From 1c623e3cbf43f12dd4a72712079bfa247a9b8ba3 Mon Sep 17 00:00:00 2001
From: Zizhen Liu <pointerliu@126.com>
Date: Thu, 22 Oct 2026 18:42:17 +0800
Subject: [PATCH 0001/1982] net: skbuff: propagate shared-frag marker in
 skb_zerocopy()

commit 79dc34beb1fdb3da79753e51e15c68591a2561fe upstream.

skb_zerocopy() moves frag descriptors from @from into @to and takes a
reference on each frag, but it does not copy skb_shinfo(from)->flags into
skb_shinfo(to)->flags.  A destination skb holding the same page-cache
backed frags as the source therefore reports skb_has_shared_frag() as
false.

That breaks the invariant relied on by later in-place writers.  ESP input
checks skb_has_shared_frag() before deciding whether an uncloned
nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
decrypted in place, letting an unprivileged user write into the page
cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
the other frag-transfer helpers.

Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb to another")
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
Cc: stable@kernel.org
Signed-off-by: Zizhen Liu <pointerliu@126.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261022104217.1852191-1-pointerliu@126.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ sashal: Adjusted context in skb_zerocopy() due to missing from->unreadable propagation. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index cdce2f72fbeafa..1808bed195af17 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3883,6 +3883,8 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 	}
 	skb_shinfo(to)->nr_frags = j;
 
+	skb_shinfo(to)->flags |= skb_shinfo(from)->flags & SKBFL_SHARED_FRAG;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(skb_zerocopy);

From 49675f7bc0e1ae12a60f6af5cb2b800eb39fe055 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 30 Sep 2026 20:39:53 +0900
Subject: [PATCH 0002/1982] ksmbd: wait for negotiation before receiving
 another PDU

[ Upstream commit 68f410faedaf6ee74d81e574733c50ebcc1bd8ed ]

The receive thread queues a request and can read the next PDU before
the negotiation worker finishes. While need_neg is set, the next PDU
can cause ksmbd_init_smb_server() to replace conn->ops. A pipelined
SMB2 request can therefore make the worker handle an earlier, shorter
SMB1 request with SMB2 operations and read beyond its buffer.

An SMB1 multi-protocol negotiate may be followed by an SMB2 NEGOTIATE
that changes conn->ops again. Wait for work queued while the connection
is new or needs negotiation to complete before reading another PDU.
This keeps the operations stable for both stages of negotiation without
changing when need_neg is cleared.

Fixes: dc8289f91238 ("ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr")
Reported-by: ihopenre-eng <ihopenre@gmail.com>
Reviewed-by: ihopenre-eng <ihopenre@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/server.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index e7af6353a641fa..85f14d1cc0cd36 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -291,6 +291,7 @@ static void handle_ksmbd_work(struct work_struct *wk)
 static int queue_ksmbd_work(struct ksmbd_conn *conn)
 {
 	struct ksmbd_work *work;
+	bool wait_for_neg = ksmbd_conn_new(conn) || ksmbd_conn_need_negotiate(conn);
 	int err;
 
 	err = ksmbd_init_smb_server(conn);
@@ -313,6 +314,10 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn)
 	conn->last_active = jiffies;
 	INIT_WORK(&work->work, handle_ksmbd_work);
 	ksmbd_queue_work(work);
+	/* Negotiation can change conn->ops, finish it before reading another PDU. */
+	if (wait_for_neg)
+		wait_event(conn->req_running_q,
+			   atomic_read(&conn->req_running) == 0);
 	return 0;
 }
 

From 62be46110a2c2bbbe08d4fb70c243bb67f1c9115 Mon Sep 17 00:00:00 2001
From: Baolin Wang <baolin.wang@linux.alibaba.com>
Date: Wed, 28 Oct 2026 00:39:03 +0800
Subject: [PATCH 0003/1982] mm: vmscan: fix dirty folios throttling on cgroup
 v1 for MGLRU

[ Upstream commit 13b6b620910436c29dea398382e83c9499fd13e4 ]

The balance_dirty_pages() won't do the dirty folios throttling on
cgroupv1.  See commit 9badce000e2c ("cgroup, writeback: don't enable
cgroup writeback on traditional hierarchies").

Moreover, after commit 6b0dfabb3555 ("fs: Remove aops->writepage"), we no
longer attempt to write back filesystem folios through reclaim.

On large memory systems, the flusher may not be able to write back quickly
enough.  Consequently, MGLRU will encounter many folios that are already
under writeback.  Since we cannot reclaim these dirty folios, the system
may run out of memory and trigger the OOM killer.

Hence, for cgroup v1, let's throttle reclaim after waking up the flusher,
which is similar to commit 81a70c21d917 ("mm/cgroup/reclaim: fix dirty
pages throttling on cgroup v1"), to avoid unnecessary OOM.

The following test program can easily reproduce the OOM issue.  With this
patch applied, the test passes successfully.

$mkdir /sys/fs/cgroup/memory/test
$echo 256M > /sys/fs/cgroup/memory/test/memory.limit_in_bytes
$echo $$ > /sys/fs/cgroup/memory/test/cgroup.procs
$dd if=/dev/zero of=/mnt/data.bin bs=1M count=800

Link: https://lore.kernel.org/3445af0f09e8ca945492e052e82594f8c4f2e2f6.1774606060.git.baolin.wang@linux.alibaba.com
Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation")
Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Kairui Song <kasong@tencent.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Leno Hou <lenohou@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmscan.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2c66fbcd6e8450..c983815bde5bfc 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -4901,9 +4901,24 @@ static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
 	 * If too many file cache in the coldest generation can't be evicted
 	 * due to being dirty, wake up the flusher.
 	 */
-	if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken)
+	if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken) {
+		struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+
 		wakeup_flusher_threads(WB_REASON_VMSCAN);
 
+		/*
+		 * For cgroupv1 dirty throttling is achieved by waking up
+		 * the kernel flusher here and later waiting on folios
+		 * which are in writeback to finish (see shrink_folio_list()).
+		 *
+		 * Flusher may not be able to issue writeback quickly
+		 * enough for cgroupv1 writeback throttling to work
+		 * on a large system.
+		 */
+		if (!writeback_throttling_sane(sc))
+			reclaim_throttle(pgdat, VMSCAN_THROTTLE_WRITEBACK);
+	}
+
 	/* whether this lruvec should be rotated */
 	return nr_to_scan < 0;
 }

From fb1e15ddd94ced53fb000283f1d2bf658eb42b97 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <dhs@frame.work>
Date: Thu, 23 Jul 2026 01:18:58 +0800
Subject: [PATCH 0004/1982] iio: hid-sensor: als: scale each channel
 individually
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cad928dad9a4c26aa56b4223dc2a29bca517fb5f ]

Some sensors have multiple channels (not just brightness but color ALS
sensors) with different scaling factors.

Signed-off-by: Daniel Schaefer <dhs@frame.work>
Link: https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/merge_requests/413
Tested-by: Sven Vainküla <sven@xn--vainkla-r2a.ee> #Asus ProArt PX13 laptop.
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/light/hid-sensor-als.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 384572844162c6..232cb58e0a9ffd 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -33,9 +33,9 @@ struct als_state {
 		u32 illum[CHANNEL_SCAN_INDEX_MAX];
 		aligned_s64 timestamp;
 	} scan;
-	int scale_pre_decml;
-	int scale_post_decml;
-	int scale_precision;
+	int scale_pre_decml[CHANNEL_SCAN_INDEX_MAX];
+	int scale_post_decml[CHANNEL_SCAN_INDEX_MAX];
+	int scale_precision[CHANNEL_SCAN_INDEX_MAX];
 	int value_offset;
 	int num_channels;
 	s64 timestamp;
@@ -186,9 +186,11 @@ static int als_read_raw(struct iio_dev *indio_dev,
 		ret_type = IIO_VAL_INT;
 		break;
 	case IIO_CHAN_INFO_SCALE:
-		*val = als_state->scale_pre_decml;
-		*val2 = als_state->scale_post_decml;
-		ret_type = als_state->scale_precision;
+		if (chan->scan_index >= CHANNEL_SCAN_INDEX_MAX)
+			return -EINVAL;
+		*val = als_state->scale_pre_decml[chan->scan_index];
+		*val2 = als_state->scale_post_decml[chan->scan_index];
+		ret_type = als_state->scale_precision[chan->scan_index];
 		break;
 	case IIO_CHAN_INFO_OFFSET:
 		*val = als_state->value_offset;
@@ -338,6 +340,10 @@ static int als_parse_report(struct platform_device *pdev,
 		als_adjust_channel_bit_mask(channels, index, st->als[i].size);
 		++index;
 
+		st->scale_precision[i] = hid_sensor_format_scale(usage_id,
+					&st->als[i], &st->scale_pre_decml[i],
+					&st->scale_post_decml[i]);
+
 		dev_dbg(&pdev->dev, "als %x:%x\n", st->als[i].index,
 			st->als[i].report_id);
 	}
@@ -347,10 +353,6 @@ static int als_parse_report(struct platform_device *pdev,
 	if (index)
 		ret = 0;
 
-	st->scale_precision = hid_sensor_format_scale(usage_id,
-				&st->als[CHANNEL_SCAN_INDEX_INTENSITY],
-				&st->scale_pre_decml, &st->scale_post_decml);
-
 	return ret;
 }
 

From 220705d574388b3c1361096ed9a5fac0d0651dbb Mon Sep 17 00:00:00 2001
From: Ridham Khurana <khurana.ridham222@gmail.com>
Date: Mon, 21 Sep 2026 20:41:47 +0000
Subject: [PATCH 0005/1982] platform: cznic: turris-omnia-mcu: Add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 59797443846bc2451c35816026bbb79d281c9f23 ]

The driver wires of_omnia_mcu_match into the i2c_driver's
.of_match_table but never exports it with MODULE_DEVICE_TABLE(), so no
module alias is generated and the module is not autoloaded when the MCU
is probed from the device tree.

Found by code inspection. Not tested on the hardware itself; with the
module built, the alias lookup

  $ modprobe -R 'of:Nsystem-controllerT(null)Ccznic,turris-omnia-mcu'

reports no match before this change and resolves to turris_omnia_mcu
after it.

Fixes: 992f1a3d4e88 ("platform: cznic: Add preliminary support for Turris Omnia MCU")
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260921204204.797294-1-khurana.ridham222@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/cznic/turris-omnia-mcu-base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/cznic/turris-omnia-mcu-base.c b/drivers/platform/cznic/turris-omnia-mcu-base.c
index e8fc0d7b334342..f0416302a1f3c1 100644
--- a/drivers/platform/cznic/turris-omnia-mcu-base.c
+++ b/drivers/platform/cznic/turris-omnia-mcu-base.c
@@ -403,6 +403,7 @@ static const struct of_device_id of_omnia_mcu_match[] = {
 	{ .compatible = "cznic,turris-omnia-mcu" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, of_omnia_mcu_match);
 
 static struct i2c_driver omnia_mcu_driver = {
 	.probe		= omnia_mcu_probe,

From 1a1ed9ba4386db6472ba743ef2014d66c301f8f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@linaro.org>
Date: Thu, 29 Oct 2026 11:03:26 +0000
Subject: [PATCH 0006/1982] kbuild: link-vmlinux.sh: improve detection of third
 pass requirement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 14b8b4bf2d7bd5d58c17adbeed0edfda1dfc1a7f upstream.

It can happen that symbol sizes within .tmp_vmlinux1.kallsyms.o and
.tmp_vmlinux2.kallsyms.o differ, without affecting file size on disk
because of section alignment and/or padding emitted by the assembler.

link-vmlinux.sh doesn't detect this case currently and keeps using
.tmp_vmlinux2.kallsyms.o to link the final vmlinux. Due to the
different symbol sizes, other symbols are shifted within the final
image compared to .tmp_vmlinux2, and the final comparison of System.map
against "${kallsyms_sysmap}" fails with the message:

    Inconsistent kallsyms data
    Try "make KALLSYMS_EXTRA_PASS=1" as a workaround

This can happen in particular if the linker emits additional symbols
that might have different names between our (re-)linking steps, e.g.
because those names depend on the virtual address of the symbol. Linker
stubs for ARM errata work-arounds are one such case.

These changed symbol names can cause the output of the token
compression of kallsyms.c to change due to the changed symbol substring
count, which in turn can change the size of the kallsyms_names symbol
itself, causing the potential shift of subsequent symbol addresses in
.tmp_vmlinux2.kallsyms.o and therefore the final image.

Update link-vmlinux.sh to not rely on file size of
.tmp_vmlinux?.kallsyms.o alone but to also consider symbol offsets
within to resolve this, and do a third pass if required.

Signed-off-by: André Draszik <andre.draszik@linaro.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Nicolas Schier <nsc@kernel.org>
[AD: adjust context]
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/link-vmlinux.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 433849ff7529e1..050791ea102354 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -133,6 +133,18 @@ gen_btf()
 	btf_vmlinux_bin_o=${btf_data}
 }
 
+# Check if kallsymso_prev and kallsymso differ
+# If symbol sizes within ${kallsymso} change, any symbols within vmlinux are
+# likely to shift, invalidating ${kallsymso}.
+# Since file size can remain unchanged even if symbol sizes change, compare the
+# actual symbols instead of relying on file size only.
+kallsymso_changed()
+{
+	${NM} -n "${kallsymso_prev}" > "${kallsymso_prev}.sym"
+	${NM} -n "${kallsymso}" > "${kallsymso}.sym"
+	! cmp -s "${kallsymso_prev}.sym" "${kallsymso}.sym"
+}
+
 # Create ${2}.o file with all symbols from the ${1} object file
 kallsyms()
 {
@@ -149,6 +161,7 @@ kallsyms()
 	${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \
 	      ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} -c -o "${2}.o" "${2}.S"
 
+	kallsymso_prev="${kallsymso:-}"
 	kallsymso=${2}.o
 }
 
@@ -267,7 +280,12 @@ if is_enabled CONFIG_KALLSYMS; then
 	sysmap_and_kallsyms .tmp_vmlinux2
 	size2=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso})
 
-	if [ $size1 -ne $size2 ] || [ -n "${KALLSYMS_EXTRA_PASS}" ]; then
+	# Due to alignment, file size of the kallsymso object file might remain
+	# unchanged even if individual symbols within change size. Changed
+	# symbol sizes can still shift other symbols, though. Therefore, don't
+	# rely on file size alone.
+	if [ $size1 -ne $size2 ] || kallsymso_changed || \
+			[ -n "${KALLSYMS_EXTRA_PASS}" ]; then
 		vmlinux_link .tmp_vmlinux3
 		sysmap_and_kallsyms .tmp_vmlinux3
 	fi

From e6223dfe62a222c999d64e05306415c46d728cfd Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Thu, 5 Jun 2025 17:29:55 -0700
Subject: [PATCH 0007/1982] hwmon: (lm90) Rely on subsystem locking

[ Upstream commit e9b64fae44be190ea21c1092e96f316f90deb663 ]

Attribute access is now serialized in the hardware monitoring core,
so locking n the driver code is no longer necessary. Drop it.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm90.c | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index e1795ccde876c3..0153160552e026 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -108,7 +108,6 @@
 #include <linux/hwmon.h>
 #include <linux/kstrtox.h>
 #include <linux/module.h>
-#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/regulator/consumer.h>
 #include <linux/slab.h>
@@ -735,7 +734,6 @@ struct lm90_data {
 	struct hwmon_channel_info temp_info;
 	const struct hwmon_channel_info *info[3];
 	struct hwmon_chip_info chip;
-	struct mutex update_lock;
 	struct delayed_work alert_work;
 	struct work_struct report_work;
 	bool shutdown;		/* true if shutting down */
@@ -1230,9 +1228,9 @@ static int lm90_update_alarms(struct lm90_data *data, bool force)
 {
 	int err;
 
-	mutex_lock(&data->update_lock);
+	hwmon_lock(data->hwmon_dev);
 	err = lm90_update_alarms_locked(data, force);
-	mutex_unlock(&data->update_lock);
+	hwmon_unlock(data->hwmon_dev);
 
 	return err;
 }
@@ -1523,9 +1521,7 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val)
 	int err;
 	u16 bit;
 
-	mutex_lock(&data->update_lock);
 	err = lm90_update_device(dev);
-	mutex_unlock(&data->update_lock);
 	if (err)
 		return err;
 
@@ -1594,11 +1590,9 @@ static int lm90_temp_write(struct device *dev, u32 attr, int channel, long val)
 	struct lm90_data *data = dev_get_drvdata(dev);
 	int err;
 
-	mutex_lock(&data->update_lock);
-
 	err = lm90_update_device(dev);
 	if (err)
-		goto error;
+		return err;
 
 	switch (attr) {
 	case hwmon_temp_min:
@@ -1628,9 +1622,6 @@ static int lm90_temp_write(struct device *dev, u32 attr, int channel, long val)
 		err = -EOPNOTSUPP;
 		break;
 	}
-error:
-	mutex_unlock(&data->update_lock);
-
 	return err;
 }
 
@@ -1666,9 +1657,7 @@ static int lm90_chip_read(struct device *dev, u32 attr, int channel, long *val)
 	struct lm90_data *data = dev_get_drvdata(dev);
 	int err;
 
-	mutex_lock(&data->update_lock);
 	err = lm90_update_device(dev);
-	mutex_unlock(&data->update_lock);
 	if (err)
 		return err;
 
@@ -1714,11 +1703,9 @@ static int lm90_chip_write(struct device *dev, u32 attr, int channel, long val)
 	struct i2c_client *client = data->client;
 	int err;
 
-	mutex_lock(&data->update_lock);
-
 	err = lm90_update_device(dev);
 	if (err)
-		goto error;
+		return err;
 
 	switch (attr) {
 	case hwmon_chip_update_interval:
@@ -1732,9 +1719,6 @@ static int lm90_chip_write(struct device *dev, u32 attr, int channel, long val)
 		err = -EOPNOTSUPP;
 		break;
 	}
-error:
-	mutex_unlock(&data->update_lock);
-
 	return err;
 }
 
@@ -2805,7 +2789,6 @@ static int lm90_probe(struct i2c_client *client)
 
 	data->client = client;
 	i2c_set_clientdata(client, data);
-	mutex_init(&data->update_lock);
 	INIT_DELAYED_WORK(&data->alert_work, lm90_alert_work);
 	INIT_WORK(&data->report_work, lm90_report_alarms);
 

From 4e023a26c613e456f1c200889934211bb4b679b8 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 28 Oct 2026 15:43:45 -0400
Subject: [PATCH 0008/1982] exec: cancel io_uring requests before de_thread()

[ Upstream commit b42c85c20d84ff3e4f0f027d6596c3b3b4a20657 ]

begin_new_exec() cancels the exec'ing thread's io_uring requests after
de_thread() made it the only thread in the thread-group. Now
io_uring_task_cancel() runs task work after. If it runs a
create_worker_cb() item then a io-wq queued on the thread before the
exec creates a new io-wq worker thread.

Said thread joins the thread-group which de_thread() just took down. The
io-iwq sticks around until it notices that its workqueue is dying. But
code after de_thread() relies on being single-threaded.

Move io_uring_task_cancel() before de_thread() but behind the point of
no return. Any worker created during task work run from
io_uring_task_cancel() is just a sibling thread that de_thread() will
take down and reap.

Once io_uring_task_cancel() returned the thread has neither a task
context nor a workqueue left so nothing can add a thread behind
de_thread()'s back anymore.

Suggested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/aq0_lvHDViIpX_Mu@redhat.com
Fixes: 3bfe6106693b ("io-wq: fork worker threads from original task")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-12-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exec.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 4aa6905259591d..3f301138e65a09 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1134,6 +1134,13 @@ int begin_new_exec(struct linux_binprm * bprm)
 	 */
 	bprm->point_of_no_return = true;
 
+	/*
+	 * Cancel any io_uring activity across execve. This runs task work
+	 * that may still create an io-wq worker, so do it while de_thread()
+	 * can still zap it.
+	 */
+	io_uring_task_cancel();
+
 	/* Make this the only thread in the thread group */
 	retval = de_thread(me);
 	if (retval)
@@ -1150,10 +1157,6 @@ int begin_new_exec(struct linux_binprm * bprm)
 
 	/* see the comment in check_unsafe_exec() */
 	current->fs->in_exec = 0;
-	/*
-	 * Cancel any io_uring activity across execve
-	 */
-	io_uring_task_cancel();
 
 	/* Ensure the files table is not shared. */
 	retval = unshare_files();

From c3b9c90f32c5d7034d8e4f5544b0b82933ff7c39 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 28 Oct 2026 14:35:32 -0400
Subject: [PATCH 0009/1982] fork: move the coredump and exec checks into
 create_io_thread()

[ Upstream commit e760200370e4de054b6b5f568a7faa911e2956bb ]

Only a PF_USER_WORKER thread returns from get_signal() after a fatal
signal and can go on to create a thread. get_signal() sets PF_SIGNALED
before it dumps core and before it lets a PF_USER_WORKER thread return.
That flags sticks.

The exec'ing thread itself is never signaled. But it doesn't need the check
anyway as we moved cancellation of io_uring requests before de_thread().
create_io_thread() is the only way a signaled thread creates another
one. vhost_task_create() is reached from ioctls alone.

io_should_retry_thread() doesn't retry -EINTR, so io-wq callers give up
the same way they did when copy_process() refused.

Suggested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/aq0VLTyxNatFmLOK@redhat.com
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-13-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Stable-dep-of: 1f978881ce6c ("fork: don't create io threads once PF_POSTCOREDUMP is set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/fork.c b/kernel/fork.c
index 6734b94600333c..bf0bbd8a569e58 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2559,6 +2559,10 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
 		.user_worker	= 1,
 	};
 
+	/* A creator past its fatal signal gets no thread. */
+	if (current->flags & PF_SIGNALED)
+		return ERR_PTR(-EINTR);
+
 	return copy_process(NULL, 0, node, &args);
 }
 

From 64f2a38a1658493d7a53d656bcc483ee4b837623 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 28 Oct 2026 14:35:33 -0400
Subject: [PATCH 0010/1982] fork: don't create io threads once PF_POSTCOREDUMP
 is set

[ Upstream commit 1f978881ce6c9ac4f4d4a7b6a6e52339eadcd350 ]

zap_process() skips every thread that already has PF_POSTCOREDUMP set.
Such a thread is past synchronize_group_exit(), so a coredump can't
catch it anymore. It isn't counted in core_state->threads_remaining and
it isn't sent SIGKILL.

do_exit() sets PF_POSTCOREDUMP in synchronize_group_exit() and calls
io_uring_files_cancel() right after that. The cancellation runs task
work and a create_worker_cb() that io-wq queued before the exit creates
a new io-wq worker from there. If another thread started a coredump in
the meantime that worker joins a thread-group which is already being
dumped. zap_process() never saw it so it was never counted. But when it
exits it sees signal->core_state in synchronize_group_exit() and
decrements threads_remaining like any other thread.

So the count reaches zero one thread early and the dumper leaves
coredump_wait_inactive() while a thread it counted is still running.

The task has no fatal signal pending because zap_process() deliberately
didn't send it one, and it never went through get_signal() so it doesn't
have PF_SIGNALED either.

Refuse to create an io thread when the creator has PF_POSTCOREDUMP.
That costs nothing. io_uring_files_cancel() raises IO_WQ_BIT_EXIT
before it runs any task work, so a worker created from there only ever
gets to exit again, and io_should_retry_thread() doesn't retry -EINTR.

Clearing PF_POSTCOREDUMP for the new thread in copy_process() was the
other option. It makes the worker a thread like any other, but it only
helps while the dump hasn't started. A worker born after zap_process()
has run is invisible to it whatever its flags say and still decrements
threads_remaining on the way out. Refusing to create it covers both, and
then no task is ever born with the flag, so there is nothing to clear.

Moving io_uring_files_cancel() ahead of synchronize_group_exit() closes
the same window. It runs the cancellation, and whatever that can block
on, before the thread announces itself to the dumper. A thread that
blocks there never reaches coredump_task_exit() at all, so the dumper
ends up waiting for a thread that never parks. Refusing the creation
leaves the cancellation where it is. But it's very ugly to run io_uring
work even before we did all the generic exit work.

Fixes: 92307383082d ("coredump:  Don't perform any cleanups before dumping core")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-14-8e4adb1619e6@kernel.org
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index bf0bbd8a569e58..b7543a93f269a7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2559,8 +2559,8 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
 		.user_worker	= 1,
 	};
 
-	/* A creator past its fatal signal gets no thread. */
-	if (current->flags & PF_SIGNALED)
+	/* A creator past its fatal signal or its coredump point gets no thread. */
+	if (current->flags & (PF_SIGNALED | PF_POSTCOREDUMP))
 		return ERR_PTR(-EINTR);
 
 	return copy_process(NULL, 0, node, &args);

From 0160184fbf890e0c49080698e17451f5a8e29e26 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 28 Oct 2026 16:47:03 -0400
Subject: [PATCH 0011/1982] coredump: prevent TIF_NOTIFY_SIGNAL from
 interrupting coredumps

[ Upstream commit a58d647acfdc62561f3570d114025b3bf38ae41b ]

TIF_NOTIFY_SIGNAL is used to kick a task in uninterruptible sleep to
return to userspace and run task work and then go back to sleep. This
mechanism works well but breaks coredumps. dump_interrupted() only
allows fatal signals to interrupt a coredump and the whole regular write
path going to actual filesystems is impervious to TIF_NOTIFY_SIGNAL as
well.

However, both the usermodehelper pipe and the coredump socket will bail
early on TIF_NOTIFY_SIGNAL. This affects the following codepaths:

- coredump_sock_recv() -> unix_stream_read_generic()
  The request/ack handshake is abandoned before any coredump data is
  sent.

- anon_pipe_write() returning -ERESTARTSYS
  Once the pipe is full this truncates the coredump.

- unix_stream_sendmsg() returning -ERESTARTSYS
  Once the send buffer is full this truncates the coredump.

- coredump_sock_wait() -> __kernel_read()
  This reports a failure that didn't happen.

- wait_for_dump_helpers() -> wait_event_interruptible()
  This stops waiting for the coredump helpers.

Such truncation is entirely invisible to userspace and all uapi bits
still indicate that a successful coredump happened. A crashing process
with a bunch of file backed mappings and io_uring thrown in loses most
of the coredump data. If the NT_FILE note goes past PAGE_SIZE mappings
it's gonzo.

TIF_NOTIFY_SIGNAL is sent by io_uring for the common case. And it uses
poll without sleeping so a completion callback runs task_work_add() from
interrupt context against the task that submitted the request. This is
the task that is running the coredump. Since that task hasn't set
work_exited (it hasn't exited yet after all) TIF_NOTIFY_SIGNAL keeps
reappearing.

A coredumping task doesn't return to userspace. The task work is run at
exit. So interrupting it doesn't buy anything and just loses the
coredump which is quite valuable.

Note that this isn't specific to io_uring. There's also
klp_send_signals(), bpf_task_work_schedule_signal(), landlock's tsync
and then  technically, kthread_stop() and the printk kunit test set the
bit raw.

Link: https://patch.msgid.link/20260824-work-tif_notify_signal-v2-2-6609e42b3157@kernel.org
Fixes: 12db8b690010 ("entry: Add support for TIF_NOTIFY_SIGNAL")
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
[ sashal: adjusted context for inline coredump handling with override_creds() instead of scoped_with_creds(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/coredump.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/coredump.c b/fs/coredump.c
index 3e927378bf5bfc..b3cc7c0531ee1c 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -1131,6 +1131,8 @@ void vfs_coredump(const kernel_siginfo_t *siginfo)
 	if (coredump_wait(siginfo->si_signo, &core_state) < 0)
 		return;
 
+	/* Task work must not cut the dump short, see signal_pending(). */
+	guard(no_notify_signal)();
 	old_cred = override_creds(cred);
 
 	if (!coredump_parse(&cn, &cprm, &argv, &argc)) {

From 024b63ae8c6abb4399ad07c82c52bc2e8390c401 Mon Sep 17 00:00:00 2001
From: Tonghao Zhang <tonghao@bamaicloud.com>
Date: Sun, 18 Jan 2026 12:21:11 +0800
Subject: [PATCH 0012/1982] net: bonding: use workqueue to make sure peer
 notify updated in lacp mode

commit 11ea9b8a88dd7524c23dffc22d8173504273a9db upstream.

The rtnl lock might be locked, preventing ad_cond_set_peer_notif() from
acquiring the lock and updating send_peer_notif. This patch addresses
the issue by using a workqueue. Since updating send_peer_notif does
not require high real-time performance, such delayed updates are entirely
acceptable.

In fact, checking this value and using it in multiple places, all operations
are protected at the same time by rtnl lock, such as
- read send_peer_notif
- send_peer_notif--
- bond_should_notify_peers

By the way, rtnl lock is still required, when accessing bond.params.* for
updating send_peer_notif. In lacp mode, resetting send_peer_notif in
workqueue is safe, simple and effective way.

Additionally, this patch introduces bond_peer_notify_may_events(), which
is used to check whether an event should be sent. This function will be
used in both patch 1 and 2.

Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Jason Xing <kerneljasonxing@gmail.com>
Suggested-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Tonghao Zhang <tonghao@bamaicloud.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/f95accb5db0b10ce3ed2f834fc70f716c9abbb9c.1768709239.git.tonghao@bamaicloud.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Struan Bartlett <struan.bartlett@newsnow.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_3ad.c  |  7 +---
 drivers/net/bonding/bond_main.c | 66 ++++++++++++++++++++++++++-------
 include/net/bonding.h           |  2 +
 3 files changed, 56 insertions(+), 19 deletions(-)

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 7148dd19710a81..e82eabeb11fe65 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1014,11 +1014,8 @@ static void ad_cond_set_peer_notif(struct port *port)
 {
 	struct bonding *bond = port->slave->bond;
 
-	if (bond->params.broadcast_neighbor && rtnl_trylock()) {
-		bond->send_peer_notif = bond->params.num_peer_notif *
-			max(1, bond->params.peer_notif_delay);
-		rtnl_unlock();
-	}
+	if (bond->params.broadcast_neighbor)
+		bond_peer_notify_work_rearm(bond, 0);
 }
 
 /**
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e555c5ce4bdfae..31b1a09440bf46 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1203,6 +1203,48 @@ static bool bond_should_notify_peers(struct bonding *bond)
 	return true;
 }
 
+/* Use this to update send_peer_notif when RTNL may be held in other places. */
+void bond_peer_notify_work_rearm(struct bonding *bond, unsigned long delay)
+{
+	queue_delayed_work(bond->wq, &bond->peer_notify_work, delay);
+}
+
+/* Peer notify update handler. Holds only RTNL */
+static void bond_peer_notify_reset(struct bonding *bond)
+{
+	bond->send_peer_notif = bond->params.num_peer_notif *
+		max(1, bond->params.peer_notif_delay);
+}
+
+static void bond_peer_notify_handler(struct work_struct *work)
+{
+	struct bonding *bond = container_of(work, struct bonding,
+					    peer_notify_work.work);
+
+	if (!rtnl_trylock()) {
+		bond_peer_notify_work_rearm(bond, 1);
+		return;
+	}
+
+	bond_peer_notify_reset(bond);
+
+	rtnl_unlock();
+}
+
+/* Peer notify events post. Holds only RTNL */
+static void bond_peer_notify_may_events(struct bonding *bond, bool force)
+{
+	bool notified = false;
+
+	if (bond_should_notify_peers(bond)) {
+		notified = true;
+		call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
+	}
+
+	if (notified || force)
+		bond->send_peer_notif--;
+}
+
 /**
  * bond_change_active_slave - change the active slave into the specified one
  * @bond: our bonding struct
@@ -1278,8 +1320,6 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
 						      BOND_SLAVE_NOTIFY_NOW);
 
 		if (new_active) {
-			bool should_notify_peers = false;
-
 			bond_set_slave_active_flags(new_active,
 						    BOND_SLAVE_NOTIFY_NOW);
 
@@ -1287,19 +1327,11 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
 				bond_do_fail_over_mac(bond, new_active,
 						      old_active);
 
-			if (netif_running(bond->dev)) {
-				bond->send_peer_notif =
-					bond->params.num_peer_notif *
-					max(1, bond->params.peer_notif_delay);
-				should_notify_peers =
-					bond_should_notify_peers(bond);
-			}
-
 			call_netdevice_notifiers(NETDEV_BONDING_FAILOVER, bond->dev);
-			if (should_notify_peers) {
-				bond->send_peer_notif--;
-				call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
-							 bond->dev);
+
+			if (netif_running(bond->dev)) {
+				bond_peer_notify_reset(bond);
+				bond_peer_notify_may_events(bond, false);
 			}
 		}
 	}
@@ -4288,6 +4320,10 @@ static u32 bond_xmit_hash_xdp(struct bonding *bond, struct xdp_buff *xdp)
 
 void bond_work_init_all(struct bonding *bond)
 {
+	/* ndo_stop, bond_close() will try to flush the work under
+	 * the rtnl lock. The workqueue must not block on rtnl lock
+	 * to avoid deadlock.
+	 */
 	INIT_DELAYED_WORK(&bond->mcast_work,
 			  bond_resend_igmp_join_requests_delayed);
 	INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
@@ -4295,6 +4331,7 @@ void bond_work_init_all(struct bonding *bond)
 	INIT_DELAYED_WORK(&bond->arp_work, bond_arp_monitor);
 	INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
 	INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
+	INIT_DELAYED_WORK(&bond->peer_notify_work, bond_peer_notify_handler);
 }
 
 void bond_work_cancel_all(struct bonding *bond)
@@ -4305,6 +4342,7 @@ void bond_work_cancel_all(struct bonding *bond)
 	cancel_delayed_work_sync(&bond->ad_work);
 	cancel_delayed_work_sync(&bond->mcast_work);
 	cancel_delayed_work_sync(&bond->slave_arr_work);
+	cancel_delayed_work_sync(&bond->peer_notify_work);
 }
 
 static int bond_open(struct net_device *bond_dev)
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 45069ed6e527f9..7583c321eca62b 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -255,6 +255,7 @@ struct bonding {
 	struct   delayed_work ad_work;
 	struct   delayed_work mcast_work;
 	struct   delayed_work slave_arr_work;
+	struct   delayed_work peer_notify_work;
 #ifdef CONFIG_DEBUG_FS
 	/* debugging support via debugfs */
 	struct	 dentry *debug_dir;
@@ -712,6 +713,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
 					      int level);
 int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
 void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
+void bond_peer_notify_work_rearm(struct bonding *bond, unsigned long delay);
 void bond_work_init_all(struct bonding *bond);
 void bond_work_cancel_all(struct bonding *bond);
 

From aff15e1f648e90bac17fd571cd4c48337929f49a Mon Sep 17 00:00:00 2001
From: Tonghao Zhang <tonghao@bamaicloud.com>
Date: Sun, 18 Jan 2026 12:21:12 +0800
Subject: [PATCH 0013/1982] net: bonding: move bond_should_notify_peers, e.g.
 into rtnl lock block

commit 70fc6649b36cf22167bbd7e2a6cc0960b746316e upstream.

This patch tries to avoid the possible peer notify event loss.

In bond_mii_monitor()/bond_activebackup_arp_mon(), when we hold the rtnl lock:
- check send_peer_notif again to avoid unconditionally reducing this value.
- send_peer_notif may have been reset. Therefore, it is necessary to check
  whether to send peer notify via bond_should_notify_peers() to avoid the
  loss of notification events.

Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Jason Xing <kerneljasonxing@gmail.com>
Signed-off-by: Tonghao Zhang <tonghao@bamaicloud.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/78cef328822b94638c97638b89011c507b8bf19e.1768709239.git.tonghao@bamaicloud.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Struan Bartlett <struan.bartlett@newsnow.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c | 30 +++++++++---------------------
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 31b1a09440bf46..baafc13603d3d9 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2887,11 +2887,10 @@ static void bond_mii_monitor(struct work_struct *work)
 {
 	struct bonding *bond = container_of(work, struct bonding,
 					    mii_work.work);
-	bool should_notify_peers;
-	bool commit;
-	unsigned long delay;
-	struct slave *slave;
 	struct list_head *iter;
+	struct slave *slave;
+	unsigned long delay;
+	bool commit;
 
 	delay = msecs_to_jiffies(bond->params.miimon);
 
@@ -2900,7 +2899,6 @@ static void bond_mii_monitor(struct work_struct *work)
 
 	rcu_read_lock();
 
-	should_notify_peers = bond_should_notify_peers(bond);
 	commit = !!bond_miimon_inspect(bond);
 
 	rcu_read_unlock();
@@ -2920,12 +2918,8 @@ static void bond_mii_monitor(struct work_struct *work)
 			bond_miimon_commit(bond);
 		}
 
-		if (bond->send_peer_notif) {
-			bond->send_peer_notif--;
-			if (should_notify_peers)
-				call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
-							 bond->dev);
-		}
+		if (bond->send_peer_notif)
+			bond_peer_notify_may_events(bond, true);
 
 		rtnl_unlock();	/* might sleep, hold no other locks */
 	}
@@ -3839,7 +3833,6 @@ static bool bond_ab_arp_probe(struct bonding *bond)
 
 static void bond_activebackup_arp_mon(struct bonding *bond)
 {
-	bool should_notify_peers = false;
 	bool should_notify_rtnl = false;
 	int delta_in_ticks;
 
@@ -3850,15 +3843,12 @@ static void bond_activebackup_arp_mon(struct bonding *bond)
 
 	rcu_read_lock();
 
-	should_notify_peers = bond_should_notify_peers(bond);
-
 	if (bond_ab_arp_inspect(bond)) {
 		rcu_read_unlock();
 
 		/* Race avoidance with bond_close flush of workqueue */
 		if (!rtnl_trylock()) {
 			delta_in_ticks = 1;
-			should_notify_peers = false;
 			goto re_arm;
 		}
 
@@ -3875,15 +3865,13 @@ static void bond_activebackup_arp_mon(struct bonding *bond)
 	if (bond->params.arp_interval)
 		queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 
-	if (should_notify_peers || should_notify_rtnl) {
+	if (bond->send_peer_notif || should_notify_rtnl) {
 		if (!rtnl_trylock())
 			return;
 
-		if (should_notify_peers) {
-			bond->send_peer_notif--;
-			call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
-						 bond->dev);
-		}
+		if (bond->send_peer_notif)
+			bond_peer_notify_may_events(bond, true);
+
 		if (should_notify_rtnl) {
 			bond_slave_state_notify(bond);
 			bond_slave_link_notify(bond);

From 862d9268f40a6e10cef24eb226e738fb69ce8aa7 Mon Sep 17 00:00:00 2001
From: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
Date: Tue, 13 Oct 2026 14:35:54 +0800
Subject: [PATCH 0014/1982] ALSA: line6: Clear prev_fbuf on capture buffer
 release

commit aa118c8f61d59387961d58ffae831c5259a9f222 upstream.

A KASAN slab-use-after-free read was reported in submit_audio_out_urb()
when generating an impulse test signal:

  BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
  BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
  Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785

  Allocated by task 11:
   kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
   line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
   line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
   line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728

  Freed by task 7785:
   kfree+0xf8/0x390 mm/slub.c:6566
   line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
   line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
   __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
   line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
   snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183

line6pcm->prev_fbuf points into the capture PCM stream buffer
(line6pcm->in.buffer), which is updated during audio_in_callback() to
feed rate synchronization, software monitoring, and impulse test signal
generation on playback side.

When all capture streams are closed, line6_buffer_release() frees
pstr->buffer with kfree().  However, it does not clear line6pcm->prev_fbuf.
If playback is subsequently started (e.g. via impulse test signal
volume control snd_line6_impulse_volume_put()), submit_audio_out_urb()
dereferences the stale pointer line6pcm->prev_fbuf under in.lock,
resulting in a slab-use-after-free read.

Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing
the capture stream buffer under in.lock, ensuring that no stale buffer
pointer can be accessed by submit_audio_out_urb().

Fixes: 63e20df1e5b2 ("ALSA: line6: Reorganize PCM stream handling")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
Link: https://patch.msgid.link/20261013063554.571-1-25031212351@stu.xidian.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/line6/pcm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index f61d9f6cf754c8..8f4b47b6b71907 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -173,6 +173,14 @@ static void line6_buffer_release(struct snd_line6_pcm *line6pcm,
 	clear_bit(type, &pstr->opened);
 	if (!pstr->opened) {
 		line6_wait_clear_audio_urbs(line6pcm, pstr);
+		if (pstr == &line6pcm->in) {
+			/* prev_fbuf points into the capture buffer we are about
+			 * to free; drop it while no capture URB is in flight.
+			 */
+			guard(spinlock_irqsave)(&line6pcm->in.lock);
+			line6pcm->prev_fbuf = NULL;
+			line6pcm->prev_fsize = 0;
+		}
 		kfree(pstr->buffer);
 		pstr->buffer = NULL;
 	}

From d65d52d6370ee1675f4f8fbbcbe75c21d419038f Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas@kwiboo.se>
Date: Mon, 18 May 2026 19:37:45 +0000
Subject: [PATCH 0015/1982] drm/rockchip: dw_hdmi: Use resume_early pm ops for
 system suspend

[ Upstream commit af3a9eadc11896f6677bcb7102bfb7c84be48d2d ]

rockchip_drm_sys_resume()/drm_mode_config_helper_resume() is called
before the resume pm ops of dw-hdmi. This result in an atomic_enable()
before dw_hdmi_rockchip_resume()/dw_hdmi_resume() is called.

Resume (without changes):
- rockchip_drm_sys_resume()
  - drm_mode_config_helper_resume()
    - atomic_enable()
- dw_hdmi_rockchip_resume()
  - dw_hdmi_resume()
    - dw_hdmi_init_hw()

Change to use resume_early pm ops for system suspend to ensure pm ops
for dw-hdmi is run before rockchip-drm pm ops. Also fix a possible NULL
pointer dereference timing issue while at it.

Resume (with changes):
- dw_hdmi_rockchip_resume_early()
  - dw_hdmi_resume()
    - dw_hdmi_init_hw()
- rockchip_drm_sys_resume()
  - drm_mode_config_helper_resume()
    - atomic_enable()

Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Tested-by: Heiko Stuebner <heiko@sntech.de> #rk3328
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260518193748.2482823-12-jonas@kwiboo.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
index 727cdf768161a5..ff34aeef3a6ff5 100644
--- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
@@ -635,17 +635,18 @@ static void dw_hdmi_rockchip_remove(struct platform_device *pdev)
 	component_del(&pdev->dev, &dw_hdmi_rockchip_ops);
 }
 
-static int __maybe_unused dw_hdmi_rockchip_resume(struct device *dev)
+static int __maybe_unused dw_hdmi_rockchip_resume_early(struct device *dev)
 {
 	struct rockchip_hdmi *hdmi = dev_get_drvdata(dev);
 
-	dw_hdmi_resume(hdmi->hdmi);
+	if (hdmi)
+		dw_hdmi_resume(hdmi->hdmi);
 
 	return 0;
 }
 
 static const struct dev_pm_ops dw_hdmi_rockchip_pm = {
-	SET_SYSTEM_SLEEP_PM_OPS(NULL, dw_hdmi_rockchip_resume)
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(NULL, dw_hdmi_rockchip_resume_early)
 };
 
 struct platform_driver dw_hdmi_rockchip_pltfm_driver = {

From 350761e9892f197eeeb140abcab8a0ed68cfc577 Mon Sep 17 00:00:00 2001
From: Ryosuke Yasuoka <ryasuoka@redhat.com>
Date: Mon, 1 Jun 2026 16:53:15 +0900
Subject: [PATCH 0016/1982] drm/virtio: abort virtqueue wait on device removal
 to avoid hung task

[ Upstream commit a46991b334f663fa0e0e9c051e50587ef977ac8b ]

virtio_gpu_queue_ctrl_sgs() and virtio_gpu_queue_cursor() use
wait_event() without any abort condition when waiting for virtqueue
space. If the host device stops processing commands, these waits block
indefinitely inside a drm_dev_enter/exit() critical section. Since
drm_dev_unplug(), which is called in device removal and system shutdown
call path, blocks on synchronize_srcu() until all critical sections
complete, device removal and system shutdown also hang.

Add a vqs_released flag to virtio_gpu_device and include it in the
wait_event() condition. Set the flag and wake up both queues in a new
virtio_gpu_release_vqs() helper, called before drm_dev_unplug() in both
virtio_gpu_remove() and virtio_gpu_shutdown(). When the flag is set, the
wait returns immediately and the command is aborted, following the same
cleanup path as drm_dev_enter() failure.

Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260601-virtio-gpu_wait_event-v3-1-89530517a98a@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_drv.c | 15 +++++++++++++++
 drivers/gpu/drm/virtio/virtgpu_drv.h |  1 +
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 23 +++++++++++++++++++++--
 3 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
index d9556e1b67b10b..78cc388b434d9b 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
@@ -118,10 +118,24 @@ static int virtio_gpu_probe(struct virtio_device *vdev)
 	return ret;
 }
 
+/*
+ * Release pending virtqueue waits so the drm_dev_enter/exit() critical
+ * sections complete before drm_dev_unplug() blocks on synchronize_srcu().
+ */
+static void virtio_gpu_release_vqs(struct drm_device *dev)
+{
+	struct virtio_gpu_device *vgdev = dev->dev_private;
+
+	vgdev->vqs_released = true;
+	wake_up_all(&vgdev->ctrlq.ack_queue);
+	wake_up_all(&vgdev->cursorq.ack_queue);
+}
+
 static void virtio_gpu_remove(struct virtio_device *vdev)
 {
 	struct drm_device *dev = vdev->priv;
 
+	virtio_gpu_release_vqs(dev);
 	drm_dev_unplug(dev);
 
 	if (drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -135,6 +149,7 @@ static void virtio_gpu_shutdown(struct virtio_device *vdev)
 {
 	struct drm_device *dev = vdev->priv;
 
+	virtio_gpu_release_vqs(dev);
 	/* stop talking to the device */
 	drm_dev_unplug(dev);
 }
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 8575c7787fc369..51b78f8a8aa2e4 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -260,6 +260,7 @@ struct virtio_gpu_device {
 
 	struct virtio_gpu_queue ctrlq;
 	struct virtio_gpu_queue cursorq;
+	bool vqs_released;
 	struct kmem_cache *vbufs;
 
 	atomic_t pending_commands;
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 592ad4f9b100d9..244a791ab915e1 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -422,7 +422,19 @@ static int virtio_gpu_queue_ctrl_sgs(struct virtio_gpu_device *vgdev,
 	if (vq->num_free < elemcnt) {
 		spin_unlock(&vgdev->ctrlq.qlock);
 		virtio_gpu_notify(vgdev);
-		wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= elemcnt);
+		wait_event(vgdev->ctrlq.ack_queue,
+			   vq->num_free >= elemcnt || vgdev->vqs_released);
+		/*
+		 * Set by virtio_gpu_release_vqs() to unblock
+		 * synchronize_srcu() wait in drm_dev_unplug().
+		 */
+		if (vgdev->vqs_released) {
+			if (fence && vbuf->objs)
+				virtio_gpu_array_unlock_resv(vbuf->objs);
+			free_vbuf(vgdev, vbuf);
+			drm_dev_exit(idx);
+			return -ENODEV;
+		}
 		goto again;
 	}
 
@@ -592,7 +604,14 @@ static void virtio_gpu_queue_cursor(struct virtio_gpu_device *vgdev,
 	ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC);
 	if (ret == -ENOSPC) {
 		spin_unlock(&vgdev->cursorq.qlock);
-		wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt);
+		wait_event(vgdev->cursorq.ack_queue,
+			   vq->num_free >= outcnt || vgdev->vqs_released);
+		/* See comment in virtio_gpu_queue_ctrl_sgs(). */
+		if (vgdev->vqs_released) {
+			free_vbuf(vgdev, vbuf);
+			drm_dev_exit(idx);
+			return;
+		}
 		spin_lock(&vgdev->cursorq.qlock);
 		goto retry;
 	} else {

From 0c42724fcbcdf58c6be63760938bb258b79f933a Mon Sep 17 00:00:00 2001
From: Terry Hsiao <terry_hsiao@compal.corp-partner.google.com>
Date: Mon, 8 Jun 2026 16:03:10 +0800
Subject: [PATCH 0017/1982] drm/panel-edp: Add BOE NV116WH2-M30, BOE
 NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30

[ Upstream commit d4ae726fc08024b359e9cacf2507f1c256b9d71c ]

The raw EDIDs for each panel:

BOE NV116WH2-M30
00 ff ff ff ff ff ff 00 09 e5 6e 38 00 00 00 00
0a 24 01 04 95 1a 0e 78 03 0b 55 9a 5f 58 95 28
1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 96 1d 56 c8 50 00 26 30 30 20
36 00 00 90 10 00 00 1a b9 13 56 c8 50 00 26 30
30 20 36 00 00 90 10 00 00 1a 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
00 0d 40 ff 0a 3c 7d 0f 0c 17 7d 00 00 00 00 80

BOE NT116WHM-N21
00 ff ff ff ff ff ff 00 09 e5 79 38 00 00 00 00
08 24 01 04 95 1a 0e 78 03 3a d5 95 5c 58 94 29
24 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 38 1d 56 c8 50 00 1c 30 30 20
36 00 00 90 10 00 00 1a 7b 13 56 c8 50 00 1c 30
30 20 36 00 00 90 10 00 00 1a 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
00 0d 40 ff 0a 3c 7d 0f 0c 17 7d 00 00 00 00 7a

BOE NV116FH1-M31
00 ff ff ff ff ff ff 00 09 e5 8b 38 01 ff 00 00
0c 24 01 04 a5 1a 0e 78 03 50 d5 9c 55 52 8f 27
15 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 9a 36 80 a0 70 38 28 40 30 20
35 00 00 90 10 00 00 1a 67 24 80 a0 70 38 28 40
30 20 35 00 00 90 10 00 00 1a 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
00 0d 36 ff 0a 3c 96 0f 0b 1a 96 00 00 00 01 cd

70 20 79 02 00 20 00 0c 9a 0e 00 8b 38 00 00 00
00 0c 1a 00 21 01 1d 03 0a a2 05 80 07 38 04 88
c2 39 55 1e 15 8f 7a 32 15 02 35 54 b0 5c b0 5c
00 36 12 78 22 00 14 ff 21 02 85 7f 07 9f 00 2f
00 1f 00 37 04 27 00 02 00 04 00 81 00 15 74 1a
00 00 03 00 28 3c 00 00 53 5a 53 5a 3c 00 00 00
00 00 00 2b 00 06 27 00 28 3b 00 00 2e 00 06 80
4b b0 5c b0 5c 00 00 00 00 00 00 00 00 00 89 90

BOE NV116FH1-M30
00 ff ff ff ff ff ff 00 09 e5 8c 38 01 ff 00 00
0c 24 01 04 a5 1a 0e 78 03 50 d5 9c 55 52 8f 27
15 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 9a 36 80 a0 70 38 28 40 30 20
35 00 00 90 10 00 00 1a 67 24 80 a0 70 38 28 40
30 20 35 00 00 90 10 00 00 1a 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
00 0d 36 ff 0a 3c 96 0f 0b 1a 96 00 00 00 01 cc

70 20 79 02 00 20 00 0c 9a 0e 00 8c 38 00 00 00
00 0c 1a 00 21 01 1d 03 0a a2 05 80 07 38 04 88
c2 39 55 1e 15 8f 7a 32 15 02 35 54 b0 5c b0 5c
00 36 12 78 22 00 14 ff 21 02 85 7f 07 9f 00 2f
00 1f 00 37 04 27 00 02 00 04 00 81 00 15 74 1a
00 00 03 00 28 3c 00 00 53 5a 53 5a 3c 00 00 00
00 00 00 2b 00 06 27 00 28 3b 00 00 2e 00 06 80
4b b0 5c b0 5c 00 00 00 00 00 00 00 00 00 88 90

Signed-off-by: Terry Hsiao <terry_hsiao@compal.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260608080310.15126-3-terry_hsiao@compal.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-edp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 9ad1769885b3c2..792923b1d78780 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -2005,6 +2005,10 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0d45, &delay_200_500_e80, "NV116WHM-N4B"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0d73, &delay_200_500_e80, "NE140WUM-N6S"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ddf, &delay_200_500_e80, "NV116WHM-T01"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x386e, &delay_200_500_e80, "NV116WH2-M30"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x3879, &delay_200_500_e80, "NT116WHM-N21"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x388b, &delay_200_500_e80, "NV116FH1-M31"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x388c, &delay_200_500_e80, "NV116FH1-M30"),
 
 	EDP_PANEL_ENTRY('C', 'M', 'N', 0x1130, &delay_200_500_e50, "N116BGE-EB2"),
 	EDP_PANEL_ENTRY('C', 'M', 'N', 0x1132, &delay_200_500_e80_d50, "N116BGE-EA2"),

From 86229fb465756fda6bc8b200a1c59bbc55959742 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Mon, 30 Mar 2026 09:33:27 +0800
Subject: [PATCH 0018/1982] drm/amdgpu/mes_v12_0: use mes schedule pipe for
 legacy queues on unified MES

[ Upstream commit 5ec4cc91708370847772f2a2397316dbd8d8f066 ]

when suspend_all_gangs is issued to pipe0 MES during system suspend or runtime PM, pipe0 can only suspend and resume queues it has tracked.
KCQs registered with a non-zero pipe slot may not be correctly handled, leaving them in an inconsistent state after resume.

v3: fix the schedule pipe issue
v4: use schedule pipe for KQ resets

Reviewed-by: Michael Chen <michael.chen@amd.com>
Suggested-by: Michael Chen <michael.chen@amd.com>
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Suggested-by: Shaoyun Liu <shaoyun.liu@amd.com>
Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 27 ++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
index c40aed5a8fc214..7d7bcf1c69f279 100644
--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
@@ -524,10 +524,15 @@ static int mes_v12_0_map_legacy_queue(struct amdgpu_mes *mes,
 		convert_to_mes_queue_type(input->queue_type);
 	mes_add_queue_pkt.map_legacy_kq = 1;
 
-	if (mes->adev->enable_uni_mes)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
+	if (mes->adev->enable_uni_mes) {
+		/* Keep scheduler queue on KIQ pipe; map all other kernel queues on sched pipe. */
+		if (input->queue_type == AMDGPU_RING_TYPE_MES)
+			pipe = AMDGPU_MES_KIQ_PIPE;
+		else
+			pipe = AMDGPU_MES_SCHED_PIPE;
+	} else {
 		pipe = AMDGPU_MES_SCHED_PIPE;
+	}
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_add_queue_pkt, sizeof(mes_add_queue_pkt),
@@ -563,10 +568,15 @@ static int mes_v12_0_unmap_legacy_queue(struct amdgpu_mes *mes,
 			convert_to_mes_queue_type(input->queue_type);
 	}
 
-	if (mes->adev->enable_uni_mes)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
+	if (mes->adev->enable_uni_mes) {
+		/* Keep scheduler queue on KIQ pipe; unmap all other kernel queues on sched pipe. */
+		if (input->queue_type == AMDGPU_RING_TYPE_MES)
+			pipe = AMDGPU_MES_KIQ_PIPE;
+		else
+			pipe = AMDGPU_MES_SCHED_PIPE;
+	} else {
 		pipe = AMDGPU_MES_SCHED_PIPE;
+	}
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_remove_queue_pkt, sizeof(mes_remove_queue_pkt),
@@ -909,10 +919,7 @@ static int mes_v12_0_reset_hw_queue(struct amdgpu_mes *mes,
 		mes_reset_queue_pkt.doorbell_offset = input->doorbell_offset;
 	}
 
-	if (input->is_kq)
-		pipe = AMDGPU_MES_KIQ_PIPE;
-	else
-		pipe = AMDGPU_MES_SCHED_PIPE;
+	pipe = AMDGPU_MES_SCHED_PIPE;
 
 	return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
 			&mes_reset_queue_pkt, sizeof(mes_reset_queue_pkt),

From 29000475b125d1c8dda42d704b7d6bfa293a658c Mon Sep 17 00:00:00 2001
From: Asad Kamal <asad.kamal@amd.com>
Date: Wed, 3 Jun 2026 02:03:33 +0800
Subject: [PATCH 0019/1982] drm/amd/pm: Validate OD DPM triples before mutating
 tables

[ Upstream commit b390cb9d776039fc4f0be13b2649299079227d12 ]

vega10_odn_edit_dpm_table() and smu7_odn_edit_dpm_table() could mutate
the live ODN table for valid triples, then return 0 after detecting a
truncated buffer or out-of-range index. Validate all (index, clock,
voltage) triples first and return -EINVAL on any failure; only then
apply updates.

v2: Use distinct message for different error case, removed unused
input_level from validation loop (Lijo)

v3: Reject negative level indices, input[] is long but was compared only
against unsigned table bounds, so negative values could pass and truncate
when assigned to uint32_t input_level.

Set DPMTABLE_OD_UPDATE_SCLK/MCLK only after validation passes,
so a failed sysfs write does not leave need_update_dpm_table set for a
later commit.

Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c   | 34 ++++++++++-------
 .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 37 ++++++++++++-------
 2 files changed, 43 insertions(+), 28 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index ba953654a0206f..cf008ed409552d 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -5661,23 +5661,29 @@ static int smu7_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	}
 
 	for (i = 0; i < size; i += 3) {
-		if (i + 3 > size || input[i] >= podn_dpm_table_in_backend->num_of_pl) {
-			pr_info("invalid clock voltage input \n");
-			return 0;
+		if (i + 3 > size) {
+			pr_info("truncated clock/voltage input\n");
+			return -EINVAL;
 		}
-		input_level = input[i];
-		input_clk = input[i+1] * 100;
-		input_vol = input[i+2];
-
-		if (smu7_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol)) {
-			podn_dpm_table_in_backend->entries[input_level].clock = input_clk;
-			podn_vdd_dep_in_backend->entries[input_level].clk = input_clk;
-			podn_dpm_table_in_backend->entries[input_level].vddc = input_vol;
-			podn_vdd_dep_in_backend->entries[input_level].vddc = input_vol;
-			podn_vdd_dep_in_backend->entries[input_level].vddgfx = input_vol;
-		} else {
+		if (input[i] < 0 || input[i] >= podn_dpm_table_in_backend->num_of_pl) {
+			pr_info("invalid clock/voltage level\n");
 			return -EINVAL;
 		}
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		if (!smu7_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol))
+			return -EINVAL;
+	}
+
+	for (i = 0; i < size; i += 3) {
+		input_level = input[i];
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		podn_dpm_table_in_backend->entries[input_level].clock = input_clk;
+		podn_vdd_dep_in_backend->entries[input_level].clk = input_clk;
+		podn_dpm_table_in_backend->entries[input_level].vddc = input_vol;
+		podn_vdd_dep_in_backend->entries[input_level].vddc = input_vol;
+		podn_vdd_dep_in_backend->entries[input_level].vddgfx = input_vol;
 	}
 
 	return 0;
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
index b3fed2a478aabf..d6aaba0b3613de 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -5645,11 +5645,9 @@ static int vega10_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	if (PP_OD_EDIT_SCLK_VDDC_TABLE == type) {
 		dpm_table = &data->dpm_table.gfx_table;
 		podn_vdd_dep_table = &data->odn_dpm_table.vdd_dep_on_sclk;
-		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
 	} else if (PP_OD_EDIT_MCLK_VDDC_TABLE == type) {
 		dpm_table = &data->dpm_table.mem_table;
 		podn_vdd_dep_table = &data->odn_dpm_table.vdd_dep_on_mclk;
-		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
 	} else if (PP_OD_RESTORE_DEFAULT_TABLE == type) {
 		memcpy(&(data->dpm_table), &(data->golden_dpm_table), sizeof(struct vega10_dpm_table));
 		vega10_odn_initial_default_setting(hwmgr);
@@ -5667,21 +5665,32 @@ static int vega10_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
 	}
 
 	for (i = 0; i < size; i += 3) {
-		if (i + 3 > size || input[i] >= podn_vdd_dep_table->count) {
-			pr_info("invalid clock voltage input\n");
-			return 0;
+		if (i + 3 > size) {
+			pr_info("truncated clock/voltage input\n");
+			return -EINVAL;
 		}
-		input_level = input[i];
-		input_clk = input[i+1] * 100;
-		input_vol = input[i+2];
-
-		if (vega10_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol)) {
-			dpm_table->dpm_levels[input_level].value = input_clk;
-			podn_vdd_dep_table->entries[input_level].clk = input_clk;
-			podn_vdd_dep_table->entries[input_level].vddc = input_vol;
-		} else {
+		if (input[i] < 0 || input[i] >= podn_vdd_dep_table->count) {
+			pr_info("invalid clock/voltage level\n");
 			return -EINVAL;
 		}
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		if (!vega10_check_clk_voltage_valid(hwmgr, type, input_clk, input_vol))
+			return -EINVAL;
+	}
+
+	if (type == PP_OD_EDIT_SCLK_VDDC_TABLE)
+		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
+	else
+		data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
+
+	for (i = 0; i < size; i += 3) {
+		input_level = input[i];
+		input_clk = input[i + 1] * 100;
+		input_vol = input[i + 2];
+		dpm_table->dpm_levels[input_level].value = input_clk;
+		podn_vdd_dep_table->entries[input_level].clk = input_clk;
+		podn_vdd_dep_table->entries[input_level].vddc = input_vol;
 	}
 	vega10_odn_update_soc_table(hwmgr, type);
 	return 0;

From 7a8c7e9212c35e69a8c385d79fdcd7c403f1cf37 Mon Sep 17 00:00:00 2001
From: Asad Kamal <asad.kamal@amd.com>
Date: Wed, 3 Jun 2026 17:30:29 +0800
Subject: [PATCH 0020/1982] drm/amdgpu: Gate debugfs MMIO access on kernel
 lockdown

[ Upstream commit 17ac73b24006700f50972d37e297dec1f523c14a ]

amdgpu_regs, amdgpu_regs2, and related debugfs nodes allow
arbitrary MMIO read/write via RREG32/WREG32 without checking
security_locked_down(). On kernel_lockdown=integrity systems
this bypasses the same restrictions as /dev/mem and PCI config
space sysfs.

Check LOCKDOWN_PCI_ACCESS (matching pci-sysfs) at the entry of every
debugfs handler that performs direct register access.

v2: Use consistent check as per previous check to use
LOCKDOWN_DEBUGFS(Lijo)

v3: Do not create any entry from amdgpu_debugfs_regs_init() if
LOCKDOWN_PCI_ACCESS is active and log once. (Lijo)

Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 04939a9711e957..c7535ef0ae401d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -26,6 +26,7 @@
 #include <linux/kthread.h>
 #include <linux/pci.h>
 #include <linux/uaccess.h>
+#include <linux/security.h>
 #include <linux/pm_runtime.h>
 
 #include "amdgpu.h"
@@ -1646,6 +1647,12 @@ int amdgpu_debugfs_regs_init(struct amdgpu_device *adev)
 	struct dentry *ent, *root = minor->debugfs_root;
 	unsigned int i;
 
+	if (security_locked_down(LOCKDOWN_PCI_ACCESS)) {
+		drm_info(adev_to_drm(adev),
+			 "amdgpu: HW debugfs nodes disabled (kernel lockdown)\n");
+		return 0;
+	}
+
 	for (i = 0; i < ARRAY_SIZE(debugfs_regs); i++) {
 		ent = debugfs_create_file(debugfs_regs_names[i],
 					  S_IFREG | 0400, root,

From 95437a99037738e926aeb38bd645f792dc88ab71 Mon Sep 17 00:00:00 2001
From: Charlene Liu <Charlene.Liu@amd.com>
Date: Thu, 21 May 2026 20:36:01 -0400
Subject: [PATCH 0021/1982] drm/amd/display: fix max dispclk_khz/dppclk_khz
 double 1000

[ Upstream commit f48124ff35357d05a98d9cd5cb7982e7e5509003 ]

[why]
Fix regresson caused by double roundup and index out of range

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Reviewed-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
index 08f7f03b102313..0167d936feaf55 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
@@ -152,16 +152,16 @@ static void dml21_calculate_rq_and_dlg_params(const struct dc *dc, struct dc_sta
 	context->bw_ctx.bw.dcn.clk.bw_dispclk_khz = context->bw_ctx.bw.dcn.clk.dispclk_khz;
 	if (in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values > 1) {
 		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz =
-			in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values] * 1000;
+			in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.num_clk_values - 1];
 	} else {
-		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[0] * 1000;
+		context->bw_ctx.bw.dcn.clk.max_supported_dispclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dispclk.clk_values_khz[0];
 	}
 
 	if (in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values > 1) {
 		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz =
-			in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values] * 1000;
+			in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.num_clk_values - 1];
 	} else {
-		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[0] * 1000;
+		context->bw_ctx.bw.dcn.clk.max_supported_dppclk_khz = in_ctx->v21.dml_init.soc_bb.clk_table.dppclk.clk_values_khz[0];
 	}
 
 	/* get global mall allocation */

From d09f84813b4a67e1c2ca734335569fc61739cd7c Mon Sep 17 00:00:00 2001
From: Ruoyu Wang <ruoyuw560@gmail.com>
Date: Mon, 8 Jun 2026 14:36:38 +0800
Subject: [PATCH 0022/1982] drm/radeon: avoid double free in r600 DPM cleanup

[ Upstream commit d3f30034f861a585f8e487ae1555d9f288a96f87 ]

r600_parse_extended_power_table() uses manual kfree() calls for some
early allocation failures, but the freed pointers are left in the
dynamic power-management state. If device teardown later calls
r600_free_extended_power_table(), those stale pointers can be freed
again.

Use the common extended power table cleanup helper for those early
failure paths as well, and clear each pointer after freeing it so
repeated cleanup stays safe.

Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/r600_dpm.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 81d58ef667dd48..2bc0bdfd115904 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -933,7 +933,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}
@@ -944,8 +944,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}
@@ -956,9 +955,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 			ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk,
 							       dep_table);
 			if (ret) {
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
-				kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries);
+				r600_free_extended_power_table(rdev);
 				return ret;
 			}
 		}
@@ -1298,17 +1295,29 @@ void r600_free_extended_power_table(struct radeon_device *rdev)
 	struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state;
 
 	kfree(dyn_state->vddc_dependency_on_sclk.entries);
+	dyn_state->vddc_dependency_on_sclk.entries = NULL;
 	kfree(dyn_state->vddci_dependency_on_mclk.entries);
+	dyn_state->vddci_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->vddc_dependency_on_mclk.entries);
+	dyn_state->vddc_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->mvdd_dependency_on_mclk.entries);
+	dyn_state->mvdd_dependency_on_mclk.entries = NULL;
 	kfree(dyn_state->cac_leakage_table.entries);
+	dyn_state->cac_leakage_table.entries = NULL;
 	kfree(dyn_state->phase_shedding_limits_table.entries);
+	dyn_state->phase_shedding_limits_table.entries = NULL;
 	kfree(dyn_state->ppm_table);
+	dyn_state->ppm_table = NULL;
 	kfree(dyn_state->cac_tdp_table);
+	dyn_state->cac_tdp_table = NULL;
 	kfree(dyn_state->vce_clock_voltage_dependency_table.entries);
+	dyn_state->vce_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->uvd_clock_voltage_dependency_table.entries);
+	dyn_state->uvd_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->samu_clock_voltage_dependency_table.entries);
+	dyn_state->samu_clock_voltage_dependency_table.entries = NULL;
 	kfree(dyn_state->acp_clock_voltage_dependency_table.entries);
+	dyn_state->acp_clock_voltage_dependency_table.entries = NULL;
 }
 
 enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev,

From 9614f912f9aec21bd1a6b70c6871e437b1fc302d Mon Sep 17 00:00:00 2001
From: Gangliang Xie <ganglxie@amd.com>
Date: Tue, 16 Jun 2026 17:04:47 +0800
Subject: [PATCH 0023/1982] drm/amdgpu: add buf length check

[ Upstream commit 473f99e4a262776141366f7fb10f101d0f22b019 ]

add buf length check before using it to access data

Signed-off-by: Gangliang Xie <ganglxie@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 0d3c18f04ac360..8ae72c862d1128 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -166,7 +166,8 @@ static ssize_t ta_if_load_debugfs_write(struct file *fp, const char *buf, size_t
 	if (ret)
 		return -EFAULT;
 
-	if (ta_bin_len > PSP_1_MEG)
+	if (ta_bin_len < sizeof(struct common_firmware_header) ||
+	    ta_bin_len > PSP_1_MEG)
 		return -EINVAL;
 
 	copy_pos += sizeof(uint32_t);
@@ -321,6 +322,8 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	ret = copy_from_user((void *)&shared_buf_len, &buf[copy_pos], sizeof(uint32_t));
 	if (ret)
 		return -EFAULT;
+	if (!shared_buf_len || shared_buf_len > PSP_1_MEG)
+		return -EINVAL;
 	copy_pos += sizeof(uint32_t);
 
 	shared_buf = memdup_user(&buf[copy_pos], shared_buf_len);

From e0f1d03b9a648bcbc47216332676c4f450aa8061 Mon Sep 17 00:00:00 2001
From: YiPeng Chai <YiPeng.Chai@amd.com>
Date: Tue, 16 Jun 2026 16:18:22 +0800
Subject: [PATCH 0024/1982] drm/amdgpu: add bounds check to prevent array
 overflow

[ Upstream commit db15c49a17b8fab9ada38f3a548e5353d7d6b1a8 ]

Add bounds check to prevent array overflow.

v2:
  Add warning messages.

Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 16ae44e131ad4c..b03d4225725890 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -4814,6 +4814,13 @@ static void amdgpu_register_bad_pages_mca_notifier(struct amdgpu_device *adev)
 	 * Use this list instead of mgpu_info to find the amdgpu
 	 * device on which the UMC error was reported.
 	 */
+	if (mce_adev_list.num_gpu >= MAX_GPU_INSTANCE) {
+		dev_warn_ratelimited(adev->dev,
+			"mce_adev_list full, skip notifier registration (max=%d)\n",
+			MAX_GPU_INSTANCE);
+		return;
+	}
+
 	mce_adev_list.devs[mce_adev_list.num_gpu++] = adev;
 
 	/*

From 220414ffec1b692b8930cefbdf30367cc30926b6 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Wed, 24 Jun 2026 13:37:44 +0800
Subject: [PATCH 0025/1982] gpio: pca9570: Use I2C match data

[ Upstream commit 415c63896b76fd98883e190bc7518383cb01779c ]

The driver stores chip metadata in both the OF match table and the I2C
id table, but probe currently reads it with device_get_match_data().
That helper only returns firmware-node match data, so an I2C-id/modalias
match can leave chip_data NULL before the driver dereferences it to read
ngpio.

Use i2c_get_match_data() so the I2C id table driver_data is consumed
when firmware match data is not present.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624053744.72612-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-pca9570.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-pca9570.c b/drivers/gpio/gpio-pca9570.c
index c5a1287079a063..f7cc3fbf453363 100644
--- a/drivers/gpio/gpio-pca9570.c
+++ b/drivers/gpio/gpio-pca9570.c
@@ -128,7 +128,7 @@ static int pca9570_probe(struct i2c_client *client)
 	gpio->chip.get = pca9570_get;
 	gpio->chip.set = pca9570_set;
 	gpio->chip.base = -1;
-	gpio->chip_data = device_get_match_data(&client->dev);
+	gpio->chip_data = i2c_get_match_data(client);
 	gpio->chip.ngpio = gpio->chip_data->ngpio;
 	gpio->chip.can_sleep = true;
 

From c51a3ad1477cf476367369b2b36d69ad61878bbb Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Mon, 15 Jun 2026 15:19:57 +0200
Subject: [PATCH 0026/1982] selftests/filesystems/overlayfs: fix
 set_layers_via_fds link error

[ Upstream commit e5804b1024193c91ff2648403beda882cb4f8b6c ]

set_layers_via_fds.c calls open_tree() directly, but that wrapper is
not provided by all C libraries, so the test fails to link with
"undefined reference to open_tree" on toolchains without it.

Use sys_open_tree() from ../wrappers.h, the syscall wrapper already
used for move_mount(), fsmount() and friends here.  This is also a
prerequisite for building the new idmapped_mounts test added to this
directory.

Link: https://patch.msgid.link/20260615-work-idmapped-overlayfs-v1-8-7381632aa402@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../filesystems/overlayfs/set_layers_via_fds.c   | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
index dc0449fa628f80..d4a645ec88636e 100644
--- a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
+++ b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c
@@ -624,7 +624,7 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds)
 
 	ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/set_layers_via_fds_tmpfs", MOVE_MOUNT_F_EMPTY_PATH), 0);
 
-	fd_tmp = open_tree(fd_tmpfs, "u", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	fd_tmp = sys_open_tree(fd_tmpfs, "u", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(fd_tmp, 0);
 
 	layer_fds[0] = openat(fd_tmp, "upper", O_CLOEXEC | O_DIRECTORY | O_PATH);
@@ -633,25 +633,25 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds)
 	layer_fds[1] = openat(fd_tmp, "work", O_CLOEXEC | O_DIRECTORY | O_PATH);
 	ASSERT_GE(layer_fds[1], 0);
 
-	layer_fds[2] = open_tree(fd_tmpfs, "l1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[2] = sys_open_tree(fd_tmpfs, "l1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[2], 0);
 
-	layer_fds[3] = open_tree(fd_tmpfs, "l2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[3] = sys_open_tree(fd_tmpfs, "l2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[3], 0);
 
-	layer_fds[4] = open_tree(fd_tmpfs, "l3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[4] = sys_open_tree(fd_tmpfs, "l3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[4], 0);
 
-	layer_fds[5] = open_tree(fd_tmpfs, "l4", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[5] = sys_open_tree(fd_tmpfs, "l4", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[5], 0);
 
-	layer_fds[6] = open_tree(fd_tmpfs, "d1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[6] = sys_open_tree(fd_tmpfs, "d1", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[6], 0);
 
-	layer_fds[7] = open_tree(fd_tmpfs, "d2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[7] = sys_open_tree(fd_tmpfs, "d2", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[7], 0);
 
-	layer_fds[8] = open_tree(fd_tmpfs, "d3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	layer_fds[8] = sys_open_tree(fd_tmpfs, "d3", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
 	ASSERT_GE(layer_fds[8], 0);
 
 	ASSERT_EQ(close(fd_tmpfs), 0);

From bd78ad6bfa958b2077fc493043fc63814a2720f5 Mon Sep 17 00:00:00 2001
From: Ruoyu Wang <ruoyuw560@gmail.com>
Date: Wed, 17 Jun 2026 15:20:35 +0800
Subject: [PATCH 0027/1982] HID: wacom: avoid copying Bluetooth input reports

[ Upstream commit 8310cdeefc8a14d2093c3234b570c7805c20bcbf ]

wacom_intuos_bt_irq() duplicates the received Bluetooth report with
kmemdup() so that it can pass 10-byte input report payloads to the
common Intuos parser. The helper then copies each payload back into
wacom->data before calling wacom_intuos_irq().

Avoid the allocation and copy by temporarily pointing wacom->data at the
current 10-byte payload while the common parser runs, then restoring the
original report pointer. The Bluetooth report parser keeps using the
original report buffer for dispatch and battery parsing, while the common
parser sees the same payload bytes as before.

This also removes the unchecked kmemdup() result from the Bluetooth IRQ
path.

Suggested-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/wacom_wac.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index af76e49fd0f258..8feb8027be95e7 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1192,8 +1192,11 @@ static int int_dist(int x1, int y1, int x2, int y2)
 static void wacom_intuos_bt_process_data(struct wacom_wac *wacom,
 		unsigned char *data)
 {
-	memcpy(wacom->data, data, 10);
+	u8 *saved_data = wacom->data;
+
+	wacom->data = data;
 	wacom_intuos_irq(wacom);
+	wacom->data = saved_data;
 
 	input_sync(wacom->pen_input);
 	if (wacom->pad_input)
@@ -1202,7 +1205,7 @@ static void wacom_intuos_bt_process_data(struct wacom_wac *wacom,
 
 static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)
 {
-	u8 *data = kmemdup(wacom->data, len, GFP_KERNEL);
+	u8 *data = wacom->data;
 	int i = 1;
 	unsigned power_raw, battery_capacity, bat_charging, ps_connected;
 
@@ -1242,7 +1245,6 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)
 		break;
 	}
 
-	kfree(data);
 	return 0;
 }
 

From 5073bafe7a8f828028a9dad83e47b132f0bcd1e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kry=C5=A1tof=20=C4=8Cern=C3=BD?= <cleverline1mc@gmail.com>
Date: Fri, 12 Jun 2026 09:55:07 +0200
Subject: [PATCH 0028/1982] w1: ds2482: add OF device match table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 53f33fd74d3993af0fbb5494b5be709f6ca6b712 ]

Add an of_device_id table and hook it into the i2c driver so the
ds2482/ds2484 can be matched and auto-probed from Device Tree.

This allows automatic module loading when instantiated via DT.

Signed-off-by: Kryštof Černý <cleverline1mc@gmail.com>
Link: https://patch.msgid.link/20260612-w1-of-autoload-v1-1-74e8a17626e6@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/w1/masters/ds2482.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c
index 0c93bf338a6ef1..e91c7b0f3617cb 100644
--- a/drivers/w1/masters/ds2482.c
+++ b/drivers/w1/masters/ds2482.c
@@ -549,9 +549,17 @@ static const struct i2c_device_id ds2482_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, ds2482_id);
 
+static const struct of_device_id ds2482_of_match[] = {
+	{ .compatible = "maxim,ds2482", },
+	{ .compatible = "maxim,ds2484", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, ds2482_of_match);
+
 static struct i2c_driver ds2482_driver = {
 	.driver = {
 		.name	= "ds2482",
+		.of_match_table  = ds2482_of_match,
 	},
 	.probe		= ds2482_probe,
 	.remove		= ds2482_remove,

From 8c804241ce99af312577cdc97634aa8bea06ae1d Mon Sep 17 00:00:00 2001
From: Fu Hao <fuhao@open-hieco.net>
Date: Mon, 15 Jun 2026 20:22:40 +0800
Subject: [PATCH 0029/1982] ALSA: hda: Add support for Hygon family 18h model
 5h HD-Audio

[ Upstream commit 41212ff3e4ed475d9f91d26b5324075087702987 ]

Add the new PCI ID 0x1d94 0x14a9 for Hygon family 18h model 5h
HDA controller.

Signed-off-by: Fu Hao <fuhao@open-hieco.net>
Link: https://patch.msgid.link/8b38f2941375553e4246167736c6acb5a541e833.1781523812.git.fuhao@open-hieco.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/controllers/intel.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
index 98367b87d8017f..f07fc5dc5cede6 100644
--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -100,6 +100,8 @@ enum {
 #define ATIHDMI_NUM_CAPTURE	0
 #define ATIHDMI_NUM_PLAYBACK	8
 
+/* Hygon HD Audio controller */
+#define PCI_DEVICE_ID_HYGON_18H_M05H_HDA	0x14a9
 
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
 static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;
@@ -241,6 +243,7 @@ enum {
 	AZX_DRIVER_ZHAOXIN,
 	AZX_DRIVER_ZHAOXINHDMI,
 	AZX_DRIVER_LOONGSON,
+	AZX_DRIVER_HYGON,
 	AZX_DRIVER_GENERIC,
 	AZX_NUM_DRIVERS, /* keep this as last entry */
 };
@@ -357,6 +360,7 @@ static const char * const driver_short_names[] = {
 	[AZX_DRIVER_ZHAOXIN] = "HDA Zhaoxin",
 	[AZX_DRIVER_ZHAOXINHDMI] = "HDA Zhaoxin HDMI",
 	[AZX_DRIVER_LOONGSON] = "HDA Loongson",
+	[AZX_DRIVER_HYGON] = "HDA Hygon",
 	[AZX_DRIVER_GENERIC] = "HD-Audio Generic",
 };
 
@@ -2814,6 +2818,9 @@ static const struct pci_device_id azx_ids[] = {
 	  .driver_data = AZX_DRIVER_LOONGSON | AZX_DCAPS_NO_TCSEL },
 	{ PCI_VDEVICE(LOONGSON, PCI_DEVICE_ID_LOONGSON_HDMI),
 	  .driver_data = AZX_DRIVER_LOONGSON | AZX_DCAPS_NO_TCSEL },
+	/* Hygon HDAudio */
+	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_HYGON_18H_M05H_HDA),
+	  .driver_data = AZX_DRIVER_HYGON | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_NO_MSI },
 	{ 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);

From b97aa8f8ec988b60fea9f9579ee8d4ab66c9cc97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?=
 <nfraprado@collabora.com>
Date: Fri, 26 Jun 2026 11:47:22 -0400
Subject: [PATCH 0030/1982] ALSA: hda: Force resume if acomp notified during
 system suspend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c0933934d5d96fc641e8d0025f9099e554a7b47a ]

Currently if an HDMI cable is connected while the system is suspended,
the HDMI audio jack status stays off after resume.

This is due to the jack state not being synced by the HDA HDMI codec
device's runtime resume, as that never happens if the device was runtime
suspended before the system suspended, or by the acomp notification
triggered from the DRM side if that happens before the HDA HDMI codec
device has resumed.

To fix this, if snd_hda_hdmi_acomp_pin_eld_notify() gets called before
the HDA HDMI codec device has resumed, mark it to be forcefully runtime
resumed at the next PM complete time.

Do this using a separate acomp_requested_resume flag that can be
temporarily set without overwriting forced_resume for drivers that
always want to force resume.

Assisted-by: Copilot:claude-sonnet-4.6
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Link: https://patch.msgid.link/20260626-hda-force-resume-eld-notify-v1-1-a92cb01393e0@collabora.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/hda_codec.h    | 1 +
 sound/hda/codecs/hdmi/hdmi.c | 4 +++-
 sound/hda/common/codec.c     | 5 ++++-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
index 3c9e64dc025243..b801943f0667ff 100644
--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -257,6 +257,7 @@ struct hda_codec {
 	unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
 	unsigned int relaxed_resume:1;	/* don't resume forcibly for jack */
 	unsigned int forced_resume:1; /* forced resume for jack */
+	unsigned int acomp_requested_resume:1; /* resume requested by acomp */
 	unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */
 	unsigned int ctl_dev_id:1; /* old control element id build behaviour */
 	unsigned int eld_jack_detect:1;	/* Machine jack-detection by ELD */
diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index f427d04176e920..42e4dc0949ec9d 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -2236,8 +2236,10 @@ void snd_hda_hdmi_acomp_pin_eld_notify(void *audio_ptr, int port, int dev_id)
 	/* skip notification during system suspend (but not in runtime PM);
 	 * the state will be updated at resume
 	 */
-	if (codec->core.dev.power.power_state.event == PM_EVENT_SUSPEND)
+	if (codec->core.dev.power.power_state.event == PM_EVENT_SUSPEND) {
+		codec->acomp_requested_resume = 1;
 		return;
+	}
 
 	snd_hda_hdmi_check_presence_and_report(codec, pin_nid, dev_id);
 }
diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index 164906e2f00f4f..8cab9321771940 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -2949,8 +2949,11 @@ static void hda_codec_pm_complete(struct device *dev)
 		dev->power.power_state = PMSG_RESUME;
 
 	if (pm_runtime_suspended(dev) && (codec->jackpoll_interval ||
-	    hda_codec_need_resume(codec) || codec->forced_resume))
+	    hda_codec_need_resume(codec) || codec->forced_resume ||
+	    codec->acomp_requested_resume)) {
+		codec->acomp_requested_resume = 0;
 		pm_request_resume(dev);
+	}
 }
 
 static int hda_codec_pm_suspend(struct device *dev)

From 54116b5fc4d0af29ce65274ec5bdcea3ca21a54c Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Wed, 24 Jun 2026 22:40:15 +0800
Subject: [PATCH 0031/1982] media: cec: stm32: return an error when log-address
 wait times out

[ Upstream commit 3bc2e4a26465386332ee1a40219d8dafba335b0b ]

stm32_cec_adap_log_addr() waits for TXSOM to clear before disabling CEC
and updating the logical address registers. The wait result is ignored,
so a timeout can still be reported as a successful logical address
update.

Return the polling error before touching the address registers. Compute
the address mask only for valid logical addresses so the invalid-address
path does not evaluate a shift based on CEC_LOG_ADDR_INVALID.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/platform/stm32/stm32-cec.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/media/cec/platform/stm32/stm32-cec.c b/drivers/media/cec/platform/stm32/stm32-cec.c
index 8c2fc232202de2..29418966a98ef2 100644
--- a/drivers/media/cec/platform/stm32/stm32-cec.c
+++ b/drivers/media/cec/platform/stm32/stm32-cec.c
@@ -194,18 +194,24 @@ static int stm32_cec_adap_enable(struct cec_adapter *adap, bool enable)
 static int stm32_cec_adap_log_addr(struct cec_adapter *adap, u8 logical_addr)
 {
 	struct stm32_cec *cec = adap->priv;
-	u32 oar = (1 << logical_addr) << 16;
 	u32 val;
+	int ret;
 
 	/* Poll every 100µs the register CEC_CR to wait end of transmission */
-	regmap_read_poll_timeout(cec->regmap, CEC_CR, val, !(val & TXSOM),
-				 100, CEC_XFER_TIMEOUT_MS * 1000);
+	ret = regmap_read_poll_timeout(cec->regmap, CEC_CR, val, !(val & TXSOM),
+				       100, CEC_XFER_TIMEOUT_MS * 1000);
+	if (ret)
+		return ret;
+
 	regmap_update_bits(cec->regmap, CEC_CR, CECEN, 0);
 
-	if (logical_addr == CEC_LOG_ADDR_INVALID)
+	if (logical_addr == CEC_LOG_ADDR_INVALID) {
 		regmap_update_bits(cec->regmap, CEC_CFGR, OAR, 0);
-	else
+	} else {
+		u32 oar = BIT(logical_addr) << 16;
+
 		regmap_update_bits(cec->regmap, CEC_CFGR, oar, oar);
+	}
 
 	regmap_update_bits(cec->regmap, CEC_CR, CECEN, CECEN);
 

From 41088f2032937beefaf9c8f4ca40e1ea28a5918a Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Fri, 19 Jun 2026 01:00:26 +0800
Subject: [PATCH 0032/1982] ALSA: usb-audio: Release components on probe errors

[ Upstream commit 3213bf9885e3356fff12ac18b12d4c2fb4687734 ]

usb_audio_probe() can create USB-audio component resources before the
first interface is recorded in chip->num_interfaces.  If a later probe
step fails, the error path drops chip->active and frees the card directly
when no interfaces have been registered.

Normal disconnect first releases USB-audio components in a fixed order
before the card is freed.  The first-interface probe error path skipped
that sequence, so partially initialized PCM, endpoint, MIDI, media, or
mixer resources could be left for the card private_free path without their
disconnect handling having run.

Move the existing normal-disconnect component release sequence into a
helper and call it from the zero-interface probe error path before
snd_card_free().  Keep the normal disconnect ordering unchanged: PCM
streams, endpoint resources, MIDI 1.0 resources, MIDI 2.0 resources, media
device cleanup, then mixer resources.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Link: https://patch.msgid.link/20260618170026.192212-1-zzzccc427@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/card.c | 70 ++++++++++++++++++++++++++----------------------
 1 file changed, 38 insertions(+), 32 deletions(-)

diff --git a/sound/usb/card.c b/sound/usb/card.c
index 85249606a6b184..d8e096f71412a5 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -904,6 +904,40 @@ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
 	return 0;
 }
 
+static void usb_audio_disconnect_components(struct snd_usb_audio *chip)
+{
+	struct snd_usb_stream *as;
+	struct snd_usb_endpoint *ep;
+	struct usb_mixer_interface *mixer;
+	struct list_head *p;
+
+	/* release the pcm resources */
+	list_for_each_entry(as, &chip->pcm_list, list) {
+		snd_usb_stream_disconnect(as);
+	}
+	/* release the endpoint resources */
+	list_for_each_entry(ep, &chip->ep_list, list) {
+		snd_usb_endpoint_release(ep);
+	}
+	/* release the midi resources */
+	list_for_each(p, &chip->midi_list) {
+		snd_usbmidi_disconnect(p);
+	}
+	snd_usb_midi_v2_disconnect_all(chip);
+	/*
+	 * Nice to check quirk && quirk->shares_media_device and
+	 * then call the snd_media_device_delete(). Don't have
+	 * access to the quirk here. snd_media_device_delete()
+	 * accesses mixer_list
+	 */
+	snd_media_device_delete(chip);
+
+	/* release mixer resources */
+	list_for_each_entry(mixer, &chip->mixer_list, list) {
+		snd_usb_mixer_disconnect(mixer);
+	}
+}
+
 /*
  * probe the active usb device
  *
@@ -1076,8 +1110,10 @@ static int usb_audio_probe(struct usb_interface *intf,
 		 * decrement before memory is possibly returned.
 		 */
 		atomic_dec(&chip->active);
-		if (!chip->num_interfaces)
+		if (!chip->num_interfaces) {
+			usb_audio_disconnect_components(chip);
 			snd_card_free(chip->card);
+		}
 	}
 	return err;
 }
@@ -1090,49 +1126,19 @@ static bool __usb_audio_disconnect(struct usb_interface *intf,
 				   struct snd_usb_audio *chip,
 				   struct snd_card *card)
 {
-	struct list_head *p;
-
 	guard(mutex)(&register_mutex);
 
 	if (platform_ops && platform_ops->disconnect_cb)
 		platform_ops->disconnect_cb(chip);
 
 	if (atomic_inc_return(&chip->shutdown) == 1) {
-		struct snd_usb_stream *as;
-		struct snd_usb_endpoint *ep;
-		struct usb_mixer_interface *mixer;
-
 		/* wait until all pending tasks done;
 		 * they are protected by snd_usb_lock_shutdown()
 		 */
 		wait_event(chip->shutdown_wait,
 			   !atomic_read(&chip->usage_count));
 		snd_card_disconnect(card);
-		/* release the pcm resources */
-		list_for_each_entry(as, &chip->pcm_list, list) {
-			snd_usb_stream_disconnect(as);
-		}
-		/* release the endpoint resources */
-		list_for_each_entry(ep, &chip->ep_list, list) {
-			snd_usb_endpoint_release(ep);
-		}
-		/* release the midi resources */
-		list_for_each(p, &chip->midi_list) {
-			snd_usbmidi_disconnect(p);
-		}
-		snd_usb_midi_v2_disconnect_all(chip);
-		/*
-		 * Nice to check quirk && quirk->shares_media_device and
-		 * then call the snd_media_device_delete(). Don't have
-		 * access to the quirk here. snd_media_device_delete()
-		 * accesses mixer_list
-		 */
-		snd_media_device_delete(chip);
-
-		/* release mixer resources */
-		list_for_each_entry(mixer, &chip->mixer_list, list) {
-			snd_usb_mixer_disconnect(mixer);
-		}
+		usb_audio_disconnect_components(chip);
 	}
 
 	if (chip->quirk_flags & QUIRK_FLAG_DISABLE_AUTOSUSPEND)

From 65f32bb18f5e452294ac24dc167d0166cd92fb5b Mon Sep 17 00:00:00 2001
From: Kemeng Shi <shikemeng@huaweicloud.com>
Date: Tue, 23 Jun 2026 15:51:32 +0800
Subject: [PATCH 0033/1982] irqdomain: Plug leak in
 irq_domain_alloc_irqs_locked() error path

[ Upstream commit 13856e22217fbf7c1200633716ff87ccb50fd89a ]

When irq_domain_trim_hierarchy() fails in irq_domain_alloc_irqs_locked(),
the error handling path fails to undo the hierarchy allocations.

Add the missing cleanup.

[ tglx: Massage change log ]

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623075134.4432-2-shikemeng@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index dc473faadcc812..cca2f01115aa03 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1621,7 +1621,7 @@ static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base,
 	for (i = 0; i < nr_irqs; i++) {
 		ret = irq_domain_trim_hierarchy(virq + i);
 		if (ret)
-			goto out_free_irq_data;
+			goto out_free_irqs;
 	}
 
 	for (i = 0; i < nr_irqs; i++)
@@ -1629,6 +1629,8 @@ static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base,
 
 	return virq;
 
+out_free_irqs:
+	irq_domain_free_irqs_hierarchy(domain, virq, nr_irqs);
 out_free_irq_data:
 	irq_domain_free_irq_data(virq, nr_irqs);
 out_free_desc:

From f6e11b1c35a682fa6fc63d2d7f87255fb511d299 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 14:44:56 +0800
Subject: [PATCH 0034/1982] ASoC: sma1303: remove fault-check sysfs group on
 remove

[ Upstream commit ce3733792d38ade8df8ce288a96ff0c6ad858bf3 ]

sma1303_i2c_probe() creates a sysfs group that exposes the fault-check
controls. The check_fault_status store callback can queue
check_fault_work.

sma1303_i2c_remove() only cancels the delayed work. It does not remove
the sysfs group, so the controls can remain published after remove while
their callbacks still use the driver data and can queue the work again.

Remove the sysfs group before cancelling the delayed work.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260615064456.28615-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/sma1303.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/sma1303.c b/sound/soc/codecs/sma1303.c
index 980c48cbc3482b..e07ec1bbf2d50e 100644
--- a/sound/soc/codecs/sma1303.c
+++ b/sound/soc/codecs/sma1303.c
@@ -1787,6 +1787,8 @@ static void sma1303_i2c_remove(struct i2c_client *client)
 	struct sma1303_priv *sma1303 =
 		(struct sma1303_priv *) i2c_get_clientdata(client);
 
+	if (sma1303->attr_grp)
+		sysfs_remove_group(sma1303->kobj, sma1303->attr_grp);
 	cancel_delayed_work_sync(&sma1303->check_fault_work);
 }
 

From 69b25b97d439b244ce147f9383de56e27eb991bf Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 16 Jun 2026 23:11:29 +0800
Subject: [PATCH 0035/1982] spi: qpic-snand: free OOB buffer with ECC context

[ Upstream commit 5504e50ffbcf97b3b6ed3740532497922c96a1f1 ]

qcom_spi_ecc_init_ctx_pipelined() allocates qspi->oob_buf as part of the
pipelined ECC context setup. The buffer is then used by the raw and ECC
page I/O paths through the NAND ECC context.

The matching cleanup callback only frees the qpic_ecc structure, and the
init error path also skips the OOB buffer after it has been allocated.
Free qspi->oob_buf on both paths and clear the pointer so the ECC context
teardown owns all resources allocated during init.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260616151129.76060-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-qpic-snand.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
index 222e4aa7ee488b..919e847c061db7 100644
--- a/drivers/spi/spi-qpic-snand.c
+++ b/drivers/spi/spi-qpic-snand.c
@@ -394,14 +394,19 @@ static int qcom_spi_ecc_init_ctx_pipelined(struct nand_device *nand)
 	return 0;
 
 err_free_ecc_cfg:
+	kfree(snandc->qspi->oob_buf);
+	snandc->qspi->oob_buf = NULL;
 	kfree(ecc_cfg);
 	return ret;
 }
 
 static void qcom_spi_ecc_cleanup_ctx_pipelined(struct nand_device *nand)
 {
+	struct qcom_nand_controller *snandc = nand_to_qcom_snand(nand);
 	struct qpic_ecc *ecc_cfg = nand_to_ecc_ctx(nand);
 
+	kfree(snandc->qspi->oob_buf);
+	snandc->qspi->oob_buf = NULL;
 	kfree(ecc_cfg);
 }
 
@@ -1660,4 +1665,3 @@ module_platform_driver(qcom_spi_driver);
 MODULE_DESCRIPTION("SPI driver for QPIC QSPI cores");
 MODULE_AUTHOR("Md Sadre Alam <quic_mdalam@quicinc.com>");
 MODULE_LICENSE("GPL");
-

From 2f5641f9740eaecefc528e34420503ba452a8e8b Mon Sep 17 00:00:00 2001
From: William Theesfeld <william@theesfeld.net>
Date: Mon, 1 Jun 2026 16:35:00 -0400
Subject: [PATCH 0036/1982] clk: zynq: handle kasprintf() failure in periph_clk
 registration

[ Upstream commit d4d0d335e8d37c6c7e1c5664c7664288eca5a09b ]

zynq_clk_register_periph_clk() ignores the return value of the two
kasprintf() calls used to build the mux and divider clock names, and
passes the resulting (possibly NULL) pointers straight into
clk_register_mux(), clk_register_divider() and clk_register_gate() as
the clock '"'name'"' argument.  On allocation failure that name later
gets dereferenced by the clock framework (e.g. in debugfs name
formatting), causing a NULL-pointer dereference.

Check both kasprintf() returns.  On failure unwind any allocated name
buffer and the spinlock, then fall through to the existing err label
which sets clks[] to ERR_PTR(-ENOMEM).  Freeing the spinlock on the
error path is correct here because no clk_register_*() call has had
a chance to take ownership of it; the success path intentionally
hands it off to the registered clocks.

The neighbouring zynq_clk_register_fclk() in the same file already
uses this per-allocation goto-label cleanup pattern; this change
brings periph_clk into line with it.

Signed-off-by: William Theesfeld <william@theesfeld.net>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/zynq/clkc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
index c28d3dacf0fb22..db40a9e7dd3d95 100644
--- a/drivers/clk/zynq/clkc.c
+++ b/drivers/clk/zynq/clkc.c
@@ -186,7 +186,11 @@ static void __init zynq_clk_register_periph_clk(enum zynq_clk clk0,
 	spin_lock_init(lock);
 
 	mux_name = kasprintf(GFP_KERNEL, "%s_mux", clk_name0);
+	if (!mux_name)
+		goto err_mux_name;
 	div_name = kasprintf(GFP_KERNEL, "%s_div", clk_name0);
+	if (!div_name)
+		goto err_div_name;
 
 	clk_register_mux(NULL, mux_name, parents, 4,
 			CLK_SET_RATE_NO_REPARENT, clk_ctrl, 4, 2, 0, lock);
@@ -205,6 +209,10 @@ static void __init zynq_clk_register_periph_clk(enum zynq_clk clk0,
 
 	return;
 
+err_div_name:
+	kfree(mux_name);
+err_mux_name:
+	kfree(lock);
 err:
 	clks[clk0] = ERR_PTR(-ENOMEM);
 	if (two_gates)

From 32b1dce444ace86469af043e85010c3dc3392e86 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 14:45:48 +0800
Subject: [PATCH 0037/1982] ASoC: tlv320aic26: remove keyclick sysfs file

[ Upstream commit ae375f8d063d71e598c0d7e14fc056154c84d7a7 ]

aic26_probe() creates the keyclick sysfs file on the component device.
The file callback uses the ASoC component pointer stored in the driver
private data.

There is no matching remove callback, so the sysfs file can remain after
the component is removed while its backing component state is gone.

Add a component remove callback that removes the keyclick file.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260615064549.34110-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/tlv320aic26.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/codecs/tlv320aic26.c b/sound/soc/codecs/tlv320aic26.c
index e5dfb3d752a3af..84e954311c1b25 100644
--- a/sound/soc/codecs/tlv320aic26.c
+++ b/sound/soc/codecs/tlv320aic26.c
@@ -320,8 +320,14 @@ static int aic26_probe(struct snd_soc_component *component)
 	return 0;
 }
 
+static void aic26_remove(struct snd_soc_component *component)
+{
+	device_remove_file(component->dev, &dev_attr_keyclick);
+}
+
 static const struct snd_soc_component_driver aic26_soc_component_dev = {
 	.probe			= aic26_probe,
+	.remove			= aic26_remove,
 	.controls		= aic26_snd_controls,
 	.num_controls		= ARRAY_SIZE(aic26_snd_controls),
 	.dapm_widgets		= tlv320aic26_dapm_widgets,

From 709c3865ede5e9c595fc867e4b168d029d4f4f39 Mon Sep 17 00:00:00 2001
From: Haoxiang Li <haoxiang_li2024@163.com>
Date: Mon, 22 Jun 2026 23:11:27 +0800
Subject: [PATCH 0038/1982] ASoC: hdac_hdmi: Fix resource cleanup on probe
 failure

[ Upstream commit 785903b7770f19ea05b8a76081dff691c56fa771 ]

hdac_hdmi_dev_probe() gets the HDA link before allocating and
initializing the HDMI codec private data. Several later error
paths return directly without dropping the link reference,
leaving the hlink refcount unbalanced.

Release the link reference on probe failures. Also turn display
power off if the failure happens after it has been enabled.

This issue was dicussed in:
https://lore.kernel.org/all/s5h1s0esk8o.wl-tiwai@suse.de/
I think the paths fixed here are probe failure paths: the device
has not been fully initialized or bound, and runtime PM suspend
cannot be relied on to balance the reference taken during probe.

Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260622151127.1198196-1-haoxiang_li2024@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/hdac_hdmi.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 2385e18127a338..1ca5e7aa42aca4 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1861,8 +1861,10 @@ static int hdac_hdmi_dev_probe(struct hdac_device *hdev)
 	snd_hdac_ext_bus_link_get(hdev->bus, hlink);
 
 	hdmi_priv = devm_kzalloc(&hdev->dev, sizeof(*hdmi_priv), GFP_KERNEL);
-	if (hdmi_priv == NULL)
+	if (hdmi_priv == NULL) {
+		snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 		return -ENOMEM;
+	}
 
 	snd_hdac_register_chmap_ops(hdev, &hdmi_priv->chmap);
 	hdmi_priv->chmap.ops.get_chmap = hdac_hdmi_get_chmap;
@@ -1871,8 +1873,10 @@ static int hdac_hdmi_dev_probe(struct hdac_device *hdev)
 	hdmi_priv->chmap.ops.get_spk_alloc = hdac_hdmi_get_spk_alloc;
 	hdmi_priv->hdev = hdev;
 
-	if (!hdac_id)
+	if (!hdac_id) {
+		snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 		return -ENODEV;
+	}
 
 	if (hdac_id->driver_data)
 		hdmi_priv->drv_data =
@@ -1897,6 +1901,8 @@ static int hdac_hdmi_dev_probe(struct hdac_device *hdev)
 	if (ret < 0) {
 		dev_err(&hdev->dev,
 			"Failed in parse and map nid with err: %d\n", ret);
+		snd_hdac_ext_bus_link_put(hdev->bus, hlink);
+		snd_hdac_display_power(hdev->bus, hdev->addr, false);
 		return ret;
 	}
 	snd_hdac_refresh_widgets(hdev);

From 62549edc55291564652f169fe3977c29c9b15dbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?=
 <u.kleine-koenig@baylibre.com>
Date: Fri, 26 Jun 2026 08:04:23 +0200
Subject: [PATCH 0039/1982] regmap: maple: Workaround for another
 false-positive compiler warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dffd32eb2b0e714a8ae23f98518ad7152cb06369 ]

Similar to the issue fixed in commit 542440fd7b30 ("regmap: maple: work
around gcc-14.1 false-positive warning"), I see an uninitialized warning
for upper_index and upper_last.

Happens with arc-linux-gnu-gcc (Debian 15.3.0-1) 15.3.0 on an
allmodconfig for ARCH=arc.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260626060427.2548578-2-u.kleine-koenig@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regcache-maple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
index 38a648efa60690..040fe03f66143a 100644
--- a/drivers/base/regmap/regcache-maple.c
+++ b/drivers/base/regmap/regcache-maple.c
@@ -112,7 +112,7 @@ static int regcache_maple_drop(struct regmap *map, unsigned int min,
 	unsigned long *entry, *lower, *upper;
 	/* initialized to work around false-positive -Wuninitialized warning */
 	unsigned long lower_index = 0, lower_last = 0;
-	unsigned long upper_index, upper_last;
+	unsigned long upper_index = 0, upper_last = 0;
 	int ret = 0;
 
 	lower = NULL;

From b220b2bb99b3c8e7b3c79afd0daed6eada4095a2 Mon Sep 17 00:00:00 2001
From: Joe Simmons-Talbott <joest@redhat.com>
Date: Fri, 26 Jun 2026 16:29:22 -0400
Subject: [PATCH 0040/1982] selftests/cgroup: Adjust cpu test duration based on
 HZ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a2703c2980c0776e9be7d8f9e144afd054dddb12 ]

For lower HZ values a quota of 1000us is much lower than the amount
of microseconds per tick which makes the tests test_cpucg_max and
test_cpugc_max_nested fail. Increase the test duration to accommodate
for lower HZ values.

Link: https://lore.kernel.org/lkml/20260625203307.1114538-1-joest@redhat.com/
Signed-off-by: Joe Simmons-Talbott <joest@redhat.com>
Acked-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../cgroup/lib/include/cgroup_util.h          |  1 +
 tools/testing/selftests/cgroup/test_cpu.c     | 43 ++++++++++++++++---
 2 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
index 7ab2824ed7b54d..b9cd00e0e83493 100644
--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
@@ -8,6 +8,7 @@
 
 #define MB(x) (x << 20)
 
+#define NSEC_PER_USEC	1000L
 #define USEC_PER_SEC	1000000L
 #define NSEC_PER_SEC	1000000000L
 
diff --git a/tools/testing/selftests/cgroup/test_cpu.c b/tools/testing/selftests/cgroup/test_cpu.c
index d54e2317efff22..de60967279668d 100644
--- a/tools/testing/selftests/cgroup/test_cpu.c
+++ b/tools/testing/selftests/cgroup/test_cpu.c
@@ -639,6 +639,31 @@ test_cpucg_nested_weight_underprovisioned(const char *root)
 	return run_cpucg_nested_weight_test(root, false);
 }
 
+/*
+ * Best effort attempt to get the kernel's HZ value from the config.
+ * Return the HZ value if found otherwise return 1000 (the default) to
+ * indicate failure.
+ */
+static long
+get_config_hz(void)
+{
+	long hz = 1000;
+	FILE *f;
+	char cmd[256] = "zcat /proc/config.gz 2>/dev/null | grep '^CONFIG_HZ='";
+
+	f = popen(cmd, "r");
+
+	if (!f)
+		return hz;
+
+	if (fscanf(f, "CONFIG_HZ=%ld", &hz) == EOF)
+		goto out;
+
+out:
+	pclose(f);
+	return hz;
+}
+
 /*
  * This test creates a cgroup with some maximum value within a period, and
  * verifies that a process in the cgroup is not overscheduled.
@@ -646,15 +671,18 @@ test_cpucg_nested_weight_underprovisioned(const char *root)
 static int test_cpucg_max(const char *root)
 {
 	int ret = KSFT_FAIL;
+	long hz = get_config_hz();
 	long quota_usec = 1000;
 	long default_period_usec = 100000; /* cpu.max's default period */
 	long duration_seconds = 1;
 
-	long duration_usec = duration_seconds * USEC_PER_SEC;
+	long duration_usec;
 	long usage_usec, n_periods, remainder_usec, expected_usage_usec;
 	char *cpucg;
 	char quota_buf[32];
 
+	duration_usec = duration_seconds * USEC_PER_SEC * 1000 / hz;
+
 	snprintf(quota_buf, sizeof(quota_buf), "%ld", quota_usec);
 
 	cpucg = cg_name(root, "cpucg_test");
@@ -670,8 +698,8 @@ static int test_cpucg_max(const char *root)
 	struct cpu_hog_func_param param = {
 		.nprocs = 1,
 		.ts = {
-			.tv_sec = duration_seconds,
-			.tv_nsec = 0,
+			.tv_sec = duration_usec / USEC_PER_SEC,
+			.tv_nsec = duration_usec % USEC_PER_SEC * NSEC_PER_USEC,
 		},
 		.clock_type = CPU_HOG_CLOCK_WALL,
 	};
@@ -710,15 +738,18 @@ static int test_cpucg_max(const char *root)
 static int test_cpucg_max_nested(const char *root)
 {
 	int ret = KSFT_FAIL;
+	long hz = get_config_hz();
 	long quota_usec = 1000;
 	long default_period_usec = 100000; /* cpu.max's default period */
 	long duration_seconds = 1;
 
-	long duration_usec = duration_seconds * USEC_PER_SEC;
+	long duration_usec;
 	long usage_usec, n_periods, remainder_usec, expected_usage_usec;
 	char *parent, *child;
 	char quota_buf[32];
 
+	duration_usec = duration_seconds * USEC_PER_SEC * 1000 / hz;
+
 	snprintf(quota_buf, sizeof(quota_buf), "%ld", quota_usec);
 
 	parent = cg_name(root, "cpucg_parent");
@@ -741,8 +772,8 @@ static int test_cpucg_max_nested(const char *root)
 	struct cpu_hog_func_param param = {
 		.nprocs = 1,
 		.ts = {
-			.tv_sec = duration_seconds,
-			.tv_nsec = 0,
+			.tv_sec = duration_usec / USEC_PER_SEC,
+			.tv_nsec = duration_usec % USEC_PER_SEC * NSEC_PER_USEC,
 		},
 		.clock_type = CPU_HOG_CLOCK_WALL,
 	};

From ee5298ac5f2b3ace3aa056a5d5aa8d2c066633a8 Mon Sep 17 00:00:00 2001
From: Mithil Bavishi <bavishimithil@gmail.com>
Date: Wed, 3 Jun 2026 22:40:48 -0700
Subject: [PATCH 0041/1982] ARM: OMAP2+: Add CFI type for omap4_finish_suspend

[ Upstream commit 4a7b197ad28d71f9fac873f283b4408df3fdb287 ]

With CONFIG_CFI enabled, OMAP4 can trap in omap4_enter_lowpower()
because omap_pm_ops.finish_suspend points directly to the assembly
routine omap4_finish_suspend, which lacks the expected KCFI type
metadata.

Annotate omap4_finish_suspend with SYM_TYPED_FUNC_START so the assembly
routine carries the KCFI type metadata.

Signed-off-by: Mithil Bavishi <bavishimithil@gmail.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260604054048.18980-1-bavishimithil@gmail.com
Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/sleep44xx.S | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-omap2/sleep44xx.S b/arch/arm/mach-omap2/sleep44xx.S
index f09c9197808b16..8b515f30072b05 100644
--- a/arch/arm/mach-omap2/sleep44xx.S
+++ b/arch/arm/mach-omap2/sleep44xx.S
@@ -6,6 +6,7 @@
  * 	Santosh Shilimkar <santosh.shilimkar@ti.com>
  */
 
+#include <linux/cfi_types.h>
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/smp_scu.h>
@@ -58,7 +59,7 @@
  * stack frame and it expects the caller to take care of it. Hence the entire
  * stack frame is saved to avoid possible stack corruption.
  */
-ENTRY(omap4_finish_suspend)
+SYM_TYPED_FUNC_START(omap4_finish_suspend)
 	stmfd	sp!, {r4-r12, lr}
 	cmp	r0, #0x0
 	beq	do_WFI				@ No lowpower state, jump to WFI
@@ -223,7 +224,7 @@ skip_scu_gp_clear:
 	isb
 	dsb
 	ldmfd	sp!, {r4-r12, pc}
-ENDPROC(omap4_finish_suspend)
+SYM_FUNC_END(omap4_finish_suspend)
 
 /*
  * ============================

From e85198f3f6b424e133321942e68b067e9b81b0c2 Mon Sep 17 00:00:00 2001
From: Bryam Vargas <hexlabsecurity@proton.me>
Date: Tue, 16 Jun 2026 20:56:15 -0500
Subject: [PATCH 0042/1982] iio: accel: fxls8962af: clamp the device-reported
 FIFO sample count

[ Upstream commit 2f8225b91eb478ca2e9aec8aaef4d229765bcebe ]

fxls8962af_fifo_flush() transfers the sample count the device reports in
BUF_STATUS into an on-stack buffer sized for FXLS8962AF_FIFO_LENGTH (32)
samples, but the count is a 6-bit field (0..63) that is only checked for
zero. A device, or an attacker on the I2C/SPI bus, reporting 33..63
overflows the buffer by up to 186 bytes: a stack out-of-bounds write.

Clamp the count to FXLS8962AF_FIFO_LENGTH before the transfer, mirroring
the clamp already applied in fxls8962af_set_watermark(). Conforming
hardware reports at most that many samples and is unaffected.

Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/fxls8962af-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/accel/fxls8962af-core.c b/drivers/iio/accel/fxls8962af-core.c
index 8763e91c63d2bf..1ecffbf41f64f7 100644
--- a/drivers/iio/accel/fxls8962af-core.c
+++ b/drivers/iio/accel/fxls8962af-core.c
@@ -970,6 +970,8 @@ static int fxls8962af_fifo_flush(struct iio_dev *indio_dev)
 	if (!count)
 		return 0;
 
+	count = min(count, FXLS8962AF_FIFO_LENGTH);
+
 	data->old_timestamp = data->timestamp;
 	data->timestamp = iio_get_time_ns(indio_dev);
 

From fb4a3facba36aa785d3b7b9242b6cdd221284b9f Mon Sep 17 00:00:00 2001
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
Date: Tue, 16 Jun 2026 12:46:49 +0800
Subject: [PATCH 0043/1982] perf/x86/intel: Fallback to sw branch type decoding
 if no hw decoding

[ Upstream commit 170cc6b02e3d5203ccaa49ffea1ee5a7ab08c885 ]

intel_pmu_lbr_filter() currently assumes arch-LBR provides hardware
branch-type decoding and skips software decoding on that path.

However, arch-LBR may not always expose branch-type information. In
that case, treating entries as hardware-decoded can misclassify sampled
branches (for example, defaulting to JCC), which breaks branch-type
filtering results.

Fix this by using software branch-type decoding when hardware
branch-type decoding is unavailable (that is, when x86_lbr_type is not
enabled). This keeps branch classification and filtering behavior
correct across arch-LBR configurations.

Since x86_lbr_type is only set to true when arch-LBR is supported,
it's unnecessary to check if the CPU has the arch-LBR feature.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260616044654.3468742-4-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/lbr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index 44f55564402239..bbfd6ffbdd68a6 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1230,7 +1230,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
 		 * Doesn't support OTHER_BRANCH decoding for now.
 		 * OTHER_BRANCH branch type still rely on software decoding.
 		 */
-		if (static_cpu_has(X86_FEATURE_ARCH_LBR) &&
+		if (static_branch_likely(&x86_lbr_type) &&
 		    type <= ARCH_LBR_BR_TYPE_KNOWN_MAX) {
 			to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
 			type = arch_lbr_br_type_map[type] | to_plm;

From d87eb804028e28ce4c7f0bf1a670f4ce1e0535cd Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 25 Jun 2026 11:39:37 +0200
Subject: [PATCH 0044/1982] drm/sysfb: simpledrm: Validate mmap size against
 framebuffer size

[ Upstream commit 127d52f9c64b1d9aab6226c4a1f38c37fb7254dc ]

The size of the mmap'ed framebuffer could be smaller than the minimum
required framebuffer size. Validate the resource size against the
framebuffer size.

Buggy firmware that triggers this check should be fixed up with a quirk
on a case-by-case base.

v3:
- fix size checks (Sashiko)
- improve error message for alignment check (Thierry)
- do not store aligned size value

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Thierry Reding <treding@nvidia.com>
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260625094509.157581-6-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sysfb/simpledrm.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
index 22f8caab39be0a..91f114ab99a3ef 100644
--- a/drivers/gpu/drm/sysfb/simpledrm.c
+++ b/drivers/gpu/drm/sysfb/simpledrm.c
@@ -5,6 +5,7 @@
 #include <linux/of_clk.h>
 #include <linux/minmax.h>
 #include <linux/of_reserved_mem.h>
+#include <linux/overflow.h>
 #include <linux/platform_data/simplefb.h>
 #include <linux/platform_device.h>
 #include <linux/pm_domain.h>
@@ -626,6 +627,7 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
 	u16 width_mm = 0, height_mm = 0;
 	struct device_node *panel_node;
 	const struct drm_format_info *format;
+	u64 size;
 	struct resource *res, *mem = NULL;
 	struct drm_plane *primary_plane;
 	struct drm_crtc *crtc;
@@ -716,6 +718,14 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
 		}
 		stride = pitch;
 	}
+	if (check_mul_overflow(height, stride, &size)) {
+		drm_err(dev, "framebuffer size exceeds maximum\n");
+		return ERR_PTR(-EINVAL);
+	}
+	if (ALIGN(size, PAGE_SIZE) < PAGE_SIZE) {
+		drm_err(dev, "page-aligned framebuffer exceeds maximum\n");
+		return ERR_PTR(-EINVAL);
+	}
 
 	sysfb->fb_mode = drm_sysfb_mode(width, height, width_mm, height_mm);
 	sysfb->fb_format = format;
@@ -741,6 +751,13 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
 
 		drm_dbg(dev, "using system memory framebuffer at %pr\n", mem);
 
+		if (size > resource_size(mem)) {
+			drm_err(dev,
+				"framebuffer size of %llu exceeds memory range %pr\n",
+				size, mem);
+			return ERR_PTR(-EINVAL);
+		}
+
 		screen_base = devm_memremap(dev->dev, mem->start, resource_size(mem), MEMREMAP_WC);
 		if (IS_ERR(screen_base))
 			return screen_base;
@@ -774,6 +791,13 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
 			mem = res;
 		}
 
+		if (size > resource_size(mem)) {
+			drm_err(dev,
+				"framebuffer size of %llu exceeds memory range %pr\n",
+				size, mem);
+			return ERR_PTR(-EINVAL);
+		}
+
 		screen_base = devm_ioremap_wc(&pdev->dev, mem->start, resource_size(mem));
 		if (!screen_base)
 			return ERR_PTR(-ENOMEM);

From 0211c538cc7b74c96307619cae3c4f5464f04d85 Mon Sep 17 00:00:00 2001
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
Date: Tue, 16 Jun 2026 12:46:53 +0800
Subject: [PATCH 0045/1982] perf/core: Fix kernel register info leak via
 hardware skid

[ Upstream commit 166f10836a653dfa280d4335603b52f685b8b1ef ]

An unprivileged hardware perf event using exclude_kernel=1 can leak kernel
register data to user space via PERF_SAMPLE_REGS_INTR or PERF_SAMPLE_IP.
Due to hardware skid, a PMI may trigger after the CPU has already entered
kernel space (Ring 0), bypassing the perf_allow_kernel() privilege
barrier.

This security vulnerability is severely exacerbated by upcoming support
for SIMD register sampling via XSAVES, which could expose sensitive kernel
FPU states (such as active cryptographic keys).

Fix this by ensuring that sampled register data is dropped if the event's
exclude_kernel attribute is set but the PMI catches the CPU in kernel mode.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/all/20260529085613.CCAFB1F00893@smtp.kernel.org/
Link: https://patch.msgid.link/20260616044654.3468742-8-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9007f2b36c4476..469f89cb92f11e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7500,10 +7500,20 @@ unsigned long perf_misc_flags(struct perf_event *event,
 unsigned long perf_instruction_pointer(struct perf_event *event,
 				       struct pt_regs *regs)
 {
-	if (should_sample_guest(event))
-		return perf_guest_get_ip();
+	/*
+	 * Hardware skid can lead to a scenario where a PMI is
+	 * delivered after the CPU has already entered kernel mode.
+	 * In that case, user-space sampling must not expose kernel
+	 * register state.
+	 */
+	if (should_sample_guest(event)) {
+		return event->attr.exclude_kernel &&
+		       !(perf_guest_state() & PERF_GUEST_USER) ?
+			0 : perf_guest_get_ip();
+	}
 
-	return perf_arch_instruction_pointer(regs);
+	return event->attr.exclude_kernel && !user_mode(regs) ?
+		0 : perf_arch_instruction_pointer(regs);
 }
 
 static void
@@ -7537,10 +7547,22 @@ static void perf_sample_regs_user(struct perf_regs *regs_user,
 }
 
 static void perf_sample_regs_intr(struct perf_regs *regs_intr,
-				  struct pt_regs *regs)
+				  struct pt_regs *regs,
+				  bool exclude_kernel)
 {
-	regs_intr->regs = regs;
-	regs_intr->abi  = perf_reg_abi(current);
+	/*
+	 * Hardware skid can lead to a scenario where a PMI is
+	 * delivered after the CPU has already entered kernel mode.
+	 * In that case, user-space sampling must not expose kernel
+	 * register state.
+	 */
+	if (exclude_kernel && !user_mode(regs)) {
+		regs_intr->abi = PERF_SAMPLE_REGS_ABI_NONE;
+		regs_intr->regs = NULL;
+	} else {
+		regs_intr->regs = regs;
+		regs_intr->abi = perf_reg_abi(current);
+	}
 }
 
 
@@ -8428,7 +8450,8 @@ void perf_prepare_sample(struct perf_sample_data *data,
 		/* regs dump ABI info */
 		int size = sizeof(u64);
 
-		perf_sample_regs_intr(&data->regs_intr, regs);
+		perf_sample_regs_intr(&data->regs_intr, regs,
+				      event->attr.exclude_kernel);
 
 		if (data->regs_intr.regs) {
 			u64 mask = event->attr.sample_regs_intr;

From 2ff10d259445316ae558a1eafa68308f928e09df Mon Sep 17 00:00:00 2001
From: Zizhi Wo <wozizhi@huawei.com>
Date: Mon, 29 Jun 2026 21:09:43 +0800
Subject: [PATCH 0046/1982] fat: reject name longer than NAME_MAX in
 msdos_format_name()

[ Upstream commit 9d7ed813ee5ff0d469bd99630828ed6fdef4e8da ]

msdos_format_name() performs no upper-bound check on the input name length.
It silently truncates an arbitrarily long name into the 8.3 form (11 bytes)
and returns success. The subsequent fat_scan() then matches only against
these 11 truncated bytes, so it returns an inode as long as any entry with
the same 8.3 name exists on disk.

For example, passing a 300-byte name of all 'A's returns 0 with res set to
"AAAAAAAA" (8 'A's + 3 padding spaces), reporting success for a name far
longer than NAME_MAX.

As a result, when a user calls open() on a path component longer than
NAME_MAX (255) bytes, the VFS only enforces PATH_MAX, not the length of an
individual component. The dentry keeps the original long name but gets an
inode attached and becomes positive. Later in vfs_open() -> fsnotify_open()
-> fanotify_info_copy_name() triggers WARN_ON_ONCE(), and the event is
reported to userspace with an empty name.

vfat is not affected, as create goes through xlate_to_uni() which refuses
names longer than FAT_LFN_LEN.

Fix this by checking 'len > NAME_MAX' at the entry of msdos_format_name(),
the single entry point for all msdos name handling, aligning with the
NAME_MAX check that xfs/9p/ceph/simple_lookup() perform at lookup.

Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Link: https://patch.msgid.link/20260629130943.3671939-1-wozizhi@huaweicloud.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fat/namei_msdos.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
index 262ec1b790b560..c03610d0e7247c 100644
--- a/fs/fat/namei_msdos.c
+++ b/fs/fat/namei_msdos.c
@@ -29,6 +29,9 @@ static int msdos_format_name(const unsigned char *name, int len,
 	unsigned char c;
 	int space;
 
+	if (len > NAME_MAX)
+		return -ENAMETOOLONG;
+
 	if (name[0] == '.') {	/* dotfile because . and .. already done */
 		if (opts->dotsOK) {
 			/* Get rid of dot - test for it elsewhere */

From 00ad8fb259e95e7c7b5aa35ed5aaccbf824c4120 Mon Sep 17 00:00:00 2001
From: Zide Chen <zide.chen@intel.com>
Date: Thu, 11 Jun 2026 09:00:26 -0700
Subject: [PATCH 0047/1982] perf/x86/intel/uncore: Fix PCI PMU cleanup on setup
 failure

[ Upstream commit 003267cb94e21d762eb72d6977d84f44f1705bb7 ]

When uncore_pci_pmu_register() fails, pmu->boxes[die] is set to NULL
before returning.  In the uncore_pci_remove() path, this causes
uncore_pci_pmu_unregister() to be skipped entirely, leaking
pmu->activeboxes.  In the uncore_bus_notify() path,
uncore_pci_pmu_unregister() may still be called and must exit early
when pmu->boxes[die] is NULL to avoid a NULL pointer dereference, and
to ensure activeboxes is only decremented for a previously active box.

Additionally, since pci_get_drvdata() returns NULL on registration
failure, uncore_pci_remove() can no longer treat NULL drvdata as an
indicator of an auxiliary PCI device.  Remove the associated
WARN_ON_ONCE().

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://sashiko.dev/#/patchset/20260512233048.9577-1-zide.chen@intel.com?part=1
Link: https://patch.msgid.link/20260611160033.66760-2-zide.chen@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/uncore.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index a5793847ed5a99..3d9973c416ecf6 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -1165,6 +1165,7 @@ static int uncore_pci_pmu_register(struct pci_dev *pdev,
 	/* First active box registers the pmu */
 	ret = uncore_pmu_register(pmu);
 	if (ret) {
+		atomic_dec(&pmu->activeboxes);
 		pmu->boxes[die] = NULL;
 		uncore_box_exit(box);
 		kfree(box);
@@ -1230,6 +1231,9 @@ static void uncore_pci_pmu_unregister(struct intel_uncore_pmu *pmu, int die)
 {
 	struct intel_uncore_box *box = pmu->boxes[die];
 
+	if (!box)
+		return;
+
 	pmu->boxes[die] = NULL;
 	if (atomic_dec_return(&pmu->activeboxes) == 0)
 		uncore_pmu_unregister(pmu);
@@ -1254,7 +1258,6 @@ static void uncore_pci_remove(struct pci_dev *pdev)
 				break;
 			}
 		}
-		WARN_ON_ONCE(i >= UNCORE_EXTRA_PCI_DEV_MAX);
 		return;
 	}
 

From a78ed42facf1567ac6f87fef2e2a711e2d363f29 Mon Sep 17 00:00:00 2001
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
Date: Mon, 1 Jun 2026 11:29:11 +0800
Subject: [PATCH 0048/1982] fs/namespace: notify pollers of legacy propagation
 changes

[ Upstream commit 0ae44a20835e5cf37d03a83e70c92e92deda3703 ]

Changing mount propagation through the legacy mount API changes
user-visible mountinfo contents, including the shared: and master:
optional fields.

The mount_setattr() path already touches the mount namespace after
change_mnt_propagation(), so pollers of /proc/<pid>/mountinfo are woken
when the namespace event changes.

The legacy mount --make-* path also changes propagation through
change_mnt_propagation(), and MOVE_MOUNT_SET_GROUP updates the
propagation relationship of the target mount. Both paths currently
return without touching the affected mount namespace.

As a result, userspace polling /proc/<pid>/mountinfo can miss these
propagation-only changes even though mountinfo has changed.

A simple reproducer that polls /proc/self/mountinfo while changing
propagation shows the inconsistency.

Before this change:

  legacy MS_SHARED: poll ret=0 revents=0x0
  mount_setattr MS_SHARED: poll ret=1 revents=0xa

After this change:

  legacy MS_SHARED: poll ret=1 revents=0xa
  mount_setattr MS_SHARED: poll ret=1 revents=0xa

Fix this by touching the affected mount namespace after successful
propagation changes in do_change_type() and do_set_group().

Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Link: https://patch.msgid.link/20260601032911.940507-1-guopeng.zhang@linux.dev
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/namespace.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index 3b6d7271eb3d1b..ab050a939cb539 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2932,6 +2932,9 @@ static int do_change_type(const struct path *path, int ms_flags)
 	for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
 		change_mnt_propagation(m, type);
 
+	guard(mount_locked_reader)();
+	touch_mnt_namespace(mnt->mnt_ns);
+
 	return 0;
 }
 
@@ -3414,6 +3417,10 @@ static int do_set_group(const struct path *from_path, const struct path *to_path
 		list_add(&to->mnt_share, &from->mnt_share);
 		set_mnt_shared(to);
 	}
+
+	guard(mount_locked_reader)();
+	touch_mnt_namespace(to->mnt_ns);
+
 	return 0;
 }
 

From b902b2bf21ed0ce106b243971838bd1e30b8e5d2 Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Thu, 18 Jun 2026 20:45:18 +0400
Subject: [PATCH 0049/1982] spi: bcm-qspi: return error from failed controller
 suspend

[ Upstream commit 44d09ef0ba690ac46d17eb05c12a47a5dd75e231 ]

spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm_qspi_suspend() ignored that error, disabled the
controller clock, uninitialized the hardware, and returned success.

Return the suspend error before tearing down the clock and hardware
state.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
Link: https://patch.msgid.link/tencent_21BF5F9512F56D45FD9018BAF14ED2805808@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm-qspi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index cfdaa5eaec76db..ae5545be0a45ca 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1694,13 +1694,17 @@ EXPORT_SYMBOL_GPL(bcm_qspi_remove);
 static int __maybe_unused bcm_qspi_suspend(struct device *dev)
 {
 	struct bcm_qspi *qspi = dev_get_drvdata(dev);
+	int ret;
 
 	/* store the override strap value */
 	if (!bcm_qspi_bspi_ver_three(qspi))
 		qspi->s3_strap_override_ctrl =
 			bcm_qspi_read(qspi, BSPI, BSPI_STRAP_OVERRIDE_CTRL);
 
-	spi_controller_suspend(qspi->host);
+	ret = spi_controller_suspend(qspi->host);
+	if (ret)
+		return ret;
+
 	clk_disable_unprepare(qspi->clk);
 	bcm_qspi_hw_uninit(qspi);
 

From 5bbe145daa754604311b19580682133da95e30ea Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Thu, 18 Jun 2026 20:45:16 +0400
Subject: [PATCH 0050/1982] spi: bcm63xx: return error from failed controller
 suspend

[ Upstream commit bbbc1ef5b35341c5122418a14f8924688a4bb954 ]

spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm63xx_spi_suspend() ignored that error, disabled the
controller clock, and returned success.

Return the suspend error before tearing down the clock.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_0BD7D4091B90EC17A8B2BA5EBA8803725905@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 8d152e906daacf..f73dc14533dcc4 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -643,8 +643,11 @@ static int bcm63xx_spi_suspend(struct device *dev)
 {
 	struct spi_controller *host = dev_get_drvdata(dev);
 	struct bcm63xx_spi *bs = spi_controller_get_devdata(host);
+	int ret;
 
-	spi_controller_suspend(host);
+	ret = spi_controller_suspend(host);
+	if (ret)
+		return ret;
 
 	clk_disable_unprepare(bs->clk);
 

From 8c249f45dde839ca6f3feffce0741da9d0d6690f Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Thu, 18 Jun 2026 20:45:17 +0400
Subject: [PATCH 0051/1982] spi: bcm63xx-hsspi: return error from failed
 controller suspend

[ Upstream commit 3b5414d76a0381db77b9694537254af7acfa187a ]

spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm63xx_hsspi_suspend() ignored that error, disabled the
PLL and core clocks, and returned success.

Return the suspend error before disabling the clocks.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Acked-by: William Zhang <william.zhang@broadcom.com>
Link: https://patch.msgid.link/tencent_B5A06807924A77C8690730EBF7A052AABE05@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx-hsspi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index b8bf8b5be2cf7c..719f0dfd96c96e 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -895,8 +895,12 @@ static int bcm63xx_hsspi_suspend(struct device *dev)
 {
 	struct spi_controller *host = dev_get_drvdata(dev);
 	struct bcm63xx_hsspi *bs = spi_controller_get_devdata(host);
+	int ret;
+
+	ret = spi_controller_suspend(host);
+	if (ret)
+		return ret;
 
-	spi_controller_suspend(host);
 	clk_disable_unprepare(bs->pll_clk);
 	clk_disable_unprepare(bs->clk);
 

From 9e93c02b6bf06a95a3fcc469736a043e59b63326 Mon Sep 17 00:00:00 2001
From: Damon Ding <damon.ding@rock-chips.com>
Date: Thu, 25 Jun 2026 15:19:16 +0800
Subject: [PATCH 0052/1982] drm/panel-edp: Add BOE NE160QDM-NY1 panel

[ Upstream commit be4f10d44757211fd656fa57f37034657f26c883 ]

Add an entry for the BOE NE160QDM-NY1 eDP panel. The panel's AUX
backlight functionality is verified and working on the RK3576 EVB1
board.

edid-decode (hex):

00 ff ff ff ff ff ff 00 09 e5 85 09 00 00 00 00
1c 1e 01 04 b5 22 15 78 03 7c e5 a4 55 4c 9f 26
0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 6b 6e 00 a0 a0 40 84 60 30 20
36 00 58 d7 10 00 00 1a 00 00 00 fd 0c 3c a5 1f
1f 4e 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42
4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe
00 4e 45 31 36 30 51 44 4d 2d 4e 59 31 0a 01 ed

02 03 1d 00 e3 05 80 00 e6 06 05 01 6a 6a 24 6d
1a 00 00 02 03 3c a5 00 04 6a 24 6a 24 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff

Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260625071916.744686-1-damon.ding@rock-chips.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-edp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 792923b1d78780..f2ae333a32d8c7 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1975,6 +1975,7 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0964, &delay_200_500_e50, "NV133WUM-N61"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x096e, &delay_200_500_e50_po2e200, "NV116WHM-T07 V8.0"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0979, &delay_200_500_e50, "NV116WHM-N49 V8.0"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0985, &delay_200_500_e50, "NE160QDM-NY1"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x098d, &boe_nv110wtm_n61.delay, "NV110WTM-N61"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0993, &delay_200_500_e80, "NV116WHM-T14 V8.0"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x09ad, &delay_200_500_e80, "NV116WHM-N47"),

From 5a6dd98304fa15b9747944430ba1538691cde6f1 Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Sat, 20 Jun 2026 12:39:30 +0400
Subject: [PATCH 0053/1982] spi: fsl-dspi: clean up after failed suspend and
 resume

[ Upstream commit 2543355f3da56a297e3803ccb5d29f4dce5f18f1 ]

dspi_suspend() disabled the IRQ before spi_controller_suspend(),
but ignored a suspend failure and kept tearing the device down.
Restore the IRQ and return the error if suspend fails.

dspi_resume() also left the clock prepared if controller resume or
hardware init failed. Route those failures through clock cleanup.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_427FA55E3D59112524886E9C931CA0F92F06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-dspi.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 83ea296597e946..1283a193b6fcc3 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -1464,10 +1464,18 @@ static int dspi_init(struct fsl_dspi *dspi)
 static int dspi_suspend(struct device *dev)
 {
 	struct fsl_dspi *dspi = dev_get_drvdata(dev);
+	int ret;
 
 	if (dspi->irq)
 		disable_irq(dspi->irq);
-	spi_controller_suspend(dspi->ctlr);
+
+	ret = spi_controller_suspend(dspi->ctlr);
+	if (ret) {
+		if (dspi->irq)
+			enable_irq(dspi->irq);
+		return ret;
+	}
+
 	clk_disable_unprepare(dspi->clk);
 
 	pinctrl_pm_select_sleep_state(dev);
@@ -1485,12 +1493,15 @@ static int dspi_resume(struct device *dev)
 	ret = clk_prepare_enable(dspi->clk);
 	if (ret)
 		return ret;
-	spi_controller_resume(dspi->ctlr);
+
+	ret = spi_controller_resume(dspi->ctlr);
+	if (ret)
+		goto disable_clk;
 
 	ret = dspi_init(dspi);
 	if (ret) {
 		dev_err(dev, "failed to initialize dspi during resume\n");
-		return ret;
+		goto disable_clk;
 	}
 
 	dspi_set_mtf(dspi);
@@ -1499,6 +1510,10 @@ static int dspi_resume(struct device *dev)
 		enable_irq(dspi->irq);
 
 	return 0;
+
+disable_clk:
+	clk_disable_unprepare(dspi->clk);
+	return ret;
 }
 #endif /* CONFIG_PM_SLEEP */
 

From 8af06aa5e860bc194de1c995c9eaedc0d29f44a9 Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Sat, 20 Jun 2026 12:39:31 +0400
Subject: [PATCH 0054/1982] spi: nxp-fspi: disable runtime PM on probe failures

[ Upstream commit 5d14285d60ba95561609a293064654a0c7d7d928 ]

nxp_fspi_probe() enables runtime PM and autosuspend before
several operations that can fail.

Some failure paths returned directly before the devm cleanup
action was installed, leaving runtime PM enabled.

Route those failures through a common runtime PM cleanup path.
Use pm_runtime_resume_and_get() for the initial clock enable.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_8FC0B8DFAF4AE67AEBA20548045D53A77707@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-nxp-fspi.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
index b504a5c86692a3..0300f4ae1455d1 100644
--- a/drivers/spi/spi-nxp-fspi.c
+++ b/drivers/spi/spi-nxp-fspi.c
@@ -1426,9 +1426,11 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	pm_runtime_use_autosuspend(dev);
 
 	/* enable clock */
-	ret = pm_runtime_get_sync(f->dev);
-	if (ret < 0)
-		return dev_err_probe(dev, ret, "Failed to enable clock");
+	ret = pm_runtime_resume_and_get(f->dev);
+	if (ret < 0) {
+		ret = dev_err_probe(dev, ret, "Failed to enable clock");
+		goto err_disable_pm;
+	}
 
 	/* Clear potential interrupts */
 	reg = fspi_readl(f, f->iobase + FSPI_INTR);
@@ -1438,18 +1440,24 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 	nxp_fspi_default_setup(f);
 
 	ret = pm_runtime_put_sync(dev);
-	if (ret < 0)
-		return dev_err_probe(dev, ret, "Failed to disable clock");
+	if (ret < 0) {
+		ret = dev_err_probe(dev, ret, "Failed to disable clock");
+		goto err_disable_pm;
+	}
 
 	init_completion(&f->c);
 	ret = devm_request_irq(dev, irq,
 			nxp_fspi_irq_handler, 0, pdev->name, f);
-	if (ret)
-		return dev_err_probe(dev, ret, "Failed to request irq\n");
+	if (ret) {
+		ret = dev_err_probe(dev, ret, "Failed to request irq\n");
+		goto err_disable_pm;
+	}
 
 	ret = devm_mutex_init(dev, &f->lock);
-	if (ret)
-		return dev_err_probe(dev, ret, "Failed to initialize lock\n");
+	if (ret) {
+		ret = dev_err_probe(dev, ret, "Failed to initialize lock\n");
+		goto err_disable_pm;
+	}
 
 	ctlr->bus_num = -1;
 	ctlr->num_chipselect = NXP_FSPI_MAX_CHIPSELECT;
@@ -1467,6 +1475,11 @@ static int nxp_fspi_probe(struct platform_device *pdev)
 		return ret;
 
 	return devm_spi_register_controller(&pdev->dev, ctlr);
+
+err_disable_pm:
+	pm_runtime_dont_use_autosuspend(dev);
+	pm_runtime_disable(dev);
+	return ret;
 }
 
 static int nxp_fspi_runtime_suspend(struct device *dev)

From 81673a22e1ee57341e7e2bd2f2182ff00c125204 Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Sat, 20 Jun 2026 12:39:29 +0400
Subject: [PATCH 0055/1982] spi: bcmbca-hsspi: return error from failed
 controller suspend

[ Upstream commit faa878d4805ca375738294bc52eae310eb287b16 ]

spi_controller_suspend() can fail if pending transfers cannot stop.
bcmbca_hsspi_suspend() ignored the error and still disabled the
PLL and core clocks.

Return the error before disabling the clocks.

Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_54F5634545908FBA724E758054BF03953808@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcmbca-hsspi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcmbca-hsspi.c b/drivers/spi/spi-bcmbca-hsspi.c
index a1ff33f6dc095e..50beb8443ea90e 100644
--- a/drivers/spi/spi-bcmbca-hsspi.c
+++ b/drivers/spi/spi-bcmbca-hsspi.c
@@ -586,8 +586,12 @@ static int bcmbca_hsspi_suspend(struct device *dev)
 {
 	struct spi_controller *host = dev_get_drvdata(dev);
 	struct bcmbca_hsspi *bs = spi_controller_get_devdata(host);
+	int ret;
+
+	ret = spi_controller_suspend(host);
+	if (ret)
+		return ret;
 
-	spi_controller_suspend(host);
 	clk_disable_unprepare(bs->pll_clk);
 	clk_disable_unprepare(bs->clk);
 

From 1f80e8bbe7c25fc9f8d41f0fe9d961110f3cb473 Mon Sep 17 00:00:00 2001
From: Ruoyu Wang <ruoyuw560@gmail.com>
Date: Thu, 18 Jun 2026 02:22:02 +0800
Subject: [PATCH 0056/1982] memory: stm32_omm: initialize ret in
 stm32_omm_set_amcr

[ Upstream commit 1527acf2295cf2d6e11e3e9b121d63709667e6e7 ]

stm32_omm_set_amcr() returns ret after checking whether the AMCR value
matches the device tree description. On the normal matching path ret is
not otherwise assigned, so initialize it to 0 before the checks.

Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Link: https://patch.msgid.link/20260617182202.961843-1-ruoyuw560@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/stm32_omm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/memory/stm32_omm.c b/drivers/memory/stm32_omm.c
index 5d06623f3f6899..2a1af229d24445 100644
--- a/drivers/memory/stm32_omm.c
+++ b/drivers/memory/stm32_omm.c
@@ -47,7 +47,7 @@ static int stm32_omm_set_amcr(struct device *dev, bool set)
 	struct device_node *node;
 	struct resource res, res1;
 	unsigned int syscon_args[2];
-	int ret, idx;
+	int ret = 0, idx;
 	unsigned int i, amcr, read_amcr;
 
 	for (i = 0; i < omm->nb_child; i++) {

From e291a2ccc553907bdfd6da016c3d97548099a5d1 Mon Sep 17 00:00:00 2001
From: Nicolas Escande <nico.escande@gmail.com>
Date: Tue, 23 Jun 2026 17:16:13 +0200
Subject: [PATCH 0057/1982] wifi: ath12k: avoid setting 320MHz support on non
 6GHz band

[ Upstream commit eaf478b3ea68e1b5df659acd24c4df5850e12325 ]

On a split phy qcn9274 (2.4GHz + 5GHz low), "iw phy" reports 320MHz
related features on the 5GHz band while it should not:

    Wiphy phy1
    [...]
        Band 2:
    [...]
            EHT Iftypes: managed
    [...]
                EHT PHY Capabilities: (0xe2ffdbe018778000):
                    320MHz in 6GHz Supported
    [...]
                    Beamformee SS (320MHz): 7
    [...]
                    Number Of Sounding Dimensions (320MHz): 3
    [...]
                EHT MCS/NSS: (0x22222222222222222200000000):

This is also reflected in the beacons sent by a mesh interface started on
that band. They erroneously advertise 320MHz support too.

This should not happen as IEEE Std 802.11-2024, subclause 9.4.2.323.3 says
we should not set the 320MHz related fields when not operating on a 6GHz
band. For example it says about Bit 0 "Support For 320 MHz In 6 GHz"

  "Reserved if the EHT Capabilities element is indicating capabilities for
   the 2.4 GHz or 5 GHz bands."

Fix this by clearing the related bits when converting from WMI eht phy
capabilities to mac80211 phy capabilities, for bands other than 6GHz.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00218-QCAHKSWPL_SILICONZ-1

Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260623151613.72113-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index ade14ba6703f3a..39d5110eca901e 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4939,6 +4939,7 @@ static void ath12k_wmi_eht_caps_parse(struct ath12k_pdev *pdev, u32 band,
 				       __le32 cap_info_internal)
 {
 	struct ath12k_band_cap *cap_band = &pdev->cap.band[band];
+	u8 *phy_cap = (u8 *)&cap_band->eht_cap_phy_info[0];
 	u32 support_320mhz;
 	u8 i;
 
@@ -4952,8 +4953,22 @@ static void ath12k_wmi_eht_caps_parse(struct ath12k_pdev *pdev, u32 band,
 	for (i = 0; i < WMI_MAX_EHTCAP_PHY_SIZE; i++)
 		cap_band->eht_cap_phy_info[i] = le32_to_cpu(cap_phy_info[i]);
 
-	if (band == NL80211_BAND_6GHZ)
+	if (band == NL80211_BAND_6GHZ) {
 		cap_band->eht_cap_phy_info[0] |= support_320mhz;
+	} else {
+		/*
+		 * Firmware may report 6 GHz/320 MHz specific capabilities for
+		 * non-6 GHz bands, so explicitly clear them.
+		 */
+		phy_cap[0] &= ~IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
+		phy_cap[1] &= ~IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK;
+		phy_cap[2] &= ~IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK;
+		phy_cap[3] &= ~IEEE80211_EHT_PHY_CAP3_SOUNDING_DIM_320MHZ_MASK;
+		phy_cap[6] &= ~IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_320MHZ;
+		phy_cap[6] &= ~IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP;
+		phy_cap[7] &= ~IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ;
+		phy_cap[7] &= ~IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ;
+	}
 
 	cap_band->eht_mcs_20_only = le32_to_cpu(supp_mcs[0]);
 	cap_band->eht_mcs_80 = le32_to_cpu(supp_mcs[1]);

From f3433cfb30fdb27d67875f2a5f065990810f70bb Mon Sep 17 00:00:00 2001
From: Paritosh Potukuchi <paritoshpotukuchi@gmail.com>
Date: Fri, 12 Jun 2026 10:18:15 +0000
Subject: [PATCH 0058/1982] i2c: amd-asf: Validate firmware-reported length

[ Upstream commit b2f4816a378dc840b605a1235b80e57c5f85b46c ]

The firmware may sometimes return a length greater than the
allocated buffer size, which can lead to out-of-bounds access
and a kernel panic.

Currently, the driver does not validate the length read from
firmware.

Add a check to ensure the firmware-reported length stays within
the bounds of the data buffer.

Signed-off-by: Paritosh Potukuchi <paritosh.potukuchi@amd.com>
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260612101815.4124804-1-paritosh.potukuchi@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-amd-asf-plat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/i2c/busses/i2c-amd-asf-plat.c b/drivers/i2c/busses/i2c-amd-asf-plat.c
index ca45f0f233210a..f5b73c83404950 100644
--- a/drivers/i2c/busses/i2c-amd-asf-plat.c
+++ b/drivers/i2c/busses/i2c-amd-asf-plat.c
@@ -90,6 +90,10 @@ static void amd_asf_process_target(struct work_struct *work)
 		outb_p(reg, ASFDATABNKSEL);
 		cmd = inb_p(ASFINDEX);
 		len = inb_p(ASFDATARWPTR);
+
+		if (len > ASF_BLOCK_MAX_BYTES)
+			return;
+
 		for (idx = 0; idx < len; idx++)
 			data[idx] = inb_p(ASFINDEX);
 

From 6c65dfeb93ab0899b2aaac09b7a36d80b537d085 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
Date: Mon, 29 Jun 2026 04:45:41 -0700
Subject: [PATCH 0059/1982] netpoll: do not warn when the best-effort pool
 refill fails

[ Upstream commit 84c0ff1efb62b0053aa265b8deb13842f68f1a74 ]

refill_skbs() tops up the per-netpoll skb pool with GFP_ATOMIC and
simply stops on the first allocation failure, leaving the pool partially
filled; a later refill tops it up once memory frees up. The allocation
failing is therefore an expected and fully handled condition, but
without __GFP_NOWARN the page allocator emits a warn_alloc() splat with
a full stack trace on every miss.

Pass __GFP_NOWARN so the best-effort refill stays quiet, mirroring the
same change in netconsole's find_skb().

Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260629-netpoll_no_warn-v1-2-f380f0b2cd0c@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/netpoll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9ef344a6932f9c..a22de992c80243 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -232,7 +232,7 @@ static void refill_skbs(struct netpoll *np)
 	skb_pool = &np->skb_pool;
 
 	while (READ_ONCE(skb_pool->qlen) < MAX_SKBS) {
-		skb = alloc_skb(MAX_SKB_SIZE, GFP_ATOMIC);
+		skb = alloc_skb(MAX_SKB_SIZE, GFP_ATOMIC | __GFP_NOWARN);
 		if (!skb)
 			break;
 

From 7fca266784f6b004448a5b229487fcb1fb7dc385 Mon Sep 17 00:00:00 2001
From: Abhijeeth Babu <babu.jeeth@gmail.com>
Date: Thu, 18 Jun 2026 00:56:11 +0530
Subject: [PATCH 0060/1982] i2c: acpi: Force ELAN1300 touchpads to 100 kHz

[ Upstream commit 9e9762e578db7556bea644bb5a8a2435f63544d1 ]

The ELAN1300 touchpad with HID ID 04F3:3104 on the ASUS VivoBook
X513UA_KM513UA exhibits severe pointer jumps and erratic movement when
the I2C bus operates at 400 kHz.

The system DSDT describes the touchpad using an I2cSerialBusV2 resource
with a speed of 0x00061A80, corresponding to 400 kHz, on the
AMDI0010:03 controller.

At this speed, libinput repeatedly reports:

kernel bug: Touch jump detected and discarded

Add ELAN1300 to i2c_acpi_force_100khz_device_ids so that it operates at
100 kHz.

Before the change, nine touch-jump events were recorded, with additional
messages suppressed by libinput's rate limiter. With the bus forced to
100 kHz, no touch-jump events have been observed and the touchpad operates
normally.

The affected system uses BIOS X513UA.319 dated 2023-05-09.

Signed-off-by: Abhijeeth Babu <babu.jeeth@gmail.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260617192611.125513-1-babu.jeeth@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/i2c-core-acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index ed90858a27b7b9..98ebbc973f2122 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -372,6 +372,7 @@ static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = {
 	 */
 	{ "DLL0945", 0 },
 	{ "ELAN06FA", 0 },
+	{ "ELAN1300", 0 },
 	{}
 };
 

From 66b095839f0b3e1bfe75559fdbc6f6f2ac7c0330 Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Mon, 15 Jun 2026 11:02:51 +0530
Subject: [PATCH 0061/1982] drm/amdgpu: Add checks to vbios fetch through ATRM

[ Upstream commit 8c3fcfc14fc1320a1155acb2dd7656fce7003bc0 ]

Check if a valid buffer object is returned after ATRM call. Also, match
the buffer length against requested size before copying.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index dec312b0f3b0a4..f28dec3630de58 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -280,8 +280,14 @@ static int amdgpu_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
 	}
 
 	obj = (union acpi_object *)buffer.pointer;
-	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
-	len = obj->buffer.length;
+	if (!obj || obj->type != ACPI_TYPE_BUFFER) {
+		DRM_ERROR("ATRM returned an invalid object\n");
+		kfree(buffer.pointer);
+		return -EINVAL;
+	}
+
+	len = min_t(size_t, obj->buffer.length, len);
+	memcpy(bios+offset, obj->buffer.pointer, len);
 	kfree(buffer.pointer);
 	return len;
 }

From 41e21fe60adfe8a45c03d20a03b8791d015146aa Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Mon, 18 May 2026 17:43:44 +0530
Subject: [PATCH 0062/1982] drm/amdgpu: Validate ATPX buffer length before use

[ Upstream commit 916867cd75dbbc383aa6cb724556de769912157a ]

Add amdgpu_atpx_buffer_validate() to check that the returned ACPI
buffer is of type ACPI_TYPE_BUFFER, is large enough to hold the u16
size field, and that the BIOS-reported size does not exceed the actual
allocation length or fall below the minimum required by the caller.
Use it in VERIFY_INTERFACE and GET_PX_PARAMETERS callers.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Assisted-by: Claude Sonnet (Cursor AI)
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c  | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 3893e6fc2f037b..e2a4644896ca8b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -89,6 +89,15 @@ bool amdgpu_is_atpx_hybrid(void)
 	return amdgpu_atpx_priv.atpx.is_hybrid;
 }
 
+static bool amdgpu_atpx_buffer_validate(const union acpi_object *obj,
+					size_t min_size)
+{
+	return obj && obj->type == ACPI_TYPE_BUFFER &&
+	       obj->buffer.length >= sizeof(u16) &&
+	       obj->buffer.length >= *(u16 *)obj->buffer.pointer &&
+	       *(u16 *)obj->buffer.pointer >= min_size;
+}
+
 /**
  * amdgpu_atpx_call - call an ATPX method
  *
@@ -179,15 +188,15 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
 		if (!info)
 			return -EIO;
 
-		memset(&output, 0, sizeof(output));
-
-		size = *(u16 *) info->buffer.pointer;
-		if (size < 10) {
-			pr_err("ATPX buffer is too small: %zu\n", size);
+		if (!amdgpu_atpx_buffer_validate(info, sizeof(output))) {
+			pr_err("Invalid ATPX GET_PX_PARAMETERS response\n");
 			kfree(info);
 			return -EINVAL;
 		}
-		size = min(sizeof(output), size);
+
+		memset(&output, 0, sizeof(output));
+
+		size = min(sizeof(output), (size_t)*(u16 *)info->buffer.pointer);
 
 		memcpy(&output, info->buffer.pointer, size);
 
@@ -258,15 +267,15 @@ static int amdgpu_atpx_verify_interface(struct amdgpu_atpx *atpx)
 	if (!info)
 		return -EIO;
 
-	memset(&output, 0, sizeof(output));
-
-	size = *(u16 *) info->buffer.pointer;
-	if (size < 8) {
-		pr_err("ATPX buffer is too small: %zu\n", size);
+	if (!amdgpu_atpx_buffer_validate(info, sizeof(output))) {
+		pr_err("Invalid ATPX VERIFY_INTERFACE response\n");
 		err = -EINVAL;
 		goto out;
 	}
-	size = min(sizeof(output), size);
+
+	memset(&output, 0, sizeof(output));
+
+	size = min(sizeof(output), (size_t)*(u16 *)info->buffer.pointer);
 
 	memcpy(&output, info->buffer.pointer, size);
 

From 27eef4dcedf82f8d7fa5e679843c129462068738 Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Wed, 17 Jun 2026 14:22:08 +0530
Subject: [PATCH 0063/1982] drm/amdgpu: Fix kobject cleanup in xcp sysfs

[ Upstream commit 62d8b452615fd7a61976a1372bb81937807968c3 ]

Fix the indexing issue. Release the kobject whose init/add failed, and
unwind the successfully added ones.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
index 1083db8cea2ebd..6059227c53150b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
@@ -901,7 +901,7 @@ static void amdgpu_xcp_cfg_sysfs_init(struct amdgpu_device *adev)
 {
 	struct amdgpu_xcp_res_details *xcp_res;
 	struct amdgpu_xcp_cfg *xcp_cfg;
-	int i, r, j, rid, mode;
+	int i, r, rid, mode;
 
 	if (!adev->xcp_mgr)
 		return;
@@ -947,14 +947,16 @@ static void amdgpu_xcp_cfg_sysfs_init(struct amdgpu_device *adev)
 					 &xcp_cfg_res_sysfs_ktype,
 					 &xcp_cfg->kobj, "%s",
 					 xcp_res_names[rid]);
-		if (r)
+		if (r) {
+			kobject_put(&xcp_res->kobj);
 			goto err;
+		}
 	}
 
 	adev->xcp_mgr->xcp_cfg = xcp_cfg;
 	return;
 err:
-	for (j = 0; j < i; j++) {
+	while (i--) {
 		xcp_res = &xcp_cfg->xcp_res[i];
 		kobject_put(&xcp_res->kobj);
 	}

From 6d6b861cd078e64accbe74df1c9a0b332dfe890c Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Mon, 18 May 2026 17:43:32 +0530
Subject: [PATCH 0064/1982] drm/amdgpu: Validate ATIF buffer length before use

[ Upstream commit b978b7d43963bbb3e2d850288f7c21ac11c3b751 ]

Add a min_size parameter to amdgpu_atif_call() to validate that the
returned ACPI buffer is of type ACPI_TYPE_BUFFER, holds at least a u16
size field, does not claim more data than was actually returned, and
meets the minimum size required by the calling function. Each caller
passes its required minimum via sizeof() or offsetof() of the expected
output struct and drops its own size check.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Assisted-by: Claude Sonnet (Cursor AI)
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 68 ++++++++++++------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 36f429e7f20275..5a04c20a5fd151 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -138,13 +138,15 @@ static struct amdgpu_acpi_priv {
  * @atif: atif structure
  * @function: the ATIF function to execute
  * @params: ATIF function params
+ * @min_size: minimum size of the expected output buffer in bytes
  *
  * Executes the requested ATIF function (all asics).
  * Returns a pointer to the acpi output buffer.
  */
 static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif,
 					   int function,
-					   struct acpi_buffer *params)
+					   struct acpi_buffer *params,
+					   size_t min_size)
 {
 	acpi_status status;
 	union acpi_object *obj;
@@ -187,6 +189,28 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif,
 		return NULL;
 	}
 
+	if (obj->buffer.length < sizeof(u16)) {
+		DRM_DEBUG_DRIVER("ATIF buffer too small to hold size field: %u\n",
+				 obj->buffer.length);
+		kfree(obj);
+		return NULL;
+	}
+
+	if (obj->buffer.length < *(u16 *)obj->buffer.pointer) {
+		DRM_DEBUG_DRIVER("ATIF buffer length mismatch: reported %u, actual %u\n",
+				 *(u16 *)obj->buffer.pointer,
+				 obj->buffer.length);
+		kfree(obj);
+		return NULL;
+	}
+
+	if (*(u16 *)obj->buffer.pointer < min_size) {
+		DRM_DEBUG_DRIVER("ATIF buffer too small: expected %zu, got %u\n",
+				 min_size, *(u16 *)obj->buffer.pointer);
+		kfree(obj);
+		return NULL;
+	}
+
 	return obj;
 }
 
@@ -248,19 +272,14 @@ static int amdgpu_atif_verify_interface(struct amdgpu_atif *atif)
 	size_t size;
 	int err = 0;
 
-	info = amdgpu_atif_call(atif, ATIF_FUNCTION_VERIFY_INTERFACE, NULL);
+	info = amdgpu_atif_call(atif, ATIF_FUNCTION_VERIFY_INTERFACE, NULL,
+				sizeof(output));
 	if (!info)
 		return -EIO;
 
 	memset(&output, 0, sizeof(output));
 
-	size = *(u16 *) info->buffer.pointer;
-	if (size < 12) {
-		DRM_INFO("ATIF buffer is too small: %zu\n", size);
-		err = -EINVAL;
-		goto out;
-	}
-	size = min(sizeof(output), size);
+	size = min(sizeof(output), (size_t)*(u16 *)info->buffer.pointer);
 
 	memcpy(&output, info->buffer.pointer, size);
 
@@ -270,7 +289,6 @@ static int amdgpu_atif_verify_interface(struct amdgpu_atif *atif)
 	amdgpu_atif_parse_notification(&atif->notifications, output.notification_mask);
 	amdgpu_atif_parse_functions(&atif->functions, output.function_bits);
 
-out:
 	kfree(info);
 	return err;
 }
@@ -295,20 +313,14 @@ static int amdgpu_atif_get_notification_params(struct amdgpu_atif *atif)
 	int err = 0;
 
 	info = amdgpu_atif_call(atif, ATIF_FUNCTION_GET_SYSTEM_PARAMETERS,
-				NULL);
+				NULL, offsetof(struct atif_system_params, command_code));
 	if (!info) {
 		err = -EIO;
 		goto out;
 	}
 
-	size = *(u16 *) info->buffer.pointer;
-	if (size < 10) {
-		err = -EINVAL;
-		goto out;
-	}
-
 	memset(&params, 0, sizeof(params));
-	size = min(sizeof(params), size);
+	size = min(sizeof(params), (size_t)*(u16 *)info->buffer.pointer);
 	memcpy(&params, info->buffer.pointer, size);
 
 	DRM_DEBUG_DRIVER("SYSTEM_PARAMS: mask = %#x, flags = %#x\n",
@@ -371,20 +383,14 @@ static int amdgpu_atif_query_backlight_caps(struct amdgpu_atif *atif)
 
 	info = amdgpu_atif_call(atif,
 		ATIF_FUNCTION_QUERY_BRIGHTNESS_TRANSFER_CHARACTERISTICS,
-		&params);
+		&params, offsetof(struct atif_qbtc_output, data_points));
 	if (!info) {
 		err = -EIO;
 		goto out;
 	}
 
-	size = *(u16 *) info->buffer.pointer;
-	if (size < 10) {
-		err = -EINVAL;
-		goto out;
-	}
-
 	memset(&characteristics, 0, sizeof(characteristics));
-	size = min(sizeof(characteristics), size);
+	size = min(sizeof(characteristics), (size_t)*(u16 *)info->buffer.pointer);
 	memcpy(&characteristics, info->buffer.pointer, size);
 
 	atif->backlight_caps.caps_valid = true;
@@ -422,24 +428,18 @@ static int amdgpu_atif_get_sbios_requests(struct amdgpu_atif *atif,
 	int count = 0;
 
 	info = amdgpu_atif_call(atif, ATIF_FUNCTION_GET_SYSTEM_BIOS_REQUESTS,
-				NULL);
+				NULL, sizeof(*req));
 	if (!info)
 		return -EIO;
 
-	size = *(u16 *)info->buffer.pointer;
-	if (size < 0xd) {
-		count = -EINVAL;
-		goto out;
-	}
 	memset(req, 0, sizeof(*req));
 
-	size = min(sizeof(*req), size);
+	size = min(sizeof(*req), (size_t)*(u16 *)info->buffer.pointer);
 	memcpy(req, info->buffer.pointer, size);
 	DRM_DEBUG_DRIVER("SBIOS pending requests: %#x\n", req->pending);
 
 	count = hweight32(req->pending);
 
-out:
 	kfree(info);
 	return count;
 }

From 9d34f2148207454472e7ea578c329efb626c6d7b Mon Sep 17 00:00:00 2001
From: Asad Kamal <asad.kamal@amd.com>
Date: Tue, 16 Jun 2026 21:24:05 +0800
Subject: [PATCH 0065/1982] drm/amdgpu: validate XCP topology counts before
 division

[ Upstream commit 0eda57ee303b4392057b7d4c32e8fda9d14cffad ]

In aqua_vanjaram_get_xcp_res_info(), max_res[i] can be zero.
When res_lt_xcp is true the code divides num_xcp by max_res[i],
causing a divide fault.

Skip the loop body for absent resources.

v2: Remove redundant checks (Lijo)

Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
index f9e2edf5260bc5..15e70415c35b4b 100644
--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
+++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
@@ -295,8 +295,10 @@ static int aqua_vanjaram_get_xcp_res_info(struct amdgpu_xcp_mgr *xcp_mgr,
 	xcp_cfg->num_res = ARRAY_SIZE(max_res);
 
 	for (i = 0; i < xcp_cfg->num_res; i++) {
-		res_lt_xcp = max_res[i] < num_xcp;
 		xcp_cfg->xcp_res[i].id = i;
+		if (!max_res[i])
+			continue;
+		res_lt_xcp = max_res[i] < num_xcp;
 		xcp_cfg->xcp_res[i].num_inst =
 			res_lt_xcp ? 1 : max_res[i] / num_xcp;
 		xcp_cfg->xcp_res[i].num_inst =

From 6441c5b430eb3df95efec01f62e9043d5573cf42 Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Thu, 18 Jun 2026 10:56:54 +0530
Subject: [PATCH 0066/1982] drm/amd/pm: validate vega10 profile mode inputs

[ Upstream commit bf939f2a1687ef4ab815640096357f8ef5bd5fb6 ]

Check for out of range profile modes and custom params that exceed 8 bits.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
index d6aaba0b3613de..84c777fde62f57 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -5406,6 +5406,11 @@ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui
 	uint8_t min_active_level;
 	uint32_t power_profile_mode = input[size];
 
+	if (power_profile_mode > PP_SMC_POWER_PROFILE_CUSTOM) {
+		pr_err("Invalid power profile mode %u\n", power_profile_mode);
+		return -EINVAL;
+	}
+
 	if (power_profile_mode == PP_SMC_POWER_PROFILE_CUSTOM) {
 		if (size != 0 && size != 4)
 			return -EINVAL;
@@ -5421,6 +5426,10 @@ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui
 				return -EINVAL;
 		}
 
+		if ((input[0] & ~0xFF) || (input[1] & ~0xFF) ||
+		    (input[2] & ~0xFF) || (input[3] & ~0xFF))
+			return -EINVAL;
+
 		data->custom_profile_mode[0] = busy_set_point = input[0];
 		data->custom_profile_mode[1] = FPS = input[1];
 		data->custom_profile_mode[2] = use_rlc_busy = input[2];

From 884ffe359625621c7d509b671d78e4a67bfa3559 Mon Sep 17 00:00:00 2001
From: Matthew Jacob <mjacob@feralsw.com>
Date: Fri, 19 Jun 2026 11:45:46 -0700
Subject: [PATCH 0067/1982] drm/amdgpu: Support some Barco AMD based graphics
 adapters

[ Upstream commit 3dc4d68ee26a7ac12069ff0562ad8935106c79b6 ]

These adapters typically are only supported by Barco on the
Windows platform. However, with these changes in the linux
driver, multiple monitor support should work correctly.

Signed-off-by: Matthew Jacob <mjacob@feralsw.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 376a7cd2667f63..845ebe041563f5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1953,6 +1953,7 @@ static const struct pci_device_id pciidlist[] = {
 	{0x1002, 0x6646, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|AMD_IS_MOBILITY},
 	{0x1002, 0x6647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|AMD_IS_MOBILITY},
 	{0x1002, 0x6649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE},
+	{0x1002, 0x664D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE},
 	{0x1002, 0x6650, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE},
 	{0x1002, 0x6651, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE},
 	{0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE},
@@ -2022,6 +2023,7 @@ static const struct pci_device_id pciidlist[] = {
 	{0x1002, 0x6930, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TONGA},
 	{0x1002, 0x6938, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TONGA},
 	{0x1002, 0x6939, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TONGA},
+	{0x1002, 0x693B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TONGA},
 	/* fiji */
 	{0x1002, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_FIJI},
 	{0x1002, 0x730F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_FIJI},
@@ -2050,6 +2052,7 @@ static const struct pci_device_id pciidlist[] = {
 	{0x1002, 0x67C4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
 	{0x1002, 0x67C7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
 	{0x1002, 0x67D0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+	{0x1002, 0x67D4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
 	{0x1002, 0x67DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
 	{0x1002, 0x67C8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
 	{0x1002, 0x67C9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
@@ -2063,6 +2066,7 @@ static const struct pci_device_id pciidlist[] = {
 	{0x1002, 0x6985, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 	{0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 	{0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+	{0x1002, 0x698F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 	{0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 	{0x1002, 0x6997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 	{0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},

From cafbd67662675a95d6019b4f5698e72b7bac3ec0 Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Wed, 17 Jun 2026 14:42:02 +0530
Subject: [PATCH 0068/1982] drm/amdgpu: Guard reads in pcie state readout

[ Upstream commit 230753e46a4a9d04dad6a9b5dbaeb7fd52add7d0 ]

Internal US/DS switch may not be exposed in passthrough. Guard the
upstream port reads to avoid a NULL dereference.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 59 +++++++++++++++-------
 1 file changed, 42 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
index 15e70415c35b4b..b73e114206cc12 100644
--- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
+++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c
@@ -613,6 +613,29 @@ static struct aqua_reg_list pcie_reg_addrs[] = {
 	{ smreg_0x1A380088, 6, DW_ADDR_INCR },
 };
 
+/*
+ * Return the GPU's internal US switch port, or NULL if it is not visible
+ * (e.g. passthrough) or the EP is parented under an unrelated bridge.
+ */
+static struct pci_dev *aqua_vanjaram_get_us_pdev(struct amdgpu_device *adev)
+{
+	struct pci_dev *ds_pdev, *us_pdev;
+
+	ds_pdev = pci_upstream_bridge(adev->pdev);
+	if (!ds_pdev || ds_pdev->vendor != PCI_VENDOR_ID_ATI ||
+	    pci_pcie_type(ds_pdev) != PCI_EXP_TYPE_DOWNSTREAM)
+		return NULL;
+
+	us_pdev = pci_upstream_bridge(ds_pdev);
+	if (!us_pdev ||
+	    (us_pdev->vendor != PCI_VENDOR_ID_ATI &&
+	     us_pdev->vendor != PCI_VENDOR_ID_AMD) ||
+	    pci_pcie_type(us_pdev) != PCI_EXP_TYPE_UPSTREAM)
+		return NULL;
+
+	return us_pdev;
+}
+
 static ssize_t aqua_vanjaram_read_pcie_state(struct amdgpu_device *adev,
 					     void *buf, size_t max_size)
 {
@@ -620,7 +643,7 @@ static ssize_t aqua_vanjaram_read_pcie_state(struct amdgpu_device *adev,
 	uint32_t start_addr, incrx, num_regs, szbuf;
 	struct amdgpu_regs_pcie_v1_0 *pcie_regs;
 	struct amdgpu_smn_reg_data *reg_data;
-	struct pci_dev *us_pdev, *ds_pdev;
+	struct pci_dev *us_pdev;
 	int aer_cap, r, n;
 
 	if (!buf || !max_size)
@@ -652,25 +675,27 @@ static ssize_t aqua_vanjaram_read_pcie_state(struct amdgpu_device *adev,
 		}
 	}
 
-	ds_pdev = pci_upstream_bridge(adev->pdev);
-	us_pdev = pci_upstream_bridge(ds_pdev);
+	us_pdev = aqua_vanjaram_get_us_pdev(adev);
+	if (us_pdev) {
+		pcie_capability_read_word(us_pdev, PCI_EXP_DEVSTA,
+					  &pcie_regs->device_status);
+		pcie_capability_read_word(us_pdev, PCI_EXP_LNKSTA,
+					  &pcie_regs->link_status);
+
+		aer_cap = pci_find_ext_capability(us_pdev, PCI_EXT_CAP_ID_ERR);
+		if (aer_cap) {
+			pci_read_config_dword(us_pdev,
+					      aer_cap + PCI_ERR_COR_STATUS,
+					      &pcie_regs->pcie_corr_err_status);
+			pci_read_config_dword(us_pdev,
+					      aer_cap + PCI_ERR_UNCOR_STATUS,
+					      &pcie_regs->pcie_uncorr_err_status);
+		}
 
-	pcie_capability_read_word(us_pdev, PCI_EXP_DEVSTA,
-				  &pcie_regs->device_status);
-	pcie_capability_read_word(us_pdev, PCI_EXP_LNKSTA,
-				  &pcie_regs->link_status);
-
-	aer_cap = pci_find_ext_capability(us_pdev, PCI_EXT_CAP_ID_ERR);
-	if (aer_cap) {
-		pci_read_config_dword(us_pdev, aer_cap + PCI_ERR_COR_STATUS,
-				      &pcie_regs->pcie_corr_err_status);
-		pci_read_config_dword(us_pdev, aer_cap + PCI_ERR_UNCOR_STATUS,
-				      &pcie_regs->pcie_uncorr_err_status);
+		pci_read_config_dword(us_pdev, PCI_PRIMARY_BUS,
+				      &pcie_regs->sub_bus_number_latency);
 	}
 
-	pci_read_config_dword(us_pdev, PCI_PRIMARY_BUS,
-			      &pcie_regs->sub_bus_number_latency);
-
 	pcie_reg_state->common_header.structure_size = szbuf;
 	pcie_reg_state->common_header.format_revision = 1;
 	pcie_reg_state->common_header.content_revision = 0;

From cfb27089cf04d8dfb9554891cffd8e426f3f78cf Mon Sep 17 00:00:00 2001
From: Gangliang Xie <ganglxie@amd.com>
Date: Tue, 23 Jun 2026 10:42:19 +0800
Subject: [PATCH 0069/1982] drm/amdgpu: add check for xcp id

[ Upstream commit fa1531170d2c96060478d697fe93f1cafc0e7ddd ]

check sel_xcp_id before its use

Signed-off-by: Gangliang Xie <ganglxie@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
index 6059227c53150b..88de3ecc7f230f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
@@ -572,6 +572,9 @@ static void amdgpu_xcp_gpu_sched_update(struct amdgpu_device *adev,
 {
 	unsigned int *num_gpu_sched;
 
+	if (sel_xcp_id >= MAX_XCP || sel_xcp_id == AMDGPU_XCP_NO_PARTITION)
+		return;
+
 	num_gpu_sched = &adev->xcp_mgr->xcp[sel_xcp_id]
 			.gpu_sched[ring->funcs->type][ring->hw_prio].num_scheds;
 	adev->xcp_mgr->xcp[sel_xcp_id].gpu_sched[ring->funcs->type][ring->hw_prio]

From 6bd63ff350e1e2115b74f88f90258ca60e696a5c Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 11:37:23 +0800
Subject: [PATCH 0070/1982] drm/amd/pm: Validate Vega hwmgr PowerPlay table
 bounds

[ Upstream commit 3a8d8e0b7f61cd759d5d4870b6220161f8a5b114 ]

The Vega hwmgr PowerPlay table parsers read fixed table fields,
state array entries, or SMC PPT fields before validating that the
VBIOS table buffer covers those structures. A truncated table can
therefore lead to out-of-bounds reads during hwmgr initialization.

Reject tables smaller than the fixed PowerPlay table. For Vega10, also
validate the state array offset and entry range before dereferencing
the state array.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../powerplay/hwmgr/vega10_processpptables.c  | 59 ++++++++++++-------
 .../powerplay/hwmgr/vega12_processpptables.c  |  7 +++
 .../powerplay/hwmgr/vega20_processpptables.c  |  7 +++
 3 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
index 3be616af327eff..64cff9f4850a6a 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
@@ -63,14 +63,17 @@ static const void *get_powerplay_table(struct pp_hwmgr *hwmgr)
 	return table_address;
 }
 
-static int check_powerplay_tables(
-		struct pp_hwmgr *hwmgr,
-		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
+static int get_vega10_state_array(struct pp_hwmgr *hwmgr,
+	const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+	const ATOM_Vega10_State_Array **state_array)
 {
 	const ATOM_Vega10_State_Array *state_arrays;
+	u16 state_array_offset;
+	size_t state_array_size;
+	size_t table_size = hwmgr->soft_pp_table_size;
 
-	state_arrays = (ATOM_Vega10_State_Array *)(((unsigned long)powerplay_table) +
-		le16_to_cpu(powerplay_table->usStateArrayOffset));
+	PP_ASSERT_WITH_CODE((table_size >= sizeof(*powerplay_table)),
+			    "Invalid PowerPlay Table!", return -1);
 
 	PP_ASSERT_WITH_CODE((powerplay_table->sHeader.format_revision >=
 			ATOM_Vega10_TABLE_REVISION_VEGA10),
@@ -79,12 +82,34 @@ static int check_powerplay_tables(
 		"State table is not set!", return -1);
 	PP_ASSERT_WITH_CODE(powerplay_table->sHeader.structuresize > 0,
 		"Invalid PowerPlay Table!", return -1);
+
+	state_array_offset = le16_to_cpu(powerplay_table->usStateArrayOffset);
+	PP_ASSERT_WITH_CODE((state_array_offset <=
+			     table_size - sizeof(*state_arrays)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	state_arrays = (ATOM_Vega10_State_Array *)(((unsigned long)powerplay_table) +
+		state_array_offset);
 	PP_ASSERT_WITH_CODE(state_arrays->ucNumEntries > 0,
 		"Invalid PowerPlay Table!", return -1);
 
+	state_array_size = struct_size(state_arrays, states, state_arrays->ucNumEntries);
+	PP_ASSERT_WITH_CODE((state_array_size <= table_size - state_array_offset),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*state_array = state_arrays;
+
 	return 0;
 }
 
+static int check_powerplay_tables(struct pp_hwmgr *hwmgr,
+	const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
+{
+	const ATOM_Vega10_State_Array *state_arrays;
+
+	return get_vega10_state_array(hwmgr, powerplay_table, &state_arrays);
+}
+
 static int set_platform_caps(struct pp_hwmgr *hwmgr, uint32_t powerplay_caps)
 {
 	set_hw_cap(
@@ -1249,15 +1274,14 @@ int vega10_get_number_of_powerplay_table_entries(struct pp_hwmgr *hwmgr)
 {
 	const ATOM_Vega10_State_Array *state_arrays;
 	const ATOM_Vega10_POWERPLAYTABLE *pp_table = get_powerplay_table(hwmgr);
+	int result;
 
 	PP_ASSERT_WITH_CODE((pp_table != NULL),
 			"Missing PowerPlay Table!", return -1);
-	PP_ASSERT_WITH_CODE((pp_table->sHeader.format_revision >=
-			ATOM_Vega10_TABLE_REVISION_VEGA10),
-			"Incorrect PowerPlay table revision!", return -1);
 
-	state_arrays = (ATOM_Vega10_State_Array *)(((unsigned long)pp_table) +
-			le16_to_cpu(pp_table->usStateArrayOffset));
+	result = get_vega10_state_array(hwmgr, pp_table, &state_arrays);
+	PP_ASSERT_WITH_CODE((result == 0),
+			    "Invalid PowerPlay Table State Array.", return result);
 
 	return (uint32_t)(state_arrays->ucNumEntries);
 }
@@ -1308,17 +1332,11 @@ int vega10_get_powerplay_table_entry(struct pp_hwmgr *hwmgr,
 
 	if (pp_table->sHeader.format_revision >=
 			ATOM_Vega10_TABLE_REVISION_VEGA10) {
-		state_arrays = (ATOM_Vega10_State_Array *)
-				(((unsigned long)pp_table) +
-				le16_to_cpu(pp_table->usStateArrayOffset));
-
-		PP_ASSERT_WITH_CODE(pp_table->usStateArrayOffset > 0,
-				"Invalid PowerPlay Table State Array Offset.",
-				return -1);
-		PP_ASSERT_WITH_CODE(state_arrays->ucNumEntries > 0,
+		result = get_vega10_state_array(hwmgr, pp_table, &state_arrays);
+		PP_ASSERT_WITH_CODE((result == 0),
 				"Invalid PowerPlay Table State Array.",
-				return -1);
-		PP_ASSERT_WITH_CODE((entry_index <= state_arrays->ucNumEntries),
+				return result);
+		PP_ASSERT_WITH_CODE((entry_index < state_arrays->ucNumEntries),
 				"Invalid PowerPlay Table State Array Entry.",
 				return -1);
 
@@ -1360,4 +1378,3 @@ int vega10_baco_set_cap(struct pp_hwmgr *hwmgr)
 			PHM_PlatformCaps_BACO);
 	return result;
 }
-
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c
index 89148f73b514a4..8e6b1565d00dec 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_processpptables.c
@@ -64,6 +64,13 @@ static int check_powerplay_tables(
 		struct pp_hwmgr *hwmgr,
 		const ATOM_Vega12_POWERPLAYTABLE *powerplay_table)
 {
+	size_t smc_pptable_size =
+		offsetofend(ATOM_Vega12_POWERPLAYTABLE, smcPPTable);
+	size_t table_size = hwmgr->soft_pp_table_size;
+
+	PP_ASSERT_WITH_CODE((table_size >= smc_pptable_size),
+			    "Invalid PowerPlay Table!", return -1);
+
 	PP_ASSERT_WITH_CODE((powerplay_table->sHeader.format_revision >=
 		ATOM_VEGA12_TABLE_REVISION_VEGA12),
 		"Unsupported PPTable format!", return -1);
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c
index 2b446f8866bac0..0d008573c0388f 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_processpptables.c
@@ -66,6 +66,13 @@ static int check_powerplay_tables(
 		struct pp_hwmgr *hwmgr,
 		const ATOM_Vega20_POWERPLAYTABLE *powerplay_table)
 {
+	size_t smc_pptable_size =
+		offsetofend(ATOM_Vega20_POWERPLAYTABLE, smcPPTable);
+	size_t table_size = hwmgr->soft_pp_table_size;
+
+	PP_ASSERT_WITH_CODE((table_size >= smc_pptable_size),
+			    "Invalid PowerPlay Table!", return -1);
+
 	PP_ASSERT_WITH_CODE((powerplay_table->sHeader.format_revision >=
 		ATOM_VEGA20_TABLE_REVISION_VEGA20),
 		"Unsupported PPTable format!", return -1);

From bb556e5ff437c0e5228011b9618fd9b2908400e6 Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 00:04:33 +0800
Subject: [PATCH 0071/1982] drm/amd/pm: Validate pp_table header before reading
 size

[ Upstream commit a17e79d01f22182a9fcbe79fcbe2ad1477d43e0f ]

smu_sys_set_pp_table() reads usStructureSize from the uploaded
pp_table buffer before validating that the buffer contains a complete
ATOM_COMMON_TABLE_HEADER. A short write can therefore make the driver
read past the supplied sysfs buffer.

Reject empty or header-short uploads before dereferencing the header
pointer.
Keep the existing structure-size check for the full uploaded table.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index 31f194142bd3ff..e0e208a0d9f94c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -636,25 +636,28 @@ static int smu_sys_set_pp_table(void *handle,
 {
 	struct smu_context *smu = handle;
 	struct smu_table_context *smu_table = &smu->smu_table;
-	ATOM_COMMON_TABLE_HEADER *header = (ATOM_COMMON_TABLE_HEADER *)buf;
+	ATOM_COMMON_TABLE_HEADER *header;
+	void *hardcode_pptable;
 	int ret = 0;
 
 	if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
 		return -EOPNOTSUPP;
 
+	if (!buf || size < sizeof(*header))
+		return -EINVAL;
+
+	header = (ATOM_COMMON_TABLE_HEADER *)buf;
 	if (header->usStructureSize != size) {
 		dev_err(smu->adev->dev, "pp table size not matched !\n");
 		return -EIO;
 	}
 
-	if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) {
-		kfree(smu_table->hardcode_pptable);
-		smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL);
-		if (!smu_table->hardcode_pptable)
-			return -ENOMEM;
-	}
+	hardcode_pptable = kmemdup(buf, size, GFP_KERNEL);
+	if (!hardcode_pptable)
+		return -ENOMEM;
 
-	memcpy(smu_table->hardcode_pptable, buf, size);
+	kfree(smu_table->hardcode_pptable);
+	smu_table->hardcode_pptable = hardcode_pptable;
 	smu_table->power_play_table = smu_table->hardcode_pptable;
 	smu_table->power_play_table_size = size;
 

From 88b64ba96052256c8b1693c97981da489b0f62e4 Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 11:36:20 +0800
Subject: [PATCH 0072/1982] drm/amd/pm: Use uploaded size for legacy custom
 PPTable

[ Upstream commit 055a40c32f3a2dcd4d1a6f85ff4c231cf35f1b53 ]

The legacy powerplay path used to allocate hardcode_pp_table from
the original VBIOS PPTable size, copy only the uploaded bytes into it,
and keep soft_pp_table_size unchanged. If a custom PPTable is shorter
than the original table, later code can still treat the stale tail as
valid table data.

Treat the uploaded buffer as the complete custom PPTable: duplicate the
uploaded buffer directly, replace hardcode_pp_table atomically, and set
soft_pp_table_size to the uploaded size.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/pm/powerplay/amd_powerplay.c  | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
index 5e197c463ed966..05c5e7d19ca1ce 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -663,25 +663,20 @@ static int amd_powerplay_reset(void *handle)
 static int pp_dpm_set_pp_table(void *handle, const char *buf, size_t size)
 {
 	struct pp_hwmgr *hwmgr = handle;
+	void *hardcode_pp_table;
 	int ret = -ENOMEM;
 
-	if (!hwmgr || !hwmgr->pm_en)
-		return -EINVAL;
-
-	if (size > hwmgr->soft_pp_table_size)
+	if (!hwmgr || !hwmgr->pm_en || !buf || !size || size > U32_MAX)
 		return -EINVAL;
 
-	if (!hwmgr->hardcode_pp_table) {
-		hwmgr->hardcode_pp_table = kmemdup(hwmgr->soft_pp_table,
-						   hwmgr->soft_pp_table_size,
-						   GFP_KERNEL);
-		if (!hwmgr->hardcode_pp_table)
-			return ret;
-	}
-
-	memcpy(hwmgr->hardcode_pp_table, buf, size);
+	hardcode_pp_table = kmemdup(buf, size, GFP_KERNEL);
+	if (!hardcode_pp_table)
+		return ret;
 
+	kfree(hwmgr->hardcode_pp_table);
+	hwmgr->hardcode_pp_table = hardcode_pp_table;
 	hwmgr->soft_pp_table = hwmgr->hardcode_pp_table;
+	hwmgr->soft_pp_table_size = size;
 
 	ret = amd_powerplay_reset(handle);
 	if (ret)

From 4487046481a55b053342c4c7273b65aeeeb46e6b Mon Sep 17 00:00:00 2001
From: Yongqiang Sun <Yongqiang.Sun@amd.com>
Date: Tue, 23 Jun 2026 15:24:11 -0400
Subject: [PATCH 0073/1982] drm/amdkfd: use node XCC count for v9 CRIU control
 stack restore

[ Upstream commit 1a0aa3c4cb207fcbf7ebd2d9ed9f1cfb4560bd2c ]

set_queue_properties_from_criu() divided the checkpointed control stack
size by NUM_XCC(adev->gfx.xcc_mask) (whole GPU), while the checkpoint
size was recorded, the MQD buffer allocated, and the control stack
restored using the per-node mask NUM_XCC(mm->dev->xcc_mask). On spatially
partitioned GFX9.4.3 (CPX/QPX) these differ, so the per-XCC control stack
size used for the restore memcpy could exceed the region sized for the
MQD allocation, writing past the BO into adjacent kernel memory; it also
broke legitimate restore on partitioned parts.

Divide by the per-node XCC count so allocation and copy agree,
leaving kfd_queue_acquire_buffers() to bound the size against
the node's advertised control stack size.

Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: David Francis <David.Francis@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 912c4ebd30405e..99a47f2a45e7a4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -1062,7 +1062,7 @@ int kfd_criu_restore_queue(struct kfd_process *p,
 	ctl_stack = mqd + q_data->mqd_size;
 
 	memset(&qp, 0, sizeof(qp));
-	set_queue_properties_from_criu(&qp, q_data, NUM_XCC(pdd->dev->adev->gfx.xcc_mask));
+	set_queue_properties_from_criu(&qp, q_data, NUM_XCC(pdd->dev->xcc_mask));
 
 	ret = kfd_queue_acquire_buffers(pdd, &qp);
 	if (ret) {

From 2fe60f66d6ab08a5a0df484d2c2983328142dc0d Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 11:36:39 +0800
Subject: [PATCH 0074/1982] drm/amd/pm: Validate Tonga PowerPlay state array
 bounds

[ Upstream commit 1ac24df78c566d767a5ef05a1fe0ecc55bac248d ]

process_pptables_v1_0.c builds the Tonga state array pointer
from usStateArrayOffset before checking that the table buffer covers
the referenced data. A truncated PowerPlay table can therefore lead to
out-of-bounds reads while validating the state array.

Validate the fixed table size first, then check the state array offset
and entry range before dereferencing the state array.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../powerplay/hwmgr/process_pptables_v1_0.c   | 62 ++++++++++++-------
 1 file changed, 40 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
index 6cfef1b295abbe..94c1e2c103703b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
@@ -1113,15 +1113,17 @@ static int init_thermal_controller(
  * @powerplay_table: Pointer to the PowerPlay Table.
  * Exception:  2 if the powerplay table is incorrect.
  */
-static int check_powerplay_tables(
-		struct pp_hwmgr *hwmgr,
-		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table
-		)
+static int get_tonga_state_array(struct pp_hwmgr *hwmgr,
+	const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+	const ATOM_Tonga_State_Array **state_array)
 {
 	const ATOM_Tonga_State_Array *state_arrays;
+	u16 state_array_offset;
+	size_t state_array_size;
+	size_t table_size = hwmgr->soft_pp_table_size;
 
-	state_arrays = (ATOM_Tonga_State_Array *)(((unsigned long)powerplay_table) +
-		le16_to_cpu(powerplay_table->usStateArrayOffset));
+	PP_ASSERT_WITH_CODE((table_size >= sizeof(*powerplay_table)),
+			    "Invalid PowerPlay Table!", return -1);
 
 	PP_ASSERT_WITH_CODE((ATOM_Tonga_TABLE_REVISION_TONGA <=
 		powerplay_table->sHeader.ucTableFormatRevision),
@@ -1130,12 +1132,34 @@ static int check_powerplay_tables(
 		"State table is not set!", return -1);
 	PP_ASSERT_WITH_CODE((0 < powerplay_table->sHeader.usStructureSize),
 		"Invalid PowerPlay Table!", return -1);
+
+	state_array_offset = le16_to_cpu(powerplay_table->usStateArrayOffset);
+	PP_ASSERT_WITH_CODE((state_array_offset <=
+			     table_size - sizeof(*state_arrays)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	state_arrays = (ATOM_Tonga_State_Array *)(((unsigned long)powerplay_table) +
+		state_array_offset);
 	PP_ASSERT_WITH_CODE((0 < state_arrays->ucNumEntries),
 		"Invalid PowerPlay Table!", return -1);
 
+	state_array_size = struct_size(state_arrays, entries, state_arrays->ucNumEntries);
+	PP_ASSERT_WITH_CODE((state_array_size <= table_size - state_array_offset),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*state_array = state_arrays;
+
 	return 0;
 }
 
+static int check_powerplay_tables(struct pp_hwmgr *hwmgr,
+	const ATOM_Tonga_POWERPLAYTABLE *powerplay_table)
+{
+	const ATOM_Tonga_State_Array *state_arrays;
+
+	return get_tonga_state_array(hwmgr, powerplay_table, &state_arrays);
+}
+
 static int pp_tables_v1_0_initialize(struct pp_hwmgr *hwmgr)
 {
 	int result = 0;
@@ -1239,17 +1263,16 @@ const struct pp_table_func pptable_v1_0_funcs = {
 
 int get_number_of_powerplay_table_entries_v1_0(struct pp_hwmgr *hwmgr)
 {
-	ATOM_Tonga_State_Array const *state_arrays;
+	const ATOM_Tonga_State_Array *state_arrays;
 	const ATOM_Tonga_POWERPLAYTABLE *pp_table = get_powerplay_table(hwmgr);
+	int result;
 
 	PP_ASSERT_WITH_CODE((NULL != pp_table),
 			"Missing PowerPlay Table!", return -1);
-	PP_ASSERT_WITH_CODE((pp_table->sHeader.ucTableFormatRevision >=
-			ATOM_Tonga_TABLE_REVISION_TONGA),
-			"Incorrect PowerPlay table revision!", return -1);
 
-	state_arrays = (ATOM_Tonga_State_Array *)(((unsigned long)pp_table) +
-			le16_to_cpu(pp_table->usStateArrayOffset));
+	result = get_tonga_state_array(hwmgr, pp_table, &state_arrays);
+	PP_ASSERT_WITH_CODE((result == 0),
+			    "Invalid PowerPlay Table State Array.", return result);
 
 	return (uint32_t)(state_arrays->ucNumEntries);
 }
@@ -1380,15 +1403,11 @@ int get_powerplay_table_entry_v1_0(struct pp_hwmgr *hwmgr,
 
 	if (pp_table->sHeader.ucTableFormatRevision >=
 			ATOM_Tonga_TABLE_REVISION_TONGA) {
-		state_arrays = (ATOM_Tonga_State_Array *)(((unsigned long)pp_table) +
-				le16_to_cpu(pp_table->usStateArrayOffset));
-
-		PP_ASSERT_WITH_CODE((0 < pp_table->usStateArrayOffset),
-				"Invalid PowerPlay Table State Array Offset.", return -1);
-		PP_ASSERT_WITH_CODE((0 < state_arrays->ucNumEntries),
-				"Invalid PowerPlay Table State Array.", return -1);
-		PP_ASSERT_WITH_CODE((entry_index <= state_arrays->ucNumEntries),
-				"Invalid PowerPlay Table State Array Entry.", return -1);
+		result = get_tonga_state_array(hwmgr, pp_table, &state_arrays);
+		PP_ASSERT_WITH_CODE((result == 0),
+				    "Invalid PowerPlay Table State Array.", return result);
+		PP_ASSERT_WITH_CODE((entry_index < state_arrays->ucNumEntries),
+				    "Invalid PowerPlay Table State Array Entry.", return -1);
 
 		state_entry = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
 						ATOM_Tonga_State, entries,
@@ -1414,4 +1433,3 @@ int get_powerplay_table_entry_v1_0(struct pp_hwmgr *hwmgr,
 
 	return result;
 }
-

From f20fe19df5d99abc6fac744b279486cb1c2ab07f Mon Sep 17 00:00:00 2001
From: Xiang Liu <xiang.liu@amd.com>
Date: Tue, 23 Jun 2026 10:59:18 +0800
Subject: [PATCH 0075/1982] drm/amd/pm: Guard VBIOS AC timing table walk

[ Upstream commit 2bf6867e5953a140fc91c3159987656e44ed29fb ]

Reject AC timing blocks with a stride smaller than a dword before walking
VBIOS data. A zero stride can otherwise keep reg_data pinned on a
nonmatching MEM_ID forever.

Also bound the data-block and END marker reads by the returned VRAM_Info
table size so malformed index/data sizes do not push the timing walk past
the table.

Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/pm/powerplay/hwmgr/ppatomctrl.c   | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
index 1fff7567bca275..4b796d60b03d4a 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
@@ -46,16 +46,22 @@ union voltage_object_info {
 static int atomctrl_retrieve_ac_timing(
 		uint8_t index,
 		ATOM_INIT_REG_BLOCK *reg_block,
+		u8 *table_end,
 		pp_atomctrl_mc_reg_table *table)
 {
 	uint32_t i, j;
+	u16 stride = le16_to_cpu(reg_block->usRegDataBlkSize);
 	uint8_t tmem_id;
 	ATOM_MEMORY_SETTING_DATA_BLOCK *reg_data = (ATOM_MEMORY_SETTING_DATA_BLOCK *)
 		((uint8_t *)reg_block + (2 * sizeof(uint16_t)) + le16_to_cpu(reg_block->usRegIndexTblSize));
 
 	uint8_t num_ranges = 0;
 
-	while (*(uint32_t *)reg_data != END_OF_REG_DATA_BLOCK &&
+	if (stride < sizeof(uint32_t))
+		return -EINVAL;
+
+	while ((uint8_t *)reg_data + sizeof(uint32_t) <= table_end &&
+	       *(uint32_t *)reg_data != END_OF_REG_DATA_BLOCK &&
 			num_ranges < VBIOS_MAX_AC_TIMING_ENTRIES) {
 		tmem_id = (uint8_t)((*(uint32_t *)reg_data & MEM_ID_MASK) >> MEM_ID_SHIFT);
 
@@ -67,6 +73,10 @@ static int atomctrl_retrieve_ac_timing(
 			for (i = 0, j = 1; i < table->last; i++) {
 				if ((table->mc_reg_address[i].uc_pre_reg_data &
 							LOW_NIBBLE_MASK) == DATA_FROM_TABLE) {
+					if ((uint8_t *)reg_data +
+					    (j + 1) * sizeof(uint32_t) > table_end)
+						return -EINVAL;
+
 					table->mc_reg_table_entry[num_ranges].mc_data[i] =
 						(uint32_t)*((uint32_t *)reg_data + j);
 					j++;
@@ -81,11 +91,13 @@ static int atomctrl_retrieve_ac_timing(
 		}
 
 		reg_data = (ATOM_MEMORY_SETTING_DATA_BLOCK *)
-			((uint8_t *)reg_data + le16_to_cpu(reg_block->usRegDataBlkSize)) ;
+			((uint8_t *)reg_data + stride);
 	}
 
-	PP_ASSERT_WITH_CODE((*(uint32_t *)reg_data == END_OF_REG_DATA_BLOCK),
-			"Invalid VramInfo table.", return -1);
+	if ((uint8_t *)reg_data + sizeof(uint32_t) > table_end ||
+	    *(uint32_t *)reg_data != END_OF_REG_DATA_BLOCK)
+		return -EINVAL;
+
 	table->num_entries = num_ranges;
 
 	return 0;
@@ -136,6 +148,7 @@ int atomctrl_initialize_mc_reg_table(
 {
 	ATOM_VRAM_INFO_HEADER_V2_1 *vram_info;
 	ATOM_INIT_REG_BLOCK *reg_block;
+	u8 *table_end;
 	int result = 0;
 	u8 frev, crev;
 	u16 size;
@@ -157,6 +170,7 @@ int atomctrl_initialize_mc_reg_table(
 	}
 
 	if (0 == result) {
+		table_end = (uint8_t *)vram_info + size;
 		reg_block = (ATOM_INIT_REG_BLOCK *)
 			((uint8_t *)vram_info + le16_to_cpu(vram_info->usMemClkPatchTblOffset));
 		result = atomctrl_set_mc_reg_address_table(reg_block, table);
@@ -164,7 +178,7 @@ int atomctrl_initialize_mc_reg_table(
 
 	if (0 == result) {
 		result = atomctrl_retrieve_ac_timing(module_index,
-					reg_block, table);
+					reg_block, table_end, table);
 	}
 
 	return result;
@@ -177,6 +191,7 @@ int atomctrl_initialize_mc_reg_table_v2_2(
 {
 	ATOM_VRAM_INFO_HEADER_V2_2 *vram_info;
 	ATOM_INIT_REG_BLOCK *reg_block;
+	u8 *table_end;
 	int result = 0;
 	u8 frev, crev;
 	u16 size;
@@ -198,6 +213,7 @@ int atomctrl_initialize_mc_reg_table_v2_2(
 	}
 
 	if (0 == result) {
+		table_end = (uint8_t *)vram_info + size;
 		reg_block = (ATOM_INIT_REG_BLOCK *)
 			((uint8_t *)vram_info + le16_to_cpu(vram_info->usMemClkPatchTblOffset));
 		result = atomctrl_set_mc_reg_address_table(reg_block, table);
@@ -205,7 +221,7 @@ int atomctrl_initialize_mc_reg_table_v2_2(
 
 	if (0 == result) {
 		result = atomctrl_retrieve_ac_timing(module_index,
-					reg_block, table);
+					reg_block, table_end, table);
 	}
 
 	return result;

From 269e57807b70ba29832a866de83a3cbe00b0cc66 Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 16:37:07 +0800
Subject: [PATCH 0076/1982] drm/amd/pm: Validate Tonga PPTable subtable bounds

[ Upstream commit 53ef33c084c5778cc2dcd1efff25e31b6e231141 ]

v1:
Tonga PPTable parsing also relies on VBIOS offsets, revision fields
and entry counts for several subtables. Malformed data can cause
out-of-bounds reads, while voltage lookup tables can overrun their
fixed-size destination arrays.

Add common bounds helpers and validate fixed subtables, dynamic entry
arrays and revision-specific layouts before consuming voltage lookup,
dependency, PCIE, power-tune, hard-limit, thermal, fan, GPIO, PPM and
VCE state data.

v2:
correct to handle get_tonga_ppm_table() return value.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../powerplay/hwmgr/process_pptables_v1_0.c   | 606 +++++++++++++++---
 1 file changed, 521 insertions(+), 85 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
index 94c1e2c103703b..78037edb4752cc 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
@@ -150,6 +150,368 @@ static const void *get_powerplay_table(struct pp_hwmgr *hwmgr)
 	return table_address;
 }
 
+static bool tonga_pp_table_has_space(struct pp_hwmgr *hwmgr, size_t offset,
+				     size_t size)
+{
+	size_t table_size = hwmgr->soft_pp_table_size;
+
+	return offset <= table_size && size <= table_size - offset;
+}
+
+static int get_tonga_subtable(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		u16 table_offset, size_t table_size, const void **table)
+{
+	PP_ASSERT_WITH_CODE((table_offset != 0),
+			    "Invalid PowerPlay Table!", return -1);
+	PP_ASSERT_WITH_CODE((tonga_pp_table_has_space(hwmgr, table_offset,
+						      table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*table = (const void *)(((unsigned long)powerplay_table) + table_offset);
+
+	return 0;
+}
+
+static int validate_tonga_table_entries(struct pp_hwmgr *hwmgr,
+		u16 table_offset, size_t entries_offset,
+		u8 num_entries, size_t entry_size)
+{
+	size_t table_size;
+
+	PP_ASSERT_WITH_CODE((num_entries != 0),
+			    "Invalid PowerPlay Table!", return -1);
+
+	table_size = entries_offset + num_entries * entry_size;
+	PP_ASSERT_WITH_CODE((tonga_pp_table_has_space(hwmgr, table_offset,
+						      table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	return 0;
+}
+
+static int get_tonga_voltage_lookup_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		u16 table_offset, uint32_t max_levels,
+		const ATOM_Tonga_Voltage_Lookup_Table **lookup_table)
+{
+	const ATOM_Tonga_Voltage_Lookup_Table *table;
+	size_t table_size;
+	int ret;
+
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	PP_ASSERT_WITH_CODE((table->ucNumEntries != 0 &&
+			     table->ucNumEntries <= max_levels),
+			    "Invalid PowerPlay Table!", return -1);
+
+	table_size = offsetof(ATOM_Tonga_Voltage_Lookup_Table, entries) +
+		table->ucNumEntries * sizeof(ATOM_Tonga_Voltage_Lookup_Record);
+	PP_ASSERT_WITH_CODE((tonga_pp_table_has_space(hwmgr, table_offset,
+						      table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*lookup_table = table;
+
+	return 0;
+}
+
+static int get_tonga_mclk_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_MCLK_Dependency_Table **mclk_dep_table)
+{
+	const ATOM_Tonga_MCLK_Dependency_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usMclkDependencyTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset,
+					   offsetof(ATOM_Tonga_MCLK_Dependency_Table,
+						    entries),
+					   table->ucNumEntries,
+					   sizeof(ATOM_Tonga_MCLK_Dependency_Record));
+	if (ret)
+		return ret;
+
+	*mclk_dep_table = table;
+
+	return 0;
+}
+
+static int get_tonga_mm_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_MM_Dependency_Table **mm_dep_table)
+{
+	const ATOM_Tonga_MM_Dependency_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usMMDependencyTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset,
+					   offsetof(ATOM_Tonga_MM_Dependency_Table,
+						    entries),
+					   table->ucNumEntries,
+					   sizeof(ATOM_Tonga_MM_Dependency_Record));
+	if (ret)
+		return ret;
+
+	*mm_dep_table = table;
+
+	return 0;
+}
+
+static int get_tonga_sclk_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const PPTable_Generic_SubTable_Header **sclk_dep_table)
+{
+	const PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t entries_offset;
+	size_t entry_size;
+	u8 num_entries;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usSclkDependencyTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId < 1) {
+		const ATOM_Tonga_SCLK_Dependency_Table *table =
+			(const ATOM_Tonga_SCLK_Dependency_Table *)header;
+
+		entries_offset = offsetof(ATOM_Tonga_SCLK_Dependency_Table, entries);
+		entry_size = sizeof(ATOM_Tonga_SCLK_Dependency_Record);
+		num_entries = table->ucNumEntries;
+	} else {
+		const ATOM_Polaris_SCLK_Dependency_Table *table =
+			(const ATOM_Polaris_SCLK_Dependency_Table *)header;
+
+		entries_offset = offsetof(ATOM_Polaris_SCLK_Dependency_Table, entries);
+		entry_size = sizeof(ATOM_Polaris_SCLK_Dependency_Record);
+		num_entries = table->ucNumEntries;
+	}
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset, entries_offset,
+					   num_entries, entry_size);
+	if (ret)
+		return ret;
+
+	*sclk_dep_table = header;
+
+	return 0;
+}
+
+static int get_tonga_pcie_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const PPTable_Generic_SubTable_Header **pcie_table)
+{
+	const PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t entries_offset;
+	size_t entry_size;
+	u8 num_entries;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usPCIETableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId < 1) {
+		const ATOM_Tonga_PCIE_Table *table =
+			(const ATOM_Tonga_PCIE_Table *)header;
+
+		entries_offset = offsetof(ATOM_Tonga_PCIE_Table, entries);
+		entry_size = sizeof(ATOM_Tonga_PCIE_Record);
+		num_entries = table->ucNumEntries;
+	} else {
+		const ATOM_Polaris10_PCIE_Table *table =
+			(const ATOM_Polaris10_PCIE_Table *)header;
+
+		entries_offset = offsetof(ATOM_Polaris10_PCIE_Table, entries);
+		entry_size = sizeof(ATOM_Polaris10_PCIE_Record);
+		num_entries = table->ucNumEntries;
+	}
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset, entries_offset,
+					   num_entries, entry_size);
+	if (ret)
+		return ret;
+
+	*pcie_table = header;
+
+	return 0;
+}
+
+static int get_tonga_hard_limit_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_Hard_Limit_Table **hard_limit_table)
+{
+	const ATOM_Tonga_Hard_Limit_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usHardLimitTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset,
+					   offsetof(ATOM_Tonga_Hard_Limit_Table,
+						    entries),
+					   table->ucNumEntries,
+					   sizeof(ATOM_Tonga_Hard_Limit_Record));
+	if (ret)
+		return ret;
+
+	*hard_limit_table = table;
+
+	return 0;
+}
+
+static int get_tonga_thermal_controller_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_Thermal_Controller **thermal_controller)
+{
+	u16 table_offset;
+
+	table_offset = le16_to_cpu(powerplay_table->usThermalControllerOffset);
+
+	return get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(**thermal_controller),
+				  (const void **)thermal_controller);
+}
+
+static int get_tonga_fan_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const PPTable_Generic_SubTable_Header **fan_table)
+{
+	const PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t table_size;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usFanTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId < 8)
+		table_size = sizeof(ATOM_Tonga_Fan_Table);
+	else if (header->ucRevId == 8)
+		table_size = sizeof(ATOM_Fiji_Fan_Table);
+	else
+		table_size = sizeof(ATOM_Polaris_Fan_Table);
+
+	PP_ASSERT_WITH_CODE((tonga_pp_table_has_space(hwmgr, table_offset,
+						      table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*fan_table = header;
+
+	return 0;
+}
+
+static int get_tonga_power_tune_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const PPTable_Generic_SubTable_Header **power_tune_table)
+{
+	const PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t table_size;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usPowerTuneTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId < 3)
+		table_size = sizeof(ATOM_Tonga_PowerTune_Table);
+	else if (header->ucRevId < 4)
+		table_size = sizeof(ATOM_Fiji_PowerTune_Table);
+	else
+		table_size = sizeof(ATOM_Polaris_PowerTune_Table);
+
+	PP_ASSERT_WITH_CODE((tonga_pp_table_has_space(hwmgr, table_offset,
+						      table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*power_tune_table = header;
+
+	return 0;
+}
+
+static int get_tonga_ppm_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_PPM_Table **ppm_table)
+{
+	u16 table_offset;
+
+	table_offset = le16_to_cpu(powerplay_table->usPPMTableOffset);
+
+	return get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(**ppm_table), (const void **)ppm_table);
+}
+
+static int get_tonga_gpio_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_GPIO_Table **gpio_table)
+{
+	u16 table_offset;
+
+	table_offset = le16_to_cpu(powerplay_table->usGPIOTableOffset);
+
+	return get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(**gpio_table), (const void **)gpio_table);
+}
+
+static int get_tonga_vce_state_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Tonga_VCE_State_Table **vce_state_table)
+{
+	const ATOM_Tonga_VCE_State_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usVCEStateTableOffset);
+	ret = get_tonga_subtable(hwmgr, powerplay_table, table_offset,
+				 sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_tonga_table_entries(hwmgr, table_offset,
+					   offsetof(ATOM_Tonga_VCE_State_Table,
+						    entries),
+					   table->ucNumEntries,
+					   sizeof(ATOM_Tonga_VCE_State_Record));
+	if (ret)
+		return ret;
+
+	*vce_state_table = table;
+
+	return 0;
+}
+
 static int get_vddc_lookup_table(
 		struct pp_hwmgr	*hwmgr,
 		phm_ppt_v1_voltage_lookup_table	**lookup_table,
@@ -198,7 +560,7 @@ static int get_vddc_lookup_table(
  */
 static int get_platform_power_management_table(
 		struct pp_hwmgr *hwmgr,
-		ATOM_Tonga_PPM_Table *atom_ppm_table)
+		const ATOM_Tonga_PPM_Table *atom_ppm_table)
 {
 	struct phm_ppm_table *ptr = kzalloc(sizeof(*ptr), GFP_KERNEL);
 	struct phm_ppt_v1_information *pp_table_information =
@@ -246,7 +608,7 @@ static int init_dpm_2_parameters(
 {
 	int result = 0;
 	struct phm_ppt_v1_information *pp_table_information = (struct phm_ppt_v1_information *)(hwmgr->pptable);
-	ATOM_Tonga_PPM_Table *atom_ppm_table;
+	const ATOM_Tonga_PPM_Table *atom_ppm_table;
 	uint32_t disable_ppm = 0;
 	uint32_t disable_power_control = 0;
 
@@ -275,30 +637,39 @@ static int init_dpm_2_parameters(
 	}
 
 	if (0 != powerplay_table->usVddcLookupTableOffset) {
-		const ATOM_Tonga_Voltage_Lookup_Table *pVddcCACTable =
-			(ATOM_Tonga_Voltage_Lookup_Table *)(((unsigned long)powerplay_table) +
-			le16_to_cpu(powerplay_table->usVddcLookupTableOffset));
-
-		result = get_vddc_lookup_table(hwmgr,
-			&pp_table_information->vddc_lookup_table, pVddcCACTable, 16);
+		const ATOM_Tonga_Voltage_Lookup_Table *pVddcCACTable;
+
+		result = get_tonga_voltage_lookup_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usVddcLookupTableOffset),
+				16, &pVddcCACTable);
+		if (!result)
+			result = get_vddc_lookup_table(hwmgr,
+				&pp_table_information->vddc_lookup_table,
+				pVddcCACTable, 16);
 	}
 
-	if (0 != powerplay_table->usVddgfxLookupTableOffset) {
-		const ATOM_Tonga_Voltage_Lookup_Table *pVddgfxCACTable =
-			(ATOM_Tonga_Voltage_Lookup_Table *)(((unsigned long)powerplay_table) +
-			le16_to_cpu(powerplay_table->usVddgfxLookupTableOffset));
+	if (!result && 0 != powerplay_table->usVddgfxLookupTableOffset) {
+		const ATOM_Tonga_Voltage_Lookup_Table *pVddgfxCACTable;
 
-		result = get_vddc_lookup_table(hwmgr,
-			&pp_table_information->vddgfx_lookup_table, pVddgfxCACTable, 16);
+		result = get_tonga_voltage_lookup_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usVddgfxLookupTableOffset),
+				16, &pVddgfxCACTable);
+		if (!result)
+			result = get_vddc_lookup_table(hwmgr,
+				&pp_table_information->vddgfx_lookup_table,
+				pVddgfxCACTable, 16);
 	}
 
 	disable_ppm = 0;
 	if (0 == disable_ppm) {
-		atom_ppm_table = (ATOM_Tonga_PPM_Table *)
-			(((unsigned long)powerplay_table) + le16_to_cpu(powerplay_table->usPPMTableOffset));
-
 		if (0 != powerplay_table->usPPMTableOffset) {
-			if (get_platform_power_management_table(hwmgr, atom_ppm_table) == 0) {
+			int ret;
+
+			ret = get_tonga_ppm_table(hwmgr, powerplay_table,
+						  &atom_ppm_table);
+			if (!ret &&
+			    get_platform_power_management_table(hwmgr,
+							       atom_ppm_table) == 0) {
 				phm_cap_set(hwmgr->platform_descriptor.platformCaps,
 					PHM_PlatformCaps_EnablePlatformPowerManagement);
 			}
@@ -792,28 +1163,13 @@ static int init_clock_voltage_dependency(
 	int result = 0;
 	struct phm_ppt_v1_information *pp_table_information =
 		(struct phm_ppt_v1_information *)(hwmgr->pptable);
-
-	const ATOM_Tonga_MM_Dependency_Table *mm_dependency_table =
-		(const ATOM_Tonga_MM_Dependency_Table *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usMMDependencyTableOffset));
-	const PPTable_Generic_SubTable_Header *pPowerTuneTable =
-		(const PPTable_Generic_SubTable_Header *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usPowerTuneTableOffset));
-	const ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table =
-		(const ATOM_Tonga_MCLK_Dependency_Table *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usMclkDependencyTableOffset));
-	const PPTable_Generic_SubTable_Header *sclk_dep_table =
-		(const PPTable_Generic_SubTable_Header *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usSclkDependencyTableOffset));
-	const ATOM_Tonga_Hard_Limit_Table *pHardLimits =
-		(const ATOM_Tonga_Hard_Limit_Table *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usHardLimitTableOffset));
-	const PPTable_Generic_SubTable_Header *pcie_table =
-		(const PPTable_Generic_SubTable_Header *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usPCIETableOffset));
-	const ATOM_Tonga_GPIO_Table *gpio_table =
-		(const ATOM_Tonga_GPIO_Table *)(((unsigned long) powerplay_table) +
-		le16_to_cpu(powerplay_table->usGPIOTableOffset));
+	const ATOM_Tonga_MM_Dependency_Table *mm_dependency_table;
+	const PPTable_Generic_SubTable_Header *pPowerTuneTable;
+	const ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table;
+	const PPTable_Generic_SubTable_Header *sclk_dep_table;
+	const ATOM_Tonga_Hard_Limit_Table *pHardLimits;
+	const PPTable_Generic_SubTable_Header *pcie_table;
+	const ATOM_Tonga_GPIO_Table *gpio_table;
 
 	pp_table_information->vdd_dep_on_sclk = NULL;
 	pp_table_information->vdd_dep_on_mclk = NULL;
@@ -821,29 +1177,58 @@ static int init_clock_voltage_dependency(
 	pp_table_information->pcie_table = NULL;
 	pp_table_information->gpio_table = NULL;
 
-	if (powerplay_table->usMMDependencyTableOffset != 0)
-		result = get_mm_clock_voltage_table(hwmgr,
-		&pp_table_information->mm_dep_table, mm_dependency_table);
+	if (powerplay_table->usMMDependencyTableOffset != 0) {
+		result = get_tonga_mm_dependency_table(hwmgr, powerplay_table,
+						       &mm_dependency_table);
+		if (!result)
+			result = get_mm_clock_voltage_table(hwmgr,
+				&pp_table_information->mm_dep_table,
+				mm_dependency_table);
+	}
 
-	if (result == 0 && powerplay_table->usPowerTuneTableOffset != 0)
-		result = get_cac_tdp_table(hwmgr,
-		&pp_table_information->cac_dtp_table, pPowerTuneTable);
+	if (result == 0 && powerplay_table->usPowerTuneTableOffset != 0) {
+		result = get_tonga_power_tune_table(hwmgr, powerplay_table,
+						    &pPowerTuneTable);
+		if (!result)
+			result = get_cac_tdp_table(hwmgr,
+				&pp_table_information->cac_dtp_table,
+				pPowerTuneTable);
+	}
 
-	if (result == 0 && powerplay_table->usSclkDependencyTableOffset != 0)
-		result = get_sclk_voltage_dependency_table(hwmgr,
-		&pp_table_information->vdd_dep_on_sclk, sclk_dep_table);
+	if (result == 0 && powerplay_table->usSclkDependencyTableOffset != 0) {
+		result = get_tonga_sclk_dependency_table(hwmgr, powerplay_table,
+							 &sclk_dep_table);
+		if (!result)
+			result = get_sclk_voltage_dependency_table(hwmgr,
+				&pp_table_information->vdd_dep_on_sclk,
+				sclk_dep_table);
+	}
 
-	if (result == 0 && powerplay_table->usMclkDependencyTableOffset != 0)
-		result = get_mclk_voltage_dependency_table(hwmgr,
-		&pp_table_information->vdd_dep_on_mclk, mclk_dep_table);
+	if (result == 0 && powerplay_table->usMclkDependencyTableOffset != 0) {
+		result = get_tonga_mclk_dependency_table(hwmgr, powerplay_table,
+							 &mclk_dep_table);
+		if (!result)
+			result = get_mclk_voltage_dependency_table(hwmgr,
+				&pp_table_information->vdd_dep_on_mclk,
+				mclk_dep_table);
+	}
 
-	if (result == 0 && powerplay_table->usPCIETableOffset != 0)
-		result = get_pcie_table(hwmgr,
-		&pp_table_information->pcie_table, pcie_table);
+	if (result == 0 && powerplay_table->usPCIETableOffset != 0) {
+		result = get_tonga_pcie_table(hwmgr, powerplay_table,
+					      &pcie_table);
+		if (!result)
+			result = get_pcie_table(hwmgr,
+				&pp_table_information->pcie_table, pcie_table);
+	}
 
-	if (result == 0 && powerplay_table->usHardLimitTableOffset != 0)
-		result = get_hard_limits(hwmgr,
-		&pp_table_information->max_clock_voltage_on_dc, pHardLimits);
+	if (result == 0 && powerplay_table->usHardLimitTableOffset != 0) {
+		result = get_tonga_hard_limit_table(hwmgr, powerplay_table,
+						    &pHardLimits);
+		if (!result)
+			result = get_hard_limits(hwmgr,
+				&pp_table_information->max_clock_voltage_on_dc,
+				pHardLimits);
+	}
 
 	hwmgr->dyn_state.max_clock_voltage_on_dc.sclk =
 		pp_table_information->max_clock_voltage_on_dc.sclk;
@@ -864,9 +1249,13 @@ static int init_clock_voltage_dependency(
 		result = get_valid_clk(hwmgr, &pp_table_information->valid_sclk_values,
 		pp_table_information->vdd_dep_on_sclk);
 
-	if (!result && gpio_table)
-		result = get_gpio_table(hwmgr, &pp_table_information->gpio_table,
-				gpio_table);
+	if (!result && powerplay_table->usGPIOTableOffset) {
+		result = get_tonga_gpio_table(hwmgr, powerplay_table,
+					      &gpio_table);
+		if (!result)
+			result = get_gpio_table(hwmgr,
+				&pp_table_information->gpio_table, gpio_table);
+	}
 
 	return result;
 }
@@ -911,14 +1300,17 @@ static int init_thermal_controller(
 		)
 {
 	const PPTable_Generic_SubTable_Header *fan_table;
-	ATOM_Tonga_Thermal_Controller *thermal_controller;
+	const ATOM_Tonga_Thermal_Controller *thermal_controller;
+	int ret;
 
-	thermal_controller = (ATOM_Tonga_Thermal_Controller *)
-		(((unsigned long)powerplay_table) +
-		le16_to_cpu(powerplay_table->usThermalControllerOffset));
 	PP_ASSERT_WITH_CODE((0 != powerplay_table->usThermalControllerOffset),
 		"Thermal controller table not set!", return -1);
 
+	ret = get_tonga_thermal_controller_table(hwmgr, powerplay_table,
+						 &thermal_controller);
+	if (ret)
+		return ret;
+
 	hwmgr->thermal_controller.ucType = thermal_controller->ucType;
 	hwmgr->thermal_controller.ucI2cLine = thermal_controller->ucI2cLine;
 	hwmgr->thermal_controller.ucI2cAddress = thermal_controller->ucI2cAddress;
@@ -946,12 +1338,13 @@ static int init_thermal_controller(
 		return 0;
 	}
 
-	fan_table = (const PPTable_Generic_SubTable_Header *)
-		(((unsigned long)powerplay_table) +
-		le16_to_cpu(powerplay_table->usFanTableOffset));
-
 	PP_ASSERT_WITH_CODE((0 != powerplay_table->usFanTableOffset),
 		"Fan table not set!", return -1);
+
+	ret = get_tonga_fan_table(hwmgr, powerplay_table, &fan_table);
+	if (ret)
+		return ret;
+
 	PP_ASSERT_WITH_CODE((0 < fan_table->ucRevId),
 		"Unsupported fan table format!", return -1);
 
@@ -1313,13 +1706,15 @@ static int ppt_get_num_of_vce_state_table_entries_v1_0(struct pp_hwmgr *hwmgr)
 {
 	const ATOM_Tonga_POWERPLAYTABLE *pp_table = get_powerplay_table(hwmgr);
 	const ATOM_Tonga_VCE_State_Table *vce_state_table;
+	int ret;
 
 
 	if (pp_table == NULL)
 		return 0;
 
-	vce_state_table = (void *)pp_table +
-			le16_to_cpu(pp_table->usVCEStateTableOffset);
+	ret = get_tonga_vce_state_table(hwmgr, pp_table, &vce_state_table);
+	if (ret)
+		return 0;
 
 	return vce_state_table->ucNumEntries;
 }
@@ -1328,18 +1723,39 @@ static int ppt_get_vce_state_table_entry_v1_0(struct pp_hwmgr *hwmgr, uint32_t i
 		struct amd_vce_state *vce_state, void **clock_info, uint32_t *flag)
 {
 	const ATOM_Tonga_VCE_State_Record *vce_state_record;
-	ATOM_Tonga_SCLK_Dependency_Record *sclk_dep_record;
+	ATOM_Tonga_SCLK_Dependency_Record *sclk_dep_record = NULL;
+	ATOM_Polaris_SCLK_Dependency_Record *polaris_sclk_dep_record = NULL;
 	ATOM_Tonga_MCLK_Dependency_Record *mclk_dep_record;
 	ATOM_Tonga_MM_Dependency_Record *mm_dep_record;
 	const ATOM_Tonga_POWERPLAYTABLE *pptable = get_powerplay_table(hwmgr);
-	const ATOM_Tonga_VCE_State_Table *vce_state_table = (ATOM_Tonga_VCE_State_Table *)(((unsigned long)pptable)
-							  + le16_to_cpu(pptable->usVCEStateTableOffset));
-	const ATOM_Tonga_SCLK_Dependency_Table *sclk_dep_table = (ATOM_Tonga_SCLK_Dependency_Table *)(((unsigned long)pptable)
-							  + le16_to_cpu(pptable->usSclkDependencyTableOffset));
-	const ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table = (ATOM_Tonga_MCLK_Dependency_Table *)(((unsigned long)pptable)
-							  + le16_to_cpu(pptable->usMclkDependencyTableOffset));
-	const ATOM_Tonga_MM_Dependency_Table *mm_dep_table = (ATOM_Tonga_MM_Dependency_Table *)(((unsigned long)pptable)
-							  + le16_to_cpu(pptable->usMMDependencyTableOffset));
+	const ATOM_Tonga_VCE_State_Table *vce_state_table;
+	const PPTable_Generic_SubTable_Header *sclk_dep_table_header;
+	const ATOM_Tonga_SCLK_Dependency_Table *sclk_dep_table;
+	const ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table;
+	const ATOM_Tonga_MM_Dependency_Table *mm_dep_table;
+	int ret;
+
+	if (!pptable)
+		return -EINVAL;
+
+	ret = get_tonga_vce_state_table(hwmgr, pptable, &vce_state_table);
+	if (ret)
+		return ret;
+
+	ret = get_tonga_sclk_dependency_table(hwmgr, pptable,
+					      &sclk_dep_table_header);
+	if (ret)
+		return ret;
+	sclk_dep_table = (const ATOM_Tonga_SCLK_Dependency_Table *)
+		sclk_dep_table_header;
+
+	ret = get_tonga_mclk_dependency_table(hwmgr, pptable, &mclk_dep_table);
+	if (ret)
+		return ret;
+
+	ret = get_tonga_mm_dependency_table(hwmgr, pptable, &mm_dep_table);
+	if (ret)
+		return ret;
 
 	PP_ASSERT_WITH_CODE((i < vce_state_table->ucNumEntries),
 			 "Requested state entry ID is out of range!",
@@ -1348,10 +1764,27 @@ static int ppt_get_vce_state_table_entry_v1_0(struct pp_hwmgr *hwmgr, uint32_t i
 	vce_state_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
 					ATOM_Tonga_VCE_State_Record,
 					entries, vce_state_table, i);
-	sclk_dep_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
-					ATOM_Tonga_SCLK_Dependency_Record,
-					entries, sclk_dep_table,
-					vce_state_record->ucSCLKIndex);
+	PP_ASSERT_WITH_CODE((vce_state_record->ucSCLKIndex <
+			     sclk_dep_table->ucNumEntries),
+			    "Invalid PowerPlay Table!", return -EINVAL);
+	PP_ASSERT_WITH_CODE((vce_state_record->ucVCEClockIndex <
+			     mm_dep_table->ucNumEntries),
+			    "Invalid PowerPlay Table!", return -EINVAL);
+	PP_ASSERT_WITH_CODE((mclk_dep_table->ucNumEntries != 0),
+			    "Invalid PowerPlay Table!", return -EINVAL);
+
+	if (sclk_dep_table_header->ucRevId < 1)
+		sclk_dep_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
+						ATOM_Tonga_SCLK_Dependency_Record,
+						entries, sclk_dep_table,
+						vce_state_record->ucSCLKIndex);
+	else
+		polaris_sclk_dep_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
+						ATOM_Polaris_SCLK_Dependency_Record,
+						entries,
+						(ATOM_Polaris_SCLK_Dependency_Table *)
+						sclk_dep_table_header,
+						vce_state_record->ucSCLKIndex);
 	mm_dep_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(
 					ATOM_Tonga_MM_Dependency_Record,
 					entries, mm_dep_table,
@@ -1360,7 +1793,10 @@ static int ppt_get_vce_state_table_entry_v1_0(struct pp_hwmgr *hwmgr, uint32_t i
 
 	vce_state->evclk = le32_to_cpu(mm_dep_record->ulEClk);
 	vce_state->ecclk = le32_to_cpu(mm_dep_record->ulEClk);
-	vce_state->sclk = le32_to_cpu(sclk_dep_record->ulSclk);
+	if (sclk_dep_record)
+		vce_state->sclk = le32_to_cpu(sclk_dep_record->ulSclk);
+	else
+		vce_state->sclk = le32_to_cpu(polaris_sclk_dep_record->ulSclk);
 
 	if (vce_state_record->ucMCLKIndex >= mclk_dep_table->ucNumEntries)
 		mclk_dep_record = GET_FLEXIBLE_ARRAY_MEMBER_ADDR(

From d930abfdca53f3db4c60eb4b30069f51c8528c83 Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 16:36:21 +0800
Subject: [PATCH 0077/1982] drm/amd/pm: Validate Vega10 PPTable subtable bounds

[ Upstream commit 9914149f99fd2ddcfd2a8c1053a57d96ec43448e ]

v1:
Vega10 PPTable parsing uses VBIOS-provided offsets, revision fields
and entry counts to locate subtables. Malformed data can otherwise
drive out-of-bounds reads from soft_pp_table_size, and voltage lookup
tables can overrun their fixed-size destination arrays.

Add shared bounds helpers and validate fixed-size subtables, dynamic
entry arrays and revision-specific layouts before consuming thermal,
fan, power-tune, clock dependency, PCIE, hard-limit and voltage lookup
data.

v2:
if ucRevId is not matched, fallback to default table size instead of returning -EINVAL.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../powerplay/hwmgr/vega10_processpptables.c  | 564 ++++++++++++++----
 1 file changed, 459 insertions(+), 105 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
index 64cff9f4850a6a..63fa6b937d9ef6 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_processpptables.c
@@ -63,6 +63,46 @@ static const void *get_powerplay_table(struct pp_hwmgr *hwmgr)
 	return table_address;
 }
 
+static bool vega10_pp_table_has_space(struct pp_hwmgr *hwmgr, size_t offset,
+				      size_t size)
+{
+	size_t table_size = hwmgr->soft_pp_table_size;
+
+	return offset <= table_size && size <= table_size - offset;
+}
+
+static int get_vega10_subtable(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		u16 table_offset, size_t table_size, const void **table)
+{
+	PP_ASSERT_WITH_CODE((table_offset != 0),
+			    "Invalid PowerPlay Table!", return -1);
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*table = (const void *)(((unsigned long)powerplay_table) + table_offset);
+
+	return 0;
+}
+
+static int validate_vega10_table_entries(struct pp_hwmgr *hwmgr,
+		u16 table_offset, size_t entries_offset,
+		u8 num_entries, size_t entry_size)
+{
+	size_t table_size;
+
+	PP_ASSERT_WITH_CODE((num_entries != 0),
+			    "Invalid PowerPlay Table!", return -1);
+
+	table_size = entries_offset + num_entries * entry_size;
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	return 0;
+}
+
 static int get_vega10_state_array(struct pp_hwmgr *hwmgr,
 	const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
 	const ATOM_Vega10_State_Array **state_array)
@@ -102,6 +142,293 @@ static int get_vega10_state_array(struct pp_hwmgr *hwmgr,
 	return 0;
 }
 
+static int get_vega10_gfxclk_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Vega10_GFXCLK_Dependency_Table **gfxclk_dep_table)
+{
+	const ATOM_Vega10_GFXCLK_Dependency_Table *table;
+	u16 table_offset;
+	size_t table_size;
+	size_t entry_size;
+
+	table_offset = le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset);
+	if (!table_offset)
+		return -EINVAL;
+
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       sizeof(*table))),
+			    "Invalid PowerPlay Table!", return -1);
+
+	table = (const ATOM_Vega10_GFXCLK_Dependency_Table *)
+		(((unsigned long)powerplay_table) + table_offset);
+	PP_ASSERT_WITH_CODE((table->ucNumEntries != 0),
+			    "Invalid PowerPlay Table!", return -1);
+
+	if (table->ucRevId == 0)
+		entry_size = sizeof(ATOM_Vega10_GFXCLK_Dependency_Record);
+	else if (table->ucRevId == 1)
+		entry_size = sizeof(ATOM_Vega10_GFXCLK_Dependency_Record_V2);
+	else
+		PP_ASSERT_WITH_CODE(false,
+			"Unsupported GFXClockDependencyTable Revision!",
+			return -EINVAL);
+
+	table_size = offsetof(ATOM_Vega10_GFXCLK_Dependency_Table, entries) +
+		table->ucNumEntries * entry_size;
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*gfxclk_dep_table = table;
+
+	return 0;
+}
+
+static int get_vega10_clk_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		u16 table_offset,
+		const ATOM_Vega10_SOCCLK_Dependency_Table **clk_dep_table)
+{
+	const ATOM_Vega10_SOCCLK_Dependency_Table *table;
+	int ret;
+
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_vega10_table_entries(hwmgr, table_offset,
+					    offsetof(ATOM_Vega10_SOCCLK_Dependency_Table,
+						     entries),
+					    table->ucNumEntries,
+					    sizeof(ATOM_Vega10_CLK_Dependency_Record));
+	if (ret)
+		return ret;
+
+	*clk_dep_table = table;
+
+	return 0;
+}
+
+static int get_vega10_mclk_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Vega10_MCLK_Dependency_Table **mclk_dep_table)
+{
+	const ATOM_Vega10_MCLK_Dependency_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usMclkDependencyTableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_vega10_table_entries(hwmgr, table_offset,
+					    offsetof(ATOM_Vega10_MCLK_Dependency_Table,
+						     entries),
+					    table->ucNumEntries,
+					    sizeof(ATOM_Vega10_MCLK_Dependency_Record));
+	if (ret)
+		return ret;
+
+	*mclk_dep_table = table;
+
+	return 0;
+}
+
+static int get_vega10_mm_dependency_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Vega10_MM_Dependency_Table **mm_dep_table)
+{
+	const ATOM_Vega10_MM_Dependency_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usMMDependencyTableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_vega10_table_entries(hwmgr, table_offset,
+					    offsetof(ATOM_Vega10_MM_Dependency_Table,
+						     entries),
+					    table->ucNumEntries,
+					    sizeof(ATOM_Vega10_MM_Dependency_Record));
+	if (ret)
+		return ret;
+
+	*mm_dep_table = table;
+
+	return 0;
+}
+
+static int get_vega10_pcie_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const Vega10_PPTable_Generic_SubTable_Header **pcie_table)
+{
+	const ATOM_Vega10_PCIE_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usPCIETableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	if (!table->ucNumEntries) {
+		*pcie_table = (const Vega10_PPTable_Generic_SubTable_Header *)table;
+		return 0;
+	}
+
+	ret = validate_vega10_table_entries(hwmgr, table_offset,
+					    offsetof(ATOM_Vega10_PCIE_Table,
+						     entries),
+					    table->ucNumEntries,
+					    sizeof(ATOM_Vega10_PCIE_Record));
+	if (ret)
+		return ret;
+
+	*pcie_table = (const Vega10_PPTable_Generic_SubTable_Header *)table;
+
+	return 0;
+}
+
+static int get_vega10_hard_limit_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Vega10_Hard_Limit_Table **hard_limit_table)
+{
+	const ATOM_Vega10_Hard_Limit_Table *table;
+	u16 table_offset;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usHardLimitTableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	ret = validate_vega10_table_entries(hwmgr, table_offset,
+					    offsetof(ATOM_Vega10_Hard_Limit_Table,
+						     entries),
+					    table->ucNumEntries,
+					    sizeof(ATOM_Vega10_Hard_Limit_Record));
+	if (ret)
+		return ret;
+
+	*hard_limit_table = table;
+
+	return 0;
+}
+
+static int get_vega10_thermal_controller_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const ATOM_Vega10_Thermal_Controller **thermal_controller)
+{
+	u16 table_offset;
+
+	table_offset = le16_to_cpu(powerplay_table->usThermalControllerOffset);
+
+	return get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				   sizeof(**thermal_controller),
+				   (const void **)thermal_controller);
+}
+
+static int get_vega10_fan_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const Vega10_PPTable_Generic_SubTable_Header **fan_table)
+{
+	const Vega10_PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t table_size;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usFanTableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId == 10)
+		table_size = sizeof(ATOM_Vega10_Fan_Table);
+	else if (header->ucRevId == 0xb)
+		table_size = sizeof(ATOM_Vega10_Fan_Table_V2);
+	else if (header->ucRevId > 0xb)
+		table_size = sizeof(ATOM_Vega10_Fan_Table_V3);
+	else
+		table_size = sizeof(*header);
+
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*fan_table = header;
+
+	return 0;
+}
+
+static int get_vega10_power_tune_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		const Vega10_PPTable_Generic_SubTable_Header **power_tune_table)
+{
+	const Vega10_PPTable_Generic_SubTable_Header *header;
+	u16 table_offset;
+	size_t table_size;
+	int ret;
+
+	table_offset = le16_to_cpu(powerplay_table->usPowerTuneTableOffset);
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*header), (const void **)&header);
+	if (ret)
+		return ret;
+
+	if (header->ucRevId == 5)
+		table_size = sizeof(ATOM_Vega10_PowerTune_Table);
+	else if (header->ucRevId == 6)
+		table_size = sizeof(ATOM_Vega10_PowerTune_Table_V2);
+	else
+		table_size = sizeof(ATOM_Vega10_PowerTune_Table_V3);
+
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*power_tune_table = header;
+
+	return 0;
+}
+
+static int get_vega10_voltage_lookup_table(struct pp_hwmgr *hwmgr,
+		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table,
+		u16 table_offset, uint32_t max_levels,
+		const ATOM_Vega10_Voltage_Lookup_Table **lookup_table)
+{
+	const ATOM_Vega10_Voltage_Lookup_Table *table;
+	size_t table_size;
+	int ret;
+
+	ret = get_vega10_subtable(hwmgr, powerplay_table, table_offset,
+				  sizeof(*table), (const void **)&table);
+	if (ret)
+		return ret;
+
+	PP_ASSERT_WITH_CODE((table->ucNumEntries != 0 &&
+			     table->ucNumEntries <= max_levels),
+			    "Invalid PowerPlay Table!", return -1);
+
+	table_size = offsetof(ATOM_Vega10_Voltage_Lookup_Table, entries) +
+		table->ucNumEntries * sizeof(ATOM_Vega10_Voltage_Lookup_Record);
+	PP_ASSERT_WITH_CODE((vega10_pp_table_has_space(hwmgr, table_offset,
+						       table_size)),
+			    "Invalid PowerPlay Table!", return -1);
+
+	*lookup_table = table;
+
+	return 0;
+}
+
 static int check_powerplay_tables(struct pp_hwmgr *hwmgr,
 	const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
@@ -149,14 +476,16 @@ static int init_thermal_controller(
 	const ATOM_Vega10_Fan_Table *fan_table_v1;
 	const ATOM_Vega10_Fan_Table_V2 *fan_table_v2;
 	const ATOM_Vega10_Fan_Table_V3 *fan_table_v3;
-
-	thermal_controller = (ATOM_Vega10_Thermal_Controller *)
-			(((unsigned long)powerplay_table) +
-			le16_to_cpu(powerplay_table->usThermalControllerOffset));
+	int ret;
 
 	PP_ASSERT_WITH_CODE((powerplay_table->usThermalControllerOffset != 0),
 			"Thermal controller table not set!", return -EINVAL);
 
+	ret = get_vega10_thermal_controller_table(hwmgr, powerplay_table,
+						  &thermal_controller);
+	if (ret)
+		return ret;
+
 	hwmgr->thermal_controller.ucType = thermal_controller->ucType;
 	hwmgr->thermal_controller.ucI2cLine = thermal_controller->ucI2cLine;
 	hwmgr->thermal_controller.ucI2cAddress = thermal_controller->ucI2cAddress;
@@ -185,9 +514,9 @@ static int init_thermal_controller(
 	if (!powerplay_table->usFanTableOffset)
 		return 0;
 
-	header = (const Vega10_PPTable_Generic_SubTable_Header *)
-			(((unsigned long)powerplay_table) +
-			le16_to_cpu(powerplay_table->usFanTableOffset));
+	ret = get_vega10_fan_table(hwmgr, powerplay_table, &header);
+	if (ret)
+		return ret;
 
 	if (header->ucRevId == 10) {
 		fan_table_v1 = (ATOM_Vega10_Fan_Table *)header;
@@ -332,12 +661,15 @@ static int init_over_drive_limits(
 		struct pp_hwmgr *hwmgr,
 		const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
-	const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
-			(const ATOM_Vega10_GFXCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
+	const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table;
 	bool is_acg_enabled = false;
 	ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
+	int ret;
+
+	ret = get_vega10_gfxclk_dependency_table(hwmgr, powerplay_table,
+						 &gfxclk_dep_table);
+	if (ret)
+		return ret;
 
 	if (gfxclk_dep_table->ucRevId == 1) {
 		patom_record_v2 =
@@ -900,51 +1232,13 @@ static int init_powerplay_extended_tables(
 	int result = 0;
 	struct phm_ppt_v2_information *pp_table_info =
 		(struct phm_ppt_v2_information *)(hwmgr->pptable);
-
-	const ATOM_Vega10_MM_Dependency_Table *mm_dependency_table =
-			(const ATOM_Vega10_MM_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usMMDependencyTableOffset));
-	const Vega10_PPTable_Generic_SubTable_Header *power_tune_table =
-			(const Vega10_PPTable_Generic_SubTable_Header *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usPowerTuneTableOffset));
-	const ATOM_Vega10_SOCCLK_Dependency_Table *socclk_dep_table =
-			(const ATOM_Vega10_SOCCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usSocclkDependencyTableOffset));
-	const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
-			(const ATOM_Vega10_GFXCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
-	const ATOM_Vega10_DCEFCLK_Dependency_Table *dcefclk_dep_table =
-			(const ATOM_Vega10_DCEFCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usDcefclkDependencyTableOffset));
-	const ATOM_Vega10_MCLK_Dependency_Table *mclk_dep_table =
-			(const ATOM_Vega10_MCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usMclkDependencyTableOffset));
-	const ATOM_Vega10_Hard_Limit_Table *hard_limits =
-			(const ATOM_Vega10_Hard_Limit_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usHardLimitTableOffset));
-	const Vega10_PPTable_Generic_SubTable_Header *pcie_table =
-			(const Vega10_PPTable_Generic_SubTable_Header *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usPCIETableOffset));
-	const ATOM_Vega10_PIXCLK_Dependency_Table *pixclk_dep_table =
-			(const ATOM_Vega10_PIXCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usPixclkDependencyTableOffset));
-	const ATOM_Vega10_PHYCLK_Dependency_Table *phyclk_dep_table =
-			(const ATOM_Vega10_PHYCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usPhyClkDependencyTableOffset));
-	const ATOM_Vega10_DISPCLK_Dependency_Table *dispclk_dep_table =
-			(const ATOM_Vega10_DISPCLK_Dependency_Table *)
-			(((unsigned long) powerplay_table) +
-			le16_to_cpu(powerplay_table->usDispClkDependencyTableOffset));
+	const ATOM_Vega10_MM_Dependency_Table *mm_dependency_table;
+	const Vega10_PPTable_Generic_SubTable_Header *power_tune_table;
+	const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table;
+	const ATOM_Vega10_MCLK_Dependency_Table *mclk_dep_table;
+	const ATOM_Vega10_Hard_Limit_Table *hard_limits;
+	const Vega10_PPTable_Generic_SubTable_Header *pcie_table;
+	const ATOM_Vega10_SOCCLK_Dependency_Table *clk_dep_table;
 
 	pp_table_info->vdd_dep_on_socclk = NULL;
 	pp_table_info->vdd_dep_on_sclk = NULL;
@@ -956,63 +1250,114 @@ static int init_powerplay_extended_tables(
 	pp_table_info->vdd_dep_on_phyclk = NULL;
 	pp_table_info->vdd_dep_on_dispclk = NULL;
 
-	if (powerplay_table->usMMDependencyTableOffset)
-		result = get_mm_clock_voltage_table(hwmgr,
+	if (powerplay_table->usMMDependencyTableOffset) {
+		result = get_vega10_mm_dependency_table(hwmgr, powerplay_table,
+							&mm_dependency_table);
+		if (!result)
+			result = get_mm_clock_voltage_table(hwmgr,
 				&pp_table_info->mm_dep_table,
 				mm_dependency_table);
+	}
 
-	if (!result && powerplay_table->usPowerTuneTableOffset)
-		result = get_tdp_table(hwmgr,
+	if (!result && powerplay_table->usPowerTuneTableOffset) {
+		result = get_vega10_power_tune_table(hwmgr, powerplay_table,
+						     &power_tune_table);
+		if (!result)
+			result = get_tdp_table(hwmgr,
 				&pp_table_info->tdp_table,
 				power_tune_table);
+	}
 
-	if (!result && powerplay_table->usSocclkDependencyTableOffset)
-		result = get_socclk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usSocclkDependencyTableOffset) {
+		result = get_vega10_clk_dependency_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usSocclkDependencyTableOffset),
+				&clk_dep_table);
+		if (!result)
+			result = get_socclk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_socclk,
-				socclk_dep_table);
+				(const ATOM_Vega10_SOCCLK_Dependency_Table *)
+				clk_dep_table);
+	}
 
-	if (!result && powerplay_table->usGfxclkDependencyTableOffset)
-		result = get_gfxclk_voltage_dependency_table(hwmgr,
-				&pp_table_info->vdd_dep_on_sclk,
-				gfxclk_dep_table);
+	if (!result && powerplay_table->usGfxclkDependencyTableOffset) {
+		result = get_vega10_gfxclk_dependency_table(hwmgr,
+			powerplay_table, &gfxclk_dep_table);
+		if (!result)
+			result = get_gfxclk_voltage_dependency_table(hwmgr,
+					&pp_table_info->vdd_dep_on_sclk,
+					gfxclk_dep_table);
+	}
 
-	if (!result && powerplay_table->usPixclkDependencyTableOffset)
-		result = get_pix_clk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usPixclkDependencyTableOffset) {
+		result = get_vega10_clk_dependency_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usPixclkDependencyTableOffset),
+				&clk_dep_table);
+		if (!result)
+			result = get_pix_clk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_pixclk,
 				(const ATOM_Vega10_PIXCLK_Dependency_Table *)
-				pixclk_dep_table);
+				clk_dep_table);
+	}
 
-	if (!result && powerplay_table->usPhyClkDependencyTableOffset)
-		result = get_pix_clk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usPhyClkDependencyTableOffset) {
+		result = get_vega10_clk_dependency_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usPhyClkDependencyTableOffset),
+				&clk_dep_table);
+		if (!result)
+			result = get_pix_clk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_phyclk,
 				(const ATOM_Vega10_PIXCLK_Dependency_Table *)
-				phyclk_dep_table);
+				clk_dep_table);
+	}
 
-	if (!result && powerplay_table->usDispClkDependencyTableOffset)
-		result = get_pix_clk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usDispClkDependencyTableOffset) {
+		result = get_vega10_clk_dependency_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usDispClkDependencyTableOffset),
+				&clk_dep_table);
+		if (!result)
+			result = get_pix_clk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_dispclk,
 				(const ATOM_Vega10_PIXCLK_Dependency_Table *)
-				dispclk_dep_table);
+				clk_dep_table);
+	}
 
-	if (!result && powerplay_table->usDcefclkDependencyTableOffset)
-		result = get_dcefclk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usDcefclkDependencyTableOffset) {
+		result = get_vega10_clk_dependency_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usDcefclkDependencyTableOffset),
+				&clk_dep_table);
+		if (!result)
+			result = get_dcefclk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_dcefclk,
-				dcefclk_dep_table);
+				(const ATOM_Vega10_DCEFCLK_Dependency_Table *)
+				clk_dep_table);
+	}
 
-	if (!result && powerplay_table->usMclkDependencyTableOffset)
-		result = get_mclk_voltage_dependency_table(hwmgr,
+	if (!result && powerplay_table->usMclkDependencyTableOffset) {
+		result = get_vega10_mclk_dependency_table(hwmgr, powerplay_table,
+							  &mclk_dep_table);
+		if (!result)
+			result = get_mclk_voltage_dependency_table(hwmgr,
 				&pp_table_info->vdd_dep_on_mclk,
 				mclk_dep_table);
+	}
 
-	if (!result && powerplay_table->usPCIETableOffset)
-		result = get_pcie_table(hwmgr,
+	if (!result && powerplay_table->usPCIETableOffset) {
+		result = get_vega10_pcie_table(hwmgr, powerplay_table,
+					       &pcie_table);
+		if (!result)
+			result = get_pcie_table(hwmgr,
 				&pp_table_info->pcie_table,
 				pcie_table);
+	}
 
-	if (!result && powerplay_table->usHardLimitTableOffset)
-		result = get_hard_limits(hwmgr,
+	if (!result && powerplay_table->usHardLimitTableOffset) {
+		result = get_vega10_hard_limit_table(hwmgr, powerplay_table,
+						     &hard_limits);
+		if (!result)
+			result = get_hard_limits(hwmgr,
 				&pp_table_info->max_clock_voltage_on_dc,
 				hard_limits);
+	}
 
 	hwmgr->dyn_state.max_clock_voltage_on_dc.sclk =
 			pp_table_info->max_clock_voltage_on_dc.sclk;
@@ -1140,30 +1485,39 @@ static int init_dpm_2_parameters(
 	}
 
 	if (powerplay_table->usVddcLookupTableOffset) {
-		const ATOM_Vega10_Voltage_Lookup_Table *vddc_table =
-				(ATOM_Vega10_Voltage_Lookup_Table *)
-				(((unsigned long)powerplay_table) +
-				le16_to_cpu(powerplay_table->usVddcLookupTableOffset));
-		result = get_vddc_lookup_table(hwmgr,
-				&pp_table_info->vddc_lookup_table, vddc_table, 8);
+		const ATOM_Vega10_Voltage_Lookup_Table *vddc_table;
+
+		result = get_vega10_voltage_lookup_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usVddcLookupTableOffset),
+				8, &vddc_table);
+		if (!result)
+			result = get_vddc_lookup_table(hwmgr,
+					&pp_table_info->vddc_lookup_table,
+					vddc_table, 8);
 	}
 
-	if (powerplay_table->usVddmemLookupTableOffset) {
-		const ATOM_Vega10_Voltage_Lookup_Table *vdd_mem_table =
-				(ATOM_Vega10_Voltage_Lookup_Table *)
-				(((unsigned long)powerplay_table) +
-				le16_to_cpu(powerplay_table->usVddmemLookupTableOffset));
-		result = get_vddc_lookup_table(hwmgr,
-				&pp_table_info->vddmem_lookup_table, vdd_mem_table, 4);
+	if (!result && powerplay_table->usVddmemLookupTableOffset) {
+		const ATOM_Vega10_Voltage_Lookup_Table *vdd_mem_table;
+
+		result = get_vega10_voltage_lookup_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usVddmemLookupTableOffset),
+				4, &vdd_mem_table);
+		if (!result)
+			result = get_vddc_lookup_table(hwmgr,
+					&pp_table_info->vddmem_lookup_table,
+					vdd_mem_table, 4);
 	}
 
-	if (powerplay_table->usVddciLookupTableOffset) {
-		const ATOM_Vega10_Voltage_Lookup_Table *vddci_table =
-				(ATOM_Vega10_Voltage_Lookup_Table *)
-				(((unsigned long)powerplay_table) +
-				le16_to_cpu(powerplay_table->usVddciLookupTableOffset));
-		result = get_vddc_lookup_table(hwmgr,
-				&pp_table_info->vddci_lookup_table, vddci_table, 4);
+	if (!result && powerplay_table->usVddciLookupTableOffset) {
+		const ATOM_Vega10_Voltage_Lookup_Table *vddci_table;
+
+		result = get_vega10_voltage_lookup_table(hwmgr, powerplay_table,
+				le16_to_cpu(powerplay_table->usVddciLookupTableOffset),
+				4, &vddci_table);
+		if (!result)
+			result = get_vddc_lookup_table(hwmgr,
+					&pp_table_info->vddci_lookup_table,
+					vddci_table, 4);
 	}
 
 	return result;

From 35606292782dd35d152cc997a95742fd9bc2bcbd Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Tue, 23 Jun 2026 11:37:41 +0800
Subject: [PATCH 0078/1982] drm/amd/pm: Validate legacy hwmgr PP table offsets

[ Upstream commit 0ceb6bc43e62f0e73b282c9de8f4bc4d5498f281 ]

processpptables.c walks several variable-length PPLIB tables by
using offsets from the VBIOS PowerPlay table. Some paths dereference
extended headers, state arrays, clock arrays, non-clock arrays, or VCE
records before checking that the referenced data is inside the table
buffer.

Add local bounds helpers and validate the relevant offsets and entry
sizes before dereferencing them. This prevents truncated or malformed
legacy PowerPlay tables from driving out-of-bounds reads during hwmgr
initialization and table entry lookup.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../amd/pm/powerplay/hwmgr/processpptables.c  | 446 +++++++++++++-----
 1 file changed, 316 insertions(+), 130 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
index f06b29e33ba452..f1009b29735744 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
@@ -47,26 +47,53 @@
 
 #define NUM_BITS_CLOCK_INFO_ARRAY_INDEX 6
 
+static bool pp_table_has_space(struct pp_hwmgr *hwmgr, size_t offset,
+			       size_t size)
+{
+	size_t table_size = hwmgr->soft_pp_table_size;
+
+	return offset <= table_size && size <= table_size - offset;
+}
+
+static const ATOM_PPLIB_EXTENDEDHEADER *
+get_extended_header(struct pp_hwmgr *hwmgr,
+		    const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table,
+		    size_t min_size)
+{
+	const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
+	u16 offset;
+
+	if (le16_to_cpu(powerplay_table->usTableSize) <
+	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3) ||
+	    !pp_table_has_space(hwmgr, 0, sizeof(ATOM_PPLIB_POWERPLAYTABLE3)))
+		return NULL;
+
+	powerplay_table3 = (const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
+	offset = le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset);
+	if (!offset || !pp_table_has_space(hwmgr, offset,
+					   sizeof(extended_header->usSize)))
+		return NULL;
+
+	extended_header = (const ATOM_PPLIB_EXTENDEDHEADER *)
+		(((unsigned long)powerplay_table) + offset);
+	if (le16_to_cpu(extended_header->usSize) < min_size ||
+	    !pp_table_has_space(hwmgr, offset, min_size))
+		return NULL;
+
+	return extended_header;
+}
+
 static uint16_t get_vce_table_offset(struct pp_hwmgr *hwmgr,
 			const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t vce_table_offset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	   sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-			(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *extended_header =
-						(const ATOM_PPLIB_EXTENDEDHEADER *)
-						(((unsigned long)powerplay_table3) +
-						le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(extended_header->usSize) >=
-			   SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V2)
-				vce_table_offset = le16_to_cpu(extended_header->usVCETableOffset);
-		}
-	}
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V2);
+	if (extended_header)
+		vce_table_offset = le16_to_cpu(extended_header->usVCETableOffset);
 
 	return vce_table_offset;
 }
@@ -93,7 +120,14 @@ static uint16_t get_vce_clock_info_array_size(struct pp_hwmgr *hwmgr,
 	if (table_offset > 0) {
 		const VCEClockInfoArray *p = (const VCEClockInfoArray *)
 			(((unsigned long) powerplay_table) + table_offset);
-		table_size = sizeof(uint8_t) + p->ucNumEntries * sizeof(VCEClockInfo);
+		size_t size;
+
+		if (!pp_table_has_space(hwmgr, table_offset, sizeof(p->ucNumEntries)))
+			return 0;
+
+		size = sizeof(uint8_t) + p->ucNumEntries * sizeof(VCEClockInfo);
+		if (pp_table_has_space(hwmgr, table_offset, size))
+			table_size = size;
 	}
 
 	return table_size;
@@ -104,10 +138,13 @@ static uint16_t get_vce_clock_voltage_limit_table_offset(struct pp_hwmgr *hwmgr,
 {
 	uint16_t table_offset = get_vce_clock_info_array_offset(hwmgr,
 							powerplay_table);
+	u16 table_size;
 
-	if (table_offset > 0)
-		return table_offset + get_vce_clock_info_array_size(hwmgr,
-							powerplay_table);
+	if (table_offset > 0) {
+		table_size = get_vce_clock_info_array_size(hwmgr, powerplay_table);
+		if (table_size)
+			return table_offset + table_size;
+	}
 
 	return 0;
 }
@@ -121,8 +158,15 @@ static uint16_t get_vce_clock_voltage_limit_table_size(struct pp_hwmgr *hwmgr,
 	if (table_offset > 0) {
 		const ATOM_PPLIB_VCE_Clock_Voltage_Limit_Table *ptable =
 			(const ATOM_PPLIB_VCE_Clock_Voltage_Limit_Table *)(((unsigned long) powerplay_table) + table_offset);
+		size_t size;
 
-		table_size = sizeof(uint8_t) + ptable->numEntries * sizeof(ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record);
+		if (!pp_table_has_space(hwmgr, table_offset, sizeof(ptable->numEntries)))
+			return 0;
+
+		size = sizeof(uint8_t) +
+			ptable->numEntries * sizeof(ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record);
+		if (pp_table_has_space(hwmgr, table_offset, size))
+			table_size = size;
 	}
 	return table_size;
 }
@@ -130,9 +174,13 @@ static uint16_t get_vce_clock_voltage_limit_table_size(struct pp_hwmgr *hwmgr,
 static uint16_t get_vce_state_table_offset(struct pp_hwmgr *hwmgr, const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t table_offset = get_vce_clock_voltage_limit_table_offset(hwmgr, powerplay_table);
+	u16 table_size;
 
-	if (table_offset > 0)
-		return table_offset + get_vce_clock_voltage_limit_table_size(hwmgr, powerplay_table);
+	if (table_offset > 0) {
+		table_size = get_vce_clock_voltage_limit_table_size(hwmgr, powerplay_table);
+		if (table_size)
+			return table_offset + table_size;
+	}
 
 	return 0;
 }
@@ -143,8 +191,12 @@ static const ATOM_PPLIB_VCE_State_Table *get_vce_state_table(
 {
 	uint16_t table_offset = get_vce_state_table_offset(hwmgr, powerplay_table);
 
-	if (table_offset > 0)
-		return (const ATOM_PPLIB_VCE_State_Table *)(((unsigned long) powerplay_table) + table_offset);
+	if (table_offset > 0) {
+		if (pp_table_has_space(hwmgr, table_offset,
+				       sizeof(((ATOM_PPLIB_VCE_State_Table *)0)->numEntries)))
+			return (const ATOM_PPLIB_VCE_State_Table *)
+				(((unsigned long)powerplay_table) + table_offset);
+	}
 
 	return NULL;
 }
@@ -153,21 +205,13 @@ static uint16_t get_uvd_table_offset(struct pp_hwmgr *hwmgr,
 			const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t uvd_table_offset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
+
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V3);
+	if (extended_header)
+		uvd_table_offset = le16_to_cpu(extended_header->usUVDTableOffset);
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-			(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *extended_header =
-					(const ATOM_PPLIB_EXTENDEDHEADER *)
-					(((unsigned long)powerplay_table3) +
-				le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(extended_header->usSize) >=
-			    SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V3)
-				uvd_table_offset = le16_to_cpu(extended_header->usUVDTableOffset);
-		}
-	}
 	return uvd_table_offset;
 }
 
@@ -193,8 +237,14 @@ static uint16_t get_uvd_clock_info_array_size(struct pp_hwmgr *hwmgr,
 		const UVDClockInfoArray *p = (const UVDClockInfoArray *)
 					(((unsigned long) powerplay_table)
 					+ table_offset);
-		table_size = sizeof(UCHAR) +
-			     p->ucNumEntries * sizeof(UVDClockInfo);
+		size_t size;
+
+		if (!pp_table_has_space(hwmgr, table_offset, sizeof(p->ucNumEntries)))
+			return 0;
+
+		size = sizeof(UCHAR) + p->ucNumEntries * sizeof(UVDClockInfo);
+		if (pp_table_has_space(hwmgr, table_offset, size))
+			table_size = size;
 	}
 
 	return table_size;
@@ -206,10 +256,13 @@ static uint16_t get_uvd_clock_voltage_limit_table_offset(
 {
 	uint16_t table_offset = get_uvd_clock_info_array_offset(hwmgr,
 						     powerplay_table);
+	u16 table_size;
 
-	if (table_offset > 0)
-		return table_offset +
-			get_uvd_clock_info_array_size(hwmgr, powerplay_table);
+	if (table_offset > 0) {
+		table_size = get_uvd_clock_info_array_size(hwmgr, powerplay_table);
+		if (table_size)
+			return table_offset + table_size;
+	}
 
 	return 0;
 }
@@ -218,21 +271,12 @@ static uint16_t get_samu_table_offset(struct pp_hwmgr *hwmgr,
 			const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t samu_table_offset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-			(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *extended_header =
-				(const ATOM_PPLIB_EXTENDEDHEADER *)
-				(((unsigned long)powerplay_table3) +
-				le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(extended_header->usSize) >=
-			    SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V4)
-				samu_table_offset = le16_to_cpu(extended_header->usSAMUTableOffset);
-		}
-	}
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V4);
+	if (extended_header)
+		samu_table_offset = le16_to_cpu(extended_header->usSAMUTableOffset);
 
 	return samu_table_offset;
 }
@@ -254,21 +298,12 @@ static uint16_t get_acp_table_offset(struct pp_hwmgr *hwmgr,
 				const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t acp_table_offset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-			(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *pExtendedHeader =
-				(const ATOM_PPLIB_EXTENDEDHEADER *)
-				(((unsigned long)powerplay_table3) +
-				le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(pExtendedHeader->usSize) >=
-			    SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V6)
-				acp_table_offset = le16_to_cpu(pExtendedHeader->usACPTableOffset);
-		}
-	}
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V6);
+	if (extended_header)
+		acp_table_offset = le16_to_cpu(extended_header->usACPTableOffset);
 
 	return acp_table_offset;
 }
@@ -290,21 +325,12 @@ static uint16_t get_cacp_tdp_table_offset(
 				const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t cacTdpTableOffset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-				(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *pExtendedHeader =
-					(const ATOM_PPLIB_EXTENDEDHEADER *)
-					(((unsigned long)powerplay_table3) +
-				le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(pExtendedHeader->usSize) >=
-			    SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V7)
-				cacTdpTableOffset = le16_to_cpu(pExtendedHeader->usPowerTuneTableOffset);
-		}
-	}
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V7);
+	if (extended_header)
+		cacTdpTableOffset = le16_to_cpu(extended_header->usPowerTuneTableOffset);
 
 	return cacTdpTableOffset;
 }
@@ -341,22 +367,13 @@ static uint16_t get_sclk_vdd_gfx_table_offset(struct pp_hwmgr *hwmgr,
 			const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
 	uint16_t sclk_vdd_gfx_table_offset = 0;
+	const ATOM_PPLIB_EXTENDEDHEADER *extended_header;
 
-	if (le16_to_cpu(powerplay_table->usTableSize) >=
-	    sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
-		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
-				(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
-		if (powerplay_table3->usExtendendedHeaderOffset > 0) {
-			const ATOM_PPLIB_EXTENDEDHEADER  *pExtendedHeader =
-				(const ATOM_PPLIB_EXTENDEDHEADER *)
-				(((unsigned long)powerplay_table3) +
-				le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));
-			if (le16_to_cpu(pExtendedHeader->usSize) >=
-			    SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V8)
-				sclk_vdd_gfx_table_offset =
-					le16_to_cpu(pExtendedHeader->usSclkVddgfxTableOffset);
-		}
-	}
+	extended_header = get_extended_header(hwmgr, powerplay_table,
+					      SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V8);
+	if (extended_header)
+		sclk_vdd_gfx_table_offset =
+			le16_to_cpu(extended_header->usSclkVddgfxTableOffset);
 
 	return sclk_vdd_gfx_table_offset;
 }
@@ -770,20 +787,37 @@ static ULONG size_of_entry_v2(ULONG num_dpm_levels)
 }
 
 static const ATOM_PPLIB_STATE_V2 *get_state_entry_v2(
+					struct pp_hwmgr *hwmgr,
 					const StateArray * pstate_arrays,
+					u16 state_array_offset,
 							 ULONG entry_index)
 {
 	ULONG i;
 	const ATOM_PPLIB_STATE_V2 *pstate;
+	size_t entry_offset;
+	size_t entry_size;
+
+	if (entry_index >= pstate_arrays->ucNumEntries)
+		return NULL;
 
+	entry_offset = state_array_offset + sizeof(pstate_arrays->ucNumEntries);
 	pstate = pstate_arrays->states;
-	if (entry_index <= pstate_arrays->ucNumEntries) {
-		for (i = 0; i < entry_index; i++)
-			pstate = (ATOM_PPLIB_STATE_V2 *)(
-						  (unsigned long)pstate +
-			     size_of_entry_v2(pstate->ucNumDPMLevels));
+	for (i = 0; i <= entry_index; i++) {
+		if (!pp_table_has_space(hwmgr, entry_offset, sizeof(*pstate)))
+			return NULL;
+
+		entry_size = size_of_entry_v2(pstate->ucNumDPMLevels);
+		if (!pp_table_has_space(hwmgr, entry_offset, entry_size))
+			return NULL;
+
+		if (i == entry_index)
+			return pstate;
+
+		entry_offset += entry_size;
+		pstate = (ATOM_PPLIB_STATE_V2 *)((unsigned long)pstate + entry_size);
 	}
-	return pstate;
+
+	return NULL;
 }
 
 static const unsigned char soft_dummy_pp_table[] = {
@@ -851,6 +885,8 @@ int pp_tables_get_response_times(struct pp_hwmgr *hwmgr,
 
 	PP_ASSERT_WITH_CODE(NULL != powerplay_tab,
 			    "Missing PowerPlay Table!", return -EINVAL);
+	PP_ASSERT_WITH_CODE(pp_table_has_space(hwmgr, 0, sizeof(*powerplay_tab)),
+			    "Invalid PowerPlay Table!", return -EINVAL);
 
 	*vol_rep_time = (uint32_t)le16_to_cpu(powerplay_tab->usVoltageTime);
 	*bb_rep_time = (uint32_t)le16_to_cpu(powerplay_tab->usBackbiasTime);
@@ -863,13 +899,21 @@ int pp_tables_get_num_of_entries(struct pp_hwmgr *hwmgr,
 {
 	const StateArray *pstate_arrays;
 	const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table = get_powerplay_table(hwmgr);
+	u16 state_array_offset;
 
 	if (powerplay_table == NULL)
 		return -1;
+	if (!pp_table_has_space(hwmgr, 0, sizeof(*powerplay_table)))
+		return -1;
 
 	if (powerplay_table->sHeader.ucTableFormatRevision >= 6) {
+		state_array_offset = le16_to_cpu(powerplay_table->usStateArrayOffset);
+		if (!pp_table_has_space(hwmgr, state_array_offset,
+					sizeof(pstate_arrays->ucNumEntries)))
+			return -1;
+
 		pstate_arrays = (StateArray *)(((unsigned long)powerplay_table) +
-					le16_to_cpu(powerplay_table->usStateArrayOffset));
+					state_array_offset);
 
 		*num_of_entries = (unsigned long)(pstate_arrays->ucNumEntries);
 	} else
@@ -896,49 +940,128 @@ int pp_tables_get_entry(struct pp_hwmgr *hwmgr,
 	const NonClockInfoArray *pnon_clock_arrays;
 
 	const ATOM_PPLIB_STATE *pstate_entry;
+	u16 state_array_offset;
+	u16 clock_info_array_offset;
+	u16 non_clock_info_array_offset;
+	size_t clock_info_offset;
+	size_t non_clock_info_offset;
+	size_t state_entry_offset;
 
 	if (powerplay_table == NULL)
 		return -1;
+	if (!pp_table_has_space(hwmgr, 0, sizeof(*powerplay_table)))
+		return -1;
 
 	ps->classification.bios_index = entry_index;
 
 	if (powerplay_table->sHeader.ucTableFormatRevision >= 6) {
+		state_array_offset = le16_to_cpu(powerplay_table->usStateArrayOffset);
+		if (!pp_table_has_space(hwmgr, state_array_offset,
+					sizeof(pstate_arrays->ucNumEntries)))
+			return -1;
+
 		pstate_arrays = (StateArray *)(((unsigned long)powerplay_table) +
-					le16_to_cpu(powerplay_table->usStateArrayOffset));
+					state_array_offset);
+
+		if (entry_index >= pstate_arrays->ucNumEntries)
+			return -1;
 
-		if (entry_index > pstate_arrays->ucNumEntries)
+		pstate_entry_v2 = get_state_entry_v2(hwmgr, pstate_arrays,
+						     state_array_offset,
+						     entry_index);
+		if (!pstate_entry_v2)
+			return -1;
+
+		clock_info_array_offset =
+			le16_to_cpu(powerplay_table->usClockInfoArrayOffset);
+		if (!pp_table_has_space(hwmgr, clock_info_array_offset,
+					sizeof(*pclock_arrays)))
 			return -1;
 
-		pstate_entry_v2 = get_state_entry_v2(pstate_arrays, entry_index);
 		pclock_arrays = (ClockInfoArray *)(((unsigned long)powerplay_table) +
-					le16_to_cpu(powerplay_table->usClockInfoArrayOffset));
+					clock_info_array_offset);
+		if (!pclock_arrays->ucEntrySize)
+			return -1;
+
+		non_clock_info_array_offset =
+			le16_to_cpu(powerplay_table->usNonClockInfoArrayOffset);
+		if (!pp_table_has_space(hwmgr, non_clock_info_array_offset,
+					sizeof(*pnon_clock_arrays)))
+			return -1;
 
 		pnon_clock_arrays = (NonClockInfoArray *)(((unsigned long)powerplay_table) +
-						le16_to_cpu(powerplay_table->usNonClockInfoArrayOffset));
+						non_clock_info_array_offset);
+		if (!pnon_clock_arrays->ucEntrySize ||
+		    pnon_clock_arrays->ucEntrySize < ATOM_PPLIB_NONCLOCKINFO_VER1 ||
+		    (pnon_clock_arrays->ucEntrySize > ATOM_PPLIB_NONCLOCKINFO_VER1 &&
+		     pnon_clock_arrays->ucEntrySize < ATOM_PPLIB_NONCLOCKINFO_VER2) ||
+		    pstate_entry_v2->nonClockInfoIndex >= pnon_clock_arrays->ucNumEntries)
+			return -1;
 
+		non_clock_info_offset = non_clock_info_array_offset +
+			offsetof(NonClockInfoArray, nonClockInfo) +
+			pstate_entry_v2->nonClockInfoIndex * pnon_clock_arrays->ucEntrySize;
+		if (!pp_table_has_space(hwmgr, non_clock_info_offset,
+					pnon_clock_arrays->ucEntrySize))
+			return -1;
 		pnon_clock_info = (ATOM_PPLIB_NONCLOCK_INFO *)((unsigned long)(pnon_clock_arrays->nonClockInfo) +
 					(pstate_entry_v2->nonClockInfoIndex * pnon_clock_arrays->ucEntrySize));
 
 		result = init_non_clock_fields(hwmgr, ps, pnon_clock_arrays->ucEntrySize, pnon_clock_info);
 
 		for (i = 0; i < pstate_entry_v2->ucNumDPMLevels; i++) {
-			const void *pclock_info = (const void *)(
-							(unsigned long)(pclock_arrays->clockInfo) +
-							(pstate_entry_v2->clockInfoIndex[i] * pclock_arrays->ucEntrySize));
+			const void *pclock_info;
+
+			if (pstate_entry_v2->clockInfoIndex[i] >=
+			    pclock_arrays->ucNumEntries)
+				return -1;
+
+			clock_info_offset = clock_info_array_offset +
+				offsetof(ClockInfoArray, clockInfo) +
+				pstate_entry_v2->clockInfoIndex[i] * pclock_arrays->ucEntrySize;
+			if (!pp_table_has_space(hwmgr, clock_info_offset,
+						pclock_arrays->ucEntrySize))
+				return -1;
+
+			pclock_info = (const void *)
+					((unsigned long)(pclock_arrays->clockInfo) +
+					(pstate_entry_v2->clockInfoIndex[i] *
+					 pclock_arrays->ucEntrySize));
 			res = func(hwmgr, &ps->hardware, i, pclock_info);
 			if ((0 == result) && (0 != res))
 				result = res;
 		}
 	} else {
-		if (entry_index > powerplay_table->ucNumStates)
+		if (entry_index >= powerplay_table->ucNumStates ||
+		    !powerplay_table->ucStateEntrySize ||
+		    !powerplay_table->ucNonClockSize ||
+		    powerplay_table->ucNonClockSize < ATOM_PPLIB_NONCLOCKINFO_VER1 ||
+		    (powerplay_table->ucNonClockSize > ATOM_PPLIB_NONCLOCKINFO_VER1 &&
+		     powerplay_table->ucNonClockSize < ATOM_PPLIB_NONCLOCKINFO_VER2) ||
+		    !powerplay_table->ucClockInfoSize)
+			return -1;
+
+		state_array_offset = le16_to_cpu(powerplay_table->usStateArrayOffset);
+		state_entry_offset = state_array_offset +
+			entry_index * powerplay_table->ucStateEntrySize;
+		if (!pp_table_has_space(hwmgr, state_entry_offset,
+					powerplay_table->ucStateEntrySize))
 			return -1;
 
 		pstate_entry = (ATOM_PPLIB_STATE *)((unsigned long)powerplay_table +
-						    le16_to_cpu(powerplay_table->usStateArrayOffset) +
+						    state_array_offset +
 						    entry_index * powerplay_table->ucStateEntrySize);
 
+		non_clock_info_array_offset =
+			le16_to_cpu(powerplay_table->usNonClockInfoArrayOffset);
+		non_clock_info_offset = non_clock_info_array_offset +
+			pstate_entry->ucNonClockStateIndex * powerplay_table->ucNonClockSize;
+		if (!pp_table_has_space(hwmgr, non_clock_info_offset,
+					powerplay_table->ucNonClockSize))
+			return -1;
+
 		pnon_clock_info = (ATOM_PPLIB_NONCLOCK_INFO *)((unsigned long)powerplay_table +
-						le16_to_cpu(powerplay_table->usNonClockInfoArrayOffset) +
+						non_clock_info_array_offset +
 						pstate_entry->ucNonClockStateIndex *
 						powerplay_table->ucNonClockSize);
 
@@ -947,12 +1070,23 @@ int pp_tables_get_entry(struct pp_hwmgr *hwmgr,
 							pnon_clock_info);
 
 		for (i = 0; i < powerplay_table->ucStateEntrySize-1; i++) {
-			const void *pclock_info = (const void *)((unsigned long)powerplay_table +
-						le16_to_cpu(powerplay_table->usClockInfoArrayOffset) +
+			const void *pclock_info;
+
+			clock_info_array_offset =
+				le16_to_cpu(powerplay_table->usClockInfoArrayOffset);
+			clock_info_offset = clock_info_array_offset +
+				pstate_entry->ucClockStateIndices[i] *
+				powerplay_table->ucClockInfoSize;
+			if (!pp_table_has_space(hwmgr, clock_info_offset,
+						powerplay_table->ucClockInfoSize))
+				return -1;
+
+			pclock_info = (const void *)((unsigned long)powerplay_table +
+						clock_info_array_offset +
 						pstate_entry->ucClockStateIndices[i] *
 						powerplay_table->ucClockInfoSize);
 
-			int res = func(hwmgr, &ps->hardware, i, pclock_info);
+			res = func(hwmgr, &ps->hardware, i, pclock_info);
 
 			if ((0 == result) && (0 != res))
 					result = res;
@@ -1667,21 +1801,70 @@ static int get_vce_state_table_entry(struct pp_hwmgr *hwmgr,
 							unsigned long *flag)
 {
 	const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table = get_powerplay_table(hwmgr);
+	const ATOM_PPLIB_VCE_State_Table *vce_state_table;
+	const ATOM_PPLIB_VCE_State_Record *record;
+	const VCEClockInfoArray *vce_clock_info_array;
+	const VCEClockInfo *vce_clock_info;
+	const ClockInfoArray *clock_arrays;
+	u16 vce_state_table_offset;
+	u16 vce_clock_info_array_offset;
+	u16 clock_info_array_offset;
+	unsigned long clockInfoIndex;
+	size_t record_offset;
+	size_t vce_clock_info_offset;
+	size_t clock_info_offset;
+
+	if (!powerplay_table || !pp_table_has_space(hwmgr, 0, sizeof(*powerplay_table)))
+		return -1;
 
-	const ATOM_PPLIB_VCE_State_Table *vce_state_table = get_vce_state_table(hwmgr, powerplay_table);
+	vce_state_table_offset = get_vce_state_table_offset(hwmgr, powerplay_table);
+	vce_state_table = get_vce_state_table(hwmgr, powerplay_table);
+	if (!vce_state_table || i >= vce_state_table->numEntries)
+		return -1;
+
+	record_offset = vce_state_table_offset +
+		offsetof(ATOM_PPLIB_VCE_State_Table, entries) +
+		i * sizeof(*record);
+	if (!pp_table_has_space(hwmgr, record_offset, sizeof(*record)))
+		return -1;
+
+	record = &vce_state_table->entries[i];
+
+	vce_clock_info_array_offset =
+		get_vce_clock_info_array_offset(hwmgr, powerplay_table);
+	if (!pp_table_has_space(hwmgr, vce_clock_info_array_offset,
+				sizeof(vce_clock_info_array->ucNumEntries)))
+		return -1;
 
-	unsigned short vce_clock_info_array_offset = get_vce_clock_info_array_offset(hwmgr, powerplay_table);
+	vce_clock_info_array = (const VCEClockInfoArray *)
+		(((unsigned long)powerplay_table) + vce_clock_info_array_offset);
+	if (record->ucVCEClockInfoIndex >= vce_clock_info_array->ucNumEntries)
+		return -1;
 
-	const VCEClockInfoArray *vce_clock_info_array = (const VCEClockInfoArray *)(((unsigned long) powerplay_table) + vce_clock_info_array_offset);
+	vce_clock_info_offset = vce_clock_info_array_offset +
+		offsetof(VCEClockInfoArray, entries) +
+		record->ucVCEClockInfoIndex * sizeof(*vce_clock_info);
+	if (!pp_table_has_space(hwmgr, vce_clock_info_offset, sizeof(*vce_clock_info)))
+		return -1;
 
-	const ClockInfoArray *clock_arrays = (ClockInfoArray *)(((unsigned long)powerplay_table) +
-								le16_to_cpu(powerplay_table->usClockInfoArrayOffset));
+	vce_clock_info = &vce_clock_info_array->entries[record->ucVCEClockInfoIndex];
 
-	const ATOM_PPLIB_VCE_State_Record *record = &vce_state_table->entries[i];
+	clock_info_array_offset = le16_to_cpu(powerplay_table->usClockInfoArrayOffset);
+	if (!pp_table_has_space(hwmgr, clock_info_array_offset,
+				sizeof(*clock_arrays)))
+		return -1;
 
-	const VCEClockInfo *vce_clock_info = &vce_clock_info_array->entries[record->ucVCEClockInfoIndex];
+	clock_arrays = (ClockInfoArray *)(((unsigned long)powerplay_table) +
+					  clock_info_array_offset);
+	clockInfoIndex = record->ucClockInfoIndex & 0x3F;
+	if (!clock_arrays->ucEntrySize || clockInfoIndex >= clock_arrays->ucNumEntries)
+		return -1;
 
-	unsigned long clockInfoIndex = record->ucClockInfoIndex & 0x3F;
+	clock_info_offset = clock_info_array_offset +
+		offsetof(ClockInfoArray, clockInfo) +
+		clockInfoIndex * clock_arrays->ucEntrySize;
+	if (!pp_table_has_space(hwmgr, clock_info_offset, clock_arrays->ucEntrySize))
+		return -1;
 
 	*flag = (record->ucClockInfoIndex >> NUM_BITS_CLOCK_INFO_ARRAY_INDEX);
 
@@ -1705,6 +1888,10 @@ static int pp_tables_initialize(struct pp_hwmgr *hwmgr)
 	hwmgr->need_pp_table_upload = true;
 
 	powerplay_table = get_powerplay_table(hwmgr);
+	PP_ASSERT_WITH_CODE((powerplay_table),
+			    "Missing PowerPlay Table!", return -1);
+	PP_ASSERT_WITH_CODE(pp_table_has_space(hwmgr, 0, sizeof(*powerplay_table)),
+			    "Invalid PowerPlay Table!", return -1);
 
 	result = init_powerplay_tables(hwmgr, powerplay_table);
 
@@ -1807,4 +1994,3 @@ const struct pp_table_func pptable_funcs = {
 	.pptable_get_vce_state_table_entry =
 						get_vce_state_table_entry,
 };
-

From f1be0815acc30ec458aef72fafb393b28476c27e Mon Sep 17 00:00:00 2001
From: Eric Huang <jinhuieric.huang@amd.com>
Date: Wed, 17 Jun 2026 14:42:48 -0400
Subject: [PATCH 0079/1982] drm/amdkfd: add sanity check in svm_range_is_valid

[ Upstream commit aa7e29cf9a37092cf5057a612ee09f28df20258f ]

to prevent svm range to be overflow or underflow.

Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 202ed1c456320d..1b29dee7948d83 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -3421,7 +3421,13 @@ svm_range_is_valid(struct kfd_process *p, uint64_t start, uint64_t size)
 	unsigned long start_unchg = start;
 
 	start <<= PAGE_SHIFT;
-	end = start + (size << PAGE_SHIFT);
+
+	if (size == 0)
+		return -EINVAL;
+
+	if (check_add_overflow(start, size << PAGE_SHIFT, &end))
+		return -EOVERFLOW;
+
 	do {
 		vma = vma_lookup(p->mm, start);
 		if (!vma || (vma->vm_flags & device_vma))

From 3e96da49091109cebf0cb806422a0527665c6cd3 Mon Sep 17 00:00:00 2001
From: Haikun Zhou <zhouhaikun5@huaqin.corp-partner.google.com>
Date: Wed, 1 Jul 2026 09:30:18 +0800
Subject: [PATCH 0080/1982] drm/panel-edp: Support MB116AS01'3 edp panel

[ Upstream commit 844e71ba7d7a50c5ffa29d147afaeaafb19b39e4 ]

MB116AS01'3 raw edid:
00 ff ff ff ff ff ff 00 21 63 03 12 00 00 00 00
00 23 01 04 95 1a 0e 78 23 e7 05 9c 5b 56 93 27
21 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 36 1c 56 92 50 00 1c 30 60 18
a8 00 00 90 10 00 00 18 00 00 00 fd 00 28 3c 30
30 07 01 0a 20 20 20 20 20 20 00 00 00 fe 00 48
4b 43 20 4d 59 20 20 20 20 0a 20 20 00 00 00 fe
00 4d 42 31 31 36 41 53 30 31 27 33 20 20 01 cb

70 20 79 02 00 22 00 14 1c 1a 01 84 55 05 91 00
5f 00 17 00 ff 02 1b 00 09 00 07 00 2b 00 06 27
00 28 3b 00 00 81 00 13 72 1a 00 00 03 01 28 3c
00 00 00 00 00 00 3c 00 00 00 00 25 01 09 1c 1a
01 1c 1a 01 28 3c 80 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 90

Signed-off-by: Haikun Zhou <zhouhaikun5@huaqin.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260701013018.2621972-1-zhouhaikun5@huaqin.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-edp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index f2ae333a32d8c7..0da04d75e4e964 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -2061,6 +2061,7 @@ static const struct edp_panel_entry edp_panels[] = {
 
 	EDP_PANEL_ENTRY('E', 'T', 'C', 0x0000, &delay_50_500_e200_d200_po2e335, "LP079QX1-SP0V"),
 
+	EDP_PANEL_ENTRY('H', 'K', 'C', 0x1203, &delay_200_500_e80, "MB116AS01'3"),
 	EDP_PANEL_ENTRY('H', 'K', 'C', 0x2d51, &delay_200_500_e200, "Unknown"),
 	EDP_PANEL_ENTRY('H', 'K', 'C', 0x2d5b, &delay_200_500_e200, "MB116AN01"),
 	EDP_PANEL_ENTRY('H', 'K', 'C', 0x2d5c, &delay_200_500_e200, "MB116AN01-2"),

From 8e9b795a570b6565111f380898be7fb1af7b45d9 Mon Sep 17 00:00:00 2001
From: Yuan Chen <chenyuan@kylinos.cn>
Date: Wed, 10 Jun 2026 22:50:53 +0800
Subject: [PATCH 0081/1982] libbpf: Skip bpf_object__probe_loading() when BPF
 token is in use

[ Upstream commit d262a25d8b58b697b2a1a2fe4b0078446cc00e11 ]

bpf_object__probe_loading() tries to load trivial SOCKET_FILTER and
TRACEPOINT programs to verify the BPF environment works.  When a
BPF token is in use with restricted program type permissions, these
probe loads may fail because the token does not allow the specific
program types, even though BPF loading is perfectly functional.

Fix by skipping the probe when a token FD is present: BPF token
creation itself proves the kernel has a working BPF subsystem.
Real BPF issues will be caught during actual program and map loading.

Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260610145059.113412-2-chenyuan_fl@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b21d2f842579f9..1aaf2bdf26857d 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5070,12 +5070,8 @@ bpf_object__probe_loading(struct bpf_object *obj)
 		BPF_EXIT_INSN(),
 	};
 	int ret, insn_cnt = ARRAY_SIZE(insns);
-	LIBBPF_OPTS(bpf_prog_load_opts, opts,
-		.token_fd = obj->token_fd,
-		.prog_flags = obj->token_fd ? BPF_F_TOKEN_FD : 0,
-	);
 
-	if (obj->gen_loader)
+	if (obj->gen_loader || obj->token_fd)
 		return 0;
 
 	ret = bump_rlimit_memlock();
@@ -5084,9 +5080,9 @@ bpf_object__probe_loading(struct bpf_object *obj)
 			errstr(ret));
 
 	/* make sure basic loading works */
-	ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, &opts);
+	ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns, insn_cnt, NULL);
 	if (ret < 0)
-		ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, &opts);
+		ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL", insns, insn_cnt, NULL);
 	if (ret < 0) {
 		ret = errno;
 		pr_warn("Error in %s(): %s. Couldn't load trivial BPF program. Make sure your kernel supports BPF (CONFIG_BPF_SYSCALL=y) and/or that RLIMIT_MEMLOCK is set to big enough value.\n",

From 2e23f7167e4a71c500673f8ad30ec4ff209e20ad Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Tue, 30 Jun 2026 12:12:16 +0200
Subject: [PATCH 0082/1982] net: usb: rtl8150: handle link status read failures

[ Upstream commit 8c9c5b9a689612dcb92a04a4218c975cd19f19d8 ]

set_carrier() ignores the result of the USB control transfer and tests
the stack variable supplied as its receive buffer. If the device rejects
or aborts the request, that variable remains uninitialized and the driver
chooses an arbitrary carrier state.

Leave the existing carrier state unchanged when the link status cannot be
read. A transient USB error should not be treated as link loss.

Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c
Suggested-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260630101216.10365-1-alhouseenyousef@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/rtl8150.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 647f28b367b991..8c739d898e57db 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -734,7 +734,9 @@ static void set_carrier(struct net_device *netdev)
 	rtl8150_t *dev = netdev_priv(netdev);
 	short tmp;
 
-	get_registers(dev, CSCR, 2, &tmp);
+	if (get_registers(dev, CSCR, 2, &tmp))
+		return;
+
 	if (tmp & CSCR_LINK_STATUS)
 		netif_carrier_on(netdev);
 	else

From 873f33349f3d399a62dc6853c1acbbb30020aa55 Mon Sep 17 00:00:00 2001
From: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: Wed, 10 Jun 2026 11:02:59 +0800
Subject: [PATCH 0083/1982] netfilter: ebtables: bound num_counters like
 nentries in do_replace()

[ Upstream commit 43ae85af154b27f9a0ff602f7a01e3a7583ffdab ]

do_replace_finish() allocates the counter buffer before it is validated:

   counterstmp = vmalloc_array(repl->num_counters, sizeof(*counterstmp));

do_replace() only checks num_counters against INT_MAX / sizeof(struct
ebt_counter), so vmalloc_array() can be asked for up to 134217726 * 16 =
2147483616 bytes (~2 GiB).

num_counters must in fact equal nentries: do_replace_finish() later
rejects the request when repl->num_counters != t->private->nentries.
get_counters() folds the per-CPU counters back into one entry per rule,
so what userspace gets is bounded by nentries, never by nentries *
nr_cpus. Apply the same upper bound used for nentries (MAX_EBT_ENTRIES)
to the incoming num_counters so the over-sized allocation can no longer
be requested.

The allocation is still kept outside the ebt_mutex, since vmalloc() may
sleep and trigger reclaim; only the bound is tightened.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebtables.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 96176aa8811179..5266f4d021c6d3 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -39,6 +39,8 @@
 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
 				 COUNTER_OFFSET(n) * cpu))
+#define MAX_EBT_ENTRIES (((INT_MAX - sizeof(struct ebt_table_info)) / \
+			 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 
 struct ebt_pernet {
 	struct list_head tables;
@@ -1126,10 +1128,9 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
 		return -EINVAL;
 
 	/* overflow check */
-	if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
-			NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+	if (tmp.nentries >= MAX_EBT_ENTRIES)
 		return -ENOMEM;
-	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+	if (tmp.num_counters >= MAX_EBT_ENTRIES)
 		return -ENOMEM;
 
 	tmp.name[sizeof(tmp.name) - 1] = 0;
@@ -2269,10 +2270,9 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
 	if (tmp.entries_size == 0)
 		return -EINVAL;
 
-	if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
-			NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+	if (tmp.nentries >= MAX_EBT_ENTRIES)
 		return -ENOMEM;
-	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+	if (tmp.num_counters >= MAX_EBT_ENTRIES)
 		return -ENOMEM;
 
 	memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));

From 329df0483984d57a8bc3251c00599a75e205d7e2 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Tue, 30 Jun 2026 09:11:32 +0100
Subject: [PATCH 0084/1982] soundwire: dmi-quirks: Disable ghost Realtek on
 Asus Expertbook

[ Upstream commit 90af3209742db61a7f9d7d054a16165818cfc6d8 ]

The Asus Expertbook B9406CAA also has a Realtek device in the ACPI that
doesn't exist in the physical hardware. This confuses the machine driver
into attempting to create DAI links for the device. Add a quirk to
remove this device.

Closes: https://github.com/thesofproject/linux/issues/5828
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260630081132.3294488-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/dmi-quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index 32a46a2d90f7ca..2a98fc8c104d60 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -178,6 +178,13 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
 		.driver_data = (void *)hp_omen_16,
 	},
 	/* PTL devices */
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
+			DMI_MATCH(DMI_BOARD_NAME, "B9406CAA"),
+		},
+		.driver_data = (void *)ghost_realtek,
+	},
 	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),

From 680154d070c436c101c519c950f108de70faedaa Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 17:16:45 +0800
Subject: [PATCH 0085/1982] dmaengine: pl330: remove debugfs file on teardown

[ Upstream commit 0d3e3376b289cdaff5b3b6c1581999926ff1000f ]

init_pl330_debugfs() creates a debugfs file with struct pl330_dmac as
private data. pl330_remove() then unregisters the DMA device and frees
the PL330 channel/thread state without removing that file.

Keep the debugfs dentry and remove it before tearing down the DMAC state
used by the debugfs show callback.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260615091645.28878-1-pengpeng@iscas.ac.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/pl330.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 82a9fe88ad54c9..fe4d266ee611c6 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -502,6 +502,7 @@ struct pl330_dmac {
 	struct dma_pl330_chan *peripherals; /* keep at end */
 	int quirks;
 
+	struct dentry		*dbgfs;
 	struct reset_control	*rstc;
 	struct reset_control	*rstc_ocp;
 };
@@ -2958,14 +2959,24 @@ DEFINE_SHOW_ATTRIBUTE(pl330_debugfs);
 
 static inline void init_pl330_debugfs(struct pl330_dmac *pl330)
 {
-	debugfs_create_file(dev_name(pl330->ddma.dev),
-			    S_IFREG | 0444, NULL, pl330,
-			    &pl330_debugfs_fops);
+	pl330->dbgfs = debugfs_create_file(dev_name(pl330->ddma.dev),
+					   S_IFREG | 0444, NULL, pl330,
+					   &pl330_debugfs_fops);
+}
+
+static inline void deinit_pl330_debugfs(struct pl330_dmac *pl330)
+{
+	debugfs_remove(pl330->dbgfs);
+	pl330->dbgfs = NULL;
 }
 #else
 static inline void init_pl330_debugfs(struct pl330_dmac *pl330)
 {
 }
+
+static inline void deinit_pl330_debugfs(struct pl330_dmac *pl330)
+{
+}
 #endif
 
 /*
@@ -3211,6 +3222,8 @@ static void pl330_remove(struct amba_device *adev)
 	struct dma_pl330_chan *pch, *_p;
 	int i, irq;
 
+	deinit_pl330_debugfs(pl330);
+
 	pm_runtime_get_noresume(pl330->ddma.dev);
 
 	if (adev->dev.of_node)

From 5b2dc86f8ad71d9d2bfc7ec93e43d2cde714fb0b Mon Sep 17 00:00:00 2001
From: Yun Zhou <yun.zhou@windriver.com>
Date: Tue, 30 Jun 2026 14:03:11 +0800
Subject: [PATCH 0086/1982] net: mvneta_bm: add suspend/resume support to
 prevent crash after resume

[ Upstream commit 140be217df577961bea1ca36240439a463026cbd ]

The mvneta driver uses the hardware Buffer Manager (BM) for RX buffer
allocation. During suspend, mvneta disables its clock, causing BM to
lose all buffer address state. On resume, mvneta_bm_port_init() re-
attaches the BM pool to the NIC, but BM hardware returns stale/garbage
buffer addresses. When NAPI poll processes these buffers, DMA cache
sync hits an invalid virtual address causing a kernel panic:

 Unable to handle kernel paging request at virtual address b0000080
 PC is at v7_dma_inv_range
 Call trace:
  v7_dma_inv_range from arch_sync_dma_for_cpu+0x94/0x158
  arch_sync_dma_for_cpu from __dma_sync_single_for_cpu+0xc4/0x15c
  __dma_sync_single_for_cpu from mvneta_rx_swbm+0x6c8/0xf48
  mvneta_rx_swbm from mvneta_poll+0x6fc/0x70c
  mvneta_poll from __napi_poll.constprop.0+0x2c/0x1e0
  __napi_poll.constprop.0 from net_rx_action+0x160/0x2c4
  net_rx_action from handle_softirqs+0xd8/0x2b8
  handle_softirqs from run_ksoftirqd+0x30/0x94
  run_ksoftirqd from smpboot_thread_fn+0x100/0x204
  smpboot_thread_fn from kthread+0xf4/0x110
  kthread from ret_from_fork+0x14/0x28

Fix by adding suspend/resume callbacks to the BM driver:

- suspend: drain all buffers (with DMA unmapping), free the BPPE
  regions, and reset pool state to FREE before stopping BM and gating
  the clock.

- resume: enable the clock, reinitialize BM defaults, and restore pool
  read/write pointers and size registers. Pool allocation and buffer
  refill are handled by mvneta_resume() through the normal
  mvneta_bm_port_init() path, which sees pools as FREE and performs
  full initialization identical to probe.

Add a device_link (DL_FLAG_AUTOREMOVE_CONSUMER) in mvneta_probe to
guarantee BM resumes before mvneta and suspends after mvneta. If the
link cannot be created, fall back to SW buffer management to avoid a
potential crash on resume due to unordered PM transitions.

Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260630060311.4072140-1-yun.zhou@windriver.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvneta.c    | 18 ++++++
 drivers/net/ethernet/marvell/mvneta_bm.c | 72 ++++++++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 71ace291a8bffa..2cb6723fe801c3 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -5684,6 +5684,24 @@ static int mvneta_probe(struct platform_device *pdev)
 					 "use SW buffer management\n");
 				mvneta_bm_put(pp->bm_priv);
 				pp->bm_priv = NULL;
+			} else if (!device_link_add(&pdev->dev,
+						    &pp->bm_priv->pdev->dev,
+						    DL_FLAG_AUTOREMOVE_CONSUMER)) {
+				/*
+				 * Link guarantees BM resumes before mvneta.
+				 * Without it, BM may not be ready when
+				 * mvneta_bm_port_init() runs on resume,
+				 * causing stale buffer addresses and a crash.
+				 * Fall back to SW management to be safe.
+				 */
+				dev_warn(&pdev->dev,
+					 "failed to link to BM, use SW buffer management\n");
+				mvneta_bm_pool_destroy(pp->bm_priv,
+						       pp->pool_long, 1 << pp->id);
+				mvneta_bm_pool_destroy(pp->bm_priv,
+						       pp->pool_short, 1 << pp->id);
+				mvneta_bm_put(pp->bm_priv);
+				pp->bm_priv = NULL;
 			}
 		}
 		/* Set RX packet offset correction for platforms, whose
diff --git a/drivers/net/ethernet/marvell/mvneta_bm.c b/drivers/net/ethernet/marvell/mvneta_bm.c
index 6bb38049491906..e0c693c0a91063 100644
--- a/drivers/net/ethernet/marvell/mvneta_bm.c
+++ b/drivers/net/ethernet/marvell/mvneta_bm.c
@@ -129,6 +129,7 @@ static int mvneta_bm_pool_create(struct mvneta_bm *priv,
 	if (!IS_ALIGNED((u32)bm_pool->virt_addr, MVNETA_BM_POOL_PTR_ALIGN)) {
 		dma_free_coherent(&pdev->dev, size_bytes, bm_pool->virt_addr,
 				  bm_pool->phys_addr);
+		bm_pool->virt_addr = NULL;
 		dev_err(&pdev->dev, "BM pool %d is not %d bytes aligned\n",
 			bm_pool->id, MVNETA_BM_POOL_PTR_ALIGN);
 		return -ENOMEM;
@@ -139,6 +140,7 @@ static int mvneta_bm_pool_create(struct mvneta_bm *priv,
 	if (err < 0) {
 		dma_free_coherent(&pdev->dev, size_bytes, bm_pool->virt_addr,
 				  bm_pool->phys_addr);
+		bm_pool->virt_addr = NULL;
 		return err;
 	}
 
@@ -477,6 +479,75 @@ static void mvneta_bm_remove(struct platform_device *pdev)
 	clk_disable_unprepare(priv->clk);
 }
 
+static int mvneta_bm_suspend(struct device *dev)
+{
+	struct mvneta_bm *priv = dev_get_drvdata(dev);
+	int i;
+
+	/* Drain buffers and free pool resources while BM is still clocked */
+	for (i = 0; i < MVNETA_BM_POOLS_NUM; i++) {
+		struct mvneta_bm_pool *bm_pool = &priv->bm_pools[i];
+		int size_bytes;
+
+		if (bm_pool->type == MVNETA_BM_FREE)
+			continue;
+
+		mvneta_bm_bufs_free(priv, bm_pool, bm_pool->port_map);
+		if (bm_pool->hwbm_pool.buf_num)
+			dev_warn(&priv->pdev->dev,
+				 "pool %d: %d buffers not freed\n",
+				 bm_pool->id, bm_pool->hwbm_pool.buf_num);
+
+		mvneta_bm_pool_disable(priv, bm_pool->id);
+
+		if (bm_pool->virt_addr) {
+			size_bytes = sizeof(u32) * bm_pool->hwbm_pool.size;
+			dma_free_coherent(&priv->pdev->dev, size_bytes,
+					  bm_pool->virt_addr,
+					  bm_pool->phys_addr);
+			bm_pool->virt_addr = NULL;
+		}
+		/*
+		 * Safe to destroy: device_link guarantees all mvneta ports
+		 * have already suspended, so no hwbm_pool_add() can be in
+		 * progress holding buf_lock.  Pairs with mutex_init() in
+		 * mvneta_bm_pool_use() on resume.
+		 */
+		mutex_destroy(&bm_pool->hwbm_pool.buf_lock);
+		bm_pool->type = MVNETA_BM_FREE;
+	}
+
+	mvneta_bm_write(priv, MVNETA_BM_COMMAND_REG, MVNETA_BM_STOP_MASK);
+	clk_disable_unprepare(priv->clk);
+	return 0;
+}
+
+static int mvneta_bm_resume(struct device *dev)
+{
+	struct mvneta_bm *priv = dev_get_drvdata(dev);
+	int i, err;
+
+	err = clk_prepare_enable(priv->clk);
+	if (err)
+		return err;
+
+	/* Reinitialize BM hardware; pools are refilled by mvneta_resume() */
+	mvneta_bm_default_set(priv);
+
+	/* Restore pool registers lost during clock gating */
+	for (i = 0; i < MVNETA_BM_POOLS_NUM; i++) {
+		mvneta_bm_write(priv, MVNETA_BM_POOL_READ_PTR_REG(i), 0);
+		mvneta_bm_write(priv, MVNETA_BM_POOL_WRITE_PTR_REG(i), 0);
+		mvneta_bm_write(priv, MVNETA_BM_POOL_SIZE_REG(i),
+				priv->bm_pools[i].hwbm_pool.size);
+	}
+
+	mvneta_bm_write(priv, MVNETA_BM_COMMAND_REG, MVNETA_BM_START_MASK);
+	return 0;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(mvneta_bm_pm_ops, mvneta_bm_suspend, mvneta_bm_resume);
+
 static const struct of_device_id mvneta_bm_match[] = {
 	{ .compatible = "marvell,armada-380-neta-bm" },
 	{ }
@@ -489,6 +560,7 @@ static struct platform_driver mvneta_bm_driver = {
 	.driver = {
 		.name = MVNETA_BM_DRIVER_NAME,
 		.of_match_table = mvneta_bm_match,
+		.pm = pm_sleep_ptr(&mvneta_bm_pm_ops),
 	},
 };
 

From b2f84c6f8e8a6ea33fcf07ac33a2f1fb3cef0621 Mon Sep 17 00:00:00 2001
From: Ben Dooks <ben.dooks@codethink.co.uk>
Date: Wed, 17 Jun 2026 09:49:43 +0100
Subject: [PATCH 0087/1982] dmaengine: dw-axi-dmac: fix __le32 on set of
 CH_CTL_H_LLI_VALID

[ Upstream commit 89aba9c39bdda8a973a6ffed7c9e93321edcfc16 ]

When writing the lli->ctl_hi, this is an __le32 type so the
value being orred should be convered to __le32 by cpu_to_le32.

Fixes 1deb96c0fa58a ("dmaegine: dw-axi-dmac: Support device_prep_dma_cyclic()")
--
Note, the call to axi_chan_irq_clear() is passing lli->status_lo
through which is also an __le32 but it does not seem to be set
anywhere. Is this also a bug?

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Link: https://patch.msgid.link/20260617084944.705266-1-ben.dooks@codethink.co.uk
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index ea4e47ee0d710d..343d32eeaa29a9 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -1128,7 +1128,7 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)
 				hw_desc = &desc->hw_desc[i];
 				if (hw_desc->llp == llp) {
 					axi_chan_irq_clear(chan, hw_desc->lli->status_lo);
-					hw_desc->lli->ctl_hi |= CH_CTL_H_LLI_VALID;
+					hw_desc->lli->ctl_hi |= cpu_to_le32(CH_CTL_H_LLI_VALID);
 					desc->completed_blocks = i;
 
 					if (((hw_desc->len * (i + 1)) % desc->period_len) == 0)

From 61b73a744e95ce187d533da925879ebd620a91e6 Mon Sep 17 00:00:00 2001
From: William Hansen-Baird <william.hansen.baird@gmail.com>
Date: Tue, 9 Jun 2026 11:53:59 +0200
Subject: [PATCH 0088/1982] wifi: rtlwifi: rtl8723be: Remove unnecessary irq
 save/restore in hw_init()

[ Upstream commit 1b4cd55626b6ffa93d18848412afb912a4add585 ]

rtl8723be hw_init() calls local_save_flags(flags) followed by
local_irq_enable(). Later, local_irq_restore(flags) is called.

This causes warnings from Lockdep on boot and modprobe,
as local_irq_restore(flags) should only be called while irqs are disabled.
The warning was introduced to detect this class of bug in [1].

With testing I found that all paths which call hw_init() have irqs
already enabled for rtl8723be.

Furthermore, the calls were originally added for the rtl8192ce
in commit f78bccd79ba3 ("rtlwifi: rtl8192ce: Fix too long disable of IRQs")
before later being added to most other rtlwifi drivers.

Commit d3feae41a347 ("rtlwifi: Update power-save routines for 062814 driver")
then replaces the call to spin_lock_irqsave() before hw_init(),
and thus the codepath which caused irqs to be disabled in hw_init and
prompted the original commit has been removed.

The same irq save/restore pattern is also present in the hw_init() of
rtl8192ce, rtl8723ae, rtl8188ee, rtl8192se and rtl8192cu,
however I don't have the hardware to test them,
so I did not include them in my changes.

Tested on a Razer Blade 14 2017.

Example of output from Lockdep prior to fix:

raw_local_irq_restore() called with IRQs enabled

...

Call Trace:
<TASK>
rtl8723be_hw_init+0x5992/0x7220 [rtl8723be]
? static_obj+0x61/0xa0
rtl_pci_start+0x222/0x5c0 [rtl_pci]
rtl_op_start+0x128/0x1a0 [rtlwifi]
? __kasan_check_read+0x11/0x20
drv_start+0x16c/0x550 [mac80211]

...

irq event stamp: 887679
hardirqs last  enabled at (887689): [<ffffffff96511170>] __up_console_sem+0x90/0xa0
hardirqs last disabled at (887698): [<ffffffff96511155>] __up_console_sem+0x75/0xa0
softirqs last  enabled at (887670): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0
softirqs last disabled at (887649): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0
---[ end trace 0000000000000000 ]---

[1] https://lore.kernel.org/all/20210111153707.10071-1-mark.rutland@arm.com/

Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260609095359.2964193-1-william.hansen.baird@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index e1f81121889498..bf7b5a32adaafa 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -1333,11 +1333,6 @@ int rtl8723be_hw_init(struct ieee80211_hw *hw)
 	bool rtstatus = true;
 	int err;
 	u8 tmp_u1b;
-	unsigned long flags;
-
-	/* reenable interrupts to not interfere with other devices */
-	local_save_flags(flags);
-	local_irq_enable();
 
 	rtlhal->fw_ready = false;
 	rtlpriv->rtlhal.being_init_adapter = true;
@@ -1443,7 +1438,6 @@ int rtl8723be_hw_init(struct ieee80211_hw *hw)
 
 	rtl8723be_dm_init(hw);
 exit:
-	local_irq_restore(flags);
 	rtlpriv->rtlhal.being_init_adapter = false;
 	return err;
 }

From a64fad3193fc0b1181d5ed029d6b327ecebbe709 Mon Sep 17 00:00:00 2001
From: Chih-Kang Chang <gary.chang@realtek.com>
Date: Thu, 25 Jun 2026 14:15:45 +0800
Subject: [PATCH 0089/1982] wifi: rtw89: wow: only WiFi 6 chips initialize RF
 registers in WoWLAN mode

[ Upstream commit dbff9040587e9bd6d3ee337315971957f9f76612 ]

Only the WiFi 6 chips need to initialize RF register when WoWLAN download
FW for some power save issue. Applying the same initialization flow to
WiFi 7 chips might trigger the error
'RF parameters exceed size. path=1, idx=1500.'.

This happens because normal mode uses rtw89_phy_config_rf_reg_v1(), which
skips registers with addresses below 0x100. However, WoWLAN mode uses
rtw89_phy_config_rf_reg_noio(), and WiFi 7 chips do not satisfy the
rtw89_chip_rf_v1() condition. As a result, more RF registers are
configured, causing the size overflow error.

Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260625061545.44808-11-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw89/wow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index f6cdbc15dcc4ab..90046d6f620efc 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -1299,7 +1299,8 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)
 	if (disable_intr_for_dlfw)
 		rtw89_hci_enable_intr(rtwdev);
 
-	rtw89_phy_init_rf_reg(rtwdev, true);
+	if (chip->chip_gen == RTW89_CHIP_AX)
+		rtw89_phy_init_rf_reg(rtwdev, true);
 
 	ret = rtw89_fw_h2c_role_maintain(rtwdev, rtwvif_link, rtwsta_link,
 					 RTW89_ROLE_FW_RESTORE);

From 0bc19a2f4a26227b15176562b0bc9b4fa86a0c68 Mon Sep 17 00:00:00 2001
From: William Hansen-Baird <william.hansen.baird@gmail.com>
Date: Tue, 30 Jun 2026 16:15:51 +0200
Subject: [PATCH 0090/1982] wifi: rtlwifi: fix disabling of ASPM for RTL8723BE
 with AER flooding

[ Upstream commit 04a46c2dbf3b516c96a1d19b72917b56055ad6c1 ]

commit 77a6407c6ab2 ("wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723")
adds code which sets ppsc->support_aspm to false in
_rtl_pci_update_default_setting() in order to disable ASPM.
This does not, however, disable ASPM. Rather, it disables driver
control of ASPM, and blocks calls to rtl_pci_enable_aspm()
and rtl_pci_disable_aspm().

In some cases, the pci device supplied to the probe function has
ASPM enabled. The code would therefore not disable ASPM, as it means to,
but rather just leave it enabled.
This was discovered through testing on a Razer Blade 14 2017.

Implement a new __rtl_pci_disable_aspm(hw) function which does not check
ppsc->support_aspm before disabling and call it from
rtl_pci_disable_aspm().

Then move the code added in the previous commit to rtl_pci_init_aspm() to
allow adding a call to __rtl_pci_disable_aspm(hw).
This makes sure ASPM is disabled while still disabling
driver control of ASPM to block it from being enabled later.

Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260630141553.785769-2-william.hansen.baird@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/pci.c | 39 ++++++++++++++--------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 8fb9604c3c533f..f9f05252b890eb 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -156,15 +156,6 @@ static void _rtl_pci_update_default_setting(struct ieee80211_hw *hw)
 				PCI_EXP_LNKCTL_ASPM_L1 | PCI_EXP_LNKCTL_CCC))
 		ppsc->support_aspm = false;
 
-	/* RTL8723BE found on some ASUSTek laptops, such as F441U and
-	 * X555UQ with subsystem ID 11ad:1723 are known to output large
-	 * amounts of PCIe AER errors during and after boot up, causing
-	 * heavy lags, poor network throughput, and occasional lock-ups.
-	 */
-	if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8723BE &&
-	    (rtlpci->pdev->subsystem_vendor == 0x11ad &&
-	     rtlpci->pdev->subsystem_device == 0x1723))
-		ppsc->support_aspm = false;
 }
 
 static bool _rtl_pci_platform_switch_device_pci_aspm(
@@ -203,7 +194,7 @@ static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value)
 }
 
 /*Disable RTL8192SE ASPM & Disable Pci Bridge ASPM*/
-static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
+static void __rtl_pci_disable_aspm(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
@@ -215,9 +206,6 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
 	u16 aspmlevel = 0;
 	u16 tmp_u1b = 0;
 
-	if (!ppsc->support_aspm)
-		return;
-
 	if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
 		rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
 			"PCI(Bridge) UNKNOWN\n");
@@ -240,6 +228,16 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
 	_rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg);
 }
 
+static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
+{
+	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+
+	if (!ppsc->support_aspm)
+		return;
+
+	__rtl_pci_disable_aspm(hw);
+}
+
 /*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for
  *power saving We should follow the sequence to enable
  *RTL8192SE first then enable Pci Bridge ASPM
@@ -330,10 +328,25 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
 
 static void rtl_pci_init_aspm(struct ieee80211_hw *hw)
 {
+	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+	struct rtl_priv *rtlpriv = rtl_priv(hw);
 
 	_rtl_pci_update_default_setting(hw);
 
+	/*
+	 * RTL8723BE found on some ASUSTek laptops, such as F441U and
+	 * X555UQ with subsystem ID 11ad:1723 are known to output large
+	 * amounts of PCIe AER errors during and after boot up, causing
+	 * heavy lags, poor network throughput, and occasional lock-ups.
+	 */
+	if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8723BE &&
+	    (rtlpci->pdev->subsystem_vendor == 0x11ad &&
+	     rtlpci->pdev->subsystem_device == 0x1723)) {
+		__rtl_pci_disable_aspm(hw);
+		ppsc->support_aspm = false;
+	}
+
 	if (ppsc->reg_rfps_level & RT_RF_PS_LEVEL_ALWAYS_ASPM) {
 		/*Always enable ASPM & Clock Req. */
 		rtl_pci_enable_aspm(hw);

From 0d75eb5f52cf0aa5a5c978806b439aa1a295a8b6 Mon Sep 17 00:00:00 2001
From: Chin-Yen Lee <timlee@realtek.com>
Date: Thu, 25 Jun 2026 14:15:44 +0800
Subject: [PATCH 0091/1982] wifi: rtw89: wow: add QoS control field to WoWLAN
 ARP response for MLO

[ Upstream commit 03a963f4aeda538acad50806e94ef25d95b78743 ]

Some MLO APs expect WoWLAN ARP response frames to be transmitted as
QoS data frames and may discard frames that do not contain a QoS
Control field.

Add a QoS Control field and use the QoS Data subtype when generating
WoWLAN ARP responses for MLD vifs. Keep the existing frame format
unchanged for non-MLO connections.

This allows WoWLAN ARP responses to be accepted by MLO APs while
preserving compatibility with legacy APs.

Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260625061545.44808-10-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 31 +++++++++++++++++++------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index c6533a085c7fe7..299526220380f4 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -2701,6 +2701,7 @@ static struct sk_buff *rtw89_sa_query_get(struct rtw89_dev *rtwdev,
 static struct sk_buff *rtw89_arp_response_get(struct rtw89_dev *rtwdev,
 					      struct rtw89_vif_link *rtwvif_link)
 {
+	struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link->rtwvif);
 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
 	u8 sec_hdr_len = rtw89_wow_get_sec_hdr_len(rtwdev);
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
@@ -2708,26 +2709,42 @@ static struct sk_buff *rtw89_arp_response_get(struct rtw89_dev *rtwdev,
 	struct rtw89_arp_rsp *arp_skb;
 	struct arphdr *arp_hdr;
 	struct sk_buff *skb;
-	__le16 fc;
+	bool with_qos;
+	u16 fc;
 
-	skb = dev_alloc_skb(sizeof(*hdr) + sec_hdr_len + sizeof(*arp_skb));
+	with_qos = ieee80211_vif_is_mld(vif);
+
+	rtw89_debug(rtwdev, RTW89_DBG_WOW, "[arp_reply] with qos field: %s\n",
+		    str_yes_no(with_qos));
+
+	skb = dev_alloc_skb(sizeof(*hdr) + sec_hdr_len + sizeof(*arp_skb) +
+			    (with_qos ? 2 : 0));
 	if (!skb)
 		return NULL;
 
 	hdr = skb_put_zero(skb, sizeof(*hdr));
 
+	fc = IEEE80211_FTYPE_DATA | IEEE80211_FCTL_TODS;
+
 	if (rtw_wow->ptk_alg)
-		fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_FCTL_TODS |
-				 IEEE80211_FCTL_PROTECTED);
+		fc |= IEEE80211_FCTL_PROTECTED;
+
+	if (with_qos)
+		fc |= IEEE80211_STYPE_QOS_DATA;
 	else
-		fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_FCTL_TODS);
+		fc |= IEEE80211_STYPE_DATA;
+
+	hdr->frame_control = cpu_to_le16(fc);
 
-	hdr->frame_control = fc;
 	ether_addr_copy(hdr->addr1, rtwvif_link->bssid);
 	ether_addr_copy(hdr->addr2, rtwvif_link->mac_addr);
 	ether_addr_copy(hdr->addr3, rtwvif_link->bssid);
 
-	skb_put_zero(skb, sec_hdr_len);
+	if (with_qos)
+		skb_put_zero(skb, sizeof(__le16));
+
+	if (sec_hdr_len)
+		skb_put_zero(skb, sec_hdr_len);
 
 	arp_skb = skb_put_zero(skb, sizeof(*arp_skb));
 	memcpy(arp_skb->llc_hdr, rfc1042_header, sizeof(rfc1042_header));

From 724be334c2944e9df54604649535c88873fc16fc Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 17:15:31 +0800
Subject: [PATCH 0092/1982] soc: amlogic: meson-clk-measure: remove debugfs
 tree

[ Upstream commit 67481152be2ec5de3529664c82054b43d6d4b9f5 ]

meson_msr_probe() creates a debugfs tree with entries that reference
devm-managed measurement table entries and the driver's private regmap
state. The driver has no remove callback, so unbinding the device can
leave those debugfs entries behind after the private data is released.

Store the debugfs root and remove the subtree from a new remove callback.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260615091531.21964-1-pengpeng@iscas.ac.cn
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/amlogic/meson-clk-measure.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/soc/amlogic/meson-clk-measure.c b/drivers/soc/amlogic/meson-clk-measure.c
index d862e30a244ed4..7ca43bcb622a22 100644
--- a/drivers/soc/amlogic/meson-clk-measure.c
+++ b/drivers/soc/amlogic/meson-clk-measure.c
@@ -7,6 +7,7 @@
 #include <linux/of_address.h>
 #include <linux/platform_device.h>
 #include <linux/bitfield.h>
+#include <linux/err.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/regmap.h>
@@ -50,6 +51,7 @@ struct meson_msr_data {
 struct meson_msr {
 	struct regmap *regmap;
 	struct meson_msr_data data;
+	struct dentry *debugfs_root;
 };
 
 #define CLK_MSR_ID(__id, __name) \
@@ -952,6 +954,7 @@ static int meson_msr_probe(struct platform_device *pdev)
 	       sizeof(struct msr_reg_offset));
 
 	root = debugfs_create_dir("meson-clk-msr", NULL);
+	priv->debugfs_root = root;
 	clks = debugfs_create_dir("clks", root);
 
 	debugfs_create_file("measure_summary", 0444, root,
@@ -967,9 +970,19 @@ static int meson_msr_probe(struct platform_device *pdev)
 				    &priv->data.msr_table[i], &clk_msr_fops);
 	}
 
+	platform_set_drvdata(pdev, priv);
+
 	return 0;
 }
 
+static void meson_msr_remove(struct platform_device *pdev)
+{
+	struct meson_msr *priv = platform_get_drvdata(pdev);
+
+	if (!IS_ERR_OR_NULL(priv->debugfs_root))
+		debugfs_remove_recursive(priv->debugfs_root);
+}
+
 static const struct msr_reg_offset msr_reg_offset = {
 	.duty_val = 0x0,
 	.freq_ctrl = 0x4,
@@ -1065,6 +1078,7 @@ MODULE_DEVICE_TABLE(of, meson_msr_match_table);
 
 static struct platform_driver meson_msr_driver = {
 	.probe	= meson_msr_probe,
+	.remove = meson_msr_remove,
 	.driver = {
 		.name		= "meson_msr",
 		.of_match_table	= meson_msr_match_table,

From 323a97943fd342c910a4a243fd3cf91add0fc78f Mon Sep 17 00:00:00 2001
From: Yun Zhou <yun.zhou@windriver.com>
Date: Fri, 3 Jul 2026 14:55:48 +0800
Subject: [PATCH 0093/1982] block: reject block device inodes with i_rdev == 0
 in lookup_bdev()

[ Upstream commit 83887ad02f30c1814bed5da3ca999f7b0f3f337c ]

lookup_bdev() blindly returns inode->i_rdev without validating it.
When a FUSE filesystem exposes a root inode with S_IFBLK mode but
i_rdev == 0 (via rootmode=060000), any subsequent mount attempt using
that path as a block device source propagates dev_t 0 into the
superblock machinery.  After commit 9ee5f161a4db ("fs: maintain a
global device-to-superblock table") this triggers a WARNING in
super_dev_register().

Reject i_rdev == 0 early with -ENODEV since no real block device
driver registers major 0.

Reported-by: syzbot+72fe3ea5814121fbc76e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72fe3ea5814121fbc76e
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260703065548.1135125-1-yun.zhou@windriver.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bdev.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/block/bdev.c b/block/bdev.c
index 02d7503e7c2c4b..00345746e34f8a 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -1209,6 +1209,18 @@ int lookup_bdev(const char *pathname, dev_t *dev)
 	if (!may_open_dev(&path))
 		goto out_path_put;
 
+	/*
+	 * Reject a block device inode with i_rdev == 0.  A dev_t of 0 is
+	 * never valid for a block device: no real block device driver
+	 * registers major 0.  Fake block device inodes (e.g. fuse with
+	 * rootmode=S_IFBLK) can expose i_rdev == 0, and letting that
+	 * propagate would confuse superblock lookup and trigger warnings
+	 * in the device-to-superblock table (super_dev_register).
+	 */
+	error = -ENODEV;
+	if (!inode->i_rdev)
+		goto out_path_put;
+
 	*dev = inode->i_rdev;
 	error = 0;
 out_path_put:

From 5a57301b3b2e99ccda234fe07d7bf407ad1ba164 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:16:33 +0800
Subject: [PATCH 0094/1982] iio: adc: max1241: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 790a2080e0c9eabefea3561dec301172043de236 ]

The driver has a match table for the spi bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/max1241.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/adc/max1241.c b/drivers/iio/adc/max1241.c
index d62c1a01165933..cab04beae7293b 100644
--- a/drivers/iio/adc/max1241.c
+++ b/drivers/iio/adc/max1241.c
@@ -179,6 +179,7 @@ static const struct spi_device_id max1241_id[] = {
 	{ "max1241", max1241 },
 	{ }
 };
+MODULE_DEVICE_TABLE(spi, max1241_id);
 
 static const struct of_device_id max1241_dt_ids[] = {
 	{ .compatible = "maxim,max1241" },

From 25c13a5b8151d31ffe98bd79ab6f7944857a7a1b Mon Sep 17 00:00:00 2001
From: Seyeong Kim <seyeong.kim@canonical.com>
Date: Fri, 19 Jun 2026 05:00:44 +0000
Subject: [PATCH 0095/1982] RDMA/irdma: Suppress PF reset on HMC error

[ Upstream commit 4dc9c884c0aafac1e8d37536d88d485135e26883 ]

The irdma driver currently issues an unconditional PF reset whenever the
HMC Error interrupt (PFINT_OICR bit 26) fires:

	if (event->reg & IRDMAPFINT_OICR_HMC_ERR_M) {
		ibdev_err(&iwdev->ibdev, "HMC Error\n");
		iwdev->rf->reset = true;
	}

request_reset() issues an IIDC_PFR to ice. In practice a single HMC_ERR
can trigger cascading PF resets, IOMMU faults during teardown, and
teardown of every RDMA connection on the device.

i40e handles the identically-named interrupt by reading
PFHMC_ERRORINFO and PFHMC_ERRORDATA and logging them without touching
device state; see commit 9c010ee0ea5f ("i40e: Suppress HMC error to
Interrupt message level") which removed the reset as "not necessary".
This patch mirrors that handling on irdma.

With this change, repeated HMC_ERR no longer produces a reset storm and
RDMA traffic on the device continues uninterrupted.

Signed-off-by: Seyeong Kim <seyeong.kim@canonical.com>
Link: https://patch.msgid.link/20260619050044.1807044-1-seyeong.kim@canonical.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/irdma/i40iw_hw.c  | 4 +++-
 drivers/infiniband/hw/irdma/icrdma_hw.c | 2 ++
 drivers/infiniband/hw/irdma/icrdma_hw.h | 2 ++
 drivers/infiniband/hw/irdma/icrdma_if.c | 8 ++++++--
 drivers/infiniband/hw/irdma/irdma.h     | 2 ++
 5 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/i40iw_hw.c b/drivers/infiniband/hw/irdma/i40iw_hw.c
index 60c1f2b1811dec..8301938b454327 100644
--- a/drivers/infiniband/hw/irdma/i40iw_hw.c
+++ b/drivers/infiniband/hw/irdma/i40iw_hw.c
@@ -29,7 +29,9 @@ static u32 i40iw_regs[IRDMA_MAX_REGS] = {
 	I40E_PFHMC_PDINV,
 	I40E_GLHMC_VFPDINV(0),
 	I40E_GLPE_CRITERR,
-	0xffffffff      /* PFINT_RATEN not used in FPK */
+	0xffffffff,     /* PFINT_RATEN not used in FPK */
+	0xffffffff,     /* PFHMC_ERRORINFO not used in FPK */
+	0xffffffff      /* PFHMC_ERRORDATA not used in FPK */
 };
 
 static u32 i40iw_stat_offsets[] = {
diff --git a/drivers/infiniband/hw/irdma/icrdma_hw.c b/drivers/infiniband/hw/irdma/icrdma_hw.c
index 32f26284a788bd..b1f1b54857626b 100644
--- a/drivers/infiniband/hw/irdma/icrdma_hw.c
+++ b/drivers/infiniband/hw/irdma/icrdma_hw.c
@@ -29,6 +29,8 @@ static u32 icrdma_regs[IRDMA_MAX_REGS] = {
 	GLHMC_VFPDINV(0),
 	GLPE_CRITERR,
 	GLINT_RATE(0),
+	PFHMC_ERRORINFO,
+	PFHMC_ERRORDATA,
 };
 
 static u64 icrdma_masks[IRDMA_MAX_MASKS] = {
diff --git a/drivers/infiniband/hw/irdma/icrdma_hw.h b/drivers/infiniband/hw/irdma/icrdma_hw.h
index d97944ab45dac7..0acdeda1236d12 100644
--- a/drivers/infiniband/hw/irdma/icrdma_hw.h
+++ b/drivers/infiniband/hw/irdma/icrdma_hw.h
@@ -40,6 +40,8 @@
 #define GLHMC_VFPDINV(_i)	(0x00528300 + ((_i) * 4)) /* _i=0...31 */
 #define GLPE_CRITERR		0x00534000
 #define GLINT_RATE(_INT)	(0x0015A000 + ((_INT) * 4)) /* _i=0...2047 */ /* Reset Source: CORER */
+#define PFHMC_ERRORINFO		0x00520400
+#define PFHMC_ERRORDATA		0x00520500
 
 #define ICRDMA_DB_ADDR_OFFSET		(8 * 1024 * 1024 - 64 * 1024)
 
diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
index b49fd9cf247654..6c1d285d1c1761 100644
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -91,8 +91,12 @@ static void icrdma_iidc_event_handler(struct iidc_rdma_core_dev_info *cdev_info,
 			}
 		}
 		if (event->reg & IRDMAPFINT_OICR_HMC_ERR_M) {
-			ibdev_err(&iwdev->ibdev, "HMC Error\n");
-			iwdev->rf->reset = true;
+			u32 hmc_errinfo = readl(iwdev->rf->sc_dev.hw_regs[IRDMA_PFHMC_ERRORINFO]);
+			u32 hmc_errdata = readl(iwdev->rf->sc_dev.hw_regs[IRDMA_PFHMC_ERRORDATA]);
+
+			/* Log diagnostics; do not reset here. */
+			ibdev_warn(&iwdev->ibdev, "HMC Error: errinfo=0x%08x errdata=0x%08x\n",
+				   hmc_errinfo, hmc_errdata);
 		}
 		if (event->reg & IRDMAPFINT_OICR_PE_PUSH_M) {
 			ibdev_err(&iwdev->ibdev, "PE Push Error\n");
diff --git a/drivers/infiniband/hw/irdma/irdma.h b/drivers/infiniband/hw/irdma/irdma.h
index ff938a01d70c4d..e8cda27d78543d 100644
--- a/drivers/infiniband/hw/irdma/irdma.h
+++ b/drivers/infiniband/hw/irdma/irdma.h
@@ -66,6 +66,8 @@ enum irdma_registers {
 	IRDMA_GLHMC_VFPDINV,
 	IRDMA_GLPE_CRITERR,
 	IRDMA_GLINT_RATE,
+	IRDMA_PFHMC_ERRORINFO,
+	IRDMA_PFHMC_ERRORDATA,
 	IRDMA_MAX_REGS, /* Must be last entry */
 };
 

From f6e8195ab2e07076860d7f601187e68455eac2d6 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Sat, 27 Jun 2026 19:50:16 +0200
Subject: [PATCH 0096/1982] soc: qcom: socinfo: Add SoC ID for SDM850

[ Upstream commit 743af1d6a8b4bfa62dd01b5c2d81b1c62ea597f7 ]

Recognize the SDM850 SoC.

Signed-off-by: David Heidelberg <david@ixit.cz>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260627-sda850-v2-2-44bf46ade42e@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/socinfo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index 963772f45489d4..79a0defe73227c 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -359,6 +359,7 @@ static const struct soc_id soc_id[] = {
 	{ qcom_board_id(IPQ8078) },
 	{ qcom_board_id(SDM636) },
 	{ qcom_board_id(SDA636) },
+	{ qcom_board_id(SDM850) },
 	{ qcom_board_id(SDM632) },
 	{ qcom_board_id(SDA632) },
 	{ qcom_board_id(SDA450) },

From 2aa1e4219a1c67360356987688463c883a3f656d Mon Sep 17 00:00:00 2001
From: Zhiwei Zhang <202275009@qq.com>
Date: Fri, 26 Jun 2026 09:59:20 +0800
Subject: [PATCH 0097/1982] RDMA/rxe: Check PDs for memory window binds

[ Upstream commit fbbe1d5cd7d400a98afcf337969cfdb808cb198f ]

The IBTA Software Transport Verbs specification requires the QP,
Memory Window and Memory Region for a Bind Memory Window operation
to belong to the same HCA and protection domain.

rxe only checked the QP and MW protection domain for type 2 MWs.
Move the QP/MW PD check to the common bind path and also reject
binding an MW to an MR from a different PD.

Invalid bind requests continue to fail with IB_WC_MW_BIND_ERR.

Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Zhiwei Zhang <202275009@qq.com>
Link: https://patch.msgid.link/tencent_FD4FB25AA4FFA845E63F5AC36CF4A46CDC0A@qq.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
index 379e65bfcd49af..bddb7a2578313c 100644
--- a/drivers/infiniband/sw/rxe/rxe_mw.c
+++ b/drivers/infiniband/sw/rxe/rxe_mw.c
@@ -72,13 +72,6 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 			return -EINVAL;
 		}
 
-		/* C10-72 */
-		if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
-			rxe_dbg_mw(mw,
-				"attempt to bind type 2 MW with qp with different PD\n");
-			return -EINVAL;
-		}
-
 		/* o10-37.2.40 */
 		if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
 			rxe_dbg_mw(mw,
@@ -87,10 +80,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 		}
 	}
 
-	/* remaining checks only apply to a nonzero MR */
+	/* C10-72 */
+	if (unlikely(qp->pd != rxe_mw_pd(mw))) {
+		rxe_dbg_mw(mw, "attempt to bind MW with qp with different PD\n");
+		return -EINVAL;
+	}
+
 	if (!mr)
 		return 0;
 
+	/* remaining checks only apply to a nonzero MR */
+	if (unlikely(qp->pd != mr_pd(mr))) {
+		rxe_dbg_mw(mw, "attempt to bind MW/QP to MR with different PD\n");
+		return -EINVAL;
+	}
+
 	if (unlikely(mr->access & IB_ZERO_BASED)) {
 		rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n");
 		return -EINVAL;

From f2cf823286f8909968a8a823effd0d1af12a0737 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Sat, 27 Jun 2026 19:50:15 +0200
Subject: [PATCH 0098/1982] dt-bindings: arm: qcom,ids: Add SoC ID for
 Snapdragon SDM 850

[ Upstream commit d529495c991a2b7d07c01622e8b3cb5ec066acee ]

Add SoC ID for Qualcomm Snapdragon SDM850.

Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260627-sda850-v2-1-44bf46ade42e@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/dt-bindings/arm/qcom,ids.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h
index cb8ce53146f0c0..b7ff78cbaa8db3 100644
--- a/include/dt-bindings/arm/qcom,ids.h
+++ b/include/dt-bindings/arm/qcom,ids.h
@@ -184,6 +184,7 @@
 #define QCOM_ID_IPQ8078			344
 #define QCOM_ID_SDM636			345
 #define QCOM_ID_SDA636			346
+#define QCOM_ID_SDM850			348
 #define QCOM_ID_SDM632			349
 #define QCOM_ID_SDA632			350
 #define QCOM_ID_SDA450			351

From aca5b61f01c4bbb17692273224e3ceaddfe96de0 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:22:30 +0800
Subject: [PATCH 0099/1982] gpio: sifive: add missing MODULE_DEVICE_TABLE()

[ Upstream commit 8fe6fa0f223f44b8b869319d1b9c383749aa147b ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704122230.75964-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-sifive.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpio/gpio-sifive.c b/drivers/gpio/gpio-sifive.c
index 94ef2efbd14f57..e9a992cd4b9cdf 100644
--- a/drivers/gpio/gpio-sifive.c
+++ b/drivers/gpio/gpio-sifive.c
@@ -260,6 +260,7 @@ static const struct of_device_id sifive_gpio_match[] = {
 	{ .compatible = "sifive,fu540-c000-gpio" },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, sifive_gpio_match);
 
 static struct platform_driver sifive_gpio_driver = {
 	.probe		= sifive_gpio_probe,

From 7228d04ae8cfdfa18c2bf48cafb2d84289d42409 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 23 Jun 2026 14:11:12 +0800
Subject: [PATCH 0100/1982] mmc: moxart: report DMA completion timeout

[ Upstream commit e29e650077e01dddf69bc8fac31e0cd60043aa7c ]

moxart_transfer_dma() waits for the DMA completion but ignores
wait_for_completion_interruptible_timeout(). It then unconditionally
reports the full transfer length in data->bytes_xfered.

Terminate the DMA channel and set data->error when the wait is
interrupted or times out. Only report host->data_len as transferred
after the completion is observed.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/moxart-mmc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
index 3dd8f232052f65..4a4d8b19b18ccd 100644
--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -264,6 +264,7 @@ static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host)
 	u32 len, dir_slave;
 	struct dma_async_tx_descriptor *desc = NULL;
 	struct dma_chan *dma_chan;
+	long timeout;
 
 	if (host->data_len == data->bytes_xfered)
 		return;
@@ -296,11 +297,17 @@ static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host)
 		dma_async_issue_pending(dma_chan);
 	}
 
-	wait_for_completion_interruptible_timeout(&host->dma_complete,
-						  host->timeout);
+	timeout = wait_for_completion_interruptible_timeout(&host->dma_complete,
+							    host->timeout);
+	if (timeout <= 0) {
+		dmaengine_terminate_sync(dma_chan);
+		data->error = timeout ?: -ETIMEDOUT;
+		goto unmap;
+	}
 
 	data->bytes_xfered = host->data_len;
 
+unmap:
 	dma_unmap_sg(dma_chan->device->dev,
 		     data->sg, data->sg_len,
 		     mmc_get_dma_dir(data));

From 7cc038a9c2887fa871cae347285a8f509b84675f Mon Sep 17 00:00:00 2001
From: Ben Dooks <ben.dooks@codethink.co.uk>
Date: Mon, 22 Jun 2026 15:50:36 +0100
Subject: [PATCH 0101/1982] mmc: cqhci: fix to missed endian conversions

[ Upstream commit 0aae2c73175821a71c0e20607f8e333be5b71940 ]

Fix two places where the wrong type or conversion of little-endian
types to fix the following sparse warnings:

drivers/mmc/host/cqhci-core.c:487:15: warning: incorrect type in assignment (different base types)
drivers/mmc/host/cqhci-core.c:487:15:    expected restricted __le32 [usertype]
drivers/mmc/host/cqhci-core.c:487:15:    got int
drivers/mmc/host/cqhci-core.c:566:19: warning: incorrect type in assignment (different base types)
drivers/mmc/host/cqhci-core.c:566:19:    expected unsigned long long [usertype] *task_desc
drivers/mmc/host/cqhci-core.c:566:19:    got restricted __le64 [usertype] *

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/cqhci-core.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/mmc/host/cqhci-core.c b/drivers/mmc/host/cqhci-core.c
index 178277d90c31c5..00614b500b2bc9 100644
--- a/drivers/mmc/host/cqhci-core.c
+++ b/drivers/mmc/host/cqhci-core.c
@@ -484,11 +484,11 @@ void cqhci_set_tran_desc(u8 *desc, dma_addr_t addr, int len, bool end,
 {
 	__le32 *attr = (__le32 __force *)desc;
 
-	*attr = (CQHCI_VALID(1) |
-		 CQHCI_END(end ? 1 : 0) |
-		 CQHCI_INT(0) |
-		 CQHCI_ACT(0x4) |
-		 CQHCI_DAT_LENGTH(len));
+	*attr = cpu_to_le32((CQHCI_VALID(1) |
+			     CQHCI_END(end ? 1 : 0) |
+			     CQHCI_INT(0) |
+			     CQHCI_ACT(0x4) |
+			     CQHCI_DAT_LENGTH(len)));
 
 	if (dma64) {
 		__le64 *dataddr = (__le64 __force *)(desc + 4);
@@ -542,7 +542,7 @@ static int cqhci_prep_tran_desc(struct mmc_request *mrq,
 static void cqhci_prep_dcmd_desc(struct mmc_host *mmc,
 				   struct mmc_request *mrq)
 {
-	u64 *task_desc = NULL;
+	__le64 *task_desc = NULL;
 	u64 data = 0;
 	u8 resp_type;
 	u8 *desc;
@@ -574,7 +574,7 @@ static void cqhci_prep_dcmd_desc(struct mmc_host *mmc,
 		 CQHCI_CMD_TIMING(timing) | CQHCI_RESP_TYPE(resp_type));
 	if (cq_host->ops->update_dcmd_desc)
 		cq_host->ops->update_dcmd_desc(mmc, mrq, &data);
-	*task_desc |= data;
+	*task_desc |= cpu_to_le64(data);
 	desc = (u8 *)task_desc;
 	pr_debug("%s: cqhci: dcmd: cmd: %d timing: %d resp: %d\n",
 		 mmc_hostname(mmc), mrq->cmd->opcode, timing, resp_type);

From 9978e5b0ebcb7fdc41662401b786d4143dccbdde Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:41:15 +0800
Subject: [PATCH 0102/1982] mmc: sdhci-of-ma35d1: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 9b3732cce41d177acac731e0b8024d72f0dfde38 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-of-ma35d1.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/sdhci-of-ma35d1.c b/drivers/mmc/host/sdhci-of-ma35d1.c
index 287026422616ca..73f772db04148d 100644
--- a/drivers/mmc/host/sdhci-of-ma35d1.c
+++ b/drivers/mmc/host/sdhci-of-ma35d1.c
@@ -291,6 +291,7 @@ static const struct of_device_id sdhci_ma35_dt_ids[] = {
 	{ .compatible = "nuvoton,ma35d1-sdhci" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, sdhci_ma35_dt_ids);
 
 static struct platform_driver sdhci_ma35_driver = {
 	.driver	= {

From 2b7412064bfad4bfc783d3322d2bcfbd3c819073 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Wed, 3 Jun 2026 10:39:35 +0200
Subject: [PATCH 0103/1982] mmc: dw_mmc: stop and complete DMA also in
 STATE_DATA_BUSY state

[ Upstream commit cb3fcb8d118b874178251d1f02613f60d25e4ddc ]

When transfer was stopped in STATE_DATA_BUSY state, there was no call to
dma_ops->cleanup function, so the DMA mapped buffer was never properly
unmapped. Fix this by calling dw_mci_stop_dma() function also in that
state to ensure proper cleanup call when DMA transfer was used.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c5db92bbb0946f..90cc41901edaa3 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2213,6 +2213,7 @@ static void dw_mci_work_func(struct work_struct *t)
 			}
 
 			dw_mci_stop_fault_timer(host);
+			dw_mci_stop_dma(host);
 			host->data = NULL;
 			set_bit(EVENT_DATA_COMPLETE, &host->completed_events);
 			err = dw_mci_data_complete(host, data);

From d94ce712685340a7536aa2509624506ae340eed9 Mon Sep 17 00:00:00 2001
From: Jerome Brunet <jbrunet@baylibre.com>
Date: Mon, 6 Jul 2026 11:32:11 +0200
Subject: [PATCH 0104/1982] clk: sunxi-ng: fix ccu probe clock unregister on
 error

[ Upstream commit 81f4ddc9f7e0c11d3e9d24d0f30023845a02f7ee ]

When registering clocks with sunxi_ccu_probe(), the number of ccu_clocks
and the number of hw clocks might be different, eventhough they usually are
the same.

If they are different, it could lead to out-of-bound access or registered
clock left behind on error.

Use a different variable when iterating on hw clocks so every registered
clock, and only those, gets unregistered on error.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260629131254.7E34C1F00A3A@smtp.kernel.org
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20260706-a733-rtc-v4-3-f330728db3d3@baylibre.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu_common.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index c7e00f0c29a556..bbda75c2bc461e 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -114,7 +114,7 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
 			   const struct sunxi_ccu_desc *desc)
 {
 	struct ccu_reset *reset;
-	int i, ret;
+	int i, j, ret;
 
 	ccu->desc = desc;
 
@@ -130,8 +130,8 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
 		cclk->lock = &ccu->lock;
 	}
 
-	for (i = 0; i < desc->hw_clks->num ; i++) {
-		struct clk_hw *hw = desc->hw_clks->hws[i];
+	for (j = 0; j < desc->hw_clks->num ; j++) {
+		struct clk_hw *hw = desc->hw_clks->hws[j];
 		const char *name;
 
 		if (!hw)
@@ -143,7 +143,7 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
 		else
 			ret = of_clk_hw_register(node, hw);
 		if (ret) {
-			pr_err("Couldn't register clock %d - %s\n", i, name);
+			pr_err("Couldn't register clock %d - %s\n", j, name);
 			goto err_clk_unreg;
 		}
 	}
@@ -186,8 +186,8 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
 err_del_provider:
 	of_clk_del_provider(node);
 err_clk_unreg:
-	while (--i >= 0) {
-		struct clk_hw *hw = desc->hw_clks->hws[i];
+	while (--j >= 0) {
+		struct clk_hw *hw = desc->hw_clks->hws[j];
 
 		if (!hw)
 			continue;

From c9bfb6382c5fdfaa77092c4a7d0f429eb956d97d Mon Sep 17 00:00:00 2001
From: Tanmay Shah <tanmay.shah@amd.com>
Date: Mon, 29 Jun 2026 17:48:05 -0700
Subject: [PATCH 0105/1982] remoteproc: core: Full attach detach during
 recovery

[ Upstream commit d93ffd549fb4df18c934ca7a47d4128a18c718cb ]

Current attach on recovery mechanism loads the clean resource table
during recovery, but doesn't re-allocate the resources. RPMsg
communication will fail after recovery due to this. Fix this
incorrect behavior by doing the full detach and attach of remote
processor during the recovery. This will load the clean resource table
and re-allocate all the resources, which will set up correct vring
information in the resource table.

Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Link: https://lore.kernel.org/r/20260630004806.3835488-2-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_core.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index bbc781e41a1b8b..2336c55eb021d6 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1784,7 +1784,20 @@ static int rproc_attach_recovery(struct rproc *rproc)
 	if (ret)
 		return ret;
 
-	return __rproc_attach(rproc);
+	/* clean up all acquired resources */
+	rproc_resource_cleanup(rproc);
+
+	/* release HW resources if needed */
+	rproc_unprepare_device(rproc);
+
+	rproc_disable_iommu(rproc);
+
+	/* Free the copy of the resource table */
+	kfree(rproc->cached_table);
+	rproc->cached_table = NULL;
+	rproc->table_ptr = NULL;
+
+	return rproc_attach(rproc);
 }
 
 static int rproc_boot_recovery(struct rproc *rproc)

From 0f4def9c8171efee5b06365947c6cab28f0ccfd0 Mon Sep 17 00:00:00 2001
From: John Garry <john.g.garry@oracle.com>
Date: Tue, 30 Jun 2026 10:27:17 +0000
Subject: [PATCH 0106/1982] nvme: handle positive error codes in nuse_show()

[ Upstream commit dd516cd7624648c71d338d99368587f10ecc9f0b ]

Function __nvme_submit_sync_cmd() returns a positive error code for NVMe
errors. Otherwise, we get 0 for success or a negative error code for a
kernel error.

In nuse_show() -> ns_{head}_update_nuse() -> nvme_identify_ns() ->
nvme_submit_sync_cmd() -> __nvme_submit_sync_cmd(), we then may get a
positive error code returned.

Function nuse_show() - being a device attr handler - should return the
number of bytes written to the buffer or a negative error code.

Convert any positive NVMe error code to -EIO.

Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/sysfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 16c6fea4b2db63..12478e0297356b 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -239,8 +239,10 @@ static ssize_t nuse_show(struct device *dev, struct device_attribute *attr,
 		ret = ns_head_update_nuse(head);
 	else
 		ret = ns_update_nuse(disk->private_data);
-	if (ret)
+	if (ret < 0)
 		return ret;
+	else if (ret > 0)
+		return -EIO;
 
 	return sysfs_emit(buf, "%llu\n", head->nuse);
 }

From 4be4e86ba5f7a86cc218fe0d564fd476b0a621ee Mon Sep 17 00:00:00 2001
From: Xixin Liu <liuxixin@kylinos.cn>
Date: Wed, 1 Jul 2026 14:30:00 +0800
Subject: [PATCH 0107/1982] nvme-auth: use crypto_memneq for DH-HMAC-CHAP
 response comparison

[ Upstream commit 3a6d89836ab09d53f4c32c57588689a378ce4363 ]

DH-HMAC-CHAP authentication compares HMAC response digests with memcmp().
Standard memcmp() may stop at the first differing byte, which can leak
timing information to a remote attacker and allow incremental recovery
of the expected digest.

Use crypto_memneq() for constant-time comparison on both the host path
that validates the controller Success1 response and the target path that
validates the host Reply digest.  Other memcmp() uses in the NVMe auth
code (e.g. fixed string prefix checks) are not security-sensitive and
are left unchanged.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/auth.c               | 3 ++-
 drivers/nvme/target/fabrics-cmd-auth.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 8f3ccb317e4de6..9d73713d6f8283 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -9,6 +9,7 @@
 #include <linux/unaligned.h>
 #include <crypto/hash.h>
 #include <crypto/dh.h>
+#include <crypto/utils.h>
 #include "nvme.h"
 #include "fabrics.h"
 #include <linux/nvme-auth.h>
@@ -381,7 +382,7 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl,
 		return 0;
 
 	/* Validate controller response */
-	if (memcmp(chap->response, data->rval, data->hl)) {
+	if (crypto_memneq(chap->response, data->rval, data->hl)) {
 		dev_dbg(ctrl->device, "%s: qid %d ctrl response %*ph\n",
 			__func__, chap->qid, (int)chap->hash_len, data->rval);
 		dev_dbg(ctrl->device, "%s: qid %d host response %*ph\n",
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 35bf1a2357d49e..5b010318286e46 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -10,6 +10,7 @@
 #include <linux/nvme-auth.h>
 #include <crypto/hash.h>
 #include <crypto/kpp.h>
+#include <crypto/utils.h>
 #include "nvmet.h"
 
 static void nvmet_auth_expired_work(struct work_struct *work)
@@ -187,7 +188,7 @@ static u8 nvmet_auth_reply(struct nvmet_req *req, void *d, u32 tl)
 		return NVME_AUTH_DHCHAP_FAILURE_FAILED;
 	}
 
-	if (memcmp(data->rval, response, data->hl)) {
+	if (crypto_memneq(data->rval, response, data->hl)) {
 		pr_info("ctrl %d qid %d host response mismatch\n",
 			ctrl->cntlid, req->sq->qid);
 		pr_debug("ctrl %d qid %d rval %*ph\n",

From e4bde5182fa112acfb6e82c7b0c7342810c409e1 Mon Sep 17 00:00:00 2001
From: Xixin Liu <liuxixin@kylinos.cn>
Date: Thu, 25 Jun 2026 10:00:00 +0800
Subject: [PATCH 0108/1982] nvme: zns: cap zone report nr_zones by DMA buffer
 size

[ Upstream commit 09c9062d4f62199a634a45e2bb9e6e8e572cc78c ]

With Partial Report (PR=1), the Number of Zones (NZ) field in the report
header must equal the number of zone descriptors fully transferred in the
DMA buffer (ZNS Command Set Specification Rev 1.2, section 3.4.2).

nvme_ns_report_zones() does not cap the parse loop by max_in_buf derived
from buflen.  Cap nz with min3() over the device-reported count, nr_zones -
zone_idx, and max_in_buf.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/zns.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/zns.c b/drivers/nvme/host/zns.c
index cce4c5b55aa9c2..f067185920451a 100644
--- a/drivers/nvme/host/zns.c
+++ b/drivers/nvme/host/zns.c
@@ -178,7 +178,7 @@ int nvme_ns_report_zones(struct nvme_ns *ns, sector_t sector,
 	struct nvme_zone_report *report;
 	struct nvme_command c = { };
 	int ret, zone_idx = 0;
-	unsigned int nz, i;
+	unsigned int max_in_buf, nz, i;
 	size_t buflen;
 
 	if (ns->head->ids.csi != NVME_CSI_ZNS)
@@ -188,6 +188,9 @@ int nvme_ns_report_zones(struct nvme_ns *ns, sector_t sector,
 	if (!report)
 		return -ENOMEM;
 
+	max_in_buf = (buflen - sizeof(struct nvme_zone_report)) /
+		sizeof(struct nvme_zone_descriptor);
+
 	c.zmr.opcode = nvme_cmd_zone_mgmt_recv;
 	c.zmr.nsid = cpu_to_le32(ns->head->ns_id);
 	c.zmr.numd = cpu_to_le32(nvme_bytes_to_numd(buflen));
@@ -207,7 +210,8 @@ int nvme_ns_report_zones(struct nvme_ns *ns, sector_t sector,
 			goto out_free;
 		}
 
-		nz = min((unsigned int)le64_to_cpu(report->nr_zones), nr_zones);
+		nz = min3((unsigned int)le64_to_cpu(report->nr_zones),
+			  nr_zones - zone_idx, max_in_buf);
 		if (!nz)
 			break;
 

From 8a85caef42628eaaf87d00cd601aaf74424b7a91 Mon Sep 17 00:00:00 2001
From: Devansh Soni <devanshsoni874@gmail.com>
Date: Fri, 19 Jun 2026 18:27:24 +0530
Subject: [PATCH 0109/1982] staging: rtl8723bs: fix missing unregister_netdev
 on sdio_alloc_irq failure

[ Upstream commit 51b554f1a758570159a770983c7a0ccd7c761491 ]

In rtw_drv_init(), if rtw_drv_register_netdev() succeeds but
sdio_alloc_irq() fails, the error path jumps to free_if1 and calls
rtw_sdio_if1_deinit(). However, rtw_sdio_if1_deinit() calls
rtw_free_netdev() without a preceding unregister_netdev(), freeing a
still-registered netdev but leaving stale sysfs entries behind.

Signed-off-by: Devansh Soni <devanshsoni874@gmail.com>
Link: https://patch.msgid.link/20260619125724.12458-1-devanshsoni874@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index ae379e99736ad7..e9bf6c3b18af09 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -379,10 +379,13 @@ static int rtw_drv_init(
 
 	status = sdio_alloc_irq(dvobj);
 	if (status != _SUCCESS)
-		goto free_if1;
+		goto free_netdev;
 
 	status = _SUCCESS;
 
+free_netdev:
+	if (status != _SUCCESS)
+		rtw_unregister_netdevs(dvobj);
 free_if1:
 	if (status != _SUCCESS && if1)
 		rtw_sdio_if1_deinit(if1);

From 1e100c7514502321632d2a520e74db95e6618df1 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:47:14 +0800
Subject: [PATCH 0110/1982] usb: typec: mux: tusb1046: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 5e4eb5c96324b226220d29d025a334df28054ed3 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://patch.msgid.link/20260704124714.18404-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/mux/tusb1046.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/typec/mux/tusb1046.c b/drivers/usb/typec/mux/tusb1046.c
index 3c1a4551c2fbfe..89b47aa56c7a9f 100644
--- a/drivers/usb/typec/mux/tusb1046.c
+++ b/drivers/usb/typec/mux/tusb1046.c
@@ -179,6 +179,7 @@ static const struct of_device_id tusb1046_match_table[] = {
 	{.compatible = "ti,tusb1046"},
 	{},
 };
+MODULE_DEVICE_TABLE(of, tusb1046_match_table);
 
 static struct i2c_driver tusb1046_driver = {
 	.driver = {

From d7f0518e1bbd2e7b43de8e81a34c3aa1bfb9b73a Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Fri, 12 Jun 2026 15:58:46 -0700
Subject: [PATCH 0111/1982] udf: validate extent partition references in
 udf_current_aext()

[ Upstream commit 120ec50984b8645232c2c004310dd94ceff5520e ]

Long allocation descriptors carry an on-disk
extLocation.partitionReferenceNum. udf_current_aext() copies that value
into a kernel_lb_addr and returns it to several consumers.

If the partition reference is outside s_partitions, callers can later
index s_partmaps out of bounds. The truncate/free path can pass such an
extent to udf_free_blocks(), where the invalid partition reference
causes a slab out-of-bounds read.

Validate eloc->partitionReferenceNum in udf_current_aext() before
returning a decoded extent. This rejects invalid file extents and
indirect allocation descriptor extents in the common parser, so callers
do not need to duplicate the partition-map bounds check.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Link: https://patch.msgid.link/20260612225846.97678-1-kylebot@openai.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/inode.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 271e3f0d1fb10e..05d4e95ba3c618 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -2312,6 +2312,13 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos,
 		return -EINVAL;
 	}
 
+	if (eloc->partitionReferenceNum >= UDF_SB(inode->i_sb)->s_partitions) {
+		udf_debug("invalid partition reference %u (partitions %u)\n",
+			  eloc->partitionReferenceNum,
+			  UDF_SB(inode->i_sb)->s_partitions);
+		return -EFSCORRUPTED;
+	}
+
 	return 1;
 }
 

From e26ea9ee489f20b22a0099ff35aedda41b4e8ca7 Mon Sep 17 00:00:00 2001
From: Deepanshu Kartikey <kartikey406@gmail.com>
Date: Sun, 21 Jun 2026 09:28:41 +0530
Subject: [PATCH 0112/1982] udf: avoid recursive s_alloc_mutex deadlock when
 freeing AED blocks

[ Upstream commit 31e5e0c8c8e2617eb9f7a20c1cf5df23f592ade2 ]

udf_table_prealloc_blocks() and udf_table_new_block() call
udf_delete_aext() on the unallocated-space-table inode while holding
sbi->s_alloc_mutex. When the deleted allocation descriptor empties an
allocation-extent (AED) block, udf_delete_aext() returns that block to
free space via udf_free_blocks(). For a table-managed partition that
path is udf_free_blocks() -> udf_table_free_blocks() ->
mutex_lock(&sbi->s_alloc_mutex), i.e. the task tries to acquire a mutex
it already holds.

On a PREEMPT_RT kernel the rtmutex deadlock detector reports this as
-EDEADLK:

  rtmutex deadlock detected
  WARNING: kernel/locking/rtmutex.c:1698 at rt_mutex_handle_deadlock
  udf_table_free_blocks fs/udf/balloc.c:376 [inline]
  udf_free_blocks+0xa8c/0x1900 fs/udf/balloc.c:678
  udf_delete_aext+0x4f5/0xc00 fs/udf/inode.c:2381
  udf_table_prealloc_blocks fs/udf/balloc.c:544 [inline]
  udf_prealloc_blocks+0xbd4/0x10e0 fs/udf/balloc.c:702

On a non-RT kernel the same path is a hard self-deadlock (or a lockdep
recursive-locking splat). It is reachable from a crafted UDF image via
the write/sendfile path.

The allocator already refuses to recurse on the add side: see the
comment in udf_table_free_blocks() explaining why it must not call
udf_add_aext() while holding s_alloc_mutex. Apply the same rule to the
delete side. Let udf_delete_aext() report the AED block it would
otherwise free through a new out-parameter, and have the two callers
that hold s_alloc_mutex free it after dropping the lock. The block is
already unlinked from the inode's descriptor chain by then, so nothing
can reference it in the meantime. All other callers pass NULL and keep
freeing the block inline, exactly as before.

The out-parameter is pre-initialised with the reserved partition number
0xFFFF, which can never name a real block, so the caller can tell
whether a block was handed back.

Reported-by: syzbot+6a680377e13041c19d50@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6a680377e13041c19d50
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://syzkaller.appspot.com/bug?extid=6a680377e13041c19d50
Link: https://patch.msgid.link/20260621035841.56194-1-kartikey406@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/balloc.c   | 12 ++++++++++--
 fs/udf/inode.c    | 19 ++++++++++++++++---
 fs/udf/truncate.c |  2 +-
 fs/udf/udfdecl.h  |  3 ++-
 4 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index cc6dc6e1d84de4..30cec560014916 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -502,6 +502,8 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 	int8_t etype = -1;
 	struct udf_inode_info *iinfo;
 	int ret = 0;
+	/* AED block freed by udf_delete_aext(), released after unlock */
+	struct kernel_lb_addr freed = { .partitionReferenceNum = 0xFFFF };
 
 	if (first_block >= sbi->s_partmaps[partition].s_partition_len)
 		return 0;
@@ -541,7 +543,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 			udf_write_aext(table, &epos, &eloc,
 					(etype << 30) | elen, 1);
 		} else
-			udf_delete_aext(table, epos);
+			udf_delete_aext(table, epos, &freed);
 	} else {
 		alloc_count = 0;
 	}
@@ -552,6 +554,8 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 	if (alloc_count)
 		udf_add_free_space(sb, partition, -alloc_count);
 	mutex_unlock(&sbi->s_alloc_mutex);
+	if (freed.partitionReferenceNum != 0xFFFF)
+		udf_free_blocks(sb, table, &freed, 0, 1);
 	return alloc_count;
 }
 
@@ -560,6 +564,8 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
 			       uint32_t goal, int *err)
 {
 	struct udf_sb_info *sbi = UDF_SB(sb);
+	/* AED block freed by udf_delete_aext(), released after unlock */
+	struct kernel_lb_addr freed = { .partitionReferenceNum = 0xFFFF };
 	uint32_t spread = 0xFFFFFFFF, nspread = 0xFFFFFFFF;
 	udf_pblk_t newblock = 0;
 	uint32_t adsize;
@@ -643,12 +649,14 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
 	if (goal_elen)
 		udf_write_aext(table, &goal_epos, &goal_eloc, goal_elen, 1);
 	else
-		udf_delete_aext(table, goal_epos);
+		udf_delete_aext(table, goal_epos, &freed);
 	brelse(goal_epos.bh);
 
 	udf_add_free_space(sb, partition, -1);
 
 	mutex_unlock(&sbi->s_alloc_mutex);
+	if (freed.partitionReferenceNum != 0xFFFF)
+		udf_free_blocks(sb, table, &freed, 0, 1);
 	*err = 0;
 	return newblock;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 05d4e95ba3c618..6a0c66d706295e 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1217,7 +1217,7 @@ static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
 
 	if (startnum > endnum) {
 		for (i = 0; i < (startnum - endnum); i++)
-			udf_delete_aext(inode, *epos);
+			udf_delete_aext(inode, *epos, NULL);
 	} else if (startnum < endnum) {
 		for (i = 0; i < (endnum - startnum); i++) {
 			err = udf_insert_aext(inode, *epos,
@@ -2348,7 +2348,8 @@ static int udf_insert_aext(struct inode *inode, struct extent_position epos,
 	return ret;
 }
 
-int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
+int8_t udf_delete_aext(struct inode *inode, struct extent_position epos,
+			struct kernel_lb_addr *freed)
 {
 	struct extent_position oepos;
 	int adsize;
@@ -2398,7 +2399,19 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
 	elen = 0;
 
 	if (epos.bh != oepos.bh) {
-		udf_free_blocks(inode->i_sb, inode, &epos.block, 0, 1);
+		/*
+		 * The block that held the now-empty allocation extent must be
+		 * returned to free space.  When the caller already holds
+		 * s_alloc_mutex (the space-table allocator in balloc.c),
+		 * freeing it inline would recurse through udf_free_blocks()
+		 * into udf_table_free_blocks() and deadlock re-acquiring
+		 * s_alloc_mutex.  In that case report the block to the caller,
+		 *  which frees it after dropping the lock.
+		 */
+		if (freed)
+			*freed = epos.block;
+		else
+			udf_free_blocks(inode->i_sb, inode, &epos.block, 0, 1);
 		udf_write_aext(inode, &oepos, &eloc, elen, 1);
 		udf_write_aext(inode, &oepos, &eloc, elen, 1);
 		if (!oepos.bh) {
diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
index b4071c9cf8c951..da5a61306390cc 100644
--- a/fs/udf/truncate.c
+++ b/fs/udf/truncate.c
@@ -159,7 +159,7 @@ void udf_discard_prealloc(struct inode *inode)
 
 	if (etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
 		lbcount -= elen;
-		udf_delete_aext(inode, prev_epos);
+		udf_delete_aext(inode, prev_epos, NULL);
 		udf_free_blocks(inode->i_sb, inode, &eloc, 0,
 				DIV_ROUND_UP(elen, bsize));
 	}
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index d159f20d61e89a..db261d743b7f17 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -169,7 +169,8 @@ extern int udf_add_aext(struct inode *, struct extent_position *,
 			struct kernel_lb_addr *, uint32_t, int);
 extern void udf_write_aext(struct inode *, struct extent_position *,
 			   struct kernel_lb_addr *, uint32_t, int);
-extern int8_t udf_delete_aext(struct inode *, struct extent_position);
+extern int8_t udf_delete_aext(struct inode *, struct extent_position,
+			       struct kernel_lb_addr *);
 extern int udf_next_aext(struct inode *inode, struct extent_position *epos,
 			 struct kernel_lb_addr *eloc, uint32_t *elen,
 			 int8_t *etype, int inc);

From 7bec37dbc03ded95e68167e81c5d85ae4870dbd3 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 15:21:40 +0800
Subject: [PATCH 0113/1982] ASoC: codecs: uda1342: Leave cache-only mode before
 syncing

[ Upstream commit 29da72e58fde87e632f2fa43e448fcd1e3ab31b0 ]

uda1342_suspend() puts the regmap into cache-only mode. uda1342_resume()
marks the cache dirty and syncs it, but does not first leave cache-only
mode and ignores sync failures.

Leave cache-only mode before syncing the dirty cache, propagate sync
failures, and restore cache-only/dirty state on failure.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704072140.67222-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/uda1342.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/uda1342.c b/sound/soc/codecs/uda1342.c
index b0b29012842da0..c21919bef4d72b 100644
--- a/sound/soc/codecs/uda1342.c
+++ b/sound/soc/codecs/uda1342.c
@@ -308,9 +308,16 @@ static int uda1342_suspend(struct device *dev)
 static int uda1342_resume(struct device *dev)
 {
 	struct uda1342_priv *uda1342 = dev_get_drvdata(dev);
+	int ret;
 
+	regcache_cache_only(uda1342->regmap, false);
 	regcache_mark_dirty(uda1342->regmap);
-	regcache_sync(uda1342->regmap);
+	ret = regcache_sync(uda1342->regmap);
+	if (ret) {
+		regcache_cache_only(uda1342->regmap, true);
+		regcache_mark_dirty(uda1342->regmap);
+		return ret;
+	}
 
 	return 0;
 }

From a1a4ef16abcaa0bf09952b4413a2cc2991f20b89 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Mon, 15 Jun 2026 18:57:29 -0400
Subject: [PATCH 0114/1982] drm/amdgpu/atomfirmware: WARN() rather than BUG()

[ Upstream commit d7c595044965c826e6f3ce30590d3ec4399cd633 ]

There's no need to crash the kernel for this case.  Just
return an error.

Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
index c7d32fb216e4ed..ce2a4a15d5ecbd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c
@@ -806,8 +806,6 @@ int amdgpu_atomfirmware_get_clock_info(struct amdgpu_device *adev)
 				   (crev != 6)) {
 				spll->reference_freq = le32_to_cpu(gfx_info->v22.rlc_gpu_timer_refclk);
 				ret = 0;
-			} else {
-				BUG();
 			}
 		}
 	}

From 61ebae16cef33e8601d030e3d200e36025a2c49b Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Mon, 15 Jun 2026 18:55:21 -0400
Subject: [PATCH 0115/1982] drm/amdgpu/gfx11: WARN() rather than BUG() for
 invalid SDMA engine

[ Upstream commit c24edbd5ae0e4f24e0179e8c9f22a867016177bb ]

There's no need to crash the kernel for these cases.

Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c
index aaccf0b9947d4d..d32ea91eeb3432 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v11.c
@@ -139,7 +139,8 @@ static uint32_t get_sdma_rlc_reg_offset(struct amdgpu_device *adev,
 				regSDMA1_QUEUE0_RB_CNTL) - regSDMA0_QUEUE0_RB_CNTL;
 		break;
 	default:
-		BUG();
+		WARN(1, "Invalid SDMA engine id %d\n", engine_id);
+		break;
 	}
 
 	sdma_rlc_reg_offset = sdma_engine_reg_base

From 21ffa516ded0d6c700a03aad8d263ac3d8964d7a Mon Sep 17 00:00:00 2001
From: John Garry <john.g.garry@oracle.com>
Date: Mon, 6 Jul 2026 12:54:02 +0000
Subject: [PATCH 0116/1982] nvme: don't reference NS after unlocking in
 nvme_ns_head_ctrl_ioctl()

[ Upstream commit 77c57daf98a2ad95ec9ac1371caeff8939cc1f58 ]

In nvme_ns_head_ctrl_ioctl(), once we drop the SRCU read lock we should
not reference the NS to lookup the controller, so use the available
controller pointer directly.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: John Garry <john.g.garry@oracle.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index fb8533127116a6..b3e58de6f5cc5e 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -727,7 +727,7 @@ static int nvme_ns_head_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd,
 
 	nvme_get_ctrl(ns->ctrl);
 	srcu_read_unlock(&head->srcu, srcu_idx);
-	ret = nvme_ctrl_ioctl(ns->ctrl, cmd, argp, open_for_write);
+	ret = nvme_ctrl_ioctl(ctrl, cmd, argp, open_for_write);
 
 	nvme_put_ctrl(ctrl);
 	return ret;

From 87afe445153c0580cdef776172e1dc24e22e5ec3 Mon Sep 17 00:00:00 2001
From: Qingtao Cao <qingtao.cao.au@gmail.com>
Date: Wed, 3 Jun 2026 11:06:11 +1000
Subject: [PATCH 0117/1982] bus: mhi: core: Fix sys error transition latency

[ Upstream commit 22568e8f13a42ab69b7d624741768cbf15dded74 ]

Bring forward the idea to fix the power down latency in
mhi_pm_disable_transition() further to mhi_pm_sys_error_transition()
so that the transition into system error (triggered by AT!RESET) in the
modems won't have to return only after the timeout of up to 24 seconds.

Once the device gets reset, there is no guarantee that it will send an
interrupt to indicate the state transition. So polling is the sensible
option here.

Signed-off-by: Qingtao Cao <qingtao.cao.au@gmail.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Link: https://patch.msgid.link/20260603011333.3306102-2-qingtao.cao.au@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mhi/host/pm.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c
index b4ef115189b505..71bcb0f98ce6ac 100644
--- a/drivers/bus/mhi/host/pm.c
+++ b/drivers/bus/mhi/host/pm.c
@@ -651,21 +651,13 @@ static void mhi_pm_sys_error_transition(struct mhi_controller *mhi_cntrl)
 
 	/* Trigger MHI RESET so that the device will not access host memory */
 	if (reset_device) {
-		u32 in_reset = -1;
-		unsigned long timeout = msecs_to_jiffies(mhi_cntrl->timeout_ms);
-
 		dev_dbg(dev, "Triggering MHI Reset in device\n");
 		mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
 
 		/* Wait for the reset bit to be cleared by the device */
-		ret = wait_event_timeout(mhi_cntrl->state_event,
-					 mhi_read_reg_field(mhi_cntrl,
-							    mhi_cntrl->regs,
-							    MHICTRL,
-							    MHICTRL_RESET_MASK,
-							    &in_reset) ||
-					!in_reset, timeout);
-		if (!ret || in_reset) {
+		ret = mhi_poll_reg_field(mhi_cntrl, mhi_cntrl->regs, MHICTRL,
+				 MHICTRL_RESET_MASK, 0, 25000, mhi_cntrl->timeout_ms);
+		if (ret) {
 			dev_err(dev, "Device failed to exit MHI Reset state\n");
 			write_lock_irq(&mhi_cntrl->pm_lock);
 			cur_state = mhi_tryset_pm_state(mhi_cntrl,

From 8cc9318ac315be56f4250597b8377edf36ef3632 Mon Sep 17 00:00:00 2001
From: Muralidhara M K <muralidhara.mk@amd.com>
Date: Mon, 29 Jun 2026 21:26:31 +0530
Subject: [PATCH 0118/1982] platform/x86/amd/hsmp: Validate ACPI UID before
 parsing socket index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4c7d1b4cd75a775326e6802608440f7642284ea6 ]

hsmp_get_uid() passed the device UID directly to kstrtou16(uid + 2)
without checking it.  A NULL UID or one shorter than three characters
would dereference a NULL pointer or read past the end of the string.

Reject such UIDs with -EINVAL before stripping the "ID" prefix.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260625123337.886435-3-muralidhara.mk@amd.com
Link: https://patch.msgid.link/20260629155634.1807598-2-muralidhara.mk@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/hsmp/acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/x86/amd/hsmp/acpi.c b/drivers/platform/x86/amd/hsmp/acpi.c
index d0b74d243ce4cb..674be316547768 100644
--- a/drivers/platform/x86/amd/hsmp/acpi.c
+++ b/drivers/platform/x86/amd/hsmp/acpi.c
@@ -21,6 +21,7 @@
 #include <linux/kstrtox.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/string.h>
 #include <linux/sysfs.h>
 #include <linux/uuid.h>
 
@@ -78,6 +79,8 @@ static inline int hsmp_get_uid(struct device *dev, u16 *sock_ind)
 	 * bytes to integer.
 	 */
 	uid = acpi_device_uid(ACPI_COMPANION(dev));
+	if (!uid || strlen(uid) < 3)
+		return -EINVAL;
 
 	return kstrtou16(uid + 2, 10, sock_ind);
 }

From 42dcaf236bf8f170f5c4dc28458cb3fabb44350c Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 12:06:51 +0800
Subject: [PATCH 0119/1982] ASoC: codecs: max98396: Unwind supplies on resume
 failure

[ Upstream commit d20de7409dfa8e3341af7f157cd42130bd4ba3a7 ]

max98396_resume() enables the core, pvdd, and vbat supplies before
leaving cache-only mode, resetting the device, and replaying cached
register state. The function currently ignores regcache_sync() failures,
and the optional pvdd/vbat enable failures return without unwinding
supplies that were already enabled in this resume attempt.

Rework the function to use common error labels. This propagates sync
failures, restores cache-only/dirty state on failed cache replay, and
disables each supply acquired by this resume path before returning the
error.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704040651.47558-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/max98396.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/sound/soc/codecs/max98396.c b/sound/soc/codecs/max98396.c
index 4b4e1fc98a6da5..0255399c405df2 100644
--- a/sound/soc/codecs/max98396.c
+++ b/sound/soc/codecs/max98396.c
@@ -1601,19 +1601,37 @@ static int max98396_resume(struct device *dev)
 	if (max98396->pvdd) {
 		ret = regulator_enable(max98396->pvdd);
 		if (ret < 0)
-			return ret;
+			goto err_core_supplies;
 	}
 
 	if (max98396->vbat) {
 		ret = regulator_enable(max98396->vbat);
 		if (ret < 0)
-			return ret;
+			goto err_pvdd;
 	}
 
 	regcache_cache_only(max98396->regmap, false);
 	max98396_reset(max98396, dev);
-	regcache_sync(max98396->regmap);
+	ret = regcache_sync(max98396->regmap);
+	if (ret < 0) {
+		regcache_cache_only(max98396->regmap, true);
+		regcache_mark_dirty(max98396->regmap);
+		goto err_vbat;
+	}
+
 	return 0;
+
+err_vbat:
+	if (max98396->vbat)
+		regulator_disable(max98396->vbat);
+err_pvdd:
+	if (max98396->pvdd)
+		regulator_disable(max98396->pvdd);
+err_core_supplies:
+	regulator_bulk_disable(MAX98396_NUM_CORE_SUPPLIES,
+			       max98396->core_supplies);
+
+	return ret;
 }
 
 static const struct dev_pm_ops max98396_pm = {

From 6d7097c6cc34e428223bcecf1a5b0a9ee581884f Mon Sep 17 00:00:00 2001
From: Muralidhara M K <muralidhara.mk@amd.com>
Date: Mon, 29 Jun 2026 21:26:32 +0530
Subject: [PATCH 0120/1982] platform/x86/amd/hsmp: Validate _DSD mailbox
 sub-package element count
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0d7a2664494534d6152be9bd9bf1cb1d089c67d3 ]

hsmp_read_acpi_dsd() dereferenced elements[0] and elements[1] of each
mailbox sub-package before confirming the package actually held two
elements, allowing an out-of-bounds read on a malformed _DSD.

Verify package.count >= 2 first, then fetch the string and integer
objects.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260625123337.886435-3-muralidhara.mk@amd.com
Link: https://patch.msgid.link/20260629155634.1807598-3-muralidhara.mk@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/hsmp/acpi.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/amd/hsmp/acpi.c b/drivers/platform/x86/amd/hsmp/acpi.c
index 674be316547768..8f297d52ab5e39 100644
--- a/drivers/platform/x86/amd/hsmp/acpi.c
+++ b/drivers/platform/x86/amd/hsmp/acpi.c
@@ -152,12 +152,18 @@ static int hsmp_read_acpi_dsd(struct hsmp_socket *sock)
 		union acpi_object *msgobj, *msgstr, *msgint;
 
 		msgobj	= &mailbox_package->package.elements[j];
-		msgstr	= &msgobj->package.elements[0];
-		msgint	= &msgobj->package.elements[1];
 
 		/* package should have 1 string and 1 integer object */
 		if (msgobj->type != ACPI_TYPE_PACKAGE ||
-		    msgstr->type != ACPI_TYPE_STRING ||
+		    msgobj->package.count < 2) {
+			ret = -EINVAL;
+			goto free_buf;
+		}
+
+		msgstr	= &msgobj->package.elements[0];
+		msgint	= &msgobj->package.elements[1];
+
+		if (msgstr->type != ACPI_TYPE_STRING ||
 		    msgint->type != ACPI_TYPE_INTEGER) {
 			ret = -EINVAL;
 			goto free_buf;

From c50acb6685598c319c77a64bdca96cfd6a389323 Mon Sep 17 00:00:00 2001
From: Pranjal Shrivastava <praan@google.com>
Date: Mon, 15 Jun 2026 23:50:34 +0000
Subject: [PATCH 0121/1982] PCI/ATS: Ensure pci_ats_supported() is PF-aware for
 VFs

[ Upstream commit 4f2cd6091ac41566a7300f5a4590d20a99aaa8bc ]

Update pci_ats_supported() to additionally check the associated PF's
status when called on a VF. This ensures that PF-level quirks and
untrusted status are correctly propagated to VFs, providing a robust
support check that aligns with the kernel's PF-centric ATS configuration
model and is immune to the timing of VF-specific fixups.

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/ats.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
index ec6c8dbdc5e9c9..a5fa7745bce8e8 100644
--- a/drivers/pci/ats.c
+++ b/drivers/pci/ats.c
@@ -40,10 +40,13 @@ void pci_ats_init(struct pci_dev *dev)
  */
 bool pci_ats_supported(struct pci_dev *dev)
 {
-	if (!dev->ats_cap)
+	if (!dev->ats_cap || dev->untrusted)
 		return false;
 
-	return (dev->untrusted == 0);
+	if (dev->is_virtfn)
+		return pci_ats_supported(pci_physfn(dev));
+
+	return true;
 }
 EXPORT_SYMBOL_GPL(pci_ats_supported);
 

From d638c584bdae71d46f3e5391dd70551349d8ea78 Mon Sep 17 00:00:00 2001
From: Chris Lew <christopher.lew@oss.qualcomm.com>
Date: Mon, 6 Apr 2026 09:59:50 +0530
Subject: [PATCH 0122/1982] rpmsg: char: Check for ongoing chrdev destroy

[ Upstream commit 1f9c2897afb0fe86c1fdf4f5e23c5fb8f7442f6d ]

A null pointer panic is observed when stopping a remoteproc and closing
a character device using the RPMSG_DESTROY_EPT_IOCTL. There is a race
where each context calls rpmsg_chrdev_eptdev_destroy(). The thread that
runs second will call cdev_device_del() for a second time, which fails
because the first call already removed the device from sysfs. Add a
check at the beginning of destroy and exit early if the destroy call
has already been done.

[ 26.654130] Call trace
[ 26.656658] kernfs_find_and_get_ns+0x28/0x8
[ 26.661140] sysfs_unmerge_group+0x2c/0x7
[ 26.665357] dpm_sysfs_remove+0x38/0x8
[ 26.669305] device_del+0xa4/0x3e
[ 26.672811] cdev_device_del+0x28/0x7
[ 26.676675] rpmsg_chrdev_eptdev_destroy+0x68/0x98
[ 26.682765] rpmsg_eptdev_ioctl+0x130/0x11c8
[ 26.688318] __arm64_sys_ioctl+0xb4/0x10
[ 26.692448] invoke_syscall+0x50/0x12
[ 26.696312] el0_svc_common.constprop.0+0xc8/0xf
[ 26.701151] do_el0_svc+0x24/0x3
[ 26.704570] el0_svc+0x40/0x17
[ 26.707810] el0t_64_sync_handler+0x120/0x13
[ 26.712288] el0t_64_sync+0x1a0/0x1a

Signed-off-by: Chris Lew <christopher.lew@oss.qualcomm.com>
Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260406-rpmsg-char-fix-chrdev-destroy-race-v1-1-7317434fa246@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rpmsg/rpmsg_char.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index d918cb30db9b06..3edc95f48967b4 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -79,6 +79,11 @@ int rpmsg_chrdev_eptdev_destroy(struct device *dev, void *data)
 	struct rpmsg_eptdev *eptdev = dev_to_eptdev(dev);
 
 	mutex_lock(&eptdev->ept_lock);
+	if (!eptdev->rpdev) {
+		mutex_unlock(&eptdev->ept_lock);
+		return 0;
+	}
+
 	eptdev->rpdev = NULL;
 	if (eptdev->ept) {
 		/* The default endpoint is released by the rpmsg core */

From 6b772df6ea8e3e275652b6fb5d0d57a551a33566 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:26:31 +0800
Subject: [PATCH 0123/1982] media: cec: tegra: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 8dcf23edaf4bdf22259f6a47cfddc8bb1467425c ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/platform/tegra/tegra_cec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/cec/platform/tegra/tegra_cec.c b/drivers/media/cec/platform/tegra/tegra_cec.c
index 3ed50097262f64..fe66336e734f88 100644
--- a/drivers/media/cec/platform/tegra/tegra_cec.c
+++ b/drivers/media/cec/platform/tegra/tegra_cec.c
@@ -458,6 +458,7 @@ static const struct of_device_id tegra_cec_of_match[] = {
 	{ .compatible = "nvidia,tegra210-cec", },
 	{},
 };
+MODULE_DEVICE_TABLE(of, tegra_cec_of_match);
 
 static struct platform_driver tegra_cec_driver = {
 	.driver = {

From 813a0eaf5570f8045cc9083355fbb39f5e4ce79a Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 18 Jun 2026 16:32:47 +0200
Subject: [PATCH 0124/1982] media: v4l2-tpg: reduce stack usage for kasan
 builds

[ Upstream commit c49cdaafa443ccf861a72d3191121294742c28c7 ]

tpg_fill_plane_buffer() is a rather complex function. While there is
nothing wrong with it per se, I have run into corner cases with clang-22
on s390 using KASAN that makes it run out of registers and blow the
stack warning limit from excessive spills:

drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2629:6: error: stack frame size (1560) exceeds limit (1536)
      in 'tpg_fill_plane_buffer' [-Werror,-Wframe-larger-than]
 2629 | void tpg_fill_plane_buffer(struct tpg_data *tpg, v4l2_std_id std,

Forcing the two largest callees out of line completely avoids the problem
and prevents all the register spills, with the stack usage for each function
going down to a few bytes for the local variables.

Arguably this is a problem caused by clang rather than the code, but
a noinline_for_stack annotation is an easy workaround.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
index 931e5dc453b900..e1d5c220f73812 100644
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -2346,9 +2346,11 @@ static void tpg_fill_params_extras(const struct tpg_data *tpg,
 			(params->is_60hz ? V4L2_FIELD_TOP : V4L2_FIELD_BOTTOM);
 }
 
-static void tpg_fill_plane_extras(const struct tpg_data *tpg,
-				  const struct tpg_draw_params *params,
-				  unsigned p, unsigned h, u8 *vbuf)
+/* noinline to work around clang KASAN issues */
+static noinline_for_stack void
+tpg_fill_plane_extras(const struct tpg_data *tpg,
+		      const struct tpg_draw_params *params,
+		      unsigned p, unsigned h, u8 *vbuf)
 {
 	unsigned twopixsize = params->twopixsize;
 	unsigned img_width = params->img_width;
@@ -2483,9 +2485,9 @@ static void tpg_fill_plane_extras(const struct tpg_data *tpg,
 	}
 }
 
-static void tpg_fill_plane_pattern(const struct tpg_data *tpg,
-				   const struct tpg_draw_params *params,
-				   unsigned p, unsigned h, u8 *vbuf)
+static noinline_for_stack void
+tpg_fill_plane_pattern(const struct tpg_data *tpg, const struct tpg_draw_params *params,
+		       unsigned p, unsigned h, u8 *vbuf)
 {
 	unsigned twopixsize = params->twopixsize;
 	unsigned img_width = params->img_width;

From aa7c80d4e25a47d73e99da22dc417a74dd59e8c9 Mon Sep 17 00:00:00 2001
From: Xu Rao <raoxu@uniontech.com>
Date: Mon, 6 Jul 2026 17:25:00 +0800
Subject: [PATCH 0125/1982] mmc: block: reject invalid perdev_minors before
 division

[ Upstream commit 5253aee00a4383cb0482d5e99bde48b8054ae2c0 ]

The mmcblk.perdev_minors module parameter is parsed as a signed int and
is used during mmc_blk_init() to compute the number of supported block
devices.

Passing perdev_minors=0 makes the init path divide by zero when it
computes max_devices. Negative values are invalid as well and would make
max_devices negative before it is later used as an IDA limit.

Reject non-positive perdev_minors values before registering any mmcblk
resources.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/block.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index e8e45b161a398f..5077842b286fef 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -3407,6 +3407,11 @@ static int __init mmc_blk_init(void)
 {
 	int res;
 
+	if (perdev_minors <= 0) {
+		pr_err("mmcblk: invalid minors per device: %d\n", perdev_minors);
+		return -EINVAL;
+	}
+
 	res  = bus_register(&mmc_rpmb_bus_type);
 	if (res < 0) {
 		pr_err("mmcblk: could not register RPMB bus type\n");

From 5996913c7c04fb3e2f11f8e4130093906cf37ea2 Mon Sep 17 00:00:00 2001
From: Rahul Bukte <rahul.bukte@sony.com>
Date: Wed, 10 Jun 2026 14:41:30 +0900
Subject: [PATCH 0126/1982] serial: 8250: force synchronous probe for the ISA
 and PNP drivers

[ Upstream commit 31e11af34e2c7cc61e25533ab877b1f9cc3eb528 ]

On x86_64 defconfig, booting with driver_async_probe=serial hangs in early
init. The 8250 PNP driver is put onto the async probe pool.
serial8250_register_8250_port() runs in a kworker concurrently with the
ISA registration done from the serial8250_init() initcall resulting in a
deadlock or NULL dereference.

  - Deadlock: serial_core_register_port() holds port_mutex across
    serial_core_add_one_port()
        uart_configure_port()
            autoconfig_irq()
                probe_irq_on()
                    async_synchronize_full(),
    which waits for the async probe pool to drain.

    The async PNP worker reaches the "port already in use" check and
    tries to unregister it.
    serial8250_register_8250_port()
        uart_remove_one_port()
            serial_core_unregister_port()
    This blocks on port_mutex.
    The init thread waits for the worker and the worker waits for the
    init thread.

  - NULL deref: when the worker instead observes a slot whose port.dev
    is set but whose port_dev has not yet been populated, it hits the
    null pointer on the call to serial_core_get_ctrl_dev() in
    serial_core_unregister_port().

Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
Link: https://patch.msgid.link/20260610054130.2825182-1-rahul.bukte@sony.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_platform.c | 1 +
 drivers/tty/serial/8250/8250_pnp.c      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_platform.c b/drivers/tty/serial/8250/8250_platform.c
index fe7ec440ffa58e..69d8720fb65bf0 100644
--- a/drivers/tty/serial/8250/8250_platform.c
+++ b/drivers/tty/serial/8250/8250_platform.c
@@ -287,6 +287,7 @@ static struct platform_driver serial8250_isa_driver = {
 	.driver		= {
 		.name	= "serial8250",
 		.acpi_match_table = acpi_platform_serial_table,
+		.probe_type = PROBE_FORCE_SYNCHRONOUS,
 	},
 };
 
diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
index 7a837fdf9df133..3f41a9d6cb2731 100644
--- a/drivers/tty/serial/8250/8250_pnp.c
+++ b/drivers/tty/serial/8250/8250_pnp.c
@@ -521,6 +521,7 @@ static struct pnp_driver serial_pnp_driver = {
 	.remove		= serial_pnp_remove,
 	.driver         = {
 		.pm     = pm_sleep_ptr(&serial_pnp_pm_ops),
+		.probe_type = PROBE_FORCE_SYNCHRONOUS,
 	},
 	.id_table	= pnp_dev_table,
 };

From d4b9dc0a5b4d1cb2ec8034d334994733bef59a4a Mon Sep 17 00:00:00 2001
From: Haoxiang Li <haoxiang_li2024@163.com>
Date: Tue, 23 Jun 2026 22:05:39 +0800
Subject: [PATCH 0127/1982] tty: serial: pch_uart: add check for pci_get_slot()

[ Upstream commit 970ede67de0e3f6a1e707ec99ae49d80bf3f2966 ]

Add check for pci_get_slot() to prevent a potetial
null pointer dereference in pch_request_dma().

Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260623140539.2272473-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/pch_uart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index c3f32e0590b7fb..9104361ccb14ff 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -678,6 +678,11 @@ static void pch_request_dma(struct uart_port *port)
 	/* Get DMA's dev information */
 	dma_dev = pci_get_slot(priv->pdev->bus,
 			PCI_DEVFN(PCI_SLOT(priv->pdev->devfn), 0));
+	if (!dma_dev) {
+		dev_err(priv->port.dev, "%s: failed to get DMA device\n",
+			__func__);
+		return;
+	}
 
 	/* Set Tx DMA */
 	param = &priv->param_tx;

From e8ba98b981a740be135b49038fdd1be46965cb07 Mon Sep 17 00:00:00 2001
From: Aniket Randive <aniket.randive@oss.qualcomm.com>
Date: Mon, 6 Jul 2026 15:07:49 +0530
Subject: [PATCH 0128/1982] serial: qcom_geni: Disable closing_wait for console
 to prevent shutdown timeout

[ Upstream commit acba38e675dd66f52925cb9edf9ed8db16335875 ]

During system power-off, systemd closes the console UART and blocks in
tty_wait_until_sent() waiting for pending TX completion before
uart_shutdown() can cancel pending TX operations. With the default
closing_wait of 30s, this causes a watchdog reset when systemd is
responsible for watchdog feeding.

Set closing_wait to ASYNC_CLOSING_WAIT_NONE in startup() for console
ports to bypass tty_wait_until_sent() on close, allowing uart_shutdown()
to cancel TX commands cleanly. This change doesn't impact regular ports
functionality.

Signed-off-by: Aniket Randive <aniket.randive@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706093749.836121-1-aniket.randive@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/qcom_geni_serial.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 5d59a2cfab3e25..0807ca83d8078d 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -1244,6 +1244,7 @@ static int qcom_geni_serial_startup(struct uart_port *uport)
 {
 	int ret;
 	struct qcom_geni_serial_port *port = to_dev_port(uport);
+	struct tty_port *tport = &uport->state->port;
 
 	if (!port->setup) {
 		ret = qcom_geni_serial_port_setup(uport);
@@ -1251,6 +1252,13 @@ static int qcom_geni_serial_startup(struct uart_port *uport)
 			return ret;
 	}
 
+	/*
+	 * Skip the close-time transmit drain for console ports so that
+	 * shutdown can proceed without waiting for pending TX completion.
+	 */
+	if (uart_console(uport))
+		tport->closing_wait = ASYNC_CLOSING_WAIT_NONE;
+
 	uart_port_lock_irq(uport);
 	qcom_geni_serial_start_rx(uport);
 	uart_port_unlock_irq(uport);

From 6997b82a2a26d40141dec72c71f13284869d25db Mon Sep 17 00:00:00 2001
From: Haoxiang Li <haoxiang_li2024@163.com>
Date: Sat, 20 Jun 2026 20:06:31 +0800
Subject: [PATCH 0129/1982] usb: fsl_qe_udc: check qe_alloc_request() failure
 in ch9getstatus()

[ Upstream commit 612551bf7cf7113b8bbd5e8c1eea86d9427c2f95 ]

qe_alloc_request() may return NULL on allocation failure. ch9getstatus()
passes the return value directly to container_of() and then immediately
dereferences the resulting qe_req pointer. Check the allocation result
before using it and stall the control request on failure.

Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260620120631.2894977-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fsl_qe_udc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index aacfde06387c0b..7911dca2135cf7 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1945,6 +1945,7 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
 			u16 index, u16 length)
 {
 	u16 usb_status = 0;
+	struct usb_request *usb_req;
 	struct qe_req *req;
 	struct qe_ep *ep;
 	int status = 0;
@@ -1983,8 +1984,11 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
 		}
 	}
 
-	req = container_of(qe_alloc_request(&ep->ep, GFP_KERNEL),
-					struct qe_req, req);
+	usb_req = qe_alloc_request(&ep->ep, GFP_KERNEL);
+	if (!usb_req)
+		goto stall;
+
+	req = container_of(usb_req, struct qe_req, req);
 	req->req.length = 2;
 	req->req.buf = udc->statusbuf;
 	*(u16 *)req->req.buf = cpu_to_le16(usb_status);

From 099d34863a4c1b6f60432c2d9a8afb0bc366b8de Mon Sep 17 00:00:00 2001
From: Xu Rao <raoxu@uniontech.com>
Date: Thu, 11 Jun 2026 17:12:28 +0800
Subject: [PATCH 0130/1982] usb: gadget: u_audio: clean up capture endpoint on
 feedback failure

[ Upstream commit 7a0d4f60da261f61dcb50c8e05fa53cc7d4d4427 ]

u_audio_start_capture() enables the capture OUT endpoint, queues capture
requests and marks the stream active before setting up the optional
feedback endpoint.

If feedback endpoint configuration or enablement fails, the function
returns an error while the capture endpoint remains enabled and its
requests may remain queued. The current code even leaves TODO comments
at these return paths.

Unwind the already started capture endpoint on these failures. Also set
fb_ep_enabled only after usb_ep_enable() succeeds, so the software state
matches the endpoint state.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/183621D513E0DE8B+20260611091229.4017443-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/u_audio.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index 24c673dcbbd771..75a4ce406c2a3e 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -641,15 +641,15 @@ int u_audio_start_capture(struct g_audio *audio_dev)
 	ret = config_ep_by_speed(gadget, &audio_dev->func, ep_fback);
 	if (ret < 0) {
 		dev_err(dev, "config_ep_by_speed in_ep_fback failed (%d)\n", ret);
-		return ret; // TODO: Clean up out_ep
+		goto err_out_ep;
 	}
 
-	prm->fb_ep_enabled = true;
 	ret = usb_ep_enable(ep_fback);
 	if (ret < 0) {
 		dev_err(dev, "usb_ep_enable failed for in_ep_fback (%d)\n", ret);
-		return ret; // TODO: Clean up out_ep
+		goto err_out_ep;
 	}
+	prm->fb_ep_enabled = true;
 	req_len = ep_fback->maxpacket;
 
 	req_fback = usb_ep_alloc_request(ep_fback, GFP_ATOMIC);
@@ -680,6 +680,12 @@ int u_audio_start_capture(struct g_audio *audio_dev)
 		dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
 
 	return 0;
+
+err_out_ep:
+	set_active(prm, false);
+	free_ep(prm, ep);
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(u_audio_start_capture);
 

From 4fba239be9110b0fb82948e5fb4d17c5ca49b27b Mon Sep 17 00:00:00 2001
From: David Laight <david.laight.linux@gmail.com>
Date: Mon, 8 Jun 2026 10:55:21 +0100
Subject: [PATCH 0131/1982] usb_string_copy: Use kzalloc() to avoid leaking old
 data

[ Upstream commit 057df423bf4747091cf942af57307627e941e1fb ]

If the string is read while being updated (which is why the copy is done
in place) and the new string is longer than the old one, then the reader
can read memory that isnt part of either string.

Use memcpy() to copy the known length string instead of strcpy.

Signed-off-by: David Laight <david.laight.linux@gmail.com>
Link: https://patch.msgid.link/20260608095523.2606-37-david.laight.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/configfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index aa0a25efb6aa0e..b6237a2e02003e 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -125,11 +125,11 @@ static int usb_string_copy(const char *s, char **s_copy)
 	if (copy) {
 		str = copy;
 	} else {
-		str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
+		str = kzalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
 		if (!str)
 			return -ENOMEM;
 	}
-	strcpy(str, s);
+	memcpy(str, s, ret + 1);
 	if (str[ret - 1] == '\n')
 		str[ret - 1] = '\0';
 	*s_copy = str;

From d0fa85e364968f531ea906df59962e32872e4b63 Mon Sep 17 00:00:00 2001
From: Gabriel Prostitis <prostitisgabriel@gmail.com>
Date: Mon, 1 Jun 2026 08:44:11 +0200
Subject: [PATCH 0132/1982] USB: gadget: inode: fix mm lifetime handling

[ Upstream commit a1c33c80e11ecd5c3310a38c4be324095dd85ac5 ]

priv stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.

This can result in a use-after-free if the task exits before
completion handling finishes.

Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.

Reported-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Signed-off-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260601-mm-uaf-fix-v2-2-3c942a707bce@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/legacy/inode.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 7c72267c0c53bf..a46b6a6b1f836e 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -473,11 +473,17 @@ static void ep_user_copy_worker(struct work_struct *work)
 	struct kiocb *iocb = priv->iocb;
 	size_t ret;
 
-	kthread_use_mm(mm);
-	ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
-	kthread_unuse_mm(mm);
-	if (!ret)
+	if (mmget_not_zero(mm)) {
+		kthread_use_mm(mm);
+		ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
+		kthread_unuse_mm(mm);
+		mmput(mm);
+		if (!ret)
+			ret = -EFAULT;
+	} else {
 		ret = -EFAULT;
+	}
+	mmdrop(mm);
 
 	/* completing the iocb can drop the ctx and mm, don't touch mm after */
 	iocb->ki_complete(iocb, ret);
@@ -503,6 +509,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
 	 * complete the aio request immediately.
 	 */
 	if (priv->to_free == NULL || unlikely(req->actual == 0)) {
+		mmdrop(priv->mm);
 		kfree(req->buf);
 		kfree(priv->to_free);
 		kfree(priv);
@@ -543,6 +550,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
 	priv->epdata = epdata;
 	priv->actual = 0;
 	priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */
+	mmgrab(priv->mm);
 
 	/* each kiocb is coupled to one usb_request, but we can't
 	 * allocate or submit those if the host disconnected.
@@ -572,6 +580,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
 
 fail:
 	spin_unlock_irq(&epdata->dev->lock);
+	mmdrop(priv->mm);
 	kfree(priv->to_free);
 	kfree(priv);
 	put_ep(epdata);

From edd239bf397ffd25bc0da960d7b5f561e4edf44d Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:22:30 +0800
Subject: [PATCH 0133/1982] pinctrl: sx150x: add missing MODULE_DEVICE_TABLE()

[ Upstream commit 5fe4b12c087db3e565f53b87f1dafdf2f0d1ee0f ]

The driver has a match table for the i2c bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-sx150x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/pinctrl-sx150x.c b/drivers/pinctrl/pinctrl-sx150x.c
index 1d6760ffe809a2..f1647d9114e3b1 100644
--- a/drivers/pinctrl/pinctrl-sx150x.c
+++ b/drivers/pinctrl/pinctrl-sx150x.c
@@ -850,6 +850,7 @@ static const struct i2c_device_id sx150x_id[] = {
 	{"sx1509q", (kernel_ulong_t) &sx1509q_device_data },
 	{}
 };
+MODULE_DEVICE_TABLE(i2c, sx150x_id);
 
 static const struct of_device_id sx150x_of_match[] = {
 	{ .compatible = "semtech,sx1501q", .data = &sx1501q_device_data },

From 7823cf4f9bc93619a207498a791009068aea2639 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:46:09 +0800
Subject: [PATCH 0134/1982] crypto: keembay - add missing MODULE_DEVICE_TABLE()

[ Upstream commit b73b71df4cb4ca241165ad31218c82dfe489147c ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/keembay/keembay-ocs-ecc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-ecc.c b/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
index 59308926399d0b..f31b5ae73f6642 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
@@ -987,6 +987,7 @@ static const struct of_device_id kmb_ocs_ecc_of_match[] = {
 	},
 	{}
 };
+MODULE_DEVICE_TABLE(of, kmb_ocs_ecc_of_match);
 
 /* The OCS driver is a platform device. */
 static struct platform_driver kmb_ocs_ecc_driver = {

From 4a1ce4307f09ee51f285d3080bd51d7001fdd192 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:21:23 +0800
Subject: [PATCH 0135/1982] gpio: vf610: add missing MODULE_DEVICE_TABLE()

[ Upstream commit 975a1d61260cf74d467f34898fade63165c80735 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260704122123.73004-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-vf610.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index aa8586d8a787f0..adfa2c2d5873d2 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -83,6 +83,7 @@ static const struct of_device_id vf610_gpio_dt_ids[] = {
 	{ .compatible = "fsl,imx8ulp-gpio",	.data = &imx8ulp_data, },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, vf610_gpio_dt_ids);
 
 static inline void vf610_gpio_writel(u32 val, void __iomem *reg)
 {

From 8879a96ba07d94c1255dd8ad2cbd4f820bac731a Mon Sep 17 00:00:00 2001
From: Mike Tipton <mike.tipton@oss.qualcomm.com>
Date: Mon, 29 Jun 2026 13:33:36 -0700
Subject: [PATCH 0136/1982] pmdomain: qcom: rpmhpd: Skip retention by default

[ Upstream commit 7178817f190496f2bfdec181fb4aa72832448468 ]

Retention is very rarely an operational corner. In the majority of
cases, HW cannot operate properly at Retention levels and so the minimum
operational level when enabling a rail is the first corner above
Retention. A small subset of always-on use cases can operate at
Retention, but those aren't controlled from HLOS.

Currently, we allow Retention by default and only disallow it special
cases. But this leaves us open to various failures when the PD is
enabled without first being voted to an OPP above Retention. Such as
when a child GDSC PD requests to enable its parent RPMh PD. In this
case, the GDSC would get stuck powering on.

Newer chips have started supporting Retention on rails that didn't
previously (such as for MMCX). Instead of adding more special cases to
skip Retention on MMCX, start skipping Retention by default since it's
almost never desired from an HLOS perspective.

Signed-off-by: Mike Tipton <mike.tipton@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pmdomain/qcom/rpmhpd.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pmdomain/qcom/rpmhpd.c b/drivers/pmdomain/qcom/rpmhpd.c
index 4c3cbf3abc7504..fc61ec45755c35 100644
--- a/drivers/pmdomain/qcom/rpmhpd.c
+++ b/drivers/pmdomain/qcom/rpmhpd.c
@@ -41,7 +41,6 @@
  * @addr:		Resource address as looped up using resource name from
  *			cmd-db
  * @state_synced:	Indicator that sync_state has been invoked for the rpmhpd resource
- * @skip_retention_level: Indicate that retention level should not be used for the power domain
  */
 struct rpmhpd {
 	struct device	*dev;
@@ -58,7 +57,6 @@ struct rpmhpd {
 	const char	*res_name;
 	u32		addr;
 	bool		state_synced;
-	bool            skip_retention_level;
 };
 
 struct rpmhpd_desc {
@@ -176,7 +174,6 @@ static struct rpmhpd mxc = {
 	.pd = { .name = "mxc", },
 	.peer = &mxc_ao,
 	.res_name = "mxc.lvl",
-	.skip_retention_level = true,
 };
 
 static struct rpmhpd mxc_ao = {
@@ -184,7 +181,6 @@ static struct rpmhpd mxc_ao = {
 	.active_only = true,
 	.peer = &mxc,
 	.res_name = "mxc.lvl",
-	.skip_retention_level = true,
 };
 
 static struct rpmhpd nsp = {
@@ -974,7 +970,15 @@ static int rpmhpd_update_level_mapping(struct rpmhpd *rpmhpd)
 		return -EINVAL;
 
 	for (i = 0; i < rpmhpd->level_count; i++) {
-		if (rpmhpd->skip_retention_level && buf[i] == RPMH_REGULATOR_LEVEL_RETENTION)
+		/*
+		 * Most HW won't function properly at Retention. The minimum
+		 * operational level is the first level above Retention. The
+		 * small subset of HW that can operate at Retention isn't
+		 * controlled by HLOS. Skip the Retention level to avoid HW
+		 * failures when the PD is enabled without first having an
+		 * explicit OPP level set.
+		 */
+		if (buf[i] == RPMH_REGULATOR_LEVEL_RETENTION)
 			continue;
 
 		rpmhpd->level[i] = buf[i];

From 3909eaa26344eda5f5b36f57281d4a150c914bd3 Mon Sep 17 00:00:00 2001
From: Sean Rhodes <sean@starlabs.systems>
Date: Mon, 6 Jul 2026 16:40:44 +0100
Subject: [PATCH 0137/1982] mmc: rtsx_usb_sdmmc: suppress false CD after init
 timeout

[ Upstream commit 7185b6d33b170cae54fb562ead44452810b6c231 ]

Some Realtek USB SD readers with a tray keep raw SD_CD asserted
when an empty tray is inserted. The MMC core then repeatedly tries to
initialize non-existent media, sees command timeouts, calls ->get_cd()
again, and starts the same detect cycle over.

Do not qualify media by open-coding MMC commands in ->get_cd().
Instead, let the normal MMC rescan path probe the card. If an
initialization command times out before a card has been attached,
suppress the raw SD_CD signal so the host can settle and the USB
parent can autosuspend.

Clear the suppression only when raw SD_CD drops. On the affected tray
reader, changing media requires removing and reinserting the tray, so
a low CD transition is the signal that a new insertion attempt can be
trusted again.

Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/rtsx_usb_sdmmc.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
index 84674659a84d4a..bf37fab233cf0c 100644
--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
@@ -44,6 +44,7 @@ struct rtsx_usb_sdmmc {
 	bool			double_clk;
 	bool			host_removal;
 	bool			card_exist;
+	bool			suppress_cd;
 	bool			initial_mode;
 	bool			ddr_mode;
 
@@ -774,6 +775,7 @@ static int sdmmc_get_cd(struct mmc_host *mmc)
 	struct rtsx_ucr *ucr = host->ucr;
 	int err;
 	u16 val;
+	bool cd;
 
 	if (host->host_removal)
 		return -ENOMEDIUM;
@@ -791,8 +793,14 @@ static int sdmmc_get_cd(struct mmc_host *mmc)
 
 	/* get OCP status */
 	host->ocp_stat = (val >> 4) & 0x03;
+	cd = val & SD_CD;
 
-	if (val & SD_CD) {
+	if (!cd) {
+		WRITE_ONCE(host->suppress_cd, false);
+		goto no_card;
+	}
+
+	if (!READ_ONCE(host->suppress_cd)) {
 		host->card_exist = true;
 		return 1;
 	}
@@ -874,6 +882,8 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
 		 * detect card when fail to update card existence state and
 		 * speed up card removal when retry
 		 */
+		if (!mmc->card && cmd->error == -ETIMEDOUT)
+			WRITE_ONCE(host->suppress_cd, true);
 		sdmmc_get_cd(mmc);
 		dev_dbg(sdmmc_dev(host), "cmd->error = %d\n", cmd->error);
 	}
@@ -1359,6 +1369,7 @@ static void rtsx_usb_init_host(struct rtsx_usb_sdmmc *host)
 
 	host->power_mode = MMC_POWER_OFF;
 	host->ocp_stat = 0;
+	host->suppress_cd = false;
 }
 
 static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)

From 3b9bfc463b2f1b53b995a70c44fd206d0f246882 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Tue, 16 Jun 2026 14:00:12 +0200
Subject: [PATCH 0138/1982] media: em28xx: dev_info->pr_info since dev has been
 freed

[ Upstream commit c132b07f7e5853c0df35a9b94b8e204cdc6afdef ]

In em28xx_free_device() dev_info passed &dev->intf->dev,
but that device can be freed already.

Just use pr_info instead.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-cards.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index b8e207443770e8..af2c06a05084d9 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3556,7 +3556,7 @@ void em28xx_free_device(struct kref *ref)
 {
 	struct em28xx *dev = kref_to_dev(ref);
 
-	dev_info(&dev->intf->dev, "Freeing device\n");
+	pr_info("%s: Freeing device\n", dev->name);
 
 	if (!dev->disconnected)
 		em28xx_release_resources(dev);

From fbc2053fc89c5dd2713c9854585651bf49813c68 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Tue, 16 Jun 2026 14:42:16 +0200
Subject: [PATCH 0139/1982] media: em28xx: requeue buffers if start_streaming
 fails

[ Upstream commit 67f87b104f4ef3108607ac9d8fa2075b13ed314d ]

If start_streaming fails, then all queued buffers must be
returned to vb2 in state QUEUED.

Otherwise it will trigger a WARN_ON.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-video.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index c8514682bccda9..e0a69309687b0e 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -1070,6 +1070,9 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
 {
 	struct em28xx *dev = vb2_get_drv_priv(vq);
 	struct em28xx_v4l2 *v4l2 = dev->v4l2;
+	struct em28xx_dmaqueue *dmaq = vq->type == V4L2_BUF_TYPE_VBI_CAPTURE ?
+		&dev->vbiq : &dev->vidq;
+	unsigned long flags = 0;
 	struct v4l2_frequency f;
 	struct v4l2_fh *owner;
 	int rc = 0;
@@ -1084,7 +1087,7 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
 	 */
 	rc = res_get(dev, vq->type);
 	if (rc)
-		return rc;
+		goto exit;
 
 	if (v4l2->streaming_users == 0) {
 		/* First active streaming user, so allocate all the URBs */
@@ -1107,7 +1110,7 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
 					  em28xx_urb_data_copy);
 		if (rc < 0) {
 			res_free(dev, vq->type);
-			return rc;
+			goto exit;
 		}
 
 		/*
@@ -1132,7 +1135,18 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
 	}
 
 	v4l2->streaming_users++;
+	return 0;
 
+exit:
+	spin_lock_irqsave(&dev->slock, flags);
+	while (!list_empty(&dmaq->active)) {
+		struct em28xx_buffer *buf;
+
+		buf = list_entry(dmaq->active.next, struct em28xx_buffer, list);
+		list_del(&buf->list);
+		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_QUEUED);
+	}
+	spin_unlock_irqrestore(&dev->slock, flags);
 	return rc;
 }
 

From aeb724dae9a792b2a24c0a6a845ee06be2cc45f2 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Tue, 19 May 2026 13:33:38 +0200
Subject: [PATCH 0140/1982] media: em28xx: use vb2_video_unregister_device

[ Upstream commit 7c8bf63b79371f5b57da1bd1401bd420180ac6e6 ]

Use vb2_video_unregister_device instead of video_unregister_device
to ensure any streaming is correctly stopped at unregister time.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-video.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index e0a69309687b0e..e2907b56220b74 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2243,17 +2243,17 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
 	if (video_is_registered(&v4l2->radio_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		video_unregister_device(&v4l2->radio_dev);
+		vb2_video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->vbi_dev));
-		video_unregister_device(&v4l2->vbi_dev);
+		vb2_video_unregister_device(&v4l2->vbi_dev);
 	}
 	if (video_is_registered(&v4l2->vdev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->vdev));
-		video_unregister_device(&v4l2->vdev);
+		vb2_video_unregister_device(&v4l2->vdev);
 	}
 
 	v4l2_ctrl_handler_free(&v4l2->ctrl_handler);
@@ -2901,19 +2901,19 @@ static int em28xx_v4l2_init(struct em28xx *dev)
 		dev_info(&dev->intf->dev,
 			 "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		video_unregister_device(&v4l2->radio_dev);
+		vb2_video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev,
 			 "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->vbi_dev));
-		video_unregister_device(&v4l2->vbi_dev);
+		vb2_video_unregister_device(&v4l2->vbi_dev);
 	}
 	if (video_is_registered(&v4l2->vdev)) {
 		dev_info(&dev->intf->dev,
 			 "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->vdev));
-		video_unregister_device(&v4l2->vdev);
+		vb2_video_unregister_device(&v4l2->vdev);
 	}
 
 	v4l2_ctrl_handler_free(&v4l2->ctrl_handler);

From d6c7e4fa4fcc90a4c8c7e62e1673bb3d02c4a2b0 Mon Sep 17 00:00:00 2001
From: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Date: Mon, 13 Jul 2026 13:23:16 -0700
Subject: [PATCH 0141/1982] drm/xe: only resume exec queues that were actually
 suspended

[ Upstream commit 65f40fa5022bcdb90d3a39e4948adf2aa16732a3 ]

A consumer-issued suspend() can fail (e.g. the queue is killed, banned
or wedged), leaving the queue un-suspended. The consumer must then not
issue the matching resume(): resuming a queue that was never suspended
is incorrect.

Add an lr.suspended flag to struct xe_exec_queue that records whether a
consumer suspend() succeeded and a matching resume() is still owed. Set
it on a successful suspend() in the preempt-fence path, clear it on
resume(), and only resume queues that have it set.

In resume_and_reinstall_preempt_fences() also skip queues that have
since been reset/killed/banned/wedged: such a queue's suspend may not
have completed (suspend_pending can still be set, e.g. a preempt fence
signalled with -ENOENT without waiting), so resuming it would trip the
!suspend_pending assert in the backend. Leave it marked suspended and
let teardown resolve its state.

A queue is only ever suspended by a single consumer at a time
(preempt-fence mode and hw engine group fault mode are mutually
exclusive), so a single flag is sufficient.

Assisted-by: Github-Copilot:Claude-opus-4.8
Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260713202317.2187787-9-niranjana.vishwanathapura@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/xe/xe_exec_queue_types.h | 12 ++++++++++++
 drivers/gpu/drm/xe/xe_preempt_fence.c    |  7 +++++++
 drivers/gpu/drm/xe/xe_vm.c               | 18 +++++++++++++++++-
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h
index 38906cb7608ca4..c5024acf4aaf0b 100644
--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h
+++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h
@@ -139,6 +139,18 @@ struct xe_exec_queue {
 		u32 seqno;
 		/** @lr.link: link into VM's list of exec queues */
 		struct list_head link;
+		/**
+		 * @lr.suspended: Tracks whether the consumer-issued suspend()
+		 * succeeded and a matching resume() is still owed. suspend() can
+		 * fail (e.g. killed/banned/wedged), leaving the queue
+		 * un-suspended, so consumers must only resume() queues that were
+		 * actually suspended. Set by the suspend caller on success and
+		 * cleared by the resume caller. A queue is only ever suspended by
+		 * a single consumer at a time (preempt-fence mode and hw engine
+		 * group fault mode are mutually exclusive), so a single flag is
+		 * sufficient.
+		 */
+		bool suspended;
 	} lr;
 
 #define XE_EXEC_QUEUE_TLB_INVAL_PRIMARY_GT	0
diff --git a/drivers/gpu/drm/xe/xe_preempt_fence.c b/drivers/gpu/drm/xe/xe_preempt_fence.c
index 83fbeea5aa201a..014a5980febd0d 100644
--- a/drivers/gpu/drm/xe/xe_preempt_fence.c
+++ b/drivers/gpu/drm/xe/xe_preempt_fence.c
@@ -63,6 +63,13 @@ static bool preempt_fence_enable_signaling(struct dma_fence *fence)
 	struct xe_exec_queue *q = pfence->q;
 
 	pfence->error = q->ops->suspend(q);
+	/*
+	 * Record a successful suspend so the rebind worker only resumes queues
+	 * that were actually suspended; a failed suspend() leaves the queue
+	 * un-suspended and must not be paired with a resume().
+	 */
+	if (!pfence->error)
+		WRITE_ONCE(q->lr.suspended, true);
 	queue_work(q->vm->xe->preempt_fence_wq, &pfence->preempt_work);
 	return true;
 }
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 72ec3f1533d054..94a62b4256b421 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -195,7 +195,23 @@ static void resume_and_reinstall_preempt_fences(struct xe_vm *vm,
 	xe_vm_assert_held(vm);
 
 	list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) {
-		q->ops->resume(q);
+		/*
+		 * Only resume queues whose suspend() actually succeeded. A
+		 * failed suspend() (e.g. killed/banned/wedged) leaves the queue
+		 * un-suspended, so it must not be resumed.
+		 *
+		 * Also skip queues that have since been reset/killed/banned/
+		 * wedged: their suspend may not have completed (suspend_pending
+		 * can still be set, e.g. a preempt fence signalled with -ENOENT
+		 * without waiting), so resuming would trip the !suspend_pending
+		 * assert in the backend. Such queues are being torn down anyway,
+		 * so leave them marked suspended and let teardown resolve their
+		 * state.
+		 */
+		if (READ_ONCE(q->lr.suspended) && !q->ops->reset_status(q)) {
+			WRITE_ONCE(q->lr.suspended, false);
+			q->ops->resume(q);
+		}
 
 		drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, q->lr.pfence,
 					 DMA_RESV_USAGE_BOOKKEEP, DMA_RESV_USAGE_BOOKKEEP);

From 45d4470612293dbd10b34b410650eb83a780d244 Mon Sep 17 00:00:00 2001
From: Bard Liao <yung-chuan.liao@linux.intel.com>
Date: Fri, 3 Jul 2026 09:16:56 +0800
Subject: [PATCH 0142/1982] soundwire: dmi-quirks: add a global ghost list

[ Upstream commit b7a5d101d7d267922e828c40135bcaccf8cfb3bf ]

Not like other ghost devices, the 0x000000D010010500 ADR doesn't belong
to any codec. We should disable it in all devices.

Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260703011656.2572959-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/dmi-quirks.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index 2a98fc8c104d60..62cee6e2179daf 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -15,6 +15,14 @@ struct adr_remap {
 	u64 remapped_adr;
 };
 
+static const struct adr_remap global_ghost_adr[] = {
+	{
+		0x000000D010010500ull,
+		0x0000000000000000ull
+	},
+	{}
+};
+
 /*
  * Some TigerLake devices based on an initial Intel BIOS do not expose
  * the correct _ADR in the DSDT.
@@ -212,6 +220,7 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
 u64 sdw_dmi_override_adr(struct sdw_bus *bus, u64 addr)
 {
 	const struct dmi_system_id *dmi_id;
+	int i;
 
 	/* check if any address remap quirk applies */
 	dmi_id = dmi_first_match(adr_remap_quirk_table);
@@ -223,10 +232,20 @@ u64 sdw_dmi_override_adr(struct sdw_bus *bus, u64 addr)
 				dev_dbg(bus->dev, "remapped _ADR 0x%llx as 0x%llx\n",
 					addr, map->remapped_adr);
 				addr = map->remapped_adr;
-				break;
+				goto out;
 			}
 		}
 	}
 
+	/* remap the ghost ADRs */
+	for (i = 0; i < ARRAY_SIZE(global_ghost_adr); i++) {
+		if (global_ghost_adr[i].adr == addr) {
+			dev_dbg(bus->dev, "remapped _ADR 0x%llx as 0x%llx\n",
+				addr, global_ghost_adr[i].remapped_adr);
+			addr = global_ghost_adr[i].remapped_adr;
+			break;
+		}
+	}
+out:
 	return addr;
 }

From 2fcd643f0e3ab09112f629c6a35a49b30cd0c434 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Wed, 8 Jul 2026 13:29:48 +0100
Subject: [PATCH 0143/1982] soundwire: intel_auxdevice: Add cs42l44 to
 wake_capable_list

[ Upstream commit d08e4d9197396ceb906715d976b63aed0c5cc8e5 ]

Add cs42l44 to the wake_capable_list because it can generate
jack events whilst the bus is stopped.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260708122948.1502227-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/intel_auxdevice.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c
index c0c8ffcecc6bfc..347e06ad6edba7 100644
--- a/drivers/soundwire/intel_auxdevice.c
+++ b/drivers/soundwire/intel_auxdevice.c
@@ -54,6 +54,7 @@ static struct wake_capable_part wake_capable_list[] = {
 	{0x01fa, 0x2A30},
 	{0x01fa, 0x2A3B},
 	{0x01fa, 0x4243},
+	{0x01fa, 0x4244},
 	{0x01fa, 0x4245},
 	{0x025d, 0x5682},
 	{0x025d, 0x700},

From b2fd3bc65516edd60db9b34ae6eb161bbee09c33 Mon Sep 17 00:00:00 2001
From: David Maximiliano Hermitte <davemadmaxxx@gmail.com>
Date: Wed, 8 Jul 2026 21:56:36 +0000
Subject: [PATCH 0144/1982] hfs: validate catalog CNIDs before instantiating
 inodes

[ Upstream commit 53c3c138d672765c26884c55728307a65c634328 ]

hfs_cat_find_brec() first resolves a catalog thread record by CNID and
then looks up the corresponding catalog record by parent/name. On a
corrupted filesystem image, the second lookup may find a record whose
CNID does not match the CNID that was requested.

Validate the record found by the second lookup before returning it.
Read the already-found record with hfs_bnode_read(), require the exact
fixed size for file and directory records, reject other record types,
and verify that the stored CNID matches the requested CNID.

Also validate reserved CNIDs in hfs_read_inode() before populating the
inode, propagate hfs_read_inode() failures from the resource-fork lookup
path, and reject bad resource-fork and root inodes.

Keep hfs_write_inode() unchanged, so corrupted catalog records are
rejected before reaching its existing reserved-CNID BUG() path.

Reported-by: syzbot+97e301b4b82ae803d21b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=97e301b4b82ae803d21b
Cc: George Anthony Vernon <contact@gvernon.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David Maximiliano Hermitte <davemadmaxxx@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260708215636.73815-1-davemadmaxxx@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/hfs/catalog.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 fs/hfs/hfs_fs.h  | 19 +++++++++++++++++++
 fs/hfs/inode.c   | 13 ++++++++++++-
 fs/hfs/super.c   |  5 +++++
 4 files changed, 76 insertions(+), 2 deletions(-)

diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
index ccdbbffaaf7c10..f3fd84cffed5fa 100644
--- a/fs/hfs/catalog.c
+++ b/fs/hfs/catalog.c
@@ -182,6 +182,40 @@ int hfs_cat_keycmp(const btree_key *key1, const btree_key *key2)
 			  key2->cat.CName.name, key2->cat.CName.len);
 }
 
+static int hfs_cat_validate_found_cnid(struct hfs_find_data *fd, u32 cnid)
+{
+	hfs_cat_rec rec;
+	u32 found_cnid;
+	int rec_len;
+
+	rec_len = fd->entrylength;
+	if (rec_len <= 0 || (size_t)rec_len > sizeof(rec))
+		return -EIO;
+
+	memset(&rec, 0, sizeof(rec));
+	hfs_bnode_read(fd->bnode, &rec, fd->entryoffset, rec_len);
+
+	switch (rec.type) {
+	case HFS_CDR_FIL:
+		if ((size_t)rec_len != sizeof(struct hfs_cat_file))
+			return -EIO;
+		found_cnid = be32_to_cpu(rec.file.FlNum);
+		break;
+	case HFS_CDR_DIR:
+		if ((size_t)rec_len != sizeof(struct hfs_cat_dir))
+			return -EIO;
+		found_cnid = be32_to_cpu(rec.dir.DirID);
+		break;
+	default:
+		return -EIO;
+	}
+
+	if (found_cnid != cnid)
+		return -EIO;
+
+	return 0;
+}
+
 /* Try to get a catalog entry for given catalog id */
 // move to read_super???
 int hfs_cat_find_brec(struct super_block *sb, u32 cnid,
@@ -208,7 +242,12 @@ int hfs_cat_find_brec(struct super_block *sb, u32 cnid,
 		return -EIO;
 	}
 	memcpy(fd->search_key->cat.CName.name, rec.thread.CName.name, len);
-	return hfs_brec_find(fd);
+
+	res = hfs_brec_find(fd);
+	if (res)
+		return res;
+
+	return hfs_cat_validate_found_cnid(fd, cnid);
 }
 
 static inline
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index 86b5ae62247be8..724b28bb8c6c4d 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -156,6 +156,25 @@ extern int hfs_cat_move(u32 cnid, struct inode *src_dir,
 extern void hfs_cat_build_key(struct super_block *sb, btree_key *key,
 			      u32 parent, const struct qstr *name);
 
+/*
+ * Validate the CNID of a catalog record.
+ */
+static inline bool hfs_is_valid_cnid(u32 cnid, u8 type)
+{
+	if (likely(cnid >= HFS_FIRSTUSER_CNID))
+		return true;
+
+	switch (cnid) {
+	case HFS_ROOT_CNID:
+		return type == HFS_CDR_DIR;
+	case HFS_EXT_CNID:
+	case HFS_CAT_CNID:
+		return type == HFS_CDR_FIL;
+	default:
+		return false;
+	}
+}
+
 /* dir.c */
 extern const struct file_operations hfs_dir_operations;
 extern const struct inode_operations hfs_dir_inode_operations;
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index f1796e4b07e832..e815e9a8ac6f25 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -365,6 +365,9 @@ static int hfs_read_inode(struct inode *inode, void *data)
 	rec = idata->rec;
 	switch (rec->type) {
 	case HFS_CDR_FIL:
+		if (!hfs_is_valid_cnid(be32_to_cpu(rec->file.FlNum), rec->type))
+			return -EIO;
+
 		if (!HFS_IS_RSRC(inode)) {
 			hfs_inode_read_fork(inode, rec->file.ExtRec, rec->file.LgLen,
 					    rec->file.PyLen, be16_to_cpu(rec->file.ClpSize));
@@ -386,6 +389,9 @@ static int hfs_read_inode(struct inode *inode, void *data)
 		inode->i_mapping->a_ops = &hfs_aops;
 		break;
 	case HFS_CDR_DIR:
+		if (!hfs_is_valid_cnid(be32_to_cpu(rec->dir.DirID), rec->type))
+			return -EIO;
+
 		inode->i_ino = be32_to_cpu(rec->dir.DirID);
 		inode->i_size = be16_to_cpu(rec->dir.Val) + 2;
 		HFS_I(inode)->fs_blocks = 0;
@@ -565,13 +571,18 @@ static struct dentry *hfs_file_lookup(struct inode *dir, struct dentry *dentry,
 	res = hfs_brec_read(&fd, &rec, sizeof(rec));
 	if (!res) {
 		struct hfs_iget_data idata = { NULL, &rec };
-		hfs_read_inode(inode, &idata);
+		res = hfs_read_inode(inode, &idata);
 	}
 	hfs_find_exit(&fd);
 	if (res) {
 		iput(inode);
 		return ERR_PTR(res);
 	}
+
+	if (is_bad_inode(inode)) {
+		iput(inode);
+		return ERR_PTR(-EIO);
+	}
 	HFS_I(inode)->rsrc_inode = dir;
 	HFS_I(dir)->rsrc_inode = inode;
 	igrab(dir);
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 97546d6b41f477..933aa044808992 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -372,6 +372,11 @@ static int hfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	if (!root_inode)
 		goto bail_no_root;
 
+	if (is_bad_inode(root_inode)) {
+		iput(root_inode);
+		goto bail_no_root;
+	}
+
 	set_default_d_op(sb, &hfs_dentry_operations);
 	res = -ENOMEM;
 	sb->s_root = d_make_root(root_inode);

From 155ae5908007b63af52ad133691b2a75858ca98f Mon Sep 17 00:00:00 2001
From: Hari Mishal <harimishal1@gmail.com>
Date: Thu, 9 Jul 2026 14:30:32 +0200
Subject: [PATCH 0145/1982] nvme: bound ns descriptor header and body to
 identify buffer

[ Upstream commit 3c568b35a0d309acb40746552bec2af24cd550ef ]

nvme_identify_ns_descs() allocates a buffer and gives it to the
controller, which populates it and then iterates the buffer with
variable byte increments that vary by type and body size.  But, there is
no bounds check inside the iteration itself except the loop bound
itself.  Fix this by checking and stopping iteration if the next header
or its declared body would go past the buffer itself.

Assisted-by: gkh_clanker_t1000
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5fb6612fa229f..5ed62e070f715f 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1564,8 +1564,12 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl,
 	for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) {
 		struct nvme_ns_id_desc *cur = data + pos;
 
+		if (pos + sizeof(*cur) > NVME_IDENTIFY_DATA_SIZE)
+			break;
 		if (cur->nidl == 0)
 			break;
+		if (pos + sizeof(*cur) + cur->nidl > NVME_IDENTIFY_DATA_SIZE)
+			break;
 
 		len = nvme_process_ns_desc(ctrl, &info->ids, cur, &csi_seen);
 		if (len < 0)

From c9513f41be7e92cf159562b85a08b3abfc733b61 Mon Sep 17 00:00:00 2001
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Date: Wed, 1 Apr 2026 11:05:55 +0800
Subject: [PATCH 0146/1982] iwlwifi: dvm: add missing cleaup for on error path

[ Upstream commit 94280e6e0c69a5327e377803732f494d8b5a74cd ]

In iwlagn_tx_agg_start(), call iwlagn_dealloc_agg_txq()
to clear bit on error path.

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Link: https://patch.msgid.link/20260401030555.541685-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
index a7806776a51eb3..1a0167f67c7bdb 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
@@ -604,8 +604,10 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
 	}
 
 	ret = iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
-	if (ret)
+	if (ret) {
+		iwlagn_dealloc_agg_txq(priv, txq_id);
 		return ret;
+	}
 
 	spin_lock_bh(&priv->sta_lock);
 	tid_data = &priv->tid_data[sta_id][tid];

From 25e807780416a425d34c19112fa0b18b2776ade5 Mon Sep 17 00:00:00 2001
From: Hari Mishal <harimishal1@gmail.com>
Date: Thu, 9 Jul 2026 14:30:33 +0200
Subject: [PATCH 0147/1982] nvme: clamp FDP nruhsd to allocated RUH status
 descriptor count

[ Upstream commit 29261f8bb41662f2a660c479e5cf592942b53f78 ]

nvme_query_fdp_info() allocates the RUH status buffer for at most S8_MAX
- 1 descriptors, and then copies ruhs->ruhsd[] into head->plids[] using
the controller reported ruhs->nruhsd directly as the loop bound.
However, that count wasn't taken into account for the actual buffer's
size, so there was a chance for a controller reporting a larger nruhsd
to cause the copy to overflow the buffer.  Clamp nr_plids to the same
bound used for the allocation.

Assisted-by: gkh_clanker_t1000
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 5ed62e070f715f..ad725e346c94e4 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2313,7 +2313,7 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 		goto free;
 	}
 
-	head->nr_plids = le16_to_cpu(ruhs->nruhsd);
+	head->nr_plids = min(le16_to_cpu(ruhs->nruhsd), S8_MAX - 1);
 	if (!head->nr_plids)
 		goto free;
 

From 57a0b2edcd5fa0b12acbceae261cde3064528e75 Mon Sep 17 00:00:00 2001
From: Jurison Murati <eng.juri@gmail.com>
Date: Wed, 10 Jun 2026 12:22:36 +0200
Subject: [PATCH 0148/1982] media: i2c: ov8865: Drop the runtime PM usage count
 on stream failure

[ Upstream commit 3fe797a12bfa9a49aa998ee722e5f25c957b9b15 ]

ov8865_s_stream() takes a runtime PM reference when enabling the
stream, but returns without releasing it if ov8865_sw_standby()
fails, leaving the reference unbalanced and the sensor powered
indefinitely. The same applies to a failure while disabling the
stream, in which case the reference acquired at stream start is
never dropped.

Drop the reference in a single place, both when disabling the
stream and on failure, and only update the streaming state on
success.

Signed-off-by: Jurison Murati <eng.juri@gmail.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov8865.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/media/i2c/ov8865.c b/drivers/media/i2c/ov8865.c
index a8586df14f7774..5b909a85612876 100644
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2621,15 +2621,13 @@ static int ov8865_s_stream(struct v4l2_subdev *subdev, int enable)
 	ret = ov8865_sw_standby(sensor, !enable);
 	mutex_unlock(&sensor->mutex);
 
-	if (ret)
-		return ret;
-
-	state->streaming = !!enable;
-
-	if (!enable)
+	if (ret || !enable)
 		pm_runtime_put(sensor->dev);
 
-	return 0;
+	if (!ret)
+		state->streaming = enable;
+
+	return ret;
 }
 
 static const struct v4l2_subdev_video_ops ov8865_subdev_video_ops = {

From 80d182edba4fb5b6d78e424be85711e6c8fb1bdc Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Mon, 11 May 2026 10:51:47 +0200
Subject: [PATCH 0149/1982] drm/etnaviv: check all modules for idle after reset

[ Upstream commit 1006d1f7c03d92b28c252333836635df8e165401 ]

While the FE is an important part of the GPU, which needs to be idle
after reset, all other modules should be idle after a proper reset.
Check all present modules for being idle to determine whether the
reset was successful.

Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
Link: https://patch.msgid.link/20260511085148.652256-1-l.stach@pengutronix.de
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index cf0d9049bcf1e3..368e799fc0c5d9 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -582,9 +582,9 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 		/* read idle register. */
 		idle = gpu_read(gpu, VIVS_HI_IDLE_STATE);
 
-		/* try resetting again if FE is not idle */
-		if ((idle & VIVS_HI_IDLE_STATE_FE) == 0) {
-			dev_dbg(gpu->dev, "FE is not idle\n");
+		/* try resetting again if any module is not idle */
+		if ((idle & gpu->idle_mask) != gpu->idle_mask) {
+			dev_dbg(gpu->dev, "GPU modules not idle\n");
 			continue;
 		}
 

From 2e7b5b3b6688b9ebc8004bb065054132d1ea3538 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Mon, 11 May 2026 10:51:48 +0200
Subject: [PATCH 0150/1982] drm/etnaviv: check MMUv2 status after reset

[ Upstream commit 4720915ab48282429f9e22ad5984b7870e4e962c ]

A full GPU reset is the only way to disable the MMUv2 and the
driver depends on the MMU being disabled after a reset to be able
to properly restart the GPU. Validate this assumption by checking
that the reset actually did disable the MMU.

Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
Link: https://patch.msgid.link/20260511085148.652256-2-l.stach@pengutronix.de
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 368e799fc0c5d9..daba33052f5240 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -598,6 +598,23 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 			continue;
 		}
 
+		/* try resetting again if MMUv2 is not disabled */
+		if (gpu->identity.minor_features1 & chipMinorFeatures1_MMU_VERSION) {
+			if (gpu->sec_mode == ETNA_SEC_KERNEL) {
+				if (gpu_read(gpu, VIVS_MMUv2_SEC_CONTROL) &
+				    VIVS_MMUv2_SEC_CONTROL_ENABLE) {
+					dev_dbg(gpu->dev, "MMU is not disabled\n");
+					continue;
+				}
+			} else {
+				if (gpu_read(gpu, VIVS_MMUv2_CONTROL) &
+				    VIVS_MMUv2_CONTROL_ENABLE) {
+					dev_dbg(gpu->dev, "MMU is not disabled\n");
+					continue;
+				}
+			}
+		}
+
 		/* enable debug register access */
 		control &= ~VIVS_HI_CLOCK_CONTROL_DISABLE_DEBUG_REGISTERS;
 		gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, control);

From 39ef93ceb83bab404324ef756826ca0f55060ddc Mon Sep 17 00:00:00 2001
From: Jurison Murati <eng.juri@gmail.com>
Date: Wed, 10 Jun 2026 12:22:37 +0200
Subject: [PATCH 0151/1982] media: i2c: ov8865: Program the sensor on stream
 start

[ Upstream commit 4e1446ac169a1a621ba90502ab8db3be821fe726 ]

The sensor registers are only written in the runtime PM resume
handler; ov8865_set_fmt() merely stores the requested mode, relying on
the sensor being runtime suspended between uses so that the next
resume applies it.

That assumption breaks when something keeps the sensor powered. On
IPU3 platforms, ipu_bridge instantiates the VCM device with a
DL_FLAG_PM_RUNTIME device link to the sensor, so a userspace process
holding the VCM subdev open (e.g. wireplumber's camera monitor) pins
the sensor runtime-active. A subsequent set_fmt() then never reaches
the hardware: the sensor keeps streaming the mode programmed on the
last resume while the CSI-2 receiver expects the newly negotiated
format.

On a Surface Book 2 (IPU3, ov8865 + dw9719 VCM), requesting the
3264x2448 mode while the hardware was left programmed for the
1632x1224 binned mode makes ipu3-cio2 report "frame sync error" and
"payload length is 10340352, received 2585088" (exactly one binned
frame) for every frame, and the inverse case stalls the stream after
a single frame. Camera applications end up displaying one bogus frame
forever.

Program the sensor configuration and apply the control values on
stream start instead, where the negotiated mode is always current,
and only write the configuration in the runtime PM resume handler
when resuming with the stream already started.

Signed-off-by: Jurison Murati <eng.juri@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov8865.c | 34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/drivers/media/i2c/ov8865.c b/drivers/media/i2c/ov8865.c
index 5b909a85612876..c6d53c3d55caa3 100644
--- a/drivers/media/i2c/ov8865.c
+++ b/drivers/media/i2c/ov8865.c
@@ -2609,7 +2609,7 @@ static int ov8865_s_stream(struct v4l2_subdev *subdev, int enable)
 {
 	struct ov8865_sensor *sensor = ov8865_subdev_sensor(subdev);
 	struct ov8865_state *state = &sensor->state;
-	int ret;
+	int ret = 0;
 
 	if (enable) {
 		ret = pm_runtime_resume_and_get(sensor->dev);
@@ -2618,7 +2618,23 @@ static int ov8865_s_stream(struct v4l2_subdev *subdev, int enable)
 	}
 
 	mutex_lock(&sensor->mutex);
-	ret = ov8865_sw_standby(sensor, !enable);
+
+	/*
+	 * The sensor may have been kept powered by something else (e.g. the
+	 * VCM's runtime PM device link on IPU3 platforms), in which case
+	 * runtime resume did not run and the hardware may still be
+	 * configured for a previous mode. Always program the negotiated
+	 * configuration on stream start.
+	 */
+	if (enable) {
+		ret = ov8865_sensor_init(sensor);
+		if (!ret)
+			ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+	}
+
+	if (!ret)
+		ret = ov8865_sw_standby(sensor, !enable);
+
 	mutex_unlock(&sensor->mutex);
 
 	if (ret || !enable)
@@ -2914,15 +2930,15 @@ static int ov8865_resume(struct device *dev)
 	if (ret)
 		goto complete;
 
-	ret = ov8865_sensor_init(sensor);
-	if (ret)
-		goto error_power;
+	if (state->streaming) {
+		ret = ov8865_sensor_init(sensor);
+		if (ret)
+			goto error_power;
 
-	ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
-	if (ret)
-		goto error_power;
+		ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+		if (ret)
+			goto error_power;
 
-	if (state->streaming) {
 		ret = ov8865_sw_standby(sensor, false);
 		if (ret)
 			goto error_power;

From 2579f03aad9375ab5503114cd1db8a7e11ca31b5 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 30 Jun 2026 15:19:33 +0800
Subject: [PATCH 0152/1982] media: ivtv: stop VBI start-code scan before short
 tail

[ Upstream commit f373cf17fb8e7a530bc6e1e36fc41cb5dab2cdaa ]

compress_sliced_buf() scans one byte at a time while testing a four-byte
VBI start code.  The final iterations can read beyond the remaining
buffer tail.

Stop the scan once fewer than four bytes remain.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ivtv/ivtv-vbi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/ivtv/ivtv-vbi.c b/drivers/media/pci/ivtv/ivtv-vbi.c
index ae7a00f462574b..af086c4cbe1a71 100644
--- a/drivers/media/pci/ivtv/ivtv-vbi.c
+++ b/drivers/media/pci/ivtv/ivtv-vbi.c
@@ -330,7 +330,7 @@ static u32 compress_sliced_buf(struct ivtv *itv, u32 line, u8 *buf, u32 size, u8
 	unsigned lines = 0;
 
 	/* find the first valid line */
-	for (i = 0; i < size; i++, buf++) {
+	for (i = 0; i + 3 < size; i++, buf++) {
 		if (buf[0] == 0xff && !buf[1] && !buf[2] && buf[3] == sav)
 			break;
 	}

From 1f000ae86851d0fe5bf6a84bb85b713e9a384756 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 30 Jun 2026 14:56:36 +0800
Subject: [PATCH 0153/1982] media: cx18: stop VBI start-code scan before short
 tail

[ Upstream commit bf533acaaa7dee21d49bcaabf8e813ea36bddcd8 ]

compress_sliced_buf() scans one byte at a time while testing a four-byte
VBI start code.  The final iterations can read beyond the remaining
buffer tail.

Stop the scan once fewer than four bytes remain.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx18/cx18-vbi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx18/cx18-vbi.c b/drivers/media/pci/cx18/cx18-vbi.c
index 8dc4ce3259353a..3a8430f3259eb3 100644
--- a/drivers/media/pci/cx18/cx18-vbi.c
+++ b/drivers/media/pci/cx18/cx18-vbi.c
@@ -135,7 +135,7 @@ static u32 compress_sliced_buf(struct cx18 *cx, u8 *buf, u32 size,
 				    : VBI_HBLANK_SAMPLES_50HZ;
 
 	/* find the first valid line */
-	for (i = hdr_size, buf += hdr_size; i < size; i++, buf++) {
+	for (i = hdr_size, buf += hdr_size; i + 3 < size; i++, buf++) {
 		if (buf[0] == 0xff && !buf[1] && !buf[2] &&
 		    (buf[3] == sliced_vbi_eav_rp[0] ||
 		     buf[3] == sliced_vbi_eav_rp[1]))

From 660cb7f6dafb20d008a7e1165c3fab21a19388b9 Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Tue, 30 Jun 2026 12:52:57 +0200
Subject: [PATCH 0154/1982] media: go7007: avoid undefined shifts in MPEG-4
 headers

[ Upstream commit 41f82777e547732460290ceb28fcc7c1b95ef192 ]

The byte-alignment paths can call CODE_ADD() with a zero bit
length.  The macro then shifts an int by name.b, which can be 32
after the preceding bit was flushed.

vti_bitlen() can likewise shift a signed int into its sign bit while
searching for the bit length, and the package mask construction can
shift by the full type width.

Make zero-length additions a no-op, derive the bit length with fls(),
and build the mask with GENMASK().

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-fw.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/media/usb/go7007/go7007-fw.c b/drivers/media/usb/go7007/go7007-fw.c
index 86ce593e0c5465..8cf959c20e30ce 100644
--- a/drivers/media/usb/go7007/go7007-fw.c
+++ b/drivers/media/usb/go7007/go7007-fw.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/bitops.h>
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/device.h>
@@ -58,14 +59,16 @@ struct code_gen {
 #define CODE_GEN(name, dest) struct code_gen name = { dest, 0, 32, 0 }
 
 #define CODE_ADD(name, val, length) do { \
-	name.b -= (length); \
-	name.a |= (val) << name.b; \
-	while (name.b <= 24) { \
-		*name.p = name.a >> 24; \
-		++name.p; \
-		name.a <<= 8; \
-		name.b += 8; \
-		name.len += 8; \
+	if (length) { \
+		name.b -= (length); \
+		name.a |= (val) << name.b; \
+		while (name.b <= 24) { \
+			*name.p = name.a >> 24; \
+			++name.p; \
+			name.a <<= 8; \
+			name.b += 8; \
+			name.len += 8; \
+		} \
 	} \
 } while (0)
 
@@ -707,11 +710,10 @@ static int gen_mpeg1hdr_to_package(struct go7007 *go,
 
 static int vti_bitlen(struct go7007 *go)
 {
-	unsigned int i, max_time_incr = go->sensor_framerate / go->fps_scale;
+	unsigned int max_time_incr = go->sensor_framerate / go->fps_scale;
+	int bitlen = fls(max_time_incr);
 
-	for (i = 31; (max_time_incr & ((1 << i) - 1)) == max_time_incr; --i)
-		;
-	return i + 1;
+	return bitlen ?: 1;
 }
 
 static int mpeg4_frame_header(struct go7007 *go, unsigned char *buf,
@@ -1209,7 +1211,7 @@ static int seqhead_to_package(struct go7007 *go, __le16 *code, int space,
 		0xbf08,		fps,
 		0xbf09,		0,
 		0xbff2,		vop_time_increment_bitlength,
-		0xbff3,		(1 << vop_time_increment_bitlength) - 1,
+		0xbff3,		GENMASK(vop_time_increment_bitlength - 1, 0),
 		0xbfe6,		0,
 		0xbfe7,		(fps / 1000) << 8,
 		0,		0,

From d9754d77182fd09995c30ec8305f88f386d5a179 Mon Sep 17 00:00:00 2001
From: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Date: Tue, 23 Jun 2026 02:05:35 -0700
Subject: [PATCH 0155/1982] remoteproc: qcom: Check subdev start status in
 rproc_stop()

[ Upstream commit f44ae8ce156a387b07d40e2d6a0ef979a2748aa1 ]

For rproc that doing attach, rproc_start_subdevices() is called only when
attach successfully. If rproc_report_crash() is called in the attach
function, rproc_boot_recovery()->rproc_stop()->rproc_stop_subdevices()->
glink_subdev_stop() could be called and cause NULL pointer dereference:

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300
 Mem abort info:
 ...
 pc : qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem]
 lr : glink_subdev_stop+0x1c/0x30 [qcom_common]
 ...
 Call trace:
  qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] (P)
  glink_subdev_stop+0x1c/0x30 [qcom_common]
  rproc_stop+0x58/0x17c
  rproc_trigger_recovery+0xb0/0x150
  rproc_crash_handler_work+0xa4/0xc4
  process_scheduled_works+0x18c/0x2d8
  worker_thread+0x144/0x280
  kthread+0x124/0x138
  ret_from_fork+0x10/0x20
 Code: a9be7bfd 910003fd a90153f3 aa0003f3 (b9430000)
 ---[ end trace 0000000000000000 ]---

Introduce "subdevs_started" flag to indicate rproc_start_subdevices() has
been called successfully. Ensure subdevices are only stopped if they have
been started.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-2-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_core.c | 7 +++++++
 include/linux/remoteproc.h           | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 2336c55eb021d6..068a3ef467f781 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1104,6 +1104,8 @@ static int rproc_start_subdevices(struct rproc *rproc)
 		}
 	}
 
+	rproc->subdevs_started = true;
+
 	return 0;
 
 unroll_registration:
@@ -1119,10 +1121,15 @@ static void rproc_stop_subdevices(struct rproc *rproc, bool crashed)
 {
 	struct rproc_subdev *subdev;
 
+	if (!rproc->subdevs_started)
+		return;
+
 	list_for_each_entry_reverse(subdev, &rproc->subdevs, node) {
 		if (subdev->stop)
 			subdev->stop(subdev, crashed);
 	}
+
+	rproc->subdevs_started = false;
 }
 
 static void rproc_unprepare_subdevices(struct rproc *rproc)
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index de98462d588892..ef711a5b1a7f27 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -273,6 +273,7 @@ enum rproc_features {
  * @has_iommu: flag to indicate if remote processor is behind an MMU
  * @auto_boot: flag to indicate if remote processor should be auto-started
  * @sysfs_read_only: flag to make remoteproc sysfs files read only
+ * @subdevs_started: flag to indicate if subdevs have started
  * @dump_segments: list of segments in the firmware
  * @nb_vdev: number of vdev currently handled by rproc
  * @elf_class: firmware ELF class
@@ -317,6 +318,7 @@ struct rproc {
 	bool has_iommu;
 	bool auto_boot;
 	bool sysfs_read_only;
+	bool subdevs_started;
 	struct list_head dump_segments;
 	int nb_vdev;
 	u8 elf_class;

From 528b299318ee2aa50f1a692b8486f1854d4f0234 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Wed, 15 Jul 2026 21:57:50 +0800
Subject: [PATCH 0156/1982] wifi: iwlwifi: validate PNVM SKU TLV length

[ Upstream commit 7410e4548a17bd868dfc60b48f2e78eacde3ad78 ]

iwl_pnvm_parse() reads an iwl_sku_id from an
IWL_UCODE_TLV_PNVM_SKU payload after only checking that the generic TLV
payload is present.

A short type-specific payload can therefore make the three data[] reads
extend beyond the TLV. Reject SKU TLVs shorter than the structure before
accessing it.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715135916.24417-1-pengpeng@iscas.ac.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index 5de3a9c0b3ef09..f623f1b6793675 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -205,6 +205,12 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
 			IWL_DEBUG_FW(trans,
 				     "Got IWL_UCODE_TLV_PNVM_SKU len %d\n",
 				     tlv_len);
+			if (tlv_len < sizeof(*tlv_sku_id)) {
+				IWL_ERR(trans, "invalid PNVM SKU TLV len: %u\n",
+					tlv_len);
+				return -EINVAL;
+			}
+
 			IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n",
 				     le32_to_cpu(tlv_sku_id->data[0]),
 				     le32_to_cpu(tlv_sku_id->data[1]),

From 5133a95f41092125a05e77a8e42f44f3146f5502 Mon Sep 17 00:00:00 2001
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Date: Tue, 14 Jul 2026 17:02:07 +0300
Subject: [PATCH 0157/1982] wifi: iwlwifi: support TTL platform device ID

[ Upstream commit 3bff0d12c36247073fca976498b58a940fca72dc ]

Add support for a new device ID that we will have on TTL (sc2).

Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20260714165826.46183446954f.Icc260831e530c1c92c9be615a7077768b1b9ae30@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 0e8481219839bb..4314d95dd12afc 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -548,6 +548,7 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pci_device_id iwl_hw_card_ids[] = {
 	{IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_mac_cfg)},
 	{IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_mac_cfg)},
 	{IWL_PCI_DEVICE(0xD240, PCI_ANY_ID, iwl_sc_mac_cfg)},
+	{IWL_PCI_DEVICE(0x9327, PCI_ANY_ID, iwl_sc_mac_cfg)},
 #endif /* CONFIG_IWLMVM || CONFIG_IWLMLD */
 
 	{0}

From 46403a03d416e87ac8055539096d64928ce534fe Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Wed, 15 Jul 2026 21:57:50 +0800
Subject: [PATCH 0158/1982] wifi: iwlwifi: validate UEFI reduced-power SKU TLV
 length

[ Upstream commit f051995c539582b05276abda4c5874fd4cafd2a5 ]

iwl_uefi_reduce_power_parse() reads an iwl_sku_id from an
IWL_UCODE_TLV_PNVM_SKU payload after only checking that the generic TLV
payload is present.

A short type-specific payload can therefore make the three data[] reads
extend beyond the TLV. Reject SKU TLVs shorter than the structure before
accessing it.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715135916.24417-2-pengpeng@iscas.ac.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
index 4ae4d215e633e0..395973c3f2bf86 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
@@ -248,6 +248,12 @@ int iwl_uefi_reduce_power_parse(struct iwl_trans *trans,
 			IWL_DEBUG_FW(trans,
 				     "Got IWL_UCODE_TLV_PNVM_SKU len %d\n",
 				     tlv_len);
+			if (tlv_len < sizeof(*tlv_sku_id)) {
+				IWL_ERR(trans, "invalid PNVM SKU TLV len: %u\n",
+					tlv_len);
+				return -EINVAL;
+			}
+
 			IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n",
 				     le32_to_cpu(tlv_sku_id->data[0]),
 				     le32_to_cpu(tlv_sku_id->data[1]),

From 3eae2410216a6905406870178701c1c232094318 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Tue, 14 Jul 2026 17:02:12 +0300
Subject: [PATCH 0159/1982] wifi: iwlwifi: mld: validate D3_END notif size

[ Upstream commit 4e777dcdfe70d9b3ddf38cb49de9e30306889b18 ]

Check D3_END_NOTIFICATION payload length before reading notif->flags.
On short payloads, mark notif handling as failed.
Avoid out-of-bounds reads from malformed notifications.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714165826.db2df8b6b6bb.I6163bbdf433379bf1dbf9eb46fb9562892217bd7@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/d3.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index 0cb7bfcd6420ed..73fd4c69357cac 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -1326,8 +1326,16 @@ static bool iwl_mld_handle_d3_notif(struct iwl_notif_wait_data *notif_wait,
 	}
 	case WIDE_ID(PROT_OFFLOAD_GROUP, D3_END_NOTIFICATION): {
 		struct iwl_d3_end_notif *notif = (void *)pkt->data;
+		u32 len = iwl_rx_packet_payload_len(pkt);
+
+		if (IWL_FW_CHECK(mld, len < sizeof(*notif),
+				 "Invalid D3_END notification (expected=%zu got=%u)\n",
+				 sizeof(*notif), len)) {
+			resume_data->notif_handling_err = true;
+		} else {
+			resume_data->d3_end_flags = le32_to_cpu(notif->flags);
+		}
 
-		resume_data->d3_end_flags = le32_to_cpu(notif->flags);
 		resume_data->notifs_received |= IWL_D3_NOTIF_D3_END_NOTIF;
 		break;
 	}

From 3da9cb696cee620dba5c8abbca9b1d0669cc0eb2 Mon Sep 17 00:00:00 2001
From: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Date: Tue, 23 Jun 2026 02:05:36 -0700
Subject: [PATCH 0160/1982] remoteproc: core: cancel crash_handler work in
 rproc_add() error path

[ Upstream commit 0ec167625b4fea30b26da33c188e853ff25d5583 ]

Ensure crash_handler work is cancelled before tearing down rproc resources
to avoid accessing freed memory.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-3-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 068a3ef467f781..70c990c3a5d76f 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -2358,6 +2358,7 @@ int rproc_add(struct rproc *rproc)
 	return 0;
 
 rproc_remove_dev:
+	cancel_work_sync(&rproc->crash_handler);
 	rproc_delete_debug_dir(rproc);
 	device_del(dev);
 rproc_remove_cdev:

From 30d81bbb623919d0d85e690fef28096e72952d4d Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Tue, 14 Jul 2026 17:02:18 +0300
Subject: [PATCH 0161/1982] wifi: iwlwifi: mld: reset the driver state upon
 firmware recovery

[ Upstream commit 71ac392d8b5c23c45c66f30eff1c319580ada4da ]

Just like we did in iwlmvm, we also need to clear the mld state when the
firmware was killed because of the device being powered off during
suspend.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714165826.ff1c9e05e0a9.I8df8d4a0384065fd2a32cf258339be77084c55bd@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 3 +--
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.h | 2 ++
 drivers/net/wireless/intel/iwlwifi/mld/mld.c      | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 27ae06e208402d..69a066904a8081 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -483,8 +483,7 @@ iwl_mld_mac80211_tx(struct ieee80211_hw *hw,
 	iwl_mld_tx_skb(mld, skb, NULL);
 }
 
-static void
-iwl_mld_restart_cleanup(struct iwl_mld *mld)
+void iwl_mld_restart_cleanup(struct iwl_mld *mld)
 {
 	iwl_cleanup_mld(mld);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.h b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.h
index aad04d7b2617d4..f3302997b28f27 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
  * Copyright (C) 2024 Intel Corporation
+ * Copyright (C) 2026 Intel Corporation
  */
 #ifndef __iwl_mld_mac80211_h__
 #define __iwl_mld_mac80211_h__
@@ -9,5 +10,6 @@
 
 int iwl_mld_register_hw(struct iwl_mld *mld);
 void iwl_mld_recalc_multicast_filter(struct iwl_mld *mld);
+void iwl_mld_restart_cleanup(struct iwl_mld *mld);
 
 #endif /* __iwl_mld_mac80211_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
index 49e46babf82217..cf003a4a374086 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
@@ -739,6 +739,7 @@ static void iwl_mld_device_powered_off(struct iwl_op_mode *op_mode)
 
 	wiphy_lock(mld->wiphy);
 	iwl_mld_stop_fw(mld);
+	iwl_mld_restart_cleanup(mld);
 	mld->fw_status.in_d3 = false;
 	wiphy_unlock(mld->wiphy);
 }

From 38c0dfbd44dda653ecef6d94ae1de756e258293d Mon Sep 17 00:00:00 2001
From: Stefan Binding <sbinding@opensource.cirrus.com>
Date: Wed, 15 Jul 2026 13:01:33 +0100
Subject: [PATCH 0162/1982] ASoC: cs35l56: Add support for CS35L62 for
 SoundWire

[ Upstream commit 3330b5f6d8dea66df51c07362f01a39ad9845aad ]

CS35L62 uses the same control and regmap interface as CS35L63 so
support for it can be added into the CS35L56 driver.

Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260715120135.939280-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs35l56-sdw.c    | 2 ++
 sound/soc/codecs/cs35l56-shared.c | 4 ++++
 sound/soc/codecs/cs35l56.c        | 1 +
 3 files changed, 7 insertions(+)

diff --git a/sound/soc/codecs/cs35l56-sdw.c b/sound/soc/codecs/cs35l56-sdw.c
index a513a15d7e5a7d..a7b4e2a923205b 100644
--- a/sound/soc/codecs/cs35l56-sdw.c
+++ b/sound/soc/codecs/cs35l56-sdw.c
@@ -529,6 +529,7 @@ static int cs35l56_sdw_probe(struct sdw_slave *peripheral, const struct sdw_devi
 		regmap_config = &cs35l56_regmap_sdw;
 		break;
 	case 0x3563:
+	case 0x3562:
 		regmap_config = &cs35l63_regmap_sdw;
 		break;
 	default:
@@ -582,6 +583,7 @@ static const struct sdw_device_id cs35l56_sdw_id[] = {
 	SDW_SLAVE_ENTRY(0x01FA, 0x3556, 0x3556),
 	SDW_SLAVE_ENTRY(0x01FA, 0x3557, 0x3557),
 	SDW_SLAVE_ENTRY(0x01FA, 0x3563, 0x3563),
+	SDW_SLAVE_ENTRY(0x01FA, 0x3562, 0x3562),
 	{},
 };
 MODULE_DEVICE_TABLE(sdw, cs35l56_sdw_id);
diff --git a/sound/soc/codecs/cs35l56-shared.c b/sound/soc/codecs/cs35l56-shared.c
index 646bb4fbca0250..3001ec45a72de2 100644
--- a/sound/soc/codecs/cs35l56-shared.c
+++ b/sound/soc/codecs/cs35l56-shared.c
@@ -86,6 +86,7 @@ int cs35l56_set_patch(struct cs35l56_base *cs35l56_base)
 					    ARRAY_SIZE(cs35l56_patch_fw));
 		break;
 	case 0x63:
+	case 0x62:
 		ret = regmap_register_patch(cs35l56_base->regmap, cs35l63_patch_fw,
 					    ARRAY_SIZE(cs35l63_patch_fw));
 		break;
@@ -370,6 +371,7 @@ static void cs35l56_set_fw_reg_table(struct cs35l56_base *cs35l56_base)
 		}
 		break;
 	case 0x63:
+	case 0x62:
 		cs35l56_base->fw_reg = &cs35l63_fw_reg;
 		break;
 	}
@@ -576,6 +578,7 @@ void cs35l56_system_reset(struct cs35l56_base *cs35l56_base, bool is_soundwire)
 		}
 		break;
 	case 0x63:
+	case 0x62:
 		regmap_multi_reg_write_bypassed(cs35l56_base->regmap,
 						cs35l63_system_reset_seq,
 						ARRAY_SIZE(cs35l63_system_reset_seq));
@@ -1080,6 +1083,7 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base)
 		cs35l56_base->calibration_controls = &cs35l56_calibration_controls;
 		break;
 	case 0x35A630:
+	case 0x35A620:
 		cs35l56_base->calibration_controls = &cs35l63_calibration_controls;
 		devid = devid >> 4;
 		break;
diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c
index e3334b2d845323..69976761ffa50c 100644
--- a/sound/soc/codecs/cs35l56.c
+++ b/sound/soc/codecs/cs35l56.c
@@ -968,6 +968,7 @@ static int cs35l56_component_probe(struct snd_soc_component *component)
 						     ARRAY_SIZE(cs35l56_controls));
 		break;
 	case 0x63:
+	case 0x62:
 		ret = snd_soc_add_component_controls(component, cs35l63_controls,
 						     ARRAY_SIZE(cs35l63_controls));
 		break;

From 7ee63a67d2da926ac487f6eb61faf7147f7513ba Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Tue, 14 Jul 2026 17:02:16 +0300
Subject: [PATCH 0163/1982] wifi: iwlwifi: mvm: reset the smart fifo state upon
 FW stop

[ Upstream commit a51cc8131214870af92abbceab64877b27e690c2 ]

The smart fifo is a feature in the firmware configured by the driver.
The driver keeps a state to remember what was the last configuration
sent to the firmware. Obviously, if the firmware stops, we need to
reconfigure the smart fifo. Since we didn't reset that state upon
firmware stop, we thought the firmware is already properly
configured and we didn't send the smart fifo configuration command
as part of the init sequence.

Reset the smart fifo state in iwl_mvm_stop_device() so that we
will properly send the command during the init that will come
later.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714165826.7d3c5efe2d1a.I16b23c328a677257257f695fa6f439e41fbcd081@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index d6a13174b56178..3e7c6208210698 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1535,6 +1535,7 @@ void iwl_mvm_stop_device(struct iwl_mvm *mvm)
 	iwl_fw_cancel_timestamp(&mvm->fwrt);
 
 	clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
+	mvm->sf_state = SF_UNINIT;
 
 	iwl_mvm_pause_tcm(mvm, false);
 

From bca5f8ecbeaf82bfece55e194c68d5c48696c4dc Mon Sep 17 00:00:00 2001
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Date: Tue, 14 Jul 2026 17:02:11 +0300
Subject: [PATCH 0164/1982] wifi: iwlwifi: mld: cancel wiphy work before
 freeing wiphy

[ Upstream commit c99bc4d4e0ba6f4661b2b914c96a597d26e7cc05 ]

When we fail to load the fw during op-mode start, we purge the list
of the async handlers but we don't cancel the work.
Same when we stop the op-mode.

Before freeing wiphy, we need to cancel/flush any pending wiphy work,
otherwise the work will fire with a freed memory.
cfg80211 will do it anyway, but it will warn.

Cancel the work in those cases.

Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20260714165826.07aa49f755a2.I734a27b1b0eeb5b0e821aee3318fee8dc0a6bc03@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/mld.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
index cf003a4a374086..49fcbe6814677d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
@@ -440,6 +440,8 @@ iwl_op_mode_mld_start(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
 	}
 
 	if (ret) {
+		/* wiphy memory is about to be freed, we should cancel any pending work */
+		wiphy_work_cancel(mld->wiphy, &mld->async_handlers_wk);
 		wiphy_unlock(mld->wiphy);
 		rtnl_unlock();
 		goto err;
@@ -505,6 +507,7 @@ iwl_op_mode_mld_stop(struct iwl_op_mode *op_mode)
 	iwl_mld_thermal_exit(mld);
 
 	wiphy_lock(mld->wiphy);
+	wiphy_work_cancel(mld->wiphy, &mld->async_handlers_wk);
 	iwl_mld_low_latency_stop(mld);
 	iwl_mld_deinit_time_sync(mld);
 	wiphy_unlock(mld->wiphy);

From cc9422f6caeeff497d2afdaceb54ee54eea5bf5e Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Fri, 10 Jul 2026 17:32:35 -0700
Subject: [PATCH 0165/1982] tools/lib/api: Fix potential double-free from
 fdarray__grow()

[ Upstream commit eadce0f46a1d066b812c7e5aa46a33711c78a755 ]

If the realloc for fda->entries succeeds but the realloc for fda->priv
fails, the error path frees the newly allocated entries.

However, fda->entries is neither updated to point to the new entries block
nor cleared to NULL. If realloc moved the allocation to a new block, the
old fda->entries pointer is now freed memory.

When fdarray__exit() is later called to clean up, it executes
free(fda->entries), which would trigger a double-free on that old pointer.

Reported-by: Sashiko Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/api/fd/array.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
index f0f195207fca9b..dcb396ab51eb10 100644
--- a/tools/lib/api/fd/array.c
+++ b/tools/lib/api/fd/array.c
@@ -31,7 +31,8 @@ int fdarray__grow(struct fdarray *fda, int nr)
 
 	priv = realloc(fda->priv, psize);
 	if (priv == NULL) {
-		free(entries);
+		/* this will be freed by fdarray__exit() */
+		fda->entries = entries;
 		return -ENOMEM;
 	}
 
@@ -50,7 +51,7 @@ struct fdarray *fdarray__new(int nr_alloc, int nr_autogrow)
 
 	if (fda != NULL) {
 		if (fdarray__grow(fda, nr_alloc)) {
-			free(fda);
+			fdarray__delete(fda);
 			fda = NULL;
 		} else {
 			fda->nr_autogrow = nr_autogrow;

From 47e3a46c3c98d3ea680547882769a1ffad59a745 Mon Sep 17 00:00:00 2001
From: Mikko Perttunen <mperttunen@nvidia.com>
Date: Tue, 9 Jun 2026 17:09:17 +0900
Subject: [PATCH 0166/1982] gpu: host1x: Wait for timeout worker completion on
 channel free

[ Upstream commit 7a39b9856acccc8e9b05845ca2bf62494fcd3dfa ]

cdma_timeout_destroy() used cancel_delayed_work() to cancel pending
timeout work when destroying the CDMA. Usually this is fine, but
there is a narrow race condition where the timeout handler has started
execution but has not taken cdma->lock; the channel is freed causing
cdma_stop to take cdma->lock and flush the channel; host1x_cdma_deinit
then proceeds with deinitializing cdma while the handler is waiting to
take cdma->lock.

Therefore change cdma_timeout_destroy to use cancel_delayed_work_sync
instead to ensure any pending timeout work completes before proceeding.

Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-1-7c1131c0b3ad@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/host1x/hw/cdma_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 3f3f0018eee0d5..ab714d221120cb 100644
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -355,7 +355,7 @@ static int cdma_timeout_init(struct host1x_cdma *cdma)
 static void cdma_timeout_destroy(struct host1x_cdma *cdma)
 {
 	if (cdma->timeout.initialized)
-		cancel_delayed_work(&cdma->timeout.wq);
+		cancel_delayed_work_sync(&cdma->timeout.wq);
 
 	cdma->timeout.initialized = false;
 }

From c7d73393a9e5e5907b0ffa54d3665995949b1f21 Mon Sep 17 00:00:00 2001
From: Avraham Stern <avraham.stern@intel.com>
Date: Wed, 15 Jul 2026 22:04:17 +0300
Subject: [PATCH 0167/1982] wifi: iwlwifi: mld: support aborting an ongoing ftm
 request

[ Upstream commit ef704fc32ae1a519801ac4a06aa290fece5f403c ]

Add support for aborting an ongoing FTM request.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.340040bdc6a3.Ifbbf70021e42bf1d59db6ec45a73f1806a1c2289@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../intel/iwlwifi/mld/ftm-initiator.c         | 21 +++++++++++++++++++
 .../intel/iwlwifi/mld/ftm-initiator.h         |  1 +
 .../net/wireless/intel/iwlwifi/mld/mac80211.c | 10 +++++++++
 3 files changed, 32 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.c
index 3464b32687124c..6e174c4d8b75ee 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.c
@@ -449,3 +449,24 @@ void iwl_mld_ftm_restart_cleanup(struct iwl_mld *mld)
 			       mld->ftm_initiator.req, GFP_KERNEL);
 	iwl_mld_ftm_reset(mld);
 }
+
+void iwl_mld_ftm_abort(struct iwl_mld *mld, struct cfg80211_pmsr_request *req)
+{
+	struct iwl_tof_range_abort_cmd cmd = {
+		.request_id = req->cookie,
+	};
+
+	lockdep_assert_wiphy(mld->wiphy);
+
+	if (req != mld->ftm_initiator.req)
+		return;
+
+	if (iwl_mld_send_cmd_pdu(mld, WIDE_ID(LOCATION_GROUP,
+					      TOF_RANGE_ABORT_CMD),
+				 &cmd))
+		IWL_ERR(mld, "failed to abort FTM process\n");
+
+	iwl_mld_cancel_notifications_of_object(mld, IWL_MLD_OBJECT_TYPE_FTM_REQ,
+					       mld->ftm_initiator.req->cookie);
+	iwl_mld_ftm_reset(mld);
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.h b/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.h
index 3fab25a52508ae..e82237b3146733 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ftm-initiator.h
@@ -25,5 +25,6 @@ int iwl_mld_ftm_start(struct iwl_mld *mld, struct ieee80211_vif *vif,
 void iwl_mld_handle_ftm_resp_notif(struct iwl_mld *mld,
 				   struct iwl_rx_packet *pkt);
 void iwl_mld_ftm_restart_cleanup(struct iwl_mld *mld);
+void iwl_mld_ftm_abort(struct iwl_mld *mld, struct cfg80211_pmsr_request *req);
 
 #endif /* __iwl_mld_ftm_initiator_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 69a066904a8081..5234229a070a79 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -2609,6 +2609,15 @@ static int iwl_mld_start_pmsr(struct ieee80211_hw *hw,
 	return iwl_mld_ftm_start(mld, vif, request);
 }
 
+static void iwl_mld_abort_pmsr(struct ieee80211_hw *hw,
+			       struct ieee80211_vif *vif,
+			       struct cfg80211_pmsr_request *request)
+{
+	struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
+
+	iwl_mld_ftm_abort(mld, request);
+}
+
 static enum ieee80211_neg_ttlm_res
 iwl_mld_can_neg_ttlm(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		     struct ieee80211_neg_ttlm *neg_ttlm)
@@ -2696,5 +2705,6 @@ const struct ieee80211_ops iwl_mld_hw_ops = {
 	.prep_add_interface = iwl_mld_prep_add_interface,
 	.set_hw_timestamp = iwl_mld_set_hw_timestamp,
 	.start_pmsr = iwl_mld_start_pmsr,
+	.abort_pmsr = iwl_mld_abort_pmsr,
 	.can_neg_ttlm = iwl_mld_can_neg_ttlm,
 };

From c91060db4f4acaec200a567af9ce87ec97ebc785 Mon Sep 17 00:00:00 2001
From: Ilan Peer <ilan.peer@intel.com>
Date: Wed, 15 Jul 2026 22:04:30 +0300
Subject: [PATCH 0168/1982] wifi: iwlwifi: mld: Do not cleanup FW state when
 the device is dead

[ Upstream commit 1c031ac5a39ebcc3269eace8b606043adc398bfa ]

When a channel context is unassigned, there is a path to cleanup the FW
state in case of NON MLO connection: remove the link and add it again.
However, when the transport is dead, e.g., during device removal etc.,
this flow will fail and as a result the mld_vif->link[0] would be set to
NULL. Later, when the interface is removed, iwl_mld_remove_link() would
warn as the link is NULL.

Fix this by not doing the cleanup when the device is dead.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.89a0c44a72a3.I45cca8b84a25943d5771199af6b0155dbac77b58@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 5234229a070a79..4ea2d45d71e4e6 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1113,11 +1113,13 @@ void iwl_mld_unassign_vif_chanctx(struct ieee80211_hw *hw,
 	RCU_INIT_POINTER(mld_link->chan_ctx, NULL);
 
 	/* in the non-MLO case, remove/re-add the link to clean up FW state.
-	 * In MLO, it'll be done in drv_change_vif_link
+	 * In MLO, it'll be done in drv_change_vif_link.
+	 * Do not do so during restart or in case the device is dead.
 	 */
 	if (!ieee80211_vif_is_mld(vif) && !mld_vif->ap_sta &&
 	    !WARN_ON_ONCE(vif->cfg.assoc) &&
-	    vif->type != NL80211_IFTYPE_AP && !mld->fw_status.in_hw_restart) {
+	    vif->type != NL80211_IFTYPE_AP && !mld->fw_status.in_hw_restart &&
+	    !iwl_trans_is_dead(mld->trans)) {
 		iwl_mld_remove_link(mld, link);
 		iwl_mld_add_link(mld, link);
 	}

From c643f5567089eb12adbd2a4c96e61ff5a398c891 Mon Sep 17 00:00:00 2001
From: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Date: Fri, 15 May 2026 13:45:18 +0000
Subject: [PATCH 0169/1982] scsi: qla2xxx: Handle INTx not connected while
 passing through

[ Upstream commit 7268e509b43ac1734e1bdb7d18553f7e1080dfb4 ]

The PCI_INTERRUPT_PIN reports if the device supports the INTx.  However,
when the device is assigned to a guest via vfio, the PCI_INTERRUPT_PIN
is set to 0 (i.e none) if the line is not connected and/or the platform
cannot route the interrupt.

In such cases, the guest PCI_INTERRUPT_PIN is 0 and the port number
becomes -1 (255, uint8_t underflow) for qla[25|27|28]xx and qla2031
devices.  The flt_region_nvram is never set, and subsequently the LUN
detection fails.  Below warnings show the NVRAM configuration failure:

 []-0073:1: Inconsistent NVRAM checksum=0xffffffc0 id=HCAM version=0x100.
 []-0074:1: Falling back to functioning (yet invalid -- WWPN) defaults.
 []-0076:1: NVRAM configuration failed.

Handle this case and set the port_no to devfn like its done everywhere
else.

Reference: commit 2bd42b03ab6b ("vfio/pci: Virtualize zero INTx PIN if no pdev->irq")
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Kyle Mahlkuch <kmahlkuc@linux.ibm.com>
Link: https://patch.msgid.link/177885270578.1573.14283751510936407585.stgit@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 07ccfe0226c5e8..5b1fb7e5e0980b 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2803,11 +2803,16 @@ qla2x00_set_isp_flags(struct qla_hw_data *ha)
 	else {
 		/* Get adapter physical port no from interrupt pin register. */
 		pci_read_config_byte(ha->pdev, PCI_INTERRUPT_PIN, &ha->port_no);
-		if (IS_QLA25XX(ha) || IS_QLA2031(ha) ||
-		    IS_QLA27XX(ha) || IS_QLA28XX(ha))
-			ha->port_no--;
-		else
-			ha->port_no = !(ha->port_no & 1);
+		if (ha->port_no == 0) {
+			/* None of INT[A|B|C|D] may be virtualized by vfio */
+			ha->port_no = PCI_FUNC(ha->pdev->devfn);
+		} else {
+			if (IS_QLA25XX(ha) || IS_QLA2031(ha) ||
+			    IS_QLA27XX(ha) || IS_QLA28XX(ha))
+				ha->port_no--;
+			else
+				ha->port_no = !(ha->port_no & 1);
+		}
 	}
 
 	ql_dbg_pci(ql_dbg_init, ha->pdev, 0x000b,

From 5bb38ddc4ddf9aa154817948330e0ecc588d895c Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Fri, 10 Jul 2026 11:53:17 +0200
Subject: [PATCH 0170/1982] media: cec: tegra_cec: don't break off msg on NACK

[ Upstream commit be627f257ce283c95fd2988080dc0db3a20d0d2a ]

The Tegra CEC hardware has a bug where, if the first attempt
to transmit a message is NACKed so the transmit is aborted,
then the second attempt can contain corrupt data.

Ensure that the full message is always transmitted to avoid hitting
this bug.

I suspect some internal state is not reset in the case of aborting
a message due to a NACK.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/platform/tegra/tegra_cec.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/media/cec/platform/tegra/tegra_cec.c b/drivers/media/cec/platform/tegra/tegra_cec.c
index fe66336e734f88..f8ffaeb78118da 100644
--- a/drivers/media/cec/platform/tegra/tegra_cec.c
+++ b/drivers/media/cec/platform/tegra/tegra_cec.c
@@ -243,7 +243,18 @@ static int tegra_cec_adap_enable(struct cec_adapter *adap, bool enable)
 		  TEGRA_CEC_INT_MASK_RX_REGISTER_FULL |
 		  TEGRA_CEC_INT_MASK_RX_START_BIT_DETECTED);
 
-	cec_write(cec, TEGRA_CEC_HW_CONTROL, TEGRA_CEC_HWCTRL_TX_RX_MODE);
+	/*
+	 * TX_NAK_MODE ensures that the whole message is transmitted even
+	 * if each byte is NACKed. Without this flag the retransmit of the
+	 * messages after a NACK can be corrupt. This is a bug in the hardware.
+	 *
+	 * While less efficient, in practice you rarely transmit messages
+	 * that can be NACKed, with the exception of POLL messages which
+	 * are just one byte anyway.
+	 */
+	cec_write(cec, TEGRA_CEC_HW_CONTROL,
+		  TEGRA_CEC_HWCTRL_TX_RX_MODE |
+		  TEGRA_CEC_HWCTRL_TX_NAK_MODE);
 	return 0;
 }
 

From 3c09eb8edc591138bb08d2291370e37d3c9b02d2 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Fri, 10 Jul 2026 13:07:32 +0200
Subject: [PATCH 0171/1982] media: cec/core: drop cec_post_state_event call

[ Upstream commit 2ff4b91e82bd76e1a6e1ff22bfc9aeda08e12a61 ]

No need to call cec_post_state_event() if the next call
is to cec_adap_unconfigure() since that will also call
cec_post_state_event().

This fixes the case when, when the physical address is
invalidated, you get two CEC_EVENT_STATE_CHANGE events:
one with a non-zero log_addr_mask and one with a zero
log_addr_mask.

You just want to see the event with phys_addr set to
f.f.f.f and log_addr_mask set to 0.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/core/cec-adap.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
index 84eaf9780db251..4d2262530c94a7 100644
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -1708,7 +1708,6 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
 		cec_phys_addr_exp(phys_addr));
 	if (becomes_invalid || !is_invalid) {
 		adap->phys_addr = CEC_PHYS_ADDR_INVALID;
-		cec_post_state_event(adap);
 		cec_adap_unconfigure(adap);
 		if (becomes_invalid) {
 			cec_adap_enable(adap);

From 148fcb7faf16e0c9b08afa62734a1e95a11309f5 Mon Sep 17 00:00:00 2001
From: Lucas Martins Alves <lucas.alves@lumal21.com.br>
Date: Tue, 14 Jul 2026 13:49:49 +0000
Subject: [PATCH 0172/1982] usb: musb: host: clear stale RX interrupt on
 three-strikes error

[ Upstream commit 3a3a48487344a653f46a4aadc9ba296386eb3541 ]

Unplugging a busy USB Ethernet adapter can leave a stale RX interrupt
pending while the host handles MUSB_RXCSR_H_ERROR. On AM335x/DSPS
platforms this can retrigger the same three-strikes error before the
disconnect path completes, flooding the log and potentially leaving the
host port stuck until reboot.

Clear the pending endpoint RX interrupt when aborting the transfer so
the error storm is broken, and rate limit the error message to avoid
spamming the log while the fault path completes.

Signed-off-by: Lucas Martins Alves <lucas.alves@lumal21.com.br>
Link: https://patch.msgid.link/20260714134941.18508-1-lucas.alves@lumal21.com.br
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/musb/musb_host.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 6b4481a867c5e8..40f51c388ef594 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1774,7 +1774,8 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 		status = -EPIPE;
 
 	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
-		dev_err(musb->controller, "ep%d RX three-strikes error", epnum);
+		dev_err_ratelimited(musb->controller,
+				    "ep%d RX three-strikes error\n", epnum);
 
 		/*
 		 * The three-strikes error could only happen when the USB
@@ -1788,6 +1789,17 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 		rx_csr &= ~MUSB_RXCSR_H_ERROR;
 		musb_writew(epio, MUSB_RXCSR, rx_csr);
 
+		/*
+		 * Unplugging a USB-Ethernet adapter while it is busy can make
+		 * the controller keep re-asserting the three-strikes error for
+		 * this endpoint before the disconnect is processed. That floods
+		 * the log and can wedge the host port until reboot. Drop the
+		 * stale pending RX interrupt on platforms that support it (e.g.
+		 * AM335x/DSPS) to break the storm; the transfer is still
+		 * aborted below via the fault path.
+		 */
+		musb_platform_clear_ep_rxintr(musb, epnum);
+
 	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
 
 		if (USB_ENDPOINT_XFER_ISOC != qh->type) {

From 7277d38c00bd3e2d5904778e9001b5817f2b3009 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Fri, 10 Jul 2026 11:55:18 +0200
Subject: [PATCH 0173/1982] usb: misc: cypress_cy7c63: check result of IO

[ Upstream commit 0673b919e0933541ae56bb3f0253853f696d3773 ]

If the device returns a bogus short read, treat it as EIO.
Actually check for IO errors.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260710095523.1646308-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/cypress_cy7c63.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
index 75f5a740cba397..e1a0c1ae93f2bf 100644
--- a/drivers/usb/misc/cypress_cy7c63.c
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -89,8 +89,11 @@ static int vendor_command(struct cypress *dev, unsigned char request,
 				 address, data, iobuf, CYPRESS_MAX_REQSIZE,
 				 USB_CTRL_GET_TIMEOUT);
 	/* we must not process garbage */
-	if (retval < 2)
+	if (retval < 2) {
+		if (retval >= 0)
+			retval = -EIO;
 		goto err_buf;
+	}
 
 	/* store returned data (more READs to be added) */
 	switch (request) {
@@ -175,8 +178,9 @@ static ssize_t read_port(struct device *dev, struct device_attribute *attr,
 	dev_dbg(&cyp->udev->dev, "READ_PORT%d called\n", port_num);
 
 	result = vendor_command(cyp, CYPRESS_READ_PORT, read_id, 0);
-
 	dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);
+	if (result < 0)
+		return result;
 
 	return sprintf(buf, "%d", cyp->port[port_num]);
 }

From 55836402fc5192a46b36b6f62f11ca5bdc2d4a7b Mon Sep 17 00:00:00 2001
From: Michail Tatas <michail.tatas@gmail.com>
Date: Fri, 17 Jul 2026 01:24:13 +0300
Subject: [PATCH 0174/1982] USB: misc: uss720: Fix leak in get_1284_register

[ Upstream commit 15902712b9e2a46649cba2f22002d05faec2a990 ]

if wait_for_completion_timeout() times out in get_1284_register()
then we do not destroy the reference acquired via kref_get() in
submit_async_request. Add the missing kref_put in the timeout path.

link: https://syzkaller.appspot.com/bug?extid=56962eb32ba0136cd330

Reported-by: syzbot+56962eb32ba0136cd330@syzkaller.appspotmail.com
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
Link: https://patch.msgid.link/allaDTUua9n5DQ0a@michalis-linux
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/uss720.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 6ebcfaf5259895..a405a36d8d42ff 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -223,6 +223,7 @@ static int get_1284_register(struct parport *pp, unsigned char reg, unsigned cha
 	}
 	printk(KERN_WARNING "get_1284_register timeout\n");
 	kill_all_async_requests_priv(priv);
+	kref_put(&rq->ref_count, destroy_async);
 	return -EIO;
 }
 

From 1b432b8013855c531c6cf8c0b5693c9571ebe7eb Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:26:42 +0800
Subject: [PATCH 0175/1982] uio: sercos3: add missing MODULE_DEVICE_TABLE()

[ Upstream commit a432f68c51fc6761658445e80a798b8425fdb3dc ]

The driver has a match table for the pci bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704152642.54769-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/uio/uio_sercos3.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/uio/uio_sercos3.c b/drivers/uio/uio_sercos3.c
index 12afc2fa1a0bbd..80087897f9b86e 100644
--- a/drivers/uio/uio_sercos3.c
+++ b/drivers/uio/uio_sercos3.c
@@ -212,6 +212,7 @@ static const struct pci_device_id sercos3_pci_ids[] = {
 	},
 	{ 0, }
 };
+MODULE_DEVICE_TABLE(pci, sercos3_pci_ids);
 
 static struct pci_driver sercos3_pci_driver = {
 	.name = "sercos3",

From a7300663fa0e033c03920537d00fdbdc4a604a51 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:12 +0100
Subject: [PATCH 0176/1982] comedi: ni_atmio16d: Add sanity check to interrupt
 handler

[ Upstream commit 13f4796223489a5349b466ce54bb868f46c9fefd ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, check the dev->attached flag in the interrupt handler to
ensure the device has been fully set up, avoiding a possible null
pointer dereference of dev->read_subdev.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-6-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/ni_atmio16d.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/comedi/drivers/ni_atmio16d.c b/drivers/comedi/drivers/ni_atmio16d.c
index b057b3b3582e17..bf7fb6704710f1 100644
--- a/drivers/comedi/drivers/ni_atmio16d.c
+++ b/drivers/comedi/drivers/ni_atmio16d.c
@@ -223,6 +223,9 @@ static irqreturn_t atmio16d_interrupt(int irq, void *d)
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned short val;
 
+	if (!dev->attached)
+		return IRQ_NONE;
+
 	val = inw(dev->iobase + AD_FIFO_REG);
 	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);

From 6c5a43d797addaac4b044a188fbb13c21023d091 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:11 +0100
Subject: [PATCH 0177/1982] comedi: ni_at_a2150: Fix sanity check in interrupt
 handler

[ Upstream commit e7356cdc7077a4f30fc5232a18e9fc6a4d404581 ]

The driver requests an interrupt handler for the device before it is
fully set up.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing various pointers which may be NULL if dev->attached is
false.  Move the check to avoid the possible null pointer dereferences.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-5-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/ni_at_a2150.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/comedi/drivers/ni_at_a2150.c b/drivers/comedi/drivers/ni_at_a2150.c
index e4e5a0ebd195a4..93e9591f5dd4c4 100644
--- a/drivers/comedi/drivers/ni_at_a2150.c
+++ b/drivers/comedi/drivers/ni_at_a2150.c
@@ -132,11 +132,11 @@ static irqreturn_t a2150_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct a2150_private *devpriv = dev->private;
 	struct comedi_isadma *dma = devpriv->dma;
-	struct comedi_isadma_desc *desc = &dma->desc[0];
+	struct comedi_isadma_desc *desc;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_async *async = s->async;
-	struct comedi_cmd *cmd = &async->cmd;
-	unsigned short *buf = desc->virt_addr;
+	struct comedi_async *async;
+	struct comedi_cmd *cmd;
+	unsigned short *buf;
 	unsigned int max_points, num_points, residue, leftover;
 	unsigned short dpnt;
 	int status;
@@ -145,6 +145,11 @@ static irqreturn_t a2150_interrupt(int irq, void *d)
 	if (!dev->attached)
 		return IRQ_HANDLED;
 
+	desc = &dma->desc[0];
+	async = s->async;
+	cmd = &async->cmd;
+	buf = desc->virt_addr;
+
 	status = inw(dev->iobase + STATUS_REG);
 	if ((status & INTR_BIT) == 0)
 		return IRQ_NONE;

From 1b077ad73af7d17f574035c3974431198fec74e1 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:15 +0100
Subject: [PATCH 0178/1982] comedi: pcm818: Fix sanity check in interrupt
 handler

[ Upstream commit 956e8478261a575d1e87490f2e5db1788b8c209d ]

The driver requests an interrupt handler for the device before it is
fully set up.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing the dev->read_dev pointer which may be NULL if
dev->attached is false.  Move the check to avoid the possible null
pointer dereference.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-9-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/pcl818.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/comedi/drivers/pcl818.c b/drivers/comedi/drivers/pcl818.c
index 06fe06396f23ab..e8ce34840050a0 100644
--- a/drivers/comedi/drivers/pcl818.c
+++ b/drivers/comedi/drivers/pcl818.c
@@ -534,13 +534,14 @@ static irqreturn_t pcl818_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct pcl818_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_cmd *cmd = &s->async->cmd;
+	struct comedi_cmd *cmd;
 
 	if (!dev->attached || !devpriv->ai_cmd_running) {
 		pcl818_ai_clear_eoc(dev);
 		return IRQ_HANDLED;
 	}
 
+	cmd = &s->async->cmd;
 	if (devpriv->ai_cmd_canceled) {
 		/*
 		 * The cleanup from ai_cancel() has been delayed

From 9fbe69c3ba2af15030f54c4cc5e95c45c5e2a2c8 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:18 +0100
Subject: [PATCH 0179/1982] comedi: quatech_daqp_cs: Fix sanity check in
 interrupt handler

[ Upstream commit 1bc9538df6be8dac8727179d8bcc0d880648361b ]

The driver requests an interrupt handler for the device before it is
fully set up.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing the dev->read_dev pointer which may be NULL if
dev->attached is false.  Move the check to avoid the possible null
pointer dereference.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-12-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/quatech_daqp_cs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/comedi/drivers/quatech_daqp_cs.c b/drivers/comedi/drivers/quatech_daqp_cs.c
index 2a76c75c513b8e..d5e3e213e233b0 100644
--- a/drivers/comedi/drivers/quatech_daqp_cs.c
+++ b/drivers/comedi/drivers/quatech_daqp_cs.c
@@ -211,13 +211,15 @@ static irqreturn_t daqp_interrupt(int irq, void *dev_id)
 {
 	struct comedi_device *dev = dev_id;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_cmd *cmd = &s->async->cmd;
+	struct comedi_cmd *cmd;
 	int loop_limit = 10000;
 	int status;
 
 	if (!dev->attached)
 		return IRQ_NONE;
 
+	cmd = &s->async->cmd;
+
 	status = inb(dev->iobase + DAQP_STATUS_REG);
 	if (!(status & DAQP_STATUS_EVENTS))
 		return IRQ_NONE;

From 27c6696abcce11e67efdf1dadf855f5e1c80caeb Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:09 +0100
Subject: [PATCH 0180/1982] comedi: das6402: Add sanity check to interrupt
 handler

[ Upstream commit e90d0550c5b3056c8821f5cd714f80902de0fca6 ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, check the dev->attached flag in the interrupt handler to
ensure the device has been fully set up, avoiding a possible null
pointer dereference of dev->read_subdev.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-3-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/das6402.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/comedi/drivers/das6402.c b/drivers/comedi/drivers/das6402.c
index 7660487e563c56..f9a778390ac936 100644
--- a/drivers/comedi/drivers/das6402.c
+++ b/drivers/comedi/drivers/das6402.c
@@ -173,10 +173,16 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
 {
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_async *async = s->async;
-	struct comedi_cmd *cmd = &async->cmd;
+	struct comedi_async *async;
+	struct comedi_cmd *cmd;
 	unsigned int status;
 
+	if (!dev->attached)
+		return IRQ_NONE;
+
+	async = s->async;
+	cmd = &async->cmd;
+
 	status = inb(dev->iobase + DAS6402_STATUS_REG);
 	if ((status & DAS6402_STATUS_INT) == 0)
 		return IRQ_NONE;

From 83b49a8dacfc211b30c7259c3be63d008683e50b Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:10 +0100
Subject: [PATCH 0181/1982] comedi: dt2811: Fix sanity check in interrupt
 handler

[ Upstream commit 8dda63825752ab19fcbc2a19ecab91d128112415 ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing dev->read_subdev, which may be NULL if dev->attached is
false.  Move the check to avoid the possible null pointer dereference.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-4-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/dt2811.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c
index dbb9f38da2898c..c2ec5e4fb689f0 100644
--- a/drivers/comedi/drivers/dt2811.c
+++ b/drivers/comedi/drivers/dt2811.c
@@ -193,13 +193,16 @@ static irqreturn_t dt2811_interrupt(int irq, void *d)
 {
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_async *async = s->async;
-	struct comedi_cmd *cmd = &async->cmd;
+	struct comedi_async *async;
+	struct comedi_cmd *cmd;
 	unsigned int status;
 
 	if (!dev->attached)
 		return IRQ_NONE;
 
+	async = s->async;
+	cmd = &async->cmd;
+
 	status = inb(dev->iobase + DT2811_ADCSR_REG);
 
 	if (status & DT2811_ADCSR_ADERROR) {

From ce0aea8f724bd2331d1848aa87fa82ffc9a1b3ca Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:13 +0100
Subject: [PATCH 0182/1982] comedi: pcm711: Fix sanity check in interrupt
 handler

[ Upstream commit f876cbfe3e066bc9e3f3210907bd534be82946c8 ]

The driver requests an interrupt handler for the device before it is
fully set up.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing the dev->read_dev pointer which may be NULL if
dev->attached is false.  Move the check to avoid the possible null
pointer dereference.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-7-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/pcl711.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/comedi/drivers/pcl711.c b/drivers/comedi/drivers/pcl711.c
index 0cf3917defe790..33407da84ef45a 100644
--- a/drivers/comedi/drivers/pcl711.c
+++ b/drivers/comedi/drivers/pcl711.c
@@ -181,7 +181,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
 {
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
-	struct comedi_cmd *cmd = &s->async->cmd;
+	struct comedi_cmd *cmd;
 	unsigned short data;
 
 	if (!dev->attached) {
@@ -189,6 +189,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
 		return IRQ_HANDLED;
 	}
 
+	cmd = &s->async->cmd;
 	data = pcl711_ai_get_sample(dev, s);
 
 	outb(PCL711_INT_STAT_CLR, dev->iobase + PCL711_INT_STAT_REG);

From 7beb6ca2f3ffdf097bddbff0dbf7c92f5aa743f9 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:08 +0100
Subject: [PATCH 0183/1982] comedi: aio_iiro_16: Add sanity check to interrupt
 handler

[ Upstream commit 1ca44751915134f19e8627768159781e75b5da50 ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, check the dev->attached flag in the interrupt handler to
ensure the device has been fully set up, avoiding a possible null
pointer dereference of dev->read_subdev.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-2-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/aio_iiro_16.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/comedi/drivers/aio_iiro_16.c b/drivers/comedi/drivers/aio_iiro_16.c
index 739cc4db52ac7e..fe75b7e1ddcac2 100644
--- a/drivers/comedi/drivers/aio_iiro_16.c
+++ b/drivers/comedi/drivers/aio_iiro_16.c
@@ -59,6 +59,9 @@ static irqreturn_t aio_iiro_16_cos(int irq, void *d)
 	unsigned int status;
 	unsigned int val;
 
+	if (!dev->attached)
+		return IRQ_NONE;
+
 	status = inb(dev->iobase + AIO_IIRO_16_STATUS);
 	if (!(status & AIO_IIRO_16_STATUS_IRQE))
 		return IRQ_NONE;

From 7fbcd6f65358607a666d6c8d3eba1d8608550d8b Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:16 +0100
Subject: [PATCH 0184/1982] comedi: pcmmio: Add sanity check to interrupt
 handler

[ Upstream commit ea72e2fc9026f375314421ddfa4dbdc49432a899 ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, check the dev->attached flag in the interrupt handler to
ensure the device has been fully set up, avoiding a possible null
pointer dereference of dev->read_subdev.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-10-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/pcmmio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/comedi/drivers/pcmmio.c b/drivers/comedi/drivers/pcmmio.c
index c2402239d5513d..db9cb3fedb48dd 100644
--- a/drivers/comedi/drivers/pcmmio.c
+++ b/drivers/comedi/drivers/pcmmio.c
@@ -362,6 +362,9 @@ static irqreturn_t interrupt_pcmmio(int irq, void *d)
 	unsigned int triggered;
 	unsigned char int_pend;
 
+	if (!dev->attached)
+		return IRQ_NONE;
+
 	/* are there any interrupts pending */
 	int_pend = inb(dev->iobase + PCMMIO_INT_PENDING_REG) & 0x07;
 	if (!int_pend)

From 52e7dfa88e395f6c4cd6f6d650f5a5f37a32068b Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:14 +0100
Subject: [PATCH 0185/1982] comedi: pcm816: Fix sanity check in interrupt
 handler

[ Upstream commit 4fdac5090ce3616283216d9a1d2b9664e8e20747 ]

The driver requests an interrupt handler for the device before it is
fully set up.

For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing the devpriv->dma pointer which may be NULL if
dev->attached is false.  Move the dereference of the devpriv->dma
pointer after dev->attached has been checked to avoid the possible null
pointer dereference.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-8-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/pcl816.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/comedi/drivers/pcl816.c b/drivers/comedi/drivers/pcl816.c
index 28d1a88c50f653..3c295647e2ed59 100644
--- a/drivers/comedi/drivers/pcl816.c
+++ b/drivers/comedi/drivers/pcl816.c
@@ -242,7 +242,7 @@ static irqreturn_t pcl816_interrupt(int irq, void *d)
 	struct comedi_subdevice *s = dev->read_subdev;
 	struct pcl816_private *devpriv = dev->private;
 	struct comedi_isadma *dma = devpriv->dma;
-	struct comedi_isadma_desc *desc = &dma->desc[dma->cur_dma];
+	struct comedi_isadma_desc *desc;
 	unsigned int nsamples;
 	unsigned int bufptr;
 
@@ -257,6 +257,7 @@ static irqreturn_t pcl816_interrupt(int irq, void *d)
 		return IRQ_HANDLED;
 	}
 
+	desc = &dma->desc[dma->cur_dma];
 	nsamples = comedi_bytes_to_samples(s, desc->size) -
 		   devpriv->ai_poll_ptr;
 	bufptr = devpriv->ai_poll_ptr;

From 833c44918f919fe9e1727df24eed07eaf7fbd52b Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 18 Jun 2026 11:09:17 +0100
Subject: [PATCH 0186/1982] comedi: pcmuio: Add sanity check to interrupt
 handler

[ Upstream commit 6f6f6644e011fa910db744e9978127a443b94001 ]

The driver requests an interrupt handler for the device, after setting
device registers to disable interrupt generation.  The interrupt handler
should not be called prematurely unless the user-configured I/O port
base address and/or IRQ number are incorrect or the hardware is bad.

For safety, check the dev->attached flag in the interrupt handler
pcmuio_interrupt() to ensure the device has been fully set up, avoiding
a possible null pointer dereference of dev->subdevices by
pcmuio_handle_asic_interrupt().

Also make use of the IRQ_HANDLED(x) macro for the normal return path of
the interrupt handler.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-11-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/comedi/drivers/pcmuio.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/comedi/drivers/pcmuio.c b/drivers/comedi/drivers/pcmuio.c
index 33b24dbbb91995..1c5fe065a91f54 100644
--- a/drivers/comedi/drivers/pcmuio.c
+++ b/drivers/comedi/drivers/pcmuio.c
@@ -362,12 +362,15 @@ static irqreturn_t pcmuio_interrupt(int irq, void *d)
 	struct pcmuio_private *devpriv = dev->private;
 	int handled = 0;
 
+	if (!dev->attached)
+		return IRQ_NONE;
+
 	if (irq == dev->irq)
 		handled += pcmuio_handle_asic_interrupt(dev, 0);
 	if (irq == devpriv->irq2)
 		handled += pcmuio_handle_asic_interrupt(dev, 1);
 
-	return handled ? IRQ_HANDLED : IRQ_NONE;
+	return IRQ_RETVAL(handled);
 }
 
 /* chip->spinlock is already locked */

From cfe59571ce974bc93361f9b67b67f141b0dfa41e Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Mon, 29 Jun 2026 18:06:05 +0200
Subject: [PATCH 0187/1982] misc: bcm-vk: validate write size before allocation

[ Upstream commit f66c40cd90954f52809b3eabd386137f56bb6215 ]

bcm_vk_write() uses the user-supplied write count to size a
flexible-array work entry and then copies count bytes into that array.
The allocation expression is evaluated before any overflow check, so a
very large count can wrap the allocation smaller than the subsequent
copy.

Reject empty writes, check the allocation arithmetic before kzalloc(),
and initialize the __counted_by field before copying into to_v_msg[].

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260629160605.29412-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/bcm-vk/bcm_vk_msg.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
index a36a6c7d384a9d..4663d758de3ce4 100644
--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
+++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
@@ -9,6 +9,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/overflow.h>
 #include <linux/poll.h>
 #include <linux/sizes.h>
 #include <linux/spinlock.h>
@@ -1090,6 +1091,7 @@ ssize_t bcm_vk_write(struct file *p_file,
 	u32 q_num;
 	u32 msg_size;
 	u32 msgq_size;
+	size_t entry_size;
 
 	if (!bcm_vk_drv_access_ok(vk))
 		return -EPERM;
@@ -1097,20 +1099,26 @@ ssize_t bcm_vk_write(struct file *p_file,
 	dev_dbg(dev, "Msg count %zu\n", count);
 
 	/* first, do sanity check where count should be multiple of basic blk */
-	if (count & (VK_MSGQ_BLK_SIZE - 1)) {
-		dev_err(dev, "Failure with size %zu not multiple of %zu\n",
+	if (!count || count & (VK_MSGQ_BLK_SIZE - 1)) {
+		dev_err(dev, "Failure with size %zu not a positive multiple of %zu\n",
 			count, VK_MSGQ_BLK_SIZE);
 		rc = -EINVAL;
 		goto write_err;
 	}
 
+	if (check_add_overflow(sizeof(*entry), count, &entry_size) ||
+	    check_add_overflow(entry_size, vk->ib_sgl_size, &entry_size)) {
+		rc = -EOVERFLOW;
+		goto write_err;
+	}
+
 	/* allocate the work entry + buffer for size count and inband sgl */
-	entry = kzalloc(sizeof(*entry) + count + vk->ib_sgl_size,
-			GFP_KERNEL);
+	entry = kzalloc(entry_size, GFP_KERNEL);
 	if (!entry) {
 		rc = -ENOMEM;
 		goto write_err;
 	}
+	entry->to_v_blks = count >> VK_MSGQ_BLK_SZ_SHIFT;
 
 	/* now copy msg from user space, and then formulate the work entry */
 	if (copy_from_user(&entry->to_v_msg[0], buf, count)) {
@@ -1118,7 +1126,6 @@ ssize_t bcm_vk_write(struct file *p_file,
 		goto write_free_ent;
 	}
 
-	entry->to_v_blks = count >> VK_MSGQ_BLK_SZ_SHIFT;
 	entry->ctx = ctx;
 
 	/* do a check on the blk size which could not exceed queue space */
@@ -1355,4 +1362,3 @@ void bcm_vk_msg_remove(struct bcm_vk *vk)
 	bcm_vk_drain_all_pend(&vk->pdev->dev, &vk->to_v_msg_chan, NULL);
 	bcm_vk_drain_all_pend(&vk->pdev->dev, &vk->to_h_msg_chan, NULL);
 }
-

From fc586ea5441086d518d7e3f4201b61b050e1f3a2 Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Tue, 30 Jun 2026 12:49:23 +0200
Subject: [PATCH 0188/1982] misc: genwqe: handle a first DMA address of zero

[ Upstream commit d401772a9e18e837631450844f835229354528a4 ]

genwqe_setup_sgl() uses zero as the initial previous DMA address. DMA
address zero is valid, so a first entry at that address enters the
merge path before last_s has been assigned and dereferences NULL.

Only merge adjacent mappings after an SGL data entry has been created.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260630104923.53827-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/genwqe/card_utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index a2c4a9b4f871cc..e3b5fb337182ed 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -413,7 +413,7 @@ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
 			size -= size_to_map;
 			map_offs = 0;
 
-			if (prev_daddr == daddr) {
+			if (last_s && prev_daddr == daddr) {
 				u32 prev_len = be32_to_cpu(last_s->len);
 
 				/* pr_info("daddr combining: "

From e1a03a65162b404dff093fc07f7ad9b403cecd97 Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Wed, 24 Jun 2026 21:09:19 +0200
Subject: [PATCH 0189/1982] misc: hpilo: validate device queue entries before
 use

[ Upstream commit 7bf6940d7cf41f1f0330a9bae4b7a886e18fd8e3 ]

ilo_pkt_dequeue() trusts descriptor IDs and lengths read from the shared
FIFO entry. A bad entry can select a descriptor outside the allocated
queue memory or report a packet length larger than one descriptor.

Reject entries whose descriptor index or packet length exceeds the queue
layout before deriving the packet pointer returned to read and write
paths.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624190919.3432-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/hpilo.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 04bd34c8c5069d..9368edf8c4a328 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -160,11 +160,16 @@ static int ilo_pkt_dequeue(struct ilo_hwinfo *hw, struct ccb *ccb,
 
 	ret = fifo_dequeue(hw, fifobar, &entry);
 	if (ret) {
+		int pkt_len;
+
 		pkt_id = get_entry_id(entry);
+		pkt_len = get_entry_len(entry);
+		if (pkt_id >= NR_QENTRY || pkt_len > desc_mem_sz(1))
+			return 0;
 		if (id)
 			*id = pkt_id;
 		if (len)
-			*len = get_entry_len(entry);
+			*len = pkt_len;
 		if (pkt)
 			*pkt = (void *)(desc + desc_mem_sz(pkt_id));
 	}

From bc01e7408d8ab422fbeb8a91bc8cd7db409d44de Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 16 Jun 2026 23:10:28 +0800
Subject: [PATCH 0190/1982] misc: rp1: clear chained IRQ handlers on teardown

[ Upstream commit 82aa033fef523ab4f0165afbc1c1fb0dadb89f94 ]

rp1_probe() installs a chained handler for each parent MSI-X vector and
stores the rp1 device pointer as handler data. rp1_unregister_interrupts()
then disposes the child IRQ mappings, removes the IRQ domain, and frees
the PCI IRQ vectors without first removing those chained handlers.

If a teardown path runs after the handlers have been installed, a later
parent IRQ can still call rp1_chained_handle_irq() with stale handler
data and a removed IRQ domain. Clear the chained handlers before
disposing mappings and freeing the vectors.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/20260616151028.69890-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/rp1/rp1_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
index 4d00dab48d475c..847feb2cbb6812 100644
--- a/drivers/misc/rp1/rp1_pci.c
+++ b/drivers/misc/rp1/rp1_pci.c
@@ -171,6 +171,9 @@ static void rp1_unregister_interrupts(struct pci_dev *pdev)
 	struct rp1_dev *rp1 = pci_get_drvdata(pdev);
 	int irq, i;
 
+	for (i = 0; i < RP1_INT_END; i++)
+		irq_set_chained_handler_and_data(pci_irq_vector(pdev, i), NULL, NULL);
+
 	if (rp1->domain) {
 		for (i = 0; i < RP1_INT_END; i++) {
 			irq = irq_find_mapping(rp1->domain, i);

From afcf127aa07d98955a0cfe7e24204b2d6e528db8 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 6 Jul 2026 17:19:35 +0800
Subject: [PATCH 0191/1982] greybus: manifest: validate string descriptor
 header

[ Upstream commit 18b6510f642dbcb856c3af8be974d1600f3ba2d3 ]

identify_descriptor() computes a string descriptor size from
desc->string.length.

Require the descriptor to contain the fixed string descriptor header
before reading the variable string length. The existing descriptor-size
check then reports the short descriptor.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706091935.78020-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/greybus/manifest.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c
index dd7040697bde9f..469da3f39afb42 100644
--- a/drivers/greybus/manifest.c
+++ b/drivers/greybus/manifest.c
@@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf,
 	switch (desc_header->type) {
 	case GREYBUS_TYPE_STRING:
 		expected_size += sizeof(struct greybus_descriptor_string);
+		if (desc_size < expected_size)
+			break;
 		expected_size += desc->string.length;
 
 		/* String descriptors are padded to 4 byte boundaries */

From 61d91a89e1364bee57531d4e0b9efb8762d1a054 Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Wed, 24 Jun 2026 20:59:25 +0200
Subject: [PATCH 0192/1982] misc: ibmvmc: release send buffer on write errors

[ Upstream commit fd62c1f591372f7dc4c5bc041569c2f0a4a86be1 ]

ibmvmc_get_valid_hmc_buffer() marks the selected send buffer busy before
ibmvmc_write() validates the backing storage or copies data from user
space. Error exits after that point leave the buffer permanently busy.

Keep the buffer pointer until ownership is handed to the hypervisor, and
mark it free again on local write failures. Also report an RDMA send
failure instead of returning a successful byte count.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624185925.2133-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/ibmvmc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index e5f935b5249d56..af84e94ec5f0e8 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -1040,7 +1040,7 @@ static ssize_t ibmvmc_write(struct file *file, const char *buffer,
 			    size_t count, loff_t *ppos)
 {
 	struct inode *inode;
-	struct ibmvmc_buffer *vmc_buffer;
+	struct ibmvmc_buffer *vmc_buffer = NULL;
 	struct ibmvmc_file_session *session;
 	struct crq_server_adapter *adapter;
 	struct ibmvmc_hmc *hmc;
@@ -1130,9 +1130,15 @@ static ssize_t ibmvmc_write(struct file *file, const char *buffer,
 	dev_dbg(adapter->dev, "write: file = 0x%lx, count = 0x%lx\n",
 		(unsigned long)file, (unsigned long)count);
 
-	ibmvmc_send_msg(adapter, vmc_buffer, hmc, count);
+	if (ibmvmc_send_msg(adapter, vmc_buffer, hmc, count)) {
+		ret = -EIO;
+		goto out;
+	}
+	vmc_buffer = NULL;
 	ret = p - buffer;
  out:
+	if (vmc_buffer)
+		vmc_buffer->free = 1;
 	spin_unlock_irqrestore(&hmc->lock, flags);
 	return (ssize_t)(ret);
 }

From 97193b096581dcb4a9cc630e84cdb27a092d23e6 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Wed, 1 Jul 2026 10:01:10 +0800
Subject: [PATCH 0193/1982] ipack: ipoctal: add rwsem to guard against TOCTOU
 in remove path

[ Upstream commit 7d3a708af7f4e2af9e114d731bd60d30c1ec884e ]

The "removed" flag check in each tty op has a TOCTOU race with
__ipoctal_remove(): the device could be removed between the flag
check and the subsequent access to hardware resources (channel
registers via iowrite8, or xmit_buf in write_tty).

Close this race by introducing a read-write semaphore (remove_sem).
The tty ops acquire the read lock via guard(rwsem_read) for the
full duration of the operation, while __ipoctal_remove() acquires
the write lock via scoped_guard(rwsem_write) when setting the
removed flag.  This ensures that once removed is true, no in-flight
tty op can still be accessing resources that are about to be freed
by the remove path.

Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://patch.msgid.link/fbce75010a0f0a3a3709a5e06fd0ffd19ca0a0ed.1782870760.git.xiaopei01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ipack/devices/ipoctal.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index 474b58858dca6c..aab303c4a9837a 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/kref.h>
+#include <linux/rwsem.h>
 #include <linux/sched.h>
 #include <linux/tty.h>
 #include <linux/serial.h>
@@ -54,6 +55,7 @@ struct ipoctal {
 	u8 __iomem			*int_space;
 	struct kref			kref;
 	struct module			*carrier_owner;
+	struct rw_semaphore		remove_sem;
 	bool				removed;
 };
 
@@ -81,7 +83,7 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
 	channel = dev_get_drvdata(tty->dev);
 	ipoctal = chan_to_ipoctal(channel, tty->index);
 
-
+	guard(rwsem_read)(&ipoctal->remove_sem);
 	if (ipoctal->removed)
 		return -ENODEV;
 
@@ -476,7 +478,7 @@ static ssize_t ipoctal_write_tty(struct tty_struct *tty, const u8 *buf,
 	struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
 	size_t char_copied;
 
-
+	guard(rwsem_read)(&ipoctal->remove_sem);
 	if (ipoctal->removed || !channel->tty_port.xmit_buf)
 		return 0;
 
@@ -522,7 +524,7 @@ static void ipoctal_set_termios(struct tty_struct *tty,
 	struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
 	speed_t baud;
 
-
+	guard(rwsem_read)(&ipoctal->remove_sem);
 	if (ipoctal->removed)
 		return;
 
@@ -660,7 +662,7 @@ static void ipoctal_hangup(struct tty_struct *tty)
 		return;
 
 	ipoctal = chan_to_ipoctal(channel, tty->index);
-
+	guard(rwsem_read)(&ipoctal->remove_sem);
 	if (ipoctal->removed)
 		return;
 
@@ -686,7 +688,7 @@ static void ipoctal_shutdown(struct tty_struct *tty)
 		return;
 
 	ipoctal = chan_to_ipoctal(channel, tty->index);
-
+	guard(rwsem_read)(&ipoctal->remove_sem);
 	if (ipoctal->removed)
 		return;
 
@@ -736,6 +738,7 @@ static int ipoctal_probe(struct ipack_device *dev)
 		return -ENOMEM;
 
 	kref_init(&ipoctal->kref);
+	init_rwsem(&ipoctal->remove_sem);
 
 	ipoctal->dev = dev;
 	ipoctal->carrier_owner = dev->bus->owner;
@@ -755,7 +758,8 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
 {
 	int i;
 
-	ipoctal->removed = true;
+	scoped_guard(rwsem_write, &ipoctal->remove_sem)
+		ipoctal->removed = true;
 
 	ipoctal->dev->bus->ops->free_irq(ipoctal->dev);
 

From 62a24f902e8ceb55df5397bb3da26665d124535c Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Wed, 24 Jun 2026 19:51:39 +0200
Subject: [PATCH 0194/1982] misc: ibmvmc: reject oversized inbound messages

[ Upstream commit 18189e5d84aa0b3bc89189cba13b9105634cb6fb ]

ibmvmc_recv_msg() trusts the message length from the CRQ.

It passes that length directly to h_copy_rdma().

The destination buffer is only max_mtu bytes.

A larger length can overrun it before userspace reads the message.

Validate the CRQ length before issuing the RDMA copy.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624175139.7981-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/ibmvmc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index af84e94ec5f0e8..b26ee0d3626f5f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -1659,6 +1659,13 @@ static int ibmvmc_recv_msg(struct crq_server_adapter *adapter,
 		return -1;
 	}
 
+	if (msg_len > buffer->size) {
+		dev_err(adapter->dev, "Recv_msg: msg_len 0x%lx exceeds buffer size 0x%x\n",
+			msg_len, buffer->size);
+		spin_unlock_irqrestore(&hmc->lock, flags);
+		return -1;
+	}
+
 	/* RDMA the data into the partition. */
 	rc = h_copy_rdma(msg_len,
 			 adapter->riobn,

From a1474ca79993349f7f206ded56469f0fcc98ca3f Mon Sep 17 00:00:00 2001
From: Logan Gunthorpe <logang@deltatee.com>
Date: Tue, 14 Jul 2026 15:20:09 -0600
Subject: [PATCH 0195/1982] PCI: switchtec: Add Microchip PCI1008 device ID

[ Upstream commit 0d8a6306c680ee534be131e360f0cafa2bada7be ]

Add the Microchip PCI1008 device ID to the core switchtec management
driver's PCI ID table. Without it, the management endpoint on a PCI1008
switch is not bound by this driver, preventing userspace tools from
configuring or monitoring the switch and leaving NTB functionality
unavailable.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260714212010.230606-3-logang@deltatee.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/switch/switchtec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index f32ddfa79da995..30566c2d9f8060 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1874,6 +1874,7 @@ static const struct pci_device_id switchtec_pci_tbl[] = {
 	SWITCHTEC_PCI100X_DEVICE(0x1004, SWITCHTEC_GEN4),  /* PCI1004 16XG4 */
 	SWITCHTEC_PCI100X_DEVICE(0x1005, SWITCHTEC_GEN4),  /* PCI1005 16XG4 */
 	SWITCHTEC_PCI100X_DEVICE(0x1006, SWITCHTEC_GEN4),  /* PCI1006 16XG4 */
+	SWITCHTEC_PCI100X_DEVICE(0x1008, SWITCHTEC_GEN4),  /* PCI1008 16XG4 */
 	{0}
 };
 MODULE_DEVICE_TABLE(pci, switchtec_pci_tbl);

From 6f244ea2fafa4303365ce3a3781453d1be640819 Mon Sep 17 00:00:00 2001
From: Logan Gunthorpe <logang@deltatee.com>
Date: Tue, 14 Jul 2026 15:20:10 -0600
Subject: [PATCH 0196/1982] PCI: switchtec: Add Microchip PCI1008 to NTB DMA
 alias quirk

[ Upstream commit 00a479ba1d01249d43ca5e453380d1ed60946f8a ]

Add the PCI1008 device ID to the quirk_switchtec_ntb_dma_alias PCI fixup
table. Without it, DMA transactions from a PCI1008 switch's NTB function
are not given the correct requester ID alias, which can misdirect them
under an IOMMU.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260714212010.230606-4-logang@deltatee.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index e8067ff59e2a53..e03a3831bcc00f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -6045,6 +6045,7 @@ SWITCHTEC_PCI100X_QUIRK(0x1003);  /* PCI1003XG4 */
 SWITCHTEC_PCI100X_QUIRK(0x1004);  /* PCI1004XG4 */
 SWITCHTEC_PCI100X_QUIRK(0x1005);  /* PCI1005XG4 */
 SWITCHTEC_PCI100X_QUIRK(0x1006);  /* PCI1006XG4 */
+SWITCHTEC_PCI100X_QUIRK(0x1008);  /* PCI1008XG4 */
 
 
 /*

From 5528da68628d2f26e1fd37b2f37b64e58d4a4612 Mon Sep 17 00:00:00 2001
From: Yuho Choi <dbgh9129@gmail.com>
Date: Mon, 8 Jun 2026 13:27:17 -0400
Subject: [PATCH 0197/1982] driver core: attribute_container: Unwind
 device_add() on attr failure

[ Upstream commit 8cfe7ad274bb42c4653b645267410d4a3a23db98 ]

attribute_container_add_class_device() first calls device_add() and then
creates the container attributes. If attribute_container_add_attrs() fails,
the helper returns the error with the class device still registered.

Callers use an error from this helper as a failed add and do not call
device_del() on that path. Undo the successful device_add() before
returning the attribute creation error.

Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260608172717.88657-1-dbgh9129@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/attribute_container.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/base/attribute_container.c b/drivers/base/attribute_container.c
index b6f941a6ab693a..b1d6eb6ab46b5a 100644
--- a/drivers/base/attribute_container.c
+++ b/drivers/base/attribute_container.c
@@ -427,7 +427,12 @@ attribute_container_add_class_device(struct device *classdev)
 
 	if (error)
 		return error;
-	return attribute_container_add_attrs(classdev);
+
+	error = attribute_container_add_attrs(classdev);
+	if (error)
+		device_del(classdev);
+
+	return error;
 }
 
 /**

From b7e3bcd3b2a162669ca571e43e49a75b75257c66 Mon Sep 17 00:00:00 2001
From: Aditya Sherawat <asherawa@qti.qualcomm.com>
Date: Fri, 10 Jul 2026 00:12:00 +0530
Subject: [PATCH 0198/1982] drm/msm/adreno: Add support for A704 GPU

[ Upstream commit 1f69339da06255a7f8560b4768fff83992c03deb ]

Adreno A704 GPU found in Shikra is an IP reuse of A702 GPU with very
minimal changes. The only KMD facing difference is the chipid and the
zap firmware which is specified via devicetree.

Just add the new chipid to enable support for A704 GPU in Shikra.

Signed-off-by: Aditya Sherawat <asherawa@qti.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/738931/
Message-ID: <20260710-shikra-gpu-v6-1-b388ec5dce77@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
index b43850966a5f6e..bbfee7fef6dc01 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
@@ -1417,7 +1417,7 @@ DECLARE_ADRENO_REGLIST_LIST(a750_ifpc_reglist);
 
 static const struct adreno_info a7xx_gpus[] = {
 	{
-		.chip_ids = ADRENO_CHIP_IDS(0x07000200),
+		.chip_ids = ADRENO_CHIP_IDS(0x07000200, 0x07000400),
 		.family = ADRENO_6XX_GEN1, /* NOT a mistake! */
 		.fw = {
 			[ADRENO_FW_SQE] = "a702_sqe.fw",

From d2554d9bd3ecd73ab0cb67b5b2bb22b00d881bfb Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Fri, 17 Jul 2026 17:31:05 +0300
Subject: [PATCH 0199/1982] wifi: iwlwifi: mld: validate wake packet crypto
 overhead

[ Upstream commit c5cb9dd220ba9fdcf4ba485ce3d1d36ca32ac00b ]

Wake packet parsing only accounted for FCS and missed per-key
IV/ICV overhead for protected data frames.

Prevent size underflow and bad packet trimming when
notifications are malformed or truncated.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717172958.e06595623533.Ie09494b7e34e5872b750fd90e325648ee469d0da@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/d3.c | 63 +++++++++++++++++++--
 1 file changed, 57 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index 73fd4c69357cac..b75936125b46d3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -53,6 +53,30 @@ struct iwl_mld_suspend_key_iter_data {
 	__le32 bigtk_cipher;
 };
 
+struct iwl_mld_wake_pkt_iter_data {
+	bool multicast;
+	u32 ivlen;
+	u32 icvlen;
+};
+
+static void
+iwl_mld_wake_pkt_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+			  struct ieee80211_sta *sta,
+			  struct ieee80211_key_conf *key, void *_data)
+{
+	struct iwl_mld_wake_pkt_iter_data *data = _data;
+	bool is_group_key = !sta;
+
+	/* ignore anything that is not a PTK / GTK */
+	if (key->keyidx > 3)
+		return;
+	if (is_group_key != data->multicast)
+		return;
+
+	data->ivlen = key->iv_len;
+	data->icvlen = key->icv_len;
+}
+
 struct iwl_mld_mcast_key_data {
 	u8 key[WOWLAN_KEY_MAX_SIZE];
 	u8 len;
@@ -707,11 +731,17 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
 			struct cfg80211_wowlan_wakeup *wakeup,
 			struct sk_buff **_pkt)
 {
-	int pkt_bufsize = wowlan_status->wake_packet_bufsize;
-	int expected_pktlen = wowlan_status->wake_packet_length;
+	u32 pkt_bufsize = wowlan_status->wake_packet_bufsize;
+	u32 expected_pktlen = wowlan_status->wake_packet_length;
 	const u8 *pktdata = wowlan_status->wake_packet;
 	const struct ieee80211_hdr *hdr = (const void *)pktdata;
-	int truncated = expected_pktlen - pkt_bufsize;
+	u32 truncated;
+
+	if (IWL_FW_CHECK(mld, pkt_bufsize < sizeof(*hdr),
+			 "pkt_bufsize is too short: %u\n", pkt_bufsize))
+		return;
+
+	truncated = expected_pktlen - pkt_bufsize;
 
 	if (ieee80211_is_data(hdr->frame_control)) {
 		int hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -722,9 +752,18 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
 		if (!pkt)
 			return;
 
-		skb_put_data(pkt, pktdata, hdrlen);
-		pktdata += hdrlen;
-		pkt_bufsize -= hdrlen;
+		if (ieee80211_has_protected(hdr->frame_control)) {
+			struct iwl_mld_wake_pkt_iter_data iter_data = {
+				.multicast =
+					is_multicast_ether_addr(hdr->addr1),
+			};
+
+			ieee80211_iter_keys(mld->hw, vif,
+					    iwl_mld_wake_pkt_key_iter,
+					    &iter_data);
+			ivlen = iter_data.ivlen;
+			icvlen += iter_data.icvlen;
+		}
 
 		/* if truncated, FCS/ICV is (partially) gone */
 		if (truncated >= icvlen) {
@@ -735,6 +774,13 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
 			truncated = 0;
 		}
 
+		if (IWL_FW_CHECK(mld, pkt_bufsize <= hdrlen + ivlen + icvlen,
+				 "pkt_bufsize is too small %u\n", pkt_bufsize))
+			return;
+
+		skb_put_data(pkt, pktdata, hdrlen);
+		pktdata += hdrlen;
+		pkt_bufsize -= hdrlen;
 		pkt_bufsize -= ivlen + icvlen;
 		pktdata += ivlen;
 
@@ -756,6 +802,11 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
 			fcslen -= truncated;
 			truncated = 0;
 		}
+
+		if (IWL_FW_CHECK(mld, pkt_bufsize <= fcslen,
+				 "pkt_bufsize is too small %u\n", pkt_bufsize))
+			return;
+
 		pkt_bufsize -= fcslen;
 		wakeup->packet = wowlan_status->wake_packet;
 		wakeup->packet_present_len = pkt_bufsize;

From 9e458e80d21d366a3f166145709dd73e896081bb Mon Sep 17 00:00:00 2001
From: Ayala Beker <ayala.beker@intel.com>
Date: Fri, 17 Jul 2026 17:31:08 +0300
Subject: [PATCH 0200/1982] wifi: iwlwifi: mld: drop connection on D3 resume
 failure

[ Upstream commit 4f5384b58b483e4aec576ce461dec45b41df18db ]

When FW crashes on D3 exit, iwl_mld_nic_error() sets
STATUS_RESET_PENDING and queues restart wk, but mac80211's resume
callback synchronously calls iwl_trans_stop_device() which clears
the flag. As a result restart wk skips sw_reset, and the FW error
recovery buffer is never read.

The new FW boots with empty BA state and initial sequence numbers,
while the AP still holds its A-MPDU RX reorder window.
This causes MPDUs to be dropped as IWL_RX_MPDU_REORDER_BA_OLD_SN until
ADDBA is renegotiated.

We don't know how long the firmware has been in an error state
or whether the AP still considers us associated, so keeping the
connection alive is not worth it.
Call ieee80211_resume_disconnect() when iwl_mld_wait_d3_notif() fails,
and let userspace reassociate.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717172958.3e10c8498f53.Icf5644b42d79e984ecc16abfa873bd37f611e778@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mld/d3.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index b75936125b46d3..69d8afda9fcd95 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -2077,6 +2077,9 @@ int iwl_mld_wowlan_resume(struct iwl_mld *mld)
 	ret = iwl_mld_wait_d3_notif(mld, &resume_data, true);
 	if (ret) {
 		IWL_ERR(mld, "Couldn't get the d3 notifs %d\n", ret);
+
+		if (bss_vif->cfg.assoc)
+			ieee80211_resume_disconnect(bss_vif);
 		goto err;
 	}
 

From b571ade3a064213bc1d516ae073e58fd09cf8add Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Fri, 17 Jul 2026 17:31:07 +0300
Subject: [PATCH 0201/1982] wifi: iwlwifi: mvm: ignore sync frames when sync is
 disabled

[ Upstream commit a790f60cc4d7dc64a2d7cadb94a3d9f60392bed4 ]

Gate time-sync frame interception on the active flag so frames are not
queued after time-sync teardown.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717172958.ac73ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
index 2cfd0fb5e781a9..7bdbacb6407870 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
  * Copyright (C) 2022 Intel Corporation
+ * Copyright (C) 2026 Intel Corporation
  */
 #ifndef __TIME_SYNC_H__
 #define __TIME_SYNC_H__
@@ -19,6 +20,9 @@ int iwl_mvm_time_sync_config(struct iwl_mvm *mvm, const u8 *addr,
 static inline
 bool iwl_mvm_time_sync_frame(struct iwl_mvm *mvm, struct sk_buff *skb, u8 *addr)
 {
+	if (!mvm->time_sync.active)
+		return false;
+
 	if (ether_addr_equal(mvm->time_sync.peer_addr, addr) &&
 	    (ieee80211_is_timing_measurement(skb) || ieee80211_is_ftm(skb))) {
 		skb_queue_tail(&mvm->time_sync.frame_list, skb);

From c023ae2228cfa00fbd2a81c7b41d570f2e952930 Mon Sep 17 00:00:00 2001
From: Rituparna Warwatkar <rwarwatkar@gmail.com>
Date: Tue, 14 Jul 2026 16:10:59 +0200
Subject: [PATCH 0202/1982] media: dvb-core: fix feed leak on failed
 DMX_ADD_PID

[ Upstream commit 9fa26c971ca310dd10a3bc0014f2fc7ea7167bba ]

dvb_dmxdev_add_pid() allocates a new dmxdev_feed, links it into
filter->feed.ts and, when the filter is already running, immediately
starts the feed.

If starting the feed fails, the newly allocated feed remains on the
list. Subsequent restart and rollback paths may then operate on this
stale entry, leaving feed resources allocated and causing leaks in
drivers that allocate resources from ->start_feed() and release them
from ->stop_feed().

Remove the feed from the list and free it when
dvb_dmxdev_start_feed() fails.

Reported-by: syzbot+e9a1f5e196de6663631b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b
Signed-off-by: Rituparna Warwatkar <rwarwatkar@gmail.com>
Link: https://patch.msgid.link/20260714141059.63582-1-rwarwatkar@gmail.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <20260714141059.63582-1-rwarwatkar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-core/dmxdev.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index ab34be22cd1aa8..f6fb54ad05e7af 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -871,6 +871,7 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
 			      struct dmxdev_filter *filter, u16 pid)
 {
 	struct dmxdev_feed *feed;
+	int ret;
 
 	if ((filter->type != DMXDEV_TYPE_PES) ||
 	    (filter->state < DMXDEV_STATE_SET))
@@ -888,8 +889,14 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
 	feed->pid = pid;
 	list_add(&feed->next, &filter->feed.ts);
 
-	if (filter->state >= DMXDEV_STATE_GO)
-		return dvb_dmxdev_start_feed(dmxdev, filter, feed);
+	if (filter->state >= DMXDEV_STATE_GO) {
+		ret = dvb_dmxdev_start_feed(dmxdev, filter, feed);
+		if (ret < 0) {
+			list_del(&feed->next);
+			kfree(feed);
+			return ret;
+		}
+	}
 
 	return 0;
 }

From 5f9d81c7144f4a0cce0a36e4ba4e45cb3abb529e Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Tue, 30 Jun 2026 12:50:15 +0200
Subject: [PATCH 0203/1982] media: go7007: s2250: propagate control I/O
 failures

[ Upstream commit 59dc14a6cb5ff1ae5ce2f6ebf51fe0139e1c0623 ]

The brightness and contrast paths use oldvalue after read_reg_fp()
without checking whether the read succeeded.  A failed read leaves
oldvalue uninitialized and can write arbitrary reserved register bits.

Return read and write errors from every control path so failed hardware
access cannot be reported as a successful control update.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/s2250-board.c | 54 ++++++++++++++++----------
 1 file changed, 33 insertions(+), 21 deletions(-)

diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c
index a155b987282f89..e536964c14e6a8 100644
--- a/drivers/media/usb/go7007/s2250-board.c
+++ b/drivers/media/usb/go7007/s2250-board.c
@@ -365,36 +365,48 @@ static int s2250_s_ctrl(struct v4l2_ctrl *ctrl)
 	struct s2250 *state = container_of(ctrl->handler, struct s2250, hdl);
 	struct i2c_client *client = v4l2_get_subdevdata(&state->sd);
 	u16 oldvalue;
+	int ret;
 
 	switch (ctrl->id) {
 	case V4L2_CID_BRIGHTNESS:
-		read_reg_fp(client, VPX322_ADDR_BRIGHTNESS0, &oldvalue);
-		write_reg_fp(client, VPX322_ADDR_BRIGHTNESS0,
-			     ctrl->val | (oldvalue & ~0xff));
-		read_reg_fp(client, VPX322_ADDR_BRIGHTNESS1, &oldvalue);
-		write_reg_fp(client, VPX322_ADDR_BRIGHTNESS1,
-			     ctrl->val | (oldvalue & ~0xff));
-		write_reg_fp(client, 0x140, 0x60);
-		break;
+		ret = read_reg_fp(client, VPX322_ADDR_BRIGHTNESS0, &oldvalue);
+		if (ret)
+			return ret;
+		ret = write_reg_fp(client, VPX322_ADDR_BRIGHTNESS0,
+				   ctrl->val | (oldvalue & ~0xff));
+		if (ret)
+			return ret;
+		ret = read_reg_fp(client, VPX322_ADDR_BRIGHTNESS1, &oldvalue);
+		if (ret)
+			return ret;
+		ret = write_reg_fp(client, VPX322_ADDR_BRIGHTNESS1,
+				   ctrl->val | (oldvalue & ~0xff));
+		if (ret)
+			return ret;
+		return write_reg_fp(client, 0x140, 0x60);
 	case V4L2_CID_CONTRAST:
-		read_reg_fp(client, VPX322_ADDR_CONTRAST0, &oldvalue);
-		write_reg_fp(client, VPX322_ADDR_CONTRAST0,
-			     ctrl->val | (oldvalue & ~0x3f));
-		read_reg_fp(client, VPX322_ADDR_CONTRAST1, &oldvalue);
-		write_reg_fp(client, VPX322_ADDR_CONTRAST1,
-			     ctrl->val | (oldvalue & ~0x3f));
-		write_reg_fp(client, 0x140, 0x60);
-		break;
+		ret = read_reg_fp(client, VPX322_ADDR_CONTRAST0, &oldvalue);
+		if (ret)
+			return ret;
+		ret = write_reg_fp(client, VPX322_ADDR_CONTRAST0,
+				   ctrl->val | (oldvalue & ~0x3f));
+		if (ret)
+			return ret;
+		ret = read_reg_fp(client, VPX322_ADDR_CONTRAST1, &oldvalue);
+		if (ret)
+			return ret;
+		ret = write_reg_fp(client, VPX322_ADDR_CONTRAST1,
+				   ctrl->val | (oldvalue & ~0x3f));
+		if (ret)
+			return ret;
+		return write_reg_fp(client, 0x140, 0x60);
 	case V4L2_CID_SATURATION:
-		write_reg_fp(client, VPX322_ADDR_SAT, ctrl->val);
-		break;
+		return write_reg_fp(client, VPX322_ADDR_SAT, ctrl->val);
 	case V4L2_CID_HUE:
-		write_reg_fp(client, VPX322_ADDR_HUE, ctrl->val);
-		break;
+		return write_reg_fp(client, VPX322_ADDR_HUE, ctrl->val);
 	default:
 		return -EINVAL;
 	}
-	return 0;
 }
 
 static int s2250_set_fmt(struct v4l2_subdev *sd,

From 5e1f73e1c34d0f50d2be0369a141ac92c5f976bd Mon Sep 17 00:00:00 2001
From: Dio Zhang <dioyc_zhang@compal.corp-partner.google.com>
Date: Mon, 20 Jul 2026 10:53:58 +0800
Subject: [PATCH 0204/1982] drm/panel: panel-edp: Adjust T8 timing for AUO
 B116XAK01.6 and B140XTK02.4

[ Upstream commit 0d40cab39158704e372240ed9821a00bfe117125 ]

Screen garbage or flickering can be observed during mode changes (such
as VT switches) on systems using the AUO B116XAK01.6 and B140XTK02.4
panels.

This occurs because the backlight is enabled before the video signal
stabilizes. Waveform measurements show that the panel signal takes
around 140ms to stabilize after a mode change, meaning the previous 50ms T8
timing was insufficient.

To resolve this issue, adjust the eDP panel delay entry from
delay_200_500_e50 to delay_200_500_e200 (increasing T8 from 50ms to 200ms).
This matches the updated panel specifications from AUO, which now formally
define T8 as 200ms to mask any display abnormalities during mode changes.

Signed-off-by: Dio Zhang <dioyc_zhang@compal.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260720025358.2781136-1-dioyc_zhang@compal.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-edp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 0da04d75e4e964..614c63e95c3574 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1901,7 +1901,7 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x145c, &delay_200_500_e50, "B116XAB01.4"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x1999, &delay_200_500_e50, "Unknown"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x1e9b, &delay_200_500_e50, "B133UAN02.1"),
-	EDP_PANEL_ENTRY('A', 'U', 'O', 0x1ea5, &delay_200_500_e50, "B116XAK01.6"),
+	EDP_PANEL_ENTRY('A', 'U', 'O', 0x1ea5, &delay_200_500_e200, "B116XAK01.6"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x203d, &delay_200_500_e50, "B140HTN02.0"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x208d, &delay_200_500_e50, "B140HTN02.1"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x235c, &delay_200_500_e50, "B116XTN02.3"),
@@ -1921,7 +1921,7 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"),
-	EDP_PANEL_ENTRY('A', 'U', 'O', 0x67a8, &delay_200_500_e50, "B140XTK02.4"),
+	EDP_PANEL_ENTRY('A', 'U', 'O', 0x67a8, &delay_200_500_e200, "B140XTK02.4"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"),
 	EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"),

From 996766054b8870b73bc804a061fe90e80c241484 Mon Sep 17 00:00:00 2001
From: Nizar Al-Kabbani <nizar.m.kabbani@gmail.com>
Date: Sun, 19 Jul 2026 12:08:43 +0300
Subject: [PATCH 0205/1982] platform/x86: asus-nb-wmi: map ProArt key (0x8b) to
 KEY_PROG3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6303451189a6d8f304221065c44ccd597e0acbe5 ]

The dedicated "ProArt" key on the ASUS ProArt PX13 (HN7306) emits ASUS
WMI event code 0x8b. This code is absent from the asus-nb-wmi sparse
keymap, so pressing the key only produces a "Unknown key code 0x8b"
message and does nothing in userspace.

On this model the key is exposed solely through the WMI interface and has
no HID scancode, so it can only be handled inside asus-nb-wmi. Map 0x8b
to KEY_PROG3 so the key emits a bindable event, consistent with the
existing KEY_PROG3 mapping used for the ASUS programmable/Armoury key.

Signed-off-by: Nizar Al-Kabbani <nizar.m.kabbani@gmail.com>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260719090843.66777-1-nizar.m.kabbani@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 8dad7bdb8f6129..a840d16e063e01 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -622,6 +622,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
 	{ KE_KEY, 0x86, { KEY_PROG1 } }, /* MyASUS Key */
 	{ KE_KEY, 0x88, { KEY_RFKILL  } }, /* Radio Toggle Key */
 	{ KE_KEY, 0x8A, { KEY_PROG1 } }, /* Color enhancement mode */
+	{ KE_KEY, 0x8B, { KEY_PROG3 } }, /* ProArt key (PX13/HN7306) */
 	{ KE_KEY, 0x8C, { KEY_SWITCHVIDEOMODE } }, /* SDSP DVI only */
 	{ KE_KEY, 0x8D, { KEY_SWITCHVIDEOMODE } }, /* SDSP LCD + DVI */
 	{ KE_KEY, 0x8E, { KEY_SWITCHVIDEOMODE } }, /* SDSP CRT + DVI */

From c9aacd7db81326b34ca70d0dc403762218c4ef7e Mon Sep 17 00:00:00 2001
From: Bob Song <songxiebing@kylinos.cn>
Date: Fri, 17 Jul 2026 10:49:48 +0800
Subject: [PATCH 0206/1982] ALSA: hda: Check snd_hda_power_pm construct error
 before executing verb

[ Upstream commit df27e4dc80c4a30ad206432cb848aab00de22ca7 ]

When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove
HDA PCI device, the HDA hardware control path is shut down and devres
unmaps the BAR virtual address bus->remap_addr automatically during
driver removal.

If a delayed HDA verb command arrives after the MMIO region is
unmapped, the driver will access invalid virtual addresses and trigger
a page fault splat.

So add an error check right after constructing snd_hda_power_pm.

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260717024948.506335-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/common/codec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index 8cab9321771940..7869f673894fe5 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -39,6 +39,12 @@ static int call_exec_verb(struct hda_bus *bus, struct hda_codec *codec,
 	int err;
 
 	CLASS(snd_hda_power_pm, pm)(codec);
+	if (pm.err < 0 && !bus->core.chip_init) {
+		codec_warn(codec,
+			   "Failed to send cmd 0x%x ret=[%d], hda control stopped\n",
+			   cmd, pm.err);
+		return pm.err;
+	}
 	guard(mutex)(&bus->core.cmd_mutex);
 	if (flags & HDA_RW_NO_RESPONSE_FALLBACK)
 		bus->no_response_fallback = 1;

From 45083910bc256ea3032cd2691685e8d162f980e5 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 6 Jul 2026 17:41:41 +0800
Subject: [PATCH 0207/1982] ACPI: FPDT: validate table and record lengths

[ Upstream commit 458b40fcdd04a9a0334830de5a536d8425454e4b ]

FPDT records are supplied by firmware and are walked through
length fields stored in the table itself.

Check the main-table entry length before reading an entry, check
the mapped subtable length before remapping it, and check each
record length before saving a typed record pointer for sysfs.

This keeps malformed firmware records from being interpreted as
complete resume, suspend, or boot records when the current item
is shorter than the structure consumed by the driver.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706094141.82438-1-pengpeng@iscas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpi_fpdt.c | 53 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 47 insertions(+), 6 deletions(-)

diff --git a/drivers/acpi/acpi_fpdt.c b/drivers/acpi/acpi_fpdt.c
index 271092f2700a1e..058d1ad47699af 100644
--- a/drivers/acpi/acpi_fpdt.c
+++ b/drivers/acpi/acpi_fpdt.c
@@ -165,7 +165,7 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type)
 	struct fpdt_subtable_header *subtable_header;
 	struct fpdt_record_header *record_header;
 	char *signature = (subtable_type == SUBTABLE_FBPT ? "FBPT" : "S3PT");
-	u32 length, offset;
+	u32 length, offset, remaining;
 	int result;
 
 	if (!fpdt_address_valid(address)) {
@@ -179,10 +179,17 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type)
 
 	if (strncmp((char *)&subtable_header->signature, signature, 4)) {
 		pr_info(FW_BUG "subtable signature and type mismatch!\n");
+		acpi_os_unmap_memory(subtable_header, sizeof(*subtable_header));
 		return -EINVAL;
 	}
 
 	length = subtable_header->length;
+	if (length < sizeof(*subtable_header)) {
+		pr_err(FW_BUG "Invalid FPDT subtable length %u.\n", length);
+		acpi_os_unmap_memory(subtable_header, sizeof(*subtable_header));
+		return -EINVAL;
+	}
+
 	acpi_os_unmap_memory(subtable_header, sizeof(*subtable_header));
 
 	subtable_header = acpi_os_map_memory(address, length);
@@ -191,17 +198,29 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type)
 
 	offset = sizeof(*subtable_header);
 	while (offset < length) {
-		record_header = (void *)subtable_header + offset;
-		offset += record_header->length;
+		remaining = length - offset;
+		if (remaining < sizeof(*record_header)) {
+			pr_err(FW_BUG "Truncated FPDT record header.\n");
+			result = -EINVAL;
+			goto err;
+		}
 
-		if (!record_header->length) {
-			pr_err(FW_BUG "Zero-length record found in FPTD.\n");
+		record_header = (void *)subtable_header + offset;
+		if (record_header->length < sizeof(*record_header) ||
+		    record_header->length > remaining) {
+			pr_err(FW_BUG "Invalid FPDT record length %u.\n",
+			       record_header->length);
 			result = -EINVAL;
 			goto err;
 		}
+		offset += record_header->length;
 
 		switch (record_header->type) {
 		case RECORD_S3_RESUME:
+			if (record_header->length < sizeof(*record_resume)) {
+				result = -EINVAL;
+				goto err;
+			}
 			if (subtable_type != SUBTABLE_S3PT) {
 				pr_err(FW_BUG "Invalid record %d for subtable %s\n",
 				     record_header->type, signature);
@@ -218,6 +237,10 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type)
 				goto err;
 			break;
 		case RECORD_S3_SUSPEND:
+			if (record_header->length < sizeof(*record_suspend)) {
+				result = -EINVAL;
+				goto err;
+			}
 			if (subtable_type != SUBTABLE_S3PT) {
 				pr_err(FW_BUG "Invalid %d for subtable %s\n",
 				     record_header->type, signature);
@@ -233,6 +256,10 @@ static int fpdt_process_subtable(u64 address, u32 subtable_type)
 				goto err;
 			break;
 		case RECORD_BOOT:
+			if (record_header->length < sizeof(*record_boot)) {
+				result = -EINVAL;
+				goto err;
+			}
 			if (subtable_type != SUBTABLE_FBPT) {
 				pr_err(FW_BUG "Invalid %d for subtable %s\n",
 				     record_header->type, signature);
@@ -289,7 +316,21 @@ static int __init acpi_init_fpdt(void)
 	}
 
 	while (offset < header->length) {
+		if (header->length - offset < sizeof(*subtable)) {
+			pr_err(FW_BUG "Truncated FPDT subtable entry.\n");
+			result = -EINVAL;
+			goto err_subtable;
+		}
+
 		subtable = (void *)header + offset;
+		if (subtable->length < sizeof(*subtable) ||
+		    subtable->length > header->length - offset) {
+			pr_err(FW_BUG "Invalid FPDT subtable entry length %u.\n",
+			       subtable->length);
+			result = -EINVAL;
+			goto err_subtable;
+		}
+
 		switch (subtable->type) {
 		case SUBTABLE_FBPT:
 		case SUBTABLE_S3PT:
@@ -302,7 +343,7 @@ static int __init acpi_init_fpdt(void)
 			/* Other types are reserved in ACPI 6.4 spec. */
 			break;
 		}
-		offset += sizeof(*subtable);
+		offset += subtable->length;
 	}
 	return 0;
 err_subtable:

From c3023181ec3ef1eaab7881be6dfa4772bfc965d5 Mon Sep 17 00:00:00 2001
From: Kate Hsuan <hpa@redhat.com>
Date: Fri, 10 Jul 2026 20:51:22 +0800
Subject: [PATCH 0208/1982] ACPI: battery: Sanitise model_number by dropping
 unprintable characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6587dd87595cfae6bf1304cd0cd1df2274424e42 ]

The battery Embedded Controller (EC) may return the model name with
trailing unprintable or non-ASCII characters. For example, on some
systems:

$ cat /sys/class/power_supply/BAT0/model_name
LNV-5B10W51864��

If a non-ASCII or an unprintable character is found, it will be
replaced with '\0' to ensure the model_number is a valid string.

If left intact, the malformed string prevents udev rules and hwdb
working correctly.

Link: https://gitlab.freedesktop.org/upower/upower/-/work_items/345
Signed-off-by: Kate Hsuan <hpa@redhat.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260710125122.1621877-1-hpa@redhat.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/battery.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 296c2981b1a737..0b922aceb28d1b 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -10,6 +10,7 @@
 
 #define pr_fmt(fmt) "ACPI: battery: " fmt
 
+#include <linux/ctype.h>
 #include <linux/delay.h>
 #include <linux/dmi.h>
 #include <linux/jiffies.h>
@@ -486,6 +487,15 @@ static int acpi_battery_get_status(struct acpi_battery *battery)
 	return 0;
 }
 
+static void acpi_battery_clean_unprintable_chars(char *str, size_t length)
+{
+	for (unsigned int i = 0; i < length; i++) {
+		if (!isascii(str[i]) || !isprint(str[i])) {
+			str[i] = '\0';
+			break;
+		}
+	}
+}
 
 static int extract_battery_info(const int use_bix,
 			 struct acpi_battery *battery,
@@ -527,6 +537,10 @@ static int extract_battery_info(const int use_bix,
 	    battery->capacity_now > battery->full_charge_capacity)
 		battery->capacity_now = battery->full_charge_capacity;
 
+	if (!result)
+		acpi_battery_clean_unprintable_chars(battery->model_number,
+					ARRAY_SIZE(battery->model_number));
+
 	return result;
 }
 

From 745d9352ec80a76ca7e25f304c65ce69c9f1ec14 Mon Sep 17 00:00:00 2001
From: Yap Weei Choong <ywc8891@gmail.com>
Date: Fri, 17 Jul 2026 14:07:45 +0800
Subject: [PATCH 0209/1982] platform/x86/amd/pmc: Add T14 Gen2 AMD (20XL) to
 s2idle quirk list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e25fb2258bddbcf70df69d1358be3e1274bdc5f2 ]

The ThinkPad T14 Gen 2 AMD was sold under two machine types, 20XK and
20XL, but only 20XK has been in the s2idle quirk list since the quirk
was introduced in commit 455cd867b85b ("platform/x86: thinkpad_acpi:
Add a s2idle resume quirk for a number of laptops").

On 20XL machines the firmware SMI handler therefore still runs on the
NVMe D3->D0 transition when exiting suspend-to-idle. With IOMMU
translation enabled (the default), this intermittently stalls resume
for ~10.25 seconds: seven devices across three root ports (nvme, both
xhci_hcd functions, xhci-pci-renesas, snd_hda_intel x2, snd_rn_pci_acp3x)
block in pci_pm_resume_noirq and are released simultaneously, consistent
with all cores being held in SMM.

Add the missing 20XL machine type, mirroring the existing 20XK entry.
This is the same class of omission fixed by commit 9a469c6dfab3
("platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle
quirk list").

Verified on a ThinkPad T14 Gen 2a (type 20XLS41C00, BIOS R1MET62W 1.32,
kernel 6.12.95): with this entry the quirk message appears at probe and
a 14-hour suspend resumes in ~1s with no noirq stalls, where previously
even short suspends could hit the ~10s delay. A further two-day soak
(short naps and two ~14-hour suspends) showed every resume clean.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221755
Signed-off-by: Yap Weei Choong <ywc8891@gmail.com>
Tested-by: Yap Weei Choong <ywc8891@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20260717060744.1252065-2-ywc8891@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
index 74ddf1d8289a90..09a30f33375964 100644
--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
+++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
@@ -71,6 +71,14 @@ static const struct dmi_system_id fwbug_list[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "20XK"),
 		}
 	},
+	{
+		.ident = "T14 Gen2 AMD",
+		.driver_data = &quirk_s2idle_spurious_8042,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "20XL"),
+		}
+	},
 	{
 		.ident = "T14 Gen1 AMD",
 		.driver_data = &quirk_s2idle_spurious_8042,

From dc40b64d04f80fee740f322a969593f4b5d44dff Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun@linux.alibaba.com>
Date: Mon, 8 Jun 2026 19:11:49 +0800
Subject: [PATCH 0210/1982] ext4: reduce max cluster size to match documented
 256MB limit

[ Upstream commit afa3caf2fbc417f755f36e271c4b3c2d45ccda9d ]

The mke2fs man page documents:

  Valid cluster-size values are from 2048 to 256M bytes per cluster.

but EXT4_MAX_CLUSTER_LOG_SIZE was set to 30 (1GB), allowing crafted
filesystem images to specify cluster sizes up to 1GB.

On 32-bit systems with bigalloc enabled, the consistency check in
ext4_handle_clustersize():

  s_blocks_per_group == s_clusters_per_group * (clustersize / blocksize)

can overflow when the cluster ratio is large enough. Since
s_blocks_per_group is not range-checked in the bigalloc path, the
wrapped product can pass the consistency check, leading to inconsistent
group geometry and potential out-of-bounds block allocation.

Reduce EXT4_MAX_CLUSTER_LOG_SIZE to 28 to match the documented 256MB
limit. With this cap, the maximum product is:

  (blocksize * 8) * (256M / blocksize) = 2^31

which fits safely in a 32-bit unsigned long for all block sizes.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260608061112.392391-1-libaokun%40linux.alibaba.com
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://patch.msgid.link/20260608111150.827117-3-libaokun@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/ext4.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index dae7fb8bc598e3..ed546c52ebc321 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -334,7 +334,7 @@ struct ext4_io_submit {
 #define	EXT4_MAX_BLOCK_SIZE		65536
 #define EXT4_MIN_BLOCK_LOG_SIZE		10
 #define EXT4_MAX_BLOCK_LOG_SIZE		16
-#define EXT4_MAX_CLUSTER_LOG_SIZE	30
+#define EXT4_MAX_CLUSTER_LOG_SIZE	28
 #ifdef __KERNEL__
 # define EXT4_BLOCK_SIZE(s)		((s)->s_blocksize)
 #else

From 72b2bf5592438867fd25cdadd46d42d00fb7ab41 Mon Sep 17 00:00:00 2001
From: Ali Alaei <ali.alaei.tabatabaei@gmail.com>
Date: Sun, 28 Jun 2026 16:34:50 +0200
Subject: [PATCH 0211/1982] PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow
 Lake-HX

[ Upstream commit 72b32eccbcd591b9606edacf3bd7c455176d7660 ]

On Intel Arrow Lake-HX systems (e.g. Core Ultra 9 275HX on Acer Predator
PH16-73), the VMD controller reports BUS_RESTRICT_CFG = 3 in the VMCONFIG
register. The existing switch statement only handled values 0, 1, and 2,
causing vmd_get_bus_number_start() to return -ENODEV and aborting the
entire VMD probe. This leaves NVMe drives behind the VMD controller
invisible to the kernel.

Hardware registers (VMCAP/VMCONFIG at offsets 0x40/0x44):

  VMD 0000:00:0e.0 (8086:ad0b): VMCAP=0x000f, VMCONFIG=0x03b8
  BUS_RESTRICT_CFG(0x03b8) = (0x03b8 >> 8) & 0x3 = 3

Add cfg=3 as a fallthrough to cfg=2, setting busn_start=224, which is
the correct bus number base for this hardware.

Also add a PCI_POSSIBLE_ERROR() guard after reading VMCONFIG: a failed
config space read returns 0xFFFF, and BUS_RESTRICT_CFG(0xFFFF) = 3,
so without this guard a removed or errored device would falsely match
the new case 3 instead of being caught as an error.

Reported-by: Lin Mohan <linmhwork@outlook.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221137 # Arrow-Lake-S
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221136 # Arrow-Lake-S
Signed-off-by: Ali Alaei <ali.alaei.tabatabaei@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260628143450.92492-1-ali.alaei.tabatabaei@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/vmd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index b4b62b9ccc45a0..5d3e6cc7e4feb4 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -656,6 +656,8 @@ static int vmd_get_bus_number_start(struct vmd_dev *vmd)
 	pci_read_config_word(dev, PCI_REG_VMCAP, &reg);
 	if (BUS_RESTRICT_CAP(reg)) {
 		pci_read_config_word(dev, PCI_REG_VMCONFIG, &reg);
+		if (PCI_POSSIBLE_ERROR(reg))
+			return -ENODEV;
 
 		switch (BUS_RESTRICT_CFG(reg)) {
 		case 0:
@@ -664,6 +666,7 @@ static int vmd_get_bus_number_start(struct vmd_dev *vmd)
 		case 1:
 			vmd->busn_start = 128;
 			break;
+		case 3:
 		case 2:
 			vmd->busn_start = 224;
 			break;

From 6166f19a699540a7ef8bf424df6c192813b2344a Mon Sep 17 00:00:00 2001
From: Yun Zhou <yun.zhou@windriver.com>
Date: Tue, 23 Jun 2026 14:19:03 +0800
Subject: [PATCH 0212/1982] ext4: set EXT4_STATE_NO_EXPAND in ext4_evict_inode

[ Upstream commit 2c0e4fb511f97467dafc91b6afb3414100289081 ]

An inode being evicted will never need its extra isize expanded.  Set
EXT4_STATE_NO_EXPAND before ext4_mark_inode_dirty() in ext4_evict_inode()
to make this explicit and prevent any unnecessary work in
ext4_try_to_expand_extra_isize().

This also provides defense-in-depth for the s_writepages_rwsem deadlock
during mount-time orphan cleanup, ensuring the expand path is blocked
for inodes under eviction regardless of how they are reached.

Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260623061903.2148767-2-yun.zhou@windriver.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index bbc437be5e63b5..9a5c08650bd1ef 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -261,6 +261,7 @@ void ext4_evict_inode(struct inode *inode)
 	if (ext4_inode_is_fast_symlink(inode))
 		memset(EXT4_I(inode)->i_data, 0, sizeof(EXT4_I(inode)->i_data));
 	inode->i_size = 0;
+	ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 	err = ext4_mark_inode_dirty(handle, inode);
 	if (err) {
 		ext4_warning(inode->i_sb,

From 6e0ea620b21961a82fbce5a006c7d8e34de0e952 Mon Sep 17 00:00:00 2001
From: Shahar Tzarfati <shahar.tzarfati@intel.com>
Date: Wed, 15 Jul 2026 21:27:43 +0300
Subject: [PATCH 0213/1982] wifi: mac80211: ibss: read deauth reason_code after
 frame length check

[ Upstream commit aa4c0a649903567762edf2bbc7fff608953b3ca4 ]

The function was reading reason_code from the frame before validating
that the frame is at least IEEE80211_DEAUTH_FRAME_LEN bytes long.

Move the reason_code read to after the length check so the field is
guaranteed to be present before it is accessed.

Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715212706.db26604650bd.I2caa73c396b8c9d357224b9334d5df3cafac498e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/ibss.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6ca2ff354e7681..4dc748a667a722 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -910,11 +910,13 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
 					  struct ieee80211_mgmt *mgmt,
 					  size_t len)
 {
-	u16 reason = le16_to_cpu(mgmt->u.deauth.reason_code);
+	u16 reason;
 
 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
 		return;
 
+	reason = le16_to_cpu(mgmt->u.deauth.reason_code);
+
 	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
 	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
 	sta_info_destroy_addr(sdata, mgmt->sa);

From a6caf23bbbd01dfb33d121a6293ac93b5b329983 Mon Sep 17 00:00:00 2001
From: Zhao Li <enderaoelyther@gmail.com>
Date: Thu, 9 Jul 2026 03:59:04 +0800
Subject: [PATCH 0214/1982] wifi: mac80211_hwsim: clear PMSR request state on
 abort

[ Upstream commit 37a77bd1395e8261d1760ae39c7f5eb637300550 ]

mac80211_hwsim saves the in-flight cfg80211 PMSR request and its wdev
in data->pmsr_request / data->pmsr_request_wdev when a measurement
starts, and clears them only when it reports completion.

mac80211_hwsim_abort_pmsr() never cleared that saved state. cfg80211
owns the request and frees it once the abort callback returns
(cfg80211_pmsr_process_abort() calls rdev_abort_pmsr() then
kfree(req)), so after an abort data->pmsr_request dangles. A later
hwsim PMSR report then dereferences the freed request in
hwsim_pmsr_report_nl() and completes it; a use-after-free.

Clear data->pmsr_request and data->pmsr_request_wdev once the abort
matches the active request. Move the wmediumd/virtio notification check
below the clear so the saved state is dropped even when no notification
is sent.

Assisted-by: Codex:gpt-5
Assisted-by: Claude:opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260708195911.84365-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/virtual/mac80211_hwsim.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 484198766efda1..89794c724858cb 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -3654,9 +3654,6 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
 	int err = 0;
 
 	data = hw->priv;
-	_portid = READ_ONCE(data->wmediumd);
-	if (!_portid && !hwsim_virtio_enabled)
-		return;
 
 	mutex_lock(&data->mutex);
 
@@ -3665,6 +3662,13 @@ static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
 		goto out;
 	}
 
+	data->pmsr_request = NULL;
+	data->pmsr_request_wdev = NULL;
+
+	_portid = READ_ONCE(data->wmediumd);
+	if (!_portid && !hwsim_virtio_enabled)
+		goto out;
+
 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (!skb) {
 		err = -ENOMEM;

From 04f44f6885a58b127afb38f5957a9aa2947f9da1 Mon Sep 17 00:00:00 2001
From: Thomas Renninger <trenn@suse.de>
Date: Fri, 17 Jul 2026 08:51:22 +0200
Subject: [PATCH 0215/1982] ACPI: sysfs: Properly map BERT and CCEL data to
 their ACPI tables

[ Upstream commit e45ee607ca6f9f97a2f97be356d844a912971a16 ]

In the case of multiple BERT ACPI tables, one gets:

sysfs: cannot create duplicate filename '/firmware/acpi/tables/data/BERT'

This is because both:

/firmware/acpi/tables/BERT1
/firmware/acpi/tables/BERT2

are attempted to be mapped to the same data table:

/firmware/acpi/tables/data/BERT

Address this problem by passing and using the same filename for data
tables.

Signed-off-by: Thomas Renninger <trenn@suse.de>
Reported-by: Michal Suchanek <msuchanek@suse.com>
Closes: https://bugzilla.suse.com/show_bug.cgi?id=1270211
[ rjw: Subject and changelog edits ]
Link: https://patch.msgid.link/20260717065129.72924-3-trenn@suse.de
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/sysfs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index e596224302f4c8..d8d04437f63d6a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -316,6 +316,7 @@ struct acpi_table_attr {
 struct acpi_data_attr {
 	struct bin_attribute attr;
 	u64	addr;
+	char filename[ACPI_NAMESEG_SIZE+ACPI_INST_SIZE];
 };
 
 static ssize_t acpi_table_show(struct file *filp, struct kobject *kobj,
@@ -453,7 +454,6 @@ static int acpi_bert_data_init(void *th, struct acpi_data_attr *data_attr)
 	}
 	data_attr->addr = bert->address;
 	data_attr->attr.size = bert->region_length;
-	data_attr->attr.attr.name = "BERT";
 
 	return sysfs_create_bin_file(tables_data_kobj, &data_attr->attr);
 }
@@ -469,7 +469,6 @@ static int acpi_ccel_data_init(void *th, struct acpi_data_attr *data_attr)
 	}
 	data_attr->addr = ccel->log_area_start_address;
 	data_attr->attr.size = ccel->log_area_minimum_length;
-	data_attr->attr.attr.name = "CCEL";
 
 	return sysfs_create_bin_file(tables_data_kobj, &data_attr->attr);
 }
@@ -484,7 +483,7 @@ static struct acpi_data_obj {
 
 #define NUM_ACPI_DATA_OBJS ARRAY_SIZE(acpi_data_objs)
 
-static int acpi_table_data_init(struct acpi_table_header *th)
+static int acpi_table_data_init(struct acpi_table_header *th, struct acpi_table_attr *table_attr)
 {
 	struct acpi_data_attr *data_attr;
 	int i;
@@ -497,6 +496,8 @@ static int acpi_table_data_init(struct acpi_table_header *th)
 			sysfs_attr_init(&data_attr->attr.attr);
 			data_attr->attr.read = acpi_data_show;
 			data_attr->attr.attr.mode = 0400;
+			strscpy(data_attr->filename, table_attr->filename);
+			data_attr->attr.attr.name = data_attr->filename;
 			return acpi_data_objs[i].fn(th, data_attr);
 		}
 	}
@@ -543,7 +544,7 @@ static int acpi_tables_sysfs_init(void)
 			return ret;
 		}
 		list_add_tail(&table_attr->node, &acpi_table_attr_list);
-		acpi_table_data_init(table_header);
+		acpi_table_data_init(table_header, table_attr);
 	}
 
 	kobject_uevent(tables_kobj, KOBJ_ADD);

From 5a83f99967922fb27e2e62b861d0f62bfabcc452 Mon Sep 17 00:00:00 2001
From: Kuan-Wei Chiu <visitorckw@gmail.com>
Date: Tue, 14 Jul 2026 00:24:49 +0000
Subject: [PATCH 0216/1982] riscv, bpf: Add support for BPF_SDIV and BPF_SMOD
 in RV32 JIT

[ Upstream commit 2e0fa2389c50fd3a69bb738efa74e127b7516938 ]

The current rv32 bpf jit compiler incorrectly treats BPF_SDIV and
BPF_SMOD as unsigned operations. The BPF instruction set allows
signed division and modulo by reusing the BPF_DIV and BPF_MOD opcodes
with the instruction offset set to 1.

Update the emit_alu_r32() function to accept an 'is_sdiv' variable and
emit the correct div and rem instructions when the offset is 1.

Before this patch:
[   44.161771] test_bpf: #165 ALU_SDIV_X: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times)
[   44.167385] test_bpf: #166 ALU_SDIV_K: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times)
[   44.171053] test_bpf: #169 ALU_SMOD_X: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times)
[   44.172081] test_bpf: #170 ALU_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times)

After this patch:
[   16.002192] test_bpf: #165 ALU_SDIV_X: -6 / 2 = -3 jited:1 95 PASS
[   16.002983] test_bpf: #166 ALU_SDIV_K: -6 / 2 = -3 jited:1 1059 PASS
[   16.017167] test_bpf: #169 ALU_SMOD_X: -7 % 2 = -1 jited:1 136 PASS
[   16.023002] test_bpf: #170 ALU_SMOD_K: -7 % 2 = -1 jited:1 109 PASS

Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/bpf/20260714002451.4091139-2-visitorckw@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/net/bpf_jit_comp32.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp32.c b/arch/riscv/net/bpf_jit_comp32.c
index 592dd86fbf811a..89153946a4e467 100644
--- a/arch/riscv/net/bpf_jit_comp32.c
+++ b/arch/riscv/net/bpf_jit_comp32.c
@@ -509,12 +509,15 @@ static void emit_alu_r64(const s8 *dst, const s8 *src,
 }
 
 static void emit_alu_r32(const s8 *dst, const s8 *src,
-			 struct rv_jit_context *ctx, const u8 op)
+			 struct rv_jit_context *ctx,
+			 const struct bpf_insn *insn)
 {
 	const s8 *tmp1 = bpf2rv32[TMP_REG_1];
 	const s8 *tmp2 = bpf2rv32[TMP_REG_2];
 	const s8 *rd = bpf_get_reg32(dst, tmp1, ctx);
 	const s8 *rs = bpf_get_reg32(src, tmp2, ctx);
+	u8 op = BPF_OP(insn->code);
+	bool is_signed = insn->off == 1;
 
 	switch (op) {
 	case BPF_MOV:
@@ -539,10 +542,12 @@ static void emit_alu_r32(const s8 *dst, const s8 *src,
 		emit(rv_mul(lo(rd), lo(rd), lo(rs)), ctx);
 		break;
 	case BPF_DIV:
-		emit(rv_divu(lo(rd), lo(rd), lo(rs)), ctx);
+		emit(is_signed ? rv_div(lo(rd), lo(rd), lo(rs)) :
+				 rv_divu(lo(rd), lo(rd), lo(rs)), ctx);
 		break;
 	case BPF_MOD:
-		emit(rv_remu(lo(rd), lo(rd), lo(rs)), ctx);
+		emit(is_signed ? rv_rem(lo(rd), lo(rd), lo(rs)) :
+				 rv_remu(lo(rd), lo(rd), lo(rs)), ctx);
 		break;
 	case BPF_LSH:
 		emit(rv_sll(lo(rd), lo(rd), lo(rs)), ctx);
@@ -1041,7 +1046,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 			emit_imm32(tmp2, imm, ctx);
 			src = tmp2;
 		}
-		emit_alu_r32(dst, src, ctx, BPF_OP(code));
+		emit_alu_r32(dst, src, ctx, insn);
 		break;
 
 	case BPF_ALU | BPF_MOV | BPF_K:
@@ -1065,7 +1070,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 		 * src is ignored---choose tmp2 as a dummy register since it
 		 * is not on the stack.
 		 */
-		emit_alu_r32(dst, tmp2, ctx, BPF_OP(code));
+		emit_alu_r32(dst, tmp2, ctx, insn);
 		break;
 
 	case BPF_ALU | BPF_END | BPF_FROM_LE:

From 16b873971b929db92ec0cadd9a2eb5d269561ae8 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 14:31:05 +0800
Subject: [PATCH 0217/1982] power: supply: cros_pchg: unregister EC notifier

[ Upstream commit 631adfa03595c63b2a621cdc62db60bb1ce5f91c ]

cros_pchg_probe() registers an EC event notifier whose callback uses the
devm-allocated charger_data via container_of().  The driver has no
remove callback and does not unregister the notifier, so the notifier
chain can retain a pointer to freed driver state after unbind or probe
cleanup.

Register a devm cleanup action immediately after the notifier is
installed so the notifier is unregistered before the driver state is
released.  Also fail probe if the notifier cannot be registered, instead
of leaving a charger device that cannot receive EC events.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20260615063105.39152-1-pengpeng@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/cros_peripheral_charger.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/cros_peripheral_charger.c b/drivers/power/supply/cros_peripheral_charger.c
index 962a6fd298323e..48e10e872d1bda 100644
--- a/drivers/power/supply/cros_peripheral_charger.c
+++ b/drivers/power/supply/cros_peripheral_charger.c
@@ -259,6 +259,14 @@ static int cros_ec_notify(struct notifier_block *nb,
 	return cros_pchg_event(charger);
 }
 
+static void cros_pchg_unregister_notifier(void *data)
+{
+	struct charger_data *charger = data;
+
+	blocking_notifier_chain_unregister(&charger->ec_device->event_notifier,
+					   &charger->notifier);
+}
+
 static int cros_pchg_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -346,9 +354,10 @@ static int cros_pchg_probe(struct platform_device *pdev)
 	ret = blocking_notifier_chain_register(&ec_dev->ec_dev->event_notifier,
 					       nb);
 	if (ret < 0)
-		dev_err(dev, "Failed to register notifier (err:%d)\n", ret);
+		return dev_err_probe(dev, ret, "Failed to register notifier\n");
 
-	return 0;
+	return devm_add_action_or_reset(dev, cros_pchg_unregister_notifier,
+					charger);
 }
 
 #ifdef CONFIG_PM_SLEEP

From 9fd6abedac7937edf7e9111cbabbd38defd45b75 Mon Sep 17 00:00:00 2001
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Sun, 19 Jul 2026 12:01:55 +0200
Subject: [PATCH 0218/1982] net: sfp: add quirk for HORACO copper SFP+ module

[ Upstream commit 1bb028baab541900d3603d4f93c1c0fb5aba5401 ]

Add quirk for a copper SFP+ module that identifies itself as "OEM"
"HC-10GE-113C". It uses RollBall protocol to talk to the PHY.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20260719100158.874882-1-olek2@wp.pl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/sfp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index af43530ffb2c3c..195468bde2f290 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -576,6 +576,9 @@ static const struct sfp_quirk sfp_quirks[] = {
 
 	SFP_QUIRK_F("YV", "SFP+ONU-XGSPON", sfp_fixup_potron),
 
+	// HORACO HC-10GE-113C uses Rollball protocol to talk to the PHY.
+	SFP_QUIRK_F("OEM", "HC-10GE-113C", sfp_fixup_rollball),
+
 	// OEM SFP-GE-T is a 1000Base-T module with broken TX_FAULT indicator
 	SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
 

From 71d4ef0a0b274d7a6e91bb829f970dd9b6bc0a9e Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Sat, 11 Jul 2026 09:54:02 +0900
Subject: [PATCH 0219/1982] net: prestera: ignore duplicate RIF destruction
 events

[ Upstream commit 3cbbc9fa33382d03f2813118e672eb318eba9cde ]

During address teardown, the inetaddr notifier may be called multiple
times for the same interface. Ignore NETDEV_DOWN events if the RIF has
already been destroyed, rather than returning -EEXIST, which aborts the
notifier chain.

Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Link: https://patch.msgid.link/20260711005405.2861680-2-yuyanghuang@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/prestera/prestera_router.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c
index de317179a7dcc7..e36d023fe9c308 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_router.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c
@@ -1302,10 +1302,8 @@ static int __prestera_inetaddr_port_event(struct net_device *port_dev,
 		dev_hold(port_dev);
 		break;
 	case NETDEV_DOWN:
-		if (!re) {
-			NL_SET_ERR_MSG_MOD(extack, "Can't find RIF");
-			return -EEXIST;
-		}
+		if (!re)
+			return 0;
 		prestera_rif_entry_destroy(port->sw, re);
 		dev_put(port_dev);
 		break;

From da882736cbedab84a780b5fc0c8a52ddcee1f95a Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:23:36 +0800
Subject: [PATCH 0220/1982] power: reset: piix4-poweroff: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit ffefc5d9a052f67bc87b57d1107fd7cc1fa1a3d4 ]

The driver has a match table for the pci bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704152336.51384-1-pengpeng@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/reset/piix4-poweroff.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/reset/piix4-poweroff.c b/drivers/power/reset/piix4-poweroff.c
index e6822c02100003..1a6f3d22d29746 100644
--- a/drivers/power/reset/piix4-poweroff.c
+++ b/drivers/power/reset/piix4-poweroff.c
@@ -96,6 +96,7 @@ static const struct pci_device_id piix4_poweroff_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3) },
 	{ 0 },
 };
+MODULE_DEVICE_TABLE(pci, piix4_poweroff_ids);
 
 static struct pci_driver piix4_poweroff_driver = {
 	.name		= "piix4-poweroff",

From b3bec69dd24dd65f0cfdbf17207f7a43ff5995ef Mon Sep 17 00:00:00 2001
From: Kuan-Wei Chiu <visitorckw@gmail.com>
Date: Tue, 14 Jul 2026 00:24:50 +0000
Subject: [PATCH 0221/1982] riscv, bpf: Add support for BPF_MOVSX in RV32 JIT

[ Upstream commit c6a08afdfe3a81b1a54e921921e9481dd6c78f8a ]

The current rv32 bpf jit compiler incorrectly treats BPF_MOVSX as a
standard zero-extended move operation. The bpf instruction set allows
sign-extension moves by reusing the BPF_MOV opcode with the instruction
offset set to 8, 16, or 32.

Update the bpf_jit_emit_insn() function to check the offset field for
both ALU and ALU64 MOV operations. If the offset is non-zero, emit the
correct slli and srai instructions to perform the sign extension.

Before this patch:
[   19.549705] test_bpf: #82 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
[   19.551354] test_bpf: #83 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
[   19.552576] test_bpf: #84 ALU64_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
[   19.553542] test_bpf: #85 ALU64_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
[   19.554807] test_bpf: #86 ALU64_MOVSX | BPF_W jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)

After this patch:
[   17.931172] test_bpf: #82 ALU_MOVSX | BPF_B jited:1 125 PASS
[   17.932198] test_bpf: #83 ALU_MOVSX | BPF_H jited:1 124 PASS
[   17.933039] test_bpf: #84 ALU64_MOVSX | BPF_B jited:1 124 PASS
[   17.933918] test_bpf: #85 ALU64_MOVSX | BPF_H jited:1 124 PASS
[   17.934751] test_bpf: #86 ALU64_MOVSX | BPF_W jited:1 122 PASS

Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/bpf/20260714002451.4091139-3-visitorckw@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/net/bpf_jit_comp32.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/arch/riscv/net/bpf_jit_comp32.c b/arch/riscv/net/bpf_jit_comp32.c
index 89153946a4e467..39e2b0b907dc37 100644
--- a/arch/riscv/net/bpf_jit_comp32.c
+++ b/arch/riscv/net/bpf_jit_comp32.c
@@ -972,6 +972,24 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 
 	switch (code) {
 	case BPF_ALU64 | BPF_MOV | BPF_X:
+		if (insn->off != 0) {
+			const s8 *rd = bpf_get_reg64(dst, tmp1, ctx);
+			const s8 *rs = bpf_get_reg64(src, tmp2, ctx);
+
+			if (insn->off == 8) {
+				emit(rv_slli(lo(rd), lo(rs), 24), ctx);
+				emit(rv_srai(lo(rd), lo(rd), 24), ctx);
+			} else if (insn->off == 16) {
+				emit(rv_slli(lo(rd), lo(rs), 16), ctx);
+				emit(rv_srai(lo(rd), lo(rd), 16), ctx);
+			} else {
+				emit(rv_addi(lo(rd), lo(rs), 0), ctx);
+			}
+			emit(rv_srai(hi(rd), lo(rd), 31), ctx);
+			bpf_put_reg64(dst, rd, ctx);
+			break;
+		}
+		fallthrough;
 
 	case BPF_ALU64 | BPF_ADD | BPF_X:
 	case BPF_ALU64 | BPF_ADD | BPF_K:
@@ -1022,6 +1040,20 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 			emit_zext64(dst, ctx);
 			break;
 		}
+		if (insn->off != 0) {
+			const s8 *rd = bpf_get_reg32(dst, tmp1, ctx);
+			const s8 *rs = bpf_get_reg32(src, tmp2, ctx);
+
+			if (insn->off == 8) {
+				emit(rv_slli(lo(rd), lo(rs), 24), ctx);
+				emit(rv_srai(lo(rd), lo(rd), 24), ctx);
+			} else if (insn->off == 16) {
+				emit(rv_slli(lo(rd), lo(rs), 16), ctx);
+				emit(rv_srai(lo(rd), lo(rd), 16), ctx);
+			}
+			bpf_put_reg32(dst, rd, ctx);
+			break;
+		}
 		fallthrough;
 
 	case BPF_ALU | BPF_ADD | BPF_X:

From 131d675880a856791088a72b08421db5d9a70200 Mon Sep 17 00:00:00 2001
From: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Date: Tue, 21 Jul 2026 15:39:58 +1000
Subject: [PATCH 0222/1982] wifi: cfg80211: include cf1 offset when sending
 chandef

[ Upstream commit 5a69b8dffd2a1b06e4cc4c9003c639eb78bac4cd ]

The cf1 offset is not included when sending the chandef leading
to incorrect channel resolution in usermode. Include it.

Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Link: https://patch.msgid.link/20260721053958.227853-1-lachlan.hodges@morsemicro.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b851e398b1b360..6ebbb16accfe84 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4260,6 +4260,10 @@ int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *ch
 		return -ENOBUFS;
 	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
 		return -ENOBUFS;
+	if (chandef->freq1_offset &&
+	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1_OFFSET,
+			chandef->freq1_offset))
+		return -ENOBUFS;
 	if (chandef->center_freq2 &&
 	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
 		return -ENOBUFS;

From 7a56475bb968c144c3e1fde2809bc5544af4fff6 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun@linux.alibaba.com>
Date: Mon, 8 Jun 2026 19:11:48 +0800
Subject: [PATCH 0223/1982] ext4: reject mount if clusters/inodes per group are
 not 8-aligned

[ Upstream commit d42dc7726a003262b73ffef2b744ff57a5488799 ]

The block and inode bitmap checksums are computed over a whole number of
bytes: ext4_inode_bitmap_csum_*() use EXT4_INODES_PER_GROUP(sb) >> 3 and
ext4_block_bitmap_csum_*() use EXT4_CLUSTERS_PER_GROUP(sb) / 8 as the
length passed to ext4_chksum().

If s_inodes_per_group or s_clusters_per_group is not a multiple of 8, the
trailing fractional bits are excluded from the checksum.  Those bits are
then unprotected, and any incremental csum update path that assumes a
byte-aligned bitmap can compute a checksum inconsistent with the full
recalculation, corrupting the on-disk bitmap checksum.

Reject such filesystems at mount time by adding the missing " & 7"
alignment checks alongside the existing range validation.

Suggested-by: Theodore Ts'o <tytso@mit.edu>
Link: https://patch.msgid.link/h3n7jlfhyna64dn5o76qxcspnhxdddcs6crpxftmy7gnl7b3sx@jenszfpcsnit
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260508121539.4174601-1-libaokun%40linux.alibaba.com?part=10
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260608111150.827117-2-libaokun@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/super.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 3f5e9d825a5e62..b4ff7e692986b8 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4439,8 +4439,9 @@ static int ext4_handle_clustersize(struct super_block *sb)
 		sbi->s_cluster_bits = 0;
 	}
 	sbi->s_clusters_per_group = le32_to_cpu(es->s_clusters_per_group);
-	if (sbi->s_clusters_per_group > sb->s_blocksize * 8) {
-		ext4_msg(sb, KERN_ERR, "#clusters per group too big: %lu",
+	if (sbi->s_clusters_per_group > sb->s_blocksize * 8 ||
+	    sbi->s_clusters_per_group & 7) {
+		ext4_msg(sb, KERN_ERR, "invalid #clusters per group: %lu",
 			 sbi->s_clusters_per_group);
 		return -EINVAL;
 	}
@@ -5238,8 +5239,9 @@ static int ext4_block_group_meta_init(struct super_block *sb, int silent)
 		return -EINVAL;
 	}
 	if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
-	    sbi->s_inodes_per_group > sb->s_blocksize * 8) {
-		ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n",
+	    sbi->s_inodes_per_group > sb->s_blocksize * 8 ||
+	    sbi->s_inodes_per_group & 7) {
+		ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu",
 			 sbi->s_inodes_per_group);
 		return -EINVAL;
 	}

From 4061582141c0d0052e8750498c2afeb2303b099d Mon Sep 17 00:00:00 2001
From: Esteban Urrutia <esteuwu@proton.me>
Date: Sat, 11 Jul 2026 23:14:01 -0400
Subject: [PATCH 0224/1982] iommu/arm-smmu-qcom: Add SM8450 MDSS compatible

[ Upstream commit d149c8b2c0146a01f1be326ddb1e182b55aee638 ]

Add the compatible for the MDSS client on the Snapdragon 8 Gen 1 so it can
be properly configured by the IOMMU driver.

Otherwise, there is an unhandled context fault, because the framebuffer is
already configured in UEFI.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Esteban Urrutia <esteuwu@proton.me>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index f7cb7de80cfb96..b6493e92343bec 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -394,6 +394,7 @@ static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = {
 	{ .compatible = "qcom,sm6375-mdss" },
 	{ .compatible = "qcom,sm8150-mdss" },
 	{ .compatible = "qcom,sm8250-mdss" },
+	{ .compatible = "qcom,sm8450-mdss" },
 	{ .compatible = "qcom,x1e80100-mdss" },
 	{ }
 };

From 6a0f6531a327014db8c1afb255e66c25ae4e41f3 Mon Sep 17 00:00:00 2001
From: Heiko Schocher <hs@nabladev.com>
Date: Tue, 21 Jul 2026 06:19:32 +0200
Subject: [PATCH 0225/1982] drm/panel: simple: Add Kyocera tcg070wvlq panel

[ Upstream commit 900517da69afca6f72dacf14278aee3b65275507 ]

Commit 922fb2db0287 ("dt-bindings: display: simple: Add Kyocera
tcg070wvlq panel") added the compatible string for the Kyocera
tcg070wvlq panel to the devicetree bindings documentation
(panel-simple.yaml), but the corresponding entry was not added
to the panel-simple driver.

Add the missing compatible entry to the driver.

Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260721041935.757240-1-hs@nabladev.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 878a5dc7748fb3..c784f67f58fa47 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -5245,6 +5245,9 @@ static const struct of_device_id platform_of_match[] = {
 	}, {
 		.compatible = "koe,tx31d200vm0baa",
 		.data = &koe_tx31d200vm0baa,
+	}, {
+		.compatible = "kyo,tcg070wvlq",
+		.data = &lg_lb070wv8,
 	}, {
 		.compatible = "kyo,tcg121xglp",
 		.data = &kyo_tcg121xglp,

From 34e6afb88d0212e34643b1455d8030ba32034cbc Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Date: Fri, 17 Jul 2026 20:16:05 +0530
Subject: [PATCH 0226/1982] iommu/qcom: Check pm_runtime_resume_and_get()
 return in probe

[ Upstream commit e910315ae08a23bc953daed10b1c518abac1df49 ]

The SMMU_INTR_SEL_NS register write in qcom_iommu_device_probe() uses
pm_runtime_get_sync() without checking the return value. If runtime
resume fails the subsequent writel_relaxed() would access hardware with
clocks potentially disabled.

Switch to pm_runtime_resume_and_get() which handles the usage-count
cleanup on failure, check the return value, and unwind the already
registered iommu device on error.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm/arm-smmu/qcom_iommu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index 9bee85259c69e9..fbe4bd3ec0c42d 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -863,13 +863,17 @@ static int qcom_iommu_device_probe(struct platform_device *pdev)
 	}
 
 	if (qcom_iommu->local_base) {
-		pm_runtime_get_sync(dev);
+		ret = pm_runtime_resume_and_get(dev);
+		if (ret)
+			goto err_iommu_unregister;
 		writel_relaxed(0xffffffff, qcom_iommu->local_base + SMMU_INTR_SEL_NS);
 		pm_runtime_put_sync(dev);
 	}
 
 	return 0;
 
+err_iommu_unregister:
+	iommu_device_unregister(&qcom_iommu->iommu);
 err_sysfs_remove:
 	iommu_device_sysfs_remove(&qcom_iommu->iommu);
 err_pm_disable:

From f8cd002bb33edcd44058dbd6ed895310dc415477 Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Date: Fri, 17 Jul 2026 20:16:08 +0530
Subject: [PATCH 0227/1982] iommu/qcom: Enable clocks before hardware access in
 qcom_iommu_ctx_probe()

[ Upstream commit cb776a03a53429aa59e25a8cbc3d1a48bd11afdb ]

qcom_iommu_ctx_probe() reads and writes the CB_FSR register to clear any
stale IRQ left by the bootloader. This happens during
devm_of_platform_populate() which is called from the parent device's
probe before any pm_runtime_get(). The parent's clocks (iface, bus, tbu)
are therefore not guaranteed to be on, making the register access
unreliable on rebind or after a suspend cycle.

Use pm_runtime_resume_and_get() on the parent device to ensure clocks
are enabled before the register access, and release the reference
immediately after.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index fbe4bd3ec0c42d..792585321bd117 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -704,8 +704,13 @@ static int qcom_iommu_ctx_probe(struct platform_device *pdev)
 	/* clear IRQs before registering fault handler, just in case the
 	 * boot-loader left us a surprise:
 	 */
-	if (!ctx->secured_ctx)
+	if (!ctx->secured_ctx) {
+		ret = pm_runtime_resume_and_get(dev->parent);
+		if (ret)
+			return ret;
 		iommu_writel(ctx, ARM_SMMU_CB_FSR, iommu_readl(ctx, ARM_SMMU_CB_FSR));
+		pm_runtime_put_sync(dev->parent);
+	}
 
 	ret = devm_request_irq(dev, irq,
 			       qcom_iommu_fault,

From 79b547ff77c32ef6690c0abe8f24f3a155f2d83a Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 15 Jun 2026 14:52:41 +0800
Subject: [PATCH 0228/1982] thermal: intel: int340x: clean up RFIM groups on
 DVFS failure

[ Upstream commit 28f34d7dafa6dfa657efd6760b7c78e98c9b2f6a ]

proc_thermal_rfim_add() can create the FIVR and DLVR sysfs groups
before creating the DVFS group.

If DVFS group creation fails while both earlier groups are enabled, the
current error handling removes only one group: the FIVR branch returns
before the DLVR cleanup branch can run.  This leaves the DLVR group
behind even though RFIM setup fails.

Use one DVFS failure path that removes all previously created RFIM
groups before returning the error.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260615065245.84252-1-pengpeng@iscas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../intel/int340x_thermal/processor_thermal_rfim.c    | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
index 635bc8fded1e9c..2f32b230a4b152 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
@@ -460,12 +460,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
 
 	if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
 		ret = sysfs_create_group(&pdev->dev.kobj, &dvfs_attribute_group);
-		if (ret && proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR) {
-			sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
-			return ret;
-		}
-		if (ret && proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR) {
-			sysfs_remove_group(&pdev->dev.kobj, &dlvr_attribute_group);
+		if (ret) {
+			if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DLVR)
+				sysfs_remove_group(&pdev->dev.kobj, &dlvr_attribute_group);
+			if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
+				sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
 			return ret;
 		}
 	}

From 823403820ab17f587254aa14d10b465386dbd437 Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Date: Fri, 17 Jul 2026 20:16:07 +0530
Subject: [PATCH 0229/1982] iommu/qcom: Publish pgtbl_ops before releasing
 init_mutex

[ Upstream commit a05b67cd45ad09a19f41b2d37255da714512e0ca ]

qcom_domain->pgtbl_ops was assigned after mutex_unlock(). Another thread
calling qcom_iommu_init_domain() would see qcom_domain->iommu already set
(domain fully initialized) and skip re-initialization under the mutex.
If it then called qcom_iommu_map() before the first thread set pgtbl_ops,
it would observe a NULL ops pointer and return -ENODEV for valid mappings.

Move the assignment to before mutex_unlock() so that once the mutex is
released the domain is fully visible to concurrent operations.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm/arm-smmu/qcom_iommu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index 792585321bd117..1a046122fca0de 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -306,13 +306,12 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain,
 		ctx->domain = domain;
 	}
 
-	mutex_unlock(&qcom_domain->init_mutex);
-
 	/* Publish page table ops for map/unmap */
 	qcom_domain->pgtbl_ops = pgtbl_ops;
 
-	return 0;
+	mutex_unlock(&qcom_domain->init_mutex);
 
+	return 0;
 out_clear_iommu:
 	qcom_domain->iommu = NULL;
 out_unlock:

From d4ffdd817e43bae1403ef3430a36e8d776d4222e Mon Sep 17 00:00:00 2001
From: Jiawen Wu <jiawenwu@trustnetic.com>
Date: Mon, 13 Jul 2026 14:04:41 +0800
Subject: [PATCH 0230/1982] net: libwx: disable TX VLAN offload for packets
 with >2 VLAN tags

[ Upstream commit f5cfb576ce39ba5647024c6d6eeb5b7a822fab6e ]

The current hardware does not support TX VLAN offload for packets with
three or more VLAN tags. When such packets are transmitted with hardware
VLAN offload enabled, the hardware may malfunction or produce corrupted
frames.

Add a check in wx_features_check() to parse the VLAN depth of the
skb. If more than two VLAN tags are detected (including both the
hardware tag and in-band tags), strip NETIF_F_HW_VLAN_CTAG_TX and
NETIF_F_HW_VLAN_STAG_TX from the feature set. This forces the
kernel networking stack to handle VLAN insertion in software for
these specific packets, ensuring correct transmission.

Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Link: https://patch.msgid.link/069DF89AA8029189+20260713060441.276612-1-jiawenwu@trustnetic.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/wangxun/libwx/wx_lib.c | 24 +++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/net/ethernet/wangxun/libwx/wx_lib.c b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
index 4a6851612368dc..9be339965a683d 100644
--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
@@ -3193,6 +3193,30 @@ netdev_features_t wx_features_check(struct sk_buff *skb,
 				    netdev_features_t features)
 {
 	struct wx *wx = netdev_priv(netdev);
+	__be16 type = skb->protocol;
+	u16 vlan_depth = ETH_HLEN;
+	u32 vlan_num = 0;
+
+	if (skb_vlan_tag_present(skb))
+		vlan_num++;
+
+	while (eth_type_vlan(type)) {
+		struct vlan_hdr vhdr, *vh;
+
+		vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
+		if (unlikely(!vh))
+			break;
+
+		type = vh->h_vlan_encapsulated_proto;
+		vlan_depth += VLAN_HLEN;
+		vlan_num++;
+
+		if (vlan_num > 2) {
+			features &= ~(NETIF_F_HW_VLAN_CTAG_TX |
+				      NETIF_F_HW_VLAN_STAG_TX);
+			break;
+		}
+	}
 
 	if (!skb->encapsulation)
 		return features;

From e05a1a4ca1db2c2b00c8bb6cf2a6c0f74fafcc38 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 09:10:40 +0800
Subject: [PATCH 0231/1982] wifi: ath11k: validate regulatory capability phy_id

[ Upstream commit f8729a40ebcc94d164be8f154483a21669f3ab52 ]

ath11k_wmi_tlv_ext_hal_reg_caps() copies firmware regulatory
capability records into soc->hal_reg_cap[] using reg_cap.phy_id as
the destination index.  The loop count is bounded by num_phy, but the
phy_id embedded in each record is not checked against the fixed
MAX_RADIOS-sized destination array.

Reject firmware records whose phy_id does not fit soc->hal_reg_cap[]
before copying the parsed capability.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260704011040.26233-1-pengpeng@iscas.ac.cn
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 3305ec66ddbf2b..c6b9e84b169c93 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4816,6 +4816,12 @@ static int ath11k_wmi_tlv_ext_hal_reg_caps(struct ath11k_base *soc,
 			return ret;
 		}
 
+		if (reg_cap.phy_id >= ARRAY_SIZE(soc->hal_reg_cap)) {
+			ath11k_warn(soc, "invalid reg cap phy_id %u\n",
+				    reg_cap.phy_id);
+			return -EINVAL;
+		}
+
 		memcpy(&soc->hal_reg_cap[reg_cap.phy_id],
 		       &reg_cap, sizeof(reg_cap));
 	}

From 213ba5c52564759585bd351c417c47f5e777b3b8 Mon Sep 17 00:00:00 2001
From: Manikanta Pubbisetty <manikanta.pubbisetty@oss.qualcomm.com>
Date: Fri, 10 Jul 2026 11:34:06 +0530
Subject: [PATCH 0232/1982] wifi: ath10k: trigger hardware recovery upon rx
 failures

[ Upstream commit f78210dd4bea09090b828adc2733cad4b9916306 ]

When an error occurs during RX packet processing (e.g., MSDU done
failure), the driver sets rx_confused and drops all subsequent RX
packets until a Wi-Fi ON/OFF cycle clears the flag. This can leave
the device in a bad state where it cannot process RX data traffic.

Instead of leaving the device in such a state, trigger hardware
recovery so that such an error state can be reset and the device
can function again normally.

Tested-on: WCN3990 hw1.0 WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189

Signed-off-by: Manikanta Pubbisetty <manikanta.pubbisetty@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260710060406.3323260-1-manikanta.pubbisetty@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/htt_rx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index d7e429041065ad..e4162d2faae663 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2345,10 +2345,8 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 	if (ret < 0) {
 		ath10k_warn(ar, "rx ring became corrupted: %d\n", ret);
 		__skb_queue_purge(&amsdu);
-		/* FIXME: It's probably a good idea to reboot the
-		 * device instead of leaving it inoperable.
-		 */
 		htt->rx_confused = true;
+		ath10k_core_start_recovery(ar);
 		return ret;
 	}
 
@@ -3313,6 +3311,7 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
 	if (ret < 0) {
 		ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
 		htt->rx_confused = true;
+		ath10k_core_start_recovery(ar);
 		return -EIO;
 	}
 
@@ -3346,6 +3345,7 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
 			ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
 			htt->rx_confused = true;
 			__skb_queue_purge(&list);
+			ath10k_core_start_recovery(ar);
 			return -EIO;
 		}
 	}

From a51500c4d9ac149984bfe9cd921366f30cb6f4c4 Mon Sep 17 00:00:00 2001
From: Alexander Wilhelm <alexander.wilhelm@westermo.com>
Date: Fri, 3 Jul 2026 09:35:38 +0200
Subject: [PATCH 0233/1982] wifi: ath12k: fix scan command endianness on big
 endian

[ Upstream commit 6c90f68f97de591e0413f7d2de59449a0388bbab ]

ath12k_wmi_scan_req_arg stores scan parameters in CPU-native byte order,
while ath12k_wmi_send_scan_start_cmd() writes them into a WMI command
buffer whose contents must be in little-endian format. The existing code
copies the channel list and writes s_ssid and hint_bssid related values to
the command buffer without endian conversion. As a result, scan requests
contain invalid parameters on big-endian systems and fail.

Convert the channel list as well as the s_ssid and hint_bssid related
values to little-endian before writing them to the WMI command buffer. This
preserves the existing behaviour on little-endian systems while fixing scan
requests on big-endian architectures.

Signed-off-by: Alexander Wilhelm <alexander.wilhelm@westermo.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260703-fix-channel-list-copy-v2-1-372c39306d79@westermo.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 20 ++++++++++++--------
 drivers/net/wireless/ath/ath12k/wmi.h | 10 ++++++++++
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 39d5110eca901e..91f293ab701378 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -2666,9 +2666,10 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,
 	struct wmi_tlv *tlv;
 	void *ptr;
 	int i, ret, len;
-	u32 *tmp_ptr, extraie_len_with_pad = 0;
-	struct ath12k_wmi_hint_short_ssid_arg *s_ssid = NULL;
-	struct ath12k_wmi_hint_bssid_arg *hint_bssid = NULL;
+	__le32 *tmp_ptr;
+	u32 extraie_len_with_pad = 0;
+	struct ath12k_wmi_hint_short_ssid_params *s_ssid = NULL;
+	struct ath12k_wmi_hint_bssid_params *hint_bssid = NULL;
 
 	len = sizeof(*cmd);
 
@@ -2751,9 +2752,10 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,
 	tlv = ptr;
 	tlv->header = ath12k_wmi_tlv_hdr(WMI_TAG_ARRAY_UINT32, len);
 	ptr += TLV_HDR_SIZE;
-	tmp_ptr = (u32 *)ptr;
+	tmp_ptr = (__le32 *)ptr;
 
-	memcpy(tmp_ptr, arg->chan_list, arg->num_chan * 4);
+	for (i = 0; i < arg->num_chan; i++)
+		tmp_ptr[i] = cpu_to_le32(arg->chan_list[i]);
 
 	ptr += len;
 
@@ -2809,8 +2811,10 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,
 		ptr += TLV_HDR_SIZE;
 		s_ssid = ptr;
 		for (i = 0; i < arg->num_hint_s_ssid; ++i) {
-			s_ssid->freq_flags = arg->hint_s_ssid[i].freq_flags;
-			s_ssid->short_ssid = arg->hint_s_ssid[i].short_ssid;
+			s_ssid->freq_flags =
+				cpu_to_le32(arg->hint_s_ssid[i].freq_flags);
+			s_ssid->short_ssid =
+				cpu_to_le32(arg->hint_s_ssid[i].short_ssid);
 			s_ssid++;
 		}
 		ptr += len;
@@ -2824,7 +2828,7 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,
 		hint_bssid = ptr;
 		for (i = 0; i < arg->num_hint_bssid; ++i) {
 			hint_bssid->freq_flags =
-				arg->hint_bssid[i].freq_flags;
+				cpu_to_le32(arg->hint_bssid[i].freq_flags);
 			ether_addr_copy(&hint_bssid->bssid.addr[0],
 					&arg->hint_bssid[i].bssid.addr[0]);
 			hint_bssid++;
diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h
index 6d9c645e3d5d04..6468d9738639e1 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.h
+++ b/drivers/net/wireless/ath/ath12k/wmi.h
@@ -3504,6 +3504,16 @@ struct ath12k_wmi_hint_bssid_arg {
 	struct ath12k_wmi_mac_addr_params bssid;
 };
 
+struct ath12k_wmi_hint_short_ssid_params {
+	__le32 freq_flags;
+	__le32 short_ssid;
+};
+
+struct ath12k_wmi_hint_bssid_params {
+	__le32 freq_flags;
+	struct ath12k_wmi_mac_addr_params bssid;
+};
+
 struct ath12k_wmi_scan_req_arg {
 	u32 scan_id;
 	u32 scan_req_id;

From e860ffebadc944f92cc57f65016da6aa3a6b0351 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Tue, 14 Jul 2026 16:00:38 +0800
Subject: [PATCH 0234/1982] ext4: check return value of ext4_get_block() in
 ext4_load_tail_bh()

[ Upstream commit 705a3fd3bac167f1dabe3d3bba46cd484c5528dd ]

ext4_load_tail_bh() ignores the return value of ext4_get_block(), so an
I/O or allocation failure is silently discarded. buffer_mapped(bh) stays
false and the function returns NULL, which callers such as
ext4_block_do_zero_range() treat as "nothing to do" and return success.
This can mask real failures during zero-range, truncate, or punch-hole
operations, potentially exposing stale data if the block was not
actually a hole and needed zeroing. So propagate the error to the
callers.

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260714080044.4038124-4-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 9a5c08650bd1ef..2e3f7ba1a924b1 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4119,7 +4119,9 @@ static int __ext4_block_zero_page_range(handle_t *handle,
 	}
 	if (!buffer_mapped(bh)) {
 		BUFFER_TRACE(bh, "unmapped");
-		ext4_get_block(inode, iblock, bh, 0);
+		err = ext4_get_block(inode, iblock, bh, 0);
+		if (err < 0)
+			goto unlock;
 		/* unmapped? It's a hole - nothing to do */
 		if (!buffer_mapped(bh)) {
 			BUFFER_TRACE(bh, "still unmapped");

From 3a2b86ccf13e006cb75e584267c9ae95dfaef750 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Tue, 14 Jul 2026 16:00:36 +0800
Subject: [PATCH 0235/1982] ext4: use FGP_WRITEBEGIN for tail block zeroing

[ Upstream commit e1cf7b5f5c8ad1e00d00c50c61c3e8fdc79cd422 ]

ext4_load_tail_bh() returns a locked folio that callers immediately
mutate through folio_zero_range() and mark_buffer_dirty().  Use
FGP_WRITEBEGIN so that, on backing devices that require stable writes,
__filemap_get_folio() waits for writeback to finish before returning
the folio; on regular devices the wait is a no-op.

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260714080044.4038124-2-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 2e3f7ba1a924b1..c3fb5f16f6e39c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4092,7 +4092,7 @@ static int __ext4_block_zero_page_range(handle_t *handle,
 	int err = 0;
 
 	folio = __filemap_get_folio(mapping, from >> PAGE_SHIFT,
-				    FGP_LOCK | FGP_ACCESSED | FGP_CREAT,
+				    FGP_WRITEBEGIN | FGP_ACCESSED,
 				    mapping_gfp_constraint(mapping, ~__GFP_FS));
 	if (IS_ERR(folio))
 		return PTR_ERR(folio);

From 7a4e9be7b7d163e0fcf36c601c8e7cf540464335 Mon Sep 17 00:00:00 2001
From: Benjamin Marzinski <bmarzins@redhat.com>
Date: Mon, 6 Jul 2026 16:23:24 -0400
Subject: [PATCH 0236/1982] bitops: make the *_bit_le functions use unsigned
 long

[ Upstream commit 1c61b0a6e5c472737619f74f79c390363ee258df ]

The *_bit_le functions use a signed integer for the bit number.
However, the *_bit functions can use an unsigned long. This causes
problems if there is a large bitmap and a bit number > 0x80000000 is
passed in. Since that is a negative int, it will get sign extended to a
long when getting passed to the *_bit function, turning it into a huge
bit number. This usually ends up with the memory address wrapping around
and the function accessing memory before the start of the bitmap.

Avoid this by making the *_bit_le functions take an unsigned long.

This can be triggered by faking an almost 4TB dm-mirror device, which
uses bitmaps to track the mirror regions:

$ dmsetup create bigzero --table '0 8589934590 zero'
$ dmsetup create mymirror --table '0 8589934590 mirror core 2 2 nosync 2 /dev/mapper/bigzero 0 /dev/mapper/bigzero 0'

This will access memory before the start of the sync_bits bitmap, and
likely hit the guard page of the previously allocated clean_bits bitmap,
causing a kernel panic with the old code.

I looked and didn't see any crazy code using the signed int to
intentionally try and access bits before some address within the bitmap.

Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Yury Norov <ynorov@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/asm-generic/bitops/le.h | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/asm-generic/bitops/le.h b/include/asm-generic/bitops/le.h
index d51beff6037550..e3b0da9a25f1b9 100644
--- a/include/asm-generic/bitops/le.h
+++ b/include/asm-generic/bitops/le.h
@@ -16,47 +16,47 @@
 #endif
 
 
-static inline int test_bit_le(int nr, const void *addr)
+static inline int test_bit_le(unsigned long nr, const void *addr)
 {
 	return test_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline void set_bit_le(int nr, void *addr)
+static inline void set_bit_le(unsigned long nr, void *addr)
 {
 	set_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline void clear_bit_le(int nr, void *addr)
+static inline void clear_bit_le(unsigned long nr, void *addr)
 {
 	clear_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline void __set_bit_le(int nr, void *addr)
+static inline void __set_bit_le(unsigned long nr, void *addr)
 {
 	__set_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline void __clear_bit_le(int nr, void *addr)
+static inline void __clear_bit_le(unsigned long nr, void *addr)
 {
 	__clear_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline int test_and_set_bit_le(int nr, void *addr)
+static inline int test_and_set_bit_le(unsigned long nr, void *addr)
 {
 	return test_and_set_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline int test_and_clear_bit_le(int nr, void *addr)
+static inline int test_and_clear_bit_le(unsigned long nr, void *addr)
 {
 	return test_and_clear_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline int __test_and_set_bit_le(int nr, void *addr)
+static inline int __test_and_set_bit_le(unsigned long nr, void *addr)
 {
 	return __test_and_set_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }
 
-static inline int __test_and_clear_bit_le(int nr, void *addr)
+static inline int __test_and_clear_bit_le(unsigned long nr, void *addr)
 {
 	return __test_and_clear_bit(nr ^ BITOP_LE_SWIZZLE, addr);
 }

From 4ae6749e29625ea13ab3c01144cdb8713423cc8f Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Sun, 19 Jul 2026 19:02:29 -0700
Subject: [PATCH 0237/1982] ata: pata_ep93xx: fix PIO fallback when DMA init
 fails

[ Upstream commit c303c3619a1d5cf7d4b457106062d16724724a80 ]

ep93xx_pata_dma_init() returns an error when dma_request_chan() fails,
which causes ep93xx_pata_probe() to abort entirely.  The probe function
already has a PIO fallback path (it checks both channel pointers before
enabling UDMA), so the DMA init should not fail the probe on non-fatal
errors.

Propagate -EPROBE_DEFER, such that we allow the DMA controller driver
to load, in case we got probed before the DMA controller driver.
For all other failures (e.g. -ENODEV when the DMA controller is missing
in the device tree), fall back to PIO.

Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_ep93xx.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index b2b9e0058333ed..3f61712af5bbe6 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -652,14 +652,22 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	 * start of new transfer.
 	 */
 	drv_data->dma_rx_channel = dma_request_chan(dev, "rx");
-	if (IS_ERR(drv_data->dma_rx_channel))
-		return dev_err_probe(dev, PTR_ERR(drv_data->dma_rx_channel),
-				     "rx DMA setup failed\n");
+	if (IS_ERR(drv_data->dma_rx_channel)) {
+		ret = PTR_ERR(drv_data->dma_rx_channel);
+		drv_data->dma_rx_channel = NULL;
+		if (ret == -EPROBE_DEFER)
+			return ret;
+		dev_warn(dev, "rx DMA unavailable, using PIO\n");
+		return 0;
+	}
 
 	drv_data->dma_tx_channel = dma_request_chan(&pdev->dev, "tx");
 	if (IS_ERR(drv_data->dma_tx_channel)) {
-		ret = dev_err_probe(dev, PTR_ERR(drv_data->dma_tx_channel),
-				    "tx DMA setup failed\n");
+		ret = PTR_ERR(drv_data->dma_tx_channel);
+		drv_data->dma_tx_channel = NULL;
+		if (ret == -EPROBE_DEFER)
+			goto fail_release_rx;
+		dev_warn(dev, "tx DMA unavailable, using PIO\n");
 		goto fail_release_rx;
 	}
 
@@ -670,7 +678,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
 	ret = dmaengine_slave_config(drv_data->dma_rx_channel, &conf);
 	if (ret) {
-		dev_err_probe(dev, ret, "failed to configure rx dma channel");
+		dev_warn(dev, "failed to configure rx dma channel, using PIO\n");
 		goto fail_release_dma;
 	}
 
@@ -681,7 +689,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
 	ret = dmaengine_slave_config(drv_data->dma_tx_channel, &conf);
 	if (ret) {
-		dev_err_probe(dev, ret, "failed to configure tx dma channel");
+		dev_warn(dev, "failed to configure tx dma channel, using PIO\n");
 		goto fail_release_dma;
 	}
 
@@ -689,10 +697,14 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 
 fail_release_rx:
 	dma_release_channel(drv_data->dma_rx_channel);
+	drv_data->dma_rx_channel = NULL;
+	if (ret == -EPROBE_DEFER)
+		return ret;
+	return 0;
+
 fail_release_dma:
 	ep93xx_pata_release_dma(drv_data);
-
-	return ret;
+	return 0;
 }
 
 static void ep93xx_pata_dma_start(struct ata_queued_cmd *qc)

From 7460497fe7df9c0bfaf4a30af9d98fd43b531e93 Mon Sep 17 00:00:00 2001
From: Randolph Sapp <rs@ti.com>
Date: Mon, 13 Oct 2025 12:01:23 -0500
Subject: [PATCH 0238/1982] drm/etnaviv: force flush on power register ops

[ Upstream commit c182a2ae13886463f7ae36e034449477306d182b ]

Add gpu_write_power_sync to verify that power register modifications
have reached the endpoint device in sequence specific sections that do
not validate device state.

These sequence specific areas have been detected experimentally with an
am57xx-evm through numerous boot and module load+unload cycles.

Signed-off-by: Randolph Sapp <rs@ti.com>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://patch.msgid.link/20251013170122.1145387-2-rs@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 10 +++++-----
 drivers/gpu/drm/etnaviv/etnaviv_gpu.h |  6 ++++++
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index daba33052f5240..e81383c5bb1b44 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -543,13 +543,13 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 		u32 pulse_eater = 0x01590880;
 
 		/* disable clock gating */
-		gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, 0x0);
+		gpu_write_power_sync(gpu, VIVS_PM_POWER_CONTROLS, 0x0);
 
 		/* disable pulse eater */
 		pulse_eater |= BIT(17);
 		gpu_write_power(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
 		pulse_eater |= BIT(0);
-		gpu_write_power(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
+		gpu_write_power_sync(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
 
 		/* enable clock */
 		control = VIVS_HI_CLOCK_CONTROL_FSCALE_VAL(fscale);
@@ -660,7 +660,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)
 	    gpu->identity.revision == 0x4302)
 		ppc |= VIVS_PM_POWER_CONTROLS_DISABLE_STALL_MODULE_CLOCK_GATING;
 
-	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, ppc);
+	gpu_write_power_sync(gpu, VIVS_PM_POWER_CONTROLS, ppc);
 
 	pmc = gpu_read_power(gpu, VIVS_PM_MODULE_CONTROLS);
 
@@ -704,7 +704,7 @@ static void etnaviv_gpu_enable_mlcg(struct etnaviv_gpu *gpu)
 	pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_HZ;
 	pmc |= VIVS_PM_MODULE_CONTROLS_DISABLE_MODULE_CLOCK_GATING_RA_EZ;
 
-	gpu_write_power(gpu, VIVS_PM_MODULE_CONTROLS, pmc);
+	gpu_write_power_sync(gpu, VIVS_PM_MODULE_CONTROLS, pmc);
 }
 
 void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch)
@@ -770,7 +770,7 @@ static void etnaviv_gpu_setup_pulse_eater(struct etnaviv_gpu *gpu)
 		pulse_eater |= BIT(18);
 	}
 
-	gpu_write_power(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
+	gpu_write_power_sync(gpu, VIVS_PM_PULSE_EATER, pulse_eater);
 }
 
 static void etnaviv_gpu_hw_init(struct etnaviv_gpu *gpu)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
index 5cb46c84e03ac2..e89d591d7404c0 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
@@ -204,6 +204,12 @@ static inline u32 gpu_read_power(struct etnaviv_gpu *gpu, u32 reg)
 	return readl(gpu->mmio + gpu_fix_power_address(gpu, reg));
 }
 
+static inline void gpu_write_power_sync(struct etnaviv_gpu *gpu, u32 reg, u32 data)
+{
+	gpu_write_power(gpu, reg, data);
+	gpu_read_power(gpu, reg);
+}
+
 int etnaviv_gpu_get_param(struct etnaviv_gpu *gpu, u32 param, u64 *value);
 
 int etnaviv_gpu_init(struct etnaviv_gpu *gpu);

From 493f39b7fe9715881c1e4484f96d611b2ddd428f Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:18:51 +0800
Subject: [PATCH 0239/1982] soc: ixp4xx: qmgr: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 01479280fa5d4691013bcd64fdfd935117b69769 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Message-ID: <20260704121851.63805-1-pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ixp4xx/ixp4xx-qmgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/ixp4xx/ixp4xx-qmgr.c b/drivers/soc/ixp4xx/ixp4xx-qmgr.c
index 475e229039e30c..e3ad0e0237a779 100644
--- a/drivers/soc/ixp4xx/ixp4xx-qmgr.c
+++ b/drivers/soc/ixp4xx/ixp4xx-qmgr.c
@@ -454,6 +454,7 @@ static const struct of_device_id ixp4xx_qmgr_of_match[] = {
         },
 	{},
 };
+MODULE_DEVICE_TABLE(of, ixp4xx_qmgr_of_match);
 
 static struct platform_driver ixp4xx_qmgr_driver = {
 	.driver = {

From 49a49271d6a396e56072c481ce6f1643434fd07d Mon Sep 17 00:00:00 2001
From: Ruoyu Wang <ruoyuw560@gmail.com>
Date: Thu, 18 Jun 2026 02:22:27 +0800
Subject: [PATCH 0240/1982] ntfs3: initialize err in attr_wof_frame_info

[ Upstream commit dd64afb32c4d8d3c934ae84df59a2e463d6fa43c ]

attr_wof_frame_info() may reuse a cached offsets folio. In that case the
loop can fill the output offsets without calling attr_load_runs_range()
or ntfs_read_run(), leaving err uninitialized before the common return
path. Initialize err to 0 for the successful cached path.

Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/attrib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 501f2ec153ab87..e500f7be8cc38e 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1410,7 +1410,7 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr,
 	u8 bytes_per_off;
 	char *addr;
 	struct folio *folio;
-	int i, err;
+	int i, err = 0;
 	__le32 *off32;
 	__le64 *off64;
 

From 1affb82f183060be09288d3cedd786d9b0763591 Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Wed, 22 Jul 2026 16:09:42 -0700
Subject: [PATCH 0241/1982] PCI/portdrv: Allow probing even without child
 services

[ Upstream commit 834171efeefffb1a0f2136f32e76669bbc11db86 ]

The PCIe port driver fails to probe if it finds no child services,
presumably under the assumption that the driver is not useful in that case.
However, the driver *can* still be useful for power management support --
namely, it still configures the port for runtime PM / D3, which may be
important for allowing a bridge to enter low power modes.

Thus, allow probe to succeed even if no IRQs and no child services are
available. This also mirrors existing behavior for ports that don't support
any portdrv services (PCIe hotplug, AER, DPC, PME, bwctrl), where we'd also
probe successfully.

This change is a bit more important after commit f5cd8a929c82 ("PCI: dwc:
Remove MSI/MSIX capability for Root Port if iMSI-RX is used as MSI
controller"), because it's common for some DWC-based systems to:

  1. have only the "aer" and "pcie_pme" port services available and

  2. not define legacy INTx interrupts properly in their device tree.

After commit f5cd8a929c82, such systems may fail pcie_init_service_irqs()
and so exit with -ENODEV.

Link: https://lore.kernel.org/all/nyada24tqwlkzdceyoxbzitzygvp4elvj5oajnqdwb33xkcdwk@76vnrx45fsfd/
Signed-off-by: Brian Norris <briannorris@chromium.org>
[bhelgaas: reorder pcie_port_device_register() decls per Lukas]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20260722160942.v4.1.I5fd5d83f518681b3949d8ab2f16ba8244fd3e774@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pcie/portdrv.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/pci/pcie/portdrv.c b/drivers/pci/pcie/portdrv.c
index a0991da4821363..91d1482221a8c6 100644
--- a/drivers/pci/pcie/portdrv.c
+++ b/drivers/pci/pcie/portdrv.c
@@ -330,8 +330,8 @@ static int pcie_device_init(struct pci_dev *pdev, int service, int irq)
  */
 static int pcie_port_device_register(struct pci_dev *dev)
 {
-	int status, capabilities, i, nr_service;
 	int irqs[PCIE_PORT_DEVICE_MAXSERVICES];
+	int status, capabilities, i;
 
 	/* Enable PCI Express port device */
 	status = pci_enable_device(dev);
@@ -355,29 +355,29 @@ static int pcie_port_device_register(struct pci_dev *dev)
 	if (status) {
 		capabilities &= PCIE_PORT_SERVICE_HP;
 		if (!capabilities)
-			goto error_disable;
+			goto out;
 	}
 
 	/* Allocate child services if any */
-	status = -ENODEV;
-	nr_service = 0;
 	for (i = 0; i < PCIE_PORT_DEVICE_MAXSERVICES; i++) {
 		int service = 1 << i;
 		if (!(capabilities & service))
 			continue;
-		if (!pcie_device_init(dev, service, irqs[i]))
-			nr_service++;
+		if (pcie_device_init(dev, service, irqs[i]))
+			capabilities &= ~service;
 	}
-	if (!nr_service)
-		goto error_cleanup_irqs;
 
-	return 0;
+out:
+	/*
+	 * With no child services, we shouldn't need bus mastering or any IRQ
+	 * vectors we allocated.
+	 */
+	if (!capabilities) {
+		pci_free_irq_vectors(dev);
+		pci_clear_master(dev);
+	}
 
-error_cleanup_irqs:
-	pci_free_irq_vectors(dev);
-error_disable:
-	pci_disable_device(dev);
-	return status;
+	return 0;
 }
 
 typedef int (*pcie_callback_t)(struct pcie_device *);

From 2a793f20a7e758cb9cc922af66474985a4277632 Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Thu, 11 Jun 2026 14:33:31 -0700
Subject: [PATCH 0242/1982] fs/ntfs3: reserve NUL byte when converting UTF-16
 names

[ Upstream commit 4871fedaabbfd574ac0a075b80e75afdd532e11e ]

ntfs_utf16_to_nls() appends a trailing NUL to the converted output,
but it passes the caller-supplied size directly to the conversion loop.
For the UTF-8 path, utf16s_to_utf8s() can legitimately fill all
buf_len bytes and return buf_len, after which ntfs_utf16_to_nls()
writes the terminator one byte past the end of the destination buffer.

The same contract problem exists for the NLS path when a converted
character consumes the last available byte.

Reserve one byte for the terminator before doing either conversion.
The function continues to return the number of converted bytes,
excluding the NUL terminator.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/dir.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index 6e1d2ad8c12ea1..6d588efaf9fdf9 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -24,6 +24,11 @@ int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len,
 
 	static_assert(sizeof(wchar_t) == sizeof(__le16));
 
+	if (buf_len <= 0)
+		return -EINVAL;
+
+	buf_len -= 1;
+
 	if (!nls) {
 		/* UTF-16 -> UTF-8 */
 		ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN,

From a664da9f549dcb62cdf9ac65f794018d57307cb7 Mon Sep 17 00:00:00 2001
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Date: Thu, 2 Jul 2026 13:29:09 +0200
Subject: [PATCH 0243/1982] ntfs3: fix info-leak in ntfs_rename()

[ Upstream commit 2fa56613b25d0c983ef3ff6d3e865d4254280abe ]

Hard to say about copy_to_user_iter(), but at least the first splat
looks correct. At the end of fill_name_de(), data layout is:

struct NTFS_DE *e = buf;
...

    |<- data_size + sizeof(struct NTFS_DE) ->|<- XXX ->|
buf |-----------------------------------------------------------
    |<- ALIGN(data_size, 8) + sizeof(struct NTFS_DE) ->|   ;; e->size

If 'buf' was allocated with kmalloc(), XXX remains uninitialized and
passed as such to memcpy() called from hdr_insert_de().

So using kzalloc() for all buffers passed to fill_name_de() looks
the simplest and most safe solution. OTOH if someone would have
said that an overhead of PAGE_SIZE'd memset() is too large, more
fine-granted solution is to memset() XXX only.

Reported-by: syzbot+905d785c4923bea2c1db@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=905d785c4923bea2c1db
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/namei.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
index 64cde1a856f447..f547ce82520f8c 100644
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@ -22,7 +22,7 @@ int fill_name_de(struct ntfs_sb_info *sbi, void *buf, const struct qstr *name,
 {
 	int err;
 	struct NTFS_DE *e = buf;
-	u16 data_size;
+	u16 data_size, real_size, aligned_size;
 	struct ATTR_FILE_NAME *fname = (struct ATTR_FILE_NAME *)(e + 1);
 
 #ifndef CONFIG_NTFS3_64BIT_CLUSTER
@@ -53,7 +53,12 @@ int fill_name_de(struct ntfs_sb_info *sbi, void *buf, const struct qstr *name,
 	fname->type = FILE_NAME_POSIX;
 	data_size = fname_full_size(fname);
 
-	e->size = cpu_to_le16(ALIGN(data_size, 8) + sizeof(struct NTFS_DE));
+	real_size = data_size + sizeof(struct NTFS_DE);
+	aligned_size = ALIGN(data_size, 8) + sizeof(struct NTFS_DE);
+	if (aligned_size > real_size)
+		memset((char *)buf + real_size, 0, aligned_size - real_size);
+
+	e->size = cpu_to_le16(aligned_size);
 	e->key_size = cpu_to_le16(data_size);
 	e->flags = 0;
 	e->res = 0;

From cd64f6c8f944aa68fe9dda95a06d09d16c448818 Mon Sep 17 00:00:00 2001
From: Senjin <senjin@hatchling.org>
Date: Sat, 13 Jun 2026 20:16:14 +0000
Subject: [PATCH 0244/1982] fs/ntfs3: fix lseek EINVAL on sparse/compressed
 files with 64-bit clusters

[ Upstream commit 789af83e41aef54c1ff1cee16adc27822e0a0d71 ]

When CONFIG_NTFS3_64BIT_CLUSTER is enabled, sbi->maxbytes_sparse is set
to -1. As a signed loff_t this is -1LL, the most negative value. Any
lseek on a sparse or compressed file passes this as maxsize to
vfs_setpos(), which returns -EINVAL whenever offset > maxsize, and
since -1LL is less than any non-negative offset, every seek fails,
including lseek(fd, 0, SEEK_SET).

The intent of -1 here appears to be "no limit" (matching the spirit of
MAX_LFS_FILESIZE assigned to sbi->maxbytes and sb->s_maxbytes in the
same block), but the signed type makes it the minimum instead of the
maximum.

Fix by assigning MAX_LFS_FILESIZE to sbi->maxbytes_sparse in the
64-bit cluster path, consistent with the other two limits set there.

Observed on a 16 TB NTFS volume with 0xFFFFFEFF total clusters compiled
with CONFIG_NTFS3_64BIT_CLUSTER=y. Sequential reads via dd/cp worked
correctly; any lseek call on sparse files returned EINVAL, preventing
archive managers and other tools from random-accessing files on the
volume. The non-64-bit-cluster path correctly sets maxbytes_sparse to
(1ull << (cluster_bits + 32)) - 1, a large positive value.

Signed-off-by: Senjin <senjin@hatchling.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index dc799ebc6c883c..74f071ace3ad74 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -1176,7 +1176,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
 #ifdef CONFIG_NTFS3_64BIT_CLUSTER
 	if (clusters >= (1ull << (64 - cluster_bits)))
 		sbi->maxbytes = -1;
-	sbi->maxbytes_sparse = -1;
+	sbi->maxbytes_sparse = MAX_LFS_FILESIZE;
 	sb->s_maxbytes = MAX_LFS_FILESIZE;
 #else
 	/* Maximum size for sparse file. */

From 2715ac3f0b8e3c04d72ab16555a04a819519b38d Mon Sep 17 00:00:00 2001
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Date: Thu, 2 Jul 2026 13:07:13 +0200
Subject: [PATCH 0245/1982] fs/ntfs3: load ATTR_BITMAP run extents from $MFT
 extension records

[ Upstream commit e31886cb6e0e14cf65e27da0bf1a422ff419d893 ]

When $MFT's ATTR_BITMAP attribute is heavily fragmented, its run list
can span multiple MFT extension records (attribute list entries with
vcn > 0). The non-primary segment handler in ntfs_read_mft() only
processed ATTR_DATA extension segments for MFT_REC_MFT, silently
skipping any ATTR_BITMAP segments. This left sbi->mft.bitmap.run
incomplete, causing wnd_init() to fail with -ENOENT when wnd_rescan()
tried to look up a VCN not covered by the truncated run list.

Observed on a 16 TB NTFS volume (0xFFFFFEFF total clusters) whose MFT
bitmap run list was split across 97 extents in extension records.
wnd_rescan() successfully looked up VCNs 0-122 from the runs loaded
from the base record, then failed at VCN 123 (the last cluster of the
bitmap) whose run was only present in an extension record.

Fix by extending the MFT_REC_MFT special case to also handle
ATTR_BITMAP extension segments, storing their runs into
sbi->mft.bitmap.run the same way the primary segment does.

Signed-off-by: Senjin <senjin@hatchling.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/inode.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 120691bc71ee9c..99fdba7b403cb2 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -126,10 +126,16 @@ static struct inode *ntfs_read_mft(struct inode *inode,
 
 	if (le && le->vcn) {
 		/* This is non primary attribute segment. Ignore if not MFT. */
-		if (ino != MFT_REC_MFT || attr->type != ATTR_DATA)
+		if (ino != MFT_REC_MFT)
+			goto next_attr;
+
+		if (attr->type == ATTR_DATA)
+			run = &ni->file.run;
+		else if (attr->type == ATTR_BITMAP)
+			run = &sbi->mft.bitmap.run;
+		else
 			goto next_attr;
 
-		run = &ni->file.run;
 		asize = le32_to_cpu(attr->size);
 		goto attr_unpack_run;
 	}

From a77dc10cccc23cd710e3559b9e0ef0c17fbcbde9 Mon Sep 17 00:00:00 2001
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Date: Thu, 23 Jul 2026 18:14:16 +0530
Subject: [PATCH 0246/1982] platform/x86: int1092: Fix info leak in
 parse_package()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f5eb833730c071b68a68de5d1df442aae4ae7e6e ]

Sashiko reports a possible information leak that can occur as follows:

1. In parse_package(), memory allocated for data->device_mode_info is not
   zerozed initially as it is allocated with devm_kmalloc_array().

2. In the for loop after the allocation, a malformed ACPI package
   provided by firmware can cause some fields in data->device_mode_info
   to remain uninitialized.

3. Later in update_sar_data(), the uninitialized fields gets copied to
   the fields of context->sar_data, which can be exposed to userspace
   through sysfs attribute read (intc_data_show()).

Fix the leak by switching to use devm_kcalloc() for allocation.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse.iitm.ac.in
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260723-platx86-v4-2-93b4a178b595@cse.iitm.ac.in
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/int1092/intel_sar.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platform/x86/intel/int1092/intel_sar.c
index 7263114f0b3d07..f506155f35d4d2 100644
--- a/drivers/platform/x86/intel/int1092/intel_sar.c
+++ b/drivers/platform/x86/intel/int1092/intel_sar.c
@@ -91,10 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context *context, union acpi_ob
 	    item->package.count <= data->total_dev_mode)
 		return AE_ERROR;
 
-	data->device_mode_info = devm_kmalloc_array(&context->sar_device->dev,
-						    data->total_dev_mode,
-						    sizeof(*data->device_mode_info),
-						    GFP_KERNEL);
+	data->device_mode_info = devm_kcalloc(&context->sar_device->dev,
+					      data->total_dev_mode,
+					      sizeof(*data->device_mode_info),
+					      GFP_KERNEL);
 	if (!data->device_mode_info)
 		return AE_ERROR;
 

From 9c9d79cf6b58dc4e45e15d6549b588e9a192400c Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 16 Jun 2026 08:59:01 +0800
Subject: [PATCH 0247/1982] firmware: imx: scu: manage mailbox channels and
 global handle

[ Upstream commit 55c748d596f841a18cf659ce0999f64029a5c88c ]

imx_scu_probe() requests mailbox channels with the non-managed
mbox_request_channel_byname() helper and then publishes sc_ipc through
the global imx_sc_ipc_handle.  Later probe failures, including child
population failure, can leave the channels and global handle live after
the probe has failed.

Register devres actions to free each mailbox channel and clear the global
handle.  Also depopulate partially created child devices when
devm_of_platform_populate() reports an error.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/imx/imx-scu.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c
index 8c28e25ddc8a65..28d745ae060671 100644
--- a/drivers/firmware/imx/imx-scu.c
+++ b/drivers/firmware/imx/imx-scu.c
@@ -82,6 +82,17 @@ static int imx_sc_linux_errmap[IMX_SC_ERR_LAST] = {
 
 static struct imx_sc_ipc *imx_sc_ipc_handle;
 
+static void imx_scu_free_mbox_chan(void *data)
+{
+	mbox_free_channel(data);
+}
+
+static void imx_scu_clear_handle(void *data)
+{
+	if (imx_sc_ipc_handle == data)
+		imx_sc_ipc_handle = NULL;
+}
+
 static inline int imx_sc_to_linux_errno(int errno)
 {
 	if (errno >= IMX_SC_ERR_NONE && errno < IMX_SC_ERR_LAST)
@@ -321,6 +332,11 @@ static int imx_scu_probe(struct platform_device *pdev)
 		dev_dbg(dev, "request mbox chan %s\n", chan_name);
 		/* chan_name is not used anymore by framework */
 		kfree(chan_name);
+
+		ret = devm_add_action_or_reset(dev, imx_scu_free_mbox_chan,
+					       sc_chan->ch);
+		if (ret)
+			return ret;
 	}
 
 	sc_ipc->dev = dev;
@@ -328,6 +344,9 @@ static int imx_scu_probe(struct platform_device *pdev)
 	init_completion(&sc_ipc->done);
 
 	imx_sc_ipc_handle = sc_ipc;
+	ret = devm_add_action_or_reset(dev, imx_scu_clear_handle, sc_ipc);
+	if (ret)
+		return ret;
 
 	ret = imx_scu_soc_init(dev);
 	if (ret)
@@ -340,7 +359,11 @@ static int imx_scu_probe(struct platform_device *pdev)
 
 	dev_info(dev, "NXP i.MX SCU Initialized\n");
 
-	return devm_of_platform_populate(dev);
+	ret = devm_of_platform_populate(dev);
+	if (ret)
+		of_platform_depopulate(dev);
+
+	return ret;
 }
 
 static const struct of_device_id imx_scu_match[] = {

From d00d165f4cc407ca78cc40373ed64f233d681034 Mon Sep 17 00:00:00 2001
From: Tomer Maimon <tmaimon77@gmail.com>
Date: Wed, 15 Jul 2026 15:29:17 +0300
Subject: [PATCH 0248/1982] pinctrl: npcm8xx: enable RMII outputs from RMII
 groups

[ Upstream commit c6ccdc305589dd7c7976116e0870a23f291c5fa9 ]

NPCM8xx uses GCR_INTCR4 bits to release the R1, R2 and RMII3
transmit outputs from Hi-Z.

Those bits need to follow the mandatory r1, r2 and rmii3 pin
groups. The R1_OEn, R2_OEn and R3_OEn side groups are optional and
should not be required just to enable RMII transmit outputs.

Program the INTCR4 bits when the corresponding RMII groups are
selected and clear them again when those pins switch back to GPIO or
another shared function.

Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 61 +++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
index 0aae1a25345940..c94441b2acdae7 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
@@ -26,6 +26,7 @@
 #define NPCM8XX_GCR_SRCNT	0x068
 #define NPCM8XX_GCR_FLOCKR1	0x074
 #define NPCM8XX_GCR_DSCNT	0x078
+#define NPCM8XX_GCR_INTCR4	0x0c0
 #define NPCM8XX_GCR_I2CSEGSEL	0x0e0
 #define NPCM8XX_GCR_MFSEL1	0x260
 #define NPCM8XX_GCR_MFSEL2	0x264
@@ -78,6 +79,9 @@
 #define NPCM8XX_GPIO_PER_BANK	32
 #define NPCM8XX_GPIO_BANK_NUM	8
 #define NPCM8XX_GCR_NONE	0
+#define NPCM8XX_INTCR4_R1_RMII_EN	BIT(12)
+#define NPCM8XX_INTCR4_R2_RMII_EN	BIT(13)
+#define NPCM8XX_INTCR4_RMII3_EN	BIT(14)
 
 #define NPCM8XX_DEBOUNCE_MAX		4
 #define NPCM8XX_DEBOUNCE_NSEC		40
@@ -1796,6 +1800,61 @@ static const struct pinctrl_pin_desc npcm8xx_pins[] = {
 	PINCTRL_PIN(251, "JM2/CP1_GPIO"),
 	};
 
+static u32 npcm8xx_rmii_output_enable_mask(unsigned int pin)
+{
+	switch (pin) {
+	case 178:
+	case 179:
+	case 180:
+	case 181:
+	case 182:
+	case 193:
+	case 201:
+		return NPCM8XX_INTCR4_R1_RMII_EN;
+	case 84:
+	case 85:
+	case 86:
+	case 87:
+	case 88:
+	case 89:
+	case 200:
+		return NPCM8XX_INTCR4_R2_RMII_EN;
+	case 110:
+	case 111:
+	case 209:
+	case 210:
+	case 211:
+	case 214:
+	case 215:
+		return NPCM8XX_INTCR4_RMII3_EN;
+	default:
+		return 0;
+	}
+}
+
+static void npcm8xx_set_rmii_output_enable(struct regmap *gcr_regmap,
+					   const unsigned int *pin,
+					   int pin_number, int mode)
+{
+	u32 mask = 0;
+	u32 val = 0;
+	u32 bit;
+	int i;
+
+	for (i = 0; i < pin_number; i++) {
+		bit = npcm8xx_rmii_output_enable_mask(pin[i]);
+		mask |= bit;
+
+		if ((mode == fn_r1 && bit == NPCM8XX_INTCR4_R1_RMII_EN) ||
+		    (mode == fn_r2 && bit == NPCM8XX_INTCR4_R2_RMII_EN) ||
+		    (mode == fn_rmii3 && bit == NPCM8XX_INTCR4_RMII3_EN))
+			val |= bit;
+	}
+
+	if (mask)
+		regmap_update_bits(gcr_regmap, NPCM8XX_GCR_INTCR4, mask, val);
+}
+
 /* Enable mode in pin group */
 static void npcm8xx_setfunc(struct regmap *gcr_regmap, const unsigned int *pin,
 			    int pin_number, int mode)
@@ -1834,6 +1893,8 @@ static void npcm8xx_setfunc(struct regmap *gcr_regmap, const unsigned int *pin,
 						   BIT(cfg->bit4) : 0);
 		}
 	}
+
+	npcm8xx_set_rmii_output_enable(gcr_regmap, pin, pin_number, mode);
 }
 
 static int npcm8xx_get_slew_rate(struct npcm8xx_gpio *bank,

From 6ea28cfe3424b0202d20521d3e7be72d8890f4cb Mon Sep 17 00:00:00 2001
From: Tomer Maimon <tmaimon77@gmail.com>
Date: Wed, 15 Jul 2026 15:29:19 +0300
Subject: [PATCH 0249/1982] pinctrl: npcm8xx: clear pending GPIO events during
 init

[ Upstream commit cd39cce4cfd499f555eb8b8252636609c3468f57 ]

A bank may retain pending event status across resets of the GPIO block.
If probe leaves the old state in place, the chained IRQ handler can see
spurious events as soon as the irqchip is registered.

Disable event generation and clear EVST before wiring each GPIO bank
into gpiolib so the driver starts from a known state.

Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
index c94441b2acdae7..22cc87d43ea694 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
@@ -2412,6 +2412,9 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl)
 		if (ret < 0)
 			return dev_err_probe(dev, ret, "Failed to retrieve IRQ for bank %u\n", id);
 
+		iowrite32(0, pctrl->gpio_bank[id].base + NPCM8XX_GP_N_EVEN);
+		iowrite32(0xffffffff, pctrl->gpio_bank[id].base + NPCM8XX_GP_N_EVST);
+
 		pctrl->gpio_bank[id].irq = ret;
 		pctrl->gpio_bank[id].irq_chip = npcmgpio_irqchip;
 		pctrl->gpio_bank[id].irqbase = id * NPCM8XX_GPIO_PER_BANK;

From 3046577a258700aff4bda98fb8188fa7f5af7d8c Mon Sep 17 00:00:00 2001
From: Tomer Maimon <tmaimon77@gmail.com>
Date: Wed, 15 Jul 2026 15:29:23 +0300
Subject: [PATCH 0250/1982] pinctrl: npcm8xx: fix debounce register selection

[ Upstream commit 602ee6c9447e4382c7e145b26a1c940813f2a144 ]

Each DBNCS register programs debounce source selection for 16 GPIOs.
The current offset calculation advances the register address every four
GPIOs, so offsets 4-15 and 20-31 end up touching the wrong selector
register.

Advance the DBNCS offset per 16 GPIOs so each line uses the debounce
selector bank that matches the hardware layout.

Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
index 22cc87d43ea694..28464463ff833e 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
@@ -2135,7 +2135,8 @@ static const struct pinmux_ops npcm8xx_pinmux_ops = {
 static int debounce_timing_setting(struct npcm8xx_gpio *bank, u32 gpio,
 				   u32 nanosecs)
 {
-	void __iomem *DBNCS_offset = bank->base + NPCM8XX_GP_N_DBNCS0 + (gpio / 4);
+	void __iomem *DBNCS_offset = bank->base + NPCM8XX_GP_N_DBNCS0 +
+				     (gpio / 16) * 4;
 	int gpio_debounce = (gpio % 16) * 2, debounce_select, i;
 	u32 dbncp_val, dbncp_val_mod;
 

From ec6a78f9541acd6aa6cfd9cbc56963b44dee631d Mon Sep 17 00:00:00 2001
From: Tomer Maimon <tmaimon77@gmail.com>
Date: Wed, 15 Jul 2026 15:29:21 +0300
Subject: [PATCH 0251/1982] pinctrl: npcm8xx: move GPIO IRQ setup into
 request_resources

[ Upstream commit b8edfde12e355030e708394c0fa11632559c7ac5 ]

npcmgpio_irq_startup() calls pinctrl_gpio_direction_input(), which may
sleep while taking the pinctrl core mutex. That makes IRQ startup trip
lockdep when CONFIG_PROVE_LOCKING is enabled.

Move the direction change into irq_request_resources() and keep startup
limited to the ack and unmask operations that are safe in atomic
context.

Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 29 ++++++++++++++++++-----
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
index 28464463ff833e..0347a471f9226d 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
@@ -295,17 +295,33 @@ static void npcmgpio_irq_unmask(struct irq_data *d)
 
 static unsigned int npcmgpio_irq_startup(struct irq_data *d)
 {
-	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
-	unsigned int gpio = irqd_to_hwirq(d);
-
-	/* active-high, input, clear interrupt, enable interrupt */
-	npcmgpio_direction_input(gc, gpio);
 	npcmgpio_irq_ack(d);
 	npcmgpio_irq_unmask(d);
 
 	return 0;
 }
 
+static int npcmgpio_irq_request_resources(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = irqd_to_hwirq(d);
+	int ret;
+
+	ret = npcmgpio_direction_input(gc, gpio);
+	if (ret)
+		return ret;
+
+	return gpiochip_reqres_irq(gc, gpio);
+}
+
+static void npcmgpio_irq_release_resources(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = irqd_to_hwirq(d);
+
+	gpiochip_relres_irq(gc, gpio);
+}
+
 static struct irq_chip npcmgpio_irqchip = {
 	.name = "NPCM8XX-GPIO-IRQ",
 	.irq_ack = npcmgpio_irq_ack,
@@ -313,8 +329,9 @@ static struct irq_chip npcmgpio_irqchip = {
 	.irq_mask = npcmgpio_irq_mask,
 	.irq_set_type = npcmgpio_set_irq_type,
 	.irq_startup = npcmgpio_irq_startup,
+	.irq_request_resources = npcmgpio_irq_request_resources,
+	.irq_release_resources = npcmgpio_irq_release_resources,
 	.flags =  IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_IMMUTABLE,
-	GPIOCHIP_IRQ_RESOURCE_HELPERS,
 };
 
 static const int gpi36_pins[] = { 36 };

From ebf377dcba5ff34d548b2c6ab524aa337189466f Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 16 Jun 2026 08:43:48 +0800
Subject: [PATCH 0252/1982] hsi: omap_ssi: remove debugfs on port creation
 failure

[ Upstream commit 760318e2e69857214314e94ac477219f0c89106b ]

ssi_probe() creates the controller debugfs tree before creating the SSI
port child devices. If a port device cannot be created, the error path
removes any children and tears down the controller, but leaves the
debugfs tree behind.

Remove the controller debugfs tree on the port creation failure path,
matching the normal remove path.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260616004348.97684-1-pengpeng@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hsi/controllers/omap_ssi_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
index 47826315d7d628..3163a063aaa233 100644
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -535,6 +535,9 @@ static int ssi_probe(struct platform_device *pd)
 	return err;
 out3:
 	device_for_each_child(&pd->dev, NULL, ssi_remove_ports);
+#ifdef CONFIG_DEBUG_FS
+	ssi_debug_remove_ctrl(ssi);
+#endif
 out2:
 	ssi_remove_controller(ssi);
 	pm_runtime_disable(&pd->dev);

From 1b2f849cd57213c2a8bc6fc76436fa9e8b7a6210 Mon Sep 17 00:00:00 2001
From: Jiaxing Hu <gahing@gahingwoo.com>
Date: Sat, 18 Jul 2026 15:11:43 +1200
Subject: [PATCH 0253/1982] iommu/rockchip: Clear stale page faults before
 enabling stall

[ Upstream commit b10d5920cafa292ee3cab9c20f813da4fe4f00b8 ]

Boot firmware can leave an IOMMU bank in PAGE_FAULT_ACTIVE before the
driver has configured paging:

  PAGE_FAULT_ACTIVE=1  STALL_ACTIVE=0  IDLE=1

Such a bank ignores CMD_ENABLE_STALL and never reaches STALL_ACTIVE, so
rk_iommu_enable_stall()'s readx_poll_timeout() spins until it times out
(seen on the RK3576 NPU, whose MMUs share this poll across banks).

Rather than special-casing these banks in the stall path, acknowledge the
stale fault with CMD_PAGE_FAULT_DONE before enabling stall, so every bank
starts from a clean state and the normal stall sequence applies to all of
them.  Banks without a pending fault are untouched.

Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/rockchip-iommu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 309ba78e27d4fa..982ea9cafee1b4 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -422,6 +422,19 @@ static int rk_iommu_enable_stall(struct rk_iommu *iommu)
 	if (!rk_iommu_is_paging_enabled(iommu))
 		return 0;
 
+	/*
+	 * Boot firmware can leave a bank in PAGE_FAULT_ACTIVE with no handler
+	 * (PAGE_FAULT_ACTIVE & !STALL_ACTIVE & IDLE).  Such a bank ignores
+	 * CMD_ENABLE_STALL and never reaches STALL_ACTIVE, timing out the poll
+	 * below.  Acknowledge any stale fault first so every bank starts clean.
+	 */
+	for (i = 0; i < iommu->num_mmu; i++) {
+		if (rk_iommu_read(iommu->bases[i], RK_MMU_STATUS) &
+		    RK_MMU_STATUS_PAGE_FAULT_ACTIVE)
+			writel(RK_MMU_CMD_PAGE_FAULT_DONE,
+			       iommu->bases[i] + RK_MMU_COMMAND);
+	}
+
 	rk_iommu_command(iommu, RK_MMU_CMD_ENABLE_STALL);
 
 	ret = readx_poll_timeout(rk_iommu_is_stall_active, iommu, val,

From d2cf7dd54f2fea514be8f7e0d7bae0bc6100e0c5 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Wed, 22 Jul 2026 17:01:19 -0700
Subject: [PATCH 0254/1982] scsi: ibmvfc: check for NULL evt in implicit LOGO
 and target delete path

[ Upstream commit 0122eab60b151d7815f420a91c7315944a037714 ]

Unlike ibmvfc_tgt_implicit_logout the ibmvfc_tgt_implicit_logout_and_del
path fails to check for a NULL evt returned from
ibmvfc_get_reserved_event and passes that directly to ibmvfc_send_event
which will unconditionally derefence the evt.

Check for a NULL evt and perform same escalation as
ibmvfc_implicit_logout.

Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Link: https://patch.msgid.link/20260723000149.969416-4-tyreld@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvfc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index 8d7c304636d990..63cc569284dedd 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4403,6 +4403,14 @@ static void ibmvfc_tgt_implicit_logout_and_del(struct ibmvfc_target *tgt)
 	evt = __ibmvfc_tgt_get_implicit_logout_evt(tgt,
 						   ibmvfc_tgt_implicit_logout_and_del_done);
 
+	if (!evt) {
+		vhost->discovery_threads--;
+		ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_NONE);
+		kref_put(&tgt->kref, ibmvfc_release_tgt);
+		__ibmvfc_reset_host(vhost);
+		return;
+	}
+
 	ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_LOGOUT_RPORT_WAIT);
 	if (ibmvfc_send_event(evt, vhost, default_timeout)) {
 		vhost->discovery_threads--;

From cb0f7456d550b2a172303766f0cb827528129122 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Wed, 22 Jul 2026 17:01:20 -0700
Subject: [PATCH 0255/1982] scsi: ibmvfc: free ibmvfc_target allocations with
 mempool_free

[ Upstream commit 99143433f7f14139ac373c553ec8e1317d0ae58a ]

The ibmvfc_target *tgt structures for discovery are allocated using
mempool_alloc but in turn free'd via kfree in ibmvfc_release_target
breaking pool guarentees.

Fixup ibmvfc_release_target to call mempool_free instead so that memory
is properly returned to the mempool instead of the general allocator.

Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Link: https://patch.msgid.link/20260723000149.969416-5-tyreld@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvfc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index 63cc569284dedd..e3853e05aa27a7 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -1366,7 +1366,7 @@ static void ibmvfc_set_rport_dev_loss_tmo(struct fc_rport *rport, u32 timeout)
 static void ibmvfc_release_tgt(struct kref *kref)
 {
 	struct ibmvfc_target *tgt = container_of(kref, struct ibmvfc_target, kref);
-	kfree(tgt);
+	mempool_free(tgt, tgt->vhost->tgt_pool);
 }
 
 /**

From 65bd51927d8d36bf7acb014f85bfd41c55f9364f Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 27 Jul 2026 13:37:12 +0200
Subject: [PATCH 0256/1982] udf: Fix bh leak for unallocated space entries

[ Upstream commit d95094d4c0a62ea17b8a7c6399b42381b8a55bc0 ]

When processing unallocated space entries we didn't properly release the
inode bh. Fix it.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 6a0c66d706295e..84b1a0b7b28d29 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1495,6 +1495,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 		memcpy(iinfo->i_data,
 		       bh->b_data + sizeof(struct unallocSpaceEntry),
 		       bs - sizeof(struct unallocSpaceEntry));
+		brelse(bh);
 		return 0;
 	}
 

From ea0a6f62eb583d03c3808f5c75b23d63c2bf7781 Mon Sep 17 00:00:00 2001
From: Jay Vadayath <jay@artiphishell.com>
Date: Fri, 17 Jul 2026 11:40:19 -0700
Subject: [PATCH 0257/1982] udf: bound lengthAllocDescs from unallocated space
 entry

[ Upstream commit b8228f59dc58aea06dc024efd8f64c2d048c4578 ]

udf_read_inode() copies the on-disk lengthAllocDescs field of a USE
(unallocSpaceEntry) inode into iinfo->i_lenAlloc without checking that
it fits in the i_data buffer that is subsequently allocated for the
inode. udf_count_free_table(), called from udf_statfs(), then walks the
allocation descriptor array up to i_lenAlloc bytes, so a crafted UDF
image with lengthAllocDescs larger than (blocksize - sizeof(struct
unallocSpaceEntry)) causes udf_get_fileshortad() to read past the end
of the kmalloc'd i_data buffer.

KASAN report from mounting a crafted UDF image and calling statfs()
from an unprivileged process:

  BUG: KASAN: slab-out-of-bounds in udf_get_fileshortad+0x126/0x130
  Read of size 4 at addr ffff8880042137d8 by task poc/65
  Call Trace:
   dump_stack_lvl+0x53/0x70
   print_report+0xce/0x610
   kasan_report+0xce/0x100
   udf_get_fileshortad+0x126/0x130
   udf_current_aext+0x3c4/0xa10
   udf_next_aext+0x241/0x440
   udf_statfs+0xb7d/0x11c0
   statfs_by_dentry+0x117/0x1e0
   user_statfs+0xac/0x130
   __do_sys_statfs+0x80/0xe0
   do_syscall_64+0x102/0x5a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reject USE inodes whose lengthAllocDescs would place descriptors past
the end of the i_data buffer, mirroring the checks the rest of the UDF
code performs on descriptor lengths.

This bug was discovered by Artiphishell's vTriage pipeline, which
generated a userspace reproducer that reliably triggers the KASAN
report on an unpatched kernel. The fix below was drafted with the
Claude coding assistant; a userspace reproducer (and the crafted UDF
image) is available on request.

Assisted-by: LLM
Signed-off-by: Jay Vadayath <jay@artiphishell.com>
Link: https://patch.msgid.link/20260717184021.13476-1-jay@artiphishell.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/inode.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 84b1a0b7b28d29..e50ecd67461046 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1488,6 +1488,10 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 		iinfo->i_lenAlloc = le32_to_cpu(
 				((struct unallocSpaceEntry *)bh->b_data)->
 				 lengthAllocDescs);
+		if (iinfo->i_lenAlloc > bs - sizeof(struct unallocSpaceEntry)) {
+			ret = -EFSCORRUPTED;
+			goto out;
+		}
 		ret = udf_alloc_i_data(inode, bs -
 					sizeof(struct unallocSpaceEntry));
 		if (ret)

From 3243737978f3aa070e98d7a0adbe945c8c898e61 Mon Sep 17 00:00:00 2001
From: Yichong Chen <chenyichong@uniontech.com>
Date: Mon, 27 Jul 2026 17:12:14 +0800
Subject: [PATCH 0258/1982] exfat: write moved entry before removing source

[ Upstream commit 896fcc93574fd511ee04a4110e8ea59d6d8d43d7 ]

exfat_move_file() removes the old directory entry before the new entry
has been written.  If writing the new entry fails, rename returns an
error after the source entry has already been marked deleted.

Write the new entry first, then remove the old entry and update the
cached inode location.  This keeps the source entry intact if creating
the destination entry fails.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exfat/namei.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 6b544df0a03a68..06bed867b46adf 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -1156,11 +1156,6 @@ static int exfat_move_file(struct inode *parent_inode,
 	exfat_init_ext_entry(&new_es, num_new_entries, p_uniname,
 			     &mov_es, num_extra_entries);
 
-	exfat_remove_entries(parent_inode, &mov_es, ES_IDX_FILE, false);
-
-	ei->dir = newdir;
-	ei->entry = newentry;
-
 	ret = exfat_put_dentry_set(&new_es, IS_DIRSYNC(parent_inode));
 	if (ret) {
 		/* Best-effort delete to avoid duplicate entries */
@@ -1174,6 +1169,11 @@ static int exfat_move_file(struct inode *parent_inode,
 		goto put_mov_es;
 	}
 
+	exfat_remove_entries(parent_inode, &mov_es, ES_IDX_FILE, false);
+
+	ei->dir = newdir;
+	ei->entry = newentry;
+
 	return exfat_put_dentry_set(&mov_es, IS_DIRSYNC(parent_inode));
 
 put_mov_es:

From 5bcbc5dfb8bbfa83c6ebcb040474038f5f259503 Mon Sep 17 00:00:00 2001
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Date: Thu, 23 Jul 2026 03:52:29 +0000
Subject: [PATCH 0259/1982] remoteproc: Force shutdown during device removal

[ Upstream commit 4059c64d78b5d543dabae332922e763b4c95c79e ]

rproc_del() is subjected to the reference counted shutdown path, as such
a remoteproc with more than one reference will be left running as its
resources are released underneath it.

Refactor the shutdown path such that the reference count value is
ignored when called from rproc_del().

Assisted-by: OpenCode:GPT-5.5
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-3-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_core.c | 57 +++++++++++++++-------------
 1 file changed, 31 insertions(+), 26 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 70c990c3a5d76f..1e277333de871c 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1993,28 +1993,7 @@ int rproc_boot(struct rproc *rproc)
 }
 EXPORT_SYMBOL(rproc_boot);
 
-/**
- * rproc_shutdown() - power off the remote processor
- * @rproc: the remote processor
- *
- * Power off a remote processor (previously booted with rproc_boot()).
- *
- * In case @rproc is still being used by an additional user(s), then
- * this function will just decrement the power refcount and exit,
- * without really powering off the device.
- *
- * Every call to rproc_boot() must (eventually) be accompanied by a call
- * to rproc_shutdown(). Calling rproc_shutdown() redundantly is a bug.
- *
- * Notes:
- * - we're not decrementing the rproc's refcount, only the power refcount.
- *   which means that the @rproc handle stays valid even after rproc_shutdown()
- *   returns, and users can still use it with a subsequent rproc_boot(), if
- *   needed.
- *
- * Return: 0 on success, and an appropriate error value otherwise
- */
-int rproc_shutdown(struct rproc *rproc)
+static int __rproc_shutdown(struct rproc *rproc, bool force)
 {
 	struct device *dev = &rproc->dev;
 	bool crashed;
@@ -2034,9 +2013,10 @@ int rproc_shutdown(struct rproc *rproc)
 	}
 	crashed = rproc->state == RPROC_CRASHED;
 
-	/* if the remote proc is still needed, bail out */
-	if (!atomic_dec_and_test(&rproc->power))
+	if (!atomic_dec_and_test(&rproc->power) && !force) {
+		/* The remote processor is still needed by another user. */
 		goto out;
+	}
 
 	ret = rproc_stop(rproc, crashed);
 	if (ret) {
@@ -2060,6 +2040,32 @@ int rproc_shutdown(struct rproc *rproc)
 	mutex_unlock(&rproc->lock);
 	return ret;
 }
+
+/**
+ * rproc_shutdown() - power off the remote processor
+ * @rproc: the remote processor
+ *
+ * Power off a remote processor (previously booted with rproc_boot()).
+ *
+ * In case @rproc is still being used by an additional user(s), then
+ * this function will just decrement the power refcount and exit,
+ * without really powering off the device.
+ *
+ * Every call to rproc_boot() must (eventually) be accompanied by a call
+ * to rproc_shutdown(). Calling rproc_shutdown() redundantly is a bug.
+ *
+ * Notes:
+ * - we're not decrementing the rproc's refcount, only the power refcount.
+ *   which means that the @rproc handle stays valid even after rproc_shutdown()
+ *   returns, and users can still use it with a subsequent rproc_boot(), if
+ *   needed.
+ *
+ * Return: 0 on success, and an appropriate error value otherwise
+ */
+int rproc_shutdown(struct rproc *rproc)
+{
+	return __rproc_shutdown(rproc, false);
+}
 EXPORT_SYMBOL(rproc_shutdown);
 
 /**
@@ -2626,8 +2632,7 @@ int rproc_del(struct rproc *rproc)
 	if (cancel_work_sync(&rproc->crash_handler))
 		pm_relax(rproc->dev.parent);
 
-	/* TODO: make sure this works with rproc->power > 1 */
-	rproc_shutdown(rproc);
+	__rproc_shutdown(rproc, true);
 
 	rproc_delete_debug_dir(rproc);
 

From 9438ed031075a2423fc21bd033b2b57d9532fde1 Mon Sep 17 00:00:00 2001
From: Nicolin Chen <nicolinc@nvidia.com>
Date: Tue, 14 Jul 2026 13:55:08 -0700
Subject: [PATCH 0260/1982] iommu/tegra241-cmdqv: Rate-limit the error ISR's
 log message

[ Upstream commit a86c36163c9722545d27e92bdad8418fdcaa8b1d ]

tegra241_cmdqv_isr() logs the error-map registers on every error interrupt.
A malfunctioning device, or a guest deliberately faulting its own VCMDQs,
can raise these interrupts rapidly, and the unconditional dev_warn() then
floods the kernel log.

Rate-limit the message with dev_warn_ratelimited(), and pass the error-map
registers straight to it so their four MMIO reads run only when the limiter
prints, instead of building the string on every interrupt.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index fdbd487848e642..8c9530873ed985 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -350,21 +350,19 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid)
 {
 	struct tegra241_cmdqv *cmdqv = (struct tegra241_cmdqv *)devid;
 	void __iomem *reg_vintf_map = REG_CMDQV(cmdqv, VINTF_ERR_MAP);
-	char err_str[256];
 	u64 vintf_map;
 
 	/* Use readl_relaxed() as register addresses are not 64-bit aligned */
 	vintf_map = (u64)readl_relaxed(reg_vintf_map + 0x4) << 32 |
 		    (u64)readl_relaxed(reg_vintf_map);
 
-	snprintf(err_str, sizeof(err_str),
-		 "vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x", vintf_map,
-		 readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))),
-		 readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))),
-		 readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))),
-		 readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0))));
-
-	dev_warn(cmdqv->dev, "unexpected error reported. %s\n", err_str);
+	dev_warn_ratelimited(
+		cmdqv->dev,
+		"unexpected error reported. vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x\n",
+		vintf_map, readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))),
+		readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))),
+		readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))),
+		readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0))));
 
 	/* Handle VINTF0 and its LVCMDQs */
 	if (vintf_map & BIT_ULL(0)) {

From a2ec55a40da21a20abded935fb01df1878ea299a Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sun, 5 Jul 2026 08:17:05 +0800
Subject: [PATCH 0261/1982] clk: imx: imx8qxp: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit cd21fdcbef3fb32136f72075ab668b075423b3f6 ]

The driver has a match table for the of bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Link: https://patch.msgid.link/20260705001705.70400-1-pengpeng@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx8qxp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c
index 3ae162625bb1a4..15b08fc02f920f 100644
--- a/drivers/clk/imx/clk-imx8qxp.c
+++ b/drivers/clk/imx/clk-imx8qxp.c
@@ -337,6 +337,7 @@ static const struct of_device_id imx8qxp_match[] = {
 	{ .compatible = "fsl,imx8qm-clk", &imx_clk_scu_rsrc_imx8qm, },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, imx8qxp_match);
 
 static struct platform_driver imx8qxp_clk_driver = {
 	.driver = {

From 7554cd67a40233207caa28993a5d9d828c970020 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:01:41 +0800
Subject: [PATCH 0262/1982] clk: imx: imx8qxp-lpcg: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit e89485455ac49925565061733c0d73d568333fc0 ]

The driver has a match table for the of bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20260704150344.59563-1-pengpeng@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx8qxp-lpcg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
index 1dae3410ee99a1..f0cf6cf9189926 100644
--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
+++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
@@ -354,6 +354,7 @@ static const struct of_device_id imx8qxp_lpcg_match[] = {
 	{ .compatible = "fsl,imx8qxp-lpcg", NULL },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, imx8qxp_lpcg_match);
 
 static struct platform_driver imx8qxp_lpcg_clk_driver = {
 	.driver = {

From fe6152b31967faf0b2427e948bd1fd0c9657e6c6 Mon Sep 17 00:00:00 2001
From: Chen Changcheng <chenchangcheng@kylinos.cn>
Date: Fri, 24 Jul 2026 10:52:18 +0800
Subject: [PATCH 0263/1982] media: cx88: fix memory leak in
 cx8802_register_driver() error path

[ Upstream commit e228b8b1a5b47a72b265671dc6d864c0da5528d0 ]

In cx8802_register_driver(), when drv->probe(driver) fails (non-zero),
the allocated cx8802_driver struct is freed neither in the else branch
nor later in cx8802_unregister_driver() (which only frees entries that
were added to dev->drvlist on success). Each failed probe leaks the
driver struct.

Add kfree(driver) in the else branch to fix the leak.

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx88/cx88-mpeg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
index 2c1d5137ac4703..bc08b35e247e01 100644
--- a/drivers/media/pci/cx88/cx88-mpeg.c
+++ b/drivers/media/pci/cx88/cx88-mpeg.c
@@ -640,6 +640,7 @@ int cx8802_register_driver(struct cx8802_driver *drv)
 			list_add_tail(&driver->drvlist, &dev->drvlist);
 		} else {
 			pr_err("cx8802 probe failed, err = %d\n", err);
+			kfree(driver);
 		}
 		mutex_unlock(&drv->core->lock);
 	}

From 1d6ad628f553d8db613ef3affc2c408582f5720a Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:44:50 +0800
Subject: [PATCH 0264/1982] clk: mediatek: mt6735-vdecsys: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 096ab64a0e69460bfb3557d09e17d2933280a1c6 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt6735-vdecsys.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/mediatek/clk-mt6735-vdecsys.c b/drivers/clk/mediatek/clk-mt6735-vdecsys.c
index 8817085fc1db4f..d53ebf92e878de 100644
--- a/drivers/clk/mediatek/clk-mt6735-vdecsys.c
+++ b/drivers/clk/mediatek/clk-mt6735-vdecsys.c
@@ -63,6 +63,7 @@ static const struct of_device_id of_match_mt6735_vdecsys[] = {
 	{ .compatible = "mediatek,mt6735-vdecsys", .data = &vdecsys_clks },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, of_match_mt6735_vdecsys);
 
 static struct platform_driver clk_mt6735_vdecsys = {
 	.probe = mtk_clk_simple_probe,

From 409acb7efcbfdcb7037ec4fde86788becd6b77fc Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:48:08 +0800
Subject: [PATCH 0265/1982] clk: mediatek: mt6735-vencsys: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 36cf8d279ff90835f4b002dec28eedb059554842 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt6735-vencsys.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/mediatek/clk-mt6735-vencsys.c b/drivers/clk/mediatek/clk-mt6735-vencsys.c
index 8dec7f98492ac5..64ba9da9fd4270 100644
--- a/drivers/clk/mediatek/clk-mt6735-vencsys.c
+++ b/drivers/clk/mediatek/clk-mt6735-vencsys.c
@@ -37,6 +37,7 @@ static const struct of_device_id of_match_mt6735_vencsys[] = {
 	{ .compatible = "mediatek,mt6735-vencsys", .data = &vencsys_clks },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, of_match_mt6735_vencsys);
 
 static struct platform_driver clk_mt6735_vencsys = {
 	.probe = mtk_clk_simple_probe,

From 91b9c9cc4066fea6f1277a6bdf461a6b8b89e8b8 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Thu, 25 Jun 2026 11:30:52 +0300
Subject: [PATCH 0266/1982] clk: tegra: support 48MHz clock for pll_p_out1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 46e31d69a547530fbef499bde888b6bb45a1deac ]

UEFI on Surface2 sets pll_p_out1 to 48MHz which is not supported by kernel
and causes BUG() early on. Add 48MHz clock support for pll_p_out1.

Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/tegra/clk-pll.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index 591b9f0c155a03..e48ca3f4b5f860 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -575,6 +575,7 @@ static int _calc_rate(struct clk_hw *hw, struct tegra_clk_pll_freq_table *cfg,
 		break;
 	case 9600000:
 	case 28800000:
+	case 48000000:
 		/*
 		 * PLL_P_OUT1 rate is not listed in PLLA table
 		 */

From 39985760acd2b65aa953e49016c098a8e989e0e1 Mon Sep 17 00:00:00 2001
From: Colin Foster <colin.foster@in-advantage.com>
Date: Mon, 29 Jun 2026 15:53:44 -0500
Subject: [PATCH 0267/1982] clk: clocking-wizard: fix clock difference
 detection

[ Upstream commit 006ba909c240b832c876b7aed29c6beec9d1f5e5 ]

Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/xilinx/clk-xlnx-clock-wizard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
index dbef983eb42520..4ef0595f7d993e 100644
--- a/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
+++ b/drivers/clk/xilinx/clk-xlnx-clock-wizard.c
@@ -406,7 +406,7 @@ static int clk_wzrd_get_divisors(struct clk_hw *hw, unsigned long rate,
 			if (o < omin || o > omax)
 				continue;
 			freq = DIV_ROUND_CLOSEST_ULL(vco_freq, o);
-			diff = freq - rate;
+			diff = abs(freq - rate);
 			if (diff < best_diff) {
 				best_diff = diff;
 				divider->m = m >> 3;

From 47aa1638074e20f6b6540e7ae561f07940b61e65 Mon Sep 17 00:00:00 2001
From: Gary Guo <gary@garyguo.net>
Date: Thu, 23 Jul 2026 23:00:40 +0100
Subject: [PATCH 0268/1982] ata: ata_generic: Don't store pci_device_id

[ Upstream commit 4f3075f629077a8cb3d3455c794a1f4a8fc8b43e ]

pci_device_id is not guaranteed to live longer than probe due to presence
of dynamic ID. All information apart from driver_data can be easily
retrieved from pci_dev, so just store driver_data.

Signed-off-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://patch.msgid.link/20260723-pci_id_fix-v4-1-3580726844e1@garyguo.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/ata_generic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index e70b6c089cf179..18ea740ca58293 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -51,11 +51,11 @@ enum {
 static int generic_set_mode(struct ata_link *link, struct ata_device **unused)
 {
 	struct ata_port *ap = link->ap;
-	const struct pci_device_id *id = ap->host->private_data;
+	unsigned long driver_data = (unsigned long)ap->host->private_data;
 	int dma_enabled = 0;
 	struct ata_device *dev;
 
-	if (id->driver_data & ATA_GEN_FORCE_DMA) {
+	if (driver_data & ATA_GEN_FORCE_DMA) {
 		dma_enabled = 0xff;
 	} else if (ap->ioaddr.bmdma_addr) {
 		/* Bits 5 and 6 indicate if DMA is active on master/slave */
@@ -206,7 +206,7 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
 			return rc;
 		pcim_pin_device(dev);
 	}
-	return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, (void *)id, 0);
+	return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, (void *)id->driver_data, 0);
 }
 
 static const struct pci_device_id ata_generic[] = {

From 27577bc864c76dcb614afbd04a9a6a0327bf8156 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Wed, 24 Jun 2026 13:52:37 +0800
Subject: [PATCH 0269/1982] i2c: qup: Propagate clock enable failures

[ Upstream commit a477626332800942f463d76aa48db0c47f1dfd18 ]

The QUP I2C driver treats the core and iface clocks as required
resources, but qup_i2c_enable_clocks() ignores clk_prepare_enable()
failures.  Probe can then continue to register the I2C adapter, and
runtime/system resume can return success, even when a required clock
transition failed.

Make the helper return an error, unwind a partially enabled clock, and
propagate failures from probe and resume paths.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260624055237.29977-1-pengpeng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-qup.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index a0e076fc5f3637..ee7915ee2ba2f0 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1657,10 +1657,21 @@ static const struct i2c_adapter_quirks qup_i2c_quirks_v2 = {
 	.flags = I2C_AQ_NO_ZERO_LEN,
 };
 
-static void qup_i2c_enable_clocks(struct qup_i2c_dev *qup)
+static int qup_i2c_enable_clocks(struct qup_i2c_dev *qup)
 {
-	clk_prepare_enable(qup->clk);
-	clk_prepare_enable(qup->pclk);
+	int ret;
+
+	ret = clk_prepare_enable(qup->clk);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(qup->pclk);
+	if (ret) {
+		clk_disable_unprepare(qup->clk);
+		return ret;
+	}
+
+	return 0;
 }
 
 static void qup_i2c_disable_clocks(struct qup_i2c_dev *qup)
@@ -1823,7 +1834,9 @@ static int qup_i2c_probe(struct platform_device *pdev)
 			ret = PTR_ERR(qup->pclk);
 			goto fail_dma;
 		}
-		qup_i2c_enable_clocks(qup);
+		ret = qup_i2c_enable_clocks(qup);
+		if (ret)
+			goto fail_dma;
 		src_clk_freq = clk_get_rate(qup->clk);
 	}
 	qup->src_clk_freq = src_clk_freq;
@@ -1975,8 +1988,7 @@ static int qup_i2c_pm_resume_runtime(struct device *device)
 	struct qup_i2c_dev *qup = dev_get_drvdata(device);
 
 	dev_dbg(device, "pm_runtime: resuming...\n");
-	qup_i2c_enable_clocks(qup);
-	return 0;
+	return qup_i2c_enable_clocks(qup);
 }
 
 static int qup_i2c_suspend(struct device *device)
@@ -1988,7 +2000,12 @@ static int qup_i2c_suspend(struct device *device)
 
 static int qup_i2c_resume(struct device *device)
 {
-	qup_i2c_pm_resume_runtime(device);
+	int ret;
+
+	ret = qup_i2c_pm_resume_runtime(device);
+	if (ret)
+		return ret;
+
 	pm_request_autosuspend(device);
 	return 0;
 }

From b42b5fcf47c75797e8cba0f78c5ac020e5889e41 Mon Sep 17 00:00:00 2001
From: David Strahan <David.Strahan@microchip.com>
Date: Wed, 22 Jul 2026 17:04:00 -0500
Subject: [PATCH 0270/1982] scsi: smartpqi: Add new PCI device-ids

[ Upstream commit 1a220e6e87a31c2572cd07ff47023e5cd92ac80f ]

All PCI ID entries in Hex.

Add PCI IDs for Hurray Data controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 207d / 4246
                                            9005 / 028f / 207d / 4256
                                            9005 / 028f / 207d / 4356
                                            9005 / 028f / 207d / 4940
                                            9005 / 028f / 207d / 4a46

Add PCI IDs for ZTE controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1cf2 / 5451
                                            9005 / 028f / 1cf2 / 5452
                                            9005 / 028f / 1cf2 / 5453

Add PCI ID for Ramaxel controller:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1f3f / 0670

Signed-off-by: David Strahan <david.strahan@microchip.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/
Link: https://patch.msgid.link/20260722220401.6357-4-david.strahan@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 36 +++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 88cffb1fb59ced..3f5fabf723c3ea 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -10152,10 +10152,30 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4240)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4246)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4256)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4356)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4840)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4940)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4a46)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_ADVANTECH, 0x8312)
@@ -10340,6 +10360,18 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x544f)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5451)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5452)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5453)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x54da)
@@ -10380,6 +10412,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1f3f, 0x0610)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1f3f, 0x0670)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_LENOVO, 0x0220)

From a5bc8c907c9fa3540f750a4c3ea2b25bd54cacb4 Mon Sep 17 00:00:00 2001
From: Amber Lin <amber.lin@amd.com>
Date: Tue, 28 Jul 2026 14:08:20 -0400
Subject: [PATCH 0271/1982] drm/amdkfd: Fix signal reset event

[ Upstream commit b38f9b6ffdfc86d5aff36881d9e8028c79bc98c9 ]

When a mode reset happens, driver needs to notify the process on that
GPU a reset event is happening. The existing code assumes the process is
using the GPU that is getting mode reset, which is not always true. For
example, on a 8G system, the process may be only using GPU 0~4 but a
mode 2 reset is resetting the all 8 GPUs connected by XGMI. Trying to
find a process on GPU 5~7 will fail, which is fine and should skip the
event signal.

Signed-off-by: Amber Lin <amber.lin@amd.com>
Reviewed-by: David Yat Sin <david.yatsin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_events.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index b033c3a9ce545a..aac5bc4d13fdb7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -1287,6 +1287,8 @@ void kfd_signal_reset_event(struct kfd_node *dev)
 	struct kfd_event *ev;
 	unsigned int temp;
 	uint32_t id, idx;
+	int user_gpu_id;
+	struct kfd_process_device *pdd;
 	int reset_cause = atomic_read(&dev->sram_ecc_flag) ?
 			KFD_HW_EXCEPTION_ECC :
 			KFD_HW_EXCEPTION_GPU_HANG;
@@ -1302,17 +1304,14 @@ void kfd_signal_reset_event(struct kfd_node *dev)
 
 	idx = srcu_read_lock(&kfd_processes_srcu);
 	hash_for_each_rcu(kfd_processes_table, temp, p, kfd_processes) {
-		int user_gpu_id = kfd_process_get_user_gpu_id(p, dev->id);
-		struct kfd_process_device *pdd = kfd_get_process_device_data(dev, p);
-
-		if (unlikely(user_gpu_id == -EINVAL)) {
-			WARN_ONCE(1, "Could not get user_gpu_id from dev->id:%x\n", dev->id);
+		pdd = kfd_get_process_device_data(dev, p);
+		if (!pdd)
+			/* no process is using this device */
 			continue;
-		}
+		user_gpu_id = kfd_process_get_user_gpu_id(p, dev->id);
 
-		if (unlikely(!pdd)) {
-			WARN_ONCE(1, "Could not get device data from process pid:%d\n",
-				  p->lead_thread->pid);
+		if (unlikely(user_gpu_id == -EINVAL)) {
+			WARN_ONCE(1, "Could not get user_gpu_id from dev->id:%d\n", dev->id);
 			continue;
 		}
 

From a5c18f62c897e0cffc469db8af52143a6e1b57f3 Mon Sep 17 00:00:00 2001
From: Matthew Stewart <Matthew.Stewart2@amd.com>
Date: Fri, 19 Jun 2026 13:41:36 -0400
Subject: [PATCH 0272/1982] drm/amd/display: Fix rounding errors in
 CalculatePrefetchSchedule

[ Upstream commit fa0300333db07ca4ad56c9879f155faafd3f7079 ]

[why]

Rounding errors were causing mode validation to fail in some cases when
it should not. (IE. Increasing fclk from a lower value could lead to
validation failure, which should not happen.)

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c   | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
index da865bd466c9ad..c32b704627085d 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
@@ -5554,7 +5554,8 @@ static bool CalculatePrefetchSchedule(struct dml2_core_internal_scratch *scratch
 				+ 2 * (p->PixelPTEBytesPerRow * p->HostVMInefficiencyFactor + p->meta_row_bytes + tdlut_row_bytes)
 				+ *p->prefetch_sw_bytes)
 				/ (*p->Tpre_rounded - *p->Tno_bw);
-			s->Tsw_est1 = *p->prefetch_sw_bytes / s->prefetch_bw1;
+			/* due to rounding, VM can clamp to +1/4, Row can clamp to +2/4, giving SW less time */
+			s->Tsw_est1 = *p->prefetch_sw_bytes / s->prefetch_bw1 - 3.0 * s->LineTime / 4.0;
 		} else
 			s->prefetch_bw1 = 0;
 
@@ -5578,7 +5579,8 @@ static bool CalculatePrefetchSchedule(struct dml2_core_internal_scratch *scratch
 		if (*p->Tpre_rounded - *p->Tno_bw - 2.0 * s->Tr0_trips_rounded > 0) {
 			s->prefetch_bw2 = (vm_bytes * p->HostVMInefficiencyFactor + *p->prefetch_sw_bytes) /
 			(*p->Tpre_rounded - *p->Tno_bw - 2.0 * s->Tr0_trips_rounded);
-			s->Tsw_est2 = *p->prefetch_sw_bytes / s->prefetch_bw2;
+			/* due to rounding, VM can clamp to +1/4  */
+			s->Tsw_est2 = *p->prefetch_sw_bytes / s->prefetch_bw2 - 1.0 * s->LineTime / 4.0;
 		} else
 			s->prefetch_bw2 = 0;
 
@@ -5592,7 +5594,8 @@ static bool CalculatePrefetchSchedule(struct dml2_core_internal_scratch *scratch
 		if (*p->Tpre_rounded - s->Tvm_trips_rounded > 0) {
 			s->prefetch_bw3 = (2 * (p->PixelPTEBytesPerRow * p->HostVMInefficiencyFactor + p->meta_row_bytes + tdlut_row_bytes) + *p->prefetch_sw_bytes) /
 				(*p->Tpre_rounded - s->Tvm_trips_rounded);
-			s->Tsw_est3 = *p->prefetch_sw_bytes / s->prefetch_bw3;
+			/* due to rounding, Row can clamp to +2/4  */
+			s->Tsw_est3 = *p->prefetch_sw_bytes / s->prefetch_bw3 - 2.0 * s->LineTime / 4.0;
 		} else
 			s->prefetch_bw3 = 0;
 

From f10cfe517a1581a10d3758a7cca3c51181a6ef06 Mon Sep 17 00:00:00 2001
From: K Prateek Nayak <kprateek.nayak@amd.com>
Date: Tue, 28 Jul 2026 05:25:34 +0000
Subject: [PATCH 0273/1982] arm64/runtime-const: Use
 aarch64_insn_patch_text_nosync() for patching

[ Upstream commit a6690350a4ae7558b39d15fcc776c4d1ab5bbf39 ]

The current scheme to directly patch the kernel text for runtime
constants runs into the following issue with futex adapted to using
runtime constants on arm64:

  Unable to handle kernel write to read-only memory at virtual address ...

The pc points to the *p assignment in the following call chain:

  futex_init()
    runtime_const_init(shift, __futex_shift)
      __runtime_fixup_shift()
        *p = cpu_to_le32(insn);

which suggests that core_initcall() is too late to patch the kernel text
directly unlike the "d_hash_shift" which is initialized during
vfs_caches_init_early() before the protections are in place.

Use aarch64_insn_patch_text_nosync() to patch the runtime constants
instead of doing it directly to allow runtime_const_init() slightly
later into the boot.

Since aarch64_insn_patch_text_nosync() calls caches_clean_inval_pou()
internally, __runtime_fixup_caches() ends up being redundant.
runtime_const_init() are rare and the overheads of multiple calls to
caches_clean_inval_pou() instead of batching them together should be
negligible in practice.

The cpu_to_le32() conversion of instruction isn't necessary since it is
handled later in the aarch64_insn_patch_text_nosync() call-chain:

  aarch64_insn_patch_text_nosync(addr, insn)
    aarch64_insn_write(addr, insn)
      __aarch64_insn_write(addr, cpu_to_le32(insn))

Sashiko noted that aarch64_insn_patch_text_nosync() does not expect a
lm_alias() address and Catalin suggested it is safe to drop the
lm_alias() for runtime patching since the kernel text is readable. The
address passed to fixup function is interpreted as a __le32 and
dereferenced as is to read the opcode at the patch site.

No functional changes are intended.

Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260728052540.4728-3-kprateek.nayak@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/runtime-const.h | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/arch/arm64/include/asm/runtime-const.h b/arch/arm64/include/asm/runtime-const.h
index be5915669d239a..31a6f94e579558 100644
--- a/arch/arm64/include/asm/runtime-const.h
+++ b/arch/arm64/include/asm/runtime-const.h
@@ -3,6 +3,7 @@
 #define _ASM_RUNTIME_CONST_H
 
 #include <asm/cacheflush.h>
+#include <asm/text-patching.h>
 
 /* Sigh. You can still run arm64 in BE mode */
 #include <asm/byteorder.h>
@@ -46,34 +47,26 @@ static inline void __runtime_fixup_16(__le32 *p, unsigned int val)
 	u32 insn = le32_to_cpu(*p);
 	insn &= 0xffe0001f;
 	insn |= (val & 0xffff) << 5;
-	*p = cpu_to_le32(insn);
-}
-
-static inline void __runtime_fixup_caches(void *where, unsigned int insns)
-{
-	unsigned long va = (unsigned long)where;
-	caches_clean_inval_pou(va, va + 4*insns);
+	aarch64_insn_patch_text_nosync(p, insn);
 }
 
 static inline void __runtime_fixup_ptr(void *where, unsigned long val)
 {
-	__le32 *p = lm_alias(where);
+	__le32 *p = where;
 	__runtime_fixup_16(p, val);
 	__runtime_fixup_16(p+1, val >> 16);
 	__runtime_fixup_16(p+2, val >> 32);
 	__runtime_fixup_16(p+3, val >> 48);
-	__runtime_fixup_caches(where, 4);
 }
 
 /* Immediate value is 6 bits starting at bit #16 */
 static inline void __runtime_fixup_shift(void *where, unsigned long val)
 {
-	__le32 *p = lm_alias(where);
+	__le32 *p = where;
 	u32 insn = le32_to_cpu(*p);
 	insn &= 0xffc0ffff;
 	insn |= (val & 63) << 16;
-	*p = cpu_to_le32(insn);
-	__runtime_fixup_caches(where, 1);
+	aarch64_insn_patch_text_nosync(p, insn);
 }
 
 static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),

From 521f9dcf2e2614c0b3a9adee3b0724b4fb401154 Mon Sep 17 00:00:00 2001
From: Yichong Chen <chenyichong@uniontech.com>
Date: Wed, 29 Jul 2026 10:25:43 +0800
Subject: [PATCH 0274/1982] exfat: clean up new entry on add entry failure

[ Upstream commit 0901a71e8cff5c60dd464529cba2ed30a2ab0a3f ]

exfat_add_entry() initializes a new directory entry set before writing it
with exfat_put_dentry_set().  If the write fails, mkdir/create returns an
error but a partially written entry may be left behind.

For non-zero-size directories, the failure also happens after a cluster
has been allocated for the new directory.  Clean up the new entry
best-effort, and free the newly allocated directory cluster only when the
cleanup writeback succeeds.  This avoids freeing a cluster that may still
be referenced by an on-disk entry if the cleanup fails.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exfat/namei.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 06bed867b46adf..9fe6635c60a42d 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -476,6 +476,7 @@ static int exfat_add_entry(struct inode *inode, const char *path,
 	struct exfat_entry_set_cache es;
 	int clu_size = 0;
 	unsigned int start_clu = EXFAT_FREE_CLUSTER;
+	bool dir_allocated = false;
 
 	ret = exfat_resolve_path(inode, path, &uniname);
 	if (ret)
@@ -502,6 +503,7 @@ static int exfat_add_entry(struct inode *inode, const char *path,
 		}
 		start_clu = clu.dir;
 		clu_size = sbi->cluster_size;
+		dir_allocated = true;
 	}
 
 	/* update the directory entry */
@@ -512,8 +514,21 @@ static int exfat_add_entry(struct inode *inode, const char *path,
 	exfat_init_ext_entry(&es, num_entries, &uniname, NULL, 0);
 
 	ret = exfat_put_dentry_set(&es, IS_DIRSYNC(inode));
-	if (ret)
+	if (ret) {
+		int cleanup_ret;
+
+		cleanup_ret = exfat_get_dentry_set(&es, sb, &info->dir,
+						   dentry, ES_ALL_ENTRIES);
+		if (!cleanup_ret) {
+			exfat_remove_entries(inode, &es, ES_IDX_FILE, false);
+			cleanup_ret = exfat_put_dentry_set(&es,
+							   IS_DIRSYNC(inode));
+		}
+
+		if (!cleanup_ret && dir_allocated)
+			exfat_free_cluster(inode, &clu);
 		goto out;
+	}
 
 	info->entry = dentry;
 	info->flags = ALLOC_NO_FAT_CHAIN;

From 53b20af866fac2cf29ae749cc8c2ff83974ff760 Mon Sep 17 00:00:00 2001
From: wangdicheng <wangdicheng@kylinos.cn>
Date: Wed, 29 Jul 2026 15:09:35 +0800
Subject: [PATCH 0275/1982] ALSA: hda/conexant: Add NULL check for dc_mode_path

[ Upstream commit 273806f38ce95c95c288a03d3de1e423cd3e5543 ]

snd_hda_add_new_path() returns NULL when no path exists between the
given NIDs, but olpc_xo_update_mic_pins() passes dc_mode_path
straight to snd_hda_activate_path() which dereferences it without
checking. Add the missing NULL guards, same as the local path
variable already has in the same function.

Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
Link: https://patch.msgid.link/20260729070935.548050-2-wangdich9700@163.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/conexant.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index fe7445fabb8870..56d6fbdd9b06de 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -457,7 +457,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
 	if (!spec->dc_enable) {
 		/* disable DC bias path and pin for port F */
 		update_mic_pin(codec, 0x1e, 0);
-		snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
+		if (spec->dc_mode_path)
+			snd_hda_activate_path(codec, spec->dc_mode_path, false, false);
 
 		/* update port B (ext mic) and C (int mic) */
 		/* OLPC defers mic widget control until when capture is
@@ -493,7 +494,8 @@ static void olpc_xo_update_mic_pins(struct hda_codec *codec)
 		update_mic_pin(codec, 0x1b, 0);
 		/* enable DC bias path and pin */
 		update_mic_pin(codec, 0x1e, spec->recording ? PIN_IN : 0);
-		snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
+		if (spec->dc_mode_path)
+			snd_hda_activate_path(codec, spec->dc_mode_path, true, false);
 	}
 }
 

From 94e9beb9f07edf273f5a0fa1bfc972a50c48b29e Mon Sep 17 00:00:00 2001
From: Rob Clark <robin.clark@oss.qualcomm.com>
Date: Wed, 29 Jul 2026 08:55:42 -0700
Subject: [PATCH 0276/1982] drm/msm: Move nr_cmds initialization

[ Upstream commit 9ee2884ed58e6b39da35732146446d5930e4746b ]

Previously if we entered an error path between these two points, we
could leak the relocs tables due to submit->nr_cmds still being zero.

In practice, relocs are disallowed on a6xx+, and non-ancient userspace
will not use relocs on earlier gens unless running on an ancient kernel.
But userspace could use this to trigger a memory leak.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743085/
Message-ID: <20260729155609.20190-6-robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_gem_submit.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 75d9f357437006..2b6b5297f05927 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -260,6 +260,9 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit,
 			ret = -ENOMEM;
 			goto out;
 		}
+
+		submit->nr_cmds = i + 1;
+
 		ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
 		if (ret) {
 			ret = -EFAULT;
@@ -717,8 +720,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
 			goto out;
 	}
 
-	submit->nr_cmds = args->nr_cmds;
-
 	idr_preload(GFP_KERNEL);
 
 	spin_lock(&queue->idr_lock);

From 7ad1c9970678a40372e1991b7e23d4858753e32f Mon Sep 17 00:00:00 2001
From: Rob Clark <robin.clark@oss.qualcomm.com>
Date: Wed, 29 Jul 2026 08:55:38 -0700
Subject: [PATCH 0277/1982] drm/msm: Fix barriers accessing ctx vm

[ Upstream commit ae88499d71ce80ecd25c055eddddace108266321 ]

Don't rely on store ordering to protect us from caller seeing a
partially initialized vm.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743079/
Message-ID: <20260729155609.20190-2-robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_drv.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index c2a8aaa33f84a5..8094e5e7e9a54c 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -226,18 +226,19 @@ struct drm_gpuvm *msm_context_vm(struct drm_device *dev, struct msm_context *ctx
 {
 	static DEFINE_MUTEX(init_lock);
 	struct msm_drm_private *priv = dev->dev_private;
+	struct drm_gpuvm *vm = smp_load_acquire(&ctx->vm);
 
 	/* Once ctx->vm is created it is valid for the lifetime of the context: */
-	if (ctx->vm)
-		return ctx->vm;
+	if (vm)
+		return vm;
+
+	guard(mutex)(&init_lock);
 
-	mutex_lock(&init_lock);
 	if (!ctx->vm) {
-		ctx->vm = msm_gpu_create_private_vm(
+		vm = msm_gpu_create_private_vm(
 			priv->gpu, current, !ctx->userspace_managed_vm);
-
+		smp_store_release(&ctx->vm, vm);
 	}
-	mutex_unlock(&init_lock);
 
 	return ctx->vm;
 }

From ad0976d2cc58b1c3d55d320882a6d02f985b5ecd Mon Sep 17 00:00:00 2001
From: Armin Wolf <W_Armin@gmx.de>
Date: Mon, 20 Jul 2026 15:19:19 +0200
Subject: [PATCH 0278/1982] platform/x86: dell-smbios-wmi: Fix chardev resource
 management
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 41427211f663c6eb36986ca2ea68d7e87aac52e9 ]

When unbinding the WMI driver while a userspace application has
an open file descriptor for the character device, a UAF occurs:

KASAN: slab-use-after-free in _copy_to_user from platform/x86/dell-smbios-wmi

The reason for this is that even after calling misc_deregister(),
userspace appications can still call read() and/or ioctl() on open
file descriptors associated with the already unregistered character
device. This causes a UAF by attempting to access the already freed
state container of the WMI driver.

Fix this by no longer storing the state container inside
filp->private_data. Instead retrieve the state container using
get_first_smbios_priv() and return -ENODEV if the state container
does not exist anymore.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/platform-driver-x86/178144969601.60470.13396800403157907003@gmail.com/
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260720131921.368000-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/dell/dell-smbios-wmi.c | 67 +++++++++++----------
 1 file changed, 34 insertions(+), 33 deletions(-)

diff --git a/drivers/platform/x86/dell/dell-smbios-wmi.c b/drivers/platform/x86/dell/dell-smbios-wmi.c
index a7dca8c59d6027..0729c5a1945c7c 100644
--- a/drivers/platform/x86/dell/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell/dell-smbios-wmi.c
@@ -6,6 +6,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/dmi.h>
 #include <linux/fs.h>
@@ -13,14 +14,13 @@
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/rwsem.h>
 #include <linux/uaccess.h>
 #include <linux/wmi.h>
 #include <uapi/linux/wmi.h>
 #include "dell-smbios.h"
 #include "dell-wmi-descriptor.h"
 
-static DEFINE_MUTEX(call_mutex);
-static DEFINE_MUTEX(list_mutex);
 static int wmi_supported;
 
 struct misc_bios_flags_structure {
@@ -32,6 +32,7 @@ struct misc_bios_flags_structure {
 #define DELL_WMI_SMBIOS_GUID "A80593CE-A997-11DA-B012-B622A1EF5492"
 
 struct wmi_smbios_priv {
+	struct mutex call_lock; /* Protects the content of the SMBIOS buffer */
 	struct dell_wmi_smbios_buffer *buf;
 	struct list_head list;
 	struct wmi_device *wdev;
@@ -39,6 +40,8 @@ struct wmi_smbios_priv {
 	u64 req_buf_size;
 	struct miscdevice char_dev;
 };
+
+static DECLARE_RWSEM(list_lock);	/* Protects access to wmi_list */
 static LIST_HEAD(wmi_list);
 
 static inline struct wmi_smbios_priv *get_first_smbios_priv(void)
@@ -93,40 +96,35 @@ static int dell_smbios_wmi_call(struct calling_interface_buffer *buffer)
 	size_t size;
 	int ret;
 
-	mutex_lock(&call_mutex);
+	guard(rwsem_read)(&list_lock);
+
 	priv = get_first_smbios_priv();
-	if (!priv) {
-		ret = -ENODEV;
-		goto out_wmi_call;
-	}
+	if (!priv)
+		return -ENODEV;
 
 	size = sizeof(struct calling_interface_buffer);
 	difference = priv->req_buf_size - sizeof(u64) - size;
 
+	guard(mutex)(&priv->call_lock);
+
 	memset(&priv->buf->ext, 0, difference);
 	memcpy(&priv->buf->std, buffer, size);
 	ret = run_smbios_call(priv->wdev);
 	memcpy(buffer, &priv->buf->std, size);
-out_wmi_call:
-	mutex_unlock(&call_mutex);
 
 	return ret;
 }
 
-static int dell_smbios_wmi_open(struct inode *inode, struct file *filp)
+static ssize_t dell_smbios_wmi_read(struct file *filp, char __user *buffer, size_t length,
+				    loff_t *offset)
 {
 	struct wmi_smbios_priv *priv;
 
-	priv = container_of(filp->private_data, struct wmi_smbios_priv, char_dev);
-	filp->private_data = priv;
+	guard(rwsem_read)(&list_lock);
 
-	return nonseekable_open(inode, filp);
-}
-
-static ssize_t dell_smbios_wmi_read(struct file *filp, char __user *buffer, size_t length,
-				    loff_t *offset)
-{
-	struct wmi_smbios_priv *priv = filp->private_data;
+	priv = get_first_smbios_priv();
+	if (!priv)
+		return -ENODEV;
 
 	return simple_read_from_buffer(buffer, length, offset, &priv->req_buf_size,
 				       sizeof(priv->req_buf_size));
@@ -173,22 +171,24 @@ static long dell_smbios_wmi_do_ioctl(struct wmi_smbios_priv *priv,
 static long dell_smbios_wmi_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct dell_wmi_smbios_buffer __user *input = (struct dell_wmi_smbios_buffer __user *)arg;
-	struct wmi_smbios_priv *priv = filp->private_data;
-	long ret;
+	struct wmi_smbios_priv *priv;
 
 	if (cmd != DELL_WMI_SMBIOS_CMD)
 		return -ENOIOCTLCMD;
 
-	mutex_lock(&call_mutex);
-	ret = dell_smbios_wmi_do_ioctl(priv, input);
-	mutex_unlock(&call_mutex);
+	guard(rwsem_read)(&list_lock);
 
-	return ret;
+	priv = get_first_smbios_priv();
+	if (!priv)
+		return -ENODEV;
+
+	guard(mutex)(&priv->call_lock);
+
+	return dell_smbios_wmi_do_ioctl(priv, input);
 }
 
 static const struct file_operations dell_smbios_wmi_fops = {
 	.owner		= THIS_MODULE,
-	.open		= dell_smbios_wmi_open,
 	.read		= dell_smbios_wmi_read,
 	.unlocked_ioctl	= dell_smbios_wmi_ioctl,
 	.compat_ioctl	= compat_ptr_ioctl,
@@ -260,6 +260,10 @@ static int dell_smbios_wmi_probe(struct wmi_device *wdev, const void *context)
 	if (!priv->buf)
 		return -ENOMEM;
 
+	ret = devm_mutex_init(&wdev->dev, &priv->call_lock);
+	if (ret)
+		return ret;
+
 	ret = dell_smbios_wmi_register_chardev(priv);
 	if (ret)
 		return ret;
@@ -268,9 +272,8 @@ static int dell_smbios_wmi_probe(struct wmi_device *wdev, const void *context)
 	if (ret)
 		return ret;
 
-	mutex_lock(&list_mutex);
+	guard(rwsem_write)(&list_lock);
 	list_add_tail(&priv->list, &wmi_list);
-	mutex_unlock(&list_mutex);
 
 	return 0;
 }
@@ -279,12 +282,10 @@ static void dell_smbios_wmi_remove(struct wmi_device *wdev)
 {
 	struct wmi_smbios_priv *priv = dev_get_drvdata(&wdev->dev);
 
-	mutex_lock(&call_mutex);
-	mutex_lock(&list_mutex);
-	list_del(&priv->list);
-	mutex_unlock(&list_mutex);
 	dell_smbios_unregister_device(&wdev->dev);
-	mutex_unlock(&call_mutex);
+
+	guard(rwsem_write)(&list_lock);
+	list_del(&priv->list);
 }
 
 static const struct wmi_device_id dell_smbios_wmi_id_table[] = {

From 020be4f6fa046b862d92201bb29c5b908cd62d95 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Mon, 20 Jul 2026 10:58:28 +0200
Subject: [PATCH 0279/1982] s390/mm: Add missing mm check to
 do_secure_storage_access()

[ Upstream commit 7cf227b2707ed0129018c283ffc8f893945586db ]

Similar like the normal exception handler the secure storage access
exception handler needs to verify if mm is not NULL, which may happen
with kernel threads.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260717132345.539A11F00A3A@smtp.kernel.org/
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> ---
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/fault.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 069f72703a915b..46e5748b5b1b3f 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -404,9 +404,9 @@ void do_secure_storage_access(struct pt_regs *regs)
 {
 	union teid teid = { .val = regs->int_parm_long };
 	unsigned long addr = get_fault_address(regs);
+	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
 	struct folio_walk fw;
-	struct mm_struct *mm;
 	struct folio *folio;
 	int rc;
 
@@ -448,9 +448,8 @@ void do_secure_storage_access(struct pt_regs *regs)
 		if (rc)
 			return handle_fault_error_nolock(regs, 0);
 	} else {
-		if (faulthandler_disabled())
+		if (faulthandler_disabled() || !mm)
 			return handle_fault_error_nolock(regs, 0);
-		mm = current->mm;
 		mmap_read_lock(mm);
 		vma = find_vma(mm, addr);
 		if (!vma)

From 0d96af6c34ca3761196dbf69f3072bb671578755 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Mon, 20 Jul 2026 10:58:30 +0200
Subject: [PATCH 0280/1982] s390/mm: Fix handling of vmalloc area in
 do_secure_storage_access()

[ Upstream commit a2e5a9d853e015bc876399eb18435aa88101c60a ]

Secure storage access exceptions in vmalloc area need to be handled
separately since virt_to_phys() does not work on such addresses. Given
that there cannot be a valid access let such exceptions fail
immediately. The kernel will either fixup or crash.

Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> ---
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/fault.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 46e5748b5b1b3f..9d7d3ef99fc168 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -433,6 +433,8 @@ void do_secure_storage_access(struct pt_regs *regs)
 		panic("Unexpected PGM 0x3d with TEID bit 61=0");
 	}
 	if (is_kernel_fault(regs)) {
+		if (is_vmalloc_addr((void *)addr))
+			return handle_fault_error_nolock(regs, 0);
 		folio = virt_to_folio((void *)addr);
 		if (unlikely(!folio_try_get(folio)))
 			return;

From 2c6749d443ac2950b5e9101dc017b60b2a33d42d Mon Sep 17 00:00:00 2001
From: Weiji Wang <nebclllo0444@gmail.com>
Date: Tue, 28 Jul 2026 03:58:20 +0800
Subject: [PATCH 0281/1982] drm/panel-edp: Add BOE NE140QDM-NX2

[ Upstream commit 354b9c43d36ce9b41e48b2d67c5d9b953a0e9d64 ]

Add timing from datasheet for BOE NE140QDM-NX2.

edid-decode (hex):

00 ff ff ff ff ff ff 00 09 e5 f2 0a 00 00 00 00
20 1f 01 04 a5 1e 13 78 03 ee 96 a3 54 4c 99 26
0f 4e 51 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 60 d2 00 a0 a0 40 32 60 30 20
35 00 2e bd 10 00 00 18 c8 9d 00 a0 a0 40 32 60
30 20 35 00 2e bd 10 00 00 18 00 00 00 fd 00 30
78 c6 c6 36 01 0a 20 20 20 20 20 20 00 00 00 fe
00 4e 45 31 34 30 51 44 4d 2d 4e 58 32 20 01 f8

70 13 79 00 00 03 01 14 30 69 00 05 ff 09 9f 00
2f 00 1f 00 3f 06 31 00 02 00 04 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 90

Signed-off-by: Weiji Wang <nebclllo0444@gmail.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/82fc6395-3425-4f71-ba58-813856cee61d@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-edp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 614c63e95c3574..65e2f68b919efe 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1989,6 +1989,7 @@ static const struct edp_panel_entry edp_panels[] = {
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a6a, &delay_200_500_e80, "NV140WUM-N44"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ac5, &delay_200_500_e50, "NV116WHM-N4C"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ae8, &delay_200_500_e50_p2e80, "NV140WUM-N41"),
+	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0af2, &delay_200_500_e50_p2e80, "NE140QDM-NX2"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b09, &delay_200_500_e50_po2e200, "NV140FHM-NZ"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b1e, &delay_200_500_e80, "NE140QDM-N6A"),
 	EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80_d50, "NV122WUM-N41"),

From ff69fd262ed126255f8566853e2d6dfbaefb2cf7 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:43:08 +0800
Subject: [PATCH 0282/1982] soc: mediatek: add missing MODULE_DEVICE_TABLE()

[ Upstream commit ec762057868d70d474a9816e9c293c2ef801c3c9 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/mediatek/mtk-dvfsrc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/mediatek/mtk-dvfsrc.c b/drivers/soc/mediatek/mtk-dvfsrc.c
index 41add5636b03c0..af35d71615baf1 100644
--- a/drivers/soc/mediatek/mtk-dvfsrc.c
+++ b/drivers/soc/mediatek/mtk-dvfsrc.c
@@ -562,6 +562,7 @@ static const struct of_device_id mtk_dvfsrc_of_match[] = {
 	{ .compatible = "mediatek,mt8195-dvfsrc", .data = &mt8195_data },
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, mtk_dvfsrc_of_match);
 
 static struct platform_driver mtk_dvfsrc_driver = {
 	.probe	= mtk_dvfsrc_probe,

From ed7d338c57cddd8d404bcd40a42ba8d5c73fa9eb Mon Sep 17 00:00:00 2001
From: Yichong Chen <chenyichong@uniontech.com>
Date: Tue, 28 Jul 2026 12:29:23 +0800
Subject: [PATCH 0283/1982] exfat: free new directory cluster if zeroing fails

[ Upstream commit ce12a39bed483008683438962b3a605374e6f803 ]

exfat_alloc_new_dir() allocates a cluster for a new directory before
zeroing it.  If exfat_zeroed_cluster() fails, the function returns the
error but leaves the allocated cluster in use.

Free the newly allocated cluster before returning the zeroing error.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exfat/dir.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c
index 1f6cb533a48d18..d82b48722ef764 100644
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -310,7 +310,13 @@ int exfat_alloc_new_dir(struct inode *inode, struct exfat_chain *clu)
 	if (ret)
 		return ret;
 
-	return exfat_zeroed_cluster(inode, clu->dir);
+	ret = exfat_zeroed_cluster(inode, clu->dir);
+	if (ret) {
+		exfat_free_cluster(inode, clu);
+		return ret;
+	}
+
+	return 0;
 }
 
 int exfat_calc_num_entries(struct exfat_uni_name *p_uniname)

From 2728611a9cc501e4f6b0ebe2270d1fbbdee2e369 Mon Sep 17 00:00:00 2001
From: Bob Song <songxiebing@kylinos.cn>
Date: Thu, 30 Jul 2026 09:53:02 +0800
Subject: [PATCH 0284/1982] ALSA: hda/realtek: add missing NULL check for
 codec->bus->pci

[ Upstream commit 3b36ac93739e7b119a30affaee9c2dd41f24efbb ]

In alc269_probe(), codec->bus->pci is dereferenced without a NULL check
for the ALC236 vendor ID case. Add the missing check, consistent with
the existing pattern used elsewhere in the same function.

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260730015302.253008-2-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 6bf500c0b5f9b4..d88627558150f5 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -8451,6 +8451,7 @@ static int alc269_probe(struct hda_codec *codec, const struct hda_device_id *id)
 		spec->init_hook = alc256_init;
 		spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
 		if (codec->core.vendor_id == 0x10ec0236 &&
+		    codec->bus->pci &&
 		    codec->bus->pci->vendor != PCI_VENDOR_ID_AMD)
 			spec->en_3kpull_low = false;
 		break;

From f732a202ae1cac8958282b21d1c1cd17bd806afc Mon Sep 17 00:00:00 2001
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Date: Thu, 30 Jul 2026 10:42:58 +0200
Subject: [PATCH 0285/1982] fs/ntfs3: Fix memory leak in indx_find_sort()

[ Upstream commit 194491be54e1c9e4d29d3ee777b05ff031c4b670 ]

When popping a level from the index lookup stack, indx_find_sort() frees
the struct indx_node but not the index buffer it owns. Every call that
descends and then pops a level leaks that allocation.

Free n->index before freeing the node itself.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/index.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index edfcd28573ef97..03ae5a817c1b47 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1325,6 +1325,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		/* Pop one level. */
 		if (n) {
 			fnd_pop(fnd);
+			kfree(n->index);
 			kfree(n);
 		}
 

From 937f704f4bfc76d912c3df618d90b4e8e7277eb0 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 10 Jun 2026 16:03:52 -0700
Subject: [PATCH 0286/1982] mfd: ipaq-micro: Fix out-of-bounds stack read in
 ipaq_micro_str

[ Upstream commit da3a98c941753255418616d249e5b40db0927c26 ]

ipaq_micro_str() decodes a UTF-16LE string into an ASCII string.
It copies characters to a stack buffer retstr, but fails to
null-terminate it. When kstrdup() is called on retstr, it can read past
the buffer into uninitialized stack memory, potentially leaking stack
contents.

Fix this by initializing retstr to zero.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://patch.msgid.link/aintJF4X5tWDW-Ej@google.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/ipaq-micro.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/ipaq-micro.c b/drivers/mfd/ipaq-micro.c
index 4b757d84728251..5146a6eb0e5a68 100644
--- a/drivers/mfd/ipaq-micro.c
+++ b/drivers/mfd/ipaq-micro.c
@@ -221,7 +221,7 @@ static void ipaq_micro_eeprom_read(struct ipaq_micro *micro,
 
 static char *ipaq_micro_str(u8 *wchar, u8 len)
 {
-	char retstr[256];
+	char retstr[256] = { 0 };
 	u8 i;
 
 	for (i = 0; i < len / 2; i++)

From 6a81aedf497a49fa98439123c19a6811e9562b98 Mon Sep 17 00:00:00 2001
From: Bob Song <songxiebing@kylinos.cn>
Date: Thu, 30 Jul 2026 09:53:01 +0800
Subject: [PATCH 0287/1982] ALSA: hda/realtek: add missing error checks for
 COEF index reads in alc269

[ Upstream commit 5b106b40ed22098f2bc049efb645148d038444bd ]

alc_read_coef_idx() and alc_read_coefex_idx() can return -1 on error
via snd_hda_codec_read(). Several codec initialization and shutdown
functions save these return values and later write them back to
hardware registers without checking for errors, potentially corrupting
COEF register state on a read failure.

Add error checks in:
- alc282_init() and alc282_shutup(): check coef78 before write-back
- alc285_hp_init(): check coef38/coef0d/coef36 before update, check
  val before write-back, and break polling loop on error
- alc294_hp_init(): break polling loop on read error

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260730015302.253008-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index d88627558150f5..3364f6ad91fcbb 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -296,7 +296,8 @@ static void alc282_init(struct hda_codec *codec)
 		msleep(100);
 
 	/* Headphone capless set to normal mode */
-	alc_write_coef_idx(codec, 0x78, coef78);
+	if (coef78 != -1)
+		alc_write_coef_idx(codec, 0x78, coef78);
 }
 
 static void alc282_shutup(struct hda_codec *codec)
@@ -333,7 +334,8 @@ static void alc282_shutup(struct hda_codec *codec)
 
 	alc_auto_setup_eapd(codec, false);
 	alc_shutup_pins(codec);
-	alc_write_coef_idx(codec, 0x78, coef78);
+	if (coef78 != -1)
+		alc_write_coef_idx(codec, 0x78, coef78);
 }
 
 static const struct coef_fw alc283_coefs[] = {
@@ -585,15 +587,19 @@ static void alc285_hp_init(struct hda_codec *codec)
 
 	alc_write_coefex_idx(codec, 0x58, 0x00, 0xf888); /* HP depop procedure start */
 	val = alc_read_coefex_idx(codec, 0x58, 0x00);
-	for (i = 0; i < 20 && val & 0x8000; i++) {
+	for (i = 0; i < 20 && val != -1 && val & 0x8000; i++) {
 		msleep(50);
 		val = alc_read_coefex_idx(codec, 0x58, 0x00);
 	} /* Wait for depop procedure finish  */
 
-	alc_write_coefex_idx(codec, 0x58, 0x00, val); /* write back the result */
-	alc_update_coef_idx(codec, 0x38, 1<<4, coef38);
-	alc_update_coef_idx(codec, 0x0d, 0x110, coef0d);
-	alc_update_coef_idx(codec, 0x36, 3<<13, coef36);
+	if (val != -1)
+		alc_write_coefex_idx(codec, 0x58, 0x00, val); /* write back the result */
+	if (coef38 != -1)
+		alc_update_coef_idx(codec, 0x38, 1<<4, coef38);
+	if (coef0d != -1)
+		alc_update_coef_idx(codec, 0x0d, 0x110, coef0d);
+	if (coef36 != -1)
+		alc_update_coef_idx(codec, 0x36, 3<<13, coef36);
 
 	msleep(50);
 	alc_update_coef_idx(codec, 0x4a, 1<<15, 0);
@@ -858,7 +864,7 @@ static void alc294_hp_init(struct hda_codec *codec)
 
 	/* Wait for depop procedure finish  */
 	val = alc_read_coefex_idx(codec, 0x58, 0x01);
-	for (i = 0; i < 20 && val & 0x0080; i++) {
+	for (i = 0; i < 20 && val != -1 && val & 0x0080; i++) {
 		msleep(50);
 		val = alc_read_coefex_idx(codec, 0x58, 0x01);
 	}

From 1a23e121c92e45dac842febaac7834be6b76cb58 Mon Sep 17 00:00:00 2001
From: Oleg Proshkin <oleg.pro171@gmail.com>
Date: Thu, 11 Jun 2026 18:46:29 +0300
Subject: [PATCH 0288/1982] mfd: axp20x: Preserve other control bits when
 powering off

[ Upstream commit 3756bf05c963563f1325af105356541882dd5899 ]

axp20x_power_off() triggers shutdown by writing AXP20X_OFF (BIT(7)) to
the power-off control register with regmap_write(), which rewrites the
whole register and clears other control bits in it.

On the AXP221/AXP223 (and the register-compatible AXP228) - that
register also holds the CHGLED auto-control bit.
Clearing it during an orderly shutdown disables the hardware charge
indicator, so the charge LED stays dark while the board is powered off
and charging. Other variants keep unrelated configuration in the same
register too.

Set only the power-off bit with regmap_set_bits() and leave the rest of
the register untouched. The shutdown register is readable on every
variant, so the read-modify-write should be safe.

Tested on a ClockworkPi uConsole (Raspberry Pi Compute Module 4, AXP228,
which enumerates as AXP221): register AXP20X_OFF_CTRL reads 0x08 at
runtime, so the old code left it 0x80 whereas setting only BIT(7)
leaves 0x88. Writing 0x88 at power-off enables the charge LED
while still powering off the PMIC.

Signed-off-by: Oleg Proshkin <oleg.pro171@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260611154629.76607-1-oleg.pro171@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/axp20x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
index c5f0ebae327f51..85506813f089c3 100644
--- a/drivers/mfd/axp20x.c
+++ b/drivers/mfd/axp20x.c
@@ -1250,7 +1250,7 @@ static int axp20x_power_off(struct sys_off_data *data)
 		break;
 	}
 
-	regmap_write(axp20x->regmap, shutdown_reg, AXP20X_OFF);
+	regmap_set_bits(axp20x->regmap, shutdown_reg, AXP20X_OFF);
 
 	/* Give capacitors etc. time to drain to avoid kernel panic msg. */
 	mdelay(500);

From 50d94323e8558b018dc16380e2909344e1dc926b Mon Sep 17 00:00:00 2001
From: bui duc phuc <phucduc.bui@gmail.com>
Date: Wed, 29 Jul 2026 17:00:18 +0700
Subject: [PATCH 0289/1982] regulator: rt6245: Restore state on enable failure

[ Upstream commit e95a0a309ca02bf26dc937cdeb3fe2a235c65f63 ]

Currently, if regcache_sync() fails after the enable GPIO has been
asserted, the driver returns with enable_gpio still set high and
regcache_cache_only() left disabled. This leaves the device state
inconsistent with the disabled state, where the enable GPIO is low and
cache_only is enabled.
On failure, restore the original state by setting cache_only back to
true and driving the enable GPIO low before returning the error.

Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260729100018.66577-1-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/rt6245-regulator.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/rt6245-regulator.c b/drivers/regulator/rt6245-regulator.c
index 1843ecec19229f..5c0ee04e97ac78 100644
--- a/drivers/regulator/rt6245-regulator.c
+++ b/drivers/regulator/rt6245-regulator.c
@@ -49,8 +49,11 @@ static int rt6245_enable(struct regulator_dev *rdev)
 
 	regcache_cache_only(regmap, false);
 	ret = regcache_sync(regmap);
-	if (ret)
+	if (ret) {
+		regcache_cache_only(regmap, true);
+		gpiod_direction_output(priv->enable_gpio, 0);
 		return ret;
+	}
 
 	priv->enable_state = true;
 	return 0;

From b7e89e2fa8f18d70d966cef55082226f0aa5d9e8 Mon Sep 17 00:00:00 2001
From: Genjian Zhang <zhanggenjian@kylinos.cn>
Date: Sun, 12 Jul 2026 00:13:26 +0800
Subject: [PATCH 0290/1982] md/raid5: complete discard bios while reshape is
 active

[ Upstream commit 85764f475f3b3abd956bf8eaeaa643b367676cf4 ]

make_discard_request() returns without completing the bio when reshape
is in progress. Discard callers block in submit_bio_wait()
waiting for a completion that never arrives.  The caller hangs in
uninterruptible sleep, and this does not resolve when reshape finishes.

Complete the bio with BLK_STS_AGAIN so userspace can retry after reshape,
consistent with the existing policy of not processing discard during
reshape.

Tested on a loop-backed RAID5 array during mdadm --grow: without this
patch, blkdiscard hangs in bio_await() and remains in uninterruptible
sleep after md reports "reshape done"; with this patch it returns
-EAGAIN instead.

Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260711161326.962336-1-zhanggenjian@126.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid5.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2817cd7d197e97..b7da2b83e19384 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5707,8 +5707,7 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
 	int stripe_sectors;
 
 	if (mddev->reshape_position != MaxSector)
-		/* Skip discard while reshape is happening */
-		return;
+		goto complete_again;
 
 	stripe_sectors = conf->chunk_sectors *
 		(conf->raid_disks - conf->max_degraded);
@@ -5786,6 +5785,11 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
 	}
 
 	bio_endio(bi);
+	return;
+
+complete_again:
+	/* Skip discard while reshape is happening */
+	bio_endio_status(bi, BLK_STS_AGAIN);
 }
 
 static bool ahead_of_reshape(struct mddev *mddev, sector_t sector,

From 10a665862bfe0ecfd2bd79786e6d91c65a385ea4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=EC=83=81=ED=98=B8?= <kudo3228@gmail.com>
Date: Thu, 2 Jul 2026 07:07:29 +0900
Subject: [PATCH 0291/1982] romfs: detect hard link cycles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d30b5a954e0a4dcc16bba9c310c13709a6169a52 ]

romfs_iget() follows on-disk hard link entries until it reaches a non-hard
link inode:

	pos = be32_to_cpu(ri.spec) & ROMFH_MASK;

The target position is image-controlled, and the loop does not detect
cycles. A crafted romfs image can make the root inode a hard link. The hard
link can point back to itself and leave mount(2) spinning in the kernel.

Reject excessive hard link indirection with -ELOOP. Normal romfs images do
not need long hard link chains. This bounds corrupted-image traversal.
Propagate romfs_iget() errors from lookup because hard link traversal can
now fail with -ELOOP.

Signed-off-by: 이상호 <kudo3228@gmail.com>
Link: https://patch.msgid.link/20260701220729.822112-1-kudo3228@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/romfs/super.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/romfs/super.c b/fs/romfs/super.c
index e83f9b78d7a16e..9b997831a46bc5 100644
--- a/fs/romfs/super.c
+++ b/fs/romfs/super.c
@@ -240,6 +240,8 @@ static struct dentry *romfs_lookup(struct inode *dir, struct dentry *dentry,
 			if ((be32_to_cpu(ri.next) & ROMFH_TYPE) == ROMFH_HRD)
 				offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
 			inode = romfs_iget(dir->i_sb, offset);
+			if (IS_ERR(inode))
+				return ERR_CAST(inode);
 			break;
 		}
 
@@ -262,6 +264,8 @@ static const struct inode_operations romfs_dir_inode_operations = {
 	.lookup		= romfs_lookup,
 };
 
+#define ROMFS_MAX_HARDLINK_DEPTH 64
+
 /*
  * get a romfs inode based on its position in the image (which doubles as the
  * inode number)
@@ -273,6 +277,7 @@ static struct inode *romfs_iget(struct super_block *sb, unsigned long pos)
 	struct inode *i;
 	unsigned long nlen;
 	unsigned nextfh;
+	unsigned int depth = 0;
 	int ret;
 	umode_t mode;
 
@@ -289,6 +294,9 @@ static struct inode *romfs_iget(struct super_block *sb, unsigned long pos)
 		if ((nextfh & ROMFH_TYPE) != ROMFH_HRD)
 			break;
 
+		if (++depth > ROMFS_MAX_HARDLINK_DEPTH)
+			return ERR_PTR(-ELOOP);
+
 		pos = be32_to_cpu(ri.spec) & ROMFH_MASK;
 	}
 

From 6983cdcd9e478f182e8d0bc17b5c5ce3673930d8 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Wed, 29 Jul 2026 10:46:45 +0100
Subject: [PATCH 0292/1982] nvmem: brcm_nvram: reject empty NVRAM partition

[ Upstream commit fde46579cf8872138b296349c2bd8a3cd3f132e2 ]

If the partition is completely erased (all padding bytes), the trimming
loop reduces data_len to 0. devm_kzalloc(dev, 0, GFP_KERNEL) returns
ZERO_SIZE_PTR ((void *)16), which is non-NULL and bypasses the NULL
check. The subsequent cast of priv->data to struct brcm_nvram_header *
and dereference of header->magic causes a page fault on address 0x10.

Reject data_len smaller than the header before allocating.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-13-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/brcm_nvram.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index b4cf245fb2467d..4b3781a70222a4 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -84,6 +84,11 @@ static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device
 	}
 	WARN(priv->data_len > SZ_128K, "Unexpected (big) NVRAM size: %zu B\n", priv->data_len);
 
+	if (priv->data_len < sizeof(struct brcm_nvram_header)) {
+		dev_err(priv->dev, "NVRAM data too small (%zu)\n", priv->data_len);
+		return -EINVAL;
+	}
+
 	priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL);
 	if (!priv->data)
 		return -ENOMEM;

From b64510df5898a8c36c3940d35036527a382552cf Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Wed, 29 Jul 2026 10:46:46 +0100
Subject: [PATCH 0293/1982] nvmem: brcm_nvram: fix out-of-bounds access on
 malformed flash data

[ Upstream commit a67e2c323a47a2254ed3472b5e4c53abac20f116 ]

The length check in brcm_nvram_parse() validated header->len against
priv->nvmem_size (the full partition size) instead of priv->data_len
(the actual allocated data buffer). A malformed flash partition with
header->len between the two would pass the check, causing
brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond
the heap allocation.

Also add a minimum bound: len < sizeof(*header) could underflow the
data[len - 1] access.

Fix both bounds by rejecting len outside [sizeof(*header), priv->data_len].

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-14-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/brcm_nvram.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/nvmem/brcm_nvram.c b/drivers/nvmem/brcm_nvram.c
index 4b3781a70222a4..5ec2ceefb77f65 100644
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -192,9 +192,13 @@ static int brcm_nvram_parse(struct brcm_nvram *priv)
 	}
 
 	len = le32_to_cpu(header->len);
-	if (len > priv->nvmem_size) {
-		dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
-			priv->nvmem_size);
+	if (len < sizeof(*header)) {
+		dev_err(dev, "NVRAM length (%zd) too small\n", len);
+		return -EINVAL;
+	}
+	if (len > priv->data_len) {
+		dev_err(dev, "NVRAM length (%zd) exceeds data size (%zd)\n", len,
+			priv->data_len);
 		return -EINVAL;
 	}
 

From 9bc5063c5123ca7f075d240c434cd790135b98b3 Mon Sep 17 00:00:00 2001
From: Hari Mishal <harimishal1@gmail.com>
Date: Fri, 17 Jul 2026 17:06:22 +0200
Subject: [PATCH 0294/1982] virtio_console: take a kref in find_port_by_vq() to
 fix port UAF

[ Upstream commit 18dd0b4e489e4f0e3b748cf36ccb909c75a3efab ]

find_port_by_vq() returns a raw struct port pointer without taking a
reference on it, unlike find_port_by_devt_in_portdev() which does.
find_port_by_vq()'s only two callers, in_intr() and out_intr(), run as
virtqueue interrupt callbacks, entirely independent of and possibly
concurrently with unplug_port(), which itself runs from a workqueue when
the host sends a VIRTIO_CONSOLE_PORT_REMOVE control message.

unplug_port() removes the port from portdev->ports under ports_lock,
then later drops its last reference with kref_put(), freeing it via
remove_port(). find_port_by_vq() also walks portdev->ports under
ports_lock, so if it finds the port still on the list, the list removal,
and therefore the eventual kref_put(), has not happened yet, and taking
a reference at that point is always safe. Without doing so,
in_intr()/out_intr() can be left holding a pointer to a port that
unplug_port() frees on another core before they are done using it.

Both triggers are host-controlled as the host decides when to send the
PORT_REMOVE control message and when to kick the port's data vq. So a
malicious backend could race the two on purpose, without any guest side
cooperation. The freed object is a generic kmalloc allocation containing
a wait_queue_head_t, which in_intr()/out_intr() pass to
wake_up_interruptible() after touching the stale pointer.
wake_up_interruptible() invokes a function pointer read out of the wait
queue's entries. If the freed slab slot is reclaimed with attacker
influenced content before that call, then this is an arbitrary function
call primitive rather than just undefined behaviour.

Take a reference in find_port_by_vq() while still holding ports_lock,
matching find_port_by_devt_in_portdev(), and release it in in_intr() and
out_intr() once they are done with the port.

Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Link: https://patch.msgid.link/20260717150622.23636-1-harimishal1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/virtio_console.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 76f934b5d84bea..750c15966d00e3 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -304,6 +304,12 @@ static struct port *find_port_by_id(struct ports_device *portdev, u32 id)
 	return port;
 }
 
+/*
+ * Finds a port by the virtqueue and returns a pointer to struct port
+ * with the reference count incremented.
+ *
+ * Callers MUST decrement it when finished.
+ */
 static struct port *find_port_by_vq(struct ports_device *portdev,
 				    struct virtqueue *vq)
 {
@@ -312,8 +318,10 @@ static struct port *find_port_by_vq(struct ports_device *portdev,
 
 	spin_lock_irqsave(&portdev->ports_lock, flags);
 	list_for_each_entry(port, &portdev->ports, list)
-		if (port->in_vq == vq || port->out_vq == vq)
+		if (port->in_vq == vq || port->out_vq == vq) {
+			kref_get(&port->kref);
 			goto out;
+		}
 	port = NULL;
 out:
 	spin_unlock_irqrestore(&portdev->ports_lock, flags);
@@ -1706,6 +1714,7 @@ static void out_intr(struct virtqueue *vq)
 	}
 
 	wake_up_interruptible(&port->waitqueue);
+	kref_put(&port->kref, remove_port);
 }
 
 static void in_intr(struct virtqueue *vq)
@@ -1751,6 +1760,8 @@ static void in_intr(struct virtqueue *vq)
 
 	if (is_console_port(port) && hvc_poll(port->cons.hvc))
 		hvc_kick();
+
+	kref_put(&port->kref, remove_port);
 }
 
 static void control_intr(struct virtqueue *vq)

From 3b45fe35f1c060c8d2e66bfe6c107de54e6e77e2 Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Thu, 11 Jun 2026 23:56:56 +0200
Subject: [PATCH 0295/1982] wifi: mt76: mt7603: free beacon SKB on error

[ Upstream commit 965cbdbdfbd37a659a05ff88e49c216975bd9d2e ]

The SKB containing the generated beacon is not freed when the beacon
queue is deected stuck and scheduled for recovery.

Fixes potential memory leaks in case the beacon queue is detected stuck.

Signed-off-by: David Bauer <mail@david-bauer.net>
Link: https://patch.msgid.link/20260611215658.259324-1-mail@david-bauer.net
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7603/beacon.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c b/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
index 6457ee06bb5a15..62e8de6949d1aa 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/beacon.c
@@ -56,6 +56,7 @@ mt7603_update_beacon_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
 		FIELD_PREP(MT_DMA_FQCR0_TARGET_QID, MT_TX_HW_QUEUE_BCN));
 	if (!mt76_poll(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY, 0, 5000)) {
 		dev->beacon_check = MT7603_WATCHDOG_TIMEOUT;
+		dev_kfree_skb(skb);
 		goto out;
 	}
 
@@ -63,6 +64,7 @@ mt7603_update_beacon_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
 		FIELD_PREP(MT_DMA_FQCR0_TARGET_QID, MT_TX_HW_QUEUE_BMC));
 	if (!mt76_poll(dev, MT_DMA_FQCR0, MT_DMA_FQCR0_BUSY, 0, 5000)) {
 		dev->beacon_check = MT7603_WATCHDOG_TIMEOUT;
+		dev_kfree_skb(skb);
 		goto out;
 	}
 

From 5470927c67dcf3e573d0f942cfa41a5f129495a2 Mon Sep 17 00:00:00 2001
From: Devin Wittmayer <lucid_duck@justthetip.ca>
Date: Fri, 12 Jun 2026 17:25:44 -0700
Subject: [PATCH 0296/1982] wifi: mt76: mt76x02: report rx FCS errors to
 mac80211

[ Upstream commit ddae0bcb01e71c1184bb3f526f9622e31dc38f3b ]

When the fcsfail filter is enabled the hardware passes frames with a bad
FCS up to the driver, but mt76x02_mac_process_rx() never checks
MT_RXINFO_CRCERR and hands them to mac80211 without
RX_FLAG_FAILED_FCS_CRC. In monitor mode the radiotap flags byte then
never gets IEEE80211_RADIOTAP_F_BADFCS set and corrupted frames cannot be
told apart from clean ones.

Set RX_FLAG_FAILED_FCS_CRC from the descriptor CRC error bit, matching
mt7603, mt7615, mt7915, mt7921, mt7925 and mt7996.

Reported-by: 0072a70 <90307219+0072a70@users.noreply.github.com>
Closes: https://github.com/morrownr/mt76/issues/38
Tested-by: 0072a70 <90307219+0072a70@users.noreply.github.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260613002544.27750-3-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 06f17da2c0106d..17c97829153158 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -792,6 +792,9 @@ int mt76x02_mac_process_rx(struct mt76x02_dev *dev, struct sk_buff *skb,
 	if (rxinfo & MT_RXINFO_L2PAD)
 		pad_len += 2;
 
+	if (rxinfo & MT_RXINFO_CRCERR)
+		status->flag |= RX_FLAG_FAILED_FCS_CRC;
+
 	if (rxinfo & MT_RXINFO_DECRYPT) {
 		status->flag |= RX_FLAG_DECRYPTED;
 		status->flag |= RX_FLAG_MMIC_STRIPPED;

From 44081a569fb64ae38ba97d6208a36f13096ab8c3 Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Sat, 16 May 2026 16:49:42 +0200
Subject: [PATCH 0297/1982] wifi: mt76: mt7915: configure noise floor reporting
 on reset

[ Upstream commit a92cd5dd792a63a5d8a72142835382d4edbe9933 ]

When performing a full system recovery of the MCU on a dual-phy
platform, band 0 (usually 2.4GHz) stops reading correct noise floor
data.

This is due to noise floor reporting only being configured correctly
for the second device PHY.

Configure the respective registers correctly after restarting the MCU
firmware to fix reported noise-floor values.

Signed-off-by: David Bauer <mail@david-bauer.net>
Link: https://patch.msgid.link/20260516144944.2574053-1-mail@david-bauer.net
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index dda4e7d1795364..55d2553addb13c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -1292,6 +1292,7 @@ mt7915_mac_restart(struct mt7915_dev *dev)
 	struct mt7915_phy *phy2;
 	struct mt76_phy *ext_phy;
 	struct mt76_dev *mdev = &dev->mt76;
+	bool run_main, run_ext;
 	int i, ret;
 
 	ext_phy = dev->mt76.phys[MT_BAND1];
@@ -1387,13 +1388,17 @@ mt7915_mac_restart(struct mt7915_dev *dev)
 	mt7915_init_txpower(phy2);
 	ret = mt7915_txbf_init(dev);
 
-	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
+	run_main = test_and_clear_bit(MT76_STATE_RUNNING, &dev->mphy.state);
+	run_ext = ext_phy &&
+		  test_and_clear_bit(MT76_STATE_RUNNING, &ext_phy->state);
+
+	if (run_main) {
 		ret = mt7915_run(dev->mphy.hw);
 		if (ret)
 			goto out;
 	}
 
-	if (ext_phy && test_bit(MT76_STATE_RUNNING, &ext_phy->state)) {
+	if (run_ext) {
 		ret = mt7915_run(ext_phy->hw);
 		if (ret)
 			goto out;

From c16fe00dc2fd32662391b0186ebadddf1cda2a0e Mon Sep 17 00:00:00 2001
From: Prashant Rahul <prashantrahul23@gmail.com>
Date: Thu, 16 Jul 2026 21:55:10 +0530
Subject: [PATCH 0298/1982] wifi: mt76: mt7921: fix memory leak when
 skb_linearize fails in mcu rx event

[ Upstream commit 4361f1660101270611eb5dc39799f620b35f2e4d ]

The ownership of sk_buff skb is passed to mt7921_queue_rx_skb, each
path inside it under the switch case handles cleaning of skb and it
is true for mt7921_mcu_rx_event as well.

mt7921_mcu_rx_event, on a success path, either queues skb via
mt76_mcu_rx_event or cleans it immediately inside
mt7921_mcu_uni_rx_unsolicited_event.

However inside mt7921_mcu_rx_event, if skb_linearize fails, the function
returns immediately and never bothers cleaning skb which leaks skb.

Since skb is fully owned at this point, it is safe to call
dev_kfree_skb which fixes the leak.

Granted, the skb_linearize failure is rare as it can only fail under
heavy memory usage, but at the same time, leaking memory under heavy
memory usage can worsen the OOM condition.

Signed-off-by: Prashant Rahul <prashantrahul23@gmail.com>
Link: https://patch.msgid.link/20260716-mt7921-mem-leak-v1-1-6e9c0ea19f63@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 8c8b35cba856cd..f63ef02542387b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -354,8 +354,10 @@ void mt7921_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
 {
 	struct mt76_connac2_mcu_rxd *rxd;
 
-	if (skb_linearize(skb))
+	if (skb_linearize(skb)) {
+		dev_kfree_skb(skb);
 		return;
+	}
 
 	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
 

From f39060120cf8171173e2d39b029adf89d5424355 Mon Sep 17 00:00:00 2001
From: Ahmed Naseef <naseefkm@gmail.com>
Date: Sun, 19 Jul 2026 12:25:30 +0400
Subject: [PATCH 0299/1982] wifi: mt76: mt7603: add 0x7592 EEPROM chip ID

[ Upstream commit d16447d7470502e998d82e806ca7ed49d1baa853 ]

Some EcoNet based routers ship an on-flash EEPROM whose chip-id is
0x7592 instead of the expected 0x7603. The device probes as PCI
14c3:7603 and the hardware MT_HW_CHIPID register reports 0x7603,
independent of the EEPROM value.

This is seen across multiple EcoNet EN751221 and EN7528 based devices
(for example the Genexis Platinum 4410).

Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://patch.msgid.link/20260719082530.3879831-1-naseefkm@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
index 88382b537a33b1..06f61988655e53 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
@@ -142,6 +142,7 @@ static int mt7603_check_eeprom(struct mt76_dev *dev)
 	case 0x7628:
 	case 0x7603:
 	case 0x7600:
+	case 0x7592:
 		return 0;
 	default:
 		return -EINVAL;

From 7b592201c2657e6d2ba9e043419444c10dd9a493 Mon Sep 17 00:00:00 2001
From: Zhi-Jun You <hujy652@gmail.com>
Date: Wed, 15 Jul 2026 23:21:12 +0800
Subject: [PATCH 0300/1982] wifi: mt76: wed: fix kernel panic on non-DBDC
 MT7986

[ Upstream commit 8a177dabeeead47dda4d4f91331282790eed0097 ]

In mt76_wed_init_rx_buf, it's hardcoded to use MT_RXQ_MAIN.
But for non-DBDC MT7986 MT_RXQ_BAND1 is used for RX data queue which
leads to kernel panic when attaching WED.

Use the correct RX queue by checking WED version and band_idx.

v2 and band 1 -> MT_RXQ_BAND1
Others -> MT_RXQ_MAIN

Kernel panic:

Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
Internal error: Oops: 0000000096000005 [#1]  SMP
CPU: 1 UID: 0 PID: 925 Comm: kmodloader Tainted: G           O        6.18.26 #0 NONE
Tainted: [O]=OOT_MODULE
Hardware name: Acer Connect Vero W6m (DT)
pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : page_pool_alloc_frag_netmem+0x1c/0x1bc
lr : page_pool_alloc_frag+0xc/0x34
sp : ffffffc081dab660
x29: ffffffc081dab660 x28: ffffffc081dabc60 x27: ffffff80091af040
x26: 0000008000000000 x25: ffffff80091a8898 x24: ffffff80091a5440
x23: 0000000000001000 x22: 0000000140000000 x21: ffffff80091a2040
x20: ffffff8003f1d780 x19: 0000000000000000 x18: 0000000000000020
x17: ffffffbfbf0ac000 x16: ffffffc080ee0000 x15: ffffff80049d47ca
x14: 000000000000037b x13: 000000000000037b x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffffff8003f1d7c0 x7 : 0000000000000000 x6 : ffffff8003f1d780
x5 : 0000000000000680 x4 : 0000000000000000 x3 : 0000000000002824
x2 : 0000000000000000 x1 : ffffffc081dab71c x0 : 0000000000000000
Call trace:
 page_pool_alloc_frag_netmem+0x1c/0x1bc (P)
 page_pool_alloc_frag+0xc/0x34
 mt76_wed_init_rx_buf+0xf8/0x2ac [mt76]
 mtk_wed_start+0x79c/0x12ac
 mt7915_dma_start+0x274/0x63c [mt7915e]
 mt7915_dma_start+0x5b4/0x63c [mt7915e]
 mt7915_dma_init+0x49c/0x81c [mt7915e]
 mt7915_register_device+0x24c/0x530 [mt7915e]
 mt7915_mmio_probe+0x91c/0x1980 [mt7915e]
 platform_probe+0x58/0xa0
 really_probe+0xb8/0x2a8
 __driver_probe_device+0x74/0x118
 driver_probe_device+0x3c/0xe0
 __driver_attach+0x88/0x154
 bus_for_each_dev+0x60/0xb0
 driver_attach+0x20/0x28
 bus_add_driver+0xdc/0x200
 driver_register+0x64/0x118
 __platform_driver_register+0x20/0x30
 init_module+0x74/0x1000 [mt7915e]
 do_one_initcall+0x4c/0x1f8
 do_init_module+0x50/0x210
 load_module+0x15f8/0x1b10
 __do_sys_init_module+0x1a8/0x260
 __arm64_sys_init_module+0x18/0x20
 invoke_syscall.constprop.0+0x4c/0xd0
 do_el0_svc+0x3c/0xd0
 el0_svc+0x18/0x60
 el0t_64_sync_handler+0x98/0xdc
 el0t_64_sync+0x158/0x15c
Code: aa0003f3 a9025bf5 a90363f7 d2820017 (b9400000)

Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
Link: https://patch.msgid.link/20260715152113.553-1-hujy652@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/wed.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/wed.c b/drivers/net/wireless/mediatek/mt76/wed.c
index fbd7e59c73aaf2..2ebf4edc689e9e 100644
--- a/drivers/net/wireless/mediatek/mt76/wed.c
+++ b/drivers/net/wireless/mediatek/mt76/wed.c
@@ -33,10 +33,15 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
 {
 	struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
 	struct mt76_dev *dev = mt76_wed_to_dev(wed);
-	struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
 	struct mt76_txwi_cache *t = NULL;
+	struct mt76_queue *q;
 	int i;
 
+	if (wed->version == 2 && dev->phy.band_idx)
+		q = &dev->q_rx[MT_RXQ_BAND1];
+	else
+		q = &dev->q_rx[MT_RXQ_MAIN];
+
 	for (i = 0; i < size; i++) {
 		dma_addr_t addr;
 		u32 offset;

From 0c6d33329960b2d884a399196c8403643d8a9de6 Mon Sep 17 00:00:00 2001
From: Minghao Zhang <zhangmh25@mails.tsinghua.edu.cn>
Date: Wed, 29 Jul 2026 15:46:52 +0000
Subject: [PATCH 0301/1982] netfilter: conntrack: tcp: use UNACK timeout for
 non-closing RST packets

[ Upstream commit bf80e6802273a900311b44e47c9b1a59c6d2473c ]

Commit be0502a3f2e9 ("netfilter: conntrack: tcp: only close if RST
matches exact sequence") keeps an established conntrack entry in
ESTABLISHED when an in-window RST does not match the expected sequence
number exactly, so the endpoint can validate the RST with a challenge
ACK.

The timeout selection nevertheless uses the CLOSE timeout for every RST
packet.  The bug is that timeout selection is based on the packet type,
not on the state transition result: even when RST validation keeps
new_state in ESTABLISHED, the timeout is still forced to
TCP_CONNTRACK_CLOSE.

Linux TCP independently rate limits challenge ACKs per socket.  A second
non-exact RST can therefore arrive after the first challenge ACK has
restored the timeout but before the rate limit expires.  The second RST
lowers the timeout to 10 seconds again while the endpoint suppresses the
second challenge ACK, allowing the conntrack entry to expire while both
TCP endpoints remain established.

Using the ESTABLISHED timeout for such RSTs would avoid this short
expiration window, but it could also retain stale entries for the
five-day default because conntrack cannot reliably match the endpoint's
exact TCP state.

Use the UNACK timeout for RST packets that leave the conntrack entry in
TCP_CONNTRACK_ESTABLISHED.  Exact-match RSTs and accepted RST packet
trains still fall through to timeouts[new_state], which preserves the
CLOSE timeout when conntrack accepts the RST as closing the flow.

This avoids the aggressive 10-second expiration window for non-exact
RSTs while preserving the short timeout for RSTs that conntrack accepts
as closing the flow.

Suggested-by: Florian Westphal <fw@strlen.de>
Reported-by: Minghao Zhang <zhangmh25@mails.tsinghua.edu.cn>
Reported-by: Jianjun Chen <jianjun@tsinghua.edu.cn>
Signed-off-by: Minghao Zhang <zhangmh25@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_proto_tcp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 91da35e2b0d8d1..456721e40ed0c0 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1325,8 +1325,9 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
 	if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
 	    timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
 		timeout = timeouts[TCP_CONNTRACK_RETRANS];
-	else if (unlikely(index == TCP_RST_SET))
-		timeout = timeouts[TCP_CONNTRACK_CLOSE];
+	else if (unlikely(index == TCP_RST_SET &&
+			  new_state == TCP_CONNTRACK_ESTABLISHED))
+		timeout = timeouts[TCP_CONNTRACK_UNACK];
 	else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
 		 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])

From 4da920688df0069618f608bafabd4abe3b0a4bd2 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 28 Jul 2026 10:40:06 +0200
Subject: [PATCH 0302/1982] netfilter: nf_tables: call skb_valid_dst() before
 skb_dst()

[ Upstream commit 689db98e535bf8efb5bc9c36f4fd3de3bd715eb6 ]

When fetching the dst_entry from the skb, check if it valid, ie. this is
not a template dst, for extensions that can be used from the netdev
ingress and egress chains.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/netfilter/nf_reject_ipv4.c | 6 ++++--
 net/ipv6/netfilter/nf_reject_ipv6.c | 8 ++++++--
 net/netfilter/nft_meta.c            | 6 ++++--
 net/netfilter/nft_rt.c              | 6 ++++--
 net/netfilter/nft_xfrm.c            | 9 ++++++++-
 5 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 4626dc46808f3a..59ec465a9df982 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -8,6 +8,7 @@
 #include <net/tcp.h>
 #include <net/route.h>
 #include <net/dst.h>
+#include <net/dst_metadata.h>
 #include <net/netfilter/ipv4/nf_reject.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_bridge.h>
@@ -263,6 +264,7 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)
 	if (!dst)
 		return -1;
 
+	skb_dst_drop(skb_in);
 	skb_dst_set(skb_in, dst);
 	return 0;
 }
@@ -279,7 +281,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	if (!oth)
 		return;
 
-	if (!skb_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)
+	if (!skb_valid_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)
 		return;
 
 	if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -352,7 +354,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
 	if (iph->frag_off & htons(IP_OFFSET))
 		return;
 
-	if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
+	if (!skb_valid_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
 		return;
 
 	if (skb_csum_unnecessary(skb_in) ||
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index ef5b7e85cffa8a..07cdaa10da0d05 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -8,6 +8,7 @@
 #include <net/ip6_route.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_checksum.h>
+#include <net/dst_metadata.h>
 #include <net/netfilter/ipv6/nf_reject.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_bridge.h>
@@ -304,6 +305,7 @@ static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in)
 	if (!dst)
 		return -1;
 
+	skb_dst_drop(skb_in);
 	skb_dst_set(skb_in, dst);
 	return 0;
 }
@@ -336,10 +338,12 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	fl6.fl6_sport = otcph->dest;
 	fl6.fl6_dport = otcph->source;
 
-	if (!skb_dst(oldskb)) {
+	if (!skb_valid_dst(oldskb)) {
 		nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
 		if (!dst)
 			return;
+
+		skb_dst_drop(oldskb);
 		skb_dst_set(oldskb, dst);
 	}
 
@@ -440,7 +444,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
 	if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
 		skb_in->dev = net->loopback_dev;
 
-	if (!skb_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
+	if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
 		return;
 
 	icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 19e6d1c2436af7..f3c7b7edb10c08 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -20,6 +20,7 @@
 #include <net/dst.h>
 #include <net/ip.h>
 #include <net/sock.h>
+#include <net/dst_metadata.h>
 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables_core.h>
@@ -274,11 +275,12 @@ static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,
 static noinline bool
 nft_meta_get_eval_rtclassid(const struct sk_buff *skb, u32 *dest)
 {
-	const struct dst_entry *dst = skb_dst(skb);
+	const struct dst_entry *dst;
 
-	if (!dst)
+	if (!skb_valid_dst(skb))
 		return false;
 
+	dst = skb_dst(skb);
 	*dest = dst->tclassid;
 	return true;
 }
diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
index ad527f3596c03a..cb7dff336bbdc8 100644
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -8,6 +8,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/dst.h>
+#include <net/dst_metadata.h>
 #include <net/ip6_route.h>
 #include <net/route.h>
 #include <net/netfilter/nf_tables.h>
@@ -59,10 +60,11 @@ void nft_rt_get_eval(const struct nft_expr *expr,
 	u32 *dest = &regs->data[priv->dreg];
 	const struct dst_entry *dst;
 
-	dst = skb_dst(skb);
-	if (!dst)
+	if (!skb_valid_dst(skb))
 		goto err;
 
+	dst = skb_dst(skb);
+
 	switch (priv->key) {
 #ifdef CONFIG_IP_ROUTE_CLASSID
 	case NFT_RT_CLASSID:
diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
index 7ffe6a2690d13d..9c9ac27122ad97 100644
--- a/net/netfilter/nft_xfrm.c
+++ b/net/netfilter/nft_xfrm.c
@@ -12,6 +12,7 @@
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables_core.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/dst_metadata.h>
 #include <linux/in.h>
 #include <net/xfrm.h>
 
@@ -177,9 +178,15 @@ static void nft_xfrm_get_eval_out(const struct nft_xfrm *priv,
 				  struct nft_regs *regs,
 				  const struct nft_pktinfo *pkt)
 {
-	const struct dst_entry *dst = skb_dst(pkt->skb);
+	const struct dst_entry *dst;
 	int i;
 
+	if (!skb_valid_dst(pkt->skb)) {
+		regs->verdict.code = NFT_BREAK;
+		return;
+	}
+
+	dst = skb_dst(pkt->skb);
 	for (i = 0; dst && dst->xfrm;
 	     dst = ((const struct xfrm_dst *)dst)->child, i++) {
 		if (i < priv->spnum)

From 25fbd699677554849541ceab007b9b3ee722c321 Mon Sep 17 00:00:00 2001
From: Geetha sowjanya <gakula@marvell.com>
Date: Mon, 1 Jun 2026 13:03:18 +0530
Subject: [PATCH 0303/1982] perf: marvell: Cancel CN10K DDR PMU hrtimer on
 device remove

[ Upstream commit 7dbcb0268d1e2a1d3badb0c6e77ee70e550b1787 ]

cn10k_ddr_perf_remove() did not cancel the poll hrtimer before returning.
If the device was unbound while perf events were still active the timer
callback could run post-free.

To fix the issue by adding hrtimer_cancel() in remove().

Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/marvell_cn10k_ddr_pmu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/perf/marvell_cn10k_ddr_pmu.c b/drivers/perf/marvell_cn10k_ddr_pmu.c
index 72ac17efd846a6..9974b62541f0da 100644
--- a/drivers/perf/marvell_cn10k_ddr_pmu.c
+++ b/drivers/perf/marvell_cn10k_ddr_pmu.c
@@ -1088,6 +1088,12 @@ static void cn10k_ddr_perf_remove(struct platform_device *pdev)
 {
 	struct cn10k_ddr_pmu *ddr_pmu = platform_get_drvdata(pdev);
 
+	/*
+	 * Cancel the poll timer before further teardown so the handler
+	 * cannot run after this function returns.
+	 */
+	hrtimer_cancel(&ddr_pmu->hrtimer);
+
 	cpuhp_state_remove_instance_nocalls(
 				CPUHP_AP_PERF_ARM_MARVELL_CN10K_DDR_ONLINE,
 				&ddr_pmu->node);

From 2ab864e23245323f0519e23d9c9f974572532a9b Mon Sep 17 00:00:00 2001
From: ZhaoJinming <zhaojinming@uniontech.com>
Date: Wed, 29 Jul 2026 10:00:05 +0800
Subject: [PATCH 0304/1982] wifi: ath11k: fix resource leak on error in ext IRQ
 setup

[ Upstream commit 8ab38bbac02298e3fb03008ed4a0227485c0fd62 ]

In ath11k_ahb_config_irq(), when a CE request_irq() fails, the function
returns the error immediately without freeing the CE IRQs that were
successfully registered in previous loop iterations. The probe error
path does not call ath11k_ahb_free_irq() either, so the previously
registered CE IRQ handlers remain attached to the interrupt lines and
are never released.

In ath11k_ahb_config_ext_irq(), when an external request_irq() fails,
the error is only logged and the loop continues. The function then
returns 0 indicating success, leaving the device in a partially
configured state where some external IRQs are not registered. This
causes enable_irq()/disable_irq()/free_irq() to be called on
unregistered IRQs during runtime and remove/shutdown, triggering
WARN_ON(!desc->action), and missing interrupt handlers lead to data
loss.

Additionally, if alloc_netdev_dummy() fails for a later IRQ group, the
function returns -ENOMEM without freeing the ext IRQs and napi_ndev
that were successfully set up for earlier groups.

Fix all three issues: propagate the error up to the caller and unwind
all successfully registered IRQs and allocated resources on failure.
Also move ab->irq_num[irq_idx] assignment after request_irq() succeeds
in the ext IRQ path to match the CE IRQ path and avoid storing a stale
IRQ number on failure.

Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260729020005.219253-1-zhaojinming@uniontech.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/ahb.c | 79 +++++++++++++++++++--------
 1 file changed, 55 insertions(+), 24 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
index b8437e23e51921..5d8c0457721cdf 100644
--- a/drivers/net/wireless/ath/ath11k/ahb.c
+++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -431,36 +431,44 @@ static void ath11k_ahb_init_qmi_ce_config(struct ath11k_base *ab)
 	ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
 }
 
-static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)
+static void ath11k_ahb_free_ext_irq_grp(struct ath11k_base *ab,
+					struct ath11k_ext_irq_grp *irq_grp)
 {
-	int i, j;
-
-	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
-		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
+	int j;
 
-		for (j = 0; j < irq_grp->num_irq; j++)
-			free_irq(ab->irq_num[irq_grp->irqs[j]], irq_grp);
+	for (j = 0; j < irq_grp->num_irq; j++)
+		free_irq(ab->irq_num[irq_grp->irqs[j]], irq_grp);
 
-		netif_napi_del(&irq_grp->napi);
-		free_netdev(irq_grp->napi_ndev);
-	}
+	netif_napi_del(&irq_grp->napi);
+	free_netdev(irq_grp->napi_ndev);
 }
 
-static void ath11k_ahb_free_irq(struct ath11k_base *ab)
+static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab)
 {
-	int irq_idx;
 	int i;
 
-	if (ab->hw_params.hybrid_bus_type)
-		return ath11k_pcic_free_irq(ab);
+	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++)
+		ath11k_ahb_free_ext_irq_grp(ab, &ab->ext_irq_grp[i]);
+}
 
-	for (i = 0; i < ab->hw_params.ce_count; i++) {
+static void ath11k_ahb_free_ce_irqs(struct ath11k_base *ab, int max_idx)
+{
+	int irq_idx, i;
+
+	for (i = 0; i < max_idx; i++) {
 		if (ath11k_ce_get_attr_flags(ab, i) & CE_ATTR_DIS_INTR)
 			continue;
 		irq_idx = ATH11K_IRQ_CE0_OFFSET + i;
 		free_irq(ab->irq_num[irq_idx], &ab->ce.ce_pipe[i]);
 	}
+}
+
+static void ath11k_ahb_free_irq(struct ath11k_base *ab)
+{
+	if (ab->hw_params.hybrid_bus_type)
+		return ath11k_pcic_free_irq(ab);
 
+	ath11k_ahb_free_ce_irqs(ab, ab->hw_params.ce_count);
 	ath11k_ahb_free_ext_irq(ab);
 }
 
@@ -524,20 +532,25 @@ static irqreturn_t ath11k_ahb_ext_interrupt_handler(int irq, void *arg)
 static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)
 {
 	struct ath11k_hw_params *hw = &ab->hw_params;
+	struct ath11k_ext_irq_grp *irq_grp;
 	int i, j;
 	int irq;
 	int ret;
 
 	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
-		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
 		u32 num_irq = 0;
 
+		irq_grp = &ab->ext_irq_grp[i];
+
 		irq_grp->ab = ab;
 		irq_grp->grp_id = i;
 
 		irq_grp->napi_ndev = alloc_netdev_dummy(0);
-		if (!irq_grp->napi_ndev)
-			return -ENOMEM;
+		if (!irq_grp->napi_ndev) {
+			ret = -ENOMEM;
+			irq_grp->num_irq = 0;
+			goto err_request_irq;
+		}
 
 		netif_napi_add(irq_grp->napi_ndev, &irq_grp->napi,
 			       ath11k_ahb_ext_grp_napi_poll);
@@ -585,14 +598,11 @@ static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)
 				}
 			}
 		}
-		irq_grp->num_irq = num_irq;
-
-		for (j = 0; j < irq_grp->num_irq; j++) {
+		for (j = 0; j < num_irq; j++) {
 			int irq_idx = irq_grp->irqs[j];
 
 			irq = platform_get_irq_byname(ab->pdev,
 						      irq_name[irq_idx]);
-			ab->irq_num[irq_idx] = irq;
 			irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY);
 			ret = request_irq(irq, ath11k_ahb_ext_interrupt_handler,
 					  IRQF_TRIGGER_RISING,
@@ -600,11 +610,24 @@ static int ath11k_ahb_config_ext_irq(struct ath11k_base *ab)
 			if (ret) {
 				ath11k_err(ab, "failed request_irq for %d\n",
 					   irq);
+				irq_grp->num_irq = j;
+				ath11k_ahb_free_ext_irq_grp(ab, irq_grp);
+				goto err_request_irq;
 			}
+			ab->irq_num[irq_idx] = irq;
 		}
+
+		irq_grp->num_irq = num_irq;
 	}
 
 	return 0;
+
+err_request_irq:
+	for (i--; i >= 0; i--) {
+		irq_grp = &ab->ext_irq_grp[i];
+		ath11k_ahb_free_ext_irq_grp(ab, irq_grp);
+	}
+	return ret;
 }
 
 static int ath11k_ahb_config_irq(struct ath11k_base *ab)
@@ -629,16 +652,24 @@ static int ath11k_ahb_config_irq(struct ath11k_base *ab)
 		ret = request_irq(irq, ath11k_ahb_ce_interrupt_handler,
 				  IRQF_TRIGGER_RISING, irq_name[irq_idx],
 				  ce_pipe);
-		if (ret)
+		if (ret) {
+			ath11k_err(ab, "failed request_irq for %d\n", irq);
+			ath11k_ahb_free_ce_irqs(ab, i);
 			return ret;
+		}
 
 		ab->irq_num[irq_idx] = irq;
 	}
 
 	/* Configure external interrupts */
 	ret = ath11k_ahb_config_ext_irq(ab);
+	if (ret) {
+		ath11k_err(ab, "failed to configure ext irq: %d\n", ret);
+		ath11k_ahb_free_ce_irqs(ab, ab->hw_params.ce_count);
+		return ret;
+	}
 
-	return ret;
+	return 0;
 }
 
 static int ath11k_ahb_map_service_to_pipe(struct ath11k_base *ab, u16 service_id,

From b9ba943727cc65c842f02e55ffbeddefd642ed53 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Thu, 30 Jul 2026 15:28:57 +0300
Subject: [PATCH 0305/1982] ASoC: SOF: Intel: mtl: Power down DSP if it is left
 enabled in pre_fw_run()

[ Upstream commit 31fd7a0bbfa4b7e8aff11f278e817664c6a5f68b ]

It is expected that the DSP is in power down state when the firmware boot
is attempted.
If the DSP for any reason was left powered up then the DSP boot will
fail since the ROM boot sequence might not be able to run.

Make sure that the DSP is off before proceeding to boot it up.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20260730122857.5294-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/intel/mtl.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c
index 2242c96bfa5197..f119e0e0651a2b 100644
--- a/sound/soc/sof/intel/mtl.c
+++ b/sound/soc/sof/intel/mtl.c
@@ -236,6 +236,17 @@ int mtl_enable_interrupts(struct snd_sof_dev *sdev, bool enable)
 }
 EXPORT_SYMBOL_NS(mtl_enable_interrupts, "SND_SOC_SOF_INTEL_MTL");
 
+static bool mtl_dsp_is_enabled(struct snd_sof_dev *sdev)
+{
+	int val;
+
+	val = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFDSSCS);
+	if (val & MTL_HFDSSCS_CPA_MASK)
+		return true;
+
+	return false;
+}
+
 /* pre fw run operations */
 static int mtl_dsp_pre_fw_run(struct snd_sof_dev *sdev)
 {
@@ -249,6 +260,18 @@ static int mtl_dsp_pre_fw_run(struct snd_sof_dev *sdev)
 	u32 dsppwrsts;
 	const struct sof_intel_dsp_desc *chip;
 
+	/* Power down the DSP if it is left enabled to ensure clean boot state */
+	if (mtl_dsp_is_enabled(sdev)) {
+		dev_dbg(sdev->dev, "powering down DSP first\n");
+
+		ret = mtl_power_down_dsp(sdev);
+		if (ret < 0) {
+			dev_warn(sdev->dev,
+				 "%s: failed to power down already-enabled DSP\n", __func__);
+			/* Continue anyway to attempt recovery */
+		}
+	}
+
 	chip = get_chip_info(sdev->pdata);
 	if (chip->hw_ip_version > SOF_INTEL_ACE_2_0) {
 		dsppwrctl = PTL_HFPWRCTL2;

From 562b8dae64597a119fcdab5bdc1520650fdaef82 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Fri, 24 Jul 2026 12:48:07 +0000
Subject: [PATCH 0306/1982] wifi: mt76: mt7615: fix NULL deref in
 mt7615_mac_set_rates

[ Upstream commit 98aff74779da9f417386c589c36848e9c568f0f9 ]

mt7615_tx() falls back to the vif BSS wcid when mac80211 hands a frame
over without a station, e.g. while a station is being torn down, and to
the global wcid when there is no vif either. Both tx_prepare_skb
implementations derive a mt7615_sta from that wcid unconditionally and,
if the rate control probe flag is set, pass it to mt7615_mac_set_rates(),
which dereferences the NULL vif backpointer of the per-vif embedded sta:

  Unable to handle kernel read from unreadable memory at virtual
  address 0000000000000002
  ...
  pc : mt7615_mac_set_rates
  lr : mt7615_tx_prepare_skb

Neither entry is rate controlled by mac80211: the embedded sta has an
empty rate set, and for the global wcid the container_of does not yield a
valid mt7615_sta at all. Only resolve the sta for wcids that belong to a
station.

Reported-by: Chad Monroe <chad@monroe.io>
Link: https://patch.msgid.link/20260724124813.3961474-23-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c  | 5 +++--
 drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
index b795d11d943d06..61efdf59133f50 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
@@ -68,10 +68,11 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
 	int pid, id;
 	u8 *txwi = (u8 *)txwi_ptr;
 	struct mt76_txwi_cache *t;
-	struct mt7615_sta *msta;
+	struct mt7615_sta *msta = NULL;
 	void *txp;
 
-	msta = wcid ? container_of(wcid, struct mt7615_sta, wcid) : NULL;
+	if (wcid && wcid->sta)
+		msta = container_of(wcid, struct mt7615_sta, wcid);
 	if (!wcid)
 		wcid = &dev->mt76.global_wcid;
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
index 820b395900275a..01e79f37649c19 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c
@@ -187,10 +187,11 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
 	struct sk_buff *skb = tx_info->skb;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_key_conf *key = info->control.hw_key;
-	struct mt7615_sta *msta;
+	struct mt7615_sta *msta = NULL;
 	int pad, err, pktid;
 
-	msta = wcid ? container_of(wcid, struct mt7615_sta, wcid) : NULL;
+	if (wcid && wcid->sta)
+		msta = container_of(wcid, struct mt7615_sta, wcid);
 	if (!wcid)
 		wcid = &dev->mt76.global_wcid;
 

From fe0126804871cbabf5aca900e3bad90e5c1c484e Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 1 Aug 2026 14:53:28 +0000
Subject: [PATCH 0307/1982] wifi: mt76: set the EOSP bit in the QoS header of
 the last released frame

[ Upstream commit 0b8d2524716099ea4743fa65bc364f94b3106a31 ]

When the driver implements .release_buffered_frames, mac80211 leaves the
U-APSD signalling entirely to the driver: "In this case it is also
responsible for setting the EOSP flag in the QoS header of the frames"
(include/net/mac80211.h). Only IEEE80211_TX_STATUS_EOSP was being set,
which merely ends the service period inside mac80211, so on air the
service period was never terminated. Clients that wait for EOSP before
going back to doze keep the SP open and stop triggering, which stalls all
downlink traffic for that station.

Set the wire EOSP bit on the last frame of a U-APSD service period.
EOSP has no meaning for a PS-Poll response, so pass the release reason
down and leave those frames alone.

Link: https://patch.msgid.link/20260801145334.1166751-4-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/tx.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 731caeda72b528..93275bb692fa50 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -415,16 +415,23 @@ mt76_txq_dequeue(struct mt76_phy *phy, struct mt76_txq *mtxq)
 
 static void
 mt76_queue_ps_skb(struct mt76_phy *phy, struct ieee80211_sta *sta,
-		  struct sk_buff *skb, bool last)
+		  struct sk_buff *skb, bool last,
+		  enum ieee80211_frame_release_type reason)
 {
 	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
 	info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
-	if (last)
+	if (last) {
 		info->flags |= IEEE80211_TX_STATUS_EOSP |
 			       IEEE80211_TX_CTL_REQ_TX_STATUS;
 
+		if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
+		    ieee80211_is_data_qos(hdr->frame_control))
+			*ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_EOSP;
+	}
+
 	mt76_skb_set_moredata(skb, !last);
 	__mt76_tx_queue_skb(phy, MT_TXQ_PSD, skb, wcid, sta, NULL);
 }
@@ -457,14 +464,15 @@ mt76_release_buffered_frames(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
 
 			nframes--;
 			if (last_skb)
-				mt76_queue_ps_skb(phy, sta, last_skb, false);
+				mt76_queue_ps_skb(phy, sta, last_skb, false,
+						  reason);
 
 			last_skb = skb;
 		} while (nframes);
 	}
 
 	if (last_skb) {
-		mt76_queue_ps_skb(phy, sta, last_skb, true);
+		mt76_queue_ps_skb(phy, sta, last_skb, true, reason);
 		dev->queue_ops->kick(dev, hwq);
 	} else {
 		ieee80211_sta_eosp(sta);

From f1a8ab40a5a2ee4231f7e82518a8914dc9308b3e Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 1 Aug 2026 14:53:29 +0000
Subject: [PATCH 0308/1982] wifi: mt76: mt7603: fix U-APSD service period
 termination

[ Upstream commit 697badc27a9b3b2a8d86092abeed767714f735a2 ]

Frames released from the driver PS queue were all tagged with MORE_DATA
and none of them ever carried the EOSP bit, so from the client's point of
view a U-APSD service period was started but never finished. Clients that
keep their receiver on until EOSP arrives stop sending trigger frames,
and all downlink traffic for that station stalls until they give up.
ieee80211_sta_eosp() only cleared the service period state inside
mac80211, which is why the mismatch went unnoticed.

Assign MORE_DATA per frame and set the wire EOSP bit on the last one. If
the last released frame is a bufferable MMPDU it has no QoS control field
to carry EOSP, so let mac80211 append a QoS-Null frame instead.

Also stop handing the remaining frame budget to
mt76_release_buffered_frames() once frames have been released from the PS
queue: both would signal the end of the same service period. Releasing
fewer frames than requested is allowed, and MORE_DATA tells the client to
trigger again.

Link: https://patch.msgid.link/20260801145334.1166751-5-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/mediatek/mt76/mt7603/main.c  | 74 ++++++++++++++++---
 1 file changed, 63 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
index 0d7c84941cd0a7..f8a43d9f72f954 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
@@ -423,13 +423,33 @@ mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
 	mt7603_ps_tx_list(dev, &list);
 }
 
+static struct ieee80211_hdr *
+mt7603_ps_skb_hdr(struct sk_buff *skb)
+{
+	return (struct ieee80211_hdr *)&skb->data[MT_TXD_SIZE];
+}
+
+/*
+ * Buffered frames can be recycled into the PS queue by mt7603_filter_tx(), so
+ * both bits have to be assigned, not just set.
+ */
 static void
-mt7603_ps_set_more_data(struct sk_buff *skb)
+mt7603_ps_set_flags(struct sk_buff *skb, bool more_data, bool eosp)
 {
-	struct ieee80211_hdr *hdr;
+	struct ieee80211_hdr *hdr = mt7603_ps_skb_hdr(skb);
+
+	if (more_data)
+		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+	else
+		hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+
+	if (!ieee80211_is_data_qos(hdr->frame_control))
+		return;
 
-	hdr = (struct ieee80211_hdr *)&skb->data[MT_TXD_SIZE];
-	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+	if (eosp)
+		*ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_EOSP;
+	else
+		*ieee80211_get_qos_ctl(hdr) &= ~IEEE80211_QOS_CTL_EOSP;
 }
 
 static void
@@ -442,7 +462,10 @@ mt7603_release_buffered_frames(struct ieee80211_hw *hw,
 	struct mt7603_dev *dev = hw->priv;
 	struct mt7603_sta *msta = (struct mt7603_sta *)sta->drv_priv;
 	struct sk_buff_head list;
-	struct sk_buff *skb, *tmp;
+	struct sk_buff *skb, *tmp, *last;
+	bool eosp_null, uapsd;
+	u16 pending = 0;
+	u8 last_tid;
 
 	__skb_queue_head_init(&list);
 
@@ -458,20 +481,49 @@ mt7603_release_buffered_frames(struct ieee80211_hw *hw,
 
 		skb_set_queue_mapping(skb, MT_TXQ_PSD);
 		__skb_unlink(skb, &msta->psq);
-		mt7603_ps_set_more_data(skb);
 		__skb_queue_tail(&list, skb);
 		nframes--;
 	}
+
+	skb_queue_walk(&msta->psq, skb)
+		pending |= BIT(skb->priority);
 	spin_unlock_bh(&dev->ps_lock);
 
-	if (!skb_queue_empty(&list))
-		ieee80211_sta_eosp(sta);
+	last = skb_peek_tail(&list);
+	if (!last) {
+		mt76_release_buffered_frames(hw, sta, tids, nframes, reason,
+					     more_data);
+		return;
+	}
+
+	/*
+	 * End the service period here instead of passing the remaining frame
+	 * budget on to mt76_release_buffered_frames(), which would signal the
+	 * end of the same service period a second time.
+	 */
+	uapsd = reason == IEEE80211_FRAME_RELEASE_UAPSD;
+	more_data |= !!(pending & tids);
+
+	skb_queue_walk(&list, skb)
+		mt7603_ps_set_flags(skb, skb != last || more_data,
+				    skb == last && uapsd);
+
+	/*
+	 * EOSP lives in the QoS control field, so a bufferable MMPDU cannot
+	 * terminate a U-APSD service period on its own. In that case mac80211
+	 * has to append a QoS-Null frame, which ends the SP through its tx
+	 * status.
+	 */
+	eosp_null = uapsd &&
+		    !ieee80211_is_data_qos(mt7603_ps_skb_hdr(last)->frame_control);
+	last_tid = __fls(tids);
 
 	mt7603_ps_tx_list(dev, &list);
 
-	if (nframes)
-		mt76_release_buffered_frames(hw, sta, tids, nframes, reason,
-					     more_data);
+	if (eosp_null)
+		ieee80211_send_eosp_nullfunc(sta, last_tid);
+	else
+		ieee80211_sta_eosp(sta);
 }
 
 static int

From 853afa74a0a8db6b5ff17a33b6c7df6d8d617e20 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 1 Aug 2026 14:53:31 +0000
Subject: [PATCH 0309/1982] wifi: mt76: mt7603: restore hardware PS buffering
 after a service period

[ Upstream commit 636a883e2feef5e4ff95695d3c372ceff03960f5 ]

Releasing buffered frames has to turn off the PSE redirect for the
station, otherwise the released frames are looped straight back into the
driver PS queue. Nothing ever turns it back on: mt7603_sta_ps() only runs
on an observed PM bit transition, and MT_WCID_FLAG_PS keeps mt76 from
reporting the same state twice. After the first service period the
hardware therefore treats a dozing station as awake and transmits at it
directly, which is where the retry storms and the packet loss reported
against U-APSD clients come from.

Re-arm hardware buffering from mt7603_mac_work() for every station that
is still known to be asleep, once the PSD queue has drained and the
released frames have passed the redirect stage. Frames that are still
queued belong to the service period that was just served, so unlike on a
sleep transition they must not be pulled back with mt7603_filter_tx().

Track the sleep state separately from the WTBL state, so a station that
wakes up while the re-arm is pending is not put back to sleep.

Link: https://patch.msgid.link/20260801145334.1166751-7-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/mediatek/mt76/mt7603/mac.c   | 73 +++++++++++++++++--
 .../net/wireless/mediatek/mt76/mt7603/main.c  |  2 +-
 .../wireless/mediatek/mt76/mt7603/mt7603.h    |  4 +
 3 files changed, 72 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index 6387f9e61060a2..85c727fc44e6f5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -235,16 +235,17 @@ void mt7603_wtbl_set_smps(struct mt7603_dev *dev, struct mt7603_sta *sta,
 	sta->smps = enabled;
 }
 
-void mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
-			bool enabled)
+static void
+__mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
+		     bool enabled, bool filter)
 {
 	int idx = sta->wcid.idx;
 	u32 addr;
 
-	spin_lock_bh(&dev->ps_lock);
+	lockdep_assert_held(&dev->ps_lock);
 
 	if (sta->ps == enabled)
-		goto out;
+		return;
 
 	mt76_wr(dev, MT_PSE_RTA,
 		FIELD_PREP(MT_PSE_RTA_TAG_ID, idx) |
@@ -255,7 +256,7 @@ void mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
 
 	mt76_poll(dev, MT_PSE_RTA, MT_PSE_RTA_BUSY, 0, 5000);
 
-	if (enabled)
+	if (enabled && filter)
 		mt7603_filter_tx(dev, sta->vif->idx, idx, false);
 
 	addr = mt7603_wtbl1_addr(idx);
@@ -264,8 +265,34 @@ void mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
 		 enabled * MT_WTBL1_W3_POWER_SAVE);
 	mt76_clear(dev, MT_WTBL1_OR, MT_WTBL1_OR_PSM_WRITE);
 	sta->ps = enabled;
+}
 
-out:
+void mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
+			bool enabled)
+{
+	spin_lock_bh(&dev->ps_lock);
+	__mt7603_wtbl_set_ps(dev, sta, enabled, enabled);
+	spin_unlock_bh(&dev->ps_lock);
+}
+
+void mt7603_wtbl_sta_ps(struct mt7603_dev *dev, struct mt7603_sta *sta, bool ps)
+{
+	spin_lock_bh(&dev->ps_lock);
+	sta->ps_sleeping = ps;
+	__mt7603_wtbl_set_ps(dev, sta, ps, ps);
+	spin_unlock_bh(&dev->ps_lock);
+}
+
+void mt7603_wtbl_restore_ps(struct mt7603_dev *dev, struct mt7603_sta *sta)
+{
+	spin_lock_bh(&dev->ps_lock);
+	/*
+	 * Frames that are already queued for the station belong to the service
+	 * period that has just been served, so unlike on a sleep transition
+	 * they must not be pulled back into the PS queue.
+	 */
+	if (sta->ps_sleeping)
+		__mt7603_wtbl_set_ps(dev, sta, true, false);
 	spin_unlock_bh(&dev->ps_lock);
 }
 
@@ -1816,6 +1843,39 @@ mt7603_false_cca_check(struct mt7603_dev *dev)
 	mt7603_adjust_sensitivity(dev);
 }
 
+/*
+ * Releasing buffered frames turns off the PSE redirect for a station, since
+ * the released frames would otherwise be looped back into the driver PS queue
+ * again. mac80211 never tells us when the service period is over, so hardware
+ * buffering has to be re-armed here for every station that is still known to
+ * be asleep. Waiting for the PSD queue to drain makes sure that the released
+ * frames have already passed the redirect stage.
+ */
+static void
+mt7603_mac_ps_check(struct mt7603_dev *dev)
+{
+	int i;
+
+	if (dev->mphy.q_tx[MT_TXQ_PSD]->queued)
+		return;
+
+	rcu_read_lock();
+	for (i = 0; i < MT7603_WTBL_STA; i++) {
+		struct mt76_wcid *wcid = mt76_wcid_ptr(dev, i);
+		struct mt7603_sta *msta;
+
+		if (!wcid || !wcid->sta)
+			continue;
+
+		msta = container_of(wcid, struct mt7603_sta, wcid);
+		if (msta->ps || !msta->ps_sleeping)
+			continue;
+
+		mt7603_wtbl_restore_ps(dev, msta);
+	}
+	rcu_read_unlock();
+}
+
 void mt7603_mac_work(struct work_struct *work)
 {
 	struct mt7603_dev *dev = container_of(work, struct mt7603_dev,
@@ -1830,6 +1890,7 @@ void mt7603_mac_work(struct work_struct *work)
 	dev->mphy.mac_work_count++;
 	mt76_update_survey(&dev->mphy);
 	mt7603_edcca_check(dev);
+	mt7603_mac_ps_check(dev);
 
 	for (i = 0, idx = 0; i < 2; i++) {
 		u32 val = mt76_rr(dev, MT_TX_AGG_CNT(i));
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
index f8a43d9f72f954..04e3966ab047fc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
@@ -410,7 +410,7 @@ mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
 	struct sk_buff_head list;
 
 	mt76_stop_tx_queues(&dev->mphy, sta, true);
-	mt7603_wtbl_set_ps(dev, msta, ps);
+	mt7603_wtbl_sta_ps(dev, msta, ps);
 	if (ps)
 		return;
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
index 55a034ccbacd94..c43ddd3e693c00 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
@@ -80,6 +80,7 @@ struct mt7603_sta {
 	u8 smps;
 
 	u8 ps;
+	u8 ps_sleeping;
 };
 
 struct mt7603_vif {
@@ -229,6 +230,9 @@ int mt7603_wtbl_set_key(struct mt7603_dev *dev, int wcid,
 			struct ieee80211_key_conf *key);
 void mt7603_wtbl_set_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
 			bool enabled);
+void mt7603_wtbl_sta_ps(struct mt7603_dev *dev, struct mt7603_sta *sta,
+			bool ps);
+void mt7603_wtbl_restore_ps(struct mt7603_dev *dev, struct mt7603_sta *sta);
 void mt7603_wtbl_set_smps(struct mt7603_dev *dev, struct mt7603_sta *sta,
 			  bool enabled);
 void mt7603_filter_tx(struct mt7603_dev *dev, int mac_idx, int idx, bool abort);

From cc03f779a328c9e06e725355dea8267df9c32b41 Mon Sep 17 00:00:00 2001
From: Can Peng <pengcan@kylinos.cn>
Date: Fri, 24 Jul 2026 17:25:30 +0800
Subject: [PATCH 0310/1982] wifi: brcmfmac: Set DMA direction for msgbuf packet
 IDs

[ Upstream commit f0ba5fd51ff23077ce66cb9be79d41a4b7c19c5e ]

brcmf_msgbuf_init_pktids() takes the DMA direction from its callers,
but never stores it in the packet ID state.  Since the state is zeroed,
pktids->direction remains DMA_BIDIRECTIONAL for both the TX and RX
packet ID pools.

All msgbuf packet ID map and unmap paths use pktids->direction.  As a
result, TX buffers requested with DMA_TO_DEVICE and RX buffers requested
with DMA_FROM_DEVICE are mapped and unmapped as DMA_BIDIRECTIONAL
instead.

Store the caller-provided direction when initializing the packet ID
state.

Signed-off-by: Can Peng <pengcan@kylinos.cn>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260724092530.674624-1-pengcan@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 45fbcbdc7d9e4b..de47d6b7e02b2d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -310,6 +310,7 @@ brcmf_msgbuf_init_pktids(u32 nr_array_entries,
 	}
 	pktids->array = array;
 	pktids->array_size = nr_array_entries;
+	pktids->direction = direction;
 
 	return pktids;
 }

From cbbef3c7d07caee341bea159044a1a746352ff8a Mon Sep 17 00:00:00 2001
From: Can Peng <pengcan@kylinos.cn>
Date: Thu, 23 Jul 2026 13:56:17 +0800
Subject: [PATCH 0311/1982] wifi: brcmfmac: validate msgbuf flowring IDs before
 use

[ Upstream commit 32856f39fefdc75bd253cab999f996750628648e ]

Firmware messages carry flow_ring_id values which brcmfmac converts
to an internal flowid by subtracting
BRCMF_H2D_MSGRING_FLOWRING_IDSTART. The resulting value is used as
a bit index in txstatus_done_map and as an array index into
msgbuf->flowrings and the flowring state.

Validate the firmware supplied flow_ring_id before using it. This
prevents flow_ring_id values below BRCMF_H2D_MSGRING_FLOWRING_IDSTART
from underflowing and rejects values outside msgbuf->max_flowrings.

In the tx status path, complete the packet with an error after
removing a valid packet id so the skb is not leaked when the flow
ring id is invalid.

Signed-off-by: Can Peng <pengcan@kylinos.cn>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260723055618.550834-1-pengcan@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 46 ++++++++++++++++---
 1 file changed, 40 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index de47d6b7e02b2d..f850e64108c410 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -561,6 +561,28 @@ brcmf_msgbuf_remove_flowring(struct brcmf_msgbuf *msgbuf, u16 flowid)
 	brcmf_flowring_delete(msgbuf->flow, flowid);
 }
 
+static bool brcmf_msgbuf_get_flowid(struct brcmf_msgbuf *msgbuf,
+				    u16 flow_ring_id, u16 *flowid)
+{
+	u32 id = flow_ring_id;
+
+	if (id < BRCMF_H2D_MSGRING_FLOWRING_IDSTART) {
+		bphy_err(msgbuf->drvr, "invalid flowring id %u\n",
+			 flow_ring_id);
+		return false;
+	}
+
+	id -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+	if (id >= msgbuf->max_flowrings) {
+		bphy_err(msgbuf->drvr, "invalid flowring id %u\n",
+			 flow_ring_id);
+		return false;
+	}
+
+	*flowid = id;
+	return true;
+}
+
 
 static struct brcmf_msgbuf_work_item *
 brcmf_msgbuf_dequeue_work(struct brcmf_msgbuf *msgbuf)
@@ -881,17 +903,23 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 	struct msgbuf_tx_status *tx_status;
 	u32 idx;
 	struct sk_buff *skb;
+	u16 flow_ring_id;
 	u16 flowid;
 
 	tx_status = (struct msgbuf_tx_status *)buf;
 	idx = le32_to_cpu(tx_status->msg.request_id) - 1;
-	flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
-	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+	flow_ring_id = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
 				     msgbuf->tx_pktids, idx);
 	if (!skb)
 		return;
 
+	if (!brcmf_msgbuf_get_flowid(msgbuf, flow_ring_id, &flowid)) {
+		brcmf_txfinalize(brcmf_get_ifp(msgbuf->drvr, tx_status->msg.ifidx),
+				 skb, false);
+		return;
+	}
+
 	set_bit(flowid, msgbuf->txstatus_done_map);
 	commonring = msgbuf->flowrings[flowid];
 	atomic_dec(&commonring->outstanding_tx);
@@ -1238,13 +1266,16 @@ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
 	struct msgbuf_flowring_create_resp *flowring_create_resp;
 	u16 status;
 	u16 flowid;
+	u16 flow_ring_id;
 
 	flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
 
-	flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
-	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+	flow_ring_id = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
 	status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
 
+	if (!brcmf_msgbuf_get_flowid(msgbuf, flow_ring_id, &flowid))
+		return;
+
 	if (status) {
 		bphy_err(drvr, "Flowring creation failed, code %d\n", status);
 		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
@@ -1267,13 +1298,16 @@ brcmf_msgbuf_process_flow_ring_delete_response(struct brcmf_msgbuf *msgbuf,
 	struct msgbuf_flowring_delete_resp *flowring_delete_resp;
 	u16 status;
 	u16 flowid;
+	u16 flow_ring_id;
 
 	flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
 
-	flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
-	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+	flow_ring_id = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
 	status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
 
+	if (!brcmf_msgbuf_get_flowid(msgbuf, flow_ring_id, &flowid))
+		return;
+
 	if (status) {
 		bphy_err(drvr, "Flowring deletion failed, code %d\n", status);
 		brcmf_flowring_delete(msgbuf->flow, flowid);

From 0a03dd1d896b15b8900db304f988fbfaf7ea20dd Mon Sep 17 00:00:00 2001
From: Mariano Baragiola <mbaragiola@linux.com>
Date: Tue, 28 Jul 2026 16:26:10 -0300
Subject: [PATCH 0312/1982] wifi: wilc1000: validate monitor transmit frame
 headers

[ Upstream commit 9d96e037ff90a2fc81a841b2002d500a5a4a5351 ]

wilc_wfi_mon_xmit() reads the radiotap length before ensuring that the
fixed header is present. After stripping that header, it reads the frame
type and all three 802.11 addresses without checking how much frame data
remains.

A truncated monitor injection can therefore cause out-of-bounds reads.
Validate the radiotap header first, use the common 802.11 helper to check
the variable header length, and require a complete three-address header
before using the addresses. This covers QoS and four-address data headers
while rejecting short control headers that this path cannot classify.

Signed-off-by: Mariano Baragiola <mbaragiola@linux.com>
Link: https://patch.msgid.link/20260728192610.2236361-1-mbaragiola@linux.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/microchip/wilc1000/mon.c | 30 +++++++++++++++----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/mon.c b/drivers/net/wireless/microchip/wilc1000/mon.c
index c3d27aaec29742..c0fde3b0d8aabb 100644
--- a/drivers/net/wireless/microchip/wilc1000/mon.c
+++ b/drivers/net/wireless/microchip/wilc1000/mon.c
@@ -142,6 +142,9 @@ static int mon_mgmt_tx(struct net_device *dev, const u8 *buf, size_t len)
 static netdev_tx_t wilc_wfi_mon_xmit(struct sk_buff *skb,
 				     struct net_device *dev)
 {
+	struct ieee80211_radiotap_header_fixed *rtap_hdr;
+	struct ieee80211_hdr_3addr *hdr;
+	unsigned int hdr_len;
 	u32 rtap_len, ret = 0;
 	struct wilc_wfi_mon_priv  *mon_priv;
 	struct sk_buff *skb2;
@@ -153,13 +156,26 @@ static netdev_tx_t wilc_wfi_mon_xmit(struct sk_buff *skb,
 	if (!mon_priv)
 		return -EFAULT;
 
+	if (skb->len < sizeof(*rtap_hdr))
+		goto drop;
+
+	rtap_hdr = (void *)skb->data;
+	if (rtap_hdr->it_version)
+		goto drop;
+
 	rtap_len = ieee80211_get_radiotap_len(skb->data);
-	if (skb->len < rtap_len)
-		return -1;
+	if (rtap_len < sizeof(*rtap_hdr) || skb->len < rtap_len)
+		goto drop;
 
 	skb_pull(skb, rtap_len);
+	hdr_len = ieee80211_get_hdrlen_from_skb(skb);
+	if (hdr_len < sizeof(*hdr))
+		goto drop;
 
-	if (skb->data[0] == 0xc0 && is_broadcast_ether_addr(&skb->data[4])) {
+	hdr = (void *)skb->data;
+
+	if (ieee80211_is_deauth(hdr->frame_control) &&
+	    is_broadcast_ether_addr(hdr->addr1)) {
 		skb2 = dev_alloc_skb(skb->len + sizeof(*cb_hdr));
 		if (!skb2)
 			return -ENOMEM;
@@ -191,8 +207,8 @@ static netdev_tx_t wilc_wfi_mon_xmit(struct sk_buff *skb,
 	}
 	skb->dev = mon_priv->real_ndev;
 
-	ether_addr_copy(srcadd, &skb->data[10]);
-	ether_addr_copy(bssid, &skb->data[16]);
+	ether_addr_copy(srcadd, hdr->addr2);
+	ether_addr_copy(bssid, hdr->addr3);
 	/*
 	 * Identify if data or mgmt packet, if source address and bssid
 	 * fields are equal send it to mgmt frames handler
@@ -207,6 +223,10 @@ static netdev_tx_t wilc_wfi_mon_xmit(struct sk_buff *skb,
 	}
 
 	return ret;
+
+drop:
+	dev_kfree_skb(skb);
+	return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops wilc_wfi_netdev_ops = {

From 70c6c25f1fdc52c435ace317010e1f819c985416 Mon Sep 17 00:00:00 2001
From: Mauricio Orozco <maudob@live.com>
Date: Wed, 29 Jul 2026 22:34:55 -0500
Subject: [PATCH 0313/1982] ALSA: hda/realtek: Add quirk for ASUS VivoBook
 M515DA/X515DAP

[ Upstream commit a9fa2a016e805504223abf8c9b373ac9f7bfb9b3 ]

The ASUS VivoBook M515DA/X515DAP (subsystem ID 1043:1e3e)
requires the ALC256_FIXUP_ASUS_MIC_NO_PRESENCE fixup to
enable the internal microphone.

Without this quirk, the internal microphone captures only
silence under Linux, while it works correctly under Windows.

The fix has been verified on real hardware.
Tested on an ASUS VivoBook M515DA/X515DAP running Linux Mint
22.3 with Ubuntu HWE kernel 7.0.0-28.

Signed-off-by: Mauricio Orozco <maudob@live.com>
Link: https://patch.msgid.link/20260730033506.8958-1-mauoro3@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 3364f6ad91fcbb..4cadbad99537a4 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7196,6 +7196,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1264, "ASUS UM5606KA", ALC294_FIXUP_BASS_SPEAKER_15),
 	SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1043, 0x1e10, "ASUS VivoBook X507UAR", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x1e3e, "ASUS VivoBook M515DA/X515DAP", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
 	SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1e1f, "ASUS Vivobook 15 X1504VAP", ALC2XX_FIXUP_HEADSET_MIC),

From d191b5ca149b7597e45051c82cbe43d76a1f881e Mon Sep 17 00:00:00 2001
From: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Date: Tue, 21 Jul 2026 18:12:48 +0100
Subject: [PATCH 0314/1982] HID: logitech-hidpp: Add support for G502 X Plus
 USB mouse

[ Upstream commit 6f4b44abe4ccdcfdab75c9493b8c7634fee37133 ]

The wireless dongle is already supported, this adds detection for
the mouse in wired mode. Supports battery reporting.

Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index a2bb7d8b15b69a..a931713a9cb696 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4615,6 +4615,8 @@ static const struct hid_device_id hidpp_devices[] = {
 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
 	{ /* Logitech G502 Lightspeed Wireless Gaming Mouse over USB */
 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08D) },
+	{ /* Logitech G502 X Plus Wireless Gaming Mouse over USB */
+	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC095) },
 	{ /* Logitech G703 Gaming Mouse over USB */
 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
 	{ /* Logitech G703 Hero Gaming Mouse over USB */

From 799f1158406074aa70c77af9fd27c726b2ab9031 Mon Sep 17 00:00:00 2001
From: Aaron Ma <mapengyu@gmail.com>
Date: Mon, 3 Aug 2026 13:39:32 +0800
Subject: [PATCH 0315/1982] HID: quirks: Add ALWAYS_POLL quirk for Beitong
 BTP-KP20D dongle

[ Upstream commit bfff246b3a31cb45ec297ca5e2a77c1410b207ac ]

The BTP-KP20D dongle in Direct/HID mode (20dd:5159) re-enumerates every
few seconds because usbhid never submits its interrupt-IN URB: no HID
driver binds to the vendor-specific report descriptor, so the device is
never opened, and the firmware treats the idle endpoint as a lost link.

Add HID_QUIRK_ALWAYS_POLL to keep the interrupt-IN URB submitted from
probe time.

Signed-off-by: Aaron Ma <mapengyu@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h    | 3 +++
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a9db2b30be9bdf..c1a7f5558ccd18 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -262,6 +262,9 @@
 #define USB_VENDOR_ID_BAANTO		0x2453
 #define USB_DEVICE_ID_BAANTO_MT_190W2	0x0100
 
+#define USB_VENDOR_ID_BEITONG		0x20dd
+#define USB_DEVICE_ID_BEITONG_KP20D	0x5159
+
 #define USB_VENDOR_ID_BELKIN		0x050d
 #define USB_DEVICE_ID_FLIP_KVM		0x3201
 
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 9d18b962e0ea63..3de594ee25c38e 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -45,6 +45,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_BEITONG, USB_DEVICE_ID_BEITONG_KP20D), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },

From d8152a70f694a5ed960e1cdf79f82fada1183b3a Mon Sep 17 00:00:00 2001
From: Yuxiang Lin <mclyxfdw@gmail.com>
Date: Thu, 23 Jul 2026 01:56:02 +0800
Subject: [PATCH 0316/1982] HID: quirks: add ALWAYS_POLL quirk for AULA Mini 60
 HE Pro Dongle

[ Upstream commit 2884e21b18613708f050ec75330b265dd07ecc03 ]

The AULA Mini 60 HE Pro wireless keyboard dongle (USB ID
0c45:fefe) becomes unresponsive after roughly one minute of idle.
No error appears in dmesg; the only recovery is physically
replugging the dongle.

This has been reproduced across kernels 6.8, 6.14 and 7.1.3.

Testing shows HID_QUIRK_ALWAYS_POLL alone resolves the issue,
verified via usbhid.quirks=0x0c45:0xfefe:0x400.

Signed-off-by: Yuxiang Lin <mclyxfdw@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c1a7f5558ccd18..5169713539bc38 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -748,6 +748,7 @@
 #define USB_DEVICE_ID_JESS_YUREX	0x1010
 #define USB_DEVICE_ID_ASUS_MD_5112	0x5112
 #define USB_DEVICE_ID_REDRAGON_ASURA	0x760b
+#define USB_DEVICE_ID_AULA_MINI_60_HE_PRO 0xfefe
 
 #define USB_VENDOR_ID_JESS2		0x0f30
 #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 3de594ee25c38e..8d2ac32c5ac123 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -113,6 +113,8 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_AULA_MINI_60_HE_PRO),
+		HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M406), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M506), HID_QUIRK_MULTI_INPUT },

From 6802944b2bca3a31b9284b45754e6e30a1a63294 Mon Sep 17 00:00:00 2001
From: Wahid Khan <wahidzk0091@gmail.com>
Date: Mon, 20 Jul 2026 23:26:56 +0530
Subject: [PATCH 0317/1982] HID: intel-ish-hid: ignore post-init ENUM_DEVICES
 from firmware

[ Upstream commit f3f3f6df05226dfa220c4e603310dae94595060a ]

Some ISH firmware versions (observed on Tiger Lake LP, 8086:a0fc,
GUID {33AECD58-B679-4E54-9BD9-A04D34F0C226}) periodically re-send an
unsolicited HOSTIF_DM_ENUM_DEVICES response roughly every 79 seconds.

The current guard collapses two distinct cases into one condition:

  if (!(response_flag) || init_done)  ->  bad packet + ish_hw_reset

This incorrectly treats a valid post-init firmware announcement as a
corrupted packet, triggering an ISH soft-reset and a full ISHTP
re-initialisation cycle on each occurrence (~1100 times per day on
affected hardware).

Split the check: reject messages with no response flag as before, but
simply discard valid ENUM_DEVICES messages that arrive after init is
complete.

Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Tested-by: Zhang Lixu <lixu.zhang@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/intel-ish-hid/ishtp-hid-client.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index 12a43c64e81560..085313ae354abf 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -113,8 +113,7 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 
 		switch (recv_msg->hdr.command & CMD_MASK) {
 		case HOSTIF_DM_ENUM_DEVICES:
-			if ((!(recv_msg->hdr.command & ~CMD_MASK) ||
-					client_data->init_done)) {
+			if (!(recv_msg->hdr.command & ~CMD_MASK)) {
 				++client_data->bad_recv_cnt;
 				report_bad_packet(hid_ishtp_cl, recv_msg,
 						  cur_pos,
@@ -122,6 +121,8 @@ static void process_recv(struct ishtp_cl *hid_ishtp_cl, void *recv_buf,
 				ish_hw_reset(ishtp_get_ishtp_device(hid_ishtp_cl));
 				break;
 			}
+			if (client_data->init_done)
+				break;
 			client_data->hid_dev_count = (unsigned int)*payload;
 			if (!client_data->hid_devices)
 				client_data->hid_devices = devm_kcalloc(

From 6e016448a0dc0b39b23803beea441da7662bebea Mon Sep 17 00:00:00 2001
From: Allison Henderson <achender@kernel.org>
Date: Wed, 29 Jul 2026 21:16:26 -0700
Subject: [PATCH 0318/1982] net/rds: don't use unpin_user_pages_dirty_lock()
 from atomic context

[ Upstream commit d100966325f782aa7775e5f0e8fb04f66f56308e ]

rds_rdma_free_op() and rds_atomic_free_op() are reached from the IB
send completion path via

  rds_ib_tasklet_fn_send()
    rds_ib_send_cqe_handler()
      rds_message_put()
        rds_message_purge()
          rds_rdma_free_op() / rds_atomic_free_op()

which runs in tasklet (softirq) context.  Both functions unpin the
user pages of the op with unpin_user_pages_dirty_lock(), which uses
set_page_dirty_lock() and thus may take the folio lock and sleep.
Sleeping in softirq context is not allowed and can deadlock or crash.

Dirtying the pages with the non-sleeping set_page_dirty() instead
would just trade one bug for another, as pointed out during review:
the pinned range can be file-backed.  rds_pin_pages() pins with
FOLL_LONGTERM, which refuses fs-dax but takes the page-cache pages
of a MAP_SHARED file mapping just fine, and RDS does not restrict
what memory the caller registers as an RDMA destination.

For a file-backed page, set_page_dirty() from a tasklet can take
non-irq-safe filesystem locks (e.g. mapping->i_private_lock and
inode->i_lock in block_dirty_folio()) and deadlock against the task
it interrupted.  Without the folio lock, it races with truncation
clearing folio->mapping, which is the race set_page_dirty_lock()
exists to close.  The pre-pin_user_pages() version of this code
dirtied pages that way from the tasklet, so that bug is older than
the sleeping unpin.

The page dirtying therefore has to move to process context, not
merely avoid the folio lock.  When the final rds_message_put() runs
in atomic context, rds_rdma_free_op() and rds_atomic_free_op() now
leave the op's pages pinned and flag the op. Later, rds_message_put()
hands the message to a work item that unpins the flagged ops' pages
and frees the message from process context. Here,
unpin_user_pages_dirty_lock() is safe outside the atomic context.
Everything else keeps running in the caller's context exactly as
before: the rest of the purge - the zerocopy completion, the socket
put and the MR reference drops - as well as RDMA writes, whose pages
the remote side only reads and which unpin without dirtying,
everything on rds_tcp, and final puts that already happen in process
context (socket close, connection teardown).

Deferring only the unpin means the work item touches nothing but the
pinned pages and the rds module's own memory: it cannot call back
into a transport module, so it changes nothing about the transports'
shutdown and unload ordering.  rds_exit() drains any pending unpin
work via destroy_workqueue(rds_wq) before the module goes away.

The Oracle UEK kernel avoids the sleeping unpin by calling
set_page_dirty() directly from the tasklet, which is subject to the
file-backed page problem above, so this deliberately does not follow
UEK here.

Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260730041629.3512480-2-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/message.c | 26 +++++++++++++++++++++++++
 net/rds/rdma.c    | 49 ++++++++++++++++++++++++++++++++++++-----------
 net/rds/rds.h     | 10 ++++++++++
 3 files changed, 74 insertions(+), 11 deletions(-)

diff --git a/net/rds/message.c b/net/rds/message.c
index 19202aa33f6f4e..bdd340f4cce658 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -180,6 +180,19 @@ static void rds_message_purge(struct rds_message *rm)
 		kref_put(&rm->atomic.op_rdma_mr->r_kref, __rds_put_mr_final);
 }
 
+static void rds_message_unpin_worker(struct work_struct *work)
+{
+	struct rds_message *rm = container_of(work, struct rds_message,
+					      m_unpin_work);
+
+	if (rm->rdma.op_unpin_deferred)
+		rds_rdma_op_unpin_pages(&rm->rdma);
+	if (rm->atomic.op_unpin_deferred)
+		rds_atomic_op_unpin_page(&rm->atomic);
+
+	kfree(rm);
+}
+
 void rds_message_put(struct rds_message *rm)
 {
 	rdsdebug("put rm %p ref %d\n", rm, refcount_read(&rm->m_refcount));
@@ -187,8 +200,21 @@ void rds_message_put(struct rds_message *rm)
 	if (refcount_dec_and_test(&rm->m_refcount)) {
 		BUG_ON(!list_empty(&rm->m_sock_item));
 		BUG_ON(!list_empty(&rm->m_conn_item));
+
 		rds_message_purge(rm);
 
+		/* A final put in atomic context cannot dirty the ops'
+		 * user pages on unpin, so rds_rdma_free_op() and
+		 * rds_atomic_free_op() deferred it.  Finish the unpin,
+		 * and the free, from process context.
+		 */
+		if (rm->rdma.op_unpin_deferred ||
+		    rm->atomic.op_unpin_deferred) {
+			INIT_WORK(&rm->m_unpin_work, rds_message_unpin_worker);
+			queue_work(rds_wq, &rm->m_unpin_work);
+			return;
+		}
+
 		kfree(rm);
 	}
 }
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 34d9333e4229f3..37695056756bea 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -483,22 +483,36 @@ void rds_rdma_unuse(struct rds_sock *rs, u32 r_key, int force)
 		kref_put(&mr->r_kref, __rds_put_mr_final);
 }
 
-void rds_rdma_free_op(struct rm_rdma_op *ro)
+void rds_rdma_op_unpin_pages(struct rm_rdma_op *ro)
 {
 	unsigned int i;
 
+	for (i = 0; i < ro->op_nents; i++) {
+		struct page *page = sg_page(&ro->op_sg[i]);
+
+		/* Mark page dirty if it was possibly modified, which
+		 * is the case for a RDMA_READ which copies from remote
+		 * to local memory
+		 */
+		unpin_user_pages_dirty_lock(&page, 1, !ro->op_write);
+	}
+}
+
+void rds_rdma_free_op(struct rm_rdma_op *ro)
+{
 	if (ro->op_odp_mr) {
 		kref_put(&ro->op_odp_mr->r_kref, __rds_put_mr_final);
+	} else if (in_task() || ro->op_write) {
+		/* An RDMA write's pages are only read by the remote
+		 * side; unpinning without dirtying does not sleep.
+		 */
+		rds_rdma_op_unpin_pages(ro);
 	} else {
-		for (i = 0; i < ro->op_nents; i++) {
-			struct page *page = sg_page(&ro->op_sg[i]);
-
-			/* Mark page dirty if it was possibly modified, which
-			 * is the case for a RDMA_READ which copies from remote
-			 * to local memory
-			 */
-			unpin_user_pages_dirty_lock(&page, 1, !ro->op_write);
-		}
+		/* Dirtying the pages on unpin can sleep; leave them
+		 * pinned and have rds_message_put() finish the unpin
+		 * from process context.
+		 */
+		ro->op_unpin_deferred = 1;
 	}
 
 	kfree(ro->op_notifier);
@@ -507,7 +521,7 @@ void rds_rdma_free_op(struct rm_rdma_op *ro)
 	ro->op_odp_mr = NULL;
 }
 
-void rds_atomic_free_op(struct rm_atomic_op *ao)
+void rds_atomic_op_unpin_page(struct rm_atomic_op *ao)
 {
 	struct page *page = sg_page(ao->op_sg);
 
@@ -515,6 +529,19 @@ void rds_atomic_free_op(struct rm_atomic_op *ao)
 	 * is the case for a RDMA_READ which copies from remote
 	 * to local memory */
 	unpin_user_pages_dirty_lock(&page, 1, true);
+}
+
+void rds_atomic_free_op(struct rm_atomic_op *ao)
+{
+	if (in_task()) {
+		rds_atomic_op_unpin_page(ao);
+	} else {
+		/* Dirtying the page on unpin can sleep; leave it
+		 * pinned and have rds_message_put() finish the unpin
+		 * from process context.
+		 */
+		ao->op_unpin_deferred = 1;
+	}
 
 	kfree(ao->op_notifier);
 	ao->op_notifier = NULL;
diff --git a/net/rds/rds.h b/net/rds/rds.h
index a029e5fcdea72a..a4816da162930d 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -424,6 +424,12 @@ struct rds_message {
 
 	void			*m_final_op;
 
+	/* Unpins the ops' user pages and frees the message from
+	 * process context when the final put happens in atomic
+	 * context: dirtying the pages on unpin can sleep.
+	 */
+	struct work_struct	m_unpin_work;
+
 	struct {
 		struct rm_atomic_op {
 			int			op_type;
@@ -447,6 +453,7 @@ struct rds_message {
 			unsigned int		op_mapped:1;
 			unsigned int		op_silent:1;
 			unsigned int		op_active:1;
+			unsigned int		op_unpin_deferred:1;
 			struct scatterlist	*op_sg;
 			struct rds_notifier	*op_notifier;
 
@@ -462,6 +469,7 @@ struct rds_message {
 			unsigned int		op_mapped:1;
 			unsigned int		op_silent:1;
 			unsigned int		op_active:1;
+			unsigned int		op_unpin_deferred:1;
 			unsigned int		op_bytes;
 			unsigned int		op_nents;
 			unsigned int		op_count;
@@ -938,6 +946,8 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
 			  struct cmsghdr *cmsg);
 void rds_rdma_free_op(struct rm_rdma_op *ro);
 void rds_atomic_free_op(struct rm_atomic_op *ao);
+void rds_rdma_op_unpin_pages(struct rm_rdma_op *ro);
+void rds_atomic_op_unpin_page(struct rm_atomic_op *ao);
 void rds_rdma_send_complete(struct rds_message *rm, int wc_status);
 void rds_atomic_send_complete(struct rds_message *rm, int wc_status);
 int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,

From d27f95e1d8e1d6abc30d2baf1d7c501d9cadaf87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A5kon=20Bugge?= <haakon.bugge@oracle.com>
Date: Wed, 29 Jul 2026 21:16:27 -0700
Subject: [PATCH 0319/1982] net/rds: hold the socket while an rds_mr references
 it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9079adef042c1e7a6141dcdfd3041acd30607297 ]

Each rds_mr stores a bare back pointer to the socket that created it
(mr->r_sock) but takes no reference on it.  When the mr is destroyed it
references the rs. Hence, provisions must be made to avoid the rs
being destroyed before all mrs referencing it have been destroyed.

The MR itself is refcounted, and in-flight messages legitimately hold
MR krefs that can outlive the socket: rds_release() drops the rb-tree
references via rds_rdma_drop_keys(), but a send completion arriving
afterwards drops the final message reference from the CQ handler and
ends up in

  rds_message_purge()
    __rds_put_mr_final()
      rds_destroy_mr()   -> takes rs->rs_rdma_lock

dereferencing a socket that may already have been freed.

Oracle UEK fixed the same use-after-free ("rds: Add proper refcnt when
an RDS MR references an RDS Socket") after seeing crashes of the form:

  PF: supervisor write access in kernel mode
  _raw_spin_lock_irqsave+0x4a/0x6a
  __rds_put_mr_final+0x2c/0xe0 [rds]
  rds_message_purge+0x13c/0x150 [rds]
  rds_message_put+0x39/0x54 [rds]
  rds_ib_send_cqe_handler+0x147/0x3dd [rds_rdma]

To fix this, take a socket reference when an MR is created and drop it
when the final MR kref goes away.  The reference cycle is broken by
rds_release(), which always runs rds_rdma_drop_keys() on close.  So the
socket reference held by an MR never prevents release, it only delays
sk_free() until the last MR user is done.

The hold sits next to kref_init() at both allocation sites -
__rds_rdma_map() and the on-demand-paging path in
rds_cmsg_rdma_args() - so every MR owns exactly one socket reference
from the moment it becomes kref-managed.  For that to work on the ODP
path, its get_mr() error handling is converted from a bare kfree() to
kref_put(..., __rds_put_mr_final), with r_trans_private cleared first
since it holds an ERR_PTR there; both sites then tear down through
the same path and a future error-path change cannot silently leak or
double-drop the reference.

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
[achender: port to net-next (sock_hold/sock_put in place of the UEK
 rds_sock_addref/rds_sock_put helpers); also balance the reference on
 the rds_cmsg_rdma_args() ODP path and unify its error path with
 __rds_put_mr_final(); update commit message]
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260730041629.3512480-3-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/rdma.c | 14 +++++++++++++-
 net/rds/rds.h  |  5 ++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 37695056756bea..062c12d9318e97 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -117,6 +117,7 @@ void __rds_put_mr_final(struct kref *kref)
 	struct rds_mr *mr = container_of(kref, struct rds_mr, r_kref);
 
 	rds_destroy_mr(mr);
+	sock_put(rds_rs_to_sk(mr->r_sock));
 	kfree(mr);
 }
 
@@ -243,7 +244,11 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
 	kref_init(&mr->r_kref);
 	RB_CLEAR_NODE(&mr->r_rb_node);
 	mr->r_trans = rs->rs_transport;
+	/* The MR can outlive its socket: a socket reference is held
+	 * until the final kref is dropped in __rds_put_mr_final().
+	 */
 	mr->r_sock = rs;
+	sock_hold(rds_rs_to_sk(rs));
 
 	if (args->flags & RDS_RDMA_USE_ONCE)
 		mr->r_use_once = 1;
@@ -762,7 +767,12 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
 			RB_CLEAR_NODE(&local_odp_mr->r_rb_node);
 			kref_init(&local_odp_mr->r_kref);
 			local_odp_mr->r_trans = rs->rs_transport;
+			/* The MR can outlive its socket: a socket
+			 * reference is held until the final kref is
+			 * dropped in __rds_put_mr_final().
+			 */
 			local_odp_mr->r_sock = rs;
+			sock_hold(rds_rs_to_sk(rs));
 			local_odp_mr->r_trans_private =
 				rs->rs_transport->get_mr(
 					NULL, 0, rs, &local_odp_mr->r_key, NULL,
@@ -771,7 +781,9 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
 				ret = PTR_ERR(local_odp_mr->r_trans_private);
 				rdsdebug("get_mr ret %d %p\"", ret,
 					 local_odp_mr->r_trans_private);
-				kfree(local_odp_mr);
+				local_odp_mr->r_trans_private = NULL;
+				kref_put(&local_odp_mr->r_kref,
+					 __rds_put_mr_final);
 				ret = -EOPNOTSUPP;
 				goto out_pages;
 			}
diff --git a/net/rds/rds.h b/net/rds/rds.h
index a4816da162930d..dcbc4610735d56 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -299,7 +299,10 @@ struct rds_mr {
 	unsigned int		r_invalidate:1;
 	unsigned int		r_write:1;
 
-	struct rds_sock		*r_sock; /* back pointer to the socket that owns us */
+	struct rds_sock		*r_sock; /* socket that owns us; counted
+					  * reference, dropped by
+					  * __rds_put_mr_final()
+					  */
 	struct rds_transport	*r_trans;
 	void			*r_trans_private;
 };

From 3ae57d5de9155635c4a2c9637b7b7c34d22238f1 Mon Sep 17 00:00:00 2001
From: Sharath Srinivasan <sharath.srinivasan@oracle.com>
Date: Wed, 29 Jul 2026 21:16:28 -0700
Subject: [PATCH 0320/1982] net/rds: fix rds_message leak in the
 rds_send_xmit() drop path

[ Upstream commit eb8a59a17f4a8b6f2afb4a8063e99dd96cc3fab0 ]

When rds_send_xmit() picks the next message off cp_send_queue it takes
its own reference with rds_message_addref().  If the message then hits
the never-retransmit check (RDS_MSG_FLUSH, or an RDMA op that was
already retransmitted), it is moved to the local to_be_dropped list and
that reference is dropped after the batch.

However, if RDS_MSG_ON_CONN has already been cleared, the message is
not added to to_be_dropped and the reference taken above is never
dropped: cp_xmit_rm has not been set at this point, so the loop simply
abandons rm and the rds_message (and everything it pins: pages, MRs,
notifiers) leaks after an RDMA error.

The only other places that clear RDS_MSG_ON_CONN are
rds_send_path_drop_acked() and rds_send_drop_to(), and both can run
while rds_send_xmit() has dropped cp_lock between moving the message
to cp_retrans and re-taking the lock in the never-retransmit check:
rds_send_path_drop_acked() can ack away a message that already sat on
cp_retrans - the RDS_MSG_RETRANSMITTED case above - and
rds_send_drop_to() runs on socket close.  Both unlink the message
under cp_lock and put their own reference, leaving the xmit-path
reference stranded.

Drop the reference directly in that case.

This mirrors Oracle UEK commit "net/rds: fix rds_message memleak in
rds_send_xmit".

Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com>
[achender: port to net-next; update commit message, checkpatch nits]
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260730041629.3512480-4-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/send.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/net/rds/send.c b/net/rds/send.c
index 5d09c7654f1368..0a541cfc901856 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -288,9 +288,21 @@ int rds_send_xmit(struct rds_conn_path *cp)
 			    (rm->rdma.op_active &&
 			    test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags))) {
 				spin_lock_irqsave(&cp->cp_lock, flags);
-				if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags))
-					list_move(&rm->m_conn_item, &to_be_dropped);
-				spin_unlock_irqrestore(&cp->cp_lock, flags);
+				if (test_and_clear_bit(RDS_MSG_ON_CONN,
+						       &rm->m_flags)) {
+					/* our ref is put after the batch */
+					list_move(&rm->m_conn_item,
+						  &to_be_dropped);
+					spin_unlock_irqrestore(&cp->cp_lock,
+							       flags);
+				} else {
+					/* already off the conn list; drop
+					 * the ref taken above ourselves
+					 */
+					spin_unlock_irqrestore(&cp->cp_lock,
+							       flags);
+					rds_message_put(rm);
+				}
 				continue;
 			}
 

From 2c4825a78bf444df92a5e608a5beda864e9c09a9 Mon Sep 17 00:00:00 2001
From: Allison Henderson <achender@kernel.org>
Date: Wed, 29 Jul 2026 21:16:29 -0700
Subject: [PATCH 0321/1982] net/rds: unpin MR pages with
 unpin_user_pages_dirty_lock()

[ Upstream commit a507023e6ff1d0b4e7aac49b2f547fed0c21ea4e ]

The pages backing an RDS memory region are pinned in __rds_rdma_map()
with rds_pin_pages(), which uses pin_user_pages_fast(): each page's
refcount is biased by GUP_PIN_COUNTING_BIAS to account the pin.  The
scatterlist is then handed to the IB transport, and the transport
releases the pages in __rds_ib_teardown_mr() with

	set_page_dirty(page);
	put_page(page);

put_page() drops a single reference instead of removing the pin bias,
so every MR teardown permanently strands the remaining references and
the pages are never freed - a userspace-triggerable memory leak of up
to RDS_MAX_MSG_SIZE per RDS_GET_MR/RDS_GET_MR_FOR_DEST call.

The conversion to the pin API updated the unpin sites in rdma.c but
missed this one on the transport side.  Release the pages with
unpin_user_pages_dirty_lock(), which removes the pin bias and also
dirties the page under the folio lock, closing the truncation race
that a bare set_page_dirty() leaves open.

Dirtying under the folio lock can sleep, which is safe in every path
that reaches __rds_ib_teardown_mr(): the registration-reuse path
(rds_ib_map_frmr()) runs in syscall context, and the pool flush
(rds_ib_unreg_frmr()) runs under pool->flush_lock, a mutex, and
already sleeps in rds_ib_post_inv().  The WARN_ON that guarded the
old irq-context set_page_dirty() case is dropped along with it.

Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260730041629.3512480-5-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib_rdma.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 751755cd069e0e..36fd8dedbce56f 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -251,9 +251,7 @@ void __rds_ib_teardown_mr(struct rds_ib_mr *ibmr)
 
 			/* FIXME we need a way to tell a r/w MR
 			 * from a r/o MR */
-			WARN_ON(!page->mapping && irqs_disabled());
-			set_page_dirty(page);
-			put_page(page);
+			unpin_user_pages_dirty_lock(&page, 1, true);
 		}
 		kfree(ibmr->sg);
 

From f302c2ce5e78d1ba5ddc9592d4e1a5ea018ac97d Mon Sep 17 00:00:00 2001
From: Simon Glass <sjg@chromium.org>
Date: Tue, 14 Jul 2026 07:35:42 -0600
Subject: [PATCH 0322/1982] kconfig: abort rather than loop for ever on EOF

[ Upstream commit f915149f5cfbd0d4406ec0b0f57b1d2c8685ae55 ]

When a non-interactive 'make oldconfig' or 'syncconfig' meets a new int
or hex symbol whose default cannot be applied, conf_string() reads a
value from stdin. At end of file fgets() returns NULL, no value is set
and the loop asks again. The result is an endless loop which fills the
output until it exhausts memory, rather than a clean failure.

Detect this in conf_string(): if the value cannot be set and stdin is at
end of file, stop with an error that names the symbol.

Note that a symbol with no default doesn't trigger this, since
sym_calc_value() falls back to 0, which is accepted at end of file. The
loop is triggered by a broken Kconfig file, with a default whose text
fails sym_string_valid().

Such mistakes do creep in from time to time and are hard to debug, since
the build fills the log with repeated prompts instead of pointing at the
offending symbol. Some bad defaults draw a parse-time warning, but
menu_validate_number() accepts a reference to any int or hex symbol, so
a cross-type reference loops with no warning at all. For example, "0xff"
is not a valid int value:

  config HEXSYM
          hex
          default 0xff

  config VAL
          int "Value"
          default HEXSYM

Interactive use is unaffected, since feof() only becomes true once a
read actually hits end of file: an invalid answer at a terminal still
re-prompts, while Ctrl-D at such a prompt exits with the error instead
of looping. bool and tristate symbols and choices already accept the
default on an empty line, so they still take their defaults in a
non-interactive build.

Tested with int and hex symbols carrying such defaults: with empty
stdin, the code without this change produces around 190MB of repeated
prompts within two seconds, while with the change it exits 1 naming the
symbol. Piped and interactive (pty) sessions still re-prompt on an
invalid answer and then accept a valid one. A new string symbol with no
default still takes the empty string at end of file, since any text is
valid for a string.

Signed-off-by: Simon Glass <sjg@chromium.org>
Link: https://patch.msgid.link/20260714133545.3294648-1-sjg@chromium.org
Signed-off-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kconfig/conf.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index c368bec5ab6016..fe8ba09b003910 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -348,6 +348,23 @@ static int conf_string(struct menu *menu)
 		}
 		if (def && sym_set_string_value(sym, def))
 			return 0;
+
+		/*
+		 * A new int or hex symbol whose default fails validation
+		 * cannot be set from an empty answer. When standard input is
+		 * exhausted, as it is for a non-interactive oldconfig or
+		 * syncconfig, re-asking would loop forever and grow the output
+		 * until it exhausts memory. Stop with an error that names the
+		 * symbol instead. String symbols accept any text, and bool and
+		 * tristate symbols (conf_sym()) and choices (conf_choice())
+		 * accept the default on an empty line, so they are unaffected.
+		 */
+		if (feof(stdin)) {
+			fprintf(stderr,
+				"\nerror: no value for new symbol '%s' at end of input\n",
+				sym->name);
+			exit(1);
+		}
 	}
 }
 

From de4d87d5b5ab3e8031eb81b1f291a038e549998e Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Wed, 5 Aug 2026 13:15:57 +0200
Subject: [PATCH 0323/1982] s390/dasd: Snapshot intrc before freeing the
 request block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dc3e3f7306cb74066f231251602b1be5aaec7bd8 ]

__dasd_cleanup_cqr() maps the completion result to a block status by
reading cqr->intrc, but only after discipline->free_cp() has returned the
request block to its memory pool (dasd_eckd_free_cp() ends in
dasd_sfree_request()). On SMP another CPU can reallocate that block and
overwrite cqr->intrc before it is read, completing the request with the
wrong error. proc_bytes is already snapshotted before free_cp() for the
same reason; do the same for intrc.

Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://patch.msgid.link/20260805111612.1285190-5-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/block/dasd.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index e7845c8ccc9ff7..f6e86692a21d76 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2736,17 +2736,23 @@ static void __dasd_cleanup_cqr(struct dasd_ccw_req *cqr)
 	struct request *req;
 	blk_status_t error = BLK_STS_OK;
 	unsigned int proc_bytes;
-	int status;
+	int status, intrc;
 
 	req = (struct request *) cqr->callback_data;
 	dasd_profile_end(cqr->block, cqr, req);
 
+	/*
+	 * free_cp() returns the request block to its memory pool, so snapshot
+	 * everything still needed from cqr before calling it - another CPU can
+	 * reallocate and overwrite the block right after.
+	 */
 	proc_bytes = cqr->proc_bytes;
+	intrc = cqr->intrc;
 	status = cqr->block->base->discipline->free_cp(cqr, req);
 	if (status < 0)
 		error = errno_to_blk_status(status);
 	else if (status == 0) {
-		switch (cqr->intrc) {
+		switch (intrc) {
 		case -EPERM:
 			/*
 			 * DASD doesn't implement SCSI/NVMe reservations, but it

From 795698c7f08f4aa2c77ffa57d4b156f9884aae71 Mon Sep 17 00:00:00 2001
From: Luca Castaldini <luca.castaldini96@gmail.com>
Date: Wed, 5 Aug 2026 14:29:07 +0200
Subject: [PATCH 0324/1982] ALSA: hda/realtek: Add mute LED support for HP
 Pavilion 15-eh2xxx

[ Upstream commit daf55a381dca9bda12cc8c3a47605698f2d560e9 ]

Add the subsystem ID 103c:8a0e to the ALC287 HP GPIO LED quirk
table so the mute LED follows the speaker mute state.

Tested on HP Pavilion Laptop 15-eh2xxx with ALC287 codec.
The mute LED now follows the speaker mute state.

Signed-off-by: Luca Castaldini <luca.castaldini96@gmail.com>
Link: https://patch.msgid.link/20260805122907.52302-1-luca.castaldini96@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 4cadbad99537a4..68d5e5aa7f62d0 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6881,6 +6881,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x89e7, "HP Elite x2 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8a05, "HP Dragonfly Folio G3 2-in-1", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8a06, "HP Dragonfly Folio G3 2-in-1", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8a0e, "HP Pavilion Laptop 15-eh2xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8a0f, "HP Pavilion 14-ec1xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8a1b, "HP 255 15.6 inch G9 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8a1f, "HP Laptop 14s-dr5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),

From f02d25d753df9dd39618177c7c0cfbcf97d24252 Mon Sep 17 00:00:00 2001
From: Marcos Paulo Medeiros <maarcospm1996@gmail.com>
Date: Mon, 27 Jul 2026 10:21:51 -0300
Subject: [PATCH 0325/1982] ACPI: video: force native backlight on Acer Nitro
 AN515-46

[ Upstream commit 525ba51157ac6e1772b5412eae26b20dd7ef8bda ]

The Acer Nitro AN515-46 is a hybrid graphics laptop whose internal
panel is driven by the AMD GPU (Radeon 680M); the discrete NVIDIA GPU
only drives external outputs. The firmware nevertheless advertises the
NVIDIA WMI EC backlight GUID, so the backlight type resolves to
nvidia_wmi_ec. The nvidia-wmi-ec-backlight driver however fails to
probe ("EC backlight control failed: AE_NOT_FOUND") and, since the
backlight type is still nvidia_wmi_ec, amdgpu skips registering its
own backlight device. The result is no backlight device at all,
leaving the brightness keys and the desktop brightness slider
non-functional.

Booting with acpi_backlight=native makes amdgpu register its backlight
interface and brightness control works. Add a DMI quirk to use the
native backlight on this model by default.

Signed-off-by: Marcos Paulo Medeiros <maarcospm1996@gmail.com>
Link: https://patch.msgid.link/20260727132151.12792-1-maarcospm1996@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/video_detect.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 2a562cb4250810..2b48b02f8a9537 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -917,6 +917,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
 		DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-n0xxx"),
 		},
 	},
+	{
+	 .callback = video_detect_force_native,
+	 /* Acer Nitro AN515-46 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "Nitro AN515-46"),
+		},
+	},
 
 	/*
 	 * x86 android tablets which directly control the backlight through

From eb5702c3a407cbb0956ff11940a52d0113b13ed7 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sat, 1 Aug 2026 14:53:32 +0000
Subject: [PATCH 0326/1982] wifi: mt76: mt7603: file buffered frames under the
 TID reported to mac80211

[ Upstream commit 0bbd6c52dfff62b319963f54cd9370f9486e59d2 ]

The PS queue filed redirected frames under the TID taken from the TXD,
while mac80211 was told about the TID taken from the QoS header, or TID 0
for anything that is not a QoS data frame. When the two disagree,
mt7603_release_buffered_frames() skips the frame because it does not
match the requested TIDs, so it stays in the PS queue until the station
wakes up. Buffered MMPDUs hit this whenever they were sent on a
non-zero TID.

Use one TID for both.

Link: https://patch.msgid.link/20260801145334.1166751-8-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7603/dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
index e26cc78fff9493..25009e49e77712 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
@@ -39,7 +39,6 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)
 
 	val = le32_to_cpu(txd[1]);
 	idx = FIELD_GET(MT_TXD1_WLAN_IDX, val);
-	skb->priority = FIELD_GET(MT_TXD1_TID, val);
 
 	if (idx >= MT7603_WTBL_STA - 1)
 		goto free;
@@ -72,6 +71,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)
 		hwq = MT_TX_HW_QUEUE_MGMT;
 	}
 
+	skb->priority = tid;
 	ieee80211_sta_set_buffered(sta, tid, true);
 
 	val = le32_to_cpu(txd[0]);

From 3b34ca885168c6be5a1bc4244c18c37f504a8ab3 Mon Sep 17 00:00:00 2001
From: Johan Alvarado <contact@c127.dev>
Date: Fri, 31 Jul 2026 14:45:22 -0500
Subject: [PATCH 0327/1982] net: stmmac: raise TX completion interrupt at the
 end of an xmit burst

[ Upstream commit d21a374995df9d7cfd193427748a19dcc87956a9 ]

The TX mitigation logic only sets the Interrupt on Completion bit once
every tx_coal_frames descriptors (STMMAC_TX_FRAMES = 25), with the
tx_coal_timer hrtimer (STMMAC_COAL_TX_TIMER = 5000 us) as the only
fallback. TX skbs are freed exclusively from the TX completion path,
so any flow that keeps fewer than 25 frames in flight has all of its
skbs held for up to 5 ms after transmission.

Paced flows never queue enough frames to reach the frame threshold:
TCP Small Queues caps the amount of unfreed data at roughly two pacing
intervals worth, which at moderate pacing rates is only a couple of
packets. Every small burst then stalls until the coalesce timer fires,
and throughput collapses to approximately tsq_limit / tx_coal_timer
regardless of link capacity.

This is easily reproducible with BBR, which paces its output and thus
keeps only a few frames in flight at a time. On a YT6801
(dwmac-motorcomm) equipped Orange Pi 5 Pro, a BBR upload over a ~23 ms
RTT path is capped at 5.24 Mbit/s, while CUBIC reaches 207 Mbit/s on
the same path. BBR measures the stalled send rate as the path
bandwidth and locks its estimate near the floor, so the connection
never recovers. Lowering the coalesce settings with ethtool -C
(tx-usecs 100 tx-frames 1) lifts the same transfer to 447 Mbit/s,
confirming the mechanism.

Fix this by setting the IC bit on the last descriptor of every xmit
burst, i.e. whenever netdev_xmit_more() reports that no further frames
are pending in the current dequeue batch. Frame-based coalescing still
applies within a burst, bulk traffic keeps batching through qdisc bulk
dequeue and NAPI polling, and the coalesce timer becomes a pure
fallback instead of the primary completion mechanism for lightly
queued flows.

tx-frames 0 keeps its meaning of timer-based mitigation only.

Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://patch.msgid.link/20260731194522.55069-1-contact@c127.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 63c045616c9b73..7dbb5e9bcb54bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4400,6 +4400,8 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 		set_ic = true;
 	else if (!priv->tx_coal_frames[queue])
 		set_ic = false;
+	else if (!netdev_xmit_more())
+		set_ic = true;
 	else if (tx_packets > priv->tx_coal_frames[queue])
 		set_ic = true;
 	else if ((tx_q->tx_count_frames %
@@ -4687,6 +4689,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 		set_ic = true;
 	else if (!priv->tx_coal_frames[queue])
 		set_ic = false;
+	else if (!netdev_xmit_more())
+		set_ic = true;
 	else if (tx_packets > priv->tx_coal_frames[queue])
 		set_ic = true;
 	else if ((tx_q->tx_count_frames %

From 24dd15e91fa6c66382e49baa7a9c2a064969496c Mon Sep 17 00:00:00 2001
From: Jinhui Guo <guojinhui.liam@bytedance.com>
Date: Thu, 30 Jul 2026 13:13:41 +0800
Subject: [PATCH 0328/1982] net: usb: cdc_ether: add quirk for AMI BMC stale
 link events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 089ca284afb0f3b2870a5ce41524cbc91ed350d4 ]

On AMD Genoa/Turin platforms the BMC-provided USB-Ethernet gadget
(American Megatrends, VID 0x046b PID 0xffb0) intermittently fails to
respond to ARP after AC cold boot.  usbmon captures a stale
NETWORK_CONNECTION(off) immediately followed by
NETWORK_CONNECTION(on) on the interrupt endpoint (~130us apart)
after enumeration.  Because alloc_netdev() leaves
__LINK_STATE_NOCARRIER cleared, netif_carrier_ok() returns true
when the spurious OFF arrives, so usbnet_cdc_status() cannot
recognise it as redundant and schedules EVENT_LINK_CHANGE.
__handle_link_change() then calls unlink_urbs(), killing ~60 rx
URBs whose payload has already been DMA'd into memory — xHCI trace
confirms them completing as -ECONNRESET with non-zero residual
length.  rx_complete() drops these unconditionally.  The following
ON restores the carrier and re-submits URBs, but the ARP reply is
already lost; the interface looks "up but silent" until ifdown/ifup.

Fix this by adding a device-specific quirk with FLAG_LINK_INTR set,
which makes usbnet_probe() call netif_carrier_off() after bind.
With initial carrier == OFF, usbnet_cdc_status() recognises the
spurious OFF as matching the current state and drops it; the
subsequent ON is the first real event and brings the link up
cleanly without ever tearing down the rx queue.  The scheduled
link-change kevent is harmless because EVENT_DEV_OPEN is not yet
set at probe time.

This is applied as a device-specific quirk rather than a change to
the shared cdc_info driver_info because some CDC devices never
send NETWORK_CONNECTION notifications; forcing carrier off for
them would leave the link permanently DOWN.  Restricting the change
to this VID/PID keeps that class of device untouched.

Tested on Genoa and Turin across 100+ AC cold boot cycles; ping
first-packet success rate went from intermittent to 100%.

Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Link: https://patch.msgid.link/20260730051341.24930-1-guojinhui.liam@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/cdc_ether.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index a032c1ded40634..05e625a461b494 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -532,6 +532,16 @@ static const struct driver_info	cdc_info = {
 	.manage_power =	usbnet_manage_power,
 };
 
+static const struct driver_info ami_bmc_info = {
+	.description =	"AMI BMC USB Ethernet",
+	.flags =	FLAG_ETHER | FLAG_POINTTOPOINT | FLAG_LINK_INTR,
+	.bind =		usbnet_cdc_bind,
+	.unbind =	usbnet_cdc_unbind,
+	.status =	usbnet_cdc_status,
+	.set_rx_mode =	usbnet_cdc_update_filter,
+	.manage_power =	usbnet_manage_power,
+};
+
 static const struct driver_info	zte_cdc_info = {
 	.description =	"ZTE CDC Ethernet Device",
 	.flags =	FLAG_ETHER | FLAG_POINTTOPOINT,
@@ -940,6 +950,12 @@ static const struct usb_device_id	products[] = {
 				      USB_CDC_SUBCLASS_ETHERNET,
 				      USB_CDC_PROTO_NONE),
 	.driver_info = (unsigned long)&wwan_info,
+}, {
+	/* AMI BMC gadget */
+	USB_DEVICE_AND_INTERFACE_INFO(0x046b, 0xffb0, USB_CLASS_COMM,
+				      USB_CDC_SUBCLASS_ETHERNET,
+				      USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long)&ami_bmc_info,
 }, {
 	USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
 			USB_CDC_PROTO_NONE),

From ee78a5c533afbe70d5a2160870742d7891a2ec86 Mon Sep 17 00:00:00 2001
From: Zihan Xi <zihanx@nebusec.ai>
Date: Fri, 31 Jul 2026 16:46:23 +0000
Subject: [PATCH 0329/1982] xsk: account ring allocations to memcg

[ Upstream commit b0057c68df711bf6a62033c072ac61c4f9d3cbc1 ]

AF_XDP rings are allocated from setsockopt() and can be mapped into user
space.  The shared xskq_create() helper allocates the ring backing memory,
but the user-controlled and long-lived allocation is not charged as kmem
to the allocating memory cgroup.

The current implementation uses vmalloc_user(), which allocates the
backing pages with GFP_KERNEL | __GFP_ZERO.  Use the same VM_USERMAP
vmalloc path, but pass GFP_KERNEL_ACCOUNT so the ring backing pages are
attributed to memcg/kmem and can be constrained by existing cgroup memory
limits.  This keeps the existing zeroing and mmap semantics while avoiding
AF_XDP-specific optmem or RLIMIT_MEMLOCK accounting.

Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260731164623.4694-2-zihanx@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk_queue.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/xdp/xsk_queue.c b/net/xdp/xsk_queue.c
index d2c2640300171a..7069830943ea85 100644
--- a/net/xdp/xsk_queue.c
+++ b/net/xdp/xsk_queue.c
@@ -9,6 +9,8 @@
 #include <linux/vmalloc.h>
 #include <net/xdp_sock_drv.h>
 
+#include <asm/shmparam.h>
+
 #include "xsk_queue.h"
 
 static size_t xskq_get_ring_size(struct xsk_queue *q, bool umem_queue)
@@ -21,6 +23,14 @@ static size_t xskq_get_ring_size(struct xsk_queue *q, bool umem_queue)
 	return struct_size(rxtx_ring, desc, q->nentries);
 }
 
+static void *xskq_vmalloc_user(unsigned long size)
+{
+	return __vmalloc_node_range(size, SHMLBA, VMALLOC_START, VMALLOC_END,
+				     GFP_KERNEL_ACCOUNT | __GFP_ZERO, PAGE_KERNEL,
+				     VM_USERMAP, NUMA_NO_NODE,
+				     __builtin_return_address(0));
+}
+
 struct xsk_queue *xskq_create(u32 nentries, bool umem_queue)
 {
 	struct xsk_queue *q;
@@ -46,7 +56,7 @@ struct xsk_queue *xskq_create(u32 nentries, bool umem_queue)
 
 	size = PAGE_ALIGN(size);
 
-	q->ring = vmalloc_user(size);
+	q->ring = xskq_vmalloc_user(size);
 	if (!q->ring) {
 		kfree(q);
 		return NULL;

From bc32b9880d1b7375f65cae6ab4818187121d3a81 Mon Sep 17 00:00:00 2001
From: Carl Quist <equalizerjr@gmail.com>
Date: Thu, 6 Aug 2026 11:47:18 +0200
Subject: [PATCH 0330/1982] ALSA: hda/realtek: Enable mute LED on HP Laptop
 15-dy0xxx

[ Upstream commit eb2b516900f2cff6c931a0d664a625ee93855779 ]

The mute LED on the HP Laptop 15-dy0xxx (PCI SSID 103c:864f, Realtek
ALC236) does not work, because the machine has no entry in the quirk
table. No fixup is applied, so no mute LED classdev is registered and
nothing ever drives the LED.

The LED is controlled by COEF index 0x07, bit 0. This was verified on
the hardware with hda-verb: setting the bit lights the mute LED and
clearing it turns the LED off.

  hda-verb /dev/snd/hwC0D0 0x20 SET_COEF_INDEX 0x07
  hda-verb /dev/snd/hwC0D0 0x20 SET_PROC_COEF 0x1     # LED on
  hda-verb /dev/snd/hwC0D0 0x20 SET_PROC_COEF 0x200   # LED off

That is exactly what ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 configures, and
the closely related HP Laptop 15-dw0xxx (103c:85f0) already uses it.
Bit 9 (0x200) is set by default on this board and is preserved by the
fixup's read-modify-write.

Tested on an HP Laptop 15-dy0xxx (SKU 7FU54UA#ABA, board 864F,
BIOS F.40).

Signed-off-by: Carl Quist <equalizerjr@gmail.com>
Link: https://lore.kernel.org/CAOtcGaxXndKxTK5MVSEcmF-LUy+V51K7fhE=qvLA+VvW5ZyCNA@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 68d5e5aa7f62d0..f2b0eb8501a781 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6772,6 +6772,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x860c, "HP ZBook 17 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+	SND_PCI_QUIRK(0x103c, 0x864f, "HP Laptop 15-dy0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x86c1, "HP Laptop 15-da3001TU", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),

From a5da12211b986eab4e88f02577a313ea53a8e5eb Mon Sep 17 00:00:00 2001
From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Date: Wed, 5 Aug 2026 12:45:18 -0300
Subject: [PATCH 0331/1982] ALSA: hda/realtek: Limit mic boost on Positivo
 N15RPE-S

[ Upstream commit 253010acfc8ad908446347b30a613032d1517bb5 ]

The internal mic boost on the Positivo N15RPE-S is too high.
Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine
to limit the gain.

Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Link: https://patch.msgid.link/20260805154518.19093-1-edson.drosdeck@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index f2b0eb8501a781..5098d3f375316c 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7646,6 +7646,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),
 	SND_PCI_QUIRK(0x2782, 0x4900, "MEDION E15443", ALC233_FIXUP_MEDION_MTL_SPK),
+	SND_PCI_QUIRK(0x2782, 0xa128, "Positivo N15RPE-S", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x2782, 0xa212, "Lunnen Ground 14", ALC269VC_FIXUP_LUNNEN_GROUND_14),
 	SND_PCI_QUIRK(0x7017, 0x2014, "Star Labs StarFighter", ALC233_FIXUP_STARLABS_STARFIGHTER),
 	SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),

From de8256a63ba2230c4dd33bb37a4945faebe12c1d Mon Sep 17 00:00:00 2001
From: Praveen Talari <praveen.talari@oss.qualcomm.com>
Date: Mon, 27 Jul 2026 22:33:12 +0530
Subject: [PATCH 0332/1982] opp: Use clk_get_optional() to avoid leaving
 opp_table->clk as an error pointer

[ Upstream commit 84f05af0975c9f9c8ffee0361d6f7cbb1f289231 ]

_update_opp_table_clk() uses clk_get(dev, NULL) to acquire the
device's clock. On platforms where the perf domain device has no
Linux clock and is instead managed entirely by firmware via
devm_pm_opp_of_add_table() (through
of_genpd_add_provider_simple()/onecell()), clk_get() returns
-ENOENT. That case is treated as valid (the OPP table can still
have entries sourced from firmware), but opp_table->clk is left
holding ERR_PTR(-ENOENT) rather than being reset to NULL:

	opp_table->clk = clk_get(dev, NULL);
	ret = PTR_ERR_OR_ZERO(opp_table->clk);
	...
	if (ret == -ENOENT) {
		opp_table->clk_count = 1;
		return opp_table;   /* opp_table->clk is still ERR_PTR(-ENOENT) */
	}

Consumers that only check IS_ERR(opp_table->clk) treat this as a
valid clk and pass it straight into the clk consumer API. In
particular, dev_pm_opp_set_rate() calls
clk_round_rate(opp_table->clk, target_freq), and clk_round_rate()
only guards against a NULL clk, so it dereferences the error pointer
to read clk->exclusive_count and crashes:

  Unable to handle kernel NULL pointer dereference at virtual
  address 000000000000002e
  ...
  pc : clk_round_rate+0x3c/0x188
  ...
  Call trace:
   clk_round_rate+0x3c/0x188 (P)
   dev_pm_opp_set_rate+0x114/0x33c

Rather than teaching every clk consumer API to special-case
ERR_PTR(-ENOENT), fix it at the source: use clk_get_optional()
instead of clk_get() in _update_opp_table_clk(), which already
translates -ENOENT into a NULL clk. This documents that the clock is
genuinely optional for such devices, and keeps opp_table->clk holding
either a valid clk or NULL, never a lingering -ENOENT error pointer.
_opp_config_clk_single() is only wired up via opp_table->config_clks
when a clk was actually found, and every other opp_table->clk
consumer already tolerates NULL through the standard clk API (which
treats a NULL clk as a no-op), so no other call site needs to change.

Suggested-by: Sebastian Reichel <sre@kernel.org>
Reviewed-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/core.c | 54 +++++++++++++++++++++-------------------------
 1 file changed, 24 insertions(+), 30 deletions(-)

diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index a179d57a5a1502..a41ad136e90e0f 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -1579,8 +1579,6 @@ static struct opp_table *_update_opp_table_clk(struct device *dev,
 					       struct opp_table *opp_table,
 					       bool getclk)
 {
-	int ret;
-
 	/*
 	 * Return early if we don't need to get clk or we have already done it
 	 * earlier.
@@ -1589,39 +1587,35 @@ static struct opp_table *_update_opp_table_clk(struct device *dev,
 	    opp_table->clks)
 		return opp_table;
 
-	/* Find clk for the device */
-	opp_table->clk = clk_get(dev, NULL);
+	/*
+	 * There are few platforms which don't want the OPP core to manage
+	 * device's clock settings. In such cases neither the platform
+	 * provides the clks explicitly to us, nor the DT contains a valid
+	 * clk entry. The OPP nodes in DT may still contain "opp-hz" property
+	 * though, which we need to parse and allow the platform to find an
+	 * OPP based on freq later on.
+	 *
+	 * This is a simple solution to take care of such corner cases, i.e.
+	 * make the clk_count 1, which lets us allocate space for frequency
+	 * in opp->rates and also parse the entries in DT. Use
+	 * clk_get_optional() instead of clk_get() so opp_table->clk stays
+	 * NULL for such devices, instead of holding an ERR_PTR(-ENOENT) that
+	 * consumers must remember to special-case.
+	 */
+	opp_table->clk = clk_get_optional(dev, NULL);
 
-	ret = PTR_ERR_OR_ZERO(opp_table->clk);
-	if (!ret) {
-		opp_table->config_clks = _opp_config_clk_single;
-		opp_table->clk_count = 1;
-		return opp_table;
+	if (IS_ERR(opp_table->clk)) {
+		dev_pm_opp_put_opp_table(opp_table);
+		dev_err_probe(dev, PTR_ERR(opp_table->clk), "Couldn't find clock\n");
+		return ERR_CAST(opp_table->clk);
 	}
 
-	if (ret == -ENOENT) {
-		/*
-		 * There are few platforms which don't want the OPP core to
-		 * manage device's clock settings. In such cases neither the
-		 * platform provides the clks explicitly to us, nor the DT
-		 * contains a valid clk entry. The OPP nodes in DT may still
-		 * contain "opp-hz" property though, which we need to parse and
-		 * allow the platform to find an OPP based on freq later on.
-		 *
-		 * This is a simple solution to take care of such corner cases,
-		 * i.e. make the clk_count 1, which lets us allocate space for
-		 * frequency in opp->rates and also parse the entries in DT.
-		 */
-		opp_table->clk_count = 1;
-
-		dev_dbg(dev, "%s: Couldn't find clock: %d\n", __func__, ret);
-		return opp_table;
-	}
+	if (opp_table->clk)
+		opp_table->config_clks = _opp_config_clk_single;
 
-	dev_pm_opp_put_opp_table(opp_table);
-	dev_err_probe(dev, ret, "Couldn't find clock\n");
+	opp_table->clk_count = 1;
 
-	return ERR_PTR(ret);
+	return opp_table;
 }
 
 /*

From 31b92853b9b306715700acffc7d79082cd985214 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Mon, 20 Jul 2026 10:57:41 +0100
Subject: [PATCH 0333/1982] soundwire: dmi-quirks: Disable ghost Realtek on
 Asus Zenbook Duo

[ Upstream commit ca02ffd4975ca5249abf0cfb750a495d23b453ee ]

The Asus Zenbook Duo also has a Realtek device in the ACPI that
doesn't exist in the physical hardware. This confuses the machine
driver into attempting to create DAI links for the device. Add a
quirk to remove this device.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20260720095741.3592825-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/dmi-quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index 62cee6e2179daf..f738e547a1f30a 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -200,6 +200,13 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
 		},
 		.driver_data = (void *)ghost_realtek,
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
+			DMI_MATCH(DMI_BOARD_NAME, "UX8407AA"),
+		},
+		.driver_data = (void *)ghost_realtek,
+	},
 	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),

From dab4eb4a21353ed64c7e9fae638e5a25f3e3f0c2 Mon Sep 17 00:00:00 2001
From: Stefan Hansson <newbyte@postmarketos.org>
Date: Tue, 4 Aug 2026 10:55:41 +0200
Subject: [PATCH 0334/1982] wifi: rsi: Fix types to appease CFI

[ Upstream commit da308f6e471252ae5e8009dcea16bc5e9c9dc5dd ]

Avoids errors like:

    CFI failure at kthread+0x124/0x1cc (target: rsi_coex_scheduler_thread+0x0/0x1b4 [redpine_91x]; expected type: 0x89fb613d)

As seen in the aforementioned error this was tested using the downstream
redpine_91x driver found in the Librem 5's downstream source tree.
However, it appears that this driver is a modified version of the rsi
driver found in mainline Linux and as such I decided to port the changes
here too.

Signed-off-by: Stefan Hansson <newbyte@postmarketos.org>
Link: https://patch.msgid.link/20260804-rsi-cfi-fix-v2-1-59679a520240@postmarketos.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_coex.c     | 3 ++-
 drivers/net/wireless/rsi/rsi_91x_main.c     | 7 ++++---
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 3 ++-
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c  | 7 ++++---
 drivers/net/wireless/rsi/rsi_common.h       | 2 +-
 drivers/net/wireless/rsi/rsi_sdio.h         | 2 +-
 drivers/net/wireless/rsi/rsi_usb.h          | 2 +-
 7 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c
index 372eaaa2b9efc3..05525d5e2edb15 100644
--- a/drivers/net/wireless/rsi/rsi_91x_coex.c
+++ b/drivers/net/wireless/rsi/rsi_91x_coex.c
@@ -50,8 +50,9 @@ static void rsi_coex_sched_tx_pkts(struct rsi_coex_ctrl_block *coex_cb)
 	} while (coex_q != RSI_COEX_Q_INVALID);
 }
 
-static void rsi_coex_scheduler_thread(struct rsi_common *common)
+static int rsi_coex_scheduler_thread(void *data)
 {
+	struct rsi_common *common = data;
 	struct rsi_coex_ctrl_block *coex_cb = common->coex_cb;
 	u32 timeout = EVENT_WAIT_FOREVER;
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index 2112d8d277a996..0b4d6915800546 100644
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -246,12 +246,13 @@ EXPORT_SYMBOL_GPL(rsi_read_pkt);
 /**
  * rsi_tx_scheduler_thread() - This function is a kernel thread to send the
  *			       packets to the device.
- * @common: Pointer to the driver private structure.
+ * @data: Pointer to the driver private structure.
  *
- * Return: None.
+ * Return: 0.
  */
-static void rsi_tx_scheduler_thread(struct rsi_common *common)
+static int rsi_tx_scheduler_thread(void *data)
 {
+	struct rsi_common *common = data;
 	struct rsi_hw *adapter = common->priv;
 	u32 timeout = EVENT_WAIT_FOREVER;
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 597b238e229499..18a28aa9744609 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -62,8 +62,9 @@ int rsi_sdio_master_access_msword(struct rsi_hw *adapter, u16 ms_word)
 
 static void rsi_rx_handler(struct rsi_hw *adapter);
 
-void rsi_sdio_rx_thread(struct rsi_common *common)
+int rsi_sdio_rx_thread(void *data)
 {
+	struct rsi_common *common = data;
 	struct rsi_hw *adapter = common->priv;
 	struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
index 25c2b232394a6b..e899631b9aed22 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
@@ -21,12 +21,13 @@
 /**
  * rsi_usb_rx_thread() - This is a kernel thread to receive the packets from
  *			 the USB device.
- * @common: Pointer to the driver private structure.
+ * @data: Pointer to the driver private structure.
  *
- * Return: None.
+ * Return: 0.
  */
-void rsi_usb_rx_thread(struct rsi_common *common)
+int rsi_usb_rx_thread(void *data)
 {
+	struct rsi_common *common = data;
 	struct rsi_hw *adapter = common->priv;
 	struct rsi_91x_usbdev *dev = adapter->rsi_dev;
 	int status;
diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
index c40f8101febcb8..4f6738ba72be25 100644
--- a/drivers/net/wireless/rsi/rsi_common.h
+++ b/drivers/net/wireless/rsi/rsi_common.h
@@ -58,7 +58,7 @@ static inline void rsi_reset_event(struct rsi_event *event)
 
 static inline int rsi_create_kthread(struct rsi_common *common,
 				     struct rsi_thread *thread,
-				     void *func_ptr,
+				     int (*func_ptr)(void *data),
 				     u8 *name)
 {
 	init_completion(&thread->completion);
diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h
index 7c91b126b350f1..eb2b7f36a7e4c6 100644
--- a/drivers/net/wireless/rsi/rsi_sdio.h
+++ b/drivers/net/wireless/rsi/rsi_sdio.h
@@ -134,5 +134,5 @@ int rsi_sdio_master_access_msword(struct rsi_hw *adapter, u16 ms_word);
 void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
 int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
 int rsi_sdio_check_buffer_status(struct rsi_hw *adapter, u8 q_num);
-void rsi_sdio_rx_thread(struct rsi_common *common);
+int rsi_sdio_rx_thread(void *data);
 #endif
diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h
index 961851748bc4c0..78067eaffe8b18 100644
--- a/drivers/net/wireless/rsi/rsi_usb.h
+++ b/drivers/net/wireless/rsi/rsi_usb.h
@@ -81,5 +81,5 @@ static inline int rsi_usb_event_timeout(struct rsi_hw *adapter)
 	return EVENT_WAIT_FOREVER;
 }
 
-void rsi_usb_rx_thread(struct rsi_common *common);
+int rsi_usb_rx_thread(void *data);
 #endif

From b6d0b00a296366319cb8d447b630f395a9189f92 Mon Sep 17 00:00:00 2001
From: liulhong617 <liulhong617@gmail.com>
Date: Wed, 13 May 2026 09:02:55 +0800
Subject: [PATCH 0335/1982] arm64: mm: fix accidental linear mapping of no-map
 reserved memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7ace06a01efaba1ec585630aa4c98ac39b38452a ]

When reserved-memory regions with the "no-map" property are not
page-aligned, the kernel may accidentally map them into the linear
mapping, contradicting the no-map semantics.

The root cause is a mismatch between /proc/iomem's address boundaries
and the actual page table mapping boundaries:

1. /proc/iomem derives its ranges from memblock via
   memblock_region_reserved_base_pfn/memblock_region_reserved_end_pfn,
   which perform PFN rounding so the displayed boundaries are
   page-aligned. This gives the impression that the no-map region
   occupies whole pages.

2. However, memblock_mark_nomap() splits memblock.memory regions at
   exact byte boundaries (memblock_isolate_range preserves raw DT
   base/size with no alignment). When for_each_mem_range iterates the
   non-NOMAP regions adjacent to a no-map region, it returns start/end
   values that are NOT page-aligned — they are the precise byte
   boundaries from the memblock split.

3. These sub-page-aligned values are passed to
   __create_pgd_mapping_locked(), which does:
     phys &= PAGE_MASK;
     addr = virt & PAGE_MASK;
     end = PAGE_ALIGN(virt + size);
   The downward rounding of phys via PAGE_MASK extends the mapped
   range backward into the adjacent no-map region, effectively
   including no-map memory in the linear mapping.

For example, with 64K pages, reserved_region@A2000000 (base=0xA2000000,
size=0x8000, no-map) causes for_each_mem_range to return
start=0xA2008000 for the next mappable region. After phys &= PAGE_MASK,
the actual mapping starts at 0xA2000000 — the entire no-map region is
incorrectly mapped.

Fix this by rounding the mappable range inward to PAGE_SIZE boundaries
before passing it to __map_memblock: start is rounded UP and end is
rounded DOWN. This ensures the mapped area never overlaps with adjacent
no-map regions. The cost is at most one page of unmapped gap at each
boundary, which is preferable to violating no-map semantics.

Signed-off-by: liulhong617 <liulhong617@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/mm/mmu.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 71841b5c319283..7c3f560df6529c 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1179,6 +1179,20 @@ static void __init map_mem(pgd_t *pgdp)
 	for_each_mem_range(i, &start, &end) {
 		if (start >= end)
 			break;
+		/*
+		 * for_each_mem_range may return sub-page-aligned boundaries
+		 * after memblock_mark_nomap() splits regions at byte precision.
+		 * __create_pgd_mapping_locked aligns phys down to PAGE_MASK,
+		 * which could accidentally map no-map memory on the boundary.
+		 * Round the mappable range inward: start UP, end DOWN, so
+		 * that the mapped area never overlaps with adjacent no-map
+		 * regions. The cost is at most one page of unmapped gap at
+		 * each boundary.
+		 */
+		start = PAGE_ALIGN(start);
+		end = end & PAGE_MASK;
+		if (start >= end)
+			continue;
 		/*
 		 * The linear map must allow allocation tags reading/writing
 		 * if MTE is present. Otherwise, it has the same attributes as

From db1e5bd4ee8efe8d8f294576d20e13b9d435a6f7 Mon Sep 17 00:00:00 2001
From: Yang Wang <kevinyang.wang@amd.com>
Date: Thu, 30 Jul 2026 09:50:40 +0800
Subject: [PATCH 0336/1982] drm/amd/pm: derive stable PPT limits from PPTable

[ Upstream commit 25f4a46b0c8acd77c9065b50a1fe48af27d91fdf ]

GetPptLimit reports mutable PMFW runtime state. Using that value for
static capabilities causes two externally visible problems:

- A userspace override changes the default reported through hwmon.
- A firmware reset changes the advertised minimum or maximum range.

Derive platform defaults and supported ranges from the driver PPTable
for Sienna Cichlid, Navi10, Arcturus, and Aldebaran. Reserve PMFW queries
for the effective current limit.

Runtime policy can no longer redefine immutable platform capabilities.

Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 25 ++++++++-------
 .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c   | 32 +++++++++++--------
 .../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c   | 28 +++++++++-------
 .../drm/amd/pm/swsmu/smu13/aldebaran_ppt.c    |  8 +++--
 4 files changed, 53 insertions(+), 40 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
index 4fff78da81ff87..2b2d3c3aa20bae 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -1329,24 +1329,25 @@ static int arcturus_get_power_limit(struct smu_context *smu,
 					uint32_t *min_power_limit)
 {
 	PPTable_t *pptable = smu->smu_table.driver_pptable;
-	uint32_t power_limit;
+	uint32_t current_limit, default_limit;
 
-	if (smu_v11_0_get_current_power_limit(smu, &power_limit)) {
-		/* the last hope to figure out the ppt limit */
-		if (!pptable) {
-			dev_err(smu->adev->dev, "Cannot get PPT limit due to pptable missing!");
-			return -EINVAL;
-		}
-		power_limit =
-			pptable->SocketPowerLimitAc[PPT_THROTTLER_PPT0];
+	if (!pptable) {
+		dev_err(smu->adev->dev,
+			"Cannot get PPT limit due to pptable missing!");
+		return -EINVAL;
 	}
 
+	default_limit = pptable->SocketPowerLimitAc[PPT_THROTTLER_PPT0];
+
+	if (smu_v11_0_get_current_power_limit(smu, &current_limit))
+		current_limit = default_limit;
+
 	if (current_power_limit)
-		*current_power_limit = power_limit;
+		*current_power_limit = current_limit;
 	if (default_power_limit)
-		*default_power_limit = power_limit;
+		*default_power_limit = default_limit;
 	if (max_power_limit)
-		*max_power_limit = power_limit;
+		*max_power_limit = default_limit;
 	/*
 	 * No lower bound is imposed on the limit. Any unreasonable limit set
 	 * will result in frequent throttling.
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
index a2fcf678182b4e..4737ceb2a54342 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
@@ -2393,22 +2393,26 @@ static int navi10_get_power_limit(struct smu_context *smu,
 		(struct smu_11_0_powerplay_table *)smu->smu_table.power_play_table;
 	struct smu_11_0_overdrive_table *od_settings = smu->od_settings;
 	PPTable_t *pptable = smu->smu_table.driver_pptable;
-	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
+	uint32_t current_limit, default_limit;
+	uint32_t od_percent_upper = 0, od_percent_lower = 0;
 
-	if (smu_v11_0_get_current_power_limit(smu, &power_limit)) {
-		/* the last hope to figure out the ppt limit */
-		if (!pptable) {
-			dev_err(smu->adev->dev, "Cannot get PPT limit due to pptable missing!");
-			return -EINVAL;
-		}
-		power_limit =
-			pptable->SocketPowerLimitAc[PPT_THROTTLER_PPT0];
+	if (!pptable) {
+		dev_err(smu->adev->dev,
+			"Cannot get PPT limit due to pptable missing!");
+		return -EINVAL;
 	}
 
+	default_limit = smu->adev->pm.ac_power ?
+		pptable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
+		pptable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
+
+	if (smu_v11_0_get_current_power_limit(smu, &current_limit))
+		current_limit = default_limit;
+
 	if (current_power_limit)
-		*current_power_limit = power_limit;
+		*current_power_limit = current_limit;
 	if (default_power_limit)
-		*default_power_limit = power_limit;
+		*default_power_limit = default_limit;
 
 	if (powerplay_table) {
 		if (smu->od_enabled &&
@@ -2422,15 +2426,15 @@ static int navi10_get_power_limit(struct smu_context *smu,
 	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
-					od_percent_upper, od_percent_lower, power_limit);
+		 od_percent_upper, od_percent_lower, default_limit);
 
 	if (max_power_limit) {
-		*max_power_limit = power_limit * (100 + od_percent_upper);
+		*max_power_limit = default_limit * (100 + od_percent_upper);
 		*max_power_limit /= 100;
 	}
 
 	if (min_power_limit) {
-		*min_power_limit = power_limit * (100 - od_percent_lower);
+		*min_power_limit = default_limit * (100 - od_percent_lower);
 		*min_power_limit /= 100;
 	}
 
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 31c2c0386b1f9d..d553c6fbab47cb 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -632,20 +632,24 @@ static int sienna_cichlid_get_power_limit(struct smu_context *smu,
 	struct smu_11_0_7_powerplay_table *powerplay_table =
 		(struct smu_11_0_7_powerplay_table *)smu->smu_table.power_play_table;
 	struct smu_11_0_7_overdrive_table *od_settings = smu->od_settings;
-	uint32_t power_limit, od_percent_upper = 0, od_percent_lower = 0;
-	uint16_t *table_member;
+	uint32_t current_limit, default_limit;
+	uint32_t od_percent_upper = 0, od_percent_lower = 0;
+	u16 *power_limit_ac, *power_limit_dc;
 
-	GET_PPTABLE_MEMBER(SocketPowerLimitAc, &table_member);
+	GET_PPTABLE_MEMBER(SocketPowerLimitAc, &power_limit_ac);
+	GET_PPTABLE_MEMBER(SocketPowerLimitDc, &power_limit_dc);
 
-	if (smu_v11_0_get_current_power_limit(smu, &power_limit)) {
-		power_limit =
-			table_member[PPT_THROTTLER_PPT0];
-	}
+	default_limit = smu->adev->pm.ac_power ?
+		power_limit_ac[PPT_THROTTLER_PPT0] :
+		power_limit_dc[PPT_THROTTLER_PPT0];
+
+	if (smu_v11_0_get_current_power_limit(smu, &current_limit))
+		current_limit = default_limit;
 
 	if (current_power_limit)
-		*current_power_limit = power_limit;
+		*current_power_limit = current_limit;
 	if (default_power_limit)
-		*default_power_limit = power_limit;
+		*default_power_limit = default_limit;
 
 	if (powerplay_table) {
 		if (smu->od_enabled &&
@@ -659,15 +663,15 @@ static int sienna_cichlid_get_power_limit(struct smu_context *smu,
 	}
 
 	dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
-					od_percent_upper, od_percent_lower, power_limit);
+		 od_percent_upper, od_percent_lower, default_limit);
 
 	if (max_power_limit) {
-		*max_power_limit = power_limit * (100 + od_percent_upper);
+		*max_power_limit = default_limit * (100 + od_percent_upper);
 		*max_power_limit /= 100;
 	}
 
 	if (min_power_limit) {
-		*min_power_limit = power_limit * (100 - od_percent_lower);
+		*min_power_limit = default_limit * (100 - od_percent_lower);
 		*min_power_limit /= 100;
 	}
 	return 0;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
index 18d5d07045098f..9e67e57d70b75c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1281,8 +1281,12 @@ static int aldebaran_get_power_limit(struct smu_context *smu,
 
 	if (current_power_limit)
 		*current_power_limit = power_limit;
-	if (default_power_limit)
-		*default_power_limit = power_limit;
+	if (default_power_limit) {
+		if (pptable)
+			*default_power_limit = pptable->PptLimit;
+		else
+			*default_power_limit = power_limit;
+	}
 
 	if (max_power_limit) {
 		if (pptable)

From 28332e8aae84ac2717f0fece9ccd3e608c0e5b64 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Tue, 30 Jun 2026 14:52:45 +0800
Subject: [PATCH 0337/1982] HID: rmi: check report length before trimming
 sentinel bytes

[ Upstream commit 28a3e326fad2451bdb66b747dd1f7ccbb900eed6 ]

rmi_check_sanity() trims trailing 0xff sentinel bytes, but its loop
reads data[valid_size - 1] before checking that valid_size is non-zero.

Reverse the condition so the length is proved before the last byte is
inspected.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-rmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index d55a0388895fb1..ecc19387f6b056 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -386,7 +386,7 @@ static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
 	 * such reports here.
 	 */
 
-	while ((data[valid_size - 1] == 0xff) && valid_size > 0)
+	while (valid_size > 0 && data[valid_size - 1] == 0xff)
 		valid_size--;
 
 	return valid_size;

From bb8625b38c5c1925df1db3b297c8c52481d1c23d Mon Sep 17 00:00:00 2001
From: Junzhe Yu <junzheyu1@gmail.com>
Date: Tue, 4 Aug 2026 12:55:33 +0800
Subject: [PATCH 0338/1982] ext4: guard against NULL s_group_info in
 ext4_get_group_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8f3901fbb40745046e513226ad84e8b84492632d ]

Resend: previous attempt was rejected by vger for containing HTML.

==================================================================

ext4_mark_group_bitmap_corrupted() already treats a NULL return from
ext4_get_group_info() as "nothing to do", but ext4_get_group_info()
indexes s_group_info without checking whether the array exists.

During mount, fast-commit replay runs inside jbd2_journal_load() from
ext4_load_and_init_journal(), which is before ext4_mb_init() allocates
s_group_info. Replaying an FC UNLINK for an inode whose bitmap bit is
already clear takes:

   ext4_fc_replay_unlink -> iput -> ext4_evict_inode -> ext4_free_inode
     -> ext4_mark_group_bitmap_corrupted -> ext4_get_group_info

and faults on the NULL s_group_info base. Userspace only mounts a dirty
ext4 image; this is a supported recovery path.

Return NULL when s_group_info (or the per-block grp_info row) is unset
so the existing caller check is effective during early mount.

Tested on Linux v6.6.145 KASAN: crafted FC-unlink image previously
triggered KASAN null-ptr-deref / panic in ext4_get_group_info; with this
patch, mount succeeds (EXT4 "bit already cleared" may still log). Also
observed on v6.6.144; still present on torvalds/linux as of
f5098b6bae76 (2026-07-26).

A self-contained Docker/QEMU reproducer (craft + mount + patch verify) is
available on request.

Signed-off-by: Yu Junzhe <junzheyu1@gmail.com>
Link: https://patch.msgid.link/65c955b0-716b-4599-b925-59c2782e38b4@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/balloc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index c9329ed5c094e2..08556dd45760d1 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -331,9 +331,13 @@ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
 
 	if (unlikely(group >= EXT4_SB(sb)->s_groups_count))
 		return NULL;
+	if (unlikely(!EXT4_SB(sb)->s_group_info))
+		return NULL;
 	indexv = group >> (EXT4_DESC_PER_BLOCK_BITS(sb));
 	indexh = group & ((EXT4_DESC_PER_BLOCK(sb)) - 1);
 	grp_info = sbi_array_rcu_deref(EXT4_SB(sb), s_group_info, indexv);
+	if (unlikely(!grp_info))
+		return NULL;
 	return grp_info[indexh];
 }
 

From 2f7ad98de370d702e3b48aaae434596369a364f6 Mon Sep 17 00:00:00 2001
From: Shang En Sim <sim@shangen.org>
Date: Thu, 6 Aug 2026 22:51:27 -0700
Subject: [PATCH 0339/1982] ALSA: hda/realtek: Enable mute LEDs on HP Spectre
 x360 16-aa0xxx

[ Upstream commit bfcdc1c0eaeae5525c726193568e8d638b2afdc0 ]

The HP Spectre x360 2-in-1 Laptop 16-aa0xxx with PCI subsystem ID
0x103c:0x8c17 only gets the CS35L41 amplifier setup from
ALC287_FIXUP_CS35L41_I2C_2, so the speaker-mute and mic-mute keyboard
LEDs do not work.

Use ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX like subsystem ID 0x8c16 so
the mute LEDs work.

Tested on HP Spectre x360 2-in-1 Laptop 16-aa0xxx.

Signed-off-by: Shang En Sim <sim@shangen.org>
Link: https://patch.msgid.link/20260807055139.58707-1-sim@shangen.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 5098d3f375316c..97ab2269dc472c 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6969,7 +6969,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c15, "HP Spectre x360 2-in-1 Laptop 14-eu0xxx", ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX),
 	SND_PCI_QUIRK(0x103c, 0x8c16, "HP Spectre x360 2-in-1 Laptop 16-aa0xxx", ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX),
-	SND_PCI_QUIRK(0x103c, 0x8c17, "HP Spectre 16", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x103c, 0x8c17, "HP Spectre x360 2-in-1 Laptop 16-aa0xxx", ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX),
 	SND_PCI_QUIRK(0x103c, 0x8c21, "HP Pavilion Plus Laptop 14-ey0XXX", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x8c2d, "HP Victus 15-fa1xxx (MB 8C2D)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c30, "HP Victus 15-fb1xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),

From ae07a0c3554473cc9f58d15c7157539129632ab2 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai@fygo.io>
Date: Mon, 3 Aug 2026 03:50:13 +0800
Subject: [PATCH 0340/1982] md/raid5: reject zero-sector reshape chunks

[ Upstream commit a41bb2ee1aca486853e84920565e50c15f86fa5d ]

Sashiko reported that RAID5 can accept a reshape chunk size that becomes
zero sectors. chunk_size_store() stores the sysfs byte value as n >> 9, so
writing a value below 512 bytes sets mddev->new_chunk_sectors to zero.
RAID5 then accepted that pending reshape geometry and raid5_start_reshape()
installed it into conf->chunk_sectors, letting reshape code divide by zero.

Reject zero-sector chunks both in check_reshape(), where normal sysfs
requests are validated, and in raid5_start_reshape(), so assembly/resume
paths also cannot install zero chunk geometry.

Test script: in QEMU, create a plain three-disk RAID5 array with 64K
chunks, write/read back a small pattern, write 1 to
/sys/block/md0/md/chunk_size, add a fourth disk, and run mdadm --grow
--raid-devices=4 --backup-file=... . The script scans dmesg for divide
error/Oops/KASAN signatures.

Bad kernel, eb29914412c3:

  echo 1 > /sys/block/md0/md/chunk_size
  mdadm --grow /dev/md0 --raid-devices=4 --backup-file=/root/md0-grow.bak

  Oops: divide error: 0000 [#1] SMP KASAN NOPTI
  RIP: raid5_get_active_stripe+0x863/0xc10
  Call Trace:
   raid5_sync_request
   md_do_sync
   md_thread
  Kernel panic - not syncing: Fatal exception

Fixed kernel: echo 1 > /sys/block/md0/md/chunk_size bash: echo: write
error: Invalid argument chunk_write_rc=1 grow_rc=skipped RESULT:
REJECTED_ZERO_CHUNK_NO_OOPS

Tested-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://patch.msgid.link/20260802195038.164272-5-yukuai@kernel.org
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid5.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b7da2b83e19384..56d7e05e94ce6f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -8437,6 +8437,8 @@ static int check_reshape(struct mddev *mddev)
 		return 0; /* nothing to do */
 	if (has_failed(conf))
 		return -EINVAL;
+	if (!mddev->new_chunk_sectors)
+		return -EINVAL;
 	if (mddev->delta_disks < 0 && mddev->reshape_position == MaxSector) {
 		/* We might be able to shrink, but the devices must
 		 * be made bigger first.
@@ -8480,6 +8482,9 @@ static int raid5_start_reshape(struct mddev *mddev)
 	if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
 		return -EBUSY;
 
+	if (!mddev->new_chunk_sectors)
+		return -EINVAL;
+
 	if (!check_stripe_cache(mddev))
 		return -ENOSPC;
 

From 2c2a8cf8dd4b219f1974bca4149c3a0cbea126a8 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai@fygo.io>
Date: Mon, 3 Aug 2026 03:50:19 +0800
Subject: [PATCH 0341/1982] md: skip bitmap accounting for empty write ranges

[ Upstream commit 87c10252e3d6c28769d93bea9e6a9b592e5809d1 ]

mkfs.ext4 can submit zero-sector flush/FUA bios. These bios are WRITE
bios for md_write_start() purposes, but they do not cover any data sector
and must not dirty bitmap bits.

md bitmap accounting currently passes such bios to bitmap start_write().
For llbitmap this reaches llbitmap_start_write() with sectors == 0,
which underflows the end chunk calculation.

Personality bitmap mapping can also turn a non-empty bio into an empty
bitmap range when the requested sectors are outside the active bitmap
geometry. Treat both cases as not started, so the completion path will not
call end_write() for an empty range.

Tested-by: Mykola Marzhan <mykola@meshstor.io>
Link: https://patch.msgid.link/20260802195038.164272-11-yukuai@kernel.org
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 03d328506b285b..ce3bd127e3bb32 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9266,6 +9266,8 @@ static void md_bitmap_start(struct mddev *mddev,
 		mddev->pers->bitmap_sector(mddev, &md_io_clone->offset,
 					   &md_io_clone->sectors);
 
+	if (!md_io_clone->sectors)
+		return;
 	fn(mddev, md_io_clone->offset, md_io_clone->sectors);
 }
 
@@ -9284,7 +9286,8 @@ static void md_end_clone_io(struct bio *bio)
 	struct bio *orig_bio = md_io_clone->orig_bio;
 	struct mddev *mddev = md_io_clone->mddev;
 
-	if (bio_data_dir(orig_bio) == WRITE && md_bitmap_enabled(mddev, false))
+	if (bio_data_dir(orig_bio) == WRITE && md_io_clone->sectors &&
+	    md_bitmap_enabled(mddev, false))
 		md_bitmap_end(mddev, md_io_clone);
 
 	if (bio->bi_status && !orig_bio->bi_status)
@@ -9308,12 +9311,14 @@ static void md_clone_bio(struct mddev *mddev, struct bio **bio)
 	md_io_clone = container_of(clone, struct md_io_clone, bio_clone);
 	md_io_clone->orig_bio = *bio;
 	md_io_clone->mddev = mddev;
+	md_io_clone->sectors = 0;
 	if (blk_queue_io_stat(bdev->bd_disk->queue))
 		md_io_clone->start_time = bio_start_io_acct(*bio);
 	else
 		md_io_clone->start_time = 0;
 
-	if (bio_data_dir(*bio) == WRITE && md_bitmap_enabled(mddev, false)) {
+	if (bio_data_dir(*bio) == WRITE && bio_sectors(*bio) &&
+	    md_bitmap_enabled(mddev, false)) {
 		md_io_clone->offset = (*bio)->bi_iter.bi_sector;
 		md_io_clone->sectors = bio_sectors(*bio);
 		md_io_clone->rw = op_stat_group(bio_op(*bio));

From 7419a8dfa09f0b7af0f4c6e7497e4ed85860d106 Mon Sep 17 00:00:00 2001
From: Yunye Zhao <yunye.zhao@linux.alibaba.com>
Date: Thu, 23 Jul 2026 21:55:34 +0800
Subject: [PATCH 0342/1982] md: add cond_resched() to md_do_sync()'s skip path

[ Upstream commit 162eb5ba791f6260fdaabae75fa2df20134f67d8 ]

When sync_request() reports a skipped region (*skipped == 1),
md_do_sync()'s main loop advances the cursor and takes an early
continue:

	j += sectors;
	...
	if (last_check + window > io_sectors || j == max_sectors)
		continue;

If the personality returns a small span per call (raid10 recovery
returns only 128 sectors), syncing a large, mostly clean array iterates
this branch an enormous number of times without ever yielding the CPU.
On a non-preemptive kernel the resync thread then trips the soft-lockup
watchdog:

  watchdog: BUG: soft lockup - CPU#149 stuck for 313s! [mdX_resync]
   md_bitmap_start_sync+0x6f/0xe0
   raid10_sync_request+0x2c9/0x1530 [raid10]
   md_do_sync+0x810/0x1030
   md_thread+0xa7/0x150

Add a cond_resched().  This does not reduce the wasted iterations; the
excessive iteration count is a raid10 problem addressed separately.

Signed-off-by: Yunye Zhao <yunye.zhao@linux.alibaba.com>
Link: https://patch.msgid.link/20260723135535.101995-3-yunye.zhao@linux.alibaba.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index ce3bd127e3bb32..44f44219ed7fe7 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9751,8 +9751,10 @@ void md_do_sync(struct md_thread *thread)
 			 */
 			md_new_event();
 
-		if (last_check + window > io_sectors || j == max_sectors)
+		if (last_check + window > io_sectors || j == max_sectors) {
+			cond_resched();
 			continue;
+		}
 
 		last_check = io_sectors;
 	repeat:

From 7f8a0b02651399002cddb96fef698ebb52442a2d Mon Sep 17 00:00:00 2001
From: Andreas Haufler <andreas@haufler.info>
Date: Tue, 21 Jul 2026 10:32:13 +0200
Subject: [PATCH 0343/1982] tools/lib/thermal: Fix misplaced extern "C" closing
 brace

[ Upstream commit cb0ec27efac2aaf92393ad563a35fb6f00d0a6cd ]

The public libthermal header opens the C++ 'extern "C" {' block inside
the __LIBTHERMAL_H include guard, but places the closing brace after
the guard has already ended:

	#endif /* __LIBTHERMAL_H */

	#ifdef __cplusplus
	}
	#endif

On a single inclusion the braces still balance, so the problem is
invisible. On the second inclusion of the header in the same C++
translation unit the include guard skips the opening 'extern "C" {',
while the closing '}' lives outside the guard and is emitted anyway.
This leaves a stray '}' and breaks compilation for any C++ consumer
that includes the header more than once.

Move the closing block inside the include guard so both halves of the
'extern "C"' declaration are guarded consistently.

Signed-off-by: Andreas Haufler <andreas@haufler.info>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260721083230.91246-1-andreas@haufler.info
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/thermal/include/thermal.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/lib/thermal/include/thermal.h b/tools/lib/thermal/include/thermal.h
index 818ecdfb46e509..d9097271d9fad8 100644
--- a/tools/lib/thermal/include/thermal.h
+++ b/tools/lib/thermal/include/thermal.h
@@ -175,8 +175,8 @@ LIBTHERMAL_API thermal_error_t thermal_sampling_handle(struct thermal_handler *t
 
 LIBTHERMAL_API int thermal_sampling_fd(struct thermal_handler *th);
 
-#endif /* __LIBTHERMAL_H */
-
 #ifdef __cplusplus
 }
 #endif
+
+#endif /* __LIBTHERMAL_H */

From 147d899c7b988501681193393489de8c9b3dadfd Mon Sep 17 00:00:00 2001
From: Rui Qi <qirui.001@bytedance.com>
Date: Fri, 7 Aug 2026 16:15:11 +0800
Subject: [PATCH 0344/1982] selftests/ftrace: Force C locale in ftracetest

[ Upstream commit c13fcd3951dcc19524ce0b3e852844b16cd32b22 ]

Some ftracetest test cases parse command output by matching English
field names. Tools such as readelf may localize their output via
gettext, while ftracetest currently inherits the user locale from
the environment.

If a translated field name is printed, parsing can fail even though
the tested kernel behavior is unchanged. For example, add_remove_uprobe
can fail to find the ELF entry point and then write a uprobe event with
a missing offset.

Export LC_ALL=C in the top-level ftracetest runner so every test case
gets stable command output by default.

Link: https://lore.kernel.org/all/20260807081512.2974757-2-qirui.001@bytedance.com/

Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ftrace/ftracetest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
index cce72f8b03dce7..ee3b950e872f64 100755
--- a/tools/testing/selftests/ftrace/ftracetest
+++ b/tools/testing/selftests/ftrace/ftracetest
@@ -7,6 +7,9 @@
 #  Written by Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
 #
 
+# Keep command output parsing stable regardless of the user's locale.
+export LC_ALL=C
+
 usage() { # errno [message]
 [ ! -z "$2" ] && echo $2
 echo "Usage: ftracetest [options] [testcase(s)] [testcase-directory(s)]"

From f8b6ea70abc0560d09b33e42e52ca752734ae6d0 Mon Sep 17 00:00:00 2001
From: Gustavo Evgucci <monesss315@gmail.com>
Date: Thu, 25 Jun 2026 11:32:30 +0300
Subject: [PATCH 0345/1982] Bluetooth: btusb: Add USB ID 13d3:3625 for MediaTek
 MT7922

[ Upstream commit 849a3bf1489093996859ba0c3c1c0cd314d6ff96 ]

The IMC Networks MT7922 Bluetooth adapter with USB ID 13d3:3625 is not
recognized as a MediaTek device because it is missing from the btusb
device ID table. As a result, btmtk firmware loading is never triggered
and the HCI reset command times out with -ETIMEDOUT.

Add the device with BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH flags,
consistent with the neighboring 13d3:3627, 13d3:3628 and 13d3:3630
entries which use the same chip.

Tested on: MediaTek MT7922 (Wi-Fi 6E combo card, IMC Networks BT USB
interface), kernel 7.0.11-arch1-1.

/sys/kernel/debug/usb/devices:

T:  Bus=01 Lev=01 Prnt=01 Port=12 Cnt=03 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3625 Rev= 1.00
S:  Manufacturer=MediaTek Inc.
S:  Product=Wireless_Device
S:  SerialNumber=000000000
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
I:  If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us

Signed-off-by: Gustavo Evgucci <monesss315@gmail.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 59fff918fd2de7..9257341b01399d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -788,6 +788,8 @@ static const struct usb_device_id quirks_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3613), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x13d3, 0x3625), .driver_info = BTUSB_MEDIATEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3627), .driver_info = BTUSB_MEDIATEK |
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |

From 8a184070477c5a71185cb7edd739612be9a4be28 Mon Sep 17 00:00:00 2001
From: Pavel Zverev <playximik29@gmail.com>
Date: Wed, 8 Jul 2026 01:15:49 +0300
Subject: [PATCH 0346/1982] Bluetooth: btusb: Add support for 1357:c123 Realtek
 8852BE device

[ Upstream commit 335d7bd554a20f33acf762655cafe1089f7f5822 ]

Wiko Hi MateBook 14 Ryzen 200 laptops (DMI system-product-name
"MNCA-XX", board "M1060") are equipped with an RTL8852BE Wi-Fi/BT
combo chip (rtw89_8852be), whose Bluetooth radio enumerates as
1357:c123 instead of one of the already-supported 1358:c123 / 0bda:c123
identifiers, presumably due to OEM rebranding. Without a matching
entry it only matches the generic USB Bluetooth class fallback, so the
Realtek firmware/config (rtl8852btu_fw.bin / rtl8852btu_config.bin) is
never loaded and the adapter cannot discover or connect to any device,
even though hciconfig reports it as powered and scanning.

Device descriptor:
  idVendor           0x1357
  idProduct          0xc123
  bcdDevice            0.00
  iManufacturer           1 Realtek
  iProduct                2 Bluetooth Radio
  bDeviceClass          224 Wireless
  bDeviceSubClass         1 Radio Frequency
  bDeviceProtocol         1 Bluetooth

Adding the same BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH quirk already
used for 1358:c123 and 0bda:c123 fixes firmware loading and normal
operation.

Signed-off-by: Pavel Zverev <playximik29@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 9257341b01399d..3c9d5d09769365 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -882,6 +882,8 @@ static const struct usb_device_id quirks_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x1357, 0xc123), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 

From 3e4e7a9907a16db636a0c88fd157e9422f8060e2 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 6 Jul 2026 17:17:01 +0800
Subject: [PATCH 0347/1982] Bluetooth: hci_nokia: validate firmware packet
 bounds

[ Upstream commit 45640627e3ddc5f4d3a0d08618a596a8c65d48a5 ]

nokia_setup_fw() walks a length-prefixed firmware stream and
decodes HCI command packets from each record.

Check that each record fits in the remaining firmware image, that command
records contain the HCI command header, and that the payload length is
covered before submitting the command.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_nokia.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
index 1e65b541f8ade2..be2923231e7128 100644
--- a/drivers/bluetooth/hci_nokia.c
+++ b/drivers/bluetooth/hci_nokia.c
@@ -354,9 +354,29 @@ static int nokia_setup_fw(struct hci_uart *hu)
 		u16 opcode;
 		struct sk_buff *skb;
 
+		if (pkt_size > fw_size - 2) {
+			err = -EINVAL;
+			dev_err(dev, "%s: Malformed firmware packet\n",
+				hu->hdev->name);
+			goto done;
+		}
+
 		switch (pkt_type) {
 		case HCI_COMMAND_PKT:
+			if (pkt_size < 1 + HCI_COMMAND_HDR_SIZE) {
+				err = -EINVAL;
+				dev_err(dev, "%s: Malformed firmware command\n",
+					hu->hdev->name);
+				goto done;
+			}
+
 			cmd = (struct hci_command_hdr *)(fw_ptr + 3);
+			if (cmd->plen > pkt_size - 1 - HCI_COMMAND_HDR_SIZE) {
+				err = -EINVAL;
+				dev_err(dev, "%s: Truncated firmware command\n",
+					hu->hdev->name);
+				goto done;
+			}
 			opcode = le16_to_cpu(cmd->opcode);
 
 			skb = __hci_cmd_sync(hu->hdev, opcode, cmd->plen,

From ef01d3ea451a84a640543caf76bb9860b8520e41 Mon Sep 17 00:00:00 2001
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
Date: Fri, 15 May 2026 08:46:07 +0800
Subject: [PATCH 0348/1982] Bluetooth: btnxpuart: Fix use-after-free in probe
 error path

[ Upstream commit a2b3b4f00403a3a40c5627d1bf537c8fb166e221 ]

In nxp_serdev_probe(), if hci_register_dev() succeeds but ps_setup()
fails, the error path jumps to 'probe_fail' which only calls
hci_free_dev() and asserts the reset GPIO, but does NOT call
hci_unregister_dev() first.

This leaves the HCI device registered in the system with its backing
memory freed, leading to a use-after-free when userspace subsequently
accesses the device (e.g. via hciconfig or bluetoothd).

Fix by adding a 'probe_fail_unregister' label that calls
hci_unregister_dev() before falling through to the existing
'probe_fail' label. The original 'probe_fail' label is preserved
for the case where hci_register_dev() itself fails (device was
never registered, so no unregister is needed).

Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Reviewed-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btnxpuart.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index c7acf6c7efcf6c..870ce16ad40b1f 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1924,13 +1924,15 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
 	}
 
 	if (ps_setup(hdev))
-		goto probe_fail;
+		goto probe_fail_unregister;
 
 	hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
 			   nxp_coredump_notify);
 
 	return 0;
 
+probe_fail_unregister:
+	hci_unregister_dev(hdev);
 probe_fail:
 	reset_control_assert(nxpdev->pdn);
 	hci_free_dev(hdev);

From ada5c75dd93ffd9716ef1ef60d505bee90114a7d Mon Sep 17 00:00:00 2001
From: Li Qiang <liqiang01@kylinos.cn>
Date: Thu, 16 Jul 2026 16:47:28 +0800
Subject: [PATCH 0349/1982] Bluetooth: bfusb: validate received block
 boundaries

[ Upstream commit 6afadcff79b157a4770c4e987a6005bff40a670b ]

The USB receive path trusts the block header to contain the required
number of bytes and passes it to the reassembly routine. The routine
also trusts a malformed HCI packet type and can append more data than
the skb allocated from the advertised packet length. A malformed USB
transfer can therefore cause out-of-bounds reads or an skb tail
overwrite.

Validate block header availability, declared block size, packet type,
and reassembly tailroom. Drop the partial frame on an invalid block.

Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/bfusb.c | 37 ++++++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 8df310983bf6b3..d31d797639b51a 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -301,6 +301,11 @@ static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned ch
 				return -EILSEQ;
 			}
 			break;
+
+		default:
+			bt_dev_err(data->hdev, "unknown packet type 0x%02x",
+				   pkt_type);
+			return -EILSEQ;
 		}
 
 		skb = bt_skb_alloc(pkt_len, GFP_ATOMIC);
@@ -319,6 +324,13 @@ static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned ch
 		}
 	}
 
+	if (len > skb_tailroom(data->reassembly)) {
+		bt_dev_err(data->hdev, "block exceeds packet length");
+		kfree_skb(data->reassembly);
+		data->reassembly = NULL;
+		return -EILSEQ;
+	}
+
 	if (len > 0)
 		skb_put_data(data->reassembly, buf, len);
 
@@ -353,6 +365,13 @@ static void bfusb_rx_complete(struct urb *urb)
 	skb_put(skb, count);
 
 	while (count) {
+		if (count < 2) {
+			bt_dev_err(data->hdev, "short block header");
+			kfree_skb(data->reassembly);
+			data->reassembly = NULL;
+			break;
+		}
+
 		hdr = buf[0] | (buf[1] << 8);
 
 		if (hdr & 0x4000) {
@@ -360,16 +379,28 @@ static void bfusb_rx_complete(struct urb *urb)
 			count -= 2;
 			buf   += 2;
 		} else {
+			if (count < 3) {
+				bt_dev_err(data->hdev, "short block header");
+				kfree_skb(data->reassembly);
+				data->reassembly = NULL;
+				break;
+			}
+
 			len = (buf[2] == 0) ? 256 : buf[2];
 			count -= 3;
 			buf   += 3;
 		}
 
-		if (count < len)
+		if (count < len) {
 			bt_dev_err(data->hdev, "block extends over URB buffer ranges");
+			kfree_skb(data->reassembly);
+			data->reassembly = NULL;
+			break;
+		}
 
-		if ((hdr & 0xe1) == 0xc1)
-			bfusb_recv_block(data, hdr, buf, len);
+		if ((hdr & 0xe1) == 0xc1 &&
+		    bfusb_recv_block(data, hdr, buf, len) < 0)
+			data->hdev->stat.err_rx++;
 
 		count -= len;
 		buf   += len;

From d9ce845629cfb4a56a72cfaa29ee702bc6588388 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 12 Jun 2026 12:02:14 +0100
Subject: [PATCH 0350/1982] btrfs: fix memory barrier order in
 reloc_root_is_dead()

[ Upstream commit 6f1c97695a6e230ee15c9e052e1933bdccfd5fa3 ]

When we set a root's reloc_root to NULL, we do it like this:

   static void clear_reloc_root(struct btrfs_root *root)
   {
       root->reloc_root = NULL;
       /*
        * Need barrier to ensure clear_bit() only happens after
        * root->reloc_root = NULL. Pairs with have_reloc_root().
        */
        smp_wmb();
        clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state);
   }

So that a NULL reloc_root is always seen before seeing that the bit
BTRFS_ROOT_DEAD_RELOC_TREE was cleared.

But on the read side we have:

   static bool reloc_root_is_dead(const struct btrfs_root *root)
   {
        smp_rmb();
        if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
            return true;
        return false;
   }

And then callers of reloc_root_is_dead() access root->reloc_root.

Because the read memory barrier is placed before testing the bit, the CPU
is completely free to speculatively reorder those two loads. It can read
root->reloc_root before it actually checks the dead tree bit.

Sashiko reported this as an existing problem in another patch review, see
the link in the Link tag below.

Fix this by moving the read memory barrier to happen after testing the bit
and update the comment to reflect current reality.

Link: https://sashiko.dev/#/patchset/cf84f1a217c719e25b6b69e4298dd7afd36c9427.1781194426.git.fdmanana%40suse.com
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/relocation.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index eab9686b1bcdfd..fcb0ab937de5c5 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -245,14 +245,15 @@ static struct btrfs_backref_node *walk_down_backref(
 
 static bool reloc_root_is_dead(const struct btrfs_root *root)
 {
+	if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
+		return true;
 	/*
-	 * Pair with set_bit/clear_bit in clean_dirty_subvols and
-	 * btrfs_update_reloc_root. We need to see the updated bit before
-	 * trying to access reloc_root
+	 * Pairs with set_bit/clear_bit in clear_reloc_root() and
+	 * btrfs_update_reloc_root(). We need to see the updated bit before
+	 * trying to access root->reloc_root in our callers.
 	 */
 	smp_rmb();
-	if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
-		return true;
+
 	return false;
 }
 

From 9bf8e55664306a8aed56352b76ae3c5322cd33f6 Mon Sep 17 00:00:00 2001
From: Aurabindo Pillai <aurabindo.pillai@amd.com>
Date: Wed, 22 Jul 2026 14:44:37 -0400
Subject: [PATCH 0351/1982] drm/amd: Add DCN6 register headers

[ Upstream commit fe219bd7d9783a6cb9249bc333546cb58d2c2723 ]

Add new headers for:
- dcn 6.0.0
- dpcs 6.0.0
- mmhub 5.0.1

Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Roman Li <Roman.Li@amd.com>
Reviewed-by: Ivan Lipski <ivan.lipski@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../include/asic_reg/dcn/dcn_6_0_0_offset.h   | 15799 +++++
 .../include/asic_reg/dcn/dcn_6_0_0_sh_mask.h  | 58556 ++++++++++++++++
 .../include/asic_reg/dpcs/dpcs_6_0_0_offset.h |    47 +
 .../asic_reg/dpcs/dpcs_6_0_0_sh_mask.h        |    55 +
 .../asic_reg/mmhub/mmhub_5_0_1_offset.h       |    17 +
 .../asic_reg/mmhub/mmhub_5_0_1_sh_mask.h      |    17 +
 6 files changed, 74491 insertions(+)
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_offset.h
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_sh_mask.h
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_offset.h
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_sh_mask.h
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_offset.h
 create mode 100644 drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_sh_mask.h

diff --git a/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_offset.h b/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_offset.h
new file mode 100644
index 00000000000000..abf0246e1bbb7c
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_offset.h
@@ -0,0 +1,15799 @@
+// SPDX-License-Identifier: MIT
+//
+// Copyright 2026 Advanced Micro Devices, Inc.
+
+#ifndef _dcn_6_0_0_OFFSET_HEADER
+#define _dcn_6_0_0_OFFSET_HEADER
+
+
+
+// addressBlock: dce_dc_hda_azcontroller_azdec
+// base address: 0x1300000
+#define regGLOBAL_CAPABILITIES                                                                          0x4acc00
+#define regGLOBAL_CAPABILITIES_BASE_IDX                                                                 4
+#define regMINOR_VERSION                                                                                0x4acc00
+#define regMINOR_VERSION_BASE_IDX                                                                       4
+#define regMAJOR_VERSION                                                                                0x4acc00
+#define regMAJOR_VERSION_BASE_IDX                                                                       4
+#define regOUTPUT_PAYLOAD_CAPABILITY                                                                    0x4acc01
+#define regOUTPUT_PAYLOAD_CAPABILITY_BASE_IDX                                                           4
+#define regINPUT_PAYLOAD_CAPABILITY                                                                     0x4acc01
+#define regINPUT_PAYLOAD_CAPABILITY_BASE_IDX                                                            4
+#define regGLOBAL_CONTROL                                                                               0x4acc02
+#define regGLOBAL_CONTROL_BASE_IDX                                                                      4
+#define regWAKE_ENABLE                                                                                  0x4acc03
+#define regWAKE_ENABLE_BASE_IDX                                                                         4
+#define regSTATE_CHANGE_STATUS                                                                          0x4acc03
+#define regSTATE_CHANGE_STATUS_BASE_IDX                                                                 4
+#define regGLOBAL_STATUS                                                                                0x4acc04
+#define regGLOBAL_STATUS_BASE_IDX                                                                       4
+#define regOUTPUT_STREAM_PAYLOAD_CAPABILITY                                                             0x4acc06
+#define regOUTPUT_STREAM_PAYLOAD_CAPABILITY_BASE_IDX                                                    4
+#define regINPUT_STREAM_PAYLOAD_CAPABILITY                                                              0x4acc06
+#define regINPUT_STREAM_PAYLOAD_CAPABILITY_BASE_IDX                                                     4
+#define regINTERRUPT_CONTROL                                                                            0x4acc08
+#define regINTERRUPT_CONTROL_BASE_IDX                                                                   4
+#define regINTERRUPT_STATUS                                                                             0x4acc09
+#define regINTERRUPT_STATUS_BASE_IDX                                                                    4
+#define regWALL_CLOCK_COUNTER                                                                           0x4acc0c
+#define regWALL_CLOCK_COUNTER_BASE_IDX                                                                  4
+#define regSTREAM_SYNCHRONIZATION                                                                       0x4acc0e
+#define regSTREAM_SYNCHRONIZATION_BASE_IDX                                                              4
+#define regCORB_LOWER_BASE_ADDRESS                                                                      0x4acc10
+#define regCORB_LOWER_BASE_ADDRESS_BASE_IDX                                                             4
+#define regCORB_UPPER_BASE_ADDRESS                                                                      0x4acc11
+#define regCORB_UPPER_BASE_ADDRESS_BASE_IDX                                                             4
+#define regAZCONTROLLER0_CORB_WRITE_POINTER                                                             0x4acc12
+#define regAZCONTROLLER0_CORB_WRITE_POINTER_BASE_IDX                                                    4
+#define regAZCONTROLLER0_CORB_READ_POINTER                                                              0x4acc12
+#define regAZCONTROLLER0_CORB_READ_POINTER_BASE_IDX                                                     4
+#define regAZCONTROLLER0_CORB_CONTROL                                                                   0x4acc13
+#define regAZCONTROLLER0_CORB_CONTROL_BASE_IDX                                                          4
+#define regAZCONTROLLER0_CORB_STATUS                                                                    0x4acc13
+#define regAZCONTROLLER0_CORB_STATUS_BASE_IDX                                                           4
+#define regAZCONTROLLER0_CORB_SIZE                                                                      0x4acc13
+#define regAZCONTROLLER0_CORB_SIZE_BASE_IDX                                                             4
+#define regAZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS                                                        0x4acc14
+#define regAZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS_BASE_IDX                                               4
+#define regAZCONTROLLER0_RIRB_UPPER_BASE_ADDRESS                                                        0x4acc15
+#define regAZCONTROLLER0_RIRB_UPPER_BASE_ADDRESS_BASE_IDX                                               4
+#define regAZCONTROLLER0_RIRB_WRITE_POINTER                                                             0x4acc16
+#define regAZCONTROLLER0_RIRB_WRITE_POINTER_BASE_IDX                                                    4
+#define regAZCONTROLLER0_RESPONSE_INTERRUPT_COUNT                                                       0x4acc16
+#define regAZCONTROLLER0_RESPONSE_INTERRUPT_COUNT_BASE_IDX                                              4
+#define regAZCONTROLLER0_RIRB_CONTROL                                                                   0x4acc17
+#define regAZCONTROLLER0_RIRB_CONTROL_BASE_IDX                                                          4
+#define regAZCONTROLLER0_RIRB_STATUS                                                                    0x4acc17
+#define regAZCONTROLLER0_RIRB_STATUS_BASE_IDX                                                           4
+#define regAZCONTROLLER0_RIRB_SIZE                                                                      0x4acc17
+#define regAZCONTROLLER0_RIRB_SIZE_BASE_IDX                                                             4
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE                                             0x4acc18
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_BASE_IDX                                    4
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                                        0x4acc18
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                               4
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                                       0x4acc18
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                              4
+#define regAZCONTROLLER0_IMMEDIATE_RESPONSE_INPUT_INTERFACE                                             0x4acc19
+#define regAZCONTROLLER0_IMMEDIATE_RESPONSE_INPUT_INTERFACE_BASE_IDX                                    4
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_STATUS                                                       0x4acc1a
+#define regAZCONTROLLER0_IMMEDIATE_COMMAND_STATUS_BASE_IDX                                              4
+#define regAZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS                                                0x4acc1c
+#define regAZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS_BASE_IDX                                       4
+#define regAZCONTROLLER0_DMA_POSITION_UPPER_BASE_ADDRESS                                                0x4acc1d
+#define regAZCONTROLLER0_DMA_POSITION_UPPER_BASE_ADDRESS_BASE_IDX                                       4
+#define regAZCONTROLLER0_WALL_CLOCK_COUNTER_ALIAS                                                       0x4ad40c
+#define regAZCONTROLLER0_WALL_CLOCK_COUNTER_ALIAS_BASE_IDX                                              4
+
+
+// addressBlock: dce_dc_hda_azendpoint_azdec
+// base address: 0x1300000
+#define regAZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                               0x4acc18
+#define regAZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                      4
+#define regAZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                              0x4acc18
+#define regAZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                     4
+
+
+// addressBlock: dce_dc_hda_azroot_azdec
+// base address: 0x1300000
+#define regAZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                                       0x4acc18
+#define regAZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                              4
+#define regAZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                                      0x4acc18
+#define regAZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                             4
+
+
+// addressBlock: dce_dc_hda_azstream0_azdec
+// base address: 0x1300000
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc20
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc21
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc22
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc23
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc24
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc24
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc26
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc27
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad421
+#define regAZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream1_azdec
+// base address: 0x1300020
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc28
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc29
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc2a
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc2b
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc2c
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc2c
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc2e
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc2f
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad429
+#define regAZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream2_azdec
+// base address: 0x1300040
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc30
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc31
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc32
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc33
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc34
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc34
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc36
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc37
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad431
+#define regAZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream3_azdec
+// base address: 0x1300060
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc38
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc39
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc3a
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc3b
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc3c
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc3c
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc3e
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc3f
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad439
+#define regAZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream4_azdec
+// base address: 0x1300080
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc40
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc41
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc42
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc43
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc44
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc44
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc46
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc47
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad441
+#define regAZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream5_azdec
+// base address: 0x13000a0
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc48
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc49
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc4a
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc4b
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc4c
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc4c
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc4e
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc4f
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad449
+#define regAZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream6_azdec
+// base address: 0x13000c0
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc50
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc51
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc52
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc53
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc54
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc54
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc56
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc57
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad451
+#define regAZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_dc_hda_azstream7_azdec
+// base address: 0x13000e0
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x4acc58
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x4acc59
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x4acc5a
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x4acc5b
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x4acc5c
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x4acc5c
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x4acc5e
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x4acc5f
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 4
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x4ad459
+#define regAZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          4
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmiopubDmuDec
+// base address: 0x900f000
+#define regRSMU_MEM_POWER_CTRL2_DMU                                                                     0x0000
+#define regRSMU_MEM_POWER_CTRL2_DMU_BASE_IDX                                                            5
+#define regRSMU_HARD_RESETB_DMU                                                                         0x0002
+#define regRSMU_HARD_RESETB_DMU_BASE_IDX                                                                5
+#define regRSMU_MEM_POWER_CTRL_DMU                                                                      0x0006
+#define regRSMU_MEM_POWER_CTRL_DMU_BASE_IDX                                                             5
+#define regRSMU_STRAP_CONTROL_DMU                                                                       0x000d
+#define regRSMU_STRAP_CONTROL_DMU_BASE_IDX                                                              5
+#define regRSMU_COUNTER_0_DMU                                                                           0x0077
+#define regRSMU_COUNTER_0_DMU_BASE_IDX                                                                  5
+#define regRSMU_COUNTER_1_DMU                                                                           0x0078
+#define regRSMU_COUNTER_1_DMU_BASE_IDX                                                                  5
+#define regRSMU_PWRMGT_INTR_ENABLE_P0_DMU                                                               0x0079
+#define regRSMU_PWRMGT_INTR_ENABLE_P0_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_ENABLE_P1_DMU                                                               0x007a
+#define regRSMU_PWRMGT_INTR_ENABLE_P1_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_ENABLE_P2_DMU                                                               0x007b
+#define regRSMU_PWRMGT_INTR_ENABLE_P2_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P0_DMU                                                          0x007c
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P0_DMU_BASE_IDX                                                 5
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P1_DMU                                                          0x007d
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P1_DMU_BASE_IDX                                                 5
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P2_DMU                                                          0x007e
+#define regRSMU_PWRMGT_INTR_TARGET_ADDR_P2_DMU_BASE_IDX                                                 5
+#define regRSMU_PWRMGT_INTR_CONFIG_P0_DMU                                                               0x007f
+#define regRSMU_PWRMGT_INTR_CONFIG_P0_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_CONFIG_P1_DMU                                                               0x0080
+#define regRSMU_PWRMGT_INTR_CONFIG_P1_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_CONFIG_P2_DMU                                                               0x0081
+#define regRSMU_PWRMGT_INTR_CONFIG_P2_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_STATUS_DMU                                                                  0x0082
+#define regRSMU_PWRMGT_INTR_STATUS_DMU_BASE_IDX                                                         5
+#define regRSMU_PWRMGT_INTR_PENDING_P0_DMU                                                              0x0083
+#define regRSMU_PWRMGT_INTR_PENDING_P0_DMU_BASE_IDX                                                     5
+#define regRSMU_PWRMGT_INTR_PENDING_P1_DMU                                                              0x0084
+#define regRSMU_PWRMGT_INTR_PENDING_P1_DMU_BASE_IDX                                                     5
+#define regRSMU_PWRMGT_INTR_PENDING_P2_DMU                                                              0x0085
+#define regRSMU_PWRMGT_INTR_PENDING_P2_DMU_BASE_IDX                                                     5
+#define regRSMU_PWRMGT_INTR_TYPE_DMU                                                                    0x0086
+#define regRSMU_PWRMGT_INTR_TYPE_DMU_BASE_IDX                                                           5
+#define regRSMU_PWRMGT_INTR_INTERCEPT_DMU                                                               0x0087
+#define regRSMU_PWRMGT_INTR_INTERCEPT_DMU_BASE_IDX                                                      5
+#define regRSMU_PWRMGT_INTR_CLEAR_DMU                                                                   0x0088
+#define regRSMU_PWRMGT_INTR_CLEAR_DMU_BASE_IDX                                                          5
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_DMU                                                               0x008a
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_DMU_BASE_IDX                                                      5
+#define regRSMU_VF_ENABLE_DMU                                                                           0x008b
+#define regRSMU_VF_ENABLE_DMU_BASE_IDX                                                                  5
+#define regRSMU_MGCG_CONTROL_DMU                                                                        0x008c
+#define regRSMU_MGCG_CONTROL_DMU_BASE_IDX                                                               5
+#define regRSMU_AXI_MASTER_QOS_CNTL_DMU                                                                 0x008e
+#define regRSMU_AXI_MASTER_QOS_CNTL_DMU_BASE_IDX                                                        5
+#define regRSMU_MASTER_ERROR_COUNTER_DMU                                                                0x008f
+#define regRSMU_MASTER_ERROR_COUNTER_DMU_BASE_IDX                                                       5
+#define regRSMU_SLAVE_TIMEOUT_VALUE_DMU                                                                 0x0090
+#define regRSMU_SLAVE_TIMEOUT_VALUE_DMU_BASE_IDX                                                        5
+#define regRSMU_RESET_TIMEOUT_CONTROL_DMU                                                               0x0091
+#define regRSMU_RESET_TIMEOUT_CONTROL_DMU_BASE_IDX                                                      5
+#define regRSMU_SLAVE_ERROR_COUNTER_DMU                                                                 0x0092
+#define regRSMU_SLAVE_ERROR_COUNTER_DMU_BASE_IDX                                                        5
+#define regRSMU_DBG_MUX_CONTROL_DMU                                                                     0x0093
+#define regRSMU_DBG_MUX_CONTROL_DMU_BASE_IDX                                                            5
+#define regRSMU_IH_RESET_CNTL_DMU                                                                       0x00ba
+#define regRSMU_IH_RESET_CNTL_DMU_BASE_IDX                                                              5
+#define regRSMU_GOLDEN_COUNTER_0_DMU                                                                    0x00bc
+#define regRSMU_GOLDEN_COUNTER_0_DMU_BASE_IDX                                                           5
+#define regRSMU_GOLDEN_COUNTER_1_DMU                                                                    0x00bd
+#define regRSMU_GOLDEN_COUNTER_1_DMU_BASE_IDX                                                           5
+#define regRSMU_IP_CLOCK_GATE_CNTL_DMU                                                                  0x00be
+#define regRSMU_IP_CLOCK_GATE_CNTL_DMU_BASE_IDX                                                         5
+#define regRSMU_MSMU_FETCH_FUSE_DMU                                                                     0x00ef
+#define regRSMU_MSMU_FETCH_FUSE_DMU_BASE_IDX                                                            5
+#define regRSMU_STRAP_STATUS_DMU                                                                        0x00f1
+#define regRSMU_STRAP_STATUS_DMU_BASE_IDX                                                               5
+#define regRSMU_SMS_FUSE_CLEAR_SET0_DMU                                                                 0x00f2
+#define regRSMU_SMS_FUSE_CLEAR_SET0_DMU_BASE_IDX                                                        5
+#define regRSMU_PWRMGT_INTR_MCM_ADDR_DMU                                                                0x0118
+#define regRSMU_PWRMGT_INTR_MCM_ADDR_DMU_BASE_IDX                                                       5
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_DMU                                                             0x0119
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_DMU_BASE_IDX                                                    5
+#define regRSMU_XBAR_CG_MISC_DMU                                                                        0x011b
+#define regRSMU_XBAR_CG_MISC_DMU_BASE_IDX                                                               5
+#define regRSMU_XBAR_CG_CTRL_DMU                                                                        0x011c
+#define regRSMU_XBAR_CG_CTRL_DMU_BASE_IDX                                                               5
+#define regRSMU_IH_MCM_ADDR_DMU                                                                         0x011d
+#define regRSMU_IH_MCM_ADDR_DMU_BASE_IDX                                                                5
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmioextDmuDec
+// base address: 0x900f780
+#define regRSMU_SOFT_RESETB_DMU                                                                         0x01e0
+#define regRSMU_SOFT_RESETB_DMU_BASE_IDX                                                                5
+#define regRSMU_IH_CREDIT_DMU                                                                           0x01e5
+#define regRSMU_IH_CREDIT_DMU_BASE_IDX                                                                  5
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_DMU                                                              0x01e7
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_DMU_BASE_IDX                                                     5
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_DMU                                                               0x01ee
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_DMU_BASE_IDX                                                      5
+#define regRSMU_IP_MASTER_STATUS_DMU                                                                    0x01ef
+#define regRSMU_IP_MASTER_STATUS_DMU_BASE_IDX                                                           5
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_DMU                                                               0x01f0
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_DMU_BASE_IDX                                                      5
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_DMU                                                               0x01f1
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_DMU_BASE_IDX                                                      5
+#define regRSMU_VERSION_DMU                                                                             0x01f5
+#define regRSMU_VERSION_DMU_BASE_IDX                                                                    5
+#define regRSMU_IH_COOKIE_WRITE_ADDR_DMU                                                                0x01ff
+#define regRSMU_IH_COOKIE_WRITE_ADDR_DMU_BASE_IDX                                                       5
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmiosecDmuDec
+// base address: 0x900f800
+#define regRSMU_AEB_OVERRIDE_0_DMU                                                                      0x0202
+#define regRSMU_AEB_OVERRIDE_0_DMU_BASE_IDX                                                             5
+#define regRSMU_AEB_OVERRIDE_1_DMU                                                                      0x0203
+#define regRSMU_AEB_OVERRIDE_1_DMU_BASE_IDX                                                             5
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_DMU                                                               0x0371
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_DMU_BASE_IDX                                                      5
+#define regRSMU_AEB_VALUE_0_DMU                                                                         0x0373
+#define regRSMU_AEB_VALUE_0_DMU_BASE_IDX                                                                5
+#define regRSMU_AEB_VALUE_1_DMU                                                                         0x0374
+#define regRSMU_AEB_VALUE_1_DMU_BASE_IDX                                                                5
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmiopubDioDec
+// base address: 0x9010000
+#define regRSMU_MEM_POWER_CTRL2_DIO                                                                     0x0400
+#define regRSMU_MEM_POWER_CTRL2_DIO_BASE_IDX                                                            5
+#define regRSMU_HARD_RESETB_DIO                                                                         0x0402
+#define regRSMU_HARD_RESETB_DIO_BASE_IDX                                                                5
+#define regRSMU_PUB_FUSE_ADDR_DIO                                                                       0x0403
+#define regRSMU_PUB_FUSE_ADDR_DIO_BASE_IDX                                                              5
+#define regRSMU_ROM_ADDR_DIO                                                                            0x0405
+#define regRSMU_ROM_ADDR_DIO_BASE_IDX                                                                   5
+#define regRSMU_MEM_POWER_CTRL_DIO                                                                      0x0406
+#define regRSMU_MEM_POWER_CTRL_DIO_BASE_IDX                                                             5
+#define regRSMU_MP0_STRAPRX_ADDR_DIO                                                                    0x0407
+#define regRSMU_MP0_STRAPRX_ADDR_DIO_BASE_IDX                                                           5
+#define regRSMU_MP0_STRAPRX_DATA_DIO                                                                    0x0408
+#define regRSMU_MP0_STRAPRX_DATA_DIO_BASE_IDX                                                           5
+#define regRSMU_PIN_STRAP_DATA_DIO                                                                      0x0409
+#define regRSMU_PIN_STRAP_DATA_DIO_BASE_IDX                                                             5
+#define regRSMU_SMS_FUSE_CFG_DIO                                                                        0x040a
+#define regRSMU_SMS_FUSE_CFG_DIO_BASE_IDX                                                               5
+#define regRSMU_SMS_FUSE_ADDR_BASE_DIO                                                                  0x040b
+#define regRSMU_SMS_FUSE_ADDR_BASE_DIO_BASE_IDX                                                         5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_DIO                                                                0x040c
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_DIO_BASE_IDX                                                       5
+#define regRSMU_STRAP_CONTROL_DIO                                                                       0x040d
+#define regRSMU_STRAP_CONTROL_DIO_BASE_IDX                                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO                                                       0x040e
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO                                                       0x040f
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO                                                       0x0410
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO                                                      0x0411
+#define regRSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO_BASE_IDX                                             5
+#define regRSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO                                                    0x0412
+#define regRSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO_BASE_IDX                                           5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO                                                       0x0413
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO                                                       0x0414
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO                                                       0x0415
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO                                                       0x0416
+#define regRSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO_BASE_IDX                                              5
+#define regRSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO                                                   0x0417
+#define regRSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO_BASE_IDX                                          5
+#define regRSMU_CAC_CONTROL_DIO                                                                         0x0450
+#define regRSMU_CAC_CONTROL_DIO_BASE_IDX                                                                5
+#define regRSMU_CAC_ACC_MASK_LO_DIO                                                                     0x0451
+#define regRSMU_CAC_ACC_MASK_LO_DIO_BASE_IDX                                                            5
+#define regRSMU_CAC_WEIGHT_0_DIO                                                                        0x0452
+#define regRSMU_CAC_WEIGHT_0_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_1_DIO                                                                        0x0453
+#define regRSMU_CAC_WEIGHT_1_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_2_DIO                                                                        0x0454
+#define regRSMU_CAC_WEIGHT_2_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_3_DIO                                                                        0x0455
+#define regRSMU_CAC_WEIGHT_3_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_4_DIO                                                                        0x0456
+#define regRSMU_CAC_WEIGHT_4_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_5_DIO                                                                        0x0457
+#define regRSMU_CAC_WEIGHT_5_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_6_DIO                                                                        0x0458
+#define regRSMU_CAC_WEIGHT_6_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_7_DIO                                                                        0x0459
+#define regRSMU_CAC_WEIGHT_7_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_WEIGHT_8_DIO                                                                        0x045a
+#define regRSMU_CAC_WEIGHT_8_DIO_BASE_IDX                                                               5
+#define regRSMU_CAC_ACC_MASK_HI_DIO                                                                     0x046c
+#define regRSMU_CAC_ACC_MASK_HI_DIO_BASE_IDX                                                            5
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_DIO                                                               0x048a
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_DIO_BASE_IDX                                                      5
+#define regRSMU_VF_ENABLE_DIO                                                                           0x048b
+#define regRSMU_VF_ENABLE_DIO_BASE_IDX                                                                  5
+#define regRSMU_MGCG_CONTROL_DIO                                                                        0x048c
+#define regRSMU_MGCG_CONTROL_DIO_BASE_IDX                                                               5
+#define regRSMU_AXI_MASTER_QOS_CNTL_DIO                                                                 0x048e
+#define regRSMU_AXI_MASTER_QOS_CNTL_DIO_BASE_IDX                                                        5
+#define regRSMU_MASTER_ERROR_COUNTER_DIO                                                                0x048f
+#define regRSMU_MASTER_ERROR_COUNTER_DIO_BASE_IDX                                                       5
+#define regRSMU_SLAVE_TIMEOUT_VALUE_DIO                                                                 0x0490
+#define regRSMU_SLAVE_TIMEOUT_VALUE_DIO_BASE_IDX                                                        5
+#define regRSMU_RESET_TIMEOUT_CONTROL_DIO                                                               0x0491
+#define regRSMU_RESET_TIMEOUT_CONTROL_DIO_BASE_IDX                                                      5
+#define regRSMU_SLAVE_ERROR_COUNTER_DIO                                                                 0x0492
+#define regRSMU_SLAVE_ERROR_COUNTER_DIO_BASE_IDX                                                        5
+#define regRSMU_DBG_MUX_CONTROL_DIO                                                                     0x0493
+#define regRSMU_DBG_MUX_CONTROL_DIO_BASE_IDX                                                            5
+#define regRSMU_IP_CLOCK_GATE_CNTL_DIO                                                                  0x04be
+#define regRSMU_IP_CLOCK_GATE_CNTL_DIO_BASE_IDX                                                         5
+#define regRSMU_CAC_ACC_0_DIO                                                                           0x04bf
+#define regRSMU_CAC_ACC_0_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_1_DIO                                                                           0x04c0
+#define regRSMU_CAC_ACC_1_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_2_DIO                                                                           0x04c1
+#define regRSMU_CAC_ACC_2_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_3_DIO                                                                           0x04c2
+#define regRSMU_CAC_ACC_3_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_4_DIO                                                                           0x04c3
+#define regRSMU_CAC_ACC_4_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_5_DIO                                                                           0x04c4
+#define regRSMU_CAC_ACC_5_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_6_DIO                                                                           0x04c5
+#define regRSMU_CAC_ACC_6_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_7_DIO                                                                           0x04c6
+#define regRSMU_CAC_ACC_7_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_8_DIO                                                                           0x04c7
+#define regRSMU_CAC_ACC_8_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_9_DIO                                                                           0x04c8
+#define regRSMU_CAC_ACC_9_DIO_BASE_IDX                                                                  5
+#define regRSMU_CAC_ACC_10_DIO                                                                          0x04c9
+#define regRSMU_CAC_ACC_10_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_11_DIO                                                                          0x04ca
+#define regRSMU_CAC_ACC_11_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_12_DIO                                                                          0x04cb
+#define regRSMU_CAC_ACC_12_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_13_DIO                                                                          0x04cc
+#define regRSMU_CAC_ACC_13_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_14_DIO                                                                          0x04cd
+#define regRSMU_CAC_ACC_14_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_15_DIO                                                                          0x04ce
+#define regRSMU_CAC_ACC_15_DIO_BASE_IDX                                                                 5
+#define regRSMU_CAC_ACC_16_DIO                                                                          0x04cf
+#define regRSMU_CAC_ACC_16_DIO_BASE_IDX                                                                 5
+#define regRSMU_MSMU_FETCH_FUSE_DIO                                                                     0x04ef
+#define regRSMU_MSMU_FETCH_FUSE_DIO_BASE_IDX                                                            5
+#define regRSMU_MSMU_FETCH_ROM_DIO                                                                      0x04f0
+#define regRSMU_MSMU_FETCH_ROM_DIO_BASE_IDX                                                             5
+#define regRSMU_STRAP_STATUS_DIO                                                                        0x04f1
+#define regRSMU_STRAP_STATUS_DIO_BASE_IDX                                                               5
+#define regRSMU_SMS_FUSE_CLEAR_SET0_DIO                                                                 0x04f2
+#define regRSMU_SMS_FUSE_CLEAR_SET0_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_0_DIO                                                                 0x04f3
+#define regRSMU_SMS_FUSE_DATA_GRP_0_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_1_DIO                                                                 0x04f4
+#define regRSMU_SMS_FUSE_DATA_GRP_1_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_2_DIO                                                                 0x04f5
+#define regRSMU_SMS_FUSE_DATA_GRP_2_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_3_DIO                                                                 0x04f6
+#define regRSMU_SMS_FUSE_DATA_GRP_3_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_4_DIO                                                                 0x04f7
+#define regRSMU_SMS_FUSE_DATA_GRP_4_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_5_DIO                                                                 0x04f8
+#define regRSMU_SMS_FUSE_DATA_GRP_5_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_6_DIO                                                                 0x04f9
+#define regRSMU_SMS_FUSE_DATA_GRP_6_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_7_DIO                                                                 0x04fa
+#define regRSMU_SMS_FUSE_DATA_GRP_7_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_8_DIO                                                                 0x04fb
+#define regRSMU_SMS_FUSE_DATA_GRP_8_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_9_DIO                                                                 0x04fc
+#define regRSMU_SMS_FUSE_DATA_GRP_9_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_DATA_GRP_10_DIO                                                                0x04fd
+#define regRSMU_SMS_FUSE_DATA_GRP_10_DIO_BASE_IDX                                                       5
+#define regRSMU_SMS_FUSE_FIFO_EMPTY_DIO                                                                 0x0513
+#define regRSMU_SMS_FUSE_FIFO_EMPTY_DIO_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_FIFO_FULL_DIO                                                                  0x0514
+#define regRSMU_SMS_FUSE_FIFO_FULL_DIO_BASE_IDX                                                         5
+#define regRSMU_ASP_FUSE_ADDR_DIO                                                                       0x0515
+#define regRSMU_ASP_FUSE_ADDR_DIO_BASE_IDX                                                              5
+#define regRSMU_ASP_FUSE_DATA_DIO                                                                       0x0516
+#define regRSMU_ASP_FUSE_DATA_DIO_BASE_IDX                                                              5
+#define regRSMU_ASP_STRAP_CONTROL_DIO                                                                   0x0517
+#define regRSMU_ASP_STRAP_CONTROL_DIO_BASE_IDX                                                          5
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_DIO                                                             0x0519
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_DIO_BASE_IDX                                                    5
+#define regRSMU_XBAR_CG_MISC_DIO                                                                        0x051b
+#define regRSMU_XBAR_CG_MISC_DIO_BASE_IDX                                                               5
+#define regRSMU_XBAR_CG_CTRL_DIO                                                                        0x051c
+#define regRSMU_XBAR_CG_CTRL_DIO_BASE_IDX                                                               5
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmioextDioDec
+// base address: 0x9010780
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_DIO                                                              0x05e7
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_DIO_BASE_IDX                                                     5
+#define regRSMU_SW_STRAPRX_ADDR_DIO                                                                     0x05eb
+#define regRSMU_SW_STRAPRX_ADDR_DIO_BASE_IDX                                                            5
+#define regRSMU_SW_STRAPRX_DATA_DIO                                                                     0x05ec
+#define regRSMU_SW_STRAPRX_DATA_DIO_BASE_IDX                                                            5
+#define regRSMU_SW_STRAP_CONTROL_DIO                                                                    0x05ed
+#define regRSMU_SW_STRAP_CONTROL_DIO_BASE_IDX                                                           5
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_DIO                                                               0x05ee
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_DIO_BASE_IDX                                                      5
+#define regRSMU_IP_MASTER_STATUS_DIO                                                                    0x05ef
+#define regRSMU_IP_MASTER_STATUS_DIO_BASE_IDX                                                           5
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_DIO                                                               0x05f0
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_DIO_BASE_IDX                                                      5
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_DIO                                                               0x05f1
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_DIO_BASE_IDX                                                      5
+#define regRSMU_VERSION_DIO                                                                             0x05f5
+#define regRSMU_VERSION_DIO_BASE_IDX                                                                    5
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmiosecDioDec
+// base address: 0x9010800
+#define regRSMU_AEB_OVERRIDE_0_DIO                                                                      0x0602
+#define regRSMU_AEB_OVERRIDE_0_DIO_BASE_IDX                                                             5
+#define regRSMU_AEB_OVERRIDE_1_DIO                                                                      0x0603
+#define regRSMU_AEB_OVERRIDE_1_DIO_BASE_IDX                                                             5
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_DIO                                                               0x0771
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_DIO_BASE_IDX                                                      5
+#define regRSMU_AEB_VALUE_0_DIO                                                                         0x0773
+#define regRSMU_AEB_VALUE_0_DIO_BASE_IDX                                                                5
+#define regRSMU_AEB_VALUE_1_DIO                                                                         0x0774
+#define regRSMU_AEB_VALUE_1_DIO_BASE_IDX                                                                5
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmiopubHdaDec
+// base address: 0x9012000
+#define regRSMU_MEM_POWER_CTRL2_HDA                                                                     0x0c00
+#define regRSMU_MEM_POWER_CTRL2_HDA_BASE_IDX                                                            5
+#define regRSMU_HARD_RESETB_HDA                                                                         0x0c02
+#define regRSMU_HARD_RESETB_HDA_BASE_IDX                                                                5
+#define regRSMU_MEM_POWER_CTRL_HDA                                                                      0x0c06
+#define regRSMU_MEM_POWER_CTRL_HDA_BASE_IDX                                                             5
+#define regRSMU_STRAP_CONTROL_HDA                                                                       0x0c0d
+#define regRSMU_STRAP_CONTROL_HDA_BASE_IDX                                                              5
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_HDA                                                               0x0c8a
+#define regRSMU_MMIOPUB_SCRATCH_REG_0_HDA_BASE_IDX                                                      5
+#define regRSMU_VF_ENABLE_HDA                                                                           0x0c8b
+#define regRSMU_VF_ENABLE_HDA_BASE_IDX                                                                  5
+#define regRSMU_MGCG_CONTROL_HDA                                                                        0x0c8c
+#define regRSMU_MGCG_CONTROL_HDA_BASE_IDX                                                               5
+#define regRSMU_AXI_MASTER_QOS_CNTL_HDA                                                                 0x0c8e
+#define regRSMU_AXI_MASTER_QOS_CNTL_HDA_BASE_IDX                                                        5
+#define regRSMU_MASTER_ERROR_COUNTER_HDA                                                                0x0c8f
+#define regRSMU_MASTER_ERROR_COUNTER_HDA_BASE_IDX                                                       5
+#define regRSMU_SLAVE_TIMEOUT_VALUE_HDA                                                                 0x0c90
+#define regRSMU_SLAVE_TIMEOUT_VALUE_HDA_BASE_IDX                                                        5
+#define regRSMU_RESET_TIMEOUT_CONTROL_HDA                                                               0x0c91
+#define regRSMU_RESET_TIMEOUT_CONTROL_HDA_BASE_IDX                                                      5
+#define regRSMU_SLAVE_ERROR_COUNTER_HDA                                                                 0x0c92
+#define regRSMU_SLAVE_ERROR_COUNTER_HDA_BASE_IDX                                                        5
+#define regRSMU_DBG_MUX_CONTROL_HDA                                                                     0x0c93
+#define regRSMU_DBG_MUX_CONTROL_HDA_BASE_IDX                                                            5
+#define regRSMU_IP_CLOCK_GATE_CNTL_HDA                                                                  0x0cbe
+#define regRSMU_IP_CLOCK_GATE_CNTL_HDA_BASE_IDX                                                         5
+#define regRSMU_MSMU_FETCH_FUSE_HDA                                                                     0x0cef
+#define regRSMU_MSMU_FETCH_FUSE_HDA_BASE_IDX                                                            5
+#define regRSMU_STRAP_STATUS_HDA                                                                        0x0cf1
+#define regRSMU_STRAP_STATUS_HDA_BASE_IDX                                                               5
+#define regRSMU_SMS_FUSE_CLEAR_SET0_HDA                                                                 0x0cf2
+#define regRSMU_SMS_FUSE_CLEAR_SET0_HDA_BASE_IDX                                                        5
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_HDA                                                             0x0d19
+#define regRSMU_SMS_FUSE_RETRIGGER_SET0_HDA_BASE_IDX                                                    5
+#define regRSMU_XBAR_CG_MISC_HDA                                                                        0x0d1b
+#define regRSMU_XBAR_CG_MISC_HDA_BASE_IDX                                                               5
+#define regRSMU_XBAR_CG_CTRL_HDA                                                                        0x0d1c
+#define regRSMU_XBAR_CG_CTRL_HDA_BASE_IDX                                                               5
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmioextHdaDec
+// base address: 0x9012780
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_HDA                                                              0x0de7
+#define regRSMU_TIMEOUT_ERROR_LOG_REG1_HDA_BASE_IDX                                                     5
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_HDA                                                               0x0dee
+#define regRSMU_TIMEOUT_ERROR_LOG_REG_HDA_BASE_IDX                                                      5
+#define regRSMU_IP_MASTER_STATUS_HDA                                                                    0x0def
+#define regRSMU_IP_MASTER_STATUS_HDA_BASE_IDX                                                           5
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_HDA                                                               0x0df0
+#define regRSMU_MMIOEXT_SCRATCH_REG_0_HDA_BASE_IDX                                                      5
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_HDA                                                               0x0df1
+#define regRSMU_MMIOEXT_SCRATCH_REG_1_HDA_BASE_IDX                                                      5
+#define regRSMU_VERSION_HDA                                                                             0x0df5
+#define regRSMU_VERSION_HDA_BASE_IDX                                                                    5
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmiosecHdaDec
+// base address: 0x9012800
+#define regRSMU_AEB_OVERRIDE_0_HDA                                                                      0x0e02
+#define regRSMU_AEB_OVERRIDE_0_HDA_BASE_IDX                                                             5
+#define regRSMU_AEB_OVERRIDE_1_HDA                                                                      0x0e03
+#define regRSMU_AEB_OVERRIDE_1_HDA_BASE_IDX                                                             5
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_HDA                                                               0x0f71
+#define regRSMU_MMIOSEC_SCRATCH_REG_0_HDA_BASE_IDX                                                      5
+#define regRSMU_AEB_VALUE_0_HDA                                                                         0x0f73
+#define regRSMU_AEB_VALUE_0_HDA_BASE_IDX                                                                5
+#define regRSMU_AEB_VALUE_1_HDA                                                                         0x0f74
+#define regRSMU_AEB_VALUE_1_HDA_BASE_IDX                                                                5
+
+
+// addressBlock: dce_dc_hda_azcontroller_azdec
+// base address: 0x0
+#define regAZCONTROLLER1_CORB_WRITE_POINTER                                                             0x0000
+#define regAZCONTROLLER1_CORB_WRITE_POINTER_BASE_IDX                                                    0
+#define regAZCONTROLLER1_CORB_READ_POINTER                                                              0x0000
+#define regAZCONTROLLER1_CORB_READ_POINTER_BASE_IDX                                                     0
+#define regAZCONTROLLER1_CORB_CONTROL                                                                   0x0001
+#define regAZCONTROLLER1_CORB_CONTROL_BASE_IDX                                                          0
+#define regAZCONTROLLER1_CORB_STATUS                                                                    0x0001
+#define regAZCONTROLLER1_CORB_STATUS_BASE_IDX                                                           0
+#define regAZCONTROLLER1_CORB_SIZE                                                                      0x0001
+#define regAZCONTROLLER1_CORB_SIZE_BASE_IDX                                                             0
+#define regAZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS                                                        0x0002
+#define regAZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS_BASE_IDX                                               0
+#define regAZCONTROLLER1_RIRB_UPPER_BASE_ADDRESS                                                        0x0003
+#define regAZCONTROLLER1_RIRB_UPPER_BASE_ADDRESS_BASE_IDX                                               0
+#define regAZCONTROLLER1_RIRB_WRITE_POINTER                                                             0x0004
+#define regAZCONTROLLER1_RIRB_WRITE_POINTER_BASE_IDX                                                    0
+#define regAZCONTROLLER1_RESPONSE_INTERRUPT_COUNT                                                       0x0004
+#define regAZCONTROLLER1_RESPONSE_INTERRUPT_COUNT_BASE_IDX                                              0
+#define regAZCONTROLLER1_RIRB_CONTROL                                                                   0x0005
+#define regAZCONTROLLER1_RIRB_CONTROL_BASE_IDX                                                          0
+#define regAZCONTROLLER1_RIRB_STATUS                                                                    0x0005
+#define regAZCONTROLLER1_RIRB_STATUS_BASE_IDX                                                           0
+#define regAZCONTROLLER1_RIRB_SIZE                                                                      0x0005
+#define regAZCONTROLLER1_RIRB_SIZE_BASE_IDX                                                             0
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE                                             0x0006
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_BASE_IDX                                    0
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                                        0x0006
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                               0
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                                       0x0006
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                              0
+#define regAZCONTROLLER1_IMMEDIATE_RESPONSE_INPUT_INTERFACE                                             0x0007
+#define regAZCONTROLLER1_IMMEDIATE_RESPONSE_INPUT_INTERFACE_BASE_IDX                                    0
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_STATUS                                                       0x0008
+#define regAZCONTROLLER1_IMMEDIATE_COMMAND_STATUS_BASE_IDX                                              0
+#define regAZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS                                                0x000a
+#define regAZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS_BASE_IDX                                       0
+#define regAZCONTROLLER1_DMA_POSITION_UPPER_BASE_ADDRESS                                                0x000b
+#define regAZCONTROLLER1_DMA_POSITION_UPPER_BASE_ADDRESS_BASE_IDX                                       0
+#define regAZCONTROLLER1_WALL_CLOCK_COUNTER_ALIAS                                                       0x074c
+#define regAZCONTROLLER1_WALL_CLOCK_COUNTER_ALIAS_BASE_IDX                                              1
+
+
+// addressBlock: dce_dc_hda_azendpoint_azdec
+// base address: 0x0
+#define regAZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                               0x0006
+#define regAZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                      0
+#define regAZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                              0x0006
+#define regAZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                     0
+
+
+// addressBlock: dce_dc_hda_azroot_azdec
+// base address: 0x0
+#define regAZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA                                       0x0006
+#define regAZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA_BASE_IDX                              0
+#define regAZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX                                      0x0006
+#define regAZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX_BASE_IDX                             0
+
+
+// addressBlock: dce_dc_hda_azstream0_azdec
+// base address: 0x0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x000e
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x000f
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0010
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0011
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x0012
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x0012
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x0014
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x0015
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0761
+#define regAZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream1_azdec
+// base address: 0x20
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x0016
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x0017
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0018
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0019
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x001a
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x001a
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x001c
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x001d
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0769
+#define regAZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream2_azdec
+// base address: 0x40
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x001e
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x001f
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0020
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0021
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x0022
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x0022
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x0024
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x0025
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0771
+#define regAZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream3_azdec
+// base address: 0x60
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x0026
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x0027
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0028
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0029
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x002a
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x002a
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x002c
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x002d
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0779
+#define regAZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream4_azdec
+// base address: 0x80
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x002e
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x002f
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0030
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0031
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x0032
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x0032
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x0034
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x0035
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0781
+#define regAZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream5_azdec
+// base address: 0xa0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x0036
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x0037
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0038
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0039
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x003a
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x003a
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x003c
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x003d
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0789
+#define regAZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream6_azdec
+// base address: 0xc0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x003e
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x003f
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0040
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0041
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x0042
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x0042
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x0044
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x0045
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0791
+#define regAZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_hda_azstream7_azdec
+// base address: 0xe0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS                                      0x0046
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS_BASE_IDX                             0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER                         0x0047
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_BASE_IDX                0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH                                    0x0048
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH_BASE_IDX                           0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX                                        0x0049
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX_BASE_IDX                               0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE                                               0x004a
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE_BASE_IDX                                      0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT                                                  0x004a
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT_BASE_IDX                                         0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS                          0x004c
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS                          0x004d
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS_BASE_IDX                 0
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS                   0x0799
+#define regAZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS_BASE_IDX          1
+
+
+// addressBlock: dce_dc_dccg_dccg_dispdec
+// base address: 0x0
+#define regPHYPLLA_PIXCLK_RESYNC_CNTL                                                                   0x0040
+#define regPHYPLLA_PIXCLK_RESYNC_CNTL_BASE_IDX                                                          1
+#define regPHYPLLB_PIXCLK_RESYNC_CNTL                                                                   0x0041
+#define regPHYPLLB_PIXCLK_RESYNC_CNTL_BASE_IDX                                                          1
+#define regPHYPLLC_PIXCLK_RESYNC_CNTL                                                                   0x0042
+#define regPHYPLLC_PIXCLK_RESYNC_CNTL_BASE_IDX                                                          1
+#define regPHYPLLD_PIXCLK_RESYNC_CNTL                                                                   0x0043
+#define regPHYPLLD_PIXCLK_RESYNC_CNTL_BASE_IDX                                                          1
+#define regDP_DTO_DBUF_EN                                                                               0x0044
+#define regDP_DTO_DBUF_EN_BASE_IDX                                                                      1
+#define regDSCCLK3_DTO_PARAM                                                                            0x0045
+#define regDSCCLK3_DTO_PARAM_BASE_IDX                                                                   1
+#define regDPREFCLK_CGTT_BLK_CTRL_REG                                                                   0x0048
+#define regDPREFCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                          1
+#define regDCCG_GATE_DISABLE_CNTL4                                                                      0x0049
+#define regDCCG_GATE_DISABLE_CNTL4_BASE_IDX                                                             1
+#define regDPSTREAMCLK_CNTL                                                                             0x004a
+#define regDPSTREAMCLK_CNTL_BASE_IDX                                                                    1
+#define regREFCLK_CGTT_BLK_CTRL_REG                                                                     0x004b
+#define regREFCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                            1
+#define regDCCG_GLOBAL_FGCG_REP_CNTL                                                                    0x0050
+#define regDCCG_GLOBAL_FGCG_REP_CNTL_BASE_IDX                                                           1
+#define regOTG_ADD_DROP_PIXEL_CNTL                                                                      0x0056
+#define regOTG_ADD_DROP_PIXEL_CNTL_BASE_IDX                                                             1
+#define regDIO_DME_MEM_RCLK_CNTL                                                                        0x0061
+#define regDIO_DME_MEM_RCLK_CNTL_BASE_IDX                                                               1
+#define regHPO_DME_MEM_RCLK_CNTL                                                                        0x0062
+#define regHPO_DME_MEM_RCLK_CNTL_BASE_IDX                                                               1
+#define regDCCG_GATE_DISABLE_CNTL7                                                                      0x0063
+#define regDCCG_GATE_DISABLE_CNTL7_BASE_IDX                                                             1
+#define regSYMCLK32_SE_CNTL                                                                             0x0065
+#define regSYMCLK32_SE_CNTL_BASE_IDX                                                                    1
+#define regSYMCLK32_LE_CNTL                                                                             0x0066
+#define regSYMCLK32_LE_CNTL_BASE_IDX                                                                    1
+#define regDTBCLK_P_CNTL                                                                                0x0068
+#define regDTBCLK_P_CNTL_BASE_IDX                                                                       1
+#define regDCCG_GATE_DISABLE_CNTL5                                                                      0x0069
+#define regDCCG_GATE_DISABLE_CNTL5_BASE_IDX                                                             1
+#define regDSCCLK0_DTO_PARAM                                                                            0x006c
+#define regDSCCLK0_DTO_PARAM_BASE_IDX                                                                   1
+#define regDSCCLK1_DTO_PARAM                                                                            0x006d
+#define regDSCCLK1_DTO_PARAM_BASE_IDX                                                                   1
+#define regDSCCLK2_DTO_PARAM                                                                            0x006e
+#define regDSCCLK2_DTO_PARAM_BASE_IDX                                                                   1
+#define regOTG_PIXEL_RATE_DIV                                                                           0x006f
+#define regOTG_PIXEL_RATE_DIV_BASE_IDX                                                                  1
+#define regMILLISECOND_TIME_BASE_DIV                                                                    0x0070
+#define regMILLISECOND_TIME_BASE_DIV_BASE_IDX                                                           1
+#define regDISPCLK_FREQ_CHANGE_CNTL                                                                     0x0071
+#define regDISPCLK_FREQ_CHANGE_CNTL_BASE_IDX                                                            1
+#define regDC_MEM_GLOBAL_PWR_REQ_CNTL                                                                   0x0072
+#define regDC_MEM_GLOBAL_PWR_REQ_CNTL_BASE_IDX                                                          1
+#define regDCCG_GATE_DISABLE_CNTL                                                                       0x0074
+#define regDCCG_GATE_DISABLE_CNTL_BASE_IDX                                                              1
+#define regDISPCLK_CGTT_BLK_CTRL_REG                                                                    0x0075
+#define regDISPCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                           1
+#define regSOCCLK_CGTT_BLK_CTRL_REG                                                                     0x0076
+#define regSOCCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                            1
+#define regMICROSECOND_TIME_BASE_DIV                                                                    0x007b
+#define regMICROSECOND_TIME_BASE_DIV_BASE_IDX                                                           1
+#define regDCCG_GATE_DISABLE_CNTL2                                                                      0x007c
+#define regDCCG_GATE_DISABLE_CNTL2_BASE_IDX                                                             1
+#define regSYMCLK_CGTT_BLK_CTRL_REG                                                                     0x007d
+#define regSYMCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                            1
+#define regOTG0_PIXEL_RATE_CNTL                                                                         0x0080
+#define regOTG0_PIXEL_RATE_CNTL_BASE_IDX                                                                1
+#define regDP_DTO0_PHASE                                                                                0x0081
+#define regDP_DTO0_PHASE_BASE_IDX                                                                       1
+#define regDP_DTO0_MODULO                                                                               0x0082
+#define regDP_DTO0_MODULO_BASE_IDX                                                                      1
+#define regOTG0_PHYPLL_PIXEL_RATE_CNTL                                                                  0x0083
+#define regOTG0_PHYPLL_PIXEL_RATE_CNTL_BASE_IDX                                                         1
+#define regOTG1_PIXEL_RATE_CNTL                                                                         0x0084
+#define regOTG1_PIXEL_RATE_CNTL_BASE_IDX                                                                1
+#define regDP_DTO1_PHASE                                                                                0x0085
+#define regDP_DTO1_PHASE_BASE_IDX                                                                       1
+#define regDP_DTO1_MODULO                                                                               0x0086
+#define regDP_DTO1_MODULO_BASE_IDX                                                                      1
+#define regOTG1_PHYPLL_PIXEL_RATE_CNTL                                                                  0x0087
+#define regOTG1_PHYPLL_PIXEL_RATE_CNTL_BASE_IDX                                                         1
+#define regOTG2_PIXEL_RATE_CNTL                                                                         0x0088
+#define regOTG2_PIXEL_RATE_CNTL_BASE_IDX                                                                1
+#define regDP_DTO2_PHASE                                                                                0x0089
+#define regDP_DTO2_PHASE_BASE_IDX                                                                       1
+#define regDP_DTO2_MODULO                                                                               0x008a
+#define regDP_DTO2_MODULO_BASE_IDX                                                                      1
+#define regOTG2_PHYPLL_PIXEL_RATE_CNTL                                                                  0x008b
+#define regOTG2_PHYPLL_PIXEL_RATE_CNTL_BASE_IDX                                                         1
+#define regOTG3_PIXEL_RATE_CNTL                                                                         0x008c
+#define regOTG3_PIXEL_RATE_CNTL_BASE_IDX                                                                1
+#define regDP_DTO3_PHASE                                                                                0x008d
+#define regDP_DTO3_PHASE_BASE_IDX                                                                       1
+#define regDP_DTO3_MODULO                                                                               0x008e
+#define regDP_DTO3_MODULO_BASE_IDX                                                                      1
+#define regOTG3_PHYPLL_PIXEL_RATE_CNTL                                                                  0x008f
+#define regOTG3_PHYPLL_PIXEL_RATE_CNTL_BASE_IDX                                                         1
+#define regDPPCLK_CGTT_BLK_CTRL_REG                                                                     0x0098
+#define regDPPCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                            1
+#define regDPPCLK0_DTO_PARAM                                                                            0x0099
+#define regDPPCLK0_DTO_PARAM_BASE_IDX                                                                   1
+#define regDPPCLK1_DTO_PARAM                                                                            0x009a
+#define regDPPCLK1_DTO_PARAM_BASE_IDX                                                                   1
+#define regDPPCLK2_DTO_PARAM                                                                            0x009b
+#define regDPPCLK2_DTO_PARAM_BASE_IDX                                                                   1
+#define regDPPCLK3_DTO_PARAM                                                                            0x009c
+#define regDPPCLK3_DTO_PARAM_BASE_IDX                                                                   1
+#define regSYMCLKA_CLOCK_ENABLE                                                                         0x00a0
+#define regSYMCLKA_CLOCK_ENABLE_BASE_IDX                                                                1
+#define regSYMCLKB_CLOCK_ENABLE                                                                         0x00a1
+#define regSYMCLKB_CLOCK_ENABLE_BASE_IDX                                                                1
+#define regSYMCLKC_CLOCK_ENABLE                                                                         0x00a2
+#define regSYMCLKC_CLOCK_ENABLE_BASE_IDX                                                                1
+#define regSYMCLKD_CLOCK_ENABLE                                                                         0x00a3
+#define regSYMCLKD_CLOCK_ENABLE_BASE_IDX                                                                1
+#define regDCCG_SOFT_RESET                                                                              0x00a6
+#define regDCCG_SOFT_RESET_BASE_IDX                                                                     1
+#define regDSCCLK_DTO_CTRL                                                                              0x00a7
+#define regDSCCLK_DTO_CTRL_BASE_IDX                                                                     1
+#define regDPPCLK_CTRL                                                                                  0x00a8
+#define regDPPCLK_CTRL_BASE_IDX                                                                         1
+#define regDCCG_GATE_DISABLE_CNTL6                                                                      0x00a9
+#define regDCCG_GATE_DISABLE_CNTL6_BASE_IDX                                                             1
+#define regSYMCLK_PSP_CNTL                                                                              0x00aa
+#define regSYMCLK_PSP_CNTL_BASE_IDX                                                                     1
+#define regDCCG_AUDIO_DTO_SOURCE                                                                        0x00ab
+#define regDCCG_AUDIO_DTO_SOURCE_BASE_IDX                                                               1
+#define regDCCG_AUDIO_DTO0_PHASE                                                                        0x00ac
+#define regDCCG_AUDIO_DTO0_PHASE_BASE_IDX                                                               1
+#define regDCCG_AUDIO_DTO0_MODULE                                                                       0x00ad
+#define regDCCG_AUDIO_DTO0_MODULE_BASE_IDX                                                              1
+#define regDCCG_AUDIO_DTO1_PHASE                                                                        0x00ae
+#define regDCCG_AUDIO_DTO1_PHASE_BASE_IDX                                                               1
+#define regDCCG_AUDIO_DTO1_MODULE                                                                       0x00af
+#define regDCCG_AUDIO_DTO1_MODULE_BASE_IDX                                                              1
+#define regDPPCLK_DTO_CTRL                                                                              0x00b6
+#define regDPPCLK_DTO_CTRL_BASE_IDX                                                                     1
+#define regDCCG_TEST_DEBUG_INDEX                                                                        0x00bc
+#define regDCCG_TEST_DEBUG_INDEX_BASE_IDX                                                               1
+#define regDCCG_TEST_DEBUG_DATA                                                                         0x00bd
+#define regDCCG_TEST_DEBUG_DATA_BASE_IDX                                                                1
+#define regHDMICHARCLK0_CLOCK_CNTL                                                                      0x004a
+#define regHDMICHARCLK0_CLOCK_CNTL_BASE_IDX                                                             2
+#define regPHYASYMCLK_CLOCK_CNTL                                                                        0x0052
+#define regPHYASYMCLK_CLOCK_CNTL_BASE_IDX                                                               2
+#define regPHYBSYMCLK_CLOCK_CNTL                                                                        0x0053
+#define regPHYBSYMCLK_CLOCK_CNTL_BASE_IDX                                                               2
+#define regPHYCSYMCLK_CLOCK_CNTL                                                                        0x0054
+#define regPHYCSYMCLK_CLOCK_CNTL_BASE_IDX                                                               2
+#define regPHYDSYMCLK_CLOCK_CNTL                                                                        0x0055
+#define regPHYDSYMCLK_CLOCK_CNTL_BASE_IDX                                                               2
+#define regHDMISTREAMCLK_CNTL                                                                           0x0059
+#define regHDMISTREAMCLK_CNTL_BASE_IDX                                                                  2
+#define regDCCG_GATE_DISABLE_CNTL3                                                                      0x005a
+#define regDCCG_GATE_DISABLE_CNTL3_BASE_IDX                                                             2
+#define regHDMISTREAMCLK0_DTO_PARAM                                                                     0x005b
+#define regHDMISTREAMCLK0_DTO_PARAM_BASE_IDX                                                            2
+#define regDSCCLK_SRC_SEL                                                                               0x0060
+#define regDSCCLK_SRC_SEL_BASE_IDX                                                                      2
+
+
+// addressBlock: dce_dc_dccg_dccg_dcperfmon0_dc_perfmon_dispdec
+// base address: 0x0
+#define regDC_PERFMON0_PERFCOUNTER_CNTL                                                                 0x0000
+#define regDC_PERFMON0_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON0_PERFCOUNTER_CNTL2                                                                0x0001
+#define regDC_PERFMON0_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON0_PERFCOUNTER_STATE                                                                0x0002
+#define regDC_PERFMON0_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON0_PERFMON_CNTL                                                                     0x0003
+#define regDC_PERFMON0_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON0_PERFMON_CNTL2                                                                    0x0004
+#define regDC_PERFMON0_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON0_PERFMON_CVALUE_INT_MISC                                                          0x0005
+#define regDC_PERFMON0_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON0_PERFMON_CVALUE_LOW                                                               0x0006
+#define regDC_PERFMON0_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON0_PERFMON_HI                                                                       0x0007
+#define regDC_PERFMON0_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON0_PERFMON_LOW                                                                      0x0008
+#define regDC_PERFMON0_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON0_PERFMON_TEST_DEBUG_INDEX                                                         0x0009
+#define regDC_PERFMON0_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON0_PERFMON_TEST_DEBUG_DATA                                                          0x000a
+#define regDC_PERFMON0_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dccg_dccg_dcperfmon1_dc_perfmon_dispdec
+// base address: 0x30
+#define regDC_PERFMON1_PERFCOUNTER_CNTL                                                                 0x000c
+#define regDC_PERFMON1_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON1_PERFCOUNTER_CNTL2                                                                0x000d
+#define regDC_PERFMON1_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON1_PERFCOUNTER_STATE                                                                0x000e
+#define regDC_PERFMON1_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON1_PERFMON_CNTL                                                                     0x000f
+#define regDC_PERFMON1_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON1_PERFMON_CNTL2                                                                    0x0010
+#define regDC_PERFMON1_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON1_PERFMON_CVALUE_INT_MISC                                                          0x0011
+#define regDC_PERFMON1_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON1_PERFMON_CVALUE_LOW                                                               0x0012
+#define regDC_PERFMON1_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON1_PERFMON_HI                                                                       0x0013
+#define regDC_PERFMON1_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON1_PERFMON_LOW                                                                      0x0014
+#define regDC_PERFMON1_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON1_PERFMON_TEST_DEBUG_INDEX                                                         0x0015
+#define regDC_PERFMON1_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON1_PERFMON_TEST_DEBUG_DATA                                                          0x0016
+#define regDC_PERFMON1_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dmu_fgsec_dispdec
+// base address: 0x0
+#define regSECURE_CHECK_CONFIG                                                                          0x016e
+#define regSECURE_CHECK_CONFIG_BASE_IDX                                                                 2
+#define regSECURE_GROUP0_CONFIG                                                                         0x016f
+#define regSECURE_GROUP0_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP1_CONFIG                                                                         0x0170
+#define regSECURE_GROUP1_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP2_CONFIG                                                                         0x0171
+#define regSECURE_GROUP2_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP3_CONFIG                                                                         0x0172
+#define regSECURE_GROUP3_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP4_CONFIG                                                                         0x0173
+#define regSECURE_GROUP4_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP5_CONFIG                                                                         0x0174
+#define regSECURE_GROUP5_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP6_CONFIG                                                                         0x0175
+#define regSECURE_GROUP6_CONFIG_BASE_IDX                                                                2
+#define regSECURE_GROUP7_CONFIG                                                                         0x0176
+#define regSECURE_GROUP7_CONFIG_BASE_IDX                                                                2
+#define regSECURE_INTERRUPT0_INFO0                                                                      0x0177
+#define regSECURE_INTERRUPT0_INFO0_BASE_IDX                                                             2
+#define regSECURE_INTERRUPT0_INFO1                                                                      0x0178
+#define regSECURE_INTERRUPT0_INFO1_BASE_IDX                                                             2
+#define regDMCUB_RBBMIF_SEC_CNTL                                                                        0x017a
+#define regDMCUB_RBBMIF_SEC_CNTL_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dmu_rbbmif_dispdec
+// base address: 0x0
+#define regRBBMIF_TIMEOUT                                                                               0x017f
+#define regRBBMIF_TIMEOUT_BASE_IDX                                                                      2
+#define regRBBMIF_STATUS                                                                                0x0180
+#define regRBBMIF_STATUS_BASE_IDX                                                                       2
+#define regRBBMIF_STATUS_2                                                                              0x0181
+#define regRBBMIF_STATUS_2_BASE_IDX                                                                     2
+#define regRBBMIF_INT_STATUS                                                                            0x0182
+#define regRBBMIF_INT_STATUS_BASE_IDX                                                                   2
+#define regRBBMIF_TIMEOUT_DIS                                                                           0x0183
+#define regRBBMIF_TIMEOUT_DIS_BASE_IDX                                                                  2
+#define regRBBMIF_TIMEOUT_DIS_2                                                                         0x0184
+#define regRBBMIF_TIMEOUT_DIS_2_BASE_IDX                                                                2
+#define regRBBMIF_STATUS_FLAG                                                                           0x0185
+#define regRBBMIF_STATUS_FLAG_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dmu_dmu_dcperfmon_dc_perfmon_dispdec
+// base address: 0x2f8
+#define regDC_PERFMON2_PERFCOUNTER_CNTL                                                                 0x00be
+#define regDC_PERFMON2_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON2_PERFCOUNTER_CNTL2                                                                0x00bf
+#define regDC_PERFMON2_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON2_PERFCOUNTER_STATE                                                                0x00c0
+#define regDC_PERFMON2_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON2_PERFMON_CNTL                                                                     0x00c1
+#define regDC_PERFMON2_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON2_PERFMON_CNTL2                                                                    0x00c2
+#define regDC_PERFMON2_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON2_PERFMON_CVALUE_INT_MISC                                                          0x00c3
+#define regDC_PERFMON2_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON2_PERFMON_CVALUE_LOW                                                               0x00c4
+#define regDC_PERFMON2_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON2_PERFMON_HI                                                                       0x00c5
+#define regDC_PERFMON2_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON2_PERFMON_LOW                                                                      0x00c6
+#define regDC_PERFMON2_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON2_PERFMON_TEST_DEBUG_INDEX                                                         0x00c7
+#define regDC_PERFMON2_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON2_PERFMON_TEST_DEBUG_DATA                                                          0x00c8
+#define regDC_PERFMON2_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dmu_ihc_dispdec
+// base address: 0x0
+#define regDC_GPU_TIMER_START_POSITION_V_UPDATE                                                         0x0126
+#define regDC_GPU_TIMER_START_POSITION_V_UPDATE_BASE_IDX                                                2
+#define regDC_GPU_TIMER_START_POSITION_VSTARTUP                                                         0x0127
+#define regDC_GPU_TIMER_START_POSITION_VSTARTUP_BASE_IDX                                                2
+#define regDC_GPU_TIMER_READ                                                                            0x0128
+#define regDC_GPU_TIMER_READ_BASE_IDX                                                                   2
+#define regDC_GPU_TIMER_READ_CNTL                                                                       0x0129
+#define regDC_GPU_TIMER_READ_CNTL_BASE_IDX                                                              2
+#define regDISP_INTERRUPT_STATUS                                                                        0x012a
+#define regDISP_INTERRUPT_STATUS_BASE_IDX                                                               2
+#define regDISP_INTERRUPT_STATUS_CONTINUE                                                               0x012b
+#define regDISP_INTERRUPT_STATUS_CONTINUE_BASE_IDX                                                      2
+#define regDISP_INTERRUPT_STATUS_CONTINUE2                                                              0x012c
+#define regDISP_INTERRUPT_STATUS_CONTINUE2_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE3                                                              0x012d
+#define regDISP_INTERRUPT_STATUS_CONTINUE3_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE4                                                              0x012e
+#define regDISP_INTERRUPT_STATUS_CONTINUE4_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE5                                                              0x012f
+#define regDISP_INTERRUPT_STATUS_CONTINUE5_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE6                                                              0x0130
+#define regDISP_INTERRUPT_STATUS_CONTINUE6_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE7                                                              0x0131
+#define regDISP_INTERRUPT_STATUS_CONTINUE7_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE8                                                              0x0132
+#define regDISP_INTERRUPT_STATUS_CONTINUE8_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE9                                                              0x0133
+#define regDISP_INTERRUPT_STATUS_CONTINUE9_BASE_IDX                                                     2
+#define regDISP_INTERRUPT_STATUS_CONTINUE10                                                             0x0134
+#define regDISP_INTERRUPT_STATUS_CONTINUE10_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE11                                                             0x0135
+#define regDISP_INTERRUPT_STATUS_CONTINUE11_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE12                                                             0x0136
+#define regDISP_INTERRUPT_STATUS_CONTINUE12_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE13                                                             0x0137
+#define regDISP_INTERRUPT_STATUS_CONTINUE13_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE14                                                             0x0138
+#define regDISP_INTERRUPT_STATUS_CONTINUE14_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE15                                                             0x0139
+#define regDISP_INTERRUPT_STATUS_CONTINUE15_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE16                                                             0x013a
+#define regDISP_INTERRUPT_STATUS_CONTINUE16_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE17                                                             0x013b
+#define regDISP_INTERRUPT_STATUS_CONTINUE17_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE18                                                             0x013c
+#define regDISP_INTERRUPT_STATUS_CONTINUE18_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE19                                                             0x013d
+#define regDISP_INTERRUPT_STATUS_CONTINUE19_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE20                                                             0x013e
+#define regDISP_INTERRUPT_STATUS_CONTINUE20_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE21                                                             0x013f
+#define regDISP_INTERRUPT_STATUS_CONTINUE21_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE22                                                             0x0140
+#define regDISP_INTERRUPT_STATUS_CONTINUE22_BASE_IDX                                                    2
+#define regDC_GPU_TIMER_START_POSITION_VREADY                                                           0x0141
+#define regDC_GPU_TIMER_START_POSITION_VREADY_BASE_IDX                                                  2
+#define regDC_GPU_TIMER_START_POSITION_FLIP                                                             0x0142
+#define regDC_GPU_TIMER_START_POSITION_FLIP_BASE_IDX                                                    2
+#define regDC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK                                                 0x0143
+#define regDC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK_BASE_IDX                                        2
+#define regDC_GPU_TIMER_START_POSITION_FLIP_AWAY                                                        0x0144
+#define regDC_GPU_TIMER_START_POSITION_FLIP_AWAY_BASE_IDX                                               2
+#define regDISP_INTERRUPT_STATUS_CONTINUE23                                                             0x0145
+#define regDISP_INTERRUPT_STATUS_CONTINUE23_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE24                                                             0x0146
+#define regDISP_INTERRUPT_STATUS_CONTINUE24_BASE_IDX                                                    2
+#define regDISP_INTERRUPT_STATUS_CONTINUE25                                                             0x0147
+#define regDISP_INTERRUPT_STATUS_CONTINUE25_BASE_IDX                                                    2
+#define regDCCG_INTERRUPT_DEST                                                                          0x0148
+#define regDCCG_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regDMU_INTERRUPT_DEST                                                                           0x0149
+#define regDMU_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regDMU_INTERRUPT_DEST2                                                                          0x014a
+#define regDMU_INTERRUPT_DEST2_BASE_IDX                                                                 2
+#define regDCPG_INTERRUPT_DEST                                                                          0x014b
+#define regDCPG_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regDCPG_INTERRUPT_DEST2                                                                         0x014c
+#define regDCPG_INTERRUPT_DEST2_BASE_IDX                                                                2
+#define regMMHUBBUB_INTERRUPT_DEST                                                                      0x014d
+#define regMMHUBBUB_INTERRUPT_DEST_BASE_IDX                                                             2
+#define regWB_INTERRUPT_DEST                                                                            0x014e
+#define regWB_INTERRUPT_DEST_BASE_IDX                                                                   2
+#define regDCHUB_INTERRUPT_DEST                                                                         0x014f
+#define regDCHUB_INTERRUPT_DEST_BASE_IDX                                                                2
+#define regDCHUB_PERFCOUNTER_INTERRUPT_DEST                                                             0x0150
+#define regDCHUB_PERFCOUNTER_INTERRUPT_DEST_BASE_IDX                                                    2
+#define regDCHUB_INTERRUPT_DEST2                                                                        0x0151
+#define regDCHUB_INTERRUPT_DEST2_BASE_IDX                                                               2
+#define regDPP_PERFCOUNTER_INTERRUPT_DEST                                                               0x0152
+#define regDPP_PERFCOUNTER_INTERRUPT_DEST_BASE_IDX                                                      2
+#define regMPC_INTERRUPT_DEST                                                                           0x0153
+#define regMPC_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regOPP_INTERRUPT_DEST                                                                           0x0154
+#define regOPP_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regOPTC_INTERRUPT_DEST                                                                          0x0155
+#define regOPTC_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG0_INTERRUPT_DEST                                                                          0x0156
+#define regOTG0_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG1_INTERRUPT_DEST                                                                          0x0157
+#define regOTG1_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG2_INTERRUPT_DEST                                                                          0x0158
+#define regOTG2_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG3_INTERRUPT_DEST                                                                          0x0159
+#define regOTG3_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG4_INTERRUPT_DEST                                                                          0x015a
+#define regOTG4_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regOTG5_INTERRUPT_DEST                                                                          0x015b
+#define regOTG5_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regDIG_INTERRUPT_DEST                                                                           0x015c
+#define regDIG_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regI2C_DDC_HPD_INTERRUPT_DEST                                                                   0x015d
+#define regI2C_DDC_HPD_INTERRUPT_DEST_BASE_IDX                                                          2
+#define regHDCP_INTERRUPT_DEST                                                                          0x015e
+#define regHDCP_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regDIO_INTERRUPT_DEST                                                                           0x015f
+#define regDIO_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regDCIO_INTERRUPT_DEST                                                                          0x0160
+#define regDCIO_INTERRUPT_DEST_BASE_IDX                                                                 2
+#define regHPD_INTERRUPT_DEST                                                                           0x0161
+#define regHPD_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regAZ_INTERRUPT_DEST                                                                            0x0162
+#define regAZ_INTERRUPT_DEST_BASE_IDX                                                                   2
+#define regAUX_INTERRUPT_DEST                                                                           0x0163
+#define regAUX_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regDSC_INTERRUPT_DEST                                                                           0x0164
+#define regDSC_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regHPO_INTERRUPT_DEST                                                                           0x0165
+#define regHPO_INTERRUPT_DEST_BASE_IDX                                                                  2
+#define regDPP_INTERRUPT_DEST                                                                           0x0166
+#define regDPP_INTERRUPT_DEST_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dmu_dmu_misc_dispdec
+// base address: 0x0
+#define regCC_DC_PIPE_DIS                                                                               0x00ca
+#define regCC_DC_PIPE_DIS_BASE_IDX                                                                      2
+#define regDMU_CLK_CNTL                                                                                 0x00cb
+#define regDMU_CLK_CNTL_BASE_IDX                                                                        2
+#define regDMCUB_SMU_INTERRUPT_CNTL                                                                     0x00cd
+#define regDMCUB_SMU_INTERRUPT_CNTL_BASE_IDX                                                            2
+#define regSMU_INTERRUPT_CONTROL                                                                        0x00ce
+#define regSMU_INTERRUPT_CONTROL_BASE_IDX                                                               2
+#define regDMU_MISC_ALLOW_DS_FORCE                                                                      0x00d6
+#define regDMU_MISC_ALLOW_DS_FORCE_BASE_IDX                                                             2
+#define regDMU_DISPCLK_CGTT_BLK_CTRL_REG                                                                0x00d8
+#define regDMU_DISPCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                       2
+#define regDMU_SOCCLK_CGTT_BLK_CTRL_REG                                                                 0x00d9
+#define regDMU_SOCCLK_CGTT_BLK_CTRL_REG_BASE_IDX                                                        2
+#define regDMU_MEM_PWR_REQ_CNTL                                                                         0x00db
+#define regDMU_MEM_PWR_REQ_CNTL_BASE_IDX                                                                2
+
+
+// addressBlock: dce_dc_dmu_dmcub_dispdec
+// base address: 0x0
+#define regDMCUB_REGION0_OFFSET                                                                         0x018e
+#define regDMCUB_REGION0_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION0_OFFSET_HIGH                                                                    0x018f
+#define regDMCUB_REGION0_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION1_OFFSET                                                                         0x0190
+#define regDMCUB_REGION1_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION1_OFFSET_HIGH                                                                    0x0191
+#define regDMCUB_REGION1_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION2_OFFSET                                                                         0x0192
+#define regDMCUB_REGION2_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION2_OFFSET_HIGH                                                                    0x0193
+#define regDMCUB_REGION2_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION2_ITCM_OFFSET                                                                    0x0194
+#define regDMCUB_REGION2_ITCM_OFFSET_BASE_IDX                                                           2
+#define regDMCUB_REGION2_ITCM_OFFSET_HIGH                                                               0x0195
+#define regDMCUB_REGION2_ITCM_OFFSET_HIGH_BASE_IDX                                                      2
+#define regDMCUB_REGION4_OFFSET                                                                         0x0196
+#define regDMCUB_REGION4_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION4_OFFSET_HIGH                                                                    0x0197
+#define regDMCUB_REGION4_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION5_OFFSET                                                                         0x0198
+#define regDMCUB_REGION5_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION5_OFFSET_HIGH                                                                    0x0199
+#define regDMCUB_REGION5_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION6_OFFSET                                                                         0x019a
+#define regDMCUB_REGION6_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION6_OFFSET_HIGH                                                                    0x019b
+#define regDMCUB_REGION6_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION7_OFFSET                                                                         0x019c
+#define regDMCUB_REGION7_OFFSET_BASE_IDX                                                                2
+#define regDMCUB_REGION7_OFFSET_HIGH                                                                    0x019d
+#define regDMCUB_REGION7_OFFSET_HIGH_BASE_IDX                                                           2
+#define regDMCUB_REGION0_TOP_ADDRESS                                                                    0x019e
+#define regDMCUB_REGION0_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION1_TOP_ADDRESS                                                                    0x019f
+#define regDMCUB_REGION1_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION2_TOP_ADDRESS                                                                    0x01a0
+#define regDMCUB_REGION2_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION4_TOP_ADDRESS                                                                    0x01a1
+#define regDMCUB_REGION4_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION5_TOP_ADDRESS                                                                    0x01a2
+#define regDMCUB_REGION5_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION6_TOP_ADDRESS                                                                    0x01a3
+#define regDMCUB_REGION6_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION7_TOP_ADDRESS                                                                    0x01a4
+#define regDMCUB_REGION7_TOP_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_REGION3_CW0_BASE_ADDRESS                                                               0x01a5
+#define regDMCUB_REGION3_CW0_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW1_BASE_ADDRESS                                                               0x01a6
+#define regDMCUB_REGION3_CW1_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW2_BASE_ADDRESS                                                               0x01a7
+#define regDMCUB_REGION3_CW2_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW3_BASE_ADDRESS                                                               0x01a8
+#define regDMCUB_REGION3_CW3_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW4_BASE_ADDRESS                                                               0x01a9
+#define regDMCUB_REGION3_CW4_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW5_BASE_ADDRESS                                                               0x01aa
+#define regDMCUB_REGION3_CW5_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW6_BASE_ADDRESS                                                               0x01ab
+#define regDMCUB_REGION3_CW6_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW7_BASE_ADDRESS                                                               0x01ac
+#define regDMCUB_REGION3_CW7_BASE_ADDRESS_BASE_IDX                                                      2
+#define regDMCUB_REGION3_CW0_TOP_ADDRESS                                                                0x01ad
+#define regDMCUB_REGION3_CW0_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW1_TOP_ADDRESS                                                                0x01ae
+#define regDMCUB_REGION3_CW1_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW2_TOP_ADDRESS                                                                0x01af
+#define regDMCUB_REGION3_CW2_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW3_TOP_ADDRESS                                                                0x01b0
+#define regDMCUB_REGION3_CW3_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW4_TOP_ADDRESS                                                                0x01b1
+#define regDMCUB_REGION3_CW4_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW5_TOP_ADDRESS                                                                0x01b2
+#define regDMCUB_REGION3_CW5_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW6_TOP_ADDRESS                                                                0x01b3
+#define regDMCUB_REGION3_CW6_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW7_TOP_ADDRESS                                                                0x01b4
+#define regDMCUB_REGION3_CW7_TOP_ADDRESS_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW0_OFFSET                                                                     0x01b5
+#define regDMCUB_REGION3_CW0_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW0_OFFSET_HIGH                                                                0x01b6
+#define regDMCUB_REGION3_CW0_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW1_OFFSET                                                                     0x01b7
+#define regDMCUB_REGION3_CW1_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW1_OFFSET_HIGH                                                                0x01b8
+#define regDMCUB_REGION3_CW1_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW2_OFFSET                                                                     0x01b9
+#define regDMCUB_REGION3_CW2_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW2_OFFSET_HIGH                                                                0x01ba
+#define regDMCUB_REGION3_CW2_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW3_OFFSET                                                                     0x01bb
+#define regDMCUB_REGION3_CW3_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW3_OFFSET_HIGH                                                                0x01bc
+#define regDMCUB_REGION3_CW3_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW4_OFFSET                                                                     0x01bd
+#define regDMCUB_REGION3_CW4_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW4_OFFSET_HIGH                                                                0x01be
+#define regDMCUB_REGION3_CW4_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW5_OFFSET                                                                     0x01bf
+#define regDMCUB_REGION3_CW5_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW5_OFFSET_HIGH                                                                0x01c0
+#define regDMCUB_REGION3_CW5_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW6_OFFSET                                                                     0x01c1
+#define regDMCUB_REGION3_CW6_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW6_OFFSET_HIGH                                                                0x01c2
+#define regDMCUB_REGION3_CW6_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_REGION3_CW7_OFFSET                                                                     0x01c3
+#define regDMCUB_REGION3_CW7_OFFSET_BASE_IDX                                                            2
+#define regDMCUB_REGION3_CW7_OFFSET_HIGH                                                                0x01c4
+#define regDMCUB_REGION3_CW7_OFFSET_HIGH_BASE_IDX                                                       2
+#define regDMCUB_INTERRUPT_ENABLE                                                                       0x01c5
+#define regDMCUB_INTERRUPT_ENABLE_BASE_IDX                                                              2
+#define regDMCUB_INTERRUPT_ACK                                                                          0x01c6
+#define regDMCUB_INTERRUPT_ACK_BASE_IDX                                                                 2
+#define regDMCUB_INTERRUPT_STATUS                                                                       0x01c7
+#define regDMCUB_INTERRUPT_STATUS_BASE_IDX                                                              2
+#define regDMCUB_INTERRUPT_TYPE                                                                         0x01c8
+#define regDMCUB_INTERRUPT_TYPE_BASE_IDX                                                                2
+#define regDMCUB_EXT_INTERRUPT_STATUS                                                                   0x01c9
+#define regDMCUB_EXT_INTERRUPT_STATUS_BASE_IDX                                                          2
+#define regDMCUB_EXT_INTERRUPT_CTXID                                                                    0x01ca
+#define regDMCUB_EXT_INTERRUPT_CTXID_BASE_IDX                                                           2
+#define regDMCUB_EXT_INTERRUPT_ACK                                                                      0x01cb
+#define regDMCUB_EXT_INTERRUPT_ACK_BASE_IDX                                                             2
+#define regDMCUB_INST_FETCH_FAULT_ADDR                                                                  0x01cc
+#define regDMCUB_INST_FETCH_FAULT_ADDR_BASE_IDX                                                         2
+#define regDMCUB_DATA_WRITE_FAULT_ADDR                                                                  0x01cd
+#define regDMCUB_DATA_WRITE_FAULT_ADDR_BASE_IDX                                                         2
+#define regDMCUB_SEC_CNTL                                                                               0x01ce
+#define regDMCUB_SEC_CNTL_BASE_IDX                                                                      2
+#define regDMCUB_MEM_CNTL                                                                               0x01cf
+#define regDMCUB_MEM_CNTL_BASE_IDX                                                                      2
+#define regDMCUB_INBOX0_BASE_ADDRESS                                                                    0x01d0
+#define regDMCUB_INBOX0_BASE_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_INBOX0_SIZE                                                                            0x01d1
+#define regDMCUB_INBOX0_SIZE_BASE_IDX                                                                   2
+#define regDMCUB_INBOX0_WPTR                                                                            0x01d2
+#define regDMCUB_INBOX0_WPTR_BASE_IDX                                                                   2
+#define regDMCUB_INBOX0_RPTR                                                                            0x01d3
+#define regDMCUB_INBOX0_RPTR_BASE_IDX                                                                   2
+#define regDMCUB_INBOX1_BASE_ADDRESS                                                                    0x01d4
+#define regDMCUB_INBOX1_BASE_ADDRESS_BASE_IDX                                                           2
+#define regDMCUB_INBOX1_SIZE                                                                            0x01d5
+#define regDMCUB_INBOX1_SIZE_BASE_IDX                                                                   2
+#define regDMCUB_INBOX1_WPTR                                                                            0x01d6
+#define regDMCUB_INBOX1_WPTR_BASE_IDX                                                                   2
+#define regDMCUB_INBOX1_RPTR                                                                            0x01d7
+#define regDMCUB_INBOX1_RPTR_BASE_IDX                                                                   2
+#define regDMCUB_OUTBOX0_BASE_ADDRESS                                                                   0x01d8
+#define regDMCUB_OUTBOX0_BASE_ADDRESS_BASE_IDX                                                          2
+#define regDMCUB_OUTBOX0_SIZE                                                                           0x01d9
+#define regDMCUB_OUTBOX0_SIZE_BASE_IDX                                                                  2
+#define regDMCUB_OUTBOX0_WPTR                                                                           0x01da
+#define regDMCUB_OUTBOX0_WPTR_BASE_IDX                                                                  2
+#define regDMCUB_OUTBOX0_RPTR                                                                           0x01db
+#define regDMCUB_OUTBOX0_RPTR_BASE_IDX                                                                  2
+#define regDMCUB_OUTBOX1_BASE_ADDRESS                                                                   0x01dc
+#define regDMCUB_OUTBOX1_BASE_ADDRESS_BASE_IDX                                                          2
+#define regDMCUB_OUTBOX1_SIZE                                                                           0x01dd
+#define regDMCUB_OUTBOX1_SIZE_BASE_IDX                                                                  2
+#define regDMCUB_OUTBOX1_WPTR                                                                           0x01de
+#define regDMCUB_OUTBOX1_WPTR_BASE_IDX                                                                  2
+#define regDMCUB_OUTBOX1_RPTR                                                                           0x01df
+#define regDMCUB_OUTBOX1_RPTR_BASE_IDX                                                                  2
+#define regDMCUB_TIMER_TRIGGER0                                                                         0x01e0
+#define regDMCUB_TIMER_TRIGGER0_BASE_IDX                                                                2
+#define regDMCUB_TIMER_TRIGGER1                                                                         0x01e1
+#define regDMCUB_TIMER_TRIGGER1_BASE_IDX                                                                2
+#define regDMCUB_TIMER_WINDOW                                                                           0x01e2
+#define regDMCUB_TIMER_WINDOW_BASE_IDX                                                                  2
+#define regDMCUB_SCRATCH0                                                                               0x01e3
+#define regDMCUB_SCRATCH0_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH1                                                                               0x01e4
+#define regDMCUB_SCRATCH1_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH2                                                                               0x01e5
+#define regDMCUB_SCRATCH2_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH3                                                                               0x01e6
+#define regDMCUB_SCRATCH3_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH4                                                                               0x01e7
+#define regDMCUB_SCRATCH4_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH5                                                                               0x01e8
+#define regDMCUB_SCRATCH5_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH6                                                                               0x01e9
+#define regDMCUB_SCRATCH6_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH7                                                                               0x01ea
+#define regDMCUB_SCRATCH7_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH8                                                                               0x01eb
+#define regDMCUB_SCRATCH8_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH9                                                                               0x01ec
+#define regDMCUB_SCRATCH9_BASE_IDX                                                                      2
+#define regDMCUB_SCRATCH10                                                                              0x01ed
+#define regDMCUB_SCRATCH10_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH11                                                                              0x01ee
+#define regDMCUB_SCRATCH11_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH12                                                                              0x01ef
+#define regDMCUB_SCRATCH12_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH13                                                                              0x01f0
+#define regDMCUB_SCRATCH13_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH14                                                                              0x01f1
+#define regDMCUB_SCRATCH14_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH15                                                                              0x01f2
+#define regDMCUB_SCRATCH15_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH16                                                                              0x01f3
+#define regDMCUB_SCRATCH16_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH17                                                                              0x01f4
+#define regDMCUB_SCRATCH17_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH18                                                                              0x01f5
+#define regDMCUB_SCRATCH18_BASE_IDX                                                                     2
+#define regDMCUB_CNTL                                                                                   0x01f6
+#define regDMCUB_CNTL_BASE_IDX                                                                          2
+#define regDMCUB_GPINT_DATAIN0                                                                          0x01f7
+#define regDMCUB_GPINT_DATAIN0_BASE_IDX                                                                 2
+#define regDMCUB_GPINT_DATAIN1                                                                          0x01f8
+#define regDMCUB_GPINT_DATAIN1_BASE_IDX                                                                 2
+#define regDMCUB_GPINT_DATAOUT                                                                          0x01f9
+#define regDMCUB_GPINT_DATAOUT_BASE_IDX                                                                 2
+#define regDMCUB_UNDEFINED_ADDRESS_FAULT_ADDR                                                           0x01fa
+#define regDMCUB_UNDEFINED_ADDRESS_FAULT_ADDR_BASE_IDX                                                  2
+#define regDMCUB_LS_WAKE_INT_ENABLE                                                                     0x01fb
+#define regDMCUB_LS_WAKE_INT_ENABLE_BASE_IDX                                                            2
+#define regDMCUB_MEM_PWR_CNTL                                                                           0x01fc
+#define regDMCUB_MEM_PWR_CNTL_BASE_IDX                                                                  2
+#define regDMCUB_TIMER_CURRENT                                                                          0x01fd
+#define regDMCUB_TIMER_CURRENT_BASE_IDX                                                                 2
+#define regDMCUB_DBG_BUS_SELECT                                                                         0x01fe
+#define regDMCUB_DBG_BUS_SELECT_BASE_IDX                                                                2
+#define regDMCUB_PROC_ID                                                                                0x01ff
+#define regDMCUB_PROC_ID_BASE_IDX                                                                       2
+#define regDMCUB_CNTL2                                                                                  0x0200
+#define regDMCUB_CNTL2_BASE_IDX                                                                         2
+#define regDMCUB_RSMU_WHITELIST_STATUS                                                                  0x0201
+#define regDMCUB_RSMU_WHITELIST_STATUS_BASE_IDX                                                         2
+#define regDMCUB_RSMU_REG_STATUS                                                                        0x0202
+#define regDMCUB_RSMU_REG_STATUS_BASE_IDX                                                               2
+#define regDMCUB_RSMU_REG_APER_ID                                                                       0x0203
+#define regDMCUB_RSMU_REG_APER_ID_BASE_IDX                                                              2
+#define regDMCUB_RSMU_MASTER_A_REG_SEC_FLAG                                                             0x0204
+#define regDMCUB_RSMU_MASTER_A_REG_SEC_FLAG_BASE_IDX                                                    2
+#define regRSMU_MASTER_A_WHITELIST0_BASE                                                                0x0205
+#define regRSMU_MASTER_A_WHITELIST0_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_A_WHITELIST0_TOP                                                                 0x0206
+#define regRSMU_MASTER_A_WHITELIST0_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_A_WHITELIST1_BASE                                                                0x0207
+#define regRSMU_MASTER_A_WHITELIST1_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_A_WHITELIST1_TOP                                                                 0x0208
+#define regRSMU_MASTER_A_WHITELIST1_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_A_WHITELIST2_BASE                                                                0x0209
+#define regRSMU_MASTER_A_WHITELIST2_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_A_WHITELIST2_TOP                                                                 0x020a
+#define regRSMU_MASTER_A_WHITELIST2_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_A_WHITELIST3_BASE                                                                0x020b
+#define regRSMU_MASTER_A_WHITELIST3_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_A_WHITELIST3_TOP                                                                 0x020c
+#define regRSMU_MASTER_A_WHITELIST3_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_B_WHITELIST0_BASE                                                                0x020d
+#define regRSMU_MASTER_B_WHITELIST0_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_B_WHITELIST0_TOP                                                                 0x020e
+#define regRSMU_MASTER_B_WHITELIST0_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_B_WHITELIST1_BASE                                                                0x020f
+#define regRSMU_MASTER_B_WHITELIST1_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_B_WHITELIST1_TOP                                                                 0x0210
+#define regRSMU_MASTER_B_WHITELIST1_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_B_WHITELIST2_BASE                                                                0x0211
+#define regRSMU_MASTER_B_WHITELIST2_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_B_WHITELIST2_TOP                                                                 0x0212
+#define regRSMU_MASTER_B_WHITELIST2_TOP_BASE_IDX                                                        2
+#define regRSMU_MASTER_B_WHITELIST3_BASE                                                                0x0213
+#define regRSMU_MASTER_B_WHITELIST3_BASE_BASE_IDX                                                       2
+#define regRSMU_MASTER_B_WHITELIST3_TOP                                                                 0x0214
+#define regRSMU_MASTER_B_WHITELIST3_TOP_BASE_IDX                                                        2
+#define regDMCUB_GPINT_DATAIN2                                                                          0x0215
+#define regDMCUB_GPINT_DATAIN2_BASE_IDX                                                                 2
+#define regDMCUB_GPINT_DATAIN3                                                                          0x0216
+#define regDMCUB_GPINT_DATAIN3_BASE_IDX                                                                 2
+#define regDMCUB_GPINT_DATAIN4                                                                          0x0217
+#define regDMCUB_GPINT_DATAIN4_BASE_IDX                                                                 2
+#define regDMCUB_REGION2_ITCM_SRC_TOP_ADDRESS                                                           0x0218
+#define regDMCUB_REGION2_ITCM_SRC_TOP_ADDRESS_BASE_IDX                                                  2
+#define regDMCUB_REGION3_TMR_AXI_SPACE                                                                  0x021a
+#define regDMCUB_REGION3_TMR_AXI_SPACE_BASE_IDX                                                         2
+#define regDMCUB_SCRATCH19                                                                              0x021b
+#define regDMCUB_SCRATCH19_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH20                                                                              0x021c
+#define regDMCUB_SCRATCH20_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH21                                                                              0x021d
+#define regDMCUB_SCRATCH21_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH22                                                                              0x021e
+#define regDMCUB_SCRATCH22_BASE_IDX                                                                     2
+#define regDMCUB_SCRATCH23                                                                              0x021f
+#define regDMCUB_SCRATCH23_BASE_IDX                                                                     2
+#define regDMCUB_TEST_DEBUG_INDEX                                                                       0x0220
+#define regDMCUB_TEST_DEBUG_INDEX_BASE_IDX                                                              2
+#define regDMCUB_TEST_DEBUG_DATA                                                                        0x0221
+#define regDMCUB_TEST_DEBUG_DATA_BASE_IDX                                                               2
+#define regHOST_INTERRUPT_CSR                                                                           0x0222
+#define regHOST_INTERRUPT_CSR_BASE_IDX                                                                  2
+#define regDMCUB_REG_INBOX0_RDY                                                                         0x0223
+#define regDMCUB_REG_INBOX0_RDY_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX0_MSG0                                                                        0x0224
+#define regDMCUB_REG_INBOX0_MSG0_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG1                                                                        0x0225
+#define regDMCUB_REG_INBOX0_MSG1_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG2                                                                        0x0226
+#define regDMCUB_REG_INBOX0_MSG2_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG3                                                                        0x0227
+#define regDMCUB_REG_INBOX0_MSG3_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG4                                                                        0x0228
+#define regDMCUB_REG_INBOX0_MSG4_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG5                                                                        0x0229
+#define regDMCUB_REG_INBOX0_MSG5_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG6                                                                        0x022a
+#define regDMCUB_REG_INBOX0_MSG6_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG7                                                                        0x022b
+#define regDMCUB_REG_INBOX0_MSG7_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG8                                                                        0x022c
+#define regDMCUB_REG_INBOX0_MSG8_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG9                                                                        0x022d
+#define regDMCUB_REG_INBOX0_MSG9_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX0_MSG10                                                                       0x022e
+#define regDMCUB_REG_INBOX0_MSG10_BASE_IDX                                                              2
+#define regDMCUB_REG_INBOX0_MSG11                                                                       0x022f
+#define regDMCUB_REG_INBOX0_MSG11_BASE_IDX                                                              2
+#define regDMCUB_REG_INBOX0_MSG12                                                                       0x0230
+#define regDMCUB_REG_INBOX0_MSG12_BASE_IDX                                                              2
+#define regDMCUB_REG_INBOX0_MSG13                                                                       0x0231
+#define regDMCUB_REG_INBOX0_MSG13_BASE_IDX                                                              2
+#define regDMCUB_REG_INBOX0_MSG14                                                                       0x0232
+#define regDMCUB_REG_INBOX0_MSG14_BASE_IDX                                                              2
+#define regDMCUB_REG_INBOX0_RSP                                                                         0x0233
+#define regDMCUB_REG_INBOX0_RSP_BASE_IDX                                                                2
+#define regDMCUB_REG_OUTBOX0_RDY                                                                        0x0234
+#define regDMCUB_REG_OUTBOX0_RDY_BASE_IDX                                                               2
+#define regDMCUB_REG_OUTBOX0_MSG0                                                                       0x0235
+#define regDMCUB_REG_OUTBOX0_MSG0_BASE_IDX                                                              2
+#define regDMCUB_REG_OUTBOX0_RSP                                                                        0x0236
+#define regDMCUB_REG_OUTBOX0_RSP_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX1_RDY                                                                         0x0237
+#define regDMCUB_REG_INBOX1_RDY_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX1_MSG0                                                                        0x0238
+#define regDMCUB_REG_INBOX1_MSG0_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX1_MSG1                                                                        0x0239
+#define regDMCUB_REG_INBOX1_MSG1_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX1_RSP                                                                         0x023a
+#define regDMCUB_REG_INBOX1_RSP_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX1_INTERRUPT_CSR                                                               0x023b
+#define regDMCUB_REG_INBOX1_INTERRUPT_CSR_BASE_IDX                                                      2
+#define regDMCUB_REG_INBOX2_RDY                                                                         0x023c
+#define regDMCUB_REG_INBOX2_RDY_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX2_MSG0                                                                        0x023d
+#define regDMCUB_REG_INBOX2_MSG0_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX2_MSG1                                                                        0x023e
+#define regDMCUB_REG_INBOX2_MSG1_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX2_RSP                                                                         0x023f
+#define regDMCUB_REG_INBOX2_RSP_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX3_RDY                                                                         0x0240
+#define regDMCUB_REG_INBOX3_RDY_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX3_MSG0                                                                        0x0241
+#define regDMCUB_REG_INBOX3_MSG0_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX3_MSG1                                                                        0x0242
+#define regDMCUB_REG_INBOX3_MSG1_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX3_RSP                                                                         0x0243
+#define regDMCUB_REG_INBOX3_RSP_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX4_RDY                                                                         0x0244
+#define regDMCUB_REG_INBOX4_RDY_BASE_IDX                                                                2
+#define regDMCUB_REG_INBOX4_MSG0                                                                        0x0245
+#define regDMCUB_REG_INBOX4_MSG0_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX4_MSG1                                                                        0x0246
+#define regDMCUB_REG_INBOX4_MSG1_BASE_IDX                                                               2
+#define regDMCUB_REG_INBOX4_RSP                                                                         0x0247
+#define regDMCUB_REG_INBOX4_RSP_BASE_IDX                                                                2
+#define regDMCUB_RSMU_MASTER_B_REG_SEC_FLAG                                                             0x0248
+#define regDMCUB_RSMU_MASTER_B_REG_SEC_FLAG_BASE_IDX                                                    2
+#define regDMCUB_IDLE_HYSTERESIS_CSR                                                                    0x0249
+#define regDMCUB_IDLE_HYSTERESIS_CSR_BASE_IDX                                                           2
+
+
+// addressBlock: dce_dc_mmhubbub_mmhubbub_dcperfmon_dc_perfmon_dispdec
+// base address: 0xd48
+#define regDC_PERFMON3_PERFCOUNTER_CNTL                                                                 0x0352
+#define regDC_PERFMON3_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON3_PERFCOUNTER_CNTL2                                                                0x0353
+#define regDC_PERFMON3_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON3_PERFCOUNTER_STATE                                                                0x0354
+#define regDC_PERFMON3_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON3_PERFMON_CNTL                                                                     0x0355
+#define regDC_PERFMON3_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON3_PERFMON_CNTL2                                                                    0x0356
+#define regDC_PERFMON3_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON3_PERFMON_CVALUE_INT_MISC                                                          0x0357
+#define regDC_PERFMON3_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON3_PERFMON_CVALUE_LOW                                                               0x0358
+#define regDC_PERFMON3_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON3_PERFMON_HI                                                                       0x0359
+#define regDC_PERFMON3_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON3_PERFMON_LOW                                                                      0x035a
+#define regDC_PERFMON3_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON3_PERFMON_TEST_DEBUG_INDEX                                                         0x035b
+#define regDC_PERFMON3_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON3_PERFMON_TEST_DEBUG_DATA                                                          0x035c
+#define regDC_PERFMON3_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_mmhubbub_mmhubbub_dispdec
+// base address: 0x0
+#define regMCIF_WB_NB_PSTATE_LATENCY_WATERMARK                                                          0x0262
+#define regMCIF_WB_NB_PSTATE_LATENCY_WATERMARK_BASE_IDX                                                 2
+#define regMCIF_WB_WATERMARK                                                                            0x0263
+#define regMCIF_WB_WATERMARK_BASE_IDX                                                                   2
+#define regMMHUBBUB_WARMUP_CONFIG                                                                       0x0264
+#define regMMHUBBUB_WARMUP_CONFIG_BASE_IDX                                                              2
+#define regMMHUBBUB_WARMUP_CONTROL_STATUS                                                               0x0265
+#define regMMHUBBUB_WARMUP_CONTROL_STATUS_BASE_IDX                                                      2
+#define regMMHUBBUB_WARMUP_BASE_ADDR_LOW                                                                0x0266
+#define regMMHUBBUB_WARMUP_BASE_ADDR_LOW_BASE_IDX                                                       2
+#define regMMHUBBUB_WARMUP_BASE_ADDR_HIGH                                                               0x0267
+#define regMMHUBBUB_WARMUP_BASE_ADDR_HIGH_BASE_IDX                                                      2
+#define regMMHUBBUB_WARMUP_ADDR_REGION                                                                  0x0268
+#define regMMHUBBUB_WARMUP_ADDR_REGION_BASE_IDX                                                         2
+#define regMMHUBBUB_MIN_TTO                                                                             0x0269
+#define regMMHUBBUB_MIN_TTO_BASE_IDX                                                                    2
+#define regMMHUBBUB_CTRL                                                                                0x0333
+#define regMMHUBBUB_CTRL_BASE_IDX                                                                       2
+#define regWBIF_SMU_WM_CONTROL                                                                          0x0334
+#define regWBIF_SMU_WM_CONTROL_BASE_IDX                                                                 2
+#define regMMHUBBUB_MEM_PWR_STATUS                                                                      0x033e
+#define regMMHUBBUB_MEM_PWR_STATUS_BASE_IDX                                                             2
+#define regMMHUBBUB_MEM_PWR_CNTL                                                                        0x033f
+#define regMMHUBBUB_MEM_PWR_CNTL_BASE_IDX                                                               2
+#define regMMHUBBUB_CLOCK_CNTL                                                                          0x0340
+#define regMMHUBBUB_CLOCK_CNTL_BASE_IDX                                                                 2
+#define regMMHUBBUB_SOFT_RESET                                                                          0x0341
+#define regMMHUBBUB_SOFT_RESET_BASE_IDX                                                                 2
+#define regDMU_IF_ERR_STATUS                                                                            0x0345
+#define regDMU_IF_ERR_STATUS_BASE_IDX                                                                   2
+#define regMMHUBBUB_CLIENT_UNIT_ID                                                                      0x0346
+#define regMMHUBBUB_CLIENT_UNIT_ID_BASE_IDX                                                             2
+#define regMMHUBBUB_WARMUP_SECURITY_CFG                                                                 0x0347
+#define regMMHUBBUB_WARMUP_SECURITY_CFG_BASE_IDX                                                        2
+#define regMMHUBBUB_WARMUP_VMID_CONTROL                                                                 0x0348
+#define regMMHUBBUB_WARMUP_VMID_CONTROL_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_hda_azf0controller_dispdec
+// base address: 0x0
+#define regAZALIA_CONTROLLER_CLOCK_GATING                                                               0x03c2
+#define regAZALIA_CONTROLLER_CLOCK_GATING_BASE_IDX                                                      2
+#define regAZALIA_AUDIO_DTO                                                                             0x03c3
+#define regAZALIA_AUDIO_DTO_BASE_IDX                                                                    2
+#define regAZALIA_AUDIO_DTO_CONTROL                                                                     0x03c4
+#define regAZALIA_AUDIO_DTO_CONTROL_BASE_IDX                                                            2
+#define regAZALIA_SOCCLK_CONTROL                                                                        0x03c5
+#define regAZALIA_SOCCLK_CONTROL_BASE_IDX                                                               2
+#define regAZALIA_UNDERFLOW_FILLER_SAMPLE                                                               0x03c6
+#define regAZALIA_UNDERFLOW_FILLER_SAMPLE_BASE_IDX                                                      2
+#define regAZALIA_DATA_DMA_CONTROL                                                                      0x03c7
+#define regAZALIA_DATA_DMA_CONTROL_BASE_IDX                                                             2
+#define regAZALIA_BDL_DMA_CONTROL                                                                       0x03c8
+#define regAZALIA_BDL_DMA_CONTROL_BASE_IDX                                                              2
+#define regAZALIA_RIRB_AND_DP_CONTROL                                                                   0x03c9
+#define regAZALIA_RIRB_AND_DP_CONTROL_BASE_IDX                                                          2
+#define regAZALIA_CORB_DMA_CONTROL                                                                      0x03ca
+#define regAZALIA_CORB_DMA_CONTROL_BASE_IDX                                                             2
+#define regAZALIA_GLOBAL_CAPABILITIES                                                                   0x03d3
+#define regAZALIA_GLOBAL_CAPABILITIES_BASE_IDX                                                          2
+#define regAZALIA_OUTPUT_PAYLOAD_CAPABILITY                                                             0x03d4
+#define regAZALIA_OUTPUT_PAYLOAD_CAPABILITY_BASE_IDX                                                    2
+#define regAZALIA_OUTPUT_STREAM_ARBITER_CONTROL                                                         0x03d5
+#define regAZALIA_OUTPUT_STREAM_ARBITER_CONTROL_BASE_IDX                                                2
+#define regAZALIA_INPUT_PAYLOAD_CAPABILITY                                                              0x03d6
+#define regAZALIA_INPUT_PAYLOAD_CAPABILITY_BASE_IDX                                                     2
+#define regAZALIA_CONTROLLER_DEBUG                                                                      0x03d7
+#define regAZALIA_CONTROLLER_DEBUG_BASE_IDX                                                             2
+#define regAZALIA_MEM_PWR_CTRL                                                                          0x03ee
+#define regAZALIA_MEM_PWR_CTRL_BASE_IDX                                                                 2
+#define regAZALIA_MEM_PWR_STATUS                                                                        0x03ef
+#define regAZALIA_MEM_PWR_STATUS_BASE_IDX                                                               2
+#define regDCI_PG_DEBUG_CONFIG                                                                          0x03f0
+#define regDCI_PG_DEBUG_CONFIG_BASE_IDX                                                                 2
+
+
+// addressBlock: dce_dc_hda_azf0root_dispdec
+// base address: 0x0
+#define regAZALIA_F0_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID                                          0x0406
+#define regAZALIA_F0_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID_BASE_IDX                                 2
+#define regAZALIA_F0_CODEC_ROOT_PARAMETER_REVISION_ID                                                   0x0407
+#define regAZALIA_F0_CODEC_ROOT_PARAMETER_REVISION_ID_BASE_IDX                                          2
+#define regAZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL                                                        0x0408
+#define regAZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL_BASE_IDX                                               2
+#define regAZALIA_F0_CODEC_RESYNC_FIFO_CONTROL                                                          0x0409
+#define regAZALIA_F0_CODEC_RESYNC_FIFO_CONTROL_BASE_IDX                                                 2
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_GROUP_TYPE                                                0x040a
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_GROUP_TYPE_BASE_IDX                                       2
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES                                      0x040b
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES_BASE_IDX                             2
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS                                            0x040c
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS_BASE_IDX                                   2
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES                                              0x040d
+#define regAZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES_BASE_IDX                                     2
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE                                                 0x040e
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE_BASE_IDX                                        2
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_RESET                                                       0x040f
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_RESET_BASE_IDX                                              2
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID                                       0x0410
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_BASE_IDX                              2
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION                                   0x0411
+#define regAZALIA_F0_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION_BASE_IDX                          2
+#define regCC_RCU_DC_AUDIO_PORT_CONNECTIVITY                                                            0x0412
+#define regCC_RCU_DC_AUDIO_PORT_CONNECTIVITY_BASE_IDX                                                   2
+#define regCC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY                                                      0x0413
+#define regCC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY_BASE_IDX                                             2
+#define regAZALIA_F0_CODEC_DEBUG                                                                        0x0414
+#define regAZALIA_F0_CODEC_DEBUG_BASE_IDX                                                               2
+#define regREG_DC_AUDIO_PORT_CONNECTIVITY                                                               0x041c
+#define regREG_DC_AUDIO_PORT_CONNECTIVITY_BASE_IDX                                                      2
+#define regREG_DC_AUDIO_INPUT_PORT_CONNECTIVITY                                                         0x041d
+#define regREG_DC_AUDIO_INPUT_PORT_CONNECTIVITY_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_hda_az_misc_dispdec
+// base address: 0x0
+#define regAZ_CLOCK_CNTL                                                                                0x0372
+#define regAZ_CLOCK_CNTL_BASE_IDX                                                                       2
+#define regAZ_MEM_GLOBAL_PWR_REQ_CNTL                                                                   0x0373
+#define regAZ_MEM_GLOBAL_PWR_REQ_CNTL_BASE_IDX                                                          2
+#define regAZ_STRAPS                                                                                    0x0374
+#define regAZ_STRAPS_BASE_IDX                                                                           2
+
+
+// addressBlock: dce_dc_hda_az_dcperfmon_dc_perfmon_dispdec
+// base address: 0xde8
+#define regDC_PERFMON4_PERFCOUNTER_CNTL                                                                 0x037a
+#define regDC_PERFMON4_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON4_PERFCOUNTER_CNTL2                                                                0x037b
+#define regDC_PERFMON4_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON4_PERFCOUNTER_STATE                                                                0x037c
+#define regDC_PERFMON4_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON4_PERFMON_CNTL                                                                     0x037d
+#define regDC_PERFMON4_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON4_PERFMON_CNTL2                                                                    0x037e
+#define regDC_PERFMON4_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON4_PERFMON_CVALUE_INT_MISC                                                          0x037f
+#define regDC_PERFMON4_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON4_PERFMON_CVALUE_LOW                                                               0x0380
+#define regDC_PERFMON4_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON4_PERFMON_HI                                                                       0x0381
+#define regDC_PERFMON4_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON4_PERFMON_LOW                                                                      0x0382
+#define regDC_PERFMON4_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON4_PERFMON_TEST_DEBUG_INDEX                                                         0x0383
+#define regDC_PERFMON4_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON4_PERFMON_TEST_DEBUG_DATA                                                          0x0384
+#define regDC_PERFMON4_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_hda_azf0stream0_dispdec
+// base address: 0x0
+#define regAZF0STREAM0_AZALIA_STREAM_INDEX                                                              0x035e
+#define regAZF0STREAM0_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM0_AZALIA_STREAM_DATA                                                               0x035f
+#define regAZF0STREAM0_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream1_dispdec
+// base address: 0x8
+#define regAZF0STREAM1_AZALIA_STREAM_INDEX                                                              0x0360
+#define regAZF0STREAM1_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM1_AZALIA_STREAM_DATA                                                               0x0361
+#define regAZF0STREAM1_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream2_dispdec
+// base address: 0x10
+#define regAZF0STREAM2_AZALIA_STREAM_INDEX                                                              0x0362
+#define regAZF0STREAM2_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM2_AZALIA_STREAM_DATA                                                               0x0363
+#define regAZF0STREAM2_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream3_dispdec
+// base address: 0x18
+#define regAZF0STREAM3_AZALIA_STREAM_INDEX                                                              0x0364
+#define regAZF0STREAM3_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM3_AZALIA_STREAM_DATA                                                               0x0365
+#define regAZF0STREAM3_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream4_dispdec
+// base address: 0x20
+#define regAZF0STREAM4_AZALIA_STREAM_INDEX                                                              0x0366
+#define regAZF0STREAM4_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM4_AZALIA_STREAM_DATA                                                               0x0367
+#define regAZF0STREAM4_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream5_dispdec
+// base address: 0x28
+#define regAZF0STREAM5_AZALIA_STREAM_INDEX                                                              0x0368
+#define regAZF0STREAM5_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM5_AZALIA_STREAM_DATA                                                               0x0369
+#define regAZF0STREAM5_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream6_dispdec
+// base address: 0x30
+#define regAZF0STREAM6_AZALIA_STREAM_INDEX                                                              0x036a
+#define regAZF0STREAM6_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM6_AZALIA_STREAM_DATA                                                               0x036b
+#define regAZF0STREAM6_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream7_dispdec
+// base address: 0x38
+#define regAZF0STREAM7_AZALIA_STREAM_INDEX                                                              0x036c
+#define regAZF0STREAM7_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM7_AZALIA_STREAM_DATA                                                               0x036d
+#define regAZF0STREAM7_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream8_dispdec
+// base address: 0x320
+#define regAZF0STREAM8_AZALIA_STREAM_INDEX                                                              0x0426
+#define regAZF0STREAM8_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM8_AZALIA_STREAM_DATA                                                               0x0427
+#define regAZF0STREAM8_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream9_dispdec
+// base address: 0x328
+#define regAZF0STREAM9_AZALIA_STREAM_INDEX                                                              0x0428
+#define regAZF0STREAM9_AZALIA_STREAM_INDEX_BASE_IDX                                                     2
+#define regAZF0STREAM9_AZALIA_STREAM_DATA                                                               0x0429
+#define regAZF0STREAM9_AZALIA_STREAM_DATA_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_hda_azf0stream10_dispdec
+// base address: 0x330
+#define regAZF0STREAM10_AZALIA_STREAM_INDEX                                                             0x042a
+#define regAZF0STREAM10_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM10_AZALIA_STREAM_DATA                                                              0x042b
+#define regAZF0STREAM10_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0stream11_dispdec
+// base address: 0x338
+#define regAZF0STREAM11_AZALIA_STREAM_INDEX                                                             0x042c
+#define regAZF0STREAM11_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM11_AZALIA_STREAM_DATA                                                              0x042d
+#define regAZF0STREAM11_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0stream12_dispdec
+// base address: 0x340
+#define regAZF0STREAM12_AZALIA_STREAM_INDEX                                                             0x042e
+#define regAZF0STREAM12_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM12_AZALIA_STREAM_DATA                                                              0x042f
+#define regAZF0STREAM12_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0stream13_dispdec
+// base address: 0x348
+#define regAZF0STREAM13_AZALIA_STREAM_INDEX                                                             0x0430
+#define regAZF0STREAM13_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM13_AZALIA_STREAM_DATA                                                              0x0431
+#define regAZF0STREAM13_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0stream14_dispdec
+// base address: 0x350
+#define regAZF0STREAM14_AZALIA_STREAM_INDEX                                                             0x0432
+#define regAZF0STREAM14_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM14_AZALIA_STREAM_DATA                                                              0x0433
+#define regAZF0STREAM14_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0stream15_dispdec
+// base address: 0x358
+#define regAZF0STREAM15_AZALIA_STREAM_INDEX                                                             0x0434
+#define regAZF0STREAM15_AZALIA_STREAM_INDEX_BASE_IDX                                                    2
+#define regAZF0STREAM15_AZALIA_STREAM_DATA                                                              0x0435
+#define regAZF0STREAM15_AZALIA_STREAM_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint0_dispdec
+// base address: 0x0
+#define regAZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x0386
+#define regAZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x0387
+#define regAZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint1_dispdec
+// base address: 0x18
+#define regAZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x038c
+#define regAZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x038d
+#define regAZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint2_dispdec
+// base address: 0x30
+#define regAZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x0392
+#define regAZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x0393
+#define regAZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint3_dispdec
+// base address: 0x48
+#define regAZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x0398
+#define regAZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x0399
+#define regAZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint4_dispdec
+// base address: 0x60
+#define regAZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x039e
+#define regAZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x039f
+#define regAZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint5_dispdec
+// base address: 0x78
+#define regAZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x03a4
+#define regAZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x03a5
+#define regAZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint6_dispdec
+// base address: 0x90
+#define regAZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x03aa
+#define regAZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x03ab
+#define regAZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_hda_azf0endpoint7_dispdec
+// base address: 0xa8
+#define regAZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_INDEX                                                 0x03b0
+#define regAZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_INDEX_BASE_IDX                                        2
+#define regAZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_DATA                                                  0x03b1
+#define regAZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_DATA_BASE_IDX                                         2
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_dispdec
+// base address: 0x0
+#define regDCHUBBUB_ARB_DF_REQ_OUTSTAND                                                                 0x04f9
+#define regDCHUBBUB_ARB_DF_REQ_OUTSTAND_BASE_IDX                                                        2
+#define regDCHUBBUB_ARB_SAT_LEVEL                                                                       0x04fa
+#define regDCHUBBUB_ARB_SAT_LEVEL_BASE_IDX                                                              2
+#define regDCHUBBUB_ARB_QOS_FORCE                                                                       0x04fb
+#define regDCHUBBUB_ARB_QOS_FORCE_BASE_IDX                                                              2
+#define regDCHUBBUB_ARB_DRAM_STATE_CNTL                                                                 0x04fc
+#define regDCHUBBUB_ARB_DRAM_STATE_CNTL_BASE_IDX                                                        2
+#define regDCHUBBUB_ARB_DRAM_HVM_STATE_CNTL                                                             0x04fd
+#define regDCHUBBUB_ARB_DRAM_HVM_STATE_CNTL_BASE_IDX                                                    2
+#define regDCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A                                                        0x04fe
+#define regDCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A_BASE_IDX                                               2
+#define regDCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A                                                     0x04ff
+#define regDCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_REFCYC_PER_META_TRIP_A                                                          0x0500
+#define regDCHUBBUB_ARB_REFCYC_PER_META_TRIP_A_BASE_IDX                                                 2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A                                                      0x0501
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A                                                       0x0502
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A_BASE_IDX                                              2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A                                                     0x0503
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A                                                      0x0504
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A                                                     0x0505
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A                                                      0x0506
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A                                                     0x0507
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A                                                      0x0508
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A                                                  0x0509
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A_BASE_IDX                                         2
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A                                                 0x050a
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A_BASE_IDX                                        2
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A                                                  0x050b
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A_BASE_IDX                                         2
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A                                                 0x050c
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A_BASE_IDX                                        2
+#define regDCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A                                                     0x050d
+#define regDCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_FRAC_URG_BW_NOM_A                                                               0x050e
+#define regDCHUBBUB_ARB_FRAC_URG_BW_NOM_A_BASE_IDX                                                      2
+#define regDCHUBBUB_ARB_FRAC_URG_BW_FLIP_A                                                              0x050f
+#define regDCHUBBUB_ARB_FRAC_URG_BW_FLIP_A_BASE_IDX                                                     2
+#define regDCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B                                                        0x0510
+#define regDCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B_BASE_IDX                                               2
+#define regDCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B                                                     0x0511
+#define regDCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_REFCYC_PER_META_TRIP_B                                                          0x0512
+#define regDCHUBBUB_ARB_REFCYC_PER_META_TRIP_B_BASE_IDX                                                 2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B                                                      0x0513
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B                                                       0x0514
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B_BASE_IDX                                              2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B                                                     0x0515
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B                                                      0x0516
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B                                                     0x0517
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B                                                      0x0518
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B                                                     0x0519
+#define regDCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B                                                      0x051a
+#define regDCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B_BASE_IDX                                             2
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B                                                  0x051b
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B_BASE_IDX                                         2
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B                                                 0x051c
+#define regDCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B_BASE_IDX                                        2
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B                                                  0x051d
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B_BASE_IDX                                         2
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B                                                 0x051e
+#define regDCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B_BASE_IDX                                        2
+#define regDCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B                                                     0x051f
+#define regDCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B_BASE_IDX                                            2
+#define regDCHUBBUB_ARB_FRAC_URG_BW_NOM_B                                                               0x0520
+#define regDCHUBBUB_ARB_FRAC_URG_BW_NOM_B_BASE_IDX                                                      2
+#define regDCHUBBUB_ARB_FRAC_URG_BW_FLIP_B                                                              0x0521
+#define regDCHUBBUB_ARB_FRAC_URG_BW_FLIP_B_BASE_IDX                                                     2
+#define regDCHUBBUB_ARB_HOSTVM_CNTL                                                                     0x0522
+#define regDCHUBBUB_ARB_HOSTVM_CNTL_BASE_IDX                                                            2
+#define regDCHUBBUB_ARB_WATERMARK_CHANGE_CNTL                                                           0x0523
+#define regDCHUBBUB_ARB_WATERMARK_CHANGE_CNTL_BASE_IDX                                                  2
+#define regDCHUBBUB_ARB_ALT_CH_CNTL                                                                     0x0524
+#define regDCHUBBUB_ARB_ALT_CH_CNTL_BASE_IDX                                                            2
+#define regDCHUBBUB_ARB_TIMEOUT_ENABLE                                                                  0x0525
+#define regDCHUBBUB_ARB_TIMEOUT_ENABLE_BASE_IDX                                                         2
+#define regDCHUBBUB_GLOBAL_TIMER_CNTL                                                                   0x0526
+#define regDCHUBBUB_GLOBAL_TIMER_CNTL_BASE_IDX                                                          2
+#define regSURFACE_CHECK0_ADDRESS_LSB                                                                   0x0527
+#define regSURFACE_CHECK0_ADDRESS_LSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK0_ADDRESS_MSB                                                                   0x0528
+#define regSURFACE_CHECK0_ADDRESS_MSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK1_ADDRESS_LSB                                                                   0x0529
+#define regSURFACE_CHECK1_ADDRESS_LSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK1_ADDRESS_MSB                                                                   0x052a
+#define regSURFACE_CHECK1_ADDRESS_MSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK2_ADDRESS_LSB                                                                   0x052b
+#define regSURFACE_CHECK2_ADDRESS_LSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK2_ADDRESS_MSB                                                                   0x052c
+#define regSURFACE_CHECK2_ADDRESS_MSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK3_ADDRESS_LSB                                                                   0x052d
+#define regSURFACE_CHECK3_ADDRESS_LSB_BASE_IDX                                                          2
+#define regSURFACE_CHECK3_ADDRESS_MSB                                                                   0x052e
+#define regSURFACE_CHECK3_ADDRESS_MSB_BASE_IDX                                                          2
+#define regVTG0_CONTROL                                                                                 0x052f
+#define regVTG0_CONTROL_BASE_IDX                                                                        2
+#define regVTG1_CONTROL                                                                                 0x0530
+#define regVTG1_CONTROL_BASE_IDX                                                                        2
+#define regVTG2_CONTROL                                                                                 0x0531
+#define regVTG2_CONTROL_BASE_IDX                                                                        2
+#define regVTG3_CONTROL                                                                                 0x0532
+#define regVTG3_CONTROL_BASE_IDX                                                                        2
+#define regDCHUBBUB_SOFT_RESET                                                                          0x0533
+#define regDCHUBBUB_SOFT_RESET_BASE_IDX                                                                 2
+#define regDCHUBBUB_CLOCK_CNTL                                                                          0x0534
+#define regDCHUBBUB_CLOCK_CNTL_BASE_IDX                                                                 2
+#define regDCFCLK_CNTL                                                                                  0x0535
+#define regDCFCLK_CNTL_BASE_IDX                                                                         2
+#define regDCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL                                                        0x0536
+#define regDCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL_BASE_IDX                                               2
+#define regDCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2                                                       0x0537
+#define regDCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2_BASE_IDX                                              2
+#define regDCHUBBUB_VLINE_SNAPSHOT                                                                      0x0538
+#define regDCHUBBUB_VLINE_SNAPSHOT_BASE_IDX                                                             2
+#define regDCHUBBUB_CTRL_STATUS                                                                         0x0539
+#define regDCHUBBUB_CTRL_STATUS_BASE_IDX                                                                2
+#define regDCHUBBUB_TIMEOUT_DETECTION_CTRL1                                                             0x053f
+#define regDCHUBBUB_TIMEOUT_DETECTION_CTRL1_BASE_IDX                                                    2
+#define regDCHUBBUB_TIMEOUT_DETECTION_CTRL2                                                             0x0540
+#define regDCHUBBUB_TIMEOUT_DETECTION_CTRL2_BASE_IDX                                                    2
+#define regDCHUBBUB_TIMEOUT_INTERRUPT_STATUS                                                            0x0541
+#define regDCHUBBUB_TIMEOUT_INTERRUPT_STATUS_BASE_IDX                                                   2
+#define regFMON_CTRL                                                                                    0x0542
+#define regFMON_CTRL_BASE_IDX                                                                           2
+#define regDCHUBBUB_TEST_DEBUG_INDEX                                                                    0x0543
+#define regDCHUBBUB_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regDCHUBBUB_TEST_DEBUG_DATA                                                                     0x0544
+#define regDCHUBBUB_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_sdpif_dispdec
+// base address: 0x0
+#define regDCHUBBUB_SDPIF_CFG0                                                                          0x046f
+#define regDCHUBBUB_SDPIF_CFG0_BASE_IDX                                                                 2
+#define regDCHUBBUB_SDPIF_CFG1                                                                          0x0470
+#define regDCHUBBUB_SDPIF_CFG1_BASE_IDX                                                                 2
+#define regDCHUBBUB_SDPIF_CFG2                                                                          0x0471
+#define regDCHUBBUB_SDPIF_CFG2_BASE_IDX                                                                 2
+#define regVM_REQUEST_PHYSICAL                                                                          0x0472
+#define regVM_REQUEST_PHYSICAL_BASE_IDX                                                                 2
+#define regDCHUBBUB_FORCE_IO_STATUS_0                                                                   0x0473
+#define regDCHUBBUB_FORCE_IO_STATUS_0_BASE_IDX                                                          2
+#define regDCHUBBUB_FORCE_IO_STATUS_1                                                                   0x0474
+#define regDCHUBBUB_FORCE_IO_STATUS_1_BASE_IDX                                                          2
+#define regDCN_VM_FB_LOCATION_BASE                                                                      0x0475
+#define regDCN_VM_FB_LOCATION_BASE_BASE_IDX                                                             2
+#define regDCN_VM_FB_LOCATION_TOP                                                                       0x0476
+#define regDCN_VM_FB_LOCATION_TOP_BASE_IDX                                                              2
+#define regDCN_VM_FB_OFFSET                                                                             0x0477
+#define regDCN_VM_FB_OFFSET_BASE_IDX                                                                    2
+#define regDCN_VM_AGP_BOT                                                                               0x0478
+#define regDCN_VM_AGP_BOT_BASE_IDX                                                                      2
+#define regDCN_VM_AGP_TOP                                                                               0x0479
+#define regDCN_VM_AGP_TOP_BASE_IDX                                                                      2
+#define regDCN_VM_AGP_BASE                                                                              0x047a
+#define regDCN_VM_AGP_BASE_BASE_IDX                                                                     2
+#define regDCN_VM_LOCAL_HBM_ADDRESS_START                                                               0x047b
+#define regDCN_VM_LOCAL_HBM_ADDRESS_START_BASE_IDX                                                      2
+#define regDCN_VM_LOCAL_HBM_ADDRESS_END                                                                 0x047c
+#define regDCN_VM_LOCAL_HBM_ADDRESS_END_BASE_IDX                                                        2
+#define regDCN_VM_LOCAL_HBM_ADDRESS_LOCK_CNTL                                                           0x047d
+#define regDCN_VM_LOCAL_HBM_ADDRESS_LOCK_CNTL_BASE_IDX                                                  2
+#define regDCHUBBUB_SDPIF_PIPE_SEC_LVL                                                                  0x047e
+#define regDCHUBBUB_SDPIF_PIPE_SEC_LVL_BASE_IDX                                                         2
+#define regDCHUBBUB_SDPIF_PIPE_NOALLOC                                                                  0x047f
+#define regDCHUBBUB_SDPIF_PIPE_NOALLOC_BASE_IDX                                                         2
+#define regDCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL                                                           0x0480
+#define regDCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL_BASE_IDX                                                  2
+#define regDCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL                                                          0x0481
+#define regDCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL_BASE_IDX                                                 2
+#define regDCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL                                                            0x0482
+#define regDCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL_BASE_IDX                                                   2
+#define regDCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL                                                            0x0483
+#define regDCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL_BASE_IDX                                                   2
+#define regDCHUBBUB_SDPIF_PIPE_DATAFETCH                                                                0x0484
+#define regDCHUBBUB_SDPIF_PIPE_DATAFETCH_BASE_IDX                                                       2
+#define regSDPIF_REQUEST_RATE_LIMIT                                                                     0x0485
+#define regSDPIF_REQUEST_RATE_LIMIT_BASE_IDX                                                            2
+#define regDCHUBBUB_SDPIF_MEM_PWR_CTRL                                                                  0x0486
+#define regDCHUBBUB_SDPIF_MEM_PWR_CTRL_BASE_IDX                                                         2
+#define regDCHUBBUB_SDPIF_MEM_PWR_STATUS                                                                0x0487
+#define regDCHUBBUB_SDPIF_MEM_PWR_STATUS_BASE_IDX                                                       2
+#define regDCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL                                                       0x0488
+#define regDCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL_BASE_IDX                                              2
+#define regUTM_CAPABILITIES_0                                                                           0x0489
+#define regUTM_CAPABILITIES_0_BASE_IDX                                                                  2
+#define regUTM_CONFIGURATION_0                                                                          0x048a
+#define regUTM_CONFIGURATION_0_BASE_IDX                                                                 2
+#define regUTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0                                                       0x048b
+#define regUTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0_BASE_IDX                                              2
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_ret_path_dispdec
+// base address: 0x0
+#define regDCHUBBUB_RET_PATH_MEM_PWR_CTRL                                                               0x04af
+#define regDCHUBBUB_RET_PATH_MEM_PWR_CTRL_BASE_IDX                                                      2
+#define regDCHUBBUB_RET_PATH_MEM_PWR_STATUS                                                             0x04b0
+#define regDCHUBBUB_RET_PATH_MEM_PWR_STATUS_BASE_IDX                                                    2
+#define regDCHUBBUB_CRC_CTRL                                                                            0x04b1
+#define regDCHUBBUB_CRC_CTRL_BASE_IDX                                                                   2
+#define regDCHUBBUB_CRC0_VAL_R                                                                          0x04b2
+#define regDCHUBBUB_CRC0_VAL_R_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC0_VAL_G                                                                          0x04b3
+#define regDCHUBBUB_CRC0_VAL_G_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC0_VAL_B                                                                          0x04b4
+#define regDCHUBBUB_CRC0_VAL_B_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC0_VAL_A                                                                          0x04b5
+#define regDCHUBBUB_CRC0_VAL_A_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC1_VAL_R                                                                          0x04b6
+#define regDCHUBBUB_CRC1_VAL_R_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC1_VAL_G                                                                          0x04b7
+#define regDCHUBBUB_CRC1_VAL_G_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC1_VAL_B                                                                          0x04b8
+#define regDCHUBBUB_CRC1_VAL_B_BASE_IDX                                                                 2
+#define regDCHUBBUB_CRC1_VAL_A                                                                          0x04b9
+#define regDCHUBBUB_CRC1_VAL_A_BASE_IDX                                                                 2
+#define regDCHUBBUB_DCC_STAT_CNTL                                                                       0x04ba
+#define regDCHUBBUB_DCC_STAT_CNTL_BASE_IDX                                                              2
+#define regDCHUBBUB_DCC_STAT0                                                                           0x04bb
+#define regDCHUBBUB_DCC_STAT0_BASE_IDX                                                                  2
+#define regDCHUBBUB_DCC_STAT1                                                                           0x04bc
+#define regDCHUBBUB_DCC_STAT1_BASE_IDX                                                                  2
+#define regDCHUBBUB_DCC_STAT2                                                                           0x04bd
+#define regDCHUBBUB_DCC_STAT2_BASE_IDX                                                                  2
+#define regDCHUBBUB_COMPBUF_CTRL                                                                        0x04be
+#define regDCHUBBUB_COMPBUF_CTRL_BASE_IDX                                                               2
+#define regDCHUBBUB_DET0_CTRL                                                                           0x04bf
+#define regDCHUBBUB_DET0_CTRL_BASE_IDX                                                                  2
+#define regDCHUBBUB_DET1_CTRL                                                                           0x04c0
+#define regDCHUBBUB_DET1_CTRL_BASE_IDX                                                                  2
+#define regDCHUBBUB_DET2_CTRL                                                                           0x04c1
+#define regDCHUBBUB_DET2_CTRL_BASE_IDX                                                                  2
+#define regDCHUBBUB_DET3_CTRL                                                                           0x04c2
+#define regDCHUBBUB_DET3_CTRL_BASE_IDX                                                                  2
+#define regDCHUBBUB_MEM_PWR_MODE_CTRL                                                                   0x04c4
+#define regDCHUBBUB_MEM_PWR_MODE_CTRL_BASE_IDX                                                          2
+#define regCOMPBUF_MEM_PWR_CTRL_1                                                                       0x04c5
+#define regCOMPBUF_MEM_PWR_CTRL_1_BASE_IDX                                                              2
+#define regCOMPBUF_MEM_PWR_CTRL_2                                                                       0x04c6
+#define regCOMPBUF_MEM_PWR_CTRL_2_BASE_IDX                                                              2
+#define regDCHUBBUB_MEM_PWR_STATUS                                                                      0x04c7
+#define regDCHUBBUB_MEM_PWR_STATUS_BASE_IDX                                                             2
+#define regCOMPBUF_RESERVED_SPACE                                                                       0x04c8
+#define regCOMPBUF_RESERVED_SPACE_BASE_IDX                                                              2
+#define regDCN_DECOMP_STATUS                                                                            0x04c9
+#define regDCN_DECOMP_STATUS_BASE_IDX                                                                   2
+#define regDCHUBBUB_DEBUG_CTRL_0                                                                        0x04ca
+#define regDCHUBBUB_DEBUG_CTRL_0_BASE_IDX                                                               2
+#define regDCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS                                            0x04cd
+#define regDCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS_BASE_IDX                                   2
+#define regDCHUBBUB_RET_PATH_TEST_DEBUG_INDEX                                                           0x04ce
+#define regDCHUBBUB_RET_PATH_TEST_DEBUG_INDEX_BASE_IDX                                                  2
+#define regDCHUBBUB_RET_PATH_TEST_DEBUG_DATA                                                            0x04cf
+#define regDCHUBBUB_RET_PATH_TEST_DEBUG_DATA_BASE_IDX                                                   2
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_vmrq_if_dispdec
+// base address: 0x0
+#define regDCN_VM_CONTEXT0_CNTL                                                                         0x0559
+#define regDCN_VM_CONTEXT0_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32                                                    0x055a
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32                                                    0x055b
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_HI32                                                   0x055c
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_LO32                                                   0x055d
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_HI32                                                     0x055e
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_LO32                                                     0x055f
+#define regDCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT1_CNTL                                                                         0x0560
+#define regDCN_VM_CONTEXT1_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0561
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0562
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_HI32                                                   0x0563
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_LO32                                                   0x0564
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_HI32                                                     0x0565
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_LO32                                                     0x0566
+#define regDCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT2_CNTL                                                                         0x0567
+#define regDCN_VM_CONTEXT2_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0568
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0569
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_HI32                                                   0x056a
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_LO32                                                   0x056b
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_HI32                                                     0x056c
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_LO32                                                     0x056d
+#define regDCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT3_CNTL                                                                         0x056e
+#define regDCN_VM_CONTEXT3_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_HI32                                                    0x056f
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0570
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_HI32                                                   0x0571
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_LO32                                                   0x0572
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_HI32                                                     0x0573
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_LO32                                                     0x0574
+#define regDCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT4_CNTL                                                                         0x0575
+#define regDCN_VM_CONTEXT4_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0576
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0577
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_HI32                                                   0x0578
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_LO32                                                   0x0579
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_HI32                                                     0x057a
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_LO32                                                     0x057b
+#define regDCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT5_CNTL                                                                         0x057c
+#define regDCN_VM_CONTEXT5_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_HI32                                                    0x057d
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_LO32                                                    0x057e
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_HI32                                                   0x057f
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_LO32                                                   0x0580
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_HI32                                                     0x0581
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_LO32                                                     0x0582
+#define regDCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT6_CNTL                                                                         0x0583
+#define regDCN_VM_CONTEXT6_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0584
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0585
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_HI32                                                   0x0586
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_LO32                                                   0x0587
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_HI32                                                     0x0588
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_LO32                                                     0x0589
+#define regDCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT7_CNTL                                                                         0x058a
+#define regDCN_VM_CONTEXT7_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_HI32                                                    0x058b
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_LO32                                                    0x058c
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_HI32                                                   0x058d
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_LO32                                                   0x058e
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_HI32                                                     0x058f
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_LO32                                                     0x0590
+#define regDCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT8_CNTL                                                                         0x0591
+#define regDCN_VM_CONTEXT8_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0592
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_LO32                                                    0x0593
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_HI32                                                   0x0594
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_LO32                                                   0x0595
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_HI32                                                     0x0596
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_LO32                                                     0x0597
+#define regDCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT9_CNTL                                                                         0x0598
+#define regDCN_VM_CONTEXT9_CNTL_BASE_IDX                                                                2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_HI32                                                    0x0599
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_LO32                                                    0x059a
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_HI32                                                   0x059b
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_LO32                                                   0x059c
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_HI32                                                     0x059d
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_LO32                                                     0x059e
+#define regDCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                            2
+#define regDCN_VM_CONTEXT10_CNTL                                                                        0x059f
+#define regDCN_VM_CONTEXT10_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05a0
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05a1
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_HI32                                                  0x05a2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_LO32                                                  0x05a3
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_HI32                                                    0x05a4
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_LO32                                                    0x05a5
+#define regDCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT11_CNTL                                                                        0x05a6
+#define regDCN_VM_CONTEXT11_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05a7
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05a8
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_HI32                                                  0x05a9
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_LO32                                                  0x05aa
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_HI32                                                    0x05ab
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_LO32                                                    0x05ac
+#define regDCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT12_CNTL                                                                        0x05ad
+#define regDCN_VM_CONTEXT12_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05ae
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05af
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_HI32                                                  0x05b0
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_LO32                                                  0x05b1
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_HI32                                                    0x05b2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_LO32                                                    0x05b3
+#define regDCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT13_CNTL                                                                        0x05b4
+#define regDCN_VM_CONTEXT13_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05b5
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05b6
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_HI32                                                  0x05b7
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_LO32                                                  0x05b8
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_HI32                                                    0x05b9
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_LO32                                                    0x05ba
+#define regDCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT14_CNTL                                                                        0x05bb
+#define regDCN_VM_CONTEXT14_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05bc
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05bd
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_HI32                                                  0x05be
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_LO32                                                  0x05bf
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_HI32                                                    0x05c0
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_LO32                                                    0x05c1
+#define regDCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT15_CNTL                                                                        0x05c2
+#define regDCN_VM_CONTEXT15_CNTL_BASE_IDX                                                               2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_HI32                                                   0x05c3
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_HI32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_LO32                                                   0x05c4
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_LO32_BASE_IDX                                          2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_HI32                                                  0x05c5
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_HI32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_LO32                                                  0x05c6
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_LO32_BASE_IDX                                         2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_HI32                                                    0x05c7
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_HI32_BASE_IDX                                           2
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_LO32                                                    0x05c8
+#define regDCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_LO32_BASE_IDX                                           2
+#define regDCN_VM_DEFAULT_ADDR_MSB                                                                      0x05c9
+#define regDCN_VM_DEFAULT_ADDR_MSB_BASE_IDX                                                             2
+#define regDCN_VM_DEFAULT_ADDR_LSB                                                                      0x05ca
+#define regDCN_VM_DEFAULT_ADDR_LSB_BASE_IDX                                                             2
+#define regDCN_VM_FAULT_CNTL                                                                            0x05cb
+#define regDCN_VM_FAULT_CNTL_BASE_IDX                                                                   2
+#define regDCN_VM_FAULT_STATUS                                                                          0x05cc
+#define regDCN_VM_FAULT_STATUS_BASE_IDX                                                                 2
+#define regDCN_VM_FAULT_ADDR_MSB                                                                        0x05cd
+#define regDCN_VM_FAULT_ADDR_MSB_BASE_IDX                                                               2
+#define regDCN_VM_FAULT_ADDR_LSB                                                                        0x05ce
+#define regDCN_VM_FAULT_ADDR_LSB_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dchubbubl_dchubbub_dcperfmon_dc_perfmon_dispdec
+// base address: 0x1534
+#define regDC_PERFMON5_PERFCOUNTER_CNTL                                                                 0x054d
+#define regDC_PERFMON5_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON5_PERFCOUNTER_CNTL2                                                                0x054e
+#define regDC_PERFMON5_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON5_PERFCOUNTER_STATE                                                                0x054f
+#define regDC_PERFMON5_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON5_PERFMON_CNTL                                                                     0x0550
+#define regDC_PERFMON5_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON5_PERFMON_CNTL2                                                                    0x0551
+#define regDC_PERFMON5_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON5_PERFMON_CVALUE_INT_MISC                                                          0x0552
+#define regDC_PERFMON5_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON5_PERFMON_CVALUE_LOW                                                               0x0553
+#define regDC_PERFMON5_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON5_PERFMON_HI                                                                       0x0554
+#define regDC_PERFMON5_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON5_PERFMON_LOW                                                                      0x0555
+#define regDC_PERFMON5_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON5_PERFMON_TEST_DEBUG_INDEX                                                         0x0556
+#define regDC_PERFMON5_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON5_PERFMON_TEST_DEBUG_DATA                                                          0x0557
+#define regDC_PERFMON5_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubp_dispdec
+// base address: 0x0
+#define regHUBP0_DCSURF_SURFACE_CONFIG                                                                  0x05e5
+#define regHUBP0_DCSURF_SURFACE_CONFIG_BASE_IDX                                                         2
+#define regHUBP0_DCSURF_ADDR_CONFIG                                                                     0x05e6
+#define regHUBP0_DCSURF_ADDR_CONFIG_BASE_IDX                                                            2
+#define regHUBP0_DCSURF_TILING_CONFIG                                                                   0x05e7
+#define regHUBP0_DCSURF_TILING_CONFIG_BASE_IDX                                                          2
+#define regHUBP0_DCSURF_LEGACY_ADDR_CONFIG                                                              0x05e8
+#define regHUBP0_DCSURF_LEGACY_ADDR_CONFIG_BASE_IDX                                                     2
+#define regHUBP0_DCSURF_PRI_VIEWPORT_START                                                              0x05e9
+#define regHUBP0_DCSURF_PRI_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE                                                0x05ea
+#define regHUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE_BASE_IDX                                       2
+#define regHUBP0_DCSURF_PRI_VIEWPORT_DIMENSION                                                          0x05eb
+#define regHUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP0_DCSURF_PRI_VIEWPORT_START_C                                                            0x05ec
+#define regHUBP0_DCSURF_PRI_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C                                                        0x05ed
+#define regHUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP0_DCSURF_SEC_VIEWPORT_START                                                              0x05ee
+#define regHUBP0_DCSURF_SEC_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP0_DCSURF_SEC_VIEWPORT_DIMENSION                                                          0x05ef
+#define regHUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP0_DCSURF_SEC_VIEWPORT_START_C                                                            0x05f0
+#define regHUBP0_DCSURF_SEC_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C                                                        0x05f1
+#define regHUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP0_DCHUBP_REQ_SIZE_CONFIG                                                                 0x05f2
+#define regHUBP0_DCHUBP_REQ_SIZE_CONFIG_BASE_IDX                                                        2
+#define regHUBP0_DCHUBP_REQ_SIZE_CONFIG_C                                                               0x05f3
+#define regHUBP0_DCHUBP_REQ_SIZE_CONFIG_C_BASE_IDX                                                      2
+#define regHUBP0_DCHUBP_CNTL                                                                            0x05f4
+#define regHUBP0_DCHUBP_CNTL_BASE_IDX                                                                   2
+#define regHUBP0_HUBP_CLK_CNTL                                                                          0x05f5
+#define regHUBP0_HUBP_CLK_CNTL_BASE_IDX                                                                 2
+#define regHUBP0_DCHUBP_VMPG_CONFIG                                                                     0x05f6
+#define regHUBP0_DCHUBP_VMPG_CONFIG_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG0                                                                     0x05f7
+#define regHUBP0_DCHUBP_SUB_VP_CFG0_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG1                                                                     0x05f8
+#define regHUBP0_DCHUBP_SUB_VP_CFG1_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG2                                                                     0x05f9
+#define regHUBP0_DCHUBP_SUB_VP_CFG2_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG3                                                                     0x05fa
+#define regHUBP0_DCHUBP_SUB_VP_CFG3_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG4                                                                     0x05fb
+#define regHUBP0_DCHUBP_SUB_VP_CFG4_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG5                                                                     0x05fc
+#define regHUBP0_DCHUBP_SUB_VP_CFG5_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG6                                                                     0x05fd
+#define regHUBP0_DCHUBP_SUB_VP_CFG6_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG7                                                                     0x05fe
+#define regHUBP0_DCHUBP_SUB_VP_CFG7_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG8                                                                     0x05ff
+#define regHUBP0_DCHUBP_SUB_VP_CFG8_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG9                                                                     0x0600
+#define regHUBP0_DCHUBP_SUB_VP_CFG9_BASE_IDX                                                            2
+#define regHUBP0_DCHUBP_SUB_VP_CFG10                                                                    0x0601
+#define regHUBP0_DCHUBP_SUB_VP_CFG10_BASE_IDX                                                           2
+#define regHUBP0_DCHUBP_SUB_VP_CFG11                                                                    0x0602
+#define regHUBP0_DCHUBP_SUB_VP_CFG11_BASE_IDX                                                           2
+#define regHUBP0_DCHUBP_SUB_VP_CFG12                                                                    0x0603
+#define regHUBP0_DCHUBP_SUB_VP_CFG12_BASE_IDX                                                           2
+#define regHUBP0_DCHUBP_SUB_VP_CFG13                                                                    0x0604
+#define regHUBP0_DCHUBP_SUB_VP_CFG13_BASE_IDX                                                           2
+#define regHUBP0_DCHUBP_MCACHEID_CONFIG                                                                 0x0605
+#define regHUBP0_DCHUBP_MCACHEID_CONFIG_BASE_IDX                                                        2
+#define regHUBP0_HUBPREQ_DEBUG_DB                                                                       0x0606
+#define regHUBP0_HUBPREQ_DEBUG_DB_BASE_IDX                                                              2
+#define regHUBP0_HUBPREQ_DEBUG                                                                          0x0607
+#define regHUBP0_HUBPREQ_DEBUG_BASE_IDX                                                                 2
+#define regHUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK                                                           0x060b
+#define regHUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK_BASE_IDX                                                  2
+#define regHUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK                                                           0x060c
+#define regHUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubpreq_dispdec
+// base address: 0x0
+#define regHUBPREQ0_DCSURF_SURFACE_PITCH                                                                0x0613
+#define regHUBPREQ0_DCSURF_SURFACE_PITCH_BASE_IDX                                                       2
+#define regHUBPREQ0_DCSURF_SURFACE_PITCH_C                                                              0x0614
+#define regHUBPREQ0_DCSURF_SURFACE_PITCH_C_BASE_IDX                                                     2
+#define regHUBPREQ0_VMID_SETTINGS_0                                                                     0x0615
+#define regHUBPREQ0_VMID_SETTINGS_0_BASE_IDX                                                            2
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS                                                      0x0616
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_BASE_IDX                                             2
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH                                                 0x0617
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                        2
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_C                                                    0x0618
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_C_BASE_IDX                                           2
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C                                               0x0619
+#define regHUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                      2
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS                                                    0x061a
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_BASE_IDX                                           2
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH                                               0x061b
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                      2
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_C                                                  0x061c
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_C_BASE_IDX                                         2
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C                                             0x061d
+#define regHUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                    2
+#define regHUBPREQ0_DCSURF_SURFACE_CONTROL                                                              0x061e
+#define regHUBPREQ0_DCSURF_SURFACE_CONTROL_BASE_IDX                                                     2
+#define regHUBPREQ0_DCSURF_FLIP_CONTROL                                                                 0x061f
+#define regHUBPREQ0_DCSURF_FLIP_CONTROL_BASE_IDX                                                        2
+#define regHUBPREQ0_DCSURF_FLIP_CONTROL2                                                                0x0620
+#define regHUBPREQ0_DCSURF_FLIP_CONTROL2_BASE_IDX                                                       2
+#define regHUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT                                                       0x0623
+#define regHUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT_BASE_IDX                                              2
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE                                                                0x0624
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_BASE_IDX                                                       2
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_HIGH                                                           0x0625
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_BASE_IDX                                                  2
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_C                                                              0x0626
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_C_BASE_IDX                                                     2
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C                                                         0x0627
+#define regHUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C_BASE_IDX                                                2
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE                                                       0x0628
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_BASE_IDX                                              2
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH                                                  0x0629
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_BASE_IDX                                         2
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_C                                                     0x062a
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_C_BASE_IDX                                            2
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C                                                0x062b
+#define regHUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C_BASE_IDX                                       2
+#define regHUBPREQ0_DCN_EXPANSION_MODE                                                                  0x062c
+#define regHUBPREQ0_DCN_EXPANSION_MODE_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_GLOBAL_TTU_CNTL                                                                 0x062d
+#define regHUBPREQ0_DCN_GLOBAL_TTU_CNTL_BASE_IDX                                                        2
+#define regHUBPREQ0_DCN_SURF0_TTU_CNTL0                                                                 0x062e
+#define regHUBPREQ0_DCN_SURF0_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ0_DCN_SURF0_TTU_CNTL1                                                                 0x062f
+#define regHUBPREQ0_DCN_SURF0_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ0_DCN_SURF1_TTU_CNTL0                                                                 0x0630
+#define regHUBPREQ0_DCN_SURF1_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ0_DCN_SURF1_TTU_CNTL1                                                                 0x0631
+#define regHUBPREQ0_DCN_SURF1_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ0_DCN_CUR0_TTU_CNTL0                                                                  0x0632
+#define regHUBPREQ0_DCN_CUR0_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_CUR0_TTU_CNTL1                                                                  0x0633
+#define regHUBPREQ0_DCN_CUR0_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_CUR1_TTU_CNTL0                                                                  0x0634
+#define regHUBPREQ0_DCN_CUR1_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_CUR1_TTU_CNTL1                                                                  0x0635
+#define regHUBPREQ0_DCN_CUR1_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_DMDATA_VM_CNTL                                                                  0x0636
+#define regHUBPREQ0_DCN_DMDATA_VM_CNTL_BASE_IDX                                                         2
+#define regHUBPREQ0_DCN_VM_SYSTEM_APERTURE_LOW_ADDR                                                     0x0637
+#define regHUBPREQ0_DCN_VM_SYSTEM_APERTURE_LOW_ADDR_BASE_IDX                                            2
+#define regHUBPREQ0_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR                                                    0x0638
+#define regHUBPREQ0_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR_BASE_IDX                                           2
+#define regHUBPREQ0_DCN_VM_MX_L1_TLB_CNTL                                                               0x0645
+#define regHUBPREQ0_DCN_VM_MX_L1_TLB_CNTL_BASE_IDX                                                      2
+#define regHUBPREQ0_BLANK_OFFSET_0                                                                      0x0646
+#define regHUBPREQ0_BLANK_OFFSET_0_BASE_IDX                                                             2
+#define regHUBPREQ0_BLANK_OFFSET_1                                                                      0x0647
+#define regHUBPREQ0_BLANK_OFFSET_1_BASE_IDX                                                             2
+#define regHUBPREQ0_DST_DIMENSIONS                                                                      0x0648
+#define regHUBPREQ0_DST_DIMENSIONS_BASE_IDX                                                             2
+#define regHUBPREQ0_DST_AFTER_SCALER                                                                    0x0649
+#define regHUBPREQ0_DST_AFTER_SCALER_BASE_IDX                                                           2
+#define regHUBPREQ0_PREFETCH_SETTINGS                                                                   0x064a
+#define regHUBPREQ0_PREFETCH_SETTINGS_BASE_IDX                                                          2
+#define regHUBPREQ0_PREFETCH_SETTINGS_C                                                                 0x064b
+#define regHUBPREQ0_PREFETCH_SETTINGS_C_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_0                                                                 0x064c
+#define regHUBPREQ0_VBLANK_PARAMETERS_0_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_1                                                                 0x064d
+#define regHUBPREQ0_VBLANK_PARAMETERS_1_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_2                                                                 0x064e
+#define regHUBPREQ0_VBLANK_PARAMETERS_2_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_3                                                                 0x064f
+#define regHUBPREQ0_VBLANK_PARAMETERS_3_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_4                                                                 0x0650
+#define regHUBPREQ0_VBLANK_PARAMETERS_4_BASE_IDX                                                        2
+#define regHUBPREQ0_FLIP_PARAMETERS_0                                                                   0x0651
+#define regHUBPREQ0_FLIP_PARAMETERS_0_BASE_IDX                                                          2
+#define regHUBPREQ0_FLIP_PARAMETERS_1                                                                   0x0652
+#define regHUBPREQ0_FLIP_PARAMETERS_1_BASE_IDX                                                          2
+#define regHUBPREQ0_FLIP_PARAMETERS_2                                                                   0x0653
+#define regHUBPREQ0_FLIP_PARAMETERS_2_BASE_IDX                                                          2
+#define regHUBPREQ0_NOM_PARAMETERS_0                                                                    0x0654
+#define regHUBPREQ0_NOM_PARAMETERS_0_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_1                                                                    0x0655
+#define regHUBPREQ0_NOM_PARAMETERS_1_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_2                                                                    0x0656
+#define regHUBPREQ0_NOM_PARAMETERS_2_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_3                                                                    0x0657
+#define regHUBPREQ0_NOM_PARAMETERS_3_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_4                                                                    0x0658
+#define regHUBPREQ0_NOM_PARAMETERS_4_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_5                                                                    0x0659
+#define regHUBPREQ0_NOM_PARAMETERS_5_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_6                                                                    0x065a
+#define regHUBPREQ0_NOM_PARAMETERS_6_BASE_IDX                                                           2
+#define regHUBPREQ0_NOM_PARAMETERS_7                                                                    0x065b
+#define regHUBPREQ0_NOM_PARAMETERS_7_BASE_IDX                                                           2
+#define regHUBPREQ0_PER_LINE_DELIVERY_PRE                                                               0x065c
+#define regHUBPREQ0_PER_LINE_DELIVERY_PRE_BASE_IDX                                                      2
+#define regHUBPREQ0_PER_LINE_DELIVERY                                                                   0x065d
+#define regHUBPREQ0_PER_LINE_DELIVERY_BASE_IDX                                                          2
+#define regHUBPREQ0_CURSOR_SETTINGS                                                                     0x065e
+#define regHUBPREQ0_CURSOR_SETTINGS_BASE_IDX                                                            2
+#define regHUBPREQ0_REF_FREQ_TO_PIX_FREQ                                                                0x065f
+#define regHUBPREQ0_REF_FREQ_TO_PIX_FREQ_BASE_IDX                                                       2
+#define regHUBPREQ0_DST_Y_DELTA_DRQ_LIMIT                                                               0x0660
+#define regHUBPREQ0_DST_Y_DELTA_DRQ_LIMIT_BASE_IDX                                                      2
+#define regHUBPREQ0_DST_Y_ALT_CH_DRQ_LIMIT                                                              0x0661
+#define regHUBPREQ0_DST_Y_ALT_CH_DRQ_LIMIT_BASE_IDX                                                     2
+#define regHUBPREQ0_HUBPREQ_MEM_PWR_CTRL                                                                0x0662
+#define regHUBPREQ0_HUBPREQ_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPREQ0_HUBPREQ_MEM_PWR_STATUS                                                              0x0663
+#define regHUBPREQ0_HUBPREQ_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPREQ0_VBLANK_PARAMETERS_5                                                                 0x0667
+#define regHUBPREQ0_VBLANK_PARAMETERS_5_BASE_IDX                                                        2
+#define regHUBPREQ0_VBLANK_PARAMETERS_6                                                                 0x0668
+#define regHUBPREQ0_VBLANK_PARAMETERS_6_BASE_IDX                                                        2
+#define regHUBPREQ0_FLIP_PARAMETERS_3                                                                   0x0669
+#define regHUBPREQ0_FLIP_PARAMETERS_3_BASE_IDX                                                          2
+#define regHUBPREQ0_FLIP_PARAMETERS_4                                                                   0x066a
+#define regHUBPREQ0_FLIP_PARAMETERS_4_BASE_IDX                                                          2
+#define regHUBPREQ0_FLIP_PARAMETERS_5                                                                   0x066b
+#define regHUBPREQ0_FLIP_PARAMETERS_5_BASE_IDX                                                          2
+#define regHUBPREQ0_FLIP_PARAMETERS_6                                                                   0x066c
+#define regHUBPREQ0_FLIP_PARAMETERS_6_BASE_IDX                                                          2
+#define regHUBPREQ0_UCLK_PSTATE_FORCE                                                                   0x066d
+#define regHUBPREQ0_UCLK_PSTATE_FORCE_BASE_IDX                                                          2
+#define regHUBPREQ0_HUBPREQ_STATUS_REG0                                                                 0x066e
+#define regHUBPREQ0_HUBPREQ_STATUS_REG0_BASE_IDX                                                        2
+#define regHUBPREQ0_HUBPREQ_STATUS_REG1                                                                 0x066f
+#define regHUBPREQ0_HUBPREQ_STATUS_REG1_BASE_IDX                                                        2
+#define regHUBPREQ0_HUBPREQ_STATUS_REG2                                                                 0x0670
+#define regHUBPREQ0_HUBPREQ_STATUS_REG2_BASE_IDX                                                        2
+#define regHUBPREQ0_HUBPREQ_STATUS_REG3                                                                 0x0671
+#define regHUBPREQ0_HUBPREQ_STATUS_REG3_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubpret_dispdec
+// base address: 0x0
+#define regHUBPRET0_HUBPRET_CONTROL                                                                     0x0679
+#define regHUBPRET0_HUBPRET_CONTROL_BASE_IDX                                                            2
+#define regHUBPRET0_HUBPRET_MEM_PWR_CTRL                                                                0x067a
+#define regHUBPRET0_HUBPRET_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPRET0_HUBPRET_MEM_PWR_STATUS                                                              0x067b
+#define regHUBPRET0_HUBPRET_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPRET0_HUBPRET_READ_LINE_CTRL0                                                             0x067c
+#define regHUBPRET0_HUBPRET_READ_LINE_CTRL0_BASE_IDX                                                    2
+#define regHUBPRET0_HUBPRET_READ_LINE_CTRL1                                                             0x067d
+#define regHUBPRET0_HUBPRET_READ_LINE_CTRL1_BASE_IDX                                                    2
+#define regHUBPRET0_HUBPRET_READ_LINE0                                                                  0x067e
+#define regHUBPRET0_HUBPRET_READ_LINE0_BASE_IDX                                                         2
+#define regHUBPRET0_HUBPRET_READ_LINE1                                                                  0x067f
+#define regHUBPRET0_HUBPRET_READ_LINE1_BASE_IDX                                                         2
+#define regHUBPRET0_HUBPRET_INTERRUPT                                                                   0x0680
+#define regHUBPRET0_HUBPRET_INTERRUPT_BASE_IDX                                                          2
+#define regHUBPRET0_HUBPRET_READ_LINE_VALUE                                                             0x0681
+#define regHUBPRET0_HUBPRET_READ_LINE_VALUE_BASE_IDX                                                    2
+#define regHUBPRET0_HUBPRET_READ_LINE_STATUS                                                            0x0682
+#define regHUBPRET0_HUBPRET_READ_LINE_STATUS_BASE_IDX                                                   2
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_cursor0_dispdec
+// base address: 0x0
+#define regCURSOR0_0_CURSOR_CONTROL                                                                     0x0686
+#define regCURSOR0_0_CURSOR_CONTROL_BASE_IDX                                                            2
+#define regCURSOR0_0_CURSOR_SURFACE_ADDRESS                                                             0x0687
+#define regCURSOR0_0_CURSOR_SURFACE_ADDRESS_BASE_IDX                                                    2
+#define regCURSOR0_0_CURSOR_SURFACE_ADDRESS_HIGH                                                        0x0688
+#define regCURSOR0_0_CURSOR_SURFACE_ADDRESS_HIGH_BASE_IDX                                               2
+#define regCURSOR0_0_CURSOR_SIZE                                                                        0x0689
+#define regCURSOR0_0_CURSOR_SIZE_BASE_IDX                                                               2
+#define regCURSOR0_0_CURSOR_POSITION                                                                    0x068a
+#define regCURSOR0_0_CURSOR_POSITION_BASE_IDX                                                           2
+#define regCURSOR0_0_CURSOR_HOT_SPOT                                                                    0x068b
+#define regCURSOR0_0_CURSOR_HOT_SPOT_BASE_IDX                                                           2
+#define regCURSOR0_0_CURSOR_STEREO_CONTROL                                                              0x068c
+#define regCURSOR0_0_CURSOR_STEREO_CONTROL_BASE_IDX                                                     2
+#define regCURSOR0_0_CURSOR_DST_OFFSET                                                                  0x068d
+#define regCURSOR0_0_CURSOR_DST_OFFSET_BASE_IDX                                                         2
+#define regCURSOR0_0_CURSOR_MEM_PWR_CTRL                                                                0x068e
+#define regCURSOR0_0_CURSOR_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regCURSOR0_0_CURSOR_MEM_PWR_STATUS                                                              0x068f
+#define regCURSOR0_0_CURSOR_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regCURSOR0_0_DMDATA_ADDRESS_HIGH                                                                0x0690
+#define regCURSOR0_0_DMDATA_ADDRESS_HIGH_BASE_IDX                                                       2
+#define regCURSOR0_0_DMDATA_ADDRESS_LOW                                                                 0x0691
+#define regCURSOR0_0_DMDATA_ADDRESS_LOW_BASE_IDX                                                        2
+#define regCURSOR0_0_DMDATA_CNTL                                                                        0x0692
+#define regCURSOR0_0_DMDATA_CNTL_BASE_IDX                                                               2
+#define regCURSOR0_0_DMDATA_QOS_CNTL                                                                    0x0693
+#define regCURSOR0_0_DMDATA_QOS_CNTL_BASE_IDX                                                           2
+#define regCURSOR0_0_DMDATA_STATUS                                                                      0x0694
+#define regCURSOR0_0_DMDATA_STATUS_BASE_IDX                                                             2
+#define regCURSOR0_0_DMDATA_SW_CNTL                                                                     0x0695
+#define regCURSOR0_0_DMDATA_SW_CNTL_BASE_IDX                                                            2
+#define regCURSOR0_0_DMDATA_SW_DATA                                                                     0x0696
+#define regCURSOR0_0_DMDATA_SW_DATA_BASE_IDX                                                            2
+#define regCURSOR0_0_HUBP_3DLUT_CONTROL                                                                 0x0697
+#define regCURSOR0_0_HUBP_3DLUT_CONTROL_BASE_IDX                                                        2
+#define regCURSOR0_0_HUBP_3DLUT_ADDRESS_LOW                                                             0x0698
+#define regCURSOR0_0_HUBP_3DLUT_ADDRESS_LOW_BASE_IDX                                                    2
+#define regCURSOR0_0_HUBP_3DLUT_ADDRESS_HIGH                                                            0x0699
+#define regCURSOR0_0_HUBP_3DLUT_ADDRESS_HIGH_BASE_IDX                                                   2
+#define regCURSOR0_0_HUBP_3DLUT_DLG_PARAM                                                               0x069a
+#define regCURSOR0_0_HUBP_3DLUT_DLG_PARAM_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x1a74
+#define regDC_PERFMON6_PERFCOUNTER_CNTL                                                                 0x069d
+#define regDC_PERFMON6_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON6_PERFCOUNTER_CNTL2                                                                0x069e
+#define regDC_PERFMON6_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON6_PERFCOUNTER_STATE                                                                0x069f
+#define regDC_PERFMON6_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON6_PERFMON_CNTL                                                                     0x06a0
+#define regDC_PERFMON6_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON6_PERFMON_CNTL2                                                                    0x06a1
+#define regDC_PERFMON6_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON6_PERFMON_CVALUE_INT_MISC                                                          0x06a2
+#define regDC_PERFMON6_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON6_PERFMON_CVALUE_LOW                                                               0x06a3
+#define regDC_PERFMON6_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON6_PERFMON_HI                                                                       0x06a4
+#define regDC_PERFMON6_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON6_PERFMON_LOW                                                                      0x06a5
+#define regDC_PERFMON6_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON6_PERFMON_TEST_DEBUG_INDEX                                                         0x06a6
+#define regDC_PERFMON6_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON6_PERFMON_TEST_DEBUG_DATA                                                          0x06a7
+#define regDC_PERFMON6_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubp_dispdec
+// base address: 0x370
+#define regHUBP1_DCSURF_SURFACE_CONFIG                                                                  0x06c1
+#define regHUBP1_DCSURF_SURFACE_CONFIG_BASE_IDX                                                         2
+#define regHUBP1_DCSURF_ADDR_CONFIG                                                                     0x06c2
+#define regHUBP1_DCSURF_ADDR_CONFIG_BASE_IDX                                                            2
+#define regHUBP1_DCSURF_TILING_CONFIG                                                                   0x06c3
+#define regHUBP1_DCSURF_TILING_CONFIG_BASE_IDX                                                          2
+#define regHUBP1_DCSURF_LEGACY_ADDR_CONFIG                                                              0x06c4
+#define regHUBP1_DCSURF_LEGACY_ADDR_CONFIG_BASE_IDX                                                     2
+#define regHUBP1_DCSURF_PRI_VIEWPORT_START                                                              0x06c5
+#define regHUBP1_DCSURF_PRI_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE                                                0x06c6
+#define regHUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE_BASE_IDX                                       2
+#define regHUBP1_DCSURF_PRI_VIEWPORT_DIMENSION                                                          0x06c7
+#define regHUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP1_DCSURF_PRI_VIEWPORT_START_C                                                            0x06c8
+#define regHUBP1_DCSURF_PRI_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C                                                        0x06c9
+#define regHUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP1_DCSURF_SEC_VIEWPORT_START                                                              0x06ca
+#define regHUBP1_DCSURF_SEC_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP1_DCSURF_SEC_VIEWPORT_DIMENSION                                                          0x06cb
+#define regHUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP1_DCSURF_SEC_VIEWPORT_START_C                                                            0x06cc
+#define regHUBP1_DCSURF_SEC_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C                                                        0x06cd
+#define regHUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP1_DCHUBP_REQ_SIZE_CONFIG                                                                 0x06ce
+#define regHUBP1_DCHUBP_REQ_SIZE_CONFIG_BASE_IDX                                                        2
+#define regHUBP1_DCHUBP_REQ_SIZE_CONFIG_C                                                               0x06cf
+#define regHUBP1_DCHUBP_REQ_SIZE_CONFIG_C_BASE_IDX                                                      2
+#define regHUBP1_DCHUBP_CNTL                                                                            0x06d0
+#define regHUBP1_DCHUBP_CNTL_BASE_IDX                                                                   2
+#define regHUBP1_HUBP_CLK_CNTL                                                                          0x06d1
+#define regHUBP1_HUBP_CLK_CNTL_BASE_IDX                                                                 2
+#define regHUBP1_DCHUBP_VMPG_CONFIG                                                                     0x06d2
+#define regHUBP1_DCHUBP_VMPG_CONFIG_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG0                                                                     0x06d3
+#define regHUBP1_DCHUBP_SUB_VP_CFG0_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG1                                                                     0x06d4
+#define regHUBP1_DCHUBP_SUB_VP_CFG1_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG2                                                                     0x06d5
+#define regHUBP1_DCHUBP_SUB_VP_CFG2_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG3                                                                     0x06d6
+#define regHUBP1_DCHUBP_SUB_VP_CFG3_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG4                                                                     0x06d7
+#define regHUBP1_DCHUBP_SUB_VP_CFG4_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG5                                                                     0x06d8
+#define regHUBP1_DCHUBP_SUB_VP_CFG5_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG6                                                                     0x06d9
+#define regHUBP1_DCHUBP_SUB_VP_CFG6_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG7                                                                     0x06da
+#define regHUBP1_DCHUBP_SUB_VP_CFG7_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG8                                                                     0x06db
+#define regHUBP1_DCHUBP_SUB_VP_CFG8_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG9                                                                     0x06dc
+#define regHUBP1_DCHUBP_SUB_VP_CFG9_BASE_IDX                                                            2
+#define regHUBP1_DCHUBP_SUB_VP_CFG10                                                                    0x06dd
+#define regHUBP1_DCHUBP_SUB_VP_CFG10_BASE_IDX                                                           2
+#define regHUBP1_DCHUBP_SUB_VP_CFG11                                                                    0x06de
+#define regHUBP1_DCHUBP_SUB_VP_CFG11_BASE_IDX                                                           2
+#define regHUBP1_DCHUBP_SUB_VP_CFG12                                                                    0x06df
+#define regHUBP1_DCHUBP_SUB_VP_CFG12_BASE_IDX                                                           2
+#define regHUBP1_DCHUBP_SUB_VP_CFG13                                                                    0x06e0
+#define regHUBP1_DCHUBP_SUB_VP_CFG13_BASE_IDX                                                           2
+#define regHUBP1_DCHUBP_MCACHEID_CONFIG                                                                 0x06e1
+#define regHUBP1_DCHUBP_MCACHEID_CONFIG_BASE_IDX                                                        2
+#define regHUBP1_HUBPREQ_DEBUG_DB                                                                       0x06e2
+#define regHUBP1_HUBPREQ_DEBUG_DB_BASE_IDX                                                              2
+#define regHUBP1_HUBPREQ_DEBUG                                                                          0x06e3
+#define regHUBP1_HUBPREQ_DEBUG_BASE_IDX                                                                 2
+#define regHUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK                                                           0x06e7
+#define regHUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK_BASE_IDX                                                  2
+#define regHUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK                                                           0x06e8
+#define regHUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubpreq_dispdec
+// base address: 0x370
+#define regHUBPREQ1_DCSURF_SURFACE_PITCH                                                                0x06ef
+#define regHUBPREQ1_DCSURF_SURFACE_PITCH_BASE_IDX                                                       2
+#define regHUBPREQ1_DCSURF_SURFACE_PITCH_C                                                              0x06f0
+#define regHUBPREQ1_DCSURF_SURFACE_PITCH_C_BASE_IDX                                                     2
+#define regHUBPREQ1_VMID_SETTINGS_0                                                                     0x06f1
+#define regHUBPREQ1_VMID_SETTINGS_0_BASE_IDX                                                            2
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS                                                      0x06f2
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_BASE_IDX                                             2
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH                                                 0x06f3
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                        2
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_C                                                    0x06f4
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_C_BASE_IDX                                           2
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C                                               0x06f5
+#define regHUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                      2
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS                                                    0x06f6
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_BASE_IDX                                           2
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH                                               0x06f7
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                      2
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_C                                                  0x06f8
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_C_BASE_IDX                                         2
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C                                             0x06f9
+#define regHUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                    2
+#define regHUBPREQ1_DCSURF_SURFACE_CONTROL                                                              0x06fa
+#define regHUBPREQ1_DCSURF_SURFACE_CONTROL_BASE_IDX                                                     2
+#define regHUBPREQ1_DCSURF_FLIP_CONTROL                                                                 0x06fb
+#define regHUBPREQ1_DCSURF_FLIP_CONTROL_BASE_IDX                                                        2
+#define regHUBPREQ1_DCSURF_FLIP_CONTROL2                                                                0x06fc
+#define regHUBPREQ1_DCSURF_FLIP_CONTROL2_BASE_IDX                                                       2
+#define regHUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT                                                       0x06ff
+#define regHUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT_BASE_IDX                                              2
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE                                                                0x0700
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_BASE_IDX                                                       2
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_HIGH                                                           0x0701
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_BASE_IDX                                                  2
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_C                                                              0x0702
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_C_BASE_IDX                                                     2
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C                                                         0x0703
+#define regHUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C_BASE_IDX                                                2
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE                                                       0x0704
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_BASE_IDX                                              2
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH                                                  0x0705
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_BASE_IDX                                         2
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_C                                                     0x0706
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_C_BASE_IDX                                            2
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C                                                0x0707
+#define regHUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C_BASE_IDX                                       2
+#define regHUBPREQ1_DCN_EXPANSION_MODE                                                                  0x0708
+#define regHUBPREQ1_DCN_EXPANSION_MODE_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_GLOBAL_TTU_CNTL                                                                 0x0709
+#define regHUBPREQ1_DCN_GLOBAL_TTU_CNTL_BASE_IDX                                                        2
+#define regHUBPREQ1_DCN_SURF0_TTU_CNTL0                                                                 0x070a
+#define regHUBPREQ1_DCN_SURF0_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ1_DCN_SURF0_TTU_CNTL1                                                                 0x070b
+#define regHUBPREQ1_DCN_SURF0_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ1_DCN_SURF1_TTU_CNTL0                                                                 0x070c
+#define regHUBPREQ1_DCN_SURF1_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ1_DCN_SURF1_TTU_CNTL1                                                                 0x070d
+#define regHUBPREQ1_DCN_SURF1_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ1_DCN_CUR0_TTU_CNTL0                                                                  0x070e
+#define regHUBPREQ1_DCN_CUR0_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_CUR0_TTU_CNTL1                                                                  0x070f
+#define regHUBPREQ1_DCN_CUR0_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_CUR1_TTU_CNTL0                                                                  0x0710
+#define regHUBPREQ1_DCN_CUR1_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_CUR1_TTU_CNTL1                                                                  0x0711
+#define regHUBPREQ1_DCN_CUR1_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_DMDATA_VM_CNTL                                                                  0x0712
+#define regHUBPREQ1_DCN_DMDATA_VM_CNTL_BASE_IDX                                                         2
+#define regHUBPREQ1_DCN_VM_SYSTEM_APERTURE_LOW_ADDR                                                     0x0713
+#define regHUBPREQ1_DCN_VM_SYSTEM_APERTURE_LOW_ADDR_BASE_IDX                                            2
+#define regHUBPREQ1_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR                                                    0x0714
+#define regHUBPREQ1_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR_BASE_IDX                                           2
+#define regHUBPREQ1_DCN_VM_MX_L1_TLB_CNTL                                                               0x0721
+#define regHUBPREQ1_DCN_VM_MX_L1_TLB_CNTL_BASE_IDX                                                      2
+#define regHUBPREQ1_BLANK_OFFSET_0                                                                      0x0722
+#define regHUBPREQ1_BLANK_OFFSET_0_BASE_IDX                                                             2
+#define regHUBPREQ1_BLANK_OFFSET_1                                                                      0x0723
+#define regHUBPREQ1_BLANK_OFFSET_1_BASE_IDX                                                             2
+#define regHUBPREQ1_DST_DIMENSIONS                                                                      0x0724
+#define regHUBPREQ1_DST_DIMENSIONS_BASE_IDX                                                             2
+#define regHUBPREQ1_DST_AFTER_SCALER                                                                    0x0725
+#define regHUBPREQ1_DST_AFTER_SCALER_BASE_IDX                                                           2
+#define regHUBPREQ1_PREFETCH_SETTINGS                                                                   0x0726
+#define regHUBPREQ1_PREFETCH_SETTINGS_BASE_IDX                                                          2
+#define regHUBPREQ1_PREFETCH_SETTINGS_C                                                                 0x0727
+#define regHUBPREQ1_PREFETCH_SETTINGS_C_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_0                                                                 0x0728
+#define regHUBPREQ1_VBLANK_PARAMETERS_0_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_1                                                                 0x0729
+#define regHUBPREQ1_VBLANK_PARAMETERS_1_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_2                                                                 0x072a
+#define regHUBPREQ1_VBLANK_PARAMETERS_2_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_3                                                                 0x072b
+#define regHUBPREQ1_VBLANK_PARAMETERS_3_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_4                                                                 0x072c
+#define regHUBPREQ1_VBLANK_PARAMETERS_4_BASE_IDX                                                        2
+#define regHUBPREQ1_FLIP_PARAMETERS_0                                                                   0x072d
+#define regHUBPREQ1_FLIP_PARAMETERS_0_BASE_IDX                                                          2
+#define regHUBPREQ1_FLIP_PARAMETERS_1                                                                   0x072e
+#define regHUBPREQ1_FLIP_PARAMETERS_1_BASE_IDX                                                          2
+#define regHUBPREQ1_FLIP_PARAMETERS_2                                                                   0x072f
+#define regHUBPREQ1_FLIP_PARAMETERS_2_BASE_IDX                                                          2
+#define regHUBPREQ1_NOM_PARAMETERS_0                                                                    0x0730
+#define regHUBPREQ1_NOM_PARAMETERS_0_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_1                                                                    0x0731
+#define regHUBPREQ1_NOM_PARAMETERS_1_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_2                                                                    0x0732
+#define regHUBPREQ1_NOM_PARAMETERS_2_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_3                                                                    0x0733
+#define regHUBPREQ1_NOM_PARAMETERS_3_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_4                                                                    0x0734
+#define regHUBPREQ1_NOM_PARAMETERS_4_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_5                                                                    0x0735
+#define regHUBPREQ1_NOM_PARAMETERS_5_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_6                                                                    0x0736
+#define regHUBPREQ1_NOM_PARAMETERS_6_BASE_IDX                                                           2
+#define regHUBPREQ1_NOM_PARAMETERS_7                                                                    0x0737
+#define regHUBPREQ1_NOM_PARAMETERS_7_BASE_IDX                                                           2
+#define regHUBPREQ1_PER_LINE_DELIVERY_PRE                                                               0x0738
+#define regHUBPREQ1_PER_LINE_DELIVERY_PRE_BASE_IDX                                                      2
+#define regHUBPREQ1_PER_LINE_DELIVERY                                                                   0x0739
+#define regHUBPREQ1_PER_LINE_DELIVERY_BASE_IDX                                                          2
+#define regHUBPREQ1_CURSOR_SETTINGS                                                                     0x073a
+#define regHUBPREQ1_CURSOR_SETTINGS_BASE_IDX                                                            2
+#define regHUBPREQ1_REF_FREQ_TO_PIX_FREQ                                                                0x073b
+#define regHUBPREQ1_REF_FREQ_TO_PIX_FREQ_BASE_IDX                                                       2
+#define regHUBPREQ1_DST_Y_DELTA_DRQ_LIMIT                                                               0x073c
+#define regHUBPREQ1_DST_Y_DELTA_DRQ_LIMIT_BASE_IDX                                                      2
+#define regHUBPREQ1_DST_Y_ALT_CH_DRQ_LIMIT                                                              0x073d
+#define regHUBPREQ1_DST_Y_ALT_CH_DRQ_LIMIT_BASE_IDX                                                     2
+#define regHUBPREQ1_HUBPREQ_MEM_PWR_CTRL                                                                0x073e
+#define regHUBPREQ1_HUBPREQ_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPREQ1_HUBPREQ_MEM_PWR_STATUS                                                              0x073f
+#define regHUBPREQ1_HUBPREQ_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPREQ1_VBLANK_PARAMETERS_5                                                                 0x0743
+#define regHUBPREQ1_VBLANK_PARAMETERS_5_BASE_IDX                                                        2
+#define regHUBPREQ1_VBLANK_PARAMETERS_6                                                                 0x0744
+#define regHUBPREQ1_VBLANK_PARAMETERS_6_BASE_IDX                                                        2
+#define regHUBPREQ1_FLIP_PARAMETERS_3                                                                   0x0745
+#define regHUBPREQ1_FLIP_PARAMETERS_3_BASE_IDX                                                          2
+#define regHUBPREQ1_FLIP_PARAMETERS_4                                                                   0x0746
+#define regHUBPREQ1_FLIP_PARAMETERS_4_BASE_IDX                                                          2
+#define regHUBPREQ1_FLIP_PARAMETERS_5                                                                   0x0747
+#define regHUBPREQ1_FLIP_PARAMETERS_5_BASE_IDX                                                          2
+#define regHUBPREQ1_FLIP_PARAMETERS_6                                                                   0x0748
+#define regHUBPREQ1_FLIP_PARAMETERS_6_BASE_IDX                                                          2
+#define regHUBPREQ1_UCLK_PSTATE_FORCE                                                                   0x0749
+#define regHUBPREQ1_UCLK_PSTATE_FORCE_BASE_IDX                                                          2
+#define regHUBPREQ1_HUBPREQ_STATUS_REG0                                                                 0x074a
+#define regHUBPREQ1_HUBPREQ_STATUS_REG0_BASE_IDX                                                        2
+#define regHUBPREQ1_HUBPREQ_STATUS_REG1                                                                 0x074b
+#define regHUBPREQ1_HUBPREQ_STATUS_REG1_BASE_IDX                                                        2
+#define regHUBPREQ1_HUBPREQ_STATUS_REG2                                                                 0x074c
+#define regHUBPREQ1_HUBPREQ_STATUS_REG2_BASE_IDX                                                        2
+#define regHUBPREQ1_HUBPREQ_STATUS_REG3                                                                 0x074d
+#define regHUBPREQ1_HUBPREQ_STATUS_REG3_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubpret_dispdec
+// base address: 0x370
+#define regHUBPRET1_HUBPRET_CONTROL                                                                     0x0755
+#define regHUBPRET1_HUBPRET_CONTROL_BASE_IDX                                                            2
+#define regHUBPRET1_HUBPRET_MEM_PWR_CTRL                                                                0x0756
+#define regHUBPRET1_HUBPRET_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPRET1_HUBPRET_MEM_PWR_STATUS                                                              0x0757
+#define regHUBPRET1_HUBPRET_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPRET1_HUBPRET_READ_LINE_CTRL0                                                             0x0758
+#define regHUBPRET1_HUBPRET_READ_LINE_CTRL0_BASE_IDX                                                    2
+#define regHUBPRET1_HUBPRET_READ_LINE_CTRL1                                                             0x0759
+#define regHUBPRET1_HUBPRET_READ_LINE_CTRL1_BASE_IDX                                                    2
+#define regHUBPRET1_HUBPRET_READ_LINE0                                                                  0x075a
+#define regHUBPRET1_HUBPRET_READ_LINE0_BASE_IDX                                                         2
+#define regHUBPRET1_HUBPRET_READ_LINE1                                                                  0x075b
+#define regHUBPRET1_HUBPRET_READ_LINE1_BASE_IDX                                                         2
+#define regHUBPRET1_HUBPRET_INTERRUPT                                                                   0x075c
+#define regHUBPRET1_HUBPRET_INTERRUPT_BASE_IDX                                                          2
+#define regHUBPRET1_HUBPRET_READ_LINE_VALUE                                                             0x075d
+#define regHUBPRET1_HUBPRET_READ_LINE_VALUE_BASE_IDX                                                    2
+#define regHUBPRET1_HUBPRET_READ_LINE_STATUS                                                            0x075e
+#define regHUBPRET1_HUBPRET_READ_LINE_STATUS_BASE_IDX                                                   2
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_cursor0_dispdec
+// base address: 0x370
+#define regCURSOR0_1_CURSOR_CONTROL                                                                     0x0762
+#define regCURSOR0_1_CURSOR_CONTROL_BASE_IDX                                                            2
+#define regCURSOR0_1_CURSOR_SURFACE_ADDRESS                                                             0x0763
+#define regCURSOR0_1_CURSOR_SURFACE_ADDRESS_BASE_IDX                                                    2
+#define regCURSOR0_1_CURSOR_SURFACE_ADDRESS_HIGH                                                        0x0764
+#define regCURSOR0_1_CURSOR_SURFACE_ADDRESS_HIGH_BASE_IDX                                               2
+#define regCURSOR0_1_CURSOR_SIZE                                                                        0x0765
+#define regCURSOR0_1_CURSOR_SIZE_BASE_IDX                                                               2
+#define regCURSOR0_1_CURSOR_POSITION                                                                    0x0766
+#define regCURSOR0_1_CURSOR_POSITION_BASE_IDX                                                           2
+#define regCURSOR0_1_CURSOR_HOT_SPOT                                                                    0x0767
+#define regCURSOR0_1_CURSOR_HOT_SPOT_BASE_IDX                                                           2
+#define regCURSOR0_1_CURSOR_STEREO_CONTROL                                                              0x0768
+#define regCURSOR0_1_CURSOR_STEREO_CONTROL_BASE_IDX                                                     2
+#define regCURSOR0_1_CURSOR_DST_OFFSET                                                                  0x0769
+#define regCURSOR0_1_CURSOR_DST_OFFSET_BASE_IDX                                                         2
+#define regCURSOR0_1_CURSOR_MEM_PWR_CTRL                                                                0x076a
+#define regCURSOR0_1_CURSOR_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regCURSOR0_1_CURSOR_MEM_PWR_STATUS                                                              0x076b
+#define regCURSOR0_1_CURSOR_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regCURSOR0_1_DMDATA_ADDRESS_HIGH                                                                0x076c
+#define regCURSOR0_1_DMDATA_ADDRESS_HIGH_BASE_IDX                                                       2
+#define regCURSOR0_1_DMDATA_ADDRESS_LOW                                                                 0x076d
+#define regCURSOR0_1_DMDATA_ADDRESS_LOW_BASE_IDX                                                        2
+#define regCURSOR0_1_DMDATA_CNTL                                                                        0x076e
+#define regCURSOR0_1_DMDATA_CNTL_BASE_IDX                                                               2
+#define regCURSOR0_1_DMDATA_QOS_CNTL                                                                    0x076f
+#define regCURSOR0_1_DMDATA_QOS_CNTL_BASE_IDX                                                           2
+#define regCURSOR0_1_DMDATA_STATUS                                                                      0x0770
+#define regCURSOR0_1_DMDATA_STATUS_BASE_IDX                                                             2
+#define regCURSOR0_1_DMDATA_SW_CNTL                                                                     0x0771
+#define regCURSOR0_1_DMDATA_SW_CNTL_BASE_IDX                                                            2
+#define regCURSOR0_1_DMDATA_SW_DATA                                                                     0x0772
+#define regCURSOR0_1_DMDATA_SW_DATA_BASE_IDX                                                            2
+#define regCURSOR0_1_HUBP_3DLUT_CONTROL                                                                 0x0773
+#define regCURSOR0_1_HUBP_3DLUT_CONTROL_BASE_IDX                                                        2
+#define regCURSOR0_1_HUBP_3DLUT_ADDRESS_LOW                                                             0x0774
+#define regCURSOR0_1_HUBP_3DLUT_ADDRESS_LOW_BASE_IDX                                                    2
+#define regCURSOR0_1_HUBP_3DLUT_ADDRESS_HIGH                                                            0x0775
+#define regCURSOR0_1_HUBP_3DLUT_ADDRESS_HIGH_BASE_IDX                                                   2
+#define regCURSOR0_1_HUBP_3DLUT_DLG_PARAM                                                               0x0776
+#define regCURSOR0_1_HUBP_3DLUT_DLG_PARAM_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x1de4
+#define regDC_PERFMON7_PERFCOUNTER_CNTL                                                                 0x0779
+#define regDC_PERFMON7_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON7_PERFCOUNTER_CNTL2                                                                0x077a
+#define regDC_PERFMON7_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON7_PERFCOUNTER_STATE                                                                0x077b
+#define regDC_PERFMON7_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON7_PERFMON_CNTL                                                                     0x077c
+#define regDC_PERFMON7_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON7_PERFMON_CNTL2                                                                    0x077d
+#define regDC_PERFMON7_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON7_PERFMON_CVALUE_INT_MISC                                                          0x077e
+#define regDC_PERFMON7_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON7_PERFMON_CVALUE_LOW                                                               0x077f
+#define regDC_PERFMON7_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON7_PERFMON_HI                                                                       0x0780
+#define regDC_PERFMON7_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON7_PERFMON_LOW                                                                      0x0781
+#define regDC_PERFMON7_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON7_PERFMON_TEST_DEBUG_INDEX                                                         0x0782
+#define regDC_PERFMON7_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON7_PERFMON_TEST_DEBUG_DATA                                                          0x0783
+#define regDC_PERFMON7_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubp_dispdec
+// base address: 0x6e0
+#define regHUBP2_DCSURF_SURFACE_CONFIG                                                                  0x079d
+#define regHUBP2_DCSURF_SURFACE_CONFIG_BASE_IDX                                                         2
+#define regHUBP2_DCSURF_ADDR_CONFIG                                                                     0x079e
+#define regHUBP2_DCSURF_ADDR_CONFIG_BASE_IDX                                                            2
+#define regHUBP2_DCSURF_TILING_CONFIG                                                                   0x079f
+#define regHUBP2_DCSURF_TILING_CONFIG_BASE_IDX                                                          2
+#define regHUBP2_DCSURF_LEGACY_ADDR_CONFIG                                                              0x07a0
+#define regHUBP2_DCSURF_LEGACY_ADDR_CONFIG_BASE_IDX                                                     2
+#define regHUBP2_DCSURF_PRI_VIEWPORT_START                                                              0x07a1
+#define regHUBP2_DCSURF_PRI_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE                                                0x07a2
+#define regHUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE_BASE_IDX                                       2
+#define regHUBP2_DCSURF_PRI_VIEWPORT_DIMENSION                                                          0x07a3
+#define regHUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP2_DCSURF_PRI_VIEWPORT_START_C                                                            0x07a4
+#define regHUBP2_DCSURF_PRI_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C                                                        0x07a5
+#define regHUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP2_DCSURF_SEC_VIEWPORT_START                                                              0x07a6
+#define regHUBP2_DCSURF_SEC_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP2_DCSURF_SEC_VIEWPORT_DIMENSION                                                          0x07a7
+#define regHUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP2_DCSURF_SEC_VIEWPORT_START_C                                                            0x07a8
+#define regHUBP2_DCSURF_SEC_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C                                                        0x07a9
+#define regHUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP2_DCHUBP_REQ_SIZE_CONFIG                                                                 0x07aa
+#define regHUBP2_DCHUBP_REQ_SIZE_CONFIG_BASE_IDX                                                        2
+#define regHUBP2_DCHUBP_REQ_SIZE_CONFIG_C                                                               0x07ab
+#define regHUBP2_DCHUBP_REQ_SIZE_CONFIG_C_BASE_IDX                                                      2
+#define regHUBP2_DCHUBP_CNTL                                                                            0x07ac
+#define regHUBP2_DCHUBP_CNTL_BASE_IDX                                                                   2
+#define regHUBP2_HUBP_CLK_CNTL                                                                          0x07ad
+#define regHUBP2_HUBP_CLK_CNTL_BASE_IDX                                                                 2
+#define regHUBP2_DCHUBP_VMPG_CONFIG                                                                     0x07ae
+#define regHUBP2_DCHUBP_VMPG_CONFIG_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG0                                                                     0x07af
+#define regHUBP2_DCHUBP_SUB_VP_CFG0_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG1                                                                     0x07b0
+#define regHUBP2_DCHUBP_SUB_VP_CFG1_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG2                                                                     0x07b1
+#define regHUBP2_DCHUBP_SUB_VP_CFG2_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG3                                                                     0x07b2
+#define regHUBP2_DCHUBP_SUB_VP_CFG3_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG4                                                                     0x07b3
+#define regHUBP2_DCHUBP_SUB_VP_CFG4_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG5                                                                     0x07b4
+#define regHUBP2_DCHUBP_SUB_VP_CFG5_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG6                                                                     0x07b5
+#define regHUBP2_DCHUBP_SUB_VP_CFG6_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG7                                                                     0x07b6
+#define regHUBP2_DCHUBP_SUB_VP_CFG7_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG8                                                                     0x07b7
+#define regHUBP2_DCHUBP_SUB_VP_CFG8_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG9                                                                     0x07b8
+#define regHUBP2_DCHUBP_SUB_VP_CFG9_BASE_IDX                                                            2
+#define regHUBP2_DCHUBP_SUB_VP_CFG10                                                                    0x07b9
+#define regHUBP2_DCHUBP_SUB_VP_CFG10_BASE_IDX                                                           2
+#define regHUBP2_DCHUBP_SUB_VP_CFG11                                                                    0x07ba
+#define regHUBP2_DCHUBP_SUB_VP_CFG11_BASE_IDX                                                           2
+#define regHUBP2_DCHUBP_SUB_VP_CFG12                                                                    0x07bb
+#define regHUBP2_DCHUBP_SUB_VP_CFG12_BASE_IDX                                                           2
+#define regHUBP2_DCHUBP_SUB_VP_CFG13                                                                    0x07bc
+#define regHUBP2_DCHUBP_SUB_VP_CFG13_BASE_IDX                                                           2
+#define regHUBP2_DCHUBP_MCACHEID_CONFIG                                                                 0x07bd
+#define regHUBP2_DCHUBP_MCACHEID_CONFIG_BASE_IDX                                                        2
+#define regHUBP2_HUBPREQ_DEBUG_DB                                                                       0x07be
+#define regHUBP2_HUBPREQ_DEBUG_DB_BASE_IDX                                                              2
+#define regHUBP2_HUBPREQ_DEBUG                                                                          0x07bf
+#define regHUBP2_HUBPREQ_DEBUG_BASE_IDX                                                                 2
+#define regHUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK                                                           0x07c3
+#define regHUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK_BASE_IDX                                                  2
+#define regHUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK                                                           0x07c4
+#define regHUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubpreq_dispdec
+// base address: 0x6e0
+#define regHUBPREQ2_DCSURF_SURFACE_PITCH                                                                0x07cb
+#define regHUBPREQ2_DCSURF_SURFACE_PITCH_BASE_IDX                                                       2
+#define regHUBPREQ2_DCSURF_SURFACE_PITCH_C                                                              0x07cc
+#define regHUBPREQ2_DCSURF_SURFACE_PITCH_C_BASE_IDX                                                     2
+#define regHUBPREQ2_VMID_SETTINGS_0                                                                     0x07cd
+#define regHUBPREQ2_VMID_SETTINGS_0_BASE_IDX                                                            2
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS                                                      0x07ce
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_BASE_IDX                                             2
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH                                                 0x07cf
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                        2
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_C                                                    0x07d0
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_C_BASE_IDX                                           2
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C                                               0x07d1
+#define regHUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                      2
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS                                                    0x07d2
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_BASE_IDX                                           2
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH                                               0x07d3
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                      2
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_C                                                  0x07d4
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_C_BASE_IDX                                         2
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C                                             0x07d5
+#define regHUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                    2
+#define regHUBPREQ2_DCSURF_SURFACE_CONTROL                                                              0x07d6
+#define regHUBPREQ2_DCSURF_SURFACE_CONTROL_BASE_IDX                                                     2
+#define regHUBPREQ2_DCSURF_FLIP_CONTROL                                                                 0x07d7
+#define regHUBPREQ2_DCSURF_FLIP_CONTROL_BASE_IDX                                                        2
+#define regHUBPREQ2_DCSURF_FLIP_CONTROL2                                                                0x07d8
+#define regHUBPREQ2_DCSURF_FLIP_CONTROL2_BASE_IDX                                                       2
+#define regHUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT                                                       0x07db
+#define regHUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT_BASE_IDX                                              2
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE                                                                0x07dc
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_BASE_IDX                                                       2
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_HIGH                                                           0x07dd
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_BASE_IDX                                                  2
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_C                                                              0x07de
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_C_BASE_IDX                                                     2
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C                                                         0x07df
+#define regHUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C_BASE_IDX                                                2
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE                                                       0x07e0
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_BASE_IDX                                              2
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH                                                  0x07e1
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_BASE_IDX                                         2
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_C                                                     0x07e2
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_C_BASE_IDX                                            2
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C                                                0x07e3
+#define regHUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C_BASE_IDX                                       2
+#define regHUBPREQ2_DCN_EXPANSION_MODE                                                                  0x07e4
+#define regHUBPREQ2_DCN_EXPANSION_MODE_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_GLOBAL_TTU_CNTL                                                                 0x07e5
+#define regHUBPREQ2_DCN_GLOBAL_TTU_CNTL_BASE_IDX                                                        2
+#define regHUBPREQ2_DCN_SURF0_TTU_CNTL0                                                                 0x07e6
+#define regHUBPREQ2_DCN_SURF0_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ2_DCN_SURF0_TTU_CNTL1                                                                 0x07e7
+#define regHUBPREQ2_DCN_SURF0_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ2_DCN_SURF1_TTU_CNTL0                                                                 0x07e8
+#define regHUBPREQ2_DCN_SURF1_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ2_DCN_SURF1_TTU_CNTL1                                                                 0x07e9
+#define regHUBPREQ2_DCN_SURF1_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ2_DCN_CUR0_TTU_CNTL0                                                                  0x07ea
+#define regHUBPREQ2_DCN_CUR0_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_CUR0_TTU_CNTL1                                                                  0x07eb
+#define regHUBPREQ2_DCN_CUR0_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_CUR1_TTU_CNTL0                                                                  0x07ec
+#define regHUBPREQ2_DCN_CUR1_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_CUR1_TTU_CNTL1                                                                  0x07ed
+#define regHUBPREQ2_DCN_CUR1_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_DMDATA_VM_CNTL                                                                  0x07ee
+#define regHUBPREQ2_DCN_DMDATA_VM_CNTL_BASE_IDX                                                         2
+#define regHUBPREQ2_DCN_VM_SYSTEM_APERTURE_LOW_ADDR                                                     0x07ef
+#define regHUBPREQ2_DCN_VM_SYSTEM_APERTURE_LOW_ADDR_BASE_IDX                                            2
+#define regHUBPREQ2_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR                                                    0x07f0
+#define regHUBPREQ2_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR_BASE_IDX                                           2
+#define regHUBPREQ2_DCN_VM_MX_L1_TLB_CNTL                                                               0x07fd
+#define regHUBPREQ2_DCN_VM_MX_L1_TLB_CNTL_BASE_IDX                                                      2
+#define regHUBPREQ2_BLANK_OFFSET_0                                                                      0x07fe
+#define regHUBPREQ2_BLANK_OFFSET_0_BASE_IDX                                                             2
+#define regHUBPREQ2_BLANK_OFFSET_1                                                                      0x07ff
+#define regHUBPREQ2_BLANK_OFFSET_1_BASE_IDX                                                             2
+#define regHUBPREQ2_DST_DIMENSIONS                                                                      0x0800
+#define regHUBPREQ2_DST_DIMENSIONS_BASE_IDX                                                             2
+#define regHUBPREQ2_DST_AFTER_SCALER                                                                    0x0801
+#define regHUBPREQ2_DST_AFTER_SCALER_BASE_IDX                                                           2
+#define regHUBPREQ2_PREFETCH_SETTINGS                                                                   0x0802
+#define regHUBPREQ2_PREFETCH_SETTINGS_BASE_IDX                                                          2
+#define regHUBPREQ2_PREFETCH_SETTINGS_C                                                                 0x0803
+#define regHUBPREQ2_PREFETCH_SETTINGS_C_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_0                                                                 0x0804
+#define regHUBPREQ2_VBLANK_PARAMETERS_0_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_1                                                                 0x0805
+#define regHUBPREQ2_VBLANK_PARAMETERS_1_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_2                                                                 0x0806
+#define regHUBPREQ2_VBLANK_PARAMETERS_2_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_3                                                                 0x0807
+#define regHUBPREQ2_VBLANK_PARAMETERS_3_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_4                                                                 0x0808
+#define regHUBPREQ2_VBLANK_PARAMETERS_4_BASE_IDX                                                        2
+#define regHUBPREQ2_FLIP_PARAMETERS_0                                                                   0x0809
+#define regHUBPREQ2_FLIP_PARAMETERS_0_BASE_IDX                                                          2
+#define regHUBPREQ2_FLIP_PARAMETERS_1                                                                   0x080a
+#define regHUBPREQ2_FLIP_PARAMETERS_1_BASE_IDX                                                          2
+#define regHUBPREQ2_FLIP_PARAMETERS_2                                                                   0x080b
+#define regHUBPREQ2_FLIP_PARAMETERS_2_BASE_IDX                                                          2
+#define regHUBPREQ2_NOM_PARAMETERS_0                                                                    0x080c
+#define regHUBPREQ2_NOM_PARAMETERS_0_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_1                                                                    0x080d
+#define regHUBPREQ2_NOM_PARAMETERS_1_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_2                                                                    0x080e
+#define regHUBPREQ2_NOM_PARAMETERS_2_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_3                                                                    0x080f
+#define regHUBPREQ2_NOM_PARAMETERS_3_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_4                                                                    0x0810
+#define regHUBPREQ2_NOM_PARAMETERS_4_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_5                                                                    0x0811
+#define regHUBPREQ2_NOM_PARAMETERS_5_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_6                                                                    0x0812
+#define regHUBPREQ2_NOM_PARAMETERS_6_BASE_IDX                                                           2
+#define regHUBPREQ2_NOM_PARAMETERS_7                                                                    0x0813
+#define regHUBPREQ2_NOM_PARAMETERS_7_BASE_IDX                                                           2
+#define regHUBPREQ2_PER_LINE_DELIVERY_PRE                                                               0x0814
+#define regHUBPREQ2_PER_LINE_DELIVERY_PRE_BASE_IDX                                                      2
+#define regHUBPREQ2_PER_LINE_DELIVERY                                                                   0x0815
+#define regHUBPREQ2_PER_LINE_DELIVERY_BASE_IDX                                                          2
+#define regHUBPREQ2_CURSOR_SETTINGS                                                                     0x0816
+#define regHUBPREQ2_CURSOR_SETTINGS_BASE_IDX                                                            2
+#define regHUBPREQ2_REF_FREQ_TO_PIX_FREQ                                                                0x0817
+#define regHUBPREQ2_REF_FREQ_TO_PIX_FREQ_BASE_IDX                                                       2
+#define regHUBPREQ2_DST_Y_DELTA_DRQ_LIMIT                                                               0x0818
+#define regHUBPREQ2_DST_Y_DELTA_DRQ_LIMIT_BASE_IDX                                                      2
+#define regHUBPREQ2_DST_Y_ALT_CH_DRQ_LIMIT                                                              0x0819
+#define regHUBPREQ2_DST_Y_ALT_CH_DRQ_LIMIT_BASE_IDX                                                     2
+#define regHUBPREQ2_HUBPREQ_MEM_PWR_CTRL                                                                0x081a
+#define regHUBPREQ2_HUBPREQ_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPREQ2_HUBPREQ_MEM_PWR_STATUS                                                              0x081b
+#define regHUBPREQ2_HUBPREQ_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPREQ2_VBLANK_PARAMETERS_5                                                                 0x081f
+#define regHUBPREQ2_VBLANK_PARAMETERS_5_BASE_IDX                                                        2
+#define regHUBPREQ2_VBLANK_PARAMETERS_6                                                                 0x0820
+#define regHUBPREQ2_VBLANK_PARAMETERS_6_BASE_IDX                                                        2
+#define regHUBPREQ2_FLIP_PARAMETERS_3                                                                   0x0821
+#define regHUBPREQ2_FLIP_PARAMETERS_3_BASE_IDX                                                          2
+#define regHUBPREQ2_FLIP_PARAMETERS_4                                                                   0x0822
+#define regHUBPREQ2_FLIP_PARAMETERS_4_BASE_IDX                                                          2
+#define regHUBPREQ2_FLIP_PARAMETERS_5                                                                   0x0823
+#define regHUBPREQ2_FLIP_PARAMETERS_5_BASE_IDX                                                          2
+#define regHUBPREQ2_FLIP_PARAMETERS_6                                                                   0x0824
+#define regHUBPREQ2_FLIP_PARAMETERS_6_BASE_IDX                                                          2
+#define regHUBPREQ2_UCLK_PSTATE_FORCE                                                                   0x0825
+#define regHUBPREQ2_UCLK_PSTATE_FORCE_BASE_IDX                                                          2
+#define regHUBPREQ2_HUBPREQ_STATUS_REG0                                                                 0x0826
+#define regHUBPREQ2_HUBPREQ_STATUS_REG0_BASE_IDX                                                        2
+#define regHUBPREQ2_HUBPREQ_STATUS_REG1                                                                 0x0827
+#define regHUBPREQ2_HUBPREQ_STATUS_REG1_BASE_IDX                                                        2
+#define regHUBPREQ2_HUBPREQ_STATUS_REG2                                                                 0x0828
+#define regHUBPREQ2_HUBPREQ_STATUS_REG2_BASE_IDX                                                        2
+#define regHUBPREQ2_HUBPREQ_STATUS_REG3                                                                 0x0829
+#define regHUBPREQ2_HUBPREQ_STATUS_REG3_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubpret_dispdec
+// base address: 0x6e0
+#define regHUBPRET2_HUBPRET_CONTROL                                                                     0x0831
+#define regHUBPRET2_HUBPRET_CONTROL_BASE_IDX                                                            2
+#define regHUBPRET2_HUBPRET_MEM_PWR_CTRL                                                                0x0832
+#define regHUBPRET2_HUBPRET_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPRET2_HUBPRET_MEM_PWR_STATUS                                                              0x0833
+#define regHUBPRET2_HUBPRET_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPRET2_HUBPRET_READ_LINE_CTRL0                                                             0x0834
+#define regHUBPRET2_HUBPRET_READ_LINE_CTRL0_BASE_IDX                                                    2
+#define regHUBPRET2_HUBPRET_READ_LINE_CTRL1                                                             0x0835
+#define regHUBPRET2_HUBPRET_READ_LINE_CTRL1_BASE_IDX                                                    2
+#define regHUBPRET2_HUBPRET_READ_LINE0                                                                  0x0836
+#define regHUBPRET2_HUBPRET_READ_LINE0_BASE_IDX                                                         2
+#define regHUBPRET2_HUBPRET_READ_LINE1                                                                  0x0837
+#define regHUBPRET2_HUBPRET_READ_LINE1_BASE_IDX                                                         2
+#define regHUBPRET2_HUBPRET_INTERRUPT                                                                   0x0838
+#define regHUBPRET2_HUBPRET_INTERRUPT_BASE_IDX                                                          2
+#define regHUBPRET2_HUBPRET_READ_LINE_VALUE                                                             0x0839
+#define regHUBPRET2_HUBPRET_READ_LINE_VALUE_BASE_IDX                                                    2
+#define regHUBPRET2_HUBPRET_READ_LINE_STATUS                                                            0x083a
+#define regHUBPRET2_HUBPRET_READ_LINE_STATUS_BASE_IDX                                                   2
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_cursor0_dispdec
+// base address: 0x6e0
+#define regCURSOR0_2_CURSOR_CONTROL                                                                     0x083e
+#define regCURSOR0_2_CURSOR_CONTROL_BASE_IDX                                                            2
+#define regCURSOR0_2_CURSOR_SURFACE_ADDRESS                                                             0x083f
+#define regCURSOR0_2_CURSOR_SURFACE_ADDRESS_BASE_IDX                                                    2
+#define regCURSOR0_2_CURSOR_SURFACE_ADDRESS_HIGH                                                        0x0840
+#define regCURSOR0_2_CURSOR_SURFACE_ADDRESS_HIGH_BASE_IDX                                               2
+#define regCURSOR0_2_CURSOR_SIZE                                                                        0x0841
+#define regCURSOR0_2_CURSOR_SIZE_BASE_IDX                                                               2
+#define regCURSOR0_2_CURSOR_POSITION                                                                    0x0842
+#define regCURSOR0_2_CURSOR_POSITION_BASE_IDX                                                           2
+#define regCURSOR0_2_CURSOR_HOT_SPOT                                                                    0x0843
+#define regCURSOR0_2_CURSOR_HOT_SPOT_BASE_IDX                                                           2
+#define regCURSOR0_2_CURSOR_STEREO_CONTROL                                                              0x0844
+#define regCURSOR0_2_CURSOR_STEREO_CONTROL_BASE_IDX                                                     2
+#define regCURSOR0_2_CURSOR_DST_OFFSET                                                                  0x0845
+#define regCURSOR0_2_CURSOR_DST_OFFSET_BASE_IDX                                                         2
+#define regCURSOR0_2_CURSOR_MEM_PWR_CTRL                                                                0x0846
+#define regCURSOR0_2_CURSOR_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regCURSOR0_2_CURSOR_MEM_PWR_STATUS                                                              0x0847
+#define regCURSOR0_2_CURSOR_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regCURSOR0_2_DMDATA_ADDRESS_HIGH                                                                0x0848
+#define regCURSOR0_2_DMDATA_ADDRESS_HIGH_BASE_IDX                                                       2
+#define regCURSOR0_2_DMDATA_ADDRESS_LOW                                                                 0x0849
+#define regCURSOR0_2_DMDATA_ADDRESS_LOW_BASE_IDX                                                        2
+#define regCURSOR0_2_DMDATA_CNTL                                                                        0x084a
+#define regCURSOR0_2_DMDATA_CNTL_BASE_IDX                                                               2
+#define regCURSOR0_2_DMDATA_QOS_CNTL                                                                    0x084b
+#define regCURSOR0_2_DMDATA_QOS_CNTL_BASE_IDX                                                           2
+#define regCURSOR0_2_DMDATA_STATUS                                                                      0x084c
+#define regCURSOR0_2_DMDATA_STATUS_BASE_IDX                                                             2
+#define regCURSOR0_2_DMDATA_SW_CNTL                                                                     0x084d
+#define regCURSOR0_2_DMDATA_SW_CNTL_BASE_IDX                                                            2
+#define regCURSOR0_2_DMDATA_SW_DATA                                                                     0x084e
+#define regCURSOR0_2_DMDATA_SW_DATA_BASE_IDX                                                            2
+#define regCURSOR0_2_HUBP_3DLUT_CONTROL                                                                 0x084f
+#define regCURSOR0_2_HUBP_3DLUT_CONTROL_BASE_IDX                                                        2
+#define regCURSOR0_2_HUBP_3DLUT_ADDRESS_LOW                                                             0x0850
+#define regCURSOR0_2_HUBP_3DLUT_ADDRESS_LOW_BASE_IDX                                                    2
+#define regCURSOR0_2_HUBP_3DLUT_ADDRESS_HIGH                                                            0x0851
+#define regCURSOR0_2_HUBP_3DLUT_ADDRESS_HIGH_BASE_IDX                                                   2
+#define regCURSOR0_2_HUBP_3DLUT_DLG_PARAM                                                               0x0852
+#define regCURSOR0_2_HUBP_3DLUT_DLG_PARAM_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x2154
+#define regDC_PERFMON8_PERFCOUNTER_CNTL                                                                 0x0855
+#define regDC_PERFMON8_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON8_PERFCOUNTER_CNTL2                                                                0x0856
+#define regDC_PERFMON8_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON8_PERFCOUNTER_STATE                                                                0x0857
+#define regDC_PERFMON8_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON8_PERFMON_CNTL                                                                     0x0858
+#define regDC_PERFMON8_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON8_PERFMON_CNTL2                                                                    0x0859
+#define regDC_PERFMON8_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON8_PERFMON_CVALUE_INT_MISC                                                          0x085a
+#define regDC_PERFMON8_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON8_PERFMON_CVALUE_LOW                                                               0x085b
+#define regDC_PERFMON8_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON8_PERFMON_HI                                                                       0x085c
+#define regDC_PERFMON8_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON8_PERFMON_LOW                                                                      0x085d
+#define regDC_PERFMON8_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON8_PERFMON_TEST_DEBUG_INDEX                                                         0x085e
+#define regDC_PERFMON8_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON8_PERFMON_TEST_DEBUG_DATA                                                          0x085f
+#define regDC_PERFMON8_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubp_dispdec
+// base address: 0xa50
+#define regHUBP3_DCSURF_SURFACE_CONFIG                                                                  0x0879
+#define regHUBP3_DCSURF_SURFACE_CONFIG_BASE_IDX                                                         2
+#define regHUBP3_DCSURF_ADDR_CONFIG                                                                     0x087a
+#define regHUBP3_DCSURF_ADDR_CONFIG_BASE_IDX                                                            2
+#define regHUBP3_DCSURF_TILING_CONFIG                                                                   0x087b
+#define regHUBP3_DCSURF_TILING_CONFIG_BASE_IDX                                                          2
+#define regHUBP3_DCSURF_LEGACY_ADDR_CONFIG                                                              0x087c
+#define regHUBP3_DCSURF_LEGACY_ADDR_CONFIG_BASE_IDX                                                     2
+#define regHUBP3_DCSURF_PRI_VIEWPORT_START                                                              0x087d
+#define regHUBP3_DCSURF_PRI_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE                                                0x087e
+#define regHUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE_BASE_IDX                                       2
+#define regHUBP3_DCSURF_PRI_VIEWPORT_DIMENSION                                                          0x087f
+#define regHUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP3_DCSURF_PRI_VIEWPORT_START_C                                                            0x0880
+#define regHUBP3_DCSURF_PRI_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C                                                        0x0881
+#define regHUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP3_DCSURF_SEC_VIEWPORT_START                                                              0x0882
+#define regHUBP3_DCSURF_SEC_VIEWPORT_START_BASE_IDX                                                     2
+#define regHUBP3_DCSURF_SEC_VIEWPORT_DIMENSION                                                          0x0883
+#define regHUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_BASE_IDX                                                 2
+#define regHUBP3_DCSURF_SEC_VIEWPORT_START_C                                                            0x0884
+#define regHUBP3_DCSURF_SEC_VIEWPORT_START_C_BASE_IDX                                                   2
+#define regHUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C                                                        0x0885
+#define regHUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C_BASE_IDX                                               2
+#define regHUBP3_DCHUBP_REQ_SIZE_CONFIG                                                                 0x0886
+#define regHUBP3_DCHUBP_REQ_SIZE_CONFIG_BASE_IDX                                                        2
+#define regHUBP3_DCHUBP_REQ_SIZE_CONFIG_C                                                               0x0887
+#define regHUBP3_DCHUBP_REQ_SIZE_CONFIG_C_BASE_IDX                                                      2
+#define regHUBP3_DCHUBP_CNTL                                                                            0x0888
+#define regHUBP3_DCHUBP_CNTL_BASE_IDX                                                                   2
+#define regHUBP3_HUBP_CLK_CNTL                                                                          0x0889
+#define regHUBP3_HUBP_CLK_CNTL_BASE_IDX                                                                 2
+#define regHUBP3_DCHUBP_VMPG_CONFIG                                                                     0x088a
+#define regHUBP3_DCHUBP_VMPG_CONFIG_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG0                                                                     0x088b
+#define regHUBP3_DCHUBP_SUB_VP_CFG0_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG1                                                                     0x088c
+#define regHUBP3_DCHUBP_SUB_VP_CFG1_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG2                                                                     0x088d
+#define regHUBP3_DCHUBP_SUB_VP_CFG2_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG3                                                                     0x088e
+#define regHUBP3_DCHUBP_SUB_VP_CFG3_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG4                                                                     0x088f
+#define regHUBP3_DCHUBP_SUB_VP_CFG4_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG5                                                                     0x0890
+#define regHUBP3_DCHUBP_SUB_VP_CFG5_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG6                                                                     0x0891
+#define regHUBP3_DCHUBP_SUB_VP_CFG6_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG7                                                                     0x0892
+#define regHUBP3_DCHUBP_SUB_VP_CFG7_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG8                                                                     0x0893
+#define regHUBP3_DCHUBP_SUB_VP_CFG8_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG9                                                                     0x0894
+#define regHUBP3_DCHUBP_SUB_VP_CFG9_BASE_IDX                                                            2
+#define regHUBP3_DCHUBP_SUB_VP_CFG10                                                                    0x0895
+#define regHUBP3_DCHUBP_SUB_VP_CFG10_BASE_IDX                                                           2
+#define regHUBP3_DCHUBP_SUB_VP_CFG11                                                                    0x0896
+#define regHUBP3_DCHUBP_SUB_VP_CFG11_BASE_IDX                                                           2
+#define regHUBP3_DCHUBP_SUB_VP_CFG12                                                                    0x0897
+#define regHUBP3_DCHUBP_SUB_VP_CFG12_BASE_IDX                                                           2
+#define regHUBP3_DCHUBP_SUB_VP_CFG13                                                                    0x0898
+#define regHUBP3_DCHUBP_SUB_VP_CFG13_BASE_IDX                                                           2
+#define regHUBP3_DCHUBP_MCACHEID_CONFIG                                                                 0x0899
+#define regHUBP3_DCHUBP_MCACHEID_CONFIG_BASE_IDX                                                        2
+#define regHUBP3_HUBPREQ_DEBUG_DB                                                                       0x089a
+#define regHUBP3_HUBPREQ_DEBUG_DB_BASE_IDX                                                              2
+#define regHUBP3_HUBPREQ_DEBUG                                                                          0x089b
+#define regHUBP3_HUBPREQ_DEBUG_BASE_IDX                                                                 2
+#define regHUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK                                                           0x089f
+#define regHUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK_BASE_IDX                                                  2
+#define regHUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK                                                           0x08a0
+#define regHUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubpreq_dispdec
+// base address: 0xa50
+#define regHUBPREQ3_DCSURF_SURFACE_PITCH                                                                0x08a7
+#define regHUBPREQ3_DCSURF_SURFACE_PITCH_BASE_IDX                                                       2
+#define regHUBPREQ3_DCSURF_SURFACE_PITCH_C                                                              0x08a8
+#define regHUBPREQ3_DCSURF_SURFACE_PITCH_C_BASE_IDX                                                     2
+#define regHUBPREQ3_VMID_SETTINGS_0                                                                     0x08a9
+#define regHUBPREQ3_VMID_SETTINGS_0_BASE_IDX                                                            2
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS                                                      0x08aa
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_BASE_IDX                                             2
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH                                                 0x08ab
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                        2
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_C                                                    0x08ac
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_C_BASE_IDX                                           2
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C                                               0x08ad
+#define regHUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                      2
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS                                                    0x08ae
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_BASE_IDX                                           2
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH                                               0x08af
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_BASE_IDX                                      2
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_C                                                  0x08b0
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_C_BASE_IDX                                         2
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C                                             0x08b1
+#define regHUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C_BASE_IDX                                    2
+#define regHUBPREQ3_DCSURF_SURFACE_CONTROL                                                              0x08b2
+#define regHUBPREQ3_DCSURF_SURFACE_CONTROL_BASE_IDX                                                     2
+#define regHUBPREQ3_DCSURF_FLIP_CONTROL                                                                 0x08b3
+#define regHUBPREQ3_DCSURF_FLIP_CONTROL_BASE_IDX                                                        2
+#define regHUBPREQ3_DCSURF_FLIP_CONTROL2                                                                0x08b4
+#define regHUBPREQ3_DCSURF_FLIP_CONTROL2_BASE_IDX                                                       2
+#define regHUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT                                                       0x08b7
+#define regHUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT_BASE_IDX                                              2
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE                                                                0x08b8
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_BASE_IDX                                                       2
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_HIGH                                                           0x08b9
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_BASE_IDX                                                  2
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_C                                                              0x08ba
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_C_BASE_IDX                                                     2
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C                                                         0x08bb
+#define regHUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C_BASE_IDX                                                2
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE                                                       0x08bc
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_BASE_IDX                                              2
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH                                                  0x08bd
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_BASE_IDX                                         2
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_C                                                     0x08be
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_C_BASE_IDX                                            2
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C                                                0x08bf
+#define regHUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C_BASE_IDX                                       2
+#define regHUBPREQ3_DCN_EXPANSION_MODE                                                                  0x08c0
+#define regHUBPREQ3_DCN_EXPANSION_MODE_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_GLOBAL_TTU_CNTL                                                                 0x08c1
+#define regHUBPREQ3_DCN_GLOBAL_TTU_CNTL_BASE_IDX                                                        2
+#define regHUBPREQ3_DCN_SURF0_TTU_CNTL0                                                                 0x08c2
+#define regHUBPREQ3_DCN_SURF0_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ3_DCN_SURF0_TTU_CNTL1                                                                 0x08c3
+#define regHUBPREQ3_DCN_SURF0_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ3_DCN_SURF1_TTU_CNTL0                                                                 0x08c4
+#define regHUBPREQ3_DCN_SURF1_TTU_CNTL0_BASE_IDX                                                        2
+#define regHUBPREQ3_DCN_SURF1_TTU_CNTL1                                                                 0x08c5
+#define regHUBPREQ3_DCN_SURF1_TTU_CNTL1_BASE_IDX                                                        2
+#define regHUBPREQ3_DCN_CUR0_TTU_CNTL0                                                                  0x08c6
+#define regHUBPREQ3_DCN_CUR0_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_CUR0_TTU_CNTL1                                                                  0x08c7
+#define regHUBPREQ3_DCN_CUR0_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_CUR1_TTU_CNTL0                                                                  0x08c8
+#define regHUBPREQ3_DCN_CUR1_TTU_CNTL0_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_CUR1_TTU_CNTL1                                                                  0x08c9
+#define regHUBPREQ3_DCN_CUR1_TTU_CNTL1_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_DMDATA_VM_CNTL                                                                  0x08ca
+#define regHUBPREQ3_DCN_DMDATA_VM_CNTL_BASE_IDX                                                         2
+#define regHUBPREQ3_DCN_VM_SYSTEM_APERTURE_LOW_ADDR                                                     0x08cb
+#define regHUBPREQ3_DCN_VM_SYSTEM_APERTURE_LOW_ADDR_BASE_IDX                                            2
+#define regHUBPREQ3_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR                                                    0x08cc
+#define regHUBPREQ3_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR_BASE_IDX                                           2
+#define regHUBPREQ3_DCN_VM_MX_L1_TLB_CNTL                                                               0x08d9
+#define regHUBPREQ3_DCN_VM_MX_L1_TLB_CNTL_BASE_IDX                                                      2
+#define regHUBPREQ3_BLANK_OFFSET_0                                                                      0x08da
+#define regHUBPREQ3_BLANK_OFFSET_0_BASE_IDX                                                             2
+#define regHUBPREQ3_BLANK_OFFSET_1                                                                      0x08db
+#define regHUBPREQ3_BLANK_OFFSET_1_BASE_IDX                                                             2
+#define regHUBPREQ3_DST_DIMENSIONS                                                                      0x08dc
+#define regHUBPREQ3_DST_DIMENSIONS_BASE_IDX                                                             2
+#define regHUBPREQ3_DST_AFTER_SCALER                                                                    0x08dd
+#define regHUBPREQ3_DST_AFTER_SCALER_BASE_IDX                                                           2
+#define regHUBPREQ3_PREFETCH_SETTINGS                                                                   0x08de
+#define regHUBPREQ3_PREFETCH_SETTINGS_BASE_IDX                                                          2
+#define regHUBPREQ3_PREFETCH_SETTINGS_C                                                                 0x08df
+#define regHUBPREQ3_PREFETCH_SETTINGS_C_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_0                                                                 0x08e0
+#define regHUBPREQ3_VBLANK_PARAMETERS_0_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_1                                                                 0x08e1
+#define regHUBPREQ3_VBLANK_PARAMETERS_1_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_2                                                                 0x08e2
+#define regHUBPREQ3_VBLANK_PARAMETERS_2_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_3                                                                 0x08e3
+#define regHUBPREQ3_VBLANK_PARAMETERS_3_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_4                                                                 0x08e4
+#define regHUBPREQ3_VBLANK_PARAMETERS_4_BASE_IDX                                                        2
+#define regHUBPREQ3_FLIP_PARAMETERS_0                                                                   0x08e5
+#define regHUBPREQ3_FLIP_PARAMETERS_0_BASE_IDX                                                          2
+#define regHUBPREQ3_FLIP_PARAMETERS_1                                                                   0x08e6
+#define regHUBPREQ3_FLIP_PARAMETERS_1_BASE_IDX                                                          2
+#define regHUBPREQ3_FLIP_PARAMETERS_2                                                                   0x08e7
+#define regHUBPREQ3_FLIP_PARAMETERS_2_BASE_IDX                                                          2
+#define regHUBPREQ3_NOM_PARAMETERS_0                                                                    0x08e8
+#define regHUBPREQ3_NOM_PARAMETERS_0_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_1                                                                    0x08e9
+#define regHUBPREQ3_NOM_PARAMETERS_1_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_2                                                                    0x08ea
+#define regHUBPREQ3_NOM_PARAMETERS_2_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_3                                                                    0x08eb
+#define regHUBPREQ3_NOM_PARAMETERS_3_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_4                                                                    0x08ec
+#define regHUBPREQ3_NOM_PARAMETERS_4_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_5                                                                    0x08ed
+#define regHUBPREQ3_NOM_PARAMETERS_5_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_6                                                                    0x08ee
+#define regHUBPREQ3_NOM_PARAMETERS_6_BASE_IDX                                                           2
+#define regHUBPREQ3_NOM_PARAMETERS_7                                                                    0x08ef
+#define regHUBPREQ3_NOM_PARAMETERS_7_BASE_IDX                                                           2
+#define regHUBPREQ3_PER_LINE_DELIVERY_PRE                                                               0x08f0
+#define regHUBPREQ3_PER_LINE_DELIVERY_PRE_BASE_IDX                                                      2
+#define regHUBPREQ3_PER_LINE_DELIVERY                                                                   0x08f1
+#define regHUBPREQ3_PER_LINE_DELIVERY_BASE_IDX                                                          2
+#define regHUBPREQ3_CURSOR_SETTINGS                                                                     0x08f2
+#define regHUBPREQ3_CURSOR_SETTINGS_BASE_IDX                                                            2
+#define regHUBPREQ3_REF_FREQ_TO_PIX_FREQ                                                                0x08f3
+#define regHUBPREQ3_REF_FREQ_TO_PIX_FREQ_BASE_IDX                                                       2
+#define regHUBPREQ3_DST_Y_DELTA_DRQ_LIMIT                                                               0x08f4
+#define regHUBPREQ3_DST_Y_DELTA_DRQ_LIMIT_BASE_IDX                                                      2
+#define regHUBPREQ3_DST_Y_ALT_CH_DRQ_LIMIT                                                              0x08f5
+#define regHUBPREQ3_DST_Y_ALT_CH_DRQ_LIMIT_BASE_IDX                                                     2
+#define regHUBPREQ3_HUBPREQ_MEM_PWR_CTRL                                                                0x08f6
+#define regHUBPREQ3_HUBPREQ_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPREQ3_HUBPREQ_MEM_PWR_STATUS                                                              0x08f7
+#define regHUBPREQ3_HUBPREQ_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPREQ3_VBLANK_PARAMETERS_5                                                                 0x08fb
+#define regHUBPREQ3_VBLANK_PARAMETERS_5_BASE_IDX                                                        2
+#define regHUBPREQ3_VBLANK_PARAMETERS_6                                                                 0x08fc
+#define regHUBPREQ3_VBLANK_PARAMETERS_6_BASE_IDX                                                        2
+#define regHUBPREQ3_FLIP_PARAMETERS_3                                                                   0x08fd
+#define regHUBPREQ3_FLIP_PARAMETERS_3_BASE_IDX                                                          2
+#define regHUBPREQ3_FLIP_PARAMETERS_4                                                                   0x08fe
+#define regHUBPREQ3_FLIP_PARAMETERS_4_BASE_IDX                                                          2
+#define regHUBPREQ3_FLIP_PARAMETERS_5                                                                   0x08ff
+#define regHUBPREQ3_FLIP_PARAMETERS_5_BASE_IDX                                                          2
+#define regHUBPREQ3_FLIP_PARAMETERS_6                                                                   0x0900
+#define regHUBPREQ3_FLIP_PARAMETERS_6_BASE_IDX                                                          2
+#define regHUBPREQ3_UCLK_PSTATE_FORCE                                                                   0x0901
+#define regHUBPREQ3_UCLK_PSTATE_FORCE_BASE_IDX                                                          2
+#define regHUBPREQ3_HUBPREQ_STATUS_REG0                                                                 0x0902
+#define regHUBPREQ3_HUBPREQ_STATUS_REG0_BASE_IDX                                                        2
+#define regHUBPREQ3_HUBPREQ_STATUS_REG1                                                                 0x0903
+#define regHUBPREQ3_HUBPREQ_STATUS_REG1_BASE_IDX                                                        2
+#define regHUBPREQ3_HUBPREQ_STATUS_REG2                                                                 0x0904
+#define regHUBPREQ3_HUBPREQ_STATUS_REG2_BASE_IDX                                                        2
+#define regHUBPREQ3_HUBPREQ_STATUS_REG3                                                                 0x0905
+#define regHUBPREQ3_HUBPREQ_STATUS_REG3_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubpret_dispdec
+// base address: 0xa50
+#define regHUBPRET3_HUBPRET_CONTROL                                                                     0x090d
+#define regHUBPRET3_HUBPRET_CONTROL_BASE_IDX                                                            2
+#define regHUBPRET3_HUBPRET_MEM_PWR_CTRL                                                                0x090e
+#define regHUBPRET3_HUBPRET_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regHUBPRET3_HUBPRET_MEM_PWR_STATUS                                                              0x090f
+#define regHUBPRET3_HUBPRET_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regHUBPRET3_HUBPRET_READ_LINE_CTRL0                                                             0x0910
+#define regHUBPRET3_HUBPRET_READ_LINE_CTRL0_BASE_IDX                                                    2
+#define regHUBPRET3_HUBPRET_READ_LINE_CTRL1                                                             0x0911
+#define regHUBPRET3_HUBPRET_READ_LINE_CTRL1_BASE_IDX                                                    2
+#define regHUBPRET3_HUBPRET_READ_LINE0                                                                  0x0912
+#define regHUBPRET3_HUBPRET_READ_LINE0_BASE_IDX                                                         2
+#define regHUBPRET3_HUBPRET_READ_LINE1                                                                  0x0913
+#define regHUBPRET3_HUBPRET_READ_LINE1_BASE_IDX                                                         2
+#define regHUBPRET3_HUBPRET_INTERRUPT                                                                   0x0914
+#define regHUBPRET3_HUBPRET_INTERRUPT_BASE_IDX                                                          2
+#define regHUBPRET3_HUBPRET_READ_LINE_VALUE                                                             0x0915
+#define regHUBPRET3_HUBPRET_READ_LINE_VALUE_BASE_IDX                                                    2
+#define regHUBPRET3_HUBPRET_READ_LINE_STATUS                                                            0x0916
+#define regHUBPRET3_HUBPRET_READ_LINE_STATUS_BASE_IDX                                                   2
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_cursor0_dispdec
+// base address: 0xa50
+#define regCURSOR0_3_CURSOR_CONTROL                                                                     0x091a
+#define regCURSOR0_3_CURSOR_CONTROL_BASE_IDX                                                            2
+#define regCURSOR0_3_CURSOR_SURFACE_ADDRESS                                                             0x091b
+#define regCURSOR0_3_CURSOR_SURFACE_ADDRESS_BASE_IDX                                                    2
+#define regCURSOR0_3_CURSOR_SURFACE_ADDRESS_HIGH                                                        0x091c
+#define regCURSOR0_3_CURSOR_SURFACE_ADDRESS_HIGH_BASE_IDX                                               2
+#define regCURSOR0_3_CURSOR_SIZE                                                                        0x091d
+#define regCURSOR0_3_CURSOR_SIZE_BASE_IDX                                                               2
+#define regCURSOR0_3_CURSOR_POSITION                                                                    0x091e
+#define regCURSOR0_3_CURSOR_POSITION_BASE_IDX                                                           2
+#define regCURSOR0_3_CURSOR_HOT_SPOT                                                                    0x091f
+#define regCURSOR0_3_CURSOR_HOT_SPOT_BASE_IDX                                                           2
+#define regCURSOR0_3_CURSOR_STEREO_CONTROL                                                              0x0920
+#define regCURSOR0_3_CURSOR_STEREO_CONTROL_BASE_IDX                                                     2
+#define regCURSOR0_3_CURSOR_DST_OFFSET                                                                  0x0921
+#define regCURSOR0_3_CURSOR_DST_OFFSET_BASE_IDX                                                         2
+#define regCURSOR0_3_CURSOR_MEM_PWR_CTRL                                                                0x0922
+#define regCURSOR0_3_CURSOR_MEM_PWR_CTRL_BASE_IDX                                                       2
+#define regCURSOR0_3_CURSOR_MEM_PWR_STATUS                                                              0x0923
+#define regCURSOR0_3_CURSOR_MEM_PWR_STATUS_BASE_IDX                                                     2
+#define regCURSOR0_3_DMDATA_ADDRESS_HIGH                                                                0x0924
+#define regCURSOR0_3_DMDATA_ADDRESS_HIGH_BASE_IDX                                                       2
+#define regCURSOR0_3_DMDATA_ADDRESS_LOW                                                                 0x0925
+#define regCURSOR0_3_DMDATA_ADDRESS_LOW_BASE_IDX                                                        2
+#define regCURSOR0_3_DMDATA_CNTL                                                                        0x0926
+#define regCURSOR0_3_DMDATA_CNTL_BASE_IDX                                                               2
+#define regCURSOR0_3_DMDATA_QOS_CNTL                                                                    0x0927
+#define regCURSOR0_3_DMDATA_QOS_CNTL_BASE_IDX                                                           2
+#define regCURSOR0_3_DMDATA_STATUS                                                                      0x0928
+#define regCURSOR0_3_DMDATA_STATUS_BASE_IDX                                                             2
+#define regCURSOR0_3_DMDATA_SW_CNTL                                                                     0x0929
+#define regCURSOR0_3_DMDATA_SW_CNTL_BASE_IDX                                                            2
+#define regCURSOR0_3_DMDATA_SW_DATA                                                                     0x092a
+#define regCURSOR0_3_DMDATA_SW_DATA_BASE_IDX                                                            2
+#define regCURSOR0_3_HUBP_3DLUT_CONTROL                                                                 0x092b
+#define regCURSOR0_3_HUBP_3DLUT_CONTROL_BASE_IDX                                                        2
+#define regCURSOR0_3_HUBP_3DLUT_ADDRESS_LOW                                                             0x092c
+#define regCURSOR0_3_HUBP_3DLUT_ADDRESS_LOW_BASE_IDX                                                    2
+#define regCURSOR0_3_HUBP_3DLUT_ADDRESS_HIGH                                                            0x092d
+#define regCURSOR0_3_HUBP_3DLUT_ADDRESS_HIGH_BASE_IDX                                                   2
+#define regCURSOR0_3_HUBP_3DLUT_DLG_PARAM                                                               0x092e
+#define regCURSOR0_3_HUBP_3DLUT_DLG_PARAM_BASE_IDX                                                      2
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x24c4
+#define regDC_PERFMON9_PERFCOUNTER_CNTL                                                                 0x0931
+#define regDC_PERFMON9_PERFCOUNTER_CNTL_BASE_IDX                                                        2
+#define regDC_PERFMON9_PERFCOUNTER_CNTL2                                                                0x0932
+#define regDC_PERFMON9_PERFCOUNTER_CNTL2_BASE_IDX                                                       2
+#define regDC_PERFMON9_PERFCOUNTER_STATE                                                                0x0933
+#define regDC_PERFMON9_PERFCOUNTER_STATE_BASE_IDX                                                       2
+#define regDC_PERFMON9_PERFMON_CNTL                                                                     0x0934
+#define regDC_PERFMON9_PERFMON_CNTL_BASE_IDX                                                            2
+#define regDC_PERFMON9_PERFMON_CNTL2                                                                    0x0935
+#define regDC_PERFMON9_PERFMON_CNTL2_BASE_IDX                                                           2
+#define regDC_PERFMON9_PERFMON_CVALUE_INT_MISC                                                          0x0936
+#define regDC_PERFMON9_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                 2
+#define regDC_PERFMON9_PERFMON_CVALUE_LOW                                                               0x0937
+#define regDC_PERFMON9_PERFMON_CVALUE_LOW_BASE_IDX                                                      2
+#define regDC_PERFMON9_PERFMON_HI                                                                       0x0938
+#define regDC_PERFMON9_PERFMON_HI_BASE_IDX                                                              2
+#define regDC_PERFMON9_PERFMON_LOW                                                                      0x0939
+#define regDC_PERFMON9_PERFMON_LOW_BASE_IDX                                                             2
+#define regDC_PERFMON9_PERFMON_TEST_DEBUG_INDEX                                                         0x093a
+#define regDC_PERFMON9_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                                2
+#define regDC_PERFMON9_PERFMON_TEST_DEBUG_DATA                                                          0x093b
+#define regDC_PERFMON9_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                 2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cnvc_cfg_dispdec
+// base address: 0x0
+#define regCNVC_CFG0_CNVC_SURFACE_PIXEL_FORMAT                                                          0x0cd2
+#define regCNVC_CFG0_CNVC_SURFACE_PIXEL_FORMAT_BASE_IDX                                                 2
+#define regCNVC_CFG0_FORMAT_CONTROL                                                                     0x0cd3
+#define regCNVC_CFG0_FORMAT_CONTROL_BASE_IDX                                                            2
+#define regCNVC_CFG0_FCNV_FP_BIAS_R                                                                     0x0cd4
+#define regCNVC_CFG0_FCNV_FP_BIAS_R_BASE_IDX                                                            2
+#define regCNVC_CFG0_FCNV_FP_BIAS_G                                                                     0x0cd5
+#define regCNVC_CFG0_FCNV_FP_BIAS_G_BASE_IDX                                                            2
+#define regCNVC_CFG0_FCNV_FP_BIAS_B                                                                     0x0cd6
+#define regCNVC_CFG0_FCNV_FP_BIAS_B_BASE_IDX                                                            2
+#define regCNVC_CFG0_FCNV_FP_SCALE_R                                                                    0x0cd7
+#define regCNVC_CFG0_FCNV_FP_SCALE_R_BASE_IDX                                                           2
+#define regCNVC_CFG0_FCNV_FP_SCALE_G                                                                    0x0cd8
+#define regCNVC_CFG0_FCNV_FP_SCALE_G_BASE_IDX                                                           2
+#define regCNVC_CFG0_FCNV_FP_SCALE_B                                                                    0x0cd9
+#define regCNVC_CFG0_FCNV_FP_SCALE_B_BASE_IDX                                                           2
+#define regCNVC_CFG0_COLOR_KEYER_CONTROL                                                                0x0cda
+#define regCNVC_CFG0_COLOR_KEYER_CONTROL_BASE_IDX                                                       2
+#define regCNVC_CFG0_COLOR_KEYER_ALPHA                                                                  0x0cdb
+#define regCNVC_CFG0_COLOR_KEYER_ALPHA_BASE_IDX                                                         2
+#define regCNVC_CFG0_COLOR_KEYER_RED                                                                    0x0cdc
+#define regCNVC_CFG0_COLOR_KEYER_RED_BASE_IDX                                                           2
+#define regCNVC_CFG0_COLOR_KEYER_GREEN                                                                  0x0cdd
+#define regCNVC_CFG0_COLOR_KEYER_GREEN_BASE_IDX                                                         2
+#define regCNVC_CFG0_COLOR_KEYER_BLUE                                                                   0x0cde
+#define regCNVC_CFG0_COLOR_KEYER_BLUE_BASE_IDX                                                          2
+#define regCNVC_CFG0_ALPHA_2BIT_LUT01                                                                   0x0ce0
+#define regCNVC_CFG0_ALPHA_2BIT_LUT01_BASE_IDX                                                          2
+#define regCNVC_CFG0_ALPHA_2BIT_LUT23                                                                   0x0ce1
+#define regCNVC_CFG0_ALPHA_2BIT_LUT23_BASE_IDX                                                          2
+#define regCNVC_CFG0_PRE_DEALPHA                                                                        0x0ce2
+#define regCNVC_CFG0_PRE_DEALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG0_PRE_CSC_MODE                                                                       0x0ce3
+#define regCNVC_CFG0_PRE_CSC_MODE_BASE_IDX                                                              2
+#define regCNVC_CFG0_PRE_CSC_C11_C12                                                                    0x0ce4
+#define regCNVC_CFG0_PRE_CSC_C11_C12_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_C13_C14                                                                    0x0ce5
+#define regCNVC_CFG0_PRE_CSC_C13_C14_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_C21_C22                                                                    0x0ce6
+#define regCNVC_CFG0_PRE_CSC_C21_C22_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_C23_C24                                                                    0x0ce7
+#define regCNVC_CFG0_PRE_CSC_C23_C24_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_C31_C32                                                                    0x0ce8
+#define regCNVC_CFG0_PRE_CSC_C31_C32_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_C33_C34                                                                    0x0ce9
+#define regCNVC_CFG0_PRE_CSC_C33_C34_BASE_IDX                                                           2
+#define regCNVC_CFG0_PRE_CSC_B_C11_C12                                                                  0x0cea
+#define regCNVC_CFG0_PRE_CSC_B_C11_C12_BASE_IDX                                                         2
+#define regCNVC_CFG0_PRE_CSC_B_C13_C14                                                                  0x0ceb
+#define regCNVC_CFG0_PRE_CSC_B_C13_C14_BASE_IDX                                                         2
+#define regCNVC_CFG0_PRE_CSC_B_C21_C22                                                                  0x0cec
+#define regCNVC_CFG0_PRE_CSC_B_C21_C22_BASE_IDX                                                         2
+#define regCNVC_CFG0_PRE_CSC_B_C23_C24                                                                  0x0ced
+#define regCNVC_CFG0_PRE_CSC_B_C23_C24_BASE_IDX                                                         2
+#define regCNVC_CFG0_PRE_CSC_B_C31_C32                                                                  0x0cee
+#define regCNVC_CFG0_PRE_CSC_B_C31_C32_BASE_IDX                                                         2
+#define regCNVC_CFG0_PRE_CSC_B_C33_C34                                                                  0x0cef
+#define regCNVC_CFG0_PRE_CSC_B_C33_C34_BASE_IDX                                                         2
+#define regCNVC_CFG0_CNVC_COEF_FORMAT                                                                   0x0cf0
+#define regCNVC_CFG0_CNVC_COEF_FORMAT_BASE_IDX                                                          2
+#define regCNVC_CFG0_PRE_GAM                                                                            0x0cf1
+#define regCNVC_CFG0_PRE_GAM_BASE_IDX                                                                   2
+#define regCNVC_CFG0_PRE_REALPHA                                                                        0x0cf2
+#define regCNVC_CFG0_PRE_REALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG0_PIX_DROP_CNTL                                                                      0x0cf3
+#define regCNVC_CFG0_PIX_DROP_CNTL_BASE_IDX                                                             2
+#define regCNVC_CFG0_PIX_DROP_OUT                                                                       0x0cf4
+#define regCNVC_CFG0_PIX_DROP_OUT_BASE_IDX                                                              2
+#define regCNVC_CFG0_CNVC_UPSP_MODE                                                                     0x0cf5
+#define regCNVC_CFG0_CNVC_UPSP_MODE_BASE_IDX                                                            2
+#define regCNVC_CFG0_CNVC_UPSP_V_COEF_P0                                                                0x0cf6
+#define regCNVC_CFG0_CNVC_UPSP_V_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG0_CNVC_UPSP_V_COEF_P1                                                                0x0cf7
+#define regCNVC_CFG0_CNVC_UPSP_V_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG0_CNVC_UPSP_H_COEF_P0                                                                0x0cf8
+#define regCNVC_CFG0_CNVC_UPSP_H_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG0_CNVC_UPSP_H_COEF_P1                                                                0x0cf9
+#define regCNVC_CFG0_CNVC_UPSP_H_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG0_CNVC_UPSP_CLAMP                                                                    0x0cfa
+#define regCNVC_CFG0_CNVC_UPSP_CLAMP_BASE_IDX                                                           2
+#define regCNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL                                                             0x0cfb
+#define regCNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL_BASE_IDX                                                    2
+#define regCNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX                                                          0x0cfc
+#define regCNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regCNVC_CFG0_CNVC_CFG_TEST_DEBUG_DATA                                                           0x0cfd
+#define regCNVC_CFG0_CNVC_CFG_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cm_cur_dispdec
+// base address: 0x0
+#define regCM_CUR0_CURSOR0_CONTROL                                                                      0x0df6
+#define regCM_CUR0_CURSOR0_CONTROL_BASE_IDX                                                             2
+#define regCM_CUR0_CURSOR0_COLOR0                                                                       0x0df7
+#define regCM_CUR0_CURSOR0_COLOR0_BASE_IDX                                                              2
+#define regCM_CUR0_CURSOR0_COLOR1                                                                       0x0df8
+#define regCM_CUR0_CURSOR0_COLOR1_BASE_IDX                                                              2
+#define regCM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y                                                            0x0df9
+#define regCM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y_BASE_IDX                                                   2
+#define regCM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB                                                        0x0dfa
+#define regCM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB_BASE_IDX                                               2
+#define regCM_CUR0_CUR0_MATRIX_MODE                                                                     0x0dfb
+#define regCM_CUR0_CUR0_MATRIX_MODE_BASE_IDX                                                            2
+#define regCM_CUR0_CUR0_MATRIX_C11_C12_A                                                                0x0dfc
+#define regCM_CUR0_CUR0_MATRIX_C11_C12_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C13_C14_A                                                                0x0dfd
+#define regCM_CUR0_CUR0_MATRIX_C13_C14_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C21_C22_A                                                                0x0dfe
+#define regCM_CUR0_CUR0_MATRIX_C21_C22_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C23_C24_A                                                                0x0dff
+#define regCM_CUR0_CUR0_MATRIX_C23_C24_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C31_C32_A                                                                0x0e00
+#define regCM_CUR0_CUR0_MATRIX_C31_C32_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C33_C34_A                                                                0x0e01
+#define regCM_CUR0_CUR0_MATRIX_C33_C34_A_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C11_C12_B                                                                0x0e02
+#define regCM_CUR0_CUR0_MATRIX_C11_C12_B_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C13_C14_B                                                                0x0e03
+#define regCM_CUR0_CUR0_MATRIX_C13_C14_B_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C21_C22_B                                                                0x0e04
+#define regCM_CUR0_CUR0_MATRIX_C21_C22_B_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C23_C24_B                                                                0x0e05
+#define regCM_CUR0_CUR0_MATRIX_C23_C24_B_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C31_C32_B                                                                0x0e06
+#define regCM_CUR0_CUR0_MATRIX_C31_C32_B_BASE_IDX                                                       2
+#define regCM_CUR0_CUR0_MATRIX_C33_C34_B                                                                0x0e07
+#define regCM_CUR0_CUR0_MATRIX_C33_C34_B_BASE_IDX                                                       2
+#define regCM_CUR0_CM_CUR0_TEST_DEBUG_INDEX                                                             0x0e08
+#define regCM_CUR0_CM_CUR0_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regCM_CUR0_CM_CUR0_TEST_DEBUG_DATA                                                              0x0e09
+#define regCM_CUR0_CM_CUR0_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dscl_dispdec
+// base address: 0x0
+#define regDSCL0_SCL_COEF_RAM_TAP_SELECT                                                                0x0d0b
+#define regDSCL0_SCL_COEF_RAM_TAP_SELECT_BASE_IDX                                                       2
+#define regDSCL0_SCL_COEF_RAM_TAP_DATA                                                                  0x0d0c
+#define regDSCL0_SCL_COEF_RAM_TAP_DATA_BASE_IDX                                                         2
+#define regDSCL0_SCL_MODE                                                                               0x0d0d
+#define regDSCL0_SCL_MODE_BASE_IDX                                                                      2
+#define regDSCL0_SCL_TAP_CONTROL                                                                        0x0d0e
+#define regDSCL0_SCL_TAP_CONTROL_BASE_IDX                                                               2
+#define regDSCL0_DSCL_CONTROL                                                                           0x0d0f
+#define regDSCL0_DSCL_CONTROL_BASE_IDX                                                                  2
+#define regDSCL0_DSCL_2TAP_CONTROL                                                                      0x0d10
+#define regDSCL0_DSCL_2TAP_CONTROL_BASE_IDX                                                             2
+#define regDSCL0_SCL_MANUAL_REPLICATE_CONTROL                                                           0x0d11
+#define regDSCL0_SCL_MANUAL_REPLICATE_CONTROL_BASE_IDX                                                  2
+#define regDSCL0_SCL_HORZ_FILTER_SCALE_RATIO                                                            0x0d12
+#define regDSCL0_SCL_HORZ_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL0_SCL_HORZ_FILTER_INIT                                                                   0x0d13
+#define regDSCL0_SCL_HORZ_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL0_SCL_HORZ_FILTER_SCALE_RATIO_C                                                          0x0d14
+#define regDSCL0_SCL_HORZ_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL0_SCL_HORZ_FILTER_INIT_C                                                                 0x0d15
+#define regDSCL0_SCL_HORZ_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL0_SCL_VERT_FILTER_SCALE_RATIO                                                            0x0d16
+#define regDSCL0_SCL_VERT_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL0_SCL_VERT_FILTER_INIT                                                                   0x0d17
+#define regDSCL0_SCL_VERT_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL0_SCL_VERT_FILTER_SCALE_RATIO_C                                                          0x0d18
+#define regDSCL0_SCL_VERT_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL0_SCL_VERT_FILTER_INIT_C                                                                 0x0d19
+#define regDSCL0_SCL_VERT_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL0_SCL_BLACK_COLOR                                                                        0x0d1b
+#define regDSCL0_SCL_BLACK_COLOR_BASE_IDX                                                               2
+#define regDSCL0_DSCL_UPDATE                                                                            0x0d1c
+#define regDSCL0_DSCL_UPDATE_BASE_IDX                                                                   2
+#define regDSCL0_DSCL_AUTOCAL                                                                           0x0d1d
+#define regDSCL0_DSCL_AUTOCAL_BASE_IDX                                                                  2
+#define regDSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT                                                           0x0d1e
+#define regDSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT_BASE_IDX                                                  2
+#define regDSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM                                                           0x0d1f
+#define regDSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM_BASE_IDX                                                  2
+#define regDSCL0_OTG_H_BLANK                                                                            0x0d20
+#define regDSCL0_OTG_H_BLANK_BASE_IDX                                                                   2
+#define regDSCL0_OTG_V_BLANK                                                                            0x0d21
+#define regDSCL0_OTG_V_BLANK_BASE_IDX                                                                   2
+#define regDSCL0_RECOUT_START                                                                           0x0d22
+#define regDSCL0_RECOUT_START_BASE_IDX                                                                  2
+#define regDSCL0_RECOUT_SIZE                                                                            0x0d23
+#define regDSCL0_RECOUT_SIZE_BASE_IDX                                                                   2
+#define regDSCL0_MPC_SIZE                                                                               0x0d24
+#define regDSCL0_MPC_SIZE_BASE_IDX                                                                      2
+#define regDSCL0_LB_DATA_FORMAT                                                                         0x0d25
+#define regDSCL0_LB_DATA_FORMAT_BASE_IDX                                                                2
+#define regDSCL0_LB_MEMORY_CTRL                                                                         0x0d26
+#define regDSCL0_LB_MEMORY_CTRL_BASE_IDX                                                                2
+#define regDSCL0_LB_V_COUNTER                                                                           0x0d27
+#define regDSCL0_LB_V_COUNTER_BASE_IDX                                                                  2
+#define regDSCL0_DSCL_MEM_PWR_CTRL                                                                      0x0d28
+#define regDSCL0_DSCL_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL0_DSCL_MEM_PWR_STATUS                                                                    0x0d29
+#define regDSCL0_DSCL_MEM_PWR_STATUS_BASE_IDX                                                           2
+#define regDSCL0_OBUF_CONTROL                                                                           0x0d2a
+#define regDSCL0_OBUF_CONTROL_BASE_IDX                                                                  2
+#define regDSCL0_OBUF_MEM_PWR_CTRL                                                                      0x0d2b
+#define regDSCL0_OBUF_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL0_DSCL_EASF_H_MODE                                                                       0x0d2c
+#define regDSCL0_DSCL_EASF_H_MODE_BASE_IDX                                                              2
+#define regDSCL0_DSCL_EASF_V_MODE                                                                       0x0d2d
+#define regDSCL0_DSCL_EASF_V_MODE_BASE_IDX                                                              2
+#define regDSCL0_DSCL_SC_MODE                                                                           0x0d2e
+#define regDSCL0_DSCL_SC_MODE_BASE_IDX                                                                  2
+#define regDSCL0_DSCL_SC_MATRIX_C0C1                                                                    0x0d2f
+#define regDSCL0_DSCL_SC_MATRIX_C0C1_BASE_IDX                                                           2
+#define regDSCL0_DSCL_SC_MATRIX_C2C3                                                                    0x0d30
+#define regDSCL0_DSCL_SC_MATRIX_C2C3_BASE_IDX                                                           2
+#define regDSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN                                                       0x0d31
+#define regDSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE                                                     0x0d32
+#define regDSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN                                                       0x0d33
+#define regDSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE                                                     0x0d34
+#define regDSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1                                                         0x0d35
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1_BASE_IDX                                                2
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2                                                         0x0d36
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2_BASE_IDX                                                2
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3                                                         0x0d37
+#define regDSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3_BASE_IDX                                                2
+#define regDSCL0_DSCL_EASF_RINGEST_FORCE                                                                0x0d38
+#define regDSCL0_DSCL_EASF_RINGEST_FORCE_BASE_IDX                                                       2
+#define regDSCL0_DSCL_EASF_H_BF_CNTL                                                                    0x0d39
+#define regDSCL0_DSCL_EASF_H_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN                                                           0x0d3a
+#define regDSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL0_DSCL_EASF_V_BF_CNTL                                                                    0x0d3b
+#define regDSCL0_DSCL_EASF_V_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN                                                           0x0d3c
+#define regDSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG0                                                               0x0d3d
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG1                                                               0x0d3e
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG2                                                               0x0d3f
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG3                                                               0x0d40
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG4                                                               0x0d41
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG5                                                               0x0d42
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG6                                                               0x0d43
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG7                                                               0x0d44
+#define regDSCL0_DSCL_EASF_H_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG0                                                               0x0d45
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG1                                                               0x0d46
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG2                                                               0x0d47
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG3                                                               0x0d48
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG4                                                               0x0d49
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG5                                                               0x0d4a
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG6                                                               0x0d4b
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG7                                                               0x0d4c
+#define regDSCL0_DSCL_EASF_V_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG0                                                               0x0d4d
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG1                                                               0x0d4e
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG2                                                               0x0d4f
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG3                                                               0x0d50
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG4                                                               0x0d51
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG5                                                               0x0d52
+#define regDSCL0_DSCL_EASF_H_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG0                                                               0x0d53
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG1                                                               0x0d54
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG2                                                               0x0d55
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG3                                                               0x0d56
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG4                                                               0x0d57
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG5                                                               0x0d58
+#define regDSCL0_DSCL_EASF_V_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL0_ISHARP_MODE                                                                            0x0d59
+#define regDSCL0_ISHARP_MODE_BASE_IDX                                                                   2
+#define regDSCL0_ISHARP_DELTA_CTRL                                                                      0x0d5a
+#define regDSCL0_ISHARP_DELTA_CTRL_BASE_IDX                                                             2
+#define regDSCL0_ISHARP_DELTA_INDEX                                                                     0x0d5b
+#define regDSCL0_ISHARP_DELTA_INDEX_BASE_IDX                                                            2
+#define regDSCL0_ISHARP_DELTA_DATA                                                                      0x0d5c
+#define regDSCL0_ISHARP_DELTA_DATA_BASE_IDX                                                             2
+#define regDSCL0_ISHARP_NLDELTA_SOFT_CLIP                                                               0x0d5d
+#define regDSCL0_ISHARP_NLDELTA_SOFT_CLIP_BASE_IDX                                                      2
+#define regDSCL0_ISHARP_NOISEDET_THRESHOLD                                                              0x0d5e
+#define regDSCL0_ISHARP_NOISEDET_THRESHOLD_BASE_IDX                                                     2
+#define regDSCL0_ISHARP_NOISE_GAIN_PWL                                                                  0x0d5f
+#define regDSCL0_ISHARP_NOISE_GAIN_PWL_BASE_IDX                                                         2
+#define regDSCL0_ISHARP_LBA_PWL_SEG0                                                                    0x0d60
+#define regDSCL0_ISHARP_LBA_PWL_SEG0_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_LBA_PWL_SEG1                                                                    0x0d61
+#define regDSCL0_ISHARP_LBA_PWL_SEG1_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_LBA_PWL_SEG2                                                                    0x0d62
+#define regDSCL0_ISHARP_LBA_PWL_SEG2_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_LBA_PWL_SEG3                                                                    0x0d63
+#define regDSCL0_ISHARP_LBA_PWL_SEG3_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_LBA_PWL_SEG4                                                                    0x0d64
+#define regDSCL0_ISHARP_LBA_PWL_SEG4_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_LBA_PWL_SEG5                                                                    0x0d65
+#define regDSCL0_ISHARP_LBA_PWL_SEG5_BASE_IDX                                                           2
+#define regDSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL                                                          0x0d66
+#define regDSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL_BASE_IDX                                                 2
+#define regDSCL0_DSCL_DEBUG                                                                             0x0d67
+#define regDSCL0_DSCL_DEBUG_BASE_IDX                                                                    2
+#define regDSCL0_DSCL_TEST_DEBUG_INDEX                                                                  0x0d68
+#define regDSCL0_DSCL_TEST_DEBUG_INDEX_BASE_IDX                                                         2
+#define regDSCL0_DSCL_TEST_DEBUG_DATA                                                                   0x0d69
+#define regDSCL0_DSCL_TEST_DEBUG_DATA_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cm_dispdec
+// base address: 0x0
+#define regCM0_CM_CONTROL                                                                               0x0d6a
+#define regCM0_CM_CONTROL_BASE_IDX                                                                      2
+#define regCM0_CM_POST_CSC_CONTROL                                                                      0x0d6b
+#define regCM0_CM_POST_CSC_CONTROL_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C11_C12                                                                      0x0d6c
+#define regCM0_CM_POST_CSC_C11_C12_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C13_C14                                                                      0x0d6d
+#define regCM0_CM_POST_CSC_C13_C14_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C21_C22                                                                      0x0d6e
+#define regCM0_CM_POST_CSC_C21_C22_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C23_C24                                                                      0x0d6f
+#define regCM0_CM_POST_CSC_C23_C24_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C31_C32                                                                      0x0d70
+#define regCM0_CM_POST_CSC_C31_C32_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_C33_C34                                                                      0x0d71
+#define regCM0_CM_POST_CSC_C33_C34_BASE_IDX                                                             2
+#define regCM0_CM_POST_CSC_B_C11_C12                                                                    0x0d72
+#define regCM0_CM_POST_CSC_B_C11_C12_BASE_IDX                                                           2
+#define regCM0_CM_POST_CSC_B_C13_C14                                                                    0x0d73
+#define regCM0_CM_POST_CSC_B_C13_C14_BASE_IDX                                                           2
+#define regCM0_CM_POST_CSC_B_C21_C22                                                                    0x0d74
+#define regCM0_CM_POST_CSC_B_C21_C22_BASE_IDX                                                           2
+#define regCM0_CM_POST_CSC_B_C23_C24                                                                    0x0d75
+#define regCM0_CM_POST_CSC_B_C23_C24_BASE_IDX                                                           2
+#define regCM0_CM_POST_CSC_B_C31_C32                                                                    0x0d76
+#define regCM0_CM_POST_CSC_B_C31_C32_BASE_IDX                                                           2
+#define regCM0_CM_POST_CSC_B_C33_C34                                                                    0x0d77
+#define regCM0_CM_POST_CSC_B_C33_C34_BASE_IDX                                                           2
+#define regCM0_CM_BIAS_CR_R                                                                             0x0d78
+#define regCM0_CM_BIAS_CR_R_BASE_IDX                                                                    2
+#define regCM0_CM_BIAS_Y_G_CB_B                                                                         0x0d79
+#define regCM0_CM_BIAS_Y_G_CB_B_BASE_IDX                                                                2
+#define regCM0_CM_GAMCOR_CONTROL                                                                        0x0d7a
+#define regCM0_CM_GAMCOR_CONTROL_BASE_IDX                                                               2
+#define regCM0_CM_GAMCOR_LUT_INDEX                                                                      0x0d7b
+#define regCM0_CM_GAMCOR_LUT_INDEX_BASE_IDX                                                             2
+#define regCM0_CM_GAMCOR_LUT_DATA                                                                       0x0d7c
+#define regCM0_CM_GAMCOR_LUT_DATA_BASE_IDX                                                              2
+#define regCM0_CM_GAMCOR_LUT_CONTROL                                                                    0x0d7d
+#define regCM0_CM_GAMCOR_LUT_CONTROL_BASE_IDX                                                           2
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_B                                                              0x0d7e
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_B_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_G                                                              0x0d7f
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_G_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_R                                                              0x0d80
+#define regCM0_CM_GAMCOR_RAMA_START_CNTL_R_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B                                                        0x0d81
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G                                                        0x0d82
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R                                                        0x0d83
+#define regCM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_B                                                         0x0d84
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_G                                                         0x0d85
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_R                                                         0x0d86
+#define regCM0_CM_GAMCOR_RAMA_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_B                                                               0x0d87
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_B                                                               0x0d88
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_G                                                               0x0d89
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_G                                                               0x0d8a
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_R                                                               0x0d8b
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_R                                                               0x0d8c
+#define regCM0_CM_GAMCOR_RAMA_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_B                                                                  0x0d8d
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_B_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_G                                                                  0x0d8e
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_G_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_R                                                                  0x0d8f
+#define regCM0_CM_GAMCOR_RAMA_OFFSET_R_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMA_REGION_0_1                                                                0x0d90
+#define regCM0_CM_GAMCOR_RAMA_REGION_0_1_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMA_REGION_2_3                                                                0x0d91
+#define regCM0_CM_GAMCOR_RAMA_REGION_2_3_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMA_REGION_4_5                                                                0x0d92
+#define regCM0_CM_GAMCOR_RAMA_REGION_4_5_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMA_REGION_6_7                                                                0x0d93
+#define regCM0_CM_GAMCOR_RAMA_REGION_6_7_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMA_REGION_8_9                                                                0x0d94
+#define regCM0_CM_GAMCOR_RAMA_REGION_8_9_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMA_REGION_10_11                                                              0x0d95
+#define regCM0_CM_GAMCOR_RAMA_REGION_10_11_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_12_13                                                              0x0d96
+#define regCM0_CM_GAMCOR_RAMA_REGION_12_13_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_14_15                                                              0x0d97
+#define regCM0_CM_GAMCOR_RAMA_REGION_14_15_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_16_17                                                              0x0d98
+#define regCM0_CM_GAMCOR_RAMA_REGION_16_17_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_18_19                                                              0x0d99
+#define regCM0_CM_GAMCOR_RAMA_REGION_18_19_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_20_21                                                              0x0d9a
+#define regCM0_CM_GAMCOR_RAMA_REGION_20_21_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_22_23                                                              0x0d9b
+#define regCM0_CM_GAMCOR_RAMA_REGION_22_23_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_24_25                                                              0x0d9c
+#define regCM0_CM_GAMCOR_RAMA_REGION_24_25_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_26_27                                                              0x0d9d
+#define regCM0_CM_GAMCOR_RAMA_REGION_26_27_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_28_29                                                              0x0d9e
+#define regCM0_CM_GAMCOR_RAMA_REGION_28_29_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_30_31                                                              0x0d9f
+#define regCM0_CM_GAMCOR_RAMA_REGION_30_31_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMA_REGION_32_33                                                              0x0da0
+#define regCM0_CM_GAMCOR_RAMA_REGION_32_33_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_B                                                              0x0da1
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_B_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_G                                                              0x0da2
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_G_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_R                                                              0x0da3
+#define regCM0_CM_GAMCOR_RAMB_START_CNTL_R_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B                                                        0x0da4
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G                                                        0x0da5
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R                                                        0x0da6
+#define regCM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_B                                                         0x0da7
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_G                                                         0x0da8
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_R                                                         0x0da9
+#define regCM0_CM_GAMCOR_RAMB_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_B                                                               0x0daa
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_B                                                               0x0dab
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_G                                                               0x0dac
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_G                                                               0x0dad
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_R                                                               0x0dae
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_R                                                               0x0daf
+#define regCM0_CM_GAMCOR_RAMB_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_B                                                                  0x0db0
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_B_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_G                                                                  0x0db1
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_G_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_R                                                                  0x0db2
+#define regCM0_CM_GAMCOR_RAMB_OFFSET_R_BASE_IDX                                                         2
+#define regCM0_CM_GAMCOR_RAMB_REGION_0_1                                                                0x0db3
+#define regCM0_CM_GAMCOR_RAMB_REGION_0_1_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMB_REGION_2_3                                                                0x0db4
+#define regCM0_CM_GAMCOR_RAMB_REGION_2_3_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMB_REGION_4_5                                                                0x0db5
+#define regCM0_CM_GAMCOR_RAMB_REGION_4_5_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMB_REGION_6_7                                                                0x0db6
+#define regCM0_CM_GAMCOR_RAMB_REGION_6_7_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMB_REGION_8_9                                                                0x0db7
+#define regCM0_CM_GAMCOR_RAMB_REGION_8_9_BASE_IDX                                                       2
+#define regCM0_CM_GAMCOR_RAMB_REGION_10_11                                                              0x0db8
+#define regCM0_CM_GAMCOR_RAMB_REGION_10_11_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_12_13                                                              0x0db9
+#define regCM0_CM_GAMCOR_RAMB_REGION_12_13_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_14_15                                                              0x0dba
+#define regCM0_CM_GAMCOR_RAMB_REGION_14_15_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_16_17                                                              0x0dbb
+#define regCM0_CM_GAMCOR_RAMB_REGION_16_17_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_18_19                                                              0x0dbc
+#define regCM0_CM_GAMCOR_RAMB_REGION_18_19_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_20_21                                                              0x0dbd
+#define regCM0_CM_GAMCOR_RAMB_REGION_20_21_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_22_23                                                              0x0dbe
+#define regCM0_CM_GAMCOR_RAMB_REGION_22_23_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_24_25                                                              0x0dbf
+#define regCM0_CM_GAMCOR_RAMB_REGION_24_25_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_26_27                                                              0x0dc0
+#define regCM0_CM_GAMCOR_RAMB_REGION_26_27_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_28_29                                                              0x0dc1
+#define regCM0_CM_GAMCOR_RAMB_REGION_28_29_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_30_31                                                              0x0dc2
+#define regCM0_CM_GAMCOR_RAMB_REGION_30_31_BASE_IDX                                                     2
+#define regCM0_CM_GAMCOR_RAMB_REGION_32_33                                                              0x0dc3
+#define regCM0_CM_GAMCOR_RAMB_REGION_32_33_BASE_IDX                                                     2
+#define regCM0_CM_HDR_MULT_COEF                                                                         0x0dc4
+#define regCM0_CM_HDR_MULT_COEF_BASE_IDX                                                                2
+#define regCM0_CM_MEM_PWR_CTRL                                                                          0x0dc5
+#define regCM0_CM_MEM_PWR_CTRL_BASE_IDX                                                                 2
+#define regCM0_CM_MEM_PWR_STATUS                                                                        0x0dc6
+#define regCM0_CM_MEM_PWR_STATUS_BASE_IDX                                                               2
+#define regCM0_CM_DEALPHA                                                                               0x0dc8
+#define regCM0_CM_DEALPHA_BASE_IDX                                                                      2
+#define regCM0_CM_COEF_FORMAT                                                                           0x0dc9
+#define regCM0_CM_COEF_FORMAT_BASE_IDX                                                                  2
+#define regCM0_CM_TEST_DEBUG_INDEX                                                                      0x0dca
+#define regCM0_CM_TEST_DEBUG_INDEX_BASE_IDX                                                             2
+#define regCM0_CM_TEST_DEBUG_DATA                                                                       0x0dcb
+#define regCM0_CM_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regCM0_CM_HIST_CNTL                                                                             0x0dcc
+#define regCM0_CM_HIST_CNTL_BASE_IDX                                                                    2
+#define regCM0_CM_HIST_SCALE_SRC1                                                                       0x0dcd
+#define regCM0_CM_HIST_SCALE_SRC1_BASE_IDX                                                              2
+#define regCM0_CM_HIST_COEFA_SRC2                                                                       0x0dce
+#define regCM0_CM_HIST_COEFA_SRC2_BASE_IDX                                                              2
+#define regCM0_CM_HIST_COEFB_SRC2                                                                       0x0dcf
+#define regCM0_CM_HIST_COEFB_SRC2_BASE_IDX                                                              2
+#define regCM0_CM_HIST_COEFC_SRC2                                                                       0x0dd0
+#define regCM0_CM_HIST_COEFC_SRC2_BASE_IDX                                                              2
+#define regCM0_CM_HIST_SCALE_SRC3                                                                       0x0dd1
+#define regCM0_CM_HIST_SCALE_SRC3_BASE_IDX                                                              2
+#define regCM0_CM_HIST_BIAS_SRC1                                                                        0x0dd2
+#define regCM0_CM_HIST_BIAS_SRC1_BASE_IDX                                                               2
+#define regCM0_CM_HIST_BIAS_SRC2                                                                        0x0dd3
+#define regCM0_CM_HIST_BIAS_SRC2_BASE_IDX                                                               2
+#define regCM0_CM_HIST_BIAS_SRC3                                                                        0x0dd4
+#define regCM0_CM_HIST_BIAS_SRC3_BASE_IDX                                                               2
+#define regCM0_CM_HIST_LOCK                                                                             0x0dd5
+#define regCM0_CM_HIST_LOCK_BASE_IDX                                                                    2
+#define regCM0_CM_HIST_INDEX                                                                            0x0dd6
+#define regCM0_CM_HIST_INDEX_BASE_IDX                                                                   2
+#define regCM0_CM_HIST_DATA                                                                             0x0dd7
+#define regCM0_CM_HIST_DATA_BASE_IDX                                                                    2
+#define regCM0_CM_HIST_STATUS                                                                           0x0dd8
+#define regCM0_CM_HIST_STATUS_BASE_IDX                                                                  2
+#define regCM0_CM_HIST_INT_CONTROL                                                                      0x0dd9
+#define regCM0_CM_HIST_INT_CONTROL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dpp_top_dispdec
+// base address: 0x0
+#define regDPP_TOP0_DPP_CONTROL                                                                         0x0cc5
+#define regDPP_TOP0_DPP_CONTROL_BASE_IDX                                                                2
+#define regDPP_TOP0_DPP_SOFT_RESET                                                                      0x0cc6
+#define regDPP_TOP0_DPP_SOFT_RESET_BASE_IDX                                                             2
+#define regDPP_TOP0_DPP_CRC_VAL_R                                                                       0x0cc7
+#define regDPP_TOP0_DPP_CRC_VAL_R_BASE_IDX                                                              2
+#define regDPP_TOP0_DPP_CRC_VAL_G                                                                       0x0cc8
+#define regDPP_TOP0_DPP_CRC_VAL_G_BASE_IDX                                                              2
+#define regDPP_TOP0_DPP_CRC_VAL_B                                                                       0x0cc9
+#define regDPP_TOP0_DPP_CRC_VAL_B_BASE_IDX                                                              2
+#define regDPP_TOP0_DPP_CRC_VAL_A                                                                       0x0cca
+#define regDPP_TOP0_DPP_CRC_VAL_A_BASE_IDX                                                              2
+#define regDPP_TOP0_DPP_CRC_CTRL                                                                        0x0ccb
+#define regDPP_TOP0_DPP_CRC_CTRL_BASE_IDX                                                               2
+#define regDPP_TOP0_HOST_READ_CONTROL                                                                   0x0ccc
+#define regDPP_TOP0_HOST_READ_CONTROL_BASE_IDX                                                          2
+#define regDPP_TOP0_DPP_DEBUG_SEL                                                                       0x0ccd
+#define regDPP_TOP0_DPP_DEBUG_SEL_BASE_IDX                                                              2
+#define regDPP_TOP0_DPP_DEBUG_SPARE                                                                     0x0cce
+#define regDPP_TOP0_DPP_DEBUG_SPARE_BASE_IDX                                                            2
+#define regDPP_TOP0_DPP_TEST_DEBUG_INDEX                                                                0x0ccf
+#define regDPP_TOP0_DPP_TEST_DEBUG_INDEX_BASE_IDX                                                       2
+#define regDPP_TOP0_DPP_TEST_DEBUG_DATA                                                                 0x0cd0
+#define regDPP_TOP0_DPP_TEST_DEBUG_DATA_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x3890
+#define regDC_PERFMON10_PERFCOUNTER_CNTL                                                                0x0e24
+#define regDC_PERFMON10_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON10_PERFCOUNTER_CNTL2                                                               0x0e25
+#define regDC_PERFMON10_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON10_PERFCOUNTER_STATE                                                               0x0e26
+#define regDC_PERFMON10_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON10_PERFMON_CNTL                                                                    0x0e27
+#define regDC_PERFMON10_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON10_PERFMON_CNTL2                                                                   0x0e28
+#define regDC_PERFMON10_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON10_PERFMON_CVALUE_INT_MISC                                                         0x0e29
+#define regDC_PERFMON10_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON10_PERFMON_CVALUE_LOW                                                              0x0e2a
+#define regDC_PERFMON10_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON10_PERFMON_HI                                                                      0x0e2b
+#define regDC_PERFMON10_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON10_PERFMON_LOW                                                                     0x0e2c
+#define regDC_PERFMON10_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON10_PERFMON_TEST_DEBUG_INDEX                                                        0x0e2d
+#define regDC_PERFMON10_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON10_PERFMON_TEST_DEBUG_DATA                                                         0x0e2e
+#define regDC_PERFMON10_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cnvc_cfg_dispdec
+// base address: 0x5ac
+#define regCNVC_CFG1_CNVC_SURFACE_PIXEL_FORMAT                                                          0x0e3d
+#define regCNVC_CFG1_CNVC_SURFACE_PIXEL_FORMAT_BASE_IDX                                                 2
+#define regCNVC_CFG1_FORMAT_CONTROL                                                                     0x0e3e
+#define regCNVC_CFG1_FORMAT_CONTROL_BASE_IDX                                                            2
+#define regCNVC_CFG1_FCNV_FP_BIAS_R                                                                     0x0e3f
+#define regCNVC_CFG1_FCNV_FP_BIAS_R_BASE_IDX                                                            2
+#define regCNVC_CFG1_FCNV_FP_BIAS_G                                                                     0x0e40
+#define regCNVC_CFG1_FCNV_FP_BIAS_G_BASE_IDX                                                            2
+#define regCNVC_CFG1_FCNV_FP_BIAS_B                                                                     0x0e41
+#define regCNVC_CFG1_FCNV_FP_BIAS_B_BASE_IDX                                                            2
+#define regCNVC_CFG1_FCNV_FP_SCALE_R                                                                    0x0e42
+#define regCNVC_CFG1_FCNV_FP_SCALE_R_BASE_IDX                                                           2
+#define regCNVC_CFG1_FCNV_FP_SCALE_G                                                                    0x0e43
+#define regCNVC_CFG1_FCNV_FP_SCALE_G_BASE_IDX                                                           2
+#define regCNVC_CFG1_FCNV_FP_SCALE_B                                                                    0x0e44
+#define regCNVC_CFG1_FCNV_FP_SCALE_B_BASE_IDX                                                           2
+#define regCNVC_CFG1_COLOR_KEYER_CONTROL                                                                0x0e45
+#define regCNVC_CFG1_COLOR_KEYER_CONTROL_BASE_IDX                                                       2
+#define regCNVC_CFG1_COLOR_KEYER_ALPHA                                                                  0x0e46
+#define regCNVC_CFG1_COLOR_KEYER_ALPHA_BASE_IDX                                                         2
+#define regCNVC_CFG1_COLOR_KEYER_RED                                                                    0x0e47
+#define regCNVC_CFG1_COLOR_KEYER_RED_BASE_IDX                                                           2
+#define regCNVC_CFG1_COLOR_KEYER_GREEN                                                                  0x0e48
+#define regCNVC_CFG1_COLOR_KEYER_GREEN_BASE_IDX                                                         2
+#define regCNVC_CFG1_COLOR_KEYER_BLUE                                                                   0x0e49
+#define regCNVC_CFG1_COLOR_KEYER_BLUE_BASE_IDX                                                          2
+#define regCNVC_CFG1_ALPHA_2BIT_LUT01                                                                   0x0e4b
+#define regCNVC_CFG1_ALPHA_2BIT_LUT01_BASE_IDX                                                          2
+#define regCNVC_CFG1_ALPHA_2BIT_LUT23                                                                   0x0e4c
+#define regCNVC_CFG1_ALPHA_2BIT_LUT23_BASE_IDX                                                          2
+#define regCNVC_CFG1_PRE_DEALPHA                                                                        0x0e4d
+#define regCNVC_CFG1_PRE_DEALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG1_PRE_CSC_MODE                                                                       0x0e4e
+#define regCNVC_CFG1_PRE_CSC_MODE_BASE_IDX                                                              2
+#define regCNVC_CFG1_PRE_CSC_C11_C12                                                                    0x0e4f
+#define regCNVC_CFG1_PRE_CSC_C11_C12_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_C13_C14                                                                    0x0e50
+#define regCNVC_CFG1_PRE_CSC_C13_C14_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_C21_C22                                                                    0x0e51
+#define regCNVC_CFG1_PRE_CSC_C21_C22_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_C23_C24                                                                    0x0e52
+#define regCNVC_CFG1_PRE_CSC_C23_C24_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_C31_C32                                                                    0x0e53
+#define regCNVC_CFG1_PRE_CSC_C31_C32_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_C33_C34                                                                    0x0e54
+#define regCNVC_CFG1_PRE_CSC_C33_C34_BASE_IDX                                                           2
+#define regCNVC_CFG1_PRE_CSC_B_C11_C12                                                                  0x0e55
+#define regCNVC_CFG1_PRE_CSC_B_C11_C12_BASE_IDX                                                         2
+#define regCNVC_CFG1_PRE_CSC_B_C13_C14                                                                  0x0e56
+#define regCNVC_CFG1_PRE_CSC_B_C13_C14_BASE_IDX                                                         2
+#define regCNVC_CFG1_PRE_CSC_B_C21_C22                                                                  0x0e57
+#define regCNVC_CFG1_PRE_CSC_B_C21_C22_BASE_IDX                                                         2
+#define regCNVC_CFG1_PRE_CSC_B_C23_C24                                                                  0x0e58
+#define regCNVC_CFG1_PRE_CSC_B_C23_C24_BASE_IDX                                                         2
+#define regCNVC_CFG1_PRE_CSC_B_C31_C32                                                                  0x0e59
+#define regCNVC_CFG1_PRE_CSC_B_C31_C32_BASE_IDX                                                         2
+#define regCNVC_CFG1_PRE_CSC_B_C33_C34                                                                  0x0e5a
+#define regCNVC_CFG1_PRE_CSC_B_C33_C34_BASE_IDX                                                         2
+#define regCNVC_CFG1_CNVC_COEF_FORMAT                                                                   0x0e5b
+#define regCNVC_CFG1_CNVC_COEF_FORMAT_BASE_IDX                                                          2
+#define regCNVC_CFG1_PRE_GAM                                                                            0x0e5c
+#define regCNVC_CFG1_PRE_GAM_BASE_IDX                                                                   2
+#define regCNVC_CFG1_PRE_REALPHA                                                                        0x0e5d
+#define regCNVC_CFG1_PRE_REALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG1_PIX_DROP_CNTL                                                                      0x0e5e
+#define regCNVC_CFG1_PIX_DROP_CNTL_BASE_IDX                                                             2
+#define regCNVC_CFG1_PIX_DROP_OUT                                                                       0x0e5f
+#define regCNVC_CFG1_PIX_DROP_OUT_BASE_IDX                                                              2
+#define regCNVC_CFG1_CNVC_UPSP_MODE                                                                     0x0e60
+#define regCNVC_CFG1_CNVC_UPSP_MODE_BASE_IDX                                                            2
+#define regCNVC_CFG1_CNVC_UPSP_V_COEF_P0                                                                0x0e61
+#define regCNVC_CFG1_CNVC_UPSP_V_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG1_CNVC_UPSP_V_COEF_P1                                                                0x0e62
+#define regCNVC_CFG1_CNVC_UPSP_V_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG1_CNVC_UPSP_H_COEF_P0                                                                0x0e63
+#define regCNVC_CFG1_CNVC_UPSP_H_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG1_CNVC_UPSP_H_COEF_P1                                                                0x0e64
+#define regCNVC_CFG1_CNVC_UPSP_H_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG1_CNVC_UPSP_CLAMP                                                                    0x0e65
+#define regCNVC_CFG1_CNVC_UPSP_CLAMP_BASE_IDX                                                           2
+#define regCNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL                                                             0x0e66
+#define regCNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL_BASE_IDX                                                    2
+#define regCNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX                                                          0x0e67
+#define regCNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regCNVC_CFG1_CNVC_CFG_TEST_DEBUG_DATA                                                           0x0e68
+#define regCNVC_CFG1_CNVC_CFG_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cm_cur_dispdec
+// base address: 0x5ac
+#define regCM_CUR1_CURSOR0_CONTROL                                                                      0x0f61
+#define regCM_CUR1_CURSOR0_CONTROL_BASE_IDX                                                             2
+#define regCM_CUR1_CURSOR0_COLOR0                                                                       0x0f62
+#define regCM_CUR1_CURSOR0_COLOR0_BASE_IDX                                                              2
+#define regCM_CUR1_CURSOR0_COLOR1                                                                       0x0f63
+#define regCM_CUR1_CURSOR0_COLOR1_BASE_IDX                                                              2
+#define regCM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y                                                            0x0f64
+#define regCM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y_BASE_IDX                                                   2
+#define regCM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB                                                        0x0f65
+#define regCM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB_BASE_IDX                                               2
+#define regCM_CUR1_CUR0_MATRIX_MODE                                                                     0x0f66
+#define regCM_CUR1_CUR0_MATRIX_MODE_BASE_IDX                                                            2
+#define regCM_CUR1_CUR0_MATRIX_C11_C12_A                                                                0x0f67
+#define regCM_CUR1_CUR0_MATRIX_C11_C12_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C13_C14_A                                                                0x0f68
+#define regCM_CUR1_CUR0_MATRIX_C13_C14_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C21_C22_A                                                                0x0f69
+#define regCM_CUR1_CUR0_MATRIX_C21_C22_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C23_C24_A                                                                0x0f6a
+#define regCM_CUR1_CUR0_MATRIX_C23_C24_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C31_C32_A                                                                0x0f6b
+#define regCM_CUR1_CUR0_MATRIX_C31_C32_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C33_C34_A                                                                0x0f6c
+#define regCM_CUR1_CUR0_MATRIX_C33_C34_A_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C11_C12_B                                                                0x0f6d
+#define regCM_CUR1_CUR0_MATRIX_C11_C12_B_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C13_C14_B                                                                0x0f6e
+#define regCM_CUR1_CUR0_MATRIX_C13_C14_B_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C21_C22_B                                                                0x0f6f
+#define regCM_CUR1_CUR0_MATRIX_C21_C22_B_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C23_C24_B                                                                0x0f70
+#define regCM_CUR1_CUR0_MATRIX_C23_C24_B_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C31_C32_B                                                                0x0f71
+#define regCM_CUR1_CUR0_MATRIX_C31_C32_B_BASE_IDX                                                       2
+#define regCM_CUR1_CUR0_MATRIX_C33_C34_B                                                                0x0f72
+#define regCM_CUR1_CUR0_MATRIX_C33_C34_B_BASE_IDX                                                       2
+#define regCM_CUR1_CM_CUR0_TEST_DEBUG_INDEX                                                             0x0f73
+#define regCM_CUR1_CM_CUR0_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regCM_CUR1_CM_CUR0_TEST_DEBUG_DATA                                                              0x0f74
+#define regCM_CUR1_CM_CUR0_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dscl_dispdec
+// base address: 0x5ac
+#define regDSCL1_SCL_COEF_RAM_TAP_SELECT                                                                0x0e76
+#define regDSCL1_SCL_COEF_RAM_TAP_SELECT_BASE_IDX                                                       2
+#define regDSCL1_SCL_COEF_RAM_TAP_DATA                                                                  0x0e77
+#define regDSCL1_SCL_COEF_RAM_TAP_DATA_BASE_IDX                                                         2
+#define regDSCL1_SCL_MODE                                                                               0x0e78
+#define regDSCL1_SCL_MODE_BASE_IDX                                                                      2
+#define regDSCL1_SCL_TAP_CONTROL                                                                        0x0e79
+#define regDSCL1_SCL_TAP_CONTROL_BASE_IDX                                                               2
+#define regDSCL1_DSCL_CONTROL                                                                           0x0e7a
+#define regDSCL1_DSCL_CONTROL_BASE_IDX                                                                  2
+#define regDSCL1_DSCL_2TAP_CONTROL                                                                      0x0e7b
+#define regDSCL1_DSCL_2TAP_CONTROL_BASE_IDX                                                             2
+#define regDSCL1_SCL_MANUAL_REPLICATE_CONTROL                                                           0x0e7c
+#define regDSCL1_SCL_MANUAL_REPLICATE_CONTROL_BASE_IDX                                                  2
+#define regDSCL1_SCL_HORZ_FILTER_SCALE_RATIO                                                            0x0e7d
+#define regDSCL1_SCL_HORZ_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL1_SCL_HORZ_FILTER_INIT                                                                   0x0e7e
+#define regDSCL1_SCL_HORZ_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL1_SCL_HORZ_FILTER_SCALE_RATIO_C                                                          0x0e7f
+#define regDSCL1_SCL_HORZ_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL1_SCL_HORZ_FILTER_INIT_C                                                                 0x0e80
+#define regDSCL1_SCL_HORZ_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL1_SCL_VERT_FILTER_SCALE_RATIO                                                            0x0e81
+#define regDSCL1_SCL_VERT_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL1_SCL_VERT_FILTER_INIT                                                                   0x0e82
+#define regDSCL1_SCL_VERT_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL1_SCL_VERT_FILTER_SCALE_RATIO_C                                                          0x0e83
+#define regDSCL1_SCL_VERT_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL1_SCL_VERT_FILTER_INIT_C                                                                 0x0e84
+#define regDSCL1_SCL_VERT_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL1_SCL_BLACK_COLOR                                                                        0x0e86
+#define regDSCL1_SCL_BLACK_COLOR_BASE_IDX                                                               2
+#define regDSCL1_DSCL_UPDATE                                                                            0x0e87
+#define regDSCL1_DSCL_UPDATE_BASE_IDX                                                                   2
+#define regDSCL1_DSCL_AUTOCAL                                                                           0x0e88
+#define regDSCL1_DSCL_AUTOCAL_BASE_IDX                                                                  2
+#define regDSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT                                                           0x0e89
+#define regDSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT_BASE_IDX                                                  2
+#define regDSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM                                                           0x0e8a
+#define regDSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM_BASE_IDX                                                  2
+#define regDSCL1_OTG_H_BLANK                                                                            0x0e8b
+#define regDSCL1_OTG_H_BLANK_BASE_IDX                                                                   2
+#define regDSCL1_OTG_V_BLANK                                                                            0x0e8c
+#define regDSCL1_OTG_V_BLANK_BASE_IDX                                                                   2
+#define regDSCL1_RECOUT_START                                                                           0x0e8d
+#define regDSCL1_RECOUT_START_BASE_IDX                                                                  2
+#define regDSCL1_RECOUT_SIZE                                                                            0x0e8e
+#define regDSCL1_RECOUT_SIZE_BASE_IDX                                                                   2
+#define regDSCL1_MPC_SIZE                                                                               0x0e8f
+#define regDSCL1_MPC_SIZE_BASE_IDX                                                                      2
+#define regDSCL1_LB_DATA_FORMAT                                                                         0x0e90
+#define regDSCL1_LB_DATA_FORMAT_BASE_IDX                                                                2
+#define regDSCL1_LB_MEMORY_CTRL                                                                         0x0e91
+#define regDSCL1_LB_MEMORY_CTRL_BASE_IDX                                                                2
+#define regDSCL1_LB_V_COUNTER                                                                           0x0e92
+#define regDSCL1_LB_V_COUNTER_BASE_IDX                                                                  2
+#define regDSCL1_DSCL_MEM_PWR_CTRL                                                                      0x0e93
+#define regDSCL1_DSCL_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL1_DSCL_MEM_PWR_STATUS                                                                    0x0e94
+#define regDSCL1_DSCL_MEM_PWR_STATUS_BASE_IDX                                                           2
+#define regDSCL1_OBUF_CONTROL                                                                           0x0e95
+#define regDSCL1_OBUF_CONTROL_BASE_IDX                                                                  2
+#define regDSCL1_OBUF_MEM_PWR_CTRL                                                                      0x0e96
+#define regDSCL1_OBUF_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL1_DSCL_EASF_H_MODE                                                                       0x0e97
+#define regDSCL1_DSCL_EASF_H_MODE_BASE_IDX                                                              2
+#define regDSCL1_DSCL_EASF_V_MODE                                                                       0x0e98
+#define regDSCL1_DSCL_EASF_V_MODE_BASE_IDX                                                              2
+#define regDSCL1_DSCL_SC_MODE                                                                           0x0e99
+#define regDSCL1_DSCL_SC_MODE_BASE_IDX                                                                  2
+#define regDSCL1_DSCL_SC_MATRIX_C0C1                                                                    0x0e9a
+#define regDSCL1_DSCL_SC_MATRIX_C0C1_BASE_IDX                                                           2
+#define regDSCL1_DSCL_SC_MATRIX_C2C3                                                                    0x0e9b
+#define regDSCL1_DSCL_SC_MATRIX_C2C3_BASE_IDX                                                           2
+#define regDSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN                                                       0x0e9c
+#define regDSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE                                                     0x0e9d
+#define regDSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN                                                       0x0e9e
+#define regDSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE                                                     0x0e9f
+#define regDSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1                                                         0x0ea0
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1_BASE_IDX                                                2
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2                                                         0x0ea1
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2_BASE_IDX                                                2
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3                                                         0x0ea2
+#define regDSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3_BASE_IDX                                                2
+#define regDSCL1_DSCL_EASF_RINGEST_FORCE                                                                0x0ea3
+#define regDSCL1_DSCL_EASF_RINGEST_FORCE_BASE_IDX                                                       2
+#define regDSCL1_DSCL_EASF_H_BF_CNTL                                                                    0x0ea4
+#define regDSCL1_DSCL_EASF_H_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN                                                           0x0ea5
+#define regDSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL1_DSCL_EASF_V_BF_CNTL                                                                    0x0ea6
+#define regDSCL1_DSCL_EASF_V_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN                                                           0x0ea7
+#define regDSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG0                                                               0x0ea8
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG1                                                               0x0ea9
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG2                                                               0x0eaa
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG3                                                               0x0eab
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG4                                                               0x0eac
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG5                                                               0x0ead
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG6                                                               0x0eae
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG7                                                               0x0eaf
+#define regDSCL1_DSCL_EASF_H_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG0                                                               0x0eb0
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG1                                                               0x0eb1
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG2                                                               0x0eb2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG3                                                               0x0eb3
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG4                                                               0x0eb4
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG5                                                               0x0eb5
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG6                                                               0x0eb6
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG7                                                               0x0eb7
+#define regDSCL1_DSCL_EASF_V_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG0                                                               0x0eb8
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG1                                                               0x0eb9
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG2                                                               0x0eba
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG3                                                               0x0ebb
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG4                                                               0x0ebc
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG5                                                               0x0ebd
+#define regDSCL1_DSCL_EASF_H_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG0                                                               0x0ebe
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG1                                                               0x0ebf
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG2                                                               0x0ec0
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG3                                                               0x0ec1
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG4                                                               0x0ec2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG5                                                               0x0ec3
+#define regDSCL1_DSCL_EASF_V_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL1_ISHARP_MODE                                                                            0x0ec4
+#define regDSCL1_ISHARP_MODE_BASE_IDX                                                                   2
+#define regDSCL1_ISHARP_DELTA_CTRL                                                                      0x0ec5
+#define regDSCL1_ISHARP_DELTA_CTRL_BASE_IDX                                                             2
+#define regDSCL1_ISHARP_DELTA_INDEX                                                                     0x0ec6
+#define regDSCL1_ISHARP_DELTA_INDEX_BASE_IDX                                                            2
+#define regDSCL1_ISHARP_DELTA_DATA                                                                      0x0ec7
+#define regDSCL1_ISHARP_DELTA_DATA_BASE_IDX                                                             2
+#define regDSCL1_ISHARP_NLDELTA_SOFT_CLIP                                                               0x0ec8
+#define regDSCL1_ISHARP_NLDELTA_SOFT_CLIP_BASE_IDX                                                      2
+#define regDSCL1_ISHARP_NOISEDET_THRESHOLD                                                              0x0ec9
+#define regDSCL1_ISHARP_NOISEDET_THRESHOLD_BASE_IDX                                                     2
+#define regDSCL1_ISHARP_NOISE_GAIN_PWL                                                                  0x0eca
+#define regDSCL1_ISHARP_NOISE_GAIN_PWL_BASE_IDX                                                         2
+#define regDSCL1_ISHARP_LBA_PWL_SEG0                                                                    0x0ecb
+#define regDSCL1_ISHARP_LBA_PWL_SEG0_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_LBA_PWL_SEG1                                                                    0x0ecc
+#define regDSCL1_ISHARP_LBA_PWL_SEG1_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_LBA_PWL_SEG2                                                                    0x0ecd
+#define regDSCL1_ISHARP_LBA_PWL_SEG2_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_LBA_PWL_SEG3                                                                    0x0ece
+#define regDSCL1_ISHARP_LBA_PWL_SEG3_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_LBA_PWL_SEG4                                                                    0x0ecf
+#define regDSCL1_ISHARP_LBA_PWL_SEG4_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_LBA_PWL_SEG5                                                                    0x0ed0
+#define regDSCL1_ISHARP_LBA_PWL_SEG5_BASE_IDX                                                           2
+#define regDSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL                                                          0x0ed1
+#define regDSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL_BASE_IDX                                                 2
+#define regDSCL1_DSCL_DEBUG                                                                             0x0ed2
+#define regDSCL1_DSCL_DEBUG_BASE_IDX                                                                    2
+#define regDSCL1_DSCL_TEST_DEBUG_INDEX                                                                  0x0ed3
+#define regDSCL1_DSCL_TEST_DEBUG_INDEX_BASE_IDX                                                         2
+#define regDSCL1_DSCL_TEST_DEBUG_DATA                                                                   0x0ed4
+#define regDSCL1_DSCL_TEST_DEBUG_DATA_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cm_dispdec
+// base address: 0x5ac
+#define regCM1_CM_CONTROL                                                                               0x0ed5
+#define regCM1_CM_CONTROL_BASE_IDX                                                                      2
+#define regCM1_CM_POST_CSC_CONTROL                                                                      0x0ed6
+#define regCM1_CM_POST_CSC_CONTROL_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C11_C12                                                                      0x0ed7
+#define regCM1_CM_POST_CSC_C11_C12_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C13_C14                                                                      0x0ed8
+#define regCM1_CM_POST_CSC_C13_C14_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C21_C22                                                                      0x0ed9
+#define regCM1_CM_POST_CSC_C21_C22_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C23_C24                                                                      0x0eda
+#define regCM1_CM_POST_CSC_C23_C24_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C31_C32                                                                      0x0edb
+#define regCM1_CM_POST_CSC_C31_C32_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_C33_C34                                                                      0x0edc
+#define regCM1_CM_POST_CSC_C33_C34_BASE_IDX                                                             2
+#define regCM1_CM_POST_CSC_B_C11_C12                                                                    0x0edd
+#define regCM1_CM_POST_CSC_B_C11_C12_BASE_IDX                                                           2
+#define regCM1_CM_POST_CSC_B_C13_C14                                                                    0x0ede
+#define regCM1_CM_POST_CSC_B_C13_C14_BASE_IDX                                                           2
+#define regCM1_CM_POST_CSC_B_C21_C22                                                                    0x0edf
+#define regCM1_CM_POST_CSC_B_C21_C22_BASE_IDX                                                           2
+#define regCM1_CM_POST_CSC_B_C23_C24                                                                    0x0ee0
+#define regCM1_CM_POST_CSC_B_C23_C24_BASE_IDX                                                           2
+#define regCM1_CM_POST_CSC_B_C31_C32                                                                    0x0ee1
+#define regCM1_CM_POST_CSC_B_C31_C32_BASE_IDX                                                           2
+#define regCM1_CM_POST_CSC_B_C33_C34                                                                    0x0ee2
+#define regCM1_CM_POST_CSC_B_C33_C34_BASE_IDX                                                           2
+#define regCM1_CM_BIAS_CR_R                                                                             0x0ee3
+#define regCM1_CM_BIAS_CR_R_BASE_IDX                                                                    2
+#define regCM1_CM_BIAS_Y_G_CB_B                                                                         0x0ee4
+#define regCM1_CM_BIAS_Y_G_CB_B_BASE_IDX                                                                2
+#define regCM1_CM_GAMCOR_CONTROL                                                                        0x0ee5
+#define regCM1_CM_GAMCOR_CONTROL_BASE_IDX                                                               2
+#define regCM1_CM_GAMCOR_LUT_INDEX                                                                      0x0ee6
+#define regCM1_CM_GAMCOR_LUT_INDEX_BASE_IDX                                                             2
+#define regCM1_CM_GAMCOR_LUT_DATA                                                                       0x0ee7
+#define regCM1_CM_GAMCOR_LUT_DATA_BASE_IDX                                                              2
+#define regCM1_CM_GAMCOR_LUT_CONTROL                                                                    0x0ee8
+#define regCM1_CM_GAMCOR_LUT_CONTROL_BASE_IDX                                                           2
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_B                                                              0x0ee9
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_B_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_G                                                              0x0eea
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_G_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_R                                                              0x0eeb
+#define regCM1_CM_GAMCOR_RAMA_START_CNTL_R_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B                                                        0x0eec
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G                                                        0x0eed
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R                                                        0x0eee
+#define regCM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_B                                                         0x0eef
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_G                                                         0x0ef0
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_R                                                         0x0ef1
+#define regCM1_CM_GAMCOR_RAMA_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_B                                                               0x0ef2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_B                                                               0x0ef3
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_G                                                               0x0ef4
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_G                                                               0x0ef5
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_R                                                               0x0ef6
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_R                                                               0x0ef7
+#define regCM1_CM_GAMCOR_RAMA_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_B                                                                  0x0ef8
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_B_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_G                                                                  0x0ef9
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_G_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_R                                                                  0x0efa
+#define regCM1_CM_GAMCOR_RAMA_OFFSET_R_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMA_REGION_0_1                                                                0x0efb
+#define regCM1_CM_GAMCOR_RAMA_REGION_0_1_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMA_REGION_2_3                                                                0x0efc
+#define regCM1_CM_GAMCOR_RAMA_REGION_2_3_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMA_REGION_4_5                                                                0x0efd
+#define regCM1_CM_GAMCOR_RAMA_REGION_4_5_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMA_REGION_6_7                                                                0x0efe
+#define regCM1_CM_GAMCOR_RAMA_REGION_6_7_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMA_REGION_8_9                                                                0x0eff
+#define regCM1_CM_GAMCOR_RAMA_REGION_8_9_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMA_REGION_10_11                                                              0x0f00
+#define regCM1_CM_GAMCOR_RAMA_REGION_10_11_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_12_13                                                              0x0f01
+#define regCM1_CM_GAMCOR_RAMA_REGION_12_13_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_14_15                                                              0x0f02
+#define regCM1_CM_GAMCOR_RAMA_REGION_14_15_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_16_17                                                              0x0f03
+#define regCM1_CM_GAMCOR_RAMA_REGION_16_17_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_18_19                                                              0x0f04
+#define regCM1_CM_GAMCOR_RAMA_REGION_18_19_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_20_21                                                              0x0f05
+#define regCM1_CM_GAMCOR_RAMA_REGION_20_21_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_22_23                                                              0x0f06
+#define regCM1_CM_GAMCOR_RAMA_REGION_22_23_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_24_25                                                              0x0f07
+#define regCM1_CM_GAMCOR_RAMA_REGION_24_25_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_26_27                                                              0x0f08
+#define regCM1_CM_GAMCOR_RAMA_REGION_26_27_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_28_29                                                              0x0f09
+#define regCM1_CM_GAMCOR_RAMA_REGION_28_29_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_30_31                                                              0x0f0a
+#define regCM1_CM_GAMCOR_RAMA_REGION_30_31_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMA_REGION_32_33                                                              0x0f0b
+#define regCM1_CM_GAMCOR_RAMA_REGION_32_33_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_B                                                              0x0f0c
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_B_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_G                                                              0x0f0d
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_G_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_R                                                              0x0f0e
+#define regCM1_CM_GAMCOR_RAMB_START_CNTL_R_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B                                                        0x0f0f
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G                                                        0x0f10
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R                                                        0x0f11
+#define regCM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_B                                                         0x0f12
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_G                                                         0x0f13
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_R                                                         0x0f14
+#define regCM1_CM_GAMCOR_RAMB_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_B                                                               0x0f15
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_B                                                               0x0f16
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_G                                                               0x0f17
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_G                                                               0x0f18
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_R                                                               0x0f19
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_R                                                               0x0f1a
+#define regCM1_CM_GAMCOR_RAMB_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_B                                                                  0x0f1b
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_B_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_G                                                                  0x0f1c
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_G_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_R                                                                  0x0f1d
+#define regCM1_CM_GAMCOR_RAMB_OFFSET_R_BASE_IDX                                                         2
+#define regCM1_CM_GAMCOR_RAMB_REGION_0_1                                                                0x0f1e
+#define regCM1_CM_GAMCOR_RAMB_REGION_0_1_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMB_REGION_2_3                                                                0x0f1f
+#define regCM1_CM_GAMCOR_RAMB_REGION_2_3_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMB_REGION_4_5                                                                0x0f20
+#define regCM1_CM_GAMCOR_RAMB_REGION_4_5_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMB_REGION_6_7                                                                0x0f21
+#define regCM1_CM_GAMCOR_RAMB_REGION_6_7_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMB_REGION_8_9                                                                0x0f22
+#define regCM1_CM_GAMCOR_RAMB_REGION_8_9_BASE_IDX                                                       2
+#define regCM1_CM_GAMCOR_RAMB_REGION_10_11                                                              0x0f23
+#define regCM1_CM_GAMCOR_RAMB_REGION_10_11_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_12_13                                                              0x0f24
+#define regCM1_CM_GAMCOR_RAMB_REGION_12_13_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_14_15                                                              0x0f25
+#define regCM1_CM_GAMCOR_RAMB_REGION_14_15_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_16_17                                                              0x0f26
+#define regCM1_CM_GAMCOR_RAMB_REGION_16_17_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_18_19                                                              0x0f27
+#define regCM1_CM_GAMCOR_RAMB_REGION_18_19_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_20_21                                                              0x0f28
+#define regCM1_CM_GAMCOR_RAMB_REGION_20_21_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_22_23                                                              0x0f29
+#define regCM1_CM_GAMCOR_RAMB_REGION_22_23_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_24_25                                                              0x0f2a
+#define regCM1_CM_GAMCOR_RAMB_REGION_24_25_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_26_27                                                              0x0f2b
+#define regCM1_CM_GAMCOR_RAMB_REGION_26_27_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_28_29                                                              0x0f2c
+#define regCM1_CM_GAMCOR_RAMB_REGION_28_29_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_30_31                                                              0x0f2d
+#define regCM1_CM_GAMCOR_RAMB_REGION_30_31_BASE_IDX                                                     2
+#define regCM1_CM_GAMCOR_RAMB_REGION_32_33                                                              0x0f2e
+#define regCM1_CM_GAMCOR_RAMB_REGION_32_33_BASE_IDX                                                     2
+#define regCM1_CM_HDR_MULT_COEF                                                                         0x0f2f
+#define regCM1_CM_HDR_MULT_COEF_BASE_IDX                                                                2
+#define regCM1_CM_MEM_PWR_CTRL                                                                          0x0f30
+#define regCM1_CM_MEM_PWR_CTRL_BASE_IDX                                                                 2
+#define regCM1_CM_MEM_PWR_STATUS                                                                        0x0f31
+#define regCM1_CM_MEM_PWR_STATUS_BASE_IDX                                                               2
+#define regCM1_CM_DEALPHA                                                                               0x0f33
+#define regCM1_CM_DEALPHA_BASE_IDX                                                                      2
+#define regCM1_CM_COEF_FORMAT                                                                           0x0f34
+#define regCM1_CM_COEF_FORMAT_BASE_IDX                                                                  2
+#define regCM1_CM_TEST_DEBUG_INDEX                                                                      0x0f35
+#define regCM1_CM_TEST_DEBUG_INDEX_BASE_IDX                                                             2
+#define regCM1_CM_TEST_DEBUG_DATA                                                                       0x0f36
+#define regCM1_CM_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regCM1_CM_HIST_CNTL                                                                             0x0f37
+#define regCM1_CM_HIST_CNTL_BASE_IDX                                                                    2
+#define regCM1_CM_HIST_SCALE_SRC1                                                                       0x0f38
+#define regCM1_CM_HIST_SCALE_SRC1_BASE_IDX                                                              2
+#define regCM1_CM_HIST_COEFA_SRC2                                                                       0x0f39
+#define regCM1_CM_HIST_COEFA_SRC2_BASE_IDX                                                              2
+#define regCM1_CM_HIST_COEFB_SRC2                                                                       0x0f3a
+#define regCM1_CM_HIST_COEFB_SRC2_BASE_IDX                                                              2
+#define regCM1_CM_HIST_COEFC_SRC2                                                                       0x0f3b
+#define regCM1_CM_HIST_COEFC_SRC2_BASE_IDX                                                              2
+#define regCM1_CM_HIST_SCALE_SRC3                                                                       0x0f3c
+#define regCM1_CM_HIST_SCALE_SRC3_BASE_IDX                                                              2
+#define regCM1_CM_HIST_BIAS_SRC1                                                                        0x0f3d
+#define regCM1_CM_HIST_BIAS_SRC1_BASE_IDX                                                               2
+#define regCM1_CM_HIST_BIAS_SRC2                                                                        0x0f3e
+#define regCM1_CM_HIST_BIAS_SRC2_BASE_IDX                                                               2
+#define regCM1_CM_HIST_BIAS_SRC3                                                                        0x0f3f
+#define regCM1_CM_HIST_BIAS_SRC3_BASE_IDX                                                               2
+#define regCM1_CM_HIST_LOCK                                                                             0x0f40
+#define regCM1_CM_HIST_LOCK_BASE_IDX                                                                    2
+#define regCM1_CM_HIST_INDEX                                                                            0x0f41
+#define regCM1_CM_HIST_INDEX_BASE_IDX                                                                   2
+#define regCM1_CM_HIST_DATA                                                                             0x0f42
+#define regCM1_CM_HIST_DATA_BASE_IDX                                                                    2
+#define regCM1_CM_HIST_STATUS                                                                           0x0f43
+#define regCM1_CM_HIST_STATUS_BASE_IDX                                                                  2
+#define regCM1_CM_HIST_INT_CONTROL                                                                      0x0f44
+#define regCM1_CM_HIST_INT_CONTROL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dpp_top_dispdec
+// base address: 0x5ac
+#define regDPP_TOP1_DPP_CONTROL                                                                         0x0e30
+#define regDPP_TOP1_DPP_CONTROL_BASE_IDX                                                                2
+#define regDPP_TOP1_DPP_SOFT_RESET                                                                      0x0e31
+#define regDPP_TOP1_DPP_SOFT_RESET_BASE_IDX                                                             2
+#define regDPP_TOP1_DPP_CRC_VAL_R                                                                       0x0e32
+#define regDPP_TOP1_DPP_CRC_VAL_R_BASE_IDX                                                              2
+#define regDPP_TOP1_DPP_CRC_VAL_G                                                                       0x0e33
+#define regDPP_TOP1_DPP_CRC_VAL_G_BASE_IDX                                                              2
+#define regDPP_TOP1_DPP_CRC_VAL_B                                                                       0x0e34
+#define regDPP_TOP1_DPP_CRC_VAL_B_BASE_IDX                                                              2
+#define regDPP_TOP1_DPP_CRC_VAL_A                                                                       0x0e35
+#define regDPP_TOP1_DPP_CRC_VAL_A_BASE_IDX                                                              2
+#define regDPP_TOP1_DPP_CRC_CTRL                                                                        0x0e36
+#define regDPP_TOP1_DPP_CRC_CTRL_BASE_IDX                                                               2
+#define regDPP_TOP1_HOST_READ_CONTROL                                                                   0x0e37
+#define regDPP_TOP1_HOST_READ_CONTROL_BASE_IDX                                                          2
+#define regDPP_TOP1_DPP_DEBUG_SEL                                                                       0x0e38
+#define regDPP_TOP1_DPP_DEBUG_SEL_BASE_IDX                                                              2
+#define regDPP_TOP1_DPP_DEBUG_SPARE                                                                     0x0e39
+#define regDPP_TOP1_DPP_DEBUG_SPARE_BASE_IDX                                                            2
+#define regDPP_TOP1_DPP_TEST_DEBUG_INDEX                                                                0x0e3a
+#define regDPP_TOP1_DPP_TEST_DEBUG_INDEX_BASE_IDX                                                       2
+#define regDPP_TOP1_DPP_TEST_DEBUG_DATA                                                                 0x0e3b
+#define regDPP_TOP1_DPP_TEST_DEBUG_DATA_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x3e3c
+#define regDC_PERFMON11_PERFCOUNTER_CNTL                                                                0x0f8f
+#define regDC_PERFMON11_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON11_PERFCOUNTER_CNTL2                                                               0x0f90
+#define regDC_PERFMON11_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON11_PERFCOUNTER_STATE                                                               0x0f91
+#define regDC_PERFMON11_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON11_PERFMON_CNTL                                                                    0x0f92
+#define regDC_PERFMON11_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON11_PERFMON_CNTL2                                                                   0x0f93
+#define regDC_PERFMON11_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON11_PERFMON_CVALUE_INT_MISC                                                         0x0f94
+#define regDC_PERFMON11_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON11_PERFMON_CVALUE_LOW                                                              0x0f95
+#define regDC_PERFMON11_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON11_PERFMON_HI                                                                      0x0f96
+#define regDC_PERFMON11_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON11_PERFMON_LOW                                                                     0x0f97
+#define regDC_PERFMON11_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON11_PERFMON_TEST_DEBUG_INDEX                                                        0x0f98
+#define regDC_PERFMON11_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON11_PERFMON_TEST_DEBUG_DATA                                                         0x0f99
+#define regDC_PERFMON11_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cnvc_cfg_dispdec
+// base address: 0xb58
+#define regCNVC_CFG2_CNVC_SURFACE_PIXEL_FORMAT                                                          0x0fa8
+#define regCNVC_CFG2_CNVC_SURFACE_PIXEL_FORMAT_BASE_IDX                                                 2
+#define regCNVC_CFG2_FORMAT_CONTROL                                                                     0x0fa9
+#define regCNVC_CFG2_FORMAT_CONTROL_BASE_IDX                                                            2
+#define regCNVC_CFG2_FCNV_FP_BIAS_R                                                                     0x0faa
+#define regCNVC_CFG2_FCNV_FP_BIAS_R_BASE_IDX                                                            2
+#define regCNVC_CFG2_FCNV_FP_BIAS_G                                                                     0x0fab
+#define regCNVC_CFG2_FCNV_FP_BIAS_G_BASE_IDX                                                            2
+#define regCNVC_CFG2_FCNV_FP_BIAS_B                                                                     0x0fac
+#define regCNVC_CFG2_FCNV_FP_BIAS_B_BASE_IDX                                                            2
+#define regCNVC_CFG2_FCNV_FP_SCALE_R                                                                    0x0fad
+#define regCNVC_CFG2_FCNV_FP_SCALE_R_BASE_IDX                                                           2
+#define regCNVC_CFG2_FCNV_FP_SCALE_G                                                                    0x0fae
+#define regCNVC_CFG2_FCNV_FP_SCALE_G_BASE_IDX                                                           2
+#define regCNVC_CFG2_FCNV_FP_SCALE_B                                                                    0x0faf
+#define regCNVC_CFG2_FCNV_FP_SCALE_B_BASE_IDX                                                           2
+#define regCNVC_CFG2_COLOR_KEYER_CONTROL                                                                0x0fb0
+#define regCNVC_CFG2_COLOR_KEYER_CONTROL_BASE_IDX                                                       2
+#define regCNVC_CFG2_COLOR_KEYER_ALPHA                                                                  0x0fb1
+#define regCNVC_CFG2_COLOR_KEYER_ALPHA_BASE_IDX                                                         2
+#define regCNVC_CFG2_COLOR_KEYER_RED                                                                    0x0fb2
+#define regCNVC_CFG2_COLOR_KEYER_RED_BASE_IDX                                                           2
+#define regCNVC_CFG2_COLOR_KEYER_GREEN                                                                  0x0fb3
+#define regCNVC_CFG2_COLOR_KEYER_GREEN_BASE_IDX                                                         2
+#define regCNVC_CFG2_COLOR_KEYER_BLUE                                                                   0x0fb4
+#define regCNVC_CFG2_COLOR_KEYER_BLUE_BASE_IDX                                                          2
+#define regCNVC_CFG2_ALPHA_2BIT_LUT01                                                                   0x0fb6
+#define regCNVC_CFG2_ALPHA_2BIT_LUT01_BASE_IDX                                                          2
+#define regCNVC_CFG2_ALPHA_2BIT_LUT23                                                                   0x0fb7
+#define regCNVC_CFG2_ALPHA_2BIT_LUT23_BASE_IDX                                                          2
+#define regCNVC_CFG2_PRE_DEALPHA                                                                        0x0fb8
+#define regCNVC_CFG2_PRE_DEALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG2_PRE_CSC_MODE                                                                       0x0fb9
+#define regCNVC_CFG2_PRE_CSC_MODE_BASE_IDX                                                              2
+#define regCNVC_CFG2_PRE_CSC_C11_C12                                                                    0x0fba
+#define regCNVC_CFG2_PRE_CSC_C11_C12_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_C13_C14                                                                    0x0fbb
+#define regCNVC_CFG2_PRE_CSC_C13_C14_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_C21_C22                                                                    0x0fbc
+#define regCNVC_CFG2_PRE_CSC_C21_C22_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_C23_C24                                                                    0x0fbd
+#define regCNVC_CFG2_PRE_CSC_C23_C24_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_C31_C32                                                                    0x0fbe
+#define regCNVC_CFG2_PRE_CSC_C31_C32_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_C33_C34                                                                    0x0fbf
+#define regCNVC_CFG2_PRE_CSC_C33_C34_BASE_IDX                                                           2
+#define regCNVC_CFG2_PRE_CSC_B_C11_C12                                                                  0x0fc0
+#define regCNVC_CFG2_PRE_CSC_B_C11_C12_BASE_IDX                                                         2
+#define regCNVC_CFG2_PRE_CSC_B_C13_C14                                                                  0x0fc1
+#define regCNVC_CFG2_PRE_CSC_B_C13_C14_BASE_IDX                                                         2
+#define regCNVC_CFG2_PRE_CSC_B_C21_C22                                                                  0x0fc2
+#define regCNVC_CFG2_PRE_CSC_B_C21_C22_BASE_IDX                                                         2
+#define regCNVC_CFG2_PRE_CSC_B_C23_C24                                                                  0x0fc3
+#define regCNVC_CFG2_PRE_CSC_B_C23_C24_BASE_IDX                                                         2
+#define regCNVC_CFG2_PRE_CSC_B_C31_C32                                                                  0x0fc4
+#define regCNVC_CFG2_PRE_CSC_B_C31_C32_BASE_IDX                                                         2
+#define regCNVC_CFG2_PRE_CSC_B_C33_C34                                                                  0x0fc5
+#define regCNVC_CFG2_PRE_CSC_B_C33_C34_BASE_IDX                                                         2
+#define regCNVC_CFG2_CNVC_COEF_FORMAT                                                                   0x0fc6
+#define regCNVC_CFG2_CNVC_COEF_FORMAT_BASE_IDX                                                          2
+#define regCNVC_CFG2_PRE_GAM                                                                            0x0fc7
+#define regCNVC_CFG2_PRE_GAM_BASE_IDX                                                                   2
+#define regCNVC_CFG2_PRE_REALPHA                                                                        0x0fc8
+#define regCNVC_CFG2_PRE_REALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG2_PIX_DROP_CNTL                                                                      0x0fc9
+#define regCNVC_CFG2_PIX_DROP_CNTL_BASE_IDX                                                             2
+#define regCNVC_CFG2_PIX_DROP_OUT                                                                       0x0fca
+#define regCNVC_CFG2_PIX_DROP_OUT_BASE_IDX                                                              2
+#define regCNVC_CFG2_CNVC_UPSP_MODE                                                                     0x0fcb
+#define regCNVC_CFG2_CNVC_UPSP_MODE_BASE_IDX                                                            2
+#define regCNVC_CFG2_CNVC_UPSP_V_COEF_P0                                                                0x0fcc
+#define regCNVC_CFG2_CNVC_UPSP_V_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG2_CNVC_UPSP_V_COEF_P1                                                                0x0fcd
+#define regCNVC_CFG2_CNVC_UPSP_V_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG2_CNVC_UPSP_H_COEF_P0                                                                0x0fce
+#define regCNVC_CFG2_CNVC_UPSP_H_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG2_CNVC_UPSP_H_COEF_P1                                                                0x0fcf
+#define regCNVC_CFG2_CNVC_UPSP_H_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG2_CNVC_UPSP_CLAMP                                                                    0x0fd0
+#define regCNVC_CFG2_CNVC_UPSP_CLAMP_BASE_IDX                                                           2
+#define regCNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL                                                             0x0fd1
+#define regCNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL_BASE_IDX                                                    2
+#define regCNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX                                                          0x0fd2
+#define regCNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regCNVC_CFG2_CNVC_CFG_TEST_DEBUG_DATA                                                           0x0fd3
+#define regCNVC_CFG2_CNVC_CFG_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cm_cur_dispdec
+// base address: 0xb58
+#define regCM_CUR2_CURSOR0_CONTROL                                                                      0x10cc
+#define regCM_CUR2_CURSOR0_CONTROL_BASE_IDX                                                             2
+#define regCM_CUR2_CURSOR0_COLOR0                                                                       0x10cd
+#define regCM_CUR2_CURSOR0_COLOR0_BASE_IDX                                                              2
+#define regCM_CUR2_CURSOR0_COLOR1                                                                       0x10ce
+#define regCM_CUR2_CURSOR0_COLOR1_BASE_IDX                                                              2
+#define regCM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y                                                            0x10cf
+#define regCM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y_BASE_IDX                                                   2
+#define regCM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB                                                        0x10d0
+#define regCM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB_BASE_IDX                                               2
+#define regCM_CUR2_CUR0_MATRIX_MODE                                                                     0x10d1
+#define regCM_CUR2_CUR0_MATRIX_MODE_BASE_IDX                                                            2
+#define regCM_CUR2_CUR0_MATRIX_C11_C12_A                                                                0x10d2
+#define regCM_CUR2_CUR0_MATRIX_C11_C12_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C13_C14_A                                                                0x10d3
+#define regCM_CUR2_CUR0_MATRIX_C13_C14_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C21_C22_A                                                                0x10d4
+#define regCM_CUR2_CUR0_MATRIX_C21_C22_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C23_C24_A                                                                0x10d5
+#define regCM_CUR2_CUR0_MATRIX_C23_C24_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C31_C32_A                                                                0x10d6
+#define regCM_CUR2_CUR0_MATRIX_C31_C32_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C33_C34_A                                                                0x10d7
+#define regCM_CUR2_CUR0_MATRIX_C33_C34_A_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C11_C12_B                                                                0x10d8
+#define regCM_CUR2_CUR0_MATRIX_C11_C12_B_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C13_C14_B                                                                0x10d9
+#define regCM_CUR2_CUR0_MATRIX_C13_C14_B_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C21_C22_B                                                                0x10da
+#define regCM_CUR2_CUR0_MATRIX_C21_C22_B_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C23_C24_B                                                                0x10db
+#define regCM_CUR2_CUR0_MATRIX_C23_C24_B_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C31_C32_B                                                                0x10dc
+#define regCM_CUR2_CUR0_MATRIX_C31_C32_B_BASE_IDX                                                       2
+#define regCM_CUR2_CUR0_MATRIX_C33_C34_B                                                                0x10dd
+#define regCM_CUR2_CUR0_MATRIX_C33_C34_B_BASE_IDX                                                       2
+#define regCM_CUR2_CM_CUR0_TEST_DEBUG_INDEX                                                             0x10de
+#define regCM_CUR2_CM_CUR0_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regCM_CUR2_CM_CUR0_TEST_DEBUG_DATA                                                              0x10df
+#define regCM_CUR2_CM_CUR0_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dscl_dispdec
+// base address: 0xb58
+#define regDSCL2_SCL_COEF_RAM_TAP_SELECT                                                                0x0fe1
+#define regDSCL2_SCL_COEF_RAM_TAP_SELECT_BASE_IDX                                                       2
+#define regDSCL2_SCL_COEF_RAM_TAP_DATA                                                                  0x0fe2
+#define regDSCL2_SCL_COEF_RAM_TAP_DATA_BASE_IDX                                                         2
+#define regDSCL2_SCL_MODE                                                                               0x0fe3
+#define regDSCL2_SCL_MODE_BASE_IDX                                                                      2
+#define regDSCL2_SCL_TAP_CONTROL                                                                        0x0fe4
+#define regDSCL2_SCL_TAP_CONTROL_BASE_IDX                                                               2
+#define regDSCL2_DSCL_CONTROL                                                                           0x0fe5
+#define regDSCL2_DSCL_CONTROL_BASE_IDX                                                                  2
+#define regDSCL2_DSCL_2TAP_CONTROL                                                                      0x0fe6
+#define regDSCL2_DSCL_2TAP_CONTROL_BASE_IDX                                                             2
+#define regDSCL2_SCL_MANUAL_REPLICATE_CONTROL                                                           0x0fe7
+#define regDSCL2_SCL_MANUAL_REPLICATE_CONTROL_BASE_IDX                                                  2
+#define regDSCL2_SCL_HORZ_FILTER_SCALE_RATIO                                                            0x0fe8
+#define regDSCL2_SCL_HORZ_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL2_SCL_HORZ_FILTER_INIT                                                                   0x0fe9
+#define regDSCL2_SCL_HORZ_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL2_SCL_HORZ_FILTER_SCALE_RATIO_C                                                          0x0fea
+#define regDSCL2_SCL_HORZ_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL2_SCL_HORZ_FILTER_INIT_C                                                                 0x0feb
+#define regDSCL2_SCL_HORZ_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL2_SCL_VERT_FILTER_SCALE_RATIO                                                            0x0fec
+#define regDSCL2_SCL_VERT_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL2_SCL_VERT_FILTER_INIT                                                                   0x0fed
+#define regDSCL2_SCL_VERT_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL2_SCL_VERT_FILTER_SCALE_RATIO_C                                                          0x0fee
+#define regDSCL2_SCL_VERT_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL2_SCL_VERT_FILTER_INIT_C                                                                 0x0fef
+#define regDSCL2_SCL_VERT_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL2_SCL_BLACK_COLOR                                                                        0x0ff1
+#define regDSCL2_SCL_BLACK_COLOR_BASE_IDX                                                               2
+#define regDSCL2_DSCL_UPDATE                                                                            0x0ff2
+#define regDSCL2_DSCL_UPDATE_BASE_IDX                                                                   2
+#define regDSCL2_DSCL_AUTOCAL                                                                           0x0ff3
+#define regDSCL2_DSCL_AUTOCAL_BASE_IDX                                                                  2
+#define regDSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT                                                           0x0ff4
+#define regDSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT_BASE_IDX                                                  2
+#define regDSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM                                                           0x0ff5
+#define regDSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM_BASE_IDX                                                  2
+#define regDSCL2_OTG_H_BLANK                                                                            0x0ff6
+#define regDSCL2_OTG_H_BLANK_BASE_IDX                                                                   2
+#define regDSCL2_OTG_V_BLANK                                                                            0x0ff7
+#define regDSCL2_OTG_V_BLANK_BASE_IDX                                                                   2
+#define regDSCL2_RECOUT_START                                                                           0x0ff8
+#define regDSCL2_RECOUT_START_BASE_IDX                                                                  2
+#define regDSCL2_RECOUT_SIZE                                                                            0x0ff9
+#define regDSCL2_RECOUT_SIZE_BASE_IDX                                                                   2
+#define regDSCL2_MPC_SIZE                                                                               0x0ffa
+#define regDSCL2_MPC_SIZE_BASE_IDX                                                                      2
+#define regDSCL2_LB_DATA_FORMAT                                                                         0x0ffb
+#define regDSCL2_LB_DATA_FORMAT_BASE_IDX                                                                2
+#define regDSCL2_LB_MEMORY_CTRL                                                                         0x0ffc
+#define regDSCL2_LB_MEMORY_CTRL_BASE_IDX                                                                2
+#define regDSCL2_LB_V_COUNTER                                                                           0x0ffd
+#define regDSCL2_LB_V_COUNTER_BASE_IDX                                                                  2
+#define regDSCL2_DSCL_MEM_PWR_CTRL                                                                      0x0ffe
+#define regDSCL2_DSCL_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL2_DSCL_MEM_PWR_STATUS                                                                    0x0fff
+#define regDSCL2_DSCL_MEM_PWR_STATUS_BASE_IDX                                                           2
+#define regDSCL2_OBUF_CONTROL                                                                           0x1000
+#define regDSCL2_OBUF_CONTROL_BASE_IDX                                                                  2
+#define regDSCL2_OBUF_MEM_PWR_CTRL                                                                      0x1001
+#define regDSCL2_OBUF_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL2_DSCL_EASF_H_MODE                                                                       0x1002
+#define regDSCL2_DSCL_EASF_H_MODE_BASE_IDX                                                              2
+#define regDSCL2_DSCL_EASF_V_MODE                                                                       0x1003
+#define regDSCL2_DSCL_EASF_V_MODE_BASE_IDX                                                              2
+#define regDSCL2_DSCL_SC_MODE                                                                           0x1004
+#define regDSCL2_DSCL_SC_MODE_BASE_IDX                                                                  2
+#define regDSCL2_DSCL_SC_MATRIX_C0C1                                                                    0x1005
+#define regDSCL2_DSCL_SC_MATRIX_C0C1_BASE_IDX                                                           2
+#define regDSCL2_DSCL_SC_MATRIX_C2C3                                                                    0x1006
+#define regDSCL2_DSCL_SC_MATRIX_C2C3_BASE_IDX                                                           2
+#define regDSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN                                                       0x1007
+#define regDSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE                                                     0x1008
+#define regDSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN                                                       0x1009
+#define regDSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE                                                     0x100a
+#define regDSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1                                                         0x100b
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1_BASE_IDX                                                2
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2                                                         0x100c
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2_BASE_IDX                                                2
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3                                                         0x100d
+#define regDSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3_BASE_IDX                                                2
+#define regDSCL2_DSCL_EASF_RINGEST_FORCE                                                                0x100e
+#define regDSCL2_DSCL_EASF_RINGEST_FORCE_BASE_IDX                                                       2
+#define regDSCL2_DSCL_EASF_H_BF_CNTL                                                                    0x100f
+#define regDSCL2_DSCL_EASF_H_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN                                                           0x1010
+#define regDSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL2_DSCL_EASF_V_BF_CNTL                                                                    0x1011
+#define regDSCL2_DSCL_EASF_V_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN                                                           0x1012
+#define regDSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG0                                                               0x1013
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG1                                                               0x1014
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG2                                                               0x1015
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG3                                                               0x1016
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG4                                                               0x1017
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG5                                                               0x1018
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG6                                                               0x1019
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG7                                                               0x101a
+#define regDSCL2_DSCL_EASF_H_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG0                                                               0x101b
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG1                                                               0x101c
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG2                                                               0x101d
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG3                                                               0x101e
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG4                                                               0x101f
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG5                                                               0x1020
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG6                                                               0x1021
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG7                                                               0x1022
+#define regDSCL2_DSCL_EASF_V_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG0                                                               0x1023
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG1                                                               0x1024
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG2                                                               0x1025
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG3                                                               0x1026
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG4                                                               0x1027
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG5                                                               0x1028
+#define regDSCL2_DSCL_EASF_H_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG0                                                               0x1029
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG1                                                               0x102a
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG2                                                               0x102b
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG3                                                               0x102c
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG4                                                               0x102d
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG5                                                               0x102e
+#define regDSCL2_DSCL_EASF_V_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL2_ISHARP_MODE                                                                            0x102f
+#define regDSCL2_ISHARP_MODE_BASE_IDX                                                                   2
+#define regDSCL2_ISHARP_DELTA_CTRL                                                                      0x1030
+#define regDSCL2_ISHARP_DELTA_CTRL_BASE_IDX                                                             2
+#define regDSCL2_ISHARP_DELTA_INDEX                                                                     0x1031
+#define regDSCL2_ISHARP_DELTA_INDEX_BASE_IDX                                                            2
+#define regDSCL2_ISHARP_DELTA_DATA                                                                      0x1032
+#define regDSCL2_ISHARP_DELTA_DATA_BASE_IDX                                                             2
+#define regDSCL2_ISHARP_NLDELTA_SOFT_CLIP                                                               0x1033
+#define regDSCL2_ISHARP_NLDELTA_SOFT_CLIP_BASE_IDX                                                      2
+#define regDSCL2_ISHARP_NOISEDET_THRESHOLD                                                              0x1034
+#define regDSCL2_ISHARP_NOISEDET_THRESHOLD_BASE_IDX                                                     2
+#define regDSCL2_ISHARP_NOISE_GAIN_PWL                                                                  0x1035
+#define regDSCL2_ISHARP_NOISE_GAIN_PWL_BASE_IDX                                                         2
+#define regDSCL2_ISHARP_LBA_PWL_SEG0                                                                    0x1036
+#define regDSCL2_ISHARP_LBA_PWL_SEG0_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_LBA_PWL_SEG1                                                                    0x1037
+#define regDSCL2_ISHARP_LBA_PWL_SEG1_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_LBA_PWL_SEG2                                                                    0x1038
+#define regDSCL2_ISHARP_LBA_PWL_SEG2_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_LBA_PWL_SEG3                                                                    0x1039
+#define regDSCL2_ISHARP_LBA_PWL_SEG3_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_LBA_PWL_SEG4                                                                    0x103a
+#define regDSCL2_ISHARP_LBA_PWL_SEG4_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_LBA_PWL_SEG5                                                                    0x103b
+#define regDSCL2_ISHARP_LBA_PWL_SEG5_BASE_IDX                                                           2
+#define regDSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL                                                          0x103c
+#define regDSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL_BASE_IDX                                                 2
+#define regDSCL2_DSCL_DEBUG                                                                             0x103d
+#define regDSCL2_DSCL_DEBUG_BASE_IDX                                                                    2
+#define regDSCL2_DSCL_TEST_DEBUG_INDEX                                                                  0x103e
+#define regDSCL2_DSCL_TEST_DEBUG_INDEX_BASE_IDX                                                         2
+#define regDSCL2_DSCL_TEST_DEBUG_DATA                                                                   0x103f
+#define regDSCL2_DSCL_TEST_DEBUG_DATA_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cm_dispdec
+// base address: 0xb58
+#define regCM2_CM_CONTROL                                                                               0x1040
+#define regCM2_CM_CONTROL_BASE_IDX                                                                      2
+#define regCM2_CM_POST_CSC_CONTROL                                                                      0x1041
+#define regCM2_CM_POST_CSC_CONTROL_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C11_C12                                                                      0x1042
+#define regCM2_CM_POST_CSC_C11_C12_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C13_C14                                                                      0x1043
+#define regCM2_CM_POST_CSC_C13_C14_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C21_C22                                                                      0x1044
+#define regCM2_CM_POST_CSC_C21_C22_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C23_C24                                                                      0x1045
+#define regCM2_CM_POST_CSC_C23_C24_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C31_C32                                                                      0x1046
+#define regCM2_CM_POST_CSC_C31_C32_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_C33_C34                                                                      0x1047
+#define regCM2_CM_POST_CSC_C33_C34_BASE_IDX                                                             2
+#define regCM2_CM_POST_CSC_B_C11_C12                                                                    0x1048
+#define regCM2_CM_POST_CSC_B_C11_C12_BASE_IDX                                                           2
+#define regCM2_CM_POST_CSC_B_C13_C14                                                                    0x1049
+#define regCM2_CM_POST_CSC_B_C13_C14_BASE_IDX                                                           2
+#define regCM2_CM_POST_CSC_B_C21_C22                                                                    0x104a
+#define regCM2_CM_POST_CSC_B_C21_C22_BASE_IDX                                                           2
+#define regCM2_CM_POST_CSC_B_C23_C24                                                                    0x104b
+#define regCM2_CM_POST_CSC_B_C23_C24_BASE_IDX                                                           2
+#define regCM2_CM_POST_CSC_B_C31_C32                                                                    0x104c
+#define regCM2_CM_POST_CSC_B_C31_C32_BASE_IDX                                                           2
+#define regCM2_CM_POST_CSC_B_C33_C34                                                                    0x104d
+#define regCM2_CM_POST_CSC_B_C33_C34_BASE_IDX                                                           2
+#define regCM2_CM_BIAS_CR_R                                                                             0x104e
+#define regCM2_CM_BIAS_CR_R_BASE_IDX                                                                    2
+#define regCM2_CM_BIAS_Y_G_CB_B                                                                         0x104f
+#define regCM2_CM_BIAS_Y_G_CB_B_BASE_IDX                                                                2
+#define regCM2_CM_GAMCOR_CONTROL                                                                        0x1050
+#define regCM2_CM_GAMCOR_CONTROL_BASE_IDX                                                               2
+#define regCM2_CM_GAMCOR_LUT_INDEX                                                                      0x1051
+#define regCM2_CM_GAMCOR_LUT_INDEX_BASE_IDX                                                             2
+#define regCM2_CM_GAMCOR_LUT_DATA                                                                       0x1052
+#define regCM2_CM_GAMCOR_LUT_DATA_BASE_IDX                                                              2
+#define regCM2_CM_GAMCOR_LUT_CONTROL                                                                    0x1053
+#define regCM2_CM_GAMCOR_LUT_CONTROL_BASE_IDX                                                           2
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_B                                                              0x1054
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_B_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_G                                                              0x1055
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_G_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_R                                                              0x1056
+#define regCM2_CM_GAMCOR_RAMA_START_CNTL_R_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B                                                        0x1057
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G                                                        0x1058
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R                                                        0x1059
+#define regCM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_B                                                         0x105a
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_G                                                         0x105b
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_R                                                         0x105c
+#define regCM2_CM_GAMCOR_RAMA_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_B                                                               0x105d
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_B                                                               0x105e
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_G                                                               0x105f
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_G                                                               0x1060
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_R                                                               0x1061
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_R                                                               0x1062
+#define regCM2_CM_GAMCOR_RAMA_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_B                                                                  0x1063
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_B_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_G                                                                  0x1064
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_G_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_R                                                                  0x1065
+#define regCM2_CM_GAMCOR_RAMA_OFFSET_R_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMA_REGION_0_1                                                                0x1066
+#define regCM2_CM_GAMCOR_RAMA_REGION_0_1_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMA_REGION_2_3                                                                0x1067
+#define regCM2_CM_GAMCOR_RAMA_REGION_2_3_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMA_REGION_4_5                                                                0x1068
+#define regCM2_CM_GAMCOR_RAMA_REGION_4_5_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMA_REGION_6_7                                                                0x1069
+#define regCM2_CM_GAMCOR_RAMA_REGION_6_7_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMA_REGION_8_9                                                                0x106a
+#define regCM2_CM_GAMCOR_RAMA_REGION_8_9_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMA_REGION_10_11                                                              0x106b
+#define regCM2_CM_GAMCOR_RAMA_REGION_10_11_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_12_13                                                              0x106c
+#define regCM2_CM_GAMCOR_RAMA_REGION_12_13_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_14_15                                                              0x106d
+#define regCM2_CM_GAMCOR_RAMA_REGION_14_15_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_16_17                                                              0x106e
+#define regCM2_CM_GAMCOR_RAMA_REGION_16_17_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_18_19                                                              0x106f
+#define regCM2_CM_GAMCOR_RAMA_REGION_18_19_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_20_21                                                              0x1070
+#define regCM2_CM_GAMCOR_RAMA_REGION_20_21_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_22_23                                                              0x1071
+#define regCM2_CM_GAMCOR_RAMA_REGION_22_23_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_24_25                                                              0x1072
+#define regCM2_CM_GAMCOR_RAMA_REGION_24_25_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_26_27                                                              0x1073
+#define regCM2_CM_GAMCOR_RAMA_REGION_26_27_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_28_29                                                              0x1074
+#define regCM2_CM_GAMCOR_RAMA_REGION_28_29_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_30_31                                                              0x1075
+#define regCM2_CM_GAMCOR_RAMA_REGION_30_31_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMA_REGION_32_33                                                              0x1076
+#define regCM2_CM_GAMCOR_RAMA_REGION_32_33_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_B                                                              0x1077
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_B_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_G                                                              0x1078
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_G_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_R                                                              0x1079
+#define regCM2_CM_GAMCOR_RAMB_START_CNTL_R_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B                                                        0x107a
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G                                                        0x107b
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R                                                        0x107c
+#define regCM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_B                                                         0x107d
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_G                                                         0x107e
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_R                                                         0x107f
+#define regCM2_CM_GAMCOR_RAMB_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_B                                                               0x1080
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_B                                                               0x1081
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_G                                                               0x1082
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_G                                                               0x1083
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_R                                                               0x1084
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_R                                                               0x1085
+#define regCM2_CM_GAMCOR_RAMB_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_B                                                                  0x1086
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_B_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_G                                                                  0x1087
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_G_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_R                                                                  0x1088
+#define regCM2_CM_GAMCOR_RAMB_OFFSET_R_BASE_IDX                                                         2
+#define regCM2_CM_GAMCOR_RAMB_REGION_0_1                                                                0x1089
+#define regCM2_CM_GAMCOR_RAMB_REGION_0_1_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMB_REGION_2_3                                                                0x108a
+#define regCM2_CM_GAMCOR_RAMB_REGION_2_3_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMB_REGION_4_5                                                                0x108b
+#define regCM2_CM_GAMCOR_RAMB_REGION_4_5_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMB_REGION_6_7                                                                0x108c
+#define regCM2_CM_GAMCOR_RAMB_REGION_6_7_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMB_REGION_8_9                                                                0x108d
+#define regCM2_CM_GAMCOR_RAMB_REGION_8_9_BASE_IDX                                                       2
+#define regCM2_CM_GAMCOR_RAMB_REGION_10_11                                                              0x108e
+#define regCM2_CM_GAMCOR_RAMB_REGION_10_11_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_12_13                                                              0x108f
+#define regCM2_CM_GAMCOR_RAMB_REGION_12_13_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_14_15                                                              0x1090
+#define regCM2_CM_GAMCOR_RAMB_REGION_14_15_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_16_17                                                              0x1091
+#define regCM2_CM_GAMCOR_RAMB_REGION_16_17_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_18_19                                                              0x1092
+#define regCM2_CM_GAMCOR_RAMB_REGION_18_19_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_20_21                                                              0x1093
+#define regCM2_CM_GAMCOR_RAMB_REGION_20_21_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_22_23                                                              0x1094
+#define regCM2_CM_GAMCOR_RAMB_REGION_22_23_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_24_25                                                              0x1095
+#define regCM2_CM_GAMCOR_RAMB_REGION_24_25_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_26_27                                                              0x1096
+#define regCM2_CM_GAMCOR_RAMB_REGION_26_27_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_28_29                                                              0x1097
+#define regCM2_CM_GAMCOR_RAMB_REGION_28_29_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_30_31                                                              0x1098
+#define regCM2_CM_GAMCOR_RAMB_REGION_30_31_BASE_IDX                                                     2
+#define regCM2_CM_GAMCOR_RAMB_REGION_32_33                                                              0x1099
+#define regCM2_CM_GAMCOR_RAMB_REGION_32_33_BASE_IDX                                                     2
+#define regCM2_CM_HDR_MULT_COEF                                                                         0x109a
+#define regCM2_CM_HDR_MULT_COEF_BASE_IDX                                                                2
+#define regCM2_CM_MEM_PWR_CTRL                                                                          0x109b
+#define regCM2_CM_MEM_PWR_CTRL_BASE_IDX                                                                 2
+#define regCM2_CM_MEM_PWR_STATUS                                                                        0x109c
+#define regCM2_CM_MEM_PWR_STATUS_BASE_IDX                                                               2
+#define regCM2_CM_DEALPHA                                                                               0x109e
+#define regCM2_CM_DEALPHA_BASE_IDX                                                                      2
+#define regCM2_CM_COEF_FORMAT                                                                           0x109f
+#define regCM2_CM_COEF_FORMAT_BASE_IDX                                                                  2
+#define regCM2_CM_TEST_DEBUG_INDEX                                                                      0x10a0
+#define regCM2_CM_TEST_DEBUG_INDEX_BASE_IDX                                                             2
+#define regCM2_CM_TEST_DEBUG_DATA                                                                       0x10a1
+#define regCM2_CM_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regCM2_CM_HIST_CNTL                                                                             0x10a2
+#define regCM2_CM_HIST_CNTL_BASE_IDX                                                                    2
+#define regCM2_CM_HIST_SCALE_SRC1                                                                       0x10a3
+#define regCM2_CM_HIST_SCALE_SRC1_BASE_IDX                                                              2
+#define regCM2_CM_HIST_COEFA_SRC2                                                                       0x10a4
+#define regCM2_CM_HIST_COEFA_SRC2_BASE_IDX                                                              2
+#define regCM2_CM_HIST_COEFB_SRC2                                                                       0x10a5
+#define regCM2_CM_HIST_COEFB_SRC2_BASE_IDX                                                              2
+#define regCM2_CM_HIST_COEFC_SRC2                                                                       0x10a6
+#define regCM2_CM_HIST_COEFC_SRC2_BASE_IDX                                                              2
+#define regCM2_CM_HIST_SCALE_SRC3                                                                       0x10a7
+#define regCM2_CM_HIST_SCALE_SRC3_BASE_IDX                                                              2
+#define regCM2_CM_HIST_BIAS_SRC1                                                                        0x10a8
+#define regCM2_CM_HIST_BIAS_SRC1_BASE_IDX                                                               2
+#define regCM2_CM_HIST_BIAS_SRC2                                                                        0x10a9
+#define regCM2_CM_HIST_BIAS_SRC2_BASE_IDX                                                               2
+#define regCM2_CM_HIST_BIAS_SRC3                                                                        0x10aa
+#define regCM2_CM_HIST_BIAS_SRC3_BASE_IDX                                                               2
+#define regCM2_CM_HIST_LOCK                                                                             0x10ab
+#define regCM2_CM_HIST_LOCK_BASE_IDX                                                                    2
+#define regCM2_CM_HIST_INDEX                                                                            0x10ac
+#define regCM2_CM_HIST_INDEX_BASE_IDX                                                                   2
+#define regCM2_CM_HIST_DATA                                                                             0x10ad
+#define regCM2_CM_HIST_DATA_BASE_IDX                                                                    2
+#define regCM2_CM_HIST_STATUS                                                                           0x10ae
+#define regCM2_CM_HIST_STATUS_BASE_IDX                                                                  2
+#define regCM2_CM_HIST_INT_CONTROL                                                                      0x10af
+#define regCM2_CM_HIST_INT_CONTROL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dpp_top_dispdec
+// base address: 0xb58
+#define regDPP_TOP2_DPP_CONTROL                                                                         0x0f9b
+#define regDPP_TOP2_DPP_CONTROL_BASE_IDX                                                                2
+#define regDPP_TOP2_DPP_SOFT_RESET                                                                      0x0f9c
+#define regDPP_TOP2_DPP_SOFT_RESET_BASE_IDX                                                             2
+#define regDPP_TOP2_DPP_CRC_VAL_R                                                                       0x0f9d
+#define regDPP_TOP2_DPP_CRC_VAL_R_BASE_IDX                                                              2
+#define regDPP_TOP2_DPP_CRC_VAL_G                                                                       0x0f9e
+#define regDPP_TOP2_DPP_CRC_VAL_G_BASE_IDX                                                              2
+#define regDPP_TOP2_DPP_CRC_VAL_B                                                                       0x0f9f
+#define regDPP_TOP2_DPP_CRC_VAL_B_BASE_IDX                                                              2
+#define regDPP_TOP2_DPP_CRC_VAL_A                                                                       0x0fa0
+#define regDPP_TOP2_DPP_CRC_VAL_A_BASE_IDX                                                              2
+#define regDPP_TOP2_DPP_CRC_CTRL                                                                        0x0fa1
+#define regDPP_TOP2_DPP_CRC_CTRL_BASE_IDX                                                               2
+#define regDPP_TOP2_HOST_READ_CONTROL                                                                   0x0fa2
+#define regDPP_TOP2_HOST_READ_CONTROL_BASE_IDX                                                          2
+#define regDPP_TOP2_DPP_DEBUG_SEL                                                                       0x0fa3
+#define regDPP_TOP2_DPP_DEBUG_SEL_BASE_IDX                                                              2
+#define regDPP_TOP2_DPP_DEBUG_SPARE                                                                     0x0fa4
+#define regDPP_TOP2_DPP_DEBUG_SPARE_BASE_IDX                                                            2
+#define regDPP_TOP2_DPP_TEST_DEBUG_INDEX                                                                0x0fa5
+#define regDPP_TOP2_DPP_TEST_DEBUG_INDEX_BASE_IDX                                                       2
+#define regDPP_TOP2_DPP_TEST_DEBUG_DATA                                                                 0x0fa6
+#define regDPP_TOP2_DPP_TEST_DEBUG_DATA_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x43e8
+#define regDC_PERFMON12_PERFCOUNTER_CNTL                                                                0x10fa
+#define regDC_PERFMON12_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON12_PERFCOUNTER_CNTL2                                                               0x10fb
+#define regDC_PERFMON12_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON12_PERFCOUNTER_STATE                                                               0x10fc
+#define regDC_PERFMON12_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON12_PERFMON_CNTL                                                                    0x10fd
+#define regDC_PERFMON12_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON12_PERFMON_CNTL2                                                                   0x10fe
+#define regDC_PERFMON12_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON12_PERFMON_CVALUE_INT_MISC                                                         0x10ff
+#define regDC_PERFMON12_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON12_PERFMON_CVALUE_LOW                                                              0x1100
+#define regDC_PERFMON12_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON12_PERFMON_HI                                                                      0x1101
+#define regDC_PERFMON12_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON12_PERFMON_LOW                                                                     0x1102
+#define regDC_PERFMON12_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON12_PERFMON_TEST_DEBUG_INDEX                                                        0x1103
+#define regDC_PERFMON12_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON12_PERFMON_TEST_DEBUG_DATA                                                         0x1104
+#define regDC_PERFMON12_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cnvc_cfg_dispdec
+// base address: 0x1104
+#define regCNVC_CFG3_CNVC_SURFACE_PIXEL_FORMAT                                                          0x1113
+#define regCNVC_CFG3_CNVC_SURFACE_PIXEL_FORMAT_BASE_IDX                                                 2
+#define regCNVC_CFG3_FORMAT_CONTROL                                                                     0x1114
+#define regCNVC_CFG3_FORMAT_CONTROL_BASE_IDX                                                            2
+#define regCNVC_CFG3_FCNV_FP_BIAS_R                                                                     0x1115
+#define regCNVC_CFG3_FCNV_FP_BIAS_R_BASE_IDX                                                            2
+#define regCNVC_CFG3_FCNV_FP_BIAS_G                                                                     0x1116
+#define regCNVC_CFG3_FCNV_FP_BIAS_G_BASE_IDX                                                            2
+#define regCNVC_CFG3_FCNV_FP_BIAS_B                                                                     0x1117
+#define regCNVC_CFG3_FCNV_FP_BIAS_B_BASE_IDX                                                            2
+#define regCNVC_CFG3_FCNV_FP_SCALE_R                                                                    0x1118
+#define regCNVC_CFG3_FCNV_FP_SCALE_R_BASE_IDX                                                           2
+#define regCNVC_CFG3_FCNV_FP_SCALE_G                                                                    0x1119
+#define regCNVC_CFG3_FCNV_FP_SCALE_G_BASE_IDX                                                           2
+#define regCNVC_CFG3_FCNV_FP_SCALE_B                                                                    0x111a
+#define regCNVC_CFG3_FCNV_FP_SCALE_B_BASE_IDX                                                           2
+#define regCNVC_CFG3_COLOR_KEYER_CONTROL                                                                0x111b
+#define regCNVC_CFG3_COLOR_KEYER_CONTROL_BASE_IDX                                                       2
+#define regCNVC_CFG3_COLOR_KEYER_ALPHA                                                                  0x111c
+#define regCNVC_CFG3_COLOR_KEYER_ALPHA_BASE_IDX                                                         2
+#define regCNVC_CFG3_COLOR_KEYER_RED                                                                    0x111d
+#define regCNVC_CFG3_COLOR_KEYER_RED_BASE_IDX                                                           2
+#define regCNVC_CFG3_COLOR_KEYER_GREEN                                                                  0x111e
+#define regCNVC_CFG3_COLOR_KEYER_GREEN_BASE_IDX                                                         2
+#define regCNVC_CFG3_COLOR_KEYER_BLUE                                                                   0x111f
+#define regCNVC_CFG3_COLOR_KEYER_BLUE_BASE_IDX                                                          2
+#define regCNVC_CFG3_ALPHA_2BIT_LUT01                                                                   0x1121
+#define regCNVC_CFG3_ALPHA_2BIT_LUT01_BASE_IDX                                                          2
+#define regCNVC_CFG3_ALPHA_2BIT_LUT23                                                                   0x1122
+#define regCNVC_CFG3_ALPHA_2BIT_LUT23_BASE_IDX                                                          2
+#define regCNVC_CFG3_PRE_DEALPHA                                                                        0x1123
+#define regCNVC_CFG3_PRE_DEALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG3_PRE_CSC_MODE                                                                       0x1124
+#define regCNVC_CFG3_PRE_CSC_MODE_BASE_IDX                                                              2
+#define regCNVC_CFG3_PRE_CSC_C11_C12                                                                    0x1125
+#define regCNVC_CFG3_PRE_CSC_C11_C12_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_C13_C14                                                                    0x1126
+#define regCNVC_CFG3_PRE_CSC_C13_C14_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_C21_C22                                                                    0x1127
+#define regCNVC_CFG3_PRE_CSC_C21_C22_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_C23_C24                                                                    0x1128
+#define regCNVC_CFG3_PRE_CSC_C23_C24_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_C31_C32                                                                    0x1129
+#define regCNVC_CFG3_PRE_CSC_C31_C32_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_C33_C34                                                                    0x112a
+#define regCNVC_CFG3_PRE_CSC_C33_C34_BASE_IDX                                                           2
+#define regCNVC_CFG3_PRE_CSC_B_C11_C12                                                                  0x112b
+#define regCNVC_CFG3_PRE_CSC_B_C11_C12_BASE_IDX                                                         2
+#define regCNVC_CFG3_PRE_CSC_B_C13_C14                                                                  0x112c
+#define regCNVC_CFG3_PRE_CSC_B_C13_C14_BASE_IDX                                                         2
+#define regCNVC_CFG3_PRE_CSC_B_C21_C22                                                                  0x112d
+#define regCNVC_CFG3_PRE_CSC_B_C21_C22_BASE_IDX                                                         2
+#define regCNVC_CFG3_PRE_CSC_B_C23_C24                                                                  0x112e
+#define regCNVC_CFG3_PRE_CSC_B_C23_C24_BASE_IDX                                                         2
+#define regCNVC_CFG3_PRE_CSC_B_C31_C32                                                                  0x112f
+#define regCNVC_CFG3_PRE_CSC_B_C31_C32_BASE_IDX                                                         2
+#define regCNVC_CFG3_PRE_CSC_B_C33_C34                                                                  0x1130
+#define regCNVC_CFG3_PRE_CSC_B_C33_C34_BASE_IDX                                                         2
+#define regCNVC_CFG3_CNVC_COEF_FORMAT                                                                   0x1131
+#define regCNVC_CFG3_CNVC_COEF_FORMAT_BASE_IDX                                                          2
+#define regCNVC_CFG3_PRE_GAM                                                                            0x1132
+#define regCNVC_CFG3_PRE_GAM_BASE_IDX                                                                   2
+#define regCNVC_CFG3_PRE_REALPHA                                                                        0x1133
+#define regCNVC_CFG3_PRE_REALPHA_BASE_IDX                                                               2
+#define regCNVC_CFG3_PIX_DROP_CNTL                                                                      0x1134
+#define regCNVC_CFG3_PIX_DROP_CNTL_BASE_IDX                                                             2
+#define regCNVC_CFG3_PIX_DROP_OUT                                                                       0x1135
+#define regCNVC_CFG3_PIX_DROP_OUT_BASE_IDX                                                              2
+#define regCNVC_CFG3_CNVC_UPSP_MODE                                                                     0x1136
+#define regCNVC_CFG3_CNVC_UPSP_MODE_BASE_IDX                                                            2
+#define regCNVC_CFG3_CNVC_UPSP_V_COEF_P0                                                                0x1137
+#define regCNVC_CFG3_CNVC_UPSP_V_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG3_CNVC_UPSP_V_COEF_P1                                                                0x1138
+#define regCNVC_CFG3_CNVC_UPSP_V_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG3_CNVC_UPSP_H_COEF_P0                                                                0x1139
+#define regCNVC_CFG3_CNVC_UPSP_H_COEF_P0_BASE_IDX                                                       2
+#define regCNVC_CFG3_CNVC_UPSP_H_COEF_P1                                                                0x113a
+#define regCNVC_CFG3_CNVC_UPSP_H_COEF_P1_BASE_IDX                                                       2
+#define regCNVC_CFG3_CNVC_UPSP_CLAMP                                                                    0x113b
+#define regCNVC_CFG3_CNVC_UPSP_CLAMP_BASE_IDX                                                           2
+#define regCNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL                                                             0x113c
+#define regCNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL_BASE_IDX                                                    2
+#define regCNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX                                                          0x113d
+#define regCNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regCNVC_CFG3_CNVC_CFG_TEST_DEBUG_DATA                                                           0x113e
+#define regCNVC_CFG3_CNVC_CFG_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cm_cur_dispdec
+// base address: 0x1104
+#define regCM_CUR3_CURSOR0_CONTROL                                                                      0x1237
+#define regCM_CUR3_CURSOR0_CONTROL_BASE_IDX                                                             2
+#define regCM_CUR3_CURSOR0_COLOR0                                                                       0x1238
+#define regCM_CUR3_CURSOR0_COLOR0_BASE_IDX                                                              2
+#define regCM_CUR3_CURSOR0_COLOR1                                                                       0x1239
+#define regCM_CUR3_CURSOR0_COLOR1_BASE_IDX                                                              2
+#define regCM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y                                                            0x123a
+#define regCM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y_BASE_IDX                                                   2
+#define regCM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB                                                        0x123b
+#define regCM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB_BASE_IDX                                               2
+#define regCM_CUR3_CUR0_MATRIX_MODE                                                                     0x123c
+#define regCM_CUR3_CUR0_MATRIX_MODE_BASE_IDX                                                            2
+#define regCM_CUR3_CUR0_MATRIX_C11_C12_A                                                                0x123d
+#define regCM_CUR3_CUR0_MATRIX_C11_C12_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C13_C14_A                                                                0x123e
+#define regCM_CUR3_CUR0_MATRIX_C13_C14_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C21_C22_A                                                                0x123f
+#define regCM_CUR3_CUR0_MATRIX_C21_C22_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C23_C24_A                                                                0x1240
+#define regCM_CUR3_CUR0_MATRIX_C23_C24_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C31_C32_A                                                                0x1241
+#define regCM_CUR3_CUR0_MATRIX_C31_C32_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C33_C34_A                                                                0x1242
+#define regCM_CUR3_CUR0_MATRIX_C33_C34_A_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C11_C12_B                                                                0x1243
+#define regCM_CUR3_CUR0_MATRIX_C11_C12_B_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C13_C14_B                                                                0x1244
+#define regCM_CUR3_CUR0_MATRIX_C13_C14_B_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C21_C22_B                                                                0x1245
+#define regCM_CUR3_CUR0_MATRIX_C21_C22_B_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C23_C24_B                                                                0x1246
+#define regCM_CUR3_CUR0_MATRIX_C23_C24_B_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C31_C32_B                                                                0x1247
+#define regCM_CUR3_CUR0_MATRIX_C31_C32_B_BASE_IDX                                                       2
+#define regCM_CUR3_CUR0_MATRIX_C33_C34_B                                                                0x1248
+#define regCM_CUR3_CUR0_MATRIX_C33_C34_B_BASE_IDX                                                       2
+#define regCM_CUR3_CM_CUR0_TEST_DEBUG_INDEX                                                             0x1249
+#define regCM_CUR3_CM_CUR0_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regCM_CUR3_CM_CUR0_TEST_DEBUG_DATA                                                              0x124a
+#define regCM_CUR3_CM_CUR0_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dscl_dispdec
+// base address: 0x1104
+#define regDSCL3_SCL_COEF_RAM_TAP_SELECT                                                                0x114c
+#define regDSCL3_SCL_COEF_RAM_TAP_SELECT_BASE_IDX                                                       2
+#define regDSCL3_SCL_COEF_RAM_TAP_DATA                                                                  0x114d
+#define regDSCL3_SCL_COEF_RAM_TAP_DATA_BASE_IDX                                                         2
+#define regDSCL3_SCL_MODE                                                                               0x114e
+#define regDSCL3_SCL_MODE_BASE_IDX                                                                      2
+#define regDSCL3_SCL_TAP_CONTROL                                                                        0x114f
+#define regDSCL3_SCL_TAP_CONTROL_BASE_IDX                                                               2
+#define regDSCL3_DSCL_CONTROL                                                                           0x1150
+#define regDSCL3_DSCL_CONTROL_BASE_IDX                                                                  2
+#define regDSCL3_DSCL_2TAP_CONTROL                                                                      0x1151
+#define regDSCL3_DSCL_2TAP_CONTROL_BASE_IDX                                                             2
+#define regDSCL3_SCL_MANUAL_REPLICATE_CONTROL                                                           0x1152
+#define regDSCL3_SCL_MANUAL_REPLICATE_CONTROL_BASE_IDX                                                  2
+#define regDSCL3_SCL_HORZ_FILTER_SCALE_RATIO                                                            0x1153
+#define regDSCL3_SCL_HORZ_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL3_SCL_HORZ_FILTER_INIT                                                                   0x1154
+#define regDSCL3_SCL_HORZ_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL3_SCL_HORZ_FILTER_SCALE_RATIO_C                                                          0x1155
+#define regDSCL3_SCL_HORZ_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL3_SCL_HORZ_FILTER_INIT_C                                                                 0x1156
+#define regDSCL3_SCL_HORZ_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL3_SCL_VERT_FILTER_SCALE_RATIO                                                            0x1157
+#define regDSCL3_SCL_VERT_FILTER_SCALE_RATIO_BASE_IDX                                                   2
+#define regDSCL3_SCL_VERT_FILTER_INIT                                                                   0x1158
+#define regDSCL3_SCL_VERT_FILTER_INIT_BASE_IDX                                                          2
+#define regDSCL3_SCL_VERT_FILTER_SCALE_RATIO_C                                                          0x1159
+#define regDSCL3_SCL_VERT_FILTER_SCALE_RATIO_C_BASE_IDX                                                 2
+#define regDSCL3_SCL_VERT_FILTER_INIT_C                                                                 0x115a
+#define regDSCL3_SCL_VERT_FILTER_INIT_C_BASE_IDX                                                        2
+#define regDSCL3_SCL_BLACK_COLOR                                                                        0x115c
+#define regDSCL3_SCL_BLACK_COLOR_BASE_IDX                                                               2
+#define regDSCL3_DSCL_UPDATE                                                                            0x115d
+#define regDSCL3_DSCL_UPDATE_BASE_IDX                                                                   2
+#define regDSCL3_DSCL_AUTOCAL                                                                           0x115e
+#define regDSCL3_DSCL_AUTOCAL_BASE_IDX                                                                  2
+#define regDSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT                                                           0x115f
+#define regDSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT_BASE_IDX                                                  2
+#define regDSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM                                                           0x1160
+#define regDSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM_BASE_IDX                                                  2
+#define regDSCL3_OTG_H_BLANK                                                                            0x1161
+#define regDSCL3_OTG_H_BLANK_BASE_IDX                                                                   2
+#define regDSCL3_OTG_V_BLANK                                                                            0x1162
+#define regDSCL3_OTG_V_BLANK_BASE_IDX                                                                   2
+#define regDSCL3_RECOUT_START                                                                           0x1163
+#define regDSCL3_RECOUT_START_BASE_IDX                                                                  2
+#define regDSCL3_RECOUT_SIZE                                                                            0x1164
+#define regDSCL3_RECOUT_SIZE_BASE_IDX                                                                   2
+#define regDSCL3_MPC_SIZE                                                                               0x1165
+#define regDSCL3_MPC_SIZE_BASE_IDX                                                                      2
+#define regDSCL3_LB_DATA_FORMAT                                                                         0x1166
+#define regDSCL3_LB_DATA_FORMAT_BASE_IDX                                                                2
+#define regDSCL3_LB_MEMORY_CTRL                                                                         0x1167
+#define regDSCL3_LB_MEMORY_CTRL_BASE_IDX                                                                2
+#define regDSCL3_LB_V_COUNTER                                                                           0x1168
+#define regDSCL3_LB_V_COUNTER_BASE_IDX                                                                  2
+#define regDSCL3_DSCL_MEM_PWR_CTRL                                                                      0x1169
+#define regDSCL3_DSCL_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL3_DSCL_MEM_PWR_STATUS                                                                    0x116a
+#define regDSCL3_DSCL_MEM_PWR_STATUS_BASE_IDX                                                           2
+#define regDSCL3_OBUF_CONTROL                                                                           0x116b
+#define regDSCL3_OBUF_CONTROL_BASE_IDX                                                                  2
+#define regDSCL3_OBUF_MEM_PWR_CTRL                                                                      0x116c
+#define regDSCL3_OBUF_MEM_PWR_CTRL_BASE_IDX                                                             2
+#define regDSCL3_DSCL_EASF_H_MODE                                                                       0x116d
+#define regDSCL3_DSCL_EASF_H_MODE_BASE_IDX                                                              2
+#define regDSCL3_DSCL_EASF_V_MODE                                                                       0x116e
+#define regDSCL3_DSCL_EASF_V_MODE_BASE_IDX                                                              2
+#define regDSCL3_DSCL_SC_MODE                                                                           0x116f
+#define regDSCL3_DSCL_SC_MODE_BASE_IDX                                                                  2
+#define regDSCL3_DSCL_SC_MATRIX_C0C1                                                                    0x1170
+#define regDSCL3_DSCL_SC_MATRIX_C0C1_BASE_IDX                                                           2
+#define regDSCL3_DSCL_SC_MATRIX_C2C3                                                                    0x1171
+#define regDSCL3_DSCL_SC_MATRIX_C2C3_BASE_IDX                                                           2
+#define regDSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN                                                       0x1172
+#define regDSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE                                                     0x1173
+#define regDSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN                                                       0x1174
+#define regDSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN_BASE_IDX                                              2
+#define regDSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE                                                     0x1175
+#define regDSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE_BASE_IDX                                            2
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1                                                         0x1176
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1_BASE_IDX                                                2
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2                                                         0x1177
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2_BASE_IDX                                                2
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3                                                         0x1178
+#define regDSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3_BASE_IDX                                                2
+#define regDSCL3_DSCL_EASF_RINGEST_FORCE                                                                0x1179
+#define regDSCL3_DSCL_EASF_RINGEST_FORCE_BASE_IDX                                                       2
+#define regDSCL3_DSCL_EASF_H_BF_CNTL                                                                    0x117a
+#define regDSCL3_DSCL_EASF_H_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN                                                           0x117b
+#define regDSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL3_DSCL_EASF_V_BF_CNTL                                                                    0x117c
+#define regDSCL3_DSCL_EASF_V_BF_CNTL_BASE_IDX                                                           2
+#define regDSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN                                                           0x117d
+#define regDSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN_BASE_IDX                                                  2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG0                                                               0x117e
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG1                                                               0x117f
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG2                                                               0x1180
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG3                                                               0x1181
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG4                                                               0x1182
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG5                                                               0x1183
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG6                                                               0x1184
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG7                                                               0x1185
+#define regDSCL3_DSCL_EASF_H_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG0                                                               0x1186
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG1                                                               0x1187
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG2                                                               0x1188
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG3                                                               0x1189
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG4                                                               0x118a
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG5                                                               0x118b
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG6                                                               0x118c
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG6_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG7                                                               0x118d
+#define regDSCL3_DSCL_EASF_V_BF1_PWL_SEG7_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG0                                                               0x118e
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG1                                                               0x118f
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG2                                                               0x1190
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG3                                                               0x1191
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG4                                                               0x1192
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG5                                                               0x1193
+#define regDSCL3_DSCL_EASF_H_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG0                                                               0x1194
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG0_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG1                                                               0x1195
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG1_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG2                                                               0x1196
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG2_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG3                                                               0x1197
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG3_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG4                                                               0x1198
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG4_BASE_IDX                                                      2
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG5                                                               0x1199
+#define regDSCL3_DSCL_EASF_V_BF3_PWL_SEG5_BASE_IDX                                                      2
+#define regDSCL3_ISHARP_MODE                                                                            0x119a
+#define regDSCL3_ISHARP_MODE_BASE_IDX                                                                   2
+#define regDSCL3_ISHARP_DELTA_CTRL                                                                      0x119b
+#define regDSCL3_ISHARP_DELTA_CTRL_BASE_IDX                                                             2
+#define regDSCL3_ISHARP_DELTA_INDEX                                                                     0x119c
+#define regDSCL3_ISHARP_DELTA_INDEX_BASE_IDX                                                            2
+#define regDSCL3_ISHARP_DELTA_DATA                                                                      0x119d
+#define regDSCL3_ISHARP_DELTA_DATA_BASE_IDX                                                             2
+#define regDSCL3_ISHARP_NLDELTA_SOFT_CLIP                                                               0x119e
+#define regDSCL3_ISHARP_NLDELTA_SOFT_CLIP_BASE_IDX                                                      2
+#define regDSCL3_ISHARP_NOISEDET_THRESHOLD                                                              0x119f
+#define regDSCL3_ISHARP_NOISEDET_THRESHOLD_BASE_IDX                                                     2
+#define regDSCL3_ISHARP_NOISE_GAIN_PWL                                                                  0x11a0
+#define regDSCL3_ISHARP_NOISE_GAIN_PWL_BASE_IDX                                                         2
+#define regDSCL3_ISHARP_LBA_PWL_SEG0                                                                    0x11a1
+#define regDSCL3_ISHARP_LBA_PWL_SEG0_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_LBA_PWL_SEG1                                                                    0x11a2
+#define regDSCL3_ISHARP_LBA_PWL_SEG1_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_LBA_PWL_SEG2                                                                    0x11a3
+#define regDSCL3_ISHARP_LBA_PWL_SEG2_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_LBA_PWL_SEG3                                                                    0x11a4
+#define regDSCL3_ISHARP_LBA_PWL_SEG3_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_LBA_PWL_SEG4                                                                    0x11a5
+#define regDSCL3_ISHARP_LBA_PWL_SEG4_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_LBA_PWL_SEG5                                                                    0x11a6
+#define regDSCL3_ISHARP_LBA_PWL_SEG5_BASE_IDX                                                           2
+#define regDSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL                                                          0x11a7
+#define regDSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL_BASE_IDX                                                 2
+#define regDSCL3_DSCL_DEBUG                                                                             0x11a8
+#define regDSCL3_DSCL_DEBUG_BASE_IDX                                                                    2
+#define regDSCL3_DSCL_TEST_DEBUG_INDEX                                                                  0x11a9
+#define regDSCL3_DSCL_TEST_DEBUG_INDEX_BASE_IDX                                                         2
+#define regDSCL3_DSCL_TEST_DEBUG_DATA                                                                   0x11aa
+#define regDSCL3_DSCL_TEST_DEBUG_DATA_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cm_dispdec
+// base address: 0x1104
+#define regCM3_CM_CONTROL                                                                               0x11ab
+#define regCM3_CM_CONTROL_BASE_IDX                                                                      2
+#define regCM3_CM_POST_CSC_CONTROL                                                                      0x11ac
+#define regCM3_CM_POST_CSC_CONTROL_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C11_C12                                                                      0x11ad
+#define regCM3_CM_POST_CSC_C11_C12_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C13_C14                                                                      0x11ae
+#define regCM3_CM_POST_CSC_C13_C14_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C21_C22                                                                      0x11af
+#define regCM3_CM_POST_CSC_C21_C22_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C23_C24                                                                      0x11b0
+#define regCM3_CM_POST_CSC_C23_C24_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C31_C32                                                                      0x11b1
+#define regCM3_CM_POST_CSC_C31_C32_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_C33_C34                                                                      0x11b2
+#define regCM3_CM_POST_CSC_C33_C34_BASE_IDX                                                             2
+#define regCM3_CM_POST_CSC_B_C11_C12                                                                    0x11b3
+#define regCM3_CM_POST_CSC_B_C11_C12_BASE_IDX                                                           2
+#define regCM3_CM_POST_CSC_B_C13_C14                                                                    0x11b4
+#define regCM3_CM_POST_CSC_B_C13_C14_BASE_IDX                                                           2
+#define regCM3_CM_POST_CSC_B_C21_C22                                                                    0x11b5
+#define regCM3_CM_POST_CSC_B_C21_C22_BASE_IDX                                                           2
+#define regCM3_CM_POST_CSC_B_C23_C24                                                                    0x11b6
+#define regCM3_CM_POST_CSC_B_C23_C24_BASE_IDX                                                           2
+#define regCM3_CM_POST_CSC_B_C31_C32                                                                    0x11b7
+#define regCM3_CM_POST_CSC_B_C31_C32_BASE_IDX                                                           2
+#define regCM3_CM_POST_CSC_B_C33_C34                                                                    0x11b8
+#define regCM3_CM_POST_CSC_B_C33_C34_BASE_IDX                                                           2
+#define regCM3_CM_BIAS_CR_R                                                                             0x11b9
+#define regCM3_CM_BIAS_CR_R_BASE_IDX                                                                    2
+#define regCM3_CM_BIAS_Y_G_CB_B                                                                         0x11ba
+#define regCM3_CM_BIAS_Y_G_CB_B_BASE_IDX                                                                2
+#define regCM3_CM_GAMCOR_CONTROL                                                                        0x11bb
+#define regCM3_CM_GAMCOR_CONTROL_BASE_IDX                                                               2
+#define regCM3_CM_GAMCOR_LUT_INDEX                                                                      0x11bc
+#define regCM3_CM_GAMCOR_LUT_INDEX_BASE_IDX                                                             2
+#define regCM3_CM_GAMCOR_LUT_DATA                                                                       0x11bd
+#define regCM3_CM_GAMCOR_LUT_DATA_BASE_IDX                                                              2
+#define regCM3_CM_GAMCOR_LUT_CONTROL                                                                    0x11be
+#define regCM3_CM_GAMCOR_LUT_CONTROL_BASE_IDX                                                           2
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_B                                                              0x11bf
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_B_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_G                                                              0x11c0
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_G_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_R                                                              0x11c1
+#define regCM3_CM_GAMCOR_RAMA_START_CNTL_R_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B                                                        0x11c2
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G                                                        0x11c3
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R                                                        0x11c4
+#define regCM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_B                                                         0x11c5
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_G                                                         0x11c6
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_R                                                         0x11c7
+#define regCM3_CM_GAMCOR_RAMA_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_B                                                               0x11c8
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_B                                                               0x11c9
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_G                                                               0x11ca
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_G                                                               0x11cb
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_R                                                               0x11cc
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_R                                                               0x11cd
+#define regCM3_CM_GAMCOR_RAMA_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_B                                                                  0x11ce
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_B_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_G                                                                  0x11cf
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_G_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_R                                                                  0x11d0
+#define regCM3_CM_GAMCOR_RAMA_OFFSET_R_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMA_REGION_0_1                                                                0x11d1
+#define regCM3_CM_GAMCOR_RAMA_REGION_0_1_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMA_REGION_2_3                                                                0x11d2
+#define regCM3_CM_GAMCOR_RAMA_REGION_2_3_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMA_REGION_4_5                                                                0x11d3
+#define regCM3_CM_GAMCOR_RAMA_REGION_4_5_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMA_REGION_6_7                                                                0x11d4
+#define regCM3_CM_GAMCOR_RAMA_REGION_6_7_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMA_REGION_8_9                                                                0x11d5
+#define regCM3_CM_GAMCOR_RAMA_REGION_8_9_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMA_REGION_10_11                                                              0x11d6
+#define regCM3_CM_GAMCOR_RAMA_REGION_10_11_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_12_13                                                              0x11d7
+#define regCM3_CM_GAMCOR_RAMA_REGION_12_13_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_14_15                                                              0x11d8
+#define regCM3_CM_GAMCOR_RAMA_REGION_14_15_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_16_17                                                              0x11d9
+#define regCM3_CM_GAMCOR_RAMA_REGION_16_17_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_18_19                                                              0x11da
+#define regCM3_CM_GAMCOR_RAMA_REGION_18_19_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_20_21                                                              0x11db
+#define regCM3_CM_GAMCOR_RAMA_REGION_20_21_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_22_23                                                              0x11dc
+#define regCM3_CM_GAMCOR_RAMA_REGION_22_23_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_24_25                                                              0x11dd
+#define regCM3_CM_GAMCOR_RAMA_REGION_24_25_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_26_27                                                              0x11de
+#define regCM3_CM_GAMCOR_RAMA_REGION_26_27_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_28_29                                                              0x11df
+#define regCM3_CM_GAMCOR_RAMA_REGION_28_29_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_30_31                                                              0x11e0
+#define regCM3_CM_GAMCOR_RAMA_REGION_30_31_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMA_REGION_32_33                                                              0x11e1
+#define regCM3_CM_GAMCOR_RAMA_REGION_32_33_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_B                                                              0x11e2
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_B_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_G                                                              0x11e3
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_G_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_R                                                              0x11e4
+#define regCM3_CM_GAMCOR_RAMB_START_CNTL_R_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B                                                        0x11e5
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G                                                        0x11e6
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R                                                        0x11e7
+#define regCM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                               2
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_B                                                         0x11e8
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_B_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_G                                                         0x11e9
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_G_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_R                                                         0x11ea
+#define regCM3_CM_GAMCOR_RAMB_START_BASE_CNTL_R_BASE_IDX                                                2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_B                                                               0x11eb
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_B_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_B                                                               0x11ec
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_B_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_G                                                               0x11ed
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_G_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_G                                                               0x11ee
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_G_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_R                                                               0x11ef
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL1_R_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_R                                                               0x11f0
+#define regCM3_CM_GAMCOR_RAMB_END_CNTL2_R_BASE_IDX                                                      2
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_B                                                                  0x11f1
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_B_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_G                                                                  0x11f2
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_G_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_R                                                                  0x11f3
+#define regCM3_CM_GAMCOR_RAMB_OFFSET_R_BASE_IDX                                                         2
+#define regCM3_CM_GAMCOR_RAMB_REGION_0_1                                                                0x11f4
+#define regCM3_CM_GAMCOR_RAMB_REGION_0_1_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMB_REGION_2_3                                                                0x11f5
+#define regCM3_CM_GAMCOR_RAMB_REGION_2_3_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMB_REGION_4_5                                                                0x11f6
+#define regCM3_CM_GAMCOR_RAMB_REGION_4_5_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMB_REGION_6_7                                                                0x11f7
+#define regCM3_CM_GAMCOR_RAMB_REGION_6_7_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMB_REGION_8_9                                                                0x11f8
+#define regCM3_CM_GAMCOR_RAMB_REGION_8_9_BASE_IDX                                                       2
+#define regCM3_CM_GAMCOR_RAMB_REGION_10_11                                                              0x11f9
+#define regCM3_CM_GAMCOR_RAMB_REGION_10_11_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_12_13                                                              0x11fa
+#define regCM3_CM_GAMCOR_RAMB_REGION_12_13_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_14_15                                                              0x11fb
+#define regCM3_CM_GAMCOR_RAMB_REGION_14_15_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_16_17                                                              0x11fc
+#define regCM3_CM_GAMCOR_RAMB_REGION_16_17_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_18_19                                                              0x11fd
+#define regCM3_CM_GAMCOR_RAMB_REGION_18_19_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_20_21                                                              0x11fe
+#define regCM3_CM_GAMCOR_RAMB_REGION_20_21_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_22_23                                                              0x11ff
+#define regCM3_CM_GAMCOR_RAMB_REGION_22_23_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_24_25                                                              0x1200
+#define regCM3_CM_GAMCOR_RAMB_REGION_24_25_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_26_27                                                              0x1201
+#define regCM3_CM_GAMCOR_RAMB_REGION_26_27_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_28_29                                                              0x1202
+#define regCM3_CM_GAMCOR_RAMB_REGION_28_29_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_30_31                                                              0x1203
+#define regCM3_CM_GAMCOR_RAMB_REGION_30_31_BASE_IDX                                                     2
+#define regCM3_CM_GAMCOR_RAMB_REGION_32_33                                                              0x1204
+#define regCM3_CM_GAMCOR_RAMB_REGION_32_33_BASE_IDX                                                     2
+#define regCM3_CM_HDR_MULT_COEF                                                                         0x1205
+#define regCM3_CM_HDR_MULT_COEF_BASE_IDX                                                                2
+#define regCM3_CM_MEM_PWR_CTRL                                                                          0x1206
+#define regCM3_CM_MEM_PWR_CTRL_BASE_IDX                                                                 2
+#define regCM3_CM_MEM_PWR_STATUS                                                                        0x1207
+#define regCM3_CM_MEM_PWR_STATUS_BASE_IDX                                                               2
+#define regCM3_CM_DEALPHA                                                                               0x1209
+#define regCM3_CM_DEALPHA_BASE_IDX                                                                      2
+#define regCM3_CM_COEF_FORMAT                                                                           0x120a
+#define regCM3_CM_COEF_FORMAT_BASE_IDX                                                                  2
+#define regCM3_CM_TEST_DEBUG_INDEX                                                                      0x120b
+#define regCM3_CM_TEST_DEBUG_INDEX_BASE_IDX                                                             2
+#define regCM3_CM_TEST_DEBUG_DATA                                                                       0x120c
+#define regCM3_CM_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regCM3_CM_HIST_CNTL                                                                             0x120d
+#define regCM3_CM_HIST_CNTL_BASE_IDX                                                                    2
+#define regCM3_CM_HIST_SCALE_SRC1                                                                       0x120e
+#define regCM3_CM_HIST_SCALE_SRC1_BASE_IDX                                                              2
+#define regCM3_CM_HIST_COEFA_SRC2                                                                       0x120f
+#define regCM3_CM_HIST_COEFA_SRC2_BASE_IDX                                                              2
+#define regCM3_CM_HIST_COEFB_SRC2                                                                       0x1210
+#define regCM3_CM_HIST_COEFB_SRC2_BASE_IDX                                                              2
+#define regCM3_CM_HIST_COEFC_SRC2                                                                       0x1211
+#define regCM3_CM_HIST_COEFC_SRC2_BASE_IDX                                                              2
+#define regCM3_CM_HIST_SCALE_SRC3                                                                       0x1212
+#define regCM3_CM_HIST_SCALE_SRC3_BASE_IDX                                                              2
+#define regCM3_CM_HIST_BIAS_SRC1                                                                        0x1213
+#define regCM3_CM_HIST_BIAS_SRC1_BASE_IDX                                                               2
+#define regCM3_CM_HIST_BIAS_SRC2                                                                        0x1214
+#define regCM3_CM_HIST_BIAS_SRC2_BASE_IDX                                                               2
+#define regCM3_CM_HIST_BIAS_SRC3                                                                        0x1215
+#define regCM3_CM_HIST_BIAS_SRC3_BASE_IDX                                                               2
+#define regCM3_CM_HIST_LOCK                                                                             0x1216
+#define regCM3_CM_HIST_LOCK_BASE_IDX                                                                    2
+#define regCM3_CM_HIST_INDEX                                                                            0x1217
+#define regCM3_CM_HIST_INDEX_BASE_IDX                                                                   2
+#define regCM3_CM_HIST_DATA                                                                             0x1218
+#define regCM3_CM_HIST_DATA_BASE_IDX                                                                    2
+#define regCM3_CM_HIST_STATUS                                                                           0x1219
+#define regCM3_CM_HIST_STATUS_BASE_IDX                                                                  2
+#define regCM3_CM_HIST_INT_CONTROL                                                                      0x121a
+#define regCM3_CM_HIST_INT_CONTROL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dpp_top_dispdec
+// base address: 0x1104
+#define regDPP_TOP3_DPP_CONTROL                                                                         0x1106
+#define regDPP_TOP3_DPP_CONTROL_BASE_IDX                                                                2
+#define regDPP_TOP3_DPP_SOFT_RESET                                                                      0x1107
+#define regDPP_TOP3_DPP_SOFT_RESET_BASE_IDX                                                             2
+#define regDPP_TOP3_DPP_CRC_VAL_R                                                                       0x1108
+#define regDPP_TOP3_DPP_CRC_VAL_R_BASE_IDX                                                              2
+#define regDPP_TOP3_DPP_CRC_VAL_G                                                                       0x1109
+#define regDPP_TOP3_DPP_CRC_VAL_G_BASE_IDX                                                              2
+#define regDPP_TOP3_DPP_CRC_VAL_B                                                                       0x110a
+#define regDPP_TOP3_DPP_CRC_VAL_B_BASE_IDX                                                              2
+#define regDPP_TOP3_DPP_CRC_VAL_A                                                                       0x110b
+#define regDPP_TOP3_DPP_CRC_VAL_A_BASE_IDX                                                              2
+#define regDPP_TOP3_DPP_CRC_CTRL                                                                        0x110c
+#define regDPP_TOP3_DPP_CRC_CTRL_BASE_IDX                                                               2
+#define regDPP_TOP3_HOST_READ_CONTROL                                                                   0x110d
+#define regDPP_TOP3_HOST_READ_CONTROL_BASE_IDX                                                          2
+#define regDPP_TOP3_DPP_DEBUG_SEL                                                                       0x110e
+#define regDPP_TOP3_DPP_DEBUG_SEL_BASE_IDX                                                              2
+#define regDPP_TOP3_DPP_DEBUG_SPARE                                                                     0x110f
+#define regDPP_TOP3_DPP_DEBUG_SPARE_BASE_IDX                                                            2
+#define regDPP_TOP3_DPP_TEST_DEBUG_INDEX                                                                0x1110
+#define regDPP_TOP3_DPP_TEST_DEBUG_INDEX_BASE_IDX                                                       2
+#define regDPP_TOP3_DPP_TEST_DEBUG_DATA                                                                 0x1111
+#define regDPP_TOP3_DPP_TEST_DEBUG_DATA_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x4994
+#define regDC_PERFMON13_PERFCOUNTER_CNTL                                                                0x1265
+#define regDC_PERFMON13_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON13_PERFCOUNTER_CNTL2                                                               0x1266
+#define regDC_PERFMON13_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON13_PERFCOUNTER_STATE                                                               0x1267
+#define regDC_PERFMON13_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON13_PERFMON_CNTL                                                                    0x1268
+#define regDC_PERFMON13_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON13_PERFMON_CNTL2                                                                   0x1269
+#define regDC_PERFMON13_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON13_PERFMON_CVALUE_INT_MISC                                                         0x126a
+#define regDC_PERFMON13_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON13_PERFMON_CVALUE_LOW                                                              0x126b
+#define regDC_PERFMON13_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON13_PERFMON_HI                                                                      0x126c
+#define regDC_PERFMON13_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON13_PERFMON_LOW                                                                     0x126d
+#define regDC_PERFMON13_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON13_PERFMON_TEST_DEBUG_INDEX                                                        0x126e
+#define regDC_PERFMON13_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON13_PERFMON_TEST_DEBUG_DATA                                                         0x126f
+#define regDC_PERFMON13_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_mpc_mpcc0_dispdec
+// base address: 0x0
+#define regMPCC0_MPCC_TOP_SEL                                                                           0x0000
+#define regMPCC0_MPCC_TOP_SEL_BASE_IDX                                                                  3
+#define regMPCC0_MPCC_BOT_SEL                                                                           0x0001
+#define regMPCC0_MPCC_BOT_SEL_BASE_IDX                                                                  3
+#define regMPCC0_MPCC_OPP_ID                                                                            0x0002
+#define regMPCC0_MPCC_OPP_ID_BASE_IDX                                                                   3
+#define regMPCC0_MPCC_CONTROL                                                                           0x0003
+#define regMPCC0_MPCC_CONTROL_BASE_IDX                                                                  3
+#define regMPCC0_MPCC_CONTROL2                                                                          0x0004
+#define regMPCC0_MPCC_CONTROL2_BASE_IDX                                                                 3
+#define regMPCC0_MPCC_SM_CONTROL                                                                        0x0005
+#define regMPCC0_MPCC_SM_CONTROL_BASE_IDX                                                               3
+#define regMPCC0_MPCC_UPDATE_LOCK_SEL                                                                   0x0006
+#define regMPCC0_MPCC_UPDATE_LOCK_SEL_BASE_IDX                                                          3
+#define regMPCC0_MPCC_TOP_GAIN                                                                          0x0007
+#define regMPCC0_MPCC_TOP_GAIN_BASE_IDX                                                                 3
+#define regMPCC0_MPCC_BOT_GAIN_INSIDE                                                                   0x0008
+#define regMPCC0_MPCC_BOT_GAIN_INSIDE_BASE_IDX                                                          3
+#define regMPCC0_MPCC_BOT_GAIN_OUTSIDE                                                                  0x0009
+#define regMPCC0_MPCC_BOT_GAIN_OUTSIDE_BASE_IDX                                                         3
+#define regMPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL                                                       0x000a
+#define regMPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL_BASE_IDX                                              3
+#define regMPCC0_MPCC_BG_R_CR                                                                           0x000b
+#define regMPCC0_MPCC_BG_R_CR_BASE_IDX                                                                  3
+#define regMPCC0_MPCC_BG_G_Y                                                                            0x000c
+#define regMPCC0_MPCC_BG_G_Y_BASE_IDX                                                                   3
+#define regMPCC0_MPCC_BG_B_CB                                                                           0x000d
+#define regMPCC0_MPCC_BG_B_CB_BASE_IDX                                                                  3
+#define regMPCC0_MPCC_MEM_PWR_CTRL                                                                      0x000e
+#define regMPCC0_MPCC_MEM_PWR_CTRL_BASE_IDX                                                             3
+#define regMPCC0_MPCC_STATUS                                                                            0x000f
+#define regMPCC0_MPCC_STATUS_BASE_IDX                                                                   3
+#define regMPCC0_MPCC_REG_UPDATE_STATUS                                                                 0x0011
+#define regMPCC0_MPCC_REG_UPDATE_STATUS_BASE_IDX                                                        3
+#define regMPCC0_MPCC_TEST_DEBUG_INDEX                                                                  0x0013
+#define regMPCC0_MPCC_TEST_DEBUG_INDEX_BASE_IDX                                                         3
+#define regMPCC0_MPCC_TEST_DEBUG_DATA                                                                   0x0014
+#define regMPCC0_MPCC_TEST_DEBUG_DATA_BASE_IDX                                                          3
+
+
+// addressBlock: dce_dc_mpc_mpcc1_dispdec
+// base address: 0x54
+#define regMPCC1_MPCC_TOP_SEL                                                                           0x0015
+#define regMPCC1_MPCC_TOP_SEL_BASE_IDX                                                                  3
+#define regMPCC1_MPCC_BOT_SEL                                                                           0x0016
+#define regMPCC1_MPCC_BOT_SEL_BASE_IDX                                                                  3
+#define regMPCC1_MPCC_OPP_ID                                                                            0x0017
+#define regMPCC1_MPCC_OPP_ID_BASE_IDX                                                                   3
+#define regMPCC1_MPCC_CONTROL                                                                           0x0018
+#define regMPCC1_MPCC_CONTROL_BASE_IDX                                                                  3
+#define regMPCC1_MPCC_CONTROL2                                                                          0x0019
+#define regMPCC1_MPCC_CONTROL2_BASE_IDX                                                                 3
+#define regMPCC1_MPCC_SM_CONTROL                                                                        0x001a
+#define regMPCC1_MPCC_SM_CONTROL_BASE_IDX                                                               3
+#define regMPCC1_MPCC_UPDATE_LOCK_SEL                                                                   0x001b
+#define regMPCC1_MPCC_UPDATE_LOCK_SEL_BASE_IDX                                                          3
+#define regMPCC1_MPCC_TOP_GAIN                                                                          0x001c
+#define regMPCC1_MPCC_TOP_GAIN_BASE_IDX                                                                 3
+#define regMPCC1_MPCC_BOT_GAIN_INSIDE                                                                   0x001d
+#define regMPCC1_MPCC_BOT_GAIN_INSIDE_BASE_IDX                                                          3
+#define regMPCC1_MPCC_BOT_GAIN_OUTSIDE                                                                  0x001e
+#define regMPCC1_MPCC_BOT_GAIN_OUTSIDE_BASE_IDX                                                         3
+#define regMPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL                                                       0x001f
+#define regMPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL_BASE_IDX                                              3
+#define regMPCC1_MPCC_BG_R_CR                                                                           0x0020
+#define regMPCC1_MPCC_BG_R_CR_BASE_IDX                                                                  3
+#define regMPCC1_MPCC_BG_G_Y                                                                            0x0021
+#define regMPCC1_MPCC_BG_G_Y_BASE_IDX                                                                   3
+#define regMPCC1_MPCC_BG_B_CB                                                                           0x0022
+#define regMPCC1_MPCC_BG_B_CB_BASE_IDX                                                                  3
+#define regMPCC1_MPCC_MEM_PWR_CTRL                                                                      0x0023
+#define regMPCC1_MPCC_MEM_PWR_CTRL_BASE_IDX                                                             3
+#define regMPCC1_MPCC_STATUS                                                                            0x0024
+#define regMPCC1_MPCC_STATUS_BASE_IDX                                                                   3
+#define regMPCC1_MPCC_REG_UPDATE_STATUS                                                                 0x0026
+#define regMPCC1_MPCC_REG_UPDATE_STATUS_BASE_IDX                                                        3
+#define regMPCC1_MPCC_TEST_DEBUG_INDEX                                                                  0x0028
+#define regMPCC1_MPCC_TEST_DEBUG_INDEX_BASE_IDX                                                         3
+#define regMPCC1_MPCC_TEST_DEBUG_DATA                                                                   0x0029
+#define regMPCC1_MPCC_TEST_DEBUG_DATA_BASE_IDX                                                          3
+
+
+// addressBlock: dce_dc_mpc_mpcc2_dispdec
+// base address: 0xa8
+#define regMPCC2_MPCC_TOP_SEL                                                                           0x002a
+#define regMPCC2_MPCC_TOP_SEL_BASE_IDX                                                                  3
+#define regMPCC2_MPCC_BOT_SEL                                                                           0x002b
+#define regMPCC2_MPCC_BOT_SEL_BASE_IDX                                                                  3
+#define regMPCC2_MPCC_OPP_ID                                                                            0x002c
+#define regMPCC2_MPCC_OPP_ID_BASE_IDX                                                                   3
+#define regMPCC2_MPCC_CONTROL                                                                           0x002d
+#define regMPCC2_MPCC_CONTROL_BASE_IDX                                                                  3
+#define regMPCC2_MPCC_CONTROL2                                                                          0x002e
+#define regMPCC2_MPCC_CONTROL2_BASE_IDX                                                                 3
+#define regMPCC2_MPCC_SM_CONTROL                                                                        0x002f
+#define regMPCC2_MPCC_SM_CONTROL_BASE_IDX                                                               3
+#define regMPCC2_MPCC_UPDATE_LOCK_SEL                                                                   0x0030
+#define regMPCC2_MPCC_UPDATE_LOCK_SEL_BASE_IDX                                                          3
+#define regMPCC2_MPCC_TOP_GAIN                                                                          0x0031
+#define regMPCC2_MPCC_TOP_GAIN_BASE_IDX                                                                 3
+#define regMPCC2_MPCC_BOT_GAIN_INSIDE                                                                   0x0032
+#define regMPCC2_MPCC_BOT_GAIN_INSIDE_BASE_IDX                                                          3
+#define regMPCC2_MPCC_BOT_GAIN_OUTSIDE                                                                  0x0033
+#define regMPCC2_MPCC_BOT_GAIN_OUTSIDE_BASE_IDX                                                         3
+#define regMPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL                                                       0x0034
+#define regMPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL_BASE_IDX                                              3
+#define regMPCC2_MPCC_BG_R_CR                                                                           0x0035
+#define regMPCC2_MPCC_BG_R_CR_BASE_IDX                                                                  3
+#define regMPCC2_MPCC_BG_G_Y                                                                            0x0036
+#define regMPCC2_MPCC_BG_G_Y_BASE_IDX                                                                   3
+#define regMPCC2_MPCC_BG_B_CB                                                                           0x0037
+#define regMPCC2_MPCC_BG_B_CB_BASE_IDX                                                                  3
+#define regMPCC2_MPCC_MEM_PWR_CTRL                                                                      0x0038
+#define regMPCC2_MPCC_MEM_PWR_CTRL_BASE_IDX                                                             3
+#define regMPCC2_MPCC_STATUS                                                                            0x0039
+#define regMPCC2_MPCC_STATUS_BASE_IDX                                                                   3
+#define regMPCC2_MPCC_REG_UPDATE_STATUS                                                                 0x003b
+#define regMPCC2_MPCC_REG_UPDATE_STATUS_BASE_IDX                                                        3
+#define regMPCC2_MPCC_TEST_DEBUG_INDEX                                                                  0x003d
+#define regMPCC2_MPCC_TEST_DEBUG_INDEX_BASE_IDX                                                         3
+#define regMPCC2_MPCC_TEST_DEBUG_DATA                                                                   0x003e
+#define regMPCC2_MPCC_TEST_DEBUG_DATA_BASE_IDX                                                          3
+
+
+// addressBlock: dce_dc_mpc_mpcc3_dispdec
+// base address: 0xfc
+#define regMPCC3_MPCC_TOP_SEL                                                                           0x003f
+#define regMPCC3_MPCC_TOP_SEL_BASE_IDX                                                                  3
+#define regMPCC3_MPCC_BOT_SEL                                                                           0x0040
+#define regMPCC3_MPCC_BOT_SEL_BASE_IDX                                                                  3
+#define regMPCC3_MPCC_OPP_ID                                                                            0x0041
+#define regMPCC3_MPCC_OPP_ID_BASE_IDX                                                                   3
+#define regMPCC3_MPCC_CONTROL                                                                           0x0042
+#define regMPCC3_MPCC_CONTROL_BASE_IDX                                                                  3
+#define regMPCC3_MPCC_CONTROL2                                                                          0x0043
+#define regMPCC3_MPCC_CONTROL2_BASE_IDX                                                                 3
+#define regMPCC3_MPCC_SM_CONTROL                                                                        0x0044
+#define regMPCC3_MPCC_SM_CONTROL_BASE_IDX                                                               3
+#define regMPCC3_MPCC_UPDATE_LOCK_SEL                                                                   0x0045
+#define regMPCC3_MPCC_UPDATE_LOCK_SEL_BASE_IDX                                                          3
+#define regMPCC3_MPCC_TOP_GAIN                                                                          0x0046
+#define regMPCC3_MPCC_TOP_GAIN_BASE_IDX                                                                 3
+#define regMPCC3_MPCC_BOT_GAIN_INSIDE                                                                   0x0047
+#define regMPCC3_MPCC_BOT_GAIN_INSIDE_BASE_IDX                                                          3
+#define regMPCC3_MPCC_BOT_GAIN_OUTSIDE                                                                  0x0048
+#define regMPCC3_MPCC_BOT_GAIN_OUTSIDE_BASE_IDX                                                         3
+#define regMPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL                                                       0x0049
+#define regMPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL_BASE_IDX                                              3
+#define regMPCC3_MPCC_BG_R_CR                                                                           0x004a
+#define regMPCC3_MPCC_BG_R_CR_BASE_IDX                                                                  3
+#define regMPCC3_MPCC_BG_G_Y                                                                            0x004b
+#define regMPCC3_MPCC_BG_G_Y_BASE_IDX                                                                   3
+#define regMPCC3_MPCC_BG_B_CB                                                                           0x004c
+#define regMPCC3_MPCC_BG_B_CB_BASE_IDX                                                                  3
+#define regMPCC3_MPCC_MEM_PWR_CTRL                                                                      0x004d
+#define regMPCC3_MPCC_MEM_PWR_CTRL_BASE_IDX                                                             3
+#define regMPCC3_MPCC_STATUS                                                                            0x004e
+#define regMPCC3_MPCC_STATUS_BASE_IDX                                                                   3
+#define regMPCC3_MPCC_REG_UPDATE_STATUS                                                                 0x0050
+#define regMPCC3_MPCC_REG_UPDATE_STATUS_BASE_IDX                                                        3
+#define regMPCC3_MPCC_TEST_DEBUG_INDEX                                                                  0x0052
+#define regMPCC3_MPCC_TEST_DEBUG_INDEX_BASE_IDX                                                         3
+#define regMPCC3_MPCC_TEST_DEBUG_DATA                                                                   0x0053
+#define regMPCC3_MPCC_TEST_DEBUG_DATA_BASE_IDX                                                          3
+
+
+// addressBlock: dce_dc_mpc_mpc_cfg_dispdec
+// base address: 0x0
+#define regMPC_CLOCK_CONTROL                                                                            0x0873
+#define regMPC_CLOCK_CONTROL_BASE_IDX                                                                   3
+#define regMPC_SOFT_RESET                                                                               0x0874
+#define regMPC_SOFT_RESET_BASE_IDX                                                                      3
+#define regMPC_CRC_CTRL                                                                                 0x0875
+#define regMPC_CRC_CTRL_BASE_IDX                                                                        3
+#define regMPC_CRC_SEL_CONTROL                                                                          0x0876
+#define regMPC_CRC_SEL_CONTROL_BASE_IDX                                                                 3
+#define regMPC_CRC_RESULT_A                                                                             0x0877
+#define regMPC_CRC_RESULT_A_BASE_IDX                                                                    3
+#define regMPC_CRC_RESULT_R                                                                             0x0878
+#define regMPC_CRC_RESULT_R_BASE_IDX                                                                    3
+#define regMPC_CRC_RESULT_G                                                                             0x0879
+#define regMPC_CRC_RESULT_G_BASE_IDX                                                                    3
+#define regMPC_CRC_RESULT_B                                                                             0x087a
+#define regMPC_CRC_RESULT_B_BASE_IDX                                                                    3
+#define regMPC_DEBUG_CONTROL                                                                            0x087b
+#define regMPC_DEBUG_CONTROL_BASE_IDX                                                                   3
+#define regMPCC_DEBUG_DATA_SELECT                                                                       0x087c
+#define regMPCC_DEBUG_DATA_SELECT_BASE_IDX                                                              3
+#define regMPC_PERFMON_EVENT_CTRL                                                                       0x087d
+#define regMPC_PERFMON_EVENT_CTRL_BASE_IDX                                                              3
+#define regMPC_BYPASS_BG_AR                                                                             0x087e
+#define regMPC_BYPASS_BG_AR_BASE_IDX                                                                    3
+#define regMPC_BYPASS_BG_GB                                                                             0x087f
+#define regMPC_BYPASS_BG_GB_BASE_IDX                                                                    3
+#define regMPC_HOST_READ_CONTROL                                                                        0x0880
+#define regMPC_HOST_READ_CONTROL_BASE_IDX                                                               3
+#define regMPC_DPP_PENDING_STATUS                                                                       0x0881
+#define regMPC_DPP_PENDING_STATUS_BASE_IDX                                                              3
+#define regMPC_PENDING_STATUS_MISC                                                                      0x0883
+#define regMPC_PENDING_STATUS_MISC_BASE_IDX                                                             3
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET0                                                                0x0886
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET0_BASE_IDX                                                       3
+#define regADR_CFG_VUPDATE_LOCK_SET0                                                                    0x0887
+#define regADR_CFG_VUPDATE_LOCK_SET0_BASE_IDX                                                           3
+#define regADR_VUPDATE_LOCK_SET0                                                                        0x0888
+#define regADR_VUPDATE_LOCK_SET0_BASE_IDX                                                               3
+#define regCFG_VUPDATE_LOCK_SET0                                                                        0x0889
+#define regCFG_VUPDATE_LOCK_SET0_BASE_IDX                                                               3
+#define regCUR_VUPDATE_LOCK_SET0                                                                        0x088a
+#define regCUR_VUPDATE_LOCK_SET0_BASE_IDX                                                               3
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET1                                                                0x088b
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET1_BASE_IDX                                                       3
+#define regADR_CFG_VUPDATE_LOCK_SET1                                                                    0x088c
+#define regADR_CFG_VUPDATE_LOCK_SET1_BASE_IDX                                                           3
+#define regADR_VUPDATE_LOCK_SET1                                                                        0x088d
+#define regADR_VUPDATE_LOCK_SET1_BASE_IDX                                                               3
+#define regCFG_VUPDATE_LOCK_SET1                                                                        0x088e
+#define regCFG_VUPDATE_LOCK_SET1_BASE_IDX                                                               3
+#define regCUR_VUPDATE_LOCK_SET1                                                                        0x088f
+#define regCUR_VUPDATE_LOCK_SET1_BASE_IDX                                                               3
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET2                                                                0x0890
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET2_BASE_IDX                                                       3
+#define regADR_CFG_VUPDATE_LOCK_SET2                                                                    0x0891
+#define regADR_CFG_VUPDATE_LOCK_SET2_BASE_IDX                                                           3
+#define regADR_VUPDATE_LOCK_SET2                                                                        0x0892
+#define regADR_VUPDATE_LOCK_SET2_BASE_IDX                                                               3
+#define regCFG_VUPDATE_LOCK_SET2                                                                        0x0893
+#define regCFG_VUPDATE_LOCK_SET2_BASE_IDX                                                               3
+#define regCUR_VUPDATE_LOCK_SET2                                                                        0x0894
+#define regCUR_VUPDATE_LOCK_SET2_BASE_IDX                                                               3
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET3                                                                0x0895
+#define regADR_CFG_CUR_VUPDATE_LOCK_SET3_BASE_IDX                                                       3
+#define regADR_CFG_VUPDATE_LOCK_SET3                                                                    0x0896
+#define regADR_CFG_VUPDATE_LOCK_SET3_BASE_IDX                                                           3
+#define regADR_VUPDATE_LOCK_SET3                                                                        0x0897
+#define regADR_VUPDATE_LOCK_SET3_BASE_IDX                                                               3
+#define regCFG_VUPDATE_LOCK_SET3                                                                        0x0898
+#define regCFG_VUPDATE_LOCK_SET3_BASE_IDX                                                               3
+#define regCUR_VUPDATE_LOCK_SET3                                                                        0x0899
+#define regCUR_VUPDATE_LOCK_SET3_BASE_IDX                                                               3
+#define regHUBP0_3DLUT_FL_CONFIG                                                                        0x089a
+#define regHUBP0_3DLUT_FL_CONFIG_BASE_IDX                                                               3
+#define regHUBP0_3DLUT_FL_BIAS_SCALE                                                                    0x089b
+#define regHUBP0_3DLUT_FL_BIAS_SCALE_BASE_IDX                                                           3
+#define regHUBP1_3DLUT_FL_CONFIG                                                                        0x089c
+#define regHUBP1_3DLUT_FL_CONFIG_BASE_IDX                                                               3
+#define regHUBP1_3DLUT_FL_BIAS_SCALE                                                                    0x089d
+#define regHUBP1_3DLUT_FL_BIAS_SCALE_BASE_IDX                                                           3
+#define regHUBP2_3DLUT_FL_CONFIG                                                                        0x089e
+#define regHUBP2_3DLUT_FL_CONFIG_BASE_IDX                                                               3
+#define regHUBP2_3DLUT_FL_BIAS_SCALE                                                                    0x089f
+#define regHUBP2_3DLUT_FL_BIAS_SCALE_BASE_IDX                                                           3
+#define regHUBP3_3DLUT_FL_CONFIG                                                                        0x08a0
+#define regHUBP3_3DLUT_FL_CONFIG_BASE_IDX                                                               3
+#define regHUBP3_3DLUT_FL_BIAS_SCALE                                                                    0x08a1
+#define regHUBP3_3DLUT_FL_BIAS_SCALE_BASE_IDX                                                           3
+#define regMPC_CFG_REG_UPDATE_STATUS                                                                    0x08b1
+#define regMPC_CFG_REG_UPDATE_STATUS_BASE_IDX                                                           3
+#define regMPC_TMZID_MAP                                                                                0x08b4
+#define regMPC_TMZID_MAP_BASE_IDX                                                                       3
+#define regMPC_CFG_TEST_DEBUG_INDEX                                                                     0x08c1
+#define regMPC_CFG_TEST_DEBUG_INDEX_BASE_IDX                                                            3
+#define regMPC_CFG_TEST_DEBUG_DATA                                                                      0x08c2
+#define regMPC_CFG_TEST_DEBUG_DATA_BASE_IDX                                                             3
+
+
+// addressBlock: dce_dc_mpc_mpc_dcperfmon_dc_perfmon_dispdec
+// base address: 0x17e1c
+#define regDC_PERFMON14_PERFCOUNTER_CNTL                                                                0x0447
+#define regDC_PERFMON14_PERFCOUNTER_CNTL_BASE_IDX                                                       3
+#define regDC_PERFMON14_PERFCOUNTER_CNTL2                                                               0x0448
+#define regDC_PERFMON14_PERFCOUNTER_CNTL2_BASE_IDX                                                      3
+#define regDC_PERFMON14_PERFCOUNTER_STATE                                                               0x0449
+#define regDC_PERFMON14_PERFCOUNTER_STATE_BASE_IDX                                                      3
+#define regDC_PERFMON14_PERFMON_CNTL                                                                    0x044a
+#define regDC_PERFMON14_PERFMON_CNTL_BASE_IDX                                                           3
+#define regDC_PERFMON14_PERFMON_CNTL2                                                                   0x044b
+#define regDC_PERFMON14_PERFMON_CNTL2_BASE_IDX                                                          3
+#define regDC_PERFMON14_PERFMON_CVALUE_INT_MISC                                                         0x044c
+#define regDC_PERFMON14_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                3
+#define regDC_PERFMON14_PERFMON_CVALUE_LOW                                                              0x044d
+#define regDC_PERFMON14_PERFMON_CVALUE_LOW_BASE_IDX                                                     3
+#define regDC_PERFMON14_PERFMON_HI                                                                      0x044e
+#define regDC_PERFMON14_PERFMON_HI_BASE_IDX                                                             3
+#define regDC_PERFMON14_PERFMON_LOW                                                                     0x044f
+#define regDC_PERFMON14_PERFMON_LOW_BASE_IDX                                                            3
+#define regDC_PERFMON14_PERFMON_TEST_DEBUG_INDEX                                                        0x0450
+#define regDC_PERFMON14_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regDC_PERFMON14_PERFMON_TEST_DEBUG_DATA                                                         0x0451
+#define regDC_PERFMON14_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam0_dispdec
+// base address: 0x0
+#define regMPCC_OGAM0_MPCC_OGAM_CONTROL                                                                 0x007e
+#define regMPCC_OGAM0_MPCC_OGAM_CONTROL_BASE_IDX                                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_INDEX                                                               0x007f
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_DATA                                                                0x0080
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_DATA_BASE_IDX                                                       3
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_CONTROL                                                             0x0081
+#define regMPCC_OGAM0_MPCC_OGAM_LUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B                                                       0x0082
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G                                                       0x0083
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R                                                       0x0084
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B                                                 0x0085
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G                                                 0x0086
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R                                                 0x0087
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_B                                                  0x0088
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_G                                                  0x0089
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_R                                                  0x008a
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_B                                                        0x008b
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B                                                        0x008c
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_G                                                        0x008d
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G                                                        0x008e
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_R                                                        0x008f
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R                                                        0x0090
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_B                                                           0x0091
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_G                                                           0x0092
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_R                                                           0x0093
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1                                                         0x0094
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3                                                         0x0095
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5                                                         0x0096
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7                                                         0x0097
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9                                                         0x0098
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11                                                       0x0099
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13                                                       0x009a
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15                                                       0x009b
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17                                                       0x009c
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19                                                       0x009d
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21                                                       0x009e
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23                                                       0x009f
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25                                                       0x00a0
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27                                                       0x00a1
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29                                                       0x00a2
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31                                                       0x00a3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33                                                       0x00a4
+#define regMPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B                                                       0x00a5
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G                                                       0x00a6
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R                                                       0x00a7
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B                                                 0x00a8
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G                                                 0x00a9
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R                                                 0x00aa
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_B                                                  0x00ab
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_G                                                  0x00ac
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_R                                                  0x00ad
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_B                                                        0x00ae
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B                                                        0x00af
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_G                                                        0x00b0
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G                                                        0x00b1
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_R                                                        0x00b2
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R                                                        0x00b3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_B                                                           0x00b4
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_G                                                           0x00b5
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_R                                                           0x00b6
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1                                                         0x00b7
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3                                                         0x00b8
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5                                                         0x00b9
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7                                                         0x00ba
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9                                                         0x00bb
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11                                                       0x00bc
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13                                                       0x00bd
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15                                                       0x00be
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17                                                       0x00bf
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19                                                       0x00c0
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21                                                       0x00c1
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23                                                       0x00c2
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25                                                       0x00c3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27                                                       0x00c4
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29                                                       0x00c5
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31                                                       0x00c6
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33                                                       0x00c7
+#define regMPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_GAMUT_REMAP_COEF_FORMAT                                                      0x00c8
+#define regMPCC_OGAM0_MPCC_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                             3
+#define regMPCC_OGAM0_MPCC_GAMUT_REMAP_MODE                                                             0x00c9
+#define regMPCC_OGAM0_MPCC_GAMUT_REMAP_MODE_BASE_IDX                                                    3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A                                                         0x00ca
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A                                                         0x00cb
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A                                                         0x00cc
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A                                                         0x00cd
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A                                                         0x00ce
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A                                                         0x00cf
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B                                                         0x00d0
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B                                                         0x00d1
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B                                                         0x00d2
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B                                                         0x00d3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B                                                         0x00d4
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B                                                         0x00d5
+#define regMPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B_BASE_IDX                                                3
+#define regMPCC_OGAM0_MPCC_OGAM_REG_UPDATE_STATUS                                                       0x00d6
+#define regMPCC_OGAM0_MPCC_OGAM_REG_UPDATE_STATUS_BASE_IDX                                              3
+#define regMPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX                                                        0x00d8
+#define regMPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regMPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_DATA                                                         0x00d9
+#define regMPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam1_dispdec
+// base address: 0x178
+#define regMPCC_OGAM1_MPCC_OGAM_CONTROL                                                                 0x00dc
+#define regMPCC_OGAM1_MPCC_OGAM_CONTROL_BASE_IDX                                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_INDEX                                                               0x00dd
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_DATA                                                                0x00de
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_DATA_BASE_IDX                                                       3
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_CONTROL                                                             0x00df
+#define regMPCC_OGAM1_MPCC_OGAM_LUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B                                                       0x00e0
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G                                                       0x00e1
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R                                                       0x00e2
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B                                                 0x00e3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G                                                 0x00e4
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R                                                 0x00e5
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_B                                                  0x00e6
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_G                                                  0x00e7
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_R                                                  0x00e8
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_B                                                        0x00e9
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B                                                        0x00ea
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_G                                                        0x00eb
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G                                                        0x00ec
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_R                                                        0x00ed
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R                                                        0x00ee
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_B                                                           0x00ef
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_G                                                           0x00f0
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_R                                                           0x00f1
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1                                                         0x00f2
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3                                                         0x00f3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5                                                         0x00f4
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7                                                         0x00f5
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9                                                         0x00f6
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11                                                       0x00f7
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13                                                       0x00f8
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15                                                       0x00f9
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17                                                       0x00fa
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19                                                       0x00fb
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21                                                       0x00fc
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23                                                       0x00fd
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25                                                       0x00fe
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27                                                       0x00ff
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29                                                       0x0100
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31                                                       0x0101
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33                                                       0x0102
+#define regMPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B                                                       0x0103
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G                                                       0x0104
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R                                                       0x0105
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B                                                 0x0106
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G                                                 0x0107
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R                                                 0x0108
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_B                                                  0x0109
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_G                                                  0x010a
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_R                                                  0x010b
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_B                                                        0x010c
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B                                                        0x010d
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_G                                                        0x010e
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G                                                        0x010f
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_R                                                        0x0110
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R                                                        0x0111
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_B                                                           0x0112
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_G                                                           0x0113
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_R                                                           0x0114
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1                                                         0x0115
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3                                                         0x0116
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5                                                         0x0117
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7                                                         0x0118
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9                                                         0x0119
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11                                                       0x011a
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13                                                       0x011b
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15                                                       0x011c
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17                                                       0x011d
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19                                                       0x011e
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21                                                       0x011f
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23                                                       0x0120
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25                                                       0x0121
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27                                                       0x0122
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29                                                       0x0123
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31                                                       0x0124
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33                                                       0x0125
+#define regMPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_GAMUT_REMAP_COEF_FORMAT                                                      0x0126
+#define regMPCC_OGAM1_MPCC_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                             3
+#define regMPCC_OGAM1_MPCC_GAMUT_REMAP_MODE                                                             0x0127
+#define regMPCC_OGAM1_MPCC_GAMUT_REMAP_MODE_BASE_IDX                                                    3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A                                                         0x0128
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A                                                         0x0129
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A                                                         0x012a
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A                                                         0x012b
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A                                                         0x012c
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A                                                         0x012d
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B                                                         0x012e
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B                                                         0x012f
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B                                                         0x0130
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B                                                         0x0131
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B                                                         0x0132
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B                                                         0x0133
+#define regMPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B_BASE_IDX                                                3
+#define regMPCC_OGAM1_MPCC_OGAM_REG_UPDATE_STATUS                                                       0x0134
+#define regMPCC_OGAM1_MPCC_OGAM_REG_UPDATE_STATUS_BASE_IDX                                              3
+#define regMPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX                                                        0x0136
+#define regMPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regMPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_DATA                                                         0x0137
+#define regMPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam2_dispdec
+// base address: 0x2f0
+#define regMPCC_OGAM2_MPCC_OGAM_CONTROL                                                                 0x013a
+#define regMPCC_OGAM2_MPCC_OGAM_CONTROL_BASE_IDX                                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_INDEX                                                               0x013b
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_DATA                                                                0x013c
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_DATA_BASE_IDX                                                       3
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_CONTROL                                                             0x013d
+#define regMPCC_OGAM2_MPCC_OGAM_LUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B                                                       0x013e
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G                                                       0x013f
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R                                                       0x0140
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B                                                 0x0141
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G                                                 0x0142
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R                                                 0x0143
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_B                                                  0x0144
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_G                                                  0x0145
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_R                                                  0x0146
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_B                                                        0x0147
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B                                                        0x0148
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_G                                                        0x0149
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G                                                        0x014a
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_R                                                        0x014b
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R                                                        0x014c
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_B                                                           0x014d
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_G                                                           0x014e
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_R                                                           0x014f
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1                                                         0x0150
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3                                                         0x0151
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5                                                         0x0152
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7                                                         0x0153
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9                                                         0x0154
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11                                                       0x0155
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13                                                       0x0156
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15                                                       0x0157
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17                                                       0x0158
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19                                                       0x0159
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21                                                       0x015a
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23                                                       0x015b
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25                                                       0x015c
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27                                                       0x015d
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29                                                       0x015e
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31                                                       0x015f
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33                                                       0x0160
+#define regMPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B                                                       0x0161
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G                                                       0x0162
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R                                                       0x0163
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B                                                 0x0164
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G                                                 0x0165
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R                                                 0x0166
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_B                                                  0x0167
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_G                                                  0x0168
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_R                                                  0x0169
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_B                                                        0x016a
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B                                                        0x016b
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_G                                                        0x016c
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G                                                        0x016d
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_R                                                        0x016e
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R                                                        0x016f
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_B                                                           0x0170
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_G                                                           0x0171
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_R                                                           0x0172
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1                                                         0x0173
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3                                                         0x0174
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5                                                         0x0175
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7                                                         0x0176
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9                                                         0x0177
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11                                                       0x0178
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13                                                       0x0179
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15                                                       0x017a
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17                                                       0x017b
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19                                                       0x017c
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21                                                       0x017d
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23                                                       0x017e
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25                                                       0x017f
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27                                                       0x0180
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29                                                       0x0181
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31                                                       0x0182
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33                                                       0x0183
+#define regMPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_GAMUT_REMAP_COEF_FORMAT                                                      0x0184
+#define regMPCC_OGAM2_MPCC_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                             3
+#define regMPCC_OGAM2_MPCC_GAMUT_REMAP_MODE                                                             0x0185
+#define regMPCC_OGAM2_MPCC_GAMUT_REMAP_MODE_BASE_IDX                                                    3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A                                                         0x0186
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A                                                         0x0187
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A                                                         0x0188
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A                                                         0x0189
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A                                                         0x018a
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A                                                         0x018b
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B                                                         0x018c
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B                                                         0x018d
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B                                                         0x018e
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B                                                         0x018f
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B                                                         0x0190
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B                                                         0x0191
+#define regMPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B_BASE_IDX                                                3
+#define regMPCC_OGAM2_MPCC_OGAM_REG_UPDATE_STATUS                                                       0x0192
+#define regMPCC_OGAM2_MPCC_OGAM_REG_UPDATE_STATUS_BASE_IDX                                              3
+#define regMPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX                                                        0x0194
+#define regMPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regMPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_DATA                                                         0x0195
+#define regMPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam3_dispdec
+// base address: 0x468
+#define regMPCC_OGAM3_MPCC_OGAM_CONTROL                                                                 0x0198
+#define regMPCC_OGAM3_MPCC_OGAM_CONTROL_BASE_IDX                                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_INDEX                                                               0x0199
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_DATA                                                                0x019a
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_DATA_BASE_IDX                                                       3
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_CONTROL                                                             0x019b
+#define regMPCC_OGAM3_MPCC_OGAM_LUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B                                                       0x019c
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G                                                       0x019d
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R                                                       0x019e
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B                                                 0x019f
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G                                                 0x01a0
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R                                                 0x01a1
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_B                                                  0x01a2
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_G                                                  0x01a3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_R                                                  0x01a4
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_B                                                        0x01a5
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B                                                        0x01a6
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_G                                                        0x01a7
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G                                                        0x01a8
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_R                                                        0x01a9
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R                                                        0x01aa
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_B                                                           0x01ab
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_G                                                           0x01ac
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_R                                                           0x01ad
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1                                                         0x01ae
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3                                                         0x01af
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5                                                         0x01b0
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7                                                         0x01b1
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9                                                         0x01b2
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11                                                       0x01b3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13                                                       0x01b4
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15                                                       0x01b5
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17                                                       0x01b6
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19                                                       0x01b7
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21                                                       0x01b8
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23                                                       0x01b9
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25                                                       0x01ba
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27                                                       0x01bb
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29                                                       0x01bc
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31                                                       0x01bd
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33                                                       0x01be
+#define regMPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B                                                       0x01bf
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G                                                       0x01c0
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R                                                       0x01c1
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B                                                 0x01c2
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G                                                 0x01c3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R                                                 0x01c4
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                        3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_B                                                  0x01c5
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_B_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_G                                                  0x01c6
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_G_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_R                                                  0x01c7
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_R_BASE_IDX                                         3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_B                                                        0x01c8
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_B_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B                                                        0x01c9
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_G                                                        0x01ca
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_G_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G                                                        0x01cb
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_R                                                        0x01cc
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_R_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R                                                        0x01cd
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_B                                                           0x01ce
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_G                                                           0x01cf
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_R                                                           0x01d0
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1                                                         0x01d1
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3                                                         0x01d2
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5                                                         0x01d3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7                                                         0x01d4
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9                                                         0x01d5
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11                                                       0x01d6
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13                                                       0x01d7
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15                                                       0x01d8
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17                                                       0x01d9
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19                                                       0x01da
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21                                                       0x01db
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23                                                       0x01dc
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25                                                       0x01dd
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27                                                       0x01de
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29                                                       0x01df
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31                                                       0x01e0
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33                                                       0x01e1
+#define regMPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_GAMUT_REMAP_COEF_FORMAT                                                      0x01e2
+#define regMPCC_OGAM3_MPCC_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                             3
+#define regMPCC_OGAM3_MPCC_GAMUT_REMAP_MODE                                                             0x01e3
+#define regMPCC_OGAM3_MPCC_GAMUT_REMAP_MODE_BASE_IDX                                                    3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A                                                         0x01e4
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A                                                         0x01e5
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A                                                         0x01e6
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A                                                         0x01e7
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A                                                         0x01e8
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A                                                         0x01e9
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B                                                         0x01ea
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B                                                         0x01eb
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B                                                         0x01ec
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B                                                         0x01ed
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B                                                         0x01ee
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B                                                         0x01ef
+#define regMPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B_BASE_IDX                                                3
+#define regMPCC_OGAM3_MPCC_OGAM_REG_UPDATE_STATUS                                                       0x01f0
+#define regMPCC_OGAM3_MPCC_OGAM_REG_UPDATE_STATUS_BASE_IDX                                              3
+#define regMPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX                                                        0x01f2
+#define regMPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regMPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_DATA                                                         0x01f3
+#define regMPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm0_dispdec
+// base address: 0x0
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_CONTROL                                                            0x0453
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_R                                                           0x0454
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_G                                                           0x0455
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_B                                                           0x0456
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_SCALE_R                                                            0x0457
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B                                                          0x0458
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_INDEX                                                          0x0459
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_DATA                                                           0x045a
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x045b
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B                                                  0x045c
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G                                                  0x045d
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R                                                  0x045e
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B                                                    0x045f
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G                                                    0x0460
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R                                                    0x0461
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1                                                    0x0462
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3                                                    0x0463
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5                                                    0x0464
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7                                                    0x0465
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9                                                    0x0466
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11                                                  0x0467
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13                                                  0x0468
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15                                                  0x0469
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17                                                  0x046a
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19                                                  0x046b
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21                                                  0x046c
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23                                                  0x046d
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25                                                  0x046e
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27                                                  0x046f
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29                                                  0x0470
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31                                                  0x0471
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33                                                  0x0472
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B                                                  0x0473
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G                                                  0x0474
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R                                                  0x0475
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B                                                    0x0476
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G                                                    0x0477
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R                                                    0x0478
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1                                                    0x0479
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3                                                    0x047a
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5                                                    0x047b
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7                                                    0x047c
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9                                                    0x047d
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11                                                  0x047e
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13                                                  0x047f
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15                                                  0x0480
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17                                                  0x0481
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19                                                  0x0482
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21                                                  0x0483
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23                                                  0x0484
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25                                                  0x0485
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27                                                  0x0486
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29                                                  0x0487
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31                                                  0x0488
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33                                                  0x0489
+#define regMPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_MODE                                                                0x048a
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_INDEX                                                               0x048b
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_DATA                                                                0x048c
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_DATA_30BIT                                                          0x048d
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL                                                  0x048e
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_NORM_FACTOR                                                     0x048f
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R                                                        0x0490
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G                                                        0x0491
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B                                                        0x0492
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_CONTROL                                                             0x0493
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_INDEX                                                           0x0494
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_INDEX_BASE_IDX                                                  3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_DATA                                                            0x0495
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_DATA_BASE_IDX                                                   3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL                                                         0x0496
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL_BASE_IDX                                                3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B                                                   0x0497
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G                                                   0x0498
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R                                                   0x0499
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B                                             0x049a
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G                                             0x049b
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R                                             0x049c
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B                                              0x049d
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G                                              0x049e
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R                                              0x049f
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B                                                    0x04a0
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B                                                    0x04a1
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G                                                    0x04a2
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G                                                    0x04a3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R                                                    0x04a4
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R                                                    0x04a5
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_B                                                       0x04a6
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_G                                                       0x04a7
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_R                                                       0x04a8
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1                                                     0x04a9
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3                                                     0x04aa
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5                                                     0x04ab
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7                                                     0x04ac
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9                                                     0x04ad
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11                                                   0x04ae
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13                                                   0x04af
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15                                                   0x04b0
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17                                                   0x04b1
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19                                                   0x04b2
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21                                                   0x04b3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23                                                   0x04b4
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25                                                   0x04b5
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27                                                   0x04b6
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29                                                   0x04b7
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31                                                   0x04b8
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33                                                   0x04b9
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B                                                   0x04ba
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G                                                   0x04bb
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R                                                   0x04bc
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B                                             0x04bd
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G                                             0x04be
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R                                             0x04bf
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B                                              0x04c0
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G                                              0x04c1
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R                                              0x04c2
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B                                                    0x04c3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B                                                    0x04c4
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G                                                    0x04c5
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G                                                    0x04c6
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R                                                    0x04c7
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R                                                    0x04c8
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_B                                                       0x04c9
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_G                                                       0x04ca
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_R                                                       0x04cb
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1                                                     0x04cc
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3                                                     0x04cd
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5                                                     0x04ce
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7                                                     0x04cf
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9                                                     0x04d0
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11                                                   0x04d1
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13                                                   0x04d2
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15                                                   0x04d3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17                                                   0x04d4
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19                                                   0x04d5
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21                                                   0x04d6
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23                                                   0x04d7
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25                                                   0x04d8
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27                                                   0x04d9
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29                                                   0x04da
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31                                                   0x04db
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33                                                   0x04dc
+#define regMPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT                                             0x04dd
+#define regMPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                    3
+#define regMPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE                                                    0x04de
+#define regMPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE_BASE_IDX                                           3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A                                                0x04df
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A                                                0x04e0
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A                                                0x04e1
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A                                                0x04e2
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A                                                0x04e3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A                                                0x04e4
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B                                                0x04e5
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B                                                0x04e6
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B                                                0x04e7
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B                                                0x04e8
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B                                                0x04e9
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B                                                0x04ea
+#define regMPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B_BASE_IDX                                       3
+#define regMPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT                                            0x04eb
+#define regMPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                   3
+#define regMPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE                                                   0x04ec
+#define regMPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE_BASE_IDX                                          3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A                                               0x04ed
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A                                               0x04ee
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A                                               0x04ef
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A                                               0x04f0
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A                                               0x04f1
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A                                               0x04f2
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B                                               0x04f3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B                                               0x04f4
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B                                               0x04f5
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B                                               0x04f6
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B                                               0x04f7
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B                                               0x04f8
+#define regMPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B_BASE_IDX                                      3
+#define regMPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL                                                              0x04f9
+#define regMPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_SELECT                                                    0x04fa
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS                                                    0x04fb
+#define regMPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPCC_MCM0_MPCC_MCM_REG_UPDATE_STATUS                                                         0x04fc
+#define regMPCC_MCM0_MPCC_MCM_REG_UPDATE_STATUS_BASE_IDX                                                3
+#define regMPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX                                                          0x04fe
+#define regMPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM0_MPCC_MCM_TEST_DEBUG_DATA                                                           0x04ff
+#define regMPCC_MCM0_MPCC_MCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm1_dispdec
+// base address: 0x2c0
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_CONTROL                                                            0x0503
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_R                                                           0x0504
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_G                                                           0x0505
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_B                                                           0x0506
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_SCALE_R                                                            0x0507
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B                                                          0x0508
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_INDEX                                                          0x0509
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_DATA                                                           0x050a
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x050b
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B                                                  0x050c
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G                                                  0x050d
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R                                                  0x050e
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B                                                    0x050f
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G                                                    0x0510
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R                                                    0x0511
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1                                                    0x0512
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3                                                    0x0513
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5                                                    0x0514
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7                                                    0x0515
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9                                                    0x0516
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11                                                  0x0517
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13                                                  0x0518
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15                                                  0x0519
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17                                                  0x051a
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19                                                  0x051b
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21                                                  0x051c
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23                                                  0x051d
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25                                                  0x051e
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27                                                  0x051f
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29                                                  0x0520
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31                                                  0x0521
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33                                                  0x0522
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B                                                  0x0523
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G                                                  0x0524
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R                                                  0x0525
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B                                                    0x0526
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G                                                    0x0527
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R                                                    0x0528
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1                                                    0x0529
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3                                                    0x052a
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5                                                    0x052b
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7                                                    0x052c
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9                                                    0x052d
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11                                                  0x052e
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13                                                  0x052f
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15                                                  0x0530
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17                                                  0x0531
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19                                                  0x0532
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21                                                  0x0533
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23                                                  0x0534
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25                                                  0x0535
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27                                                  0x0536
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29                                                  0x0537
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31                                                  0x0538
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33                                                  0x0539
+#define regMPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_MODE                                                                0x053a
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_INDEX                                                               0x053b
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_DATA                                                                0x053c
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_DATA_30BIT                                                          0x053d
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL                                                  0x053e
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_NORM_FACTOR                                                     0x053f
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R                                                        0x0540
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G                                                        0x0541
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B                                                        0x0542
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_CONTROL                                                             0x0543
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_INDEX                                                           0x0544
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_INDEX_BASE_IDX                                                  3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_DATA                                                            0x0545
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_DATA_BASE_IDX                                                   3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL                                                         0x0546
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL_BASE_IDX                                                3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B                                                   0x0547
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G                                                   0x0548
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R                                                   0x0549
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B                                             0x054a
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G                                             0x054b
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R                                             0x054c
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B                                              0x054d
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G                                              0x054e
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R                                              0x054f
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B                                                    0x0550
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B                                                    0x0551
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G                                                    0x0552
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G                                                    0x0553
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R                                                    0x0554
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R                                                    0x0555
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_B                                                       0x0556
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_G                                                       0x0557
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_R                                                       0x0558
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1                                                     0x0559
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3                                                     0x055a
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5                                                     0x055b
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7                                                     0x055c
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9                                                     0x055d
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11                                                   0x055e
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13                                                   0x055f
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15                                                   0x0560
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17                                                   0x0561
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19                                                   0x0562
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21                                                   0x0563
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23                                                   0x0564
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25                                                   0x0565
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27                                                   0x0566
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29                                                   0x0567
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31                                                   0x0568
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33                                                   0x0569
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B                                                   0x056a
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G                                                   0x056b
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R                                                   0x056c
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B                                             0x056d
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G                                             0x056e
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R                                             0x056f
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B                                              0x0570
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G                                              0x0571
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R                                              0x0572
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B                                                    0x0573
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B                                                    0x0574
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G                                                    0x0575
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G                                                    0x0576
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R                                                    0x0577
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R                                                    0x0578
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_B                                                       0x0579
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_G                                                       0x057a
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_R                                                       0x057b
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1                                                     0x057c
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3                                                     0x057d
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5                                                     0x057e
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7                                                     0x057f
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9                                                     0x0580
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11                                                   0x0581
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13                                                   0x0582
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15                                                   0x0583
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17                                                   0x0584
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19                                                   0x0585
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21                                                   0x0586
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23                                                   0x0587
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25                                                   0x0588
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27                                                   0x0589
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29                                                   0x058a
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31                                                   0x058b
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33                                                   0x058c
+#define regMPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT                                             0x058d
+#define regMPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                    3
+#define regMPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE                                                    0x058e
+#define regMPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE_BASE_IDX                                           3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A                                                0x058f
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A                                                0x0590
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A                                                0x0591
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A                                                0x0592
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A                                                0x0593
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A                                                0x0594
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B                                                0x0595
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B                                                0x0596
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B                                                0x0597
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B                                                0x0598
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B                                                0x0599
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B                                                0x059a
+#define regMPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B_BASE_IDX                                       3
+#define regMPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT                                            0x059b
+#define regMPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                   3
+#define regMPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE                                                   0x059c
+#define regMPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE_BASE_IDX                                          3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A                                               0x059d
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A                                               0x059e
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A                                               0x059f
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A                                               0x05a0
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A                                               0x05a1
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A                                               0x05a2
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B                                               0x05a3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B                                               0x05a4
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B                                               0x05a5
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B                                               0x05a6
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B                                               0x05a7
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B                                               0x05a8
+#define regMPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B_BASE_IDX                                      3
+#define regMPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL                                                              0x05a9
+#define regMPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_SELECT                                                    0x05aa
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS                                                    0x05ab
+#define regMPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPCC_MCM1_MPCC_MCM_REG_UPDATE_STATUS                                                         0x05ac
+#define regMPCC_MCM1_MPCC_MCM_REG_UPDATE_STATUS_BASE_IDX                                                3
+#define regMPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX                                                          0x05ae
+#define regMPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM1_MPCC_MCM_TEST_DEBUG_DATA                                                           0x05af
+#define regMPCC_MCM1_MPCC_MCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm2_dispdec
+// base address: 0x580
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_CONTROL                                                            0x05b3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_R                                                           0x05b4
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_G                                                           0x05b5
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_B                                                           0x05b6
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_SCALE_R                                                            0x05b7
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B                                                          0x05b8
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_INDEX                                                          0x05b9
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_DATA                                                           0x05ba
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x05bb
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B                                                  0x05bc
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G                                                  0x05bd
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R                                                  0x05be
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B                                                    0x05bf
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G                                                    0x05c0
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R                                                    0x05c1
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1                                                    0x05c2
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3                                                    0x05c3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5                                                    0x05c4
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7                                                    0x05c5
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9                                                    0x05c6
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11                                                  0x05c7
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13                                                  0x05c8
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15                                                  0x05c9
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17                                                  0x05ca
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19                                                  0x05cb
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21                                                  0x05cc
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23                                                  0x05cd
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25                                                  0x05ce
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27                                                  0x05cf
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29                                                  0x05d0
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31                                                  0x05d1
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33                                                  0x05d2
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B                                                  0x05d3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G                                                  0x05d4
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R                                                  0x05d5
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B                                                    0x05d6
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G                                                    0x05d7
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R                                                    0x05d8
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1                                                    0x05d9
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3                                                    0x05da
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5                                                    0x05db
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7                                                    0x05dc
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9                                                    0x05dd
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11                                                  0x05de
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13                                                  0x05df
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15                                                  0x05e0
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17                                                  0x05e1
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19                                                  0x05e2
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21                                                  0x05e3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23                                                  0x05e4
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25                                                  0x05e5
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27                                                  0x05e6
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29                                                  0x05e7
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31                                                  0x05e8
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33                                                  0x05e9
+#define regMPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_MODE                                                                0x05ea
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_INDEX                                                               0x05eb
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_DATA                                                                0x05ec
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_DATA_30BIT                                                          0x05ed
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL                                                  0x05ee
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_NORM_FACTOR                                                     0x05ef
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R                                                        0x05f0
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G                                                        0x05f1
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B                                                        0x05f2
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_CONTROL                                                             0x05f3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_INDEX                                                           0x05f4
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_INDEX_BASE_IDX                                                  3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_DATA                                                            0x05f5
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_DATA_BASE_IDX                                                   3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL                                                         0x05f6
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL_BASE_IDX                                                3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B                                                   0x05f7
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G                                                   0x05f8
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R                                                   0x05f9
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B                                             0x05fa
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G                                             0x05fb
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R                                             0x05fc
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B                                              0x05fd
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G                                              0x05fe
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R                                              0x05ff
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B                                                    0x0600
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B                                                    0x0601
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G                                                    0x0602
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G                                                    0x0603
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R                                                    0x0604
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R                                                    0x0605
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_B                                                       0x0606
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_G                                                       0x0607
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_R                                                       0x0608
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1                                                     0x0609
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3                                                     0x060a
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5                                                     0x060b
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7                                                     0x060c
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9                                                     0x060d
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11                                                   0x060e
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13                                                   0x060f
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15                                                   0x0610
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17                                                   0x0611
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19                                                   0x0612
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21                                                   0x0613
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23                                                   0x0614
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25                                                   0x0615
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27                                                   0x0616
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29                                                   0x0617
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31                                                   0x0618
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33                                                   0x0619
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B                                                   0x061a
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G                                                   0x061b
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R                                                   0x061c
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B                                             0x061d
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G                                             0x061e
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R                                             0x061f
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B                                              0x0620
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G                                              0x0621
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R                                              0x0622
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B                                                    0x0623
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B                                                    0x0624
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G                                                    0x0625
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G                                                    0x0626
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R                                                    0x0627
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R                                                    0x0628
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_B                                                       0x0629
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_G                                                       0x062a
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_R                                                       0x062b
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1                                                     0x062c
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3                                                     0x062d
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5                                                     0x062e
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7                                                     0x062f
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9                                                     0x0630
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11                                                   0x0631
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13                                                   0x0632
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15                                                   0x0633
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17                                                   0x0634
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19                                                   0x0635
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21                                                   0x0636
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23                                                   0x0637
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25                                                   0x0638
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27                                                   0x0639
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29                                                   0x063a
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31                                                   0x063b
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33                                                   0x063c
+#define regMPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT                                             0x063d
+#define regMPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                    3
+#define regMPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE                                                    0x063e
+#define regMPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE_BASE_IDX                                           3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A                                                0x063f
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A                                                0x0640
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A                                                0x0641
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A                                                0x0642
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A                                                0x0643
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A                                                0x0644
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B                                                0x0645
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B                                                0x0646
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B                                                0x0647
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B                                                0x0648
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B                                                0x0649
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B                                                0x064a
+#define regMPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B_BASE_IDX                                       3
+#define regMPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT                                            0x064b
+#define regMPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                   3
+#define regMPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE                                                   0x064c
+#define regMPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE_BASE_IDX                                          3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A                                               0x064d
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A                                               0x064e
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A                                               0x064f
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A                                               0x0650
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A                                               0x0651
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A                                               0x0652
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B                                               0x0653
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B                                               0x0654
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B                                               0x0655
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B                                               0x0656
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B                                               0x0657
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B                                               0x0658
+#define regMPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B_BASE_IDX                                      3
+#define regMPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL                                                              0x0659
+#define regMPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_SELECT                                                    0x065a
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS                                                    0x065b
+#define regMPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPCC_MCM2_MPCC_MCM_REG_UPDATE_STATUS                                                         0x065c
+#define regMPCC_MCM2_MPCC_MCM_REG_UPDATE_STATUS_BASE_IDX                                                3
+#define regMPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX                                                          0x065e
+#define regMPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM2_MPCC_MCM_TEST_DEBUG_DATA                                                           0x065f
+#define regMPCC_MCM2_MPCC_MCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm3_dispdec
+// base address: 0x840
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_CONTROL                                                            0x0663
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_R                                                           0x0664
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_G                                                           0x0665
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_B                                                           0x0666
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_SCALE_R                                                            0x0667
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B                                                          0x0668
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_INDEX                                                          0x0669
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_DATA                                                           0x066a
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x066b
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B                                                  0x066c
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G                                                  0x066d
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R                                                  0x066e
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B                                                    0x066f
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G                                                    0x0670
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R                                                    0x0671
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1                                                    0x0672
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3                                                    0x0673
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5                                                    0x0674
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7                                                    0x0675
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9                                                    0x0676
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11                                                  0x0677
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13                                                  0x0678
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15                                                  0x0679
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17                                                  0x067a
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19                                                  0x067b
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21                                                  0x067c
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23                                                  0x067d
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25                                                  0x067e
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27                                                  0x067f
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29                                                  0x0680
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31                                                  0x0681
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33                                                  0x0682
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B                                                  0x0683
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G                                                  0x0684
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R                                                  0x0685
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B                                                    0x0686
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G                                                    0x0687
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R                                                    0x0688
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1                                                    0x0689
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3                                                    0x068a
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5                                                    0x068b
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7                                                    0x068c
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9                                                    0x068d
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11                                                  0x068e
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13                                                  0x068f
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15                                                  0x0690
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17                                                  0x0691
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19                                                  0x0692
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21                                                  0x0693
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23                                                  0x0694
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25                                                  0x0695
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27                                                  0x0696
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29                                                  0x0697
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31                                                  0x0698
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33                                                  0x0699
+#define regMPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_MODE                                                                0x069a
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_INDEX                                                               0x069b
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_DATA                                                                0x069c
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_DATA_30BIT                                                          0x069d
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL                                                  0x069e
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_NORM_FACTOR                                                     0x069f
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R                                                        0x06a0
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G                                                        0x06a1
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B                                                        0x06a2
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_CONTROL                                                             0x06a3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_CONTROL_BASE_IDX                                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_INDEX                                                           0x06a4
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_INDEX_BASE_IDX                                                  3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_DATA                                                            0x06a5
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_DATA_BASE_IDX                                                   3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL                                                         0x06a6
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL_BASE_IDX                                                3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B                                                   0x06a7
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G                                                   0x06a8
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R                                                   0x06a9
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B                                             0x06aa
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G                                             0x06ab
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R                                             0x06ac
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B                                              0x06ad
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G                                              0x06ae
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R                                              0x06af
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B                                                    0x06b0
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B                                                    0x06b1
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G                                                    0x06b2
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G                                                    0x06b3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R                                                    0x06b4
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R                                                    0x06b5
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_B                                                       0x06b6
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_G                                                       0x06b7
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_R                                                       0x06b8
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1                                                     0x06b9
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3                                                     0x06ba
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5                                                     0x06bb
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7                                                     0x06bc
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9                                                     0x06bd
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11                                                   0x06be
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13                                                   0x06bf
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15                                                   0x06c0
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17                                                   0x06c1
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19                                                   0x06c2
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21                                                   0x06c3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23                                                   0x06c4
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25                                                   0x06c5
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27                                                   0x06c6
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29                                                   0x06c7
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31                                                   0x06c8
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33                                                   0x06c9
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B                                                   0x06ca
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G                                                   0x06cb
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R                                                   0x06cc
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B                                             0x06cd
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G                                             0x06ce
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R                                             0x06cf
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B                                              0x06d0
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G                                              0x06d1
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R                                              0x06d2
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R_BASE_IDX                                     3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B                                                    0x06d3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B                                                    0x06d4
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G                                                    0x06d5
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G                                                    0x06d6
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R                                                    0x06d7
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R                                                    0x06d8
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_B                                                       0x06d9
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_B_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_G                                                       0x06da
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_G_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_R                                                       0x06db
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_R_BASE_IDX                                              3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1                                                     0x06dc
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3                                                     0x06dd
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5                                                     0x06de
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7                                                     0x06df
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9                                                     0x06e0
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9_BASE_IDX                                            3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11                                                   0x06e1
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13                                                   0x06e2
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15                                                   0x06e3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17                                                   0x06e4
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19                                                   0x06e5
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21                                                   0x06e6
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23                                                   0x06e7
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25                                                   0x06e8
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27                                                   0x06e9
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29                                                   0x06ea
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31                                                   0x06eb
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33                                                   0x06ec
+#define regMPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33_BASE_IDX                                          3
+#define regMPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT                                             0x06ed
+#define regMPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                    3
+#define regMPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE                                                    0x06ee
+#define regMPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE_BASE_IDX                                           3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A                                                0x06ef
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A                                                0x06f0
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A                                                0x06f1
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A                                                0x06f2
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A                                                0x06f3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A                                                0x06f4
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B                                                0x06f5
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B                                                0x06f6
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B                                                0x06f7
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B                                                0x06f8
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B                                                0x06f9
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B                                                0x06fa
+#define regMPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B_BASE_IDX                                       3
+#define regMPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT                                            0x06fb
+#define regMPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                   3
+#define regMPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE                                                   0x06fc
+#define regMPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE_BASE_IDX                                          3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A                                               0x06fd
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A                                               0x06fe
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A                                               0x06ff
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A                                               0x0700
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A                                               0x0701
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A                                               0x0702
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B                                               0x0703
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B                                               0x0704
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B                                               0x0705
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B                                               0x0706
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B                                               0x0707
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B                                               0x0708
+#define regMPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B_BASE_IDX                                      3
+#define regMPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL                                                              0x0709
+#define regMPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_SELECT                                                    0x070a
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS                                                    0x070b
+#define regMPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPCC_MCM3_MPCC_MCM_REG_UPDATE_STATUS                                                         0x070c
+#define regMPCC_MCM3_MPCC_MCM_REG_UPDATE_STATUS_BASE_IDX                                                3
+#define regMPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX                                                          0x070e
+#define regMPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPCC_MCM3_MPCC_MCM_TEST_DEBUG_DATA                                                           0x070f
+#define regMPCC_MCM3_MPCC_MCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpc_rmcm0_dispdec
+// base address: 0x0
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_CONTROL                                                            0x032f
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_R                                                           0x0330
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_G                                                           0x0331
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_B                                                           0x0332
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_SCALE_R                                                            0x0333
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B                                                          0x0334
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_INDEX                                                          0x0335
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_DATA                                                           0x0336
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x0337
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B                                                  0x0338
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G                                                  0x0339
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R                                                  0x033a
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B                                                    0x033b
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G                                                    0x033c
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R                                                    0x033d
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1                                                    0x033e
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3                                                    0x033f
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5                                                    0x0340
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7                                                    0x0341
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9                                                    0x0342
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11                                                  0x0343
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13                                                  0x0344
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15                                                  0x0345
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17                                                  0x0346
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19                                                  0x0347
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21                                                  0x0348
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23                                                  0x0349
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25                                                  0x034a
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27                                                  0x034b
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29                                                  0x034c
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31                                                  0x034d
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33                                                  0x034e
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B                                                  0x034f
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G                                                  0x0350
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R                                                  0x0351
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B                                                    0x0352
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G                                                    0x0353
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R                                                    0x0354
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1                                                    0x0355
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3                                                    0x0356
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5                                                    0x0357
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7                                                    0x0358
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9                                                    0x0359
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11                                                  0x035a
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13                                                  0x035b
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15                                                  0x035c
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17                                                  0x035d
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19                                                  0x035e
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21                                                  0x035f
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23                                                  0x0360
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25                                                  0x0361
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27                                                  0x0362
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29                                                  0x0363
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31                                                  0x0364
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33                                                  0x0365
+#define regMPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_MODE                                                                0x0366
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_INDEX                                                               0x0367
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_DATA                                                                0x0368
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_DATA_30BIT                                                          0x0369
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL                                                  0x036a
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_NORM_FACTOR                                                     0x036b
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R                                                        0x036c
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G                                                        0x036d
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B                                                        0x036e
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT                                                   0x036f
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                          3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE                                                          0x0370
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE_BASE_IDX                                                 3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A                                                     0x0371
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A                                                     0x0372
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A                                                     0x0373
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A                                                     0x0374
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A                                                     0x0375
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A                                                     0x0376
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B                                                     0x0377
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B                                                     0x0378
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B                                                     0x0379
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B                                                     0x037a
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B                                                     0x037b
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B                                                     0x037c
+#define regMPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B_BASE_IDX                                            3
+#define regMPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL                                                              0x037d
+#define regMPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_SELECT                                                    0x037e
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS                                                    0x037f
+#define regMPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPC_RMCM0_MPC_RMCM_CNTL                                                                      0x0380
+#define regMPC_RMCM0_MPC_RMCM_CNTL_BASE_IDX                                                             3
+#define regMPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX                                                          0x0382
+#define regMPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPC_RMCM0_MPC_RMCM_TEST_DEBUG_DATA                                                           0x0383
+#define regMPC_RMCM0_MPC_RMCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpc_rmcm1_dispdec
+// base address: 0x168
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_CONTROL                                                            0x0389
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_CONTROL_BASE_IDX                                                   3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_R                                                           0x038a
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_R_BASE_IDX                                                  3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_G                                                           0x038b
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_G_BASE_IDX                                                  3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_B                                                           0x038c
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_B_BASE_IDX                                                  3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_SCALE_R                                                            0x038d
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_SCALE_R_BASE_IDX                                                   3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B                                                          0x038e
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B_BASE_IDX                                                 3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_INDEX                                                          0x038f
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_INDEX_BASE_IDX                                                 3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_DATA                                                           0x0390
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_DATA_BASE_IDX                                                  3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK                                                  0x0391
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B                                                  0x0392
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G                                                  0x0393
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R                                                  0x0394
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B                                                    0x0395
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G                                                    0x0396
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R                                                    0x0397
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1                                                    0x0398
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3                                                    0x0399
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5                                                    0x039a
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7                                                    0x039b
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9                                                    0x039c
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11                                                  0x039d
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13                                                  0x039e
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15                                                  0x039f
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17                                                  0x03a0
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19                                                  0x03a1
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21                                                  0x03a2
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23                                                  0x03a3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25                                                  0x03a4
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27                                                  0x03a5
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29                                                  0x03a6
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31                                                  0x03a7
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33                                                  0x03a8
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B                                                  0x03a9
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G                                                  0x03aa
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R                                                  0x03ab
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B                                                    0x03ac
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G                                                    0x03ad
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R                                                    0x03ae
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1                                                    0x03af
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3                                                    0x03b0
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5                                                    0x03b1
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7                                                    0x03b2
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9                                                    0x03b3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11                                                  0x03b4
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13                                                  0x03b5
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15                                                  0x03b6
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17                                                  0x03b7
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19                                                  0x03b8
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21                                                  0x03b9
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23                                                  0x03ba
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25                                                  0x03bb
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27                                                  0x03bc
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29                                                  0x03bd
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31                                                  0x03be
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33                                                  0x03bf
+#define regMPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_MODE                                                                0x03c0
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_MODE_BASE_IDX                                                       3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_INDEX                                                               0x03c1
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_INDEX_BASE_IDX                                                      3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_DATA                                                                0x03c2
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_DATA_BASE_IDX                                                       3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_DATA_30BIT                                                          0x03c3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_DATA_30BIT_BASE_IDX                                                 3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL                                                  0x03c4
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL_BASE_IDX                                         3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_NORM_FACTOR                                                     0x03c5
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_NORM_FACTOR_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R                                                        0x03c6
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R_BASE_IDX                                               3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G                                                        0x03c7
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G_BASE_IDX                                               3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B                                                        0x03c8
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B_BASE_IDX                                               3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT                                                   0x03c9
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT_BASE_IDX                                          3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE                                                          0x03ca
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE_BASE_IDX                                                 3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A                                                     0x03cb
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A                                                     0x03cc
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A                                                     0x03cd
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A                                                     0x03ce
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A                                                     0x03cf
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A                                                     0x03d0
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B                                                     0x03d1
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B                                                     0x03d2
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B                                                     0x03d3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B                                                     0x03d4
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B                                                     0x03d5
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B                                                     0x03d6
+#define regMPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B_BASE_IDX                                            3
+#define regMPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL                                                              0x03d7
+#define regMPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL_BASE_IDX                                                     3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_SELECT                                                    0x03d8
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_SELECT_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS                                                    0x03d9
+#define regMPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS_BASE_IDX                                           3
+#define regMPC_RMCM1_MPC_RMCM_CNTL                                                                      0x03da
+#define regMPC_RMCM1_MPC_RMCM_CNTL_BASE_IDX                                                             3
+#define regMPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX                                                          0x03dc
+#define regMPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX_BASE_IDX                                                 3
+#define regMPC_RMCM1_MPC_RMCM_TEST_DEBUG_DATA                                                           0x03dd
+#define regMPC_RMCM1_MPC_RMCM_TEST_DEBUG_DATA_BASE_IDX                                                  3
+
+
+// addressBlock: dce_dc_mpc_mpc_ocsc_dispdec
+// base address: 0x0
+#define regMPC_OUT0_MUX                                                                                 0x02b2
+#define regMPC_OUT0_MUX_BASE_IDX                                                                        3
+#define regMPC_OUT0_DENORM_CONTROL                                                                      0x02b3
+#define regMPC_OUT0_DENORM_CONTROL_BASE_IDX                                                             3
+#define regMPC_OUT0_DENORM_CLAMP_G_Y                                                                    0x02b4
+#define regMPC_OUT0_DENORM_CLAMP_G_Y_BASE_IDX                                                           3
+#define regMPC_OUT0_DENORM_CLAMP_B_CB                                                                   0x02b5
+#define regMPC_OUT0_DENORM_CLAMP_B_CB_BASE_IDX                                                          3
+#define regMPC_OUT1_MUX                                                                                 0x02b6
+#define regMPC_OUT1_MUX_BASE_IDX                                                                        3
+#define regMPC_OUT1_DENORM_CONTROL                                                                      0x02b7
+#define regMPC_OUT1_DENORM_CONTROL_BASE_IDX                                                             3
+#define regMPC_OUT1_DENORM_CLAMP_G_Y                                                                    0x02b8
+#define regMPC_OUT1_DENORM_CLAMP_G_Y_BASE_IDX                                                           3
+#define regMPC_OUT1_DENORM_CLAMP_B_CB                                                                   0x02b9
+#define regMPC_OUT1_DENORM_CLAMP_B_CB_BASE_IDX                                                          3
+#define regMPC_OUT2_MUX                                                                                 0x02ba
+#define regMPC_OUT2_MUX_BASE_IDX                                                                        3
+#define regMPC_OUT2_DENORM_CONTROL                                                                      0x02bb
+#define regMPC_OUT2_DENORM_CONTROL_BASE_IDX                                                             3
+#define regMPC_OUT2_DENORM_CLAMP_G_Y                                                                    0x02bc
+#define regMPC_OUT2_DENORM_CLAMP_G_Y_BASE_IDX                                                           3
+#define regMPC_OUT2_DENORM_CLAMP_B_CB                                                                   0x02bd
+#define regMPC_OUT2_DENORM_CLAMP_B_CB_BASE_IDX                                                          3
+#define regMPC_OUT3_MUX                                                                                 0x02be
+#define regMPC_OUT3_MUX_BASE_IDX                                                                        3
+#define regMPC_OUT3_DENORM_CONTROL                                                                      0x02bf
+#define regMPC_OUT3_DENORM_CONTROL_BASE_IDX                                                             3
+#define regMPC_OUT3_DENORM_CLAMP_G_Y                                                                    0x02c0
+#define regMPC_OUT3_DENORM_CLAMP_G_Y_BASE_IDX                                                           3
+#define regMPC_OUT3_DENORM_CLAMP_B_CB                                                                   0x02c1
+#define regMPC_OUT3_DENORM_CLAMP_B_CB_BASE_IDX                                                          3
+#define regMPC_OUT_CSC_COEF_FORMAT                                                                      0x02ca
+#define regMPC_OUT_CSC_COEF_FORMAT_BASE_IDX                                                             3
+#define regMPC_OUT0_CSC_MODE                                                                            0x02cb
+#define regMPC_OUT0_CSC_MODE_BASE_IDX                                                                   3
+#define regMPC_OUT0_CSC_C11_C12_A                                                                       0x02cc
+#define regMPC_OUT0_CSC_C11_C12_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C13_C14_A                                                                       0x02cd
+#define regMPC_OUT0_CSC_C13_C14_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C21_C22_A                                                                       0x02ce
+#define regMPC_OUT0_CSC_C21_C22_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C23_C24_A                                                                       0x02cf
+#define regMPC_OUT0_CSC_C23_C24_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C31_C32_A                                                                       0x02d0
+#define regMPC_OUT0_CSC_C31_C32_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C33_C34_A                                                                       0x02d1
+#define regMPC_OUT0_CSC_C33_C34_A_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C11_C12_B                                                                       0x02d2
+#define regMPC_OUT0_CSC_C11_C12_B_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C13_C14_B                                                                       0x02d3
+#define regMPC_OUT0_CSC_C13_C14_B_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C21_C22_B                                                                       0x02d4
+#define regMPC_OUT0_CSC_C21_C22_B_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C23_C24_B                                                                       0x02d5
+#define regMPC_OUT0_CSC_C23_C24_B_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C31_C32_B                                                                       0x02d6
+#define regMPC_OUT0_CSC_C31_C32_B_BASE_IDX                                                              3
+#define regMPC_OUT0_CSC_C33_C34_B                                                                       0x02d7
+#define regMPC_OUT0_CSC_C33_C34_B_BASE_IDX                                                              3
+#define regMPC_OUT0_PIX_SNAP_EN                                                                         0x02d8
+#define regMPC_OUT0_PIX_SNAP_EN_BASE_IDX                                                                3
+#define regMPC_OUT0_PIX_SNAP                                                                            0x02d9
+#define regMPC_OUT0_PIX_SNAP_BASE_IDX                                                                   3
+#define regMPC_OUT0_PIX_SNAP_PIX_READ1                                                                  0x02da
+#define regMPC_OUT0_PIX_SNAP_PIX_READ1_BASE_IDX                                                         3
+#define regMPC_OUT0_PIX_SNAP_PIX_READ2                                                                  0x02db
+#define regMPC_OUT0_PIX_SNAP_PIX_READ2_BASE_IDX                                                         3
+#define regMPC_OUT1_CSC_MODE                                                                            0x02dc
+#define regMPC_OUT1_CSC_MODE_BASE_IDX                                                                   3
+#define regMPC_OUT1_CSC_C11_C12_A                                                                       0x02dd
+#define regMPC_OUT1_CSC_C11_C12_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C13_C14_A                                                                       0x02de
+#define regMPC_OUT1_CSC_C13_C14_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C21_C22_A                                                                       0x02df
+#define regMPC_OUT1_CSC_C21_C22_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C23_C24_A                                                                       0x02e0
+#define regMPC_OUT1_CSC_C23_C24_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C31_C32_A                                                                       0x02e1
+#define regMPC_OUT1_CSC_C31_C32_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C33_C34_A                                                                       0x02e2
+#define regMPC_OUT1_CSC_C33_C34_A_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C11_C12_B                                                                       0x02e3
+#define regMPC_OUT1_CSC_C11_C12_B_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C13_C14_B                                                                       0x02e4
+#define regMPC_OUT1_CSC_C13_C14_B_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C21_C22_B                                                                       0x02e5
+#define regMPC_OUT1_CSC_C21_C22_B_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C23_C24_B                                                                       0x02e6
+#define regMPC_OUT1_CSC_C23_C24_B_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C31_C32_B                                                                       0x02e7
+#define regMPC_OUT1_CSC_C31_C32_B_BASE_IDX                                                              3
+#define regMPC_OUT1_CSC_C33_C34_B                                                                       0x02e8
+#define regMPC_OUT1_CSC_C33_C34_B_BASE_IDX                                                              3
+#define regMPC_OUT1_PIX_SNAP_EN                                                                         0x02e9
+#define regMPC_OUT1_PIX_SNAP_EN_BASE_IDX                                                                3
+#define regMPC_OUT1_PIX_SNAP                                                                            0x02ea
+#define regMPC_OUT1_PIX_SNAP_BASE_IDX                                                                   3
+#define regMPC_OUT1_PIX_SNAP_PIX_READ1                                                                  0x02eb
+#define regMPC_OUT1_PIX_SNAP_PIX_READ1_BASE_IDX                                                         3
+#define regMPC_OUT1_PIX_SNAP_PIX_READ2                                                                  0x02ec
+#define regMPC_OUT1_PIX_SNAP_PIX_READ2_BASE_IDX                                                         3
+#define regMPC_OUT2_CSC_MODE                                                                            0x02ed
+#define regMPC_OUT2_CSC_MODE_BASE_IDX                                                                   3
+#define regMPC_OUT2_CSC_C11_C12_A                                                                       0x02ee
+#define regMPC_OUT2_CSC_C11_C12_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C13_C14_A                                                                       0x02ef
+#define regMPC_OUT2_CSC_C13_C14_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C21_C22_A                                                                       0x02f0
+#define regMPC_OUT2_CSC_C21_C22_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C23_C24_A                                                                       0x02f1
+#define regMPC_OUT2_CSC_C23_C24_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C31_C32_A                                                                       0x02f2
+#define regMPC_OUT2_CSC_C31_C32_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C33_C34_A                                                                       0x02f3
+#define regMPC_OUT2_CSC_C33_C34_A_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C11_C12_B                                                                       0x02f4
+#define regMPC_OUT2_CSC_C11_C12_B_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C13_C14_B                                                                       0x02f5
+#define regMPC_OUT2_CSC_C13_C14_B_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C21_C22_B                                                                       0x02f6
+#define regMPC_OUT2_CSC_C21_C22_B_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C23_C24_B                                                                       0x02f7
+#define regMPC_OUT2_CSC_C23_C24_B_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C31_C32_B                                                                       0x02f8
+#define regMPC_OUT2_CSC_C31_C32_B_BASE_IDX                                                              3
+#define regMPC_OUT2_CSC_C33_C34_B                                                                       0x02f9
+#define regMPC_OUT2_CSC_C33_C34_B_BASE_IDX                                                              3
+#define regMPC_OUT2_PIX_SNAP_EN                                                                         0x02fa
+#define regMPC_OUT2_PIX_SNAP_EN_BASE_IDX                                                                3
+#define regMPC_OUT2_PIX_SNAP                                                                            0x02fb
+#define regMPC_OUT2_PIX_SNAP_BASE_IDX                                                                   3
+#define regMPC_OUT2_PIX_SNAP_PIX_READ1                                                                  0x02fc
+#define regMPC_OUT2_PIX_SNAP_PIX_READ1_BASE_IDX                                                         3
+#define regMPC_OUT2_PIX_SNAP_PIX_READ2                                                                  0x02fd
+#define regMPC_OUT2_PIX_SNAP_PIX_READ2_BASE_IDX                                                         3
+#define regMPC_OUT3_CSC_MODE                                                                            0x02fe
+#define regMPC_OUT3_CSC_MODE_BASE_IDX                                                                   3
+#define regMPC_OUT3_CSC_C11_C12_A                                                                       0x02ff
+#define regMPC_OUT3_CSC_C11_C12_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C13_C14_A                                                                       0x0300
+#define regMPC_OUT3_CSC_C13_C14_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C21_C22_A                                                                       0x0301
+#define regMPC_OUT3_CSC_C21_C22_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C23_C24_A                                                                       0x0302
+#define regMPC_OUT3_CSC_C23_C24_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C31_C32_A                                                                       0x0303
+#define regMPC_OUT3_CSC_C31_C32_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C33_C34_A                                                                       0x0304
+#define regMPC_OUT3_CSC_C33_C34_A_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C11_C12_B                                                                       0x0305
+#define regMPC_OUT3_CSC_C11_C12_B_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C13_C14_B                                                                       0x0306
+#define regMPC_OUT3_CSC_C13_C14_B_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C21_C22_B                                                                       0x0307
+#define regMPC_OUT3_CSC_C21_C22_B_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C23_C24_B                                                                       0x0308
+#define regMPC_OUT3_CSC_C23_C24_B_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C31_C32_B                                                                       0x0309
+#define regMPC_OUT3_CSC_C31_C32_B_BASE_IDX                                                              3
+#define regMPC_OUT3_CSC_C33_C34_B                                                                       0x030a
+#define regMPC_OUT3_CSC_C33_C34_B_BASE_IDX                                                              3
+#define regMPC_OUT3_PIX_SNAP_EN                                                                         0x030b
+#define regMPC_OUT3_PIX_SNAP_EN_BASE_IDX                                                                3
+#define regMPC_OUT3_PIX_SNAP                                                                            0x030c
+#define regMPC_OUT3_PIX_SNAP_BASE_IDX                                                                   3
+#define regMPC_OUT3_PIX_SNAP_PIX_READ1                                                                  0x030d
+#define regMPC_OUT3_PIX_SNAP_PIX_READ1_BASE_IDX                                                         3
+#define regMPC_OUT3_PIX_SNAP_PIX_READ2                                                                  0x030e
+#define regMPC_OUT3_PIX_SNAP_PIX_READ2_BASE_IDX                                                         3
+#define regMPC_OCSC_REG_UPDATE_STATUS                                                                   0x032b
+#define regMPC_OCSC_REG_UPDATE_STATUS_BASE_IDX                                                          3
+#define regMPC_OCSC_TEST_DEBUG_INDEX                                                                    0x032d
+#define regMPC_OCSC_TEST_DEBUG_INDEX_BASE_IDX                                                           3
+#define regMPC_OCSC_TEST_DEBUG_DATA                                                                     0x032e
+#define regMPC_OCSC_TEST_DEBUG_DATA_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_opp_abm0_dispdec
+// base address: 0x0
+#define regABM0_BL1_PWM_AMBIENT_LIGHT_LEVEL                                                             0x0e7a
+#define regABM0_BL1_PWM_AMBIENT_LIGHT_LEVEL_BASE_IDX                                                    3
+#define regABM0_BL1_PWM_USER_LEVEL                                                                      0x0e7b
+#define regABM0_BL1_PWM_USER_LEVEL_BASE_IDX                                                             3
+#define regABM0_BL1_PWM_TARGET_ABM_LEVEL                                                                0x0e7c
+#define regABM0_BL1_PWM_TARGET_ABM_LEVEL_BASE_IDX                                                       3
+#define regABM0_BL1_PWM_CURRENT_ABM_LEVEL                                                               0x0e7d
+#define regABM0_BL1_PWM_CURRENT_ABM_LEVEL_BASE_IDX                                                      3
+#define regABM0_BL1_PWM_FINAL_DUTY_CYCLE                                                                0x0e7e
+#define regABM0_BL1_PWM_FINAL_DUTY_CYCLE_BASE_IDX                                                       3
+#define regABM0_BL1_PWM_MINIMUM_DUTY_CYCLE                                                              0x0e7f
+#define regABM0_BL1_PWM_MINIMUM_DUTY_CYCLE_BASE_IDX                                                     3
+#define regABM0_BL1_PWM_ABM_CNTL                                                                        0x0e80
+#define regABM0_BL1_PWM_ABM_CNTL_BASE_IDX                                                               3
+#define regABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE                                                           0x0e81
+#define regABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE_BASE_IDX                                                  3
+#define regABM0_DC_ABM1_CNTL                                                                            0x0e82
+#define regABM0_DC_ABM1_CNTL_BASE_IDX                                                                   3
+#define regABM0_DC_ABM1_IPCSC_COEFF_SEL                                                                 0x0e83
+#define regABM0_DC_ABM1_IPCSC_COEFF_SEL_BASE_IDX                                                        3
+#define regABM0_DC_ABM1_ACE_PWL_CNTL                                                                    0x0e84
+#define regABM0_DC_ABM1_ACE_PWL_CNTL_BASE_IDX                                                           3
+#define regABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA                                                           0x0e85
+#define regABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA_BASE_IDX                                                  3
+#define regABM0_DC_ABM1_ACE_CNTL_MISC                                                                   0x0e86
+#define regABM0_DC_ABM1_ACE_CNTL_MISC_BASE_IDX                                                          3
+#define regABM0_DC_ABM1_HGLS_REG_READ_PROGRESS                                                          0x0e88
+#define regABM0_DC_ABM1_HGLS_REG_READ_PROGRESS_BASE_IDX                                                 3
+#define regABM0_DC_ABM1_HG_MISC_CTRL                                                                    0x0e89
+#define regABM0_DC_ABM1_HG_MISC_CTRL_BASE_IDX                                                           3
+#define regABM0_DC_ABM1_LS_SUM_OF_LUMA                                                                  0x0e8a
+#define regABM0_DC_ABM1_LS_SUM_OF_LUMA_BASE_IDX                                                         3
+#define regABM0_DC_ABM1_LS_SUM_OF_LUMA_MSB                                                              0x0e8b
+#define regABM0_DC_ABM1_LS_SUM_OF_LUMA_MSB_BASE_IDX                                                     3
+#define regABM0_DC_ABM1_LS_MIN_MAX_LUMA                                                                 0x0e8c
+#define regABM0_DC_ABM1_LS_MIN_MAX_LUMA_BASE_IDX                                                        3
+#define regABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA                                                        0x0e8d
+#define regABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA_BASE_IDX                                               3
+#define regABM0_DC_ABM1_LS_PIXEL_COUNT                                                                  0x0e8e
+#define regABM0_DC_ABM1_LS_PIXEL_COUNT_BASE_IDX                                                         3
+#define regABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES                                                    0x0e8f
+#define regABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES_BASE_IDX                                           3
+#define regABM0_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT                                                        0x0e90
+#define regABM0_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM0_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT                                                        0x0e91
+#define regABM0_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_SAMPLE_RATE                                                                  0x0e92
+#define regABM0_DC_ABM1_HG_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM0_DC_ABM1_LS_SAMPLE_RATE                                                                  0x0e93
+#define regABM0_DC_ABM1_LS_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM0_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG                                                          0x0e94
+#define regABM0_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG_BASE_IDX                                                 3
+#define regABM0_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG                                                         0x0e95
+#define regABM0_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG_BASE_IDX                                                3
+#define regABM0_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX                                                          0x0e96
+#define regABM0_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX_BASE_IDX                                                 3
+#define regABM0_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX                                                         0x0e97
+#define regABM0_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX_BASE_IDX                                                3
+#define regABM0_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX                                                        0x0e98
+#define regABM0_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX                                                        0x0e99
+#define regABM0_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX                                                        0x0e9a
+#define regABM0_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX                                                        0x0e9b
+#define regABM0_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX                                                        0x0e9c
+#define regABM0_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX                                                        0x0e9d
+#define regABM0_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM0_DC_ABM1_HG_RESULT_INDEX                                                                 0x0e9e
+#define regABM0_DC_ABM1_HG_RESULT_INDEX_BASE_IDX                                                        3
+#define regABM0_DC_ABM1_HG_RESULT_DATA                                                                  0x0e9f
+#define regABM0_DC_ABM1_HG_RESULT_DATA_BASE_IDX                                                         3
+#define regABM0_DC_ABM1_BL_MASTER_LOCK                                                                  0x0ea0
+#define regABM0_DC_ABM1_BL_MASTER_LOCK_BASE_IDX                                                         3
+#define regABM0_ABM_TEST_DEBUG_INDEX                                                                    0x0ea1
+#define regABM0_ABM_TEST_DEBUG_INDEX_BASE_IDX                                                           3
+#define regABM0_ABM_TEST_DEBUG_DATA                                                                     0x0ea2
+#define regABM0_ABM_TEST_DEBUG_DATA_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_opp_abm1_dispdec
+// base address: 0x104
+#define regABM1_BL1_PWM_AMBIENT_LIGHT_LEVEL                                                             0x0ebb
+#define regABM1_BL1_PWM_AMBIENT_LIGHT_LEVEL_BASE_IDX                                                    3
+#define regABM1_BL1_PWM_USER_LEVEL                                                                      0x0ebc
+#define regABM1_BL1_PWM_USER_LEVEL_BASE_IDX                                                             3
+#define regABM1_BL1_PWM_TARGET_ABM_LEVEL                                                                0x0ebd
+#define regABM1_BL1_PWM_TARGET_ABM_LEVEL_BASE_IDX                                                       3
+#define regABM1_BL1_PWM_CURRENT_ABM_LEVEL                                                               0x0ebe
+#define regABM1_BL1_PWM_CURRENT_ABM_LEVEL_BASE_IDX                                                      3
+#define regABM1_BL1_PWM_FINAL_DUTY_CYCLE                                                                0x0ebf
+#define regABM1_BL1_PWM_FINAL_DUTY_CYCLE_BASE_IDX                                                       3
+#define regABM1_BL1_PWM_MINIMUM_DUTY_CYCLE                                                              0x0ec0
+#define regABM1_BL1_PWM_MINIMUM_DUTY_CYCLE_BASE_IDX                                                     3
+#define regABM1_BL1_PWM_ABM_CNTL                                                                        0x0ec1
+#define regABM1_BL1_PWM_ABM_CNTL_BASE_IDX                                                               3
+#define regABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE                                                           0x0ec2
+#define regABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE_BASE_IDX                                                  3
+#define regABM1_DC_ABM1_CNTL                                                                            0x0ec3
+#define regABM1_DC_ABM1_CNTL_BASE_IDX                                                                   3
+#define regABM1_DC_ABM1_IPCSC_COEFF_SEL                                                                 0x0ec4
+#define regABM1_DC_ABM1_IPCSC_COEFF_SEL_BASE_IDX                                                        3
+#define regABM1_DC_ABM1_ACE_PWL_CNTL                                                                    0x0ec5
+#define regABM1_DC_ABM1_ACE_PWL_CNTL_BASE_IDX                                                           3
+#define regABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA                                                           0x0ec6
+#define regABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA_BASE_IDX                                                  3
+#define regABM1_DC_ABM1_ACE_CNTL_MISC                                                                   0x0ec7
+#define regABM1_DC_ABM1_ACE_CNTL_MISC_BASE_IDX                                                          3
+#define regABM1_DC_ABM1_HGLS_REG_READ_PROGRESS                                                          0x0ec9
+#define regABM1_DC_ABM1_HGLS_REG_READ_PROGRESS_BASE_IDX                                                 3
+#define regABM1_DC_ABM1_HG_MISC_CTRL                                                                    0x0eca
+#define regABM1_DC_ABM1_HG_MISC_CTRL_BASE_IDX                                                           3
+#define regABM1_DC_ABM1_LS_SUM_OF_LUMA                                                                  0x0ecb
+#define regABM1_DC_ABM1_LS_SUM_OF_LUMA_BASE_IDX                                                         3
+#define regABM1_DC_ABM1_LS_SUM_OF_LUMA_MSB                                                              0x0ecc
+#define regABM1_DC_ABM1_LS_SUM_OF_LUMA_MSB_BASE_IDX                                                     3
+#define regABM1_DC_ABM1_LS_MIN_MAX_LUMA                                                                 0x0ecd
+#define regABM1_DC_ABM1_LS_MIN_MAX_LUMA_BASE_IDX                                                        3
+#define regABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA                                                        0x0ece
+#define regABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA_BASE_IDX                                               3
+#define regABM1_DC_ABM1_LS_PIXEL_COUNT                                                                  0x0ecf
+#define regABM1_DC_ABM1_LS_PIXEL_COUNT_BASE_IDX                                                         3
+#define regABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES                                                    0x0ed0
+#define regABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES_BASE_IDX                                           3
+#define regABM1_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT                                                        0x0ed1
+#define regABM1_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM1_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT                                                        0x0ed2
+#define regABM1_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_SAMPLE_RATE                                                                  0x0ed3
+#define regABM1_DC_ABM1_HG_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM1_DC_ABM1_LS_SAMPLE_RATE                                                                  0x0ed4
+#define regABM1_DC_ABM1_LS_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM1_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG                                                          0x0ed5
+#define regABM1_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG_BASE_IDX                                                 3
+#define regABM1_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG                                                         0x0ed6
+#define regABM1_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG_BASE_IDX                                                3
+#define regABM1_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX                                                          0x0ed7
+#define regABM1_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX_BASE_IDX                                                 3
+#define regABM1_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX                                                         0x0ed8
+#define regABM1_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX_BASE_IDX                                                3
+#define regABM1_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX                                                        0x0ed9
+#define regABM1_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX                                                        0x0eda
+#define regABM1_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX                                                        0x0edb
+#define regABM1_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX                                                        0x0edc
+#define regABM1_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX                                                        0x0edd
+#define regABM1_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX                                                        0x0ede
+#define regABM1_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM1_DC_ABM1_HG_RESULT_INDEX                                                                 0x0edf
+#define regABM1_DC_ABM1_HG_RESULT_INDEX_BASE_IDX                                                        3
+#define regABM1_DC_ABM1_HG_RESULT_DATA                                                                  0x0ee0
+#define regABM1_DC_ABM1_HG_RESULT_DATA_BASE_IDX                                                         3
+#define regABM1_DC_ABM1_BL_MASTER_LOCK                                                                  0x0ee1
+#define regABM1_DC_ABM1_BL_MASTER_LOCK_BASE_IDX                                                         3
+#define regABM1_ABM_TEST_DEBUG_INDEX                                                                    0x0ee2
+#define regABM1_ABM_TEST_DEBUG_INDEX_BASE_IDX                                                           3
+#define regABM1_ABM_TEST_DEBUG_DATA                                                                     0x0ee3
+#define regABM1_ABM_TEST_DEBUG_DATA_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_opp_abm2_dispdec
+// base address: 0x208
+#define regABM2_BL1_PWM_AMBIENT_LIGHT_LEVEL                                                             0x0efc
+#define regABM2_BL1_PWM_AMBIENT_LIGHT_LEVEL_BASE_IDX                                                    3
+#define regABM2_BL1_PWM_USER_LEVEL                                                                      0x0efd
+#define regABM2_BL1_PWM_USER_LEVEL_BASE_IDX                                                             3
+#define regABM2_BL1_PWM_TARGET_ABM_LEVEL                                                                0x0efe
+#define regABM2_BL1_PWM_TARGET_ABM_LEVEL_BASE_IDX                                                       3
+#define regABM2_BL1_PWM_CURRENT_ABM_LEVEL                                                               0x0eff
+#define regABM2_BL1_PWM_CURRENT_ABM_LEVEL_BASE_IDX                                                      3
+#define regABM2_BL1_PWM_FINAL_DUTY_CYCLE                                                                0x0f00
+#define regABM2_BL1_PWM_FINAL_DUTY_CYCLE_BASE_IDX                                                       3
+#define regABM2_BL1_PWM_MINIMUM_DUTY_CYCLE                                                              0x0f01
+#define regABM2_BL1_PWM_MINIMUM_DUTY_CYCLE_BASE_IDX                                                     3
+#define regABM2_BL1_PWM_ABM_CNTL                                                                        0x0f02
+#define regABM2_BL1_PWM_ABM_CNTL_BASE_IDX                                                               3
+#define regABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE                                                           0x0f03
+#define regABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE_BASE_IDX                                                  3
+#define regABM2_DC_ABM1_CNTL                                                                            0x0f04
+#define regABM2_DC_ABM1_CNTL_BASE_IDX                                                                   3
+#define regABM2_DC_ABM1_IPCSC_COEFF_SEL                                                                 0x0f05
+#define regABM2_DC_ABM1_IPCSC_COEFF_SEL_BASE_IDX                                                        3
+#define regABM2_DC_ABM1_ACE_PWL_CNTL                                                                    0x0f06
+#define regABM2_DC_ABM1_ACE_PWL_CNTL_BASE_IDX                                                           3
+#define regABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA                                                           0x0f07
+#define regABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA_BASE_IDX                                                  3
+#define regABM2_DC_ABM1_ACE_CNTL_MISC                                                                   0x0f08
+#define regABM2_DC_ABM1_ACE_CNTL_MISC_BASE_IDX                                                          3
+#define regABM2_DC_ABM1_HGLS_REG_READ_PROGRESS                                                          0x0f0a
+#define regABM2_DC_ABM1_HGLS_REG_READ_PROGRESS_BASE_IDX                                                 3
+#define regABM2_DC_ABM1_HG_MISC_CTRL                                                                    0x0f0b
+#define regABM2_DC_ABM1_HG_MISC_CTRL_BASE_IDX                                                           3
+#define regABM2_DC_ABM1_LS_SUM_OF_LUMA                                                                  0x0f0c
+#define regABM2_DC_ABM1_LS_SUM_OF_LUMA_BASE_IDX                                                         3
+#define regABM2_DC_ABM1_LS_SUM_OF_LUMA_MSB                                                              0x0f0d
+#define regABM2_DC_ABM1_LS_SUM_OF_LUMA_MSB_BASE_IDX                                                     3
+#define regABM2_DC_ABM1_LS_MIN_MAX_LUMA                                                                 0x0f0e
+#define regABM2_DC_ABM1_LS_MIN_MAX_LUMA_BASE_IDX                                                        3
+#define regABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA                                                        0x0f0f
+#define regABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA_BASE_IDX                                               3
+#define regABM2_DC_ABM1_LS_PIXEL_COUNT                                                                  0x0f10
+#define regABM2_DC_ABM1_LS_PIXEL_COUNT_BASE_IDX                                                         3
+#define regABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES                                                    0x0f11
+#define regABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES_BASE_IDX                                           3
+#define regABM2_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT                                                        0x0f12
+#define regABM2_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM2_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT                                                        0x0f13
+#define regABM2_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_SAMPLE_RATE                                                                  0x0f14
+#define regABM2_DC_ABM1_HG_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM2_DC_ABM1_LS_SAMPLE_RATE                                                                  0x0f15
+#define regABM2_DC_ABM1_LS_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM2_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG                                                          0x0f16
+#define regABM2_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG_BASE_IDX                                                 3
+#define regABM2_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG                                                         0x0f17
+#define regABM2_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG_BASE_IDX                                                3
+#define regABM2_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX                                                          0x0f18
+#define regABM2_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX_BASE_IDX                                                 3
+#define regABM2_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX                                                         0x0f19
+#define regABM2_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX_BASE_IDX                                                3
+#define regABM2_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX                                                        0x0f1a
+#define regABM2_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX                                                        0x0f1b
+#define regABM2_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX                                                        0x0f1c
+#define regABM2_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX                                                        0x0f1d
+#define regABM2_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX                                                        0x0f1e
+#define regABM2_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX                                                        0x0f1f
+#define regABM2_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM2_DC_ABM1_HG_RESULT_INDEX                                                                 0x0f20
+#define regABM2_DC_ABM1_HG_RESULT_INDEX_BASE_IDX                                                        3
+#define regABM2_DC_ABM1_HG_RESULT_DATA                                                                  0x0f21
+#define regABM2_DC_ABM1_HG_RESULT_DATA_BASE_IDX                                                         3
+#define regABM2_DC_ABM1_BL_MASTER_LOCK                                                                  0x0f22
+#define regABM2_DC_ABM1_BL_MASTER_LOCK_BASE_IDX                                                         3
+#define regABM2_ABM_TEST_DEBUG_INDEX                                                                    0x0f23
+#define regABM2_ABM_TEST_DEBUG_INDEX_BASE_IDX                                                           3
+#define regABM2_ABM_TEST_DEBUG_DATA                                                                     0x0f24
+#define regABM2_ABM_TEST_DEBUG_DATA_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_opp_abm3_dispdec
+// base address: 0x30c
+#define regABM3_BL1_PWM_AMBIENT_LIGHT_LEVEL                                                             0x0f3d
+#define regABM3_BL1_PWM_AMBIENT_LIGHT_LEVEL_BASE_IDX                                                    3
+#define regABM3_BL1_PWM_USER_LEVEL                                                                      0x0f3e
+#define regABM3_BL1_PWM_USER_LEVEL_BASE_IDX                                                             3
+#define regABM3_BL1_PWM_TARGET_ABM_LEVEL                                                                0x0f3f
+#define regABM3_BL1_PWM_TARGET_ABM_LEVEL_BASE_IDX                                                       3
+#define regABM3_BL1_PWM_CURRENT_ABM_LEVEL                                                               0x0f40
+#define regABM3_BL1_PWM_CURRENT_ABM_LEVEL_BASE_IDX                                                      3
+#define regABM3_BL1_PWM_FINAL_DUTY_CYCLE                                                                0x0f41
+#define regABM3_BL1_PWM_FINAL_DUTY_CYCLE_BASE_IDX                                                       3
+#define regABM3_BL1_PWM_MINIMUM_DUTY_CYCLE                                                              0x0f42
+#define regABM3_BL1_PWM_MINIMUM_DUTY_CYCLE_BASE_IDX                                                     3
+#define regABM3_BL1_PWM_ABM_CNTL                                                                        0x0f43
+#define regABM3_BL1_PWM_ABM_CNTL_BASE_IDX                                                               3
+#define regABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE                                                           0x0f44
+#define regABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE_BASE_IDX                                                  3
+#define regABM3_DC_ABM1_CNTL                                                                            0x0f45
+#define regABM3_DC_ABM1_CNTL_BASE_IDX                                                                   3
+#define regABM3_DC_ABM1_IPCSC_COEFF_SEL                                                                 0x0f46
+#define regABM3_DC_ABM1_IPCSC_COEFF_SEL_BASE_IDX                                                        3
+#define regABM3_DC_ABM1_ACE_PWL_CNTL                                                                    0x0f47
+#define regABM3_DC_ABM1_ACE_PWL_CNTL_BASE_IDX                                                           3
+#define regABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA                                                           0x0f48
+#define regABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA_BASE_IDX                                                  3
+#define regABM3_DC_ABM1_ACE_CNTL_MISC                                                                   0x0f49
+#define regABM3_DC_ABM1_ACE_CNTL_MISC_BASE_IDX                                                          3
+#define regABM3_DC_ABM1_HGLS_REG_READ_PROGRESS                                                          0x0f4b
+#define regABM3_DC_ABM1_HGLS_REG_READ_PROGRESS_BASE_IDX                                                 3
+#define regABM3_DC_ABM1_HG_MISC_CTRL                                                                    0x0f4c
+#define regABM3_DC_ABM1_HG_MISC_CTRL_BASE_IDX                                                           3
+#define regABM3_DC_ABM1_LS_SUM_OF_LUMA                                                                  0x0f4d
+#define regABM3_DC_ABM1_LS_SUM_OF_LUMA_BASE_IDX                                                         3
+#define regABM3_DC_ABM1_LS_SUM_OF_LUMA_MSB                                                              0x0f4e
+#define regABM3_DC_ABM1_LS_SUM_OF_LUMA_MSB_BASE_IDX                                                     3
+#define regABM3_DC_ABM1_LS_MIN_MAX_LUMA                                                                 0x0f4f
+#define regABM3_DC_ABM1_LS_MIN_MAX_LUMA_BASE_IDX                                                        3
+#define regABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA                                                        0x0f50
+#define regABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA_BASE_IDX                                               3
+#define regABM3_DC_ABM1_LS_PIXEL_COUNT                                                                  0x0f51
+#define regABM3_DC_ABM1_LS_PIXEL_COUNT_BASE_IDX                                                         3
+#define regABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES                                                    0x0f52
+#define regABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES_BASE_IDX                                           3
+#define regABM3_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT                                                        0x0f53
+#define regABM3_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM3_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT                                                        0x0f54
+#define regABM3_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_SAMPLE_RATE                                                                  0x0f55
+#define regABM3_DC_ABM1_HG_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM3_DC_ABM1_LS_SAMPLE_RATE                                                                  0x0f56
+#define regABM3_DC_ABM1_LS_SAMPLE_RATE_BASE_IDX                                                         3
+#define regABM3_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG                                                          0x0f57
+#define regABM3_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG_BASE_IDX                                                 3
+#define regABM3_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG                                                         0x0f58
+#define regABM3_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG_BASE_IDX                                                3
+#define regABM3_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX                                                          0x0f59
+#define regABM3_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX_BASE_IDX                                                 3
+#define regABM3_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX                                                         0x0f5a
+#define regABM3_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX_BASE_IDX                                                3
+#define regABM3_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX                                                        0x0f5b
+#define regABM3_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX                                                        0x0f5c
+#define regABM3_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX                                                        0x0f5d
+#define regABM3_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX                                                        0x0f5e
+#define regABM3_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX                                                        0x0f5f
+#define regABM3_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX                                                        0x0f60
+#define regABM3_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX_BASE_IDX                                               3
+#define regABM3_DC_ABM1_HG_RESULT_INDEX                                                                 0x0f61
+#define regABM3_DC_ABM1_HG_RESULT_INDEX_BASE_IDX                                                        3
+#define regABM3_DC_ABM1_HG_RESULT_DATA                                                                  0x0f62
+#define regABM3_DC_ABM1_HG_RESULT_DATA_BASE_IDX                                                         3
+#define regABM3_DC_ABM1_BL_MASTER_LOCK                                                                  0x0f63
+#define regABM3_DC_ABM1_BL_MASTER_LOCK_BASE_IDX                                                         3
+#define regABM3_ABM_TEST_DEBUG_INDEX                                                                    0x0f64
+#define regABM3_ABM_TEST_DEBUG_INDEX_BASE_IDX                                                           3
+#define regABM3_ABM_TEST_DEBUG_DATA                                                                     0x0f65
+#define regABM3_ABM_TEST_DEBUG_DATA_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_opp_dpg0_dispdec
+// base address: 0x0
+#define regDPG0_DPG_CONTROL                                                                             0x1854
+#define regDPG0_DPG_CONTROL_BASE_IDX                                                                    2
+#define regDPG0_DPG_RAMP_CONTROL                                                                        0x1855
+#define regDPG0_DPG_RAMP_CONTROL_BASE_IDX                                                               2
+#define regDPG0_DPG_DIMENSIONS                                                                          0x1856
+#define regDPG0_DPG_DIMENSIONS_BASE_IDX                                                                 2
+#define regDPG0_DPG_COLOUR_R_CR                                                                         0x1857
+#define regDPG0_DPG_COLOUR_R_CR_BASE_IDX                                                                2
+#define regDPG0_DPG_COLOUR_G_Y                                                                          0x1858
+#define regDPG0_DPG_COLOUR_G_Y_BASE_IDX                                                                 2
+#define regDPG0_DPG_COLOUR_B_CB                                                                         0x1859
+#define regDPG0_DPG_COLOUR_B_CB_BASE_IDX                                                                2
+#define regDPG0_DPG_OFFSET_SEGMENT                                                                      0x185a
+#define regDPG0_DPG_OFFSET_SEGMENT_BASE_IDX                                                             2
+#define regDPG0_DPG_STATUS                                                                              0x185b
+#define regDPG0_DPG_STATUS_BASE_IDX                                                                     2
+#define regDPG0_DPG_TEST_DEBUG_INDEX                                                                    0x185d
+#define regDPG0_DPG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regDPG0_DPG_TEST_DEBUG_DATA                                                                     0x185e
+#define regDPG0_DPG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_fmt0_dispdec
+// base address: 0x0
+#define regFMT0_FMT_CLAMP_COMPONENT_R                                                                   0x183c
+#define regFMT0_FMT_CLAMP_COMPONENT_R_BASE_IDX                                                          2
+#define regFMT0_FMT_CLAMP_COMPONENT_G                                                                   0x183d
+#define regFMT0_FMT_CLAMP_COMPONENT_G_BASE_IDX                                                          2
+#define regFMT0_FMT_CLAMP_COMPONENT_B                                                                   0x183e
+#define regFMT0_FMT_CLAMP_COMPONENT_B_BASE_IDX                                                          2
+#define regFMT0_FMT_DYNAMIC_EXP_CNTL                                                                    0x183f
+#define regFMT0_FMT_DYNAMIC_EXP_CNTL_BASE_IDX                                                           2
+#define regFMT0_FMT_CONTROL                                                                             0x1840
+#define regFMT0_FMT_CONTROL_BASE_IDX                                                                    2
+#define regFMT0_FMT_BIT_DEPTH_CONTROL                                                                   0x1841
+#define regFMT0_FMT_BIT_DEPTH_CONTROL_BASE_IDX                                                          2
+#define regFMT0_FMT_DITHER_RAND_R_SEED                                                                  0x1842
+#define regFMT0_FMT_DITHER_RAND_R_SEED_BASE_IDX                                                         2
+#define regFMT0_FMT_DITHER_RAND_G_SEED                                                                  0x1843
+#define regFMT0_FMT_DITHER_RAND_G_SEED_BASE_IDX                                                         2
+#define regFMT0_FMT_DITHER_RAND_B_SEED                                                                  0x1844
+#define regFMT0_FMT_DITHER_RAND_B_SEED_BASE_IDX                                                         2
+#define regFMT0_FMT_CLAMP_CNTL                                                                          0x1845
+#define regFMT0_FMT_CLAMP_CNTL_BASE_IDX                                                                 2
+#define regFMT0_FMT_SIDE_BY_SIDE_STEREO_CONTROL                                                         0x1846
+#define regFMT0_FMT_SIDE_BY_SIDE_STEREO_CONTROL_BASE_IDX                                                2
+#define regFMT0_FMT_MAP420_MEMORY_CONTROL                                                               0x1847
+#define regFMT0_FMT_MAP420_MEMORY_CONTROL_BASE_IDX                                                      2
+#define regFMT0_FMT_DEBUG_CNTL                                                                          0x1848
+#define regFMT0_FMT_DEBUG_CNTL_BASE_IDX                                                                 2
+#define regFMT0_FMT_422_CONTROL                                                                         0x1849
+#define regFMT0_FMT_422_CONTROL_BASE_IDX                                                                2
+#define regFMT0_FMT_TEST_DEBUG_INDEX                                                                    0x184b
+#define regFMT0_FMT_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regFMT0_FMT_TEST_DEBUG_DATA                                                                     0x184c
+#define regFMT0_FMT_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_oppbuf0_dispdec
+// base address: 0x0
+#define regOPPBUF0_OPPBUF_CONTROL                                                                       0x1884
+#define regOPPBUF0_OPPBUF_CONTROL_BASE_IDX                                                              2
+#define regOPPBUF0_OPPBUF_3D_PARAMETERS_0                                                               0x1885
+#define regOPPBUF0_OPPBUF_3D_PARAMETERS_0_BASE_IDX                                                      2
+#define regOPPBUF0_OPPBUF_3D_PARAMETERS_1                                                               0x1886
+#define regOPPBUF0_OPPBUF_3D_PARAMETERS_1_BASE_IDX                                                      2
+#define regOPPBUF0_OPPBUF_TEST_DEBUG_INDEX                                                              0x1887
+#define regOPPBUF0_OPPBUF_TEST_DEBUG_INDEX_BASE_IDX                                                     2
+#define regOPPBUF0_OPPBUF_TEST_DEBUG_DATA                                                               0x1888
+#define regOPPBUF0_OPPBUF_TEST_DEBUG_DATA_BASE_IDX                                                      2
+#define regOPPBUF0_OPPBUF_CONTROL1                                                                      0x1889
+#define regOPPBUF0_OPPBUF_CONTROL1_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_opp_opp_pipe0_dispdec
+// base address: 0x0
+#define regOPP_PIPE0_OPP_PIPE_CONTROL                                                                   0x188b
+#define regOPP_PIPE0_OPP_PIPE_CONTROL_BASE_IDX                                                          2
+#define regOPP_PIPE0_OPP_PIPE_SPARE_DEBUG                                                               0x188c
+#define regOPP_PIPE0_OPP_PIPE_SPARE_DEBUG_BASE_IDX                                                      2
+#define regOPP_PIPE0_OPP_PIPE_TEST_DEBUG_INDEX                                                          0x188d
+#define regOPP_PIPE0_OPP_PIPE_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regOPP_PIPE0_OPP_PIPE_TEST_DEBUG_DATA                                                           0x188e
+#define regOPP_PIPE0_OPP_PIPE_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc0_dispdec
+// base address: 0x0
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL                                                           0x188f
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_MASK                                                              0x1890
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_MASK_BASE_IDX                                                     2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTA                                                           0x1891
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTA_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTR                                                           0x1892
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTR_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTG                                                           0x1893
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTG_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTB                                                           0x1894
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTB_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTC                                                           0x1895
+#define regOPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTC_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_dpg1_dispdec
+// base address: 0x168
+#define regDPG1_DPG_CONTROL                                                                             0x18ae
+#define regDPG1_DPG_CONTROL_BASE_IDX                                                                    2
+#define regDPG1_DPG_RAMP_CONTROL                                                                        0x18af
+#define regDPG1_DPG_RAMP_CONTROL_BASE_IDX                                                               2
+#define regDPG1_DPG_DIMENSIONS                                                                          0x18b0
+#define regDPG1_DPG_DIMENSIONS_BASE_IDX                                                                 2
+#define regDPG1_DPG_COLOUR_R_CR                                                                         0x18b1
+#define regDPG1_DPG_COLOUR_R_CR_BASE_IDX                                                                2
+#define regDPG1_DPG_COLOUR_G_Y                                                                          0x18b2
+#define regDPG1_DPG_COLOUR_G_Y_BASE_IDX                                                                 2
+#define regDPG1_DPG_COLOUR_B_CB                                                                         0x18b3
+#define regDPG1_DPG_COLOUR_B_CB_BASE_IDX                                                                2
+#define regDPG1_DPG_OFFSET_SEGMENT                                                                      0x18b4
+#define regDPG1_DPG_OFFSET_SEGMENT_BASE_IDX                                                             2
+#define regDPG1_DPG_STATUS                                                                              0x18b5
+#define regDPG1_DPG_STATUS_BASE_IDX                                                                     2
+#define regDPG1_DPG_TEST_DEBUG_INDEX                                                                    0x18b7
+#define regDPG1_DPG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regDPG1_DPG_TEST_DEBUG_DATA                                                                     0x18b8
+#define regDPG1_DPG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_fmt1_dispdec
+// base address: 0x168
+#define regFMT1_FMT_CLAMP_COMPONENT_R                                                                   0x1896
+#define regFMT1_FMT_CLAMP_COMPONENT_R_BASE_IDX                                                          2
+#define regFMT1_FMT_CLAMP_COMPONENT_G                                                                   0x1897
+#define regFMT1_FMT_CLAMP_COMPONENT_G_BASE_IDX                                                          2
+#define regFMT1_FMT_CLAMP_COMPONENT_B                                                                   0x1898
+#define regFMT1_FMT_CLAMP_COMPONENT_B_BASE_IDX                                                          2
+#define regFMT1_FMT_DYNAMIC_EXP_CNTL                                                                    0x1899
+#define regFMT1_FMT_DYNAMIC_EXP_CNTL_BASE_IDX                                                           2
+#define regFMT1_FMT_CONTROL                                                                             0x189a
+#define regFMT1_FMT_CONTROL_BASE_IDX                                                                    2
+#define regFMT1_FMT_BIT_DEPTH_CONTROL                                                                   0x189b
+#define regFMT1_FMT_BIT_DEPTH_CONTROL_BASE_IDX                                                          2
+#define regFMT1_FMT_DITHER_RAND_R_SEED                                                                  0x189c
+#define regFMT1_FMT_DITHER_RAND_R_SEED_BASE_IDX                                                         2
+#define regFMT1_FMT_DITHER_RAND_G_SEED                                                                  0x189d
+#define regFMT1_FMT_DITHER_RAND_G_SEED_BASE_IDX                                                         2
+#define regFMT1_FMT_DITHER_RAND_B_SEED                                                                  0x189e
+#define regFMT1_FMT_DITHER_RAND_B_SEED_BASE_IDX                                                         2
+#define regFMT1_FMT_CLAMP_CNTL                                                                          0x189f
+#define regFMT1_FMT_CLAMP_CNTL_BASE_IDX                                                                 2
+#define regFMT1_FMT_SIDE_BY_SIDE_STEREO_CONTROL                                                         0x18a0
+#define regFMT1_FMT_SIDE_BY_SIDE_STEREO_CONTROL_BASE_IDX                                                2
+#define regFMT1_FMT_MAP420_MEMORY_CONTROL                                                               0x18a1
+#define regFMT1_FMT_MAP420_MEMORY_CONTROL_BASE_IDX                                                      2
+#define regFMT1_FMT_DEBUG_CNTL                                                                          0x18a2
+#define regFMT1_FMT_DEBUG_CNTL_BASE_IDX                                                                 2
+#define regFMT1_FMT_422_CONTROL                                                                         0x18a3
+#define regFMT1_FMT_422_CONTROL_BASE_IDX                                                                2
+#define regFMT1_FMT_TEST_DEBUG_INDEX                                                                    0x18a5
+#define regFMT1_FMT_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regFMT1_FMT_TEST_DEBUG_DATA                                                                     0x18a6
+#define regFMT1_FMT_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_oppbuf1_dispdec
+// base address: 0x168
+#define regOPPBUF1_OPPBUF_CONTROL                                                                       0x18de
+#define regOPPBUF1_OPPBUF_CONTROL_BASE_IDX                                                              2
+#define regOPPBUF1_OPPBUF_3D_PARAMETERS_0                                                               0x18df
+#define regOPPBUF1_OPPBUF_3D_PARAMETERS_0_BASE_IDX                                                      2
+#define regOPPBUF1_OPPBUF_3D_PARAMETERS_1                                                               0x18e0
+#define regOPPBUF1_OPPBUF_3D_PARAMETERS_1_BASE_IDX                                                      2
+#define regOPPBUF1_OPPBUF_TEST_DEBUG_INDEX                                                              0x18e1
+#define regOPPBUF1_OPPBUF_TEST_DEBUG_INDEX_BASE_IDX                                                     2
+#define regOPPBUF1_OPPBUF_TEST_DEBUG_DATA                                                               0x18e2
+#define regOPPBUF1_OPPBUF_TEST_DEBUG_DATA_BASE_IDX                                                      2
+#define regOPPBUF1_OPPBUF_CONTROL1                                                                      0x18e3
+#define regOPPBUF1_OPPBUF_CONTROL1_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_opp_opp_pipe1_dispdec
+// base address: 0x168
+#define regOPP_PIPE1_OPP_PIPE_CONTROL                                                                   0x18e5
+#define regOPP_PIPE1_OPP_PIPE_CONTROL_BASE_IDX                                                          2
+#define regOPP_PIPE1_OPP_PIPE_SPARE_DEBUG                                                               0x18e6
+#define regOPP_PIPE1_OPP_PIPE_SPARE_DEBUG_BASE_IDX                                                      2
+#define regOPP_PIPE1_OPP_PIPE_TEST_DEBUG_INDEX                                                          0x18e7
+#define regOPP_PIPE1_OPP_PIPE_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regOPP_PIPE1_OPP_PIPE_TEST_DEBUG_DATA                                                           0x18e8
+#define regOPP_PIPE1_OPP_PIPE_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc1_dispdec
+// base address: 0x168
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL                                                           0x18e9
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_MASK                                                              0x18ea
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_MASK_BASE_IDX                                                     2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTA                                                           0x18eb
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTA_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTR                                                           0x18ec
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTR_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTG                                                           0x18ed
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTG_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTB                                                           0x18ee
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTB_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTC                                                           0x18ef
+#define regOPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTC_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_dpg2_dispdec
+// base address: 0x2d0
+#define regDPG2_DPG_CONTROL                                                                             0x1908
+#define regDPG2_DPG_CONTROL_BASE_IDX                                                                    2
+#define regDPG2_DPG_RAMP_CONTROL                                                                        0x1909
+#define regDPG2_DPG_RAMP_CONTROL_BASE_IDX                                                               2
+#define regDPG2_DPG_DIMENSIONS                                                                          0x190a
+#define regDPG2_DPG_DIMENSIONS_BASE_IDX                                                                 2
+#define regDPG2_DPG_COLOUR_R_CR                                                                         0x190b
+#define regDPG2_DPG_COLOUR_R_CR_BASE_IDX                                                                2
+#define regDPG2_DPG_COLOUR_G_Y                                                                          0x190c
+#define regDPG2_DPG_COLOUR_G_Y_BASE_IDX                                                                 2
+#define regDPG2_DPG_COLOUR_B_CB                                                                         0x190d
+#define regDPG2_DPG_COLOUR_B_CB_BASE_IDX                                                                2
+#define regDPG2_DPG_OFFSET_SEGMENT                                                                      0x190e
+#define regDPG2_DPG_OFFSET_SEGMENT_BASE_IDX                                                             2
+#define regDPG2_DPG_STATUS                                                                              0x190f
+#define regDPG2_DPG_STATUS_BASE_IDX                                                                     2
+#define regDPG2_DPG_TEST_DEBUG_INDEX                                                                    0x1911
+#define regDPG2_DPG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regDPG2_DPG_TEST_DEBUG_DATA                                                                     0x1912
+#define regDPG2_DPG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_fmt2_dispdec
+// base address: 0x2d0
+#define regFMT2_FMT_CLAMP_COMPONENT_R                                                                   0x18f0
+#define regFMT2_FMT_CLAMP_COMPONENT_R_BASE_IDX                                                          2
+#define regFMT2_FMT_CLAMP_COMPONENT_G                                                                   0x18f1
+#define regFMT2_FMT_CLAMP_COMPONENT_G_BASE_IDX                                                          2
+#define regFMT2_FMT_CLAMP_COMPONENT_B                                                                   0x18f2
+#define regFMT2_FMT_CLAMP_COMPONENT_B_BASE_IDX                                                          2
+#define regFMT2_FMT_DYNAMIC_EXP_CNTL                                                                    0x18f3
+#define regFMT2_FMT_DYNAMIC_EXP_CNTL_BASE_IDX                                                           2
+#define regFMT2_FMT_CONTROL                                                                             0x18f4
+#define regFMT2_FMT_CONTROL_BASE_IDX                                                                    2
+#define regFMT2_FMT_BIT_DEPTH_CONTROL                                                                   0x18f5
+#define regFMT2_FMT_BIT_DEPTH_CONTROL_BASE_IDX                                                          2
+#define regFMT2_FMT_DITHER_RAND_R_SEED                                                                  0x18f6
+#define regFMT2_FMT_DITHER_RAND_R_SEED_BASE_IDX                                                         2
+#define regFMT2_FMT_DITHER_RAND_G_SEED                                                                  0x18f7
+#define regFMT2_FMT_DITHER_RAND_G_SEED_BASE_IDX                                                         2
+#define regFMT2_FMT_DITHER_RAND_B_SEED                                                                  0x18f8
+#define regFMT2_FMT_DITHER_RAND_B_SEED_BASE_IDX                                                         2
+#define regFMT2_FMT_CLAMP_CNTL                                                                          0x18f9
+#define regFMT2_FMT_CLAMP_CNTL_BASE_IDX                                                                 2
+#define regFMT2_FMT_SIDE_BY_SIDE_STEREO_CONTROL                                                         0x18fa
+#define regFMT2_FMT_SIDE_BY_SIDE_STEREO_CONTROL_BASE_IDX                                                2
+#define regFMT2_FMT_MAP420_MEMORY_CONTROL                                                               0x18fb
+#define regFMT2_FMT_MAP420_MEMORY_CONTROL_BASE_IDX                                                      2
+#define regFMT2_FMT_DEBUG_CNTL                                                                          0x18fc
+#define regFMT2_FMT_DEBUG_CNTL_BASE_IDX                                                                 2
+#define regFMT2_FMT_422_CONTROL                                                                         0x18fd
+#define regFMT2_FMT_422_CONTROL_BASE_IDX                                                                2
+#define regFMT2_FMT_TEST_DEBUG_INDEX                                                                    0x18ff
+#define regFMT2_FMT_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regFMT2_FMT_TEST_DEBUG_DATA                                                                     0x1900
+#define regFMT2_FMT_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_oppbuf2_dispdec
+// base address: 0x2d0
+#define regOPPBUF2_OPPBUF_CONTROL                                                                       0x1938
+#define regOPPBUF2_OPPBUF_CONTROL_BASE_IDX                                                              2
+#define regOPPBUF2_OPPBUF_3D_PARAMETERS_0                                                               0x1939
+#define regOPPBUF2_OPPBUF_3D_PARAMETERS_0_BASE_IDX                                                      2
+#define regOPPBUF2_OPPBUF_3D_PARAMETERS_1                                                               0x193a
+#define regOPPBUF2_OPPBUF_3D_PARAMETERS_1_BASE_IDX                                                      2
+#define regOPPBUF2_OPPBUF_TEST_DEBUG_INDEX                                                              0x193b
+#define regOPPBUF2_OPPBUF_TEST_DEBUG_INDEX_BASE_IDX                                                     2
+#define regOPPBUF2_OPPBUF_TEST_DEBUG_DATA                                                               0x193c
+#define regOPPBUF2_OPPBUF_TEST_DEBUG_DATA_BASE_IDX                                                      2
+#define regOPPBUF2_OPPBUF_CONTROL1                                                                      0x193d
+#define regOPPBUF2_OPPBUF_CONTROL1_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_opp_opp_pipe2_dispdec
+// base address: 0x2d0
+#define regOPP_PIPE2_OPP_PIPE_CONTROL                                                                   0x193f
+#define regOPP_PIPE2_OPP_PIPE_CONTROL_BASE_IDX                                                          2
+#define regOPP_PIPE2_OPP_PIPE_SPARE_DEBUG                                                               0x1940
+#define regOPP_PIPE2_OPP_PIPE_SPARE_DEBUG_BASE_IDX                                                      2
+#define regOPP_PIPE2_OPP_PIPE_TEST_DEBUG_INDEX                                                          0x1941
+#define regOPP_PIPE2_OPP_PIPE_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regOPP_PIPE2_OPP_PIPE_TEST_DEBUG_DATA                                                           0x1942
+#define regOPP_PIPE2_OPP_PIPE_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc2_dispdec
+// base address: 0x2d0
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL                                                           0x1943
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_MASK                                                              0x1944
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_MASK_BASE_IDX                                                     2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTA                                                           0x1945
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTA_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTR                                                           0x1946
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTR_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTG                                                           0x1947
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTG_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTB                                                           0x1948
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTB_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTC                                                           0x1949
+#define regOPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTC_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_dpg3_dispdec
+// base address: 0x438
+#define regDPG3_DPG_CONTROL                                                                             0x1962
+#define regDPG3_DPG_CONTROL_BASE_IDX                                                                    2
+#define regDPG3_DPG_RAMP_CONTROL                                                                        0x1963
+#define regDPG3_DPG_RAMP_CONTROL_BASE_IDX                                                               2
+#define regDPG3_DPG_DIMENSIONS                                                                          0x1964
+#define regDPG3_DPG_DIMENSIONS_BASE_IDX                                                                 2
+#define regDPG3_DPG_COLOUR_R_CR                                                                         0x1965
+#define regDPG3_DPG_COLOUR_R_CR_BASE_IDX                                                                2
+#define regDPG3_DPG_COLOUR_G_Y                                                                          0x1966
+#define regDPG3_DPG_COLOUR_G_Y_BASE_IDX                                                                 2
+#define regDPG3_DPG_COLOUR_B_CB                                                                         0x1967
+#define regDPG3_DPG_COLOUR_B_CB_BASE_IDX                                                                2
+#define regDPG3_DPG_OFFSET_SEGMENT                                                                      0x1968
+#define regDPG3_DPG_OFFSET_SEGMENT_BASE_IDX                                                             2
+#define regDPG3_DPG_STATUS                                                                              0x1969
+#define regDPG3_DPG_STATUS_BASE_IDX                                                                     2
+#define regDPG3_DPG_TEST_DEBUG_INDEX                                                                    0x196b
+#define regDPG3_DPG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regDPG3_DPG_TEST_DEBUG_DATA                                                                     0x196c
+#define regDPG3_DPG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_fmt3_dispdec
+// base address: 0x438
+#define regFMT3_FMT_CLAMP_COMPONENT_R                                                                   0x194a
+#define regFMT3_FMT_CLAMP_COMPONENT_R_BASE_IDX                                                          2
+#define regFMT3_FMT_CLAMP_COMPONENT_G                                                                   0x194b
+#define regFMT3_FMT_CLAMP_COMPONENT_G_BASE_IDX                                                          2
+#define regFMT3_FMT_CLAMP_COMPONENT_B                                                                   0x194c
+#define regFMT3_FMT_CLAMP_COMPONENT_B_BASE_IDX                                                          2
+#define regFMT3_FMT_DYNAMIC_EXP_CNTL                                                                    0x194d
+#define regFMT3_FMT_DYNAMIC_EXP_CNTL_BASE_IDX                                                           2
+#define regFMT3_FMT_CONTROL                                                                             0x194e
+#define regFMT3_FMT_CONTROL_BASE_IDX                                                                    2
+#define regFMT3_FMT_BIT_DEPTH_CONTROL                                                                   0x194f
+#define regFMT3_FMT_BIT_DEPTH_CONTROL_BASE_IDX                                                          2
+#define regFMT3_FMT_DITHER_RAND_R_SEED                                                                  0x1950
+#define regFMT3_FMT_DITHER_RAND_R_SEED_BASE_IDX                                                         2
+#define regFMT3_FMT_DITHER_RAND_G_SEED                                                                  0x1951
+#define regFMT3_FMT_DITHER_RAND_G_SEED_BASE_IDX                                                         2
+#define regFMT3_FMT_DITHER_RAND_B_SEED                                                                  0x1952
+#define regFMT3_FMT_DITHER_RAND_B_SEED_BASE_IDX                                                         2
+#define regFMT3_FMT_CLAMP_CNTL                                                                          0x1953
+#define regFMT3_FMT_CLAMP_CNTL_BASE_IDX                                                                 2
+#define regFMT3_FMT_SIDE_BY_SIDE_STEREO_CONTROL                                                         0x1954
+#define regFMT3_FMT_SIDE_BY_SIDE_STEREO_CONTROL_BASE_IDX                                                2
+#define regFMT3_FMT_MAP420_MEMORY_CONTROL                                                               0x1955
+#define regFMT3_FMT_MAP420_MEMORY_CONTROL_BASE_IDX                                                      2
+#define regFMT3_FMT_DEBUG_CNTL                                                                          0x1956
+#define regFMT3_FMT_DEBUG_CNTL_BASE_IDX                                                                 2
+#define regFMT3_FMT_422_CONTROL                                                                         0x1957
+#define regFMT3_FMT_422_CONTROL_BASE_IDX                                                                2
+#define regFMT3_FMT_TEST_DEBUG_INDEX                                                                    0x1959
+#define regFMT3_FMT_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regFMT3_FMT_TEST_DEBUG_DATA                                                                     0x195a
+#define regFMT3_FMT_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_opp_oppbuf3_dispdec
+// base address: 0x438
+#define regOPPBUF3_OPPBUF_CONTROL                                                                       0x1992
+#define regOPPBUF3_OPPBUF_CONTROL_BASE_IDX                                                              2
+#define regOPPBUF3_OPPBUF_3D_PARAMETERS_0                                                               0x1993
+#define regOPPBUF3_OPPBUF_3D_PARAMETERS_0_BASE_IDX                                                      2
+#define regOPPBUF3_OPPBUF_3D_PARAMETERS_1                                                               0x1994
+#define regOPPBUF3_OPPBUF_3D_PARAMETERS_1_BASE_IDX                                                      2
+#define regOPPBUF3_OPPBUF_TEST_DEBUG_INDEX                                                              0x1995
+#define regOPPBUF3_OPPBUF_TEST_DEBUG_INDEX_BASE_IDX                                                     2
+#define regOPPBUF3_OPPBUF_TEST_DEBUG_DATA                                                               0x1996
+#define regOPPBUF3_OPPBUF_TEST_DEBUG_DATA_BASE_IDX                                                      2
+#define regOPPBUF3_OPPBUF_CONTROL1                                                                      0x1997
+#define regOPPBUF3_OPPBUF_CONTROL1_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_opp_opp_pipe3_dispdec
+// base address: 0x438
+#define regOPP_PIPE3_OPP_PIPE_CONTROL                                                                   0x1999
+#define regOPP_PIPE3_OPP_PIPE_CONTROL_BASE_IDX                                                          2
+#define regOPP_PIPE3_OPP_PIPE_SPARE_DEBUG                                                               0x199a
+#define regOPP_PIPE3_OPP_PIPE_SPARE_DEBUG_BASE_IDX                                                      2
+#define regOPP_PIPE3_OPP_PIPE_TEST_DEBUG_INDEX                                                          0x199b
+#define regOPP_PIPE3_OPP_PIPE_TEST_DEBUG_INDEX_BASE_IDX                                                 2
+#define regOPP_PIPE3_OPP_PIPE_TEST_DEBUG_DATA                                                           0x199c
+#define regOPP_PIPE3_OPP_PIPE_TEST_DEBUG_DATA_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc3_dispdec
+// base address: 0x438
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL                                                           0x199d
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_MASK                                                              0x199e
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_MASK_BASE_IDX                                                     2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTA                                                           0x199f
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTA_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTR                                                           0x19a0
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTR_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTG                                                           0x19a1
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTG_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTB                                                           0x19a2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTB_BASE_IDX                                                  2
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTC                                                           0x19a3
+#define regOPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTC_BASE_IDX                                                  2
+
+
+// addressBlock: dce_dc_opp_dscrm0_dispdec
+// base address: 0x0
+#define regDSCRM0_DSCRM_DSC_FORWARD_CONFIG                                                              0x1a64
+#define regDSCRM0_DSCRM_DSC_FORWARD_CONFIG_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_opp_dscrm1_dispdec
+// base address: 0x4
+#define regDSCRM1_DSCRM_DSC_FORWARD_CONFIG                                                              0x1a65
+#define regDSCRM1_DSCRM_DSC_FORWARD_CONFIG_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_opp_dscrm2_dispdec
+// base address: 0x8
+#define regDSCRM2_DSCRM_DSC_FORWARD_CONFIG                                                              0x1a66
+#define regDSCRM2_DSCRM_DSC_FORWARD_CONFIG_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_opp_dscrm3_dispdec
+// base address: 0xc
+#define regDSCRM3_DSCRM_DSC_FORWARD_CONFIG                                                              0x1a67
+#define regDSCRM3_DSCRM_DSC_FORWARD_CONFIG_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_opp_opp_top_dispdec
+// base address: 0x0
+#define regOPP_TOP_CLK_CONTROL                                                                          0x1a5e
+#define regOPP_TOP_CLK_CONTROL_BASE_IDX                                                                 2
+#define regOPP_DEBUG_CONTROL                                                                            0x1a5f
+#define regOPP_DEBUG_CONTROL_BASE_IDX                                                                   2
+#define regOPP_ABM_CONTROL                                                                              0x1a60
+#define regOPP_ABM_CONTROL_BASE_IDX                                                                     2
+#define regOPP_TOP_SPARE_DEBUG                                                                          0x1a61
+#define regOPP_TOP_SPARE_DEBUG_BASE_IDX                                                                 2
+#define regOPP_TOP_TEST_DEBUG_INDEX                                                                     0x1a62
+#define regOPP_TOP_TEST_DEBUG_INDEX_BASE_IDX                                                            2
+#define regOPP_TOP_TEST_DEBUG_DATA                                                                      0x1a63
+#define regOPP_TOP_TEST_DEBUG_DATA_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_opp_opp_dcperfmon_dc_perfmon_dispdec
+// base address: 0x6af8
+#define regDC_PERFMON15_PERFCOUNTER_CNTL                                                                0x1abe
+#define regDC_PERFMON15_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON15_PERFCOUNTER_CNTL2                                                               0x1abf
+#define regDC_PERFMON15_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON15_PERFCOUNTER_STATE                                                               0x1ac0
+#define regDC_PERFMON15_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON15_PERFMON_CNTL                                                                    0x1ac1
+#define regDC_PERFMON15_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON15_PERFMON_CNTL2                                                                   0x1ac2
+#define regDC_PERFMON15_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON15_PERFMON_CVALUE_INT_MISC                                                         0x1ac3
+#define regDC_PERFMON15_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON15_PERFMON_CVALUE_LOW                                                              0x1ac4
+#define regDC_PERFMON15_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON15_PERFMON_HI                                                                      0x1ac5
+#define regDC_PERFMON15_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON15_PERFMON_LOW                                                                     0x1ac6
+#define regDC_PERFMON15_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON15_PERFMON_TEST_DEBUG_INDEX                                                        0x1ac7
+#define regDC_PERFMON15_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON15_PERFMON_TEST_DEBUG_DATA                                                         0x1ac8
+#define regDC_PERFMON15_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_optc_odm0_dispdec
+// base address: 0x0
+#define regODM0_OPTC_INPUT_GLOBAL_CONTROL                                                               0x1aca
+#define regODM0_OPTC_INPUT_GLOBAL_CONTROL_BASE_IDX                                                      2
+#define regODM0_OPTC_RSMU_UNDERFLOW                                                                     0x1acb
+#define regODM0_OPTC_RSMU_UNDERFLOW_BASE_IDX                                                            2
+#define regODM0_OPTC_UNDERFLOW_THRESHOLD                                                                0x1acc
+#define regODM0_OPTC_UNDERFLOW_THRESHOLD_BASE_IDX                                                       2
+#define regODM0_OPTC_DATA_SOURCE_SELECT                                                                 0x1acd
+#define regODM0_OPTC_DATA_SOURCE_SELECT_BASE_IDX                                                        2
+#define regODM0_OPTC_DATA_FORMAT_CONTROL                                                                0x1ace
+#define regODM0_OPTC_DATA_FORMAT_CONTROL_BASE_IDX                                                       2
+#define regODM0_OPTC_BYTES_PER_PIXEL                                                                    0x1acf
+#define regODM0_OPTC_BYTES_PER_PIXEL_BASE_IDX                                                           2
+#define regODM0_OPTC_WIDTH_CONTROL                                                                      0x1ad0
+#define regODM0_OPTC_WIDTH_CONTROL_BASE_IDX                                                             2
+#define regODM0_OPTC_WIDTH_CONTROL2                                                                     0x1ad1
+#define regODM0_OPTC_WIDTH_CONTROL2_BASE_IDX                                                            2
+#define regODM0_OPTC_INPUT_CLOCK_CONTROL                                                                0x1ad2
+#define regODM0_OPTC_INPUT_CLOCK_CONTROL_BASE_IDX                                                       2
+#define regODM0_OPTC_MEMORY_CONFIG                                                                      0x1ad3
+#define regODM0_OPTC_MEMORY_CONFIG_BASE_IDX                                                             2
+#define regODM0_OPTC_INPUT_TEST_DEBUG_INDEX                                                             0x1ad5
+#define regODM0_OPTC_INPUT_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regODM0_OPTC_INPUT_TEST_DEBUG_DATA                                                              0x1ad6
+#define regODM0_OPTC_INPUT_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_optc_odm1_dispdec
+// base address: 0x40
+#define regODM1_OPTC_INPUT_GLOBAL_CONTROL                                                               0x1ada
+#define regODM1_OPTC_INPUT_GLOBAL_CONTROL_BASE_IDX                                                      2
+#define regODM1_OPTC_RSMU_UNDERFLOW                                                                     0x1adb
+#define regODM1_OPTC_RSMU_UNDERFLOW_BASE_IDX                                                            2
+#define regODM1_OPTC_UNDERFLOW_THRESHOLD                                                                0x1adc
+#define regODM1_OPTC_UNDERFLOW_THRESHOLD_BASE_IDX                                                       2
+#define regODM1_OPTC_DATA_SOURCE_SELECT                                                                 0x1add
+#define regODM1_OPTC_DATA_SOURCE_SELECT_BASE_IDX                                                        2
+#define regODM1_OPTC_DATA_FORMAT_CONTROL                                                                0x1ade
+#define regODM1_OPTC_DATA_FORMAT_CONTROL_BASE_IDX                                                       2
+#define regODM1_OPTC_BYTES_PER_PIXEL                                                                    0x1adf
+#define regODM1_OPTC_BYTES_PER_PIXEL_BASE_IDX                                                           2
+#define regODM1_OPTC_WIDTH_CONTROL                                                                      0x1ae0
+#define regODM1_OPTC_WIDTH_CONTROL_BASE_IDX                                                             2
+#define regODM1_OPTC_WIDTH_CONTROL2                                                                     0x1ae1
+#define regODM1_OPTC_WIDTH_CONTROL2_BASE_IDX                                                            2
+#define regODM1_OPTC_INPUT_CLOCK_CONTROL                                                                0x1ae2
+#define regODM1_OPTC_INPUT_CLOCK_CONTROL_BASE_IDX                                                       2
+#define regODM1_OPTC_MEMORY_CONFIG                                                                      0x1ae3
+#define regODM1_OPTC_MEMORY_CONFIG_BASE_IDX                                                             2
+#define regODM1_OPTC_INPUT_TEST_DEBUG_INDEX                                                             0x1ae5
+#define regODM1_OPTC_INPUT_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regODM1_OPTC_INPUT_TEST_DEBUG_DATA                                                              0x1ae6
+#define regODM1_OPTC_INPUT_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_optc_odm2_dispdec
+// base address: 0x80
+#define regODM2_OPTC_INPUT_GLOBAL_CONTROL                                                               0x1aea
+#define regODM2_OPTC_INPUT_GLOBAL_CONTROL_BASE_IDX                                                      2
+#define regODM2_OPTC_RSMU_UNDERFLOW                                                                     0x1aeb
+#define regODM2_OPTC_RSMU_UNDERFLOW_BASE_IDX                                                            2
+#define regODM2_OPTC_UNDERFLOW_THRESHOLD                                                                0x1aec
+#define regODM2_OPTC_UNDERFLOW_THRESHOLD_BASE_IDX                                                       2
+#define regODM2_OPTC_DATA_SOURCE_SELECT                                                                 0x1aed
+#define regODM2_OPTC_DATA_SOURCE_SELECT_BASE_IDX                                                        2
+#define regODM2_OPTC_DATA_FORMAT_CONTROL                                                                0x1aee
+#define regODM2_OPTC_DATA_FORMAT_CONTROL_BASE_IDX                                                       2
+#define regODM2_OPTC_BYTES_PER_PIXEL                                                                    0x1aef
+#define regODM2_OPTC_BYTES_PER_PIXEL_BASE_IDX                                                           2
+#define regODM2_OPTC_WIDTH_CONTROL                                                                      0x1af0
+#define regODM2_OPTC_WIDTH_CONTROL_BASE_IDX                                                             2
+#define regODM2_OPTC_WIDTH_CONTROL2                                                                     0x1af1
+#define regODM2_OPTC_WIDTH_CONTROL2_BASE_IDX                                                            2
+#define regODM2_OPTC_INPUT_CLOCK_CONTROL                                                                0x1af2
+#define regODM2_OPTC_INPUT_CLOCK_CONTROL_BASE_IDX                                                       2
+#define regODM2_OPTC_MEMORY_CONFIG                                                                      0x1af3
+#define regODM2_OPTC_MEMORY_CONFIG_BASE_IDX                                                             2
+#define regODM2_OPTC_INPUT_TEST_DEBUG_INDEX                                                             0x1af5
+#define regODM2_OPTC_INPUT_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regODM2_OPTC_INPUT_TEST_DEBUG_DATA                                                              0x1af6
+#define regODM2_OPTC_INPUT_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_optc_odm3_dispdec
+// base address: 0xc0
+#define regODM3_OPTC_INPUT_GLOBAL_CONTROL                                                               0x1afa
+#define regODM3_OPTC_INPUT_GLOBAL_CONTROL_BASE_IDX                                                      2
+#define regODM3_OPTC_RSMU_UNDERFLOW                                                                     0x1afb
+#define regODM3_OPTC_RSMU_UNDERFLOW_BASE_IDX                                                            2
+#define regODM3_OPTC_UNDERFLOW_THRESHOLD                                                                0x1afc
+#define regODM3_OPTC_UNDERFLOW_THRESHOLD_BASE_IDX                                                       2
+#define regODM3_OPTC_DATA_SOURCE_SELECT                                                                 0x1afd
+#define regODM3_OPTC_DATA_SOURCE_SELECT_BASE_IDX                                                        2
+#define regODM3_OPTC_DATA_FORMAT_CONTROL                                                                0x1afe
+#define regODM3_OPTC_DATA_FORMAT_CONTROL_BASE_IDX                                                       2
+#define regODM3_OPTC_BYTES_PER_PIXEL                                                                    0x1aff
+#define regODM3_OPTC_BYTES_PER_PIXEL_BASE_IDX                                                           2
+#define regODM3_OPTC_WIDTH_CONTROL                                                                      0x1b00
+#define regODM3_OPTC_WIDTH_CONTROL_BASE_IDX                                                             2
+#define regODM3_OPTC_WIDTH_CONTROL2                                                                     0x1b01
+#define regODM3_OPTC_WIDTH_CONTROL2_BASE_IDX                                                            2
+#define regODM3_OPTC_INPUT_CLOCK_CONTROL                                                                0x1b02
+#define regODM3_OPTC_INPUT_CLOCK_CONTROL_BASE_IDX                                                       2
+#define regODM3_OPTC_MEMORY_CONFIG                                                                      0x1b03
+#define regODM3_OPTC_MEMORY_CONFIG_BASE_IDX                                                             2
+#define regODM3_OPTC_INPUT_TEST_DEBUG_INDEX                                                             0x1b05
+#define regODM3_OPTC_INPUT_TEST_DEBUG_INDEX_BASE_IDX                                                    2
+#define regODM3_OPTC_INPUT_TEST_DEBUG_DATA                                                              0x1b06
+#define regODM3_OPTC_INPUT_TEST_DEBUG_DATA_BASE_IDX                                                     2
+
+
+// addressBlock: dce_dc_optc_otg0_dispdec
+// base address: 0x0
+#define regOTG0_OTG_H_TOTAL                                                                             0x1b2a
+#define regOTG0_OTG_H_TOTAL_BASE_IDX                                                                    2
+#define regOTG0_OTG_H_BLANK_START_END                                                                   0x1b2b
+#define regOTG0_OTG_H_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG0_OTG_H_SYNC_A                                                                            0x1b2c
+#define regOTG0_OTG_H_SYNC_A_BASE_IDX                                                                   2
+#define regOTG0_OTG_H_SYNC_A_CNTL                                                                       0x1b2d
+#define regOTG0_OTG_H_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG0_OTG_H_TIMING_CNTL                                                                       0x1b2e
+#define regOTG0_OTG_H_TIMING_CNTL_BASE_IDX                                                              2
+#define regOTG0_OTG_V_TOTAL                                                                             0x1b2f
+#define regOTG0_OTG_V_TOTAL_BASE_IDX                                                                    2
+#define regOTG0_OTG_V_TOTAL_MIN                                                                         0x1b30
+#define regOTG0_OTG_V_TOTAL_MIN_BASE_IDX                                                                2
+#define regOTG0_OTG_V_TOTAL_MAX                                                                         0x1b31
+#define regOTG0_OTG_V_TOTAL_MAX_BASE_IDX                                                                2
+#define regOTG0_OTG_V_TOTAL_MID                                                                         0x1b32
+#define regOTG0_OTG_V_TOTAL_MID_BASE_IDX                                                                2
+#define regOTG0_OTG_V_TOTAL_CONTROL                                                                     0x1b33
+#define regOTG0_OTG_V_TOTAL_CONTROL_BASE_IDX                                                            2
+#define regOTG0_OTG_V_COUNT_STOP_CONTROL                                                                0x1b34
+#define regOTG0_OTG_V_COUNT_STOP_CONTROL_BASE_IDX                                                       2
+#define regOTG0_OTG_V_COUNT_STOP_CONTROL2                                                               0x1b35
+#define regOTG0_OTG_V_COUNT_STOP_CONTROL2_BASE_IDX                                                      2
+#define regOTG0_OTG_V_TOTAL_INT_STATUS                                                                  0x1b36
+#define regOTG0_OTG_V_TOTAL_INT_STATUS_BASE_IDX                                                         2
+#define regOTG0_OTG_VSYNC_NOM_INT_STATUS                                                                0x1b37
+#define regOTG0_OTG_VSYNC_NOM_INT_STATUS_BASE_IDX                                                       2
+#define regOTG0_OTG_V_BLANK_START_END                                                                   0x1b38
+#define regOTG0_OTG_V_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG0_OTG_V_SYNC_A                                                                            0x1b39
+#define regOTG0_OTG_V_SYNC_A_BASE_IDX                                                                   2
+#define regOTG0_OTG_V_SYNC_A_CNTL                                                                       0x1b3a
+#define regOTG0_OTG_V_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG0_OTG_TRIGA_CNTL                                                                          0x1b3b
+#define regOTG0_OTG_TRIGA_CNTL_BASE_IDX                                                                 2
+#define regOTG0_OTG_TRIGA_MANUAL_TRIG                                                                   0x1b3c
+#define regOTG0_OTG_TRIGA_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG0_OTG_TRIGB_CNTL                                                                          0x1b3d
+#define regOTG0_OTG_TRIGB_CNTL_BASE_IDX                                                                 2
+#define regOTG0_OTG_TRIGB_MANUAL_TRIG                                                                   0x1b3e
+#define regOTG0_OTG_TRIGB_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG0_OTG_FORCE_COUNT_NOW_CNTL                                                                0x1b3f
+#define regOTG0_OTG_FORCE_COUNT_NOW_CNTL_BASE_IDX                                                       2
+#define regOTG0_OTG_FLOW_CONTROL                                                                        0x1b40
+#define regOTG0_OTG_FLOW_CONTROL_BASE_IDX                                                               2
+#define regOTG0_OTG_STEREO_FORCE_NEXT_EYE                                                               0x1b41
+#define regOTG0_OTG_STEREO_FORCE_NEXT_EYE_BASE_IDX                                                      2
+#define regOTG0_OTG_CONTROL                                                                             0x1b43
+#define regOTG0_OTG_CONTROL_BASE_IDX                                                                    2
+#define regOTG0_OTG_DLPC_CONTROL                                                                        0x1b44
+#define regOTG0_OTG_DLPC_CONTROL_BASE_IDX                                                               2
+#define regOTG0_OTG_PIXEL_DATA_READBACK0                                                                0x1b48
+#define regOTG0_OTG_PIXEL_DATA_READBACK0_BASE_IDX                                                       2
+#define regOTG0_OTG_PIXEL_DATA_READBACK1                                                                0x1b49
+#define regOTG0_OTG_PIXEL_DATA_READBACK1_BASE_IDX                                                       2
+#define regOTG0_OTG_STATUS                                                                              0x1b4a
+#define regOTG0_OTG_STATUS_BASE_IDX                                                                     2
+#define regOTG0_OTG_STATUS_POSITION                                                                     0x1b4b
+#define regOTG0_OTG_STATUS_POSITION_BASE_IDX                                                            2
+#define regOTG0_OTG_LONG_VBLANK_STATUS                                                                  0x1b4c
+#define regOTG0_OTG_LONG_VBLANK_STATUS_BASE_IDX                                                         2
+#define regOTG0_OTG_NOM_VERT_POSITION                                                                   0x1b4d
+#define regOTG0_OTG_NOM_VERT_POSITION_BASE_IDX                                                          2
+#define regOTG0_OTG_STATUS_FRAME_COUNT                                                                  0x1b4e
+#define regOTG0_OTG_STATUS_FRAME_COUNT_BASE_IDX                                                         2
+#define regOTG0_OTG_STATUS_VF_COUNT                                                                     0x1b4f
+#define regOTG0_OTG_STATUS_VF_COUNT_BASE_IDX                                                            2
+#define regOTG0_OTG_STATUS_HV_COUNT                                                                     0x1b50
+#define regOTG0_OTG_STATUS_HV_COUNT_BASE_IDX                                                            2
+#define regOTG0_OTG_COUNT_CONTROL                                                                       0x1b51
+#define regOTG0_OTG_COUNT_CONTROL_BASE_IDX                                                              2
+#define regOTG0_OTG_COUNT_RESET                                                                         0x1b52
+#define regOTG0_OTG_COUNT_RESET_BASE_IDX                                                                2
+#define regOTG0_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE                                                        0x1b53
+#define regOTG0_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_BASE_IDX                                               2
+#define regOTG0_OTG_VERT_SYNC_CONTROL                                                                   0x1b54
+#define regOTG0_OTG_VERT_SYNC_CONTROL_BASE_IDX                                                          2
+#define regOTG0_OTG_STEREO_STATUS                                                                       0x1b55
+#define regOTG0_OTG_STEREO_STATUS_BASE_IDX                                                              2
+#define regOTG0_OTG_STEREO_CONTROL                                                                      0x1b56
+#define regOTG0_OTG_STEREO_CONTROL_BASE_IDX                                                             2
+#define regOTG0_OTG_SNAPSHOT_STATUS                                                                     0x1b57
+#define regOTG0_OTG_SNAPSHOT_STATUS_BASE_IDX                                                            2
+#define regOTG0_OTG_SNAPSHOT_CONTROL                                                                    0x1b58
+#define regOTG0_OTG_SNAPSHOT_CONTROL_BASE_IDX                                                           2
+#define regOTG0_OTG_SNAPSHOT_POSITION                                                                   0x1b59
+#define regOTG0_OTG_SNAPSHOT_POSITION_BASE_IDX                                                          2
+#define regOTG0_OTG_SNAPSHOT_FRAME                                                                      0x1b5a
+#define regOTG0_OTG_SNAPSHOT_FRAME_BASE_IDX                                                             2
+#define regOTG0_OTG_INTERRUPT_CONTROL                                                                   0x1b5b
+#define regOTG0_OTG_INTERRUPT_CONTROL_BASE_IDX                                                          2
+#define regOTG0_OTG_UPDATE_LOCK                                                                         0x1b5c
+#define regOTG0_OTG_UPDATE_LOCK_BASE_IDX                                                                2
+#define regOTG0_OTG_DOUBLE_BUFFER_CONTROL                                                               0x1b5d
+#define regOTG0_OTG_DOUBLE_BUFFER_CONTROL_BASE_IDX                                                      2
+#define regOTG0_OTG_MASTER_EN                                                                           0x1b5e
+#define regOTG0_OTG_MASTER_EN_BASE_IDX                                                                  2
+#define regOTG0_OTG_VERTICAL_INTERRUPT0_POSITION                                                        0x1b60
+#define regOTG0_OTG_VERTICAL_INTERRUPT0_POSITION_BASE_IDX                                               2
+#define regOTG0_OTG_VERTICAL_INTERRUPT0_CONTROL                                                         0x1b61
+#define regOTG0_OTG_VERTICAL_INTERRUPT0_CONTROL_BASE_IDX                                                2
+#define regOTG0_OTG_VERTICAL_INTERRUPT1_POSITION                                                        0x1b62
+#define regOTG0_OTG_VERTICAL_INTERRUPT1_POSITION_BASE_IDX                                               2
+#define regOTG0_OTG_VERTICAL_INTERRUPT1_CONTROL                                                         0x1b63
+#define regOTG0_OTG_VERTICAL_INTERRUPT1_CONTROL_BASE_IDX                                                2
+#define regOTG0_OTG_VERTICAL_INTERRUPT2_POSITION                                                        0x1b64
+#define regOTG0_OTG_VERTICAL_INTERRUPT2_POSITION_BASE_IDX                                               2
+#define regOTG0_OTG_VERTICAL_INTERRUPT2_CONTROL                                                         0x1b65
+#define regOTG0_OTG_VERTICAL_INTERRUPT2_CONTROL_BASE_IDX                                                2
+#define regOTG0_OTG_CRC_CNTL                                                                            0x1b66
+#define regOTG0_OTG_CRC_CNTL_BASE_IDX                                                                   2
+#define regOTG0_OTG_CRC0_WINDOWA_X_CONTROL                                                              0x1b67
+#define regOTG0_OTG_CRC0_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC0_WINDOWA_Y_CONTROL                                                              0x1b68
+#define regOTG0_OTG_CRC0_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC0_WINDOWB_X_CONTROL                                                              0x1b69
+#define regOTG0_OTG_CRC0_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC0_WINDOWB_Y_CONTROL                                                              0x1b6a
+#define regOTG0_OTG_CRC0_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC0_DATA_R                                                                         0x1b6b
+#define regOTG0_OTG_CRC0_DATA_R_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC0_DATA_G                                                                         0x1b6c
+#define regOTG0_OTG_CRC0_DATA_G_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC0_DATA_B                                                                         0x1b6d
+#define regOTG0_OTG_CRC0_DATA_B_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC0_DATA_C                                                                         0x1b6e
+#define regOTG0_OTG_CRC0_DATA_C_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC1_WINDOWA_X_CONTROL                                                              0x1b6f
+#define regOTG0_OTG_CRC1_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC1_WINDOWA_Y_CONTROL                                                              0x1b70
+#define regOTG0_OTG_CRC1_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC1_WINDOWB_X_CONTROL                                                              0x1b71
+#define regOTG0_OTG_CRC1_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC1_WINDOWB_Y_CONTROL                                                              0x1b72
+#define regOTG0_OTG_CRC1_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC1_DATA_R                                                                         0x1b73
+#define regOTG0_OTG_CRC1_DATA_R_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC1_DATA_G                                                                         0x1b74
+#define regOTG0_OTG_CRC1_DATA_G_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC1_DATA_B                                                                         0x1b75
+#define regOTG0_OTG_CRC1_DATA_B_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC1_DATA_C                                                                         0x1b76
+#define regOTG0_OTG_CRC1_DATA_C_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC2_DATA_R                                                                         0x1b77
+#define regOTG0_OTG_CRC2_DATA_R_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC2_DATA_G                                                                         0x1b78
+#define regOTG0_OTG_CRC2_DATA_G_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC2_DATA_B                                                                         0x1b79
+#define regOTG0_OTG_CRC2_DATA_B_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC2_DATA_C                                                                         0x1b7a
+#define regOTG0_OTG_CRC2_DATA_C_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC3_DATA_R                                                                         0x1b7b
+#define regOTG0_OTG_CRC3_DATA_R_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC3_DATA_G                                                                         0x1b7c
+#define regOTG0_OTG_CRC3_DATA_G_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC3_DATA_B                                                                         0x1b7d
+#define regOTG0_OTG_CRC3_DATA_B_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC3_DATA_C                                                                         0x1b7e
+#define regOTG0_OTG_CRC3_DATA_C_BASE_IDX                                                                2
+#define regOTG0_OTG_CRC_SIG_RED_GREEN_MASK                                                              0x1b7f
+#define regOTG0_OTG_CRC_SIG_RED_GREEN_MASK_BASE_IDX                                                     2
+#define regOTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK                                                           0x1b80
+#define regOTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK_BASE_IDX                                                  2
+#define regOTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK                                                     0x1b81
+#define regOTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK                                                     0x1b82
+#define regOTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK                                                     0x1b83
+#define regOTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK                                                     0x1b84
+#define regOTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK                                                     0x1b85
+#define regOTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK                                                     0x1b86
+#define regOTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK                                                     0x1b87
+#define regOTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK                                                     0x1b88
+#define regOTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG0_OTG_STATIC_SCREEN_CONTROL                                                               0x1b89
+#define regOTG0_OTG_STATIC_SCREEN_CONTROL_BASE_IDX                                                      2
+#define regOTG0_OTG_3D_STRUCTURE_CONTROL                                                                0x1b8a
+#define regOTG0_OTG_3D_STRUCTURE_CONTROL_BASE_IDX                                                       2
+#define regOTG0_OTG_CLOCK_CONTROL                                                                       0x1b8d
+#define regOTG0_OTG_CLOCK_CONTROL_BASE_IDX                                                              2
+#define regOTG0_OTG_VSTARTUP_PARAM                                                                      0x1b8e
+#define regOTG0_OTG_VSTARTUP_PARAM_BASE_IDX                                                             2
+#define regOTG0_OTG_VUPDATE_PARAM                                                                       0x1b8f
+#define regOTG0_OTG_VUPDATE_PARAM_BASE_IDX                                                              2
+#define regOTG0_OTG_VREADY_PARAM                                                                        0x1b90
+#define regOTG0_OTG_VREADY_PARAM_BASE_IDX                                                               2
+#define regOTG0_OTG_GLOBAL_SYNC_STATUS                                                                  0x1b91
+#define regOTG0_OTG_GLOBAL_SYNC_STATUS_BASE_IDX                                                         2
+#define regOTG0_OTG_MASTER_UPDATE_LOCK                                                                  0x1b92
+#define regOTG0_OTG_MASTER_UPDATE_LOCK_BASE_IDX                                                         2
+#define regOTG0_OTG_GSL_CONTROL                                                                         0x1b93
+#define regOTG0_OTG_GSL_CONTROL_BASE_IDX                                                                2
+#define regOTG0_OTG_GSL_WINDOW_X                                                                        0x1b94
+#define regOTG0_OTG_GSL_WINDOW_X_BASE_IDX                                                               2
+#define regOTG0_OTG_GSL_WINDOW_Y                                                                        0x1b95
+#define regOTG0_OTG_GSL_WINDOW_Y_BASE_IDX                                                               2
+#define regOTG0_OTG_VUPDATE_KEEPOUT                                                                     0x1b96
+#define regOTG0_OTG_VUPDATE_KEEPOUT_BASE_IDX                                                            2
+#define regOTG0_OTG_GLOBAL_CONTROL0                                                                     0x1b97
+#define regOTG0_OTG_GLOBAL_CONTROL0_BASE_IDX                                                            2
+#define regOTG0_OTG_GLOBAL_CONTROL1                                                                     0x1b98
+#define regOTG0_OTG_GLOBAL_CONTROL1_BASE_IDX                                                            2
+#define regOTG0_OTG_GLOBAL_CONTROL2                                                                     0x1b99
+#define regOTG0_OTG_GLOBAL_CONTROL2_BASE_IDX                                                            2
+#define regOTG0_OTG_GLOBAL_CONTROL3                                                                     0x1b9a
+#define regOTG0_OTG_GLOBAL_CONTROL3_BASE_IDX                                                            2
+#define regOTG0_OTG_GLOBAL_CONTROL4                                                                     0x1b9b
+#define regOTG0_OTG_GLOBAL_CONTROL4_BASE_IDX                                                            2
+#define regOTG0_OTG_TRIG_MANUAL_CONTROL                                                                 0x1b9c
+#define regOTG0_OTG_TRIG_MANUAL_CONTROL_BASE_IDX                                                        2
+#define regOTG0_OTG_MANUAL_FLOW_CONTROL                                                                 0x1b9d
+#define regOTG0_OTG_MANUAL_FLOW_CONTROL_BASE_IDX                                                        2
+#define regOTG0_OTG_DRR_TIMING_INT_STATUS                                                               0x1b9e
+#define regOTG0_OTG_DRR_TIMING_INT_STATUS_BASE_IDX                                                      2
+#define regOTG0_OTG_DRR_V_TOTAL_REACH_RANGE                                                             0x1b9f
+#define regOTG0_OTG_DRR_V_TOTAL_REACH_RANGE_BASE_IDX                                                    2
+#define regOTG0_OTG_DRR_V_TOTAL_CHANGE                                                                  0x1ba0
+#define regOTG0_OTG_DRR_V_TOTAL_CHANGE_BASE_IDX                                                         2
+#define regOTG0_OTG_DRR_TRIGGER_WINDOW                                                                  0x1ba1
+#define regOTG0_OTG_DRR_TRIGGER_WINDOW_BASE_IDX                                                         2
+#define regOTG0_OTG_DRR_CONTROL                                                                         0x1ba2
+#define regOTG0_OTG_DRR_CONTROL_BASE_IDX                                                                2
+#define regOTG0_OTG_DRR_CONTOL2                                                                         0x1ba3
+#define regOTG0_OTG_DRR_CONTOL2_BASE_IDX                                                                2
+#define regOTG0_OTG_M_CONST_DTO0                                                                        0x1ba4
+#define regOTG0_OTG_M_CONST_DTO0_BASE_IDX                                                               2
+#define regOTG0_OTG_M_CONST_DTO1                                                                        0x1ba5
+#define regOTG0_OTG_M_CONST_DTO1_BASE_IDX                                                               2
+#define regOTG0_OTG_PIPE_UPDATE_STATUS                                                                  0x1ba7
+#define regOTG0_OTG_PIPE_UPDATE_STATUS_BASE_IDX                                                         2
+#define regOTG0_OTG_PSTATE_REGISTER                                                                     0x1ba8
+#define regOTG0_OTG_PSTATE_REGISTER_BASE_IDX                                                            2
+#define regOTG0_OTG_ENCRYPTION                                                                          0x1ba9
+#define regOTG0_OTG_ENCRYPTION_BASE_IDX                                                                 2
+#define regOTG0_OTG_TEST_DEBUG_INDEX                                                                    0x1bab
+#define regOTG0_OTG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regOTG0_OTG_TEST_DEBUG_DATA                                                                     0x1bac
+#define regOTG0_OTG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_optc_otg1_dispdec
+// base address: 0x220
+#define regOTG1_OTG_H_TOTAL                                                                             0x1bb2
+#define regOTG1_OTG_H_TOTAL_BASE_IDX                                                                    2
+#define regOTG1_OTG_H_BLANK_START_END                                                                   0x1bb3
+#define regOTG1_OTG_H_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG1_OTG_H_SYNC_A                                                                            0x1bb4
+#define regOTG1_OTG_H_SYNC_A_BASE_IDX                                                                   2
+#define regOTG1_OTG_H_SYNC_A_CNTL                                                                       0x1bb5
+#define regOTG1_OTG_H_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG1_OTG_H_TIMING_CNTL                                                                       0x1bb6
+#define regOTG1_OTG_H_TIMING_CNTL_BASE_IDX                                                              2
+#define regOTG1_OTG_V_TOTAL                                                                             0x1bb7
+#define regOTG1_OTG_V_TOTAL_BASE_IDX                                                                    2
+#define regOTG1_OTG_V_TOTAL_MIN                                                                         0x1bb8
+#define regOTG1_OTG_V_TOTAL_MIN_BASE_IDX                                                                2
+#define regOTG1_OTG_V_TOTAL_MAX                                                                         0x1bb9
+#define regOTG1_OTG_V_TOTAL_MAX_BASE_IDX                                                                2
+#define regOTG1_OTG_V_TOTAL_MID                                                                         0x1bba
+#define regOTG1_OTG_V_TOTAL_MID_BASE_IDX                                                                2
+#define regOTG1_OTG_V_TOTAL_CONTROL                                                                     0x1bbb
+#define regOTG1_OTG_V_TOTAL_CONTROL_BASE_IDX                                                            2
+#define regOTG1_OTG_V_COUNT_STOP_CONTROL                                                                0x1bbc
+#define regOTG1_OTG_V_COUNT_STOP_CONTROL_BASE_IDX                                                       2
+#define regOTG1_OTG_V_COUNT_STOP_CONTROL2                                                               0x1bbd
+#define regOTG1_OTG_V_COUNT_STOP_CONTROL2_BASE_IDX                                                      2
+#define regOTG1_OTG_V_TOTAL_INT_STATUS                                                                  0x1bbe
+#define regOTG1_OTG_V_TOTAL_INT_STATUS_BASE_IDX                                                         2
+#define regOTG1_OTG_VSYNC_NOM_INT_STATUS                                                                0x1bbf
+#define regOTG1_OTG_VSYNC_NOM_INT_STATUS_BASE_IDX                                                       2
+#define regOTG1_OTG_V_BLANK_START_END                                                                   0x1bc0
+#define regOTG1_OTG_V_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG1_OTG_V_SYNC_A                                                                            0x1bc1
+#define regOTG1_OTG_V_SYNC_A_BASE_IDX                                                                   2
+#define regOTG1_OTG_V_SYNC_A_CNTL                                                                       0x1bc2
+#define regOTG1_OTG_V_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG1_OTG_TRIGA_CNTL                                                                          0x1bc3
+#define regOTG1_OTG_TRIGA_CNTL_BASE_IDX                                                                 2
+#define regOTG1_OTG_TRIGA_MANUAL_TRIG                                                                   0x1bc4
+#define regOTG1_OTG_TRIGA_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG1_OTG_TRIGB_CNTL                                                                          0x1bc5
+#define regOTG1_OTG_TRIGB_CNTL_BASE_IDX                                                                 2
+#define regOTG1_OTG_TRIGB_MANUAL_TRIG                                                                   0x1bc6
+#define regOTG1_OTG_TRIGB_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG1_OTG_FORCE_COUNT_NOW_CNTL                                                                0x1bc7
+#define regOTG1_OTG_FORCE_COUNT_NOW_CNTL_BASE_IDX                                                       2
+#define regOTG1_OTG_FLOW_CONTROL                                                                        0x1bc8
+#define regOTG1_OTG_FLOW_CONTROL_BASE_IDX                                                               2
+#define regOTG1_OTG_STEREO_FORCE_NEXT_EYE                                                               0x1bc9
+#define regOTG1_OTG_STEREO_FORCE_NEXT_EYE_BASE_IDX                                                      2
+#define regOTG1_OTG_CONTROL                                                                             0x1bcb
+#define regOTG1_OTG_CONTROL_BASE_IDX                                                                    2
+#define regOTG1_OTG_DLPC_CONTROL                                                                        0x1bcc
+#define regOTG1_OTG_DLPC_CONTROL_BASE_IDX                                                               2
+#define regOTG1_OTG_PIXEL_DATA_READBACK0                                                                0x1bd0
+#define regOTG1_OTG_PIXEL_DATA_READBACK0_BASE_IDX                                                       2
+#define regOTG1_OTG_PIXEL_DATA_READBACK1                                                                0x1bd1
+#define regOTG1_OTG_PIXEL_DATA_READBACK1_BASE_IDX                                                       2
+#define regOTG1_OTG_STATUS                                                                              0x1bd2
+#define regOTG1_OTG_STATUS_BASE_IDX                                                                     2
+#define regOTG1_OTG_STATUS_POSITION                                                                     0x1bd3
+#define regOTG1_OTG_STATUS_POSITION_BASE_IDX                                                            2
+#define regOTG1_OTG_LONG_VBLANK_STATUS                                                                  0x1bd4
+#define regOTG1_OTG_LONG_VBLANK_STATUS_BASE_IDX                                                         2
+#define regOTG1_OTG_NOM_VERT_POSITION                                                                   0x1bd5
+#define regOTG1_OTG_NOM_VERT_POSITION_BASE_IDX                                                          2
+#define regOTG1_OTG_STATUS_FRAME_COUNT                                                                  0x1bd6
+#define regOTG1_OTG_STATUS_FRAME_COUNT_BASE_IDX                                                         2
+#define regOTG1_OTG_STATUS_VF_COUNT                                                                     0x1bd7
+#define regOTG1_OTG_STATUS_VF_COUNT_BASE_IDX                                                            2
+#define regOTG1_OTG_STATUS_HV_COUNT                                                                     0x1bd8
+#define regOTG1_OTG_STATUS_HV_COUNT_BASE_IDX                                                            2
+#define regOTG1_OTG_COUNT_CONTROL                                                                       0x1bd9
+#define regOTG1_OTG_COUNT_CONTROL_BASE_IDX                                                              2
+#define regOTG1_OTG_COUNT_RESET                                                                         0x1bda
+#define regOTG1_OTG_COUNT_RESET_BASE_IDX                                                                2
+#define regOTG1_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE                                                        0x1bdb
+#define regOTG1_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_BASE_IDX                                               2
+#define regOTG1_OTG_VERT_SYNC_CONTROL                                                                   0x1bdc
+#define regOTG1_OTG_VERT_SYNC_CONTROL_BASE_IDX                                                          2
+#define regOTG1_OTG_STEREO_STATUS                                                                       0x1bdd
+#define regOTG1_OTG_STEREO_STATUS_BASE_IDX                                                              2
+#define regOTG1_OTG_STEREO_CONTROL                                                                      0x1bde
+#define regOTG1_OTG_STEREO_CONTROL_BASE_IDX                                                             2
+#define regOTG1_OTG_SNAPSHOT_STATUS                                                                     0x1bdf
+#define regOTG1_OTG_SNAPSHOT_STATUS_BASE_IDX                                                            2
+#define regOTG1_OTG_SNAPSHOT_CONTROL                                                                    0x1be0
+#define regOTG1_OTG_SNAPSHOT_CONTROL_BASE_IDX                                                           2
+#define regOTG1_OTG_SNAPSHOT_POSITION                                                                   0x1be1
+#define regOTG1_OTG_SNAPSHOT_POSITION_BASE_IDX                                                          2
+#define regOTG1_OTG_SNAPSHOT_FRAME                                                                      0x1be2
+#define regOTG1_OTG_SNAPSHOT_FRAME_BASE_IDX                                                             2
+#define regOTG1_OTG_INTERRUPT_CONTROL                                                                   0x1be3
+#define regOTG1_OTG_INTERRUPT_CONTROL_BASE_IDX                                                          2
+#define regOTG1_OTG_UPDATE_LOCK                                                                         0x1be4
+#define regOTG1_OTG_UPDATE_LOCK_BASE_IDX                                                                2
+#define regOTG1_OTG_DOUBLE_BUFFER_CONTROL                                                               0x1be5
+#define regOTG1_OTG_DOUBLE_BUFFER_CONTROL_BASE_IDX                                                      2
+#define regOTG1_OTG_MASTER_EN                                                                           0x1be6
+#define regOTG1_OTG_MASTER_EN_BASE_IDX                                                                  2
+#define regOTG1_OTG_VERTICAL_INTERRUPT0_POSITION                                                        0x1be8
+#define regOTG1_OTG_VERTICAL_INTERRUPT0_POSITION_BASE_IDX                                               2
+#define regOTG1_OTG_VERTICAL_INTERRUPT0_CONTROL                                                         0x1be9
+#define regOTG1_OTG_VERTICAL_INTERRUPT0_CONTROL_BASE_IDX                                                2
+#define regOTG1_OTG_VERTICAL_INTERRUPT1_POSITION                                                        0x1bea
+#define regOTG1_OTG_VERTICAL_INTERRUPT1_POSITION_BASE_IDX                                               2
+#define regOTG1_OTG_VERTICAL_INTERRUPT1_CONTROL                                                         0x1beb
+#define regOTG1_OTG_VERTICAL_INTERRUPT1_CONTROL_BASE_IDX                                                2
+#define regOTG1_OTG_VERTICAL_INTERRUPT2_POSITION                                                        0x1bec
+#define regOTG1_OTG_VERTICAL_INTERRUPT2_POSITION_BASE_IDX                                               2
+#define regOTG1_OTG_VERTICAL_INTERRUPT2_CONTROL                                                         0x1bed
+#define regOTG1_OTG_VERTICAL_INTERRUPT2_CONTROL_BASE_IDX                                                2
+#define regOTG1_OTG_CRC_CNTL                                                                            0x1bee
+#define regOTG1_OTG_CRC_CNTL_BASE_IDX                                                                   2
+#define regOTG1_OTG_CRC0_WINDOWA_X_CONTROL                                                              0x1bef
+#define regOTG1_OTG_CRC0_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC0_WINDOWA_Y_CONTROL                                                              0x1bf0
+#define regOTG1_OTG_CRC0_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC0_WINDOWB_X_CONTROL                                                              0x1bf1
+#define regOTG1_OTG_CRC0_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC0_WINDOWB_Y_CONTROL                                                              0x1bf2
+#define regOTG1_OTG_CRC0_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC0_DATA_R                                                                         0x1bf3
+#define regOTG1_OTG_CRC0_DATA_R_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC0_DATA_G                                                                         0x1bf4
+#define regOTG1_OTG_CRC0_DATA_G_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC0_DATA_B                                                                         0x1bf5
+#define regOTG1_OTG_CRC0_DATA_B_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC0_DATA_C                                                                         0x1bf6
+#define regOTG1_OTG_CRC0_DATA_C_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC1_WINDOWA_X_CONTROL                                                              0x1bf7
+#define regOTG1_OTG_CRC1_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC1_WINDOWA_Y_CONTROL                                                              0x1bf8
+#define regOTG1_OTG_CRC1_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC1_WINDOWB_X_CONTROL                                                              0x1bf9
+#define regOTG1_OTG_CRC1_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC1_WINDOWB_Y_CONTROL                                                              0x1bfa
+#define regOTG1_OTG_CRC1_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC1_DATA_R                                                                         0x1bfb
+#define regOTG1_OTG_CRC1_DATA_R_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC1_DATA_G                                                                         0x1bfc
+#define regOTG1_OTG_CRC1_DATA_G_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC1_DATA_B                                                                         0x1bfd
+#define regOTG1_OTG_CRC1_DATA_B_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC1_DATA_C                                                                         0x1bfe
+#define regOTG1_OTG_CRC1_DATA_C_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC2_DATA_R                                                                         0x1bff
+#define regOTG1_OTG_CRC2_DATA_R_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC2_DATA_G                                                                         0x1c00
+#define regOTG1_OTG_CRC2_DATA_G_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC2_DATA_B                                                                         0x1c01
+#define regOTG1_OTG_CRC2_DATA_B_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC2_DATA_C                                                                         0x1c02
+#define regOTG1_OTG_CRC2_DATA_C_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC3_DATA_R                                                                         0x1c03
+#define regOTG1_OTG_CRC3_DATA_R_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC3_DATA_G                                                                         0x1c04
+#define regOTG1_OTG_CRC3_DATA_G_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC3_DATA_B                                                                         0x1c05
+#define regOTG1_OTG_CRC3_DATA_B_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC3_DATA_C                                                                         0x1c06
+#define regOTG1_OTG_CRC3_DATA_C_BASE_IDX                                                                2
+#define regOTG1_OTG_CRC_SIG_RED_GREEN_MASK                                                              0x1c07
+#define regOTG1_OTG_CRC_SIG_RED_GREEN_MASK_BASE_IDX                                                     2
+#define regOTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK                                                           0x1c08
+#define regOTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK_BASE_IDX                                                  2
+#define regOTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK                                                     0x1c09
+#define regOTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK                                                     0x1c0a
+#define regOTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK                                                     0x1c0b
+#define regOTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK                                                     0x1c0c
+#define regOTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK                                                     0x1c0d
+#define regOTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK                                                     0x1c0e
+#define regOTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK                                                     0x1c0f
+#define regOTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK                                                     0x1c10
+#define regOTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG1_OTG_STATIC_SCREEN_CONTROL                                                               0x1c11
+#define regOTG1_OTG_STATIC_SCREEN_CONTROL_BASE_IDX                                                      2
+#define regOTG1_OTG_3D_STRUCTURE_CONTROL                                                                0x1c12
+#define regOTG1_OTG_3D_STRUCTURE_CONTROL_BASE_IDX                                                       2
+#define regOTG1_OTG_CLOCK_CONTROL                                                                       0x1c15
+#define regOTG1_OTG_CLOCK_CONTROL_BASE_IDX                                                              2
+#define regOTG1_OTG_VSTARTUP_PARAM                                                                      0x1c16
+#define regOTG1_OTG_VSTARTUP_PARAM_BASE_IDX                                                             2
+#define regOTG1_OTG_VUPDATE_PARAM                                                                       0x1c17
+#define regOTG1_OTG_VUPDATE_PARAM_BASE_IDX                                                              2
+#define regOTG1_OTG_VREADY_PARAM                                                                        0x1c18
+#define regOTG1_OTG_VREADY_PARAM_BASE_IDX                                                               2
+#define regOTG1_OTG_GLOBAL_SYNC_STATUS                                                                  0x1c19
+#define regOTG1_OTG_GLOBAL_SYNC_STATUS_BASE_IDX                                                         2
+#define regOTG1_OTG_MASTER_UPDATE_LOCK                                                                  0x1c1a
+#define regOTG1_OTG_MASTER_UPDATE_LOCK_BASE_IDX                                                         2
+#define regOTG1_OTG_GSL_CONTROL                                                                         0x1c1b
+#define regOTG1_OTG_GSL_CONTROL_BASE_IDX                                                                2
+#define regOTG1_OTG_GSL_WINDOW_X                                                                        0x1c1c
+#define regOTG1_OTG_GSL_WINDOW_X_BASE_IDX                                                               2
+#define regOTG1_OTG_GSL_WINDOW_Y                                                                        0x1c1d
+#define regOTG1_OTG_GSL_WINDOW_Y_BASE_IDX                                                               2
+#define regOTG1_OTG_VUPDATE_KEEPOUT                                                                     0x1c1e
+#define regOTG1_OTG_VUPDATE_KEEPOUT_BASE_IDX                                                            2
+#define regOTG1_OTG_GLOBAL_CONTROL0                                                                     0x1c1f
+#define regOTG1_OTG_GLOBAL_CONTROL0_BASE_IDX                                                            2
+#define regOTG1_OTG_GLOBAL_CONTROL1                                                                     0x1c20
+#define regOTG1_OTG_GLOBAL_CONTROL1_BASE_IDX                                                            2
+#define regOTG1_OTG_GLOBAL_CONTROL2                                                                     0x1c21
+#define regOTG1_OTG_GLOBAL_CONTROL2_BASE_IDX                                                            2
+#define regOTG1_OTG_GLOBAL_CONTROL3                                                                     0x1c22
+#define regOTG1_OTG_GLOBAL_CONTROL3_BASE_IDX                                                            2
+#define regOTG1_OTG_GLOBAL_CONTROL4                                                                     0x1c23
+#define regOTG1_OTG_GLOBAL_CONTROL4_BASE_IDX                                                            2
+#define regOTG1_OTG_TRIG_MANUAL_CONTROL                                                                 0x1c24
+#define regOTG1_OTG_TRIG_MANUAL_CONTROL_BASE_IDX                                                        2
+#define regOTG1_OTG_MANUAL_FLOW_CONTROL                                                                 0x1c25
+#define regOTG1_OTG_MANUAL_FLOW_CONTROL_BASE_IDX                                                        2
+#define regOTG1_OTG_DRR_TIMING_INT_STATUS                                                               0x1c26
+#define regOTG1_OTG_DRR_TIMING_INT_STATUS_BASE_IDX                                                      2
+#define regOTG1_OTG_DRR_V_TOTAL_REACH_RANGE                                                             0x1c27
+#define regOTG1_OTG_DRR_V_TOTAL_REACH_RANGE_BASE_IDX                                                    2
+#define regOTG1_OTG_DRR_V_TOTAL_CHANGE                                                                  0x1c28
+#define regOTG1_OTG_DRR_V_TOTAL_CHANGE_BASE_IDX                                                         2
+#define regOTG1_OTG_DRR_TRIGGER_WINDOW                                                                  0x1c29
+#define regOTG1_OTG_DRR_TRIGGER_WINDOW_BASE_IDX                                                         2
+#define regOTG1_OTG_DRR_CONTROL                                                                         0x1c2a
+#define regOTG1_OTG_DRR_CONTROL_BASE_IDX                                                                2
+#define regOTG1_OTG_DRR_CONTOL2                                                                         0x1c2b
+#define regOTG1_OTG_DRR_CONTOL2_BASE_IDX                                                                2
+#define regOTG1_OTG_M_CONST_DTO0                                                                        0x1c2c
+#define regOTG1_OTG_M_CONST_DTO0_BASE_IDX                                                               2
+#define regOTG1_OTG_M_CONST_DTO1                                                                        0x1c2d
+#define regOTG1_OTG_M_CONST_DTO1_BASE_IDX                                                               2
+#define regOTG1_OTG_PIPE_UPDATE_STATUS                                                                  0x1c2f
+#define regOTG1_OTG_PIPE_UPDATE_STATUS_BASE_IDX                                                         2
+#define regOTG1_OTG_PSTATE_REGISTER                                                                     0x1c30
+#define regOTG1_OTG_PSTATE_REGISTER_BASE_IDX                                                            2
+#define regOTG1_OTG_ENCRYPTION                                                                          0x1c31
+#define regOTG1_OTG_ENCRYPTION_BASE_IDX                                                                 2
+#define regOTG1_OTG_TEST_DEBUG_INDEX                                                                    0x1c33
+#define regOTG1_OTG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regOTG1_OTG_TEST_DEBUG_DATA                                                                     0x1c34
+#define regOTG1_OTG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_optc_otg2_dispdec
+// base address: 0x440
+#define regOTG2_OTG_H_TOTAL                                                                             0x1c3a
+#define regOTG2_OTG_H_TOTAL_BASE_IDX                                                                    2
+#define regOTG2_OTG_H_BLANK_START_END                                                                   0x1c3b
+#define regOTG2_OTG_H_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG2_OTG_H_SYNC_A                                                                            0x1c3c
+#define regOTG2_OTG_H_SYNC_A_BASE_IDX                                                                   2
+#define regOTG2_OTG_H_SYNC_A_CNTL                                                                       0x1c3d
+#define regOTG2_OTG_H_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG2_OTG_H_TIMING_CNTL                                                                       0x1c3e
+#define regOTG2_OTG_H_TIMING_CNTL_BASE_IDX                                                              2
+#define regOTG2_OTG_V_TOTAL                                                                             0x1c3f
+#define regOTG2_OTG_V_TOTAL_BASE_IDX                                                                    2
+#define regOTG2_OTG_V_TOTAL_MIN                                                                         0x1c40
+#define regOTG2_OTG_V_TOTAL_MIN_BASE_IDX                                                                2
+#define regOTG2_OTG_V_TOTAL_MAX                                                                         0x1c41
+#define regOTG2_OTG_V_TOTAL_MAX_BASE_IDX                                                                2
+#define regOTG2_OTG_V_TOTAL_MID                                                                         0x1c42
+#define regOTG2_OTG_V_TOTAL_MID_BASE_IDX                                                                2
+#define regOTG2_OTG_V_TOTAL_CONTROL                                                                     0x1c43
+#define regOTG2_OTG_V_TOTAL_CONTROL_BASE_IDX                                                            2
+#define regOTG2_OTG_V_COUNT_STOP_CONTROL                                                                0x1c44
+#define regOTG2_OTG_V_COUNT_STOP_CONTROL_BASE_IDX                                                       2
+#define regOTG2_OTG_V_COUNT_STOP_CONTROL2                                                               0x1c45
+#define regOTG2_OTG_V_COUNT_STOP_CONTROL2_BASE_IDX                                                      2
+#define regOTG2_OTG_V_TOTAL_INT_STATUS                                                                  0x1c46
+#define regOTG2_OTG_V_TOTAL_INT_STATUS_BASE_IDX                                                         2
+#define regOTG2_OTG_VSYNC_NOM_INT_STATUS                                                                0x1c47
+#define regOTG2_OTG_VSYNC_NOM_INT_STATUS_BASE_IDX                                                       2
+#define regOTG2_OTG_V_BLANK_START_END                                                                   0x1c48
+#define regOTG2_OTG_V_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG2_OTG_V_SYNC_A                                                                            0x1c49
+#define regOTG2_OTG_V_SYNC_A_BASE_IDX                                                                   2
+#define regOTG2_OTG_V_SYNC_A_CNTL                                                                       0x1c4a
+#define regOTG2_OTG_V_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG2_OTG_TRIGA_CNTL                                                                          0x1c4b
+#define regOTG2_OTG_TRIGA_CNTL_BASE_IDX                                                                 2
+#define regOTG2_OTG_TRIGA_MANUAL_TRIG                                                                   0x1c4c
+#define regOTG2_OTG_TRIGA_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG2_OTG_TRIGB_CNTL                                                                          0x1c4d
+#define regOTG2_OTG_TRIGB_CNTL_BASE_IDX                                                                 2
+#define regOTG2_OTG_TRIGB_MANUAL_TRIG                                                                   0x1c4e
+#define regOTG2_OTG_TRIGB_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG2_OTG_FORCE_COUNT_NOW_CNTL                                                                0x1c4f
+#define regOTG2_OTG_FORCE_COUNT_NOW_CNTL_BASE_IDX                                                       2
+#define regOTG2_OTG_FLOW_CONTROL                                                                        0x1c50
+#define regOTG2_OTG_FLOW_CONTROL_BASE_IDX                                                               2
+#define regOTG2_OTG_STEREO_FORCE_NEXT_EYE                                                               0x1c51
+#define regOTG2_OTG_STEREO_FORCE_NEXT_EYE_BASE_IDX                                                      2
+#define regOTG2_OTG_CONTROL                                                                             0x1c53
+#define regOTG2_OTG_CONTROL_BASE_IDX                                                                    2
+#define regOTG2_OTG_DLPC_CONTROL                                                                        0x1c54
+#define regOTG2_OTG_DLPC_CONTROL_BASE_IDX                                                               2
+#define regOTG2_OTG_PIXEL_DATA_READBACK0                                                                0x1c58
+#define regOTG2_OTG_PIXEL_DATA_READBACK0_BASE_IDX                                                       2
+#define regOTG2_OTG_PIXEL_DATA_READBACK1                                                                0x1c59
+#define regOTG2_OTG_PIXEL_DATA_READBACK1_BASE_IDX                                                       2
+#define regOTG2_OTG_STATUS                                                                              0x1c5a
+#define regOTG2_OTG_STATUS_BASE_IDX                                                                     2
+#define regOTG2_OTG_STATUS_POSITION                                                                     0x1c5b
+#define regOTG2_OTG_STATUS_POSITION_BASE_IDX                                                            2
+#define regOTG2_OTG_LONG_VBLANK_STATUS                                                                  0x1c5c
+#define regOTG2_OTG_LONG_VBLANK_STATUS_BASE_IDX                                                         2
+#define regOTG2_OTG_NOM_VERT_POSITION                                                                   0x1c5d
+#define regOTG2_OTG_NOM_VERT_POSITION_BASE_IDX                                                          2
+#define regOTG2_OTG_STATUS_FRAME_COUNT                                                                  0x1c5e
+#define regOTG2_OTG_STATUS_FRAME_COUNT_BASE_IDX                                                         2
+#define regOTG2_OTG_STATUS_VF_COUNT                                                                     0x1c5f
+#define regOTG2_OTG_STATUS_VF_COUNT_BASE_IDX                                                            2
+#define regOTG2_OTG_STATUS_HV_COUNT                                                                     0x1c60
+#define regOTG2_OTG_STATUS_HV_COUNT_BASE_IDX                                                            2
+#define regOTG2_OTG_COUNT_CONTROL                                                                       0x1c61
+#define regOTG2_OTG_COUNT_CONTROL_BASE_IDX                                                              2
+#define regOTG2_OTG_COUNT_RESET                                                                         0x1c62
+#define regOTG2_OTG_COUNT_RESET_BASE_IDX                                                                2
+#define regOTG2_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE                                                        0x1c63
+#define regOTG2_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_BASE_IDX                                               2
+#define regOTG2_OTG_VERT_SYNC_CONTROL                                                                   0x1c64
+#define regOTG2_OTG_VERT_SYNC_CONTROL_BASE_IDX                                                          2
+#define regOTG2_OTG_STEREO_STATUS                                                                       0x1c65
+#define regOTG2_OTG_STEREO_STATUS_BASE_IDX                                                              2
+#define regOTG2_OTG_STEREO_CONTROL                                                                      0x1c66
+#define regOTG2_OTG_STEREO_CONTROL_BASE_IDX                                                             2
+#define regOTG2_OTG_SNAPSHOT_STATUS                                                                     0x1c67
+#define regOTG2_OTG_SNAPSHOT_STATUS_BASE_IDX                                                            2
+#define regOTG2_OTG_SNAPSHOT_CONTROL                                                                    0x1c68
+#define regOTG2_OTG_SNAPSHOT_CONTROL_BASE_IDX                                                           2
+#define regOTG2_OTG_SNAPSHOT_POSITION                                                                   0x1c69
+#define regOTG2_OTG_SNAPSHOT_POSITION_BASE_IDX                                                          2
+#define regOTG2_OTG_SNAPSHOT_FRAME                                                                      0x1c6a
+#define regOTG2_OTG_SNAPSHOT_FRAME_BASE_IDX                                                             2
+#define regOTG2_OTG_INTERRUPT_CONTROL                                                                   0x1c6b
+#define regOTG2_OTG_INTERRUPT_CONTROL_BASE_IDX                                                          2
+#define regOTG2_OTG_UPDATE_LOCK                                                                         0x1c6c
+#define regOTG2_OTG_UPDATE_LOCK_BASE_IDX                                                                2
+#define regOTG2_OTG_DOUBLE_BUFFER_CONTROL                                                               0x1c6d
+#define regOTG2_OTG_DOUBLE_BUFFER_CONTROL_BASE_IDX                                                      2
+#define regOTG2_OTG_MASTER_EN                                                                           0x1c6e
+#define regOTG2_OTG_MASTER_EN_BASE_IDX                                                                  2
+#define regOTG2_OTG_VERTICAL_INTERRUPT0_POSITION                                                        0x1c70
+#define regOTG2_OTG_VERTICAL_INTERRUPT0_POSITION_BASE_IDX                                               2
+#define regOTG2_OTG_VERTICAL_INTERRUPT0_CONTROL                                                         0x1c71
+#define regOTG2_OTG_VERTICAL_INTERRUPT0_CONTROL_BASE_IDX                                                2
+#define regOTG2_OTG_VERTICAL_INTERRUPT1_POSITION                                                        0x1c72
+#define regOTG2_OTG_VERTICAL_INTERRUPT1_POSITION_BASE_IDX                                               2
+#define regOTG2_OTG_VERTICAL_INTERRUPT1_CONTROL                                                         0x1c73
+#define regOTG2_OTG_VERTICAL_INTERRUPT1_CONTROL_BASE_IDX                                                2
+#define regOTG2_OTG_VERTICAL_INTERRUPT2_POSITION                                                        0x1c74
+#define regOTG2_OTG_VERTICAL_INTERRUPT2_POSITION_BASE_IDX                                               2
+#define regOTG2_OTG_VERTICAL_INTERRUPT2_CONTROL                                                         0x1c75
+#define regOTG2_OTG_VERTICAL_INTERRUPT2_CONTROL_BASE_IDX                                                2
+#define regOTG2_OTG_CRC_CNTL                                                                            0x1c76
+#define regOTG2_OTG_CRC_CNTL_BASE_IDX                                                                   2
+#define regOTG2_OTG_CRC0_WINDOWA_X_CONTROL                                                              0x1c77
+#define regOTG2_OTG_CRC0_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC0_WINDOWA_Y_CONTROL                                                              0x1c78
+#define regOTG2_OTG_CRC0_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC0_WINDOWB_X_CONTROL                                                              0x1c79
+#define regOTG2_OTG_CRC0_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC0_WINDOWB_Y_CONTROL                                                              0x1c7a
+#define regOTG2_OTG_CRC0_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC0_DATA_R                                                                         0x1c7b
+#define regOTG2_OTG_CRC0_DATA_R_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC0_DATA_G                                                                         0x1c7c
+#define regOTG2_OTG_CRC0_DATA_G_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC0_DATA_B                                                                         0x1c7d
+#define regOTG2_OTG_CRC0_DATA_B_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC0_DATA_C                                                                         0x1c7e
+#define regOTG2_OTG_CRC0_DATA_C_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC1_WINDOWA_X_CONTROL                                                              0x1c7f
+#define regOTG2_OTG_CRC1_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC1_WINDOWA_Y_CONTROL                                                              0x1c80
+#define regOTG2_OTG_CRC1_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC1_WINDOWB_X_CONTROL                                                              0x1c81
+#define regOTG2_OTG_CRC1_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC1_WINDOWB_Y_CONTROL                                                              0x1c82
+#define regOTG2_OTG_CRC1_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC1_DATA_R                                                                         0x1c83
+#define regOTG2_OTG_CRC1_DATA_R_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC1_DATA_G                                                                         0x1c84
+#define regOTG2_OTG_CRC1_DATA_G_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC1_DATA_B                                                                         0x1c85
+#define regOTG2_OTG_CRC1_DATA_B_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC1_DATA_C                                                                         0x1c86
+#define regOTG2_OTG_CRC1_DATA_C_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC2_DATA_R                                                                         0x1c87
+#define regOTG2_OTG_CRC2_DATA_R_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC2_DATA_G                                                                         0x1c88
+#define regOTG2_OTG_CRC2_DATA_G_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC2_DATA_B                                                                         0x1c89
+#define regOTG2_OTG_CRC2_DATA_B_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC2_DATA_C                                                                         0x1c8a
+#define regOTG2_OTG_CRC2_DATA_C_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC3_DATA_R                                                                         0x1c8b
+#define regOTG2_OTG_CRC3_DATA_R_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC3_DATA_G                                                                         0x1c8c
+#define regOTG2_OTG_CRC3_DATA_G_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC3_DATA_B                                                                         0x1c8d
+#define regOTG2_OTG_CRC3_DATA_B_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC3_DATA_C                                                                         0x1c8e
+#define regOTG2_OTG_CRC3_DATA_C_BASE_IDX                                                                2
+#define regOTG2_OTG_CRC_SIG_RED_GREEN_MASK                                                              0x1c8f
+#define regOTG2_OTG_CRC_SIG_RED_GREEN_MASK_BASE_IDX                                                     2
+#define regOTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK                                                           0x1c90
+#define regOTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK_BASE_IDX                                                  2
+#define regOTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK                                                     0x1c91
+#define regOTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK                                                     0x1c92
+#define regOTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK                                                     0x1c93
+#define regOTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK                                                     0x1c94
+#define regOTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK                                                     0x1c95
+#define regOTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK                                                     0x1c96
+#define regOTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK                                                     0x1c97
+#define regOTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK                                                     0x1c98
+#define regOTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG2_OTG_STATIC_SCREEN_CONTROL                                                               0x1c99
+#define regOTG2_OTG_STATIC_SCREEN_CONTROL_BASE_IDX                                                      2
+#define regOTG2_OTG_3D_STRUCTURE_CONTROL                                                                0x1c9a
+#define regOTG2_OTG_3D_STRUCTURE_CONTROL_BASE_IDX                                                       2
+#define regOTG2_OTG_CLOCK_CONTROL                                                                       0x1c9d
+#define regOTG2_OTG_CLOCK_CONTROL_BASE_IDX                                                              2
+#define regOTG2_OTG_VSTARTUP_PARAM                                                                      0x1c9e
+#define regOTG2_OTG_VSTARTUP_PARAM_BASE_IDX                                                             2
+#define regOTG2_OTG_VUPDATE_PARAM                                                                       0x1c9f
+#define regOTG2_OTG_VUPDATE_PARAM_BASE_IDX                                                              2
+#define regOTG2_OTG_VREADY_PARAM                                                                        0x1ca0
+#define regOTG2_OTG_VREADY_PARAM_BASE_IDX                                                               2
+#define regOTG2_OTG_GLOBAL_SYNC_STATUS                                                                  0x1ca1
+#define regOTG2_OTG_GLOBAL_SYNC_STATUS_BASE_IDX                                                         2
+#define regOTG2_OTG_MASTER_UPDATE_LOCK                                                                  0x1ca2
+#define regOTG2_OTG_MASTER_UPDATE_LOCK_BASE_IDX                                                         2
+#define regOTG2_OTG_GSL_CONTROL                                                                         0x1ca3
+#define regOTG2_OTG_GSL_CONTROL_BASE_IDX                                                                2
+#define regOTG2_OTG_GSL_WINDOW_X                                                                        0x1ca4
+#define regOTG2_OTG_GSL_WINDOW_X_BASE_IDX                                                               2
+#define regOTG2_OTG_GSL_WINDOW_Y                                                                        0x1ca5
+#define regOTG2_OTG_GSL_WINDOW_Y_BASE_IDX                                                               2
+#define regOTG2_OTG_VUPDATE_KEEPOUT                                                                     0x1ca6
+#define regOTG2_OTG_VUPDATE_KEEPOUT_BASE_IDX                                                            2
+#define regOTG2_OTG_GLOBAL_CONTROL0                                                                     0x1ca7
+#define regOTG2_OTG_GLOBAL_CONTROL0_BASE_IDX                                                            2
+#define regOTG2_OTG_GLOBAL_CONTROL1                                                                     0x1ca8
+#define regOTG2_OTG_GLOBAL_CONTROL1_BASE_IDX                                                            2
+#define regOTG2_OTG_GLOBAL_CONTROL2                                                                     0x1ca9
+#define regOTG2_OTG_GLOBAL_CONTROL2_BASE_IDX                                                            2
+#define regOTG2_OTG_GLOBAL_CONTROL3                                                                     0x1caa
+#define regOTG2_OTG_GLOBAL_CONTROL3_BASE_IDX                                                            2
+#define regOTG2_OTG_GLOBAL_CONTROL4                                                                     0x1cab
+#define regOTG2_OTG_GLOBAL_CONTROL4_BASE_IDX                                                            2
+#define regOTG2_OTG_TRIG_MANUAL_CONTROL                                                                 0x1cac
+#define regOTG2_OTG_TRIG_MANUAL_CONTROL_BASE_IDX                                                        2
+#define regOTG2_OTG_MANUAL_FLOW_CONTROL                                                                 0x1cad
+#define regOTG2_OTG_MANUAL_FLOW_CONTROL_BASE_IDX                                                        2
+#define regOTG2_OTG_DRR_TIMING_INT_STATUS                                                               0x1cae
+#define regOTG2_OTG_DRR_TIMING_INT_STATUS_BASE_IDX                                                      2
+#define regOTG2_OTG_DRR_V_TOTAL_REACH_RANGE                                                             0x1caf
+#define regOTG2_OTG_DRR_V_TOTAL_REACH_RANGE_BASE_IDX                                                    2
+#define regOTG2_OTG_DRR_V_TOTAL_CHANGE                                                                  0x1cb0
+#define regOTG2_OTG_DRR_V_TOTAL_CHANGE_BASE_IDX                                                         2
+#define regOTG2_OTG_DRR_TRIGGER_WINDOW                                                                  0x1cb1
+#define regOTG2_OTG_DRR_TRIGGER_WINDOW_BASE_IDX                                                         2
+#define regOTG2_OTG_DRR_CONTROL                                                                         0x1cb2
+#define regOTG2_OTG_DRR_CONTROL_BASE_IDX                                                                2
+#define regOTG2_OTG_DRR_CONTOL2                                                                         0x1cb3
+#define regOTG2_OTG_DRR_CONTOL2_BASE_IDX                                                                2
+#define regOTG2_OTG_M_CONST_DTO0                                                                        0x1cb4
+#define regOTG2_OTG_M_CONST_DTO0_BASE_IDX                                                               2
+#define regOTG2_OTG_M_CONST_DTO1                                                                        0x1cb5
+#define regOTG2_OTG_M_CONST_DTO1_BASE_IDX                                                               2
+#define regOTG2_OTG_PIPE_UPDATE_STATUS                                                                  0x1cb7
+#define regOTG2_OTG_PIPE_UPDATE_STATUS_BASE_IDX                                                         2
+#define regOTG2_OTG_PSTATE_REGISTER                                                                     0x1cb8
+#define regOTG2_OTG_PSTATE_REGISTER_BASE_IDX                                                            2
+#define regOTG2_OTG_ENCRYPTION                                                                          0x1cb9
+#define regOTG2_OTG_ENCRYPTION_BASE_IDX                                                                 2
+#define regOTG2_OTG_TEST_DEBUG_INDEX                                                                    0x1cbb
+#define regOTG2_OTG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regOTG2_OTG_TEST_DEBUG_DATA                                                                     0x1cbc
+#define regOTG2_OTG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_optc_otg3_dispdec
+// base address: 0x660
+#define regOTG3_OTG_H_TOTAL                                                                             0x1cc2
+#define regOTG3_OTG_H_TOTAL_BASE_IDX                                                                    2
+#define regOTG3_OTG_H_BLANK_START_END                                                                   0x1cc3
+#define regOTG3_OTG_H_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG3_OTG_H_SYNC_A                                                                            0x1cc4
+#define regOTG3_OTG_H_SYNC_A_BASE_IDX                                                                   2
+#define regOTG3_OTG_H_SYNC_A_CNTL                                                                       0x1cc5
+#define regOTG3_OTG_H_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG3_OTG_H_TIMING_CNTL                                                                       0x1cc6
+#define regOTG3_OTG_H_TIMING_CNTL_BASE_IDX                                                              2
+#define regOTG3_OTG_V_TOTAL                                                                             0x1cc7
+#define regOTG3_OTG_V_TOTAL_BASE_IDX                                                                    2
+#define regOTG3_OTG_V_TOTAL_MIN                                                                         0x1cc8
+#define regOTG3_OTG_V_TOTAL_MIN_BASE_IDX                                                                2
+#define regOTG3_OTG_V_TOTAL_MAX                                                                         0x1cc9
+#define regOTG3_OTG_V_TOTAL_MAX_BASE_IDX                                                                2
+#define regOTG3_OTG_V_TOTAL_MID                                                                         0x1cca
+#define regOTG3_OTG_V_TOTAL_MID_BASE_IDX                                                                2
+#define regOTG3_OTG_V_TOTAL_CONTROL                                                                     0x1ccb
+#define regOTG3_OTG_V_TOTAL_CONTROL_BASE_IDX                                                            2
+#define regOTG3_OTG_V_COUNT_STOP_CONTROL                                                                0x1ccc
+#define regOTG3_OTG_V_COUNT_STOP_CONTROL_BASE_IDX                                                       2
+#define regOTG3_OTG_V_COUNT_STOP_CONTROL2                                                               0x1ccd
+#define regOTG3_OTG_V_COUNT_STOP_CONTROL2_BASE_IDX                                                      2
+#define regOTG3_OTG_V_TOTAL_INT_STATUS                                                                  0x1cce
+#define regOTG3_OTG_V_TOTAL_INT_STATUS_BASE_IDX                                                         2
+#define regOTG3_OTG_VSYNC_NOM_INT_STATUS                                                                0x1ccf
+#define regOTG3_OTG_VSYNC_NOM_INT_STATUS_BASE_IDX                                                       2
+#define regOTG3_OTG_V_BLANK_START_END                                                                   0x1cd0
+#define regOTG3_OTG_V_BLANK_START_END_BASE_IDX                                                          2
+#define regOTG3_OTG_V_SYNC_A                                                                            0x1cd1
+#define regOTG3_OTG_V_SYNC_A_BASE_IDX                                                                   2
+#define regOTG3_OTG_V_SYNC_A_CNTL                                                                       0x1cd2
+#define regOTG3_OTG_V_SYNC_A_CNTL_BASE_IDX                                                              2
+#define regOTG3_OTG_TRIGA_CNTL                                                                          0x1cd3
+#define regOTG3_OTG_TRIGA_CNTL_BASE_IDX                                                                 2
+#define regOTG3_OTG_TRIGA_MANUAL_TRIG                                                                   0x1cd4
+#define regOTG3_OTG_TRIGA_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG3_OTG_TRIGB_CNTL                                                                          0x1cd5
+#define regOTG3_OTG_TRIGB_CNTL_BASE_IDX                                                                 2
+#define regOTG3_OTG_TRIGB_MANUAL_TRIG                                                                   0x1cd6
+#define regOTG3_OTG_TRIGB_MANUAL_TRIG_BASE_IDX                                                          2
+#define regOTG3_OTG_FORCE_COUNT_NOW_CNTL                                                                0x1cd7
+#define regOTG3_OTG_FORCE_COUNT_NOW_CNTL_BASE_IDX                                                       2
+#define regOTG3_OTG_FLOW_CONTROL                                                                        0x1cd8
+#define regOTG3_OTG_FLOW_CONTROL_BASE_IDX                                                               2
+#define regOTG3_OTG_STEREO_FORCE_NEXT_EYE                                                               0x1cd9
+#define regOTG3_OTG_STEREO_FORCE_NEXT_EYE_BASE_IDX                                                      2
+#define regOTG3_OTG_CONTROL                                                                             0x1cdb
+#define regOTG3_OTG_CONTROL_BASE_IDX                                                                    2
+#define regOTG3_OTG_DLPC_CONTROL                                                                        0x1cdc
+#define regOTG3_OTG_DLPC_CONTROL_BASE_IDX                                                               2
+#define regOTG3_OTG_PIXEL_DATA_READBACK0                                                                0x1ce0
+#define regOTG3_OTG_PIXEL_DATA_READBACK0_BASE_IDX                                                       2
+#define regOTG3_OTG_PIXEL_DATA_READBACK1                                                                0x1ce1
+#define regOTG3_OTG_PIXEL_DATA_READBACK1_BASE_IDX                                                       2
+#define regOTG3_OTG_STATUS                                                                              0x1ce2
+#define regOTG3_OTG_STATUS_BASE_IDX                                                                     2
+#define regOTG3_OTG_STATUS_POSITION                                                                     0x1ce3
+#define regOTG3_OTG_STATUS_POSITION_BASE_IDX                                                            2
+#define regOTG3_OTG_LONG_VBLANK_STATUS                                                                  0x1ce4
+#define regOTG3_OTG_LONG_VBLANK_STATUS_BASE_IDX                                                         2
+#define regOTG3_OTG_NOM_VERT_POSITION                                                                   0x1ce5
+#define regOTG3_OTG_NOM_VERT_POSITION_BASE_IDX                                                          2
+#define regOTG3_OTG_STATUS_FRAME_COUNT                                                                  0x1ce6
+#define regOTG3_OTG_STATUS_FRAME_COUNT_BASE_IDX                                                         2
+#define regOTG3_OTG_STATUS_VF_COUNT                                                                     0x1ce7
+#define regOTG3_OTG_STATUS_VF_COUNT_BASE_IDX                                                            2
+#define regOTG3_OTG_STATUS_HV_COUNT                                                                     0x1ce8
+#define regOTG3_OTG_STATUS_HV_COUNT_BASE_IDX                                                            2
+#define regOTG3_OTG_COUNT_CONTROL                                                                       0x1ce9
+#define regOTG3_OTG_COUNT_CONTROL_BASE_IDX                                                              2
+#define regOTG3_OTG_COUNT_RESET                                                                         0x1cea
+#define regOTG3_OTG_COUNT_RESET_BASE_IDX                                                                2
+#define regOTG3_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE                                                        0x1ceb
+#define regOTG3_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_BASE_IDX                                               2
+#define regOTG3_OTG_VERT_SYNC_CONTROL                                                                   0x1cec
+#define regOTG3_OTG_VERT_SYNC_CONTROL_BASE_IDX                                                          2
+#define regOTG3_OTG_STEREO_STATUS                                                                       0x1ced
+#define regOTG3_OTG_STEREO_STATUS_BASE_IDX                                                              2
+#define regOTG3_OTG_STEREO_CONTROL                                                                      0x1cee
+#define regOTG3_OTG_STEREO_CONTROL_BASE_IDX                                                             2
+#define regOTG3_OTG_SNAPSHOT_STATUS                                                                     0x1cef
+#define regOTG3_OTG_SNAPSHOT_STATUS_BASE_IDX                                                            2
+#define regOTG3_OTG_SNAPSHOT_CONTROL                                                                    0x1cf0
+#define regOTG3_OTG_SNAPSHOT_CONTROL_BASE_IDX                                                           2
+#define regOTG3_OTG_SNAPSHOT_POSITION                                                                   0x1cf1
+#define regOTG3_OTG_SNAPSHOT_POSITION_BASE_IDX                                                          2
+#define regOTG3_OTG_SNAPSHOT_FRAME                                                                      0x1cf2
+#define regOTG3_OTG_SNAPSHOT_FRAME_BASE_IDX                                                             2
+#define regOTG3_OTG_INTERRUPT_CONTROL                                                                   0x1cf3
+#define regOTG3_OTG_INTERRUPT_CONTROL_BASE_IDX                                                          2
+#define regOTG3_OTG_UPDATE_LOCK                                                                         0x1cf4
+#define regOTG3_OTG_UPDATE_LOCK_BASE_IDX                                                                2
+#define regOTG3_OTG_DOUBLE_BUFFER_CONTROL                                                               0x1cf5
+#define regOTG3_OTG_DOUBLE_BUFFER_CONTROL_BASE_IDX                                                      2
+#define regOTG3_OTG_MASTER_EN                                                                           0x1cf6
+#define regOTG3_OTG_MASTER_EN_BASE_IDX                                                                  2
+#define regOTG3_OTG_VERTICAL_INTERRUPT0_POSITION                                                        0x1cf8
+#define regOTG3_OTG_VERTICAL_INTERRUPT0_POSITION_BASE_IDX                                               2
+#define regOTG3_OTG_VERTICAL_INTERRUPT0_CONTROL                                                         0x1cf9
+#define regOTG3_OTG_VERTICAL_INTERRUPT0_CONTROL_BASE_IDX                                                2
+#define regOTG3_OTG_VERTICAL_INTERRUPT1_POSITION                                                        0x1cfa
+#define regOTG3_OTG_VERTICAL_INTERRUPT1_POSITION_BASE_IDX                                               2
+#define regOTG3_OTG_VERTICAL_INTERRUPT1_CONTROL                                                         0x1cfb
+#define regOTG3_OTG_VERTICAL_INTERRUPT1_CONTROL_BASE_IDX                                                2
+#define regOTG3_OTG_VERTICAL_INTERRUPT2_POSITION                                                        0x1cfc
+#define regOTG3_OTG_VERTICAL_INTERRUPT2_POSITION_BASE_IDX                                               2
+#define regOTG3_OTG_VERTICAL_INTERRUPT2_CONTROL                                                         0x1cfd
+#define regOTG3_OTG_VERTICAL_INTERRUPT2_CONTROL_BASE_IDX                                                2
+#define regOTG3_OTG_CRC_CNTL                                                                            0x1cfe
+#define regOTG3_OTG_CRC_CNTL_BASE_IDX                                                                   2
+#define regOTG3_OTG_CRC0_WINDOWA_X_CONTROL                                                              0x1cff
+#define regOTG3_OTG_CRC0_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC0_WINDOWA_Y_CONTROL                                                              0x1d00
+#define regOTG3_OTG_CRC0_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC0_WINDOWB_X_CONTROL                                                              0x1d01
+#define regOTG3_OTG_CRC0_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC0_WINDOWB_Y_CONTROL                                                              0x1d02
+#define regOTG3_OTG_CRC0_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC0_DATA_R                                                                         0x1d03
+#define regOTG3_OTG_CRC0_DATA_R_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC0_DATA_G                                                                         0x1d04
+#define regOTG3_OTG_CRC0_DATA_G_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC0_DATA_B                                                                         0x1d05
+#define regOTG3_OTG_CRC0_DATA_B_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC0_DATA_C                                                                         0x1d06
+#define regOTG3_OTG_CRC0_DATA_C_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC1_WINDOWA_X_CONTROL                                                              0x1d07
+#define regOTG3_OTG_CRC1_WINDOWA_X_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC1_WINDOWA_Y_CONTROL                                                              0x1d08
+#define regOTG3_OTG_CRC1_WINDOWA_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC1_WINDOWB_X_CONTROL                                                              0x1d09
+#define regOTG3_OTG_CRC1_WINDOWB_X_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC1_WINDOWB_Y_CONTROL                                                              0x1d0a
+#define regOTG3_OTG_CRC1_WINDOWB_Y_CONTROL_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC1_DATA_R                                                                         0x1d0b
+#define regOTG3_OTG_CRC1_DATA_R_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC1_DATA_G                                                                         0x1d0c
+#define regOTG3_OTG_CRC1_DATA_G_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC1_DATA_B                                                                         0x1d0d
+#define regOTG3_OTG_CRC1_DATA_B_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC1_DATA_C                                                                         0x1d0e
+#define regOTG3_OTG_CRC1_DATA_C_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC2_DATA_R                                                                         0x1d0f
+#define regOTG3_OTG_CRC2_DATA_R_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC2_DATA_G                                                                         0x1d10
+#define regOTG3_OTG_CRC2_DATA_G_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC2_DATA_B                                                                         0x1d11
+#define regOTG3_OTG_CRC2_DATA_B_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC2_DATA_C                                                                         0x1d12
+#define regOTG3_OTG_CRC2_DATA_C_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC3_DATA_R                                                                         0x1d13
+#define regOTG3_OTG_CRC3_DATA_R_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC3_DATA_G                                                                         0x1d14
+#define regOTG3_OTG_CRC3_DATA_G_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC3_DATA_B                                                                         0x1d15
+#define regOTG3_OTG_CRC3_DATA_B_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC3_DATA_C                                                                         0x1d16
+#define regOTG3_OTG_CRC3_DATA_C_BASE_IDX                                                                2
+#define regOTG3_OTG_CRC_SIG_RED_GREEN_MASK                                                              0x1d17
+#define regOTG3_OTG_CRC_SIG_RED_GREEN_MASK_BASE_IDX                                                     2
+#define regOTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK                                                           0x1d18
+#define regOTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK_BASE_IDX                                                  2
+#define regOTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK                                                     0x1d19
+#define regOTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK                                                     0x1d1a
+#define regOTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK                                                     0x1d1b
+#define regOTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK                                                     0x1d1c
+#define regOTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK                                                     0x1d1d
+#define regOTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK                                                     0x1d1e
+#define regOTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK                                                     0x1d1f
+#define regOTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK                                                     0x1d20
+#define regOTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK_BASE_IDX                                            2
+#define regOTG3_OTG_STATIC_SCREEN_CONTROL                                                               0x1d21
+#define regOTG3_OTG_STATIC_SCREEN_CONTROL_BASE_IDX                                                      2
+#define regOTG3_OTG_3D_STRUCTURE_CONTROL                                                                0x1d22
+#define regOTG3_OTG_3D_STRUCTURE_CONTROL_BASE_IDX                                                       2
+#define regOTG3_OTG_CLOCK_CONTROL                                                                       0x1d25
+#define regOTG3_OTG_CLOCK_CONTROL_BASE_IDX                                                              2
+#define regOTG3_OTG_VSTARTUP_PARAM                                                                      0x1d26
+#define regOTG3_OTG_VSTARTUP_PARAM_BASE_IDX                                                             2
+#define regOTG3_OTG_VUPDATE_PARAM                                                                       0x1d27
+#define regOTG3_OTG_VUPDATE_PARAM_BASE_IDX                                                              2
+#define regOTG3_OTG_VREADY_PARAM                                                                        0x1d28
+#define regOTG3_OTG_VREADY_PARAM_BASE_IDX                                                               2
+#define regOTG3_OTG_GLOBAL_SYNC_STATUS                                                                  0x1d29
+#define regOTG3_OTG_GLOBAL_SYNC_STATUS_BASE_IDX                                                         2
+#define regOTG3_OTG_MASTER_UPDATE_LOCK                                                                  0x1d2a
+#define regOTG3_OTG_MASTER_UPDATE_LOCK_BASE_IDX                                                         2
+#define regOTG3_OTG_GSL_CONTROL                                                                         0x1d2b
+#define regOTG3_OTG_GSL_CONTROL_BASE_IDX                                                                2
+#define regOTG3_OTG_GSL_WINDOW_X                                                                        0x1d2c
+#define regOTG3_OTG_GSL_WINDOW_X_BASE_IDX                                                               2
+#define regOTG3_OTG_GSL_WINDOW_Y                                                                        0x1d2d
+#define regOTG3_OTG_GSL_WINDOW_Y_BASE_IDX                                                               2
+#define regOTG3_OTG_VUPDATE_KEEPOUT                                                                     0x1d2e
+#define regOTG3_OTG_VUPDATE_KEEPOUT_BASE_IDX                                                            2
+#define regOTG3_OTG_GLOBAL_CONTROL0                                                                     0x1d2f
+#define regOTG3_OTG_GLOBAL_CONTROL0_BASE_IDX                                                            2
+#define regOTG3_OTG_GLOBAL_CONTROL1                                                                     0x1d30
+#define regOTG3_OTG_GLOBAL_CONTROL1_BASE_IDX                                                            2
+#define regOTG3_OTG_GLOBAL_CONTROL2                                                                     0x1d31
+#define regOTG3_OTG_GLOBAL_CONTROL2_BASE_IDX                                                            2
+#define regOTG3_OTG_GLOBAL_CONTROL3                                                                     0x1d32
+#define regOTG3_OTG_GLOBAL_CONTROL3_BASE_IDX                                                            2
+#define regOTG3_OTG_GLOBAL_CONTROL4                                                                     0x1d33
+#define regOTG3_OTG_GLOBAL_CONTROL4_BASE_IDX                                                            2
+#define regOTG3_OTG_TRIG_MANUAL_CONTROL                                                                 0x1d34
+#define regOTG3_OTG_TRIG_MANUAL_CONTROL_BASE_IDX                                                        2
+#define regOTG3_OTG_MANUAL_FLOW_CONTROL                                                                 0x1d35
+#define regOTG3_OTG_MANUAL_FLOW_CONTROL_BASE_IDX                                                        2
+#define regOTG3_OTG_DRR_TIMING_INT_STATUS                                                               0x1d36
+#define regOTG3_OTG_DRR_TIMING_INT_STATUS_BASE_IDX                                                      2
+#define regOTG3_OTG_DRR_V_TOTAL_REACH_RANGE                                                             0x1d37
+#define regOTG3_OTG_DRR_V_TOTAL_REACH_RANGE_BASE_IDX                                                    2
+#define regOTG3_OTG_DRR_V_TOTAL_CHANGE                                                                  0x1d38
+#define regOTG3_OTG_DRR_V_TOTAL_CHANGE_BASE_IDX                                                         2
+#define regOTG3_OTG_DRR_TRIGGER_WINDOW                                                                  0x1d39
+#define regOTG3_OTG_DRR_TRIGGER_WINDOW_BASE_IDX                                                         2
+#define regOTG3_OTG_DRR_CONTROL                                                                         0x1d3a
+#define regOTG3_OTG_DRR_CONTROL_BASE_IDX                                                                2
+#define regOTG3_OTG_DRR_CONTOL2                                                                         0x1d3b
+#define regOTG3_OTG_DRR_CONTOL2_BASE_IDX                                                                2
+#define regOTG3_OTG_M_CONST_DTO0                                                                        0x1d3c
+#define regOTG3_OTG_M_CONST_DTO0_BASE_IDX                                                               2
+#define regOTG3_OTG_M_CONST_DTO1                                                                        0x1d3d
+#define regOTG3_OTG_M_CONST_DTO1_BASE_IDX                                                               2
+#define regOTG3_OTG_PIPE_UPDATE_STATUS                                                                  0x1d3f
+#define regOTG3_OTG_PIPE_UPDATE_STATUS_BASE_IDX                                                         2
+#define regOTG3_OTG_PSTATE_REGISTER                                                                     0x1d40
+#define regOTG3_OTG_PSTATE_REGISTER_BASE_IDX                                                            2
+#define regOTG3_OTG_ENCRYPTION                                                                          0x1d41
+#define regOTG3_OTG_ENCRYPTION_BASE_IDX                                                                 2
+#define regOTG3_OTG_TEST_DEBUG_INDEX                                                                    0x1d43
+#define regOTG3_OTG_TEST_DEBUG_INDEX_BASE_IDX                                                           2
+#define regOTG3_OTG_TEST_DEBUG_DATA                                                                     0x1d44
+#define regOTG3_OTG_TEST_DEBUG_DATA_BASE_IDX                                                            2
+
+
+// addressBlock: dce_dc_optc_optc_misc_dispdec
+// base address: 0x0
+#define regOPTC_DLPC_CONTROL                                                                            0x1e2b
+#define regOPTC_DLPC_CONTROL_BASE_IDX                                                                   2
+#define regOPTC_CLOCK_CONTROL                                                                           0x1e2c
+#define regOPTC_CLOCK_CONTROL_BASE_IDX                                                                  2
+#define regODM_MEM_PWR_CTRL                                                                             0x1e2d
+#define regODM_MEM_PWR_CTRL_BASE_IDX                                                                    2
+#define regODM_MEM_PWR_CTRL3                                                                            0x1e2f
+#define regODM_MEM_PWR_CTRL3_BASE_IDX                                                                   2
+#define regODM_MEM_PWR_STATUS                                                                           0x1e30
+#define regODM_MEM_PWR_STATUS_BASE_IDX                                                                  2
+#define regOPTC_DEBUG_CONTROL                                                                           0x1e32
+#define regOPTC_DEBUG_CONTROL_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_optc_optc_dcperfmon_dc_perfmon_dispdec
+// base address: 0x79a8
+#define regDC_PERFMON16_PERFCOUNTER_CNTL                                                                0x1e6a
+#define regDC_PERFMON16_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON16_PERFCOUNTER_CNTL2                                                               0x1e6b
+#define regDC_PERFMON16_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON16_PERFCOUNTER_STATE                                                               0x1e6c
+#define regDC_PERFMON16_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON16_PERFMON_CNTL                                                                    0x1e6d
+#define regDC_PERFMON16_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON16_PERFMON_CNTL2                                                                   0x1e6e
+#define regDC_PERFMON16_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON16_PERFMON_CVALUE_INT_MISC                                                         0x1e6f
+#define regDC_PERFMON16_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON16_PERFMON_CVALUE_LOW                                                              0x1e70
+#define regDC_PERFMON16_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON16_PERFMON_HI                                                                      0x1e71
+#define regDC_PERFMON16_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON16_PERFMON_LOW                                                                     0x1e72
+#define regDC_PERFMON16_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON16_PERFMON_TEST_DEBUG_INDEX                                                        0x1e73
+#define regDC_PERFMON16_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON16_PERFMON_TEST_DEBUG_DATA                                                         0x1e74
+#define regDC_PERFMON16_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_dio_dp0_dispdec
+// base address: 0x0
+#define regDP0_DP_LINK_CNTL                                                                             0x20f4
+#define regDP0_DP_LINK_CNTL_BASE_IDX                                                                    2
+#define regDP0_DP_PIXEL_FORMAT                                                                          0x20f5
+#define regDP0_DP_PIXEL_FORMAT_BASE_IDX                                                                 2
+#define regDP0_DP_MSA_COLORIMETRY                                                                       0x20f6
+#define regDP0_DP_MSA_COLORIMETRY_BASE_IDX                                                              2
+#define regDP0_DP_CONFIG                                                                                0x20f7
+#define regDP0_DP_CONFIG_BASE_IDX                                                                       2
+#define regDP0_DP_VID_STREAM_CNTL                                                                       0x20f8
+#define regDP0_DP_VID_STREAM_CNTL_BASE_IDX                                                              2
+#define regDP0_DP_STEER_FIFO                                                                            0x20f9
+#define regDP0_DP_STEER_FIFO_BASE_IDX                                                                   2
+#define regDP0_DP_MSA_MISC                                                                              0x20fa
+#define regDP0_DP_MSA_MISC_BASE_IDX                                                                     2
+#define regDP0_DP_DPHY_INTERNAL_CTRL                                                                    0x20fb
+#define regDP0_DP_DPHY_INTERNAL_CTRL_BASE_IDX                                                           2
+#define regDP0_DP_VID_TIMING                                                                            0x20fc
+#define regDP0_DP_VID_TIMING_BASE_IDX                                                                   2
+#define regDP0_DP_VID_N                                                                                 0x20fd
+#define regDP0_DP_VID_N_BASE_IDX                                                                        2
+#define regDP0_DP_VID_M                                                                                 0x20fe
+#define regDP0_DP_VID_M_BASE_IDX                                                                        2
+#define regDP0_DP_LINK_FRAMING_CNTL                                                                     0x20ff
+#define regDP0_DP_LINK_FRAMING_CNTL_BASE_IDX                                                            2
+#define regDP0_DP_HBR2_EYE_PATTERN                                                                      0x2100
+#define regDP0_DP_HBR2_EYE_PATTERN_BASE_IDX                                                             2
+#define regDP0_DP_VID_MSA_VBID                                                                          0x2101
+#define regDP0_DP_VID_MSA_VBID_BASE_IDX                                                                 2
+#define regDP0_DP_VID_INTERRUPT_CNTL                                                                    0x2102
+#define regDP0_DP_VID_INTERRUPT_CNTL_BASE_IDX                                                           2
+#define regDP0_DP_DPHY_CNTL                                                                             0x2103
+#define regDP0_DP_DPHY_CNTL_BASE_IDX                                                                    2
+#define regDP0_DP_DPHY_TRAINING_PATTERN_SEL                                                             0x2104
+#define regDP0_DP_DPHY_TRAINING_PATTERN_SEL_BASE_IDX                                                    2
+#define regDP0_DP_DPHY_SYM0                                                                             0x2105
+#define regDP0_DP_DPHY_SYM0_BASE_IDX                                                                    2
+#define regDP0_DP_DPHY_SYM1                                                                             0x2106
+#define regDP0_DP_DPHY_SYM1_BASE_IDX                                                                    2
+#define regDP0_DP_DPHY_SYM2                                                                             0x2107
+#define regDP0_DP_DPHY_SYM2_BASE_IDX                                                                    2
+#define regDP0_DP_DPHY_8B10B_CNTL                                                                       0x2108
+#define regDP0_DP_DPHY_8B10B_CNTL_BASE_IDX                                                              2
+#define regDP0_DP_DPHY_PRBS_CNTL                                                                        0x2109
+#define regDP0_DP_DPHY_PRBS_CNTL_BASE_IDX                                                               2
+#define regDP0_DP_DPHY_SCRAM_CNTL                                                                       0x210a
+#define regDP0_DP_DPHY_SCRAM_CNTL_BASE_IDX                                                              2
+#define regDP0_DP_TU_CNTL                                                                               0x2112
+#define regDP0_DP_TU_CNTL_BASE_IDX                                                                      2
+#define regDP0_DP_PIXEL_FORMAT_DB_CNTL                                                                  0x2113
+#define regDP0_DP_PIXEL_FORMAT_DB_CNTL_BASE_IDX                                                         2
+#define regDP0_DP_CP_LINK_VERIFICATION_PATTERN                                                          0x2114
+#define regDP0_DP_CP_LINK_VERIFICATION_PATTERN_BASE_IDX                                                 2
+#define regDP0_DP_SEC_CNTL                                                                              0x2117
+#define regDP0_DP_SEC_CNTL_BASE_IDX                                                                     2
+#define regDP0_DP_SEC_CNTL1                                                                             0x2118
+#define regDP0_DP_SEC_CNTL1_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_FRAMING1                                                                          0x2119
+#define regDP0_DP_SEC_FRAMING1_BASE_IDX                                                                 2
+#define regDP0_DP_SEC_FRAMING2                                                                          0x211a
+#define regDP0_DP_SEC_FRAMING2_BASE_IDX                                                                 2
+#define regDP0_DP_SEC_FRAMING3                                                                          0x211b
+#define regDP0_DP_SEC_FRAMING3_BASE_IDX                                                                 2
+#define regDP0_DP_SEC_FRAMING4                                                                          0x211c
+#define regDP0_DP_SEC_FRAMING4_BASE_IDX                                                                 2
+#define regDP0_DP_SEC_AUD_N                                                                             0x211d
+#define regDP0_DP_SEC_AUD_N_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_AUD_N_READBACK                                                                    0x211e
+#define regDP0_DP_SEC_AUD_N_READBACK_BASE_IDX                                                           2
+#define regDP0_DP_SEC_AUD_M                                                                             0x211f
+#define regDP0_DP_SEC_AUD_M_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_AUD_M_READBACK                                                                    0x2120
+#define regDP0_DP_SEC_AUD_M_READBACK_BASE_IDX                                                           2
+#define regDP0_DP_SEC_TIMESTAMP                                                                         0x2121
+#define regDP0_DP_SEC_TIMESTAMP_BASE_IDX                                                                2
+#define regDP0_DP_SEC_PACKET_CNTL                                                                       0x2122
+#define regDP0_DP_SEC_PACKET_CNTL_BASE_IDX                                                              2
+#define regDP0_DP_MSE_RATE_CNTL                                                                         0x2123
+#define regDP0_DP_MSE_RATE_CNTL_BASE_IDX                                                                2
+#define regDP0_DP_CP_MSE_STATUS                                                                         0x2124
+#define regDP0_DP_CP_MSE_STATUS_BASE_IDX                                                                2
+#define regDP0_DP_MSE_RATE_UPDATE                                                                       0x2125
+#define regDP0_DP_MSE_RATE_UPDATE_BASE_IDX                                                              2
+#define regDP0_DP_MSE_SAT0                                                                              0x2126
+#define regDP0_DP_MSE_SAT0_BASE_IDX                                                                     2
+#define regDP0_DP_MSE_SAT1                                                                              0x2127
+#define regDP0_DP_MSE_SAT1_BASE_IDX                                                                     2
+#define regDP0_DP_MSE_SAT2                                                                              0x2128
+#define regDP0_DP_MSE_SAT2_BASE_IDX                                                                     2
+#define regDP0_DP_MSE_SAT_UPDATE                                                                        0x2129
+#define regDP0_DP_MSE_SAT_UPDATE_BASE_IDX                                                               2
+#define regDP0_DP_MSE_LINK_TIMING                                                                       0x212a
+#define regDP0_DP_MSE_LINK_TIMING_BASE_IDX                                                              2
+#define regDP0_DP_MSE_MISC_CNTL                                                                         0x212b
+#define regDP0_DP_MSE_MISC_CNTL_BASE_IDX                                                                2
+#define regDP0_DP_TEST_DEBUG_DATA                                                                       0x212d
+#define regDP0_DP_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regDP0_DP_DPHY_BS_SR_SWAP_CNTL                                                                  0x2130
+#define regDP0_DP_DPHY_BS_SR_SWAP_CNTL_BASE_IDX                                                         2
+#define regDP0_DP_DPHY_HBR2_PATTERN_CONTROL                                                             0x2131
+#define regDP0_DP_DPHY_HBR2_PATTERN_CONTROL_BASE_IDX                                                    2
+#define regDP0_DP_MSE_SAT0_STATUS                                                                       0x2133
+#define regDP0_DP_MSE_SAT0_STATUS_BASE_IDX                                                              2
+#define regDP0_DP_MSE_SAT1_STATUS                                                                       0x2134
+#define regDP0_DP_MSE_SAT1_STATUS_BASE_IDX                                                              2
+#define regDP0_DP_MSE_SAT2_STATUS                                                                       0x2135
+#define regDP0_DP_MSE_SAT2_STATUS_BASE_IDX                                                              2
+#define regDP0_DP_HBLANK_CONTROL                                                                        0x2137
+#define regDP0_DP_HBLANK_CONTROL_BASE_IDX                                                               2
+#define regDP0_DP_MSA_TIMING_PARAM1                                                                     0x2138
+#define regDP0_DP_MSA_TIMING_PARAM1_BASE_IDX                                                            2
+#define regDP0_DP_MSA_TIMING_PARAM2                                                                     0x2139
+#define regDP0_DP_MSA_TIMING_PARAM2_BASE_IDX                                                            2
+#define regDP0_DP_MSA_TIMING_PARAM3                                                                     0x213a
+#define regDP0_DP_MSA_TIMING_PARAM3_BASE_IDX                                                            2
+#define regDP0_DP_MSA_TIMING_PARAM4                                                                     0x213b
+#define regDP0_DP_MSA_TIMING_PARAM4_BASE_IDX                                                            2
+#define regDP0_DP_MSO_CNTL                                                                              0x213c
+#define regDP0_DP_MSO_CNTL_BASE_IDX                                                                     2
+#define regDP0_DP_MSO_CNTL1                                                                             0x213d
+#define regDP0_DP_MSO_CNTL1_BASE_IDX                                                                    2
+#define regDP0_DP_STEER_FIFO_CNTL                                                                       0x213e
+#define regDP0_DP_STEER_FIFO_CNTL_BASE_IDX                                                              2
+#define regDP0_DP_SEC_CNTL2                                                                             0x213f
+#define regDP0_DP_SEC_CNTL2_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_CNTL3                                                                             0x2140
+#define regDP0_DP_SEC_CNTL3_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_CNTL4                                                                             0x2141
+#define regDP0_DP_SEC_CNTL4_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_CNTL5                                                                             0x2142
+#define regDP0_DP_SEC_CNTL5_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_CNTL6                                                                             0x2143
+#define regDP0_DP_SEC_CNTL6_BASE_IDX                                                                    2
+#define regDP0_DP_SEC_CNTL7                                                                             0x2144
+#define regDP0_DP_SEC_CNTL7_BASE_IDX                                                                    2
+#define regDP0_DP_DB_CNTL                                                                               0x2145
+#define regDP0_DP_DB_CNTL_BASE_IDX                                                                      2
+#define regDP0_DP_MSA_VBID_MISC                                                                         0x2146
+#define regDP0_DP_MSA_VBID_MISC_BASE_IDX                                                                2
+#define regDP0_DP_SEC_METADATA_TRANSMISSION                                                             0x2147
+#define regDP0_DP_SEC_METADATA_TRANSMISSION_BASE_IDX                                                    2
+#define regDP0_DP_ALPM_CNTL                                                                             0x2149
+#define regDP0_DP_ALPM_CNTL_BASE_IDX                                                                    2
+#define regDP0_DP_GSP8_CNTL                                                                             0x214a
+#define regDP0_DP_GSP8_CNTL_BASE_IDX                                                                    2
+#define regDP0_DP_GSP9_CNTL                                                                             0x214b
+#define regDP0_DP_GSP9_CNTL_BASE_IDX                                                                    2
+#define regDP0_DP_GSP10_CNTL                                                                            0x214c
+#define regDP0_DP_GSP10_CNTL_BASE_IDX                                                                   2
+#define regDP0_DP_GSP11_CNTL                                                                            0x214d
+#define regDP0_DP_GSP11_CNTL_BASE_IDX                                                                   2
+#define regDP0_DP_GSP_EN_DB_STATUS                                                                      0x214e
+#define regDP0_DP_GSP_EN_DB_STATUS_BASE_IDX                                                             2
+#define regDP0_DP_AUXLESS_ALPM_CNTL1                                                                    0x214f
+#define regDP0_DP_AUXLESS_ALPM_CNTL1_BASE_IDX                                                           2
+#define regDP0_DP_AUXLESS_ALPM_CNTL2                                                                    0x2150
+#define regDP0_DP_AUXLESS_ALPM_CNTL2_BASE_IDX                                                           2
+#define regDP0_DP_AUXLESS_ALPM_CNTL3                                                                    0x2151
+#define regDP0_DP_AUXLESS_ALPM_CNTL3_BASE_IDX                                                           2
+#define regDP0_DP_AUXLESS_ALPM_CNTL4                                                                    0x2152
+#define regDP0_DP_AUXLESS_ALPM_CNTL4_BASE_IDX                                                           2
+#define regDP0_DP_AUXLESS_ALPM_CNTL5                                                                    0x2153
+#define regDP0_DP_AUXLESS_ALPM_CNTL5_BASE_IDX                                                           2
+#define regDP0_DP_STREAM_SYMBOL_COUNT_STATUS                                                            0x2154
+#define regDP0_DP_STREAM_SYMBOL_COUNT_STATUS_BASE_IDX                                                   2
+#define regDP0_DP_STREAM_SYMBOL_COUNT_CONTROL                                                           0x2155
+#define regDP0_DP_STREAM_SYMBOL_COUNT_CONTROL_BASE_IDX                                                  2
+#define regDP0_DP_LINK_SYMBOL_COUNT_STATUS0                                                             0x2156
+#define regDP0_DP_LINK_SYMBOL_COUNT_STATUS0_BASE_IDX                                                    2
+#define regDP0_DP_LINK_SYMBOL_COUNT_STATUS1                                                             0x2157
+#define regDP0_DP_LINK_SYMBOL_COUNT_STATUS1_BASE_IDX                                                    2
+#define regDP0_DP_LINK_SYMBOL_COUNT_CONTROL                                                             0x2158
+#define regDP0_DP_LINK_SYMBOL_COUNT_CONTROL_BASE_IDX                                                    2
+#define regDP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL                                                     0x2159
+#define regDP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                            2
+#define regDP0_DP_DPHY_FAST_TRAINING                                                                    0x215c
+#define regDP0_DP_DPHY_FAST_TRAINING_BASE_IDX                                                           2
+#define regDP0_DP_DPHY_FAST_TRAINING_STATUS                                                             0x215d
+#define regDP0_DP_DPHY_FAST_TRAINING_STATUS_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dio_dig0_dispdec
+// base address: 0x0
+#define regDIG0_DIG_FE_CNTL                                                                             0x2069
+#define regDIG0_DIG_FE_CNTL_BASE_IDX                                                                    2
+#define regDIG0_DIG_FE_CLK_CNTL                                                                         0x206a
+#define regDIG0_DIG_FE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG0_DIG_FE_EN_CNTL                                                                          0x206b
+#define regDIG0_DIG_FE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG0_DIG_OUTPUT_CRC_CNTL                                                                     0x206c
+#define regDIG0_DIG_OUTPUT_CRC_CNTL_BASE_IDX                                                            2
+#define regDIG0_DIG_OUTPUT_CRC_RESULT                                                                   0x206d
+#define regDIG0_DIG_OUTPUT_CRC_RESULT_BASE_IDX                                                          2
+#define regDIG0_DIG_CLOCK_PATTERN                                                                       0x206e
+#define regDIG0_DIG_CLOCK_PATTERN_BASE_IDX                                                              2
+#define regDIG0_DIG_TEST_PATTERN                                                                        0x206f
+#define regDIG0_DIG_TEST_PATTERN_BASE_IDX                                                               2
+#define regDIG0_DIG_RANDOM_PATTERN_SEED                                                                 0x2070
+#define regDIG0_DIG_RANDOM_PATTERN_SEED_BASE_IDX                                                        2
+#define regDIG0_DIG_FIFO_CTRL0                                                                          0x2071
+#define regDIG0_DIG_FIFO_CTRL0_BASE_IDX                                                                 2
+#define regDIG0_DIG_FIFO_CTRL1                                                                          0x2072
+#define regDIG0_DIG_FIFO_CTRL1_BASE_IDX                                                                 2
+#define regDIG0_HDMI_METADATA_PACKET_CONTROL                                                            0x2073
+#define regDIG0_HDMI_METADATA_PACKET_CONTROL_BASE_IDX                                                   2
+#define regDIG0_HDMI_CONTROL                                                                            0x2074
+#define regDIG0_HDMI_CONTROL_BASE_IDX                                                                   2
+#define regDIG0_HDMI_STATUS                                                                             0x2075
+#define regDIG0_HDMI_STATUS_BASE_IDX                                                                    2
+#define regDIG0_HDMI_AUDIO_PACKET_CONTROL                                                               0x2076
+#define regDIG0_HDMI_AUDIO_PACKET_CONTROL_BASE_IDX                                                      2
+#define regDIG0_HDMI_ACR_PACKET_CONTROL                                                                 0x2077
+#define regDIG0_HDMI_ACR_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG0_HDMI_VBI_PACKET_CONTROL                                                                 0x2078
+#define regDIG0_HDMI_VBI_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG0_HDMI_INFOFRAME_CONTROL0                                                                 0x2079
+#define regDIG0_HDMI_INFOFRAME_CONTROL0_BASE_IDX                                                        2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL0                                                            0x207a
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL0_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL6                                                            0x207b
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL6_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL5                                                            0x207c
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL5_BASE_IDX                                                   2
+#define regDIG0_HDMI_GC                                                                                 0x207d
+#define regDIG0_HDMI_GC_BASE_IDX                                                                        2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL1                                                            0x207e
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL1_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL2                                                            0x207f
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL2_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL3                                                            0x2080
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL3_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL4                                                            0x2081
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL4_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL7                                                            0x2082
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL7_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL8                                                            0x2083
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL8_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL9                                                            0x2084
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL9_BASE_IDX                                                   2
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL10                                                           0x2085
+#define regDIG0_HDMI_GENERIC_PACKET_CONTROL10_BASE_IDX                                                  2
+#define regDIG0_HDMI_DB_CONTROL                                                                         0x2086
+#define regDIG0_HDMI_DB_CONTROL_BASE_IDX                                                                2
+#define regDIG0_HDMI_ACR_32_0                                                                           0x2087
+#define regDIG0_HDMI_ACR_32_0_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_32_1                                                                           0x2088
+#define regDIG0_HDMI_ACR_32_1_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_44_0                                                                           0x2089
+#define regDIG0_HDMI_ACR_44_0_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_44_1                                                                           0x208a
+#define regDIG0_HDMI_ACR_44_1_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_48_0                                                                           0x208b
+#define regDIG0_HDMI_ACR_48_0_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_48_1                                                                           0x208c
+#define regDIG0_HDMI_ACR_48_1_BASE_IDX                                                                  2
+#define regDIG0_HDMI_ACR_STATUS_0                                                                       0x208d
+#define regDIG0_HDMI_ACR_STATUS_0_BASE_IDX                                                              2
+#define regDIG0_HDMI_ACR_STATUS_1                                                                       0x208e
+#define regDIG0_HDMI_ACR_STATUS_1_BASE_IDX                                                              2
+#define regDIG0_DIG_FE_AUDIO_CNTL                                                                       0x208f
+#define regDIG0_DIG_FE_AUDIO_CNTL_BASE_IDX                                                              2
+#define regDIG0_DIG_BE_CLK_CNTL                                                                         0x2090
+#define regDIG0_DIG_BE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG0_DIG_BE_CNTL                                                                             0x2091
+#define regDIG0_DIG_BE_CNTL_BASE_IDX                                                                    2
+#define regDIG0_DIG_BE_EN_CNTL                                                                          0x2092
+#define regDIG0_DIG_BE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG0_HDCP_INT_CONTROL                                                                        0x2095
+#define regDIG0_HDCP_INT_CONTROL_BASE_IDX                                                               2
+#define regDIG0_HDCP_I2C_CONTROL_0                                                                      0x2097
+#define regDIG0_HDCP_I2C_CONTROL_0_BASE_IDX                                                             2
+#define regDIG0_HDCP_I2C_CONTROL_1                                                                      0x2098
+#define regDIG0_HDCP_I2C_CONTROL_1_BASE_IDX                                                             2
+#define regDIG0_TMDS_CNTL                                                                               0x20b9
+#define regDIG0_TMDS_CNTL_BASE_IDX                                                                      2
+#define regDIG0_TMDS_CONTROL_CHAR                                                                       0x20ba
+#define regDIG0_TMDS_CONTROL_CHAR_BASE_IDX                                                              2
+#define regDIG0_TMDS_CONTROL0_FEEDBACK                                                                  0x20bb
+#define regDIG0_TMDS_CONTROL0_FEEDBACK_BASE_IDX                                                         2
+#define regDIG0_TMDS_STEREOSYNC_CTL_SEL                                                                 0x20bc
+#define regDIG0_TMDS_STEREOSYNC_CTL_SEL_BASE_IDX                                                        2
+#define regDIG0_TMDS_SYNC_CHAR_PATTERN_0_1                                                              0x20bd
+#define regDIG0_TMDS_SYNC_CHAR_PATTERN_0_1_BASE_IDX                                                     2
+#define regDIG0_TMDS_SYNC_CHAR_PATTERN_2_3                                                              0x20be
+#define regDIG0_TMDS_SYNC_CHAR_PATTERN_2_3_BASE_IDX                                                     2
+#define regDIG0_TMDS_CTL_BITS                                                                           0x20c0
+#define regDIG0_TMDS_CTL_BITS_BASE_IDX                                                                  2
+#define regDIG0_TMDS_DCBALANCER_CONTROL                                                                 0x20c1
+#define regDIG0_TMDS_DCBALANCER_CONTROL_BASE_IDX                                                        2
+#define regDIG0_TMDS_CTL0_1_GEN_CNTL                                                                    0x20c3
+#define regDIG0_TMDS_CTL0_1_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG0_TMDS_CTL2_3_GEN_CNTL                                                                    0x20c4
+#define regDIG0_TMDS_CTL2_3_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG0_DIG_VERSION                                                                             0x20c6
+#define regDIG0_DIG_VERSION_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dp1_dispdec
+// base address: 0x4ac
+#define regDP1_DP_LINK_CNTL                                                                             0x221f
+#define regDP1_DP_LINK_CNTL_BASE_IDX                                                                    2
+#define regDP1_DP_PIXEL_FORMAT                                                                          0x2220
+#define regDP1_DP_PIXEL_FORMAT_BASE_IDX                                                                 2
+#define regDP1_DP_MSA_COLORIMETRY                                                                       0x2221
+#define regDP1_DP_MSA_COLORIMETRY_BASE_IDX                                                              2
+#define regDP1_DP_CONFIG                                                                                0x2222
+#define regDP1_DP_CONFIG_BASE_IDX                                                                       2
+#define regDP1_DP_VID_STREAM_CNTL                                                                       0x2223
+#define regDP1_DP_VID_STREAM_CNTL_BASE_IDX                                                              2
+#define regDP1_DP_STEER_FIFO                                                                            0x2224
+#define regDP1_DP_STEER_FIFO_BASE_IDX                                                                   2
+#define regDP1_DP_MSA_MISC                                                                              0x2225
+#define regDP1_DP_MSA_MISC_BASE_IDX                                                                     2
+#define regDP1_DP_DPHY_INTERNAL_CTRL                                                                    0x2226
+#define regDP1_DP_DPHY_INTERNAL_CTRL_BASE_IDX                                                           2
+#define regDP1_DP_VID_TIMING                                                                            0x2227
+#define regDP1_DP_VID_TIMING_BASE_IDX                                                                   2
+#define regDP1_DP_VID_N                                                                                 0x2228
+#define regDP1_DP_VID_N_BASE_IDX                                                                        2
+#define regDP1_DP_VID_M                                                                                 0x2229
+#define regDP1_DP_VID_M_BASE_IDX                                                                        2
+#define regDP1_DP_LINK_FRAMING_CNTL                                                                     0x222a
+#define regDP1_DP_LINK_FRAMING_CNTL_BASE_IDX                                                            2
+#define regDP1_DP_HBR2_EYE_PATTERN                                                                      0x222b
+#define regDP1_DP_HBR2_EYE_PATTERN_BASE_IDX                                                             2
+#define regDP1_DP_VID_MSA_VBID                                                                          0x222c
+#define regDP1_DP_VID_MSA_VBID_BASE_IDX                                                                 2
+#define regDP1_DP_VID_INTERRUPT_CNTL                                                                    0x222d
+#define regDP1_DP_VID_INTERRUPT_CNTL_BASE_IDX                                                           2
+#define regDP1_DP_DPHY_CNTL                                                                             0x222e
+#define regDP1_DP_DPHY_CNTL_BASE_IDX                                                                    2
+#define regDP1_DP_DPHY_TRAINING_PATTERN_SEL                                                             0x222f
+#define regDP1_DP_DPHY_TRAINING_PATTERN_SEL_BASE_IDX                                                    2
+#define regDP1_DP_DPHY_SYM0                                                                             0x2230
+#define regDP1_DP_DPHY_SYM0_BASE_IDX                                                                    2
+#define regDP1_DP_DPHY_SYM1                                                                             0x2231
+#define regDP1_DP_DPHY_SYM1_BASE_IDX                                                                    2
+#define regDP1_DP_DPHY_SYM2                                                                             0x2232
+#define regDP1_DP_DPHY_SYM2_BASE_IDX                                                                    2
+#define regDP1_DP_DPHY_8B10B_CNTL                                                                       0x2233
+#define regDP1_DP_DPHY_8B10B_CNTL_BASE_IDX                                                              2
+#define regDP1_DP_DPHY_PRBS_CNTL                                                                        0x2234
+#define regDP1_DP_DPHY_PRBS_CNTL_BASE_IDX                                                               2
+#define regDP1_DP_DPHY_SCRAM_CNTL                                                                       0x2235
+#define regDP1_DP_DPHY_SCRAM_CNTL_BASE_IDX                                                              2
+#define regDP1_DP_TU_CNTL                                                                               0x223d
+#define regDP1_DP_TU_CNTL_BASE_IDX                                                                      2
+#define regDP1_DP_PIXEL_FORMAT_DB_CNTL                                                                  0x223e
+#define regDP1_DP_PIXEL_FORMAT_DB_CNTL_BASE_IDX                                                         2
+#define regDP1_DP_CP_LINK_VERIFICATION_PATTERN                                                          0x223f
+#define regDP1_DP_CP_LINK_VERIFICATION_PATTERN_BASE_IDX                                                 2
+#define regDP1_DP_SEC_CNTL                                                                              0x2242
+#define regDP1_DP_SEC_CNTL_BASE_IDX                                                                     2
+#define regDP1_DP_SEC_CNTL1                                                                             0x2243
+#define regDP1_DP_SEC_CNTL1_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_FRAMING1                                                                          0x2244
+#define regDP1_DP_SEC_FRAMING1_BASE_IDX                                                                 2
+#define regDP1_DP_SEC_FRAMING2                                                                          0x2245
+#define regDP1_DP_SEC_FRAMING2_BASE_IDX                                                                 2
+#define regDP1_DP_SEC_FRAMING3                                                                          0x2246
+#define regDP1_DP_SEC_FRAMING3_BASE_IDX                                                                 2
+#define regDP1_DP_SEC_FRAMING4                                                                          0x2247
+#define regDP1_DP_SEC_FRAMING4_BASE_IDX                                                                 2
+#define regDP1_DP_SEC_AUD_N                                                                             0x2248
+#define regDP1_DP_SEC_AUD_N_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_AUD_N_READBACK                                                                    0x2249
+#define regDP1_DP_SEC_AUD_N_READBACK_BASE_IDX                                                           2
+#define regDP1_DP_SEC_AUD_M                                                                             0x224a
+#define regDP1_DP_SEC_AUD_M_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_AUD_M_READBACK                                                                    0x224b
+#define regDP1_DP_SEC_AUD_M_READBACK_BASE_IDX                                                           2
+#define regDP1_DP_SEC_TIMESTAMP                                                                         0x224c
+#define regDP1_DP_SEC_TIMESTAMP_BASE_IDX                                                                2
+#define regDP1_DP_SEC_PACKET_CNTL                                                                       0x224d
+#define regDP1_DP_SEC_PACKET_CNTL_BASE_IDX                                                              2
+#define regDP1_DP_MSE_RATE_CNTL                                                                         0x224e
+#define regDP1_DP_MSE_RATE_CNTL_BASE_IDX                                                                2
+#define regDP1_DP_CP_MSE_STATUS                                                                         0x224f
+#define regDP1_DP_CP_MSE_STATUS_BASE_IDX                                                                2
+#define regDP1_DP_MSE_RATE_UPDATE                                                                       0x2250
+#define regDP1_DP_MSE_RATE_UPDATE_BASE_IDX                                                              2
+#define regDP1_DP_MSE_SAT0                                                                              0x2251
+#define regDP1_DP_MSE_SAT0_BASE_IDX                                                                     2
+#define regDP1_DP_MSE_SAT1                                                                              0x2252
+#define regDP1_DP_MSE_SAT1_BASE_IDX                                                                     2
+#define regDP1_DP_MSE_SAT2                                                                              0x2253
+#define regDP1_DP_MSE_SAT2_BASE_IDX                                                                     2
+#define regDP1_DP_MSE_SAT_UPDATE                                                                        0x2254
+#define regDP1_DP_MSE_SAT_UPDATE_BASE_IDX                                                               2
+#define regDP1_DP_MSE_LINK_TIMING                                                                       0x2255
+#define regDP1_DP_MSE_LINK_TIMING_BASE_IDX                                                              2
+#define regDP1_DP_MSE_MISC_CNTL                                                                         0x2256
+#define regDP1_DP_MSE_MISC_CNTL_BASE_IDX                                                                2
+#define regDP1_DP_TEST_DEBUG_DATA                                                                       0x2258
+#define regDP1_DP_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regDP1_DP_DPHY_BS_SR_SWAP_CNTL                                                                  0x225b
+#define regDP1_DP_DPHY_BS_SR_SWAP_CNTL_BASE_IDX                                                         2
+#define regDP1_DP_DPHY_HBR2_PATTERN_CONTROL                                                             0x225c
+#define regDP1_DP_DPHY_HBR2_PATTERN_CONTROL_BASE_IDX                                                    2
+#define regDP1_DP_MSE_SAT0_STATUS                                                                       0x225e
+#define regDP1_DP_MSE_SAT0_STATUS_BASE_IDX                                                              2
+#define regDP1_DP_MSE_SAT1_STATUS                                                                       0x225f
+#define regDP1_DP_MSE_SAT1_STATUS_BASE_IDX                                                              2
+#define regDP1_DP_MSE_SAT2_STATUS                                                                       0x2260
+#define regDP1_DP_MSE_SAT2_STATUS_BASE_IDX                                                              2
+#define regDP1_DP_HBLANK_CONTROL                                                                        0x2262
+#define regDP1_DP_HBLANK_CONTROL_BASE_IDX                                                               2
+#define regDP1_DP_MSA_TIMING_PARAM1                                                                     0x2263
+#define regDP1_DP_MSA_TIMING_PARAM1_BASE_IDX                                                            2
+#define regDP1_DP_MSA_TIMING_PARAM2                                                                     0x2264
+#define regDP1_DP_MSA_TIMING_PARAM2_BASE_IDX                                                            2
+#define regDP1_DP_MSA_TIMING_PARAM3                                                                     0x2265
+#define regDP1_DP_MSA_TIMING_PARAM3_BASE_IDX                                                            2
+#define regDP1_DP_MSA_TIMING_PARAM4                                                                     0x2266
+#define regDP1_DP_MSA_TIMING_PARAM4_BASE_IDX                                                            2
+#define regDP1_DP_MSO_CNTL                                                                              0x2267
+#define regDP1_DP_MSO_CNTL_BASE_IDX                                                                     2
+#define regDP1_DP_MSO_CNTL1                                                                             0x2268
+#define regDP1_DP_MSO_CNTL1_BASE_IDX                                                                    2
+#define regDP1_DP_STEER_FIFO_CNTL                                                                       0x2269
+#define regDP1_DP_STEER_FIFO_CNTL_BASE_IDX                                                              2
+#define regDP1_DP_SEC_CNTL2                                                                             0x226a
+#define regDP1_DP_SEC_CNTL2_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_CNTL3                                                                             0x226b
+#define regDP1_DP_SEC_CNTL3_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_CNTL4                                                                             0x226c
+#define regDP1_DP_SEC_CNTL4_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_CNTL5                                                                             0x226d
+#define regDP1_DP_SEC_CNTL5_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_CNTL6                                                                             0x226e
+#define regDP1_DP_SEC_CNTL6_BASE_IDX                                                                    2
+#define regDP1_DP_SEC_CNTL7                                                                             0x226f
+#define regDP1_DP_SEC_CNTL7_BASE_IDX                                                                    2
+#define regDP1_DP_DB_CNTL                                                                               0x2270
+#define regDP1_DP_DB_CNTL_BASE_IDX                                                                      2
+#define regDP1_DP_MSA_VBID_MISC                                                                         0x2271
+#define regDP1_DP_MSA_VBID_MISC_BASE_IDX                                                                2
+#define regDP1_DP_SEC_METADATA_TRANSMISSION                                                             0x2272
+#define regDP1_DP_SEC_METADATA_TRANSMISSION_BASE_IDX                                                    2
+#define regDP1_DP_ALPM_CNTL                                                                             0x2274
+#define regDP1_DP_ALPM_CNTL_BASE_IDX                                                                    2
+#define regDP1_DP_GSP8_CNTL                                                                             0x2275
+#define regDP1_DP_GSP8_CNTL_BASE_IDX                                                                    2
+#define regDP1_DP_GSP9_CNTL                                                                             0x2276
+#define regDP1_DP_GSP9_CNTL_BASE_IDX                                                                    2
+#define regDP1_DP_GSP10_CNTL                                                                            0x2277
+#define regDP1_DP_GSP10_CNTL_BASE_IDX                                                                   2
+#define regDP1_DP_GSP11_CNTL                                                                            0x2278
+#define regDP1_DP_GSP11_CNTL_BASE_IDX                                                                   2
+#define regDP1_DP_GSP_EN_DB_STATUS                                                                      0x2279
+#define regDP1_DP_GSP_EN_DB_STATUS_BASE_IDX                                                             2
+#define regDP1_DP_AUXLESS_ALPM_CNTL1                                                                    0x227a
+#define regDP1_DP_AUXLESS_ALPM_CNTL1_BASE_IDX                                                           2
+#define regDP1_DP_AUXLESS_ALPM_CNTL2                                                                    0x227b
+#define regDP1_DP_AUXLESS_ALPM_CNTL2_BASE_IDX                                                           2
+#define regDP1_DP_AUXLESS_ALPM_CNTL3                                                                    0x227c
+#define regDP1_DP_AUXLESS_ALPM_CNTL3_BASE_IDX                                                           2
+#define regDP1_DP_AUXLESS_ALPM_CNTL4                                                                    0x227d
+#define regDP1_DP_AUXLESS_ALPM_CNTL4_BASE_IDX                                                           2
+#define regDP1_DP_AUXLESS_ALPM_CNTL5                                                                    0x227e
+#define regDP1_DP_AUXLESS_ALPM_CNTL5_BASE_IDX                                                           2
+#define regDP1_DP_STREAM_SYMBOL_COUNT_STATUS                                                            0x227f
+#define regDP1_DP_STREAM_SYMBOL_COUNT_STATUS_BASE_IDX                                                   2
+#define regDP1_DP_STREAM_SYMBOL_COUNT_CONTROL                                                           0x2280
+#define regDP1_DP_STREAM_SYMBOL_COUNT_CONTROL_BASE_IDX                                                  2
+#define regDP1_DP_LINK_SYMBOL_COUNT_STATUS0                                                             0x2281
+#define regDP1_DP_LINK_SYMBOL_COUNT_STATUS0_BASE_IDX                                                    2
+#define regDP1_DP_LINK_SYMBOL_COUNT_STATUS1                                                             0x2282
+#define regDP1_DP_LINK_SYMBOL_COUNT_STATUS1_BASE_IDX                                                    2
+#define regDP1_DP_LINK_SYMBOL_COUNT_CONTROL                                                             0x2283
+#define regDP1_DP_LINK_SYMBOL_COUNT_CONTROL_BASE_IDX                                                    2
+#define regDP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL                                                     0x2284
+#define regDP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                            2
+#define regDP1_DP_DPHY_FAST_TRAINING                                                                    0x2287
+#define regDP1_DP_DPHY_FAST_TRAINING_BASE_IDX                                                           2
+#define regDP1_DP_DPHY_FAST_TRAINING_STATUS                                                             0x2288
+#define regDP1_DP_DPHY_FAST_TRAINING_STATUS_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dio_dig1_dispdec
+// base address: 0x4ac
+#define regDIG1_DIG_FE_CNTL                                                                             0x2194
+#define regDIG1_DIG_FE_CNTL_BASE_IDX                                                                    2
+#define regDIG1_DIG_FE_CLK_CNTL                                                                         0x2195
+#define regDIG1_DIG_FE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG1_DIG_FE_EN_CNTL                                                                          0x2196
+#define regDIG1_DIG_FE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG1_DIG_OUTPUT_CRC_CNTL                                                                     0x2197
+#define regDIG1_DIG_OUTPUT_CRC_CNTL_BASE_IDX                                                            2
+#define regDIG1_DIG_OUTPUT_CRC_RESULT                                                                   0x2198
+#define regDIG1_DIG_OUTPUT_CRC_RESULT_BASE_IDX                                                          2
+#define regDIG1_DIG_CLOCK_PATTERN                                                                       0x2199
+#define regDIG1_DIG_CLOCK_PATTERN_BASE_IDX                                                              2
+#define regDIG1_DIG_TEST_PATTERN                                                                        0x219a
+#define regDIG1_DIG_TEST_PATTERN_BASE_IDX                                                               2
+#define regDIG1_DIG_RANDOM_PATTERN_SEED                                                                 0x219b
+#define regDIG1_DIG_RANDOM_PATTERN_SEED_BASE_IDX                                                        2
+#define regDIG1_DIG_FIFO_CTRL0                                                                          0x219c
+#define regDIG1_DIG_FIFO_CTRL0_BASE_IDX                                                                 2
+#define regDIG1_DIG_FIFO_CTRL1                                                                          0x219d
+#define regDIG1_DIG_FIFO_CTRL1_BASE_IDX                                                                 2
+#define regDIG1_HDMI_METADATA_PACKET_CONTROL                                                            0x219e
+#define regDIG1_HDMI_METADATA_PACKET_CONTROL_BASE_IDX                                                   2
+#define regDIG1_HDMI_CONTROL                                                                            0x219f
+#define regDIG1_HDMI_CONTROL_BASE_IDX                                                                   2
+#define regDIG1_HDMI_STATUS                                                                             0x21a0
+#define regDIG1_HDMI_STATUS_BASE_IDX                                                                    2
+#define regDIG1_HDMI_AUDIO_PACKET_CONTROL                                                               0x21a1
+#define regDIG1_HDMI_AUDIO_PACKET_CONTROL_BASE_IDX                                                      2
+#define regDIG1_HDMI_ACR_PACKET_CONTROL                                                                 0x21a2
+#define regDIG1_HDMI_ACR_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG1_HDMI_VBI_PACKET_CONTROL                                                                 0x21a3
+#define regDIG1_HDMI_VBI_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG1_HDMI_INFOFRAME_CONTROL0                                                                 0x21a4
+#define regDIG1_HDMI_INFOFRAME_CONTROL0_BASE_IDX                                                        2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL0                                                            0x21a5
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL0_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL6                                                            0x21a6
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL6_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL5                                                            0x21a7
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL5_BASE_IDX                                                   2
+#define regDIG1_HDMI_GC                                                                                 0x21a8
+#define regDIG1_HDMI_GC_BASE_IDX                                                                        2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL1                                                            0x21a9
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL1_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL2                                                            0x21aa
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL2_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL3                                                            0x21ab
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL3_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL4                                                            0x21ac
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL4_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL7                                                            0x21ad
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL7_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL8                                                            0x21ae
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL8_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL9                                                            0x21af
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL9_BASE_IDX                                                   2
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL10                                                           0x21b0
+#define regDIG1_HDMI_GENERIC_PACKET_CONTROL10_BASE_IDX                                                  2
+#define regDIG1_HDMI_DB_CONTROL                                                                         0x21b1
+#define regDIG1_HDMI_DB_CONTROL_BASE_IDX                                                                2
+#define regDIG1_HDMI_ACR_32_0                                                                           0x21b2
+#define regDIG1_HDMI_ACR_32_0_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_32_1                                                                           0x21b3
+#define regDIG1_HDMI_ACR_32_1_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_44_0                                                                           0x21b4
+#define regDIG1_HDMI_ACR_44_0_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_44_1                                                                           0x21b5
+#define regDIG1_HDMI_ACR_44_1_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_48_0                                                                           0x21b6
+#define regDIG1_HDMI_ACR_48_0_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_48_1                                                                           0x21b7
+#define regDIG1_HDMI_ACR_48_1_BASE_IDX                                                                  2
+#define regDIG1_HDMI_ACR_STATUS_0                                                                       0x21b8
+#define regDIG1_HDMI_ACR_STATUS_0_BASE_IDX                                                              2
+#define regDIG1_HDMI_ACR_STATUS_1                                                                       0x21b9
+#define regDIG1_HDMI_ACR_STATUS_1_BASE_IDX                                                              2
+#define regDIG1_DIG_FE_AUDIO_CNTL                                                                       0x21ba
+#define regDIG1_DIG_FE_AUDIO_CNTL_BASE_IDX                                                              2
+#define regDIG1_DIG_BE_CLK_CNTL                                                                         0x21bb
+#define regDIG1_DIG_BE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG1_DIG_BE_CNTL                                                                             0x21bc
+#define regDIG1_DIG_BE_CNTL_BASE_IDX                                                                    2
+#define regDIG1_DIG_BE_EN_CNTL                                                                          0x21bd
+#define regDIG1_DIG_BE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG1_HDCP_INT_CONTROL                                                                        0x21c0
+#define regDIG1_HDCP_INT_CONTROL_BASE_IDX                                                               2
+#define regDIG1_HDCP_I2C_CONTROL_0                                                                      0x21c2
+#define regDIG1_HDCP_I2C_CONTROL_0_BASE_IDX                                                             2
+#define regDIG1_HDCP_I2C_CONTROL_1                                                                      0x21c3
+#define regDIG1_HDCP_I2C_CONTROL_1_BASE_IDX                                                             2
+#define regDIG1_TMDS_CNTL                                                                               0x21e4
+#define regDIG1_TMDS_CNTL_BASE_IDX                                                                      2
+#define regDIG1_TMDS_CONTROL_CHAR                                                                       0x21e5
+#define regDIG1_TMDS_CONTROL_CHAR_BASE_IDX                                                              2
+#define regDIG1_TMDS_CONTROL0_FEEDBACK                                                                  0x21e6
+#define regDIG1_TMDS_CONTROL0_FEEDBACK_BASE_IDX                                                         2
+#define regDIG1_TMDS_STEREOSYNC_CTL_SEL                                                                 0x21e7
+#define regDIG1_TMDS_STEREOSYNC_CTL_SEL_BASE_IDX                                                        2
+#define regDIG1_TMDS_SYNC_CHAR_PATTERN_0_1                                                              0x21e8
+#define regDIG1_TMDS_SYNC_CHAR_PATTERN_0_1_BASE_IDX                                                     2
+#define regDIG1_TMDS_SYNC_CHAR_PATTERN_2_3                                                              0x21e9
+#define regDIG1_TMDS_SYNC_CHAR_PATTERN_2_3_BASE_IDX                                                     2
+#define regDIG1_TMDS_CTL_BITS                                                                           0x21eb
+#define regDIG1_TMDS_CTL_BITS_BASE_IDX                                                                  2
+#define regDIG1_TMDS_DCBALANCER_CONTROL                                                                 0x21ec
+#define regDIG1_TMDS_DCBALANCER_CONTROL_BASE_IDX                                                        2
+#define regDIG1_TMDS_CTL0_1_GEN_CNTL                                                                    0x21ee
+#define regDIG1_TMDS_CTL0_1_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG1_TMDS_CTL2_3_GEN_CNTL                                                                    0x21ef
+#define regDIG1_TMDS_CTL2_3_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG1_DIG_VERSION                                                                             0x21f1
+#define regDIG1_DIG_VERSION_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dp2_dispdec
+// base address: 0x958
+#define regDP2_DP_LINK_CNTL                                                                             0x234a
+#define regDP2_DP_LINK_CNTL_BASE_IDX                                                                    2
+#define regDP2_DP_PIXEL_FORMAT                                                                          0x234b
+#define regDP2_DP_PIXEL_FORMAT_BASE_IDX                                                                 2
+#define regDP2_DP_MSA_COLORIMETRY                                                                       0x234c
+#define regDP2_DP_MSA_COLORIMETRY_BASE_IDX                                                              2
+#define regDP2_DP_CONFIG                                                                                0x234d
+#define regDP2_DP_CONFIG_BASE_IDX                                                                       2
+#define regDP2_DP_VID_STREAM_CNTL                                                                       0x234e
+#define regDP2_DP_VID_STREAM_CNTL_BASE_IDX                                                              2
+#define regDP2_DP_STEER_FIFO                                                                            0x234f
+#define regDP2_DP_STEER_FIFO_BASE_IDX                                                                   2
+#define regDP2_DP_MSA_MISC                                                                              0x2350
+#define regDP2_DP_MSA_MISC_BASE_IDX                                                                     2
+#define regDP2_DP_DPHY_INTERNAL_CTRL                                                                    0x2351
+#define regDP2_DP_DPHY_INTERNAL_CTRL_BASE_IDX                                                           2
+#define regDP2_DP_VID_TIMING                                                                            0x2352
+#define regDP2_DP_VID_TIMING_BASE_IDX                                                                   2
+#define regDP2_DP_VID_N                                                                                 0x2353
+#define regDP2_DP_VID_N_BASE_IDX                                                                        2
+#define regDP2_DP_VID_M                                                                                 0x2354
+#define regDP2_DP_VID_M_BASE_IDX                                                                        2
+#define regDP2_DP_LINK_FRAMING_CNTL                                                                     0x2355
+#define regDP2_DP_LINK_FRAMING_CNTL_BASE_IDX                                                            2
+#define regDP2_DP_HBR2_EYE_PATTERN                                                                      0x2356
+#define regDP2_DP_HBR2_EYE_PATTERN_BASE_IDX                                                             2
+#define regDP2_DP_VID_MSA_VBID                                                                          0x2357
+#define regDP2_DP_VID_MSA_VBID_BASE_IDX                                                                 2
+#define regDP2_DP_VID_INTERRUPT_CNTL                                                                    0x2358
+#define regDP2_DP_VID_INTERRUPT_CNTL_BASE_IDX                                                           2
+#define regDP2_DP_DPHY_CNTL                                                                             0x2359
+#define regDP2_DP_DPHY_CNTL_BASE_IDX                                                                    2
+#define regDP2_DP_DPHY_TRAINING_PATTERN_SEL                                                             0x235a
+#define regDP2_DP_DPHY_TRAINING_PATTERN_SEL_BASE_IDX                                                    2
+#define regDP2_DP_DPHY_SYM0                                                                             0x235b
+#define regDP2_DP_DPHY_SYM0_BASE_IDX                                                                    2
+#define regDP2_DP_DPHY_SYM1                                                                             0x235c
+#define regDP2_DP_DPHY_SYM1_BASE_IDX                                                                    2
+#define regDP2_DP_DPHY_SYM2                                                                             0x235d
+#define regDP2_DP_DPHY_SYM2_BASE_IDX                                                                    2
+#define regDP2_DP_DPHY_8B10B_CNTL                                                                       0x235e
+#define regDP2_DP_DPHY_8B10B_CNTL_BASE_IDX                                                              2
+#define regDP2_DP_DPHY_PRBS_CNTL                                                                        0x235f
+#define regDP2_DP_DPHY_PRBS_CNTL_BASE_IDX                                                               2
+#define regDP2_DP_DPHY_SCRAM_CNTL                                                                       0x2360
+#define regDP2_DP_DPHY_SCRAM_CNTL_BASE_IDX                                                              2
+#define regDP2_DP_TU_CNTL                                                                               0x2368
+#define regDP2_DP_TU_CNTL_BASE_IDX                                                                      2
+#define regDP2_DP_PIXEL_FORMAT_DB_CNTL                                                                  0x2369
+#define regDP2_DP_PIXEL_FORMAT_DB_CNTL_BASE_IDX                                                         2
+#define regDP2_DP_CP_LINK_VERIFICATION_PATTERN                                                          0x236a
+#define regDP2_DP_CP_LINK_VERIFICATION_PATTERN_BASE_IDX                                                 2
+#define regDP2_DP_SEC_CNTL                                                                              0x236d
+#define regDP2_DP_SEC_CNTL_BASE_IDX                                                                     2
+#define regDP2_DP_SEC_CNTL1                                                                             0x236e
+#define regDP2_DP_SEC_CNTL1_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_FRAMING1                                                                          0x236f
+#define regDP2_DP_SEC_FRAMING1_BASE_IDX                                                                 2
+#define regDP2_DP_SEC_FRAMING2                                                                          0x2370
+#define regDP2_DP_SEC_FRAMING2_BASE_IDX                                                                 2
+#define regDP2_DP_SEC_FRAMING3                                                                          0x2371
+#define regDP2_DP_SEC_FRAMING3_BASE_IDX                                                                 2
+#define regDP2_DP_SEC_FRAMING4                                                                          0x2372
+#define regDP2_DP_SEC_FRAMING4_BASE_IDX                                                                 2
+#define regDP2_DP_SEC_AUD_N                                                                             0x2373
+#define regDP2_DP_SEC_AUD_N_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_AUD_N_READBACK                                                                    0x2374
+#define regDP2_DP_SEC_AUD_N_READBACK_BASE_IDX                                                           2
+#define regDP2_DP_SEC_AUD_M                                                                             0x2375
+#define regDP2_DP_SEC_AUD_M_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_AUD_M_READBACK                                                                    0x2376
+#define regDP2_DP_SEC_AUD_M_READBACK_BASE_IDX                                                           2
+#define regDP2_DP_SEC_TIMESTAMP                                                                         0x2377
+#define regDP2_DP_SEC_TIMESTAMP_BASE_IDX                                                                2
+#define regDP2_DP_SEC_PACKET_CNTL                                                                       0x2378
+#define regDP2_DP_SEC_PACKET_CNTL_BASE_IDX                                                              2
+#define regDP2_DP_MSE_RATE_CNTL                                                                         0x2379
+#define regDP2_DP_MSE_RATE_CNTL_BASE_IDX                                                                2
+#define regDP2_DP_CP_MSE_STATUS                                                                         0x237a
+#define regDP2_DP_CP_MSE_STATUS_BASE_IDX                                                                2
+#define regDP2_DP_MSE_RATE_UPDATE                                                                       0x237b
+#define regDP2_DP_MSE_RATE_UPDATE_BASE_IDX                                                              2
+#define regDP2_DP_MSE_SAT0                                                                              0x237c
+#define regDP2_DP_MSE_SAT0_BASE_IDX                                                                     2
+#define regDP2_DP_MSE_SAT1                                                                              0x237d
+#define regDP2_DP_MSE_SAT1_BASE_IDX                                                                     2
+#define regDP2_DP_MSE_SAT2                                                                              0x237e
+#define regDP2_DP_MSE_SAT2_BASE_IDX                                                                     2
+#define regDP2_DP_MSE_SAT_UPDATE                                                                        0x237f
+#define regDP2_DP_MSE_SAT_UPDATE_BASE_IDX                                                               2
+#define regDP2_DP_MSE_LINK_TIMING                                                                       0x2380
+#define regDP2_DP_MSE_LINK_TIMING_BASE_IDX                                                              2
+#define regDP2_DP_MSE_MISC_CNTL                                                                         0x2381
+#define regDP2_DP_MSE_MISC_CNTL_BASE_IDX                                                                2
+#define regDP2_DP_TEST_DEBUG_DATA                                                                       0x2383
+#define regDP2_DP_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regDP2_DP_DPHY_BS_SR_SWAP_CNTL                                                                  0x2386
+#define regDP2_DP_DPHY_BS_SR_SWAP_CNTL_BASE_IDX                                                         2
+#define regDP2_DP_DPHY_HBR2_PATTERN_CONTROL                                                             0x2387
+#define regDP2_DP_DPHY_HBR2_PATTERN_CONTROL_BASE_IDX                                                    2
+#define regDP2_DP_MSE_SAT0_STATUS                                                                       0x2389
+#define regDP2_DP_MSE_SAT0_STATUS_BASE_IDX                                                              2
+#define regDP2_DP_MSE_SAT1_STATUS                                                                       0x238a
+#define regDP2_DP_MSE_SAT1_STATUS_BASE_IDX                                                              2
+#define regDP2_DP_MSE_SAT2_STATUS                                                                       0x238b
+#define regDP2_DP_MSE_SAT2_STATUS_BASE_IDX                                                              2
+#define regDP2_DP_HBLANK_CONTROL                                                                        0x238d
+#define regDP2_DP_HBLANK_CONTROL_BASE_IDX                                                               2
+#define regDP2_DP_MSA_TIMING_PARAM1                                                                     0x238e
+#define regDP2_DP_MSA_TIMING_PARAM1_BASE_IDX                                                            2
+#define regDP2_DP_MSA_TIMING_PARAM2                                                                     0x238f
+#define regDP2_DP_MSA_TIMING_PARAM2_BASE_IDX                                                            2
+#define regDP2_DP_MSA_TIMING_PARAM3                                                                     0x2390
+#define regDP2_DP_MSA_TIMING_PARAM3_BASE_IDX                                                            2
+#define regDP2_DP_MSA_TIMING_PARAM4                                                                     0x2391
+#define regDP2_DP_MSA_TIMING_PARAM4_BASE_IDX                                                            2
+#define regDP2_DP_MSO_CNTL                                                                              0x2392
+#define regDP2_DP_MSO_CNTL_BASE_IDX                                                                     2
+#define regDP2_DP_MSO_CNTL1                                                                             0x2393
+#define regDP2_DP_MSO_CNTL1_BASE_IDX                                                                    2
+#define regDP2_DP_STEER_FIFO_CNTL                                                                       0x2394
+#define regDP2_DP_STEER_FIFO_CNTL_BASE_IDX                                                              2
+#define regDP2_DP_SEC_CNTL2                                                                             0x2395
+#define regDP2_DP_SEC_CNTL2_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_CNTL3                                                                             0x2396
+#define regDP2_DP_SEC_CNTL3_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_CNTL4                                                                             0x2397
+#define regDP2_DP_SEC_CNTL4_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_CNTL5                                                                             0x2398
+#define regDP2_DP_SEC_CNTL5_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_CNTL6                                                                             0x2399
+#define regDP2_DP_SEC_CNTL6_BASE_IDX                                                                    2
+#define regDP2_DP_SEC_CNTL7                                                                             0x239a
+#define regDP2_DP_SEC_CNTL7_BASE_IDX                                                                    2
+#define regDP2_DP_DB_CNTL                                                                               0x239b
+#define regDP2_DP_DB_CNTL_BASE_IDX                                                                      2
+#define regDP2_DP_MSA_VBID_MISC                                                                         0x239c
+#define regDP2_DP_MSA_VBID_MISC_BASE_IDX                                                                2
+#define regDP2_DP_SEC_METADATA_TRANSMISSION                                                             0x239d
+#define regDP2_DP_SEC_METADATA_TRANSMISSION_BASE_IDX                                                    2
+#define regDP2_DP_ALPM_CNTL                                                                             0x239f
+#define regDP2_DP_ALPM_CNTL_BASE_IDX                                                                    2
+#define regDP2_DP_GSP8_CNTL                                                                             0x23a0
+#define regDP2_DP_GSP8_CNTL_BASE_IDX                                                                    2
+#define regDP2_DP_GSP9_CNTL                                                                             0x23a1
+#define regDP2_DP_GSP9_CNTL_BASE_IDX                                                                    2
+#define regDP2_DP_GSP10_CNTL                                                                            0x23a2
+#define regDP2_DP_GSP10_CNTL_BASE_IDX                                                                   2
+#define regDP2_DP_GSP11_CNTL                                                                            0x23a3
+#define regDP2_DP_GSP11_CNTL_BASE_IDX                                                                   2
+#define regDP2_DP_GSP_EN_DB_STATUS                                                                      0x23a4
+#define regDP2_DP_GSP_EN_DB_STATUS_BASE_IDX                                                             2
+#define regDP2_DP_AUXLESS_ALPM_CNTL1                                                                    0x23a5
+#define regDP2_DP_AUXLESS_ALPM_CNTL1_BASE_IDX                                                           2
+#define regDP2_DP_AUXLESS_ALPM_CNTL2                                                                    0x23a6
+#define regDP2_DP_AUXLESS_ALPM_CNTL2_BASE_IDX                                                           2
+#define regDP2_DP_AUXLESS_ALPM_CNTL3                                                                    0x23a7
+#define regDP2_DP_AUXLESS_ALPM_CNTL3_BASE_IDX                                                           2
+#define regDP2_DP_AUXLESS_ALPM_CNTL4                                                                    0x23a8
+#define regDP2_DP_AUXLESS_ALPM_CNTL4_BASE_IDX                                                           2
+#define regDP2_DP_AUXLESS_ALPM_CNTL5                                                                    0x23a9
+#define regDP2_DP_AUXLESS_ALPM_CNTL5_BASE_IDX                                                           2
+#define regDP2_DP_STREAM_SYMBOL_COUNT_STATUS                                                            0x23aa
+#define regDP2_DP_STREAM_SYMBOL_COUNT_STATUS_BASE_IDX                                                   2
+#define regDP2_DP_STREAM_SYMBOL_COUNT_CONTROL                                                           0x23ab
+#define regDP2_DP_STREAM_SYMBOL_COUNT_CONTROL_BASE_IDX                                                  2
+#define regDP2_DP_LINK_SYMBOL_COUNT_STATUS0                                                             0x23ac
+#define regDP2_DP_LINK_SYMBOL_COUNT_STATUS0_BASE_IDX                                                    2
+#define regDP2_DP_LINK_SYMBOL_COUNT_STATUS1                                                             0x23ad
+#define regDP2_DP_LINK_SYMBOL_COUNT_STATUS1_BASE_IDX                                                    2
+#define regDP2_DP_LINK_SYMBOL_COUNT_CONTROL                                                             0x23ae
+#define regDP2_DP_LINK_SYMBOL_COUNT_CONTROL_BASE_IDX                                                    2
+#define regDP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL                                                     0x23af
+#define regDP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                            2
+#define regDP2_DP_DPHY_FAST_TRAINING                                                                    0x23b2
+#define regDP2_DP_DPHY_FAST_TRAINING_BASE_IDX                                                           2
+#define regDP2_DP_DPHY_FAST_TRAINING_STATUS                                                             0x23b3
+#define regDP2_DP_DPHY_FAST_TRAINING_STATUS_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dio_dig2_dispdec
+// base address: 0x958
+#define regDIG2_DIG_FE_CNTL                                                                             0x22bf
+#define regDIG2_DIG_FE_CNTL_BASE_IDX                                                                    2
+#define regDIG2_DIG_FE_CLK_CNTL                                                                         0x22c0
+#define regDIG2_DIG_FE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG2_DIG_FE_EN_CNTL                                                                          0x22c1
+#define regDIG2_DIG_FE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG2_DIG_OUTPUT_CRC_CNTL                                                                     0x22c2
+#define regDIG2_DIG_OUTPUT_CRC_CNTL_BASE_IDX                                                            2
+#define regDIG2_DIG_OUTPUT_CRC_RESULT                                                                   0x22c3
+#define regDIG2_DIG_OUTPUT_CRC_RESULT_BASE_IDX                                                          2
+#define regDIG2_DIG_CLOCK_PATTERN                                                                       0x22c4
+#define regDIG2_DIG_CLOCK_PATTERN_BASE_IDX                                                              2
+#define regDIG2_DIG_TEST_PATTERN                                                                        0x22c5
+#define regDIG2_DIG_TEST_PATTERN_BASE_IDX                                                               2
+#define regDIG2_DIG_RANDOM_PATTERN_SEED                                                                 0x22c6
+#define regDIG2_DIG_RANDOM_PATTERN_SEED_BASE_IDX                                                        2
+#define regDIG2_DIG_FIFO_CTRL0                                                                          0x22c7
+#define regDIG2_DIG_FIFO_CTRL0_BASE_IDX                                                                 2
+#define regDIG2_DIG_FIFO_CTRL1                                                                          0x22c8
+#define regDIG2_DIG_FIFO_CTRL1_BASE_IDX                                                                 2
+#define regDIG2_HDMI_METADATA_PACKET_CONTROL                                                            0x22c9
+#define regDIG2_HDMI_METADATA_PACKET_CONTROL_BASE_IDX                                                   2
+#define regDIG2_HDMI_CONTROL                                                                            0x22ca
+#define regDIG2_HDMI_CONTROL_BASE_IDX                                                                   2
+#define regDIG2_HDMI_STATUS                                                                             0x22cb
+#define regDIG2_HDMI_STATUS_BASE_IDX                                                                    2
+#define regDIG2_HDMI_AUDIO_PACKET_CONTROL                                                               0x22cc
+#define regDIG2_HDMI_AUDIO_PACKET_CONTROL_BASE_IDX                                                      2
+#define regDIG2_HDMI_ACR_PACKET_CONTROL                                                                 0x22cd
+#define regDIG2_HDMI_ACR_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG2_HDMI_VBI_PACKET_CONTROL                                                                 0x22ce
+#define regDIG2_HDMI_VBI_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG2_HDMI_INFOFRAME_CONTROL0                                                                 0x22cf
+#define regDIG2_HDMI_INFOFRAME_CONTROL0_BASE_IDX                                                        2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL0                                                            0x22d0
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL0_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL6                                                            0x22d1
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL6_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL5                                                            0x22d2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL5_BASE_IDX                                                   2
+#define regDIG2_HDMI_GC                                                                                 0x22d3
+#define regDIG2_HDMI_GC_BASE_IDX                                                                        2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL1                                                            0x22d4
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL1_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL2                                                            0x22d5
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL2_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL3                                                            0x22d6
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL3_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL4                                                            0x22d7
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL4_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL7                                                            0x22d8
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL7_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL8                                                            0x22d9
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL8_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL9                                                            0x22da
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL9_BASE_IDX                                                   2
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL10                                                           0x22db
+#define regDIG2_HDMI_GENERIC_PACKET_CONTROL10_BASE_IDX                                                  2
+#define regDIG2_HDMI_DB_CONTROL                                                                         0x22dc
+#define regDIG2_HDMI_DB_CONTROL_BASE_IDX                                                                2
+#define regDIG2_HDMI_ACR_32_0                                                                           0x22dd
+#define regDIG2_HDMI_ACR_32_0_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_32_1                                                                           0x22de
+#define regDIG2_HDMI_ACR_32_1_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_44_0                                                                           0x22df
+#define regDIG2_HDMI_ACR_44_0_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_44_1                                                                           0x22e0
+#define regDIG2_HDMI_ACR_44_1_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_48_0                                                                           0x22e1
+#define regDIG2_HDMI_ACR_48_0_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_48_1                                                                           0x22e2
+#define regDIG2_HDMI_ACR_48_1_BASE_IDX                                                                  2
+#define regDIG2_HDMI_ACR_STATUS_0                                                                       0x22e3
+#define regDIG2_HDMI_ACR_STATUS_0_BASE_IDX                                                              2
+#define regDIG2_HDMI_ACR_STATUS_1                                                                       0x22e4
+#define regDIG2_HDMI_ACR_STATUS_1_BASE_IDX                                                              2
+#define regDIG2_DIG_FE_AUDIO_CNTL                                                                       0x22e5
+#define regDIG2_DIG_FE_AUDIO_CNTL_BASE_IDX                                                              2
+#define regDIG2_DIG_BE_CLK_CNTL                                                                         0x22e6
+#define regDIG2_DIG_BE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG2_DIG_BE_CNTL                                                                             0x22e7
+#define regDIG2_DIG_BE_CNTL_BASE_IDX                                                                    2
+#define regDIG2_DIG_BE_EN_CNTL                                                                          0x22e8
+#define regDIG2_DIG_BE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG2_HDCP_INT_CONTROL                                                                        0x22eb
+#define regDIG2_HDCP_INT_CONTROL_BASE_IDX                                                               2
+#define regDIG2_HDCP_I2C_CONTROL_0                                                                      0x22ed
+#define regDIG2_HDCP_I2C_CONTROL_0_BASE_IDX                                                             2
+#define regDIG2_HDCP_I2C_CONTROL_1                                                                      0x22ee
+#define regDIG2_HDCP_I2C_CONTROL_1_BASE_IDX                                                             2
+#define regDIG2_TMDS_CNTL                                                                               0x230f
+#define regDIG2_TMDS_CNTL_BASE_IDX                                                                      2
+#define regDIG2_TMDS_CONTROL_CHAR                                                                       0x2310
+#define regDIG2_TMDS_CONTROL_CHAR_BASE_IDX                                                              2
+#define regDIG2_TMDS_CONTROL0_FEEDBACK                                                                  0x2311
+#define regDIG2_TMDS_CONTROL0_FEEDBACK_BASE_IDX                                                         2
+#define regDIG2_TMDS_STEREOSYNC_CTL_SEL                                                                 0x2312
+#define regDIG2_TMDS_STEREOSYNC_CTL_SEL_BASE_IDX                                                        2
+#define regDIG2_TMDS_SYNC_CHAR_PATTERN_0_1                                                              0x2313
+#define regDIG2_TMDS_SYNC_CHAR_PATTERN_0_1_BASE_IDX                                                     2
+#define regDIG2_TMDS_SYNC_CHAR_PATTERN_2_3                                                              0x2314
+#define regDIG2_TMDS_SYNC_CHAR_PATTERN_2_3_BASE_IDX                                                     2
+#define regDIG2_TMDS_CTL_BITS                                                                           0x2316
+#define regDIG2_TMDS_CTL_BITS_BASE_IDX                                                                  2
+#define regDIG2_TMDS_DCBALANCER_CONTROL                                                                 0x2317
+#define regDIG2_TMDS_DCBALANCER_CONTROL_BASE_IDX                                                        2
+#define regDIG2_TMDS_CTL0_1_GEN_CNTL                                                                    0x2319
+#define regDIG2_TMDS_CTL0_1_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG2_TMDS_CTL2_3_GEN_CNTL                                                                    0x231a
+#define regDIG2_TMDS_CTL2_3_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG2_DIG_VERSION                                                                             0x231c
+#define regDIG2_DIG_VERSION_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dp3_dispdec
+// base address: 0xe04
+#define regDP3_DP_LINK_CNTL                                                                             0x2475
+#define regDP3_DP_LINK_CNTL_BASE_IDX                                                                    2
+#define regDP3_DP_PIXEL_FORMAT                                                                          0x2476
+#define regDP3_DP_PIXEL_FORMAT_BASE_IDX                                                                 2
+#define regDP3_DP_MSA_COLORIMETRY                                                                       0x2477
+#define regDP3_DP_MSA_COLORIMETRY_BASE_IDX                                                              2
+#define regDP3_DP_CONFIG                                                                                0x2478
+#define regDP3_DP_CONFIG_BASE_IDX                                                                       2
+#define regDP3_DP_VID_STREAM_CNTL                                                                       0x2479
+#define regDP3_DP_VID_STREAM_CNTL_BASE_IDX                                                              2
+#define regDP3_DP_STEER_FIFO                                                                            0x247a
+#define regDP3_DP_STEER_FIFO_BASE_IDX                                                                   2
+#define regDP3_DP_MSA_MISC                                                                              0x247b
+#define regDP3_DP_MSA_MISC_BASE_IDX                                                                     2
+#define regDP3_DP_DPHY_INTERNAL_CTRL                                                                    0x247c
+#define regDP3_DP_DPHY_INTERNAL_CTRL_BASE_IDX                                                           2
+#define regDP3_DP_VID_TIMING                                                                            0x247d
+#define regDP3_DP_VID_TIMING_BASE_IDX                                                                   2
+#define regDP3_DP_VID_N                                                                                 0x247e
+#define regDP3_DP_VID_N_BASE_IDX                                                                        2
+#define regDP3_DP_VID_M                                                                                 0x247f
+#define regDP3_DP_VID_M_BASE_IDX                                                                        2
+#define regDP3_DP_LINK_FRAMING_CNTL                                                                     0x2480
+#define regDP3_DP_LINK_FRAMING_CNTL_BASE_IDX                                                            2
+#define regDP3_DP_HBR2_EYE_PATTERN                                                                      0x2481
+#define regDP3_DP_HBR2_EYE_PATTERN_BASE_IDX                                                             2
+#define regDP3_DP_VID_MSA_VBID                                                                          0x2482
+#define regDP3_DP_VID_MSA_VBID_BASE_IDX                                                                 2
+#define regDP3_DP_VID_INTERRUPT_CNTL                                                                    0x2483
+#define regDP3_DP_VID_INTERRUPT_CNTL_BASE_IDX                                                           2
+#define regDP3_DP_DPHY_CNTL                                                                             0x2484
+#define regDP3_DP_DPHY_CNTL_BASE_IDX                                                                    2
+#define regDP3_DP_DPHY_TRAINING_PATTERN_SEL                                                             0x2485
+#define regDP3_DP_DPHY_TRAINING_PATTERN_SEL_BASE_IDX                                                    2
+#define regDP3_DP_DPHY_SYM0                                                                             0x2486
+#define regDP3_DP_DPHY_SYM0_BASE_IDX                                                                    2
+#define regDP3_DP_DPHY_SYM1                                                                             0x2487
+#define regDP3_DP_DPHY_SYM1_BASE_IDX                                                                    2
+#define regDP3_DP_DPHY_SYM2                                                                             0x2488
+#define regDP3_DP_DPHY_SYM2_BASE_IDX                                                                    2
+#define regDP3_DP_DPHY_8B10B_CNTL                                                                       0x2489
+#define regDP3_DP_DPHY_8B10B_CNTL_BASE_IDX                                                              2
+#define regDP3_DP_DPHY_PRBS_CNTL                                                                        0x248a
+#define regDP3_DP_DPHY_PRBS_CNTL_BASE_IDX                                                               2
+#define regDP3_DP_DPHY_SCRAM_CNTL                                                                       0x248b
+#define regDP3_DP_DPHY_SCRAM_CNTL_BASE_IDX                                                              2
+#define regDP3_DP_TU_CNTL                                                                               0x2493
+#define regDP3_DP_TU_CNTL_BASE_IDX                                                                      2
+#define regDP3_DP_PIXEL_FORMAT_DB_CNTL                                                                  0x2494
+#define regDP3_DP_PIXEL_FORMAT_DB_CNTL_BASE_IDX                                                         2
+#define regDP3_DP_CP_LINK_VERIFICATION_PATTERN                                                          0x2495
+#define regDP3_DP_CP_LINK_VERIFICATION_PATTERN_BASE_IDX                                                 2
+#define regDP3_DP_SEC_CNTL                                                                              0x2498
+#define regDP3_DP_SEC_CNTL_BASE_IDX                                                                     2
+#define regDP3_DP_SEC_CNTL1                                                                             0x2499
+#define regDP3_DP_SEC_CNTL1_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_FRAMING1                                                                          0x249a
+#define regDP3_DP_SEC_FRAMING1_BASE_IDX                                                                 2
+#define regDP3_DP_SEC_FRAMING2                                                                          0x249b
+#define regDP3_DP_SEC_FRAMING2_BASE_IDX                                                                 2
+#define regDP3_DP_SEC_FRAMING3                                                                          0x249c
+#define regDP3_DP_SEC_FRAMING3_BASE_IDX                                                                 2
+#define regDP3_DP_SEC_FRAMING4                                                                          0x249d
+#define regDP3_DP_SEC_FRAMING4_BASE_IDX                                                                 2
+#define regDP3_DP_SEC_AUD_N                                                                             0x249e
+#define regDP3_DP_SEC_AUD_N_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_AUD_N_READBACK                                                                    0x249f
+#define regDP3_DP_SEC_AUD_N_READBACK_BASE_IDX                                                           2
+#define regDP3_DP_SEC_AUD_M                                                                             0x24a0
+#define regDP3_DP_SEC_AUD_M_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_AUD_M_READBACK                                                                    0x24a1
+#define regDP3_DP_SEC_AUD_M_READBACK_BASE_IDX                                                           2
+#define regDP3_DP_SEC_TIMESTAMP                                                                         0x24a2
+#define regDP3_DP_SEC_TIMESTAMP_BASE_IDX                                                                2
+#define regDP3_DP_SEC_PACKET_CNTL                                                                       0x24a3
+#define regDP3_DP_SEC_PACKET_CNTL_BASE_IDX                                                              2
+#define regDP3_DP_MSE_RATE_CNTL                                                                         0x24a4
+#define regDP3_DP_MSE_RATE_CNTL_BASE_IDX                                                                2
+#define regDP3_DP_CP_MSE_STATUS                                                                         0x24a5
+#define regDP3_DP_CP_MSE_STATUS_BASE_IDX                                                                2
+#define regDP3_DP_MSE_RATE_UPDATE                                                                       0x24a6
+#define regDP3_DP_MSE_RATE_UPDATE_BASE_IDX                                                              2
+#define regDP3_DP_MSE_SAT0                                                                              0x24a7
+#define regDP3_DP_MSE_SAT0_BASE_IDX                                                                     2
+#define regDP3_DP_MSE_SAT1                                                                              0x24a8
+#define regDP3_DP_MSE_SAT1_BASE_IDX                                                                     2
+#define regDP3_DP_MSE_SAT2                                                                              0x24a9
+#define regDP3_DP_MSE_SAT2_BASE_IDX                                                                     2
+#define regDP3_DP_MSE_SAT_UPDATE                                                                        0x24aa
+#define regDP3_DP_MSE_SAT_UPDATE_BASE_IDX                                                               2
+#define regDP3_DP_MSE_LINK_TIMING                                                                       0x24ab
+#define regDP3_DP_MSE_LINK_TIMING_BASE_IDX                                                              2
+#define regDP3_DP_MSE_MISC_CNTL                                                                         0x24ac
+#define regDP3_DP_MSE_MISC_CNTL_BASE_IDX                                                                2
+#define regDP3_DP_TEST_DEBUG_DATA                                                                       0x24ae
+#define regDP3_DP_TEST_DEBUG_DATA_BASE_IDX                                                              2
+#define regDP3_DP_DPHY_BS_SR_SWAP_CNTL                                                                  0x24b1
+#define regDP3_DP_DPHY_BS_SR_SWAP_CNTL_BASE_IDX                                                         2
+#define regDP3_DP_DPHY_HBR2_PATTERN_CONTROL                                                             0x24b2
+#define regDP3_DP_DPHY_HBR2_PATTERN_CONTROL_BASE_IDX                                                    2
+#define regDP3_DP_MSE_SAT0_STATUS                                                                       0x24b4
+#define regDP3_DP_MSE_SAT0_STATUS_BASE_IDX                                                              2
+#define regDP3_DP_MSE_SAT1_STATUS                                                                       0x24b5
+#define regDP3_DP_MSE_SAT1_STATUS_BASE_IDX                                                              2
+#define regDP3_DP_MSE_SAT2_STATUS                                                                       0x24b6
+#define regDP3_DP_MSE_SAT2_STATUS_BASE_IDX                                                              2
+#define regDP3_DP_HBLANK_CONTROL                                                                        0x24b8
+#define regDP3_DP_HBLANK_CONTROL_BASE_IDX                                                               2
+#define regDP3_DP_MSA_TIMING_PARAM1                                                                     0x24b9
+#define regDP3_DP_MSA_TIMING_PARAM1_BASE_IDX                                                            2
+#define regDP3_DP_MSA_TIMING_PARAM2                                                                     0x24ba
+#define regDP3_DP_MSA_TIMING_PARAM2_BASE_IDX                                                            2
+#define regDP3_DP_MSA_TIMING_PARAM3                                                                     0x24bb
+#define regDP3_DP_MSA_TIMING_PARAM3_BASE_IDX                                                            2
+#define regDP3_DP_MSA_TIMING_PARAM4                                                                     0x24bc
+#define regDP3_DP_MSA_TIMING_PARAM4_BASE_IDX                                                            2
+#define regDP3_DP_MSO_CNTL                                                                              0x24bd
+#define regDP3_DP_MSO_CNTL_BASE_IDX                                                                     2
+#define regDP3_DP_MSO_CNTL1                                                                             0x24be
+#define regDP3_DP_MSO_CNTL1_BASE_IDX                                                                    2
+#define regDP3_DP_STEER_FIFO_CNTL                                                                       0x24bf
+#define regDP3_DP_STEER_FIFO_CNTL_BASE_IDX                                                              2
+#define regDP3_DP_SEC_CNTL2                                                                             0x24c0
+#define regDP3_DP_SEC_CNTL2_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_CNTL3                                                                             0x24c1
+#define regDP3_DP_SEC_CNTL3_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_CNTL4                                                                             0x24c2
+#define regDP3_DP_SEC_CNTL4_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_CNTL5                                                                             0x24c3
+#define regDP3_DP_SEC_CNTL5_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_CNTL6                                                                             0x24c4
+#define regDP3_DP_SEC_CNTL6_BASE_IDX                                                                    2
+#define regDP3_DP_SEC_CNTL7                                                                             0x24c5
+#define regDP3_DP_SEC_CNTL7_BASE_IDX                                                                    2
+#define regDP3_DP_DB_CNTL                                                                               0x24c6
+#define regDP3_DP_DB_CNTL_BASE_IDX                                                                      2
+#define regDP3_DP_MSA_VBID_MISC                                                                         0x24c7
+#define regDP3_DP_MSA_VBID_MISC_BASE_IDX                                                                2
+#define regDP3_DP_SEC_METADATA_TRANSMISSION                                                             0x24c8
+#define regDP3_DP_SEC_METADATA_TRANSMISSION_BASE_IDX                                                    2
+#define regDP3_DP_ALPM_CNTL                                                                             0x24ca
+#define regDP3_DP_ALPM_CNTL_BASE_IDX                                                                    2
+#define regDP3_DP_GSP8_CNTL                                                                             0x24cb
+#define regDP3_DP_GSP8_CNTL_BASE_IDX                                                                    2
+#define regDP3_DP_GSP9_CNTL                                                                             0x24cc
+#define regDP3_DP_GSP9_CNTL_BASE_IDX                                                                    2
+#define regDP3_DP_GSP10_CNTL                                                                            0x24cd
+#define regDP3_DP_GSP10_CNTL_BASE_IDX                                                                   2
+#define regDP3_DP_GSP11_CNTL                                                                            0x24ce
+#define regDP3_DP_GSP11_CNTL_BASE_IDX                                                                   2
+#define regDP3_DP_GSP_EN_DB_STATUS                                                                      0x24cf
+#define regDP3_DP_GSP_EN_DB_STATUS_BASE_IDX                                                             2
+#define regDP3_DP_AUXLESS_ALPM_CNTL1                                                                    0x24d0
+#define regDP3_DP_AUXLESS_ALPM_CNTL1_BASE_IDX                                                           2
+#define regDP3_DP_AUXLESS_ALPM_CNTL2                                                                    0x24d1
+#define regDP3_DP_AUXLESS_ALPM_CNTL2_BASE_IDX                                                           2
+#define regDP3_DP_AUXLESS_ALPM_CNTL3                                                                    0x24d2
+#define regDP3_DP_AUXLESS_ALPM_CNTL3_BASE_IDX                                                           2
+#define regDP3_DP_AUXLESS_ALPM_CNTL4                                                                    0x24d3
+#define regDP3_DP_AUXLESS_ALPM_CNTL4_BASE_IDX                                                           2
+#define regDP3_DP_AUXLESS_ALPM_CNTL5                                                                    0x24d4
+#define regDP3_DP_AUXLESS_ALPM_CNTL5_BASE_IDX                                                           2
+#define regDP3_DP_STREAM_SYMBOL_COUNT_STATUS                                                            0x24d5
+#define regDP3_DP_STREAM_SYMBOL_COUNT_STATUS_BASE_IDX                                                   2
+#define regDP3_DP_STREAM_SYMBOL_COUNT_CONTROL                                                           0x24d6
+#define regDP3_DP_STREAM_SYMBOL_COUNT_CONTROL_BASE_IDX                                                  2
+#define regDP3_DP_LINK_SYMBOL_COUNT_STATUS0                                                             0x24d7
+#define regDP3_DP_LINK_SYMBOL_COUNT_STATUS0_BASE_IDX                                                    2
+#define regDP3_DP_LINK_SYMBOL_COUNT_STATUS1                                                             0x24d8
+#define regDP3_DP_LINK_SYMBOL_COUNT_STATUS1_BASE_IDX                                                    2
+#define regDP3_DP_LINK_SYMBOL_COUNT_CONTROL                                                             0x24d9
+#define regDP3_DP_LINK_SYMBOL_COUNT_CONTROL_BASE_IDX                                                    2
+#define regDP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL                                                     0x24da
+#define regDP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                            2
+#define regDP3_DP_DPHY_FAST_TRAINING                                                                    0x24dd
+#define regDP3_DP_DPHY_FAST_TRAINING_BASE_IDX                                                           2
+#define regDP3_DP_DPHY_FAST_TRAINING_STATUS                                                             0x24de
+#define regDP3_DP_DPHY_FAST_TRAINING_STATUS_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dio_dig3_dispdec
+// base address: 0xe04
+#define regDIG3_DIG_FE_CNTL                                                                             0x23ea
+#define regDIG3_DIG_FE_CNTL_BASE_IDX                                                                    2
+#define regDIG3_DIG_FE_CLK_CNTL                                                                         0x23eb
+#define regDIG3_DIG_FE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG3_DIG_FE_EN_CNTL                                                                          0x23ec
+#define regDIG3_DIG_FE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG3_DIG_OUTPUT_CRC_CNTL                                                                     0x23ed
+#define regDIG3_DIG_OUTPUT_CRC_CNTL_BASE_IDX                                                            2
+#define regDIG3_DIG_OUTPUT_CRC_RESULT                                                                   0x23ee
+#define regDIG3_DIG_OUTPUT_CRC_RESULT_BASE_IDX                                                          2
+#define regDIG3_DIG_CLOCK_PATTERN                                                                       0x23ef
+#define regDIG3_DIG_CLOCK_PATTERN_BASE_IDX                                                              2
+#define regDIG3_DIG_TEST_PATTERN                                                                        0x23f0
+#define regDIG3_DIG_TEST_PATTERN_BASE_IDX                                                               2
+#define regDIG3_DIG_RANDOM_PATTERN_SEED                                                                 0x23f1
+#define regDIG3_DIG_RANDOM_PATTERN_SEED_BASE_IDX                                                        2
+#define regDIG3_DIG_FIFO_CTRL0                                                                          0x23f2
+#define regDIG3_DIG_FIFO_CTRL0_BASE_IDX                                                                 2
+#define regDIG3_DIG_FIFO_CTRL1                                                                          0x23f3
+#define regDIG3_DIG_FIFO_CTRL1_BASE_IDX                                                                 2
+#define regDIG3_HDMI_METADATA_PACKET_CONTROL                                                            0x23f4
+#define regDIG3_HDMI_METADATA_PACKET_CONTROL_BASE_IDX                                                   2
+#define regDIG3_HDMI_CONTROL                                                                            0x23f5
+#define regDIG3_HDMI_CONTROL_BASE_IDX                                                                   2
+#define regDIG3_HDMI_STATUS                                                                             0x23f6
+#define regDIG3_HDMI_STATUS_BASE_IDX                                                                    2
+#define regDIG3_HDMI_AUDIO_PACKET_CONTROL                                                               0x23f7
+#define regDIG3_HDMI_AUDIO_PACKET_CONTROL_BASE_IDX                                                      2
+#define regDIG3_HDMI_ACR_PACKET_CONTROL                                                                 0x23f8
+#define regDIG3_HDMI_ACR_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG3_HDMI_VBI_PACKET_CONTROL                                                                 0x23f9
+#define regDIG3_HDMI_VBI_PACKET_CONTROL_BASE_IDX                                                        2
+#define regDIG3_HDMI_INFOFRAME_CONTROL0                                                                 0x23fa
+#define regDIG3_HDMI_INFOFRAME_CONTROL0_BASE_IDX                                                        2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL0                                                            0x23fb
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL0_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL6                                                            0x23fc
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL6_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL5                                                            0x23fd
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL5_BASE_IDX                                                   2
+#define regDIG3_HDMI_GC                                                                                 0x23fe
+#define regDIG3_HDMI_GC_BASE_IDX                                                                        2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL1                                                            0x23ff
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL1_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL2                                                            0x2400
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL2_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL3                                                            0x2401
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL3_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL4                                                            0x2402
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL4_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL7                                                            0x2403
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL7_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL8                                                            0x2404
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL8_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL9                                                            0x2405
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL9_BASE_IDX                                                   2
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL10                                                           0x2406
+#define regDIG3_HDMI_GENERIC_PACKET_CONTROL10_BASE_IDX                                                  2
+#define regDIG3_HDMI_DB_CONTROL                                                                         0x2407
+#define regDIG3_HDMI_DB_CONTROL_BASE_IDX                                                                2
+#define regDIG3_HDMI_ACR_32_0                                                                           0x2408
+#define regDIG3_HDMI_ACR_32_0_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_32_1                                                                           0x2409
+#define regDIG3_HDMI_ACR_32_1_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_44_0                                                                           0x240a
+#define regDIG3_HDMI_ACR_44_0_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_44_1                                                                           0x240b
+#define regDIG3_HDMI_ACR_44_1_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_48_0                                                                           0x240c
+#define regDIG3_HDMI_ACR_48_0_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_48_1                                                                           0x240d
+#define regDIG3_HDMI_ACR_48_1_BASE_IDX                                                                  2
+#define regDIG3_HDMI_ACR_STATUS_0                                                                       0x240e
+#define regDIG3_HDMI_ACR_STATUS_0_BASE_IDX                                                              2
+#define regDIG3_HDMI_ACR_STATUS_1                                                                       0x240f
+#define regDIG3_HDMI_ACR_STATUS_1_BASE_IDX                                                              2
+#define regDIG3_DIG_FE_AUDIO_CNTL                                                                       0x2410
+#define regDIG3_DIG_FE_AUDIO_CNTL_BASE_IDX                                                              2
+#define regDIG3_DIG_BE_CLK_CNTL                                                                         0x2411
+#define regDIG3_DIG_BE_CLK_CNTL_BASE_IDX                                                                2
+#define regDIG3_DIG_BE_CNTL                                                                             0x2412
+#define regDIG3_DIG_BE_CNTL_BASE_IDX                                                                    2
+#define regDIG3_DIG_BE_EN_CNTL                                                                          0x2413
+#define regDIG3_DIG_BE_EN_CNTL_BASE_IDX                                                                 2
+#define regDIG3_HDCP_INT_CONTROL                                                                        0x2416
+#define regDIG3_HDCP_INT_CONTROL_BASE_IDX                                                               2
+#define regDIG3_HDCP_I2C_CONTROL_0                                                                      0x2418
+#define regDIG3_HDCP_I2C_CONTROL_0_BASE_IDX                                                             2
+#define regDIG3_HDCP_I2C_CONTROL_1                                                                      0x2419
+#define regDIG3_HDCP_I2C_CONTROL_1_BASE_IDX                                                             2
+#define regDIG3_TMDS_CNTL                                                                               0x243a
+#define regDIG3_TMDS_CNTL_BASE_IDX                                                                      2
+#define regDIG3_TMDS_CONTROL_CHAR                                                                       0x243b
+#define regDIG3_TMDS_CONTROL_CHAR_BASE_IDX                                                              2
+#define regDIG3_TMDS_CONTROL0_FEEDBACK                                                                  0x243c
+#define regDIG3_TMDS_CONTROL0_FEEDBACK_BASE_IDX                                                         2
+#define regDIG3_TMDS_STEREOSYNC_CTL_SEL                                                                 0x243d
+#define regDIG3_TMDS_STEREOSYNC_CTL_SEL_BASE_IDX                                                        2
+#define regDIG3_TMDS_SYNC_CHAR_PATTERN_0_1                                                              0x243e
+#define regDIG3_TMDS_SYNC_CHAR_PATTERN_0_1_BASE_IDX                                                     2
+#define regDIG3_TMDS_SYNC_CHAR_PATTERN_2_3                                                              0x243f
+#define regDIG3_TMDS_SYNC_CHAR_PATTERN_2_3_BASE_IDX                                                     2
+#define regDIG3_TMDS_CTL_BITS                                                                           0x2441
+#define regDIG3_TMDS_CTL_BITS_BASE_IDX                                                                  2
+#define regDIG3_TMDS_DCBALANCER_CONTROL                                                                 0x2442
+#define regDIG3_TMDS_DCBALANCER_CONTROL_BASE_IDX                                                        2
+#define regDIG3_TMDS_CTL0_1_GEN_CNTL                                                                    0x2444
+#define regDIG3_TMDS_CTL0_1_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG3_TMDS_CTL2_3_GEN_CNTL                                                                    0x2445
+#define regDIG3_TMDS_CTL2_3_GEN_CNTL_BASE_IDX                                                           2
+#define regDIG3_DIG_VERSION                                                                             0x2447
+#define regDIG3_DIG_VERSION_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig0_apg_apg_dispdec
+// base address: 0x15424
+#define regAPG0_APG_CONTROL                                                                             0x2049
+#define regAPG0_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG0_APG_CONTROL2                                                                            0x204a
+#define regAPG0_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG0_APG_DBG_GEN_CONTROL                                                                     0x204b
+#define regAPG0_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG0_APG_PACKET_CONTROL                                                                      0x204c
+#define regAPG0_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG0_APG_DBG_60958_0                                                                         0x2050
+#define regAPG0_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG0_APG_DBG_60958_1                                                                         0x2051
+#define regAPG0_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG0_APG_DBG_60958_2                                                                         0x2052
+#define regAPG0_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG0_APG_MEM_PWR                                                                             0x205d
+#define regAPG0_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig1_apg_apg_dispdec
+// base address: 0x158d0
+#define regAPG1_APG_CONTROL                                                                             0x2174
+#define regAPG1_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG1_APG_CONTROL2                                                                            0x2175
+#define regAPG1_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG1_APG_DBG_GEN_CONTROL                                                                     0x2176
+#define regAPG1_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG1_APG_PACKET_CONTROL                                                                      0x2177
+#define regAPG1_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG1_APG_DBG_60958_0                                                                         0x217b
+#define regAPG1_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG1_APG_DBG_60958_1                                                                         0x217c
+#define regAPG1_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG1_APG_DBG_60958_2                                                                         0x217d
+#define regAPG1_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG1_APG_MEM_PWR                                                                             0x2188
+#define regAPG1_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig2_apg_apg_dispdec
+// base address: 0x15d7c
+#define regAPG2_APG_CONTROL                                                                             0x229f
+#define regAPG2_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG2_APG_CONTROL2                                                                            0x22a0
+#define regAPG2_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG2_APG_DBG_GEN_CONTROL                                                                     0x22a1
+#define regAPG2_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG2_APG_PACKET_CONTROL                                                                      0x22a2
+#define regAPG2_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG2_APG_DBG_60958_0                                                                         0x22a6
+#define regAPG2_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG2_APG_DBG_60958_1                                                                         0x22a7
+#define regAPG2_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG2_APG_DBG_60958_2                                                                         0x22a8
+#define regAPG2_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG2_APG_MEM_PWR                                                                             0x22b3
+#define regAPG2_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig3_apg_apg_dispdec
+// base address: 0x16228
+#define regAPG3_APG_CONTROL                                                                             0x23ca
+#define regAPG3_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG3_APG_CONTROL2                                                                            0x23cb
+#define regAPG3_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG3_APG_DBG_GEN_CONTROL                                                                     0x23cc
+#define regAPG3_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG3_APG_PACKET_CONTROL                                                                      0x23cd
+#define regAPG3_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG3_APG_DBG_60958_0                                                                         0x23d1
+#define regAPG3_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG3_APG_DBG_60958_1                                                                         0x23d2
+#define regAPG3_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG3_APG_DBG_60958_2                                                                         0x23d3
+#define regAPG3_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG3_APG_MEM_PWR                                                                             0x23de
+#define regAPG3_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig0_dme_dme_dispdec
+// base address: 0x1549c
+#define regDME0_DME_CONTROL                                                                             0x2067
+#define regDME0_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig0_vpg_vpg_dispdec
+// base address: 0x153dc
+#define regVPG0_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x2037
+#define regVPG0_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG0_VPG_GENERIC_PACKET_DATA                                                                 0x2038
+#define regVPG0_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG0_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x2039
+#define regVPG0_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x203a
+#define regVPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG0_VPG_GENERIC_STATUS                                                                      0x203b
+#define regVPG0_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG0_VPG_MEM_PWR                                                                             0x203c
+#define regVPG0_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG0_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x203d
+#define regVPG0_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG0_VPG_ISRC1_2_DATA                                                                        0x203e
+#define regVPG0_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dio_dig1_dme_dme_dispdec
+// base address: 0x15948
+#define regDME1_DME_CONTROL                                                                             0x2192
+#define regDME1_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig1_vpg_vpg_dispdec
+// base address: 0x15888
+#define regVPG1_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x2162
+#define regVPG1_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG1_VPG_GENERIC_PACKET_DATA                                                                 0x2163
+#define regVPG1_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG1_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x2164
+#define regVPG1_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x2165
+#define regVPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG1_VPG_GENERIC_STATUS                                                                      0x2166
+#define regVPG1_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG1_VPG_MEM_PWR                                                                             0x2167
+#define regVPG1_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG1_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x2168
+#define regVPG1_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG1_VPG_ISRC1_2_DATA                                                                        0x2169
+#define regVPG1_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dio_dig2_dme_dme_dispdec
+// base address: 0x15df4
+#define regDME2_DME_CONTROL                                                                             0x22bd
+#define regDME2_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig2_vpg_vpg_dispdec
+// base address: 0x15d34
+#define regVPG2_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x228d
+#define regVPG2_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG2_VPG_GENERIC_PACKET_DATA                                                                 0x228e
+#define regVPG2_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG2_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x228f
+#define regVPG2_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x2290
+#define regVPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG2_VPG_GENERIC_STATUS                                                                      0x2291
+#define regVPG2_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG2_VPG_MEM_PWR                                                                             0x2292
+#define regVPG2_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG2_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x2293
+#define regVPG2_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG2_VPG_ISRC1_2_DATA                                                                        0x2294
+#define regVPG2_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dio_dig3_dme_dme_dispdec
+// base address: 0x162a0
+#define regDME3_DME_CONTROL                                                                             0x23e8
+#define regDME3_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_dio_dig3_vpg_vpg_dispdec
+// base address: 0x161e0
+#define regVPG3_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x23b8
+#define regVPG3_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG3_VPG_GENERIC_PACKET_DATA                                                                 0x23b9
+#define regVPG3_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG3_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x23ba
+#define regVPG3_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x23bb
+#define regVPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG3_VPG_GENERIC_STATUS                                                                      0x23bc
+#define regVPG3_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG3_VPG_MEM_PWR                                                                             0x23bd
+#define regVPG3_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG3_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x23be
+#define regVPG3_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG3_VPG_ISRC1_2_DATA                                                                        0x23bf
+#define regVPG3_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_dio_dio_dme_rm_mem0_dme_rm_dispdec
+// base address: 0x153a4
+#define regDME_RM0_DME_MEMORY_CONTROL                                                                   0x2029
+#define regDME_RM0_DME_MEMORY_CONTROL_BASE_IDX                                                          2
+#define regDME_RM0_DME_RM_MEM_CTRL                                                                      0x202a
+#define regDME_RM0_DME_RM_MEM_CTRL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dio_dio_dme_rm_mem1_dme_rm_dispdec
+// base address: 0x153ac
+#define regDME_RM1_DME_MEMORY_CONTROL                                                                   0x202b
+#define regDME_RM1_DME_MEMORY_CONTROL_BASE_IDX                                                          2
+#define regDME_RM1_DME_RM_MEM_CTRL                                                                      0x202c
+#define regDME_RM1_DME_RM_MEM_CTRL_BASE_IDX                                                             2
+
+
+// addressBlock: dce_dc_dio_dout_i2c_dispdec
+// base address: 0x0
+#define regDC_I2C_CONTROL                                                                               0x1e98
+#define regDC_I2C_CONTROL_BASE_IDX                                                                      2
+#define regDC_I2C_ARBITRATION                                                                           0x1e99
+#define regDC_I2C_ARBITRATION_BASE_IDX                                                                  2
+#define regDC_I2C_INTERRUPT_CONTROL                                                                     0x1e9a
+#define regDC_I2C_INTERRUPT_CONTROL_BASE_IDX                                                            2
+#define regDC_I2C_SW_STATUS                                                                             0x1e9b
+#define regDC_I2C_SW_STATUS_BASE_IDX                                                                    2
+#define regDC_I2C_DDC1_HW_STATUS                                                                        0x1e9c
+#define regDC_I2C_DDC1_HW_STATUS_BASE_IDX                                                               2
+#define regDC_I2C_DDC2_HW_STATUS                                                                        0x1e9d
+#define regDC_I2C_DDC2_HW_STATUS_BASE_IDX                                                               2
+#define regDC_I2C_DDC1_SPEED                                                                            0x1ea2
+#define regDC_I2C_DDC1_SPEED_BASE_IDX                                                                   2
+#define regDC_I2C_DDC1_SETUP                                                                            0x1ea3
+#define regDC_I2C_DDC1_SETUP_BASE_IDX                                                                   2
+#define regDC_I2C_DDC2_SPEED                                                                            0x1ea4
+#define regDC_I2C_DDC2_SPEED_BASE_IDX                                                                   2
+#define regDC_I2C_DDC2_SETUP                                                                            0x1ea5
+#define regDC_I2C_DDC2_SETUP_BASE_IDX                                                                   2
+#define regDC_I2C_TRANSACTION0                                                                          0x1eae
+#define regDC_I2C_TRANSACTION0_BASE_IDX                                                                 2
+#define regDC_I2C_TRANSACTION1                                                                          0x1eaf
+#define regDC_I2C_TRANSACTION1_BASE_IDX                                                                 2
+#define regDC_I2C_TRANSACTION2                                                                          0x1eb0
+#define regDC_I2C_TRANSACTION2_BASE_IDX                                                                 2
+#define regDC_I2C_TRANSACTION3                                                                          0x1eb1
+#define regDC_I2C_TRANSACTION3_BASE_IDX                                                                 2
+#define regDC_I2C_DATA                                                                                  0x1eb2
+#define regDC_I2C_DATA_BASE_IDX                                                                         2
+#define regDC_I2C_EDID_DETECT_CTRL                                                                      0x1eb6
+#define regDC_I2C_EDID_DETECT_CTRL_BASE_IDX                                                             2
+#define regDC_I2C_READ_REQUEST_INTERRUPT                                                                0x1eb7
+#define regDC_I2C_READ_REQUEST_INTERRUPT_BASE_IDX                                                       2
+
+
+// addressBlock: dce_dc_dio_dio_misc_dispdec
+// base address: 0x0
+#define regDIO_SCRATCH0                                                                                 0x1eca
+#define regDIO_SCRATCH0_BASE_IDX                                                                        2
+#define regDIO_SCRATCH1                                                                                 0x1ecb
+#define regDIO_SCRATCH1_BASE_IDX                                                                        2
+#define regDIO_SCRATCH2                                                                                 0x1ecc
+#define regDIO_SCRATCH2_BASE_IDX                                                                        2
+#define regDIO_SCRATCH3                                                                                 0x1ecd
+#define regDIO_SCRATCH3_BASE_IDX                                                                        2
+#define regDIO_SCRATCH4                                                                                 0x1ece
+#define regDIO_SCRATCH4_BASE_IDX                                                                        2
+#define regDIO_SCRATCH5                                                                                 0x1ecf
+#define regDIO_SCRATCH5_BASE_IDX                                                                        2
+#define regDIO_SCRATCH6                                                                                 0x1ed0
+#define regDIO_SCRATCH6_BASE_IDX                                                                        2
+#define regDIO_SCRATCH7                                                                                 0x1ed1
+#define regDIO_SCRATCH7_BASE_IDX                                                                        2
+#define regDIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS                                                          0x1ed3
+#define regDIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS_BASE_IDX                                                 2
+#define regDIO_MEM_PWR_STATUS                                                                           0x1edd
+#define regDIO_MEM_PWR_STATUS_BASE_IDX                                                                  2
+#define regDIO_MEM_PWR_CTRL                                                                             0x1ede
+#define regDIO_MEM_PWR_CTRL_BASE_IDX                                                                    2
+#define regDIO_MEM_PWR_CTRL2                                                                            0x1edf
+#define regDIO_MEM_PWR_CTRL2_BASE_IDX                                                                   2
+#define regDIO_CLK_CNTL                                                                                 0x1ee0
+#define regDIO_CLK_CNTL_BASE_IDX                                                                        2
+#define regDIO_POWER_MANAGEMENT_CNTL                                                                    0x1ee4
+#define regDIO_POWER_MANAGEMENT_CNTL_BASE_IDX                                                           2
+#define regHDCP_CLK_STATUS                                                                              0x1ef4
+#define regHDCP_CLK_STATUS_BASE_IDX                                                                     2
+#define regDIO_HDMI_RXSTATUS_TIMER_CONTROL                                                              0x1eff
+#define regDIO_HDMI_RXSTATUS_TIMER_CONTROL_BASE_IDX                                                     2
+#define regDIO_STATUS                                                                                   0x1f02
+#define regDIO_STATUS_BASE_IDX                                                                          2
+
+
+// addressBlock: dce_dc_dio_dig_stream_mapper_dispdec
+// base address: 0x0
+#define regDIG0_STREAM_MAPPER_CONTROL                                                                   0x1f0d
+#define regDIG0_STREAM_MAPPER_CONTROL_BASE_IDX                                                          2
+#define regDIG1_STREAM_MAPPER_CONTROL                                                                   0x1f0e
+#define regDIG1_STREAM_MAPPER_CONTROL_BASE_IDX                                                          2
+#define regDIG2_STREAM_MAPPER_CONTROL                                                                   0x1f0f
+#define regDIG2_STREAM_MAPPER_CONTROL_BASE_IDX                                                          2
+#define regDIG3_STREAM_MAPPER_CONTROL                                                                   0x1f10
+#define regDIG3_STREAM_MAPPER_CONTROL_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dio_dio_dcperfmon_dc_perfmon_dispdec
+// base address: 0x7d10
+#define regDC_PERFMON17_PERFCOUNTER_CNTL                                                                0x1f44
+#define regDC_PERFMON17_PERFCOUNTER_CNTL_BASE_IDX                                                       2
+#define regDC_PERFMON17_PERFCOUNTER_CNTL2                                                               0x1f45
+#define regDC_PERFMON17_PERFCOUNTER_CNTL2_BASE_IDX                                                      2
+#define regDC_PERFMON17_PERFCOUNTER_STATE                                                               0x1f46
+#define regDC_PERFMON17_PERFCOUNTER_STATE_BASE_IDX                                                      2
+#define regDC_PERFMON17_PERFMON_CNTL                                                                    0x1f47
+#define regDC_PERFMON17_PERFMON_CNTL_BASE_IDX                                                           2
+#define regDC_PERFMON17_PERFMON_CNTL2                                                                   0x1f48
+#define regDC_PERFMON17_PERFMON_CNTL2_BASE_IDX                                                          2
+#define regDC_PERFMON17_PERFMON_CVALUE_INT_MISC                                                         0x1f49
+#define regDC_PERFMON17_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                2
+#define regDC_PERFMON17_PERFMON_CVALUE_LOW                                                              0x1f4a
+#define regDC_PERFMON17_PERFMON_CVALUE_LOW_BASE_IDX                                                     2
+#define regDC_PERFMON17_PERFMON_HI                                                                      0x1f4b
+#define regDC_PERFMON17_PERFMON_HI_BASE_IDX                                                             2
+#define regDC_PERFMON17_PERFMON_LOW                                                                     0x1f4c
+#define regDC_PERFMON17_PERFMON_LOW_BASE_IDX                                                            2
+#define regDC_PERFMON17_PERFMON_TEST_DEBUG_INDEX                                                        0x1f4d
+#define regDC_PERFMON17_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               2
+#define regDC_PERFMON17_PERFMON_TEST_DEBUG_DATA                                                         0x1f4e
+#define regDC_PERFMON17_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                2
+
+
+// addressBlock: dce_dc_dsc0_dispdec_dscc_dispdec
+// base address: 0x19328
+#define regDSCC0_DSCC_CONFIG0                                                                           0x300a
+#define regDSCC0_DSCC_CONFIG0_BASE_IDX                                                                  2
+#define regDSCC0_DSCC_CONFIG1                                                                           0x300b
+#define regDSCC0_DSCC_CONFIG1_BASE_IDX                                                                  2
+#define regDSCC0_DSCC_CONFIG2                                                                           0x300c
+#define regDSCC0_DSCC_CONFIG2_BASE_IDX                                                                  2
+#define regDSCC0_DSCC_CONFIG3                                                                           0x300d
+#define regDSCC0_DSCC_CONFIG3_BASE_IDX                                                                  2
+#define regDSCC0_DSCC_STATUS                                                                            0x300e
+#define regDSCC0_DSCC_STATUS_BASE_IDX                                                                   2
+#define regDSCC0_DSCC_INTERRUPT_CONTROL0                                                                0x300f
+#define regDSCC0_DSCC_INTERRUPT_CONTROL0_BASE_IDX                                                       2
+#define regDSCC0_DSCC_INTERRUPT_CONTROL1                                                                0x3010
+#define regDSCC0_DSCC_INTERRUPT_CONTROL1_BASE_IDX                                                       2
+#define regDSCC0_DSCC_INTERRUPT_CONTROL2                                                                0x3011
+#define regDSCC0_DSCC_INTERRUPT_CONTROL2_BASE_IDX                                                       2
+#define regDSCC0_DSCC_INTERRUPT_STATUS0                                                                 0x3012
+#define regDSCC0_DSCC_INTERRUPT_STATUS0_BASE_IDX                                                        2
+#define regDSCC0_DSCC_INTERRUPT_STATUS1                                                                 0x3013
+#define regDSCC0_DSCC_INTERRUPT_STATUS1_BASE_IDX                                                        2
+#define regDSCC0_DSCC_INTERRUPT_STATUS2                                                                 0x3014
+#define regDSCC0_DSCC_INTERRUPT_STATUS2_BASE_IDX                                                        2
+#define regDSCC0_DSCC_INTERRUPT_CLEAR0                                                                  0x3015
+#define regDSCC0_DSCC_INTERRUPT_CLEAR0_BASE_IDX                                                         2
+#define regDSCC0_DSCC_INTERRUPT_CLEAR1                                                                  0x3016
+#define regDSCC0_DSCC_INTERRUPT_CLEAR1_BASE_IDX                                                         2
+#define regDSCC0_DSCC_INTERRUPT_CLEAR2                                                                  0x3017
+#define regDSCC0_DSCC_INTERRUPT_CLEAR2_BASE_IDX                                                         2
+#define regDSCC0_DSCC_PPS_CONFIG0                                                                       0x3018
+#define regDSCC0_DSCC_PPS_CONFIG0_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG1                                                                       0x3019
+#define regDSCC0_DSCC_PPS_CONFIG1_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG2                                                                       0x301a
+#define regDSCC0_DSCC_PPS_CONFIG2_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG3                                                                       0x301b
+#define regDSCC0_DSCC_PPS_CONFIG3_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG4                                                                       0x301c
+#define regDSCC0_DSCC_PPS_CONFIG4_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG5                                                                       0x301d
+#define regDSCC0_DSCC_PPS_CONFIG5_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG6                                                                       0x301e
+#define regDSCC0_DSCC_PPS_CONFIG6_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG7                                                                       0x301f
+#define regDSCC0_DSCC_PPS_CONFIG7_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG8                                                                       0x3020
+#define regDSCC0_DSCC_PPS_CONFIG8_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG9                                                                       0x3021
+#define regDSCC0_DSCC_PPS_CONFIG9_BASE_IDX                                                              2
+#define regDSCC0_DSCC_PPS_CONFIG10                                                                      0x3022
+#define regDSCC0_DSCC_PPS_CONFIG10_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG11                                                                      0x3023
+#define regDSCC0_DSCC_PPS_CONFIG11_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG12                                                                      0x3024
+#define regDSCC0_DSCC_PPS_CONFIG12_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG13                                                                      0x3025
+#define regDSCC0_DSCC_PPS_CONFIG13_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG14                                                                      0x3026
+#define regDSCC0_DSCC_PPS_CONFIG14_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG15                                                                      0x3027
+#define regDSCC0_DSCC_PPS_CONFIG15_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG16                                                                      0x3028
+#define regDSCC0_DSCC_PPS_CONFIG16_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG17                                                                      0x3029
+#define regDSCC0_DSCC_PPS_CONFIG17_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG18                                                                      0x302a
+#define regDSCC0_DSCC_PPS_CONFIG18_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG19                                                                      0x302b
+#define regDSCC0_DSCC_PPS_CONFIG19_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG20                                                                      0x302c
+#define regDSCC0_DSCC_PPS_CONFIG20_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG21                                                                      0x302d
+#define regDSCC0_DSCC_PPS_CONFIG21_BASE_IDX                                                             2
+#define regDSCC0_DSCC_PPS_CONFIG22                                                                      0x302e
+#define regDSCC0_DSCC_PPS_CONFIG22_BASE_IDX                                                             2
+#define regDSCC0_DSCC_MEM_POWER_CONTROL0                                                                0x302f
+#define regDSCC0_DSCC_MEM_POWER_CONTROL0_BASE_IDX                                                       2
+#define regDSCC0_DSCC_MEM_POWER_CONTROL1                                                                0x3030
+#define regDSCC0_DSCC_MEM_POWER_CONTROL1_BASE_IDX                                                       2
+#define regDSCC0_DSCC_MEM_POWER_CONTROL2                                                                0x3031
+#define regDSCC0_DSCC_MEM_POWER_CONTROL2_BASE_IDX                                                       2
+#define regDSCC0_DSCC_SLICE_CTX_SELECT                                                                  0x3032
+#define regDSCC0_DSCC_SLICE_CTX_SELECT_BASE_IDX                                                         2
+#define regDSCC0_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL                                                 0x3033
+#define regDSCC0_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_BASE_IDX                                        2
+#define regDSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL                                                  0x3034
+#define regDSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_BASE_IDX                                         2
+#define regDSCC0_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL                                             0x3035
+#define regDSCC0_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_BASE_IDX                                    2
+#define regDSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL                                              0x3036
+#define regDSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_BASE_IDX                                     2
+#define regDSCC0_DSCC_RESET_CONTROL                                                                     0x3037
+#define regDSCC0_DSCC_RESET_CONTROL_BASE_IDX                                                            2
+#define regDSCC0_DSCC_TEST_DEBUG_BUS_ROTATE                                                             0x303c
+#define regDSCC0_DSCC_TEST_DEBUG_BUS_ROTATE_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dsc0_dispdec_dsc_top_dispdec
+// base address: 0x19300
+#define regDSC_TOP0_DSC_TOP_CONTROL                                                                     0x3000
+#define regDSC_TOP0_DSC_TOP_CONTROL_BASE_IDX                                                            2
+#define regDSC_TOP0_DSC_DEBUG_CONTROL                                                                   0x3001
+#define regDSC_TOP0_DSC_DEBUG_CONTROL_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dsc1_dispdec_dscc_dispdec
+// base address: 0x19498
+#define regDSCC1_DSCC_CONFIG0                                                                           0x3066
+#define regDSCC1_DSCC_CONFIG0_BASE_IDX                                                                  2
+#define regDSCC1_DSCC_CONFIG1                                                                           0x3067
+#define regDSCC1_DSCC_CONFIG1_BASE_IDX                                                                  2
+#define regDSCC1_DSCC_CONFIG2                                                                           0x3068
+#define regDSCC1_DSCC_CONFIG2_BASE_IDX                                                                  2
+#define regDSCC1_DSCC_CONFIG3                                                                           0x3069
+#define regDSCC1_DSCC_CONFIG3_BASE_IDX                                                                  2
+#define regDSCC1_DSCC_STATUS                                                                            0x306a
+#define regDSCC1_DSCC_STATUS_BASE_IDX                                                                   2
+#define regDSCC1_DSCC_INTERRUPT_CONTROL0                                                                0x306b
+#define regDSCC1_DSCC_INTERRUPT_CONTROL0_BASE_IDX                                                       2
+#define regDSCC1_DSCC_INTERRUPT_CONTROL1                                                                0x306c
+#define regDSCC1_DSCC_INTERRUPT_CONTROL1_BASE_IDX                                                       2
+#define regDSCC1_DSCC_INTERRUPT_CONTROL2                                                                0x306d
+#define regDSCC1_DSCC_INTERRUPT_CONTROL2_BASE_IDX                                                       2
+#define regDSCC1_DSCC_INTERRUPT_STATUS0                                                                 0x306e
+#define regDSCC1_DSCC_INTERRUPT_STATUS0_BASE_IDX                                                        2
+#define regDSCC1_DSCC_INTERRUPT_STATUS1                                                                 0x306f
+#define regDSCC1_DSCC_INTERRUPT_STATUS1_BASE_IDX                                                        2
+#define regDSCC1_DSCC_INTERRUPT_STATUS2                                                                 0x3070
+#define regDSCC1_DSCC_INTERRUPT_STATUS2_BASE_IDX                                                        2
+#define regDSCC1_DSCC_INTERRUPT_CLEAR0                                                                  0x3071
+#define regDSCC1_DSCC_INTERRUPT_CLEAR0_BASE_IDX                                                         2
+#define regDSCC1_DSCC_INTERRUPT_CLEAR1                                                                  0x3072
+#define regDSCC1_DSCC_INTERRUPT_CLEAR1_BASE_IDX                                                         2
+#define regDSCC1_DSCC_INTERRUPT_CLEAR2                                                                  0x3073
+#define regDSCC1_DSCC_INTERRUPT_CLEAR2_BASE_IDX                                                         2
+#define regDSCC1_DSCC_PPS_CONFIG0                                                                       0x3074
+#define regDSCC1_DSCC_PPS_CONFIG0_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG1                                                                       0x3075
+#define regDSCC1_DSCC_PPS_CONFIG1_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG2                                                                       0x3076
+#define regDSCC1_DSCC_PPS_CONFIG2_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG3                                                                       0x3077
+#define regDSCC1_DSCC_PPS_CONFIG3_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG4                                                                       0x3078
+#define regDSCC1_DSCC_PPS_CONFIG4_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG5                                                                       0x3079
+#define regDSCC1_DSCC_PPS_CONFIG5_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG6                                                                       0x307a
+#define regDSCC1_DSCC_PPS_CONFIG6_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG7                                                                       0x307b
+#define regDSCC1_DSCC_PPS_CONFIG7_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG8                                                                       0x307c
+#define regDSCC1_DSCC_PPS_CONFIG8_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG9                                                                       0x307d
+#define regDSCC1_DSCC_PPS_CONFIG9_BASE_IDX                                                              2
+#define regDSCC1_DSCC_PPS_CONFIG10                                                                      0x307e
+#define regDSCC1_DSCC_PPS_CONFIG10_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG11                                                                      0x307f
+#define regDSCC1_DSCC_PPS_CONFIG11_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG12                                                                      0x3080
+#define regDSCC1_DSCC_PPS_CONFIG12_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG13                                                                      0x3081
+#define regDSCC1_DSCC_PPS_CONFIG13_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG14                                                                      0x3082
+#define regDSCC1_DSCC_PPS_CONFIG14_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG15                                                                      0x3083
+#define regDSCC1_DSCC_PPS_CONFIG15_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG16                                                                      0x3084
+#define regDSCC1_DSCC_PPS_CONFIG16_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG17                                                                      0x3085
+#define regDSCC1_DSCC_PPS_CONFIG17_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG18                                                                      0x3086
+#define regDSCC1_DSCC_PPS_CONFIG18_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG19                                                                      0x3087
+#define regDSCC1_DSCC_PPS_CONFIG19_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG20                                                                      0x3088
+#define regDSCC1_DSCC_PPS_CONFIG20_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG21                                                                      0x3089
+#define regDSCC1_DSCC_PPS_CONFIG21_BASE_IDX                                                             2
+#define regDSCC1_DSCC_PPS_CONFIG22                                                                      0x308a
+#define regDSCC1_DSCC_PPS_CONFIG22_BASE_IDX                                                             2
+#define regDSCC1_DSCC_MEM_POWER_CONTROL0                                                                0x308b
+#define regDSCC1_DSCC_MEM_POWER_CONTROL0_BASE_IDX                                                       2
+#define regDSCC1_DSCC_MEM_POWER_CONTROL1                                                                0x308c
+#define regDSCC1_DSCC_MEM_POWER_CONTROL1_BASE_IDX                                                       2
+#define regDSCC1_DSCC_MEM_POWER_CONTROL2                                                                0x308d
+#define regDSCC1_DSCC_MEM_POWER_CONTROL2_BASE_IDX                                                       2
+#define regDSCC1_DSCC_SLICE_CTX_SELECT                                                                  0x308e
+#define regDSCC1_DSCC_SLICE_CTX_SELECT_BASE_IDX                                                         2
+#define regDSCC1_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL                                                 0x308f
+#define regDSCC1_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_BASE_IDX                                        2
+#define regDSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL                                                  0x3090
+#define regDSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_BASE_IDX                                         2
+#define regDSCC1_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL                                             0x3091
+#define regDSCC1_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_BASE_IDX                                    2
+#define regDSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL                                              0x3092
+#define regDSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_BASE_IDX                                     2
+#define regDSCC1_DSCC_RESET_CONTROL                                                                     0x3093
+#define regDSCC1_DSCC_RESET_CONTROL_BASE_IDX                                                            2
+#define regDSCC1_DSCC_TEST_DEBUG_BUS_ROTATE                                                             0x3098
+#define regDSCC1_DSCC_TEST_DEBUG_BUS_ROTATE_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dsc1_dispdec_dsc_top_dispdec
+// base address: 0x19470
+#define regDSC_TOP1_DSC_TOP_CONTROL                                                                     0x305c
+#define regDSC_TOP1_DSC_TOP_CONTROL_BASE_IDX                                                            2
+#define regDSC_TOP1_DSC_DEBUG_CONTROL                                                                   0x305d
+#define regDSC_TOP1_DSC_DEBUG_CONTROL_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dsc2_dispdec_dscc_dispdec
+// base address: 0x19608
+#define regDSCC2_DSCC_CONFIG0                                                                           0x30c2
+#define regDSCC2_DSCC_CONFIG0_BASE_IDX                                                                  2
+#define regDSCC2_DSCC_CONFIG1                                                                           0x30c3
+#define regDSCC2_DSCC_CONFIG1_BASE_IDX                                                                  2
+#define regDSCC2_DSCC_CONFIG2                                                                           0x30c4
+#define regDSCC2_DSCC_CONFIG2_BASE_IDX                                                                  2
+#define regDSCC2_DSCC_CONFIG3                                                                           0x30c5
+#define regDSCC2_DSCC_CONFIG3_BASE_IDX                                                                  2
+#define regDSCC2_DSCC_STATUS                                                                            0x30c6
+#define regDSCC2_DSCC_STATUS_BASE_IDX                                                                   2
+#define regDSCC2_DSCC_INTERRUPT_CONTROL0                                                                0x30c7
+#define regDSCC2_DSCC_INTERRUPT_CONTROL0_BASE_IDX                                                       2
+#define regDSCC2_DSCC_INTERRUPT_CONTROL1                                                                0x30c8
+#define regDSCC2_DSCC_INTERRUPT_CONTROL1_BASE_IDX                                                       2
+#define regDSCC2_DSCC_INTERRUPT_CONTROL2                                                                0x30c9
+#define regDSCC2_DSCC_INTERRUPT_CONTROL2_BASE_IDX                                                       2
+#define regDSCC2_DSCC_INTERRUPT_STATUS0                                                                 0x30ca
+#define regDSCC2_DSCC_INTERRUPT_STATUS0_BASE_IDX                                                        2
+#define regDSCC2_DSCC_INTERRUPT_STATUS1                                                                 0x30cb
+#define regDSCC2_DSCC_INTERRUPT_STATUS1_BASE_IDX                                                        2
+#define regDSCC2_DSCC_INTERRUPT_STATUS2                                                                 0x30cc
+#define regDSCC2_DSCC_INTERRUPT_STATUS2_BASE_IDX                                                        2
+#define regDSCC2_DSCC_INTERRUPT_CLEAR0                                                                  0x30cd
+#define regDSCC2_DSCC_INTERRUPT_CLEAR0_BASE_IDX                                                         2
+#define regDSCC2_DSCC_INTERRUPT_CLEAR1                                                                  0x30ce
+#define regDSCC2_DSCC_INTERRUPT_CLEAR1_BASE_IDX                                                         2
+#define regDSCC2_DSCC_INTERRUPT_CLEAR2                                                                  0x30cf
+#define regDSCC2_DSCC_INTERRUPT_CLEAR2_BASE_IDX                                                         2
+#define regDSCC2_DSCC_PPS_CONFIG0                                                                       0x30d0
+#define regDSCC2_DSCC_PPS_CONFIG0_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG1                                                                       0x30d1
+#define regDSCC2_DSCC_PPS_CONFIG1_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG2                                                                       0x30d2
+#define regDSCC2_DSCC_PPS_CONFIG2_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG3                                                                       0x30d3
+#define regDSCC2_DSCC_PPS_CONFIG3_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG4                                                                       0x30d4
+#define regDSCC2_DSCC_PPS_CONFIG4_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG5                                                                       0x30d5
+#define regDSCC2_DSCC_PPS_CONFIG5_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG6                                                                       0x30d6
+#define regDSCC2_DSCC_PPS_CONFIG6_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG7                                                                       0x30d7
+#define regDSCC2_DSCC_PPS_CONFIG7_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG8                                                                       0x30d8
+#define regDSCC2_DSCC_PPS_CONFIG8_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG9                                                                       0x30d9
+#define regDSCC2_DSCC_PPS_CONFIG9_BASE_IDX                                                              2
+#define regDSCC2_DSCC_PPS_CONFIG10                                                                      0x30da
+#define regDSCC2_DSCC_PPS_CONFIG10_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG11                                                                      0x30db
+#define regDSCC2_DSCC_PPS_CONFIG11_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG12                                                                      0x30dc
+#define regDSCC2_DSCC_PPS_CONFIG12_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG13                                                                      0x30dd
+#define regDSCC2_DSCC_PPS_CONFIG13_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG14                                                                      0x30de
+#define regDSCC2_DSCC_PPS_CONFIG14_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG15                                                                      0x30df
+#define regDSCC2_DSCC_PPS_CONFIG15_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG16                                                                      0x30e0
+#define regDSCC2_DSCC_PPS_CONFIG16_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG17                                                                      0x30e1
+#define regDSCC2_DSCC_PPS_CONFIG17_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG18                                                                      0x30e2
+#define regDSCC2_DSCC_PPS_CONFIG18_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG19                                                                      0x30e3
+#define regDSCC2_DSCC_PPS_CONFIG19_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG20                                                                      0x30e4
+#define regDSCC2_DSCC_PPS_CONFIG20_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG21                                                                      0x30e5
+#define regDSCC2_DSCC_PPS_CONFIG21_BASE_IDX                                                             2
+#define regDSCC2_DSCC_PPS_CONFIG22                                                                      0x30e6
+#define regDSCC2_DSCC_PPS_CONFIG22_BASE_IDX                                                             2
+#define regDSCC2_DSCC_MEM_POWER_CONTROL0                                                                0x30e7
+#define regDSCC2_DSCC_MEM_POWER_CONTROL0_BASE_IDX                                                       2
+#define regDSCC2_DSCC_MEM_POWER_CONTROL1                                                                0x30e8
+#define regDSCC2_DSCC_MEM_POWER_CONTROL1_BASE_IDX                                                       2
+#define regDSCC2_DSCC_MEM_POWER_CONTROL2                                                                0x30e9
+#define regDSCC2_DSCC_MEM_POWER_CONTROL2_BASE_IDX                                                       2
+#define regDSCC2_DSCC_SLICE_CTX_SELECT                                                                  0x30ea
+#define regDSCC2_DSCC_SLICE_CTX_SELECT_BASE_IDX                                                         2
+#define regDSCC2_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL                                                 0x30eb
+#define regDSCC2_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_BASE_IDX                                        2
+#define regDSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL                                                  0x30ec
+#define regDSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_BASE_IDX                                         2
+#define regDSCC2_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL                                             0x30ed
+#define regDSCC2_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_BASE_IDX                                    2
+#define regDSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL                                              0x30ee
+#define regDSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_BASE_IDX                                     2
+#define regDSCC2_DSCC_RESET_CONTROL                                                                     0x30ef
+#define regDSCC2_DSCC_RESET_CONTROL_BASE_IDX                                                            2
+#define regDSCC2_DSCC_TEST_DEBUG_BUS_ROTATE                                                             0x30f4
+#define regDSCC2_DSCC_TEST_DEBUG_BUS_ROTATE_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dsc2_dispdec_dsc_top_dispdec
+// base address: 0x195e0
+#define regDSC_TOP2_DSC_TOP_CONTROL                                                                     0x30b8
+#define regDSC_TOP2_DSC_TOP_CONTROL_BASE_IDX                                                            2
+#define regDSC_TOP2_DSC_DEBUG_CONTROL                                                                   0x30b9
+#define regDSC_TOP2_DSC_DEBUG_CONTROL_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dsc3_dispdec_dscc_dispdec
+// base address: 0x19778
+#define regDSCC3_DSCC_CONFIG0                                                                           0x311e
+#define regDSCC3_DSCC_CONFIG0_BASE_IDX                                                                  2
+#define regDSCC3_DSCC_CONFIG1                                                                           0x311f
+#define regDSCC3_DSCC_CONFIG1_BASE_IDX                                                                  2
+#define regDSCC3_DSCC_CONFIG2                                                                           0x3120
+#define regDSCC3_DSCC_CONFIG2_BASE_IDX                                                                  2
+#define regDSCC3_DSCC_CONFIG3                                                                           0x3121
+#define regDSCC3_DSCC_CONFIG3_BASE_IDX                                                                  2
+#define regDSCC3_DSCC_STATUS                                                                            0x3122
+#define regDSCC3_DSCC_STATUS_BASE_IDX                                                                   2
+#define regDSCC3_DSCC_INTERRUPT_CONTROL0                                                                0x3123
+#define regDSCC3_DSCC_INTERRUPT_CONTROL0_BASE_IDX                                                       2
+#define regDSCC3_DSCC_INTERRUPT_CONTROL1                                                                0x3124
+#define regDSCC3_DSCC_INTERRUPT_CONTROL1_BASE_IDX                                                       2
+#define regDSCC3_DSCC_INTERRUPT_CONTROL2                                                                0x3125
+#define regDSCC3_DSCC_INTERRUPT_CONTROL2_BASE_IDX                                                       2
+#define regDSCC3_DSCC_INTERRUPT_STATUS0                                                                 0x3126
+#define regDSCC3_DSCC_INTERRUPT_STATUS0_BASE_IDX                                                        2
+#define regDSCC3_DSCC_INTERRUPT_STATUS1                                                                 0x3127
+#define regDSCC3_DSCC_INTERRUPT_STATUS1_BASE_IDX                                                        2
+#define regDSCC3_DSCC_INTERRUPT_STATUS2                                                                 0x3128
+#define regDSCC3_DSCC_INTERRUPT_STATUS2_BASE_IDX                                                        2
+#define regDSCC3_DSCC_INTERRUPT_CLEAR0                                                                  0x3129
+#define regDSCC3_DSCC_INTERRUPT_CLEAR0_BASE_IDX                                                         2
+#define regDSCC3_DSCC_INTERRUPT_CLEAR1                                                                  0x312a
+#define regDSCC3_DSCC_INTERRUPT_CLEAR1_BASE_IDX                                                         2
+#define regDSCC3_DSCC_INTERRUPT_CLEAR2                                                                  0x312b
+#define regDSCC3_DSCC_INTERRUPT_CLEAR2_BASE_IDX                                                         2
+#define regDSCC3_DSCC_PPS_CONFIG0                                                                       0x312c
+#define regDSCC3_DSCC_PPS_CONFIG0_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG1                                                                       0x312d
+#define regDSCC3_DSCC_PPS_CONFIG1_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG2                                                                       0x312e
+#define regDSCC3_DSCC_PPS_CONFIG2_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG3                                                                       0x312f
+#define regDSCC3_DSCC_PPS_CONFIG3_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG4                                                                       0x3130
+#define regDSCC3_DSCC_PPS_CONFIG4_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG5                                                                       0x3131
+#define regDSCC3_DSCC_PPS_CONFIG5_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG6                                                                       0x3132
+#define regDSCC3_DSCC_PPS_CONFIG6_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG7                                                                       0x3133
+#define regDSCC3_DSCC_PPS_CONFIG7_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG8                                                                       0x3134
+#define regDSCC3_DSCC_PPS_CONFIG8_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG9                                                                       0x3135
+#define regDSCC3_DSCC_PPS_CONFIG9_BASE_IDX                                                              2
+#define regDSCC3_DSCC_PPS_CONFIG10                                                                      0x3136
+#define regDSCC3_DSCC_PPS_CONFIG10_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG11                                                                      0x3137
+#define regDSCC3_DSCC_PPS_CONFIG11_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG12                                                                      0x3138
+#define regDSCC3_DSCC_PPS_CONFIG12_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG13                                                                      0x3139
+#define regDSCC3_DSCC_PPS_CONFIG13_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG14                                                                      0x313a
+#define regDSCC3_DSCC_PPS_CONFIG14_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG15                                                                      0x313b
+#define regDSCC3_DSCC_PPS_CONFIG15_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG16                                                                      0x313c
+#define regDSCC3_DSCC_PPS_CONFIG16_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG17                                                                      0x313d
+#define regDSCC3_DSCC_PPS_CONFIG17_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG18                                                                      0x313e
+#define regDSCC3_DSCC_PPS_CONFIG18_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG19                                                                      0x313f
+#define regDSCC3_DSCC_PPS_CONFIG19_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG20                                                                      0x3140
+#define regDSCC3_DSCC_PPS_CONFIG20_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG21                                                                      0x3141
+#define regDSCC3_DSCC_PPS_CONFIG21_BASE_IDX                                                             2
+#define regDSCC3_DSCC_PPS_CONFIG22                                                                      0x3142
+#define regDSCC3_DSCC_PPS_CONFIG22_BASE_IDX                                                             2
+#define regDSCC3_DSCC_MEM_POWER_CONTROL0                                                                0x3143
+#define regDSCC3_DSCC_MEM_POWER_CONTROL0_BASE_IDX                                                       2
+#define regDSCC3_DSCC_MEM_POWER_CONTROL1                                                                0x3144
+#define regDSCC3_DSCC_MEM_POWER_CONTROL1_BASE_IDX                                                       2
+#define regDSCC3_DSCC_MEM_POWER_CONTROL2                                                                0x3145
+#define regDSCC3_DSCC_MEM_POWER_CONTROL2_BASE_IDX                                                       2
+#define regDSCC3_DSCC_SLICE_CTX_SELECT                                                                  0x3146
+#define regDSCC3_DSCC_SLICE_CTX_SELECT_BASE_IDX                                                         2
+#define regDSCC3_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL                                                 0x3147
+#define regDSCC3_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_BASE_IDX                                        2
+#define regDSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL                                                  0x3148
+#define regDSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_BASE_IDX                                         2
+#define regDSCC3_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL                                             0x3149
+#define regDSCC3_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_BASE_IDX                                    2
+#define regDSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL                                              0x314a
+#define regDSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_BASE_IDX                                     2
+#define regDSCC3_DSCC_RESET_CONTROL                                                                     0x314b
+#define regDSCC3_DSCC_RESET_CONTROL_BASE_IDX                                                            2
+#define regDSCC3_DSCC_TEST_DEBUG_BUS_ROTATE                                                             0x3150
+#define regDSCC3_DSCC_TEST_DEBUG_BUS_ROTATE_BASE_IDX                                                    2
+
+
+// addressBlock: dce_dc_dsc3_dispdec_dsc_top_dispdec
+// base address: 0x19750
+#define regDSC_TOP3_DSC_TOP_CONTROL                                                                     0x3114
+#define regDSC_TOP3_DSC_TOP_CONTROL_BASE_IDX                                                            2
+#define regDSC_TOP3_DSC_DEBUG_CONTROL                                                                   0x3115
+#define regDSC_TOP3_DSC_DEBUG_CONTROL_BASE_IDX                                                          2
+
+
+// addressBlock: dce_dc_dcoh_dcoh_top_dispdec
+// base address: 0x0
+#define regDCOH_TOP_CLOCK_CONTROL                                                                       0x17af
+#define regDCOH_TOP_CLOCK_CONTROL_BASE_IDX                                                              2
+#define regDCOH_TOP_SPARE                                                                               0x17b4
+#define regDCOH_TOP_SPARE_BASE_IDX                                                                      2
+
+
+// addressBlock: dce_dc_dcoh_hdcp2_misc_dispdec
+// base address: 0x0
+#define regPSP_INTERRUPT_STATUS                                                                         0x17c9
+#define regPSP_INTERRUPT_STATUS_BASE_IDX                                                                2
+#define regPSP_INTERRUPT_CLEAR                                                                          0x17ca
+#define regPSP_INTERRUPT_CLEAR_BASE_IDX                                                                 2
+
+
+// addressBlock: dce_dc_dcoh_phy_mux0_dispdec
+// base address: 0x13168
+#define regPHY_MUX0_PHY_MUX_CONTROL                                                                     0x179a
+#define regPHY_MUX0_PHY_MUX_CONTROL_BASE_IDX                                                            2
+#define regPHY_MUX0_PORT_TYPE                                                                           0x179b
+#define regPHY_MUX0_PORT_TYPE_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dcoh_phy_mux1_dispdec
+// base address: 0x13174
+#define regPHY_MUX1_PHY_MUX_CONTROL                                                                     0x179d
+#define regPHY_MUX1_PHY_MUX_CONTROL_BASE_IDX                                                            2
+#define regPHY_MUX1_PORT_TYPE                                                                           0x179e
+#define regPHY_MUX1_PORT_TYPE_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dcoh_phy_mux2_dispdec
+// base address: 0x13180
+#define regPHY_MUX2_PHY_MUX_CONTROL                                                                     0x17a0
+#define regPHY_MUX2_PHY_MUX_CONTROL_BASE_IDX                                                            2
+#define regPHY_MUX2_PORT_TYPE                                                                           0x17a1
+#define regPHY_MUX2_PORT_TYPE_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dcoh_phy_mux3_dispdec
+// base address: 0x1318c
+#define regPHY_MUX3_PHY_MUX_CONTROL                                                                     0x17a3
+#define regPHY_MUX3_PHY_MUX_CONTROL_BASE_IDX                                                            2
+#define regPHY_MUX3_PORT_TYPE                                                                           0x17a4
+#define regPHY_MUX3_PORT_TYPE_BASE_IDX                                                                  2
+
+
+// addressBlock: dce_dc_dcoh_dp_aux0_dispdec
+// base address: 0x0
+#define regDP_AUX0_AUX_CONTROL                                                                          0x16b2
+#define regDP_AUX0_AUX_CONTROL_BASE_IDX                                                                 2
+#define regDP_AUX0_AUX_SW_CONTROL                                                                       0x16b3
+#define regDP_AUX0_AUX_SW_CONTROL_BASE_IDX                                                              2
+#define regDP_AUX0_AUX_ARB_CONTROL                                                                      0x16b4
+#define regDP_AUX0_AUX_ARB_CONTROL_BASE_IDX                                                             2
+#define regDP_AUX0_AUX_INTERRUPT_CONTROL                                                                0x16b5
+#define regDP_AUX0_AUX_INTERRUPT_CONTROL_BASE_IDX                                                       2
+#define regDP_AUX0_AUX_SW_STATUS                                                                        0x16b6
+#define regDP_AUX0_AUX_SW_STATUS_BASE_IDX                                                               2
+#define regDP_AUX0_AUX_LS_STATUS                                                                        0x16b7
+#define regDP_AUX0_AUX_LS_STATUS_BASE_IDX                                                               2
+#define regDP_AUX0_AUX_SW_DATA                                                                          0x16b8
+#define regDP_AUX0_AUX_SW_DATA_BASE_IDX                                                                 2
+#define regDP_AUX0_AUX_LS_DATA                                                                          0x16b9
+#define regDP_AUX0_AUX_LS_DATA_BASE_IDX                                                                 2
+#define regDP_AUX0_AUX_DPHY_TX_REF_CONTROL                                                              0x16ba
+#define regDP_AUX0_AUX_DPHY_TX_REF_CONTROL_BASE_IDX                                                     2
+#define regDP_AUX0_AUX_DPHY_TX_CONTROL                                                                  0x16bb
+#define regDP_AUX0_AUX_DPHY_TX_CONTROL_BASE_IDX                                                         2
+#define regDP_AUX0_AUX_DPHY_RX_CONTROL0                                                                 0x16bc
+#define regDP_AUX0_AUX_DPHY_RX_CONTROL0_BASE_IDX                                                        2
+#define regDP_AUX0_AUX_DPHY_RX_CONTROL1                                                                 0x16bd
+#define regDP_AUX0_AUX_DPHY_RX_CONTROL1_BASE_IDX                                                        2
+#define regDP_AUX0_AUX_DPHY_TX_STATUS                                                                   0x16be
+#define regDP_AUX0_AUX_DPHY_TX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX0_AUX_DPHY_RX_STATUS                                                                   0x16bf
+#define regDP_AUX0_AUX_DPHY_RX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX0_AUX_PHY_WAKE_CNTL                                                                    0x16c1
+#define regDP_AUX0_AUX_PHY_WAKE_CNTL_BASE_IDX                                                           2
+#define regDP_AUX0_AUX_PHY_WAKE_STATUS                                                                  0x16c2
+#define regDP_AUX0_AUX_PHY_WAKE_STATUS_BASE_IDX                                                         2
+
+
+// addressBlock: dce_dc_dcoh_dp_aux1_dispdec
+// base address: 0x70
+#define regDP_AUX1_AUX_CONTROL                                                                          0x16ce
+#define regDP_AUX1_AUX_CONTROL_BASE_IDX                                                                 2
+#define regDP_AUX1_AUX_SW_CONTROL                                                                       0x16cf
+#define regDP_AUX1_AUX_SW_CONTROL_BASE_IDX                                                              2
+#define regDP_AUX1_AUX_ARB_CONTROL                                                                      0x16d0
+#define regDP_AUX1_AUX_ARB_CONTROL_BASE_IDX                                                             2
+#define regDP_AUX1_AUX_INTERRUPT_CONTROL                                                                0x16d1
+#define regDP_AUX1_AUX_INTERRUPT_CONTROL_BASE_IDX                                                       2
+#define regDP_AUX1_AUX_SW_STATUS                                                                        0x16d2
+#define regDP_AUX1_AUX_SW_STATUS_BASE_IDX                                                               2
+#define regDP_AUX1_AUX_LS_STATUS                                                                        0x16d3
+#define regDP_AUX1_AUX_LS_STATUS_BASE_IDX                                                               2
+#define regDP_AUX1_AUX_SW_DATA                                                                          0x16d4
+#define regDP_AUX1_AUX_SW_DATA_BASE_IDX                                                                 2
+#define regDP_AUX1_AUX_LS_DATA                                                                          0x16d5
+#define regDP_AUX1_AUX_LS_DATA_BASE_IDX                                                                 2
+#define regDP_AUX1_AUX_DPHY_TX_REF_CONTROL                                                              0x16d6
+#define regDP_AUX1_AUX_DPHY_TX_REF_CONTROL_BASE_IDX                                                     2
+#define regDP_AUX1_AUX_DPHY_TX_CONTROL                                                                  0x16d7
+#define regDP_AUX1_AUX_DPHY_TX_CONTROL_BASE_IDX                                                         2
+#define regDP_AUX1_AUX_DPHY_RX_CONTROL0                                                                 0x16d8
+#define regDP_AUX1_AUX_DPHY_RX_CONTROL0_BASE_IDX                                                        2
+#define regDP_AUX1_AUX_DPHY_RX_CONTROL1                                                                 0x16d9
+#define regDP_AUX1_AUX_DPHY_RX_CONTROL1_BASE_IDX                                                        2
+#define regDP_AUX1_AUX_DPHY_TX_STATUS                                                                   0x16da
+#define regDP_AUX1_AUX_DPHY_TX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX1_AUX_DPHY_RX_STATUS                                                                   0x16db
+#define regDP_AUX1_AUX_DPHY_RX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX1_AUX_PHY_WAKE_CNTL                                                                    0x16dd
+#define regDP_AUX1_AUX_PHY_WAKE_CNTL_BASE_IDX                                                           2
+#define regDP_AUX1_AUX_PHY_WAKE_STATUS                                                                  0x16de
+#define regDP_AUX1_AUX_PHY_WAKE_STATUS_BASE_IDX                                                         2
+
+
+// addressBlock: dce_dc_dcoh_dp_aux2_dispdec
+// base address: 0xe0
+#define regDP_AUX2_AUX_CONTROL                                                                          0x16ea
+#define regDP_AUX2_AUX_CONTROL_BASE_IDX                                                                 2
+#define regDP_AUX2_AUX_SW_CONTROL                                                                       0x16eb
+#define regDP_AUX2_AUX_SW_CONTROL_BASE_IDX                                                              2
+#define regDP_AUX2_AUX_ARB_CONTROL                                                                      0x16ec
+#define regDP_AUX2_AUX_ARB_CONTROL_BASE_IDX                                                             2
+#define regDP_AUX2_AUX_INTERRUPT_CONTROL                                                                0x16ed
+#define regDP_AUX2_AUX_INTERRUPT_CONTROL_BASE_IDX                                                       2
+#define regDP_AUX2_AUX_SW_STATUS                                                                        0x16ee
+#define regDP_AUX2_AUX_SW_STATUS_BASE_IDX                                                               2
+#define regDP_AUX2_AUX_LS_STATUS                                                                        0x16ef
+#define regDP_AUX2_AUX_LS_STATUS_BASE_IDX                                                               2
+#define regDP_AUX2_AUX_SW_DATA                                                                          0x16f0
+#define regDP_AUX2_AUX_SW_DATA_BASE_IDX                                                                 2
+#define regDP_AUX2_AUX_LS_DATA                                                                          0x16f1
+#define regDP_AUX2_AUX_LS_DATA_BASE_IDX                                                                 2
+#define regDP_AUX2_AUX_DPHY_TX_REF_CONTROL                                                              0x16f2
+#define regDP_AUX2_AUX_DPHY_TX_REF_CONTROL_BASE_IDX                                                     2
+#define regDP_AUX2_AUX_DPHY_TX_CONTROL                                                                  0x16f3
+#define regDP_AUX2_AUX_DPHY_TX_CONTROL_BASE_IDX                                                         2
+#define regDP_AUX2_AUX_DPHY_RX_CONTROL0                                                                 0x16f4
+#define regDP_AUX2_AUX_DPHY_RX_CONTROL0_BASE_IDX                                                        2
+#define regDP_AUX2_AUX_DPHY_RX_CONTROL1                                                                 0x16f5
+#define regDP_AUX2_AUX_DPHY_RX_CONTROL1_BASE_IDX                                                        2
+#define regDP_AUX2_AUX_DPHY_TX_STATUS                                                                   0x16f6
+#define regDP_AUX2_AUX_DPHY_TX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX2_AUX_DPHY_RX_STATUS                                                                   0x16f7
+#define regDP_AUX2_AUX_DPHY_RX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX2_AUX_PHY_WAKE_CNTL                                                                    0x16f9
+#define regDP_AUX2_AUX_PHY_WAKE_CNTL_BASE_IDX                                                           2
+#define regDP_AUX2_AUX_PHY_WAKE_STATUS                                                                  0x16fa
+#define regDP_AUX2_AUX_PHY_WAKE_STATUS_BASE_IDX                                                         2
+
+
+// addressBlock: dce_dc_dcoh_dp_aux3_dispdec
+// base address: 0x150
+#define regDP_AUX3_AUX_CONTROL                                                                          0x1706
+#define regDP_AUX3_AUX_CONTROL_BASE_IDX                                                                 2
+#define regDP_AUX3_AUX_SW_CONTROL                                                                       0x1707
+#define regDP_AUX3_AUX_SW_CONTROL_BASE_IDX                                                              2
+#define regDP_AUX3_AUX_ARB_CONTROL                                                                      0x1708
+#define regDP_AUX3_AUX_ARB_CONTROL_BASE_IDX                                                             2
+#define regDP_AUX3_AUX_INTERRUPT_CONTROL                                                                0x1709
+#define regDP_AUX3_AUX_INTERRUPT_CONTROL_BASE_IDX                                                       2
+#define regDP_AUX3_AUX_SW_STATUS                                                                        0x170a
+#define regDP_AUX3_AUX_SW_STATUS_BASE_IDX                                                               2
+#define regDP_AUX3_AUX_LS_STATUS                                                                        0x170b
+#define regDP_AUX3_AUX_LS_STATUS_BASE_IDX                                                               2
+#define regDP_AUX3_AUX_SW_DATA                                                                          0x170c
+#define regDP_AUX3_AUX_SW_DATA_BASE_IDX                                                                 2
+#define regDP_AUX3_AUX_LS_DATA                                                                          0x170d
+#define regDP_AUX3_AUX_LS_DATA_BASE_IDX                                                                 2
+#define regDP_AUX3_AUX_DPHY_TX_REF_CONTROL                                                              0x170e
+#define regDP_AUX3_AUX_DPHY_TX_REF_CONTROL_BASE_IDX                                                     2
+#define regDP_AUX3_AUX_DPHY_TX_CONTROL                                                                  0x170f
+#define regDP_AUX3_AUX_DPHY_TX_CONTROL_BASE_IDX                                                         2
+#define regDP_AUX3_AUX_DPHY_RX_CONTROL0                                                                 0x1710
+#define regDP_AUX3_AUX_DPHY_RX_CONTROL0_BASE_IDX                                                        2
+#define regDP_AUX3_AUX_DPHY_RX_CONTROL1                                                                 0x1711
+#define regDP_AUX3_AUX_DPHY_RX_CONTROL1_BASE_IDX                                                        2
+#define regDP_AUX3_AUX_DPHY_TX_STATUS                                                                   0x1712
+#define regDP_AUX3_AUX_DPHY_TX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX3_AUX_DPHY_RX_STATUS                                                                   0x1713
+#define regDP_AUX3_AUX_DPHY_RX_STATUS_BASE_IDX                                                          2
+#define regDP_AUX3_AUX_PHY_WAKE_CNTL                                                                    0x1715
+#define regDP_AUX3_AUX_PHY_WAKE_CNTL_BASE_IDX                                                           2
+#define regDP_AUX3_AUX_PHY_WAKE_STATUS                                                                  0x1716
+#define regDP_AUX3_AUX_PHY_WAKE_STATUS_BASE_IDX                                                         2
+
+
+// addressBlock: dce_dc_dcoh_hpd0_dispdec
+// base address: 0x0
+#define regHPD0_DC_HPD_INT_STATUS                                                                       0x175a
+#define regHPD0_DC_HPD_INT_STATUS_BASE_IDX                                                              2
+#define regHPD0_DC_HPD_INT_CONTROL                                                                      0x175b
+#define regHPD0_DC_HPD_INT_CONTROL_BASE_IDX                                                             2
+#define regHPD0_DC_HPD_CONTROL                                                                          0x175c
+#define regHPD0_DC_HPD_CONTROL_BASE_IDX                                                                 2
+#define regHPD0_DC_HPD_FAST_TRAIN_CNTL                                                                  0x175d
+#define regHPD0_DC_HPD_FAST_TRAIN_CNTL_BASE_IDX                                                         2
+#define regHPD0_DC_HPD_TOGGLE_FILT_CNTL                                                                 0x175e
+#define regHPD0_DC_HPD_TOGGLE_FILT_CNTL_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcoh_hpd1_dispdec
+// base address: 0x20
+#define regHPD1_DC_HPD_INT_STATUS                                                                       0x1762
+#define regHPD1_DC_HPD_INT_STATUS_BASE_IDX                                                              2
+#define regHPD1_DC_HPD_INT_CONTROL                                                                      0x1763
+#define regHPD1_DC_HPD_INT_CONTROL_BASE_IDX                                                             2
+#define regHPD1_DC_HPD_CONTROL                                                                          0x1764
+#define regHPD1_DC_HPD_CONTROL_BASE_IDX                                                                 2
+#define regHPD1_DC_HPD_FAST_TRAIN_CNTL                                                                  0x1765
+#define regHPD1_DC_HPD_FAST_TRAIN_CNTL_BASE_IDX                                                         2
+#define regHPD1_DC_HPD_TOGGLE_FILT_CNTL                                                                 0x1766
+#define regHPD1_DC_HPD_TOGGLE_FILT_CNTL_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcoh_hpd2_dispdec
+// base address: 0x40
+#define regHPD2_DC_HPD_INT_STATUS                                                                       0x176a
+#define regHPD2_DC_HPD_INT_STATUS_BASE_IDX                                                              2
+#define regHPD2_DC_HPD_INT_CONTROL                                                                      0x176b
+#define regHPD2_DC_HPD_INT_CONTROL_BASE_IDX                                                             2
+#define regHPD2_DC_HPD_CONTROL                                                                          0x176c
+#define regHPD2_DC_HPD_CONTROL_BASE_IDX                                                                 2
+#define regHPD2_DC_HPD_FAST_TRAIN_CNTL                                                                  0x176d
+#define regHPD2_DC_HPD_FAST_TRAIN_CNTL_BASE_IDX                                                         2
+#define regHPD2_DC_HPD_TOGGLE_FILT_CNTL                                                                 0x176e
+#define regHPD2_DC_HPD_TOGGLE_FILT_CNTL_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_dcoh_hpd3_dispdec
+// base address: 0x60
+#define regHPD3_DC_HPD_INT_STATUS                                                                       0x1772
+#define regHPD3_DC_HPD_INT_STATUS_BASE_IDX                                                              2
+#define regHPD3_DC_HPD_INT_CONTROL                                                                      0x1773
+#define regHPD3_DC_HPD_INT_CONTROL_BASE_IDX                                                             2
+#define regHPD3_DC_HPD_CONTROL                                                                          0x1774
+#define regHPD3_DC_HPD_CONTROL_BASE_IDX                                                                 2
+#define regHPD3_DC_HPD_FAST_TRAIN_CNTL                                                                  0x1775
+#define regHPD3_DC_HPD_FAST_TRAIN_CNTL_BASE_IDX                                                         2
+#define regHPD3_DC_HPD_TOGGLE_FILT_CNTL                                                                 0x1776
+#define regHPD3_DC_HPD_TOGGLE_FILT_CNTL_BASE_IDX                                                        2
+
+
+// addressBlock: dce_dc_hpo_hpo_top_dispdec
+// base address: 0x2790c
+#define regHPO_TOP_CLOCK_CONTROL                                                                        0x0e43
+#define regHPO_TOP_CLOCK_CONTROL_BASE_IDX                                                               3
+#define regHPO_TOP_HW_CONTROL                                                                           0x0e44
+#define regHPO_TOP_HW_CONTROL_BASE_IDX                                                                  3
+
+
+// addressBlock: dce_dc_hpo_dp_stream_mapper_dispdec
+// base address: 0x27958
+#define regDP_STREAM_MAPPER_CONTROL0                                                                    0x0e56
+#define regDP_STREAM_MAPPER_CONTROL0_BASE_IDX                                                           3
+#define regDP_STREAM_MAPPER_CONTROL1                                                                    0x0e57
+#define regDP_STREAM_MAPPER_CONTROL1_BASE_IDX                                                           3
+#define regDP_STREAM_MAPPER_CONTROL2                                                                    0x0e58
+#define regDP_STREAM_MAPPER_CONTROL2_BASE_IDX                                                           3
+#define regDP_STREAM_MAPPER_CONTROL3                                                                    0x0e59
+#define regDP_STREAM_MAPPER_CONTROL3_BASE_IDX                                                           3
+
+
+// addressBlock: dce_dc_hpo_hpo_dcperfmon_dc_perfmon_dispdec
+// base address: 0x1a698
+#define regDC_PERFMON18_PERFCOUNTER_CNTL                                                                0x0e66
+#define regDC_PERFMON18_PERFCOUNTER_CNTL_BASE_IDX                                                       3
+#define regDC_PERFMON18_PERFCOUNTER_CNTL2                                                               0x0e67
+#define regDC_PERFMON18_PERFCOUNTER_CNTL2_BASE_IDX                                                      3
+#define regDC_PERFMON18_PERFCOUNTER_STATE                                                               0x0e68
+#define regDC_PERFMON18_PERFCOUNTER_STATE_BASE_IDX                                                      3
+#define regDC_PERFMON18_PERFMON_CNTL                                                                    0x0e69
+#define regDC_PERFMON18_PERFMON_CNTL_BASE_IDX                                                           3
+#define regDC_PERFMON18_PERFMON_CNTL2                                                                   0x0e6a
+#define regDC_PERFMON18_PERFMON_CNTL2_BASE_IDX                                                          3
+#define regDC_PERFMON18_PERFMON_CVALUE_INT_MISC                                                         0x0e6b
+#define regDC_PERFMON18_PERFMON_CVALUE_INT_MISC_BASE_IDX                                                3
+#define regDC_PERFMON18_PERFMON_CVALUE_LOW                                                              0x0e6c
+#define regDC_PERFMON18_PERFMON_CVALUE_LOW_BASE_IDX                                                     3
+#define regDC_PERFMON18_PERFMON_HI                                                                      0x0e6d
+#define regDC_PERFMON18_PERFMON_HI_BASE_IDX                                                             3
+#define regDC_PERFMON18_PERFMON_LOW                                                                     0x0e6e
+#define regDC_PERFMON18_PERFMON_LOW_BASE_IDX                                                            3
+#define regDC_PERFMON18_PERFMON_TEST_DEBUG_INDEX                                                        0x0e6f
+#define regDC_PERFMON18_PERFMON_TEST_DEBUG_INDEX_BASE_IDX                                               3
+#define regDC_PERFMON18_PERFMON_TEST_DEBUG_DATA                                                         0x0e70
+#define regDC_PERFMON18_PERFMON_TEST_DEBUG_DATA_BASE_IDX                                                3
+
+
+// addressBlock: dce_dc_hpo_hpo_dme_rm_mem0_dme_rm_dispdec
+// base address: 0x278ac
+#define regDME_RM2_DME_MEMORY_CONTROL                                                                   0x0e2b
+#define regDME_RM2_DME_MEMORY_CONTROL_BASE_IDX                                                          3
+#define regDME_RM2_DME_RM_MEM_CTRL                                                                      0x0e2c
+#define regDME_RM2_DME_RM_MEM_CTRL_BASE_IDX                                                             3
+
+
+// addressBlock: dce_dc_hpo_hpo_dme_rm_mem1_dme_rm_dispdec
+// base address: 0x278b4
+#define regDME_RM3_DME_MEMORY_CONTROL                                                                   0x0e2d
+#define regDME_RM3_DME_MEMORY_CONTROL_BASE_IDX                                                          3
+#define regDME_RM3_DME_RM_MEM_CTRL                                                                      0x0e2e
+#define regDME_RM3_DME_RM_MEM_CTRL_BASE_IDX                                                             3
+
+
+// addressBlock: dce_dc_hpo_hdmi_link_enc0_dispdec
+// base address: 0x26588
+#define regHDMI_LINK_ENC_CONTROL                                                                        0x0962
+#define regHDMI_LINK_ENC_CONTROL_BASE_IDX                                                               3
+#define regHDMI_LINK_ENC_CLK_CTRL                                                                       0x0963
+#define regHDMI_LINK_ENC_CLK_CTRL_BASE_IDX                                                              3
+
+
+// addressBlock: dce_dc_hpo_hdmi_frl_enc0_dispdec
+// base address: 0x265b0
+#define regHDMI_FRL_ENC_CONFIG                                                                          0x096c
+#define regHDMI_FRL_ENC_CONFIG_BASE_IDX                                                                 3
+#define regHDMI_FRL_ENC_CONFIG2                                                                         0x096d
+#define regHDMI_FRL_ENC_CONFIG2_BASE_IDX                                                                3
+#define regHDMI_FRL_ENC_METER_BUFFER_STATUS                                                             0x096e
+#define regHDMI_FRL_ENC_METER_BUFFER_STATUS_BASE_IDX                                                    3
+#define regHDMI_FRL_ENC_MEM_CTRL                                                                        0x096f
+#define regHDMI_FRL_ENC_MEM_CTRL_BASE_IDX                                                               3
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_dispdec
+// base address: 0x2634c
+#define regHDMI_STREAM_ENC_CLOCK_CONTROL                                                                0x08d3
+#define regHDMI_STREAM_ENC_CLOCK_CONTROL_BASE_IDX                                                       3
+#define regHDMI_STREAM_ENC_INPUT_MUX_CONTROL                                                            0x08d4
+#define regHDMI_STREAM_ENC_INPUT_MUX_CONTROL_BASE_IDX                                                   3
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0                                     0x08d5
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0_BASE_IDX                            3
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1                                     0x08d6
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1_BASE_IDX                            3
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2                                     0x08d7
+#define regHDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2_BASE_IDX                            3
+#define regHDMI_STREAM_ENC_AUDIO_CONTROL                                                                0x08d8
+#define regHDMI_STREAM_ENC_AUDIO_CONTROL_BASE_IDX                                                       3
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_apg_apg_dispdec
+// base address: 0x2644c
+#define regAPG4_APG_CONTROL                                                                             0x0913
+#define regAPG4_APG_CONTROL_BASE_IDX                                                                    3
+#define regAPG4_APG_CONTROL2                                                                            0x0914
+#define regAPG4_APG_CONTROL2_BASE_IDX                                                                   3
+#define regAPG4_APG_DBG_GEN_CONTROL                                                                     0x0915
+#define regAPG4_APG_DBG_GEN_CONTROL_BASE_IDX                                                            3
+#define regAPG4_APG_PACKET_CONTROL                                                                      0x0916
+#define regAPG4_APG_PACKET_CONTROL_BASE_IDX                                                             3
+#define regAPG4_APG_DBG_60958_0                                                                         0x091a
+#define regAPG4_APG_DBG_60958_0_BASE_IDX                                                                3
+#define regAPG4_APG_DBG_60958_1                                                                         0x091b
+#define regAPG4_APG_DBG_60958_1_BASE_IDX                                                                3
+#define regAPG4_APG_DBG_60958_2                                                                         0x091c
+#define regAPG4_APG_DBG_60958_2_BASE_IDX                                                                3
+#define regAPG4_APG_MEM_PWR                                                                             0x0927
+#define regAPG4_APG_MEM_PWR_BASE_IDX                                                                    3
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_dme_dme_dispdec
+// base address: 0x2650c
+#define regDME4_DME_CONTROL                                                                             0x0943
+#define regDME4_DME_CONTROL_BASE_IDX                                                                    3
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_vpg_vpg_dispdec
+// base address: 0x264c4
+#define regVPG4_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x0931
+#define regVPG4_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 3
+#define regVPG4_VPG_GENERIC_PACKET_DATA                                                                 0x0932
+#define regVPG4_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        3
+#define regVPG4_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x0933
+#define regVPG4_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      3
+#define regVPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x0934
+#define regVPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  3
+#define regVPG4_VPG_GENERIC_STATUS                                                                      0x0935
+#define regVPG4_VPG_GENERIC_STATUS_BASE_IDX                                                             3
+#define regVPG4_VPG_MEM_PWR                                                                             0x0936
+#define regVPG4_VPG_MEM_PWR_BASE_IDX                                                                    3
+#define regVPG4_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x0937
+#define regVPG4_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        3
+#define regVPG4_VPG_ISRC1_2_DATA                                                                        0x0938
+#define regVPG4_VPG_ISRC1_2_DATA_BASE_IDX                                                               3
+
+
+// addressBlock: dce_dc_hpo_hdmi_tb_enc0_dispdec
+// base address: 0x2637c
+#define regHDMI_TB_ENC_CONTROL                                                                          0x08df
+#define regHDMI_TB_ENC_CONTROL_BASE_IDX                                                                 3
+#define regHDMI_TB_ENC_PIXEL_FORMAT                                                                     0x08e0
+#define regHDMI_TB_ENC_PIXEL_FORMAT_BASE_IDX                                                            3
+#define regHDMI_TB_ENC_PACKET_CONTROL                                                                   0x08e1
+#define regHDMI_TB_ENC_PACKET_CONTROL_BASE_IDX                                                          3
+#define regHDMI_TB_ENC_ACR_PACKET_CONTROL                                                               0x08e2
+#define regHDMI_TB_ENC_ACR_PACKET_CONTROL_BASE_IDX                                                      3
+#define regHDMI_TB_ENC_VBI_PACKET_CONTROL1                                                              0x08e3
+#define regHDMI_TB_ENC_VBI_PACKET_CONTROL1_BASE_IDX                                                     3
+#define regHDMI_TB_ENC_VBI_PACKET_CONTROL2                                                              0x08e4
+#define regHDMI_TB_ENC_VBI_PACKET_CONTROL2_BASE_IDX                                                     3
+#define regHDMI_TB_ENC_GC_CONTROL                                                                       0x08e5
+#define regHDMI_TB_ENC_GC_CONTROL_BASE_IDX                                                              3
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL0                                                          0x08e6
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL0_BASE_IDX                                                 3
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL1                                                          0x08e7
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL1_BASE_IDX                                                 3
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL2                                                          0x08e8
+#define regHDMI_TB_ENC_GENERIC_PACKET_CONTROL2_BASE_IDX                                                 3
+#define regHDMI_TB_ENC_GENERIC_PACKET0_1_LINE                                                           0x08e9
+#define regHDMI_TB_ENC_GENERIC_PACKET0_1_LINE_BASE_IDX                                                  3
+#define regHDMI_TB_ENC_GENERIC_PACKET2_3_LINE                                                           0x08ea
+#define regHDMI_TB_ENC_GENERIC_PACKET2_3_LINE_BASE_IDX                                                  3
+#define regHDMI_TB_ENC_GENERIC_PACKET4_5_LINE                                                           0x08eb
+#define regHDMI_TB_ENC_GENERIC_PACKET4_5_LINE_BASE_IDX                                                  3
+#define regHDMI_TB_ENC_GENERIC_PACKET6_7_LINE                                                           0x08ec
+#define regHDMI_TB_ENC_GENERIC_PACKET6_7_LINE_BASE_IDX                                                  3
+#define regHDMI_TB_ENC_GENERIC_PACKET8_9_LINE                                                           0x08ed
+#define regHDMI_TB_ENC_GENERIC_PACKET8_9_LINE_BASE_IDX                                                  3
+#define regHDMI_TB_ENC_GENERIC_PACKET10_11_LINE                                                         0x08ee
+#define regHDMI_TB_ENC_GENERIC_PACKET10_11_LINE_BASE_IDX                                                3
+#define regHDMI_TB_ENC_GENERIC_PACKET12_13_LINE                                                         0x08ef
+#define regHDMI_TB_ENC_GENERIC_PACKET12_13_LINE_BASE_IDX                                                3
+#define regHDMI_TB_ENC_GENERIC_PACKET14_LINE                                                            0x08f0
+#define regHDMI_TB_ENC_GENERIC_PACKET14_LINE_BASE_IDX                                                   3
+#define regHDMI_TB_ENC_DB_CONTROL                                                                       0x08f1
+#define regHDMI_TB_ENC_DB_CONTROL_BASE_IDX                                                              3
+#define regHDMI_TB_ENC_ACR_32_0                                                                         0x08f2
+#define regHDMI_TB_ENC_ACR_32_0_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_32_1                                                                         0x08f3
+#define regHDMI_TB_ENC_ACR_32_1_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_44_0                                                                         0x08f4
+#define regHDMI_TB_ENC_ACR_44_0_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_44_1                                                                         0x08f5
+#define regHDMI_TB_ENC_ACR_44_1_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_48_0                                                                         0x08f6
+#define regHDMI_TB_ENC_ACR_48_0_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_48_1                                                                         0x08f7
+#define regHDMI_TB_ENC_ACR_48_1_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_ACR_STATUS_0                                                                     0x08f8
+#define regHDMI_TB_ENC_ACR_STATUS_0_BASE_IDX                                                            3
+#define regHDMI_TB_ENC_ACR_STATUS_1                                                                     0x08f9
+#define regHDMI_TB_ENC_ACR_STATUS_1_BASE_IDX                                                            3
+#define regHDMI_TB_ENC_BUFFER_CONTROL                                                                   0x08fb
+#define regHDMI_TB_ENC_BUFFER_CONTROL_BASE_IDX                                                          3
+#define regHDMI_TB_ENC_MEM_CTRL                                                                         0x08fe
+#define regHDMI_TB_ENC_MEM_CTRL_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_METADATA_PACKET_CONTROL                                                          0x08ff
+#define regHDMI_TB_ENC_METADATA_PACKET_CONTROL_BASE_IDX                                                 3
+#define regHDMI_TB_ENC_H_ACTIVE_BLANK                                                                   0x0900
+#define regHDMI_TB_ENC_H_ACTIVE_BLANK_BASE_IDX                                                          3
+#define regHDMI_TB_ENC_HC_ACTIVE_BLANK                                                                  0x0901
+#define regHDMI_TB_ENC_HC_ACTIVE_BLANK_BASE_IDX                                                         3
+#define regHDMI_TB_ENC_CRC_CNTL                                                                         0x0903
+#define regHDMI_TB_ENC_CRC_CNTL_BASE_IDX                                                                3
+#define regHDMI_TB_ENC_CRC_RESULT_0                                                                     0x0904
+#define regHDMI_TB_ENC_CRC_RESULT_0_BASE_IDX                                                            3
+#define regHDMI_TB_ENC_ENCRYPTION_CONTROL                                                               0x0907
+#define regHDMI_TB_ENC_ENCRYPTION_CONTROL_BASE_IDX                                                      3
+#define regHDMI_TB_ENC_MODE                                                                             0x0908
+#define regHDMI_TB_ENC_MODE_BASE_IDX                                                                    3
+#define regHDMI_TB_ENC_INPUT_FIFO_STATUS                                                                0x0909
+#define regHDMI_TB_ENC_INPUT_FIFO_STATUS_BASE_IDX                                                       3
+#define regHDMI_TB_ENC_CRC_RESULT_1                                                                     0x090a
+#define regHDMI_TB_ENC_CRC_RESULT_1_BASE_IDX                                                            3
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_dispdec
+// base address: 0x1ab8c
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL                                                   0x3623
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_INPUT_MUX_CONTROL                                               0x3624
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_INPUT_MUX_CONTROL_BASE_IDX                                      2
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL                                                   0x3625
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0                        0x3626
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0_BASE_IDX               2
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1                        0x3627
+#define regDP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1_BASE_IDX               2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_apg_apg_dispdec
+// base address: 0x1abc0
+#define regAPG5_APG_CONTROL                                                                             0x3630
+#define regAPG5_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG5_APG_CONTROL2                                                                            0x3631
+#define regAPG5_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG5_APG_DBG_GEN_CONTROL                                                                     0x3632
+#define regAPG5_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG5_APG_PACKET_CONTROL                                                                      0x3633
+#define regAPG5_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG5_APG_DBG_60958_0                                                                         0x3637
+#define regAPG5_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG5_APG_DBG_60958_1                                                                         0x3638
+#define regAPG5_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG5_APG_DBG_60958_2                                                                         0x3639
+#define regAPG5_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG5_APG_MEM_PWR                                                                             0x3644
+#define regAPG5_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_dme_dme_dispdec
+// base address: 0x1ac38
+#define regDME5_DME_CONTROL                                                                             0x364e
+#define regDME5_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_vpg_vpg_dispdec
+// base address: 0x1ac44
+#define regVPG5_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x3651
+#define regVPG5_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG5_VPG_GENERIC_PACKET_DATA                                                                 0x3652
+#define regVPG5_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG5_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x3653
+#define regVPG5_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x3654
+#define regVPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG5_VPG_GENERIC_STATUS                                                                      0x3655
+#define regVPG5_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG5_VPG_MEM_PWR                                                                             0x3656
+#define regVPG5_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG5_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x3657
+#define regVPG5_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG5_VPG_ISRC1_2_DATA                                                                        0x3658
+#define regVPG5_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc0_dispdec
+// base address: 0x1ac8c
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_CONTROL                                                           0x3663
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_CONTROL_BASE_IDX                                                  2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL                                                  0x3664
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL                                     0x3665
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL_BASE_IDX                            2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL                            0x3666
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL_BASE_IDX                   2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT                                                  0x3667
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA0                                                          0x3668
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA0_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA1                                                          0x3669
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA1_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA2                                                          0x366a
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA2_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA3                                                          0x366b
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA3_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA4                                                          0x366c
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA4_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA5                                                          0x366d
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA5_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA6                                                          0x366e
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA6_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA7                                                          0x366f
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA7_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA8                                                          0x3670
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA8_BASE_IDX                                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL                                                    0x3671
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL_BASE_IDX                                           2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0                                                  0x3672
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1                                                  0x3673
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2                                                  0x3674
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3                                                  0x3675
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4                                                  0x3676
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5                                                  0x3677
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6                                                  0x3678
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7                                                  0x3679
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8                                                  0x367a
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9                                                  0x367b
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10                                                 0x367c
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11                                                 0x367d
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12                                                 0x367e
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13                                                 0x367f
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14                                                 0x3680
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL                                                       0x3681
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL_BASE_IDX                                              2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0                                                0x3682
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0_BASE_IDX                                       2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL                                       0x3684
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL                                                   0x3689
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL                                                  0x368a
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL                                                0x368b
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL                                          0x368c
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                 2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL                                                   0x368d
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_STATUS                                               0x3693
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_STATUS_BASE_IDX                                      2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL                                              0x3694
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL_BASE_IDX                                     2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL                                                0x3695
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL                                                 0x3696
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL_BASE_IDX                                        2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET                                               0x3697
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET_BASE_IDX                                      2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_READY_CONTROL                                                0x3698
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_READY_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL                                        0x3699
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL_BASE_IDX                               2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS                                                       0x369a
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS_BASE_IDX                                              2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_START_CONTROL                                                0x369b
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_START_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL                                       0x369c
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS                                        0x369d
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS_BASE_IDX                               2
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL                                                 0x369e
+#define regDP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL_BASE_IDX                                        2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_dispdec
+// base address: 0x1aef4
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL                                                   0x36fd
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_INPUT_MUX_CONTROL                                               0x36fe
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_INPUT_MUX_CONTROL_BASE_IDX                                      2
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL                                                   0x36ff
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0                        0x3700
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0_BASE_IDX               2
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1                        0x3701
+#define regDP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1_BASE_IDX               2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_apg_apg_dispdec
+// base address: 0x1af28
+#define regAPG6_APG_CONTROL                                                                             0x370a
+#define regAPG6_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG6_APG_CONTROL2                                                                            0x370b
+#define regAPG6_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG6_APG_DBG_GEN_CONTROL                                                                     0x370c
+#define regAPG6_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG6_APG_PACKET_CONTROL                                                                      0x370d
+#define regAPG6_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG6_APG_DBG_60958_0                                                                         0x3711
+#define regAPG6_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG6_APG_DBG_60958_1                                                                         0x3712
+#define regAPG6_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG6_APG_DBG_60958_2                                                                         0x3713
+#define regAPG6_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG6_APG_MEM_PWR                                                                             0x371e
+#define regAPG6_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_dme_dme_dispdec
+// base address: 0x1afa0
+#define regDME6_DME_CONTROL                                                                             0x3728
+#define regDME6_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_vpg_vpg_dispdec
+// base address: 0x1afac
+#define regVPG6_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x372b
+#define regVPG6_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG6_VPG_GENERIC_PACKET_DATA                                                                 0x372c
+#define regVPG6_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG6_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x372d
+#define regVPG6_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x372e
+#define regVPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG6_VPG_GENERIC_STATUS                                                                      0x372f
+#define regVPG6_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG6_VPG_MEM_PWR                                                                             0x3730
+#define regVPG6_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG6_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x3731
+#define regVPG6_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG6_VPG_ISRC1_2_DATA                                                                        0x3732
+#define regVPG6_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc1_dispdec
+// base address: 0x1aff4
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_CONTROL                                                           0x373d
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_CONTROL_BASE_IDX                                                  2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL                                                  0x373e
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL                                     0x373f
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL_BASE_IDX                            2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL                            0x3740
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL_BASE_IDX                   2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT                                                  0x3741
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA0                                                          0x3742
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA0_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA1                                                          0x3743
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA1_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA2                                                          0x3744
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA2_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA3                                                          0x3745
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA3_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA4                                                          0x3746
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA4_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA5                                                          0x3747
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA5_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA6                                                          0x3748
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA6_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA7                                                          0x3749
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA7_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA8                                                          0x374a
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA8_BASE_IDX                                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_HBLANK_CONTROL                                                    0x374b
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_HBLANK_CONTROL_BASE_IDX                                           2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0                                                  0x374c
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1                                                  0x374d
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2                                                  0x374e
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3                                                  0x374f
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4                                                  0x3750
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5                                                  0x3751
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6                                                  0x3752
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7                                                  0x3753
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8                                                  0x3754
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9                                                  0x3755
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10                                                 0x3756
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11                                                 0x3757
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12                                                 0x3758
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13                                                 0x3759
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14                                                 0x375a
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL                                                       0x375b
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL_BASE_IDX                                              2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0                                                0x375c
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0_BASE_IDX                                       2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL                                       0x375e
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL                                                   0x3763
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL                                                  0x3764
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL                                                0x3765
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL                                          0x3766
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                 2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL                                                   0x3767
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_STATUS                                               0x376d
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_STATUS_BASE_IDX                                      2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL                                              0x376e
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL_BASE_IDX                                     2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL                                                0x376f
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL                                                 0x3770
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL_BASE_IDX                                        2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET                                               0x3771
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET_BASE_IDX                                      2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_READY_CONTROL                                                0x3772
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_READY_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL                                        0x3773
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL_BASE_IDX                               2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS                                                       0x3774
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS_BASE_IDX                                              2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_START_CONTROL                                                0x3775
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_START_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL                                       0x3776
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS                                        0x3777
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS_BASE_IDX                               2
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL                                                 0x3778
+#define regDP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL_BASE_IDX                                        2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_dispdec
+// base address: 0x1b25c
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL                                                   0x37d7
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_INPUT_MUX_CONTROL                                               0x37d8
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_INPUT_MUX_CONTROL_BASE_IDX                                      2
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL                                                   0x37d9
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0                        0x37da
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0_BASE_IDX               2
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1                        0x37db
+#define regDP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1_BASE_IDX               2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_apg_apg_dispdec
+// base address: 0x1b290
+#define regAPG7_APG_CONTROL                                                                             0x37e4
+#define regAPG7_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG7_APG_CONTROL2                                                                            0x37e5
+#define regAPG7_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG7_APG_DBG_GEN_CONTROL                                                                     0x37e6
+#define regAPG7_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG7_APG_PACKET_CONTROL                                                                      0x37e7
+#define regAPG7_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG7_APG_DBG_60958_0                                                                         0x37eb
+#define regAPG7_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG7_APG_DBG_60958_1                                                                         0x37ec
+#define regAPG7_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG7_APG_DBG_60958_2                                                                         0x37ed
+#define regAPG7_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG7_APG_MEM_PWR                                                                             0x37f8
+#define regAPG7_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_dme_dme_dispdec
+// base address: 0x1b308
+#define regDME7_DME_CONTROL                                                                             0x3802
+#define regDME7_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_vpg_vpg_dispdec
+// base address: 0x1b314
+#define regVPG7_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x3805
+#define regVPG7_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG7_VPG_GENERIC_PACKET_DATA                                                                 0x3806
+#define regVPG7_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG7_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x3807
+#define regVPG7_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x3808
+#define regVPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG7_VPG_GENERIC_STATUS                                                                      0x3809
+#define regVPG7_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG7_VPG_MEM_PWR                                                                             0x380a
+#define regVPG7_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG7_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x380b
+#define regVPG7_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG7_VPG_ISRC1_2_DATA                                                                        0x380c
+#define regVPG7_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc2_dispdec
+// base address: 0x1b35c
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_CONTROL                                                           0x3817
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_CONTROL_BASE_IDX                                                  2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL                                                  0x3818
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL                                     0x3819
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL_BASE_IDX                            2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL                            0x381a
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL_BASE_IDX                   2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT                                                  0x381b
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA0                                                          0x381c
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA0_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA1                                                          0x381d
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA1_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA2                                                          0x381e
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA2_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA3                                                          0x381f
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA3_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA4                                                          0x3820
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA4_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA5                                                          0x3821
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA5_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA6                                                          0x3822
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA6_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA7                                                          0x3823
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA7_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA8                                                          0x3824
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA8_BASE_IDX                                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_HBLANK_CONTROL                                                    0x3825
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_HBLANK_CONTROL_BASE_IDX                                           2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0                                                  0x3826
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1                                                  0x3827
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2                                                  0x3828
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3                                                  0x3829
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4                                                  0x382a
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5                                                  0x382b
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6                                                  0x382c
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7                                                  0x382d
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8                                                  0x382e
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9                                                  0x382f
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10                                                 0x3830
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11                                                 0x3831
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12                                                 0x3832
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13                                                 0x3833
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14                                                 0x3834
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL                                                       0x3835
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL_BASE_IDX                                              2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0                                                0x3836
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0_BASE_IDX                                       2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL                                       0x3838
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL                                                   0x383d
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL                                                  0x383e
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL                                                0x383f
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL                                          0x3840
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                 2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL                                                   0x3841
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_STATUS                                               0x3847
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_STATUS_BASE_IDX                                      2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL                                              0x3848
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL_BASE_IDX                                     2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL                                                0x3849
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL                                                 0x384a
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL_BASE_IDX                                        2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET                                               0x384b
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET_BASE_IDX                                      2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_READY_CONTROL                                                0x384c
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_READY_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL                                        0x384d
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL_BASE_IDX                               2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS                                                       0x384e
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS_BASE_IDX                                              2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_START_CONTROL                                                0x384f
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_START_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL                                       0x3850
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS                                        0x3851
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS_BASE_IDX                               2
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL                                                 0x3852
+#define regDP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL_BASE_IDX                                        2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_dispdec
+// base address: 0x1b5c4
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL                                                   0x38b1
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_INPUT_MUX_CONTROL                                               0x38b2
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_INPUT_MUX_CONTROL_BASE_IDX                                      2
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL                                                   0x38b3
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL_BASE_IDX                                          2
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0                        0x38b4
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0_BASE_IDX               2
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1                        0x38b5
+#define regDP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1_BASE_IDX               2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_apg_apg_dispdec
+// base address: 0x1b5f8
+#define regAPG8_APG_CONTROL                                                                             0x38be
+#define regAPG8_APG_CONTROL_BASE_IDX                                                                    2
+#define regAPG8_APG_CONTROL2                                                                            0x38bf
+#define regAPG8_APG_CONTROL2_BASE_IDX                                                                   2
+#define regAPG8_APG_DBG_GEN_CONTROL                                                                     0x38c0
+#define regAPG8_APG_DBG_GEN_CONTROL_BASE_IDX                                                            2
+#define regAPG8_APG_PACKET_CONTROL                                                                      0x38c1
+#define regAPG8_APG_PACKET_CONTROL_BASE_IDX                                                             2
+#define regAPG8_APG_DBG_60958_0                                                                         0x38c5
+#define regAPG8_APG_DBG_60958_0_BASE_IDX                                                                2
+#define regAPG8_APG_DBG_60958_1                                                                         0x38c6
+#define regAPG8_APG_DBG_60958_1_BASE_IDX                                                                2
+#define regAPG8_APG_DBG_60958_2                                                                         0x38c7
+#define regAPG8_APG_DBG_60958_2_BASE_IDX                                                                2
+#define regAPG8_APG_MEM_PWR                                                                             0x38d2
+#define regAPG8_APG_MEM_PWR_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_dme_dme_dispdec
+// base address: 0x1b670
+#define regDME8_DME_CONTROL                                                                             0x38dc
+#define regDME8_DME_CONTROL_BASE_IDX                                                                    2
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_vpg_vpg_dispdec
+// base address: 0x1b67c
+#define regVPG8_VPG_GENERIC_PACKET_ACCESS_CTRL                                                          0x38df
+#define regVPG8_VPG_GENERIC_PACKET_ACCESS_CTRL_BASE_IDX                                                 2
+#define regVPG8_VPG_GENERIC_PACKET_DATA                                                                 0x38e0
+#define regVPG8_VPG_GENERIC_PACKET_DATA_BASE_IDX                                                        2
+#define regVPG8_VPG_GSP_FRAME_UPDATE_CTRL                                                               0x38e1
+#define regVPG8_VPG_GSP_FRAME_UPDATE_CTRL_BASE_IDX                                                      2
+#define regVPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL                                                           0x38e2
+#define regVPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL_BASE_IDX                                                  2
+#define regVPG8_VPG_GENERIC_STATUS                                                                      0x38e3
+#define regVPG8_VPG_GENERIC_STATUS_BASE_IDX                                                             2
+#define regVPG8_VPG_MEM_PWR                                                                             0x38e4
+#define regVPG8_VPG_MEM_PWR_BASE_IDX                                                                    2
+#define regVPG8_VPG_ISRC1_2_ACCESS_CTRL                                                                 0x38e5
+#define regVPG8_VPG_ISRC1_2_ACCESS_CTRL_BASE_IDX                                                        2
+#define regVPG8_VPG_ISRC1_2_DATA                                                                        0x38e6
+#define regVPG8_VPG_ISRC1_2_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc3_dispdec
+// base address: 0x1b6c4
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_CONTROL                                                           0x38f1
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_CONTROL_BASE_IDX                                                  2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL                                                  0x38f2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL                                     0x38f3
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL_BASE_IDX                            2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL                            0x38f4
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL_BASE_IDX                   2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT                                                  0x38f5
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA0                                                          0x38f6
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA0_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA1                                                          0x38f7
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA1_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA2                                                          0x38f8
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA2_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA3                                                          0x38f9
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA3_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA4                                                          0x38fa
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA4_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA5                                                          0x38fb
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA5_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA6                                                          0x38fc
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA6_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA7                                                          0x38fd
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA7_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA8                                                          0x38fe
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA8_BASE_IDX                                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_HBLANK_CONTROL                                                    0x38ff
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_HBLANK_CONTROL_BASE_IDX                                           2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0                                                  0x3900
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1                                                  0x3901
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2                                                  0x3902
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3                                                  0x3903
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4                                                  0x3904
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5                                                  0x3905
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6                                                  0x3906
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7                                                  0x3907
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8                                                  0x3908
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9                                                  0x3909
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10                                                 0x390a
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11                                                 0x390b
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12                                                 0x390c
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13                                                 0x390d
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14                                                 0x390e
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL                                                       0x390f
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL_BASE_IDX                                              2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0                                                0x3910
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0_BASE_IDX                                       2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL                                       0x3912
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL                                                   0x3917
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL                                                  0x3918
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL_BASE_IDX                                         2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL                                                0x3919
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL                                          0x391a
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL_BASE_IDX                                 2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL                                                   0x391b
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL_BASE_IDX                                          2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_STATUS                                               0x3921
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_STATUS_BASE_IDX                                      2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL                                              0x3922
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL_BASE_IDX                                     2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL                                                0x3923
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL                                                 0x3924
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL_BASE_IDX                                        2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET                                               0x3925
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET_BASE_IDX                                      2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_READY_CONTROL                                                0x3926
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_READY_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL                                        0x3927
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL_BASE_IDX                               2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS                                                       0x3928
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS_BASE_IDX                                              2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_START_CONTROL                                                0x3929
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_START_CONTROL_BASE_IDX                                       2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL                                       0x392a
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL_BASE_IDX                              2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS                                        0x392b
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS_BASE_IDX                               2
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL                                                 0x392c
+#define regDP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL_BASE_IDX                                        2
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc0_dispdec
+// base address: 0x1ad94
+#define regDP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL                                                       0x36a5
+#define regDP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL_BASE_IDX                                              2
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym320_dispdec
+// base address: 0x1ade8
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL                                                         0x36ba
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL_BASE_IDX                                                2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_STATUS                                                          0x36bb
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_STATUS_BASE_IDX                                                 2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_UPDATE                                                      0x36be
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_UPDATE_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0                                                   0x36bf
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1                                                   0x36c0
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2                                                   0x36c1
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3                                                   0x36c2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0                                                         0x36c5
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0_BASE_IDX                                                2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1                                                         0x36c6
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1_BASE_IDX                                                2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2                                                         0x36c7
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2_BASE_IDX                                                2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3                                                         0x36c8
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3_BASE_IDX                                                2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0                                                  0x36cb
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0_BASE_IDX                                         2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1                                                  0x36cc
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1_BASE_IDX                                         2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2                                                  0x36cd
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2_BASE_IDX                                         2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3                                                  0x36ce
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3_BASE_IDX                                         2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0                                                     0x36d1
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0_BASE_IDX                                            2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR0                                                       0x36d2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR0_BASE_IDX                                              2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR1                                                       0x36d3
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR1_BASE_IDX                                              2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR2                                                       0x36d4
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR2_BASE_IDX                                              2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR3                                                       0x36d5
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR3_BASE_IDX                                              2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0                                              0x36d6
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0_BASE_IDX                                     2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0                                               0x36d7
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0_BASE_IDX                                      2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL                                                    0x36d9
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL_BASE_IDX                                           2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG                                                       0x36da
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG_BASE_IDX                                              2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED0                                                   0x36db
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED0_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED1                                                   0x36dc
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED1_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED2                                                   0x36dd
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED2_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED3                                                   0x36de
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED3_BASE_IDX                                          2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_SQ_PULSE                                                     0x36df
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_SQ_PULSE_BASE_IDX                                            2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM0                                                      0x36e0
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM0_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM1                                                      0x36e1
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM1_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM2                                                      0x36e2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM2_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM3                                                      0x36e3
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM3_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM4                                                      0x36e4
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM4_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM5                                                      0x36e5
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM5_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM6                                                      0x36e6
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM6_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM7                                                      0x36e7
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM7_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM8                                                      0x36e8
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM8_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM9                                                      0x36e9
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM9_BASE_IDX                                             2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM10                                                     0x36ea
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM10_BASE_IDX                                            2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0                                            0x36ee
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0_BASE_IDX                                   2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1                                            0x36ef
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1_BASE_IDX                                   2
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL                                            0x36f0
+#define regDP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL_BASE_IDX                                   2
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc1_dispdec
+// base address: 0x1b0fc
+#define regDP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL                                                       0x377f
+#define regDP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL_BASE_IDX                                              2
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym321_dispdec
+// base address: 0x1b150
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL                                                         0x3794
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL_BASE_IDX                                                2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_STATUS                                                          0x3795
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_STATUS_BASE_IDX                                                 2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_UPDATE                                                      0x3798
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_UPDATE_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0                                                   0x3799
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1                                                   0x379a
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2                                                   0x379b
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3                                                   0x379c
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0                                                         0x379f
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0_BASE_IDX                                                2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1                                                         0x37a0
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1_BASE_IDX                                                2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2                                                         0x37a1
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2_BASE_IDX                                                2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3                                                         0x37a2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3_BASE_IDX                                                2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0                                                  0x37a5
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0_BASE_IDX                                         2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1                                                  0x37a6
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1_BASE_IDX                                         2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2                                                  0x37a7
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2_BASE_IDX                                         2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3                                                  0x37a8
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3_BASE_IDX                                         2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0                                                     0x37ab
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0_BASE_IDX                                            2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR0                                                       0x37ac
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR0_BASE_IDX                                              2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR1                                                       0x37ad
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR1_BASE_IDX                                              2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR2                                                       0x37ae
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR2_BASE_IDX                                              2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR3                                                       0x37af
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR3_BASE_IDX                                              2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0                                              0x37b0
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0_BASE_IDX                                     2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0                                               0x37b1
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0_BASE_IDX                                      2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL                                                    0x37b3
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL_BASE_IDX                                           2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG                                                       0x37b4
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG_BASE_IDX                                              2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED0                                                   0x37b5
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED0_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED1                                                   0x37b6
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED1_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED2                                                   0x37b7
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED2_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED3                                                   0x37b8
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED3_BASE_IDX                                          2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_SQ_PULSE                                                     0x37b9
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_SQ_PULSE_BASE_IDX                                            2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM0                                                      0x37ba
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM0_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM1                                                      0x37bb
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM1_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM2                                                      0x37bc
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM2_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM3                                                      0x37bd
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM3_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM4                                                      0x37be
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM4_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM5                                                      0x37bf
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM5_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM6                                                      0x37c0
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM6_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM7                                                      0x37c1
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM7_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM8                                                      0x37c2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM8_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM9                                                      0x37c3
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM9_BASE_IDX                                             2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM10                                                     0x37c4
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM10_BASE_IDX                                            2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0                                            0x37c8
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0_BASE_IDX                                   2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1                                            0x37c9
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1_BASE_IDX                                   2
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL                                            0x37ca
+#define regDP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL_BASE_IDX                                   2
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc2_dispdec
+// base address: 0x1b464
+#define regDP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL                                                       0x3859
+#define regDP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL_BASE_IDX                                              2
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym322_dispdec
+// base address: 0x1b4b8
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL                                                         0x386e
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL_BASE_IDX                                                2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_STATUS                                                          0x386f
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_STATUS_BASE_IDX                                                 2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_UPDATE                                                      0x3872
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_UPDATE_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0                                                   0x3873
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1                                                   0x3874
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2                                                   0x3875
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3                                                   0x3876
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0                                                         0x3879
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0_BASE_IDX                                                2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1                                                         0x387a
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1_BASE_IDX                                                2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2                                                         0x387b
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2_BASE_IDX                                                2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3                                                         0x387c
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3_BASE_IDX                                                2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0                                                  0x387f
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0_BASE_IDX                                         2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1                                                  0x3880
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1_BASE_IDX                                         2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2                                                  0x3881
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2_BASE_IDX                                         2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3                                                  0x3882
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3_BASE_IDX                                         2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0                                                     0x3885
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0_BASE_IDX                                            2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR0                                                       0x3886
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR0_BASE_IDX                                              2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR1                                                       0x3887
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR1_BASE_IDX                                              2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR2                                                       0x3888
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR2_BASE_IDX                                              2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR3                                                       0x3889
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR3_BASE_IDX                                              2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0                                              0x388a
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0_BASE_IDX                                     2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0                                               0x388b
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0_BASE_IDX                                      2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL                                                    0x388d
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL_BASE_IDX                                           2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG                                                       0x388e
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG_BASE_IDX                                              2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED0                                                   0x388f
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED0_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED1                                                   0x3890
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED1_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED2                                                   0x3891
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED2_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED3                                                   0x3892
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED3_BASE_IDX                                          2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_SQ_PULSE                                                     0x3893
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_SQ_PULSE_BASE_IDX                                            2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM0                                                      0x3894
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM0_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM1                                                      0x3895
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM1_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM2                                                      0x3896
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM2_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM3                                                      0x3897
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM3_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM4                                                      0x3898
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM4_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM5                                                      0x3899
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM5_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM6                                                      0x389a
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM6_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM7                                                      0x389b
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM7_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM8                                                      0x389c
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM8_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM9                                                      0x389d
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM9_BASE_IDX                                             2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM10                                                     0x389e
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM10_BASE_IDX                                            2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0                                            0x38a2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0_BASE_IDX                                   2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1                                            0x38a3
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1_BASE_IDX                                   2
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL                                            0x38a4
+#define regDP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL_BASE_IDX                                   2
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc3_dispdec
+// base address: 0x1b7cc
+#define regDP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL                                                       0x3933
+#define regDP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL_BASE_IDX                                              2
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym323_dispdec
+// base address: 0x1b820
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL                                                         0x3948
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL_BASE_IDX                                                2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_STATUS                                                          0x3949
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_STATUS_BASE_IDX                                                 2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_UPDATE                                                      0x394c
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_UPDATE_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0                                                   0x394d
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1                                                   0x394e
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2                                                   0x394f
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3                                                   0x3950
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0                                                         0x3953
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0_BASE_IDX                                                2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1                                                         0x3954
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1_BASE_IDX                                                2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2                                                         0x3955
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2_BASE_IDX                                                2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3                                                         0x3956
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3_BASE_IDX                                                2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0                                                  0x3959
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0_BASE_IDX                                         2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1                                                  0x395a
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1_BASE_IDX                                         2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2                                                  0x395b
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2_BASE_IDX                                         2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3                                                  0x395c
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3_BASE_IDX                                         2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0                                                     0x395f
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0_BASE_IDX                                            2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR0                                                       0x3960
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR0_BASE_IDX                                              2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR1                                                       0x3961
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR1_BASE_IDX                                              2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR2                                                       0x3962
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR2_BASE_IDX                                              2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR3                                                       0x3963
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR3_BASE_IDX                                              2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0                                              0x3964
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0_BASE_IDX                                     2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0                                               0x3965
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0_BASE_IDX                                      2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL                                                    0x3967
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL_BASE_IDX                                           2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG                                                       0x3968
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG_BASE_IDX                                              2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED0                                                   0x3969
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED0_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED1                                                   0x396a
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED1_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED2                                                   0x396b
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED2_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED3                                                   0x396c
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED3_BASE_IDX                                          2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_SQ_PULSE                                                     0x396d
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_SQ_PULSE_BASE_IDX                                            2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM0                                                      0x396e
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM0_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM1                                                      0x396f
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM1_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM2                                                      0x3970
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM2_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM3                                                      0x3971
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM3_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM4                                                      0x3972
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM4_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM5                                                      0x3973
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM5_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM6                                                      0x3974
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM6_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM7                                                      0x3975
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM7_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM8                                                      0x3976
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM8_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM9                                                      0x3977
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM9_BASE_IDX                                             2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM10                                                     0x3978
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM10_BASE_IDX                                            2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0                                            0x397c
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0_BASE_IDX                                   2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1                                            0x397d
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1_BASE_IDX                                   2
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL                                            0x397e
+#define regDP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL_BASE_IDX                                   2
+
+
+// addressBlock: dce_dc_dchvm_hvm_dispdec
+// base address: 0x0
+#define regDCHVM_CTRL0                                                                                  0x17cb
+#define regDCHVM_CTRL0_BASE_IDX                                                                         2
+#define regDCHVM_CTRL1                                                                                  0x17cc
+#define regDCHVM_CTRL1_BASE_IDX                                                                         2
+#define regDCHVM_CLK_CTRL                                                                               0x17cd
+#define regDCHVM_CLK_CTRL_BASE_IDX                                                                      2
+#define regDCHVM_MEM_CTRL                                                                               0x17ce
+#define regDCHVM_MEM_CTRL_BASE_IDX                                                                      2
+#define regDCHVM_RIOMMU_CTRL0                                                                           0x17cf
+#define regDCHVM_RIOMMU_CTRL0_BASE_IDX                                                                  2
+#define regDCHVM_RIOMMU_STAT0                                                                           0x17d0
+#define regDCHVM_RIOMMU_STAT0_BASE_IDX                                                                  2
+#define regDCHVM_PREFETCH_VFID                                                                          0x17d5
+#define regDCHVM_PREFETCH_VFID_BASE_IDX                                                                 2
+#define regDCHVM_VMID0_CTRL                                                                             0x17d6
+#define regDCHVM_VMID0_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID1_CTRL                                                                             0x17d7
+#define regDCHVM_VMID1_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID2_CTRL                                                                             0x17d8
+#define regDCHVM_VMID2_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID3_CTRL                                                                             0x17d9
+#define regDCHVM_VMID3_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID4_CTRL                                                                             0x17da
+#define regDCHVM_VMID4_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID5_CTRL                                                                             0x17db
+#define regDCHVM_VMID5_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID6_CTRL                                                                             0x17dc
+#define regDCHVM_VMID6_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID7_CTRL                                                                             0x17dd
+#define regDCHVM_VMID7_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID8_CTRL                                                                             0x17de
+#define regDCHVM_VMID8_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID9_CTRL                                                                             0x17df
+#define regDCHVM_VMID9_CTRL_BASE_IDX                                                                    2
+#define regDCHVM_VMID10_CTRL                                                                            0x17e0
+#define regDCHVM_VMID10_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_VMID11_CTRL                                                                            0x17e1
+#define regDCHVM_VMID11_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_VMID12_CTRL                                                                            0x17e2
+#define regDCHVM_VMID12_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_VMID13_CTRL                                                                            0x17e3
+#define regDCHVM_VMID13_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_VMID14_CTRL                                                                            0x17e4
+#define regDCHVM_VMID14_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_VMID15_CTRL                                                                            0x17e5
+#define regDCHVM_VMID15_CTRL_BASE_IDX                                                                   2
+#define regDCHVM_FFBM_ACCESS_CNTL                                                                       0x17e6
+#define regDCHVM_FFBM_ACCESS_CNTL_BASE_IDX                                                              2
+#define regDCHVM_FFBM_ADDRESS_HI                                                                        0x17e7
+#define regDCHVM_FFBM_ADDRESS_HI_BASE_IDX                                                               2
+#define regDCHVM_FFBM_ADDRESS_LO                                                                        0x17e8
+#define regDCHVM_FFBM_ADDRESS_LO_BASE_IDX                                                               2
+#define regDCHVM_FFBM_CONFIG                                                                            0x17e9
+#define regDCHVM_FFBM_CONFIG_BASE_IDX                                                                   2
+#define regDCHVM_FFBM_ENABLE_CNTL                                                                       0x17ea
+#define regDCHVM_FFBM_ENABLE_CNTL_BASE_IDX                                                              2
+#define regDCHVM_FFBM_DATA_HI                                                                           0x17eb
+#define regDCHVM_FFBM_DATA_HI_BASE_IDX                                                                  2
+#define regDCHVM_FFBM_DATA_LO                                                                           0x17ec
+#define regDCHVM_FFBM_DATA_LO_BASE_IDX                                                                  2
+#define regDCHVM_FFBM_INVALIDATE_REQ                                                                    0x17ed
+#define regDCHVM_FFBM_INVALIDATE_REQ_BASE_IDX                                                           2
+#define regDCHVM_FFBM_INVALIDATE_RSP                                                                    0x17ee
+#define regDCHVM_FFBM_INVALIDATE_RSP_BASE_IDX                                                           2
+#define regDCHVM_VM_FB_OFFSET                                                                           0x17ef
+#define regDCHVM_VM_FB_OFFSET_BASE_IDX                                                                  2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL                                                             0x17f0
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL                                                             0x17f1
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL                                                             0x17f2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL                                                             0x17f3
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL                                                             0x17f4
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL                                                             0x17f5
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL                                                             0x17f6
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL                                                             0x17f7
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL                                                             0x17f8
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL                                                             0x17f9
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL_BASE_IDX                                                    2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL                                                            0x17fa
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL                                                            0x17fb
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL                                                            0x17fc
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL                                                            0x17fd
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL                                                            0x17fe
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL                                                            0x17ff
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL                                                            0x1800
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL                                                            0x1801
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL                                                            0x1802
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL                                                            0x1803
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL                                                            0x1804
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL                                                            0x1805
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL                                                            0x1806
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL                                                            0x1807
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL                                                            0x1808
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL                                                            0x1809
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL                                                            0x180a
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL                                                            0x180b
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL                                                            0x180c
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL                                                            0x180d
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL_BASE_IDX                                                   2
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL                                                            0x180e
+#define regDCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL_BASE_IDX                                                   2
+#define regDCHVM_FFBM_DEBUG_CNTL                                                                        0x180f
+#define regDCHVM_FFBM_DEBUG_CNTL_BASE_IDX                                                               2
+#define regDCHVM_FFBM_TLB_DEBUG_DATA                                                                    0x1810
+#define regDCHVM_FFBM_TLB_DEBUG_DATA_BASE_IDX                                                           2
+#define regDCHVM_DEBUG_CTRL0                                                                            0x1811
+#define regDCHVM_DEBUG_CTRL0_BASE_IDX                                                                   2
+#define regDCHVM_TEST_DEBUG_INDEX                                                                       0x1812
+#define regDCHVM_TEST_DEBUG_INDEX_BASE_IDX                                                              2
+#define regDCHVM_TEST_DEBUG_DATA                                                                        0x1813
+#define regDCHVM_TEST_DEBUG_DATA_BASE_IDX                                                               2
+
+
+// addressBlock: azendpoint_f2codecind
+// base address: 0x0
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                                           0x2200
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                                          0x2706
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                                          0x270d
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_2                                        0x270e
+#define ixAZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL                                                     0x2724
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_3                                        0x273e
+#define ixAZALIA_F2_CODEC_CONVERTER_CONTROL_RAMP_RATE                                                  0x2770
+#define ixAZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                                0x2f09
+#define ixAZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                                     0x2f0a
+#define ixAZALIA_F2_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                                           0x2f0b
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONNECTION_LIST_ENTRY                                   0x3702
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_WIDGET_CONTROL                                                   0x3707
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                                             0x3708
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                               0x3709
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                                   0x371c
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2                                 0x371d
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3                                 0x371e
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4                                 0x371f
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION                                      0x3770
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_CHANNEL_ALLOCATION                                               0x3771
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO                                                    0x3772
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX                                                        0x3774
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_ACP_DATA                                                         0x3775
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR                                                 0x3776
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR_DATA                                            0x3776
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE                                            0x3777
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE                                            0x3778
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE                                            0x3779
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE                                            0x377a
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC                                                          0x377b
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_HBR                                                              0x377c
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_INDEX                                            0x3780
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_DATA                                             0x3781
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE                                             0x3785
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE                                             0x3786
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE                                             0x3787
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE                                             0x3788
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                                0x3789
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                                    0x378a
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                                    0x378b
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                                    0x378c
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                                    0x378d
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                                    0x378e
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                                    0x378f
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                                    0x3790
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                                    0x3791
+#define ixAZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                                    0x3792
+#define ixAZALIA_F2_CODEC_PIN_ASSOCIATION_INFO                                                         0x3793
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                                            0x3797
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                                            0x3798
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_LPIB                                                             0x3799
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                              0x379a
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_CODING_TYPE                                                      0x379b
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED                                                   0x379c
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                                  0x379d
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                                 0x379e
+#define ixAZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                                      0x3f09
+#define ixAZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES                                                   0x3f0c
+#define ixAZALIA_F2_CODEC_PIN_PARAMETER_CONNECTION_LIST_LENGTH                                         0x3f0e
+
+
+// addressBlock: azendpoint_descriptorind
+// base address: 0x0
+#define ixAUDIO_DESCRIPTOR0                                                                            0x0001
+#define ixAUDIO_DESCRIPTOR1                                                                            0x0002
+#define ixAUDIO_DESCRIPTOR2                                                                            0x0003
+#define ixAUDIO_DESCRIPTOR3                                                                            0x0004
+#define ixAUDIO_DESCRIPTOR4                                                                            0x0005
+#define ixAUDIO_DESCRIPTOR5                                                                            0x0006
+#define ixAUDIO_DESCRIPTOR6                                                                            0x0007
+#define ixAUDIO_DESCRIPTOR7                                                                            0x0008
+#define ixAUDIO_DESCRIPTOR8                                                                            0x0009
+#define ixAUDIO_DESCRIPTOR9                                                                            0x000a
+#define ixAUDIO_DESCRIPTOR10                                                                           0x000b
+#define ixAUDIO_DESCRIPTOR11                                                                           0x000c
+#define ixAUDIO_DESCRIPTOR12                                                                           0x000d
+#define ixAUDIO_DESCRIPTOR13                                                                           0x000e
+
+
+// addressBlock: azendpoint_sinkinfoind
+// base address: 0x0
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_MANUFACTURER_ID                                                  0x0000
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_PRODUCT_ID                                                       0x0001
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_SINK_DESCRIPTION_LEN                                             0x0002
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_PORTID0                                                          0x0003
+#define ixAZALIA_F2_CODEC_PIN_CONTROL_PORTID1                                                          0x0004
+#define ixSINK_DESCRIPTION0                                                                            0x0005
+#define ixSINK_DESCRIPTION1                                                                            0x0006
+#define ixSINK_DESCRIPTION2                                                                            0x0007
+#define ixSINK_DESCRIPTION3                                                                            0x0008
+#define ixSINK_DESCRIPTION4                                                                            0x0009
+#define ixSINK_DESCRIPTION5                                                                            0x000a
+#define ixSINK_DESCRIPTION6                                                                            0x000b
+#define ixSINK_DESCRIPTION7                                                                            0x000c
+#define ixSINK_DESCRIPTION8                                                                            0x000d
+#define ixSINK_DESCRIPTION9                                                                            0x000e
+#define ixSINK_DESCRIPTION10                                                                           0x000f
+#define ixSINK_DESCRIPTION11                                                                           0x0010
+#define ixSINK_DESCRIPTION12                                                                           0x0011
+#define ixSINK_DESCRIPTION13                                                                           0x0012
+#define ixSINK_DESCRIPTION14                                                                           0x0013
+#define ixSINK_DESCRIPTION15                                                                           0x0014
+#define ixSINK_DESCRIPTION16                                                                           0x0015
+#define ixSINK_DESCRIPTION17                                                                           0x0016
+
+
+// addressBlock: azroot_f2codecind
+// base address: 0x0
+#define ixAZALIA_F2_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID                                          0x0f00
+#define ixAZALIA_F2_CODEC_ROOT_PARAMETER_REVISION_ID                                                   0x0f02
+#define ixAZALIA_F2_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT                                        0x0f04
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE                                                 0x1705
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID                                       0x1720
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_2                                     0x1721
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_3                                     0x1722
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_4                                     0x1723
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION                                   0x1770
+#define ixAZALIA_F2_CODEC_FUNCTION_CONTROL_RESET                                                       0x17ff
+#define ixAZALIA_F2_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT                                    0x1f04
+#define ixAZALIA_F2_CODEC_FUNCTION_PARAMETER_GROUP_TYPE                                                0x1f05
+#define ixAZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES                                      0x1f0a
+#define ixAZALIA_F2_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS                                            0x1f0b
+#define ixAZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES                                              0x1f0f
+
+
+// addressBlock: azf0stream0_streamind
+// base address: 0x0
+#define ixAZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM0_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM0_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM0_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM0_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM0_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream1_streamind
+// base address: 0x0
+#define ixAZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM1_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM1_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM1_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM1_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM1_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream2_streamind
+// base address: 0x0
+#define ixAZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM2_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM2_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM2_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM2_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM2_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream3_streamind
+// base address: 0x0
+#define ixAZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM3_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM3_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM3_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM3_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM3_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream4_streamind
+// base address: 0x0
+#define ixAZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM4_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM4_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM4_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM4_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM4_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream5_streamind
+// base address: 0x0
+#define ixAZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM5_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM5_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM5_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM5_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM5_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream6_streamind
+// base address: 0x0
+#define ixAZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM6_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM6_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM6_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM6_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM6_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream7_streamind
+// base address: 0x0
+#define ixAZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM7_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM7_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM7_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM7_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM7_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream8_streamind
+// base address: 0x0
+#define ixAZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM8_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM8_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM8_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM8_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM8_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream9_streamind
+// base address: 0x0
+#define ixAZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL                                                         0x0000
+#define ixAZF0STREAM9_AZALIA_LATENCY_COUNTER_CONTROL                                                   0x0001
+#define ixAZF0STREAM9_AZALIA_WORSTCASE_LATENCY_COUNT                                                   0x0002
+#define ixAZF0STREAM9_AZALIA_CUMULATIVE_LATENCY_COUNT                                                  0x0003
+#define ixAZF0STREAM9_AZALIA_CUMULATIVE_REQUEST_COUNT                                                  0x0004
+#define ixAZF0STREAM9_AZALIA_STREAM_DEBUG                                                              0x0005
+
+
+// addressBlock: azf0stream10_streamind
+// base address: 0x0
+#define ixAZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM10_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM10_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM10_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM10_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM10_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0stream11_streamind
+// base address: 0x0
+#define ixAZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM11_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM11_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM11_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM11_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM11_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0stream12_streamind
+// base address: 0x0
+#define ixAZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM12_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM12_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM12_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM12_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM12_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0stream13_streamind
+// base address: 0x0
+#define ixAZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM13_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM13_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM13_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM13_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM13_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0stream14_streamind
+// base address: 0x0
+#define ixAZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM14_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM14_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM14_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM14_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM14_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0stream15_streamind
+// base address: 0x0
+#define ixAZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL                                                        0x0000
+#define ixAZF0STREAM15_AZALIA_LATENCY_COUNTER_CONTROL                                                  0x0001
+#define ixAZF0STREAM15_AZALIA_WORSTCASE_LATENCY_COUNT                                                  0x0002
+#define ixAZF0STREAM15_AZALIA_CUMULATIVE_LATENCY_COUNT                                                 0x0003
+#define ixAZF0STREAM15_AZALIA_CUMULATIVE_REQUEST_COUNT                                                 0x0004
+#define ixAZF0STREAM15_AZALIA_STREAM_DEBUG                                                             0x0005
+
+
+// addressBlock: azf0endpoint0_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT0_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint1_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT1_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint2_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT2_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint3_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT3_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint4_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT4_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint5_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT5_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint6_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT6_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+// addressBlock: azf0endpoint7_endpointind
+// base address: 0x0
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG                                            0x0000
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES                  0x0001
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT                             0x0002
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID                            0x0003
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER                            0x0004
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS                             0x0005
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES                       0x0006
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL                                       0x0007
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE                                    0x0008
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES                        0x0020
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES                                     0x0021
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE                               0x0022
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE                                 0x0023
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL                                     0x0024
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER                                    0x0025
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA                                           0x0027
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0                                  0x0028
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1                                  0x0029
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2                                  0x002a
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3                                  0x002b
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4                                  0x002c
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5                                  0x002d
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6                                  0x002e
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7                                  0x002f
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8                                  0x0030
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9                                  0x0031
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10                                 0x0032
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11                                 0x0033
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12                                 0x0034
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13                                 0x0035
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE                                0x0036
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC                                   0x0037
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR                                       0x0038
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0                                         0x003a
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1                                         0x003b
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2                                         0x003c
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3                                         0x003d
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4                                         0x003e
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5                                         0x003f
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6                                         0x0040
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7                                         0x0041
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8                                         0x0042
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL                                   0x0054
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE                         0x0055
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT                     0x0056
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2                               0x0057
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE                                  0x0058
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0                                      0x0059
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1                                      0x005a
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2                                      0x005b
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3                                      0x005c
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4                                      0x005d
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5                                      0x005e
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6                                      0x005f
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7                                      0x0060
+#define ixAZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8                                      0x0061
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO                                           0x0062
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS                              0x0063
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL                              0x0064
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB                                               0x0065
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT                                0x0066
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE                                        0x0067
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED                                     0x0068
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION                    0x0069
+#define ixAZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE                                   0x006a
+#define ixAZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLE_STATUS                                                  0x006b
+#define ixAZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS                                             0x006c
+#define ixAZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS                                            0x006d
+#define ixAZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS                                      0x006e
+#define ixAZF0ENDPOINT7_AZALIA_F0_ENDPOINT_FGCG_REP_DIS                                                0x0070
+
+
+#endif
diff --git a/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_sh_mask.h
new file mode 100644
index 00000000000000..bf5d825e7ef5b3
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/dcn/dcn_6_0_0_sh_mask.h
@@ -0,0 +1,58556 @@
+// SPDX-License-Identifier: MIT
+//
+// Copyright 2026 Advanced Micro Devices, Inc.
+
+#ifndef _dcn_6_0_0_SH_MASK_HEADER
+#define _dcn_6_0_0_SH_MASK_HEADER
+
+
+// addressBlock: dce_dc_hda_azcontroller_azdec
+//GLOBAL_CAPABILITIES
+#define GLOBAL_CAPABILITIES__SIXTY_FOUR_BIT_ADDRESS_SUPPORTED__SHIFT                                          0x0
+#define GLOBAL_CAPABILITIES__NUMBER_OF_SERIAL_DATA_OUTPUT_SIGNALS__SHIFT                                      0x1
+#define GLOBAL_CAPABILITIES__NUMBER_OF_BIDIRECTIONAL_STREAMS_SUPPORTED__SHIFT                                 0x3
+#define GLOBAL_CAPABILITIES__NUMBER_OF_INPUT_STREAMS_SUPPORTED__SHIFT                                         0x8
+#define GLOBAL_CAPABILITIES__NUMBER_OF_OUTPUT_STREAMS_SUPPORTED__SHIFT                                        0xc
+#define GLOBAL_CAPABILITIES__SIXTY_FOUR_BIT_ADDRESS_SUPPORTED_MASK                                            0x0001L
+#define GLOBAL_CAPABILITIES__NUMBER_OF_SERIAL_DATA_OUTPUT_SIGNALS_MASK                                        0x0006L
+#define GLOBAL_CAPABILITIES__NUMBER_OF_BIDIRECTIONAL_STREAMS_SUPPORTED_MASK                                   0x00F8L
+#define GLOBAL_CAPABILITIES__NUMBER_OF_INPUT_STREAMS_SUPPORTED_MASK                                           0x0F00L
+#define GLOBAL_CAPABILITIES__NUMBER_OF_OUTPUT_STREAMS_SUPPORTED_MASK                                          0xF000L
+//MINOR_VERSION
+#define MINOR_VERSION__MINOR_VERSION__SHIFT                                                                   0x0
+#define MINOR_VERSION__MINOR_VERSION_MASK                                                                     0xFFL
+//MAJOR_VERSION
+#define MAJOR_VERSION__MAJOR_VERSION__SHIFT                                                                   0x0
+#define MAJOR_VERSION__MAJOR_VERSION_MASK                                                                     0xFFL
+//OUTPUT_PAYLOAD_CAPABILITY
+#define OUTPUT_PAYLOAD_CAPABILITY__OUTPUT_PAYLOAD_CAPABILITY__SHIFT                                           0x0
+#define OUTPUT_PAYLOAD_CAPABILITY__OUTPUT_PAYLOAD_CAPABILITY_MASK                                             0xFFFFL
+//INPUT_PAYLOAD_CAPABILITY
+#define INPUT_PAYLOAD_CAPABILITY__INPUT_PAYLOAD_CAPABILITY__SHIFT                                             0x0
+#define INPUT_PAYLOAD_CAPABILITY__INPUT_PAYLOAD_CAPABILITY_MASK                                               0xFFFFL
+//GLOBAL_CONTROL
+#define GLOBAL_CONTROL__CONTROLLER_RESET__SHIFT                                                               0x0
+#define GLOBAL_CONTROL__FLUSH_CONTROL__SHIFT                                                                  0x1
+#define GLOBAL_CONTROL__ACCEPT_UNSOLICITED_RESPONSE_ENABLE__SHIFT                                             0x8
+#define GLOBAL_CONTROL__CONTROLLER_RESET_MASK                                                                 0x00000001L
+#define GLOBAL_CONTROL__FLUSH_CONTROL_MASK                                                                    0x00000002L
+#define GLOBAL_CONTROL__ACCEPT_UNSOLICITED_RESPONSE_ENABLE_MASK                                               0x00000100L
+//WAKE_ENABLE
+#define WAKE_ENABLE__SDIN_WAKE_ENABLE_FLAG__SHIFT                                                             0x0
+#define WAKE_ENABLE__SDIN_WAKE_ENABLE_FLAG_MASK                                                               0x0001L
+//STATE_CHANGE_STATUS
+#define STATE_CHANGE_STATUS__STATE_CHANGE_STATUS__SHIFT                                                       0x0
+#define STATE_CHANGE_STATUS__STATE_CHANGE_STATUS_MASK                                                         0x0001L
+//GLOBAL_STATUS
+#define GLOBAL_STATUS__FLUSH_STATUS__SHIFT                                                                    0x1
+#define GLOBAL_STATUS__FLUSH_STATUS_MASK                                                                      0x00000002L
+//OUTPUT_STREAM_PAYLOAD_CAPABILITY
+#define OUTPUT_STREAM_PAYLOAD_CAPABILITY__OUTSTRMPAY__SHIFT                                                   0x0
+#define OUTPUT_STREAM_PAYLOAD_CAPABILITY__OUTSTRMPAY_MASK                                                     0xFFFFL
+//INPUT_STREAM_PAYLOAD_CAPABILITY
+#define INPUT_STREAM_PAYLOAD_CAPABILITY__INSTRMPAY__SHIFT                                                     0x0
+#define INPUT_STREAM_PAYLOAD_CAPABILITY__INSTRMPAY_MASK                                                       0xFFFFL
+//INTERRUPT_CONTROL
+#define INTERRUPT_CONTROL__STREAM_0_INTERRUPT_ENABLE__SHIFT                                                   0x0
+#define INTERRUPT_CONTROL__STREAM_1_INTERRUPT_ENABLE__SHIFT                                                   0x1
+#define INTERRUPT_CONTROL__STREAM_2_INTERRUPT_ENABLE__SHIFT                                                   0x2
+#define INTERRUPT_CONTROL__STREAM_3_INTERRUPT_ENABLE__SHIFT                                                   0x3
+#define INTERRUPT_CONTROL__STREAM_4_INTERRUPT_ENABLE__SHIFT                                                   0x4
+#define INTERRUPT_CONTROL__STREAM_5_INTERRUPT_ENABLE__SHIFT                                                   0x5
+#define INTERRUPT_CONTROL__STREAM_6_INTERRUPT_ENABLE__SHIFT                                                   0x6
+#define INTERRUPT_CONTROL__STREAM_7_INTERRUPT_ENABLE__SHIFT                                                   0x7
+#define INTERRUPT_CONTROL__STREAM_8_INTERRUPT_ENABLE__SHIFT                                                   0x8
+#define INTERRUPT_CONTROL__STREAM_9_INTERRUPT_ENABLE__SHIFT                                                   0x9
+#define INTERRUPT_CONTROL__STREAM_10_INTERRUPT_ENABLE__SHIFT                                                  0xa
+#define INTERRUPT_CONTROL__STREAM_11_INTERRUPT_ENABLE__SHIFT                                                  0xb
+#define INTERRUPT_CONTROL__STREAM_12_INTERRUPT_ENABLE__SHIFT                                                  0xc
+#define INTERRUPT_CONTROL__STREAM_13_INTERRUPT_ENABLE__SHIFT                                                  0xd
+#define INTERRUPT_CONTROL__STREAM_14_INTERRUPT_ENABLE__SHIFT                                                  0xe
+#define INTERRUPT_CONTROL__STREAM_15_INTERRUPT_ENABLE__SHIFT                                                  0xf
+#define INTERRUPT_CONTROL__CONTROLLER_INTERRUPT_ENABLE__SHIFT                                                 0x1e
+#define INTERRUPT_CONTROL__GLOBAL_INTERRUPT_ENABLE__SHIFT                                                     0x1f
+#define INTERRUPT_CONTROL__STREAM_0_INTERRUPT_ENABLE_MASK                                                     0x00000001L
+#define INTERRUPT_CONTROL__STREAM_1_INTERRUPT_ENABLE_MASK                                                     0x00000002L
+#define INTERRUPT_CONTROL__STREAM_2_INTERRUPT_ENABLE_MASK                                                     0x00000004L
+#define INTERRUPT_CONTROL__STREAM_3_INTERRUPT_ENABLE_MASK                                                     0x00000008L
+#define INTERRUPT_CONTROL__STREAM_4_INTERRUPT_ENABLE_MASK                                                     0x00000010L
+#define INTERRUPT_CONTROL__STREAM_5_INTERRUPT_ENABLE_MASK                                                     0x00000020L
+#define INTERRUPT_CONTROL__STREAM_6_INTERRUPT_ENABLE_MASK                                                     0x00000040L
+#define INTERRUPT_CONTROL__STREAM_7_INTERRUPT_ENABLE_MASK                                                     0x00000080L
+#define INTERRUPT_CONTROL__STREAM_8_INTERRUPT_ENABLE_MASK                                                     0x00000100L
+#define INTERRUPT_CONTROL__STREAM_9_INTERRUPT_ENABLE_MASK                                                     0x00000200L
+#define INTERRUPT_CONTROL__STREAM_10_INTERRUPT_ENABLE_MASK                                                    0x00000400L
+#define INTERRUPT_CONTROL__STREAM_11_INTERRUPT_ENABLE_MASK                                                    0x00000800L
+#define INTERRUPT_CONTROL__STREAM_12_INTERRUPT_ENABLE_MASK                                                    0x00001000L
+#define INTERRUPT_CONTROL__STREAM_13_INTERRUPT_ENABLE_MASK                                                    0x00002000L
+#define INTERRUPT_CONTROL__STREAM_14_INTERRUPT_ENABLE_MASK                                                    0x00004000L
+#define INTERRUPT_CONTROL__STREAM_15_INTERRUPT_ENABLE_MASK                                                    0x00008000L
+#define INTERRUPT_CONTROL__CONTROLLER_INTERRUPT_ENABLE_MASK                                                   0x40000000L
+#define INTERRUPT_CONTROL__GLOBAL_INTERRUPT_ENABLE_MASK                                                       0x80000000L
+//INTERRUPT_STATUS
+#define INTERRUPT_STATUS__STREAM_0_INTERRUPT_STATUS__SHIFT                                                    0x0
+#define INTERRUPT_STATUS__STREAM_1_INTERRUPT_STATUS__SHIFT                                                    0x1
+#define INTERRUPT_STATUS__STREAM_2_INTERRUPT_STATUS__SHIFT                                                    0x2
+#define INTERRUPT_STATUS__STREAM_3_INTERRUPT_STATUS__SHIFT                                                    0x3
+#define INTERRUPT_STATUS__STREAM_4_INTERRUPT_STATUS__SHIFT                                                    0x4
+#define INTERRUPT_STATUS__STREAM_5_INTERRUPT_STATUS__SHIFT                                                    0x5
+#define INTERRUPT_STATUS__STREAM_6_INTERRUPT_STATUS__SHIFT                                                    0x6
+#define INTERRUPT_STATUS__STREAM_7_INTERRUPT_STATUS__SHIFT                                                    0x7
+#define INTERRUPT_STATUS__STREAM_8_INTERRUPT_STATUS__SHIFT                                                    0x8
+#define INTERRUPT_STATUS__STREAM_9_INTERRUPT_STATUS__SHIFT                                                    0x9
+#define INTERRUPT_STATUS__STREAM_10_INTERRUPT_STATUS__SHIFT                                                   0xa
+#define INTERRUPT_STATUS__STREAM_11_INTERRUPT_STATUS__SHIFT                                                   0xb
+#define INTERRUPT_STATUS__STREAM_12_INTERRUPT_STATUS__SHIFT                                                   0xc
+#define INTERRUPT_STATUS__STREAM_13_INTERRUPT_STATUS__SHIFT                                                   0xd
+#define INTERRUPT_STATUS__STREAM_14_INTERRUPT_STATUS__SHIFT                                                   0xe
+#define INTERRUPT_STATUS__STREAM_15_INTERRUPT_STATUS__SHIFT                                                   0xf
+#define INTERRUPT_STATUS__CONTROLLER_INTERRUPT_STATUS__SHIFT                                                  0x1e
+#define INTERRUPT_STATUS__GLOBAL_INTERRUPT_STATUS__SHIFT                                                      0x1f
+#define INTERRUPT_STATUS__STREAM_0_INTERRUPT_STATUS_MASK                                                      0x00000001L
+#define INTERRUPT_STATUS__STREAM_1_INTERRUPT_STATUS_MASK                                                      0x00000002L
+#define INTERRUPT_STATUS__STREAM_2_INTERRUPT_STATUS_MASK                                                      0x00000004L
+#define INTERRUPT_STATUS__STREAM_3_INTERRUPT_STATUS_MASK                                                      0x00000008L
+#define INTERRUPT_STATUS__STREAM_4_INTERRUPT_STATUS_MASK                                                      0x00000010L
+#define INTERRUPT_STATUS__STREAM_5_INTERRUPT_STATUS_MASK                                                      0x00000020L
+#define INTERRUPT_STATUS__STREAM_6_INTERRUPT_STATUS_MASK                                                      0x00000040L
+#define INTERRUPT_STATUS__STREAM_7_INTERRUPT_STATUS_MASK                                                      0x00000080L
+#define INTERRUPT_STATUS__STREAM_8_INTERRUPT_STATUS_MASK                                                      0x00000100L
+#define INTERRUPT_STATUS__STREAM_9_INTERRUPT_STATUS_MASK                                                      0x00000200L
+#define INTERRUPT_STATUS__STREAM_10_INTERRUPT_STATUS_MASK                                                     0x00000400L
+#define INTERRUPT_STATUS__STREAM_11_INTERRUPT_STATUS_MASK                                                     0x00000800L
+#define INTERRUPT_STATUS__STREAM_12_INTERRUPT_STATUS_MASK                                                     0x00001000L
+#define INTERRUPT_STATUS__STREAM_13_INTERRUPT_STATUS_MASK                                                     0x00002000L
+#define INTERRUPT_STATUS__STREAM_14_INTERRUPT_STATUS_MASK                                                     0x00004000L
+#define INTERRUPT_STATUS__STREAM_15_INTERRUPT_STATUS_MASK                                                     0x00008000L
+#define INTERRUPT_STATUS__CONTROLLER_INTERRUPT_STATUS_MASK                                                    0x40000000L
+#define INTERRUPT_STATUS__GLOBAL_INTERRUPT_STATUS_MASK                                                        0x80000000L
+//WALL_CLOCK_COUNTER
+#define WALL_CLOCK_COUNTER__WALL_CLOCK_COUNTER__SHIFT                                                         0x0
+#define WALL_CLOCK_COUNTER__WALL_CLOCK_COUNTER_MASK                                                           0xFFFFFFFFL
+//STREAM_SYNCHRONIZATION
+#define STREAM_SYNCHRONIZATION__STREAM_0_SYNCHRONIZATION__SHIFT                                               0x0
+#define STREAM_SYNCHRONIZATION__STREAM_1_SYNCHRONIZATION__SHIFT                                               0x1
+#define STREAM_SYNCHRONIZATION__STREAM_2_SYNCHRONIZATION__SHIFT                                               0x2
+#define STREAM_SYNCHRONIZATION__STREAM_3_SYNCHRONIZATION__SHIFT                                               0x3
+#define STREAM_SYNCHRONIZATION__STREAM_4_SYNCHRONIZATION__SHIFT                                               0x4
+#define STREAM_SYNCHRONIZATION__STREAM_5_SYNCHRONIZATION__SHIFT                                               0x5
+#define STREAM_SYNCHRONIZATION__STREAM_6_SYNCHRONIZATION__SHIFT                                               0x6
+#define STREAM_SYNCHRONIZATION__STREAM_7_SYNCHRONIZATION__SHIFT                                               0x7
+#define STREAM_SYNCHRONIZATION__STREAM_8_SYNCHRONIZATION__SHIFT                                               0x8
+#define STREAM_SYNCHRONIZATION__STREAM_9_SYNCHRONIZATION__SHIFT                                               0x9
+#define STREAM_SYNCHRONIZATION__STREAM_10_SYNCHRONIZATION__SHIFT                                              0xa
+#define STREAM_SYNCHRONIZATION__STREAM_11_SYNCHRONIZATION__SHIFT                                              0xb
+#define STREAM_SYNCHRONIZATION__STREAM_12_SYNCHRONIZATION__SHIFT                                              0xc
+#define STREAM_SYNCHRONIZATION__STREAM_13_SYNCHRONIZATION__SHIFT                                              0xd
+#define STREAM_SYNCHRONIZATION__STREAM_14_SYNCHRONIZATION__SHIFT                                              0xe
+#define STREAM_SYNCHRONIZATION__STREAM_15_SYNCHRONIZATION__SHIFT                                              0xf
+#define STREAM_SYNCHRONIZATION__STREAM_0_SYNCHRONIZATION_MASK                                                 0x00000001L
+#define STREAM_SYNCHRONIZATION__STREAM_1_SYNCHRONIZATION_MASK                                                 0x00000002L
+#define STREAM_SYNCHRONIZATION__STREAM_2_SYNCHRONIZATION_MASK                                                 0x00000004L
+#define STREAM_SYNCHRONIZATION__STREAM_3_SYNCHRONIZATION_MASK                                                 0x00000008L
+#define STREAM_SYNCHRONIZATION__STREAM_4_SYNCHRONIZATION_MASK                                                 0x00000010L
+#define STREAM_SYNCHRONIZATION__STREAM_5_SYNCHRONIZATION_MASK                                                 0x00000020L
+#define STREAM_SYNCHRONIZATION__STREAM_6_SYNCHRONIZATION_MASK                                                 0x00000040L
+#define STREAM_SYNCHRONIZATION__STREAM_7_SYNCHRONIZATION_MASK                                                 0x00000080L
+#define STREAM_SYNCHRONIZATION__STREAM_8_SYNCHRONIZATION_MASK                                                 0x00000100L
+#define STREAM_SYNCHRONIZATION__STREAM_9_SYNCHRONIZATION_MASK                                                 0x00000200L
+#define STREAM_SYNCHRONIZATION__STREAM_10_SYNCHRONIZATION_MASK                                                0x00000400L
+#define STREAM_SYNCHRONIZATION__STREAM_11_SYNCHRONIZATION_MASK                                                0x00000800L
+#define STREAM_SYNCHRONIZATION__STREAM_12_SYNCHRONIZATION_MASK                                                0x00001000L
+#define STREAM_SYNCHRONIZATION__STREAM_13_SYNCHRONIZATION_MASK                                                0x00002000L
+#define STREAM_SYNCHRONIZATION__STREAM_14_SYNCHRONIZATION_MASK                                                0x00004000L
+#define STREAM_SYNCHRONIZATION__STREAM_15_SYNCHRONIZATION_MASK                                                0x00008000L
+//CORB_LOWER_BASE_ADDRESS
+#define CORB_LOWER_BASE_ADDRESS__CORB_LOWER_BASE_UNIMPLEMENTED_BITS__SHIFT                                    0x0
+#define CORB_LOWER_BASE_ADDRESS__CORB_LOWER_BASE_ADDRESS__SHIFT                                               0x7
+#define CORB_LOWER_BASE_ADDRESS__CORB_LOWER_BASE_UNIMPLEMENTED_BITS_MASK                                      0x0000007FL
+#define CORB_LOWER_BASE_ADDRESS__CORB_LOWER_BASE_ADDRESS_MASK                                                 0xFFFFFF80L
+//CORB_UPPER_BASE_ADDRESS
+#define CORB_UPPER_BASE_ADDRESS__CORB_UPPER_BASE_ADDRESS__SHIFT                                               0x0
+#define CORB_UPPER_BASE_ADDRESS__CORB_UPPER_BASE_ADDRESS_MASK                                                 0xFFFFFFFFL
+//AZCONTROLLER0_CORB_WRITE_POINTER
+#define AZCONTROLLER0_CORB_WRITE_POINTER__CORB_WRITE_POINTER__SHIFT                                           0x0
+#define AZCONTROLLER0_CORB_WRITE_POINTER__CORB_WRITE_POINTER_MASK                                             0x00FFL
+//AZCONTROLLER0_CORB_READ_POINTER
+#define AZCONTROLLER0_CORB_READ_POINTER__CORB_READ_POINTER__SHIFT                                             0x0
+#define AZCONTROLLER0_CORB_READ_POINTER__CORB_READ_POINTER_RESET__SHIFT                                       0xf
+#define AZCONTROLLER0_CORB_READ_POINTER__CORB_READ_POINTER_MASK                                               0x00FFL
+#define AZCONTROLLER0_CORB_READ_POINTER__CORB_READ_POINTER_RESET_MASK                                         0x8000L
+//AZCONTROLLER0_CORB_CONTROL
+#define AZCONTROLLER0_CORB_CONTROL__CORB_MEMORY_ERROR_INTERRUPT_ENABLE__SHIFT                                 0x0
+#define AZCONTROLLER0_CORB_CONTROL__ENABLE_CORB_DMA_ENGINE__SHIFT                                             0x1
+#define AZCONTROLLER0_CORB_CONTROL__CORB_MEMORY_ERROR_INTERRUPT_ENABLE_MASK                                   0x01L
+#define AZCONTROLLER0_CORB_CONTROL__ENABLE_CORB_DMA_ENGINE_MASK                                               0x02L
+//AZCONTROLLER0_CORB_STATUS
+#define AZCONTROLLER0_CORB_STATUS__CORB_MEMORY_ERROR_INDICATION__SHIFT                                        0x0
+#define AZCONTROLLER0_CORB_STATUS__CORB_MEMORY_ERROR_INDICATION_MASK                                          0x01L
+//AZCONTROLLER0_CORB_SIZE
+#define AZCONTROLLER0_CORB_SIZE__CORB_SIZE__SHIFT                                                             0x0
+#define AZCONTROLLER0_CORB_SIZE__CORB_SIZE_CAPABILITY__SHIFT                                                  0x4
+#define AZCONTROLLER0_CORB_SIZE__CORB_SIZE_MASK                                                               0x0003L
+#define AZCONTROLLER0_CORB_SIZE__CORB_SIZE_CAPABILITY_MASK                                                    0x00F0L
+//AZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS
+#define AZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_UNIMPLEMENTED_BITS__SHIFT                      0x0
+#define AZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_ADDRESS__SHIFT                                 0x7
+#define AZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_UNIMPLEMENTED_BITS_MASK                        0x0000007FL
+#define AZCONTROLLER0_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_ADDRESS_MASK                                   0xFFFFFF80L
+//AZCONTROLLER0_RIRB_UPPER_BASE_ADDRESS
+#define AZCONTROLLER0_RIRB_UPPER_BASE_ADDRESS__RIRB_UPPER_BASE_ADDRESS__SHIFT                                 0x0
+#define AZCONTROLLER0_RIRB_UPPER_BASE_ADDRESS__RIRB_UPPER_BASE_ADDRESS_MASK                                   0xFFFFFFFFL
+//AZCONTROLLER0_RIRB_WRITE_POINTER
+#define AZCONTROLLER0_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER__SHIFT                                           0x0
+#define AZCONTROLLER0_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_RESET__SHIFT                                     0xf
+#define AZCONTROLLER0_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_MASK                                             0x00FFL
+#define AZCONTROLLER0_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_RESET_MASK                                       0x8000L
+//AZCONTROLLER0_RESPONSE_INTERRUPT_COUNT
+#define AZCONTROLLER0_RESPONSE_INTERRUPT_COUNT__N_RESPONSE_INTERRUPT_COUNT__SHIFT                             0x0
+#define AZCONTROLLER0_RESPONSE_INTERRUPT_COUNT__N_RESPONSE_INTERRUPT_COUNT_MASK                               0x00FFL
+//AZCONTROLLER0_RIRB_CONTROL
+#define AZCONTROLLER0_RIRB_CONTROL__RESPONSE_INTERRUPT_CONTROL__SHIFT                                         0x0
+#define AZCONTROLLER0_RIRB_CONTROL__RIRB_DMA_ENABLE__SHIFT                                                    0x1
+#define AZCONTROLLER0_RIRB_CONTROL__RESPONSE_OVERRUN_INTERRUPT_CONTROL__SHIFT                                 0x2
+#define AZCONTROLLER0_RIRB_CONTROL__RESPONSE_INTERRUPT_CONTROL_MASK                                           0x01L
+#define AZCONTROLLER0_RIRB_CONTROL__RIRB_DMA_ENABLE_MASK                                                      0x02L
+#define AZCONTROLLER0_RIRB_CONTROL__RESPONSE_OVERRUN_INTERRUPT_CONTROL_MASK                                   0x04L
+//AZCONTROLLER0_RIRB_STATUS
+#define AZCONTROLLER0_RIRB_STATUS__RESPONSE_INTERRUPT__SHIFT                                                  0x0
+#define AZCONTROLLER0_RIRB_STATUS__RESPONSE_OVERRUN_INTERRUPT_STATUS__SHIFT                                   0x2
+#define AZCONTROLLER0_RIRB_STATUS__RESPONSE_INTERRUPT_MASK                                                    0x01L
+#define AZCONTROLLER0_RIRB_STATUS__RESPONSE_OVERRUN_INTERRUPT_STATUS_MASK                                     0x04L
+//AZCONTROLLER0_RIRB_SIZE
+#define AZCONTROLLER0_RIRB_SIZE__RIRB_SIZE__SHIFT                                                             0x0
+#define AZCONTROLLER0_RIRB_SIZE__RIRB_SIZE_CAPABILITY__SHIFT                                                  0x4
+#define AZCONTROLLER0_RIRB_SIZE__RIRB_SIZE_MASK                                                               0x0003L
+#define AZCONTROLLER0_RIRB_SIZE__RIRB_SIZE_CAPABILITY_MASK                                                    0x00F0L
+//AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_VERB_AND_PAYLOAD__SHIFT     0x0
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_CODEC_ADDRESS__SHIFT        0x1c
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_VERB_AND_PAYLOAD_MASK       0x0FFFFFFFL
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_CODEC_ADDRESS_MASK          0xF0000000L
+//AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT                 0x0
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK                   0xFFFFFFFFL
+//AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT                0x0
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK                  0x0000FFFFL
+//AZCONTROLLER0_IMMEDIATE_RESPONSE_INPUT_INTERFACE
+#define AZCONTROLLER0_IMMEDIATE_RESPONSE_INPUT_INTERFACE__IMMEDIATE_RESPONSE_READ__SHIFT                      0x0
+#define AZCONTROLLER0_IMMEDIATE_RESPONSE_INPUT_INTERFACE__IMMEDIATE_RESPONSE_READ_MASK                        0xFFFFFFFFL
+//AZCONTROLLER0_IMMEDIATE_COMMAND_STATUS
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_COMMAND_BUSY__SHIFT                                 0x0
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_RESULT_VALID__SHIFT                                 0x1
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_COMMAND_BUSY_MASK                                   0x00000001L
+#define AZCONTROLLER0_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_RESULT_VALID_MASK                                   0x00000002L
+//AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_BUFFER_ENABLE__SHIFT                      0x0
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_UNIMPLEMENTED_BITS__SHIFT      0x1
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_ADDRESS__SHIFT                 0x7
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_BUFFER_ENABLE_MASK                        0x00000001L
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_UNIMPLEMENTED_BITS_MASK        0x0000007EL
+#define AZCONTROLLER0_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_ADDRESS_MASK                   0xFFFFFF80L
+//AZCONTROLLER0_DMA_POSITION_UPPER_BASE_ADDRESS
+#define AZCONTROLLER0_DMA_POSITION_UPPER_BASE_ADDRESS__DMA_POSITION_UPPER_BASE_ADDRESS__SHIFT                 0x0
+#define AZCONTROLLER0_DMA_POSITION_UPPER_BASE_ADDRESS__DMA_POSITION_UPPER_BASE_ADDRESS_MASK                   0xFFFFFFFFL
+//AZCONTROLLER0_WALL_CLOCK_COUNTER_ALIAS
+#define AZCONTROLLER0_WALL_CLOCK_COUNTER_ALIAS__WALL_CLOCK_COUNTER_ALIAS__SHIFT                               0x0
+#define AZCONTROLLER0_WALL_CLOCK_COUNTER_ALIAS__WALL_CLOCK_COUNTER_ALIAS_MASK                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azendpoint_azdec
+//AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT        0x0
+#define AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK          0xFFFFFFFFL
+//AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT       0x0
+#define AZENDPOINT0_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK         0x0001FFFFL
+
+
+// addressBlock: dce_dc_hda_azroot_azdec
+//AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT                0x0
+#define AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK                  0xFFFFFFFFL
+//AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT               0x0
+#define AZROOT0_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK                 0x0001FFFFL
+
+
+// addressBlock: dce_dc_hda_azstream0_azdec
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM0_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream1_azdec
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM1_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream2_azdec
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM2_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream3_azdec
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM3_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream4_azdec
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM4_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream5_azdec
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM5_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream6_azdec
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM6_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream7_azdec
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM7_0_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmiopubDmuDec
+//RSMU_MEM_POWER_CTRL2_DMU
+#define RSMU_MEM_POWER_CTRL2_DMU__RSMU_MEM_POWER_CTRL2_DATA__SHIFT                                            0x0
+#define RSMU_MEM_POWER_CTRL2_DMU__RSMU_MEM_POWER_CTRL2_DATA_MASK                                              0xFFFFFFFFL
+//RSMU_HARD_RESETB_DMU
+#define RSMU_HARD_RESETB_DMU__RSMU_HARD_RESETB__SHIFT                                                         0x0
+#define RSMU_HARD_RESETB_DMU__RSMU_MASTER_HARD_RESET_FENCE_ENABLE__SHIFT                                      0x2
+#define RSMU_HARD_RESETB_DMU__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE__SHIFT                                     0x5
+#define RSMU_HARD_RESETB_DMU__RSMU_HARD_RESETB_MASK                                                           0x00000003L
+#define RSMU_HARD_RESETB_DMU__RSMU_MASTER_HARD_RESET_FENCE_ENABLE_MASK                                        0x0000000CL
+#define RSMU_HARD_RESETB_DMU__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE_MASK                                       0x00000060L
+//RSMU_MEM_POWER_CTRL_DMU
+#define RSMU_MEM_POWER_CTRL_DMU__RSMU_MEM_POWER_CTRL_DATA__SHIFT                                              0x0
+#define RSMU_MEM_POWER_CTRL_DMU__RSMU_MEM_POWER_CTRL_DATA_MASK                                                0xFFFFFFFFL
+//RSMU_STRAP_CONTROL_DMU
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_READY__SHIFT                                                    0x0
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_VALID__SHIFT                                                    0x1
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_RELOAD__SHIFT                                                   0x2
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_READY__SHIFT                                                         0x3
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_VALID__SHIFT                                                         0x4
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_RELOAD__SHIFT                                                        0x5
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PIN_RELOAD__SHIFT                                                        0x6
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SEC_FUSE_READY__SHIFT                                                    0x7
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SEC_FUSE_VALID__SHIFT                                                    0x8
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP0__SHIFT                                               0x9
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP1__SHIFT                                               0xa
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP2__SHIFT                                               0xb
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP3__SHIFT                                               0xc
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP0__SHIFT                                               0xd
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP1__SHIFT                                               0xe
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP2__SHIFT                                               0xf
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP3__SHIFT                                               0x10
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP0__SHIFT                                           0x11
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP1__SHIFT                                           0x12
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP2__SHIFT                                           0x13
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP3__SHIFT                                           0x14
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_READY_MASK                                                      0x00000001L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_VALID_MASK                                                      0x00000002L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PUB_FUSE_RELOAD_MASK                                                     0x00000004L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_READY_MASK                                                           0x00000008L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_VALID_MASK                                                           0x00000010L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_ROM_RELOAD_MASK                                                          0x00000020L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_PIN_RELOAD_MASK                                                          0x00000040L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SEC_FUSE_READY_MASK                                                      0x00000080L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SEC_FUSE_VALID_MASK                                                      0x00000100L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP0_MASK                                                 0x00000200L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP1_MASK                                                 0x00000400L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP2_MASK                                                 0x00000800L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_READY_GRP3_MASK                                                 0x00001000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP0_MASK                                                 0x00002000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP1_MASK                                                 0x00004000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP2_MASK                                                 0x00008000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_VALID_GRP3_MASK                                                 0x00010000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP0_MASK                                             0x00020000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP1_MASK                                             0x00040000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP2_MASK                                             0x00080000L
+#define RSMU_STRAP_CONTROL_DMU__RSMU_SMS_FUSE_BIST_FAIL_GRP3_MASK                                             0x00100000L
+//RSMU_COUNTER_0_DMU
+#define RSMU_COUNTER_0_DMU__RSMU_COUNTER_0__SHIFT                                                             0x0
+#define RSMU_COUNTER_0_DMU__RSMU_COUNTER_0_MASK                                                               0xFFFFFFFFL
+//RSMU_COUNTER_1_DMU
+#define RSMU_COUNTER_1_DMU__RSMU_COUNTER_1__SHIFT                                                             0x0
+#define RSMU_COUNTER_1_DMU__RSMU_COUNTER_1_MASK                                                               0x00FFFFFFL
+//RSMU_PWRMGT_INTR_ENABLE_P0_DMU
+#define RSMU_PWRMGT_INTR_ENABLE_P0_DMU__RSMU_PWRMGT_INTR_ENABLE_P0__SHIFT                                     0x0
+#define RSMU_PWRMGT_INTR_ENABLE_P0_DMU__RSMU_PWRMGT_INTR_ENABLE_P0_MASK                                       0x0000FFFFL
+//RSMU_PWRMGT_INTR_ENABLE_P1_DMU
+#define RSMU_PWRMGT_INTR_ENABLE_P1_DMU__RSMU_PWRMGT_INTR_ENABLE_P1__SHIFT                                     0x0
+#define RSMU_PWRMGT_INTR_ENABLE_P1_DMU__RSMU_PWRMGT_INTR_ENABLE_P1_MASK                                       0x0000FFFFL
+//RSMU_PWRMGT_INTR_ENABLE_P2_DMU
+#define RSMU_PWRMGT_INTR_ENABLE_P2_DMU__RSMU_PWRMGT_INTR_ENABLE_P2__SHIFT                                     0x0
+#define RSMU_PWRMGT_INTR_ENABLE_P2_DMU__RSMU_PWRMGT_INTR_ENABLE_P2_MASK                                       0x0000FFFFL
+//RSMU_PWRMGT_INTR_TARGET_ADDR_P0_DMU
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P0_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P0__SHIFT                           0x0
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P0_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P0_MASK                             0xFFFFFFFFL
+//RSMU_PWRMGT_INTR_TARGET_ADDR_P1_DMU
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P1_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P1__SHIFT                           0x0
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P1_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P1_MASK                             0xFFFFFFFFL
+//RSMU_PWRMGT_INTR_TARGET_ADDR_P2_DMU
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P2_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P2__SHIFT                           0x0
+#define RSMU_PWRMGT_INTR_TARGET_ADDR_P2_DMU__RSMU_PWRMGT_INTR_TARGET_ADDR_P2_MASK                             0xFFFFFFFFL
+//RSMU_PWRMGT_INTR_CONFIG_P0_DMU
+#define RSMU_PWRMGT_INTR_CONFIG_P0_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P0__SHIFT                                  0x0
+#define RSMU_PWRMGT_INTR_CONFIG_P0_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P0_MASK                                    0x00000003L
+//RSMU_PWRMGT_INTR_CONFIG_P1_DMU
+#define RSMU_PWRMGT_INTR_CONFIG_P1_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P1__SHIFT                                  0x0
+#define RSMU_PWRMGT_INTR_CONFIG_P1_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P1_MASK                                    0x00000003L
+//RSMU_PWRMGT_INTR_CONFIG_P2_DMU
+#define RSMU_PWRMGT_INTR_CONFIG_P2_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P2__SHIFT                                  0x0
+#define RSMU_PWRMGT_INTR_CONFIG_P2_DMU__RSMU_PWRMGT_INTR_CONFIG_VC_P2_MASK                                    0x00000003L
+//RSMU_PWRMGT_INTR_STATUS_DMU
+#define RSMU_PWRMGT_INTR_STATUS_DMU__RSMU_PWRMGT_INTR_STATUS__SHIFT                                           0x0
+#define RSMU_PWRMGT_INTR_STATUS_DMU__RSMU_PWRMGT_INTR_STATUS_MASK                                             0x0000FFFFL
+//RSMU_PWRMGT_INTR_PENDING_P0_DMU
+#define RSMU_PWRMGT_INTR_PENDING_P0_DMU__RSMU_PWRMGT_INTR_PENDING_P0__SHIFT                                   0x0
+#define RSMU_PWRMGT_INTR_PENDING_P0_DMU__RSMU_PWRMGT_INTR_PENDING_P0_MASK                                     0x0000FFFFL
+//RSMU_PWRMGT_INTR_PENDING_P1_DMU
+#define RSMU_PWRMGT_INTR_PENDING_P1_DMU__RSMU_PWRMGT_INTR_PENDING_P1__SHIFT                                   0x0
+#define RSMU_PWRMGT_INTR_PENDING_P1_DMU__RSMU_PWRMGT_INTR_PENDING_P1_MASK                                     0x0000FFFFL
+//RSMU_PWRMGT_INTR_PENDING_P2_DMU
+#define RSMU_PWRMGT_INTR_PENDING_P2_DMU__RSMU_PWRMGT_INTR_PENDING_P2__SHIFT                                   0x0
+#define RSMU_PWRMGT_INTR_PENDING_P2_DMU__RSMU_PWRMGT_INTR_PENDING_P2_MASK                                     0x0000FFFFL
+//RSMU_PWRMGT_INTR_TYPE_DMU
+#define RSMU_PWRMGT_INTR_TYPE_DMU__RSMU_PWRMGT_INTR_TYPE__SHIFT                                               0x0
+#define RSMU_PWRMGT_INTR_TYPE_DMU__RSMU_PWRMGT_INTR_TYPE_MASK                                                 0x0000FFFFL
+//RSMU_PWRMGT_INTR_INTERCEPT_DMU
+#define RSMU_PWRMGT_INTR_INTERCEPT_DMU__RSMU_PWRMGT_INTR_OVERRIDE__SHIFT                                      0x0
+#define RSMU_PWRMGT_INTR_INTERCEPT_DMU__RSMU_PWRMGT_INTR_VALUE__SHIFT                                         0x10
+#define RSMU_PWRMGT_INTR_INTERCEPT_DMU__RSMU_PWRMGT_INTR_OVERRIDE_MASK                                        0x0000FFFFL
+#define RSMU_PWRMGT_INTR_INTERCEPT_DMU__RSMU_PWRMGT_INTR_VALUE_MASK                                           0xFFFF0000L
+//RSMU_PWRMGT_INTR_CLEAR_DMU
+#define RSMU_PWRMGT_INTR_CLEAR_DMU__RSMU_PWRMGT_INTR_CLEAR__SHIFT                                             0x0
+#define RSMU_PWRMGT_INTR_CLEAR_DMU__RSMU_PWRMGT_INTR_CLEAR_MASK                                               0x0000FFFFL
+//RSMU_MMIOPUB_SCRATCH_REG_0_DMU
+#define RSMU_MMIOPUB_SCRATCH_REG_0_DMU__RSMU_MMIOPUB_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOPUB_SCRATCH_REG_0_DMU__RSMU_MMIOPUB_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_VF_ENABLE_DMU
+#define RSMU_VF_ENABLE_DMU__RSMU_VF_ENABLE__SHIFT                                                             0x0
+#define RSMU_VF_ENABLE_DMU__RSMU_VF_ENABLE_MASK                                                               0x00000001L
+//RSMU_MGCG_CONTROL_DMU
+#define RSMU_MGCG_CONTROL_DMU__RSMU_AXI_SLAVE_MGCG_OVERRIDE__SHIFT                                            0x0
+#define RSMU_MGCG_CONTROL_DMU__RSMU_AXI_MASTER_MGCG_OVERRIDE__SHIFT                                           0x1
+#define RSMU_MGCG_CONTROL_DMU__RSMU_SEC_INTR_MGCG_OVERRIDE__SHIFT                                             0x2
+#define RSMU_MGCG_CONTROL_DMU__RSMU_PWRMGT_INTR_MGCG_OVERRIDE__SHIFT                                          0x3
+#define RSMU_MGCG_CONTROL_DMU__RSMU_REG_WRAPPER_MGCG_OVERRIDE__SHIFT                                          0x4
+#define RSMU_MGCG_CONTROL_DMU__RSMU_STRAP_MASTER_MGCG_OVERRIDE__SHIFT                                         0x5
+#define RSMU_MGCG_CONTROL_DMU__RSMU_VWIRE_SRC_MGCG_OVERRIDE__SHIFT                                            0x6
+#define RSMU_MGCG_CONTROL_DMU__RSMU_REGIF_MASTER_MGCG_OVERRIDE__SHIFT                                         0x7
+#define RSMU_MGCG_CONTROL_DMU__RSMU_PGFSM_MGCG_OVERRIDE__SHIFT                                                0x8
+#define RSMU_MGCG_CONTROL_DMU__RSMU_IH_MGCG_OVERRIDE__SHIFT                                                   0x9
+#define RSMU_MGCG_CONTROL_DMU__RSMU_SEM_MGCG_OVERRIDE__SHIFT                                                  0xa
+#define RSMU_MGCG_CONTROL_DMU__RSMU_DPM_MGCG_OVERRIDE__SHIFT                                                  0xb
+#define RSMU_MGCG_CONTROL_DMU__RSMU_RAS_INTR_MGCG_OVERRIDE__SHIFT                                             0xc
+#define RSMU_MGCG_CONTROL_DMU__RSMU_CAC_MGCG_OVERRIDE__SHIFT                                                  0xd
+#define RSMU_MGCG_CONTROL_DMU__RSMU_XBAR_MGCG_OVERRIDE__SHIFT                                                 0xe
+#define RSMU_MGCG_CONTROL_DMU__RSMU_MCA_IBIR_MGCG_OVERRIDE__SHIFT                                             0xf
+#define RSMU_MGCG_CONTROL_DMU__RSMU_AXI_SLAVE_MGCG_OVERRIDE_MASK                                              0x00000001L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_AXI_MASTER_MGCG_OVERRIDE_MASK                                             0x00000002L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_SEC_INTR_MGCG_OVERRIDE_MASK                                               0x00000004L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_PWRMGT_INTR_MGCG_OVERRIDE_MASK                                            0x00000008L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_REG_WRAPPER_MGCG_OVERRIDE_MASK                                            0x00000010L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_STRAP_MASTER_MGCG_OVERRIDE_MASK                                           0x00000020L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_VWIRE_SRC_MGCG_OVERRIDE_MASK                                              0x00000040L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_REGIF_MASTER_MGCG_OVERRIDE_MASK                                           0x00000080L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_PGFSM_MGCG_OVERRIDE_MASK                                                  0x00000100L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_IH_MGCG_OVERRIDE_MASK                                                     0x00000200L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_SEM_MGCG_OVERRIDE_MASK                                                    0x00000400L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_DPM_MGCG_OVERRIDE_MASK                                                    0x00000800L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_RAS_INTR_MGCG_OVERRIDE_MASK                                               0x00001000L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_CAC_MGCG_OVERRIDE_MASK                                                    0x00002000L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_XBAR_MGCG_OVERRIDE_MASK                                                   0x00004000L
+#define RSMU_MGCG_CONTROL_DMU__RSMU_MCA_IBIR_MGCG_OVERRIDE_MASK                                               0x00008000L
+//RSMU_AXI_MASTER_QOS_CNTL_DMU
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_MASTER_QOS_OVRD_MODE__SHIFT                                        0x0
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_MASTER_QOS_OVRD_VALUE__SHIFT                                       0x1
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_AWQOS_OVRD_MODE__SHIFT                                   0x5
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_AWQOS_OVRD_VALUE__SHIFT                                  0x6
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_ARQOS_OVRD_MODE__SHIFT                                   0xa
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_ARQOS_OVRD_VALUE__SHIFT                                  0xb
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_MASTER_QOS_OVRD_MODE_MASK                                          0x00000001L
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_MASTER_QOS_OVRD_VALUE_MASK                                         0x0000001EL
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_AWQOS_OVRD_MODE_MASK                                     0x00000020L
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_AWQOS_OVRD_VALUE_MASK                                    0x000003C0L
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_ARQOS_OVRD_MODE_MASK                                     0x00000400L
+#define RSMU_AXI_MASTER_QOS_CNTL_DMU__RSMU_IP_MASTER_ARQOS_OVRD_VALUE_MASK                                    0x00007800L
+//RSMU_MASTER_ERROR_COUNTER_DMU
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_SMN_SLVERR_COUNTER__SHIFT                                         0x0
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_SMN_DECERR_COUNTER__SHIFT                                         0x8
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_MASTER_SLVERR_COUNTER__SHIFT                                      0x10
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_MASTER_DECERR_COUNTER__SHIFT                                      0x18
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_SMN_SLVERR_COUNTER_MASK                                           0x000000FFL
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_SMN_DECERR_COUNTER_MASK                                           0x0000FF00L
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_MASTER_SLVERR_COUNTER_MASK                                        0x00FF0000L
+#define RSMU_MASTER_ERROR_COUNTER_DMU__RSMU_MASTER_DECERR_COUNTER_MASK                                        0xFF000000L
+//RSMU_SLAVE_TIMEOUT_VALUE_DMU
+#define RSMU_SLAVE_TIMEOUT_VALUE_DMU__RSMU_SLAVE_TIMEOUT_VALUE__SHIFT                                         0x0
+#define RSMU_SLAVE_TIMEOUT_VALUE_DMU__RSMU_SLAVE_TIMEOUT_VALUE_MASK                                           0xFFFFFFFFL
+//RSMU_RESET_TIMEOUT_CONTROL_DMU
+#define RSMU_RESET_TIMEOUT_CONTROL_DMU__RSMU_SLAVE_TIMEOUT_ENABLE__SHIFT                                      0x0
+#define RSMU_RESET_TIMEOUT_CONTROL_DMU__RSMU_SLAVE_RESET_TIMEOUT_VALUE__SHIFT                                 0x1
+#define RSMU_RESET_TIMEOUT_CONTROL_DMU__RSMU_SLAVE_TIMEOUT_ENABLE_MASK                                        0x00000001L
+#define RSMU_RESET_TIMEOUT_CONTROL_DMU__RSMU_SLAVE_RESET_TIMEOUT_VALUE_MASK                                   0x000001FEL
+//RSMU_SLAVE_ERROR_COUNTER_DMU
+#define RSMU_SLAVE_ERROR_COUNTER_DMU__RSMU_SLAVE_ERROR_COUNTER__SHIFT                                         0x0
+#define RSMU_SLAVE_ERROR_COUNTER_DMU__RSMU_SLAVE_ERROR_COUNTER_MASK                                           0x000000FFL
+//RSMU_DBG_MUX_CONTROL_DMU
+#define RSMU_DBG_MUX_CONTROL_DMU__RSMU_DBG_MUX_SELECT__SHIFT                                                  0x0
+#define RSMU_DBG_MUX_CONTROL_DMU__RSMU_DBG_SIGNATURE__SHIFT                                                   0x18
+#define RSMU_DBG_MUX_CONTROL_DMU__RSMU_DBG_MUX_SELECT_MASK                                                    0x000000FFL
+#define RSMU_DBG_MUX_CONTROL_DMU__RSMU_DBG_SIGNATURE_MASK                                                     0xFF000000L
+//RSMU_IH_RESET_CNTL_DMU
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_RESET__SHIFT                                                          0x0
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_HARD_RESET_ENABLE__SHIFT                                              0x1
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_SOFT_RESET_ENABLE__SHIFT                                              0x2
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_RESET_MASK                                                            0x00000001L
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_HARD_RESET_ENABLE_MASK                                                0x00000002L
+#define RSMU_IH_RESET_CNTL_DMU__RSMU_IH_SOFT_RESET_ENABLE_MASK                                                0x00000004L
+//RSMU_GOLDEN_COUNTER_0_DMU
+#define RSMU_GOLDEN_COUNTER_0_DMU__RSMU_GOLDEN_COUNTER_0__SHIFT                                               0x0
+#define RSMU_GOLDEN_COUNTER_0_DMU__RSMU_GOLDEN_COUNTER_0_MASK                                                 0xFFFFFFFFL
+//RSMU_GOLDEN_COUNTER_1_DMU
+#define RSMU_GOLDEN_COUNTER_1_DMU__RSMU_GOLDEN_COUNTER_1__SHIFT                                               0x0
+#define RSMU_GOLDEN_COUNTER_1_DMU__RSMU_GOLDEN_COUNTER_1_MASK                                                 0x00FFFFFFL
+//RSMU_IP_CLOCK_GATE_CNTL_DMU
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_MGCG_ENABLE__SHIFT                                               0x0
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_MEMVIEW_FGCG_OVRD__SHIFT                                         0x1
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_RDFT_SMS_IF_FGCG_OVRD__SHIFT                                        0x2
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_FORCE_CLKOFF__SHIFT                                              0x1f
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_MGCG_ENABLE_MASK                                                 0x00000001L
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_MEMVIEW_FGCG_OVRD_MASK                                           0x00000002L
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_RDFT_SMS_IF_FGCG_OVRD_MASK                                          0x00000004L
+#define RSMU_IP_CLOCK_GATE_CNTL_DMU__RSMU_IP_FORCE_CLKOFF_MASK                                                0x80000000L
+//RSMU_MSMU_FETCH_FUSE_DMU
+#define RSMU_MSMU_FETCH_FUSE_DMU__RSMU_FUSE_UPPER_256KB_H_OFFSET__SHIFT                                       0x0
+#define RSMU_MSMU_FETCH_FUSE_DMU__RSMU_FUSE_APERTURE_ID_H_OFFSET__SHIFT                                       0x2
+#define RSMU_MSMU_FETCH_FUSE_DMU__RSMU_FUSE_UPPER_256KB_H_OFFSET_MASK                                         0x00000003L
+#define RSMU_MSMU_FETCH_FUSE_DMU__RSMU_FUSE_APERTURE_ID_H_OFFSET_MASK                                         0x00003FFCL
+//RSMU_STRAP_STATUS_DMU
+#define RSMU_STRAP_STATUS_DMU__RSMU_PUBLIC_FUSE_STATUS__SHIFT                                                 0x0
+#define RSMU_STRAP_STATUS_DMU__RSMU_SECURITY_FUSE_STATUS__SHIFT                                               0x8
+#define RSMU_STRAP_STATUS_DMU__RSMU_SMS_FUSE_STATUS__SHIFT                                                    0x10
+#define RSMU_STRAP_STATUS_DMU__RSMU_ROM_STRAP_STATUS__SHIFT                                                   0x18
+#define RSMU_STRAP_STATUS_DMU__RSMU_PUBLIC_FUSE_STATUS_MASK                                                   0x00000001L
+#define RSMU_STRAP_STATUS_DMU__RSMU_SECURITY_FUSE_STATUS_MASK                                                 0x00000100L
+#define RSMU_STRAP_STATUS_DMU__RSMU_SMS_FUSE_STATUS_MASK                                                      0x00010000L
+#define RSMU_STRAP_STATUS_DMU__RSMU_ROM_STRAP_STATUS_MASK                                                     0x01000000L
+//RSMU_SMS_FUSE_CLEAR_SET0_DMU
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP0__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP1__SHIFT                                         0x1
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP2__SHIFT                                         0x2
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP3__SHIFT                                         0x3
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP4__SHIFT                                         0x4
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP5__SHIFT                                         0x5
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP6__SHIFT                                         0x6
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP7__SHIFT                                         0x7
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP8__SHIFT                                         0x8
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP9__SHIFT                                         0x9
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP10__SHIFT                                        0xa
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP11__SHIFT                                        0xb
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP12__SHIFT                                        0xc
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP13__SHIFT                                        0xd
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP14__SHIFT                                        0xe
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP15__SHIFT                                        0xf
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP16__SHIFT                                        0x10
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP17__SHIFT                                        0x11
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP18__SHIFT                                        0x12
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP19__SHIFT                                        0x13
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP20__SHIFT                                        0x14
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP21__SHIFT                                        0x15
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP22__SHIFT                                        0x16
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP23__SHIFT                                        0x17
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP24__SHIFT                                        0x18
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP25__SHIFT                                        0x19
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP26__SHIFT                                        0x1a
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP27__SHIFT                                        0x1b
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP28__SHIFT                                        0x1c
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP29__SHIFT                                        0x1d
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP30__SHIFT                                        0x1e
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP31__SHIFT                                        0x1f
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP0_MASK                                           0x00000001L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP1_MASK                                           0x00000002L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP2_MASK                                           0x00000004L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP3_MASK                                           0x00000008L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP4_MASK                                           0x00000010L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP5_MASK                                           0x00000020L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP6_MASK                                           0x00000040L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP7_MASK                                           0x00000080L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP8_MASK                                           0x00000100L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP9_MASK                                           0x00000200L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP10_MASK                                          0x00000400L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP11_MASK                                          0x00000800L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP12_MASK                                          0x00001000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP13_MASK                                          0x00002000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP14_MASK                                          0x00004000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP15_MASK                                          0x00008000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP16_MASK                                          0x00010000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP17_MASK                                          0x00020000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP18_MASK                                          0x00040000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP19_MASK                                          0x00080000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP20_MASK                                          0x00100000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP21_MASK                                          0x00200000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP22_MASK                                          0x00400000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP23_MASK                                          0x00800000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP24_MASK                                          0x01000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP25_MASK                                          0x02000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP26_MASK                                          0x04000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP27_MASK                                          0x08000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP28_MASK                                          0x10000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP29_MASK                                          0x20000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP30_MASK                                          0x40000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DMU__RSMU_SMS_FUSE_CLEAR_GRP31_MASK                                          0x80000000L
+//RSMU_PWRMGT_INTR_MCM_ADDR_DMU
+#define RSMU_PWRMGT_INTR_MCM_ADDR_DMU__RSMU_PWRMGT_INTR_MCM_ADDR__SHIFT                                       0x0
+#define RSMU_PWRMGT_INTR_MCM_ADDR_DMU__RSMU_PWRMGT_INTR_MCM_ADDR_MASK                                         0x0000FFFFL
+//RSMU_SMS_FUSE_RETRIGGER_SET0_DMU
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_DMU__RSMU_SMS_FUSE_RETRIGGER_SET0__SHIFT                                 0x0
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_DMU__RSMU_SMS_FUSE_RETRIGGER_SET0_MASK                                   0xFFFFFFFFL
+//RSMU_XBAR_CG_MISC_DMU
+#define RSMU_XBAR_CG_MISC_DMU__RSMU_XBAR_CG_TIMEOUT_VALUE__SHIFT                                              0x0
+#define RSMU_XBAR_CG_MISC_DMU__RSMU_XBAR_CSYS_DELAY__SHIFT                                                    0x8
+#define RSMU_XBAR_CG_MISC_DMU__RSMU_XBAR_CG_TIMEOUT_VALUE_MASK                                                0x000000FFL
+#define RSMU_XBAR_CG_MISC_DMU__RSMU_XBAR_CSYS_DELAY_MASK                                                      0x0000FF00L
+//RSMU_XBAR_CG_CTRL_DMU
+#define RSMU_XBAR_CG_CTRL_DMU__RSMU_XBAR_CACTIVE_EN__SHIFT                                                    0x0
+#define RSMU_XBAR_CG_CTRL_DMU__RSMU_XBAR_CACTIVE_EN_MASK                                                      0x00000001L
+//RSMU_IH_MCM_ADDR_DMU
+#define RSMU_IH_MCM_ADDR_DMU__RSMU_IH_MCM_ADDR__SHIFT                                                         0x0
+#define RSMU_IH_MCM_ADDR_DMU__RSMU_IH_MCM_ADDR_MASK                                                           0x0000FFFFL
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmioextDmuDec
+//RSMU_SOFT_RESETB_DMU
+#define RSMU_SOFT_RESETB_DMU__RSMU_SOFT_RESETB__SHIFT                                                         0x0
+#define RSMU_SOFT_RESETB_DMU__RSMU_MASTER_SOFT_RESET_FENCE_ENABLE__SHIFT                                      0x2
+#define RSMU_SOFT_RESETB_DMU__RSMU_SLAVE_SOFT_RESET_TIMEOUT_ENABLE__SHIFT                                     0x4
+#define RSMU_SOFT_RESETB_DMU__RSMU_SOFT_RESETB_MASK                                                           0x00000003L
+#define RSMU_SOFT_RESETB_DMU__RSMU_MASTER_SOFT_RESET_FENCE_ENABLE_MASK                                        0x0000000CL
+#define RSMU_SOFT_RESETB_DMU__RSMU_SLAVE_SOFT_RESET_TIMEOUT_ENABLE_MASK                                       0x00000030L
+//RSMU_IH_CREDIT_DMU
+#define RSMU_IH_CREDIT_DMU__RSMU_IH_CREDIT__SHIFT                                                             0x0
+#define RSMU_IH_CREDIT_DMU__RSMU_IH_CREDIT_MASK                                                               0xFFFFFFFFL
+//RSMU_TIMEOUT_ERROR_LOG_REG1_DMU
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DMU__RSMU_TIMEOUT_ERROR_REMOTE_FLAG__SHIFT                                0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DMU__RSMU_TIMEOUT_ERROR_NODE_ID__SHIFT                                    0x1
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DMU__RSMU_TIMEOUT_ERROR_REMOTE_FLAG_MASK                                  0x00000001L
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DMU__RSMU_TIMEOUT_ERROR_NODE_ID_MASK                                      0x0000FFFEL
+//RSMU_TIMEOUT_ERROR_LOG_REG_DMU
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_ADDR__SHIFT                                        0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_INITIATORID__SHIFT                                 0x14
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_OP__SHIFT                                          0x1e
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_OUTSTANDING__SHIFT                                 0x1f
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_ADDR_MASK                                          0x000FFFFFL
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_INITIATORID_MASK                                   0x3FF00000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_OP_MASK                                            0x40000000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DMU__RSMU_TIMEOUT_ERROR_OUTSTANDING_MASK                                   0x80000000L
+//RSMU_IP_MASTER_STATUS_DMU
+#define RSMU_IP_MASTER_STATUS_DMU__RSMU_IP_MASTER_REQ_PENDING__SHIFT                                          0x0
+#define RSMU_IP_MASTER_STATUS_DMU__RSMU_IP_MASTER_RESP_PENDING__SHIFT                                         0x1
+#define RSMU_IP_MASTER_STATUS_DMU__RSMU_IP_MASTER_REQ_PENDING_MASK                                            0x00000001L
+#define RSMU_IP_MASTER_STATUS_DMU__RSMU_IP_MASTER_RESP_PENDING_MASK                                           0x00000002L
+//RSMU_MMIOEXT_SCRATCH_REG_0_DMU
+#define RSMU_MMIOEXT_SCRATCH_REG_0_DMU__RSMU_MMIOEXT_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_0_DMU__RSMU_MMIOEXT_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_MMIOEXT_SCRATCH_REG_1_DMU
+#define RSMU_MMIOEXT_SCRATCH_REG_1_DMU__RSMU_MMIOEXT_SCRATCH_REG_1__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_1_DMU__RSMU_MMIOEXT_SCRATCH_REG_1_MASK                                       0xFFFFFFFFL
+//RSMU_VERSION_DMU
+#define RSMU_VERSION_DMU__RSMU_VERSION_LOW__SHIFT                                                             0x0
+#define RSMU_VERSION_DMU__RSMU_VERSION_MIDDLE__SHIFT                                                          0x8
+#define RSMU_VERSION_DMU__RSMU_VERSION_HIGH__SHIFT                                                            0x10
+#define RSMU_VERSION_DMU__RSMU_VERSION_LOW_MASK                                                               0x000000FFL
+#define RSMU_VERSION_DMU__RSMU_VERSION_MIDDLE_MASK                                                            0x0000FF00L
+#define RSMU_VERSION_DMU__RSMU_VERSION_HIGH_MASK                                                              0x00FF0000L
+//RSMU_IH_COOKIE_WRITE_ADDR_DMU
+#define RSMU_IH_COOKIE_WRITE_ADDR_DMU__RSMU_IH_COOKIE_WRITE_ADDR__SHIFT                                       0x0
+#define RSMU_IH_COOKIE_WRITE_ADDR_DMU__RSMU_IH_COOKIE_WRITE_ADDR_MASK                                         0xFFFFFFFFL
+
+
+// addressBlock: dce_rsmu_dmu_rsmu_dmu_RsmuMmiosecDmuDec
+//RSMU_AEB_OVERRIDE_0_DMU
+#define RSMU_AEB_OVERRIDE_0_DMU__RSMU_AEB_OVERRIDE_0__SHIFT                                                   0x3
+#define RSMU_AEB_OVERRIDE_0_DMU__RSMU_AEB_OVERRIDE_0_MASK                                                     0xFFFFFFF8L
+//RSMU_AEB_OVERRIDE_1_DMU
+#define RSMU_AEB_OVERRIDE_1_DMU__RSMU_AEB_OVERRIDE_1__SHIFT                                                   0x0
+#define RSMU_AEB_OVERRIDE_1_DMU__RSMU_AEB_OVERRIDE_1_MASK                                                     0xFFFFFFFFL
+//RSMU_MMIOSEC_SCRATCH_REG_0_DMU
+#define RSMU_MMIOSEC_SCRATCH_REG_0_DMU__RSMU_MMIOSEC_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOSEC_SCRATCH_REG_0_DMU__RSMU_MMIOSEC_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_AEB_VALUE_0_DMU
+#define RSMU_AEB_VALUE_0_DMU__RSMU_AEB_VALUE_0__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_0_DMU__RSMU_AEB_VALUE_0_MASK                                                           0xFFFFFFFFL
+//RSMU_AEB_VALUE_1_DMU
+#define RSMU_AEB_VALUE_1_DMU__RSMU_AEB_VALUE_1__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_1_DMU__RSMU_AEB_VALUE_1_MASK                                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmiopubDioDec
+//RSMU_MEM_POWER_CTRL2_DIO
+#define RSMU_MEM_POWER_CTRL2_DIO__RSMU_MEM_POWER_CTRL2_DATA__SHIFT                                            0x0
+#define RSMU_MEM_POWER_CTRL2_DIO__RSMU_MEM_POWER_CTRL2_DATA_MASK                                              0xFFFFFFFFL
+//RSMU_HARD_RESETB_DIO
+#define RSMU_HARD_RESETB_DIO__RSMU_HARD_RESETB__SHIFT                                                         0x0
+#define RSMU_HARD_RESETB_DIO__RSMU_MASTER_HARD_RESET_FENCE_ENABLE__SHIFT                                      0x2
+#define RSMU_HARD_RESETB_DIO__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE__SHIFT                                     0x5
+#define RSMU_HARD_RESETB_DIO__RSMU_HARD_RESETB_MASK                                                           0x00000003L
+#define RSMU_HARD_RESETB_DIO__RSMU_MASTER_HARD_RESET_FENCE_ENABLE_MASK                                        0x0000000CL
+#define RSMU_HARD_RESETB_DIO__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE_MASK                                       0x00000060L
+//RSMU_PUB_FUSE_ADDR_DIO
+#define RSMU_PUB_FUSE_ADDR_DIO__RSMU_PUB_FUSE_START_ADDR__SHIFT                                               0x0
+#define RSMU_PUB_FUSE_ADDR_DIO__RSMU_PUB_FUSE_END_ADDR__SHIFT                                                 0x10
+#define RSMU_PUB_FUSE_ADDR_DIO__RSMU_PUB_FUSE_START_ADDR_MASK                                                 0x0000FFFFL
+#define RSMU_PUB_FUSE_ADDR_DIO__RSMU_PUB_FUSE_END_ADDR_MASK                                                   0xFFFF0000L
+//RSMU_ROM_ADDR_DIO
+#define RSMU_ROM_ADDR_DIO__RSMU_ROM_START_ADDR__SHIFT                                                         0x0
+#define RSMU_ROM_ADDR_DIO__RSMU_ROM_END_ADDR__SHIFT                                                           0x10
+#define RSMU_ROM_ADDR_DIO__RSMU_ROM_START_ADDR_MASK                                                           0x0000FFFFL
+#define RSMU_ROM_ADDR_DIO__RSMU_ROM_END_ADDR_MASK                                                             0xFFFF0000L
+//RSMU_MEM_POWER_CTRL_DIO
+#define RSMU_MEM_POWER_CTRL_DIO__RSMU_MEM_POWER_CTRL_DATA__SHIFT                                              0x0
+#define RSMU_MEM_POWER_CTRL_DIO__RSMU_MEM_POWER_CTRL_DATA_MASK                                                0xFFFFFFFFL
+//RSMU_MP0_STRAPRX_ADDR_DIO
+#define RSMU_MP0_STRAPRX_ADDR_DIO__RSMU_MP0_STRAPRX_ADDR__SHIFT                                               0x0
+#define RSMU_MP0_STRAPRX_ADDR_DIO__RSMU_MP0_STRAPRX_ADDR_MASK                                                 0xFFFFFFFFL
+//RSMU_MP0_STRAPRX_DATA_DIO
+#define RSMU_MP0_STRAPRX_DATA_DIO__RSMU_MP0_STRAPRX_DATA__SHIFT                                               0x0
+#define RSMU_MP0_STRAPRX_DATA_DIO__RSMU_MP0_STRAPRX_DATA_MASK                                                 0xFFFFFFFFL
+//RSMU_PIN_STRAP_DATA_DIO
+#define RSMU_PIN_STRAP_DATA_DIO__RSMU_PIN_STRAP_DATA__SHIFT                                                   0x0
+#define RSMU_PIN_STRAP_DATA_DIO__RSMU_PIN_STRAP_DATA_MASK                                                     0xFFFFFFFFL
+//RSMU_SMS_FUSE_CFG_DIO
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RESETB__SHIFT                                                    0x0
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RUN_BIHR__SHIFT                                                  0x1
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RUN_MBIST__SHIFT                                                 0x2
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_FISO_RESET__SHIFT                                                         0x3
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_FISO_SET__SHIFT                                                           0x4
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RESETB_MASK                                                      0x00000001L
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RUN_BIHR_MASK                                                    0x00000002L
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_SMS_FUSE_RUN_MBIST_MASK                                                   0x00000004L
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_FISO_RESET_MASK                                                           0x00000008L
+#define RSMU_SMS_FUSE_CFG_DIO__RSMU_FISO_SET_MASK                                                             0x00000010L
+//RSMU_SMS_FUSE_ADDR_BASE_DIO
+#define RSMU_SMS_FUSE_ADDR_BASE_DIO__RSMU_SMS_FUSE_ADDR_BASE__SHIFT                                           0x0
+#define RSMU_SMS_FUSE_ADDR_BASE_DIO__RSMU_SMS_FUSE_ADDR_BASE_MASK                                             0x000FFFFFL
+//RSMU_SMS_FUSE_ADDR_OFFSET_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP0__SHIFT                                  0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP1__SHIFT                                  0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP2__SHIFT                                  0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP3__SHIFT                                  0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP0_MASK                                    0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP1_MASK                                    0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP2_MASK                                    0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP3_MASK                                    0xFF000000L
+//RSMU_STRAP_CONTROL_DIO
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_READY__SHIFT                                                    0x0
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_VALID__SHIFT                                                    0x1
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_RELOAD__SHIFT                                                   0x2
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_READY__SHIFT                                                         0x3
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_VALID__SHIFT                                                         0x4
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_RELOAD__SHIFT                                                        0x5
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PIN_RELOAD__SHIFT                                                        0x6
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SEC_FUSE_READY__SHIFT                                                    0x7
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SEC_FUSE_VALID__SHIFT                                                    0x8
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP0__SHIFT                                               0x9
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP1__SHIFT                                               0xa
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP2__SHIFT                                               0xb
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP3__SHIFT                                               0xc
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP0__SHIFT                                               0xd
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP1__SHIFT                                               0xe
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP2__SHIFT                                               0xf
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP3__SHIFT                                               0x10
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP0__SHIFT                                           0x11
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP1__SHIFT                                           0x12
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP2__SHIFT                                           0x13
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP3__SHIFT                                           0x14
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_READY_MASK                                                      0x00000001L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_VALID_MASK                                                      0x00000002L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PUB_FUSE_RELOAD_MASK                                                     0x00000004L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_READY_MASK                                                           0x00000008L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_VALID_MASK                                                           0x00000010L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_ROM_RELOAD_MASK                                                          0x00000020L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_PIN_RELOAD_MASK                                                          0x00000040L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SEC_FUSE_READY_MASK                                                      0x00000080L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SEC_FUSE_VALID_MASK                                                      0x00000100L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP0_MASK                                                 0x00000200L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP1_MASK                                                 0x00000400L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP2_MASK                                                 0x00000800L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_READY_GRP3_MASK                                                 0x00001000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP0_MASK                                                 0x00002000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP1_MASK                                                 0x00004000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP2_MASK                                                 0x00008000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_VALID_GRP3_MASK                                                 0x00010000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP0_MASK                                             0x00020000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP1_MASK                                             0x00040000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP2_MASK                                             0x00080000L
+#define RSMU_STRAP_CONTROL_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP3_MASK                                             0x00100000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP4__SHIFT                         0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP5__SHIFT                         0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP6__SHIFT                         0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP7__SHIFT                         0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP4_MASK                           0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP5_MASK                           0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP6_MASK                           0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET1_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP7_MASK                           0xFF000000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP8__SHIFT                         0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP9__SHIFT                         0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP10__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP11__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP8_MASK                           0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP9_MASK                           0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP10_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET2_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP11_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP12__SHIFT                        0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP13__SHIFT                        0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP14__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP15__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP12_MASK                          0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP13_MASK                          0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP14_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET3_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP15_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP4__SHIFT                              0x0
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP5__SHIFT                              0x1
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP6__SHIFT                              0x2
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP7__SHIFT                              0x3
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP8__SHIFT                              0x4
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP9__SHIFT                              0x5
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP10__SHIFT                             0x6
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP11__SHIFT                             0x7
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP12__SHIFT                             0x8
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP13__SHIFT                             0x9
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP14__SHIFT                             0xa
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP15__SHIFT                             0xb
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP16__SHIFT                             0xc
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP17__SHIFT                             0xd
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP18__SHIFT                             0xe
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP19__SHIFT                             0xf
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP20__SHIFT                             0x10
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP21__SHIFT                             0x11
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP22__SHIFT                             0x12
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP23__SHIFT                             0x13
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP24__SHIFT                             0x14
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP25__SHIFT                             0x15
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP26__SHIFT                             0x16
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP27__SHIFT                             0x17
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP28__SHIFT                             0x18
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP29__SHIFT                             0x19
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP30__SHIFT                             0x1a
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP31__SHIFT                             0x1b
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP4_MASK                                0x00000001L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP5_MASK                                0x00000002L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP6_MASK                                0x00000004L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP7_MASK                                0x00000008L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP8_MASK                                0x00000010L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP9_MASK                                0x00000020L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP10_MASK                               0x00000040L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP11_MASK                               0x00000080L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP12_MASK                               0x00000100L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP13_MASK                               0x00000200L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP14_MASK                               0x00000400L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP15_MASK                               0x00000800L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP16_MASK                               0x00001000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP17_MASK                               0x00002000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP18_MASK                               0x00004000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP19_MASK                               0x00008000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP20_MASK                               0x00010000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP21_MASK                               0x00020000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP22_MASK                               0x00040000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP23_MASK                               0x00080000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP24_MASK                               0x00100000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP25_MASK                               0x00200000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP26_MASK                               0x00400000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP27_MASK                               0x00800000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP28_MASK                               0x01000000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP29_MASK                               0x02000000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP30_MASK                               0x04000000L
+#define RSMU_SMS_FUSE_CNTL_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_READY_GRP31_MASK                               0x08000000L
+//RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP4__SHIFT                            0x0
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP5__SHIFT                            0x1
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP6__SHIFT                            0x2
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP7__SHIFT                            0x3
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP8__SHIFT                            0x4
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP9__SHIFT                            0x5
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP10__SHIFT                           0x6
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP11__SHIFT                           0x7
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP12__SHIFT                           0x8
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP13__SHIFT                           0x9
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP14__SHIFT                           0xa
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP15__SHIFT                           0xb
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP4__SHIFT                        0xc
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP5__SHIFT                        0xd
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP6__SHIFT                        0xe
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP7__SHIFT                        0xf
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP8__SHIFT                        0x10
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP9__SHIFT                        0x11
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP10__SHIFT                       0x12
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP11__SHIFT                       0x13
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP12__SHIFT                       0x14
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP13__SHIFT                       0x15
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP14__SHIFT                       0x16
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP15__SHIFT                       0x17
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP4_MASK                              0x00000001L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP5_MASK                              0x00000002L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP6_MASK                              0x00000004L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP7_MASK                              0x00000008L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP8_MASK                              0x00000010L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP9_MASK                              0x00000020L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP10_MASK                             0x00000040L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP11_MASK                             0x00000080L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP12_MASK                             0x00000100L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP13_MASK                             0x00000200L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP14_MASK                             0x00000400L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_VALID_GRP15_MASK                             0x00000800L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP4_MASK                          0x00001000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP5_MASK                          0x00002000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP6_MASK                          0x00004000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP7_MASK                          0x00008000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP8_MASK                          0x00010000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP9_MASK                          0x00020000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP10_MASK                         0x00040000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP11_MASK                         0x00080000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP12_MASK                         0x00100000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP13_MASK                         0x00200000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP14_MASK                         0x00400000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP15_MASK                         0x00800000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP16__SHIFT                        0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP17__SHIFT                        0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP18__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP19__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP16_MASK                          0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP17_MASK                          0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP18_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET4_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP19_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP20__SHIFT                        0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP21__SHIFT                        0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP22__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP23__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP20_MASK                          0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP21_MASK                          0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP22_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET5_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP23_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP24__SHIFT                        0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP25__SHIFT                        0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP26__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP27__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP24_MASK                          0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP25_MASK                          0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP26_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET6_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP27_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP28__SHIFT                        0x0
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP29__SHIFT                        0x8
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP30__SHIFT                        0x10
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP31__SHIFT                        0x18
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP28_MASK                          0x000000FFL
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP29_MASK                          0x0000FF00L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP30_MASK                          0x00FF0000L
+#define RSMU_SMS_FUSE_ADDR_OFFSET_GRP_SET7_DIO__RSMU_SMS_FUSE_ADDR_OFFSET_GRP31_MASK                          0xFF000000L
+//RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP16__SHIFT                          0x0
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP17__SHIFT                          0x1
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP18__SHIFT                          0x2
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP19__SHIFT                          0x3
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP20__SHIFT                          0x4
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP21__SHIFT                          0x5
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP22__SHIFT                          0x6
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP23__SHIFT                          0x7
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP24__SHIFT                          0x8
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP25__SHIFT                          0x9
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP26__SHIFT                          0xa
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP27__SHIFT                          0xb
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP28__SHIFT                          0xc
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP29__SHIFT                          0xd
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP30__SHIFT                          0xe
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP31__SHIFT                          0xf
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP16__SHIFT                      0x10
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP17__SHIFT                      0x11
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP18__SHIFT                      0x12
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP19__SHIFT                      0x13
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP20__SHIFT                      0x14
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP21__SHIFT                      0x15
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP22__SHIFT                      0x16
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP23__SHIFT                      0x17
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP24__SHIFT                      0x18
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP25__SHIFT                      0x19
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP26__SHIFT                      0x1a
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP27__SHIFT                      0x1b
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP28__SHIFT                      0x1c
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP29__SHIFT                      0x1d
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP30__SHIFT                      0x1e
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP31__SHIFT                      0x1f
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP16_MASK                            0x00000001L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP17_MASK                            0x00000002L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP18_MASK                            0x00000004L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP19_MASK                            0x00000008L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP20_MASK                            0x00000010L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP21_MASK                            0x00000020L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP22_MASK                            0x00000040L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP23_MASK                            0x00000080L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP24_MASK                            0x00000100L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP25_MASK                            0x00000200L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP26_MASK                            0x00000400L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP27_MASK                            0x00000800L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP28_MASK                            0x00001000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP29_MASK                            0x00002000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP30_MASK                            0x00004000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_VALID_GRP31_MASK                            0x00008000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP16_MASK                        0x00010000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP17_MASK                        0x00020000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP18_MASK                        0x00040000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP19_MASK                        0x00080000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP20_MASK                        0x00100000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP21_MASK                        0x00200000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP22_MASK                        0x00400000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP23_MASK                        0x00800000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP24_MASK                        0x01000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP25_MASK                        0x02000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP26_MASK                        0x04000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP27_MASK                        0x08000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP28_MASK                        0x10000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP29_MASK                        0x20000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP30_MASK                        0x40000000L
+#define RSMU_SMS_FUSE_STATUS_SET_NONE_DEFAULT1_DIO__RSMU_SMS_FUSE_BIST_FAIL_GRP31_MASK                        0x80000000L
+//RSMU_CAC_CONTROL_DIO
+#define RSMU_CAC_CONTROL_DIO__RSMU_CAC_WINDOW__SHIFT                                                          0x0
+#define RSMU_CAC_CONTROL_DIO__RSMU_CAC_ENABLE__SHIFT                                                          0x1f
+#define RSMU_CAC_CONTROL_DIO__RSMU_CAC_WINDOW_MASK                                                            0x00FFFFFFL
+#define RSMU_CAC_CONTROL_DIO__RSMU_CAC_ENABLE_MASK                                                            0x80000000L
+//RSMU_CAC_ACC_MASK_LO_DIO
+#define RSMU_CAC_ACC_MASK_LO_DIO__RSMU_CAC_ACC_MASK_LO__SHIFT                                                 0x0
+#define RSMU_CAC_ACC_MASK_LO_DIO__RSMU_CAC_ACC_MASK_LO_MASK                                                   0xFFFFFFFFL
+//RSMU_CAC_WEIGHT_0_DIO
+#define RSMU_CAC_WEIGHT_0_DIO__CAC_WEIGHT_LO_0__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_0_DIO__CAC_WEIGHT_HI_0__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_0_DIO__CAC_WEIGHT_LO_0_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_0_DIO__CAC_WEIGHT_HI_0_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_1_DIO
+#define RSMU_CAC_WEIGHT_1_DIO__CAC_WEIGHT_LO_1__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_1_DIO__CAC_WEIGHT_HI_1__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_1_DIO__CAC_WEIGHT_LO_1_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_1_DIO__CAC_WEIGHT_HI_1_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_2_DIO
+#define RSMU_CAC_WEIGHT_2_DIO__CAC_WEIGHT_LO_2__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_2_DIO__CAC_WEIGHT_HI_2__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_2_DIO__CAC_WEIGHT_LO_2_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_2_DIO__CAC_WEIGHT_HI_2_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_3_DIO
+#define RSMU_CAC_WEIGHT_3_DIO__CAC_WEIGHT_LO_3__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_3_DIO__CAC_WEIGHT_HI_3__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_3_DIO__CAC_WEIGHT_LO_3_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_3_DIO__CAC_WEIGHT_HI_3_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_4_DIO
+#define RSMU_CAC_WEIGHT_4_DIO__CAC_WEIGHT_LO_4__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_4_DIO__CAC_WEIGHT_HI_4__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_4_DIO__CAC_WEIGHT_LO_4_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_4_DIO__CAC_WEIGHT_HI_4_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_5_DIO
+#define RSMU_CAC_WEIGHT_5_DIO__CAC_WEIGHT_LO_5__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_5_DIO__CAC_WEIGHT_HI_5__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_5_DIO__CAC_WEIGHT_LO_5_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_5_DIO__CAC_WEIGHT_HI_5_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_6_DIO
+#define RSMU_CAC_WEIGHT_6_DIO__CAC_WEIGHT_LO_6__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_6_DIO__CAC_WEIGHT_HI_6__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_6_DIO__CAC_WEIGHT_LO_6_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_6_DIO__CAC_WEIGHT_HI_6_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_7_DIO
+#define RSMU_CAC_WEIGHT_7_DIO__CAC_WEIGHT_LO_7__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_7_DIO__CAC_WEIGHT_HI_7__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_7_DIO__CAC_WEIGHT_LO_7_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_7_DIO__CAC_WEIGHT_HI_7_MASK                                                           0xFFFF0000L
+//RSMU_CAC_WEIGHT_8_DIO
+#define RSMU_CAC_WEIGHT_8_DIO__CAC_WEIGHT_LO_8__SHIFT                                                         0x0
+#define RSMU_CAC_WEIGHT_8_DIO__CAC_WEIGHT_HI_8__SHIFT                                                         0x10
+#define RSMU_CAC_WEIGHT_8_DIO__CAC_WEIGHT_LO_8_MASK                                                           0x0000FFFFL
+#define RSMU_CAC_WEIGHT_8_DIO__CAC_WEIGHT_HI_8_MASK                                                           0xFFFF0000L
+//RSMU_CAC_ACC_MASK_HI_DIO
+#define RSMU_CAC_ACC_MASK_HI_DIO__RSMU_CAC_ACC_MASK_HI__SHIFT                                                 0x0
+#define RSMU_CAC_ACC_MASK_HI_DIO__RSMU_CAC_ACC_MASK_HI_MASK                                                   0x0000FFFFL
+//RSMU_MMIOPUB_SCRATCH_REG_0_DIO
+#define RSMU_MMIOPUB_SCRATCH_REG_0_DIO__RSMU_MMIOPUB_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOPUB_SCRATCH_REG_0_DIO__RSMU_MMIOPUB_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_VF_ENABLE_DIO
+#define RSMU_VF_ENABLE_DIO__RSMU_VF_ENABLE__SHIFT                                                             0x0
+#define RSMU_VF_ENABLE_DIO__RSMU_VF_ENABLE_MASK                                                               0x00000001L
+//RSMU_MGCG_CONTROL_DIO
+#define RSMU_MGCG_CONTROL_DIO__RSMU_AXI_SLAVE_MGCG_OVERRIDE__SHIFT                                            0x0
+#define RSMU_MGCG_CONTROL_DIO__RSMU_AXI_MASTER_MGCG_OVERRIDE__SHIFT                                           0x1
+#define RSMU_MGCG_CONTROL_DIO__RSMU_SEC_INTR_MGCG_OVERRIDE__SHIFT                                             0x2
+#define RSMU_MGCG_CONTROL_DIO__RSMU_PWRMGT_INTR_MGCG_OVERRIDE__SHIFT                                          0x3
+#define RSMU_MGCG_CONTROL_DIO__RSMU_REG_WRAPPER_MGCG_OVERRIDE__SHIFT                                          0x4
+#define RSMU_MGCG_CONTROL_DIO__RSMU_STRAP_MASTER_MGCG_OVERRIDE__SHIFT                                         0x5
+#define RSMU_MGCG_CONTROL_DIO__RSMU_VWIRE_SRC_MGCG_OVERRIDE__SHIFT                                            0x6
+#define RSMU_MGCG_CONTROL_DIO__RSMU_REGIF_MASTER_MGCG_OVERRIDE__SHIFT                                         0x7
+#define RSMU_MGCG_CONTROL_DIO__RSMU_PGFSM_MGCG_OVERRIDE__SHIFT                                                0x8
+#define RSMU_MGCG_CONTROL_DIO__RSMU_IH_MGCG_OVERRIDE__SHIFT                                                   0x9
+#define RSMU_MGCG_CONTROL_DIO__RSMU_SEM_MGCG_OVERRIDE__SHIFT                                                  0xa
+#define RSMU_MGCG_CONTROL_DIO__RSMU_DPM_MGCG_OVERRIDE__SHIFT                                                  0xb
+#define RSMU_MGCG_CONTROL_DIO__RSMU_RAS_INTR_MGCG_OVERRIDE__SHIFT                                             0xc
+#define RSMU_MGCG_CONTROL_DIO__RSMU_CAC_MGCG_OVERRIDE__SHIFT                                                  0xd
+#define RSMU_MGCG_CONTROL_DIO__RSMU_XBAR_MGCG_OVERRIDE__SHIFT                                                 0xe
+#define RSMU_MGCG_CONTROL_DIO__RSMU_MCA_IBIR_MGCG_OVERRIDE__SHIFT                                             0xf
+#define RSMU_MGCG_CONTROL_DIO__RSMU_AXI_SLAVE_MGCG_OVERRIDE_MASK                                              0x00000001L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_AXI_MASTER_MGCG_OVERRIDE_MASK                                             0x00000002L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_SEC_INTR_MGCG_OVERRIDE_MASK                                               0x00000004L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_PWRMGT_INTR_MGCG_OVERRIDE_MASK                                            0x00000008L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_REG_WRAPPER_MGCG_OVERRIDE_MASK                                            0x00000010L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_STRAP_MASTER_MGCG_OVERRIDE_MASK                                           0x00000020L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_VWIRE_SRC_MGCG_OVERRIDE_MASK                                              0x00000040L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_REGIF_MASTER_MGCG_OVERRIDE_MASK                                           0x00000080L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_PGFSM_MGCG_OVERRIDE_MASK                                                  0x00000100L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_IH_MGCG_OVERRIDE_MASK                                                     0x00000200L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_SEM_MGCG_OVERRIDE_MASK                                                    0x00000400L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_DPM_MGCG_OVERRIDE_MASK                                                    0x00000800L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_RAS_INTR_MGCG_OVERRIDE_MASK                                               0x00001000L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_CAC_MGCG_OVERRIDE_MASK                                                    0x00002000L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_XBAR_MGCG_OVERRIDE_MASK                                                   0x00004000L
+#define RSMU_MGCG_CONTROL_DIO__RSMU_MCA_IBIR_MGCG_OVERRIDE_MASK                                               0x00008000L
+//RSMU_AXI_MASTER_QOS_CNTL_DIO
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_MASTER_QOS_OVRD_MODE__SHIFT                                        0x0
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_MASTER_QOS_OVRD_VALUE__SHIFT                                       0x1
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_AWQOS_OVRD_MODE__SHIFT                                   0x5
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_AWQOS_OVRD_VALUE__SHIFT                                  0x6
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_ARQOS_OVRD_MODE__SHIFT                                   0xa
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_ARQOS_OVRD_VALUE__SHIFT                                  0xb
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_MASTER_QOS_OVRD_MODE_MASK                                          0x00000001L
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_MASTER_QOS_OVRD_VALUE_MASK                                         0x0000001EL
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_AWQOS_OVRD_MODE_MASK                                     0x00000020L
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_AWQOS_OVRD_VALUE_MASK                                    0x000003C0L
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_ARQOS_OVRD_MODE_MASK                                     0x00000400L
+#define RSMU_AXI_MASTER_QOS_CNTL_DIO__RSMU_IP_MASTER_ARQOS_OVRD_VALUE_MASK                                    0x00007800L
+//RSMU_MASTER_ERROR_COUNTER_DIO
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_SMN_SLVERR_COUNTER__SHIFT                                         0x0
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_SMN_DECERR_COUNTER__SHIFT                                         0x8
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_MASTER_SLVERR_COUNTER__SHIFT                                      0x10
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_MASTER_DECERR_COUNTER__SHIFT                                      0x18
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_SMN_SLVERR_COUNTER_MASK                                           0x000000FFL
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_SMN_DECERR_COUNTER_MASK                                           0x0000FF00L
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_MASTER_SLVERR_COUNTER_MASK                                        0x00FF0000L
+#define RSMU_MASTER_ERROR_COUNTER_DIO__RSMU_MASTER_DECERR_COUNTER_MASK                                        0xFF000000L
+//RSMU_SLAVE_TIMEOUT_VALUE_DIO
+#define RSMU_SLAVE_TIMEOUT_VALUE_DIO__RSMU_SLAVE_TIMEOUT_VALUE__SHIFT                                         0x0
+#define RSMU_SLAVE_TIMEOUT_VALUE_DIO__RSMU_SLAVE_TIMEOUT_VALUE_MASK                                           0xFFFFFFFFL
+//RSMU_RESET_TIMEOUT_CONTROL_DIO
+#define RSMU_RESET_TIMEOUT_CONTROL_DIO__RSMU_SLAVE_TIMEOUT_ENABLE__SHIFT                                      0x0
+#define RSMU_RESET_TIMEOUT_CONTROL_DIO__RSMU_SLAVE_RESET_TIMEOUT_VALUE__SHIFT                                 0x1
+#define RSMU_RESET_TIMEOUT_CONTROL_DIO__RSMU_SLAVE_TIMEOUT_ENABLE_MASK                                        0x00000001L
+#define RSMU_RESET_TIMEOUT_CONTROL_DIO__RSMU_SLAVE_RESET_TIMEOUT_VALUE_MASK                                   0x000001FEL
+//RSMU_SLAVE_ERROR_COUNTER_DIO
+#define RSMU_SLAVE_ERROR_COUNTER_DIO__RSMU_SLAVE_ERROR_COUNTER__SHIFT                                         0x0
+#define RSMU_SLAVE_ERROR_COUNTER_DIO__RSMU_SLAVE_ERROR_COUNTER_MASK                                           0x000000FFL
+//RSMU_DBG_MUX_CONTROL_DIO
+#define RSMU_DBG_MUX_CONTROL_DIO__RSMU_DBG_MUX_SELECT__SHIFT                                                  0x0
+#define RSMU_DBG_MUX_CONTROL_DIO__RSMU_DBG_SIGNATURE__SHIFT                                                   0x18
+#define RSMU_DBG_MUX_CONTROL_DIO__RSMU_DBG_MUX_SELECT_MASK                                                    0x000000FFL
+#define RSMU_DBG_MUX_CONTROL_DIO__RSMU_DBG_SIGNATURE_MASK                                                     0xFF000000L
+//RSMU_IP_CLOCK_GATE_CNTL_DIO
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_MGCG_ENABLE__SHIFT                                               0x0
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_MEMVIEW_FGCG_OVRD__SHIFT                                         0x1
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_RDFT_SMS_IF_FGCG_OVRD__SHIFT                                        0x2
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_FORCE_CLKOFF__SHIFT                                              0x1f
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_MGCG_ENABLE_MASK                                                 0x00000001L
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_MEMVIEW_FGCG_OVRD_MASK                                           0x00000002L
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_RDFT_SMS_IF_FGCG_OVRD_MASK                                          0x00000004L
+#define RSMU_IP_CLOCK_GATE_CNTL_DIO__RSMU_IP_FORCE_CLKOFF_MASK                                                0x80000000L
+//RSMU_CAC_ACC_0_DIO
+#define RSMU_CAC_ACC_0_DIO__RSMU_CAC_ACC_0__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_0_DIO__RSMU_CAC_ACC_0_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_1_DIO
+#define RSMU_CAC_ACC_1_DIO__RSMU_CAC_ACC_1__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_1_DIO__RSMU_CAC_ACC_1_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_2_DIO
+#define RSMU_CAC_ACC_2_DIO__RSMU_CAC_ACC_2__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_2_DIO__RSMU_CAC_ACC_2_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_3_DIO
+#define RSMU_CAC_ACC_3_DIO__RSMU_CAC_ACC_3__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_3_DIO__RSMU_CAC_ACC_3_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_4_DIO
+#define RSMU_CAC_ACC_4_DIO__RSMU_CAC_ACC_4__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_4_DIO__RSMU_CAC_ACC_4_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_5_DIO
+#define RSMU_CAC_ACC_5_DIO__RSMU_CAC_ACC_5__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_5_DIO__RSMU_CAC_ACC_5_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_6_DIO
+#define RSMU_CAC_ACC_6_DIO__RSMU_CAC_ACC_6__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_6_DIO__RSMU_CAC_ACC_6_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_7_DIO
+#define RSMU_CAC_ACC_7_DIO__RSMU_CAC_ACC_7__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_7_DIO__RSMU_CAC_ACC_7_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_8_DIO
+#define RSMU_CAC_ACC_8_DIO__RSMU_CAC_ACC_8__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_8_DIO__RSMU_CAC_ACC_8_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_9_DIO
+#define RSMU_CAC_ACC_9_DIO__RSMU_CAC_ACC_9__SHIFT                                                             0x0
+#define RSMU_CAC_ACC_9_DIO__RSMU_CAC_ACC_9_MASK                                                               0xFFFFFFFFL
+//RSMU_CAC_ACC_10_DIO
+#define RSMU_CAC_ACC_10_DIO__RSMU_CAC_ACC_10__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_10_DIO__RSMU_CAC_ACC_10_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_11_DIO
+#define RSMU_CAC_ACC_11_DIO__RSMU_CAC_ACC_11__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_11_DIO__RSMU_CAC_ACC_11_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_12_DIO
+#define RSMU_CAC_ACC_12_DIO__RSMU_CAC_ACC_12__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_12_DIO__RSMU_CAC_ACC_12_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_13_DIO
+#define RSMU_CAC_ACC_13_DIO__RSMU_CAC_ACC_13__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_13_DIO__RSMU_CAC_ACC_13_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_14_DIO
+#define RSMU_CAC_ACC_14_DIO__RSMU_CAC_ACC_14__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_14_DIO__RSMU_CAC_ACC_14_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_15_DIO
+#define RSMU_CAC_ACC_15_DIO__RSMU_CAC_ACC_15__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_15_DIO__RSMU_CAC_ACC_15_MASK                                                             0xFFFFFFFFL
+//RSMU_CAC_ACC_16_DIO
+#define RSMU_CAC_ACC_16_DIO__RSMU_CAC_ACC_16__SHIFT                                                           0x0
+#define RSMU_CAC_ACC_16_DIO__RSMU_CAC_ACC_16_MASK                                                             0xFFFFFFFFL
+//RSMU_MSMU_FETCH_FUSE_DIO
+#define RSMU_MSMU_FETCH_FUSE_DIO__RSMU_FUSE_UPPER_256KB_H_OFFSET__SHIFT                                       0x0
+#define RSMU_MSMU_FETCH_FUSE_DIO__RSMU_FUSE_APERTURE_ID_H_OFFSET__SHIFT                                       0x2
+#define RSMU_MSMU_FETCH_FUSE_DIO__RSMU_FUSE_UPPER_256KB_H_OFFSET_MASK                                         0x00000003L
+#define RSMU_MSMU_FETCH_FUSE_DIO__RSMU_FUSE_APERTURE_ID_H_OFFSET_MASK                                         0x00003FFCL
+//RSMU_MSMU_FETCH_ROM_DIO
+#define RSMU_MSMU_FETCH_ROM_DIO__RSMU_ROM_QUARTER_INDEX_H_OFFSET__SHIFT                                       0x0
+#define RSMU_MSMU_FETCH_ROM_DIO__RSMU_ROM_APERTURE_ID_H_OFFSET__SHIFT                                         0x2
+#define RSMU_MSMU_FETCH_ROM_DIO__RSMU_ROM_QUARTER_INDEX_H_OFFSET_MASK                                         0x00000003L
+#define RSMU_MSMU_FETCH_ROM_DIO__RSMU_ROM_APERTURE_ID_H_OFFSET_MASK                                           0x00003FFCL
+//RSMU_STRAP_STATUS_DIO
+#define RSMU_STRAP_STATUS_DIO__RSMU_PUBLIC_FUSE_STATUS__SHIFT                                                 0x0
+#define RSMU_STRAP_STATUS_DIO__RSMU_SECURITY_FUSE_STATUS__SHIFT                                               0x8
+#define RSMU_STRAP_STATUS_DIO__RSMU_SMS_FUSE_STATUS__SHIFT                                                    0x10
+#define RSMU_STRAP_STATUS_DIO__RSMU_ROM_STRAP_STATUS__SHIFT                                                   0x18
+#define RSMU_STRAP_STATUS_DIO__RSMU_PUBLIC_FUSE_STATUS_MASK                                                   0x00000001L
+#define RSMU_STRAP_STATUS_DIO__RSMU_SECURITY_FUSE_STATUS_MASK                                                 0x00000100L
+#define RSMU_STRAP_STATUS_DIO__RSMU_SMS_FUSE_STATUS_MASK                                                      0x00010000L
+#define RSMU_STRAP_STATUS_DIO__RSMU_ROM_STRAP_STATUS_MASK                                                     0x01000000L
+//RSMU_SMS_FUSE_CLEAR_SET0_DIO
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP0__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP1__SHIFT                                         0x1
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP2__SHIFT                                         0x2
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP3__SHIFT                                         0x3
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP4__SHIFT                                         0x4
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP5__SHIFT                                         0x5
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP6__SHIFT                                         0x6
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP7__SHIFT                                         0x7
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP8__SHIFT                                         0x8
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP9__SHIFT                                         0x9
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP10__SHIFT                                        0xa
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP11__SHIFT                                        0xb
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP12__SHIFT                                        0xc
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP13__SHIFT                                        0xd
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP14__SHIFT                                        0xe
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP15__SHIFT                                        0xf
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP16__SHIFT                                        0x10
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP17__SHIFT                                        0x11
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP18__SHIFT                                        0x12
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP19__SHIFT                                        0x13
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP20__SHIFT                                        0x14
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP21__SHIFT                                        0x15
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP22__SHIFT                                        0x16
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP23__SHIFT                                        0x17
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP24__SHIFT                                        0x18
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP25__SHIFT                                        0x19
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP26__SHIFT                                        0x1a
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP27__SHIFT                                        0x1b
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP28__SHIFT                                        0x1c
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP29__SHIFT                                        0x1d
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP30__SHIFT                                        0x1e
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP31__SHIFT                                        0x1f
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP0_MASK                                           0x00000001L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP1_MASK                                           0x00000002L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP2_MASK                                           0x00000004L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP3_MASK                                           0x00000008L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP4_MASK                                           0x00000010L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP5_MASK                                           0x00000020L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP6_MASK                                           0x00000040L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP7_MASK                                           0x00000080L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP8_MASK                                           0x00000100L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP9_MASK                                           0x00000200L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP10_MASK                                          0x00000400L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP11_MASK                                          0x00000800L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP12_MASK                                          0x00001000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP13_MASK                                          0x00002000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP14_MASK                                          0x00004000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP15_MASK                                          0x00008000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP16_MASK                                          0x00010000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP17_MASK                                          0x00020000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP18_MASK                                          0x00040000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP19_MASK                                          0x00080000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP20_MASK                                          0x00100000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP21_MASK                                          0x00200000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP22_MASK                                          0x00400000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP23_MASK                                          0x00800000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP24_MASK                                          0x01000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP25_MASK                                          0x02000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP26_MASK                                          0x04000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP27_MASK                                          0x08000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP28_MASK                                          0x10000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP29_MASK                                          0x20000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP30_MASK                                          0x40000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_DIO__RSMU_SMS_FUSE_CLEAR_GRP31_MASK                                          0x80000000L
+//RSMU_SMS_FUSE_DATA_GRP_0_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_0_DIO__RSMU_SMS_FUSE_DATA_GRP_0__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_0_DIO__RSMU_SMS_FUSE_DATA_GRP_0_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_1_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_1_DIO__RSMU_SMS_FUSE_DATA_GRP_1__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_1_DIO__RSMU_SMS_FUSE_DATA_GRP_1_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_2_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_2_DIO__RSMU_SMS_FUSE_DATA_GRP_2__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_2_DIO__RSMU_SMS_FUSE_DATA_GRP_2_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_3_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_3_DIO__RSMU_SMS_FUSE_DATA_GRP_3__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_3_DIO__RSMU_SMS_FUSE_DATA_GRP_3_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_4_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_4_DIO__RSMU_SMS_FUSE_DATA_GRP_4__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_4_DIO__RSMU_SMS_FUSE_DATA_GRP_4_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_5_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_5_DIO__RSMU_SMS_FUSE_DATA_GRP_5__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_5_DIO__RSMU_SMS_FUSE_DATA_GRP_5_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_6_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_6_DIO__RSMU_SMS_FUSE_DATA_GRP_6__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_6_DIO__RSMU_SMS_FUSE_DATA_GRP_6_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_7_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_7_DIO__RSMU_SMS_FUSE_DATA_GRP_7__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_7_DIO__RSMU_SMS_FUSE_DATA_GRP_7_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_8_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_8_DIO__RSMU_SMS_FUSE_DATA_GRP_8__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_8_DIO__RSMU_SMS_FUSE_DATA_GRP_8_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_9_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_9_DIO__RSMU_SMS_FUSE_DATA_GRP_9__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_DATA_GRP_9_DIO__RSMU_SMS_FUSE_DATA_GRP_9_MASK                                           0xFFFFFFFFL
+//RSMU_SMS_FUSE_DATA_GRP_10_DIO
+#define RSMU_SMS_FUSE_DATA_GRP_10_DIO__RSMU_SMS_FUSE_DATA_GRP_10__SHIFT                                       0x0
+#define RSMU_SMS_FUSE_DATA_GRP_10_DIO__RSMU_SMS_FUSE_DATA_GRP_10_MASK                                         0xFFFFFFFFL
+//RSMU_SMS_FUSE_FIFO_EMPTY_DIO
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP0__SHIFT                                    0x0
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP1__SHIFT                                    0x1
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP2__SHIFT                                    0x2
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP3__SHIFT                                    0x3
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP4__SHIFT                                    0x4
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP5__SHIFT                                    0x5
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP6__SHIFT                                    0x6
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP7__SHIFT                                    0x7
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP8__SHIFT                                    0x8
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP9__SHIFT                                    0x9
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP10__SHIFT                                   0xa
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP11__SHIFT                                   0xb
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP12__SHIFT                                   0xc
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP13__SHIFT                                   0xd
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP14__SHIFT                                   0xe
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP15__SHIFT                                   0xf
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP16__SHIFT                                   0x10
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP17__SHIFT                                   0x11
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP18__SHIFT                                   0x12
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP19__SHIFT                                   0x13
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP20__SHIFT                                   0x14
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP21__SHIFT                                   0x15
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP22__SHIFT                                   0x16
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP23__SHIFT                                   0x17
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP24__SHIFT                                   0x18
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP25__SHIFT                                   0x19
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP26__SHIFT                                   0x1a
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP27__SHIFT                                   0x1b
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP28__SHIFT                                   0x1c
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP29__SHIFT                                   0x1d
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP30__SHIFT                                   0x1e
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP31__SHIFT                                   0x1f
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP0_MASK                                      0x00000001L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP1_MASK                                      0x00000002L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP2_MASK                                      0x00000004L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP3_MASK                                      0x00000008L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP4_MASK                                      0x00000010L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP5_MASK                                      0x00000020L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP6_MASK                                      0x00000040L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP7_MASK                                      0x00000080L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP8_MASK                                      0x00000100L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP9_MASK                                      0x00000200L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP10_MASK                                     0x00000400L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP11_MASK                                     0x00000800L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP12_MASK                                     0x00001000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP13_MASK                                     0x00002000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP14_MASK                                     0x00004000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP15_MASK                                     0x00008000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP16_MASK                                     0x00010000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP17_MASK                                     0x00020000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP18_MASK                                     0x00040000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP19_MASK                                     0x00080000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP20_MASK                                     0x00100000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP21_MASK                                     0x00200000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP22_MASK                                     0x00400000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP23_MASK                                     0x00800000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP24_MASK                                     0x01000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP25_MASK                                     0x02000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP26_MASK                                     0x04000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP27_MASK                                     0x08000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP28_MASK                                     0x10000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP29_MASK                                     0x20000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP30_MASK                                     0x40000000L
+#define RSMU_SMS_FUSE_FIFO_EMPTY_DIO__RSMU_SMS_FUSE_FIFO_EMPTY_GRP31_MASK                                     0x80000000L
+//RSMU_SMS_FUSE_FIFO_FULL_DIO
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP0__SHIFT                                      0x0
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP1__SHIFT                                      0x1
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP2__SHIFT                                      0x2
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP3__SHIFT                                      0x3
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP4__SHIFT                                      0x4
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP5__SHIFT                                      0x5
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP6__SHIFT                                      0x6
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP7__SHIFT                                      0x7
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP8__SHIFT                                      0x8
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP9__SHIFT                                      0x9
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP10__SHIFT                                     0xa
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP11__SHIFT                                     0xb
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP12__SHIFT                                     0xc
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP13__SHIFT                                     0xd
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP14__SHIFT                                     0xe
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP15__SHIFT                                     0xf
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP16__SHIFT                                     0x10
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP17__SHIFT                                     0x11
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP18__SHIFT                                     0x12
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP19__SHIFT                                     0x13
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP20__SHIFT                                     0x14
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP21__SHIFT                                     0x15
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP22__SHIFT                                     0x16
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP23__SHIFT                                     0x17
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP24__SHIFT                                     0x18
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP25__SHIFT                                     0x19
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP26__SHIFT                                     0x1a
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP27__SHIFT                                     0x1b
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP28__SHIFT                                     0x1c
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP29__SHIFT                                     0x1d
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP30__SHIFT                                     0x1e
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP31__SHIFT                                     0x1f
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP0_MASK                                        0x00000001L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP1_MASK                                        0x00000002L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP2_MASK                                        0x00000004L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP3_MASK                                        0x00000008L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP4_MASK                                        0x00000010L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP5_MASK                                        0x00000020L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP6_MASK                                        0x00000040L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP7_MASK                                        0x00000080L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP8_MASK                                        0x00000100L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP9_MASK                                        0x00000200L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP10_MASK                                       0x00000400L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP11_MASK                                       0x00000800L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP12_MASK                                       0x00001000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP13_MASK                                       0x00002000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP14_MASK                                       0x00004000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP15_MASK                                       0x00008000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP16_MASK                                       0x00010000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP17_MASK                                       0x00020000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP18_MASK                                       0x00040000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP19_MASK                                       0x00080000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP20_MASK                                       0x00100000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP21_MASK                                       0x00200000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP22_MASK                                       0x00400000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP23_MASK                                       0x00800000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP24_MASK                                       0x01000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP25_MASK                                       0x02000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP26_MASK                                       0x04000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP27_MASK                                       0x08000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP28_MASK                                       0x10000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP29_MASK                                       0x20000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP30_MASK                                       0x40000000L
+#define RSMU_SMS_FUSE_FIFO_FULL_DIO__RSMU_SMS_FUSE_FIFO_FULL_GRP31_MASK                                       0x80000000L
+//RSMU_ASP_FUSE_ADDR_DIO
+#define RSMU_ASP_FUSE_ADDR_DIO__RSMU_ASP_FUSE_ADDR__SHIFT                                                     0x0
+#define RSMU_ASP_FUSE_ADDR_DIO__RSMU_ASP_FUSE_ADDR_MASK                                                       0x000000FFL
+//RSMU_ASP_FUSE_DATA_DIO
+#define RSMU_ASP_FUSE_DATA_DIO__RSMU_ASP_FUSE_DATA__SHIFT                                                     0x0
+#define RSMU_ASP_FUSE_DATA_DIO__RSMU_ASP_FUSE_DATA_MASK                                                       0xFFFFFFFFL
+//RSMU_ASP_STRAP_CONTROL_DIO
+#define RSMU_ASP_STRAP_CONTROL_DIO__RSMU_ASP_FUSE_RELOAD__SHIFT                                               0x0
+#define RSMU_ASP_STRAP_CONTROL_DIO__RSMU_ASP_FUSE_RELOAD_MASK                                                 0x00000001L
+//RSMU_SMS_FUSE_RETRIGGER_SET0_DIO
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_DIO__RSMU_SMS_FUSE_RETRIGGER_SET0__SHIFT                                 0x0
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_DIO__RSMU_SMS_FUSE_RETRIGGER_SET0_MASK                                   0xFFFFFFFFL
+//RSMU_XBAR_CG_MISC_DIO
+#define RSMU_XBAR_CG_MISC_DIO__RSMU_XBAR_CG_TIMEOUT_VALUE__SHIFT                                              0x0
+#define RSMU_XBAR_CG_MISC_DIO__RSMU_XBAR_CSYS_DELAY__SHIFT                                                    0x8
+#define RSMU_XBAR_CG_MISC_DIO__RSMU_XBAR_CG_TIMEOUT_VALUE_MASK                                                0x000000FFL
+#define RSMU_XBAR_CG_MISC_DIO__RSMU_XBAR_CSYS_DELAY_MASK                                                      0x0000FF00L
+//RSMU_XBAR_CG_CTRL_DIO
+#define RSMU_XBAR_CG_CTRL_DIO__RSMU_XBAR_CACTIVE_EN__SHIFT                                                    0x0
+#define RSMU_XBAR_CG_CTRL_DIO__RSMU_XBAR_CACTIVE_EN_MASK                                                      0x00000001L
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmioextDioDec
+//RSMU_TIMEOUT_ERROR_LOG_REG1_DIO
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DIO__RSMU_TIMEOUT_ERROR_REMOTE_FLAG__SHIFT                                0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DIO__RSMU_TIMEOUT_ERROR_NODE_ID__SHIFT                                    0x1
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DIO__RSMU_TIMEOUT_ERROR_REMOTE_FLAG_MASK                                  0x00000001L
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_DIO__RSMU_TIMEOUT_ERROR_NODE_ID_MASK                                      0x0000FFFEL
+//RSMU_SW_STRAPRX_ADDR_DIO
+#define RSMU_SW_STRAPRX_ADDR_DIO__RSMU_SW_STRAPRX_ADDR__SHIFT                                                 0x0
+#define RSMU_SW_STRAPRX_ADDR_DIO__RSMU_SW_STRAPRX_ADDR_MASK                                                   0xFFFFFFFFL
+//RSMU_SW_STRAPRX_DATA_DIO
+#define RSMU_SW_STRAPRX_DATA_DIO__RSMU_SW_STRAPRX_DATA__SHIFT                                                 0x0
+#define RSMU_SW_STRAPRX_DATA_DIO__RSMU_SW_STRAPRX_DATA_MASK                                                   0xFFFFFFFFL
+//RSMU_SW_STRAP_CONTROL_DIO
+#define RSMU_SW_STRAP_CONTROL_DIO__RSMU_SW_ROM_RELOAD__SHIFT                                                  0x0
+#define RSMU_SW_STRAP_CONTROL_DIO__RSMU_SW_ROM_RELOAD_MASK                                                    0x00000001L
+//RSMU_TIMEOUT_ERROR_LOG_REG_DIO
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_ADDR__SHIFT                                        0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_INITIATORID__SHIFT                                 0x14
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_OP__SHIFT                                          0x1e
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_OUTSTANDING__SHIFT                                 0x1f
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_ADDR_MASK                                          0x000FFFFFL
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_INITIATORID_MASK                                   0x3FF00000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_OP_MASK                                            0x40000000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_DIO__RSMU_TIMEOUT_ERROR_OUTSTANDING_MASK                                   0x80000000L
+//RSMU_IP_MASTER_STATUS_DIO
+#define RSMU_IP_MASTER_STATUS_DIO__RSMU_IP_MASTER_REQ_PENDING__SHIFT                                          0x0
+#define RSMU_IP_MASTER_STATUS_DIO__RSMU_IP_MASTER_RESP_PENDING__SHIFT                                         0x1
+#define RSMU_IP_MASTER_STATUS_DIO__RSMU_IP_MASTER_REQ_PENDING_MASK                                            0x00000001L
+#define RSMU_IP_MASTER_STATUS_DIO__RSMU_IP_MASTER_RESP_PENDING_MASK                                           0x00000002L
+//RSMU_MMIOEXT_SCRATCH_REG_0_DIO
+#define RSMU_MMIOEXT_SCRATCH_REG_0_DIO__RSMU_MMIOEXT_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_0_DIO__RSMU_MMIOEXT_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_MMIOEXT_SCRATCH_REG_1_DIO
+#define RSMU_MMIOEXT_SCRATCH_REG_1_DIO__RSMU_MMIOEXT_SCRATCH_REG_1__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_1_DIO__RSMU_MMIOEXT_SCRATCH_REG_1_MASK                                       0xFFFFFFFFL
+//RSMU_VERSION_DIO
+#define RSMU_VERSION_DIO__RSMU_VERSION_LOW__SHIFT                                                             0x0
+#define RSMU_VERSION_DIO__RSMU_VERSION_MIDDLE__SHIFT                                                          0x8
+#define RSMU_VERSION_DIO__RSMU_VERSION_HIGH__SHIFT                                                            0x10
+#define RSMU_VERSION_DIO__RSMU_VERSION_LOW_MASK                                                               0x000000FFL
+#define RSMU_VERSION_DIO__RSMU_VERSION_MIDDLE_MASK                                                            0x0000FF00L
+#define RSMU_VERSION_DIO__RSMU_VERSION_HIGH_MASK                                                              0x00FF0000L
+
+
+// addressBlock: dce_rsmu_dio_rsmu_dio_RsmuMmiosecDioDec
+//RSMU_AEB_OVERRIDE_0_DIO
+#define RSMU_AEB_OVERRIDE_0_DIO__RSMU_AEB_OVERRIDE_0__SHIFT                                                   0x3
+#define RSMU_AEB_OVERRIDE_0_DIO__RSMU_AEB_OVERRIDE_0_MASK                                                     0xFFFFFFF8L
+//RSMU_AEB_OVERRIDE_1_DIO
+#define RSMU_AEB_OVERRIDE_1_DIO__RSMU_AEB_OVERRIDE_1__SHIFT                                                   0x0
+#define RSMU_AEB_OVERRIDE_1_DIO__RSMU_AEB_OVERRIDE_1_MASK                                                     0xFFFFFFFFL
+//RSMU_MMIOSEC_SCRATCH_REG_0_DIO
+#define RSMU_MMIOSEC_SCRATCH_REG_0_DIO__RSMU_MMIOSEC_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOSEC_SCRATCH_REG_0_DIO__RSMU_MMIOSEC_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_AEB_VALUE_0_DIO
+#define RSMU_AEB_VALUE_0_DIO__RSMU_AEB_VALUE_0__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_0_DIO__RSMU_AEB_VALUE_0_MASK                                                           0xFFFFFFFFL
+//RSMU_AEB_VALUE_1_DIO
+#define RSMU_AEB_VALUE_1_DIO__RSMU_AEB_VALUE_1__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_1_DIO__RSMU_AEB_VALUE_1_MASK                                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmiopubHdaDec
+//RSMU_MEM_POWER_CTRL2_HDA
+#define RSMU_MEM_POWER_CTRL2_HDA__RSMU_MEM_POWER_CTRL2_DATA__SHIFT                                            0x0
+#define RSMU_MEM_POWER_CTRL2_HDA__RSMU_MEM_POWER_CTRL2_DATA_MASK                                              0xFFFFFFFFL
+//RSMU_HARD_RESETB_HDA
+#define RSMU_HARD_RESETB_HDA__RSMU_HARD_RESETB__SHIFT                                                         0x0
+#define RSMU_HARD_RESETB_HDA__RSMU_MASTER_HARD_RESET_FENCE_ENABLE__SHIFT                                      0x2
+#define RSMU_HARD_RESETB_HDA__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE__SHIFT                                     0x5
+#define RSMU_HARD_RESETB_HDA__RSMU_HARD_RESETB_MASK                                                           0x00000003L
+#define RSMU_HARD_RESETB_HDA__RSMU_MASTER_HARD_RESET_FENCE_ENABLE_MASK                                        0x0000000CL
+#define RSMU_HARD_RESETB_HDA__RSMU_SLAVE_HARD_RESET_TIMEOUT_ENABLE_MASK                                       0x00000060L
+//RSMU_MEM_POWER_CTRL_HDA
+#define RSMU_MEM_POWER_CTRL_HDA__RSMU_MEM_POWER_CTRL_DATA__SHIFT                                              0x0
+#define RSMU_MEM_POWER_CTRL_HDA__RSMU_MEM_POWER_CTRL_DATA_MASK                                                0xFFFFFFFFL
+//RSMU_STRAP_CONTROL_HDA
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_READY__SHIFT                                                    0x0
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_VALID__SHIFT                                                    0x1
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_RELOAD__SHIFT                                                   0x2
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_READY__SHIFT                                                         0x3
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_VALID__SHIFT                                                         0x4
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_RELOAD__SHIFT                                                        0x5
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PIN_RELOAD__SHIFT                                                        0x6
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SEC_FUSE_READY__SHIFT                                                    0x7
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SEC_FUSE_VALID__SHIFT                                                    0x8
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP0__SHIFT                                               0x9
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP1__SHIFT                                               0xa
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP2__SHIFT                                               0xb
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP3__SHIFT                                               0xc
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP0__SHIFT                                               0xd
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP1__SHIFT                                               0xe
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP2__SHIFT                                               0xf
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP3__SHIFT                                               0x10
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP0__SHIFT                                           0x11
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP1__SHIFT                                           0x12
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP2__SHIFT                                           0x13
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP3__SHIFT                                           0x14
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_READY_MASK                                                      0x00000001L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_VALID_MASK                                                      0x00000002L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PUB_FUSE_RELOAD_MASK                                                     0x00000004L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_READY_MASK                                                           0x00000008L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_VALID_MASK                                                           0x00000010L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_ROM_RELOAD_MASK                                                          0x00000020L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_PIN_RELOAD_MASK                                                          0x00000040L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SEC_FUSE_READY_MASK                                                      0x00000080L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SEC_FUSE_VALID_MASK                                                      0x00000100L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP0_MASK                                                 0x00000200L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP1_MASK                                                 0x00000400L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP2_MASK                                                 0x00000800L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_READY_GRP3_MASK                                                 0x00001000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP0_MASK                                                 0x00002000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP1_MASK                                                 0x00004000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP2_MASK                                                 0x00008000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_VALID_GRP3_MASK                                                 0x00010000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP0_MASK                                             0x00020000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP1_MASK                                             0x00040000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP2_MASK                                             0x00080000L
+#define RSMU_STRAP_CONTROL_HDA__RSMU_SMS_FUSE_BIST_FAIL_GRP3_MASK                                             0x00100000L
+//RSMU_MMIOPUB_SCRATCH_REG_0_HDA
+#define RSMU_MMIOPUB_SCRATCH_REG_0_HDA__RSMU_MMIOPUB_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOPUB_SCRATCH_REG_0_HDA__RSMU_MMIOPUB_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_VF_ENABLE_HDA
+#define RSMU_VF_ENABLE_HDA__RSMU_VF_ENABLE__SHIFT                                                             0x0
+#define RSMU_VF_ENABLE_HDA__RSMU_VF_ENABLE_MASK                                                               0x00000001L
+//RSMU_MGCG_CONTROL_HDA
+#define RSMU_MGCG_CONTROL_HDA__RSMU_AXI_SLAVE_MGCG_OVERRIDE__SHIFT                                            0x0
+#define RSMU_MGCG_CONTROL_HDA__RSMU_AXI_MASTER_MGCG_OVERRIDE__SHIFT                                           0x1
+#define RSMU_MGCG_CONTROL_HDA__RSMU_SEC_INTR_MGCG_OVERRIDE__SHIFT                                             0x2
+#define RSMU_MGCG_CONTROL_HDA__RSMU_PWRMGT_INTR_MGCG_OVERRIDE__SHIFT                                          0x3
+#define RSMU_MGCG_CONTROL_HDA__RSMU_REG_WRAPPER_MGCG_OVERRIDE__SHIFT                                          0x4
+#define RSMU_MGCG_CONTROL_HDA__RSMU_STRAP_MASTER_MGCG_OVERRIDE__SHIFT                                         0x5
+#define RSMU_MGCG_CONTROL_HDA__RSMU_VWIRE_SRC_MGCG_OVERRIDE__SHIFT                                            0x6
+#define RSMU_MGCG_CONTROL_HDA__RSMU_REGIF_MASTER_MGCG_OVERRIDE__SHIFT                                         0x7
+#define RSMU_MGCG_CONTROL_HDA__RSMU_PGFSM_MGCG_OVERRIDE__SHIFT                                                0x8
+#define RSMU_MGCG_CONTROL_HDA__RSMU_IH_MGCG_OVERRIDE__SHIFT                                                   0x9
+#define RSMU_MGCG_CONTROL_HDA__RSMU_SEM_MGCG_OVERRIDE__SHIFT                                                  0xa
+#define RSMU_MGCG_CONTROL_HDA__RSMU_DPM_MGCG_OVERRIDE__SHIFT                                                  0xb
+#define RSMU_MGCG_CONTROL_HDA__RSMU_RAS_INTR_MGCG_OVERRIDE__SHIFT                                             0xc
+#define RSMU_MGCG_CONTROL_HDA__RSMU_CAC_MGCG_OVERRIDE__SHIFT                                                  0xd
+#define RSMU_MGCG_CONTROL_HDA__RSMU_XBAR_MGCG_OVERRIDE__SHIFT                                                 0xe
+#define RSMU_MGCG_CONTROL_HDA__RSMU_MCA_IBIR_MGCG_OVERRIDE__SHIFT                                             0xf
+#define RSMU_MGCG_CONTROL_HDA__RSMU_AXI_SLAVE_MGCG_OVERRIDE_MASK                                              0x00000001L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_AXI_MASTER_MGCG_OVERRIDE_MASK                                             0x00000002L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_SEC_INTR_MGCG_OVERRIDE_MASK                                               0x00000004L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_PWRMGT_INTR_MGCG_OVERRIDE_MASK                                            0x00000008L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_REG_WRAPPER_MGCG_OVERRIDE_MASK                                            0x00000010L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_STRAP_MASTER_MGCG_OVERRIDE_MASK                                           0x00000020L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_VWIRE_SRC_MGCG_OVERRIDE_MASK                                              0x00000040L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_REGIF_MASTER_MGCG_OVERRIDE_MASK                                           0x00000080L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_PGFSM_MGCG_OVERRIDE_MASK                                                  0x00000100L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_IH_MGCG_OVERRIDE_MASK                                                     0x00000200L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_SEM_MGCG_OVERRIDE_MASK                                                    0x00000400L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_DPM_MGCG_OVERRIDE_MASK                                                    0x00000800L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_RAS_INTR_MGCG_OVERRIDE_MASK                                               0x00001000L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_CAC_MGCG_OVERRIDE_MASK                                                    0x00002000L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_XBAR_MGCG_OVERRIDE_MASK                                                   0x00004000L
+#define RSMU_MGCG_CONTROL_HDA__RSMU_MCA_IBIR_MGCG_OVERRIDE_MASK                                               0x00008000L
+//RSMU_AXI_MASTER_QOS_CNTL_HDA
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_MASTER_QOS_OVRD_MODE__SHIFT                                        0x0
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_MASTER_QOS_OVRD_VALUE__SHIFT                                       0x1
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_AWQOS_OVRD_MODE__SHIFT                                   0x5
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_AWQOS_OVRD_VALUE__SHIFT                                  0x6
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_ARQOS_OVRD_MODE__SHIFT                                   0xa
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_ARQOS_OVRD_VALUE__SHIFT                                  0xb
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_MASTER_QOS_OVRD_MODE_MASK                                          0x00000001L
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_MASTER_QOS_OVRD_VALUE_MASK                                         0x0000001EL
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_AWQOS_OVRD_MODE_MASK                                     0x00000020L
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_AWQOS_OVRD_VALUE_MASK                                    0x000003C0L
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_ARQOS_OVRD_MODE_MASK                                     0x00000400L
+#define RSMU_AXI_MASTER_QOS_CNTL_HDA__RSMU_IP_MASTER_ARQOS_OVRD_VALUE_MASK                                    0x00007800L
+//RSMU_MASTER_ERROR_COUNTER_HDA
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_SMN_SLVERR_COUNTER__SHIFT                                         0x0
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_SMN_DECERR_COUNTER__SHIFT                                         0x8
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_MASTER_SLVERR_COUNTER__SHIFT                                      0x10
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_MASTER_DECERR_COUNTER__SHIFT                                      0x18
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_SMN_SLVERR_COUNTER_MASK                                           0x000000FFL
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_SMN_DECERR_COUNTER_MASK                                           0x0000FF00L
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_MASTER_SLVERR_COUNTER_MASK                                        0x00FF0000L
+#define RSMU_MASTER_ERROR_COUNTER_HDA__RSMU_MASTER_DECERR_COUNTER_MASK                                        0xFF000000L
+//RSMU_SLAVE_TIMEOUT_VALUE_HDA
+#define RSMU_SLAVE_TIMEOUT_VALUE_HDA__RSMU_SLAVE_TIMEOUT_VALUE__SHIFT                                         0x0
+#define RSMU_SLAVE_TIMEOUT_VALUE_HDA__RSMU_SLAVE_TIMEOUT_VALUE_MASK                                           0xFFFFFFFFL
+//RSMU_RESET_TIMEOUT_CONTROL_HDA
+#define RSMU_RESET_TIMEOUT_CONTROL_HDA__RSMU_SLAVE_TIMEOUT_ENABLE__SHIFT                                      0x0
+#define RSMU_RESET_TIMEOUT_CONTROL_HDA__RSMU_SLAVE_RESET_TIMEOUT_VALUE__SHIFT                                 0x1
+#define RSMU_RESET_TIMEOUT_CONTROL_HDA__RSMU_SLAVE_TIMEOUT_ENABLE_MASK                                        0x00000001L
+#define RSMU_RESET_TIMEOUT_CONTROL_HDA__RSMU_SLAVE_RESET_TIMEOUT_VALUE_MASK                                   0x000001FEL
+//RSMU_SLAVE_ERROR_COUNTER_HDA
+#define RSMU_SLAVE_ERROR_COUNTER_HDA__RSMU_SLAVE_ERROR_COUNTER__SHIFT                                         0x0
+#define RSMU_SLAVE_ERROR_COUNTER_HDA__RSMU_SLAVE_ERROR_COUNTER_MASK                                           0x000000FFL
+//RSMU_DBG_MUX_CONTROL_HDA
+#define RSMU_DBG_MUX_CONTROL_HDA__RSMU_DBG_MUX_SELECT__SHIFT                                                  0x0
+#define RSMU_DBG_MUX_CONTROL_HDA__RSMU_DBG_SIGNATURE__SHIFT                                                   0x18
+#define RSMU_DBG_MUX_CONTROL_HDA__RSMU_DBG_MUX_SELECT_MASK                                                    0x000000FFL
+#define RSMU_DBG_MUX_CONTROL_HDA__RSMU_DBG_SIGNATURE_MASK                                                     0xFF000000L
+//RSMU_IP_CLOCK_GATE_CNTL_HDA
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_MGCG_ENABLE__SHIFT                                               0x0
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_MEMVIEW_FGCG_OVRD__SHIFT                                         0x1
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_RDFT_SMS_IF_FGCG_OVRD__SHIFT                                        0x2
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_FORCE_CLKOFF__SHIFT                                              0x1f
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_MGCG_ENABLE_MASK                                                 0x00000001L
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_MEMVIEW_FGCG_OVRD_MASK                                           0x00000002L
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_RDFT_SMS_IF_FGCG_OVRD_MASK                                          0x00000004L
+#define RSMU_IP_CLOCK_GATE_CNTL_HDA__RSMU_IP_FORCE_CLKOFF_MASK                                                0x80000000L
+//RSMU_MSMU_FETCH_FUSE_HDA
+#define RSMU_MSMU_FETCH_FUSE_HDA__RSMU_FUSE_UPPER_256KB_H_OFFSET__SHIFT                                       0x0
+#define RSMU_MSMU_FETCH_FUSE_HDA__RSMU_FUSE_APERTURE_ID_H_OFFSET__SHIFT                                       0x2
+#define RSMU_MSMU_FETCH_FUSE_HDA__RSMU_FUSE_UPPER_256KB_H_OFFSET_MASK                                         0x00000003L
+#define RSMU_MSMU_FETCH_FUSE_HDA__RSMU_FUSE_APERTURE_ID_H_OFFSET_MASK                                         0x00003FFCL
+//RSMU_STRAP_STATUS_HDA
+#define RSMU_STRAP_STATUS_HDA__RSMU_PUBLIC_FUSE_STATUS__SHIFT                                                 0x0
+#define RSMU_STRAP_STATUS_HDA__RSMU_SECURITY_FUSE_STATUS__SHIFT                                               0x8
+#define RSMU_STRAP_STATUS_HDA__RSMU_SMS_FUSE_STATUS__SHIFT                                                    0x10
+#define RSMU_STRAP_STATUS_HDA__RSMU_ROM_STRAP_STATUS__SHIFT                                                   0x18
+#define RSMU_STRAP_STATUS_HDA__RSMU_PUBLIC_FUSE_STATUS_MASK                                                   0x00000001L
+#define RSMU_STRAP_STATUS_HDA__RSMU_SECURITY_FUSE_STATUS_MASK                                                 0x00000100L
+#define RSMU_STRAP_STATUS_HDA__RSMU_SMS_FUSE_STATUS_MASK                                                      0x00010000L
+#define RSMU_STRAP_STATUS_HDA__RSMU_ROM_STRAP_STATUS_MASK                                                     0x01000000L
+//RSMU_SMS_FUSE_CLEAR_SET0_HDA
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP0__SHIFT                                         0x0
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP1__SHIFT                                         0x1
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP2__SHIFT                                         0x2
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP3__SHIFT                                         0x3
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP4__SHIFT                                         0x4
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP5__SHIFT                                         0x5
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP6__SHIFT                                         0x6
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP7__SHIFT                                         0x7
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP8__SHIFT                                         0x8
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP9__SHIFT                                         0x9
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP10__SHIFT                                        0xa
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP11__SHIFT                                        0xb
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP12__SHIFT                                        0xc
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP13__SHIFT                                        0xd
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP14__SHIFT                                        0xe
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP15__SHIFT                                        0xf
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP16__SHIFT                                        0x10
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP17__SHIFT                                        0x11
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP18__SHIFT                                        0x12
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP19__SHIFT                                        0x13
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP20__SHIFT                                        0x14
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP21__SHIFT                                        0x15
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP22__SHIFT                                        0x16
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP23__SHIFT                                        0x17
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP24__SHIFT                                        0x18
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP25__SHIFT                                        0x19
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP26__SHIFT                                        0x1a
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP27__SHIFT                                        0x1b
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP28__SHIFT                                        0x1c
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP29__SHIFT                                        0x1d
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP30__SHIFT                                        0x1e
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP31__SHIFT                                        0x1f
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP0_MASK                                           0x00000001L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP1_MASK                                           0x00000002L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP2_MASK                                           0x00000004L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP3_MASK                                           0x00000008L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP4_MASK                                           0x00000010L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP5_MASK                                           0x00000020L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP6_MASK                                           0x00000040L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP7_MASK                                           0x00000080L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP8_MASK                                           0x00000100L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP9_MASK                                           0x00000200L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP10_MASK                                          0x00000400L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP11_MASK                                          0x00000800L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP12_MASK                                          0x00001000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP13_MASK                                          0x00002000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP14_MASK                                          0x00004000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP15_MASK                                          0x00008000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP16_MASK                                          0x00010000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP17_MASK                                          0x00020000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP18_MASK                                          0x00040000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP19_MASK                                          0x00080000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP20_MASK                                          0x00100000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP21_MASK                                          0x00200000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP22_MASK                                          0x00400000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP23_MASK                                          0x00800000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP24_MASK                                          0x01000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP25_MASK                                          0x02000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP26_MASK                                          0x04000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP27_MASK                                          0x08000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP28_MASK                                          0x10000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP29_MASK                                          0x20000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP30_MASK                                          0x40000000L
+#define RSMU_SMS_FUSE_CLEAR_SET0_HDA__RSMU_SMS_FUSE_CLEAR_GRP31_MASK                                          0x80000000L
+//RSMU_SMS_FUSE_RETRIGGER_SET0_HDA
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_HDA__RSMU_SMS_FUSE_RETRIGGER_SET0__SHIFT                                 0x0
+#define RSMU_SMS_FUSE_RETRIGGER_SET0_HDA__RSMU_SMS_FUSE_RETRIGGER_SET0_MASK                                   0xFFFFFFFFL
+//RSMU_XBAR_CG_MISC_HDA
+#define RSMU_XBAR_CG_MISC_HDA__RSMU_XBAR_CG_TIMEOUT_VALUE__SHIFT                                              0x0
+#define RSMU_XBAR_CG_MISC_HDA__RSMU_XBAR_CSYS_DELAY__SHIFT                                                    0x8
+#define RSMU_XBAR_CG_MISC_HDA__RSMU_XBAR_CG_TIMEOUT_VALUE_MASK                                                0x000000FFL
+#define RSMU_XBAR_CG_MISC_HDA__RSMU_XBAR_CSYS_DELAY_MASK                                                      0x0000FF00L
+//RSMU_XBAR_CG_CTRL_HDA
+#define RSMU_XBAR_CG_CTRL_HDA__RSMU_XBAR_CACTIVE_EN__SHIFT                                                    0x0
+#define RSMU_XBAR_CG_CTRL_HDA__RSMU_XBAR_CACTIVE_EN_MASK                                                      0x00000001L
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmioextHdaDec
+//RSMU_TIMEOUT_ERROR_LOG_REG1_HDA
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_HDA__RSMU_TIMEOUT_ERROR_REMOTE_FLAG__SHIFT                                0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_HDA__RSMU_TIMEOUT_ERROR_NODE_ID__SHIFT                                    0x1
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_HDA__RSMU_TIMEOUT_ERROR_REMOTE_FLAG_MASK                                  0x00000001L
+#define RSMU_TIMEOUT_ERROR_LOG_REG1_HDA__RSMU_TIMEOUT_ERROR_NODE_ID_MASK                                      0x0000FFFEL
+//RSMU_TIMEOUT_ERROR_LOG_REG_HDA
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_ADDR__SHIFT                                        0x0
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_INITIATORID__SHIFT                                 0x14
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_OP__SHIFT                                          0x1e
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_OUTSTANDING__SHIFT                                 0x1f
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_ADDR_MASK                                          0x000FFFFFL
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_INITIATORID_MASK                                   0x3FF00000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_OP_MASK                                            0x40000000L
+#define RSMU_TIMEOUT_ERROR_LOG_REG_HDA__RSMU_TIMEOUT_ERROR_OUTSTANDING_MASK                                   0x80000000L
+//RSMU_IP_MASTER_STATUS_HDA
+#define RSMU_IP_MASTER_STATUS_HDA__RSMU_IP_MASTER_REQ_PENDING__SHIFT                                          0x0
+#define RSMU_IP_MASTER_STATUS_HDA__RSMU_IP_MASTER_RESP_PENDING__SHIFT                                         0x1
+#define RSMU_IP_MASTER_STATUS_HDA__RSMU_IP_MASTER_REQ_PENDING_MASK                                            0x00000001L
+#define RSMU_IP_MASTER_STATUS_HDA__RSMU_IP_MASTER_RESP_PENDING_MASK                                           0x00000002L
+//RSMU_MMIOEXT_SCRATCH_REG_0_HDA
+#define RSMU_MMIOEXT_SCRATCH_REG_0_HDA__RSMU_MMIOEXT_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_0_HDA__RSMU_MMIOEXT_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_MMIOEXT_SCRATCH_REG_1_HDA
+#define RSMU_MMIOEXT_SCRATCH_REG_1_HDA__RSMU_MMIOEXT_SCRATCH_REG_1__SHIFT                                     0x0
+#define RSMU_MMIOEXT_SCRATCH_REG_1_HDA__RSMU_MMIOEXT_SCRATCH_REG_1_MASK                                       0xFFFFFFFFL
+//RSMU_VERSION_HDA
+#define RSMU_VERSION_HDA__RSMU_VERSION_LOW__SHIFT                                                             0x0
+#define RSMU_VERSION_HDA__RSMU_VERSION_MIDDLE__SHIFT                                                          0x8
+#define RSMU_VERSION_HDA__RSMU_VERSION_HIGH__SHIFT                                                            0x10
+#define RSMU_VERSION_HDA__RSMU_VERSION_LOW_MASK                                                               0x000000FFL
+#define RSMU_VERSION_HDA__RSMU_VERSION_MIDDLE_MASK                                                            0x0000FF00L
+#define RSMU_VERSION_HDA__RSMU_VERSION_HIGH_MASK                                                              0x00FF0000L
+
+
+// addressBlock: dce_rsmu_hda_rsmu_hda_RsmuMmiosecHdaDec
+//RSMU_AEB_OVERRIDE_0_HDA
+#define RSMU_AEB_OVERRIDE_0_HDA__RSMU_AEB_OVERRIDE_0__SHIFT                                                   0x3
+#define RSMU_AEB_OVERRIDE_0_HDA__RSMU_AEB_OVERRIDE_0_MASK                                                     0xFFFFFFF8L
+//RSMU_AEB_OVERRIDE_1_HDA
+#define RSMU_AEB_OVERRIDE_1_HDA__RSMU_AEB_OVERRIDE_1__SHIFT                                                   0x0
+#define RSMU_AEB_OVERRIDE_1_HDA__RSMU_AEB_OVERRIDE_1_MASK                                                     0xFFFFFFFFL
+//RSMU_MMIOSEC_SCRATCH_REG_0_HDA
+#define RSMU_MMIOSEC_SCRATCH_REG_0_HDA__RSMU_MMIOSEC_SCRATCH_REG_0__SHIFT                                     0x0
+#define RSMU_MMIOSEC_SCRATCH_REG_0_HDA__RSMU_MMIOSEC_SCRATCH_REG_0_MASK                                       0xFFFFFFFFL
+//RSMU_AEB_VALUE_0_HDA
+#define RSMU_AEB_VALUE_0_HDA__RSMU_AEB_VALUE_0__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_0_HDA__RSMU_AEB_VALUE_0_MASK                                                           0xFFFFFFFFL
+//RSMU_AEB_VALUE_1_HDA
+#define RSMU_AEB_VALUE_1_HDA__RSMU_AEB_VALUE_1__SHIFT                                                         0x0
+#define RSMU_AEB_VALUE_1_HDA__RSMU_AEB_VALUE_1_MASK                                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azcontroller_azdec
+//AZCONTROLLER1_CORB_WRITE_POINTER
+#define AZCONTROLLER1_CORB_WRITE_POINTER__CORB_WRITE_POINTER__SHIFT                                           0x0
+#define AZCONTROLLER1_CORB_WRITE_POINTER__CORB_WRITE_POINTER_MASK                                             0x00FFL
+//AZCONTROLLER1_CORB_READ_POINTER
+#define AZCONTROLLER1_CORB_READ_POINTER__CORB_READ_POINTER__SHIFT                                             0x0
+#define AZCONTROLLER1_CORB_READ_POINTER__CORB_READ_POINTER_RESET__SHIFT                                       0xf
+#define AZCONTROLLER1_CORB_READ_POINTER__CORB_READ_POINTER_MASK                                               0x00FFL
+#define AZCONTROLLER1_CORB_READ_POINTER__CORB_READ_POINTER_RESET_MASK                                         0x8000L
+//AZCONTROLLER1_CORB_CONTROL
+#define AZCONTROLLER1_CORB_CONTROL__CORB_MEMORY_ERROR_INTERRUPT_ENABLE__SHIFT                                 0x0
+#define AZCONTROLLER1_CORB_CONTROL__ENABLE_CORB_DMA_ENGINE__SHIFT                                             0x1
+#define AZCONTROLLER1_CORB_CONTROL__CORB_MEMORY_ERROR_INTERRUPT_ENABLE_MASK                                   0x01L
+#define AZCONTROLLER1_CORB_CONTROL__ENABLE_CORB_DMA_ENGINE_MASK                                               0x02L
+//AZCONTROLLER1_CORB_STATUS
+#define AZCONTROLLER1_CORB_STATUS__CORB_MEMORY_ERROR_INDICATION__SHIFT                                        0x0
+#define AZCONTROLLER1_CORB_STATUS__CORB_MEMORY_ERROR_INDICATION_MASK                                          0x01L
+//AZCONTROLLER1_CORB_SIZE
+#define AZCONTROLLER1_CORB_SIZE__CORB_SIZE__SHIFT                                                             0x0
+#define AZCONTROLLER1_CORB_SIZE__CORB_SIZE_CAPABILITY__SHIFT                                                  0x4
+#define AZCONTROLLER1_CORB_SIZE__CORB_SIZE_MASK                                                               0x0003L
+#define AZCONTROLLER1_CORB_SIZE__CORB_SIZE_CAPABILITY_MASK                                                    0x00F0L
+//AZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS
+#define AZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_UNIMPLEMENTED_BITS__SHIFT                      0x0
+#define AZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_ADDRESS__SHIFT                                 0x7
+#define AZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_UNIMPLEMENTED_BITS_MASK                        0x0000007FL
+#define AZCONTROLLER1_RIRB_LOWER_BASE_ADDRESS__RIRB_LOWER_BASE_ADDRESS_MASK                                   0xFFFFFF80L
+//AZCONTROLLER1_RIRB_UPPER_BASE_ADDRESS
+#define AZCONTROLLER1_RIRB_UPPER_BASE_ADDRESS__RIRB_UPPER_BASE_ADDRESS__SHIFT                                 0x0
+#define AZCONTROLLER1_RIRB_UPPER_BASE_ADDRESS__RIRB_UPPER_BASE_ADDRESS_MASK                                   0xFFFFFFFFL
+//AZCONTROLLER1_RIRB_WRITE_POINTER
+#define AZCONTROLLER1_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER__SHIFT                                           0x0
+#define AZCONTROLLER1_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_RESET__SHIFT                                     0xf
+#define AZCONTROLLER1_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_MASK                                             0x00FFL
+#define AZCONTROLLER1_RIRB_WRITE_POINTER__RIRB_WRITE_POINTER_RESET_MASK                                       0x8000L
+//AZCONTROLLER1_RESPONSE_INTERRUPT_COUNT
+#define AZCONTROLLER1_RESPONSE_INTERRUPT_COUNT__N_RESPONSE_INTERRUPT_COUNT__SHIFT                             0x0
+#define AZCONTROLLER1_RESPONSE_INTERRUPT_COUNT__N_RESPONSE_INTERRUPT_COUNT_MASK                               0x00FFL
+//AZCONTROLLER1_RIRB_CONTROL
+#define AZCONTROLLER1_RIRB_CONTROL__RESPONSE_INTERRUPT_CONTROL__SHIFT                                         0x0
+#define AZCONTROLLER1_RIRB_CONTROL__RIRB_DMA_ENABLE__SHIFT                                                    0x1
+#define AZCONTROLLER1_RIRB_CONTROL__RESPONSE_OVERRUN_INTERRUPT_CONTROL__SHIFT                                 0x2
+#define AZCONTROLLER1_RIRB_CONTROL__RESPONSE_INTERRUPT_CONTROL_MASK                                           0x01L
+#define AZCONTROLLER1_RIRB_CONTROL__RIRB_DMA_ENABLE_MASK                                                      0x02L
+#define AZCONTROLLER1_RIRB_CONTROL__RESPONSE_OVERRUN_INTERRUPT_CONTROL_MASK                                   0x04L
+//AZCONTROLLER1_RIRB_STATUS
+#define AZCONTROLLER1_RIRB_STATUS__RESPONSE_INTERRUPT__SHIFT                                                  0x0
+#define AZCONTROLLER1_RIRB_STATUS__RESPONSE_OVERRUN_INTERRUPT_STATUS__SHIFT                                   0x2
+#define AZCONTROLLER1_RIRB_STATUS__RESPONSE_INTERRUPT_MASK                                                    0x01L
+#define AZCONTROLLER1_RIRB_STATUS__RESPONSE_OVERRUN_INTERRUPT_STATUS_MASK                                     0x04L
+//AZCONTROLLER1_RIRB_SIZE
+#define AZCONTROLLER1_RIRB_SIZE__RIRB_SIZE__SHIFT                                                             0x0
+#define AZCONTROLLER1_RIRB_SIZE__RIRB_SIZE_CAPABILITY__SHIFT                                                  0x4
+#define AZCONTROLLER1_RIRB_SIZE__RIRB_SIZE_MASK                                                               0x0003L
+#define AZCONTROLLER1_RIRB_SIZE__RIRB_SIZE_CAPABILITY_MASK                                                    0x00F0L
+//AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_VERB_AND_PAYLOAD__SHIFT     0x0
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_CODEC_ADDRESS__SHIFT        0x1c
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_VERB_AND_PAYLOAD_MASK       0x0FFFFFFFL
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE__IMMEDIATE_COMMAND_WRITE_CODEC_ADDRESS_MASK          0xF0000000L
+//AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT                 0x0
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK                   0xFFFFFFFFL
+//AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT                0x0
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK                  0x0000FFFFL
+//AZCONTROLLER1_IMMEDIATE_RESPONSE_INPUT_INTERFACE
+#define AZCONTROLLER1_IMMEDIATE_RESPONSE_INPUT_INTERFACE__IMMEDIATE_RESPONSE_READ__SHIFT                      0x0
+#define AZCONTROLLER1_IMMEDIATE_RESPONSE_INPUT_INTERFACE__IMMEDIATE_RESPONSE_READ_MASK                        0xFFFFFFFFL
+//AZCONTROLLER1_IMMEDIATE_COMMAND_STATUS
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_COMMAND_BUSY__SHIFT                                 0x0
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_RESULT_VALID__SHIFT                                 0x1
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_COMMAND_BUSY_MASK                                   0x00000001L
+#define AZCONTROLLER1_IMMEDIATE_COMMAND_STATUS__IMMEDIATE_RESULT_VALID_MASK                                   0x00000002L
+//AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_BUFFER_ENABLE__SHIFT                      0x0
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_UNIMPLEMENTED_BITS__SHIFT      0x1
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_ADDRESS__SHIFT                 0x7
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_BUFFER_ENABLE_MASK                        0x00000001L
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_UNIMPLEMENTED_BITS_MASK        0x0000007EL
+#define AZCONTROLLER1_DMA_POSITION_LOWER_BASE_ADDRESS__DMA_POSITION_LOWER_BASE_ADDRESS_MASK                   0xFFFFFF80L
+//AZCONTROLLER1_DMA_POSITION_UPPER_BASE_ADDRESS
+#define AZCONTROLLER1_DMA_POSITION_UPPER_BASE_ADDRESS__DMA_POSITION_UPPER_BASE_ADDRESS__SHIFT                 0x0
+#define AZCONTROLLER1_DMA_POSITION_UPPER_BASE_ADDRESS__DMA_POSITION_UPPER_BASE_ADDRESS_MASK                   0xFFFFFFFFL
+//AZCONTROLLER1_WALL_CLOCK_COUNTER_ALIAS
+#define AZCONTROLLER1_WALL_CLOCK_COUNTER_ALIAS__WALL_CLOCK_COUNTER_ALIAS__SHIFT                               0x0
+#define AZCONTROLLER1_WALL_CLOCK_COUNTER_ALIAS__WALL_CLOCK_COUNTER_ALIAS_MASK                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azendpoint_azdec
+//AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT        0x0
+#define AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK          0xFFFFFFFFL
+//AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT       0x0
+#define AZENDPOINT1_AZENDPOINT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK         0x0001FFFFL
+
+
+// addressBlock: dce_dc_hda_azroot_azdec
+//AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA
+#define AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE__SHIFT                0x0
+#define AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_DATA__IMMEDIATE_COMMAND_WRITE_MASK                  0xFFFFFFFFL
+//AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX
+#define AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE__SHIFT               0x0
+#define AZROOT1_AZROOT_IMMEDIATE_COMMAND_OUTPUT_INTERFACE_INDEX__IMMEDIATE_COMMAND_WRITE_MASK                 0x0001FFFFL
+
+
+// addressBlock: dce_dc_hda_azstream0_azdec
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM0_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream1_azdec
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM1_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream2_azdec
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM2_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream3_azdec
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM3_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream4_azdec
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM4_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream5_azdec
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM5_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream6_azdec
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM6_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azstream7_azdec
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET__SHIFT                          0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN__SHIFT                            0x1
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE__SHIFT        0x2
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE__SHIFT           0x3
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE__SHIFT     0x4
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL__SHIFT                        0x10
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY__SHIFT                      0x12
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER__SHIFT                         0x14
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS__SHIFT    0x1a
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR__SHIFT                            0x1b
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR__SHIFT                      0x1c
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY__SHIFT                            0x1d
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RESET_MASK                            0x00000001L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_RUN_MASK                              0x00000002L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__INTERRUPT_ON_COMPLETION_ENABLE_MASK          0x00000004L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_INTERRUPT_ENABLE_MASK             0x00000008L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_INTERRUPT_ENABLE_MASK       0x00000010L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STRIPE_CONTROL_MASK                          0x00030000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__TRAFFIC_PRIORITY_MASK                        0x00040000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__STREAM_NUMBER_MASK                           0x00F00000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__BUFFER_COMPLETION_INTERRUPT_STATUS_MASK      0x04000000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_ERROR_MASK                              0x08000000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__DESCRIPTOR_ERROR_MASK                        0x10000000L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CONTROL_AND_STATUS__FIFO_READY_MASK                              0x20000000L
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER__SHIFT  0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER__LINK_POSITION_IN_BUFFER_MASK    0xFFFFFFFFL
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH__SHIFT                0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_CYCLIC_BUFFER_LENGTH__CYCLIC_BUFFER_LENGTH_MASK                  0xFFFFFFFFL
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX__SHIFT                        0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LAST_VALID_INDEX__LAST_VALID_INDEX_MASK                          0x000000FFL
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE__SHIFT                                      0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FIFO_SIZE__FIFO_SIZE_MASK                                        0xFFFFL
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS__SHIFT                                0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE__SHIFT                                   0x4
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                               0x8
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                              0xb
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE__SHIFT                                  0xe
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__NUMBER_OF_CHANNELS_MASK                                  0x000FL
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__BITS_PER_SAMPLE_MASK                                     0x0070L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_DIVISOR_MASK                                 0x0700L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                                0x3800L
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_FORMAT__SAMPLE_BASE_RATE_MASK                                    0x4000L
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS__SHIFT  0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS__SHIFT  0x7
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_UNIMPLEMENTED_BITS_MASK  0x0000007FL
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_LOWER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_LOWER_BASE_ADDRESS_MASK  0xFFFFFF80L
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS__SHIFT  0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_BDL_POINTER_UPPER_BASE_ADDRESS__BUFFER_DESCRIPTOR_LIST_UPPER_BASE_ADDRESS_MASK  0xFFFFFFFFL
+//AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS__SHIFT  0x0
+#define AZSTREAM7_1_OUTPUT_STREAM_DESCRIPTOR_LINK_POSITION_IN_CURRENT_BUFFER_ALIAS__LINK_POSITION_IN_BUFFER_ALIAS_MASK  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dccg_dccg_dispdec
+//PHYPLLA_PIXCLK_RESYNC_CNTL
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_PIXCLK_RESYNC_ENABLE__SHIFT                                       0x0
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_DEEP_COLOR_DTO_ENABLE_STATUS__SHIFT                               0x1
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_DCCG_DEEP_COLOR_CNTL__SHIFT                                       0x4
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_PIXCLK_ENABLE__SHIFT                                              0x8
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_PIXCLK_RESYNC_ENABLE_MASK                                         0x00000001L
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_DEEP_COLOR_DTO_ENABLE_STATUS_MASK                                 0x00000002L
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_DCCG_DEEP_COLOR_CNTL_MASK                                         0x00000030L
+#define PHYPLLA_PIXCLK_RESYNC_CNTL__PHYPLLA_PIXCLK_ENABLE_MASK                                                0x00000100L
+//PHYPLLB_PIXCLK_RESYNC_CNTL
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_PIXCLK_RESYNC_ENABLE__SHIFT                                       0x0
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_DEEP_COLOR_DTO_ENABLE_STATUS__SHIFT                               0x1
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_DCCG_DEEP_COLOR_CNTL__SHIFT                                       0x4
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_PIXCLK_ENABLE__SHIFT                                              0x8
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_PIXCLK_RESYNC_ENABLE_MASK                                         0x00000001L
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_DEEP_COLOR_DTO_ENABLE_STATUS_MASK                                 0x00000002L
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_DCCG_DEEP_COLOR_CNTL_MASK                                         0x00000030L
+#define PHYPLLB_PIXCLK_RESYNC_CNTL__PHYPLLB_PIXCLK_ENABLE_MASK                                                0x00000100L
+//PHYPLLC_PIXCLK_RESYNC_CNTL
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_PIXCLK_RESYNC_ENABLE__SHIFT                                       0x0
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_DEEP_COLOR_DTO_ENABLE_STATUS__SHIFT                               0x1
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_DCCG_DEEP_COLOR_CNTL__SHIFT                                       0x4
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_PIXCLK_ENABLE__SHIFT                                              0x8
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_PIXCLK_RESYNC_ENABLE_MASK                                         0x00000001L
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_DEEP_COLOR_DTO_ENABLE_STATUS_MASK                                 0x00000002L
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_DCCG_DEEP_COLOR_CNTL_MASK                                         0x00000030L
+#define PHYPLLC_PIXCLK_RESYNC_CNTL__PHYPLLC_PIXCLK_ENABLE_MASK                                                0x00000100L
+//PHYPLLD_PIXCLK_RESYNC_CNTL
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_PIXCLK_RESYNC_ENABLE__SHIFT                                       0x0
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_DEEP_COLOR_DTO_ENABLE_STATUS__SHIFT                               0x1
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_DCCG_DEEP_COLOR_CNTL__SHIFT                                       0x4
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_PIXCLK_ENABLE__SHIFT                                              0x8
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_PIXCLK_RESYNC_ENABLE_MASK                                         0x00000001L
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_DEEP_COLOR_DTO_ENABLE_STATUS_MASK                                 0x00000002L
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_DCCG_DEEP_COLOR_CNTL_MASK                                         0x00000030L
+#define PHYPLLD_PIXCLK_RESYNC_CNTL__PHYPLLD_PIXCLK_ENABLE_MASK                                                0x00000100L
+//DP_DTO_DBUF_EN
+#define DP_DTO_DBUF_EN__DP_DTO0_DBUF_EN__SHIFT                                                                0x0
+#define DP_DTO_DBUF_EN__DP_DTO1_DBUF_EN__SHIFT                                                                0x1
+#define DP_DTO_DBUF_EN__DP_DTO2_DBUF_EN__SHIFT                                                                0x2
+#define DP_DTO_DBUF_EN__DP_DTO3_DBUF_EN__SHIFT                                                                0x3
+#define DP_DTO_DBUF_EN__DP_DTO4_DBUF_EN__SHIFT                                                                0x4
+#define DP_DTO_DBUF_EN__DP_DTO5_DBUF_EN__SHIFT                                                                0x5
+#define DP_DTO_DBUF_EN__DP_DTO6_DBUF_EN__SHIFT                                                                0x6
+#define DP_DTO_DBUF_EN__DP_DTO7_DBUF_EN__SHIFT                                                                0x7
+#define DP_DTO_DBUF_EN__DP_DTO0_DBUF_EN_MASK                                                                  0x00000001L
+#define DP_DTO_DBUF_EN__DP_DTO1_DBUF_EN_MASK                                                                  0x00000002L
+#define DP_DTO_DBUF_EN__DP_DTO2_DBUF_EN_MASK                                                                  0x00000004L
+#define DP_DTO_DBUF_EN__DP_DTO3_DBUF_EN_MASK                                                                  0x00000008L
+#define DP_DTO_DBUF_EN__DP_DTO4_DBUF_EN_MASK                                                                  0x00000010L
+#define DP_DTO_DBUF_EN__DP_DTO5_DBUF_EN_MASK                                                                  0x00000020L
+#define DP_DTO_DBUF_EN__DP_DTO6_DBUF_EN_MASK                                                                  0x00000040L
+#define DP_DTO_DBUF_EN__DP_DTO7_DBUF_EN_MASK                                                                  0x00000080L
+//DSCCLK3_DTO_PARAM
+#define DSCCLK3_DTO_PARAM__DSCCLK3_DTO_PHASE__SHIFT                                                           0x0
+#define DSCCLK3_DTO_PARAM__DSCCLK3_DTO_MODULO__SHIFT                                                          0x10
+#define DSCCLK3_DTO_PARAM__DSCCLK3_DTO_PHASE_MASK                                                             0x000000FFL
+#define DSCCLK3_DTO_PARAM__DSCCLK3_DTO_MODULO_MASK                                                            0x00FF0000L
+//DPREFCLK_CGTT_BLK_CTRL_REG
+#define DPREFCLK_CGTT_BLK_CTRL_REG__DPREFCLK_TURN_ON_DELAY__SHIFT                                             0x0
+#define DPREFCLK_CGTT_BLK_CTRL_REG__DPREFCLK_TURN_OFF_DELAY__SHIFT                                            0x4
+#define DPREFCLK_CGTT_BLK_CTRL_REG__DPREFCLK_TURN_ON_DELAY_MASK                                               0x0000000FL
+#define DPREFCLK_CGTT_BLK_CTRL_REG__DPREFCLK_TURN_OFF_DELAY_MASK                                              0x00000FF0L
+//DCCG_GATE_DISABLE_CNTL4
+#define DCCG_GATE_DISABLE_CNTL4__PHYA_REFCLK_ROOT_GATE_DISABLE__SHIFT                                         0x0
+#define DCCG_GATE_DISABLE_CNTL4__PHYB_REFCLK_ROOT_GATE_DISABLE__SHIFT                                         0x1
+#define DCCG_GATE_DISABLE_CNTL4__PHYC_REFCLK_ROOT_GATE_DISABLE__SHIFT                                         0x2
+#define DCCG_GATE_DISABLE_CNTL4__PHYD_REFCLK_ROOT_GATE_DISABLE__SHIFT                                         0x3
+#define DCCG_GATE_DISABLE_CNTL4__HDMICHARCLK0_ROOT_GATE_DISABLE__SHIFT                                        0x11
+#define DCCG_GATE_DISABLE_CNTL4__PHYA_REFCLK_ROOT_GATE_DISABLE_MASK                                           0x00000001L
+#define DCCG_GATE_DISABLE_CNTL4__PHYB_REFCLK_ROOT_GATE_DISABLE_MASK                                           0x00000002L
+#define DCCG_GATE_DISABLE_CNTL4__PHYC_REFCLK_ROOT_GATE_DISABLE_MASK                                           0x00000004L
+#define DCCG_GATE_DISABLE_CNTL4__PHYD_REFCLK_ROOT_GATE_DISABLE_MASK                                           0x00000008L
+#define DCCG_GATE_DISABLE_CNTL4__HDMICHARCLK0_ROOT_GATE_DISABLE_MASK                                          0x00020000L
+//DPSTREAMCLK_CNTL
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK0_SRC_SEL__SHIFT                                                         0x0
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK0_EN__SHIFT                                                              0x3
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK1_SRC_SEL__SHIFT                                                         0x4
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK1_EN__SHIFT                                                              0x7
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK2_SRC_SEL__SHIFT                                                         0x8
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK2_EN__SHIFT                                                              0xb
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK3_SRC_SEL__SHIFT                                                         0xc
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK3_EN__SHIFT                                                              0xf
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK0_SRC_SEL_MASK                                                           0x00000007L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK0_EN_MASK                                                                0x00000008L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK1_SRC_SEL_MASK                                                           0x00000070L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK1_EN_MASK                                                                0x00000080L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK2_SRC_SEL_MASK                                                           0x00000700L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK2_EN_MASK                                                                0x00000800L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK3_SRC_SEL_MASK                                                           0x00007000L
+#define DPSTREAMCLK_CNTL__DPSTREAMCLK3_EN_MASK                                                                0x00008000L
+//REFCLK_CGTT_BLK_CTRL_REG
+#define REFCLK_CGTT_BLK_CTRL_REG__REFCLK_TURN_ON_DELAY__SHIFT                                                 0x0
+#define REFCLK_CGTT_BLK_CTRL_REG__REFCLK_TURN_OFF_DELAY__SHIFT                                                0x4
+#define REFCLK_CGTT_BLK_CTRL_REG__REFCLK_TURN_ON_DELAY_MASK                                                   0x0000000FL
+#define REFCLK_CGTT_BLK_CTRL_REG__REFCLK_TURN_OFF_DELAY_MASK                                                  0x00000FF0L
+//DCCG_GLOBAL_FGCG_REP_CNTL
+#define DCCG_GLOBAL_FGCG_REP_CNTL__DCCG_GLOBAL_FGCG_REP_DIS__SHIFT                                            0x0
+#define DCCG_GLOBAL_FGCG_REP_CNTL__DCCG_GLOBAL_FGCG_REP_DIS_MASK                                              0x00000001L
+//OTG_ADD_DROP_PIXEL_CNTL
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG0_ADD_PIXEL__SHIFT                                                        0x0
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG1_ADD_PIXEL__SHIFT                                                        0x1
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG2_ADD_PIXEL__SHIFT                                                        0x2
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG3_ADD_PIXEL__SHIFT                                                        0x3
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG0_DROP_PIXEL__SHIFT                                                       0x8
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG1_DROP_PIXEL__SHIFT                                                       0x9
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG2_DROP_PIXEL__SHIFT                                                       0xa
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG3_DROP_PIXEL__SHIFT                                                       0xb
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG_ADD_DROP_PIXEL_DONE__SHIFT                                               0x1f
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG0_ADD_PIXEL_MASK                                                          0x00000001L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG1_ADD_PIXEL_MASK                                                          0x00000002L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG2_ADD_PIXEL_MASK                                                          0x00000004L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG3_ADD_PIXEL_MASK                                                          0x00000008L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG0_DROP_PIXEL_MASK                                                         0x00000100L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG1_DROP_PIXEL_MASK                                                         0x00000200L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG2_DROP_PIXEL_MASK                                                         0x00000400L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG3_DROP_PIXEL_MASK                                                         0x00000800L
+#define OTG_ADD_DROP_PIXEL_CNTL__OTG_ADD_DROP_PIXEL_DONE_MASK                                                 0x80000000L
+//DIO_DME_MEM_RCLK_CNTL
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK0_SRC_SEL__SHIFT                                               0x0
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK0_EN__SHIFT                                                    0x3
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK1_SRC_SEL__SHIFT                                               0x4
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK1_EN__SHIFT                                                    0x7
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK0_SRC_SEL_MASK                                                 0x00000007L
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK0_EN_MASK                                                      0x00000008L
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK1_SRC_SEL_MASK                                                 0x00000070L
+#define DIO_DME_MEM_RCLK_CNTL__DIO_DME_MEM_RCLK1_EN_MASK                                                      0x00000080L
+//HPO_DME_MEM_RCLK_CNTL
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK0_SRC_SEL__SHIFT                                               0x0
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK0_EN__SHIFT                                                    0x4
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK1_SRC_SEL__SHIFT                                               0x5
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK1_EN__SHIFT                                                    0x9
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK0_SRC_SEL_MASK                                                 0x0000000FL
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK0_EN_MASK                                                      0x00000010L
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK1_SRC_SEL_MASK                                                 0x000001E0L
+#define HPO_DME_MEM_RCLK_CNTL__HPO_DME_MEM_RCLK1_EN_MASK                                                      0x00000200L
+//DCCG_GATE_DISABLE_CNTL7
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK0_GATE_DISABLE__SHIFT                                        0x0
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK0_ROOT_GATE_DISABLE__SHIFT                                   0x1
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK1_GATE_DISABLE__SHIFT                                        0x2
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK1_ROOT_GATE_DISABLE__SHIFT                                   0x3
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK0_GATE_DISABLE__SHIFT                                        0x8
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK0_ROOT_GATE_DISABLE__SHIFT                                   0x9
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK1_GATE_DISABLE__SHIFT                                        0xa
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK1_ROOT_GATE_DISABLE__SHIFT                                   0xb
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK0_GATE_DISABLE_MASK                                          0x00000001L
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK0_ROOT_GATE_DISABLE_MASK                                     0x00000002L
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK1_GATE_DISABLE_MASK                                          0x00000004L
+#define DCCG_GATE_DISABLE_CNTL7__DIO_DME_MEM_RCLK1_ROOT_GATE_DISABLE_MASK                                     0x00000008L
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK0_GATE_DISABLE_MASK                                          0x00000100L
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK0_ROOT_GATE_DISABLE_MASK                                     0x00000200L
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK1_GATE_DISABLE_MASK                                          0x00000400L
+#define DCCG_GATE_DISABLE_CNTL7__HPO_DME_MEM_RCLK1_ROOT_GATE_DISABLE_MASK                                     0x00000800L
+//SYMCLK32_SE_CNTL
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE0_SRC_SEL__SHIFT                                                         0x0
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE0_EN__SHIFT                                                              0x3
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE1_SRC_SEL__SHIFT                                                         0x4
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE1_EN__SHIFT                                                              0x7
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE2_SRC_SEL__SHIFT                                                         0x8
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE2_EN__SHIFT                                                              0xb
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE3_SRC_SEL__SHIFT                                                         0xc
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE3_EN__SHIFT                                                              0xf
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE0_SRC_SEL_MASK                                                           0x00000007L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE0_EN_MASK                                                                0x00000008L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE1_SRC_SEL_MASK                                                           0x00000070L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE1_EN_MASK                                                                0x00000080L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE2_SRC_SEL_MASK                                                           0x00000700L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE2_EN_MASK                                                                0x00000800L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE3_SRC_SEL_MASK                                                           0x00007000L
+#define SYMCLK32_SE_CNTL__SYMCLK32_SE3_EN_MASK                                                                0x00008000L
+//SYMCLK32_LE_CNTL
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE0_SRC_SEL__SHIFT                                                         0x0
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE0_EN__SHIFT                                                              0x3
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE1_SRC_SEL__SHIFT                                                         0x4
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE1_EN__SHIFT                                                              0x7
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE2_SRC_SEL__SHIFT                                                         0x8
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE2_EN__SHIFT                                                              0xb
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE3_SRC_SEL__SHIFT                                                         0xc
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE3_EN__SHIFT                                                              0xf
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE0_SRC_SEL_MASK                                                           0x00000007L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE0_EN_MASK                                                                0x00000008L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE1_SRC_SEL_MASK                                                           0x00000070L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE1_EN_MASK                                                                0x00000080L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE2_SRC_SEL_MASK                                                           0x00000700L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE2_EN_MASK                                                                0x00000800L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE3_SRC_SEL_MASK                                                           0x00007000L
+#define SYMCLK32_LE_CNTL__SYMCLK32_LE3_EN_MASK                                                                0x00008000L
+//DTBCLK_P_CNTL
+#define DTBCLK_P_CNTL__DTBCLK_P0_SRC_SEL__SHIFT                                                               0x0
+#define DTBCLK_P_CNTL__DTBCLK_P0_EN__SHIFT                                                                    0x2
+#define DTBCLK_P_CNTL__DTBCLK_P1_SRC_SEL__SHIFT                                                               0x3
+#define DTBCLK_P_CNTL__DTBCLK_P1_EN__SHIFT                                                                    0x5
+#define DTBCLK_P_CNTL__DTBCLK_P2_SRC_SEL__SHIFT                                                               0x6
+#define DTBCLK_P_CNTL__DTBCLK_P2_EN__SHIFT                                                                    0x8
+#define DTBCLK_P_CNTL__DTBCLK_P3_SRC_SEL__SHIFT                                                               0x9
+#define DTBCLK_P_CNTL__DTBCLK_P3_EN__SHIFT                                                                    0xb
+#define DTBCLK_P_CNTL__DTBCLK_P0_SRC_SEL_MASK                                                                 0x00000003L
+#define DTBCLK_P_CNTL__DTBCLK_P0_EN_MASK                                                                      0x00000004L
+#define DTBCLK_P_CNTL__DTBCLK_P1_SRC_SEL_MASK                                                                 0x00000018L
+#define DTBCLK_P_CNTL__DTBCLK_P1_EN_MASK                                                                      0x00000020L
+#define DTBCLK_P_CNTL__DTBCLK_P2_SRC_SEL_MASK                                                                 0x000000C0L
+#define DTBCLK_P_CNTL__DTBCLK_P2_EN_MASK                                                                      0x00000100L
+#define DTBCLK_P_CNTL__DTBCLK_P3_SRC_SEL_MASK                                                                 0x00000600L
+#define DTBCLK_P_CNTL__DTBCLK_P3_EN_MASK                                                                      0x00000800L
+//DCCG_GATE_DISABLE_CNTL5
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P0_GATE_DISABLE__SHIFT                                                0x0
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P1_GATE_DISABLE__SHIFT                                                0x1
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P2_GATE_DISABLE__SHIFT                                                0x2
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P3_GATE_DISABLE__SHIFT                                                0x3
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK0_ROOT_GATE_DISABLE__SHIFT                                        0x6
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK0_GATE_DISABLE__SHIFT                                             0x7
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK1_ROOT_GATE_DISABLE__SHIFT                                        0x8
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK1_GATE_DISABLE__SHIFT                                             0x9
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK2_ROOT_GATE_DISABLE__SHIFT                                        0xa
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK2_GATE_DISABLE__SHIFT                                             0xb
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK3_ROOT_GATE_DISABLE__SHIFT                                        0xc
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK3_GATE_DISABLE__SHIFT                                             0xd
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKA_ROOT_GATE_DISABLE__SHIFT                                             0x12
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKB_ROOT_GATE_DISABLE__SHIFT                                             0x13
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKC_ROOT_GATE_DISABLE__SHIFT                                             0x14
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKD_ROOT_GATE_DISABLE__SHIFT                                             0x15
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKA_FE_ROOT_GATE_DISABLE__SHIFT                                          0x18
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKB_FE_ROOT_GATE_DISABLE__SHIFT                                          0x19
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKC_FE_ROOT_GATE_DISABLE__SHIFT                                          0x1a
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKD_FE_ROOT_GATE_DISABLE__SHIFT                                          0x1b
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P0_GATE_DISABLE_MASK                                                  0x00000001L
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P1_GATE_DISABLE_MASK                                                  0x00000002L
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P2_GATE_DISABLE_MASK                                                  0x00000004L
+#define DCCG_GATE_DISABLE_CNTL5__DTBCLK_P3_GATE_DISABLE_MASK                                                  0x00000008L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK0_ROOT_GATE_DISABLE_MASK                                          0x00000040L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK0_GATE_DISABLE_MASK                                               0x00000080L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK1_ROOT_GATE_DISABLE_MASK                                          0x00000100L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK1_GATE_DISABLE_MASK                                               0x00000200L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK2_ROOT_GATE_DISABLE_MASK                                          0x00000400L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK2_GATE_DISABLE_MASK                                               0x00000800L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK3_ROOT_GATE_DISABLE_MASK                                          0x00001000L
+#define DCCG_GATE_DISABLE_CNTL5__DPSTREAMCLK3_GATE_DISABLE_MASK                                               0x00002000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKA_ROOT_GATE_DISABLE_MASK                                               0x00040000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKB_ROOT_GATE_DISABLE_MASK                                               0x00080000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKC_ROOT_GATE_DISABLE_MASK                                               0x00100000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKD_ROOT_GATE_DISABLE_MASK                                               0x00200000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKA_FE_ROOT_GATE_DISABLE_MASK                                            0x01000000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKB_FE_ROOT_GATE_DISABLE_MASK                                            0x02000000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKC_FE_ROOT_GATE_DISABLE_MASK                                            0x04000000L
+#define DCCG_GATE_DISABLE_CNTL5__SYMCLKD_FE_ROOT_GATE_DISABLE_MASK                                            0x08000000L
+//DSCCLK0_DTO_PARAM
+#define DSCCLK0_DTO_PARAM__DSCCLK0_DTO_PHASE__SHIFT                                                           0x0
+#define DSCCLK0_DTO_PARAM__DSCCLK0_DTO_MODULO__SHIFT                                                          0x10
+#define DSCCLK0_DTO_PARAM__DSCCLK0_DTO_PHASE_MASK                                                             0x000000FFL
+#define DSCCLK0_DTO_PARAM__DSCCLK0_DTO_MODULO_MASK                                                            0x00FF0000L
+//DSCCLK1_DTO_PARAM
+#define DSCCLK1_DTO_PARAM__DSCCLK1_DTO_PHASE__SHIFT                                                           0x0
+#define DSCCLK1_DTO_PARAM__DSCCLK1_DTO_MODULO__SHIFT                                                          0x10
+#define DSCCLK1_DTO_PARAM__DSCCLK1_DTO_PHASE_MASK                                                             0x000000FFL
+#define DSCCLK1_DTO_PARAM__DSCCLK1_DTO_MODULO_MASK                                                            0x00FF0000L
+//DSCCLK2_DTO_PARAM
+#define DSCCLK2_DTO_PARAM__DSCCLK2_DTO_PHASE__SHIFT                                                           0x0
+#define DSCCLK2_DTO_PARAM__DSCCLK2_DTO_MODULO__SHIFT                                                          0x10
+#define DSCCLK2_DTO_PARAM__DSCCLK2_DTO_PHASE_MASK                                                             0x000000FFL
+#define DSCCLK2_DTO_PARAM__DSCCLK2_DTO_MODULO_MASK                                                            0x00FF0000L
+//OTG_PIXEL_RATE_DIV
+#define OTG_PIXEL_RATE_DIV__OTG0_TMDS_PIXEL_RATE_DIV__SHIFT                                                   0x0
+#define OTG_PIXEL_RATE_DIV__DPDTO0_INT__SHIFT                                                                 0x1
+#define OTG_PIXEL_RATE_DIV__OTG1_TMDS_PIXEL_RATE_DIV__SHIFT                                                   0x5
+#define OTG_PIXEL_RATE_DIV__DPDTO1_INT__SHIFT                                                                 0x6
+#define OTG_PIXEL_RATE_DIV__OTG2_TMDS_PIXEL_RATE_DIV__SHIFT                                                   0xa
+#define OTG_PIXEL_RATE_DIV__DPDTO2_INT__SHIFT                                                                 0xb
+#define OTG_PIXEL_RATE_DIV__OTG3_TMDS_PIXEL_RATE_DIV__SHIFT                                                   0xf
+#define OTG_PIXEL_RATE_DIV__DPDTO3_INT__SHIFT                                                                 0x10
+#define OTG_PIXEL_RATE_DIV__OTG0_TMDS_PIXEL_RATE_DIV_MASK                                                     0x00000001L
+#define OTG_PIXEL_RATE_DIV__DPDTO0_INT_MASK                                                                   0x0000001EL
+#define OTG_PIXEL_RATE_DIV__OTG1_TMDS_PIXEL_RATE_DIV_MASK                                                     0x00000020L
+#define OTG_PIXEL_RATE_DIV__DPDTO1_INT_MASK                                                                   0x000003C0L
+#define OTG_PIXEL_RATE_DIV__OTG2_TMDS_PIXEL_RATE_DIV_MASK                                                     0x00000400L
+#define OTG_PIXEL_RATE_DIV__DPDTO2_INT_MASK                                                                   0x00007800L
+#define OTG_PIXEL_RATE_DIV__OTG3_TMDS_PIXEL_RATE_DIV_MASK                                                     0x00008000L
+#define OTG_PIXEL_RATE_DIV__DPDTO3_INT_MASK                                                                   0x000F0000L
+//MILLISECOND_TIME_BASE_DIV
+#define MILLISECOND_TIME_BASE_DIV__MILLISECOND_TIME_BASE_DIV__SHIFT                                           0x0
+#define MILLISECOND_TIME_BASE_DIV__MILLISECOND_TIME_BASE_CLOCK_SOURCE_SEL__SHIFT                              0x14
+#define MILLISECOND_TIME_BASE_DIV__MILLISECOND_TIME_BASE_DIV_MASK                                             0x0001FFFFL
+#define MILLISECOND_TIME_BASE_DIV__MILLISECOND_TIME_BASE_CLOCK_SOURCE_SEL_MASK                                0x00100000L
+//DISPCLK_FREQ_CHANGE_CNTL
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_STEP_DELAY__SHIFT                                                   0x0
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_FREQ_RAMP_DONE__SHIFT                                               0x14
+#define DISPCLK_FREQ_CHANGE_CNTL__RESYNC_FIFO_LEVEL_ADJUST_EN__SHIFT                                          0x15
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_RESET__SHIFT                                               0x16
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_MAX_ERRDET_CYCLES__SHIFT                                            0x18
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_STATE__SHIFT                                               0x1d
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_OVR_EN__SHIFT                                              0x1e
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_STEP_DELAY_MASK                                                     0x00003FFFL
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_FREQ_RAMP_DONE_MASK                                                 0x00100000L
+#define DISPCLK_FREQ_CHANGE_CNTL__RESYNC_FIFO_LEVEL_ADJUST_EN_MASK                                            0x00200000L
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_RESET_MASK                                                 0x00400000L
+#define DISPCLK_FREQ_CHANGE_CNTL__DISPCLK_MAX_ERRDET_CYCLES_MASK                                              0x1F000000L
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_STATE_MASK                                                 0x20000000L
+#define DISPCLK_FREQ_CHANGE_CNTL__DCCG_FIFO_ERRDET_OVR_EN_MASK                                                0x40000000L
+//DC_MEM_GLOBAL_PWR_REQ_CNTL
+#define DC_MEM_GLOBAL_PWR_REQ_CNTL__DC_MEM_GLOBAL_PWR_REQ_DIS__SHIFT                                          0x0
+#define DC_MEM_GLOBAL_PWR_REQ_CNTL__DC_MEM_GLOBAL_PWR_REQ_DIS_MASK                                            0x00000001L
+//DCCG_GATE_DISABLE_CNTL
+#define DCCG_GATE_DISABLE_CNTL__DISPCLK_DCCG_GATE_DISABLE__SHIFT                                              0x0
+#define DCCG_GATE_DISABLE_CNTL__DISPCLK_R_DCCG_GATE_DISABLE__SHIFT                                            0x1
+#define DCCG_GATE_DISABLE_CNTL__SOCCLK_GATE_DISABLE__SHIFT                                                    0x2
+#define DCCG_GATE_DISABLE_CNTL__DPREFCLK_GATE_DISABLE__SHIFT                                                  0x3
+#define DCCG_GATE_DISABLE_CNTL__DPREFCLK_R_DCCG_GATE_DISABLE__SHIFT                                           0x8
+#define DCCG_GATE_DISABLE_CNTL__DPPCLK_GATE_DISABLE__SHIFT                                                    0x9
+#define DCCG_GATE_DISABLE_CNTL__DPPCLK_R_DCCG_GATE_DISABLE__SHIFT                                             0xa
+#define DCCG_GATE_DISABLE_CNTL__DSCCLK_GATE_DISABLE__SHIFT                                                    0xb
+#define DCCG_GATE_DISABLE_CNTL__REFCLK_GATE_DISABLE__SHIFT                                                    0x1a
+#define DCCG_GATE_DISABLE_CNTL__REFCLK_R_DIG_GATE_DISABLE__SHIFT                                              0x1b
+#define DCCG_GATE_DISABLE_CNTL__DISPCLK_DCCG_GATE_DISABLE_MASK                                                0x00000001L
+#define DCCG_GATE_DISABLE_CNTL__DISPCLK_R_DCCG_GATE_DISABLE_MASK                                              0x00000002L
+#define DCCG_GATE_DISABLE_CNTL__SOCCLK_GATE_DISABLE_MASK                                                      0x00000004L
+#define DCCG_GATE_DISABLE_CNTL__DPREFCLK_GATE_DISABLE_MASK                                                    0x00000008L
+#define DCCG_GATE_DISABLE_CNTL__DPREFCLK_R_DCCG_GATE_DISABLE_MASK                                             0x00000100L
+#define DCCG_GATE_DISABLE_CNTL__DPPCLK_GATE_DISABLE_MASK                                                      0x00000200L
+#define DCCG_GATE_DISABLE_CNTL__DPPCLK_R_DCCG_GATE_DISABLE_MASK                                               0x00000400L
+#define DCCG_GATE_DISABLE_CNTL__DSCCLK_GATE_DISABLE_MASK                                                      0x00000800L
+#define DCCG_GATE_DISABLE_CNTL__REFCLK_GATE_DISABLE_MASK                                                      0x04000000L
+#define DCCG_GATE_DISABLE_CNTL__REFCLK_R_DIG_GATE_DISABLE_MASK                                                0x08000000L
+//DISPCLK_CGTT_BLK_CTRL_REG
+#define DISPCLK_CGTT_BLK_CTRL_REG__DISPCLK_TURN_ON_DELAY__SHIFT                                               0x0
+#define DISPCLK_CGTT_BLK_CTRL_REG__DISPCLK_TURN_OFF_DELAY__SHIFT                                              0x4
+#define DISPCLK_CGTT_BLK_CTRL_REG__DISPCLK_TURN_ON_DELAY_MASK                                                 0x0000000FL
+#define DISPCLK_CGTT_BLK_CTRL_REG__DISPCLK_TURN_OFF_DELAY_MASK                                                0x00000FF0L
+//SOCCLK_CGTT_BLK_CTRL_REG
+#define SOCCLK_CGTT_BLK_CTRL_REG__SOCCLK_TURN_ON_DELAY__SHIFT                                                 0x0
+#define SOCCLK_CGTT_BLK_CTRL_REG__SOCCLK_TURN_OFF_DELAY__SHIFT                                                0x4
+#define SOCCLK_CGTT_BLK_CTRL_REG__SOCCLK_TURN_ON_DELAY_MASK                                                   0x0000000FL
+#define SOCCLK_CGTT_BLK_CTRL_REG__SOCCLK_TURN_OFF_DELAY_MASK                                                  0x00000FF0L
+//MICROSECOND_TIME_BASE_DIV
+#define MICROSECOND_TIME_BASE_DIV__MICROSECOND_TIME_BASE_DIV__SHIFT                                           0x0
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_DIV__SHIFT                                                        0x8
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_SEL__SHIFT                                                        0x10
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_CLOCK_SOURCE_SEL__SHIFT                                           0x11
+#define MICROSECOND_TIME_BASE_DIV__MICROSECOND_TIME_BASE_CLOCK_SOURCE_SEL__SHIFT                              0x14
+#define MICROSECOND_TIME_BASE_DIV__MICROSECOND_TIME_BASE_DIV_MASK                                             0x0000007FL
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_DIV_MASK                                                          0x00007F00L
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_SEL_MASK                                                          0x00010000L
+#define MICROSECOND_TIME_BASE_DIV__XTAL_REF_CLOCK_SOURCE_SEL_MASK                                             0x00020000L
+#define MICROSECOND_TIME_BASE_DIV__MICROSECOND_TIME_BASE_CLOCK_SOURCE_SEL_MASK                                0x00100000L
+//DCCG_GATE_DISABLE_CNTL2
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKA_FE_GATE_DISABLE__SHIFT                                               0x0
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKB_FE_GATE_DISABLE__SHIFT                                               0x1
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKC_FE_GATE_DISABLE__SHIFT                                               0x2
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKD_FE_GATE_DISABLE__SHIFT                                               0x3
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKE_FE_GATE_DISABLE__SHIFT                                               0x4
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKF_FE_GATE_DISABLE__SHIFT                                               0x5
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKG_FE_GATE_DISABLE__SHIFT                                               0x6
+#define DCCG_GATE_DISABLE_CNTL2__HDMICHARCLK0_GATE_DISABLE__SHIFT                                             0x8
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKA_GATE_DISABLE__SHIFT                                                  0x10
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKB_GATE_DISABLE__SHIFT                                                  0x11
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKC_GATE_DISABLE__SHIFT                                                  0x12
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKD_GATE_DISABLE__SHIFT                                                  0x13
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKE_GATE_DISABLE__SHIFT                                                  0x14
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKF_GATE_DISABLE__SHIFT                                                  0x15
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKG_GATE_DISABLE__SHIFT                                                  0x16
+#define DCCG_GATE_DISABLE_CNTL2__PHYASYMCLK_ROOT_GATE_DISABLE__SHIFT                                          0x18
+#define DCCG_GATE_DISABLE_CNTL2__PHYBSYMCLK_ROOT_GATE_DISABLE__SHIFT                                          0x19
+#define DCCG_GATE_DISABLE_CNTL2__PHYCSYMCLK_ROOT_GATE_DISABLE__SHIFT                                          0x1a
+#define DCCG_GATE_DISABLE_CNTL2__PHYDSYMCLK_ROOT_GATE_DISABLE__SHIFT                                          0x1b
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKA_FE_GATE_DISABLE_MASK                                                 0x00000001L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKB_FE_GATE_DISABLE_MASK                                                 0x00000002L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKC_FE_GATE_DISABLE_MASK                                                 0x00000004L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKD_FE_GATE_DISABLE_MASK                                                 0x00000008L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKE_FE_GATE_DISABLE_MASK                                                 0x00000010L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKF_FE_GATE_DISABLE_MASK                                                 0x00000020L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKG_FE_GATE_DISABLE_MASK                                                 0x00000040L
+#define DCCG_GATE_DISABLE_CNTL2__HDMICHARCLK0_GATE_DISABLE_MASK                                               0x00000100L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKA_GATE_DISABLE_MASK                                                    0x00010000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKB_GATE_DISABLE_MASK                                                    0x00020000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKC_GATE_DISABLE_MASK                                                    0x00040000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKD_GATE_DISABLE_MASK                                                    0x00080000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKE_GATE_DISABLE_MASK                                                    0x00100000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKF_GATE_DISABLE_MASK                                                    0x00200000L
+#define DCCG_GATE_DISABLE_CNTL2__SYMCLKG_GATE_DISABLE_MASK                                                    0x00400000L
+#define DCCG_GATE_DISABLE_CNTL2__PHYASYMCLK_ROOT_GATE_DISABLE_MASK                                            0x01000000L
+#define DCCG_GATE_DISABLE_CNTL2__PHYBSYMCLK_ROOT_GATE_DISABLE_MASK                                            0x02000000L
+#define DCCG_GATE_DISABLE_CNTL2__PHYCSYMCLK_ROOT_GATE_DISABLE_MASK                                            0x04000000L
+#define DCCG_GATE_DISABLE_CNTL2__PHYDSYMCLK_ROOT_GATE_DISABLE_MASK                                            0x08000000L
+//SYMCLK_CGTT_BLK_CTRL_REG
+#define SYMCLK_CGTT_BLK_CTRL_REG__SYMCLK_TURN_ON_DELAY__SHIFT                                                 0x0
+#define SYMCLK_CGTT_BLK_CTRL_REG__SYMCLK_TURN_OFF_DELAY__SHIFT                                                0x4
+#define SYMCLK_CGTT_BLK_CTRL_REG__SYMCLK_TURN_ON_DELAY_MASK                                                   0x0000000FL
+#define SYMCLK_CGTT_BLK_CTRL_REG__SYMCLK_TURN_OFF_DELAY_MASK                                                  0x00000FF0L
+//OTG0_PIXEL_RATE_CNTL
+#define OTG0_PIXEL_RATE_CNTL__OTG0_PIXEL_RATE_SOURCE__SHIFT                                                   0x0
+#define OTG0_PIXEL_RATE_CNTL__DP_DTO0_ENABLE__SHIFT                                                           0x4
+#define OTG0_PIXEL_RATE_CNTL__DP_DTO0_DS_DISABLE__SHIFT                                                       0x5
+#define OTG0_PIXEL_RATE_CNTL__DPDTO0_ENABLE_STATUS__SHIFT                                                     0x7
+#define OTG0_PIXEL_RATE_CNTL__PIPE0_DTO_SRC_SEL__SHIFT                                                        0xc
+#define OTG0_PIXEL_RATE_CNTL__OTG0_DIO_FIFO_ERROR__SHIFT                                                      0xe
+#define OTG0_PIXEL_RATE_CNTL__OTG0_PIXEL_RATE_SOURCE_MASK                                                     0x00000003L
+#define OTG0_PIXEL_RATE_CNTL__DP_DTO0_ENABLE_MASK                                                             0x00000010L
+#define OTG0_PIXEL_RATE_CNTL__DP_DTO0_DS_DISABLE_MASK                                                         0x00000020L
+#define OTG0_PIXEL_RATE_CNTL__DPDTO0_ENABLE_STATUS_MASK                                                       0x00000080L
+#define OTG0_PIXEL_RATE_CNTL__PIPE0_DTO_SRC_SEL_MASK                                                          0x00001000L
+#define OTG0_PIXEL_RATE_CNTL__OTG0_DIO_FIFO_ERROR_MASK                                                        0x0000C000L
+//DP_DTO0_PHASE
+#define DP_DTO0_PHASE__DP_DTO0_PHASE__SHIFT                                                                   0x0
+#define DP_DTO0_PHASE__DP_DTO0_PHASE_MASK                                                                     0xFFFFFFFFL
+//DP_DTO0_MODULO
+#define DP_DTO0_MODULO__DP_DTO0_MODULO__SHIFT                                                                 0x0
+#define DP_DTO0_MODULO__DP_DTO0_MODULO_MASK                                                                   0xFFFFFFFFL
+//OTG0_PHYPLL_PIXEL_RATE_CNTL
+#define OTG0_PHYPLL_PIXEL_RATE_CNTL__OTG0_PHYPLL_PIXEL_RATE_SOURCE__SHIFT                                     0x0
+#define OTG0_PHYPLL_PIXEL_RATE_CNTL__OTG0_PHYPLL_PIXEL_RATE_SOURCE_MASK                                       0x00000007L
+//OTG1_PIXEL_RATE_CNTL
+#define OTG1_PIXEL_RATE_CNTL__OTG1_PIXEL_RATE_SOURCE__SHIFT                                                   0x0
+#define OTG1_PIXEL_RATE_CNTL__DP_DTO1_ENABLE__SHIFT                                                           0x4
+#define OTG1_PIXEL_RATE_CNTL__DP_DTO1_DS_DISABLE__SHIFT                                                       0x5
+#define OTG1_PIXEL_RATE_CNTL__DPDTO1_ENABLE_STATUS__SHIFT                                                     0x7
+#define OTG1_PIXEL_RATE_CNTL__PIPE1_DTO_SRC_SEL__SHIFT                                                        0xc
+#define OTG1_PIXEL_RATE_CNTL__OTG1_DIO_FIFO_ERROR__SHIFT                                                      0xe
+#define OTG1_PIXEL_RATE_CNTL__OTG1_PIXEL_RATE_SOURCE_MASK                                                     0x00000003L
+#define OTG1_PIXEL_RATE_CNTL__DP_DTO1_ENABLE_MASK                                                             0x00000010L
+#define OTG1_PIXEL_RATE_CNTL__DP_DTO1_DS_DISABLE_MASK                                                         0x00000020L
+#define OTG1_PIXEL_RATE_CNTL__DPDTO1_ENABLE_STATUS_MASK                                                       0x00000080L
+#define OTG1_PIXEL_RATE_CNTL__PIPE1_DTO_SRC_SEL_MASK                                                          0x00001000L
+#define OTG1_PIXEL_RATE_CNTL__OTG1_DIO_FIFO_ERROR_MASK                                                        0x0000C000L
+//DP_DTO1_PHASE
+#define DP_DTO1_PHASE__DP_DTO1_PHASE__SHIFT                                                                   0x0
+#define DP_DTO1_PHASE__DP_DTO1_PHASE_MASK                                                                     0xFFFFFFFFL
+//DP_DTO1_MODULO
+#define DP_DTO1_MODULO__DP_DTO1_MODULO__SHIFT                                                                 0x0
+#define DP_DTO1_MODULO__DP_DTO1_MODULO_MASK                                                                   0xFFFFFFFFL
+//OTG1_PHYPLL_PIXEL_RATE_CNTL
+#define OTG1_PHYPLL_PIXEL_RATE_CNTL__OTG1_PHYPLL_PIXEL_RATE_SOURCE__SHIFT                                     0x0
+#define OTG1_PHYPLL_PIXEL_RATE_CNTL__OTG1_PHYPLL_PIXEL_RATE_SOURCE_MASK                                       0x00000007L
+//OTG2_PIXEL_RATE_CNTL
+#define OTG2_PIXEL_RATE_CNTL__OTG2_PIXEL_RATE_SOURCE__SHIFT                                                   0x0
+#define OTG2_PIXEL_RATE_CNTL__DP_DTO2_ENABLE__SHIFT                                                           0x4
+#define OTG2_PIXEL_RATE_CNTL__DP_DTO2_DS_DISABLE__SHIFT                                                       0x5
+#define OTG2_PIXEL_RATE_CNTL__DPDTO2_ENABLE_STATUS__SHIFT                                                     0x7
+#define OTG2_PIXEL_RATE_CNTL__PIPE2_DTO_SRC_SEL__SHIFT                                                        0xc
+#define OTG2_PIXEL_RATE_CNTL__OTG2_DIO_FIFO_ERROR__SHIFT                                                      0xe
+#define OTG2_PIXEL_RATE_CNTL__OTG2_PIXEL_RATE_SOURCE_MASK                                                     0x00000003L
+#define OTG2_PIXEL_RATE_CNTL__DP_DTO2_ENABLE_MASK                                                             0x00000010L
+#define OTG2_PIXEL_RATE_CNTL__DP_DTO2_DS_DISABLE_MASK                                                         0x00000020L
+#define OTG2_PIXEL_RATE_CNTL__DPDTO2_ENABLE_STATUS_MASK                                                       0x00000080L
+#define OTG2_PIXEL_RATE_CNTL__PIPE2_DTO_SRC_SEL_MASK                                                          0x00001000L
+#define OTG2_PIXEL_RATE_CNTL__OTG2_DIO_FIFO_ERROR_MASK                                                        0x0000C000L
+//DP_DTO2_PHASE
+#define DP_DTO2_PHASE__DP_DTO2_PHASE__SHIFT                                                                   0x0
+#define DP_DTO2_PHASE__DP_DTO2_PHASE_MASK                                                                     0xFFFFFFFFL
+//DP_DTO2_MODULO
+#define DP_DTO2_MODULO__DP_DTO2_MODULO__SHIFT                                                                 0x0
+#define DP_DTO2_MODULO__DP_DTO2_MODULO_MASK                                                                   0xFFFFFFFFL
+//OTG2_PHYPLL_PIXEL_RATE_CNTL
+#define OTG2_PHYPLL_PIXEL_RATE_CNTL__OTG2_PHYPLL_PIXEL_RATE_SOURCE__SHIFT                                     0x0
+#define OTG2_PHYPLL_PIXEL_RATE_CNTL__OTG2_PHYPLL_PIXEL_RATE_SOURCE_MASK                                       0x00000007L
+//OTG3_PIXEL_RATE_CNTL
+#define OTG3_PIXEL_RATE_CNTL__OTG3_PIXEL_RATE_SOURCE__SHIFT                                                   0x0
+#define OTG3_PIXEL_RATE_CNTL__DP_DTO3_ENABLE__SHIFT                                                           0x4
+#define OTG3_PIXEL_RATE_CNTL__DP_DTO3_DS_DISABLE__SHIFT                                                       0x5
+#define OTG3_PIXEL_RATE_CNTL__DPDTO3_ENABLE_STATUS__SHIFT                                                     0x7
+#define OTG3_PIXEL_RATE_CNTL__PIPE3_DTO_SRC_SEL__SHIFT                                                        0xc
+#define OTG3_PIXEL_RATE_CNTL__OTG3_DIO_FIFO_ERROR__SHIFT                                                      0xe
+#define OTG3_PIXEL_RATE_CNTL__OTG3_PIXEL_RATE_SOURCE_MASK                                                     0x00000003L
+#define OTG3_PIXEL_RATE_CNTL__DP_DTO3_ENABLE_MASK                                                             0x00000010L
+#define OTG3_PIXEL_RATE_CNTL__DP_DTO3_DS_DISABLE_MASK                                                         0x00000020L
+#define OTG3_PIXEL_RATE_CNTL__DPDTO3_ENABLE_STATUS_MASK                                                       0x00000080L
+#define OTG3_PIXEL_RATE_CNTL__PIPE3_DTO_SRC_SEL_MASK                                                          0x00001000L
+#define OTG3_PIXEL_RATE_CNTL__OTG3_DIO_FIFO_ERROR_MASK                                                        0x0000C000L
+//DP_DTO3_PHASE
+#define DP_DTO3_PHASE__DP_DTO3_PHASE__SHIFT                                                                   0x0
+#define DP_DTO3_PHASE__DP_DTO3_PHASE_MASK                                                                     0xFFFFFFFFL
+//DP_DTO3_MODULO
+#define DP_DTO3_MODULO__DP_DTO3_MODULO__SHIFT                                                                 0x0
+#define DP_DTO3_MODULO__DP_DTO3_MODULO_MASK                                                                   0xFFFFFFFFL
+//OTG3_PHYPLL_PIXEL_RATE_CNTL
+#define OTG3_PHYPLL_PIXEL_RATE_CNTL__OTG3_PHYPLL_PIXEL_RATE_SOURCE__SHIFT                                     0x0
+#define OTG3_PHYPLL_PIXEL_RATE_CNTL__OTG3_PHYPLL_PIXEL_RATE_SOURCE_MASK                                       0x00000007L
+//DPPCLK_CGTT_BLK_CTRL_REG
+#define DPPCLK_CGTT_BLK_CTRL_REG__DPPCLK_TURN_ON_DELAY__SHIFT                                                 0x0
+#define DPPCLK_CGTT_BLK_CTRL_REG__DPPCLK_TURN_OFF_DELAY__SHIFT                                                0x4
+#define DPPCLK_CGTT_BLK_CTRL_REG__DPPCLK_TURN_ON_DELAY_MASK                                                   0x0000000FL
+#define DPPCLK_CGTT_BLK_CTRL_REG__DPPCLK_TURN_OFF_DELAY_MASK                                                  0x00000FF0L
+//DPPCLK0_DTO_PARAM
+#define DPPCLK0_DTO_PARAM__DPPCLK0_DTO_PHASE__SHIFT                                                           0x0
+#define DPPCLK0_DTO_PARAM__DPPCLK0_DTO_MODULO__SHIFT                                                          0x10
+#define DPPCLK0_DTO_PARAM__DPPCLK0_DTO_PHASE_MASK                                                             0x000000FFL
+#define DPPCLK0_DTO_PARAM__DPPCLK0_DTO_MODULO_MASK                                                            0x00FF0000L
+//DPPCLK1_DTO_PARAM
+#define DPPCLK1_DTO_PARAM__DPPCLK1_DTO_PHASE__SHIFT                                                           0x0
+#define DPPCLK1_DTO_PARAM__DPPCLK1_DTO_MODULO__SHIFT                                                          0x10
+#define DPPCLK1_DTO_PARAM__DPPCLK1_DTO_PHASE_MASK                                                             0x000000FFL
+#define DPPCLK1_DTO_PARAM__DPPCLK1_DTO_MODULO_MASK                                                            0x00FF0000L
+//DPPCLK2_DTO_PARAM
+#define DPPCLK2_DTO_PARAM__DPPCLK2_DTO_PHASE__SHIFT                                                           0x0
+#define DPPCLK2_DTO_PARAM__DPPCLK2_DTO_MODULO__SHIFT                                                          0x10
+#define DPPCLK2_DTO_PARAM__DPPCLK2_DTO_PHASE_MASK                                                             0x000000FFL
+#define DPPCLK2_DTO_PARAM__DPPCLK2_DTO_MODULO_MASK                                                            0x00FF0000L
+//DPPCLK3_DTO_PARAM
+#define DPPCLK3_DTO_PARAM__DPPCLK3_DTO_PHASE__SHIFT                                                           0x0
+#define DPPCLK3_DTO_PARAM__DPPCLK3_DTO_MODULO__SHIFT                                                          0x10
+#define DPPCLK3_DTO_PARAM__DPPCLK3_DTO_PHASE_MASK                                                             0x000000FFL
+#define DPPCLK3_DTO_PARAM__DPPCLK3_DTO_MODULO_MASK                                                            0x00FF0000L
+//SYMCLKA_CLOCK_ENABLE
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_CLOCK_ENABLE__SHIFT                                                     0x0
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_FE_EN__SHIFT                                                            0x4
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_FE_SRC_SEL__SHIFT                                                       0x8
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_CLOCK_ENABLE_MASK                                                       0x00000001L
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_FE_EN_MASK                                                              0x00000010L
+#define SYMCLKA_CLOCK_ENABLE__SYMCLKA_FE_SRC_SEL_MASK                                                         0x00000700L
+//SYMCLKB_CLOCK_ENABLE
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_CLOCK_ENABLE__SHIFT                                                     0x0
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_FE_EN__SHIFT                                                            0x4
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_FE_SRC_SEL__SHIFT                                                       0x8
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_CLOCK_ENABLE_MASK                                                       0x00000001L
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_FE_EN_MASK                                                              0x00000010L
+#define SYMCLKB_CLOCK_ENABLE__SYMCLKB_FE_SRC_SEL_MASK                                                         0x00000700L
+//SYMCLKC_CLOCK_ENABLE
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_CLOCK_ENABLE__SHIFT                                                     0x0
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_FE_EN__SHIFT                                                            0x4
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_FE_SRC_SEL__SHIFT                                                       0x8
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_CLOCK_ENABLE_MASK                                                       0x00000001L
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_FE_EN_MASK                                                              0x00000010L
+#define SYMCLKC_CLOCK_ENABLE__SYMCLKC_FE_SRC_SEL_MASK                                                         0x00000700L
+//SYMCLKD_CLOCK_ENABLE
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_CLOCK_ENABLE__SHIFT                                                     0x0
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_FE_EN__SHIFT                                                            0x4
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_FE_SRC_SEL__SHIFT                                                       0x8
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_CLOCK_ENABLE_MASK                                                       0x00000001L
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_FE_EN_MASK                                                              0x00000010L
+#define SYMCLKD_CLOCK_ENABLE__SYMCLKD_FE_SRC_SEL_MASK                                                         0x00000700L
+//DCCG_SOFT_RESET
+#define DCCG_SOFT_RESET__REFCLK_SOFT_RESET__SHIFT                                                             0x0
+#define DCCG_SOFT_RESET__DPREFCLK_SOFT_RESET__SHIFT                                                           0x8
+#define DCCG_SOFT_RESET__REFCLK_SOFT_RESET_MASK                                                               0x00000001L
+#define DCCG_SOFT_RESET__DPREFCLK_SOFT_RESET_MASK                                                             0x00000100L
+//DSCCLK_DTO_CTRL
+#define DSCCLK_DTO_CTRL__DSCCLK0_EN__SHIFT                                                                    0x0
+#define DSCCLK_DTO_CTRL__DSCCLK1_EN__SHIFT                                                                    0x1
+#define DSCCLK_DTO_CTRL__DSCCLK2_EN__SHIFT                                                                    0x2
+#define DSCCLK_DTO_CTRL__DSCCLK3_EN__SHIFT                                                                    0x3
+#define DSCCLK_DTO_CTRL__DSCCLK4_EN__SHIFT                                                                    0x4
+#define DSCCLK_DTO_CTRL__DSCCLK5_EN__SHIFT                                                                    0x5
+#define DSCCLK_DTO_CTRL__DSCCLK0_DTO_DB_EN__SHIFT                                                             0x8
+#define DSCCLK_DTO_CTRL__DSCCLK1_DTO_DB_EN__SHIFT                                                             0x9
+#define DSCCLK_DTO_CTRL__DSCCLK2_DTO_DB_EN__SHIFT                                                             0xa
+#define DSCCLK_DTO_CTRL__DSCCLK3_DTO_DB_EN__SHIFT                                                             0xb
+#define DSCCLK_DTO_CTRL__DSCCLK4_DTO_DB_EN__SHIFT                                                             0xc
+#define DSCCLK_DTO_CTRL__DSCCLK5_DTO_DB_EN__SHIFT                                                             0xd
+#define DSCCLK_DTO_CTRL__DSCCLK0_EN_MASK                                                                      0x00000001L
+#define DSCCLK_DTO_CTRL__DSCCLK1_EN_MASK                                                                      0x00000002L
+#define DSCCLK_DTO_CTRL__DSCCLK2_EN_MASK                                                                      0x00000004L
+#define DSCCLK_DTO_CTRL__DSCCLK3_EN_MASK                                                                      0x00000008L
+#define DSCCLK_DTO_CTRL__DSCCLK4_EN_MASK                                                                      0x00000010L
+#define DSCCLK_DTO_CTRL__DSCCLK5_EN_MASK                                                                      0x00000020L
+#define DSCCLK_DTO_CTRL__DSCCLK0_DTO_DB_EN_MASK                                                               0x00000100L
+#define DSCCLK_DTO_CTRL__DSCCLK1_DTO_DB_EN_MASK                                                               0x00000200L
+#define DSCCLK_DTO_CTRL__DSCCLK2_DTO_DB_EN_MASK                                                               0x00000400L
+#define DSCCLK_DTO_CTRL__DSCCLK3_DTO_DB_EN_MASK                                                               0x00000800L
+#define DSCCLK_DTO_CTRL__DSCCLK4_DTO_DB_EN_MASK                                                               0x00001000L
+#define DSCCLK_DTO_CTRL__DSCCLK5_DTO_DB_EN_MASK                                                               0x00002000L
+//DPPCLK_CTRL
+#define DPPCLK_CTRL__DPPCLK0_EN__SHIFT                                                                        0x0
+#define DPPCLK_CTRL__DPPCLK1_EN__SHIFT                                                                        0x3
+#define DPPCLK_CTRL__DPPCLK2_EN__SHIFT                                                                        0x6
+#define DPPCLK_CTRL__DPPCLK3_EN__SHIFT                                                                        0x9
+#define DPPCLK_CTRL__DPPCLK0_EN_MASK                                                                          0x00000001L
+#define DPPCLK_CTRL__DPPCLK1_EN_MASK                                                                          0x00000008L
+#define DPPCLK_CTRL__DPPCLK2_EN_MASK                                                                          0x00000040L
+#define DPPCLK_CTRL__DPPCLK3_EN_MASK                                                                          0x00000200L
+//DCCG_GATE_DISABLE_CNTL6
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK0_ROOT_GATE_DISABLE__SHIFT                                             0x0
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK1_ROOT_GATE_DISABLE__SHIFT                                             0x1
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK2_ROOT_GATE_DISABLE__SHIFT                                             0x2
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK3_ROOT_GATE_DISABLE__SHIFT                                             0x3
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK0_ROOT_GATE_DISABLE__SHIFT                                             0x8
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK1_ROOT_GATE_DISABLE__SHIFT                                             0x9
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK2_ROOT_GATE_DISABLE__SHIFT                                             0xa
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK3_ROOT_GATE_DISABLE__SHIFT                                             0xb
+#define DCCG_GATE_DISABLE_CNTL6__HDMISTREAMCLK0_ROOT_GATE_DISABLE__SHIFT                                      0xf
+#define DCCG_GATE_DISABLE_CNTL6__DPREFCLK_DIO_GATE_DISABLE__SHIFT                                             0x18
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK0_ROOT_GATE_DISABLE_MASK                                               0x00000001L
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK1_ROOT_GATE_DISABLE_MASK                                               0x00000002L
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK2_ROOT_GATE_DISABLE_MASK                                               0x00000004L
+#define DCCG_GATE_DISABLE_CNTL6__DPPCLK3_ROOT_GATE_DISABLE_MASK                                               0x00000008L
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK0_ROOT_GATE_DISABLE_MASK                                               0x00000100L
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK1_ROOT_GATE_DISABLE_MASK                                               0x00000200L
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK2_ROOT_GATE_DISABLE_MASK                                               0x00000400L
+#define DCCG_GATE_DISABLE_CNTL6__DSCCLK3_ROOT_GATE_DISABLE_MASK                                               0x00000800L
+#define DCCG_GATE_DISABLE_CNTL6__HDMISTREAMCLK0_ROOT_GATE_DISABLE_MASK                                        0x00008000L
+#define DCCG_GATE_DISABLE_CNTL6__DPREFCLK_DIO_GATE_DISABLE_MASK                                               0x01000000L
+//SYMCLK_PSP_CNTL
+#define SYMCLK_PSP_CNTL__SYMCLK_PSP_FORCE_ON__SHIFT                                                           0x0
+#define SYMCLK_PSP_CNTL__SYMCLK_PSP_FORCE_ON_MASK                                                             0x00000001L
+//DCCG_AUDIO_DTO_SOURCE
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO0_SOURCE_SEL__SHIFT                                              0x0
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO_SEL__SHIFT                                                      0x4
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO0_USE_512FBR_DTO__SHIFT                                          0x18
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO1_USE_512FBR_DTO__SHIFT                                          0x1c
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO0_SOURCE_SEL_MASK                                                0x00000007L
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO_SEL_MASK                                                        0x00000030L
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO0_USE_512FBR_DTO_MASK                                            0x01000000L
+#define DCCG_AUDIO_DTO_SOURCE__DCCG_AUDIO_DTO1_USE_512FBR_DTO_MASK                                            0x10000000L
+//DCCG_AUDIO_DTO0_PHASE
+#define DCCG_AUDIO_DTO0_PHASE__DCCG_AUDIO_DTO0_PHASE__SHIFT                                                   0x0
+#define DCCG_AUDIO_DTO0_PHASE__DCCG_AUDIO_DTO0_PHASE_MASK                                                     0xFFFFFFFFL
+//DCCG_AUDIO_DTO0_MODULE
+#define DCCG_AUDIO_DTO0_MODULE__DCCG_AUDIO_DTO0_MODULE__SHIFT                                                 0x0
+#define DCCG_AUDIO_DTO0_MODULE__DCCG_AUDIO_DTO0_MODULE_MASK                                                   0xFFFFFFFFL
+//DCCG_AUDIO_DTO1_PHASE
+#define DCCG_AUDIO_DTO1_PHASE__DCCG_AUDIO_DTO1_PHASE__SHIFT                                                   0x0
+#define DCCG_AUDIO_DTO1_PHASE__DCCG_AUDIO_DTO1_PHASE_MASK                                                     0xFFFFFFFFL
+//DCCG_AUDIO_DTO1_MODULE
+#define DCCG_AUDIO_DTO1_MODULE__DCCG_AUDIO_DTO1_MODULE__SHIFT                                                 0x0
+#define DCCG_AUDIO_DTO1_MODULE__DCCG_AUDIO_DTO1_MODULE_MASK                                                   0xFFFFFFFFL
+//DPPCLK_DTO_CTRL
+#define DPPCLK_DTO_CTRL__DPPCLK0_DTO_DB_EN__SHIFT                                                             0x1
+#define DPPCLK_DTO_CTRL__DPPCLK1_DTO_DB_EN__SHIFT                                                             0x5
+#define DPPCLK_DTO_CTRL__DPPCLK2_DTO_DB_EN__SHIFT                                                             0x9
+#define DPPCLK_DTO_CTRL__DPPCLK3_DTO_DB_EN__SHIFT                                                             0xd
+#define DPPCLK_DTO_CTRL__DPPCLK4_DTO_DB_EN__SHIFT                                                             0x11
+#define DPPCLK_DTO_CTRL__DPPCLK5_DTO_DB_EN__SHIFT                                                             0x15
+#define DPPCLK_DTO_CTRL__DPPCLK0_DTO_DB_EN_MASK                                                               0x00000002L
+#define DPPCLK_DTO_CTRL__DPPCLK1_DTO_DB_EN_MASK                                                               0x00000020L
+#define DPPCLK_DTO_CTRL__DPPCLK2_DTO_DB_EN_MASK                                                               0x00000200L
+#define DPPCLK_DTO_CTRL__DPPCLK3_DTO_DB_EN_MASK                                                               0x00002000L
+#define DPPCLK_DTO_CTRL__DPPCLK4_DTO_DB_EN_MASK                                                               0x00020000L
+#define DPPCLK_DTO_CTRL__DPPCLK5_DTO_DB_EN_MASK                                                               0x00200000L
+//DCCG_TEST_DEBUG_INDEX
+#define DCCG_TEST_DEBUG_INDEX__DCCG_TEST_DEBUG_INDEX__SHIFT                                                   0x0
+#define DCCG_TEST_DEBUG_INDEX__DCCG_TEST_DEBUG_INDEX_MASK                                                     0x000000FFL
+//DCCG_TEST_DEBUG_DATA
+#define DCCG_TEST_DEBUG_DATA__DCCG_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define DCCG_TEST_DEBUG_DATA__DCCG_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//HDMICHARCLK0_CLOCK_CNTL
+#define HDMICHARCLK0_CLOCK_CNTL__HDMICHARCLK0_EN__SHIFT                                                       0x0
+#define HDMICHARCLK0_CLOCK_CNTL__HDMICHARCLK0_SRC_SEL__SHIFT                                                  0x4
+#define HDMICHARCLK0_CLOCK_CNTL__HDMICHARCLK0_EN_MASK                                                         0x00000001L
+#define HDMICHARCLK0_CLOCK_CNTL__HDMICHARCLK0_SRC_SEL_MASK                                                    0x00000070L
+//PHYASYMCLK_CLOCK_CNTL
+#define PHYASYMCLK_CLOCK_CNTL__PHYASYMCLK_EN__SHIFT                                                           0x0
+#define PHYASYMCLK_CLOCK_CNTL__PHYASYMCLK_SRC_SEL__SHIFT                                                      0x4
+#define PHYASYMCLK_CLOCK_CNTL__PHYASYMCLK_EN_MASK                                                             0x00000001L
+#define PHYASYMCLK_CLOCK_CNTL__PHYASYMCLK_SRC_SEL_MASK                                                        0x00000030L
+//PHYBSYMCLK_CLOCK_CNTL
+#define PHYBSYMCLK_CLOCK_CNTL__PHYBSYMCLK_EN__SHIFT                                                           0x0
+#define PHYBSYMCLK_CLOCK_CNTL__PHYBSYMCLK_SRC_SEL__SHIFT                                                      0x4
+#define PHYBSYMCLK_CLOCK_CNTL__PHYBSYMCLK_EN_MASK                                                             0x00000001L
+#define PHYBSYMCLK_CLOCK_CNTL__PHYBSYMCLK_SRC_SEL_MASK                                                        0x00000030L
+//PHYCSYMCLK_CLOCK_CNTL
+#define PHYCSYMCLK_CLOCK_CNTL__PHYCSYMCLK_EN__SHIFT                                                           0x0
+#define PHYCSYMCLK_CLOCK_CNTL__PHYCSYMCLK_SRC_SEL__SHIFT                                                      0x4
+#define PHYCSYMCLK_CLOCK_CNTL__PHYCSYMCLK_EN_MASK                                                             0x00000001L
+#define PHYCSYMCLK_CLOCK_CNTL__PHYCSYMCLK_SRC_SEL_MASK                                                        0x00000030L
+//PHYDSYMCLK_CLOCK_CNTL
+#define PHYDSYMCLK_CLOCK_CNTL__PHYDSYMCLK_EN__SHIFT                                                           0x0
+#define PHYDSYMCLK_CLOCK_CNTL__PHYDSYMCLK_SRC_SEL__SHIFT                                                      0x4
+#define PHYDSYMCLK_CLOCK_CNTL__PHYDSYMCLK_EN_MASK                                                             0x00000001L
+#define PHYDSYMCLK_CLOCK_CNTL__PHYDSYMCLK_SRC_SEL_MASK                                                        0x00000030L
+//HDMISTREAMCLK_CNTL
+#define HDMISTREAMCLK_CNTL__HDMISTREAMCLK0_SRC_SEL__SHIFT                                                     0x0
+#define HDMISTREAMCLK_CNTL__HDMISTREAMCLK0_EN__SHIFT                                                          0x3
+#define HDMISTREAMCLK_CNTL__HDMISTREAMCLK0_SRC_SEL_MASK                                                       0x00000007L
+#define HDMISTREAMCLK_CNTL__HDMISTREAMCLK0_EN_MASK                                                            0x00000008L
+//DCCG_GATE_DISABLE_CNTL3
+#define DCCG_GATE_DISABLE_CNTL3__HDMISTREAMCLK0_GATE_DISABLE__SHIFT                                           0x0
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE0_GATE_DISABLE__SHIFT                                        0x8
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE0_GATE_DISABLE__SHIFT                                             0x9
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE1_GATE_DISABLE__SHIFT                                        0xa
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE1_GATE_DISABLE__SHIFT                                             0xb
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE2_GATE_DISABLE__SHIFT                                        0xc
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE2_GATE_DISABLE__SHIFT                                             0xd
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE3_GATE_DISABLE__SHIFT                                        0xe
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE3_GATE_DISABLE__SHIFT                                             0xf
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE0_GATE_DISABLE__SHIFT                                        0x14
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE0_GATE_DISABLE__SHIFT                                             0x15
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE1_GATE_DISABLE__SHIFT                                        0x16
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE1_GATE_DISABLE__SHIFT                                             0x17
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE2_GATE_DISABLE__SHIFT                                        0x18
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE2_GATE_DISABLE__SHIFT                                             0x19
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE3_GATE_DISABLE__SHIFT                                        0x1a
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE3_GATE_DISABLE__SHIFT                                             0x1b
+#define DCCG_GATE_DISABLE_CNTL3__HDMISTREAMCLK0_GATE_DISABLE_MASK                                             0x00000001L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE0_GATE_DISABLE_MASK                                          0x00000100L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE0_GATE_DISABLE_MASK                                               0x00000200L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE1_GATE_DISABLE_MASK                                          0x00000400L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE1_GATE_DISABLE_MASK                                               0x00000800L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE2_GATE_DISABLE_MASK                                          0x00001000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE2_GATE_DISABLE_MASK                                               0x00002000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_SE3_GATE_DISABLE_MASK                                          0x00004000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_SE3_GATE_DISABLE_MASK                                               0x00008000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE0_GATE_DISABLE_MASK                                          0x00100000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE0_GATE_DISABLE_MASK                                               0x00200000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE1_GATE_DISABLE_MASK                                          0x00400000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE1_GATE_DISABLE_MASK                                               0x00800000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE2_GATE_DISABLE_MASK                                          0x01000000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE2_GATE_DISABLE_MASK                                               0x02000000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_ROOT_LE3_GATE_DISABLE_MASK                                          0x04000000L
+#define DCCG_GATE_DISABLE_CNTL3__SYMCLK32_LE3_GATE_DISABLE_MASK                                               0x08000000L
+//HDMISTREAMCLK0_DTO_PARAM
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_PHASE__SHIFT                                             0x0
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_MODULO__SHIFT                                            0x8
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_EN__SHIFT                                                0x10
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_PHASE_MASK                                               0x000000FFL
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_MODULO_MASK                                              0x0000FF00L
+#define HDMISTREAMCLK0_DTO_PARAM__HDMISTREAMCLK0_DTO_EN_MASK                                                  0x00010000L
+//DSCCLK_SRC_SEL
+#define DSCCLK_SRC_SEL__DSCCLK0_SRC_SEL__SHIFT                                                                0x0
+#define DSCCLK_SRC_SEL__DSCCLK1_SRC_SEL__SHIFT                                                                0x1
+#define DSCCLK_SRC_SEL__DSCCLK2_SRC_SEL__SHIFT                                                                0x2
+#define DSCCLK_SRC_SEL__DSCCLK3_SRC_SEL__SHIFT                                                                0x3
+#define DSCCLK_SRC_SEL__DSCCLK4_SRC_SEL__SHIFT                                                                0x4
+#define DSCCLK_SRC_SEL__DSCCLK5_SRC_SEL__SHIFT                                                                0x5
+#define DSCCLK_SRC_SEL__DSCCLK0_SRC_SEL_MASK                                                                  0x00000001L
+#define DSCCLK_SRC_SEL__DSCCLK1_SRC_SEL_MASK                                                                  0x00000002L
+#define DSCCLK_SRC_SEL__DSCCLK2_SRC_SEL_MASK                                                                  0x00000004L
+#define DSCCLK_SRC_SEL__DSCCLK3_SRC_SEL_MASK                                                                  0x00000008L
+#define DSCCLK_SRC_SEL__DSCCLK4_SRC_SEL_MASK                                                                  0x00000010L
+#define DSCCLK_SRC_SEL__DSCCLK5_SRC_SEL_MASK                                                                  0x00000020L
+
+
+// addressBlock: dce_dc_dccg_dccg_dcperfmon0_dc_perfmon_dispdec
+//DC_PERFMON0_PERFCOUNTER_CNTL
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON0_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON0_PERFCOUNTER_CNTL2
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON0_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON0_PERFCOUNTER_STATE
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON0_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON0_PERFMON_CNTL
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON0_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON0_PERFMON_CNTL2
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON0_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON0_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON0_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON0_PERFMON_CVALUE_LOW
+#define DC_PERFMON0_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON0_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON0_PERFMON_HI
+#define DC_PERFMON0_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON0_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON0_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON0_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON0_PERFMON_LOW
+#define DC_PERFMON0_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON0_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON0_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON0_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON0_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dccg_dccg_dcperfmon1_dc_perfmon_dispdec
+//DC_PERFMON1_PERFCOUNTER_CNTL
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON1_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON1_PERFCOUNTER_CNTL2
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON1_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON1_PERFCOUNTER_STATE
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON1_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON1_PERFMON_CNTL
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON1_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON1_PERFMON_CNTL2
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON1_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON1_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON1_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON1_PERFMON_CVALUE_LOW
+#define DC_PERFMON1_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON1_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON1_PERFMON_HI
+#define DC_PERFMON1_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON1_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON1_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON1_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON1_PERFMON_LOW
+#define DC_PERFMON1_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON1_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON1_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON1_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON1_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dmu_fgsec_dispdec
+//SECURE_CHECK_CONFIG
+#define SECURE_CHECK_CONFIG__SECURE_CHECK_EN__SHIFT                                                           0x0
+#define SECURE_CHECK_CONFIG__SECURE_CONFIG_DONE__SHIFT                                                        0x1
+#define SECURE_CHECK_CONFIG__SECOND_PRIVILEDGE_SECURE_LEVEL__SHIFT                                            0x7
+#define SECURE_CHECK_CONFIG__NORMAL_PRIVILEDGE_SECURE_LEVEL__SHIFT                                            0xa
+#define SECURE_CHECK_CONFIG__SECURE_CHECK_EN_MASK                                                             0x00000001L
+#define SECURE_CHECK_CONFIG__SECURE_CONFIG_DONE_MASK                                                          0x00000002L
+#define SECURE_CHECK_CONFIG__SECOND_PRIVILEDGE_SECURE_LEVEL_MASK                                              0x00000380L
+#define SECURE_CHECK_CONFIG__NORMAL_PRIVILEDGE_SECURE_LEVEL_MASK                                              0x00001C00L
+//SECURE_GROUP0_CONFIG
+#define SECURE_GROUP0_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP0_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP0_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP0_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP1_CONFIG
+#define SECURE_GROUP1_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP1_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP1_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP1_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP2_CONFIG
+#define SECURE_GROUP2_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP2_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP2_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP2_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP3_CONFIG
+#define SECURE_GROUP3_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP3_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP3_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP3_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP4_CONFIG
+#define SECURE_GROUP4_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP4_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP4_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP4_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP5_CONFIG
+#define SECURE_GROUP5_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP5_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP5_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP5_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP6_CONFIG
+#define SECURE_GROUP6_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP6_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP6_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP6_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_GROUP7_CONFIG
+#define SECURE_GROUP7_CONFIG__WRITE_SECURE_LEVEL__SHIFT                                                       0x0
+#define SECURE_GROUP7_CONFIG__READ_SECURE_LEVEL__SHIFT                                                        0x4
+#define SECURE_GROUP7_CONFIG__WRITE_SECURE_LEVEL_MASK                                                         0x00000007L
+#define SECURE_GROUP7_CONFIG__READ_SECURE_LEVEL_MASK                                                          0x00000070L
+//SECURE_INTERRUPT0_INFO0
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_ENABLE__SHIFT                                                        0x0
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_STATUS__SHIFT                                                        0x1
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_SROUCE_ID__SHIFT                                                     0x3
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_TRUST_LEVEL__SHIFT                                                   0x14
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_SECURE_LEVEL__SHIFT                                                  0x18
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_OP__SHIFT                                                            0x1b
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_ENABLE_MASK                                                          0x00000001L
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_STATUS_MASK                                                          0x00000002L
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_SROUCE_ID_MASK                                                       0x000FFFF8L
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_TRUST_LEVEL_MASK                                                     0x00F00000L
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_SECURE_LEVEL_MASK                                                    0x07000000L
+#define SECURE_INTERRUPT0_INFO0__SEC_INT_OP_MASK                                                              0x08000000L
+//SECURE_INTERRUPT0_INFO1
+#define SECURE_INTERRUPT0_INFO1__SEC_INT_ADDRESS__SHIFT                                                       0x0
+#define SECURE_INTERRUPT0_INFO1__SEC_INT_ADDRESS_MASK                                                         0x000FFFFFL
+//DMCUB_RBBMIF_SEC_CNTL
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_SEC_LVL__SHIFT                                                    0x0
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_TRUST_LVL__SHIFT                                                  0x4
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_SOURCE_ID__SHIFT                                                  0x8
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_SEC_LVL_MASK                                                      0x00000007L
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_TRUST_LVL_MASK                                                    0x000000F0L
+#define DMCUB_RBBMIF_SEC_CNTL__DMCUB_RBBMIF_SOURCE_ID_MASK                                                    0x01FFFF00L
+
+
+// addressBlock: dce_dc_dmu_rbbmif_dispdec
+//RBBMIF_TIMEOUT
+#define RBBMIF_TIMEOUT__RBBMIF_TIMEOUT_DELAY__SHIFT                                                           0x0
+#define RBBMIF_TIMEOUT__RBBMIF_TIMEOUT_TO_REQ_HOLD__SHIFT                                                     0x14
+#define RBBMIF_TIMEOUT__RBBMIF_TIMEOUT_DELAY_MASK                                                             0x000FFFFFL
+#define RBBMIF_TIMEOUT__RBBMIF_TIMEOUT_TO_REQ_HOLD_MASK                                                       0xFFF00000L
+//RBBMIF_STATUS
+#define RBBMIF_STATUS__RBBMIF_TIMEOUT_CLIENTS_DEC__SHIFT                                                      0x0
+#define RBBMIF_STATUS__RBBMIF_TIMEOUT_CLIENTS_DEC_MASK                                                        0xFFFFFFFFL
+//RBBMIF_STATUS_2
+#define RBBMIF_STATUS_2__RBBMIF_TIMEOUT_CLIENTS_DEC_2__SHIFT                                                  0x0
+#define RBBMIF_STATUS_2__RBBMIF_TIMEOUT_CLIENTS_DEC_2_MASK                                                    0x000000FFL
+//RBBMIF_INT_STATUS
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_ADDR__SHIFT                                                         0x2
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_OP__SHIFT                                                           0x1c
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_RDWR_STATUS__SHIFT                                                  0x1d
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_ACK__SHIFT                                                          0x1e
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_MASK__SHIFT                                                         0x1f
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_ADDR_MASK                                                           0x0003FFFCL
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_OP_MASK                                                             0x10000000L
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_RDWR_STATUS_MASK                                                    0x20000000L
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_ACK_MASK                                                            0x40000000L
+#define RBBMIF_INT_STATUS__RBBMIF_TIMEOUT_MASK_MASK                                                           0x80000000L
+//RBBMIF_TIMEOUT_DIS
+#define RBBMIF_TIMEOUT_DIS__CLIENT0_TIMEOUT_DIS__SHIFT                                                        0x0
+#define RBBMIF_TIMEOUT_DIS__CLIENT1_TIMEOUT_DIS__SHIFT                                                        0x1
+#define RBBMIF_TIMEOUT_DIS__CLIENT2_TIMEOUT_DIS__SHIFT                                                        0x2
+#define RBBMIF_TIMEOUT_DIS__CLIENT3_TIMEOUT_DIS__SHIFT                                                        0x3
+#define RBBMIF_TIMEOUT_DIS__CLIENT4_TIMEOUT_DIS__SHIFT                                                        0x4
+#define RBBMIF_TIMEOUT_DIS__CLIENT5_TIMEOUT_DIS__SHIFT                                                        0x5
+#define RBBMIF_TIMEOUT_DIS__CLIENT6_TIMEOUT_DIS__SHIFT                                                        0x6
+#define RBBMIF_TIMEOUT_DIS__CLIENT7_TIMEOUT_DIS__SHIFT                                                        0x7
+#define RBBMIF_TIMEOUT_DIS__CLIENT8_TIMEOUT_DIS__SHIFT                                                        0x8
+#define RBBMIF_TIMEOUT_DIS__CLIENT9_TIMEOUT_DIS__SHIFT                                                        0x9
+#define RBBMIF_TIMEOUT_DIS__CLIENT10_TIMEOUT_DIS__SHIFT                                                       0xa
+#define RBBMIF_TIMEOUT_DIS__CLIENT11_TIMEOUT_DIS__SHIFT                                                       0xb
+#define RBBMIF_TIMEOUT_DIS__CLIENT12_TIMEOUT_DIS__SHIFT                                                       0xc
+#define RBBMIF_TIMEOUT_DIS__CLIENT13_TIMEOUT_DIS__SHIFT                                                       0xd
+#define RBBMIF_TIMEOUT_DIS__CLIENT14_TIMEOUT_DIS__SHIFT                                                       0xe
+#define RBBMIF_TIMEOUT_DIS__CLIENT15_TIMEOUT_DIS__SHIFT                                                       0xf
+#define RBBMIF_TIMEOUT_DIS__CLIENT16_TIMEOUT_DIS__SHIFT                                                       0x10
+#define RBBMIF_TIMEOUT_DIS__CLIENT17_TIMEOUT_DIS__SHIFT                                                       0x11
+#define RBBMIF_TIMEOUT_DIS__CLIENT18_TIMEOUT_DIS__SHIFT                                                       0x12
+#define RBBMIF_TIMEOUT_DIS__CLIENT19_TIMEOUT_DIS__SHIFT                                                       0x13
+#define RBBMIF_TIMEOUT_DIS__CLIENT20_TIMEOUT_DIS__SHIFT                                                       0x14
+#define RBBMIF_TIMEOUT_DIS__CLIENT21_TIMEOUT_DIS__SHIFT                                                       0x15
+#define RBBMIF_TIMEOUT_DIS__CLIENT22_TIMEOUT_DIS__SHIFT                                                       0x16
+#define RBBMIF_TIMEOUT_DIS__CLIENT23_TIMEOUT_DIS__SHIFT                                                       0x17
+#define RBBMIF_TIMEOUT_DIS__CLIENT24_TIMEOUT_DIS__SHIFT                                                       0x18
+#define RBBMIF_TIMEOUT_DIS__CLIENT25_TIMEOUT_DIS__SHIFT                                                       0x19
+#define RBBMIF_TIMEOUT_DIS__CLIENT26_TIMEOUT_DIS__SHIFT                                                       0x1a
+#define RBBMIF_TIMEOUT_DIS__CLIENT27_TIMEOUT_DIS__SHIFT                                                       0x1b
+#define RBBMIF_TIMEOUT_DIS__CLIENT28_TIMEOUT_DIS__SHIFT                                                       0x1c
+#define RBBMIF_TIMEOUT_DIS__CLIENT29_TIMEOUT_DIS__SHIFT                                                       0x1d
+#define RBBMIF_TIMEOUT_DIS__CLIENT30_TIMEOUT_DIS__SHIFT                                                       0x1e
+#define RBBMIF_TIMEOUT_DIS__CLIENT31_TIMEOUT_DIS__SHIFT                                                       0x1f
+#define RBBMIF_TIMEOUT_DIS__CLIENT0_TIMEOUT_DIS_MASK                                                          0x00000001L
+#define RBBMIF_TIMEOUT_DIS__CLIENT1_TIMEOUT_DIS_MASK                                                          0x00000002L
+#define RBBMIF_TIMEOUT_DIS__CLIENT2_TIMEOUT_DIS_MASK                                                          0x00000004L
+#define RBBMIF_TIMEOUT_DIS__CLIENT3_TIMEOUT_DIS_MASK                                                          0x00000008L
+#define RBBMIF_TIMEOUT_DIS__CLIENT4_TIMEOUT_DIS_MASK                                                          0x00000010L
+#define RBBMIF_TIMEOUT_DIS__CLIENT5_TIMEOUT_DIS_MASK                                                          0x00000020L
+#define RBBMIF_TIMEOUT_DIS__CLIENT6_TIMEOUT_DIS_MASK                                                          0x00000040L
+#define RBBMIF_TIMEOUT_DIS__CLIENT7_TIMEOUT_DIS_MASK                                                          0x00000080L
+#define RBBMIF_TIMEOUT_DIS__CLIENT8_TIMEOUT_DIS_MASK                                                          0x00000100L
+#define RBBMIF_TIMEOUT_DIS__CLIENT9_TIMEOUT_DIS_MASK                                                          0x00000200L
+#define RBBMIF_TIMEOUT_DIS__CLIENT10_TIMEOUT_DIS_MASK                                                         0x00000400L
+#define RBBMIF_TIMEOUT_DIS__CLIENT11_TIMEOUT_DIS_MASK                                                         0x00000800L
+#define RBBMIF_TIMEOUT_DIS__CLIENT12_TIMEOUT_DIS_MASK                                                         0x00001000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT13_TIMEOUT_DIS_MASK                                                         0x00002000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT14_TIMEOUT_DIS_MASK                                                         0x00004000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT15_TIMEOUT_DIS_MASK                                                         0x00008000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT16_TIMEOUT_DIS_MASK                                                         0x00010000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT17_TIMEOUT_DIS_MASK                                                         0x00020000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT18_TIMEOUT_DIS_MASK                                                         0x00040000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT19_TIMEOUT_DIS_MASK                                                         0x00080000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT20_TIMEOUT_DIS_MASK                                                         0x00100000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT21_TIMEOUT_DIS_MASK                                                         0x00200000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT22_TIMEOUT_DIS_MASK                                                         0x00400000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT23_TIMEOUT_DIS_MASK                                                         0x00800000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT24_TIMEOUT_DIS_MASK                                                         0x01000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT25_TIMEOUT_DIS_MASK                                                         0x02000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT26_TIMEOUT_DIS_MASK                                                         0x04000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT27_TIMEOUT_DIS_MASK                                                         0x08000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT28_TIMEOUT_DIS_MASK                                                         0x10000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT29_TIMEOUT_DIS_MASK                                                         0x20000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT30_TIMEOUT_DIS_MASK                                                         0x40000000L
+#define RBBMIF_TIMEOUT_DIS__CLIENT31_TIMEOUT_DIS_MASK                                                         0x80000000L
+//RBBMIF_TIMEOUT_DIS_2
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT32_TIMEOUT_DIS__SHIFT                                                     0x0
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT33_TIMEOUT_DIS__SHIFT                                                     0x1
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT34_TIMEOUT_DIS__SHIFT                                                     0x2
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT35_TIMEOUT_DIS__SHIFT                                                     0x3
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT36_TIMEOUT_DIS__SHIFT                                                     0x4
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT37_TIMEOUT_DIS__SHIFT                                                     0x5
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT38_TIMEOUT_DIS__SHIFT                                                     0x6
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT39_TIMEOUT_DIS__SHIFT                                                     0x7
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT32_TIMEOUT_DIS_MASK                                                       0x00000001L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT33_TIMEOUT_DIS_MASK                                                       0x00000002L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT34_TIMEOUT_DIS_MASK                                                       0x00000004L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT35_TIMEOUT_DIS_MASK                                                       0x00000008L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT36_TIMEOUT_DIS_MASK                                                       0x00000010L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT37_TIMEOUT_DIS_MASK                                                       0x00000020L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT38_TIMEOUT_DIS_MASK                                                       0x00000040L
+#define RBBMIF_TIMEOUT_DIS_2__CLIENT39_TIMEOUT_DIS_MASK                                                       0x00000080L
+//RBBMIF_STATUS_FLAG
+#define RBBMIF_STATUS_FLAG__RBBMIF_STATE__SHIFT                                                               0x0
+#define RBBMIF_STATUS_FLAG__RBBMIF_READ_TIMEOUT__SHIFT                                                        0x4
+#define RBBMIF_STATUS_FLAG__RBBMIF_FIFO_EMPTY__SHIFT                                                          0x5
+#define RBBMIF_STATUS_FLAG__RBBMIF_FIFO_FULL__SHIFT                                                           0x6
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_FLAG__SHIFT                                                 0x8
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_TYPE__SHIFT                                                 0x9
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_ADDR__SHIFT                                                 0x10
+#define RBBMIF_STATUS_FLAG__RBBMIF_STATE_MASK                                                                 0x00000003L
+#define RBBMIF_STATUS_FLAG__RBBMIF_READ_TIMEOUT_MASK                                                          0x00000010L
+#define RBBMIF_STATUS_FLAG__RBBMIF_FIFO_EMPTY_MASK                                                            0x00000020L
+#define RBBMIF_STATUS_FLAG__RBBMIF_FIFO_FULL_MASK                                                             0x00000040L
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_FLAG_MASK                                                   0x00000100L
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_TYPE_MASK                                                   0x00000E00L
+#define RBBMIF_STATUS_FLAG__RBBMIF_INVALID_ACCESS_ADDR_MASK                                                   0xFFFF0000L
+
+
+// addressBlock: dce_dc_dmu_dmu_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON2_PERFCOUNTER_CNTL
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON2_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON2_PERFCOUNTER_CNTL2
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON2_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON2_PERFCOUNTER_STATE
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON2_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON2_PERFMON_CNTL
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON2_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON2_PERFMON_CNTL2
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON2_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON2_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON2_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON2_PERFMON_CVALUE_LOW
+#define DC_PERFMON2_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON2_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON2_PERFMON_HI
+#define DC_PERFMON2_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON2_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON2_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON2_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON2_PERFMON_LOW
+#define DC_PERFMON2_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON2_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON2_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON2_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON2_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dmu_ihc_dispdec
+//DC_GPU_TIMER_START_POSITION_V_UPDATE
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D1_V_UPDATE__SHIFT                  0x0
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D2_V_UPDATE__SHIFT                  0x4
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D3_V_UPDATE__SHIFT                  0x8
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D4_V_UPDATE__SHIFT                  0xc
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D1_V_UPDATE_MASK                    0x00000007L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D2_V_UPDATE_MASK                    0x00000070L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D3_V_UPDATE_MASK                    0x00000700L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE__DC_GPU_TIMER_START_POSITION_D4_V_UPDATE_MASK                    0x00007000L
+//DC_GPU_TIMER_START_POSITION_VSTARTUP
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D1_VSTARTUP__SHIFT                  0x0
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D2_VSTARTUP__SHIFT                  0x4
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D3_VSTARTUP__SHIFT                  0x8
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D4_VSTARTUP__SHIFT                  0xc
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D1_VSTARTUP_MASK                    0x00000007L
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D2_VSTARTUP_MASK                    0x00000070L
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D3_VSTARTUP_MASK                    0x00000700L
+#define DC_GPU_TIMER_START_POSITION_VSTARTUP__DC_GPU_TIMER_START_POSITION_D4_VSTARTUP_MASK                    0x00007000L
+//DC_GPU_TIMER_READ
+#define DC_GPU_TIMER_READ__DC_GPU_TIMER_READ__SHIFT                                                           0x0
+#define DC_GPU_TIMER_READ__DC_GPU_TIMER_READ_MASK                                                             0xFFFFFFFFL
+//DC_GPU_TIMER_READ_CNTL
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_READ_SELECT__SHIFT                                               0x0
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D1_VSYNC_NOM__SHIFT                               0x8
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D2_VSYNC_NOM__SHIFT                               0xb
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D3_VSYNC_NOM__SHIFT                               0xe
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D4_VSYNC_NOM__SHIFT                               0x11
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_READ_SELECT_MASK                                                 0x0000007FL
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D1_VSYNC_NOM_MASK                                 0x00000700L
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D2_VSYNC_NOM_MASK                                 0x00003800L
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D3_VSYNC_NOM_MASK                                 0x0001C000L
+#define DC_GPU_TIMER_READ_CNTL__DC_GPU_TIMER_START_POSITION_D4_VSYNC_NOM_MASK                                 0x000E0000L
+//DISP_INTERRUPT_STATUS
+#define DISP_INTERRUPT_STATUS__OPTC1_DATA_UNDERFLOW_INTERRUPT__SHIFT                                          0x1
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_SNAPSHOT_INTERRUPT__SHIFT                                             0x4
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT__SHIFT                                0x5
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_FORCE_COUNT_NOW_INTERRUPT__SHIFT                                      0x6
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_TRIGA_INTERRUPT__SHIFT                                                0x7
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_TRIGB_INTERRUPT__SHIFT                                                0x8
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_VSYNC_NOM_INTERRUPT__SHIFT                                            0x9
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT__SHIFT                              0xa
+#define DISP_INTERRUPT_STATUS__DIGA_DP_FAST_TRAINING_COMPLETE_INTERRUPT__SHIFT                                0xf
+#define DISP_INTERRUPT_STATUS__DIGA_DP_VID_STREAM_DISABLE_INTERRUPT__SHIFT                                    0x10
+#define DISP_INTERRUPT_STATUS__DC_HPD1_INTERRUPT__SHIFT                                                       0x11
+#define DISP_INTERRUPT_STATUS__DC_HPD1_RX_INTERRUPT__SHIFT                                                    0x12
+#define DISP_INTERRUPT_STATUS__AUX1_SW_DONE_INTERRUPT__SHIFT                                                  0x13
+#define DISP_INTERRUPT_STATUS__AUX1_LS_DONE_INTERRUPT__SHIFT                                                  0x14
+#define DISP_INTERRUPT_STATUS__DIO_ALPM_INTERRUPT__SHIFT                                                      0x15
+#define DISP_INTERRUPT_STATUS__RBBMIF_IHC_TIMEOUT_INTERRUPT__SHIFT                                            0x17
+#define DISP_INTERRUPT_STATUS__DC_I2C_SW_DONE_INTERRUPT__SHIFT                                                0x18
+#define DISP_INTERRUPT_STATUS__DISP_INTERRUPT_STATUS_CONTINUE__SHIFT                                          0x1f
+#define DISP_INTERRUPT_STATUS__OPTC1_DATA_UNDERFLOW_INTERRUPT_MASK                                            0x00000002L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_SNAPSHOT_INTERRUPT_MASK                                               0x00000010L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_MASK                                  0x00000020L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_FORCE_COUNT_NOW_INTERRUPT_MASK                                        0x00000040L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_TRIGA_INTERRUPT_MASK                                                  0x00000080L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_TRIGB_INTERRUPT_MASK                                                  0x00000100L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_VSYNC_NOM_INTERRUPT_MASK                                              0x00000200L
+#define DISP_INTERRUPT_STATUS__OTG1_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT_MASK                                0x00000400L
+#define DISP_INTERRUPT_STATUS__DIGA_DP_FAST_TRAINING_COMPLETE_INTERRUPT_MASK                                  0x00008000L
+#define DISP_INTERRUPT_STATUS__DIGA_DP_VID_STREAM_DISABLE_INTERRUPT_MASK                                      0x00010000L
+#define DISP_INTERRUPT_STATUS__DC_HPD1_INTERRUPT_MASK                                                         0x00020000L
+#define DISP_INTERRUPT_STATUS__DC_HPD1_RX_INTERRUPT_MASK                                                      0x00040000L
+#define DISP_INTERRUPT_STATUS__AUX1_SW_DONE_INTERRUPT_MASK                                                    0x00080000L
+#define DISP_INTERRUPT_STATUS__AUX1_LS_DONE_INTERRUPT_MASK                                                    0x00100000L
+#define DISP_INTERRUPT_STATUS__DIO_ALPM_INTERRUPT_MASK                                                        0x00200000L
+#define DISP_INTERRUPT_STATUS__RBBMIF_IHC_TIMEOUT_INTERRUPT_MASK                                              0x00800000L
+#define DISP_INTERRUPT_STATUS__DC_I2C_SW_DONE_INTERRUPT_MASK                                                  0x01000000L
+#define DISP_INTERRUPT_STATUS__DISP_INTERRUPT_STATUS_CONTINUE_MASK                                            0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE
+#define DISP_INTERRUPT_STATUS_CONTINUE__OPTC2_DATA_UNDERFLOW_INTERRUPT__SHIFT                                 0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_SNAPSHOT_INTERRUPT__SHIFT                                    0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT__SHIFT                       0x5
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_FORCE_COUNT_NOW_INTERRUPT__SHIFT                             0x6
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_TRIGA_INTERRUPT__SHIFT                                       0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_TRIGB_INTERRUPT__SHIFT                                       0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_VSYNC_NOM_INTERRUPT__SHIFT                                   0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT__SHIFT                     0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE__DIGB_DP_FAST_TRAINING_COMPLETE_INTERRUPT__SHIFT                       0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE__DIGB_DP_VID_STREAM_DISABLE_INTERRUPT__SHIFT                           0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE__DC_HPD2_INTERRUPT__SHIFT                                              0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE__DC_HPD2_RX_INTERRUPT__SHIFT                                           0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE__AUX2_SW_DONE_INTERRUPT__SHIFT                                         0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE__AUX2_LS_DONE_INTERRUPT__SHIFT                                         0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT0__SHIFT                                   0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT1__SHIFT                                   0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT2__SHIFT                                   0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE__DISP_INTERRUPT_STATUS_CONTINUE2__SHIFT                                0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE__OPTC2_DATA_UNDERFLOW_INTERRUPT_MASK                                   0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_SNAPSHOT_INTERRUPT_MASK                                      0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_MASK                         0x00000020L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_FORCE_COUNT_NOW_INTERRUPT_MASK                               0x00000040L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_TRIGA_INTERRUPT_MASK                                         0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_TRIGB_INTERRUPT_MASK                                         0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_VSYNC_NOM_INTERRUPT_MASK                                     0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG2_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT_MASK                       0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE__DIGB_DP_FAST_TRAINING_COMPLETE_INTERRUPT_MASK                         0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__DIGB_DP_VID_STREAM_DISABLE_INTERRUPT_MASK                             0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__DC_HPD2_INTERRUPT_MASK                                                0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__DC_HPD2_RX_INTERRUPT_MASK                                             0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__AUX2_SW_DONE_INTERRUPT_MASK                                           0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__AUX2_LS_DONE_INTERRUPT_MASK                                           0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT0_MASK                                     0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT1_MASK                                     0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__OTG1_IHC_VERTICAL_INTERRUPT2_MASK                                     0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE__DISP_INTERRUPT_STATUS_CONTINUE2_MASK                                  0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE2
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OPTC3_DATA_UNDERFLOW_INTERRUPT__SHIFT                                0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_SNAPSHOT_INTERRUPT__SHIFT                                   0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT__SHIFT                      0x5
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_FORCE_COUNT_NOW_INTERRUPT__SHIFT                            0x6
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_TRIGA_INTERRUPT__SHIFT                                      0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_TRIGB_INTERRUPT__SHIFT                                      0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_VSYNC_NOM_INTERRUPT__SHIFT                                  0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT__SHIFT                    0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DIGC_DP_FAST_TRAINING_COMPLETE_INTERRUPT__SHIFT                      0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DIGC_DP_VID_STREAM_DISABLE_INTERRUPT__SHIFT                          0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DC_HPD3_INTERRUPT__SHIFT                                             0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DC_HPD3_RX_INTERRUPT__SHIFT                                          0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE2__AUX3_SW_DONE_INTERRUPT__SHIFT                                        0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE2__AUX3_LS_DONE_INTERRUPT__SHIFT                                        0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT0__SHIFT                                  0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT1__SHIFT                                  0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT2__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DISP_INTERRUPT_STATUS_CONTINUE3__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OPTC3_DATA_UNDERFLOW_INTERRUPT_MASK                                  0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_SNAPSHOT_INTERRUPT_MASK                                     0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_MASK                        0x00000020L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_FORCE_COUNT_NOW_INTERRUPT_MASK                              0x00000040L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_TRIGA_INTERRUPT_MASK                                        0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_TRIGB_INTERRUPT_MASK                                        0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_VSYNC_NOM_INTERRUPT_MASK                                    0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG3_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT_MASK                      0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DIGC_DP_FAST_TRAINING_COMPLETE_INTERRUPT_MASK                        0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DIGC_DP_VID_STREAM_DISABLE_INTERRUPT_MASK                            0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DC_HPD3_INTERRUPT_MASK                                               0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DC_HPD3_RX_INTERRUPT_MASK                                            0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__AUX3_SW_DONE_INTERRUPT_MASK                                          0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__AUX3_LS_DONE_INTERRUPT_MASK                                          0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT0_MASK                                    0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT1_MASK                                    0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__OTG2_IHC_VERTICAL_INTERRUPT2_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE2__DISP_INTERRUPT_STATUS_CONTINUE3_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE3
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OPTC4_DATA_UNDERFLOW_INTERRUPT__SHIFT                                0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_SNAPSHOT_INTERRUPT__SHIFT                                   0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT__SHIFT                      0x5
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_FORCE_COUNT_NOW_INTERRUPT__SHIFT                            0x6
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_TRIGA_INTERRUPT__SHIFT                                      0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_TRIGB_INTERRUPT__SHIFT                                      0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_VSYNC_NOM_INTERRUPT__SHIFT                                  0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT__SHIFT                    0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DIGD_DP_FAST_TRAINING_COMPLETE_INTERRUPT__SHIFT                      0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DIGD_DP_VID_STREAM_DISABLE_INTERRUPT__SHIFT                          0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DC_HPD4_INTERRUPT__SHIFT                                             0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DC_HPD4_RX_INTERRUPT__SHIFT                                          0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE3__AUX4_SW_DONE_INTERRUPT__SHIFT                                        0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE3__AUX4_LS_DONE_INTERRUPT__SHIFT                                        0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT0__SHIFT                                  0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT1__SHIFT                                  0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT2__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DISP_INTERRUPT_STATUS_CONTINUE4__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OPTC4_DATA_UNDERFLOW_INTERRUPT_MASK                                  0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_SNAPSHOT_INTERRUPT_MASK                                     0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_MASK                        0x00000020L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_FORCE_COUNT_NOW_INTERRUPT_MASK                              0x00000040L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_TRIGA_INTERRUPT_MASK                                        0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_TRIGB_INTERRUPT_MASK                                        0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_VSYNC_NOM_INTERRUPT_MASK                                    0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG4_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INT_MASK                      0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DIGD_DP_FAST_TRAINING_COMPLETE_INTERRUPT_MASK                        0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DIGD_DP_VID_STREAM_DISABLE_INTERRUPT_MASK                            0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DC_HPD4_INTERRUPT_MASK                                               0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DC_HPD4_RX_INTERRUPT_MASK                                            0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__AUX4_SW_DONE_INTERRUPT_MASK                                          0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__AUX4_LS_DONE_INTERRUPT_MASK                                          0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT0_MASK                                    0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT1_MASK                                    0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__OTG3_IHC_VERTICAL_INTERRUPT2_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE3__DISP_INTERRUPT_STATUS_CONTINUE4_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE4
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT0__SHIFT                                  0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT1__SHIFT                                  0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT2__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE4__DISP_INTERRUPT_STATUS_CONTINUE5__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT0_MASK                                    0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT1_MASK                                    0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE4__OTG4_IHC_VERTICAL_INTERRUPT2_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE4__DISP_INTERRUPT_STATUS_CONTINUE5_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE5
+#define DISP_INTERRUPT_STATUS_CONTINUE5__DISP_INTERRUPT_STATUS_CONTINUE6__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE5__DISP_INTERRUPT_STATUS_CONTINUE6_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE6
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE0_ALPM_WAKE_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE1_ALPM_WAKE_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE2_ALPM_WAKE_INTERRUPT__SHIFT                               0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE3_ALPM_WAKE_INTERRUPT__SHIFT                               0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE4_ALPM_WAKE_INTERRUPT__SHIFT                               0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE5_ALPM_WAKE_INTERRUPT__SHIFT                               0x5
+#define DISP_INTERRUPT_STATUS_CONTINUE6__DISP_INTERRUPT_STATUS_CONTINUE7__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE0_ALPM_WAKE_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE1_ALPM_WAKE_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE2_ALPM_WAKE_INTERRUPT_MASK                                 0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE3_ALPM_WAKE_INTERRUPT_MASK                                 0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE4_ALPM_WAKE_INTERRUPT_MASK                                 0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__HPO_IHC_SE5_ALPM_WAKE_INTERRUPT_MASK                                 0x00000020L
+#define DISP_INTERRUPT_STATUS_CONTINUE6__DISP_INTERRUPT_STATUS_CONTINUE7_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE7
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DCCG_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DCCG_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DMU_PERFMON_COUNTER0_INTERRUPT__SHIFT                                0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DMU_PERFMON_COUNTER1_INTERRUPT__SHIFT                                0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DIO_PERFMON_COUNTER0_INTERRUPT__SHIFT                                0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DIO_PERFMON_COUNTER1_INTERRUPT__SHIFT                                0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DISP_INTERRUPT_STATUS_CONTINUE8__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DCCG_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DCCG_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DMU_PERFMON_COUNTER0_INTERRUPT_MASK                                  0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DMU_PERFMON_COUNTER1_INTERRUPT_MASK                                  0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DIO_PERFMON_COUNTER0_INTERRUPT_MASK                                  0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DIO_PERFMON_COUNTER1_INTERRUPT_MASK                                  0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE7__DISP_INTERRUPT_STATUS_CONTINUE8_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE8
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP0_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP0_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP1_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP1_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP2_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP2_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DISP_INTERRUPT_STATUS_CONTINUE9__SHIFT                               0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP0_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP0_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP1_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP1_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP2_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DPP2_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE8__DISP_INTERRUPT_STATUS_CONTINUE9_MASK                                 0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE9
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP0_HIST_RDY_IHC_INTERRUPT__SHIFT                                   0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP1_HIST_RDY_IHC_INTERRUPT__SHIFT                                   0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP2_HIST_RDY_IHC_INTERRUPT__SHIFT                                   0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_HIST_RDY_IHC_INTERRUPT__SHIFT                                   0x17
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DISP_INTERRUPT_STATUS_CONTINUE10__SHIFT                              0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP0_HIST_RDY_IHC_INTERRUPT_MASK                                     0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP1_HIST_RDY_IHC_INTERRUPT_MASK                                     0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP2_HIST_RDY_IHC_INTERRUPT_MASK                                     0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DPP3_HIST_RDY_IHC_INTERRUPT_MASK                                     0x00800000L
+#define DISP_INTERRUPT_STATUS_CONTINUE9__DISP_INTERRUPT_STATUS_CONTINUE10_MASK                                0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE10
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG0_LATCH_INT__SHIFT                                0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG1_LATCH_INT__SHIFT                                0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG2_LATCH_INT__SHIFT                                0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG3_LATCH_INT__SHIFT                                0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_PERFMON2_COUNTER0_INTERRUPT__SHIFT                             0xc
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_PERFMON2_COUNTER1_INTERRUPT__SHIFT                             0xd
+#define DISP_INTERRUPT_STATUS_CONTINUE10__HDCP2_RXSTATUS_TIMER_INTERRUPT__SHIFT                               0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG1_IHC_DRR_TIMING_UPDATE__SHIFT                                   0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG2_IHC_DRR_TIMING_UPDATE__SHIFT                                   0x17
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG3_IHC_DRR_TIMING_UPDATE__SHIFT                                   0x18
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG4_IHC_DRR_TIMING_UPDATE__SHIFT                                   0x19
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DISP_INTERRUPT_STATUS_CONTINUE11__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG0_LATCH_INT_MASK                                  0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG1_LATCH_INT_MASK                                  0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG2_LATCH_INT_MASK                                  0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_IHC_VSYNC_OTG3_LATCH_INT_MASK                                  0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_PERFMON2_COUNTER0_INTERRUPT_MASK                               0x00001000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DCCG_PERFMON2_COUNTER1_INTERRUPT_MASK                               0x00002000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__HDCP2_RXSTATUS_TIMER_INTERRUPT_MASK                                 0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG1_IHC_DRR_TIMING_UPDATE_MASK                                     0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG2_IHC_DRR_TIMING_UPDATE_MASK                                     0x00800000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG3_IHC_DRR_TIMING_UPDATE_MASK                                     0x01000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__OTG4_IHC_DRR_TIMING_UPDATE_MASK                                     0x02000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE10__DISP_INTERRUPT_STATUS_CONTINUE11_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE11
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC0_STALL_INTERRUPT__SHIFT                                        0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC1_STALL_INTERRUPT__SHIFT                                        0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC2_STALL_INTERRUPT__SHIFT                                        0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC3_STALL_INTERRUPT__SHIFT                                        0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE11__DISP_INTERRUPT_STATUS_CONTINUE12__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC0_STALL_INTERRUPT_MASK                                          0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC1_STALL_INTERRUPT_MASK                                          0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC2_STALL_INTERRUPT_MASK                                          0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE11__MPCC3_STALL_INTERRUPT_MASK                                          0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE11__DISP_INTERRUPT_STATUS_CONTINUE12_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE12
+#define DISP_INTERRUPT_STATUS_CONTINUE12__MPC_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE12__MPC_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE12__DISP_INTERRUPT_STATUS_CONTINUE13__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE12__MPC_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE12__MPC_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE12__DISP_INTERRUPT_STATUS_CONTINUE13_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE13
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_PERFMON_COUNTER0_INTERRUPT__SHIFT                            0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_PERFMON_COUNTER1_INTERRUPT__SHIFT                            0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_VM_FAULT_INTERRUPT__SHIFT                                0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_TIMEOUT_INTERRUPT__SHIFT                                 0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_COMPBUF_SIZE_CHANGE_INTERRUPT__SHIFT                     0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_PERFMON_COUNTER0_INTERRUPT__SHIFT                             0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_PERFMON_COUNTER1_INTERRUPT__SHIFT                             0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VBLANK_INTERRUPT__SHIFT                                   0x1b
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VLINE_INTERRUPT__SHIFT                                    0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VLINE2_INTERRUPT__SHIFT                                   0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_TIMEOUT_INTERRUPT__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE13__DISP_INTERRUPT_STATUS_CONTINUE14__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_PERFMON_COUNTER0_INTERRUPT_MASK                              0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_PERFMON_COUNTER1_INTERRUPT_MASK                              0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_VM_FAULT_INTERRUPT_MASK                                  0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_TIMEOUT_INTERRUPT_MASK                                   0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBBUB_IHC_COMPBUF_SIZE_CHANGE_INTERRUPT_MASK                       0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_PERFMON_COUNTER0_INTERRUPT_MASK                               0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_PERFMON_COUNTER1_INTERRUPT_MASK                               0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VBLANK_INTERRUPT_MASK                                     0x08000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VLINE_INTERRUPT_MASK                                      0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_VLINE2_INTERRUPT_MASK                                     0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__HUBP0_IHC_TIMEOUT_INTERRUPT_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE13__DISP_INTERRUPT_STATUS_CONTINUE14_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE14
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_PERFMON_COUNTER0_INTERRUPT__SHIFT                             0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_PERFMON_COUNTER1_INTERRUPT__SHIFT                             0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP2_PERFMON_COUNTER0_INTERRUPT__SHIFT                             0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP2_PERFMON_COUNTER1_INTERRUPT__SHIFT                             0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP3_PERFMON_COUNTER0_INTERRUPT__SHIFT                             0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP3_PERFMON_COUNTER1_INTERRUPT__SHIFT                             0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VBLANK_INTERRUPT__SHIFT                                   0x1b
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VLINE_INTERRUPT__SHIFT                                    0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VLINE2_INTERRUPT__SHIFT                                   0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_TIMEOUT_INTERRUPT__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE14__DISP_INTERRUPT_STATUS_CONTINUE15__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_PERFMON_COUNTER0_INTERRUPT_MASK                               0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_PERFMON_COUNTER1_INTERRUPT_MASK                               0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP2_PERFMON_COUNTER0_INTERRUPT_MASK                               0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP2_PERFMON_COUNTER1_INTERRUPT_MASK                               0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP3_PERFMON_COUNTER0_INTERRUPT_MASK                               0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP3_PERFMON_COUNTER1_INTERRUPT_MASK                               0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VBLANK_INTERRUPT_MASK                                     0x08000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VLINE_INTERRUPT_MASK                                      0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_VLINE2_INTERRUPT_MASK                                     0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__HUBP1_IHC_TIMEOUT_INTERRUPT_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE14__DISP_INTERRUPT_STATUS_CONTINUE15_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE15
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VBLANK_INTERRUPT__SHIFT                                   0x1b
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VLINE_INTERRUPT__SHIFT                                    0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VLINE2_INTERRUPT__SHIFT                                   0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_TIMEOUT_INTERRUPT__SHIFT                                  0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE15__DISP_INTERRUPT_STATUS_CONTINUE16__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VBLANK_INTERRUPT_MASK                                     0x08000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VLINE_INTERRUPT_MASK                                      0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_VLINE2_INTERRUPT_MASK                                     0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE15__HUBP2_IHC_TIMEOUT_INTERRUPT_MASK                                    0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE15__DISP_INTERRUPT_STATUS_CONTINUE16_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE16
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VBLANK_INTERRUPT__SHIFT                                   0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VLINE_INTERRUPT__SHIFT                                    0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VLINE2_INTERRUPT__SHIFT                                   0xb
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_TIMEOUT_INTERRUPT__SHIFT                                  0x18
+#define DISP_INTERRUPT_STATUS_CONTINUE16__DISP_INTERRUPT_STATUS_CONTINUE17__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VBLANK_INTERRUPT_MASK                                     0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VLINE_INTERRUPT_MASK                                      0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_VLINE2_INTERRUPT_MASK                                     0x00000800L
+#define DISP_INTERRUPT_STATUS_CONTINUE16__HUBP3_IHC_TIMEOUT_INTERRUPT_MASK                                    0x01000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE16__DISP_INTERRUPT_STATUS_CONTINUE17_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE17
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPP_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPP_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP0_IHC_FLIP_INTERRUPT__SHIFT                                     0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP1_IHC_FLIP_INTERRUPT__SHIFT                                     0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP2_IHC_FLIP_INTERRUPT__SHIFT                                     0x4
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP3_IHC_FLIP_INTERRUPT__SHIFT                                     0x5
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPTC_PERFMON_COUNTER0_INTERRUPT__SHIFT                              0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPTC_PERFMON_COUNTER1_INTERRUPT__SHIFT                              0xb
+#define DISP_INTERRUPT_STATUS_CONTINUE17__MMHUBBUB_PERFMON_COUNTER0_INTERRUPT__SHIFT                          0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE17__MMHUBBUB_PERFMON_COUNTER1_INTERRUPT__SHIFT                          0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP0_IHC_FLIP_AWAY_INTERRUPT__SHIFT                                0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP1_IHC_FLIP_AWAY_INTERRUPT__SHIFT                                0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP2_IHC_FLIP_AWAY_INTERRUPT__SHIFT                                0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP3_IHC_FLIP_AWAY_INTERRUPT__SHIFT                                0x17
+#define DISP_INTERRUPT_STATUS_CONTINUE17__DISP_INTERRUPT_STATUS_CONTINUE18__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPP_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPP_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP0_IHC_FLIP_INTERRUPT_MASK                                       0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP1_IHC_FLIP_INTERRUPT_MASK                                       0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP2_IHC_FLIP_INTERRUPT_MASK                                       0x00000010L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP3_IHC_FLIP_INTERRUPT_MASK                                       0x00000020L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPTC_PERFMON_COUNTER0_INTERRUPT_MASK                                0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__OPTC_PERFMON_COUNTER1_INTERRUPT_MASK                                0x00000800L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__MMHUBBUB_PERFMON_COUNTER0_INTERRUPT_MASK                            0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__MMHUBBUB_PERFMON_COUNTER1_INTERRUPT_MASK                            0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP0_IHC_FLIP_AWAY_INTERRUPT_MASK                                  0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP1_IHC_FLIP_AWAY_INTERRUPT_MASK                                  0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP2_IHC_FLIP_AWAY_INTERRUPT_MASK                                  0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__HUBP3_IHC_FLIP_AWAY_INTERRUPT_MASK                                  0x00800000L
+#define DISP_INTERRUPT_STATUS_CONTINUE17__DISP_INTERRUPT_STATUS_CONTINUE18_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE18
+#define DISP_INTERRUPT_STATUS_CONTINUE18__AZ_PERFMON_COUNTER0_INTERRUPT__SHIFT                                0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE18__AZ_PERFMON_COUNTER1_INTERRUPT__SHIFT                                0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXA_IHC_ERROR_INTERRUPT__SHIFT                            0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXB_IHC_ERROR_INTERRUPT__SHIFT                            0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXC_IHC_ERROR_INTERRUPT__SHIFT                            0xb
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXD_IHC_ERROR_INTERRUPT__SHIFT                            0xc
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_RXA_IHC_ERROR_INTERRUPT__SHIFT                            0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DISP_INTERRUPT_STATUS_CONTINUE19__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE18__AZ_PERFMON_COUNTER0_INTERRUPT_MASK                                  0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__AZ_PERFMON_COUNTER1_INTERRUPT_MASK                                  0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXA_IHC_ERROR_INTERRUPT_MASK                              0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXB_IHC_ERROR_INTERRUPT_MASK                              0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXC_IHC_ERROR_INTERRUPT_MASK                              0x00000800L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_TXD_IHC_ERROR_INTERRUPT_MASK                              0x00001000L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DCIO_DPCS_RXA_IHC_ERROR_INTERRUPT_MASK                              0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE18__DISP_INTERRUPT_STATUS_CONTINUE19_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE19
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_FORMAT_CHANGED_INT__SHIFT                    0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_FORMAT_CHANGED_INT__SHIFT                    0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_FORMAT_CHANGED_INT__SHIFT                    0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_FORMAT_CHANGED_INT__SHIFT                    0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_ENABLED_INT__SHIFT                           0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_ENABLED_INT__SHIFT                           0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_ENABLED_INT__SHIFT                           0xa
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_ENABLED_INT__SHIFT                           0xb
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_DISABLED_INT__SHIFT                          0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_DISABLED_INT__SHIFT                          0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_DISABLED_INT__SHIFT                          0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_DISABLED_INT__SHIFT                          0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE19__DISP_INTERRUPT_STATUS_CONTINUE20__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_FORMAT_CHANGED_INT_MASK                      0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_FORMAT_CHANGED_INT_MASK                      0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_FORMAT_CHANGED_INT_MASK                      0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_FORMAT_CHANGED_INT_MASK                      0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_ENABLED_INT_MASK                             0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_ENABLED_INT_MASK                             0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_ENABLED_INT_MASK                             0x00000400L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_ENABLED_INT_MASK                             0x00000800L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT0_AUDIO_DISABLED_INT_MASK                            0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT1_AUDIO_DISABLED_INT_MASK                            0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT2_AUDIO_DISABLED_INT_MASK                            0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__AZ_IHC_ENDPOINT3_AUDIO_DISABLED_INT_MASK                            0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE19__DISP_INTERRUPT_STATUS_CONTINUE20_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE20
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_CPU_SS_INTERRUPT__SHIFT                                    0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_CPU_SS_INTERRUPT__SHIFT                                    0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_CPU_SS_INTERRUPT__SHIFT                                    0x2
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_CPU_SS_INTERRUPT__SHIFT                                    0x3
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_V_UPDATE_INTERRUPT__SHIFT                                  0x6
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_V_UPDATE_INTERRUPT__SHIFT                                  0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_V_UPDATE_INTERRUPT__SHIFT                                  0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_V_UPDATE_INTERRUPT__SHIFT                                  0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_GSL_VSYNC_GAP_INTERRUPT__SHIFT                             0xc
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_GSL_VSYNC_GAP_INTERRUPT__SHIFT                             0xd
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_GSL_VSYNC_GAP_INTERRUPT__SHIFT                             0xe
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_GSL_VSYNC_GAP_INTERRUPT__SHIFT                             0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_VSTARTUP_INTERRUPT__SHIFT                                  0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_VSTARTUP_INTERRUPT__SHIFT                                  0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_VSTARTUP_INTERRUPT__SHIFT                                  0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_VSTARTUP_INTERRUPT__SHIFT                                  0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_VREADY_INTERRUPT__SHIFT                                    0x18
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_VREADY_INTERRUPT__SHIFT                                    0x19
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_VREADY_INTERRUPT__SHIFT                                    0x1a
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_VREADY_INTERRUPT__SHIFT                                    0x1b
+#define DISP_INTERRUPT_STATUS_CONTINUE20__DISP_INTERRUPT_STATUS_CONTINUE21__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_CPU_SS_INTERRUPT_MASK                                      0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_CPU_SS_INTERRUPT_MASK                                      0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_CPU_SS_INTERRUPT_MASK                                      0x00000004L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_CPU_SS_INTERRUPT_MASK                                      0x00000008L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_V_UPDATE_INTERRUPT_MASK                                    0x00000040L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_V_UPDATE_INTERRUPT_MASK                                    0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_V_UPDATE_INTERRUPT_MASK                                    0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_V_UPDATE_INTERRUPT_MASK                                    0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_GSL_VSYNC_GAP_INTERRUPT_MASK                               0x00001000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_GSL_VSYNC_GAP_INTERRUPT_MASK                               0x00002000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_GSL_VSYNC_GAP_INTERRUPT_MASK                               0x00004000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_GSL_VSYNC_GAP_INTERRUPT_MASK                               0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_VSTARTUP_INTERRUPT_MASK                                    0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_VSTARTUP_INTERRUPT_MASK                                    0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_VSTARTUP_INTERRUPT_MASK                                    0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_VSTARTUP_INTERRUPT_MASK                                    0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG1_IHC_VREADY_INTERRUPT_MASK                                      0x01000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG2_IHC_VREADY_INTERRUPT_MASK                                      0x02000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG3_IHC_VREADY_INTERRUPT_MASK                                      0x04000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__OTG4_IHC_VREADY_INTERRUPT_MASK                                      0x08000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE20__DISP_INTERRUPT_STATUS_CONTINUE21_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE21
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DOUT_IHC_I2C_DDC1_HW_DONE_INTERRUPT__SHIFT                          0x0
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DOUT_IHC_I2C_DDC2_HW_DONE_INTERRUPT__SHIFT                          0x1
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DC_I2C_DDC1_READ_REQUEST_INTERRUPT__SHIFT                           0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DC_I2C_DDC2_READ_REQUEST_INTERRUPT__SHIFT                           0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DIGH_DP_FAST_TRAINING_COMPLETE_INTERRUPT__SHIFT                     0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DIGH_DP_VID_STREAM_DISABLE_INTERRUPT__SHIFT                         0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DISP_INTERRUPT_STATUS_CONTINUE22__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DOUT_IHC_I2C_DDC1_HW_DONE_INTERRUPT_MASK                            0x00000001L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DOUT_IHC_I2C_DDC2_HW_DONE_INTERRUPT_MASK                            0x00000002L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DC_I2C_DDC1_READ_REQUEST_INTERRUPT_MASK                             0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DC_I2C_DDC2_READ_REQUEST_INTERRUPT_MASK                             0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DIGH_DP_FAST_TRAINING_COMPLETE_INTERRUPT_MASK                       0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DIGH_DP_VID_STREAM_DISABLE_INTERRUPT_MASK                           0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE21__DISP_INTERRUPT_STATUS_CONTINUE22_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE22
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG0_IHC_V_UPDATE_NO_LOCK_INTERRUPT__SHIFT                          0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG1_IHC_V_UPDATE_NO_LOCK_INTERRUPT__SHIFT                          0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG2_IHC_V_UPDATE_NO_LOCK_INTERRUPT__SHIFT                          0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG3_IHC_V_UPDATE_NO_LOCK_INTERRUPT__SHIFT                          0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG0_DRR_V_TOTAL_REACH_INTERRUPT__SHIFT                             0x19
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG1_DRR_V_TOTAL_REACH_INTERRUPT__SHIFT                             0x1a
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG2_DRR_V_TOTAL_REACH_INTERRUPT__SHIFT                             0x1b
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG3_DRR_V_TOTAL_REACH_INTERRUPT__SHIFT                             0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE22__DISP_INTERRUPT_STATUS_CONTINUE23__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG0_IHC_V_UPDATE_NO_LOCK_INTERRUPT_MASK                            0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG1_IHC_V_UPDATE_NO_LOCK_INTERRUPT_MASK                            0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG2_IHC_V_UPDATE_NO_LOCK_INTERRUPT_MASK                            0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG3_IHC_V_UPDATE_NO_LOCK_INTERRUPT_MASK                            0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG0_DRR_V_TOTAL_REACH_INTERRUPT_MASK                               0x02000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG1_DRR_V_TOTAL_REACH_INTERRUPT_MASK                               0x04000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG2_DRR_V_TOTAL_REACH_INTERRUPT_MASK                               0x08000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__OTG3_DRR_V_TOTAL_REACH_INTERRUPT_MASK                               0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE22__DISP_INTERRUPT_STATUS_CONTINUE23_MASK                               0x80000000L
+//DC_GPU_TIMER_START_POSITION_VREADY
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D1_VREADY__SHIFT                      0x0
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D2_VREADY__SHIFT                      0x4
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D3_VREADY__SHIFT                      0x8
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D4_VREADY__SHIFT                      0xc
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D1_VREADY_MASK                        0x00000007L
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D2_VREADY_MASK                        0x00000070L
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D3_VREADY_MASK                        0x00000700L
+#define DC_GPU_TIMER_START_POSITION_VREADY__DC_GPU_TIMER_START_POSITION_D4_VREADY_MASK                        0x00007000L
+//DC_GPU_TIMER_START_POSITION_FLIP
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D1_FLIP__SHIFT                          0x0
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D2_FLIP__SHIFT                          0x4
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D3_FLIP__SHIFT                          0x8
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D4_FLIP__SHIFT                          0xc
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D1_FLIP_MASK                            0x00000007L
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D2_FLIP_MASK                            0x00000070L
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D3_FLIP_MASK                            0x00000700L
+#define DC_GPU_TIMER_START_POSITION_FLIP__DC_GPU_TIMER_START_POSITION_D4_FLIP_MASK                            0x00007000L
+//DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D1_V_UPDATE_NO_LOCK__SHIFT  0x0
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D2_V_UPDATE_NO_LOCK__SHIFT  0x4
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D3_V_UPDATE_NO_LOCK__SHIFT  0x8
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D4_V_UPDATE_NO_LOCK__SHIFT  0xc
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D1_V_UPDATE_NO_LOCK_MASK    0x00000007L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D2_V_UPDATE_NO_LOCK_MASK    0x00000070L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D3_V_UPDATE_NO_LOCK_MASK    0x00000700L
+#define DC_GPU_TIMER_START_POSITION_V_UPDATE_NO_LOCK__DC_GPU_TIMER_START_POSITION_D4_V_UPDATE_NO_LOCK_MASK    0x00007000L
+//DC_GPU_TIMER_START_POSITION_FLIP_AWAY
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D1_FLIP_AWAY__SHIFT                0x0
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D2_FLIP_AWAY__SHIFT                0x4
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D3_FLIP_AWAY__SHIFT                0x8
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D4_FLIP_AWAY__SHIFT                0xc
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D1_FLIP_AWAY_MASK                  0x00000007L
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D2_FLIP_AWAY_MASK                  0x00000070L
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D3_FLIP_AWAY_MASK                  0x00000700L
+#define DC_GPU_TIMER_START_POSITION_FLIP_AWAY__DC_GPU_TIMER_START_POSITION_D4_FLIP_AWAY_MASK                  0x00007000L
+//DISP_INTERRUPT_STATUS_CONTINUE23
+#define DISP_INTERRUPT_STATUS_CONTINUE23__DISP_INTERRUPT_STATUS_CONTINUE24__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE23__DISP_INTERRUPT_STATUS_CONTINUE24_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE24
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_TIMER_HIGH_PRIORITY_INTERRUPT__SHIFT                          0xc
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_TIMER_LOW_PRIORITY_INTERRUPT__SHIFT                           0xd
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_HIGH_PRIORITY_READY_INTERRUPT__SHIFT                    0xe
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_HIGH_PRIORITY_DONE_INTERRUPT__SHIFT                     0xf
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_LOW_PRIORITY_READY_INTERRUPT__SHIFT                     0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_LOW_PRIORITY_DONE_INTERRUPT__SHIFT                      0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_HIGH_PRIORITY_READY_INTERRUPT__SHIFT                   0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_HIGH_PRIORITY_DONE_INTERRUPT__SHIFT                    0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_LOW_PRIORITY_READY_INTERRUPT__SHIFT                    0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_LOW_PRIORITY_DONE_INTERRUPT__SHIFT                     0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN0_INTERRUPT__SHIFT                              0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN1_INTERRUPT__SHIFT                              0x17
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN2_INTERRUPT__SHIFT                              0x18
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN3_INTERRUPT__SHIFT                              0x19
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN4_INTERRUPT__SHIFT                              0x1a
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAOUT_INTERRUPT__SHIFT                              0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_UNDEFINED_ADDRESS_FAULT_INTERRUPT__SHIFT                      0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DISP_INTERRUPT_STATUS_CONTINUE25__SHIFT                             0x1f
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_TIMER_HIGH_PRIORITY_INTERRUPT_MASK                            0x00001000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_TIMER_LOW_PRIORITY_INTERRUPT_MASK                             0x00002000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_HIGH_PRIORITY_READY_INTERRUPT_MASK                      0x00004000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_HIGH_PRIORITY_DONE_INTERRUPT_MASK                       0x00008000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_LOW_PRIORITY_READY_INTERRUPT_MASK                       0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_INBOX_LOW_PRIORITY_DONE_INTERRUPT_MASK                        0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_HIGH_PRIORITY_READY_INTERRUPT_MASK                     0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_HIGH_PRIORITY_DONE_INTERRUPT_MASK                      0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_LOW_PRIORITY_READY_INTERRUPT_MASK                      0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_OUTBOX_LOW_PRIORITY_DONE_INTERRUPT_MASK                       0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN0_INTERRUPT_MASK                                0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN1_INTERRUPT_MASK                                0x00800000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN2_INTERRUPT_MASK                                0x01000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN3_INTERRUPT_MASK                                0x02000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAIN4_INTERRUPT_MASK                                0x04000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_GENERAL_DATAOUT_INTERRUPT_MASK                                0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DMCUB_UNDEFINED_ADDRESS_FAULT_INTERRUPT_MASK                        0x40000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE24__DISP_INTERRUPT_STATUS_CONTINUE25_MASK                               0x80000000L
+//DISP_INTERRUPT_STATUS_CONTINUE25
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC0_IHC_CORE_ERROR_INTERRUPT__SHIFT                                0x6
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC1_IHC_CORE_ERROR_INTERRUPT__SHIFT                                0x7
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC2_IHC_CORE_ERROR_INTERRUPT__SHIFT                                0x8
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC3_IHC_CORE_ERROR_INTERRUPT__SHIFT                                0x9
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_WHITELIST_INVALID_ACCESS_INTERRUPT__SHIFT                     0xd
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX0_RDY_INTERRUPT__SHIFT                               0x10
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX1_RDY_INTERRUPT__SHIFT                               0x11
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX2_RDY_INTERRUPT__SHIFT                               0x12
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX3_RDY_INTERRUPT__SHIFT                               0x13
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX4_RDY_INTERRUPT__SHIFT                               0x14
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_OUTBOX0_RSP_INTERRUPT__SHIFT                              0x15
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_HOST_REG_INBOX0_RSP_INTERRUPT__SHIFT                          0x16
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_HOST_REG_OUTBOX0_RDY_INTERRUPT__SHIFT                         0x17
+#define DISP_INTERRUPT_STATUS_CONTINUE25__HPO_PERFMON_COUNTER0_INTERRUPT__SHIFT                               0x1c
+#define DISP_INTERRUPT_STATUS_CONTINUE25__HPO_PERFMON_COUNTER1_INTERRUPT__SHIFT                               0x1d
+#define DISP_INTERRUPT_STATUS_CONTINUE25__MMHUBBUB_WARMUP_INTERRUPT__SHIFT                                    0x1e
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC0_IHC_CORE_ERROR_INTERRUPT_MASK                                  0x00000040L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC1_IHC_CORE_ERROR_INTERRUPT_MASK                                  0x00000080L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC2_IHC_CORE_ERROR_INTERRUPT_MASK                                  0x00000100L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DSC3_IHC_CORE_ERROR_INTERRUPT_MASK                                  0x00000200L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_WHITELIST_INVALID_ACCESS_INTERRUPT_MASK                       0x00002000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX0_RDY_INTERRUPT_MASK                                 0x00010000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX1_RDY_INTERRUPT_MASK                                 0x00020000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX2_RDY_INTERRUPT_MASK                                 0x00040000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX3_RDY_INTERRUPT_MASK                                 0x00080000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_INBOX4_RDY_INTERRUPT_MASK                                 0x00100000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_REG_OUTBOX0_RSP_INTERRUPT_MASK                                0x00200000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_HOST_REG_INBOX0_RSP_INTERRUPT_MASK                            0x00400000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__DMCUB_HOST_REG_OUTBOX0_RDY_INTERRUPT_MASK                           0x00800000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__HPO_PERFMON_COUNTER0_INTERRUPT_MASK                                 0x10000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__HPO_PERFMON_COUNTER1_INTERRUPT_MASK                                 0x20000000L
+#define DISP_INTERRUPT_STATUS_CONTINUE25__MMHUBBUB_WARMUP_INTERRUPT_MASK                                      0x40000000L
+//DCCG_INTERRUPT_DEST
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG0_LATCH_INT_DEST__SHIFT                                        0x0
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG1_LATCH_INT_DEST__SHIFT                                        0x1
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG2_LATCH_INT_DEST__SHIFT                                        0x2
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG3_LATCH_INT_DEST__SHIFT                                        0x3
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                  0xc
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                  0xd
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON2_COUNTER0_INTERRUPT_DEST__SHIFT                                 0xe
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON2_COUNTER1_INTERRUPT_DEST__SHIFT                                 0xf
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG0_LATCH_INT_DEST_MASK                                          0x00000001L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG1_LATCH_INT_DEST_MASK                                          0x00000002L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG2_LATCH_INT_DEST_MASK                                          0x00000004L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_VSYNC_OTG3_LATCH_INT_DEST_MASK                                          0x00000008L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                    0x00001000L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                    0x00002000L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON2_COUNTER0_INTERRUPT_DEST_MASK                                   0x00004000L
+#define DCCG_INTERRUPT_DEST__DCCG_IHC_PERFMON2_COUNTER1_INTERRUPT_DEST_MASK                                   0x00008000L
+//DMU_INTERRUPT_DEST
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_TIMER0_INT_DEST__SHIFT                                                  0x0
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_TIMER1_INT_DEST__SHIFT                                                  0x1
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT0_INT_DEST__SHIFT                                                  0x2
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT1_INT_DEST__SHIFT                                                  0x3
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT2_INT_DEST__SHIFT                                                  0x4
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT3_INT_DEST__SHIFT                                                  0x5
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT4_INT_DEST__SHIFT                                                  0x6
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT_IH_INT_DEST__SHIFT                                                0x9
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX0_READY_INT_DEST__SHIFT                                            0xa
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX0_DONE_INT_DEST__SHIFT                                             0xb
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX1_READY_INT_DEST__SHIFT                                            0xc
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX1_DONE_INT_DEST__SHIFT                                             0xd
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX0_READY_INT_DEST__SHIFT                                           0xe
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX0_DONE_INT_DEST__SHIFT                                            0xf
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX1_READY_INT_DEST__SHIFT                                           0x10
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX1_DONE_INT_DEST__SHIFT                                            0x11
+#define DMU_INTERRUPT_DEST__DMU_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                    0x12
+#define DMU_INTERRUPT_DEST__DMU_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                    0x13
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_UNDEFINED_ADDRESS_FAULT_INT_DEST__SHIFT                                 0x1a
+#define DMU_INTERRUPT_DEST__RBBMIF_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                          0x1b
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_TIMER0_INT_DEST_MASK                                                    0x00000001L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_TIMER1_INT_DEST_MASK                                                    0x00000002L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT0_INT_DEST_MASK                                                    0x00000004L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT1_INT_DEST_MASK                                                    0x00000008L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT2_INT_DEST_MASK                                                    0x00000010L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT3_INT_DEST_MASK                                                    0x00000020L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT4_INT_DEST_MASK                                                    0x00000040L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_GPINT_IH_INT_DEST_MASK                                                  0x00000200L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX0_READY_INT_DEST_MASK                                              0x00000400L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX0_DONE_INT_DEST_MASK                                               0x00000800L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX1_READY_INT_DEST_MASK                                              0x00001000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_INBOX1_DONE_INT_DEST_MASK                                               0x00002000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX0_READY_INT_DEST_MASK                                             0x00004000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX0_DONE_INT_DEST_MASK                                              0x00008000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX1_READY_INT_DEST_MASK                                             0x00010000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_OUTBOX1_DONE_INT_DEST_MASK                                              0x00020000L
+#define DMU_INTERRUPT_DEST__DMU_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                      0x00040000L
+#define DMU_INTERRUPT_DEST__DMU_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                      0x00080000L
+#define DMU_INTERRUPT_DEST__DMCUB_IHC_UNDEFINED_ADDRESS_FAULT_INT_DEST_MASK                                   0x04000000L
+#define DMU_INTERRUPT_DEST__RBBMIF_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                            0x08000000L
+//DMU_INTERRUPT_DEST2
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX0_RDY_INT_DEST__SHIFT                                         0x0
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX1_RDY_INT_DEST__SHIFT                                         0x1
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX2_RDY_INT_DEST__SHIFT                                         0x2
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX3_RDY_INT_DEST__SHIFT                                         0x3
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX4_RDY_INT_DEST__SHIFT                                         0x4
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_OUTBOX0_RSP_INT_DEST__SHIFT                                        0x5
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_HOST_REG_INBOX0_RSP_INT_DEST__SHIFT                                    0x6
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_HOST_REG_OUTBOX0_RDY_INT_DEST__SHIFT                                   0x7
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_WHITELIST_INVALID_ACCESS_INTERRUPT_DEST__SHIFT                         0xd
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX0_RDY_INT_DEST_MASK                                           0x00000001L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX1_RDY_INT_DEST_MASK                                           0x00000002L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX2_RDY_INT_DEST_MASK                                           0x00000004L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX3_RDY_INT_DEST_MASK                                           0x00000008L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_INBOX4_RDY_INT_DEST_MASK                                           0x00000010L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_REG_OUTBOX0_RSP_INT_DEST_MASK                                          0x00000020L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_HOST_REG_INBOX0_RSP_INT_DEST_MASK                                      0x00000040L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_HOST_REG_OUTBOX0_RDY_INT_DEST_MASK                                     0x00000080L
+#define DMU_INTERRUPT_DEST2__DMCUB_IHC_WHITELIST_INVALID_ACCESS_INTERRUPT_DEST_MASK                           0x00002000L
+//DCPG_INTERRUPT_DEST
+//DCPG_INTERRUPT_DEST2
+//MMHUBBUB_INTERRUPT_DEST
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_WARMUP_INTERRUPT_DEST__SHIFT                                    0x8
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                          0xc
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                          0xd
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_WARMUP_INTERRUPT_DEST_MASK                                      0x00000100L
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                            0x00001000L
+#define MMHUBBUB_INTERRUPT_DEST__MMHUBBUB_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                            0x00002000L
+//WB_INTERRUPT_DEST
+//DCHUB_INTERRUPT_DEST
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VBLANK_INTERRUPT_DEST__SHIFT                                          0x0
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VLINE_INTERRUPT_DEST__SHIFT                                           0x1
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VLINE2_INTERRUPT_DEST__SHIFT                                          0x2
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                         0x3
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VBLANK_INTERRUPT_DEST__SHIFT                                          0x4
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VLINE_INTERRUPT_DEST__SHIFT                                           0x5
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VLINE2_INTERRUPT_DEST__SHIFT                                          0x6
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                         0x7
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VBLANK_INTERRUPT_DEST__SHIFT                                          0x8
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VLINE_INTERRUPT_DEST__SHIFT                                           0x9
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VLINE2_INTERRUPT_DEST__SHIFT                                          0xa
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                         0xb
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VBLANK_INTERRUPT_DEST__SHIFT                                          0xc
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VLINE_INTERRUPT_DEST__SHIFT                                           0xd
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VLINE2_INTERRUPT_DEST__SHIFT                                          0xe
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                         0xf
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VBLANK_INTERRUPT_DEST_MASK                                            0x00000001L
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VLINE_INTERRUPT_DEST_MASK                                             0x00000002L
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_VLINE2_INTERRUPT_DEST_MASK                                            0x00000004L
+#define DCHUB_INTERRUPT_DEST__HUBP0_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                           0x00000008L
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VBLANK_INTERRUPT_DEST_MASK                                            0x00000010L
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VLINE_INTERRUPT_DEST_MASK                                             0x00000020L
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_VLINE2_INTERRUPT_DEST_MASK                                            0x00000040L
+#define DCHUB_INTERRUPT_DEST__HUBP1_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                           0x00000080L
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VBLANK_INTERRUPT_DEST_MASK                                            0x00000100L
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VLINE_INTERRUPT_DEST_MASK                                             0x00000200L
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_VLINE2_INTERRUPT_DEST_MASK                                            0x00000400L
+#define DCHUB_INTERRUPT_DEST__HUBP2_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                           0x00000800L
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VBLANK_INTERRUPT_DEST_MASK                                            0x00001000L
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VLINE_INTERRUPT_DEST_MASK                                             0x00002000L
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_VLINE2_INTERRUPT_DEST_MASK                                            0x00004000L
+#define DCHUB_INTERRUPT_DEST__HUBP3_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                           0x00008000L
+//DCHUB_PERFCOUNTER_INTERRUPT_DEST
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBBUB_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                   0xc
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBBUB_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                   0xd
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP0_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                    0xe
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP0_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                    0xf
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP1_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                    0x10
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP1_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                    0x11
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP2_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                    0x12
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP2_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                    0x13
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP3_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                    0x14
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP3_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                    0x15
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBBUB_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                     0x00001000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBBUB_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                     0x00002000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP0_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                      0x00004000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP0_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                      0x00008000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP1_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                      0x00010000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP1_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                      0x00020000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP2_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                      0x00040000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP2_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                      0x00080000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP3_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                      0x00100000L
+#define DCHUB_PERFCOUNTER_INTERRUPT_DEST__HUBP3_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                      0x00200000L
+//DCHUB_INTERRUPT_DEST2
+#define DCHUB_INTERRUPT_DEST2__HUBP0_IHC_FLIP_INTERRUPT_DEST__SHIFT                                           0x0
+#define DCHUB_INTERRUPT_DEST2__HUBP0_IHC_FLIP_AWAY_INTERRUPT_DEST__SHIFT                                      0x1
+#define DCHUB_INTERRUPT_DEST2__HUBP1_IHC_FLIP_INTERRUPT_DEST__SHIFT                                           0x2
+#define DCHUB_INTERRUPT_DEST2__HUBP1_IHC_FLIP_AWAY_INTERRUPT_DEST__SHIFT                                      0x3
+#define DCHUB_INTERRUPT_DEST2__HUBP2_IHC_FLIP_INTERRUPT_DEST__SHIFT                                           0x4
+#define DCHUB_INTERRUPT_DEST2__HUBP2_IHC_FLIP_AWAY_INTERRUPT_DEST__SHIFT                                      0x5
+#define DCHUB_INTERRUPT_DEST2__HUBP3_IHC_FLIP_INTERRUPT_DEST__SHIFT                                           0x6
+#define DCHUB_INTERRUPT_DEST2__HUBP3_IHC_FLIP_AWAY_INTERRUPT_DEST__SHIFT                                      0x7
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_VM_FAULT_INTERRUPT_DEST__SHIFT                                      0x18
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_TIMEOUT_INTERRUPT_DEST__SHIFT                                       0x19
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_COMPBUF_SIZE_CHANGE_INTERRUPT_DEST__SHIFT                           0x1a
+#define DCHUB_INTERRUPT_DEST2__HUBP0_IHC_FLIP_INTERRUPT_DEST_MASK                                             0x00000001L
+#define DCHUB_INTERRUPT_DEST2__HUBP0_IHC_FLIP_AWAY_INTERRUPT_DEST_MASK                                        0x00000002L
+#define DCHUB_INTERRUPT_DEST2__HUBP1_IHC_FLIP_INTERRUPT_DEST_MASK                                             0x00000004L
+#define DCHUB_INTERRUPT_DEST2__HUBP1_IHC_FLIP_AWAY_INTERRUPT_DEST_MASK                                        0x00000008L
+#define DCHUB_INTERRUPT_DEST2__HUBP2_IHC_FLIP_INTERRUPT_DEST_MASK                                             0x00000010L
+#define DCHUB_INTERRUPT_DEST2__HUBP2_IHC_FLIP_AWAY_INTERRUPT_DEST_MASK                                        0x00000020L
+#define DCHUB_INTERRUPT_DEST2__HUBP3_IHC_FLIP_INTERRUPT_DEST_MASK                                             0x00000040L
+#define DCHUB_INTERRUPT_DEST2__HUBP3_IHC_FLIP_AWAY_INTERRUPT_DEST_MASK                                        0x00000080L
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_VM_FAULT_INTERRUPT_DEST_MASK                                        0x01000000L
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_TIMEOUT_INTERRUPT_DEST_MASK                                         0x02000000L
+#define DCHUB_INTERRUPT_DEST2__HUBBUB_IHC_COMPBUF_SIZE_CHANGE_INTERRUPT_DEST_MASK                             0x04000000L
+//DPP_PERFCOUNTER_INTERRUPT_DEST
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP0_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                       0xc
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP0_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                       0xd
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP1_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                       0xe
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP1_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                       0xf
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP2_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                       0x10
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP2_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                       0x11
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP3_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                       0x12
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP3_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                       0x13
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP0_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                         0x00001000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP0_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                         0x00002000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP1_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                         0x00004000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP1_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                         0x00008000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP2_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                         0x00010000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP2_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                         0x00020000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP3_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                         0x00040000L
+#define DPP_PERFCOUNTER_INTERRUPT_DEST__DPP3_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                         0x00080000L
+//MPC_INTERRUPT_DEST
+#define MPC_INTERRUPT_DEST__MPCC0_STALL_INTERRUPT_DEST__SHIFT                                                 0x0
+#define MPC_INTERRUPT_DEST__MPCC1_STALL_INTERRUPT_DEST__SHIFT                                                 0x1
+#define MPC_INTERRUPT_DEST__MPCC2_STALL_INTERRUPT_DEST__SHIFT                                                 0x2
+#define MPC_INTERRUPT_DEST__MPCC3_STALL_INTERRUPT_DEST__SHIFT                                                 0x3
+#define MPC_INTERRUPT_DEST__MPC_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                    0xc
+#define MPC_INTERRUPT_DEST__MPC_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                    0xd
+#define MPC_INTERRUPT_DEST__MPCC0_STALL_INTERRUPT_DEST_MASK                                                   0x00000001L
+#define MPC_INTERRUPT_DEST__MPCC1_STALL_INTERRUPT_DEST_MASK                                                   0x00000002L
+#define MPC_INTERRUPT_DEST__MPCC2_STALL_INTERRUPT_DEST_MASK                                                   0x00000004L
+#define MPC_INTERRUPT_DEST__MPCC3_STALL_INTERRUPT_DEST_MASK                                                   0x00000008L
+#define MPC_INTERRUPT_DEST__MPC_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                      0x00001000L
+#define MPC_INTERRUPT_DEST__MPC_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                      0x00002000L
+//OPP_INTERRUPT_DEST
+#define OPP_INTERRUPT_DEST__OPP_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                    0xc
+#define OPP_INTERRUPT_DEST__OPP_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                    0xd
+#define OPP_INTERRUPT_DEST__OPP_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                      0x00001000L
+#define OPP_INTERRUPT_DEST__OPP_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                      0x00002000L
+//OPTC_INTERRUPT_DEST
+#define OPTC_INTERRUPT_DEST__OPTC_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                  0xc
+#define OPTC_INTERRUPT_DEST__OPTC_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                  0xd
+#define OPTC_INTERRUPT_DEST__OPTC0_IHC_DATA_UNDERFLOW_INTERRUPT_DEST__SHIFT                                   0x18
+#define OPTC_INTERRUPT_DEST__OPTC1_IHC_DATA_UNDERFLOW_INTERRUPT_DEST__SHIFT                                   0x19
+#define OPTC_INTERRUPT_DEST__OPTC2_IHC_DATA_UNDERFLOW_INTERRUPT_DEST__SHIFT                                   0x1a
+#define OPTC_INTERRUPT_DEST__OPTC3_IHC_DATA_UNDERFLOW_INTERRUPT_DEST__SHIFT                                   0x1b
+#define OPTC_INTERRUPT_DEST__OPTC_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                    0x00001000L
+#define OPTC_INTERRUPT_DEST__OPTC_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                    0x00002000L
+#define OPTC_INTERRUPT_DEST__OPTC0_IHC_DATA_UNDERFLOW_INTERRUPT_DEST_MASK                                     0x01000000L
+#define OPTC_INTERRUPT_DEST__OPTC1_IHC_DATA_UNDERFLOW_INTERRUPT_DEST_MASK                                     0x02000000L
+#define OPTC_INTERRUPT_DEST__OPTC2_IHC_DATA_UNDERFLOW_INTERRUPT_DEST_MASK                                     0x04000000L
+#define OPTC_INTERRUPT_DEST__OPTC3_IHC_DATA_UNDERFLOW_INTERRUPT_DEST_MASK                                     0x08000000L
+//OTG0_INTERRUPT_DEST
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_CPU_SS_INTERRUPT_DEST__SHIFT                                            0x0
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_DRR_TIMING_INTERRUPT_DEST__SHIFT                                        0x1
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_V_UPDATE_INTERRUPT_DEST__SHIFT                                          0x2
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_SNAPSHOT_INTERRUPT_DEST__SHIFT                                          0x3
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST__SHIFT                               0x4
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST__SHIFT                             0x5
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_TRIGA_INTERRUPT_DEST__SHIFT                                         0x6
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_TRIGB_INTERRUPT_DEST__SHIFT                                         0x7
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST__SHIFT                                     0x8
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT0_DEST__SHIFT                                     0x9
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT1_DEST__SHIFT                                     0xa
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT2_DEST__SHIFT                                     0xb
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST__SHIFT                     0xf
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VSTARTUP_INTERRUPT_DEST__SHIFT                                          0x10
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VREADY_INTERRUPT_DEST__SHIFT                                            0x11
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VSYNC_NOM_INTERRUPT_DEST__SHIFT                                         0x12
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST__SHIFT                                  0x13
+#define OTG0_INTERRUPT_DEST__OTG0_DRR_V_TOTAL_REACH_INTERRUPT_DEST__SHIFT                                     0x14
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_CPU_SS_INTERRUPT_DEST_MASK                                              0x00000001L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_DRR_TIMING_INTERRUPT_DEST_MASK                                          0x00000002L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_V_UPDATE_INTERRUPT_DEST_MASK                                            0x00000004L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_SNAPSHOT_INTERRUPT_DEST_MASK                                            0x00000008L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST_MASK                                 0x00000010L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST_MASK                               0x00000020L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_TRIGA_INTERRUPT_DEST_MASK                                           0x00000040L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_TRIGB_INTERRUPT_DEST_MASK                                           0x00000080L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST_MASK                                       0x00000100L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT0_DEST_MASK                                       0x00000200L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT1_DEST_MASK                                       0x00000400L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_OTG_VERTICAL_INTERRUPT2_DEST_MASK                                       0x00000800L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST_MASK                       0x00008000L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VSTARTUP_INTERRUPT_DEST_MASK                                            0x00010000L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VREADY_INTERRUPT_DEST_MASK                                              0x00020000L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_VSYNC_NOM_INTERRUPT_DEST_MASK                                           0x00040000L
+#define OTG0_INTERRUPT_DEST__OTG0_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST_MASK                                    0x00080000L
+#define OTG0_INTERRUPT_DEST__OTG0_DRR_V_TOTAL_REACH_INTERRUPT_DEST_MASK                                       0x00100000L
+//OTG1_INTERRUPT_DEST
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_CPU_SS_INTERRUPT_DEST__SHIFT                                            0x0
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_DRR_TIMING_INTERRUPT_DEST__SHIFT                                        0x1
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_V_UPDATE_INTERRUPT_DEST__SHIFT                                          0x2
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_SNAPSHOT_INTERRUPT_DEST__SHIFT                                          0x3
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST__SHIFT                               0x4
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST__SHIFT                             0x5
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_TRIGA_INTERRUPT_DEST__SHIFT                                         0x6
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_TRIGB_INTERRUPT_DEST__SHIFT                                         0x7
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST__SHIFT                                     0x8
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT0_DEST__SHIFT                                     0x9
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT1_DEST__SHIFT                                     0xa
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT2_DEST__SHIFT                                     0xb
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST__SHIFT                     0xf
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VSTARTUP_INTERRUPT_DEST__SHIFT                                          0x10
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VREADY_INTERRUPT_DEST__SHIFT                                            0x11
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VSYNC_NOM_INTERRUPT_DEST__SHIFT                                         0x12
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST__SHIFT                                  0x13
+#define OTG1_INTERRUPT_DEST__OTG1_DRR_V_TOTAL_REACH_INTERRUPT_DEST__SHIFT                                     0x14
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_CPU_SS_INTERRUPT_DEST_MASK                                              0x00000001L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_DRR_TIMING_INTERRUPT_DEST_MASK                                          0x00000002L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_V_UPDATE_INTERRUPT_DEST_MASK                                            0x00000004L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_SNAPSHOT_INTERRUPT_DEST_MASK                                            0x00000008L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST_MASK                                 0x00000010L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST_MASK                               0x00000020L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_TRIGA_INTERRUPT_DEST_MASK                                           0x00000040L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_TRIGB_INTERRUPT_DEST_MASK                                           0x00000080L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST_MASK                                       0x00000100L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT0_DEST_MASK                                       0x00000200L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT1_DEST_MASK                                       0x00000400L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_OTG_VERTICAL_INTERRUPT2_DEST_MASK                                       0x00000800L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST_MASK                       0x00008000L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VSTARTUP_INTERRUPT_DEST_MASK                                            0x00010000L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VREADY_INTERRUPT_DEST_MASK                                              0x00020000L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_VSYNC_NOM_INTERRUPT_DEST_MASK                                           0x00040000L
+#define OTG1_INTERRUPT_DEST__OTG1_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST_MASK                                    0x00080000L
+#define OTG1_INTERRUPT_DEST__OTG1_DRR_V_TOTAL_REACH_INTERRUPT_DEST_MASK                                       0x00100000L
+//OTG2_INTERRUPT_DEST
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_CPU_SS_INTERRUPT_DEST__SHIFT                                            0x0
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_DRR_TIMING_INTERRUPT_DEST__SHIFT                                        0x1
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_V_UPDATE_INTERRUPT_DEST__SHIFT                                          0x2
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_SNAPSHOT_INTERRUPT_DEST__SHIFT                                          0x3
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST__SHIFT                               0x4
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST__SHIFT                             0x5
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_TRIGA_INTERRUPT_DEST__SHIFT                                         0x6
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_TRIGB_INTERRUPT_DEST__SHIFT                                         0x7
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST__SHIFT                                     0x8
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT0_DEST__SHIFT                                     0x9
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT1_DEST__SHIFT                                     0xa
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT2_DEST__SHIFT                                     0xb
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST__SHIFT                     0xf
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VSTARTUP_INTERRUPT_DEST__SHIFT                                          0x10
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VREADY_INTERRUPT_DEST__SHIFT                                            0x11
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VSYNC_NOM_INTERRUPT_DEST__SHIFT                                         0x12
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST__SHIFT                                  0x13
+#define OTG2_INTERRUPT_DEST__OTG2_DRR_V_TOTAL_REACH_INTERRUPT_DEST__SHIFT                                     0x14
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_CPU_SS_INTERRUPT_DEST_MASK                                              0x00000001L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_DRR_TIMING_INTERRUPT_DEST_MASK                                          0x00000002L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_V_UPDATE_INTERRUPT_DEST_MASK                                            0x00000004L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_SNAPSHOT_INTERRUPT_DEST_MASK                                            0x00000008L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST_MASK                                 0x00000010L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST_MASK                               0x00000020L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_TRIGA_INTERRUPT_DEST_MASK                                           0x00000040L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_TRIGB_INTERRUPT_DEST_MASK                                           0x00000080L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST_MASK                                       0x00000100L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT0_DEST_MASK                                       0x00000200L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT1_DEST_MASK                                       0x00000400L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_OTG_VERTICAL_INTERRUPT2_DEST_MASK                                       0x00000800L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST_MASK                       0x00008000L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VSTARTUP_INTERRUPT_DEST_MASK                                            0x00010000L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VREADY_INTERRUPT_DEST_MASK                                              0x00020000L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_VSYNC_NOM_INTERRUPT_DEST_MASK                                           0x00040000L
+#define OTG2_INTERRUPT_DEST__OTG2_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST_MASK                                    0x00080000L
+#define OTG2_INTERRUPT_DEST__OTG2_DRR_V_TOTAL_REACH_INTERRUPT_DEST_MASK                                       0x00100000L
+//OTG3_INTERRUPT_DEST
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_CPU_SS_INTERRUPT_DEST__SHIFT                                            0x0
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_DRR_TIMING_INTERRUPT_DEST__SHIFT                                        0x1
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_V_UPDATE_INTERRUPT_DEST__SHIFT                                          0x2
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_SNAPSHOT_INTERRUPT_DEST__SHIFT                                          0x3
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST__SHIFT                               0x4
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST__SHIFT                             0x5
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_TRIGA_INTERRUPT_DEST__SHIFT                                         0x6
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_TRIGB_INTERRUPT_DEST__SHIFT                                         0x7
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST__SHIFT                                     0x8
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT0_DEST__SHIFT                                     0x9
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT1_DEST__SHIFT                                     0xa
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT2_DEST__SHIFT                                     0xb
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST__SHIFT                     0xf
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VSTARTUP_INTERRUPT_DEST__SHIFT                                          0x10
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VREADY_INTERRUPT_DEST__SHIFT                                            0x11
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VSYNC_NOM_INTERRUPT_DEST__SHIFT                                         0x12
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST__SHIFT                                  0x13
+#define OTG3_INTERRUPT_DEST__OTG3_DRR_V_TOTAL_REACH_INTERRUPT_DEST__SHIFT                                     0x14
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_CPU_SS_INTERRUPT_DEST_MASK                                              0x00000001L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_DRR_TIMING_INTERRUPT_DEST_MASK                                          0x00000002L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_V_UPDATE_INTERRUPT_DEST_MASK                                            0x00000004L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_SNAPSHOT_INTERRUPT_DEST_MASK                                            0x00000008L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_FORCE_COUNT_NOW_INTERRUPT_DEST_MASK                                 0x00000010L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_FORCE_VSYNC_NEXT_LINE_INTERRUPT_DEST_MASK                               0x00000020L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_TRIGA_INTERRUPT_DEST_MASK                                           0x00000040L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_TRIGB_INTERRUPT_DEST_MASK                                           0x00000080L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_GSL_VSYNC_GAP_INTERRUPT_DEST_MASK                                       0x00000100L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT0_DEST_MASK                                       0x00000200L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT1_DEST_MASK                                       0x00000400L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_OTG_VERTICAL_INTERRUPT2_DEST_MASK                                       0x00000800L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_SET_V_TOTAL_MIN_EVENT_OCCURED_INTERRUPT_DEST_MASK                       0x00008000L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VSTARTUP_INTERRUPT_DEST_MASK                                            0x00010000L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VREADY_INTERRUPT_DEST_MASK                                              0x00020000L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_VSYNC_NOM_INTERRUPT_DEST_MASK                                           0x00040000L
+#define OTG3_INTERRUPT_DEST__OTG3_IHC_V_UPDATE_NO_LOCK_INTERRUPT_DEST_MASK                                    0x00080000L
+#define OTG3_INTERRUPT_DEST__OTG3_DRR_V_TOTAL_REACH_INTERRUPT_DEST_MASK                                       0x00100000L
+//OTG4_INTERRUPT_DEST
+//OTG5_INTERRUPT_DEST
+//DIG_INTERRUPT_DEST
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGA_VID_STREAM_DISABLE_INTERRUPT_DEST__SHIFT                            0x0
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGB_VID_STREAM_DISABLE_INTERRUPT_DEST__SHIFT                            0x1
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGC_VID_STREAM_DISABLE_INTERRUPT_DEST__SHIFT                            0x2
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGD_VID_STREAM_DISABLE_INTERRUPT_DEST__SHIFT                            0x3
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGA_FAST_TRAINING_COMPLETE_INTERRUPT_DEST__SHIFT                        0x8
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGB_FAST_TRAINING_COMPLETE_INTERRUPT_DEST__SHIFT                        0x9
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGC_FAST_TRAINING_COMPLETE_INTERRUPT_DEST__SHIFT                        0xa
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGD_FAST_TRAINING_COMPLETE_INTERRUPT_DEST__SHIFT                        0xb
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGA_VID_STREAM_DISABLE_INTERRUPT_DEST_MASK                              0x00000001L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGB_VID_STREAM_DISABLE_INTERRUPT_DEST_MASK                              0x00000002L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGC_VID_STREAM_DISABLE_INTERRUPT_DEST_MASK                              0x00000004L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGD_VID_STREAM_DISABLE_INTERRUPT_DEST_MASK                              0x00000008L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGA_FAST_TRAINING_COMPLETE_INTERRUPT_DEST_MASK                          0x00000100L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGB_FAST_TRAINING_COMPLETE_INTERRUPT_DEST_MASK                          0x00000200L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGC_FAST_TRAINING_COMPLETE_INTERRUPT_DEST_MASK                          0x00000400L
+#define DIG_INTERRUPT_DEST__DOUT_IHC_DIGD_FAST_TRAINING_COMPLETE_INTERRUPT_DEST_MASK                          0x00000800L
+//I2C_DDC_HPD_INTERRUPT_DEST
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_SW_DONE_INTERRUPT_DEST__SHIFT                                0x0
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_DDC1_HW_DONE_INTERRUPT_DEST__SHIFT                           0x1
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_DDC2_HW_DONE_INTERRUPT_DEST__SHIFT                           0x2
+#define I2C_DDC_HPD_INTERRUPT_DEST__DC_I2C_DDC1_READ_REQUEST_INTERRUPT_DEST__SHIFT                            0x10
+#define I2C_DDC_HPD_INTERRUPT_DEST__DC_I2C_DDC2_READ_REQUEST_INTERRUPT_DEST__SHIFT                            0x11
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_SW_DONE_INTERRUPT_DEST_MASK                                  0x00000001L
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_DDC1_HW_DONE_INTERRUPT_DEST_MASK                             0x00000002L
+#define I2C_DDC_HPD_INTERRUPT_DEST__DOUT_IHC_I2C_DDC2_HW_DONE_INTERRUPT_DEST_MASK                             0x00000004L
+#define I2C_DDC_HPD_INTERRUPT_DEST__DC_I2C_DDC1_READ_REQUEST_INTERRUPT_DEST_MASK                              0x00010000L
+#define I2C_DDC_HPD_INTERRUPT_DEST__DC_I2C_DDC2_READ_REQUEST_INTERRUPT_DEST_MASK                              0x00020000L
+//HDCP_INTERRUPT_DEST
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_AUTH_SUCCESS_INTERRUPT_DEST__SHIFT                                0x0
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_AUTH_FAIL_INTERRUPT_DEST__SHIFT                                   0x1
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_I2C_XFER_REQ_INTERRUPT_DEST__SHIFT                                0x2
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_I2C_XFER_DONE_INTERRUPT_DEST__SHIFT                               0x3
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_AUTH_SUCCESS_INTERRUPT_DEST__SHIFT                                0x4
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_AUTH_FAIL_INTERRUPT_DEST__SHIFT                                   0x5
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_I2C_XFER_REQ_INTERRUPT_DEST__SHIFT                                0x6
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_I2C_XFER_DONE_INTERRUPT_DEST__SHIFT                               0x7
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_AUTH_SUCCESS_INTERRUPT_DEST__SHIFT                                0x8
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_AUTH_FAIL_INTERRUPT_DEST__SHIFT                                   0x9
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_I2C_XFER_REQ_INTERRUPT_DEST__SHIFT                                0xa
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_I2C_XFER_DONE_INTERRUPT_DEST__SHIFT                               0xb
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_AUTH_SUCCESS_INTERRUPT_DEST__SHIFT                                0xc
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_AUTH_FAIL_INTERRUPT_DEST__SHIFT                                   0xd
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_I2C_XFER_REQ_INTERRUPT_DEST__SHIFT                                0xe
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_I2C_XFER_DONE_INTERRUPT_DEST__SHIFT                               0xf
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_AUTH_SUCCESS_INTERRUPT_DEST_MASK                                  0x00000001L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_AUTH_FAIL_INTERRUPT_DEST_MASK                                     0x00000002L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_I2C_XFER_REQ_INTERRUPT_DEST_MASK                                  0x00000004L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP0_I2C_XFER_DONE_INTERRUPT_DEST_MASK                                 0x00000008L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_AUTH_SUCCESS_INTERRUPT_DEST_MASK                                  0x00000010L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_AUTH_FAIL_INTERRUPT_DEST_MASK                                     0x00000020L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_I2C_XFER_REQ_INTERRUPT_DEST_MASK                                  0x00000040L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP1_I2C_XFER_DONE_INTERRUPT_DEST_MASK                                 0x00000080L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_AUTH_SUCCESS_INTERRUPT_DEST_MASK                                  0x00000100L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_AUTH_FAIL_INTERRUPT_DEST_MASK                                     0x00000200L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_I2C_XFER_REQ_INTERRUPT_DEST_MASK                                  0x00000400L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP2_I2C_XFER_DONE_INTERRUPT_DEST_MASK                                 0x00000800L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_AUTH_SUCCESS_INTERRUPT_DEST_MASK                                  0x00001000L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_AUTH_FAIL_INTERRUPT_DEST_MASK                                     0x00002000L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_I2C_XFER_REQ_INTERRUPT_DEST_MASK                                  0x00004000L
+#define HDCP_INTERRUPT_DEST__DOUT_IHC_HDCP3_I2C_XFER_DONE_INTERRUPT_DEST_MASK                                 0x00008000L
+//DIO_INTERRUPT_DEST
+#define DIO_INTERRUPT_DEST__HDCP2_IHC_RXSTATUS_TIMER_INTERRUPT_DEST__SHIFT                                    0x0
+#define DIO_INTERRUPT_DEST__DIO_ALPM_INTERRUPT_DEST__SHIFT                                                    0x4
+#define DIO_INTERRUPT_DEST__DIO_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                    0xc
+#define DIO_INTERRUPT_DEST__DIO_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                    0xd
+#define DIO_INTERRUPT_DEST__HDCP2_IHC_RXSTATUS_TIMER_INTERRUPT_DEST_MASK                                      0x00000001L
+#define DIO_INTERRUPT_DEST__DIO_ALPM_INTERRUPT_DEST_MASK                                                      0x00000010L
+#define DIO_INTERRUPT_DEST__DIO_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                      0x00001000L
+#define DIO_INTERRUPT_DEST__DIO_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                      0x00002000L
+//DCIO_INTERRUPT_DEST
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXA_IHC_ERROR_INTERRUPT_DEST__SHIFT                                    0x0
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXB_IHC_ERROR_INTERRUPT_DEST__SHIFT                                    0x1
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXC_IHC_ERROR_INTERRUPT_DEST__SHIFT                                    0x2
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXD_IHC_ERROR_INTERRUPT_DEST__SHIFT                                    0x3
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXA_IHC_ERROR_INTERRUPT_DEST_MASK                                      0x00000001L
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXB_IHC_ERROR_INTERRUPT_DEST_MASK                                      0x00000002L
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXC_IHC_ERROR_INTERRUPT_DEST_MASK                                      0x00000004L
+#define DCIO_INTERRUPT_DEST__DCIO_DPCS_TXD_IHC_ERROR_INTERRUPT_DEST_MASK                                      0x00000008L
+//HPD_INTERRUPT_DEST
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD1_INTERRUPT_DEST__SHIFT                                               0x0
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD2_INTERRUPT_DEST__SHIFT                                               0x1
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD3_INTERRUPT_DEST__SHIFT                                               0x2
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD4_INTERRUPT_DEST__SHIFT                                               0x3
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD1_RX_INTERRUPT_DEST__SHIFT                                            0x8
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD2_RX_INTERRUPT_DEST__SHIFT                                            0x9
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD3_RX_INTERRUPT_DEST__SHIFT                                            0xa
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD4_RX_INTERRUPT_DEST__SHIFT                                            0xb
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD1_INTERRUPT_DEST_MASK                                                 0x00000001L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD2_INTERRUPT_DEST_MASK                                                 0x00000002L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD3_INTERRUPT_DEST_MASK                                                 0x00000004L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD4_INTERRUPT_DEST_MASK                                                 0x00000008L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD1_RX_INTERRUPT_DEST_MASK                                              0x00000100L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD2_RX_INTERRUPT_DEST_MASK                                              0x00000200L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD3_RX_INTERRUPT_DEST_MASK                                              0x00000400L
+#define HPD_INTERRUPT_DEST__DOUT_IHC_HPD4_RX_INTERRUPT_DEST_MASK                                              0x00000800L
+//AZ_INTERRUPT_DEST
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_FORMAT_CHANGED_INT_DEST__SHIFT                              0x0
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_FORMAT_CHANGED_INT_DEST__SHIFT                              0x1
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_FORMAT_CHANGED_INT_DEST__SHIFT                              0x2
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_FORMAT_CHANGED_INT_DEST__SHIFT                              0x3
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_ENABLED_INT_DEST__SHIFT                                     0x8
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_ENABLED_INT_DEST__SHIFT                                     0x9
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_ENABLED_INT_DEST__SHIFT                                     0xa
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_ENABLED_INT_DEST__SHIFT                                     0xb
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_DISABLED_INT_DEST__SHIFT                                    0x10
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_DISABLED_INT_DEST__SHIFT                                    0x11
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_DISABLED_INT_DEST__SHIFT                                    0x12
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_DISABLED_INT_DEST__SHIFT                                    0x13
+#define AZ_INTERRUPT_DEST__AZ_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                      0x1e
+#define AZ_INTERRUPT_DEST__AZ_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                      0x1f
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_FORMAT_CHANGED_INT_DEST_MASK                                0x00000001L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_FORMAT_CHANGED_INT_DEST_MASK                                0x00000002L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_FORMAT_CHANGED_INT_DEST_MASK                                0x00000004L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_FORMAT_CHANGED_INT_DEST_MASK                                0x00000008L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_ENABLED_INT_DEST_MASK                                       0x00000100L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_ENABLED_INT_DEST_MASK                                       0x00000200L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_ENABLED_INT_DEST_MASK                                       0x00000400L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_ENABLED_INT_DEST_MASK                                       0x00000800L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT0_AUDIO_DISABLED_INT_DEST_MASK                                      0x00010000L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT1_AUDIO_DISABLED_INT_DEST_MASK                                      0x00020000L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT2_AUDIO_DISABLED_INT_DEST_MASK                                      0x00040000L
+#define AZ_INTERRUPT_DEST__AZ_IHC_ENDPOINT3_AUDIO_DISABLED_INT_DEST_MASK                                      0x00080000L
+#define AZ_INTERRUPT_DEST__AZ_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                        0x40000000L
+#define AZ_INTERRUPT_DEST__AZ_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                        0x80000000L
+//AUX_INTERRUPT_DEST
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX1_SW_DONE_INTERRUPT_DEST__SHIFT                                       0x0
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX1_LS_DONE_INTERRUPT_DEST__SHIFT                                       0x1
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX2_SW_DONE_INTERRUPT_DEST__SHIFT                                       0x2
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX2_LS_DONE_INTERRUPT_DEST__SHIFT                                       0x3
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX3_SW_DONE_INTERRUPT_DEST__SHIFT                                       0x4
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX3_LS_DONE_INTERRUPT_DEST__SHIFT                                       0x5
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX4_SW_DONE_INTERRUPT_DEST__SHIFT                                       0x6
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX4_LS_DONE_INTERRUPT_DEST__SHIFT                                       0x7
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX1_SW_DONE_INTERRUPT_DEST_MASK                                         0x00000001L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX1_LS_DONE_INTERRUPT_DEST_MASK                                         0x00000002L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX2_SW_DONE_INTERRUPT_DEST_MASK                                         0x00000004L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX2_LS_DONE_INTERRUPT_DEST_MASK                                         0x00000008L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX3_SW_DONE_INTERRUPT_DEST_MASK                                         0x00000010L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX3_LS_DONE_INTERRUPT_DEST_MASK                                         0x00000020L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX4_SW_DONE_INTERRUPT_DEST_MASK                                         0x00000040L
+#define AUX_INTERRUPT_DEST__DOUT_IHC_AUX4_LS_DONE_INTERRUPT_DEST_MASK                                         0x00000080L
+//DSC_INTERRUPT_DEST
+#define DSC_INTERRUPT_DEST__DSC0_IHC_CORE_ERROR_INTERRUPT_DEST__SHIFT                                         0x1
+#define DSC_INTERRUPT_DEST__DSC1_IHC_CORE_ERROR_INTERRUPT_DEST__SHIFT                                         0x5
+#define DSC_INTERRUPT_DEST__DSC2_IHC_CORE_ERROR_INTERRUPT_DEST__SHIFT                                         0x9
+#define DSC_INTERRUPT_DEST__DSC3_IHC_CORE_ERROR_INTERRUPT_DEST__SHIFT                                         0xd
+#define DSC_INTERRUPT_DEST__DSC0_IHC_CORE_ERROR_INTERRUPT_DEST_MASK                                           0x00000002L
+#define DSC_INTERRUPT_DEST__DSC1_IHC_CORE_ERROR_INTERRUPT_DEST_MASK                                           0x00000020L
+#define DSC_INTERRUPT_DEST__DSC2_IHC_CORE_ERROR_INTERRUPT_DEST_MASK                                           0x00000200L
+#define DSC_INTERRUPT_DEST__DSC3_IHC_CORE_ERROR_INTERRUPT_DEST_MASK                                           0x00002000L
+//HPO_INTERRUPT_DEST
+#define HPO_INTERRUPT_DEST__HPO_IHC_PERFMON_COUNTER0_INTERRUPT_DEST__SHIFT                                    0x2
+#define HPO_INTERRUPT_DEST__HPO_IHC_PERFMON_COUNTER1_INTERRUPT_DEST__SHIFT                                    0x3
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE0_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x4
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE1_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x5
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE2_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x6
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE3_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x7
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE4_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x8
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE5_ALPM_WAKE_INTERRUPT_DEST__SHIFT                                       0x9
+#define HPO_INTERRUPT_DEST__HPO_IHC_PERFMON_COUNTER0_INTERRUPT_DEST_MASK                                      0x00000004L
+#define HPO_INTERRUPT_DEST__HPO_IHC_PERFMON_COUNTER1_INTERRUPT_DEST_MASK                                      0x00000008L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE0_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000010L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE1_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000020L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE2_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000040L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE3_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000080L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE4_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000100L
+#define HPO_INTERRUPT_DEST__HPO_IHC_SE5_ALPM_WAKE_INTERRUPT_DEST_MASK                                         0x00000200L
+//DPP_INTERRUPT_DEST
+#define DPP_INTERRUPT_DEST__DPP0_HIST_RDY_IHC_INTERRUPT_DEST__SHIFT                                           0x0
+#define DPP_INTERRUPT_DEST__DPP1_HIST_RDY_IHC_INTERRUPT_DEST__SHIFT                                           0x1
+#define DPP_INTERRUPT_DEST__DPP2_HIST_RDY_IHC_INTERRUPT_DEST__SHIFT                                           0x2
+#define DPP_INTERRUPT_DEST__DPP3_HIST_RDY_IHC_INTERRUPT_DEST__SHIFT                                           0x3
+#define DPP_INTERRUPT_DEST__DPP0_HIST_RDY_IHC_INTERRUPT_DEST_MASK                                             0x00000001L
+#define DPP_INTERRUPT_DEST__DPP1_HIST_RDY_IHC_INTERRUPT_DEST_MASK                                             0x00000002L
+#define DPP_INTERRUPT_DEST__DPP2_HIST_RDY_IHC_INTERRUPT_DEST_MASK                                             0x00000004L
+#define DPP_INTERRUPT_DEST__DPP3_HIST_RDY_IHC_INTERRUPT_DEST_MASK                                             0x00000008L
+
+
+// addressBlock: dce_dc_dmu_dmu_misc_dispdec
+//CC_DC_PIPE_DIS
+#define CC_DC_PIPE_DIS__DC_FULL_DIS__SHIFT                                                                    0xc
+#define CC_DC_PIPE_DIS__DC_FULL_DIS_MASK                                                                      0x00001000L
+//DMU_CLK_CNTL
+#define DMU_CLK_CNTL__DMU_TEST_CLK_SEL__SHIFT                                                                 0x0
+#define DMU_CLK_CNTL__DISPCLK_R_DMU_GATE_DIS__SHIFT                                                           0x4
+#define DMU_CLK_CNTL__DISPCLK_G_RBBMIF_GATE_DIS__SHIFT                                                        0x5
+#define DMU_CLK_CNTL__DISPCLK_R_CLOCK_ON__SHIFT                                                               0x6
+#define DMU_CLK_CNTL__DISPCLK_G_RBBMIF_CLOCK_ON__SHIFT                                                        0x7
+#define DMU_CLK_CNTL__RBBMIF_FGCG_REP_DIS__SHIFT                                                              0xc
+#define DMU_CLK_CNTL__IHC_FGCG_REP_DIS__SHIFT                                                                 0xd
+#define DMU_CLK_CNTL__DMCUB_DMCUBCLK_SRC_SEL__SHIFT                                                           0xe
+#define DMU_CLK_CNTL__DPREFCLK_ALLOW_DS_CLKSTOP__SHIFT                                                        0x10
+#define DMU_CLK_CNTL__DISPCLK_ALLOW_DS_CLKSTOP__SHIFT                                                         0x12
+#define DMU_CLK_CNTL__DPPCLK_ALLOW_DS_CLKSTOP__SHIFT                                                          0x14
+#define DMU_CLK_CNTL__DTBCLK_ALLOW_DS_CLKSTOP__SHIFT                                                          0x16
+#define DMU_CLK_CNTL__DCFCLK_ALLOW_DS_CLKSTOP__SHIFT                                                          0x18
+#define DMU_CLK_CNTL__LONO_FGCG_REP_DIS__SHIFT                                                                0x1c
+#define DMU_CLK_CNTL__LONO_DISPCLK_GATE_DISABLE__SHIFT                                                        0x1d
+#define DMU_CLK_CNTL__LONO_SOCCLK_GATE_DISABLE__SHIFT                                                         0x1e
+#define DMU_CLK_CNTL__LONO_DMCUBCLK_GATE_DISABLE__SHIFT                                                       0x1f
+#define DMU_CLK_CNTL__DMU_TEST_CLK_SEL_MASK                                                                   0x0000000FL
+#define DMU_CLK_CNTL__DISPCLK_R_DMU_GATE_DIS_MASK                                                             0x00000010L
+#define DMU_CLK_CNTL__DISPCLK_G_RBBMIF_GATE_DIS_MASK                                                          0x00000020L
+#define DMU_CLK_CNTL__DISPCLK_R_CLOCK_ON_MASK                                                                 0x00000040L
+#define DMU_CLK_CNTL__DISPCLK_G_RBBMIF_CLOCK_ON_MASK                                                          0x00000080L
+#define DMU_CLK_CNTL__RBBMIF_FGCG_REP_DIS_MASK                                                                0x00001000L
+#define DMU_CLK_CNTL__IHC_FGCG_REP_DIS_MASK                                                                   0x00002000L
+#define DMU_CLK_CNTL__DMCUB_DMCUBCLK_SRC_SEL_MASK                                                             0x0000C000L
+#define DMU_CLK_CNTL__DPREFCLK_ALLOW_DS_CLKSTOP_MASK                                                          0x00030000L
+#define DMU_CLK_CNTL__DISPCLK_ALLOW_DS_CLKSTOP_MASK                                                           0x000C0000L
+#define DMU_CLK_CNTL__DPPCLK_ALLOW_DS_CLKSTOP_MASK                                                            0x00300000L
+#define DMU_CLK_CNTL__DTBCLK_ALLOW_DS_CLKSTOP_MASK                                                            0x00C00000L
+#define DMU_CLK_CNTL__DCFCLK_ALLOW_DS_CLKSTOP_MASK                                                            0x03000000L
+#define DMU_CLK_CNTL__LONO_FGCG_REP_DIS_MASK                                                                  0x10000000L
+#define DMU_CLK_CNTL__LONO_DISPCLK_GATE_DISABLE_MASK                                                          0x20000000L
+#define DMU_CLK_CNTL__LONO_SOCCLK_GATE_DISABLE_MASK                                                           0x40000000L
+#define DMU_CLK_CNTL__LONO_DMCUBCLK_GATE_DISABLE_MASK                                                         0x80000000L
+//DMCUB_SMU_INTERRUPT_CNTL
+#define DMCUB_SMU_INTERRUPT_CNTL__DMCUB_SMU_MSG_INT__SHIFT                                                    0x0
+#define DMCUB_SMU_INTERRUPT_CNTL__DMCUB_SMU_MSG__SHIFT                                                        0x10
+#define DMCUB_SMU_INTERRUPT_CNTL__DMCUB_SMU_MSG_INT_MASK                                                      0x00000001L
+#define DMCUB_SMU_INTERRUPT_CNTL__DMCUB_SMU_MSG_MASK                                                          0xFFFF0000L
+//SMU_INTERRUPT_CONTROL
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_ENABLE__SHIFT                                                       0x0
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_STATUS__SHIFT                                                       0x4
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_EVENT__SHIFT                                                        0x10
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_ENABLE_MASK                                                         0x00000001L
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_STATUS_MASK                                                         0x00000010L
+#define SMU_INTERRUPT_CONTROL__DC_SMU_INT_EVENT_MASK                                                          0xFFFF0000L
+//DMU_MISC_ALLOW_DS_FORCE
+#define DMU_MISC_ALLOW_DS_FORCE__DMU_MISC_ALLOW_DS_FORCE_EN__SHIFT                                            0x0
+#define DMU_MISC_ALLOW_DS_FORCE__DMU_MISC_ALLOW_DS_FORCE_VALUE__SHIFT                                         0x4
+#define DMU_MISC_ALLOW_DS_FORCE__DMU_MISC_ALLOW_DS_FORCE_EN_MASK                                              0x00000001L
+#define DMU_MISC_ALLOW_DS_FORCE__DMU_MISC_ALLOW_DS_FORCE_VALUE_MASK                                           0x00000010L
+//DMU_DISPCLK_CGTT_BLK_CTRL_REG
+#define DMU_DISPCLK_CGTT_BLK_CTRL_REG__LONO_DISPCLK_TURN_ON_DELAY__SHIFT                                      0x0
+#define DMU_DISPCLK_CGTT_BLK_CTRL_REG__LONO_DISPCLK_TURN_OFF_DELAY__SHIFT                                     0x4
+#define DMU_DISPCLK_CGTT_BLK_CTRL_REG__LONO_DISPCLK_TURN_ON_DELAY_MASK                                        0x0000000FL
+#define DMU_DISPCLK_CGTT_BLK_CTRL_REG__LONO_DISPCLK_TURN_OFF_DELAY_MASK                                       0x00000FF0L
+//DMU_SOCCLK_CGTT_BLK_CTRL_REG
+#define DMU_SOCCLK_CGTT_BLK_CTRL_REG__LONO_SOCCLK_TURN_ON_DELAY__SHIFT                                        0x0
+#define DMU_SOCCLK_CGTT_BLK_CTRL_REG__LONO_SOCCLK_TURN_OFF_DELAY__SHIFT                                       0x4
+#define DMU_SOCCLK_CGTT_BLK_CTRL_REG__LONO_SOCCLK_TURN_ON_DELAY_MASK                                          0x0000000FL
+#define DMU_SOCCLK_CGTT_BLK_CTRL_REG__LONO_SOCCLK_TURN_OFF_DELAY_MASK                                         0x00000FF0L
+//DMU_MEM_PWR_REQ_CNTL
+#define DMU_MEM_PWR_REQ_CNTL__MEM_PWR_REQ_DIS__SHIFT                                                          0x0
+#define DMU_MEM_PWR_REQ_CNTL__MEM_PWR_REQ_DIS_MASK                                                            0x00000001L
+
+
+// addressBlock: dce_dc_dmu_dmcub_dispdec
+//DMCUB_REGION0_OFFSET
+#define DMCUB_REGION0_OFFSET__DMCUB_REGION0_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION0_OFFSET__DMCUB_REGION0_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION0_OFFSET_HIGH
+#define DMCUB_REGION0_OFFSET_HIGH__DMCUB_REGION0_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION0_OFFSET_HIGH__DMCUB_REGION0_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION1_OFFSET
+#define DMCUB_REGION1_OFFSET__DMCUB_REGION1_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION1_OFFSET__DMCUB_REGION1_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION1_OFFSET_HIGH
+#define DMCUB_REGION1_OFFSET_HIGH__DMCUB_REGION1_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION1_OFFSET_HIGH__DMCUB_REGION1_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION2_OFFSET
+#define DMCUB_REGION2_OFFSET__DMCUB_REGION2_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION2_OFFSET__DMCUB_REGION2_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION2_OFFSET_HIGH
+#define DMCUB_REGION2_OFFSET_HIGH__DMCUB_REGION2_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION2_OFFSET_HIGH__DMCUB_REGION2_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION2_ITCM_OFFSET
+#define DMCUB_REGION2_ITCM_OFFSET__DMCUB_REGION2_ITCM_OFFSET__SHIFT                                           0x8
+#define DMCUB_REGION2_ITCM_OFFSET__DMCUB_REGION2_ITCM_OFFSET_MASK                                             0xFFFFFF00L
+//DMCUB_REGION2_ITCM_OFFSET_HIGH
+#define DMCUB_REGION2_ITCM_OFFSET_HIGH__DMCUB_REGION2_ITCM_OFFSET_HIGH__SHIFT                                 0x0
+#define DMCUB_REGION2_ITCM_OFFSET_HIGH__DMCUB_REGION2_ITCM_OFFSET_HIGH_MASK                                   0x0000FFFFL
+//DMCUB_REGION4_OFFSET
+#define DMCUB_REGION4_OFFSET__DMCUB_REGION4_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION4_OFFSET__DMCUB_REGION4_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION4_OFFSET_HIGH
+#define DMCUB_REGION4_OFFSET_HIGH__DMCUB_REGION4_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION4_OFFSET_HIGH__DMCUB_REGION4_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION5_OFFSET
+#define DMCUB_REGION5_OFFSET__DMCUB_REGION5_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION5_OFFSET__DMCUB_REGION5_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION5_OFFSET_HIGH
+#define DMCUB_REGION5_OFFSET_HIGH__DMCUB_REGION5_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION5_OFFSET_HIGH__DMCUB_REGION5_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION6_OFFSET
+#define DMCUB_REGION6_OFFSET__DMCUB_REGION6_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION6_OFFSET__DMCUB_REGION6_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION6_OFFSET_HIGH
+#define DMCUB_REGION6_OFFSET_HIGH__DMCUB_REGION6_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION6_OFFSET_HIGH__DMCUB_REGION6_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION7_OFFSET
+#define DMCUB_REGION7_OFFSET__DMCUB_REGION7_OFFSET__SHIFT                                                     0x8
+#define DMCUB_REGION7_OFFSET__DMCUB_REGION7_OFFSET_MASK                                                       0xFFFFFF00L
+//DMCUB_REGION7_OFFSET_HIGH
+#define DMCUB_REGION7_OFFSET_HIGH__DMCUB_REGION7_OFFSET_HIGH__SHIFT                                           0x0
+#define DMCUB_REGION7_OFFSET_HIGH__DMCUB_REGION7_OFFSET_HIGH_MASK                                             0x0000FFFFL
+//DMCUB_REGION0_TOP_ADDRESS
+#define DMCUB_REGION0_TOP_ADDRESS__DMCUB_REGION0_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION0_TOP_ADDRESS__DMCUB_REGION0_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION0_TOP_ADDRESS__DMCUB_REGION0_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION0_TOP_ADDRESS__DMCUB_REGION0_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION1_TOP_ADDRESS
+#define DMCUB_REGION1_TOP_ADDRESS__DMCUB_REGION1_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION1_TOP_ADDRESS__DMCUB_REGION1_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION1_TOP_ADDRESS__DMCUB_REGION1_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION1_TOP_ADDRESS__DMCUB_REGION1_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION2_TOP_ADDRESS
+#define DMCUB_REGION2_TOP_ADDRESS__DMCUB_REGION2_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION2_TOP_ADDRESS__DMCUB_REGION2_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION2_TOP_ADDRESS__DMCUB_REGION2_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION2_TOP_ADDRESS__DMCUB_REGION2_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION4_TOP_ADDRESS
+#define DMCUB_REGION4_TOP_ADDRESS__DMCUB_REGION4_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION4_TOP_ADDRESS__DMCUB_REGION4_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION4_TOP_ADDRESS__DMCUB_REGION4_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION4_TOP_ADDRESS__DMCUB_REGION4_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION5_TOP_ADDRESS
+#define DMCUB_REGION5_TOP_ADDRESS__DMCUB_REGION5_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION5_TOP_ADDRESS__DMCUB_REGION5_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION5_TOP_ADDRESS__DMCUB_REGION5_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION5_TOP_ADDRESS__DMCUB_REGION5_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION6_TOP_ADDRESS
+#define DMCUB_REGION6_TOP_ADDRESS__DMCUB_REGION6_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION6_TOP_ADDRESS__DMCUB_REGION6_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION6_TOP_ADDRESS__DMCUB_REGION6_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION6_TOP_ADDRESS__DMCUB_REGION6_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION7_TOP_ADDRESS
+#define DMCUB_REGION7_TOP_ADDRESS__DMCUB_REGION7_TOP_ADDRESS__SHIFT                                           0x0
+#define DMCUB_REGION7_TOP_ADDRESS__DMCUB_REGION7_ENABLE__SHIFT                                                0x1f
+#define DMCUB_REGION7_TOP_ADDRESS__DMCUB_REGION7_TOP_ADDRESS_MASK                                             0x1FFFFFFFL
+#define DMCUB_REGION7_TOP_ADDRESS__DMCUB_REGION7_ENABLE_MASK                                                  0x80000000L
+//DMCUB_REGION3_CW0_BASE_ADDRESS
+#define DMCUB_REGION3_CW0_BASE_ADDRESS__DMCUB_REGION3_CW0_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW0_BASE_ADDRESS__DMCUB_REGION3_CW0_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW1_BASE_ADDRESS
+#define DMCUB_REGION3_CW1_BASE_ADDRESS__DMCUB_REGION3_CW1_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW1_BASE_ADDRESS__DMCUB_REGION3_CW1_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW2_BASE_ADDRESS
+#define DMCUB_REGION3_CW2_BASE_ADDRESS__DMCUB_REGION3_CW2_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW2_BASE_ADDRESS__DMCUB_REGION3_CW2_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW3_BASE_ADDRESS
+#define DMCUB_REGION3_CW3_BASE_ADDRESS__DMCUB_REGION3_CW3_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW3_BASE_ADDRESS__DMCUB_REGION3_CW3_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW4_BASE_ADDRESS
+#define DMCUB_REGION3_CW4_BASE_ADDRESS__DMCUB_REGION3_CW4_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW4_BASE_ADDRESS__DMCUB_REGION3_CW4_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW5_BASE_ADDRESS
+#define DMCUB_REGION3_CW5_BASE_ADDRESS__DMCUB_REGION3_CW5_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW5_BASE_ADDRESS__DMCUB_REGION3_CW5_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW6_BASE_ADDRESS
+#define DMCUB_REGION3_CW6_BASE_ADDRESS__DMCUB_REGION3_CW6_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW6_BASE_ADDRESS__DMCUB_REGION3_CW6_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW7_BASE_ADDRESS
+#define DMCUB_REGION3_CW7_BASE_ADDRESS__DMCUB_REGION3_CW7_BASE_ADDRESS__SHIFT                                 0x0
+#define DMCUB_REGION3_CW7_BASE_ADDRESS__DMCUB_REGION3_CW7_BASE_ADDRESS_MASK                                   0x1FFFFFFFL
+//DMCUB_REGION3_CW0_TOP_ADDRESS
+#define DMCUB_REGION3_CW0_TOP_ADDRESS__DMCUB_REGION3_CW0_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW0_TOP_ADDRESS__DMCUB_REGION3_CW0_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW0_TOP_ADDRESS__DMCUB_REGION3_CW0_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW0_TOP_ADDRESS__DMCUB_REGION3_CW0_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW1_TOP_ADDRESS
+#define DMCUB_REGION3_CW1_TOP_ADDRESS__DMCUB_REGION3_CW1_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW1_TOP_ADDRESS__DMCUB_REGION3_CW1_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW1_TOP_ADDRESS__DMCUB_REGION3_CW1_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW1_TOP_ADDRESS__DMCUB_REGION3_CW1_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW2_TOP_ADDRESS
+#define DMCUB_REGION3_CW2_TOP_ADDRESS__DMCUB_REGION3_CW2_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW2_TOP_ADDRESS__DMCUB_REGION3_CW2_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW2_TOP_ADDRESS__DMCUB_REGION3_CW2_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW2_TOP_ADDRESS__DMCUB_REGION3_CW2_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW3_TOP_ADDRESS
+#define DMCUB_REGION3_CW3_TOP_ADDRESS__DMCUB_REGION3_CW3_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW3_TOP_ADDRESS__DMCUB_REGION3_CW3_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW3_TOP_ADDRESS__DMCUB_REGION3_CW3_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW3_TOP_ADDRESS__DMCUB_REGION3_CW3_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW4_TOP_ADDRESS
+#define DMCUB_REGION3_CW4_TOP_ADDRESS__DMCUB_REGION3_CW4_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW4_TOP_ADDRESS__DMCUB_REGION3_CW4_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW4_TOP_ADDRESS__DMCUB_REGION3_CW4_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW4_TOP_ADDRESS__DMCUB_REGION3_CW4_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW5_TOP_ADDRESS
+#define DMCUB_REGION3_CW5_TOP_ADDRESS__DMCUB_REGION3_CW5_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW5_TOP_ADDRESS__DMCUB_REGION3_CW5_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW5_TOP_ADDRESS__DMCUB_REGION3_CW5_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW5_TOP_ADDRESS__DMCUB_REGION3_CW5_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW6_TOP_ADDRESS
+#define DMCUB_REGION3_CW6_TOP_ADDRESS__DMCUB_REGION3_CW6_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW6_TOP_ADDRESS__DMCUB_REGION3_CW6_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW6_TOP_ADDRESS__DMCUB_REGION3_CW6_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW6_TOP_ADDRESS__DMCUB_REGION3_CW6_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW7_TOP_ADDRESS
+#define DMCUB_REGION3_CW7_TOP_ADDRESS__DMCUB_REGION3_CW7_TOP_ADDRESS__SHIFT                                   0x0
+#define DMCUB_REGION3_CW7_TOP_ADDRESS__DMCUB_REGION3_CW7_ENABLE__SHIFT                                        0x1f
+#define DMCUB_REGION3_CW7_TOP_ADDRESS__DMCUB_REGION3_CW7_TOP_ADDRESS_MASK                                     0x1FFFFFFFL
+#define DMCUB_REGION3_CW7_TOP_ADDRESS__DMCUB_REGION3_CW7_ENABLE_MASK                                          0x80000000L
+//DMCUB_REGION3_CW0_OFFSET
+#define DMCUB_REGION3_CW0_OFFSET__DMCUB_REGION3_CW0_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW0_OFFSET__DMCUB_REGION3_CW0_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW0_OFFSET_HIGH
+#define DMCUB_REGION3_CW0_OFFSET_HIGH__DMCUB_REGION3_CW0_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW0_OFFSET_HIGH__DMCUB_REGION3_CW0_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW1_OFFSET
+#define DMCUB_REGION3_CW1_OFFSET__DMCUB_REGION3_CW1_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW1_OFFSET__DMCUB_REGION3_CW1_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW1_OFFSET_HIGH
+#define DMCUB_REGION3_CW1_OFFSET_HIGH__DMCUB_REGION3_CW1_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW1_OFFSET_HIGH__DMCUB_REGION3_CW1_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW2_OFFSET
+#define DMCUB_REGION3_CW2_OFFSET__DMCUB_REGION3_CW2_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW2_OFFSET__DMCUB_REGION3_CW2_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW2_OFFSET_HIGH
+#define DMCUB_REGION3_CW2_OFFSET_HIGH__DMCUB_REGION3_CW2_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW2_OFFSET_HIGH__DMCUB_REGION3_CW2_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW3_OFFSET
+#define DMCUB_REGION3_CW3_OFFSET__DMCUB_REGION3_CW3_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW3_OFFSET__DMCUB_REGION3_CW3_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW3_OFFSET_HIGH
+#define DMCUB_REGION3_CW3_OFFSET_HIGH__DMCUB_REGION3_CW3_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW3_OFFSET_HIGH__DMCUB_REGION3_CW3_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW4_OFFSET
+#define DMCUB_REGION3_CW4_OFFSET__DMCUB_REGION3_CW4_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW4_OFFSET__DMCUB_REGION3_CW4_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW4_OFFSET_HIGH
+#define DMCUB_REGION3_CW4_OFFSET_HIGH__DMCUB_REGION3_CW4_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW4_OFFSET_HIGH__DMCUB_REGION3_CW4_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW5_OFFSET
+#define DMCUB_REGION3_CW5_OFFSET__DMCUB_REGION3_CW5_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW5_OFFSET__DMCUB_REGION3_CW5_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW5_OFFSET_HIGH
+#define DMCUB_REGION3_CW5_OFFSET_HIGH__DMCUB_REGION3_CW5_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW5_OFFSET_HIGH__DMCUB_REGION3_CW5_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW6_OFFSET
+#define DMCUB_REGION3_CW6_OFFSET__DMCUB_REGION3_CW6_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW6_OFFSET__DMCUB_REGION3_CW6_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW6_OFFSET_HIGH
+#define DMCUB_REGION3_CW6_OFFSET_HIGH__DMCUB_REGION3_CW6_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW6_OFFSET_HIGH__DMCUB_REGION3_CW6_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_REGION3_CW7_OFFSET
+#define DMCUB_REGION3_CW7_OFFSET__DMCUB_REGION3_CW7_OFFSET__SHIFT                                             0x8
+#define DMCUB_REGION3_CW7_OFFSET__DMCUB_REGION3_CW7_OFFSET_MASK                                               0xFFFFFF00L
+//DMCUB_REGION3_CW7_OFFSET_HIGH
+#define DMCUB_REGION3_CW7_OFFSET_HIGH__DMCUB_REGION3_CW7_OFFSET_HIGH__SHIFT                                   0x0
+#define DMCUB_REGION3_CW7_OFFSET_HIGH__DMCUB_REGION3_CW7_OFFSET_HIGH_MASK                                     0x0000FFFFL
+//DMCUB_INTERRUPT_ENABLE
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_TIMER0_INT_EN__SHIFT                                                    0x0
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_TIMER1_INT_EN__SHIFT                                                    0x1
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX0_READY_INT_EN__SHIFT                                              0x2
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX0_DONE_INT_EN__SHIFT                                               0x3
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX1_READY_INT_EN__SHIFT                                              0x4
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX1_DONE_INT_EN__SHIFT                                               0x5
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX0_READY_INT_EN__SHIFT                                             0x6
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX0_DONE_INT_EN__SHIFT                                              0x7
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX1_READY_INT_EN__SHIFT                                             0x8
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX1_DONE_INT_EN__SHIFT                                              0x9
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT0_INT_EN__SHIFT                                                    0xa
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT1_INT_EN__SHIFT                                                    0xb
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT2_INT_EN__SHIFT                                                    0xc
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT3_INT_EN__SHIFT                                                    0xd
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT4_INT_EN__SHIFT                                                    0xe
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT_IH_INT_EN__SHIFT                                                  0x11
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_UNDEFINED_ADDRESS_FAULT_INT_EN__SHIFT                                   0x12
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX0_RDY_INT_EN__SHIFT                                            0x13
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX2_RDY_INT_EN__SHIFT                                            0x15
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX3_RDY_INT_EN__SHIFT                                            0x16
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX4_RDY_INT_EN__SHIFT                                            0x17
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_OUTBOX0_RSP_INT_EN__SHIFT                                           0x18
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_TIMER0_INT_EN_MASK                                                      0x00000001L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_TIMER1_INT_EN_MASK                                                      0x00000002L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX0_READY_INT_EN_MASK                                                0x00000004L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX0_DONE_INT_EN_MASK                                                 0x00000008L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX1_READY_INT_EN_MASK                                                0x00000010L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_INBOX1_DONE_INT_EN_MASK                                                 0x00000020L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX0_READY_INT_EN_MASK                                               0x00000040L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX0_DONE_INT_EN_MASK                                                0x00000080L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX1_READY_INT_EN_MASK                                               0x00000100L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_OUTBOX1_DONE_INT_EN_MASK                                                0x00000200L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT0_INT_EN_MASK                                                      0x00000400L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT1_INT_EN_MASK                                                      0x00000800L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT2_INT_EN_MASK                                                      0x00001000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT3_INT_EN_MASK                                                      0x00002000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT4_INT_EN_MASK                                                      0x00004000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_GPINT_IH_INT_EN_MASK                                                    0x00020000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_UNDEFINED_ADDRESS_FAULT_INT_EN_MASK                                     0x00040000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX0_RDY_INT_EN_MASK                                              0x00080000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX2_RDY_INT_EN_MASK                                              0x00200000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX3_RDY_INT_EN_MASK                                              0x00400000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_INBOX4_RDY_INT_EN_MASK                                              0x00800000L
+#define DMCUB_INTERRUPT_ENABLE__DMCUB_REG_OUTBOX0_RSP_INT_EN_MASK                                             0x01000000L
+//DMCUB_INTERRUPT_ACK
+#define DMCUB_INTERRUPT_ACK__DMCUB_TIMER0_INT_ACK__SHIFT                                                      0x0
+#define DMCUB_INTERRUPT_ACK__DMCUB_TIMER1_INT_ACK__SHIFT                                                      0x1
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX0_READY_INT_ACK__SHIFT                                                0x2
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX0_DONE_INT_ACK__SHIFT                                                 0x3
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX1_READY_INT_ACK__SHIFT                                                0x4
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX1_DONE_INT_ACK__SHIFT                                                 0x5
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX0_READY_INT_ACK__SHIFT                                               0x6
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX0_DONE_INT_ACK__SHIFT                                                0x7
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX1_READY_INT_ACK__SHIFT                                               0x8
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX1_DONE_INT_ACK__SHIFT                                                0x9
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT0_INT_ACK__SHIFT                                                      0xa
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT1_INT_ACK__SHIFT                                                      0xb
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT2_INT_ACK__SHIFT                                                      0xc
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT3_INT_ACK__SHIFT                                                      0xd
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT4_INT_ACK__SHIFT                                                      0xe
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT_IH_INT_ACK__SHIFT                                                    0x11
+#define DMCUB_INTERRUPT_ACK__DMCUB_UNDEFINED_ADDRESS_FAULT_ACK__SHIFT                                         0x12
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX0_RDY_INT_ACK__SHIFT                                              0x13
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX2_RDY_INT_ACK__SHIFT                                              0x15
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX3_RDY_INT_ACK__SHIFT                                              0x16
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX4_RDY_INT_ACK__SHIFT                                              0x17
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_OUTBOX0_RSP_INT_ACK__SHIFT                                             0x18
+#define DMCUB_INTERRUPT_ACK__DMCUB_TIMER0_INT_ACK_MASK                                                        0x00000001L
+#define DMCUB_INTERRUPT_ACK__DMCUB_TIMER1_INT_ACK_MASK                                                        0x00000002L
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX0_READY_INT_ACK_MASK                                                  0x00000004L
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX0_DONE_INT_ACK_MASK                                                   0x00000008L
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX1_READY_INT_ACK_MASK                                                  0x00000010L
+#define DMCUB_INTERRUPT_ACK__DMCUB_INBOX1_DONE_INT_ACK_MASK                                                   0x00000020L
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX0_READY_INT_ACK_MASK                                                 0x00000040L
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX0_DONE_INT_ACK_MASK                                                  0x00000080L
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX1_READY_INT_ACK_MASK                                                 0x00000100L
+#define DMCUB_INTERRUPT_ACK__DMCUB_OUTBOX1_DONE_INT_ACK_MASK                                                  0x00000200L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT0_INT_ACK_MASK                                                        0x00000400L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT1_INT_ACK_MASK                                                        0x00000800L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT2_INT_ACK_MASK                                                        0x00001000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT3_INT_ACK_MASK                                                        0x00002000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT4_INT_ACK_MASK                                                        0x00004000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_GPINT_IH_INT_ACK_MASK                                                      0x00020000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_UNDEFINED_ADDRESS_FAULT_ACK_MASK                                           0x00040000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX0_RDY_INT_ACK_MASK                                                0x00080000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX2_RDY_INT_ACK_MASK                                                0x00200000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX3_RDY_INT_ACK_MASK                                                0x00400000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_INBOX4_RDY_INT_ACK_MASK                                                0x00800000L
+#define DMCUB_INTERRUPT_ACK__DMCUB_REG_OUTBOX0_RSP_INT_ACK_MASK                                               0x01000000L
+//DMCUB_INTERRUPT_STATUS
+#define DMCUB_INTERRUPT_STATUS__DMCUB_TIMER0_INT_STAT__SHIFT                                                  0x0
+#define DMCUB_INTERRUPT_STATUS__DMCUB_TIMER1_INT_STAT__SHIFT                                                  0x1
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX0_READY_INT_STAT__SHIFT                                            0x2
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX0_DONE_INT_STAT__SHIFT                                             0x3
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX1_READY_INT_STAT__SHIFT                                            0x4
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX1_DONE_INT_STAT__SHIFT                                             0x5
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX0_READY_INT_STAT__SHIFT                                           0x6
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX0_DONE_INT_STAT__SHIFT                                            0x7
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX1_READY_INT_STAT__SHIFT                                           0x8
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX1_DONE_INT_STAT__SHIFT                                            0x9
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT0_INT_STAT__SHIFT                                                  0xa
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT1_INT_STAT__SHIFT                                                  0xb
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT2_INT_STAT__SHIFT                                                  0xc
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT3_INT_STAT__SHIFT                                                  0xd
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT4_INT_STAT__SHIFT                                                  0xe
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT_IH_INT_STAT__SHIFT                                                0x11
+#define DMCUB_INTERRUPT_STATUS__DMCUB_UNDEFINED_ADDRESS_FAULT__SHIFT                                          0x12
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INST_FETCH_FAULT__SHIFT                                                 0x13
+#define DMCUB_INTERRUPT_STATUS__DMCUB_DATA_WRITE_FAULT__SHIFT                                                 0x14
+#define DMCUB_INTERRUPT_STATUS__DMCUB_PWR_UP_TRIG_INT_STAT__SHIFT                                             0x15
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OTG_RESYNC_TRIG_INT_STAT__SHIFT                                         0x16
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX0_RDY_INT_STAT__SHIFT                                          0x17
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX2_RDY_INT_STAT__SHIFT                                          0x19
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX3_RDY_INT_STAT__SHIFT                                          0x1a
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX4_RDY_INT_STAT__SHIFT                                          0x1b
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_OUTBOX0_RSP_INT_STAT__SHIFT                                         0x1c
+#define DMCUB_INTERRUPT_STATUS__DMCUB_TIMER0_INT_STAT_MASK                                                    0x00000001L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_TIMER1_INT_STAT_MASK                                                    0x00000002L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX0_READY_INT_STAT_MASK                                              0x00000004L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX0_DONE_INT_STAT_MASK                                               0x00000008L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX1_READY_INT_STAT_MASK                                              0x00000010L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INBOX1_DONE_INT_STAT_MASK                                               0x00000020L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX0_READY_INT_STAT_MASK                                             0x00000040L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX0_DONE_INT_STAT_MASK                                              0x00000080L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX1_READY_INT_STAT_MASK                                             0x00000100L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OUTBOX1_DONE_INT_STAT_MASK                                              0x00000200L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT0_INT_STAT_MASK                                                    0x00000400L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT1_INT_STAT_MASK                                                    0x00000800L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT2_INT_STAT_MASK                                                    0x00001000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT3_INT_STAT_MASK                                                    0x00002000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT4_INT_STAT_MASK                                                    0x00004000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_GPINT_IH_INT_STAT_MASK                                                  0x00020000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_UNDEFINED_ADDRESS_FAULT_MASK                                            0x00040000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_INST_FETCH_FAULT_MASK                                                   0x00080000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_DATA_WRITE_FAULT_MASK                                                   0x00100000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_PWR_UP_TRIG_INT_STAT_MASK                                               0x00200000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_OTG_RESYNC_TRIG_INT_STAT_MASK                                           0x00400000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX0_RDY_INT_STAT_MASK                                            0x00800000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX2_RDY_INT_STAT_MASK                                            0x02000000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX3_RDY_INT_STAT_MASK                                            0x04000000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_INBOX4_RDY_INT_STAT_MASK                                            0x08000000L
+#define DMCUB_INTERRUPT_STATUS__DMCUB_REG_OUTBOX0_RSP_INT_STAT_MASK                                           0x10000000L
+//DMCUB_INTERRUPT_TYPE
+#define DMCUB_INTERRUPT_TYPE__DMCUB_TIMER0_INT_TYPE__SHIFT                                                    0x0
+#define DMCUB_INTERRUPT_TYPE__DMCUB_TIMER1_INT_TYPE__SHIFT                                                    0x1
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX0_READY_INT_TYPE__SHIFT                                              0x2
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX0_DONE_INT_TYPE__SHIFT                                               0x3
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX1_READY_INT_TYPE__SHIFT                                              0x4
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX1_DONE_INT_TYPE__SHIFT                                               0x5
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX0_READY_INT_TYPE__SHIFT                                             0x6
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX0_DONE_INT_TYPE__SHIFT                                              0x7
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX1_READY_INT_TYPE__SHIFT                                             0x8
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX1_DONE_INT_TYPE__SHIFT                                              0x9
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT0_INT_TYPE__SHIFT                                                    0xa
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT1_INT_TYPE__SHIFT                                                    0xb
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT2_INT_TYPE__SHIFT                                                    0xc
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT3_INT_TYPE__SHIFT                                                    0xd
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT4_INT_TYPE__SHIFT                                                    0xe
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT_IH_INT_TYPE__SHIFT                                                  0x11
+#define DMCUB_INTERRUPT_TYPE__DMCUB_UNDEFINED_ADDRESS_FAULT_INT_TYPE__SHIFT                                   0x12
+#define DMCUB_INTERRUPT_TYPE__DMCUB_TIMER0_INT_TYPE_MASK                                                      0x00000001L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_TIMER1_INT_TYPE_MASK                                                      0x00000002L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX0_READY_INT_TYPE_MASK                                                0x00000004L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX0_DONE_INT_TYPE_MASK                                                 0x00000008L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX1_READY_INT_TYPE_MASK                                                0x00000010L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_INBOX1_DONE_INT_TYPE_MASK                                                 0x00000020L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX0_READY_INT_TYPE_MASK                                               0x00000040L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX0_DONE_INT_TYPE_MASK                                                0x00000080L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX1_READY_INT_TYPE_MASK                                               0x00000100L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_OUTBOX1_DONE_INT_TYPE_MASK                                                0x00000200L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT0_INT_TYPE_MASK                                                      0x00000400L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT1_INT_TYPE_MASK                                                      0x00000800L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT2_INT_TYPE_MASK                                                      0x00001000L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT3_INT_TYPE_MASK                                                      0x00002000L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT4_INT_TYPE_MASK                                                      0x00004000L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_GPINT_IH_INT_TYPE_MASK                                                    0x00020000L
+#define DMCUB_INTERRUPT_TYPE__DMCUB_UNDEFINED_ADDRESS_FAULT_INT_TYPE_MASK                                     0x00040000L
+//DMCUB_EXT_INTERRUPT_STATUS
+#define DMCUB_EXT_INTERRUPT_STATUS__DMCUB_EXT_INTERRUPT_COUNT__SHIFT                                          0x0
+#define DMCUB_EXT_INTERRUPT_STATUS__DMCUB_EXT_INTERRUPT_ID__SHIFT                                             0x8
+#define DMCUB_EXT_INTERRUPT_STATUS__DMCUB_EXT_INTERRUPT_COUNT_MASK                                            0x000000FFL
+#define DMCUB_EXT_INTERRUPT_STATUS__DMCUB_EXT_INTERRUPT_ID_MASK                                               0x0000FF00L
+//DMCUB_EXT_INTERRUPT_CTXID
+#define DMCUB_EXT_INTERRUPT_CTXID__DMCUB_EXT_INTERRUPT_CTXID__SHIFT                                           0x0
+#define DMCUB_EXT_INTERRUPT_CTXID__DMCUB_EXT_INTERRUPT_CTXID_MASK                                             0x0FFFFFFFL
+//DMCUB_EXT_INTERRUPT_ACK
+#define DMCUB_EXT_INTERRUPT_ACK__DMCUB_EXT_INTERRUPT_ACK__SHIFT                                               0x0
+#define DMCUB_EXT_INTERRUPT_ACK__DMCUB_EXT_INTERRUPT_ACK_MASK                                                 0x00000001L
+//DMCUB_INST_FETCH_FAULT_ADDR
+#define DMCUB_INST_FETCH_FAULT_ADDR__DMCUB_INST_FETCH_FAULT_ADDR__SHIFT                                       0x0
+#define DMCUB_INST_FETCH_FAULT_ADDR__DMCUB_INST_FETCH_FAULT_ADDR_MASK                                         0xFFFFFFFFL
+//DMCUB_DATA_WRITE_FAULT_ADDR
+#define DMCUB_DATA_WRITE_FAULT_ADDR__DMCUB_DATA_WRITE_FAULT_ADDR__SHIFT                                       0x0
+#define DMCUB_DATA_WRITE_FAULT_ADDR__DMCUB_DATA_WRITE_FAULT_ADDR_MASK                                         0xFFFFFFFFL
+//DMCUB_SEC_CNTL
+#define DMCUB_SEC_CNTL__DMCUB_MEM_SEC_LVL__SHIFT                                                              0x0
+#define DMCUB_SEC_CNTL__DMCUB_MEM_UNIT_ID__SHIFT                                                              0x8
+#define DMCUB_SEC_CNTL__DMCUB_SEC_RESET__SHIFT                                                                0x10
+#define DMCUB_SEC_CNTL__DMCUB_DATA_FAULT_INT_DISABLE__SHIFT                                                   0x11
+#define DMCUB_SEC_CNTL__DMCUB_AUTO_RESET_STATUS__SHIFT                                                        0x14
+#define DMCUB_SEC_CNTL__DMCUB_SEC_RESET_STATUS__SHIFT                                                         0x15
+#define DMCUB_SEC_CNTL__DMCUB_INST_FETCH_FAULT_CLEAR__SHIFT                                                   0x18
+#define DMCUB_SEC_CNTL__DMCUB_DATA_WRITE_FAULT_CLEAR__SHIFT                                                   0x19
+#define DMCUB_SEC_CNTL__DMCUB_MEM_SEC_LVL_MASK                                                                0x0000000FL
+#define DMCUB_SEC_CNTL__DMCUB_MEM_UNIT_ID_MASK                                                                0x00003F00L
+#define DMCUB_SEC_CNTL__DMCUB_SEC_RESET_MASK                                                                  0x00010000L
+#define DMCUB_SEC_CNTL__DMCUB_DATA_FAULT_INT_DISABLE_MASK                                                     0x00020000L
+#define DMCUB_SEC_CNTL__DMCUB_AUTO_RESET_STATUS_MASK                                                          0x00100000L
+#define DMCUB_SEC_CNTL__DMCUB_SEC_RESET_STATUS_MASK                                                           0x00200000L
+#define DMCUB_SEC_CNTL__DMCUB_INST_FETCH_FAULT_CLEAR_MASK                                                     0x01000000L
+#define DMCUB_SEC_CNTL__DMCUB_DATA_WRITE_FAULT_CLEAR_MASK                                                     0x02000000L
+//DMCUB_MEM_CNTL
+#define DMCUB_MEM_CNTL__DMCUB_MEM_WRITE_QOS__SHIFT                                                            0x0
+#define DMCUB_MEM_CNTL__DMCUB_MEM_READ_QOS__SHIFT                                                             0x4
+#define DMCUB_MEM_CNTL__DMCUB_MEM_OUTSTANDING_REQ__SHIFT                                                      0x8
+#define DMCUB_MEM_CNTL__DMCUB_MEM_WRITE_QOS_MASK                                                              0x0000000FL
+#define DMCUB_MEM_CNTL__DMCUB_MEM_READ_QOS_MASK                                                               0x000000F0L
+#define DMCUB_MEM_CNTL__DMCUB_MEM_OUTSTANDING_REQ_MASK                                                        0x00000100L
+//DMCUB_INBOX0_BASE_ADDRESS
+#define DMCUB_INBOX0_BASE_ADDRESS__DMCUB_INBOX0_BASE_ADDRESS__SHIFT                                           0x0
+#define DMCUB_INBOX0_BASE_ADDRESS__DMCUB_INBOX0_BASE_ADDRESS_MASK                                             0xFFFFFFFFL
+//DMCUB_INBOX0_SIZE
+#define DMCUB_INBOX0_SIZE__DMCUB_INBOX0_SIZE__SHIFT                                                           0x0
+#define DMCUB_INBOX0_SIZE__DMCUB_INBOX0_SIZE_MASK                                                             0xFFFFFFFFL
+//DMCUB_INBOX0_WPTR
+#define DMCUB_INBOX0_WPTR__DMCUB_INBOX0_WPTR__SHIFT                                                           0x0
+#define DMCUB_INBOX0_WPTR__DMCUB_INBOX0_WPTR_MASK                                                             0xFFFFFFFFL
+//DMCUB_INBOX0_RPTR
+#define DMCUB_INBOX0_RPTR__DMCUB_INBOX0_RPTR__SHIFT                                                           0x0
+#define DMCUB_INBOX0_RPTR__DMCUB_INBOX0_RPTR_MASK                                                             0xFFFFFFFFL
+//DMCUB_INBOX1_BASE_ADDRESS
+#define DMCUB_INBOX1_BASE_ADDRESS__DMCUB_INBOX1_BASE_ADDRESS__SHIFT                                           0x0
+#define DMCUB_INBOX1_BASE_ADDRESS__DMCUB_INBOX1_BASE_ADDRESS_MASK                                             0xFFFFFFFFL
+//DMCUB_INBOX1_SIZE
+#define DMCUB_INBOX1_SIZE__DMCUB_INBOX1_SIZE__SHIFT                                                           0x0
+#define DMCUB_INBOX1_SIZE__DMCUB_INBOX1_SIZE_MASK                                                             0xFFFFFFFFL
+//DMCUB_INBOX1_WPTR
+#define DMCUB_INBOX1_WPTR__DMCUB_INBOX1_WPTR__SHIFT                                                           0x0
+#define DMCUB_INBOX1_WPTR__DMCUB_INBOX1_WPTR_MASK                                                             0xFFFFFFFFL
+//DMCUB_INBOX1_RPTR
+#define DMCUB_INBOX1_RPTR__DMCUB_INBOX1_RPTR__SHIFT                                                           0x0
+#define DMCUB_INBOX1_RPTR__DMCUB_INBOX1_RPTR_MASK                                                             0xFFFFFFFFL
+//DMCUB_OUTBOX0_BASE_ADDRESS
+#define DMCUB_OUTBOX0_BASE_ADDRESS__DMCUB_OUTBOX0_BASE_ADDRESS__SHIFT                                         0x0
+#define DMCUB_OUTBOX0_BASE_ADDRESS__DMCUB_OUTBOX0_BASE_ADDRESS_MASK                                           0xFFFFFFFFL
+//DMCUB_OUTBOX0_SIZE
+#define DMCUB_OUTBOX0_SIZE__DMCUB_OUTBOX0_SIZE__SHIFT                                                         0x0
+#define DMCUB_OUTBOX0_SIZE__DMCUB_OUTBOX0_SIZE_MASK                                                           0xFFFFFFFFL
+//DMCUB_OUTBOX0_WPTR
+#define DMCUB_OUTBOX0_WPTR__DMCUB_OUTBOX0_WPTR__SHIFT                                                         0x0
+#define DMCUB_OUTBOX0_WPTR__DMCUB_OUTBOX0_WPTR_MASK                                                           0xFFFFFFFFL
+//DMCUB_OUTBOX0_RPTR
+#define DMCUB_OUTBOX0_RPTR__DMCUB_OUTBOX0_RPTR__SHIFT                                                         0x0
+#define DMCUB_OUTBOX0_RPTR__DMCUB_OUTBOX0_RPTR_MASK                                                           0xFFFFFFFFL
+//DMCUB_OUTBOX1_BASE_ADDRESS
+#define DMCUB_OUTBOX1_BASE_ADDRESS__DMCUB_OUTBOX1_BASE_ADDRESS__SHIFT                                         0x0
+#define DMCUB_OUTBOX1_BASE_ADDRESS__DMCUB_OUTBOX1_BASE_ADDRESS_MASK                                           0xFFFFFFFFL
+//DMCUB_OUTBOX1_SIZE
+#define DMCUB_OUTBOX1_SIZE__DMCUB_OUTBOX1_SIZE__SHIFT                                                         0x0
+#define DMCUB_OUTBOX1_SIZE__DMCUB_OUTBOX1_SIZE_MASK                                                           0xFFFFFFFFL
+//DMCUB_OUTBOX1_WPTR
+#define DMCUB_OUTBOX1_WPTR__DMCUB_OUTBOX1_WPTR__SHIFT                                                         0x0
+#define DMCUB_OUTBOX1_WPTR__DMCUB_OUTBOX1_WPTR_MASK                                                           0xFFFFFFFFL
+//DMCUB_OUTBOX1_RPTR
+#define DMCUB_OUTBOX1_RPTR__DMCUB_OUTBOX1_RPTR__SHIFT                                                         0x0
+#define DMCUB_OUTBOX1_RPTR__DMCUB_OUTBOX1_RPTR_MASK                                                           0xFFFFFFFFL
+//DMCUB_TIMER_TRIGGER0
+#define DMCUB_TIMER_TRIGGER0__DMCUB_TIMER_TRIGGER0__SHIFT                                                     0x0
+#define DMCUB_TIMER_TRIGGER0__DMCUB_TIMER_TRIGGER0_MASK                                                       0xFFFFFFFFL
+//DMCUB_TIMER_TRIGGER1
+#define DMCUB_TIMER_TRIGGER1__DMCUB_TIMER_TRIGGER1__SHIFT                                                     0x0
+#define DMCUB_TIMER_TRIGGER1__DMCUB_TIMER_TRIGGER1_MASK                                                       0xFFFFFFFFL
+//DMCUB_TIMER_WINDOW
+#define DMCUB_TIMER_WINDOW__DMCUB_TIMER_WINDOW__SHIFT                                                         0x0
+#define DMCUB_TIMER_WINDOW__DMCUB_TIMER_WINDOW_MASK                                                           0x00000007L
+//DMCUB_SCRATCH0
+#define DMCUB_SCRATCH0__DMCUB_SCRATCH0__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH0__DMCUB_SCRATCH0_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH1
+#define DMCUB_SCRATCH1__DMCUB_SCRATCH1__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH1__DMCUB_SCRATCH1_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH2
+#define DMCUB_SCRATCH2__DMCUB_SCRATCH2__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH2__DMCUB_SCRATCH2_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH3
+#define DMCUB_SCRATCH3__DMCUB_SCRATCH3__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH3__DMCUB_SCRATCH3_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH4
+#define DMCUB_SCRATCH4__DMCUB_SCRATCH4__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH4__DMCUB_SCRATCH4_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH5
+#define DMCUB_SCRATCH5__DMCUB_SCRATCH5__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH5__DMCUB_SCRATCH5_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH6
+#define DMCUB_SCRATCH6__DMCUB_SCRATCH6__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH6__DMCUB_SCRATCH6_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH7
+#define DMCUB_SCRATCH7__DMCUB_SCRATCH7__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH7__DMCUB_SCRATCH7_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH8
+#define DMCUB_SCRATCH8__DMCUB_SCRATCH8__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH8__DMCUB_SCRATCH8_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH9
+#define DMCUB_SCRATCH9__DMCUB_SCRATCH9__SHIFT                                                                 0x0
+#define DMCUB_SCRATCH9__DMCUB_SCRATCH9_MASK                                                                   0xFFFFFFFFL
+//DMCUB_SCRATCH10
+#define DMCUB_SCRATCH10__DMCUB_SCRATCH10__SHIFT                                                               0x0
+#define DMCUB_SCRATCH10__DMCUB_SCRATCH10_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH11
+#define DMCUB_SCRATCH11__DMCUB_SCRATCH11__SHIFT                                                               0x0
+#define DMCUB_SCRATCH11__DMCUB_SCRATCH11_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH12
+#define DMCUB_SCRATCH12__DMCUB_SCRATCH12__SHIFT                                                               0x0
+#define DMCUB_SCRATCH12__DMCUB_SCRATCH12_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH13
+#define DMCUB_SCRATCH13__DMCUB_SCRATCH13__SHIFT                                                               0x0
+#define DMCUB_SCRATCH13__DMCUB_SCRATCH13_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH14
+#define DMCUB_SCRATCH14__DMCUB_SCRATCH14__SHIFT                                                               0x0
+#define DMCUB_SCRATCH14__DMCUB_SCRATCH14_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH15
+#define DMCUB_SCRATCH15__DMCUB_SCRATCH15__SHIFT                                                               0x0
+#define DMCUB_SCRATCH15__DMCUB_SCRATCH15_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH16
+#define DMCUB_SCRATCH16__DMCUB_SCRATCH16__SHIFT                                                               0x0
+#define DMCUB_SCRATCH16__DMCUB_SCRATCH16_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH17
+#define DMCUB_SCRATCH17__DMCUB_SCRATCH17__SHIFT                                                               0x0
+#define DMCUB_SCRATCH17__DMCUB_SCRATCH17_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH18
+#define DMCUB_SCRATCH18__DMCUB_SCRATCH18__SHIFT                                                               0x0
+#define DMCUB_SCRATCH18__DMCUB_SCRATCH18_MASK                                                                 0xFFFFFFFFL
+//DMCUB_CNTL
+#define DMCUB_CNTL__DMCUB_LS_WAKE_DELAY__SHIFT                                                                0x0
+#define DMCUB_CNTL__DMCUB_DMCUBCLK_R_GATE_DIS__SHIFT                                                          0x8
+#define DMCUB_CNTL__DMCUB_ENABLE__SHIFT                                                                       0x10
+#define DMCUB_CNTL__DMCUB_MEM_LIGHT_SLEEP_DISABLE__SHIFT                                                      0x12
+#define DMCUB_CNTL__DMCUB_TRACEPORT_EN__SHIFT                                                                 0x13
+#define DMCUB_CNTL__DMCUB_PWAIT_MODE_STATUS__SHIFT                                                            0x14
+#define DMCUB_CNTL__DMCUB_LS_WAKE_DELAY_MASK                                                                  0x000000FFL
+#define DMCUB_CNTL__DMCUB_DMCUBCLK_R_GATE_DIS_MASK                                                            0x00000100L
+#define DMCUB_CNTL__DMCUB_ENABLE_MASK                                                                         0x00010000L
+#define DMCUB_CNTL__DMCUB_MEM_LIGHT_SLEEP_DISABLE_MASK                                                        0x00040000L
+#define DMCUB_CNTL__DMCUB_TRACEPORT_EN_MASK                                                                   0x00080000L
+#define DMCUB_CNTL__DMCUB_PWAIT_MODE_STATUS_MASK                                                              0x00100000L
+//DMCUB_GPINT_DATAIN0
+#define DMCUB_GPINT_DATAIN0__DMCUB_GPINT_DATAIN0__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAIN0__DMCUB_GPINT_DATAIN0_MASK                                                         0xFFFFFFFFL
+//DMCUB_GPINT_DATAIN1
+#define DMCUB_GPINT_DATAIN1__DMCUB_GPINT_DATAIN1__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAIN1__DMCUB_GPINT_DATAIN1_MASK                                                         0xFFFFFFFFL
+//DMCUB_GPINT_DATAOUT
+#define DMCUB_GPINT_DATAOUT__DMCUB_GPINT_DATAOUT__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAOUT__DMCUB_GPINT_DATAOUT_MASK                                                         0xFFFFFFFFL
+//DMCUB_UNDEFINED_ADDRESS_FAULT_ADDR
+#define DMCUB_UNDEFINED_ADDRESS_FAULT_ADDR__DMCUB_UNDEFINED_ADDRESS_FAULT_ADDR__SHIFT                         0x0
+#define DMCUB_UNDEFINED_ADDRESS_FAULT_ADDR__DMCUB_UNDEFINED_ADDRESS_FAULT_ADDR_MASK                           0xFFFFFFFFL
+//DMCUB_LS_WAKE_INT_ENABLE
+#define DMCUB_LS_WAKE_INT_ENABLE__DMCUB_LS_WAKE_INT_ENABLE__SHIFT                                             0x0
+#define DMCUB_LS_WAKE_INT_ENABLE__DMCUB_LS_WAKE_INT_ENABLE_MASK                                               0xFFFFFFFFL
+//DMCUB_MEM_PWR_CNTL
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_FORCE__SHIFT                                                        0x1
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_DIS__SHIFT                                                          0x3
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_STATE__SHIFT                                                        0x4
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_FORCE__SHIFT                                                   0x9
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_DIS__SHIFT                                                     0xb
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_STATE__SHIFT                                                   0xc
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_FORCE__SHIFT                                                   0x11
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_DIS__SHIFT                                                     0x13
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_STATE__SHIFT                                                   0x14
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_FORCE_MASK                                                          0x00000006L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_DIS_MASK                                                            0x00000008L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_PWR_STATE_MASK                                                          0x00000030L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_FORCE_MASK                                                     0x00000600L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_DIS_MASK                                                       0x00000800L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_DRAM_PWR_STATE_MASK                                                     0x00003000L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_FORCE_MASK                                                     0x00060000L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_DIS_MASK                                                       0x00080000L
+#define DMCUB_MEM_PWR_CNTL__DMCUB_MEM_IRAM_PWR_STATE_MASK                                                     0x00300000L
+//DMCUB_TIMER_CURRENT
+#define DMCUB_TIMER_CURRENT__DMCUB_TIMER_CURRENT__SHIFT                                                       0x0
+#define DMCUB_TIMER_CURRENT__DMCUB_TIMER_CURRENT_MASK                                                         0xFFFFFFFFL
+//DMCUB_DBG_BUS_SELECT
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DMCUBCLK_SEL__SHIFT                                               0x0
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DMCUBCLK_SEL2__SHIFT                                              0x5
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DISPCLK_SEL__SHIFT                                                0xa
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_SOCCLK_SEL__SHIFT                                                 0xe
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DMCUBCLK_SEL_MASK                                                 0x0000001FL
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DMCUBCLK_SEL2_MASK                                                0x000003E0L
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_DISPCLK_SEL_MASK                                                  0x00001C00L
+#define DMCUB_DBG_BUS_SELECT__DMCUB_DBG_BUS_SOCCLK_SEL_MASK                                                   0x0001C000L
+//DMCUB_PROC_ID
+#define DMCUB_PROC_ID__DMCUB_PROC_ID__SHIFT                                                                   0x0
+#define DMCUB_PROC_ID__DMCUB_PROC_ID_MASK                                                                     0x0000FFFFL
+//DMCUB_CNTL2
+#define DMCUB_CNTL2__DMCUB_SOFT_RESET__SHIFT                                                                  0x0
+#define DMCUB_CNTL2__DMCUB_SOFT_RESET_MASK                                                                    0x00000001L
+//DMCUB_RSMU_WHITELIST_STATUS
+#define DMCUB_RSMU_WHITELIST_STATUS__RSMU_MASTER_INVALID_ACCESS__SHIFT                                        0x0
+#define DMCUB_RSMU_WHITELIST_STATUS__RSMU_MASTER_INVALID_ADDR__SHIFT                                          0x8
+#define DMCUB_RSMU_WHITELIST_STATUS__RSMU_MASTER_INVALID_ACCESS_MASK                                          0x00000001L
+#define DMCUB_RSMU_WHITELIST_STATUS__RSMU_MASTER_INVALID_ADDR_MASK                                            0x1FFFFF00L
+//DMCUB_RSMU_REG_STATUS
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR__SHIFT                                              0x0
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR_TYPE__SHIFT                                         0x1
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR_ADDR__SHIFT                                         0x4
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR_MASK                                                0x00000001L
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR_TYPE_MASK                                           0x00000002L
+#define DMCUB_RSMU_REG_STATUS__RSMU_MASTER_REG_TRAN_ERROR_ADDR_MASK                                           0x01FFFFF0L
+//DMCUB_RSMU_REG_APER_ID
+#define DMCUB_RSMU_REG_APER_ID__RSMU_MASTER_REG_APERTURE_A_ID__SHIFT                                          0x0
+#define DMCUB_RSMU_REG_APER_ID__RSMU_MASTER_REG_APERTURE_B_ID__SHIFT                                          0xc
+#define DMCUB_RSMU_REG_APER_ID__RSMU_MASTER_REG_APERTURE_A_ID_MASK                                            0x00000FFFL
+#define DMCUB_RSMU_REG_APER_ID__RSMU_MASTER_REG_APERTURE_B_ID_MASK                                            0x00FFF000L
+//DMCUB_RSMU_MASTER_A_REG_SEC_FLAG
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST0_SEC_FLAG__SHIFT                            0x0
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST1_SEC_FLAG__SHIFT                            0x4
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST2_SEC_FLAG__SHIFT                            0x8
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST3_SEC_FLAG__SHIFT                            0xc
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_INVALID_SEC_FLAG__SHIFT                               0x18
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST0_SEC_FLAG_MASK                              0x0000000FL
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST1_SEC_FLAG_MASK                              0x000000F0L
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST2_SEC_FLAG_MASK                              0x00000F00L
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_WHITELIST3_SEC_FLAG_MASK                              0x0000F000L
+#define DMCUB_RSMU_MASTER_A_REG_SEC_FLAG__RSMU_MASTER_A_INVALID_SEC_FLAG_MASK                                 0x0F000000L
+//RSMU_MASTER_A_WHITELIST0_BASE
+#define RSMU_MASTER_A_WHITELIST0_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_A_WHITELIST0_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST0_TOP
+#define RSMU_MASTER_A_WHITELIST0_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_A_WHITELIST0_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST1_BASE
+#define RSMU_MASTER_A_WHITELIST1_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_A_WHITELIST1_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST1_TOP
+#define RSMU_MASTER_A_WHITELIST1_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_A_WHITELIST1_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST2_BASE
+#define RSMU_MASTER_A_WHITELIST2_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_A_WHITELIST2_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST2_TOP
+#define RSMU_MASTER_A_WHITELIST2_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_A_WHITELIST2_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST3_BASE
+#define RSMU_MASTER_A_WHITELIST3_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_A_WHITELIST3_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_A_WHITELIST3_TOP
+#define RSMU_MASTER_A_WHITELIST3_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_A_WHITELIST3_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST0_BASE
+#define RSMU_MASTER_B_WHITELIST0_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_B_WHITELIST0_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST0_TOP
+#define RSMU_MASTER_B_WHITELIST0_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_B_WHITELIST0_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST1_BASE
+#define RSMU_MASTER_B_WHITELIST1_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_B_WHITELIST1_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST1_TOP
+#define RSMU_MASTER_B_WHITELIST1_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_B_WHITELIST1_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST2_BASE
+#define RSMU_MASTER_B_WHITELIST2_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_B_WHITELIST2_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST2_TOP
+#define RSMU_MASTER_B_WHITELIST2_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_B_WHITELIST2_TOP__ADDR_MASK                                                               0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST3_BASE
+#define RSMU_MASTER_B_WHITELIST3_BASE__ADDR__SHIFT                                                            0x0
+#define RSMU_MASTER_B_WHITELIST3_BASE__ADDR_MASK                                                              0x000FFFFFL
+//RSMU_MASTER_B_WHITELIST3_TOP
+#define RSMU_MASTER_B_WHITELIST3_TOP__ADDR__SHIFT                                                             0x0
+#define RSMU_MASTER_B_WHITELIST3_TOP__ADDR_MASK                                                               0x000FFFFFL
+//DMCUB_GPINT_DATAIN2
+#define DMCUB_GPINT_DATAIN2__DMCUB_GPINT_DATAIN2__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAIN2__DMCUB_GPINT_DATAIN2_MASK                                                         0xFFFFFFFFL
+//DMCUB_GPINT_DATAIN3
+#define DMCUB_GPINT_DATAIN3__DMCUB_GPINT_DATAIN3__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAIN3__DMCUB_GPINT_DATAIN3_MASK                                                         0xFFFFFFFFL
+//DMCUB_GPINT_DATAIN4
+#define DMCUB_GPINT_DATAIN4__DMCUB_GPINT_DATAIN4__SHIFT                                                       0x0
+#define DMCUB_GPINT_DATAIN4__DMCUB_GPINT_DATAIN4_MASK                                                         0xFFFFFFFFL
+//DMCUB_REGION2_ITCM_SRC_TOP_ADDRESS
+#define DMCUB_REGION2_ITCM_SRC_TOP_ADDRESS__DMCUB_REGION2_ITCM_SRC_TOP_ADDRESS__SHIFT                         0x0
+#define DMCUB_REGION2_ITCM_SRC_TOP_ADDRESS__DMCUB_REGION2_ITCM_SRC_TOP_ADDRESS_MASK                           0xFFFFFFFFL
+//DMCUB_REGION3_TMR_AXI_SPACE
+#define DMCUB_REGION3_TMR_AXI_SPACE__DMCUB_REGION3_TMR_AXI_SPACE__SHIFT                                       0x0
+#define DMCUB_REGION3_TMR_AXI_SPACE__DMCUB_REGION3_TMR_AXI_SPACE_MASK                                         0x07L
+//DMCUB_SCRATCH19
+#define DMCUB_SCRATCH19__DMCUB_SCRATCH19__SHIFT                                                               0x0
+#define DMCUB_SCRATCH19__DMCUB_SCRATCH19_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH20
+#define DMCUB_SCRATCH20__DMCUB_SCRATCH20__SHIFT                                                               0x0
+#define DMCUB_SCRATCH20__DMCUB_SCRATCH20_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH21
+#define DMCUB_SCRATCH21__DMCUB_SCRATCH21__SHIFT                                                               0x0
+#define DMCUB_SCRATCH21__DMCUB_SCRATCH21_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH22
+#define DMCUB_SCRATCH22__DMCUB_SCRATCH22__SHIFT                                                               0x0
+#define DMCUB_SCRATCH22__DMCUB_SCRATCH22_MASK                                                                 0xFFFFFFFFL
+//DMCUB_SCRATCH23
+#define DMCUB_SCRATCH23__DMCUB_SCRATCH23__SHIFT                                                               0x0
+#define DMCUB_SCRATCH23__DMCUB_SCRATCH23_MASK                                                                 0xFFFFFFFFL
+//DMCUB_TEST_DEBUG_INDEX
+#define DMCUB_TEST_DEBUG_INDEX__DMCUB_TEST_DEBUG_INDEX__SHIFT                                                 0x0
+#define DMCUB_TEST_DEBUG_INDEX__DMCUB_TEST_DEBUG_WRITE_EN__SHIFT                                              0x8
+#define DMCUB_TEST_DEBUG_INDEX__DMCUB_TEST_DEBUG_INDEX_MASK                                                   0x000000FFL
+#define DMCUB_TEST_DEBUG_INDEX__DMCUB_TEST_DEBUG_WRITE_EN_MASK                                                0x00000100L
+//DMCUB_TEST_DEBUG_DATA
+#define DMCUB_TEST_DEBUG_DATA__DMCUB_TEST_DEBUG_DATA__SHIFT                                                   0x0
+#define DMCUB_TEST_DEBUG_DATA__DMCUB_TEST_DEBUG_DATA_MASK                                                     0xFFFFFFFFL
+//HOST_INTERRUPT_CSR
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_EN__SHIFT                                                 0x0
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_EN__SHIFT                                                0x1
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_ACK__SHIFT                                                0x8
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_ACK__SHIFT                                               0x9
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_STAT__SHIFT                                               0xc
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_STAT__SHIFT                                              0xd
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_EN_MASK                                                   0x00000001L
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_EN_MASK                                                  0x00000002L
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_ACK_MASK                                                  0x00000100L
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_ACK_MASK                                                 0x00000200L
+#define HOST_INTERRUPT_CSR__HOST_REG_INBOX0_RSP_INT_STAT_MASK                                                 0x00001000L
+#define HOST_INTERRUPT_CSR__HOST_REG_OUTBOX0_RDY_INT_STAT_MASK                                                0x00002000L
+//DMCUB_REG_INBOX0_RDY
+#define DMCUB_REG_INBOX0_RDY__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX0_RDY__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG0
+#define DMCUB_REG_INBOX0_MSG0__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG0__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG1
+#define DMCUB_REG_INBOX0_MSG1__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG1__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG2
+#define DMCUB_REG_INBOX0_MSG2__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG2__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG3
+#define DMCUB_REG_INBOX0_MSG3__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG3__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG4
+#define DMCUB_REG_INBOX0_MSG4__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG4__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG5
+#define DMCUB_REG_INBOX0_MSG5__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG5__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG6
+#define DMCUB_REG_INBOX0_MSG6__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG6__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG7
+#define DMCUB_REG_INBOX0_MSG7__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG7__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG8
+#define DMCUB_REG_INBOX0_MSG8__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG8__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG9
+#define DMCUB_REG_INBOX0_MSG9__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX0_MSG9__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG10
+#define DMCUB_REG_INBOX0_MSG10__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_INBOX0_MSG10__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG11
+#define DMCUB_REG_INBOX0_MSG11__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_INBOX0_MSG11__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG12
+#define DMCUB_REG_INBOX0_MSG12__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_INBOX0_MSG12__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG13
+#define DMCUB_REG_INBOX0_MSG13__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_INBOX0_MSG13__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_INBOX0_MSG14
+#define DMCUB_REG_INBOX0_MSG14__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_INBOX0_MSG14__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_INBOX0_RSP
+#define DMCUB_REG_INBOX0_RSP__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX0_RSP__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_OUTBOX0_RDY
+#define DMCUB_REG_OUTBOX0_RDY__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_OUTBOX0_RDY__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_OUTBOX0_MSG0
+#define DMCUB_REG_OUTBOX0_MSG0__DATA__SHIFT                                                                   0x0
+#define DMCUB_REG_OUTBOX0_MSG0__DATA_MASK                                                                     0xFFFFFFFFL
+//DMCUB_REG_OUTBOX0_RSP
+#define DMCUB_REG_OUTBOX0_RSP__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_OUTBOX0_RSP__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX1_RDY
+#define DMCUB_REG_INBOX1_RDY__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX1_RDY__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX1_MSG0
+#define DMCUB_REG_INBOX1_MSG0__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX1_MSG0__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX1_MSG1
+#define DMCUB_REG_INBOX1_MSG1__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX1_MSG1__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX1_RSP
+#define DMCUB_REG_INBOX1_RSP__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX1_RSP__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX1_INTERRUPT_CSR
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_EN__SHIFT                                    0x0
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_ACK__SHIFT                                   0x1
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_STAT__SHIFT                                  0x2
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_EN_MASK                                      0x00000001L
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_ACK_MASK                                     0x00000002L
+#define DMCUB_REG_INBOX1_INTERRUPT_CSR__DMCUB_REG_INBOX1_RDY_INT_STAT_MASK                                    0x00000004L
+//DMCUB_REG_INBOX2_RDY
+#define DMCUB_REG_INBOX2_RDY__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX2_RDY__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX2_MSG0
+#define DMCUB_REG_INBOX2_MSG0__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX2_MSG0__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX2_MSG1
+#define DMCUB_REG_INBOX2_MSG1__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX2_MSG1__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX2_RSP
+#define DMCUB_REG_INBOX2_RSP__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX2_RSP__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX3_RDY
+#define DMCUB_REG_INBOX3_RDY__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX3_RDY__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX3_MSG0
+#define DMCUB_REG_INBOX3_MSG0__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX3_MSG0__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX3_MSG1
+#define DMCUB_REG_INBOX3_MSG1__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX3_MSG1__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX3_RSP
+#define DMCUB_REG_INBOX3_RSP__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX3_RSP__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX4_RDY
+#define DMCUB_REG_INBOX4_RDY__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX4_RDY__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_REG_INBOX4_MSG0
+#define DMCUB_REG_INBOX4_MSG0__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX4_MSG0__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX4_MSG1
+#define DMCUB_REG_INBOX4_MSG1__DATA__SHIFT                                                                    0x0
+#define DMCUB_REG_INBOX4_MSG1__DATA_MASK                                                                      0xFFFFFFFFL
+//DMCUB_REG_INBOX4_RSP
+#define DMCUB_REG_INBOX4_RSP__DATA__SHIFT                                                                     0x0
+#define DMCUB_REG_INBOX4_RSP__DATA_MASK                                                                       0xFFFFFFFFL
+//DMCUB_RSMU_MASTER_B_REG_SEC_FLAG
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST0_SEC_FLAG__SHIFT                            0x0
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST1_SEC_FLAG__SHIFT                            0x4
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST2_SEC_FLAG__SHIFT                            0x8
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST3_SEC_FLAG__SHIFT                            0xc
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_INVALID_SEC_FLAG__SHIFT                               0x18
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST0_SEC_FLAG_MASK                              0x0000000FL
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST1_SEC_FLAG_MASK                              0x000000F0L
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST2_SEC_FLAG_MASK                              0x00000F00L
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_WHITELIST3_SEC_FLAG_MASK                              0x0000F000L
+#define DMCUB_RSMU_MASTER_B_REG_SEC_FLAG__RSMU_MASTER_B_INVALID_SEC_FLAG_MASK                                 0x0F000000L
+//DMCUB_IDLE_HYSTERESIS_CSR
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_ENABLE__SHIFT                                              0x0
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_STATE__SHIFT                                               0x1
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_THRESHOLD__SHIFT                                           0x10
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_ENABLE_MASK                                                0x00000001L
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_STATE_MASK                                                 0x00000002L
+#define DMCUB_IDLE_HYSTERESIS_CSR__IDLE_HYSTERESIS_THRESHOLD_MASK                                             0xFFFF0000L
+
+
+// addressBlock: dce_dc_mmhubbub_mmhubbub_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON3_PERFCOUNTER_CNTL
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON3_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON3_PERFCOUNTER_CNTL2
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON3_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON3_PERFCOUNTER_STATE
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON3_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON3_PERFMON_CNTL
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON3_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON3_PERFMON_CNTL2
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON3_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON3_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON3_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON3_PERFMON_CVALUE_LOW
+#define DC_PERFMON3_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON3_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON3_PERFMON_HI
+#define DC_PERFMON3_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON3_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON3_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON3_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON3_PERFMON_LOW
+#define DC_PERFMON3_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON3_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON3_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON3_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON3_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mmhubbub_mmhubbub_dispdec
+//MCIF_WB_NB_PSTATE_LATENCY_WATERMARK
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_REFRESH_WATERMARK__SHIFT                        0x0
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_WATERMARK_MASK__SHIFT                           0x18
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_WATERMARK_TYPE__SHIFT                           0x1f
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_REFRESH_WATERMARK_MASK                          0x001FFFFFL
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_WATERMARK_MASK_MASK                             0x07000000L
+#define MCIF_WB_NB_PSTATE_LATENCY_WATERMARK__NB_PSTATE_CHANGE_WATERMARK_TYPE_MASK                             0x80000000L
+//MCIF_WB_WATERMARK
+#define MCIF_WB_WATERMARK__MCIF_WB_CLI_WATERMARK__SHIFT                                                       0x0
+#define MCIF_WB_WATERMARK__MCIF_WB_CLI_WATERMARK_MASK__SHIFT                                                  0x18
+#define MCIF_WB_WATERMARK__MCIF_WB_CLI_WATERMARK_MASK                                                         0x001FFFFFL
+#define MCIF_WB_WATERMARK__MCIF_WB_CLI_WATERMARK_MASK_MASK                                                    0x07000000L
+//MMHUBBUB_WARMUP_CONFIG
+#define MMHUBBUB_WARMUP_CONFIG__MMHUBBUB_WARMUP_QOS__SHIFT                                                    0x10
+#define MMHUBBUB_WARMUP_CONFIG__MMHUBBUB_WARMUP_AWID__SHIFT                                                   0x14
+#define MMHUBBUB_WARMUP_CONFIG__MMHUBBUB_WARMUP_QOS_MASK                                                      0x000F0000L
+#define MMHUBBUB_WARMUP_CONFIG__MMHUBBUB_WARMUP_AWID_MASK                                                     0x00F00000L
+//MMHUBBUB_WARMUP_CONTROL_STATUS
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_EN__SHIFT                                             0x0
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_EN__SHIFT                                      0x4
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_STATUS__SHIFT                                  0x5
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_ACK__SHIFT                                     0x6
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_INC_ADDR__SHIFT                                       0x8
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_EN_MASK                                               0x00000001L
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_EN_MASK                                        0x00000010L
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_STATUS_MASK                                    0x00000020L
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_SW_INT_ACK_MASK                                       0x00000040L
+#define MMHUBBUB_WARMUP_CONTROL_STATUS__MMHUBBUB_WARMUP_INC_ADDR_MASK                                         0x03FFFF00L
+//MMHUBBUB_WARMUP_BASE_ADDR_LOW
+#define MMHUBBUB_WARMUP_BASE_ADDR_LOW__MMHUBBUB_WARMUP_BASE_ADDR_LOW__SHIFT                                   0x0
+#define MMHUBBUB_WARMUP_BASE_ADDR_LOW__MMHUBBUB_WARMUP_BASE_ADDR_LOW_MASK                                     0xFFFFFFFFL
+//MMHUBBUB_WARMUP_BASE_ADDR_HIGH
+#define MMHUBBUB_WARMUP_BASE_ADDR_HIGH__MMHUBBUB_WARMUP_BASE_ADDR_HIGH__SHIFT                                 0x0
+#define MMHUBBUB_WARMUP_BASE_ADDR_HIGH__MMHUBBUB_WARMUP_BASE_ADDR_HIGH_MASK                                   0x000007FFL
+//MMHUBBUB_WARMUP_ADDR_REGION
+#define MMHUBBUB_WARMUP_ADDR_REGION__MMHUBBUB_WARMUP_ADDR_REGION__SHIFT                                       0x0
+#define MMHUBBUB_WARMUP_ADDR_REGION__MMHUBBUB_WARMUP_ADDR_REGION_MASK                                         0x07FFFFFFL
+//MMHUBBUB_MIN_TTO
+#define MMHUBBUB_MIN_TTO__MMHUBBUB_MIN_TTO__SHIFT                                                             0x0
+#define MMHUBBUB_MIN_TTO__MMHUBBUB_MIN_TTO_MASK                                                               0x0007FFFFL
+//MMHUBBUB_CTRL
+#define MMHUBBUB_CTRL__MMHUB_SOCCLK_DS_MODE__SHIFT                                                            0x0
+#define MMHUBBUB_CTRL__MMHUB_SOCCLK_DS_MODE_MASK                                                              0x00000003L
+//WBIF_SMU_WM_CONTROL
+#define WBIF_SMU_WM_CONTROL__MCIF_WB_WM_CHG_SEL__SHIFT                                                        0x14
+#define WBIF_SMU_WM_CONTROL__MCIF_WB_WM_CHG_REQ__SHIFT                                                        0x16
+#define WBIF_SMU_WM_CONTROL__MCIF_WB_WM_CHG_SEL_MASK                                                          0x00300000L
+#define WBIF_SMU_WM_CONTROL__MCIF_WB_WM_CHG_REQ_MASK                                                          0x00400000L
+//MMHUBBUB_MEM_PWR_STATUS
+//MMHUBBUB_MEM_PWR_CNTL
+//MMHUBBUB_CLOCK_CNTL
+#define MMHUBBUB_CLOCK_CNTL__MMHUBBUB_TEST_CLK_SEL__SHIFT                                                     0x0
+#define MMHUBBUB_CLOCK_CNTL__DISPCLK_R_MMHUBBUB_GATE_DIS__SHIFT                                               0x5
+#define MMHUBBUB_CLOCK_CNTL__MMHUBBUB_FGCG_REP_DIS__SHIFT                                                     0x11
+#define MMHUBBUB_CLOCK_CNTL__MMHUBBUB_TEST_CLK_SEL_MASK                                                       0x0000001FL
+#define MMHUBBUB_CLOCK_CNTL__DISPCLK_R_MMHUBBUB_GATE_DIS_MASK                                                 0x00000020L
+#define MMHUBBUB_CLOCK_CNTL__MMHUBBUB_FGCG_REP_DIS_MASK                                                       0x00020000L
+//MMHUBBUB_SOFT_RESET
+#define MMHUBBUB_SOFT_RESET__DMUIF_SOFT_RESET__SHIFT                                                          0x8
+#define MMHUBBUB_SOFT_RESET__DMUIF_SOFT_RESET_MASK                                                            0x00000100L
+//DMU_IF_ERR_STATUS
+#define DMU_IF_ERR_STATUS__DMU_RD_OUTSTANDING_ERR__SHIFT                                                      0x0
+#define DMU_IF_ERR_STATUS__DMU_RD_OUTSTANDING_ERR_CLR__SHIFT                                                  0x4
+#define DMU_IF_ERR_STATUS__DMU_RD_OUTSTANDING_ERR_MASK                                                        0x00000001L
+#define DMU_IF_ERR_STATUS__DMU_RD_OUTSTANDING_ERR_CLR_MASK                                                    0x00000010L
+//MMHUBBUB_CLIENT_UNIT_ID
+//MMHUBBUB_WARMUP_SECURITY_CFG
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_UNITID__SHIFT                                           0x0
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_SECURE_LVL__SHIFT                                       0x8
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_SPACE__SHIFT                                            0x10
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_HDM__SHIFT                                              0x13
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_UNITID_MASK                                             0x0000003FL
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_SECURE_LVL_MASK                                         0x00000F00L
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_SPACE_MASK                                              0x00070000L
+#define MMHUBBUB_WARMUP_SECURITY_CFG__MMHUBBUB_WARMUP_HDM_MASK                                                0x00080000L
+//MMHUBBUB_WARMUP_VMID_CONTROL
+#define MMHUBBUB_WARMUP_VMID_CONTROL__MMHUBBUB_WARMUP_P_VMID__SHIFT                                           0x0
+#define MMHUBBUB_WARMUP_VMID_CONTROL__MMHUBBUB_WARMUP_P_VMID_MASK                                             0x0000000FL
+
+
+// addressBlock: dce_dc_hda_azf0controller_dispdec
+//AZALIA_CONTROLLER_CLOCK_GATING
+#define AZALIA_CONTROLLER_CLOCK_GATING__ENABLE_CLOCK_GATING__SHIFT                                            0x0
+#define AZALIA_CONTROLLER_CLOCK_GATING__CLOCK_ON_STATE__SHIFT                                                 0x4
+#define AZALIA_CONTROLLER_CLOCK_GATING__ENABLE_CLOCK_GATING_MASK                                              0x00000001L
+#define AZALIA_CONTROLLER_CLOCK_GATING__CLOCK_ON_STATE_MASK                                                   0x00000010L
+//AZALIA_AUDIO_DTO
+#define AZALIA_AUDIO_DTO__AZALIA_AUDIO_DTO_PHASE__SHIFT                                                       0x0
+#define AZALIA_AUDIO_DTO__AZALIA_AUDIO_DTO_MODULE__SHIFT                                                      0x10
+#define AZALIA_AUDIO_DTO__AZALIA_AUDIO_DTO_PHASE_MASK                                                         0x0000FFFFL
+#define AZALIA_AUDIO_DTO__AZALIA_AUDIO_DTO_MODULE_MASK                                                        0xFFFF0000L
+//AZALIA_AUDIO_DTO_CONTROL
+#define AZALIA_AUDIO_DTO_CONTROL__AZALIA_AUDIO_FORCE_DTO__SHIFT                                               0x8
+#define AZALIA_AUDIO_DTO_CONTROL__AZALIA_AUDIO_FORCE_DTO_MASK                                                 0x00000300L
+//AZALIA_SOCCLK_CONTROL
+#define AZALIA_SOCCLK_CONTROL__AUDIO_STREAM_SOCCLK_DEEP_SLEEP_EXIT_EN__SHIFT                                  0x1
+#define AZALIA_SOCCLK_CONTROL__AUDIO_STREAM_SOCCLK_DEEP_SLEEP_EXIT_EN_MASK                                    0x00000002L
+//AZALIA_UNDERFLOW_FILLER_SAMPLE
+#define AZALIA_UNDERFLOW_FILLER_SAMPLE__AZALIA_UNDERFLOW_FILLER_SAMPLE__SHIFT                                 0x0
+#define AZALIA_UNDERFLOW_FILLER_SAMPLE__AZALIA_UNDERFLOW_FILLER_SAMPLE_MASK                                   0xFFFFFFFFL
+//AZALIA_DATA_DMA_CONTROL
+#define AZALIA_DATA_DMA_CONTROL__DATA_DMA_NON_SNOOP__SHIFT                                                    0x0
+#define AZALIA_DATA_DMA_CONTROL__INPUT_DATA_DMA_NON_SNOOP__SHIFT                                              0x2
+#define AZALIA_DATA_DMA_CONTROL__DATA_DMA_ISOCHRONOUS__SHIFT                                                  0x4
+#define AZALIA_DATA_DMA_CONTROL__INPUT_DATA_DMA_ISOCHRONOUS__SHIFT                                            0x6
+#define AZALIA_DATA_DMA_CONTROL__AZALIA_IOC_GENERATION_METHOD__SHIFT                                          0x10
+#define AZALIA_DATA_DMA_CONTROL__AZALIA_UNDERFLOW_CONTROL__SHIFT                                              0x11
+#define AZALIA_DATA_DMA_CONTROL__DATA_DMA_NON_SNOOP_MASK                                                      0x00000003L
+#define AZALIA_DATA_DMA_CONTROL__INPUT_DATA_DMA_NON_SNOOP_MASK                                                0x0000000CL
+#define AZALIA_DATA_DMA_CONTROL__DATA_DMA_ISOCHRONOUS_MASK                                                    0x00000030L
+#define AZALIA_DATA_DMA_CONTROL__INPUT_DATA_DMA_ISOCHRONOUS_MASK                                              0x000000C0L
+#define AZALIA_DATA_DMA_CONTROL__AZALIA_IOC_GENERATION_METHOD_MASK                                            0x00010000L
+#define AZALIA_DATA_DMA_CONTROL__AZALIA_UNDERFLOW_CONTROL_MASK                                                0x00020000L
+//AZALIA_BDL_DMA_CONTROL
+#define AZALIA_BDL_DMA_CONTROL__BDL_DMA_NON_SNOOP__SHIFT                                                      0x0
+#define AZALIA_BDL_DMA_CONTROL__INPUT_BDL_DMA_NON_SNOOP__SHIFT                                                0x2
+#define AZALIA_BDL_DMA_CONTROL__BDL_DMA_ISOCHRONOUS__SHIFT                                                    0x4
+#define AZALIA_BDL_DMA_CONTROL__INPUT_BDL_DMA_ISOCHRONOUS__SHIFT                                              0x6
+#define AZALIA_BDL_DMA_CONTROL__BDL_DMA_NON_SNOOP_MASK                                                        0x00000003L
+#define AZALIA_BDL_DMA_CONTROL__INPUT_BDL_DMA_NON_SNOOP_MASK                                                  0x0000000CL
+#define AZALIA_BDL_DMA_CONTROL__BDL_DMA_ISOCHRONOUS_MASK                                                      0x00000030L
+#define AZALIA_BDL_DMA_CONTROL__INPUT_BDL_DMA_ISOCHRONOUS_MASK                                                0x000000C0L
+//AZALIA_RIRB_AND_DP_CONTROL
+#define AZALIA_RIRB_AND_DP_CONTROL__RIRB_NON_SNOOP__SHIFT                                                     0x0
+#define AZALIA_RIRB_AND_DP_CONTROL__DP_DMA_NON_SNOOP__SHIFT                                                   0x4
+#define AZALIA_RIRB_AND_DP_CONTROL__DP_UPDATE_FREQ_DIVIDER__SHIFT                                             0x5
+#define AZALIA_RIRB_AND_DP_CONTROL__RIRB_NON_SNOOP_MASK                                                       0x00000001L
+#define AZALIA_RIRB_AND_DP_CONTROL__DP_DMA_NON_SNOOP_MASK                                                     0x00000010L
+#define AZALIA_RIRB_AND_DP_CONTROL__DP_UPDATE_FREQ_DIVIDER_MASK                                               0x000001E0L
+//AZALIA_CORB_DMA_CONTROL
+#define AZALIA_CORB_DMA_CONTROL__CORB_DMA_NON_SNOOP__SHIFT                                                    0x0
+#define AZALIA_CORB_DMA_CONTROL__CORB_DMA_ISOCHRONOUS__SHIFT                                                  0x4
+#define AZALIA_CORB_DMA_CONTROL__CORB_DMA_NON_SNOOP_MASK                                                      0x00000001L
+#define AZALIA_CORB_DMA_CONTROL__CORB_DMA_ISOCHRONOUS_MASK                                                    0x00000010L
+//AZALIA_GLOBAL_CAPABILITIES
+#define AZALIA_GLOBAL_CAPABILITIES__NUMBER_OF_SERIAL_DATA_OUTPUT_SIGNALS__SHIFT                               0x1
+#define AZALIA_GLOBAL_CAPABILITIES__NUMBER_OF_SERIAL_DATA_OUTPUT_SIGNALS_MASK                                 0x00000006L
+//AZALIA_OUTPUT_PAYLOAD_CAPABILITY
+#define AZALIA_OUTPUT_PAYLOAD_CAPABILITY__OUTPUT_PAYLOAD_CAPABILITY__SHIFT                                    0x0
+#define AZALIA_OUTPUT_PAYLOAD_CAPABILITY__OUTSTRMPAY__SHIFT                                                   0x10
+#define AZALIA_OUTPUT_PAYLOAD_CAPABILITY__OUTPUT_PAYLOAD_CAPABILITY_MASK                                      0x0000FFFFL
+#define AZALIA_OUTPUT_PAYLOAD_CAPABILITY__OUTSTRMPAY_MASK                                                     0xFFFF0000L
+//AZALIA_OUTPUT_STREAM_ARBITER_CONTROL
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__LATENCY_HIDING_LEVEL__SHIFT                                     0x0
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__SYS_MEM_ACTIVE_ENABLE__SHIFT                                    0x8
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__INPUT_LATENCY_HIDING_LEVEL__SHIFT                               0x10
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__LATENCY_HIDING_LEVEL_MASK                                       0x000000FFL
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__SYS_MEM_ACTIVE_ENABLE_MASK                                      0x00000100L
+#define AZALIA_OUTPUT_STREAM_ARBITER_CONTROL__INPUT_LATENCY_HIDING_LEVEL_MASK                                 0x00FF0000L
+//AZALIA_INPUT_PAYLOAD_CAPABILITY
+#define AZALIA_INPUT_PAYLOAD_CAPABILITY__INPUT_PAYLOAD_CAPABILITY__SHIFT                                      0x0
+#define AZALIA_INPUT_PAYLOAD_CAPABILITY__INSTRMPAY__SHIFT                                                     0x10
+#define AZALIA_INPUT_PAYLOAD_CAPABILITY__INPUT_PAYLOAD_CAPABILITY_MASK                                        0x0000FFFFL
+#define AZALIA_INPUT_PAYLOAD_CAPABILITY__INSTRMPAY_MASK                                                       0xFFFF0000L
+//AZALIA_CONTROLLER_DEBUG
+#define AZALIA_CONTROLLER_DEBUG__CONTROLLER_DEBUG__SHIFT                                                      0x0
+#define AZALIA_CONTROLLER_DEBUG__CONTROLLER_DEBUG_MASK                                                        0xFFFFFFFFL
+//AZALIA_MEM_PWR_CTRL
+#define AZALIA_MEM_PWR_CTRL__AZ_MEM_PWR_FORCE__SHIFT                                                          0x0
+#define AZALIA_MEM_PWR_CTRL__AZ_MEM_PWR_DIS__SHIFT                                                            0x2
+#define AZALIA_MEM_PWR_CTRL__AZ_MEM_PWR_FORCE_MASK                                                            0x00000003L
+#define AZALIA_MEM_PWR_CTRL__AZ_MEM_PWR_DIS_MASK                                                              0x00000004L
+//AZALIA_MEM_PWR_STATUS
+#define AZALIA_MEM_PWR_STATUS__AZ_MEM_PWR_STATE__SHIFT                                                        0x0
+#define AZALIA_MEM_PWR_STATUS__AZ_MEM_PWR_STATE_MASK                                                          0x00000003L
+//DCI_PG_DEBUG_CONFIG
+#define DCI_PG_DEBUG_CONFIG__DCI_PG_DBG_EN__SHIFT                                                             0x0
+#define DCI_PG_DEBUG_CONFIG__DCI_PG_DBG_EN_MASK                                                               0x00000001L
+
+
+// addressBlock: dce_dc_hda_azf0root_dispdec
+//AZALIA_F0_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID
+#define AZALIA_F0_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__AZALIA_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__SHIFT  0x0
+#define AZALIA_F0_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__AZALIA_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID_MASK  0xFFFFFFFFL
+//AZALIA_F0_CODEC_ROOT_PARAMETER_REVISION_ID
+#define AZALIA_F0_CODEC_ROOT_PARAMETER_REVISION_ID__AZALIA_CODEC_ROOT_PARAMETER_REVISION_ID__SHIFT            0x0
+#define AZALIA_F0_CODEC_ROOT_PARAMETER_REVISION_ID__AZALIA_CODEC_ROOT_PARAMETER_REVISION_ID_MASK              0xFFFFFFFFL
+//AZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL
+#define AZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL__HBR_CHANNEL_COUNT__SHIFT                                       0x0
+#define AZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL__COMPRESSED_CHANNEL_COUNT__SHIFT                                0x4
+#define AZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL__HBR_CHANNEL_COUNT_MASK                                         0x00000007L
+#define AZALIA_F0_CODEC_CHANNEL_COUNT_CONTROL__COMPRESSED_CHANNEL_COUNT_MASK                                  0x00000070L
+//AZALIA_F0_CODEC_RESYNC_FIFO_CONTROL
+#define AZALIA_F0_CODEC_RESYNC_FIFO_CONTROL__RESYNC_FIFO_STARTUP_KEEPOUT_WINDOW__SHIFT                        0x0
+#define AZALIA_F0_CODEC_RESYNC_FIFO_CONTROL__RESYNC_FIFO_STARTUP_KEEPOUT_WINDOW_MASK                          0x0000003FL
+//AZALIA_F0_CODEC_FUNCTION_PARAMETER_GROUP_TYPE
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__AZALIA_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__SHIFT      0x0
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__AZALIA_CODEC_FUNCTION_PARAMETER_GROUP_TYPE_MASK        0xFFFFFFFFL
+//AZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT               0x0
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT                0x10
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK                 0x00000FFFL
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK                  0x001F0000L
+//AZALIA_F0_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__AZALIA_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__SHIFT  0x0
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__AZALIA_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS_MASK  0xFFFFFFFFL
+//AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__AZALIA_CODEC_FUNCTION_PARAMETER_POWER_STATES__SHIFT  0x0
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__CLKSTOP__SHIFT                                       0x1e
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__EPSS__SHIFT                                          0x1f
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__AZALIA_CODEC_FUNCTION_PARAMETER_POWER_STATES_MASK    0x3FFFFFFFL
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__CLKSTOP_MASK                                         0x40000000L
+#define AZALIA_F0_CODEC_FUNCTION_PARAMETER_POWER_STATES__EPSS_MASK                                            0x80000000L
+//AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SET__SHIFT                                  0x0
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_ACT__SHIFT                                  0x4
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__CLKSTOPOK__SHIFT                                        0x9
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SETTINGS_RESET__SHIFT                       0xa
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SET_MASK                                    0x0000000FL
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_ACT_MASK                                    0x000000F0L
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__CLKSTOPOK_MASK                                          0x00000200L
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SETTINGS_RESET_MASK                         0x00000400L
+//AZALIA_F0_CODEC_FUNCTION_CONTROL_RESET
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESET__CODEC_RESET__SHIFT                                            0x0
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESET__CODEC_RESET_MASK                                              0x00000001L
+//AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE0__SHIFT                     0x0
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE1__SHIFT                     0x8
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE2__SHIFT                     0x10
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE3__SHIFT                     0x18
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE0_MASK                       0x000000FFL
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE1_MASK                       0x0000FF00L
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE2_MASK                       0x00FF0000L
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE3_MASK                       0xFF000000L
+//AZALIA_F0_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION__CONVERTER_SYNCHRONIZATION__SHIFT          0x0
+#define AZALIA_F0_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION__CONVERTER_SYNCHRONIZATION_MASK            0x000000FFL
+//CC_RCU_DC_AUDIO_PORT_CONNECTIVITY
+#define CC_RCU_DC_AUDIO_PORT_CONNECTIVITY__PORT_CONNECTIVITY__SHIFT                                           0x0
+#define CC_RCU_DC_AUDIO_PORT_CONNECTIVITY__PORT_CONNECTIVITY_OVERRIDE_ENABLE__SHIFT                           0x4
+#define CC_RCU_DC_AUDIO_PORT_CONNECTIVITY__PORT_CONNECTIVITY_MASK                                             0x00000007L
+#define CC_RCU_DC_AUDIO_PORT_CONNECTIVITY__PORT_CONNECTIVITY_OVERRIDE_ENABLE_MASK                             0x00000010L
+//CC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY
+#define CC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY__INPUT_PORT_CONNECTIVITY__SHIFT                               0x0
+#define CC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY__INPUT_PORT_CONNECTIVITY_OVERRIDE_ENABLE__SHIFT               0x4
+#define CC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY__INPUT_PORT_CONNECTIVITY_MASK                                 0x00000007L
+#define CC_RCU_DC_AUDIO_INPUT_PORT_CONNECTIVITY__INPUT_PORT_CONNECTIVITY_OVERRIDE_ENABLE_MASK                 0x00000010L
+//AZALIA_F0_CODEC_DEBUG
+#define AZALIA_F0_CODEC_DEBUG__DISABLE_FORMAT_COMPARISON__SHIFT                                               0x0
+#define AZALIA_F0_CODEC_DEBUG__CODEC_DEBUG__SHIFT                                                             0x6
+#define AZALIA_F0_CODEC_DEBUG__DISABLE_FORMAT_COMPARISON_MASK                                                 0x0000003FL
+#define AZALIA_F0_CODEC_DEBUG__CODEC_DEBUG_MASK                                                               0xFFFFFFC0L
+//REG_DC_AUDIO_PORT_CONNECTIVITY
+#define REG_DC_AUDIO_PORT_CONNECTIVITY__REG_PORT_CONNECTIVITY__SHIFT                                          0x0
+#define REG_DC_AUDIO_PORT_CONNECTIVITY__REG_PORT_CONNECTIVITY_OVERRIDE_ENABLE__SHIFT                          0x4
+#define REG_DC_AUDIO_PORT_CONNECTIVITY__REG_PORT_CONNECTIVITY_MASK                                            0x00000007L
+#define REG_DC_AUDIO_PORT_CONNECTIVITY__REG_PORT_CONNECTIVITY_OVERRIDE_ENABLE_MASK                            0x00000010L
+//REG_DC_AUDIO_INPUT_PORT_CONNECTIVITY
+#define REG_DC_AUDIO_INPUT_PORT_CONNECTIVITY__REG_INPUT_PORT_CONNECTIVITY__SHIFT                              0x0
+#define REG_DC_AUDIO_INPUT_PORT_CONNECTIVITY__REG_INPUT_PORT_CONNECTIVITY_OVERRIDE_ENABLE__SHIFT              0x4
+#define REG_DC_AUDIO_INPUT_PORT_CONNECTIVITY__REG_INPUT_PORT_CONNECTIVITY_MASK                                0x00000007L
+#define REG_DC_AUDIO_INPUT_PORT_CONNECTIVITY__REG_INPUT_PORT_CONNECTIVITY_OVERRIDE_ENABLE_MASK                0x00000010L
+
+
+// addressBlock: dce_dc_hda_az_misc_dispdec
+//AZ_CLOCK_CNTL
+#define AZ_CLOCK_CNTL__SCLK_G_STREAM_AZ_GATE_DIS__SHIFT                                                       0x0
+#define AZ_CLOCK_CNTL__AZ_GLOBAL_FGCG_REP_DIS__SHIFT                                                          0x1
+#define AZ_CLOCK_CNTL__SCLK_R_AZ_GATE_DIS__SHIFT                                                              0x4
+#define AZ_CLOCK_CNTL__SCLK_G_CNTL_AZ_GATE_DIS__SHIFT                                                         0x8
+#define AZ_CLOCK_CNTL__DCIPG_TEST_CLK_SEL__SHIFT                                                              0xc
+#define AZ_CLOCK_CNTL__SCLK_GATE_DIS__SHIFT                                                                   0x10
+#define AZ_CLOCK_CNTL__SCLK_TURN_ON_DELAY__SHIFT                                                              0x14
+#define AZ_CLOCK_CNTL__SCLK_TURN_OFF_DELAY__SHIFT                                                             0x18
+#define AZ_CLOCK_CNTL__SCLK_G_STREAM_AZ_GATE_DIS_MASK                                                         0x00000001L
+#define AZ_CLOCK_CNTL__AZ_GLOBAL_FGCG_REP_DIS_MASK                                                            0x00000002L
+#define AZ_CLOCK_CNTL__SCLK_R_AZ_GATE_DIS_MASK                                                                0x00000010L
+#define AZ_CLOCK_CNTL__SCLK_G_CNTL_AZ_GATE_DIS_MASK                                                           0x00000100L
+#define AZ_CLOCK_CNTL__DCIPG_TEST_CLK_SEL_MASK                                                                0x0000F000L
+#define AZ_CLOCK_CNTL__SCLK_GATE_DIS_MASK                                                                     0x00010000L
+#define AZ_CLOCK_CNTL__SCLK_TURN_ON_DELAY_MASK                                                                0x00F00000L
+#define AZ_CLOCK_CNTL__SCLK_TURN_OFF_DELAY_MASK                                                               0xFF000000L
+//AZ_MEM_GLOBAL_PWR_REQ_CNTL
+#define AZ_MEM_GLOBAL_PWR_REQ_CNTL__AZ_MEM_GLOBAL_PWR_REQ_DIS__SHIFT                                          0x0
+#define AZ_MEM_GLOBAL_PWR_REQ_CNTL__AZ_MEM_GLOBAL_PWR_REQ_DIS_MASK                                            0x00000001L
+//AZ_STRAPS
+#define AZ_STRAPS__AUDIO_PORT_CONNECTIVITY__SHIFT                                                             0x0
+#define AZ_STRAPS__AUDIO_STREAM_NUMBER__SHIFT                                                                 0x4
+#define AZ_STRAPS__AUDIO_PORT_CONNECTIVITY_MASK                                                               0x00000007L
+#define AZ_STRAPS__AUDIO_STREAM_NUMBER_MASK                                                                   0x00000070L
+
+
+// addressBlock: dce_dc_hda_az_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON4_PERFCOUNTER_CNTL
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON4_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON4_PERFCOUNTER_CNTL2
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON4_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON4_PERFCOUNTER_STATE
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON4_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON4_PERFMON_CNTL
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON4_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON4_PERFMON_CNTL2
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON4_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON4_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON4_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON4_PERFMON_CVALUE_LOW
+#define DC_PERFMON4_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON4_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON4_PERFMON_HI
+#define DC_PERFMON4_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON4_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON4_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON4_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON4_PERFMON_LOW
+#define DC_PERFMON4_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON4_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON4_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON4_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON4_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream0_dispdec
+//AZF0STREAM0_AZALIA_STREAM_INDEX
+#define AZF0STREAM0_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM0_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM0_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM0_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM0_AZALIA_STREAM_DATA
+#define AZF0STREAM0_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM0_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream1_dispdec
+//AZF0STREAM1_AZALIA_STREAM_INDEX
+#define AZF0STREAM1_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM1_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM1_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM1_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM1_AZALIA_STREAM_DATA
+#define AZF0STREAM1_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM1_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream2_dispdec
+//AZF0STREAM2_AZALIA_STREAM_INDEX
+#define AZF0STREAM2_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM2_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM2_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM2_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM2_AZALIA_STREAM_DATA
+#define AZF0STREAM2_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM2_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream3_dispdec
+//AZF0STREAM3_AZALIA_STREAM_INDEX
+#define AZF0STREAM3_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM3_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM3_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM3_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM3_AZALIA_STREAM_DATA
+#define AZF0STREAM3_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM3_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream4_dispdec
+//AZF0STREAM4_AZALIA_STREAM_INDEX
+#define AZF0STREAM4_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM4_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM4_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM4_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM4_AZALIA_STREAM_DATA
+#define AZF0STREAM4_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM4_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream5_dispdec
+//AZF0STREAM5_AZALIA_STREAM_INDEX
+#define AZF0STREAM5_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM5_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM5_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM5_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM5_AZALIA_STREAM_DATA
+#define AZF0STREAM5_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM5_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream6_dispdec
+//AZF0STREAM6_AZALIA_STREAM_INDEX
+#define AZF0STREAM6_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM6_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM6_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM6_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM6_AZALIA_STREAM_DATA
+#define AZF0STREAM6_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM6_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream7_dispdec
+//AZF0STREAM7_AZALIA_STREAM_INDEX
+#define AZF0STREAM7_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM7_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM7_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM7_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM7_AZALIA_STREAM_DATA
+#define AZF0STREAM7_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM7_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream8_dispdec
+//AZF0STREAM8_AZALIA_STREAM_INDEX
+#define AZF0STREAM8_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM8_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM8_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM8_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM8_AZALIA_STREAM_DATA
+#define AZF0STREAM8_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM8_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream9_dispdec
+//AZF0STREAM9_AZALIA_STREAM_INDEX
+#define AZF0STREAM9_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                       0x0
+#define AZF0STREAM9_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                    0x8
+#define AZF0STREAM9_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                         0x000000FFL
+#define AZF0STREAM9_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                      0x00000100L
+//AZF0STREAM9_AZALIA_STREAM_DATA
+#define AZF0STREAM9_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                         0x0
+#define AZF0STREAM9_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                           0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream10_dispdec
+//AZF0STREAM10_AZALIA_STREAM_INDEX
+#define AZF0STREAM10_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM10_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM10_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM10_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM10_AZALIA_STREAM_DATA
+#define AZF0STREAM10_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM10_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream11_dispdec
+//AZF0STREAM11_AZALIA_STREAM_INDEX
+#define AZF0STREAM11_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM11_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM11_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM11_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM11_AZALIA_STREAM_DATA
+#define AZF0STREAM11_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM11_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream12_dispdec
+//AZF0STREAM12_AZALIA_STREAM_INDEX
+#define AZF0STREAM12_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM12_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM12_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM12_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM12_AZALIA_STREAM_DATA
+#define AZF0STREAM12_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM12_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream13_dispdec
+//AZF0STREAM13_AZALIA_STREAM_INDEX
+#define AZF0STREAM13_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM13_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM13_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM13_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM13_AZALIA_STREAM_DATA
+#define AZF0STREAM13_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM13_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream14_dispdec
+//AZF0STREAM14_AZALIA_STREAM_INDEX
+#define AZF0STREAM14_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM14_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM14_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM14_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM14_AZALIA_STREAM_DATA
+#define AZF0STREAM14_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM14_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0stream15_dispdec
+//AZF0STREAM15_AZALIA_STREAM_INDEX
+#define AZF0STREAM15_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX__SHIFT                                      0x0
+#define AZF0STREAM15_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN__SHIFT                                   0x8
+#define AZF0STREAM15_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_INDEX_MASK                                        0x000000FFL
+#define AZF0STREAM15_AZALIA_STREAM_INDEX__AZALIA_STREAM_REG_WRITE_EN_MASK                                     0x00000100L
+//AZF0STREAM15_AZALIA_STREAM_DATA
+#define AZF0STREAM15_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA__SHIFT                                        0x0
+#define AZF0STREAM15_AZALIA_STREAM_DATA__AZALIA_STREAM_REG_DATA_MASK                                          0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint0_dispdec
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint1_dispdec
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint2_dispdec
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint3_dispdec
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint4_dispdec
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint5_dispdec
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint6_dispdec
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hda_azf0endpoint7_dispdec
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_INDEX
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX__SHIFT                        0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_INDEX__AZALIA_ENDPOINT_REG_INDEX_MASK                          0x00003FFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_DATA
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA__SHIFT                          0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_ENDPOINT_DATA__AZALIA_ENDPOINT_REG_DATA_MASK                            0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_dispdec
+//DCHUBBUB_ARB_DF_REQ_OUTSTAND
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MAX_REQ_OUTSTAND__SHIFT                                    0x0
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MIN_REQ_OUTSTAND__SHIFT                                    0xb
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MIN_REQ_OUTSTAND_COMMIT_THRESHOLD__SHIFT                   0x16
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MAX_REQ_OUTSTAND_MASK                                      0x000003FFL
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MIN_REQ_OUTSTAND_MASK                                      0x001FF800L
+#define DCHUBBUB_ARB_DF_REQ_OUTSTAND__DCHUBBUB_ARB_MIN_REQ_OUTSTAND_COMMIT_THRESHOLD_MASK                     0xFFC00000L
+//DCHUBBUB_ARB_SAT_LEVEL
+#define DCHUBBUB_ARB_SAT_LEVEL__DCHUBBUB_ARB_SAT_LEVEL__SHIFT                                                 0x0
+#define DCHUBBUB_ARB_SAT_LEVEL__DCHUBBUB_ARB_SAT_LEVEL_MASK                                                   0xFFFFFFFFL
+//DCHUBBUB_ARB_QOS_FORCE
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_URGENT__SHIFT                                          0x0
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_BANDWIDTH_OVERHEAD__SHIFT                              0x1
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_ENABLE__SHIFT                                          0x8
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_DO_NOT_FORCE_URGENCY_DURING_PSTATE_CHANGE_REQUEST__SHIFT         0x9
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_URGENT_MASK                                            0x00000001L
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_BANDWIDTH_OVERHEAD_MASK                                0x00000002L
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_UTM_FORCE_ENABLE_MASK                                            0x00000100L
+#define DCHUBBUB_ARB_QOS_FORCE__DCHUBBUB_ARB_DO_NOT_FORCE_URGENCY_DURING_PSTATE_CHANGE_REQUEST_MASK           0x00000200L
+//DCHUBBUB_ARB_DRAM_STATE_CNTL
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_SELF_REFRESH_FORCE_VALUE__SHIFT                      0x0
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_SELF_REFRESH_FORCE_ENABLE__SHIFT                     0x1
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DO_NOT_FORCE_ALLOW_CSTATE_DURING_PSTATE_CHANGE_REQUEST__SHIFT  0x2
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_PSTATE_CHANGE_FORCE_VALUE__SHIFT                     0x4
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_PSTATE_CHANGE_FORCE_ENABLE__SHIFT                    0x5
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__ENABLE_QOS_FORCE_PSTATE__SHIFT                                          0x7
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DEEPSLEEP_BEFORE_COMPBUF_EMPTY_CONDITION_DISABLE__SHIFT  0xb
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_CSTATE_MAX_CAP_MODE__SHIFT                                 0xc
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_CSTATE_DEEPSLEEP_LEGACY_MODE__SHIFT                  0xd
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DISABL_EXIT_DEEPSLEEP_WHEN_PREFETCH_START_PENDING__SHIFT   0xe
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DISABLE_HOSTVM_FORCE_DCFCLK_DEEP_SLEEP__SHIFT                           0xf
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_VALUE__SHIFT                 0x10
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_ENABLE__SHIFT                0x11
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_LEGACY__SHIFT                0x12
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DCFCLK_DEEP_SLEEP_HYSTERESIS__SHIFT                        0x18
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_SELF_REFRESH_FORCE_VALUE_MASK                        0x00000001L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_SELF_REFRESH_FORCE_ENABLE_MASK                       0x00000002L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DO_NOT_FORCE_ALLOW_CSTATE_DURING_PSTATE_CHANGE_REQUEST_MASK  0x00000004L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_PSTATE_CHANGE_FORCE_VALUE_MASK                       0x00000010L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_PSTATE_CHANGE_FORCE_ENABLE_MASK                      0x00000020L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__ENABLE_QOS_FORCE_PSTATE_MASK                                            0x00000080L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DEEPSLEEP_BEFORE_COMPBUF_EMPTY_CONDITION_DISABLE_MASK  0x00000800L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_CSTATE_MAX_CAP_MODE_MASK                                   0x00001000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_CSTATE_DEEPSLEEP_LEGACY_MODE_MASK                    0x00002000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DISABL_EXIT_DEEPSLEEP_WHEN_PREFETCH_START_PENDING_MASK     0x00004000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DISABLE_HOSTVM_FORCE_DCFCLK_DEEP_SLEEP_MASK                             0x00008000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_VALUE_MASK                   0x00010000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_ENABLE_MASK                  0x00020000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_ALLOW_DCFCLK_DEEP_SLEEP_FORCE_LEGACY_MASK                  0x00040000L
+#define DCHUBBUB_ARB_DRAM_STATE_CNTL__DCHUBBUB_ARB_DCFCLK_DEEP_SLEEP_HYSTERESIS_MASK                          0xFF000000L
+//DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_NO_PENDING_HVM_REQ_BEFORE_ENTER_CSTATE_HYSTERESIS__SHIFT  0x0
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DELAY_HOSTVM_INV_FLIP_EN__SHIFT                        0x10
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DISALLOW_HOSTVM_INV_FLIP__SHIFT                        0x11
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL_RESERVED__SHIFT                    0x12
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_NO_PENDING_HVM_REQ_BEFORE_ENTER_CSTATE_HYSTERESIS_MASK  0x0000FFFFL
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DELAY_HOSTVM_INV_FLIP_EN_MASK                          0x00010000L
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DISALLOW_HOSTVM_INV_FLIP_MASK                          0x00020000L
+#define DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL__DCHUBBUB_ARB_DRAM_HVM_STATE_CNTL_RESERVED_MASK                      0xFFFC0000L
+//DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A
+#define DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A__DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A__SHIFT                   0x0
+#define DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A__DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_A_MASK                     0x00003FFFL
+//DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A
+#define DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A__DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A__SHIFT             0x0
+#define DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A__DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_A_MASK               0x00003FFFL
+//DCHUBBUB_ARB_REFCYC_PER_META_TRIP_A
+#define DCHUBBUB_ARB_REFCYC_PER_META_TRIP_A__DCHUBBUB_ARB_REFCYC_PER_META_TRIP_A__SHIFT                       0x0
+#define DCHUBBUB_ARB_REFCYC_PER_META_TRIP_A__DCHUBBUB_ARB_REFCYC_PER_META_TRIP_A_MASK                         0x00003FFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_A_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A__SHIFT                 0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_A_MASK                   0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_A_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_A_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_A_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_A_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_A_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_A_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A__SHIFT       0x0
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_A_MASK         0x0000FFFFL
+//DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A__SHIFT     0x0
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_A_MASK       0x0000FFFFL
+//DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A__SHIFT       0x0
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_A_MASK         0x0000FFFFL
+//DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A__SHIFT     0x0
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_A_MASK       0x0000FFFFL
+//DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A
+#define DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A__DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A__SHIFT             0x0
+#define DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A__DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_A_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_FRAC_URG_BW_NOM_A
+#define DCHUBBUB_ARB_FRAC_URG_BW_NOM_A__DCHUBBUB_ARB_FRAC_URG_BW_NOM_A__SHIFT                                 0x0
+#define DCHUBBUB_ARB_FRAC_URG_BW_NOM_A__DCHUBBUB_ARB_FRAC_URG_BW_NOM_A_MASK                                   0x000003FFL
+//DCHUBBUB_ARB_FRAC_URG_BW_FLIP_A
+#define DCHUBBUB_ARB_FRAC_URG_BW_FLIP_A__DCHUBBUB_ARB_FRAC_URG_BW_FLIP_A__SHIFT                               0x0
+#define DCHUBBUB_ARB_FRAC_URG_BW_FLIP_A__DCHUBBUB_ARB_FRAC_URG_BW_FLIP_A_MASK                                 0x000003FFL
+//DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B
+#define DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B__DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B__SHIFT                   0x0
+#define DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B__DCHUBBUB_ARB_DATA_URGENCY_WATERMARK_B_MASK                     0x00003FFFL
+//DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B
+#define DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B__DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B__SHIFT             0x0
+#define DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B__DCHUBBUB_ARB_REFCYC_PER_TRIP_TO_MEMORY_B_MASK               0x00003FFFL
+//DCHUBBUB_ARB_REFCYC_PER_META_TRIP_B
+#define DCHUBBUB_ARB_REFCYC_PER_META_TRIP_B__DCHUBBUB_ARB_REFCYC_PER_META_TRIP_B__SHIFT                       0x0
+#define DCHUBBUB_ARB_REFCYC_PER_META_TRIP_B__DCHUBBUB_ARB_REFCYC_PER_META_TRIP_B_MASK                         0x00003FFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK_B_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B__SHIFT                 0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK_B_MASK                   0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK1_B_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK1_B_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK2_B_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK2_B_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B__SHIFT             0x0
+#define DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B__DCHUBBUB_ARB_ALLOW_SR_ENTER_WATERMARK3_B_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B__SHIFT               0x0
+#define DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B__DCHUBBUB_ARB_ALLOW_SR_EXIT_WATERMARK3_B_MASK                 0x000FFFFFL
+//DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B__SHIFT       0x0
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK_B_MASK         0x0000FFFFL
+//DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B__SHIFT     0x0
+#define DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B__DCHUBBUB_ARB_UCLK_PSTATE_CHANGE_WATERMARK1_B_MASK       0x0000FFFFL
+//DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B__SHIFT       0x0
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK_B_MASK         0x0000FFFFL
+//DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B__SHIFT     0x0
+#define DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B__DCHUBBUB_ARB_FCLK_PSTATE_CHANGE_WATERMARK1_B_MASK       0x0000FFFFL
+//DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B
+#define DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B__DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B__SHIFT             0x0
+#define DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B__DCHUBBUB_ARB_BUFFER_FULLNESS_WATERMARK_B_MASK               0x000FFFFFL
+//DCHUBBUB_ARB_FRAC_URG_BW_NOM_B
+#define DCHUBBUB_ARB_FRAC_URG_BW_NOM_B__DCHUBBUB_ARB_FRAC_URG_BW_NOM_B__SHIFT                                 0x0
+#define DCHUBBUB_ARB_FRAC_URG_BW_NOM_B__DCHUBBUB_ARB_FRAC_URG_BW_NOM_B_MASK                                   0x000003FFL
+//DCHUBBUB_ARB_FRAC_URG_BW_FLIP_B
+#define DCHUBBUB_ARB_FRAC_URG_BW_FLIP_B__DCHUBBUB_ARB_FRAC_URG_BW_FLIP_B__SHIFT                               0x0
+#define DCHUBBUB_ARB_FRAC_URG_BW_FLIP_B__DCHUBBUB_ARB_FRAC_URG_BW_FLIP_B_MASK                                 0x000003FFL
+//DCHUBBUB_ARB_HOSTVM_CNTL
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DISABLE_HOSTVM_FORCE_CSTATE__SHIFT                                          0x0
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DISABLE_HOSTVM_FORCE_ALLOW_PSTATE__SHIFT                                    0x1
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_SLACK_MASK__SHIFT                                                       0x3
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_SPACE_OK_STATUS__SHIFT                                                  0x4
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_GID_FREE_STATUS__SHIFT                                                  0x5
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DCHVM_RET_FIFO_FREE_STATUS__SHIFT                                           0x6
+#define DCHUBBUB_ARB_HOSTVM_CNTL__NON_PRQ_CLIENT_WINNER_STATUS__SHIFT                                         0x7
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_MAX_ALLOCATED_GROUPS__SHIFT                                          0x8
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_MAX_RD_FIFO_ENTRIES__SHIFT                                           0x10
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_FORCE_URGENT_WHEN_OVERHEAD__SHIFT                                    0x18
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DCHUBBUB_ARB_MAX_QOS_COMMIT_THRESHOLD__SHIFT                                0x1c
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DISABLE_HOSTVM_FORCE_CSTATE_MASK                                            0x00000001L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DISABLE_HOSTVM_FORCE_ALLOW_PSTATE_MASK                                      0x00000002L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_SLACK_MASK_MASK                                                         0x00000008L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_SPACE_OK_STATUS_MASK                                                    0x00000010L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__PRQ_GID_FREE_STATUS_MASK                                                    0x00000020L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DCHVM_RET_FIFO_FREE_STATUS_MASK                                             0x00000040L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__NON_PRQ_CLIENT_WINNER_STATUS_MASK                                           0x00000080L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_MAX_ALLOCATED_GROUPS_MASK                                            0x00003F00L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_MAX_RD_FIFO_ENTRIES_MASK                                             0x00FF0000L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__HOSTVM_FORCE_URGENT_WHEN_OVERHEAD_MASK                                      0x01000000L
+#define DCHUBBUB_ARB_HOSTVM_CNTL__DCHUBBUB_ARB_MAX_QOS_COMMIT_THRESHOLD_MASK                                  0xF0000000L
+//DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_SELECT__SHIFT                       0x0
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_DONE_INTERRUPT_DISABLE__SHIFT       0x4
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_DONE_INTERRUPT_STATUS__SHIFT        0x5
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_REQUEST__SHIFT                      0x8
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__Z_STUTTER_WATERMARK_SELECT__SHIFT                                 0x11
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__PSTATE_CHANGE_TYPE__SHIFT                                         0x18
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__UCLK_PSTATE_CHANGE_WATERMARK_SELECT__SHIFT                        0x19
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__FCLK_PSTATE_CHANGE_WATERMARK_SELECT__SHIFT                        0x1a
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_SELECT_MASK                         0x00000001L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_DONE_INTERRUPT_DISABLE_MASK         0x00000010L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_DONE_INTERRUPT_STATUS_MASK          0x00000020L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__DCHUBBUB_ARB_WATERMARK_CHANGE_REQUEST_MASK                        0x00000100L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__Z_STUTTER_WATERMARK_SELECT_MASK                                   0x00060000L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__PSTATE_CHANGE_TYPE_MASK                                           0x01000000L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__UCLK_PSTATE_CHANGE_WATERMARK_SELECT_MASK                          0x02000000L
+#define DCHUBBUB_ARB_WATERMARK_CHANGE_CNTL__FCLK_PSTATE_CHANGE_WATERMARK_SELECT_MASK                          0x04000000L
+//DCHUBBUB_ARB_ALT_CH_CNTL
+#define DCHUBBUB_ARB_ALT_CH_CNTL__PSTATE_ALT_CH_RESERVED__SHIFT                                               0x0
+#define DCHUBBUB_ARB_ALT_CH_CNTL__ALT_CH_IN_USE__SHIFT                                                        0x4
+#define DCHUBBUB_ARB_ALT_CH_CNTL__PSTATE_ALT_CH_RESERVED_MASK                                                 0x00000001L
+#define DCHUBBUB_ARB_ALT_CH_CNTL__ALT_CH_IN_USE_MASK                                                          0x00000010L
+//DCHUBBUB_ARB_TIMEOUT_ENABLE
+#define DCHUBBUB_ARB_TIMEOUT_ENABLE__DCHUBBUB_ARB_TIMEOUT_ENABLE__SHIFT                                       0x0
+#define DCHUBBUB_ARB_TIMEOUT_ENABLE__DCHUBBUB_ARB_TIMEOUT_ENABLE_MASK                                         0x00000001L
+//DCHUBBUB_GLOBAL_TIMER_CNTL
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_REFDIV__SHIFT                                       0x0
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_ENABLE__SHIFT                                       0xc
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_INIT__SHIFT                                         0x10
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_REFDIV_MASK                                         0x0000000FL
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_ENABLE_MASK                                         0x00001000L
+#define DCHUBBUB_GLOBAL_TIMER_CNTL__DCHUBBUB_GLOBAL_TIMER_INIT_MASK                                           0xFFFF0000L
+//SURFACE_CHECK0_ADDRESS_LSB
+#define SURFACE_CHECK0_ADDRESS_LSB__SURFACE_CHECK0_ADDRESS_LSB__SHIFT                                         0x0
+#define SURFACE_CHECK0_ADDRESS_LSB__SURFACE_CHECK0_ADDRESS_LSB_MASK                                           0xFFFFFFFFL
+//SURFACE_CHECK0_ADDRESS_MSB
+#define SURFACE_CHECK0_ADDRESS_MSB__SURFACE_CHECK0_ADDRESS_MSB__SHIFT                                         0x0
+#define SURFACE_CHECK0_ADDRESS_MSB__CHECKER0_SURFACE_INUSE__SHIFT                                             0x1f
+#define SURFACE_CHECK0_ADDRESS_MSB__SURFACE_CHECK0_ADDRESS_MSB_MASK                                           0x0000FFFFL
+#define SURFACE_CHECK0_ADDRESS_MSB__CHECKER0_SURFACE_INUSE_MASK                                               0x80000000L
+//SURFACE_CHECK1_ADDRESS_LSB
+#define SURFACE_CHECK1_ADDRESS_LSB__SURFACE_CHECK1_ADDRESS_LSB__SHIFT                                         0x0
+#define SURFACE_CHECK1_ADDRESS_LSB__SURFACE_CHECK1_ADDRESS_LSB_MASK                                           0xFFFFFFFFL
+//SURFACE_CHECK1_ADDRESS_MSB
+#define SURFACE_CHECK1_ADDRESS_MSB__SURFACE_CHECK1_ADDRESS_MSB__SHIFT                                         0x0
+#define SURFACE_CHECK1_ADDRESS_MSB__CHECKER1_SURFACE_INUSE__SHIFT                                             0x1f
+#define SURFACE_CHECK1_ADDRESS_MSB__SURFACE_CHECK1_ADDRESS_MSB_MASK                                           0x0000FFFFL
+#define SURFACE_CHECK1_ADDRESS_MSB__CHECKER1_SURFACE_INUSE_MASK                                               0x80000000L
+//SURFACE_CHECK2_ADDRESS_LSB
+#define SURFACE_CHECK2_ADDRESS_LSB__SURFACE_CHECK2_ADDRESS_LSB__SHIFT                                         0x0
+#define SURFACE_CHECK2_ADDRESS_LSB__SURFACE_CHECK2_ADDRESS_LSB_MASK                                           0xFFFFFFFFL
+//SURFACE_CHECK2_ADDRESS_MSB
+#define SURFACE_CHECK2_ADDRESS_MSB__SURFACE_CHECK2_ADDRESS_MSB__SHIFT                                         0x0
+#define SURFACE_CHECK2_ADDRESS_MSB__CHECKER2_SURFACE_INUSE__SHIFT                                             0x1f
+#define SURFACE_CHECK2_ADDRESS_MSB__SURFACE_CHECK2_ADDRESS_MSB_MASK                                           0x0000FFFFL
+#define SURFACE_CHECK2_ADDRESS_MSB__CHECKER2_SURFACE_INUSE_MASK                                               0x80000000L
+//SURFACE_CHECK3_ADDRESS_LSB
+#define SURFACE_CHECK3_ADDRESS_LSB__SURFACE_CHECK3_ADDRESS_LSB__SHIFT                                         0x0
+#define SURFACE_CHECK3_ADDRESS_LSB__SURFACE_CHECK3_ADDRESS_LSB_MASK                                           0xFFFFFFFFL
+//SURFACE_CHECK3_ADDRESS_MSB
+#define SURFACE_CHECK3_ADDRESS_MSB__SURFACE_CHECK3_ADDRESS_MSB__SHIFT                                         0x0
+#define SURFACE_CHECK3_ADDRESS_MSB__CHECKER3_SURFACE_INUSE__SHIFT                                             0x1f
+#define SURFACE_CHECK3_ADDRESS_MSB__SURFACE_CHECK3_ADDRESS_MSB_MASK                                           0x0000FFFFL
+#define SURFACE_CHECK3_ADDRESS_MSB__CHECKER3_SURFACE_INUSE_MASK                                               0x80000000L
+//VTG0_CONTROL
+#define VTG0_CONTROL__VTG0_FP2__SHIFT                                                                         0x0
+#define VTG0_CONTROL__VTG0_VCOUNT_INIT__SHIFT                                                                 0x10
+#define VTG0_CONTROL__VTG0_ENABLE__SHIFT                                                                      0x1f
+#define VTG0_CONTROL__VTG0_FP2_MASK                                                                           0x00007FFFL
+#define VTG0_CONTROL__VTG0_VCOUNT_INIT_MASK                                                                   0x7FFF0000L
+#define VTG0_CONTROL__VTG0_ENABLE_MASK                                                                        0x80000000L
+//VTG1_CONTROL
+#define VTG1_CONTROL__VTG1_FP2__SHIFT                                                                         0x0
+#define VTG1_CONTROL__VTG1_VCOUNT_INIT__SHIFT                                                                 0x10
+#define VTG1_CONTROL__VTG1_ENABLE__SHIFT                                                                      0x1f
+#define VTG1_CONTROL__VTG1_FP2_MASK                                                                           0x00007FFFL
+#define VTG1_CONTROL__VTG1_VCOUNT_INIT_MASK                                                                   0x7FFF0000L
+#define VTG1_CONTROL__VTG1_ENABLE_MASK                                                                        0x80000000L
+//VTG2_CONTROL
+#define VTG2_CONTROL__VTG2_FP2__SHIFT                                                                         0x0
+#define VTG2_CONTROL__VTG2_VCOUNT_INIT__SHIFT                                                                 0x10
+#define VTG2_CONTROL__VTG2_ENABLE__SHIFT                                                                      0x1f
+#define VTG2_CONTROL__VTG2_FP2_MASK                                                                           0x00007FFFL
+#define VTG2_CONTROL__VTG2_VCOUNT_INIT_MASK                                                                   0x7FFF0000L
+#define VTG2_CONTROL__VTG2_ENABLE_MASK                                                                        0x80000000L
+//VTG3_CONTROL
+#define VTG3_CONTROL__VTG3_FP2__SHIFT                                                                         0x0
+#define VTG3_CONTROL__VTG3_VCOUNT_INIT__SHIFT                                                                 0x10
+#define VTG3_CONTROL__VTG3_ENABLE__SHIFT                                                                      0x1f
+#define VTG3_CONTROL__VTG3_FP2_MASK                                                                           0x00007FFFL
+#define VTG3_CONTROL__VTG3_VCOUNT_INIT_MASK                                                                   0x7FFF0000L
+#define VTG3_CONTROL__VTG3_ENABLE_MASK                                                                        0x80000000L
+//DCHUBBUB_SOFT_RESET
+#define DCHUBBUB_SOFT_RESET__DCHUBBUB_GLOBAL_SOFT_RESET__SHIFT                                                0x0
+#define DCHUBBUB_SOFT_RESET__ALLOW_CSTATE_SOFT_RESET__SHIFT                                                   0x1
+#define DCHUBBUB_SOFT_RESET__GLBFLIP_SOFT_RESET__SHIFT                                                        0x4
+#define DCHUBBUB_SOFT_RESET__DCHUBBUB_GLOBAL_SOFT_RESET_MASK                                                  0x00000001L
+#define DCHUBBUB_SOFT_RESET__ALLOW_CSTATE_SOFT_RESET_MASK                                                     0x00000002L
+#define DCHUBBUB_SOFT_RESET__GLBFLIP_SOFT_RESET_MASK                                                          0x00000010L
+//DCHUBBUB_CLOCK_CNTL
+#define DCHUBBUB_CLOCK_CNTL__DCHUBBUB_TEST_CLK_SEL__SHIFT                                                     0x0
+#define DCHUBBUB_CLOCK_CNTL__DISPCLK_R_DCHUBBUB_GATE_DIS__SHIFT                                               0x5
+#define DCHUBBUB_CLOCK_CNTL__DCFCLK_R_DCHUBBUB_GATE_DIS__SHIFT                                                0x6
+#define DCHUBBUB_CLOCK_CNTL__DCHUBBUB_FGCG_REP_DIS__SHIFT                                                     0x7
+#define DCHUBBUB_CLOCK_CNTL__DCHUBBUB_TEST_CLK_SEL_MASK                                                       0x0000001FL
+#define DCHUBBUB_CLOCK_CNTL__DISPCLK_R_DCHUBBUB_GATE_DIS_MASK                                                 0x00000020L
+#define DCHUBBUB_CLOCK_CNTL__DCFCLK_R_DCHUBBUB_GATE_DIS_MASK                                                  0x00000040L
+#define DCHUBBUB_CLOCK_CNTL__DCHUBBUB_FGCG_REP_DIS_MASK                                                       0x00000080L
+//DCFCLK_CNTL
+#define DCFCLK_CNTL__DCFCLK_TURN_ON_DELAY__SHIFT                                                              0x0
+#define DCFCLK_CNTL__DCFCLK_TURN_OFF_DELAY__SHIFT                                                             0x4
+#define DCFCLK_CNTL__DCFCLK_GATE_DIS__SHIFT                                                                   0x1f
+#define DCFCLK_CNTL__DCFCLK_TURN_ON_DELAY_MASK                                                                0x0000000FL
+#define DCFCLK_CNTL__DCFCLK_TURN_OFF_DELAY_MASK                                                               0x00000FF0L
+#define DCFCLK_CNTL__DCFCLK_GATE_DIS_MASK                                                                     0x80000000L
+//DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__DCHUBBUB_LATENCY_CNT_EN__SHIFT                                 0x0
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__DCHUBBUB_DF_REQ_CMD_LATENCY_SEL__SHIFT                         0x1
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ARB_LATENCY_PIPE_SEL__SHIFT                                    0x2
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ARB_LATENCY_REQ_TYPE_SEL__SHIFT                                0x6
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ROB_FIFO_LEVEL__SHIFT                                          0x9
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_UNIT_ID_MASK__SHIFT                                        0x14
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_UNIT_ID_SEL__SHIFT                                         0x19
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_SVP_SEL__SHIFT                                             0x1e
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__DCHUBBUB_LATENCY_CNT_EN_MASK                                   0x00000001L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__DCHUBBUB_DF_REQ_CMD_LATENCY_SEL_MASK                           0x00000002L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ARB_LATENCY_PIPE_SEL_MASK                                      0x0000003CL
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ARB_LATENCY_REQ_TYPE_SEL_MASK                                  0x000001C0L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__ROB_FIFO_LEVEL_MASK                                            0x000FFE00L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_UNIT_ID_MASK_MASK                                          0x01F00000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_UNIT_ID_SEL_MASK                                           0x3E000000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL__REQ_SVP_SEL_MASK                                               0xC0000000L
+//DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_EN__SHIFT                          0x0
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_SRC_SEL__SHIFT                     0x1
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_DUR__SHIFT                         0x4
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__LATENCY_SOURCE_SEL__SHIFT                                     0xc
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__LATENCY_DEBUG_SEL__SHIFT                                      0x10
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__UTM_FILTER_SEL__SHIFT                                         0x11
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__ROB_MAX_FIFO_LEVEL__SHIFT                                     0x13
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__ROB_MAX_FIFO_LEVEL_RESET__SHIFT                               0x1f
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_EN_MASK                            0x00000001L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_SRC_SEL_MASK                       0x0000000EL
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__DCHUBBUB_LATENCY_FRAME_WIN_DUR_MASK                           0x00000FF0L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__LATENCY_SOURCE_SEL_MASK                                       0x0000F000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__LATENCY_DEBUG_SEL_MASK                                        0x00010000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__UTM_FILTER_SEL_MASK                                           0x00060000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__ROB_MAX_FIFO_LEVEL_MASK                                       0x7FF80000L
+#define DCHUBBUB_PERFORMANCE_MEASUREMENT_CNTL2__ROB_MAX_FIFO_LEVEL_RESET_MASK                                 0x80000000L
+//DCHUBBUB_VLINE_SNAPSHOT
+#define DCHUBBUB_VLINE_SNAPSHOT__DCHUBBUB_VLINE_SNAPSHOT__SHIFT                                               0x0
+#define DCHUBBUB_VLINE_SNAPSHOT__DCHUBBUB_VLINE_SNAPSHOT_MASK                                                 0x00000001L
+//DCHUBBUB_CTRL_STATUS
+#define DCHUBBUB_CTRL_STATUS__ROB_UNDERFLOW_STATUS__SHIFT                                                     0x1
+#define DCHUBBUB_CTRL_STATUS__ROB_OVERFLOW_STATUS__SHIFT                                                      0x2
+#define DCHUBBUB_CTRL_STATUS__ROB_OVERFLOW_CLEAR__SHIFT                                                       0x3
+#define DCHUBBUB_CTRL_STATUS__DCHUBBUB_HW_DEBUG__SHIFT                                                        0x4
+#define DCHUBBUB_CTRL_STATUS__CSTATE_SWATH_CHK_GOOD_MODE__SHIFT                                               0x1f
+#define DCHUBBUB_CTRL_STATUS__ROB_UNDERFLOW_STATUS_MASK                                                       0x00000002L
+#define DCHUBBUB_CTRL_STATUS__ROB_OVERFLOW_STATUS_MASK                                                        0x00000004L
+#define DCHUBBUB_CTRL_STATUS__ROB_OVERFLOW_CLEAR_MASK                                                         0x00000008L
+#define DCHUBBUB_CTRL_STATUS__DCHUBBUB_HW_DEBUG_MASK                                                          0x3FFFFFF0L
+#define DCHUBBUB_CTRL_STATUS__CSTATE_SWATH_CHK_GOOD_MODE_MASK                                                 0x80000000L
+//DCHUBBUB_TIMEOUT_DETECTION_CTRL1
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL1__DCHUBBUB_TIMEOUT_ERROR_STATUS__SHIFT                                0x0
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL1__DCHUBBUB_TIMEOUT_REQ_STALL_THRESHOLD__SHIFT                         0x6
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL1__DCHUBBUB_TIMEOUT_ERROR_STATUS_MASK                                  0x0000003FL
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL1__DCHUBBUB_TIMEOUT_REQ_STALL_THRESHOLD_MASK                           0xFFFFFFC0L
+//DCHUBBUB_TIMEOUT_DETECTION_CTRL2
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_PSTATE_STALL_THRESHOLD__SHIFT                      0x0
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_DETECTION_EN__SHIFT                                0x1b
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_TIMER_RESET__SHIFT                                 0x1c
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_PSTATE_STALL_THRESHOLD_MASK                        0x07FFFFFFL
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_DETECTION_EN_MASK                                  0x08000000L
+#define DCHUBBUB_TIMEOUT_DETECTION_CTRL2__DCHUBBUB_TIMEOUT_TIMER_RESET_MASK                                   0x10000000L
+//DCHUBBUB_TIMEOUT_INTERRUPT_STATUS
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_ENABLE__SHIFT                                 0x0
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_STATUS__SHIFT                                 0x1
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_CLEAR__SHIFT                                  0x2
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_MASK__SHIFT                                   0x3
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_ENABLE_MASK                                   0x00000001L
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_STATUS_MASK                                   0x00000002L
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_CLEAR_MASK                                    0x00000004L
+#define DCHUBBUB_TIMEOUT_INTERRUPT_STATUS__DCHUBBUB_TIMEOUT_INT_MASK_MASK                                     0x000000F8L
+//FMON_CTRL
+#define FMON_CTRL__FMON_START__SHIFT                                                                          0x0
+#define FMON_CTRL__FMON_MODE__SHIFT                                                                           0x1
+#define FMON_CTRL__FMON_PSTATE_IGNORE__SHIFT                                                                  0x4
+#define FMON_CTRL__FMON_STATUS_IGNORE__SHIFT                                                                  0x5
+#define FMON_CTRL__FMON_URG_MODE_GREATER__SHIFT                                                               0x6
+#define FMON_CTRL__FMON_FILTER_UID_EN__SHIFT                                                                  0x7
+#define FMON_CTRL__FMON_STATE__SHIFT                                                                          0x9
+#define FMON_CTRL__FMON_URG_FILTER__SHIFT                                                                     0xc
+#define FMON_CTRL__FMON_URG_THRESHOLD__SHIFT                                                                  0xd
+#define FMON_CTRL__FMON_FILTER_UID_1__SHIFT                                                                   0x11
+#define FMON_CTRL__FMON_FILTER_UID_2__SHIFT                                                                   0x16
+#define FMON_CTRL__FMON_SOF_SEL__SHIFT                                                                        0x1b
+#define FMON_CTRL__FMON_START_MASK                                                                            0x00000001L
+#define FMON_CTRL__FMON_MODE_MASK                                                                             0x00000006L
+#define FMON_CTRL__FMON_PSTATE_IGNORE_MASK                                                                    0x00000010L
+#define FMON_CTRL__FMON_STATUS_IGNORE_MASK                                                                    0x00000020L
+#define FMON_CTRL__FMON_URG_MODE_GREATER_MASK                                                                 0x00000040L
+#define FMON_CTRL__FMON_FILTER_UID_EN_MASK                                                                    0x00000180L
+#define FMON_CTRL__FMON_STATE_MASK                                                                            0x00000600L
+#define FMON_CTRL__FMON_URG_FILTER_MASK                                                                       0x00001000L
+#define FMON_CTRL__FMON_URG_THRESHOLD_MASK                                                                    0x0001E000L
+#define FMON_CTRL__FMON_FILTER_UID_1_MASK                                                                     0x003E0000L
+#define FMON_CTRL__FMON_FILTER_UID_2_MASK                                                                     0x07C00000L
+#define FMON_CTRL__FMON_SOF_SEL_MASK                                                                          0x38000000L
+//DCHUBBUB_TEST_DEBUG_INDEX
+#define DCHUBBUB_TEST_DEBUG_INDEX__DCHUBBUB_TEST_DEBUG_INDEX__SHIFT                                           0x0
+#define DCHUBBUB_TEST_DEBUG_INDEX__DCHUBBUB_TEST_DEBUG_INDEX_MASK                                             0x000000FFL
+//DCHUBBUB_TEST_DEBUG_DATA
+#define DCHUBBUB_TEST_DEBUG_DATA__DCHUBBUB_TEST_DEBUG_DATA__SHIFT                                             0x0
+#define DCHUBBUB_TEST_DEBUG_DATA__DCHUBBUB_TEST_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_sdpif_dispdec
+//DCHUBBUB_SDPIF_CFG0
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_NO_OUTSTANDING_REQ__SHIFT                                                  0x0
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_PORT_STATUS__SHIFT                                                         0x1
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_DATA_RESPONSE_STATUS__SHIFT                                                0x3
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_STATUS__SHIFT                                                     0x6
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_ERROR__SHIFT                                                    0xa
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_STATUS_CLEAR__SHIFT                                               0xb
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_ERROR_CLEAR__SHIFT                                              0xc
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_FLUSH_REQ_CREDIT_EN__SHIFT                                                 0xd
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_EN__SHIFT                                                       0xe
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_PORT_CONTROL__SHIFT                                                        0xf
+#define DCHUBBUB_SDPIF_CFG0__DF_CSTATE_DISALLOW__SHIFT                                                        0x10
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_DECODE_STATUS__SHIFT                                              0x11
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_CREDIT_DISCONNECT_DELAY__SHIFT                                             0x19
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_SKIP_VDCI_EMPTY_CHECK__SHIFT                                               0x1f
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_NO_OUTSTANDING_REQ_MASK                                                    0x00000001L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_PORT_STATUS_MASK                                                           0x00000006L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_DATA_RESPONSE_STATUS_MASK                                                  0x00000038L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_STATUS_MASK                                                       0x000003C0L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_ERROR_MASK                                                      0x00000400L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_STATUS_CLEAR_MASK                                                 0x00000800L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_ERROR_CLEAR_MASK                                                0x00001000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_FLUSH_REQ_CREDIT_EN_MASK                                                   0x00002000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_REQ_CREDIT_EN_MASK                                                         0x00004000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_PORT_CONTROL_MASK                                                          0x00008000L
+#define DCHUBBUB_SDPIF_CFG0__DF_CSTATE_DISALLOW_MASK                                                          0x00010000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_RESPONSE_DECODE_STATUS_MASK                                                0x000E0000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_CREDIT_DISCONNECT_DELAY_MASK                                               0x7E000000L
+#define DCHUBBUB_SDPIF_CFG0__SDPIF_SKIP_VDCI_EMPTY_CHECK_MASK                                                 0x80000000L
+//DCHUBBUB_SDPIF_CFG1
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_DETECT_EN__SHIFT                                                 0x0
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_STATUS__SHIFT                                                    0x1
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_STATUS_CLEAR__SHIFT                                              0x2
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_DETECT_EN__SHIFT                                                 0x4
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_STATUS__SHIFT                                                    0x5
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_STATUS_CLEAR__SHIFT                                              0x6
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_FORCE_SNOOP__SHIFT                                                         0x8
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_MAX_NUM_OUTSTANDING__SHIFT                                                 0x9
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_FORCE_READ_UNCOMPRESSED__SHIFT                                             0xa
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_UTM_DOWN_GRADE_WHEN_NO_OUTSTANDING_REQ_DISABLE__SHIFT                      0xb
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_DETECT_EN_MASK                                                   0x00000001L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_STATUS_MASK                                                      0x00000002L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_PRQ_ERROR_STATUS_CLEAR_MASK                                                0x00000004L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_DETECT_EN_MASK                                                   0x00000010L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_STATUS_MASK                                                      0x00000020L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_DRQ_ERROR_STATUS_CLEAR_MASK                                                0x00000040L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_FORCE_SNOOP_MASK                                                           0x00000100L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_MAX_NUM_OUTSTANDING_MASK                                                   0x00000200L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_FORCE_READ_UNCOMPRESSED_MASK                                               0x00000400L
+#define DCHUBBUB_SDPIF_CFG1__SDPIF_UTM_DOWN_GRADE_WHEN_NO_OUTSTANDING_REQ_DISABLE_MASK                        0x00000800L
+//DCHUBBUB_SDPIF_CFG2
+#define DCHUBBUB_SDPIF_CFG2__dGPU_ADDR_PRESENT__SHIFT                                                         0x0
+#define DCHUBBUB_SDPIF_CFG2__SDPIF_HOSTVM_SEC_LVL__SHIFT                                                      0x8
+#define DCHUBBUB_SDPIF_CFG2__SDPIF_UNIT_ID_BITMASK__SHIFT                                                     0x10
+#define DCHUBBUB_SDPIF_CFG2__dGPU_ADDR_PRESENT_MASK                                                           0x00000001L
+#define DCHUBBUB_SDPIF_CFG2__SDPIF_HOSTVM_SEC_LVL_MASK                                                        0x00000F00L
+#define DCHUBBUB_SDPIF_CFG2__SDPIF_UNIT_ID_BITMASK_MASK                                                       0x01FF0000L
+//VM_REQUEST_PHYSICAL
+#define VM_REQUEST_PHYSICAL__PDE_REQUEST_PHYSICAL__SHIFT                                                      0x0
+#define VM_REQUEST_PHYSICAL__PTE_REQUEST_PHYSICAL__SHIFT                                                      0x3
+#define VM_REQUEST_PHYSICAL__PDE_REQUEST_PHYSICAL_MASK                                                        0x00000001L
+#define VM_REQUEST_PHYSICAL__PTE_REQUEST_PHYSICAL_MASK                                                        0x00000008L
+//DCHUBBUB_FORCE_IO_STATUS_0
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS__SHIFT                                              0x0
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_STICKY__SHIFT                                       0x1
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_CLEAR__SHIFT                                        0x2
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_PIPE_ID__SHIFT                                      0x3
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_REQUEST_TYPE__SHIFT                                 0x7
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_ADDR_LO__SHIFT                                      0xa
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_MASK                                                0x00000001L
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_STICKY_MASK                                         0x00000002L
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_CLEAR_MASK                                          0x00000004L
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_PIPE_ID_MASK                                        0x00000078L
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_REQUEST_TYPE_MASK                                   0x00000380L
+#define DCHUBBUB_FORCE_IO_STATUS_0__SDPIF_FORCE_IO_STATUS_ADDR_LO_MASK                                        0xFFFFFC00L
+//DCHUBBUB_FORCE_IO_STATUS_1
+#define DCHUBBUB_FORCE_IO_STATUS_1__SDPIF_FORCE_IO_STATUS_ADDR_HI__SHIFT                                      0x0
+#define DCHUBBUB_FORCE_IO_STATUS_1__SDPIF_FORCE_IO_STATUS_ADDR_HI_MASK                                        0x001FFFFFL
+//DCN_VM_FB_LOCATION_BASE
+#define DCN_VM_FB_LOCATION_BASE__FB_BASE__SHIFT                                                               0x0
+#define DCN_VM_FB_LOCATION_BASE__FB_BASE_MASK                                                                 0x00FFFFFFL
+//DCN_VM_FB_LOCATION_TOP
+#define DCN_VM_FB_LOCATION_TOP__FB_TOP__SHIFT                                                                 0x0
+#define DCN_VM_FB_LOCATION_TOP__FB_TOP_MASK                                                                   0x00FFFFFFL
+//DCN_VM_FB_OFFSET
+#define DCN_VM_FB_OFFSET__FB_OFFSET__SHIFT                                                                    0x0
+#define DCN_VM_FB_OFFSET__FB_OFFSET_MASK                                                                      0x00FFFFFFL
+//DCN_VM_AGP_BOT
+#define DCN_VM_AGP_BOT__AGP_BOT__SHIFT                                                                        0x0
+#define DCN_VM_AGP_BOT__AGP_BOT_MASK                                                                          0x00FFFFFFL
+//DCN_VM_AGP_TOP
+#define DCN_VM_AGP_TOP__AGP_TOP__SHIFT                                                                        0x0
+#define DCN_VM_AGP_TOP__AGP_TOP_MASK                                                                          0x00FFFFFFL
+//DCN_VM_AGP_BASE
+#define DCN_VM_AGP_BASE__AGP_BASE__SHIFT                                                                      0x0
+#define DCN_VM_AGP_BASE__AGP_BASE_MASK                                                                        0x00FFFFFFL
+//DCN_VM_LOCAL_HBM_ADDRESS_START
+#define DCN_VM_LOCAL_HBM_ADDRESS_START__ADDRESS_START__SHIFT                                                  0x0
+#define DCN_VM_LOCAL_HBM_ADDRESS_START__ADDRESS_START_MASK                                                    0x000FFFFFL
+//DCN_VM_LOCAL_HBM_ADDRESS_END
+#define DCN_VM_LOCAL_HBM_ADDRESS_END__ADDRESS_END__SHIFT                                                      0x0
+#define DCN_VM_LOCAL_HBM_ADDRESS_END__ADDRESS_END_MASK                                                        0x000FFFFFL
+//DCN_VM_LOCAL_HBM_ADDRESS_LOCK_CNTL
+#define DCN_VM_LOCAL_HBM_ADDRESS_LOCK_CNTL__LOCK__SHIFT                                                       0x0
+#define DCN_VM_LOCAL_HBM_ADDRESS_LOCK_CNTL__LOCK_MASK                                                         0x00000001L
+//DCHUBBUB_SDPIF_PIPE_SEC_LVL
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE0_SEC_LVL__SHIFT                                               0x0
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE1_SEC_LVL__SHIFT                                               0x4
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE2_SEC_LVL__SHIFT                                               0x8
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE3_SEC_LVL__SHIFT                                               0xc
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE0_SEC_LVL_MASK                                                 0x0000000FL
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE1_SEC_LVL_MASK                                                 0x000000F0L
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE2_SEC_LVL_MASK                                                 0x00000F00L
+#define DCHUBBUB_SDPIF_PIPE_SEC_LVL__SDPIF_PIPE3_SEC_LVL_MASK                                                 0x0000F000L
+//DCHUBBUB_SDPIF_PIPE_NOALLOC
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE0_NOALLOC__SHIFT                                               0x0
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE1_NOALLOC__SHIFT                                               0x2
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE2_NOALLOC__SHIFT                                               0x4
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE3_NOALLOC__SHIFT                                               0x6
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE0_NOALLOC_MASK                                                 0x00000003L
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE1_NOALLOC_MASK                                                 0x0000000CL
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE2_NOALLOC_MASK                                                 0x00000030L
+#define DCHUBBUB_SDPIF_PIPE_NOALLOC__SDPIF_PIPE3_NOALLOC_MASK                                                 0x000000C0L
+//DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE0_DMDATA_SEC_LVL__SHIFT                                 0x0
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE1_DMDATA_SEC_LVL__SHIFT                                 0x4
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE2_DMDATA_SEC_LVL__SHIFT                                 0x8
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE3_DMDATA_SEC_LVL__SHIFT                                 0xc
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE0_DMDATA_SEC_LVL_MASK                                   0x0000000FL
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE1_DMDATA_SEC_LVL_MASK                                   0x000000F0L
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE2_DMDATA_SEC_LVL_MASK                                   0x00000F00L
+#define DCHUBBUB_SDPIF_PIPE_DMDATA_SEC_LVL__SDPIF_PIPE3_DMDATA_SEC_LVL_MASK                                   0x0000F000L
+//DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE0_CURSOR0_SEC_LVL__SHIFT                               0x0
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE1_CURSOR0_SEC_LVL__SHIFT                               0x4
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE2_CURSOR0_SEC_LVL__SHIFT                               0x8
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE3_CURSOR0_SEC_LVL__SHIFT                               0xc
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE0_CURSOR0_SEC_LVL_MASK                                 0x0000000FL
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE1_CURSOR0_SEC_LVL_MASK                                 0x000000F0L
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE2_CURSOR0_SEC_LVL_MASK                                 0x00000F00L
+#define DCHUBBUB_SDPIF_PIPE_CURSOR0_SEC_LVL__SDPIF_PIPE3_CURSOR0_SEC_LVL_MASK                                 0x0000F000L
+//DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE0_3DLUT_SEC_LVL__SHIFT                                   0x0
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE1_3DLUT_SEC_LVL__SHIFT                                   0x4
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE2_3DLUT_SEC_LVL__SHIFT                                   0x8
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE3_3DLUT_SEC_LVL__SHIFT                                   0xc
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE0_3DLUT_SEC_LVL_MASK                                     0x0000000FL
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE1_3DLUT_SEC_LVL_MASK                                     0x000000F0L
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE2_3DLUT_SEC_LVL_MASK                                     0x00000F00L
+#define DCHUBBUB_SDPIF_PIPE_3DLUT_SEC_LVL__SDPIF_PIPE3_3DLUT_SEC_LVL_MASK                                     0x0000F000L
+//DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE0_GPUVM_SEC_LVL__SHIFT                                   0x0
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE1_GPUVM_SEC_LVL__SHIFT                                   0x4
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE2_GPUVM_SEC_LVL__SHIFT                                   0x8
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE3_GPUVM_SEC_LVL__SHIFT                                   0xc
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE0_GPUVM_SEC_LVL_MASK                                     0x0000000FL
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE1_GPUVM_SEC_LVL_MASK                                     0x000000F0L
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE2_GPUVM_SEC_LVL_MASK                                     0x00000F00L
+#define DCHUBBUB_SDPIF_PIPE_GPUVM_SEC_LVL__SDPIF_PIPE3_GPUVM_SEC_LVL_MASK                                     0x0000F000L
+//DCHUBBUB_SDPIF_PIPE_DATAFETCH
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE0_DATAFETCH__SHIFT                                           0x0
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE1_DATAFETCH__SHIFT                                           0x2
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE2_DATAFETCH__SHIFT                                           0x4
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE3_DATAFETCH__SHIFT                                           0x6
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE0_DATAFETCH_MASK                                             0x00000003L
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE1_DATAFETCH_MASK                                             0x0000000CL
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE2_DATAFETCH_MASK                                             0x00000030L
+#define DCHUBBUB_SDPIF_PIPE_DATAFETCH__SDPIF_PIPE3_DATAFETCH_MASK                                             0x000000C0L
+//SDPIF_REQUEST_RATE_LIMIT
+#define SDPIF_REQUEST_RATE_LIMIT__SDPIF_REQUEST_RATE_LIMIT__SHIFT                                             0x0
+#define SDPIF_REQUEST_RATE_LIMIT__SDPIF_REQUEST_RATE_LIMIT_MASK                                               0x00000FFFL
+//DCHUBBUB_SDPIF_MEM_PWR_CTRL
+#define DCHUBBUB_SDPIF_MEM_PWR_CTRL__DCHUBBUB_SDPIF_MEM_PWR_FORCE__SHIFT                                      0x0
+#define DCHUBBUB_SDPIF_MEM_PWR_CTRL__DCHUBBUB_SDPIF_MEM_PWR_DIS__SHIFT                                        0x2
+#define DCHUBBUB_SDPIF_MEM_PWR_CTRL__DCHUBBUB_SDPIF_MEM_PWR_FORCE_MASK                                        0x00000003L
+#define DCHUBBUB_SDPIF_MEM_PWR_CTRL__DCHUBBUB_SDPIF_MEM_PWR_DIS_MASK                                          0x00000004L
+//DCHUBBUB_SDPIF_MEM_PWR_STATUS
+#define DCHUBBUB_SDPIF_MEM_PWR_STATUS__DCHUBBUB_SDPIF_MEM_PWR_STATE__SHIFT                                    0x0
+#define DCHUBBUB_SDPIF_MEM_PWR_STATUS__DCHUBBUB_SDPIF_MEM_PWR_STATE_MASK                                      0x00000003L
+//DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE0__SHIFT                 0x0
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE1__SHIFT                 0x1
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE2__SHIFT                 0x2
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE3__SHIFT                 0x3
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE0__SHIFT            0xc
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE1__SHIFT            0xd
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE2__SHIFT            0xe
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE3__SHIFT            0xf
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_ENABLE__SHIFT                 0x1c
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_VREADY_MODE__SHIFT                0x1f
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE0_MASK                   0x00000001L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE1_MASK                   0x00000002L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE2_MASK                   0x00000004L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_FLIP_AWAY_MISSING_PIPE3_MASK                   0x00000008L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE0_MASK              0x00001000L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE1_MASK              0x00002000L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE2_MASK              0x00004000L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_CLEAR_PIPE3_MASK              0x00008000L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_ERR_ENABLE_MASK                   0x10000000L
+#define DCHUBBUB_SDPIF_MCACHE_INVALIDATION_CTL__DCHUBBUB_SDPIF_MCACHEID_INV_VREADY_MODE_MASK                  0x80000000L
+//UTM_CAPABILITIES_0
+#define UTM_CAPABILITIES_0__UTM_MAJOR_VERSION__SHIFT                                                          0x0
+#define UTM_CAPABILITIES_0__UTM_MINOR_VERSION__SHIFT                                                          0x4
+#define UTM_CAPABILITIES_0__RESERVED__SHIFT                                                                   0x8
+#define UTM_CAPABILITIES_0__INT_PRIO__SHIFT                                                                   0x1d
+#define UTM_CAPABILITIES_0__OT_LIMIT__SHIFT                                                                   0x1e
+#define UTM_CAPABILITIES_0__BW_ALLOC__SHIFT                                                                   0x1f
+#define UTM_CAPABILITIES_0__UTM_MAJOR_VERSION_MASK                                                            0x0000000FL
+#define UTM_CAPABILITIES_0__UTM_MINOR_VERSION_MASK                                                            0x000000F0L
+#define UTM_CAPABILITIES_0__RESERVED_MASK                                                                     0x1FFFFF00L
+#define UTM_CAPABILITIES_0__INT_PRIO_MASK                                                                     0x20000000L
+#define UTM_CAPABILITIES_0__OT_LIMIT_MASK                                                                     0x40000000L
+#define UTM_CAPABILITIES_0__BW_ALLOC_MASK                                                                     0x80000000L
+//UTM_CONFIGURATION_0
+#define UTM_CONFIGURATION_0__NUM_SYSTEM_PROFILES__SHIFT                                                       0x0
+#define UTM_CONFIGURATION_0__RESERVED0__SHIFT                                                                 0x6
+#define UTM_CONFIGURATION_0__NUM_CLIENT_PROFILES__SHIFT                                                       0x8
+#define UTM_CONFIGURATION_0__RESERVED1__SHIFT                                                                 0xd
+#define UTM_CONFIGURATION_0__WINDOW_WIDTH__SHIFT                                                              0x10
+#define UTM_CONFIGURATION_0__NUM_INT_PRIOLVLS__SHIFT                                                          0x14
+#define UTM_CONFIGURATION_0__RESERVED2__SHIFT                                                                 0x18
+#define UTM_CONFIGURATION_0__UTM_ENABLE__SHIFT                                                                0x1f
+#define UTM_CONFIGURATION_0__NUM_SYSTEM_PROFILES_MASK                                                         0x0000003FL
+#define UTM_CONFIGURATION_0__RESERVED0_MASK                                                                   0x000000C0L
+#define UTM_CONFIGURATION_0__NUM_CLIENT_PROFILES_MASK                                                         0x00001F00L
+#define UTM_CONFIGURATION_0__RESERVED1_MASK                                                                   0x0000E000L
+#define UTM_CONFIGURATION_0__WINDOW_WIDTH_MASK                                                                0x000F0000L
+#define UTM_CONFIGURATION_0__NUM_INT_PRIOLVLS_MASK                                                            0x00F00000L
+#define UTM_CONFIGURATION_0__RESERVED2_MASK                                                                   0x7F000000L
+#define UTM_CONFIGURATION_0__UTM_ENABLE_MASK                                                                  0x80000000L
+//UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC0__SHIFT                                     0x0
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED0__SHIFT                                              0x6
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC1__SHIFT                                     0x8
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED1__SHIFT                                              0xe
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC2__SHIFT                                     0x10
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED2__SHIFT                                              0x16
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC3__SHIFT                                     0x18
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED3__SHIFT                                              0x1e
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC0_MASK                                       0x0000003FL
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED0_MASK                                                0x000000C0L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC1_MASK                                       0x00003F00L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED1_MASK                                                0x0000C000L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC2_MASK                                       0x003F0000L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED2_MASK                                                0x00C00000L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__SYSTEM_PROFILE_QC3_MASK                                       0x3F000000L
+#define UTM_CLIENT_TO_SYSTEM_PROFILE_MAPPING_0__RESERVED3_MASK                                                0xC0000000L
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_ret_path_dispdec
+//DCHUBBUB_RET_PATH_MEM_PWR_CTRL
+#define DCHUBBUB_RET_PATH_MEM_PWR_CTRL__DCHUBBUB_RET_PATH_MEM_PWR_FORCE__SHIFT                                0x0
+#define DCHUBBUB_RET_PATH_MEM_PWR_CTRL__DCHUBBUB_RET_PATH_MEM_PWR_DIS__SHIFT                                  0x2
+#define DCHUBBUB_RET_PATH_MEM_PWR_CTRL__DCHUBBUB_RET_PATH_MEM_PWR_FORCE_MASK                                  0x00000003L
+#define DCHUBBUB_RET_PATH_MEM_PWR_CTRL__DCHUBBUB_RET_PATH_MEM_PWR_DIS_MASK                                    0x00000004L
+//DCHUBBUB_RET_PATH_MEM_PWR_STATUS
+#define DCHUBBUB_RET_PATH_MEM_PWR_STATUS__DCHUBBUB_RET_PATH_MEM_PWR_STATE__SHIFT                              0x0
+#define DCHUBBUB_RET_PATH_MEM_PWR_STATUS__DCHUBBUB_RET_PATH_MEM_PWR_STATE_MASK                                0x00000003L
+//DCHUBBUB_CRC_CTRL
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_EN__SHIFT                                                             0x0
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_CONT_EN__SHIFT                                                        0x1
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC0_ONE_SHOT_PENDING__SHIFT                                              0x2
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC1_ONE_SHOT_PENDING__SHIFT                                              0x3
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC0_SRC_SEL__SHIFT                                                       0x4
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC1_SRC_SEL__SHIFT                                                       0x6
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_PIPE_SEL__SHIFT                                                       0x8
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_SURF_SEL__SHIFT                                                       0xc
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_DATA_SRC_SEL__SHIFT                                                   0x14
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_EN_MASK                                                               0x00000001L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_CONT_EN_MASK                                                          0x00000002L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC0_ONE_SHOT_PENDING_MASK                                                0x00000004L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC1_ONE_SHOT_PENDING_MASK                                                0x00000008L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC0_SRC_SEL_MASK                                                         0x00000030L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC1_SRC_SEL_MASK                                                         0x000000C0L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_PIPE_SEL_MASK                                                         0x00000F00L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_SURF_SEL_MASK                                                         0x00001000L
+#define DCHUBBUB_CRC_CTRL__DCHUBBUB_CRC_DATA_SRC_SEL_MASK                                                     0x00100000L
+//DCHUBBUB_CRC0_VAL_R
+#define DCHUBBUB_CRC0_VAL_R__DCHUBBUB_CRC0_R_CR__SHIFT                                                        0x0
+#define DCHUBBUB_CRC0_VAL_R__DCHUBBUB_CRC0_R_CR_MASK                                                          0xFFFFFFFFL
+//DCHUBBUB_CRC0_VAL_G
+#define DCHUBBUB_CRC0_VAL_G__DCHUBBUB_CRC0_G_Y__SHIFT                                                         0x0
+#define DCHUBBUB_CRC0_VAL_G__DCHUBBUB_CRC0_G_Y_MASK                                                           0xFFFFFFFFL
+//DCHUBBUB_CRC0_VAL_B
+#define DCHUBBUB_CRC0_VAL_B__DCHUBBUB_CRC0_B_CB__SHIFT                                                        0x0
+#define DCHUBBUB_CRC0_VAL_B__DCHUBBUB_CRC0_B_CB_MASK                                                          0xFFFFFFFFL
+//DCHUBBUB_CRC0_VAL_A
+#define DCHUBBUB_CRC0_VAL_A__DCHUBBUB_CRC0_ALPHA__SHIFT                                                       0x0
+#define DCHUBBUB_CRC0_VAL_A__DCHUBBUB_CRC0_ALPHA_MASK                                                         0xFFFFFFFFL
+//DCHUBBUB_CRC1_VAL_R
+#define DCHUBBUB_CRC1_VAL_R__DCHUBBUB_CRC1_R_CR__SHIFT                                                        0x0
+#define DCHUBBUB_CRC1_VAL_R__DCHUBBUB_CRC1_R_CR_MASK                                                          0xFFFFFFFFL
+//DCHUBBUB_CRC1_VAL_G
+#define DCHUBBUB_CRC1_VAL_G__DCHUBBUB_CRC1_G_Y__SHIFT                                                         0x0
+#define DCHUBBUB_CRC1_VAL_G__DCHUBBUB_CRC1_G_Y_MASK                                                           0xFFFFFFFFL
+//DCHUBBUB_CRC1_VAL_B
+#define DCHUBBUB_CRC1_VAL_B__DCHUBBUB_CRC1_B_CB__SHIFT                                                        0x0
+#define DCHUBBUB_CRC1_VAL_B__DCHUBBUB_CRC1_B_CB_MASK                                                          0xFFFFFFFFL
+//DCHUBBUB_CRC1_VAL_A
+#define DCHUBBUB_CRC1_VAL_A__DCHUBBUB_CRC1_ALPHA__SHIFT                                                       0x0
+#define DCHUBBUB_CRC1_VAL_A__DCHUBBUB_CRC1_ALPHA_MASK                                                         0xFFFFFFFFL
+//DCHUBBUB_DCC_STAT_CNTL
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_MODE__SHIFT                                                 0x0
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_EN__SHIFT                                                   0x1
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_DONE__SHIFT                                                 0x2
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_PIPE_SEL__SHIFT                                             0x4
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_FRAME_CNT__SHIFT                                            0x10
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_MODE_MASK                                                   0x00000001L
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_EN_MASK                                                     0x00000002L
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_DONE_MASK                                                   0x00000004L
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_PIPE_SEL_MASK                                               0x000000F0L
+#define DCHUBBUB_DCC_STAT_CNTL__DCHUBBUB_DCC_STAT_FRAME_CNT_MASK                                              0xFFFF0000L
+//DCHUBBUB_DCC_STAT0
+#define DCHUBBUB_DCC_STAT0__DCHUBBUB_DCC_STAT_TOTAL_REQ__SHIFT                                                0x0
+#define DCHUBBUB_DCC_STAT0__DCHUBBUB_DCC_STAT_TOTAL_REQ_MASK                                                  0xFFFFFFFFL
+//DCHUBBUB_DCC_STAT1
+#define DCHUBBUB_DCC_STAT1__DCHUBBUB_DCC_STAT_ZS_REQ__SHIFT                                                   0x0
+#define DCHUBBUB_DCC_STAT1__DCHUBBUB_DCC_STAT_ZS_REQ_MASK                                                     0xFFFFFFFFL
+//DCHUBBUB_DCC_STAT2
+#define DCHUBBUB_DCC_STAT2__DCHUBBUB_DCC_STAT_DCC_REQ__SHIFT                                                  0x0
+#define DCHUBBUB_DCC_STAT2__DCHUBBUB_DCC_STAT_DCC_REQ_MASK                                                    0xFFFFFFFFL
+//DCHUBBUB_COMPBUF_CTRL
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE__SHIFT                                                            0x0
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CURRENT__SHIFT                                                    0x8
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_ENABLE__SHIFT                                     0x10
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_STATUS__SHIFT                                     0x12
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_CLEAR__SHIFT                                      0x13
+#define DCHUBBUB_COMPBUF_CTRL__CONFIG_ERROR__SHIFT                                                            0x1f
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_MASK                                                              0x0000001FL
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CURRENT_MASK                                                      0x00001F00L
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_ENABLE_MASK                                       0x00010000L
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_STATUS_MASK                                       0x00040000L
+#define DCHUBBUB_COMPBUF_CTRL__COMPBUF_SIZE_CHANGE_DONE_INT_CLEAR_MASK                                        0x00080000L
+#define DCHUBBUB_COMPBUF_CTRL__CONFIG_ERROR_MASK                                                              0x80000000L
+//DCHUBBUB_DET0_CTRL
+#define DCHUBBUB_DET0_CTRL__DET0_SIZE__SHIFT                                                                  0x0
+#define DCHUBBUB_DET0_CTRL__DET0_SIZE_CURRENT__SHIFT                                                          0x7
+#define DCHUBBUB_DET0_CTRL__YUV422_PACK_DET0_CROSS_Y_UV_EN__SHIFT                                             0xd
+#define DCHUBBUB_DET0_CTRL__YUV422_PACK_DET0_CROSS_Y_UV__SHIFT                                                0xe
+#define DCHUBBUB_DET0_CTRL__DET0_SIZE_MASK                                                                    0x0000003FL
+#define DCHUBBUB_DET0_CTRL__DET0_SIZE_CURRENT_MASK                                                            0x00001F80L
+#define DCHUBBUB_DET0_CTRL__YUV422_PACK_DET0_CROSS_Y_UV_EN_MASK                                               0x00002000L
+#define DCHUBBUB_DET0_CTRL__YUV422_PACK_DET0_CROSS_Y_UV_MASK                                                  0x00004000L
+//DCHUBBUB_DET1_CTRL
+#define DCHUBBUB_DET1_CTRL__DET1_SIZE__SHIFT                                                                  0x0
+#define DCHUBBUB_DET1_CTRL__DET1_SIZE_CURRENT__SHIFT                                                          0x7
+#define DCHUBBUB_DET1_CTRL__YUV422_PACK_DET1_CROSS_Y_UV_EN__SHIFT                                             0xd
+#define DCHUBBUB_DET1_CTRL__YUV422_PACK_DET1_CROSS_Y_UV__SHIFT                                                0xe
+#define DCHUBBUB_DET1_CTRL__DET1_SIZE_MASK                                                                    0x0000003FL
+#define DCHUBBUB_DET1_CTRL__DET1_SIZE_CURRENT_MASK                                                            0x00001F80L
+#define DCHUBBUB_DET1_CTRL__YUV422_PACK_DET1_CROSS_Y_UV_EN_MASK                                               0x00002000L
+#define DCHUBBUB_DET1_CTRL__YUV422_PACK_DET1_CROSS_Y_UV_MASK                                                  0x00004000L
+//DCHUBBUB_DET2_CTRL
+#define DCHUBBUB_DET2_CTRL__DET2_SIZE__SHIFT                                                                  0x0
+#define DCHUBBUB_DET2_CTRL__DET2_SIZE_CURRENT__SHIFT                                                          0x7
+#define DCHUBBUB_DET2_CTRL__YUV422_PACK_DET2_CROSS_Y_UV_EN__SHIFT                                             0xd
+#define DCHUBBUB_DET2_CTRL__YUV422_PACK_DET2_CROSS_Y_UV__SHIFT                                                0xe
+#define DCHUBBUB_DET2_CTRL__DET2_SIZE_MASK                                                                    0x0000003FL
+#define DCHUBBUB_DET2_CTRL__DET2_SIZE_CURRENT_MASK                                                            0x00001F80L
+#define DCHUBBUB_DET2_CTRL__YUV422_PACK_DET2_CROSS_Y_UV_EN_MASK                                               0x00002000L
+#define DCHUBBUB_DET2_CTRL__YUV422_PACK_DET2_CROSS_Y_UV_MASK                                                  0x00004000L
+//DCHUBBUB_DET3_CTRL
+#define DCHUBBUB_DET3_CTRL__DET3_SIZE__SHIFT                                                                  0x0
+#define DCHUBBUB_DET3_CTRL__DET3_SIZE_CURRENT__SHIFT                                                          0x7
+#define DCHUBBUB_DET3_CTRL__YUV422_PACK_DET3_CROSS_Y_UV_EN__SHIFT                                             0xd
+#define DCHUBBUB_DET3_CTRL__YUV422_PACK_DET3_CROSS_Y_UV__SHIFT                                                0xe
+#define DCHUBBUB_DET3_CTRL__DET3_SIZE_MASK                                                                    0x0000003FL
+#define DCHUBBUB_DET3_CTRL__DET3_SIZE_CURRENT_MASK                                                            0x00001F80L
+#define DCHUBBUB_DET3_CTRL__YUV422_PACK_DET3_CROSS_Y_UV_EN_MASK                                               0x00002000L
+#define DCHUBBUB_DET3_CTRL__YUV422_PACK_DET3_CROSS_Y_UV_MASK                                                  0x00004000L
+//DCHUBBUB_MEM_PWR_MODE_CTRL
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_ACCESS_MEM_PWR_MODE__SHIFT                                        0x0
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_ACTIVE_MEM_PWR_MODE__SHIFT                                        0x2
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_IDLE_MEM_PWR_MODE__SHIFT                                          0x4
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__METAFIFO_MEM_PWR_FORCE__SHIFT                                             0x6
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__UNALLOCATED_MEM_PWR_MODE__SHIFT                                           0xa
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_MEM_PWR_FORCE__SHIFT                                                  0x10
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_IDLE_MEM_PWR_MODE__SHIFT                                              0x12
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_MEM_PWR_LS_MODE__SHIFT                                                0x14
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__SEGMENT_MEM_PWR_DIS__SHIFT                                                0x18
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__METAFIFO_MEM_PWR_DIS__SHIFT                                               0x19
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_ACCESS_MEM_PWR_MODE_MASK                                          0x00000003L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_ACTIVE_MEM_PWR_MODE_MASK                                          0x0000000CL
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__COMPBUF_IDLE_MEM_PWR_MODE_MASK                                            0x00000030L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__METAFIFO_MEM_PWR_FORCE_MASK                                               0x000000C0L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__UNALLOCATED_MEM_PWR_MODE_MASK                                             0x00000C00L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_MEM_PWR_FORCE_MASK                                                    0x00030000L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_IDLE_MEM_PWR_MODE_MASK                                                0x000C0000L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__DET_MEM_PWR_LS_MODE_MASK                                                  0x00300000L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__SEGMENT_MEM_PWR_DIS_MASK                                                  0x01000000L
+#define DCHUBBUB_MEM_PWR_MODE_CTRL__METAFIFO_MEM_PWR_DIS_MASK                                                 0x02000000L
+//COMPBUF_MEM_PWR_CTRL_1
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_ACTIVE_WAKE_LATENCY__SHIFT                                            0x0
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_ACTIVE_SLEEP_LATENCY__SHIFT                                           0x8
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_IDLE_WAKE_LATENCY__SHIFT                                              0x10
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_IDLE_SLEEP_LATENCY__SHIFT                                             0x18
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_ACTIVE_WAKE_LATENCY_MASK                                              0x000000FFL
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_ACTIVE_SLEEP_LATENCY_MASK                                             0x0000FF00L
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_IDLE_WAKE_LATENCY_MASK                                                0x00FF0000L
+#define COMPBUF_MEM_PWR_CTRL_1__COMPBUF_IDLE_SLEEP_LATENCY_MASK                                               0xFF000000L
+//COMPBUF_MEM_PWR_CTRL_2
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_UNALLOCATED_WAKE_LATENCY__SHIFT                                       0x0
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_ACTIVE_ENTER_LATENCY__SHIFT                                           0x8
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_IDLE_ENTER_LATENCY__SHIFT                                             0xc
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_UNALLOCATED_WAKE_LATENCY_MASK                                         0x000000FFL
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_ACTIVE_ENTER_LATENCY_MASK                                             0x00000F00L
+#define COMPBUF_MEM_PWR_CTRL_2__COMPBUF_IDLE_ENTER_LATENCY_MASK                                               0x0000F000L
+//DCHUBBUB_MEM_PWR_STATUS
+#define DCHUBBUB_MEM_PWR_STATUS__COMPBUF_MEM_PWR_STATE__SHIFT                                                 0x0
+#define DCHUBBUB_MEM_PWR_STATUS__METAFIFO_MEM_PWR_STATE__SHIFT                                                0x2
+#define DCHUBBUB_MEM_PWR_STATUS__UNALLOCATED_MEM_PWR_STATE__SHIFT                                             0x4
+#define DCHUBBUB_MEM_PWR_STATUS__DET0_MEM_PWR_STATE__SHIFT                                                    0x8
+#define DCHUBBUB_MEM_PWR_STATUS__DET1_MEM_PWR_STATE__SHIFT                                                    0xa
+#define DCHUBBUB_MEM_PWR_STATUS__DET2_MEM_PWR_STATE__SHIFT                                                    0xc
+#define DCHUBBUB_MEM_PWR_STATUS__DET3_MEM_PWR_STATE__SHIFT                                                    0xe
+#define DCHUBBUB_MEM_PWR_STATUS__COMPBUF_MEM_PWR_STATE_MASK                                                   0x00000003L
+#define DCHUBBUB_MEM_PWR_STATUS__METAFIFO_MEM_PWR_STATE_MASK                                                  0x0000000CL
+#define DCHUBBUB_MEM_PWR_STATUS__UNALLOCATED_MEM_PWR_STATE_MASK                                               0x00000030L
+#define DCHUBBUB_MEM_PWR_STATUS__DET0_MEM_PWR_STATE_MASK                                                      0x00000300L
+#define DCHUBBUB_MEM_PWR_STATUS__DET1_MEM_PWR_STATE_MASK                                                      0x00000C00L
+#define DCHUBBUB_MEM_PWR_STATUS__DET2_MEM_PWR_STATE_MASK                                                      0x00003000L
+#define DCHUBBUB_MEM_PWR_STATUS__DET3_MEM_PWR_STATE_MASK                                                      0x0000C000L
+//COMPBUF_RESERVED_SPACE
+#define COMPBUF_RESERVED_SPACE__COMPBUF_RESERVED_SPACE_64B__SHIFT                                             0x0
+#define COMPBUF_RESERVED_SPACE__COMPBUF_RESERVED_SPACE_64B_MASK                                               0x00000FFFL
+//DCN_DECOMP_STATUS
+#define DCN_DECOMP_STATUS__DECOMP_OUT_STATUS__SHIFT                                                           0x0
+#define DCN_DECOMP_STATUS__DECOMP_OUT_STATUS_CLEAR__SHIFT                                                     0x10
+#define DCN_DECOMP_STATUS__DECOMP_OUT_STATUS_MASK                                                             0x0000FFFFL
+#define DCN_DECOMP_STATUS__DECOMP_OUT_STATUS_CLEAR_MASK                                                       0x00010000L
+//DCHUBBUB_DEBUG_CTRL_0
+#define DCHUBBUB_DEBUG_CTRL_0__DET_DEPTH__SHIFT                                                               0x10
+#define DCHUBBUB_DEBUG_CTRL_0__DET_DEPTH_MASK                                                                 0x0FFF0000L
+//DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_PENDING_STATUS__SHIFT              0x0
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_TAKEN_STATUS__SHIFT                0x1
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_TAKEN_ACK__SHIFT                   0x2
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_PENDING_STATUS__SHIFT              0x3
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_TAKEN_STATUS__SHIFT                0x4
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_TAKEN_ACK__SHIFT                   0x5
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_PENDING_STATUS__SHIFT              0x6
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_TAKEN_STATUS__SHIFT                0x7
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_TAKEN_ACK__SHIFT                   0x8
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_PENDING_STATUS__SHIFT              0x9
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_TAKEN_STATUS__SHIFT                0xa
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_TAKEN_ACK__SHIFT                   0xb
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_PENDING_STATUS_MASK                0x00000001L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_TAKEN_STATUS_MASK                  0x00000002L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG0_REG_UPDATE_TAKEN_ACK_MASK                     0x00000004L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_PENDING_STATUS_MASK                0x00000008L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_TAKEN_STATUS_MASK                  0x00000010L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG1_REG_UPDATE_TAKEN_ACK_MASK                     0x00000020L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_PENDING_STATUS_MASK                0x00000040L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_TAKEN_STATUS_MASK                  0x00000080L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG2_REG_UPDATE_TAKEN_ACK_MASK                     0x00000100L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_PENDING_STATUS_MASK                0x00000200L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_TAKEN_STATUS_MASK                  0x00000400L
+#define DCHUBBUB_RET_PATH_REG_UPDATE_PENDING_TAKEN_STATUS__CFG3_REG_UPDATE_TAKEN_ACK_MASK                     0x00000800L
+//DCHUBBUB_RET_PATH_TEST_DEBUG_INDEX
+#define DCHUBBUB_RET_PATH_TEST_DEBUG_INDEX__DCHUBBUB_RET_PATH_TEST_DEBUG_INDEX__SHIFT                         0x0
+#define DCHUBBUB_RET_PATH_TEST_DEBUG_INDEX__DCHUBBUB_RET_PATH_TEST_DEBUG_INDEX_MASK                           0x000000FFL
+//DCHUBBUB_RET_PATH_TEST_DEBUG_DATA
+#define DCHUBBUB_RET_PATH_TEST_DEBUG_DATA__DCHUBBUB_RET_PATH_TEST_DEBUG_DATA__SHIFT                           0x0
+#define DCHUBBUB_RET_PATH_TEST_DEBUG_DATA__DCHUBBUB_RET_PATH_TEST_DEBUG_DATA_MASK                             0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dchubbubl_hubbub_vmrq_if_dispdec
+//DCN_VM_CONTEXT0_CNTL
+#define DCN_VM_CONTEXT0_CNTL__VM_CONTEXT0_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT0_CNTL__VM_CONTEXT0_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT0_CNTL__VM_CONTEXT0_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT0_CNTL__VM_CONTEXT0_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT0_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT0_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT0_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT0_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT0_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT0_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT0_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT0_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT0_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT0_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT1_CNTL
+#define DCN_VM_CONTEXT1_CNTL__VM_CONTEXT1_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT1_CNTL__VM_CONTEXT1_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT1_CNTL__VM_CONTEXT1_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT1_CNTL__VM_CONTEXT1_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT1_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT1_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT1_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT1_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT1_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT1_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT1_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT1_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT1_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT1_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT1_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT1_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT1_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT2_CNTL
+#define DCN_VM_CONTEXT2_CNTL__VM_CONTEXT2_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT2_CNTL__VM_CONTEXT2_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT2_CNTL__VM_CONTEXT2_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT2_CNTL__VM_CONTEXT2_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT2_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT2_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT2_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT2_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT2_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT2_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT2_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT2_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT2_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT2_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT2_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT2_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT2_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT3_CNTL
+#define DCN_VM_CONTEXT3_CNTL__VM_CONTEXT3_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT3_CNTL__VM_CONTEXT3_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT3_CNTL__VM_CONTEXT3_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT3_CNTL__VM_CONTEXT3_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT3_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT3_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT3_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT3_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT3_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT3_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT3_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT3_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT3_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT3_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT3_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT3_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT3_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT4_CNTL
+#define DCN_VM_CONTEXT4_CNTL__VM_CONTEXT4_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT4_CNTL__VM_CONTEXT4_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT4_CNTL__VM_CONTEXT4_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT4_CNTL__VM_CONTEXT4_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT4_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT4_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT4_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT4_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT4_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT4_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT4_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT4_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT4_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT4_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT4_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT4_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT4_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT5_CNTL
+#define DCN_VM_CONTEXT5_CNTL__VM_CONTEXT5_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT5_CNTL__VM_CONTEXT5_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT5_CNTL__VM_CONTEXT5_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT5_CNTL__VM_CONTEXT5_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT5_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT5_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT5_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT5_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT5_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT5_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT5_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT5_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT5_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT5_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT5_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT5_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT5_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT6_CNTL
+#define DCN_VM_CONTEXT6_CNTL__VM_CONTEXT6_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT6_CNTL__VM_CONTEXT6_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT6_CNTL__VM_CONTEXT6_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT6_CNTL__VM_CONTEXT6_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT6_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT6_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT6_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT6_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT6_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT6_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT6_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT6_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT6_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT6_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT6_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT6_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT6_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT7_CNTL
+#define DCN_VM_CONTEXT7_CNTL__VM_CONTEXT7_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT7_CNTL__VM_CONTEXT7_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT7_CNTL__VM_CONTEXT7_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT7_CNTL__VM_CONTEXT7_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT7_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT7_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT7_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT7_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT7_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT7_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT7_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT7_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT7_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT7_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT7_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT7_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT7_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT8_CNTL
+#define DCN_VM_CONTEXT8_CNTL__VM_CONTEXT8_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT8_CNTL__VM_CONTEXT8_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT8_CNTL__VM_CONTEXT8_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT8_CNTL__VM_CONTEXT8_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT8_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT8_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT8_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT8_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT8_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT8_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT8_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT8_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT8_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT8_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT8_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT8_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT8_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT9_CNTL
+#define DCN_VM_CONTEXT9_CNTL__VM_CONTEXT9_PAGE_TABLE_DEPTH__SHIFT                                             0x1
+#define DCN_VM_CONTEXT9_CNTL__VM_CONTEXT9_PAGE_TABLE_BLOCK_SIZE__SHIFT                                        0x3
+#define DCN_VM_CONTEXT9_CNTL__VM_CONTEXT9_PAGE_TABLE_DEPTH_MASK                                               0x00000006L
+#define DCN_VM_CONTEXT9_CNTL__VM_CONTEXT9_PAGE_TABLE_BLOCK_SIZE_MASK                                          0x00000078L
+//DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT9_PAGE_DIRECTORY_ENTRY_HI32__SHIFT               0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT9_PAGE_DIRECTORY_ENTRY_HI32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT9_PAGE_DIRECTORY_ENTRY_LO32__SHIFT               0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT9_PAGE_DIRECTORY_ENTRY_LO32_MASK                 0xFFFFFFFFL
+//DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT9_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT          0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT9_START_LOGICAL_PAGE_NUMBER_HI4_MASK            0x0000000FL
+//DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT9_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT         0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT9_START_LOGICAL_PAGE_NUMBER_LO32_MASK           0xFFFFFFFFL
+//DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT9_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT              0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT9_END_LOGICAL_PAGE_NUMBER_HI4_MASK                0x0000000FL
+//DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT9_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT9_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT9_END_LOGICAL_PAGE_NUMBER_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT10_CNTL
+#define DCN_VM_CONTEXT10_CNTL__VM_CONTEXT10_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT10_CNTL__VM_CONTEXT10_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT10_CNTL__VM_CONTEXT10_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT10_CNTL__VM_CONTEXT10_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT10_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT10_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT10_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT10_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT10_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT10_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT10_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT10_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT10_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT10_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT10_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT10_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT10_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_CONTEXT11_CNTL
+#define DCN_VM_CONTEXT11_CNTL__VM_CONTEXT11_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT11_CNTL__VM_CONTEXT11_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT11_CNTL__VM_CONTEXT11_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT11_CNTL__VM_CONTEXT11_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT11_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT11_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT11_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT11_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT11_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT11_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT11_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT11_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT11_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT11_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT11_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT11_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT11_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_CONTEXT12_CNTL
+#define DCN_VM_CONTEXT12_CNTL__VM_CONTEXT12_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT12_CNTL__VM_CONTEXT12_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT12_CNTL__VM_CONTEXT12_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT12_CNTL__VM_CONTEXT12_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT12_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT12_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT12_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT12_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT12_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT12_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT12_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT12_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT12_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT12_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT12_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT12_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT12_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_CONTEXT13_CNTL
+#define DCN_VM_CONTEXT13_CNTL__VM_CONTEXT13_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT13_CNTL__VM_CONTEXT13_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT13_CNTL__VM_CONTEXT13_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT13_CNTL__VM_CONTEXT13_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT13_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT13_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT13_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT13_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT13_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT13_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT13_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT13_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT13_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT13_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT13_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT13_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT13_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_CONTEXT14_CNTL
+#define DCN_VM_CONTEXT14_CNTL__VM_CONTEXT14_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT14_CNTL__VM_CONTEXT14_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT14_CNTL__VM_CONTEXT14_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT14_CNTL__VM_CONTEXT14_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT14_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT14_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT14_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT14_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT14_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT14_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT14_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT14_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT14_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT14_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT14_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT14_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT14_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_CONTEXT15_CNTL
+#define DCN_VM_CONTEXT15_CNTL__VM_CONTEXT15_PAGE_TABLE_DEPTH__SHIFT                                           0x1
+#define DCN_VM_CONTEXT15_CNTL__VM_CONTEXT15_PAGE_TABLE_BLOCK_SIZE__SHIFT                                      0x3
+#define DCN_VM_CONTEXT15_CNTL__VM_CONTEXT15_PAGE_TABLE_DEPTH_MASK                                             0x00000006L
+#define DCN_VM_CONTEXT15_CNTL__VM_CONTEXT15_PAGE_TABLE_BLOCK_SIZE_MASK                                        0x00000078L
+//DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_HI32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT15_PAGE_DIRECTORY_ENTRY_HI32__SHIFT             0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_HI32__VM_CONTEXT15_PAGE_DIRECTORY_ENTRY_HI32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_LO32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT15_PAGE_DIRECTORY_ENTRY_LO32__SHIFT             0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_BASE_ADDR_LO32__VM_CONTEXT15_PAGE_DIRECTORY_ENTRY_LO32_MASK               0xFFFFFFFFL
+//DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_HI32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT15_START_LOGICAL_PAGE_NUMBER_HI4__SHIFT        0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_HI32__VM_CONTEXT15_START_LOGICAL_PAGE_NUMBER_HI4_MASK          0x0000000FL
+//DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_LO32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT15_START_LOGICAL_PAGE_NUMBER_LO32__SHIFT       0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_START_ADDR_LO32__VM_CONTEXT15_START_LOGICAL_PAGE_NUMBER_LO32_MASK         0xFFFFFFFFL
+//DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_HI32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT15_END_LOGICAL_PAGE_NUMBER_HI4__SHIFT            0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_HI32__VM_CONTEXT15_END_LOGICAL_PAGE_NUMBER_HI4_MASK              0x0000000FL
+//DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_LO32
+#define DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT15_END_LOGICAL_PAGE_NUMBER_LO32__SHIFT           0x0
+#define DCN_VM_CONTEXT15_PAGE_TABLE_END_ADDR_LO32__VM_CONTEXT15_END_LOGICAL_PAGE_NUMBER_LO32_MASK             0xFFFFFFFFL
+//DCN_VM_DEFAULT_ADDR_MSB
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_ADDR_MSB__SHIFT                                               0x0
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_SPA__SHIFT                                                    0x1c
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_SNOOP__SHIFT                                                  0x1d
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_ADDR_MSB_MASK                                                 0x0000000FL
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_SPA_MASK                                                      0x10000000L
+#define DCN_VM_DEFAULT_ADDR_MSB__DCN_VM_DEFAULT_SNOOP_MASK                                                    0x20000000L
+//DCN_VM_DEFAULT_ADDR_LSB
+#define DCN_VM_DEFAULT_ADDR_LSB__DCN_VM_DEFAULT_ADDR_LSB__SHIFT                                               0x0
+#define DCN_VM_DEFAULT_ADDR_LSB__DCN_VM_DEFAULT_ADDR_LSB_MASK                                                 0xFFFFFFFFL
+//DCN_VM_FAULT_CNTL
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_STATUS_CLEAR__SHIFT                                                   0x0
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_STATUS_MODE__SHIFT                                                    0x1
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_INTERRUPT_ENABLE__SHIFT                                               0x2
+#define DCN_VM_FAULT_CNTL__DCN_VM_RANGE_FAULT_DISABLE__SHIFT                                                  0x8
+#define DCN_VM_FAULT_CNTL__DCN_VM_PRQ_FAULT_DISABLE__SHIFT                                                    0x9
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_STATUS_CLEAR_MASK                                                     0x00000001L
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_STATUS_MODE_MASK                                                      0x00000002L
+#define DCN_VM_FAULT_CNTL__DCN_VM_ERROR_INTERRUPT_ENABLE_MASK                                                 0x00000004L
+#define DCN_VM_FAULT_CNTL__DCN_VM_RANGE_FAULT_DISABLE_MASK                                                    0x00000100L
+#define DCN_VM_FAULT_CNTL__DCN_VM_PRQ_FAULT_DISABLE_MASK                                                      0x00000200L
+//DCN_VM_FAULT_STATUS
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_STATUS__SHIFT                                                       0x0
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_VMID__SHIFT                                                         0x10
+#define DCN_VM_FAULT_STATUS__DCN_VM_TR_RESP_ERROR_VMID__SHIFT                                                 0x14
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_TABLE_LEVEL__SHIFT                                                  0x18
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_PIPE__SHIFT                                                         0x1a
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_INTERRUPT_STATUS__SHIFT                                             0x1f
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_STATUS_MASK                                                         0x0000FFFFL
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_VMID_MASK                                                           0x000F0000L
+#define DCN_VM_FAULT_STATUS__DCN_VM_TR_RESP_ERROR_VMID_MASK                                                   0x00F00000L
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_TABLE_LEVEL_MASK                                                    0x03000000L
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_PIPE_MASK                                                           0x3C000000L
+#define DCN_VM_FAULT_STATUS__DCN_VM_ERROR_INTERRUPT_STATUS_MASK                                               0x80000000L
+//DCN_VM_FAULT_ADDR_MSB
+#define DCN_VM_FAULT_ADDR_MSB__DCN_VM_FAULT_ADDR_MSB__SHIFT                                                   0x0
+#define DCN_VM_FAULT_ADDR_MSB__DCN_VM_FAULT_ADDR_MSB_MASK                                                     0x0000000FL
+//DCN_VM_FAULT_ADDR_LSB
+#define DCN_VM_FAULT_ADDR_LSB__DCN_VM_FAULT_ADDR_LSB__SHIFT                                                   0x0
+#define DCN_VM_FAULT_ADDR_LSB__DCN_VM_FAULT_ADDR_LSB_MASK                                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dchubbubl_dchubbub_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON5_PERFCOUNTER_CNTL
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON5_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON5_PERFCOUNTER_CNTL2
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON5_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON5_PERFCOUNTER_STATE
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON5_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON5_PERFMON_CNTL
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON5_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON5_PERFMON_CNTL2
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON5_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON5_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON5_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON5_PERFMON_CVALUE_LOW
+#define DC_PERFMON5_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON5_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON5_PERFMON_HI
+#define DC_PERFMON5_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON5_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON5_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON5_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON5_PERFMON_LOW
+#define DC_PERFMON5_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON5_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON5_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON5_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON5_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubp_dispdec
+//HUBP0_DCSURF_SURFACE_CONFIG
+#define HUBP0_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT__SHIFT                                              0x0
+#define HUBP0_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE__SHIFT                                                    0x8
+#define HUBP0_DCSURF_SURFACE_CONFIG__H_MIRROR_EN__SHIFT                                                       0xa
+#define HUBP0_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN__SHIFT                                                    0xb
+#define HUBP0_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT_MASK                                                0x0000007FL
+#define HUBP0_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE_MASK                                                      0x00000300L
+#define HUBP0_DCSURF_SURFACE_CONFIG__H_MIRROR_EN_MASK                                                         0x00000400L
+#define HUBP0_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN_MASK                                                      0x00000800L
+//HUBP0_DCSURF_ADDR_CONFIG
+#define HUBP0_DCSURF_ADDR_CONFIG__NUM_PIPES__SHIFT                                                            0x0
+#define HUBP0_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE__SHIFT                                                      0x6
+#define HUBP0_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS__SHIFT                                                 0xc
+#define HUBP0_DCSURF_ADDR_CONFIG__NUM_PKRS__SHIFT                                                             0x10
+#define HUBP0_DCSURF_ADDR_CONFIG__NUM_PIPES_MASK                                                              0x00000007L
+#define HUBP0_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE_MASK                                                        0x000000C0L
+#define HUBP0_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS_MASK                                                   0x00003000L
+#define HUBP0_DCSURF_ADDR_CONFIG__NUM_PKRS_MASK                                                               0x00070000L
+//HUBP0_DCSURF_TILING_CONFIG
+#define HUBP0_DCSURF_TILING_CONFIG__SW_MODE__SHIFT                                                            0x0
+#define HUBP0_DCSURF_TILING_CONFIG__DIM_TYPE__SHIFT                                                           0x7
+#define HUBP0_DCSURF_TILING_CONFIG__COMPAT_LEVEL__SHIFT                                                       0xa
+#define HUBP0_DCSURF_TILING_CONFIG__SW_MODE_MASK                                                              0x0000001FL
+#define HUBP0_DCSURF_TILING_CONFIG__DIM_TYPE_MASK                                                             0x00000180L
+#define HUBP0_DCSURF_TILING_CONFIG__COMPAT_LEVEL_MASK                                                         0x00001C00L
+//HUBP0_DCSURF_LEGACY_ADDR_CONFIG
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE__SHIFT                                        0x4
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE__SHIFT                                                    0x8
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG__SHIFT                                                   0xc
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW__SHIFT                                           0x11
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT__SHIFT                                                    0x14
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH__SHIFT                                                    0x18
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT__SHIFT                                                   0x1a
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT__SHIFT                                             0x1c
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS__SHIFT                                              0x1e
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE_MASK                                          0x00000030L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE_MASK                                                      0x00000F00L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG_MASK                                                     0x0001F000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW_MASK                                             0x000E0000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT_MASK                                                      0x00700000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH_MASK                                                      0x03000000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT_MASK                                                     0x0C000000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT_MASK                                               0x30000000L
+#define HUBP0_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS_MASK                                                0xC0000000L
+//HUBP0_DCSURF_PRI_VIEWPORT_START
+#define HUBP0_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP0_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP0_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP0_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE
+#define HUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE__SHIFT                0x0
+#define HUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C__SHIFT              0x10
+#define HUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_MASK                  0x0000FFFFL
+#define HUBP0_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C_MASK                0xFFFF0000L
+//HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP0_DCSURF_PRI_VIEWPORT_START_C
+#define HUBP0_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP0_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP0_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP0_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP0_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP0_DCSURF_SEC_VIEWPORT_START
+#define HUBP0_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP0_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP0_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP0_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP0_DCSURF_SEC_VIEWPORT_START_C
+#define HUBP0_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP0_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP0_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP0_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP0_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP0_DCHUBP_REQ_SIZE_CONFIG
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT__SHIFT                                                     0x0
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR__SHIFT                                            0x4
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE__SHIFT                                                       0x8
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE__SHIFT                                                   0xb
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE__SHIFT                                                  0x14
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE__SHIFT                                                    0x18
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT_MASK                                                       0x00000007L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR_MASK                                              0x00000070L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE_MASK                                                         0x00000700L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE_MASK                                                     0x00001800L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE_MASK                                                    0x00700000L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE_MASK                                                      0x07000000L
+//HUBP0_DCHUBP_REQ_SIZE_CONFIG_C
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C__SHIFT                                                 0x0
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C__SHIFT                                        0x4
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C__SHIFT                                                   0x8
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C__SHIFT                                               0xb
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C__SHIFT                                              0x14
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C_MASK                                                   0x00000007L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C_MASK                                          0x00000070L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C_MASK                                                     0x00000700L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C_MASK                                                 0x00001800L
+#define HUBP0_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C_MASK                                                0x00700000L
+//HUBP0_DCHUBP_CNTL
+#define HUBP0_DCHUBP_CNTL__HUBP_BLANK_EN__SHIFT                                                               0x0
+#define HUBP0_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ__SHIFT                                                     0x1
+#define HUBP0_DCHUBP_CNTL__HUBP_SOFT_RESET__SHIFT                                                             0x2
+#define HUBP0_DCHUBP_CNTL__HUBP_IN_BLANK__SHIFT                                                               0x3
+#define HUBP0_DCHUBP_CNTL__HUBP_VTG_SEL__SHIFT                                                                0x4
+#define HUBP0_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC__SHIFT                                               0x8
+#define HUBP0_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM__SHIFT                                            0x9
+#define HUBP0_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE__SHIFT                                                     0xa
+#define HUBP0_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS__SHIFT                                                   0xb
+#define HUBP0_DCHUBP_CNTL__HUBP_TTU_DISABLE__SHIFT                                                            0xc
+#define HUBP0_DCHUBP_CNTL__HUBP_TTU_MODE__SHIFT                                                               0xd
+#define HUBP0_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ__SHIFT                                                 0x10
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS__SHIFT                                                         0x14
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD__SHIFT                                                      0x18
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR__SHIFT                                                   0x1a
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN__SHIFT                                                   0x1b
+#define HUBP0_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS__SHIFT                                                       0x1c
+#define HUBP0_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR__SHIFT                                                        0x1f
+#define HUBP0_DCHUBP_CNTL__HUBP_BLANK_EN_MASK                                                                 0x00000001L
+#define HUBP0_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ_MASK                                                       0x00000002L
+#define HUBP0_DCHUBP_CNTL__HUBP_SOFT_RESET_MASK                                                               0x00000004L
+#define HUBP0_DCHUBP_CNTL__HUBP_IN_BLANK_MASK                                                                 0x00000008L
+#define HUBP0_DCHUBP_CNTL__HUBP_VTG_SEL_MASK                                                                  0x000000F0L
+#define HUBP0_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC_MASK                                                 0x00000100L
+#define HUBP0_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM_MASK                                              0x00000200L
+#define HUBP0_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE_MASK                                                       0x00000400L
+#define HUBP0_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS_MASK                                                     0x00000800L
+#define HUBP0_DCHUBP_CNTL__HUBP_TTU_DISABLE_MASK                                                              0x00001000L
+#define HUBP0_DCHUBP_CNTL__HUBP_TTU_MODE_MASK                                                                 0x0000E000L
+#define HUBP0_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ_MASK                                                   0x000F0000L
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_MASK                                                           0x00F00000L
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD_MASK                                                        0x03000000L
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR_MASK                                                     0x04000000L
+#define HUBP0_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN_MASK                                                     0x08000000L
+#define HUBP0_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS_MASK                                                         0x70000000L
+#define HUBP0_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR_MASK                                                          0x80000000L
+//HUBP0_HUBP_CLK_CNTL
+#define HUBP0_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE__SHIFT                                                         0x0
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS__SHIFT                                                   0x4
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS__SHIFT                                                   0x5
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS__SHIFT                                                    0x8
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS__SHIFT                                                    0xc
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS__SHIFT                                                    0x10
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON__SHIFT                                                   0x14
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON__SHIFT                                                    0x15
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON__SHIFT                                                    0x16
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON__SHIFT                                                    0x17
+#define HUBP0_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON__SHIFT                                                   0x19
+#define HUBP0_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define HUBP0_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE_MASK                                                           0x00000001L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS_MASK                                                     0x00000010L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS_MASK                                                     0x00000020L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS_MASK                                                      0x00000100L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS_MASK                                                      0x00001000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS_MASK                                                      0x00010000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON_MASK                                                     0x00100000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON_MASK                                                      0x00200000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON_MASK                                                      0x00400000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON_MASK                                                      0x00800000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON_MASK                                                     0x02000000L
+#define HUBP0_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL_MASK                                                           0xF0000000L
+//HUBP0_DCHUBP_VMPG_CONFIG
+#define HUBP0_DCHUBP_VMPG_CONFIG__VMPG_SIZE__SHIFT                                                            0x0
+#define HUBP0_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE__SHIFT                                                      0x1
+#define HUBP0_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE__SHIFT                                                   0x2
+#define HUBP0_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME__SHIFT                                              0x7
+#define HUBP0_DCHUBP_VMPG_CONFIG__VMPG_SIZE_MASK                                                              0x00000001L
+#define HUBP0_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE_MASK                                                        0x00000002L
+#define HUBP0_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE_MASK                                                     0x0000007CL
+#define HUBP0_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME_MASK                                                0x00000080L
+//HUBP0_DCHUBP_SUB_VP_CFG0
+#define HUBP0_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE__SHIFT                                            0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION__SHIFT                                                0x1
+#define HUBP0_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0__SHIFT                                               0x2
+#define HUBP0_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0__SHIFT                                               0xe
+#define HUBP0_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE_MASK                                              0x00000001L
+#define HUBP0_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION_MASK                                                  0x00000002L
+#define HUBP0_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0_MASK                                                 0x00003FFCL
+#define HUBP0_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0_MASK                                                 0x03FFC000L
+//HUBP0_DCHUBP_SUB_VP_CFG1
+#define HUBP0_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0__SHIFT                                                0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0__SHIFT                                                0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0_MASK                                                  0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0_MASK                                                  0xFFFF0000L
+//HUBP0_DCHUBP_SUB_VP_CFG2
+#define HUBP0_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0__SHIFT                                               0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0__SHIFT                                               0xc
+#define HUBP0_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0_MASK                                                 0x00000FFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0_MASK                                                 0x00FFF000L
+//HUBP0_DCHUBP_SUB_VP_CFG3
+#define HUBP0_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP0_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP0_DCHUBP_SUB_VP_CFG4
+#define HUBP0_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1__SHIFT                                                0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1__SHIFT                                                0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1_MASK                                                  0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1_MASK                                                  0xFFFF0000L
+//HUBP0_DCHUBP_SUB_VP_CFG5
+#define HUBP0_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP0_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP0_DCHUBP_SUB_VP_CFG6
+#define HUBP0_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP0_DCHUBP_SUB_VP_CFG7
+#define HUBP0_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP0_DCHUBP_SUB_VP_CFG8
+#define HUBP0_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0_MASK                                         0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0_MASK                                         0xFFFF0000L
+//HUBP0_DCHUBP_SUB_VP_CFG9
+#define HUBP0_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1__SHIFT                                        0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1_MASK                                          0xFFFFFFFFL
+//HUBP0_DCHUBP_SUB_VP_CFG10
+#define HUBP0_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1__SHIFT                                       0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1_MASK                                         0xFFFFFFFFL
+//HUBP0_DCHUBP_SUB_VP_CFG11
+#define HUBP0_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1_MASK                                        0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1_MASK                                        0xFFFF0000L
+//HUBP0_DCHUBP_SUB_VP_CFG12
+#define HUBP0_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0__SHIFT                                               0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0__SHIFT                                               0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0_MASK                                                 0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0_MASK                                                 0xFFFF0000L
+//HUBP0_DCHUBP_SUB_VP_CFG13
+#define HUBP0_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1__SHIFT                                               0x0
+#define HUBP0_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1__SHIFT                                               0x10
+#define HUBP0_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1_MASK                                                 0x0000FFFFL
+#define HUBP0_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1_MASK                                                 0xFFFF0000L
+//HUBP0_DCHUBP_MCACHEID_CONFIG
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0__SHIFT                                          0x0
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0__SHIFT                                          0x4
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1__SHIFT                                          0x8
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1__SHIFT                                          0xc
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0__SHIFT                                         0x10
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0__SHIFT                                         0x14
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1__SHIFT                                         0x18
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1__SHIFT                                         0x1c
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0_MASK                                            0x0000000FL
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0_MASK                                            0x000000F0L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1_MASK                                            0x00000F00L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1_MASK                                            0x0000F000L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0_MASK                                           0x000F0000L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0_MASK                                           0x00F00000L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1_MASK                                           0x0F000000L
+#define HUBP0_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1_MASK                                           0xF0000000L
+//HUBP0_HUBPREQ_DEBUG_DB
+#define HUBP0_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG__SHIFT                                                          0x0
+#define HUBP0_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG_MASK                                                            0xFFFFFFFFL
+//HUBP0_HUBPREQ_DEBUG
+#define HUBP0_HUBPREQ_DEBUG__HUBPREQ_DEBUG__SHIFT                                                             0x0
+#define HUBP0_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS__SHIFT                                 0x1f
+#define HUBP0_HUBPREQ_DEBUG__HUBPREQ_DEBUG_MASK                                                               0x7FFFFFFFL
+#define HUBP0_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS_MASK                                   0x80000000L
+//HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK__SHIFT                                 0x0
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK__SHIFT                          0x4
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK__SHIFT                              0xc
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK__SHIFT                               0x14
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK__SHIFT                               0x1c
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK_MASK                                   0x00000001L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK_MASK                            0x00000FF0L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK_MASK                                0x0001F000L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK_MASK                                 0x01F00000L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK_MASK                                 0x30000000L
+//HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK__SHIFT                                 0x0
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK__SHIFT                            0x1
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK__SHIFT                          0x4
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK__SHIFT                              0xc
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK__SHIFT                               0x14
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK_MASK                                   0x00000001L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK_MASK                              0x00000002L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK_MASK                            0x00000FF0L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK_MASK                                0x0001F000L
+#define HUBP0_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK_MASK                                 0x01F00000L
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubpreq_dispdec
+//HUBPREQ0_DCSURF_SURFACE_PITCH
+#define HUBPREQ0_DCSURF_SURFACE_PITCH__PITCH__SHIFT                                                           0x0
+#define HUBPREQ0_DCSURF_SURFACE_PITCH__PITCH_MASK                                                             0x0000FFFFL
+//HUBPREQ0_DCSURF_SURFACE_PITCH_C
+#define HUBPREQ0_DCSURF_SURFACE_PITCH_C__PITCH_C__SHIFT                                                       0x0
+#define HUBPREQ0_DCSURF_SURFACE_PITCH_C__PITCH_C_MASK                                                         0x0000FFFFL
+//HUBPREQ0_VMID_SETTINGS_0
+#define HUBPREQ0_VMID_SETTINGS_0__VMID__SHIFT                                                                 0x0
+#define HUBPREQ0_VMID_SETTINGS_0__VMID_MASK                                                                   0x0000000FL
+//HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS__SHIFT                               0x0
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS_MASK                                 0xFFFFFFFFL
+//HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH__SHIFT                     0x0
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH_MASK                       0x0000FFFFL
+//HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_C
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C__SHIFT                           0x0
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C_MASK                             0xFFFFFFFFL
+//HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C__SHIFT                 0x0
+#define HUBPREQ0_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C_MASK                   0x0000FFFFL
+//HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS__SHIFT                           0x0
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS_MASK                             0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH__SHIFT                 0x0
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH_MASK                   0x0000FFFFL
+//HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_C
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C__SHIFT                       0x0
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C_MASK                         0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C__SHIFT             0x0
+#define HUBPREQ0_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C_MASK               0x0000FFFFL
+//HUBPREQ0_DCSURF_SURFACE_CONTROL
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ__SHIFT                                           0x0
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN__SHIFT                                        0x4
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C__SHIFT                                         0x5
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ__SHIFT                                         0x9
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN__SHIFT                                      0xd
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C__SHIFT                                       0xe
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_MASK                                             0x0000000FL
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN_MASK                                          0x00000010L
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C_MASK                                           0x000001E0L
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_MASK                                           0x00001E00L
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN_MASK                                        0x00002000L
+#define HUBPREQ0_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C_MASK                                         0x0003C000L
+//HUBPREQ0_DCSURF_FLIP_CONTROL
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK__SHIFT                                              0x0
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE__SHIFT                                                0x1
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING__SHIFT                                             0x8
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS__SHIFT                                0x9
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC__SHIFT                                 0xc
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC__SHIFT                                       0x10
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE__SHIFT                               0x11
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY__SHIFT                              0x12
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY__SHIFT                                       0x14
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK_MASK                                                0x00000001L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE_MASK                                                  0x00000002L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_MASK                                               0x00000100L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS_MASK                                  0x00000200L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC_MASK                                   0x00003000L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC_MASK                                         0x00010000L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE_MASK                                 0x00020000L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY_MASK                                0x00040000L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY_MASK                                         0x3FF00000L
+//HUBPREQ0_DCSURF_FLIP_CONTROL2
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME__SHIFT                                   0x0
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE__SHIFT                                              0x8
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK__SHIFT                                                0x9
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE__SHIFT                                    0xa
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH__SHIFT                                     0xc
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE__SHIFT                                    0x1f
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME_MASK                                     0x000000FFL
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE_MASK                                                0x00000100L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK_MASK                                                  0x00000200L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE_MASK                                      0x00000400L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH_MASK                                       0x00001000L
+#define HUBPREQ0_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE_MASK                                      0x80000000L
+//HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK__SHIFT                                  0x0
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE__SHIFT                                  0x1
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK__SHIFT                             0x2
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE__SHIFT                             0x3
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR__SHIFT                                     0x8
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR__SHIFT                                0x9
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED__SHIFT                                  0x10
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS__SHIFT                                0x11
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED__SHIFT                             0x12
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS__SHIFT                           0x13
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK_MASK                                    0x00000001L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE_MASK                                    0x00000002L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK_MASK                               0x00000004L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE_MASK                               0x00000008L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR_MASK                                       0x00000100L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR_MASK                                  0x00000200L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED_MASK                                    0x00010000L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS_MASK                                  0x00020000L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED_MASK                               0x00040000L
+#define HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS_MASK                             0x00080000L
+//HUBPREQ0_DCSURF_SURFACE_INUSE
+#define HUBPREQ0_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS__SHIFT                                           0x0
+#define HUBPREQ0_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS_MASK                                             0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH__SHIFT                                 0x0
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID__SHIFT                                         0x1c
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH_MASK                                   0x0000FFFFL
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID_MASK                                           0xF0000000L
+//HUBPREQ0_DCSURF_SURFACE_INUSE_C
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C__SHIFT                                       0x0
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C_MASK                                         0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C__SHIFT                             0x0
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C__SHIFT                                     0x1c
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C_MASK                               0x0000FFFFL
+#define HUBPREQ0_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C_MASK                                       0xF0000000L
+//HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS__SHIFT                         0x0
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS_MASK                           0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH__SHIFT               0x0
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID__SHIFT                       0x1c
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_MASK                 0x0000FFFFL
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID_MASK                         0xF0000000L
+//HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_C
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C__SHIFT                     0x0
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C_MASK                       0xFFFFFFFFL
+//HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C__SHIFT           0x0
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C__SHIFT                   0x1c
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C_MASK             0x0000FFFFL
+#define HUBPREQ0_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C_MASK                     0xF0000000L
+//HUBPREQ0_DCN_EXPANSION_MODE
+#define HUBPREQ0_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE__SHIFT                                                0x0
+#define HUBPREQ0_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE__SHIFT                                                0x2
+#define HUBPREQ0_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE__SHIFT                                                0x4
+#define HUBPREQ0_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE__SHIFT                                                0x6
+#define HUBPREQ0_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE_MASK                                                  0x00000003L
+#define HUBPREQ0_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE_MASK                                                  0x0000000CL
+#define HUBPREQ0_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE_MASK                                                  0x00000030L
+#define HUBPREQ0_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE_MASK                                                  0x000000C0L
+//HUBPREQ0_DCN_GLOBAL_TTU_CNTL
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK__SHIFT                                                   0x0
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT__SHIFT                                             0x18
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT__SHIFT                                             0x19
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH__SHIFT                                          0x1a
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE__SHIFT                                                     0x1b
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY__SHIFT                                0x1c
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP__SHIFT                                                0x1e
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH__SHIFT                                         0x1f
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK_MASK                                                     0x00FFFFFFL
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT_MASK                                               0x01000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT_MASK                                               0x02000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH_MASK                                            0x04000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE_MASK                                                       0x08000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY_MASK                                  0x10000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP_MASK                                                  0x40000000L
+#define HUBPREQ0_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH_MASK                                           0x80000000L
+//HUBPREQ0_DCN_SURF0_TTU_CNTL0
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ0_DCN_SURF0_TTU_CNTL1
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ0_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ0_DCN_SURF1_TTU_CNTL0
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ0_DCN_SURF1_TTU_CNTL1
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ0_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ0_DCN_CUR0_TTU_CNTL0
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ0_DCN_CUR0_TTU_CNTL1
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ0_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ0_DCN_CUR1_TTU_CNTL0
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ0_DCN_CUR1_TTU_CNTL1
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ0_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ0_DCN_DMDATA_VM_CNTL
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA__SHIFT                                              0x0
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS__SHIFT                                            0x10
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR__SHIFT                                      0x14
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS__SHIFT                                        0x18
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS__SHIFT                                             0x19
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR__SHIFT                                  0x1a
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE__SHIFT                                                    0x1f
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA_MASK                                                0x0000FFFFL
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_MASK                                              0x000F0000L
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR_MASK                                        0x00100000L
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_MASK                                          0x01000000L
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS_MASK                                               0x02000000L
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR_MASK                                    0x04000000L
+#define HUBPREQ0_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE_MASK                                                      0x80000000L
+//HUBPREQ0_DCN_VM_SYSTEM_APERTURE_LOW_ADDR
+#define HUBPREQ0_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR__SHIFT                       0x0
+#define HUBPREQ0_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR_MASK                         0x3FFFFFFFL
+//HUBPREQ0_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR
+#define HUBPREQ0_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR__SHIFT                     0x0
+#define HUBPREQ0_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR_MASK                       0x3FFFFFFFL
+//HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB__SHIFT                                                  0x0
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE__SHIFT                                             0x3
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS__SHIFT                                0x5
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL__SHIFT                                   0x6
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB_MASK                                                    0x00000001L
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE_MASK                                               0x00000018L
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS_MASK                                  0x00000020L
+#define HUBPREQ0_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL_MASK                                     0x00000040L
+//HUBPREQ0_BLANK_OFFSET_0
+#define HUBPREQ0_BLANK_OFFSET_0__REFCYC_H_BLANK_END__SHIFT                                                    0x0
+#define HUBPREQ0_BLANK_OFFSET_0__DLG_V_BLANK_END__SHIFT                                                       0x10
+#define HUBPREQ0_BLANK_OFFSET_0__REFCYC_H_BLANK_END_MASK                                                      0x00001FFFL
+#define HUBPREQ0_BLANK_OFFSET_0__DLG_V_BLANK_END_MASK                                                         0x7FFF0000L
+//HUBPREQ0_BLANK_OFFSET_1
+#define HUBPREQ0_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START__SHIFT                                                  0x0
+#define HUBPREQ0_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START_MASK                                                    0x0003FFFFL
+//HUBPREQ0_DST_DIMENSIONS
+#define HUBPREQ0_DST_DIMENSIONS__REFCYC_PER_HTOTAL__SHIFT                                                     0x0
+#define HUBPREQ0_DST_DIMENSIONS__REFCYC_PER_HTOTAL_MASK                                                       0x001FFFFFL
+//HUBPREQ0_DST_AFTER_SCALER
+#define HUBPREQ0_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER__SHIFT                                               0x0
+#define HUBPREQ0_DST_AFTER_SCALER__DST_Y_AFTER_SCALER__SHIFT                                                  0x10
+#define HUBPREQ0_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER_MASK                                                 0x00001FFFL
+#define HUBPREQ0_DST_AFTER_SCALER__DST_Y_AFTER_SCALER_MASK                                                    0x00070000L
+//HUBPREQ0_PREFETCH_SETTINGS
+#define HUBPREQ0_PREFETCH_SETTINGS__VRATIO_PREFETCH__SHIFT                                                    0x0
+#define HUBPREQ0_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK__SHIFT                                          0x17
+#define HUBPREQ0_PREFETCH_SETTINGS__DST_Y_PREFETCH__SHIFT                                                     0x18
+#define HUBPREQ0_PREFETCH_SETTINGS__VRATIO_PREFETCH_MASK                                                      0x003FFFFFL
+#define HUBPREQ0_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK_MASK                                            0x00800000L
+#define HUBPREQ0_PREFETCH_SETTINGS__DST_Y_PREFETCH_MASK                                                       0xFF000000L
+//HUBPREQ0_PREFETCH_SETTINGS_C
+#define HUBPREQ0_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C__SHIFT                                                0x0
+#define HUBPREQ0_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C_MASK                                                  0x003FFFFFL
+//HUBPREQ0_VBLANK_PARAMETERS_0
+#define HUBPREQ0_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK__SHIFT                                              0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK__SHIFT                                             0x8
+#define HUBPREQ0_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK_MASK                                                0x0000007FL
+#define HUBPREQ0_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK_MASK                                               0x00003F00L
+//HUBPREQ0_VBLANK_PARAMETERS_1
+#define HUBPREQ0_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L__SHIFT                                    0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L_MASK                                      0x007FFFFFL
+//HUBPREQ0_VBLANK_PARAMETERS_2
+#define HUBPREQ0_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C__SHIFT                                    0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C_MASK                                      0x007FFFFFL
+//HUBPREQ0_VBLANK_PARAMETERS_3
+#define HUBPREQ0_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L__SHIFT                                   0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L_MASK                                     0x007FFFFFL
+//HUBPREQ0_VBLANK_PARAMETERS_4
+#define HUBPREQ0_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C__SHIFT                                   0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C_MASK                                     0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_0
+#define HUBPREQ0_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP__SHIFT                                                  0x0
+#define HUBPREQ0_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP__SHIFT                                                 0x8
+#define HUBPREQ0_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP_MASK                                                    0x0000007FL
+#define HUBPREQ0_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP_MASK                                                   0x00003F00L
+//HUBPREQ0_FLIP_PARAMETERS_1
+#define HUBPREQ0_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L__SHIFT                                        0x0
+#define HUBPREQ0_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L_MASK                                          0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_2
+#define HUBPREQ0_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L__SHIFT                                       0x0
+#define HUBPREQ0_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L_MASK                                         0x007FFFFFL
+//HUBPREQ0_NOM_PARAMETERS_0
+#define HUBPREQ0_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L__SHIFT                                             0x0
+#define HUBPREQ0_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L_MASK                                               0x0001FFFFL
+//HUBPREQ0_NOM_PARAMETERS_1
+#define HUBPREQ0_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L__SHIFT                                          0x0
+#define HUBPREQ0_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L_MASK                                            0x007FFFFFL
+//HUBPREQ0_NOM_PARAMETERS_2
+#define HUBPREQ0_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C__SHIFT                                             0x0
+#define HUBPREQ0_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C_MASK                                               0x0001FFFFL
+//HUBPREQ0_NOM_PARAMETERS_3
+#define HUBPREQ0_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C__SHIFT                                          0x0
+#define HUBPREQ0_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C_MASK                                            0x007FFFFFL
+//HUBPREQ0_NOM_PARAMETERS_4
+#define HUBPREQ0_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L__SHIFT                                            0x0
+#define HUBPREQ0_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L_MASK                                              0x0001FFFFL
+//HUBPREQ0_NOM_PARAMETERS_5
+#define HUBPREQ0_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L__SHIFT                                         0x0
+#define HUBPREQ0_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L_MASK                                           0x007FFFFFL
+//HUBPREQ0_NOM_PARAMETERS_6
+#define HUBPREQ0_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C__SHIFT                                            0x0
+#define HUBPREQ0_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C_MASK                                              0x0001FFFFL
+//HUBPREQ0_NOM_PARAMETERS_7
+#define HUBPREQ0_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C__SHIFT                                         0x0
+#define HUBPREQ0_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C_MASK                                           0x007FFFFFL
+//HUBPREQ0_PER_LINE_DELIVERY_PRE
+#define HUBPREQ0_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L__SHIFT                                 0x0
+#define HUBPREQ0_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C__SHIFT                                 0x10
+#define HUBPREQ0_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L_MASK                                   0x00001FFFL
+#define HUBPREQ0_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C_MASK                                   0x1FFF0000L
+//HUBPREQ0_PER_LINE_DELIVERY
+#define HUBPREQ0_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L__SHIFT                                         0x0
+#define HUBPREQ0_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C__SHIFT                                         0x10
+#define HUBPREQ0_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L_MASK                                           0x00001FFFL
+#define HUBPREQ0_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C_MASK                                           0x1FFF0000L
+//HUBPREQ0_CURSOR_SETTINGS
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET__SHIFT                                                 0x0
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST__SHIFT                                             0x8
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET__SHIFT                                                 0x10
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST__SHIFT                                             0x18
+#define HUBPREQ0_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF__SHIFT                                            0x1e
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET_MASK                                                   0x000000FFL
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST_MASK                                               0x00000300L
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET_MASK                                                   0x00FF0000L
+#define HUBPREQ0_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST_MASK                                               0x03000000L
+#define HUBPREQ0_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF_MASK                                              0x40000000L
+//HUBPREQ0_REF_FREQ_TO_PIX_FREQ
+#define HUBPREQ0_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ__SHIFT                                            0x0
+#define HUBPREQ0_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ_MASK                                              0x001FFFFFL
+//HUBPREQ0_DST_Y_DELTA_DRQ_LIMIT
+#define HUBPREQ0_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT__SHIFT                                          0x0
+#define HUBPREQ0_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT_MASK                                            0x00007FFFL
+//HUBPREQ0_DST_Y_ALT_CH_DRQ_LIMIT
+#define HUBPREQ0_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT__SHIFT                                        0x0
+#define HUBPREQ0_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT_MASK                                          0x00007FFFL
+//HUBPREQ0_HUBPREQ_MEM_PWR_CTRL
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE__SHIFT                                          0x0
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS__SHIFT                                            0x2
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE__SHIFT                                          0x4
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS__SHIFT                                            0x6
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE__SHIFT                                           0x8
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS__SHIFT                                             0xa
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE_MASK                                            0x00000003L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS_MASK                                              0x00000004L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE_MASK                                            0x00000030L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS_MASK                                              0x00000040L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE_MASK                                             0x00000300L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS_MASK                                               0x00000400L
+//HUBPREQ0_HUBPREQ_MEM_PWR_STATUS
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE__SHIFT                                        0x0
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE__SHIFT                                        0x2
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE__SHIFT                                         0x4
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE_MASK                                          0x00000003L
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE_MASK                                          0x0000000CL
+#define HUBPREQ0_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE_MASK                                           0x00000030L
+//HUBPREQ0_VBLANK_PARAMETERS_5
+#define HUBPREQ0_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK__SHIFT                                       0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK_MASK                                         0x007FFFFFL
+//HUBPREQ0_VBLANK_PARAMETERS_6
+#define HUBPREQ0_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK__SHIFT                                         0x0
+#define HUBPREQ0_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK_MASK                                           0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_3
+#define HUBPREQ0_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP__SHIFT                                           0x0
+#define HUBPREQ0_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP_MASK                                             0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_4
+#define HUBPREQ0_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP__SHIFT                                             0x0
+#define HUBPREQ0_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP_MASK                                               0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_5
+#define HUBPREQ0_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C__SHIFT                                        0x0
+#define HUBPREQ0_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C_MASK                                          0x007FFFFFL
+//HUBPREQ0_FLIP_PARAMETERS_6
+#define HUBPREQ0_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C__SHIFT                                       0x0
+#define HUBPREQ0_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C_MASK                                         0x007FFFFFL
+//HUBPREQ0_UCLK_PSTATE_FORCE
+#define HUBPREQ0_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN__SHIFT                                          0x0
+#define HUBPREQ0_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE__SHIFT                                       0x1
+#define HUBPREQ0_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN__SHIFT                                        0x2
+#define HUBPREQ0_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE__SHIFT                                     0x3
+#define HUBPREQ0_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN_MASK                                            0x00000001L
+#define HUBPREQ0_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE_MASK                                         0x00000002L
+#define HUBPREQ0_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN_MASK                                          0x00000004L
+#define HUBPREQ0_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE_MASK                                       0x00000008L
+//HUBPREQ0_HUBPREQ_STATUS_REG0
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0__SHIFT                                         0x0
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1__SHIFT                                         0x8
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT__SHIFT                                                 0x10
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0_MASK                                           0x0000001FL
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1_MASK                                           0x00001F00L
+#define HUBPREQ0_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT_MASK                                                   0x7FFF0000L
+//HUBPREQ0_HUBPREQ_STATUS_REG1
+#define HUBPREQ0_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0__SHIFT                                       0x0
+#define HUBPREQ0_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1__SHIFT                                       0x10
+#define HUBPREQ0_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0_MASK                                         0x0000FFFFL
+#define HUBPREQ0_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1_MASK                                         0xFFFF0000L
+//HUBPREQ0_HUBPREQ_STATUS_REG2
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0__SHIFT                                      0x0
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0__SHIFT                                     0x1
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0__SHIFT                               0x2
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0__SHIFT                               0x3
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0__SHIFT                                                 0x5
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1__SHIFT                                      0x8
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1__SHIFT                                     0x9
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1__SHIFT                               0xa
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1__SHIFT                               0xb
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1__SHIFT                                                 0xd
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR__SHIFT                                     0x10
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR__SHIFT                                    0x11
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR__SHIFT                              0x12
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR__SHIFT                              0x13
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR__SHIFT                                                0x15
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_VBLANK__SHIFT                                                    0x1a
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN__SHIFT                                                   0x1b
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY__SHIFT                                          0x1c
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH__SHIFT                                             0x1d
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0__SHIFT                                            0x1e
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1__SHIFT                                            0x1f
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0_MASK                                        0x00000001L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0_MASK                                       0x00000002L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0_MASK                                 0x00000004L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0_MASK                                 0x00000008L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0_MASK                                                   0x00000020L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1_MASK                                        0x00000100L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1_MASK                                       0x00000200L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1_MASK                                 0x00000400L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1_MASK                                 0x00000800L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1_MASK                                                   0x00002000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR_MASK                                       0x00010000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR_MASK                                      0x00020000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR_MASK                                0x00040000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR_MASK                                0x00080000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR_MASK                                                  0x00200000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_VBLANK_MASK                                                      0x04000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN_MASK                                                     0x08000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY_MASK                                            0x10000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH_MASK                                               0x20000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0_MASK                                              0x40000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1_MASK                                              0x80000000L
+//HUBPREQ0_HUBPREQ_STATUS_REG3
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL__SHIFT                                            0x0
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE__SHIFT                                     0x1
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL__SHIFT                                            0x2
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0__SHIFT                                              0x3
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0__SHIFT                                   0x6
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0__SHIFT                                    0x7
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0__SHIFT                                         0x9
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0__SHIFT                                  0xa
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1__SHIFT                                              0xd
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1__SHIFT                                   0x10
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1__SHIFT                                    0x11
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1__SHIFT                                         0x13
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1__SHIFT                                  0x14
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE__SHIFT                                 0x17
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST__SHIFT                                     0x18
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR__SHIFT                                       0x19
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED__SHIFT                                          0x1a
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT__SHIFT                            0x1b
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT__SHIFT                            0x1d
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL_MASK                                              0x00000001L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE_MASK                                       0x00000002L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL_MASK                                              0x00000004L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0_MASK                                                0x00000038L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0_MASK                                     0x00000040L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0_MASK                                      0x00000180L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0_MASK                                           0x00000200L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0_MASK                                    0x00001C00L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1_MASK                                                0x0000E000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1_MASK                                     0x00010000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1_MASK                                      0x00060000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1_MASK                                           0x00080000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1_MASK                                    0x00700000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE_MASK                                   0x00800000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST_MASK                                       0x01000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR_MASK                                         0x02000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED_MASK                                            0x04000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT_MASK                              0x18000000L
+#define HUBPREQ0_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT_MASK                              0x60000000L
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubpret_dispdec
+//HUBPRET0_HUBPRET_CONTROL
+#define HUBPRET0_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS__SHIFT                                          0x4
+#define HUBPRET0_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE__SHIFT                                            0xf
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA__SHIFT                                                   0x10
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G__SHIFT                                                     0x12
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B__SHIFT                                                    0x14
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R__SHIFT                                                    0x16
+#define HUBPRET0_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS_MASK                                            0x00007FF0L
+#define HUBPRET0_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE_MASK                                              0x00008000L
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA_MASK                                                     0x00030000L
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G_MASK                                                       0x000C0000L
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B_MASK                                                      0x00300000L
+#define HUBPRET0_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R_MASK                                                      0x00C00000L
+//HUBPRET0_HUBPRET_MEM_PWR_CTRL
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE__SHIFT                                             0x8
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS__SHIFT                                               0xa
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE__SHIFT                                            0x10
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS__SHIFT                                              0x12
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE__SHIFT                                          0x14
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE_MASK                                               0x00000300L
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS_MASK                                                 0x00000400L
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE_MASK                                              0x00030000L
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS_MASK                                                0x00040000L
+#define HUBPRET0_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE_MASK                                            0x00300000L
+//HUBPRET0_HUBPRET_MEM_PWR_STATUS
+#define HUBPRET0_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE__SHIFT                                           0x2
+#define HUBPRET0_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE__SHIFT                                          0x4
+#define HUBPRET0_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE_MASK                                             0x0000000CL
+#define HUBPRET0_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE_MASK                                            0x00000030L
+//HUBPRET0_HUBPRET_READ_LINE_CTRL0
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE__SHIFT                         0x0
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM__SHIFT                                0x10
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE_MASK                           0x0000FFFFL
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM_MASK                                  0xFFFF0000L
+//HUBPRET0_HUBPRET_READ_LINE_CTRL1
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED__SHIFT                    0x0
+#define HUBPRET0_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED_MASK                      0x0000FFFFL
+//HUBPRET0_HUBPRET_READ_LINE0
+#define HUBPRET0_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START__SHIFT                                             0x0
+#define HUBPRET0_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END__SHIFT                                               0x10
+#define HUBPRET0_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START_MASK                                               0x0000FFFFL
+#define HUBPRET0_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END_MASK                                                 0xFFFF0000L
+//HUBPRET0_HUBPRET_READ_LINE1
+#define HUBPRET0_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START__SHIFT                                             0x0
+#define HUBPRET0_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END__SHIFT                                               0x10
+#define HUBPRET0_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START_MASK                                               0x0000FFFFL
+#define HUBPRET0_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END_MASK                                                 0xFFFF0000L
+//HUBPRET0_HUBPRET_INTERRUPT
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK__SHIFT                                               0x0
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK__SHIFT                                           0x1
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK__SHIFT                                           0x2
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE__SHIFT                                               0x4
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE__SHIFT                                           0x5
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE__SHIFT                                           0x6
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR__SHIFT                                              0x8
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR__SHIFT                                          0x9
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR__SHIFT                                          0xa
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS__SHIFT                                                 0xc
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS__SHIFT                                             0xd
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS__SHIFT                                             0xe
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS__SHIFT                                             0x10
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS__SHIFT                                         0x11
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS__SHIFT                                         0x12
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK_MASK                                                 0x00000001L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK_MASK                                             0x00000002L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK_MASK                                             0x00000004L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE_MASK                                                 0x00000010L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE_MASK                                             0x00000020L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE_MASK                                             0x00000040L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR_MASK                                                0x00000100L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR_MASK                                            0x00000200L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR_MASK                                            0x00000400L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS_MASK                                                   0x00001000L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS_MASK                                               0x00002000L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS_MASK                                               0x00004000L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS_MASK                                               0x00010000L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS_MASK                                           0x00020000L
+#define HUBPRET0_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS_MASK                                           0x00040000L
+//HUBPRET0_HUBPRET_READ_LINE_VALUE
+#define HUBPRET0_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE__SHIFT                                               0x0
+#define HUBPRET0_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT__SHIFT                                      0x10
+#define HUBPRET0_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_MASK                                                 0x0000FFFFL
+#define HUBPRET0_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT_MASK                                        0xFFFF0000L
+//HUBPRET0_HUBPRET_READ_LINE_STATUS
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK__SHIFT                                            0x0
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE__SHIFT                                      0x4
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE__SHIFT                                     0x5
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE__SHIFT                                      0x8
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE__SHIFT                                     0xa
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK_MASK                                              0x00000001L
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE_MASK                                        0x00000010L
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE_MASK                                       0x00000020L
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE_MASK                                        0x00000100L
+#define HUBPRET0_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE_MASK                                       0x00000400L
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_cursor0_dispdec
+//CURSOR0_0_CURSOR_CONTROL
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_ENABLE__SHIFT                                                        0x0
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_REQ_MODE__SHIFT                                                      0x2
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_2X_MAGNIFY__SHIFT                                                    0x4
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_MODE__SHIFT                                                          0x8
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_TMZ__SHIFT                                                           0xc
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PITCH__SHIFT                                                         0x10
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS__SHIFT                     0x14
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK__SHIFT                                               0x18
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN__SHIFT                                    0x1e
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL__SHIFT                                   0x1f
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_ENABLE_MASK                                                          0x00000001L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_REQ_MODE_MASK                                                        0x00000004L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_2X_MAGNIFY_MASK                                                      0x00000010L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_MODE_MASK                                                            0x00000700L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_TMZ_MASK                                                             0x00001000L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PITCH_MASK                                                           0x00030000L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS_MASK                       0x00100000L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK_MASK                                                 0x1F000000L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN_MASK                                      0x40000000L
+#define CURSOR0_0_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL_MASK                                     0x80000000L
+//CURSOR0_0_CURSOR_SURFACE_ADDRESS
+#define CURSOR0_0_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS__SHIFT                                       0x0
+#define CURSOR0_0_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS_MASK                                         0xFFFFFFFFL
+//CURSOR0_0_CURSOR_SURFACE_ADDRESS_HIGH
+#define CURSOR0_0_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH__SHIFT                             0x0
+#define CURSOR0_0_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH_MASK                               0x0000FFFFL
+//CURSOR0_0_CURSOR_SIZE
+#define CURSOR0_0_CURSOR_SIZE__CURSOR_HEIGHT__SHIFT                                                           0x0
+#define CURSOR0_0_CURSOR_SIZE__CURSOR_WIDTH__SHIFT                                                            0x10
+#define CURSOR0_0_CURSOR_SIZE__CURSOR_HEIGHT_MASK                                                             0x000001FFL
+#define CURSOR0_0_CURSOR_SIZE__CURSOR_WIDTH_MASK                                                              0x01FF0000L
+//CURSOR0_0_CURSOR_POSITION
+#define CURSOR0_0_CURSOR_POSITION__CURSOR_Y_POSITION__SHIFT                                                   0x0
+#define CURSOR0_0_CURSOR_POSITION__CURSOR_X_POSITION__SHIFT                                                   0xf
+#define CURSOR0_0_CURSOR_POSITION__CURSOR_Y_POSITION_MASK                                                     0x00007FFFL
+#define CURSOR0_0_CURSOR_POSITION__CURSOR_X_POSITION_MASK                                                     0x3FFF8000L
+//CURSOR0_0_CURSOR_HOT_SPOT
+#define CURSOR0_0_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y__SHIFT                                                   0x0
+#define CURSOR0_0_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X__SHIFT                                                   0x10
+#define CURSOR0_0_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y_MASK                                                     0x000000FFL
+#define CURSOR0_0_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X_MASK                                                     0x00FF0000L
+//CURSOR0_0_CURSOR_STEREO_CONTROL
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN__SHIFT                                              0x0
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET__SHIFT                                         0x2
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET__SHIFT                                       0x11
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN_MASK                                                0x00000001L
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET_MASK                                           0x0001FFFCL
+#define CURSOR0_0_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET_MASK                                         0xFFFE0000L
+//CURSOR0_0_CURSOR_DST_OFFSET
+#define CURSOR0_0_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET__SHIFT                                               0x0
+#define CURSOR0_0_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET_MASK                                                 0x00003FFFL
+//CURSOR0_0_CURSOR_MEM_PWR_CTRL
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE__SHIFT                                              0x0
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS__SHIFT                                                0x2
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE__SHIFT                                            0x4
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE_MASK                                                0x00000003L
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS_MASK                                                  0x00000004L
+#define CURSOR0_0_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE_MASK                                              0x00000030L
+//CURSOR0_0_CURSOR_MEM_PWR_STATUS
+#define CURSOR0_0_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE__SHIFT                                            0x0
+#define CURSOR0_0_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE_MASK                                              0x00000003L
+//CURSOR0_0_DMDATA_ADDRESS_HIGH
+#define CURSOR0_0_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH__SHIFT                                             0x0
+#define CURSOR0_0_DMDATA_ADDRESS_HIGH__DMDATA_TMZ__SHIFT                                                      0x1e
+#define CURSOR0_0_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH_MASK                                               0x0000FFFFL
+#define CURSOR0_0_DMDATA_ADDRESS_HIGH__DMDATA_TMZ_MASK                                                        0x40000000L
+//CURSOR0_0_DMDATA_ADDRESS_LOW
+#define CURSOR0_0_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW__SHIFT                                               0x0
+#define CURSOR0_0_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW_MASK                                                 0xFFFFFFFFL
+//CURSOR0_0_DMDATA_CNTL
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_UPDATED__SHIFT                                                          0x0
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_REPEAT__SHIFT                                                           0x1
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_MODE__SHIFT                                                             0x2
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_SIZE__SHIFT                                                             0x10
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_UPDATED_MASK                                                            0x00000001L
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_REPEAT_MASK                                                             0x00000002L
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_MODE_MASK                                                               0x00000004L
+#define CURSOR0_0_DMDATA_CNTL__DMDATA_SIZE_MASK                                                               0x0FFF0000L
+//CURSOR0_0_DMDATA_QOS_CNTL
+#define CURSOR0_0_DMDATA_QOS_CNTL__DMDATA_QOS_MODE__SHIFT                                                     0x0
+#define CURSOR0_0_DMDATA_QOS_CNTL__DMDATA_DL_DELTA__SHIFT                                                     0x10
+#define CURSOR0_0_DMDATA_QOS_CNTL__DMDATA_QOS_MODE_MASK                                                       0x00000001L
+#define CURSOR0_0_DMDATA_QOS_CNTL__DMDATA_DL_DELTA_MASK                                                       0xFFFF0000L
+//CURSOR0_0_DMDATA_STATUS
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_DONE__SHIFT                                                           0x0
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_UNDERFLOW__SHIFT                                                      0x2
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR__SHIFT                                                0x4
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_DONE_MASK                                                             0x00000001L
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_UNDERFLOW_MASK                                                        0x00000004L
+#define CURSOR0_0_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR_MASK                                                  0x00000010L
+//CURSOR0_0_DMDATA_SW_CNTL
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_UPDATED__SHIFT                                                    0x0
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_REPEAT__SHIFT                                                     0x1
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_SIZE__SHIFT                                                       0x10
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_UPDATED_MASK                                                      0x00000001L
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_REPEAT_MASK                                                       0x00000002L
+#define CURSOR0_0_DMDATA_SW_CNTL__DMDATA_SW_SIZE_MASK                                                         0x0FFF0000L
+//CURSOR0_0_DMDATA_SW_DATA
+#define CURSOR0_0_DMDATA_SW_DATA__DMDATA_SW_DATA__SHIFT                                                       0x0
+#define CURSOR0_0_DMDATA_SW_DATA__DMDATA_SW_DATA_MASK                                                         0xFFFFFFFFL
+//CURSOR0_0_HUBP_3DLUT_CONTROL
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE__SHIFT                                                0x0
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE__SHIFT                                       0x1
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH__SHIFT                                                 0x2
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B__SHIFT                                        0x13
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G__SHIFT                                        0x15
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R__SHIFT                                        0x17
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ__SHIFT                                                   0x19
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH__SHIFT                                             0x1e
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE__SHIFT                                                  0x1f
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE_MASK                                                  0x00000001L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE_MASK                                         0x00000002L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH_MASK                                                   0x0003FFFCL
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B_MASK                                          0x00180000L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G_MASK                                          0x00600000L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R_MASK                                          0x01800000L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ_MASK                                                     0x1E000000L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH_MASK                                               0x40000000L
+#define CURSOR0_0_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE_MASK                                                    0x80000000L
+//CURSOR0_0_HUBP_3DLUT_ADDRESS_LOW
+#define CURSOR0_0_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW__SHIFT                                       0x0
+#define CURSOR0_0_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW_MASK                                         0xFFFFFFFFL
+//CURSOR0_0_HUBP_3DLUT_ADDRESS_HIGH
+#define CURSOR0_0_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH__SHIFT                                     0x0
+#define CURSOR0_0_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH_MASK                                       0x0000FFFFL
+//CURSOR0_0_HUBP_3DLUT_DLG_PARAM
+#define CURSOR0_0_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP__SHIFT                                         0x0
+#define CURSOR0_0_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP_MASK                                           0x007FFFFFL
+
+
+// addressBlock: dce_dc_dcbubp0_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON6_PERFCOUNTER_CNTL
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON6_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON6_PERFCOUNTER_CNTL2
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON6_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON6_PERFCOUNTER_STATE
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON6_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON6_PERFMON_CNTL
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON6_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON6_PERFMON_CNTL2
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON6_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON6_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON6_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON6_PERFMON_CVALUE_LOW
+#define DC_PERFMON6_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON6_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON6_PERFMON_HI
+#define DC_PERFMON6_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON6_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON6_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON6_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON6_PERFMON_LOW
+#define DC_PERFMON6_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON6_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON6_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON6_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON6_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubp_dispdec
+//HUBP1_DCSURF_SURFACE_CONFIG
+#define HUBP1_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT__SHIFT                                              0x0
+#define HUBP1_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE__SHIFT                                                    0x8
+#define HUBP1_DCSURF_SURFACE_CONFIG__H_MIRROR_EN__SHIFT                                                       0xa
+#define HUBP1_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN__SHIFT                                                    0xb
+#define HUBP1_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT_MASK                                                0x0000007FL
+#define HUBP1_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE_MASK                                                      0x00000300L
+#define HUBP1_DCSURF_SURFACE_CONFIG__H_MIRROR_EN_MASK                                                         0x00000400L
+#define HUBP1_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN_MASK                                                      0x00000800L
+//HUBP1_DCSURF_ADDR_CONFIG
+#define HUBP1_DCSURF_ADDR_CONFIG__NUM_PIPES__SHIFT                                                            0x0
+#define HUBP1_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE__SHIFT                                                      0x6
+#define HUBP1_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS__SHIFT                                                 0xc
+#define HUBP1_DCSURF_ADDR_CONFIG__NUM_PKRS__SHIFT                                                             0x10
+#define HUBP1_DCSURF_ADDR_CONFIG__NUM_PIPES_MASK                                                              0x00000007L
+#define HUBP1_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE_MASK                                                        0x000000C0L
+#define HUBP1_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS_MASK                                                   0x00003000L
+#define HUBP1_DCSURF_ADDR_CONFIG__NUM_PKRS_MASK                                                               0x00070000L
+//HUBP1_DCSURF_TILING_CONFIG
+#define HUBP1_DCSURF_TILING_CONFIG__SW_MODE__SHIFT                                                            0x0
+#define HUBP1_DCSURF_TILING_CONFIG__DIM_TYPE__SHIFT                                                           0x7
+#define HUBP1_DCSURF_TILING_CONFIG__COMPAT_LEVEL__SHIFT                                                       0xa
+#define HUBP1_DCSURF_TILING_CONFIG__SW_MODE_MASK                                                              0x0000001FL
+#define HUBP1_DCSURF_TILING_CONFIG__DIM_TYPE_MASK                                                             0x00000180L
+#define HUBP1_DCSURF_TILING_CONFIG__COMPAT_LEVEL_MASK                                                         0x00001C00L
+//HUBP1_DCSURF_LEGACY_ADDR_CONFIG
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE__SHIFT                                        0x4
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE__SHIFT                                                    0x8
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG__SHIFT                                                   0xc
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW__SHIFT                                           0x11
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT__SHIFT                                                    0x14
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH__SHIFT                                                    0x18
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT__SHIFT                                                   0x1a
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT__SHIFT                                             0x1c
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS__SHIFT                                              0x1e
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE_MASK                                          0x00000030L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE_MASK                                                      0x00000F00L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG_MASK                                                     0x0001F000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW_MASK                                             0x000E0000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT_MASK                                                      0x00700000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH_MASK                                                      0x03000000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT_MASK                                                     0x0C000000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT_MASK                                               0x30000000L
+#define HUBP1_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS_MASK                                                0xC0000000L
+//HUBP1_DCSURF_PRI_VIEWPORT_START
+#define HUBP1_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP1_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP1_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP1_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE
+#define HUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE__SHIFT                0x0
+#define HUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C__SHIFT              0x10
+#define HUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_MASK                  0x0000FFFFL
+#define HUBP1_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C_MASK                0xFFFF0000L
+//HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP1_DCSURF_PRI_VIEWPORT_START_C
+#define HUBP1_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP1_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP1_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP1_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP1_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP1_DCSURF_SEC_VIEWPORT_START
+#define HUBP1_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP1_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP1_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP1_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP1_DCSURF_SEC_VIEWPORT_START_C
+#define HUBP1_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP1_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP1_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP1_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP1_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP1_DCHUBP_REQ_SIZE_CONFIG
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT__SHIFT                                                     0x0
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR__SHIFT                                            0x4
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE__SHIFT                                                       0x8
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE__SHIFT                                                   0xb
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE__SHIFT                                                  0x14
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE__SHIFT                                                    0x18
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT_MASK                                                       0x00000007L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR_MASK                                              0x00000070L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE_MASK                                                         0x00000700L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE_MASK                                                     0x00001800L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE_MASK                                                    0x00700000L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE_MASK                                                      0x07000000L
+//HUBP1_DCHUBP_REQ_SIZE_CONFIG_C
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C__SHIFT                                                 0x0
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C__SHIFT                                        0x4
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C__SHIFT                                                   0x8
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C__SHIFT                                               0xb
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C__SHIFT                                              0x14
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C_MASK                                                   0x00000007L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C_MASK                                          0x00000070L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C_MASK                                                     0x00000700L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C_MASK                                                 0x00001800L
+#define HUBP1_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C_MASK                                                0x00700000L
+//HUBP1_DCHUBP_CNTL
+#define HUBP1_DCHUBP_CNTL__HUBP_BLANK_EN__SHIFT                                                               0x0
+#define HUBP1_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ__SHIFT                                                     0x1
+#define HUBP1_DCHUBP_CNTL__HUBP_SOFT_RESET__SHIFT                                                             0x2
+#define HUBP1_DCHUBP_CNTL__HUBP_IN_BLANK__SHIFT                                                               0x3
+#define HUBP1_DCHUBP_CNTL__HUBP_VTG_SEL__SHIFT                                                                0x4
+#define HUBP1_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC__SHIFT                                               0x8
+#define HUBP1_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM__SHIFT                                            0x9
+#define HUBP1_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE__SHIFT                                                     0xa
+#define HUBP1_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS__SHIFT                                                   0xb
+#define HUBP1_DCHUBP_CNTL__HUBP_TTU_DISABLE__SHIFT                                                            0xc
+#define HUBP1_DCHUBP_CNTL__HUBP_TTU_MODE__SHIFT                                                               0xd
+#define HUBP1_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ__SHIFT                                                 0x10
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS__SHIFT                                                         0x14
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD__SHIFT                                                      0x18
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR__SHIFT                                                   0x1a
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN__SHIFT                                                   0x1b
+#define HUBP1_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS__SHIFT                                                       0x1c
+#define HUBP1_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR__SHIFT                                                        0x1f
+#define HUBP1_DCHUBP_CNTL__HUBP_BLANK_EN_MASK                                                                 0x00000001L
+#define HUBP1_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ_MASK                                                       0x00000002L
+#define HUBP1_DCHUBP_CNTL__HUBP_SOFT_RESET_MASK                                                               0x00000004L
+#define HUBP1_DCHUBP_CNTL__HUBP_IN_BLANK_MASK                                                                 0x00000008L
+#define HUBP1_DCHUBP_CNTL__HUBP_VTG_SEL_MASK                                                                  0x000000F0L
+#define HUBP1_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC_MASK                                                 0x00000100L
+#define HUBP1_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM_MASK                                              0x00000200L
+#define HUBP1_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE_MASK                                                       0x00000400L
+#define HUBP1_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS_MASK                                                     0x00000800L
+#define HUBP1_DCHUBP_CNTL__HUBP_TTU_DISABLE_MASK                                                              0x00001000L
+#define HUBP1_DCHUBP_CNTL__HUBP_TTU_MODE_MASK                                                                 0x0000E000L
+#define HUBP1_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ_MASK                                                   0x000F0000L
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_MASK                                                           0x00F00000L
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD_MASK                                                        0x03000000L
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR_MASK                                                     0x04000000L
+#define HUBP1_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN_MASK                                                     0x08000000L
+#define HUBP1_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS_MASK                                                         0x70000000L
+#define HUBP1_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR_MASK                                                          0x80000000L
+//HUBP1_HUBP_CLK_CNTL
+#define HUBP1_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE__SHIFT                                                         0x0
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS__SHIFT                                                   0x4
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS__SHIFT                                                   0x5
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS__SHIFT                                                    0x8
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS__SHIFT                                                    0xc
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS__SHIFT                                                    0x10
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON__SHIFT                                                   0x14
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON__SHIFT                                                    0x15
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON__SHIFT                                                    0x16
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON__SHIFT                                                    0x17
+#define HUBP1_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON__SHIFT                                                   0x19
+#define HUBP1_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define HUBP1_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE_MASK                                                           0x00000001L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS_MASK                                                     0x00000010L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS_MASK                                                     0x00000020L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS_MASK                                                      0x00000100L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS_MASK                                                      0x00001000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS_MASK                                                      0x00010000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON_MASK                                                     0x00100000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON_MASK                                                      0x00200000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON_MASK                                                      0x00400000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON_MASK                                                      0x00800000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON_MASK                                                     0x02000000L
+#define HUBP1_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL_MASK                                                           0xF0000000L
+//HUBP1_DCHUBP_VMPG_CONFIG
+#define HUBP1_DCHUBP_VMPG_CONFIG__VMPG_SIZE__SHIFT                                                            0x0
+#define HUBP1_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE__SHIFT                                                      0x1
+#define HUBP1_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE__SHIFT                                                   0x2
+#define HUBP1_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME__SHIFT                                              0x7
+#define HUBP1_DCHUBP_VMPG_CONFIG__VMPG_SIZE_MASK                                                              0x00000001L
+#define HUBP1_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE_MASK                                                        0x00000002L
+#define HUBP1_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE_MASK                                                     0x0000007CL
+#define HUBP1_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME_MASK                                                0x00000080L
+//HUBP1_DCHUBP_SUB_VP_CFG0
+#define HUBP1_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE__SHIFT                                            0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION__SHIFT                                                0x1
+#define HUBP1_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0__SHIFT                                               0x2
+#define HUBP1_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0__SHIFT                                               0xe
+#define HUBP1_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE_MASK                                              0x00000001L
+#define HUBP1_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION_MASK                                                  0x00000002L
+#define HUBP1_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0_MASK                                                 0x00003FFCL
+#define HUBP1_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0_MASK                                                 0x03FFC000L
+//HUBP1_DCHUBP_SUB_VP_CFG1
+#define HUBP1_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0__SHIFT                                                0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0__SHIFT                                                0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0_MASK                                                  0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0_MASK                                                  0xFFFF0000L
+//HUBP1_DCHUBP_SUB_VP_CFG2
+#define HUBP1_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0__SHIFT                                               0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0__SHIFT                                               0xc
+#define HUBP1_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0_MASK                                                 0x00000FFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0_MASK                                                 0x00FFF000L
+//HUBP1_DCHUBP_SUB_VP_CFG3
+#define HUBP1_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP1_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP1_DCHUBP_SUB_VP_CFG4
+#define HUBP1_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1__SHIFT                                                0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1__SHIFT                                                0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1_MASK                                                  0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1_MASK                                                  0xFFFF0000L
+//HUBP1_DCHUBP_SUB_VP_CFG5
+#define HUBP1_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP1_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP1_DCHUBP_SUB_VP_CFG6
+#define HUBP1_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP1_DCHUBP_SUB_VP_CFG7
+#define HUBP1_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP1_DCHUBP_SUB_VP_CFG8
+#define HUBP1_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0_MASK                                         0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0_MASK                                         0xFFFF0000L
+//HUBP1_DCHUBP_SUB_VP_CFG9
+#define HUBP1_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1__SHIFT                                        0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1_MASK                                          0xFFFFFFFFL
+//HUBP1_DCHUBP_SUB_VP_CFG10
+#define HUBP1_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1__SHIFT                                       0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1_MASK                                         0xFFFFFFFFL
+//HUBP1_DCHUBP_SUB_VP_CFG11
+#define HUBP1_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1_MASK                                        0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1_MASK                                        0xFFFF0000L
+//HUBP1_DCHUBP_SUB_VP_CFG12
+#define HUBP1_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0__SHIFT                                               0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0__SHIFT                                               0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0_MASK                                                 0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0_MASK                                                 0xFFFF0000L
+//HUBP1_DCHUBP_SUB_VP_CFG13
+#define HUBP1_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1__SHIFT                                               0x0
+#define HUBP1_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1__SHIFT                                               0x10
+#define HUBP1_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1_MASK                                                 0x0000FFFFL
+#define HUBP1_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1_MASK                                                 0xFFFF0000L
+//HUBP1_DCHUBP_MCACHEID_CONFIG
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0__SHIFT                                          0x0
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0__SHIFT                                          0x4
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1__SHIFT                                          0x8
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1__SHIFT                                          0xc
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0__SHIFT                                         0x10
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0__SHIFT                                         0x14
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1__SHIFT                                         0x18
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1__SHIFT                                         0x1c
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0_MASK                                            0x0000000FL
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0_MASK                                            0x000000F0L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1_MASK                                            0x00000F00L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1_MASK                                            0x0000F000L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0_MASK                                           0x000F0000L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0_MASK                                           0x00F00000L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1_MASK                                           0x0F000000L
+#define HUBP1_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1_MASK                                           0xF0000000L
+//HUBP1_HUBPREQ_DEBUG_DB
+#define HUBP1_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG__SHIFT                                                          0x0
+#define HUBP1_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG_MASK                                                            0xFFFFFFFFL
+//HUBP1_HUBPREQ_DEBUG
+#define HUBP1_HUBPREQ_DEBUG__HUBPREQ_DEBUG__SHIFT                                                             0x0
+#define HUBP1_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS__SHIFT                                 0x1f
+#define HUBP1_HUBPREQ_DEBUG__HUBPREQ_DEBUG_MASK                                                               0x7FFFFFFFL
+#define HUBP1_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS_MASK                                   0x80000000L
+//HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK__SHIFT                                 0x0
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK__SHIFT                          0x4
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK__SHIFT                              0xc
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK__SHIFT                               0x14
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK__SHIFT                               0x1c
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK_MASK                                   0x00000001L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK_MASK                            0x00000FF0L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK_MASK                                0x0001F000L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK_MASK                                 0x01F00000L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK_MASK                                 0x30000000L
+//HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK__SHIFT                                 0x0
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK__SHIFT                            0x1
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK__SHIFT                          0x4
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK__SHIFT                              0xc
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK__SHIFT                               0x14
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK_MASK                                   0x00000001L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK_MASK                              0x00000002L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK_MASK                            0x00000FF0L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK_MASK                                0x0001F000L
+#define HUBP1_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK_MASK                                 0x01F00000L
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubpreq_dispdec
+//HUBPREQ1_DCSURF_SURFACE_PITCH
+#define HUBPREQ1_DCSURF_SURFACE_PITCH__PITCH__SHIFT                                                           0x0
+#define HUBPREQ1_DCSURF_SURFACE_PITCH__PITCH_MASK                                                             0x0000FFFFL
+//HUBPREQ1_DCSURF_SURFACE_PITCH_C
+#define HUBPREQ1_DCSURF_SURFACE_PITCH_C__PITCH_C__SHIFT                                                       0x0
+#define HUBPREQ1_DCSURF_SURFACE_PITCH_C__PITCH_C_MASK                                                         0x0000FFFFL
+//HUBPREQ1_VMID_SETTINGS_0
+#define HUBPREQ1_VMID_SETTINGS_0__VMID__SHIFT                                                                 0x0
+#define HUBPREQ1_VMID_SETTINGS_0__VMID_MASK                                                                   0x0000000FL
+//HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS__SHIFT                               0x0
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS_MASK                                 0xFFFFFFFFL
+//HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH__SHIFT                     0x0
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH_MASK                       0x0000FFFFL
+//HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_C
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C__SHIFT                           0x0
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C_MASK                             0xFFFFFFFFL
+//HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C__SHIFT                 0x0
+#define HUBPREQ1_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C_MASK                   0x0000FFFFL
+//HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS__SHIFT                           0x0
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS_MASK                             0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH__SHIFT                 0x0
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH_MASK                   0x0000FFFFL
+//HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_C
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C__SHIFT                       0x0
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C_MASK                         0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C__SHIFT             0x0
+#define HUBPREQ1_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C_MASK               0x0000FFFFL
+//HUBPREQ1_DCSURF_SURFACE_CONTROL
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ__SHIFT                                           0x0
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN__SHIFT                                        0x4
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C__SHIFT                                         0x5
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ__SHIFT                                         0x9
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN__SHIFT                                      0xd
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C__SHIFT                                       0xe
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_MASK                                             0x0000000FL
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN_MASK                                          0x00000010L
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C_MASK                                           0x000001E0L
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_MASK                                           0x00001E00L
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN_MASK                                        0x00002000L
+#define HUBPREQ1_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C_MASK                                         0x0003C000L
+//HUBPREQ1_DCSURF_FLIP_CONTROL
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK__SHIFT                                              0x0
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE__SHIFT                                                0x1
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING__SHIFT                                             0x8
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS__SHIFT                                0x9
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC__SHIFT                                 0xc
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC__SHIFT                                       0x10
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE__SHIFT                               0x11
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY__SHIFT                              0x12
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY__SHIFT                                       0x14
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK_MASK                                                0x00000001L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE_MASK                                                  0x00000002L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_MASK                                               0x00000100L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS_MASK                                  0x00000200L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC_MASK                                   0x00003000L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC_MASK                                         0x00010000L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE_MASK                                 0x00020000L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY_MASK                                0x00040000L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY_MASK                                         0x3FF00000L
+//HUBPREQ1_DCSURF_FLIP_CONTROL2
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME__SHIFT                                   0x0
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE__SHIFT                                              0x8
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK__SHIFT                                                0x9
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE__SHIFT                                    0xa
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH__SHIFT                                     0xc
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE__SHIFT                                    0x1f
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME_MASK                                     0x000000FFL
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE_MASK                                                0x00000100L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK_MASK                                                  0x00000200L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE_MASK                                      0x00000400L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH_MASK                                       0x00001000L
+#define HUBPREQ1_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE_MASK                                      0x80000000L
+//HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK__SHIFT                                  0x0
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE__SHIFT                                  0x1
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK__SHIFT                             0x2
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE__SHIFT                             0x3
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR__SHIFT                                     0x8
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR__SHIFT                                0x9
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED__SHIFT                                  0x10
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS__SHIFT                                0x11
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED__SHIFT                             0x12
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS__SHIFT                           0x13
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK_MASK                                    0x00000001L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE_MASK                                    0x00000002L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK_MASK                               0x00000004L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE_MASK                               0x00000008L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR_MASK                                       0x00000100L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR_MASK                                  0x00000200L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED_MASK                                    0x00010000L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS_MASK                                  0x00020000L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED_MASK                               0x00040000L
+#define HUBPREQ1_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS_MASK                             0x00080000L
+//HUBPREQ1_DCSURF_SURFACE_INUSE
+#define HUBPREQ1_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS__SHIFT                                           0x0
+#define HUBPREQ1_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS_MASK                                             0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH__SHIFT                                 0x0
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID__SHIFT                                         0x1c
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH_MASK                                   0x0000FFFFL
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID_MASK                                           0xF0000000L
+//HUBPREQ1_DCSURF_SURFACE_INUSE_C
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C__SHIFT                                       0x0
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C_MASK                                         0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C__SHIFT                             0x0
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C__SHIFT                                     0x1c
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C_MASK                               0x0000FFFFL
+#define HUBPREQ1_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C_MASK                                       0xF0000000L
+//HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS__SHIFT                         0x0
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS_MASK                           0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH__SHIFT               0x0
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID__SHIFT                       0x1c
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_MASK                 0x0000FFFFL
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID_MASK                         0xF0000000L
+//HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_C
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C__SHIFT                     0x0
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C_MASK                       0xFFFFFFFFL
+//HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C__SHIFT           0x0
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C__SHIFT                   0x1c
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C_MASK             0x0000FFFFL
+#define HUBPREQ1_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C_MASK                     0xF0000000L
+//HUBPREQ1_DCN_EXPANSION_MODE
+#define HUBPREQ1_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE__SHIFT                                                0x0
+#define HUBPREQ1_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE__SHIFT                                                0x2
+#define HUBPREQ1_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE__SHIFT                                                0x4
+#define HUBPREQ1_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE__SHIFT                                                0x6
+#define HUBPREQ1_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE_MASK                                                  0x00000003L
+#define HUBPREQ1_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE_MASK                                                  0x0000000CL
+#define HUBPREQ1_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE_MASK                                                  0x00000030L
+#define HUBPREQ1_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE_MASK                                                  0x000000C0L
+//HUBPREQ1_DCN_GLOBAL_TTU_CNTL
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK__SHIFT                                                   0x0
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT__SHIFT                                             0x18
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT__SHIFT                                             0x19
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH__SHIFT                                          0x1a
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE__SHIFT                                                     0x1b
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY__SHIFT                                0x1c
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP__SHIFT                                                0x1e
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH__SHIFT                                         0x1f
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK_MASK                                                     0x00FFFFFFL
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT_MASK                                               0x01000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT_MASK                                               0x02000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH_MASK                                            0x04000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE_MASK                                                       0x08000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY_MASK                                  0x10000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP_MASK                                                  0x40000000L
+#define HUBPREQ1_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH_MASK                                           0x80000000L
+//HUBPREQ1_DCN_SURF0_TTU_CNTL0
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ1_DCN_SURF0_TTU_CNTL1
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ1_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ1_DCN_SURF1_TTU_CNTL0
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ1_DCN_SURF1_TTU_CNTL1
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ1_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ1_DCN_CUR0_TTU_CNTL0
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ1_DCN_CUR0_TTU_CNTL1
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ1_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ1_DCN_CUR1_TTU_CNTL0
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ1_DCN_CUR1_TTU_CNTL1
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ1_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ1_DCN_DMDATA_VM_CNTL
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA__SHIFT                                              0x0
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS__SHIFT                                            0x10
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR__SHIFT                                      0x14
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS__SHIFT                                        0x18
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS__SHIFT                                             0x19
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR__SHIFT                                  0x1a
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE__SHIFT                                                    0x1f
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA_MASK                                                0x0000FFFFL
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_MASK                                              0x000F0000L
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR_MASK                                        0x00100000L
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_MASK                                          0x01000000L
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS_MASK                                               0x02000000L
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR_MASK                                    0x04000000L
+#define HUBPREQ1_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE_MASK                                                      0x80000000L
+//HUBPREQ1_DCN_VM_SYSTEM_APERTURE_LOW_ADDR
+#define HUBPREQ1_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR__SHIFT                       0x0
+#define HUBPREQ1_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR_MASK                         0x3FFFFFFFL
+//HUBPREQ1_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR
+#define HUBPREQ1_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR__SHIFT                     0x0
+#define HUBPREQ1_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR_MASK                       0x3FFFFFFFL
+//HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB__SHIFT                                                  0x0
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE__SHIFT                                             0x3
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS__SHIFT                                0x5
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL__SHIFT                                   0x6
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB_MASK                                                    0x00000001L
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE_MASK                                               0x00000018L
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS_MASK                                  0x00000020L
+#define HUBPREQ1_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL_MASK                                     0x00000040L
+//HUBPREQ1_BLANK_OFFSET_0
+#define HUBPREQ1_BLANK_OFFSET_0__REFCYC_H_BLANK_END__SHIFT                                                    0x0
+#define HUBPREQ1_BLANK_OFFSET_0__DLG_V_BLANK_END__SHIFT                                                       0x10
+#define HUBPREQ1_BLANK_OFFSET_0__REFCYC_H_BLANK_END_MASK                                                      0x00001FFFL
+#define HUBPREQ1_BLANK_OFFSET_0__DLG_V_BLANK_END_MASK                                                         0x7FFF0000L
+//HUBPREQ1_BLANK_OFFSET_1
+#define HUBPREQ1_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START__SHIFT                                                  0x0
+#define HUBPREQ1_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START_MASK                                                    0x0003FFFFL
+//HUBPREQ1_DST_DIMENSIONS
+#define HUBPREQ1_DST_DIMENSIONS__REFCYC_PER_HTOTAL__SHIFT                                                     0x0
+#define HUBPREQ1_DST_DIMENSIONS__REFCYC_PER_HTOTAL_MASK                                                       0x001FFFFFL
+//HUBPREQ1_DST_AFTER_SCALER
+#define HUBPREQ1_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER__SHIFT                                               0x0
+#define HUBPREQ1_DST_AFTER_SCALER__DST_Y_AFTER_SCALER__SHIFT                                                  0x10
+#define HUBPREQ1_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER_MASK                                                 0x00001FFFL
+#define HUBPREQ1_DST_AFTER_SCALER__DST_Y_AFTER_SCALER_MASK                                                    0x00070000L
+//HUBPREQ1_PREFETCH_SETTINGS
+#define HUBPREQ1_PREFETCH_SETTINGS__VRATIO_PREFETCH__SHIFT                                                    0x0
+#define HUBPREQ1_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK__SHIFT                                          0x17
+#define HUBPREQ1_PREFETCH_SETTINGS__DST_Y_PREFETCH__SHIFT                                                     0x18
+#define HUBPREQ1_PREFETCH_SETTINGS__VRATIO_PREFETCH_MASK                                                      0x003FFFFFL
+#define HUBPREQ1_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK_MASK                                            0x00800000L
+#define HUBPREQ1_PREFETCH_SETTINGS__DST_Y_PREFETCH_MASK                                                       0xFF000000L
+//HUBPREQ1_PREFETCH_SETTINGS_C
+#define HUBPREQ1_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C__SHIFT                                                0x0
+#define HUBPREQ1_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C_MASK                                                  0x003FFFFFL
+//HUBPREQ1_VBLANK_PARAMETERS_0
+#define HUBPREQ1_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK__SHIFT                                              0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK__SHIFT                                             0x8
+#define HUBPREQ1_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK_MASK                                                0x0000007FL
+#define HUBPREQ1_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK_MASK                                               0x00003F00L
+//HUBPREQ1_VBLANK_PARAMETERS_1
+#define HUBPREQ1_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L__SHIFT                                    0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L_MASK                                      0x007FFFFFL
+//HUBPREQ1_VBLANK_PARAMETERS_2
+#define HUBPREQ1_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C__SHIFT                                    0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C_MASK                                      0x007FFFFFL
+//HUBPREQ1_VBLANK_PARAMETERS_3
+#define HUBPREQ1_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L__SHIFT                                   0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L_MASK                                     0x007FFFFFL
+//HUBPREQ1_VBLANK_PARAMETERS_4
+#define HUBPREQ1_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C__SHIFT                                   0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C_MASK                                     0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_0
+#define HUBPREQ1_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP__SHIFT                                                  0x0
+#define HUBPREQ1_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP__SHIFT                                                 0x8
+#define HUBPREQ1_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP_MASK                                                    0x0000007FL
+#define HUBPREQ1_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP_MASK                                                   0x00003F00L
+//HUBPREQ1_FLIP_PARAMETERS_1
+#define HUBPREQ1_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L__SHIFT                                        0x0
+#define HUBPREQ1_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L_MASK                                          0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_2
+#define HUBPREQ1_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L__SHIFT                                       0x0
+#define HUBPREQ1_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L_MASK                                         0x007FFFFFL
+//HUBPREQ1_NOM_PARAMETERS_0
+#define HUBPREQ1_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L__SHIFT                                             0x0
+#define HUBPREQ1_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L_MASK                                               0x0001FFFFL
+//HUBPREQ1_NOM_PARAMETERS_1
+#define HUBPREQ1_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L__SHIFT                                          0x0
+#define HUBPREQ1_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L_MASK                                            0x007FFFFFL
+//HUBPREQ1_NOM_PARAMETERS_2
+#define HUBPREQ1_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C__SHIFT                                             0x0
+#define HUBPREQ1_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C_MASK                                               0x0001FFFFL
+//HUBPREQ1_NOM_PARAMETERS_3
+#define HUBPREQ1_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C__SHIFT                                          0x0
+#define HUBPREQ1_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C_MASK                                            0x007FFFFFL
+//HUBPREQ1_NOM_PARAMETERS_4
+#define HUBPREQ1_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L__SHIFT                                            0x0
+#define HUBPREQ1_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L_MASK                                              0x0001FFFFL
+//HUBPREQ1_NOM_PARAMETERS_5
+#define HUBPREQ1_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L__SHIFT                                         0x0
+#define HUBPREQ1_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L_MASK                                           0x007FFFFFL
+//HUBPREQ1_NOM_PARAMETERS_6
+#define HUBPREQ1_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C__SHIFT                                            0x0
+#define HUBPREQ1_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C_MASK                                              0x0001FFFFL
+//HUBPREQ1_NOM_PARAMETERS_7
+#define HUBPREQ1_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C__SHIFT                                         0x0
+#define HUBPREQ1_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C_MASK                                           0x007FFFFFL
+//HUBPREQ1_PER_LINE_DELIVERY_PRE
+#define HUBPREQ1_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L__SHIFT                                 0x0
+#define HUBPREQ1_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C__SHIFT                                 0x10
+#define HUBPREQ1_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L_MASK                                   0x00001FFFL
+#define HUBPREQ1_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C_MASK                                   0x1FFF0000L
+//HUBPREQ1_PER_LINE_DELIVERY
+#define HUBPREQ1_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L__SHIFT                                         0x0
+#define HUBPREQ1_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C__SHIFT                                         0x10
+#define HUBPREQ1_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L_MASK                                           0x00001FFFL
+#define HUBPREQ1_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C_MASK                                           0x1FFF0000L
+//HUBPREQ1_CURSOR_SETTINGS
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET__SHIFT                                                 0x0
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST__SHIFT                                             0x8
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET__SHIFT                                                 0x10
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST__SHIFT                                             0x18
+#define HUBPREQ1_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF__SHIFT                                            0x1e
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET_MASK                                                   0x000000FFL
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST_MASK                                               0x00000300L
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET_MASK                                                   0x00FF0000L
+#define HUBPREQ1_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST_MASK                                               0x03000000L
+#define HUBPREQ1_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF_MASK                                              0x40000000L
+//HUBPREQ1_REF_FREQ_TO_PIX_FREQ
+#define HUBPREQ1_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ__SHIFT                                            0x0
+#define HUBPREQ1_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ_MASK                                              0x001FFFFFL
+//HUBPREQ1_DST_Y_DELTA_DRQ_LIMIT
+#define HUBPREQ1_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT__SHIFT                                          0x0
+#define HUBPREQ1_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT_MASK                                            0x00007FFFL
+//HUBPREQ1_DST_Y_ALT_CH_DRQ_LIMIT
+#define HUBPREQ1_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT__SHIFT                                        0x0
+#define HUBPREQ1_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT_MASK                                          0x00007FFFL
+//HUBPREQ1_HUBPREQ_MEM_PWR_CTRL
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE__SHIFT                                          0x0
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS__SHIFT                                            0x2
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE__SHIFT                                          0x4
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS__SHIFT                                            0x6
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE__SHIFT                                           0x8
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS__SHIFT                                             0xa
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE_MASK                                            0x00000003L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS_MASK                                              0x00000004L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE_MASK                                            0x00000030L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS_MASK                                              0x00000040L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE_MASK                                             0x00000300L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS_MASK                                               0x00000400L
+//HUBPREQ1_HUBPREQ_MEM_PWR_STATUS
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE__SHIFT                                        0x0
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE__SHIFT                                        0x2
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE__SHIFT                                         0x4
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE_MASK                                          0x00000003L
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE_MASK                                          0x0000000CL
+#define HUBPREQ1_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE_MASK                                           0x00000030L
+//HUBPREQ1_VBLANK_PARAMETERS_5
+#define HUBPREQ1_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK__SHIFT                                       0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK_MASK                                         0x007FFFFFL
+//HUBPREQ1_VBLANK_PARAMETERS_6
+#define HUBPREQ1_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK__SHIFT                                         0x0
+#define HUBPREQ1_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK_MASK                                           0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_3
+#define HUBPREQ1_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP__SHIFT                                           0x0
+#define HUBPREQ1_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP_MASK                                             0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_4
+#define HUBPREQ1_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP__SHIFT                                             0x0
+#define HUBPREQ1_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP_MASK                                               0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_5
+#define HUBPREQ1_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C__SHIFT                                        0x0
+#define HUBPREQ1_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C_MASK                                          0x007FFFFFL
+//HUBPREQ1_FLIP_PARAMETERS_6
+#define HUBPREQ1_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C__SHIFT                                       0x0
+#define HUBPREQ1_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C_MASK                                         0x007FFFFFL
+//HUBPREQ1_UCLK_PSTATE_FORCE
+#define HUBPREQ1_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN__SHIFT                                          0x0
+#define HUBPREQ1_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE__SHIFT                                       0x1
+#define HUBPREQ1_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN__SHIFT                                        0x2
+#define HUBPREQ1_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE__SHIFT                                     0x3
+#define HUBPREQ1_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN_MASK                                            0x00000001L
+#define HUBPREQ1_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE_MASK                                         0x00000002L
+#define HUBPREQ1_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN_MASK                                          0x00000004L
+#define HUBPREQ1_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE_MASK                                       0x00000008L
+//HUBPREQ1_HUBPREQ_STATUS_REG0
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0__SHIFT                                         0x0
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1__SHIFT                                         0x8
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT__SHIFT                                                 0x10
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0_MASK                                           0x0000001FL
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1_MASK                                           0x00001F00L
+#define HUBPREQ1_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT_MASK                                                   0x7FFF0000L
+//HUBPREQ1_HUBPREQ_STATUS_REG1
+#define HUBPREQ1_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0__SHIFT                                       0x0
+#define HUBPREQ1_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1__SHIFT                                       0x10
+#define HUBPREQ1_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0_MASK                                         0x0000FFFFL
+#define HUBPREQ1_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1_MASK                                         0xFFFF0000L
+//HUBPREQ1_HUBPREQ_STATUS_REG2
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0__SHIFT                                      0x0
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0__SHIFT                                     0x1
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0__SHIFT                               0x2
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0__SHIFT                               0x3
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0__SHIFT                                                 0x5
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1__SHIFT                                      0x8
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1__SHIFT                                     0x9
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1__SHIFT                               0xa
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1__SHIFT                               0xb
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1__SHIFT                                                 0xd
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR__SHIFT                                     0x10
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR__SHIFT                                    0x11
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR__SHIFT                              0x12
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR__SHIFT                              0x13
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR__SHIFT                                                0x15
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_VBLANK__SHIFT                                                    0x1a
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN__SHIFT                                                   0x1b
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY__SHIFT                                          0x1c
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH__SHIFT                                             0x1d
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0__SHIFT                                            0x1e
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1__SHIFT                                            0x1f
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0_MASK                                        0x00000001L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0_MASK                                       0x00000002L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0_MASK                                 0x00000004L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0_MASK                                 0x00000008L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0_MASK                                                   0x00000020L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1_MASK                                        0x00000100L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1_MASK                                       0x00000200L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1_MASK                                 0x00000400L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1_MASK                                 0x00000800L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1_MASK                                                   0x00002000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR_MASK                                       0x00010000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR_MASK                                      0x00020000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR_MASK                                0x00040000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR_MASK                                0x00080000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR_MASK                                                  0x00200000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_VBLANK_MASK                                                      0x04000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN_MASK                                                     0x08000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY_MASK                                            0x10000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH_MASK                                               0x20000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0_MASK                                              0x40000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1_MASK                                              0x80000000L
+//HUBPREQ1_HUBPREQ_STATUS_REG3
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL__SHIFT                                            0x0
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE__SHIFT                                     0x1
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL__SHIFT                                            0x2
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0__SHIFT                                              0x3
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0__SHIFT                                   0x6
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0__SHIFT                                    0x7
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0__SHIFT                                         0x9
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0__SHIFT                                  0xa
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1__SHIFT                                              0xd
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1__SHIFT                                   0x10
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1__SHIFT                                    0x11
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1__SHIFT                                         0x13
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1__SHIFT                                  0x14
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE__SHIFT                                 0x17
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST__SHIFT                                     0x18
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR__SHIFT                                       0x19
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED__SHIFT                                          0x1a
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT__SHIFT                            0x1b
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT__SHIFT                            0x1d
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL_MASK                                              0x00000001L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE_MASK                                       0x00000002L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL_MASK                                              0x00000004L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0_MASK                                                0x00000038L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0_MASK                                     0x00000040L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0_MASK                                      0x00000180L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0_MASK                                           0x00000200L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0_MASK                                    0x00001C00L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1_MASK                                                0x0000E000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1_MASK                                     0x00010000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1_MASK                                      0x00060000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1_MASK                                           0x00080000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1_MASK                                    0x00700000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE_MASK                                   0x00800000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST_MASK                                       0x01000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR_MASK                                         0x02000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED_MASK                                            0x04000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT_MASK                              0x18000000L
+#define HUBPREQ1_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT_MASK                              0x60000000L
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubpret_dispdec
+//HUBPRET1_HUBPRET_CONTROL
+#define HUBPRET1_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS__SHIFT                                          0x4
+#define HUBPRET1_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE__SHIFT                                            0xf
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA__SHIFT                                                   0x10
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G__SHIFT                                                     0x12
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B__SHIFT                                                    0x14
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R__SHIFT                                                    0x16
+#define HUBPRET1_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS_MASK                                            0x00007FF0L
+#define HUBPRET1_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE_MASK                                              0x00008000L
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA_MASK                                                     0x00030000L
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G_MASK                                                       0x000C0000L
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B_MASK                                                      0x00300000L
+#define HUBPRET1_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R_MASK                                                      0x00C00000L
+//HUBPRET1_HUBPRET_MEM_PWR_CTRL
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE__SHIFT                                             0x8
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS__SHIFT                                               0xa
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE__SHIFT                                            0x10
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS__SHIFT                                              0x12
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE__SHIFT                                          0x14
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE_MASK                                               0x00000300L
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS_MASK                                                 0x00000400L
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE_MASK                                              0x00030000L
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS_MASK                                                0x00040000L
+#define HUBPRET1_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE_MASK                                            0x00300000L
+//HUBPRET1_HUBPRET_MEM_PWR_STATUS
+#define HUBPRET1_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE__SHIFT                                           0x2
+#define HUBPRET1_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE__SHIFT                                          0x4
+#define HUBPRET1_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE_MASK                                             0x0000000CL
+#define HUBPRET1_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE_MASK                                            0x00000030L
+//HUBPRET1_HUBPRET_READ_LINE_CTRL0
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE__SHIFT                         0x0
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM__SHIFT                                0x10
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE_MASK                           0x0000FFFFL
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM_MASK                                  0xFFFF0000L
+//HUBPRET1_HUBPRET_READ_LINE_CTRL1
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED__SHIFT                    0x0
+#define HUBPRET1_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED_MASK                      0x0000FFFFL
+//HUBPRET1_HUBPRET_READ_LINE0
+#define HUBPRET1_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START__SHIFT                                             0x0
+#define HUBPRET1_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END__SHIFT                                               0x10
+#define HUBPRET1_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START_MASK                                               0x0000FFFFL
+#define HUBPRET1_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END_MASK                                                 0xFFFF0000L
+//HUBPRET1_HUBPRET_READ_LINE1
+#define HUBPRET1_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START__SHIFT                                             0x0
+#define HUBPRET1_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END__SHIFT                                               0x10
+#define HUBPRET1_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START_MASK                                               0x0000FFFFL
+#define HUBPRET1_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END_MASK                                                 0xFFFF0000L
+//HUBPRET1_HUBPRET_INTERRUPT
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK__SHIFT                                               0x0
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK__SHIFT                                           0x1
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK__SHIFT                                           0x2
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE__SHIFT                                               0x4
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE__SHIFT                                           0x5
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE__SHIFT                                           0x6
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR__SHIFT                                              0x8
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR__SHIFT                                          0x9
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR__SHIFT                                          0xa
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS__SHIFT                                                 0xc
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS__SHIFT                                             0xd
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS__SHIFT                                             0xe
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS__SHIFT                                             0x10
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS__SHIFT                                         0x11
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS__SHIFT                                         0x12
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK_MASK                                                 0x00000001L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK_MASK                                             0x00000002L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK_MASK                                             0x00000004L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE_MASK                                                 0x00000010L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE_MASK                                             0x00000020L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE_MASK                                             0x00000040L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR_MASK                                                0x00000100L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR_MASK                                            0x00000200L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR_MASK                                            0x00000400L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS_MASK                                                   0x00001000L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS_MASK                                               0x00002000L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS_MASK                                               0x00004000L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS_MASK                                               0x00010000L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS_MASK                                           0x00020000L
+#define HUBPRET1_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS_MASK                                           0x00040000L
+//HUBPRET1_HUBPRET_READ_LINE_VALUE
+#define HUBPRET1_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE__SHIFT                                               0x0
+#define HUBPRET1_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT__SHIFT                                      0x10
+#define HUBPRET1_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_MASK                                                 0x0000FFFFL
+#define HUBPRET1_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT_MASK                                        0xFFFF0000L
+//HUBPRET1_HUBPRET_READ_LINE_STATUS
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK__SHIFT                                            0x0
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE__SHIFT                                      0x4
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE__SHIFT                                     0x5
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE__SHIFT                                      0x8
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE__SHIFT                                     0xa
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK_MASK                                              0x00000001L
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE_MASK                                        0x00000010L
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE_MASK                                       0x00000020L
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE_MASK                                        0x00000100L
+#define HUBPRET1_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE_MASK                                       0x00000400L
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_cursor0_dispdec
+//CURSOR0_1_CURSOR_CONTROL
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_ENABLE__SHIFT                                                        0x0
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_REQ_MODE__SHIFT                                                      0x2
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_2X_MAGNIFY__SHIFT                                                    0x4
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_MODE__SHIFT                                                          0x8
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_TMZ__SHIFT                                                           0xc
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PITCH__SHIFT                                                         0x10
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS__SHIFT                     0x14
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK__SHIFT                                               0x18
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN__SHIFT                                    0x1e
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL__SHIFT                                   0x1f
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_ENABLE_MASK                                                          0x00000001L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_REQ_MODE_MASK                                                        0x00000004L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_2X_MAGNIFY_MASK                                                      0x00000010L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_MODE_MASK                                                            0x00000700L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_TMZ_MASK                                                             0x00001000L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PITCH_MASK                                                           0x00030000L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS_MASK                       0x00100000L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK_MASK                                                 0x1F000000L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN_MASK                                      0x40000000L
+#define CURSOR0_1_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL_MASK                                     0x80000000L
+//CURSOR0_1_CURSOR_SURFACE_ADDRESS
+#define CURSOR0_1_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS__SHIFT                                       0x0
+#define CURSOR0_1_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS_MASK                                         0xFFFFFFFFL
+//CURSOR0_1_CURSOR_SURFACE_ADDRESS_HIGH
+#define CURSOR0_1_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH__SHIFT                             0x0
+#define CURSOR0_1_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH_MASK                               0x0000FFFFL
+//CURSOR0_1_CURSOR_SIZE
+#define CURSOR0_1_CURSOR_SIZE__CURSOR_HEIGHT__SHIFT                                                           0x0
+#define CURSOR0_1_CURSOR_SIZE__CURSOR_WIDTH__SHIFT                                                            0x10
+#define CURSOR0_1_CURSOR_SIZE__CURSOR_HEIGHT_MASK                                                             0x000001FFL
+#define CURSOR0_1_CURSOR_SIZE__CURSOR_WIDTH_MASK                                                              0x01FF0000L
+//CURSOR0_1_CURSOR_POSITION
+#define CURSOR0_1_CURSOR_POSITION__CURSOR_Y_POSITION__SHIFT                                                   0x0
+#define CURSOR0_1_CURSOR_POSITION__CURSOR_X_POSITION__SHIFT                                                   0xf
+#define CURSOR0_1_CURSOR_POSITION__CURSOR_Y_POSITION_MASK                                                     0x00007FFFL
+#define CURSOR0_1_CURSOR_POSITION__CURSOR_X_POSITION_MASK                                                     0x3FFF8000L
+//CURSOR0_1_CURSOR_HOT_SPOT
+#define CURSOR0_1_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y__SHIFT                                                   0x0
+#define CURSOR0_1_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X__SHIFT                                                   0x10
+#define CURSOR0_1_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y_MASK                                                     0x000000FFL
+#define CURSOR0_1_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X_MASK                                                     0x00FF0000L
+//CURSOR0_1_CURSOR_STEREO_CONTROL
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN__SHIFT                                              0x0
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET__SHIFT                                         0x2
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET__SHIFT                                       0x11
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN_MASK                                                0x00000001L
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET_MASK                                           0x0001FFFCL
+#define CURSOR0_1_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET_MASK                                         0xFFFE0000L
+//CURSOR0_1_CURSOR_DST_OFFSET
+#define CURSOR0_1_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET__SHIFT                                               0x0
+#define CURSOR0_1_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET_MASK                                                 0x00003FFFL
+//CURSOR0_1_CURSOR_MEM_PWR_CTRL
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE__SHIFT                                              0x0
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS__SHIFT                                                0x2
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE__SHIFT                                            0x4
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE_MASK                                                0x00000003L
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS_MASK                                                  0x00000004L
+#define CURSOR0_1_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE_MASK                                              0x00000030L
+//CURSOR0_1_CURSOR_MEM_PWR_STATUS
+#define CURSOR0_1_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE__SHIFT                                            0x0
+#define CURSOR0_1_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE_MASK                                              0x00000003L
+//CURSOR0_1_DMDATA_ADDRESS_HIGH
+#define CURSOR0_1_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH__SHIFT                                             0x0
+#define CURSOR0_1_DMDATA_ADDRESS_HIGH__DMDATA_TMZ__SHIFT                                                      0x1e
+#define CURSOR0_1_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH_MASK                                               0x0000FFFFL
+#define CURSOR0_1_DMDATA_ADDRESS_HIGH__DMDATA_TMZ_MASK                                                        0x40000000L
+//CURSOR0_1_DMDATA_ADDRESS_LOW
+#define CURSOR0_1_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW__SHIFT                                               0x0
+#define CURSOR0_1_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW_MASK                                                 0xFFFFFFFFL
+//CURSOR0_1_DMDATA_CNTL
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_UPDATED__SHIFT                                                          0x0
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_REPEAT__SHIFT                                                           0x1
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_MODE__SHIFT                                                             0x2
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_SIZE__SHIFT                                                             0x10
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_UPDATED_MASK                                                            0x00000001L
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_REPEAT_MASK                                                             0x00000002L
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_MODE_MASK                                                               0x00000004L
+#define CURSOR0_1_DMDATA_CNTL__DMDATA_SIZE_MASK                                                               0x0FFF0000L
+//CURSOR0_1_DMDATA_QOS_CNTL
+#define CURSOR0_1_DMDATA_QOS_CNTL__DMDATA_QOS_MODE__SHIFT                                                     0x0
+#define CURSOR0_1_DMDATA_QOS_CNTL__DMDATA_DL_DELTA__SHIFT                                                     0x10
+#define CURSOR0_1_DMDATA_QOS_CNTL__DMDATA_QOS_MODE_MASK                                                       0x00000001L
+#define CURSOR0_1_DMDATA_QOS_CNTL__DMDATA_DL_DELTA_MASK                                                       0xFFFF0000L
+//CURSOR0_1_DMDATA_STATUS
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_DONE__SHIFT                                                           0x0
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_UNDERFLOW__SHIFT                                                      0x2
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR__SHIFT                                                0x4
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_DONE_MASK                                                             0x00000001L
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_UNDERFLOW_MASK                                                        0x00000004L
+#define CURSOR0_1_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR_MASK                                                  0x00000010L
+//CURSOR0_1_DMDATA_SW_CNTL
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_UPDATED__SHIFT                                                    0x0
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_REPEAT__SHIFT                                                     0x1
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_SIZE__SHIFT                                                       0x10
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_UPDATED_MASK                                                      0x00000001L
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_REPEAT_MASK                                                       0x00000002L
+#define CURSOR0_1_DMDATA_SW_CNTL__DMDATA_SW_SIZE_MASK                                                         0x0FFF0000L
+//CURSOR0_1_DMDATA_SW_DATA
+#define CURSOR0_1_DMDATA_SW_DATA__DMDATA_SW_DATA__SHIFT                                                       0x0
+#define CURSOR0_1_DMDATA_SW_DATA__DMDATA_SW_DATA_MASK                                                         0xFFFFFFFFL
+//CURSOR0_1_HUBP_3DLUT_CONTROL
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE__SHIFT                                                0x0
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE__SHIFT                                       0x1
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH__SHIFT                                                 0x2
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B__SHIFT                                        0x13
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G__SHIFT                                        0x15
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R__SHIFT                                        0x17
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ__SHIFT                                                   0x19
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH__SHIFT                                             0x1e
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE__SHIFT                                                  0x1f
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE_MASK                                                  0x00000001L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE_MASK                                         0x00000002L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH_MASK                                                   0x0003FFFCL
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B_MASK                                          0x00180000L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G_MASK                                          0x00600000L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R_MASK                                          0x01800000L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ_MASK                                                     0x1E000000L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH_MASK                                               0x40000000L
+#define CURSOR0_1_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE_MASK                                                    0x80000000L
+//CURSOR0_1_HUBP_3DLUT_ADDRESS_LOW
+#define CURSOR0_1_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW__SHIFT                                       0x0
+#define CURSOR0_1_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW_MASK                                         0xFFFFFFFFL
+//CURSOR0_1_HUBP_3DLUT_ADDRESS_HIGH
+#define CURSOR0_1_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH__SHIFT                                     0x0
+#define CURSOR0_1_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH_MASK                                       0x0000FFFFL
+//CURSOR0_1_HUBP_3DLUT_DLG_PARAM
+#define CURSOR0_1_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP__SHIFT                                         0x0
+#define CURSOR0_1_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP_MASK                                           0x007FFFFFL
+
+
+// addressBlock: dce_dc_dcbubp1_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON7_PERFCOUNTER_CNTL
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON7_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON7_PERFCOUNTER_CNTL2
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON7_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON7_PERFCOUNTER_STATE
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON7_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON7_PERFMON_CNTL
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON7_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON7_PERFMON_CNTL2
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON7_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON7_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON7_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON7_PERFMON_CVALUE_LOW
+#define DC_PERFMON7_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON7_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON7_PERFMON_HI
+#define DC_PERFMON7_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON7_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON7_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON7_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON7_PERFMON_LOW
+#define DC_PERFMON7_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON7_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON7_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON7_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON7_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubp_dispdec
+//HUBP2_DCSURF_SURFACE_CONFIG
+#define HUBP2_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT__SHIFT                                              0x0
+#define HUBP2_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE__SHIFT                                                    0x8
+#define HUBP2_DCSURF_SURFACE_CONFIG__H_MIRROR_EN__SHIFT                                                       0xa
+#define HUBP2_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN__SHIFT                                                    0xb
+#define HUBP2_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT_MASK                                                0x0000007FL
+#define HUBP2_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE_MASK                                                      0x00000300L
+#define HUBP2_DCSURF_SURFACE_CONFIG__H_MIRROR_EN_MASK                                                         0x00000400L
+#define HUBP2_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN_MASK                                                      0x00000800L
+//HUBP2_DCSURF_ADDR_CONFIG
+#define HUBP2_DCSURF_ADDR_CONFIG__NUM_PIPES__SHIFT                                                            0x0
+#define HUBP2_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE__SHIFT                                                      0x6
+#define HUBP2_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS__SHIFT                                                 0xc
+#define HUBP2_DCSURF_ADDR_CONFIG__NUM_PKRS__SHIFT                                                             0x10
+#define HUBP2_DCSURF_ADDR_CONFIG__NUM_PIPES_MASK                                                              0x00000007L
+#define HUBP2_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE_MASK                                                        0x000000C0L
+#define HUBP2_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS_MASK                                                   0x00003000L
+#define HUBP2_DCSURF_ADDR_CONFIG__NUM_PKRS_MASK                                                               0x00070000L
+//HUBP2_DCSURF_TILING_CONFIG
+#define HUBP2_DCSURF_TILING_CONFIG__SW_MODE__SHIFT                                                            0x0
+#define HUBP2_DCSURF_TILING_CONFIG__DIM_TYPE__SHIFT                                                           0x7
+#define HUBP2_DCSURF_TILING_CONFIG__COMPAT_LEVEL__SHIFT                                                       0xa
+#define HUBP2_DCSURF_TILING_CONFIG__SW_MODE_MASK                                                              0x0000001FL
+#define HUBP2_DCSURF_TILING_CONFIG__DIM_TYPE_MASK                                                             0x00000180L
+#define HUBP2_DCSURF_TILING_CONFIG__COMPAT_LEVEL_MASK                                                         0x00001C00L
+//HUBP2_DCSURF_LEGACY_ADDR_CONFIG
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE__SHIFT                                        0x4
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE__SHIFT                                                    0x8
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG__SHIFT                                                   0xc
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW__SHIFT                                           0x11
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT__SHIFT                                                    0x14
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH__SHIFT                                                    0x18
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT__SHIFT                                                   0x1a
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT__SHIFT                                             0x1c
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS__SHIFT                                              0x1e
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE_MASK                                          0x00000030L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE_MASK                                                      0x00000F00L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG_MASK                                                     0x0001F000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW_MASK                                             0x000E0000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT_MASK                                                      0x00700000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH_MASK                                                      0x03000000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT_MASK                                                     0x0C000000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT_MASK                                               0x30000000L
+#define HUBP2_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS_MASK                                                0xC0000000L
+//HUBP2_DCSURF_PRI_VIEWPORT_START
+#define HUBP2_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP2_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP2_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP2_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE
+#define HUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE__SHIFT                0x0
+#define HUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C__SHIFT              0x10
+#define HUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_MASK                  0x0000FFFFL
+#define HUBP2_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C_MASK                0xFFFF0000L
+//HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP2_DCSURF_PRI_VIEWPORT_START_C
+#define HUBP2_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP2_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP2_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP2_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP2_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP2_DCSURF_SEC_VIEWPORT_START
+#define HUBP2_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP2_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP2_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP2_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP2_DCSURF_SEC_VIEWPORT_START_C
+#define HUBP2_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP2_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP2_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP2_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP2_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP2_DCHUBP_REQ_SIZE_CONFIG
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT__SHIFT                                                     0x0
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR__SHIFT                                            0x4
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE__SHIFT                                                       0x8
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE__SHIFT                                                   0xb
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE__SHIFT                                                  0x14
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE__SHIFT                                                    0x18
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT_MASK                                                       0x00000007L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR_MASK                                              0x00000070L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE_MASK                                                         0x00000700L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE_MASK                                                     0x00001800L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE_MASK                                                    0x00700000L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE_MASK                                                      0x07000000L
+//HUBP2_DCHUBP_REQ_SIZE_CONFIG_C
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C__SHIFT                                                 0x0
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C__SHIFT                                        0x4
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C__SHIFT                                                   0x8
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C__SHIFT                                               0xb
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C__SHIFT                                              0x14
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C_MASK                                                   0x00000007L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C_MASK                                          0x00000070L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C_MASK                                                     0x00000700L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C_MASK                                                 0x00001800L
+#define HUBP2_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C_MASK                                                0x00700000L
+//HUBP2_DCHUBP_CNTL
+#define HUBP2_DCHUBP_CNTL__HUBP_BLANK_EN__SHIFT                                                               0x0
+#define HUBP2_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ__SHIFT                                                     0x1
+#define HUBP2_DCHUBP_CNTL__HUBP_SOFT_RESET__SHIFT                                                             0x2
+#define HUBP2_DCHUBP_CNTL__HUBP_IN_BLANK__SHIFT                                                               0x3
+#define HUBP2_DCHUBP_CNTL__HUBP_VTG_SEL__SHIFT                                                                0x4
+#define HUBP2_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC__SHIFT                                               0x8
+#define HUBP2_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM__SHIFT                                            0x9
+#define HUBP2_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE__SHIFT                                                     0xa
+#define HUBP2_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS__SHIFT                                                   0xb
+#define HUBP2_DCHUBP_CNTL__HUBP_TTU_DISABLE__SHIFT                                                            0xc
+#define HUBP2_DCHUBP_CNTL__HUBP_TTU_MODE__SHIFT                                                               0xd
+#define HUBP2_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ__SHIFT                                                 0x10
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS__SHIFT                                                         0x14
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD__SHIFT                                                      0x18
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR__SHIFT                                                   0x1a
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN__SHIFT                                                   0x1b
+#define HUBP2_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS__SHIFT                                                       0x1c
+#define HUBP2_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR__SHIFT                                                        0x1f
+#define HUBP2_DCHUBP_CNTL__HUBP_BLANK_EN_MASK                                                                 0x00000001L
+#define HUBP2_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ_MASK                                                       0x00000002L
+#define HUBP2_DCHUBP_CNTL__HUBP_SOFT_RESET_MASK                                                               0x00000004L
+#define HUBP2_DCHUBP_CNTL__HUBP_IN_BLANK_MASK                                                                 0x00000008L
+#define HUBP2_DCHUBP_CNTL__HUBP_VTG_SEL_MASK                                                                  0x000000F0L
+#define HUBP2_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC_MASK                                                 0x00000100L
+#define HUBP2_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM_MASK                                              0x00000200L
+#define HUBP2_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE_MASK                                                       0x00000400L
+#define HUBP2_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS_MASK                                                     0x00000800L
+#define HUBP2_DCHUBP_CNTL__HUBP_TTU_DISABLE_MASK                                                              0x00001000L
+#define HUBP2_DCHUBP_CNTL__HUBP_TTU_MODE_MASK                                                                 0x0000E000L
+#define HUBP2_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ_MASK                                                   0x000F0000L
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_MASK                                                           0x00F00000L
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD_MASK                                                        0x03000000L
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR_MASK                                                     0x04000000L
+#define HUBP2_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN_MASK                                                     0x08000000L
+#define HUBP2_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS_MASK                                                         0x70000000L
+#define HUBP2_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR_MASK                                                          0x80000000L
+//HUBP2_HUBP_CLK_CNTL
+#define HUBP2_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE__SHIFT                                                         0x0
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS__SHIFT                                                   0x4
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS__SHIFT                                                   0x5
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS__SHIFT                                                    0x8
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS__SHIFT                                                    0xc
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS__SHIFT                                                    0x10
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON__SHIFT                                                   0x14
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON__SHIFT                                                    0x15
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON__SHIFT                                                    0x16
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON__SHIFT                                                    0x17
+#define HUBP2_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON__SHIFT                                                   0x19
+#define HUBP2_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define HUBP2_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE_MASK                                                           0x00000001L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS_MASK                                                     0x00000010L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS_MASK                                                     0x00000020L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS_MASK                                                      0x00000100L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS_MASK                                                      0x00001000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS_MASK                                                      0x00010000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON_MASK                                                     0x00100000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON_MASK                                                      0x00200000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON_MASK                                                      0x00400000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON_MASK                                                      0x00800000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON_MASK                                                     0x02000000L
+#define HUBP2_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL_MASK                                                           0xF0000000L
+//HUBP2_DCHUBP_VMPG_CONFIG
+#define HUBP2_DCHUBP_VMPG_CONFIG__VMPG_SIZE__SHIFT                                                            0x0
+#define HUBP2_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE__SHIFT                                                      0x1
+#define HUBP2_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE__SHIFT                                                   0x2
+#define HUBP2_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME__SHIFT                                              0x7
+#define HUBP2_DCHUBP_VMPG_CONFIG__VMPG_SIZE_MASK                                                              0x00000001L
+#define HUBP2_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE_MASK                                                        0x00000002L
+#define HUBP2_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE_MASK                                                     0x0000007CL
+#define HUBP2_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME_MASK                                                0x00000080L
+//HUBP2_DCHUBP_SUB_VP_CFG0
+#define HUBP2_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE__SHIFT                                            0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION__SHIFT                                                0x1
+#define HUBP2_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0__SHIFT                                               0x2
+#define HUBP2_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0__SHIFT                                               0xe
+#define HUBP2_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE_MASK                                              0x00000001L
+#define HUBP2_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION_MASK                                                  0x00000002L
+#define HUBP2_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0_MASK                                                 0x00003FFCL
+#define HUBP2_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0_MASK                                                 0x03FFC000L
+//HUBP2_DCHUBP_SUB_VP_CFG1
+#define HUBP2_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0__SHIFT                                                0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0__SHIFT                                                0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0_MASK                                                  0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0_MASK                                                  0xFFFF0000L
+//HUBP2_DCHUBP_SUB_VP_CFG2
+#define HUBP2_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0__SHIFT                                               0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0__SHIFT                                               0xc
+#define HUBP2_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0_MASK                                                 0x00000FFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0_MASK                                                 0x00FFF000L
+//HUBP2_DCHUBP_SUB_VP_CFG3
+#define HUBP2_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP2_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP2_DCHUBP_SUB_VP_CFG4
+#define HUBP2_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1__SHIFT                                                0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1__SHIFT                                                0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1_MASK                                                  0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1_MASK                                                  0xFFFF0000L
+//HUBP2_DCHUBP_SUB_VP_CFG5
+#define HUBP2_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP2_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP2_DCHUBP_SUB_VP_CFG6
+#define HUBP2_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP2_DCHUBP_SUB_VP_CFG7
+#define HUBP2_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP2_DCHUBP_SUB_VP_CFG8
+#define HUBP2_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0_MASK                                         0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0_MASK                                         0xFFFF0000L
+//HUBP2_DCHUBP_SUB_VP_CFG9
+#define HUBP2_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1__SHIFT                                        0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1_MASK                                          0xFFFFFFFFL
+//HUBP2_DCHUBP_SUB_VP_CFG10
+#define HUBP2_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1__SHIFT                                       0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1_MASK                                         0xFFFFFFFFL
+//HUBP2_DCHUBP_SUB_VP_CFG11
+#define HUBP2_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1_MASK                                        0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1_MASK                                        0xFFFF0000L
+//HUBP2_DCHUBP_SUB_VP_CFG12
+#define HUBP2_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0__SHIFT                                               0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0__SHIFT                                               0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0_MASK                                                 0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0_MASK                                                 0xFFFF0000L
+//HUBP2_DCHUBP_SUB_VP_CFG13
+#define HUBP2_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1__SHIFT                                               0x0
+#define HUBP2_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1__SHIFT                                               0x10
+#define HUBP2_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1_MASK                                                 0x0000FFFFL
+#define HUBP2_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1_MASK                                                 0xFFFF0000L
+//HUBP2_DCHUBP_MCACHEID_CONFIG
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0__SHIFT                                          0x0
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0__SHIFT                                          0x4
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1__SHIFT                                          0x8
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1__SHIFT                                          0xc
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0__SHIFT                                         0x10
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0__SHIFT                                         0x14
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1__SHIFT                                         0x18
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1__SHIFT                                         0x1c
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0_MASK                                            0x0000000FL
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0_MASK                                            0x000000F0L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1_MASK                                            0x00000F00L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1_MASK                                            0x0000F000L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0_MASK                                           0x000F0000L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0_MASK                                           0x00F00000L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1_MASK                                           0x0F000000L
+#define HUBP2_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1_MASK                                           0xF0000000L
+//HUBP2_HUBPREQ_DEBUG_DB
+#define HUBP2_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG__SHIFT                                                          0x0
+#define HUBP2_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG_MASK                                                            0xFFFFFFFFL
+//HUBP2_HUBPREQ_DEBUG
+#define HUBP2_HUBPREQ_DEBUG__HUBPREQ_DEBUG__SHIFT                                                             0x0
+#define HUBP2_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS__SHIFT                                 0x1f
+#define HUBP2_HUBPREQ_DEBUG__HUBPREQ_DEBUG_MASK                                                               0x7FFFFFFFL
+#define HUBP2_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS_MASK                                   0x80000000L
+//HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK__SHIFT                                 0x0
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK__SHIFT                          0x4
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK__SHIFT                              0xc
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK__SHIFT                               0x14
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK__SHIFT                               0x1c
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK_MASK                                   0x00000001L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK_MASK                            0x00000FF0L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK_MASK                                0x0001F000L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK_MASK                                 0x01F00000L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK_MASK                                 0x30000000L
+//HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK__SHIFT                                 0x0
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK__SHIFT                            0x1
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK__SHIFT                          0x4
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK__SHIFT                              0xc
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK__SHIFT                               0x14
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK_MASK                                   0x00000001L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK_MASK                              0x00000002L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK_MASK                            0x00000FF0L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK_MASK                                0x0001F000L
+#define HUBP2_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK_MASK                                 0x01F00000L
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubpreq_dispdec
+//HUBPREQ2_DCSURF_SURFACE_PITCH
+#define HUBPREQ2_DCSURF_SURFACE_PITCH__PITCH__SHIFT                                                           0x0
+#define HUBPREQ2_DCSURF_SURFACE_PITCH__PITCH_MASK                                                             0x0000FFFFL
+//HUBPREQ2_DCSURF_SURFACE_PITCH_C
+#define HUBPREQ2_DCSURF_SURFACE_PITCH_C__PITCH_C__SHIFT                                                       0x0
+#define HUBPREQ2_DCSURF_SURFACE_PITCH_C__PITCH_C_MASK                                                         0x0000FFFFL
+//HUBPREQ2_VMID_SETTINGS_0
+#define HUBPREQ2_VMID_SETTINGS_0__VMID__SHIFT                                                                 0x0
+#define HUBPREQ2_VMID_SETTINGS_0__VMID_MASK                                                                   0x0000000FL
+//HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS__SHIFT                               0x0
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS_MASK                                 0xFFFFFFFFL
+//HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH__SHIFT                     0x0
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH_MASK                       0x0000FFFFL
+//HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_C
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C__SHIFT                           0x0
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C_MASK                             0xFFFFFFFFL
+//HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C__SHIFT                 0x0
+#define HUBPREQ2_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C_MASK                   0x0000FFFFL
+//HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS__SHIFT                           0x0
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS_MASK                             0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH__SHIFT                 0x0
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH_MASK                   0x0000FFFFL
+//HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_C
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C__SHIFT                       0x0
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C_MASK                         0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C__SHIFT             0x0
+#define HUBPREQ2_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C_MASK               0x0000FFFFL
+//HUBPREQ2_DCSURF_SURFACE_CONTROL
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ__SHIFT                                           0x0
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN__SHIFT                                        0x4
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C__SHIFT                                         0x5
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ__SHIFT                                         0x9
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN__SHIFT                                      0xd
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C__SHIFT                                       0xe
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_MASK                                             0x0000000FL
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN_MASK                                          0x00000010L
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C_MASK                                           0x000001E0L
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_MASK                                           0x00001E00L
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN_MASK                                        0x00002000L
+#define HUBPREQ2_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C_MASK                                         0x0003C000L
+//HUBPREQ2_DCSURF_FLIP_CONTROL
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK__SHIFT                                              0x0
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE__SHIFT                                                0x1
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING__SHIFT                                             0x8
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS__SHIFT                                0x9
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC__SHIFT                                 0xc
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC__SHIFT                                       0x10
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE__SHIFT                               0x11
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY__SHIFT                              0x12
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY__SHIFT                                       0x14
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK_MASK                                                0x00000001L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE_MASK                                                  0x00000002L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_MASK                                               0x00000100L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS_MASK                                  0x00000200L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC_MASK                                   0x00003000L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC_MASK                                         0x00010000L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE_MASK                                 0x00020000L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY_MASK                                0x00040000L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY_MASK                                         0x3FF00000L
+//HUBPREQ2_DCSURF_FLIP_CONTROL2
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME__SHIFT                                   0x0
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE__SHIFT                                              0x8
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK__SHIFT                                                0x9
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE__SHIFT                                    0xa
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH__SHIFT                                     0xc
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE__SHIFT                                    0x1f
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME_MASK                                     0x000000FFL
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE_MASK                                                0x00000100L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK_MASK                                                  0x00000200L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE_MASK                                      0x00000400L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH_MASK                                       0x00001000L
+#define HUBPREQ2_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE_MASK                                      0x80000000L
+//HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK__SHIFT                                  0x0
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE__SHIFT                                  0x1
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK__SHIFT                             0x2
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE__SHIFT                             0x3
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR__SHIFT                                     0x8
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR__SHIFT                                0x9
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED__SHIFT                                  0x10
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS__SHIFT                                0x11
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED__SHIFT                             0x12
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS__SHIFT                           0x13
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK_MASK                                    0x00000001L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE_MASK                                    0x00000002L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK_MASK                               0x00000004L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE_MASK                               0x00000008L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR_MASK                                       0x00000100L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR_MASK                                  0x00000200L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED_MASK                                    0x00010000L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS_MASK                                  0x00020000L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED_MASK                               0x00040000L
+#define HUBPREQ2_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS_MASK                             0x00080000L
+//HUBPREQ2_DCSURF_SURFACE_INUSE
+#define HUBPREQ2_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS__SHIFT                                           0x0
+#define HUBPREQ2_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS_MASK                                             0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH__SHIFT                                 0x0
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID__SHIFT                                         0x1c
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH_MASK                                   0x0000FFFFL
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID_MASK                                           0xF0000000L
+//HUBPREQ2_DCSURF_SURFACE_INUSE_C
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C__SHIFT                                       0x0
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C_MASK                                         0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C__SHIFT                             0x0
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C__SHIFT                                     0x1c
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C_MASK                               0x0000FFFFL
+#define HUBPREQ2_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C_MASK                                       0xF0000000L
+//HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS__SHIFT                         0x0
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS_MASK                           0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH__SHIFT               0x0
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID__SHIFT                       0x1c
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_MASK                 0x0000FFFFL
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID_MASK                         0xF0000000L
+//HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_C
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C__SHIFT                     0x0
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C_MASK                       0xFFFFFFFFL
+//HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C__SHIFT           0x0
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C__SHIFT                   0x1c
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C_MASK             0x0000FFFFL
+#define HUBPREQ2_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C_MASK                     0xF0000000L
+//HUBPREQ2_DCN_EXPANSION_MODE
+#define HUBPREQ2_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE__SHIFT                                                0x0
+#define HUBPREQ2_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE__SHIFT                                                0x2
+#define HUBPREQ2_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE__SHIFT                                                0x4
+#define HUBPREQ2_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE__SHIFT                                                0x6
+#define HUBPREQ2_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE_MASK                                                  0x00000003L
+#define HUBPREQ2_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE_MASK                                                  0x0000000CL
+#define HUBPREQ2_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE_MASK                                                  0x00000030L
+#define HUBPREQ2_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE_MASK                                                  0x000000C0L
+//HUBPREQ2_DCN_GLOBAL_TTU_CNTL
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK__SHIFT                                                   0x0
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT__SHIFT                                             0x18
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT__SHIFT                                             0x19
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH__SHIFT                                          0x1a
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE__SHIFT                                                     0x1b
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY__SHIFT                                0x1c
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP__SHIFT                                                0x1e
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH__SHIFT                                         0x1f
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK_MASK                                                     0x00FFFFFFL
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT_MASK                                               0x01000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT_MASK                                               0x02000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH_MASK                                            0x04000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE_MASK                                                       0x08000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY_MASK                                  0x10000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP_MASK                                                  0x40000000L
+#define HUBPREQ2_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH_MASK                                           0x80000000L
+//HUBPREQ2_DCN_SURF0_TTU_CNTL0
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ2_DCN_SURF0_TTU_CNTL1
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ2_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ2_DCN_SURF1_TTU_CNTL0
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ2_DCN_SURF1_TTU_CNTL1
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ2_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ2_DCN_CUR0_TTU_CNTL0
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ2_DCN_CUR0_TTU_CNTL1
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ2_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ2_DCN_CUR1_TTU_CNTL0
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ2_DCN_CUR1_TTU_CNTL1
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ2_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ2_DCN_DMDATA_VM_CNTL
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA__SHIFT                                              0x0
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS__SHIFT                                            0x10
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR__SHIFT                                      0x14
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS__SHIFT                                        0x18
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS__SHIFT                                             0x19
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR__SHIFT                                  0x1a
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE__SHIFT                                                    0x1f
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA_MASK                                                0x0000FFFFL
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_MASK                                              0x000F0000L
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR_MASK                                        0x00100000L
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_MASK                                          0x01000000L
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS_MASK                                               0x02000000L
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR_MASK                                    0x04000000L
+#define HUBPREQ2_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE_MASK                                                      0x80000000L
+//HUBPREQ2_DCN_VM_SYSTEM_APERTURE_LOW_ADDR
+#define HUBPREQ2_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR__SHIFT                       0x0
+#define HUBPREQ2_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR_MASK                         0x3FFFFFFFL
+//HUBPREQ2_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR
+#define HUBPREQ2_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR__SHIFT                     0x0
+#define HUBPREQ2_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR_MASK                       0x3FFFFFFFL
+//HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB__SHIFT                                                  0x0
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE__SHIFT                                             0x3
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS__SHIFT                                0x5
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL__SHIFT                                   0x6
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB_MASK                                                    0x00000001L
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE_MASK                                               0x00000018L
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS_MASK                                  0x00000020L
+#define HUBPREQ2_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL_MASK                                     0x00000040L
+//HUBPREQ2_BLANK_OFFSET_0
+#define HUBPREQ2_BLANK_OFFSET_0__REFCYC_H_BLANK_END__SHIFT                                                    0x0
+#define HUBPREQ2_BLANK_OFFSET_0__DLG_V_BLANK_END__SHIFT                                                       0x10
+#define HUBPREQ2_BLANK_OFFSET_0__REFCYC_H_BLANK_END_MASK                                                      0x00001FFFL
+#define HUBPREQ2_BLANK_OFFSET_0__DLG_V_BLANK_END_MASK                                                         0x7FFF0000L
+//HUBPREQ2_BLANK_OFFSET_1
+#define HUBPREQ2_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START__SHIFT                                                  0x0
+#define HUBPREQ2_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START_MASK                                                    0x0003FFFFL
+//HUBPREQ2_DST_DIMENSIONS
+#define HUBPREQ2_DST_DIMENSIONS__REFCYC_PER_HTOTAL__SHIFT                                                     0x0
+#define HUBPREQ2_DST_DIMENSIONS__REFCYC_PER_HTOTAL_MASK                                                       0x001FFFFFL
+//HUBPREQ2_DST_AFTER_SCALER
+#define HUBPREQ2_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER__SHIFT                                               0x0
+#define HUBPREQ2_DST_AFTER_SCALER__DST_Y_AFTER_SCALER__SHIFT                                                  0x10
+#define HUBPREQ2_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER_MASK                                                 0x00001FFFL
+#define HUBPREQ2_DST_AFTER_SCALER__DST_Y_AFTER_SCALER_MASK                                                    0x00070000L
+//HUBPREQ2_PREFETCH_SETTINGS
+#define HUBPREQ2_PREFETCH_SETTINGS__VRATIO_PREFETCH__SHIFT                                                    0x0
+#define HUBPREQ2_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK__SHIFT                                          0x17
+#define HUBPREQ2_PREFETCH_SETTINGS__DST_Y_PREFETCH__SHIFT                                                     0x18
+#define HUBPREQ2_PREFETCH_SETTINGS__VRATIO_PREFETCH_MASK                                                      0x003FFFFFL
+#define HUBPREQ2_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK_MASK                                            0x00800000L
+#define HUBPREQ2_PREFETCH_SETTINGS__DST_Y_PREFETCH_MASK                                                       0xFF000000L
+//HUBPREQ2_PREFETCH_SETTINGS_C
+#define HUBPREQ2_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C__SHIFT                                                0x0
+#define HUBPREQ2_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C_MASK                                                  0x003FFFFFL
+//HUBPREQ2_VBLANK_PARAMETERS_0
+#define HUBPREQ2_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK__SHIFT                                              0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK__SHIFT                                             0x8
+#define HUBPREQ2_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK_MASK                                                0x0000007FL
+#define HUBPREQ2_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK_MASK                                               0x00003F00L
+//HUBPREQ2_VBLANK_PARAMETERS_1
+#define HUBPREQ2_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L__SHIFT                                    0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L_MASK                                      0x007FFFFFL
+//HUBPREQ2_VBLANK_PARAMETERS_2
+#define HUBPREQ2_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C__SHIFT                                    0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C_MASK                                      0x007FFFFFL
+//HUBPREQ2_VBLANK_PARAMETERS_3
+#define HUBPREQ2_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L__SHIFT                                   0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L_MASK                                     0x007FFFFFL
+//HUBPREQ2_VBLANK_PARAMETERS_4
+#define HUBPREQ2_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C__SHIFT                                   0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C_MASK                                     0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_0
+#define HUBPREQ2_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP__SHIFT                                                  0x0
+#define HUBPREQ2_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP__SHIFT                                                 0x8
+#define HUBPREQ2_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP_MASK                                                    0x0000007FL
+#define HUBPREQ2_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP_MASK                                                   0x00003F00L
+//HUBPREQ2_FLIP_PARAMETERS_1
+#define HUBPREQ2_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L__SHIFT                                        0x0
+#define HUBPREQ2_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L_MASK                                          0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_2
+#define HUBPREQ2_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L__SHIFT                                       0x0
+#define HUBPREQ2_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L_MASK                                         0x007FFFFFL
+//HUBPREQ2_NOM_PARAMETERS_0
+#define HUBPREQ2_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L__SHIFT                                             0x0
+#define HUBPREQ2_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L_MASK                                               0x0001FFFFL
+//HUBPREQ2_NOM_PARAMETERS_1
+#define HUBPREQ2_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L__SHIFT                                          0x0
+#define HUBPREQ2_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L_MASK                                            0x007FFFFFL
+//HUBPREQ2_NOM_PARAMETERS_2
+#define HUBPREQ2_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C__SHIFT                                             0x0
+#define HUBPREQ2_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C_MASK                                               0x0001FFFFL
+//HUBPREQ2_NOM_PARAMETERS_3
+#define HUBPREQ2_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C__SHIFT                                          0x0
+#define HUBPREQ2_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C_MASK                                            0x007FFFFFL
+//HUBPREQ2_NOM_PARAMETERS_4
+#define HUBPREQ2_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L__SHIFT                                            0x0
+#define HUBPREQ2_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L_MASK                                              0x0001FFFFL
+//HUBPREQ2_NOM_PARAMETERS_5
+#define HUBPREQ2_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L__SHIFT                                         0x0
+#define HUBPREQ2_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L_MASK                                           0x007FFFFFL
+//HUBPREQ2_NOM_PARAMETERS_6
+#define HUBPREQ2_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C__SHIFT                                            0x0
+#define HUBPREQ2_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C_MASK                                              0x0001FFFFL
+//HUBPREQ2_NOM_PARAMETERS_7
+#define HUBPREQ2_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C__SHIFT                                         0x0
+#define HUBPREQ2_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C_MASK                                           0x007FFFFFL
+//HUBPREQ2_PER_LINE_DELIVERY_PRE
+#define HUBPREQ2_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L__SHIFT                                 0x0
+#define HUBPREQ2_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C__SHIFT                                 0x10
+#define HUBPREQ2_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L_MASK                                   0x00001FFFL
+#define HUBPREQ2_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C_MASK                                   0x1FFF0000L
+//HUBPREQ2_PER_LINE_DELIVERY
+#define HUBPREQ2_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L__SHIFT                                         0x0
+#define HUBPREQ2_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C__SHIFT                                         0x10
+#define HUBPREQ2_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L_MASK                                           0x00001FFFL
+#define HUBPREQ2_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C_MASK                                           0x1FFF0000L
+//HUBPREQ2_CURSOR_SETTINGS
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET__SHIFT                                                 0x0
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST__SHIFT                                             0x8
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET__SHIFT                                                 0x10
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST__SHIFT                                             0x18
+#define HUBPREQ2_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF__SHIFT                                            0x1e
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET_MASK                                                   0x000000FFL
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST_MASK                                               0x00000300L
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET_MASK                                                   0x00FF0000L
+#define HUBPREQ2_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST_MASK                                               0x03000000L
+#define HUBPREQ2_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF_MASK                                              0x40000000L
+//HUBPREQ2_REF_FREQ_TO_PIX_FREQ
+#define HUBPREQ2_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ__SHIFT                                            0x0
+#define HUBPREQ2_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ_MASK                                              0x001FFFFFL
+//HUBPREQ2_DST_Y_DELTA_DRQ_LIMIT
+#define HUBPREQ2_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT__SHIFT                                          0x0
+#define HUBPREQ2_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT_MASK                                            0x00007FFFL
+//HUBPREQ2_DST_Y_ALT_CH_DRQ_LIMIT
+#define HUBPREQ2_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT__SHIFT                                        0x0
+#define HUBPREQ2_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT_MASK                                          0x00007FFFL
+//HUBPREQ2_HUBPREQ_MEM_PWR_CTRL
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE__SHIFT                                          0x0
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS__SHIFT                                            0x2
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE__SHIFT                                          0x4
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS__SHIFT                                            0x6
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE__SHIFT                                           0x8
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS__SHIFT                                             0xa
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE_MASK                                            0x00000003L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS_MASK                                              0x00000004L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE_MASK                                            0x00000030L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS_MASK                                              0x00000040L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE_MASK                                             0x00000300L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS_MASK                                               0x00000400L
+//HUBPREQ2_HUBPREQ_MEM_PWR_STATUS
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE__SHIFT                                        0x0
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE__SHIFT                                        0x2
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE__SHIFT                                         0x4
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE_MASK                                          0x00000003L
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE_MASK                                          0x0000000CL
+#define HUBPREQ2_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE_MASK                                           0x00000030L
+//HUBPREQ2_VBLANK_PARAMETERS_5
+#define HUBPREQ2_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK__SHIFT                                       0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK_MASK                                         0x007FFFFFL
+//HUBPREQ2_VBLANK_PARAMETERS_6
+#define HUBPREQ2_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK__SHIFT                                         0x0
+#define HUBPREQ2_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK_MASK                                           0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_3
+#define HUBPREQ2_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP__SHIFT                                           0x0
+#define HUBPREQ2_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP_MASK                                             0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_4
+#define HUBPREQ2_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP__SHIFT                                             0x0
+#define HUBPREQ2_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP_MASK                                               0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_5
+#define HUBPREQ2_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C__SHIFT                                        0x0
+#define HUBPREQ2_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C_MASK                                          0x007FFFFFL
+//HUBPREQ2_FLIP_PARAMETERS_6
+#define HUBPREQ2_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C__SHIFT                                       0x0
+#define HUBPREQ2_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C_MASK                                         0x007FFFFFL
+//HUBPREQ2_UCLK_PSTATE_FORCE
+#define HUBPREQ2_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN__SHIFT                                          0x0
+#define HUBPREQ2_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE__SHIFT                                       0x1
+#define HUBPREQ2_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN__SHIFT                                        0x2
+#define HUBPREQ2_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE__SHIFT                                     0x3
+#define HUBPREQ2_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN_MASK                                            0x00000001L
+#define HUBPREQ2_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE_MASK                                         0x00000002L
+#define HUBPREQ2_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN_MASK                                          0x00000004L
+#define HUBPREQ2_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE_MASK                                       0x00000008L
+//HUBPREQ2_HUBPREQ_STATUS_REG0
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0__SHIFT                                         0x0
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1__SHIFT                                         0x8
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT__SHIFT                                                 0x10
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0_MASK                                           0x0000001FL
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1_MASK                                           0x00001F00L
+#define HUBPREQ2_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT_MASK                                                   0x7FFF0000L
+//HUBPREQ2_HUBPREQ_STATUS_REG1
+#define HUBPREQ2_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0__SHIFT                                       0x0
+#define HUBPREQ2_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1__SHIFT                                       0x10
+#define HUBPREQ2_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0_MASK                                         0x0000FFFFL
+#define HUBPREQ2_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1_MASK                                         0xFFFF0000L
+//HUBPREQ2_HUBPREQ_STATUS_REG2
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0__SHIFT                                      0x0
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0__SHIFT                                     0x1
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0__SHIFT                               0x2
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0__SHIFT                               0x3
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0__SHIFT                                                 0x5
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1__SHIFT                                      0x8
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1__SHIFT                                     0x9
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1__SHIFT                               0xa
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1__SHIFT                               0xb
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1__SHIFT                                                 0xd
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR__SHIFT                                     0x10
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR__SHIFT                                    0x11
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR__SHIFT                              0x12
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR__SHIFT                              0x13
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR__SHIFT                                                0x15
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_VBLANK__SHIFT                                                    0x1a
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN__SHIFT                                                   0x1b
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY__SHIFT                                          0x1c
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH__SHIFT                                             0x1d
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0__SHIFT                                            0x1e
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1__SHIFT                                            0x1f
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0_MASK                                        0x00000001L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0_MASK                                       0x00000002L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0_MASK                                 0x00000004L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0_MASK                                 0x00000008L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0_MASK                                                   0x00000020L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1_MASK                                        0x00000100L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1_MASK                                       0x00000200L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1_MASK                                 0x00000400L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1_MASK                                 0x00000800L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1_MASK                                                   0x00002000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR_MASK                                       0x00010000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR_MASK                                      0x00020000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR_MASK                                0x00040000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR_MASK                                0x00080000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR_MASK                                                  0x00200000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_VBLANK_MASK                                                      0x04000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN_MASK                                                     0x08000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY_MASK                                            0x10000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH_MASK                                               0x20000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0_MASK                                              0x40000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1_MASK                                              0x80000000L
+//HUBPREQ2_HUBPREQ_STATUS_REG3
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL__SHIFT                                            0x0
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE__SHIFT                                     0x1
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL__SHIFT                                            0x2
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0__SHIFT                                              0x3
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0__SHIFT                                   0x6
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0__SHIFT                                    0x7
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0__SHIFT                                         0x9
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0__SHIFT                                  0xa
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1__SHIFT                                              0xd
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1__SHIFT                                   0x10
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1__SHIFT                                    0x11
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1__SHIFT                                         0x13
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1__SHIFT                                  0x14
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE__SHIFT                                 0x17
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST__SHIFT                                     0x18
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR__SHIFT                                       0x19
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED__SHIFT                                          0x1a
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT__SHIFT                            0x1b
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT__SHIFT                            0x1d
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL_MASK                                              0x00000001L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE_MASK                                       0x00000002L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL_MASK                                              0x00000004L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0_MASK                                                0x00000038L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0_MASK                                     0x00000040L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0_MASK                                      0x00000180L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0_MASK                                           0x00000200L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0_MASK                                    0x00001C00L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1_MASK                                                0x0000E000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1_MASK                                     0x00010000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1_MASK                                      0x00060000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1_MASK                                           0x00080000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1_MASK                                    0x00700000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE_MASK                                   0x00800000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST_MASK                                       0x01000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR_MASK                                         0x02000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED_MASK                                            0x04000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT_MASK                              0x18000000L
+#define HUBPREQ2_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT_MASK                              0x60000000L
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubpret_dispdec
+//HUBPRET2_HUBPRET_CONTROL
+#define HUBPRET2_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS__SHIFT                                          0x4
+#define HUBPRET2_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE__SHIFT                                            0xf
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA__SHIFT                                                   0x10
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G__SHIFT                                                     0x12
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B__SHIFT                                                    0x14
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R__SHIFT                                                    0x16
+#define HUBPRET2_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS_MASK                                            0x00007FF0L
+#define HUBPRET2_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE_MASK                                              0x00008000L
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA_MASK                                                     0x00030000L
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G_MASK                                                       0x000C0000L
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B_MASK                                                      0x00300000L
+#define HUBPRET2_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R_MASK                                                      0x00C00000L
+//HUBPRET2_HUBPRET_MEM_PWR_CTRL
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE__SHIFT                                             0x8
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS__SHIFT                                               0xa
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE__SHIFT                                            0x10
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS__SHIFT                                              0x12
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE__SHIFT                                          0x14
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE_MASK                                               0x00000300L
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS_MASK                                                 0x00000400L
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE_MASK                                              0x00030000L
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS_MASK                                                0x00040000L
+#define HUBPRET2_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE_MASK                                            0x00300000L
+//HUBPRET2_HUBPRET_MEM_PWR_STATUS
+#define HUBPRET2_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE__SHIFT                                           0x2
+#define HUBPRET2_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE__SHIFT                                          0x4
+#define HUBPRET2_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE_MASK                                             0x0000000CL
+#define HUBPRET2_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE_MASK                                            0x00000030L
+//HUBPRET2_HUBPRET_READ_LINE_CTRL0
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE__SHIFT                         0x0
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM__SHIFT                                0x10
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE_MASK                           0x0000FFFFL
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM_MASK                                  0xFFFF0000L
+//HUBPRET2_HUBPRET_READ_LINE_CTRL1
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED__SHIFT                    0x0
+#define HUBPRET2_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED_MASK                      0x0000FFFFL
+//HUBPRET2_HUBPRET_READ_LINE0
+#define HUBPRET2_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START__SHIFT                                             0x0
+#define HUBPRET2_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END__SHIFT                                               0x10
+#define HUBPRET2_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START_MASK                                               0x0000FFFFL
+#define HUBPRET2_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END_MASK                                                 0xFFFF0000L
+//HUBPRET2_HUBPRET_READ_LINE1
+#define HUBPRET2_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START__SHIFT                                             0x0
+#define HUBPRET2_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END__SHIFT                                               0x10
+#define HUBPRET2_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START_MASK                                               0x0000FFFFL
+#define HUBPRET2_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END_MASK                                                 0xFFFF0000L
+//HUBPRET2_HUBPRET_INTERRUPT
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK__SHIFT                                               0x0
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK__SHIFT                                           0x1
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK__SHIFT                                           0x2
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE__SHIFT                                               0x4
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE__SHIFT                                           0x5
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE__SHIFT                                           0x6
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR__SHIFT                                              0x8
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR__SHIFT                                          0x9
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR__SHIFT                                          0xa
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS__SHIFT                                                 0xc
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS__SHIFT                                             0xd
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS__SHIFT                                             0xe
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS__SHIFT                                             0x10
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS__SHIFT                                         0x11
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS__SHIFT                                         0x12
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK_MASK                                                 0x00000001L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK_MASK                                             0x00000002L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK_MASK                                             0x00000004L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE_MASK                                                 0x00000010L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE_MASK                                             0x00000020L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE_MASK                                             0x00000040L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR_MASK                                                0x00000100L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR_MASK                                            0x00000200L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR_MASK                                            0x00000400L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS_MASK                                                   0x00001000L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS_MASK                                               0x00002000L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS_MASK                                               0x00004000L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS_MASK                                               0x00010000L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS_MASK                                           0x00020000L
+#define HUBPRET2_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS_MASK                                           0x00040000L
+//HUBPRET2_HUBPRET_READ_LINE_VALUE
+#define HUBPRET2_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE__SHIFT                                               0x0
+#define HUBPRET2_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT__SHIFT                                      0x10
+#define HUBPRET2_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_MASK                                                 0x0000FFFFL
+#define HUBPRET2_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT_MASK                                        0xFFFF0000L
+//HUBPRET2_HUBPRET_READ_LINE_STATUS
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK__SHIFT                                            0x0
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE__SHIFT                                      0x4
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE__SHIFT                                     0x5
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE__SHIFT                                      0x8
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE__SHIFT                                     0xa
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK_MASK                                              0x00000001L
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE_MASK                                        0x00000010L
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE_MASK                                       0x00000020L
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE_MASK                                        0x00000100L
+#define HUBPRET2_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE_MASK                                       0x00000400L
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_cursor0_dispdec
+//CURSOR0_2_CURSOR_CONTROL
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_ENABLE__SHIFT                                                        0x0
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_REQ_MODE__SHIFT                                                      0x2
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_2X_MAGNIFY__SHIFT                                                    0x4
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_MODE__SHIFT                                                          0x8
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_TMZ__SHIFT                                                           0xc
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PITCH__SHIFT                                                         0x10
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS__SHIFT                     0x14
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK__SHIFT                                               0x18
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN__SHIFT                                    0x1e
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL__SHIFT                                   0x1f
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_ENABLE_MASK                                                          0x00000001L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_REQ_MODE_MASK                                                        0x00000004L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_2X_MAGNIFY_MASK                                                      0x00000010L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_MODE_MASK                                                            0x00000700L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_TMZ_MASK                                                             0x00001000L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PITCH_MASK                                                           0x00030000L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS_MASK                       0x00100000L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK_MASK                                                 0x1F000000L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN_MASK                                      0x40000000L
+#define CURSOR0_2_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL_MASK                                     0x80000000L
+//CURSOR0_2_CURSOR_SURFACE_ADDRESS
+#define CURSOR0_2_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS__SHIFT                                       0x0
+#define CURSOR0_2_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS_MASK                                         0xFFFFFFFFL
+//CURSOR0_2_CURSOR_SURFACE_ADDRESS_HIGH
+#define CURSOR0_2_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH__SHIFT                             0x0
+#define CURSOR0_2_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH_MASK                               0x0000FFFFL
+//CURSOR0_2_CURSOR_SIZE
+#define CURSOR0_2_CURSOR_SIZE__CURSOR_HEIGHT__SHIFT                                                           0x0
+#define CURSOR0_2_CURSOR_SIZE__CURSOR_WIDTH__SHIFT                                                            0x10
+#define CURSOR0_2_CURSOR_SIZE__CURSOR_HEIGHT_MASK                                                             0x000001FFL
+#define CURSOR0_2_CURSOR_SIZE__CURSOR_WIDTH_MASK                                                              0x01FF0000L
+//CURSOR0_2_CURSOR_POSITION
+#define CURSOR0_2_CURSOR_POSITION__CURSOR_Y_POSITION__SHIFT                                                   0x0
+#define CURSOR0_2_CURSOR_POSITION__CURSOR_X_POSITION__SHIFT                                                   0xf
+#define CURSOR0_2_CURSOR_POSITION__CURSOR_Y_POSITION_MASK                                                     0x00007FFFL
+#define CURSOR0_2_CURSOR_POSITION__CURSOR_X_POSITION_MASK                                                     0x3FFF8000L
+//CURSOR0_2_CURSOR_HOT_SPOT
+#define CURSOR0_2_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y__SHIFT                                                   0x0
+#define CURSOR0_2_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X__SHIFT                                                   0x10
+#define CURSOR0_2_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y_MASK                                                     0x000000FFL
+#define CURSOR0_2_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X_MASK                                                     0x00FF0000L
+//CURSOR0_2_CURSOR_STEREO_CONTROL
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN__SHIFT                                              0x0
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET__SHIFT                                         0x2
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET__SHIFT                                       0x11
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN_MASK                                                0x00000001L
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET_MASK                                           0x0001FFFCL
+#define CURSOR0_2_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET_MASK                                         0xFFFE0000L
+//CURSOR0_2_CURSOR_DST_OFFSET
+#define CURSOR0_2_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET__SHIFT                                               0x0
+#define CURSOR0_2_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET_MASK                                                 0x00003FFFL
+//CURSOR0_2_CURSOR_MEM_PWR_CTRL
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE__SHIFT                                              0x0
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS__SHIFT                                                0x2
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE__SHIFT                                            0x4
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE_MASK                                                0x00000003L
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS_MASK                                                  0x00000004L
+#define CURSOR0_2_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE_MASK                                              0x00000030L
+//CURSOR0_2_CURSOR_MEM_PWR_STATUS
+#define CURSOR0_2_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE__SHIFT                                            0x0
+#define CURSOR0_2_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE_MASK                                              0x00000003L
+//CURSOR0_2_DMDATA_ADDRESS_HIGH
+#define CURSOR0_2_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH__SHIFT                                             0x0
+#define CURSOR0_2_DMDATA_ADDRESS_HIGH__DMDATA_TMZ__SHIFT                                                      0x1e
+#define CURSOR0_2_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH_MASK                                               0x0000FFFFL
+#define CURSOR0_2_DMDATA_ADDRESS_HIGH__DMDATA_TMZ_MASK                                                        0x40000000L
+//CURSOR0_2_DMDATA_ADDRESS_LOW
+#define CURSOR0_2_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW__SHIFT                                               0x0
+#define CURSOR0_2_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW_MASK                                                 0xFFFFFFFFL
+//CURSOR0_2_DMDATA_CNTL
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_UPDATED__SHIFT                                                          0x0
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_REPEAT__SHIFT                                                           0x1
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_MODE__SHIFT                                                             0x2
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_SIZE__SHIFT                                                             0x10
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_UPDATED_MASK                                                            0x00000001L
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_REPEAT_MASK                                                             0x00000002L
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_MODE_MASK                                                               0x00000004L
+#define CURSOR0_2_DMDATA_CNTL__DMDATA_SIZE_MASK                                                               0x0FFF0000L
+//CURSOR0_2_DMDATA_QOS_CNTL
+#define CURSOR0_2_DMDATA_QOS_CNTL__DMDATA_QOS_MODE__SHIFT                                                     0x0
+#define CURSOR0_2_DMDATA_QOS_CNTL__DMDATA_DL_DELTA__SHIFT                                                     0x10
+#define CURSOR0_2_DMDATA_QOS_CNTL__DMDATA_QOS_MODE_MASK                                                       0x00000001L
+#define CURSOR0_2_DMDATA_QOS_CNTL__DMDATA_DL_DELTA_MASK                                                       0xFFFF0000L
+//CURSOR0_2_DMDATA_STATUS
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_DONE__SHIFT                                                           0x0
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_UNDERFLOW__SHIFT                                                      0x2
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR__SHIFT                                                0x4
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_DONE_MASK                                                             0x00000001L
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_UNDERFLOW_MASK                                                        0x00000004L
+#define CURSOR0_2_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR_MASK                                                  0x00000010L
+//CURSOR0_2_DMDATA_SW_CNTL
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_UPDATED__SHIFT                                                    0x0
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_REPEAT__SHIFT                                                     0x1
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_SIZE__SHIFT                                                       0x10
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_UPDATED_MASK                                                      0x00000001L
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_REPEAT_MASK                                                       0x00000002L
+#define CURSOR0_2_DMDATA_SW_CNTL__DMDATA_SW_SIZE_MASK                                                         0x0FFF0000L
+//CURSOR0_2_DMDATA_SW_DATA
+#define CURSOR0_2_DMDATA_SW_DATA__DMDATA_SW_DATA__SHIFT                                                       0x0
+#define CURSOR0_2_DMDATA_SW_DATA__DMDATA_SW_DATA_MASK                                                         0xFFFFFFFFL
+//CURSOR0_2_HUBP_3DLUT_CONTROL
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE__SHIFT                                                0x0
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE__SHIFT                                       0x1
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH__SHIFT                                                 0x2
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B__SHIFT                                        0x13
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G__SHIFT                                        0x15
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R__SHIFT                                        0x17
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ__SHIFT                                                   0x19
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH__SHIFT                                             0x1e
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE__SHIFT                                                  0x1f
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE_MASK                                                  0x00000001L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE_MASK                                         0x00000002L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH_MASK                                                   0x0003FFFCL
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B_MASK                                          0x00180000L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G_MASK                                          0x00600000L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R_MASK                                          0x01800000L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ_MASK                                                     0x1E000000L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH_MASK                                               0x40000000L
+#define CURSOR0_2_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE_MASK                                                    0x80000000L
+//CURSOR0_2_HUBP_3DLUT_ADDRESS_LOW
+#define CURSOR0_2_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW__SHIFT                                       0x0
+#define CURSOR0_2_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW_MASK                                         0xFFFFFFFFL
+//CURSOR0_2_HUBP_3DLUT_ADDRESS_HIGH
+#define CURSOR0_2_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH__SHIFT                                     0x0
+#define CURSOR0_2_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH_MASK                                       0x0000FFFFL
+//CURSOR0_2_HUBP_3DLUT_DLG_PARAM
+#define CURSOR0_2_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP__SHIFT                                         0x0
+#define CURSOR0_2_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP_MASK                                           0x007FFFFFL
+
+
+// addressBlock: dce_dc_dcbubp2_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON8_PERFCOUNTER_CNTL
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON8_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON8_PERFCOUNTER_CNTL2
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON8_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON8_PERFCOUNTER_STATE
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON8_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON8_PERFMON_CNTL
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON8_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON8_PERFMON_CNTL2
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON8_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON8_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON8_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON8_PERFMON_CVALUE_LOW
+#define DC_PERFMON8_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON8_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON8_PERFMON_HI
+#define DC_PERFMON8_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON8_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON8_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON8_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON8_PERFMON_LOW
+#define DC_PERFMON8_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON8_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON8_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON8_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON8_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubp_dispdec
+//HUBP3_DCSURF_SURFACE_CONFIG
+#define HUBP3_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT__SHIFT                                              0x0
+#define HUBP3_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE__SHIFT                                                    0x8
+#define HUBP3_DCSURF_SURFACE_CONFIG__H_MIRROR_EN__SHIFT                                                       0xa
+#define HUBP3_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN__SHIFT                                                    0xb
+#define HUBP3_DCSURF_SURFACE_CONFIG__SURFACE_PIXEL_FORMAT_MASK                                                0x0000007FL
+#define HUBP3_DCSURF_SURFACE_CONFIG__ROTATION_ANGLE_MASK                                                      0x00000300L
+#define HUBP3_DCSURF_SURFACE_CONFIG__H_MIRROR_EN_MASK                                                         0x00000400L
+#define HUBP3_DCSURF_SURFACE_CONFIG__ALPHA_PLANE_EN_MASK                                                      0x00000800L
+//HUBP3_DCSURF_ADDR_CONFIG
+#define HUBP3_DCSURF_ADDR_CONFIG__NUM_PIPES__SHIFT                                                            0x0
+#define HUBP3_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE__SHIFT                                                      0x6
+#define HUBP3_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS__SHIFT                                                 0xc
+#define HUBP3_DCSURF_ADDR_CONFIG__NUM_PKRS__SHIFT                                                             0x10
+#define HUBP3_DCSURF_ADDR_CONFIG__NUM_PIPES_MASK                                                              0x00000007L
+#define HUBP3_DCSURF_ADDR_CONFIG__PIPE_INTERLEAVE_MASK                                                        0x000000C0L
+#define HUBP3_DCSURF_ADDR_CONFIG__MAX_COMPRESSED_FRAGS_MASK                                                   0x00003000L
+#define HUBP3_DCSURF_ADDR_CONFIG__NUM_PKRS_MASK                                                               0x00070000L
+//HUBP3_DCSURF_TILING_CONFIG
+#define HUBP3_DCSURF_TILING_CONFIG__SW_MODE__SHIFT                                                            0x0
+#define HUBP3_DCSURF_TILING_CONFIG__DIM_TYPE__SHIFT                                                           0x7
+#define HUBP3_DCSURF_TILING_CONFIG__COMPAT_LEVEL__SHIFT                                                       0xa
+#define HUBP3_DCSURF_TILING_CONFIG__SW_MODE_MASK                                                              0x0000001FL
+#define HUBP3_DCSURF_TILING_CONFIG__DIM_TYPE_MASK                                                             0x00000180L
+#define HUBP3_DCSURF_TILING_CONFIG__COMPAT_LEVEL_MASK                                                         0x00001C00L
+//HUBP3_DCSURF_LEGACY_ADDR_CONFIG
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE__SHIFT                                        0x4
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE__SHIFT                                                    0x8
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG__SHIFT                                                   0xc
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW__SHIFT                                           0x11
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT__SHIFT                                                    0x14
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH__SHIFT                                                    0x18
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT__SHIFT                                                   0x1a
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT__SHIFT                                             0x1c
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS__SHIFT                                              0x1e
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_PIPE_INTERLEAVE_MASK                                          0x00000030L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__ARRAY_MODE_MASK                                                      0x00000F00L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__PIPE_CONFIG_MASK                                                     0x0001F000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__MICRO_TILE_MODE_NEW_MASK                                             0x000E0000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__TILE_SPLIT_MASK                                                      0x00700000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__BANK_WIDTH_MASK                                                      0x03000000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__BANK_HEIGHT_MASK                                                     0x0C000000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__MACRO_TILE_ASPECT_MASK                                               0x30000000L
+#define HUBP3_DCSURF_LEGACY_ADDR_CONFIG__LEGACY_NUM_BANKS_MASK                                                0xC0000000L
+//HUBP3_DCSURF_PRI_VIEWPORT_START
+#define HUBP3_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP3_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP3_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP3_DCSURF_PRI_VIEWPORT_START__PRI_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE
+#define HUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE__SHIFT                0x0
+#define HUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C__SHIFT              0x10
+#define HUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_MASK                  0x0000FFFFL
+#define HUBP3_DCSURF_VIEWPORT_MCACHE_SPLIT_COORDINATE__VIEWPORT_MCACHE_SPLIT_COORDINATE_C_MASK                0xFFFF0000L
+//HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION__PRI_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP3_DCSURF_PRI_VIEWPORT_START_C
+#define HUBP3_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP3_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP3_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP3_DCSURF_PRI_VIEWPORT_START_C__PRI_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP3_DCSURF_PRI_VIEWPORT_DIMENSION_C__PRI_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP3_DCSURF_SEC_VIEWPORT_START
+#define HUBP3_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START__SHIFT                                          0x0
+#define HUBP3_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START__SHIFT                                          0x10
+#define HUBP3_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_X_START_MASK                                            0x0000FFFFL
+#define HUBP3_DCSURF_SEC_VIEWPORT_START__SEC_VIEWPORT_Y_START_MASK                                            0xFFFF0000L
+//HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH__SHIFT                                        0x0
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT__SHIFT                                       0x10
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_WIDTH_MASK                                          0x00003FFFL
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION__SEC_VIEWPORT_HEIGHT_MASK                                         0x3FFF0000L
+//HUBP3_DCSURF_SEC_VIEWPORT_START_C
+#define HUBP3_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C__SHIFT                                      0x0
+#define HUBP3_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C__SHIFT                                      0x10
+#define HUBP3_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_X_START_C_MASK                                        0x0000FFFFL
+#define HUBP3_DCSURF_SEC_VIEWPORT_START_C__SEC_VIEWPORT_Y_START_C_MASK                                        0xFFFF0000L
+//HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C__SHIFT                                    0x0
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C__SHIFT                                   0x10
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_WIDTH_C_MASK                                      0x00003FFFL
+#define HUBP3_DCSURF_SEC_VIEWPORT_DIMENSION_C__SEC_VIEWPORT_HEIGHT_C_MASK                                     0x3FFF0000L
+//HUBP3_DCHUBP_REQ_SIZE_CONFIG
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT__SHIFT                                                     0x0
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR__SHIFT                                            0x4
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE__SHIFT                                                       0x8
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE__SHIFT                                                   0xb
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE__SHIFT                                                  0x14
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE__SHIFT                                                    0x18
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__SWATH_HEIGHT_MASK                                                       0x00000007L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__PTE_ROW_HEIGHT_LINEAR_MASK                                              0x00000070L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__CHUNK_SIZE_MASK                                                         0x00000700L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__MIN_CHUNK_SIZE_MASK                                                     0x00001800L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__DPTE_GROUP_SIZE_MASK                                                    0x00700000L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG__VM_GROUP_SIZE_MASK                                                      0x07000000L
+//HUBP3_DCHUBP_REQ_SIZE_CONFIG_C
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C__SHIFT                                                 0x0
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C__SHIFT                                        0x4
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C__SHIFT                                                   0x8
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C__SHIFT                                               0xb
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C__SHIFT                                              0x14
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__SWATH_HEIGHT_C_MASK                                                   0x00000007L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__PTE_ROW_HEIGHT_LINEAR_C_MASK                                          0x00000070L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__CHUNK_SIZE_C_MASK                                                     0x00000700L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__MIN_CHUNK_SIZE_C_MASK                                                 0x00001800L
+#define HUBP3_DCHUBP_REQ_SIZE_CONFIG_C__DPTE_GROUP_SIZE_C_MASK                                                0x00700000L
+//HUBP3_DCHUBP_CNTL
+#define HUBP3_DCHUBP_CNTL__HUBP_BLANK_EN__SHIFT                                                               0x0
+#define HUBP3_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ__SHIFT                                                     0x1
+#define HUBP3_DCHUBP_CNTL__HUBP_SOFT_RESET__SHIFT                                                             0x2
+#define HUBP3_DCHUBP_CNTL__HUBP_IN_BLANK__SHIFT                                                               0x3
+#define HUBP3_DCHUBP_CNTL__HUBP_VTG_SEL__SHIFT                                                                0x4
+#define HUBP3_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC__SHIFT                                               0x8
+#define HUBP3_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM__SHIFT                                            0x9
+#define HUBP3_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE__SHIFT                                                     0xa
+#define HUBP3_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS__SHIFT                                                   0xb
+#define HUBP3_DCHUBP_CNTL__HUBP_TTU_DISABLE__SHIFT                                                            0xc
+#define HUBP3_DCHUBP_CNTL__HUBP_TTU_MODE__SHIFT                                                               0xd
+#define HUBP3_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ__SHIFT                                                 0x10
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS__SHIFT                                                         0x14
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD__SHIFT                                                      0x18
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR__SHIFT                                                   0x1a
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN__SHIFT                                                   0x1b
+#define HUBP3_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS__SHIFT                                                       0x1c
+#define HUBP3_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR__SHIFT                                                        0x1f
+#define HUBP3_DCHUBP_CNTL__HUBP_BLANK_EN_MASK                                                                 0x00000001L
+#define HUBP3_DCHUBP_CNTL__HUBP_NO_OUTSTANDING_REQ_MASK                                                       0x00000002L
+#define HUBP3_DCHUBP_CNTL__HUBP_SOFT_RESET_MASK                                                               0x00000004L
+#define HUBP3_DCHUBP_CNTL__HUBP_IN_BLANK_MASK                                                                 0x00000008L
+#define HUBP3_DCHUBP_CNTL__HUBP_VTG_SEL_MASK                                                                  0x000000F0L
+#define HUBP3_DCHUBP_CNTL__HUBP_VREADY_AT_OR_AFTER_VSYNC_MASK                                                 0x00000100L
+#define HUBP3_DCHUBP_CNTL__HUBP_DISABLE_STOP_DATA_DURING_VM_MASK                                              0x00000200L
+#define HUBP3_DCHUBP_CNTL__HUBP_UNBOUNDED_REQ_MODE_MASK                                                       0x00000400L
+#define HUBP3_DCHUBP_CNTL__HUBP_SEG_ALLOC_ERR_STATUS_MASK                                                     0x00000800L
+#define HUBP3_DCHUBP_CNTL__HUBP_TTU_DISABLE_MASK                                                              0x00001000L
+#define HUBP3_DCHUBP_CNTL__HUBP_TTU_MODE_MASK                                                                 0x0000E000L
+#define HUBP3_DCHUBP_CNTL__HUBP_XRQ_NO_OUTSTANDING_REQ_MASK                                                   0x000F0000L
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_MASK                                                           0x00F00000L
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_THRESHOLD_MASK                                                        0x03000000L
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_STATUS_CLEAR_MASK                                                     0x04000000L
+#define HUBP3_DCHUBP_CNTL__HUBP_TIMEOUT_INTERRUPT_EN_MASK                                                     0x08000000L
+#define HUBP3_DCHUBP_CNTL__HUBP_UNDERFLOW_STATUS_MASK                                                         0x70000000L
+#define HUBP3_DCHUBP_CNTL__HUBP_UNDERFLOW_CLEAR_MASK                                                          0x80000000L
+//HUBP3_HUBP_CLK_CNTL
+#define HUBP3_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE__SHIFT                                                         0x0
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS__SHIFT                                                   0x4
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS__SHIFT                                                   0x5
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS__SHIFT                                                    0x8
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS__SHIFT                                                    0xc
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS__SHIFT                                                    0x10
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON__SHIFT                                                   0x14
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON__SHIFT                                                    0x15
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON__SHIFT                                                    0x16
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON__SHIFT                                                    0x17
+#define HUBP3_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON__SHIFT                                                   0x19
+#define HUBP3_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define HUBP3_HUBP_CLK_CNTL__HUBP_CLOCK_ENABLE_MASK                                                           0x00000001L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_R_GATE_DIS_MASK                                                     0x00000010L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_G_GATE_DIS_MASK                                                     0x00000020L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DPPCLK_G_GATE_DIS_MASK                                                      0x00000100L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_R_GATE_DIS_MASK                                                      0x00001000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_G_GATE_DIS_MASK                                                      0x00010000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_R_CLOCK_ON_MASK                                                     0x00100000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DPPCLK_G_CLOCK_ON_MASK                                                      0x00200000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_R_CLOCK_ON_MASK                                                      0x00400000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DCFCLK_G_CLOCK_ON_MASK                                                      0x00800000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_DISPCLK_G_CLOCK_ON_MASK                                                     0x02000000L
+#define HUBP3_HUBP_CLK_CNTL__HUBP_TEST_CLK_SEL_MASK                                                           0xF0000000L
+//HUBP3_DCHUBP_VMPG_CONFIG
+#define HUBP3_DCHUBP_VMPG_CONFIG__VMPG_SIZE__SHIFT                                                            0x0
+#define HUBP3_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE__SHIFT                                                      0x1
+#define HUBP3_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE__SHIFT                                                   0x2
+#define HUBP3_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME__SHIFT                                              0x7
+#define HUBP3_DCHUBP_VMPG_CONFIG__VMPG_SIZE_MASK                                                              0x00000001L
+#define HUBP3_DCHUBP_VMPG_CONFIG__PTE_BUFFER_MODE_MASK                                                        0x00000002L
+#define HUBP3_DCHUBP_VMPG_CONFIG__BIGK_FRAGMENT_SIZE_MASK                                                     0x0000007CL
+#define HUBP3_DCHUBP_VMPG_CONFIG__FORCE_ONE_ROW_FOR_FRAME_MASK                                                0x00000080L
+//HUBP3_DCHUBP_SUB_VP_CFG0
+#define HUBP3_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE__SHIFT                                            0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION__SHIFT                                                0x1
+#define HUBP3_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0__SHIFT                                               0x2
+#define HUBP3_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0__SHIFT                                               0xe
+#define HUBP3_DCHUBP_SUB_VP_CFG0__USE_ALT_CHN_AT_START_LINE_MASK                                              0x00000001L
+#define HUBP3_DCHUBP_SUB_VP_CFG0__PSTATE_ALLOW_POSITION_MASK                                                  0x00000002L
+#define HUBP3_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_CURR_S0_MASK                                                 0x00003FFCL
+#define HUBP3_DCHUBP_SUB_VP_CFG0__SUB_VP0_HEIGHT_NEXT_S0_MASK                                                 0x03FFC000L
+//HUBP3_DCHUBP_SUB_VP_CFG1
+#define HUBP3_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0__SHIFT                                                0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0__SHIFT                                                0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG1__SUB_VP0_START_LINE_S0_MASK                                                  0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG1__SUB_VP1_START_LINE_S0_MASK                                                  0xFFFF0000L
+//HUBP3_DCHUBP_SUB_VP_CFG2
+#define HUBP3_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0__SHIFT                                               0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0__SHIFT                                               0xc
+#define HUBP3_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_CURR_S0_MASK                                                 0x00000FFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG2__SUB_VP1_HEIGHT_NEXT_S0_MASK                                                 0x00FFF000L
+//HUBP3_DCHUBP_SUB_VP_CFG3
+#define HUBP3_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP3_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG3__SUB_VP0_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP3_DCHUBP_SUB_VP_CFG4
+#define HUBP3_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1__SHIFT                                                0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1__SHIFT                                                0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG4__SUB_VP0_START_LINE_S1_MASK                                                  0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG4__SUB_VP1_START_LINE_S1_MASK                                                  0xFFFF0000L
+//HUBP3_DCHUBP_SUB_VP_CFG5
+#define HUBP3_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1__SHIFT                                               0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1__SHIFT                                               0xc
+#define HUBP3_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_CURR_S1_MASK                                                 0x00000FFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG5__SUB_VP1_HEIGHT_NEXT_S1_MASK                                                 0x00FFF000L
+//HUBP3_DCHUBP_SUB_VP_CFG6
+#define HUBP3_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG6__SUB_VP0_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP3_DCHUBP_SUB_VP_CFG7
+#define HUBP3_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0__SHIFT                                        0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG7__SUB_VP1_SURF_BASE_ADDR_LOW_S0_MASK                                          0xFFFFFFFFL
+//HUBP3_DCHUBP_SUB_VP_CFG8
+#define HUBP3_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0__SHIFT                                       0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG8__SUB_VP0_SURF_BASE_ADDR_HIGH_S0_MASK                                         0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG8__SUB_VP1_SURF_BASE_ADDR_HIGH_S0_MASK                                         0xFFFF0000L
+//HUBP3_DCHUBP_SUB_VP_CFG9
+#define HUBP3_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1__SHIFT                                        0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG9__SUB_VP0_SURF_BASE_ADDR_LOW_S1_MASK                                          0xFFFFFFFFL
+//HUBP3_DCHUBP_SUB_VP_CFG10
+#define HUBP3_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1__SHIFT                                       0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG10__SUB_VP1_SURF_BASE_ADDR_LOW_S1_MASK                                         0xFFFFFFFFL
+//HUBP3_DCHUBP_SUB_VP_CFG11
+#define HUBP3_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1__SHIFT                                      0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG11__SUB_VP0_SURF_BASE_ADDR_HIGH_S1_MASK                                        0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG11__SUB_VP1_SURF_BASE_ADDR_HIGH_S1_MASK                                        0xFFFF0000L
+//HUBP3_DCHUBP_SUB_VP_CFG12
+#define HUBP3_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0__SHIFT                                               0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0__SHIFT                                               0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG12__SUB_VP0_SURF_PITCH_S0_MASK                                                 0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG12__SUB_VP1_SURF_PITCH_S0_MASK                                                 0xFFFF0000L
+//HUBP3_DCHUBP_SUB_VP_CFG13
+#define HUBP3_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1__SHIFT                                               0x0
+#define HUBP3_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1__SHIFT                                               0x10
+#define HUBP3_DCHUBP_SUB_VP_CFG13__SUB_VP0_SURF_PITCH_S1_MASK                                                 0x0000FFFFL
+#define HUBP3_DCHUBP_SUB_VP_CFG13__SUB_VP1_SURF_PITCH_S1_MASK                                                 0xFFFF0000L
+//HUBP3_DCHUBP_MCACHEID_CONFIG
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0__SHIFT                                          0x0
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0__SHIFT                                          0x4
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1__SHIFT                                          0x8
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1__SHIFT                                          0xc
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0__SHIFT                                         0x10
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0__SHIFT                                         0x14
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1__SHIFT                                         0x18
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1__SHIFT                                         0x1c
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P0_MASK                                            0x0000000FL
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P0_MASK                                            0x000000F0L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_1H_P1_MASK                                            0x00000F00L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_REG_READ_2H_P1_MASK                                            0x0000F000L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P0_MASK                                           0x000F0000L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P0_MASK                                           0x00F00000L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_1H_P1_MASK                                           0x0F000000L
+#define HUBP3_DCHUBP_MCACHEID_CONFIG__MCACHEID_MALL_PREF_2H_P1_MASK                                           0xF0000000L
+//HUBP3_HUBPREQ_DEBUG_DB
+#define HUBP3_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG__SHIFT                                                          0x0
+#define HUBP3_HUBPREQ_DEBUG_DB__HUBPREQ_DEBUG_MASK                                                            0xFFFFFFFFL
+//HUBP3_HUBPREQ_DEBUG
+#define HUBP3_HUBPREQ_DEBUG__HUBPREQ_DEBUG__SHIFT                                                             0x0
+#define HUBP3_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS__SHIFT                                 0x1f
+#define HUBP3_HUBPREQ_DEBUG__HUBPREQ_DEBUG_MASK                                                               0x7FFFFFFFL
+#define HUBP3_HUBPREQ_DEBUG__HUBPREQ_DEBUG_FLIP_REQ_DURING_MALL_STATUS_MASK                                   0x80000000L
+//HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK__SHIFT                                 0x0
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK__SHIFT                          0x4
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK__SHIFT                              0xc
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK__SHIFT                               0x14
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK__SHIFT                               0x1c
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_EN_DCFCLK_MASK                                   0x00000001L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_PERIOD_M1_DCFCLK_MASK                            0x00000FF0L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_START_SEL_DCFCLK_MASK                                0x0001F000L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_PERFMON_STOP_SEL_DCFCLK_MASK                                 0x01F00000L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DCFCLK__HUBP_MEASURE_WIN_MODE_DCFCLK_MASK                                 0x30000000L
+//HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK__SHIFT                                 0x0
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK__SHIFT                            0x1
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK__SHIFT                          0x4
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK__SHIFT                              0xc
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK__SHIFT                               0x14
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_EN_DPPCLK_MASK                                   0x00000001L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_SRC_SEL_DPPCLK_MASK                              0x00000002L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_MEASURE_WIN_PERIOD_M1_DPPCLK_MASK                            0x00000FF0L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_START_SEL_DPPCLK_MASK                                0x0001F000L
+#define HUBP3_HUBP_MEASURE_WIN_CTRL_DPPCLK__HUBP_PERFMON_STOP_SEL_DPPCLK_MASK                                 0x01F00000L
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubpreq_dispdec
+//HUBPREQ3_DCSURF_SURFACE_PITCH
+#define HUBPREQ3_DCSURF_SURFACE_PITCH__PITCH__SHIFT                                                           0x0
+#define HUBPREQ3_DCSURF_SURFACE_PITCH__PITCH_MASK                                                             0x0000FFFFL
+//HUBPREQ3_DCSURF_SURFACE_PITCH_C
+#define HUBPREQ3_DCSURF_SURFACE_PITCH_C__PITCH_C__SHIFT                                                       0x0
+#define HUBPREQ3_DCSURF_SURFACE_PITCH_C__PITCH_C_MASK                                                         0x0000FFFFL
+//HUBPREQ3_VMID_SETTINGS_0
+#define HUBPREQ3_VMID_SETTINGS_0__VMID__SHIFT                                                                 0x0
+#define HUBPREQ3_VMID_SETTINGS_0__VMID_MASK                                                                   0x0000000FL
+//HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS__SHIFT                               0x0
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS__PRIMARY_SURFACE_ADDRESS_MASK                                 0xFFFFFFFFL
+//HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH__SHIFT                     0x0
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH__PRIMARY_SURFACE_ADDRESS_HIGH_MASK                       0x0000FFFFL
+//HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_C
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C__SHIFT                           0x0
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_C__PRIMARY_SURFACE_ADDRESS_C_MASK                             0xFFFFFFFFL
+//HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C__SHIFT                 0x0
+#define HUBPREQ3_DCSURF_PRIMARY_SURFACE_ADDRESS_HIGH_C__PRIMARY_SURFACE_ADDRESS_HIGH_C_MASK                   0x0000FFFFL
+//HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS__SHIFT                           0x0
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS__SECONDARY_SURFACE_ADDRESS_MASK                             0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH__SHIFT                 0x0
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH__SECONDARY_SURFACE_ADDRESS_HIGH_MASK                   0x0000FFFFL
+//HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_C
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C__SHIFT                       0x0
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_C__SECONDARY_SURFACE_ADDRESS_C_MASK                         0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C__SHIFT             0x0
+#define HUBPREQ3_DCSURF_SECONDARY_SURFACE_ADDRESS_HIGH_C__SECONDARY_SURFACE_ADDRESS_HIGH_C_MASK               0x0000FFFFL
+//HUBPREQ3_DCSURF_SURFACE_CONTROL
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ__SHIFT                                           0x0
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN__SHIFT                                        0x4
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C__SHIFT                                         0x5
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ__SHIFT                                         0x9
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN__SHIFT                                      0xd
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C__SHIFT                                       0xe
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_MASK                                             0x0000000FL
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_DCC_EN_MASK                                          0x00000010L
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__PRIMARY_SURFACE_TMZ_C_MASK                                           0x000001E0L
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_MASK                                           0x00001E00L
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_DCC_EN_MASK                                        0x00002000L
+#define HUBPREQ3_DCSURF_SURFACE_CONTROL__SECONDARY_SURFACE_TMZ_C_MASK                                         0x0003C000L
+//HUBPREQ3_DCSURF_FLIP_CONTROL
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK__SHIFT                                              0x0
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE__SHIFT                                                0x1
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING__SHIFT                                             0x8
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS__SHIFT                                0x9
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC__SHIFT                                 0xc
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC__SHIFT                                       0x10
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE__SHIFT                               0x11
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY__SHIFT                              0x12
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY__SHIFT                                       0x14
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_UPDATE_LOCK_MASK                                                0x00000001L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_TYPE_MASK                                                  0x00000002L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_MASK                                               0x00000100L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__HUBPREQ_MASTER_UPDATE_LOCK_STATUS_MASK                                  0x00000200L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_MODE_FOR_STEREOSYNC_MASK                                   0x00003000L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_IN_STEREOSYNC_MASK                                         0x00010000L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_DISABLE_MASK                                 0x00020000L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_STEREO_SELECT_POLARITY_MASK                                0x00040000L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL__SURFACE_FLIP_PENDING_DELAY_MASK                                         0x3FF00000L
+//HUBPREQ3_DCSURF_FLIP_CONTROL2
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME__SHIFT                                   0x0
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE__SHIFT                                              0x8
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK__SHIFT                                                0x9
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE__SHIFT                                    0xa
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH__SHIFT                                     0xc
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE__SHIFT                                    0x1f
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_PENDING_MIN_TIME_MASK                                     0x000000FFL
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_GSL_ENABLE_MASK                                                0x00000100L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_GSL_MASK_MASK                                                  0x00000200L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_TRIPLE_BUFFER_ENABLE_MASK                                      0x00000400L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_INUSE_RAED_NO_LATCH_MASK                                       0x00001000L
+#define HUBPREQ3_DCSURF_FLIP_CONTROL2__SURFACE_FLIP_EXEC_DEBUG_MODE_MASK                                      0x80000000L
+//HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK__SHIFT                                  0x0
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE__SHIFT                                  0x1
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK__SHIFT                             0x2
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE__SHIFT                             0x3
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR__SHIFT                                     0x8
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR__SHIFT                                0x9
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED__SHIFT                                  0x10
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS__SHIFT                                0x11
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED__SHIFT                             0x12
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS__SHIFT                           0x13
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_MASK_MASK                                    0x00000001L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_TYPE_MASK                                    0x00000002L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_MASK_MASK                               0x00000004L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_TYPE_MASK                               0x00000008L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_CLEAR_MASK                                       0x00000100L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_CLEAR_MASK                                  0x00000200L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_OCCURRED_MASK                                    0x00010000L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_INT_STATUS_MASK                                  0x00020000L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_OCCURRED_MASK                               0x00040000L
+#define HUBPREQ3_DCSURF_SURFACE_FLIP_INTERRUPT__SURFACE_FLIP_AWAY_INT_STATUS_MASK                             0x00080000L
+//HUBPREQ3_DCSURF_SURFACE_INUSE
+#define HUBPREQ3_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS__SHIFT                                           0x0
+#define HUBPREQ3_DCSURF_SURFACE_INUSE__SURFACE_INUSE_ADDRESS_MASK                                             0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH__SHIFT                                 0x0
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID__SHIFT                                         0x1c
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_ADDRESS_HIGH_MASK                                   0x0000FFFFL
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH__SURFACE_INUSE_VMID_MASK                                           0xF0000000L
+//HUBPREQ3_DCSURF_SURFACE_INUSE_C
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C__SHIFT                                       0x0
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_C__SURFACE_INUSE_ADDRESS_C_MASK                                         0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C__SHIFT                             0x0
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C__SHIFT                                     0x1c
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_ADDRESS_HIGH_C_MASK                               0x0000FFFFL
+#define HUBPREQ3_DCSURF_SURFACE_INUSE_HIGH_C__SURFACE_INUSE_VMID_C_MASK                                       0xF0000000L
+//HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS__SHIFT                         0x0
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE__SURFACE_EARLIEST_INUSE_ADDRESS_MASK                           0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH__SHIFT               0x0
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID__SHIFT                       0x1c
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_MASK                 0x0000FFFFL
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH__SURFACE_EARLIEST_INUSE_VMID_MASK                         0xF0000000L
+//HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_C
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C__SHIFT                     0x0
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_C__SURFACE_EARLIEST_INUSE_ADDRESS_C_MASK                       0xFFFFFFFFL
+//HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C__SHIFT           0x0
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C__SHIFT                   0x1c
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_ADDRESS_HIGH_C_MASK             0x0000FFFFL
+#define HUBPREQ3_DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C__SURFACE_EARLIEST_INUSE_VMID_C_MASK                     0xF0000000L
+//HUBPREQ3_DCN_EXPANSION_MODE
+#define HUBPREQ3_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE__SHIFT                                                0x0
+#define HUBPREQ3_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE__SHIFT                                                0x2
+#define HUBPREQ3_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE__SHIFT                                                0x4
+#define HUBPREQ3_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE__SHIFT                                                0x6
+#define HUBPREQ3_DCN_EXPANSION_MODE__DRQ_EXPANSION_MODE_MASK                                                  0x00000003L
+#define HUBPREQ3_DCN_EXPANSION_MODE__CRQ_EXPANSION_MODE_MASK                                                  0x0000000CL
+#define HUBPREQ3_DCN_EXPANSION_MODE__MRQ_EXPANSION_MODE_MASK                                                  0x00000030L
+#define HUBPREQ3_DCN_EXPANSION_MODE__PRQ_EXPANSION_MODE_MASK                                                  0x000000C0L
+//HUBPREQ3_DCN_GLOBAL_TTU_CNTL
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK__SHIFT                                                   0x0
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT__SHIFT                                             0x18
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT__SHIFT                                             0x19
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH__SHIFT                                          0x1a
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE__SHIFT                                                     0x1b
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY__SHIFT                                0x1c
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP__SHIFT                                                0x1e
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH__SHIFT                                         0x1f
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__MIN_TTU_VBLANK_MASK                                                     0x00FFFFFFL
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__PIPE_IN_FLUSH_URGENT_MASK                                               0x01000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__PRQ_MRQ_FLUSH_URGENT_MASK                                               0x02000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__INCLUDE_GLOBAL_PREFETCH_MASK                                            0x04000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__ROW_TTU_MODE_MASK                                                       0x08000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__SEL_TTU_FRAC_URG_BW_PROG_STRATEGY_MASK                                  0x10000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_FLIP_MASK                                                  0x40000000L
+#define HUBPREQ3_DCN_GLOBAL_TTU_CNTL__FORCE_URGENT_VM_PREFETCH_MASK                                           0x80000000L
+//HUBPREQ3_DCN_SURF0_TTU_CNTL0
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ3_DCN_SURF0_TTU_CNTL1
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ3_DCN_SURF0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ3_DCN_SURF1_TTU_CNTL0
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                          0x0
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                               0x1e
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                  0x1f
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                            0x007FFFFFL
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                 0x40000000L
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                    0x80000000L
+//HUBPREQ3_DCN_SURF1_TTU_CNTL1
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                      0x0
+#define HUBPREQ3_DCN_SURF1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                        0x007FFFFFL
+//HUBPREQ3_DCN_CUR0_TTU_CNTL0
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ3_DCN_CUR0_TTU_CNTL1
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ3_DCN_CUR0_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ3_DCN_CUR1_TTU_CNTL0
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY__SHIFT                                           0x0
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE__SHIFT                                                0x1e
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN__SHIFT                                                   0x1f
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__REFCYC_PER_REQ_DELIVERY_MASK                                             0x007FFFFFL
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_VALUE_MASK                                                  0x40000000L
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL0__URGENT_FORCE_EN_MASK                                                     0x80000000L
+//HUBPREQ3_DCN_CUR1_TTU_CNTL1
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE__SHIFT                                       0x0
+#define HUBPREQ3_DCN_CUR1_TTU_CNTL1__REFCYC_PER_REQ_DELIVERY_PRE_MASK                                         0x007FFFFFL
+//HUBPREQ3_DCN_DMDATA_VM_CNTL
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA__SHIFT                                              0x0
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS__SHIFT                                            0x10
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR__SHIFT                                      0x14
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS__SHIFT                                        0x18
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS__SHIFT                                             0x19
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR__SHIFT                                  0x1a
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE__SHIFT                                                    0x1f
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__REFCYC_PER_VM_DMDATA_MASK                                                0x0000FFFFL
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_MASK                                              0x000F0000L
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_FAULT_STATUS_CLEAR_MASK                                        0x00100000L
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_MASK                                          0x01000000L
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_LATE_STATUS_MASK                                               0x02000000L
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_UNDERFLOW_STATUS_CLEAR_MASK                                    0x04000000L
+#define HUBPREQ3_DCN_DMDATA_VM_CNTL__DMDATA_VM_DONE_MASK                                                      0x80000000L
+//HUBPREQ3_DCN_VM_SYSTEM_APERTURE_LOW_ADDR
+#define HUBPREQ3_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR__SHIFT                       0x0
+#define HUBPREQ3_DCN_VM_SYSTEM_APERTURE_LOW_ADDR__MC_VM_SYSTEM_APERTURE_LOW_ADDR_MASK                         0x3FFFFFFFL
+//HUBPREQ3_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR
+#define HUBPREQ3_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR__SHIFT                     0x0
+#define HUBPREQ3_DCN_VM_SYSTEM_APERTURE_HIGH_ADDR__MC_VM_SYSTEM_APERTURE_HIGH_ADDR_MASK                       0x3FFFFFFFL
+//HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB__SHIFT                                                  0x0
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE__SHIFT                                             0x3
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS__SHIFT                                0x5
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL__SHIFT                                   0x6
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__ENABLE_L1_TLB_MASK                                                    0x00000001L
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_ACCESS_MODE_MASK                                               0x00000018L
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__SYSTEM_APERTURE_UNMAPPED_ACCESS_MASK                                  0x00000020L
+#define HUBPREQ3_DCN_VM_MX_L1_TLB_CNTL__ENABLE_ADVANCED_DRIVER_MODEL_MASK                                     0x00000040L
+//HUBPREQ3_BLANK_OFFSET_0
+#define HUBPREQ3_BLANK_OFFSET_0__REFCYC_H_BLANK_END__SHIFT                                                    0x0
+#define HUBPREQ3_BLANK_OFFSET_0__DLG_V_BLANK_END__SHIFT                                                       0x10
+#define HUBPREQ3_BLANK_OFFSET_0__REFCYC_H_BLANK_END_MASK                                                      0x00001FFFL
+#define HUBPREQ3_BLANK_OFFSET_0__DLG_V_BLANK_END_MASK                                                         0x7FFF0000L
+//HUBPREQ3_BLANK_OFFSET_1
+#define HUBPREQ3_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START__SHIFT                                                  0x0
+#define HUBPREQ3_BLANK_OFFSET_1__MIN_DST_Y_NEXT_START_MASK                                                    0x0003FFFFL
+//HUBPREQ3_DST_DIMENSIONS
+#define HUBPREQ3_DST_DIMENSIONS__REFCYC_PER_HTOTAL__SHIFT                                                     0x0
+#define HUBPREQ3_DST_DIMENSIONS__REFCYC_PER_HTOTAL_MASK                                                       0x001FFFFFL
+//HUBPREQ3_DST_AFTER_SCALER
+#define HUBPREQ3_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER__SHIFT                                               0x0
+#define HUBPREQ3_DST_AFTER_SCALER__DST_Y_AFTER_SCALER__SHIFT                                                  0x10
+#define HUBPREQ3_DST_AFTER_SCALER__REFCYC_X_AFTER_SCALER_MASK                                                 0x00001FFFL
+#define HUBPREQ3_DST_AFTER_SCALER__DST_Y_AFTER_SCALER_MASK                                                    0x00070000L
+//HUBPREQ3_PREFETCH_SETTINGS
+#define HUBPREQ3_PREFETCH_SETTINGS__VRATIO_PREFETCH__SHIFT                                                    0x0
+#define HUBPREQ3_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK__SHIFT                                          0x17
+#define HUBPREQ3_PREFETCH_SETTINGS__DST_Y_PREFETCH__SHIFT                                                     0x18
+#define HUBPREQ3_PREFETCH_SETTINGS__VRATIO_PREFETCH_MASK                                                      0x003FFFFFL
+#define HUBPREQ3_PREFETCH_SETTINGS__FORCE_DISP_PREF_TO_VBLANK_MASK                                            0x00800000L
+#define HUBPREQ3_PREFETCH_SETTINGS__DST_Y_PREFETCH_MASK                                                       0xFF000000L
+//HUBPREQ3_PREFETCH_SETTINGS_C
+#define HUBPREQ3_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C__SHIFT                                                0x0
+#define HUBPREQ3_PREFETCH_SETTINGS_C__VRATIO_PREFETCH_C_MASK                                                  0x003FFFFFL
+//HUBPREQ3_VBLANK_PARAMETERS_0
+#define HUBPREQ3_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK__SHIFT                                              0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK__SHIFT                                             0x8
+#define HUBPREQ3_VBLANK_PARAMETERS_0__DST_Y_PER_VM_VBLANK_MASK                                                0x0000007FL
+#define HUBPREQ3_VBLANK_PARAMETERS_0__DST_Y_PER_ROW_VBLANK_MASK                                               0x00003F00L
+//HUBPREQ3_VBLANK_PARAMETERS_1
+#define HUBPREQ3_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L__SHIFT                                    0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_1__REFCYC_PER_PTE_GROUP_VBLANK_L_MASK                                      0x007FFFFFL
+//HUBPREQ3_VBLANK_PARAMETERS_2
+#define HUBPREQ3_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C__SHIFT                                    0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_2__REFCYC_PER_PTE_GROUP_VBLANK_C_MASK                                      0x007FFFFFL
+//HUBPREQ3_VBLANK_PARAMETERS_3
+#define HUBPREQ3_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L__SHIFT                                   0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_3__REFCYC_PER_META_CHUNK_VBLANK_L_MASK                                     0x007FFFFFL
+//HUBPREQ3_VBLANK_PARAMETERS_4
+#define HUBPREQ3_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C__SHIFT                                   0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_4__REFCYC_PER_META_CHUNK_VBLANK_C_MASK                                     0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_0
+#define HUBPREQ3_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP__SHIFT                                                  0x0
+#define HUBPREQ3_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP__SHIFT                                                 0x8
+#define HUBPREQ3_FLIP_PARAMETERS_0__DST_Y_PER_VM_FLIP_MASK                                                    0x0000007FL
+#define HUBPREQ3_FLIP_PARAMETERS_0__DST_Y_PER_ROW_FLIP_MASK                                                   0x00003F00L
+//HUBPREQ3_FLIP_PARAMETERS_1
+#define HUBPREQ3_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L__SHIFT                                        0x0
+#define HUBPREQ3_FLIP_PARAMETERS_1__REFCYC_PER_PTE_GROUP_FLIP_L_MASK                                          0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_2
+#define HUBPREQ3_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L__SHIFT                                       0x0
+#define HUBPREQ3_FLIP_PARAMETERS_2__REFCYC_PER_META_CHUNK_FLIP_L_MASK                                         0x007FFFFFL
+//HUBPREQ3_NOM_PARAMETERS_0
+#define HUBPREQ3_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L__SHIFT                                             0x0
+#define HUBPREQ3_NOM_PARAMETERS_0__DST_Y_PER_PTE_ROW_NOM_L_MASK                                               0x0001FFFFL
+//HUBPREQ3_NOM_PARAMETERS_1
+#define HUBPREQ3_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L__SHIFT                                          0x0
+#define HUBPREQ3_NOM_PARAMETERS_1__REFCYC_PER_PTE_GROUP_NOM_L_MASK                                            0x007FFFFFL
+//HUBPREQ3_NOM_PARAMETERS_2
+#define HUBPREQ3_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C__SHIFT                                             0x0
+#define HUBPREQ3_NOM_PARAMETERS_2__DST_Y_PER_PTE_ROW_NOM_C_MASK                                               0x0001FFFFL
+//HUBPREQ3_NOM_PARAMETERS_3
+#define HUBPREQ3_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C__SHIFT                                          0x0
+#define HUBPREQ3_NOM_PARAMETERS_3__REFCYC_PER_PTE_GROUP_NOM_C_MASK                                            0x007FFFFFL
+//HUBPREQ3_NOM_PARAMETERS_4
+#define HUBPREQ3_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L__SHIFT                                            0x0
+#define HUBPREQ3_NOM_PARAMETERS_4__DST_Y_PER_META_ROW_NOM_L_MASK                                              0x0001FFFFL
+//HUBPREQ3_NOM_PARAMETERS_5
+#define HUBPREQ3_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L__SHIFT                                         0x0
+#define HUBPREQ3_NOM_PARAMETERS_5__REFCYC_PER_META_CHUNK_NOM_L_MASK                                           0x007FFFFFL
+//HUBPREQ3_NOM_PARAMETERS_6
+#define HUBPREQ3_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C__SHIFT                                            0x0
+#define HUBPREQ3_NOM_PARAMETERS_6__DST_Y_PER_META_ROW_NOM_C_MASK                                              0x0001FFFFL
+//HUBPREQ3_NOM_PARAMETERS_7
+#define HUBPREQ3_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C__SHIFT                                         0x0
+#define HUBPREQ3_NOM_PARAMETERS_7__REFCYC_PER_META_CHUNK_NOM_C_MASK                                           0x007FFFFFL
+//HUBPREQ3_PER_LINE_DELIVERY_PRE
+#define HUBPREQ3_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L__SHIFT                                 0x0
+#define HUBPREQ3_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C__SHIFT                                 0x10
+#define HUBPREQ3_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_L_MASK                                   0x00001FFFL
+#define HUBPREQ3_PER_LINE_DELIVERY_PRE__REFCYC_PER_LINE_DELIVERY_PRE_C_MASK                                   0x1FFF0000L
+//HUBPREQ3_PER_LINE_DELIVERY
+#define HUBPREQ3_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L__SHIFT                                         0x0
+#define HUBPREQ3_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C__SHIFT                                         0x10
+#define HUBPREQ3_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_L_MASK                                           0x00001FFFL
+#define HUBPREQ3_PER_LINE_DELIVERY__REFCYC_PER_LINE_DELIVERY_C_MASK                                           0x1FFF0000L
+//HUBPREQ3_CURSOR_SETTINGS
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET__SHIFT                                                 0x0
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST__SHIFT                                             0x8
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET__SHIFT                                                 0x10
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST__SHIFT                                             0x18
+#define HUBPREQ3_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF__SHIFT                                            0x1e
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR0_DST_Y_OFFSET_MASK                                                   0x000000FFL
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR0_CHUNK_HDL_ADJUST_MASK                                               0x00000300L
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR1_DST_Y_OFFSET_MASK                                                   0x00FF0000L
+#define HUBPREQ3_CURSOR_SETTINGS__CURSOR1_CHUNK_HDL_ADJUST_MASK                                               0x03000000L
+#define HUBPREQ3_CURSOR_SETTINGS__FORCE_CURSOR_TO_DISP_PREF_MASK                                              0x40000000L
+//HUBPREQ3_REF_FREQ_TO_PIX_FREQ
+#define HUBPREQ3_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ__SHIFT                                            0x0
+#define HUBPREQ3_REF_FREQ_TO_PIX_FREQ__REF_FREQ_TO_PIX_FREQ_MASK                                              0x001FFFFFL
+//HUBPREQ3_DST_Y_DELTA_DRQ_LIMIT
+#define HUBPREQ3_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT__SHIFT                                          0x0
+#define HUBPREQ3_DST_Y_DELTA_DRQ_LIMIT__DST_Y_DELTA_DRQ_LIMIT_MASK                                            0x00007FFFL
+//HUBPREQ3_DST_Y_ALT_CH_DRQ_LIMIT
+#define HUBPREQ3_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT__SHIFT                                        0x0
+#define HUBPREQ3_DST_Y_ALT_CH_DRQ_LIMIT__DST_Y_ALT_CH_DRQ_LIMIT_MASK                                          0x00007FFFL
+//HUBPREQ3_HUBPREQ_MEM_PWR_CTRL
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE__SHIFT                                          0x0
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS__SHIFT                                            0x2
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE__SHIFT                                          0x4
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS__SHIFT                                            0x6
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE__SHIFT                                           0x8
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS__SHIFT                                             0xa
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_FORCE_MASK                                            0x00000003L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_DPTE_MEM_PWR_DIS_MASK                                              0x00000004L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_FORCE_MASK                                            0x00000030L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_TPTE_MEM_PWR_DIS_MASK                                              0x00000040L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_FORCE_MASK                                             0x00000300L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_CTRL__REQ_PDE_MEM_PWR_DIS_MASK                                               0x00000400L
+//HUBPREQ3_HUBPREQ_MEM_PWR_STATUS
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE__SHIFT                                        0x0
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE__SHIFT                                        0x2
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE__SHIFT                                         0x4
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_DPTE_MEM_PWR_STATE_MASK                                          0x00000003L
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_TPTE_MEM_PWR_STATE_MASK                                          0x0000000CL
+#define HUBPREQ3_HUBPREQ_MEM_PWR_STATUS__REQ_PDE_MEM_PWR_STATE_MASK                                           0x00000030L
+//HUBPREQ3_VBLANK_PARAMETERS_5
+#define HUBPREQ3_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK__SHIFT                                       0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_5__REFCYC_PER_VM_GROUP_VBLANK_MASK                                         0x007FFFFFL
+//HUBPREQ3_VBLANK_PARAMETERS_6
+#define HUBPREQ3_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK__SHIFT                                         0x0
+#define HUBPREQ3_VBLANK_PARAMETERS_6__REFCYC_PER_VM_REQ_VBLANK_MASK                                           0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_3
+#define HUBPREQ3_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP__SHIFT                                           0x0
+#define HUBPREQ3_FLIP_PARAMETERS_3__REFCYC_PER_VM_GROUP_FLIP_MASK                                             0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_4
+#define HUBPREQ3_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP__SHIFT                                             0x0
+#define HUBPREQ3_FLIP_PARAMETERS_4__REFCYC_PER_VM_REQ_FLIP_MASK                                               0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_5
+#define HUBPREQ3_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C__SHIFT                                        0x0
+#define HUBPREQ3_FLIP_PARAMETERS_5__REFCYC_PER_PTE_GROUP_FLIP_C_MASK                                          0x007FFFFFL
+//HUBPREQ3_FLIP_PARAMETERS_6
+#define HUBPREQ3_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C__SHIFT                                       0x0
+#define HUBPREQ3_FLIP_PARAMETERS_6__REFCYC_PER_META_CHUNK_FLIP_C_MASK                                         0x007FFFFFL
+//HUBPREQ3_UCLK_PSTATE_FORCE
+#define HUBPREQ3_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN__SHIFT                                          0x0
+#define HUBPREQ3_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE__SHIFT                                       0x1
+#define HUBPREQ3_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN__SHIFT                                        0x2
+#define HUBPREQ3_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE__SHIFT                                     0x3
+#define HUBPREQ3_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_EN_MASK                                            0x00000001L
+#define HUBPREQ3_UCLK_PSTATE_FORCE__DATA_UCLK_PSTATE_FORCE_VALUE_MASK                                         0x00000002L
+#define HUBPREQ3_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_EN_MASK                                          0x00000004L
+#define HUBPREQ3_UCLK_PSTATE_FORCE__CURSOR_UCLK_PSTATE_FORCE_VALUE_MASK                                       0x00000008L
+//HUBPREQ3_HUBPREQ_STATUS_REG0
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0__SHIFT                                         0x0
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1__SHIFT                                         0x8
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT__SHIFT                                                 0x10
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S0_MASK                                           0x0000001FL
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_TPTE_ROW_READY_S1_MASK                                           0x00001F00L
+#define HUBPREQ3_HUBPREQ_STATUS_REG0__STATUS_VTG_COUNT_MASK                                                   0x7FFF0000L
+//HUBPREQ3_HUBPREQ_STATUS_REG1
+#define HUBPREQ3_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0__SHIFT                                       0x0
+#define HUBPREQ3_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1__SHIFT                                       0x10
+#define HUBPREQ3_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S0_MASK                                         0x0000FFFFL
+#define HUBPREQ3_HUBPREQ_STATUS_REG1__STATUS_CHUNK_REQ_X_OR_Y_S1_MASK                                         0xFFFF0000L
+//HUBPREQ3_HUBPREQ_STATUS_REG2
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0__SHIFT                                      0x0
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0__SHIFT                                     0x1
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0__SHIFT                               0x2
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0__SHIFT                               0x3
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0__SHIFT                                                 0x5
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1__SHIFT                                      0x8
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1__SHIFT                                     0x9
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1__SHIFT                               0xa
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1__SHIFT                               0xb
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1__SHIFT                                                 0xd
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR__SHIFT                                     0x10
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR__SHIFT                                    0x11
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR__SHIFT                              0x12
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR__SHIFT                              0x13
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR__SHIFT                                                0x15
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_VBLANK__SHIFT                                                    0x1a
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN__SHIFT                                                   0x1b
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY__SHIFT                                          0x1c
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH__SHIFT                                             0x1d
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0__SHIFT                                            0x1e
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1__SHIFT                                            0x1f
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S0_MASK                                        0x00000001L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S0_MASK                                       0x00000002L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S0_MASK                                 0x00000004L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S0_MASK                                 0x00000008L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_S0_MASK                                                   0x00000020L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_S1_MASK                                        0x00000100L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_S1_MASK                                       0x00000200L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_S1_MASK                                 0x00000400L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_S1_MASK                                 0x00000800L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_S1_MASK                                                   0x00002000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_EXIT_SELF_REFRESH_CUR_MASK                                       0x00010000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ENTER_SELF_REFRESH_CUR_MASK                                      0x00020000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_UCLK_PSTATE_CHANGE_CUR_MASK                                0x00040000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_ALLOW_FCLK_PSTATE_CHANGE_CUR_MASK                                0x00080000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_URGENT_CUR_MASK                                                  0x00200000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_VBLANK_MASK                                                      0x04000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_HUBP_EN_MASK                                                     0x08000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_RECOVERY_MASK                                            0x10000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_PIPE_IN_FLUSH_MASK                                               0x20000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S0_MASK                                              0x40000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG2__STATUS_FLIP_ACTIVE_S1_MASK                                              0x80000000L
+//HUBPREQ3_HUBPREQ_STATUS_REG3
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL__SHIFT                                            0x0
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE__SHIFT                                     0x1
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL__SHIFT                                            0x2
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0__SHIFT                                              0x3
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0__SHIFT                                   0x6
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0__SHIFT                                    0x7
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0__SHIFT                                         0x9
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0__SHIFT                                  0xa
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1__SHIFT                                              0xd
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1__SHIFT                                   0x10
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1__SHIFT                                    0x11
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1__SHIFT                                         0x13
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1__SHIFT                                  0x14
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE__SHIFT                                 0x17
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST__SHIFT                                     0x18
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR__SHIFT                                       0x19
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED__SHIFT                                          0x1a
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT__SHIFT                            0x1b
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT__SHIFT                            0x1d
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_EN_LOCAL_MASK                                              0x00000001L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_DELIVERY_ACTIVE_MASK                                       0x00000002L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_TDLUT_PIX_CTRL_MASK                                              0x00000004L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S0_MASK                                                0x00000038L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S0_MASK                                     0x00000040L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S0_MASK                                      0x00000180L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S0_MASK                                           0x00000200L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S0_MASK                                    0x00001C00L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_STATE_SVP_S1_MASK                                                0x0000E000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_ALLOW_S1_MASK                                     0x00010000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_RD_TYPE_S1_MASK                                      0x00060000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_IN_USE_S1_MASK                                           0x00080000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_MEM_TYPE_DONE_S1_MASK                                    0x00700000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_USE_ALT_CHN_AT_START_LINE_MASK                                   0x00800000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_PSTATE_CHANGE_REQUEST_MASK                                       0x01000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_REUSE_VM_AND_CURSOR_MASK                                         0x02000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_NO_REUSE_ALLOWED_MASK                                            0x04000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_NEGEDGE_CNT_MASK                              0x18000000L
+#define HUBPREQ3_HUBPREQ_STATUS_REG3__STATUS_ALT_CHN_PSTATE_REQ_POSEDGE_CNT_MASK                              0x60000000L
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubpret_dispdec
+//HUBPRET3_HUBPRET_CONTROL
+#define HUBPRET3_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS__SHIFT                                          0x4
+#define HUBPRET3_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE__SHIFT                                            0xf
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA__SHIFT                                                   0x10
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G__SHIFT                                                     0x12
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B__SHIFT                                                    0x14
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R__SHIFT                                                    0x16
+#define HUBPRET3_HUBPRET_CONTROL__DET_BUF_PLANE1_BASE_ADDRESS_MASK                                            0x00007FF0L
+#define HUBPRET3_HUBPRET_CONTROL__PACK_3TO2_ELEMENT_DISABLE_MASK                                              0x00008000L
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_ALPHA_MASK                                                     0x00030000L
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_Y_G_MASK                                                       0x000C0000L
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_CB_B_MASK                                                      0x00300000L
+#define HUBPRET3_HUBPRET_CONTROL__CROSSBAR_SRC_CR_R_MASK                                                      0x00C00000L
+//HUBPRET3_HUBPRET_MEM_PWR_CTRL
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE__SHIFT                                             0x8
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS__SHIFT                                               0xa
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE__SHIFT                                            0x10
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS__SHIFT                                              0x12
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE__SHIFT                                          0x14
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_FORCE_MASK                                               0x00000300L
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__DMROB_MEM_PWR_DIS_MASK                                                 0x00000400L
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_FORCE_MASK                                              0x00030000L
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_DIS_MASK                                                0x00040000L
+#define HUBPRET3_HUBPRET_MEM_PWR_CTRL__PIXCDC_MEM_PWR_LS_MODE_MASK                                            0x00300000L
+//HUBPRET3_HUBPRET_MEM_PWR_STATUS
+#define HUBPRET3_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE__SHIFT                                           0x2
+#define HUBPRET3_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE__SHIFT                                          0x4
+#define HUBPRET3_HUBPRET_MEM_PWR_STATUS__DMROB_MEM_PWR_STATE_MASK                                             0x0000000CL
+#define HUBPRET3_HUBPRET_MEM_PWR_STATUS__PIXCDC_MEM_PWR_STATE_MASK                                            0x00000030L
+//HUBPRET3_HUBPRET_READ_LINE_CTRL0
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE__SHIFT                         0x0
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM__SHIFT                                0x10
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_INTERVAL_IN_NONACTIVE_MASK                           0x0000FFFFL
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL0__PIPE_READ_LINE_VBLANK_MAXIMUM_MASK                                  0xFFFF0000L
+//HUBPRET3_HUBPRET_READ_LINE_CTRL1
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED__SHIFT                    0x0
+#define HUBPRET3_HUBPRET_READ_LINE_CTRL1__PIPE_READ_LINE_REPORTED_WHEN_REQ_DISABLED_MASK                      0x0000FFFFL
+//HUBPRET3_HUBPRET_READ_LINE0
+#define HUBPRET3_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START__SHIFT                                             0x0
+#define HUBPRET3_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END__SHIFT                                               0x10
+#define HUBPRET3_HUBPRET_READ_LINE0__PIPE_READ_LINE0_START_MASK                                               0x0000FFFFL
+#define HUBPRET3_HUBPRET_READ_LINE0__PIPE_READ_LINE0_END_MASK                                                 0xFFFF0000L
+//HUBPRET3_HUBPRET_READ_LINE1
+#define HUBPRET3_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START__SHIFT                                             0x0
+#define HUBPRET3_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END__SHIFT                                               0x10
+#define HUBPRET3_HUBPRET_READ_LINE1__PIPE_READ_LINE1_START_MASK                                               0x0000FFFFL
+#define HUBPRET3_HUBPRET_READ_LINE1__PIPE_READ_LINE1_END_MASK                                                 0xFFFF0000L
+//HUBPRET3_HUBPRET_INTERRUPT
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK__SHIFT                                               0x0
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK__SHIFT                                           0x1
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK__SHIFT                                           0x2
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE__SHIFT                                               0x4
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE__SHIFT                                           0x5
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE__SHIFT                                           0x6
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR__SHIFT                                              0x8
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR__SHIFT                                          0x9
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR__SHIFT                                          0xa
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS__SHIFT                                                 0xc
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS__SHIFT                                             0xd
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS__SHIFT                                             0xe
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS__SHIFT                                             0x10
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS__SHIFT                                         0x11
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS__SHIFT                                         0x12
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_MASK_MASK                                                 0x00000001L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_MASK_MASK                                             0x00000002L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_MASK_MASK                                             0x00000004L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_TYPE_MASK                                                 0x00000010L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_TYPE_MASK                                             0x00000020L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_TYPE_MASK                                             0x00000040L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_CLEAR_MASK                                                0x00000100L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_CLEAR_MASK                                            0x00000200L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_CLEAR_MASK                                            0x00000400L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_STATUS_MASK                                                   0x00001000L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_STATUS_MASK                                               0x00002000L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_STATUS_MASK                                               0x00004000L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_VBLANK_INT_STATUS_MASK                                               0x00010000L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE0_INT_STATUS_MASK                                           0x00020000L
+#define HUBPRET3_HUBPRET_INTERRUPT__PIPE_READ_LINE1_INT_STATUS_MASK                                           0x00040000L
+//HUBPRET3_HUBPRET_READ_LINE_VALUE
+#define HUBPRET3_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE__SHIFT                                               0x0
+#define HUBPRET3_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT__SHIFT                                      0x10
+#define HUBPRET3_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_MASK                                                 0x0000FFFFL
+#define HUBPRET3_HUBPRET_READ_LINE_VALUE__PIPE_READ_LINE_SNAPSHOT_MASK                                        0xFFFF0000L
+//HUBPRET3_HUBPRET_READ_LINE_STATUS
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK__SHIFT                                            0x0
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE__SHIFT                                      0x4
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE__SHIFT                                     0x5
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE__SHIFT                                      0x8
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE__SHIFT                                     0xa
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_VBLANK_MASK                                              0x00000001L
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_INSIDE_MASK                                        0x00000010L
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE0_OUTSIDE_MASK                                       0x00000020L
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_INSIDE_MASK                                        0x00000100L
+#define HUBPRET3_HUBPRET_READ_LINE_STATUS__PIPE_READ_LINE1_OUTSIDE_MASK                                       0x00000400L
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_cursor0_dispdec
+//CURSOR0_3_CURSOR_CONTROL
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_ENABLE__SHIFT                                                        0x0
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_REQ_MODE__SHIFT                                                      0x2
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_2X_MAGNIFY__SHIFT                                                    0x4
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_MODE__SHIFT                                                          0x8
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_TMZ__SHIFT                                                           0xc
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PITCH__SHIFT                                                         0x10
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS__SHIFT                     0x14
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK__SHIFT                                               0x18
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN__SHIFT                                    0x1e
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL__SHIFT                                   0x1f
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_ENABLE_MASK                                                          0x00000001L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_REQ_MODE_MASK                                                        0x00000004L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_2X_MAGNIFY_MASK                                                      0x00000010L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_MODE_MASK                                                            0x00000700L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_TMZ_MASK                                                             0x00001000L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PITCH_MASK                                                           0x00030000L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_XY_POSITION_ROTATION_AND_MIRRORING_BYPASS_MASK                       0x00100000L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_LINES_PER_CHUNK_MASK                                                 0x1F000000L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_EN_MASK                                      0x40000000L
+#define CURSOR0_3_CURSOR_CONTROL__CURSOR_PERFMON_LATENCY_MEASURE_SEL_MASK                                     0x80000000L
+//CURSOR0_3_CURSOR_SURFACE_ADDRESS
+#define CURSOR0_3_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS__SHIFT                                       0x0
+#define CURSOR0_3_CURSOR_SURFACE_ADDRESS__CURSOR_SURFACE_ADDRESS_MASK                                         0xFFFFFFFFL
+//CURSOR0_3_CURSOR_SURFACE_ADDRESS_HIGH
+#define CURSOR0_3_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH__SHIFT                             0x0
+#define CURSOR0_3_CURSOR_SURFACE_ADDRESS_HIGH__CURSOR_SURFACE_ADDRESS_HIGH_MASK                               0x0000FFFFL
+//CURSOR0_3_CURSOR_SIZE
+#define CURSOR0_3_CURSOR_SIZE__CURSOR_HEIGHT__SHIFT                                                           0x0
+#define CURSOR0_3_CURSOR_SIZE__CURSOR_WIDTH__SHIFT                                                            0x10
+#define CURSOR0_3_CURSOR_SIZE__CURSOR_HEIGHT_MASK                                                             0x000001FFL
+#define CURSOR0_3_CURSOR_SIZE__CURSOR_WIDTH_MASK                                                              0x01FF0000L
+//CURSOR0_3_CURSOR_POSITION
+#define CURSOR0_3_CURSOR_POSITION__CURSOR_Y_POSITION__SHIFT                                                   0x0
+#define CURSOR0_3_CURSOR_POSITION__CURSOR_X_POSITION__SHIFT                                                   0xf
+#define CURSOR0_3_CURSOR_POSITION__CURSOR_Y_POSITION_MASK                                                     0x00007FFFL
+#define CURSOR0_3_CURSOR_POSITION__CURSOR_X_POSITION_MASK                                                     0x3FFF8000L
+//CURSOR0_3_CURSOR_HOT_SPOT
+#define CURSOR0_3_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y__SHIFT                                                   0x0
+#define CURSOR0_3_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X__SHIFT                                                   0x10
+#define CURSOR0_3_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_Y_MASK                                                     0x000000FFL
+#define CURSOR0_3_CURSOR_HOT_SPOT__CURSOR_HOT_SPOT_X_MASK                                                     0x00FF0000L
+//CURSOR0_3_CURSOR_STEREO_CONTROL
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN__SHIFT                                              0x0
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET__SHIFT                                         0x2
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET__SHIFT                                       0x11
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_STEREO_EN_MASK                                                0x00000001L
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_PRIMARY_OFFSET_MASK                                           0x0001FFFCL
+#define CURSOR0_3_CURSOR_STEREO_CONTROL__CURSOR_SECONDARY_OFFSET_MASK                                         0xFFFE0000L
+//CURSOR0_3_CURSOR_DST_OFFSET
+#define CURSOR0_3_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET__SHIFT                                               0x0
+#define CURSOR0_3_CURSOR_DST_OFFSET__CURSOR_DST_X_OFFSET_MASK                                                 0x00003FFFL
+//CURSOR0_3_CURSOR_MEM_PWR_CTRL
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE__SHIFT                                              0x0
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS__SHIFT                                                0x2
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE__SHIFT                                            0x4
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_FORCE_MASK                                                0x00000003L
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_DIS_MASK                                                  0x00000004L
+#define CURSOR0_3_CURSOR_MEM_PWR_CTRL__CROB_MEM_PWR_LS_MODE_MASK                                              0x00000030L
+//CURSOR0_3_CURSOR_MEM_PWR_STATUS
+#define CURSOR0_3_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE__SHIFT                                            0x0
+#define CURSOR0_3_CURSOR_MEM_PWR_STATUS__CROB_MEM_PWR_STATE_MASK                                              0x00000003L
+//CURSOR0_3_DMDATA_ADDRESS_HIGH
+#define CURSOR0_3_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH__SHIFT                                             0x0
+#define CURSOR0_3_DMDATA_ADDRESS_HIGH__DMDATA_TMZ__SHIFT                                                      0x1e
+#define CURSOR0_3_DMDATA_ADDRESS_HIGH__DMDATA_ADDRESS_HIGH_MASK                                               0x0000FFFFL
+#define CURSOR0_3_DMDATA_ADDRESS_HIGH__DMDATA_TMZ_MASK                                                        0x40000000L
+//CURSOR0_3_DMDATA_ADDRESS_LOW
+#define CURSOR0_3_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW__SHIFT                                               0x0
+#define CURSOR0_3_DMDATA_ADDRESS_LOW__DMDATA_ADDRESS_LOW_MASK                                                 0xFFFFFFFFL
+//CURSOR0_3_DMDATA_CNTL
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_UPDATED__SHIFT                                                          0x0
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_REPEAT__SHIFT                                                           0x1
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_MODE__SHIFT                                                             0x2
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_SIZE__SHIFT                                                             0x10
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_UPDATED_MASK                                                            0x00000001L
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_REPEAT_MASK                                                             0x00000002L
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_MODE_MASK                                                               0x00000004L
+#define CURSOR0_3_DMDATA_CNTL__DMDATA_SIZE_MASK                                                               0x0FFF0000L
+//CURSOR0_3_DMDATA_QOS_CNTL
+#define CURSOR0_3_DMDATA_QOS_CNTL__DMDATA_QOS_MODE__SHIFT                                                     0x0
+#define CURSOR0_3_DMDATA_QOS_CNTL__DMDATA_DL_DELTA__SHIFT                                                     0x10
+#define CURSOR0_3_DMDATA_QOS_CNTL__DMDATA_QOS_MODE_MASK                                                       0x00000001L
+#define CURSOR0_3_DMDATA_QOS_CNTL__DMDATA_DL_DELTA_MASK                                                       0xFFFF0000L
+//CURSOR0_3_DMDATA_STATUS
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_DONE__SHIFT                                                           0x0
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_UNDERFLOW__SHIFT                                                      0x2
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR__SHIFT                                                0x4
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_DONE_MASK                                                             0x00000001L
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_UNDERFLOW_MASK                                                        0x00000004L
+#define CURSOR0_3_DMDATA_STATUS__DMDATA_UNDERFLOW_CLEAR_MASK                                                  0x00000010L
+//CURSOR0_3_DMDATA_SW_CNTL
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_UPDATED__SHIFT                                                    0x0
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_REPEAT__SHIFT                                                     0x1
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_SIZE__SHIFT                                                       0x10
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_UPDATED_MASK                                                      0x00000001L
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_REPEAT_MASK                                                       0x00000002L
+#define CURSOR0_3_DMDATA_SW_CNTL__DMDATA_SW_SIZE_MASK                                                         0x0FFF0000L
+//CURSOR0_3_DMDATA_SW_DATA
+#define CURSOR0_3_DMDATA_SW_DATA__DMDATA_SW_DATA__SHIFT                                                       0x0
+#define CURSOR0_3_DMDATA_SW_DATA__DMDATA_SW_DATA_MASK                                                         0xFFFFFFFFL
+//CURSOR0_3_HUBP_3DLUT_CONTROL
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE__SHIFT                                                0x0
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE__SHIFT                                       0x1
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH__SHIFT                                                 0x2
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B__SHIFT                                        0x13
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G__SHIFT                                        0x15
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R__SHIFT                                        0x17
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ__SHIFT                                                   0x19
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH__SHIFT                                             0x1e
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE__SHIFT                                                  0x1f
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ENABLE_MASK                                                  0x00000001L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_ADDRESSING_MODE_MASK                                         0x00000002L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_WIDTH_MASK                                                   0x0003FFFCL
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_B_MASK                                          0x00180000L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_G_MASK                                          0x00600000L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_CROSSBAR_SEL_R_MASK                                          0x01800000L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_TMZ_MASK                                                     0x1E000000L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_MPC_WIDTH_MASK                                               0x40000000L
+#define CURSOR0_3_HUBP_3DLUT_CONTROL__HUBP_3DLUT_DONE_MASK                                                    0x80000000L
+//CURSOR0_3_HUBP_3DLUT_ADDRESS_LOW
+#define CURSOR0_3_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW__SHIFT                                       0x0
+#define CURSOR0_3_HUBP_3DLUT_ADDRESS_LOW__HUBP_3DLUT_ADDRESS_LOW_MASK                                         0xFFFFFFFFL
+//CURSOR0_3_HUBP_3DLUT_ADDRESS_HIGH
+#define CURSOR0_3_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH__SHIFT                                     0x0
+#define CURSOR0_3_HUBP_3DLUT_ADDRESS_HIGH__HUBP_3DLUT_ADDRESS_HIGH_MASK                                       0x0000FFFFL
+//CURSOR0_3_HUBP_3DLUT_DLG_PARAM
+#define CURSOR0_3_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP__SHIFT                                         0x0
+#define CURSOR0_3_HUBP_3DLUT_DLG_PARAM__REFCYC_PER_3DLUT_GROUP_MASK                                           0x007FFFFFL
+
+
+// addressBlock: dce_dc_dcbubp3_dispdec_hubp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON9_PERFCOUNTER_CNTL
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                            0x0
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                           0x9
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                             0xc
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                          0xf
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                           0x10
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                     0x16
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                           0x17
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                               0x18
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                             0x19
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                               0x1a
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                             0x1d
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                              0x000001FFL
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                             0x00000E00L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                               0x00007000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                            0x00008000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                             0x00010000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                       0x00400000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                             0x00800000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                 0x01000000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                               0x02000000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                 0x04000000L
+#define DC_PERFMON9_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                               0xE0000000L
+//DC_PERFMON9_PERFCOUNTER_CNTL2
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                  0x0
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                        0x2
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                        0x3
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                          0x8
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                           0x1d
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                    0x00000003L
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                          0x00000004L
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                          0x00000008L
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                            0x00003F00L
+#define DC_PERFMON9_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                             0xE0000000L
+//DC_PERFMON9_PERFCOUNTER_STATE
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                          0x0
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                          0x2
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                          0x4
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                          0x6
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                          0x8
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                          0xa
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                          0xc
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                          0xe
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                          0x10
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                          0x12
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                          0x14
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                          0x16
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                          0x18
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                          0x1a
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                          0x1c
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                          0x1e
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                            0x00000003L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                            0x00000004L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                            0x00000030L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                            0x00000040L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                            0x00000300L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                            0x00000400L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                            0x00003000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                            0x00004000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                            0x00030000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                            0x00040000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                            0x00300000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                            0x00400000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                            0x03000000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                            0x04000000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                            0x30000000L
+#define DC_PERFMON9_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                            0x40000000L
+//DC_PERFMON9_PERFMON_CNTL
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                        0x0
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                    0x8
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                                0x1c
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                                0x1d
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                            0x1e
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                               0x1f
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_STATE_MASK                                                          0x00000003L
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                      0x0FFFFF00L
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                  0x10000000L
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                  0x20000000L
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                              0x40000000L
+#define DC_PERFMON9_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                 0x80000000L
+//DC_PERFMON9_PERFMON_CNTL2
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                             0x0
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                  0x1
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                        0x2
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                         0xa
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                               0x00000001L
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                    0x00000002L
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                          0x000003FCL
+#define DC_PERFMON9_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                           0x0003FC00L
+//DC_PERFMON9_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                   0x0
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                   0x1
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                   0x2
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                   0x3
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                   0x4
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                   0x5
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                   0x6
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                   0x7
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                      0x8
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                      0x9
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                      0xa
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                      0xb
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                      0xc
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                      0xd
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                      0xe
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                      0xf
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                         0x10
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                     0x00000001L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                     0x00000002L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                     0x00000004L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                     0x00000008L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                     0x00000010L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                     0x00000020L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                     0x00000040L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                     0x00000080L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                        0x00000100L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                        0x00000200L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                        0x00000400L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                        0x00000800L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                        0x00001000L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                        0x00002000L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                        0x00004000L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                        0x00008000L
+#define DC_PERFMON9_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                           0xFFFF0000L
+//DC_PERFMON9_PERFMON_CVALUE_LOW
+#define DC_PERFMON9_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                             0x0
+#define DC_PERFMON9_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                               0xFFFFFFFFL
+//DC_PERFMON9_PERFMON_HI
+#define DC_PERFMON9_PERFMON_HI__PERFMON_HI__SHIFT                                                             0x0
+#define DC_PERFMON9_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                       0x1d
+#define DC_PERFMON9_PERFMON_HI__PERFMON_HI_MASK                                                               0x0000FFFFL
+#define DC_PERFMON9_PERFMON_HI__PERFMON_READ_SEL_MASK                                                         0xE0000000L
+//DC_PERFMON9_PERFMON_LOW
+#define DC_PERFMON9_PERFMON_LOW__PERFMON_LOW__SHIFT                                                           0x0
+#define DC_PERFMON9_PERFMON_LOW__PERFMON_LOW_MASK                                                             0xFFFFFFFFL
+//DC_PERFMON9_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//DC_PERFMON9_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define DC_PERFMON9_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cnvc_cfg_dispdec
+//CNVC_CFG0_CNVC_SURFACE_PIXEL_FORMAT
+#define CNVC_CFG0_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT__SHIFT                                 0x0
+#define CNVC_CFG0_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT_MASK                                   0x0000007FL
+//CNVC_CFG0_FORMAT_CONTROL
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_EXPANSION_MODE__SHIFT                                                0x0
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CNV16__SHIFT                                                         0x4
+#define CNVC_CFG0_FORMAT_CONTROL__ALPHA_EN__SHIFT                                                             0x8
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_BYPASS__SHIFT                                                          0xc
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN__SHIFT                                                0xd
+#define CNVC_CFG0_FORMAT_CONTROL__CLAMP_POSITIVE__SHIFT                                                       0x10
+#define CNVC_CFG0_FORMAT_CONTROL__CLAMP_POSITIVE_C__SHIFT                                                     0x11
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_UPDATE_PENDING__SHIFT                                                  0x14
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_R__SHIFT                                                    0x18
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_G__SHIFT                                                    0x1a
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_B__SHIFT                                                    0x1c
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_EXPANSION_MODE_MASK                                                  0x00000001L
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CNV16_MASK                                                           0x00000010L
+#define CNVC_CFG0_FORMAT_CONTROL__ALPHA_EN_MASK                                                               0x00000100L
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_BYPASS_MASK                                                            0x00001000L
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN_MASK                                                  0x00002000L
+#define CNVC_CFG0_FORMAT_CONTROL__CLAMP_POSITIVE_MASK                                                         0x00010000L
+#define CNVC_CFG0_FORMAT_CONTROL__CLAMP_POSITIVE_C_MASK                                                       0x00020000L
+#define CNVC_CFG0_FORMAT_CONTROL__CNVC_UPDATE_PENDING_MASK                                                    0x00100000L
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_R_MASK                                                      0x03000000L
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_G_MASK                                                      0x0C000000L
+#define CNVC_CFG0_FORMAT_CONTROL__FORMAT_CROSSBAR_B_MASK                                                      0x30000000L
+//CNVC_CFG0_FCNV_FP_BIAS_R
+#define CNVC_CFG0_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R__SHIFT                                                       0x0
+#define CNVC_CFG0_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R_MASK                                                         0x0007FFFFL
+//CNVC_CFG0_FCNV_FP_BIAS_G
+#define CNVC_CFG0_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G__SHIFT                                                       0x0
+#define CNVC_CFG0_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G_MASK                                                         0x0007FFFFL
+//CNVC_CFG0_FCNV_FP_BIAS_B
+#define CNVC_CFG0_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B__SHIFT                                                       0x0
+#define CNVC_CFG0_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B_MASK                                                         0x0007FFFFL
+//CNVC_CFG0_FCNV_FP_SCALE_R
+#define CNVC_CFG0_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R__SHIFT                                                     0x0
+#define CNVC_CFG0_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R_MASK                                                       0x0007FFFFL
+//CNVC_CFG0_FCNV_FP_SCALE_G
+#define CNVC_CFG0_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G__SHIFT                                                     0x0
+#define CNVC_CFG0_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G_MASK                                                       0x0007FFFFL
+//CNVC_CFG0_FCNV_FP_SCALE_B
+#define CNVC_CFG0_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B__SHIFT                                                     0x0
+#define CNVC_CFG0_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B_MASK                                                       0x0007FFFFL
+//CNVC_CFG0_COLOR_KEYER_CONTROL
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__COLOR_KEYER_EN__SHIFT                                                  0x0
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__LUMA_KEYER_EN__SHIFT                                                   0x1
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE__SHIFT                                                0x4
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__COLOR_KEYER_EN_MASK                                                    0x00000001L
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__LUMA_KEYER_EN_MASK                                                     0x00000002L
+#define CNVC_CFG0_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE_MASK                                                  0x00000030L
+//CNVC_CFG0_COLOR_KEYER_ALPHA
+#define CNVC_CFG0_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW__SHIFT                                             0x0
+#define CNVC_CFG0_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH__SHIFT                                            0x10
+#define CNVC_CFG0_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG0_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG0_COLOR_KEYER_RED
+#define CNVC_CFG0_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW__SHIFT                                                 0x0
+#define CNVC_CFG0_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH__SHIFT                                                0x10
+#define CNVC_CFG0_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW_MASK                                                   0x0000FFFFL
+#define CNVC_CFG0_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH_MASK                                                  0xFFFF0000L
+//CNVC_CFG0_COLOR_KEYER_GREEN
+#define CNVC_CFG0_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW__SHIFT                                             0x0
+#define CNVC_CFG0_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH__SHIFT                                            0x10
+#define CNVC_CFG0_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG0_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG0_COLOR_KEYER_BLUE
+#define CNVC_CFG0_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW__SHIFT                                               0x0
+#define CNVC_CFG0_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH__SHIFT                                              0x10
+#define CNVC_CFG0_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW_MASK                                                 0x0000FFFFL
+#define CNVC_CFG0_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH_MASK                                                0xFFFF0000L
+//CNVC_CFG0_ALPHA_2BIT_LUT01
+#define CNVC_CFG0_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0__SHIFT                                                    0x0
+#define CNVC_CFG0_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1__SHIFT                                                    0x10
+#define CNVC_CFG0_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0_MASK                                                      0x00000FFFL
+#define CNVC_CFG0_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1_MASK                                                      0x0FFF0000L
+//CNVC_CFG0_ALPHA_2BIT_LUT23
+#define CNVC_CFG0_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2__SHIFT                                                    0x0
+#define CNVC_CFG0_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3__SHIFT                                                    0x10
+#define CNVC_CFG0_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2_MASK                                                      0x00000FFFL
+#define CNVC_CFG0_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3_MASK                                                      0x0FFF0000L
+//CNVC_CFG0_PRE_DEALPHA
+#define CNVC_CFG0_PRE_DEALPHA__PRE_DEALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG0_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG0_PRE_DEALPHA__PRE_DEALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG0_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG0_PRE_CSC_MODE
+#define CNVC_CFG0_PRE_CSC_MODE__PRE_CSC_MODE__SHIFT                                                           0x0
+#define CNVC_CFG0_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT__SHIFT                                                   0x2
+#define CNVC_CFG0_PRE_CSC_MODE__PRE_CSC_MODE_MASK                                                             0x00000003L
+#define CNVC_CFG0_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT_MASK                                                     0x0000000CL
+//CNVC_CFG0_PRE_CSC_C11_C12
+#define CNVC_CFG0_PRE_CSC_C11_C12__PRE_CSC_C11__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C11_C12__PRE_CSC_C12__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C11_C12__PRE_CSC_C11_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C11_C12__PRE_CSC_C12_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_C13_C14
+#define CNVC_CFG0_PRE_CSC_C13_C14__PRE_CSC_C13__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C13_C14__PRE_CSC_C14__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C13_C14__PRE_CSC_C13_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C13_C14__PRE_CSC_C14_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_C21_C22
+#define CNVC_CFG0_PRE_CSC_C21_C22__PRE_CSC_C21__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C21_C22__PRE_CSC_C22__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C21_C22__PRE_CSC_C21_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C21_C22__PRE_CSC_C22_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_C23_C24
+#define CNVC_CFG0_PRE_CSC_C23_C24__PRE_CSC_C23__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C23_C24__PRE_CSC_C24__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C23_C24__PRE_CSC_C23_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C23_C24__PRE_CSC_C24_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_C31_C32
+#define CNVC_CFG0_PRE_CSC_C31_C32__PRE_CSC_C31__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C31_C32__PRE_CSC_C32__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C31_C32__PRE_CSC_C31_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C31_C32__PRE_CSC_C32_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_C33_C34
+#define CNVC_CFG0_PRE_CSC_C33_C34__PRE_CSC_C33__SHIFT                                                         0x0
+#define CNVC_CFG0_PRE_CSC_C33_C34__PRE_CSC_C34__SHIFT                                                         0x10
+#define CNVC_CFG0_PRE_CSC_C33_C34__PRE_CSC_C33_MASK                                                           0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_C33_C34__PRE_CSC_C34_MASK                                                           0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C11_C12
+#define CNVC_CFG0_PRE_CSC_B_C11_C12__PRE_CSC_B_C11__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C11_C12__PRE_CSC_B_C12__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C11_C12__PRE_CSC_B_C11_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C11_C12__PRE_CSC_B_C12_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C13_C14
+#define CNVC_CFG0_PRE_CSC_B_C13_C14__PRE_CSC_B_C13__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C13_C14__PRE_CSC_B_C14__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C13_C14__PRE_CSC_B_C13_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C13_C14__PRE_CSC_B_C14_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C21_C22
+#define CNVC_CFG0_PRE_CSC_B_C21_C22__PRE_CSC_B_C21__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C21_C22__PRE_CSC_B_C22__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C21_C22__PRE_CSC_B_C21_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C21_C22__PRE_CSC_B_C22_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C23_C24
+#define CNVC_CFG0_PRE_CSC_B_C23_C24__PRE_CSC_B_C23__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C23_C24__PRE_CSC_B_C24__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C23_C24__PRE_CSC_B_C23_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C23_C24__PRE_CSC_B_C24_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C31_C32
+#define CNVC_CFG0_PRE_CSC_B_C31_C32__PRE_CSC_B_C31__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C31_C32__PRE_CSC_B_C32__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C31_C32__PRE_CSC_B_C31_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C31_C32__PRE_CSC_B_C32_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_PRE_CSC_B_C33_C34
+#define CNVC_CFG0_PRE_CSC_B_C33_C34__PRE_CSC_B_C33__SHIFT                                                     0x0
+#define CNVC_CFG0_PRE_CSC_B_C33_C34__PRE_CSC_B_C34__SHIFT                                                     0x10
+#define CNVC_CFG0_PRE_CSC_B_C33_C34__PRE_CSC_B_C33_MASK                                                       0x0000FFFFL
+#define CNVC_CFG0_PRE_CSC_B_C33_C34__PRE_CSC_B_C34_MASK                                                       0xFFFF0000L
+//CNVC_CFG0_CNVC_COEF_FORMAT
+#define CNVC_CFG0_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT__SHIFT                                                0x0
+#define CNVC_CFG0_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT_MASK                                                  0x00000001L
+//CNVC_CFG0_PRE_GAM
+#define CNVC_CFG0_PRE_GAM__PRE_GAM_MODE__SHIFT                                                                0x0
+#define CNVC_CFG0_PRE_GAM__PRE_DEGAM_SELECT__SHIFT                                                            0x4
+#define CNVC_CFG0_PRE_GAM__PRE_REGAM_SELECT__SHIFT                                                            0x7
+#define CNVC_CFG0_PRE_GAM__PRE_GAM_MODE_MASK                                                                  0x00000003L
+#define CNVC_CFG0_PRE_GAM__PRE_DEGAM_SELECT_MASK                                                              0x00000070L
+#define CNVC_CFG0_PRE_GAM__PRE_REGAM_SELECT_MASK                                                              0x00000080L
+//CNVC_CFG0_PRE_REALPHA
+#define CNVC_CFG0_PRE_REALPHA__PRE_REALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG0_PRE_REALPHA__PRE_REALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG0_PRE_REALPHA__PRE_REALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG0_PRE_REALPHA__PRE_REALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG0_PIX_DROP_CNTL
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_DROP_EN__SHIFT                                                           0x0
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_LUMA_DROP__SHIFT                                                         0x4
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_CHROMA_DROP__SHIFT                                                       0x8
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_DROP_EN_MASK                                                             0x00000001L
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_LUMA_DROP_MASK                                                           0x000000F0L
+#define CNVC_CFG0_PIX_DROP_CNTL__PIX_CHROMA_DROP_MASK                                                         0x00000F00L
+//CNVC_CFG0_PIX_DROP_OUT
+#define CNVC_CFG0_PIX_DROP_OUT__PIX_DROP_OUT_L__SHIFT                                                         0x0
+#define CNVC_CFG0_PIX_DROP_OUT__PIX_DROP_OUT_C__SHIFT                                                         0x10
+#define CNVC_CFG0_PIX_DROP_OUT__PIX_DROP_OUT_L_MASK                                                           0x00003FFFL
+#define CNVC_CFG0_PIX_DROP_OUT__PIX_DROP_OUT_C_MASK                                                           0x3FFF0000L
+//CNVC_CFG0_CNVC_UPSP_MODE
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_MODE__SHIFT                                                            0x0
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE__SHIFT                                                   0x2
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS__SHIFT                                                      0x4
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_INIT_INT__SHIFT                                                      0x8
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC__SHIFT                                                     0xc
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS__SHIFT                                                      0x10
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_INIT_INT__SHIFT                                                      0x14
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC__SHIFT                                                     0x18
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_MODE_MASK                                                              0x00000003L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE_MASK                                                     0x00000004L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS_MASK                                                        0x00000010L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_INIT_INT_MASK                                                        0x00000700L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC_MASK                                                       0x00001000L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS_MASK                                                        0x00010000L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_INIT_INT_MASK                                                        0x00700000L
+#define CNVC_CFG0_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC_MASK                                                       0x01000000L
+//CNVC_CFG0_CNVC_UPSP_V_COEF_P0
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG0_CNVC_UPSP_V_COEF_P1
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG0_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG0_CNVC_UPSP_H_COEF_P0
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG0_CNVC_UPSP_H_COEF_P1
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG0_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG0_CNVC_UPSP_CLAMP
+#define CNVC_CFG0_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX__SHIFT                                                      0x0
+#define CNVC_CFG0_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN__SHIFT                                                      0x10
+#define CNVC_CFG0_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX_MASK                                                        0x00000FFFL
+#define CNVC_CFG0_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN_MASK                                                        0x0FFF0000L
+//CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE__SHIFT                                           0x0
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS__SHIFT                                             0x2
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE__SHIFT                                           0x10
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE_MASK                                             0x00000003L
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS_MASK                                               0x00000004L
+#define CNVC_CFG0_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE_MASK                                             0x00030000L
+//CNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//CNVC_CFG0_CNVC_CFG_TEST_DEBUG_DATA
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define CNVC_CFG0_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cm_cur_dispdec
+//CM_CUR0_CURSOR0_CONTROL
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_ENABLE__SHIFT                                                           0x0
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_EXPANSION_MODE__SHIFT                                                   0x1
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_PIX_INV_MODE__SHIFT                                                     0x2
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_ROM_EN__SHIFT                                                           0x3
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_MODE__SHIFT                                                             0x4
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN__SHIFT                                               0x7
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_UPDATE_PENDING__SHIFT                                                   0x10
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_ENABLE_MASK                                                             0x00000001L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_EXPANSION_MODE_MASK                                                     0x00000002L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_PIX_INV_MODE_MASK                                                       0x00000004L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_ROM_EN_MASK                                                             0x00000008L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_MODE_MASK                                                               0x00000070L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN_MASK                                                 0x00000080L
+#define CM_CUR0_CURSOR0_CONTROL__CUR0_UPDATE_PENDING_MASK                                                     0x00010000L
+//CM_CUR0_CURSOR0_COLOR0
+#define CM_CUR0_CURSOR0_COLOR0__CUR0_COLOR0__SHIFT                                                            0x0
+#define CM_CUR0_CURSOR0_COLOR0__CUR0_COLOR0_MASK                                                              0x00FFFFFFL
+//CM_CUR0_CURSOR0_COLOR1
+#define CM_CUR0_CURSOR0_COLOR1__CUR0_COLOR1__SHIFT                                                            0x0
+#define CM_CUR0_CURSOR0_COLOR1__CUR0_COLOR1_MASK                                                              0x00FFFFFFL
+//CM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y__SHIFT                                           0x0
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y__SHIFT                                            0x10
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y_MASK                                             0x0000FFFFL
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y_MASK                                              0xFFFF0000L
+//CM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB__SHIFT                                   0x0
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB__SHIFT                                    0x10
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB_MASK                                     0x0000FFFFL
+#define CM_CUR0_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB_MASK                                      0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_MODE
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE__SHIFT                                                     0x0
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT__SHIFT                                             0x2
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT__SHIFT                                              0x4
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_MASK                                                       0x00000003L
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT_MASK                                               0x0000000CL
+#define CM_CUR0_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT_MASK                                                0x00000010L
+//CM_CUR0_CUR0_MATRIX_C11_C12_A
+#define CM_CUR0_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C13_C14_A
+#define CM_CUR0_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C21_C22_A
+#define CM_CUR0_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C23_C24_A
+#define CM_CUR0_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C31_C32_A
+#define CM_CUR0_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C33_C34_A
+#define CM_CUR0_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C11_C12_B
+#define CM_CUR0_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C13_C14_B
+#define CM_CUR0_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C21_C22_B
+#define CM_CUR0_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C23_C24_B
+#define CM_CUR0_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C31_C32_B
+#define CM_CUR0_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CUR0_MATRIX_C33_C34_B
+#define CM_CUR0_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B__SHIFT                                               0x0
+#define CM_CUR0_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B__SHIFT                                               0x10
+#define CM_CUR0_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B_MASK                                                 0x0000FFFFL
+#define CM_CUR0_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B_MASK                                                 0xFFFF0000L
+//CM_CUR0_CM_CUR0_TEST_DEBUG_INDEX
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX__SHIFT                                     0x0
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN__SHIFT                                  0x8
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX_MASK                                       0x000000FFL
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN_MASK                                    0x00000100L
+//CM_CUR0_CM_CUR0_TEST_DEBUG_DATA
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA__SHIFT                                       0x0
+#define CM_CUR0_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA_MASK                                         0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dscl_dispdec
+//DSCL0_SCL_COEF_RAM_TAP_SELECT
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX__SHIFT                                       0x0
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE__SHIFT                                              0x8
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE__SHIFT                                        0x10
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX_MASK                                         0x00000003L
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE_MASK                                                0x00003F00L
+#define DSCL0_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE_MASK                                          0x00070000L
+//DSCL0_SCL_COEF_RAM_TAP_DATA
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF__SHIFT                                        0x0
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN__SHIFT                                     0xf
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF__SHIFT                                         0x10
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN__SHIFT                                      0x1f
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_MASK                                          0x00003FFFL
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN_MASK                                       0x00008000L
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_MASK                                           0x3FFF0000L
+#define DSCL0_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN_MASK                                        0x80000000L
+//DSCL0_SCL_MODE
+#define DSCL0_SCL_MODE__DSCL_MODE__SHIFT                                                                      0x0
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT__SHIFT                                                            0x8
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT__SHIFT                                                    0xc
+#define DSCL0_SCL_MODE__SCL_CHROMA_COEF_MODE__SHIFT                                                           0x10
+#define DSCL0_SCL_MODE__SCL_ALPHA_COEF_MODE__SHIFT                                                            0x14
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT_RD__SHIFT                                                         0x18
+#define DSCL0_SCL_MODE__DSCL_MODE_MASK                                                                        0x00000007L
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT_MASK                                                              0x00000100L
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT_MASK                                                      0x00001000L
+#define DSCL0_SCL_MODE__SCL_CHROMA_COEF_MODE_MASK                                                             0x00010000L
+#define DSCL0_SCL_MODE__SCL_ALPHA_COEF_MODE_MASK                                                              0x00100000L
+#define DSCL0_SCL_MODE__SCL_COEF_RAM_SELECT_RD_MASK                                                           0x01000000L
+//DSCL0_SCL_TAP_CONTROL
+#define DSCL0_SCL_TAP_CONTROL__SCL_V_NUM_TAPS__SHIFT                                                          0x0
+#define DSCL0_SCL_TAP_CONTROL__SCL_H_NUM_TAPS__SHIFT                                                          0x4
+#define DSCL0_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C__SHIFT                                                        0x8
+#define DSCL0_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C__SHIFT                                                        0xc
+#define DSCL0_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_MASK                                                            0x00000007L
+#define DSCL0_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_MASK                                                            0x00000070L
+#define DSCL0_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C_MASK                                                          0x00000700L
+#define DSCL0_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C_MASK                                                          0x00007000L
+//DSCL0_DSCL_CONTROL
+#define DSCL0_DSCL_CONTROL__SCL_BOUNDARY_MODE__SHIFT                                                          0x0
+#define DSCL0_DSCL_CONTROL__SCL_BOUNDARY_MODE_MASK                                                            0x00000001L
+//DSCL0_DSCL_2TAP_CONTROL
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x0
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN__SHIFT                                                   0x4
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR__SHIFT                                               0x8
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x10
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN__SHIFT                                                   0x14
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR__SHIFT                                               0x18
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN_MASK                                             0x00000001L
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN_MASK                                                     0x00000010L
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR_MASK                                                 0x00000700L
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN_MASK                                             0x00010000L
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN_MASK                                                     0x00100000L
+#define DSCL0_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR_MASK                                                 0x07000000L
+//DSCL0_SCL_MANUAL_REPLICATE_CONTROL
+#define DSCL0_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR__SHIFT                              0x0
+#define DSCL0_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR__SHIFT                              0x8
+#define DSCL0_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR_MASK                                0x0000000FL
+#define DSCL0_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR_MASK                                0x00000F00L
+//DSCL0_SCL_HORZ_FILTER_SCALE_RATIO
+#define DSCL0_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL0_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL0_SCL_HORZ_FILTER_INIT
+#define DSCL0_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL0_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT__SHIFT                                                     0x18
+#define DSCL0_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL0_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT_MASK                                                       0x0F000000L
+//DSCL0_SCL_HORZ_FILTER_SCALE_RATIO_C
+#define DSCL0_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL0_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL0_SCL_HORZ_FILTER_INIT_C
+#define DSCL0_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL0_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL0_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL0_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL0_SCL_VERT_FILTER_SCALE_RATIO
+#define DSCL0_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL0_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL0_SCL_VERT_FILTER_INIT
+#define DSCL0_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL0_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT__SHIFT                                                     0x18
+#define DSCL0_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL0_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT_MASK                                                       0x0F000000L
+//DSCL0_SCL_VERT_FILTER_SCALE_RATIO_C
+#define DSCL0_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL0_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL0_SCL_VERT_FILTER_INIT_C
+#define DSCL0_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL0_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL0_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL0_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL0_SCL_BLACK_COLOR
+#define DSCL0_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y__SHIFT                                                   0x0
+#define DSCL0_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR__SHIFT                                                    0x10
+#define DSCL0_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y_MASK                                                     0x0000FFFFL
+#define DSCL0_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR_MASK                                                      0xFFFF0000L
+//DSCL0_DSCL_UPDATE
+#define DSCL0_DSCL_UPDATE__SCL_UPDATE_PENDING__SHIFT                                                          0x0
+#define DSCL0_DSCL_UPDATE__SCL_UPDATE_PENDING_MASK                                                            0x00000001L
+//DSCL0_DSCL_AUTOCAL
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_MODE__SHIFT                                                               0x0
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE__SHIFT                                                          0x2
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE__SHIFT                                                           0x8
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_PIPE_ID__SHIFT                                                            0xc
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_MODE_MASK                                                                 0x00000003L
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE_MASK                                                            0x00000004L
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE_MASK                                                             0x00000300L
+#define DSCL0_DSCL_AUTOCAL__AUTOCAL_PIPE_ID_MASK                                                              0x00003000L
+//DSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT
+#define DSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT__SHIFT                                         0x0
+#define DSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT__SHIFT                                          0x10
+#define DSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT_MASK                                           0x00003FFFL
+#define DSCL0_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT_MASK                                            0x3FFF0000L
+//DSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM
+#define DSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM__SHIFT                                        0x0
+#define DSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP__SHIFT                                           0x10
+#define DSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM_MASK                                          0x00003FFFL
+#define DSCL0_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP_MASK                                             0x3FFF0000L
+//DSCL0_OTG_H_BLANK
+#define DSCL0_OTG_H_BLANK__OTG_H_BLANK_START__SHIFT                                                           0x0
+#define DSCL0_OTG_H_BLANK__OTG_H_BLANK_END__SHIFT                                                             0x10
+#define DSCL0_OTG_H_BLANK__OTG_H_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL0_OTG_H_BLANK__OTG_H_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL0_OTG_V_BLANK
+#define DSCL0_OTG_V_BLANK__OTG_V_BLANK_START__SHIFT                                                           0x0
+#define DSCL0_OTG_V_BLANK__OTG_V_BLANK_END__SHIFT                                                             0x10
+#define DSCL0_OTG_V_BLANK__OTG_V_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL0_OTG_V_BLANK__OTG_V_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL0_RECOUT_START
+#define DSCL0_RECOUT_START__RECOUT_START_X__SHIFT                                                             0x0
+#define DSCL0_RECOUT_START__RECOUT_START_Y__SHIFT                                                             0x10
+#define DSCL0_RECOUT_START__RECOUT_START_X_MASK                                                               0x00003FFFL
+#define DSCL0_RECOUT_START__RECOUT_START_Y_MASK                                                               0x3FFF0000L
+//DSCL0_RECOUT_SIZE
+#define DSCL0_RECOUT_SIZE__RECOUT_WIDTH__SHIFT                                                                0x0
+#define DSCL0_RECOUT_SIZE__RECOUT_HEIGHT__SHIFT                                                               0x10
+#define DSCL0_RECOUT_SIZE__RECOUT_WIDTH_MASK                                                                  0x00003FFFL
+#define DSCL0_RECOUT_SIZE__RECOUT_HEIGHT_MASK                                                                 0x3FFF0000L
+//DSCL0_MPC_SIZE
+#define DSCL0_MPC_SIZE__MPC_WIDTH__SHIFT                                                                      0x0
+#define DSCL0_MPC_SIZE__MPC_HEIGHT__SHIFT                                                                     0x10
+#define DSCL0_MPC_SIZE__MPC_WIDTH_MASK                                                                        0x00003FFFL
+#define DSCL0_MPC_SIZE__MPC_HEIGHT_MASK                                                                       0x3FFF0000L
+//DSCL0_LB_DATA_FORMAT
+#define DSCL0_LB_DATA_FORMAT__ALPHA_EN__SHIFT                                                                 0x4
+#define DSCL0_LB_DATA_FORMAT__ALPHA_EN_MASK                                                                   0x00000010L
+//DSCL0_LB_MEMORY_CTRL
+#define DSCL0_LB_MEMORY_CTRL__MEMORY_CONFIG__SHIFT                                                            0x0
+#define DSCL0_LB_MEMORY_CTRL__LB_MAX_PARTITIONS__SHIFT                                                        0x8
+#define DSCL0_LB_MEMORY_CTRL__LB_NUM_PARTITIONS__SHIFT                                                        0x10
+#define DSCL0_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C__SHIFT                                                      0x18
+#define DSCL0_LB_MEMORY_CTRL__MEMORY_CONFIG_MASK                                                              0x00000003L
+#define DSCL0_LB_MEMORY_CTRL__LB_MAX_PARTITIONS_MASK                                                          0x00003F00L
+#define DSCL0_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_MASK                                                          0x007F0000L
+#define DSCL0_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C_MASK                                                        0x7F000000L
+//DSCL0_LB_V_COUNTER
+#define DSCL0_LB_V_COUNTER__V_COUNTER__SHIFT                                                                  0x0
+#define DSCL0_LB_V_COUNTER__V_COUNTER_C__SHIFT                                                                0x10
+#define DSCL0_LB_V_COUNTER__V_COUNTER_MASK                                                                    0x00001FFFL
+#define DSCL0_LB_V_COUNTER__V_COUNTER_C_MASK                                                                  0x1FFF0000L
+//DSCL0_DSCL_MEM_PWR_CTRL
+#define DSCL0_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE__SHIFT                                                     0x0
+#define DSCL0_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS__SHIFT                                                       0x2
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE__SHIFT                                                   0x4
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS__SHIFT                                                     0x6
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE__SHIFT                                                   0x8
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS__SHIFT                                                     0xa
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE__SHIFT                                                   0xc
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS__SHIFT                                                     0xe
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE__SHIFT                                                   0x10
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS__SHIFT                                                     0x12
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE__SHIFT                                                   0x14
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS__SHIFT                                                     0x16
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE__SHIFT                                                   0x18
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS__SHIFT                                                     0x1a
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE__SHIFT                                                       0x1c
+#define DSCL0_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE_MASK                                                       0x00000003L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS_MASK                                                         0x00000004L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE_MASK                                                     0x00000030L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS_MASK                                                       0x00000040L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE_MASK                                                     0x00000300L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS_MASK                                                       0x00000400L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE_MASK                                                     0x00003000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS_MASK                                                       0x00004000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE_MASK                                                     0x00030000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS_MASK                                                       0x00040000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE_MASK                                                     0x00300000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS_MASK                                                       0x00400000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE_MASK                                                     0x03000000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS_MASK                                                       0x04000000L
+#define DSCL0_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE_MASK                                                         0x10000000L
+//DSCL0_DSCL_MEM_PWR_STATUS
+#define DSCL0_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE__SHIFT                                                   0x0
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE__SHIFT                                                 0x2
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE__SHIFT                                                 0x4
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE__SHIFT                                                 0x6
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE__SHIFT                                                 0x8
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE__SHIFT                                                 0xa
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE__SHIFT                                                 0xc
+#define DSCL0_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE_MASK                                                     0x00000003L
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE_MASK                                                   0x0000000CL
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE_MASK                                                   0x00000030L
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE_MASK                                                   0x000000C0L
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE_MASK                                                   0x00000300L
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE_MASK                                                   0x00000C00L
+#define DSCL0_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE_MASK                                                   0x00003000L
+//DSCL0_OBUF_CONTROL
+#define DSCL0_OBUF_CONTROL__OBUF_BYPASS__SHIFT                                                                0x0
+#define DSCL0_OBUF_CONTROL__OBUF_USE_FULL_BUFFER__SHIFT                                                       0x1
+#define DSCL0_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH__SHIFT                                                  0x2
+#define DSCL0_OBUF_CONTROL__OBUF_OUT_HOLD_CNT__SHIFT                                                          0x4
+#define DSCL0_OBUF_CONTROL__OBUF_BYPASS_MASK                                                                  0x00000001L
+#define DSCL0_OBUF_CONTROL__OBUF_USE_FULL_BUFFER_MASK                                                         0x00000002L
+#define DSCL0_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH_MASK                                                    0x00000004L
+#define DSCL0_OBUF_CONTROL__OBUF_OUT_HOLD_CNT_MASK                                                            0x000000F0L
+//DSCL0_OBUF_MEM_PWR_CTRL
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE__SHIFT                                                    0x0
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS__SHIFT                                                      0x2
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE__SHIFT                                                     0x8
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE__SHIFT                                                    0x10
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE_MASK                                                      0x00000003L
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS_MASK                                                        0x00000004L
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE_MASK                                                       0x00000100L
+#define DSCL0_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE_MASK                                                      0x00030000L
+//DSCL0_DSCL_EASF_H_MODE
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_EN__SHIFT                                                          0x0
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_EN_MASK                                                            0x00000001L
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL0_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL0_DSCL_EASF_V_MODE
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_EN__SHIFT                                                          0x0
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_EN_MASK                                                            0x00000001L
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL0_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL0_DSCL_SC_MODE
+#define DSCL0_DSCL_SC_MODE__SCL_SC_MATRIX_MODE__SHIFT                                                         0x0
+#define DSCL0_DSCL_SC_MODE__SCL_SC_LTONL_EN__SHIFT                                                            0x8
+#define DSCL0_DSCL_SC_MODE__SCL_SC_MATRIX_MODE_MASK                                                           0x00000001L
+#define DSCL0_DSCL_SC_MODE__SCL_SC_LTONL_EN_MASK                                                              0x00000100L
+//DSCL0_DSCL_SC_MATRIX_C0C1
+#define DSCL0_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0__SHIFT                                                    0x0
+#define DSCL0_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1__SHIFT                                                    0x10
+#define DSCL0_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0_MASK                                                      0x0000FFFFL
+#define DSCL0_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1_MASK                                                      0xFFFF0000L
+//DSCL0_DSCL_SC_MATRIX_C2C3
+#define DSCL0_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2__SHIFT                                                    0x0
+#define DSCL0_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3__SHIFT                                                    0x10
+#define DSCL0_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2_MASK                                                      0x0000FFFFL
+#define DSCL0_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3_MASK                                                      0xFFFF0000L
+//DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL0_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL0_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT__SHIFT                    0x0
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL__SHIFT                    0x10
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT_MASK                      0x0000FFFFL
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL_MASK                      0xFFFF0000L
+//DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE__SHIFT                     0x0
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE__SHIFT                    0x10
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE_MASK                       0x0000FFFFL
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE_MASK                      0xFFFF0000L
+//DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE__SHIFT                    0x0
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET__SHIFT                   0x10
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE_MASK                      0x0000FFFFL
+#define DSCL0_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET_MASK                     0xFFFF0000L
+//DSCL0_DSCL_EASF_RINGEST_FORCE
+#define DSCL0_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE__SHIFT                                        0x0
+#define DSCL0_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE__SHIFT                                        0x10
+#define DSCL0_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE_MASK                                          0x0000FFFFL
+#define DSCL0_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE_MASK                                          0xFFFF0000L
+//DSCL0_DSCL_EASF_H_BF_CNTL
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN__SHIFT                                                   0x0
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE__SHIFT                                                 0x8
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE__SHIFT                                                 0x10
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN_MASK                                                     0x00000001L
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL0_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA__SHIFT                                         0x0
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB__SHIFT                                         0x8
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA__SHIFT                                         0x10
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB__SHIFT                                         0x18
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA_MASK                                           0x003F0000L
+#define DSCL0_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB_MASK                                           0x3F000000L
+//DSCL0_DSCL_EASF_V_BF_CNTL
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN__SHIFT                                                   0x0
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE__SHIFT                                                 0x8
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE__SHIFT                                                 0x10
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN_MASK                                                     0x00000001L
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL0_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA__SHIFT                                         0x0
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB__SHIFT                                         0x8
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA__SHIFT                                         0x10
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB__SHIFT                                         0x18
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA_MASK                                           0x003F0000L
+#define DSCL0_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB_MASK                                           0x3F000000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG1
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG2
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG3
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG4
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG5
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG6
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_H_BF1_PWL_SEG7
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG1
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG2
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG3
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG4
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG5
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG6
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL0_DSCL_EASF_V_BF1_PWL_SEG7
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL0_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG1
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG2
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG3
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG4
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_H_BF3_PWL_SEG5
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG1
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG2
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG3
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG4
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL0_DSCL_EASF_V_BF3_PWL_SEG5
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL0_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL0_ISHARP_MODE
+#define DSCL0_ISHARP_MODE__ISHARP_EN__SHIFT                                                                   0x0
+#define DSCL0_ISHARP_MODE__ISHARP_NOISEDET_EN__SHIFT                                                          0x4
+#define DSCL0_ISHARP_MODE__ISHARP_NOISEDET_MODE__SHIFT                                                        0x5
+#define DSCL0_ISHARP_MODE__ISHARP_LBA_MODE__SHIFT                                                             0x9
+#define DSCL0_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT__SHIFT                                                     0xa
+#define DSCL0_ISHARP_MODE__ISHARP_FMT_MODE__SHIFT                                                             0xb
+#define DSCL0_ISHARP_MODE__ISHARP_FMT_NORM__SHIFT                                                             0xc
+#define DSCL0_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT__SHIFT                                             0x1c
+#define DSCL0_ISHARP_MODE__ISHARP_EN_MASK                                                                     0x00000001L
+#define DSCL0_ISHARP_MODE__ISHARP_NOISEDET_EN_MASK                                                            0x00000010L
+#define DSCL0_ISHARP_MODE__ISHARP_NOISEDET_MODE_MASK                                                          0x00000060L
+#define DSCL0_ISHARP_MODE__ISHARP_LBA_MODE_MASK                                                               0x00000200L
+#define DSCL0_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_MASK                                                       0x00000400L
+#define DSCL0_ISHARP_MODE__ISHARP_FMT_MODE_MASK                                                               0x00000800L
+#define DSCL0_ISHARP_MODE__ISHARP_FMT_NORM_MASK                                                               0x0FFFF000L
+#define DSCL0_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT_MASK                                               0x10000000L
+//DSCL0_ISHARP_DELTA_CTRL
+#define DSCL0_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT__SHIFT                                          0x0
+#define DSCL0_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT_MASK                                            0x00000001L
+//DSCL0_ISHARP_DELTA_INDEX
+#define DSCL0_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX__SHIFT                                                   0x0
+#define DSCL0_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX_MASK                                                     0x0000001FL
+//DSCL0_ISHARP_DELTA_DATA
+#define DSCL0_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA__SHIFT                                                     0x0
+#define DSCL0_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA_MASK                                                       0xFFFFFFFFL
+//DSCL0_ISHARP_NLDELTA_SOFT_CLIP
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P__SHIFT                                      0x0
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P__SHIFT                                   0x1
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P__SHIFT                                   0x8
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N__SHIFT                                      0x10
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N__SHIFT                                   0x11
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N__SHIFT                                   0x18
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P_MASK                                        0x00000001L
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P_MASK                                     0x000000FEL
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P_MASK                                     0x0000FF00L
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N_MASK                                        0x00010000L
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N_MASK                                     0x00FE0000L
+#define DSCL0_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N_MASK                                     0xFF000000L
+//DSCL0_ISHARP_NOISEDET_THRESHOLD
+#define DSCL0_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE__SHIFT                                         0x0
+#define DSCL0_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE__SHIFT                                         0x10
+#define DSCL0_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE_MASK                                           0x000003FFL
+#define DSCL0_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE_MASK                                           0x03FF0000L
+//DSCL0_ISHARP_NOISE_GAIN_PWL
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN__SHIFT                                      0x0
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN__SHIFT                                        0x8
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE__SHIFT                                         0x10
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN_MASK                                        0x0000001FL
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN_MASK                                          0x00001F00L
+#define DSCL0_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE_MASK                                           0x3FFF0000L
+//DSCL0_ISHARP_LBA_PWL_SEG0
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0__SHIFT                                           0x14
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0_MASK                                              0x0003F000L
+#define DSCL0_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0_MASK                                             0x1FF00000L
+//DSCL0_ISHARP_LBA_PWL_SEG1
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1__SHIFT                                           0x14
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1_MASK                                              0x0003F000L
+#define DSCL0_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1_MASK                                             0x1FF00000L
+//DSCL0_ISHARP_LBA_PWL_SEG2
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2__SHIFT                                           0x14
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2_MASK                                              0x0003F000L
+#define DSCL0_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2_MASK                                             0x1FF00000L
+//DSCL0_ISHARP_LBA_PWL_SEG3
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3__SHIFT                                           0x14
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3_MASK                                              0x0003F000L
+#define DSCL0_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3_MASK                                             0x1FF00000L
+//DSCL0_ISHARP_LBA_PWL_SEG4
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4__SHIFT                                           0x14
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4_MASK                                              0x0003F000L
+#define DSCL0_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4_MASK                                             0x1FF00000L
+//DSCL0_ISHARP_LBA_PWL_SEG5
+#define DSCL0_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5__SHIFT                                              0x0
+#define DSCL0_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5__SHIFT                                            0xc
+#define DSCL0_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5_MASK                                                0x000003FFL
+#define DSCL0_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5_MASK                                              0x0003F000L
+//DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE__SHIFT                            0x0
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS__SHIFT                              0x2
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE__SHIFT                            0x4
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE_MASK                              0x00000003L
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS_MASK                                0x00000004L
+#define DSCL0_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE_MASK                              0x00000030L
+//DSCL0_DSCL_DEBUG
+#define DSCL0_DSCL_DEBUG__SCL_DEBUG__SHIFT                                                                    0x0
+#define DSCL0_DSCL_DEBUG__SCL_DEBUG_MASK                                                                      0xFFFFFFFFL
+//DSCL0_DSCL_TEST_DEBUG_INDEX
+#define DSCL0_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX__SHIFT                                              0x0
+#define DSCL0_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN__SHIFT                                           0x8
+#define DSCL0_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX_MASK                                                0x000000FFL
+#define DSCL0_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN_MASK                                             0x00000100L
+//DSCL0_DSCL_TEST_DEBUG_DATA
+#define DSCL0_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA__SHIFT                                                0x0
+#define DSCL0_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA_MASK                                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp0_dispdec_cm_dispdec
+//CM0_CM_CONTROL
+#define CM0_CM_CONTROL__CM_BYPASS__SHIFT                                                                      0x0
+#define CM0_CM_CONTROL__CM_UPDATE_PENDING__SHIFT                                                              0x8
+#define CM0_CM_CONTROL__CM_BYPASS_MASK                                                                        0x00000001L
+#define CM0_CM_CONTROL__CM_UPDATE_PENDING_MASK                                                                0x00000100L
+//CM0_CM_POST_CSC_CONTROL
+#define CM0_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE__SHIFT                                                      0x0
+#define CM0_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT__SHIFT                                              0x2
+#define CM0_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_MASK                                                        0x00000003L
+#define CM0_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT_MASK                                                0x0000000CL
+//CM0_CM_POST_CSC_C11_C12
+#define CM0_CM_POST_CSC_C11_C12__CM_POST_CSC_C11__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C11_C12__CM_POST_CSC_C12__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C11_C12__CM_POST_CSC_C11_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C11_C12__CM_POST_CSC_C12_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_C13_C14
+#define CM0_CM_POST_CSC_C13_C14__CM_POST_CSC_C13__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C13_C14__CM_POST_CSC_C14__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C13_C14__CM_POST_CSC_C13_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C13_C14__CM_POST_CSC_C14_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_C21_C22
+#define CM0_CM_POST_CSC_C21_C22__CM_POST_CSC_C21__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C21_C22__CM_POST_CSC_C22__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C21_C22__CM_POST_CSC_C21_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C21_C22__CM_POST_CSC_C22_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_C23_C24
+#define CM0_CM_POST_CSC_C23_C24__CM_POST_CSC_C23__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C23_C24__CM_POST_CSC_C24__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C23_C24__CM_POST_CSC_C23_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C23_C24__CM_POST_CSC_C24_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_C31_C32
+#define CM0_CM_POST_CSC_C31_C32__CM_POST_CSC_C31__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C31_C32__CM_POST_CSC_C32__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C31_C32__CM_POST_CSC_C31_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C31_C32__CM_POST_CSC_C32_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_C33_C34
+#define CM0_CM_POST_CSC_C33_C34__CM_POST_CSC_C33__SHIFT                                                       0x0
+#define CM0_CM_POST_CSC_C33_C34__CM_POST_CSC_C34__SHIFT                                                       0x10
+#define CM0_CM_POST_CSC_C33_C34__CM_POST_CSC_C33_MASK                                                         0x0000FFFFL
+#define CM0_CM_POST_CSC_C33_C34__CM_POST_CSC_C34_MASK                                                         0xFFFF0000L
+//CM0_CM_POST_CSC_B_C11_C12
+#define CM0_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12_MASK                                                     0xFFFF0000L
+//CM0_CM_POST_CSC_B_C13_C14
+#define CM0_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14_MASK                                                     0xFFFF0000L
+//CM0_CM_POST_CSC_B_C21_C22
+#define CM0_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22_MASK                                                     0xFFFF0000L
+//CM0_CM_POST_CSC_B_C23_C24
+#define CM0_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24_MASK                                                     0xFFFF0000L
+//CM0_CM_POST_CSC_B_C31_C32
+#define CM0_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32_MASK                                                     0xFFFF0000L
+//CM0_CM_POST_CSC_B_C33_C34
+#define CM0_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33__SHIFT                                                   0x0
+#define CM0_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34__SHIFT                                                   0x10
+#define CM0_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33_MASK                                                     0x0000FFFFL
+#define CM0_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34_MASK                                                     0xFFFF0000L
+//CM0_CM_BIAS_CR_R
+#define CM0_CM_BIAS_CR_R__CM_BIAS_CR_R__SHIFT                                                                 0x0
+#define CM0_CM_BIAS_CR_R__CM_BIAS_CR_R_MASK                                                                   0x0000FFFFL
+//CM0_CM_BIAS_Y_G_CB_B
+#define CM0_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G__SHIFT                                                              0x0
+#define CM0_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B__SHIFT                                                             0x10
+#define CM0_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G_MASK                                                                0x0000FFFFL
+#define CM0_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B_MASK                                                               0xFFFF0000L
+//CM0_CM_GAMCOR_CONTROL
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE__SHIFT                                                          0x0
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT__SHIFT                                                        0x2
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE__SHIFT                                                   0x3
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT__SHIFT                                                  0x4
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT__SHIFT                                                0x6
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_MASK                                                            0x00000003L
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_MASK                                                          0x00000004L
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE_MASK                                                     0x00000008L
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT_MASK                                                    0x00000030L
+#define CM0_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT_MASK                                                  0x00000040L
+//CM0_CM_GAMCOR_LUT_INDEX
+#define CM0_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX__SHIFT                                                   0x0
+#define CM0_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX_MASK                                                     0x000001FFL
+//CM0_CM_GAMCOR_LUT_DATA
+#define CM0_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA__SHIFT                                                     0x0
+#define CM0_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA_MASK                                                       0x0003FFFFL
+//CM0_CM_GAMCOR_LUT_CONTROL
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK__SHIFT                                      0x0
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL__SHIFT                                        0x3
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG__SHIFT                                              0x5
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL__SHIFT                                              0x6
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK_MASK                                        0x00000007L
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL_MASK                                          0x00000018L
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG_MASK                                                0x00000020L
+#define CM0_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL_MASK                                                0x00000040L
+//CM0_CM_GAMCOR_RAMA_START_CNTL_B
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMA_START_CNTL_G
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMA_START_CNTL_R
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_B
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_G
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_R
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_END_CNTL1_B
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_END_CNTL2_B
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMA_END_CNTL1_G
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_END_CNTL2_G
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMA_END_CNTL1_R
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMA_END_CNTL2_R
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMA_OFFSET_B
+#define CM0_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMA_OFFSET_G
+#define CM0_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMA_OFFSET_R
+#define CM0_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMA_REGION_0_1
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_2_3
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_4_5
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_6_7
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_8_9
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_10_11
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_12_13
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_14_15
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_16_17
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_18_19
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_20_21
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_22_23
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_24_25
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_26_27
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_28_29
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_30_31
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMA_REGION_32_33
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_START_CNTL_B
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMB_START_CNTL_G
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMB_START_CNTL_R
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R__SHIFT                             0x0
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM0_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM0_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_B
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_G
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_R
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM0_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_END_CNTL1_B
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_END_CNTL2_B
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMB_END_CNTL1_G
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_END_CNTL2_G
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMB_END_CNTL1_R
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM0_CM_GAMCOR_RAMB_END_CNTL2_R
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R__SHIFT                                0x0
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM0_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM0_CM_GAMCOR_RAMB_OFFSET_B
+#define CM0_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMB_OFFSET_G
+#define CM0_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMB_OFFSET_R
+#define CM0_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R__SHIFT                                           0x0
+#define CM0_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R_MASK                                             0x0007FFFFL
+//CM0_CM_GAMCOR_RAMB_REGION_0_1
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_2_3
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_4_5
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_6_7
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_8_9
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_10_11
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_12_13
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_14_15
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_16_17
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_18_19
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_20_21
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_22_23
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_24_25
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_26_27
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_28_29
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_30_31
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_GAMCOR_RAMB_REGION_32_33
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM0_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM0_CM_HDR_MULT_COEF
+#define CM0_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF__SHIFT                                                         0x0
+#define CM0_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF_MASK                                                           0x0007FFFFL
+//CM0_CM_MEM_PWR_CTRL
+#define CM0_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE__SHIFT                                                      0x0
+#define CM0_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS__SHIFT                                                        0x2
+#define CM0_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE__SHIFT                                                        0x8
+#define CM0_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS__SHIFT                                                          0x9
+#define CM0_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE_MASK                                                        0x00000003L
+#define CM0_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS_MASK                                                          0x00000004L
+#define CM0_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE_MASK                                                          0x00000100L
+#define CM0_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS_MASK                                                            0x00000200L
+//CM0_CM_MEM_PWR_STATUS
+#define CM0_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE__SHIFT                                                    0x0
+#define CM0_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE__SHIFT                                                      0x8
+#define CM0_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE_MASK                                                      0x00000003L
+#define CM0_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE_MASK                                                        0x00000100L
+//CM0_CM_DEALPHA
+#define CM0_CM_DEALPHA__CM_DEALPHA_EN__SHIFT                                                                  0x0
+#define CM0_CM_DEALPHA__CM_DEALPHA_ABLND__SHIFT                                                               0x1
+#define CM0_CM_DEALPHA__CM_DEALPHA_EN_MASK                                                                    0x00000001L
+#define CM0_CM_DEALPHA__CM_DEALPHA_ABLND_MASK                                                                 0x00000002L
+//CM0_CM_COEF_FORMAT
+#define CM0_CM_COEF_FORMAT__CM_BIAS_FORMAT__SHIFT                                                             0x0
+#define CM0_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT__SHIFT                                                    0x4
+#define CM0_CM_COEF_FORMAT__CM_BIAS_FORMAT_MASK                                                               0x00000001L
+#define CM0_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT_MASK                                                      0x00000010L
+//CM0_CM_TEST_DEBUG_INDEX
+#define CM0_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX__SHIFT                                                   0x0
+#define CM0_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN__SHIFT                                                0x8
+#define CM0_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX_MASK                                                     0x000000FFL
+#define CM0_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN_MASK                                                  0x00000100L
+//CM0_CM_TEST_DEBUG_DATA
+#define CM0_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define CM0_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//CM0_CM_HIST_CNTL
+#define CM0_CM_HIST_CNTL__CM_HIST_SEL__SHIFT                                                                  0x0
+#define CM0_CM_HIST_CNTL__CM_HIST_CH_EN__SHIFT                                                                0x2
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC1_SEL__SHIFT                                                             0x4
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC2_SEL__SHIFT                                                             0x5
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC3_SEL__SHIFT                                                             0x6
+#define CM0_CM_HIST_CNTL__CM_HIST_CH1_XBAR__SHIFT                                                             0x7
+#define CM0_CM_HIST_CNTL__CM_HIST_CH2_XBAR__SHIFT                                                             0x9
+#define CM0_CM_HIST_CNTL__CM_HIST_CH3_XBAR__SHIFT                                                             0xb
+#define CM0_CM_HIST_CNTL__CM_HIST_FORMAT__SHIFT                                                               0xd
+#define CM0_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK__SHIFT                                                    0xf
+#define CM0_CM_HIST_CNTL__CM_HIST_SEL_MASK                                                                    0x00000003L
+#define CM0_CM_HIST_CNTL__CM_HIST_CH_EN_MASK                                                                  0x0000000CL
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC1_SEL_MASK                                                               0x00000010L
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC2_SEL_MASK                                                               0x00000020L
+#define CM0_CM_HIST_CNTL__CM_HIST_SRC3_SEL_MASK                                                               0x00000040L
+#define CM0_CM_HIST_CNTL__CM_HIST_CH1_XBAR_MASK                                                               0x00000180L
+#define CM0_CM_HIST_CNTL__CM_HIST_CH2_XBAR_MASK                                                               0x00000600L
+#define CM0_CM_HIST_CNTL__CM_HIST_CH3_XBAR_MASK                                                               0x00001800L
+#define CM0_CM_HIST_CNTL__CM_HIST_FORMAT_MASK                                                                 0x00006000L
+#define CM0_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK_MASK                                                      0x00038000L
+//CM0_CM_HIST_SCALE_SRC1
+#define CM0_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1__SHIFT                                                     0x0
+#define CM0_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1_MASK                                                       0x0007FFFFL
+//CM0_CM_HIST_COEFA_SRC2
+#define CM0_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2__SHIFT                                                     0x0
+#define CM0_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2_MASK                                                       0x0007FFFFL
+//CM0_CM_HIST_COEFB_SRC2
+#define CM0_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2__SHIFT                                                     0x0
+#define CM0_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2_MASK                                                       0x0007FFFFL
+//CM0_CM_HIST_COEFC_SRC2
+#define CM0_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2__SHIFT                                                     0x0
+#define CM0_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2_MASK                                                       0x0007FFFFL
+//CM0_CM_HIST_SCALE_SRC3
+#define CM0_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3__SHIFT                                                     0x0
+#define CM0_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3_MASK                                                       0x0007FFFFL
+//CM0_CM_HIST_BIAS_SRC1
+#define CM0_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1__SHIFT                                                       0x0
+#define CM0_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1_MASK                                                         0x0007FFFFL
+//CM0_CM_HIST_BIAS_SRC2
+#define CM0_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2__SHIFT                                                       0x0
+#define CM0_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2_MASK                                                         0x0007FFFFL
+//CM0_CM_HIST_BIAS_SRC3
+#define CM0_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3__SHIFT                                                       0x0
+#define CM0_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3_MASK                                                         0x0007FFFFL
+//CM0_CM_HIST_LOCK
+#define CM0_CM_HIST_LOCK__CM_HIST_LOCK__SHIFT                                                                 0x0
+#define CM0_CM_HIST_LOCK__CM_HIST_LOCK_MASK                                                                   0x00000001L
+//CM0_CM_HIST_INDEX
+#define CM0_CM_HIST_INDEX__CM_HIST_INDEX__SHIFT                                                               0x0
+#define CM0_CM_HIST_INDEX__CM_HIST_INDEX_MASK                                                                 0x000000FFL
+//CM0_CM_HIST_DATA
+#define CM0_CM_HIST_DATA__CM_HIST_DATA__SHIFT                                                                 0x0
+#define CM0_CM_HIST_DATA__CM_HIST_DATA_MASK                                                                   0x01FFFFFFL
+//CM0_CM_HIST_STATUS
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS__SHIFT                                                    0x0
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS__SHIFT                                                    0x1
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT__SHIFT                                                 0x2
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ__SHIFT                                                    0x3
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED__SHIFT                                              0x4
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT__SHIFT                                      0x5
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT__SHIFT                                          0x6
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED__SHIFT                                            0xc
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0xd
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED__SHIFT                                            0x10
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0x11
+#define CM0_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW__SHIFT                                                     0x18
+#define CM0_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT__SHIFT                                             0x19
+#define CM0_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE__SHIFT                                                 0x1a
+#define CM0_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT__SHIFT                                         0x1b
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS_MASK                                                      0x00000001L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS_MASK                                                      0x00000002L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT_MASK                                                   0x00000004L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ_MASK                                                      0x00000008L
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_MASK                                                0x00000010L
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT_MASK                                        0x00000020L
+#define CM0_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT_MASK                                            0x000001C0L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_MASK                                              0x00001000L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00002000L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_MASK                                              0x00010000L
+#define CM0_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00020000L
+#define CM0_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_MASK                                                       0x01000000L
+#define CM0_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT_MASK                                               0x02000000L
+#define CM0_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_MASK                                                   0x04000000L
+#define CM0_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT_MASK                                           0x08000000L
+//CM0_CM_HIST_INT_CONTROL
+#define CM0_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT__SHIFT                                                       0x0
+#define CM0_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN__SHIFT                                                    0x4
+#define CM0_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_MASK                                                         0x00000001L
+#define CM0_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN_MASK                                                      0x00000010L
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dpp_top_dispdec
+//DPP_TOP0_DPP_CONTROL
+#define DPP_TOP0_DPP_CONTROL__DPP_CLOCK_ENABLE__SHIFT                                                         0x4
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_GATE_DISABLE__SHIFT                                                    0x8
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE__SHIFT                                                0xa
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE__SHIFT                                               0xc
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE__SHIFT                                               0xd
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_R_GATE_DISABLE__SHIFT                                                    0xe
+#define DPP_TOP0_DPP_CONTROL__DISPCLK_R_GATE_DISABLE__SHIFT                                                   0x10
+#define DPP_TOP0_DPP_CONTROL__DISPCLK_G_GATE_DISABLE__SHIFT                                                   0x12
+#define DPP_TOP0_DPP_CONTROL__DPP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define DPP_TOP0_DPP_CONTROL__DPP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define DPP_TOP0_DPP_CONTROL__DPP_CLOCK_ENABLE_MASK                                                           0x00000010L
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_GATE_DISABLE_MASK                                                      0x00000100L
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE_MASK                                                  0x00000400L
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE_MASK                                                 0x00001000L
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE_MASK                                                 0x00002000L
+#define DPP_TOP0_DPP_CONTROL__DPPCLK_R_GATE_DISABLE_MASK                                                      0x00004000L
+#define DPP_TOP0_DPP_CONTROL__DISPCLK_R_GATE_DISABLE_MASK                                                     0x00010000L
+#define DPP_TOP0_DPP_CONTROL__DISPCLK_G_GATE_DISABLE_MASK                                                     0x00040000L
+#define DPP_TOP0_DPP_CONTROL__DPP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define DPP_TOP0_DPP_CONTROL__DPP_TEST_CLK_SEL_MASK                                                           0x70000000L
+//DPP_TOP0_DPP_SOFT_RESET
+#define DPP_TOP0_DPP_SOFT_RESET__CNVC_SOFT_RESET__SHIFT                                                       0x0
+#define DPP_TOP0_DPP_SOFT_RESET__DSCL_SOFT_RESET__SHIFT                                                       0x4
+#define DPP_TOP0_DPP_SOFT_RESET__CM_SOFT_RESET__SHIFT                                                         0x8
+#define DPP_TOP0_DPP_SOFT_RESET__OBUF_SOFT_RESET__SHIFT                                                       0xc
+#define DPP_TOP0_DPP_SOFT_RESET__HIST_SOFT_RESET__SHIFT                                                       0x10
+#define DPP_TOP0_DPP_SOFT_RESET__CNVC_SOFT_RESET_MASK                                                         0x00000001L
+#define DPP_TOP0_DPP_SOFT_RESET__DSCL_SOFT_RESET_MASK                                                         0x00000010L
+#define DPP_TOP0_DPP_SOFT_RESET__CM_SOFT_RESET_MASK                                                           0x00000100L
+#define DPP_TOP0_DPP_SOFT_RESET__OBUF_SOFT_RESET_MASK                                                         0x00001000L
+#define DPP_TOP0_DPP_SOFT_RESET__HIST_SOFT_RESET_MASK                                                         0x00010000L
+//DPP_TOP0_DPP_CRC_VAL_R
+#define DPP_TOP0_DPP_CRC_VAL_R__DPP_CRC_R_CR__SHIFT                                                           0x0
+#define DPP_TOP0_DPP_CRC_VAL_R__DPP_CRC_R_CR_MASK                                                             0xFFFFFFFFL
+//DPP_TOP0_DPP_CRC_VAL_G
+#define DPP_TOP0_DPP_CRC_VAL_G__DPP_CRC_G_Y__SHIFT                                                            0x0
+#define DPP_TOP0_DPP_CRC_VAL_G__DPP_CRC_G_Y_MASK                                                              0xFFFFFFFFL
+//DPP_TOP0_DPP_CRC_VAL_B
+#define DPP_TOP0_DPP_CRC_VAL_B__DPP_CRC_B_CB__SHIFT                                                           0x0
+#define DPP_TOP0_DPP_CRC_VAL_B__DPP_CRC_B_CB_MASK                                                             0xFFFFFFFFL
+//DPP_TOP0_DPP_CRC_VAL_A
+#define DPP_TOP0_DPP_CRC_VAL_A__DPP_CRC_ALPHA__SHIFT                                                          0x0
+#define DPP_TOP0_DPP_CRC_VAL_A__DPP_CRC_ALPHA_MASK                                                            0xFFFFFFFFL
+//DPP_TOP0_DPP_CRC_CTRL
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_EN__SHIFT                                                              0x0
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_CONT_EN__SHIFT                                                         0x1
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING__SHIFT                                                0x2
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL__SHIFT                                                    0x3
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_SRC_SEL__SHIFT                                                         0x4
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_STEREO_EN__SHIFT                                                       0x6
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE__SHIFT                                                     0x7
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL__SHIFT                                                  0xb
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_MASK__SHIFT                                                            0x10
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_EN_MASK                                                                0x00000001L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_CONT_EN_MASK                                                           0x00000002L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING_MASK                                                  0x00000004L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL_MASK                                                      0x00000008L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_SRC_SEL_MASK                                                           0x00000030L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_STEREO_EN_MASK                                                         0x00000040L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE_MASK                                                       0x00000180L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL_MASK                                                    0x00003800L
+#define DPP_TOP0_DPP_CRC_CTRL__DPP_CRC_MASK_MASK                                                              0xFFFF0000L
+//DPP_TOP0_HOST_READ_CONTROL
+#define DPP_TOP0_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL__SHIFT                                             0x0
+#define DPP_TOP0_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL_MASK                                               0x000000FFL
+//DPP_TOP0_DPP_DEBUG_SEL
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL__SHIFT                                               0x0
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL__SHIFT                                              0x8
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DBG_EN__SHIFT                                                             0x1f
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL_MASK                                                 0x00000007L
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL_MASK                                                0x00000700L
+#define DPP_TOP0_DPP_DEBUG_SEL__DPP_DBG_EN_MASK                                                               0x80000000L
+//DPP_TOP0_DPP_DEBUG_SPARE
+#define DPP_TOP0_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE__SHIFT                                                      0x0
+#define DPP_TOP0_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE_MASK                                                        0xFFFFFFFFL
+//DPP_TOP0_DPP_TEST_DEBUG_INDEX
+#define DPP_TOP0_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX__SHIFT                                            0x0
+#define DPP_TOP0_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN__SHIFT                                         0x8
+#define DPP_TOP0_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX_MASK                                              0x000000FFL
+#define DPP_TOP0_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN_MASK                                           0x00000100L
+//DPP_TOP0_DPP_TEST_DEBUG_DATA
+#define DPP_TOP0_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA__SHIFT                                              0x0
+#define DPP_TOP0_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA_MASK                                                0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp0_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON10_PERFCOUNTER_CNTL
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON10_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON10_PERFCOUNTER_CNTL2
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON10_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON10_PERFCOUNTER_STATE
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON10_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON10_PERFMON_CNTL
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON10_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON10_PERFMON_CNTL2
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON10_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON10_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON10_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON10_PERFMON_CVALUE_LOW
+#define DC_PERFMON10_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON10_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON10_PERFMON_HI
+#define DC_PERFMON10_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON10_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON10_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON10_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON10_PERFMON_LOW
+#define DC_PERFMON10_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON10_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON10_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON10_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON10_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cnvc_cfg_dispdec
+//CNVC_CFG1_CNVC_SURFACE_PIXEL_FORMAT
+#define CNVC_CFG1_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT__SHIFT                                 0x0
+#define CNVC_CFG1_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT_MASK                                   0x0000007FL
+//CNVC_CFG1_FORMAT_CONTROL
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_EXPANSION_MODE__SHIFT                                                0x0
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CNV16__SHIFT                                                         0x4
+#define CNVC_CFG1_FORMAT_CONTROL__ALPHA_EN__SHIFT                                                             0x8
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_BYPASS__SHIFT                                                          0xc
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN__SHIFT                                                0xd
+#define CNVC_CFG1_FORMAT_CONTROL__CLAMP_POSITIVE__SHIFT                                                       0x10
+#define CNVC_CFG1_FORMAT_CONTROL__CLAMP_POSITIVE_C__SHIFT                                                     0x11
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_UPDATE_PENDING__SHIFT                                                  0x14
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_R__SHIFT                                                    0x18
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_G__SHIFT                                                    0x1a
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_B__SHIFT                                                    0x1c
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_EXPANSION_MODE_MASK                                                  0x00000001L
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CNV16_MASK                                                           0x00000010L
+#define CNVC_CFG1_FORMAT_CONTROL__ALPHA_EN_MASK                                                               0x00000100L
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_BYPASS_MASK                                                            0x00001000L
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN_MASK                                                  0x00002000L
+#define CNVC_CFG1_FORMAT_CONTROL__CLAMP_POSITIVE_MASK                                                         0x00010000L
+#define CNVC_CFG1_FORMAT_CONTROL__CLAMP_POSITIVE_C_MASK                                                       0x00020000L
+#define CNVC_CFG1_FORMAT_CONTROL__CNVC_UPDATE_PENDING_MASK                                                    0x00100000L
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_R_MASK                                                      0x03000000L
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_G_MASK                                                      0x0C000000L
+#define CNVC_CFG1_FORMAT_CONTROL__FORMAT_CROSSBAR_B_MASK                                                      0x30000000L
+//CNVC_CFG1_FCNV_FP_BIAS_R
+#define CNVC_CFG1_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R__SHIFT                                                       0x0
+#define CNVC_CFG1_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R_MASK                                                         0x0007FFFFL
+//CNVC_CFG1_FCNV_FP_BIAS_G
+#define CNVC_CFG1_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G__SHIFT                                                       0x0
+#define CNVC_CFG1_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G_MASK                                                         0x0007FFFFL
+//CNVC_CFG1_FCNV_FP_BIAS_B
+#define CNVC_CFG1_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B__SHIFT                                                       0x0
+#define CNVC_CFG1_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B_MASK                                                         0x0007FFFFL
+//CNVC_CFG1_FCNV_FP_SCALE_R
+#define CNVC_CFG1_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R__SHIFT                                                     0x0
+#define CNVC_CFG1_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R_MASK                                                       0x0007FFFFL
+//CNVC_CFG1_FCNV_FP_SCALE_G
+#define CNVC_CFG1_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G__SHIFT                                                     0x0
+#define CNVC_CFG1_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G_MASK                                                       0x0007FFFFL
+//CNVC_CFG1_FCNV_FP_SCALE_B
+#define CNVC_CFG1_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B__SHIFT                                                     0x0
+#define CNVC_CFG1_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B_MASK                                                       0x0007FFFFL
+//CNVC_CFG1_COLOR_KEYER_CONTROL
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__COLOR_KEYER_EN__SHIFT                                                  0x0
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__LUMA_KEYER_EN__SHIFT                                                   0x1
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE__SHIFT                                                0x4
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__COLOR_KEYER_EN_MASK                                                    0x00000001L
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__LUMA_KEYER_EN_MASK                                                     0x00000002L
+#define CNVC_CFG1_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE_MASK                                                  0x00000030L
+//CNVC_CFG1_COLOR_KEYER_ALPHA
+#define CNVC_CFG1_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW__SHIFT                                             0x0
+#define CNVC_CFG1_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH__SHIFT                                            0x10
+#define CNVC_CFG1_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG1_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG1_COLOR_KEYER_RED
+#define CNVC_CFG1_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW__SHIFT                                                 0x0
+#define CNVC_CFG1_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH__SHIFT                                                0x10
+#define CNVC_CFG1_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW_MASK                                                   0x0000FFFFL
+#define CNVC_CFG1_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH_MASK                                                  0xFFFF0000L
+//CNVC_CFG1_COLOR_KEYER_GREEN
+#define CNVC_CFG1_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW__SHIFT                                             0x0
+#define CNVC_CFG1_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH__SHIFT                                            0x10
+#define CNVC_CFG1_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG1_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG1_COLOR_KEYER_BLUE
+#define CNVC_CFG1_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW__SHIFT                                               0x0
+#define CNVC_CFG1_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH__SHIFT                                              0x10
+#define CNVC_CFG1_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW_MASK                                                 0x0000FFFFL
+#define CNVC_CFG1_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH_MASK                                                0xFFFF0000L
+//CNVC_CFG1_ALPHA_2BIT_LUT01
+#define CNVC_CFG1_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0__SHIFT                                                    0x0
+#define CNVC_CFG1_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1__SHIFT                                                    0x10
+#define CNVC_CFG1_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0_MASK                                                      0x00000FFFL
+#define CNVC_CFG1_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1_MASK                                                      0x0FFF0000L
+//CNVC_CFG1_ALPHA_2BIT_LUT23
+#define CNVC_CFG1_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2__SHIFT                                                    0x0
+#define CNVC_CFG1_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3__SHIFT                                                    0x10
+#define CNVC_CFG1_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2_MASK                                                      0x00000FFFL
+#define CNVC_CFG1_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3_MASK                                                      0x0FFF0000L
+//CNVC_CFG1_PRE_DEALPHA
+#define CNVC_CFG1_PRE_DEALPHA__PRE_DEALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG1_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG1_PRE_DEALPHA__PRE_DEALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG1_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG1_PRE_CSC_MODE
+#define CNVC_CFG1_PRE_CSC_MODE__PRE_CSC_MODE__SHIFT                                                           0x0
+#define CNVC_CFG1_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT__SHIFT                                                   0x2
+#define CNVC_CFG1_PRE_CSC_MODE__PRE_CSC_MODE_MASK                                                             0x00000003L
+#define CNVC_CFG1_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT_MASK                                                     0x0000000CL
+//CNVC_CFG1_PRE_CSC_C11_C12
+#define CNVC_CFG1_PRE_CSC_C11_C12__PRE_CSC_C11__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C11_C12__PRE_CSC_C12__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C11_C12__PRE_CSC_C11_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C11_C12__PRE_CSC_C12_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_C13_C14
+#define CNVC_CFG1_PRE_CSC_C13_C14__PRE_CSC_C13__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C13_C14__PRE_CSC_C14__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C13_C14__PRE_CSC_C13_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C13_C14__PRE_CSC_C14_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_C21_C22
+#define CNVC_CFG1_PRE_CSC_C21_C22__PRE_CSC_C21__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C21_C22__PRE_CSC_C22__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C21_C22__PRE_CSC_C21_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C21_C22__PRE_CSC_C22_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_C23_C24
+#define CNVC_CFG1_PRE_CSC_C23_C24__PRE_CSC_C23__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C23_C24__PRE_CSC_C24__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C23_C24__PRE_CSC_C23_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C23_C24__PRE_CSC_C24_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_C31_C32
+#define CNVC_CFG1_PRE_CSC_C31_C32__PRE_CSC_C31__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C31_C32__PRE_CSC_C32__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C31_C32__PRE_CSC_C31_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C31_C32__PRE_CSC_C32_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_C33_C34
+#define CNVC_CFG1_PRE_CSC_C33_C34__PRE_CSC_C33__SHIFT                                                         0x0
+#define CNVC_CFG1_PRE_CSC_C33_C34__PRE_CSC_C34__SHIFT                                                         0x10
+#define CNVC_CFG1_PRE_CSC_C33_C34__PRE_CSC_C33_MASK                                                           0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_C33_C34__PRE_CSC_C34_MASK                                                           0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C11_C12
+#define CNVC_CFG1_PRE_CSC_B_C11_C12__PRE_CSC_B_C11__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C11_C12__PRE_CSC_B_C12__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C11_C12__PRE_CSC_B_C11_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C11_C12__PRE_CSC_B_C12_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C13_C14
+#define CNVC_CFG1_PRE_CSC_B_C13_C14__PRE_CSC_B_C13__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C13_C14__PRE_CSC_B_C14__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C13_C14__PRE_CSC_B_C13_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C13_C14__PRE_CSC_B_C14_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C21_C22
+#define CNVC_CFG1_PRE_CSC_B_C21_C22__PRE_CSC_B_C21__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C21_C22__PRE_CSC_B_C22__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C21_C22__PRE_CSC_B_C21_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C21_C22__PRE_CSC_B_C22_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C23_C24
+#define CNVC_CFG1_PRE_CSC_B_C23_C24__PRE_CSC_B_C23__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C23_C24__PRE_CSC_B_C24__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C23_C24__PRE_CSC_B_C23_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C23_C24__PRE_CSC_B_C24_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C31_C32
+#define CNVC_CFG1_PRE_CSC_B_C31_C32__PRE_CSC_B_C31__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C31_C32__PRE_CSC_B_C32__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C31_C32__PRE_CSC_B_C31_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C31_C32__PRE_CSC_B_C32_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_PRE_CSC_B_C33_C34
+#define CNVC_CFG1_PRE_CSC_B_C33_C34__PRE_CSC_B_C33__SHIFT                                                     0x0
+#define CNVC_CFG1_PRE_CSC_B_C33_C34__PRE_CSC_B_C34__SHIFT                                                     0x10
+#define CNVC_CFG1_PRE_CSC_B_C33_C34__PRE_CSC_B_C33_MASK                                                       0x0000FFFFL
+#define CNVC_CFG1_PRE_CSC_B_C33_C34__PRE_CSC_B_C34_MASK                                                       0xFFFF0000L
+//CNVC_CFG1_CNVC_COEF_FORMAT
+#define CNVC_CFG1_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT__SHIFT                                                0x0
+#define CNVC_CFG1_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT_MASK                                                  0x00000001L
+//CNVC_CFG1_PRE_GAM
+#define CNVC_CFG1_PRE_GAM__PRE_GAM_MODE__SHIFT                                                                0x0
+#define CNVC_CFG1_PRE_GAM__PRE_DEGAM_SELECT__SHIFT                                                            0x4
+#define CNVC_CFG1_PRE_GAM__PRE_REGAM_SELECT__SHIFT                                                            0x7
+#define CNVC_CFG1_PRE_GAM__PRE_GAM_MODE_MASK                                                                  0x00000003L
+#define CNVC_CFG1_PRE_GAM__PRE_DEGAM_SELECT_MASK                                                              0x00000070L
+#define CNVC_CFG1_PRE_GAM__PRE_REGAM_SELECT_MASK                                                              0x00000080L
+//CNVC_CFG1_PRE_REALPHA
+#define CNVC_CFG1_PRE_REALPHA__PRE_REALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG1_PRE_REALPHA__PRE_REALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG1_PRE_REALPHA__PRE_REALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG1_PRE_REALPHA__PRE_REALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG1_PIX_DROP_CNTL
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_DROP_EN__SHIFT                                                           0x0
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_LUMA_DROP__SHIFT                                                         0x4
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_CHROMA_DROP__SHIFT                                                       0x8
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_DROP_EN_MASK                                                             0x00000001L
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_LUMA_DROP_MASK                                                           0x000000F0L
+#define CNVC_CFG1_PIX_DROP_CNTL__PIX_CHROMA_DROP_MASK                                                         0x00000F00L
+//CNVC_CFG1_PIX_DROP_OUT
+#define CNVC_CFG1_PIX_DROP_OUT__PIX_DROP_OUT_L__SHIFT                                                         0x0
+#define CNVC_CFG1_PIX_DROP_OUT__PIX_DROP_OUT_C__SHIFT                                                         0x10
+#define CNVC_CFG1_PIX_DROP_OUT__PIX_DROP_OUT_L_MASK                                                           0x00003FFFL
+#define CNVC_CFG1_PIX_DROP_OUT__PIX_DROP_OUT_C_MASK                                                           0x3FFF0000L
+//CNVC_CFG1_CNVC_UPSP_MODE
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_MODE__SHIFT                                                            0x0
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE__SHIFT                                                   0x2
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS__SHIFT                                                      0x4
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_INIT_INT__SHIFT                                                      0x8
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC__SHIFT                                                     0xc
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS__SHIFT                                                      0x10
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_INIT_INT__SHIFT                                                      0x14
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC__SHIFT                                                     0x18
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_MODE_MASK                                                              0x00000003L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE_MASK                                                     0x00000004L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS_MASK                                                        0x00000010L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_INIT_INT_MASK                                                        0x00000700L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC_MASK                                                       0x00001000L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS_MASK                                                        0x00010000L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_INIT_INT_MASK                                                        0x00700000L
+#define CNVC_CFG1_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC_MASK                                                       0x01000000L
+//CNVC_CFG1_CNVC_UPSP_V_COEF_P0
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG1_CNVC_UPSP_V_COEF_P1
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG1_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG1_CNVC_UPSP_H_COEF_P0
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG1_CNVC_UPSP_H_COEF_P1
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG1_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG1_CNVC_UPSP_CLAMP
+#define CNVC_CFG1_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX__SHIFT                                                      0x0
+#define CNVC_CFG1_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN__SHIFT                                                      0x10
+#define CNVC_CFG1_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX_MASK                                                        0x00000FFFL
+#define CNVC_CFG1_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN_MASK                                                        0x0FFF0000L
+//CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE__SHIFT                                           0x0
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS__SHIFT                                             0x2
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE__SHIFT                                           0x10
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE_MASK                                             0x00000003L
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS_MASK                                               0x00000004L
+#define CNVC_CFG1_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE_MASK                                             0x00030000L
+//CNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//CNVC_CFG1_CNVC_CFG_TEST_DEBUG_DATA
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define CNVC_CFG1_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cm_cur_dispdec
+//CM_CUR1_CURSOR0_CONTROL
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_ENABLE__SHIFT                                                           0x0
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_EXPANSION_MODE__SHIFT                                                   0x1
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_PIX_INV_MODE__SHIFT                                                     0x2
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_ROM_EN__SHIFT                                                           0x3
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_MODE__SHIFT                                                             0x4
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN__SHIFT                                               0x7
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_UPDATE_PENDING__SHIFT                                                   0x10
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_ENABLE_MASK                                                             0x00000001L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_EXPANSION_MODE_MASK                                                     0x00000002L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_PIX_INV_MODE_MASK                                                       0x00000004L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_ROM_EN_MASK                                                             0x00000008L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_MODE_MASK                                                               0x00000070L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN_MASK                                                 0x00000080L
+#define CM_CUR1_CURSOR0_CONTROL__CUR0_UPDATE_PENDING_MASK                                                     0x00010000L
+//CM_CUR1_CURSOR0_COLOR0
+#define CM_CUR1_CURSOR0_COLOR0__CUR0_COLOR0__SHIFT                                                            0x0
+#define CM_CUR1_CURSOR0_COLOR0__CUR0_COLOR0_MASK                                                              0x00FFFFFFL
+//CM_CUR1_CURSOR0_COLOR1
+#define CM_CUR1_CURSOR0_COLOR1__CUR0_COLOR1__SHIFT                                                            0x0
+#define CM_CUR1_CURSOR0_COLOR1__CUR0_COLOR1_MASK                                                              0x00FFFFFFL
+//CM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y__SHIFT                                           0x0
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y__SHIFT                                            0x10
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y_MASK                                             0x0000FFFFL
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y_MASK                                              0xFFFF0000L
+//CM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB__SHIFT                                   0x0
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB__SHIFT                                    0x10
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB_MASK                                     0x0000FFFFL
+#define CM_CUR1_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB_MASK                                      0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_MODE
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE__SHIFT                                                     0x0
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT__SHIFT                                             0x2
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT__SHIFT                                              0x4
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_MASK                                                       0x00000003L
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT_MASK                                               0x0000000CL
+#define CM_CUR1_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT_MASK                                                0x00000010L
+//CM_CUR1_CUR0_MATRIX_C11_C12_A
+#define CM_CUR1_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C13_C14_A
+#define CM_CUR1_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C21_C22_A
+#define CM_CUR1_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C23_C24_A
+#define CM_CUR1_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C31_C32_A
+#define CM_CUR1_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C33_C34_A
+#define CM_CUR1_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C11_C12_B
+#define CM_CUR1_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C13_C14_B
+#define CM_CUR1_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C21_C22_B
+#define CM_CUR1_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C23_C24_B
+#define CM_CUR1_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C31_C32_B
+#define CM_CUR1_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CUR0_MATRIX_C33_C34_B
+#define CM_CUR1_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B__SHIFT                                               0x0
+#define CM_CUR1_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B__SHIFT                                               0x10
+#define CM_CUR1_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B_MASK                                                 0x0000FFFFL
+#define CM_CUR1_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B_MASK                                                 0xFFFF0000L
+//CM_CUR1_CM_CUR0_TEST_DEBUG_INDEX
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX__SHIFT                                     0x0
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN__SHIFT                                  0x8
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX_MASK                                       0x000000FFL
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN_MASK                                    0x00000100L
+//CM_CUR1_CM_CUR0_TEST_DEBUG_DATA
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA__SHIFT                                       0x0
+#define CM_CUR1_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA_MASK                                         0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dscl_dispdec
+//DSCL1_SCL_COEF_RAM_TAP_SELECT
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX__SHIFT                                       0x0
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE__SHIFT                                              0x8
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE__SHIFT                                        0x10
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX_MASK                                         0x00000003L
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE_MASK                                                0x00003F00L
+#define DSCL1_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE_MASK                                          0x00070000L
+//DSCL1_SCL_COEF_RAM_TAP_DATA
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF__SHIFT                                        0x0
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN__SHIFT                                     0xf
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF__SHIFT                                         0x10
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN__SHIFT                                      0x1f
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_MASK                                          0x00003FFFL
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN_MASK                                       0x00008000L
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_MASK                                           0x3FFF0000L
+#define DSCL1_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN_MASK                                        0x80000000L
+//DSCL1_SCL_MODE
+#define DSCL1_SCL_MODE__DSCL_MODE__SHIFT                                                                      0x0
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT__SHIFT                                                            0x8
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT__SHIFT                                                    0xc
+#define DSCL1_SCL_MODE__SCL_CHROMA_COEF_MODE__SHIFT                                                           0x10
+#define DSCL1_SCL_MODE__SCL_ALPHA_COEF_MODE__SHIFT                                                            0x14
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT_RD__SHIFT                                                         0x18
+#define DSCL1_SCL_MODE__DSCL_MODE_MASK                                                                        0x00000007L
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT_MASK                                                              0x00000100L
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT_MASK                                                      0x00001000L
+#define DSCL1_SCL_MODE__SCL_CHROMA_COEF_MODE_MASK                                                             0x00010000L
+#define DSCL1_SCL_MODE__SCL_ALPHA_COEF_MODE_MASK                                                              0x00100000L
+#define DSCL1_SCL_MODE__SCL_COEF_RAM_SELECT_RD_MASK                                                           0x01000000L
+//DSCL1_SCL_TAP_CONTROL
+#define DSCL1_SCL_TAP_CONTROL__SCL_V_NUM_TAPS__SHIFT                                                          0x0
+#define DSCL1_SCL_TAP_CONTROL__SCL_H_NUM_TAPS__SHIFT                                                          0x4
+#define DSCL1_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C__SHIFT                                                        0x8
+#define DSCL1_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C__SHIFT                                                        0xc
+#define DSCL1_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_MASK                                                            0x00000007L
+#define DSCL1_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_MASK                                                            0x00000070L
+#define DSCL1_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C_MASK                                                          0x00000700L
+#define DSCL1_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C_MASK                                                          0x00007000L
+//DSCL1_DSCL_CONTROL
+#define DSCL1_DSCL_CONTROL__SCL_BOUNDARY_MODE__SHIFT                                                          0x0
+#define DSCL1_DSCL_CONTROL__SCL_BOUNDARY_MODE_MASK                                                            0x00000001L
+//DSCL1_DSCL_2TAP_CONTROL
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x0
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN__SHIFT                                                   0x4
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR__SHIFT                                               0x8
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x10
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN__SHIFT                                                   0x14
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR__SHIFT                                               0x18
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN_MASK                                             0x00000001L
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN_MASK                                                     0x00000010L
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR_MASK                                                 0x00000700L
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN_MASK                                             0x00010000L
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN_MASK                                                     0x00100000L
+#define DSCL1_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR_MASK                                                 0x07000000L
+//DSCL1_SCL_MANUAL_REPLICATE_CONTROL
+#define DSCL1_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR__SHIFT                              0x0
+#define DSCL1_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR__SHIFT                              0x8
+#define DSCL1_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR_MASK                                0x0000000FL
+#define DSCL1_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR_MASK                                0x00000F00L
+//DSCL1_SCL_HORZ_FILTER_SCALE_RATIO
+#define DSCL1_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL1_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL1_SCL_HORZ_FILTER_INIT
+#define DSCL1_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL1_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT__SHIFT                                                     0x18
+#define DSCL1_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL1_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT_MASK                                                       0x0F000000L
+//DSCL1_SCL_HORZ_FILTER_SCALE_RATIO_C
+#define DSCL1_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL1_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL1_SCL_HORZ_FILTER_INIT_C
+#define DSCL1_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL1_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL1_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL1_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL1_SCL_VERT_FILTER_SCALE_RATIO
+#define DSCL1_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL1_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL1_SCL_VERT_FILTER_INIT
+#define DSCL1_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL1_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT__SHIFT                                                     0x18
+#define DSCL1_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL1_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT_MASK                                                       0x0F000000L
+//DSCL1_SCL_VERT_FILTER_SCALE_RATIO_C
+#define DSCL1_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL1_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL1_SCL_VERT_FILTER_INIT_C
+#define DSCL1_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL1_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL1_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL1_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL1_SCL_BLACK_COLOR
+#define DSCL1_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y__SHIFT                                                   0x0
+#define DSCL1_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR__SHIFT                                                    0x10
+#define DSCL1_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y_MASK                                                     0x0000FFFFL
+#define DSCL1_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR_MASK                                                      0xFFFF0000L
+//DSCL1_DSCL_UPDATE
+#define DSCL1_DSCL_UPDATE__SCL_UPDATE_PENDING__SHIFT                                                          0x0
+#define DSCL1_DSCL_UPDATE__SCL_UPDATE_PENDING_MASK                                                            0x00000001L
+//DSCL1_DSCL_AUTOCAL
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_MODE__SHIFT                                                               0x0
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE__SHIFT                                                          0x2
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE__SHIFT                                                           0x8
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_PIPE_ID__SHIFT                                                            0xc
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_MODE_MASK                                                                 0x00000003L
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE_MASK                                                            0x00000004L
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE_MASK                                                             0x00000300L
+#define DSCL1_DSCL_AUTOCAL__AUTOCAL_PIPE_ID_MASK                                                              0x00003000L
+//DSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT
+#define DSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT__SHIFT                                         0x0
+#define DSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT__SHIFT                                          0x10
+#define DSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT_MASK                                           0x00003FFFL
+#define DSCL1_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT_MASK                                            0x3FFF0000L
+//DSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM
+#define DSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM__SHIFT                                        0x0
+#define DSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP__SHIFT                                           0x10
+#define DSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM_MASK                                          0x00003FFFL
+#define DSCL1_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP_MASK                                             0x3FFF0000L
+//DSCL1_OTG_H_BLANK
+#define DSCL1_OTG_H_BLANK__OTG_H_BLANK_START__SHIFT                                                           0x0
+#define DSCL1_OTG_H_BLANK__OTG_H_BLANK_END__SHIFT                                                             0x10
+#define DSCL1_OTG_H_BLANK__OTG_H_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL1_OTG_H_BLANK__OTG_H_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL1_OTG_V_BLANK
+#define DSCL1_OTG_V_BLANK__OTG_V_BLANK_START__SHIFT                                                           0x0
+#define DSCL1_OTG_V_BLANK__OTG_V_BLANK_END__SHIFT                                                             0x10
+#define DSCL1_OTG_V_BLANK__OTG_V_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL1_OTG_V_BLANK__OTG_V_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL1_RECOUT_START
+#define DSCL1_RECOUT_START__RECOUT_START_X__SHIFT                                                             0x0
+#define DSCL1_RECOUT_START__RECOUT_START_Y__SHIFT                                                             0x10
+#define DSCL1_RECOUT_START__RECOUT_START_X_MASK                                                               0x00003FFFL
+#define DSCL1_RECOUT_START__RECOUT_START_Y_MASK                                                               0x3FFF0000L
+//DSCL1_RECOUT_SIZE
+#define DSCL1_RECOUT_SIZE__RECOUT_WIDTH__SHIFT                                                                0x0
+#define DSCL1_RECOUT_SIZE__RECOUT_HEIGHT__SHIFT                                                               0x10
+#define DSCL1_RECOUT_SIZE__RECOUT_WIDTH_MASK                                                                  0x00003FFFL
+#define DSCL1_RECOUT_SIZE__RECOUT_HEIGHT_MASK                                                                 0x3FFF0000L
+//DSCL1_MPC_SIZE
+#define DSCL1_MPC_SIZE__MPC_WIDTH__SHIFT                                                                      0x0
+#define DSCL1_MPC_SIZE__MPC_HEIGHT__SHIFT                                                                     0x10
+#define DSCL1_MPC_SIZE__MPC_WIDTH_MASK                                                                        0x00003FFFL
+#define DSCL1_MPC_SIZE__MPC_HEIGHT_MASK                                                                       0x3FFF0000L
+//DSCL1_LB_DATA_FORMAT
+#define DSCL1_LB_DATA_FORMAT__ALPHA_EN__SHIFT                                                                 0x4
+#define DSCL1_LB_DATA_FORMAT__ALPHA_EN_MASK                                                                   0x00000010L
+//DSCL1_LB_MEMORY_CTRL
+#define DSCL1_LB_MEMORY_CTRL__MEMORY_CONFIG__SHIFT                                                            0x0
+#define DSCL1_LB_MEMORY_CTRL__LB_MAX_PARTITIONS__SHIFT                                                        0x8
+#define DSCL1_LB_MEMORY_CTRL__LB_NUM_PARTITIONS__SHIFT                                                        0x10
+#define DSCL1_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C__SHIFT                                                      0x18
+#define DSCL1_LB_MEMORY_CTRL__MEMORY_CONFIG_MASK                                                              0x00000003L
+#define DSCL1_LB_MEMORY_CTRL__LB_MAX_PARTITIONS_MASK                                                          0x00003F00L
+#define DSCL1_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_MASK                                                          0x007F0000L
+#define DSCL1_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C_MASK                                                        0x7F000000L
+//DSCL1_LB_V_COUNTER
+#define DSCL1_LB_V_COUNTER__V_COUNTER__SHIFT                                                                  0x0
+#define DSCL1_LB_V_COUNTER__V_COUNTER_C__SHIFT                                                                0x10
+#define DSCL1_LB_V_COUNTER__V_COUNTER_MASK                                                                    0x00001FFFL
+#define DSCL1_LB_V_COUNTER__V_COUNTER_C_MASK                                                                  0x1FFF0000L
+//DSCL1_DSCL_MEM_PWR_CTRL
+#define DSCL1_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE__SHIFT                                                     0x0
+#define DSCL1_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS__SHIFT                                                       0x2
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE__SHIFT                                                   0x4
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS__SHIFT                                                     0x6
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE__SHIFT                                                   0x8
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS__SHIFT                                                     0xa
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE__SHIFT                                                   0xc
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS__SHIFT                                                     0xe
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE__SHIFT                                                   0x10
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS__SHIFT                                                     0x12
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE__SHIFT                                                   0x14
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS__SHIFT                                                     0x16
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE__SHIFT                                                   0x18
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS__SHIFT                                                     0x1a
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE__SHIFT                                                       0x1c
+#define DSCL1_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE_MASK                                                       0x00000003L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS_MASK                                                         0x00000004L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE_MASK                                                     0x00000030L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS_MASK                                                       0x00000040L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE_MASK                                                     0x00000300L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS_MASK                                                       0x00000400L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE_MASK                                                     0x00003000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS_MASK                                                       0x00004000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE_MASK                                                     0x00030000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS_MASK                                                       0x00040000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE_MASK                                                     0x00300000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS_MASK                                                       0x00400000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE_MASK                                                     0x03000000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS_MASK                                                       0x04000000L
+#define DSCL1_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE_MASK                                                         0x10000000L
+//DSCL1_DSCL_MEM_PWR_STATUS
+#define DSCL1_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE__SHIFT                                                   0x0
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE__SHIFT                                                 0x2
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE__SHIFT                                                 0x4
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE__SHIFT                                                 0x6
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE__SHIFT                                                 0x8
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE__SHIFT                                                 0xa
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE__SHIFT                                                 0xc
+#define DSCL1_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE_MASK                                                     0x00000003L
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE_MASK                                                   0x0000000CL
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE_MASK                                                   0x00000030L
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE_MASK                                                   0x000000C0L
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE_MASK                                                   0x00000300L
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE_MASK                                                   0x00000C00L
+#define DSCL1_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE_MASK                                                   0x00003000L
+//DSCL1_OBUF_CONTROL
+#define DSCL1_OBUF_CONTROL__OBUF_BYPASS__SHIFT                                                                0x0
+#define DSCL1_OBUF_CONTROL__OBUF_USE_FULL_BUFFER__SHIFT                                                       0x1
+#define DSCL1_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH__SHIFT                                                  0x2
+#define DSCL1_OBUF_CONTROL__OBUF_OUT_HOLD_CNT__SHIFT                                                          0x4
+#define DSCL1_OBUF_CONTROL__OBUF_BYPASS_MASK                                                                  0x00000001L
+#define DSCL1_OBUF_CONTROL__OBUF_USE_FULL_BUFFER_MASK                                                         0x00000002L
+#define DSCL1_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH_MASK                                                    0x00000004L
+#define DSCL1_OBUF_CONTROL__OBUF_OUT_HOLD_CNT_MASK                                                            0x000000F0L
+//DSCL1_OBUF_MEM_PWR_CTRL
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE__SHIFT                                                    0x0
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS__SHIFT                                                      0x2
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE__SHIFT                                                     0x8
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE__SHIFT                                                    0x10
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE_MASK                                                      0x00000003L
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS_MASK                                                        0x00000004L
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE_MASK                                                       0x00000100L
+#define DSCL1_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE_MASK                                                      0x00030000L
+//DSCL1_DSCL_EASF_H_MODE
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_EN__SHIFT                                                          0x0
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_EN_MASK                                                            0x00000001L
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL1_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL1_DSCL_EASF_V_MODE
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_EN__SHIFT                                                          0x0
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_EN_MASK                                                            0x00000001L
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL1_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL1_DSCL_SC_MODE
+#define DSCL1_DSCL_SC_MODE__SCL_SC_MATRIX_MODE__SHIFT                                                         0x0
+#define DSCL1_DSCL_SC_MODE__SCL_SC_LTONL_EN__SHIFT                                                            0x8
+#define DSCL1_DSCL_SC_MODE__SCL_SC_MATRIX_MODE_MASK                                                           0x00000001L
+#define DSCL1_DSCL_SC_MODE__SCL_SC_LTONL_EN_MASK                                                              0x00000100L
+//DSCL1_DSCL_SC_MATRIX_C0C1
+#define DSCL1_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0__SHIFT                                                    0x0
+#define DSCL1_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1__SHIFT                                                    0x10
+#define DSCL1_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0_MASK                                                      0x0000FFFFL
+#define DSCL1_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1_MASK                                                      0xFFFF0000L
+//DSCL1_DSCL_SC_MATRIX_C2C3
+#define DSCL1_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2__SHIFT                                                    0x0
+#define DSCL1_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3__SHIFT                                                    0x10
+#define DSCL1_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2_MASK                                                      0x0000FFFFL
+#define DSCL1_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3_MASK                                                      0xFFFF0000L
+//DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL1_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL1_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT__SHIFT                    0x0
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL__SHIFT                    0x10
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT_MASK                      0x0000FFFFL
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL_MASK                      0xFFFF0000L
+//DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE__SHIFT                     0x0
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE__SHIFT                    0x10
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE_MASK                       0x0000FFFFL
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE_MASK                      0xFFFF0000L
+//DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE__SHIFT                    0x0
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET__SHIFT                   0x10
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE_MASK                      0x0000FFFFL
+#define DSCL1_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET_MASK                     0xFFFF0000L
+//DSCL1_DSCL_EASF_RINGEST_FORCE
+#define DSCL1_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE__SHIFT                                        0x0
+#define DSCL1_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE__SHIFT                                        0x10
+#define DSCL1_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE_MASK                                          0x0000FFFFL
+#define DSCL1_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE_MASK                                          0xFFFF0000L
+//DSCL1_DSCL_EASF_H_BF_CNTL
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN__SHIFT                                                   0x0
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE__SHIFT                                                 0x8
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE__SHIFT                                                 0x10
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN_MASK                                                     0x00000001L
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL1_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA__SHIFT                                         0x0
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB__SHIFT                                         0x8
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA__SHIFT                                         0x10
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB__SHIFT                                         0x18
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA_MASK                                           0x003F0000L
+#define DSCL1_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB_MASK                                           0x3F000000L
+//DSCL1_DSCL_EASF_V_BF_CNTL
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN__SHIFT                                                   0x0
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE__SHIFT                                                 0x8
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE__SHIFT                                                 0x10
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN_MASK                                                     0x00000001L
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL1_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA__SHIFT                                         0x0
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB__SHIFT                                         0x8
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA__SHIFT                                         0x10
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB__SHIFT                                         0x18
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA_MASK                                           0x003F0000L
+#define DSCL1_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB_MASK                                           0x3F000000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG1
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG2
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG3
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG4
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG5
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG6
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_H_BF1_PWL_SEG7
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG1
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG2
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG3
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG4
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG5
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG6
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL1_DSCL_EASF_V_BF1_PWL_SEG7
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL1_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG1
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG2
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG3
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG4
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_H_BF3_PWL_SEG5
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG1
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG2
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG3
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG4
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL1_DSCL_EASF_V_BF3_PWL_SEG5
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL1_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL1_ISHARP_MODE
+#define DSCL1_ISHARP_MODE__ISHARP_EN__SHIFT                                                                   0x0
+#define DSCL1_ISHARP_MODE__ISHARP_NOISEDET_EN__SHIFT                                                          0x4
+#define DSCL1_ISHARP_MODE__ISHARP_NOISEDET_MODE__SHIFT                                                        0x5
+#define DSCL1_ISHARP_MODE__ISHARP_LBA_MODE__SHIFT                                                             0x9
+#define DSCL1_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT__SHIFT                                                     0xa
+#define DSCL1_ISHARP_MODE__ISHARP_FMT_MODE__SHIFT                                                             0xb
+#define DSCL1_ISHARP_MODE__ISHARP_FMT_NORM__SHIFT                                                             0xc
+#define DSCL1_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT__SHIFT                                             0x1c
+#define DSCL1_ISHARP_MODE__ISHARP_EN_MASK                                                                     0x00000001L
+#define DSCL1_ISHARP_MODE__ISHARP_NOISEDET_EN_MASK                                                            0x00000010L
+#define DSCL1_ISHARP_MODE__ISHARP_NOISEDET_MODE_MASK                                                          0x00000060L
+#define DSCL1_ISHARP_MODE__ISHARP_LBA_MODE_MASK                                                               0x00000200L
+#define DSCL1_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_MASK                                                       0x00000400L
+#define DSCL1_ISHARP_MODE__ISHARP_FMT_MODE_MASK                                                               0x00000800L
+#define DSCL1_ISHARP_MODE__ISHARP_FMT_NORM_MASK                                                               0x0FFFF000L
+#define DSCL1_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT_MASK                                               0x10000000L
+//DSCL1_ISHARP_DELTA_CTRL
+#define DSCL1_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT__SHIFT                                          0x0
+#define DSCL1_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT_MASK                                            0x00000001L
+//DSCL1_ISHARP_DELTA_INDEX
+#define DSCL1_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX__SHIFT                                                   0x0
+#define DSCL1_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX_MASK                                                     0x0000001FL
+//DSCL1_ISHARP_DELTA_DATA
+#define DSCL1_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA__SHIFT                                                     0x0
+#define DSCL1_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA_MASK                                                       0xFFFFFFFFL
+//DSCL1_ISHARP_NLDELTA_SOFT_CLIP
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P__SHIFT                                      0x0
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P__SHIFT                                   0x1
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P__SHIFT                                   0x8
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N__SHIFT                                      0x10
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N__SHIFT                                   0x11
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N__SHIFT                                   0x18
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P_MASK                                        0x00000001L
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P_MASK                                     0x000000FEL
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P_MASK                                     0x0000FF00L
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N_MASK                                        0x00010000L
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N_MASK                                     0x00FE0000L
+#define DSCL1_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N_MASK                                     0xFF000000L
+//DSCL1_ISHARP_NOISEDET_THRESHOLD
+#define DSCL1_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE__SHIFT                                         0x0
+#define DSCL1_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE__SHIFT                                         0x10
+#define DSCL1_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE_MASK                                           0x000003FFL
+#define DSCL1_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE_MASK                                           0x03FF0000L
+//DSCL1_ISHARP_NOISE_GAIN_PWL
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN__SHIFT                                      0x0
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN__SHIFT                                        0x8
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE__SHIFT                                         0x10
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN_MASK                                        0x0000001FL
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN_MASK                                          0x00001F00L
+#define DSCL1_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE_MASK                                           0x3FFF0000L
+//DSCL1_ISHARP_LBA_PWL_SEG0
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0__SHIFT                                           0x14
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0_MASK                                              0x0003F000L
+#define DSCL1_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0_MASK                                             0x1FF00000L
+//DSCL1_ISHARP_LBA_PWL_SEG1
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1__SHIFT                                           0x14
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1_MASK                                              0x0003F000L
+#define DSCL1_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1_MASK                                             0x1FF00000L
+//DSCL1_ISHARP_LBA_PWL_SEG2
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2__SHIFT                                           0x14
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2_MASK                                              0x0003F000L
+#define DSCL1_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2_MASK                                             0x1FF00000L
+//DSCL1_ISHARP_LBA_PWL_SEG3
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3__SHIFT                                           0x14
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3_MASK                                              0x0003F000L
+#define DSCL1_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3_MASK                                             0x1FF00000L
+//DSCL1_ISHARP_LBA_PWL_SEG4
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4__SHIFT                                           0x14
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4_MASK                                              0x0003F000L
+#define DSCL1_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4_MASK                                             0x1FF00000L
+//DSCL1_ISHARP_LBA_PWL_SEG5
+#define DSCL1_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5__SHIFT                                              0x0
+#define DSCL1_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5__SHIFT                                            0xc
+#define DSCL1_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5_MASK                                                0x000003FFL
+#define DSCL1_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5_MASK                                              0x0003F000L
+//DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE__SHIFT                            0x0
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS__SHIFT                              0x2
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE__SHIFT                            0x4
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE_MASK                              0x00000003L
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS_MASK                                0x00000004L
+#define DSCL1_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE_MASK                              0x00000030L
+//DSCL1_DSCL_DEBUG
+#define DSCL1_DSCL_DEBUG__SCL_DEBUG__SHIFT                                                                    0x0
+#define DSCL1_DSCL_DEBUG__SCL_DEBUG_MASK                                                                      0xFFFFFFFFL
+//DSCL1_DSCL_TEST_DEBUG_INDEX
+#define DSCL1_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX__SHIFT                                              0x0
+#define DSCL1_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN__SHIFT                                           0x8
+#define DSCL1_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX_MASK                                                0x000000FFL
+#define DSCL1_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN_MASK                                             0x00000100L
+//DSCL1_DSCL_TEST_DEBUG_DATA
+#define DSCL1_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA__SHIFT                                                0x0
+#define DSCL1_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA_MASK                                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp1_dispdec_cm_dispdec
+//CM1_CM_CONTROL
+#define CM1_CM_CONTROL__CM_BYPASS__SHIFT                                                                      0x0
+#define CM1_CM_CONTROL__CM_UPDATE_PENDING__SHIFT                                                              0x8
+#define CM1_CM_CONTROL__CM_BYPASS_MASK                                                                        0x00000001L
+#define CM1_CM_CONTROL__CM_UPDATE_PENDING_MASK                                                                0x00000100L
+//CM1_CM_POST_CSC_CONTROL
+#define CM1_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE__SHIFT                                                      0x0
+#define CM1_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT__SHIFT                                              0x2
+#define CM1_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_MASK                                                        0x00000003L
+#define CM1_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT_MASK                                                0x0000000CL
+//CM1_CM_POST_CSC_C11_C12
+#define CM1_CM_POST_CSC_C11_C12__CM_POST_CSC_C11__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C11_C12__CM_POST_CSC_C12__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C11_C12__CM_POST_CSC_C11_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C11_C12__CM_POST_CSC_C12_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_C13_C14
+#define CM1_CM_POST_CSC_C13_C14__CM_POST_CSC_C13__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C13_C14__CM_POST_CSC_C14__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C13_C14__CM_POST_CSC_C13_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C13_C14__CM_POST_CSC_C14_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_C21_C22
+#define CM1_CM_POST_CSC_C21_C22__CM_POST_CSC_C21__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C21_C22__CM_POST_CSC_C22__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C21_C22__CM_POST_CSC_C21_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C21_C22__CM_POST_CSC_C22_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_C23_C24
+#define CM1_CM_POST_CSC_C23_C24__CM_POST_CSC_C23__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C23_C24__CM_POST_CSC_C24__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C23_C24__CM_POST_CSC_C23_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C23_C24__CM_POST_CSC_C24_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_C31_C32
+#define CM1_CM_POST_CSC_C31_C32__CM_POST_CSC_C31__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C31_C32__CM_POST_CSC_C32__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C31_C32__CM_POST_CSC_C31_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C31_C32__CM_POST_CSC_C32_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_C33_C34
+#define CM1_CM_POST_CSC_C33_C34__CM_POST_CSC_C33__SHIFT                                                       0x0
+#define CM1_CM_POST_CSC_C33_C34__CM_POST_CSC_C34__SHIFT                                                       0x10
+#define CM1_CM_POST_CSC_C33_C34__CM_POST_CSC_C33_MASK                                                         0x0000FFFFL
+#define CM1_CM_POST_CSC_C33_C34__CM_POST_CSC_C34_MASK                                                         0xFFFF0000L
+//CM1_CM_POST_CSC_B_C11_C12
+#define CM1_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12_MASK                                                     0xFFFF0000L
+//CM1_CM_POST_CSC_B_C13_C14
+#define CM1_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14_MASK                                                     0xFFFF0000L
+//CM1_CM_POST_CSC_B_C21_C22
+#define CM1_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22_MASK                                                     0xFFFF0000L
+//CM1_CM_POST_CSC_B_C23_C24
+#define CM1_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24_MASK                                                     0xFFFF0000L
+//CM1_CM_POST_CSC_B_C31_C32
+#define CM1_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32_MASK                                                     0xFFFF0000L
+//CM1_CM_POST_CSC_B_C33_C34
+#define CM1_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33__SHIFT                                                   0x0
+#define CM1_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34__SHIFT                                                   0x10
+#define CM1_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33_MASK                                                     0x0000FFFFL
+#define CM1_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34_MASK                                                     0xFFFF0000L
+//CM1_CM_BIAS_CR_R
+#define CM1_CM_BIAS_CR_R__CM_BIAS_CR_R__SHIFT                                                                 0x0
+#define CM1_CM_BIAS_CR_R__CM_BIAS_CR_R_MASK                                                                   0x0000FFFFL
+//CM1_CM_BIAS_Y_G_CB_B
+#define CM1_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G__SHIFT                                                              0x0
+#define CM1_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B__SHIFT                                                             0x10
+#define CM1_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G_MASK                                                                0x0000FFFFL
+#define CM1_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B_MASK                                                               0xFFFF0000L
+//CM1_CM_GAMCOR_CONTROL
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE__SHIFT                                                          0x0
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT__SHIFT                                                        0x2
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE__SHIFT                                                   0x3
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT__SHIFT                                                  0x4
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT__SHIFT                                                0x6
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_MASK                                                            0x00000003L
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_MASK                                                          0x00000004L
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE_MASK                                                     0x00000008L
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT_MASK                                                    0x00000030L
+#define CM1_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT_MASK                                                  0x00000040L
+//CM1_CM_GAMCOR_LUT_INDEX
+#define CM1_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX__SHIFT                                                   0x0
+#define CM1_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX_MASK                                                     0x000001FFL
+//CM1_CM_GAMCOR_LUT_DATA
+#define CM1_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA__SHIFT                                                     0x0
+#define CM1_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA_MASK                                                       0x0003FFFFL
+//CM1_CM_GAMCOR_LUT_CONTROL
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK__SHIFT                                      0x0
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL__SHIFT                                        0x3
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG__SHIFT                                              0x5
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL__SHIFT                                              0x6
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK_MASK                                        0x00000007L
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL_MASK                                          0x00000018L
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG_MASK                                                0x00000020L
+#define CM1_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL_MASK                                                0x00000040L
+//CM1_CM_GAMCOR_RAMA_START_CNTL_B
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMA_START_CNTL_G
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMA_START_CNTL_R
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_B
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_G
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_R
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_END_CNTL1_B
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_END_CNTL2_B
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMA_END_CNTL1_G
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_END_CNTL2_G
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMA_END_CNTL1_R
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMA_END_CNTL2_R
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMA_OFFSET_B
+#define CM1_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMA_OFFSET_G
+#define CM1_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMA_OFFSET_R
+#define CM1_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMA_REGION_0_1
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_2_3
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_4_5
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_6_7
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_8_9
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_10_11
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_12_13
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_14_15
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_16_17
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_18_19
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_20_21
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_22_23
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_24_25
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_26_27
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_28_29
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_30_31
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMA_REGION_32_33
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_START_CNTL_B
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMB_START_CNTL_G
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMB_START_CNTL_R
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R__SHIFT                             0x0
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM1_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM1_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_B
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_G
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_R
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM1_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_END_CNTL1_B
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_END_CNTL2_B
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMB_END_CNTL1_G
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_END_CNTL2_G
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMB_END_CNTL1_R
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM1_CM_GAMCOR_RAMB_END_CNTL2_R
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R__SHIFT                                0x0
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM1_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM1_CM_GAMCOR_RAMB_OFFSET_B
+#define CM1_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMB_OFFSET_G
+#define CM1_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMB_OFFSET_R
+#define CM1_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R__SHIFT                                           0x0
+#define CM1_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R_MASK                                             0x0007FFFFL
+//CM1_CM_GAMCOR_RAMB_REGION_0_1
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_2_3
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_4_5
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_6_7
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_8_9
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_10_11
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_12_13
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_14_15
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_16_17
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_18_19
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_20_21
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_22_23
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_24_25
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_26_27
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_28_29
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_30_31
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_GAMCOR_RAMB_REGION_32_33
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM1_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM1_CM_HDR_MULT_COEF
+#define CM1_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF__SHIFT                                                         0x0
+#define CM1_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF_MASK                                                           0x0007FFFFL
+//CM1_CM_MEM_PWR_CTRL
+#define CM1_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE__SHIFT                                                      0x0
+#define CM1_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS__SHIFT                                                        0x2
+#define CM1_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE__SHIFT                                                        0x8
+#define CM1_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS__SHIFT                                                          0x9
+#define CM1_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE_MASK                                                        0x00000003L
+#define CM1_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS_MASK                                                          0x00000004L
+#define CM1_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE_MASK                                                          0x00000100L
+#define CM1_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS_MASK                                                            0x00000200L
+//CM1_CM_MEM_PWR_STATUS
+#define CM1_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE__SHIFT                                                    0x0
+#define CM1_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE__SHIFT                                                      0x8
+#define CM1_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE_MASK                                                      0x00000003L
+#define CM1_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE_MASK                                                        0x00000100L
+//CM1_CM_DEALPHA
+#define CM1_CM_DEALPHA__CM_DEALPHA_EN__SHIFT                                                                  0x0
+#define CM1_CM_DEALPHA__CM_DEALPHA_ABLND__SHIFT                                                               0x1
+#define CM1_CM_DEALPHA__CM_DEALPHA_EN_MASK                                                                    0x00000001L
+#define CM1_CM_DEALPHA__CM_DEALPHA_ABLND_MASK                                                                 0x00000002L
+//CM1_CM_COEF_FORMAT
+#define CM1_CM_COEF_FORMAT__CM_BIAS_FORMAT__SHIFT                                                             0x0
+#define CM1_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT__SHIFT                                                    0x4
+#define CM1_CM_COEF_FORMAT__CM_BIAS_FORMAT_MASK                                                               0x00000001L
+#define CM1_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT_MASK                                                      0x00000010L
+//CM1_CM_TEST_DEBUG_INDEX
+#define CM1_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX__SHIFT                                                   0x0
+#define CM1_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN__SHIFT                                                0x8
+#define CM1_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX_MASK                                                     0x000000FFL
+#define CM1_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN_MASK                                                  0x00000100L
+//CM1_CM_TEST_DEBUG_DATA
+#define CM1_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define CM1_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//CM1_CM_HIST_CNTL
+#define CM1_CM_HIST_CNTL__CM_HIST_SEL__SHIFT                                                                  0x0
+#define CM1_CM_HIST_CNTL__CM_HIST_CH_EN__SHIFT                                                                0x2
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC1_SEL__SHIFT                                                             0x4
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC2_SEL__SHIFT                                                             0x5
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC3_SEL__SHIFT                                                             0x6
+#define CM1_CM_HIST_CNTL__CM_HIST_CH1_XBAR__SHIFT                                                             0x7
+#define CM1_CM_HIST_CNTL__CM_HIST_CH2_XBAR__SHIFT                                                             0x9
+#define CM1_CM_HIST_CNTL__CM_HIST_CH3_XBAR__SHIFT                                                             0xb
+#define CM1_CM_HIST_CNTL__CM_HIST_FORMAT__SHIFT                                                               0xd
+#define CM1_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK__SHIFT                                                    0xf
+#define CM1_CM_HIST_CNTL__CM_HIST_SEL_MASK                                                                    0x00000003L
+#define CM1_CM_HIST_CNTL__CM_HIST_CH_EN_MASK                                                                  0x0000000CL
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC1_SEL_MASK                                                               0x00000010L
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC2_SEL_MASK                                                               0x00000020L
+#define CM1_CM_HIST_CNTL__CM_HIST_SRC3_SEL_MASK                                                               0x00000040L
+#define CM1_CM_HIST_CNTL__CM_HIST_CH1_XBAR_MASK                                                               0x00000180L
+#define CM1_CM_HIST_CNTL__CM_HIST_CH2_XBAR_MASK                                                               0x00000600L
+#define CM1_CM_HIST_CNTL__CM_HIST_CH3_XBAR_MASK                                                               0x00001800L
+#define CM1_CM_HIST_CNTL__CM_HIST_FORMAT_MASK                                                                 0x00006000L
+#define CM1_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK_MASK                                                      0x00038000L
+//CM1_CM_HIST_SCALE_SRC1
+#define CM1_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1__SHIFT                                                     0x0
+#define CM1_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1_MASK                                                       0x0007FFFFL
+//CM1_CM_HIST_COEFA_SRC2
+#define CM1_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2__SHIFT                                                     0x0
+#define CM1_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2_MASK                                                       0x0007FFFFL
+//CM1_CM_HIST_COEFB_SRC2
+#define CM1_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2__SHIFT                                                     0x0
+#define CM1_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2_MASK                                                       0x0007FFFFL
+//CM1_CM_HIST_COEFC_SRC2
+#define CM1_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2__SHIFT                                                     0x0
+#define CM1_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2_MASK                                                       0x0007FFFFL
+//CM1_CM_HIST_SCALE_SRC3
+#define CM1_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3__SHIFT                                                     0x0
+#define CM1_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3_MASK                                                       0x0007FFFFL
+//CM1_CM_HIST_BIAS_SRC1
+#define CM1_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1__SHIFT                                                       0x0
+#define CM1_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1_MASK                                                         0x0007FFFFL
+//CM1_CM_HIST_BIAS_SRC2
+#define CM1_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2__SHIFT                                                       0x0
+#define CM1_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2_MASK                                                         0x0007FFFFL
+//CM1_CM_HIST_BIAS_SRC3
+#define CM1_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3__SHIFT                                                       0x0
+#define CM1_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3_MASK                                                         0x0007FFFFL
+//CM1_CM_HIST_LOCK
+#define CM1_CM_HIST_LOCK__CM_HIST_LOCK__SHIFT                                                                 0x0
+#define CM1_CM_HIST_LOCK__CM_HIST_LOCK_MASK                                                                   0x00000001L
+//CM1_CM_HIST_INDEX
+#define CM1_CM_HIST_INDEX__CM_HIST_INDEX__SHIFT                                                               0x0
+#define CM1_CM_HIST_INDEX__CM_HIST_INDEX_MASK                                                                 0x000000FFL
+//CM1_CM_HIST_DATA
+#define CM1_CM_HIST_DATA__CM_HIST_DATA__SHIFT                                                                 0x0
+#define CM1_CM_HIST_DATA__CM_HIST_DATA_MASK                                                                   0x01FFFFFFL
+//CM1_CM_HIST_STATUS
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS__SHIFT                                                    0x0
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS__SHIFT                                                    0x1
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT__SHIFT                                                 0x2
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ__SHIFT                                                    0x3
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED__SHIFT                                              0x4
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT__SHIFT                                      0x5
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT__SHIFT                                          0x6
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED__SHIFT                                            0xc
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0xd
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED__SHIFT                                            0x10
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0x11
+#define CM1_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW__SHIFT                                                     0x18
+#define CM1_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT__SHIFT                                             0x19
+#define CM1_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE__SHIFT                                                 0x1a
+#define CM1_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT__SHIFT                                         0x1b
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS_MASK                                                      0x00000001L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS_MASK                                                      0x00000002L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT_MASK                                                   0x00000004L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ_MASK                                                      0x00000008L
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_MASK                                                0x00000010L
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT_MASK                                        0x00000020L
+#define CM1_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT_MASK                                            0x000001C0L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_MASK                                              0x00001000L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00002000L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_MASK                                              0x00010000L
+#define CM1_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00020000L
+#define CM1_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_MASK                                                       0x01000000L
+#define CM1_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT_MASK                                               0x02000000L
+#define CM1_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_MASK                                                   0x04000000L
+#define CM1_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT_MASK                                           0x08000000L
+//CM1_CM_HIST_INT_CONTROL
+#define CM1_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT__SHIFT                                                       0x0
+#define CM1_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN__SHIFT                                                    0x4
+#define CM1_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_MASK                                                         0x00000001L
+#define CM1_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN_MASK                                                      0x00000010L
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dpp_top_dispdec
+//DPP_TOP1_DPP_CONTROL
+#define DPP_TOP1_DPP_CONTROL__DPP_CLOCK_ENABLE__SHIFT                                                         0x4
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_GATE_DISABLE__SHIFT                                                    0x8
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE__SHIFT                                                0xa
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE__SHIFT                                               0xc
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE__SHIFT                                               0xd
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_R_GATE_DISABLE__SHIFT                                                    0xe
+#define DPP_TOP1_DPP_CONTROL__DISPCLK_R_GATE_DISABLE__SHIFT                                                   0x10
+#define DPP_TOP1_DPP_CONTROL__DISPCLK_G_GATE_DISABLE__SHIFT                                                   0x12
+#define DPP_TOP1_DPP_CONTROL__DPP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define DPP_TOP1_DPP_CONTROL__DPP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define DPP_TOP1_DPP_CONTROL__DPP_CLOCK_ENABLE_MASK                                                           0x00000010L
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_GATE_DISABLE_MASK                                                      0x00000100L
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE_MASK                                                  0x00000400L
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE_MASK                                                 0x00001000L
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE_MASK                                                 0x00002000L
+#define DPP_TOP1_DPP_CONTROL__DPPCLK_R_GATE_DISABLE_MASK                                                      0x00004000L
+#define DPP_TOP1_DPP_CONTROL__DISPCLK_R_GATE_DISABLE_MASK                                                     0x00010000L
+#define DPP_TOP1_DPP_CONTROL__DISPCLK_G_GATE_DISABLE_MASK                                                     0x00040000L
+#define DPP_TOP1_DPP_CONTROL__DPP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define DPP_TOP1_DPP_CONTROL__DPP_TEST_CLK_SEL_MASK                                                           0x70000000L
+//DPP_TOP1_DPP_SOFT_RESET
+#define DPP_TOP1_DPP_SOFT_RESET__CNVC_SOFT_RESET__SHIFT                                                       0x0
+#define DPP_TOP1_DPP_SOFT_RESET__DSCL_SOFT_RESET__SHIFT                                                       0x4
+#define DPP_TOP1_DPP_SOFT_RESET__CM_SOFT_RESET__SHIFT                                                         0x8
+#define DPP_TOP1_DPP_SOFT_RESET__OBUF_SOFT_RESET__SHIFT                                                       0xc
+#define DPP_TOP1_DPP_SOFT_RESET__HIST_SOFT_RESET__SHIFT                                                       0x10
+#define DPP_TOP1_DPP_SOFT_RESET__CNVC_SOFT_RESET_MASK                                                         0x00000001L
+#define DPP_TOP1_DPP_SOFT_RESET__DSCL_SOFT_RESET_MASK                                                         0x00000010L
+#define DPP_TOP1_DPP_SOFT_RESET__CM_SOFT_RESET_MASK                                                           0x00000100L
+#define DPP_TOP1_DPP_SOFT_RESET__OBUF_SOFT_RESET_MASK                                                         0x00001000L
+#define DPP_TOP1_DPP_SOFT_RESET__HIST_SOFT_RESET_MASK                                                         0x00010000L
+//DPP_TOP1_DPP_CRC_VAL_R
+#define DPP_TOP1_DPP_CRC_VAL_R__DPP_CRC_R_CR__SHIFT                                                           0x0
+#define DPP_TOP1_DPP_CRC_VAL_R__DPP_CRC_R_CR_MASK                                                             0xFFFFFFFFL
+//DPP_TOP1_DPP_CRC_VAL_G
+#define DPP_TOP1_DPP_CRC_VAL_G__DPP_CRC_G_Y__SHIFT                                                            0x0
+#define DPP_TOP1_DPP_CRC_VAL_G__DPP_CRC_G_Y_MASK                                                              0xFFFFFFFFL
+//DPP_TOP1_DPP_CRC_VAL_B
+#define DPP_TOP1_DPP_CRC_VAL_B__DPP_CRC_B_CB__SHIFT                                                           0x0
+#define DPP_TOP1_DPP_CRC_VAL_B__DPP_CRC_B_CB_MASK                                                             0xFFFFFFFFL
+//DPP_TOP1_DPP_CRC_VAL_A
+#define DPP_TOP1_DPP_CRC_VAL_A__DPP_CRC_ALPHA__SHIFT                                                          0x0
+#define DPP_TOP1_DPP_CRC_VAL_A__DPP_CRC_ALPHA_MASK                                                            0xFFFFFFFFL
+//DPP_TOP1_DPP_CRC_CTRL
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_EN__SHIFT                                                              0x0
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_CONT_EN__SHIFT                                                         0x1
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING__SHIFT                                                0x2
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL__SHIFT                                                    0x3
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_SRC_SEL__SHIFT                                                         0x4
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_STEREO_EN__SHIFT                                                       0x6
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE__SHIFT                                                     0x7
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL__SHIFT                                                  0xb
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_MASK__SHIFT                                                            0x10
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_EN_MASK                                                                0x00000001L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_CONT_EN_MASK                                                           0x00000002L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING_MASK                                                  0x00000004L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL_MASK                                                      0x00000008L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_SRC_SEL_MASK                                                           0x00000030L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_STEREO_EN_MASK                                                         0x00000040L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE_MASK                                                       0x00000180L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL_MASK                                                    0x00003800L
+#define DPP_TOP1_DPP_CRC_CTRL__DPP_CRC_MASK_MASK                                                              0xFFFF0000L
+//DPP_TOP1_HOST_READ_CONTROL
+#define DPP_TOP1_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL__SHIFT                                             0x0
+#define DPP_TOP1_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL_MASK                                               0x000000FFL
+//DPP_TOP1_DPP_DEBUG_SEL
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL__SHIFT                                               0x0
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL__SHIFT                                              0x8
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DBG_EN__SHIFT                                                             0x1f
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL_MASK                                                 0x00000007L
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL_MASK                                                0x00000700L
+#define DPP_TOP1_DPP_DEBUG_SEL__DPP_DBG_EN_MASK                                                               0x80000000L
+//DPP_TOP1_DPP_DEBUG_SPARE
+#define DPP_TOP1_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE__SHIFT                                                      0x0
+#define DPP_TOP1_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE_MASK                                                        0xFFFFFFFFL
+//DPP_TOP1_DPP_TEST_DEBUG_INDEX
+#define DPP_TOP1_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX__SHIFT                                            0x0
+#define DPP_TOP1_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN__SHIFT                                         0x8
+#define DPP_TOP1_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX_MASK                                              0x000000FFL
+#define DPP_TOP1_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN_MASK                                           0x00000100L
+//DPP_TOP1_DPP_TEST_DEBUG_DATA
+#define DPP_TOP1_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA__SHIFT                                              0x0
+#define DPP_TOP1_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA_MASK                                                0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp1_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON11_PERFCOUNTER_CNTL
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON11_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON11_PERFCOUNTER_CNTL2
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON11_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON11_PERFCOUNTER_STATE
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON11_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON11_PERFMON_CNTL
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON11_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON11_PERFMON_CNTL2
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON11_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON11_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON11_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON11_PERFMON_CVALUE_LOW
+#define DC_PERFMON11_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON11_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON11_PERFMON_HI
+#define DC_PERFMON11_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON11_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON11_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON11_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON11_PERFMON_LOW
+#define DC_PERFMON11_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON11_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON11_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON11_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON11_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cnvc_cfg_dispdec
+//CNVC_CFG2_CNVC_SURFACE_PIXEL_FORMAT
+#define CNVC_CFG2_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT__SHIFT                                 0x0
+#define CNVC_CFG2_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT_MASK                                   0x0000007FL
+//CNVC_CFG2_FORMAT_CONTROL
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_EXPANSION_MODE__SHIFT                                                0x0
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CNV16__SHIFT                                                         0x4
+#define CNVC_CFG2_FORMAT_CONTROL__ALPHA_EN__SHIFT                                                             0x8
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_BYPASS__SHIFT                                                          0xc
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN__SHIFT                                                0xd
+#define CNVC_CFG2_FORMAT_CONTROL__CLAMP_POSITIVE__SHIFT                                                       0x10
+#define CNVC_CFG2_FORMAT_CONTROL__CLAMP_POSITIVE_C__SHIFT                                                     0x11
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_UPDATE_PENDING__SHIFT                                                  0x14
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_R__SHIFT                                                    0x18
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_G__SHIFT                                                    0x1a
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_B__SHIFT                                                    0x1c
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_EXPANSION_MODE_MASK                                                  0x00000001L
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CNV16_MASK                                                           0x00000010L
+#define CNVC_CFG2_FORMAT_CONTROL__ALPHA_EN_MASK                                                               0x00000100L
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_BYPASS_MASK                                                            0x00001000L
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN_MASK                                                  0x00002000L
+#define CNVC_CFG2_FORMAT_CONTROL__CLAMP_POSITIVE_MASK                                                         0x00010000L
+#define CNVC_CFG2_FORMAT_CONTROL__CLAMP_POSITIVE_C_MASK                                                       0x00020000L
+#define CNVC_CFG2_FORMAT_CONTROL__CNVC_UPDATE_PENDING_MASK                                                    0x00100000L
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_R_MASK                                                      0x03000000L
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_G_MASK                                                      0x0C000000L
+#define CNVC_CFG2_FORMAT_CONTROL__FORMAT_CROSSBAR_B_MASK                                                      0x30000000L
+//CNVC_CFG2_FCNV_FP_BIAS_R
+#define CNVC_CFG2_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R__SHIFT                                                       0x0
+#define CNVC_CFG2_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R_MASK                                                         0x0007FFFFL
+//CNVC_CFG2_FCNV_FP_BIAS_G
+#define CNVC_CFG2_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G__SHIFT                                                       0x0
+#define CNVC_CFG2_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G_MASK                                                         0x0007FFFFL
+//CNVC_CFG2_FCNV_FP_BIAS_B
+#define CNVC_CFG2_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B__SHIFT                                                       0x0
+#define CNVC_CFG2_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B_MASK                                                         0x0007FFFFL
+//CNVC_CFG2_FCNV_FP_SCALE_R
+#define CNVC_CFG2_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R__SHIFT                                                     0x0
+#define CNVC_CFG2_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R_MASK                                                       0x0007FFFFL
+//CNVC_CFG2_FCNV_FP_SCALE_G
+#define CNVC_CFG2_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G__SHIFT                                                     0x0
+#define CNVC_CFG2_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G_MASK                                                       0x0007FFFFL
+//CNVC_CFG2_FCNV_FP_SCALE_B
+#define CNVC_CFG2_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B__SHIFT                                                     0x0
+#define CNVC_CFG2_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B_MASK                                                       0x0007FFFFL
+//CNVC_CFG2_COLOR_KEYER_CONTROL
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__COLOR_KEYER_EN__SHIFT                                                  0x0
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__LUMA_KEYER_EN__SHIFT                                                   0x1
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE__SHIFT                                                0x4
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__COLOR_KEYER_EN_MASK                                                    0x00000001L
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__LUMA_KEYER_EN_MASK                                                     0x00000002L
+#define CNVC_CFG2_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE_MASK                                                  0x00000030L
+//CNVC_CFG2_COLOR_KEYER_ALPHA
+#define CNVC_CFG2_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW__SHIFT                                             0x0
+#define CNVC_CFG2_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH__SHIFT                                            0x10
+#define CNVC_CFG2_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG2_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG2_COLOR_KEYER_RED
+#define CNVC_CFG2_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW__SHIFT                                                 0x0
+#define CNVC_CFG2_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH__SHIFT                                                0x10
+#define CNVC_CFG2_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW_MASK                                                   0x0000FFFFL
+#define CNVC_CFG2_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH_MASK                                                  0xFFFF0000L
+//CNVC_CFG2_COLOR_KEYER_GREEN
+#define CNVC_CFG2_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW__SHIFT                                             0x0
+#define CNVC_CFG2_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH__SHIFT                                            0x10
+#define CNVC_CFG2_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG2_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG2_COLOR_KEYER_BLUE
+#define CNVC_CFG2_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW__SHIFT                                               0x0
+#define CNVC_CFG2_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH__SHIFT                                              0x10
+#define CNVC_CFG2_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW_MASK                                                 0x0000FFFFL
+#define CNVC_CFG2_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH_MASK                                                0xFFFF0000L
+//CNVC_CFG2_ALPHA_2BIT_LUT01
+#define CNVC_CFG2_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0__SHIFT                                                    0x0
+#define CNVC_CFG2_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1__SHIFT                                                    0x10
+#define CNVC_CFG2_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0_MASK                                                      0x00000FFFL
+#define CNVC_CFG2_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1_MASK                                                      0x0FFF0000L
+//CNVC_CFG2_ALPHA_2BIT_LUT23
+#define CNVC_CFG2_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2__SHIFT                                                    0x0
+#define CNVC_CFG2_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3__SHIFT                                                    0x10
+#define CNVC_CFG2_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2_MASK                                                      0x00000FFFL
+#define CNVC_CFG2_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3_MASK                                                      0x0FFF0000L
+//CNVC_CFG2_PRE_DEALPHA
+#define CNVC_CFG2_PRE_DEALPHA__PRE_DEALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG2_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG2_PRE_DEALPHA__PRE_DEALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG2_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG2_PRE_CSC_MODE
+#define CNVC_CFG2_PRE_CSC_MODE__PRE_CSC_MODE__SHIFT                                                           0x0
+#define CNVC_CFG2_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT__SHIFT                                                   0x2
+#define CNVC_CFG2_PRE_CSC_MODE__PRE_CSC_MODE_MASK                                                             0x00000003L
+#define CNVC_CFG2_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT_MASK                                                     0x0000000CL
+//CNVC_CFG2_PRE_CSC_C11_C12
+#define CNVC_CFG2_PRE_CSC_C11_C12__PRE_CSC_C11__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C11_C12__PRE_CSC_C12__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C11_C12__PRE_CSC_C11_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C11_C12__PRE_CSC_C12_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_C13_C14
+#define CNVC_CFG2_PRE_CSC_C13_C14__PRE_CSC_C13__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C13_C14__PRE_CSC_C14__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C13_C14__PRE_CSC_C13_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C13_C14__PRE_CSC_C14_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_C21_C22
+#define CNVC_CFG2_PRE_CSC_C21_C22__PRE_CSC_C21__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C21_C22__PRE_CSC_C22__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C21_C22__PRE_CSC_C21_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C21_C22__PRE_CSC_C22_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_C23_C24
+#define CNVC_CFG2_PRE_CSC_C23_C24__PRE_CSC_C23__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C23_C24__PRE_CSC_C24__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C23_C24__PRE_CSC_C23_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C23_C24__PRE_CSC_C24_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_C31_C32
+#define CNVC_CFG2_PRE_CSC_C31_C32__PRE_CSC_C31__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C31_C32__PRE_CSC_C32__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C31_C32__PRE_CSC_C31_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C31_C32__PRE_CSC_C32_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_C33_C34
+#define CNVC_CFG2_PRE_CSC_C33_C34__PRE_CSC_C33__SHIFT                                                         0x0
+#define CNVC_CFG2_PRE_CSC_C33_C34__PRE_CSC_C34__SHIFT                                                         0x10
+#define CNVC_CFG2_PRE_CSC_C33_C34__PRE_CSC_C33_MASK                                                           0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_C33_C34__PRE_CSC_C34_MASK                                                           0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C11_C12
+#define CNVC_CFG2_PRE_CSC_B_C11_C12__PRE_CSC_B_C11__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C11_C12__PRE_CSC_B_C12__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C11_C12__PRE_CSC_B_C11_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C11_C12__PRE_CSC_B_C12_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C13_C14
+#define CNVC_CFG2_PRE_CSC_B_C13_C14__PRE_CSC_B_C13__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C13_C14__PRE_CSC_B_C14__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C13_C14__PRE_CSC_B_C13_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C13_C14__PRE_CSC_B_C14_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C21_C22
+#define CNVC_CFG2_PRE_CSC_B_C21_C22__PRE_CSC_B_C21__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C21_C22__PRE_CSC_B_C22__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C21_C22__PRE_CSC_B_C21_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C21_C22__PRE_CSC_B_C22_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C23_C24
+#define CNVC_CFG2_PRE_CSC_B_C23_C24__PRE_CSC_B_C23__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C23_C24__PRE_CSC_B_C24__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C23_C24__PRE_CSC_B_C23_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C23_C24__PRE_CSC_B_C24_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C31_C32
+#define CNVC_CFG2_PRE_CSC_B_C31_C32__PRE_CSC_B_C31__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C31_C32__PRE_CSC_B_C32__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C31_C32__PRE_CSC_B_C31_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C31_C32__PRE_CSC_B_C32_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_PRE_CSC_B_C33_C34
+#define CNVC_CFG2_PRE_CSC_B_C33_C34__PRE_CSC_B_C33__SHIFT                                                     0x0
+#define CNVC_CFG2_PRE_CSC_B_C33_C34__PRE_CSC_B_C34__SHIFT                                                     0x10
+#define CNVC_CFG2_PRE_CSC_B_C33_C34__PRE_CSC_B_C33_MASK                                                       0x0000FFFFL
+#define CNVC_CFG2_PRE_CSC_B_C33_C34__PRE_CSC_B_C34_MASK                                                       0xFFFF0000L
+//CNVC_CFG2_CNVC_COEF_FORMAT
+#define CNVC_CFG2_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT__SHIFT                                                0x0
+#define CNVC_CFG2_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT_MASK                                                  0x00000001L
+//CNVC_CFG2_PRE_GAM
+#define CNVC_CFG2_PRE_GAM__PRE_GAM_MODE__SHIFT                                                                0x0
+#define CNVC_CFG2_PRE_GAM__PRE_DEGAM_SELECT__SHIFT                                                            0x4
+#define CNVC_CFG2_PRE_GAM__PRE_REGAM_SELECT__SHIFT                                                            0x7
+#define CNVC_CFG2_PRE_GAM__PRE_GAM_MODE_MASK                                                                  0x00000003L
+#define CNVC_CFG2_PRE_GAM__PRE_DEGAM_SELECT_MASK                                                              0x00000070L
+#define CNVC_CFG2_PRE_GAM__PRE_REGAM_SELECT_MASK                                                              0x00000080L
+//CNVC_CFG2_PRE_REALPHA
+#define CNVC_CFG2_PRE_REALPHA__PRE_REALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG2_PRE_REALPHA__PRE_REALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG2_PRE_REALPHA__PRE_REALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG2_PRE_REALPHA__PRE_REALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG2_PIX_DROP_CNTL
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_DROP_EN__SHIFT                                                           0x0
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_LUMA_DROP__SHIFT                                                         0x4
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_CHROMA_DROP__SHIFT                                                       0x8
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_DROP_EN_MASK                                                             0x00000001L
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_LUMA_DROP_MASK                                                           0x000000F0L
+#define CNVC_CFG2_PIX_DROP_CNTL__PIX_CHROMA_DROP_MASK                                                         0x00000F00L
+//CNVC_CFG2_PIX_DROP_OUT
+#define CNVC_CFG2_PIX_DROP_OUT__PIX_DROP_OUT_L__SHIFT                                                         0x0
+#define CNVC_CFG2_PIX_DROP_OUT__PIX_DROP_OUT_C__SHIFT                                                         0x10
+#define CNVC_CFG2_PIX_DROP_OUT__PIX_DROP_OUT_L_MASK                                                           0x00003FFFL
+#define CNVC_CFG2_PIX_DROP_OUT__PIX_DROP_OUT_C_MASK                                                           0x3FFF0000L
+//CNVC_CFG2_CNVC_UPSP_MODE
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_MODE__SHIFT                                                            0x0
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE__SHIFT                                                   0x2
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS__SHIFT                                                      0x4
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_INIT_INT__SHIFT                                                      0x8
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC__SHIFT                                                     0xc
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS__SHIFT                                                      0x10
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_INIT_INT__SHIFT                                                      0x14
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC__SHIFT                                                     0x18
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_MODE_MASK                                                              0x00000003L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE_MASK                                                     0x00000004L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS_MASK                                                        0x00000010L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_INIT_INT_MASK                                                        0x00000700L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC_MASK                                                       0x00001000L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS_MASK                                                        0x00010000L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_INIT_INT_MASK                                                        0x00700000L
+#define CNVC_CFG2_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC_MASK                                                       0x01000000L
+//CNVC_CFG2_CNVC_UPSP_V_COEF_P0
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG2_CNVC_UPSP_V_COEF_P1
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG2_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG2_CNVC_UPSP_H_COEF_P0
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG2_CNVC_UPSP_H_COEF_P1
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG2_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG2_CNVC_UPSP_CLAMP
+#define CNVC_CFG2_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX__SHIFT                                                      0x0
+#define CNVC_CFG2_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN__SHIFT                                                      0x10
+#define CNVC_CFG2_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX_MASK                                                        0x00000FFFL
+#define CNVC_CFG2_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN_MASK                                                        0x0FFF0000L
+//CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE__SHIFT                                           0x0
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS__SHIFT                                             0x2
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE__SHIFT                                           0x10
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE_MASK                                             0x00000003L
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS_MASK                                               0x00000004L
+#define CNVC_CFG2_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE_MASK                                             0x00030000L
+//CNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//CNVC_CFG2_CNVC_CFG_TEST_DEBUG_DATA
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define CNVC_CFG2_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cm_cur_dispdec
+//CM_CUR2_CURSOR0_CONTROL
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_ENABLE__SHIFT                                                           0x0
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_EXPANSION_MODE__SHIFT                                                   0x1
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_PIX_INV_MODE__SHIFT                                                     0x2
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_ROM_EN__SHIFT                                                           0x3
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_MODE__SHIFT                                                             0x4
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN__SHIFT                                               0x7
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_UPDATE_PENDING__SHIFT                                                   0x10
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_ENABLE_MASK                                                             0x00000001L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_EXPANSION_MODE_MASK                                                     0x00000002L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_PIX_INV_MODE_MASK                                                       0x00000004L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_ROM_EN_MASK                                                             0x00000008L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_MODE_MASK                                                               0x00000070L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN_MASK                                                 0x00000080L
+#define CM_CUR2_CURSOR0_CONTROL__CUR0_UPDATE_PENDING_MASK                                                     0x00010000L
+//CM_CUR2_CURSOR0_COLOR0
+#define CM_CUR2_CURSOR0_COLOR0__CUR0_COLOR0__SHIFT                                                            0x0
+#define CM_CUR2_CURSOR0_COLOR0__CUR0_COLOR0_MASK                                                              0x00FFFFFFL
+//CM_CUR2_CURSOR0_COLOR1
+#define CM_CUR2_CURSOR0_COLOR1__CUR0_COLOR1__SHIFT                                                            0x0
+#define CM_CUR2_CURSOR0_COLOR1__CUR0_COLOR1_MASK                                                              0x00FFFFFFL
+//CM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y__SHIFT                                           0x0
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y__SHIFT                                            0x10
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y_MASK                                             0x0000FFFFL
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y_MASK                                              0xFFFF0000L
+//CM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB__SHIFT                                   0x0
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB__SHIFT                                    0x10
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB_MASK                                     0x0000FFFFL
+#define CM_CUR2_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB_MASK                                      0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_MODE
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE__SHIFT                                                     0x0
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT__SHIFT                                             0x2
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT__SHIFT                                              0x4
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_MASK                                                       0x00000003L
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT_MASK                                               0x0000000CL
+#define CM_CUR2_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT_MASK                                                0x00000010L
+//CM_CUR2_CUR0_MATRIX_C11_C12_A
+#define CM_CUR2_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C13_C14_A
+#define CM_CUR2_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C21_C22_A
+#define CM_CUR2_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C23_C24_A
+#define CM_CUR2_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C31_C32_A
+#define CM_CUR2_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C33_C34_A
+#define CM_CUR2_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C11_C12_B
+#define CM_CUR2_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C13_C14_B
+#define CM_CUR2_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C21_C22_B
+#define CM_CUR2_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C23_C24_B
+#define CM_CUR2_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C31_C32_B
+#define CM_CUR2_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CUR0_MATRIX_C33_C34_B
+#define CM_CUR2_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B__SHIFT                                               0x0
+#define CM_CUR2_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B__SHIFT                                               0x10
+#define CM_CUR2_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B_MASK                                                 0x0000FFFFL
+#define CM_CUR2_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B_MASK                                                 0xFFFF0000L
+//CM_CUR2_CM_CUR0_TEST_DEBUG_INDEX
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX__SHIFT                                     0x0
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN__SHIFT                                  0x8
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX_MASK                                       0x000000FFL
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN_MASK                                    0x00000100L
+//CM_CUR2_CM_CUR0_TEST_DEBUG_DATA
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA__SHIFT                                       0x0
+#define CM_CUR2_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA_MASK                                         0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dscl_dispdec
+//DSCL2_SCL_COEF_RAM_TAP_SELECT
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX__SHIFT                                       0x0
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE__SHIFT                                              0x8
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE__SHIFT                                        0x10
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX_MASK                                         0x00000003L
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE_MASK                                                0x00003F00L
+#define DSCL2_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE_MASK                                          0x00070000L
+//DSCL2_SCL_COEF_RAM_TAP_DATA
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF__SHIFT                                        0x0
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN__SHIFT                                     0xf
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF__SHIFT                                         0x10
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN__SHIFT                                      0x1f
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_MASK                                          0x00003FFFL
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN_MASK                                       0x00008000L
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_MASK                                           0x3FFF0000L
+#define DSCL2_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN_MASK                                        0x80000000L
+//DSCL2_SCL_MODE
+#define DSCL2_SCL_MODE__DSCL_MODE__SHIFT                                                                      0x0
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT__SHIFT                                                            0x8
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT__SHIFT                                                    0xc
+#define DSCL2_SCL_MODE__SCL_CHROMA_COEF_MODE__SHIFT                                                           0x10
+#define DSCL2_SCL_MODE__SCL_ALPHA_COEF_MODE__SHIFT                                                            0x14
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT_RD__SHIFT                                                         0x18
+#define DSCL2_SCL_MODE__DSCL_MODE_MASK                                                                        0x00000007L
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT_MASK                                                              0x00000100L
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT_MASK                                                      0x00001000L
+#define DSCL2_SCL_MODE__SCL_CHROMA_COEF_MODE_MASK                                                             0x00010000L
+#define DSCL2_SCL_MODE__SCL_ALPHA_COEF_MODE_MASK                                                              0x00100000L
+#define DSCL2_SCL_MODE__SCL_COEF_RAM_SELECT_RD_MASK                                                           0x01000000L
+//DSCL2_SCL_TAP_CONTROL
+#define DSCL2_SCL_TAP_CONTROL__SCL_V_NUM_TAPS__SHIFT                                                          0x0
+#define DSCL2_SCL_TAP_CONTROL__SCL_H_NUM_TAPS__SHIFT                                                          0x4
+#define DSCL2_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C__SHIFT                                                        0x8
+#define DSCL2_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C__SHIFT                                                        0xc
+#define DSCL2_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_MASK                                                            0x00000007L
+#define DSCL2_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_MASK                                                            0x00000070L
+#define DSCL2_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C_MASK                                                          0x00000700L
+#define DSCL2_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C_MASK                                                          0x00007000L
+//DSCL2_DSCL_CONTROL
+#define DSCL2_DSCL_CONTROL__SCL_BOUNDARY_MODE__SHIFT                                                          0x0
+#define DSCL2_DSCL_CONTROL__SCL_BOUNDARY_MODE_MASK                                                            0x00000001L
+//DSCL2_DSCL_2TAP_CONTROL
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x0
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN__SHIFT                                                   0x4
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR__SHIFT                                               0x8
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x10
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN__SHIFT                                                   0x14
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR__SHIFT                                               0x18
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN_MASK                                             0x00000001L
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN_MASK                                                     0x00000010L
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR_MASK                                                 0x00000700L
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN_MASK                                             0x00010000L
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN_MASK                                                     0x00100000L
+#define DSCL2_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR_MASK                                                 0x07000000L
+//DSCL2_SCL_MANUAL_REPLICATE_CONTROL
+#define DSCL2_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR__SHIFT                              0x0
+#define DSCL2_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR__SHIFT                              0x8
+#define DSCL2_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR_MASK                                0x0000000FL
+#define DSCL2_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR_MASK                                0x00000F00L
+//DSCL2_SCL_HORZ_FILTER_SCALE_RATIO
+#define DSCL2_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL2_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL2_SCL_HORZ_FILTER_INIT
+#define DSCL2_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL2_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT__SHIFT                                                     0x18
+#define DSCL2_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL2_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT_MASK                                                       0x0F000000L
+//DSCL2_SCL_HORZ_FILTER_SCALE_RATIO_C
+#define DSCL2_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL2_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL2_SCL_HORZ_FILTER_INIT_C
+#define DSCL2_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL2_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL2_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL2_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL2_SCL_VERT_FILTER_SCALE_RATIO
+#define DSCL2_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL2_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL2_SCL_VERT_FILTER_INIT
+#define DSCL2_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL2_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT__SHIFT                                                     0x18
+#define DSCL2_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL2_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT_MASK                                                       0x0F000000L
+//DSCL2_SCL_VERT_FILTER_SCALE_RATIO_C
+#define DSCL2_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL2_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL2_SCL_VERT_FILTER_INIT_C
+#define DSCL2_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL2_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL2_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL2_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL2_SCL_BLACK_COLOR
+#define DSCL2_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y__SHIFT                                                   0x0
+#define DSCL2_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR__SHIFT                                                    0x10
+#define DSCL2_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y_MASK                                                     0x0000FFFFL
+#define DSCL2_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR_MASK                                                      0xFFFF0000L
+//DSCL2_DSCL_UPDATE
+#define DSCL2_DSCL_UPDATE__SCL_UPDATE_PENDING__SHIFT                                                          0x0
+#define DSCL2_DSCL_UPDATE__SCL_UPDATE_PENDING_MASK                                                            0x00000001L
+//DSCL2_DSCL_AUTOCAL
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_MODE__SHIFT                                                               0x0
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE__SHIFT                                                          0x2
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE__SHIFT                                                           0x8
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_PIPE_ID__SHIFT                                                            0xc
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_MODE_MASK                                                                 0x00000003L
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE_MASK                                                            0x00000004L
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE_MASK                                                             0x00000300L
+#define DSCL2_DSCL_AUTOCAL__AUTOCAL_PIPE_ID_MASK                                                              0x00003000L
+//DSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT
+#define DSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT__SHIFT                                         0x0
+#define DSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT__SHIFT                                          0x10
+#define DSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT_MASK                                           0x00003FFFL
+#define DSCL2_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT_MASK                                            0x3FFF0000L
+//DSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM
+#define DSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM__SHIFT                                        0x0
+#define DSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP__SHIFT                                           0x10
+#define DSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM_MASK                                          0x00003FFFL
+#define DSCL2_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP_MASK                                             0x3FFF0000L
+//DSCL2_OTG_H_BLANK
+#define DSCL2_OTG_H_BLANK__OTG_H_BLANK_START__SHIFT                                                           0x0
+#define DSCL2_OTG_H_BLANK__OTG_H_BLANK_END__SHIFT                                                             0x10
+#define DSCL2_OTG_H_BLANK__OTG_H_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL2_OTG_H_BLANK__OTG_H_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL2_OTG_V_BLANK
+#define DSCL2_OTG_V_BLANK__OTG_V_BLANK_START__SHIFT                                                           0x0
+#define DSCL2_OTG_V_BLANK__OTG_V_BLANK_END__SHIFT                                                             0x10
+#define DSCL2_OTG_V_BLANK__OTG_V_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL2_OTG_V_BLANK__OTG_V_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL2_RECOUT_START
+#define DSCL2_RECOUT_START__RECOUT_START_X__SHIFT                                                             0x0
+#define DSCL2_RECOUT_START__RECOUT_START_Y__SHIFT                                                             0x10
+#define DSCL2_RECOUT_START__RECOUT_START_X_MASK                                                               0x00003FFFL
+#define DSCL2_RECOUT_START__RECOUT_START_Y_MASK                                                               0x3FFF0000L
+//DSCL2_RECOUT_SIZE
+#define DSCL2_RECOUT_SIZE__RECOUT_WIDTH__SHIFT                                                                0x0
+#define DSCL2_RECOUT_SIZE__RECOUT_HEIGHT__SHIFT                                                               0x10
+#define DSCL2_RECOUT_SIZE__RECOUT_WIDTH_MASK                                                                  0x00003FFFL
+#define DSCL2_RECOUT_SIZE__RECOUT_HEIGHT_MASK                                                                 0x3FFF0000L
+//DSCL2_MPC_SIZE
+#define DSCL2_MPC_SIZE__MPC_WIDTH__SHIFT                                                                      0x0
+#define DSCL2_MPC_SIZE__MPC_HEIGHT__SHIFT                                                                     0x10
+#define DSCL2_MPC_SIZE__MPC_WIDTH_MASK                                                                        0x00003FFFL
+#define DSCL2_MPC_SIZE__MPC_HEIGHT_MASK                                                                       0x3FFF0000L
+//DSCL2_LB_DATA_FORMAT
+#define DSCL2_LB_DATA_FORMAT__ALPHA_EN__SHIFT                                                                 0x4
+#define DSCL2_LB_DATA_FORMAT__ALPHA_EN_MASK                                                                   0x00000010L
+//DSCL2_LB_MEMORY_CTRL
+#define DSCL2_LB_MEMORY_CTRL__MEMORY_CONFIG__SHIFT                                                            0x0
+#define DSCL2_LB_MEMORY_CTRL__LB_MAX_PARTITIONS__SHIFT                                                        0x8
+#define DSCL2_LB_MEMORY_CTRL__LB_NUM_PARTITIONS__SHIFT                                                        0x10
+#define DSCL2_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C__SHIFT                                                      0x18
+#define DSCL2_LB_MEMORY_CTRL__MEMORY_CONFIG_MASK                                                              0x00000003L
+#define DSCL2_LB_MEMORY_CTRL__LB_MAX_PARTITIONS_MASK                                                          0x00003F00L
+#define DSCL2_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_MASK                                                          0x007F0000L
+#define DSCL2_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C_MASK                                                        0x7F000000L
+//DSCL2_LB_V_COUNTER
+#define DSCL2_LB_V_COUNTER__V_COUNTER__SHIFT                                                                  0x0
+#define DSCL2_LB_V_COUNTER__V_COUNTER_C__SHIFT                                                                0x10
+#define DSCL2_LB_V_COUNTER__V_COUNTER_MASK                                                                    0x00001FFFL
+#define DSCL2_LB_V_COUNTER__V_COUNTER_C_MASK                                                                  0x1FFF0000L
+//DSCL2_DSCL_MEM_PWR_CTRL
+#define DSCL2_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE__SHIFT                                                     0x0
+#define DSCL2_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS__SHIFT                                                       0x2
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE__SHIFT                                                   0x4
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS__SHIFT                                                     0x6
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE__SHIFT                                                   0x8
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS__SHIFT                                                     0xa
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE__SHIFT                                                   0xc
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS__SHIFT                                                     0xe
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE__SHIFT                                                   0x10
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS__SHIFT                                                     0x12
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE__SHIFT                                                   0x14
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS__SHIFT                                                     0x16
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE__SHIFT                                                   0x18
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS__SHIFT                                                     0x1a
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE__SHIFT                                                       0x1c
+#define DSCL2_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE_MASK                                                       0x00000003L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS_MASK                                                         0x00000004L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE_MASK                                                     0x00000030L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS_MASK                                                       0x00000040L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE_MASK                                                     0x00000300L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS_MASK                                                       0x00000400L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE_MASK                                                     0x00003000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS_MASK                                                       0x00004000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE_MASK                                                     0x00030000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS_MASK                                                       0x00040000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE_MASK                                                     0x00300000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS_MASK                                                       0x00400000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE_MASK                                                     0x03000000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS_MASK                                                       0x04000000L
+#define DSCL2_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE_MASK                                                         0x10000000L
+//DSCL2_DSCL_MEM_PWR_STATUS
+#define DSCL2_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE__SHIFT                                                   0x0
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE__SHIFT                                                 0x2
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE__SHIFT                                                 0x4
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE__SHIFT                                                 0x6
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE__SHIFT                                                 0x8
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE__SHIFT                                                 0xa
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE__SHIFT                                                 0xc
+#define DSCL2_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE_MASK                                                     0x00000003L
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE_MASK                                                   0x0000000CL
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE_MASK                                                   0x00000030L
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE_MASK                                                   0x000000C0L
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE_MASK                                                   0x00000300L
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE_MASK                                                   0x00000C00L
+#define DSCL2_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE_MASK                                                   0x00003000L
+//DSCL2_OBUF_CONTROL
+#define DSCL2_OBUF_CONTROL__OBUF_BYPASS__SHIFT                                                                0x0
+#define DSCL2_OBUF_CONTROL__OBUF_USE_FULL_BUFFER__SHIFT                                                       0x1
+#define DSCL2_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH__SHIFT                                                  0x2
+#define DSCL2_OBUF_CONTROL__OBUF_OUT_HOLD_CNT__SHIFT                                                          0x4
+#define DSCL2_OBUF_CONTROL__OBUF_BYPASS_MASK                                                                  0x00000001L
+#define DSCL2_OBUF_CONTROL__OBUF_USE_FULL_BUFFER_MASK                                                         0x00000002L
+#define DSCL2_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH_MASK                                                    0x00000004L
+#define DSCL2_OBUF_CONTROL__OBUF_OUT_HOLD_CNT_MASK                                                            0x000000F0L
+//DSCL2_OBUF_MEM_PWR_CTRL
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE__SHIFT                                                    0x0
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS__SHIFT                                                      0x2
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE__SHIFT                                                     0x8
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE__SHIFT                                                    0x10
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE_MASK                                                      0x00000003L
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS_MASK                                                        0x00000004L
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE_MASK                                                       0x00000100L
+#define DSCL2_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE_MASK                                                      0x00030000L
+//DSCL2_DSCL_EASF_H_MODE
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_EN__SHIFT                                                          0x0
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_EN_MASK                                                            0x00000001L
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL2_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL2_DSCL_EASF_V_MODE
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_EN__SHIFT                                                          0x0
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_EN_MASK                                                            0x00000001L
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL2_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL2_DSCL_SC_MODE
+#define DSCL2_DSCL_SC_MODE__SCL_SC_MATRIX_MODE__SHIFT                                                         0x0
+#define DSCL2_DSCL_SC_MODE__SCL_SC_LTONL_EN__SHIFT                                                            0x8
+#define DSCL2_DSCL_SC_MODE__SCL_SC_MATRIX_MODE_MASK                                                           0x00000001L
+#define DSCL2_DSCL_SC_MODE__SCL_SC_LTONL_EN_MASK                                                              0x00000100L
+//DSCL2_DSCL_SC_MATRIX_C0C1
+#define DSCL2_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0__SHIFT                                                    0x0
+#define DSCL2_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1__SHIFT                                                    0x10
+#define DSCL2_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0_MASK                                                      0x0000FFFFL
+#define DSCL2_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1_MASK                                                      0xFFFF0000L
+//DSCL2_DSCL_SC_MATRIX_C2C3
+#define DSCL2_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2__SHIFT                                                    0x0
+#define DSCL2_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3__SHIFT                                                    0x10
+#define DSCL2_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2_MASK                                                      0x0000FFFFL
+#define DSCL2_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3_MASK                                                      0xFFFF0000L
+//DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL2_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL2_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT__SHIFT                    0x0
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL__SHIFT                    0x10
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT_MASK                      0x0000FFFFL
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL_MASK                      0xFFFF0000L
+//DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE__SHIFT                     0x0
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE__SHIFT                    0x10
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE_MASK                       0x0000FFFFL
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE_MASK                      0xFFFF0000L
+//DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE__SHIFT                    0x0
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET__SHIFT                   0x10
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE_MASK                      0x0000FFFFL
+#define DSCL2_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET_MASK                     0xFFFF0000L
+//DSCL2_DSCL_EASF_RINGEST_FORCE
+#define DSCL2_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE__SHIFT                                        0x0
+#define DSCL2_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE__SHIFT                                        0x10
+#define DSCL2_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE_MASK                                          0x0000FFFFL
+#define DSCL2_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE_MASK                                          0xFFFF0000L
+//DSCL2_DSCL_EASF_H_BF_CNTL
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN__SHIFT                                                   0x0
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE__SHIFT                                                 0x8
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE__SHIFT                                                 0x10
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN_MASK                                                     0x00000001L
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL2_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA__SHIFT                                         0x0
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB__SHIFT                                         0x8
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA__SHIFT                                         0x10
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB__SHIFT                                         0x18
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA_MASK                                           0x003F0000L
+#define DSCL2_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB_MASK                                           0x3F000000L
+//DSCL2_DSCL_EASF_V_BF_CNTL
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN__SHIFT                                                   0x0
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE__SHIFT                                                 0x8
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE__SHIFT                                                 0x10
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN_MASK                                                     0x00000001L
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL2_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA__SHIFT                                         0x0
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB__SHIFT                                         0x8
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA__SHIFT                                         0x10
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB__SHIFT                                         0x18
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA_MASK                                           0x003F0000L
+#define DSCL2_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB_MASK                                           0x3F000000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG1
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG2
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG3
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG4
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG5
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG6
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_H_BF1_PWL_SEG7
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG1
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG2
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG3
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG4
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG5
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG6
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL2_DSCL_EASF_V_BF1_PWL_SEG7
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL2_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG1
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG2
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG3
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG4
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_H_BF3_PWL_SEG5
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG1
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG2
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG3
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG4
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL2_DSCL_EASF_V_BF3_PWL_SEG5
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL2_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL2_ISHARP_MODE
+#define DSCL2_ISHARP_MODE__ISHARP_EN__SHIFT                                                                   0x0
+#define DSCL2_ISHARP_MODE__ISHARP_NOISEDET_EN__SHIFT                                                          0x4
+#define DSCL2_ISHARP_MODE__ISHARP_NOISEDET_MODE__SHIFT                                                        0x5
+#define DSCL2_ISHARP_MODE__ISHARP_LBA_MODE__SHIFT                                                             0x9
+#define DSCL2_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT__SHIFT                                                     0xa
+#define DSCL2_ISHARP_MODE__ISHARP_FMT_MODE__SHIFT                                                             0xb
+#define DSCL2_ISHARP_MODE__ISHARP_FMT_NORM__SHIFT                                                             0xc
+#define DSCL2_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT__SHIFT                                             0x1c
+#define DSCL2_ISHARP_MODE__ISHARP_EN_MASK                                                                     0x00000001L
+#define DSCL2_ISHARP_MODE__ISHARP_NOISEDET_EN_MASK                                                            0x00000010L
+#define DSCL2_ISHARP_MODE__ISHARP_NOISEDET_MODE_MASK                                                          0x00000060L
+#define DSCL2_ISHARP_MODE__ISHARP_LBA_MODE_MASK                                                               0x00000200L
+#define DSCL2_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_MASK                                                       0x00000400L
+#define DSCL2_ISHARP_MODE__ISHARP_FMT_MODE_MASK                                                               0x00000800L
+#define DSCL2_ISHARP_MODE__ISHARP_FMT_NORM_MASK                                                               0x0FFFF000L
+#define DSCL2_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT_MASK                                               0x10000000L
+//DSCL2_ISHARP_DELTA_CTRL
+#define DSCL2_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT__SHIFT                                          0x0
+#define DSCL2_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT_MASK                                            0x00000001L
+//DSCL2_ISHARP_DELTA_INDEX
+#define DSCL2_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX__SHIFT                                                   0x0
+#define DSCL2_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX_MASK                                                     0x0000001FL
+//DSCL2_ISHARP_DELTA_DATA
+#define DSCL2_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA__SHIFT                                                     0x0
+#define DSCL2_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA_MASK                                                       0xFFFFFFFFL
+//DSCL2_ISHARP_NLDELTA_SOFT_CLIP
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P__SHIFT                                      0x0
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P__SHIFT                                   0x1
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P__SHIFT                                   0x8
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N__SHIFT                                      0x10
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N__SHIFT                                   0x11
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N__SHIFT                                   0x18
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P_MASK                                        0x00000001L
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P_MASK                                     0x000000FEL
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P_MASK                                     0x0000FF00L
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N_MASK                                        0x00010000L
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N_MASK                                     0x00FE0000L
+#define DSCL2_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N_MASK                                     0xFF000000L
+//DSCL2_ISHARP_NOISEDET_THRESHOLD
+#define DSCL2_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE__SHIFT                                         0x0
+#define DSCL2_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE__SHIFT                                         0x10
+#define DSCL2_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE_MASK                                           0x000003FFL
+#define DSCL2_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE_MASK                                           0x03FF0000L
+//DSCL2_ISHARP_NOISE_GAIN_PWL
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN__SHIFT                                      0x0
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN__SHIFT                                        0x8
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE__SHIFT                                         0x10
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN_MASK                                        0x0000001FL
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN_MASK                                          0x00001F00L
+#define DSCL2_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE_MASK                                           0x3FFF0000L
+//DSCL2_ISHARP_LBA_PWL_SEG0
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0__SHIFT                                           0x14
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0_MASK                                              0x0003F000L
+#define DSCL2_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0_MASK                                             0x1FF00000L
+//DSCL2_ISHARP_LBA_PWL_SEG1
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1__SHIFT                                           0x14
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1_MASK                                              0x0003F000L
+#define DSCL2_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1_MASK                                             0x1FF00000L
+//DSCL2_ISHARP_LBA_PWL_SEG2
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2__SHIFT                                           0x14
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2_MASK                                              0x0003F000L
+#define DSCL2_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2_MASK                                             0x1FF00000L
+//DSCL2_ISHARP_LBA_PWL_SEG3
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3__SHIFT                                           0x14
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3_MASK                                              0x0003F000L
+#define DSCL2_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3_MASK                                             0x1FF00000L
+//DSCL2_ISHARP_LBA_PWL_SEG4
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4__SHIFT                                           0x14
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4_MASK                                              0x0003F000L
+#define DSCL2_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4_MASK                                             0x1FF00000L
+//DSCL2_ISHARP_LBA_PWL_SEG5
+#define DSCL2_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5__SHIFT                                              0x0
+#define DSCL2_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5__SHIFT                                            0xc
+#define DSCL2_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5_MASK                                                0x000003FFL
+#define DSCL2_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5_MASK                                              0x0003F000L
+//DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE__SHIFT                            0x0
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS__SHIFT                              0x2
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE__SHIFT                            0x4
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE_MASK                              0x00000003L
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS_MASK                                0x00000004L
+#define DSCL2_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE_MASK                              0x00000030L
+//DSCL2_DSCL_DEBUG
+#define DSCL2_DSCL_DEBUG__SCL_DEBUG__SHIFT                                                                    0x0
+#define DSCL2_DSCL_DEBUG__SCL_DEBUG_MASK                                                                      0xFFFFFFFFL
+//DSCL2_DSCL_TEST_DEBUG_INDEX
+#define DSCL2_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX__SHIFT                                              0x0
+#define DSCL2_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN__SHIFT                                           0x8
+#define DSCL2_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX_MASK                                                0x000000FFL
+#define DSCL2_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN_MASK                                             0x00000100L
+//DSCL2_DSCL_TEST_DEBUG_DATA
+#define DSCL2_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA__SHIFT                                                0x0
+#define DSCL2_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA_MASK                                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp2_dispdec_cm_dispdec
+//CM2_CM_CONTROL
+#define CM2_CM_CONTROL__CM_BYPASS__SHIFT                                                                      0x0
+#define CM2_CM_CONTROL__CM_UPDATE_PENDING__SHIFT                                                              0x8
+#define CM2_CM_CONTROL__CM_BYPASS_MASK                                                                        0x00000001L
+#define CM2_CM_CONTROL__CM_UPDATE_PENDING_MASK                                                                0x00000100L
+//CM2_CM_POST_CSC_CONTROL
+#define CM2_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE__SHIFT                                                      0x0
+#define CM2_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT__SHIFT                                              0x2
+#define CM2_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_MASK                                                        0x00000003L
+#define CM2_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT_MASK                                                0x0000000CL
+//CM2_CM_POST_CSC_C11_C12
+#define CM2_CM_POST_CSC_C11_C12__CM_POST_CSC_C11__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C11_C12__CM_POST_CSC_C12__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C11_C12__CM_POST_CSC_C11_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C11_C12__CM_POST_CSC_C12_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_C13_C14
+#define CM2_CM_POST_CSC_C13_C14__CM_POST_CSC_C13__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C13_C14__CM_POST_CSC_C14__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C13_C14__CM_POST_CSC_C13_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C13_C14__CM_POST_CSC_C14_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_C21_C22
+#define CM2_CM_POST_CSC_C21_C22__CM_POST_CSC_C21__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C21_C22__CM_POST_CSC_C22__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C21_C22__CM_POST_CSC_C21_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C21_C22__CM_POST_CSC_C22_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_C23_C24
+#define CM2_CM_POST_CSC_C23_C24__CM_POST_CSC_C23__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C23_C24__CM_POST_CSC_C24__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C23_C24__CM_POST_CSC_C23_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C23_C24__CM_POST_CSC_C24_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_C31_C32
+#define CM2_CM_POST_CSC_C31_C32__CM_POST_CSC_C31__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C31_C32__CM_POST_CSC_C32__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C31_C32__CM_POST_CSC_C31_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C31_C32__CM_POST_CSC_C32_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_C33_C34
+#define CM2_CM_POST_CSC_C33_C34__CM_POST_CSC_C33__SHIFT                                                       0x0
+#define CM2_CM_POST_CSC_C33_C34__CM_POST_CSC_C34__SHIFT                                                       0x10
+#define CM2_CM_POST_CSC_C33_C34__CM_POST_CSC_C33_MASK                                                         0x0000FFFFL
+#define CM2_CM_POST_CSC_C33_C34__CM_POST_CSC_C34_MASK                                                         0xFFFF0000L
+//CM2_CM_POST_CSC_B_C11_C12
+#define CM2_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12_MASK                                                     0xFFFF0000L
+//CM2_CM_POST_CSC_B_C13_C14
+#define CM2_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14_MASK                                                     0xFFFF0000L
+//CM2_CM_POST_CSC_B_C21_C22
+#define CM2_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22_MASK                                                     0xFFFF0000L
+//CM2_CM_POST_CSC_B_C23_C24
+#define CM2_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24_MASK                                                     0xFFFF0000L
+//CM2_CM_POST_CSC_B_C31_C32
+#define CM2_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32_MASK                                                     0xFFFF0000L
+//CM2_CM_POST_CSC_B_C33_C34
+#define CM2_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33__SHIFT                                                   0x0
+#define CM2_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34__SHIFT                                                   0x10
+#define CM2_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33_MASK                                                     0x0000FFFFL
+#define CM2_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34_MASK                                                     0xFFFF0000L
+//CM2_CM_BIAS_CR_R
+#define CM2_CM_BIAS_CR_R__CM_BIAS_CR_R__SHIFT                                                                 0x0
+#define CM2_CM_BIAS_CR_R__CM_BIAS_CR_R_MASK                                                                   0x0000FFFFL
+//CM2_CM_BIAS_Y_G_CB_B
+#define CM2_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G__SHIFT                                                              0x0
+#define CM2_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B__SHIFT                                                             0x10
+#define CM2_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G_MASK                                                                0x0000FFFFL
+#define CM2_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B_MASK                                                               0xFFFF0000L
+//CM2_CM_GAMCOR_CONTROL
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE__SHIFT                                                          0x0
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT__SHIFT                                                        0x2
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE__SHIFT                                                   0x3
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT__SHIFT                                                  0x4
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT__SHIFT                                                0x6
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_MASK                                                            0x00000003L
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_MASK                                                          0x00000004L
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE_MASK                                                     0x00000008L
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT_MASK                                                    0x00000030L
+#define CM2_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT_MASK                                                  0x00000040L
+//CM2_CM_GAMCOR_LUT_INDEX
+#define CM2_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX__SHIFT                                                   0x0
+#define CM2_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX_MASK                                                     0x000001FFL
+//CM2_CM_GAMCOR_LUT_DATA
+#define CM2_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA__SHIFT                                                     0x0
+#define CM2_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA_MASK                                                       0x0003FFFFL
+//CM2_CM_GAMCOR_LUT_CONTROL
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK__SHIFT                                      0x0
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL__SHIFT                                        0x3
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG__SHIFT                                              0x5
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL__SHIFT                                              0x6
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK_MASK                                        0x00000007L
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL_MASK                                          0x00000018L
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG_MASK                                                0x00000020L
+#define CM2_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL_MASK                                                0x00000040L
+//CM2_CM_GAMCOR_RAMA_START_CNTL_B
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMA_START_CNTL_G
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMA_START_CNTL_R
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_B
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_G
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_R
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_END_CNTL1_B
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_END_CNTL2_B
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMA_END_CNTL1_G
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_END_CNTL2_G
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMA_END_CNTL1_R
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMA_END_CNTL2_R
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMA_OFFSET_B
+#define CM2_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMA_OFFSET_G
+#define CM2_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMA_OFFSET_R
+#define CM2_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMA_REGION_0_1
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_2_3
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_4_5
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_6_7
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_8_9
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_10_11
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_12_13
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_14_15
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_16_17
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_18_19
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_20_21
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_22_23
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_24_25
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_26_27
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_28_29
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_30_31
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMA_REGION_32_33
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_START_CNTL_B
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMB_START_CNTL_G
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMB_START_CNTL_R
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R__SHIFT                             0x0
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM2_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM2_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_B
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_G
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_R
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM2_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_END_CNTL1_B
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_END_CNTL2_B
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMB_END_CNTL1_G
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_END_CNTL2_G
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMB_END_CNTL1_R
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM2_CM_GAMCOR_RAMB_END_CNTL2_R
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R__SHIFT                                0x0
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM2_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM2_CM_GAMCOR_RAMB_OFFSET_B
+#define CM2_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMB_OFFSET_G
+#define CM2_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMB_OFFSET_R
+#define CM2_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R__SHIFT                                           0x0
+#define CM2_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R_MASK                                             0x0007FFFFL
+//CM2_CM_GAMCOR_RAMB_REGION_0_1
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_2_3
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_4_5
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_6_7
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_8_9
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_10_11
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_12_13
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_14_15
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_16_17
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_18_19
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_20_21
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_22_23
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_24_25
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_26_27
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_28_29
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_30_31
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_GAMCOR_RAMB_REGION_32_33
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM2_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM2_CM_HDR_MULT_COEF
+#define CM2_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF__SHIFT                                                         0x0
+#define CM2_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF_MASK                                                           0x0007FFFFL
+//CM2_CM_MEM_PWR_CTRL
+#define CM2_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE__SHIFT                                                      0x0
+#define CM2_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS__SHIFT                                                        0x2
+#define CM2_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE__SHIFT                                                        0x8
+#define CM2_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS__SHIFT                                                          0x9
+#define CM2_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE_MASK                                                        0x00000003L
+#define CM2_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS_MASK                                                          0x00000004L
+#define CM2_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE_MASK                                                          0x00000100L
+#define CM2_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS_MASK                                                            0x00000200L
+//CM2_CM_MEM_PWR_STATUS
+#define CM2_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE__SHIFT                                                    0x0
+#define CM2_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE__SHIFT                                                      0x8
+#define CM2_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE_MASK                                                      0x00000003L
+#define CM2_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE_MASK                                                        0x00000100L
+//CM2_CM_DEALPHA
+#define CM2_CM_DEALPHA__CM_DEALPHA_EN__SHIFT                                                                  0x0
+#define CM2_CM_DEALPHA__CM_DEALPHA_ABLND__SHIFT                                                               0x1
+#define CM2_CM_DEALPHA__CM_DEALPHA_EN_MASK                                                                    0x00000001L
+#define CM2_CM_DEALPHA__CM_DEALPHA_ABLND_MASK                                                                 0x00000002L
+//CM2_CM_COEF_FORMAT
+#define CM2_CM_COEF_FORMAT__CM_BIAS_FORMAT__SHIFT                                                             0x0
+#define CM2_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT__SHIFT                                                    0x4
+#define CM2_CM_COEF_FORMAT__CM_BIAS_FORMAT_MASK                                                               0x00000001L
+#define CM2_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT_MASK                                                      0x00000010L
+//CM2_CM_TEST_DEBUG_INDEX
+#define CM2_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX__SHIFT                                                   0x0
+#define CM2_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN__SHIFT                                                0x8
+#define CM2_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX_MASK                                                     0x000000FFL
+#define CM2_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN_MASK                                                  0x00000100L
+//CM2_CM_TEST_DEBUG_DATA
+#define CM2_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define CM2_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//CM2_CM_HIST_CNTL
+#define CM2_CM_HIST_CNTL__CM_HIST_SEL__SHIFT                                                                  0x0
+#define CM2_CM_HIST_CNTL__CM_HIST_CH_EN__SHIFT                                                                0x2
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC1_SEL__SHIFT                                                             0x4
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC2_SEL__SHIFT                                                             0x5
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC3_SEL__SHIFT                                                             0x6
+#define CM2_CM_HIST_CNTL__CM_HIST_CH1_XBAR__SHIFT                                                             0x7
+#define CM2_CM_HIST_CNTL__CM_HIST_CH2_XBAR__SHIFT                                                             0x9
+#define CM2_CM_HIST_CNTL__CM_HIST_CH3_XBAR__SHIFT                                                             0xb
+#define CM2_CM_HIST_CNTL__CM_HIST_FORMAT__SHIFT                                                               0xd
+#define CM2_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK__SHIFT                                                    0xf
+#define CM2_CM_HIST_CNTL__CM_HIST_SEL_MASK                                                                    0x00000003L
+#define CM2_CM_HIST_CNTL__CM_HIST_CH_EN_MASK                                                                  0x0000000CL
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC1_SEL_MASK                                                               0x00000010L
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC2_SEL_MASK                                                               0x00000020L
+#define CM2_CM_HIST_CNTL__CM_HIST_SRC3_SEL_MASK                                                               0x00000040L
+#define CM2_CM_HIST_CNTL__CM_HIST_CH1_XBAR_MASK                                                               0x00000180L
+#define CM2_CM_HIST_CNTL__CM_HIST_CH2_XBAR_MASK                                                               0x00000600L
+#define CM2_CM_HIST_CNTL__CM_HIST_CH3_XBAR_MASK                                                               0x00001800L
+#define CM2_CM_HIST_CNTL__CM_HIST_FORMAT_MASK                                                                 0x00006000L
+#define CM2_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK_MASK                                                      0x00038000L
+//CM2_CM_HIST_SCALE_SRC1
+#define CM2_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1__SHIFT                                                     0x0
+#define CM2_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1_MASK                                                       0x0007FFFFL
+//CM2_CM_HIST_COEFA_SRC2
+#define CM2_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2__SHIFT                                                     0x0
+#define CM2_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2_MASK                                                       0x0007FFFFL
+//CM2_CM_HIST_COEFB_SRC2
+#define CM2_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2__SHIFT                                                     0x0
+#define CM2_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2_MASK                                                       0x0007FFFFL
+//CM2_CM_HIST_COEFC_SRC2
+#define CM2_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2__SHIFT                                                     0x0
+#define CM2_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2_MASK                                                       0x0007FFFFL
+//CM2_CM_HIST_SCALE_SRC3
+#define CM2_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3__SHIFT                                                     0x0
+#define CM2_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3_MASK                                                       0x0007FFFFL
+//CM2_CM_HIST_BIAS_SRC1
+#define CM2_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1__SHIFT                                                       0x0
+#define CM2_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1_MASK                                                         0x0007FFFFL
+//CM2_CM_HIST_BIAS_SRC2
+#define CM2_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2__SHIFT                                                       0x0
+#define CM2_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2_MASK                                                         0x0007FFFFL
+//CM2_CM_HIST_BIAS_SRC3
+#define CM2_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3__SHIFT                                                       0x0
+#define CM2_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3_MASK                                                         0x0007FFFFL
+//CM2_CM_HIST_LOCK
+#define CM2_CM_HIST_LOCK__CM_HIST_LOCK__SHIFT                                                                 0x0
+#define CM2_CM_HIST_LOCK__CM_HIST_LOCK_MASK                                                                   0x00000001L
+//CM2_CM_HIST_INDEX
+#define CM2_CM_HIST_INDEX__CM_HIST_INDEX__SHIFT                                                               0x0
+#define CM2_CM_HIST_INDEX__CM_HIST_INDEX_MASK                                                                 0x000000FFL
+//CM2_CM_HIST_DATA
+#define CM2_CM_HIST_DATA__CM_HIST_DATA__SHIFT                                                                 0x0
+#define CM2_CM_HIST_DATA__CM_HIST_DATA_MASK                                                                   0x01FFFFFFL
+//CM2_CM_HIST_STATUS
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS__SHIFT                                                    0x0
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS__SHIFT                                                    0x1
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT__SHIFT                                                 0x2
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ__SHIFT                                                    0x3
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED__SHIFT                                              0x4
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT__SHIFT                                      0x5
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT__SHIFT                                          0x6
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED__SHIFT                                            0xc
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0xd
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED__SHIFT                                            0x10
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0x11
+#define CM2_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW__SHIFT                                                     0x18
+#define CM2_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT__SHIFT                                             0x19
+#define CM2_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE__SHIFT                                                 0x1a
+#define CM2_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT__SHIFT                                         0x1b
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS_MASK                                                      0x00000001L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS_MASK                                                      0x00000002L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT_MASK                                                   0x00000004L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ_MASK                                                      0x00000008L
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_MASK                                                0x00000010L
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT_MASK                                        0x00000020L
+#define CM2_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT_MASK                                            0x000001C0L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_MASK                                              0x00001000L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00002000L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_MASK                                              0x00010000L
+#define CM2_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00020000L
+#define CM2_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_MASK                                                       0x01000000L
+#define CM2_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT_MASK                                               0x02000000L
+#define CM2_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_MASK                                                   0x04000000L
+#define CM2_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT_MASK                                           0x08000000L
+//CM2_CM_HIST_INT_CONTROL
+#define CM2_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT__SHIFT                                                       0x0
+#define CM2_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN__SHIFT                                                    0x4
+#define CM2_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_MASK                                                         0x00000001L
+#define CM2_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN_MASK                                                      0x00000010L
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dpp_top_dispdec
+//DPP_TOP2_DPP_CONTROL
+#define DPP_TOP2_DPP_CONTROL__DPP_CLOCK_ENABLE__SHIFT                                                         0x4
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_GATE_DISABLE__SHIFT                                                    0x8
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE__SHIFT                                                0xa
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE__SHIFT                                               0xc
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE__SHIFT                                               0xd
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_R_GATE_DISABLE__SHIFT                                                    0xe
+#define DPP_TOP2_DPP_CONTROL__DISPCLK_R_GATE_DISABLE__SHIFT                                                   0x10
+#define DPP_TOP2_DPP_CONTROL__DISPCLK_G_GATE_DISABLE__SHIFT                                                   0x12
+#define DPP_TOP2_DPP_CONTROL__DPP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define DPP_TOP2_DPP_CONTROL__DPP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define DPP_TOP2_DPP_CONTROL__DPP_CLOCK_ENABLE_MASK                                                           0x00000010L
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_GATE_DISABLE_MASK                                                      0x00000100L
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE_MASK                                                  0x00000400L
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE_MASK                                                 0x00001000L
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE_MASK                                                 0x00002000L
+#define DPP_TOP2_DPP_CONTROL__DPPCLK_R_GATE_DISABLE_MASK                                                      0x00004000L
+#define DPP_TOP2_DPP_CONTROL__DISPCLK_R_GATE_DISABLE_MASK                                                     0x00010000L
+#define DPP_TOP2_DPP_CONTROL__DISPCLK_G_GATE_DISABLE_MASK                                                     0x00040000L
+#define DPP_TOP2_DPP_CONTROL__DPP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define DPP_TOP2_DPP_CONTROL__DPP_TEST_CLK_SEL_MASK                                                           0x70000000L
+//DPP_TOP2_DPP_SOFT_RESET
+#define DPP_TOP2_DPP_SOFT_RESET__CNVC_SOFT_RESET__SHIFT                                                       0x0
+#define DPP_TOP2_DPP_SOFT_RESET__DSCL_SOFT_RESET__SHIFT                                                       0x4
+#define DPP_TOP2_DPP_SOFT_RESET__CM_SOFT_RESET__SHIFT                                                         0x8
+#define DPP_TOP2_DPP_SOFT_RESET__OBUF_SOFT_RESET__SHIFT                                                       0xc
+#define DPP_TOP2_DPP_SOFT_RESET__HIST_SOFT_RESET__SHIFT                                                       0x10
+#define DPP_TOP2_DPP_SOFT_RESET__CNVC_SOFT_RESET_MASK                                                         0x00000001L
+#define DPP_TOP2_DPP_SOFT_RESET__DSCL_SOFT_RESET_MASK                                                         0x00000010L
+#define DPP_TOP2_DPP_SOFT_RESET__CM_SOFT_RESET_MASK                                                           0x00000100L
+#define DPP_TOP2_DPP_SOFT_RESET__OBUF_SOFT_RESET_MASK                                                         0x00001000L
+#define DPP_TOP2_DPP_SOFT_RESET__HIST_SOFT_RESET_MASK                                                         0x00010000L
+//DPP_TOP2_DPP_CRC_VAL_R
+#define DPP_TOP2_DPP_CRC_VAL_R__DPP_CRC_R_CR__SHIFT                                                           0x0
+#define DPP_TOP2_DPP_CRC_VAL_R__DPP_CRC_R_CR_MASK                                                             0xFFFFFFFFL
+//DPP_TOP2_DPP_CRC_VAL_G
+#define DPP_TOP2_DPP_CRC_VAL_G__DPP_CRC_G_Y__SHIFT                                                            0x0
+#define DPP_TOP2_DPP_CRC_VAL_G__DPP_CRC_G_Y_MASK                                                              0xFFFFFFFFL
+//DPP_TOP2_DPP_CRC_VAL_B
+#define DPP_TOP2_DPP_CRC_VAL_B__DPP_CRC_B_CB__SHIFT                                                           0x0
+#define DPP_TOP2_DPP_CRC_VAL_B__DPP_CRC_B_CB_MASK                                                             0xFFFFFFFFL
+//DPP_TOP2_DPP_CRC_VAL_A
+#define DPP_TOP2_DPP_CRC_VAL_A__DPP_CRC_ALPHA__SHIFT                                                          0x0
+#define DPP_TOP2_DPP_CRC_VAL_A__DPP_CRC_ALPHA_MASK                                                            0xFFFFFFFFL
+//DPP_TOP2_DPP_CRC_CTRL
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_EN__SHIFT                                                              0x0
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_CONT_EN__SHIFT                                                         0x1
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING__SHIFT                                                0x2
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL__SHIFT                                                    0x3
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_SRC_SEL__SHIFT                                                         0x4
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_STEREO_EN__SHIFT                                                       0x6
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE__SHIFT                                                     0x7
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL__SHIFT                                                  0xb
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_MASK__SHIFT                                                            0x10
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_EN_MASK                                                                0x00000001L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_CONT_EN_MASK                                                           0x00000002L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING_MASK                                                  0x00000004L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL_MASK                                                      0x00000008L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_SRC_SEL_MASK                                                           0x00000030L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_STEREO_EN_MASK                                                         0x00000040L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE_MASK                                                       0x00000180L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL_MASK                                                    0x00003800L
+#define DPP_TOP2_DPP_CRC_CTRL__DPP_CRC_MASK_MASK                                                              0xFFFF0000L
+//DPP_TOP2_HOST_READ_CONTROL
+#define DPP_TOP2_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL__SHIFT                                             0x0
+#define DPP_TOP2_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL_MASK                                               0x000000FFL
+//DPP_TOP2_DPP_DEBUG_SEL
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL__SHIFT                                               0x0
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL__SHIFT                                              0x8
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DBG_EN__SHIFT                                                             0x1f
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL_MASK                                                 0x00000007L
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL_MASK                                                0x00000700L
+#define DPP_TOP2_DPP_DEBUG_SEL__DPP_DBG_EN_MASK                                                               0x80000000L
+//DPP_TOP2_DPP_DEBUG_SPARE
+#define DPP_TOP2_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE__SHIFT                                                      0x0
+#define DPP_TOP2_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE_MASK                                                        0xFFFFFFFFL
+//DPP_TOP2_DPP_TEST_DEBUG_INDEX
+#define DPP_TOP2_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX__SHIFT                                            0x0
+#define DPP_TOP2_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN__SHIFT                                         0x8
+#define DPP_TOP2_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX_MASK                                              0x000000FFL
+#define DPP_TOP2_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN_MASK                                           0x00000100L
+//DPP_TOP2_DPP_TEST_DEBUG_DATA
+#define DPP_TOP2_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA__SHIFT                                              0x0
+#define DPP_TOP2_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA_MASK                                                0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp2_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON12_PERFCOUNTER_CNTL
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON12_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON12_PERFCOUNTER_CNTL2
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON12_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON12_PERFCOUNTER_STATE
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON12_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON12_PERFMON_CNTL
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON12_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON12_PERFMON_CNTL2
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON12_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON12_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON12_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON12_PERFMON_CVALUE_LOW
+#define DC_PERFMON12_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON12_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON12_PERFMON_HI
+#define DC_PERFMON12_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON12_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON12_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON12_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON12_PERFMON_LOW
+#define DC_PERFMON12_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON12_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON12_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON12_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON12_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cnvc_cfg_dispdec
+//CNVC_CFG3_CNVC_SURFACE_PIXEL_FORMAT
+#define CNVC_CFG3_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT__SHIFT                                 0x0
+#define CNVC_CFG3_CNVC_SURFACE_PIXEL_FORMAT__CNVC_SURFACE_PIXEL_FORMAT_MASK                                   0x0000007FL
+//CNVC_CFG3_FORMAT_CONTROL
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_EXPANSION_MODE__SHIFT                                                0x0
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CNV16__SHIFT                                                         0x4
+#define CNVC_CFG3_FORMAT_CONTROL__ALPHA_EN__SHIFT                                                             0x8
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_BYPASS__SHIFT                                                          0xc
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN__SHIFT                                                0xd
+#define CNVC_CFG3_FORMAT_CONTROL__CLAMP_POSITIVE__SHIFT                                                       0x10
+#define CNVC_CFG3_FORMAT_CONTROL__CLAMP_POSITIVE_C__SHIFT                                                     0x11
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_UPDATE_PENDING__SHIFT                                                  0x14
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_R__SHIFT                                                    0x18
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_G__SHIFT                                                    0x1a
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_B__SHIFT                                                    0x1c
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_EXPANSION_MODE_MASK                                                  0x00000001L
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CNV16_MASK                                                           0x00000010L
+#define CNVC_CFG3_FORMAT_CONTROL__ALPHA_EN_MASK                                                               0x00000100L
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_BYPASS_MASK                                                            0x00001000L
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_BYPASS_MSB_ALIGN_MASK                                                  0x00002000L
+#define CNVC_CFG3_FORMAT_CONTROL__CLAMP_POSITIVE_MASK                                                         0x00010000L
+#define CNVC_CFG3_FORMAT_CONTROL__CLAMP_POSITIVE_C_MASK                                                       0x00020000L
+#define CNVC_CFG3_FORMAT_CONTROL__CNVC_UPDATE_PENDING_MASK                                                    0x00100000L
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_R_MASK                                                      0x03000000L
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_G_MASK                                                      0x0C000000L
+#define CNVC_CFG3_FORMAT_CONTROL__FORMAT_CROSSBAR_B_MASK                                                      0x30000000L
+//CNVC_CFG3_FCNV_FP_BIAS_R
+#define CNVC_CFG3_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R__SHIFT                                                       0x0
+#define CNVC_CFG3_FCNV_FP_BIAS_R__FCNV_FP_BIAS_R_MASK                                                         0x0007FFFFL
+//CNVC_CFG3_FCNV_FP_BIAS_G
+#define CNVC_CFG3_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G__SHIFT                                                       0x0
+#define CNVC_CFG3_FCNV_FP_BIAS_G__FCNV_FP_BIAS_G_MASK                                                         0x0007FFFFL
+//CNVC_CFG3_FCNV_FP_BIAS_B
+#define CNVC_CFG3_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B__SHIFT                                                       0x0
+#define CNVC_CFG3_FCNV_FP_BIAS_B__FCNV_FP_BIAS_B_MASK                                                         0x0007FFFFL
+//CNVC_CFG3_FCNV_FP_SCALE_R
+#define CNVC_CFG3_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R__SHIFT                                                     0x0
+#define CNVC_CFG3_FCNV_FP_SCALE_R__FCNV_FP_SCALE_R_MASK                                                       0x0007FFFFL
+//CNVC_CFG3_FCNV_FP_SCALE_G
+#define CNVC_CFG3_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G__SHIFT                                                     0x0
+#define CNVC_CFG3_FCNV_FP_SCALE_G__FCNV_FP_SCALE_G_MASK                                                       0x0007FFFFL
+//CNVC_CFG3_FCNV_FP_SCALE_B
+#define CNVC_CFG3_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B__SHIFT                                                     0x0
+#define CNVC_CFG3_FCNV_FP_SCALE_B__FCNV_FP_SCALE_B_MASK                                                       0x0007FFFFL
+//CNVC_CFG3_COLOR_KEYER_CONTROL
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__COLOR_KEYER_EN__SHIFT                                                  0x0
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__LUMA_KEYER_EN__SHIFT                                                   0x1
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE__SHIFT                                                0x4
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__COLOR_KEYER_EN_MASK                                                    0x00000001L
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__LUMA_KEYER_EN_MASK                                                     0x00000002L
+#define CNVC_CFG3_COLOR_KEYER_CONTROL__COLOR_KEYER_MODE_MASK                                                  0x00000030L
+//CNVC_CFG3_COLOR_KEYER_ALPHA
+#define CNVC_CFG3_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW__SHIFT                                             0x0
+#define CNVC_CFG3_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH__SHIFT                                            0x10
+#define CNVC_CFG3_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG3_COLOR_KEYER_ALPHA__COLOR_KEYER_ALPHA_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG3_COLOR_KEYER_RED
+#define CNVC_CFG3_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW__SHIFT                                                 0x0
+#define CNVC_CFG3_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH__SHIFT                                                0x10
+#define CNVC_CFG3_COLOR_KEYER_RED__COLOR_KEYER_RED_LOW_MASK                                                   0x0000FFFFL
+#define CNVC_CFG3_COLOR_KEYER_RED__COLOR_KEYER_RED_HIGH_MASK                                                  0xFFFF0000L
+//CNVC_CFG3_COLOR_KEYER_GREEN
+#define CNVC_CFG3_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW__SHIFT                                             0x0
+#define CNVC_CFG3_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH__SHIFT                                            0x10
+#define CNVC_CFG3_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_LOW_MASK                                               0x0000FFFFL
+#define CNVC_CFG3_COLOR_KEYER_GREEN__COLOR_KEYER_GREEN_HIGH_MASK                                              0xFFFF0000L
+//CNVC_CFG3_COLOR_KEYER_BLUE
+#define CNVC_CFG3_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW__SHIFT                                               0x0
+#define CNVC_CFG3_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH__SHIFT                                              0x10
+#define CNVC_CFG3_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_LOW_MASK                                                 0x0000FFFFL
+#define CNVC_CFG3_COLOR_KEYER_BLUE__COLOR_KEYER_BLUE_HIGH_MASK                                                0xFFFF0000L
+//CNVC_CFG3_ALPHA_2BIT_LUT01
+#define CNVC_CFG3_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0__SHIFT                                                    0x0
+#define CNVC_CFG3_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1__SHIFT                                                    0x10
+#define CNVC_CFG3_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT0_MASK                                                      0x00000FFFL
+#define CNVC_CFG3_ALPHA_2BIT_LUT01__ALPHA_2BIT_LUT1_MASK                                                      0x0FFF0000L
+//CNVC_CFG3_ALPHA_2BIT_LUT23
+#define CNVC_CFG3_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2__SHIFT                                                    0x0
+#define CNVC_CFG3_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3__SHIFT                                                    0x10
+#define CNVC_CFG3_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT2_MASK                                                      0x00000FFFL
+#define CNVC_CFG3_ALPHA_2BIT_LUT23__ALPHA_2BIT_LUT3_MASK                                                      0x0FFF0000L
+//CNVC_CFG3_PRE_DEALPHA
+#define CNVC_CFG3_PRE_DEALPHA__PRE_DEALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG3_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG3_PRE_DEALPHA__PRE_DEALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG3_PRE_DEALPHA__PRE_DEALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG3_PRE_CSC_MODE
+#define CNVC_CFG3_PRE_CSC_MODE__PRE_CSC_MODE__SHIFT                                                           0x0
+#define CNVC_CFG3_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT__SHIFT                                                   0x2
+#define CNVC_CFG3_PRE_CSC_MODE__PRE_CSC_MODE_MASK                                                             0x00000003L
+#define CNVC_CFG3_PRE_CSC_MODE__PRE_CSC_MODE_CURRENT_MASK                                                     0x0000000CL
+//CNVC_CFG3_PRE_CSC_C11_C12
+#define CNVC_CFG3_PRE_CSC_C11_C12__PRE_CSC_C11__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C11_C12__PRE_CSC_C12__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C11_C12__PRE_CSC_C11_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C11_C12__PRE_CSC_C12_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_C13_C14
+#define CNVC_CFG3_PRE_CSC_C13_C14__PRE_CSC_C13__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C13_C14__PRE_CSC_C14__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C13_C14__PRE_CSC_C13_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C13_C14__PRE_CSC_C14_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_C21_C22
+#define CNVC_CFG3_PRE_CSC_C21_C22__PRE_CSC_C21__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C21_C22__PRE_CSC_C22__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C21_C22__PRE_CSC_C21_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C21_C22__PRE_CSC_C22_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_C23_C24
+#define CNVC_CFG3_PRE_CSC_C23_C24__PRE_CSC_C23__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C23_C24__PRE_CSC_C24__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C23_C24__PRE_CSC_C23_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C23_C24__PRE_CSC_C24_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_C31_C32
+#define CNVC_CFG3_PRE_CSC_C31_C32__PRE_CSC_C31__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C31_C32__PRE_CSC_C32__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C31_C32__PRE_CSC_C31_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C31_C32__PRE_CSC_C32_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_C33_C34
+#define CNVC_CFG3_PRE_CSC_C33_C34__PRE_CSC_C33__SHIFT                                                         0x0
+#define CNVC_CFG3_PRE_CSC_C33_C34__PRE_CSC_C34__SHIFT                                                         0x10
+#define CNVC_CFG3_PRE_CSC_C33_C34__PRE_CSC_C33_MASK                                                           0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_C33_C34__PRE_CSC_C34_MASK                                                           0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C11_C12
+#define CNVC_CFG3_PRE_CSC_B_C11_C12__PRE_CSC_B_C11__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C11_C12__PRE_CSC_B_C12__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C11_C12__PRE_CSC_B_C11_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C11_C12__PRE_CSC_B_C12_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C13_C14
+#define CNVC_CFG3_PRE_CSC_B_C13_C14__PRE_CSC_B_C13__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C13_C14__PRE_CSC_B_C14__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C13_C14__PRE_CSC_B_C13_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C13_C14__PRE_CSC_B_C14_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C21_C22
+#define CNVC_CFG3_PRE_CSC_B_C21_C22__PRE_CSC_B_C21__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C21_C22__PRE_CSC_B_C22__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C21_C22__PRE_CSC_B_C21_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C21_C22__PRE_CSC_B_C22_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C23_C24
+#define CNVC_CFG3_PRE_CSC_B_C23_C24__PRE_CSC_B_C23__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C23_C24__PRE_CSC_B_C24__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C23_C24__PRE_CSC_B_C23_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C23_C24__PRE_CSC_B_C24_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C31_C32
+#define CNVC_CFG3_PRE_CSC_B_C31_C32__PRE_CSC_B_C31__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C31_C32__PRE_CSC_B_C32__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C31_C32__PRE_CSC_B_C31_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C31_C32__PRE_CSC_B_C32_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_PRE_CSC_B_C33_C34
+#define CNVC_CFG3_PRE_CSC_B_C33_C34__PRE_CSC_B_C33__SHIFT                                                     0x0
+#define CNVC_CFG3_PRE_CSC_B_C33_C34__PRE_CSC_B_C34__SHIFT                                                     0x10
+#define CNVC_CFG3_PRE_CSC_B_C33_C34__PRE_CSC_B_C33_MASK                                                       0x0000FFFFL
+#define CNVC_CFG3_PRE_CSC_B_C33_C34__PRE_CSC_B_C34_MASK                                                       0xFFFF0000L
+//CNVC_CFG3_CNVC_COEF_FORMAT
+#define CNVC_CFG3_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT__SHIFT                                                0x0
+#define CNVC_CFG3_CNVC_COEF_FORMAT__PRE_CSC_COEF_FORMAT_MASK                                                  0x00000001L
+//CNVC_CFG3_PRE_GAM
+#define CNVC_CFG3_PRE_GAM__PRE_GAM_MODE__SHIFT                                                                0x0
+#define CNVC_CFG3_PRE_GAM__PRE_DEGAM_SELECT__SHIFT                                                            0x4
+#define CNVC_CFG3_PRE_GAM__PRE_REGAM_SELECT__SHIFT                                                            0x7
+#define CNVC_CFG3_PRE_GAM__PRE_GAM_MODE_MASK                                                                  0x00000003L
+#define CNVC_CFG3_PRE_GAM__PRE_DEGAM_SELECT_MASK                                                              0x00000070L
+#define CNVC_CFG3_PRE_GAM__PRE_REGAM_SELECT_MASK                                                              0x00000080L
+//CNVC_CFG3_PRE_REALPHA
+#define CNVC_CFG3_PRE_REALPHA__PRE_REALPHA_EN__SHIFT                                                          0x0
+#define CNVC_CFG3_PRE_REALPHA__PRE_REALPHA_ABLND_EN__SHIFT                                                    0x4
+#define CNVC_CFG3_PRE_REALPHA__PRE_REALPHA_EN_MASK                                                            0x00000001L
+#define CNVC_CFG3_PRE_REALPHA__PRE_REALPHA_ABLND_EN_MASK                                                      0x00000010L
+//CNVC_CFG3_PIX_DROP_CNTL
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_DROP_EN__SHIFT                                                           0x0
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_LUMA_DROP__SHIFT                                                         0x4
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_CHROMA_DROP__SHIFT                                                       0x8
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_DROP_EN_MASK                                                             0x00000001L
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_LUMA_DROP_MASK                                                           0x000000F0L
+#define CNVC_CFG3_PIX_DROP_CNTL__PIX_CHROMA_DROP_MASK                                                         0x00000F00L
+//CNVC_CFG3_PIX_DROP_OUT
+#define CNVC_CFG3_PIX_DROP_OUT__PIX_DROP_OUT_L__SHIFT                                                         0x0
+#define CNVC_CFG3_PIX_DROP_OUT__PIX_DROP_OUT_C__SHIFT                                                         0x10
+#define CNVC_CFG3_PIX_DROP_OUT__PIX_DROP_OUT_L_MASK                                                           0x00003FFFL
+#define CNVC_CFG3_PIX_DROP_OUT__PIX_DROP_OUT_C_MASK                                                           0x3FFF0000L
+//CNVC_CFG3_CNVC_UPSP_MODE
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_MODE__SHIFT                                                            0x0
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE__SHIFT                                                   0x2
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS__SHIFT                                                      0x4
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_INIT_INT__SHIFT                                                      0x8
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC__SHIFT                                                     0xc
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS__SHIFT                                                      0x10
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_INIT_INT__SHIFT                                                      0x14
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC__SHIFT                                                     0x18
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_MODE_MASK                                                              0x00000003L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_BOUNDARY_MODE_MASK                                                     0x00000004L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_NUM_TAPS_MASK                                                        0x00000010L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_INIT_INT_MASK                                                        0x00000700L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_V_INIT_FRAC_MASK                                                       0x00001000L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_NUM_TAPS_MASK                                                        0x00010000L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_INIT_INT_MASK                                                        0x00700000L
+#define CNVC_CFG3_CNVC_UPSP_MODE__UPSP_H_INIT_FRAC_MASK                                                       0x01000000L
+//CNVC_CFG3_CNVC_UPSP_V_COEF_P0
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P0__UPSP_V_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG3_CNVC_UPSP_V_COEF_P1
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG3_CNVC_UPSP_V_COEF_P1__UPSP_V_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG3_CNVC_UPSP_H_COEF_P0
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0__SHIFT                                             0x0
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0__SHIFT                                             0x8
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0__SHIFT                                             0x10
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0__SHIFT                                             0x18
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP0_P0_MASK                                               0x000000FFL
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP1_P0_MASK                                               0x0000FF00L
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP2_P0_MASK                                               0x00FF0000L
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P0__UPSP_H_COEF_TAP3_P0_MASK                                               0xFF000000L
+//CNVC_CFG3_CNVC_UPSP_H_COEF_P1
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1__SHIFT                                             0x0
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1__SHIFT                                             0x8
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1__SHIFT                                             0x10
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1__SHIFT                                             0x18
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP0_P1_MASK                                               0x000000FFL
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP1_P1_MASK                                               0x0000FF00L
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP2_P1_MASK                                               0x00FF0000L
+#define CNVC_CFG3_CNVC_UPSP_H_COEF_P1__UPSP_H_COEF_TAP3_P1_MASK                                               0xFF000000L
+//CNVC_CFG3_CNVC_UPSP_CLAMP
+#define CNVC_CFG3_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX__SHIFT                                                      0x0
+#define CNVC_CFG3_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN__SHIFT                                                      0x10
+#define CNVC_CFG3_CNVC_UPSP_CLAMP__UPSP_CLAMP_MAX_MASK                                                        0x00000FFFL
+#define CNVC_CFG3_CNVC_UPSP_CLAMP__UPSP_CLAMP_MIN_MASK                                                        0x0FFF0000L
+//CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE__SHIFT                                           0x0
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS__SHIFT                                             0x2
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE__SHIFT                                           0x10
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_FORCE_MASK                                             0x00000003L
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_DIS_MASK                                               0x00000004L
+#define CNVC_CFG3_CNVC_UPSP_MEM_PWR_CTRL__UPSP_MEM_PWR_STATE_MASK                                             0x00030000L
+//CNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_INDEX__CNVC_CFG_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//CNVC_CFG3_CNVC_CFG_TEST_DEBUG_DATA
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define CNVC_CFG3_CNVC_CFG_TEST_DEBUG_DATA__CNVC_CFG_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cm_cur_dispdec
+//CM_CUR3_CURSOR0_CONTROL
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_ENABLE__SHIFT                                                           0x0
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_EXPANSION_MODE__SHIFT                                                   0x1
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_PIX_INV_MODE__SHIFT                                                     0x2
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_ROM_EN__SHIFT                                                           0x3
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_MODE__SHIFT                                                             0x4
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN__SHIFT                                               0x7
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_UPDATE_PENDING__SHIFT                                                   0x10
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_ENABLE_MASK                                                             0x00000001L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_EXPANSION_MODE_MASK                                                     0x00000002L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_PIX_INV_MODE_MASK                                                       0x00000004L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_ROM_EN_MASK                                                             0x00000008L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_MODE_MASK                                                               0x00000070L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_PIXEL_ALPHA_MOD_EN_MASK                                                 0x00000080L
+#define CM_CUR3_CURSOR0_CONTROL__CUR0_UPDATE_PENDING_MASK                                                     0x00010000L
+//CM_CUR3_CURSOR0_COLOR0
+#define CM_CUR3_CURSOR0_COLOR0__CUR0_COLOR0__SHIFT                                                            0x0
+#define CM_CUR3_CURSOR0_COLOR0__CUR0_COLOR0_MASK                                                              0x00FFFFFFL
+//CM_CUR3_CURSOR0_COLOR1
+#define CM_CUR3_CURSOR0_COLOR1__CUR0_COLOR1__SHIFT                                                            0x0
+#define CM_CUR3_CURSOR0_COLOR1__CUR0_COLOR1_MASK                                                              0x00FFFFFFL
+//CM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y__SHIFT                                           0x0
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y__SHIFT                                            0x10
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_SCALE_G_Y_MASK                                             0x0000FFFFL
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_G_Y__CUR0_FP_BIAS_G_Y_MASK                                              0xFFFF0000L
+//CM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB__SHIFT                                   0x0
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB__SHIFT                                    0x10
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_SCALE_RB_CRCB_MASK                                     0x0000FFFFL
+#define CM_CUR3_CURSOR0_FP_SCALE_BIAS_RB_CRCB__CUR0_FP_BIAS_RB_CRCB_MASK                                      0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_MODE
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE__SHIFT                                                     0x0
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT__SHIFT                                             0x2
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT__SHIFT                                              0x4
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_MASK                                                       0x00000003L
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_MODE_CURRENT_MASK                                               0x0000000CL
+#define CM_CUR3_CUR0_MATRIX_MODE__CUR0_MATRIX_COEF_FORMAT_MASK                                                0x00000010L
+//CM_CUR3_CUR0_MATRIX_C11_C12_A
+#define CM_CUR3_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C11_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C11_C12_A__CUR0_MATRIX_C12_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C13_C14_A
+#define CM_CUR3_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C13_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C13_C14_A__CUR0_MATRIX_C14_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C21_C22_A
+#define CM_CUR3_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C21_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C21_C22_A__CUR0_MATRIX_C22_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C23_C24_A
+#define CM_CUR3_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C23_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C23_C24_A__CUR0_MATRIX_C24_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C31_C32_A
+#define CM_CUR3_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C31_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C31_C32_A__CUR0_MATRIX_C32_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C33_C34_A
+#define CM_CUR3_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C33_A_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C33_C34_A__CUR0_MATRIX_C34_A_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C11_C12_B
+#define CM_CUR3_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C11_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C11_C12_B__CUR0_MATRIX_C12_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C13_C14_B
+#define CM_CUR3_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C13_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C13_C14_B__CUR0_MATRIX_C14_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C21_C22_B
+#define CM_CUR3_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C21_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C21_C22_B__CUR0_MATRIX_C22_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C23_C24_B
+#define CM_CUR3_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C23_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C23_C24_B__CUR0_MATRIX_C24_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C31_C32_B
+#define CM_CUR3_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C31_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C31_C32_B__CUR0_MATRIX_C32_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CUR0_MATRIX_C33_C34_B
+#define CM_CUR3_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B__SHIFT                                               0x0
+#define CM_CUR3_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B__SHIFT                                               0x10
+#define CM_CUR3_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C33_B_MASK                                                 0x0000FFFFL
+#define CM_CUR3_CUR0_MATRIX_C33_C34_B__CUR0_MATRIX_C34_B_MASK                                                 0xFFFF0000L
+//CM_CUR3_CM_CUR0_TEST_DEBUG_INDEX
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX__SHIFT                                     0x0
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN__SHIFT                                  0x8
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_INDEX_MASK                                       0x000000FFL
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_INDEX__CM_CUR0_TEST_DEBUG_WRITE_EN_MASK                                    0x00000100L
+//CM_CUR3_CM_CUR0_TEST_DEBUG_DATA
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA__SHIFT                                       0x0
+#define CM_CUR3_CM_CUR0_TEST_DEBUG_DATA__CM_CUR0_TEST_DEBUG_DATA_MASK                                         0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dscl_dispdec
+//DSCL3_SCL_COEF_RAM_TAP_SELECT
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX__SHIFT                                       0x0
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE__SHIFT                                              0x8
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE__SHIFT                                        0x10
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_TAP_PAIR_IDX_MASK                                         0x00000003L
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_PHASE_MASK                                                0x00003F00L
+#define DSCL3_SCL_COEF_RAM_TAP_SELECT__SCL_COEF_RAM_FILTER_TYPE_MASK                                          0x00070000L
+//DSCL3_SCL_COEF_RAM_TAP_DATA
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF__SHIFT                                        0x0
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN__SHIFT                                     0xf
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF__SHIFT                                         0x10
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN__SHIFT                                      0x1f
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_MASK                                          0x00003FFFL
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_EVEN_TAP_COEF_EN_MASK                                       0x00008000L
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_MASK                                           0x3FFF0000L
+#define DSCL3_SCL_COEF_RAM_TAP_DATA__SCL_COEF_RAM_ODD_TAP_COEF_EN_MASK                                        0x80000000L
+//DSCL3_SCL_MODE
+#define DSCL3_SCL_MODE__DSCL_MODE__SHIFT                                                                      0x0
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT__SHIFT                                                            0x8
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT__SHIFT                                                    0xc
+#define DSCL3_SCL_MODE__SCL_CHROMA_COEF_MODE__SHIFT                                                           0x10
+#define DSCL3_SCL_MODE__SCL_ALPHA_COEF_MODE__SHIFT                                                            0x14
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT_RD__SHIFT                                                         0x18
+#define DSCL3_SCL_MODE__DSCL_MODE_MASK                                                                        0x00000007L
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT_MASK                                                              0x00000100L
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT_CURRENT_MASK                                                      0x00001000L
+#define DSCL3_SCL_MODE__SCL_CHROMA_COEF_MODE_MASK                                                             0x00010000L
+#define DSCL3_SCL_MODE__SCL_ALPHA_COEF_MODE_MASK                                                              0x00100000L
+#define DSCL3_SCL_MODE__SCL_COEF_RAM_SELECT_RD_MASK                                                           0x01000000L
+//DSCL3_SCL_TAP_CONTROL
+#define DSCL3_SCL_TAP_CONTROL__SCL_V_NUM_TAPS__SHIFT                                                          0x0
+#define DSCL3_SCL_TAP_CONTROL__SCL_H_NUM_TAPS__SHIFT                                                          0x4
+#define DSCL3_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C__SHIFT                                                        0x8
+#define DSCL3_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C__SHIFT                                                        0xc
+#define DSCL3_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_MASK                                                            0x00000007L
+#define DSCL3_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_MASK                                                            0x00000070L
+#define DSCL3_SCL_TAP_CONTROL__SCL_V_NUM_TAPS_C_MASK                                                          0x00000700L
+#define DSCL3_SCL_TAP_CONTROL__SCL_H_NUM_TAPS_C_MASK                                                          0x00007000L
+//DSCL3_DSCL_CONTROL
+#define DSCL3_DSCL_CONTROL__SCL_BOUNDARY_MODE__SHIFT                                                          0x0
+#define DSCL3_DSCL_CONTROL__SCL_BOUNDARY_MODE_MASK                                                            0x00000001L
+//DSCL3_DSCL_2TAP_CONTROL
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x0
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN__SHIFT                                                   0x4
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR__SHIFT                                               0x8
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN__SHIFT                                           0x10
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN__SHIFT                                                   0x14
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR__SHIFT                                               0x18
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_HARDCODE_COEF_EN_MASK                                             0x00000001L
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_EN_MASK                                                     0x00000010L
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_H_2TAP_SHARP_FACTOR_MASK                                                 0x00000700L
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_HARDCODE_COEF_EN_MASK                                             0x00010000L
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_EN_MASK                                                     0x00100000L
+#define DSCL3_DSCL_2TAP_CONTROL__SCL_V_2TAP_SHARP_FACTOR_MASK                                                 0x07000000L
+//DSCL3_SCL_MANUAL_REPLICATE_CONTROL
+#define DSCL3_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR__SHIFT                              0x0
+#define DSCL3_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR__SHIFT                              0x8
+#define DSCL3_SCL_MANUAL_REPLICATE_CONTROL__SCL_V_MANUAL_REPLICATE_FACTOR_MASK                                0x0000000FL
+#define DSCL3_SCL_MANUAL_REPLICATE_CONTROL__SCL_H_MANUAL_REPLICATE_FACTOR_MASK                                0x00000F00L
+//DSCL3_SCL_HORZ_FILTER_SCALE_RATIO
+#define DSCL3_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL3_SCL_HORZ_FILTER_SCALE_RATIO__SCL_H_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL3_SCL_HORZ_FILTER_INIT
+#define DSCL3_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL3_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT__SHIFT                                                     0x18
+#define DSCL3_SCL_HORZ_FILTER_INIT__SCL_H_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL3_SCL_HORZ_FILTER_INIT__SCL_H_INIT_INT_MASK                                                       0x0F000000L
+//DSCL3_SCL_HORZ_FILTER_SCALE_RATIO_C
+#define DSCL3_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL3_SCL_HORZ_FILTER_SCALE_RATIO_C__SCL_H_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL3_SCL_HORZ_FILTER_INIT_C
+#define DSCL3_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL3_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL3_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL3_SCL_HORZ_FILTER_INIT_C__SCL_H_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL3_SCL_VERT_FILTER_SCALE_RATIO
+#define DSCL3_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO__SHIFT                                           0x0
+#define DSCL3_SCL_VERT_FILTER_SCALE_RATIO__SCL_V_SCALE_RATIO_MASK                                             0x07FFFFFFL
+//DSCL3_SCL_VERT_FILTER_INIT
+#define DSCL3_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC__SHIFT                                                    0x0
+#define DSCL3_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT__SHIFT                                                     0x18
+#define DSCL3_SCL_VERT_FILTER_INIT__SCL_V_INIT_FRAC_MASK                                                      0x00FFFFFFL
+#define DSCL3_SCL_VERT_FILTER_INIT__SCL_V_INIT_INT_MASK                                                       0x0F000000L
+//DSCL3_SCL_VERT_FILTER_SCALE_RATIO_C
+#define DSCL3_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C__SHIFT                                       0x0
+#define DSCL3_SCL_VERT_FILTER_SCALE_RATIO_C__SCL_V_SCALE_RATIO_C_MASK                                         0x07FFFFFFL
+//DSCL3_SCL_VERT_FILTER_INIT_C
+#define DSCL3_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C__SHIFT                                                0x0
+#define DSCL3_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C__SHIFT                                                 0x18
+#define DSCL3_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_FRAC_C_MASK                                                  0x00FFFFFFL
+#define DSCL3_SCL_VERT_FILTER_INIT_C__SCL_V_INIT_INT_C_MASK                                                   0x0F000000L
+//DSCL3_SCL_BLACK_COLOR
+#define DSCL3_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y__SHIFT                                                   0x0
+#define DSCL3_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR__SHIFT                                                    0x10
+#define DSCL3_SCL_BLACK_COLOR__SCL_BLACK_COLOR_RGB_Y_MASK                                                     0x0000FFFFL
+#define DSCL3_SCL_BLACK_COLOR__SCL_BLACK_COLOR_CBCR_MASK                                                      0xFFFF0000L
+//DSCL3_DSCL_UPDATE
+#define DSCL3_DSCL_UPDATE__SCL_UPDATE_PENDING__SHIFT                                                          0x0
+#define DSCL3_DSCL_UPDATE__SCL_UPDATE_PENDING_MASK                                                            0x00000001L
+//DSCL3_DSCL_AUTOCAL
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_MODE__SHIFT                                                               0x0
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE__SHIFT                                                          0x2
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE__SHIFT                                                           0x8
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_PIPE_ID__SHIFT                                                            0xc
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_MODE_MASK                                                                 0x00000003L
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_FRAC_MODE_MASK                                                            0x00000004L
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_NUM_PIPE_MASK                                                             0x00000300L
+#define DSCL3_DSCL_AUTOCAL__AUTOCAL_PIPE_ID_MASK                                                              0x00003000L
+//DSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT
+#define DSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT__SHIFT                                         0x0
+#define DSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT__SHIFT                                          0x10
+#define DSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_RIGHT_MASK                                           0x00003FFFL
+#define DSCL3_DSCL_EXT_OVERSCAN_LEFT_RIGHT__EXT_OVERSCAN_LEFT_MASK                                            0x3FFF0000L
+//DSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM
+#define DSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM__SHIFT                                        0x0
+#define DSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP__SHIFT                                           0x10
+#define DSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_BOTTOM_MASK                                          0x00003FFFL
+#define DSCL3_DSCL_EXT_OVERSCAN_TOP_BOTTOM__EXT_OVERSCAN_TOP_MASK                                             0x3FFF0000L
+//DSCL3_OTG_H_BLANK
+#define DSCL3_OTG_H_BLANK__OTG_H_BLANK_START__SHIFT                                                           0x0
+#define DSCL3_OTG_H_BLANK__OTG_H_BLANK_END__SHIFT                                                             0x10
+#define DSCL3_OTG_H_BLANK__OTG_H_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL3_OTG_H_BLANK__OTG_H_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL3_OTG_V_BLANK
+#define DSCL3_OTG_V_BLANK__OTG_V_BLANK_START__SHIFT                                                           0x0
+#define DSCL3_OTG_V_BLANK__OTG_V_BLANK_END__SHIFT                                                             0x10
+#define DSCL3_OTG_V_BLANK__OTG_V_BLANK_START_MASK                                                             0x00003FFFL
+#define DSCL3_OTG_V_BLANK__OTG_V_BLANK_END_MASK                                                               0x3FFF0000L
+//DSCL3_RECOUT_START
+#define DSCL3_RECOUT_START__RECOUT_START_X__SHIFT                                                             0x0
+#define DSCL3_RECOUT_START__RECOUT_START_Y__SHIFT                                                             0x10
+#define DSCL3_RECOUT_START__RECOUT_START_X_MASK                                                               0x00003FFFL
+#define DSCL3_RECOUT_START__RECOUT_START_Y_MASK                                                               0x3FFF0000L
+//DSCL3_RECOUT_SIZE
+#define DSCL3_RECOUT_SIZE__RECOUT_WIDTH__SHIFT                                                                0x0
+#define DSCL3_RECOUT_SIZE__RECOUT_HEIGHT__SHIFT                                                               0x10
+#define DSCL3_RECOUT_SIZE__RECOUT_WIDTH_MASK                                                                  0x00003FFFL
+#define DSCL3_RECOUT_SIZE__RECOUT_HEIGHT_MASK                                                                 0x3FFF0000L
+//DSCL3_MPC_SIZE
+#define DSCL3_MPC_SIZE__MPC_WIDTH__SHIFT                                                                      0x0
+#define DSCL3_MPC_SIZE__MPC_HEIGHT__SHIFT                                                                     0x10
+#define DSCL3_MPC_SIZE__MPC_WIDTH_MASK                                                                        0x00003FFFL
+#define DSCL3_MPC_SIZE__MPC_HEIGHT_MASK                                                                       0x3FFF0000L
+//DSCL3_LB_DATA_FORMAT
+#define DSCL3_LB_DATA_FORMAT__ALPHA_EN__SHIFT                                                                 0x4
+#define DSCL3_LB_DATA_FORMAT__ALPHA_EN_MASK                                                                   0x00000010L
+//DSCL3_LB_MEMORY_CTRL
+#define DSCL3_LB_MEMORY_CTRL__MEMORY_CONFIG__SHIFT                                                            0x0
+#define DSCL3_LB_MEMORY_CTRL__LB_MAX_PARTITIONS__SHIFT                                                        0x8
+#define DSCL3_LB_MEMORY_CTRL__LB_NUM_PARTITIONS__SHIFT                                                        0x10
+#define DSCL3_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C__SHIFT                                                      0x18
+#define DSCL3_LB_MEMORY_CTRL__MEMORY_CONFIG_MASK                                                              0x00000003L
+#define DSCL3_LB_MEMORY_CTRL__LB_MAX_PARTITIONS_MASK                                                          0x00003F00L
+#define DSCL3_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_MASK                                                          0x007F0000L
+#define DSCL3_LB_MEMORY_CTRL__LB_NUM_PARTITIONS_C_MASK                                                        0x7F000000L
+//DSCL3_LB_V_COUNTER
+#define DSCL3_LB_V_COUNTER__V_COUNTER__SHIFT                                                                  0x0
+#define DSCL3_LB_V_COUNTER__V_COUNTER_C__SHIFT                                                                0x10
+#define DSCL3_LB_V_COUNTER__V_COUNTER_MASK                                                                    0x00001FFFL
+#define DSCL3_LB_V_COUNTER__V_COUNTER_C_MASK                                                                  0x1FFF0000L
+//DSCL3_DSCL_MEM_PWR_CTRL
+#define DSCL3_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE__SHIFT                                                     0x0
+#define DSCL3_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS__SHIFT                                                       0x2
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE__SHIFT                                                   0x4
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS__SHIFT                                                     0x6
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE__SHIFT                                                   0x8
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS__SHIFT                                                     0xa
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE__SHIFT                                                   0xc
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS__SHIFT                                                     0xe
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE__SHIFT                                                   0x10
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS__SHIFT                                                     0x12
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE__SHIFT                                                   0x14
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS__SHIFT                                                     0x16
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE__SHIFT                                                   0x18
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS__SHIFT                                                     0x1a
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE__SHIFT                                                       0x1c
+#define DSCL3_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_FORCE_MASK                                                       0x00000003L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LUT_MEM_PWR_DIS_MASK                                                         0x00000004L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_FORCE_MASK                                                     0x00000030L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G1_MEM_PWR_DIS_MASK                                                       0x00000040L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_FORCE_MASK                                                     0x00000300L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G2_MEM_PWR_DIS_MASK                                                       0x00000400L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_FORCE_MASK                                                     0x00003000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G3_MEM_PWR_DIS_MASK                                                       0x00004000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_FORCE_MASK                                                     0x00030000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G4_MEM_PWR_DIS_MASK                                                       0x00040000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_FORCE_MASK                                                     0x00300000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G5_MEM_PWR_DIS_MASK                                                       0x00400000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_FORCE_MASK                                                     0x03000000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_G6_MEM_PWR_DIS_MASK                                                       0x04000000L
+#define DSCL3_DSCL_MEM_PWR_CTRL__LB_MEM_PWR_MODE_MASK                                                         0x10000000L
+//DSCL3_DSCL_MEM_PWR_STATUS
+#define DSCL3_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE__SHIFT                                                   0x0
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE__SHIFT                                                 0x2
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE__SHIFT                                                 0x4
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE__SHIFT                                                 0x6
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE__SHIFT                                                 0x8
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE__SHIFT                                                 0xa
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE__SHIFT                                                 0xc
+#define DSCL3_DSCL_MEM_PWR_STATUS__LUT_MEM_PWR_STATE_MASK                                                     0x00000003L
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G1_MEM_PWR_STATE_MASK                                                   0x0000000CL
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G2_MEM_PWR_STATE_MASK                                                   0x00000030L
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G3_MEM_PWR_STATE_MASK                                                   0x000000C0L
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G4_MEM_PWR_STATE_MASK                                                   0x00000300L
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G5_MEM_PWR_STATE_MASK                                                   0x00000C00L
+#define DSCL3_DSCL_MEM_PWR_STATUS__LB_G6_MEM_PWR_STATE_MASK                                                   0x00003000L
+//DSCL3_OBUF_CONTROL
+#define DSCL3_OBUF_CONTROL__OBUF_BYPASS__SHIFT                                                                0x0
+#define DSCL3_OBUF_CONTROL__OBUF_USE_FULL_BUFFER__SHIFT                                                       0x1
+#define DSCL3_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH__SHIFT                                                  0x2
+#define DSCL3_OBUF_CONTROL__OBUF_OUT_HOLD_CNT__SHIFT                                                          0x4
+#define DSCL3_OBUF_CONTROL__OBUF_BYPASS_MASK                                                                  0x00000001L
+#define DSCL3_OBUF_CONTROL__OBUF_USE_FULL_BUFFER_MASK                                                         0x00000002L
+#define DSCL3_OBUF_CONTROL__OBUF_IS_HALF_RECOUT_WIDTH_MASK                                                    0x00000004L
+#define DSCL3_OBUF_CONTROL__OBUF_OUT_HOLD_CNT_MASK                                                            0x000000F0L
+//DSCL3_OBUF_MEM_PWR_CTRL
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE__SHIFT                                                    0x0
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS__SHIFT                                                      0x2
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE__SHIFT                                                     0x8
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE__SHIFT                                                    0x10
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_FORCE_MASK                                                      0x00000003L
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_DIS_MASK                                                        0x00000004L
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_MODE_MASK                                                       0x00000100L
+#define DSCL3_OBUF_MEM_PWR_CTRL__OBUF_MEM_PWR_STATE_MASK                                                      0x00030000L
+//DSCL3_DSCL_EASF_H_MODE
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_EN__SHIFT                                                          0x0
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_EN_MASK                                                            0x00000001L
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL3_DSCL_EASF_H_MODE__SCL_EASF_H_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL3_DSCL_EASF_V_MODE
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_EN__SHIFT                                                          0x0
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN__SHIFT                                            0x4
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR__SHIFT                                           0x8
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_EN_MASK                                                            0x00000001L
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_RINGEST_FORCE_EN_MASK                                              0x00000010L
+#define DSCL3_DSCL_EASF_V_MODE__SCL_EASF_V_2TAP_SHARP_FACTOR_MASK                                             0x00003F00L
+//DSCL3_DSCL_SC_MODE
+#define DSCL3_DSCL_SC_MODE__SCL_SC_MATRIX_MODE__SHIFT                                                         0x0
+#define DSCL3_DSCL_SC_MODE__SCL_SC_LTONL_EN__SHIFT                                                            0x8
+#define DSCL3_DSCL_SC_MODE__SCL_SC_MATRIX_MODE_MASK                                                           0x00000001L
+#define DSCL3_DSCL_SC_MODE__SCL_SC_LTONL_EN_MASK                                                              0x00000100L
+//DSCL3_DSCL_SC_MATRIX_C0C1
+#define DSCL3_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0__SHIFT                                                    0x0
+#define DSCL3_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1__SHIFT                                                    0x10
+#define DSCL3_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C0_MASK                                                      0x0000FFFFL
+#define DSCL3_DSCL_SC_MATRIX_C0C1__SCL_SC_MATRIX_C1_MASK                                                      0xFFFF0000L
+//DSCL3_DSCL_SC_MATRIX_C2C3
+#define DSCL3_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2__SHIFT                                                    0x0
+#define DSCL3_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3__SHIFT                                                    0x10
+#define DSCL3_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C2_MASK                                                      0x0000FFFFL
+#define DSCL3_DSCL_SC_MATRIX_C2C3__SCL_SC_MATRIX_C3_MASK                                                      0xFFFF0000L
+//DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_GAIN__SCL_EASF_H_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL3_DSCL_EASF_H_RINGEST_EVENTAP_REDUCE__SCL_EASF_H_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1__SHIFT                       0x0
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2__SHIFT                       0x10
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN1_MASK                         0x0000FFFFL
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_GAIN__SCL_EASF_V_RINGEST_EVENTAP_GAIN2_MASK                         0xFFFF0000L
+//DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1__SHIFT                  0x0
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2__SHIFT                  0x10
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG1_MASK                    0x0000FFFFL
+#define DSCL3_DSCL_EASF_V_RINGEST_EVENTAP_REDUCE__SCL_EASF_V_RINGEST_EVENTAP_REDUCEG2_MASK                    0xFFFF0000L
+//DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT__SHIFT                    0x0
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL__SHIFT                    0x10
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_DNTILT_UPTILT_MASK                      0x0000FFFFL
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL1__SCL_EASF_V_RINGEST_3TAP_UPTILT_MAXVAL_MASK                      0xFFFF0000L
+//DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE__SHIFT                     0x0
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE__SHIFT                    0x10
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_DNTILT_SLOPE_MASK                       0x0000FFFFL
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL2__SCL_EASF_V_RINGEST_3TAP_UPTILT1_SLOPE_MASK                      0xFFFF0000L
+//DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE__SHIFT                    0x0
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET__SHIFT                   0x10
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_SLOPE_MASK                      0x0000FFFFL
+#define DSCL3_DSCL_EASF_V_RINGEST_3TAP_CNTL3__SCL_EASF_V_RINGEST_3TAP_UPTILT2_OFFSET_MASK                     0xFFFF0000L
+//DSCL3_DSCL_EASF_RINGEST_FORCE
+#define DSCL3_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE__SHIFT                                        0x0
+#define DSCL3_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE__SHIFT                                        0x10
+#define DSCL3_DSCL_EASF_RINGEST_FORCE__SCL_EASF_H_RINGEST_FORCE_MASK                                          0x0000FFFFL
+#define DSCL3_DSCL_EASF_RINGEST_FORCE__SCL_EASF_V_RINGEST_FORCE_MASK                                          0xFFFF0000L
+//DSCL3_DSCL_EASF_H_BF_CNTL
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN__SHIFT                                                   0x0
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE__SHIFT                                                 0x8
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE__SHIFT                                                 0x10
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF1_EN_MASK                                                     0x00000001L
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL3_DSCL_EASF_H_BF_CNTL__SCL_EASF_H_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA__SHIFT                                         0x0
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB__SHIFT                                         0x8
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA__SHIFT                                         0x10
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB__SHIFT                                         0x18
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINA_MASK                                           0x003F0000L
+#define DSCL3_DSCL_EASF_H_BF_FINAL_MAX_MIN__SCL_EASF_H_BF_MINB_MASK                                           0x3F000000L
+//DSCL3_DSCL_EASF_V_BF_CNTL
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN__SHIFT                                                   0x0
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE__SHIFT                                                 0x8
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE__SHIFT                                                 0x10
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN__SHIFT                                           0x14
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN__SHIFT                                           0x18
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN__SHIFT                                             0x1c
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF1_EN_MASK                                                     0x00000001L
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_MODE_MASK                                                   0x00000F00L
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF3_MODE_MASK                                                   0x00030000L
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT1_GAIN_MASK                                             0x00F00000L
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_FLAT2_GAIN_MASK                                             0x0F000000L
+#define DSCL3_DSCL_EASF_V_BF_CNTL__SCL_EASF_V_BF2_ROC_GAIN_MASK                                               0xF0000000L
+//DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA__SHIFT                                         0x0
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB__SHIFT                                         0x8
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA__SHIFT                                         0x10
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB__SHIFT                                         0x18
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXA_MASK                                           0x0000003FL
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MAXB_MASK                                           0x00003F00L
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINA_MASK                                           0x003F0000L
+#define DSCL3_DSCL_EASF_V_BF_FINAL_MAX_MIN__SCL_EASF_V_BF_MINB_MASK                                           0x3F000000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG0__SCL_EASF_H_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG1
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG1__SCL_EASF_H_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG2
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG2__SCL_EASF_H_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG3
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG3__SCL_EASF_H_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG4
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG4__SCL_EASF_H_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG5
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG5__SCL_EASF_H_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG6
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG6__SCL_EASF_H_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_H_BF1_PWL_SEG7
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_H_BF1_PWL_SEG7__SCL_EASF_H_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_IN_SEG0_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_BASE_SEG0_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG0__SCL_EASF_V_BF1_PWL_SLOPE_SEG0_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG1
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_IN_SEG1_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_BASE_SEG1_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG1__SCL_EASF_V_BF1_PWL_SLOPE_SEG1_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG2
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_IN_SEG2_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_BASE_SEG2_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG2__SCL_EASF_V_BF1_PWL_SLOPE_SEG2_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG3
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_IN_SEG3_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_BASE_SEG3_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG3__SCL_EASF_V_BF1_PWL_SLOPE_SEG3_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG4
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_IN_SEG4_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_BASE_SEG4_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG4__SCL_EASF_V_BF1_PWL_SLOPE_SEG4_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG5
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_IN_SEG5_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_BASE_SEG5_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG5__SCL_EASF_V_BF1_PWL_SLOPE_SEG5_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG6
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6__SHIFT                                  0x14
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_IN_SEG6_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_BASE_SEG6_MASK                                     0x0003F000L
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG6__SCL_EASF_V_BF1_PWL_SLOPE_SEG6_MASK                                    0x7FF00000L
+//DSCL3_DSCL_EASF_V_BF1_PWL_SEG7
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_IN_SEG7_MASK                                       0x000007FFL
+#define DSCL3_DSCL_EASF_V_BF1_PWL_SEG7__SCL_EASF_V_BF1_PWL_BASE_SEG7_MASK                                     0x0003F000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG0__SCL_EASF_H_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG1
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG1__SCL_EASF_H_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG2
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG2__SCL_EASF_H_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG3
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG3__SCL_EASF_H_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG4
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG4__SCL_EASF_H_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_H_BF3_PWL_SEG5
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_H_BF3_PWL_SEG5__SCL_EASF_H_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_IN_SEG0_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_BASE_SEG0_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG0__SCL_EASF_V_BF3_PWL_SLOPE_SEG0_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG1
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_IN_SEG1_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_BASE_SEG1_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG1__SCL_EASF_V_BF3_PWL_SLOPE_SEG1_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG2
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_IN_SEG2_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_BASE_SEG2_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG2__SCL_EASF_V_BF3_PWL_SLOPE_SEG2_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG3
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_IN_SEG3_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_BASE_SEG3_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG3__SCL_EASF_V_BF3_PWL_SLOPE_SEG3_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG4
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4__SHIFT                                  0x13
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_IN_SEG4_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_BASE_SEG4_MASK                                     0x0007F000L
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG4__SCL_EASF_V_BF3_PWL_SLOPE_SEG4_MASK                                    0xFFF80000L
+//DSCL3_DSCL_EASF_V_BF3_PWL_SEG5
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5__SHIFT                                     0x0
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5__SHIFT                                   0xc
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_IN_SEG5_MASK                                       0x00000FFFL
+#define DSCL3_DSCL_EASF_V_BF3_PWL_SEG5__SCL_EASF_V_BF3_PWL_BASE_SEG5_MASK                                     0x0007F000L
+//DSCL3_ISHARP_MODE
+#define DSCL3_ISHARP_MODE__ISHARP_EN__SHIFT                                                                   0x0
+#define DSCL3_ISHARP_MODE__ISHARP_NOISEDET_EN__SHIFT                                                          0x4
+#define DSCL3_ISHARP_MODE__ISHARP_NOISEDET_MODE__SHIFT                                                        0x5
+#define DSCL3_ISHARP_MODE__ISHARP_LBA_MODE__SHIFT                                                             0x9
+#define DSCL3_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT__SHIFT                                                     0xa
+#define DSCL3_ISHARP_MODE__ISHARP_FMT_MODE__SHIFT                                                             0xb
+#define DSCL3_ISHARP_MODE__ISHARP_FMT_NORM__SHIFT                                                             0xc
+#define DSCL3_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT__SHIFT                                             0x1c
+#define DSCL3_ISHARP_MODE__ISHARP_EN_MASK                                                                     0x00000001L
+#define DSCL3_ISHARP_MODE__ISHARP_NOISEDET_EN_MASK                                                            0x00000010L
+#define DSCL3_ISHARP_MODE__ISHARP_NOISEDET_MODE_MASK                                                          0x00000060L
+#define DSCL3_ISHARP_MODE__ISHARP_LBA_MODE_MASK                                                               0x00000200L
+#define DSCL3_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_MASK                                                       0x00000400L
+#define DSCL3_ISHARP_MODE__ISHARP_FMT_MODE_MASK                                                               0x00000800L
+#define DSCL3_ISHARP_MODE__ISHARP_FMT_NORM_MASK                                                               0x0FFFF000L
+#define DSCL3_ISHARP_MODE__ISHARP_DELTA_LUT_SELECT_CURRENT_MASK                                               0x10000000L
+//DSCL3_ISHARP_DELTA_CTRL
+#define DSCL3_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT__SHIFT                                          0x0
+#define DSCL3_ISHARP_DELTA_CTRL__ISHARP_DELTA_LUT_HOST_SELECT_MASK                                            0x00000001L
+//DSCL3_ISHARP_DELTA_INDEX
+#define DSCL3_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX__SHIFT                                                   0x0
+#define DSCL3_ISHARP_DELTA_INDEX__ISHARP_DELTA_INDEX_MASK                                                     0x0000001FL
+//DSCL3_ISHARP_DELTA_DATA
+#define DSCL3_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA__SHIFT                                                     0x0
+#define DSCL3_ISHARP_DELTA_DATA__ISHARP_DELTA_DATA_MASK                                                       0xFFFFFFFFL
+//DSCL3_ISHARP_NLDELTA_SOFT_CLIP
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P__SHIFT                                      0x0
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P__SHIFT                                   0x1
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P__SHIFT                                   0x8
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N__SHIFT                                      0x10
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N__SHIFT                                   0x11
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N__SHIFT                                   0x18
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_P_MASK                                        0x00000001L
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_P_MASK                                     0x000000FEL
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_P_MASK                                     0x0000FF00L
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_EN_N_MASK                                        0x00010000L
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_PIVOT_N_MASK                                     0x00FE0000L
+#define DSCL3_ISHARP_NLDELTA_SOFT_CLIP__ISHARP_NLDELTA_SCLIP_SLOPE_N_MASK                                     0xFF000000L
+//DSCL3_ISHARP_NOISEDET_THRESHOLD
+#define DSCL3_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE__SHIFT                                         0x0
+#define DSCL3_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE__SHIFT                                         0x10
+#define DSCL3_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_UTHRE_MASK                                           0x000003FFL
+#define DSCL3_ISHARP_NOISEDET_THRESHOLD__ISHARP_NOISEDET_DTHRE_MASK                                           0x03FF0000L
+//DSCL3_ISHARP_NOISE_GAIN_PWL
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN__SHIFT                                      0x0
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN__SHIFT                                        0x8
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE__SHIFT                                         0x10
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_START_IN_MASK                                        0x0000001FL
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_END_IN_MASK                                          0x00001F00L
+#define DSCL3_ISHARP_NOISE_GAIN_PWL__ISHARP_NOISEDET_PWL_SLOPE_MASK                                           0x3FFF0000L
+//DSCL3_ISHARP_LBA_PWL_SEG0
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0__SHIFT                                           0x14
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_IN_SEG0_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_BASE_SEG0_MASK                                              0x0003F000L
+#define DSCL3_ISHARP_LBA_PWL_SEG0__ISHARP_LBA_PWL_SLOPE_SEG0_MASK                                             0x1FF00000L
+//DSCL3_ISHARP_LBA_PWL_SEG1
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1__SHIFT                                           0x14
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_IN_SEG1_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_BASE_SEG1_MASK                                              0x0003F000L
+#define DSCL3_ISHARP_LBA_PWL_SEG1__ISHARP_LBA_PWL_SLOPE_SEG1_MASK                                             0x1FF00000L
+//DSCL3_ISHARP_LBA_PWL_SEG2
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2__SHIFT                                           0x14
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_IN_SEG2_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_BASE_SEG2_MASK                                              0x0003F000L
+#define DSCL3_ISHARP_LBA_PWL_SEG2__ISHARP_LBA_PWL_SLOPE_SEG2_MASK                                             0x1FF00000L
+//DSCL3_ISHARP_LBA_PWL_SEG3
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3__SHIFT                                           0x14
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_IN_SEG3_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_BASE_SEG3_MASK                                              0x0003F000L
+#define DSCL3_ISHARP_LBA_PWL_SEG3__ISHARP_LBA_PWL_SLOPE_SEG3_MASK                                             0x1FF00000L
+//DSCL3_ISHARP_LBA_PWL_SEG4
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4__SHIFT                                           0x14
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_IN_SEG4_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_BASE_SEG4_MASK                                              0x0003F000L
+#define DSCL3_ISHARP_LBA_PWL_SEG4__ISHARP_LBA_PWL_SLOPE_SEG4_MASK                                             0x1FF00000L
+//DSCL3_ISHARP_LBA_PWL_SEG5
+#define DSCL3_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5__SHIFT                                              0x0
+#define DSCL3_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5__SHIFT                                            0xc
+#define DSCL3_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_IN_SEG5_MASK                                                0x000003FFL
+#define DSCL3_ISHARP_LBA_PWL_SEG5__ISHARP_LBA_PWL_BASE_SEG5_MASK                                              0x0003F000L
+//DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE__SHIFT                            0x0
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS__SHIFT                              0x2
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE__SHIFT                            0x4
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_FORCE_MASK                              0x00000003L
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_DIS_MASK                                0x00000004L
+#define DSCL3_ISHARP_DELTA_LUT_MEM_PWR_CTRL__ISHARP_DELTA_LUT_MEM_PWR_STATE_MASK                              0x00000030L
+//DSCL3_DSCL_DEBUG
+#define DSCL3_DSCL_DEBUG__SCL_DEBUG__SHIFT                                                                    0x0
+#define DSCL3_DSCL_DEBUG__SCL_DEBUG_MASK                                                                      0xFFFFFFFFL
+//DSCL3_DSCL_TEST_DEBUG_INDEX
+#define DSCL3_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX__SHIFT                                              0x0
+#define DSCL3_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN__SHIFT                                           0x8
+#define DSCL3_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_INDEX_MASK                                                0x000000FFL
+#define DSCL3_DSCL_TEST_DEBUG_INDEX__SCL_TEST_DEBUG_WRITE_EN_MASK                                             0x00000100L
+//DSCL3_DSCL_TEST_DEBUG_DATA
+#define DSCL3_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA__SHIFT                                                0x0
+#define DSCL3_DSCL_TEST_DEBUG_DATA__SCL_TEST_DEBUG_DATA_MASK                                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp3_dispdec_cm_dispdec
+//CM3_CM_CONTROL
+#define CM3_CM_CONTROL__CM_BYPASS__SHIFT                                                                      0x0
+#define CM3_CM_CONTROL__CM_UPDATE_PENDING__SHIFT                                                              0x8
+#define CM3_CM_CONTROL__CM_BYPASS_MASK                                                                        0x00000001L
+#define CM3_CM_CONTROL__CM_UPDATE_PENDING_MASK                                                                0x00000100L
+//CM3_CM_POST_CSC_CONTROL
+#define CM3_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE__SHIFT                                                      0x0
+#define CM3_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT__SHIFT                                              0x2
+#define CM3_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_MASK                                                        0x00000003L
+#define CM3_CM_POST_CSC_CONTROL__CM_POST_CSC_MODE_CURRENT_MASK                                                0x0000000CL
+//CM3_CM_POST_CSC_C11_C12
+#define CM3_CM_POST_CSC_C11_C12__CM_POST_CSC_C11__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C11_C12__CM_POST_CSC_C12__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C11_C12__CM_POST_CSC_C11_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C11_C12__CM_POST_CSC_C12_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_C13_C14
+#define CM3_CM_POST_CSC_C13_C14__CM_POST_CSC_C13__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C13_C14__CM_POST_CSC_C14__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C13_C14__CM_POST_CSC_C13_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C13_C14__CM_POST_CSC_C14_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_C21_C22
+#define CM3_CM_POST_CSC_C21_C22__CM_POST_CSC_C21__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C21_C22__CM_POST_CSC_C22__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C21_C22__CM_POST_CSC_C21_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C21_C22__CM_POST_CSC_C22_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_C23_C24
+#define CM3_CM_POST_CSC_C23_C24__CM_POST_CSC_C23__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C23_C24__CM_POST_CSC_C24__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C23_C24__CM_POST_CSC_C23_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C23_C24__CM_POST_CSC_C24_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_C31_C32
+#define CM3_CM_POST_CSC_C31_C32__CM_POST_CSC_C31__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C31_C32__CM_POST_CSC_C32__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C31_C32__CM_POST_CSC_C31_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C31_C32__CM_POST_CSC_C32_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_C33_C34
+#define CM3_CM_POST_CSC_C33_C34__CM_POST_CSC_C33__SHIFT                                                       0x0
+#define CM3_CM_POST_CSC_C33_C34__CM_POST_CSC_C34__SHIFT                                                       0x10
+#define CM3_CM_POST_CSC_C33_C34__CM_POST_CSC_C33_MASK                                                         0x0000FFFFL
+#define CM3_CM_POST_CSC_C33_C34__CM_POST_CSC_C34_MASK                                                         0xFFFF0000L
+//CM3_CM_POST_CSC_B_C11_C12
+#define CM3_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C11_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C11_C12__CM_POST_CSC_B_C12_MASK                                                     0xFFFF0000L
+//CM3_CM_POST_CSC_B_C13_C14
+#define CM3_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C13_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C13_C14__CM_POST_CSC_B_C14_MASK                                                     0xFFFF0000L
+//CM3_CM_POST_CSC_B_C21_C22
+#define CM3_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C21_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C21_C22__CM_POST_CSC_B_C22_MASK                                                     0xFFFF0000L
+//CM3_CM_POST_CSC_B_C23_C24
+#define CM3_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C23_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C23_C24__CM_POST_CSC_B_C24_MASK                                                     0xFFFF0000L
+//CM3_CM_POST_CSC_B_C31_C32
+#define CM3_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C31_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C31_C32__CM_POST_CSC_B_C32_MASK                                                     0xFFFF0000L
+//CM3_CM_POST_CSC_B_C33_C34
+#define CM3_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33__SHIFT                                                   0x0
+#define CM3_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34__SHIFT                                                   0x10
+#define CM3_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C33_MASK                                                     0x0000FFFFL
+#define CM3_CM_POST_CSC_B_C33_C34__CM_POST_CSC_B_C34_MASK                                                     0xFFFF0000L
+//CM3_CM_BIAS_CR_R
+#define CM3_CM_BIAS_CR_R__CM_BIAS_CR_R__SHIFT                                                                 0x0
+#define CM3_CM_BIAS_CR_R__CM_BIAS_CR_R_MASK                                                                   0x0000FFFFL
+//CM3_CM_BIAS_Y_G_CB_B
+#define CM3_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G__SHIFT                                                              0x0
+#define CM3_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B__SHIFT                                                             0x10
+#define CM3_CM_BIAS_Y_G_CB_B__CM_BIAS_Y_G_MASK                                                                0x0000FFFFL
+#define CM3_CM_BIAS_Y_G_CB_B__CM_BIAS_CB_B_MASK                                                               0xFFFF0000L
+//CM3_CM_GAMCOR_CONTROL
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE__SHIFT                                                          0x0
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT__SHIFT                                                        0x2
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE__SHIFT                                                   0x3
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT__SHIFT                                                  0x4
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT__SHIFT                                                0x6
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_MASK                                                            0x00000003L
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_MASK                                                          0x00000004L
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_PWL_DISABLE_MASK                                                     0x00000008L
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_MODE_CURRENT_MASK                                                    0x00000030L
+#define CM3_CM_GAMCOR_CONTROL__CM_GAMCOR_SELECT_CURRENT_MASK                                                  0x00000040L
+//CM3_CM_GAMCOR_LUT_INDEX
+#define CM3_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX__SHIFT                                                   0x0
+#define CM3_CM_GAMCOR_LUT_INDEX__CM_GAMCOR_LUT_INDEX_MASK                                                     0x000001FFL
+//CM3_CM_GAMCOR_LUT_DATA
+#define CM3_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA__SHIFT                                                     0x0
+#define CM3_CM_GAMCOR_LUT_DATA__CM_GAMCOR_LUT_DATA_MASK                                                       0x0003FFFFL
+//CM3_CM_GAMCOR_LUT_CONTROL
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK__SHIFT                                      0x0
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL__SHIFT                                        0x3
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG__SHIFT                                              0x5
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL__SHIFT                                              0x6
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_WRITE_COLOR_MASK_MASK                                        0x00000007L
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_COLOR_SEL_MASK                                          0x00000018L
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_READ_DBG_MASK                                                0x00000020L
+#define CM3_CM_GAMCOR_LUT_CONTROL__CM_GAMCOR_LUT_HOST_SEL_MASK                                                0x00000040L
+//CM3_CM_GAMCOR_RAMA_START_CNTL_B
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMA_START_CNTL_G
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMA_START_CNTL_R
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMA_START_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMA_START_SLOPE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_B
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_B__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_G
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_G__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_R
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMA_START_BASE_CNTL_R__CM_GAMCOR_RAMA_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_END_CNTL1_B
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_B__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_END_CNTL2_B
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_B__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMA_END_CNTL1_G
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_G__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_END_CNTL2_G
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_G__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMA_END_CNTL1_R
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL1_R__CM_GAMCOR_RAMA_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMA_END_CNTL2_R
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMA_END_CNTL2_R__CM_GAMCOR_RAMA_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMA_OFFSET_B
+#define CM3_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMA_OFFSET_B__CM_GAMCOR_RAMA_OFFSET_B_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMA_OFFSET_G
+#define CM3_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMA_OFFSET_G__CM_GAMCOR_RAMA_OFFSET_G_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMA_OFFSET_R
+#define CM3_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMA_OFFSET_R__CM_GAMCOR_RAMA_OFFSET_R_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMA_REGION_0_1
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_0_1__CM_GAMCOR_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_2_3
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_2_3__CM_GAMCOR_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_4_5
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_4_5__CM_GAMCOR_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_6_7
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_6_7__CM_GAMCOR_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_8_9
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_8_9__CM_GAMCOR_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_10_11
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_10_11__CM_GAMCOR_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_12_13
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_12_13__CM_GAMCOR_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_14_15
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_14_15__CM_GAMCOR_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_16_17
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_16_17__CM_GAMCOR_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_18_19
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_18_19__CM_GAMCOR_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_20_21
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_20_21__CM_GAMCOR_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_22_23
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_22_23__CM_GAMCOR_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_24_25
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_24_25__CM_GAMCOR_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_26_27
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_26_27__CM_GAMCOR_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_28_29
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_28_29__CM_GAMCOR_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_30_31
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_30_31__CM_GAMCOR_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMA_REGION_32_33
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMA_REGION_32_33__CM_GAMCOR_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_START_CNTL_B
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_B_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_B_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMB_START_CNTL_G
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_G_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_G_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMB_START_CNTL_R
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R__SHIFT                             0x0
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT                     0x14
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_R_MASK                               0x0003FFFFL
+#define CM3_CM_GAMCOR_RAMB_START_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SEGMENT_R_MASK                       0x07F00000L
+//CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_B_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_G_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R__SHIFT                 0x0
+#define CM3_CM_GAMCOR_RAMB_START_SLOPE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_SLOPE_R_MASK                   0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_B
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_B__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_B_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_G
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_G__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_G_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_R
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R__SHIFT                   0x0
+#define CM3_CM_GAMCOR_RAMB_START_BASE_CNTL_R__CM_GAMCOR_RAMB_EXP_REGION_START_BASE_R_MASK                     0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_END_CNTL1_B
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_B__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_B_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_END_CNTL2_B
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_B_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_B__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_B_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMB_END_CNTL1_G
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_G__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_G_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_END_CNTL2_G
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_G_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_G__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_G_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMB_END_CNTL1_R
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL1_R__CM_GAMCOR_RAMB_EXP_REGION_END_BASE_R_MASK                             0x0003FFFFL
+//CM3_CM_GAMCOR_RAMB_END_CNTL2_R
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R__SHIFT                                0x0
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                          0x10
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_R_MASK                                  0x0000FFFFL
+#define CM3_CM_GAMCOR_RAMB_END_CNTL2_R__CM_GAMCOR_RAMB_EXP_REGION_END_SLOPE_R_MASK                            0xFFFF0000L
+//CM3_CM_GAMCOR_RAMB_OFFSET_B
+#define CM3_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMB_OFFSET_B__CM_GAMCOR_RAMB_OFFSET_B_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMB_OFFSET_G
+#define CM3_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMB_OFFSET_G__CM_GAMCOR_RAMB_OFFSET_G_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMB_OFFSET_R
+#define CM3_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R__SHIFT                                           0x0
+#define CM3_CM_GAMCOR_RAMB_OFFSET_R__CM_GAMCOR_RAMB_OFFSET_R_MASK                                             0x0007FFFFL
+//CM3_CM_GAMCOR_RAMB_REGION_0_1
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_0_1__CM_GAMCOR_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_2_3
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_2_3__CM_GAMCOR_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_4_5
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_4_5__CM_GAMCOR_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_6_7
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_6_7__CM_GAMCOR_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_8_9
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                           0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                         0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                           0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                         0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_LUT_OFFSET_MASK                             0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                           0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_LUT_OFFSET_MASK                             0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_8_9__CM_GAMCOR_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                           0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_10_11
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_10_11__CM_GAMCOR_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_12_13
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_12_13__CM_GAMCOR_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_14_15
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_14_15__CM_GAMCOR_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_16_17
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_16_17__CM_GAMCOR_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_18_19
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_18_19__CM_GAMCOR_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_20_21
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_20_21__CM_GAMCOR_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_22_23
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_22_23__CM_GAMCOR_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_24_25
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_24_25__CM_GAMCOR_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_26_27
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_26_27__CM_GAMCOR_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_28_29
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_28_29__CM_GAMCOR_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_30_31
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_30_31__CM_GAMCOR_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_GAMCOR_RAMB_REGION_32_33
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                        0x0
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT                      0xc
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                        0x10
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT                      0x1c
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_LUT_OFFSET_MASK                          0x000001FFL
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                        0x00007000L
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_LUT_OFFSET_MASK                          0x01FF0000L
+#define CM3_CM_GAMCOR_RAMB_REGION_32_33__CM_GAMCOR_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                        0x70000000L
+//CM3_CM_HDR_MULT_COEF
+#define CM3_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF__SHIFT                                                         0x0
+#define CM3_CM_HDR_MULT_COEF__CM_HDR_MULT_COEF_MASK                                                           0x0007FFFFL
+//CM3_CM_MEM_PWR_CTRL
+#define CM3_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE__SHIFT                                                      0x0
+#define CM3_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS__SHIFT                                                        0x2
+#define CM3_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE__SHIFT                                                        0x8
+#define CM3_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS__SHIFT                                                          0x9
+#define CM3_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_FORCE_MASK                                                        0x00000003L
+#define CM3_CM_MEM_PWR_CTRL__GAMCOR_MEM_PWR_DIS_MASK                                                          0x00000004L
+#define CM3_CM_MEM_PWR_CTRL__HIST_MEM_PWR_FORCE_MASK                                                          0x00000100L
+#define CM3_CM_MEM_PWR_CTRL__HIST_MEM_PWR_DIS_MASK                                                            0x00000200L
+//CM3_CM_MEM_PWR_STATUS
+#define CM3_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE__SHIFT                                                    0x0
+#define CM3_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE__SHIFT                                                      0x8
+#define CM3_CM_MEM_PWR_STATUS__GAMCOR_MEM_PWR_STATE_MASK                                                      0x00000003L
+#define CM3_CM_MEM_PWR_STATUS__HIST_MEM_PWR_STATE_MASK                                                        0x00000100L
+//CM3_CM_DEALPHA
+#define CM3_CM_DEALPHA__CM_DEALPHA_EN__SHIFT                                                                  0x0
+#define CM3_CM_DEALPHA__CM_DEALPHA_ABLND__SHIFT                                                               0x1
+#define CM3_CM_DEALPHA__CM_DEALPHA_EN_MASK                                                                    0x00000001L
+#define CM3_CM_DEALPHA__CM_DEALPHA_ABLND_MASK                                                                 0x00000002L
+//CM3_CM_COEF_FORMAT
+#define CM3_CM_COEF_FORMAT__CM_BIAS_FORMAT__SHIFT                                                             0x0
+#define CM3_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT__SHIFT                                                    0x4
+#define CM3_CM_COEF_FORMAT__CM_BIAS_FORMAT_MASK                                                               0x00000001L
+#define CM3_CM_COEF_FORMAT__CM_POST_CSC_COEF_FORMAT_MASK                                                      0x00000010L
+//CM3_CM_TEST_DEBUG_INDEX
+#define CM3_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX__SHIFT                                                   0x0
+#define CM3_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN__SHIFT                                                0x8
+#define CM3_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_INDEX_MASK                                                     0x000000FFL
+#define CM3_CM_TEST_DEBUG_INDEX__CM_TEST_DEBUG_WRITE_EN_MASK                                                  0x00000100L
+//CM3_CM_TEST_DEBUG_DATA
+#define CM3_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define CM3_CM_TEST_DEBUG_DATA__CM_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//CM3_CM_HIST_CNTL
+#define CM3_CM_HIST_CNTL__CM_HIST_SEL__SHIFT                                                                  0x0
+#define CM3_CM_HIST_CNTL__CM_HIST_CH_EN__SHIFT                                                                0x2
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC1_SEL__SHIFT                                                             0x4
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC2_SEL__SHIFT                                                             0x5
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC3_SEL__SHIFT                                                             0x6
+#define CM3_CM_HIST_CNTL__CM_HIST_CH1_XBAR__SHIFT                                                             0x7
+#define CM3_CM_HIST_CNTL__CM_HIST_CH2_XBAR__SHIFT                                                             0x9
+#define CM3_CM_HIST_CNTL__CM_HIST_CH3_XBAR__SHIFT                                                             0xb
+#define CM3_CM_HIST_CNTL__CM_HIST_FORMAT__SHIFT                                                               0xd
+#define CM3_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK__SHIFT                                                    0xf
+#define CM3_CM_HIST_CNTL__CM_HIST_SEL_MASK                                                                    0x00000003L
+#define CM3_CM_HIST_CNTL__CM_HIST_CH_EN_MASK                                                                  0x0000000CL
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC1_SEL_MASK                                                               0x00000010L
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC2_SEL_MASK                                                               0x00000020L
+#define CM3_CM_HIST_CNTL__CM_HIST_SRC3_SEL_MASK                                                               0x00000040L
+#define CM3_CM_HIST_CNTL__CM_HIST_CH1_XBAR_MASK                                                               0x00000180L
+#define CM3_CM_HIST_CNTL__CM_HIST_CH2_XBAR_MASK                                                               0x00000600L
+#define CM3_CM_HIST_CNTL__CM_HIST_CH3_XBAR_MASK                                                               0x00001800L
+#define CM3_CM_HIST_CNTL__CM_HIST_FORMAT_MASK                                                                 0x00006000L
+#define CM3_CM_HIST_CNTL__CM_HIST_READ_CHANNEL_MASK_MASK                                                      0x00038000L
+//CM3_CM_HIST_SCALE_SRC1
+#define CM3_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1__SHIFT                                                     0x0
+#define CM3_CM_HIST_SCALE_SRC1__CM_HIST_SCALE_SRC1_MASK                                                       0x0007FFFFL
+//CM3_CM_HIST_COEFA_SRC2
+#define CM3_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2__SHIFT                                                     0x0
+#define CM3_CM_HIST_COEFA_SRC2__CM_HIST_COEFA_SRC2_MASK                                                       0x0007FFFFL
+//CM3_CM_HIST_COEFB_SRC2
+#define CM3_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2__SHIFT                                                     0x0
+#define CM3_CM_HIST_COEFB_SRC2__CM_HIST_COEFB_SRC2_MASK                                                       0x0007FFFFL
+//CM3_CM_HIST_COEFC_SRC2
+#define CM3_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2__SHIFT                                                     0x0
+#define CM3_CM_HIST_COEFC_SRC2__CM_HIST_COEFC_SRC2_MASK                                                       0x0007FFFFL
+//CM3_CM_HIST_SCALE_SRC3
+#define CM3_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3__SHIFT                                                     0x0
+#define CM3_CM_HIST_SCALE_SRC3__CM_HIST_SCALE_SRC3_MASK                                                       0x0007FFFFL
+//CM3_CM_HIST_BIAS_SRC1
+#define CM3_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1__SHIFT                                                       0x0
+#define CM3_CM_HIST_BIAS_SRC1__CM_HIST_BIAS_SRC1_MASK                                                         0x0007FFFFL
+//CM3_CM_HIST_BIAS_SRC2
+#define CM3_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2__SHIFT                                                       0x0
+#define CM3_CM_HIST_BIAS_SRC2__CM_HIST_BIAS_SRC2_MASK                                                         0x0007FFFFL
+//CM3_CM_HIST_BIAS_SRC3
+#define CM3_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3__SHIFT                                                       0x0
+#define CM3_CM_HIST_BIAS_SRC3__CM_HIST_BIAS_SRC3_MASK                                                         0x0007FFFFL
+//CM3_CM_HIST_LOCK
+#define CM3_CM_HIST_LOCK__CM_HIST_LOCK__SHIFT                                                                 0x0
+#define CM3_CM_HIST_LOCK__CM_HIST_LOCK_MASK                                                                   0x00000001L
+//CM3_CM_HIST_INDEX
+#define CM3_CM_HIST_INDEX__CM_HIST_INDEX__SHIFT                                                               0x0
+#define CM3_CM_HIST_INDEX__CM_HIST_INDEX_MASK                                                                 0x000000FFL
+//CM3_CM_HIST_DATA
+#define CM3_CM_HIST_DATA__CM_HIST_DATA__SHIFT                                                                 0x0
+#define CM3_CM_HIST_DATA__CM_HIST_DATA_MASK                                                                   0x01FFFFFFL
+//CM3_CM_HIST_STATUS
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS__SHIFT                                                    0x0
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS__SHIFT                                                    0x1
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT__SHIFT                                                 0x2
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ__SHIFT                                                    0x3
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED__SHIFT                                              0x4
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT__SHIFT                                      0x5
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT__SHIFT                                          0x6
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED__SHIFT                                            0xc
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0xd
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED__SHIFT                                            0x10
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT__SHIFT                                    0x11
+#define CM3_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW__SHIFT                                                     0x18
+#define CM3_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT__SHIFT                                             0x19
+#define CM3_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE__SHIFT                                                 0x1a
+#define CM3_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT__SHIFT                                         0x1b
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_RDY_STATUS_MASK                                                      0x00000001L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_RDY_STATUS_MASK                                                      0x00000002L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_COLLECT_MASK                                                   0x00000004L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFF_INUSE_READ_MASK                                                      0x00000008L
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_MASK                                                0x00000010L
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CURRENT_MASK                                        0x00000020L
+#define CM3_CM_HIST_STATUS__CM_HIST_FRAME_COLLECT_SKIPPED_CNT_MASK                                            0x000001C0L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_MASK                                              0x00001000L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFA_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00002000L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_MASK                                              0x00010000L
+#define CM3_CM_HIST_STATUS__CM_HIST_BUFB_FRAME_READ_SKIPPED_CURRENT_MASK                                      0x00020000L
+#define CM3_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_MASK                                                       0x01000000L
+#define CM3_CM_HIST_STATUS__CM_HIST_COUNT_OVERFLOW_CURRENT_MASK                                               0x02000000L
+#define CM3_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_MASK                                                   0x04000000L
+#define CM3_CM_HIST_STATUS__CM_HIST_COLLECT_INCOMPLETE_CURRENT_MASK                                           0x08000000L
+//CM3_CM_HIST_INT_CONTROL
+#define CM3_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT__SHIFT                                                       0x0
+#define CM3_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN__SHIFT                                                    0x4
+#define CM3_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_MASK                                                         0x00000001L
+#define CM3_CM_HIST_INT_CONTROL__CM_HIST_RDY_INT_EN_MASK                                                      0x00000010L
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dpp_top_dispdec
+//DPP_TOP3_DPP_CONTROL
+#define DPP_TOP3_DPP_CONTROL__DPP_CLOCK_ENABLE__SHIFT                                                         0x4
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_GATE_DISABLE__SHIFT                                                    0x8
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE__SHIFT                                                0xa
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE__SHIFT                                               0xc
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE__SHIFT                                               0xd
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_R_GATE_DISABLE__SHIFT                                                    0xe
+#define DPP_TOP3_DPP_CONTROL__DISPCLK_R_GATE_DISABLE__SHIFT                                                   0x10
+#define DPP_TOP3_DPP_CONTROL__DISPCLK_G_GATE_DISABLE__SHIFT                                                   0x12
+#define DPP_TOP3_DPP_CONTROL__DPP_FGCG_REP_DIS__SHIFT                                                         0x18
+#define DPP_TOP3_DPP_CONTROL__DPP_TEST_CLK_SEL__SHIFT                                                         0x1c
+#define DPP_TOP3_DPP_CONTROL__DPP_CLOCK_ENABLE_MASK                                                           0x00000010L
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_GATE_DISABLE_MASK                                                      0x00000100L
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_DYN_GATE_DISABLE_MASK                                                  0x00000400L
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_DSCL_GATE_DISABLE_MASK                                                 0x00001000L
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_G_UPSP_GATE_DISABLE_MASK                                                 0x00002000L
+#define DPP_TOP3_DPP_CONTROL__DPPCLK_R_GATE_DISABLE_MASK                                                      0x00004000L
+#define DPP_TOP3_DPP_CONTROL__DISPCLK_R_GATE_DISABLE_MASK                                                     0x00010000L
+#define DPP_TOP3_DPP_CONTROL__DISPCLK_G_GATE_DISABLE_MASK                                                     0x00040000L
+#define DPP_TOP3_DPP_CONTROL__DPP_FGCG_REP_DIS_MASK                                                           0x01000000L
+#define DPP_TOP3_DPP_CONTROL__DPP_TEST_CLK_SEL_MASK                                                           0x70000000L
+//DPP_TOP3_DPP_SOFT_RESET
+#define DPP_TOP3_DPP_SOFT_RESET__CNVC_SOFT_RESET__SHIFT                                                       0x0
+#define DPP_TOP3_DPP_SOFT_RESET__DSCL_SOFT_RESET__SHIFT                                                       0x4
+#define DPP_TOP3_DPP_SOFT_RESET__CM_SOFT_RESET__SHIFT                                                         0x8
+#define DPP_TOP3_DPP_SOFT_RESET__OBUF_SOFT_RESET__SHIFT                                                       0xc
+#define DPP_TOP3_DPP_SOFT_RESET__HIST_SOFT_RESET__SHIFT                                                       0x10
+#define DPP_TOP3_DPP_SOFT_RESET__CNVC_SOFT_RESET_MASK                                                         0x00000001L
+#define DPP_TOP3_DPP_SOFT_RESET__DSCL_SOFT_RESET_MASK                                                         0x00000010L
+#define DPP_TOP3_DPP_SOFT_RESET__CM_SOFT_RESET_MASK                                                           0x00000100L
+#define DPP_TOP3_DPP_SOFT_RESET__OBUF_SOFT_RESET_MASK                                                         0x00001000L
+#define DPP_TOP3_DPP_SOFT_RESET__HIST_SOFT_RESET_MASK                                                         0x00010000L
+//DPP_TOP3_DPP_CRC_VAL_R
+#define DPP_TOP3_DPP_CRC_VAL_R__DPP_CRC_R_CR__SHIFT                                                           0x0
+#define DPP_TOP3_DPP_CRC_VAL_R__DPP_CRC_R_CR_MASK                                                             0xFFFFFFFFL
+//DPP_TOP3_DPP_CRC_VAL_G
+#define DPP_TOP3_DPP_CRC_VAL_G__DPP_CRC_G_Y__SHIFT                                                            0x0
+#define DPP_TOP3_DPP_CRC_VAL_G__DPP_CRC_G_Y_MASK                                                              0xFFFFFFFFL
+//DPP_TOP3_DPP_CRC_VAL_B
+#define DPP_TOP3_DPP_CRC_VAL_B__DPP_CRC_B_CB__SHIFT                                                           0x0
+#define DPP_TOP3_DPP_CRC_VAL_B__DPP_CRC_B_CB_MASK                                                             0xFFFFFFFFL
+//DPP_TOP3_DPP_CRC_VAL_A
+#define DPP_TOP3_DPP_CRC_VAL_A__DPP_CRC_ALPHA__SHIFT                                                          0x0
+#define DPP_TOP3_DPP_CRC_VAL_A__DPP_CRC_ALPHA_MASK                                                            0xFFFFFFFFL
+//DPP_TOP3_DPP_CRC_CTRL
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_EN__SHIFT                                                              0x0
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_CONT_EN__SHIFT                                                         0x1
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING__SHIFT                                                0x2
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL__SHIFT                                                    0x3
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_SRC_SEL__SHIFT                                                         0x4
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_STEREO_EN__SHIFT                                                       0x6
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE__SHIFT                                                     0x7
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL__SHIFT                                                  0xb
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_MASK__SHIFT                                                            0x10
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_EN_MASK                                                                0x00000001L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_CONT_EN_MASK                                                           0x00000002L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_ONE_SHOT_PENDING_MASK                                                  0x00000004L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_420_COMP_SEL_MASK                                                      0x00000008L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_SRC_SEL_MASK                                                           0x00000030L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_STEREO_EN_MASK                                                         0x00000040L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_STEREO_MODE_MASK                                                       0x00000180L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_PIX_FORMAT_SEL_MASK                                                    0x00003800L
+#define DPP_TOP3_DPP_CRC_CTRL__DPP_CRC_MASK_MASK                                                              0xFFFF0000L
+//DPP_TOP3_HOST_READ_CONTROL
+#define DPP_TOP3_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL__SHIFT                                             0x0
+#define DPP_TOP3_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL_MASK                                               0x000000FFL
+//DPP_TOP3_DPP_DEBUG_SEL
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL__SHIFT                                               0x0
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL__SHIFT                                              0x8
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DBG_EN__SHIFT                                                             0x1f
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DPPCLK_DEBUG_BUS_SEL_MASK                                                 0x00000007L
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DISPCLK_DEBUG_BUS_SEL_MASK                                                0x00000700L
+#define DPP_TOP3_DPP_DEBUG_SEL__DPP_DBG_EN_MASK                                                               0x80000000L
+//DPP_TOP3_DPP_DEBUG_SPARE
+#define DPP_TOP3_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE__SHIFT                                                      0x0
+#define DPP_TOP3_DPP_DEBUG_SPARE__DPP_DEBUG_SPARE_MASK                                                        0xFFFFFFFFL
+//DPP_TOP3_DPP_TEST_DEBUG_INDEX
+#define DPP_TOP3_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX__SHIFT                                            0x0
+#define DPP_TOP3_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN__SHIFT                                         0x8
+#define DPP_TOP3_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_INDEX_MASK                                              0x000000FFL
+#define DPP_TOP3_DPP_TEST_DEBUG_INDEX__DPP_TEST_DEBUG_WRITE_EN_MASK                                           0x00000100L
+//DPP_TOP3_DPP_TEST_DEBUG_DATA
+#define DPP_TOP3_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA__SHIFT                                              0x0
+#define DPP_TOP3_DPP_TEST_DEBUG_DATA__DPP_TEST_DEBUG_DATA_MASK                                                0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dpp3_dispdec_dpp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON13_PERFCOUNTER_CNTL
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON13_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON13_PERFCOUNTER_CNTL2
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON13_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON13_PERFCOUNTER_STATE
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON13_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON13_PERFMON_CNTL
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON13_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON13_PERFMON_CNTL2
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON13_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON13_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON13_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON13_PERFMON_CVALUE_LOW
+#define DC_PERFMON13_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON13_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON13_PERFMON_HI
+#define DC_PERFMON13_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON13_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON13_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON13_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON13_PERFMON_LOW
+#define DC_PERFMON13_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON13_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON13_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON13_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON13_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc0_dispdec
+//MPCC0_MPCC_TOP_SEL
+#define MPCC0_MPCC_TOP_SEL__MPCC_TOP_SEL__SHIFT                                                               0x0
+#define MPCC0_MPCC_TOP_SEL__MPCC_TOP_SEL_MASK                                                                 0x0000000FL
+//MPCC0_MPCC_BOT_SEL
+#define MPCC0_MPCC_BOT_SEL__MPCC_BOT_SEL__SHIFT                                                               0x0
+#define MPCC0_MPCC_BOT_SEL__MPCC_BOT_SEL_MASK                                                                 0x0000000FL
+//MPCC0_MPCC_OPP_ID
+#define MPCC0_MPCC_OPP_ID__MPCC_OPP_ID__SHIFT                                                                 0x0
+#define MPCC0_MPCC_OPP_ID__MPCC_OPP_ID_MASK                                                                   0x0000000FL
+//MPCC0_MPCC_CONTROL
+#define MPCC0_MPCC_CONTROL__MPCC_MODE__SHIFT                                                                  0x0
+#define MPCC0_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE__SHIFT                                                       0x4
+#define MPCC0_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE__SHIFT                                                 0x6
+#define MPCC0_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY__SHIFT                                              0x7
+#define MPCC0_MPCC_CONTROL__MPCC_BG_BPC__SHIFT                                                                0x8
+#define MPCC0_MPCC_CONTROL__MPCC_BOT_GAIN_MODE__SHIFT                                                         0xb
+#define MPCC0_MPCC_CONTROL__MPCC_MODE_MASK                                                                    0x00000003L
+#define MPCC0_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE_MASK                                                         0x00000030L
+#define MPCC0_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE_MASK                                                   0x00000040L
+#define MPCC0_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY_MASK                                                0x00000080L
+#define MPCC0_MPCC_CONTROL__MPCC_BG_BPC_MASK                                                                  0x00000700L
+#define MPCC0_MPCC_CONTROL__MPCC_BOT_GAIN_MODE_MASK                                                           0x00000800L
+//MPCC0_MPCC_CONTROL2
+#define MPCC0_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA__SHIFT                                                         0x0
+#define MPCC0_MPCC_CONTROL2__MPCC_GLOBAL_GAIN__SHIFT                                                          0x10
+#define MPCC0_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA_MASK                                                           0x00000FFFL
+#define MPCC0_MPCC_CONTROL2__MPCC_GLOBAL_GAIN_MASK                                                            0x0FFF0000L
+//MPCC0_MPCC_SM_CONTROL
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_EN__SHIFT                                                              0x0
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_MODE__SHIFT                                                            0x1
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT__SHIFT                                                       0x4
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL__SHIFT                                            0x8
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL__SHIFT                                               0x18
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_EN_MASK                                                                0x00000001L
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_MODE_MASK                                                              0x0000000EL
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT_MASK                                                         0x00000010L
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL_MASK                                              0x00000300L
+#define MPCC0_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL_MASK                                                 0x01000000L
+//MPCC0_MPCC_UPDATE_LOCK_SEL
+#define MPCC0_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL__SHIFT                                               0x0
+#define MPCC0_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS__SHIFT                                          0x4
+#define MPCC0_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL_MASK                                                 0x0000000FL
+#define MPCC0_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS_MASK                                            0x00000070L
+//MPCC0_MPCC_TOP_GAIN
+#define MPCC0_MPCC_TOP_GAIN__MPCC_TOP_GAIN__SHIFT                                                             0x0
+#define MPCC0_MPCC_TOP_GAIN__MPCC_TOP_GAIN_MASK                                                               0x0007FFFFL
+//MPCC0_MPCC_BOT_GAIN_INSIDE
+#define MPCC0_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE__SHIFT                                               0x0
+#define MPCC0_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE_MASK                                                 0x0007FFFFL
+//MPCC0_MPCC_BOT_GAIN_OUTSIDE
+#define MPCC0_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE__SHIFT                                             0x0
+#define MPCC0_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE_MASK                                               0x0007FFFFL
+//MPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL
+#define MPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL__SHIFT                          0x0
+#define MPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT__SHIFT                  0x4
+#define MPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_MASK                            0x00000001L
+#define MPCC0_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT_MASK                    0x00000010L
+//MPCC0_MPCC_BG_R_CR
+#define MPCC0_MPCC_BG_R_CR__MPCC_BG_R_CR__SHIFT                                                               0x0
+#define MPCC0_MPCC_BG_R_CR__MPCC_BG_R_CR_MASK                                                                 0x00000FFFL
+//MPCC0_MPCC_BG_G_Y
+#define MPCC0_MPCC_BG_G_Y__MPCC_BG_G_Y__SHIFT                                                                 0x0
+#define MPCC0_MPCC_BG_G_Y__MPCC_BG_G_Y_MASK                                                                   0x00000FFFL
+//MPCC0_MPCC_BG_B_CB
+#define MPCC0_MPCC_BG_B_CB__MPCC_BG_B_CB__SHIFT                                                               0x0
+#define MPCC0_MPCC_BG_B_CB__MPCC_BG_B_CB_MASK                                                                 0x00000FFFL
+//MPCC0_MPCC_MEM_PWR_CTRL
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE__SHIFT                                               0x0
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS__SHIFT                                                 0x2
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE__SHIFT                                            0x4
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE__SHIFT                                               0x8
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE_MASK                                                 0x00000003L
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS_MASK                                                   0x00000004L
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE_MASK                                              0x00000030L
+#define MPCC0_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE_MASK                                                 0x00000300L
+//MPCC0_MPCC_STATUS
+#define MPCC0_MPCC_STATUS__MPCC_IDLE__SHIFT                                                                   0x0
+#define MPCC0_MPCC_STATUS__MPCC_BUSY__SHIFT                                                                   0x1
+#define MPCC0_MPCC_STATUS__MPCC_DISABLED__SHIFT                                                               0x2
+#define MPCC0_MPCC_STATUS__MPCC_IDLE_MASK                                                                     0x00000001L
+#define MPCC0_MPCC_STATUS__MPCC_BUSY_MASK                                                                     0x00000002L
+#define MPCC0_MPCC_STATUS__MPCC_DISABLED_MASK                                                                 0x00000004L
+//MPCC0_MPCC_REG_UPDATE_STATUS
+#define MPCC0_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS__SHIFT                                   0x0
+#define MPCC0_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS__SHIFT                                0x3
+#define MPCC0_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS_MASK                                     0x00000001L
+#define MPCC0_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS_MASK                                  0x00000008L
+//MPCC0_MPCC_TEST_DEBUG_INDEX
+#define MPCC0_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define MPCC0_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN__SHIFT                                          0x8
+#define MPCC0_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+#define MPCC0_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN_MASK                                            0x00000100L
+//MPCC0_MPCC_TEST_DEBUG_DATA
+#define MPCC0_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define MPCC0_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc1_dispdec
+//MPCC1_MPCC_TOP_SEL
+#define MPCC1_MPCC_TOP_SEL__MPCC_TOP_SEL__SHIFT                                                               0x0
+#define MPCC1_MPCC_TOP_SEL__MPCC_TOP_SEL_MASK                                                                 0x0000000FL
+//MPCC1_MPCC_BOT_SEL
+#define MPCC1_MPCC_BOT_SEL__MPCC_BOT_SEL__SHIFT                                                               0x0
+#define MPCC1_MPCC_BOT_SEL__MPCC_BOT_SEL_MASK                                                                 0x0000000FL
+//MPCC1_MPCC_OPP_ID
+#define MPCC1_MPCC_OPP_ID__MPCC_OPP_ID__SHIFT                                                                 0x0
+#define MPCC1_MPCC_OPP_ID__MPCC_OPP_ID_MASK                                                                   0x0000000FL
+//MPCC1_MPCC_CONTROL
+#define MPCC1_MPCC_CONTROL__MPCC_MODE__SHIFT                                                                  0x0
+#define MPCC1_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE__SHIFT                                                       0x4
+#define MPCC1_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE__SHIFT                                                 0x6
+#define MPCC1_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY__SHIFT                                              0x7
+#define MPCC1_MPCC_CONTROL__MPCC_BG_BPC__SHIFT                                                                0x8
+#define MPCC1_MPCC_CONTROL__MPCC_BOT_GAIN_MODE__SHIFT                                                         0xb
+#define MPCC1_MPCC_CONTROL__MPCC_MODE_MASK                                                                    0x00000003L
+#define MPCC1_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE_MASK                                                         0x00000030L
+#define MPCC1_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE_MASK                                                   0x00000040L
+#define MPCC1_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY_MASK                                                0x00000080L
+#define MPCC1_MPCC_CONTROL__MPCC_BG_BPC_MASK                                                                  0x00000700L
+#define MPCC1_MPCC_CONTROL__MPCC_BOT_GAIN_MODE_MASK                                                           0x00000800L
+//MPCC1_MPCC_CONTROL2
+#define MPCC1_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA__SHIFT                                                         0x0
+#define MPCC1_MPCC_CONTROL2__MPCC_GLOBAL_GAIN__SHIFT                                                          0x10
+#define MPCC1_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA_MASK                                                           0x00000FFFL
+#define MPCC1_MPCC_CONTROL2__MPCC_GLOBAL_GAIN_MASK                                                            0x0FFF0000L
+//MPCC1_MPCC_SM_CONTROL
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_EN__SHIFT                                                              0x0
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_MODE__SHIFT                                                            0x1
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT__SHIFT                                                       0x4
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL__SHIFT                                            0x8
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL__SHIFT                                               0x18
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_EN_MASK                                                                0x00000001L
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_MODE_MASK                                                              0x0000000EL
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT_MASK                                                         0x00000010L
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL_MASK                                              0x00000300L
+#define MPCC1_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL_MASK                                                 0x01000000L
+//MPCC1_MPCC_UPDATE_LOCK_SEL
+#define MPCC1_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL__SHIFT                                               0x0
+#define MPCC1_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS__SHIFT                                          0x4
+#define MPCC1_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL_MASK                                                 0x0000000FL
+#define MPCC1_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS_MASK                                            0x00000070L
+//MPCC1_MPCC_TOP_GAIN
+#define MPCC1_MPCC_TOP_GAIN__MPCC_TOP_GAIN__SHIFT                                                             0x0
+#define MPCC1_MPCC_TOP_GAIN__MPCC_TOP_GAIN_MASK                                                               0x0007FFFFL
+//MPCC1_MPCC_BOT_GAIN_INSIDE
+#define MPCC1_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE__SHIFT                                               0x0
+#define MPCC1_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE_MASK                                                 0x0007FFFFL
+//MPCC1_MPCC_BOT_GAIN_OUTSIDE
+#define MPCC1_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE__SHIFT                                             0x0
+#define MPCC1_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE_MASK                                               0x0007FFFFL
+//MPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL
+#define MPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL__SHIFT                          0x0
+#define MPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT__SHIFT                  0x4
+#define MPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_MASK                            0x00000001L
+#define MPCC1_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT_MASK                    0x00000010L
+//MPCC1_MPCC_BG_R_CR
+#define MPCC1_MPCC_BG_R_CR__MPCC_BG_R_CR__SHIFT                                                               0x0
+#define MPCC1_MPCC_BG_R_CR__MPCC_BG_R_CR_MASK                                                                 0x00000FFFL
+//MPCC1_MPCC_BG_G_Y
+#define MPCC1_MPCC_BG_G_Y__MPCC_BG_G_Y__SHIFT                                                                 0x0
+#define MPCC1_MPCC_BG_G_Y__MPCC_BG_G_Y_MASK                                                                   0x00000FFFL
+//MPCC1_MPCC_BG_B_CB
+#define MPCC1_MPCC_BG_B_CB__MPCC_BG_B_CB__SHIFT                                                               0x0
+#define MPCC1_MPCC_BG_B_CB__MPCC_BG_B_CB_MASK                                                                 0x00000FFFL
+//MPCC1_MPCC_MEM_PWR_CTRL
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE__SHIFT                                               0x0
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS__SHIFT                                                 0x2
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE__SHIFT                                            0x4
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE__SHIFT                                               0x8
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE_MASK                                                 0x00000003L
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS_MASK                                                   0x00000004L
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE_MASK                                              0x00000030L
+#define MPCC1_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE_MASK                                                 0x00000300L
+//MPCC1_MPCC_STATUS
+#define MPCC1_MPCC_STATUS__MPCC_IDLE__SHIFT                                                                   0x0
+#define MPCC1_MPCC_STATUS__MPCC_BUSY__SHIFT                                                                   0x1
+#define MPCC1_MPCC_STATUS__MPCC_DISABLED__SHIFT                                                               0x2
+#define MPCC1_MPCC_STATUS__MPCC_IDLE_MASK                                                                     0x00000001L
+#define MPCC1_MPCC_STATUS__MPCC_BUSY_MASK                                                                     0x00000002L
+#define MPCC1_MPCC_STATUS__MPCC_DISABLED_MASK                                                                 0x00000004L
+//MPCC1_MPCC_REG_UPDATE_STATUS
+#define MPCC1_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS__SHIFT                                   0x0
+#define MPCC1_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS__SHIFT                                0x3
+#define MPCC1_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS_MASK                                     0x00000001L
+#define MPCC1_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS_MASK                                  0x00000008L
+//MPCC1_MPCC_TEST_DEBUG_INDEX
+#define MPCC1_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define MPCC1_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN__SHIFT                                          0x8
+#define MPCC1_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+#define MPCC1_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN_MASK                                            0x00000100L
+//MPCC1_MPCC_TEST_DEBUG_DATA
+#define MPCC1_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define MPCC1_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc2_dispdec
+//MPCC2_MPCC_TOP_SEL
+#define MPCC2_MPCC_TOP_SEL__MPCC_TOP_SEL__SHIFT                                                               0x0
+#define MPCC2_MPCC_TOP_SEL__MPCC_TOP_SEL_MASK                                                                 0x0000000FL
+//MPCC2_MPCC_BOT_SEL
+#define MPCC2_MPCC_BOT_SEL__MPCC_BOT_SEL__SHIFT                                                               0x0
+#define MPCC2_MPCC_BOT_SEL__MPCC_BOT_SEL_MASK                                                                 0x0000000FL
+//MPCC2_MPCC_OPP_ID
+#define MPCC2_MPCC_OPP_ID__MPCC_OPP_ID__SHIFT                                                                 0x0
+#define MPCC2_MPCC_OPP_ID__MPCC_OPP_ID_MASK                                                                   0x0000000FL
+//MPCC2_MPCC_CONTROL
+#define MPCC2_MPCC_CONTROL__MPCC_MODE__SHIFT                                                                  0x0
+#define MPCC2_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE__SHIFT                                                       0x4
+#define MPCC2_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE__SHIFT                                                 0x6
+#define MPCC2_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY__SHIFT                                              0x7
+#define MPCC2_MPCC_CONTROL__MPCC_BG_BPC__SHIFT                                                                0x8
+#define MPCC2_MPCC_CONTROL__MPCC_BOT_GAIN_MODE__SHIFT                                                         0xb
+#define MPCC2_MPCC_CONTROL__MPCC_MODE_MASK                                                                    0x00000003L
+#define MPCC2_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE_MASK                                                         0x00000030L
+#define MPCC2_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE_MASK                                                   0x00000040L
+#define MPCC2_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY_MASK                                                0x00000080L
+#define MPCC2_MPCC_CONTROL__MPCC_BG_BPC_MASK                                                                  0x00000700L
+#define MPCC2_MPCC_CONTROL__MPCC_BOT_GAIN_MODE_MASK                                                           0x00000800L
+//MPCC2_MPCC_CONTROL2
+#define MPCC2_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA__SHIFT                                                         0x0
+#define MPCC2_MPCC_CONTROL2__MPCC_GLOBAL_GAIN__SHIFT                                                          0x10
+#define MPCC2_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA_MASK                                                           0x00000FFFL
+#define MPCC2_MPCC_CONTROL2__MPCC_GLOBAL_GAIN_MASK                                                            0x0FFF0000L
+//MPCC2_MPCC_SM_CONTROL
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_EN__SHIFT                                                              0x0
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_MODE__SHIFT                                                            0x1
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT__SHIFT                                                       0x4
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL__SHIFT                                            0x8
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL__SHIFT                                               0x18
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_EN_MASK                                                                0x00000001L
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_MODE_MASK                                                              0x0000000EL
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT_MASK                                                         0x00000010L
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL_MASK                                              0x00000300L
+#define MPCC2_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL_MASK                                                 0x01000000L
+//MPCC2_MPCC_UPDATE_LOCK_SEL
+#define MPCC2_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL__SHIFT                                               0x0
+#define MPCC2_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS__SHIFT                                          0x4
+#define MPCC2_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL_MASK                                                 0x0000000FL
+#define MPCC2_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS_MASK                                            0x00000070L
+//MPCC2_MPCC_TOP_GAIN
+#define MPCC2_MPCC_TOP_GAIN__MPCC_TOP_GAIN__SHIFT                                                             0x0
+#define MPCC2_MPCC_TOP_GAIN__MPCC_TOP_GAIN_MASK                                                               0x0007FFFFL
+//MPCC2_MPCC_BOT_GAIN_INSIDE
+#define MPCC2_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE__SHIFT                                               0x0
+#define MPCC2_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE_MASK                                                 0x0007FFFFL
+//MPCC2_MPCC_BOT_GAIN_OUTSIDE
+#define MPCC2_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE__SHIFT                                             0x0
+#define MPCC2_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE_MASK                                               0x0007FFFFL
+//MPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL
+#define MPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL__SHIFT                          0x0
+#define MPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT__SHIFT                  0x4
+#define MPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_MASK                            0x00000001L
+#define MPCC2_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT_MASK                    0x00000010L
+//MPCC2_MPCC_BG_R_CR
+#define MPCC2_MPCC_BG_R_CR__MPCC_BG_R_CR__SHIFT                                                               0x0
+#define MPCC2_MPCC_BG_R_CR__MPCC_BG_R_CR_MASK                                                                 0x00000FFFL
+//MPCC2_MPCC_BG_G_Y
+#define MPCC2_MPCC_BG_G_Y__MPCC_BG_G_Y__SHIFT                                                                 0x0
+#define MPCC2_MPCC_BG_G_Y__MPCC_BG_G_Y_MASK                                                                   0x00000FFFL
+//MPCC2_MPCC_BG_B_CB
+#define MPCC2_MPCC_BG_B_CB__MPCC_BG_B_CB__SHIFT                                                               0x0
+#define MPCC2_MPCC_BG_B_CB__MPCC_BG_B_CB_MASK                                                                 0x00000FFFL
+//MPCC2_MPCC_MEM_PWR_CTRL
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE__SHIFT                                               0x0
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS__SHIFT                                                 0x2
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE__SHIFT                                            0x4
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE__SHIFT                                               0x8
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE_MASK                                                 0x00000003L
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS_MASK                                                   0x00000004L
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE_MASK                                              0x00000030L
+#define MPCC2_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE_MASK                                                 0x00000300L
+//MPCC2_MPCC_STATUS
+#define MPCC2_MPCC_STATUS__MPCC_IDLE__SHIFT                                                                   0x0
+#define MPCC2_MPCC_STATUS__MPCC_BUSY__SHIFT                                                                   0x1
+#define MPCC2_MPCC_STATUS__MPCC_DISABLED__SHIFT                                                               0x2
+#define MPCC2_MPCC_STATUS__MPCC_IDLE_MASK                                                                     0x00000001L
+#define MPCC2_MPCC_STATUS__MPCC_BUSY_MASK                                                                     0x00000002L
+#define MPCC2_MPCC_STATUS__MPCC_DISABLED_MASK                                                                 0x00000004L
+//MPCC2_MPCC_REG_UPDATE_STATUS
+#define MPCC2_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS__SHIFT                                   0x0
+#define MPCC2_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS__SHIFT                                0x3
+#define MPCC2_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS_MASK                                     0x00000001L
+#define MPCC2_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS_MASK                                  0x00000008L
+//MPCC2_MPCC_TEST_DEBUG_INDEX
+#define MPCC2_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define MPCC2_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN__SHIFT                                          0x8
+#define MPCC2_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+#define MPCC2_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN_MASK                                            0x00000100L
+//MPCC2_MPCC_TEST_DEBUG_DATA
+#define MPCC2_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define MPCC2_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc3_dispdec
+//MPCC3_MPCC_TOP_SEL
+#define MPCC3_MPCC_TOP_SEL__MPCC_TOP_SEL__SHIFT                                                               0x0
+#define MPCC3_MPCC_TOP_SEL__MPCC_TOP_SEL_MASK                                                                 0x0000000FL
+//MPCC3_MPCC_BOT_SEL
+#define MPCC3_MPCC_BOT_SEL__MPCC_BOT_SEL__SHIFT                                                               0x0
+#define MPCC3_MPCC_BOT_SEL__MPCC_BOT_SEL_MASK                                                                 0x0000000FL
+//MPCC3_MPCC_OPP_ID
+#define MPCC3_MPCC_OPP_ID__MPCC_OPP_ID__SHIFT                                                                 0x0
+#define MPCC3_MPCC_OPP_ID__MPCC_OPP_ID_MASK                                                                   0x0000000FL
+//MPCC3_MPCC_CONTROL
+#define MPCC3_MPCC_CONTROL__MPCC_MODE__SHIFT                                                                  0x0
+#define MPCC3_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE__SHIFT                                                       0x4
+#define MPCC3_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE__SHIFT                                                 0x6
+#define MPCC3_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY__SHIFT                                              0x7
+#define MPCC3_MPCC_CONTROL__MPCC_BG_BPC__SHIFT                                                                0x8
+#define MPCC3_MPCC_CONTROL__MPCC_BOT_GAIN_MODE__SHIFT                                                         0xb
+#define MPCC3_MPCC_CONTROL__MPCC_MODE_MASK                                                                    0x00000003L
+#define MPCC3_MPCC_CONTROL__MPCC_ALPHA_BLND_MODE_MASK                                                         0x00000030L
+#define MPCC3_MPCC_CONTROL__MPCC_ALPHA_MULTIPLIED_MODE_MASK                                                   0x00000040L
+#define MPCC3_MPCC_CONTROL__MPCC_BLND_ACTIVE_OVERLAP_ONLY_MASK                                                0x00000080L
+#define MPCC3_MPCC_CONTROL__MPCC_BG_BPC_MASK                                                                  0x00000700L
+#define MPCC3_MPCC_CONTROL__MPCC_BOT_GAIN_MODE_MASK                                                           0x00000800L
+//MPCC3_MPCC_CONTROL2
+#define MPCC3_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA__SHIFT                                                         0x0
+#define MPCC3_MPCC_CONTROL2__MPCC_GLOBAL_GAIN__SHIFT                                                          0x10
+#define MPCC3_MPCC_CONTROL2__MPCC_GLOBAL_ALPHA_MASK                                                           0x00000FFFL
+#define MPCC3_MPCC_CONTROL2__MPCC_GLOBAL_GAIN_MASK                                                            0x0FFF0000L
+//MPCC3_MPCC_SM_CONTROL
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_EN__SHIFT                                                              0x0
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_MODE__SHIFT                                                            0x1
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT__SHIFT                                                       0x4
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL__SHIFT                                            0x8
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL__SHIFT                                               0x18
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_EN_MASK                                                                0x00000001L
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_MODE_MASK                                                              0x0000000EL
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_FRAME_ALT_MASK                                                         0x00000010L
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_FORCE_NEXT_FRAME_POL_MASK                                              0x00000300L
+#define MPCC3_MPCC_SM_CONTROL__MPCC_SM_CURRENT_FRAME_POL_MASK                                                 0x01000000L
+//MPCC3_MPCC_UPDATE_LOCK_SEL
+#define MPCC3_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL__SHIFT                                               0x0
+#define MPCC3_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS__SHIFT                                          0x4
+#define MPCC3_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCK_SEL_MASK                                                 0x0000000FL
+#define MPCC3_MPCC_UPDATE_LOCK_SEL__MPCC_UPDATE_LOCKED_STATUS_MASK                                            0x00000070L
+//MPCC3_MPCC_TOP_GAIN
+#define MPCC3_MPCC_TOP_GAIN__MPCC_TOP_GAIN__SHIFT                                                             0x0
+#define MPCC3_MPCC_TOP_GAIN__MPCC_TOP_GAIN_MASK                                                               0x0007FFFFL
+//MPCC3_MPCC_BOT_GAIN_INSIDE
+#define MPCC3_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE__SHIFT                                               0x0
+#define MPCC3_MPCC_BOT_GAIN_INSIDE__MPCC_BOT_GAIN_INSIDE_MASK                                                 0x0007FFFFL
+//MPCC3_MPCC_BOT_GAIN_OUTSIDE
+#define MPCC3_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE__SHIFT                                             0x0
+#define MPCC3_MPCC_BOT_GAIN_OUTSIDE__MPCC_BOT_GAIN_OUTSIDE_MASK                                               0x0007FFFFL
+//MPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL
+#define MPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL__SHIFT                          0x0
+#define MPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT__SHIFT                  0x4
+#define MPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_MASK                            0x00000001L
+#define MPCC3_MPCC_MOVABLE_CM_LOCATION_CONTROL__MPCC_MOVABLE_CM_LOCATION_CNTL_CURRENT_MASK                    0x00000010L
+//MPCC3_MPCC_BG_R_CR
+#define MPCC3_MPCC_BG_R_CR__MPCC_BG_R_CR__SHIFT                                                               0x0
+#define MPCC3_MPCC_BG_R_CR__MPCC_BG_R_CR_MASK                                                                 0x00000FFFL
+//MPCC3_MPCC_BG_G_Y
+#define MPCC3_MPCC_BG_G_Y__MPCC_BG_G_Y__SHIFT                                                                 0x0
+#define MPCC3_MPCC_BG_G_Y__MPCC_BG_G_Y_MASK                                                                   0x00000FFFL
+//MPCC3_MPCC_BG_B_CB
+#define MPCC3_MPCC_BG_B_CB__MPCC_BG_B_CB__SHIFT                                                               0x0
+#define MPCC3_MPCC_BG_B_CB__MPCC_BG_B_CB_MASK                                                                 0x00000FFFL
+//MPCC3_MPCC_MEM_PWR_CTRL
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE__SHIFT                                               0x0
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS__SHIFT                                                 0x2
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE__SHIFT                                            0x4
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE__SHIFT                                               0x8
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_FORCE_MASK                                                 0x00000003L
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_DIS_MASK                                                   0x00000004L
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_LOW_PWR_MODE_MASK                                              0x00000030L
+#define MPCC3_MPCC_MEM_PWR_CTRL__MPCC_OGAM_MEM_PWR_STATE_MASK                                                 0x00000300L
+//MPCC3_MPCC_STATUS
+#define MPCC3_MPCC_STATUS__MPCC_IDLE__SHIFT                                                                   0x0
+#define MPCC3_MPCC_STATUS__MPCC_BUSY__SHIFT                                                                   0x1
+#define MPCC3_MPCC_STATUS__MPCC_DISABLED__SHIFT                                                               0x2
+#define MPCC3_MPCC_STATUS__MPCC_IDLE_MASK                                                                     0x00000001L
+#define MPCC3_MPCC_STATUS__MPCC_BUSY_MASK                                                                     0x00000002L
+#define MPCC3_MPCC_STATUS__MPCC_DISABLED_MASK                                                                 0x00000004L
+//MPCC3_MPCC_REG_UPDATE_STATUS
+#define MPCC3_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS__SHIFT                                   0x0
+#define MPCC3_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS__SHIFT                                0x3
+#define MPCC3_MPCC_REG_UPDATE_STATUS__MPCC_REG_UPDATE_PENDING_STATUS_MASK                                     0x00000001L
+#define MPCC3_MPCC_REG_UPDATE_STATUS__MPCC_OPP_ID_UPDATE_PENDING_STATUS_MASK                                  0x00000008L
+//MPCC3_MPCC_TEST_DEBUG_INDEX
+#define MPCC3_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define MPCC3_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN__SHIFT                                          0x8
+#define MPCC3_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+#define MPCC3_MPCC_TEST_DEBUG_INDEX__MPCC_TEST_DEBUG_WRITE_EN_MASK                                            0x00000100L
+//MPCC3_MPCC_TEST_DEBUG_DATA
+#define MPCC3_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define MPCC3_MPCC_TEST_DEBUG_DATA__MPCC_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpc_cfg_dispdec
+//MPC_CLOCK_CONTROL
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE0_GATE_DISABLE__SHIFT                                                0x0
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE1_GATE_DISABLE__SHIFT                                                0x1
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE2_GATE_DISABLE__SHIFT                                                0x2
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE3_GATE_DISABLE__SHIFT                                                0x3
+#define MPC_CLOCK_CONTROL__DISPCLK_R_GATE_DISABLE__SHIFT                                                      0x8
+#define MPC_CLOCK_CONTROL__MPC_TEST_CLK_SEL__SHIFT                                                            0xc
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE0_GATE_DISABLE_MASK                                                  0x00000001L
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE1_GATE_DISABLE_MASK                                                  0x00000002L
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE2_GATE_DISABLE_MASK                                                  0x00000004L
+#define MPC_CLOCK_CONTROL__DISPCLK_G_PIPE3_GATE_DISABLE_MASK                                                  0x00000008L
+#define MPC_CLOCK_CONTROL__DISPCLK_R_GATE_DISABLE_MASK                                                        0x00000100L
+#define MPC_CLOCK_CONTROL__MPC_TEST_CLK_SEL_MASK                                                              0x0000F000L
+//MPC_SOFT_RESET
+#define MPC_SOFT_RESET__MPCC0_SOFT_RESET__SHIFT                                                               0x0
+#define MPC_SOFT_RESET__MPCC1_SOFT_RESET__SHIFT                                                               0x1
+#define MPC_SOFT_RESET__MPCC2_SOFT_RESET__SHIFT                                                               0x2
+#define MPC_SOFT_RESET__MPCC3_SOFT_RESET__SHIFT                                                               0x3
+#define MPC_SOFT_RESET__MPC_SOFT_RESET__SHIFT                                                                 0x1f
+#define MPC_SOFT_RESET__MPCC0_SOFT_RESET_MASK                                                                 0x00000001L
+#define MPC_SOFT_RESET__MPCC1_SOFT_RESET_MASK                                                                 0x00000002L
+#define MPC_SOFT_RESET__MPCC2_SOFT_RESET_MASK                                                                 0x00000004L
+#define MPC_SOFT_RESET__MPCC3_SOFT_RESET_MASK                                                                 0x00000008L
+#define MPC_SOFT_RESET__MPC_SOFT_RESET_MASK                                                                   0x80000000L
+//MPC_CRC_CTRL
+#define MPC_CRC_CTRL__MPC_CRC_EN__SHIFT                                                                       0x0
+#define MPC_CRC_CTRL__MPC_CRC_CONT_EN__SHIFT                                                                  0x4
+#define MPC_CRC_CTRL__MPC_CRC_STEREO_MODE__SHIFT                                                              0x8
+#define MPC_CRC_CTRL__MPC_CRC_STEREO_EN__SHIFT                                                                0xa
+#define MPC_CRC_CTRL__MPC_CRC_SRC_SEL__SHIFT                                                                  0x18
+#define MPC_CRC_CTRL__MPC_CRC_ONE_SHOT_PENDING__SHIFT                                                         0x1c
+#define MPC_CRC_CTRL__MPC_CRC_UPDATE_ENABLED__SHIFT                                                           0x1e
+#define MPC_CRC_CTRL__MPC_CRC_UPDATE_LOCK__SHIFT                                                              0x1f
+#define MPC_CRC_CTRL__MPC_CRC_EN_MASK                                                                         0x00000001L
+#define MPC_CRC_CTRL__MPC_CRC_CONT_EN_MASK                                                                    0x00000010L
+#define MPC_CRC_CTRL__MPC_CRC_STEREO_MODE_MASK                                                                0x00000300L
+#define MPC_CRC_CTRL__MPC_CRC_STEREO_EN_MASK                                                                  0x00000400L
+#define MPC_CRC_CTRL__MPC_CRC_SRC_SEL_MASK                                                                    0x03000000L
+#define MPC_CRC_CTRL__MPC_CRC_ONE_SHOT_PENDING_MASK                                                           0x10000000L
+#define MPC_CRC_CTRL__MPC_CRC_UPDATE_ENABLED_MASK                                                             0x40000000L
+#define MPC_CRC_CTRL__MPC_CRC_UPDATE_LOCK_MASK                                                                0x80000000L
+//MPC_CRC_SEL_CONTROL
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_DPP_SEL__SHIFT                                                           0x0
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_OPP_SEL__SHIFT                                                           0x4
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_MASK__SHIFT                                                              0x10
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_DPP_SEL_MASK                                                             0x0000000FL
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_OPP_SEL_MASK                                                             0x000000F0L
+#define MPC_CRC_SEL_CONTROL__MPC_CRC_MASK_MASK                                                                0xFFFF0000L
+//MPC_CRC_RESULT_A
+#define MPC_CRC_RESULT_A__MPC_CRC_RESULT_A__SHIFT                                                             0x0
+#define MPC_CRC_RESULT_A__MPC_CRC_RESULT_A_MASK                                                               0xFFFFFFFFL
+//MPC_CRC_RESULT_R
+#define MPC_CRC_RESULT_R__MPC_CRC_RESULT_R__SHIFT                                                             0x0
+#define MPC_CRC_RESULT_R__MPC_CRC_RESULT_R_MASK                                                               0xFFFFFFFFL
+//MPC_CRC_RESULT_G
+#define MPC_CRC_RESULT_G__MPC_CRC_RESULT_G__SHIFT                                                             0x0
+#define MPC_CRC_RESULT_G__MPC_CRC_RESULT_G_MASK                                                               0xFFFFFFFFL
+//MPC_CRC_RESULT_B
+#define MPC_CRC_RESULT_B__MPC_CRC_RESULT_B__SHIFT                                                             0x0
+#define MPC_CRC_RESULT_B__MPC_CRC_RESULT_B_MASK                                                               0xFFFFFFFFL
+//MPC_DEBUG_CONTROL
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_EN__SHIFT                                                           0x0
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_TOP_DATA_SELECT__SHIFT                                                   0x1
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SELECT__SHIFT                                            0x4
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SFR_SELECT__SHIFT                                        0x8
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SFT_SELECT__SHIFT                                        0xc
+#define MPC_DEBUG_CONTROL__MPC_RMCM_DEBUG_DATA_SELECT__SHIFT                                                  0x10
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_EN_MASK                                                             0x00000001L
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_TOP_DATA_SELECT_MASK                                                     0x00000006L
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SELECT_MASK                                              0x00000070L
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SFR_SELECT_MASK                                          0x00000F00L
+#define MPC_DEBUG_CONTROL__MPC_DEBUG_DATA_DIRECT_OUT_SFT_SELECT_MASK                                          0x0000F000L
+#define MPC_DEBUG_CONTROL__MPC_RMCM_DEBUG_DATA_SELECT_MASK                                                    0x00070000L
+//MPCC_DEBUG_DATA_SELECT
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT0__SHIFT                                           0x0
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT0__SHIFT                                      0x4
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT0__SHIFT                                      0x6
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT1__SHIFT                                           0x8
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT1__SHIFT                                      0xc
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT1__SHIFT                                      0xe
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT2__SHIFT                                           0x10
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT2__SHIFT                                      0x14
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT2__SHIFT                                      0x16
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT3__SHIFT                                           0x18
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT3__SHIFT                                      0x1c
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT3__SHIFT                                      0x1e
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT0_MASK                                             0x0000000FL
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT0_MASK                                        0x00000030L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT0_MASK                                        0x000000C0L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT1_MASK                                             0x00000F00L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT1_MASK                                        0x00003000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT1_MASK                                        0x0000C000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT2_MASK                                             0x000F0000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT2_MASK                                        0x00300000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT2_MASK                                        0x00C00000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_SELECT3_MASK                                             0x0F000000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_BYTE_SELECT3_MASK                                        0x30000000L
+#define MPCC_DEBUG_DATA_SELECT__MPCC_DEBUG_DATA_MPCC_OGAM_SELECT3_MASK                                        0xC0000000L
+//MPC_PERFMON_EVENT_CTRL
+#define MPC_PERFMON_EVENT_CTRL__MPC_PERFMON_EVENT_EN__SHIFT                                                   0x0
+#define MPC_PERFMON_EVENT_CTRL__MPC_PERFMON_EVENT_EN_MASK                                                     0x00000001L
+//MPC_BYPASS_BG_AR
+#define MPC_BYPASS_BG_AR__MPC_BYPASS_BG_ALPHA__SHIFT                                                          0x0
+#define MPC_BYPASS_BG_AR__MPC_BYPASS_BG_R_CR__SHIFT                                                           0x10
+#define MPC_BYPASS_BG_AR__MPC_BYPASS_BG_ALPHA_MASK                                                            0x0000FFFFL
+#define MPC_BYPASS_BG_AR__MPC_BYPASS_BG_R_CR_MASK                                                             0xFFFF0000L
+//MPC_BYPASS_BG_GB
+#define MPC_BYPASS_BG_GB__MPC_BYPASS_BG_G_Y__SHIFT                                                            0x0
+#define MPC_BYPASS_BG_GB__MPC_BYPASS_BG_B_CB__SHIFT                                                           0x10
+#define MPC_BYPASS_BG_GB__MPC_BYPASS_BG_G_Y_MASK                                                              0x0000FFFFL
+#define MPC_BYPASS_BG_GB__MPC_BYPASS_BG_B_CB_MASK                                                             0xFFFF0000L
+//MPC_HOST_READ_CONTROL
+#define MPC_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL__SHIFT                                                  0x0
+#define MPC_HOST_READ_CONTROL__HOST_READ_RATE_CONTROL_MASK                                                    0x000000FFL
+//MPC_DPP_PENDING_STATUS
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_SURFACE_UPDATE_PENDING__SHIFT                                         0x0
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_CONFIG_UPDATE_PENDING__SHIFT                                          0x2
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_CURSOR_UPDATE_PENDING__SHIFT                                          0x4
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_SURFACE_UPDATE_PENDING__SHIFT                                         0x6
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_CONFIG_UPDATE_PENDING__SHIFT                                          0x8
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_CURSOR_UPDATE_PENDING__SHIFT                                          0xa
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_SURFACE_UPDATE_PENDING__SHIFT                                         0xc
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_CONFIG_UPDATE_PENDING__SHIFT                                          0xe
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_CURSOR_UPDATE_PENDING__SHIFT                                          0x10
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_SURFACE_UPDATE_PENDING__SHIFT                                         0x12
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_CONFIG_UPDATE_PENDING__SHIFT                                          0x14
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_CURSOR_UPDATE_PENDING__SHIFT                                          0x16
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_SURFACE_UPDATE_PENDING_MASK                                           0x00000001L
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_CONFIG_UPDATE_PENDING_MASK                                            0x00000004L
+#define MPC_DPP_PENDING_STATUS__IN_DPP0_CURSOR_UPDATE_PENDING_MASK                                            0x00000010L
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_SURFACE_UPDATE_PENDING_MASK                                           0x00000040L
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_CONFIG_UPDATE_PENDING_MASK                                            0x00000100L
+#define MPC_DPP_PENDING_STATUS__IN_DPP1_CURSOR_UPDATE_PENDING_MASK                                            0x00000400L
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_SURFACE_UPDATE_PENDING_MASK                                           0x00001000L
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_CONFIG_UPDATE_PENDING_MASK                                            0x00004000L
+#define MPC_DPP_PENDING_STATUS__IN_DPP2_CURSOR_UPDATE_PENDING_MASK                                            0x00010000L
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_SURFACE_UPDATE_PENDING_MASK                                           0x00040000L
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_CONFIG_UPDATE_PENDING_MASK                                            0x00100000L
+#define MPC_DPP_PENDING_STATUS__IN_DPP3_CURSOR_UPDATE_PENDING_MASK                                            0x00400000L
+//MPC_PENDING_STATUS_MISC
+#define MPC_PENDING_STATUS_MISC__OUT_OPP0_CONFIG_UPDATE_PENDING__SHIFT                                        0x0
+#define MPC_PENDING_STATUS_MISC__OUT_OPP1_CONFIG_UPDATE_PENDING__SHIFT                                        0x2
+#define MPC_PENDING_STATUS_MISC__OUT_OPP2_CONFIG_UPDATE_PENDING__SHIFT                                        0x4
+#define MPC_PENDING_STATUS_MISC__OUT_OPP3_CONFIG_UPDATE_PENDING__SHIFT                                        0x6
+#define MPC_PENDING_STATUS_MISC__MPCC0_CONFIG_UPDATE_PENDING__SHIFT                                           0xc
+#define MPC_PENDING_STATUS_MISC__MPCC1_CONFIG_UPDATE_PENDING__SHIFT                                           0xe
+#define MPC_PENDING_STATUS_MISC__MPCC2_CONFIG_UPDATE_PENDING__SHIFT                                           0x10
+#define MPC_PENDING_STATUS_MISC__MPCC3_CONFIG_UPDATE_PENDING__SHIFT                                           0x12
+#define MPC_PENDING_STATUS_MISC__OUT_OPP0_CONFIG_UPDATE_PENDING_MASK                                          0x00000001L
+#define MPC_PENDING_STATUS_MISC__OUT_OPP1_CONFIG_UPDATE_PENDING_MASK                                          0x00000004L
+#define MPC_PENDING_STATUS_MISC__OUT_OPP2_CONFIG_UPDATE_PENDING_MASK                                          0x00000010L
+#define MPC_PENDING_STATUS_MISC__OUT_OPP3_CONFIG_UPDATE_PENDING_MASK                                          0x00000040L
+#define MPC_PENDING_STATUS_MISC__MPCC0_CONFIG_UPDATE_PENDING_MASK                                             0x00001000L
+#define MPC_PENDING_STATUS_MISC__MPCC1_CONFIG_UPDATE_PENDING_MASK                                             0x00004000L
+#define MPC_PENDING_STATUS_MISC__MPCC2_CONFIG_UPDATE_PENDING_MASK                                             0x00010000L
+#define MPC_PENDING_STATUS_MISC__MPCC3_CONFIG_UPDATE_PENDING_MASK                                             0x00040000L
+//ADR_CFG_CUR_VUPDATE_LOCK_SET0
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET0__ADR_CFG_CUR_VUPDATE_LOCK_SET__SHIFT                                    0x0
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET0__ADR_CFG_CUR_VUPDATE_LOCK_SET_MASK                                      0x00000001L
+//ADR_CFG_VUPDATE_LOCK_SET0
+#define ADR_CFG_VUPDATE_LOCK_SET0__ADR_CFG_VUPDATE_LOCK_SET__SHIFT                                            0x0
+#define ADR_CFG_VUPDATE_LOCK_SET0__ADR_CFG_VUPDATE_LOCK_SET_MASK                                              0x00000001L
+//ADR_VUPDATE_LOCK_SET0
+#define ADR_VUPDATE_LOCK_SET0__ADR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define ADR_VUPDATE_LOCK_SET0__ADR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CFG_VUPDATE_LOCK_SET0
+#define CFG_VUPDATE_LOCK_SET0__CFG_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CFG_VUPDATE_LOCK_SET0__CFG_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CUR_VUPDATE_LOCK_SET0
+#define CUR_VUPDATE_LOCK_SET0__CUR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CUR_VUPDATE_LOCK_SET0__CUR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//ADR_CFG_CUR_VUPDATE_LOCK_SET1
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET1__ADR_CFG_CUR_VUPDATE_LOCK_SET__SHIFT                                    0x0
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET1__ADR_CFG_CUR_VUPDATE_LOCK_SET_MASK                                      0x00000001L
+//ADR_CFG_VUPDATE_LOCK_SET1
+#define ADR_CFG_VUPDATE_LOCK_SET1__ADR_CFG_VUPDATE_LOCK_SET__SHIFT                                            0x0
+#define ADR_CFG_VUPDATE_LOCK_SET1__ADR_CFG_VUPDATE_LOCK_SET_MASK                                              0x00000001L
+//ADR_VUPDATE_LOCK_SET1
+#define ADR_VUPDATE_LOCK_SET1__ADR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define ADR_VUPDATE_LOCK_SET1__ADR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CFG_VUPDATE_LOCK_SET1
+#define CFG_VUPDATE_LOCK_SET1__CFG_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CFG_VUPDATE_LOCK_SET1__CFG_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CUR_VUPDATE_LOCK_SET1
+#define CUR_VUPDATE_LOCK_SET1__CUR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CUR_VUPDATE_LOCK_SET1__CUR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//ADR_CFG_CUR_VUPDATE_LOCK_SET2
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET2__ADR_CFG_CUR_VUPDATE_LOCK_SET__SHIFT                                    0x0
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET2__ADR_CFG_CUR_VUPDATE_LOCK_SET_MASK                                      0x00000001L
+//ADR_CFG_VUPDATE_LOCK_SET2
+#define ADR_CFG_VUPDATE_LOCK_SET2__ADR_CFG_VUPDATE_LOCK_SET__SHIFT                                            0x0
+#define ADR_CFG_VUPDATE_LOCK_SET2__ADR_CFG_VUPDATE_LOCK_SET_MASK                                              0x00000001L
+//ADR_VUPDATE_LOCK_SET2
+#define ADR_VUPDATE_LOCK_SET2__ADR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define ADR_VUPDATE_LOCK_SET2__ADR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CFG_VUPDATE_LOCK_SET2
+#define CFG_VUPDATE_LOCK_SET2__CFG_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CFG_VUPDATE_LOCK_SET2__CFG_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CUR_VUPDATE_LOCK_SET2
+#define CUR_VUPDATE_LOCK_SET2__CUR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CUR_VUPDATE_LOCK_SET2__CUR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//ADR_CFG_CUR_VUPDATE_LOCK_SET3
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET3__ADR_CFG_CUR_VUPDATE_LOCK_SET__SHIFT                                    0x0
+#define ADR_CFG_CUR_VUPDATE_LOCK_SET3__ADR_CFG_CUR_VUPDATE_LOCK_SET_MASK                                      0x00000001L
+//ADR_CFG_VUPDATE_LOCK_SET3
+#define ADR_CFG_VUPDATE_LOCK_SET3__ADR_CFG_VUPDATE_LOCK_SET__SHIFT                                            0x0
+#define ADR_CFG_VUPDATE_LOCK_SET3__ADR_CFG_VUPDATE_LOCK_SET_MASK                                              0x00000001L
+//ADR_VUPDATE_LOCK_SET3
+#define ADR_VUPDATE_LOCK_SET3__ADR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define ADR_VUPDATE_LOCK_SET3__ADR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CFG_VUPDATE_LOCK_SET3
+#define CFG_VUPDATE_LOCK_SET3__CFG_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CFG_VUPDATE_LOCK_SET3__CFG_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//CUR_VUPDATE_LOCK_SET3
+#define CUR_VUPDATE_LOCK_SET3__CUR_VUPDATE_LOCK_SET__SHIFT                                                    0x0
+#define CUR_VUPDATE_LOCK_SET3__CUR_VUPDATE_LOCK_SET_MASK                                                      0x00000001L
+//HUBP0_3DLUT_FL_CONFIG
+#define HUBP0_3DLUT_FL_CONFIG__HUBP0_3DLUT_FL_MODE__SHIFT                                                     0x0
+#define HUBP0_3DLUT_FL_CONFIG__HUBP0_3DLUT_FL_FORMAT__SHIFT                                                   0x4
+#define HUBP0_3DLUT_FL_CONFIG__HUBP0_3DLUT_FL_MODE_MASK                                                       0x00000003L
+#define HUBP0_3DLUT_FL_CONFIG__HUBP0_3DLUT_FL_FORMAT_MASK                                                     0x00000030L
+//HUBP0_3DLUT_FL_BIAS_SCALE
+#define HUBP0_3DLUT_FL_BIAS_SCALE__HUBP0_3DLUT_FL_BIAS__SHIFT                                                 0x0
+#define HUBP0_3DLUT_FL_BIAS_SCALE__HUBP0_3DLUT_FL_SCALE__SHIFT                                                0x10
+#define HUBP0_3DLUT_FL_BIAS_SCALE__HUBP0_3DLUT_FL_BIAS_MASK                                                   0x0000FFFFL
+#define HUBP0_3DLUT_FL_BIAS_SCALE__HUBP0_3DLUT_FL_SCALE_MASK                                                  0xFFFF0000L
+//HUBP1_3DLUT_FL_CONFIG
+#define HUBP1_3DLUT_FL_CONFIG__HUBP1_3DLUT_FL_MODE__SHIFT                                                     0x0
+#define HUBP1_3DLUT_FL_CONFIG__HUBP1_3DLUT_FL_FORMAT__SHIFT                                                   0x4
+#define HUBP1_3DLUT_FL_CONFIG__HUBP1_3DLUT_FL_MODE_MASK                                                       0x00000003L
+#define HUBP1_3DLUT_FL_CONFIG__HUBP1_3DLUT_FL_FORMAT_MASK                                                     0x00000030L
+//HUBP1_3DLUT_FL_BIAS_SCALE
+#define HUBP1_3DLUT_FL_BIAS_SCALE__HUBP1_3DLUT_FL_BIAS__SHIFT                                                 0x0
+#define HUBP1_3DLUT_FL_BIAS_SCALE__HUBP1_3DLUT_FL_SCALE__SHIFT                                                0x10
+#define HUBP1_3DLUT_FL_BIAS_SCALE__HUBP1_3DLUT_FL_BIAS_MASK                                                   0x0000FFFFL
+#define HUBP1_3DLUT_FL_BIAS_SCALE__HUBP1_3DLUT_FL_SCALE_MASK                                                  0xFFFF0000L
+//HUBP2_3DLUT_FL_CONFIG
+#define HUBP2_3DLUT_FL_CONFIG__HUBP2_3DLUT_FL_MODE__SHIFT                                                     0x0
+#define HUBP2_3DLUT_FL_CONFIG__HUBP2_3DLUT_FL_FORMAT__SHIFT                                                   0x4
+#define HUBP2_3DLUT_FL_CONFIG__HUBP2_3DLUT_FL_MODE_MASK                                                       0x00000003L
+#define HUBP2_3DLUT_FL_CONFIG__HUBP2_3DLUT_FL_FORMAT_MASK                                                     0x00000030L
+//HUBP2_3DLUT_FL_BIAS_SCALE
+#define HUBP2_3DLUT_FL_BIAS_SCALE__HUBP2_3DLUT_FL_BIAS__SHIFT                                                 0x0
+#define HUBP2_3DLUT_FL_BIAS_SCALE__HUBP2_3DLUT_FL_SCALE__SHIFT                                                0x10
+#define HUBP2_3DLUT_FL_BIAS_SCALE__HUBP2_3DLUT_FL_BIAS_MASK                                                   0x0000FFFFL
+#define HUBP2_3DLUT_FL_BIAS_SCALE__HUBP2_3DLUT_FL_SCALE_MASK                                                  0xFFFF0000L
+//HUBP3_3DLUT_FL_CONFIG
+#define HUBP3_3DLUT_FL_CONFIG__HUBP3_3DLUT_FL_MODE__SHIFT                                                     0x0
+#define HUBP3_3DLUT_FL_CONFIG__HUBP3_3DLUT_FL_FORMAT__SHIFT                                                   0x4
+#define HUBP3_3DLUT_FL_CONFIG__HUBP3_3DLUT_FL_MODE_MASK                                                       0x00000003L
+#define HUBP3_3DLUT_FL_CONFIG__HUBP3_3DLUT_FL_FORMAT_MASK                                                     0x00000030L
+//HUBP3_3DLUT_FL_BIAS_SCALE
+#define HUBP3_3DLUT_FL_BIAS_SCALE__HUBP3_3DLUT_FL_BIAS__SHIFT                                                 0x0
+#define HUBP3_3DLUT_FL_BIAS_SCALE__HUBP3_3DLUT_FL_SCALE__SHIFT                                                0x10
+#define HUBP3_3DLUT_FL_BIAS_SCALE__HUBP3_3DLUT_FL_BIAS_MASK                                                   0x0000FFFFL
+#define HUBP3_3DLUT_FL_BIAS_SCALE__HUBP3_3DLUT_FL_SCALE_MASK                                                  0xFFFF0000L
+//MPC_CFG_REG_UPDATE_STATUS
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_CRC_REG_UPDATE_PENDING_STATUS__SHIFT                                   0x0
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL0_REG_UPDATE_PENDING_STATUS__SHIFT                             0xc
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL1_REG_UPDATE_PENDING_STATUS__SHIFT                             0xf
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL2_REG_UPDATE_PENDING_STATUS__SHIFT                             0x12
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL3_REG_UPDATE_PENDING_STATUS__SHIFT                             0x15
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_CRC_REG_UPDATE_PENDING_STATUS_MASK                                     0x00000001L
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL0_REG_UPDATE_PENDING_STATUS_MASK                               0x00001000L
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL1_REG_UPDATE_PENDING_STATUS_MASK                               0x00008000L
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL2_REG_UPDATE_PENDING_STATUS_MASK                               0x00040000L
+#define MPC_CFG_REG_UPDATE_STATUS__MPC_3DLUT_FL3_REG_UPDATE_PENDING_STATUS_MASK                               0x00200000L
+//MPC_TMZID_MAP
+#define MPC_TMZID_MAP__MPC_ERL0__SHIFT                                                                        0x0
+#define MPC_TMZID_MAP__MPC_ERL1__SHIFT                                                                        0x2
+#define MPC_TMZID_MAP__MPC_ERL2__SHIFT                                                                        0x4
+#define MPC_TMZID_MAP__MPC_ERL3__SHIFT                                                                        0x6
+#define MPC_TMZID_MAP__MPC_ERL4__SHIFT                                                                        0x8
+#define MPC_TMZID_MAP__MPC_ERL5__SHIFT                                                                        0xa
+#define MPC_TMZID_MAP__MPC_ERL6__SHIFT                                                                        0xc
+#define MPC_TMZID_MAP__MPC_ERL7__SHIFT                                                                        0xe
+#define MPC_TMZID_MAP__MPC_ERL8__SHIFT                                                                        0x10
+#define MPC_TMZID_MAP__MPC_ERL9__SHIFT                                                                        0x12
+#define MPC_TMZID_MAP__MPC_ERL10__SHIFT                                                                       0x14
+#define MPC_TMZID_MAP__MPC_ERL11__SHIFT                                                                       0x16
+#define MPC_TMZID_MAP__MPC_ERL12__SHIFT                                                                       0x18
+#define MPC_TMZID_MAP__MPC_ERL13__SHIFT                                                                       0x1a
+#define MPC_TMZID_MAP__MPC_ERL14__SHIFT                                                                       0x1c
+#define MPC_TMZID_MAP__MPC_ERL15__SHIFT                                                                       0x1e
+#define MPC_TMZID_MAP__MPC_ERL0_MASK                                                                          0x00000003L
+#define MPC_TMZID_MAP__MPC_ERL1_MASK                                                                          0x0000000CL
+#define MPC_TMZID_MAP__MPC_ERL2_MASK                                                                          0x00000030L
+#define MPC_TMZID_MAP__MPC_ERL3_MASK                                                                          0x000000C0L
+#define MPC_TMZID_MAP__MPC_ERL4_MASK                                                                          0x00000300L
+#define MPC_TMZID_MAP__MPC_ERL5_MASK                                                                          0x00000C00L
+#define MPC_TMZID_MAP__MPC_ERL6_MASK                                                                          0x00003000L
+#define MPC_TMZID_MAP__MPC_ERL7_MASK                                                                          0x0000C000L
+#define MPC_TMZID_MAP__MPC_ERL8_MASK                                                                          0x00030000L
+#define MPC_TMZID_MAP__MPC_ERL9_MASK                                                                          0x000C0000L
+#define MPC_TMZID_MAP__MPC_ERL10_MASK                                                                         0x00300000L
+#define MPC_TMZID_MAP__MPC_ERL11_MASK                                                                         0x00C00000L
+#define MPC_TMZID_MAP__MPC_ERL12_MASK                                                                         0x03000000L
+#define MPC_TMZID_MAP__MPC_ERL13_MASK                                                                         0x0C000000L
+#define MPC_TMZID_MAP__MPC_ERL14_MASK                                                                         0x30000000L
+#define MPC_TMZID_MAP__MPC_ERL15_MASK                                                                         0xC0000000L
+//MPC_CFG_TEST_DEBUG_INDEX
+#define MPC_CFG_TEST_DEBUG_INDEX__MPC_CFG_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define MPC_CFG_TEST_DEBUG_INDEX__MPC_CFG_TEST_DEBUG_WRITE_EN__SHIFT                                          0x8
+#define MPC_CFG_TEST_DEBUG_INDEX__MPC_CFG_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+#define MPC_CFG_TEST_DEBUG_INDEX__MPC_CFG_TEST_DEBUG_WRITE_EN_MASK                                            0x00000100L
+//MPC_CFG_TEST_DEBUG_DATA
+#define MPC_CFG_TEST_DEBUG_DATA__MPC_CFG_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define MPC_CFG_TEST_DEBUG_DATA__MPC_CFG_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpc_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON14_PERFCOUNTER_CNTL
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON14_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON14_PERFCOUNTER_CNTL2
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON14_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON14_PERFCOUNTER_STATE
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON14_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON14_PERFMON_CNTL
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON14_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON14_PERFMON_CNTL2
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON14_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON14_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON14_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON14_PERFMON_CVALUE_LOW
+#define DC_PERFMON14_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON14_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON14_PERFMON_HI
+#define DC_PERFMON14_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON14_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON14_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON14_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON14_PERFMON_LOW
+#define DC_PERFMON14_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON14_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON14_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON14_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON14_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam0_dispdec
+//MPCC_OGAM0_MPCC_OGAM_CONTROL
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE__SHIFT                                                   0x0
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT__SHIFT                                                 0x2
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE__SHIFT                                            0x3
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT__SHIFT                                           0x7
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT__SHIFT                                         0x9
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_MASK                                                     0x00000003L
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_MASK                                                   0x00000004L
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE_MASK                                              0x00000008L
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT_MASK                                             0x00000180L
+#define MPCC_OGAM0_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT_MASK                                           0x00000200L
+//MPCC_OGAM0_MPCC_OGAM_LUT_INDEX
+#define MPCC_OGAM0_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX__SHIFT                                            0x0
+#define MPCC_OGAM0_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX_MASK                                              0x000001FFL
+//MPCC_OGAM0_MPCC_OGAM_LUT_DATA
+#define MPCC_OGAM0_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA__SHIFT                                              0x0
+#define MPCC_OGAM0_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA_MASK                                                0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK__SHIFT                               0x0
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL__SHIFT                                 0x3
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG__SHIFT                                       0x5
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL__SHIFT                                       0x6
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK_MASK                                 0x00000007L
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL_MASK                                   0x00000018L
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG_MASK                                         0x00000020L
+#define MPCC_OGAM0_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL_MASK                                         0x00000040L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_B
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_G
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_R
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM0_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM0_MPCC_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT__SHIFT                          0x0
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT_MASK                            0x00000001L
+//MPCC_OGAM0_MPCC_GAMUT_REMAP_MODE
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE__SHIFT                                        0x0
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT__SHIFT                                0x7
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_MASK                                          0x00000003L
+#define MPCC_OGAM0_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT_MASK                                  0x00000180L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B__SHIFT                                   0x0
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B__SHIFT                                   0x10
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM0_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM0_MPCC_OGAM_REG_UPDATE_STATUS
+#define MPCC_OGAM0_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS__SHIFT                    0x0
+#define MPCC_OGAM0_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS_MASK                      0x00000001L
+//MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX__SHIFT                              0x0
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN__SHIFT                           0x8
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX_MASK                                0x000000FFL
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN_MASK                             0x00000100L
+//MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_DATA
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA__SHIFT                                0x0
+#define MPCC_OGAM0_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA_MASK                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam1_dispdec
+//MPCC_OGAM1_MPCC_OGAM_CONTROL
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE__SHIFT                                                   0x0
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT__SHIFT                                                 0x2
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE__SHIFT                                            0x3
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT__SHIFT                                           0x7
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT__SHIFT                                         0x9
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_MASK                                                     0x00000003L
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_MASK                                                   0x00000004L
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE_MASK                                              0x00000008L
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT_MASK                                             0x00000180L
+#define MPCC_OGAM1_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT_MASK                                           0x00000200L
+//MPCC_OGAM1_MPCC_OGAM_LUT_INDEX
+#define MPCC_OGAM1_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX__SHIFT                                            0x0
+#define MPCC_OGAM1_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX_MASK                                              0x000001FFL
+//MPCC_OGAM1_MPCC_OGAM_LUT_DATA
+#define MPCC_OGAM1_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA__SHIFT                                              0x0
+#define MPCC_OGAM1_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA_MASK                                                0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK__SHIFT                               0x0
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL__SHIFT                                 0x3
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG__SHIFT                                       0x5
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL__SHIFT                                       0x6
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK_MASK                                 0x00000007L
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL_MASK                                   0x00000018L
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG_MASK                                         0x00000020L
+#define MPCC_OGAM1_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL_MASK                                         0x00000040L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_B
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_G
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_R
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM1_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM1_MPCC_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT__SHIFT                          0x0
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT_MASK                            0x00000001L
+//MPCC_OGAM1_MPCC_GAMUT_REMAP_MODE
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE__SHIFT                                        0x0
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT__SHIFT                                0x7
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_MASK                                          0x00000003L
+#define MPCC_OGAM1_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT_MASK                                  0x00000180L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B__SHIFT                                   0x0
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B__SHIFT                                   0x10
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM1_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM1_MPCC_OGAM_REG_UPDATE_STATUS
+#define MPCC_OGAM1_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS__SHIFT                    0x0
+#define MPCC_OGAM1_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS_MASK                      0x00000001L
+//MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX__SHIFT                              0x0
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN__SHIFT                           0x8
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX_MASK                                0x000000FFL
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN_MASK                             0x00000100L
+//MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_DATA
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA__SHIFT                                0x0
+#define MPCC_OGAM1_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA_MASK                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam2_dispdec
+//MPCC_OGAM2_MPCC_OGAM_CONTROL
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE__SHIFT                                                   0x0
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT__SHIFT                                                 0x2
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE__SHIFT                                            0x3
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT__SHIFT                                           0x7
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT__SHIFT                                         0x9
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_MASK                                                     0x00000003L
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_MASK                                                   0x00000004L
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE_MASK                                              0x00000008L
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT_MASK                                             0x00000180L
+#define MPCC_OGAM2_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT_MASK                                           0x00000200L
+//MPCC_OGAM2_MPCC_OGAM_LUT_INDEX
+#define MPCC_OGAM2_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX__SHIFT                                            0x0
+#define MPCC_OGAM2_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX_MASK                                              0x000001FFL
+//MPCC_OGAM2_MPCC_OGAM_LUT_DATA
+#define MPCC_OGAM2_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA__SHIFT                                              0x0
+#define MPCC_OGAM2_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA_MASK                                                0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK__SHIFT                               0x0
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL__SHIFT                                 0x3
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG__SHIFT                                       0x5
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL__SHIFT                                       0x6
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK_MASK                                 0x00000007L
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL_MASK                                   0x00000018L
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG_MASK                                         0x00000020L
+#define MPCC_OGAM2_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL_MASK                                         0x00000040L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_B
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_G
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_R
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM2_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM2_MPCC_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT__SHIFT                          0x0
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT_MASK                            0x00000001L
+//MPCC_OGAM2_MPCC_GAMUT_REMAP_MODE
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE__SHIFT                                        0x0
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT__SHIFT                                0x7
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_MASK                                          0x00000003L
+#define MPCC_OGAM2_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT_MASK                                  0x00000180L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B__SHIFT                                   0x0
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B__SHIFT                                   0x10
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM2_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM2_MPCC_OGAM_REG_UPDATE_STATUS
+#define MPCC_OGAM2_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS__SHIFT                    0x0
+#define MPCC_OGAM2_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS_MASK                      0x00000001L
+//MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX__SHIFT                              0x0
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN__SHIFT                           0x8
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX_MASK                                0x000000FFL
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN_MASK                             0x00000100L
+//MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_DATA
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA__SHIFT                                0x0
+#define MPCC_OGAM2_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA_MASK                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_ogam3_dispdec
+//MPCC_OGAM3_MPCC_OGAM_CONTROL
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE__SHIFT                                                   0x0
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT__SHIFT                                                 0x2
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE__SHIFT                                            0x3
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT__SHIFT                                           0x7
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT__SHIFT                                         0x9
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_MASK                                                     0x00000003L
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_MASK                                                   0x00000004L
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_PWL_DISABLE_MASK                                              0x00000008L
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_MODE_CURRENT_MASK                                             0x00000180L
+#define MPCC_OGAM3_MPCC_OGAM_CONTROL__MPCC_OGAM_SELECT_CURRENT_MASK                                           0x00000200L
+//MPCC_OGAM3_MPCC_OGAM_LUT_INDEX
+#define MPCC_OGAM3_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX__SHIFT                                            0x0
+#define MPCC_OGAM3_MPCC_OGAM_LUT_INDEX__MPCC_OGAM_LUT_INDEX_MASK                                              0x000001FFL
+//MPCC_OGAM3_MPCC_OGAM_LUT_DATA
+#define MPCC_OGAM3_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA__SHIFT                                              0x0
+#define MPCC_OGAM3_MPCC_OGAM_LUT_DATA__MPCC_OGAM_LUT_DATA_MASK                                                0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK__SHIFT                               0x0
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL__SHIFT                                 0x3
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG__SHIFT                                       0x5
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL__SHIFT                                       0x6
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_WRITE_COLOR_MASK_MASK                                 0x00000007L
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_COLOR_SEL_MASK                                   0x00000018L
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_READ_DBG_MASK                                         0x00000020L
+#define MPCC_OGAM3_MPCC_OGAM_LUT_CONTROL__MPCC_OGAM_LUT_HOST_SEL_MASK                                         0x00000040L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_SLOPE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_B__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_G__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_START_BASE_CNTL_R__MPCC_OGAM_RAMA_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_B__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_B__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_G__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_G__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL1_R__MPCC_OGAM_RAMA_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_END_CNTL2_R__MPCC_OGAM_RAMA_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_B__MPCC_OGAM_RAMA_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_G__MPCC_OGAM_RAMA_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_OFFSET_R__MPCC_OGAM_RAMA_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_0_1__MPCC_OGAM_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_2_3__MPCC_OGAM_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_4_5__MPCC_OGAM_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_6_7__MPCC_OGAM_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_8_9__MPCC_OGAM_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_10_11__MPCC_OGAM_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_12_13__MPCC_OGAM_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_14_15__MPCC_OGAM_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_16_17__MPCC_OGAM_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_18_19__MPCC_OGAM_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_20_21__MPCC_OGAM_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_22_23__MPCC_OGAM_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_24_25__MPCC_OGAM_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_26_27__MPCC_OGAM_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_28_29__MPCC_OGAM_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_30_31__MPCC_OGAM_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMA_REGION_32_33__MPCC_OGAM_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_B_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_B_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_G_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_G_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R__SHIFT                      0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT              0x14
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_R_MASK                        0x0003FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SEGMENT_R_MASK                0x07F00000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_B_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_G_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R__SHIFT          0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_SLOPE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_SLOPE_R_MASK            0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_B__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_B_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_G__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_G_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R__SHIFT            0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_START_BASE_CNTL_R__MPCC_OGAM_RAMB_EXP_REGION_START_BASE_R_MASK              0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_B__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_B_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_B_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_B__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_B_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_G__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_G_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_G_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_G__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_G_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL1_R__MPCC_OGAM_RAMB_EXP_REGION_END_BASE_R_MASK                      0x0003FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R__SHIFT                         0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R__SHIFT                   0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_R_MASK                           0x0000FFFFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_END_CNTL2_R__MPCC_OGAM_RAMB_EXP_REGION_END_SLOPE_R_MASK                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_B
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_B__MPCC_OGAM_RAMB_OFFSET_B_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_G
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_G__MPCC_OGAM_RAMB_OFFSET_G_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_R
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R__SHIFT                                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_OFFSET_R__MPCC_OGAM_RAMB_OFFSET_R_MASK                                      0x0007FFFFL
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_0_1__MPCC_OGAM_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_2_3__MPCC_OGAM_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_4_5__MPCC_OGAM_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_6_7__MPCC_OGAM_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT                  0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT                    0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT                  0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_LUT_OFFSET_MASK                      0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK                    0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_LUT_OFFSET_MASK                      0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_8_9__MPCC_OGAM_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK                    0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_10_11__MPCC_OGAM_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_12_13__MPCC_OGAM_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_14_15__MPCC_OGAM_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_16_17__MPCC_OGAM_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_18_19__MPCC_OGAM_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_20_21__MPCC_OGAM_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_22_23__MPCC_OGAM_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_24_25__MPCC_OGAM_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_26_27__MPCC_OGAM_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_28_29__MPCC_OGAM_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_30_31__MPCC_OGAM_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT                 0x0
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT               0xc
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT                 0x10
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT               0x1c
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_LUT_OFFSET_MASK                   0x000001FFL
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK                 0x00007000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_LUT_OFFSET_MASK                   0x01FF0000L
+#define MPCC_OGAM3_MPCC_OGAM_RAMB_REGION_32_33__MPCC_OGAM_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK                 0x70000000L
+//MPCC_OGAM3_MPCC_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT__SHIFT                          0x0
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_COEF_FORMAT__MPCC_GAMUT_REMAP_COEF_FORMAT_MASK                            0x00000001L
+//MPCC_OGAM3_MPCC_GAMUT_REMAP_MODE
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE__SHIFT                                        0x0
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT__SHIFT                                0x7
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_MASK                                          0x00000003L
+#define MPCC_OGAM3_MPCC_GAMUT_REMAP_MODE__MPCC_GAMUT_REMAP_MODE_CURRENT_MASK                                  0x00000180L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C11_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_A__MPCC_GAMUT_REMAP_C12_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C13_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_A__MPCC_GAMUT_REMAP_C14_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C21_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_A__MPCC_GAMUT_REMAP_C22_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C23_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_A__MPCC_GAMUT_REMAP_C24_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C31_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_A__MPCC_GAMUT_REMAP_C32_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C33_A_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_A__MPCC_GAMUT_REMAP_C34_A_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C11_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C11_C12_B__MPCC_GAMUT_REMAP_C12_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C13_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C13_C14_B__MPCC_GAMUT_REMAP_C14_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C21_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C21_C22_B__MPCC_GAMUT_REMAP_C22_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C23_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C23_C24_B__MPCC_GAMUT_REMAP_C24_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C31_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C31_C32_B__MPCC_GAMUT_REMAP_C32_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B__SHIFT                                   0x0
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B__SHIFT                                   0x10
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C33_B_MASK                                     0x0000FFFFL
+#define MPCC_OGAM3_MPC_GAMUT_REMAP_C33_C34_B__MPCC_GAMUT_REMAP_C34_B_MASK                                     0xFFFF0000L
+//MPCC_OGAM3_MPCC_OGAM_REG_UPDATE_STATUS
+#define MPCC_OGAM3_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS__SHIFT                    0x0
+#define MPCC_OGAM3_MPCC_OGAM_REG_UPDATE_STATUS__MPCC_OGAM_REG_UPDATE_PENDING_STATUS_MASK                      0x00000001L
+//MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX__SHIFT                              0x0
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN__SHIFT                           0x8
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_INDEX_MASK                                0x000000FFL
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_INDEX__MPCC_OGAM_TEST_DEBUG_WRITE_EN_MASK                             0x00000100L
+//MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_DATA
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA__SHIFT                                0x0
+#define MPCC_OGAM3_MPCC_OGAM_TEST_DEBUG_DATA__MPCC_OGAM_TEST_DEBUG_DATA_MASK                                  0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm0_dispdec
+//MPCC_MCM0_MPCC_MCM_SHAPER_CONTROL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPCC_MCM0_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_G
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_LUT_INDEX
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_LUT_DATA
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_MODE
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPCC_MCM0_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPCC_MCM0_MPCC_MCM_3DLUT_INDEX
+#define MPCC_MCM0_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX_MASK                                             0x000007FFL
+//MPCC_MCM0_MPCC_MCM_3DLUT_DATA
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_DATA_30BIT
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPCC_MCM0_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPCC_MCM0_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_OUT_NORM_FACTOR
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE__SHIFT                                          0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT__SHIFT                                        0x2
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE__SHIFT                                   0x3
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT__SHIFT                                  0x4
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT__SHIFT                                0x6
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_MASK                                            0x00000003L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_MASK                                          0x00000004L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE_MASK                                     0x00000008L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT_MASK                                    0x00000030L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT_MASK                                  0x00000040L
+//MPCC_MCM0_MPCC_MCM_1DLUT_LUT_INDEX
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX_MASK                                     0x000001FFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_LUT_DATA
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA__SHIFT                                     0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA_MASK                                       0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK__SHIFT                      0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL__SHIFT                        0x3
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG__SHIFT                              0x5
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL__SHIFT                              0x6
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK_MASK                        0x00000007L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL_MASK                          0x00000018L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG_MASK                                0x00000020L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL_MASK                                0x00000040L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_B
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_G
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_R
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM0_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__SHIFT       0x0
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_MASK         0x00000001L
+//MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE__SHIFT                     0x0
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT__SHIFT             0x7
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_MASK                       0x00000003L
+#define MPCC_MCM0_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT_MASK               0x00000180L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B__SHIFT                0x0
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B__SHIFT                0x10
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B_MASK                  0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B_MASK                  0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__SHIFT     0x0
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_MASK       0x00000001L
+//MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE__SHIFT                   0x0
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT__SHIFT           0x7
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_MASK                     0x00000003L
+#define MPCC_MCM0_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT_MASK             0x00000180L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B__SHIFT              0x0
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B__SHIFT              0x10
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B_MASK                0x0000FFFFL
+#define MPCC_MCM0_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B_MASK                0xFFFF0000L
+//MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE__SHIFT                                  0x10
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS__SHIFT                                    0x12
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE__SHIFT                               0x14
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE__SHIFT                                  0x1c
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE_MASK                                    0x00030000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS_MASK                                      0x00040000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00300000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+#define MPCC_MCM0_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE_MASK                                    0x30000000L
+//MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_SELECT
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPCC_MCM0_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPCC_MCM0_MPCC_MCM_REG_UPDATE_STATUS
+#define MPCC_MCM0_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS__SHIFT                       0x0
+#define MPCC_MCM0_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS_MASK                         0x00000001L
+//MPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPCC_MCM0_MPCC_MCM_TEST_DEBUG_DATA
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPCC_MCM0_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm1_dispdec
+//MPCC_MCM1_MPCC_MCM_SHAPER_CONTROL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPCC_MCM1_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_G
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_LUT_INDEX
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_LUT_DATA
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_MODE
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPCC_MCM1_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPCC_MCM1_MPCC_MCM_3DLUT_INDEX
+#define MPCC_MCM1_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX_MASK                                             0x000007FFL
+//MPCC_MCM1_MPCC_MCM_3DLUT_DATA
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_DATA_30BIT
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPCC_MCM1_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPCC_MCM1_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_OUT_NORM_FACTOR
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE__SHIFT                                          0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT__SHIFT                                        0x2
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE__SHIFT                                   0x3
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT__SHIFT                                  0x4
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT__SHIFT                                0x6
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_MASK                                            0x00000003L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_MASK                                          0x00000004L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE_MASK                                     0x00000008L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT_MASK                                    0x00000030L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT_MASK                                  0x00000040L
+//MPCC_MCM1_MPCC_MCM_1DLUT_LUT_INDEX
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX_MASK                                     0x000001FFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_LUT_DATA
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA__SHIFT                                     0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA_MASK                                       0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK__SHIFT                      0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL__SHIFT                        0x3
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG__SHIFT                              0x5
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL__SHIFT                              0x6
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK_MASK                        0x00000007L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL_MASK                          0x00000018L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG_MASK                                0x00000020L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL_MASK                                0x00000040L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_B
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_G
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_R
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM1_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__SHIFT       0x0
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_MASK         0x00000001L
+//MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE__SHIFT                     0x0
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT__SHIFT             0x7
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_MASK                       0x00000003L
+#define MPCC_MCM1_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT_MASK               0x00000180L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B__SHIFT                0x0
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B__SHIFT                0x10
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B_MASK                  0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B_MASK                  0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__SHIFT     0x0
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_MASK       0x00000001L
+//MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE__SHIFT                   0x0
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT__SHIFT           0x7
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_MASK                     0x00000003L
+#define MPCC_MCM1_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT_MASK             0x00000180L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B__SHIFT              0x0
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B__SHIFT              0x10
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B_MASK                0x0000FFFFL
+#define MPCC_MCM1_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B_MASK                0xFFFF0000L
+//MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE__SHIFT                                  0x10
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS__SHIFT                                    0x12
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE__SHIFT                               0x14
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE__SHIFT                                  0x1c
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE_MASK                                    0x00030000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS_MASK                                      0x00040000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00300000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+#define MPCC_MCM1_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE_MASK                                    0x30000000L
+//MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_SELECT
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPCC_MCM1_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPCC_MCM1_MPCC_MCM_REG_UPDATE_STATUS
+#define MPCC_MCM1_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS__SHIFT                       0x0
+#define MPCC_MCM1_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS_MASK                         0x00000001L
+//MPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPCC_MCM1_MPCC_MCM_TEST_DEBUG_DATA
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPCC_MCM1_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm2_dispdec
+//MPCC_MCM2_MPCC_MCM_SHAPER_CONTROL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPCC_MCM2_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_G
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_LUT_INDEX
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_LUT_DATA
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_MODE
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPCC_MCM2_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPCC_MCM2_MPCC_MCM_3DLUT_INDEX
+#define MPCC_MCM2_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX_MASK                                             0x000007FFL
+//MPCC_MCM2_MPCC_MCM_3DLUT_DATA
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_DATA_30BIT
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPCC_MCM2_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPCC_MCM2_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_OUT_NORM_FACTOR
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE__SHIFT                                          0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT__SHIFT                                        0x2
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE__SHIFT                                   0x3
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT__SHIFT                                  0x4
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT__SHIFT                                0x6
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_MASK                                            0x00000003L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_MASK                                          0x00000004L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE_MASK                                     0x00000008L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT_MASK                                    0x00000030L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT_MASK                                  0x00000040L
+//MPCC_MCM2_MPCC_MCM_1DLUT_LUT_INDEX
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX_MASK                                     0x000001FFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_LUT_DATA
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA__SHIFT                                     0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA_MASK                                       0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK__SHIFT                      0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL__SHIFT                        0x3
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG__SHIFT                              0x5
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL__SHIFT                              0x6
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK_MASK                        0x00000007L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL_MASK                          0x00000018L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG_MASK                                0x00000020L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL_MASK                                0x00000040L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_B
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_G
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_R
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM2_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__SHIFT       0x0
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_MASK         0x00000001L
+//MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE__SHIFT                     0x0
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT__SHIFT             0x7
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_MASK                       0x00000003L
+#define MPCC_MCM2_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT_MASK               0x00000180L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B__SHIFT                0x0
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B__SHIFT                0x10
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B_MASK                  0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B_MASK                  0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__SHIFT     0x0
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_MASK       0x00000001L
+//MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE__SHIFT                   0x0
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT__SHIFT           0x7
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_MASK                     0x00000003L
+#define MPCC_MCM2_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT_MASK             0x00000180L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B__SHIFT              0x0
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B__SHIFT              0x10
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B_MASK                0x0000FFFFL
+#define MPCC_MCM2_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B_MASK                0xFFFF0000L
+//MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE__SHIFT                                  0x10
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS__SHIFT                                    0x12
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE__SHIFT                               0x14
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE__SHIFT                                  0x1c
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE_MASK                                    0x00030000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS_MASK                                      0x00040000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00300000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+#define MPCC_MCM2_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE_MASK                                    0x30000000L
+//MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_SELECT
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPCC_MCM2_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPCC_MCM2_MPCC_MCM_REG_UPDATE_STATUS
+#define MPCC_MCM2_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS__SHIFT                       0x0
+#define MPCC_MCM2_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS_MASK                         0x00000001L
+//MPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPCC_MCM2_MPCC_MCM_TEST_DEBUG_DATA
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPCC_MCM2_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpcc_mcm3_dispdec
+//MPCC_MCM3_MPCC_MCM_SHAPER_CONTROL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPCC_MCM3_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_CONTROL__MPCC_MCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_R__MPCC_MCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_G
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_G__MPCC_MCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_OFFSET_B__MPCC_MCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_R__MPCC_MCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_SCALE_G_B__MPCC_MCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_LUT_INDEX
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_INDEX__MPCC_MCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_LUT_DATA
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_DATA__MPCC_MCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_LUT_WRITE_EN_MASK__MPCC_MCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_START_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_B__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_G__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_END_CNTL_R__MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_0_1__MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_2_3__MPCC_MCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_4_5__MPCC_MCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_6_7__MPCC_MCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_8_9__MPCC_MCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_10_11__MPCC_MCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_12_13__MPCC_MCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_14_15__MPCC_MCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_16_17__MPCC_MCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_18_19__MPCC_MCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_20_21__MPCC_MCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_22_23__MPCC_MCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_24_25__MPCC_MCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_26_27__MPCC_MCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_28_29__MPCC_MCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_30_31__MPCC_MCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMA_REGION_32_33__MPCC_MCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_START_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_B__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_G__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_END_CNTL_R__MPCC_MCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_0_1__MPCC_MCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_2_3__MPCC_MCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_4_5__MPCC_MCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_6_7__MPCC_MCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_8_9__MPCC_MCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_10_11__MPCC_MCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_12_13__MPCC_MCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_14_15__MPCC_MCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_16_17__MPCC_MCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_18_19__MPCC_MCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_20_21__MPCC_MCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_22_23__MPCC_MCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_24_25__MPCC_MCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_26_27__MPCC_MCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_28_29__MPCC_MCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_30_31__MPCC_MCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_SHAPER_RAMB_REGION_32_33__MPCC_MCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_MODE
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPCC_MCM3_MPCC_MCM_3DLUT_MODE__MPCC_MCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPCC_MCM3_MPCC_MCM_3DLUT_INDEX
+#define MPCC_MCM3_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_INDEX__MPCC_MCM_3DLUT_INDEX_MASK                                             0x000007FFL
+//MPCC_MCM3_MPCC_MCM_3DLUT_DATA
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA__MPCC_MCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_DATA_30BIT
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPCC_MCM3_MPCC_MCM_3DLUT_DATA_30BIT__MPCC_MCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPCC_MCM3_MPCC_MCM_3DLUT_READ_WRITE_CONTROL__MPCC_MCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_OUT_NORM_FACTOR
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_NORM_FACTOR__MPCC_MCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_R__MPCC_MCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_G__MPCC_MCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_3DLUT_OUT_OFFSET_B__MPCC_MCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE__SHIFT                                          0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT__SHIFT                                        0x2
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE__SHIFT                                   0x3
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT__SHIFT                                  0x4
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT__SHIFT                                0x6
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_MASK                                            0x00000003L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_MASK                                          0x00000004L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_PWL_DISABLE_MASK                                     0x00000008L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_MODE_CURRENT_MASK                                    0x00000030L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_CONTROL__MPCC_MCM_1DLUT_SELECT_CURRENT_MASK                                  0x00000040L
+//MPCC_MCM3_MPCC_MCM_1DLUT_LUT_INDEX
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_INDEX__MPCC_MCM_1DLUT_LUT_INDEX_MASK                                     0x000001FFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_LUT_DATA
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA__SHIFT                                     0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_DATA__MPCC_MCM_1DLUT_LUT_DATA_MASK                                       0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK__SHIFT                      0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL__SHIFT                        0x3
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG__SHIFT                              0x5
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL__SHIFT                              0x6
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_WRITE_COLOR_MASK_MASK                        0x00000007L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_COLOR_SEL_MASK                          0x00000018L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_READ_DBG_MASK                                0x00000020L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_LUT_CONTROL__MPCC_MCM_1DLUT_LUT_HOST_SEL_MASK                                0x00000040L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_B__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_G__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL1_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_END_CNTL2_R__MPCC_MCM_1DLUT_RAMA_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_B__MPCC_MCM_1DLUT_RAMA_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_G__MPCC_MCM_1DLUT_RAMA_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_OFFSET_R__MPCC_MCM_1DLUT_RAMA_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_0_1__MPCC_MCM_1DLUT_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_2_3__MPCC_MCM_1DLUT_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_4_5__MPCC_MCM_1DLUT_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_6_7__MPCC_MCM_1DLUT_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_8_9__MPCC_MCM_1DLUT_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_10_11__MPCC_MCM_1DLUT_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_12_13__MPCC_MCM_1DLUT_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_14_15__MPCC_MCM_1DLUT_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_16_17__MPCC_MCM_1DLUT_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_18_19__MPCC_MCM_1DLUT_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_20_21__MPCC_MCM_1DLUT_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_22_23__MPCC_MCM_1DLUT_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_24_25__MPCC_MCM_1DLUT_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_26_27__MPCC_MCM_1DLUT_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_28_29__MPCC_MCM_1DLUT_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_30_31__MPCC_MCM_1DLUT_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMA_REGION_32_33__MPCC_MCM_1DLUT_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_B_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_B_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_G_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_G_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R__SHIFT             0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT     0x14
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_R_MASK               0x0003FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SEGMENT_R_MASK       0x07F00000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_B_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_G_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R__SHIFT  0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_SLOPE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_SLOPE_R_MASK   0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_B_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_G_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R__SHIFT   0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_START_BASE_CNTL_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_START_BASE_R_MASK     0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_B_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_B__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_B_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_G_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_G_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_G__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_G_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL1_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_BASE_R_MASK             0x0003FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R__SHIFT                0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R__SHIFT          0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_R_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_END_CNTL2_R__MPCC_MCM_1DLUT_RAMB_EXP_REGION_END_SLOPE_R_MASK            0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_B
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_B__MPCC_MCM_1DLUT_RAMB_OFFSET_B_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_G
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_G__MPCC_MCM_1DLUT_RAMB_OFFSET_G_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_R
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R__SHIFT                           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_OFFSET_R__MPCC_MCM_1DLUT_RAMB_OFFSET_R_MASK                             0x0007FFFFL
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_0_1__MPCC_MCM_1DLUT_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_2_3__MPCC_MCM_1DLUT_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_4_5__MPCC_MCM_1DLUT_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_6_7__MPCC_MCM_1DLUT_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT           0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT         0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT           0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT         0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_LUT_OFFSET_MASK             0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK           0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_LUT_OFFSET_MASK             0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_8_9__MPCC_MCM_1DLUT_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK           0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_10_11__MPCC_MCM_1DLUT_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_12_13__MPCC_MCM_1DLUT_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_14_15__MPCC_MCM_1DLUT_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_16_17__MPCC_MCM_1DLUT_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_18_19__MPCC_MCM_1DLUT_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_20_21__MPCC_MCM_1DLUT_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_22_23__MPCC_MCM_1DLUT_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_24_25__MPCC_MCM_1DLUT_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_26_27__MPCC_MCM_1DLUT_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_28_29__MPCC_MCM_1DLUT_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_30_31__MPCC_MCM_1DLUT_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT        0x0
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT      0xc
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT        0x10
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT      0x1c
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_LUT_OFFSET_MASK          0x000001FFL
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK        0x00007000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_LUT_OFFSET_MASK          0x01FF0000L
+#define MPCC_MCM3_MPCC_MCM_1DLUT_RAMB_REGION_32_33__MPCC_MCM_1DLUT_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK        0x70000000L
+//MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__SHIFT       0x0
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_FIRST_GAMUT_REMAP_COEF_FORMAT_MASK         0x00000001L
+//MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE__SHIFT                     0x0
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT__SHIFT             0x7
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_MASK                       0x00000003L
+#define MPCC_MCM3_MPCC_MCM_FIRST_GAMUT_REMAP_MODE__MPCC_MCM_FIRST_GAMUT_REMAP_MODE_CURRENT_MASK               0x00000180L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C11_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_A__MPCC_MCM_FIRST_GAMUT_REMAP_C12_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C13_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_A__MPCC_MCM_FIRST_GAMUT_REMAP_C14_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C21_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_A__MPCC_MCM_FIRST_GAMUT_REMAP_C22_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C23_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_A__MPCC_MCM_FIRST_GAMUT_REMAP_C24_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C31_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_A__MPCC_MCM_FIRST_GAMUT_REMAP_C32_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C33_A_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_A__MPCC_MCM_FIRST_GAMUT_REMAP_C34_A_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C11_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C11_C12_B__MPCC_MCM_FIRST_GAMUT_REMAP_C12_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C13_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C13_C14_B__MPCC_MCM_FIRST_GAMUT_REMAP_C14_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C21_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C21_C22_B__MPCC_MCM_FIRST_GAMUT_REMAP_C22_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C23_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C23_C24_B__MPCC_MCM_FIRST_GAMUT_REMAP_C24_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C31_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C31_C32_B__MPCC_MCM_FIRST_GAMUT_REMAP_C32_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B__SHIFT                0x0
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B__SHIFT                0x10
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C33_B_MASK                  0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_FIRST_GAMUT_REMAP_C33_C34_B__MPCC_MCM_FIRST_GAMUT_REMAP_C34_B_MASK                  0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__SHIFT     0x0
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT__MPCC_MCM_SECOND_GAMUT_REMAP_COEF_FORMAT_MASK       0x00000001L
+//MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE__SHIFT                   0x0
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT__SHIFT           0x7
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_MASK                     0x00000003L
+#define MPCC_MCM3_MPCC_MCM_SECOND_GAMUT_REMAP_MODE__MPCC_MCM_SECOND_GAMUT_REMAP_MODE_CURRENT_MASK             0x00000180L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C11_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_A__MPCC_MCM_SECOND_GAMUT_REMAP_C12_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C13_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_A__MPCC_MCM_SECOND_GAMUT_REMAP_C14_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C21_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_A__MPCC_MCM_SECOND_GAMUT_REMAP_C22_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C23_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_A__MPCC_MCM_SECOND_GAMUT_REMAP_C24_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C31_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_A__MPCC_MCM_SECOND_GAMUT_REMAP_C32_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C33_A_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_A__MPCC_MCM_SECOND_GAMUT_REMAP_C34_A_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C11_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C11_C12_B__MPCC_MCM_SECOND_GAMUT_REMAP_C12_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C13_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C13_C14_B__MPCC_MCM_SECOND_GAMUT_REMAP_C14_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C21_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C21_C22_B__MPCC_MCM_SECOND_GAMUT_REMAP_C22_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C23_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C23_C24_B__MPCC_MCM_SECOND_GAMUT_REMAP_C24_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C31_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C31_C32_B__MPCC_MCM_SECOND_GAMUT_REMAP_C32_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B__SHIFT              0x0
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B__SHIFT              0x10
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C33_B_MASK                0x0000FFFFL
+#define MPCC_MCM3_MPC_MCM_SECOND_GAMUT_REMAP_C33_C34_B__MPCC_MCM_SECOND_GAMUT_REMAP_C34_B_MASK                0xFFFF0000L
+//MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE__SHIFT                                  0x10
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS__SHIFT                                    0x12
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE__SHIFT                               0x14
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE__SHIFT                                  0x1c
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_FORCE_MASK                                    0x00030000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_DIS_MASK                                      0x00040000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00300000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+#define MPCC_MCM3_MPCC_MCM_MEM_PWR_CTRL__MPCC_MCM_1DLUT_MEM_PWR_STATE_MASK                                    0x30000000L
+//MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_SELECT
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_SELECT__MPCC_MCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPCC_MCM3_MPCC_MCM_3DLUT_FAST_LOAD_STATUS__MPCC_MCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPCC_MCM3_MPCC_MCM_REG_UPDATE_STATUS
+#define MPCC_MCM3_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS__SHIFT                       0x0
+#define MPCC_MCM3_MPCC_MCM_REG_UPDATE_STATUS__MPCC_MCM_REG_UPDATE_PENDING_STATUS_MASK                         0x00000001L
+//MPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_INDEX__MPCC_MCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPCC_MCM3_MPCC_MCM_TEST_DEBUG_DATA
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPCC_MCM3_MPCC_MCM_TEST_DEBUG_DATA__MPCC_MCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpc_rmcm0_dispdec
+//MPC_RMCM0_MPC_RMCM_SHAPER_CONTROL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPC_RMCM0_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_R__MPC_RMCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_R__MPC_RMCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_G
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_G__MPC_RMCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_G__MPC_RMCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_B__MPC_RMCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_OFFSET_B__MPC_RMCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_R__MPC_RMCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_R__MPC_RMCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_LUT_INDEX
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_INDEX__MPC_RMCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_INDEX__MPC_RMCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_LUT_DATA
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_DATA__MPC_RMCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_DATA__MPC_RMCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM0_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_MODE
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPC_RMCM0_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPC_RMCM0_MPC_RMCM_3DLUT_INDEX
+#define MPC_RMCM0_MPC_RMCM_3DLUT_INDEX__MPC_RMCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_INDEX__MPC_RMCM_3DLUT_INDEX_MASK                                             0x00003FFFL
+//MPC_RMCM0_MPC_RMCM_3DLUT_DATA
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_DATA_30BIT
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA_30BIT__MPC_RMCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPC_RMCM0_MPC_RMCM_3DLUT_DATA_30BIT__MPC_RMCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPC_RMCM0_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_OUT_NORM_FACTOR
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_NORM_FACTOR__MPC_RMCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_NORM_FACTOR__MPC_RMCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__SHIFT                   0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__MPC_RMCM_GAMUT_REMAP_COEF_FORMAT_MASK                     0x00000001L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE__SHIFT                                 0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_CURRENT__SHIFT                         0x7
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_MASK                                   0x00000003L
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_CURRENT_MASK                           0x00000180L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C11_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C12_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C11_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C12_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C13_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C14_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C13_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C14_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C21_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C22_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C21_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C22_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C23_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C24_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C23_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C24_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C31_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C32_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C31_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C32_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C33_A__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C34_A__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C33_A_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C34_A_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C11_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C12_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C11_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C12_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C13_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C14_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C13_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C14_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C21_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C22_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C21_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C22_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C23_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C24_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C23_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C24_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C31_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C32_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C31_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C32_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C33_B__SHIFT                           0x0
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C34_B__SHIFT                           0x10
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C33_B_MASK                             0x0000FFFFL
+#define MPC_RMCM0_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C34_B_MASK                             0xFFFF0000L
+//MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPC_RMCM0_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+//MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_SELECT
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_SELECT__MPC_RMCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_SELECT__MPC_RMCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPC_RMCM0_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPC_RMCM0_MPC_RMCM_CNTL
+#define MPC_RMCM0_MPC_RMCM_CNTL__MPC_RMCM_CNTL__SHIFT                                                         0x0
+#define MPC_RMCM0_MPC_RMCM_CNTL__MPC_RMCM_CNTL_MASK                                                           0x0000000FL
+//MPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPC_RMCM0_MPC_RMCM_TEST_DEBUG_DATA
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_DATA__MPC_RMCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPC_RMCM0_MPC_RMCM_TEST_DEBUG_DATA__MPC_RMCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpc_rmcm1_dispdec
+//MPC_RMCM1_MPC_RMCM_SHAPER_CONTROL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_LUT_MODE__SHIFT                                    0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_MODE_CURRENT__SHIFT                                0x2
+#define MPC_RMCM1_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_LUT_MODE_MASK                                      0x00000003L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_CONTROL__MPC_RMCM_SHAPER_MODE_CURRENT_MASK                                  0x0000000CL
+//MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_R__MPC_RMCM_SHAPER_OFFSET_R__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_R__MPC_RMCM_SHAPER_OFFSET_R_MASK                                     0x0007FFFFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_G
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_G__MPC_RMCM_SHAPER_OFFSET_G__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_G__MPC_RMCM_SHAPER_OFFSET_G_MASK                                     0x0007FFFFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_B__MPC_RMCM_SHAPER_OFFSET_B__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_OFFSET_B__MPC_RMCM_SHAPER_OFFSET_B_MASK                                     0x0007FFFFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_R__MPC_RMCM_SHAPER_SCALE_R__SHIFT                                     0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_R__MPC_RMCM_SHAPER_SCALE_R_MASK                                       0x0000FFFFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_G__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_B__SHIFT                                   0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_G_MASK                                     0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_SCALE_G_B__MPC_RMCM_SHAPER_SCALE_B_MASK                                     0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_LUT_INDEX
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_INDEX__MPC_RMCM_SHAPER_LUT_INDEX__SHIFT                                 0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_INDEX__MPC_RMCM_SHAPER_LUT_INDEX_MASK                                   0x000000FFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_LUT_DATA
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_DATA__MPC_RMCM_SHAPER_LUT_DATA__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_DATA__MPC_RMCM_SHAPER_LUT_DATA_MASK                                     0x00FFFFFFL
+//MPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__SHIFT                 0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_SEL__SHIFT                     0x4
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK_MASK                   0x00000007L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_LUT_WRITE_EN_MASK__MPC_RMCM_SHAPER_LUT_WRITE_SEL_MASK                       0x00000010L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_B__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_G__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_R__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_START_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_B__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_B__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_G__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_G__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_R__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_END_CNTL_R__MPC_RMCM_SHAPER_RAMA_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_0_1__MPC_RMCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_2_3__MPC_RMCM_SHAPER_RAMA_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_4_5__MPC_RMCM_SHAPER_RAMA_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_6_7__MPC_RMCM_SHAPER_RAMA_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_8_9__MPC_RMCM_SHAPER_RAMA_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_10_11__MPC_RMCM_SHAPER_RAMA_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_12_13__MPC_RMCM_SHAPER_RAMA_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_14_15__MPC_RMCM_SHAPER_RAMA_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_16_17__MPC_RMCM_SHAPER_RAMA_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_18_19__MPC_RMCM_SHAPER_RAMA_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_20_21__MPC_RMCM_SHAPER_RAMA_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_22_23__MPC_RMCM_SHAPER_RAMA_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_24_25__MPC_RMCM_SHAPER_RAMA_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_26_27__MPC_RMCM_SHAPER_RAMA_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_28_29__MPC_RMCM_SHAPER_RAMA_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_30_31__MPC_RMCM_SHAPER_RAMA_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMA_REGION_32_33__MPC_RMCM_SHAPER_RAMA_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_B__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_B_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_B_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_G__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_G_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_G_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_R__SHIFT           0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R__SHIFT   0x14
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_R_MASK             0x0003FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_START_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_START_SEGMENT_R_MASK     0x07F00000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_B__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_B__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_B_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_B__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_B_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_G__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_G__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_G_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_G__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_G_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_R__SHIFT               0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_R__SHIFT          0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_R_MASK                 0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_END_CNTL_R__MPC_RMCM_SHAPER_RAMB_EXP_REGION_END_BASE_R_MASK            0x3FFF0000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION0_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_0_1__MPC_RMCM_SHAPER_RAMB_EXP_REGION1_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION2_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_2_3__MPC_RMCM_SHAPER_RAMB_EXP_REGION3_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION4_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_4_5__MPC_RMCM_SHAPER_RAMB_EXP_REGION5_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION6_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_6_7__MPC_RMCM_SHAPER_RAMB_EXP_REGION7_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET__SHIFT         0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS__SHIFT       0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET__SHIFT         0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS__SHIFT       0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_LUT_OFFSET_MASK           0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION8_NUM_SEGMENTS_MASK         0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_LUT_OFFSET_MASK           0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_8_9__MPC_RMCM_SHAPER_RAMB_EXP_REGION9_NUM_SEGMENTS_MASK         0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION10_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_10_11__MPC_RMCM_SHAPER_RAMB_EXP_REGION11_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION12_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_12_13__MPC_RMCM_SHAPER_RAMB_EXP_REGION13_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION14_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_14_15__MPC_RMCM_SHAPER_RAMB_EXP_REGION15_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION16_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_16_17__MPC_RMCM_SHAPER_RAMB_EXP_REGION17_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION18_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_18_19__MPC_RMCM_SHAPER_RAMB_EXP_REGION19_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION20_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_20_21__MPC_RMCM_SHAPER_RAMB_EXP_REGION21_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION22_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_22_23__MPC_RMCM_SHAPER_RAMB_EXP_REGION23_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION24_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_24_25__MPC_RMCM_SHAPER_RAMB_EXP_REGION25_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION26_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_26_27__MPC_RMCM_SHAPER_RAMB_EXP_REGION27_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION28_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_28_29__MPC_RMCM_SHAPER_RAMB_EXP_REGION29_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION30_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_30_31__MPC_RMCM_SHAPER_RAMB_EXP_REGION31_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET__SHIFT      0x0
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS__SHIFT    0xc
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET__SHIFT      0x10
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS__SHIFT    0x1c
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_LUT_OFFSET_MASK        0x000001FFL
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION32_NUM_SEGMENTS_MASK      0x00007000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_LUT_OFFSET_MASK        0x01FF0000L
+#define MPC_RMCM1_MPC_RMCM_SHAPER_RAMB_REGION_32_33__MPC_RMCM_SHAPER_RAMB_EXP_REGION33_NUM_SEGMENTS_MASK      0x70000000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_MODE
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE__SHIFT                                             0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_SIZE__SHIFT                                             0x4
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_CURRENT__SHIFT                                     0x8
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_MASK                                               0x00000003L
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_SIZE_MASK                                               0x00000030L
+#define MPC_RMCM1_MPC_RMCM_3DLUT_MODE__MPC_RMCM_3DLUT_MODE_CURRENT_MASK                                       0x00000300L
+//MPC_RMCM1_MPC_RMCM_3DLUT_INDEX
+#define MPC_RMCM1_MPC_RMCM_3DLUT_INDEX__MPC_RMCM_3DLUT_INDEX__SHIFT                                           0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_INDEX__MPC_RMCM_3DLUT_INDEX_MASK                                             0x00003FFFL
+//MPC_RMCM1_MPC_RMCM_3DLUT_DATA
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA0__SHIFT                                            0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA1__SHIFT                                            0x10
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA0_MASK                                              0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA__MPC_RMCM_3DLUT_DATA1_MASK                                              0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_DATA_30BIT
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA_30BIT__MPC_RMCM_3DLUT_DATA_30BIT__SHIFT                                 0x2
+#define MPC_RMCM1_MPC_RMCM_3DLUT_DATA_30BIT__MPC_RMCM_3DLUT_DATA_30BIT_MASK                                   0xFFFFFFFCL
+//MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_WRITE_EN_MASK__SHIFT                      0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_30BIT_EN__SHIFT                           0x8
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_READ_SEL__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_WRITE_EN_MASK_MASK                        0x0000000FL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_30BIT_EN_MASK                             0x00000100L
+#define MPC_RMCM1_MPC_RMCM_3DLUT_READ_WRITE_CONTROL__MPC_RMCM_3DLUT_READ_SEL_MASK                             0x00030000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_OUT_NORM_FACTOR
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_NORM_FACTOR__MPC_RMCM_3DLUT_OUT_NORM_FACTOR__SHIFT                       0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_NORM_FACTOR__MPC_RMCM_3DLUT_OUT_NORM_FACTOR_MASK                         0x0000FFFFL
+//MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_OFFSET_R__SHIFT                             0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_SCALE_R__SHIFT                              0x10
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_OFFSET_R_MASK                               0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_R__MPC_RMCM_3DLUT_OUT_SCALE_R_MASK                                0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_OFFSET_G__SHIFT                             0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_SCALE_G__SHIFT                              0x10
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_OFFSET_G_MASK                               0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_G__MPC_RMCM_3DLUT_OUT_SCALE_G_MASK                                0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_OFFSET_B__SHIFT                             0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_SCALE_B__SHIFT                              0x10
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_OFFSET_B_MASK                               0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_3DLUT_OUT_OFFSET_B__MPC_RMCM_3DLUT_OUT_SCALE_B_MASK                                0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__SHIFT                   0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_COEF_FORMAT__MPC_RMCM_GAMUT_REMAP_COEF_FORMAT_MASK                     0x00000001L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE__SHIFT                                 0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_CURRENT__SHIFT                         0x7
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_MASK                                   0x00000003L
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_MODE__MPC_RMCM_GAMUT_REMAP_MODE_CURRENT_MASK                           0x00000180L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C11_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C12_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C11_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_A__MPC_RMCM_GAMUT_REMAP_C12_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C13_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C14_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C13_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_A__MPC_RMCM_GAMUT_REMAP_C14_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C21_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C22_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C21_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_A__MPC_RMCM_GAMUT_REMAP_C22_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C23_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C24_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C23_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_A__MPC_RMCM_GAMUT_REMAP_C24_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C31_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C32_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C31_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_A__MPC_RMCM_GAMUT_REMAP_C32_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C33_A__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C34_A__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C33_A_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_A__MPC_RMCM_GAMUT_REMAP_C34_A_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C11_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C12_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C11_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C11_C12_B__MPC_RMCM_GAMUT_REMAP_C12_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C13_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C14_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C13_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C13_C14_B__MPC_RMCM_GAMUT_REMAP_C14_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C21_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C22_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C21_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C21_C22_B__MPC_RMCM_GAMUT_REMAP_C22_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C23_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C24_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C23_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C23_C24_B__MPC_RMCM_GAMUT_REMAP_C24_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C31_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C32_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C31_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C31_C32_B__MPC_RMCM_GAMUT_REMAP_C32_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C33_B__SHIFT                           0x0
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C34_B__SHIFT                           0x10
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C33_B_MASK                             0x0000FFFFL
+#define MPC_RMCM1_MPC_RMCM_GAMUT_REMAP_C33_C34_B__MPC_RMCM_GAMUT_REMAP_C34_B_MASK                             0xFFFF0000L
+//MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_FORCE__SHIFT                                 0x0
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_DIS__SHIFT                                   0x2
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_LOW_PWR_MODE__SHIFT                              0x4
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_FORCE__SHIFT                                  0x8
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_DIS__SHIFT                                    0xa
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_LOW_PWR_MODE__SHIFT                               0xc
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_STATE__SHIFT                                 0x18
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_STATE__SHIFT                                  0x1a
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_FORCE_MASK                                   0x00000003L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_DIS_MASK                                     0x00000004L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_LOW_PWR_MODE_MASK                                0x00000030L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_FORCE_MASK                                    0x00000300L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_DIS_MASK                                      0x00000400L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_LOW_PWR_MODE_MASK                                 0x00003000L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_SHAPER_MEM_PWR_STATE_MASK                                   0x03000000L
+#define MPC_RMCM1_MPC_RMCM_MEM_PWR_CTRL__MPC_RMCM_3DLUT_MEM_PWR_STATE_MASK                                    0x0C000000L
+//MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_SELECT
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_SELECT__MPC_RMCM_3DLUT_FL_SEL__SHIFT                               0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_SELECT__MPC_RMCM_3DLUT_FL_SEL_MASK                                 0x0000000FL
+//MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_DONE__SHIFT                              0x0
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_SOFT_UNDERFLOW__SHIFT                    0x1
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_HARD_UNDERFLOW__SHIFT                    0x2
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_DONE_MASK                                0x00000001L
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_SOFT_UNDERFLOW_MASK                      0x00000002L
+#define MPC_RMCM1_MPC_RMCM_3DLUT_FAST_LOAD_STATUS__MPC_RMCM_3DLUT_FL_HARD_UNDERFLOW_MASK                      0x00000004L
+//MPC_RMCM1_MPC_RMCM_CNTL
+#define MPC_RMCM1_MPC_RMCM_CNTL__MPC_RMCM_CNTL__SHIFT                                                         0x0
+#define MPC_RMCM1_MPC_RMCM_CNTL__MPC_RMCM_CNTL_MASK                                                           0x0000000FL
+//MPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_WRITE_EN__SHIFT                              0x8
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_INDEX__MPC_RMCM_TEST_DEBUG_WRITE_EN_MASK                                0x00000100L
+//MPC_RMCM1_MPC_RMCM_TEST_DEBUG_DATA
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_DATA__MPC_RMCM_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define MPC_RMCM1_MPC_RMCM_TEST_DEBUG_DATA__MPC_RMCM_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_mpc_mpc_ocsc_dispdec
+//MPC_OUT0_MUX
+#define MPC_OUT0_MUX__MPC_OUT_MUX__SHIFT                                                                      0x0
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR__SHIFT                                                  0x5
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK__SHIFT                                                   0x7
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_DISABLE__SHIFT                                                     0x8
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL__SHIFT                                                             0x9
+#define MPC_OUT0_MUX__MPC_OUT_FLOW_CONTROL_MODE__SHIFT                                                        0xa
+#define MPC_OUT0_MUX__MPC_OUT_FLOW_CONTROL_COUNT__SHIFT                                                       0xb
+#define MPC_OUT0_MUX__MPC_OUT_MUX_MASK                                                                        0x0000000FL
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR_MASK                                                    0x00000020L
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK_MASK                                                     0x00000080L
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_DISABLE_MASK                                                       0x00000100L
+#define MPC_OUT0_MUX__MPC_OUT_RATE_CONTROL_MASK                                                               0x00000200L
+#define MPC_OUT0_MUX__MPC_OUT_FLOW_CONTROL_MODE_MASK                                                          0x00000400L
+#define MPC_OUT0_MUX__MPC_OUT_FLOW_CONTROL_COUNT_MASK                                                         0x007FF800L
+//MPC_OUT0_DENORM_CONTROL
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR__SHIFT                                         0x0
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR__SHIFT                                         0xc
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_MODE__SHIFT                                                   0x18
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR_MASK                                           0x00000FFFL
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR_MASK                                           0x00FFF000L
+#define MPC_OUT0_DENORM_CONTROL__MPC_OUT_DENORM_MODE_MASK                                                     0x07000000L
+//MPC_OUT0_DENORM_CLAMP_G_Y
+#define MPC_OUT0_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y__SHIFT                                        0x0
+#define MPC_OUT0_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y__SHIFT                                        0xc
+#define MPC_OUT0_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y_MASK                                          0x00000FFFL
+#define MPC_OUT0_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y_MASK                                          0x00FFF000L
+//MPC_OUT0_DENORM_CLAMP_B_CB
+#define MPC_OUT0_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB__SHIFT                                      0x0
+#define MPC_OUT0_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB__SHIFT                                      0xc
+#define MPC_OUT0_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB_MASK                                        0x00000FFFL
+#define MPC_OUT0_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB_MASK                                        0x00FFF000L
+//MPC_OUT1_MUX
+#define MPC_OUT1_MUX__MPC_OUT_MUX__SHIFT                                                                      0x0
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR__SHIFT                                                  0x5
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK__SHIFT                                                   0x7
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_DISABLE__SHIFT                                                     0x8
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL__SHIFT                                                             0x9
+#define MPC_OUT1_MUX__MPC_OUT_FLOW_CONTROL_MODE__SHIFT                                                        0xa
+#define MPC_OUT1_MUX__MPC_OUT_FLOW_CONTROL_COUNT__SHIFT                                                       0xb
+#define MPC_OUT1_MUX__MPC_OUT_MUX_MASK                                                                        0x0000000FL
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR_MASK                                                    0x00000020L
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK_MASK                                                     0x00000080L
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_DISABLE_MASK                                                       0x00000100L
+#define MPC_OUT1_MUX__MPC_OUT_RATE_CONTROL_MASK                                                               0x00000200L
+#define MPC_OUT1_MUX__MPC_OUT_FLOW_CONTROL_MODE_MASK                                                          0x00000400L
+#define MPC_OUT1_MUX__MPC_OUT_FLOW_CONTROL_COUNT_MASK                                                         0x007FF800L
+//MPC_OUT1_DENORM_CONTROL
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR__SHIFT                                         0x0
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR__SHIFT                                         0xc
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_MODE__SHIFT                                                   0x18
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR_MASK                                           0x00000FFFL
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR_MASK                                           0x00FFF000L
+#define MPC_OUT1_DENORM_CONTROL__MPC_OUT_DENORM_MODE_MASK                                                     0x07000000L
+//MPC_OUT1_DENORM_CLAMP_G_Y
+#define MPC_OUT1_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y__SHIFT                                        0x0
+#define MPC_OUT1_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y__SHIFT                                        0xc
+#define MPC_OUT1_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y_MASK                                          0x00000FFFL
+#define MPC_OUT1_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y_MASK                                          0x00FFF000L
+//MPC_OUT1_DENORM_CLAMP_B_CB
+#define MPC_OUT1_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB__SHIFT                                      0x0
+#define MPC_OUT1_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB__SHIFT                                      0xc
+#define MPC_OUT1_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB_MASK                                        0x00000FFFL
+#define MPC_OUT1_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB_MASK                                        0x00FFF000L
+//MPC_OUT2_MUX
+#define MPC_OUT2_MUX__MPC_OUT_MUX__SHIFT                                                                      0x0
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR__SHIFT                                                  0x5
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK__SHIFT                                                   0x7
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_DISABLE__SHIFT                                                     0x8
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL__SHIFT                                                             0x9
+#define MPC_OUT2_MUX__MPC_OUT_FLOW_CONTROL_MODE__SHIFT                                                        0xa
+#define MPC_OUT2_MUX__MPC_OUT_FLOW_CONTROL_COUNT__SHIFT                                                       0xb
+#define MPC_OUT2_MUX__MPC_OUT_MUX_MASK                                                                        0x0000000FL
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR_MASK                                                    0x00000020L
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK_MASK                                                     0x00000080L
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_DISABLE_MASK                                                       0x00000100L
+#define MPC_OUT2_MUX__MPC_OUT_RATE_CONTROL_MASK                                                               0x00000200L
+#define MPC_OUT2_MUX__MPC_OUT_FLOW_CONTROL_MODE_MASK                                                          0x00000400L
+#define MPC_OUT2_MUX__MPC_OUT_FLOW_CONTROL_COUNT_MASK                                                         0x007FF800L
+//MPC_OUT2_DENORM_CONTROL
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR__SHIFT                                         0x0
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR__SHIFT                                         0xc
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_MODE__SHIFT                                                   0x18
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR_MASK                                           0x00000FFFL
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR_MASK                                           0x00FFF000L
+#define MPC_OUT2_DENORM_CONTROL__MPC_OUT_DENORM_MODE_MASK                                                     0x07000000L
+//MPC_OUT2_DENORM_CLAMP_G_Y
+#define MPC_OUT2_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y__SHIFT                                        0x0
+#define MPC_OUT2_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y__SHIFT                                        0xc
+#define MPC_OUT2_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y_MASK                                          0x00000FFFL
+#define MPC_OUT2_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y_MASK                                          0x00FFF000L
+//MPC_OUT2_DENORM_CLAMP_B_CB
+#define MPC_OUT2_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB__SHIFT                                      0x0
+#define MPC_OUT2_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB__SHIFT                                      0xc
+#define MPC_OUT2_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB_MASK                                        0x00000FFFL
+#define MPC_OUT2_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB_MASK                                        0x00FFF000L
+//MPC_OUT3_MUX
+#define MPC_OUT3_MUX__MPC_OUT_MUX__SHIFT                                                                      0x0
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR__SHIFT                                                  0x5
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK__SHIFT                                                   0x7
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_DISABLE__SHIFT                                                     0x8
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL__SHIFT                                                             0x9
+#define MPC_OUT3_MUX__MPC_OUT_FLOW_CONTROL_MODE__SHIFT                                                        0xa
+#define MPC_OUT3_MUX__MPC_OUT_FLOW_CONTROL_COUNT__SHIFT                                                       0xb
+#define MPC_OUT3_MUX__MPC_OUT_MUX_MASK                                                                        0x0000000FL
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_OVFL_ERROR_MASK                                                    0x00000020L
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_ERROR_ACK_MASK                                                     0x00000080L
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_DISABLE_MASK                                                       0x00000100L
+#define MPC_OUT3_MUX__MPC_OUT_RATE_CONTROL_MASK                                                               0x00000200L
+#define MPC_OUT3_MUX__MPC_OUT_FLOW_CONTROL_MODE_MASK                                                          0x00000400L
+#define MPC_OUT3_MUX__MPC_OUT_FLOW_CONTROL_COUNT_MASK                                                         0x007FF800L
+//MPC_OUT3_DENORM_CONTROL
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR__SHIFT                                         0x0
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR__SHIFT                                         0xc
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_MODE__SHIFT                                                   0x18
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MIN_R_CR_MASK                                           0x00000FFFL
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_CLAMP_MAX_R_CR_MASK                                           0x00FFF000L
+#define MPC_OUT3_DENORM_CONTROL__MPC_OUT_DENORM_MODE_MASK                                                     0x07000000L
+//MPC_OUT3_DENORM_CLAMP_G_Y
+#define MPC_OUT3_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y__SHIFT                                        0x0
+#define MPC_OUT3_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y__SHIFT                                        0xc
+#define MPC_OUT3_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MIN_G_Y_MASK                                          0x00000FFFL
+#define MPC_OUT3_DENORM_CLAMP_G_Y__MPC_OUT_DENORM_CLAMP_MAX_G_Y_MASK                                          0x00FFF000L
+//MPC_OUT3_DENORM_CLAMP_B_CB
+#define MPC_OUT3_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB__SHIFT                                      0x0
+#define MPC_OUT3_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB__SHIFT                                      0xc
+#define MPC_OUT3_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MIN_B_CB_MASK                                        0x00000FFFL
+#define MPC_OUT3_DENORM_CLAMP_B_CB__MPC_OUT_DENORM_CLAMP_MAX_B_CB_MASK                                        0x00FFF000L
+//MPC_OUT_CSC_COEF_FORMAT
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC0_COEF_FORMAT__SHIFT                                                 0x0
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC1_COEF_FORMAT__SHIFT                                                 0x1
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC2_COEF_FORMAT__SHIFT                                                 0x2
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC3_COEF_FORMAT__SHIFT                                                 0x3
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC0_COEF_FORMAT_MASK                                                   0x00000001L
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC1_COEF_FORMAT_MASK                                                   0x00000002L
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC2_COEF_FORMAT_MASK                                                   0x00000004L
+#define MPC_OUT_CSC_COEF_FORMAT__MPC_OCSC3_COEF_FORMAT_MASK                                                   0x00000008L
+//MPC_OUT0_CSC_MODE
+#define MPC_OUT0_CSC_MODE__MPC_OCSC_MODE__SHIFT                                                               0x0
+#define MPC_OUT0_CSC_MODE__MPC_OCSC_MODE_CURRENT__SHIFT                                                       0x7
+#define MPC_OUT0_CSC_MODE__MPC_OCSC_MODE_MASK                                                                 0x00000003L
+#define MPC_OUT0_CSC_MODE__MPC_OCSC_MODE_CURRENT_MASK                                                         0x00000180L
+//MPC_OUT0_CSC_C11_C12_A
+#define MPC_OUT0_CSC_C11_C12_A__MPC_OCSC_C11_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C11_C12_A__MPC_OCSC_C12_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C11_C12_A__MPC_OCSC_C11_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C11_C12_A__MPC_OCSC_C12_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C13_C14_A
+#define MPC_OUT0_CSC_C13_C14_A__MPC_OCSC_C13_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C13_C14_A__MPC_OCSC_C14_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C13_C14_A__MPC_OCSC_C13_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C13_C14_A__MPC_OCSC_C14_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C21_C22_A
+#define MPC_OUT0_CSC_C21_C22_A__MPC_OCSC_C21_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C21_C22_A__MPC_OCSC_C22_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C21_C22_A__MPC_OCSC_C21_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C21_C22_A__MPC_OCSC_C22_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C23_C24_A
+#define MPC_OUT0_CSC_C23_C24_A__MPC_OCSC_C23_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C23_C24_A__MPC_OCSC_C24_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C23_C24_A__MPC_OCSC_C23_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C23_C24_A__MPC_OCSC_C24_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C31_C32_A
+#define MPC_OUT0_CSC_C31_C32_A__MPC_OCSC_C31_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C31_C32_A__MPC_OCSC_C32_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C31_C32_A__MPC_OCSC_C31_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C31_C32_A__MPC_OCSC_C32_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C33_C34_A
+#define MPC_OUT0_CSC_C33_C34_A__MPC_OCSC_C33_A__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C33_C34_A__MPC_OCSC_C34_A__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C33_C34_A__MPC_OCSC_C33_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C33_C34_A__MPC_OCSC_C34_A_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C11_C12_B
+#define MPC_OUT0_CSC_C11_C12_B__MPC_OCSC_C11_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C11_C12_B__MPC_OCSC_C12_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C11_C12_B__MPC_OCSC_C11_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C11_C12_B__MPC_OCSC_C12_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C13_C14_B
+#define MPC_OUT0_CSC_C13_C14_B__MPC_OCSC_C13_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C13_C14_B__MPC_OCSC_C14_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C13_C14_B__MPC_OCSC_C13_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C13_C14_B__MPC_OCSC_C14_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C21_C22_B
+#define MPC_OUT0_CSC_C21_C22_B__MPC_OCSC_C21_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C21_C22_B__MPC_OCSC_C22_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C21_C22_B__MPC_OCSC_C21_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C21_C22_B__MPC_OCSC_C22_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C23_C24_B
+#define MPC_OUT0_CSC_C23_C24_B__MPC_OCSC_C23_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C23_C24_B__MPC_OCSC_C24_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C23_C24_B__MPC_OCSC_C23_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C23_C24_B__MPC_OCSC_C24_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C31_C32_B
+#define MPC_OUT0_CSC_C31_C32_B__MPC_OCSC_C31_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C31_C32_B__MPC_OCSC_C32_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C31_C32_B__MPC_OCSC_C31_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C31_C32_B__MPC_OCSC_C32_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_CSC_C33_C34_B
+#define MPC_OUT0_CSC_C33_C34_B__MPC_OCSC_C33_B__SHIFT                                                         0x0
+#define MPC_OUT0_CSC_C33_C34_B__MPC_OCSC_C34_B__SHIFT                                                         0x10
+#define MPC_OUT0_CSC_C33_C34_B__MPC_OCSC_C33_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT0_CSC_C33_C34_B__MPC_OCSC_C34_B_MASK                                                           0xFFFF0000L
+//MPC_OUT0_PIX_SNAP_EN
+#define MPC_OUT0_PIX_SNAP_EN__PIX_SNAP_EN__SHIFT                                                              0x0
+#define MPC_OUT0_PIX_SNAP_EN__PIX_SNAP_EN_MASK                                                                0x00000001L
+//MPC_OUT0_PIX_SNAP
+#define MPC_OUT0_PIX_SNAP__PIX_SNAP_X__SHIFT                                                                  0x0
+#define MPC_OUT0_PIX_SNAP__PIX_SNAP_Y__SHIFT                                                                  0x10
+#define MPC_OUT0_PIX_SNAP__PIX_SNAP_X_MASK                                                                    0x00003FFFL
+#define MPC_OUT0_PIX_SNAP__PIX_SNAP_Y_MASK                                                                    0x3FFF0000L
+//MPC_OUT0_PIX_SNAP_PIX_READ1
+#define MPC_OUT0_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y__SHIFT                                                      0x0
+#define MPC_OUT0_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS__SHIFT                                                0x1f
+#define MPC_OUT0_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y_MASK                                                        0x00000FFFL
+#define MPC_OUT0_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS_MASK                                                  0x80000000L
+//MPC_OUT0_PIX_SNAP_PIX_READ2
+#define MPC_OUT0_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR__SHIFT                                                     0x0
+#define MPC_OUT0_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB__SHIFT                                                     0x10
+#define MPC_OUT0_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR_MASK                                                       0x00000FFFL
+#define MPC_OUT0_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB_MASK                                                       0x0FFF0000L
+//MPC_OUT1_CSC_MODE
+#define MPC_OUT1_CSC_MODE__MPC_OCSC_MODE__SHIFT                                                               0x0
+#define MPC_OUT1_CSC_MODE__MPC_OCSC_MODE_CURRENT__SHIFT                                                       0x7
+#define MPC_OUT1_CSC_MODE__MPC_OCSC_MODE_MASK                                                                 0x00000003L
+#define MPC_OUT1_CSC_MODE__MPC_OCSC_MODE_CURRENT_MASK                                                         0x00000180L
+//MPC_OUT1_CSC_C11_C12_A
+#define MPC_OUT1_CSC_C11_C12_A__MPC_OCSC_C11_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C11_C12_A__MPC_OCSC_C12_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C11_C12_A__MPC_OCSC_C11_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C11_C12_A__MPC_OCSC_C12_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C13_C14_A
+#define MPC_OUT1_CSC_C13_C14_A__MPC_OCSC_C13_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C13_C14_A__MPC_OCSC_C14_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C13_C14_A__MPC_OCSC_C13_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C13_C14_A__MPC_OCSC_C14_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C21_C22_A
+#define MPC_OUT1_CSC_C21_C22_A__MPC_OCSC_C21_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C21_C22_A__MPC_OCSC_C22_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C21_C22_A__MPC_OCSC_C21_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C21_C22_A__MPC_OCSC_C22_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C23_C24_A
+#define MPC_OUT1_CSC_C23_C24_A__MPC_OCSC_C23_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C23_C24_A__MPC_OCSC_C24_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C23_C24_A__MPC_OCSC_C23_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C23_C24_A__MPC_OCSC_C24_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C31_C32_A
+#define MPC_OUT1_CSC_C31_C32_A__MPC_OCSC_C31_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C31_C32_A__MPC_OCSC_C32_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C31_C32_A__MPC_OCSC_C31_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C31_C32_A__MPC_OCSC_C32_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C33_C34_A
+#define MPC_OUT1_CSC_C33_C34_A__MPC_OCSC_C33_A__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C33_C34_A__MPC_OCSC_C34_A__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C33_C34_A__MPC_OCSC_C33_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C33_C34_A__MPC_OCSC_C34_A_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C11_C12_B
+#define MPC_OUT1_CSC_C11_C12_B__MPC_OCSC_C11_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C11_C12_B__MPC_OCSC_C12_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C11_C12_B__MPC_OCSC_C11_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C11_C12_B__MPC_OCSC_C12_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C13_C14_B
+#define MPC_OUT1_CSC_C13_C14_B__MPC_OCSC_C13_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C13_C14_B__MPC_OCSC_C14_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C13_C14_B__MPC_OCSC_C13_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C13_C14_B__MPC_OCSC_C14_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C21_C22_B
+#define MPC_OUT1_CSC_C21_C22_B__MPC_OCSC_C21_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C21_C22_B__MPC_OCSC_C22_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C21_C22_B__MPC_OCSC_C21_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C21_C22_B__MPC_OCSC_C22_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C23_C24_B
+#define MPC_OUT1_CSC_C23_C24_B__MPC_OCSC_C23_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C23_C24_B__MPC_OCSC_C24_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C23_C24_B__MPC_OCSC_C23_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C23_C24_B__MPC_OCSC_C24_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C31_C32_B
+#define MPC_OUT1_CSC_C31_C32_B__MPC_OCSC_C31_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C31_C32_B__MPC_OCSC_C32_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C31_C32_B__MPC_OCSC_C31_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C31_C32_B__MPC_OCSC_C32_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_CSC_C33_C34_B
+#define MPC_OUT1_CSC_C33_C34_B__MPC_OCSC_C33_B__SHIFT                                                         0x0
+#define MPC_OUT1_CSC_C33_C34_B__MPC_OCSC_C34_B__SHIFT                                                         0x10
+#define MPC_OUT1_CSC_C33_C34_B__MPC_OCSC_C33_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT1_CSC_C33_C34_B__MPC_OCSC_C34_B_MASK                                                           0xFFFF0000L
+//MPC_OUT1_PIX_SNAP_EN
+#define MPC_OUT1_PIX_SNAP_EN__PIX_SNAP_EN__SHIFT                                                              0x0
+#define MPC_OUT1_PIX_SNAP_EN__PIX_SNAP_EN_MASK                                                                0x00000001L
+//MPC_OUT1_PIX_SNAP
+#define MPC_OUT1_PIX_SNAP__PIX_SNAP_X__SHIFT                                                                  0x0
+#define MPC_OUT1_PIX_SNAP__PIX_SNAP_Y__SHIFT                                                                  0x10
+#define MPC_OUT1_PIX_SNAP__PIX_SNAP_X_MASK                                                                    0x00003FFFL
+#define MPC_OUT1_PIX_SNAP__PIX_SNAP_Y_MASK                                                                    0x3FFF0000L
+//MPC_OUT1_PIX_SNAP_PIX_READ1
+#define MPC_OUT1_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y__SHIFT                                                      0x0
+#define MPC_OUT1_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS__SHIFT                                                0x1f
+#define MPC_OUT1_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y_MASK                                                        0x00000FFFL
+#define MPC_OUT1_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS_MASK                                                  0x80000000L
+//MPC_OUT1_PIX_SNAP_PIX_READ2
+#define MPC_OUT1_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR__SHIFT                                                     0x0
+#define MPC_OUT1_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB__SHIFT                                                     0x10
+#define MPC_OUT1_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR_MASK                                                       0x00000FFFL
+#define MPC_OUT1_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB_MASK                                                       0x0FFF0000L
+//MPC_OUT2_CSC_MODE
+#define MPC_OUT2_CSC_MODE__MPC_OCSC_MODE__SHIFT                                                               0x0
+#define MPC_OUT2_CSC_MODE__MPC_OCSC_MODE_CURRENT__SHIFT                                                       0x7
+#define MPC_OUT2_CSC_MODE__MPC_OCSC_MODE_MASK                                                                 0x00000003L
+#define MPC_OUT2_CSC_MODE__MPC_OCSC_MODE_CURRENT_MASK                                                         0x00000180L
+//MPC_OUT2_CSC_C11_C12_A
+#define MPC_OUT2_CSC_C11_C12_A__MPC_OCSC_C11_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C11_C12_A__MPC_OCSC_C12_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C11_C12_A__MPC_OCSC_C11_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C11_C12_A__MPC_OCSC_C12_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C13_C14_A
+#define MPC_OUT2_CSC_C13_C14_A__MPC_OCSC_C13_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C13_C14_A__MPC_OCSC_C14_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C13_C14_A__MPC_OCSC_C13_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C13_C14_A__MPC_OCSC_C14_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C21_C22_A
+#define MPC_OUT2_CSC_C21_C22_A__MPC_OCSC_C21_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C21_C22_A__MPC_OCSC_C22_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C21_C22_A__MPC_OCSC_C21_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C21_C22_A__MPC_OCSC_C22_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C23_C24_A
+#define MPC_OUT2_CSC_C23_C24_A__MPC_OCSC_C23_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C23_C24_A__MPC_OCSC_C24_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C23_C24_A__MPC_OCSC_C23_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C23_C24_A__MPC_OCSC_C24_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C31_C32_A
+#define MPC_OUT2_CSC_C31_C32_A__MPC_OCSC_C31_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C31_C32_A__MPC_OCSC_C32_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C31_C32_A__MPC_OCSC_C31_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C31_C32_A__MPC_OCSC_C32_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C33_C34_A
+#define MPC_OUT2_CSC_C33_C34_A__MPC_OCSC_C33_A__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C33_C34_A__MPC_OCSC_C34_A__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C33_C34_A__MPC_OCSC_C33_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C33_C34_A__MPC_OCSC_C34_A_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C11_C12_B
+#define MPC_OUT2_CSC_C11_C12_B__MPC_OCSC_C11_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C11_C12_B__MPC_OCSC_C12_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C11_C12_B__MPC_OCSC_C11_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C11_C12_B__MPC_OCSC_C12_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C13_C14_B
+#define MPC_OUT2_CSC_C13_C14_B__MPC_OCSC_C13_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C13_C14_B__MPC_OCSC_C14_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C13_C14_B__MPC_OCSC_C13_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C13_C14_B__MPC_OCSC_C14_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C21_C22_B
+#define MPC_OUT2_CSC_C21_C22_B__MPC_OCSC_C21_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C21_C22_B__MPC_OCSC_C22_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C21_C22_B__MPC_OCSC_C21_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C21_C22_B__MPC_OCSC_C22_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C23_C24_B
+#define MPC_OUT2_CSC_C23_C24_B__MPC_OCSC_C23_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C23_C24_B__MPC_OCSC_C24_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C23_C24_B__MPC_OCSC_C23_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C23_C24_B__MPC_OCSC_C24_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C31_C32_B
+#define MPC_OUT2_CSC_C31_C32_B__MPC_OCSC_C31_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C31_C32_B__MPC_OCSC_C32_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C31_C32_B__MPC_OCSC_C31_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C31_C32_B__MPC_OCSC_C32_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_CSC_C33_C34_B
+#define MPC_OUT2_CSC_C33_C34_B__MPC_OCSC_C33_B__SHIFT                                                         0x0
+#define MPC_OUT2_CSC_C33_C34_B__MPC_OCSC_C34_B__SHIFT                                                         0x10
+#define MPC_OUT2_CSC_C33_C34_B__MPC_OCSC_C33_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT2_CSC_C33_C34_B__MPC_OCSC_C34_B_MASK                                                           0xFFFF0000L
+//MPC_OUT2_PIX_SNAP_EN
+#define MPC_OUT2_PIX_SNAP_EN__PIX_SNAP_EN__SHIFT                                                              0x0
+#define MPC_OUT2_PIX_SNAP_EN__PIX_SNAP_EN_MASK                                                                0x00000001L
+//MPC_OUT2_PIX_SNAP
+#define MPC_OUT2_PIX_SNAP__PIX_SNAP_X__SHIFT                                                                  0x0
+#define MPC_OUT2_PIX_SNAP__PIX_SNAP_Y__SHIFT                                                                  0x10
+#define MPC_OUT2_PIX_SNAP__PIX_SNAP_X_MASK                                                                    0x00003FFFL
+#define MPC_OUT2_PIX_SNAP__PIX_SNAP_Y_MASK                                                                    0x3FFF0000L
+//MPC_OUT2_PIX_SNAP_PIX_READ1
+#define MPC_OUT2_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y__SHIFT                                                      0x0
+#define MPC_OUT2_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS__SHIFT                                                0x1f
+#define MPC_OUT2_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y_MASK                                                        0x00000FFFL
+#define MPC_OUT2_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS_MASK                                                  0x80000000L
+//MPC_OUT2_PIX_SNAP_PIX_READ2
+#define MPC_OUT2_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR__SHIFT                                                     0x0
+#define MPC_OUT2_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB__SHIFT                                                     0x10
+#define MPC_OUT2_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR_MASK                                                       0x00000FFFL
+#define MPC_OUT2_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB_MASK                                                       0x0FFF0000L
+//MPC_OUT3_CSC_MODE
+#define MPC_OUT3_CSC_MODE__MPC_OCSC_MODE__SHIFT                                                               0x0
+#define MPC_OUT3_CSC_MODE__MPC_OCSC_MODE_CURRENT__SHIFT                                                       0x7
+#define MPC_OUT3_CSC_MODE__MPC_OCSC_MODE_MASK                                                                 0x00000003L
+#define MPC_OUT3_CSC_MODE__MPC_OCSC_MODE_CURRENT_MASK                                                         0x00000180L
+//MPC_OUT3_CSC_C11_C12_A
+#define MPC_OUT3_CSC_C11_C12_A__MPC_OCSC_C11_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C11_C12_A__MPC_OCSC_C12_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C11_C12_A__MPC_OCSC_C11_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C11_C12_A__MPC_OCSC_C12_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C13_C14_A
+#define MPC_OUT3_CSC_C13_C14_A__MPC_OCSC_C13_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C13_C14_A__MPC_OCSC_C14_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C13_C14_A__MPC_OCSC_C13_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C13_C14_A__MPC_OCSC_C14_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C21_C22_A
+#define MPC_OUT3_CSC_C21_C22_A__MPC_OCSC_C21_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C21_C22_A__MPC_OCSC_C22_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C21_C22_A__MPC_OCSC_C21_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C21_C22_A__MPC_OCSC_C22_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C23_C24_A
+#define MPC_OUT3_CSC_C23_C24_A__MPC_OCSC_C23_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C23_C24_A__MPC_OCSC_C24_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C23_C24_A__MPC_OCSC_C23_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C23_C24_A__MPC_OCSC_C24_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C31_C32_A
+#define MPC_OUT3_CSC_C31_C32_A__MPC_OCSC_C31_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C31_C32_A__MPC_OCSC_C32_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C31_C32_A__MPC_OCSC_C31_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C31_C32_A__MPC_OCSC_C32_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C33_C34_A
+#define MPC_OUT3_CSC_C33_C34_A__MPC_OCSC_C33_A__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C33_C34_A__MPC_OCSC_C34_A__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C33_C34_A__MPC_OCSC_C33_A_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C33_C34_A__MPC_OCSC_C34_A_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C11_C12_B
+#define MPC_OUT3_CSC_C11_C12_B__MPC_OCSC_C11_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C11_C12_B__MPC_OCSC_C12_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C11_C12_B__MPC_OCSC_C11_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C11_C12_B__MPC_OCSC_C12_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C13_C14_B
+#define MPC_OUT3_CSC_C13_C14_B__MPC_OCSC_C13_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C13_C14_B__MPC_OCSC_C14_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C13_C14_B__MPC_OCSC_C13_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C13_C14_B__MPC_OCSC_C14_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C21_C22_B
+#define MPC_OUT3_CSC_C21_C22_B__MPC_OCSC_C21_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C21_C22_B__MPC_OCSC_C22_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C21_C22_B__MPC_OCSC_C21_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C21_C22_B__MPC_OCSC_C22_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C23_C24_B
+#define MPC_OUT3_CSC_C23_C24_B__MPC_OCSC_C23_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C23_C24_B__MPC_OCSC_C24_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C23_C24_B__MPC_OCSC_C23_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C23_C24_B__MPC_OCSC_C24_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C31_C32_B
+#define MPC_OUT3_CSC_C31_C32_B__MPC_OCSC_C31_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C31_C32_B__MPC_OCSC_C32_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C31_C32_B__MPC_OCSC_C31_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C31_C32_B__MPC_OCSC_C32_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_CSC_C33_C34_B
+#define MPC_OUT3_CSC_C33_C34_B__MPC_OCSC_C33_B__SHIFT                                                         0x0
+#define MPC_OUT3_CSC_C33_C34_B__MPC_OCSC_C34_B__SHIFT                                                         0x10
+#define MPC_OUT3_CSC_C33_C34_B__MPC_OCSC_C33_B_MASK                                                           0x0000FFFFL
+#define MPC_OUT3_CSC_C33_C34_B__MPC_OCSC_C34_B_MASK                                                           0xFFFF0000L
+//MPC_OUT3_PIX_SNAP_EN
+#define MPC_OUT3_PIX_SNAP_EN__PIX_SNAP_EN__SHIFT                                                              0x0
+#define MPC_OUT3_PIX_SNAP_EN__PIX_SNAP_EN_MASK                                                                0x00000001L
+//MPC_OUT3_PIX_SNAP
+#define MPC_OUT3_PIX_SNAP__PIX_SNAP_X__SHIFT                                                                  0x0
+#define MPC_OUT3_PIX_SNAP__PIX_SNAP_Y__SHIFT                                                                  0x10
+#define MPC_OUT3_PIX_SNAP__PIX_SNAP_X_MASK                                                                    0x00003FFFL
+#define MPC_OUT3_PIX_SNAP__PIX_SNAP_Y_MASK                                                                    0x3FFF0000L
+//MPC_OUT3_PIX_SNAP_PIX_READ1
+#define MPC_OUT3_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y__SHIFT                                                      0x0
+#define MPC_OUT3_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS__SHIFT                                                0x1f
+#define MPC_OUT3_PIX_SNAP_PIX_READ1__PIX_SNAP_G_Y_MASK                                                        0x00000FFFL
+#define MPC_OUT3_PIX_SNAP_PIX_READ1__PIX_SNAP_EN_STATUS_MASK                                                  0x80000000L
+//MPC_OUT3_PIX_SNAP_PIX_READ2
+#define MPC_OUT3_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR__SHIFT                                                     0x0
+#define MPC_OUT3_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB__SHIFT                                                     0x10
+#define MPC_OUT3_PIX_SNAP_PIX_READ2__PIX_SNAP_R_CR_MASK                                                       0x00000FFFL
+#define MPC_OUT3_PIX_SNAP_PIX_READ2__PIX_SNAP_B_CB_MASK                                                       0x0FFF0000L
+//MPC_OCSC_REG_UPDATE_STATUS
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC0_REG_UPDATE_PENDING_STATUS__SHIFT                                0x0
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC1_REG_UPDATE_PENDING_STATUS__SHIFT                                0x3
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC2_REG_UPDATE_PENDING_STATUS__SHIFT                                0x6
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC3_REG_UPDATE_PENDING_STATUS__SHIFT                                0x9
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC0_REG_UPDATE_PENDING_STATUS_MASK                                  0x00000001L
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC1_REG_UPDATE_PENDING_STATUS_MASK                                  0x00000008L
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC2_REG_UPDATE_PENDING_STATUS_MASK                                  0x00000040L
+#define MPC_OCSC_REG_UPDATE_STATUS__MPC_OCSC3_REG_UPDATE_PENDING_STATUS_MASK                                  0x00000200L
+//MPC_OCSC_TEST_DEBUG_INDEX
+#define MPC_OCSC_TEST_DEBUG_INDEX__MPC_OCSC_TEST_DEBUG_INDEX__SHIFT                                           0x0
+#define MPC_OCSC_TEST_DEBUG_INDEX__MPC_OCSC_TEST_DEBUG_WRITE_EN__SHIFT                                        0x8
+#define MPC_OCSC_TEST_DEBUG_INDEX__MPC_OCSC_TEST_DEBUG_INDEX_MASK                                             0x000000FFL
+#define MPC_OCSC_TEST_DEBUG_INDEX__MPC_OCSC_TEST_DEBUG_WRITE_EN_MASK                                          0x00000100L
+//MPC_OCSC_TEST_DEBUG_DATA
+#define MPC_OCSC_TEST_DEBUG_DATA__MPC_OCSC_TEST_DEBUG_DATA__SHIFT                                             0x0
+#define MPC_OCSC_TEST_DEBUG_DATA__MPC_OCSC_TEST_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_abm0_dispdec
+//ABM0_BL1_PWM_AMBIENT_LIGHT_LEVEL
+#define ABM0_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL__SHIFT                                  0x0
+#define ABM0_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL_MASK                                    0x0001FFFFL
+//ABM0_BL1_PWM_USER_LEVEL
+#define ABM0_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL__SHIFT                                                    0x0
+#define ABM0_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL_MASK                                                      0x0001FFFFL
+//ABM0_BL1_PWM_TARGET_ABM_LEVEL
+#define ABM0_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL__SHIFT                                        0x0
+#define ABM0_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL_MASK                                          0x0001FFFFL
+//ABM0_BL1_PWM_CURRENT_ABM_LEVEL
+#define ABM0_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL__SHIFT                                      0x0
+#define ABM0_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL_MASK                                        0x0001FFFFL
+//ABM0_BL1_PWM_FINAL_DUTY_CYCLE
+#define ABM0_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE__SHIFT                                        0x0
+#define ABM0_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE_MASK                                          0x0001FFFFL
+//ABM0_BL1_PWM_MINIMUM_DUTY_CYCLE
+#define ABM0_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE__SHIFT                                    0x0
+#define ABM0_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE_MASK                                      0x0001FFFFL
+//ABM0_BL1_PWM_ABM_CNTL
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN__SHIFT                                                      0x0
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN__SHIFT                                            0x1
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN__SHIFT                                0x2
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN__SHIFT                                   0x3
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE__SHIFT                               0x10
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN_MASK                                                        0x00000001L
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN_MASK                                              0x00000002L
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN_MASK                                  0x00000004L
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN_MASK                                     0x00000008L
+#define ABM0_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE_MASK                                 0xFFFF0000L
+//ABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE
+#define ABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN__SHIFT                     0x0
+#define ABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT__SHIFT                  0x8
+#define ABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN_MASK                       0x00000001L
+#define ABM0_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT_MASK                    0x0000FF00L
+//ABM0_DC_ABM1_CNTL
+#define ABM0_DC_ABM1_CNTL__ABM1_EN__SHIFT                                                                     0x0
+#define ABM0_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS__SHIFT                                                      0x4
+#define ABM0_DC_ABM1_CNTL__ABM1_EN_MASK                                                                       0x00000001L
+#define ABM0_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS_MASK                                                        0x00000010L
+//ABM0_DC_ABM1_IPCSC_COEFF_SEL
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B__SHIFT                                           0x0
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G__SHIFT                                           0xa
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R__SHIFT                                           0x14
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B_MASK                                             0x000001FFL
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G_MASK                                             0x0007FC00L
+#define ABM0_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R_MASK                                             0x1FF00000L
+//ABM0_DC_ABM1_ACE_PWL_CNTL
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX__SHIFT                                         0x0
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN__SHIFT                                      0x1c
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN__SHIFT                                   0x1d
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING__SHIFT                                    0x1e
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK__SHIFT                                                       0x1f
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX_MASK                                           0x0000003FL
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN_MASK                                        0x10000000L
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN_MASK                                     0x20000000L
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING_MASK                                      0x40000000L
+#define ABM0_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK_MASK                                                         0x80000000L
+//ABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA
+#define ABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA__SHIFT                                        0x0
+#define ABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA__SHIFT                                       0x10
+#define ABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA_MASK                                          0x00000FFFL
+#define ABM0_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA_MASK                                         0x0FFF0000L
+//ABM0_DC_ABM1_ACE_CNTL_MISC
+#define ABM0_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME__SHIFT                                       0x0
+#define ABM0_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR__SHIFT                                 0x8
+#define ABM0_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_MASK                                         0x00000001L
+#define ABM0_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR_MASK                                   0x00000100L
+//ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS__SHIFT                              0x0
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS__SHIFT                              0x1
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS__SHIFT                              0x2
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME__SHIFT                             0x8
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME__SHIFT                             0x9
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME__SHIFT                             0xa
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x10
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x18
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x1f
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS_MASK                                0x00000001L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS_MASK                                0x00000002L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS_MASK                                0x00000004L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_MASK                               0x00000100L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_MASK                               0x00000200L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_MASK                               0x00000400L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x00010000L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x01000000L
+#define ABM0_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x80000000L
+//ABM0_DC_ABM1_HG_MISC_CTRL
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL__SHIFT                                             0x0
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL__SHIFT                                                    0x8
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION__SHIFT                                              0xe
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL__SHIFT                                       0x10
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN__SHIFT                                      0x14
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL_MASK                                               0x00000003L
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL_MASK                                                      0x00000100L
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION_MASK                                                0x00004000L
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL_MASK                                         0x00030000L
+#define ABM0_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN_MASK                                        0x00100000L
+//ABM0_DC_ABM1_LS_SUM_OF_LUMA
+#define ABM0_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA__SHIFT                                               0x0
+#define ABM0_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA_MASK                                                 0xFFFFFFFFL
+//ABM0_DC_ABM1_LS_SUM_OF_LUMA_MSB
+#define ABM0_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB__SHIFT                                       0x0
+#define ABM0_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB_MASK                                         0x000003FFL
+//ABM0_DC_ABM1_LS_MIN_MAX_LUMA
+#define ABM0_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA__SHIFT                                                 0x0
+#define ABM0_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA__SHIFT                                                 0x10
+#define ABM0_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA_MASK                                                   0x00000FFFL
+#define ABM0_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA_MASK                                                   0x0FFF0000L
+//ABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA
+#define ABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA__SHIFT                               0x0
+#define ABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA__SHIFT                               0x10
+#define ABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA_MASK                                 0x00000FFFL
+#define ABM0_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA_MASK                                 0x0FFF0000L
+//ABM0_DC_ABM1_LS_PIXEL_COUNT
+#define ABM0_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT__SHIFT                                               0x0
+#define ABM0_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT_MASK                                                 0x00FFFFFFL
+//ABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES
+#define ABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES__SHIFT                       0x0
+#define ABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES__SHIFT                       0x10
+#define ABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES_MASK                         0x00000FFFL
+#define ABM0_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES_MASK                         0x0FFF0000L
+//ABM0_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT
+#define ABM0_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM0_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM0_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT
+#define ABM0_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM0_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM0_DC_ABM1_HG_SAMPLE_RATE
+#define ABM0_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM0_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM0_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM0_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM0_DC_ABM1_LS_SAMPLE_RATE
+#define ABM0_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM0_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM0_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM0_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM0_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG
+#define ABM0_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG__SHIFT                               0x0
+#define ABM0_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG_MASK                                 0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG
+#define ABM0_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG__SHIFT                             0x0
+#define ABM0_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG_MASK                               0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX__SHIFT                               0x0
+#define ABM0_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX_MASK                                 0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX__SHIFT                             0x0
+#define ABM0_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX_MASK                               0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX
+#define ABM0_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX__SHIFT                           0x0
+#define ABM0_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM0_DC_ABM1_HG_RESULT_INDEX
+#define ABM0_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX__SHIFT                                             0x0
+#define ABM0_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX_MASK                                               0x0000003FL
+//ABM0_DC_ABM1_HG_RESULT_DATA
+#define ABM0_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA__SHIFT                                               0x0
+#define ABM0_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA_MASK                                                 0xFFFFFFFFL
+//ABM0_DC_ABM1_BL_MASTER_LOCK
+#define ABM0_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK__SHIFT                                               0x1f
+#define ABM0_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK_MASK                                                 0x80000000L
+//ABM0_ABM_TEST_DEBUG_INDEX
+#define ABM0_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define ABM0_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define ABM0_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define ABM0_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//ABM0_ABM_TEST_DEBUG_DATA
+#define ABM0_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define ABM0_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_abm1_dispdec
+//ABM1_BL1_PWM_AMBIENT_LIGHT_LEVEL
+#define ABM1_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL__SHIFT                                  0x0
+#define ABM1_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL_MASK                                    0x0001FFFFL
+//ABM1_BL1_PWM_USER_LEVEL
+#define ABM1_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL__SHIFT                                                    0x0
+#define ABM1_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL_MASK                                                      0x0001FFFFL
+//ABM1_BL1_PWM_TARGET_ABM_LEVEL
+#define ABM1_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL__SHIFT                                        0x0
+#define ABM1_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL_MASK                                          0x0001FFFFL
+//ABM1_BL1_PWM_CURRENT_ABM_LEVEL
+#define ABM1_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL__SHIFT                                      0x0
+#define ABM1_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL_MASK                                        0x0001FFFFL
+//ABM1_BL1_PWM_FINAL_DUTY_CYCLE
+#define ABM1_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE__SHIFT                                        0x0
+#define ABM1_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE_MASK                                          0x0001FFFFL
+//ABM1_BL1_PWM_MINIMUM_DUTY_CYCLE
+#define ABM1_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE__SHIFT                                    0x0
+#define ABM1_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE_MASK                                      0x0001FFFFL
+//ABM1_BL1_PWM_ABM_CNTL
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN__SHIFT                                                      0x0
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN__SHIFT                                            0x1
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN__SHIFT                                0x2
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN__SHIFT                                   0x3
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE__SHIFT                               0x10
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN_MASK                                                        0x00000001L
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN_MASK                                              0x00000002L
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN_MASK                                  0x00000004L
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN_MASK                                     0x00000008L
+#define ABM1_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE_MASK                                 0xFFFF0000L
+//ABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE
+#define ABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN__SHIFT                     0x0
+#define ABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT__SHIFT                  0x8
+#define ABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN_MASK                       0x00000001L
+#define ABM1_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT_MASK                    0x0000FF00L
+//ABM1_DC_ABM1_CNTL
+#define ABM1_DC_ABM1_CNTL__ABM1_EN__SHIFT                                                                     0x0
+#define ABM1_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS__SHIFT                                                      0x4
+#define ABM1_DC_ABM1_CNTL__ABM1_EN_MASK                                                                       0x00000001L
+#define ABM1_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS_MASK                                                        0x00000010L
+//ABM1_DC_ABM1_IPCSC_COEFF_SEL
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B__SHIFT                                           0x0
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G__SHIFT                                           0xa
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R__SHIFT                                           0x14
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B_MASK                                             0x000001FFL
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G_MASK                                             0x0007FC00L
+#define ABM1_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R_MASK                                             0x1FF00000L
+//ABM1_DC_ABM1_ACE_PWL_CNTL
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX__SHIFT                                         0x0
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN__SHIFT                                      0x1c
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN__SHIFT                                   0x1d
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING__SHIFT                                    0x1e
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK__SHIFT                                                       0x1f
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX_MASK                                           0x0000003FL
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN_MASK                                        0x10000000L
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN_MASK                                     0x20000000L
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING_MASK                                      0x40000000L
+#define ABM1_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK_MASK                                                         0x80000000L
+//ABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA
+#define ABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA__SHIFT                                        0x0
+#define ABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA__SHIFT                                       0x10
+#define ABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA_MASK                                          0x00000FFFL
+#define ABM1_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA_MASK                                         0x0FFF0000L
+//ABM1_DC_ABM1_ACE_CNTL_MISC
+#define ABM1_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME__SHIFT                                       0x0
+#define ABM1_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR__SHIFT                                 0x8
+#define ABM1_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_MASK                                         0x00000001L
+#define ABM1_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR_MASK                                   0x00000100L
+//ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS__SHIFT                              0x0
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS__SHIFT                              0x1
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS__SHIFT                              0x2
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME__SHIFT                             0x8
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME__SHIFT                             0x9
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME__SHIFT                             0xa
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x10
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x18
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x1f
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS_MASK                                0x00000001L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS_MASK                                0x00000002L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS_MASK                                0x00000004L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_MASK                               0x00000100L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_MASK                               0x00000200L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_MASK                               0x00000400L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x00010000L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x01000000L
+#define ABM1_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x80000000L
+//ABM1_DC_ABM1_HG_MISC_CTRL
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL__SHIFT                                             0x0
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL__SHIFT                                                    0x8
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION__SHIFT                                              0xe
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL__SHIFT                                       0x10
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN__SHIFT                                      0x14
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL_MASK                                               0x00000003L
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL_MASK                                                      0x00000100L
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION_MASK                                                0x00004000L
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL_MASK                                         0x00030000L
+#define ABM1_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN_MASK                                        0x00100000L
+//ABM1_DC_ABM1_LS_SUM_OF_LUMA
+#define ABM1_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA__SHIFT                                               0x0
+#define ABM1_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA_MASK                                                 0xFFFFFFFFL
+//ABM1_DC_ABM1_LS_SUM_OF_LUMA_MSB
+#define ABM1_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB__SHIFT                                       0x0
+#define ABM1_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB_MASK                                         0x000003FFL
+//ABM1_DC_ABM1_LS_MIN_MAX_LUMA
+#define ABM1_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA__SHIFT                                                 0x0
+#define ABM1_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA__SHIFT                                                 0x10
+#define ABM1_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA_MASK                                                   0x00000FFFL
+#define ABM1_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA_MASK                                                   0x0FFF0000L
+//ABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA
+#define ABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA__SHIFT                               0x0
+#define ABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA__SHIFT                               0x10
+#define ABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA_MASK                                 0x00000FFFL
+#define ABM1_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA_MASK                                 0x0FFF0000L
+//ABM1_DC_ABM1_LS_PIXEL_COUNT
+#define ABM1_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT__SHIFT                                               0x0
+#define ABM1_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT_MASK                                                 0x00FFFFFFL
+//ABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES
+#define ABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES__SHIFT                       0x0
+#define ABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES__SHIFT                       0x10
+#define ABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES_MASK                         0x00000FFFL
+#define ABM1_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES_MASK                         0x0FFF0000L
+//ABM1_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT
+#define ABM1_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM1_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM1_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT
+#define ABM1_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM1_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM1_DC_ABM1_HG_SAMPLE_RATE
+#define ABM1_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM1_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM1_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM1_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM1_DC_ABM1_LS_SAMPLE_RATE
+#define ABM1_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM1_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM1_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM1_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM1_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG
+#define ABM1_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG__SHIFT                               0x0
+#define ABM1_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG_MASK                                 0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG
+#define ABM1_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG__SHIFT                             0x0
+#define ABM1_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG_MASK                               0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX__SHIFT                               0x0
+#define ABM1_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX_MASK                                 0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX__SHIFT                             0x0
+#define ABM1_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX_MASK                               0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX
+#define ABM1_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX__SHIFT                           0x0
+#define ABM1_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM1_DC_ABM1_HG_RESULT_INDEX
+#define ABM1_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX__SHIFT                                             0x0
+#define ABM1_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX_MASK                                               0x0000003FL
+//ABM1_DC_ABM1_HG_RESULT_DATA
+#define ABM1_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA__SHIFT                                               0x0
+#define ABM1_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA_MASK                                                 0xFFFFFFFFL
+//ABM1_DC_ABM1_BL_MASTER_LOCK
+#define ABM1_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK__SHIFT                                               0x1f
+#define ABM1_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK_MASK                                                 0x80000000L
+//ABM1_ABM_TEST_DEBUG_INDEX
+#define ABM1_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define ABM1_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define ABM1_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define ABM1_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//ABM1_ABM_TEST_DEBUG_DATA
+#define ABM1_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define ABM1_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_abm2_dispdec
+//ABM2_BL1_PWM_AMBIENT_LIGHT_LEVEL
+#define ABM2_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL__SHIFT                                  0x0
+#define ABM2_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL_MASK                                    0x0001FFFFL
+//ABM2_BL1_PWM_USER_LEVEL
+#define ABM2_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL__SHIFT                                                    0x0
+#define ABM2_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL_MASK                                                      0x0001FFFFL
+//ABM2_BL1_PWM_TARGET_ABM_LEVEL
+#define ABM2_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL__SHIFT                                        0x0
+#define ABM2_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL_MASK                                          0x0001FFFFL
+//ABM2_BL1_PWM_CURRENT_ABM_LEVEL
+#define ABM2_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL__SHIFT                                      0x0
+#define ABM2_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL_MASK                                        0x0001FFFFL
+//ABM2_BL1_PWM_FINAL_DUTY_CYCLE
+#define ABM2_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE__SHIFT                                        0x0
+#define ABM2_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE_MASK                                          0x0001FFFFL
+//ABM2_BL1_PWM_MINIMUM_DUTY_CYCLE
+#define ABM2_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE__SHIFT                                    0x0
+#define ABM2_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE_MASK                                      0x0001FFFFL
+//ABM2_BL1_PWM_ABM_CNTL
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN__SHIFT                                                      0x0
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN__SHIFT                                            0x1
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN__SHIFT                                0x2
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN__SHIFT                                   0x3
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE__SHIFT                               0x10
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN_MASK                                                        0x00000001L
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN_MASK                                              0x00000002L
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN_MASK                                  0x00000004L
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN_MASK                                     0x00000008L
+#define ABM2_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE_MASK                                 0xFFFF0000L
+//ABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE
+#define ABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN__SHIFT                     0x0
+#define ABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT__SHIFT                  0x8
+#define ABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN_MASK                       0x00000001L
+#define ABM2_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT_MASK                    0x0000FF00L
+//ABM2_DC_ABM1_CNTL
+#define ABM2_DC_ABM1_CNTL__ABM1_EN__SHIFT                                                                     0x0
+#define ABM2_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS__SHIFT                                                      0x4
+#define ABM2_DC_ABM1_CNTL__ABM1_EN_MASK                                                                       0x00000001L
+#define ABM2_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS_MASK                                                        0x00000010L
+//ABM2_DC_ABM1_IPCSC_COEFF_SEL
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B__SHIFT                                           0x0
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G__SHIFT                                           0xa
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R__SHIFT                                           0x14
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B_MASK                                             0x000001FFL
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G_MASK                                             0x0007FC00L
+#define ABM2_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R_MASK                                             0x1FF00000L
+//ABM2_DC_ABM1_ACE_PWL_CNTL
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX__SHIFT                                         0x0
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN__SHIFT                                      0x1c
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN__SHIFT                                   0x1d
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING__SHIFT                                    0x1e
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK__SHIFT                                                       0x1f
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX_MASK                                           0x0000003FL
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN_MASK                                        0x10000000L
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN_MASK                                     0x20000000L
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING_MASK                                      0x40000000L
+#define ABM2_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK_MASK                                                         0x80000000L
+//ABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA
+#define ABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA__SHIFT                                        0x0
+#define ABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA__SHIFT                                       0x10
+#define ABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA_MASK                                          0x00000FFFL
+#define ABM2_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA_MASK                                         0x0FFF0000L
+//ABM2_DC_ABM1_ACE_CNTL_MISC
+#define ABM2_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME__SHIFT                                       0x0
+#define ABM2_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR__SHIFT                                 0x8
+#define ABM2_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_MASK                                         0x00000001L
+#define ABM2_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR_MASK                                   0x00000100L
+//ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS__SHIFT                              0x0
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS__SHIFT                              0x1
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS__SHIFT                              0x2
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME__SHIFT                             0x8
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME__SHIFT                             0x9
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME__SHIFT                             0xa
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x10
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x18
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x1f
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS_MASK                                0x00000001L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS_MASK                                0x00000002L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS_MASK                                0x00000004L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_MASK                               0x00000100L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_MASK                               0x00000200L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_MASK                               0x00000400L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x00010000L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x01000000L
+#define ABM2_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x80000000L
+//ABM2_DC_ABM1_HG_MISC_CTRL
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL__SHIFT                                             0x0
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL__SHIFT                                                    0x8
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION__SHIFT                                              0xe
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL__SHIFT                                       0x10
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN__SHIFT                                      0x14
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL_MASK                                               0x00000003L
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL_MASK                                                      0x00000100L
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION_MASK                                                0x00004000L
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL_MASK                                         0x00030000L
+#define ABM2_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN_MASK                                        0x00100000L
+//ABM2_DC_ABM1_LS_SUM_OF_LUMA
+#define ABM2_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA__SHIFT                                               0x0
+#define ABM2_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA_MASK                                                 0xFFFFFFFFL
+//ABM2_DC_ABM1_LS_SUM_OF_LUMA_MSB
+#define ABM2_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB__SHIFT                                       0x0
+#define ABM2_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB_MASK                                         0x000003FFL
+//ABM2_DC_ABM1_LS_MIN_MAX_LUMA
+#define ABM2_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA__SHIFT                                                 0x0
+#define ABM2_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA__SHIFT                                                 0x10
+#define ABM2_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA_MASK                                                   0x00000FFFL
+#define ABM2_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA_MASK                                                   0x0FFF0000L
+//ABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA
+#define ABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA__SHIFT                               0x0
+#define ABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA__SHIFT                               0x10
+#define ABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA_MASK                                 0x00000FFFL
+#define ABM2_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA_MASK                                 0x0FFF0000L
+//ABM2_DC_ABM1_LS_PIXEL_COUNT
+#define ABM2_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT__SHIFT                                               0x0
+#define ABM2_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT_MASK                                                 0x00FFFFFFL
+//ABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES
+#define ABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES__SHIFT                       0x0
+#define ABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES__SHIFT                       0x10
+#define ABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES_MASK                         0x00000FFFL
+#define ABM2_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES_MASK                         0x0FFF0000L
+//ABM2_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT
+#define ABM2_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM2_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM2_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT
+#define ABM2_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM2_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM2_DC_ABM1_HG_SAMPLE_RATE
+#define ABM2_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM2_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM2_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM2_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM2_DC_ABM1_LS_SAMPLE_RATE
+#define ABM2_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM2_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM2_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM2_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM2_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG
+#define ABM2_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG__SHIFT                               0x0
+#define ABM2_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG_MASK                                 0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG
+#define ABM2_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG__SHIFT                             0x0
+#define ABM2_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG_MASK                               0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX__SHIFT                               0x0
+#define ABM2_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX_MASK                                 0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX__SHIFT                             0x0
+#define ABM2_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX_MASK                               0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX
+#define ABM2_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX__SHIFT                           0x0
+#define ABM2_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM2_DC_ABM1_HG_RESULT_INDEX
+#define ABM2_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX__SHIFT                                             0x0
+#define ABM2_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX_MASK                                               0x0000003FL
+//ABM2_DC_ABM1_HG_RESULT_DATA
+#define ABM2_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA__SHIFT                                               0x0
+#define ABM2_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA_MASK                                                 0xFFFFFFFFL
+//ABM2_DC_ABM1_BL_MASTER_LOCK
+#define ABM2_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK__SHIFT                                               0x1f
+#define ABM2_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK_MASK                                                 0x80000000L
+//ABM2_ABM_TEST_DEBUG_INDEX
+#define ABM2_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define ABM2_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define ABM2_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define ABM2_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//ABM2_ABM_TEST_DEBUG_DATA
+#define ABM2_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define ABM2_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_abm3_dispdec
+//ABM3_BL1_PWM_AMBIENT_LIGHT_LEVEL
+#define ABM3_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL__SHIFT                                  0x0
+#define ABM3_BL1_PWM_AMBIENT_LIGHT_LEVEL__BL1_PWM_AMBIENT_LIGHT_LEVEL_MASK                                    0x0001FFFFL
+//ABM3_BL1_PWM_USER_LEVEL
+#define ABM3_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL__SHIFT                                                    0x0
+#define ABM3_BL1_PWM_USER_LEVEL__BL1_PWM_USER_LEVEL_MASK                                                      0x0001FFFFL
+//ABM3_BL1_PWM_TARGET_ABM_LEVEL
+#define ABM3_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL__SHIFT                                        0x0
+#define ABM3_BL1_PWM_TARGET_ABM_LEVEL__BL1_PWM_TARGET_ABM_LEVEL_MASK                                          0x0001FFFFL
+//ABM3_BL1_PWM_CURRENT_ABM_LEVEL
+#define ABM3_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL__SHIFT                                      0x0
+#define ABM3_BL1_PWM_CURRENT_ABM_LEVEL__BL1_PWM_CURRENT_ABM_LEVEL_MASK                                        0x0001FFFFL
+//ABM3_BL1_PWM_FINAL_DUTY_CYCLE
+#define ABM3_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE__SHIFT                                        0x0
+#define ABM3_BL1_PWM_FINAL_DUTY_CYCLE__BL1_PWM_FINAL_DUTY_CYCLE_MASK                                          0x0001FFFFL
+//ABM3_BL1_PWM_MINIMUM_DUTY_CYCLE
+#define ABM3_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE__SHIFT                                    0x0
+#define ABM3_BL1_PWM_MINIMUM_DUTY_CYCLE__BL1_PWM_MINIMUM_DUTY_CYCLE_MASK                                      0x0001FFFFL
+//ABM3_BL1_PWM_ABM_CNTL
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN__SHIFT                                                      0x0
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN__SHIFT                                            0x1
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN__SHIFT                                0x2
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN__SHIFT                                   0x3
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE__SHIFT                               0x10
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_USE_ABM_EN_MASK                                                        0x00000001L
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_USE_AMBIENT_LEVEL_EN_MASK                                              0x00000002L
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_LEVEL_EN_MASK                                  0x00000004L
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_CALC_FINAL_DUTY_CYCLE_EN_MASK                                     0x00000008L
+#define ABM3_BL1_PWM_ABM_CNTL__BL1_PWM_AUTO_UPDATE_CURRENT_ABM_STEP_SIZE_MASK                                 0xFFFF0000L
+//ABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE
+#define ABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN__SHIFT                     0x0
+#define ABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT__SHIFT                  0x8
+#define ABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_COUNT_EN_MASK                       0x00000001L
+#define ABM3_BL1_PWM_BL_UPDATE_SAMPLE_RATE__BL1_PWM_BL_UPDATE_SAMPLE_RATE_FRAME_COUNT_MASK                    0x0000FF00L
+//ABM3_DC_ABM1_CNTL
+#define ABM3_DC_ABM1_CNTL__ABM1_EN__SHIFT                                                                     0x0
+#define ABM3_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS__SHIFT                                                      0x4
+#define ABM3_DC_ABM1_CNTL__ABM1_EN_MASK                                                                       0x00000001L
+#define ABM3_DC_ABM1_CNTL__ABM1_PROCESSING_BYPASS_MASK                                                        0x00000010L
+//ABM3_DC_ABM1_IPCSC_COEFF_SEL
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B__SHIFT                                           0x0
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G__SHIFT                                           0xa
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R__SHIFT                                           0x14
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_B_MASK                                             0x000001FFL
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_G_MASK                                             0x0007FC00L
+#define ABM3_DC_ABM1_IPCSC_COEFF_SEL__ABM1_IPCSC_COEFF_SEL_R_MASK                                             0x1FF00000L
+//ABM3_DC_ABM1_ACE_PWL_CNTL
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX__SHIFT                                         0x0
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN__SHIFT                                      0x1c
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN__SHIFT                                   0x1d
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING__SHIFT                                    0x1e
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK__SHIFT                                                       0x1f
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_OFFSET_SLOPE_INDEX_MASK                                           0x0000003FL
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_IGNORE_MASTER_LOCK_EN_MASK                                        0x10000000L
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_READBACK_DB_REG_VALUE_EN_MASK                                     0x20000000L
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_DBUF_REG_UPDATE_PENDING_MASK                                      0x40000000L
+#define ABM3_DC_ABM1_ACE_PWL_CNTL__ABM1_ACE_LOCK_MASK                                                         0x80000000L
+//ABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA
+#define ABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA__SHIFT                                        0x0
+#define ABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA__SHIFT                                       0x10
+#define ABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_SLOPE_DATA_MASK                                          0x00000FFFL
+#define ABM3_DC_ABM1_ACE_OFFSET_SLOPE_DATA__ABM1_ACE_OFFSET_DATA_MASK                                         0x0FFF0000L
+//ABM3_DC_ABM1_ACE_CNTL_MISC
+#define ABM3_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME__SHIFT                                       0x0
+#define ABM3_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR__SHIFT                                 0x8
+#define ABM3_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_MASK                                         0x00000001L
+#define ABM3_DC_ABM1_ACE_CNTL_MISC__ABM1_ACE_REG_WR_MISSED_FRAME_CLEAR_MASK                                   0x00000100L
+//ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS__SHIFT                              0x0
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS__SHIFT                              0x1
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS__SHIFT                              0x2
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME__SHIFT                             0x8
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME__SHIFT                             0x9
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME__SHIFT                             0xa
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x10
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x18
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR__SHIFT                       0x1f
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_IN_PROGRESS_MASK                                0x00000001L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_IN_PROGRESS_MASK                                0x00000002L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_IN_PROGRESS_MASK                                0x00000004L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_MASK                               0x00000100L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_MASK                               0x00000200L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_MASK                               0x00000400L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_HG_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x00010000L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_LS_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x01000000L
+#define ABM3_DC_ABM1_HGLS_REG_READ_PROGRESS__ABM1_BL_REG_READ_MISSED_FRAME_CLEAR_MASK                         0x80000000L
+//ABM3_DC_ABM1_HG_MISC_CTRL
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL__SHIFT                                             0x0
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL__SHIFT                                                    0x8
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION__SHIFT                                              0xe
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL__SHIFT                                       0x10
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN__SHIFT                                      0x14
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_NUM_OF_BINS_SEL_MASK                                               0x00000003L
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_VMAX_SEL_MASK                                                      0x00000100L
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_LATCH_POSITION_MASK                                                0x00004000L
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_HG_BIN_BITWIDTH_SIZE_SEL_MASK                                         0x00030000L
+#define ABM3_DC_ABM1_HG_MISC_CTRL__ABM1_OVR_SCAN_PIXEL_PROCESS_EN_MASK                                        0x00100000L
+//ABM3_DC_ABM1_LS_SUM_OF_LUMA
+#define ABM3_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA__SHIFT                                               0x0
+#define ABM3_DC_ABM1_LS_SUM_OF_LUMA__ABM1_LS_SUM_OF_LUMA_MASK                                                 0xFFFFFFFFL
+//ABM3_DC_ABM1_LS_SUM_OF_LUMA_MSB
+#define ABM3_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB__SHIFT                                       0x0
+#define ABM3_DC_ABM1_LS_SUM_OF_LUMA_MSB__ABM1_LS_SUM_OF_LUMA_MSB_MASK                                         0x000003FFL
+//ABM3_DC_ABM1_LS_MIN_MAX_LUMA
+#define ABM3_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA__SHIFT                                                 0x0
+#define ABM3_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA__SHIFT                                                 0x10
+#define ABM3_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MIN_LUMA_MASK                                                   0x00000FFFL
+#define ABM3_DC_ABM1_LS_MIN_MAX_LUMA__ABM1_LS_MAX_LUMA_MASK                                                   0x0FFF0000L
+//ABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA
+#define ABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA__SHIFT                               0x0
+#define ABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA__SHIFT                               0x10
+#define ABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MIN_LUMA_MASK                                 0x00000FFFL
+#define ABM3_DC_ABM1_LS_FILTERED_MIN_MAX_LUMA__ABM1_LS_FILTERED_MAX_LUMA_MASK                                 0x0FFF0000L
+//ABM3_DC_ABM1_LS_PIXEL_COUNT
+#define ABM3_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT__SHIFT                                               0x0
+#define ABM3_DC_ABM1_LS_PIXEL_COUNT__ABM1_LS_PIXEL_COUNT_MASK                                                 0x00FFFFFFL
+//ABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES
+#define ABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES__SHIFT                       0x0
+#define ABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES__SHIFT                       0x10
+#define ABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MIN_PIXEL_VALUE_THRES_MASK                         0x00000FFFL
+#define ABM3_DC_ABM1_LS_MIN_MAX_PIXEL_VALUE_THRES__ABM1_LS_MAX_PIXEL_VALUE_THRES_MASK                         0x0FFF0000L
+//ABM3_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT
+#define ABM3_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM3_DC_ABM1_LS_MIN_PIXEL_VALUE_COUNT__ABM1_LS_MIN_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM3_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT
+#define ABM3_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT__SHIFT                           0x0
+#define ABM3_DC_ABM1_LS_MAX_PIXEL_VALUE_COUNT__ABM1_LS_MAX_PIXEL_VALUE_COUNT_MASK                             0x00FFFFFFL
+//ABM3_DC_ABM1_HG_SAMPLE_RATE
+#define ABM3_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM3_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM3_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM3_DC_ABM1_HG_SAMPLE_RATE__ABM1_HG_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM3_DC_ABM1_LS_SAMPLE_RATE
+#define ABM3_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN__SHIFT                                      0x0
+#define ABM3_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT__SHIFT                                   0x8
+#define ABM3_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_COUNT_EN_MASK                                        0x00000001L
+#define ABM3_DC_ABM1_LS_SAMPLE_RATE__ABM1_LS_SAMPLE_RATE_FRAME_COUNT_MASK                                     0x0000FF00L
+//ABM3_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG
+#define ABM3_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG__SHIFT                               0x0
+#define ABM3_DC_ABM1_HG_BIN_1_32_SHIFT_FLAG__ABM1_HG_BIN_1_32_SHIFT_FLAG_MASK                                 0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG
+#define ABM3_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG__SHIFT                             0x0
+#define ABM3_DC_ABM1_HG_BIN_33_64_SHIFT_FLAG__ABM1_HG_BIN_33_64_SHIFT_FLAG_MASK                               0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX__SHIFT                               0x0
+#define ABM3_DC_ABM1_HG_BIN_1_8_SHIFT_INDEX__ABM1_HG_BIN_1_8_SHIFT_INDEX_MASK                                 0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX__SHIFT                             0x0
+#define ABM3_DC_ABM1_HG_BIN_9_16_SHIFT_INDEX__ABM1_HG_BIN_9_16_SHIFT_INDEX_MASK                               0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_17_24_SHIFT_INDEX__ABM1_HG_BIN_17_24_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_25_32_SHIFT_INDEX__ABM1_HG_BIN_25_32_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_33_40_SHIFT_INDEX__ABM1_HG_BIN_33_40_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_41_48_SHIFT_INDEX__ABM1_HG_BIN_41_48_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_49_56_SHIFT_INDEX__ABM1_HG_BIN_49_56_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX
+#define ABM3_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX__SHIFT                           0x0
+#define ABM3_DC_ABM1_HG_BIN_57_64_SHIFT_INDEX__ABM1_HG_BIN_57_64_SHIFT_INDEX_MASK                             0xFFFFFFFFL
+//ABM3_DC_ABM1_HG_RESULT_INDEX
+#define ABM3_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX__SHIFT                                             0x0
+#define ABM3_DC_ABM1_HG_RESULT_INDEX__ABM1_HG_RESULT_INDEX_MASK                                               0x0000003FL
+//ABM3_DC_ABM1_HG_RESULT_DATA
+#define ABM3_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA__SHIFT                                               0x0
+#define ABM3_DC_ABM1_HG_RESULT_DATA__ABM1_HG_RESULT_DATA_MASK                                                 0xFFFFFFFFL
+//ABM3_DC_ABM1_BL_MASTER_LOCK
+#define ABM3_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK__SHIFT                                               0x1f
+#define ABM3_DC_ABM1_BL_MASTER_LOCK__ABM1_BL_MASTER_LOCK_MASK                                                 0x80000000L
+//ABM3_ABM_TEST_DEBUG_INDEX
+#define ABM3_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define ABM3_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define ABM3_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define ABM3_ABM_TEST_DEBUG_INDEX__ABM_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//ABM3_ABM_TEST_DEBUG_DATA
+#define ABM3_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define ABM3_ABM_TEST_DEBUG_DATA__ABM_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_dpg0_dispdec
+//DPG0_DPG_CONTROL
+#define DPG0_DPG_CONTROL__DPG_EN__SHIFT                                                                       0x0
+#define DPG0_DPG_CONTROL__DPG_MODE__SHIFT                                                                     0x4
+#define DPG0_DPG_CONTROL__DPG_DYNAMIC_RANGE__SHIFT                                                            0x8
+#define DPG0_DPG_CONTROL__DPG_BIT_DEPTH__SHIFT                                                                0xc
+#define DPG0_DPG_CONTROL__DPG_VRES__SHIFT                                                                     0x10
+#define DPG0_DPG_CONTROL__DPG_HRES__SHIFT                                                                     0x14
+#define DPG0_DPG_CONTROL__DPG_EN_MASK                                                                         0x00000001L
+#define DPG0_DPG_CONTROL__DPG_MODE_MASK                                                                       0x00000070L
+#define DPG0_DPG_CONTROL__DPG_DYNAMIC_RANGE_MASK                                                              0x00000100L
+#define DPG0_DPG_CONTROL__DPG_BIT_DEPTH_MASK                                                                  0x00003000L
+#define DPG0_DPG_CONTROL__DPG_VRES_MASK                                                                       0x000F0000L
+#define DPG0_DPG_CONTROL__DPG_HRES_MASK                                                                       0x00F00000L
+//DPG0_DPG_RAMP_CONTROL
+#define DPG0_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET__SHIFT                                                        0x0
+#define DPG0_DPG_RAMP_CONTROL__DPG_INC0__SHIFT                                                                0x18
+#define DPG0_DPG_RAMP_CONTROL__DPG_INC1__SHIFT                                                                0x1c
+#define DPG0_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET_MASK                                                          0x0000FFFFL
+#define DPG0_DPG_RAMP_CONTROL__DPG_INC0_MASK                                                                  0x0F000000L
+#define DPG0_DPG_RAMP_CONTROL__DPG_INC1_MASK                                                                  0xF0000000L
+//DPG0_DPG_DIMENSIONS
+#define DPG0_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT__SHIFT                                                         0x0
+#define DPG0_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH__SHIFT                                                          0x10
+#define DPG0_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT_MASK                                                           0x00003FFFL
+#define DPG0_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH_MASK                                                            0x3FFF0000L
+//DPG0_DPG_COLOUR_R_CR
+#define DPG0_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR__SHIFT                                                         0x0
+#define DPG0_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR__SHIFT                                                         0x10
+#define DPG0_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR_MASK                                                           0x0000FFFFL
+#define DPG0_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR_MASK                                                           0xFFFF0000L
+//DPG0_DPG_COLOUR_G_Y
+#define DPG0_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y__SHIFT                                                           0x0
+#define DPG0_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y__SHIFT                                                           0x10
+#define DPG0_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y_MASK                                                             0x0000FFFFL
+#define DPG0_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y_MASK                                                             0xFFFF0000L
+//DPG0_DPG_COLOUR_B_CB
+#define DPG0_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB__SHIFT                                                         0x0
+#define DPG0_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB__SHIFT                                                         0x10
+#define DPG0_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB_MASK                                                           0x0000FFFFL
+#define DPG0_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB_MASK                                                           0xFFFF0000L
+//DPG0_DPG_OFFSET_SEGMENT
+#define DPG0_DPG_OFFSET_SEGMENT__DPG_X_OFFSET__SHIFT                                                          0x0
+#define DPG0_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH__SHIFT                                                     0x10
+#define DPG0_DPG_OFFSET_SEGMENT__DPG_X_OFFSET_MASK                                                            0x00003FFFL
+#define DPG0_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH_MASK                                                       0x3FFF0000L
+//DPG0_DPG_STATUS
+#define DPG0_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING__SHIFT                                                     0x0
+#define DPG0_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING_MASK                                                       0x00000001L
+//DPG0_DPG_TEST_DEBUG_INDEX
+#define DPG0_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define DPG0_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+//DPG0_DPG_TEST_DEBUG_DATA
+#define DPG0_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define DPG0_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_fmt0_dispdec
+//FMT0_FMT_CLAMP_COMPONENT_R
+#define FMT0_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R__SHIFT                                                  0x0
+#define FMT0_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R__SHIFT                                                  0x10
+#define FMT0_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R_MASK                                                    0x0000FFFFL
+#define FMT0_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R_MASK                                                    0xFFFF0000L
+//FMT0_FMT_CLAMP_COMPONENT_G
+#define FMT0_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G__SHIFT                                                  0x0
+#define FMT0_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G__SHIFT                                                  0x10
+#define FMT0_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G_MASK                                                    0x0000FFFFL
+#define FMT0_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G_MASK                                                    0xFFFF0000L
+//FMT0_FMT_CLAMP_COMPONENT_B
+#define FMT0_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B__SHIFT                                                  0x0
+#define FMT0_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B__SHIFT                                                  0x10
+#define FMT0_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B_MASK                                                    0x0000FFFFL
+#define FMT0_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B_MASK                                                    0xFFFF0000L
+//FMT0_FMT_DYNAMIC_EXP_CNTL
+#define FMT0_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN__SHIFT                                                  0x0
+#define FMT0_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE__SHIFT                                                0x4
+#define FMT0_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN_MASK                                                    0x00000001L
+#define FMT0_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE_MASK                                                  0x00000010L
+//FMT0_FMT_CONTROL
+#define FMT0_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE__SHIFT                                                      0x0
+#define FMT0_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX__SHIFT                                         0x8
+#define FMT0_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP__SHIFT                                    0xc
+#define FMT0_FMT_CONTROL__FMT_PIXEL_ENCODING__SHIFT                                                           0x10
+#define FMT0_FMT_CONTROL__FMT_SUBSAMPLING_MODE__SHIFT                                                         0x12
+#define FMT0_FMT_CONTROL__FMT_SUBSAMPLING_ORDER__SHIFT                                                        0x14
+#define FMT0_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS__SHIFT                                                0x15
+#define FMT0_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                         0x18
+#define FMT0_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE_MASK                                                        0x00000001L
+#define FMT0_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX_MASK                                           0x00000F00L
+#define FMT0_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP_MASK                                      0x00003000L
+#define FMT0_FMT_CONTROL__FMT_PIXEL_ENCODING_MASK                                                             0x00030000L
+#define FMT0_FMT_CONTROL__FMT_SUBSAMPLING_MODE_MASK                                                           0x000C0000L
+#define FMT0_FMT_CONTROL__FMT_SUBSAMPLING_ORDER_MASK                                                          0x00100000L
+#define FMT0_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS_MASK                                                  0x00200000L
+#define FMT0_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                           0x01000000L
+//FMT0_FMT_BIT_DEPTH_CONTROL
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN__SHIFT                                                    0x0
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE__SHIFT                                                  0x1
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH__SHIFT                                                 0x4
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN__SHIFT                                              0x8
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE__SHIFT                                            0x9
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH__SHIFT                                           0xb
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE__SHIFT                                            0xd
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE__SHIFT                                              0xe
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE__SHIFT                                         0xf
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN__SHIFT                                             0x10
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH__SHIFT                                          0x11
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET__SHIFT                                         0x15
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL__SHIFT                                                 0x18
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET__SHIFT                                          0x19
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL__SHIFT                                                      0x1a
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL__SHIFT                                                      0x1c
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL__SHIFT                                                      0x1e
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK                                                      0x00000001L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE_MASK                                                    0x00000002L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH_MASK                                                   0x00000030L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK                                                0x00000100L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE_MASK                                              0x00000600L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH_MASK                                             0x00001800L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK                                              0x00002000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE_MASK                                                0x00004000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_MASK                                           0x00008000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN_MASK                                               0x00010000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH_MASK                                            0x00060000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET_MASK                                           0x00600000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL_MASK                                                   0x01000000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET_MASK                                            0x02000000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL_MASK                                                        0x0C000000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL_MASK                                                        0x30000000L
+#define FMT0_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL_MASK                                                        0xC0000000L
+//FMT0_FMT_DITHER_RAND_R_SEED
+#define FMT0_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED__SHIFT                                                   0x0
+#define FMT0_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR__SHIFT                                                   0x10
+#define FMT0_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED_MASK                                                     0x000000FFL
+#define FMT0_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR_MASK                                                     0xFFFF0000L
+//FMT0_FMT_DITHER_RAND_G_SEED
+#define FMT0_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED__SHIFT                                                   0x0
+#define FMT0_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y__SHIFT                                                    0x10
+#define FMT0_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED_MASK                                                     0x000000FFL
+#define FMT0_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y_MASK                                                      0xFFFF0000L
+//FMT0_FMT_DITHER_RAND_B_SEED
+#define FMT0_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED__SHIFT                                                   0x0
+#define FMT0_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB__SHIFT                                                   0x10
+#define FMT0_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED_MASK                                                     0x000000FFL
+#define FMT0_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB_MASK                                                     0xFFFF0000L
+//FMT0_FMT_CLAMP_CNTL
+#define FMT0_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN__SHIFT                                                         0x0
+#define FMT0_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT__SHIFT                                                    0x10
+#define FMT0_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN_MASK                                                           0x00000001L
+#define FMT0_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT_MASK                                                      0x00070000L
+//FMT0_FMT_SIDE_BY_SIDE_STEREO_CONTROL
+#define FMT0_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH__SHIFT                     0x0
+#define FMT0_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH_MASK                       0x00001FFFL
+//FMT0_FMT_MAP420_MEMORY_CONTROL
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE__SHIFT                                        0x0
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS__SHIFT                                          0x4
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE__SHIFT                                        0x8
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE_MASK                                          0x00000003L
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS_MASK                                            0x00000010L
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE_MASK                                          0x00000300L
+#define FMT0_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//FMT0_FMT_DEBUG_CNTL
+#define FMT0_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT__SHIFT                                                    0x0
+#define FMT0_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT_MASK                                                      0x00000003L
+//FMT0_FMT_422_CONTROL
+#define FMT0_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT__SHIFT                                          0x0
+#define FMT0_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT_MASK                                            0x00000001L
+//FMT0_FMT_TEST_DEBUG_INDEX
+#define FMT0_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define FMT0_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define FMT0_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define FMT0_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//FMT0_FMT_TEST_DEBUG_DATA
+#define FMT0_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define FMT0_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_oppbuf0_dispdec
+//OPPBUF0_OPPBUF_CONTROL
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH__SHIFT                                                    0x0
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION__SHIFT                                            0x10
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM__SHIFT                                               0x14
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION__SHIFT                                                0x18
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING__SHIFT                                           0x1c
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH_MASK                                                      0x00003FFFL
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION_MASK                                              0x00070000L
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM_MASK                                                 0x00F00000L
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION_MASK                                                  0x0F000000L
+#define OPPBUF0_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING_MASK                                             0x10000000L
+//OPPBUF0_OPPBUF_3D_PARAMETERS_0
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE__SHIFT                                     0x0
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R__SHIFT                                            0x14
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE_MASK                                       0x000003FFL
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R_MASK                                              0xFFF00000L
+//OPPBUF0_OPPBUF_3D_PARAMETERS_1
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G__SHIFT                                            0x0
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B__SHIFT                                            0x10
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G_MASK                                              0x00000FFFL
+#define OPPBUF0_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B_MASK                                              0x0FFF0000L
+//OPPBUF0_OPPBUF_TEST_DEBUG_INDEX
+#define OPPBUF0_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX__SHIFT                                       0x0
+#define OPPBUF0_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX_MASK                                         0x000000FFL
+//OPPBUF0_OPPBUF_TEST_DEBUG_DATA
+#define OPPBUF0_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA__SHIFT                                         0x0
+#define OPPBUF0_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA_MASK                                           0xFFFFFFFFL
+//OPPBUF0_OPPBUF_CONTROL1
+#define OPPBUF0_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS__SHIFT                                      0x0
+#define OPPBUF0_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS_MASK                                        0x00000007L
+
+
+// addressBlock: dce_dc_opp_opp_pipe0_dispdec
+//OPP_PIPE0_OPP_PIPE_CONTROL
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN__SHIFT                                                  0x0
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON__SHIFT                                                  0x1
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN__SHIFT                                         0x4
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN_MASK                                                    0x00000001L
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON_MASK                                                    0x00000002L
+#define OPP_PIPE0_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN_MASK                                           0x00000010L
+//OPP_PIPE0_OPP_PIPE_SPARE_DEBUG
+#define OPP_PIPE0_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG__SHIFT                                           0x0
+#define OPP_PIPE0_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG_MASK                                             0xFFFFFFFFL
+//OPP_PIPE0_OPP_PIPE_TEST_DEBUG_INDEX
+#define OPP_PIPE0_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define OPP_PIPE0_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+//OPP_PIPE0_OPP_PIPE_TEST_DEBUG_DATA
+#define OPP_PIPE0_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define OPP_PIPE0_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc0_dispdec
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN__SHIFT                                            0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN__SHIFT                                       0x4
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE__SHIFT                                   0x8
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN__SHIFT                                     0xa
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN__SHIFT                                  0xe
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT__SHIFT                                  0x14
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT__SHIFT                                 0x18
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING__SHIFT                              0x1c
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN_MASK                                              0x00000001L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN_MASK                                         0x00000010L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE_MASK                                     0x00000300L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN_MASK                                       0x00000400L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN_MASK                                    0x00004000L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT_MASK                                    0x00300000L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT_MASK                                   0x01000000L
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING_MASK                                0x10000000L
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_MASK
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK__SHIFT                                             0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK_MASK                                               0x0000FFFFL
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTA
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A__SHIFT                                      0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTR
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R__SHIFT                                      0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTG
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G__SHIFT                                      0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTB
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B__SHIFT                                      0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTC
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C__SHIFT                                      0x0
+#define OPP_PIPE_CRC0_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C_MASK                                        0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_dpg1_dispdec
+//DPG1_DPG_CONTROL
+#define DPG1_DPG_CONTROL__DPG_EN__SHIFT                                                                       0x0
+#define DPG1_DPG_CONTROL__DPG_MODE__SHIFT                                                                     0x4
+#define DPG1_DPG_CONTROL__DPG_DYNAMIC_RANGE__SHIFT                                                            0x8
+#define DPG1_DPG_CONTROL__DPG_BIT_DEPTH__SHIFT                                                                0xc
+#define DPG1_DPG_CONTROL__DPG_VRES__SHIFT                                                                     0x10
+#define DPG1_DPG_CONTROL__DPG_HRES__SHIFT                                                                     0x14
+#define DPG1_DPG_CONTROL__DPG_EN_MASK                                                                         0x00000001L
+#define DPG1_DPG_CONTROL__DPG_MODE_MASK                                                                       0x00000070L
+#define DPG1_DPG_CONTROL__DPG_DYNAMIC_RANGE_MASK                                                              0x00000100L
+#define DPG1_DPG_CONTROL__DPG_BIT_DEPTH_MASK                                                                  0x00003000L
+#define DPG1_DPG_CONTROL__DPG_VRES_MASK                                                                       0x000F0000L
+#define DPG1_DPG_CONTROL__DPG_HRES_MASK                                                                       0x00F00000L
+//DPG1_DPG_RAMP_CONTROL
+#define DPG1_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET__SHIFT                                                        0x0
+#define DPG1_DPG_RAMP_CONTROL__DPG_INC0__SHIFT                                                                0x18
+#define DPG1_DPG_RAMP_CONTROL__DPG_INC1__SHIFT                                                                0x1c
+#define DPG1_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET_MASK                                                          0x0000FFFFL
+#define DPG1_DPG_RAMP_CONTROL__DPG_INC0_MASK                                                                  0x0F000000L
+#define DPG1_DPG_RAMP_CONTROL__DPG_INC1_MASK                                                                  0xF0000000L
+//DPG1_DPG_DIMENSIONS
+#define DPG1_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT__SHIFT                                                         0x0
+#define DPG1_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH__SHIFT                                                          0x10
+#define DPG1_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT_MASK                                                           0x00003FFFL
+#define DPG1_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH_MASK                                                            0x3FFF0000L
+//DPG1_DPG_COLOUR_R_CR
+#define DPG1_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR__SHIFT                                                         0x0
+#define DPG1_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR__SHIFT                                                         0x10
+#define DPG1_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR_MASK                                                           0x0000FFFFL
+#define DPG1_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR_MASK                                                           0xFFFF0000L
+//DPG1_DPG_COLOUR_G_Y
+#define DPG1_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y__SHIFT                                                           0x0
+#define DPG1_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y__SHIFT                                                           0x10
+#define DPG1_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y_MASK                                                             0x0000FFFFL
+#define DPG1_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y_MASK                                                             0xFFFF0000L
+//DPG1_DPG_COLOUR_B_CB
+#define DPG1_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB__SHIFT                                                         0x0
+#define DPG1_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB__SHIFT                                                         0x10
+#define DPG1_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB_MASK                                                           0x0000FFFFL
+#define DPG1_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB_MASK                                                           0xFFFF0000L
+//DPG1_DPG_OFFSET_SEGMENT
+#define DPG1_DPG_OFFSET_SEGMENT__DPG_X_OFFSET__SHIFT                                                          0x0
+#define DPG1_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH__SHIFT                                                     0x10
+#define DPG1_DPG_OFFSET_SEGMENT__DPG_X_OFFSET_MASK                                                            0x00003FFFL
+#define DPG1_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH_MASK                                                       0x3FFF0000L
+//DPG1_DPG_STATUS
+#define DPG1_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING__SHIFT                                                     0x0
+#define DPG1_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING_MASK                                                       0x00000001L
+//DPG1_DPG_TEST_DEBUG_INDEX
+#define DPG1_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define DPG1_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+//DPG1_DPG_TEST_DEBUG_DATA
+#define DPG1_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define DPG1_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_fmt1_dispdec
+//FMT1_FMT_CLAMP_COMPONENT_R
+#define FMT1_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R__SHIFT                                                  0x0
+#define FMT1_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R__SHIFT                                                  0x10
+#define FMT1_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R_MASK                                                    0x0000FFFFL
+#define FMT1_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R_MASK                                                    0xFFFF0000L
+//FMT1_FMT_CLAMP_COMPONENT_G
+#define FMT1_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G__SHIFT                                                  0x0
+#define FMT1_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G__SHIFT                                                  0x10
+#define FMT1_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G_MASK                                                    0x0000FFFFL
+#define FMT1_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G_MASK                                                    0xFFFF0000L
+//FMT1_FMT_CLAMP_COMPONENT_B
+#define FMT1_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B__SHIFT                                                  0x0
+#define FMT1_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B__SHIFT                                                  0x10
+#define FMT1_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B_MASK                                                    0x0000FFFFL
+#define FMT1_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B_MASK                                                    0xFFFF0000L
+//FMT1_FMT_DYNAMIC_EXP_CNTL
+#define FMT1_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN__SHIFT                                                  0x0
+#define FMT1_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE__SHIFT                                                0x4
+#define FMT1_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN_MASK                                                    0x00000001L
+#define FMT1_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE_MASK                                                  0x00000010L
+//FMT1_FMT_CONTROL
+#define FMT1_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE__SHIFT                                                      0x0
+#define FMT1_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX__SHIFT                                         0x8
+#define FMT1_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP__SHIFT                                    0xc
+#define FMT1_FMT_CONTROL__FMT_PIXEL_ENCODING__SHIFT                                                           0x10
+#define FMT1_FMT_CONTROL__FMT_SUBSAMPLING_MODE__SHIFT                                                         0x12
+#define FMT1_FMT_CONTROL__FMT_SUBSAMPLING_ORDER__SHIFT                                                        0x14
+#define FMT1_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS__SHIFT                                                0x15
+#define FMT1_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                         0x18
+#define FMT1_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE_MASK                                                        0x00000001L
+#define FMT1_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX_MASK                                           0x00000F00L
+#define FMT1_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP_MASK                                      0x00003000L
+#define FMT1_FMT_CONTROL__FMT_PIXEL_ENCODING_MASK                                                             0x00030000L
+#define FMT1_FMT_CONTROL__FMT_SUBSAMPLING_MODE_MASK                                                           0x000C0000L
+#define FMT1_FMT_CONTROL__FMT_SUBSAMPLING_ORDER_MASK                                                          0x00100000L
+#define FMT1_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS_MASK                                                  0x00200000L
+#define FMT1_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                           0x01000000L
+//FMT1_FMT_BIT_DEPTH_CONTROL
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN__SHIFT                                                    0x0
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE__SHIFT                                                  0x1
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH__SHIFT                                                 0x4
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN__SHIFT                                              0x8
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE__SHIFT                                            0x9
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH__SHIFT                                           0xb
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE__SHIFT                                            0xd
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE__SHIFT                                              0xe
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE__SHIFT                                         0xf
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN__SHIFT                                             0x10
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH__SHIFT                                          0x11
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET__SHIFT                                         0x15
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL__SHIFT                                                 0x18
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET__SHIFT                                          0x19
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL__SHIFT                                                      0x1a
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL__SHIFT                                                      0x1c
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL__SHIFT                                                      0x1e
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK                                                      0x00000001L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE_MASK                                                    0x00000002L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH_MASK                                                   0x00000030L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK                                                0x00000100L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE_MASK                                              0x00000600L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH_MASK                                             0x00001800L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK                                              0x00002000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE_MASK                                                0x00004000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_MASK                                           0x00008000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN_MASK                                               0x00010000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH_MASK                                            0x00060000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET_MASK                                           0x00600000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL_MASK                                                   0x01000000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET_MASK                                            0x02000000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL_MASK                                                        0x0C000000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL_MASK                                                        0x30000000L
+#define FMT1_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL_MASK                                                        0xC0000000L
+//FMT1_FMT_DITHER_RAND_R_SEED
+#define FMT1_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED__SHIFT                                                   0x0
+#define FMT1_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR__SHIFT                                                   0x10
+#define FMT1_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED_MASK                                                     0x000000FFL
+#define FMT1_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR_MASK                                                     0xFFFF0000L
+//FMT1_FMT_DITHER_RAND_G_SEED
+#define FMT1_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED__SHIFT                                                   0x0
+#define FMT1_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y__SHIFT                                                    0x10
+#define FMT1_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED_MASK                                                     0x000000FFL
+#define FMT1_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y_MASK                                                      0xFFFF0000L
+//FMT1_FMT_DITHER_RAND_B_SEED
+#define FMT1_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED__SHIFT                                                   0x0
+#define FMT1_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB__SHIFT                                                   0x10
+#define FMT1_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED_MASK                                                     0x000000FFL
+#define FMT1_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB_MASK                                                     0xFFFF0000L
+//FMT1_FMT_CLAMP_CNTL
+#define FMT1_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN__SHIFT                                                         0x0
+#define FMT1_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT__SHIFT                                                    0x10
+#define FMT1_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN_MASK                                                           0x00000001L
+#define FMT1_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT_MASK                                                      0x00070000L
+//FMT1_FMT_SIDE_BY_SIDE_STEREO_CONTROL
+#define FMT1_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH__SHIFT                     0x0
+#define FMT1_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH_MASK                       0x00001FFFL
+//FMT1_FMT_MAP420_MEMORY_CONTROL
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE__SHIFT                                        0x0
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS__SHIFT                                          0x4
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE__SHIFT                                        0x8
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE_MASK                                          0x00000003L
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS_MASK                                            0x00000010L
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE_MASK                                          0x00000300L
+#define FMT1_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//FMT1_FMT_DEBUG_CNTL
+#define FMT1_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT__SHIFT                                                    0x0
+#define FMT1_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT_MASK                                                      0x00000003L
+//FMT1_FMT_422_CONTROL
+#define FMT1_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT__SHIFT                                          0x0
+#define FMT1_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT_MASK                                            0x00000001L
+//FMT1_FMT_TEST_DEBUG_INDEX
+#define FMT1_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define FMT1_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define FMT1_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define FMT1_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//FMT1_FMT_TEST_DEBUG_DATA
+#define FMT1_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define FMT1_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_oppbuf1_dispdec
+//OPPBUF1_OPPBUF_CONTROL
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH__SHIFT                                                    0x0
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION__SHIFT                                            0x10
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM__SHIFT                                               0x14
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION__SHIFT                                                0x18
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING__SHIFT                                           0x1c
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH_MASK                                                      0x00003FFFL
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION_MASK                                              0x00070000L
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM_MASK                                                 0x00F00000L
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION_MASK                                                  0x0F000000L
+#define OPPBUF1_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING_MASK                                             0x10000000L
+//OPPBUF1_OPPBUF_3D_PARAMETERS_0
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE__SHIFT                                     0x0
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R__SHIFT                                            0x14
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE_MASK                                       0x000003FFL
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R_MASK                                              0xFFF00000L
+//OPPBUF1_OPPBUF_3D_PARAMETERS_1
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G__SHIFT                                            0x0
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B__SHIFT                                            0x10
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G_MASK                                              0x00000FFFL
+#define OPPBUF1_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B_MASK                                              0x0FFF0000L
+//OPPBUF1_OPPBUF_TEST_DEBUG_INDEX
+#define OPPBUF1_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX__SHIFT                                       0x0
+#define OPPBUF1_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX_MASK                                         0x000000FFL
+//OPPBUF1_OPPBUF_TEST_DEBUG_DATA
+#define OPPBUF1_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA__SHIFT                                         0x0
+#define OPPBUF1_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA_MASK                                           0xFFFFFFFFL
+//OPPBUF1_OPPBUF_CONTROL1
+#define OPPBUF1_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS__SHIFT                                      0x0
+#define OPPBUF1_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS_MASK                                        0x00000007L
+
+
+// addressBlock: dce_dc_opp_opp_pipe1_dispdec
+//OPP_PIPE1_OPP_PIPE_CONTROL
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN__SHIFT                                                  0x0
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON__SHIFT                                                  0x1
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN__SHIFT                                         0x4
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN_MASK                                                    0x00000001L
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON_MASK                                                    0x00000002L
+#define OPP_PIPE1_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN_MASK                                           0x00000010L
+//OPP_PIPE1_OPP_PIPE_SPARE_DEBUG
+#define OPP_PIPE1_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG__SHIFT                                           0x0
+#define OPP_PIPE1_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG_MASK                                             0xFFFFFFFFL
+//OPP_PIPE1_OPP_PIPE_TEST_DEBUG_INDEX
+#define OPP_PIPE1_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define OPP_PIPE1_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+//OPP_PIPE1_OPP_PIPE_TEST_DEBUG_DATA
+#define OPP_PIPE1_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define OPP_PIPE1_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc1_dispdec
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN__SHIFT                                            0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN__SHIFT                                       0x4
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE__SHIFT                                   0x8
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN__SHIFT                                     0xa
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN__SHIFT                                  0xe
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT__SHIFT                                  0x14
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT__SHIFT                                 0x18
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING__SHIFT                              0x1c
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN_MASK                                              0x00000001L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN_MASK                                         0x00000010L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE_MASK                                     0x00000300L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN_MASK                                       0x00000400L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN_MASK                                    0x00004000L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT_MASK                                    0x00300000L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT_MASK                                   0x01000000L
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING_MASK                                0x10000000L
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_MASK
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK__SHIFT                                             0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK_MASK                                               0x0000FFFFL
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTA
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A__SHIFT                                      0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTR
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R__SHIFT                                      0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTG
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G__SHIFT                                      0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTB
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B__SHIFT                                      0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTC
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C__SHIFT                                      0x0
+#define OPP_PIPE_CRC1_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C_MASK                                        0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_dpg2_dispdec
+//DPG2_DPG_CONTROL
+#define DPG2_DPG_CONTROL__DPG_EN__SHIFT                                                                       0x0
+#define DPG2_DPG_CONTROL__DPG_MODE__SHIFT                                                                     0x4
+#define DPG2_DPG_CONTROL__DPG_DYNAMIC_RANGE__SHIFT                                                            0x8
+#define DPG2_DPG_CONTROL__DPG_BIT_DEPTH__SHIFT                                                                0xc
+#define DPG2_DPG_CONTROL__DPG_VRES__SHIFT                                                                     0x10
+#define DPG2_DPG_CONTROL__DPG_HRES__SHIFT                                                                     0x14
+#define DPG2_DPG_CONTROL__DPG_EN_MASK                                                                         0x00000001L
+#define DPG2_DPG_CONTROL__DPG_MODE_MASK                                                                       0x00000070L
+#define DPG2_DPG_CONTROL__DPG_DYNAMIC_RANGE_MASK                                                              0x00000100L
+#define DPG2_DPG_CONTROL__DPG_BIT_DEPTH_MASK                                                                  0x00003000L
+#define DPG2_DPG_CONTROL__DPG_VRES_MASK                                                                       0x000F0000L
+#define DPG2_DPG_CONTROL__DPG_HRES_MASK                                                                       0x00F00000L
+//DPG2_DPG_RAMP_CONTROL
+#define DPG2_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET__SHIFT                                                        0x0
+#define DPG2_DPG_RAMP_CONTROL__DPG_INC0__SHIFT                                                                0x18
+#define DPG2_DPG_RAMP_CONTROL__DPG_INC1__SHIFT                                                                0x1c
+#define DPG2_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET_MASK                                                          0x0000FFFFL
+#define DPG2_DPG_RAMP_CONTROL__DPG_INC0_MASK                                                                  0x0F000000L
+#define DPG2_DPG_RAMP_CONTROL__DPG_INC1_MASK                                                                  0xF0000000L
+//DPG2_DPG_DIMENSIONS
+#define DPG2_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT__SHIFT                                                         0x0
+#define DPG2_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH__SHIFT                                                          0x10
+#define DPG2_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT_MASK                                                           0x00003FFFL
+#define DPG2_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH_MASK                                                            0x3FFF0000L
+//DPG2_DPG_COLOUR_R_CR
+#define DPG2_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR__SHIFT                                                         0x0
+#define DPG2_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR__SHIFT                                                         0x10
+#define DPG2_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR_MASK                                                           0x0000FFFFL
+#define DPG2_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR_MASK                                                           0xFFFF0000L
+//DPG2_DPG_COLOUR_G_Y
+#define DPG2_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y__SHIFT                                                           0x0
+#define DPG2_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y__SHIFT                                                           0x10
+#define DPG2_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y_MASK                                                             0x0000FFFFL
+#define DPG2_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y_MASK                                                             0xFFFF0000L
+//DPG2_DPG_COLOUR_B_CB
+#define DPG2_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB__SHIFT                                                         0x0
+#define DPG2_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB__SHIFT                                                         0x10
+#define DPG2_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB_MASK                                                           0x0000FFFFL
+#define DPG2_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB_MASK                                                           0xFFFF0000L
+//DPG2_DPG_OFFSET_SEGMENT
+#define DPG2_DPG_OFFSET_SEGMENT__DPG_X_OFFSET__SHIFT                                                          0x0
+#define DPG2_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH__SHIFT                                                     0x10
+#define DPG2_DPG_OFFSET_SEGMENT__DPG_X_OFFSET_MASK                                                            0x00003FFFL
+#define DPG2_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH_MASK                                                       0x3FFF0000L
+//DPG2_DPG_STATUS
+#define DPG2_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING__SHIFT                                                     0x0
+#define DPG2_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING_MASK                                                       0x00000001L
+//DPG2_DPG_TEST_DEBUG_INDEX
+#define DPG2_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define DPG2_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+//DPG2_DPG_TEST_DEBUG_DATA
+#define DPG2_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define DPG2_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_fmt2_dispdec
+//FMT2_FMT_CLAMP_COMPONENT_R
+#define FMT2_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R__SHIFT                                                  0x0
+#define FMT2_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R__SHIFT                                                  0x10
+#define FMT2_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R_MASK                                                    0x0000FFFFL
+#define FMT2_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R_MASK                                                    0xFFFF0000L
+//FMT2_FMT_CLAMP_COMPONENT_G
+#define FMT2_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G__SHIFT                                                  0x0
+#define FMT2_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G__SHIFT                                                  0x10
+#define FMT2_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G_MASK                                                    0x0000FFFFL
+#define FMT2_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G_MASK                                                    0xFFFF0000L
+//FMT2_FMT_CLAMP_COMPONENT_B
+#define FMT2_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B__SHIFT                                                  0x0
+#define FMT2_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B__SHIFT                                                  0x10
+#define FMT2_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B_MASK                                                    0x0000FFFFL
+#define FMT2_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B_MASK                                                    0xFFFF0000L
+//FMT2_FMT_DYNAMIC_EXP_CNTL
+#define FMT2_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN__SHIFT                                                  0x0
+#define FMT2_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE__SHIFT                                                0x4
+#define FMT2_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN_MASK                                                    0x00000001L
+#define FMT2_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE_MASK                                                  0x00000010L
+//FMT2_FMT_CONTROL
+#define FMT2_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE__SHIFT                                                      0x0
+#define FMT2_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX__SHIFT                                         0x8
+#define FMT2_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP__SHIFT                                    0xc
+#define FMT2_FMT_CONTROL__FMT_PIXEL_ENCODING__SHIFT                                                           0x10
+#define FMT2_FMT_CONTROL__FMT_SUBSAMPLING_MODE__SHIFT                                                         0x12
+#define FMT2_FMT_CONTROL__FMT_SUBSAMPLING_ORDER__SHIFT                                                        0x14
+#define FMT2_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS__SHIFT                                                0x15
+#define FMT2_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                         0x18
+#define FMT2_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE_MASK                                                        0x00000001L
+#define FMT2_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX_MASK                                           0x00000F00L
+#define FMT2_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP_MASK                                      0x00003000L
+#define FMT2_FMT_CONTROL__FMT_PIXEL_ENCODING_MASK                                                             0x00030000L
+#define FMT2_FMT_CONTROL__FMT_SUBSAMPLING_MODE_MASK                                                           0x000C0000L
+#define FMT2_FMT_CONTROL__FMT_SUBSAMPLING_ORDER_MASK                                                          0x00100000L
+#define FMT2_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS_MASK                                                  0x00200000L
+#define FMT2_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                           0x01000000L
+//FMT2_FMT_BIT_DEPTH_CONTROL
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN__SHIFT                                                    0x0
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE__SHIFT                                                  0x1
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH__SHIFT                                                 0x4
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN__SHIFT                                              0x8
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE__SHIFT                                            0x9
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH__SHIFT                                           0xb
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE__SHIFT                                            0xd
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE__SHIFT                                              0xe
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE__SHIFT                                         0xf
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN__SHIFT                                             0x10
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH__SHIFT                                          0x11
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET__SHIFT                                         0x15
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL__SHIFT                                                 0x18
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET__SHIFT                                          0x19
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL__SHIFT                                                      0x1a
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL__SHIFT                                                      0x1c
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL__SHIFT                                                      0x1e
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK                                                      0x00000001L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE_MASK                                                    0x00000002L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH_MASK                                                   0x00000030L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK                                                0x00000100L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE_MASK                                              0x00000600L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH_MASK                                             0x00001800L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK                                              0x00002000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE_MASK                                                0x00004000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_MASK                                           0x00008000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN_MASK                                               0x00010000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH_MASK                                            0x00060000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET_MASK                                           0x00600000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL_MASK                                                   0x01000000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET_MASK                                            0x02000000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL_MASK                                                        0x0C000000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL_MASK                                                        0x30000000L
+#define FMT2_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL_MASK                                                        0xC0000000L
+//FMT2_FMT_DITHER_RAND_R_SEED
+#define FMT2_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED__SHIFT                                                   0x0
+#define FMT2_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR__SHIFT                                                   0x10
+#define FMT2_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED_MASK                                                     0x000000FFL
+#define FMT2_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR_MASK                                                     0xFFFF0000L
+//FMT2_FMT_DITHER_RAND_G_SEED
+#define FMT2_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED__SHIFT                                                   0x0
+#define FMT2_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y__SHIFT                                                    0x10
+#define FMT2_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED_MASK                                                     0x000000FFL
+#define FMT2_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y_MASK                                                      0xFFFF0000L
+//FMT2_FMT_DITHER_RAND_B_SEED
+#define FMT2_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED__SHIFT                                                   0x0
+#define FMT2_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB__SHIFT                                                   0x10
+#define FMT2_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED_MASK                                                     0x000000FFL
+#define FMT2_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB_MASK                                                     0xFFFF0000L
+//FMT2_FMT_CLAMP_CNTL
+#define FMT2_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN__SHIFT                                                         0x0
+#define FMT2_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT__SHIFT                                                    0x10
+#define FMT2_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN_MASK                                                           0x00000001L
+#define FMT2_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT_MASK                                                      0x00070000L
+//FMT2_FMT_SIDE_BY_SIDE_STEREO_CONTROL
+#define FMT2_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH__SHIFT                     0x0
+#define FMT2_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH_MASK                       0x00001FFFL
+//FMT2_FMT_MAP420_MEMORY_CONTROL
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE__SHIFT                                        0x0
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS__SHIFT                                          0x4
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE__SHIFT                                        0x8
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE_MASK                                          0x00000003L
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS_MASK                                            0x00000010L
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE_MASK                                          0x00000300L
+#define FMT2_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//FMT2_FMT_DEBUG_CNTL
+#define FMT2_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT__SHIFT                                                    0x0
+#define FMT2_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT_MASK                                                      0x00000003L
+//FMT2_FMT_422_CONTROL
+#define FMT2_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT__SHIFT                                          0x0
+#define FMT2_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT_MASK                                            0x00000001L
+//FMT2_FMT_TEST_DEBUG_INDEX
+#define FMT2_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define FMT2_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define FMT2_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define FMT2_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//FMT2_FMT_TEST_DEBUG_DATA
+#define FMT2_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define FMT2_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_oppbuf2_dispdec
+//OPPBUF2_OPPBUF_CONTROL
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH__SHIFT                                                    0x0
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION__SHIFT                                            0x10
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM__SHIFT                                               0x14
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION__SHIFT                                                0x18
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING__SHIFT                                           0x1c
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH_MASK                                                      0x00003FFFL
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION_MASK                                              0x00070000L
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM_MASK                                                 0x00F00000L
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION_MASK                                                  0x0F000000L
+#define OPPBUF2_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING_MASK                                             0x10000000L
+//OPPBUF2_OPPBUF_3D_PARAMETERS_0
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE__SHIFT                                     0x0
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R__SHIFT                                            0x14
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE_MASK                                       0x000003FFL
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R_MASK                                              0xFFF00000L
+//OPPBUF2_OPPBUF_3D_PARAMETERS_1
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G__SHIFT                                            0x0
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B__SHIFT                                            0x10
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G_MASK                                              0x00000FFFL
+#define OPPBUF2_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B_MASK                                              0x0FFF0000L
+//OPPBUF2_OPPBUF_TEST_DEBUG_INDEX
+#define OPPBUF2_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX__SHIFT                                       0x0
+#define OPPBUF2_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX_MASK                                         0x000000FFL
+//OPPBUF2_OPPBUF_TEST_DEBUG_DATA
+#define OPPBUF2_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA__SHIFT                                         0x0
+#define OPPBUF2_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA_MASK                                           0xFFFFFFFFL
+//OPPBUF2_OPPBUF_CONTROL1
+#define OPPBUF2_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS__SHIFT                                      0x0
+#define OPPBUF2_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS_MASK                                        0x00000007L
+
+
+// addressBlock: dce_dc_opp_opp_pipe2_dispdec
+//OPP_PIPE2_OPP_PIPE_CONTROL
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN__SHIFT                                                  0x0
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON__SHIFT                                                  0x1
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN__SHIFT                                         0x4
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN_MASK                                                    0x00000001L
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON_MASK                                                    0x00000002L
+#define OPP_PIPE2_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN_MASK                                           0x00000010L
+//OPP_PIPE2_OPP_PIPE_SPARE_DEBUG
+#define OPP_PIPE2_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG__SHIFT                                           0x0
+#define OPP_PIPE2_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG_MASK                                             0xFFFFFFFFL
+//OPP_PIPE2_OPP_PIPE_TEST_DEBUG_INDEX
+#define OPP_PIPE2_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define OPP_PIPE2_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+//OPP_PIPE2_OPP_PIPE_TEST_DEBUG_DATA
+#define OPP_PIPE2_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define OPP_PIPE2_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc2_dispdec
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN__SHIFT                                            0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN__SHIFT                                       0x4
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE__SHIFT                                   0x8
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN__SHIFT                                     0xa
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN__SHIFT                                  0xe
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT__SHIFT                                  0x14
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT__SHIFT                                 0x18
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING__SHIFT                              0x1c
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN_MASK                                              0x00000001L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN_MASK                                         0x00000010L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE_MASK                                     0x00000300L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN_MASK                                       0x00000400L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN_MASK                                    0x00004000L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT_MASK                                    0x00300000L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT_MASK                                   0x01000000L
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING_MASK                                0x10000000L
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_MASK
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK__SHIFT                                             0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK_MASK                                               0x0000FFFFL
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTA
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A__SHIFT                                      0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTR
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R__SHIFT                                      0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTG
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G__SHIFT                                      0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTB
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B__SHIFT                                      0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTC
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C__SHIFT                                      0x0
+#define OPP_PIPE_CRC2_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C_MASK                                        0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_dpg3_dispdec
+//DPG3_DPG_CONTROL
+#define DPG3_DPG_CONTROL__DPG_EN__SHIFT                                                                       0x0
+#define DPG3_DPG_CONTROL__DPG_MODE__SHIFT                                                                     0x4
+#define DPG3_DPG_CONTROL__DPG_DYNAMIC_RANGE__SHIFT                                                            0x8
+#define DPG3_DPG_CONTROL__DPG_BIT_DEPTH__SHIFT                                                                0xc
+#define DPG3_DPG_CONTROL__DPG_VRES__SHIFT                                                                     0x10
+#define DPG3_DPG_CONTROL__DPG_HRES__SHIFT                                                                     0x14
+#define DPG3_DPG_CONTROL__DPG_EN_MASK                                                                         0x00000001L
+#define DPG3_DPG_CONTROL__DPG_MODE_MASK                                                                       0x00000070L
+#define DPG3_DPG_CONTROL__DPG_DYNAMIC_RANGE_MASK                                                              0x00000100L
+#define DPG3_DPG_CONTROL__DPG_BIT_DEPTH_MASK                                                                  0x00003000L
+#define DPG3_DPG_CONTROL__DPG_VRES_MASK                                                                       0x000F0000L
+#define DPG3_DPG_CONTROL__DPG_HRES_MASK                                                                       0x00F00000L
+//DPG3_DPG_RAMP_CONTROL
+#define DPG3_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET__SHIFT                                                        0x0
+#define DPG3_DPG_RAMP_CONTROL__DPG_INC0__SHIFT                                                                0x18
+#define DPG3_DPG_RAMP_CONTROL__DPG_INC1__SHIFT                                                                0x1c
+#define DPG3_DPG_RAMP_CONTROL__DPG_RAMP0_OFFSET_MASK                                                          0x0000FFFFL
+#define DPG3_DPG_RAMP_CONTROL__DPG_INC0_MASK                                                                  0x0F000000L
+#define DPG3_DPG_RAMP_CONTROL__DPG_INC1_MASK                                                                  0xF0000000L
+//DPG3_DPG_DIMENSIONS
+#define DPG3_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT__SHIFT                                                         0x0
+#define DPG3_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH__SHIFT                                                          0x10
+#define DPG3_DPG_DIMENSIONS__DPG_ACTIVE_HEIGHT_MASK                                                           0x00003FFFL
+#define DPG3_DPG_DIMENSIONS__DPG_ACTIVE_WIDTH_MASK                                                            0x3FFF0000L
+//DPG3_DPG_COLOUR_R_CR
+#define DPG3_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR__SHIFT                                                         0x0
+#define DPG3_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR__SHIFT                                                         0x10
+#define DPG3_DPG_COLOUR_R_CR__DPG_COLOUR0_R_CR_MASK                                                           0x0000FFFFL
+#define DPG3_DPG_COLOUR_R_CR__DPG_COLOUR1_R_CR_MASK                                                           0xFFFF0000L
+//DPG3_DPG_COLOUR_G_Y
+#define DPG3_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y__SHIFT                                                           0x0
+#define DPG3_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y__SHIFT                                                           0x10
+#define DPG3_DPG_COLOUR_G_Y__DPG_COLOUR0_G_Y_MASK                                                             0x0000FFFFL
+#define DPG3_DPG_COLOUR_G_Y__DPG_COLOUR1_G_Y_MASK                                                             0xFFFF0000L
+//DPG3_DPG_COLOUR_B_CB
+#define DPG3_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB__SHIFT                                                         0x0
+#define DPG3_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB__SHIFT                                                         0x10
+#define DPG3_DPG_COLOUR_B_CB__DPG_COLOUR0_B_CB_MASK                                                           0x0000FFFFL
+#define DPG3_DPG_COLOUR_B_CB__DPG_COLOUR1_B_CB_MASK                                                           0xFFFF0000L
+//DPG3_DPG_OFFSET_SEGMENT
+#define DPG3_DPG_OFFSET_SEGMENT__DPG_X_OFFSET__SHIFT                                                          0x0
+#define DPG3_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH__SHIFT                                                     0x10
+#define DPG3_DPG_OFFSET_SEGMENT__DPG_X_OFFSET_MASK                                                            0x00003FFFL
+#define DPG3_DPG_OFFSET_SEGMENT__DPG_SEGMENT_WIDTH_MASK                                                       0x3FFF0000L
+//DPG3_DPG_STATUS
+#define DPG3_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING__SHIFT                                                     0x0
+#define DPG3_DPG_STATUS__DPG_DOUBLE_BUFFER_PENDING_MASK                                                       0x00000001L
+//DPG3_DPG_TEST_DEBUG_INDEX
+#define DPG3_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define DPG3_DPG_TEST_DEBUG_INDEX__DPG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+//DPG3_DPG_TEST_DEBUG_DATA
+#define DPG3_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define DPG3_DPG_TEST_DEBUG_DATA__DPG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_fmt3_dispdec
+//FMT3_FMT_CLAMP_COMPONENT_R
+#define FMT3_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R__SHIFT                                                  0x0
+#define FMT3_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R__SHIFT                                                  0x10
+#define FMT3_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_LOWER_R_MASK                                                    0x0000FFFFL
+#define FMT3_FMT_CLAMP_COMPONENT_R__FMT_CLAMP_UPPER_R_MASK                                                    0xFFFF0000L
+//FMT3_FMT_CLAMP_COMPONENT_G
+#define FMT3_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G__SHIFT                                                  0x0
+#define FMT3_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G__SHIFT                                                  0x10
+#define FMT3_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_LOWER_G_MASK                                                    0x0000FFFFL
+#define FMT3_FMT_CLAMP_COMPONENT_G__FMT_CLAMP_UPPER_G_MASK                                                    0xFFFF0000L
+//FMT3_FMT_CLAMP_COMPONENT_B
+#define FMT3_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B__SHIFT                                                  0x0
+#define FMT3_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B__SHIFT                                                  0x10
+#define FMT3_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_LOWER_B_MASK                                                    0x0000FFFFL
+#define FMT3_FMT_CLAMP_COMPONENT_B__FMT_CLAMP_UPPER_B_MASK                                                    0xFFFF0000L
+//FMT3_FMT_DYNAMIC_EXP_CNTL
+#define FMT3_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN__SHIFT                                                  0x0
+#define FMT3_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE__SHIFT                                                0x4
+#define FMT3_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_EN_MASK                                                    0x00000001L
+#define FMT3_FMT_DYNAMIC_EXP_CNTL__FMT_DYNAMIC_EXP_MODE_MASK                                                  0x00000010L
+//FMT3_FMT_CONTROL
+#define FMT3_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE__SHIFT                                                      0x0
+#define FMT3_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX__SHIFT                                         0x8
+#define FMT3_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP__SHIFT                                    0xc
+#define FMT3_FMT_CONTROL__FMT_PIXEL_ENCODING__SHIFT                                                           0x10
+#define FMT3_FMT_CONTROL__FMT_SUBSAMPLING_MODE__SHIFT                                                         0x12
+#define FMT3_FMT_CONTROL__FMT_SUBSAMPLING_ORDER__SHIFT                                                        0x14
+#define FMT3_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS__SHIFT                                                0x15
+#define FMT3_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                         0x18
+#define FMT3_FMT_CONTROL__FMT_STEREOSYNC_OVERRIDE_MASK                                                        0x00000001L
+#define FMT3_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_MAX_MASK                                           0x00000F00L
+#define FMT3_FMT_CONTROL__FMT_SPATIAL_DITHER_FRAME_COUNTER_BIT_SWAP_MASK                                      0x00003000L
+#define FMT3_FMT_CONTROL__FMT_PIXEL_ENCODING_MASK                                                             0x00030000L
+#define FMT3_FMT_CONTROL__FMT_SUBSAMPLING_MODE_MASK                                                           0x000C0000L
+#define FMT3_FMT_CONTROL__FMT_SUBSAMPLING_ORDER_MASK                                                          0x00100000L
+#define FMT3_FMT_CONTROL__FMT_CBCR_BIT_REDUCTION_BYPASS_MASK                                                  0x00200000L
+#define FMT3_FMT_CONTROL__FMT_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                           0x01000000L
+//FMT3_FMT_BIT_DEPTH_CONTROL
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN__SHIFT                                                    0x0
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE__SHIFT                                                  0x1
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH__SHIFT                                                 0x4
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN__SHIFT                                              0x8
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE__SHIFT                                            0x9
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH__SHIFT                                           0xb
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE__SHIFT                                            0xd
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE__SHIFT                                              0xe
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE__SHIFT                                         0xf
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN__SHIFT                                             0x10
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH__SHIFT                                          0x11
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET__SHIFT                                         0x15
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL__SHIFT                                                 0x18
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET__SHIFT                                          0x19
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL__SHIFT                                                      0x1a
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL__SHIFT                                                      0x1c
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL__SHIFT                                                      0x1e
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_EN_MASK                                                      0x00000001L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_MODE_MASK                                                    0x00000002L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TRUNCATE_DEPTH_MASK                                                   0x00000030L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_EN_MASK                                                0x00000100L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_MODE_MASK                                              0x00000600L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_SPATIAL_DITHER_DEPTH_MASK                                             0x00001800L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_FRAME_RANDOM_ENABLE_MASK                                              0x00002000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_RGB_RANDOM_ENABLE_MASK                                                0x00004000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_HIGHPASS_RANDOM_ENABLE_MASK                                           0x00008000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_EN_MASK                                               0x00010000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_DEPTH_MASK                                            0x00060000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_OFFSET_MASK                                           0x00600000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_LEVEL_MASK                                                   0x01000000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_TEMPORAL_DITHER_RESET_MASK                                            0x02000000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_25FRC_SEL_MASK                                                        0x0C000000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_50FRC_SEL_MASK                                                        0x30000000L
+#define FMT3_FMT_BIT_DEPTH_CONTROL__FMT_75FRC_SEL_MASK                                                        0xC0000000L
+//FMT3_FMT_DITHER_RAND_R_SEED
+#define FMT3_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED__SHIFT                                                   0x0
+#define FMT3_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR__SHIFT                                                   0x10
+#define FMT3_FMT_DITHER_RAND_R_SEED__FMT_RAND_R_SEED_MASK                                                     0x000000FFL
+#define FMT3_FMT_DITHER_RAND_R_SEED__FMT_OFFSET_R_CR_MASK                                                     0xFFFF0000L
+//FMT3_FMT_DITHER_RAND_G_SEED
+#define FMT3_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED__SHIFT                                                   0x0
+#define FMT3_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y__SHIFT                                                    0x10
+#define FMT3_FMT_DITHER_RAND_G_SEED__FMT_RAND_G_SEED_MASK                                                     0x000000FFL
+#define FMT3_FMT_DITHER_RAND_G_SEED__FMT_OFFSET_G_Y_MASK                                                      0xFFFF0000L
+//FMT3_FMT_DITHER_RAND_B_SEED
+#define FMT3_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED__SHIFT                                                   0x0
+#define FMT3_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB__SHIFT                                                   0x10
+#define FMT3_FMT_DITHER_RAND_B_SEED__FMT_RAND_B_SEED_MASK                                                     0x000000FFL
+#define FMT3_FMT_DITHER_RAND_B_SEED__FMT_OFFSET_B_CB_MASK                                                     0xFFFF0000L
+//FMT3_FMT_CLAMP_CNTL
+#define FMT3_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN__SHIFT                                                         0x0
+#define FMT3_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT__SHIFT                                                    0x10
+#define FMT3_FMT_CLAMP_CNTL__FMT_CLAMP_DATA_EN_MASK                                                           0x00000001L
+#define FMT3_FMT_CLAMP_CNTL__FMT_CLAMP_COLOR_FORMAT_MASK                                                      0x00070000L
+//FMT3_FMT_SIDE_BY_SIDE_STEREO_CONTROL
+#define FMT3_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH__SHIFT                     0x0
+#define FMT3_FMT_SIDE_BY_SIDE_STEREO_CONTROL__FMT_SIDE_BY_SIDE_STEREO_ACTIVE_WIDTH_MASK                       0x00001FFFL
+//FMT3_FMT_MAP420_MEMORY_CONTROL
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE__SHIFT                                        0x0
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS__SHIFT                                          0x4
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE__SHIFT                                        0x8
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_FORCE_MASK                                          0x00000003L
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_DIS_MASK                                            0x00000010L
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_MAP420MEM_PWR_STATE_MASK                                          0x00000300L
+#define FMT3_FMT_MAP420_MEMORY_CONTROL__FMT_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//FMT3_FMT_DEBUG_CNTL
+#define FMT3_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT__SHIFT                                                    0x0
+#define FMT3_FMT_DEBUG_CNTL__FMT_DEBUG_COLOR_SELECT_MASK                                                      0x00000003L
+//FMT3_FMT_422_CONTROL
+#define FMT3_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT__SHIFT                                          0x0
+#define FMT3_FMT_422_CONTROL__FMT_LEFT_EDGE_EXTRA_PIXEL_COUNT_MASK                                            0x00000001L
+//FMT3_FMT_TEST_DEBUG_INDEX
+#define FMT3_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define FMT3_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define FMT3_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define FMT3_FMT_TEST_DEBUG_INDEX__FMT_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//FMT3_FMT_TEST_DEBUG_DATA
+#define FMT3_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define FMT3_FMT_TEST_DEBUG_DATA__FMT_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_oppbuf3_dispdec
+//OPPBUF3_OPPBUF_CONTROL
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH__SHIFT                                                    0x0
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION__SHIFT                                            0x10
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM__SHIFT                                               0x14
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION__SHIFT                                                0x18
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING__SHIFT                                           0x1c
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_ACTIVE_WIDTH_MASK                                                      0x00003FFFL
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_DISPLAY_SEGMENTATION_MASK                                              0x00070000L
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_OVERLAP_PIXEL_NUM_MASK                                                 0x00F00000L
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_PIXEL_REPETITION_MASK                                                  0x0F000000L
+#define OPPBUF3_OPPBUF_CONTROL__OPPBUF_DOUBLE_BUFFER_PENDING_MASK                                             0x10000000L
+//OPPBUF3_OPPBUF_3D_PARAMETERS_0
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE__SHIFT                                     0x0
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R__SHIFT                                            0x14
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_0__OPPBUF_3D_VACT_SPACE1_SIZE_MASK                                       0x000003FFL
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_0__OPPBUF_DUMMY_DATA_R_MASK                                              0xFFF00000L
+//OPPBUF3_OPPBUF_3D_PARAMETERS_1
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G__SHIFT                                            0x0
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B__SHIFT                                            0x10
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_G_MASK                                              0x00000FFFL
+#define OPPBUF3_OPPBUF_3D_PARAMETERS_1__OPPBUF_DUMMY_DATA_B_MASK                                              0x0FFF0000L
+//OPPBUF3_OPPBUF_TEST_DEBUG_INDEX
+#define OPPBUF3_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX__SHIFT                                       0x0
+#define OPPBUF3_OPPBUF_TEST_DEBUG_INDEX__OPPBUF_TEST_DEBUG_INDEX_MASK                                         0x000000FFL
+//OPPBUF3_OPPBUF_TEST_DEBUG_DATA
+#define OPPBUF3_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA__SHIFT                                         0x0
+#define OPPBUF3_OPPBUF_TEST_DEBUG_DATA__OPPBUF_TEST_DEBUG_DATA_MASK                                           0xFFFFFFFFL
+//OPPBUF3_OPPBUF_CONTROL1
+#define OPPBUF3_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS__SHIFT                                      0x0
+#define OPPBUF3_OPPBUF_CONTROL1__OPPBUF_NUM_SEGMENT_PADDED_PIXELS_MASK                                        0x00000007L
+
+
+// addressBlock: dce_dc_opp_opp_pipe3_dispdec
+//OPP_PIPE3_OPP_PIPE_CONTROL
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN__SHIFT                                                  0x0
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON__SHIFT                                                  0x1
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN__SHIFT                                         0x4
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_EN_MASK                                                    0x00000001L
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_CLOCK_ON_MASK                                                    0x00000002L
+#define OPP_PIPE3_OPP_PIPE_CONTROL__OPP_PIPE_DIGITAL_BYPASS_EN_MASK                                           0x00000010L
+//OPP_PIPE3_OPP_PIPE_SPARE_DEBUG
+#define OPP_PIPE3_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG__SHIFT                                           0x0
+#define OPP_PIPE3_OPP_PIPE_SPARE_DEBUG__OPP_PIPE_SPARE_DEBUG_MASK                                             0xFFFFFFFFL
+//OPP_PIPE3_OPP_PIPE_TEST_DEBUG_INDEX
+#define OPP_PIPE3_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX__SHIFT                                 0x0
+#define OPP_PIPE3_OPP_PIPE_TEST_DEBUG_INDEX__OPP_PIPE_TEST_DEBUG_INDEX_MASK                                   0x000000FFL
+//OPP_PIPE3_OPP_PIPE_TEST_DEBUG_DATA
+#define OPP_PIPE3_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA__SHIFT                                   0x0
+#define OPP_PIPE3_OPP_PIPE_TEST_DEBUG_DATA__OPP_PIPE_TEST_DEBUG_DATA_MASK                                     0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_opp_pipe_crc3_dispdec
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN__SHIFT                                            0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN__SHIFT                                       0x4
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE__SHIFT                                   0x8
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN__SHIFT                                     0xa
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN__SHIFT                                  0xe
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT__SHIFT                                  0x14
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT__SHIFT                                 0x18
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING__SHIFT                              0x1c
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_EN_MASK                                              0x00000001L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_CONT_EN_MASK                                         0x00000010L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_MODE_MASK                                     0x00000300L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_STEREO_EN_MASK                                       0x00000400L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_INTERLACE_EN_MASK                                    0x00004000L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_PIXEL_SELECT_MASK                                    0x00300000L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_SOURCE_SELECT_MASK                                   0x01000000L
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_CONTROL__OPP_PIPE_CRC_ONE_SHOT_PENDING_MASK                                0x10000000L
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_MASK
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK__SHIFT                                             0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_MASK__OPP_PIPE_CRC_MASK_MASK                                               0x0000FFFFL
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTA
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A__SHIFT                                      0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTA__OPP_PIPE_CRC_RESULT_A_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTR
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R__SHIFT                                      0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTR__OPP_PIPE_CRC_RESULT_R_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTG
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G__SHIFT                                      0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTG__OPP_PIPE_CRC_RESULT_G_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTB
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B__SHIFT                                      0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTB__OPP_PIPE_CRC_RESULT_B_MASK                                        0xFFFFFFFFL
+//OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTC
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C__SHIFT                                      0x0
+#define OPP_PIPE_CRC3_OPP_PIPE_CRC_RESULTC__OPP_PIPE_CRC_RESULT_C_MASK                                        0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_dscrm0_dispdec
+//DSCRM0_DSCRM_DSC_FORWARD_CONFIG
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN__SHIFT                                          0x0
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE__SHIFT                                     0x4
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                    0x8
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS__SHIFT                                   0xc
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_MASK                                            0x00000001L
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE_MASK                                       0x00000070L
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                      0x00000100L
+#define DSCRM0_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS_MASK                                     0x00001000L
+
+
+// addressBlock: dce_dc_opp_dscrm1_dispdec
+//DSCRM1_DSCRM_DSC_FORWARD_CONFIG
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN__SHIFT                                          0x0
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE__SHIFT                                     0x4
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                    0x8
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS__SHIFT                                   0xc
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_MASK                                            0x00000001L
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE_MASK                                       0x00000070L
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                      0x00000100L
+#define DSCRM1_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS_MASK                                     0x00001000L
+
+
+// addressBlock: dce_dc_opp_dscrm2_dispdec
+//DSCRM2_DSCRM_DSC_FORWARD_CONFIG
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN__SHIFT                                          0x0
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE__SHIFT                                     0x4
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                    0x8
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS__SHIFT                                   0xc
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_MASK                                            0x00000001L
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE_MASK                                       0x00000070L
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                      0x00000100L
+#define DSCRM2_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS_MASK                                     0x00001000L
+
+
+// addressBlock: dce_dc_opp_dscrm3_dispdec
+//DSCRM3_DSCRM_DSC_FORWARD_CONFIG
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN__SHIFT                                          0x0
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE__SHIFT                                     0x4
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                    0x8
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS__SHIFT                                   0xc
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_MASK                                            0x00000001L
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_OPP_PIPE_SOURCE_MASK                                       0x00000070L
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                      0x00000100L
+#define DSCRM3_DSCRM_DSC_FORWARD_CONFIG__DSCRM_DSC_FORWARD_EN_STATUS_MASK                                     0x00001000L
+
+
+// addressBlock: dce_dc_opp_opp_top_dispdec
+//OPP_TOP_CLK_CONTROL
+#define OPP_TOP_CLK_CONTROL__OPP_DISPCLK_R_GATE_DIS__SHIFT                                                    0x0
+#define OPP_TOP_CLK_CONTROL__OPP_DISPCLK_G_ABM_GATE_DIS__SHIFT                                                0x4
+#define OPP_TOP_CLK_CONTROL__OPP_TEST_CLK_SEL__SHIFT                                                          0x8
+#define OPP_TOP_CLK_CONTROL__OPP_ABM0_CLOCK_ON__SHIFT                                                         0xc
+#define OPP_TOP_CLK_CONTROL__OPP_ABM1_CLOCK_ON__SHIFT                                                         0xd
+#define OPP_TOP_CLK_CONTROL__OPP_ABM2_CLOCK_ON__SHIFT                                                         0xe
+#define OPP_TOP_CLK_CONTROL__OPP_ABM3_CLOCK_ON__SHIFT                                                         0xf
+#define OPP_TOP_CLK_CONTROL__OPP_FGCG_REP_DIS__SHIFT                                                          0x18
+#define OPP_TOP_CLK_CONTROL__OPP_DISPCLK_R_GATE_DIS_MASK                                                      0x00000001L
+#define OPP_TOP_CLK_CONTROL__OPP_DISPCLK_G_ABM_GATE_DIS_MASK                                                  0x00000010L
+#define OPP_TOP_CLK_CONTROL__OPP_TEST_CLK_SEL_MASK                                                            0x00000F00L
+#define OPP_TOP_CLK_CONTROL__OPP_ABM0_CLOCK_ON_MASK                                                           0x00001000L
+#define OPP_TOP_CLK_CONTROL__OPP_ABM1_CLOCK_ON_MASK                                                           0x00002000L
+#define OPP_TOP_CLK_CONTROL__OPP_ABM2_CLOCK_ON_MASK                                                           0x00004000L
+#define OPP_TOP_CLK_CONTROL__OPP_ABM3_CLOCK_ON_MASK                                                           0x00008000L
+#define OPP_TOP_CLK_CONTROL__OPP_FGCG_REP_DIS_MASK                                                            0x01000000L
+//OPP_DEBUG_CONTROL
+#define OPP_DEBUG_CONTROL__OPP_DBG_EN__SHIFT                                                                  0x0
+#define OPP_DEBUG_CONTROL__OPP_FMT_DEBUG_BUS_SELECT__SHIFT                                                    0x4
+#define OPP_DEBUG_CONTROL__OPP_OPP_BUF_DEBUG_BUS_SELECT__SHIFT                                                0x8
+#define OPP_DEBUG_CONTROL__OPP_ABM_DEBUG_BUS_SELECT__SHIFT                                                    0xc
+#define OPP_DEBUG_CONTROL__OPP_OPP_PIPE_DEBUG_BUS_SELECT__SHIFT                                               0x10
+#define OPP_DEBUG_CONTROL__OPP_DPG_DEBUG_BUS_SELECT__SHIFT                                                    0x14
+#define OPP_DEBUG_CONTROL__OPP_DBG_EN_MASK                                                                    0x00000001L
+#define OPP_DEBUG_CONTROL__OPP_FMT_DEBUG_BUS_SELECT_MASK                                                      0x000000F0L
+#define OPP_DEBUG_CONTROL__OPP_OPP_BUF_DEBUG_BUS_SELECT_MASK                                                  0x00000F00L
+#define OPP_DEBUG_CONTROL__OPP_ABM_DEBUG_BUS_SELECT_MASK                                                      0x00007000L
+#define OPP_DEBUG_CONTROL__OPP_OPP_PIPE_DEBUG_BUS_SELECT_MASK                                                 0x00070000L
+#define OPP_DEBUG_CONTROL__OPP_DPG_DEBUG_BUS_SELECT_MASK                                                      0x00F00000L
+//OPP_ABM_CONTROL
+#define OPP_ABM_CONTROL__OPP_ABM_BLPWM_SEL__SHIFT                                                             0x0
+#define OPP_ABM_CONTROL__OPP_ABM_BLPWM_SEL_MASK                                                               0x00000007L
+//OPP_TOP_SPARE_DEBUG
+#define OPP_TOP_SPARE_DEBUG__OPP_TOP_SPARE_DEBUG__SHIFT                                                       0x0
+#define OPP_TOP_SPARE_DEBUG__OPP_TOP_SPARE_DEBUG_MASK                                                         0xFFFFFFFFL
+//OPP_TOP_TEST_DEBUG_INDEX
+#define OPP_TOP_TEST_DEBUG_INDEX__OPP_TOP_TEST_DEBUG_INDEX__SHIFT                                             0x0
+#define OPP_TOP_TEST_DEBUG_INDEX__OPP_TOP_TEST_DEBUG_INDEX_MASK                                               0x000000FFL
+//OPP_TOP_TEST_DEBUG_DATA
+#define OPP_TOP_TEST_DEBUG_DATA__OPP_TOP_TEST_DEBUG_DATA__SHIFT                                               0x0
+#define OPP_TOP_TEST_DEBUG_DATA__OPP_TOP_TEST_DEBUG_DATA_MASK                                                 0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_opp_opp_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON15_PERFCOUNTER_CNTL
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON15_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON15_PERFCOUNTER_CNTL2
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON15_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON15_PERFCOUNTER_STATE
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON15_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON15_PERFMON_CNTL
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON15_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON15_PERFMON_CNTL2
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON15_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON15_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON15_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON15_PERFMON_CVALUE_LOW
+#define DC_PERFMON15_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON15_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON15_PERFMON_HI
+#define DC_PERFMON15_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON15_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON15_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON15_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON15_PERFMON_LOW
+#define DC_PERFMON15_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON15_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON15_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON15_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON15_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_odm0_dispdec
+//ODM0_OPTC_INPUT_GLOBAL_CONTROL
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET__SHIFT                                          0x0
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN__SHIFT                                          0x8
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS__SHIFT                                 0xa
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS__SHIFT                                      0xb
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR__SHIFT                                           0xc
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT__SHIFT                                0xd
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING__SHIFT                                     0x1f
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET_MASK                                            0x00000001L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN_MASK                                            0x00000100L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS_MASK                                   0x00000400L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS_MASK                                        0x00000800L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR_MASK                                             0x00001000L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT_MASK                                  0x00002000L
+#define ODM0_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING_MASK                                       0x80000000L
+//ODM0_OPTC_RSMU_UNDERFLOW
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN__SHIFT                                           0x0
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS__SHIFT                                  0x1
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS__SHIFT                                       0x2
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR__SHIFT                                            0x3
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN_MASK                                             0x00000001L
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS_MASK                                    0x00000002L
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS_MASK                                         0x00000004L
+#define ODM0_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR_MASK                                              0x00000008L
+//ODM0_OPTC_UNDERFLOW_THRESHOLD
+#define ODM0_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD__SHIFT                                        0x0
+#define ODM0_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD_MASK                                          0x01FFFFFFL
+//ODM0_OPTC_DATA_SOURCE_SELECT
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT__SHIFT                                        0x0
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT__SHIFT                                       0x8
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL__SHIFT                                                0x10
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL__SHIFT                                                0x14
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL__SHIFT                                                0x18
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL__SHIFT                                                0x1c
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT_MASK                                          0x00000003L
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT_MASK                                         0x00000300L
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL_MASK                                                  0x000F0000L
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL_MASK                                                  0x00F00000L
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL_MASK                                                  0x0F000000L
+#define ODM0_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL_MASK                                                  0xF0000000L
+//ODM0_OPTC_DATA_FORMAT_CONTROL
+#define ODM0_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT__SHIFT                                                0x0
+#define ODM0_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE__SHIFT                                                   0x4
+#define ODM0_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT_MASK                                                  0x00000003L
+#define ODM0_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE_MASK                                                     0x00000030L
+//ODM0_OPTC_BYTES_PER_PIXEL
+#define ODM0_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL__SHIFT                                            0x0
+#define ODM0_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL_MASK                                              0x7FFFFFFFL
+//ODM0_OPTC_WIDTH_CONTROL
+#define ODM0_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH__SHIFT                                                    0x0
+#define ODM0_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH__SHIFT                                                  0x10
+#define ODM0_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH_MASK                                                      0x00001FFFL
+#define ODM0_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH_MASK                                                    0x1FFF0000L
+//ODM0_OPTC_WIDTH_CONTROL2
+#define ODM0_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST__SHIFT                                              0x0
+#define ODM0_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST_MASK                                                0x00001FFFL
+//ODM0_OPTC_INPUT_CLOCK_CONTROL
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS__SHIFT                                         0x0
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN__SHIFT                                               0x1
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON__SHIFT                                               0x2
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS_MASK                                           0x00000001L
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN_MASK                                                 0x00000002L
+#define ODM0_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON_MASK                                                 0x00000004L
+//ODM0_OPTC_MEMORY_CONFIG
+#define ODM0_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL__SHIFT                                                          0x0
+#define ODM0_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS__SHIFT                                                   0x10
+#define ODM0_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_MASK                                                            0x0000FFFFL
+#define ODM0_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS_MASK                                                     0xFFFF0000L
+//ODM0_OPTC_INPUT_TEST_DEBUG_INDEX
+#define ODM0_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX__SHIFT                                  0x0
+#define ODM0_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX_MASK                                    0x000000FFL
+//ODM0_OPTC_INPUT_TEST_DEBUG_DATA
+#define ODM0_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA__SHIFT                                    0x0
+#define ODM0_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA_MASK                                      0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_odm1_dispdec
+//ODM1_OPTC_INPUT_GLOBAL_CONTROL
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET__SHIFT                                          0x0
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN__SHIFT                                          0x8
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS__SHIFT                                 0xa
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS__SHIFT                                      0xb
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR__SHIFT                                           0xc
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT__SHIFT                                0xd
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING__SHIFT                                     0x1f
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET_MASK                                            0x00000001L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN_MASK                                            0x00000100L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS_MASK                                   0x00000400L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS_MASK                                        0x00000800L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR_MASK                                             0x00001000L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT_MASK                                  0x00002000L
+#define ODM1_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING_MASK                                       0x80000000L
+//ODM1_OPTC_RSMU_UNDERFLOW
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN__SHIFT                                           0x0
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS__SHIFT                                  0x1
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS__SHIFT                                       0x2
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR__SHIFT                                            0x3
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN_MASK                                             0x00000001L
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS_MASK                                    0x00000002L
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS_MASK                                         0x00000004L
+#define ODM1_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR_MASK                                              0x00000008L
+//ODM1_OPTC_UNDERFLOW_THRESHOLD
+#define ODM1_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD__SHIFT                                        0x0
+#define ODM1_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD_MASK                                          0x01FFFFFFL
+//ODM1_OPTC_DATA_SOURCE_SELECT
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT__SHIFT                                        0x0
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT__SHIFT                                       0x8
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL__SHIFT                                                0x10
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL__SHIFT                                                0x14
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL__SHIFT                                                0x18
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL__SHIFT                                                0x1c
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT_MASK                                          0x00000003L
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT_MASK                                         0x00000300L
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL_MASK                                                  0x000F0000L
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL_MASK                                                  0x00F00000L
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL_MASK                                                  0x0F000000L
+#define ODM1_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL_MASK                                                  0xF0000000L
+//ODM1_OPTC_DATA_FORMAT_CONTROL
+#define ODM1_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT__SHIFT                                                0x0
+#define ODM1_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE__SHIFT                                                   0x4
+#define ODM1_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT_MASK                                                  0x00000003L
+#define ODM1_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE_MASK                                                     0x00000030L
+//ODM1_OPTC_BYTES_PER_PIXEL
+#define ODM1_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL__SHIFT                                            0x0
+#define ODM1_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL_MASK                                              0x7FFFFFFFL
+//ODM1_OPTC_WIDTH_CONTROL
+#define ODM1_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH__SHIFT                                                    0x0
+#define ODM1_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH__SHIFT                                                  0x10
+#define ODM1_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH_MASK                                                      0x00001FFFL
+#define ODM1_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH_MASK                                                    0x1FFF0000L
+//ODM1_OPTC_WIDTH_CONTROL2
+#define ODM1_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST__SHIFT                                              0x0
+#define ODM1_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST_MASK                                                0x00001FFFL
+//ODM1_OPTC_INPUT_CLOCK_CONTROL
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS__SHIFT                                         0x0
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN__SHIFT                                               0x1
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON__SHIFT                                               0x2
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS_MASK                                           0x00000001L
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN_MASK                                                 0x00000002L
+#define ODM1_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON_MASK                                                 0x00000004L
+//ODM1_OPTC_MEMORY_CONFIG
+#define ODM1_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL__SHIFT                                                          0x0
+#define ODM1_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS__SHIFT                                                   0x10
+#define ODM1_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_MASK                                                            0x0000FFFFL
+#define ODM1_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS_MASK                                                     0xFFFF0000L
+//ODM1_OPTC_INPUT_TEST_DEBUG_INDEX
+#define ODM1_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX__SHIFT                                  0x0
+#define ODM1_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX_MASK                                    0x000000FFL
+//ODM1_OPTC_INPUT_TEST_DEBUG_DATA
+#define ODM1_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA__SHIFT                                    0x0
+#define ODM1_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA_MASK                                      0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_odm2_dispdec
+//ODM2_OPTC_INPUT_GLOBAL_CONTROL
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET__SHIFT                                          0x0
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN__SHIFT                                          0x8
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS__SHIFT                                 0xa
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS__SHIFT                                      0xb
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR__SHIFT                                           0xc
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT__SHIFT                                0xd
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING__SHIFT                                     0x1f
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET_MASK                                            0x00000001L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN_MASK                                            0x00000100L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS_MASK                                   0x00000400L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS_MASK                                        0x00000800L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR_MASK                                             0x00001000L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT_MASK                                  0x00002000L
+#define ODM2_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING_MASK                                       0x80000000L
+//ODM2_OPTC_RSMU_UNDERFLOW
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN__SHIFT                                           0x0
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS__SHIFT                                  0x1
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS__SHIFT                                       0x2
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR__SHIFT                                            0x3
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN_MASK                                             0x00000001L
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS_MASK                                    0x00000002L
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS_MASK                                         0x00000004L
+#define ODM2_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR_MASK                                              0x00000008L
+//ODM2_OPTC_UNDERFLOW_THRESHOLD
+#define ODM2_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD__SHIFT                                        0x0
+#define ODM2_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD_MASK                                          0x01FFFFFFL
+//ODM2_OPTC_DATA_SOURCE_SELECT
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT__SHIFT                                        0x0
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT__SHIFT                                       0x8
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL__SHIFT                                                0x10
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL__SHIFT                                                0x14
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL__SHIFT                                                0x18
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL__SHIFT                                                0x1c
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT_MASK                                          0x00000003L
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT_MASK                                         0x00000300L
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL_MASK                                                  0x000F0000L
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL_MASK                                                  0x00F00000L
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL_MASK                                                  0x0F000000L
+#define ODM2_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL_MASK                                                  0xF0000000L
+//ODM2_OPTC_DATA_FORMAT_CONTROL
+#define ODM2_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT__SHIFT                                                0x0
+#define ODM2_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE__SHIFT                                                   0x4
+#define ODM2_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT_MASK                                                  0x00000003L
+#define ODM2_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE_MASK                                                     0x00000030L
+//ODM2_OPTC_BYTES_PER_PIXEL
+#define ODM2_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL__SHIFT                                            0x0
+#define ODM2_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL_MASK                                              0x7FFFFFFFL
+//ODM2_OPTC_WIDTH_CONTROL
+#define ODM2_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH__SHIFT                                                    0x0
+#define ODM2_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH__SHIFT                                                  0x10
+#define ODM2_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH_MASK                                                      0x00001FFFL
+#define ODM2_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH_MASK                                                    0x1FFF0000L
+//ODM2_OPTC_WIDTH_CONTROL2
+#define ODM2_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST__SHIFT                                              0x0
+#define ODM2_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST_MASK                                                0x00001FFFL
+//ODM2_OPTC_INPUT_CLOCK_CONTROL
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS__SHIFT                                         0x0
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN__SHIFT                                               0x1
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON__SHIFT                                               0x2
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS_MASK                                           0x00000001L
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN_MASK                                                 0x00000002L
+#define ODM2_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON_MASK                                                 0x00000004L
+//ODM2_OPTC_MEMORY_CONFIG
+#define ODM2_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL__SHIFT                                                          0x0
+#define ODM2_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS__SHIFT                                                   0x10
+#define ODM2_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_MASK                                                            0x0000FFFFL
+#define ODM2_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS_MASK                                                     0xFFFF0000L
+//ODM2_OPTC_INPUT_TEST_DEBUG_INDEX
+#define ODM2_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX__SHIFT                                  0x0
+#define ODM2_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX_MASK                                    0x000000FFL
+//ODM2_OPTC_INPUT_TEST_DEBUG_DATA
+#define ODM2_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA__SHIFT                                    0x0
+#define ODM2_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA_MASK                                      0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_odm3_dispdec
+//ODM3_OPTC_INPUT_GLOBAL_CONTROL
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET__SHIFT                                          0x0
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN__SHIFT                                          0x8
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS__SHIFT                                 0xa
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS__SHIFT                                      0xb
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR__SHIFT                                           0xc
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT__SHIFT                                0xd
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING__SHIFT                                     0x1f
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_INPUT_SOFT_RESET_MASK                                            0x00000001L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_EN_MASK                                            0x00000100L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_STATUS_MASK                                   0x00000400L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_INT_STATUS_MASK                                        0x00000800L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_CLEAR_MASK                                             0x00001000L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_UNDERFLOW_OCCURRED_CURRENT_MASK                                  0x00002000L
+#define ODM3_OPTC_INPUT_GLOBAL_CONTROL__OPTC_DOUBLE_BUFFER_PENDING_MASK                                       0x80000000L
+//ODM3_OPTC_RSMU_UNDERFLOW
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN__SHIFT                                           0x0
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS__SHIFT                                  0x1
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS__SHIFT                                       0x2
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR__SHIFT                                            0x3
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_EN_MASK                                             0x00000001L
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_OCCURRED_STATUS_MASK                                    0x00000002L
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_INT_STATUS_MASK                                         0x00000004L
+#define ODM3_OPTC_RSMU_UNDERFLOW__OPTC_RSMU_UNDERFLOW_CLEAR_MASK                                              0x00000008L
+//ODM3_OPTC_UNDERFLOW_THRESHOLD
+#define ODM3_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD__SHIFT                                        0x0
+#define ODM3_OPTC_UNDERFLOW_THRESHOLD__OPTC_UNDERFLOW_THRESHOLD_MASK                                          0x01FFFFFFL
+//ODM3_OPTC_DATA_SOURCE_SELECT
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT__SHIFT                                        0x0
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT__SHIFT                                       0x8
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL__SHIFT                                                0x10
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL__SHIFT                                                0x14
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL__SHIFT                                                0x18
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL__SHIFT                                                0x1c
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_INPUT_SEGMENT_MASK                                          0x00000003L
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_NUM_OF_OUTPUT_SEGMENT_MASK                                         0x00000300L
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG0_SRC_SEL_MASK                                                  0x000F0000L
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG1_SRC_SEL_MASK                                                  0x00F00000L
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG2_SRC_SEL_MASK                                                  0x0F000000L
+#define ODM3_OPTC_DATA_SOURCE_SELECT__OPTC_SEG3_SRC_SEL_MASK                                                  0xF0000000L
+//ODM3_OPTC_DATA_FORMAT_CONTROL
+#define ODM3_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT__SHIFT                                                0x0
+#define ODM3_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE__SHIFT                                                   0x4
+#define ODM3_OPTC_DATA_FORMAT_CONTROL__OPTC_DATA_FORMAT_MASK                                                  0x00000003L
+#define ODM3_OPTC_DATA_FORMAT_CONTROL__OPTC_DSC_MODE_MASK                                                     0x00000030L
+//ODM3_OPTC_BYTES_PER_PIXEL
+#define ODM3_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL__SHIFT                                            0x0
+#define ODM3_OPTC_BYTES_PER_PIXEL__OPTC_DSC_BYTES_PER_PIXEL_MASK                                              0x7FFFFFFFL
+//ODM3_OPTC_WIDTH_CONTROL
+#define ODM3_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH__SHIFT                                                    0x0
+#define ODM3_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH__SHIFT                                                  0x10
+#define ODM3_OPTC_WIDTH_CONTROL__OPTC_SEGMENT_WIDTH_MASK                                                      0x00001FFFL
+#define ODM3_OPTC_WIDTH_CONTROL__OPTC_DSC_SLICE_WIDTH_MASK                                                    0x1FFF0000L
+//ODM3_OPTC_WIDTH_CONTROL2
+#define ODM3_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST__SHIFT                                              0x0
+#define ODM3_OPTC_WIDTH_CONTROL2__OPTC_SEGMENT_WIDTH_LAST_MASK                                                0x00001FFFL
+//ODM3_OPTC_INPUT_CLOCK_CONTROL
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS__SHIFT                                         0x0
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN__SHIFT                                               0x1
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON__SHIFT                                               0x2
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_GATE_DIS_MASK                                           0x00000001L
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_EN_MASK                                                 0x00000002L
+#define ODM3_OPTC_INPUT_CLOCK_CONTROL__OPTC_INPUT_CLK_ON_MASK                                                 0x00000004L
+//ODM3_OPTC_MEMORY_CONFIG
+#define ODM3_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL__SHIFT                                                          0x0
+#define ODM3_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS__SHIFT                                                   0x10
+#define ODM3_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_MASK                                                            0x0000FFFFL
+#define ODM3_OPTC_MEMORY_CONFIG__OPTC_MEM_SEL_STATUS_MASK                                                     0xFFFF0000L
+//ODM3_OPTC_INPUT_TEST_DEBUG_INDEX
+#define ODM3_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX__SHIFT                                  0x0
+#define ODM3_OPTC_INPUT_TEST_DEBUG_INDEX__OPTC_INPUT_TEST_DEBUG_INDEX_MASK                                    0x000000FFL
+//ODM3_OPTC_INPUT_TEST_DEBUG_DATA
+#define ODM3_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA__SHIFT                                    0x0
+#define ODM3_OPTC_INPUT_TEST_DEBUG_DATA__OPTC_INPUT_TEST_DEBUG_DATA_MASK                                      0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_otg0_dispdec
+//OTG0_OTG_H_TOTAL
+#define OTG0_OTG_H_TOTAL__OTG_H_TOTAL__SHIFT                                                                  0x0
+#define OTG0_OTG_H_TOTAL__OTG_H_TOTAL_MASK                                                                    0x00007FFFL
+//OTG0_OTG_H_BLANK_START_END
+#define OTG0_OTG_H_BLANK_START_END__OTG_H_BLANK_START__SHIFT                                                  0x0
+#define OTG0_OTG_H_BLANK_START_END__OTG_H_BLANK_END__SHIFT                                                    0x10
+#define OTG0_OTG_H_BLANK_START_END__OTG_H_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG0_OTG_H_BLANK_START_END__OTG_H_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG0_OTG_H_SYNC_A
+#define OTG0_OTG_H_SYNC_A__OTG_H_SYNC_A_START__SHIFT                                                          0x0
+#define OTG0_OTG_H_SYNC_A__OTG_H_SYNC_A_END__SHIFT                                                            0x10
+#define OTG0_OTG_H_SYNC_A__OTG_H_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG0_OTG_H_SYNC_A__OTG_H_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG0_OTG_H_SYNC_A_CNTL
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN__SHIFT                                                     0x10
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF__SHIFT                                                    0x11
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN_MASK                                                       0x00010000L
+#define OTG0_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF_MASK                                                      0x00020000L
+//OTG0_OTG_H_TIMING_CNTL
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE__SHIFT                                                  0x0
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL__SHIFT                                           0x8
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR__SHIFT                                             0x10
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MASK                                                    0x00000003L
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL_MASK                                             0x00000100L
+#define OTG0_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR_MASK                                               0x00030000L
+//OTG0_OTG_V_TOTAL
+#define OTG0_OTG_V_TOTAL__OTG_V_TOTAL__SHIFT                                                                  0x0
+#define OTG0_OTG_V_TOTAL__OTG_V_TOTAL_MASK                                                                    0x00007FFFL
+//OTG0_OTG_V_TOTAL_MIN
+#define OTG0_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN__SHIFT                                                          0x0
+#define OTG0_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN_MASK                                                            0x00007FFFL
+//OTG0_OTG_V_TOTAL_MAX
+#define OTG0_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX__SHIFT                                                          0x0
+#define OTG0_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX_MASK                                                            0x00007FFFL
+//OTG0_OTG_V_TOTAL_MID
+#define OTG0_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID__SHIFT                                                          0x0
+#define OTG0_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID_MASK                                                            0x00007FFFL
+//OTG0_OTG_V_TOTAL_CONTROL
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL__SHIFT                                                  0x0
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL__SHIFT                                                  0x1
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN__SHIFT                                      0x2
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN__SHIFT                                      0x3
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT__SHIFT                                              0x4
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE__SHIFT                                0x5
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM__SHIFT                                             0x8
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK__SHIFT                                             0x10
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL_MASK                                                    0x00000001L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL_MASK                                                    0x00000002L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN_MASK                                        0x00000004L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN_MASK                                        0x00000008L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT_MASK                                                0x00000010L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE_MASK                                  0x00000020L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM_MASK                                               0x0000FF00L
+#define OTG0_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK_MASK                                               0xFFFF0000L
+//OTG0_OTG_V_COUNT_STOP_CONTROL
+#define OTG0_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP__SHIFT                                                0x0
+#define OTG0_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP_MASK                                                  0x00007FFFL
+//OTG0_OTG_V_COUNT_STOP_CONTROL2
+#define OTG0_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER__SHIFT                                         0x0
+#define OTG0_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER_MASK                                           0xFFFFFFFFL
+//OTG0_OTG_V_TOTAL_INT_STATUS
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED__SHIFT                                0x0
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT__SHIFT                            0x4
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK__SHIFT                            0x8
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK__SHIFT                            0xc
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MASK                                  0x00000001L
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT_MASK                              0x00000010L
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK_MASK                              0x00000100L
+#define OTG0_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK_MASK                              0x00001000L
+//OTG0_OTG_VSYNC_NOM_INT_STATUS
+#define OTG0_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM__SHIFT                                                   0x0
+#define OTG0_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR__SHIFT                                         0x4
+#define OTG0_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_MASK                                                     0x00000001L
+#define OTG0_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR_MASK                                           0x00000010L
+//OTG0_OTG_V_BLANK_START_END
+#define OTG0_OTG_V_BLANK_START_END__OTG_V_BLANK_START__SHIFT                                                  0x0
+#define OTG0_OTG_V_BLANK_START_END__OTG_V_BLANK_END__SHIFT                                                    0x10
+#define OTG0_OTG_V_BLANK_START_END__OTG_V_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG0_OTG_V_BLANK_START_END__OTG_V_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG0_OTG_V_SYNC_A
+#define OTG0_OTG_V_SYNC_A__OTG_V_SYNC_A_START__SHIFT                                                          0x0
+#define OTG0_OTG_V_SYNC_A__OTG_V_SYNC_A_END__SHIFT                                                            0x10
+#define OTG0_OTG_V_SYNC_A__OTG_V_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG0_OTG_V_SYNC_A__OTG_V_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG0_OTG_V_SYNC_A_CNTL
+#define OTG0_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG0_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE__SHIFT                                                        0x8
+#define OTG0_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG0_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE_MASK                                                          0x00000100L
+//OTG0_OTG_TRIGA_CNTL
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED__SHIFT                                                        0xe
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY__SHIFT                                                           0x18
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR__SHIFT                                                           0x1f
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED_MASK                                                          0x00004000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY_MASK                                                             0x1F000000L
+#define OTG0_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR_MASK                                                             0x80000000L
+//OTG0_OTG_TRIGA_MANUAL_TRIG
+#define OTG0_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG0_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG0_OTG_TRIGB_CNTL
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED__SHIFT                                                        0xe
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY__SHIFT                                                           0x18
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR__SHIFT                                                           0x1f
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED_MASK                                                          0x00004000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY_MASK                                                             0x1F000000L
+#define OTG0_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR_MASK                                                             0x80000000L
+//OTG0_OTG_TRIGB_MANUAL_TRIG
+#define OTG0_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG0_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG0_OTG_FORCE_COUNT_NOW_CNTL
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE__SHIFT                                        0x0
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK__SHIFT                                       0x4
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL__SHIFT                                    0x8
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED__SHIFT                                    0x10
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR__SHIFT                                       0x18
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE_MASK                                          0x00000003L
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK_MASK                                         0x00000010L
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL_MASK                                      0x00000100L
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED_MASK                                      0x00010000L
+#define OTG0_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR_MASK                                         0x01000000L
+//OTG0_OTG_FLOW_CONTROL
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT__SHIFT                                          0x0
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY__SHIFT                                               0x8
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY__SHIFT                                            0x10
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS__SHIFT                                           0x18
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT_MASK                                            0x0000001FL
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY_MASK                                                 0x00000100L
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY_MASK                                              0x00010000L
+#define OTG0_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS_MASK                                             0x01000000L
+//OTG0_OTG_STEREO_FORCE_NEXT_EYE
+#define OTG0_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE__SHIFT                                      0x0
+#define OTG0_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE_MASK                                        0x00000003L
+//OTG0_OTG_CONTROL
+#define OTG0_OTG_CONTROL__OTG_MASTER_EN__SHIFT                                                                0x0
+#define OTG0_OTG_CONTROL__OTG_DISABLE_POINT_CNTL__SHIFT                                                       0x8
+#define OTG0_OTG_CONTROL__OTG_START_POINT_CNTL__SHIFT                                                         0xc
+#define OTG0_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL__SHIFT                                                        0xd
+#define OTG0_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY__SHIFT                                                    0xe
+#define OTG0_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE__SHIFT                                                  0x10
+#define OTG0_OTG_CONTROL__OTG_OUT_MUX__SHIFT                                                                  0x14
+#define OTG0_OTG_CONTROL__OTG_MASTER_EN_MASK                                                                  0x00000001L
+#define OTG0_OTG_CONTROL__OTG_DISABLE_POINT_CNTL_MASK                                                         0x00000300L
+#define OTG0_OTG_CONTROL__OTG_START_POINT_CNTL_MASK                                                           0x00001000L
+#define OTG0_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL_MASK                                                          0x00002000L
+#define OTG0_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY_MASK                                                      0x00004000L
+#define OTG0_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE_MASK                                                    0x00010000L
+#define OTG0_OTG_CONTROL__OTG_OUT_MUX_MASK                                                                    0x00300000L
+//OTG0_OTG_DLPC_CONTROL
+#define OTG0_OTG_DLPC_CONTROL__OTG_RESYNC_MODE__SHIFT                                                         0x0
+#define OTG0_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION__SHIFT                                              0x10
+#define OTG0_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT__SHIFT                                               0x1f
+#define OTG0_OTG_DLPC_CONTROL__OTG_RESYNC_MODE_MASK                                                           0x00000001L
+#define OTG0_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION_MASK                                                0x7FFF0000L
+#define OTG0_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT_MASK                                                 0x80000000L
+//OTG0_OTG_PIXEL_DATA_READBACK0
+#define OTG0_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB__SHIFT                                          0x0
+#define OTG0_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y__SHIFT                                          0x10
+#define OTG0_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB_MASK                                            0x0000FFFFL
+#define OTG0_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y_MASK                                            0xFFFF0000L
+//OTG0_OTG_PIXEL_DATA_READBACK1
+#define OTG0_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR__SHIFT                                           0x0
+#define OTG0_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR_MASK                                             0x0000FFFFL
+//OTG0_OTG_STATUS
+#define OTG0_OTG_STATUS__OTG_V_BLANK__SHIFT                                                                   0x0
+#define OTG0_OTG_STATUS__OTG_V_ACTIVE_DISP__SHIFT                                                             0x1
+#define OTG0_OTG_STATUS__OTG_V_SYNC_A__SHIFT                                                                  0x2
+#define OTG0_OTG_STATUS__OTG_V_UPDATE__SHIFT                                                                  0x3
+#define OTG0_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE__SHIFT                                                      0x5
+#define OTG0_OTG_STATUS__OTG_H_BLANK__SHIFT                                                                   0x10
+#define OTG0_OTG_STATUS__OTG_H_ACTIVE_DISP__SHIFT                                                             0x11
+#define OTG0_OTG_STATUS__OTG_H_SYNC_A__SHIFT                                                                  0x12
+#define OTG0_OTG_STATUS__OTG_V_BLANK_MASK                                                                     0x00000001L
+#define OTG0_OTG_STATUS__OTG_V_ACTIVE_DISP_MASK                                                               0x00000002L
+#define OTG0_OTG_STATUS__OTG_V_SYNC_A_MASK                                                                    0x00000004L
+#define OTG0_OTG_STATUS__OTG_V_UPDATE_MASK                                                                    0x00000008L
+#define OTG0_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE_MASK                                                        0x00000020L
+#define OTG0_OTG_STATUS__OTG_H_BLANK_MASK                                                                     0x00010000L
+#define OTG0_OTG_STATUS__OTG_H_ACTIVE_DISP_MASK                                                               0x00020000L
+#define OTG0_OTG_STATUS__OTG_H_SYNC_A_MASK                                                                    0x00040000L
+//OTG0_OTG_STATUS_POSITION
+#define OTG0_OTG_STATUS_POSITION__OTG_VERT_COUNT__SHIFT                                                       0x0
+#define OTG0_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK__SHIFT                                                 0xf
+#define OTG0_OTG_STATUS_POSITION__OTG_HORZ_COUNT__SHIFT                                                       0x10
+#define OTG0_OTG_STATUS_POSITION__OTG_VERT_COUNT_MASK                                                         0x00007FFFL
+#define OTG0_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK_MASK                                                   0x00008000L
+#define OTG0_OTG_STATUS_POSITION__OTG_HORZ_COUNT_MASK                                                         0x7FFF0000L
+//OTG0_OTG_LONG_VBLANK_STATUS
+#define OTG0_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT__SHIFT                                            0x0
+#define OTG0_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT_MASK                                              0xFFFFFFFFL
+//OTG0_OTG_NOM_VERT_POSITION
+#define OTG0_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM__SHIFT                                                 0x0
+#define OTG0_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM_MASK                                                   0x00007FFFL
+//OTG0_OTG_STATUS_FRAME_COUNT
+#define OTG0_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT__SHIFT                                                   0x0
+#define OTG0_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT_MASK                                                     0x00FFFFFFL
+//OTG0_OTG_STATUS_VF_COUNT
+#define OTG0_OTG_STATUS_VF_COUNT__OTG_VF_COUNT__SHIFT                                                         0x0
+#define OTG0_OTG_STATUS_VF_COUNT__OTG_VF_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG0_OTG_STATUS_HV_COUNT
+#define OTG0_OTG_STATUS_HV_COUNT__OTG_HV_COUNT__SHIFT                                                         0x0
+#define OTG0_OTG_STATUS_HV_COUNT__OTG_HV_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG0_OTG_COUNT_CONTROL
+#define OTG0_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN__SHIFT                                                  0x0
+#define OTG0_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT__SHIFT                                              0x1
+#define OTG0_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN_MASK                                                    0x00000001L
+#define OTG0_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT_MASK                                                0x0000001EL
+//OTG0_OTG_COUNT_RESET
+#define OTG0_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT__SHIFT                                                    0x0
+#define OTG0_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT_MASK                                                      0x00000001L
+//OTG0_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE
+#define OTG0_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__SHIFT                        0x0
+#define OTG0_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_MASK                          0x00000001L
+//OTG0_OTG_VERT_SYNC_CONTROL
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED__SHIFT                                 0x0
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR__SHIFT                                    0x8
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE__SHIFT                                          0x10
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED_MASK                                   0x00000001L
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR_MASK                                      0x00000100L
+#define OTG0_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE_MASK                                            0x00030000L
+//OTG0_OTG_STEREO_STATUS
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE__SHIFT                                                 0x0
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT__SHIFT                                                 0x8
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT__SHIFT                                                 0x10
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG__SHIFT                                                    0x14
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING__SHIFT                                      0x18
+#define OTG0_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE__SHIFT                                         0x1e
+#define OTG0_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE__SHIFT                                        0x1f
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE_MASK                                                   0x00000001L
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT_MASK                                                   0x00000100L
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT_MASK                                                   0x00010000L
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG_MASK                                                      0x00100000L
+#define OTG0_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING_MASK                                        0x03000000L
+#define OTG0_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE_MASK                                           0x40000000L
+#define OTG0_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE_MASK                                          0x80000000L
+//OTG0_OTG_STEREO_CONTROL
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM__SHIFT                                       0x0
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY__SHIFT                                       0xf
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY__SHIFT                                          0x11
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP__SHIFT                                  0x12
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM__SHIFT                                                 0x13
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX__SHIFT                                        0x14
+#define OTG0_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL__SHIFT                                                     0x15
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_EN__SHIFT                                                         0x18
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM_MASK                                         0x00007FFFL
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY_MASK                                         0x00008000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY_MASK                                            0x00020000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP_MASK                                    0x00040000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM_MASK                                                   0x00080000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX_MASK                                          0x00100000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL_MASK                                                       0x00200000L
+#define OTG0_OTG_STEREO_CONTROL__OTG_STEREO_EN_MASK                                                           0x01000000L
+//OTG0_OTG_SNAPSHOT_STATUS
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED__SHIFT                                                0x0
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR__SHIFT                                                   0x1
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER__SHIFT                                          0x2
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED_MASK                                                  0x00000001L
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR_MASK                                                     0x00000002L
+#define OTG0_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER_MASK                                            0x00000004L
+//OTG0_OTG_SNAPSHOT_CONTROL
+#define OTG0_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL__SHIFT                                          0x0
+#define OTG0_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL_MASK                                            0x00000003L
+//OTG0_OTG_SNAPSHOT_POSITION
+#define OTG0_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT__SHIFT                                            0x0
+#define OTG0_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT__SHIFT                                            0x10
+#define OTG0_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT_MASK                                              0x00007FFFL
+#define OTG0_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT_MASK                                              0x7FFF0000L
+//OTG0_OTG_SNAPSHOT_FRAME
+#define OTG0_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT__SHIFT                                              0x0
+#define OTG0_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT_MASK                                                0x00FFFFFFL
+//OTG0_OTG_INTERRUPT_CONTROL
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK__SHIFT                                               0x0
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE__SHIFT                                              0x1
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK__SHIFT                                        0x8
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE__SHIFT                                       0x9
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK__SHIFT                                  0x10
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE__SHIFT                                 0x11
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK__SHIFT                                                  0x18
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK__SHIFT                                                  0x19
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE__SHIFT                                                 0x1a
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE__SHIFT                                                 0x1b
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK__SHIFT                                              0x1c
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE__SHIFT                                             0x1d
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK__SHIFT                                          0x1e
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE__SHIFT                                         0x1f
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK_MASK                                                 0x00000001L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE_MASK                                                0x00000002L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK_MASK                                          0x00000100L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE_MASK                                         0x00000200L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK_MASK                                    0x00010000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE_MASK                                   0x00020000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK_MASK                                                    0x01000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK_MASK                                                    0x02000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE_MASK                                                   0x04000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE_MASK                                                   0x08000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK_MASK                                                0x10000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE_MASK                                               0x20000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK_MASK                                            0x40000000L
+#define OTG0_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE_MASK                                           0x80000000L
+//OTG0_OTG_UPDATE_LOCK
+#define OTG0_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK__SHIFT                                                          0x0
+#define OTG0_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK_MASK                                                            0x00000001L
+//OTG0_OTG_DOUBLE_BUFFER_CONTROL
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING__SHIFT                                             0x0
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING__SHIFT                             0x4
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING__SHIFT                                   0x5
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING__SHIFT                                  0x6
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING__SHIFT                          0x7
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY__SHIFT                                           0x8
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING__SHIFT                                 0x9
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE__SHIFT                                0x18
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING_MASK                                               0x00000001L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING_MASK                               0x00000010L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING_MASK                                     0x00000020L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING_MASK                                    0x00000040L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING_MASK                            0x00000080L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY_MASK                                             0x00000100L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING_MASK                                   0x00000200L
+#define OTG0_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE_MASK                                  0x03000000L
+//OTG0_OTG_MASTER_EN
+#define OTG0_OTG_MASTER_EN__OTG_MASTER_EN__SHIFT                                                              0x0
+#define OTG0_OTG_MASTER_EN__OTG_MASTER_EN_MASK                                                                0x00000001L
+//OTG0_OTG_VERTICAL_INTERRUPT0_POSITION
+#define OTG0_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START__SHIFT                      0x0
+#define OTG0_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END__SHIFT                        0x10
+#define OTG0_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START_MASK                        0x00007FFFL
+#define OTG0_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END_MASK                          0x7FFF0000L
+//OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY__SHIFT                  0x4
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE__SHIFT                       0x8
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS__SHIFT                           0xc
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS__SHIFT                       0x10
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR__SHIFT                            0x14
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE__SHIFT                         0x18
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS__SHIFT                                         0x1c
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY_MASK                    0x00000010L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE_MASK                         0x00000100L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS_MASK                             0x00001000L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS_MASK                         0x00010000L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR_MASK                              0x00100000L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE_MASK                           0x01000000L
+#define OTG0_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS_MASK                                           0x10000000L
+//OTG0_OTG_VERTICAL_INTERRUPT1_POSITION
+#define OTG0_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START__SHIFT                      0x0
+#define OTG0_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START_MASK                        0x00007FFFL
+//OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE__SHIFT                       0x8
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS__SHIFT                           0xc
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS__SHIFT                       0x10
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR__SHIFT                            0x14
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE__SHIFT                         0x18
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE_MASK                         0x00000100L
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS_MASK                             0x00001000L
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS_MASK                         0x00010000L
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR_MASK                              0x00100000L
+#define OTG0_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE_MASK                           0x01000000L
+//OTG0_OTG_VERTICAL_INTERRUPT2_POSITION
+#define OTG0_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START__SHIFT                      0x0
+#define OTG0_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START_MASK                        0x00007FFFL
+//OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE__SHIFT                       0x8
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS__SHIFT                           0xc
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS__SHIFT                       0x10
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR__SHIFT                            0x14
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE__SHIFT                         0x18
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE_MASK                         0x00000100L
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS_MASK                             0x00001000L
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS_MASK                         0x00010000L
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR_MASK                              0x00100000L
+#define OTG0_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE_MASK                           0x01000000L
+//OTG0_OTG_CRC_CNTL
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_EN__SHIFT                                                                  0x0
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN__SHIFT                                                        0x1
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_POLY_SEL__SHIFT                                                            0x2
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY__SHIFT                                                          0x3
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CONT_EN__SHIFT                                                             0x4
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL__SHIFT                                                   0x5
+#define OTG0_OTG_CRC_CNTL__OTG_CRC1_EN__SHIFT                                                                 0x7
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE__SHIFT                                                         0x8
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CONT_MODE__SHIFT                                                           0xa
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS__SHIFT                                         0x13
+#define OTG0_OTG_CRC_CNTL__OTG_CRC0_SELECT__SHIFT                                                             0x14
+#define OTG0_OTG_CRC_CNTL__OTG_CRC1_SELECT__SHIFT                                                             0x18
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING__SHIFT                                                   0x1c
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING__SHIFT                                                   0x1d
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING__SHIFT                                                   0x1e
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING__SHIFT                                                   0x1f
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_EN_MASK                                                                    0x00000001L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN_MASK                                                          0x00000002L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_POLY_SEL_MASK                                                              0x00000004L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY_MASK                                                            0x00000008L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CONT_EN_MASK                                                               0x00000010L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL_MASK                                                     0x00000060L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC1_EN_MASK                                                                   0x00000080L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE_MASK                                                           0x00000300L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_CONT_MODE_MASK                                                             0x00000400L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS_MASK                                           0x00080000L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC0_SELECT_MASK                                                               0x00700000L
+#define OTG0_OTG_CRC_CNTL__OTG_CRC1_SELECT_MASK                                                               0x07000000L
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING_MASK                                                     0x10000000L
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING_MASK                                                     0x20000000L
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING_MASK                                                     0x40000000L
+#define OTG0_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING_MASK                                                     0x80000000L
+//OTG0_OTG_CRC0_WINDOWA_X_CONTROL
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWA_Y_CONTROL
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWB_X_CONTROL
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWB_Y_CONTROL
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC0_DATA_R
+#define OTG0_OTG_CRC0_DATA_R__CRC0_R_CR__SHIFT                                                                0x0
+#define OTG0_OTG_CRC0_DATA_R__CRC0_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC0_DATA_G
+#define OTG0_OTG_CRC0_DATA_G__CRC0_G_Y__SHIFT                                                                 0x0
+#define OTG0_OTG_CRC0_DATA_G__CRC0_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG0_OTG_CRC0_DATA_B
+#define OTG0_OTG_CRC0_DATA_B__CRC0_B_CB__SHIFT                                                                0x0
+#define OTG0_OTG_CRC0_DATA_B__CRC0_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC0_DATA_C
+#define OTG0_OTG_CRC0_DATA_C__CRC0_C__SHIFT                                                                   0x0
+#define OTG0_OTG_CRC0_DATA_C__CRC0_C_MASK                                                                     0xFFFFFFFFL
+//OTG0_OTG_CRC1_WINDOWA_X_CONTROL
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWA_Y_CONTROL
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWB_X_CONTROL
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWB_Y_CONTROL
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG0_OTG_CRC1_DATA_R
+#define OTG0_OTG_CRC1_DATA_R__CRC1_R_CR__SHIFT                                                                0x0
+#define OTG0_OTG_CRC1_DATA_R__CRC1_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC1_DATA_G
+#define OTG0_OTG_CRC1_DATA_G__CRC1_G_Y__SHIFT                                                                 0x0
+#define OTG0_OTG_CRC1_DATA_G__CRC1_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG0_OTG_CRC1_DATA_B
+#define OTG0_OTG_CRC1_DATA_B__CRC1_B_CB__SHIFT                                                                0x0
+#define OTG0_OTG_CRC1_DATA_B__CRC1_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC1_DATA_C
+#define OTG0_OTG_CRC1_DATA_C__CRC1_C__SHIFT                                                                   0x0
+#define OTG0_OTG_CRC1_DATA_C__CRC1_C_MASK                                                                     0xFFFFFFFFL
+//OTG0_OTG_CRC2_DATA_R
+#define OTG0_OTG_CRC2_DATA_R__CRC2_R_CR__SHIFT                                                                0x0
+#define OTG0_OTG_CRC2_DATA_R__CRC2_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC2_DATA_G
+#define OTG0_OTG_CRC2_DATA_G__CRC2_G_Y__SHIFT                                                                 0x0
+#define OTG0_OTG_CRC2_DATA_G__CRC2_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG0_OTG_CRC2_DATA_B
+#define OTG0_OTG_CRC2_DATA_B__CRC2_B_CB__SHIFT                                                                0x0
+#define OTG0_OTG_CRC2_DATA_B__CRC2_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC2_DATA_C
+#define OTG0_OTG_CRC2_DATA_C__CRC2_C__SHIFT                                                                   0x0
+#define OTG0_OTG_CRC2_DATA_C__CRC2_C_MASK                                                                     0xFFFFFFFFL
+//OTG0_OTG_CRC3_DATA_R
+#define OTG0_OTG_CRC3_DATA_R__CRC3_R_CR__SHIFT                                                                0x0
+#define OTG0_OTG_CRC3_DATA_R__CRC3_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC3_DATA_G
+#define OTG0_OTG_CRC3_DATA_G__CRC3_G_Y__SHIFT                                                                 0x0
+#define OTG0_OTG_CRC3_DATA_G__CRC3_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG0_OTG_CRC3_DATA_B
+#define OTG0_OTG_CRC3_DATA_B__CRC3_B_CB__SHIFT                                                                0x0
+#define OTG0_OTG_CRC3_DATA_B__CRC3_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG0_OTG_CRC3_DATA_C
+#define OTG0_OTG_CRC3_DATA_C__CRC3_C__SHIFT                                                                   0x0
+#define OTG0_OTG_CRC3_DATA_C__CRC3_C_MASK                                                                     0xFFFFFFFFL
+//OTG0_OTG_CRC_SIG_RED_GREEN_MASK
+#define OTG0_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK__SHIFT                                          0x0
+#define OTG0_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK__SHIFT                                        0x10
+#define OTG0_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK_MASK                                            0x0000FFFFL
+#define OTG0_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK_MASK                                          0xFFFF0000L
+//OTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK
+#define OTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK__SHIFT                                      0x0
+#define OTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK__SHIFT                                   0x10
+#define OTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK_MASK                                        0x0000FFFFL
+#define OTG0_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK_MASK                                     0xFFFF0000L
+//OTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG0_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG0_OTG_STATIC_SCREEN_CONTROL
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK__SHIFT                                   0x0
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT__SHIFT                                  0x10
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE__SHIFT                                          0x18
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS__SHIFT                                                  0x19
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS__SHIFT                                          0x1a
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR__SHIFT                                           0x1b
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE__SHIFT                                            0x1c
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE__SHIFT                                     0x1e
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE__SHIFT                               0x1f
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK_MASK                                     0x0000FFFFL
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT_MASK                                    0x00FF0000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE_MASK                                            0x01000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS_MASK                                                    0x02000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS_MASK                                            0x04000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR_MASK                                             0x08000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE_MASK                                              0x10000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_MASK                                       0x40000000L
+#define OTG0_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE_MASK                                 0x80000000L
+//OTG0_OTG_3D_STRUCTURE_CONTROL
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN__SHIFT                                             0x0
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE__SHIFT                                  0x8
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR__SHIFT                                 0xc
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET__SHIFT                                  0x10
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING__SHIFT                          0x11
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT__SHIFT                                        0x12
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN_MASK                                               0x00000001L
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE_MASK                                    0x00000300L
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR_MASK                                   0x00001000L
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_MASK                                    0x00010000L
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING_MASK                            0x00020000L
+#define OTG0_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_MASK                                          0x000C0000L
+//OTG0_OTG_CLOCK_CONTROL
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_EN__SHIFT                                                           0x0
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS__SHIFT                                                     0x1
+#define OTG0_OTG_CLOCK_CONTROL__OTG_SOFT_RESET__SHIFT                                                         0x4
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_ON__SHIFT                                                           0x8
+#define OTG0_OTG_CLOCK_CONTROL__OTG_BUSY__SHIFT                                                               0x10
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_EN_MASK                                                             0x00000001L
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS_MASK                                                       0x00000002L
+#define OTG0_OTG_CLOCK_CONTROL__OTG_SOFT_RESET_MASK                                                           0x00000010L
+#define OTG0_OTG_CLOCK_CONTROL__OTG_CLOCK_ON_MASK                                                             0x00000100L
+#define OTG0_OTG_CLOCK_CONTROL__OTG_BUSY_MASK                                                                 0x00010000L
+//OTG0_OTG_VSTARTUP_PARAM
+#define OTG0_OTG_VSTARTUP_PARAM__VSTARTUP_START__SHIFT                                                        0x0
+#define OTG0_OTG_VSTARTUP_PARAM__VSTARTUP_START_MASK                                                          0x000003FFL
+//OTG0_OTG_VUPDATE_PARAM
+#define OTG0_OTG_VUPDATE_PARAM__VUPDATE_OFFSET__SHIFT                                                         0x0
+#define OTG0_OTG_VUPDATE_PARAM__VUPDATE_WIDTH__SHIFT                                                          0x10
+#define OTG0_OTG_VUPDATE_PARAM__VUPDATE_OFFSET_MASK                                                           0x0000FFFFL
+#define OTG0_OTG_VUPDATE_PARAM__VUPDATE_WIDTH_MASK                                                            0x03FF0000L
+//OTG0_OTG_VREADY_PARAM
+#define OTG0_OTG_VREADY_PARAM__VREADY_OFFSET__SHIFT                                                           0x0
+#define OTG0_OTG_VREADY_PARAM__VREADY_OFFSET_MASK                                                             0x0000FFFFL
+//OTG0_OTG_GLOBAL_SYNC_STATUS
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN__SHIFT                                                   0x0
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE__SHIFT                                                 0x1
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED__SHIFT                                           0x2
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS__SHIFT                                               0x3
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR__SHIFT                                              0x4
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN__SHIFT                                                    0x5
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE__SHIFT                                                  0x6
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL__SHIFT                                          0x7
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED__SHIFT                                            0x8
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS__SHIFT                                                0x9
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR__SHIFT                                               0xa
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS__SHIFT                                                    0xb
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN__SHIFT                                            0xc
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE__SHIFT                                          0xd
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED__SHIFT                                    0xe
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS__SHIFT                                        0xf
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR__SHIFT                                       0x10
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS__SHIFT                                            0x11
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN__SHIFT                                                     0x12
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE__SHIFT                                                   0x13
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED__SHIFT                                             0x14
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS__SHIFT                                                 0x15
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR__SHIFT                                                0x16
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS__SHIFT                                              0x18
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS__SHIFT                                               0x19
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN_MASK                                                     0x00000001L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE_MASK                                                   0x00000002L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED_MASK                                             0x00000004L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS_MASK                                                 0x00000008L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR_MASK                                                0x00000010L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN_MASK                                                      0x00000020L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE_MASK                                                    0x00000040L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL_MASK                                            0x00000080L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED_MASK                                              0x00000100L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS_MASK                                                  0x00000200L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR_MASK                                                 0x00000400L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS_MASK                                                      0x00000800L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN_MASK                                              0x00001000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE_MASK                                            0x00002000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED_MASK                                      0x00004000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS_MASK                                          0x00008000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR_MASK                                         0x00010000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS_MASK                                              0x00020000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN_MASK                                                       0x00040000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE_MASK                                                     0x00080000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED_MASK                                               0x00100000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS_MASK                                                   0x00200000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR_MASK                                                  0x00400000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS_MASK                                                0x01000000L
+#define OTG0_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS_MASK                                                 0x02000000L
+//OTG0_OTG_MASTER_UPDATE_LOCK
+#define OTG0_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK__SHIFT                                            0x0
+#define OTG0_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS__SHIFT                                                0x8
+#define OTG0_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK_MASK                                              0x00000001L
+#define OTG0_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS_MASK                                                  0x00000100L
+//OTG0_OTG_GSL_CONTROL
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL0_EN__SHIFT                                                              0x0
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL1_EN__SHIFT                                                              0x1
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL2_EN__SHIFT                                                              0x2
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN__SHIFT                                                        0x3
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE__SHIFT                                                      0x4
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY__SHIFT                                                      0x8
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY__SHIFT                                                      0x10
+#define OTG0_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN__SHIFT                                            0x1f
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL0_EN_MASK                                                                0x00000001L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL1_EN_MASK                                                                0x00000002L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL2_EN_MASK                                                                0x00000004L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN_MASK                                                          0x00000008L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE_MASK                                                        0x00000030L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY_MASK                                                        0x00000F00L
+#define OTG0_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY_MASK                                                        0x001F0000L
+#define OTG0_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN_MASK                                              0x80000000L
+//OTG0_OTG_GSL_WINDOW_X
+#define OTG0_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X__SHIFT                                                  0x0
+#define OTG0_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X__SHIFT                                                    0x10
+#define OTG0_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X_MASK                                                    0x00007FFFL
+#define OTG0_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X_MASK                                                      0x7FFF0000L
+//OTG0_OTG_GSL_WINDOW_Y
+#define OTG0_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y__SHIFT                                                  0x0
+#define OTG0_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y__SHIFT                                                    0x10
+#define OTG0_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y_MASK                                                    0x00007FFFL
+#define OTG0_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y_MASK                                                      0x7FFF0000L
+//OTG0_OTG_VUPDATE_KEEPOUT
+#define OTG0_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET__SHIFT                      0x0
+#define OTG0_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET__SHIFT                        0x10
+#define OTG0_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN__SHIFT                            0x1f
+#define OTG0_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET_MASK                        0x0000FFFFL
+#define OTG0_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET_MASK                          0x03FF0000L
+#define OTG0_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN_MASK                              0x80000000L
+//OTG0_OTG_GLOBAL_CONTROL0
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X__SHIFT                                        0x0
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X__SHIFT                                          0x10
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN__SHIFT                                             0x1f
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X_MASK                                          0x00007FFFL
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X_MASK                                            0x7FFF0000L
+#define OTG0_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN_MASK                                               0x80000000L
+//OTG0_OTG_GLOBAL_CONTROL1
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y__SHIFT                                        0x0
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y__SHIFT                                          0x10
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE__SHIFT                                       0x1f
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y_MASK                                          0x00007FFFL
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y_MASK                                            0x7FFF0000L
+#define OTG0_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE_MASK                                         0x80000000L
+//OTG0_OTG_GLOBAL_CONTROL2
+#define OTG0_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN__SHIFT                                                0xa
+#define OTG0_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL__SHIFT                                              0x10
+#define OTG0_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL__SHIFT                                           0x19
+#define OTG0_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE__SHIFT                                            0x1e
+#define OTG0_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE__SHIFT                                                    0x1f
+#define OTG0_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN_MASK                                                  0x00000400L
+#define OTG0_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL_MASK                                                0x00070000L
+#define OTG0_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL_MASK                                             0x0E000000L
+#define OTG0_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE_MASK                                              0x40000000L
+#define OTG0_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE_MASK                                                      0x80000000L
+//OTG0_OTG_GLOBAL_CONTROL3
+#define OTG0_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL__SHIFT                                     0x4
+#define OTG0_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL__SHIFT                                                   0x14
+#define OTG0_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL_MASK                                       0x00000030L
+#define OTG0_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL_MASK                                                     0x00300000L
+//OTG0_OTG_GLOBAL_CONTROL4
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X__SHIFT                                                0x0
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y__SHIFT                                                0x10
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE__SHIFT                                               0x1f
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X_MASK                                                  0x00007FFFL
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y_MASK                                                  0x7FFF0000L
+#define OTG0_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE_MASK                                                 0x80000000L
+//OTG0_OTG_TRIG_MANUAL_CONTROL
+#define OTG0_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL__SHIFT                                              0x0
+#define OTG0_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL_MASK                                                0x00000001L
+//OTG0_OTG_MANUAL_FLOW_CONTROL
+#define OTG0_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL__SHIFT                                              0x0
+#define OTG0_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL_MASK                                                0x00000001L
+//OTG0_OTG_DRR_TIMING_INT_STATUS
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED__SHIFT                                 0x0
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT__SHIFT                             0x4
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR__SHIFT                           0x8
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK__SHIFT                         0xc
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE__SHIFT                        0xd
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED__SHIFT                                 0x10
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT__SHIFT                             0x14
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR__SHIFT                           0x18
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK__SHIFT                         0x1c
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE__SHIFT                        0x1d
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_MASK                                   0x00000001L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MASK                               0x00000010L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR_MASK                             0x00000100L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK_MASK                           0x00001000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE_MASK                          0x00002000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_MASK                                   0x00010000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MASK                               0x00100000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR_MASK                             0x01000000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK_MASK                           0x10000000L
+#define OTG0_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE_MASK                          0x20000000L
+//OTG0_OTG_DRR_V_TOTAL_REACH_RANGE
+#define OTG0_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE__SHIFT                            0x0
+#define OTG0_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE__SHIFT                            0x10
+#define OTG0_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE_MASK                              0x00007FFFL
+#define OTG0_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE_MASK                              0x7FFF0000L
+//OTG0_OTG_DRR_V_TOTAL_CHANGE
+#define OTG0_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT__SHIFT                                      0x0
+#define OTG0_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT_MASK                                        0x00007FFFL
+//OTG0_OTG_DRR_TRIGGER_WINDOW
+#define OTG0_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X__SHIFT                                    0x0
+#define OTG0_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X__SHIFT                                      0x10
+#define OTG0_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X_MASK                                      0x00007FFFL
+#define OTG0_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X_MASK                                        0x7FFF0000L
+//OTG0_OTG_DRR_CONTROL
+#define OTG0_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME__SHIFT                                                    0x0
+#define OTG0_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR__SHIFT                                             0x10
+#define OTG0_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME_MASK                                                      0x00000003L
+#define OTG0_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR_MASK                                               0x7FFF0000L
+//OTG0_OTG_DRR_CONTOL2
+#define OTG0_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR__SHIFT                                             0x0
+#define OTG0_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR_MASK                                               0xFFFFFFFFL
+//OTG0_OTG_M_CONST_DTO0
+#define OTG0_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE__SHIFT                                                   0x0
+#define OTG0_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE_MASK                                                     0xFFFFFFFFL
+//OTG0_OTG_M_CONST_DTO1
+#define OTG0_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO__SHIFT                                                  0x0
+#define OTG0_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO_MASK                                                    0xFFFFFFFFL
+//OTG0_OTG_PIPE_UPDATE_STATUS
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING__SHIFT                                                  0x0
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING__SHIFT                                         0x4
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING__SHIFT                                         0x8
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS__SHIFT                                        0x10
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING_MASK                                                    0x00000001L
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING_MASK                                           0x00000010L
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING_MASK                                           0x00000100L
+#define OTG0_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS_MASK                                          0x00010000L
+//OTG0_OTG_PSTATE_REGISTER
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START__SHIFT                                             0x0
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND__SHIFT                                                    0x10
+#define OTG0_OTG_PSTATE_REGISTER__OTG_UNBLANK__SHIFT                                                          0x14
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN__SHIFT                                           0x18
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START_MASK                                               0x00007FFFL
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND_MASK                                                      0x00010000L
+#define OTG0_OTG_PSTATE_REGISTER__OTG_UNBLANK_MASK                                                            0x00100000L
+#define OTG0_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN_MASK                                             0xFF000000L
+//OTG0_OTG_ENCRYPTION
+#define OTG0_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL__SHIFT                                             0x0
+#define OTG0_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE__SHIFT                                              0x4
+#define OTG0_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL_MASK                                               0x00000003L
+#define OTG0_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE_MASK                                                0x00000010L
+//OTG0_OTG_TEST_DEBUG_INDEX
+#define OTG0_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define OTG0_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define OTG0_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define OTG0_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//OTG0_OTG_TEST_DEBUG_DATA
+#define OTG0_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define OTG0_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_otg1_dispdec
+//OTG1_OTG_H_TOTAL
+#define OTG1_OTG_H_TOTAL__OTG_H_TOTAL__SHIFT                                                                  0x0
+#define OTG1_OTG_H_TOTAL__OTG_H_TOTAL_MASK                                                                    0x00007FFFL
+//OTG1_OTG_H_BLANK_START_END
+#define OTG1_OTG_H_BLANK_START_END__OTG_H_BLANK_START__SHIFT                                                  0x0
+#define OTG1_OTG_H_BLANK_START_END__OTG_H_BLANK_END__SHIFT                                                    0x10
+#define OTG1_OTG_H_BLANK_START_END__OTG_H_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG1_OTG_H_BLANK_START_END__OTG_H_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG1_OTG_H_SYNC_A
+#define OTG1_OTG_H_SYNC_A__OTG_H_SYNC_A_START__SHIFT                                                          0x0
+#define OTG1_OTG_H_SYNC_A__OTG_H_SYNC_A_END__SHIFT                                                            0x10
+#define OTG1_OTG_H_SYNC_A__OTG_H_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG1_OTG_H_SYNC_A__OTG_H_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG1_OTG_H_SYNC_A_CNTL
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN__SHIFT                                                     0x10
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF__SHIFT                                                    0x11
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN_MASK                                                       0x00010000L
+#define OTG1_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF_MASK                                                      0x00020000L
+//OTG1_OTG_H_TIMING_CNTL
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE__SHIFT                                                  0x0
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL__SHIFT                                           0x8
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR__SHIFT                                             0x10
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MASK                                                    0x00000003L
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL_MASK                                             0x00000100L
+#define OTG1_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR_MASK                                               0x00030000L
+//OTG1_OTG_V_TOTAL
+#define OTG1_OTG_V_TOTAL__OTG_V_TOTAL__SHIFT                                                                  0x0
+#define OTG1_OTG_V_TOTAL__OTG_V_TOTAL_MASK                                                                    0x00007FFFL
+//OTG1_OTG_V_TOTAL_MIN
+#define OTG1_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN__SHIFT                                                          0x0
+#define OTG1_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN_MASK                                                            0x00007FFFL
+//OTG1_OTG_V_TOTAL_MAX
+#define OTG1_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX__SHIFT                                                          0x0
+#define OTG1_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX_MASK                                                            0x00007FFFL
+//OTG1_OTG_V_TOTAL_MID
+#define OTG1_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID__SHIFT                                                          0x0
+#define OTG1_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID_MASK                                                            0x00007FFFL
+//OTG1_OTG_V_TOTAL_CONTROL
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL__SHIFT                                                  0x0
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL__SHIFT                                                  0x1
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN__SHIFT                                      0x2
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN__SHIFT                                      0x3
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT__SHIFT                                              0x4
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE__SHIFT                                0x5
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM__SHIFT                                             0x8
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK__SHIFT                                             0x10
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL_MASK                                                    0x00000001L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL_MASK                                                    0x00000002L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN_MASK                                        0x00000004L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN_MASK                                        0x00000008L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT_MASK                                                0x00000010L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE_MASK                                  0x00000020L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM_MASK                                               0x0000FF00L
+#define OTG1_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK_MASK                                               0xFFFF0000L
+//OTG1_OTG_V_COUNT_STOP_CONTROL
+#define OTG1_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP__SHIFT                                                0x0
+#define OTG1_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP_MASK                                                  0x00007FFFL
+//OTG1_OTG_V_COUNT_STOP_CONTROL2
+#define OTG1_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER__SHIFT                                         0x0
+#define OTG1_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER_MASK                                           0xFFFFFFFFL
+//OTG1_OTG_V_TOTAL_INT_STATUS
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED__SHIFT                                0x0
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT__SHIFT                            0x4
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK__SHIFT                            0x8
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK__SHIFT                            0xc
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MASK                                  0x00000001L
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT_MASK                              0x00000010L
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK_MASK                              0x00000100L
+#define OTG1_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK_MASK                              0x00001000L
+//OTG1_OTG_VSYNC_NOM_INT_STATUS
+#define OTG1_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM__SHIFT                                                   0x0
+#define OTG1_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR__SHIFT                                         0x4
+#define OTG1_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_MASK                                                     0x00000001L
+#define OTG1_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR_MASK                                           0x00000010L
+//OTG1_OTG_V_BLANK_START_END
+#define OTG1_OTG_V_BLANK_START_END__OTG_V_BLANK_START__SHIFT                                                  0x0
+#define OTG1_OTG_V_BLANK_START_END__OTG_V_BLANK_END__SHIFT                                                    0x10
+#define OTG1_OTG_V_BLANK_START_END__OTG_V_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG1_OTG_V_BLANK_START_END__OTG_V_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG1_OTG_V_SYNC_A
+#define OTG1_OTG_V_SYNC_A__OTG_V_SYNC_A_START__SHIFT                                                          0x0
+#define OTG1_OTG_V_SYNC_A__OTG_V_SYNC_A_END__SHIFT                                                            0x10
+#define OTG1_OTG_V_SYNC_A__OTG_V_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG1_OTG_V_SYNC_A__OTG_V_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG1_OTG_V_SYNC_A_CNTL
+#define OTG1_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG1_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE__SHIFT                                                        0x8
+#define OTG1_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG1_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE_MASK                                                          0x00000100L
+//OTG1_OTG_TRIGA_CNTL
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED__SHIFT                                                        0xe
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY__SHIFT                                                           0x18
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR__SHIFT                                                           0x1f
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED_MASK                                                          0x00004000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY_MASK                                                             0x1F000000L
+#define OTG1_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR_MASK                                                             0x80000000L
+//OTG1_OTG_TRIGA_MANUAL_TRIG
+#define OTG1_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG1_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG1_OTG_TRIGB_CNTL
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED__SHIFT                                                        0xe
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY__SHIFT                                                           0x18
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR__SHIFT                                                           0x1f
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED_MASK                                                          0x00004000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY_MASK                                                             0x1F000000L
+#define OTG1_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR_MASK                                                             0x80000000L
+//OTG1_OTG_TRIGB_MANUAL_TRIG
+#define OTG1_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG1_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG1_OTG_FORCE_COUNT_NOW_CNTL
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE__SHIFT                                        0x0
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK__SHIFT                                       0x4
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL__SHIFT                                    0x8
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED__SHIFT                                    0x10
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR__SHIFT                                       0x18
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE_MASK                                          0x00000003L
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK_MASK                                         0x00000010L
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL_MASK                                      0x00000100L
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED_MASK                                      0x00010000L
+#define OTG1_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR_MASK                                         0x01000000L
+//OTG1_OTG_FLOW_CONTROL
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT__SHIFT                                          0x0
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY__SHIFT                                               0x8
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY__SHIFT                                            0x10
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS__SHIFT                                           0x18
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT_MASK                                            0x0000001FL
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY_MASK                                                 0x00000100L
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY_MASK                                              0x00010000L
+#define OTG1_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS_MASK                                             0x01000000L
+//OTG1_OTG_STEREO_FORCE_NEXT_EYE
+#define OTG1_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE__SHIFT                                      0x0
+#define OTG1_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE_MASK                                        0x00000003L
+//OTG1_OTG_CONTROL
+#define OTG1_OTG_CONTROL__OTG_MASTER_EN__SHIFT                                                                0x0
+#define OTG1_OTG_CONTROL__OTG_DISABLE_POINT_CNTL__SHIFT                                                       0x8
+#define OTG1_OTG_CONTROL__OTG_START_POINT_CNTL__SHIFT                                                         0xc
+#define OTG1_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL__SHIFT                                                        0xd
+#define OTG1_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY__SHIFT                                                    0xe
+#define OTG1_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE__SHIFT                                                  0x10
+#define OTG1_OTG_CONTROL__OTG_OUT_MUX__SHIFT                                                                  0x14
+#define OTG1_OTG_CONTROL__OTG_MASTER_EN_MASK                                                                  0x00000001L
+#define OTG1_OTG_CONTROL__OTG_DISABLE_POINT_CNTL_MASK                                                         0x00000300L
+#define OTG1_OTG_CONTROL__OTG_START_POINT_CNTL_MASK                                                           0x00001000L
+#define OTG1_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL_MASK                                                          0x00002000L
+#define OTG1_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY_MASK                                                      0x00004000L
+#define OTG1_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE_MASK                                                    0x00010000L
+#define OTG1_OTG_CONTROL__OTG_OUT_MUX_MASK                                                                    0x00300000L
+//OTG1_OTG_DLPC_CONTROL
+#define OTG1_OTG_DLPC_CONTROL__OTG_RESYNC_MODE__SHIFT                                                         0x0
+#define OTG1_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION__SHIFT                                              0x10
+#define OTG1_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT__SHIFT                                               0x1f
+#define OTG1_OTG_DLPC_CONTROL__OTG_RESYNC_MODE_MASK                                                           0x00000001L
+#define OTG1_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION_MASK                                                0x7FFF0000L
+#define OTG1_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT_MASK                                                 0x80000000L
+//OTG1_OTG_PIXEL_DATA_READBACK0
+#define OTG1_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB__SHIFT                                          0x0
+#define OTG1_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y__SHIFT                                          0x10
+#define OTG1_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB_MASK                                            0x0000FFFFL
+#define OTG1_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y_MASK                                            0xFFFF0000L
+//OTG1_OTG_PIXEL_DATA_READBACK1
+#define OTG1_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR__SHIFT                                           0x0
+#define OTG1_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR_MASK                                             0x0000FFFFL
+//OTG1_OTG_STATUS
+#define OTG1_OTG_STATUS__OTG_V_BLANK__SHIFT                                                                   0x0
+#define OTG1_OTG_STATUS__OTG_V_ACTIVE_DISP__SHIFT                                                             0x1
+#define OTG1_OTG_STATUS__OTG_V_SYNC_A__SHIFT                                                                  0x2
+#define OTG1_OTG_STATUS__OTG_V_UPDATE__SHIFT                                                                  0x3
+#define OTG1_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE__SHIFT                                                      0x5
+#define OTG1_OTG_STATUS__OTG_H_BLANK__SHIFT                                                                   0x10
+#define OTG1_OTG_STATUS__OTG_H_ACTIVE_DISP__SHIFT                                                             0x11
+#define OTG1_OTG_STATUS__OTG_H_SYNC_A__SHIFT                                                                  0x12
+#define OTG1_OTG_STATUS__OTG_V_BLANK_MASK                                                                     0x00000001L
+#define OTG1_OTG_STATUS__OTG_V_ACTIVE_DISP_MASK                                                               0x00000002L
+#define OTG1_OTG_STATUS__OTG_V_SYNC_A_MASK                                                                    0x00000004L
+#define OTG1_OTG_STATUS__OTG_V_UPDATE_MASK                                                                    0x00000008L
+#define OTG1_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE_MASK                                                        0x00000020L
+#define OTG1_OTG_STATUS__OTG_H_BLANK_MASK                                                                     0x00010000L
+#define OTG1_OTG_STATUS__OTG_H_ACTIVE_DISP_MASK                                                               0x00020000L
+#define OTG1_OTG_STATUS__OTG_H_SYNC_A_MASK                                                                    0x00040000L
+//OTG1_OTG_STATUS_POSITION
+#define OTG1_OTG_STATUS_POSITION__OTG_VERT_COUNT__SHIFT                                                       0x0
+#define OTG1_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK__SHIFT                                                 0xf
+#define OTG1_OTG_STATUS_POSITION__OTG_HORZ_COUNT__SHIFT                                                       0x10
+#define OTG1_OTG_STATUS_POSITION__OTG_VERT_COUNT_MASK                                                         0x00007FFFL
+#define OTG1_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK_MASK                                                   0x00008000L
+#define OTG1_OTG_STATUS_POSITION__OTG_HORZ_COUNT_MASK                                                         0x7FFF0000L
+//OTG1_OTG_LONG_VBLANK_STATUS
+#define OTG1_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT__SHIFT                                            0x0
+#define OTG1_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT_MASK                                              0xFFFFFFFFL
+//OTG1_OTG_NOM_VERT_POSITION
+#define OTG1_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM__SHIFT                                                 0x0
+#define OTG1_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM_MASK                                                   0x00007FFFL
+//OTG1_OTG_STATUS_FRAME_COUNT
+#define OTG1_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT__SHIFT                                                   0x0
+#define OTG1_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT_MASK                                                     0x00FFFFFFL
+//OTG1_OTG_STATUS_VF_COUNT
+#define OTG1_OTG_STATUS_VF_COUNT__OTG_VF_COUNT__SHIFT                                                         0x0
+#define OTG1_OTG_STATUS_VF_COUNT__OTG_VF_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG1_OTG_STATUS_HV_COUNT
+#define OTG1_OTG_STATUS_HV_COUNT__OTG_HV_COUNT__SHIFT                                                         0x0
+#define OTG1_OTG_STATUS_HV_COUNT__OTG_HV_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG1_OTG_COUNT_CONTROL
+#define OTG1_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN__SHIFT                                                  0x0
+#define OTG1_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT__SHIFT                                              0x1
+#define OTG1_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN_MASK                                                    0x00000001L
+#define OTG1_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT_MASK                                                0x0000001EL
+//OTG1_OTG_COUNT_RESET
+#define OTG1_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT__SHIFT                                                    0x0
+#define OTG1_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT_MASK                                                      0x00000001L
+//OTG1_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE
+#define OTG1_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__SHIFT                        0x0
+#define OTG1_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_MASK                          0x00000001L
+//OTG1_OTG_VERT_SYNC_CONTROL
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED__SHIFT                                 0x0
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR__SHIFT                                    0x8
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE__SHIFT                                          0x10
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED_MASK                                   0x00000001L
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR_MASK                                      0x00000100L
+#define OTG1_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE_MASK                                            0x00030000L
+//OTG1_OTG_STEREO_STATUS
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE__SHIFT                                                 0x0
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT__SHIFT                                                 0x8
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT__SHIFT                                                 0x10
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG__SHIFT                                                    0x14
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING__SHIFT                                      0x18
+#define OTG1_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE__SHIFT                                         0x1e
+#define OTG1_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE__SHIFT                                        0x1f
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE_MASK                                                   0x00000001L
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT_MASK                                                   0x00000100L
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT_MASK                                                   0x00010000L
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG_MASK                                                      0x00100000L
+#define OTG1_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING_MASK                                        0x03000000L
+#define OTG1_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE_MASK                                           0x40000000L
+#define OTG1_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE_MASK                                          0x80000000L
+//OTG1_OTG_STEREO_CONTROL
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM__SHIFT                                       0x0
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY__SHIFT                                       0xf
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY__SHIFT                                          0x11
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP__SHIFT                                  0x12
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM__SHIFT                                                 0x13
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX__SHIFT                                        0x14
+#define OTG1_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL__SHIFT                                                     0x15
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_EN__SHIFT                                                         0x18
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM_MASK                                         0x00007FFFL
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY_MASK                                         0x00008000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY_MASK                                            0x00020000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP_MASK                                    0x00040000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM_MASK                                                   0x00080000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX_MASK                                          0x00100000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL_MASK                                                       0x00200000L
+#define OTG1_OTG_STEREO_CONTROL__OTG_STEREO_EN_MASK                                                           0x01000000L
+//OTG1_OTG_SNAPSHOT_STATUS
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED__SHIFT                                                0x0
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR__SHIFT                                                   0x1
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER__SHIFT                                          0x2
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED_MASK                                                  0x00000001L
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR_MASK                                                     0x00000002L
+#define OTG1_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER_MASK                                            0x00000004L
+//OTG1_OTG_SNAPSHOT_CONTROL
+#define OTG1_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL__SHIFT                                          0x0
+#define OTG1_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL_MASK                                            0x00000003L
+//OTG1_OTG_SNAPSHOT_POSITION
+#define OTG1_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT__SHIFT                                            0x0
+#define OTG1_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT__SHIFT                                            0x10
+#define OTG1_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT_MASK                                              0x00007FFFL
+#define OTG1_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT_MASK                                              0x7FFF0000L
+//OTG1_OTG_SNAPSHOT_FRAME
+#define OTG1_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT__SHIFT                                              0x0
+#define OTG1_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT_MASK                                                0x00FFFFFFL
+//OTG1_OTG_INTERRUPT_CONTROL
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK__SHIFT                                               0x0
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE__SHIFT                                              0x1
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK__SHIFT                                        0x8
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE__SHIFT                                       0x9
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK__SHIFT                                  0x10
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE__SHIFT                                 0x11
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK__SHIFT                                                  0x18
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK__SHIFT                                                  0x19
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE__SHIFT                                                 0x1a
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE__SHIFT                                                 0x1b
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK__SHIFT                                              0x1c
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE__SHIFT                                             0x1d
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK__SHIFT                                          0x1e
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE__SHIFT                                         0x1f
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK_MASK                                                 0x00000001L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE_MASK                                                0x00000002L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK_MASK                                          0x00000100L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE_MASK                                         0x00000200L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK_MASK                                    0x00010000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE_MASK                                   0x00020000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK_MASK                                                    0x01000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK_MASK                                                    0x02000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE_MASK                                                   0x04000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE_MASK                                                   0x08000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK_MASK                                                0x10000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE_MASK                                               0x20000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK_MASK                                            0x40000000L
+#define OTG1_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE_MASK                                           0x80000000L
+//OTG1_OTG_UPDATE_LOCK
+#define OTG1_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK__SHIFT                                                          0x0
+#define OTG1_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK_MASK                                                            0x00000001L
+//OTG1_OTG_DOUBLE_BUFFER_CONTROL
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING__SHIFT                                             0x0
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING__SHIFT                             0x4
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING__SHIFT                                   0x5
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING__SHIFT                                  0x6
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING__SHIFT                          0x7
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY__SHIFT                                           0x8
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING__SHIFT                                 0x9
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE__SHIFT                                0x18
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING_MASK                                               0x00000001L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING_MASK                               0x00000010L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING_MASK                                     0x00000020L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING_MASK                                    0x00000040L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING_MASK                            0x00000080L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY_MASK                                             0x00000100L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING_MASK                                   0x00000200L
+#define OTG1_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE_MASK                                  0x03000000L
+//OTG1_OTG_MASTER_EN
+#define OTG1_OTG_MASTER_EN__OTG_MASTER_EN__SHIFT                                                              0x0
+#define OTG1_OTG_MASTER_EN__OTG_MASTER_EN_MASK                                                                0x00000001L
+//OTG1_OTG_VERTICAL_INTERRUPT0_POSITION
+#define OTG1_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START__SHIFT                      0x0
+#define OTG1_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END__SHIFT                        0x10
+#define OTG1_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START_MASK                        0x00007FFFL
+#define OTG1_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END_MASK                          0x7FFF0000L
+//OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY__SHIFT                  0x4
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE__SHIFT                       0x8
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS__SHIFT                           0xc
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS__SHIFT                       0x10
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR__SHIFT                            0x14
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE__SHIFT                         0x18
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS__SHIFT                                         0x1c
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY_MASK                    0x00000010L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE_MASK                         0x00000100L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS_MASK                             0x00001000L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS_MASK                         0x00010000L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR_MASK                              0x00100000L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE_MASK                           0x01000000L
+#define OTG1_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS_MASK                                           0x10000000L
+//OTG1_OTG_VERTICAL_INTERRUPT1_POSITION
+#define OTG1_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START__SHIFT                      0x0
+#define OTG1_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START_MASK                        0x00007FFFL
+//OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE__SHIFT                       0x8
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS__SHIFT                           0xc
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS__SHIFT                       0x10
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR__SHIFT                            0x14
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE__SHIFT                         0x18
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE_MASK                         0x00000100L
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS_MASK                             0x00001000L
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS_MASK                         0x00010000L
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR_MASK                              0x00100000L
+#define OTG1_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE_MASK                           0x01000000L
+//OTG1_OTG_VERTICAL_INTERRUPT2_POSITION
+#define OTG1_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START__SHIFT                      0x0
+#define OTG1_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START_MASK                        0x00007FFFL
+//OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE__SHIFT                       0x8
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS__SHIFT                           0xc
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS__SHIFT                       0x10
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR__SHIFT                            0x14
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE__SHIFT                         0x18
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE_MASK                         0x00000100L
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS_MASK                             0x00001000L
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS_MASK                         0x00010000L
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR_MASK                              0x00100000L
+#define OTG1_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE_MASK                           0x01000000L
+//OTG1_OTG_CRC_CNTL
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_EN__SHIFT                                                                  0x0
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN__SHIFT                                                        0x1
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_POLY_SEL__SHIFT                                                            0x2
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY__SHIFT                                                          0x3
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CONT_EN__SHIFT                                                             0x4
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL__SHIFT                                                   0x5
+#define OTG1_OTG_CRC_CNTL__OTG_CRC1_EN__SHIFT                                                                 0x7
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE__SHIFT                                                         0x8
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CONT_MODE__SHIFT                                                           0xa
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS__SHIFT                                         0x13
+#define OTG1_OTG_CRC_CNTL__OTG_CRC0_SELECT__SHIFT                                                             0x14
+#define OTG1_OTG_CRC_CNTL__OTG_CRC1_SELECT__SHIFT                                                             0x18
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING__SHIFT                                                   0x1c
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING__SHIFT                                                   0x1d
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING__SHIFT                                                   0x1e
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING__SHIFT                                                   0x1f
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_EN_MASK                                                                    0x00000001L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN_MASK                                                          0x00000002L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_POLY_SEL_MASK                                                              0x00000004L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY_MASK                                                            0x00000008L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CONT_EN_MASK                                                               0x00000010L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL_MASK                                                     0x00000060L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC1_EN_MASK                                                                   0x00000080L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE_MASK                                                           0x00000300L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_CONT_MODE_MASK                                                             0x00000400L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS_MASK                                           0x00080000L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC0_SELECT_MASK                                                               0x00700000L
+#define OTG1_OTG_CRC_CNTL__OTG_CRC1_SELECT_MASK                                                               0x07000000L
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING_MASK                                                     0x10000000L
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING_MASK                                                     0x20000000L
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING_MASK                                                     0x40000000L
+#define OTG1_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING_MASK                                                     0x80000000L
+//OTG1_OTG_CRC0_WINDOWA_X_CONTROL
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWA_Y_CONTROL
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWB_X_CONTROL
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWB_Y_CONTROL
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC0_DATA_R
+#define OTG1_OTG_CRC0_DATA_R__CRC0_R_CR__SHIFT                                                                0x0
+#define OTG1_OTG_CRC0_DATA_R__CRC0_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC0_DATA_G
+#define OTG1_OTG_CRC0_DATA_G__CRC0_G_Y__SHIFT                                                                 0x0
+#define OTG1_OTG_CRC0_DATA_G__CRC0_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG1_OTG_CRC0_DATA_B
+#define OTG1_OTG_CRC0_DATA_B__CRC0_B_CB__SHIFT                                                                0x0
+#define OTG1_OTG_CRC0_DATA_B__CRC0_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC0_DATA_C
+#define OTG1_OTG_CRC0_DATA_C__CRC0_C__SHIFT                                                                   0x0
+#define OTG1_OTG_CRC0_DATA_C__CRC0_C_MASK                                                                     0xFFFFFFFFL
+//OTG1_OTG_CRC1_WINDOWA_X_CONTROL
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWA_Y_CONTROL
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWB_X_CONTROL
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWB_Y_CONTROL
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG1_OTG_CRC1_DATA_R
+#define OTG1_OTG_CRC1_DATA_R__CRC1_R_CR__SHIFT                                                                0x0
+#define OTG1_OTG_CRC1_DATA_R__CRC1_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC1_DATA_G
+#define OTG1_OTG_CRC1_DATA_G__CRC1_G_Y__SHIFT                                                                 0x0
+#define OTG1_OTG_CRC1_DATA_G__CRC1_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG1_OTG_CRC1_DATA_B
+#define OTG1_OTG_CRC1_DATA_B__CRC1_B_CB__SHIFT                                                                0x0
+#define OTG1_OTG_CRC1_DATA_B__CRC1_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC1_DATA_C
+#define OTG1_OTG_CRC1_DATA_C__CRC1_C__SHIFT                                                                   0x0
+#define OTG1_OTG_CRC1_DATA_C__CRC1_C_MASK                                                                     0xFFFFFFFFL
+//OTG1_OTG_CRC2_DATA_R
+#define OTG1_OTG_CRC2_DATA_R__CRC2_R_CR__SHIFT                                                                0x0
+#define OTG1_OTG_CRC2_DATA_R__CRC2_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC2_DATA_G
+#define OTG1_OTG_CRC2_DATA_G__CRC2_G_Y__SHIFT                                                                 0x0
+#define OTG1_OTG_CRC2_DATA_G__CRC2_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG1_OTG_CRC2_DATA_B
+#define OTG1_OTG_CRC2_DATA_B__CRC2_B_CB__SHIFT                                                                0x0
+#define OTG1_OTG_CRC2_DATA_B__CRC2_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC2_DATA_C
+#define OTG1_OTG_CRC2_DATA_C__CRC2_C__SHIFT                                                                   0x0
+#define OTG1_OTG_CRC2_DATA_C__CRC2_C_MASK                                                                     0xFFFFFFFFL
+//OTG1_OTG_CRC3_DATA_R
+#define OTG1_OTG_CRC3_DATA_R__CRC3_R_CR__SHIFT                                                                0x0
+#define OTG1_OTG_CRC3_DATA_R__CRC3_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC3_DATA_G
+#define OTG1_OTG_CRC3_DATA_G__CRC3_G_Y__SHIFT                                                                 0x0
+#define OTG1_OTG_CRC3_DATA_G__CRC3_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG1_OTG_CRC3_DATA_B
+#define OTG1_OTG_CRC3_DATA_B__CRC3_B_CB__SHIFT                                                                0x0
+#define OTG1_OTG_CRC3_DATA_B__CRC3_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG1_OTG_CRC3_DATA_C
+#define OTG1_OTG_CRC3_DATA_C__CRC3_C__SHIFT                                                                   0x0
+#define OTG1_OTG_CRC3_DATA_C__CRC3_C_MASK                                                                     0xFFFFFFFFL
+//OTG1_OTG_CRC_SIG_RED_GREEN_MASK
+#define OTG1_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK__SHIFT                                          0x0
+#define OTG1_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK__SHIFT                                        0x10
+#define OTG1_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK_MASK                                            0x0000FFFFL
+#define OTG1_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK_MASK                                          0xFFFF0000L
+//OTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK
+#define OTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK__SHIFT                                      0x0
+#define OTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK__SHIFT                                   0x10
+#define OTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK_MASK                                        0x0000FFFFL
+#define OTG1_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK_MASK                                     0xFFFF0000L
+//OTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG1_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG1_OTG_STATIC_SCREEN_CONTROL
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK__SHIFT                                   0x0
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT__SHIFT                                  0x10
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE__SHIFT                                          0x18
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS__SHIFT                                                  0x19
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS__SHIFT                                          0x1a
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR__SHIFT                                           0x1b
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE__SHIFT                                            0x1c
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE__SHIFT                                     0x1e
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE__SHIFT                               0x1f
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK_MASK                                     0x0000FFFFL
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT_MASK                                    0x00FF0000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE_MASK                                            0x01000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS_MASK                                                    0x02000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS_MASK                                            0x04000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR_MASK                                             0x08000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE_MASK                                              0x10000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_MASK                                       0x40000000L
+#define OTG1_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE_MASK                                 0x80000000L
+//OTG1_OTG_3D_STRUCTURE_CONTROL
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN__SHIFT                                             0x0
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE__SHIFT                                  0x8
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR__SHIFT                                 0xc
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET__SHIFT                                  0x10
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING__SHIFT                          0x11
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT__SHIFT                                        0x12
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN_MASK                                               0x00000001L
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE_MASK                                    0x00000300L
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR_MASK                                   0x00001000L
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_MASK                                    0x00010000L
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING_MASK                            0x00020000L
+#define OTG1_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_MASK                                          0x000C0000L
+//OTG1_OTG_CLOCK_CONTROL
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_EN__SHIFT                                                           0x0
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS__SHIFT                                                     0x1
+#define OTG1_OTG_CLOCK_CONTROL__OTG_SOFT_RESET__SHIFT                                                         0x4
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_ON__SHIFT                                                           0x8
+#define OTG1_OTG_CLOCK_CONTROL__OTG_BUSY__SHIFT                                                               0x10
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_EN_MASK                                                             0x00000001L
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS_MASK                                                       0x00000002L
+#define OTG1_OTG_CLOCK_CONTROL__OTG_SOFT_RESET_MASK                                                           0x00000010L
+#define OTG1_OTG_CLOCK_CONTROL__OTG_CLOCK_ON_MASK                                                             0x00000100L
+#define OTG1_OTG_CLOCK_CONTROL__OTG_BUSY_MASK                                                                 0x00010000L
+//OTG1_OTG_VSTARTUP_PARAM
+#define OTG1_OTG_VSTARTUP_PARAM__VSTARTUP_START__SHIFT                                                        0x0
+#define OTG1_OTG_VSTARTUP_PARAM__VSTARTUP_START_MASK                                                          0x000003FFL
+//OTG1_OTG_VUPDATE_PARAM
+#define OTG1_OTG_VUPDATE_PARAM__VUPDATE_OFFSET__SHIFT                                                         0x0
+#define OTG1_OTG_VUPDATE_PARAM__VUPDATE_WIDTH__SHIFT                                                          0x10
+#define OTG1_OTG_VUPDATE_PARAM__VUPDATE_OFFSET_MASK                                                           0x0000FFFFL
+#define OTG1_OTG_VUPDATE_PARAM__VUPDATE_WIDTH_MASK                                                            0x03FF0000L
+//OTG1_OTG_VREADY_PARAM
+#define OTG1_OTG_VREADY_PARAM__VREADY_OFFSET__SHIFT                                                           0x0
+#define OTG1_OTG_VREADY_PARAM__VREADY_OFFSET_MASK                                                             0x0000FFFFL
+//OTG1_OTG_GLOBAL_SYNC_STATUS
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN__SHIFT                                                   0x0
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE__SHIFT                                                 0x1
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED__SHIFT                                           0x2
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS__SHIFT                                               0x3
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR__SHIFT                                              0x4
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN__SHIFT                                                    0x5
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE__SHIFT                                                  0x6
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL__SHIFT                                          0x7
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED__SHIFT                                            0x8
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS__SHIFT                                                0x9
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR__SHIFT                                               0xa
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS__SHIFT                                                    0xb
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN__SHIFT                                            0xc
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE__SHIFT                                          0xd
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED__SHIFT                                    0xe
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS__SHIFT                                        0xf
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR__SHIFT                                       0x10
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS__SHIFT                                            0x11
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN__SHIFT                                                     0x12
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE__SHIFT                                                   0x13
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED__SHIFT                                             0x14
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS__SHIFT                                                 0x15
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR__SHIFT                                                0x16
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS__SHIFT                                              0x18
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS__SHIFT                                               0x19
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN_MASK                                                     0x00000001L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE_MASK                                                   0x00000002L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED_MASK                                             0x00000004L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS_MASK                                                 0x00000008L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR_MASK                                                0x00000010L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN_MASK                                                      0x00000020L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE_MASK                                                    0x00000040L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL_MASK                                            0x00000080L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED_MASK                                              0x00000100L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS_MASK                                                  0x00000200L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR_MASK                                                 0x00000400L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS_MASK                                                      0x00000800L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN_MASK                                              0x00001000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE_MASK                                            0x00002000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED_MASK                                      0x00004000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS_MASK                                          0x00008000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR_MASK                                         0x00010000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS_MASK                                              0x00020000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN_MASK                                                       0x00040000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE_MASK                                                     0x00080000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED_MASK                                               0x00100000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS_MASK                                                   0x00200000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR_MASK                                                  0x00400000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS_MASK                                                0x01000000L
+#define OTG1_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS_MASK                                                 0x02000000L
+//OTG1_OTG_MASTER_UPDATE_LOCK
+#define OTG1_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK__SHIFT                                            0x0
+#define OTG1_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS__SHIFT                                                0x8
+#define OTG1_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK_MASK                                              0x00000001L
+#define OTG1_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS_MASK                                                  0x00000100L
+//OTG1_OTG_GSL_CONTROL
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL0_EN__SHIFT                                                              0x0
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL1_EN__SHIFT                                                              0x1
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL2_EN__SHIFT                                                              0x2
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN__SHIFT                                                        0x3
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE__SHIFT                                                      0x4
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY__SHIFT                                                      0x8
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY__SHIFT                                                      0x10
+#define OTG1_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN__SHIFT                                            0x1f
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL0_EN_MASK                                                                0x00000001L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL1_EN_MASK                                                                0x00000002L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL2_EN_MASK                                                                0x00000004L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN_MASK                                                          0x00000008L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE_MASK                                                        0x00000030L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY_MASK                                                        0x00000F00L
+#define OTG1_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY_MASK                                                        0x001F0000L
+#define OTG1_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN_MASK                                              0x80000000L
+//OTG1_OTG_GSL_WINDOW_X
+#define OTG1_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X__SHIFT                                                  0x0
+#define OTG1_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X__SHIFT                                                    0x10
+#define OTG1_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X_MASK                                                    0x00007FFFL
+#define OTG1_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X_MASK                                                      0x7FFF0000L
+//OTG1_OTG_GSL_WINDOW_Y
+#define OTG1_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y__SHIFT                                                  0x0
+#define OTG1_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y__SHIFT                                                    0x10
+#define OTG1_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y_MASK                                                    0x00007FFFL
+#define OTG1_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y_MASK                                                      0x7FFF0000L
+//OTG1_OTG_VUPDATE_KEEPOUT
+#define OTG1_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET__SHIFT                      0x0
+#define OTG1_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET__SHIFT                        0x10
+#define OTG1_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN__SHIFT                            0x1f
+#define OTG1_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET_MASK                        0x0000FFFFL
+#define OTG1_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET_MASK                          0x03FF0000L
+#define OTG1_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN_MASK                              0x80000000L
+//OTG1_OTG_GLOBAL_CONTROL0
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X__SHIFT                                        0x0
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X__SHIFT                                          0x10
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN__SHIFT                                             0x1f
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X_MASK                                          0x00007FFFL
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X_MASK                                            0x7FFF0000L
+#define OTG1_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN_MASK                                               0x80000000L
+//OTG1_OTG_GLOBAL_CONTROL1
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y__SHIFT                                        0x0
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y__SHIFT                                          0x10
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE__SHIFT                                       0x1f
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y_MASK                                          0x00007FFFL
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y_MASK                                            0x7FFF0000L
+#define OTG1_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE_MASK                                         0x80000000L
+//OTG1_OTG_GLOBAL_CONTROL2
+#define OTG1_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN__SHIFT                                                0xa
+#define OTG1_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL__SHIFT                                              0x10
+#define OTG1_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL__SHIFT                                           0x19
+#define OTG1_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE__SHIFT                                            0x1e
+#define OTG1_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE__SHIFT                                                    0x1f
+#define OTG1_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN_MASK                                                  0x00000400L
+#define OTG1_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL_MASK                                                0x00070000L
+#define OTG1_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL_MASK                                             0x0E000000L
+#define OTG1_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE_MASK                                              0x40000000L
+#define OTG1_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE_MASK                                                      0x80000000L
+//OTG1_OTG_GLOBAL_CONTROL3
+#define OTG1_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL__SHIFT                                     0x4
+#define OTG1_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL__SHIFT                                                   0x14
+#define OTG1_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL_MASK                                       0x00000030L
+#define OTG1_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL_MASK                                                     0x00300000L
+//OTG1_OTG_GLOBAL_CONTROL4
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X__SHIFT                                                0x0
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y__SHIFT                                                0x10
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE__SHIFT                                               0x1f
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X_MASK                                                  0x00007FFFL
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y_MASK                                                  0x7FFF0000L
+#define OTG1_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE_MASK                                                 0x80000000L
+//OTG1_OTG_TRIG_MANUAL_CONTROL
+#define OTG1_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL__SHIFT                                              0x0
+#define OTG1_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL_MASK                                                0x00000001L
+//OTG1_OTG_MANUAL_FLOW_CONTROL
+#define OTG1_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL__SHIFT                                              0x0
+#define OTG1_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL_MASK                                                0x00000001L
+//OTG1_OTG_DRR_TIMING_INT_STATUS
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED__SHIFT                                 0x0
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT__SHIFT                             0x4
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR__SHIFT                           0x8
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK__SHIFT                         0xc
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE__SHIFT                        0xd
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED__SHIFT                                 0x10
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT__SHIFT                             0x14
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR__SHIFT                           0x18
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK__SHIFT                         0x1c
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE__SHIFT                        0x1d
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_MASK                                   0x00000001L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MASK                               0x00000010L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR_MASK                             0x00000100L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK_MASK                           0x00001000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE_MASK                          0x00002000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_MASK                                   0x00010000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MASK                               0x00100000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR_MASK                             0x01000000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK_MASK                           0x10000000L
+#define OTG1_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE_MASK                          0x20000000L
+//OTG1_OTG_DRR_V_TOTAL_REACH_RANGE
+#define OTG1_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE__SHIFT                            0x0
+#define OTG1_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE__SHIFT                            0x10
+#define OTG1_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE_MASK                              0x00007FFFL
+#define OTG1_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE_MASK                              0x7FFF0000L
+//OTG1_OTG_DRR_V_TOTAL_CHANGE
+#define OTG1_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT__SHIFT                                      0x0
+#define OTG1_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT_MASK                                        0x00007FFFL
+//OTG1_OTG_DRR_TRIGGER_WINDOW
+#define OTG1_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X__SHIFT                                    0x0
+#define OTG1_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X__SHIFT                                      0x10
+#define OTG1_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X_MASK                                      0x00007FFFL
+#define OTG1_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X_MASK                                        0x7FFF0000L
+//OTG1_OTG_DRR_CONTROL
+#define OTG1_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME__SHIFT                                                    0x0
+#define OTG1_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR__SHIFT                                             0x10
+#define OTG1_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME_MASK                                                      0x00000003L
+#define OTG1_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR_MASK                                               0x7FFF0000L
+//OTG1_OTG_DRR_CONTOL2
+#define OTG1_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR__SHIFT                                             0x0
+#define OTG1_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR_MASK                                               0xFFFFFFFFL
+//OTG1_OTG_M_CONST_DTO0
+#define OTG1_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE__SHIFT                                                   0x0
+#define OTG1_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE_MASK                                                     0xFFFFFFFFL
+//OTG1_OTG_M_CONST_DTO1
+#define OTG1_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO__SHIFT                                                  0x0
+#define OTG1_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO_MASK                                                    0xFFFFFFFFL
+//OTG1_OTG_PIPE_UPDATE_STATUS
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING__SHIFT                                                  0x0
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING__SHIFT                                         0x4
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING__SHIFT                                         0x8
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS__SHIFT                                        0x10
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING_MASK                                                    0x00000001L
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING_MASK                                           0x00000010L
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING_MASK                                           0x00000100L
+#define OTG1_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS_MASK                                          0x00010000L
+//OTG1_OTG_PSTATE_REGISTER
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START__SHIFT                                             0x0
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND__SHIFT                                                    0x10
+#define OTG1_OTG_PSTATE_REGISTER__OTG_UNBLANK__SHIFT                                                          0x14
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN__SHIFT                                           0x18
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START_MASK                                               0x00007FFFL
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND_MASK                                                      0x00010000L
+#define OTG1_OTG_PSTATE_REGISTER__OTG_UNBLANK_MASK                                                            0x00100000L
+#define OTG1_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN_MASK                                             0xFF000000L
+//OTG1_OTG_ENCRYPTION
+#define OTG1_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL__SHIFT                                             0x0
+#define OTG1_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE__SHIFT                                              0x4
+#define OTG1_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL_MASK                                               0x00000003L
+#define OTG1_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE_MASK                                                0x00000010L
+//OTG1_OTG_TEST_DEBUG_INDEX
+#define OTG1_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define OTG1_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define OTG1_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define OTG1_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//OTG1_OTG_TEST_DEBUG_DATA
+#define OTG1_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define OTG1_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_otg2_dispdec
+//OTG2_OTG_H_TOTAL
+#define OTG2_OTG_H_TOTAL__OTG_H_TOTAL__SHIFT                                                                  0x0
+#define OTG2_OTG_H_TOTAL__OTG_H_TOTAL_MASK                                                                    0x00007FFFL
+//OTG2_OTG_H_BLANK_START_END
+#define OTG2_OTG_H_BLANK_START_END__OTG_H_BLANK_START__SHIFT                                                  0x0
+#define OTG2_OTG_H_BLANK_START_END__OTG_H_BLANK_END__SHIFT                                                    0x10
+#define OTG2_OTG_H_BLANK_START_END__OTG_H_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG2_OTG_H_BLANK_START_END__OTG_H_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG2_OTG_H_SYNC_A
+#define OTG2_OTG_H_SYNC_A__OTG_H_SYNC_A_START__SHIFT                                                          0x0
+#define OTG2_OTG_H_SYNC_A__OTG_H_SYNC_A_END__SHIFT                                                            0x10
+#define OTG2_OTG_H_SYNC_A__OTG_H_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG2_OTG_H_SYNC_A__OTG_H_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG2_OTG_H_SYNC_A_CNTL
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN__SHIFT                                                     0x10
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF__SHIFT                                                    0x11
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN_MASK                                                       0x00010000L
+#define OTG2_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF_MASK                                                      0x00020000L
+//OTG2_OTG_H_TIMING_CNTL
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE__SHIFT                                                  0x0
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL__SHIFT                                           0x8
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR__SHIFT                                             0x10
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MASK                                                    0x00000003L
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL_MASK                                             0x00000100L
+#define OTG2_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR_MASK                                               0x00030000L
+//OTG2_OTG_V_TOTAL
+#define OTG2_OTG_V_TOTAL__OTG_V_TOTAL__SHIFT                                                                  0x0
+#define OTG2_OTG_V_TOTAL__OTG_V_TOTAL_MASK                                                                    0x00007FFFL
+//OTG2_OTG_V_TOTAL_MIN
+#define OTG2_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN__SHIFT                                                          0x0
+#define OTG2_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN_MASK                                                            0x00007FFFL
+//OTG2_OTG_V_TOTAL_MAX
+#define OTG2_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX__SHIFT                                                          0x0
+#define OTG2_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX_MASK                                                            0x00007FFFL
+//OTG2_OTG_V_TOTAL_MID
+#define OTG2_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID__SHIFT                                                          0x0
+#define OTG2_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID_MASK                                                            0x00007FFFL
+//OTG2_OTG_V_TOTAL_CONTROL
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL__SHIFT                                                  0x0
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL__SHIFT                                                  0x1
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN__SHIFT                                      0x2
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN__SHIFT                                      0x3
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT__SHIFT                                              0x4
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE__SHIFT                                0x5
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM__SHIFT                                             0x8
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK__SHIFT                                             0x10
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL_MASK                                                    0x00000001L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL_MASK                                                    0x00000002L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN_MASK                                        0x00000004L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN_MASK                                        0x00000008L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT_MASK                                                0x00000010L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE_MASK                                  0x00000020L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM_MASK                                               0x0000FF00L
+#define OTG2_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK_MASK                                               0xFFFF0000L
+//OTG2_OTG_V_COUNT_STOP_CONTROL
+#define OTG2_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP__SHIFT                                                0x0
+#define OTG2_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP_MASK                                                  0x00007FFFL
+//OTG2_OTG_V_COUNT_STOP_CONTROL2
+#define OTG2_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER__SHIFT                                         0x0
+#define OTG2_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER_MASK                                           0xFFFFFFFFL
+//OTG2_OTG_V_TOTAL_INT_STATUS
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED__SHIFT                                0x0
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT__SHIFT                            0x4
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK__SHIFT                            0x8
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK__SHIFT                            0xc
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MASK                                  0x00000001L
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT_MASK                              0x00000010L
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK_MASK                              0x00000100L
+#define OTG2_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK_MASK                              0x00001000L
+//OTG2_OTG_VSYNC_NOM_INT_STATUS
+#define OTG2_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM__SHIFT                                                   0x0
+#define OTG2_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR__SHIFT                                         0x4
+#define OTG2_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_MASK                                                     0x00000001L
+#define OTG2_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR_MASK                                           0x00000010L
+//OTG2_OTG_V_BLANK_START_END
+#define OTG2_OTG_V_BLANK_START_END__OTG_V_BLANK_START__SHIFT                                                  0x0
+#define OTG2_OTG_V_BLANK_START_END__OTG_V_BLANK_END__SHIFT                                                    0x10
+#define OTG2_OTG_V_BLANK_START_END__OTG_V_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG2_OTG_V_BLANK_START_END__OTG_V_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG2_OTG_V_SYNC_A
+#define OTG2_OTG_V_SYNC_A__OTG_V_SYNC_A_START__SHIFT                                                          0x0
+#define OTG2_OTG_V_SYNC_A__OTG_V_SYNC_A_END__SHIFT                                                            0x10
+#define OTG2_OTG_V_SYNC_A__OTG_V_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG2_OTG_V_SYNC_A__OTG_V_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG2_OTG_V_SYNC_A_CNTL
+#define OTG2_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG2_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE__SHIFT                                                        0x8
+#define OTG2_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG2_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE_MASK                                                          0x00000100L
+//OTG2_OTG_TRIGA_CNTL
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED__SHIFT                                                        0xe
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY__SHIFT                                                           0x18
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR__SHIFT                                                           0x1f
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED_MASK                                                          0x00004000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY_MASK                                                             0x1F000000L
+#define OTG2_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR_MASK                                                             0x80000000L
+//OTG2_OTG_TRIGA_MANUAL_TRIG
+#define OTG2_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG2_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG2_OTG_TRIGB_CNTL
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED__SHIFT                                                        0xe
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY__SHIFT                                                           0x18
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR__SHIFT                                                           0x1f
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED_MASK                                                          0x00004000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY_MASK                                                             0x1F000000L
+#define OTG2_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR_MASK                                                             0x80000000L
+//OTG2_OTG_TRIGB_MANUAL_TRIG
+#define OTG2_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG2_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG2_OTG_FORCE_COUNT_NOW_CNTL
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE__SHIFT                                        0x0
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK__SHIFT                                       0x4
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL__SHIFT                                    0x8
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED__SHIFT                                    0x10
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR__SHIFT                                       0x18
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE_MASK                                          0x00000003L
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK_MASK                                         0x00000010L
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL_MASK                                      0x00000100L
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED_MASK                                      0x00010000L
+#define OTG2_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR_MASK                                         0x01000000L
+//OTG2_OTG_FLOW_CONTROL
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT__SHIFT                                          0x0
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY__SHIFT                                               0x8
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY__SHIFT                                            0x10
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS__SHIFT                                           0x18
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT_MASK                                            0x0000001FL
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY_MASK                                                 0x00000100L
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY_MASK                                              0x00010000L
+#define OTG2_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS_MASK                                             0x01000000L
+//OTG2_OTG_STEREO_FORCE_NEXT_EYE
+#define OTG2_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE__SHIFT                                      0x0
+#define OTG2_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE_MASK                                        0x00000003L
+//OTG2_OTG_CONTROL
+#define OTG2_OTG_CONTROL__OTG_MASTER_EN__SHIFT                                                                0x0
+#define OTG2_OTG_CONTROL__OTG_DISABLE_POINT_CNTL__SHIFT                                                       0x8
+#define OTG2_OTG_CONTROL__OTG_START_POINT_CNTL__SHIFT                                                         0xc
+#define OTG2_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL__SHIFT                                                        0xd
+#define OTG2_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY__SHIFT                                                    0xe
+#define OTG2_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE__SHIFT                                                  0x10
+#define OTG2_OTG_CONTROL__OTG_OUT_MUX__SHIFT                                                                  0x14
+#define OTG2_OTG_CONTROL__OTG_MASTER_EN_MASK                                                                  0x00000001L
+#define OTG2_OTG_CONTROL__OTG_DISABLE_POINT_CNTL_MASK                                                         0x00000300L
+#define OTG2_OTG_CONTROL__OTG_START_POINT_CNTL_MASK                                                           0x00001000L
+#define OTG2_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL_MASK                                                          0x00002000L
+#define OTG2_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY_MASK                                                      0x00004000L
+#define OTG2_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE_MASK                                                    0x00010000L
+#define OTG2_OTG_CONTROL__OTG_OUT_MUX_MASK                                                                    0x00300000L
+//OTG2_OTG_DLPC_CONTROL
+#define OTG2_OTG_DLPC_CONTROL__OTG_RESYNC_MODE__SHIFT                                                         0x0
+#define OTG2_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION__SHIFT                                              0x10
+#define OTG2_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT__SHIFT                                               0x1f
+#define OTG2_OTG_DLPC_CONTROL__OTG_RESYNC_MODE_MASK                                                           0x00000001L
+#define OTG2_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION_MASK                                                0x7FFF0000L
+#define OTG2_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT_MASK                                                 0x80000000L
+//OTG2_OTG_PIXEL_DATA_READBACK0
+#define OTG2_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB__SHIFT                                          0x0
+#define OTG2_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y__SHIFT                                          0x10
+#define OTG2_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB_MASK                                            0x0000FFFFL
+#define OTG2_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y_MASK                                            0xFFFF0000L
+//OTG2_OTG_PIXEL_DATA_READBACK1
+#define OTG2_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR__SHIFT                                           0x0
+#define OTG2_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR_MASK                                             0x0000FFFFL
+//OTG2_OTG_STATUS
+#define OTG2_OTG_STATUS__OTG_V_BLANK__SHIFT                                                                   0x0
+#define OTG2_OTG_STATUS__OTG_V_ACTIVE_DISP__SHIFT                                                             0x1
+#define OTG2_OTG_STATUS__OTG_V_SYNC_A__SHIFT                                                                  0x2
+#define OTG2_OTG_STATUS__OTG_V_UPDATE__SHIFT                                                                  0x3
+#define OTG2_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE__SHIFT                                                      0x5
+#define OTG2_OTG_STATUS__OTG_H_BLANK__SHIFT                                                                   0x10
+#define OTG2_OTG_STATUS__OTG_H_ACTIVE_DISP__SHIFT                                                             0x11
+#define OTG2_OTG_STATUS__OTG_H_SYNC_A__SHIFT                                                                  0x12
+#define OTG2_OTG_STATUS__OTG_V_BLANK_MASK                                                                     0x00000001L
+#define OTG2_OTG_STATUS__OTG_V_ACTIVE_DISP_MASK                                                               0x00000002L
+#define OTG2_OTG_STATUS__OTG_V_SYNC_A_MASK                                                                    0x00000004L
+#define OTG2_OTG_STATUS__OTG_V_UPDATE_MASK                                                                    0x00000008L
+#define OTG2_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE_MASK                                                        0x00000020L
+#define OTG2_OTG_STATUS__OTG_H_BLANK_MASK                                                                     0x00010000L
+#define OTG2_OTG_STATUS__OTG_H_ACTIVE_DISP_MASK                                                               0x00020000L
+#define OTG2_OTG_STATUS__OTG_H_SYNC_A_MASK                                                                    0x00040000L
+//OTG2_OTG_STATUS_POSITION
+#define OTG2_OTG_STATUS_POSITION__OTG_VERT_COUNT__SHIFT                                                       0x0
+#define OTG2_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK__SHIFT                                                 0xf
+#define OTG2_OTG_STATUS_POSITION__OTG_HORZ_COUNT__SHIFT                                                       0x10
+#define OTG2_OTG_STATUS_POSITION__OTG_VERT_COUNT_MASK                                                         0x00007FFFL
+#define OTG2_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK_MASK                                                   0x00008000L
+#define OTG2_OTG_STATUS_POSITION__OTG_HORZ_COUNT_MASK                                                         0x7FFF0000L
+//OTG2_OTG_LONG_VBLANK_STATUS
+#define OTG2_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT__SHIFT                                            0x0
+#define OTG2_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT_MASK                                              0xFFFFFFFFL
+//OTG2_OTG_NOM_VERT_POSITION
+#define OTG2_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM__SHIFT                                                 0x0
+#define OTG2_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM_MASK                                                   0x00007FFFL
+//OTG2_OTG_STATUS_FRAME_COUNT
+#define OTG2_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT__SHIFT                                                   0x0
+#define OTG2_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT_MASK                                                     0x00FFFFFFL
+//OTG2_OTG_STATUS_VF_COUNT
+#define OTG2_OTG_STATUS_VF_COUNT__OTG_VF_COUNT__SHIFT                                                         0x0
+#define OTG2_OTG_STATUS_VF_COUNT__OTG_VF_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG2_OTG_STATUS_HV_COUNT
+#define OTG2_OTG_STATUS_HV_COUNT__OTG_HV_COUNT__SHIFT                                                         0x0
+#define OTG2_OTG_STATUS_HV_COUNT__OTG_HV_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG2_OTG_COUNT_CONTROL
+#define OTG2_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN__SHIFT                                                  0x0
+#define OTG2_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT__SHIFT                                              0x1
+#define OTG2_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN_MASK                                                    0x00000001L
+#define OTG2_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT_MASK                                                0x0000001EL
+//OTG2_OTG_COUNT_RESET
+#define OTG2_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT__SHIFT                                                    0x0
+#define OTG2_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT_MASK                                                      0x00000001L
+//OTG2_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE
+#define OTG2_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__SHIFT                        0x0
+#define OTG2_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_MASK                          0x00000001L
+//OTG2_OTG_VERT_SYNC_CONTROL
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED__SHIFT                                 0x0
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR__SHIFT                                    0x8
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE__SHIFT                                          0x10
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED_MASK                                   0x00000001L
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR_MASK                                      0x00000100L
+#define OTG2_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE_MASK                                            0x00030000L
+//OTG2_OTG_STEREO_STATUS
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE__SHIFT                                                 0x0
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT__SHIFT                                                 0x8
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT__SHIFT                                                 0x10
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG__SHIFT                                                    0x14
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING__SHIFT                                      0x18
+#define OTG2_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE__SHIFT                                         0x1e
+#define OTG2_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE__SHIFT                                        0x1f
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE_MASK                                                   0x00000001L
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT_MASK                                                   0x00000100L
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT_MASK                                                   0x00010000L
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG_MASK                                                      0x00100000L
+#define OTG2_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING_MASK                                        0x03000000L
+#define OTG2_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE_MASK                                           0x40000000L
+#define OTG2_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE_MASK                                          0x80000000L
+//OTG2_OTG_STEREO_CONTROL
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM__SHIFT                                       0x0
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY__SHIFT                                       0xf
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY__SHIFT                                          0x11
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP__SHIFT                                  0x12
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM__SHIFT                                                 0x13
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX__SHIFT                                        0x14
+#define OTG2_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL__SHIFT                                                     0x15
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_EN__SHIFT                                                         0x18
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM_MASK                                         0x00007FFFL
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY_MASK                                         0x00008000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY_MASK                                            0x00020000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP_MASK                                    0x00040000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM_MASK                                                   0x00080000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX_MASK                                          0x00100000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL_MASK                                                       0x00200000L
+#define OTG2_OTG_STEREO_CONTROL__OTG_STEREO_EN_MASK                                                           0x01000000L
+//OTG2_OTG_SNAPSHOT_STATUS
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED__SHIFT                                                0x0
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR__SHIFT                                                   0x1
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER__SHIFT                                          0x2
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED_MASK                                                  0x00000001L
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR_MASK                                                     0x00000002L
+#define OTG2_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER_MASK                                            0x00000004L
+//OTG2_OTG_SNAPSHOT_CONTROL
+#define OTG2_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL__SHIFT                                          0x0
+#define OTG2_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL_MASK                                            0x00000003L
+//OTG2_OTG_SNAPSHOT_POSITION
+#define OTG2_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT__SHIFT                                            0x0
+#define OTG2_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT__SHIFT                                            0x10
+#define OTG2_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT_MASK                                              0x00007FFFL
+#define OTG2_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT_MASK                                              0x7FFF0000L
+//OTG2_OTG_SNAPSHOT_FRAME
+#define OTG2_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT__SHIFT                                              0x0
+#define OTG2_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT_MASK                                                0x00FFFFFFL
+//OTG2_OTG_INTERRUPT_CONTROL
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK__SHIFT                                               0x0
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE__SHIFT                                              0x1
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK__SHIFT                                        0x8
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE__SHIFT                                       0x9
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK__SHIFT                                  0x10
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE__SHIFT                                 0x11
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK__SHIFT                                                  0x18
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK__SHIFT                                                  0x19
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE__SHIFT                                                 0x1a
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE__SHIFT                                                 0x1b
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK__SHIFT                                              0x1c
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE__SHIFT                                             0x1d
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK__SHIFT                                          0x1e
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE__SHIFT                                         0x1f
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK_MASK                                                 0x00000001L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE_MASK                                                0x00000002L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK_MASK                                          0x00000100L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE_MASK                                         0x00000200L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK_MASK                                    0x00010000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE_MASK                                   0x00020000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK_MASK                                                    0x01000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK_MASK                                                    0x02000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE_MASK                                                   0x04000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE_MASK                                                   0x08000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK_MASK                                                0x10000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE_MASK                                               0x20000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK_MASK                                            0x40000000L
+#define OTG2_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE_MASK                                           0x80000000L
+//OTG2_OTG_UPDATE_LOCK
+#define OTG2_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK__SHIFT                                                          0x0
+#define OTG2_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK_MASK                                                            0x00000001L
+//OTG2_OTG_DOUBLE_BUFFER_CONTROL
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING__SHIFT                                             0x0
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING__SHIFT                             0x4
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING__SHIFT                                   0x5
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING__SHIFT                                  0x6
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING__SHIFT                          0x7
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY__SHIFT                                           0x8
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING__SHIFT                                 0x9
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE__SHIFT                                0x18
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING_MASK                                               0x00000001L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING_MASK                               0x00000010L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING_MASK                                     0x00000020L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING_MASK                                    0x00000040L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING_MASK                            0x00000080L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY_MASK                                             0x00000100L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING_MASK                                   0x00000200L
+#define OTG2_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE_MASK                                  0x03000000L
+//OTG2_OTG_MASTER_EN
+#define OTG2_OTG_MASTER_EN__OTG_MASTER_EN__SHIFT                                                              0x0
+#define OTG2_OTG_MASTER_EN__OTG_MASTER_EN_MASK                                                                0x00000001L
+//OTG2_OTG_VERTICAL_INTERRUPT0_POSITION
+#define OTG2_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START__SHIFT                      0x0
+#define OTG2_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END__SHIFT                        0x10
+#define OTG2_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START_MASK                        0x00007FFFL
+#define OTG2_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END_MASK                          0x7FFF0000L
+//OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY__SHIFT                  0x4
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE__SHIFT                       0x8
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS__SHIFT                           0xc
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS__SHIFT                       0x10
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR__SHIFT                            0x14
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE__SHIFT                         0x18
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS__SHIFT                                         0x1c
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY_MASK                    0x00000010L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE_MASK                         0x00000100L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS_MASK                             0x00001000L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS_MASK                         0x00010000L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR_MASK                              0x00100000L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE_MASK                           0x01000000L
+#define OTG2_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS_MASK                                           0x10000000L
+//OTG2_OTG_VERTICAL_INTERRUPT1_POSITION
+#define OTG2_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START__SHIFT                      0x0
+#define OTG2_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START_MASK                        0x00007FFFL
+//OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE__SHIFT                       0x8
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS__SHIFT                           0xc
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS__SHIFT                       0x10
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR__SHIFT                            0x14
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE__SHIFT                         0x18
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE_MASK                         0x00000100L
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS_MASK                             0x00001000L
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS_MASK                         0x00010000L
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR_MASK                              0x00100000L
+#define OTG2_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE_MASK                           0x01000000L
+//OTG2_OTG_VERTICAL_INTERRUPT2_POSITION
+#define OTG2_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START__SHIFT                      0x0
+#define OTG2_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START_MASK                        0x00007FFFL
+//OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE__SHIFT                       0x8
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS__SHIFT                           0xc
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS__SHIFT                       0x10
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR__SHIFT                            0x14
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE__SHIFT                         0x18
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE_MASK                         0x00000100L
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS_MASK                             0x00001000L
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS_MASK                         0x00010000L
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR_MASK                              0x00100000L
+#define OTG2_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE_MASK                           0x01000000L
+//OTG2_OTG_CRC_CNTL
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_EN__SHIFT                                                                  0x0
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN__SHIFT                                                        0x1
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_POLY_SEL__SHIFT                                                            0x2
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY__SHIFT                                                          0x3
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CONT_EN__SHIFT                                                             0x4
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL__SHIFT                                                   0x5
+#define OTG2_OTG_CRC_CNTL__OTG_CRC1_EN__SHIFT                                                                 0x7
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE__SHIFT                                                         0x8
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CONT_MODE__SHIFT                                                           0xa
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS__SHIFT                                         0x13
+#define OTG2_OTG_CRC_CNTL__OTG_CRC0_SELECT__SHIFT                                                             0x14
+#define OTG2_OTG_CRC_CNTL__OTG_CRC1_SELECT__SHIFT                                                             0x18
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING__SHIFT                                                   0x1c
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING__SHIFT                                                   0x1d
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING__SHIFT                                                   0x1e
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING__SHIFT                                                   0x1f
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_EN_MASK                                                                    0x00000001L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN_MASK                                                          0x00000002L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_POLY_SEL_MASK                                                              0x00000004L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY_MASK                                                            0x00000008L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CONT_EN_MASK                                                               0x00000010L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL_MASK                                                     0x00000060L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC1_EN_MASK                                                                   0x00000080L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE_MASK                                                           0x00000300L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_CONT_MODE_MASK                                                             0x00000400L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS_MASK                                           0x00080000L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC0_SELECT_MASK                                                               0x00700000L
+#define OTG2_OTG_CRC_CNTL__OTG_CRC1_SELECT_MASK                                                               0x07000000L
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING_MASK                                                     0x10000000L
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING_MASK                                                     0x20000000L
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING_MASK                                                     0x40000000L
+#define OTG2_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING_MASK                                                     0x80000000L
+//OTG2_OTG_CRC0_WINDOWA_X_CONTROL
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWA_Y_CONTROL
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWB_X_CONTROL
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWB_Y_CONTROL
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC0_DATA_R
+#define OTG2_OTG_CRC0_DATA_R__CRC0_R_CR__SHIFT                                                                0x0
+#define OTG2_OTG_CRC0_DATA_R__CRC0_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC0_DATA_G
+#define OTG2_OTG_CRC0_DATA_G__CRC0_G_Y__SHIFT                                                                 0x0
+#define OTG2_OTG_CRC0_DATA_G__CRC0_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG2_OTG_CRC0_DATA_B
+#define OTG2_OTG_CRC0_DATA_B__CRC0_B_CB__SHIFT                                                                0x0
+#define OTG2_OTG_CRC0_DATA_B__CRC0_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC0_DATA_C
+#define OTG2_OTG_CRC0_DATA_C__CRC0_C__SHIFT                                                                   0x0
+#define OTG2_OTG_CRC0_DATA_C__CRC0_C_MASK                                                                     0xFFFFFFFFL
+//OTG2_OTG_CRC1_WINDOWA_X_CONTROL
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWA_Y_CONTROL
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWB_X_CONTROL
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWB_Y_CONTROL
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG2_OTG_CRC1_DATA_R
+#define OTG2_OTG_CRC1_DATA_R__CRC1_R_CR__SHIFT                                                                0x0
+#define OTG2_OTG_CRC1_DATA_R__CRC1_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC1_DATA_G
+#define OTG2_OTG_CRC1_DATA_G__CRC1_G_Y__SHIFT                                                                 0x0
+#define OTG2_OTG_CRC1_DATA_G__CRC1_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG2_OTG_CRC1_DATA_B
+#define OTG2_OTG_CRC1_DATA_B__CRC1_B_CB__SHIFT                                                                0x0
+#define OTG2_OTG_CRC1_DATA_B__CRC1_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC1_DATA_C
+#define OTG2_OTG_CRC1_DATA_C__CRC1_C__SHIFT                                                                   0x0
+#define OTG2_OTG_CRC1_DATA_C__CRC1_C_MASK                                                                     0xFFFFFFFFL
+//OTG2_OTG_CRC2_DATA_R
+#define OTG2_OTG_CRC2_DATA_R__CRC2_R_CR__SHIFT                                                                0x0
+#define OTG2_OTG_CRC2_DATA_R__CRC2_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC2_DATA_G
+#define OTG2_OTG_CRC2_DATA_G__CRC2_G_Y__SHIFT                                                                 0x0
+#define OTG2_OTG_CRC2_DATA_G__CRC2_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG2_OTG_CRC2_DATA_B
+#define OTG2_OTG_CRC2_DATA_B__CRC2_B_CB__SHIFT                                                                0x0
+#define OTG2_OTG_CRC2_DATA_B__CRC2_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC2_DATA_C
+#define OTG2_OTG_CRC2_DATA_C__CRC2_C__SHIFT                                                                   0x0
+#define OTG2_OTG_CRC2_DATA_C__CRC2_C_MASK                                                                     0xFFFFFFFFL
+//OTG2_OTG_CRC3_DATA_R
+#define OTG2_OTG_CRC3_DATA_R__CRC3_R_CR__SHIFT                                                                0x0
+#define OTG2_OTG_CRC3_DATA_R__CRC3_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC3_DATA_G
+#define OTG2_OTG_CRC3_DATA_G__CRC3_G_Y__SHIFT                                                                 0x0
+#define OTG2_OTG_CRC3_DATA_G__CRC3_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG2_OTG_CRC3_DATA_B
+#define OTG2_OTG_CRC3_DATA_B__CRC3_B_CB__SHIFT                                                                0x0
+#define OTG2_OTG_CRC3_DATA_B__CRC3_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG2_OTG_CRC3_DATA_C
+#define OTG2_OTG_CRC3_DATA_C__CRC3_C__SHIFT                                                                   0x0
+#define OTG2_OTG_CRC3_DATA_C__CRC3_C_MASK                                                                     0xFFFFFFFFL
+//OTG2_OTG_CRC_SIG_RED_GREEN_MASK
+#define OTG2_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK__SHIFT                                          0x0
+#define OTG2_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK__SHIFT                                        0x10
+#define OTG2_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK_MASK                                            0x0000FFFFL
+#define OTG2_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK_MASK                                          0xFFFF0000L
+//OTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK
+#define OTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK__SHIFT                                      0x0
+#define OTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK__SHIFT                                   0x10
+#define OTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK_MASK                                        0x0000FFFFL
+#define OTG2_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK_MASK                                     0xFFFF0000L
+//OTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG2_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG2_OTG_STATIC_SCREEN_CONTROL
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK__SHIFT                                   0x0
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT__SHIFT                                  0x10
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE__SHIFT                                          0x18
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS__SHIFT                                                  0x19
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS__SHIFT                                          0x1a
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR__SHIFT                                           0x1b
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE__SHIFT                                            0x1c
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE__SHIFT                                     0x1e
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE__SHIFT                               0x1f
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK_MASK                                     0x0000FFFFL
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT_MASK                                    0x00FF0000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE_MASK                                            0x01000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS_MASK                                                    0x02000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS_MASK                                            0x04000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR_MASK                                             0x08000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE_MASK                                              0x10000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_MASK                                       0x40000000L
+#define OTG2_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE_MASK                                 0x80000000L
+//OTG2_OTG_3D_STRUCTURE_CONTROL
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN__SHIFT                                             0x0
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE__SHIFT                                  0x8
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR__SHIFT                                 0xc
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET__SHIFT                                  0x10
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING__SHIFT                          0x11
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT__SHIFT                                        0x12
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN_MASK                                               0x00000001L
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE_MASK                                    0x00000300L
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR_MASK                                   0x00001000L
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_MASK                                    0x00010000L
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING_MASK                            0x00020000L
+#define OTG2_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_MASK                                          0x000C0000L
+//OTG2_OTG_CLOCK_CONTROL
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_EN__SHIFT                                                           0x0
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS__SHIFT                                                     0x1
+#define OTG2_OTG_CLOCK_CONTROL__OTG_SOFT_RESET__SHIFT                                                         0x4
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_ON__SHIFT                                                           0x8
+#define OTG2_OTG_CLOCK_CONTROL__OTG_BUSY__SHIFT                                                               0x10
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_EN_MASK                                                             0x00000001L
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS_MASK                                                       0x00000002L
+#define OTG2_OTG_CLOCK_CONTROL__OTG_SOFT_RESET_MASK                                                           0x00000010L
+#define OTG2_OTG_CLOCK_CONTROL__OTG_CLOCK_ON_MASK                                                             0x00000100L
+#define OTG2_OTG_CLOCK_CONTROL__OTG_BUSY_MASK                                                                 0x00010000L
+//OTG2_OTG_VSTARTUP_PARAM
+#define OTG2_OTG_VSTARTUP_PARAM__VSTARTUP_START__SHIFT                                                        0x0
+#define OTG2_OTG_VSTARTUP_PARAM__VSTARTUP_START_MASK                                                          0x000003FFL
+//OTG2_OTG_VUPDATE_PARAM
+#define OTG2_OTG_VUPDATE_PARAM__VUPDATE_OFFSET__SHIFT                                                         0x0
+#define OTG2_OTG_VUPDATE_PARAM__VUPDATE_WIDTH__SHIFT                                                          0x10
+#define OTG2_OTG_VUPDATE_PARAM__VUPDATE_OFFSET_MASK                                                           0x0000FFFFL
+#define OTG2_OTG_VUPDATE_PARAM__VUPDATE_WIDTH_MASK                                                            0x03FF0000L
+//OTG2_OTG_VREADY_PARAM
+#define OTG2_OTG_VREADY_PARAM__VREADY_OFFSET__SHIFT                                                           0x0
+#define OTG2_OTG_VREADY_PARAM__VREADY_OFFSET_MASK                                                             0x0000FFFFL
+//OTG2_OTG_GLOBAL_SYNC_STATUS
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN__SHIFT                                                   0x0
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE__SHIFT                                                 0x1
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED__SHIFT                                           0x2
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS__SHIFT                                               0x3
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR__SHIFT                                              0x4
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN__SHIFT                                                    0x5
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE__SHIFT                                                  0x6
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL__SHIFT                                          0x7
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED__SHIFT                                            0x8
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS__SHIFT                                                0x9
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR__SHIFT                                               0xa
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS__SHIFT                                                    0xb
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN__SHIFT                                            0xc
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE__SHIFT                                          0xd
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED__SHIFT                                    0xe
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS__SHIFT                                        0xf
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR__SHIFT                                       0x10
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS__SHIFT                                            0x11
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN__SHIFT                                                     0x12
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE__SHIFT                                                   0x13
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED__SHIFT                                             0x14
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS__SHIFT                                                 0x15
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR__SHIFT                                                0x16
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS__SHIFT                                              0x18
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS__SHIFT                                               0x19
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN_MASK                                                     0x00000001L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE_MASK                                                   0x00000002L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED_MASK                                             0x00000004L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS_MASK                                                 0x00000008L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR_MASK                                                0x00000010L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN_MASK                                                      0x00000020L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE_MASK                                                    0x00000040L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL_MASK                                            0x00000080L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED_MASK                                              0x00000100L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS_MASK                                                  0x00000200L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR_MASK                                                 0x00000400L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS_MASK                                                      0x00000800L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN_MASK                                              0x00001000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE_MASK                                            0x00002000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED_MASK                                      0x00004000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS_MASK                                          0x00008000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR_MASK                                         0x00010000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS_MASK                                              0x00020000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN_MASK                                                       0x00040000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE_MASK                                                     0x00080000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED_MASK                                               0x00100000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS_MASK                                                   0x00200000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR_MASK                                                  0x00400000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS_MASK                                                0x01000000L
+#define OTG2_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS_MASK                                                 0x02000000L
+//OTG2_OTG_MASTER_UPDATE_LOCK
+#define OTG2_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK__SHIFT                                            0x0
+#define OTG2_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS__SHIFT                                                0x8
+#define OTG2_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK_MASK                                              0x00000001L
+#define OTG2_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS_MASK                                                  0x00000100L
+//OTG2_OTG_GSL_CONTROL
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL0_EN__SHIFT                                                              0x0
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL1_EN__SHIFT                                                              0x1
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL2_EN__SHIFT                                                              0x2
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN__SHIFT                                                        0x3
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE__SHIFT                                                      0x4
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY__SHIFT                                                      0x8
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY__SHIFT                                                      0x10
+#define OTG2_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN__SHIFT                                            0x1f
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL0_EN_MASK                                                                0x00000001L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL1_EN_MASK                                                                0x00000002L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL2_EN_MASK                                                                0x00000004L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN_MASK                                                          0x00000008L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE_MASK                                                        0x00000030L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY_MASK                                                        0x00000F00L
+#define OTG2_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY_MASK                                                        0x001F0000L
+#define OTG2_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN_MASK                                              0x80000000L
+//OTG2_OTG_GSL_WINDOW_X
+#define OTG2_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X__SHIFT                                                  0x0
+#define OTG2_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X__SHIFT                                                    0x10
+#define OTG2_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X_MASK                                                    0x00007FFFL
+#define OTG2_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X_MASK                                                      0x7FFF0000L
+//OTG2_OTG_GSL_WINDOW_Y
+#define OTG2_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y__SHIFT                                                  0x0
+#define OTG2_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y__SHIFT                                                    0x10
+#define OTG2_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y_MASK                                                    0x00007FFFL
+#define OTG2_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y_MASK                                                      0x7FFF0000L
+//OTG2_OTG_VUPDATE_KEEPOUT
+#define OTG2_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET__SHIFT                      0x0
+#define OTG2_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET__SHIFT                        0x10
+#define OTG2_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN__SHIFT                            0x1f
+#define OTG2_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET_MASK                        0x0000FFFFL
+#define OTG2_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET_MASK                          0x03FF0000L
+#define OTG2_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN_MASK                              0x80000000L
+//OTG2_OTG_GLOBAL_CONTROL0
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X__SHIFT                                        0x0
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X__SHIFT                                          0x10
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN__SHIFT                                             0x1f
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X_MASK                                          0x00007FFFL
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X_MASK                                            0x7FFF0000L
+#define OTG2_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN_MASK                                               0x80000000L
+//OTG2_OTG_GLOBAL_CONTROL1
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y__SHIFT                                        0x0
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y__SHIFT                                          0x10
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE__SHIFT                                       0x1f
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y_MASK                                          0x00007FFFL
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y_MASK                                            0x7FFF0000L
+#define OTG2_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE_MASK                                         0x80000000L
+//OTG2_OTG_GLOBAL_CONTROL2
+#define OTG2_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN__SHIFT                                                0xa
+#define OTG2_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL__SHIFT                                              0x10
+#define OTG2_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL__SHIFT                                           0x19
+#define OTG2_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE__SHIFT                                            0x1e
+#define OTG2_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE__SHIFT                                                    0x1f
+#define OTG2_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN_MASK                                                  0x00000400L
+#define OTG2_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL_MASK                                                0x00070000L
+#define OTG2_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL_MASK                                             0x0E000000L
+#define OTG2_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE_MASK                                              0x40000000L
+#define OTG2_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE_MASK                                                      0x80000000L
+//OTG2_OTG_GLOBAL_CONTROL3
+#define OTG2_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL__SHIFT                                     0x4
+#define OTG2_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL__SHIFT                                                   0x14
+#define OTG2_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL_MASK                                       0x00000030L
+#define OTG2_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL_MASK                                                     0x00300000L
+//OTG2_OTG_GLOBAL_CONTROL4
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X__SHIFT                                                0x0
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y__SHIFT                                                0x10
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE__SHIFT                                               0x1f
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X_MASK                                                  0x00007FFFL
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y_MASK                                                  0x7FFF0000L
+#define OTG2_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE_MASK                                                 0x80000000L
+//OTG2_OTG_TRIG_MANUAL_CONTROL
+#define OTG2_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL__SHIFT                                              0x0
+#define OTG2_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL_MASK                                                0x00000001L
+//OTG2_OTG_MANUAL_FLOW_CONTROL
+#define OTG2_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL__SHIFT                                              0x0
+#define OTG2_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL_MASK                                                0x00000001L
+//OTG2_OTG_DRR_TIMING_INT_STATUS
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED__SHIFT                                 0x0
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT__SHIFT                             0x4
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR__SHIFT                           0x8
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK__SHIFT                         0xc
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE__SHIFT                        0xd
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED__SHIFT                                 0x10
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT__SHIFT                             0x14
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR__SHIFT                           0x18
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK__SHIFT                         0x1c
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE__SHIFT                        0x1d
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_MASK                                   0x00000001L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MASK                               0x00000010L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR_MASK                             0x00000100L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK_MASK                           0x00001000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE_MASK                          0x00002000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_MASK                                   0x00010000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MASK                               0x00100000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR_MASK                             0x01000000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK_MASK                           0x10000000L
+#define OTG2_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE_MASK                          0x20000000L
+//OTG2_OTG_DRR_V_TOTAL_REACH_RANGE
+#define OTG2_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE__SHIFT                            0x0
+#define OTG2_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE__SHIFT                            0x10
+#define OTG2_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE_MASK                              0x00007FFFL
+#define OTG2_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE_MASK                              0x7FFF0000L
+//OTG2_OTG_DRR_V_TOTAL_CHANGE
+#define OTG2_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT__SHIFT                                      0x0
+#define OTG2_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT_MASK                                        0x00007FFFL
+//OTG2_OTG_DRR_TRIGGER_WINDOW
+#define OTG2_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X__SHIFT                                    0x0
+#define OTG2_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X__SHIFT                                      0x10
+#define OTG2_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X_MASK                                      0x00007FFFL
+#define OTG2_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X_MASK                                        0x7FFF0000L
+//OTG2_OTG_DRR_CONTROL
+#define OTG2_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME__SHIFT                                                    0x0
+#define OTG2_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR__SHIFT                                             0x10
+#define OTG2_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME_MASK                                                      0x00000003L
+#define OTG2_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR_MASK                                               0x7FFF0000L
+//OTG2_OTG_DRR_CONTOL2
+#define OTG2_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR__SHIFT                                             0x0
+#define OTG2_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR_MASK                                               0xFFFFFFFFL
+//OTG2_OTG_M_CONST_DTO0
+#define OTG2_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE__SHIFT                                                   0x0
+#define OTG2_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE_MASK                                                     0xFFFFFFFFL
+//OTG2_OTG_M_CONST_DTO1
+#define OTG2_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO__SHIFT                                                  0x0
+#define OTG2_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO_MASK                                                    0xFFFFFFFFL
+//OTG2_OTG_PIPE_UPDATE_STATUS
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING__SHIFT                                                  0x0
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING__SHIFT                                         0x4
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING__SHIFT                                         0x8
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS__SHIFT                                        0x10
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING_MASK                                                    0x00000001L
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING_MASK                                           0x00000010L
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING_MASK                                           0x00000100L
+#define OTG2_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS_MASK                                          0x00010000L
+//OTG2_OTG_PSTATE_REGISTER
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START__SHIFT                                             0x0
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND__SHIFT                                                    0x10
+#define OTG2_OTG_PSTATE_REGISTER__OTG_UNBLANK__SHIFT                                                          0x14
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN__SHIFT                                           0x18
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START_MASK                                               0x00007FFFL
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND_MASK                                                      0x00010000L
+#define OTG2_OTG_PSTATE_REGISTER__OTG_UNBLANK_MASK                                                            0x00100000L
+#define OTG2_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN_MASK                                             0xFF000000L
+//OTG2_OTG_ENCRYPTION
+#define OTG2_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL__SHIFT                                             0x0
+#define OTG2_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE__SHIFT                                              0x4
+#define OTG2_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL_MASK                                               0x00000003L
+#define OTG2_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE_MASK                                                0x00000010L
+//OTG2_OTG_TEST_DEBUG_INDEX
+#define OTG2_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define OTG2_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define OTG2_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define OTG2_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//OTG2_OTG_TEST_DEBUG_DATA
+#define OTG2_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define OTG2_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_otg3_dispdec
+//OTG3_OTG_H_TOTAL
+#define OTG3_OTG_H_TOTAL__OTG_H_TOTAL__SHIFT                                                                  0x0
+#define OTG3_OTG_H_TOTAL__OTG_H_TOTAL_MASK                                                                    0x00007FFFL
+//OTG3_OTG_H_BLANK_START_END
+#define OTG3_OTG_H_BLANK_START_END__OTG_H_BLANK_START__SHIFT                                                  0x0
+#define OTG3_OTG_H_BLANK_START_END__OTG_H_BLANK_END__SHIFT                                                    0x10
+#define OTG3_OTG_H_BLANK_START_END__OTG_H_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG3_OTG_H_BLANK_START_END__OTG_H_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG3_OTG_H_SYNC_A
+#define OTG3_OTG_H_SYNC_A__OTG_H_SYNC_A_START__SHIFT                                                          0x0
+#define OTG3_OTG_H_SYNC_A__OTG_H_SYNC_A_END__SHIFT                                                            0x10
+#define OTG3_OTG_H_SYNC_A__OTG_H_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG3_OTG_H_SYNC_A__OTG_H_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG3_OTG_H_SYNC_A_CNTL
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN__SHIFT                                                     0x10
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF__SHIFT                                                    0x11
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_COMP_SYNC_A_EN_MASK                                                       0x00010000L
+#define OTG3_OTG_H_SYNC_A_CNTL__OTG_H_SYNC_A_CUTOFF_MASK                                                      0x00020000L
+//OTG3_OTG_H_TIMING_CNTL
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE__SHIFT                                                  0x0
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL__SHIFT                                           0x8
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR__SHIFT                                             0x10
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MASK                                                    0x00000003L
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_MANUAL_MASK                                             0x00000100L
+#define OTG3_OTG_H_TIMING_CNTL__OTG_H_TIMING_DIV_MODE_CURR_MASK                                               0x00030000L
+//OTG3_OTG_V_TOTAL
+#define OTG3_OTG_V_TOTAL__OTG_V_TOTAL__SHIFT                                                                  0x0
+#define OTG3_OTG_V_TOTAL__OTG_V_TOTAL_MASK                                                                    0x00007FFFL
+//OTG3_OTG_V_TOTAL_MIN
+#define OTG3_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN__SHIFT                                                          0x0
+#define OTG3_OTG_V_TOTAL_MIN__OTG_V_TOTAL_MIN_MASK                                                            0x00007FFFL
+//OTG3_OTG_V_TOTAL_MAX
+#define OTG3_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX__SHIFT                                                          0x0
+#define OTG3_OTG_V_TOTAL_MAX__OTG_V_TOTAL_MAX_MASK                                                            0x00007FFFL
+//OTG3_OTG_V_TOTAL_MID
+#define OTG3_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID__SHIFT                                                          0x0
+#define OTG3_OTG_V_TOTAL_MID__OTG_V_TOTAL_MID_MASK                                                            0x00007FFFL
+//OTG3_OTG_V_TOTAL_CONTROL
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL__SHIFT                                                  0x0
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL__SHIFT                                                  0x1
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN__SHIFT                                      0x2
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN__SHIFT                                      0x3
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT__SHIFT                                              0x4
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE__SHIFT                                0x5
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM__SHIFT                                             0x8
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK__SHIFT                                             0x10
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MIN_SEL_MASK                                                    0x00000001L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_V_TOTAL_MAX_SEL_MASK                                                    0x00000002L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MAX_EN_MASK                                        0x00000004L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_REPLACING_MIN_EN_MASK                                        0x00000008L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_FORCE_LOCK_ON_EVENT_MASK                                                0x00000010L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_FLIP_PENDING_MODE_MASK                                  0x00000020L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_VTOTAL_MID_FRAME_NUM_MASK                                               0x0000FF00L
+#define OTG3_OTG_V_TOTAL_CONTROL__OTG_SET_V_TOTAL_MIN_MASK_MASK                                               0xFFFF0000L
+//OTG3_OTG_V_COUNT_STOP_CONTROL
+#define OTG3_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP__SHIFT                                                0x0
+#define OTG3_OTG_V_COUNT_STOP_CONTROL__OTG_V_COUNT_STOP_MASK                                                  0x00007FFFL
+//OTG3_OTG_V_COUNT_STOP_CONTROL2
+#define OTG3_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER__SHIFT                                         0x0
+#define OTG3_OTG_V_COUNT_STOP_CONTROL2__OTG_V_COUNT_STOP_TIMER_MASK                                           0xFFFFFFFFL
+//OTG3_OTG_V_TOTAL_INT_STATUS
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED__SHIFT                                0x0
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT__SHIFT                            0x4
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK__SHIFT                            0x8
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK__SHIFT                            0xc
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MASK                                  0x00000001L
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_INT_MASK                              0x00000010L
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_ACK_MASK                              0x00000100L
+#define OTG3_OTG_V_TOTAL_INT_STATUS__OTG_SET_V_TOTAL_MIN_EVENT_OCCURRED_MSK_MASK                              0x00001000L
+//OTG3_OTG_VSYNC_NOM_INT_STATUS
+#define OTG3_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM__SHIFT                                                   0x0
+#define OTG3_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR__SHIFT                                         0x4
+#define OTG3_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_MASK                                                     0x00000001L
+#define OTG3_OTG_VSYNC_NOM_INT_STATUS__OTG_VSYNC_NOM_INT_CLEAR_MASK                                           0x00000010L
+//OTG3_OTG_V_BLANK_START_END
+#define OTG3_OTG_V_BLANK_START_END__OTG_V_BLANK_START__SHIFT                                                  0x0
+#define OTG3_OTG_V_BLANK_START_END__OTG_V_BLANK_END__SHIFT                                                    0x10
+#define OTG3_OTG_V_BLANK_START_END__OTG_V_BLANK_START_MASK                                                    0x00007FFFL
+#define OTG3_OTG_V_BLANK_START_END__OTG_V_BLANK_END_MASK                                                      0x7FFF0000L
+//OTG3_OTG_V_SYNC_A
+#define OTG3_OTG_V_SYNC_A__OTG_V_SYNC_A_START__SHIFT                                                          0x0
+#define OTG3_OTG_V_SYNC_A__OTG_V_SYNC_A_END__SHIFT                                                            0x10
+#define OTG3_OTG_V_SYNC_A__OTG_V_SYNC_A_START_MASK                                                            0x00007FFFL
+#define OTG3_OTG_V_SYNC_A__OTG_V_SYNC_A_END_MASK                                                              0x7FFF0000L
+//OTG3_OTG_V_SYNC_A_CNTL
+#define OTG3_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL__SHIFT                                                       0x0
+#define OTG3_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE__SHIFT                                                        0x8
+#define OTG3_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_A_POL_MASK                                                         0x00000001L
+#define OTG3_OTG_V_SYNC_A_CNTL__OTG_V_SYNC_MODE_MASK                                                          0x00000100L
+//OTG3_OTG_TRIGA_CNTL
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED__SHIFT                                                        0xe
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY__SHIFT                                                           0x18
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR__SHIFT                                                           0x1f
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_OCCURRED_MASK                                                          0x00004000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_DELAY_MASK                                                             0x1F000000L
+#define OTG3_OTG_TRIGA_CNTL__OTG_TRIGA_CLEAR_MASK                                                             0x80000000L
+//OTG3_OTG_TRIGA_MANUAL_TRIG
+#define OTG3_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG3_OTG_TRIGA_MANUAL_TRIG__OTG_TRIGA_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG3_OTG_TRIGB_CNTL
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT__SHIFT                                                   0x0
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT__SHIFT                                              0x5
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT__SHIFT                                                 0x8
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN__SHIFT                                                0xb
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS__SHIFT                                                    0xc
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS__SHIFT                                                 0xd
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED__SHIFT                                                        0xe
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL__SHIFT                                         0x10
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL__SHIFT                                        0x12
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT__SHIFT                                                0x14
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY__SHIFT                                                           0x18
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR__SHIFT                                                           0x1f
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_SELECT_MASK                                                     0x0000001FL
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_SOURCE_PIPE_SELECT_MASK                                                0x000000E0L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_SELECT_MASK                                                   0x00000700L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_RESYNC_BYPASS_EN_MASK                                                  0x00000800L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_INPUT_STATUS_MASK                                                      0x00001000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_POLARITY_STATUS_MASK                                                   0x00002000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_OCCURRED_MASK                                                          0x00004000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_RISING_EDGE_DETECT_CNTL_MASK                                           0x00030000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_FALLING_EDGE_DETECT_CNTL_MASK                                          0x000C0000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_FREQUENCY_SELECT_MASK                                                  0x00300000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_DELAY_MASK                                                             0x1F000000L
+#define OTG3_OTG_TRIGB_CNTL__OTG_TRIGB_CLEAR_MASK                                                             0x80000000L
+//OTG3_OTG_TRIGB_MANUAL_TRIG
+#define OTG3_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG__SHIFT                                              0x0
+#define OTG3_OTG_TRIGB_MANUAL_TRIG__OTG_TRIGB_MANUAL_TRIG_MASK                                                0x00000001L
+//OTG3_OTG_FORCE_COUNT_NOW_CNTL
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE__SHIFT                                        0x0
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK__SHIFT                                       0x4
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL__SHIFT                                    0x8
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED__SHIFT                                    0x10
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR__SHIFT                                       0x18
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_MODE_MASK                                          0x00000003L
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CHECK_MASK                                         0x00000010L
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_TRIG_SEL_MASK                                      0x00000100L
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_OCCURRED_MASK                                      0x00010000L
+#define OTG3_OTG_FORCE_COUNT_NOW_CNTL__OTG_FORCE_COUNT_NOW_CLEAR_MASK                                         0x01000000L
+//OTG3_OTG_FLOW_CONTROL
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT__SHIFT                                          0x0
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY__SHIFT                                               0x8
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY__SHIFT                                            0x10
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS__SHIFT                                           0x18
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_SOURCE_SELECT_MASK                                            0x0000001FL
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_POLARITY_MASK                                                 0x00000100L
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_GRANULARITY_MASK                                              0x00010000L
+#define OTG3_OTG_FLOW_CONTROL__OTG_FLOW_CONTROL_INPUT_STATUS_MASK                                             0x01000000L
+//OTG3_OTG_STEREO_FORCE_NEXT_EYE
+#define OTG3_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE__SHIFT                                      0x0
+#define OTG3_OTG_STEREO_FORCE_NEXT_EYE__OTG_STEREO_FORCE_NEXT_EYE_MASK                                        0x00000003L
+//OTG3_OTG_CONTROL
+#define OTG3_OTG_CONTROL__OTG_MASTER_EN__SHIFT                                                                0x0
+#define OTG3_OTG_CONTROL__OTG_DISABLE_POINT_CNTL__SHIFT                                                       0x8
+#define OTG3_OTG_CONTROL__OTG_START_POINT_CNTL__SHIFT                                                         0xc
+#define OTG3_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL__SHIFT                                                        0xd
+#define OTG3_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY__SHIFT                                                    0xe
+#define OTG3_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE__SHIFT                                                  0x10
+#define OTG3_OTG_CONTROL__OTG_OUT_MUX__SHIFT                                                                  0x14
+#define OTG3_OTG_CONTROL__OTG_MASTER_EN_MASK                                                                  0x00000001L
+#define OTG3_OTG_CONTROL__OTG_DISABLE_POINT_CNTL_MASK                                                         0x00000300L
+#define OTG3_OTG_CONTROL__OTG_START_POINT_CNTL_MASK                                                           0x00001000L
+#define OTG3_OTG_CONTROL__OTG_FIELD_NUMBER_CNTL_MASK                                                          0x00002000L
+#define OTG3_OTG_CONTROL__OTG_FIELD_NUMBER_POLARITY_MASK                                                      0x00004000L
+#define OTG3_OTG_CONTROL__OTG_CURRENT_MASTER_EN_STATE_MASK                                                    0x00010000L
+#define OTG3_OTG_CONTROL__OTG_OUT_MUX_MASK                                                                    0x00300000L
+//OTG3_OTG_DLPC_CONTROL
+#define OTG3_OTG_DLPC_CONTROL__OTG_RESYNC_MODE__SHIFT                                                         0x0
+#define OTG3_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION__SHIFT                                              0x10
+#define OTG3_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT__SHIFT                                               0x1f
+#define OTG3_OTG_DLPC_CONTROL__OTG_RESYNC_MODE_MASK                                                           0x00000001L
+#define OTG3_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_LOCATION_MASK                                                0x7FFF0000L
+#define OTG3_OTG_DLPC_CONTROL__OTG_DLPC_SNAPSHOT_CURRENT_MASK                                                 0x80000000L
+//OTG3_OTG_PIXEL_DATA_READBACK0
+#define OTG3_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB__SHIFT                                          0x0
+#define OTG3_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y__SHIFT                                          0x10
+#define OTG3_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_BLUE_CB_MASK                                            0x0000FFFFL
+#define OTG3_OTG_PIXEL_DATA_READBACK0__OTG_PIXEL_DATA_GREEN_Y_MASK                                            0xFFFF0000L
+//OTG3_OTG_PIXEL_DATA_READBACK1
+#define OTG3_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR__SHIFT                                           0x0
+#define OTG3_OTG_PIXEL_DATA_READBACK1__OTG_PIXEL_DATA_RED_CR_MASK                                             0x0000FFFFL
+//OTG3_OTG_STATUS
+#define OTG3_OTG_STATUS__OTG_V_BLANK__SHIFT                                                                   0x0
+#define OTG3_OTG_STATUS__OTG_V_ACTIVE_DISP__SHIFT                                                             0x1
+#define OTG3_OTG_STATUS__OTG_V_SYNC_A__SHIFT                                                                  0x2
+#define OTG3_OTG_STATUS__OTG_V_UPDATE__SHIFT                                                                  0x3
+#define OTG3_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE__SHIFT                                                      0x5
+#define OTG3_OTG_STATUS__OTG_H_BLANK__SHIFT                                                                   0x10
+#define OTG3_OTG_STATUS__OTG_H_ACTIVE_DISP__SHIFT                                                             0x11
+#define OTG3_OTG_STATUS__OTG_H_SYNC_A__SHIFT                                                                  0x12
+#define OTG3_OTG_STATUS__OTG_V_BLANK_MASK                                                                     0x00000001L
+#define OTG3_OTG_STATUS__OTG_V_ACTIVE_DISP_MASK                                                               0x00000002L
+#define OTG3_OTG_STATUS__OTG_V_SYNC_A_MASK                                                                    0x00000004L
+#define OTG3_OTG_STATUS__OTG_V_UPDATE_MASK                                                                    0x00000008L
+#define OTG3_OTG_STATUS__OTG_V_BLANK_3D_STRUCTURE_MASK                                                        0x00000020L
+#define OTG3_OTG_STATUS__OTG_H_BLANK_MASK                                                                     0x00010000L
+#define OTG3_OTG_STATUS__OTG_H_ACTIVE_DISP_MASK                                                               0x00020000L
+#define OTG3_OTG_STATUS__OTG_H_SYNC_A_MASK                                                                    0x00040000L
+//OTG3_OTG_STATUS_POSITION
+#define OTG3_OTG_STATUS_POSITION__OTG_VERT_COUNT__SHIFT                                                       0x0
+#define OTG3_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK__SHIFT                                                 0xf
+#define OTG3_OTG_STATUS_POSITION__OTG_HORZ_COUNT__SHIFT                                                       0x10
+#define OTG3_OTG_STATUS_POSITION__OTG_VERT_COUNT_MASK                                                         0x00007FFFL
+#define OTG3_OTG_STATUS_POSITION__OTG_VERT_LONG_VBLANK_MASK                                                   0x00008000L
+#define OTG3_OTG_STATUS_POSITION__OTG_HORZ_COUNT_MASK                                                         0x7FFF0000L
+//OTG3_OTG_LONG_VBLANK_STATUS
+#define OTG3_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT__SHIFT                                            0x0
+#define OTG3_OTG_LONG_VBLANK_STATUS__OTG_V_COUNT_STOP_COUNT_MASK                                              0xFFFFFFFFL
+//OTG3_OTG_NOM_VERT_POSITION
+#define OTG3_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM__SHIFT                                                 0x0
+#define OTG3_OTG_NOM_VERT_POSITION__OTG_VERT_COUNT_NOM_MASK                                                   0x00007FFFL
+//OTG3_OTG_STATUS_FRAME_COUNT
+#define OTG3_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT__SHIFT                                                   0x0
+#define OTG3_OTG_STATUS_FRAME_COUNT__OTG_FRAME_COUNT_MASK                                                     0x00FFFFFFL
+//OTG3_OTG_STATUS_VF_COUNT
+#define OTG3_OTG_STATUS_VF_COUNT__OTG_VF_COUNT__SHIFT                                                         0x0
+#define OTG3_OTG_STATUS_VF_COUNT__OTG_VF_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG3_OTG_STATUS_HV_COUNT
+#define OTG3_OTG_STATUS_HV_COUNT__OTG_HV_COUNT__SHIFT                                                         0x0
+#define OTG3_OTG_STATUS_HV_COUNT__OTG_HV_COUNT_MASK                                                           0x7FFFFFFFL
+//OTG3_OTG_COUNT_CONTROL
+#define OTG3_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN__SHIFT                                                  0x0
+#define OTG3_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT__SHIFT                                              0x1
+#define OTG3_OTG_COUNT_CONTROL__OTG_HORZ_COUNT_BY2_EN_MASK                                                    0x00000001L
+#define OTG3_OTG_COUNT_CONTROL__OTG_HORZ_REPETITION_COUNT_MASK                                                0x0000001EL
+//OTG3_OTG_COUNT_RESET
+#define OTG3_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT__SHIFT                                                    0x0
+#define OTG3_OTG_COUNT_RESET__OTG_RESET_FRAME_COUNT_MASK                                                      0x00000001L
+//OTG3_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE
+#define OTG3_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__SHIFT                        0x0
+#define OTG3_OTG_MANUAL_FORCE_VSYNC_NEXT_LINE__OTG_MANUAL_FORCE_VSYNC_NEXT_LINE_MASK                          0x00000001L
+//OTG3_OTG_VERT_SYNC_CONTROL
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED__SHIFT                                 0x0
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR__SHIFT                                    0x8
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE__SHIFT                                          0x10
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_OCCURRED_MASK                                   0x00000001L
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_CLEAR_MASK                                      0x00000100L
+#define OTG3_OTG_VERT_SYNC_CONTROL__OTG_AUTO_FORCE_VSYNC_MODE_MASK                                            0x00030000L
+//OTG3_OTG_STEREO_STATUS
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE__SHIFT                                                 0x0
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT__SHIFT                                                 0x8
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT__SHIFT                                                 0x10
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG__SHIFT                                                    0x14
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING__SHIFT                                      0x18
+#define OTG3_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE__SHIFT                                         0x1e
+#define OTG3_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE__SHIFT                                        0x1f
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_CURRENT_EYE_MASK                                                   0x00000001L
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_SYNC_OUTPUT_MASK                                                   0x00000100L
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_SYNC_SELECT_MASK                                                   0x00010000L
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_EYE_FLAG_MASK                                                      0x00100000L
+#define OTG3_OTG_STEREO_STATUS__OTG_STEREO_FORCE_NEXT_EYE_PENDING_MASK                                        0x03000000L
+#define OTG3_OTG_STEREO_STATUS__OTG_CURRENT_3D_STRUCTURE_STATE_MASK                                           0x40000000L
+#define OTG3_OTG_STEREO_STATUS__OTG_CURRENT_STEREOSYNC_EN_STATE_MASK                                          0x80000000L
+//OTG3_OTG_STEREO_CONTROL
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM__SHIFT                                       0x0
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY__SHIFT                                       0xf
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY__SHIFT                                          0x11
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP__SHIFT                                  0x12
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM__SHIFT                                                 0x13
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX__SHIFT                                        0x14
+#define OTG3_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL__SHIFT                                                     0x15
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_EN__SHIFT                                                         0x18
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_LINE_NUM_MASK                                         0x00007FFFL
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_SYNC_OUTPUT_POLARITY_MASK                                         0x00008000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_EYE_FLAG_POLARITY_MASK                                            0x00020000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_STEREOSYNC_OUTPUT_FOR_DP_MASK                                    0x00040000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_FIELD_NUM_MASK                                                   0x00080000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_DISABLE_V_BLANK_FOR_DP_FIX_MASK                                          0x00100000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_FIELD_NUM_SEL_MASK                                                       0x00200000L
+#define OTG3_OTG_STEREO_CONTROL__OTG_STEREO_EN_MASK                                                           0x01000000L
+//OTG3_OTG_SNAPSHOT_STATUS
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED__SHIFT                                                0x0
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR__SHIFT                                                   0x1
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER__SHIFT                                          0x2
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_OCCURRED_MASK                                                  0x00000001L
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_CLEAR_MASK                                                     0x00000002L
+#define OTG3_OTG_SNAPSHOT_STATUS__OTG_SNAPSHOT_MANUAL_TRIGGER_MASK                                            0x00000004L
+//OTG3_OTG_SNAPSHOT_CONTROL
+#define OTG3_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL__SHIFT                                          0x0
+#define OTG3_OTG_SNAPSHOT_CONTROL__OTG_AUTO_SNAPSHOT_TRIG_SEL_MASK                                            0x00000003L
+//OTG3_OTG_SNAPSHOT_POSITION
+#define OTG3_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT__SHIFT                                            0x0
+#define OTG3_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT__SHIFT                                            0x10
+#define OTG3_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_VERT_COUNT_MASK                                              0x00007FFFL
+#define OTG3_OTG_SNAPSHOT_POSITION__OTG_SNAPSHOT_HORZ_COUNT_MASK                                              0x7FFF0000L
+//OTG3_OTG_SNAPSHOT_FRAME
+#define OTG3_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT__SHIFT                                              0x0
+#define OTG3_OTG_SNAPSHOT_FRAME__OTG_SNAPSHOT_FRAME_COUNT_MASK                                                0x00FFFFFFL
+//OTG3_OTG_INTERRUPT_CONTROL
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK__SHIFT                                               0x0
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE__SHIFT                                              0x1
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK__SHIFT                                        0x8
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE__SHIFT                                       0x9
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK__SHIFT                                  0x10
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE__SHIFT                                 0x11
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK__SHIFT                                                  0x18
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK__SHIFT                                                  0x19
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE__SHIFT                                                 0x1a
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE__SHIFT                                                 0x1b
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK__SHIFT                                              0x1c
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE__SHIFT                                             0x1d
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK__SHIFT                                          0x1e
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE__SHIFT                                         0x1f
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_MSK_MASK                                                 0x00000001L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_SNAPSHOT_INT_TYPE_MASK                                                0x00000002L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_MSK_MASK                                          0x00000100L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_COUNT_NOW_INT_TYPE_MASK                                         0x00000200L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_MSK_MASK                                    0x00010000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_FORCE_VSYNC_NEXT_LINE_INT_TYPE_MASK                                   0x00020000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_MSK_MASK                                                    0x01000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_MSK_MASK                                                    0x02000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGA_INT_TYPE_MASK                                                   0x04000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_TRIGB_INT_TYPE_MASK                                                   0x08000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_MSK_MASK                                                0x10000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_VSYNC_NOM_INT_TYPE_MASK                                               0x20000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_MSK_MASK                                            0x40000000L
+#define OTG3_OTG_INTERRUPT_CONTROL__OTG_GSL_VSYNC_GAP_INT_TYPE_MASK                                           0x80000000L
+//OTG3_OTG_UPDATE_LOCK
+#define OTG3_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK__SHIFT                                                          0x0
+#define OTG3_OTG_UPDATE_LOCK__OTG_UPDATE_LOCK_MASK                                                            0x00000001L
+//OTG3_OTG_DOUBLE_BUFFER_CONTROL
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING__SHIFT                                             0x0
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING__SHIFT                             0x4
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING__SHIFT                                   0x5
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING__SHIFT                                  0x6
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING__SHIFT                          0x7
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY__SHIFT                                           0x8
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING__SHIFT                                 0x9
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE__SHIFT                                0x18
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_PENDING_MASK                                               0x00000001L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_PENDING_MASK                               0x00000010L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_TIMING_DB_UPDATE_PENDING_MASK                                     0x00000020L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_CTRL_DB_UPDATE_PENDING_MASK                                    0x00000040L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_3D_STRUCTURE_EN_DB_UPDATE_PENDING_MASK                            0x00000080L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_UPDATE_INSTANTLY_MASK                                             0x00000100L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_VSTARTUP_DB_UPDATE_PENDING_MASK                                   0x00000200L
+#define OTG3_OTG_DOUBLE_BUFFER_CONTROL__OTG_DRR_TIMING_DBUF_UPDATE_MODE_MASK                                  0x03000000L
+//OTG3_OTG_MASTER_EN
+#define OTG3_OTG_MASTER_EN__OTG_MASTER_EN__SHIFT                                                              0x0
+#define OTG3_OTG_MASTER_EN__OTG_MASTER_EN_MASK                                                                0x00000001L
+//OTG3_OTG_VERTICAL_INTERRUPT0_POSITION
+#define OTG3_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START__SHIFT                      0x0
+#define OTG3_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END__SHIFT                        0x10
+#define OTG3_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_START_MASK                        0x00007FFFL
+#define OTG3_OTG_VERTICAL_INTERRUPT0_POSITION__OTG_VERTICAL_INTERRUPT0_LINE_END_MASK                          0x7FFF0000L
+//OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY__SHIFT                  0x4
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE__SHIFT                       0x8
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS__SHIFT                           0xc
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS__SHIFT                       0x10
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR__SHIFT                            0x14
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE__SHIFT                         0x18
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS__SHIFT                                         0x1c
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_OUTPUT_POLARITY_MASK                    0x00000010L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_ENABLE_MASK                         0x00000100L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_STATUS_MASK                             0x00001000L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_STATUS_MASK                         0x00010000L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_CLEAR_MASK                              0x00100000L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VERTICAL_INTERRUPT0_INT_TYPE_MASK                           0x01000000L
+#define OTG3_OTG_VERTICAL_INTERRUPT0_CONTROL__OTG_VINTE_STATUS_MASK                                           0x10000000L
+//OTG3_OTG_VERTICAL_INTERRUPT1_POSITION
+#define OTG3_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START__SHIFT                      0x0
+#define OTG3_OTG_VERTICAL_INTERRUPT1_POSITION__OTG_VERTICAL_INTERRUPT1_LINE_START_MASK                        0x00007FFFL
+//OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE__SHIFT                       0x8
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS__SHIFT                           0xc
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS__SHIFT                       0x10
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR__SHIFT                            0x14
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE__SHIFT                         0x18
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_ENABLE_MASK                         0x00000100L
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_STATUS_MASK                             0x00001000L
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_STATUS_MASK                         0x00010000L
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_CLEAR_MASK                              0x00100000L
+#define OTG3_OTG_VERTICAL_INTERRUPT1_CONTROL__OTG_VERTICAL_INTERRUPT1_INT_TYPE_MASK                           0x01000000L
+//OTG3_OTG_VERTICAL_INTERRUPT2_POSITION
+#define OTG3_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START__SHIFT                      0x0
+#define OTG3_OTG_VERTICAL_INTERRUPT2_POSITION__OTG_VERTICAL_INTERRUPT2_LINE_START_MASK                        0x00007FFFL
+//OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE__SHIFT                       0x8
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS__SHIFT                           0xc
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS__SHIFT                       0x10
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR__SHIFT                            0x14
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE__SHIFT                         0x18
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_ENABLE_MASK                         0x00000100L
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_STATUS_MASK                             0x00001000L
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_STATUS_MASK                         0x00010000L
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_CLEAR_MASK                              0x00100000L
+#define OTG3_OTG_VERTICAL_INTERRUPT2_CONTROL__OTG_VERTICAL_INTERRUPT2_INT_TYPE_MASK                           0x01000000L
+//OTG3_OTG_CRC_CNTL
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_EN__SHIFT                                                                  0x0
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN__SHIFT                                                        0x1
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_POLY_SEL__SHIFT                                                            0x2
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY__SHIFT                                                          0x3
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CONT_EN__SHIFT                                                             0x4
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL__SHIFT                                                   0x5
+#define OTG3_OTG_CRC_CNTL__OTG_CRC1_EN__SHIFT                                                                 0x7
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE__SHIFT                                                         0x8
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CONT_MODE__SHIFT                                                           0xa
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS__SHIFT                                         0x13
+#define OTG3_OTG_CRC_CNTL__OTG_CRC0_SELECT__SHIFT                                                             0x14
+#define OTG3_OTG_CRC_CNTL__OTG_CRC1_SELECT__SHIFT                                                             0x18
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING__SHIFT                                                   0x1c
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING__SHIFT                                                   0x1d
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING__SHIFT                                                   0x1e
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING__SHIFT                                                   0x1f
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_EN_MASK                                                                    0x00000001L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_WINDOW_DB_EN_MASK                                                          0x00000002L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_POLY_SEL_MASK                                                              0x00000004L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_BLANK_ONLY_MASK                                                            0x00000008L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CONT_EN_MASK                                                               0x00000010L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CAPTURE_START_SEL_MASK                                                     0x00000060L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC1_EN_MASK                                                                   0x00000080L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_STEREO_MODE_MASK                                                           0x00000300L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_CONT_MODE_MASK                                                             0x00000400L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC_USE_NEW_AND_REPEATED_PIXELS_MASK                                           0x00080000L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC0_SELECT_MASK                                                               0x00700000L
+#define OTG3_OTG_CRC_CNTL__OTG_CRC1_SELECT_MASK                                                               0x07000000L
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC0_PENDING_MASK                                                     0x10000000L
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC1_PENDING_MASK                                                     0x20000000L
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC2_PENDING_MASK                                                     0x40000000L
+#define OTG3_OTG_CRC_CNTL__OTG_ONE_SHOT_CRC3_PENDING_MASK                                                     0x80000000L
+//OTG3_OTG_CRC0_WINDOWA_X_CONTROL
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL__OTG_CRC0_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWA_Y_CONTROL
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL__OTG_CRC0_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWB_X_CONTROL
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL__OTG_CRC0_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWB_Y_CONTROL
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL__OTG_CRC0_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC0_DATA_R
+#define OTG3_OTG_CRC0_DATA_R__CRC0_R_CR__SHIFT                                                                0x0
+#define OTG3_OTG_CRC0_DATA_R__CRC0_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC0_DATA_G
+#define OTG3_OTG_CRC0_DATA_G__CRC0_G_Y__SHIFT                                                                 0x0
+#define OTG3_OTG_CRC0_DATA_G__CRC0_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG3_OTG_CRC0_DATA_B
+#define OTG3_OTG_CRC0_DATA_B__CRC0_B_CB__SHIFT                                                                0x0
+#define OTG3_OTG_CRC0_DATA_B__CRC0_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC0_DATA_C
+#define OTG3_OTG_CRC0_DATA_C__CRC0_C__SHIFT                                                                   0x0
+#define OTG3_OTG_CRC0_DATA_C__CRC0_C_MASK                                                                     0xFFFFFFFFL
+//OTG3_OTG_CRC1_WINDOWA_X_CONTROL
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL__OTG_CRC1_WINDOWA_X_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWA_Y_CONTROL
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL__OTG_CRC1_WINDOWA_Y_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWB_X_CONTROL
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL__OTG_CRC1_WINDOWB_X_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWB_Y_CONTROL
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START__SHIFT                                      0x0
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END__SHIFT                                        0x10
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_START_MASK                                        0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL__OTG_CRC1_WINDOWB_Y_END_MASK                                          0x7FFF0000L
+//OTG3_OTG_CRC1_DATA_R
+#define OTG3_OTG_CRC1_DATA_R__CRC1_R_CR__SHIFT                                                                0x0
+#define OTG3_OTG_CRC1_DATA_R__CRC1_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC1_DATA_G
+#define OTG3_OTG_CRC1_DATA_G__CRC1_G_Y__SHIFT                                                                 0x0
+#define OTG3_OTG_CRC1_DATA_G__CRC1_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG3_OTG_CRC1_DATA_B
+#define OTG3_OTG_CRC1_DATA_B__CRC1_B_CB__SHIFT                                                                0x0
+#define OTG3_OTG_CRC1_DATA_B__CRC1_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC1_DATA_C
+#define OTG3_OTG_CRC1_DATA_C__CRC1_C__SHIFT                                                                   0x0
+#define OTG3_OTG_CRC1_DATA_C__CRC1_C_MASK                                                                     0xFFFFFFFFL
+//OTG3_OTG_CRC2_DATA_R
+#define OTG3_OTG_CRC2_DATA_R__CRC2_R_CR__SHIFT                                                                0x0
+#define OTG3_OTG_CRC2_DATA_R__CRC2_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC2_DATA_G
+#define OTG3_OTG_CRC2_DATA_G__CRC2_G_Y__SHIFT                                                                 0x0
+#define OTG3_OTG_CRC2_DATA_G__CRC2_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG3_OTG_CRC2_DATA_B
+#define OTG3_OTG_CRC2_DATA_B__CRC2_B_CB__SHIFT                                                                0x0
+#define OTG3_OTG_CRC2_DATA_B__CRC2_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC2_DATA_C
+#define OTG3_OTG_CRC2_DATA_C__CRC2_C__SHIFT                                                                   0x0
+#define OTG3_OTG_CRC2_DATA_C__CRC2_C_MASK                                                                     0xFFFFFFFFL
+//OTG3_OTG_CRC3_DATA_R
+#define OTG3_OTG_CRC3_DATA_R__CRC3_R_CR__SHIFT                                                                0x0
+#define OTG3_OTG_CRC3_DATA_R__CRC3_R_CR_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC3_DATA_G
+#define OTG3_OTG_CRC3_DATA_G__CRC3_G_Y__SHIFT                                                                 0x0
+#define OTG3_OTG_CRC3_DATA_G__CRC3_G_Y_MASK                                                                   0xFFFFFFFFL
+//OTG3_OTG_CRC3_DATA_B
+#define OTG3_OTG_CRC3_DATA_B__CRC3_B_CB__SHIFT                                                                0x0
+#define OTG3_OTG_CRC3_DATA_B__CRC3_B_CB_MASK                                                                  0xFFFFFFFFL
+//OTG3_OTG_CRC3_DATA_C
+#define OTG3_OTG_CRC3_DATA_C__CRC3_C__SHIFT                                                                   0x0
+#define OTG3_OTG_CRC3_DATA_C__CRC3_C_MASK                                                                     0xFFFFFFFFL
+//OTG3_OTG_CRC_SIG_RED_GREEN_MASK
+#define OTG3_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK__SHIFT                                          0x0
+#define OTG3_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK__SHIFT                                        0x10
+#define OTG3_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_RED_MASK_MASK                                            0x0000FFFFL
+#define OTG3_OTG_CRC_SIG_RED_GREEN_MASK__OTG_CRC_SIG_GREEN_MASK_MASK                                          0xFFFF0000L
+//OTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK
+#define OTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK__SHIFT                                      0x0
+#define OTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK__SHIFT                                   0x10
+#define OTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_BLUE_MASK_MASK                                        0x0000FFFFL
+#define OTG3_OTG_CRC_SIG_BLUE_CONTROL_MASK__OTG_CRC_SIG_CONTROL_MASK_MASK                                     0xFFFF0000L
+//OTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWA_X_CONTROL_READBACK__OTG_CRC0_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWA_Y_CONTROL_READBACK__OTG_CRC0_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWB_X_CONTROL_READBACK__OTG_CRC0_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC0_WINDOWB_Y_CONTROL_READBACK__OTG_CRC0_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWA_X_CONTROL_READBACK__OTG_CRC1_WINDOWA_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWA_Y_CONTROL_READBACK__OTG_CRC1_WINDOWA_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWB_X_CONTROL_READBACK__OTG_CRC1_WINDOWB_X_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK__SHIFT                    0x0
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK__SHIFT                      0x10
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_START_READBACK_MASK                      0x00007FFFL
+#define OTG3_OTG_CRC1_WINDOWB_Y_CONTROL_READBACK__OTG_CRC1_WINDOWB_Y_END_READBACK_MASK                        0x7FFF0000L
+//OTG3_OTG_STATIC_SCREEN_CONTROL
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK__SHIFT                                   0x0
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT__SHIFT                                  0x10
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE__SHIFT                                          0x18
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS__SHIFT                                                  0x19
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS__SHIFT                                          0x1a
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR__SHIFT                                           0x1b
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE__SHIFT                                            0x1c
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE__SHIFT                                     0x1e
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE__SHIFT                               0x1f
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_EVENT_MASK_MASK                                     0x0000FFFFL
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_FRAME_COUNT_MASK                                    0x00FF0000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_ENABLE_MASK                                            0x01000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_SS_STATUS_MASK                                                    0x02000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_STATUS_MASK                                            0x04000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_CLEAR_MASK                                             0x08000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_CPU_SS_INT_TYPE_MASK                                              0x10000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_MASK                                       0x40000000L
+#define OTG3_OTG_STATIC_SCREEN_CONTROL__OTG_STATIC_SCREEN_OVERRIDE_VALUE_MASK                                 0x80000000L
+//OTG3_OTG_3D_STRUCTURE_CONTROL
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN__SHIFT                                             0x0
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE__SHIFT                                  0x8
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR__SHIFT                                 0xc
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET__SHIFT                                  0x10
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING__SHIFT                          0x11
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT__SHIFT                                        0x12
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_EN_MASK                                               0x00000001L
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_V_UPDATE_MODE_MASK                                    0x00000300L
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_STEREO_SEL_OVR_MASK                                   0x00001000L
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_MASK                                    0x00010000L
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_RESET_PENDING_MASK                            0x00020000L
+#define OTG3_OTG_3D_STRUCTURE_CONTROL__OTG_3D_STRUCTURE_F_COUNT_MASK                                          0x000C0000L
+//OTG3_OTG_CLOCK_CONTROL
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_EN__SHIFT                                                           0x0
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS__SHIFT                                                     0x1
+#define OTG3_OTG_CLOCK_CONTROL__OTG_SOFT_RESET__SHIFT                                                         0x4
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_ON__SHIFT                                                           0x8
+#define OTG3_OTG_CLOCK_CONTROL__OTG_BUSY__SHIFT                                                               0x10
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_EN_MASK                                                             0x00000001L
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_GATE_DIS_MASK                                                       0x00000002L
+#define OTG3_OTG_CLOCK_CONTROL__OTG_SOFT_RESET_MASK                                                           0x00000010L
+#define OTG3_OTG_CLOCK_CONTROL__OTG_CLOCK_ON_MASK                                                             0x00000100L
+#define OTG3_OTG_CLOCK_CONTROL__OTG_BUSY_MASK                                                                 0x00010000L
+//OTG3_OTG_VSTARTUP_PARAM
+#define OTG3_OTG_VSTARTUP_PARAM__VSTARTUP_START__SHIFT                                                        0x0
+#define OTG3_OTG_VSTARTUP_PARAM__VSTARTUP_START_MASK                                                          0x000003FFL
+//OTG3_OTG_VUPDATE_PARAM
+#define OTG3_OTG_VUPDATE_PARAM__VUPDATE_OFFSET__SHIFT                                                         0x0
+#define OTG3_OTG_VUPDATE_PARAM__VUPDATE_WIDTH__SHIFT                                                          0x10
+#define OTG3_OTG_VUPDATE_PARAM__VUPDATE_OFFSET_MASK                                                           0x0000FFFFL
+#define OTG3_OTG_VUPDATE_PARAM__VUPDATE_WIDTH_MASK                                                            0x03FF0000L
+//OTG3_OTG_VREADY_PARAM
+#define OTG3_OTG_VREADY_PARAM__VREADY_OFFSET__SHIFT                                                           0x0
+#define OTG3_OTG_VREADY_PARAM__VREADY_OFFSET_MASK                                                             0x0000FFFFL
+//OTG3_OTG_GLOBAL_SYNC_STATUS
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN__SHIFT                                                   0x0
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE__SHIFT                                                 0x1
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED__SHIFT                                           0x2
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS__SHIFT                                               0x3
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR__SHIFT                                              0x4
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN__SHIFT                                                    0x5
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE__SHIFT                                                  0x6
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL__SHIFT                                          0x7
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED__SHIFT                                            0x8
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS__SHIFT                                                0x9
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR__SHIFT                                               0xa
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS__SHIFT                                                    0xb
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN__SHIFT                                            0xc
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE__SHIFT                                          0xd
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED__SHIFT                                    0xe
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS__SHIFT                                        0xf
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR__SHIFT                                       0x10
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS__SHIFT                                            0x11
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN__SHIFT                                                     0x12
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE__SHIFT                                                   0x13
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED__SHIFT                                             0x14
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS__SHIFT                                                 0x15
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR__SHIFT                                                0x16
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS__SHIFT                                              0x18
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS__SHIFT                                               0x19
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_EN_MASK                                                     0x00000001L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_TYPE_MASK                                                   0x00000002L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_OCCURRED_MASK                                             0x00000004L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_INT_STATUS_MASK                                                 0x00000008L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VSTARTUP_EVENT_CLEAR_MASK                                                0x00000010L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_EN_MASK                                                      0x00000020L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_TYPE_MASK                                                    0x00000040L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_POSITION_SEL_MASK                                            0x00000080L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_OCCURRED_MASK                                              0x00000100L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_INT_STATUS_MASK                                                  0x00000200L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_EVENT_CLEAR_MASK                                                 0x00000400L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_STATUS_MASK                                                      0x00000800L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_EN_MASK                                              0x00001000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_TYPE_MASK                                            0x00002000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_OCCURRED_MASK                                      0x00004000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_INT_STATUS_MASK                                          0x00008000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_EVENT_CLEAR_MASK                                         0x00010000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VUPDATE_NO_LOCK_STATUS_MASK                                              0x00020000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_EN_MASK                                                       0x00040000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_TYPE_MASK                                                     0x00080000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_OCCURRED_MASK                                               0x00100000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_INT_STATUS_MASK                                                   0x00200000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__VREADY_EVENT_CLEAR_MASK                                                  0x00400000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__STEREO_SELECT_STATUS_MASK                                                0x01000000L
+#define OTG3_OTG_GLOBAL_SYNC_STATUS__FIELD_NUMBER_STATUS_MASK                                                 0x02000000L
+//OTG3_OTG_MASTER_UPDATE_LOCK
+#define OTG3_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK__SHIFT                                            0x0
+#define OTG3_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS__SHIFT                                                0x8
+#define OTG3_OTG_MASTER_UPDATE_LOCK__OTG_MASTER_UPDATE_LOCK_MASK                                              0x00000001L
+#define OTG3_OTG_MASTER_UPDATE_LOCK__UPDATE_LOCK_STATUS_MASK                                                  0x00000100L
+//OTG3_OTG_GSL_CONTROL
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL0_EN__SHIFT                                                              0x0
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL1_EN__SHIFT                                                              0x1
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL2_EN__SHIFT                                                              0x2
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN__SHIFT                                                        0x3
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE__SHIFT                                                      0x4
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY__SHIFT                                                      0x8
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY__SHIFT                                                      0x10
+#define OTG3_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN__SHIFT                                            0x1f
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL0_EN_MASK                                                                0x00000001L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL1_EN_MASK                                                                0x00000002L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL2_EN_MASK                                                                0x00000004L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_MASTER_EN_MASK                                                          0x00000008L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_MASTER_MODE_MASK                                                        0x00000030L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_CHECK_DELAY_MASK                                                        0x00000F00L
+#define OTG3_OTG_GSL_CONTROL__OTG_GSL_FORCE_DELAY_MASK                                                        0x001F0000L
+#define OTG3_OTG_GSL_CONTROL__OTG_MASTER_UPDATE_LOCK_GSL_EN_MASK                                              0x80000000L
+//OTG3_OTG_GSL_WINDOW_X
+#define OTG3_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X__SHIFT                                                  0x0
+#define OTG3_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X__SHIFT                                                    0x10
+#define OTG3_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_START_X_MASK                                                    0x00007FFFL
+#define OTG3_OTG_GSL_WINDOW_X__OTG_GSL_WINDOW_END_X_MASK                                                      0x7FFF0000L
+//OTG3_OTG_GSL_WINDOW_Y
+#define OTG3_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y__SHIFT                                                  0x0
+#define OTG3_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y__SHIFT                                                    0x10
+#define OTG3_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_START_Y_MASK                                                    0x00007FFFL
+#define OTG3_OTG_GSL_WINDOW_Y__OTG_GSL_WINDOW_END_Y_MASK                                                      0x7FFF0000L
+//OTG3_OTG_VUPDATE_KEEPOUT
+#define OTG3_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET__SHIFT                      0x0
+#define OTG3_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET__SHIFT                        0x10
+#define OTG3_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN__SHIFT                            0x1f
+#define OTG3_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_START_OFFSET_MASK                        0x0000FFFFL
+#define OTG3_OTG_VUPDATE_KEEPOUT__MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_END_OFFSET_MASK                          0x03FF0000L
+#define OTG3_OTG_VUPDATE_KEEPOUT__OTG_MASTER_UPDATE_LOCK_VUPDATE_KEEPOUT_EN_MASK                              0x80000000L
+//OTG3_OTG_GLOBAL_CONTROL0
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X__SHIFT                                        0x0
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X__SHIFT                                          0x10
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN__SHIFT                                             0x1f
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_START_X_MASK                                          0x00007FFFL
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_END_X_MASK                                            0x7FFF0000L
+#define OTG3_OTG_GLOBAL_CONTROL0__MASTER_UPDATE_LOCK_DB_EN_MASK                                               0x80000000L
+//OTG3_OTG_GLOBAL_CONTROL1
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y__SHIFT                                        0x0
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y__SHIFT                                          0x10
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE__SHIFT                                       0x1f
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_START_Y_MASK                                          0x00007FFFL
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_DB_END_Y_MASK                                            0x7FFF0000L
+#define OTG3_OTG_GLOBAL_CONTROL1__MASTER_UPDATE_LOCK_VCOUNT_MODE_MASK                                         0x80000000L
+//OTG3_OTG_GLOBAL_CONTROL2
+#define OTG3_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN__SHIFT                                                0xa
+#define OTG3_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL__SHIFT                                              0x10
+#define OTG3_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL__SHIFT                                           0x19
+#define OTG3_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE__SHIFT                                            0x1e
+#define OTG3_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE__SHIFT                                                    0x1f
+#define OTG3_OTG_GLOBAL_CONTROL2__GLOBAL_UPDATE_LOCK_EN_MASK                                                  0x00000400L
+#define OTG3_OTG_GLOBAL_CONTROL2__MANUAL_FLOW_CONTROL_SEL_MASK                                                0x00070000L
+#define OTG3_OTG_GLOBAL_CONTROL2__OTG_MASTER_UPDATE_LOCK_SEL_MASK                                             0x0E000000L
+#define OTG3_OTG_GLOBAL_CONTROL2__OTG_VUPDATE_BLOCK_DISABLE_MASK                                              0x40000000L
+#define OTG3_OTG_GLOBAL_CONTROL2__DCCG_VUPDATE_MODE_MASK                                                      0x80000000L
+//OTG3_OTG_GLOBAL_CONTROL3
+#define OTG3_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL__SHIFT                                     0x4
+#define OTG3_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL__SHIFT                                                   0x14
+#define OTG3_OTG_GLOBAL_CONTROL3__MASTER_UPDATE_LOCK_DB_STEREO_SEL_MASK                                       0x00000030L
+#define OTG3_OTG_GLOBAL_CONTROL3__DIG_UPDATE_EYE_SEL_MASK                                                     0x00300000L
+//OTG3_OTG_GLOBAL_CONTROL4
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X__SHIFT                                                0x0
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y__SHIFT                                                0x10
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE__SHIFT                                               0x1f
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_X_MASK                                                  0x00007FFFL
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_POSITION_Y_MASK                                                  0x7FFF0000L
+#define OTG3_OTG_GLOBAL_CONTROL4__DIG_UPDATE_VCOUNT_MODE_MASK                                                 0x80000000L
+//OTG3_OTG_TRIG_MANUAL_CONTROL
+#define OTG3_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL__SHIFT                                              0x0
+#define OTG3_OTG_TRIG_MANUAL_CONTROL__TRIG_MANUAL_CONTROL_MASK                                                0x00000001L
+//OTG3_OTG_MANUAL_FLOW_CONTROL
+#define OTG3_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL__SHIFT                                              0x0
+#define OTG3_OTG_MANUAL_FLOW_CONTROL__MANUAL_FLOW_CONTROL_MASK                                                0x00000001L
+//OTG3_OTG_DRR_TIMING_INT_STATUS
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED__SHIFT                                 0x0
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT__SHIFT                             0x4
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR__SHIFT                           0x8
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK__SHIFT                         0xc
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE__SHIFT                        0xd
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED__SHIFT                                 0x10
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT__SHIFT                             0x14
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR__SHIFT                           0x18
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK__SHIFT                         0x1c
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE__SHIFT                        0x1d
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_MASK                                   0x00000001L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MASK                               0x00000010L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_CLEAR_MASK                             0x00000100L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_MSK_MASK                           0x00001000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_TIMING_UPDATE_OCCURRED_INT_TYPE_MASK                          0x00002000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_MASK                                   0x00010000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MASK                               0x00100000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_CLEAR_MASK                             0x01000000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_MSK_MASK                           0x10000000L
+#define OTG3_OTG_DRR_TIMING_INT_STATUS__OTG_DRR_V_TOTAL_REACH_OCCURRED_INT_TYPE_MASK                          0x20000000L
+//OTG3_OTG_DRR_V_TOTAL_REACH_RANGE
+#define OTG3_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE__SHIFT                            0x0
+#define OTG3_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE__SHIFT                            0x10
+#define OTG3_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_LOWER_RANGE_MASK                              0x00007FFFL
+#define OTG3_OTG_DRR_V_TOTAL_REACH_RANGE__OTG_DRR_V_TOTAL_REACH_UPPER_RANGE_MASK                              0x7FFF0000L
+//OTG3_OTG_DRR_V_TOTAL_CHANGE
+#define OTG3_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT__SHIFT                                      0x0
+#define OTG3_OTG_DRR_V_TOTAL_CHANGE__OTG_DRR_V_TOTAL_CHANGE_LIMIT_MASK                                        0x00007FFFL
+//OTG3_OTG_DRR_TRIGGER_WINDOW
+#define OTG3_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X__SHIFT                                    0x0
+#define OTG3_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X__SHIFT                                      0x10
+#define OTG3_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_START_X_MASK                                      0x00007FFFL
+#define OTG3_OTG_DRR_TRIGGER_WINDOW__OTG_DRR_TRIGGER_WINDOW_END_X_MASK                                        0x7FFF0000L
+//OTG3_OTG_DRR_CONTROL
+#define OTG3_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME__SHIFT                                                    0x0
+#define OTG3_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR__SHIFT                                             0x10
+#define OTG3_OTG_DRR_CONTROL__OTG_DRR_AVERAGE_FRAME_MASK                                                      0x00000003L
+#define OTG3_OTG_DRR_CONTROL__OTG_V_TOTAL_LAST_USED_BY_DRR_MASK                                               0x7FFF0000L
+//OTG3_OTG_DRR_CONTOL2
+#define OTG3_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR__SHIFT                                             0x0
+#define OTG3_OTG_DRR_CONTOL2__OTG_VCOUNT2_LAST_USED_BY_DRR_MASK                                               0xFFFFFFFFL
+//OTG3_OTG_M_CONST_DTO0
+#define OTG3_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE__SHIFT                                                   0x0
+#define OTG3_OTG_M_CONST_DTO0__OTG_M_CONST_DTO_PHASE_MASK                                                     0xFFFFFFFFL
+//OTG3_OTG_M_CONST_DTO1
+#define OTG3_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO__SHIFT                                                  0x0
+#define OTG3_OTG_M_CONST_DTO1__OTG_M_CONST_DTO_MODULO_MASK                                                    0xFFFFFFFFL
+//OTG3_OTG_PIPE_UPDATE_STATUS
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING__SHIFT                                                  0x0
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING__SHIFT                                         0x4
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING__SHIFT                                         0x8
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS__SHIFT                                        0x10
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_FLIP_PENDING_MASK                                                    0x00000001L
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_DC_REG_UPDATE_PENDING_MASK                                           0x00000010L
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_CURSOR_UPDATE_PENDING_MASK                                           0x00000100L
+#define OTG3_OTG_PIPE_UPDATE_STATUS__OTG_VUPDATE_KEEPOUT_STATUS_MASK                                          0x00010000L
+//OTG3_OTG_PSTATE_REGISTER
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START__SHIFT                                             0x0
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND__SHIFT                                                    0x10
+#define OTG3_OTG_PSTATE_REGISTER__OTG_UNBLANK__SHIFT                                                          0x14
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN__SHIFT                                           0x18
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_KEEPOUT_START_MASK                                               0x00007FFFL
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_EXTEND_MASK                                                      0x00010000L
+#define OTG3_OTG_PSTATE_REGISTER__OTG_UNBLANK_MASK                                                            0x00100000L
+#define OTG3_OTG_PSTATE_REGISTER__OTG_PSTATE_ALLOW_WIDTH_MIN_MASK                                             0xFF000000L
+//OTG3_OTG_ENCRYPTION
+#define OTG3_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL__SHIFT                                             0x0
+#define OTG3_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE__SHIFT                                              0x4
+#define OTG3_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_LEVEL_MASK                                               0x00000003L
+#define OTG3_OTG_ENCRYPTION__OTG_ENCRYPTION_REQUIRED_MODE_MASK                                                0x00000010L
+//OTG3_OTG_TEST_DEBUG_INDEX
+#define OTG3_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX__SHIFT                                                0x0
+#define OTG3_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN__SHIFT                                             0x8
+#define OTG3_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_INDEX_MASK                                                  0x000000FFL
+#define OTG3_OTG_TEST_DEBUG_INDEX__OTG_TEST_DEBUG_WRITE_EN_MASK                                               0x00000100L
+//OTG3_OTG_TEST_DEBUG_DATA
+#define OTG3_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA__SHIFT                                                  0x0
+#define OTG3_OTG_TEST_DEBUG_DATA__OTG_TEST_DEBUG_DATA_MASK                                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_optc_optc_misc_dispdec
+//OPTC_DLPC_CONTROL
+#define OPTC_DLPC_CONTROL__OPTC_DLPC_SNAPSHOT_MUX__SHIFT                                                      0x0
+#define OPTC_DLPC_CONTROL__OPTC_DLPC_SNAPSHOT_MUX_MASK                                                        0x00000007L
+//OPTC_CLOCK_CONTROL
+#define OPTC_CLOCK_CONTROL__OPTC_DISPCLK_R_GATE_DIS__SHIFT                                                    0x0
+#define OPTC_CLOCK_CONTROL__OPTC_DISPCLK_R_CLOCK_ON__SHIFT                                                    0x1
+#define OPTC_CLOCK_CONTROL__OPTC_TEST_CLK_SEL__SHIFT                                                          0x8
+#define OPTC_CLOCK_CONTROL__OPTC_FGCG_REP_DIS__SHIFT                                                          0xf
+#define OPTC_CLOCK_CONTROL__OPTC_DISPCLK_R_GATE_DIS_MASK                                                      0x00000001L
+#define OPTC_CLOCK_CONTROL__OPTC_DISPCLK_R_CLOCK_ON_MASK                                                      0x00000002L
+#define OPTC_CLOCK_CONTROL__OPTC_TEST_CLK_SEL_MASK                                                            0x00000F00L
+#define OPTC_CLOCK_CONTROL__OPTC_FGCG_REP_DIS_MASK                                                            0x00008000L
+//ODM_MEM_PWR_CTRL
+#define ODM_MEM_PWR_CTRL__ODM_MEM0_PWR_FORCE__SHIFT                                                           0x0
+#define ODM_MEM_PWR_CTRL__ODM_MEM0_PWR_DIS__SHIFT                                                             0x2
+#define ODM_MEM_PWR_CTRL__ODM_MEM1_PWR_FORCE__SHIFT                                                           0x4
+#define ODM_MEM_PWR_CTRL__ODM_MEM1_PWR_DIS__SHIFT                                                             0x6
+#define ODM_MEM_PWR_CTRL__ODM_MEM2_PWR_FORCE__SHIFT                                                           0x8
+#define ODM_MEM_PWR_CTRL__ODM_MEM2_PWR_DIS__SHIFT                                                             0xa
+#define ODM_MEM_PWR_CTRL__ODM_MEM3_PWR_FORCE__SHIFT                                                           0xc
+#define ODM_MEM_PWR_CTRL__ODM_MEM3_PWR_DIS__SHIFT                                                             0xe
+#define ODM_MEM_PWR_CTRL__ODM_MEM4_PWR_FORCE__SHIFT                                                           0x10
+#define ODM_MEM_PWR_CTRL__ODM_MEM4_PWR_DIS__SHIFT                                                             0x12
+#define ODM_MEM_PWR_CTRL__ODM_MEM5_PWR_FORCE__SHIFT                                                           0x14
+#define ODM_MEM_PWR_CTRL__ODM_MEM5_PWR_DIS__SHIFT                                                             0x16
+#define ODM_MEM_PWR_CTRL__ODM_MEM6_PWR_FORCE__SHIFT                                                           0x18
+#define ODM_MEM_PWR_CTRL__ODM_MEM6_PWR_DIS__SHIFT                                                             0x1a
+#define ODM_MEM_PWR_CTRL__ODM_MEM7_PWR_FORCE__SHIFT                                                           0x1c
+#define ODM_MEM_PWR_CTRL__ODM_MEM7_PWR_DIS__SHIFT                                                             0x1e
+#define ODM_MEM_PWR_CTRL__ODM_MEM0_PWR_FORCE_MASK                                                             0x00000003L
+#define ODM_MEM_PWR_CTRL__ODM_MEM0_PWR_DIS_MASK                                                               0x00000004L
+#define ODM_MEM_PWR_CTRL__ODM_MEM1_PWR_FORCE_MASK                                                             0x00000030L
+#define ODM_MEM_PWR_CTRL__ODM_MEM1_PWR_DIS_MASK                                                               0x00000040L
+#define ODM_MEM_PWR_CTRL__ODM_MEM2_PWR_FORCE_MASK                                                             0x00000300L
+#define ODM_MEM_PWR_CTRL__ODM_MEM2_PWR_DIS_MASK                                                               0x00000400L
+#define ODM_MEM_PWR_CTRL__ODM_MEM3_PWR_FORCE_MASK                                                             0x00003000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM3_PWR_DIS_MASK                                                               0x00004000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM4_PWR_FORCE_MASK                                                             0x00030000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM4_PWR_DIS_MASK                                                               0x00040000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM5_PWR_FORCE_MASK                                                             0x00300000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM5_PWR_DIS_MASK                                                               0x00400000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM6_PWR_FORCE_MASK                                                             0x03000000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM6_PWR_DIS_MASK                                                               0x04000000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM7_PWR_FORCE_MASK                                                             0x30000000L
+#define ODM_MEM_PWR_CTRL__ODM_MEM7_PWR_DIS_MASK                                                               0x40000000L
+//ODM_MEM_PWR_CTRL3
+#define ODM_MEM_PWR_CTRL3__ODM_MEM_UNASSIGNED_PWR_MODE__SHIFT                                                 0x0
+#define ODM_MEM_PWR_CTRL3__ODM_MEM_VBLANK_PWR_MODE__SHIFT                                                     0x2
+#define ODM_MEM_PWR_CTRL3__ODM_MEM_UNASSIGNED_PWR_MODE_MASK                                                   0x00000003L
+#define ODM_MEM_PWR_CTRL3__ODM_MEM_VBLANK_PWR_MODE_MASK                                                       0x0000000CL
+//ODM_MEM_PWR_STATUS
+#define ODM_MEM_PWR_STATUS__ODM_MEM0_PWR_STATE__SHIFT                                                         0x0
+#define ODM_MEM_PWR_STATUS__ODM_MEM1_PWR_STATE__SHIFT                                                         0x2
+#define ODM_MEM_PWR_STATUS__ODM_MEM2_PWR_STATE__SHIFT                                                         0x4
+#define ODM_MEM_PWR_STATUS__ODM_MEM3_PWR_STATE__SHIFT                                                         0x6
+#define ODM_MEM_PWR_STATUS__ODM_MEM4_PWR_STATE__SHIFT                                                         0x8
+#define ODM_MEM_PWR_STATUS__ODM_MEM5_PWR_STATE__SHIFT                                                         0xa
+#define ODM_MEM_PWR_STATUS__ODM_MEM6_PWR_STATE__SHIFT                                                         0xc
+#define ODM_MEM_PWR_STATUS__ODM_MEM7_PWR_STATE__SHIFT                                                         0xe
+#define ODM_MEM_PWR_STATUS__ODM_MEM0_PWR_STATE_MASK                                                           0x00000003L
+#define ODM_MEM_PWR_STATUS__ODM_MEM1_PWR_STATE_MASK                                                           0x0000000CL
+#define ODM_MEM_PWR_STATUS__ODM_MEM2_PWR_STATE_MASK                                                           0x00000030L
+#define ODM_MEM_PWR_STATUS__ODM_MEM3_PWR_STATE_MASK                                                           0x000000C0L
+#define ODM_MEM_PWR_STATUS__ODM_MEM4_PWR_STATE_MASK                                                           0x00000300L
+#define ODM_MEM_PWR_STATUS__ODM_MEM5_PWR_STATE_MASK                                                           0x00000C00L
+#define ODM_MEM_PWR_STATUS__ODM_MEM6_PWR_STATE_MASK                                                           0x00003000L
+#define ODM_MEM_PWR_STATUS__ODM_MEM7_PWR_STATE_MASK                                                           0x0000C000L
+//OPTC_DEBUG_CONTROL
+#define OPTC_DEBUG_CONTROL__OPTC_DBG_EN__SHIFT                                                                0x0
+#define OPTC_DEBUG_CONTROL__OPTC_OTG_DEBUG_BUS_SELECT__SHIFT                                                  0x4
+#define OPTC_DEBUG_CONTROL__OPTC_ODM_DEBUG_BUS_SELECT__SHIFT                                                  0x8
+#define OPTC_DEBUG_CONTROL__OPTC_OTG_DIRECT_DEBUG_BUS_SELECT__SHIFT                                           0xc
+#define OPTC_DEBUG_CONTROL__OPTC_DIRECT_DEBUG_BUS_SELECT__SHIFT                                               0x10
+#define OPTC_DEBUG_CONTROL__OPTC_DBG_EN_MASK                                                                  0x00000001L
+#define OPTC_DEBUG_CONTROL__OPTC_OTG_DEBUG_BUS_SELECT_MASK                                                    0x000000F0L
+#define OPTC_DEBUG_CONTROL__OPTC_ODM_DEBUG_BUS_SELECT_MASK                                                    0x00000F00L
+#define OPTC_DEBUG_CONTROL__OPTC_OTG_DIRECT_DEBUG_BUS_SELECT_MASK                                             0x0000F000L
+#define OPTC_DEBUG_CONTROL__OPTC_DIRECT_DEBUG_BUS_SELECT_MASK                                                 0x001F0000L
+
+
+// addressBlock: dce_dc_optc_optc_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON16_PERFCOUNTER_CNTL
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON16_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON16_PERFCOUNTER_CNTL2
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON16_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON16_PERFCOUNTER_STATE
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON16_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON16_PERFMON_CNTL
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON16_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON16_PERFMON_CNTL2
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON16_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON16_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON16_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON16_PERFMON_CVALUE_LOW
+#define DC_PERFMON16_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON16_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON16_PERFMON_HI
+#define DC_PERFMON16_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON16_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON16_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON16_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON16_PERFMON_LOW
+#define DC_PERFMON16_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON16_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON16_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON16_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON16_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dio_dp0_dispdec
+//DP0_DP_LINK_CNTL
+#define DP0_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE__SHIFT                                                    0x4
+#define DP0_DP_LINK_CNTL__DP_LINK_STATUS__SHIFT                                                               0x8
+#define DP0_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE_MASK                                                      0x00000010L
+#define DP0_DP_LINK_CNTL__DP_LINK_STATUS_MASK                                                                 0x00000100L
+//DP0_DP_PIXEL_FORMAT
+#define DP0_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                                                       0x0
+#define DP0_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT__SHIFT                                                 0x4
+#define DP0_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                                              0x8
+#define DP0_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT__SHIFT                                                   0x10
+#define DP0_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                                         0x00000001L
+#define DP0_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT_MASK                                                   0x00000030L
+#define DP0_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                                                0x00000700L
+#define DP0_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT_MASK                                                     0x00010000L
+//DP0_DP_MSA_COLORIMETRY
+#define DP0_DP_MSA_COLORIMETRY__DP_MSA_MISC0__SHIFT                                                           0x18
+#define DP0_DP_MSA_COLORIMETRY__DP_MSA_MISC0_MASK                                                             0xFF000000L
+//DP0_DP_CONFIG
+#define DP0_DP_CONFIG__DP_UDI_LANES__SHIFT                                                                    0x0
+#define DP0_DP_CONFIG__DP_UDI_LANES_MASK                                                                      0x00000003L
+//DP0_DP_VID_STREAM_CNTL
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE__SHIFT                                                   0x0
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER__SHIFT                                                0x8
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS__SHIFT                                                   0x10
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT__SHIFT                                           0x14
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE_MASK                                                     0x00000001L
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER_MASK                                                  0x00000300L
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS_MASK                                                     0x00010000L
+#define DP0_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT_MASK                                             0x00100000L
+//DP0_DP_STEER_FIFO
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE__SHIFT                                                        0x0
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_RESET__SHIFT                                                         0x1
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE__SHIFT                                                    0x2
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG__SHIFT                                                      0x4
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT__SHIFT                                                       0x5
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK__SHIFT                                                       0x6
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK__SHIFT                                                      0x7
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE_MASK                                                          0x00000001L
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_RESET_MASK                                                           0x00000002L
+#define DP0_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE_MASK                                                      0x00000004L
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG_MASK                                                        0x00000010L
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT_MASK                                                         0x00000020L
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK_MASK                                                         0x00000040L
+#define DP0_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK_MASK                                                        0x00000080L
+//DP0_DP_MSA_MISC
+#define DP0_DP_MSA_MISC__DP_MSA_MISC1__SHIFT                                                                  0x0
+#define DP0_DP_MSA_MISC__DP_MSA_MISC2__SHIFT                                                                  0x8
+#define DP0_DP_MSA_MISC__DP_MSA_MISC3__SHIFT                                                                  0x10
+#define DP0_DP_MSA_MISC__DP_MSA_MISC4__SHIFT                                                                  0x18
+#define DP0_DP_MSA_MISC__DP_MSA_MISC1_MASK                                                                    0x000000FFL
+#define DP0_DP_MSA_MISC__DP_MSA_MISC2_MASK                                                                    0x0000FF00L
+#define DP0_DP_MSA_MISC__DP_MSA_MISC3_MASK                                                                    0x00FF0000L
+#define DP0_DP_MSA_MISC__DP_MSA_MISC4_MASK                                                                    0xFF000000L
+//DP0_DP_DPHY_INTERNAL_CTRL
+#define DP0_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN__SHIFT                                         0x0
+#define DP0_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL__SHIFT                                        0x4
+#define DP0_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN_MASK                                           0x00000001L
+#define DP0_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL_MASK                                          0x00000010L
+//DP0_DP_VID_TIMING
+#define DP0_DP_VID_TIMING__DP_VID_M_N_GEN_EN__SHIFT                                                           0x8
+#define DP0_DP_VID_TIMING__DP_VID_M_DIV__SHIFT                                                                0xc
+#define DP0_DP_VID_TIMING__DP_VID_N_INTERVAL__SHIFT                                                           0xe
+#define DP0_DP_VID_TIMING__DP_VID_M_N_GEN_EN_MASK                                                             0x00000100L
+#define DP0_DP_VID_TIMING__DP_VID_M_DIV_MASK                                                                  0x00003000L
+#define DP0_DP_VID_TIMING__DP_VID_N_INTERVAL_MASK                                                             0x0000C000L
+//DP0_DP_VID_N
+#define DP0_DP_VID_N__DP_VID_N__SHIFT                                                                         0x0
+#define DP0_DP_VID_N__DP_VID_N_MASK                                                                           0x00FFFFFFL
+//DP0_DP_VID_M
+#define DP0_DP_VID_M__DP_VID_M__SHIFT                                                                         0x0
+#define DP0_DP_VID_M__DP_VID_M_MASK                                                                           0x00FFFFFFL
+//DP0_DP_LINK_FRAMING_CNTL
+#define DP0_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL__SHIFT                                                  0x0
+#define DP0_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE__SHIFT                                  0x14
+#define DP0_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE__SHIFT                                                      0x18
+#define DP0_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE__SHIFT                                           0x1c
+#define DP0_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL_MASK                                                    0x0003FFFFL
+#define DP0_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE_MASK                                    0x00100000L
+#define DP0_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE_MASK                                                        0x01000000L
+#define DP0_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE_MASK                                             0x10000000L
+//DP0_DP_HBR2_EYE_PATTERN
+#define DP0_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE__SHIFT                                            0x0
+#define DP0_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE_MASK                                              0x00000001L
+//DP0_DP_VID_MSA_VBID
+#define DP0_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION__SHIFT                                                       0x0
+#define DP0_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE__SHIFT                                            0xc
+#define DP0_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL__SHIFT                                                     0x18
+#define DP0_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION_MASK                                                         0x00000FFFL
+#define DP0_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE_MASK                                              0x00001000L
+#define DP0_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL_MASK                                                       0x01000000L
+//DP0_DP_VID_INTERRUPT_CNTL
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT__SHIFT                                           0x0
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK__SHIFT                                           0x1
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK__SHIFT                                          0x2
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT_MASK                                             0x00000001L
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK_MASK                                             0x00000002L
+#define DP0_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK_MASK                                            0x00000004L
+//DP0_DP_DPHY_CNTL
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0__SHIFT                                                         0x0
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1__SHIFT                                                         0x1
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2__SHIFT                                                         0x2
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3__SHIFT                                                         0x3
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_EN__SHIFT                                                                  0x4
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW__SHIFT                                                        0x5
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS__SHIFT                                                       0x6
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM__SHIFT                                               0x7
+#define DP0_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL__SHIFT                                                           0x8
+#define DP0_DP_DPHY_CNTL__DPHY_BYPASS__SHIFT                                                                  0x10
+#define DP0_DP_DPHY_CNTL__DPHY_SKEW_BYPASS__SHIFT                                                             0x18
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0_MASK                                                           0x00000001L
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1_MASK                                                           0x00000002L
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2_MASK                                                           0x00000004L
+#define DP0_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3_MASK                                                           0x00000008L
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_EN_MASK                                                                    0x00000010L
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW_MASK                                                          0x00000020L
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS_MASK                                                         0x00000040L
+#define DP0_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM_MASK                                                 0x00000080L
+#define DP0_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL_MASK                                                             0x00000100L
+#define DP0_DP_DPHY_CNTL__DPHY_BYPASS_MASK                                                                    0x00010000L
+#define DP0_DP_DPHY_CNTL__DPHY_SKEW_BYPASS_MASK                                                               0x01000000L
+//DP0_DP_DPHY_TRAINING_PATTERN_SEL
+#define DP0_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL__SHIFT                                    0x0
+#define DP0_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL_MASK                                      0x00000003L
+//DP0_DP_DPHY_SYM0
+#define DP0_DP_DPHY_SYM0__DPHY_SYM1__SHIFT                                                                    0x0
+#define DP0_DP_DPHY_SYM0__DPHY_SYM2__SHIFT                                                                    0xa
+#define DP0_DP_DPHY_SYM0__DPHY_SYM3__SHIFT                                                                    0x14
+#define DP0_DP_DPHY_SYM0__DPHY_SYM1_MASK                                                                      0x000003FFL
+#define DP0_DP_DPHY_SYM0__DPHY_SYM2_MASK                                                                      0x000FFC00L
+#define DP0_DP_DPHY_SYM0__DPHY_SYM3_MASK                                                                      0x3FF00000L
+//DP0_DP_DPHY_SYM1
+#define DP0_DP_DPHY_SYM1__DPHY_SYM4__SHIFT                                                                    0x0
+#define DP0_DP_DPHY_SYM1__DPHY_SYM5__SHIFT                                                                    0xa
+#define DP0_DP_DPHY_SYM1__DPHY_SYM6__SHIFT                                                                    0x14
+#define DP0_DP_DPHY_SYM1__DPHY_SYM4_MASK                                                                      0x000003FFL
+#define DP0_DP_DPHY_SYM1__DPHY_SYM5_MASK                                                                      0x000FFC00L
+#define DP0_DP_DPHY_SYM1__DPHY_SYM6_MASK                                                                      0x3FF00000L
+//DP0_DP_DPHY_SYM2
+#define DP0_DP_DPHY_SYM2__DPHY_SYM7__SHIFT                                                                    0x0
+#define DP0_DP_DPHY_SYM2__DPHY_SYM8__SHIFT                                                                    0xa
+#define DP0_DP_DPHY_SYM2__DPHY_SYM7_MASK                                                                      0x000003FFL
+#define DP0_DP_DPHY_SYM2__DPHY_SYM8_MASK                                                                      0x000FFC00L
+//DP0_DP_DPHY_8B10B_CNTL
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET__SHIFT                                                       0x8
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP__SHIFT                                                    0x10
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP__SHIFT                                                    0x18
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET_MASK                                                         0x00000100L
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP_MASK                                                      0x00010000L
+#define DP0_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP_MASK                                                      0x01000000L
+//DP0_DP_DPHY_PRBS_CNTL
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN__SHIFT                                                            0x0
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL__SHIFT                                                           0x4
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED__SHIFT                                                          0x8
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN_MASK                                                              0x00000001L
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL_MASK                                                             0x00000030L
+#define DP0_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED_MASK                                                            0x7FFFFF00L
+//DP0_DP_DPHY_SCRAM_CNTL
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS__SHIFT                                                     0x0
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE__SHIFT                                                 0x4
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT__SHIFT                                                0x8
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE__SHIFT                                                   0x18
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS_MASK                                                       0x00000001L
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE_MASK                                                   0x00000010L
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT_MASK                                                  0x0003FF00L
+#define DP0_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE_MASK                                                     0x01000000L
+//DP0_DP_TU_CNTL
+#define DP0_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG__SHIFT                                                            0x8
+#define DP0_DP_TU_CNTL__DP_TU_OVERFLOW_ACK__SHIFT                                                             0xc
+#define DP0_DP_TU_CNTL__DP_TU_SIZE__SHIFT                                                                     0x18
+#define DP0_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG_MASK                                                              0x00000100L
+#define DP0_DP_TU_CNTL__DP_TU_OVERFLOW_ACK_MASK                                                               0x00001000L
+#define DP0_DP_TU_CNTL__DP_TU_SIZE_MASK                                                                       0x3F000000L
+//DP0_DP_PIXEL_FORMAT_DB_CNTL
+#define DP0_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE__SHIFT                                            0x0
+#define DP0_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING__SHIFT                                           0x4
+#define DP0_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE_MASK                                              0x00000001L
+#define DP0_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING_MASK                                             0x00000010L
+//DP0_DP_CP_LINK_VERIFICATION_PATTERN
+#define DP0_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN__SHIFT                           0x0
+#define DP0_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN_MASK                             0x0000FFFFL
+//DP0_DP_SEC_CNTL
+#define DP0_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE__SHIFT                                                          0x0
+#define DP0_DP_SEC_CNTL__DP_SEC_ASP_ENABLE__SHIFT                                                             0x4
+#define DP0_DP_SEC_CNTL__DP_SEC_ATP_ENABLE__SHIFT                                                             0x8
+#define DP0_DP_SEC_CNTL__DP_SEC_AIP_ENABLE__SHIFT                                                             0xc
+#define DP0_DP_SEC_CNTL__DP_SEC_ACM_ENABLE__SHIFT                                                             0x10
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE__SHIFT                                                            0x14
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE__SHIFT                                                            0x15
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE__SHIFT                                                            0x16
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE__SHIFT                                                            0x17
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE__SHIFT                                                            0x18
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE__SHIFT                                                            0x19
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE__SHIFT                                                            0x1a
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE__SHIFT                                                            0x1b
+#define DP0_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE_MASK                                                            0x00000001L
+#define DP0_DP_SEC_CNTL__DP_SEC_ASP_ENABLE_MASK                                                               0x00000010L
+#define DP0_DP_SEC_CNTL__DP_SEC_ATP_ENABLE_MASK                                                               0x00000100L
+#define DP0_DP_SEC_CNTL__DP_SEC_AIP_ENABLE_MASK                                                               0x00001000L
+#define DP0_DP_SEC_CNTL__DP_SEC_ACM_ENABLE_MASK                                                               0x00010000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE_MASK                                                              0x00100000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE_MASK                                                              0x00200000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE_MASK                                                              0x00400000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE_MASK                                                              0x00800000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE_MASK                                                              0x01000000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE_MASK                                                              0x02000000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE_MASK                                                              0x04000000L
+#define DP0_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE_MASK                                                              0x08000000L
+//DP0_DP_SEC_CNTL1
+#define DP0_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE__SHIFT                                                           0x0
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE__SHIFT                                                   0x1
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY__SHIFT                                                         0x4
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND__SHIFT                                                             0x5
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING__SHIFT                                                     0x6
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED__SHIFT                                             0x7
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE__SHIFT                                                   0x9
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE__SHIFT                                                   0xa
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE__SHIFT                                                   0xb
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE__SHIFT                                                   0xc
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE__SHIFT                                                   0xd
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE__SHIFT                                                   0xe
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE__SHIFT                                                   0xf
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE_MASK                                                             0x00000001L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE_MASK                                                     0x00000002L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY_MASK                                                           0x00000010L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_MASK                                                               0x00000020L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING_MASK                                                       0x00000040L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED_MASK                                               0x00000080L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE_MASK                                                     0x00000200L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE_MASK                                                     0x00000400L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE_MASK                                                     0x00000800L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE_MASK                                                     0x00001000L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE_MASK                                                     0x00002000L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE_MASK                                                     0x00004000L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE_MASK                                                     0x00008000L
+#define DP0_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_SEC_FRAMING1
+#define DP0_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION__SHIFT                                               0x0
+#define DP0_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP0_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION_MASK                                                 0x00000FFFL
+#define DP0_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP0_DP_SEC_FRAMING2
+#define DP0_DP_SEC_FRAMING2__DP_SEC_START_POSITION__SHIFT                                                     0x0
+#define DP0_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP0_DP_SEC_FRAMING2__DP_SEC_START_POSITION_MASK                                                       0x0000FFFFL
+#define DP0_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP0_DP_SEC_FRAMING3
+#define DP0_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE__SHIFT                                                    0x0
+#define DP0_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH__SHIFT                                                0x10
+#define DP0_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE_MASK                                                      0x00003FFFL
+#define DP0_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH_MASK                                                  0xFFFF0000L
+//DP0_DP_SEC_FRAMING4
+#define DP0_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING__SHIFT                                                      0x0
+#define DP0_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS__SHIFT                                                   0x14
+#define DP0_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK__SHIFT                                                      0x18
+#define DP0_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE__SHIFT                                                         0x1c
+#define DP0_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS__SHIFT                                                  0x1d
+#define DP0_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING_MASK                                                        0x00000001L
+#define DP0_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS_MASK                                                     0x00100000L
+#define DP0_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK_MASK                                                        0x01000000L
+#define DP0_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_MASK                                                           0x10000000L
+#define DP0_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS_MASK                                                    0x20000000L
+//DP0_DP_SEC_AUD_N
+#define DP0_DP_SEC_AUD_N__DP_SEC_AUD_N__SHIFT                                                                 0x0
+#define DP0_DP_SEC_AUD_N__DP_SEC_AUD_N_MASK                                                                   0x00FFFFFFL
+//DP0_DP_SEC_AUD_N_READBACK
+#define DP0_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK__SHIFT                                               0x0
+#define DP0_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK_MASK                                                 0x00FFFFFFL
+//DP0_DP_SEC_AUD_M
+#define DP0_DP_SEC_AUD_M__DP_SEC_AUD_M__SHIFT                                                                 0x0
+#define DP0_DP_SEC_AUD_M__DP_SEC_AUD_M_MASK                                                                   0x00FFFFFFL
+//DP0_DP_SEC_AUD_M_READBACK
+#define DP0_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK__SHIFT                                               0x0
+#define DP0_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK_MASK                                                 0x00FFFFFFL
+//DP0_DP_SEC_TIMESTAMP
+#define DP0_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE__SHIFT                                                    0x0
+#define DP0_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE_MASK                                                      0x00000001L
+//DP0_DP_SEC_PACKET_CNTL
+#define DP0_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY__SHIFT                                                    0x4
+#define DP0_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER__SHIFT                                              0x18
+#define DP0_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY_MASK                                                      0x00000010L
+#define DP0_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER_MASK                                                0x3F000000L
+//DP0_DP_MSE_RATE_CNTL
+#define DP0_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y__SHIFT                                                            0x0
+#define DP0_DP_MSE_RATE_CNTL__DP_MSE_RATE_X__SHIFT                                                            0x1a
+#define DP0_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y_MASK                                                              0x03FFFFFFL
+#define DP0_DP_MSE_RATE_CNTL__DP_MSE_RATE_X_MASK                                                              0xFC000000L
+//DP0_DP_CP_MSE_STATUS
+#define DP0_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT__SHIFT                                                    0x0
+#define DP0_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE__SHIFT                                              0x4
+#define DP0_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT_MASK                                                      0x00000001L
+#define DP0_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE_MASK                                                0x00000010L
+//DP0_DP_MSE_RATE_UPDATE
+#define DP0_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING__SHIFT                                             0x0
+#define DP0_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING_MASK                                               0x00000001L
+//DP0_DP_MSE_SAT0
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SRC0__SHIFT                                                               0x0
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0__SHIFT                                                           0x4
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0__SHIFT                                                   0x5
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0__SHIFT                                                        0x8
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SRC1__SHIFT                                                               0x10
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1__SHIFT                                                           0x14
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1__SHIFT                                                   0x15
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1__SHIFT                                                        0x18
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SRC0_MASK                                                                 0x00000007L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0_MASK                                                             0x00000010L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0_MASK                                                     0x00000020L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0_MASK                                                          0x00003F00L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SRC1_MASK                                                                 0x00070000L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1_MASK                                                             0x00100000L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1_MASK                                                     0x00200000L
+#define DP0_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1_MASK                                                          0x3F000000L
+//DP0_DP_MSE_SAT1
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SRC2__SHIFT                                                               0x0
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2__SHIFT                                                           0x4
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2__SHIFT                                                   0x5
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2__SHIFT                                                        0x8
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SRC3__SHIFT                                                               0x10
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3__SHIFT                                                           0x14
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3__SHIFT                                                   0x15
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3__SHIFT                                                        0x18
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SRC2_MASK                                                                 0x00000007L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2_MASK                                                             0x00000010L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2_MASK                                                     0x00000020L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2_MASK                                                          0x00003F00L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SRC3_MASK                                                                 0x00070000L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3_MASK                                                             0x00100000L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3_MASK                                                     0x00200000L
+#define DP0_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3_MASK                                                          0x3F000000L
+//DP0_DP_MSE_SAT2
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SRC4__SHIFT                                                               0x0
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4__SHIFT                                                           0x4
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4__SHIFT                                                   0x5
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4__SHIFT                                                        0x8
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SRC5__SHIFT                                                               0x10
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5__SHIFT                                                           0x14
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5__SHIFT                                                   0x15
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5__SHIFT                                                        0x18
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SRC4_MASK                                                                 0x00000007L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4_MASK                                                             0x00000010L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4_MASK                                                     0x00000020L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4_MASK                                                          0x00003F00L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SRC5_MASK                                                                 0x00070000L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5_MASK                                                             0x00100000L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5_MASK                                                     0x00200000L
+#define DP0_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5_MASK                                                          0x3F000000L
+//DP0_DP_MSE_SAT_UPDATE
+#define DP0_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE__SHIFT                                                       0x0
+#define DP0_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT__SHIFT                                                   0x8
+#define DP0_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE_MASK                                                         0x00000003L
+#define DP0_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT_MASK                                                     0x00000100L
+//DP0_DP_MSE_LINK_TIMING
+#define DP0_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME__SHIFT                                                      0x0
+#define DP0_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE__SHIFT                                                       0x10
+#define DP0_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME_MASK                                                        0x000003FFL
+#define DP0_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE_MASK                                                         0x00030000L
+//DP0_DP_MSE_MISC_CNTL
+#define DP0_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE__SHIFT                                                        0x0
+#define DP0_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER__SHIFT                                                      0x8
+#define DP0_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE_MASK                                                          0x00000001L
+#define DP0_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER_MASK                                                        0x00000100L
+//DP0_DP_TEST_DEBUG_DATA
+#define DP0_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define DP0_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//DP0_DP_DPHY_BS_SR_SWAP_CNTL
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT__SHIFT                                                0x0
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE__SHIFT                                              0xf
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START__SHIFT                                          0x10
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_MASK                                                  0x000003FFL
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE_MASK                                                0x00008000L
+#define DP0_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START_MASK                                            0x00010000L
+//DP0_DP_DPHY_HBR2_PATTERN_CONTROL
+#define DP0_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL__SHIFT                                 0x0
+#define DP0_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL_MASK                                   0x00000007L
+//DP0_DP_MSE_SAT0_STATUS
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS__SHIFT                                                 0x0
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS__SHIFT                                             0x4
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS__SHIFT                                     0x5
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS__SHIFT                                          0x8
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS__SHIFT                                                 0x10
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS__SHIFT                                             0x14
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS__SHIFT                                     0x15
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS__SHIFT                                          0x18
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS_MASK                                                   0x00000007L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS_MASK                                               0x00000010L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS_MASK                                       0x00000020L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS_MASK                                            0x00003F00L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS_MASK                                                   0x00070000L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS_MASK                                               0x00100000L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS_MASK                                       0x00200000L
+#define DP0_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS_MASK                                            0x3F000000L
+//DP0_DP_MSE_SAT1_STATUS
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS__SHIFT                                                 0x0
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS__SHIFT                                             0x4
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS__SHIFT                                     0x5
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS__SHIFT                                          0x8
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS__SHIFT                                                 0x10
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS__SHIFT                                             0x14
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS__SHIFT                                     0x15
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS__SHIFT                                          0x18
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS_MASK                                                   0x00000007L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS_MASK                                               0x00000010L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS_MASK                                       0x00000020L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS_MASK                                            0x00003F00L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS_MASK                                                   0x00070000L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS_MASK                                               0x00100000L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS_MASK                                       0x00200000L
+#define DP0_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS_MASK                                            0x3F000000L
+//DP0_DP_MSE_SAT2_STATUS
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS__SHIFT                                                 0x0
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS__SHIFT                                             0x4
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS__SHIFT                                     0x5
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS__SHIFT                                          0x8
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS__SHIFT                                                 0x10
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS__SHIFT                                             0x14
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS__SHIFT                                     0x15
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS__SHIFT                                          0x18
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS_MASK                                                   0x00000007L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS_MASK                                               0x00000010L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS_MASK                                       0x00000020L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS_MASK                                            0x00003F00L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS_MASK                                                   0x00070000L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS_MASK                                               0x00100000L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS_MASK                                       0x00200000L
+#define DP0_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS_MASK                                            0x3F000000L
+//DP0_DP_HBLANK_CONTROL
+#define DP0_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                                          0x0
+#define DP0_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                                            0x0000FFFFL
+//DP0_DP_MSA_TIMING_PARAM1
+#define DP0_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL__SHIFT                                                        0x0
+#define DP0_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL__SHIFT                                                        0x10
+#define DP0_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL_MASK                                                          0x0000FFFFL
+#define DP0_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL_MASK                                                          0xFFFF0000L
+//DP0_DP_MSA_TIMING_PARAM2
+#define DP0_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART__SHIFT                                                        0x0
+#define DP0_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART__SHIFT                                                        0x10
+#define DP0_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART_MASK                                                          0x0000FFFFL
+#define DP0_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART_MASK                                                          0xFFFF0000L
+//DP0_DP_MSA_TIMING_PARAM3
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH__SHIFT                                                    0x0
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY__SHIFT                                                 0xf
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH__SHIFT                                                    0x10
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY__SHIFT                                                 0x1f
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH_MASK                                                      0x00007FFFL
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY_MASK                                                   0x00008000L
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH_MASK                                                      0x7FFF0000L
+#define DP0_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY_MASK                                                   0x80000000L
+//DP0_DP_MSA_TIMING_PARAM4
+#define DP0_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT__SHIFT                                                       0x0
+#define DP0_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH__SHIFT                                                        0x10
+#define DP0_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT_MASK                                                         0x0000FFFFL
+#define DP0_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH_MASK                                                          0xFFFF0000L
+//DP0_DP_MSO_CNTL
+#define DP0_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK__SHIFT                                                         0x0
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE__SHIFT                                                      0x4
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE__SHIFT                                                         0x8
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE__SHIFT                                                         0xc
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE__SHIFT                                                         0x10
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE__SHIFT                                                         0x14
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE__SHIFT                                                        0x18
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE__SHIFT                                                        0x1c
+#define DP0_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK_MASK                                                           0x00000003L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE_MASK                                                        0x000000F0L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE_MASK                                                           0x00000F00L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE_MASK                                                           0x0000F000L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE_MASK                                                           0x000F0000L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE_MASK                                                           0x00F00000L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE_MASK                                                          0x0F000000L
+#define DP0_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE_MASK                                                          0xF0000000L
+//DP0_DP_MSO_CNTL1
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE__SHIFT                                                       0x0
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE__SHIFT                                                       0x4
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE__SHIFT                                                       0x8
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE__SHIFT                                                       0xc
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE__SHIFT                                                       0x10
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE__SHIFT                                                       0x14
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE__SHIFT                                                       0x1c
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE_MASK                                                         0x0000000FL
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE_MASK                                                         0x000000F0L
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE_MASK                                                         0x00000F00L
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE_MASK                                                         0x0000F000L
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE_MASK                                                         0x000F0000L
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE_MASK                                                         0x00F00000L
+#define DP0_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE_MASK                                                         0xF0000000L
+//DP0_DP_STEER_FIFO_CNTL
+#define DP0_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN__SHIFT                       0x8
+#define DP0_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                        0x10
+#define DP0_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN_MASK                         0x00000100L
+#define DP0_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE_MASK                                          0x00030000L
+//DP0_DP_SEC_CNTL2
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND__SHIFT                                                             0x0
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING__SHIFT                                                     0x1
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED__SHIFT                                             0x2
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE__SHIFT                                                    0x3
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND__SHIFT                                                             0x4
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING__SHIFT                                                     0x5
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED__SHIFT                                             0x6
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE__SHIFT                                                    0x7
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND__SHIFT                                                             0x8
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING__SHIFT                                                     0x9
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED__SHIFT                                             0xa
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE__SHIFT                                                    0xb
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND__SHIFT                                                             0xc
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING__SHIFT                                                     0xd
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE__SHIFT                                                    0xf
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND__SHIFT                                                             0x10
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING__SHIFT                                                     0x11
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED__SHIFT                                             0x12
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE__SHIFT                                                    0x13
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND__SHIFT                                                             0x14
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING__SHIFT                                                     0x15
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED__SHIFT                                             0x16
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE__SHIFT                                                    0x17
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND__SHIFT                                                             0x18
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING__SHIFT                                                     0x19
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED__SHIFT                                             0x1a
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE__SHIFT                                                    0x1b
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP11_PPS__SHIFT                                                             0x1c
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_MASK                                                               0x00000001L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING_MASK                                                       0x00000002L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED_MASK                                               0x00000004L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE_MASK                                                      0x00000008L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_MASK                                                               0x00000010L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING_MASK                                                       0x00000020L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED_MASK                                               0x00000040L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE_MASK                                                      0x00000080L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_MASK                                                               0x00000100L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING_MASK                                                       0x00000200L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED_MASK                                               0x00000400L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE_MASK                                                      0x00000800L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_MASK                                                               0x00001000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING_MASK                                                       0x00002000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE_MASK                                                      0x00008000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_MASK                                                               0x00010000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING_MASK                                                       0x00020000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED_MASK                                               0x00040000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE_MASK                                                      0x00080000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_MASK                                                               0x00100000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING_MASK                                                       0x00200000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED_MASK                                               0x00400000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE_MASK                                                      0x00800000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_MASK                                                               0x01000000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING_MASK                                                       0x02000000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED_MASK                                               0x04000000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE_MASK                                                      0x08000000L
+#define DP0_DP_SEC_CNTL2__DP_SEC_GSP11_PPS_MASK                                                               0x10000000L
+//DP0_DP_SEC_CNTL3
+#define DP0_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM__SHIFT                                                         0x0
+#define DP0_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP0_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_SEC_CNTL4
+#define DP0_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM__SHIFT                                                         0x0
+#define DP0_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP0_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_SEC_CNTL5
+#define DP0_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM__SHIFT                                                         0x0
+#define DP0_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP0_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_SEC_CNTL6
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM__SHIFT                                                         0x0
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE__SHIFT                                                    0x10
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE__SHIFT                                                    0x11
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE__SHIFT                                                    0x12
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE__SHIFT                                                    0x13
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE__SHIFT                                                    0x14
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE__SHIFT                                                    0x15
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE__SHIFT                                                    0x16
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE__SHIFT                                                    0x17
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE__SHIFT                                                    0x18
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE__SHIFT                                                    0x19
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE__SHIFT                                                   0x1a
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE__SHIFT                                                   0x1b
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE_MASK                                                      0x00010000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE_MASK                                                      0x00020000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE_MASK                                                      0x00040000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE_MASK                                                      0x00080000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE_MASK                                                      0x00100000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE_MASK                                                      0x00200000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE_MASK                                                      0x00400000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE_MASK                                                      0x00800000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE_MASK                                                      0x01000000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE_MASK                                                      0x02000000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE_MASK                                                     0x04000000L
+#define DP0_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE_MASK                                                     0x08000000L
+//DP0_DP_SEC_CNTL7
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE__SHIFT                                                      0x0
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE__SHIFT                                                     0x1
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE__SHIFT                                                      0x4
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE__SHIFT                                                     0x5
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE__SHIFT                                                      0x8
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE__SHIFT                                                     0x9
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE__SHIFT                                                      0xc
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE__SHIFT                                                     0xd
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE__SHIFT                                                      0x10
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE__SHIFT                                                     0x11
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE__SHIFT                                                      0x14
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE__SHIFT                                                     0x15
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE__SHIFT                                                      0x18
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE__SHIFT                                                     0x19
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE__SHIFT                                                      0x1c
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE__SHIFT                                                     0x1d
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE_MASK                                                        0x00000001L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE_MASK                                                       0x00000002L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE_MASK                                                        0x00000010L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE_MASK                                                       0x00000020L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE_MASK                                                        0x00000100L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE_MASK                                                       0x00000200L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE_MASK                                                        0x00001000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE_MASK                                                       0x00002000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE_MASK                                                        0x00010000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE_MASK                                                       0x00020000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE_MASK                                                        0x00100000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE_MASK                                                       0x00200000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE_MASK                                                        0x01000000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE_MASK                                                       0x02000000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE_MASK                                                        0x10000000L
+#define DP0_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE_MASK                                                       0x20000000L
+//DP0_DP_DB_CNTL
+#define DP0_DP_DB_CNTL__DP_DB_PENDING__SHIFT                                                                  0x0
+#define DP0_DP_DB_CNTL__DP_DB_TAKEN__SHIFT                                                                    0x4
+#define DP0_DP_DB_CNTL__DP_DB_TAKEN_CLR__SHIFT                                                                0x5
+#define DP0_DP_DB_CNTL__DP_DB_LOCK__SHIFT                                                                     0x8
+#define DP0_DP_DB_CNTL__DP_DB_DISABLE__SHIFT                                                                  0xc
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_PENDING__SHIFT                                                          0xf
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN__SHIFT                                                            0x10
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR__SHIFT                                                        0x11
+#define DP0_DP_DB_CNTL__DP_DB_PENDING_MASK                                                                    0x00000001L
+#define DP0_DP_DB_CNTL__DP_DB_TAKEN_MASK                                                                      0x00000010L
+#define DP0_DP_DB_CNTL__DP_DB_TAKEN_CLR_MASK                                                                  0x00000020L
+#define DP0_DP_DB_CNTL__DP_DB_LOCK_MASK                                                                       0x00000100L
+#define DP0_DP_DB_CNTL__DP_DB_DISABLE_MASK                                                                    0x00001000L
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_PENDING_MASK                                                            0x00008000L
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_MASK                                                              0x00010000L
+#define DP0_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR_MASK                                                          0x00020000L
+//DP0_DP_MSA_VBID_MISC
+#define DP0_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE__SHIFT                                         0x0
+#define DP0_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                                      0x4
+#define DP0_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE__SHIFT                                                        0x8
+#define DP0_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE__SHIFT                                                        0x9
+#define DP0_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN__SHIFT                                                     0xc
+#define DP0_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN__SHIFT                                                     0xd
+#define DP0_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE__SHIFT                                                  0xf
+#define DP0_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM__SHIFT                                                        0x10
+#define DP0_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_MASK                                           0x00000003L
+#define DP0_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                                        0x00000010L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_MASK                                                          0x00000100L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_MASK                                                          0x00000200L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN_MASK                                                       0x00001000L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN_MASK                                                       0x00002000L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE_MASK                                                    0x00008000L
+#define DP0_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM_MASK                                                          0xFFFF0000L
+//DP0_DP_SEC_METADATA_TRANSMISSION
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE__SHIFT                                0x0
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE__SHIFT                        0x1
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE__SHIFT                            0x4
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE__SHIFT                                  0x10
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE_MASK                                  0x00000001L
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE_MASK                          0x00000002L
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE_MASK                              0x000000F0L
+#define DP0_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_MASK                                    0xFFFF0000L
+//DP0_DP_ALPM_CNTL
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND__SHIFT                                                         0x0
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING__SHIFT                                                      0x1
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND__SHIFT                                                       0x2
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING__SHIFT                                                    0x3
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE__SHIFT                                            0x4
+#define DP0_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO__SHIFT                                        0x5
+#define DP0_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE__SHIFT                                                  0x6
+#define DP0_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP__SHIFT                                     0x7
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM__SHIFT                                                  0x8
+#define DP0_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS__SHIFT                                   0xb
+#define DP0_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN__SHIFT                                       0xc
+#define DP0_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE__SHIFT                                                       0xf
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM__SHIFT                                             0x10
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND_MASK                                                           0x00000001L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING_MASK                                                        0x00000002L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND_MASK                                                         0x00000004L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING_MASK                                                      0x00000008L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE_MASK                                              0x00000010L
+#define DP0_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO_MASK                                          0x00000020L
+#define DP0_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE_MASK                                                    0x00000040L
+#define DP0_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_MASK                                       0x00000080L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM_MASK                                                    0x00000300L
+#define DP0_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS_MASK                                     0x00000800L
+#define DP0_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN_MASK                                         0x00001000L
+#define DP0_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE_MASK                                                         0x00008000L
+#define DP0_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM_MASK                                               0xFFFF0000L
+//DP0_DP_GSP8_CNTL
+#define DP0_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE__SHIFT                                                       0x0
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE__SHIFT                                                           0x4
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND__SHIFT                                                             0x7
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING__SHIFT                                                     0xc
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE_MASK                                                         0x0000000FL
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE_MASK                                                             0x00000010L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_MASK                                                               0x00000080L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING_MASK                                                       0x00001000L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP0_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_GSP9_CNTL
+#define DP0_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE__SHIFT                                                       0x0
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE__SHIFT                                                           0x4
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND__SHIFT                                                             0x7
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING__SHIFT                                                     0xc
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM__SHIFT                                                         0x10
+#define DP0_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE_MASK                                                         0x0000000FL
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE_MASK                                                             0x00000010L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_MASK                                                               0x00000080L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING_MASK                                                       0x00001000L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP0_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP0_DP_GSP10_CNTL
+#define DP0_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE__SHIFT                                                     0x0
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE__SHIFT                                                         0x4
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND__SHIFT                                                           0x7
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING__SHIFT                                                   0xc
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM__SHIFT                                                       0x10
+#define DP0_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE_MASK                                                       0x0000000FL
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE_MASK                                                           0x00000010L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_MASK                                                             0x00000080L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING_MASK                                                     0x00001000L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP0_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP0_DP_GSP11_CNTL
+#define DP0_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE__SHIFT                                                     0x0
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE__SHIFT                                                         0x4
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND__SHIFT                                                           0x7
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING__SHIFT                                                   0xc
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM__SHIFT                                                       0x10
+#define DP0_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE_MASK                                                       0x0000000FL
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE_MASK                                                           0x00000010L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_MASK                                                             0x00000080L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING_MASK                                                     0x00001000L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP0_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP0_DP_GSP_EN_DB_STATUS
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING__SHIFT                                             0x0
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING__SHIFT                                             0x1
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING__SHIFT                                             0x2
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING__SHIFT                                             0x3
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING__SHIFT                                             0x4
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING__SHIFT                                             0x5
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING__SHIFT                                             0x6
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING__SHIFT                                             0x7
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING__SHIFT                                             0x8
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING__SHIFT                                             0x9
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING__SHIFT                                            0xa
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING__SHIFT                                            0xb
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING_MASK                                               0x00000001L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING_MASK                                               0x00000002L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING_MASK                                               0x00000004L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING_MASK                                               0x00000008L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING_MASK                                               0x00000010L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING_MASK                                               0x00000020L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING_MASK                                               0x00000040L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING_MASK                                               0x00000080L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING_MASK                                               0x00000100L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING_MASK                                               0x00000200L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING_MASK                                              0x00000400L
+#define DP0_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING_MASK                                              0x00000800L
+//DP0_DP_AUXLESS_ALPM_CNTL1
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT__SHIFT                                              0x4
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY__SHIFT                                               0x8
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL__SHIFT                                            0x14
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE__SHIFT                                     0x1f
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT_MASK                                                0x000000F0L
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY_MASK                                                 0x0007FF00L
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL_MASK                                              0x1FF00000L
+#define DP0_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE_MASK                                       0x80000000L
+//DP0_DP_AUXLESS_ALPM_CNTL2
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME__SHIFT                                           0x0
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND__SHIFT                                                 0x7
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE__SHIFT                                            0x10
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING__SHIFT                                              0x11
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE__SHIFT                                            0x12
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING__SHIFT                                              0x13
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD__SHIFT                                          0x14
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME_MASK                                             0x0000007FL
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND_MASK                                                   0x00000080L
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE_MASK                                              0x00010000L
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING_MASK                                                0x00020000L
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE_MASK                                              0x00040000L
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING_MASK                                                0x00080000L
+#define DP0_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD_MASK                                            0x3FF00000L
+//DP0_DP_AUXLESS_ALPM_CNTL3
+#define DP0_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM__SHIFT                                             0x0
+#define DP0_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM__SHIFT                                             0x10
+#define DP0_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM_MASK                                               0x0000FFFFL
+#define DP0_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM_MASK                                               0xFFFF0000L
+//DP0_DP_AUXLESS_ALPM_CNTL4
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN__SHIFT                                                  0x1
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL__SHIFT                                   0x2
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME__SHIFT                                     0x3
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE__SHIFT                                       0x4
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS__SHIFT                                           0x5
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE__SHIFT                                               0x6
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM__SHIFT                                                   0x18
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_MASK                                                    0x00000002L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL_MASK                                     0x00000004L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME_MASK                                       0x00000008L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE_MASK                                         0x00000010L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS_MASK                                             0x00000020L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE_MASK                                                 0x00000040L
+#define DP0_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM_MASK                                                     0xFF000000L
+//DP0_DP_AUXLESS_ALPM_CNTL5
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK__SHIFT                                       0x0
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED__SHIFT                                   0x1
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                                     0x2
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR__SHIFT                                      0x3
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM__SHIFT                                  0x8
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM__SHIFT                                   0x10
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK_MASK                                         0x00000001L
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED_MASK                                     0x00000002L
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                                       0x00000004L
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR_MASK                                        0x00000008L
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM_MASK                                    0x0000FF00L
+#define DP0_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM_MASK                                     0xFFFF0000L
+//DP0_DP_STREAM_SYMBOL_COUNT_STATUS
+#define DP0_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT__SHIFT                                          0x0
+#define DP0_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT_MASK                                            0x0000FFFFL
+//DP0_DP_STREAM_SYMBOL_COUNT_CONTROL
+#define DP0_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE__SHIFT                                  0x0
+#define DP0_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET__SHIFT                                   0x4
+#define DP0_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE_MASK                                    0x00000001L
+#define DP0_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET_MASK                                     0x00000010L
+//DP0_DP_LINK_SYMBOL_COUNT_STATUS0
+#define DP0_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT__SHIFT                                             0x0
+#define DP0_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT_MASK                                               0x0000FFFFL
+//DP0_DP_LINK_SYMBOL_COUNT_STATUS1
+#define DP0_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT__SHIFT                                          0x0
+#define DP0_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT_MASK                                            0xFFFFFFFFL
+//DP0_DP_LINK_SYMBOL_COUNT_CONTROL
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE__SHIFT                                      0x0
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET__SHIFT                                       0x4
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE__SHIFT                                   0x8
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET__SHIFT                                    0xc
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE_MASK                                        0x00000001L
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET_MASK                                         0x00000010L
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE_MASK                                     0x00000100L
+#define DP0_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET_MASK                                      0x00001000L
+//DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT           0x0
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING__SHIFT  0x8
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK             0x00000001L
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+#define DP0_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING_MASK  0x00000100L
+//DP0_DP_DPHY_FAST_TRAINING
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE__SHIFT                                       0x0
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START__SHIFT                                         0x1
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN__SHIFT                            0x2
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING__SHIFT                              0x4
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME__SHIFT                                         0x8
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME__SHIFT                                         0x14
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE_MASK                                         0x00000001L
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START_MASK                                           0x00000002L
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN_MASK                              0x00000004L
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING_MASK                                0x00000010L
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME_MASK                                           0x000FFF00L
+#define DP0_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME_MASK                                           0xFFF00000L
+//DP0_DP_DPHY_FAST_TRAINING_STATUS
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE__SHIFT                                     0x0
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED__SHIFT                         0x4
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK__SHIFT                             0x8
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK__SHIFT                              0xc
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE_MASK                                       0x00000007L
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED_MASK                           0x00000010L
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK_MASK                               0x00000100L
+#define DP0_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK_MASK                                0x00001000L
+
+
+// addressBlock: dce_dc_dio_dig0_dispdec
+//DIG0_DIG_FE_CNTL
+#define DIG0_DIG_FE_CNTL__DIG_SOURCE_SELECT__SHIFT                                                            0x0
+#define DIG0_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT__SHIFT                                                        0x4
+#define DIG0_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN__SHIFT                                                       0x8
+#define DIG0_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT__SHIFT                                                    0xc
+#define DIG0_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN__SHIFT                                                        0x14
+#define DIG0_DIG_FE_CNTL__DIG_SOURCE_SELECT_MASK                                                              0x00000007L
+#define DIG0_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT_MASK                                                          0x00000070L
+#define DIG0_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN_MASK                                                         0x00000100L
+#define DIG0_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT_MASK                                                      0x00007000L
+#define DIG0_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN_MASK                                                          0x00100000L
+//DIG0_DIG_FE_CLK_CNTL
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_MODE__SHIFT                                                              0x0
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN__SHIFT                                                            0x4
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON__SHIFT                                                0xa
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON__SHIFT                                              0xb
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON__SHIFT                                          0xc
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON__SHIFT                                         0xd
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON__SHIFT                                             0xe
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_MODE_MASK                                                                0x00000007L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN_MASK                                                              0x00000010L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON_MASK                                                  0x00000400L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON_MASK                                                0x00000800L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON_MASK                                            0x00001000L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON_MASK                                           0x00002000L
+#define DIG0_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON_MASK                                               0x00004000L
+//DIG0_DIG_FE_EN_CNTL
+#define DIG0_DIG_FE_EN_CNTL__DIG_FE_ENABLE__SHIFT                                                             0x0
+#define DIG0_DIG_FE_EN_CNTL__DIG_FE_ENABLE_MASK                                                               0x00000001L
+//DIG0_DIG_OUTPUT_CRC_CNTL
+#define DIG0_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN__SHIFT                                                    0x0
+#define DIG0_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL__SHIFT                                              0x8
+#define DIG0_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN_MASK                                                      0x00000001L
+#define DIG0_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL_MASK                                                0x00000300L
+//DIG0_DIG_OUTPUT_CRC_RESULT
+#define DIG0_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT__SHIFT                                              0x0
+#define DIG0_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT_MASK                                                0x3FFFFFFFL
+//DIG0_DIG_CLOCK_PATTERN
+#define DIG0_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN__SHIFT                                                      0x0
+#define DIG0_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN_MASK                                                        0x000003FFL
+//DIG0_DIG_TEST_PATTERN
+#define DIG0_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN__SHIFT                                                 0x0
+#define DIG0_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL__SHIFT                                              0x1
+#define DIG0_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN__SHIFT                                               0x4
+#define DIG0_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET__SHIFT                                                0x5
+#define DIG0_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN__SHIFT                                      0x6
+#define DIG0_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN__SHIFT                                                 0x10
+#define DIG0_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN_MASK                                                   0x00000001L
+#define DIG0_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL_MASK                                                0x00000002L
+#define DIG0_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN_MASK                                                 0x00000010L
+#define DIG0_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET_MASK                                                  0x00000020L
+#define DIG0_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN_MASK                                        0x00000040L
+#define DIG0_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN_MASK                                                   0x03FF0000L
+//DIG0_DIG_RANDOM_PATTERN_SEED
+#define DIG0_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED__SHIFT                                          0x0
+#define DIG0_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY__SHIFT                                       0x18
+#define DIG0_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED_MASK                                            0x00FFFFFFL
+#define DIG0_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY_MASK                                         0x01000000L
+//DIG0_DIG_FIFO_CTRL0
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE__SHIFT                                                           0x0
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_RESET__SHIFT                                                            0x1
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL__SHIFT                                                 0x2
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC__SHIFT                                                   0x8
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                           0x9
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE__SHIFT                                                       0x14
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_ERROR__SHIFT                                                            0x1c
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE_MASK                                                             0x00000001L
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_RESET_MASK                                                              0x00000002L
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL_MASK                                                   0x000000FCL
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC_MASK                                                     0x00000100L
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE_MASK                                             0x00000600L
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE_MASK                                                         0x00100000L
+#define DIG0_DIG_FIFO_CTRL0__DIG_FIFO_ERROR_MASK                                                              0x30000000L
+//DIG0_DIG_FIFO_CTRL1
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL__SHIFT                                              0x1
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL__SHIFT                                                  0x2
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY__SHIFT                                                  0x8
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL__SHIFT                                                0xa
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL__SHIFT                                                    0x10
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL__SHIFT                                                    0x16
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED__SHIFT                                                       0x1d
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE__SHIFT                                              0x1e
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX__SHIFT                                              0x1f
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL_MASK                                                0x00000002L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL_MASK                                                    0x000000FCL
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY_MASK                                                    0x00000300L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL_MASK                                                  0x0000FC00L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL_MASK                                                      0x001F0000L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL_MASK                                                      0x03C00000L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED_MASK                                                         0x20000000L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE_MASK                                                0x40000000L
+#define DIG0_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX_MASK                                                0x80000000L
+//DIG0_HDMI_METADATA_PACKET_CONTROL
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE__SHIFT                                 0x0
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE__SHIFT                         0x4
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED__SHIFT                                 0x8
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE__SHIFT                                   0x10
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE_MASK                                   0x00000001L
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE_MASK                           0x00000010L
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED_MASK                                   0x00000100L
+#define DIG0_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_MASK                                     0xFFFF0000L
+//DIG0_HDMI_CONTROL
+#define DIG0_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN__SHIFT                                                       0x1
+#define DIG0_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE__SHIFT                                                     0x2
+#define DIG0_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED__SHIFT                                            0x3
+#define DIG0_HDMI_CONTROL__HDMI_ERROR_ACK__SHIFT                                                              0x8
+#define DIG0_HDMI_CONTROL__HDMI_ERROR_MASK__SHIFT                                                             0x9
+#define DIG0_HDMI_CONTROL__DOLBY_VISION_EN__SHIFT                                                             0xa
+#define DIG0_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED__SHIFT                                         0xb
+#define DIG0_HDMI_CONTROL__TMDS_PIXEL_ENCODING__SHIFT                                                         0xc
+#define DIG0_HDMI_CONTROL__TMDS_COLOR_FORMAT__SHIFT                                                           0xd
+#define DIG0_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM__SHIFT                                           0x10
+#define DIG0_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE__SHIFT                                                      0x18
+#define DIG0_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH__SHIFT                                                       0x1c
+#define DIG0_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN_MASK                                                         0x00000002L
+#define DIG0_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE_MASK                                                       0x00000004L
+#define DIG0_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED_MASK                                              0x00000008L
+#define DIG0_HDMI_CONTROL__HDMI_ERROR_ACK_MASK                                                                0x00000100L
+#define DIG0_HDMI_CONTROL__HDMI_ERROR_MASK_MASK                                                               0x00000200L
+#define DIG0_HDMI_CONTROL__DOLBY_VISION_EN_MASK                                                               0x00000400L
+#define DIG0_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED_MASK                                           0x00000800L
+#define DIG0_HDMI_CONTROL__TMDS_PIXEL_ENCODING_MASK                                                           0x00001000L
+#define DIG0_HDMI_CONTROL__TMDS_COLOR_FORMAT_MASK                                                             0x00006000L
+#define DIG0_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM_MASK                                             0x003F0000L
+#define DIG0_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK                                                        0x01000000L
+#define DIG0_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK                                                         0x30000000L
+//DIG0_HDMI_STATUS
+#define DIG0_HDMI_STATUS__HDMI_ACTIVE_AVMUTE__SHIFT                                                           0x0
+#define DIG0_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR__SHIFT                                                      0x10
+#define DIG0_HDMI_STATUS__HDMI_ERROR_INT__SHIFT                                                               0x1b
+#define DIG0_HDMI_STATUS__HDMI_ACTIVE_AVMUTE_MASK                                                             0x00000001L
+#define DIG0_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR_MASK                                                        0x00010000L
+#define DIG0_HDMI_STATUS__HDMI_ERROR_INT_MASK                                                                 0x08000000L
+//DIG0_HDMI_AUDIO_PACKET_CONTROL
+#define DIG0_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN__SHIFT                                            0x4
+#define DIG0_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN_MASK                                              0x00000030L
+//DIG0_HDMI_ACR_PACKET_CONTROL
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND__SHIFT                                                    0x0
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT__SHIFT                                                    0x1
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT__SHIFT                                                  0x4
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE__SHIFT                                                  0x8
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND__SHIFT                                               0xc
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE__SHIFT                                              0x10
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND_MASK                                                      0x00000001L
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT_MASK                                                      0x00000002L
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT_MASK                                                    0x00000030L
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE_MASK                                                    0x00000100L
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_MASK                                                 0x00001000L
+#define DIG0_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE_MASK                                                0x00070000L
+//DIG0_HDMI_VBI_PACKET_CONTROL
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND__SHIFT                                                   0x0
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND__SHIFT                                                     0x4
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT__SHIFT                                                     0x5
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND__SHIFT                                                   0x8
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT__SHIFT                                                   0x9
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND__SHIFT                                                    0xc
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE__SHIFT                                                   0x10
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE__SHIFT                                                    0x18
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK                                                     0x00000001L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND_MASK                                                       0x00000010L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT_MASK                                                       0x00000020L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND_MASK                                                     0x00000100L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT_MASK                                                     0x00000200L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND_MASK                                                      0x00001000L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE_MASK                                                     0x003F0000L
+#define DIG0_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE_MASK                                                      0x3F000000L
+//DIG0_HDMI_INFOFRAME_CONTROL0
+#define DIG0_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND__SHIFT                                             0x4
+#define DIG0_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE__SHIFT                                             0x8
+#define DIG0_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND_MASK                                               0x00000010L
+#define DIG0_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE_MASK                                               0x00003F00L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT__SHIFT                                          0x1
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE__SHIFT                                0x2
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND__SHIFT                                          0x4
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT__SHIFT                                          0x5
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE__SHIFT                                0x6
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND__SHIFT                                          0x8
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT__SHIFT                                          0x9
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE__SHIFT                                0xa
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE__SHIFT                           0xb
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND__SHIFT                                          0xc
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT__SHIFT                                          0xd
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE__SHIFT                                0xe
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE__SHIFT                           0xf
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT__SHIFT                                          0x11
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE__SHIFT                                0x12
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE__SHIFT                           0x13
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND__SHIFT                                          0x14
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT__SHIFT                                          0x15
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE__SHIFT                                0x16
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE__SHIFT                           0x17
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND__SHIFT                                          0x18
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT__SHIFT                                          0x19
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE__SHIFT                                0x1a
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE__SHIFT                           0x1b
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND__SHIFT                                          0x1c
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT__SHIFT                                          0x1d
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE__SHIFT                                0x1e
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE__SHIFT                           0x1f
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND_MASK                                            0x00000001L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT_MASK                                            0x00000002L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND_MASK                                            0x00000010L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT_MASK                                            0x00000020L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND_MASK                                            0x00000100L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT_MASK                                            0x00000200L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE_MASK                                  0x00000400L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE_MASK                             0x00000800L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND_MASK                                            0x00001000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT_MASK                                            0x00002000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE_MASK                                  0x00004000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE_MASK                             0x00008000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND_MASK                                            0x00010000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT_MASK                                            0x00020000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE_MASK                                  0x00040000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE_MASK                             0x00080000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND_MASK                                            0x00100000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT_MASK                                            0x00200000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE_MASK                                  0x00400000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE_MASK                             0x00800000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND_MASK                                            0x01000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT_MASK                                            0x02000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE_MASK                                  0x04000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE_MASK                             0x08000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND_MASK                                            0x10000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT_MASK                                            0x20000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE_MASK                                  0x40000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE_MASK                             0x80000000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL6
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT__SHIFT                                          0x1
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE__SHIFT                                0x2
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND__SHIFT                                          0x4
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT__SHIFT                                          0x5
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE__SHIFT                                0x6
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND__SHIFT                                         0x8
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT__SHIFT                                         0x9
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE__SHIFT                               0xa
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE__SHIFT                          0xb
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND__SHIFT                                         0xc
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT__SHIFT                                         0xd
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE__SHIFT                               0xe
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE__SHIFT                          0xf
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND__SHIFT                                         0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT__SHIFT                                         0x11
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE__SHIFT                               0x12
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE__SHIFT                          0x13
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND__SHIFT                                         0x14
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT__SHIFT                                         0x15
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE__SHIFT                               0x16
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE__SHIFT                          0x17
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND__SHIFT                                         0x18
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT__SHIFT                                         0x19
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE__SHIFT                               0x1a
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE__SHIFT                          0x1b
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND_MASK                                            0x00000001L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT_MASK                                            0x00000002L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND_MASK                                            0x00000010L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT_MASK                                            0x00000020L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND_MASK                                           0x00000100L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT_MASK                                           0x00000200L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE_MASK                                 0x00000400L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE_MASK                            0x00000800L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND_MASK                                           0x00001000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT_MASK                                           0x00002000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE_MASK                                 0x00004000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE_MASK                            0x00008000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND_MASK                                           0x00010000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT_MASK                                           0x00020000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE_MASK                                 0x00040000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE_MASK                            0x00080000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND_MASK                                           0x00100000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT_MASK                                           0x00200000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE_MASK                                 0x00400000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE_MASK                            0x00800000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND_MASK                                           0x01000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT_MASK                                           0x02000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE_MASK                                 0x04000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE_MASK                            0x08000000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL5
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND__SHIFT                                0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING__SHIFT                        0x1
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND__SHIFT                                0x2
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING__SHIFT                        0x3
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND__SHIFT                                0x4
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING__SHIFT                        0x5
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND__SHIFT                                0x6
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING__SHIFT                        0x7
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND__SHIFT                                0x8
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING__SHIFT                        0x9
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND__SHIFT                                0xa
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING__SHIFT                        0xb
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND__SHIFT                                0xc
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING__SHIFT                        0xd
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND__SHIFT                                0xe
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING__SHIFT                        0xf
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND__SHIFT                                0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING__SHIFT                        0x11
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND__SHIFT                                0x12
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING__SHIFT                        0x13
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND__SHIFT                               0x14
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING__SHIFT                       0x15
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND__SHIFT                               0x16
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING__SHIFT                       0x17
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND__SHIFT                               0x18
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING__SHIFT                       0x19
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND__SHIFT                               0x1a
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING__SHIFT                       0x1b
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND__SHIFT                               0x1c
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING__SHIFT                       0x1d
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_MASK                                  0x00000001L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING_MASK                          0x00000002L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_MASK                                  0x00000004L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING_MASK                          0x00000008L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_MASK                                  0x00000010L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING_MASK                          0x00000020L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_MASK                                  0x00000040L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING_MASK                          0x00000080L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_MASK                                  0x00000100L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING_MASK                          0x00000200L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_MASK                                  0x00000400L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING_MASK                          0x00000800L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_MASK                                  0x00001000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING_MASK                          0x00002000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_MASK                                  0x00004000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING_MASK                          0x00008000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_MASK                                  0x00010000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING_MASK                          0x00020000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_MASK                                  0x00040000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING_MASK                          0x00080000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_MASK                                 0x00100000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING_MASK                         0x00200000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_MASK                                 0x00400000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING_MASK                         0x00800000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_MASK                                 0x01000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING_MASK                         0x02000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_MASK                                 0x04000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING_MASK                         0x08000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_MASK                                 0x10000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING_MASK                         0x20000000L
+//DIG0_HDMI_GC
+#define DIG0_HDMI_GC__HDMI_GC_AVMUTE__SHIFT                                                                   0x0
+#define DIG0_HDMI_GC__HDMI_GC_AVMUTE_CONT__SHIFT                                                              0x2
+#define DIG0_HDMI_GC__HDMI_DEFAULT_PHASE__SHIFT                                                               0x4
+#define DIG0_HDMI_GC__HDMI_PACKING_PHASE__SHIFT                                                               0x8
+#define DIG0_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE__SHIFT                                                      0xc
+#define DIG0_HDMI_GC__HDMI_GC_AVMUTE_MASK                                                                     0x00000001L
+#define DIG0_HDMI_GC__HDMI_GC_AVMUTE_CONT_MASK                                                                0x00000004L
+#define DIG0_HDMI_GC__HDMI_DEFAULT_PHASE_MASK                                                                 0x00000010L
+#define DIG0_HDMI_GC__HDMI_PACKING_PHASE_MASK                                                                 0x00000F00L
+#define DIG0_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE_MASK                                                        0x00001000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL1
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE_MASK                                            0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE_MASK                                            0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL2
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE_MASK                                            0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE_MASK                                            0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL3
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE_MASK                                            0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE_MASK                                            0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL4
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE_MASK                                            0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE_MASK                                            0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL7
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE__SHIFT                                          0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE__SHIFT                                          0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE_MASK                                            0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE_MASK                                            0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL8
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE__SHIFT                                         0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE__SHIFT                                         0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE_MASK                                           0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE_MASK                                           0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL9
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE__SHIFT                                         0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE__SHIFT                                         0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE_MASK                                           0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE_MASK                                           0xFFFF0000L
+//DIG0_HDMI_GENERIC_PACKET_CONTROL10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE__SHIFT                                        0x0
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING__SHIFT                                0x10
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING__SHIFT                                0x11
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING__SHIFT                                0x12
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING__SHIFT                                0x13
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING__SHIFT                                0x14
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING__SHIFT                                0x15
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING__SHIFT                                0x16
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING__SHIFT                                0x17
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING__SHIFT                                0x18
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING__SHIFT                                0x19
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING__SHIFT                               0x1a
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING__SHIFT                               0x1b
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING__SHIFT                               0x1c
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING__SHIFT                               0x1d
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING__SHIFT                               0x1e
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE_MASK                                          0x0000FFFFL
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING_MASK                                  0x00010000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING_MASK                                  0x00020000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING_MASK                                  0x00040000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING_MASK                                  0x00080000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING_MASK                                  0x00100000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING_MASK                                  0x00200000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING_MASK                                  0x00400000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING_MASK                                  0x00800000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING_MASK                                  0x01000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING_MASK                                  0x02000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING_MASK                                 0x04000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING_MASK                                 0x08000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING_MASK                                 0x10000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING_MASK                                 0x20000000L
+#define DIG0_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING_MASK                                 0x40000000L
+//DIG0_HDMI_DB_CONTROL
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_PENDING__SHIFT                                                          0x0
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_TAKEN__SHIFT                                                            0x4
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR__SHIFT                                                        0x5
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_LOCK__SHIFT                                                             0x8
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_DISABLE__SHIFT                                                          0xc
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_PENDING__SHIFT                                                       0xf
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN__SHIFT                                                         0x10
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR__SHIFT                                                     0x11
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_PENDING_MASK                                                            0x00000001L
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_TAKEN_MASK                                                              0x00000010L
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR_MASK                                                          0x00000020L
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_LOCK_MASK                                                               0x00000100L
+#define DIG0_HDMI_DB_CONTROL__HDMI_DB_DISABLE_MASK                                                            0x00001000L
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_PENDING_MASK                                                         0x00008000L
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_MASK                                                           0x00010000L
+#define DIG0_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR_MASK                                                       0x00020000L
+//DIG0_HDMI_ACR_32_0
+#define DIG0_HDMI_ACR_32_0__HDMI_ACR_CTS_32__SHIFT                                                            0xc
+#define DIG0_HDMI_ACR_32_0__HDMI_ACR_CTS_32_MASK                                                              0xFFFFF000L
+//DIG0_HDMI_ACR_32_1
+#define DIG0_HDMI_ACR_32_1__HDMI_ACR_N_32__SHIFT                                                              0x0
+#define DIG0_HDMI_ACR_32_1__HDMI_ACR_N_32_MASK                                                                0x000FFFFFL
+//DIG0_HDMI_ACR_44_0
+#define DIG0_HDMI_ACR_44_0__HDMI_ACR_CTS_44__SHIFT                                                            0xc
+#define DIG0_HDMI_ACR_44_0__HDMI_ACR_CTS_44_MASK                                                              0xFFFFF000L
+//DIG0_HDMI_ACR_44_1
+#define DIG0_HDMI_ACR_44_1__HDMI_ACR_N_44__SHIFT                                                              0x0
+#define DIG0_HDMI_ACR_44_1__HDMI_ACR_N_44_MASK                                                                0x000FFFFFL
+//DIG0_HDMI_ACR_48_0
+#define DIG0_HDMI_ACR_48_0__HDMI_ACR_CTS_48__SHIFT                                                            0xc
+#define DIG0_HDMI_ACR_48_0__HDMI_ACR_CTS_48_MASK                                                              0xFFFFF000L
+//DIG0_HDMI_ACR_48_1
+#define DIG0_HDMI_ACR_48_1__HDMI_ACR_N_48__SHIFT                                                              0x0
+#define DIG0_HDMI_ACR_48_1__HDMI_ACR_N_48_MASK                                                                0x000FFFFFL
+//DIG0_HDMI_ACR_STATUS_0
+#define DIG0_HDMI_ACR_STATUS_0__HDMI_ACR_CTS__SHIFT                                                           0xc
+#define DIG0_HDMI_ACR_STATUS_0__HDMI_ACR_CTS_MASK                                                             0xFFFFF000L
+//DIG0_HDMI_ACR_STATUS_1
+#define DIG0_HDMI_ACR_STATUS_1__HDMI_ACR_N__SHIFT                                                             0x0
+#define DIG0_HDMI_ACR_STATUS_1__HDMI_ACR_N_MASK                                                               0x000FFFFFL
+//DIG0_DIG_FE_AUDIO_CNTL
+#define DIG0_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT                               0x0
+#define DIG0_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE__SHIFT                                                       0x8
+#define DIG0_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK                                 0x00000007L
+#define DIG0_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE_MASK                                                         0x00000100L
+//DIG0_DIG_BE_CLK_CNTL
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_MODE__SHIFT                                                              0x0
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN__SHIFT                                                            0x4
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG0_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET__SHIFT                                                          0x6
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON__SHIFT                                                 0xb
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON__SHIFT                                            0xc
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON__SHIFT                                            0xd
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_MODE_MASK                                                                0x00000007L
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN_MASK                                                              0x00000010L
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG0_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET_MASK                                                            0x00000040L
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON_MASK                                                   0x00000800L
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON_MASK                                              0x00001000L
+#define DIG0_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON_MASK                                              0x00002000L
+//DIG0_DIG_BE_CNTL
+#define DIG0_DIG_BE_CNTL__DIG_RB_SWITCH_EN__SHIFT                                                             0x2
+#define DIG0_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT__SHIFT                                                         0x8
+#define DIG0_DIG_BE_CNTL__DIG_HPD_SELECT__SHIFT                                                               0x1c
+#define DIG0_DIG_BE_CNTL__DIG_RB_SWITCH_EN_MASK                                                               0x00000004L
+#define DIG0_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT_MASK                                                           0x00007F00L
+#define DIG0_DIG_BE_CNTL__DIG_HPD_SELECT_MASK                                                                 0x70000000L
+//DIG0_DIG_BE_EN_CNTL
+#define DIG0_DIG_BE_EN_CNTL__DIG_BE_ENABLE__SHIFT                                                             0x0
+#define DIG0_DIG_BE_EN_CNTL__DIG_BE_ENABLE_MASK                                                               0x00000001L
+//DIG0_HDCP_INT_CONTROL
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT__SHIFT                                                   0x0
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK__SHIFT                                                   0x1
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK__SHIFT                                                  0x2
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT__SHIFT                                                      0x4
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK__SHIFT                                                      0x5
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK__SHIFT                                                     0x6
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK__SHIFT                                                 0x7
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT__SHIFT                                                   0x8
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK__SHIFT                                                   0x9
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK__SHIFT                                                  0xa
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT__SHIFT                                                  0xc
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK__SHIFT                                                  0xd
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK__SHIFT                                                 0xe
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT_MASK                                                     0x00000001L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK_MASK                                                     0x00000002L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK_MASK                                                    0x00000004L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT_MASK                                                        0x00000010L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK_MASK                                                        0x00000020L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK_MASK                                                       0x00000040L
+#define DIG0_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK_MASK                                                   0x00000080L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT_MASK                                                     0x00000100L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK_MASK                                                     0x00000200L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK_MASK                                                    0x00000400L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT_MASK                                                    0x00001000L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK_MASK                                                    0x00002000L
+#define DIG0_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK_MASK                                                   0x00004000L
+//DIG0_HDCP_I2C_CONTROL_0
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE__SHIFT                                                      0x0
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET__SHIFT                                                   0x2
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT__SHIFT                                                   0x8
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE_MASK                                                        0x00000001L
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET_MASK                                                     0x00000004L
+#define DIG0_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT_MASK                                                     0x00000700L
+//DIG0_HDCP_I2C_CONTROL_1
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK__SHIFT                                                   0x0
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE__SHIFT                                                   0x1
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE__SHIFT                                               0x8
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT__SHIFT                                                  0x14
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY__SHIFT                                                  0x18
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK_MASK                                                     0x00000001L
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE_MASK                                                     0x00000002L
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE_MASK                                                 0x00000100L
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT_MASK                                                    0x00F00000L
+#define DIG0_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY_MASK                                                    0xFF000000L
+//DIG0_TMDS_CNTL
+#define DIG0_TMDS_CNTL__TMDS_SYNC_PHASE__SHIFT                                                                0x0
+#define DIG0_TMDS_CNTL__TMDS_SYNC_PHASE_MASK                                                                  0x00000001L
+//DIG0_TMDS_CONTROL_CHAR
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN__SHIFT                                              0x0
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN__SHIFT                                              0x1
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN__SHIFT                                              0x2
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN__SHIFT                                              0x3
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN_MASK                                                0x00000001L
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN_MASK                                                0x00000002L
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN_MASK                                                0x00000004L
+#define DIG0_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN_MASK                                                0x00000008L
+//DIG0_TMDS_CONTROL0_FEEDBACK
+#define DIG0_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT__SHIFT                                     0x0
+#define DIG0_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY__SHIFT                                      0x8
+#define DIG0_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT_MASK                                       0x00000003L
+#define DIG0_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY_MASK                                        0x00000300L
+//DIG0_TMDS_STEREOSYNC_CTL_SEL
+#define DIG0_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL__SHIFT                                          0x0
+#define DIG0_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL_MASK                                            0x00000003L
+//DIG0_TMDS_SYNC_CHAR_PATTERN_0_1
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0__SHIFT                                       0x0
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1__SHIFT                                       0x10
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0_MASK                                         0x000003FFL
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1_MASK                                         0x03FF0000L
+//DIG0_TMDS_SYNC_CHAR_PATTERN_2_3
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2__SHIFT                                       0x0
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3__SHIFT                                       0x10
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2_MASK                                         0x000003FFL
+#define DIG0_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3_MASK                                         0x03FF0000L
+//DIG0_TMDS_CTL_BITS
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL0__SHIFT                                                                  0x0
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL1__SHIFT                                                                  0x8
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL2__SHIFT                                                                  0x10
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL3__SHIFT                                                                  0x18
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL0_MASK                                                                    0x00000001L
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL1_MASK                                                                    0x00000100L
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL2_MASK                                                                    0x00010000L
+#define DIG0_TMDS_CTL_BITS__TMDS_CTL3_MASK                                                                    0x01000000L
+//DIG0_TMDS_DCBALANCER_CONTROL
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN__SHIFT                                               0x0
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN__SHIFT                                               0x4
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN__SHIFT                                          0x8
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN__SHIFT                                          0x10
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE__SHIFT                                            0x18
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN_MASK                                                 0x00000001L
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN_MASK                                                 0x00000070L
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN_MASK                                            0x00000100L
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN_MASK                                            0x000F0000L
+#define DIG0_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE_MASK                                              0x01000000L
+//DIG0_TMDS_CTL0_1_GEN_CNTL
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL__SHIFT                                                  0x0
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY__SHIFT                                                0x4
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT__SHIFT                                               0x7
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION__SHIFT                                           0x8
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL__SHIFT                                                  0x10
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY__SHIFT                                                0x14
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT__SHIFT                                               0x17
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION__SHIFT                                           0x18
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN__SHIFT                                                0x1f
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN_MASK                                              0x10000000L
+#define DIG0_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN_MASK                                                  0x80000000L
+//DIG0_TMDS_CTL2_3_GEN_CNTL
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL__SHIFT                                                  0x0
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY__SHIFT                                                0x4
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT__SHIFT                                               0x7
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION__SHIFT                                           0x8
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL__SHIFT                                                  0x10
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY__SHIFT                                                0x14
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT__SHIFT                                               0x17
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION__SHIFT                                           0x18
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG0_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN_MASK                                              0x10000000L
+//DIG0_DIG_VERSION
+
+
+// addressBlock: dce_dc_dio_dp1_dispdec
+//DP1_DP_LINK_CNTL
+#define DP1_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE__SHIFT                                                    0x4
+#define DP1_DP_LINK_CNTL__DP_LINK_STATUS__SHIFT                                                               0x8
+#define DP1_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE_MASK                                                      0x00000010L
+#define DP1_DP_LINK_CNTL__DP_LINK_STATUS_MASK                                                                 0x00000100L
+//DP1_DP_PIXEL_FORMAT
+#define DP1_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                                                       0x0
+#define DP1_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT__SHIFT                                                 0x4
+#define DP1_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                                              0x8
+#define DP1_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT__SHIFT                                                   0x10
+#define DP1_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                                         0x00000001L
+#define DP1_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT_MASK                                                   0x00000030L
+#define DP1_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                                                0x00000700L
+#define DP1_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT_MASK                                                     0x00010000L
+//DP1_DP_MSA_COLORIMETRY
+#define DP1_DP_MSA_COLORIMETRY__DP_MSA_MISC0__SHIFT                                                           0x18
+#define DP1_DP_MSA_COLORIMETRY__DP_MSA_MISC0_MASK                                                             0xFF000000L
+//DP1_DP_CONFIG
+#define DP1_DP_CONFIG__DP_UDI_LANES__SHIFT                                                                    0x0
+#define DP1_DP_CONFIG__DP_UDI_LANES_MASK                                                                      0x00000003L
+//DP1_DP_VID_STREAM_CNTL
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE__SHIFT                                                   0x0
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER__SHIFT                                                0x8
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS__SHIFT                                                   0x10
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT__SHIFT                                           0x14
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE_MASK                                                     0x00000001L
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER_MASK                                                  0x00000300L
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS_MASK                                                     0x00010000L
+#define DP1_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT_MASK                                             0x00100000L
+//DP1_DP_STEER_FIFO
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE__SHIFT                                                        0x0
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_RESET__SHIFT                                                         0x1
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE__SHIFT                                                    0x2
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG__SHIFT                                                      0x4
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT__SHIFT                                                       0x5
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK__SHIFT                                                       0x6
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK__SHIFT                                                      0x7
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE_MASK                                                          0x00000001L
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_RESET_MASK                                                           0x00000002L
+#define DP1_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE_MASK                                                      0x00000004L
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG_MASK                                                        0x00000010L
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT_MASK                                                         0x00000020L
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK_MASK                                                         0x00000040L
+#define DP1_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK_MASK                                                        0x00000080L
+//DP1_DP_MSA_MISC
+#define DP1_DP_MSA_MISC__DP_MSA_MISC1__SHIFT                                                                  0x0
+#define DP1_DP_MSA_MISC__DP_MSA_MISC2__SHIFT                                                                  0x8
+#define DP1_DP_MSA_MISC__DP_MSA_MISC3__SHIFT                                                                  0x10
+#define DP1_DP_MSA_MISC__DP_MSA_MISC4__SHIFT                                                                  0x18
+#define DP1_DP_MSA_MISC__DP_MSA_MISC1_MASK                                                                    0x000000FFL
+#define DP1_DP_MSA_MISC__DP_MSA_MISC2_MASK                                                                    0x0000FF00L
+#define DP1_DP_MSA_MISC__DP_MSA_MISC3_MASK                                                                    0x00FF0000L
+#define DP1_DP_MSA_MISC__DP_MSA_MISC4_MASK                                                                    0xFF000000L
+//DP1_DP_DPHY_INTERNAL_CTRL
+#define DP1_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN__SHIFT                                         0x0
+#define DP1_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL__SHIFT                                        0x4
+#define DP1_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN_MASK                                           0x00000001L
+#define DP1_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL_MASK                                          0x00000010L
+//DP1_DP_VID_TIMING
+#define DP1_DP_VID_TIMING__DP_VID_M_N_GEN_EN__SHIFT                                                           0x8
+#define DP1_DP_VID_TIMING__DP_VID_M_DIV__SHIFT                                                                0xc
+#define DP1_DP_VID_TIMING__DP_VID_N_INTERVAL__SHIFT                                                           0xe
+#define DP1_DP_VID_TIMING__DP_VID_M_N_GEN_EN_MASK                                                             0x00000100L
+#define DP1_DP_VID_TIMING__DP_VID_M_DIV_MASK                                                                  0x00003000L
+#define DP1_DP_VID_TIMING__DP_VID_N_INTERVAL_MASK                                                             0x0000C000L
+//DP1_DP_VID_N
+#define DP1_DP_VID_N__DP_VID_N__SHIFT                                                                         0x0
+#define DP1_DP_VID_N__DP_VID_N_MASK                                                                           0x00FFFFFFL
+//DP1_DP_VID_M
+#define DP1_DP_VID_M__DP_VID_M__SHIFT                                                                         0x0
+#define DP1_DP_VID_M__DP_VID_M_MASK                                                                           0x00FFFFFFL
+//DP1_DP_LINK_FRAMING_CNTL
+#define DP1_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL__SHIFT                                                  0x0
+#define DP1_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE__SHIFT                                  0x14
+#define DP1_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE__SHIFT                                                      0x18
+#define DP1_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE__SHIFT                                           0x1c
+#define DP1_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL_MASK                                                    0x0003FFFFL
+#define DP1_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE_MASK                                    0x00100000L
+#define DP1_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE_MASK                                                        0x01000000L
+#define DP1_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE_MASK                                             0x10000000L
+//DP1_DP_HBR2_EYE_PATTERN
+#define DP1_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE__SHIFT                                            0x0
+#define DP1_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE_MASK                                              0x00000001L
+//DP1_DP_VID_MSA_VBID
+#define DP1_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION__SHIFT                                                       0x0
+#define DP1_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE__SHIFT                                            0xc
+#define DP1_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL__SHIFT                                                     0x18
+#define DP1_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION_MASK                                                         0x00000FFFL
+#define DP1_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE_MASK                                              0x00001000L
+#define DP1_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL_MASK                                                       0x01000000L
+//DP1_DP_VID_INTERRUPT_CNTL
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT__SHIFT                                           0x0
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK__SHIFT                                           0x1
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK__SHIFT                                          0x2
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT_MASK                                             0x00000001L
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK_MASK                                             0x00000002L
+#define DP1_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK_MASK                                            0x00000004L
+//DP1_DP_DPHY_CNTL
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0__SHIFT                                                         0x0
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1__SHIFT                                                         0x1
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2__SHIFT                                                         0x2
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3__SHIFT                                                         0x3
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_EN__SHIFT                                                                  0x4
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW__SHIFT                                                        0x5
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS__SHIFT                                                       0x6
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM__SHIFT                                               0x7
+#define DP1_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL__SHIFT                                                           0x8
+#define DP1_DP_DPHY_CNTL__DPHY_BYPASS__SHIFT                                                                  0x10
+#define DP1_DP_DPHY_CNTL__DPHY_SKEW_BYPASS__SHIFT                                                             0x18
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0_MASK                                                           0x00000001L
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1_MASK                                                           0x00000002L
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2_MASK                                                           0x00000004L
+#define DP1_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3_MASK                                                           0x00000008L
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_EN_MASK                                                                    0x00000010L
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW_MASK                                                          0x00000020L
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS_MASK                                                         0x00000040L
+#define DP1_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM_MASK                                                 0x00000080L
+#define DP1_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL_MASK                                                             0x00000100L
+#define DP1_DP_DPHY_CNTL__DPHY_BYPASS_MASK                                                                    0x00010000L
+#define DP1_DP_DPHY_CNTL__DPHY_SKEW_BYPASS_MASK                                                               0x01000000L
+//DP1_DP_DPHY_TRAINING_PATTERN_SEL
+#define DP1_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL__SHIFT                                    0x0
+#define DP1_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL_MASK                                      0x00000003L
+//DP1_DP_DPHY_SYM0
+#define DP1_DP_DPHY_SYM0__DPHY_SYM1__SHIFT                                                                    0x0
+#define DP1_DP_DPHY_SYM0__DPHY_SYM2__SHIFT                                                                    0xa
+#define DP1_DP_DPHY_SYM0__DPHY_SYM3__SHIFT                                                                    0x14
+#define DP1_DP_DPHY_SYM0__DPHY_SYM1_MASK                                                                      0x000003FFL
+#define DP1_DP_DPHY_SYM0__DPHY_SYM2_MASK                                                                      0x000FFC00L
+#define DP1_DP_DPHY_SYM0__DPHY_SYM3_MASK                                                                      0x3FF00000L
+//DP1_DP_DPHY_SYM1
+#define DP1_DP_DPHY_SYM1__DPHY_SYM4__SHIFT                                                                    0x0
+#define DP1_DP_DPHY_SYM1__DPHY_SYM5__SHIFT                                                                    0xa
+#define DP1_DP_DPHY_SYM1__DPHY_SYM6__SHIFT                                                                    0x14
+#define DP1_DP_DPHY_SYM1__DPHY_SYM4_MASK                                                                      0x000003FFL
+#define DP1_DP_DPHY_SYM1__DPHY_SYM5_MASK                                                                      0x000FFC00L
+#define DP1_DP_DPHY_SYM1__DPHY_SYM6_MASK                                                                      0x3FF00000L
+//DP1_DP_DPHY_SYM2
+#define DP1_DP_DPHY_SYM2__DPHY_SYM7__SHIFT                                                                    0x0
+#define DP1_DP_DPHY_SYM2__DPHY_SYM8__SHIFT                                                                    0xa
+#define DP1_DP_DPHY_SYM2__DPHY_SYM7_MASK                                                                      0x000003FFL
+#define DP1_DP_DPHY_SYM2__DPHY_SYM8_MASK                                                                      0x000FFC00L
+//DP1_DP_DPHY_8B10B_CNTL
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET__SHIFT                                                       0x8
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP__SHIFT                                                    0x10
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP__SHIFT                                                    0x18
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET_MASK                                                         0x00000100L
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP_MASK                                                      0x00010000L
+#define DP1_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP_MASK                                                      0x01000000L
+//DP1_DP_DPHY_PRBS_CNTL
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN__SHIFT                                                            0x0
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL__SHIFT                                                           0x4
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED__SHIFT                                                          0x8
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN_MASK                                                              0x00000001L
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL_MASK                                                             0x00000030L
+#define DP1_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED_MASK                                                            0x7FFFFF00L
+//DP1_DP_DPHY_SCRAM_CNTL
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS__SHIFT                                                     0x0
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE__SHIFT                                                 0x4
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT__SHIFT                                                0x8
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE__SHIFT                                                   0x18
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS_MASK                                                       0x00000001L
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE_MASK                                                   0x00000010L
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT_MASK                                                  0x0003FF00L
+#define DP1_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE_MASK                                                     0x01000000L
+//DP1_DP_TU_CNTL
+#define DP1_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG__SHIFT                                                            0x8
+#define DP1_DP_TU_CNTL__DP_TU_OVERFLOW_ACK__SHIFT                                                             0xc
+#define DP1_DP_TU_CNTL__DP_TU_SIZE__SHIFT                                                                     0x18
+#define DP1_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG_MASK                                                              0x00000100L
+#define DP1_DP_TU_CNTL__DP_TU_OVERFLOW_ACK_MASK                                                               0x00001000L
+#define DP1_DP_TU_CNTL__DP_TU_SIZE_MASK                                                                       0x3F000000L
+//DP1_DP_PIXEL_FORMAT_DB_CNTL
+#define DP1_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE__SHIFT                                            0x0
+#define DP1_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING__SHIFT                                           0x4
+#define DP1_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE_MASK                                              0x00000001L
+#define DP1_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING_MASK                                             0x00000010L
+//DP1_DP_CP_LINK_VERIFICATION_PATTERN
+#define DP1_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN__SHIFT                           0x0
+#define DP1_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN_MASK                             0x0000FFFFL
+//DP1_DP_SEC_CNTL
+#define DP1_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE__SHIFT                                                          0x0
+#define DP1_DP_SEC_CNTL__DP_SEC_ASP_ENABLE__SHIFT                                                             0x4
+#define DP1_DP_SEC_CNTL__DP_SEC_ATP_ENABLE__SHIFT                                                             0x8
+#define DP1_DP_SEC_CNTL__DP_SEC_AIP_ENABLE__SHIFT                                                             0xc
+#define DP1_DP_SEC_CNTL__DP_SEC_ACM_ENABLE__SHIFT                                                             0x10
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE__SHIFT                                                            0x14
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE__SHIFT                                                            0x15
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE__SHIFT                                                            0x16
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE__SHIFT                                                            0x17
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE__SHIFT                                                            0x18
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE__SHIFT                                                            0x19
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE__SHIFT                                                            0x1a
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE__SHIFT                                                            0x1b
+#define DP1_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE_MASK                                                            0x00000001L
+#define DP1_DP_SEC_CNTL__DP_SEC_ASP_ENABLE_MASK                                                               0x00000010L
+#define DP1_DP_SEC_CNTL__DP_SEC_ATP_ENABLE_MASK                                                               0x00000100L
+#define DP1_DP_SEC_CNTL__DP_SEC_AIP_ENABLE_MASK                                                               0x00001000L
+#define DP1_DP_SEC_CNTL__DP_SEC_ACM_ENABLE_MASK                                                               0x00010000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE_MASK                                                              0x00100000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE_MASK                                                              0x00200000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE_MASK                                                              0x00400000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE_MASK                                                              0x00800000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE_MASK                                                              0x01000000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE_MASK                                                              0x02000000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE_MASK                                                              0x04000000L
+#define DP1_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE_MASK                                                              0x08000000L
+//DP1_DP_SEC_CNTL1
+#define DP1_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE__SHIFT                                                           0x0
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE__SHIFT                                                   0x1
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY__SHIFT                                                         0x4
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND__SHIFT                                                             0x5
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING__SHIFT                                                     0x6
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED__SHIFT                                             0x7
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE__SHIFT                                                   0x9
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE__SHIFT                                                   0xa
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE__SHIFT                                                   0xb
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE__SHIFT                                                   0xc
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE__SHIFT                                                   0xd
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE__SHIFT                                                   0xe
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE__SHIFT                                                   0xf
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE_MASK                                                             0x00000001L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE_MASK                                                     0x00000002L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY_MASK                                                           0x00000010L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_MASK                                                               0x00000020L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING_MASK                                                       0x00000040L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED_MASK                                               0x00000080L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE_MASK                                                     0x00000200L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE_MASK                                                     0x00000400L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE_MASK                                                     0x00000800L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE_MASK                                                     0x00001000L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE_MASK                                                     0x00002000L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE_MASK                                                     0x00004000L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE_MASK                                                     0x00008000L
+#define DP1_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_SEC_FRAMING1
+#define DP1_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION__SHIFT                                               0x0
+#define DP1_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP1_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION_MASK                                                 0x00000FFFL
+#define DP1_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP1_DP_SEC_FRAMING2
+#define DP1_DP_SEC_FRAMING2__DP_SEC_START_POSITION__SHIFT                                                     0x0
+#define DP1_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP1_DP_SEC_FRAMING2__DP_SEC_START_POSITION_MASK                                                       0x0000FFFFL
+#define DP1_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP1_DP_SEC_FRAMING3
+#define DP1_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE__SHIFT                                                    0x0
+#define DP1_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH__SHIFT                                                0x10
+#define DP1_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE_MASK                                                      0x00003FFFL
+#define DP1_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH_MASK                                                  0xFFFF0000L
+//DP1_DP_SEC_FRAMING4
+#define DP1_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING__SHIFT                                                      0x0
+#define DP1_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS__SHIFT                                                   0x14
+#define DP1_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK__SHIFT                                                      0x18
+#define DP1_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE__SHIFT                                                         0x1c
+#define DP1_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS__SHIFT                                                  0x1d
+#define DP1_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING_MASK                                                        0x00000001L
+#define DP1_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS_MASK                                                     0x00100000L
+#define DP1_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK_MASK                                                        0x01000000L
+#define DP1_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_MASK                                                           0x10000000L
+#define DP1_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS_MASK                                                    0x20000000L
+//DP1_DP_SEC_AUD_N
+#define DP1_DP_SEC_AUD_N__DP_SEC_AUD_N__SHIFT                                                                 0x0
+#define DP1_DP_SEC_AUD_N__DP_SEC_AUD_N_MASK                                                                   0x00FFFFFFL
+//DP1_DP_SEC_AUD_N_READBACK
+#define DP1_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK__SHIFT                                               0x0
+#define DP1_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK_MASK                                                 0x00FFFFFFL
+//DP1_DP_SEC_AUD_M
+#define DP1_DP_SEC_AUD_M__DP_SEC_AUD_M__SHIFT                                                                 0x0
+#define DP1_DP_SEC_AUD_M__DP_SEC_AUD_M_MASK                                                                   0x00FFFFFFL
+//DP1_DP_SEC_AUD_M_READBACK
+#define DP1_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK__SHIFT                                               0x0
+#define DP1_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK_MASK                                                 0x00FFFFFFL
+//DP1_DP_SEC_TIMESTAMP
+#define DP1_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE__SHIFT                                                    0x0
+#define DP1_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE_MASK                                                      0x00000001L
+//DP1_DP_SEC_PACKET_CNTL
+#define DP1_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY__SHIFT                                                    0x4
+#define DP1_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER__SHIFT                                              0x18
+#define DP1_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY_MASK                                                      0x00000010L
+#define DP1_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER_MASK                                                0x3F000000L
+//DP1_DP_MSE_RATE_CNTL
+#define DP1_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y__SHIFT                                                            0x0
+#define DP1_DP_MSE_RATE_CNTL__DP_MSE_RATE_X__SHIFT                                                            0x1a
+#define DP1_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y_MASK                                                              0x03FFFFFFL
+#define DP1_DP_MSE_RATE_CNTL__DP_MSE_RATE_X_MASK                                                              0xFC000000L
+//DP1_DP_CP_MSE_STATUS
+#define DP1_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT__SHIFT                                                    0x0
+#define DP1_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE__SHIFT                                              0x4
+#define DP1_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT_MASK                                                      0x00000001L
+#define DP1_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE_MASK                                                0x00000010L
+//DP1_DP_MSE_RATE_UPDATE
+#define DP1_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING__SHIFT                                             0x0
+#define DP1_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING_MASK                                               0x00000001L
+//DP1_DP_MSE_SAT0
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SRC0__SHIFT                                                               0x0
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0__SHIFT                                                           0x4
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0__SHIFT                                                   0x5
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0__SHIFT                                                        0x8
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SRC1__SHIFT                                                               0x10
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1__SHIFT                                                           0x14
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1__SHIFT                                                   0x15
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1__SHIFT                                                        0x18
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SRC0_MASK                                                                 0x00000007L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0_MASK                                                             0x00000010L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0_MASK                                                     0x00000020L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0_MASK                                                          0x00003F00L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SRC1_MASK                                                                 0x00070000L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1_MASK                                                             0x00100000L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1_MASK                                                     0x00200000L
+#define DP1_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1_MASK                                                          0x3F000000L
+//DP1_DP_MSE_SAT1
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SRC2__SHIFT                                                               0x0
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2__SHIFT                                                           0x4
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2__SHIFT                                                   0x5
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2__SHIFT                                                        0x8
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SRC3__SHIFT                                                               0x10
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3__SHIFT                                                           0x14
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3__SHIFT                                                   0x15
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3__SHIFT                                                        0x18
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SRC2_MASK                                                                 0x00000007L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2_MASK                                                             0x00000010L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2_MASK                                                     0x00000020L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2_MASK                                                          0x00003F00L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SRC3_MASK                                                                 0x00070000L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3_MASK                                                             0x00100000L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3_MASK                                                     0x00200000L
+#define DP1_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3_MASK                                                          0x3F000000L
+//DP1_DP_MSE_SAT2
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SRC4__SHIFT                                                               0x0
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4__SHIFT                                                           0x4
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4__SHIFT                                                   0x5
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4__SHIFT                                                        0x8
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SRC5__SHIFT                                                               0x10
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5__SHIFT                                                           0x14
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5__SHIFT                                                   0x15
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5__SHIFT                                                        0x18
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SRC4_MASK                                                                 0x00000007L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4_MASK                                                             0x00000010L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4_MASK                                                     0x00000020L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4_MASK                                                          0x00003F00L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SRC5_MASK                                                                 0x00070000L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5_MASK                                                             0x00100000L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5_MASK                                                     0x00200000L
+#define DP1_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5_MASK                                                          0x3F000000L
+//DP1_DP_MSE_SAT_UPDATE
+#define DP1_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE__SHIFT                                                       0x0
+#define DP1_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT__SHIFT                                                   0x8
+#define DP1_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE_MASK                                                         0x00000003L
+#define DP1_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT_MASK                                                     0x00000100L
+//DP1_DP_MSE_LINK_TIMING
+#define DP1_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME__SHIFT                                                      0x0
+#define DP1_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE__SHIFT                                                       0x10
+#define DP1_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME_MASK                                                        0x000003FFL
+#define DP1_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE_MASK                                                         0x00030000L
+//DP1_DP_MSE_MISC_CNTL
+#define DP1_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE__SHIFT                                                        0x0
+#define DP1_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER__SHIFT                                                      0x8
+#define DP1_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE_MASK                                                          0x00000001L
+#define DP1_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER_MASK                                                        0x00000100L
+//DP1_DP_TEST_DEBUG_DATA
+#define DP1_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define DP1_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//DP1_DP_DPHY_BS_SR_SWAP_CNTL
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT__SHIFT                                                0x0
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE__SHIFT                                              0xf
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START__SHIFT                                          0x10
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_MASK                                                  0x000003FFL
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE_MASK                                                0x00008000L
+#define DP1_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START_MASK                                            0x00010000L
+//DP1_DP_DPHY_HBR2_PATTERN_CONTROL
+#define DP1_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL__SHIFT                                 0x0
+#define DP1_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL_MASK                                   0x00000007L
+//DP1_DP_MSE_SAT0_STATUS
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS__SHIFT                                                 0x0
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS__SHIFT                                             0x4
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS__SHIFT                                     0x5
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS__SHIFT                                          0x8
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS__SHIFT                                                 0x10
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS__SHIFT                                             0x14
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS__SHIFT                                     0x15
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS__SHIFT                                          0x18
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS_MASK                                                   0x00000007L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS_MASK                                               0x00000010L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS_MASK                                       0x00000020L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS_MASK                                            0x00003F00L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS_MASK                                                   0x00070000L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS_MASK                                               0x00100000L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS_MASK                                       0x00200000L
+#define DP1_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS_MASK                                            0x3F000000L
+//DP1_DP_MSE_SAT1_STATUS
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS__SHIFT                                                 0x0
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS__SHIFT                                             0x4
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS__SHIFT                                     0x5
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS__SHIFT                                          0x8
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS__SHIFT                                                 0x10
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS__SHIFT                                             0x14
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS__SHIFT                                     0x15
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS__SHIFT                                          0x18
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS_MASK                                                   0x00000007L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS_MASK                                               0x00000010L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS_MASK                                       0x00000020L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS_MASK                                            0x00003F00L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS_MASK                                                   0x00070000L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS_MASK                                               0x00100000L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS_MASK                                       0x00200000L
+#define DP1_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS_MASK                                            0x3F000000L
+//DP1_DP_MSE_SAT2_STATUS
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS__SHIFT                                                 0x0
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS__SHIFT                                             0x4
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS__SHIFT                                     0x5
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS__SHIFT                                          0x8
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS__SHIFT                                                 0x10
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS__SHIFT                                             0x14
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS__SHIFT                                     0x15
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS__SHIFT                                          0x18
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS_MASK                                                   0x00000007L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS_MASK                                               0x00000010L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS_MASK                                       0x00000020L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS_MASK                                            0x00003F00L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS_MASK                                                   0x00070000L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS_MASK                                               0x00100000L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS_MASK                                       0x00200000L
+#define DP1_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS_MASK                                            0x3F000000L
+//DP1_DP_HBLANK_CONTROL
+#define DP1_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                                          0x0
+#define DP1_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                                            0x0000FFFFL
+//DP1_DP_MSA_TIMING_PARAM1
+#define DP1_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL__SHIFT                                                        0x0
+#define DP1_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL__SHIFT                                                        0x10
+#define DP1_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL_MASK                                                          0x0000FFFFL
+#define DP1_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL_MASK                                                          0xFFFF0000L
+//DP1_DP_MSA_TIMING_PARAM2
+#define DP1_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART__SHIFT                                                        0x0
+#define DP1_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART__SHIFT                                                        0x10
+#define DP1_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART_MASK                                                          0x0000FFFFL
+#define DP1_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART_MASK                                                          0xFFFF0000L
+//DP1_DP_MSA_TIMING_PARAM3
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH__SHIFT                                                    0x0
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY__SHIFT                                                 0xf
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH__SHIFT                                                    0x10
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY__SHIFT                                                 0x1f
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH_MASK                                                      0x00007FFFL
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY_MASK                                                   0x00008000L
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH_MASK                                                      0x7FFF0000L
+#define DP1_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY_MASK                                                   0x80000000L
+//DP1_DP_MSA_TIMING_PARAM4
+#define DP1_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT__SHIFT                                                       0x0
+#define DP1_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH__SHIFT                                                        0x10
+#define DP1_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT_MASK                                                         0x0000FFFFL
+#define DP1_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH_MASK                                                          0xFFFF0000L
+//DP1_DP_MSO_CNTL
+#define DP1_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK__SHIFT                                                         0x0
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE__SHIFT                                                      0x4
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE__SHIFT                                                         0x8
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE__SHIFT                                                         0xc
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE__SHIFT                                                         0x10
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE__SHIFT                                                         0x14
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE__SHIFT                                                        0x18
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE__SHIFT                                                        0x1c
+#define DP1_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK_MASK                                                           0x00000003L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE_MASK                                                        0x000000F0L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE_MASK                                                           0x00000F00L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE_MASK                                                           0x0000F000L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE_MASK                                                           0x000F0000L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE_MASK                                                           0x00F00000L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE_MASK                                                          0x0F000000L
+#define DP1_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE_MASK                                                          0xF0000000L
+//DP1_DP_MSO_CNTL1
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE__SHIFT                                                       0x0
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE__SHIFT                                                       0x4
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE__SHIFT                                                       0x8
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE__SHIFT                                                       0xc
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE__SHIFT                                                       0x10
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE__SHIFT                                                       0x14
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE__SHIFT                                                       0x1c
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE_MASK                                                         0x0000000FL
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE_MASK                                                         0x000000F0L
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE_MASK                                                         0x00000F00L
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE_MASK                                                         0x0000F000L
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE_MASK                                                         0x000F0000L
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE_MASK                                                         0x00F00000L
+#define DP1_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE_MASK                                                         0xF0000000L
+//DP1_DP_STEER_FIFO_CNTL
+#define DP1_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN__SHIFT                       0x8
+#define DP1_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                        0x10
+#define DP1_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN_MASK                         0x00000100L
+#define DP1_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE_MASK                                          0x00030000L
+//DP1_DP_SEC_CNTL2
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND__SHIFT                                                             0x0
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING__SHIFT                                                     0x1
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED__SHIFT                                             0x2
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE__SHIFT                                                    0x3
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND__SHIFT                                                             0x4
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING__SHIFT                                                     0x5
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED__SHIFT                                             0x6
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE__SHIFT                                                    0x7
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND__SHIFT                                                             0x8
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING__SHIFT                                                     0x9
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED__SHIFT                                             0xa
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE__SHIFT                                                    0xb
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND__SHIFT                                                             0xc
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING__SHIFT                                                     0xd
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE__SHIFT                                                    0xf
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND__SHIFT                                                             0x10
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING__SHIFT                                                     0x11
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED__SHIFT                                             0x12
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE__SHIFT                                                    0x13
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND__SHIFT                                                             0x14
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING__SHIFT                                                     0x15
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED__SHIFT                                             0x16
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE__SHIFT                                                    0x17
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND__SHIFT                                                             0x18
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING__SHIFT                                                     0x19
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED__SHIFT                                             0x1a
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE__SHIFT                                                    0x1b
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP11_PPS__SHIFT                                                             0x1c
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_MASK                                                               0x00000001L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING_MASK                                                       0x00000002L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED_MASK                                               0x00000004L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE_MASK                                                      0x00000008L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_MASK                                                               0x00000010L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING_MASK                                                       0x00000020L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED_MASK                                               0x00000040L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE_MASK                                                      0x00000080L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_MASK                                                               0x00000100L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING_MASK                                                       0x00000200L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED_MASK                                               0x00000400L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE_MASK                                                      0x00000800L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_MASK                                                               0x00001000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING_MASK                                                       0x00002000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE_MASK                                                      0x00008000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_MASK                                                               0x00010000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING_MASK                                                       0x00020000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED_MASK                                               0x00040000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE_MASK                                                      0x00080000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_MASK                                                               0x00100000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING_MASK                                                       0x00200000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED_MASK                                               0x00400000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE_MASK                                                      0x00800000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_MASK                                                               0x01000000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING_MASK                                                       0x02000000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED_MASK                                               0x04000000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE_MASK                                                      0x08000000L
+#define DP1_DP_SEC_CNTL2__DP_SEC_GSP11_PPS_MASK                                                               0x10000000L
+//DP1_DP_SEC_CNTL3
+#define DP1_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM__SHIFT                                                         0x0
+#define DP1_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP1_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_SEC_CNTL4
+#define DP1_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM__SHIFT                                                         0x0
+#define DP1_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP1_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_SEC_CNTL5
+#define DP1_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM__SHIFT                                                         0x0
+#define DP1_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP1_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_SEC_CNTL6
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM__SHIFT                                                         0x0
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE__SHIFT                                                    0x10
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE__SHIFT                                                    0x11
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE__SHIFT                                                    0x12
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE__SHIFT                                                    0x13
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE__SHIFT                                                    0x14
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE__SHIFT                                                    0x15
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE__SHIFT                                                    0x16
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE__SHIFT                                                    0x17
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE__SHIFT                                                    0x18
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE__SHIFT                                                    0x19
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE__SHIFT                                                   0x1a
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE__SHIFT                                                   0x1b
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE_MASK                                                      0x00010000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE_MASK                                                      0x00020000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE_MASK                                                      0x00040000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE_MASK                                                      0x00080000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE_MASK                                                      0x00100000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE_MASK                                                      0x00200000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE_MASK                                                      0x00400000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE_MASK                                                      0x00800000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE_MASK                                                      0x01000000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE_MASK                                                      0x02000000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE_MASK                                                     0x04000000L
+#define DP1_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE_MASK                                                     0x08000000L
+//DP1_DP_SEC_CNTL7
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE__SHIFT                                                      0x0
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE__SHIFT                                                     0x1
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE__SHIFT                                                      0x4
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE__SHIFT                                                     0x5
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE__SHIFT                                                      0x8
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE__SHIFT                                                     0x9
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE__SHIFT                                                      0xc
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE__SHIFT                                                     0xd
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE__SHIFT                                                      0x10
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE__SHIFT                                                     0x11
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE__SHIFT                                                      0x14
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE__SHIFT                                                     0x15
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE__SHIFT                                                      0x18
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE__SHIFT                                                     0x19
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE__SHIFT                                                      0x1c
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE__SHIFT                                                     0x1d
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE_MASK                                                        0x00000001L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE_MASK                                                       0x00000002L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE_MASK                                                        0x00000010L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE_MASK                                                       0x00000020L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE_MASK                                                        0x00000100L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE_MASK                                                       0x00000200L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE_MASK                                                        0x00001000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE_MASK                                                       0x00002000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE_MASK                                                        0x00010000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE_MASK                                                       0x00020000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE_MASK                                                        0x00100000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE_MASK                                                       0x00200000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE_MASK                                                        0x01000000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE_MASK                                                       0x02000000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE_MASK                                                        0x10000000L
+#define DP1_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE_MASK                                                       0x20000000L
+//DP1_DP_DB_CNTL
+#define DP1_DP_DB_CNTL__DP_DB_PENDING__SHIFT                                                                  0x0
+#define DP1_DP_DB_CNTL__DP_DB_TAKEN__SHIFT                                                                    0x4
+#define DP1_DP_DB_CNTL__DP_DB_TAKEN_CLR__SHIFT                                                                0x5
+#define DP1_DP_DB_CNTL__DP_DB_LOCK__SHIFT                                                                     0x8
+#define DP1_DP_DB_CNTL__DP_DB_DISABLE__SHIFT                                                                  0xc
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_PENDING__SHIFT                                                          0xf
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN__SHIFT                                                            0x10
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR__SHIFT                                                        0x11
+#define DP1_DP_DB_CNTL__DP_DB_PENDING_MASK                                                                    0x00000001L
+#define DP1_DP_DB_CNTL__DP_DB_TAKEN_MASK                                                                      0x00000010L
+#define DP1_DP_DB_CNTL__DP_DB_TAKEN_CLR_MASK                                                                  0x00000020L
+#define DP1_DP_DB_CNTL__DP_DB_LOCK_MASK                                                                       0x00000100L
+#define DP1_DP_DB_CNTL__DP_DB_DISABLE_MASK                                                                    0x00001000L
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_PENDING_MASK                                                            0x00008000L
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_MASK                                                              0x00010000L
+#define DP1_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR_MASK                                                          0x00020000L
+//DP1_DP_MSA_VBID_MISC
+#define DP1_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE__SHIFT                                         0x0
+#define DP1_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                                      0x4
+#define DP1_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE__SHIFT                                                        0x8
+#define DP1_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE__SHIFT                                                        0x9
+#define DP1_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN__SHIFT                                                     0xc
+#define DP1_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN__SHIFT                                                     0xd
+#define DP1_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE__SHIFT                                                  0xf
+#define DP1_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM__SHIFT                                                        0x10
+#define DP1_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_MASK                                           0x00000003L
+#define DP1_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                                        0x00000010L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_MASK                                                          0x00000100L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_MASK                                                          0x00000200L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN_MASK                                                       0x00001000L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN_MASK                                                       0x00002000L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE_MASK                                                    0x00008000L
+#define DP1_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM_MASK                                                          0xFFFF0000L
+//DP1_DP_SEC_METADATA_TRANSMISSION
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE__SHIFT                                0x0
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE__SHIFT                        0x1
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE__SHIFT                            0x4
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE__SHIFT                                  0x10
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE_MASK                                  0x00000001L
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE_MASK                          0x00000002L
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE_MASK                              0x000000F0L
+#define DP1_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_MASK                                    0xFFFF0000L
+//DP1_DP_ALPM_CNTL
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND__SHIFT                                                         0x0
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING__SHIFT                                                      0x1
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND__SHIFT                                                       0x2
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING__SHIFT                                                    0x3
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE__SHIFT                                            0x4
+#define DP1_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO__SHIFT                                        0x5
+#define DP1_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE__SHIFT                                                  0x6
+#define DP1_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP__SHIFT                                     0x7
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM__SHIFT                                                  0x8
+#define DP1_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS__SHIFT                                   0xb
+#define DP1_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN__SHIFT                                       0xc
+#define DP1_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE__SHIFT                                                       0xf
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM__SHIFT                                             0x10
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND_MASK                                                           0x00000001L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING_MASK                                                        0x00000002L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND_MASK                                                         0x00000004L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING_MASK                                                      0x00000008L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE_MASK                                              0x00000010L
+#define DP1_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO_MASK                                          0x00000020L
+#define DP1_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE_MASK                                                    0x00000040L
+#define DP1_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_MASK                                       0x00000080L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM_MASK                                                    0x00000300L
+#define DP1_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS_MASK                                     0x00000800L
+#define DP1_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN_MASK                                         0x00001000L
+#define DP1_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE_MASK                                                         0x00008000L
+#define DP1_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM_MASK                                               0xFFFF0000L
+//DP1_DP_GSP8_CNTL
+#define DP1_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE__SHIFT                                                       0x0
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE__SHIFT                                                           0x4
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND__SHIFT                                                             0x7
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING__SHIFT                                                     0xc
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE_MASK                                                         0x0000000FL
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE_MASK                                                             0x00000010L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_MASK                                                               0x00000080L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING_MASK                                                       0x00001000L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP1_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_GSP9_CNTL
+#define DP1_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE__SHIFT                                                       0x0
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE__SHIFT                                                           0x4
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND__SHIFT                                                             0x7
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING__SHIFT                                                     0xc
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM__SHIFT                                                         0x10
+#define DP1_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE_MASK                                                         0x0000000FL
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE_MASK                                                             0x00000010L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_MASK                                                               0x00000080L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING_MASK                                                       0x00001000L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP1_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP1_DP_GSP10_CNTL
+#define DP1_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE__SHIFT                                                     0x0
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE__SHIFT                                                         0x4
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND__SHIFT                                                           0x7
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING__SHIFT                                                   0xc
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM__SHIFT                                                       0x10
+#define DP1_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE_MASK                                                       0x0000000FL
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE_MASK                                                           0x00000010L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_MASK                                                             0x00000080L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING_MASK                                                     0x00001000L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP1_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP1_DP_GSP11_CNTL
+#define DP1_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE__SHIFT                                                     0x0
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE__SHIFT                                                         0x4
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND__SHIFT                                                           0x7
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING__SHIFT                                                   0xc
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM__SHIFT                                                       0x10
+#define DP1_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE_MASK                                                       0x0000000FL
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE_MASK                                                           0x00000010L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_MASK                                                             0x00000080L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING_MASK                                                     0x00001000L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP1_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP1_DP_GSP_EN_DB_STATUS
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING__SHIFT                                             0x0
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING__SHIFT                                             0x1
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING__SHIFT                                             0x2
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING__SHIFT                                             0x3
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING__SHIFT                                             0x4
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING__SHIFT                                             0x5
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING__SHIFT                                             0x6
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING__SHIFT                                             0x7
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING__SHIFT                                             0x8
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING__SHIFT                                             0x9
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING__SHIFT                                            0xa
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING__SHIFT                                            0xb
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING_MASK                                               0x00000001L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING_MASK                                               0x00000002L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING_MASK                                               0x00000004L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING_MASK                                               0x00000008L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING_MASK                                               0x00000010L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING_MASK                                               0x00000020L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING_MASK                                               0x00000040L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING_MASK                                               0x00000080L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING_MASK                                               0x00000100L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING_MASK                                               0x00000200L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING_MASK                                              0x00000400L
+#define DP1_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING_MASK                                              0x00000800L
+//DP1_DP_AUXLESS_ALPM_CNTL1
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT__SHIFT                                              0x4
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY__SHIFT                                               0x8
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL__SHIFT                                            0x14
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE__SHIFT                                     0x1f
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT_MASK                                                0x000000F0L
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY_MASK                                                 0x0007FF00L
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL_MASK                                              0x1FF00000L
+#define DP1_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE_MASK                                       0x80000000L
+//DP1_DP_AUXLESS_ALPM_CNTL2
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME__SHIFT                                           0x0
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND__SHIFT                                                 0x7
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE__SHIFT                                            0x10
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING__SHIFT                                              0x11
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE__SHIFT                                            0x12
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING__SHIFT                                              0x13
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD__SHIFT                                          0x14
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME_MASK                                             0x0000007FL
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND_MASK                                                   0x00000080L
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE_MASK                                              0x00010000L
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING_MASK                                                0x00020000L
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE_MASK                                              0x00040000L
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING_MASK                                                0x00080000L
+#define DP1_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD_MASK                                            0x3FF00000L
+//DP1_DP_AUXLESS_ALPM_CNTL3
+#define DP1_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM__SHIFT                                             0x0
+#define DP1_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM__SHIFT                                             0x10
+#define DP1_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM_MASK                                               0x0000FFFFL
+#define DP1_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM_MASK                                               0xFFFF0000L
+//DP1_DP_AUXLESS_ALPM_CNTL4
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN__SHIFT                                                  0x1
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL__SHIFT                                   0x2
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME__SHIFT                                     0x3
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE__SHIFT                                       0x4
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS__SHIFT                                           0x5
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE__SHIFT                                               0x6
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM__SHIFT                                                   0x18
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_MASK                                                    0x00000002L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL_MASK                                     0x00000004L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME_MASK                                       0x00000008L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE_MASK                                         0x00000010L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS_MASK                                             0x00000020L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE_MASK                                                 0x00000040L
+#define DP1_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM_MASK                                                     0xFF000000L
+//DP1_DP_AUXLESS_ALPM_CNTL5
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK__SHIFT                                       0x0
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED__SHIFT                                   0x1
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                                     0x2
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR__SHIFT                                      0x3
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM__SHIFT                                  0x8
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM__SHIFT                                   0x10
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK_MASK                                         0x00000001L
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED_MASK                                     0x00000002L
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                                       0x00000004L
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR_MASK                                        0x00000008L
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM_MASK                                    0x0000FF00L
+#define DP1_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM_MASK                                     0xFFFF0000L
+//DP1_DP_STREAM_SYMBOL_COUNT_STATUS
+#define DP1_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT__SHIFT                                          0x0
+#define DP1_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT_MASK                                            0x0000FFFFL
+//DP1_DP_STREAM_SYMBOL_COUNT_CONTROL
+#define DP1_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE__SHIFT                                  0x0
+#define DP1_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET__SHIFT                                   0x4
+#define DP1_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE_MASK                                    0x00000001L
+#define DP1_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET_MASK                                     0x00000010L
+//DP1_DP_LINK_SYMBOL_COUNT_STATUS0
+#define DP1_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT__SHIFT                                             0x0
+#define DP1_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT_MASK                                               0x0000FFFFL
+//DP1_DP_LINK_SYMBOL_COUNT_STATUS1
+#define DP1_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT__SHIFT                                          0x0
+#define DP1_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT_MASK                                            0xFFFFFFFFL
+//DP1_DP_LINK_SYMBOL_COUNT_CONTROL
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE__SHIFT                                      0x0
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET__SHIFT                                       0x4
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE__SHIFT                                   0x8
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET__SHIFT                                    0xc
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE_MASK                                        0x00000001L
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET_MASK                                         0x00000010L
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE_MASK                                     0x00000100L
+#define DP1_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET_MASK                                      0x00001000L
+//DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT           0x0
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING__SHIFT  0x8
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK             0x00000001L
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+#define DP1_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING_MASK  0x00000100L
+//DP1_DP_DPHY_FAST_TRAINING
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE__SHIFT                                       0x0
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START__SHIFT                                         0x1
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN__SHIFT                            0x2
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING__SHIFT                              0x4
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME__SHIFT                                         0x8
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME__SHIFT                                         0x14
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE_MASK                                         0x00000001L
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START_MASK                                           0x00000002L
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN_MASK                              0x00000004L
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING_MASK                                0x00000010L
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME_MASK                                           0x000FFF00L
+#define DP1_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME_MASK                                           0xFFF00000L
+//DP1_DP_DPHY_FAST_TRAINING_STATUS
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE__SHIFT                                     0x0
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED__SHIFT                         0x4
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK__SHIFT                             0x8
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK__SHIFT                              0xc
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE_MASK                                       0x00000007L
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED_MASK                           0x00000010L
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK_MASK                               0x00000100L
+#define DP1_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK_MASK                                0x00001000L
+
+
+// addressBlock: dce_dc_dio_dig1_dispdec
+//DIG1_DIG_FE_CNTL
+#define DIG1_DIG_FE_CNTL__DIG_SOURCE_SELECT__SHIFT                                                            0x0
+#define DIG1_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT__SHIFT                                                        0x4
+#define DIG1_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN__SHIFT                                                       0x8
+#define DIG1_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT__SHIFT                                                    0xc
+#define DIG1_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN__SHIFT                                                        0x14
+#define DIG1_DIG_FE_CNTL__DIG_SOURCE_SELECT_MASK                                                              0x00000007L
+#define DIG1_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT_MASK                                                          0x00000070L
+#define DIG1_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN_MASK                                                         0x00000100L
+#define DIG1_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT_MASK                                                      0x00007000L
+#define DIG1_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN_MASK                                                          0x00100000L
+//DIG1_DIG_FE_CLK_CNTL
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_MODE__SHIFT                                                              0x0
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN__SHIFT                                                            0x4
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON__SHIFT                                                0xa
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON__SHIFT                                              0xb
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON__SHIFT                                          0xc
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON__SHIFT                                         0xd
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON__SHIFT                                             0xe
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_MODE_MASK                                                                0x00000007L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN_MASK                                                              0x00000010L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON_MASK                                                  0x00000400L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON_MASK                                                0x00000800L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON_MASK                                            0x00001000L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON_MASK                                           0x00002000L
+#define DIG1_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON_MASK                                               0x00004000L
+//DIG1_DIG_FE_EN_CNTL
+#define DIG1_DIG_FE_EN_CNTL__DIG_FE_ENABLE__SHIFT                                                             0x0
+#define DIG1_DIG_FE_EN_CNTL__DIG_FE_ENABLE_MASK                                                               0x00000001L
+//DIG1_DIG_OUTPUT_CRC_CNTL
+#define DIG1_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN__SHIFT                                                    0x0
+#define DIG1_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL__SHIFT                                              0x8
+#define DIG1_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN_MASK                                                      0x00000001L
+#define DIG1_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL_MASK                                                0x00000300L
+//DIG1_DIG_OUTPUT_CRC_RESULT
+#define DIG1_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT__SHIFT                                              0x0
+#define DIG1_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT_MASK                                                0x3FFFFFFFL
+//DIG1_DIG_CLOCK_PATTERN
+#define DIG1_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN__SHIFT                                                      0x0
+#define DIG1_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN_MASK                                                        0x000003FFL
+//DIG1_DIG_TEST_PATTERN
+#define DIG1_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN__SHIFT                                                 0x0
+#define DIG1_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL__SHIFT                                              0x1
+#define DIG1_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN__SHIFT                                               0x4
+#define DIG1_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET__SHIFT                                                0x5
+#define DIG1_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN__SHIFT                                      0x6
+#define DIG1_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN__SHIFT                                                 0x10
+#define DIG1_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN_MASK                                                   0x00000001L
+#define DIG1_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL_MASK                                                0x00000002L
+#define DIG1_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN_MASK                                                 0x00000010L
+#define DIG1_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET_MASK                                                  0x00000020L
+#define DIG1_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN_MASK                                        0x00000040L
+#define DIG1_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN_MASK                                                   0x03FF0000L
+//DIG1_DIG_RANDOM_PATTERN_SEED
+#define DIG1_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED__SHIFT                                          0x0
+#define DIG1_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY__SHIFT                                       0x18
+#define DIG1_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED_MASK                                            0x00FFFFFFL
+#define DIG1_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY_MASK                                         0x01000000L
+//DIG1_DIG_FIFO_CTRL0
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE__SHIFT                                                           0x0
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_RESET__SHIFT                                                            0x1
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL__SHIFT                                                 0x2
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC__SHIFT                                                   0x8
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                           0x9
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE__SHIFT                                                       0x14
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_ERROR__SHIFT                                                            0x1c
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE_MASK                                                             0x00000001L
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_RESET_MASK                                                              0x00000002L
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL_MASK                                                   0x000000FCL
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC_MASK                                                     0x00000100L
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE_MASK                                             0x00000600L
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE_MASK                                                         0x00100000L
+#define DIG1_DIG_FIFO_CTRL0__DIG_FIFO_ERROR_MASK                                                              0x30000000L
+//DIG1_DIG_FIFO_CTRL1
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL__SHIFT                                              0x1
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL__SHIFT                                                  0x2
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY__SHIFT                                                  0x8
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL__SHIFT                                                0xa
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL__SHIFT                                                    0x10
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL__SHIFT                                                    0x16
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED__SHIFT                                                       0x1d
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE__SHIFT                                              0x1e
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX__SHIFT                                              0x1f
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL_MASK                                                0x00000002L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL_MASK                                                    0x000000FCL
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY_MASK                                                    0x00000300L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL_MASK                                                  0x0000FC00L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL_MASK                                                      0x001F0000L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL_MASK                                                      0x03C00000L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED_MASK                                                         0x20000000L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE_MASK                                                0x40000000L
+#define DIG1_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX_MASK                                                0x80000000L
+//DIG1_HDMI_METADATA_PACKET_CONTROL
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE__SHIFT                                 0x0
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE__SHIFT                         0x4
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED__SHIFT                                 0x8
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE__SHIFT                                   0x10
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE_MASK                                   0x00000001L
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE_MASK                           0x00000010L
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED_MASK                                   0x00000100L
+#define DIG1_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_MASK                                     0xFFFF0000L
+//DIG1_HDMI_CONTROL
+#define DIG1_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN__SHIFT                                                       0x1
+#define DIG1_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE__SHIFT                                                     0x2
+#define DIG1_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED__SHIFT                                            0x3
+#define DIG1_HDMI_CONTROL__HDMI_ERROR_ACK__SHIFT                                                              0x8
+#define DIG1_HDMI_CONTROL__HDMI_ERROR_MASK__SHIFT                                                             0x9
+#define DIG1_HDMI_CONTROL__DOLBY_VISION_EN__SHIFT                                                             0xa
+#define DIG1_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED__SHIFT                                         0xb
+#define DIG1_HDMI_CONTROL__TMDS_PIXEL_ENCODING__SHIFT                                                         0xc
+#define DIG1_HDMI_CONTROL__TMDS_COLOR_FORMAT__SHIFT                                                           0xd
+#define DIG1_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM__SHIFT                                           0x10
+#define DIG1_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE__SHIFT                                                      0x18
+#define DIG1_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH__SHIFT                                                       0x1c
+#define DIG1_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN_MASK                                                         0x00000002L
+#define DIG1_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE_MASK                                                       0x00000004L
+#define DIG1_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED_MASK                                              0x00000008L
+#define DIG1_HDMI_CONTROL__HDMI_ERROR_ACK_MASK                                                                0x00000100L
+#define DIG1_HDMI_CONTROL__HDMI_ERROR_MASK_MASK                                                               0x00000200L
+#define DIG1_HDMI_CONTROL__DOLBY_VISION_EN_MASK                                                               0x00000400L
+#define DIG1_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED_MASK                                           0x00000800L
+#define DIG1_HDMI_CONTROL__TMDS_PIXEL_ENCODING_MASK                                                           0x00001000L
+#define DIG1_HDMI_CONTROL__TMDS_COLOR_FORMAT_MASK                                                             0x00006000L
+#define DIG1_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM_MASK                                             0x003F0000L
+#define DIG1_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK                                                        0x01000000L
+#define DIG1_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK                                                         0x30000000L
+//DIG1_HDMI_STATUS
+#define DIG1_HDMI_STATUS__HDMI_ACTIVE_AVMUTE__SHIFT                                                           0x0
+#define DIG1_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR__SHIFT                                                      0x10
+#define DIG1_HDMI_STATUS__HDMI_ERROR_INT__SHIFT                                                               0x1b
+#define DIG1_HDMI_STATUS__HDMI_ACTIVE_AVMUTE_MASK                                                             0x00000001L
+#define DIG1_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR_MASK                                                        0x00010000L
+#define DIG1_HDMI_STATUS__HDMI_ERROR_INT_MASK                                                                 0x08000000L
+//DIG1_HDMI_AUDIO_PACKET_CONTROL
+#define DIG1_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN__SHIFT                                            0x4
+#define DIG1_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN_MASK                                              0x00000030L
+//DIG1_HDMI_ACR_PACKET_CONTROL
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND__SHIFT                                                    0x0
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT__SHIFT                                                    0x1
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT__SHIFT                                                  0x4
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE__SHIFT                                                  0x8
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND__SHIFT                                               0xc
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE__SHIFT                                              0x10
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND_MASK                                                      0x00000001L
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT_MASK                                                      0x00000002L
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT_MASK                                                    0x00000030L
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE_MASK                                                    0x00000100L
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_MASK                                                 0x00001000L
+#define DIG1_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE_MASK                                                0x00070000L
+//DIG1_HDMI_VBI_PACKET_CONTROL
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND__SHIFT                                                   0x0
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND__SHIFT                                                     0x4
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT__SHIFT                                                     0x5
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND__SHIFT                                                   0x8
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT__SHIFT                                                   0x9
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND__SHIFT                                                    0xc
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE__SHIFT                                                   0x10
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE__SHIFT                                                    0x18
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK                                                     0x00000001L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND_MASK                                                       0x00000010L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT_MASK                                                       0x00000020L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND_MASK                                                     0x00000100L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT_MASK                                                     0x00000200L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND_MASK                                                      0x00001000L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE_MASK                                                     0x003F0000L
+#define DIG1_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE_MASK                                                      0x3F000000L
+//DIG1_HDMI_INFOFRAME_CONTROL0
+#define DIG1_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND__SHIFT                                             0x4
+#define DIG1_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE__SHIFT                                             0x8
+#define DIG1_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND_MASK                                               0x00000010L
+#define DIG1_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE_MASK                                               0x00003F00L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT__SHIFT                                          0x1
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE__SHIFT                                0x2
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND__SHIFT                                          0x4
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT__SHIFT                                          0x5
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE__SHIFT                                0x6
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND__SHIFT                                          0x8
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT__SHIFT                                          0x9
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE__SHIFT                                0xa
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE__SHIFT                           0xb
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND__SHIFT                                          0xc
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT__SHIFT                                          0xd
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE__SHIFT                                0xe
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE__SHIFT                           0xf
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT__SHIFT                                          0x11
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE__SHIFT                                0x12
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE__SHIFT                           0x13
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND__SHIFT                                          0x14
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT__SHIFT                                          0x15
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE__SHIFT                                0x16
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE__SHIFT                           0x17
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND__SHIFT                                          0x18
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT__SHIFT                                          0x19
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE__SHIFT                                0x1a
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE__SHIFT                           0x1b
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND__SHIFT                                          0x1c
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT__SHIFT                                          0x1d
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE__SHIFT                                0x1e
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE__SHIFT                           0x1f
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND_MASK                                            0x00000001L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT_MASK                                            0x00000002L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND_MASK                                            0x00000010L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT_MASK                                            0x00000020L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND_MASK                                            0x00000100L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT_MASK                                            0x00000200L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE_MASK                                  0x00000400L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE_MASK                             0x00000800L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND_MASK                                            0x00001000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT_MASK                                            0x00002000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE_MASK                                  0x00004000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE_MASK                             0x00008000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND_MASK                                            0x00010000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT_MASK                                            0x00020000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE_MASK                                  0x00040000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE_MASK                             0x00080000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND_MASK                                            0x00100000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT_MASK                                            0x00200000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE_MASK                                  0x00400000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE_MASK                             0x00800000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND_MASK                                            0x01000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT_MASK                                            0x02000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE_MASK                                  0x04000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE_MASK                             0x08000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND_MASK                                            0x10000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT_MASK                                            0x20000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE_MASK                                  0x40000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE_MASK                             0x80000000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL6
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT__SHIFT                                          0x1
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE__SHIFT                                0x2
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND__SHIFT                                          0x4
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT__SHIFT                                          0x5
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE__SHIFT                                0x6
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND__SHIFT                                         0x8
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT__SHIFT                                         0x9
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE__SHIFT                               0xa
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE__SHIFT                          0xb
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND__SHIFT                                         0xc
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT__SHIFT                                         0xd
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE__SHIFT                               0xe
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE__SHIFT                          0xf
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND__SHIFT                                         0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT__SHIFT                                         0x11
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE__SHIFT                               0x12
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE__SHIFT                          0x13
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND__SHIFT                                         0x14
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT__SHIFT                                         0x15
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE__SHIFT                               0x16
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE__SHIFT                          0x17
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND__SHIFT                                         0x18
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT__SHIFT                                         0x19
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE__SHIFT                               0x1a
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE__SHIFT                          0x1b
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND_MASK                                            0x00000001L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT_MASK                                            0x00000002L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND_MASK                                            0x00000010L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT_MASK                                            0x00000020L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND_MASK                                           0x00000100L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT_MASK                                           0x00000200L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE_MASK                                 0x00000400L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE_MASK                            0x00000800L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND_MASK                                           0x00001000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT_MASK                                           0x00002000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE_MASK                                 0x00004000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE_MASK                            0x00008000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND_MASK                                           0x00010000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT_MASK                                           0x00020000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE_MASK                                 0x00040000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE_MASK                            0x00080000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND_MASK                                           0x00100000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT_MASK                                           0x00200000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE_MASK                                 0x00400000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE_MASK                            0x00800000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND_MASK                                           0x01000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT_MASK                                           0x02000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE_MASK                                 0x04000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE_MASK                            0x08000000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL5
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND__SHIFT                                0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING__SHIFT                        0x1
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND__SHIFT                                0x2
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING__SHIFT                        0x3
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND__SHIFT                                0x4
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING__SHIFT                        0x5
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND__SHIFT                                0x6
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING__SHIFT                        0x7
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND__SHIFT                                0x8
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING__SHIFT                        0x9
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND__SHIFT                                0xa
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING__SHIFT                        0xb
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND__SHIFT                                0xc
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING__SHIFT                        0xd
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND__SHIFT                                0xe
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING__SHIFT                        0xf
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND__SHIFT                                0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING__SHIFT                        0x11
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND__SHIFT                                0x12
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING__SHIFT                        0x13
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND__SHIFT                               0x14
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING__SHIFT                       0x15
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND__SHIFT                               0x16
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING__SHIFT                       0x17
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND__SHIFT                               0x18
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING__SHIFT                       0x19
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND__SHIFT                               0x1a
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING__SHIFT                       0x1b
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND__SHIFT                               0x1c
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING__SHIFT                       0x1d
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_MASK                                  0x00000001L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING_MASK                          0x00000002L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_MASK                                  0x00000004L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING_MASK                          0x00000008L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_MASK                                  0x00000010L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING_MASK                          0x00000020L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_MASK                                  0x00000040L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING_MASK                          0x00000080L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_MASK                                  0x00000100L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING_MASK                          0x00000200L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_MASK                                  0x00000400L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING_MASK                          0x00000800L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_MASK                                  0x00001000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING_MASK                          0x00002000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_MASK                                  0x00004000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING_MASK                          0x00008000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_MASK                                  0x00010000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING_MASK                          0x00020000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_MASK                                  0x00040000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING_MASK                          0x00080000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_MASK                                 0x00100000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING_MASK                         0x00200000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_MASK                                 0x00400000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING_MASK                         0x00800000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_MASK                                 0x01000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING_MASK                         0x02000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_MASK                                 0x04000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING_MASK                         0x08000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_MASK                                 0x10000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING_MASK                         0x20000000L
+//DIG1_HDMI_GC
+#define DIG1_HDMI_GC__HDMI_GC_AVMUTE__SHIFT                                                                   0x0
+#define DIG1_HDMI_GC__HDMI_GC_AVMUTE_CONT__SHIFT                                                              0x2
+#define DIG1_HDMI_GC__HDMI_DEFAULT_PHASE__SHIFT                                                               0x4
+#define DIG1_HDMI_GC__HDMI_PACKING_PHASE__SHIFT                                                               0x8
+#define DIG1_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE__SHIFT                                                      0xc
+#define DIG1_HDMI_GC__HDMI_GC_AVMUTE_MASK                                                                     0x00000001L
+#define DIG1_HDMI_GC__HDMI_GC_AVMUTE_CONT_MASK                                                                0x00000004L
+#define DIG1_HDMI_GC__HDMI_DEFAULT_PHASE_MASK                                                                 0x00000010L
+#define DIG1_HDMI_GC__HDMI_PACKING_PHASE_MASK                                                                 0x00000F00L
+#define DIG1_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE_MASK                                                        0x00001000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL1
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE_MASK                                            0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE_MASK                                            0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL2
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE_MASK                                            0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE_MASK                                            0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL3
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE_MASK                                            0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE_MASK                                            0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL4
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE_MASK                                            0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE_MASK                                            0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL7
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE__SHIFT                                          0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE__SHIFT                                          0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE_MASK                                            0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE_MASK                                            0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL8
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE__SHIFT                                         0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE__SHIFT                                         0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE_MASK                                           0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE_MASK                                           0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL9
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE__SHIFT                                         0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE__SHIFT                                         0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE_MASK                                           0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE_MASK                                           0xFFFF0000L
+//DIG1_HDMI_GENERIC_PACKET_CONTROL10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE__SHIFT                                        0x0
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING__SHIFT                                0x10
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING__SHIFT                                0x11
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING__SHIFT                                0x12
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING__SHIFT                                0x13
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING__SHIFT                                0x14
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING__SHIFT                                0x15
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING__SHIFT                                0x16
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING__SHIFT                                0x17
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING__SHIFT                                0x18
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING__SHIFT                                0x19
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING__SHIFT                               0x1a
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING__SHIFT                               0x1b
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING__SHIFT                               0x1c
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING__SHIFT                               0x1d
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING__SHIFT                               0x1e
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE_MASK                                          0x0000FFFFL
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING_MASK                                  0x00010000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING_MASK                                  0x00020000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING_MASK                                  0x00040000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING_MASK                                  0x00080000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING_MASK                                  0x00100000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING_MASK                                  0x00200000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING_MASK                                  0x00400000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING_MASK                                  0x00800000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING_MASK                                  0x01000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING_MASK                                  0x02000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING_MASK                                 0x04000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING_MASK                                 0x08000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING_MASK                                 0x10000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING_MASK                                 0x20000000L
+#define DIG1_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING_MASK                                 0x40000000L
+//DIG1_HDMI_DB_CONTROL
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_PENDING__SHIFT                                                          0x0
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_TAKEN__SHIFT                                                            0x4
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR__SHIFT                                                        0x5
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_LOCK__SHIFT                                                             0x8
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_DISABLE__SHIFT                                                          0xc
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_PENDING__SHIFT                                                       0xf
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN__SHIFT                                                         0x10
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR__SHIFT                                                     0x11
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_PENDING_MASK                                                            0x00000001L
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_TAKEN_MASK                                                              0x00000010L
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR_MASK                                                          0x00000020L
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_LOCK_MASK                                                               0x00000100L
+#define DIG1_HDMI_DB_CONTROL__HDMI_DB_DISABLE_MASK                                                            0x00001000L
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_PENDING_MASK                                                         0x00008000L
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_MASK                                                           0x00010000L
+#define DIG1_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR_MASK                                                       0x00020000L
+//DIG1_HDMI_ACR_32_0
+#define DIG1_HDMI_ACR_32_0__HDMI_ACR_CTS_32__SHIFT                                                            0xc
+#define DIG1_HDMI_ACR_32_0__HDMI_ACR_CTS_32_MASK                                                              0xFFFFF000L
+//DIG1_HDMI_ACR_32_1
+#define DIG1_HDMI_ACR_32_1__HDMI_ACR_N_32__SHIFT                                                              0x0
+#define DIG1_HDMI_ACR_32_1__HDMI_ACR_N_32_MASK                                                                0x000FFFFFL
+//DIG1_HDMI_ACR_44_0
+#define DIG1_HDMI_ACR_44_0__HDMI_ACR_CTS_44__SHIFT                                                            0xc
+#define DIG1_HDMI_ACR_44_0__HDMI_ACR_CTS_44_MASK                                                              0xFFFFF000L
+//DIG1_HDMI_ACR_44_1
+#define DIG1_HDMI_ACR_44_1__HDMI_ACR_N_44__SHIFT                                                              0x0
+#define DIG1_HDMI_ACR_44_1__HDMI_ACR_N_44_MASK                                                                0x000FFFFFL
+//DIG1_HDMI_ACR_48_0
+#define DIG1_HDMI_ACR_48_0__HDMI_ACR_CTS_48__SHIFT                                                            0xc
+#define DIG1_HDMI_ACR_48_0__HDMI_ACR_CTS_48_MASK                                                              0xFFFFF000L
+//DIG1_HDMI_ACR_48_1
+#define DIG1_HDMI_ACR_48_1__HDMI_ACR_N_48__SHIFT                                                              0x0
+#define DIG1_HDMI_ACR_48_1__HDMI_ACR_N_48_MASK                                                                0x000FFFFFL
+//DIG1_HDMI_ACR_STATUS_0
+#define DIG1_HDMI_ACR_STATUS_0__HDMI_ACR_CTS__SHIFT                                                           0xc
+#define DIG1_HDMI_ACR_STATUS_0__HDMI_ACR_CTS_MASK                                                             0xFFFFF000L
+//DIG1_HDMI_ACR_STATUS_1
+#define DIG1_HDMI_ACR_STATUS_1__HDMI_ACR_N__SHIFT                                                             0x0
+#define DIG1_HDMI_ACR_STATUS_1__HDMI_ACR_N_MASK                                                               0x000FFFFFL
+//DIG1_DIG_FE_AUDIO_CNTL
+#define DIG1_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT                               0x0
+#define DIG1_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE__SHIFT                                                       0x8
+#define DIG1_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK                                 0x00000007L
+#define DIG1_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE_MASK                                                         0x00000100L
+//DIG1_DIG_BE_CLK_CNTL
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_MODE__SHIFT                                                              0x0
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN__SHIFT                                                            0x4
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG1_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET__SHIFT                                                          0x6
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON__SHIFT                                                 0xb
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON__SHIFT                                            0xc
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON__SHIFT                                            0xd
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_MODE_MASK                                                                0x00000007L
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN_MASK                                                              0x00000010L
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG1_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET_MASK                                                            0x00000040L
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON_MASK                                                   0x00000800L
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON_MASK                                              0x00001000L
+#define DIG1_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON_MASK                                              0x00002000L
+//DIG1_DIG_BE_CNTL
+#define DIG1_DIG_BE_CNTL__DIG_RB_SWITCH_EN__SHIFT                                                             0x2
+#define DIG1_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT__SHIFT                                                         0x8
+#define DIG1_DIG_BE_CNTL__DIG_HPD_SELECT__SHIFT                                                               0x1c
+#define DIG1_DIG_BE_CNTL__DIG_RB_SWITCH_EN_MASK                                                               0x00000004L
+#define DIG1_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT_MASK                                                           0x00007F00L
+#define DIG1_DIG_BE_CNTL__DIG_HPD_SELECT_MASK                                                                 0x70000000L
+//DIG1_DIG_BE_EN_CNTL
+#define DIG1_DIG_BE_EN_CNTL__DIG_BE_ENABLE__SHIFT                                                             0x0
+#define DIG1_DIG_BE_EN_CNTL__DIG_BE_ENABLE_MASK                                                               0x00000001L
+//DIG1_HDCP_INT_CONTROL
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT__SHIFT                                                   0x0
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK__SHIFT                                                   0x1
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK__SHIFT                                                  0x2
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT__SHIFT                                                      0x4
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK__SHIFT                                                      0x5
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK__SHIFT                                                     0x6
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK__SHIFT                                                 0x7
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT__SHIFT                                                   0x8
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK__SHIFT                                                   0x9
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK__SHIFT                                                  0xa
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT__SHIFT                                                  0xc
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK__SHIFT                                                  0xd
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK__SHIFT                                                 0xe
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT_MASK                                                     0x00000001L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK_MASK                                                     0x00000002L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK_MASK                                                    0x00000004L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT_MASK                                                        0x00000010L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK_MASK                                                        0x00000020L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK_MASK                                                       0x00000040L
+#define DIG1_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK_MASK                                                   0x00000080L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT_MASK                                                     0x00000100L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK_MASK                                                     0x00000200L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK_MASK                                                    0x00000400L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT_MASK                                                    0x00001000L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK_MASK                                                    0x00002000L
+#define DIG1_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK_MASK                                                   0x00004000L
+//DIG1_HDCP_I2C_CONTROL_0
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE__SHIFT                                                      0x0
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET__SHIFT                                                   0x2
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT__SHIFT                                                   0x8
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE_MASK                                                        0x00000001L
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET_MASK                                                     0x00000004L
+#define DIG1_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT_MASK                                                     0x00000700L
+//DIG1_HDCP_I2C_CONTROL_1
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK__SHIFT                                                   0x0
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE__SHIFT                                                   0x1
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE__SHIFT                                               0x8
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT__SHIFT                                                  0x14
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY__SHIFT                                                  0x18
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK_MASK                                                     0x00000001L
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE_MASK                                                     0x00000002L
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE_MASK                                                 0x00000100L
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT_MASK                                                    0x00F00000L
+#define DIG1_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY_MASK                                                    0xFF000000L
+//DIG1_TMDS_CNTL
+#define DIG1_TMDS_CNTL__TMDS_SYNC_PHASE__SHIFT                                                                0x0
+#define DIG1_TMDS_CNTL__TMDS_SYNC_PHASE_MASK                                                                  0x00000001L
+//DIG1_TMDS_CONTROL_CHAR
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN__SHIFT                                              0x0
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN__SHIFT                                              0x1
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN__SHIFT                                              0x2
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN__SHIFT                                              0x3
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN_MASK                                                0x00000001L
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN_MASK                                                0x00000002L
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN_MASK                                                0x00000004L
+#define DIG1_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN_MASK                                                0x00000008L
+//DIG1_TMDS_CONTROL0_FEEDBACK
+#define DIG1_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT__SHIFT                                     0x0
+#define DIG1_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY__SHIFT                                      0x8
+#define DIG1_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT_MASK                                       0x00000003L
+#define DIG1_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY_MASK                                        0x00000300L
+//DIG1_TMDS_STEREOSYNC_CTL_SEL
+#define DIG1_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL__SHIFT                                          0x0
+#define DIG1_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL_MASK                                            0x00000003L
+//DIG1_TMDS_SYNC_CHAR_PATTERN_0_1
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0__SHIFT                                       0x0
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1__SHIFT                                       0x10
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0_MASK                                         0x000003FFL
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1_MASK                                         0x03FF0000L
+//DIG1_TMDS_SYNC_CHAR_PATTERN_2_3
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2__SHIFT                                       0x0
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3__SHIFT                                       0x10
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2_MASK                                         0x000003FFL
+#define DIG1_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3_MASK                                         0x03FF0000L
+//DIG1_TMDS_CTL_BITS
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL0__SHIFT                                                                  0x0
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL1__SHIFT                                                                  0x8
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL2__SHIFT                                                                  0x10
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL3__SHIFT                                                                  0x18
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL0_MASK                                                                    0x00000001L
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL1_MASK                                                                    0x00000100L
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL2_MASK                                                                    0x00010000L
+#define DIG1_TMDS_CTL_BITS__TMDS_CTL3_MASK                                                                    0x01000000L
+//DIG1_TMDS_DCBALANCER_CONTROL
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN__SHIFT                                               0x0
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN__SHIFT                                               0x4
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN__SHIFT                                          0x8
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN__SHIFT                                          0x10
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE__SHIFT                                            0x18
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN_MASK                                                 0x00000001L
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN_MASK                                                 0x00000070L
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN_MASK                                            0x00000100L
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN_MASK                                            0x000F0000L
+#define DIG1_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE_MASK                                              0x01000000L
+//DIG1_TMDS_CTL0_1_GEN_CNTL
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL__SHIFT                                                  0x0
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY__SHIFT                                                0x4
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT__SHIFT                                               0x7
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION__SHIFT                                           0x8
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL__SHIFT                                                  0x10
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY__SHIFT                                                0x14
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT__SHIFT                                               0x17
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION__SHIFT                                           0x18
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN__SHIFT                                                0x1f
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN_MASK                                              0x10000000L
+#define DIG1_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN_MASK                                                  0x80000000L
+//DIG1_TMDS_CTL2_3_GEN_CNTL
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL__SHIFT                                                  0x0
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY__SHIFT                                                0x4
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT__SHIFT                                               0x7
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION__SHIFT                                           0x8
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL__SHIFT                                                  0x10
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY__SHIFT                                                0x14
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT__SHIFT                                               0x17
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION__SHIFT                                           0x18
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG1_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN_MASK                                              0x10000000L
+//DIG1_DIG_VERSION
+
+
+// addressBlock: dce_dc_dio_dp2_dispdec
+//DP2_DP_LINK_CNTL
+#define DP2_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE__SHIFT                                                    0x4
+#define DP2_DP_LINK_CNTL__DP_LINK_STATUS__SHIFT                                                               0x8
+#define DP2_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE_MASK                                                      0x00000010L
+#define DP2_DP_LINK_CNTL__DP_LINK_STATUS_MASK                                                                 0x00000100L
+//DP2_DP_PIXEL_FORMAT
+#define DP2_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                                                       0x0
+#define DP2_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT__SHIFT                                                 0x4
+#define DP2_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                                              0x8
+#define DP2_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT__SHIFT                                                   0x10
+#define DP2_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                                         0x00000001L
+#define DP2_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT_MASK                                                   0x00000030L
+#define DP2_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                                                0x00000700L
+#define DP2_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT_MASK                                                     0x00010000L
+//DP2_DP_MSA_COLORIMETRY
+#define DP2_DP_MSA_COLORIMETRY__DP_MSA_MISC0__SHIFT                                                           0x18
+#define DP2_DP_MSA_COLORIMETRY__DP_MSA_MISC0_MASK                                                             0xFF000000L
+//DP2_DP_CONFIG
+#define DP2_DP_CONFIG__DP_UDI_LANES__SHIFT                                                                    0x0
+#define DP2_DP_CONFIG__DP_UDI_LANES_MASK                                                                      0x00000003L
+//DP2_DP_VID_STREAM_CNTL
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE__SHIFT                                                   0x0
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER__SHIFT                                                0x8
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS__SHIFT                                                   0x10
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT__SHIFT                                           0x14
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE_MASK                                                     0x00000001L
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER_MASK                                                  0x00000300L
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS_MASK                                                     0x00010000L
+#define DP2_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT_MASK                                             0x00100000L
+//DP2_DP_STEER_FIFO
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE__SHIFT                                                        0x0
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_RESET__SHIFT                                                         0x1
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE__SHIFT                                                    0x2
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG__SHIFT                                                      0x4
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT__SHIFT                                                       0x5
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK__SHIFT                                                       0x6
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK__SHIFT                                                      0x7
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE_MASK                                                          0x00000001L
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_RESET_MASK                                                           0x00000002L
+#define DP2_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE_MASK                                                      0x00000004L
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG_MASK                                                        0x00000010L
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT_MASK                                                         0x00000020L
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK_MASK                                                         0x00000040L
+#define DP2_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK_MASK                                                        0x00000080L
+//DP2_DP_MSA_MISC
+#define DP2_DP_MSA_MISC__DP_MSA_MISC1__SHIFT                                                                  0x0
+#define DP2_DP_MSA_MISC__DP_MSA_MISC2__SHIFT                                                                  0x8
+#define DP2_DP_MSA_MISC__DP_MSA_MISC3__SHIFT                                                                  0x10
+#define DP2_DP_MSA_MISC__DP_MSA_MISC4__SHIFT                                                                  0x18
+#define DP2_DP_MSA_MISC__DP_MSA_MISC1_MASK                                                                    0x000000FFL
+#define DP2_DP_MSA_MISC__DP_MSA_MISC2_MASK                                                                    0x0000FF00L
+#define DP2_DP_MSA_MISC__DP_MSA_MISC3_MASK                                                                    0x00FF0000L
+#define DP2_DP_MSA_MISC__DP_MSA_MISC4_MASK                                                                    0xFF000000L
+//DP2_DP_DPHY_INTERNAL_CTRL
+#define DP2_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN__SHIFT                                         0x0
+#define DP2_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL__SHIFT                                        0x4
+#define DP2_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN_MASK                                           0x00000001L
+#define DP2_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL_MASK                                          0x00000010L
+//DP2_DP_VID_TIMING
+#define DP2_DP_VID_TIMING__DP_VID_M_N_GEN_EN__SHIFT                                                           0x8
+#define DP2_DP_VID_TIMING__DP_VID_M_DIV__SHIFT                                                                0xc
+#define DP2_DP_VID_TIMING__DP_VID_N_INTERVAL__SHIFT                                                           0xe
+#define DP2_DP_VID_TIMING__DP_VID_M_N_GEN_EN_MASK                                                             0x00000100L
+#define DP2_DP_VID_TIMING__DP_VID_M_DIV_MASK                                                                  0x00003000L
+#define DP2_DP_VID_TIMING__DP_VID_N_INTERVAL_MASK                                                             0x0000C000L
+//DP2_DP_VID_N
+#define DP2_DP_VID_N__DP_VID_N__SHIFT                                                                         0x0
+#define DP2_DP_VID_N__DP_VID_N_MASK                                                                           0x00FFFFFFL
+//DP2_DP_VID_M
+#define DP2_DP_VID_M__DP_VID_M__SHIFT                                                                         0x0
+#define DP2_DP_VID_M__DP_VID_M_MASK                                                                           0x00FFFFFFL
+//DP2_DP_LINK_FRAMING_CNTL
+#define DP2_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL__SHIFT                                                  0x0
+#define DP2_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE__SHIFT                                  0x14
+#define DP2_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE__SHIFT                                                      0x18
+#define DP2_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE__SHIFT                                           0x1c
+#define DP2_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL_MASK                                                    0x0003FFFFL
+#define DP2_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE_MASK                                    0x00100000L
+#define DP2_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE_MASK                                                        0x01000000L
+#define DP2_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE_MASK                                             0x10000000L
+//DP2_DP_HBR2_EYE_PATTERN
+#define DP2_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE__SHIFT                                            0x0
+#define DP2_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE_MASK                                              0x00000001L
+//DP2_DP_VID_MSA_VBID
+#define DP2_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION__SHIFT                                                       0x0
+#define DP2_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE__SHIFT                                            0xc
+#define DP2_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL__SHIFT                                                     0x18
+#define DP2_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION_MASK                                                         0x00000FFFL
+#define DP2_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE_MASK                                              0x00001000L
+#define DP2_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL_MASK                                                       0x01000000L
+//DP2_DP_VID_INTERRUPT_CNTL
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT__SHIFT                                           0x0
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK__SHIFT                                           0x1
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK__SHIFT                                          0x2
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT_MASK                                             0x00000001L
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK_MASK                                             0x00000002L
+#define DP2_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK_MASK                                            0x00000004L
+//DP2_DP_DPHY_CNTL
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0__SHIFT                                                         0x0
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1__SHIFT                                                         0x1
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2__SHIFT                                                         0x2
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3__SHIFT                                                         0x3
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_EN__SHIFT                                                                  0x4
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW__SHIFT                                                        0x5
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS__SHIFT                                                       0x6
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM__SHIFT                                               0x7
+#define DP2_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL__SHIFT                                                           0x8
+#define DP2_DP_DPHY_CNTL__DPHY_BYPASS__SHIFT                                                                  0x10
+#define DP2_DP_DPHY_CNTL__DPHY_SKEW_BYPASS__SHIFT                                                             0x18
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0_MASK                                                           0x00000001L
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1_MASK                                                           0x00000002L
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2_MASK                                                           0x00000004L
+#define DP2_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3_MASK                                                           0x00000008L
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_EN_MASK                                                                    0x00000010L
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW_MASK                                                          0x00000020L
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS_MASK                                                         0x00000040L
+#define DP2_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM_MASK                                                 0x00000080L
+#define DP2_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL_MASK                                                             0x00000100L
+#define DP2_DP_DPHY_CNTL__DPHY_BYPASS_MASK                                                                    0x00010000L
+#define DP2_DP_DPHY_CNTL__DPHY_SKEW_BYPASS_MASK                                                               0x01000000L
+//DP2_DP_DPHY_TRAINING_PATTERN_SEL
+#define DP2_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL__SHIFT                                    0x0
+#define DP2_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL_MASK                                      0x00000003L
+//DP2_DP_DPHY_SYM0
+#define DP2_DP_DPHY_SYM0__DPHY_SYM1__SHIFT                                                                    0x0
+#define DP2_DP_DPHY_SYM0__DPHY_SYM2__SHIFT                                                                    0xa
+#define DP2_DP_DPHY_SYM0__DPHY_SYM3__SHIFT                                                                    0x14
+#define DP2_DP_DPHY_SYM0__DPHY_SYM1_MASK                                                                      0x000003FFL
+#define DP2_DP_DPHY_SYM0__DPHY_SYM2_MASK                                                                      0x000FFC00L
+#define DP2_DP_DPHY_SYM0__DPHY_SYM3_MASK                                                                      0x3FF00000L
+//DP2_DP_DPHY_SYM1
+#define DP2_DP_DPHY_SYM1__DPHY_SYM4__SHIFT                                                                    0x0
+#define DP2_DP_DPHY_SYM1__DPHY_SYM5__SHIFT                                                                    0xa
+#define DP2_DP_DPHY_SYM1__DPHY_SYM6__SHIFT                                                                    0x14
+#define DP2_DP_DPHY_SYM1__DPHY_SYM4_MASK                                                                      0x000003FFL
+#define DP2_DP_DPHY_SYM1__DPHY_SYM5_MASK                                                                      0x000FFC00L
+#define DP2_DP_DPHY_SYM1__DPHY_SYM6_MASK                                                                      0x3FF00000L
+//DP2_DP_DPHY_SYM2
+#define DP2_DP_DPHY_SYM2__DPHY_SYM7__SHIFT                                                                    0x0
+#define DP2_DP_DPHY_SYM2__DPHY_SYM8__SHIFT                                                                    0xa
+#define DP2_DP_DPHY_SYM2__DPHY_SYM7_MASK                                                                      0x000003FFL
+#define DP2_DP_DPHY_SYM2__DPHY_SYM8_MASK                                                                      0x000FFC00L
+//DP2_DP_DPHY_8B10B_CNTL
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET__SHIFT                                                       0x8
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP__SHIFT                                                    0x10
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP__SHIFT                                                    0x18
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET_MASK                                                         0x00000100L
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP_MASK                                                      0x00010000L
+#define DP2_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP_MASK                                                      0x01000000L
+//DP2_DP_DPHY_PRBS_CNTL
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN__SHIFT                                                            0x0
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL__SHIFT                                                           0x4
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED__SHIFT                                                          0x8
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN_MASK                                                              0x00000001L
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL_MASK                                                             0x00000030L
+#define DP2_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED_MASK                                                            0x7FFFFF00L
+//DP2_DP_DPHY_SCRAM_CNTL
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS__SHIFT                                                     0x0
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE__SHIFT                                                 0x4
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT__SHIFT                                                0x8
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE__SHIFT                                                   0x18
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS_MASK                                                       0x00000001L
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE_MASK                                                   0x00000010L
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT_MASK                                                  0x0003FF00L
+#define DP2_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE_MASK                                                     0x01000000L
+//DP2_DP_TU_CNTL
+#define DP2_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG__SHIFT                                                            0x8
+#define DP2_DP_TU_CNTL__DP_TU_OVERFLOW_ACK__SHIFT                                                             0xc
+#define DP2_DP_TU_CNTL__DP_TU_SIZE__SHIFT                                                                     0x18
+#define DP2_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG_MASK                                                              0x00000100L
+#define DP2_DP_TU_CNTL__DP_TU_OVERFLOW_ACK_MASK                                                               0x00001000L
+#define DP2_DP_TU_CNTL__DP_TU_SIZE_MASK                                                                       0x3F000000L
+//DP2_DP_PIXEL_FORMAT_DB_CNTL
+#define DP2_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE__SHIFT                                            0x0
+#define DP2_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING__SHIFT                                           0x4
+#define DP2_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE_MASK                                              0x00000001L
+#define DP2_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING_MASK                                             0x00000010L
+//DP2_DP_CP_LINK_VERIFICATION_PATTERN
+#define DP2_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN__SHIFT                           0x0
+#define DP2_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN_MASK                             0x0000FFFFL
+//DP2_DP_SEC_CNTL
+#define DP2_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE__SHIFT                                                          0x0
+#define DP2_DP_SEC_CNTL__DP_SEC_ASP_ENABLE__SHIFT                                                             0x4
+#define DP2_DP_SEC_CNTL__DP_SEC_ATP_ENABLE__SHIFT                                                             0x8
+#define DP2_DP_SEC_CNTL__DP_SEC_AIP_ENABLE__SHIFT                                                             0xc
+#define DP2_DP_SEC_CNTL__DP_SEC_ACM_ENABLE__SHIFT                                                             0x10
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE__SHIFT                                                            0x14
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE__SHIFT                                                            0x15
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE__SHIFT                                                            0x16
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE__SHIFT                                                            0x17
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE__SHIFT                                                            0x18
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE__SHIFT                                                            0x19
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE__SHIFT                                                            0x1a
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE__SHIFT                                                            0x1b
+#define DP2_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE_MASK                                                            0x00000001L
+#define DP2_DP_SEC_CNTL__DP_SEC_ASP_ENABLE_MASK                                                               0x00000010L
+#define DP2_DP_SEC_CNTL__DP_SEC_ATP_ENABLE_MASK                                                               0x00000100L
+#define DP2_DP_SEC_CNTL__DP_SEC_AIP_ENABLE_MASK                                                               0x00001000L
+#define DP2_DP_SEC_CNTL__DP_SEC_ACM_ENABLE_MASK                                                               0x00010000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE_MASK                                                              0x00100000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE_MASK                                                              0x00200000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE_MASK                                                              0x00400000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE_MASK                                                              0x00800000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE_MASK                                                              0x01000000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE_MASK                                                              0x02000000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE_MASK                                                              0x04000000L
+#define DP2_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE_MASK                                                              0x08000000L
+//DP2_DP_SEC_CNTL1
+#define DP2_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE__SHIFT                                                           0x0
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE__SHIFT                                                   0x1
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY__SHIFT                                                         0x4
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND__SHIFT                                                             0x5
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING__SHIFT                                                     0x6
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED__SHIFT                                             0x7
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE__SHIFT                                                   0x9
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE__SHIFT                                                   0xa
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE__SHIFT                                                   0xb
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE__SHIFT                                                   0xc
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE__SHIFT                                                   0xd
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE__SHIFT                                                   0xe
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE__SHIFT                                                   0xf
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE_MASK                                                             0x00000001L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE_MASK                                                     0x00000002L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY_MASK                                                           0x00000010L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_MASK                                                               0x00000020L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING_MASK                                                       0x00000040L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED_MASK                                               0x00000080L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE_MASK                                                     0x00000200L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE_MASK                                                     0x00000400L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE_MASK                                                     0x00000800L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE_MASK                                                     0x00001000L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE_MASK                                                     0x00002000L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE_MASK                                                     0x00004000L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE_MASK                                                     0x00008000L
+#define DP2_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_SEC_FRAMING1
+#define DP2_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION__SHIFT                                               0x0
+#define DP2_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP2_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION_MASK                                                 0x00000FFFL
+#define DP2_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP2_DP_SEC_FRAMING2
+#define DP2_DP_SEC_FRAMING2__DP_SEC_START_POSITION__SHIFT                                                     0x0
+#define DP2_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP2_DP_SEC_FRAMING2__DP_SEC_START_POSITION_MASK                                                       0x0000FFFFL
+#define DP2_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP2_DP_SEC_FRAMING3
+#define DP2_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE__SHIFT                                                    0x0
+#define DP2_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH__SHIFT                                                0x10
+#define DP2_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE_MASK                                                      0x00003FFFL
+#define DP2_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH_MASK                                                  0xFFFF0000L
+//DP2_DP_SEC_FRAMING4
+#define DP2_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING__SHIFT                                                      0x0
+#define DP2_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS__SHIFT                                                   0x14
+#define DP2_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK__SHIFT                                                      0x18
+#define DP2_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE__SHIFT                                                         0x1c
+#define DP2_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS__SHIFT                                                  0x1d
+#define DP2_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING_MASK                                                        0x00000001L
+#define DP2_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS_MASK                                                     0x00100000L
+#define DP2_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK_MASK                                                        0x01000000L
+#define DP2_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_MASK                                                           0x10000000L
+#define DP2_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS_MASK                                                    0x20000000L
+//DP2_DP_SEC_AUD_N
+#define DP2_DP_SEC_AUD_N__DP_SEC_AUD_N__SHIFT                                                                 0x0
+#define DP2_DP_SEC_AUD_N__DP_SEC_AUD_N_MASK                                                                   0x00FFFFFFL
+//DP2_DP_SEC_AUD_N_READBACK
+#define DP2_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK__SHIFT                                               0x0
+#define DP2_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK_MASK                                                 0x00FFFFFFL
+//DP2_DP_SEC_AUD_M
+#define DP2_DP_SEC_AUD_M__DP_SEC_AUD_M__SHIFT                                                                 0x0
+#define DP2_DP_SEC_AUD_M__DP_SEC_AUD_M_MASK                                                                   0x00FFFFFFL
+//DP2_DP_SEC_AUD_M_READBACK
+#define DP2_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK__SHIFT                                               0x0
+#define DP2_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK_MASK                                                 0x00FFFFFFL
+//DP2_DP_SEC_TIMESTAMP
+#define DP2_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE__SHIFT                                                    0x0
+#define DP2_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE_MASK                                                      0x00000001L
+//DP2_DP_SEC_PACKET_CNTL
+#define DP2_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY__SHIFT                                                    0x4
+#define DP2_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER__SHIFT                                              0x18
+#define DP2_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY_MASK                                                      0x00000010L
+#define DP2_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER_MASK                                                0x3F000000L
+//DP2_DP_MSE_RATE_CNTL
+#define DP2_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y__SHIFT                                                            0x0
+#define DP2_DP_MSE_RATE_CNTL__DP_MSE_RATE_X__SHIFT                                                            0x1a
+#define DP2_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y_MASK                                                              0x03FFFFFFL
+#define DP2_DP_MSE_RATE_CNTL__DP_MSE_RATE_X_MASK                                                              0xFC000000L
+//DP2_DP_CP_MSE_STATUS
+#define DP2_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT__SHIFT                                                    0x0
+#define DP2_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE__SHIFT                                              0x4
+#define DP2_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT_MASK                                                      0x00000001L
+#define DP2_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE_MASK                                                0x00000010L
+//DP2_DP_MSE_RATE_UPDATE
+#define DP2_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING__SHIFT                                             0x0
+#define DP2_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING_MASK                                               0x00000001L
+//DP2_DP_MSE_SAT0
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SRC0__SHIFT                                                               0x0
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0__SHIFT                                                           0x4
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0__SHIFT                                                   0x5
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0__SHIFT                                                        0x8
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SRC1__SHIFT                                                               0x10
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1__SHIFT                                                           0x14
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1__SHIFT                                                   0x15
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1__SHIFT                                                        0x18
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SRC0_MASK                                                                 0x00000007L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0_MASK                                                             0x00000010L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0_MASK                                                     0x00000020L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0_MASK                                                          0x00003F00L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SRC1_MASK                                                                 0x00070000L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1_MASK                                                             0x00100000L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1_MASK                                                     0x00200000L
+#define DP2_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1_MASK                                                          0x3F000000L
+//DP2_DP_MSE_SAT1
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SRC2__SHIFT                                                               0x0
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2__SHIFT                                                           0x4
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2__SHIFT                                                   0x5
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2__SHIFT                                                        0x8
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SRC3__SHIFT                                                               0x10
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3__SHIFT                                                           0x14
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3__SHIFT                                                   0x15
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3__SHIFT                                                        0x18
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SRC2_MASK                                                                 0x00000007L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2_MASK                                                             0x00000010L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2_MASK                                                     0x00000020L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2_MASK                                                          0x00003F00L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SRC3_MASK                                                                 0x00070000L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3_MASK                                                             0x00100000L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3_MASK                                                     0x00200000L
+#define DP2_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3_MASK                                                          0x3F000000L
+//DP2_DP_MSE_SAT2
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SRC4__SHIFT                                                               0x0
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4__SHIFT                                                           0x4
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4__SHIFT                                                   0x5
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4__SHIFT                                                        0x8
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SRC5__SHIFT                                                               0x10
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5__SHIFT                                                           0x14
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5__SHIFT                                                   0x15
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5__SHIFT                                                        0x18
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SRC4_MASK                                                                 0x00000007L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4_MASK                                                             0x00000010L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4_MASK                                                     0x00000020L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4_MASK                                                          0x00003F00L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SRC5_MASK                                                                 0x00070000L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5_MASK                                                             0x00100000L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5_MASK                                                     0x00200000L
+#define DP2_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5_MASK                                                          0x3F000000L
+//DP2_DP_MSE_SAT_UPDATE
+#define DP2_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE__SHIFT                                                       0x0
+#define DP2_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT__SHIFT                                                   0x8
+#define DP2_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE_MASK                                                         0x00000003L
+#define DP2_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT_MASK                                                     0x00000100L
+//DP2_DP_MSE_LINK_TIMING
+#define DP2_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME__SHIFT                                                      0x0
+#define DP2_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE__SHIFT                                                       0x10
+#define DP2_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME_MASK                                                        0x000003FFL
+#define DP2_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE_MASK                                                         0x00030000L
+//DP2_DP_MSE_MISC_CNTL
+#define DP2_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE__SHIFT                                                        0x0
+#define DP2_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER__SHIFT                                                      0x8
+#define DP2_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE_MASK                                                          0x00000001L
+#define DP2_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER_MASK                                                        0x00000100L
+//DP2_DP_TEST_DEBUG_DATA
+#define DP2_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define DP2_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//DP2_DP_DPHY_BS_SR_SWAP_CNTL
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT__SHIFT                                                0x0
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE__SHIFT                                              0xf
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START__SHIFT                                          0x10
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_MASK                                                  0x000003FFL
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE_MASK                                                0x00008000L
+#define DP2_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START_MASK                                            0x00010000L
+//DP2_DP_DPHY_HBR2_PATTERN_CONTROL
+#define DP2_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL__SHIFT                                 0x0
+#define DP2_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL_MASK                                   0x00000007L
+//DP2_DP_MSE_SAT0_STATUS
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS__SHIFT                                                 0x0
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS__SHIFT                                             0x4
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS__SHIFT                                     0x5
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS__SHIFT                                          0x8
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS__SHIFT                                                 0x10
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS__SHIFT                                             0x14
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS__SHIFT                                     0x15
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS__SHIFT                                          0x18
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS_MASK                                                   0x00000007L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS_MASK                                               0x00000010L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS_MASK                                       0x00000020L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS_MASK                                            0x00003F00L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS_MASK                                                   0x00070000L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS_MASK                                               0x00100000L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS_MASK                                       0x00200000L
+#define DP2_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS_MASK                                            0x3F000000L
+//DP2_DP_MSE_SAT1_STATUS
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS__SHIFT                                                 0x0
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS__SHIFT                                             0x4
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS__SHIFT                                     0x5
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS__SHIFT                                          0x8
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS__SHIFT                                                 0x10
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS__SHIFT                                             0x14
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS__SHIFT                                     0x15
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS__SHIFT                                          0x18
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS_MASK                                                   0x00000007L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS_MASK                                               0x00000010L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS_MASK                                       0x00000020L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS_MASK                                            0x00003F00L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS_MASK                                                   0x00070000L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS_MASK                                               0x00100000L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS_MASK                                       0x00200000L
+#define DP2_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS_MASK                                            0x3F000000L
+//DP2_DP_MSE_SAT2_STATUS
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS__SHIFT                                                 0x0
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS__SHIFT                                             0x4
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS__SHIFT                                     0x5
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS__SHIFT                                          0x8
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS__SHIFT                                                 0x10
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS__SHIFT                                             0x14
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS__SHIFT                                     0x15
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS__SHIFT                                          0x18
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS_MASK                                                   0x00000007L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS_MASK                                               0x00000010L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS_MASK                                       0x00000020L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS_MASK                                            0x00003F00L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS_MASK                                                   0x00070000L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS_MASK                                               0x00100000L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS_MASK                                       0x00200000L
+#define DP2_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS_MASK                                            0x3F000000L
+//DP2_DP_HBLANK_CONTROL
+#define DP2_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                                          0x0
+#define DP2_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                                            0x0000FFFFL
+//DP2_DP_MSA_TIMING_PARAM1
+#define DP2_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL__SHIFT                                                        0x0
+#define DP2_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL__SHIFT                                                        0x10
+#define DP2_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL_MASK                                                          0x0000FFFFL
+#define DP2_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL_MASK                                                          0xFFFF0000L
+//DP2_DP_MSA_TIMING_PARAM2
+#define DP2_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART__SHIFT                                                        0x0
+#define DP2_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART__SHIFT                                                        0x10
+#define DP2_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART_MASK                                                          0x0000FFFFL
+#define DP2_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART_MASK                                                          0xFFFF0000L
+//DP2_DP_MSA_TIMING_PARAM3
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH__SHIFT                                                    0x0
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY__SHIFT                                                 0xf
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH__SHIFT                                                    0x10
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY__SHIFT                                                 0x1f
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH_MASK                                                      0x00007FFFL
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY_MASK                                                   0x00008000L
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH_MASK                                                      0x7FFF0000L
+#define DP2_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY_MASK                                                   0x80000000L
+//DP2_DP_MSA_TIMING_PARAM4
+#define DP2_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT__SHIFT                                                       0x0
+#define DP2_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH__SHIFT                                                        0x10
+#define DP2_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT_MASK                                                         0x0000FFFFL
+#define DP2_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH_MASK                                                          0xFFFF0000L
+//DP2_DP_MSO_CNTL
+#define DP2_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK__SHIFT                                                         0x0
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE__SHIFT                                                      0x4
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE__SHIFT                                                         0x8
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE__SHIFT                                                         0xc
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE__SHIFT                                                         0x10
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE__SHIFT                                                         0x14
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE__SHIFT                                                        0x18
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE__SHIFT                                                        0x1c
+#define DP2_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK_MASK                                                           0x00000003L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE_MASK                                                        0x000000F0L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE_MASK                                                           0x00000F00L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE_MASK                                                           0x0000F000L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE_MASK                                                           0x000F0000L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE_MASK                                                           0x00F00000L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE_MASK                                                          0x0F000000L
+#define DP2_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE_MASK                                                          0xF0000000L
+//DP2_DP_MSO_CNTL1
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE__SHIFT                                                       0x0
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE__SHIFT                                                       0x4
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE__SHIFT                                                       0x8
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE__SHIFT                                                       0xc
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE__SHIFT                                                       0x10
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE__SHIFT                                                       0x14
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE__SHIFT                                                       0x1c
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE_MASK                                                         0x0000000FL
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE_MASK                                                         0x000000F0L
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE_MASK                                                         0x00000F00L
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE_MASK                                                         0x0000F000L
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE_MASK                                                         0x000F0000L
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE_MASK                                                         0x00F00000L
+#define DP2_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE_MASK                                                         0xF0000000L
+//DP2_DP_STEER_FIFO_CNTL
+#define DP2_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN__SHIFT                       0x8
+#define DP2_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                        0x10
+#define DP2_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN_MASK                         0x00000100L
+#define DP2_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE_MASK                                          0x00030000L
+//DP2_DP_SEC_CNTL2
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND__SHIFT                                                             0x0
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING__SHIFT                                                     0x1
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED__SHIFT                                             0x2
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE__SHIFT                                                    0x3
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND__SHIFT                                                             0x4
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING__SHIFT                                                     0x5
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED__SHIFT                                             0x6
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE__SHIFT                                                    0x7
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND__SHIFT                                                             0x8
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING__SHIFT                                                     0x9
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED__SHIFT                                             0xa
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE__SHIFT                                                    0xb
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND__SHIFT                                                             0xc
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING__SHIFT                                                     0xd
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE__SHIFT                                                    0xf
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND__SHIFT                                                             0x10
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING__SHIFT                                                     0x11
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED__SHIFT                                             0x12
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE__SHIFT                                                    0x13
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND__SHIFT                                                             0x14
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING__SHIFT                                                     0x15
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED__SHIFT                                             0x16
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE__SHIFT                                                    0x17
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND__SHIFT                                                             0x18
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING__SHIFT                                                     0x19
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED__SHIFT                                             0x1a
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE__SHIFT                                                    0x1b
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP11_PPS__SHIFT                                                             0x1c
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_MASK                                                               0x00000001L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING_MASK                                                       0x00000002L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED_MASK                                               0x00000004L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE_MASK                                                      0x00000008L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_MASK                                                               0x00000010L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING_MASK                                                       0x00000020L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED_MASK                                               0x00000040L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE_MASK                                                      0x00000080L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_MASK                                                               0x00000100L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING_MASK                                                       0x00000200L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED_MASK                                               0x00000400L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE_MASK                                                      0x00000800L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_MASK                                                               0x00001000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING_MASK                                                       0x00002000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE_MASK                                                      0x00008000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_MASK                                                               0x00010000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING_MASK                                                       0x00020000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED_MASK                                               0x00040000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE_MASK                                                      0x00080000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_MASK                                                               0x00100000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING_MASK                                                       0x00200000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED_MASK                                               0x00400000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE_MASK                                                      0x00800000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_MASK                                                               0x01000000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING_MASK                                                       0x02000000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED_MASK                                               0x04000000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE_MASK                                                      0x08000000L
+#define DP2_DP_SEC_CNTL2__DP_SEC_GSP11_PPS_MASK                                                               0x10000000L
+//DP2_DP_SEC_CNTL3
+#define DP2_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM__SHIFT                                                         0x0
+#define DP2_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP2_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_SEC_CNTL4
+#define DP2_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM__SHIFT                                                         0x0
+#define DP2_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP2_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_SEC_CNTL5
+#define DP2_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM__SHIFT                                                         0x0
+#define DP2_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP2_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_SEC_CNTL6
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM__SHIFT                                                         0x0
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE__SHIFT                                                    0x10
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE__SHIFT                                                    0x11
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE__SHIFT                                                    0x12
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE__SHIFT                                                    0x13
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE__SHIFT                                                    0x14
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE__SHIFT                                                    0x15
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE__SHIFT                                                    0x16
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE__SHIFT                                                    0x17
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE__SHIFT                                                    0x18
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE__SHIFT                                                    0x19
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE__SHIFT                                                   0x1a
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE__SHIFT                                                   0x1b
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE_MASK                                                      0x00010000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE_MASK                                                      0x00020000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE_MASK                                                      0x00040000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE_MASK                                                      0x00080000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE_MASK                                                      0x00100000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE_MASK                                                      0x00200000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE_MASK                                                      0x00400000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE_MASK                                                      0x00800000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE_MASK                                                      0x01000000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE_MASK                                                      0x02000000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE_MASK                                                     0x04000000L
+#define DP2_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE_MASK                                                     0x08000000L
+//DP2_DP_SEC_CNTL7
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE__SHIFT                                                      0x0
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE__SHIFT                                                     0x1
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE__SHIFT                                                      0x4
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE__SHIFT                                                     0x5
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE__SHIFT                                                      0x8
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE__SHIFT                                                     0x9
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE__SHIFT                                                      0xc
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE__SHIFT                                                     0xd
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE__SHIFT                                                      0x10
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE__SHIFT                                                     0x11
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE__SHIFT                                                      0x14
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE__SHIFT                                                     0x15
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE__SHIFT                                                      0x18
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE__SHIFT                                                     0x19
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE__SHIFT                                                      0x1c
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE__SHIFT                                                     0x1d
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE_MASK                                                        0x00000001L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE_MASK                                                       0x00000002L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE_MASK                                                        0x00000010L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE_MASK                                                       0x00000020L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE_MASK                                                        0x00000100L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE_MASK                                                       0x00000200L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE_MASK                                                        0x00001000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE_MASK                                                       0x00002000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE_MASK                                                        0x00010000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE_MASK                                                       0x00020000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE_MASK                                                        0x00100000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE_MASK                                                       0x00200000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE_MASK                                                        0x01000000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE_MASK                                                       0x02000000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE_MASK                                                        0x10000000L
+#define DP2_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE_MASK                                                       0x20000000L
+//DP2_DP_DB_CNTL
+#define DP2_DP_DB_CNTL__DP_DB_PENDING__SHIFT                                                                  0x0
+#define DP2_DP_DB_CNTL__DP_DB_TAKEN__SHIFT                                                                    0x4
+#define DP2_DP_DB_CNTL__DP_DB_TAKEN_CLR__SHIFT                                                                0x5
+#define DP2_DP_DB_CNTL__DP_DB_LOCK__SHIFT                                                                     0x8
+#define DP2_DP_DB_CNTL__DP_DB_DISABLE__SHIFT                                                                  0xc
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_PENDING__SHIFT                                                          0xf
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN__SHIFT                                                            0x10
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR__SHIFT                                                        0x11
+#define DP2_DP_DB_CNTL__DP_DB_PENDING_MASK                                                                    0x00000001L
+#define DP2_DP_DB_CNTL__DP_DB_TAKEN_MASK                                                                      0x00000010L
+#define DP2_DP_DB_CNTL__DP_DB_TAKEN_CLR_MASK                                                                  0x00000020L
+#define DP2_DP_DB_CNTL__DP_DB_LOCK_MASK                                                                       0x00000100L
+#define DP2_DP_DB_CNTL__DP_DB_DISABLE_MASK                                                                    0x00001000L
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_PENDING_MASK                                                            0x00008000L
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_MASK                                                              0x00010000L
+#define DP2_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR_MASK                                                          0x00020000L
+//DP2_DP_MSA_VBID_MISC
+#define DP2_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE__SHIFT                                         0x0
+#define DP2_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                                      0x4
+#define DP2_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE__SHIFT                                                        0x8
+#define DP2_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE__SHIFT                                                        0x9
+#define DP2_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN__SHIFT                                                     0xc
+#define DP2_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN__SHIFT                                                     0xd
+#define DP2_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE__SHIFT                                                  0xf
+#define DP2_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM__SHIFT                                                        0x10
+#define DP2_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_MASK                                           0x00000003L
+#define DP2_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                                        0x00000010L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_MASK                                                          0x00000100L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_MASK                                                          0x00000200L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN_MASK                                                       0x00001000L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN_MASK                                                       0x00002000L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE_MASK                                                    0x00008000L
+#define DP2_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM_MASK                                                          0xFFFF0000L
+//DP2_DP_SEC_METADATA_TRANSMISSION
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE__SHIFT                                0x0
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE__SHIFT                        0x1
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE__SHIFT                            0x4
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE__SHIFT                                  0x10
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE_MASK                                  0x00000001L
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE_MASK                          0x00000002L
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE_MASK                              0x000000F0L
+#define DP2_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_MASK                                    0xFFFF0000L
+//DP2_DP_ALPM_CNTL
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND__SHIFT                                                         0x0
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING__SHIFT                                                      0x1
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND__SHIFT                                                       0x2
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING__SHIFT                                                    0x3
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE__SHIFT                                            0x4
+#define DP2_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO__SHIFT                                        0x5
+#define DP2_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE__SHIFT                                                  0x6
+#define DP2_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP__SHIFT                                     0x7
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM__SHIFT                                                  0x8
+#define DP2_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS__SHIFT                                   0xb
+#define DP2_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN__SHIFT                                       0xc
+#define DP2_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE__SHIFT                                                       0xf
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM__SHIFT                                             0x10
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND_MASK                                                           0x00000001L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING_MASK                                                        0x00000002L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND_MASK                                                         0x00000004L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING_MASK                                                      0x00000008L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE_MASK                                              0x00000010L
+#define DP2_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO_MASK                                          0x00000020L
+#define DP2_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE_MASK                                                    0x00000040L
+#define DP2_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_MASK                                       0x00000080L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM_MASK                                                    0x00000300L
+#define DP2_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS_MASK                                     0x00000800L
+#define DP2_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN_MASK                                         0x00001000L
+#define DP2_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE_MASK                                                         0x00008000L
+#define DP2_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM_MASK                                               0xFFFF0000L
+//DP2_DP_GSP8_CNTL
+#define DP2_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE__SHIFT                                                       0x0
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE__SHIFT                                                           0x4
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND__SHIFT                                                             0x7
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING__SHIFT                                                     0xc
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE_MASK                                                         0x0000000FL
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE_MASK                                                             0x00000010L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_MASK                                                               0x00000080L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING_MASK                                                       0x00001000L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP2_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_GSP9_CNTL
+#define DP2_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE__SHIFT                                                       0x0
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE__SHIFT                                                           0x4
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND__SHIFT                                                             0x7
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING__SHIFT                                                     0xc
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM__SHIFT                                                         0x10
+#define DP2_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE_MASK                                                         0x0000000FL
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE_MASK                                                             0x00000010L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_MASK                                                               0x00000080L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING_MASK                                                       0x00001000L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP2_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP2_DP_GSP10_CNTL
+#define DP2_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE__SHIFT                                                     0x0
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE__SHIFT                                                         0x4
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND__SHIFT                                                           0x7
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING__SHIFT                                                   0xc
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM__SHIFT                                                       0x10
+#define DP2_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE_MASK                                                       0x0000000FL
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE_MASK                                                           0x00000010L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_MASK                                                             0x00000080L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING_MASK                                                     0x00001000L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP2_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP2_DP_GSP11_CNTL
+#define DP2_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE__SHIFT                                                     0x0
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE__SHIFT                                                         0x4
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND__SHIFT                                                           0x7
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING__SHIFT                                                   0xc
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM__SHIFT                                                       0x10
+#define DP2_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE_MASK                                                       0x0000000FL
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE_MASK                                                           0x00000010L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_MASK                                                             0x00000080L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING_MASK                                                     0x00001000L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP2_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP2_DP_GSP_EN_DB_STATUS
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING__SHIFT                                             0x0
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING__SHIFT                                             0x1
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING__SHIFT                                             0x2
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING__SHIFT                                             0x3
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING__SHIFT                                             0x4
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING__SHIFT                                             0x5
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING__SHIFT                                             0x6
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING__SHIFT                                             0x7
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING__SHIFT                                             0x8
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING__SHIFT                                             0x9
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING__SHIFT                                            0xa
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING__SHIFT                                            0xb
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING_MASK                                               0x00000001L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING_MASK                                               0x00000002L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING_MASK                                               0x00000004L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING_MASK                                               0x00000008L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING_MASK                                               0x00000010L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING_MASK                                               0x00000020L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING_MASK                                               0x00000040L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING_MASK                                               0x00000080L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING_MASK                                               0x00000100L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING_MASK                                               0x00000200L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING_MASK                                              0x00000400L
+#define DP2_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING_MASK                                              0x00000800L
+//DP2_DP_AUXLESS_ALPM_CNTL1
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT__SHIFT                                              0x4
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY__SHIFT                                               0x8
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL__SHIFT                                            0x14
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE__SHIFT                                     0x1f
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT_MASK                                                0x000000F0L
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY_MASK                                                 0x0007FF00L
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL_MASK                                              0x1FF00000L
+#define DP2_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE_MASK                                       0x80000000L
+//DP2_DP_AUXLESS_ALPM_CNTL2
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME__SHIFT                                           0x0
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND__SHIFT                                                 0x7
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE__SHIFT                                            0x10
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING__SHIFT                                              0x11
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE__SHIFT                                            0x12
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING__SHIFT                                              0x13
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD__SHIFT                                          0x14
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME_MASK                                             0x0000007FL
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND_MASK                                                   0x00000080L
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE_MASK                                              0x00010000L
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING_MASK                                                0x00020000L
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE_MASK                                              0x00040000L
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING_MASK                                                0x00080000L
+#define DP2_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD_MASK                                            0x3FF00000L
+//DP2_DP_AUXLESS_ALPM_CNTL3
+#define DP2_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM__SHIFT                                             0x0
+#define DP2_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM__SHIFT                                             0x10
+#define DP2_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM_MASK                                               0x0000FFFFL
+#define DP2_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM_MASK                                               0xFFFF0000L
+//DP2_DP_AUXLESS_ALPM_CNTL4
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN__SHIFT                                                  0x1
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL__SHIFT                                   0x2
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME__SHIFT                                     0x3
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE__SHIFT                                       0x4
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS__SHIFT                                           0x5
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE__SHIFT                                               0x6
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM__SHIFT                                                   0x18
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_MASK                                                    0x00000002L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL_MASK                                     0x00000004L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME_MASK                                       0x00000008L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE_MASK                                         0x00000010L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS_MASK                                             0x00000020L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE_MASK                                                 0x00000040L
+#define DP2_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM_MASK                                                     0xFF000000L
+//DP2_DP_AUXLESS_ALPM_CNTL5
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK__SHIFT                                       0x0
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED__SHIFT                                   0x1
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                                     0x2
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR__SHIFT                                      0x3
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM__SHIFT                                  0x8
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM__SHIFT                                   0x10
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK_MASK                                         0x00000001L
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED_MASK                                     0x00000002L
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                                       0x00000004L
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR_MASK                                        0x00000008L
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM_MASK                                    0x0000FF00L
+#define DP2_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM_MASK                                     0xFFFF0000L
+//DP2_DP_STREAM_SYMBOL_COUNT_STATUS
+#define DP2_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT__SHIFT                                          0x0
+#define DP2_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT_MASK                                            0x0000FFFFL
+//DP2_DP_STREAM_SYMBOL_COUNT_CONTROL
+#define DP2_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE__SHIFT                                  0x0
+#define DP2_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET__SHIFT                                   0x4
+#define DP2_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE_MASK                                    0x00000001L
+#define DP2_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET_MASK                                     0x00000010L
+//DP2_DP_LINK_SYMBOL_COUNT_STATUS0
+#define DP2_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT__SHIFT                                             0x0
+#define DP2_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT_MASK                                               0x0000FFFFL
+//DP2_DP_LINK_SYMBOL_COUNT_STATUS1
+#define DP2_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT__SHIFT                                          0x0
+#define DP2_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT_MASK                                            0xFFFFFFFFL
+//DP2_DP_LINK_SYMBOL_COUNT_CONTROL
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE__SHIFT                                      0x0
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET__SHIFT                                       0x4
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE__SHIFT                                   0x8
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET__SHIFT                                    0xc
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE_MASK                                        0x00000001L
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET_MASK                                         0x00000010L
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE_MASK                                     0x00000100L
+#define DP2_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET_MASK                                      0x00001000L
+//DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT           0x0
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING__SHIFT  0x8
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK             0x00000001L
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+#define DP2_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING_MASK  0x00000100L
+//DP2_DP_DPHY_FAST_TRAINING
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE__SHIFT                                       0x0
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START__SHIFT                                         0x1
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN__SHIFT                            0x2
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING__SHIFT                              0x4
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME__SHIFT                                         0x8
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME__SHIFT                                         0x14
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE_MASK                                         0x00000001L
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START_MASK                                           0x00000002L
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN_MASK                              0x00000004L
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING_MASK                                0x00000010L
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME_MASK                                           0x000FFF00L
+#define DP2_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME_MASK                                           0xFFF00000L
+//DP2_DP_DPHY_FAST_TRAINING_STATUS
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE__SHIFT                                     0x0
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED__SHIFT                         0x4
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK__SHIFT                             0x8
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK__SHIFT                              0xc
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE_MASK                                       0x00000007L
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED_MASK                           0x00000010L
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK_MASK                               0x00000100L
+#define DP2_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK_MASK                                0x00001000L
+
+
+// addressBlock: dce_dc_dio_dig2_dispdec
+//DIG2_DIG_FE_CNTL
+#define DIG2_DIG_FE_CNTL__DIG_SOURCE_SELECT__SHIFT                                                            0x0
+#define DIG2_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT__SHIFT                                                        0x4
+#define DIG2_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN__SHIFT                                                       0x8
+#define DIG2_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT__SHIFT                                                    0xc
+#define DIG2_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN__SHIFT                                                        0x14
+#define DIG2_DIG_FE_CNTL__DIG_SOURCE_SELECT_MASK                                                              0x00000007L
+#define DIG2_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT_MASK                                                          0x00000070L
+#define DIG2_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN_MASK                                                         0x00000100L
+#define DIG2_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT_MASK                                                      0x00007000L
+#define DIG2_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN_MASK                                                          0x00100000L
+//DIG2_DIG_FE_CLK_CNTL
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_MODE__SHIFT                                                              0x0
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN__SHIFT                                                            0x4
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON__SHIFT                                                0xa
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON__SHIFT                                              0xb
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON__SHIFT                                          0xc
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON__SHIFT                                         0xd
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON__SHIFT                                             0xe
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_MODE_MASK                                                                0x00000007L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN_MASK                                                              0x00000010L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON_MASK                                                  0x00000400L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON_MASK                                                0x00000800L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON_MASK                                            0x00001000L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON_MASK                                           0x00002000L
+#define DIG2_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON_MASK                                               0x00004000L
+//DIG2_DIG_FE_EN_CNTL
+#define DIG2_DIG_FE_EN_CNTL__DIG_FE_ENABLE__SHIFT                                                             0x0
+#define DIG2_DIG_FE_EN_CNTL__DIG_FE_ENABLE_MASK                                                               0x00000001L
+//DIG2_DIG_OUTPUT_CRC_CNTL
+#define DIG2_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN__SHIFT                                                    0x0
+#define DIG2_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL__SHIFT                                              0x8
+#define DIG2_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN_MASK                                                      0x00000001L
+#define DIG2_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL_MASK                                                0x00000300L
+//DIG2_DIG_OUTPUT_CRC_RESULT
+#define DIG2_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT__SHIFT                                              0x0
+#define DIG2_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT_MASK                                                0x3FFFFFFFL
+//DIG2_DIG_CLOCK_PATTERN
+#define DIG2_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN__SHIFT                                                      0x0
+#define DIG2_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN_MASK                                                        0x000003FFL
+//DIG2_DIG_TEST_PATTERN
+#define DIG2_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN__SHIFT                                                 0x0
+#define DIG2_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL__SHIFT                                              0x1
+#define DIG2_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN__SHIFT                                               0x4
+#define DIG2_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET__SHIFT                                                0x5
+#define DIG2_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN__SHIFT                                      0x6
+#define DIG2_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN__SHIFT                                                 0x10
+#define DIG2_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN_MASK                                                   0x00000001L
+#define DIG2_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL_MASK                                                0x00000002L
+#define DIG2_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN_MASK                                                 0x00000010L
+#define DIG2_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET_MASK                                                  0x00000020L
+#define DIG2_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN_MASK                                        0x00000040L
+#define DIG2_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN_MASK                                                   0x03FF0000L
+//DIG2_DIG_RANDOM_PATTERN_SEED
+#define DIG2_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED__SHIFT                                          0x0
+#define DIG2_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY__SHIFT                                       0x18
+#define DIG2_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED_MASK                                            0x00FFFFFFL
+#define DIG2_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY_MASK                                         0x01000000L
+//DIG2_DIG_FIFO_CTRL0
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE__SHIFT                                                           0x0
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_RESET__SHIFT                                                            0x1
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL__SHIFT                                                 0x2
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC__SHIFT                                                   0x8
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                           0x9
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE__SHIFT                                                       0x14
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_ERROR__SHIFT                                                            0x1c
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE_MASK                                                             0x00000001L
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_RESET_MASK                                                              0x00000002L
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL_MASK                                                   0x000000FCL
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC_MASK                                                     0x00000100L
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE_MASK                                             0x00000600L
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE_MASK                                                         0x00100000L
+#define DIG2_DIG_FIFO_CTRL0__DIG_FIFO_ERROR_MASK                                                              0x30000000L
+//DIG2_DIG_FIFO_CTRL1
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL__SHIFT                                              0x1
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL__SHIFT                                                  0x2
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY__SHIFT                                                  0x8
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL__SHIFT                                                0xa
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL__SHIFT                                                    0x10
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL__SHIFT                                                    0x16
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED__SHIFT                                                       0x1d
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE__SHIFT                                              0x1e
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX__SHIFT                                              0x1f
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL_MASK                                                0x00000002L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL_MASK                                                    0x000000FCL
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY_MASK                                                    0x00000300L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL_MASK                                                  0x0000FC00L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL_MASK                                                      0x001F0000L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL_MASK                                                      0x03C00000L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED_MASK                                                         0x20000000L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE_MASK                                                0x40000000L
+#define DIG2_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX_MASK                                                0x80000000L
+//DIG2_HDMI_METADATA_PACKET_CONTROL
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE__SHIFT                                 0x0
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE__SHIFT                         0x4
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED__SHIFT                                 0x8
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE__SHIFT                                   0x10
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE_MASK                                   0x00000001L
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE_MASK                           0x00000010L
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED_MASK                                   0x00000100L
+#define DIG2_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_MASK                                     0xFFFF0000L
+//DIG2_HDMI_CONTROL
+#define DIG2_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN__SHIFT                                                       0x1
+#define DIG2_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE__SHIFT                                                     0x2
+#define DIG2_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED__SHIFT                                            0x3
+#define DIG2_HDMI_CONTROL__HDMI_ERROR_ACK__SHIFT                                                              0x8
+#define DIG2_HDMI_CONTROL__HDMI_ERROR_MASK__SHIFT                                                             0x9
+#define DIG2_HDMI_CONTROL__DOLBY_VISION_EN__SHIFT                                                             0xa
+#define DIG2_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED__SHIFT                                         0xb
+#define DIG2_HDMI_CONTROL__TMDS_PIXEL_ENCODING__SHIFT                                                         0xc
+#define DIG2_HDMI_CONTROL__TMDS_COLOR_FORMAT__SHIFT                                                           0xd
+#define DIG2_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM__SHIFT                                           0x10
+#define DIG2_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE__SHIFT                                                      0x18
+#define DIG2_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH__SHIFT                                                       0x1c
+#define DIG2_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN_MASK                                                         0x00000002L
+#define DIG2_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE_MASK                                                       0x00000004L
+#define DIG2_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED_MASK                                              0x00000008L
+#define DIG2_HDMI_CONTROL__HDMI_ERROR_ACK_MASK                                                                0x00000100L
+#define DIG2_HDMI_CONTROL__HDMI_ERROR_MASK_MASK                                                               0x00000200L
+#define DIG2_HDMI_CONTROL__DOLBY_VISION_EN_MASK                                                               0x00000400L
+#define DIG2_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED_MASK                                           0x00000800L
+#define DIG2_HDMI_CONTROL__TMDS_PIXEL_ENCODING_MASK                                                           0x00001000L
+#define DIG2_HDMI_CONTROL__TMDS_COLOR_FORMAT_MASK                                                             0x00006000L
+#define DIG2_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM_MASK                                             0x003F0000L
+#define DIG2_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK                                                        0x01000000L
+#define DIG2_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK                                                         0x30000000L
+//DIG2_HDMI_STATUS
+#define DIG2_HDMI_STATUS__HDMI_ACTIVE_AVMUTE__SHIFT                                                           0x0
+#define DIG2_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR__SHIFT                                                      0x10
+#define DIG2_HDMI_STATUS__HDMI_ERROR_INT__SHIFT                                                               0x1b
+#define DIG2_HDMI_STATUS__HDMI_ACTIVE_AVMUTE_MASK                                                             0x00000001L
+#define DIG2_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR_MASK                                                        0x00010000L
+#define DIG2_HDMI_STATUS__HDMI_ERROR_INT_MASK                                                                 0x08000000L
+//DIG2_HDMI_AUDIO_PACKET_CONTROL
+#define DIG2_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN__SHIFT                                            0x4
+#define DIG2_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN_MASK                                              0x00000030L
+//DIG2_HDMI_ACR_PACKET_CONTROL
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND__SHIFT                                                    0x0
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT__SHIFT                                                    0x1
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT__SHIFT                                                  0x4
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE__SHIFT                                                  0x8
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND__SHIFT                                               0xc
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE__SHIFT                                              0x10
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND_MASK                                                      0x00000001L
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT_MASK                                                      0x00000002L
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT_MASK                                                    0x00000030L
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE_MASK                                                    0x00000100L
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_MASK                                                 0x00001000L
+#define DIG2_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE_MASK                                                0x00070000L
+//DIG2_HDMI_VBI_PACKET_CONTROL
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND__SHIFT                                                   0x0
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND__SHIFT                                                     0x4
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT__SHIFT                                                     0x5
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND__SHIFT                                                   0x8
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT__SHIFT                                                   0x9
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND__SHIFT                                                    0xc
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE__SHIFT                                                   0x10
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE__SHIFT                                                    0x18
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK                                                     0x00000001L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND_MASK                                                       0x00000010L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT_MASK                                                       0x00000020L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND_MASK                                                     0x00000100L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT_MASK                                                     0x00000200L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND_MASK                                                      0x00001000L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE_MASK                                                     0x003F0000L
+#define DIG2_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE_MASK                                                      0x3F000000L
+//DIG2_HDMI_INFOFRAME_CONTROL0
+#define DIG2_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND__SHIFT                                             0x4
+#define DIG2_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE__SHIFT                                             0x8
+#define DIG2_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND_MASK                                               0x00000010L
+#define DIG2_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE_MASK                                               0x00003F00L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT__SHIFT                                          0x1
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE__SHIFT                                0x2
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND__SHIFT                                          0x4
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT__SHIFT                                          0x5
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE__SHIFT                                0x6
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND__SHIFT                                          0x8
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT__SHIFT                                          0x9
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE__SHIFT                                0xa
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE__SHIFT                           0xb
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND__SHIFT                                          0xc
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT__SHIFT                                          0xd
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE__SHIFT                                0xe
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE__SHIFT                           0xf
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT__SHIFT                                          0x11
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE__SHIFT                                0x12
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE__SHIFT                           0x13
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND__SHIFT                                          0x14
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT__SHIFT                                          0x15
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE__SHIFT                                0x16
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE__SHIFT                           0x17
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND__SHIFT                                          0x18
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT__SHIFT                                          0x19
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE__SHIFT                                0x1a
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE__SHIFT                           0x1b
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND__SHIFT                                          0x1c
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT__SHIFT                                          0x1d
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE__SHIFT                                0x1e
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE__SHIFT                           0x1f
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND_MASK                                            0x00000001L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT_MASK                                            0x00000002L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND_MASK                                            0x00000010L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT_MASK                                            0x00000020L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND_MASK                                            0x00000100L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT_MASK                                            0x00000200L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE_MASK                                  0x00000400L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE_MASK                             0x00000800L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND_MASK                                            0x00001000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT_MASK                                            0x00002000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE_MASK                                  0x00004000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE_MASK                             0x00008000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND_MASK                                            0x00010000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT_MASK                                            0x00020000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE_MASK                                  0x00040000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE_MASK                             0x00080000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND_MASK                                            0x00100000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT_MASK                                            0x00200000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE_MASK                                  0x00400000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE_MASK                             0x00800000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND_MASK                                            0x01000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT_MASK                                            0x02000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE_MASK                                  0x04000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE_MASK                             0x08000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND_MASK                                            0x10000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT_MASK                                            0x20000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE_MASK                                  0x40000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE_MASK                             0x80000000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL6
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT__SHIFT                                          0x1
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE__SHIFT                                0x2
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND__SHIFT                                          0x4
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT__SHIFT                                          0x5
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE__SHIFT                                0x6
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND__SHIFT                                         0x8
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT__SHIFT                                         0x9
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE__SHIFT                               0xa
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE__SHIFT                          0xb
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND__SHIFT                                         0xc
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT__SHIFT                                         0xd
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE__SHIFT                               0xe
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE__SHIFT                          0xf
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND__SHIFT                                         0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT__SHIFT                                         0x11
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE__SHIFT                               0x12
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE__SHIFT                          0x13
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND__SHIFT                                         0x14
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT__SHIFT                                         0x15
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE__SHIFT                               0x16
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE__SHIFT                          0x17
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND__SHIFT                                         0x18
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT__SHIFT                                         0x19
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE__SHIFT                               0x1a
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE__SHIFT                          0x1b
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND_MASK                                            0x00000001L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT_MASK                                            0x00000002L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND_MASK                                            0x00000010L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT_MASK                                            0x00000020L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND_MASK                                           0x00000100L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT_MASK                                           0x00000200L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE_MASK                                 0x00000400L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE_MASK                            0x00000800L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND_MASK                                           0x00001000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT_MASK                                           0x00002000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE_MASK                                 0x00004000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE_MASK                            0x00008000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND_MASK                                           0x00010000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT_MASK                                           0x00020000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE_MASK                                 0x00040000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE_MASK                            0x00080000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND_MASK                                           0x00100000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT_MASK                                           0x00200000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE_MASK                                 0x00400000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE_MASK                            0x00800000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND_MASK                                           0x01000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT_MASK                                           0x02000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE_MASK                                 0x04000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE_MASK                            0x08000000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL5
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND__SHIFT                                0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING__SHIFT                        0x1
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND__SHIFT                                0x2
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING__SHIFT                        0x3
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND__SHIFT                                0x4
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING__SHIFT                        0x5
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND__SHIFT                                0x6
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING__SHIFT                        0x7
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND__SHIFT                                0x8
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING__SHIFT                        0x9
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND__SHIFT                                0xa
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING__SHIFT                        0xb
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND__SHIFT                                0xc
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING__SHIFT                        0xd
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND__SHIFT                                0xe
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING__SHIFT                        0xf
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND__SHIFT                                0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING__SHIFT                        0x11
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND__SHIFT                                0x12
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING__SHIFT                        0x13
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND__SHIFT                               0x14
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING__SHIFT                       0x15
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND__SHIFT                               0x16
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING__SHIFT                       0x17
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND__SHIFT                               0x18
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING__SHIFT                       0x19
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND__SHIFT                               0x1a
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING__SHIFT                       0x1b
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND__SHIFT                               0x1c
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING__SHIFT                       0x1d
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_MASK                                  0x00000001L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING_MASK                          0x00000002L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_MASK                                  0x00000004L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING_MASK                          0x00000008L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_MASK                                  0x00000010L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING_MASK                          0x00000020L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_MASK                                  0x00000040L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING_MASK                          0x00000080L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_MASK                                  0x00000100L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING_MASK                          0x00000200L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_MASK                                  0x00000400L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING_MASK                          0x00000800L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_MASK                                  0x00001000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING_MASK                          0x00002000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_MASK                                  0x00004000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING_MASK                          0x00008000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_MASK                                  0x00010000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING_MASK                          0x00020000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_MASK                                  0x00040000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING_MASK                          0x00080000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_MASK                                 0x00100000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING_MASK                         0x00200000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_MASK                                 0x00400000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING_MASK                         0x00800000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_MASK                                 0x01000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING_MASK                         0x02000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_MASK                                 0x04000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING_MASK                         0x08000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_MASK                                 0x10000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING_MASK                         0x20000000L
+//DIG2_HDMI_GC
+#define DIG2_HDMI_GC__HDMI_GC_AVMUTE__SHIFT                                                                   0x0
+#define DIG2_HDMI_GC__HDMI_GC_AVMUTE_CONT__SHIFT                                                              0x2
+#define DIG2_HDMI_GC__HDMI_DEFAULT_PHASE__SHIFT                                                               0x4
+#define DIG2_HDMI_GC__HDMI_PACKING_PHASE__SHIFT                                                               0x8
+#define DIG2_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE__SHIFT                                                      0xc
+#define DIG2_HDMI_GC__HDMI_GC_AVMUTE_MASK                                                                     0x00000001L
+#define DIG2_HDMI_GC__HDMI_GC_AVMUTE_CONT_MASK                                                                0x00000004L
+#define DIG2_HDMI_GC__HDMI_DEFAULT_PHASE_MASK                                                                 0x00000010L
+#define DIG2_HDMI_GC__HDMI_PACKING_PHASE_MASK                                                                 0x00000F00L
+#define DIG2_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE_MASK                                                        0x00001000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL1
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE_MASK                                            0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE_MASK                                            0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL2
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE_MASK                                            0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE_MASK                                            0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL3
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE_MASK                                            0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE_MASK                                            0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL4
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE_MASK                                            0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE_MASK                                            0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL7
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE__SHIFT                                          0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE__SHIFT                                          0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE_MASK                                            0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE_MASK                                            0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL8
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE__SHIFT                                         0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE__SHIFT                                         0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE_MASK                                           0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE_MASK                                           0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL9
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE__SHIFT                                         0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE__SHIFT                                         0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE_MASK                                           0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE_MASK                                           0xFFFF0000L
+//DIG2_HDMI_GENERIC_PACKET_CONTROL10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE__SHIFT                                        0x0
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING__SHIFT                                0x10
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING__SHIFT                                0x11
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING__SHIFT                                0x12
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING__SHIFT                                0x13
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING__SHIFT                                0x14
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING__SHIFT                                0x15
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING__SHIFT                                0x16
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING__SHIFT                                0x17
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING__SHIFT                                0x18
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING__SHIFT                                0x19
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING__SHIFT                               0x1a
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING__SHIFT                               0x1b
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING__SHIFT                               0x1c
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING__SHIFT                               0x1d
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING__SHIFT                               0x1e
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE_MASK                                          0x0000FFFFL
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING_MASK                                  0x00010000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING_MASK                                  0x00020000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING_MASK                                  0x00040000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING_MASK                                  0x00080000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING_MASK                                  0x00100000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING_MASK                                  0x00200000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING_MASK                                  0x00400000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING_MASK                                  0x00800000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING_MASK                                  0x01000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING_MASK                                  0x02000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING_MASK                                 0x04000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING_MASK                                 0x08000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING_MASK                                 0x10000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING_MASK                                 0x20000000L
+#define DIG2_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING_MASK                                 0x40000000L
+//DIG2_HDMI_DB_CONTROL
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_PENDING__SHIFT                                                          0x0
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_TAKEN__SHIFT                                                            0x4
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR__SHIFT                                                        0x5
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_LOCK__SHIFT                                                             0x8
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_DISABLE__SHIFT                                                          0xc
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_PENDING__SHIFT                                                       0xf
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN__SHIFT                                                         0x10
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR__SHIFT                                                     0x11
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_PENDING_MASK                                                            0x00000001L
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_TAKEN_MASK                                                              0x00000010L
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR_MASK                                                          0x00000020L
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_LOCK_MASK                                                               0x00000100L
+#define DIG2_HDMI_DB_CONTROL__HDMI_DB_DISABLE_MASK                                                            0x00001000L
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_PENDING_MASK                                                         0x00008000L
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_MASK                                                           0x00010000L
+#define DIG2_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR_MASK                                                       0x00020000L
+//DIG2_HDMI_ACR_32_0
+#define DIG2_HDMI_ACR_32_0__HDMI_ACR_CTS_32__SHIFT                                                            0xc
+#define DIG2_HDMI_ACR_32_0__HDMI_ACR_CTS_32_MASK                                                              0xFFFFF000L
+//DIG2_HDMI_ACR_32_1
+#define DIG2_HDMI_ACR_32_1__HDMI_ACR_N_32__SHIFT                                                              0x0
+#define DIG2_HDMI_ACR_32_1__HDMI_ACR_N_32_MASK                                                                0x000FFFFFL
+//DIG2_HDMI_ACR_44_0
+#define DIG2_HDMI_ACR_44_0__HDMI_ACR_CTS_44__SHIFT                                                            0xc
+#define DIG2_HDMI_ACR_44_0__HDMI_ACR_CTS_44_MASK                                                              0xFFFFF000L
+//DIG2_HDMI_ACR_44_1
+#define DIG2_HDMI_ACR_44_1__HDMI_ACR_N_44__SHIFT                                                              0x0
+#define DIG2_HDMI_ACR_44_1__HDMI_ACR_N_44_MASK                                                                0x000FFFFFL
+//DIG2_HDMI_ACR_48_0
+#define DIG2_HDMI_ACR_48_0__HDMI_ACR_CTS_48__SHIFT                                                            0xc
+#define DIG2_HDMI_ACR_48_0__HDMI_ACR_CTS_48_MASK                                                              0xFFFFF000L
+//DIG2_HDMI_ACR_48_1
+#define DIG2_HDMI_ACR_48_1__HDMI_ACR_N_48__SHIFT                                                              0x0
+#define DIG2_HDMI_ACR_48_1__HDMI_ACR_N_48_MASK                                                                0x000FFFFFL
+//DIG2_HDMI_ACR_STATUS_0
+#define DIG2_HDMI_ACR_STATUS_0__HDMI_ACR_CTS__SHIFT                                                           0xc
+#define DIG2_HDMI_ACR_STATUS_0__HDMI_ACR_CTS_MASK                                                             0xFFFFF000L
+//DIG2_HDMI_ACR_STATUS_1
+#define DIG2_HDMI_ACR_STATUS_1__HDMI_ACR_N__SHIFT                                                             0x0
+#define DIG2_HDMI_ACR_STATUS_1__HDMI_ACR_N_MASK                                                               0x000FFFFFL
+//DIG2_DIG_FE_AUDIO_CNTL
+#define DIG2_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT                               0x0
+#define DIG2_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE__SHIFT                                                       0x8
+#define DIG2_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK                                 0x00000007L
+#define DIG2_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE_MASK                                                         0x00000100L
+//DIG2_DIG_BE_CLK_CNTL
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_MODE__SHIFT                                                              0x0
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN__SHIFT                                                            0x4
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG2_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET__SHIFT                                                          0x6
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON__SHIFT                                                 0xb
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON__SHIFT                                            0xc
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON__SHIFT                                            0xd
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_MODE_MASK                                                                0x00000007L
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN_MASK                                                              0x00000010L
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG2_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET_MASK                                                            0x00000040L
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON_MASK                                                   0x00000800L
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON_MASK                                              0x00001000L
+#define DIG2_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON_MASK                                              0x00002000L
+//DIG2_DIG_BE_CNTL
+#define DIG2_DIG_BE_CNTL__DIG_RB_SWITCH_EN__SHIFT                                                             0x2
+#define DIG2_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT__SHIFT                                                         0x8
+#define DIG2_DIG_BE_CNTL__DIG_HPD_SELECT__SHIFT                                                               0x1c
+#define DIG2_DIG_BE_CNTL__DIG_RB_SWITCH_EN_MASK                                                               0x00000004L
+#define DIG2_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT_MASK                                                           0x00007F00L
+#define DIG2_DIG_BE_CNTL__DIG_HPD_SELECT_MASK                                                                 0x70000000L
+//DIG2_DIG_BE_EN_CNTL
+#define DIG2_DIG_BE_EN_CNTL__DIG_BE_ENABLE__SHIFT                                                             0x0
+#define DIG2_DIG_BE_EN_CNTL__DIG_BE_ENABLE_MASK                                                               0x00000001L
+//DIG2_HDCP_INT_CONTROL
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT__SHIFT                                                   0x0
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK__SHIFT                                                   0x1
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK__SHIFT                                                  0x2
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT__SHIFT                                                      0x4
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK__SHIFT                                                      0x5
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK__SHIFT                                                     0x6
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK__SHIFT                                                 0x7
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT__SHIFT                                                   0x8
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK__SHIFT                                                   0x9
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK__SHIFT                                                  0xa
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT__SHIFT                                                  0xc
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK__SHIFT                                                  0xd
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK__SHIFT                                                 0xe
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT_MASK                                                     0x00000001L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK_MASK                                                     0x00000002L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK_MASK                                                    0x00000004L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT_MASK                                                        0x00000010L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK_MASK                                                        0x00000020L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK_MASK                                                       0x00000040L
+#define DIG2_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK_MASK                                                   0x00000080L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT_MASK                                                     0x00000100L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK_MASK                                                     0x00000200L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK_MASK                                                    0x00000400L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT_MASK                                                    0x00001000L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK_MASK                                                    0x00002000L
+#define DIG2_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK_MASK                                                   0x00004000L
+//DIG2_HDCP_I2C_CONTROL_0
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE__SHIFT                                                      0x0
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET__SHIFT                                                   0x2
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT__SHIFT                                                   0x8
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE_MASK                                                        0x00000001L
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET_MASK                                                     0x00000004L
+#define DIG2_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT_MASK                                                     0x00000700L
+//DIG2_HDCP_I2C_CONTROL_1
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK__SHIFT                                                   0x0
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE__SHIFT                                                   0x1
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE__SHIFT                                               0x8
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT__SHIFT                                                  0x14
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY__SHIFT                                                  0x18
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK_MASK                                                     0x00000001L
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE_MASK                                                     0x00000002L
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE_MASK                                                 0x00000100L
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT_MASK                                                    0x00F00000L
+#define DIG2_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY_MASK                                                    0xFF000000L
+//DIG2_TMDS_CNTL
+#define DIG2_TMDS_CNTL__TMDS_SYNC_PHASE__SHIFT                                                                0x0
+#define DIG2_TMDS_CNTL__TMDS_SYNC_PHASE_MASK                                                                  0x00000001L
+//DIG2_TMDS_CONTROL_CHAR
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN__SHIFT                                              0x0
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN__SHIFT                                              0x1
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN__SHIFT                                              0x2
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN__SHIFT                                              0x3
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN_MASK                                                0x00000001L
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN_MASK                                                0x00000002L
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN_MASK                                                0x00000004L
+#define DIG2_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN_MASK                                                0x00000008L
+//DIG2_TMDS_CONTROL0_FEEDBACK
+#define DIG2_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT__SHIFT                                     0x0
+#define DIG2_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY__SHIFT                                      0x8
+#define DIG2_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT_MASK                                       0x00000003L
+#define DIG2_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY_MASK                                        0x00000300L
+//DIG2_TMDS_STEREOSYNC_CTL_SEL
+#define DIG2_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL__SHIFT                                          0x0
+#define DIG2_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL_MASK                                            0x00000003L
+//DIG2_TMDS_SYNC_CHAR_PATTERN_0_1
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0__SHIFT                                       0x0
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1__SHIFT                                       0x10
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0_MASK                                         0x000003FFL
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1_MASK                                         0x03FF0000L
+//DIG2_TMDS_SYNC_CHAR_PATTERN_2_3
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2__SHIFT                                       0x0
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3__SHIFT                                       0x10
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2_MASK                                         0x000003FFL
+#define DIG2_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3_MASK                                         0x03FF0000L
+//DIG2_TMDS_CTL_BITS
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL0__SHIFT                                                                  0x0
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL1__SHIFT                                                                  0x8
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL2__SHIFT                                                                  0x10
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL3__SHIFT                                                                  0x18
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL0_MASK                                                                    0x00000001L
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL1_MASK                                                                    0x00000100L
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL2_MASK                                                                    0x00010000L
+#define DIG2_TMDS_CTL_BITS__TMDS_CTL3_MASK                                                                    0x01000000L
+//DIG2_TMDS_DCBALANCER_CONTROL
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN__SHIFT                                               0x0
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN__SHIFT                                               0x4
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN__SHIFT                                          0x8
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN__SHIFT                                          0x10
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE__SHIFT                                            0x18
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN_MASK                                                 0x00000001L
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN_MASK                                                 0x00000070L
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN_MASK                                            0x00000100L
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN_MASK                                            0x000F0000L
+#define DIG2_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE_MASK                                              0x01000000L
+//DIG2_TMDS_CTL0_1_GEN_CNTL
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL__SHIFT                                                  0x0
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY__SHIFT                                                0x4
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT__SHIFT                                               0x7
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION__SHIFT                                           0x8
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL__SHIFT                                                  0x10
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY__SHIFT                                                0x14
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT__SHIFT                                               0x17
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION__SHIFT                                           0x18
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN__SHIFT                                                0x1f
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN_MASK                                              0x10000000L
+#define DIG2_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN_MASK                                                  0x80000000L
+//DIG2_TMDS_CTL2_3_GEN_CNTL
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL__SHIFT                                                  0x0
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY__SHIFT                                                0x4
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT__SHIFT                                               0x7
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION__SHIFT                                           0x8
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL__SHIFT                                                  0x10
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY__SHIFT                                                0x14
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT__SHIFT                                               0x17
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION__SHIFT                                           0x18
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG2_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN_MASK                                              0x10000000L
+//DIG2_DIG_VERSION
+
+
+// addressBlock: dce_dc_dio_dp3_dispdec
+//DP3_DP_LINK_CNTL
+#define DP3_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE__SHIFT                                                    0x4
+#define DP3_DP_LINK_CNTL__DP_LINK_STATUS__SHIFT                                                               0x8
+#define DP3_DP_LINK_CNTL__DP_LINK_TRAINING_COMPLETE_MASK                                                      0x00000010L
+#define DP3_DP_LINK_CNTL__DP_LINK_STATUS_MASK                                                                 0x00000100L
+//DP3_DP_PIXEL_FORMAT
+#define DP3_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                                                       0x0
+#define DP3_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT__SHIFT                                                 0x4
+#define DP3_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                                              0x8
+#define DP3_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT__SHIFT                                                   0x10
+#define DP3_DP_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                                         0x00000001L
+#define DP3_DP_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_FORMAT_MASK                                                   0x00000030L
+#define DP3_DP_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                                                0x00000700L
+#define DP3_DP_PIXEL_FORMAT__COMPRESSED_PIXEL_FORMAT_MASK                                                     0x00010000L
+//DP3_DP_MSA_COLORIMETRY
+#define DP3_DP_MSA_COLORIMETRY__DP_MSA_MISC0__SHIFT                                                           0x18
+#define DP3_DP_MSA_COLORIMETRY__DP_MSA_MISC0_MASK                                                             0xFF000000L
+//DP3_DP_CONFIG
+#define DP3_DP_CONFIG__DP_UDI_LANES__SHIFT                                                                    0x0
+#define DP3_DP_CONFIG__DP_UDI_LANES_MASK                                                                      0x00000003L
+//DP3_DP_VID_STREAM_CNTL
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE__SHIFT                                                   0x0
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER__SHIFT                                                0x8
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS__SHIFT                                                   0x10
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT__SHIFT                                           0x14
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_ENABLE_MASK                                                     0x00000001L
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_DIS_DEFER_MASK                                                  0x00000300L
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_STATUS_MASK                                                     0x00010000L
+#define DP3_DP_VID_STREAM_CNTL__DP_VID_STREAM_CHANGE_KEEPOUT_MASK                                             0x00100000L
+//DP3_DP_STEER_FIFO
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE__SHIFT                                                        0x0
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_RESET__SHIFT                                                         0x1
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE__SHIFT                                                    0x2
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG__SHIFT                                                      0x4
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT__SHIFT                                                       0x5
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK__SHIFT                                                       0x6
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK__SHIFT                                                      0x7
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_ENABLE_MASK                                                          0x00000001L
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_RESET_MASK                                                           0x00000002L
+#define DP3_DP_STEER_FIFO__DP_STEER_FIFO_RESET_DONE_MASK                                                      0x00000004L
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_FLAG_MASK                                                        0x00000010L
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_INT_MASK                                                         0x00000020L
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_ACK_MASK                                                         0x00000040L
+#define DP3_DP_STEER_FIFO__DP_STEER_OVERFLOW_MASK_MASK                                                        0x00000080L
+//DP3_DP_MSA_MISC
+#define DP3_DP_MSA_MISC__DP_MSA_MISC1__SHIFT                                                                  0x0
+#define DP3_DP_MSA_MISC__DP_MSA_MISC2__SHIFT                                                                  0x8
+#define DP3_DP_MSA_MISC__DP_MSA_MISC3__SHIFT                                                                  0x10
+#define DP3_DP_MSA_MISC__DP_MSA_MISC4__SHIFT                                                                  0x18
+#define DP3_DP_MSA_MISC__DP_MSA_MISC1_MASK                                                                    0x000000FFL
+#define DP3_DP_MSA_MISC__DP_MSA_MISC2_MASK                                                                    0x0000FF00L
+#define DP3_DP_MSA_MISC__DP_MSA_MISC3_MASK                                                                    0x00FF0000L
+#define DP3_DP_MSA_MISC__DP_MSA_MISC4_MASK                                                                    0xFF000000L
+//DP3_DP_DPHY_INTERNAL_CTRL
+#define DP3_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN__SHIFT                                         0x0
+#define DP3_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL__SHIFT                                        0x4
+#define DP3_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_EN_MASK                                           0x00000001L
+#define DP3_DP_DPHY_INTERNAL_CTRL__DPHY_ALT_SCRAMBLER_RESET_SEL_MASK                                          0x00000010L
+//DP3_DP_VID_TIMING
+#define DP3_DP_VID_TIMING__DP_VID_M_N_GEN_EN__SHIFT                                                           0x8
+#define DP3_DP_VID_TIMING__DP_VID_M_DIV__SHIFT                                                                0xc
+#define DP3_DP_VID_TIMING__DP_VID_N_INTERVAL__SHIFT                                                           0xe
+#define DP3_DP_VID_TIMING__DP_VID_M_N_GEN_EN_MASK                                                             0x00000100L
+#define DP3_DP_VID_TIMING__DP_VID_M_DIV_MASK                                                                  0x00003000L
+#define DP3_DP_VID_TIMING__DP_VID_N_INTERVAL_MASK                                                             0x0000C000L
+//DP3_DP_VID_N
+#define DP3_DP_VID_N__DP_VID_N__SHIFT                                                                         0x0
+#define DP3_DP_VID_N__DP_VID_N_MASK                                                                           0x00FFFFFFL
+//DP3_DP_VID_M
+#define DP3_DP_VID_M__DP_VID_M__SHIFT                                                                         0x0
+#define DP3_DP_VID_M__DP_VID_M_MASK                                                                           0x00FFFFFFL
+//DP3_DP_LINK_FRAMING_CNTL
+#define DP3_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL__SHIFT                                                  0x0
+#define DP3_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE__SHIFT                                  0x14
+#define DP3_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE__SHIFT                                                      0x18
+#define DP3_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE__SHIFT                                           0x1c
+#define DP3_DP_LINK_FRAMING_CNTL__DP_IDLE_BS_INTERVAL_MASK                                                    0x0003FFFFL
+#define DP3_DP_LINK_FRAMING_CNTL__DP_BACK_TO_BACK_BS_AVOIDANCE_ENABLE_MASK                                    0x00100000L
+#define DP3_DP_LINK_FRAMING_CNTL__DP_VBID_DISABLE_MASK                                                        0x01000000L
+#define DP3_DP_LINK_FRAMING_CNTL__DP_VID_ENHANCED_FRAME_MODE_MASK                                             0x10000000L
+//DP3_DP_HBR2_EYE_PATTERN
+#define DP3_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE__SHIFT                                            0x0
+#define DP3_DP_HBR2_EYE_PATTERN__DP_HBR2_EYE_PATTERN_ENABLE_MASK                                              0x00000001L
+//DP3_DP_VID_MSA_VBID
+#define DP3_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION__SHIFT                                                       0x0
+#define DP3_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE__SHIFT                                            0xc
+#define DP3_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL__SHIFT                                                     0x18
+#define DP3_DP_VID_MSA_VBID__DP_VID_MSA_LOCATION_MASK                                                         0x00000FFFL
+#define DP3_DP_VID_MSA_VBID__DP_VID_MSA_TRANSMISSION_ENABLE_MASK                                              0x00001000L
+#define DP3_DP_VID_MSA_VBID__DP_VID_VBID_FIELD_POL_MASK                                                       0x01000000L
+//DP3_DP_VID_INTERRUPT_CNTL
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT__SHIFT                                           0x0
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK__SHIFT                                           0x1
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK__SHIFT                                          0x2
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_INT_MASK                                             0x00000001L
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_ACK_MASK                                             0x00000002L
+#define DP3_DP_VID_INTERRUPT_CNTL__DP_VID_STREAM_DISABLE_MASK_MASK                                            0x00000004L
+//DP3_DP_DPHY_CNTL
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0__SHIFT                                                         0x0
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1__SHIFT                                                         0x1
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2__SHIFT                                                         0x2
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3__SHIFT                                                         0x3
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_EN__SHIFT                                                                  0x4
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW__SHIFT                                                        0x5
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS__SHIFT                                                       0x6
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM__SHIFT                                               0x7
+#define DP3_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL__SHIFT                                                           0x8
+#define DP3_DP_DPHY_CNTL__DPHY_BYPASS__SHIFT                                                                  0x10
+#define DP3_DP_DPHY_CNTL__DPHY_SKEW_BYPASS__SHIFT                                                             0x18
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE0_MASK                                                           0x00000001L
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE1_MASK                                                           0x00000002L
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE2_MASK                                                           0x00000004L
+#define DP3_DP_DPHY_CNTL__DPHY_ATEST_SEL_LANE3_MASK                                                           0x00000008L
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_EN_MASK                                                                    0x00000010L
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_READY_SHADOW_MASK                                                          0x00000020L
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_ACTIVE_STATUS_MASK                                                         0x00000040L
+#define DP3_DP_DPHY_CNTL__DPHY_FEC_DISABLE_MODE_FOR_ALPM_MASK                                                 0x00000080L
+#define DP3_DP_DPHY_CNTL__DPHY_SCRAMBLER_SEL_MASK                                                             0x00000100L
+#define DP3_DP_DPHY_CNTL__DPHY_BYPASS_MASK                                                                    0x00010000L
+#define DP3_DP_DPHY_CNTL__DPHY_SKEW_BYPASS_MASK                                                               0x01000000L
+//DP3_DP_DPHY_TRAINING_PATTERN_SEL
+#define DP3_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL__SHIFT                                    0x0
+#define DP3_DP_DPHY_TRAINING_PATTERN_SEL__DPHY_TRAINING_PATTERN_SEL_MASK                                      0x00000003L
+//DP3_DP_DPHY_SYM0
+#define DP3_DP_DPHY_SYM0__DPHY_SYM1__SHIFT                                                                    0x0
+#define DP3_DP_DPHY_SYM0__DPHY_SYM2__SHIFT                                                                    0xa
+#define DP3_DP_DPHY_SYM0__DPHY_SYM3__SHIFT                                                                    0x14
+#define DP3_DP_DPHY_SYM0__DPHY_SYM1_MASK                                                                      0x000003FFL
+#define DP3_DP_DPHY_SYM0__DPHY_SYM2_MASK                                                                      0x000FFC00L
+#define DP3_DP_DPHY_SYM0__DPHY_SYM3_MASK                                                                      0x3FF00000L
+//DP3_DP_DPHY_SYM1
+#define DP3_DP_DPHY_SYM1__DPHY_SYM4__SHIFT                                                                    0x0
+#define DP3_DP_DPHY_SYM1__DPHY_SYM5__SHIFT                                                                    0xa
+#define DP3_DP_DPHY_SYM1__DPHY_SYM6__SHIFT                                                                    0x14
+#define DP3_DP_DPHY_SYM1__DPHY_SYM4_MASK                                                                      0x000003FFL
+#define DP3_DP_DPHY_SYM1__DPHY_SYM5_MASK                                                                      0x000FFC00L
+#define DP3_DP_DPHY_SYM1__DPHY_SYM6_MASK                                                                      0x3FF00000L
+//DP3_DP_DPHY_SYM2
+#define DP3_DP_DPHY_SYM2__DPHY_SYM7__SHIFT                                                                    0x0
+#define DP3_DP_DPHY_SYM2__DPHY_SYM8__SHIFT                                                                    0xa
+#define DP3_DP_DPHY_SYM2__DPHY_SYM7_MASK                                                                      0x000003FFL
+#define DP3_DP_DPHY_SYM2__DPHY_SYM8_MASK                                                                      0x000FFC00L
+//DP3_DP_DPHY_8B10B_CNTL
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET__SHIFT                                                       0x8
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP__SHIFT                                                    0x10
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP__SHIFT                                                    0x18
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_RESET_MASK                                                         0x00000100L
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_EXT_DISP_MASK                                                      0x00010000L
+#define DP3_DP_DPHY_8B10B_CNTL__DPHY_8B10B_CUR_DISP_MASK                                                      0x01000000L
+//DP3_DP_DPHY_PRBS_CNTL
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN__SHIFT                                                            0x0
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL__SHIFT                                                           0x4
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED__SHIFT                                                          0x8
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_EN_MASK                                                              0x00000001L
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEL_MASK                                                             0x00000030L
+#define DP3_DP_DPHY_PRBS_CNTL__DPHY_PRBS_SEED_MASK                                                            0x7FFFFF00L
+//DP3_DP_DPHY_SCRAM_CNTL
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS__SHIFT                                                     0x0
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE__SHIFT                                                 0x4
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT__SHIFT                                                0x8
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE__SHIFT                                                   0x18
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_DIS_MASK                                                       0x00000001L
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_ADVANCE_MASK                                                   0x00000010L
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_BS_COUNT_MASK                                                  0x0003FF00L
+#define DP3_DP_DPHY_SCRAM_CNTL__DPHY_SCRAMBLER_KCODE_MASK                                                     0x01000000L
+//DP3_DP_TU_CNTL
+#define DP3_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG__SHIFT                                                            0x8
+#define DP3_DP_TU_CNTL__DP_TU_OVERFLOW_ACK__SHIFT                                                             0xc
+#define DP3_DP_TU_CNTL__DP_TU_SIZE__SHIFT                                                                     0x18
+#define DP3_DP_TU_CNTL__DP_TU_OVERFLOW_FLAG_MASK                                                              0x00000100L
+#define DP3_DP_TU_CNTL__DP_TU_OVERFLOW_ACK_MASK                                                               0x00001000L
+#define DP3_DP_TU_CNTL__DP_TU_SIZE_MASK                                                                       0x3F000000L
+//DP3_DP_PIXEL_FORMAT_DB_CNTL
+#define DP3_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE__SHIFT                                            0x0
+#define DP3_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING__SHIFT                                           0x4
+#define DP3_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_ENABLE_MASK                                              0x00000001L
+#define DP3_DP_PIXEL_FORMAT_DB_CNTL__PIXEL_FORMAT_DB_PENDING_MASK                                             0x00000010L
+//DP3_DP_CP_LINK_VERIFICATION_PATTERN
+#define DP3_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN__SHIFT                           0x0
+#define DP3_DP_CP_LINK_VERIFICATION_PATTERN__DP_CP_LINK_VERIFICATION_PATTERN_MASK                             0x0000FFFFL
+//DP3_DP_SEC_CNTL
+#define DP3_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE__SHIFT                                                          0x0
+#define DP3_DP_SEC_CNTL__DP_SEC_ASP_ENABLE__SHIFT                                                             0x4
+#define DP3_DP_SEC_CNTL__DP_SEC_ATP_ENABLE__SHIFT                                                             0x8
+#define DP3_DP_SEC_CNTL__DP_SEC_AIP_ENABLE__SHIFT                                                             0xc
+#define DP3_DP_SEC_CNTL__DP_SEC_ACM_ENABLE__SHIFT                                                             0x10
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE__SHIFT                                                            0x14
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE__SHIFT                                                            0x15
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE__SHIFT                                                            0x16
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE__SHIFT                                                            0x17
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE__SHIFT                                                            0x18
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE__SHIFT                                                            0x19
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE__SHIFT                                                            0x1a
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE__SHIFT                                                            0x1b
+#define DP3_DP_SEC_CNTL__DP_SEC_STREAM_ENABLE_MASK                                                            0x00000001L
+#define DP3_DP_SEC_CNTL__DP_SEC_ASP_ENABLE_MASK                                                               0x00000010L
+#define DP3_DP_SEC_CNTL__DP_SEC_ATP_ENABLE_MASK                                                               0x00000100L
+#define DP3_DP_SEC_CNTL__DP_SEC_AIP_ENABLE_MASK                                                               0x00001000L
+#define DP3_DP_SEC_CNTL__DP_SEC_ACM_ENABLE_MASK                                                               0x00010000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP0_ENABLE_MASK                                                              0x00100000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP1_ENABLE_MASK                                                              0x00200000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP2_ENABLE_MASK                                                              0x00400000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP3_ENABLE_MASK                                                              0x00800000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP4_ENABLE_MASK                                                              0x01000000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP5_ENABLE_MASK                                                              0x02000000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP6_ENABLE_MASK                                                              0x04000000L
+#define DP3_DP_SEC_CNTL__DP_SEC_GSP7_ENABLE_MASK                                                              0x08000000L
+//DP3_DP_SEC_CNTL1
+#define DP3_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE__SHIFT                                                           0x0
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE__SHIFT                                                   0x1
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY__SHIFT                                                         0x4
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND__SHIFT                                                             0x5
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING__SHIFT                                                     0x6
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED__SHIFT                                             0x7
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE__SHIFT                                                   0x9
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE__SHIFT                                                   0xa
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE__SHIFT                                                   0xb
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE__SHIFT                                                   0xc
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE__SHIFT                                                   0xd
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE__SHIFT                                                   0xe
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE__SHIFT                                                   0xf
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_SEC_CNTL1__DP_SEC_ISRC_ENABLE_MASK                                                             0x00000001L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_REFERENCE_MASK                                                     0x00000002L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_PRIORITY_MASK                                                           0x00000010L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_MASK                                                               0x00000020L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_PENDING_MASK                                                       0x00000040L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_DEADLINE_MISSED_MASK                                               0x00000080L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP1_LINE_REFERENCE_MASK                                                     0x00000200L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP2_LINE_REFERENCE_MASK                                                     0x00000400L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP3_LINE_REFERENCE_MASK                                                     0x00000800L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP4_LINE_REFERENCE_MASK                                                     0x00001000L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP5_LINE_REFERENCE_MASK                                                     0x00002000L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP6_LINE_REFERENCE_MASK                                                     0x00004000L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP7_LINE_REFERENCE_MASK                                                     0x00008000L
+#define DP3_DP_SEC_CNTL1__DP_SEC_GSP0_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_SEC_FRAMING1
+#define DP3_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION__SHIFT                                               0x0
+#define DP3_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP3_DP_SEC_FRAMING1__DP_SEC_FRAME_START_LOCATION_MASK                                                 0x00000FFFL
+#define DP3_DP_SEC_FRAMING1__DP_SEC_VBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP3_DP_SEC_FRAMING2
+#define DP3_DP_SEC_FRAMING2__DP_SEC_START_POSITION__SHIFT                                                     0x0
+#define DP3_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH__SHIFT                                              0x10
+#define DP3_DP_SEC_FRAMING2__DP_SEC_START_POSITION_MASK                                                       0x0000FFFFL
+#define DP3_DP_SEC_FRAMING2__DP_SEC_HBLANK_TRANSMIT_WIDTH_MASK                                                0xFFFF0000L
+//DP3_DP_SEC_FRAMING3
+#define DP3_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE__SHIFT                                                    0x0
+#define DP3_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH__SHIFT                                                0x10
+#define DP3_DP_SEC_FRAMING3__DP_SEC_IDLE_FRAME_SIZE_MASK                                                      0x00003FFFL
+#define DP3_DP_SEC_FRAMING3__DP_SEC_IDLE_TRANSMIT_WIDTH_MASK                                                  0xFFFF0000L
+//DP3_DP_SEC_FRAMING4
+#define DP3_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING__SHIFT                                                      0x0
+#define DP3_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS__SHIFT                                                   0x14
+#define DP3_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK__SHIFT                                                      0x18
+#define DP3_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE__SHIFT                                                         0x1c
+#define DP3_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS__SHIFT                                                  0x1d
+#define DP3_DP_SEC_FRAMING4__DP_SST_SDP_SPLITTING_MASK                                                        0x00000001L
+#define DP3_DP_SEC_FRAMING4__DP_SEC_COLLISION_STATUS_MASK                                                     0x00100000L
+#define DP3_DP_SEC_FRAMING4__DP_SEC_COLLISION_ACK_MASK                                                        0x01000000L
+#define DP3_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_MASK                                                           0x10000000L
+#define DP3_DP_SEC_FRAMING4__DP_SEC_AUDIO_MUTE_STATUS_MASK                                                    0x20000000L
+//DP3_DP_SEC_AUD_N
+#define DP3_DP_SEC_AUD_N__DP_SEC_AUD_N__SHIFT                                                                 0x0
+#define DP3_DP_SEC_AUD_N__DP_SEC_AUD_N_MASK                                                                   0x00FFFFFFL
+//DP3_DP_SEC_AUD_N_READBACK
+#define DP3_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK__SHIFT                                               0x0
+#define DP3_DP_SEC_AUD_N_READBACK__DP_SEC_AUD_N_READBACK_MASK                                                 0x00FFFFFFL
+//DP3_DP_SEC_AUD_M
+#define DP3_DP_SEC_AUD_M__DP_SEC_AUD_M__SHIFT                                                                 0x0
+#define DP3_DP_SEC_AUD_M__DP_SEC_AUD_M_MASK                                                                   0x00FFFFFFL
+//DP3_DP_SEC_AUD_M_READBACK
+#define DP3_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK__SHIFT                                               0x0
+#define DP3_DP_SEC_AUD_M_READBACK__DP_SEC_AUD_M_READBACK_MASK                                                 0x00FFFFFFL
+//DP3_DP_SEC_TIMESTAMP
+#define DP3_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE__SHIFT                                                    0x0
+#define DP3_DP_SEC_TIMESTAMP__DP_SEC_TIMESTAMP_MODE_MASK                                                      0x00000001L
+//DP3_DP_SEC_PACKET_CNTL
+#define DP3_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY__SHIFT                                                    0x4
+#define DP3_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER__SHIFT                                              0x18
+#define DP3_DP_SEC_PACKET_CNTL__DP_SEC_ASP_PRIORITY_MASK                                                      0x00000010L
+#define DP3_DP_SEC_PACKET_CNTL__DP_SEC_ATP_VERSION_NUMBER_MASK                                                0x3F000000L
+//DP3_DP_MSE_RATE_CNTL
+#define DP3_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y__SHIFT                                                            0x0
+#define DP3_DP_MSE_RATE_CNTL__DP_MSE_RATE_X__SHIFT                                                            0x1a
+#define DP3_DP_MSE_RATE_CNTL__DP_MSE_RATE_Y_MASK                                                              0x03FFFFFFL
+#define DP3_DP_MSE_RATE_CNTL__DP_MSE_RATE_X_MASK                                                              0xFC000000L
+//DP3_DP_CP_MSE_STATUS
+#define DP3_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT__SHIFT                                                    0x0
+#define DP3_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE__SHIFT                                              0x4
+#define DP3_DP_CP_MSE_STATUS__DP_CP_MSE_RDY_ENCRYPT_MASK                                                      0x00000001L
+#define DP3_DP_CP_MSE_STATUS__DP_CP_MSE_ENCRYPTION_ENABLE_MASK                                                0x00000010L
+//DP3_DP_MSE_RATE_UPDATE
+#define DP3_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING__SHIFT                                             0x0
+#define DP3_DP_MSE_RATE_UPDATE__DP_MSE_RATE_UPDATE_PENDING_MASK                                               0x00000001L
+//DP3_DP_MSE_SAT0
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SRC0__SHIFT                                                               0x0
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0__SHIFT                                                           0x4
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0__SHIFT                                                   0x5
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0__SHIFT                                                        0x8
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SRC1__SHIFT                                                               0x10
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1__SHIFT                                                           0x14
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1__SHIFT                                                   0x15
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1__SHIFT                                                        0x18
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SRC0_MASK                                                                 0x00000007L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT0_MASK                                                             0x00000010L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE0_MASK                                                     0x00000020L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT0_MASK                                                          0x00003F00L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SRC1_MASK                                                                 0x00070000L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPT1_MASK                                                             0x00100000L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_ENCRYPTION_TYPE1_MASK                                                     0x00200000L
+#define DP3_DP_MSE_SAT0__DP_MSE_SAT_SLOT_COUNT1_MASK                                                          0x3F000000L
+//DP3_DP_MSE_SAT1
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SRC2__SHIFT                                                               0x0
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2__SHIFT                                                           0x4
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2__SHIFT                                                   0x5
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2__SHIFT                                                        0x8
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SRC3__SHIFT                                                               0x10
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3__SHIFT                                                           0x14
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3__SHIFT                                                   0x15
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3__SHIFT                                                        0x18
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SRC2_MASK                                                                 0x00000007L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT2_MASK                                                             0x00000010L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE2_MASK                                                     0x00000020L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT2_MASK                                                          0x00003F00L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SRC3_MASK                                                                 0x00070000L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPT3_MASK                                                             0x00100000L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_ENCRYPTION_TYPE3_MASK                                                     0x00200000L
+#define DP3_DP_MSE_SAT1__DP_MSE_SAT_SLOT_COUNT3_MASK                                                          0x3F000000L
+//DP3_DP_MSE_SAT2
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SRC4__SHIFT                                                               0x0
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4__SHIFT                                                           0x4
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4__SHIFT                                                   0x5
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4__SHIFT                                                        0x8
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SRC5__SHIFT                                                               0x10
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5__SHIFT                                                           0x14
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5__SHIFT                                                   0x15
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5__SHIFT                                                        0x18
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SRC4_MASK                                                                 0x00000007L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT4_MASK                                                             0x00000010L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE4_MASK                                                     0x00000020L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT4_MASK                                                          0x00003F00L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SRC5_MASK                                                                 0x00070000L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPT5_MASK                                                             0x00100000L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_ENCRYPTION_TYPE5_MASK                                                     0x00200000L
+#define DP3_DP_MSE_SAT2__DP_MSE_SAT_SLOT_COUNT5_MASK                                                          0x3F000000L
+//DP3_DP_MSE_SAT_UPDATE
+#define DP3_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE__SHIFT                                                       0x0
+#define DP3_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT__SHIFT                                                   0x8
+#define DP3_DP_MSE_SAT_UPDATE__DP_MSE_SAT_UPDATE_MASK                                                         0x00000003L
+#define DP3_DP_MSE_SAT_UPDATE__DP_MSE_16_MTP_KEEPOUT_MASK                                                     0x00000100L
+//DP3_DP_MSE_LINK_TIMING
+#define DP3_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME__SHIFT                                                      0x0
+#define DP3_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE__SHIFT                                                       0x10
+#define DP3_DP_MSE_LINK_TIMING__DP_MSE_LINK_FRAME_MASK                                                        0x000003FFL
+#define DP3_DP_MSE_LINK_TIMING__DP_MSE_LINK_LINE_MASK                                                         0x00030000L
+//DP3_DP_MSE_MISC_CNTL
+#define DP3_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE__SHIFT                                                        0x0
+#define DP3_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER__SHIFT                                                      0x8
+#define DP3_DP_MSE_MISC_CNTL__DP_MSE_BLANK_CODE_MASK                                                          0x00000001L
+#define DP3_DP_MSE_MISC_CNTL__DP_MSE_ZERO_ENCODER_MASK                                                        0x00000100L
+//DP3_DP_TEST_DEBUG_DATA
+#define DP3_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA__SHIFT                                                     0x0
+#define DP3_DP_TEST_DEBUG_DATA__DP_TEST_DEBUG_DATA_MASK                                                       0xFFFFFFFFL
+//DP3_DP_DPHY_BS_SR_SWAP_CNTL
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT__SHIFT                                                0x0
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE__SHIFT                                              0xf
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START__SHIFT                                          0x10
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_MASK                                                  0x000003FFL
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_BS_SR_SWAP_DONE_MASK                                                0x00008000L
+#define DP3_DP_DPHY_BS_SR_SWAP_CNTL__DPHY_LOAD_BS_COUNT_START_MASK                                            0x00010000L
+//DP3_DP_DPHY_HBR2_PATTERN_CONTROL
+#define DP3_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL__SHIFT                                 0x0
+#define DP3_DP_DPHY_HBR2_PATTERN_CONTROL__DP_DPHY_HBR2_PATTERN_CONTROL_MASK                                   0x00000007L
+//DP3_DP_MSE_SAT0_STATUS
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS__SHIFT                                                 0x0
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS__SHIFT                                             0x4
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS__SHIFT                                     0x5
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS__SHIFT                                          0x8
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS__SHIFT                                                 0x10
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS__SHIFT                                             0x14
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS__SHIFT                                     0x15
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS__SHIFT                                          0x18
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC0_STATUS_MASK                                                   0x00000007L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT0_STATUS_MASK                                               0x00000010L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE0_STATUS_MASK                                       0x00000020L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT0_STATUS_MASK                                            0x00003F00L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SRC1_STATUS_MASK                                                   0x00070000L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPT1_STATUS_MASK                                               0x00100000L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE1_STATUS_MASK                                       0x00200000L
+#define DP3_DP_MSE_SAT0_STATUS__DP_MSE_SAT_SLOT_COUNT1_STATUS_MASK                                            0x3F000000L
+//DP3_DP_MSE_SAT1_STATUS
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS__SHIFT                                                 0x0
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS__SHIFT                                             0x4
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS__SHIFT                                     0x5
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS__SHIFT                                          0x8
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS__SHIFT                                                 0x10
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS__SHIFT                                             0x14
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS__SHIFT                                     0x15
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS__SHIFT                                          0x18
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC2_STATUS_MASK                                                   0x00000007L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT2_STATUS_MASK                                               0x00000010L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE2_STATUS_MASK                                       0x00000020L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT2_STATUS_MASK                                            0x00003F00L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SRC3_STATUS_MASK                                                   0x00070000L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPT3_STATUS_MASK                                               0x00100000L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE3_STATUS_MASK                                       0x00200000L
+#define DP3_DP_MSE_SAT1_STATUS__DP_MSE_SAT_SLOT_COUNT3_STATUS_MASK                                            0x3F000000L
+//DP3_DP_MSE_SAT2_STATUS
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS__SHIFT                                                 0x0
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS__SHIFT                                             0x4
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS__SHIFT                                     0x5
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS__SHIFT                                          0x8
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS__SHIFT                                                 0x10
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS__SHIFT                                             0x14
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS__SHIFT                                     0x15
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS__SHIFT                                          0x18
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC4_STATUS_MASK                                                   0x00000007L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT4_STATUS_MASK                                               0x00000010L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE4_STATUS_MASK                                       0x00000020L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT4_STATUS_MASK                                            0x00003F00L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SRC5_STATUS_MASK                                                   0x00070000L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPT5_STATUS_MASK                                               0x00100000L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_ENCRYPTION_TYPE5_STATUS_MASK                                       0x00200000L
+#define DP3_DP_MSE_SAT2_STATUS__DP_MSE_SAT_SLOT_COUNT5_STATUS_MASK                                            0x3F000000L
+//DP3_DP_HBLANK_CONTROL
+#define DP3_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                                          0x0
+#define DP3_DP_HBLANK_CONTROL__DP_HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                                            0x0000FFFFL
+//DP3_DP_MSA_TIMING_PARAM1
+#define DP3_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL__SHIFT                                                        0x0
+#define DP3_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL__SHIFT                                                        0x10
+#define DP3_DP_MSA_TIMING_PARAM1__DP_MSA_VTOTAL_MASK                                                          0x0000FFFFL
+#define DP3_DP_MSA_TIMING_PARAM1__DP_MSA_HTOTAL_MASK                                                          0xFFFF0000L
+//DP3_DP_MSA_TIMING_PARAM2
+#define DP3_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART__SHIFT                                                        0x0
+#define DP3_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART__SHIFT                                                        0x10
+#define DP3_DP_MSA_TIMING_PARAM2__DP_MSA_VSTART_MASK                                                          0x0000FFFFL
+#define DP3_DP_MSA_TIMING_PARAM2__DP_MSA_HSTART_MASK                                                          0xFFFF0000L
+//DP3_DP_MSA_TIMING_PARAM3
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH__SHIFT                                                    0x0
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY__SHIFT                                                 0xf
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH__SHIFT                                                    0x10
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY__SHIFT                                                 0x1f
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCWIDTH_MASK                                                      0x00007FFFL
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_VSYNCPOLARITY_MASK                                                   0x00008000L
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCWIDTH_MASK                                                      0x7FFF0000L
+#define DP3_DP_MSA_TIMING_PARAM3__DP_MSA_HSYNCPOLARITY_MASK                                                   0x80000000L
+//DP3_DP_MSA_TIMING_PARAM4
+#define DP3_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT__SHIFT                                                       0x0
+#define DP3_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH__SHIFT                                                        0x10
+#define DP3_DP_MSA_TIMING_PARAM4__DP_MSA_VHEIGHT_MASK                                                         0x0000FFFFL
+#define DP3_DP_MSA_TIMING_PARAM4__DP_MSA_HWIDTH_MASK                                                          0xFFFF0000L
+//DP3_DP_MSO_CNTL
+#define DP3_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK__SHIFT                                                         0x0
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE__SHIFT                                                      0x4
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE__SHIFT                                                         0x8
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE__SHIFT                                                         0xc
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE__SHIFT                                                         0x10
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE__SHIFT                                                         0x14
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE__SHIFT                                                        0x18
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE__SHIFT                                                        0x1c
+#define DP3_DP_MSO_CNTL__DP_MSO_NUM_OF_SSTLINK_MASK                                                           0x00000003L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_STREAM_ENABLE_MASK                                                        0x000000F0L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ASP_ENABLE_MASK                                                           0x00000F00L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ATP_ENABLE_MASK                                                           0x0000F000L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_AIP_ENABLE_MASK                                                           0x000F0000L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_ACM_ENABLE_MASK                                                           0x00F00000L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_GSP0_ENABLE_MASK                                                          0x0F000000L
+#define DP3_DP_MSO_CNTL__DP_MSO_SEC_GSP1_ENABLE_MASK                                                          0xF0000000L
+//DP3_DP_MSO_CNTL1
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE__SHIFT                                                       0x0
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE__SHIFT                                                       0x4
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE__SHIFT                                                       0x8
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE__SHIFT                                                       0xc
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE__SHIFT                                                       0x10
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE__SHIFT                                                       0x14
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE__SHIFT                                                       0x1c
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP2_ENABLE_MASK                                                         0x0000000FL
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP3_ENABLE_MASK                                                         0x000000F0L
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP4_ENABLE_MASK                                                         0x00000F00L
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP5_ENABLE_MASK                                                         0x0000F000L
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP6_ENABLE_MASK                                                         0x000F0000L
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_GSP7_ENABLE_MASK                                                         0x00F00000L
+#define DP3_DP_MSO_CNTL1__DP_MSO_SEC_ISRC_ENABLE_MASK                                                         0xF0000000L
+//DP3_DP_STEER_FIFO_CNTL
+#define DP3_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN__SHIFT                       0x8
+#define DP3_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                        0x10
+#define DP3_DP_STEER_FIFO_CNTL__DP_STEER_FIFO_COMPRESSED_LOW_GRANULARITY_MODE_EN_MASK                         0x00000100L
+#define DP3_DP_STEER_FIFO_CNTL__DP_STEER_OUTPUT_PIXEL_PER_CYCLE_MASK                                          0x00030000L
+//DP3_DP_SEC_CNTL2
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND__SHIFT                                                             0x0
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING__SHIFT                                                     0x1
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED__SHIFT                                             0x2
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE__SHIFT                                                    0x3
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND__SHIFT                                                             0x4
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING__SHIFT                                                     0x5
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED__SHIFT                                             0x6
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE__SHIFT                                                    0x7
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND__SHIFT                                                             0x8
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING__SHIFT                                                     0x9
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED__SHIFT                                             0xa
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE__SHIFT                                                    0xb
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND__SHIFT                                                             0xc
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING__SHIFT                                                     0xd
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE__SHIFT                                                    0xf
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND__SHIFT                                                             0x10
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING__SHIFT                                                     0x11
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED__SHIFT                                             0x12
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE__SHIFT                                                    0x13
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND__SHIFT                                                             0x14
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING__SHIFT                                                     0x15
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED__SHIFT                                             0x16
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE__SHIFT                                                    0x17
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND__SHIFT                                                             0x18
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING__SHIFT                                                     0x19
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED__SHIFT                                             0x1a
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE__SHIFT                                                    0x1b
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP11_PPS__SHIFT                                                             0x1c
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_MASK                                                               0x00000001L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_PENDING_MASK                                                       0x00000002L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_DEADLINE_MISSED_MASK                                               0x00000004L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP1_SEND_ANY_LINE_MASK                                                      0x00000008L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_MASK                                                               0x00000010L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_PENDING_MASK                                                       0x00000020L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_DEADLINE_MISSED_MASK                                               0x00000040L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP2_SEND_ANY_LINE_MASK                                                      0x00000080L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_MASK                                                               0x00000100L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_PENDING_MASK                                                       0x00000200L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_DEADLINE_MISSED_MASK                                               0x00000400L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP3_SEND_ANY_LINE_MASK                                                      0x00000800L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_MASK                                                               0x00001000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_PENDING_MASK                                                       0x00002000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP4_SEND_ANY_LINE_MASK                                                      0x00008000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_MASK                                                               0x00010000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_PENDING_MASK                                                       0x00020000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_DEADLINE_MISSED_MASK                                               0x00040000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP5_SEND_ANY_LINE_MASK                                                      0x00080000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_MASK                                                               0x00100000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_PENDING_MASK                                                       0x00200000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_DEADLINE_MISSED_MASK                                               0x00400000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP6_SEND_ANY_LINE_MASK                                                      0x00800000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_MASK                                                               0x01000000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_PENDING_MASK                                                       0x02000000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_DEADLINE_MISSED_MASK                                               0x04000000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP7_SEND_ANY_LINE_MASK                                                      0x08000000L
+#define DP3_DP_SEC_CNTL2__DP_SEC_GSP11_PPS_MASK                                                               0x10000000L
+//DP3_DP_SEC_CNTL3
+#define DP3_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM__SHIFT                                                         0x0
+#define DP3_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_SEC_CNTL3__DP_SEC_GSP1_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP3_DP_SEC_CNTL3__DP_SEC_GSP2_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_SEC_CNTL4
+#define DP3_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM__SHIFT                                                         0x0
+#define DP3_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_SEC_CNTL4__DP_SEC_GSP3_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP3_DP_SEC_CNTL4__DP_SEC_GSP4_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_SEC_CNTL5
+#define DP3_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM__SHIFT                                                         0x0
+#define DP3_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_SEC_CNTL5__DP_SEC_GSP5_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP3_DP_SEC_CNTL5__DP_SEC_GSP6_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_SEC_CNTL6
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM__SHIFT                                                         0x0
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE__SHIFT                                                    0x10
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE__SHIFT                                                    0x11
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE__SHIFT                                                    0x12
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE__SHIFT                                                    0x13
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE__SHIFT                                                    0x14
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE__SHIFT                                                    0x15
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE__SHIFT                                                    0x16
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE__SHIFT                                                    0x17
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE__SHIFT                                                    0x18
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE__SHIFT                                                    0x19
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE__SHIFT                                                   0x1a
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE__SHIFT                                                   0x1b
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP7_LINE_NUM_MASK                                                           0x0000FFFFL
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP0_EN_DB_DISABLE_MASK                                                      0x00010000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP1_EN_DB_DISABLE_MASK                                                      0x00020000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP2_EN_DB_DISABLE_MASK                                                      0x00040000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP3_EN_DB_DISABLE_MASK                                                      0x00080000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP4_EN_DB_DISABLE_MASK                                                      0x00100000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP5_EN_DB_DISABLE_MASK                                                      0x00200000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP6_EN_DB_DISABLE_MASK                                                      0x00400000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP7_EN_DB_DISABLE_MASK                                                      0x00800000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP8_EN_DB_DISABLE_MASK                                                      0x01000000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP9_EN_DB_DISABLE_MASK                                                      0x02000000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP10_EN_DB_DISABLE_MASK                                                     0x04000000L
+#define DP3_DP_SEC_CNTL6__DP_SEC_GSP11_EN_DB_DISABLE_MASK                                                     0x08000000L
+//DP3_DP_SEC_CNTL7
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE__SHIFT                                                      0x0
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE__SHIFT                                                     0x1
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE__SHIFT                                                      0x4
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE__SHIFT                                                     0x5
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE__SHIFT                                                      0x8
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE__SHIFT                                                     0x9
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE__SHIFT                                                      0xc
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE__SHIFT                                                     0xd
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE__SHIFT                                                      0x10
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE__SHIFT                                                     0x11
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE__SHIFT                                                      0x14
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE__SHIFT                                                     0x15
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE__SHIFT                                                      0x18
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE__SHIFT                                                     0x19
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE__SHIFT                                                      0x1c
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE__SHIFT                                                     0x1d
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_ACTIVE_MASK                                                        0x00000001L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP0_SEND_IN_IDLE_MASK                                                       0x00000002L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_ACTIVE_MASK                                                        0x00000010L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP1_SEND_IN_IDLE_MASK                                                       0x00000020L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_ACTIVE_MASK                                                        0x00000100L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP2_SEND_IN_IDLE_MASK                                                       0x00000200L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_ACTIVE_MASK                                                        0x00001000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP3_SEND_IN_IDLE_MASK                                                       0x00002000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_ACTIVE_MASK                                                        0x00010000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP4_SEND_IN_IDLE_MASK                                                       0x00020000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_ACTIVE_MASK                                                        0x00100000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP5_SEND_IN_IDLE_MASK                                                       0x00200000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_ACTIVE_MASK                                                        0x01000000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP6_SEND_IN_IDLE_MASK                                                       0x02000000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_ACTIVE_MASK                                                        0x10000000L
+#define DP3_DP_SEC_CNTL7__DP_SEC_GSP7_SEND_IN_IDLE_MASK                                                       0x20000000L
+//DP3_DP_DB_CNTL
+#define DP3_DP_DB_CNTL__DP_DB_PENDING__SHIFT                                                                  0x0
+#define DP3_DP_DB_CNTL__DP_DB_TAKEN__SHIFT                                                                    0x4
+#define DP3_DP_DB_CNTL__DP_DB_TAKEN_CLR__SHIFT                                                                0x5
+#define DP3_DP_DB_CNTL__DP_DB_LOCK__SHIFT                                                                     0x8
+#define DP3_DP_DB_CNTL__DP_DB_DISABLE__SHIFT                                                                  0xc
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_PENDING__SHIFT                                                          0xf
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN__SHIFT                                                            0x10
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR__SHIFT                                                        0x11
+#define DP3_DP_DB_CNTL__DP_DB_PENDING_MASK                                                                    0x00000001L
+#define DP3_DP_DB_CNTL__DP_DB_TAKEN_MASK                                                                      0x00000010L
+#define DP3_DP_DB_CNTL__DP_DB_TAKEN_CLR_MASK                                                                  0x00000020L
+#define DP3_DP_DB_CNTL__DP_DB_LOCK_MASK                                                                       0x00000100L
+#define DP3_DP_DB_CNTL__DP_DB_DISABLE_MASK                                                                    0x00001000L
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_PENDING_MASK                                                            0x00008000L
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_MASK                                                              0x00010000L
+#define DP3_DP_DB_CNTL__DP_VUPDATE_DB_TAKEN_CLR_MASK                                                          0x00020000L
+//DP3_DP_MSA_VBID_MISC
+#define DP3_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE__SHIFT                                         0x0
+#define DP3_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                                      0x4
+#define DP3_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE__SHIFT                                                        0x8
+#define DP3_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE__SHIFT                                                        0x9
+#define DP3_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN__SHIFT                                                     0xc
+#define DP3_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN__SHIFT                                                     0xd
+#define DP3_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE__SHIFT                                                  0xf
+#define DP3_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM__SHIFT                                                        0x10
+#define DP3_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_MASK                                           0x00000003L
+#define DP3_DP_MSA_VBID_MISC__DP_MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                                        0x00000010L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_MASK                                                          0x00000100L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_MASK                                                          0x00000200L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID1_OVERRIDE_EN_MASK                                                       0x00001000L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID2_OVERRIDE_EN_MASK                                                       0x00002000L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID6_LINE_REFERENCE_MASK                                                    0x00008000L
+#define DP3_DP_MSA_VBID_MISC__DP_VBID6_LINE_NUM_MASK                                                          0xFFFF0000L
+//DP3_DP_SEC_METADATA_TRANSMISSION
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE__SHIFT                                0x0
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE__SHIFT                        0x1
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE__SHIFT                            0x4
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE__SHIFT                                  0x10
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_ENABLE_MASK                                  0x00000001L
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_REFERENCE_MASK                          0x00000002L
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_MSO_METADATA_PACKET_ENABLE_MASK                              0x000000F0L
+#define DP3_DP_SEC_METADATA_TRANSMISSION__DP_SEC_METADATA_PACKET_LINE_MASK                                    0xFFFF0000L
+//DP3_DP_ALPM_CNTL
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND__SHIFT                                                         0x0
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING__SHIFT                                                      0x1
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND__SHIFT                                                       0x2
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING__SHIFT                                                    0x3
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE__SHIFT                                            0x4
+#define DP3_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO__SHIFT                                        0x5
+#define DP3_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE__SHIFT                                                  0x6
+#define DP3_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP__SHIFT                                     0x7
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM__SHIFT                                                  0x8
+#define DP3_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS__SHIFT                                   0xb
+#define DP3_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN__SHIFT                                       0xc
+#define DP3_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE__SHIFT                                                       0xf
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM__SHIFT                                             0x10
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_SEND_MASK                                                           0x00000001L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PENDING_MASK                                                        0x00000002L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_SEND_MASK                                                         0x00000004L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_STANDBY_PENDING_MASK                                                      0x00000008L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_IMMEDIATE_MASK                                              0x00000010L
+#define DP3_DP_ALPM_CNTL__DP_LINK_TRAINING_SWITCH_BETWEEN_VIDEO_MASK                                          0x00000020L
+#define DP3_DP_ALPM_CNTL__DP_ALPM_SLEEP_SEQUENCE_MODE_MASK                                                    0x00000040L
+#define DP3_DP_ALPM_CNTL__DP_STOP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_MASK                                       0x00000080L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_PATTERN_NUM_MASK                                                    0x00000300L
+#define DP3_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_STATUS_MASK                                     0x00000800L
+#define DP3_DP_ALPM_CNTL__DP_FORCE_SCRAMBLED_ZERO_AFTER_SLEEP_EN_MASK                                         0x00001000L
+#define DP3_DP_ALPM_CNTL__DP_ALPM_LINE_REFERENCE_MASK                                                         0x00008000L
+#define DP3_DP_ALPM_CNTL__DP_ML_PHY_SLEEP_STANDBY_LINE_NUM_MASK                                               0xFFFF0000L
+//DP3_DP_GSP8_CNTL
+#define DP3_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE__SHIFT                                                       0x0
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE__SHIFT                                                           0x4
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND__SHIFT                                                             0x7
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING__SHIFT                                                     0xc
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_GSP8_CNTL__DP_MSO_SEC_GSP8_ENABLE_MASK                                                         0x0000000FL
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_ENABLE_MASK                                                             0x00000010L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_MASK                                                               0x00000080L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_PENDING_MASK                                                       0x00001000L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP3_DP_GSP8_CNTL__DP_SEC_GSP8_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_GSP9_CNTL
+#define DP3_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE__SHIFT                                                       0x0
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE__SHIFT                                                           0x4
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE__SHIFT                                                   0x5
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE__SHIFT                                                     0x6
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND__SHIFT                                                             0x7
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE__SHIFT                                                    0x8
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING__SHIFT                                                     0xc
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE__SHIFT                                                      0xd
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED__SHIFT                                             0xe
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM__SHIFT                                                         0x10
+#define DP3_DP_GSP9_CNTL__DP_MSO_SEC_GSP9_ENABLE_MASK                                                         0x0000000FL
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_ENABLE_MASK                                                             0x00000010L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_REFERENCE_MASK                                                     0x00000020L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_IN_IDLE_MASK                                                       0x00000040L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_MASK                                                               0x00000080L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ANY_LINE_MASK                                                      0x00000100L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_PENDING_MASK                                                       0x00001000L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_ACTIVE_MASK                                                        0x00002000L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_SEND_DEADLINE_MISSED_MASK                                               0x00004000L
+#define DP3_DP_GSP9_CNTL__DP_SEC_GSP9_LINE_NUM_MASK                                                           0xFFFF0000L
+//DP3_DP_GSP10_CNTL
+#define DP3_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE__SHIFT                                                     0x0
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE__SHIFT                                                         0x4
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND__SHIFT                                                           0x7
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING__SHIFT                                                   0xc
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM__SHIFT                                                       0x10
+#define DP3_DP_GSP10_CNTL__DP_MSO_SEC_GSP10_ENABLE_MASK                                                       0x0000000FL
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_ENABLE_MASK                                                           0x00000010L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_MASK                                                             0x00000080L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_PENDING_MASK                                                     0x00001000L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP3_DP_GSP10_CNTL__DP_SEC_GSP10_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP3_DP_GSP11_CNTL
+#define DP3_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE__SHIFT                                                     0x0
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE__SHIFT                                                         0x4
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE__SHIFT                                                 0x5
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE__SHIFT                                                   0x6
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND__SHIFT                                                           0x7
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE__SHIFT                                                  0x8
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING__SHIFT                                                   0xc
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE__SHIFT                                                    0xd
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED__SHIFT                                           0xe
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM__SHIFT                                                       0x10
+#define DP3_DP_GSP11_CNTL__DP_MSO_SEC_GSP11_ENABLE_MASK                                                       0x0000000FL
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_ENABLE_MASK                                                           0x00000010L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_REFERENCE_MASK                                                   0x00000020L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_IN_IDLE_MASK                                                     0x00000040L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_MASK                                                             0x00000080L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ANY_LINE_MASK                                                    0x00000100L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_PENDING_MASK                                                     0x00001000L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_ACTIVE_MASK                                                      0x00002000L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_SEND_DEADLINE_MISSED_MASK                                             0x00004000L
+#define DP3_DP_GSP11_CNTL__DP_SEC_GSP11_LINE_NUM_MASK                                                         0xFFFF0000L
+//DP3_DP_GSP_EN_DB_STATUS
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING__SHIFT                                             0x0
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING__SHIFT                                             0x1
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING__SHIFT                                             0x2
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING__SHIFT                                             0x3
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING__SHIFT                                             0x4
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING__SHIFT                                             0x5
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING__SHIFT                                             0x6
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING__SHIFT                                             0x7
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING__SHIFT                                             0x8
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING__SHIFT                                             0x9
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING__SHIFT                                            0xa
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING__SHIFT                                            0xb
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP0_EN_DB_PENDING_MASK                                               0x00000001L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP1_EN_DB_PENDING_MASK                                               0x00000002L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP2_EN_DB_PENDING_MASK                                               0x00000004L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP3_EN_DB_PENDING_MASK                                               0x00000008L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP4_EN_DB_PENDING_MASK                                               0x00000010L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP5_EN_DB_PENDING_MASK                                               0x00000020L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP6_EN_DB_PENDING_MASK                                               0x00000040L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP7_EN_DB_PENDING_MASK                                               0x00000080L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP8_EN_DB_PENDING_MASK                                               0x00000100L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP9_EN_DB_PENDING_MASK                                               0x00000200L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP10_EN_DB_PENDING_MASK                                              0x00000400L
+#define DP3_DP_GSP_EN_DB_STATUS__DP_SEC_GSP11_EN_DB_PENDING_MASK                                              0x00000800L
+//DP3_DP_AUXLESS_ALPM_CNTL1
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT__SHIFT                                              0x4
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY__SHIFT                                               0x8
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL__SHIFT                                            0x14
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE__SHIFT                                     0x1f
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_REPEAT_MASK                                                0x000000F0L
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_DELAY_MASK                                                 0x0007FF00L
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_ML_PHY_SLEEP_INTERVAL_MASK                                              0x1FF00000L
+#define DP3_DP_AUXLESS_ALPM_CNTL1__DP_SET_AUXLESS_ALPM_SLEEP_STATE_MASK                                       0x80000000L
+//DP3_DP_AUXLESS_ALPM_CNTL2
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME__SHIFT                                           0x0
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND__SHIFT                                                 0x7
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE__SHIFT                                            0x10
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING__SHIFT                                              0x11
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE__SHIFT                                            0x12
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING__SHIFT                                              0x13
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD__SHIFT                                          0x14
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ML_PHY_SLEEP_HOLD_TIME_MASK                                             0x0000007FL
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_SEND_MASK                                                   0x00000080L
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_IMMEDIATE_MASK                                              0x00010000L
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_WAKEUP_PENDING_MASK                                                0x00020000L
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_IMMEDIATE_MASK                                              0x00040000L
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_FEC_EN_PENDING_MASK                                                0x00080000L
+#define DP3_DP_AUXLESS_ALPM_CNTL2__DP_ALPM_ML_PHY_LOCK_PERIOD_MASK                                            0x3FF00000L
+//DP3_DP_AUXLESS_ALPM_CNTL3
+#define DP3_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM__SHIFT                                             0x0
+#define DP3_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM__SHIFT                                             0x10
+#define DP3_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_WAKEUP_LINE_NUM_MASK                                               0x0000FFFFL
+#define DP3_DP_AUXLESS_ALPM_CNTL3__DP_ALPM_FEC_EN_LINE_NUM_MASK                                               0xFFFF0000L
+//DP3_DP_AUXLESS_ALPM_CNTL4
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN__SHIFT                                                  0x1
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL__SHIFT                                   0x2
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME__SHIFT                                     0x3
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE__SHIFT                                       0x4
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS__SHIFT                                           0x5
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE__SHIFT                                               0x6
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM__SHIFT                                                   0x18
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_MASK                                                    0x00000002L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_SLEEP_PATTERN_SEL_MASK                                     0x00000004L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FORCE_WAKEUP_NEXT_FRAME_MASK                                       0x00000008L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_DIS_IMMEDIATE_MASK                                         0x00000010L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_HW_MODE_EN_STATUS_MASK                                             0x00000020L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_CURRENT_STATE_MASK                                                 0x00000040L
+#define DP3_DP_AUXLESS_ALPM_CNTL4__DP_ALPM_FRAME_NUM_MASK                                                     0xFF000000L
+//DP3_DP_AUXLESS_ALPM_CNTL5
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK__SHIFT                                       0x0
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED__SHIFT                                   0x1
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                                     0x2
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR__SHIFT                                      0x3
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM__SHIFT                                  0x8
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM__SHIFT                                   0x10
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_MASK_MASK                                         0x00000001L
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_OCCURRED_MASK                                     0x00000002L
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                                       0x00000004L
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_CLEAR_MASK                                        0x00000008L
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_FRAME_NUM_MASK                                    0x0000FF00L
+#define DP3_DP_AUXLESS_ALPM_CNTL5__DP_ALPM_WAKEUP_INTERRUPT_LINE_NUM_MASK                                     0xFFFF0000L
+//DP3_DP_STREAM_SYMBOL_COUNT_STATUS
+#define DP3_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT__SHIFT                                          0x0
+#define DP3_DP_STREAM_SYMBOL_COUNT_STATUS__DP_STREAM_BS_COUNT_MASK                                            0x0000FFFFL
+//DP3_DP_STREAM_SYMBOL_COUNT_CONTROL
+#define DP3_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE__SHIFT                                  0x0
+#define DP3_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET__SHIFT                                   0x4
+#define DP3_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_ENABLE_MASK                                    0x00000001L
+#define DP3_DP_STREAM_SYMBOL_COUNT_CONTROL__DP_STREAM_BS_COUNT_RESET_MASK                                     0x00000010L
+//DP3_DP_LINK_SYMBOL_COUNT_STATUS0
+#define DP3_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT__SHIFT                                             0x0
+#define DP3_DP_LINK_SYMBOL_COUNT_STATUS0__DP_LINK_SR_COUNT_MASK                                               0x0000FFFFL
+//DP3_DP_LINK_SYMBOL_COUNT_STATUS1
+#define DP3_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT__SHIFT                                          0x0
+#define DP3_DP_LINK_SYMBOL_COUNT_STATUS1__DP_LINK_CYCLE_COUNT_MASK                                            0xFFFFFFFFL
+//DP3_DP_LINK_SYMBOL_COUNT_CONTROL
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE__SHIFT                                      0x0
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET__SHIFT                                       0x4
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE__SHIFT                                   0x8
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET__SHIFT                                    0xc
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_ENABLE_MASK                                        0x00000001L
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_SR_COUNT_RESET_MASK                                         0x00000010L
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_ENABLE_MASK                                     0x00000100L
+#define DP3_DP_LINK_SYMBOL_COUNT_CONTROL__DP_LINK_CYCLE_COUNT_RESET_MASK                                      0x00001000L
+//DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT           0x0
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING__SHIFT  0x8
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK             0x00000001L
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+#define DP3_DP_SYM8_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_PENDING_MASK  0x00000100L
+//DP3_DP_DPHY_FAST_TRAINING
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE__SHIFT                                       0x0
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START__SHIFT                                         0x1
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN__SHIFT                            0x2
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING__SHIFT                              0x4
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME__SHIFT                                         0x8
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME__SHIFT                                         0x14
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_RX_FAST_TRAINING_CAPABLE_MASK                                         0x00000001L
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_SW_FAST_TRAINING_START_MASK                                           0x00000002L
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_VBLANK_EDGE_DETECT_EN_MASK                              0x00000004L
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_STREAM_RESET_DURING_FAST_TRAINING_MASK                                0x00000010L
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP1_TIME_MASK                                           0x000FFF00L
+#define DP3_DP_DPHY_FAST_TRAINING__DPHY_FAST_TRAINING_TP2_TIME_MASK                                           0xFFF00000L
+//DP3_DP_DPHY_FAST_TRAINING_STATUS
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE__SHIFT                                     0x0
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED__SHIFT                         0x4
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK__SHIFT                             0x8
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK__SHIFT                              0xc
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_STATE_MASK                                       0x00000007L
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_OCCURRED_MASK                           0x00000010L
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_MASK_MASK                               0x00000100L
+#define DP3_DP_DPHY_FAST_TRAINING_STATUS__DPHY_FAST_TRAINING_COMPLETE_ACK_MASK                                0x00001000L
+
+
+// addressBlock: dce_dc_dio_dig3_dispdec
+//DIG3_DIG_FE_CNTL
+#define DIG3_DIG_FE_CNTL__DIG_SOURCE_SELECT__SHIFT                                                            0x0
+#define DIG3_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT__SHIFT                                                        0x4
+#define DIG3_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN__SHIFT                                                       0x8
+#define DIG3_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT__SHIFT                                                    0xc
+#define DIG3_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN__SHIFT                                                        0x14
+#define DIG3_DIG_FE_CNTL__DIG_SOURCE_SELECT_MASK                                                              0x00000007L
+#define DIG3_DIG_FE_CNTL__DIG_STEREOSYNC_SELECT_MASK                                                          0x00000070L
+#define DIG3_DIG_FE_CNTL__DIG_STEREOSYNC_GATE_EN_MASK                                                         0x00000100L
+#define DIG3_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_SELECT_MASK                                                      0x00007000L
+#define DIG3_DIG_FE_CNTL__DIG_DIGITAL_BYPASS_EN_MASK                                                          0x00100000L
+//DIG3_DIG_FE_CLK_CNTL
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_MODE__SHIFT                                                              0x0
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN__SHIFT                                                            0x4
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON__SHIFT                                                0xa
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON__SHIFT                                              0xb
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON__SHIFT                                          0xc
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON__SHIFT                                         0xd
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON__SHIFT                                             0xe
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_MODE_MASK                                                                0x00000007L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_CLK_EN_MASK                                                              0x00000010L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_DISPCLK_G_CLOCK_ON_MASK                                                  0x00000400L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_CLOCK_ON_MASK                                                0x00000800L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_APG_CLOCK_ON_MASK                                            0x00001000L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SYMCLK_FE_G_TMDS_CLOCK_ON_MASK                                           0x00002000L
+#define DIG3_DIG_FE_CLK_CNTL__DIG_FE_SOCCLK_G_APG_CLOCK_ON_MASK                                               0x00004000L
+//DIG3_DIG_FE_EN_CNTL
+#define DIG3_DIG_FE_EN_CNTL__DIG_FE_ENABLE__SHIFT                                                             0x0
+#define DIG3_DIG_FE_EN_CNTL__DIG_FE_ENABLE_MASK                                                               0x00000001L
+//DIG3_DIG_OUTPUT_CRC_CNTL
+#define DIG3_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN__SHIFT                                                    0x0
+#define DIG3_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL__SHIFT                                              0x8
+#define DIG3_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_EN_MASK                                                      0x00000001L
+#define DIG3_DIG_OUTPUT_CRC_CNTL__DIG_OUTPUT_CRC_DATA_SEL_MASK                                                0x00000300L
+//DIG3_DIG_OUTPUT_CRC_RESULT
+#define DIG3_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT__SHIFT                                              0x0
+#define DIG3_DIG_OUTPUT_CRC_RESULT__DIG_OUTPUT_CRC_RESULT_MASK                                                0x3FFFFFFFL
+//DIG3_DIG_CLOCK_PATTERN
+#define DIG3_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN__SHIFT                                                      0x0
+#define DIG3_DIG_CLOCK_PATTERN__DIG_CLOCK_PATTERN_MASK                                                        0x000003FFL
+//DIG3_DIG_TEST_PATTERN
+#define DIG3_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN__SHIFT                                                 0x0
+#define DIG3_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL__SHIFT                                              0x1
+#define DIG3_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN__SHIFT                                               0x4
+#define DIG3_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET__SHIFT                                                0x5
+#define DIG3_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN__SHIFT                                      0x6
+#define DIG3_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN__SHIFT                                                 0x10
+#define DIG3_DIG_TEST_PATTERN__DIG_TEST_PATTERN_OUT_EN_MASK                                                   0x00000001L
+#define DIG3_DIG_TEST_PATTERN__DIG_HALF_CLOCK_PATTERN_SEL_MASK                                                0x00000002L
+#define DIG3_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_OUT_EN_MASK                                                 0x00000010L
+#define DIG3_DIG_TEST_PATTERN__DIG_RANDOM_PATTERN_RESET_MASK                                                  0x00000020L
+#define DIG3_DIG_TEST_PATTERN__DIG_TEST_PATTERN_EXTERNAL_RESET_EN_MASK                                        0x00000040L
+#define DIG3_DIG_TEST_PATTERN__DIG_STATIC_TEST_PATTERN_MASK                                                   0x03FF0000L
+//DIG3_DIG_RANDOM_PATTERN_SEED
+#define DIG3_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED__SHIFT                                          0x0
+#define DIG3_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY__SHIFT                                       0x18
+#define DIG3_DIG_RANDOM_PATTERN_SEED__DIG_RANDOM_PATTERN_SEED_MASK                                            0x00FFFFFFL
+#define DIG3_DIG_RANDOM_PATTERN_SEED__DIG_RAN_PAT_DURING_DE_ONLY_MASK                                         0x01000000L
+//DIG3_DIG_FIFO_CTRL0
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE__SHIFT                                                           0x0
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_RESET__SHIFT                                                            0x1
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL__SHIFT                                                 0x2
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC__SHIFT                                                   0x8
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE__SHIFT                                           0x9
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE__SHIFT                                                       0x14
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_ERROR__SHIFT                                                            0x1c
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_ENABLE_MASK                                                             0x00000001L
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_RESET_MASK                                                              0x00000002L
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_READ_START_LEVEL_MASK                                                   0x000000FCL
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_READ_CLOCK_SRC_MASK                                                     0x00000100L
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_OUTPUT_PIXEL_PER_CYCLE_MASK                                             0x00000600L
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_RESET_DONE_MASK                                                         0x00100000L
+#define DIG3_DIG_FIFO_CTRL0__DIG_FIFO_ERROR_MASK                                                              0x30000000L
+//DIG3_DIG_FIFO_CTRL1
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL__SHIFT                                              0x1
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL__SHIFT                                                  0x2
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY__SHIFT                                                  0x8
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL__SHIFT                                                0xa
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL__SHIFT                                                    0x10
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL__SHIFT                                                    0x16
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED__SHIFT                                                       0x1d
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE__SHIFT                                              0x1e
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX__SHIFT                                              0x1f
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_USE_OVERWRITE_LEVEL_MASK                                                0x00000002L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_OVERWRITE_LEVEL_MASK                                                    0x000000FCL
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_LEVEL_DET_DELAY_MASK                                                    0x00000300L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_CAL_AVERAGE_LEVEL_MASK                                                  0x0000FC00L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_MAXIMUM_LEVEL_MASK                                                      0x001F0000L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_MINIMUM_LEVEL_MASK                                                      0x03C00000L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_CALIBRATED_MASK                                                         0x20000000L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECAL_AVERAGE_MASK                                                0x40000000L
+#define DIG3_DIG_FIFO_CTRL1__DIG_FIFO_FORCE_RECOMP_MINMAX_MASK                                                0x80000000L
+//DIG3_HDMI_METADATA_PACKET_CONTROL
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE__SHIFT                                 0x0
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE__SHIFT                         0x4
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED__SHIFT                                 0x8
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE__SHIFT                                   0x10
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE_MASK                                   0x00000001L
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE_MASK                           0x00000010L
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED_MASK                                   0x00000100L
+#define DIG3_HDMI_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_MASK                                     0xFFFF0000L
+//DIG3_HDMI_CONTROL
+#define DIG3_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN__SHIFT                                                       0x1
+#define DIG3_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE__SHIFT                                                     0x2
+#define DIG3_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED__SHIFT                                            0x3
+#define DIG3_HDMI_CONTROL__HDMI_ERROR_ACK__SHIFT                                                              0x8
+#define DIG3_HDMI_CONTROL__HDMI_ERROR_MASK__SHIFT                                                             0x9
+#define DIG3_HDMI_CONTROL__DOLBY_VISION_EN__SHIFT                                                             0xa
+#define DIG3_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED__SHIFT                                         0xb
+#define DIG3_HDMI_CONTROL__TMDS_PIXEL_ENCODING__SHIFT                                                         0xc
+#define DIG3_HDMI_CONTROL__TMDS_COLOR_FORMAT__SHIFT                                                           0xd
+#define DIG3_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM__SHIFT                                           0x10
+#define DIG3_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE__SHIFT                                                      0x18
+#define DIG3_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH__SHIFT                                                       0x1c
+#define DIG3_HDMI_CONTROL__HDMI_DATA_SCRAMBLE_EN_MASK                                                         0x00000002L
+#define DIG3_HDMI_CONTROL__HDMI_CLOCK_CHANNEL_RATE_MASK                                                       0x00000004L
+#define DIG3_HDMI_CONTROL__HDMI_NO_EXTRA_NULL_PACKET_FILLED_MASK                                              0x00000008L
+#define DIG3_HDMI_CONTROL__HDMI_ERROR_ACK_MASK                                                                0x00000100L
+#define DIG3_HDMI_CONTROL__HDMI_ERROR_MASK_MASK                                                               0x00000200L
+#define DIG3_HDMI_CONTROL__DOLBY_VISION_EN_MASK                                                               0x00000400L
+#define DIG3_HDMI_CONTROL__DOLBY_VISION_METADATA_PACKET_MISSED_MASK                                           0x00000800L
+#define DIG3_HDMI_CONTROL__TMDS_PIXEL_ENCODING_MASK                                                           0x00001000L
+#define DIG3_HDMI_CONTROL__TMDS_COLOR_FORMAT_MASK                                                             0x00006000L
+#define DIG3_HDMI_CONTROL__HDMI_UNSCRAMBLED_CONTROL_LINE_NUM_MASK                                             0x003F0000L
+#define DIG3_HDMI_CONTROL__HDMI_DEEP_COLOR_ENABLE_MASK                                                        0x01000000L
+#define DIG3_HDMI_CONTROL__HDMI_DEEP_COLOR_DEPTH_MASK                                                         0x30000000L
+//DIG3_HDMI_STATUS
+#define DIG3_HDMI_STATUS__HDMI_ACTIVE_AVMUTE__SHIFT                                                           0x0
+#define DIG3_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR__SHIFT                                                      0x10
+#define DIG3_HDMI_STATUS__HDMI_ERROR_INT__SHIFT                                                               0x1b
+#define DIG3_HDMI_STATUS__HDMI_ACTIVE_AVMUTE_MASK                                                             0x00000001L
+#define DIG3_HDMI_STATUS__HDMI_AUDIO_PACKET_ERROR_MASK                                                        0x00010000L
+#define DIG3_HDMI_STATUS__HDMI_ERROR_INT_MASK                                                                 0x08000000L
+//DIG3_HDMI_AUDIO_PACKET_CONTROL
+#define DIG3_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN__SHIFT                                            0x4
+#define DIG3_HDMI_AUDIO_PACKET_CONTROL__HDMI_AUDIO_DELAY_EN_MASK                                              0x00000030L
+//DIG3_HDMI_ACR_PACKET_CONTROL
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND__SHIFT                                                    0x0
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT__SHIFT                                                    0x1
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT__SHIFT                                                  0x4
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE__SHIFT                                                  0x8
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND__SHIFT                                               0xc
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE__SHIFT                                              0x10
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SEND_MASK                                                      0x00000001L
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_CONT_MASK                                                      0x00000002L
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SELECT_MASK                                                    0x00000030L
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE_MASK                                                    0x00000100L
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_MASK                                                 0x00001000L
+#define DIG3_HDMI_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE_MASK                                                0x00070000L
+//DIG3_HDMI_VBI_PACKET_CONTROL
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND__SHIFT                                                   0x0
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND__SHIFT                                                     0x4
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT__SHIFT                                                     0x5
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND__SHIFT                                                   0x8
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT__SHIFT                                                   0x9
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND__SHIFT                                                    0xc
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE__SHIFT                                                   0x10
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE__SHIFT                                                    0x18
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_NULL_SEND_MASK                                                     0x00000001L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_GC_SEND_MASK                                                       0x00000010L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_GC_CONT_MASK                                                       0x00000020L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_SEND_MASK                                                     0x00000100L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_CONT_MASK                                                     0x00000200L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_SEND_MASK                                                      0x00001000L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ISRC_LINE_MASK                                                     0x003F0000L
+#define DIG3_HDMI_VBI_PACKET_CONTROL__HDMI_ACP_LINE_MASK                                                      0x3F000000L
+//DIG3_HDMI_INFOFRAME_CONTROL0
+#define DIG3_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND__SHIFT                                             0x4
+#define DIG3_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE__SHIFT                                             0x8
+#define DIG3_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_SEND_MASK                                               0x00000010L
+#define DIG3_HDMI_INFOFRAME_CONTROL0__HDMI_AUDIO_INFO_LINE_MASK                                               0x00003F00L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT__SHIFT                                          0x1
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE__SHIFT                                0x2
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND__SHIFT                                          0x4
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT__SHIFT                                          0x5
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE__SHIFT                                0x6
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND__SHIFT                                          0x8
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT__SHIFT                                          0x9
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE__SHIFT                                0xa
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE__SHIFT                           0xb
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND__SHIFT                                          0xc
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT__SHIFT                                          0xd
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE__SHIFT                                0xe
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE__SHIFT                           0xf
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT__SHIFT                                          0x11
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE__SHIFT                                0x12
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE__SHIFT                           0x13
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND__SHIFT                                          0x14
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT__SHIFT                                          0x15
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE__SHIFT                                0x16
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE__SHIFT                           0x17
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND__SHIFT                                          0x18
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT__SHIFT                                          0x19
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE__SHIFT                                0x1a
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE__SHIFT                           0x1b
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND__SHIFT                                          0x1c
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT__SHIFT                                          0x1d
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE__SHIFT                                0x1e
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE__SHIFT                           0x1f
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND_MASK                                            0x00000001L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT_MASK                                            0x00000002L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND_MASK                                            0x00000010L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT_MASK                                            0x00000020L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND_MASK                                            0x00000100L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT_MASK                                            0x00000200L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE_MASK                                  0x00000400L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_UPDATE_LOCK_DISABLE_MASK                             0x00000800L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND_MASK                                            0x00001000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT_MASK                                            0x00002000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE_MASK                                  0x00004000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_UPDATE_LOCK_DISABLE_MASK                             0x00008000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND_MASK                                            0x00010000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT_MASK                                            0x00020000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE_MASK                                  0x00040000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_UPDATE_LOCK_DISABLE_MASK                             0x00080000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND_MASK                                            0x00100000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT_MASK                                            0x00200000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE_MASK                                  0x00400000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_UPDATE_LOCK_DISABLE_MASK                             0x00800000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND_MASK                                            0x01000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT_MASK                                            0x02000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE_MASK                                  0x04000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_UPDATE_LOCK_DISABLE_MASK                             0x08000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND_MASK                                            0x10000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT_MASK                                            0x20000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE_MASK                                  0x40000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_UPDATE_LOCK_DISABLE_MASK                             0x80000000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL6
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT__SHIFT                                          0x1
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE__SHIFT                                0x2
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE__SHIFT                           0x3
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND__SHIFT                                          0x4
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT__SHIFT                                          0x5
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE__SHIFT                                0x6
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE__SHIFT                           0x7
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND__SHIFT                                         0x8
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT__SHIFT                                         0x9
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE__SHIFT                               0xa
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE__SHIFT                          0xb
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND__SHIFT                                         0xc
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT__SHIFT                                         0xd
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE__SHIFT                               0xe
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE__SHIFT                          0xf
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND__SHIFT                                         0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT__SHIFT                                         0x11
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE__SHIFT                               0x12
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE__SHIFT                          0x13
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND__SHIFT                                         0x14
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT__SHIFT                                         0x15
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE__SHIFT                               0x16
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE__SHIFT                          0x17
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND__SHIFT                                         0x18
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT__SHIFT                                         0x19
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE__SHIFT                               0x1a
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE__SHIFT                          0x1b
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_SEND_MASK                                            0x00000001L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_CONT_MASK                                            0x00000002L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_LINE_REFERENCE_MASK                                  0x00000004L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC8_UPDATE_LOCK_DISABLE_MASK                             0x00000008L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_SEND_MASK                                            0x00000010L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_CONT_MASK                                            0x00000020L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_LINE_REFERENCE_MASK                                  0x00000040L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC9_UPDATE_LOCK_DISABLE_MASK                             0x00000080L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_SEND_MASK                                           0x00000100L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_CONT_MASK                                           0x00000200L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_LINE_REFERENCE_MASK                                 0x00000400L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC10_UPDATE_LOCK_DISABLE_MASK                            0x00000800L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_SEND_MASK                                           0x00001000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_CONT_MASK                                           0x00002000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_LINE_REFERENCE_MASK                                 0x00004000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC11_UPDATE_LOCK_DISABLE_MASK                            0x00008000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_SEND_MASK                                           0x00010000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_CONT_MASK                                           0x00020000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_LINE_REFERENCE_MASK                                 0x00040000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC12_UPDATE_LOCK_DISABLE_MASK                            0x00080000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_SEND_MASK                                           0x00100000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_CONT_MASK                                           0x00200000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_LINE_REFERENCE_MASK                                 0x00400000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC13_UPDATE_LOCK_DISABLE_MASK                            0x00800000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_SEND_MASK                                           0x01000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_CONT_MASK                                           0x02000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_LINE_REFERENCE_MASK                                 0x04000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL6__HDMI_GENERIC14_UPDATE_LOCK_DISABLE_MASK                            0x08000000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL5
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND__SHIFT                                0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING__SHIFT                        0x1
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND__SHIFT                                0x2
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING__SHIFT                        0x3
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND__SHIFT                                0x4
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING__SHIFT                        0x5
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND__SHIFT                                0x6
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING__SHIFT                        0x7
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND__SHIFT                                0x8
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING__SHIFT                        0x9
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND__SHIFT                                0xa
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING__SHIFT                        0xb
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND__SHIFT                                0xc
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING__SHIFT                        0xd
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND__SHIFT                                0xe
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING__SHIFT                        0xf
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND__SHIFT                                0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING__SHIFT                        0x11
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND__SHIFT                                0x12
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING__SHIFT                        0x13
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND__SHIFT                               0x14
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING__SHIFT                       0x15
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND__SHIFT                               0x16
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING__SHIFT                       0x17
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND__SHIFT                               0x18
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING__SHIFT                       0x19
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND__SHIFT                               0x1a
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING__SHIFT                       0x1b
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND__SHIFT                               0x1c
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING__SHIFT                       0x1d
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_MASK                                  0x00000001L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING_MASK                          0x00000002L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_MASK                                  0x00000004L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING_MASK                          0x00000008L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_MASK                                  0x00000010L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING_MASK                          0x00000020L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_MASK                                  0x00000040L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING_MASK                          0x00000080L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_MASK                                  0x00000100L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING_MASK                          0x00000200L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_MASK                                  0x00000400L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING_MASK                          0x00000800L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_MASK                                  0x00001000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING_MASK                          0x00002000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_MASK                                  0x00004000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING_MASK                          0x00008000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_MASK                                  0x00010000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING_MASK                          0x00020000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_MASK                                  0x00040000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING_MASK                          0x00080000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_MASK                                 0x00100000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING_MASK                         0x00200000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_MASK                                 0x00400000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING_MASK                         0x00800000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_MASK                                 0x01000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING_MASK                         0x02000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_MASK                                 0x04000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING_MASK                         0x08000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_MASK                                 0x10000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL5__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING_MASK                         0x20000000L
+//DIG3_HDMI_GC
+#define DIG3_HDMI_GC__HDMI_GC_AVMUTE__SHIFT                                                                   0x0
+#define DIG3_HDMI_GC__HDMI_GC_AVMUTE_CONT__SHIFT                                                              0x2
+#define DIG3_HDMI_GC__HDMI_DEFAULT_PHASE__SHIFT                                                               0x4
+#define DIG3_HDMI_GC__HDMI_PACKING_PHASE__SHIFT                                                               0x8
+#define DIG3_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE__SHIFT                                                      0xc
+#define DIG3_HDMI_GC__HDMI_GC_AVMUTE_MASK                                                                     0x00000001L
+#define DIG3_HDMI_GC__HDMI_GC_AVMUTE_CONT_MASK                                                                0x00000004L
+#define DIG3_HDMI_GC__HDMI_DEFAULT_PHASE_MASK                                                                 0x00000010L
+#define DIG3_HDMI_GC__HDMI_PACKING_PHASE_MASK                                                                 0x00000F00L
+#define DIG3_HDMI_GC__HDMI_PACKING_PHASE_OVERRIDE_MASK                                                        0x00001000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL1
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC0_LINE_MASK                                            0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL1__HDMI_GENERIC1_LINE_MASK                                            0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL2
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_LINE_MASK                                            0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_LINE_MASK                                            0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL3
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC4_LINE_MASK                                            0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL3__HDMI_GENERIC5_LINE_MASK                                            0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL4
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC6_LINE_MASK                                            0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL4__HDMI_GENERIC7_LINE_MASK                                            0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL7
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE__SHIFT                                          0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE__SHIFT                                          0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC8_LINE_MASK                                            0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL7__HDMI_GENERIC9_LINE_MASK                                            0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL8
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE__SHIFT                                         0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE__SHIFT                                         0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC10_LINE_MASK                                           0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL8__HDMI_GENERIC11_LINE_MASK                                           0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL9
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE__SHIFT                                         0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE__SHIFT                                         0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC12_LINE_MASK                                           0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL9__HDMI_GENERIC13_LINE_MASK                                           0xFFFF0000L
+//DIG3_HDMI_GENERIC_PACKET_CONTROL10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE__SHIFT                                        0x0
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING__SHIFT                                0x10
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING__SHIFT                                0x11
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING__SHIFT                                0x12
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING__SHIFT                                0x13
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING__SHIFT                                0x14
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING__SHIFT                                0x15
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING__SHIFT                                0x16
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING__SHIFT                                0x17
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING__SHIFT                                0x18
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING__SHIFT                                0x19
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING__SHIFT                               0x1a
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING__SHIFT                               0x1b
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING__SHIFT                               0x1c
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING__SHIFT                               0x1d
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING__SHIFT                               0x1e
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_LINE_MASK                                          0x0000FFFFL
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC0_EN_DB_PENDING_MASK                                  0x00010000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC1_EN_DB_PENDING_MASK                                  0x00020000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC2_EN_DB_PENDING_MASK                                  0x00040000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC3_EN_DB_PENDING_MASK                                  0x00080000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC4_EN_DB_PENDING_MASK                                  0x00100000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC5_EN_DB_PENDING_MASK                                  0x00200000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC6_EN_DB_PENDING_MASK                                  0x00400000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC7_EN_DB_PENDING_MASK                                  0x00800000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC8_EN_DB_PENDING_MASK                                  0x01000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC9_EN_DB_PENDING_MASK                                  0x02000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC10_EN_DB_PENDING_MASK                                 0x04000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC11_EN_DB_PENDING_MASK                                 0x08000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC12_EN_DB_PENDING_MASK                                 0x10000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC13_EN_DB_PENDING_MASK                                 0x20000000L
+#define DIG3_HDMI_GENERIC_PACKET_CONTROL10__HDMI_GENERIC14_EN_DB_PENDING_MASK                                 0x40000000L
+//DIG3_HDMI_DB_CONTROL
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_PENDING__SHIFT                                                          0x0
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_TAKEN__SHIFT                                                            0x4
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR__SHIFT                                                        0x5
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_LOCK__SHIFT                                                             0x8
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_DISABLE__SHIFT                                                          0xc
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_PENDING__SHIFT                                                       0xf
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN__SHIFT                                                         0x10
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR__SHIFT                                                     0x11
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_PENDING_MASK                                                            0x00000001L
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_TAKEN_MASK                                                              0x00000010L
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_TAKEN_CLR_MASK                                                          0x00000020L
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_LOCK_MASK                                                               0x00000100L
+#define DIG3_HDMI_DB_CONTROL__HDMI_DB_DISABLE_MASK                                                            0x00001000L
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_PENDING_MASK                                                         0x00008000L
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_MASK                                                           0x00010000L
+#define DIG3_HDMI_DB_CONTROL__VUPDATE_DB_TAKEN_CLR_MASK                                                       0x00020000L
+//DIG3_HDMI_ACR_32_0
+#define DIG3_HDMI_ACR_32_0__HDMI_ACR_CTS_32__SHIFT                                                            0xc
+#define DIG3_HDMI_ACR_32_0__HDMI_ACR_CTS_32_MASK                                                              0xFFFFF000L
+//DIG3_HDMI_ACR_32_1
+#define DIG3_HDMI_ACR_32_1__HDMI_ACR_N_32__SHIFT                                                              0x0
+#define DIG3_HDMI_ACR_32_1__HDMI_ACR_N_32_MASK                                                                0x000FFFFFL
+//DIG3_HDMI_ACR_44_0
+#define DIG3_HDMI_ACR_44_0__HDMI_ACR_CTS_44__SHIFT                                                            0xc
+#define DIG3_HDMI_ACR_44_0__HDMI_ACR_CTS_44_MASK                                                              0xFFFFF000L
+//DIG3_HDMI_ACR_44_1
+#define DIG3_HDMI_ACR_44_1__HDMI_ACR_N_44__SHIFT                                                              0x0
+#define DIG3_HDMI_ACR_44_1__HDMI_ACR_N_44_MASK                                                                0x000FFFFFL
+//DIG3_HDMI_ACR_48_0
+#define DIG3_HDMI_ACR_48_0__HDMI_ACR_CTS_48__SHIFT                                                            0xc
+#define DIG3_HDMI_ACR_48_0__HDMI_ACR_CTS_48_MASK                                                              0xFFFFF000L
+//DIG3_HDMI_ACR_48_1
+#define DIG3_HDMI_ACR_48_1__HDMI_ACR_N_48__SHIFT                                                              0x0
+#define DIG3_HDMI_ACR_48_1__HDMI_ACR_N_48_MASK                                                                0x000FFFFFL
+//DIG3_HDMI_ACR_STATUS_0
+#define DIG3_HDMI_ACR_STATUS_0__HDMI_ACR_CTS__SHIFT                                                           0xc
+#define DIG3_HDMI_ACR_STATUS_0__HDMI_ACR_CTS_MASK                                                             0xFFFFF000L
+//DIG3_HDMI_ACR_STATUS_1
+#define DIG3_HDMI_ACR_STATUS_1__HDMI_ACR_N__SHIFT                                                             0x0
+#define DIG3_HDMI_ACR_STATUS_1__HDMI_ACR_N_MASK                                                               0x000FFFFFL
+//DIG3_DIG_FE_AUDIO_CNTL
+#define DIG3_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT                               0x0
+#define DIG3_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE__SHIFT                                                       0x8
+#define DIG3_DIG_FE_AUDIO_CNTL__DIG_FE_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK                                 0x00000007L
+#define DIG3_DIG_FE_AUDIO_CNTL__APG_CLOCK_ENABLE_MASK                                                         0x00000100L
+//DIG3_DIG_BE_CLK_CNTL
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_MODE__SHIFT                                                              0x0
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN__SHIFT                                                            0x4
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET__SHIFT                                                        0x5
+#define DIG3_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET__SHIFT                                                          0x6
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON__SHIFT                                                 0xb
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON__SHIFT                                            0xc
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON__SHIFT                                            0xd
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_MODE_MASK                                                                0x00000007L
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_CLK_EN_MASK                                                              0x00000010L
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SOFT_RESET_MASK                                                          0x00000020L
+#define DIG3_DIG_BE_CLK_CNTL__HDCP_SOFT_RESET_MASK                                                            0x00000040L
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_CLOCK_ON_MASK                                                   0x00000800L
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_HDCP_CLOCK_ON_MASK                                              0x00001000L
+#define DIG3_DIG_BE_CLK_CNTL__DIG_BE_SYMCLK_G_TMDS_CLOCK_ON_MASK                                              0x00002000L
+//DIG3_DIG_BE_CNTL
+#define DIG3_DIG_BE_CNTL__DIG_RB_SWITCH_EN__SHIFT                                                             0x2
+#define DIG3_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT__SHIFT                                                         0x8
+#define DIG3_DIG_BE_CNTL__DIG_HPD_SELECT__SHIFT                                                               0x1c
+#define DIG3_DIG_BE_CNTL__DIG_RB_SWITCH_EN_MASK                                                               0x00000004L
+#define DIG3_DIG_BE_CNTL__DIG_FE_SOURCE_SELECT_MASK                                                           0x00007F00L
+#define DIG3_DIG_BE_CNTL__DIG_HPD_SELECT_MASK                                                                 0x70000000L
+//DIG3_DIG_BE_EN_CNTL
+#define DIG3_DIG_BE_EN_CNTL__DIG_BE_ENABLE__SHIFT                                                             0x0
+#define DIG3_DIG_BE_EN_CNTL__DIG_BE_ENABLE_MASK                                                               0x00000001L
+//DIG3_HDCP_INT_CONTROL
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT__SHIFT                                                   0x0
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK__SHIFT                                                   0x1
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK__SHIFT                                                  0x2
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT__SHIFT                                                      0x4
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK__SHIFT                                                      0x5
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK__SHIFT                                                     0x6
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK__SHIFT                                                 0x7
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT__SHIFT                                                   0x8
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK__SHIFT                                                   0x9
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK__SHIFT                                                  0xa
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT__SHIFT                                                  0xc
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK__SHIFT                                                  0xd
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK__SHIFT                                                 0xe
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_INT_MASK                                                     0x00000001L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_ACK_MASK                                                     0x00000002L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_SUCCESS_MASK_MASK                                                    0x00000004L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INT_MASK                                                        0x00000010L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_ACK_MASK                                                        0x00000020L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_MASK_MASK                                                       0x00000040L
+#define DIG3_HDCP_INT_CONTROL__HDCP_AUTH_FAIL_INFO_ACK_MASK                                                   0x00000080L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_INT_MASK                                                     0x00000100L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_ACK_MASK                                                     0x00000200L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_REQ_MASK_MASK                                                    0x00000400L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_INT_MASK                                                    0x00001000L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_ACK_MASK                                                    0x00002000L
+#define DIG3_HDCP_INT_CONTROL__HDCP_I2C_XFER_DONE_MASK_MASK                                                   0x00004000L
+//DIG3_HDCP_I2C_CONTROL_0
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE__SHIFT                                                      0x0
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET__SHIFT                                                   0x2
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT__SHIFT                                                   0x8
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_DISABLE_MASK                                                        0x00000001L
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_SEND_RESET_MASK                                                     0x00000004L
+#define DIG3_HDCP_I2C_CONTROL_0__HDCP_I2C_DDC_SELECT_MASK                                                     0x00000700L
+//DIG3_HDCP_I2C_CONTROL_1
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK__SHIFT                                                   0x0
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE__SHIFT                                                   0x1
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE__SHIFT                                               0x8
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT__SHIFT                                                  0x14
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY__SHIFT                                                  0x18
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_FAILED_ACK_MASK                                                     0x00000001L
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_XFER_IN_DE_MASK                                                     0x00000002L
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_SHORT_READ_DISABLE_MASK                                                 0x00000100L
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_COUNT_MASK                                                    0x00F00000L
+#define DIG3_HDCP_I2C_CONTROL_1__HDCP_I2C_RETRY_DELAY_MASK                                                    0xFF000000L
+//DIG3_TMDS_CNTL
+#define DIG3_TMDS_CNTL__TMDS_SYNC_PHASE__SHIFT                                                                0x0
+#define DIG3_TMDS_CNTL__TMDS_SYNC_PHASE_MASK                                                                  0x00000001L
+//DIG3_TMDS_CONTROL_CHAR
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN__SHIFT                                              0x0
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN__SHIFT                                              0x1
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN__SHIFT                                              0x2
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN__SHIFT                                              0x3
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR0_OUT_EN_MASK                                                0x00000001L
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR1_OUT_EN_MASK                                                0x00000002L
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR2_OUT_EN_MASK                                                0x00000004L
+#define DIG3_TMDS_CONTROL_CHAR__TMDS_CONTROL_CHAR3_OUT_EN_MASK                                                0x00000008L
+//DIG3_TMDS_CONTROL0_FEEDBACK
+#define DIG3_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT__SHIFT                                     0x0
+#define DIG3_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY__SHIFT                                      0x8
+#define DIG3_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_SELECT_MASK                                       0x00000003L
+#define DIG3_TMDS_CONTROL0_FEEDBACK__TMDS_CONTROL0_FEEDBACK_DELAY_MASK                                        0x00000300L
+//DIG3_TMDS_STEREOSYNC_CTL_SEL
+#define DIG3_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL__SHIFT                                          0x0
+#define DIG3_TMDS_STEREOSYNC_CTL_SEL__TMDS_STEREOSYNC_CTL_SEL_MASK                                            0x00000003L
+//DIG3_TMDS_SYNC_CHAR_PATTERN_0_1
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0__SHIFT                                       0x0
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1__SHIFT                                       0x10
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN0_MASK                                         0x000003FFL
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_0_1__TMDS_SYNC_CHAR_PATTERN1_MASK                                         0x03FF0000L
+//DIG3_TMDS_SYNC_CHAR_PATTERN_2_3
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2__SHIFT                                       0x0
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3__SHIFT                                       0x10
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN2_MASK                                         0x000003FFL
+#define DIG3_TMDS_SYNC_CHAR_PATTERN_2_3__TMDS_SYNC_CHAR_PATTERN3_MASK                                         0x03FF0000L
+//DIG3_TMDS_CTL_BITS
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL0__SHIFT                                                                  0x0
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL1__SHIFT                                                                  0x8
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL2__SHIFT                                                                  0x10
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL3__SHIFT                                                                  0x18
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL0_MASK                                                                    0x00000001L
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL1_MASK                                                                    0x00000100L
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL2_MASK                                                                    0x00010000L
+#define DIG3_TMDS_CTL_BITS__TMDS_CTL3_MASK                                                                    0x01000000L
+//DIG3_TMDS_DCBALANCER_CONTROL
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN__SHIFT                                               0x0
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN__SHIFT                                               0x4
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN__SHIFT                                          0x8
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN__SHIFT                                          0x10
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE__SHIFT                                            0x18
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_EN_MASK                                                 0x00000001L
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_SYNC_DCBAL_EN_MASK                                                 0x00000070L
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_EN_MASK                                            0x00000100L
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_TEST_IN_MASK                                            0x000F0000L
+#define DIG3_TMDS_DCBALANCER_CONTROL__TMDS_DCBALANCER_FORCE_MASK                                              0x01000000L
+//DIG3_TMDS_CTL0_1_GEN_CNTL
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL__SHIFT                                                  0x0
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY__SHIFT                                                0x4
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT__SHIFT                                               0x7
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION__SHIFT                                           0x8
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL__SHIFT                                                  0x10
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY__SHIFT                                                0x14
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT__SHIFT                                               0x17
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION__SHIFT                                           0x18
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN__SHIFT                                                0x1f
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL0_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_CTL1_PATTERN_OUT_EN_MASK                                              0x10000000L
+#define DIG3_TMDS_CTL0_1_GEN_CNTL__TMDS_2BIT_COUNTER_EN_MASK                                                  0x80000000L
+//DIG3_TMDS_CTL2_3_GEN_CNTL
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL__SHIFT                                                  0x0
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY__SHIFT                                                0x4
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT__SHIFT                                               0x7
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION__SHIFT                                           0x8
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH__SHIFT                                         0xa
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT__SHIFT                                              0xb
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN__SHIFT                                            0xc
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL__SHIFT                                                  0x10
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY__SHIFT                                                0x14
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT__SHIFT                                               0x17
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION__SHIFT                                           0x18
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH__SHIFT                                         0x1a
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT__SHIFT                                              0x1b
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN__SHIFT                                            0x1c
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_SEL_MASK                                                    0x0000000FL
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_DELAY_MASK                                                  0x00000070L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_INVERT_MASK                                                 0x00000080L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_DATA_MODULATION_MASK                                             0x00000300L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_USE_FEEDBACK_PATH_MASK                                           0x00000400L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_FB_SYNC_CONT_MASK                                                0x00000800L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL2_PATTERN_OUT_EN_MASK                                              0x00001000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_SEL_MASK                                                    0x000F0000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_DELAY_MASK                                                  0x00700000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_INVERT_MASK                                                 0x00800000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_DATA_MODULATION_MASK                                             0x03000000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_USE_FEEDBACK_PATH_MASK                                           0x04000000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_FB_SYNC_CONT_MASK                                                0x08000000L
+#define DIG3_TMDS_CTL2_3_GEN_CNTL__TMDS_CTL3_PATTERN_OUT_EN_MASK                                              0x10000000L
+//DIG3_DIG_VERSION
+
+
+// addressBlock: dce_dc_dio_dig0_apg_apg_dispdec
+//APG0_APG_CONTROL
+#define APG0_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG0_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG0_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG0_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG0_APG_CONTROL2
+#define APG0_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG0_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG0_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG0_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG0_APG_DBG_GEN_CONTROL
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG0_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG0_APG_PACKET_CONTROL
+#define APG0_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG0_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG0_APG_DBG_60958_0
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG0_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG0_APG_DBG_60958_1
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG0_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG0_APG_DBG_60958_2
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG0_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG0_APG_MEM_PWR
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG0_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG0_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG0_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_dio_dig1_apg_apg_dispdec
+//APG1_APG_CONTROL
+#define APG1_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG1_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG1_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG1_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG1_APG_CONTROL2
+#define APG1_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG1_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG1_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG1_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG1_APG_DBG_GEN_CONTROL
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG1_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG1_APG_PACKET_CONTROL
+#define APG1_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG1_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG1_APG_DBG_60958_0
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG1_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG1_APG_DBG_60958_1
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG1_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG1_APG_DBG_60958_2
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG1_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG1_APG_MEM_PWR
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG1_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG1_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG1_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_dio_dig2_apg_apg_dispdec
+//APG2_APG_CONTROL
+#define APG2_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG2_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG2_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG2_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG2_APG_CONTROL2
+#define APG2_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG2_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG2_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG2_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG2_APG_DBG_GEN_CONTROL
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG2_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG2_APG_PACKET_CONTROL
+#define APG2_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG2_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG2_APG_DBG_60958_0
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG2_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG2_APG_DBG_60958_1
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG2_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG2_APG_DBG_60958_2
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG2_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG2_APG_MEM_PWR
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG2_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG2_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG2_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_dio_dig3_apg_apg_dispdec
+//APG3_APG_CONTROL
+#define APG3_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG3_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG3_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG3_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG3_APG_CONTROL2
+#define APG3_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG3_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG3_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG3_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG3_APG_DBG_GEN_CONTROL
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG3_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG3_APG_PACKET_CONTROL
+#define APG3_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG3_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG3_APG_DBG_60958_0
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG3_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG3_APG_DBG_60958_1
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG3_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG3_APG_DBG_60958_2
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG3_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG3_APG_MEM_PWR
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG3_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG3_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG3_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_dio_dig0_dme_dme_dispdec
+//DME0_DME_CONTROL
+#define DME0_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME0_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME0_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME0_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME0_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME0_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME0_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME0_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME0_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME0_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME0_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME0_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME0_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME0_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME0_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME0_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME0_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME0_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME0_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME0_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_dio_dig0_vpg_vpg_dispdec
+//VPG0_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG0_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG0_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG0_VPG_GENERIC_PACKET_DATA
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG0_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG0_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG0_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG0_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG0_VPG_GENERIC_STATUS
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG0_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG0_VPG_MEM_PWR
+#define VPG0_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG0_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG0_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG0_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG0_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG0_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG0_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG0_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG0_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG0_VPG_ISRC1_2_DATA
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG0_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_dio_dig1_dme_dme_dispdec
+//DME1_DME_CONTROL
+#define DME1_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME1_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME1_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME1_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME1_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME1_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME1_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME1_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME1_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME1_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME1_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME1_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME1_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME1_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME1_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME1_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME1_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME1_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME1_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME1_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_dio_dig1_vpg_vpg_dispdec
+//VPG1_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG1_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG1_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG1_VPG_GENERIC_PACKET_DATA
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG1_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG1_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG1_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG1_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG1_VPG_GENERIC_STATUS
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG1_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG1_VPG_MEM_PWR
+#define VPG1_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG1_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG1_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG1_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG1_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG1_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG1_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG1_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG1_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG1_VPG_ISRC1_2_DATA
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG1_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_dio_dig2_dme_dme_dispdec
+//DME2_DME_CONTROL
+#define DME2_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME2_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME2_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME2_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME2_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME2_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME2_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME2_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME2_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME2_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME2_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME2_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME2_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME2_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME2_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME2_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME2_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME2_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME2_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME2_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_dio_dig2_vpg_vpg_dispdec
+//VPG2_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG2_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG2_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG2_VPG_GENERIC_PACKET_DATA
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG2_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG2_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG2_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG2_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG2_VPG_GENERIC_STATUS
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG2_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG2_VPG_MEM_PWR
+#define VPG2_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG2_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG2_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG2_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG2_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG2_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG2_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG2_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG2_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG2_VPG_ISRC1_2_DATA
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG2_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_dio_dig3_dme_dme_dispdec
+//DME3_DME_CONTROL
+#define DME3_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME3_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME3_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME3_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME3_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME3_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME3_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME3_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME3_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME3_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME3_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME3_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME3_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME3_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME3_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME3_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME3_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME3_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME3_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME3_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_dio_dig3_vpg_vpg_dispdec
+//VPG3_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG3_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG3_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG3_VPG_GENERIC_PACKET_DATA
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG3_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG3_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG3_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG3_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG3_VPG_GENERIC_STATUS
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG3_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG3_VPG_MEM_PWR
+#define VPG3_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG3_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG3_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG3_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG3_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG3_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG3_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG3_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG3_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG3_VPG_ISRC1_2_DATA
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG3_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_dio_dio_dme_rm_mem0_dme_rm_dispdec
+//DME_RM0_DME_MEMORY_CONTROL
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE__SHIFT                                                  0x0
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS__SHIFT                                                    0x4
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE__SHIFT                                                  0x8
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE_MASK                                                    0x00000003L
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS_MASK                                                      0x00000010L
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE_MASK                                                    0x00000300L
+#define DME_RM0_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//DME_RM0_DME_RM_MEM_CTRL
+#define DME_RM0_DME_RM_MEM_CTRL__DME_SRC_SEL__SHIFT                                                           0x0
+#define DME_RM0_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE__SHIFT                                                      0x3
+#define DME_RM0_DME_RM_MEM_CTRL__DME_MEM_ENABLE__SHIFT                                                        0x5
+#define DME_RM0_DME_RM_MEM_CTRL__DME_SRC_SEL_MASK                                                             0x00000007L
+#define DME_RM0_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE_MASK                                                        0x00000008L
+#define DME_RM0_DME_RM_MEM_CTRL__DME_MEM_ENABLE_MASK                                                          0x00000020L
+
+
+// addressBlock: dce_dc_dio_dio_dme_rm_mem1_dme_rm_dispdec
+//DME_RM1_DME_MEMORY_CONTROL
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE__SHIFT                                                  0x0
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS__SHIFT                                                    0x4
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE__SHIFT                                                  0x8
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE_MASK                                                    0x00000003L
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS_MASK                                                      0x00000010L
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE_MASK                                                    0x00000300L
+#define DME_RM1_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//DME_RM1_DME_RM_MEM_CTRL
+#define DME_RM1_DME_RM_MEM_CTRL__DME_SRC_SEL__SHIFT                                                           0x0
+#define DME_RM1_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE__SHIFT                                                      0x3
+#define DME_RM1_DME_RM_MEM_CTRL__DME_MEM_ENABLE__SHIFT                                                        0x5
+#define DME_RM1_DME_RM_MEM_CTRL__DME_SRC_SEL_MASK                                                             0x00000007L
+#define DME_RM1_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE_MASK                                                        0x00000008L
+#define DME_RM1_DME_RM_MEM_CTRL__DME_MEM_ENABLE_MASK                                                          0x00000020L
+
+
+// addressBlock: dce_dc_dio_dout_i2c_dispdec
+//DC_I2C_CONTROL
+#define DC_I2C_CONTROL__DC_I2C_GO__SHIFT                                                                      0x0
+#define DC_I2C_CONTROL__DC_I2C_SOFT_RESET__SHIFT                                                              0x1
+#define DC_I2C_CONTROL__DC_I2C_SEND_RESET__SHIFT                                                              0x2
+#define DC_I2C_CONTROL__DC_I2C_SW_STATUS_RESET__SHIFT                                                         0x3
+#define DC_I2C_CONTROL__DC_I2C_DDC_SELECT__SHIFT                                                              0x8
+#define DC_I2C_CONTROL__DC_I2C_TRANSACTION_COUNT__SHIFT                                                       0x14
+#define DC_I2C_CONTROL__DC_I2C_DBG_REF_SEL__SHIFT                                                             0x1f
+#define DC_I2C_CONTROL__DC_I2C_GO_MASK                                                                        0x00000001L
+#define DC_I2C_CONTROL__DC_I2C_SOFT_RESET_MASK                                                                0x00000002L
+#define DC_I2C_CONTROL__DC_I2C_SEND_RESET_MASK                                                                0x00000004L
+#define DC_I2C_CONTROL__DC_I2C_SW_STATUS_RESET_MASK                                                           0x00000008L
+#define DC_I2C_CONTROL__DC_I2C_DDC_SELECT_MASK                                                                0x00000700L
+#define DC_I2C_CONTROL__DC_I2C_TRANSACTION_COUNT_MASK                                                         0x00300000L
+#define DC_I2C_CONTROL__DC_I2C_DBG_REF_SEL_MASK                                                               0x80000000L
+//DC_I2C_ARBITRATION
+#define DC_I2C_ARBITRATION__DC_I2C_SW_PRIORITY__SHIFT                                                         0x0
+#define DC_I2C_ARBITRATION__DC_I2C_REG_RW_CNTL_STATUS__SHIFT                                                  0x2
+#define DC_I2C_ARBITRATION__DC_I2C_NO_QUEUED_SW_GO__SHIFT                                                     0x4
+#define DC_I2C_ARBITRATION__DC_I2C_ABORT_HW_XFER__SHIFT                                                       0x8
+#define DC_I2C_ARBITRATION__DC_I2C_ABORT_SW_XFER__SHIFT                                                       0xc
+#define DC_I2C_ARBITRATION__DC_I2C_SW_USE_I2C_REG_REQ__SHIFT                                                  0x14
+#define DC_I2C_ARBITRATION__DC_I2C_SW_DONE_USING_I2C_REG__SHIFT                                               0x15
+#define DC_I2C_ARBITRATION__DC_I2C_DMCU_USE_I2C_REG_REQ__SHIFT                                                0x18
+#define DC_I2C_ARBITRATION__DC_I2C_DMCU_DONE_USING_I2C_REG__SHIFT                                             0x19
+#define DC_I2C_ARBITRATION__DC_I2C_SW_PRIORITY_MASK                                                           0x00000003L
+#define DC_I2C_ARBITRATION__DC_I2C_REG_RW_CNTL_STATUS_MASK                                                    0x0000000CL
+#define DC_I2C_ARBITRATION__DC_I2C_NO_QUEUED_SW_GO_MASK                                                       0x00000010L
+#define DC_I2C_ARBITRATION__DC_I2C_ABORT_HW_XFER_MASK                                                         0x00000100L
+#define DC_I2C_ARBITRATION__DC_I2C_ABORT_SW_XFER_MASK                                                         0x00001000L
+#define DC_I2C_ARBITRATION__DC_I2C_SW_USE_I2C_REG_REQ_MASK                                                    0x00100000L
+#define DC_I2C_ARBITRATION__DC_I2C_SW_DONE_USING_I2C_REG_MASK                                                 0x00200000L
+#define DC_I2C_ARBITRATION__DC_I2C_DMCU_USE_I2C_REG_REQ_MASK                                                  0x01000000L
+#define DC_I2C_ARBITRATION__DC_I2C_DMCU_DONE_USING_I2C_REG_MASK                                               0x02000000L
+//DC_I2C_INTERRUPT_CONTROL
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_INT__SHIFT                                                   0x0
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_ACK__SHIFT                                                   0x1
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_MASK__SHIFT                                                  0x2
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_INT__SHIFT                                              0x4
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_ACK__SHIFT                                              0x5
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_MASK__SHIFT                                             0x6
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_INT__SHIFT                                              0x8
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_ACK__SHIFT                                              0x9
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_MASK__SHIFT                                             0xa
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_INT_MASK                                                     0x00000001L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_ACK_MASK                                                     0x00000002L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_SW_DONE_MASK_MASK                                                    0x00000004L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_INT_MASK                                                0x00000010L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_ACK_MASK                                                0x00000020L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC1_HW_DONE_MASK_MASK                                               0x00000040L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_INT_MASK                                                0x00000100L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_ACK_MASK                                                0x00000200L
+#define DC_I2C_INTERRUPT_CONTROL__DC_I2C_DDC2_HW_DONE_MASK_MASK                                               0x00000400L
+//DC_I2C_SW_STATUS
+#define DC_I2C_SW_STATUS__DC_I2C_SW_STATUS__SHIFT                                                             0x0
+#define DC_I2C_SW_STATUS__DC_I2C_SW_DONE__SHIFT                                                               0x2
+#define DC_I2C_SW_STATUS__DC_I2C_SW_ABORTED__SHIFT                                                            0x4
+#define DC_I2C_SW_STATUS__DC_I2C_SW_TIMEOUT__SHIFT                                                            0x5
+#define DC_I2C_SW_STATUS__DC_I2C_SW_INTERRUPTED__SHIFT                                                        0x6
+#define DC_I2C_SW_STATUS__DC_I2C_SW_BUFFER_OVERFLOW__SHIFT                                                    0x7
+#define DC_I2C_SW_STATUS__DC_I2C_SW_STOPPED_ON_NACK__SHIFT                                                    0x8
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK0__SHIFT                                                              0xc
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK1__SHIFT                                                              0xd
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK2__SHIFT                                                              0xe
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK3__SHIFT                                                              0xf
+#define DC_I2C_SW_STATUS__DC_I2C_SW_REQ__SHIFT                                                                0x12
+#define DC_I2C_SW_STATUS__DC_I2C_SW_STATUS_MASK                                                               0x00000003L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_DONE_MASK                                                                 0x00000004L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_ABORTED_MASK                                                              0x00000010L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_TIMEOUT_MASK                                                              0x00000020L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_INTERRUPTED_MASK                                                          0x00000040L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_BUFFER_OVERFLOW_MASK                                                      0x00000080L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_STOPPED_ON_NACK_MASK                                                      0x00000100L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK0_MASK                                                                0x00001000L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK1_MASK                                                                0x00002000L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK2_MASK                                                                0x00004000L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_NACK3_MASK                                                                0x00008000L
+#define DC_I2C_SW_STATUS__DC_I2C_SW_REQ_MASK                                                                  0x00040000L
+//DC_I2C_DDC1_HW_STATUS
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_STATUS__SHIFT                                                   0x0
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_DONE__SHIFT                                                     0x3
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_REQ__SHIFT                                                      0x10
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_URG__SHIFT                                                      0x11
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_STATUS__SHIFT                                          0x14
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_NUM_VALID_TRIES__SHIFT                                 0x18
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_STATE__SHIFT                                           0x1c
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_STATUS_MASK                                                     0x00000003L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_DONE_MASK                                                       0x00000008L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_REQ_MASK                                                        0x00010000L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_HW_URG_MASK                                                        0x00020000L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_STATUS_MASK                                            0x00100000L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_NUM_VALID_TRIES_MASK                                   0x0F000000L
+#define DC_I2C_DDC1_HW_STATUS__DC_I2C_DDC1_EDID_DETECT_STATE_MASK                                             0x70000000L
+//DC_I2C_DDC2_HW_STATUS
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_STATUS__SHIFT                                                   0x0
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_DONE__SHIFT                                                     0x3
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_REQ__SHIFT                                                      0x10
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_URG__SHIFT                                                      0x11
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_STATUS__SHIFT                                          0x14
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_NUM_VALID_TRIES__SHIFT                                 0x18
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_STATE__SHIFT                                           0x1c
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_STATUS_MASK                                                     0x00000003L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_DONE_MASK                                                       0x00000008L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_REQ_MASK                                                        0x00010000L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_HW_URG_MASK                                                        0x00020000L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_STATUS_MASK                                            0x00100000L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_NUM_VALID_TRIES_MASK                                   0x0F000000L
+#define DC_I2C_DDC2_HW_STATUS__DC_I2C_DDC2_EDID_DETECT_STATE_MASK                                             0x70000000L
+//DC_I2C_DDC1_SPEED
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_THRESHOLD__SHIFT                                                       0x0
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_DISABLE_FILTER_DURING_STALL__SHIFT                                     0x4
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_START_STOP_TIMING_CNTL__SHIFT                                          0x8
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_PRESCALE__SHIFT                                                        0x10
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_THRESHOLD_MASK                                                         0x00000003L
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_DISABLE_FILTER_DURING_STALL_MASK                                       0x00000010L
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_START_STOP_TIMING_CNTL_MASK                                            0x00000300L
+#define DC_I2C_DDC1_SPEED__DC_I2C_DDC1_PRESCALE_MASK                                                          0xFFFF0000L
+//DC_I2C_DDC1_SETUP
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_DATA_DRIVE_EN__SHIFT                                                   0x0
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_DATA_DRIVE_SEL__SHIFT                                                  0x1
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_SEND_RESET_LENGTH__SHIFT                                               0x2
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_CLK_EN__SHIFT                                                          0x3
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_EDID_DETECT_ENABLE__SHIFT                                              0x4
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_EDID_DETECT_MODE__SHIFT                                                0x5
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_ENABLE__SHIFT                                                          0x6
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_CLK_DRIVE_EN__SHIFT                                                    0x7
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_INTRA_BYTE_DELAY__SHIFT                                                0x8
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_INTRA_TRANSACTION_DELAY__SHIFT                                         0x10
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_TIME_LIMIT__SHIFT                                                      0x18
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_DATA_DRIVE_EN_MASK                                                     0x00000001L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_DATA_DRIVE_SEL_MASK                                                    0x00000002L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_SEND_RESET_LENGTH_MASK                                                 0x00000004L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_CLK_EN_MASK                                                            0x00000008L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_EDID_DETECT_ENABLE_MASK                                                0x00000010L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_EDID_DETECT_MODE_MASK                                                  0x00000020L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_ENABLE_MASK                                                            0x00000040L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_CLK_DRIVE_EN_MASK                                                      0x00000080L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_INTRA_BYTE_DELAY_MASK                                                  0x0000FF00L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_INTRA_TRANSACTION_DELAY_MASK                                           0x00FF0000L
+#define DC_I2C_DDC1_SETUP__DC_I2C_DDC1_TIME_LIMIT_MASK                                                        0xFF000000L
+//DC_I2C_DDC2_SPEED
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_THRESHOLD__SHIFT                                                       0x0
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_DISABLE_FILTER_DURING_STALL__SHIFT                                     0x4
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_START_STOP_TIMING_CNTL__SHIFT                                          0x8
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_PRESCALE__SHIFT                                                        0x10
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_THRESHOLD_MASK                                                         0x00000003L
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_DISABLE_FILTER_DURING_STALL_MASK                                       0x00000010L
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_START_STOP_TIMING_CNTL_MASK                                            0x00000300L
+#define DC_I2C_DDC2_SPEED__DC_I2C_DDC2_PRESCALE_MASK                                                          0xFFFF0000L
+//DC_I2C_DDC2_SETUP
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_DATA_DRIVE_EN__SHIFT                                                   0x0
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_DATA_DRIVE_SEL__SHIFT                                                  0x1
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_SEND_RESET_LENGTH__SHIFT                                               0x2
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_CLK_EN__SHIFT                                                          0x3
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_EDID_DETECT_ENABLE__SHIFT                                              0x4
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_EDID_DETECT_MODE__SHIFT                                                0x5
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_ENABLE__SHIFT                                                          0x6
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_CLK_DRIVE_EN__SHIFT                                                    0x7
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_INTRA_BYTE_DELAY__SHIFT                                                0x8
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_INTRA_TRANSACTION_DELAY__SHIFT                                         0x10
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_TIME_LIMIT__SHIFT                                                      0x18
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_DATA_DRIVE_EN_MASK                                                     0x00000001L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_DATA_DRIVE_SEL_MASK                                                    0x00000002L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_SEND_RESET_LENGTH_MASK                                                 0x00000004L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_CLK_EN_MASK                                                            0x00000008L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_EDID_DETECT_ENABLE_MASK                                                0x00000010L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_EDID_DETECT_MODE_MASK                                                  0x00000020L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_ENABLE_MASK                                                            0x00000040L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_CLK_DRIVE_EN_MASK                                                      0x00000080L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_INTRA_BYTE_DELAY_MASK                                                  0x0000FF00L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_INTRA_TRANSACTION_DELAY_MASK                                           0x00FF0000L
+#define DC_I2C_DDC2_SETUP__DC_I2C_DDC2_TIME_LIMIT_MASK                                                        0xFF000000L
+//DC_I2C_TRANSACTION0
+#define DC_I2C_TRANSACTION0__DC_I2C_RW0__SHIFT                                                                0x0
+#define DC_I2C_TRANSACTION0__DC_I2C_STOP_ON_NACK0__SHIFT                                                      0x8
+#define DC_I2C_TRANSACTION0__DC_I2C_START0__SHIFT                                                             0xc
+#define DC_I2C_TRANSACTION0__DC_I2C_STOP0__SHIFT                                                              0xd
+#define DC_I2C_TRANSACTION0__DC_I2C_COUNT0__SHIFT                                                             0x10
+#define DC_I2C_TRANSACTION0__DC_I2C_RW0_MASK                                                                  0x00000001L
+#define DC_I2C_TRANSACTION0__DC_I2C_STOP_ON_NACK0_MASK                                                        0x00000100L
+#define DC_I2C_TRANSACTION0__DC_I2C_START0_MASK                                                               0x00001000L
+#define DC_I2C_TRANSACTION0__DC_I2C_STOP0_MASK                                                                0x00002000L
+#define DC_I2C_TRANSACTION0__DC_I2C_COUNT0_MASK                                                               0x03FF0000L
+//DC_I2C_TRANSACTION1
+#define DC_I2C_TRANSACTION1__DC_I2C_RW1__SHIFT                                                                0x0
+#define DC_I2C_TRANSACTION1__DC_I2C_STOP_ON_NACK1__SHIFT                                                      0x8
+#define DC_I2C_TRANSACTION1__DC_I2C_START1__SHIFT                                                             0xc
+#define DC_I2C_TRANSACTION1__DC_I2C_STOP1__SHIFT                                                              0xd
+#define DC_I2C_TRANSACTION1__DC_I2C_COUNT1__SHIFT                                                             0x10
+#define DC_I2C_TRANSACTION1__DC_I2C_RW1_MASK                                                                  0x00000001L
+#define DC_I2C_TRANSACTION1__DC_I2C_STOP_ON_NACK1_MASK                                                        0x00000100L
+#define DC_I2C_TRANSACTION1__DC_I2C_START1_MASK                                                               0x00001000L
+#define DC_I2C_TRANSACTION1__DC_I2C_STOP1_MASK                                                                0x00002000L
+#define DC_I2C_TRANSACTION1__DC_I2C_COUNT1_MASK                                                               0x03FF0000L
+//DC_I2C_TRANSACTION2
+#define DC_I2C_TRANSACTION2__DC_I2C_RW2__SHIFT                                                                0x0
+#define DC_I2C_TRANSACTION2__DC_I2C_STOP_ON_NACK2__SHIFT                                                      0x8
+#define DC_I2C_TRANSACTION2__DC_I2C_START2__SHIFT                                                             0xc
+#define DC_I2C_TRANSACTION2__DC_I2C_STOP2__SHIFT                                                              0xd
+#define DC_I2C_TRANSACTION2__DC_I2C_COUNT2__SHIFT                                                             0x10
+#define DC_I2C_TRANSACTION2__DC_I2C_RW2_MASK                                                                  0x00000001L
+#define DC_I2C_TRANSACTION2__DC_I2C_STOP_ON_NACK2_MASK                                                        0x00000100L
+#define DC_I2C_TRANSACTION2__DC_I2C_START2_MASK                                                               0x00001000L
+#define DC_I2C_TRANSACTION2__DC_I2C_STOP2_MASK                                                                0x00002000L
+#define DC_I2C_TRANSACTION2__DC_I2C_COUNT2_MASK                                                               0x03FF0000L
+//DC_I2C_TRANSACTION3
+#define DC_I2C_TRANSACTION3__DC_I2C_RW3__SHIFT                                                                0x0
+#define DC_I2C_TRANSACTION3__DC_I2C_STOP_ON_NACK3__SHIFT                                                      0x8
+#define DC_I2C_TRANSACTION3__DC_I2C_START3__SHIFT                                                             0xc
+#define DC_I2C_TRANSACTION3__DC_I2C_STOP3__SHIFT                                                              0xd
+#define DC_I2C_TRANSACTION3__DC_I2C_COUNT3__SHIFT                                                             0x10
+#define DC_I2C_TRANSACTION3__DC_I2C_RW3_MASK                                                                  0x00000001L
+#define DC_I2C_TRANSACTION3__DC_I2C_STOP_ON_NACK3_MASK                                                        0x00000100L
+#define DC_I2C_TRANSACTION3__DC_I2C_START3_MASK                                                               0x00001000L
+#define DC_I2C_TRANSACTION3__DC_I2C_STOP3_MASK                                                                0x00002000L
+#define DC_I2C_TRANSACTION3__DC_I2C_COUNT3_MASK                                                               0x03FF0000L
+//DC_I2C_DATA
+#define DC_I2C_DATA__DC_I2C_DATA_RW__SHIFT                                                                    0x0
+#define DC_I2C_DATA__DC_I2C_DATA__SHIFT                                                                       0x8
+#define DC_I2C_DATA__DC_I2C_INDEX__SHIFT                                                                      0x10
+#define DC_I2C_DATA__DC_I2C_INDEX_WRITE__SHIFT                                                                0x1f
+#define DC_I2C_DATA__DC_I2C_DATA_RW_MASK                                                                      0x00000001L
+#define DC_I2C_DATA__DC_I2C_DATA_MASK                                                                         0x0000FF00L
+#define DC_I2C_DATA__DC_I2C_INDEX_MASK                                                                        0x03FF0000L
+#define DC_I2C_DATA__DC_I2C_INDEX_WRITE_MASK                                                                  0x80000000L
+//DC_I2C_EDID_DETECT_CTRL
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_WAIT_TIME__SHIFT                                          0x0
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_NUM_TRIES_UNTIL_VALID__SHIFT                              0x14
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_SEND_RESET__SHIFT                                         0x1c
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_WAIT_TIME_MASK                                            0x0000FFFFL
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_NUM_TRIES_UNTIL_VALID_MASK                                0x00F00000L
+#define DC_I2C_EDID_DETECT_CTRL__DC_I2C_EDID_DETECT_SEND_RESET_MASK                                           0x10000000L
+//DC_I2C_READ_REQUEST_INTERRUPT
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_OCCURRED__SHIFT                               0x0
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_INT__SHIFT                                    0x1
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_ACK__SHIFT                                    0x2
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_MASK__SHIFT                                   0x3
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_OCCURRED__SHIFT                               0x4
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_INT__SHIFT                                    0x5
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_ACK__SHIFT                                    0x6
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_MASK__SHIFT                                   0x7
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC_READ_REQUEST_ACK_ENABLE__SHIFT                              0x1e
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC_READ_REQUEST_INT_TYPE__SHIFT                                0x1f
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_OCCURRED_MASK                                 0x00000001L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_INT_MASK                                      0x00000002L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_ACK_MASK                                      0x00000004L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC1_READ_REQUEST_MASK_MASK                                     0x00000008L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_OCCURRED_MASK                                 0x00000010L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_INT_MASK                                      0x00000020L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_ACK_MASK                                      0x00000040L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC2_READ_REQUEST_MASK_MASK                                     0x00000080L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC_READ_REQUEST_ACK_ENABLE_MASK                                0x40000000L
+#define DC_I2C_READ_REQUEST_INTERRUPT__DC_I2C_DDC_READ_REQUEST_INT_TYPE_MASK                                  0x80000000L
+
+
+// addressBlock: dce_dc_dio_dio_misc_dispdec
+//DIO_SCRATCH0
+#define DIO_SCRATCH0__DIO_SCRATCH0__SHIFT                                                                     0x0
+#define DIO_SCRATCH0__DIO_SCRATCH0_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH1
+#define DIO_SCRATCH1__DIO_SCRATCH1__SHIFT                                                                     0x0
+#define DIO_SCRATCH1__DIO_SCRATCH1_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH2
+#define DIO_SCRATCH2__DIO_SCRATCH2__SHIFT                                                                     0x0
+#define DIO_SCRATCH2__DIO_SCRATCH2_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH3
+#define DIO_SCRATCH3__DIO_SCRATCH3__SHIFT                                                                     0x0
+#define DIO_SCRATCH3__DIO_SCRATCH3_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH4
+#define DIO_SCRATCH4__DIO_SCRATCH4__SHIFT                                                                     0x0
+#define DIO_SCRATCH4__DIO_SCRATCH4_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH5
+#define DIO_SCRATCH5__DIO_SCRATCH5__SHIFT                                                                     0x0
+#define DIO_SCRATCH5__DIO_SCRATCH5_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH6
+#define DIO_SCRATCH6__DIO_SCRATCH6__SHIFT                                                                     0x0
+#define DIO_SCRATCH6__DIO_SCRATCH6_MASK                                                                       0xFFFFFFFFL
+//DIO_SCRATCH7
+#define DIO_SCRATCH7__DIO_SCRATCH7__SHIFT                                                                     0x0
+#define DIO_SCRATCH7__DIO_SCRATCH7_MASK                                                                       0xFFFFFFFFL
+//DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGA_DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                      0x0
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGB_DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                      0x1
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGC_DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                      0x2
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGD_DP_ALPM_WAKEUP_INTERRUPT_STATUS__SHIFT                      0x3
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGA_DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                        0x00000001L
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGB_DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                        0x00000002L
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGC_DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                        0x00000004L
+#define DIO_DP_ALPM_WAKEUP_INTERRUPT_STATUS__DIGD_DP_ALPM_WAKEUP_INTERRUPT_STATUS_MASK                        0x00000008L
+//DIO_MEM_PWR_STATUS
+#define DIO_MEM_PWR_STATUS__I2C_MEM_PWR_STATE__SHIFT                                                          0x0
+#define DIO_MEM_PWR_STATUS__DPA_MEM_PWR_STATE__SHIFT                                                          0x3
+#define DIO_MEM_PWR_STATUS__DPB_MEM_PWR_STATE__SHIFT                                                          0x4
+#define DIO_MEM_PWR_STATUS__DPC_MEM_PWR_STATE__SHIFT                                                          0x5
+#define DIO_MEM_PWR_STATUS__DPD_MEM_PWR_STATE__SHIFT                                                          0x6
+#define DIO_MEM_PWR_STATUS__I2C_MEM_PWR_STATE_MASK                                                            0x00000001L
+#define DIO_MEM_PWR_STATUS__DPA_MEM_PWR_STATE_MASK                                                            0x00000008L
+#define DIO_MEM_PWR_STATUS__DPB_MEM_PWR_STATE_MASK                                                            0x00000010L
+#define DIO_MEM_PWR_STATUS__DPC_MEM_PWR_STATE_MASK                                                            0x00000020L
+#define DIO_MEM_PWR_STATUS__DPD_MEM_PWR_STATE_MASK                                                            0x00000040L
+//DIO_MEM_PWR_CTRL
+#define DIO_MEM_PWR_CTRL__I2C_LIGHT_SLEEP_FORCE__SHIFT                                                        0x0
+#define DIO_MEM_PWR_CTRL__I2C_LIGHT_SLEEP_DIS__SHIFT                                                          0x1
+#define DIO_MEM_PWR_CTRL__DPA_LIGHT_SLEEP_DIS__SHIFT                                                          0x4
+#define DIO_MEM_PWR_CTRL__DPB_LIGHT_SLEEP_DIS__SHIFT                                                          0x5
+#define DIO_MEM_PWR_CTRL__DPC_LIGHT_SLEEP_DIS__SHIFT                                                          0x6
+#define DIO_MEM_PWR_CTRL__DPD_LIGHT_SLEEP_DIS__SHIFT                                                          0x7
+#define DIO_MEM_PWR_CTRL__I2C_LIGHT_SLEEP_FORCE_MASK                                                          0x00000001L
+#define DIO_MEM_PWR_CTRL__I2C_LIGHT_SLEEP_DIS_MASK                                                            0x00000002L
+#define DIO_MEM_PWR_CTRL__DPA_LIGHT_SLEEP_DIS_MASK                                                            0x00000010L
+#define DIO_MEM_PWR_CTRL__DPB_LIGHT_SLEEP_DIS_MASK                                                            0x00000020L
+#define DIO_MEM_PWR_CTRL__DPC_LIGHT_SLEEP_DIS_MASK                                                            0x00000040L
+#define DIO_MEM_PWR_CTRL__DPD_LIGHT_SLEEP_DIS_MASK                                                            0x00000080L
+//DIO_MEM_PWR_CTRL2
+#define DIO_MEM_PWR_CTRL2__DPA_LIGHT_SLEEP_FORCE__SHIFT                                                       0x18
+#define DIO_MEM_PWR_CTRL2__DPB_LIGHT_SLEEP_FORCE__SHIFT                                                       0x19
+#define DIO_MEM_PWR_CTRL2__DPC_LIGHT_SLEEP_FORCE__SHIFT                                                       0x1a
+#define DIO_MEM_PWR_CTRL2__DPD_LIGHT_SLEEP_FORCE__SHIFT                                                       0x1b
+#define DIO_MEM_PWR_CTRL2__DPA_LIGHT_SLEEP_FORCE_MASK                                                         0x01000000L
+#define DIO_MEM_PWR_CTRL2__DPB_LIGHT_SLEEP_FORCE_MASK                                                         0x02000000L
+#define DIO_MEM_PWR_CTRL2__DPC_LIGHT_SLEEP_FORCE_MASK                                                         0x04000000L
+#define DIO_MEM_PWR_CTRL2__DPD_LIGHT_SLEEP_FORCE_MASK                                                         0x08000000L
+//DIO_CLK_CNTL
+#define DIO_CLK_CNTL__DIO_TEST_CLK_SEL__SHIFT                                                                 0x0
+#define DIO_CLK_CNTL__DISPCLK_R_GATE_DIS__SHIFT                                                               0x9
+#define DIO_CLK_CNTL__DISPCLK_G_GATE_DIS__SHIFT                                                               0xa
+#define DIO_CLK_CNTL__REFCLK_R_GATE_DIS__SHIFT                                                                0xb
+#define DIO_CLK_CNTL__REFCLK_G_GATE_DIS__SHIFT                                                                0xc
+#define DIO_CLK_CNTL__SOCCLK_G_GATE_DIS__SHIFT                                                                0xd
+#define DIO_CLK_CNTL__SYMCLK_FE_R_GATE_DIS__SHIFT                                                             0xe
+#define DIO_CLK_CNTL__SYMCLK_FE_G_GATE_DIS__SHIFT                                                             0xf
+#define DIO_CLK_CNTL__SYMCLK_R_GATE_DIS__SHIFT                                                                0x10
+#define DIO_CLK_CNTL__SYMCLK_G_GATE_DIS__SHIFT                                                                0x11
+#define DIO_CLK_CNTL__DPREFCLK_R_GATE_DIS__SHIFT                                                              0x12
+#define DIO_CLK_CNTL__DPREFCLK_G_GATE_DIS__SHIFT                                                              0x13
+#define DIO_CLK_CNTL__DIO_FGCG_REP_DIS__SHIFT                                                                 0x14
+#define DIO_CLK_CNTL__DISPCLK_G_HDCP_GATE_DIS__SHIFT                                                          0x15
+#define DIO_CLK_CNTL__SYMCLKA_G_HDCP_GATE_DIS__SHIFT                                                          0x16
+#define DIO_CLK_CNTL__SYMCLKB_G_HDCP_GATE_DIS__SHIFT                                                          0x17
+#define DIO_CLK_CNTL__SYMCLKC_G_HDCP_GATE_DIS__SHIFT                                                          0x18
+#define DIO_CLK_CNTL__SYMCLKD_G_HDCP_GATE_DIS__SHIFT                                                          0x19
+#define DIO_CLK_CNTL__SOCCLK_R_GATE_DIS__SHIFT                                                                0x1d
+#define DIO_CLK_CNTL__DIO_TEST_CLK_SEL_MASK                                                                   0x0000007FL
+#define DIO_CLK_CNTL__DISPCLK_R_GATE_DIS_MASK                                                                 0x00000200L
+#define DIO_CLK_CNTL__DISPCLK_G_GATE_DIS_MASK                                                                 0x00000400L
+#define DIO_CLK_CNTL__REFCLK_R_GATE_DIS_MASK                                                                  0x00000800L
+#define DIO_CLK_CNTL__REFCLK_G_GATE_DIS_MASK                                                                  0x00001000L
+#define DIO_CLK_CNTL__SOCCLK_G_GATE_DIS_MASK                                                                  0x00002000L
+#define DIO_CLK_CNTL__SYMCLK_FE_R_GATE_DIS_MASK                                                               0x00004000L
+#define DIO_CLK_CNTL__SYMCLK_FE_G_GATE_DIS_MASK                                                               0x00008000L
+#define DIO_CLK_CNTL__SYMCLK_R_GATE_DIS_MASK                                                                  0x00010000L
+#define DIO_CLK_CNTL__SYMCLK_G_GATE_DIS_MASK                                                                  0x00020000L
+#define DIO_CLK_CNTL__DPREFCLK_R_GATE_DIS_MASK                                                                0x00040000L
+#define DIO_CLK_CNTL__DPREFCLK_G_GATE_DIS_MASK                                                                0x00080000L
+#define DIO_CLK_CNTL__DIO_FGCG_REP_DIS_MASK                                                                   0x00100000L
+#define DIO_CLK_CNTL__DISPCLK_G_HDCP_GATE_DIS_MASK                                                            0x00200000L
+#define DIO_CLK_CNTL__SYMCLKA_G_HDCP_GATE_DIS_MASK                                                            0x00400000L
+#define DIO_CLK_CNTL__SYMCLKB_G_HDCP_GATE_DIS_MASK                                                            0x00800000L
+#define DIO_CLK_CNTL__SYMCLKC_G_HDCP_GATE_DIS_MASK                                                            0x01000000L
+#define DIO_CLK_CNTL__SYMCLKD_G_HDCP_GATE_DIS_MASK                                                            0x02000000L
+#define DIO_CLK_CNTL__SOCCLK_R_GATE_DIS_MASK                                                                  0x20000000L
+//DIO_POWER_MANAGEMENT_CNTL
+#define DIO_POWER_MANAGEMENT_CNTL__PM_ALL_BUSY_OFF__SHIFT                                                     0x8
+#define DIO_POWER_MANAGEMENT_CNTL__PM_ALL_BUSY_OFF_MASK                                                       0x00000100L
+//HDCP_CLK_STATUS
+#define HDCP_CLK_STATUS__DISPCLK_G_HDCP_CLOCK_ON__SHIFT                                                       0x1
+#define HDCP_CLK_STATUS__SYMCLKA_G_HDCP_CLOCK_ON__SHIFT                                                       0x8
+#define HDCP_CLK_STATUS__SYMCLKB_G_HDCP_CLOCK_ON__SHIFT                                                       0x9
+#define HDCP_CLK_STATUS__SYMCLKC_G_HDCP_CLOCK_ON__SHIFT                                                       0xa
+#define HDCP_CLK_STATUS__SYMCLKD_G_HDCP_CLOCK_ON__SHIFT                                                       0xb
+#define HDCP_CLK_STATUS__DISPCLK_G_HDCP_CLOCK_ON_MASK                                                         0x00000002L
+#define HDCP_CLK_STATUS__SYMCLKA_G_HDCP_CLOCK_ON_MASK                                                         0x00000100L
+#define HDCP_CLK_STATUS__SYMCLKB_G_HDCP_CLOCK_ON_MASK                                                         0x00000200L
+#define HDCP_CLK_STATUS__SYMCLKC_G_HDCP_CLOCK_ON_MASK                                                         0x00000400L
+#define HDCP_CLK_STATUS__SYMCLKD_G_HDCP_CLOCK_ON_MASK                                                         0x00000800L
+//DIO_HDMI_RXSTATUS_TIMER_CONTROL
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_ENABLE__SHIFT                                0x0
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_TYPE__SHIFT                                  0x4
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_STATUS__SHIFT                                0x8
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_MASK__SHIFT                                  0xc
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_INTERVAL__SHIFT                              0x10
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_ENABLE_MASK                                  0x00000001L
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_TYPE_MASK                                    0x00000010L
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_STATUS_MASK                                  0x00000100L
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_MASK_MASK                                    0x00001000L
+#define DIO_HDMI_RXSTATUS_TIMER_CONTROL__DIO_HDMI_RXSTATUS_TIMER_INTERVAL_MASK                                0x0FFF0000L
+//DIO_STATUS
+#define DIO_STATUS__DIO_EN__SHIFT                                                                             0x0
+#define DIO_STATUS__DIO_EN_MASK                                                                               0x00000001L
+
+
+// addressBlock: dce_dc_dio_dig_stream_mapper_dispdec
+//DIG0_STREAM_MAPPER_CONTROL
+#define DIG0_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET__SHIFT                                             0x0
+#define DIG0_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET_MASK                                               0x00000007L
+//DIG1_STREAM_MAPPER_CONTROL
+#define DIG1_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET__SHIFT                                             0x0
+#define DIG1_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET_MASK                                               0x00000007L
+//DIG2_STREAM_MAPPER_CONTROL
+#define DIG2_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET__SHIFT                                             0x0
+#define DIG2_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET_MASK                                               0x00000007L
+//DIG3_STREAM_MAPPER_CONTROL
+#define DIG3_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET__SHIFT                                             0x0
+#define DIG3_STREAM_MAPPER_CONTROL__DIG_STREAM_LINK_TARGET_MASK                                               0x00000007L
+
+
+// addressBlock: dce_dc_dio_dio_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON17_PERFCOUNTER_CNTL
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON17_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON17_PERFCOUNTER_CNTL2
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON17_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON17_PERFCOUNTER_STATE
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON17_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON17_PERFMON_CNTL
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON17_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON17_PERFMON_CNTL2
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON17_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON17_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON17_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON17_PERFMON_CVALUE_LOW
+#define DC_PERFMON17_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON17_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON17_PERFMON_HI
+#define DC_PERFMON17_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON17_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON17_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON17_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON17_PERFMON_LOW
+#define DC_PERFMON17_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON17_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON17_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON17_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON17_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dsc0_dispdec_dscc_dispdec
+//DSCC0_DSCC_CONFIG0
+#define DSCC0_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE__SHIFT                                                   0x0
+#define DSCC0_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE__SHIFT                                                  0x4
+#define DSCC0_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN__SHIFT                                                  0x8
+#define DSCC0_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION__SHIFT                                     0x10
+#define DSCC0_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE_MASK                                                     0x00000001L
+#define DSCC0_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE_MASK                                                    0x00000070L
+#define DSCC0_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN_MASK                                                    0x00000100L
+#define DSCC0_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION_MASK                                       0xFFFF0000L
+//DSCC0_DSCC_CONFIG1
+#define DSCC0_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE__SHIFT                                        0x0
+#define DSCC0_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE_MASK                                          0x0003FFFFL
+//DSCC0_DSCC_CONFIG2
+#define DSCC0_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD__SHIFT                                         0x0
+#define DSCC0_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD__SHIFT                                  0x10
+#define DSCC0_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD_MASK                                           0x0000FFFFL
+#define DSCC0_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD_MASK                                    0xFFFF0000L
+//DSCC0_DSCC_CONFIG3
+#define DSCC0_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET__SHIFT                                                  0x0
+#define DSCC0_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN__SHIFT                           0xc
+#define DSCC0_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY__SHIFT                                       0x10
+#define DSCC0_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET_MASK                                                    0x000007FFL
+#define DSCC0_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN_MASK                             0x00001000L
+#define DSCC0_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_MASK                                         0x03FF0000L
+//DSCC0_DSCC_STATUS
+#define DSCC0_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                       0x0
+#define DSCC0_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                         0x00000001L
+//DSCC0_DSCC_INTERRUPT_CONTROL0
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0__SHIFT        0x0
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1__SHIFT        0x1
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2__SHIFT        0x2
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3__SHIFT        0x3
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4__SHIFT        0x4
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5__SHIFT        0x5
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6__SHIFT        0x6
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7__SHIFT        0x7
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0__SHIFT       0x10
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1__SHIFT       0x11
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2__SHIFT       0x12
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3__SHIFT       0x13
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4__SHIFT       0x14
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5__SHIFT       0x15
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6__SHIFT       0x16
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7__SHIFT       0x17
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0_MASK          0x00000001L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1_MASK          0x00000002L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2_MASK          0x00000004L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3_MASK          0x00000008L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4_MASK          0x00000010L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5_MASK          0x00000020L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6_MASK          0x00000040L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7_MASK          0x00000080L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0_MASK         0x00010000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1_MASK         0x00020000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2_MASK         0x00040000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3_MASK         0x00080000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4_MASK         0x00100000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5_MASK         0x00200000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6_MASK         0x00400000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7_MASK         0x00800000L
+//DSCC0_DSCC_INTERRUPT_CONTROL1
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0__SHIFT                    0x0
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1__SHIFT                    0x1
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2__SHIFT                    0x2
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3__SHIFT                    0x3
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4__SHIFT                    0x4
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5__SHIFT                    0x5
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6__SHIFT                    0x6
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7__SHIFT                    0x7
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0__SHIFT                   0x10
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1__SHIFT                   0x11
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2__SHIFT                   0x12
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3__SHIFT                   0x13
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4__SHIFT                   0x14
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5__SHIFT                   0x15
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6__SHIFT                   0x16
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7__SHIFT                   0x17
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0_MASK                      0x00000001L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1_MASK                      0x00000002L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2_MASK                      0x00000004L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3_MASK                      0x00000008L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4_MASK                      0x00000010L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5_MASK                      0x00000020L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6_MASK                      0x00000040L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7_MASK                      0x00000080L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0_MASK                     0x00010000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1_MASK                     0x00020000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2_MASK                     0x00040000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3_MASK                     0x00080000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4_MASK                     0x00100000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5_MASK                     0x00200000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6_MASK                     0x00400000L
+#define DSCC0_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7_MASK                     0x00800000L
+//DSCC0_DSCC_INTERRUPT_CONTROL2
+#define DSCC0_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN__SHIFT                   0x0
+#define DSCC0_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN_MASK                     0x00000001L
+//DSCC0_DSCC_INTERRUPT_STATUS0
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0__SHIFT                0x0
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1__SHIFT                0x1
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2__SHIFT                0x2
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3__SHIFT                0x3
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4__SHIFT                0x4
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5__SHIFT                0x5
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6__SHIFT                0x6
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7__SHIFT                0x7
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0__SHIFT               0x10
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1__SHIFT               0x11
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2__SHIFT               0x12
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3__SHIFT               0x13
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4__SHIFT               0x14
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5__SHIFT               0x15
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6__SHIFT               0x16
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7__SHIFT               0x17
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0_MASK                  0x00000001L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1_MASK                  0x00000002L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2_MASK                  0x00000004L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3_MASK                  0x00000008L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4_MASK                  0x00000010L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5_MASK                  0x00000020L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6_MASK                  0x00000040L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7_MASK                  0x00000080L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0_MASK                 0x00010000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1_MASK                 0x00020000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2_MASK                 0x00040000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3_MASK                 0x00080000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4_MASK                 0x00100000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5_MASK                 0x00200000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6_MASK                 0x00400000L
+#define DSCC0_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7_MASK                 0x00800000L
+//DSCC0_DSCC_INTERRUPT_STATUS1
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0__SHIFT                            0x0
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1__SHIFT                            0x1
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2__SHIFT                            0x2
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3__SHIFT                            0x3
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4__SHIFT                            0x4
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5__SHIFT                            0x5
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6__SHIFT                            0x6
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7__SHIFT                            0x7
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0__SHIFT                           0x10
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1__SHIFT                           0x11
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2__SHIFT                           0x12
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3__SHIFT                           0x13
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4__SHIFT                           0x14
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5__SHIFT                           0x15
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6__SHIFT                           0x16
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7__SHIFT                           0x17
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0_MASK                              0x00000001L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1_MASK                              0x00000002L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2_MASK                              0x00000004L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3_MASK                              0x00000008L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4_MASK                              0x00000010L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5_MASK                              0x00000020L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6_MASK                              0x00000040L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7_MASK                              0x00000080L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0_MASK                             0x00010000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1_MASK                             0x00020000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2_MASK                             0x00040000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3_MASK                             0x00080000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4_MASK                             0x00100000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5_MASK                             0x00200000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6_MASK                             0x00400000L
+#define DSCC0_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7_MASK                             0x00800000L
+//DSCC0_DSCC_INTERRUPT_STATUS2
+#define DSCC0_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED__SHIFT                           0x0
+#define DSCC0_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_MASK                             0x00000001L
+//DSCC0_DSCC_INTERRUPT_CLEAR0
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0__SHIFT                    0x0
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1__SHIFT                    0x1
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2__SHIFT                    0x2
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3__SHIFT                    0x3
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4__SHIFT                    0x4
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5__SHIFT                    0x5
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6__SHIFT                    0x6
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7__SHIFT                    0x7
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0__SHIFT                   0x10
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1__SHIFT                   0x11
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2__SHIFT                   0x12
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3__SHIFT                   0x13
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4__SHIFT                   0x14
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5__SHIFT                   0x15
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6__SHIFT                   0x16
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7__SHIFT                   0x17
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0_MASK                      0x00000001L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1_MASK                      0x00000002L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2_MASK                      0x00000004L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3_MASK                      0x00000008L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4_MASK                      0x00000010L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5_MASK                      0x00000020L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6_MASK                      0x00000040L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7_MASK                      0x00000080L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0_MASK                     0x00010000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1_MASK                     0x00020000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2_MASK                     0x00040000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3_MASK                     0x00080000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4_MASK                     0x00100000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5_MASK                     0x00200000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6_MASK                     0x00400000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7_MASK                     0x00800000L
+//DSCC0_DSCC_INTERRUPT_CLEAR1
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0__SHIFT                                0x0
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1__SHIFT                                0x1
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2__SHIFT                                0x2
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3__SHIFT                                0x3
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4__SHIFT                                0x4
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5__SHIFT                                0x5
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6__SHIFT                                0x6
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7__SHIFT                                0x7
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0__SHIFT                               0x10
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1__SHIFT                               0x11
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2__SHIFT                               0x12
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3__SHIFT                               0x13
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4__SHIFT                               0x14
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5__SHIFT                               0x15
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6__SHIFT                               0x16
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7__SHIFT                               0x17
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0_MASK                                  0x00000001L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1_MASK                                  0x00000002L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2_MASK                                  0x00000004L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3_MASK                                  0x00000008L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4_MASK                                  0x00000010L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5_MASK                                  0x00000020L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6_MASK                                  0x00000040L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7_MASK                                  0x00000080L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0_MASK                                 0x00010000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1_MASK                                 0x00020000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2_MASK                                 0x00040000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3_MASK                                 0x00080000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4_MASK                                 0x00100000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5_MASK                                 0x00200000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6_MASK                                 0x00400000L
+#define DSCC0_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7_MASK                                 0x00800000L
+//DSCC0_DSCC_INTERRUPT_CLEAR2
+#define DSCC0_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR__SHIFT                               0x0
+#define DSCC0_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR_MASK                                 0x00000001L
+//DSCC0_DSCC_PPS_CONFIG0
+#define DSCC0_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR__SHIFT                                                      0x0
+#define DSCC0_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR__SHIFT                                                      0x4
+#define DSCC0_DSCC_PPS_CONFIG0__PPS_IDENTIFIER__SHIFT                                                         0x8
+#define DSCC0_DSCC_PPS_CONFIG0__LINEBUF_DEPTH__SHIFT                                                          0x18
+#define DSCC0_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT__SHIFT                                                     0x1c
+#define DSCC0_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR_MASK                                                        0x0000000FL
+#define DSCC0_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR_MASK                                                        0x000000F0L
+#define DSCC0_DSCC_PPS_CONFIG0__PPS_IDENTIFIER_MASK                                                           0x0000FF00L
+#define DSCC0_DSCC_PPS_CONFIG0__LINEBUF_DEPTH_MASK                                                            0x0F000000L
+#define DSCC0_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT_MASK                                                       0xF0000000L
+//DSCC0_DSCC_PPS_CONFIG1
+#define DSCC0_DSCC_PPS_CONFIG1__BITS_PER_PIXEL__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG1__VBR_ENABLE__SHIFT                                                             0xa
+#define DSCC0_DSCC_PPS_CONFIG1__SIMPLE_422__SHIFT                                                             0xb
+#define DSCC0_DSCC_PPS_CONFIG1__CONVERT_RGB__SHIFT                                                            0xc
+#define DSCC0_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE__SHIFT                                                      0xd
+#define DSCC0_DSCC_PPS_CONFIG1__NATIVE_422__SHIFT                                                             0xe
+#define DSCC0_DSCC_PPS_CONFIG1__NATIVE_420__SHIFT                                                             0xf
+#define DSCC0_DSCC_PPS_CONFIG1__CHUNK_SIZE__SHIFT                                                             0x10
+#define DSCC0_DSCC_PPS_CONFIG1__BITS_PER_PIXEL_MASK                                                           0x000003FFL
+#define DSCC0_DSCC_PPS_CONFIG1__VBR_ENABLE_MASK                                                               0x00000400L
+#define DSCC0_DSCC_PPS_CONFIG1__SIMPLE_422_MASK                                                               0x00000800L
+#define DSCC0_DSCC_PPS_CONFIG1__CONVERT_RGB_MASK                                                              0x00001000L
+#define DSCC0_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE_MASK                                                        0x00002000L
+#define DSCC0_DSCC_PPS_CONFIG1__NATIVE_422_MASK                                                               0x00004000L
+#define DSCC0_DSCC_PPS_CONFIG1__NATIVE_420_MASK                                                               0x00008000L
+#define DSCC0_DSCC_PPS_CONFIG1__CHUNK_SIZE_MASK                                                               0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG2
+#define DSCC0_DSCC_PPS_CONFIG2__PIC_WIDTH__SHIFT                                                              0x0
+#define DSCC0_DSCC_PPS_CONFIG2__PIC_HEIGHT__SHIFT                                                             0x10
+#define DSCC0_DSCC_PPS_CONFIG2__PIC_WIDTH_MASK                                                                0x0000FFFFL
+#define DSCC0_DSCC_PPS_CONFIG2__PIC_HEIGHT_MASK                                                               0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG3
+#define DSCC0_DSCC_PPS_CONFIG3__SLICE_WIDTH__SHIFT                                                            0x0
+#define DSCC0_DSCC_PPS_CONFIG3__SLICE_HEIGHT__SHIFT                                                           0x10
+#define DSCC0_DSCC_PPS_CONFIG3__SLICE_WIDTH_MASK                                                              0x0000FFFFL
+#define DSCC0_DSCC_PPS_CONFIG3__SLICE_HEIGHT_MASK                                                             0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG4
+#define DSCC0_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY__SHIFT                                                     0x0
+#define DSCC0_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY__SHIFT                                                      0x10
+#define DSCC0_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY_MASK                                                       0x000003FFL
+#define DSCC0_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY_MASK                                                        0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG5
+#define DSCC0_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE__SHIFT                                                    0x0
+#define DSCC0_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL__SHIFT                                               0x10
+#define DSCC0_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE_MASK                                                      0x0000003FL
+#define DSCC0_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL_MASK                                                 0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG6
+#define DSCC0_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL__SHIFT                                               0x0
+#define DSCC0_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET__SHIFT                                                  0x10
+#define DSCC0_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET__SHIFT                                                 0x18
+#define DSCC0_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL_MASK                                                 0x00000FFFL
+#define DSCC0_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET_MASK                                                    0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET_MASK                                                   0x1F000000L
+//DSCC0_DSCC_PPS_CONFIG7
+#define DSCC0_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET__SHIFT                                                       0x10
+#define DSCC0_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC0_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET_MASK                                                         0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG8
+#define DSCC0_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ__SHIFT                                                 0x10
+#define DSCC0_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC0_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ_MASK                                                   0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG9
+#define DSCC0_DSCC_PPS_CONFIG9__INITIAL_OFFSET__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG9__FINAL_OFFSET__SHIFT                                                           0x10
+#define DSCC0_DSCC_PPS_CONFIG9__INITIAL_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC0_DSCC_PPS_CONFIG9__FINAL_OFFSET_MASK                                                             0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG10
+#define DSCC0_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP__SHIFT                                                       0x0
+#define DSCC0_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP__SHIFT                                                       0x8
+#define DSCC0_DSCC_PPS_CONFIG10__RC_MODEL_SIZE__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP_MASK                                                         0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP_MASK                                                         0x00001F00L
+#define DSCC0_DSCC_PPS_CONFIG10__RC_MODEL_SIZE_MASK                                                           0xFFFF0000L
+//DSCC0_DSCC_PPS_CONFIG11
+#define DSCC0_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0__SHIFT                                                  0x8
+#define DSCC0_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1__SHIFT                                                  0x10
+#define DSCC0_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO__SHIFT                                                      0x18
+#define DSCC0_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI__SHIFT                                                      0x1c
+#define DSCC0_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR_MASK                                                          0x0000000FL
+#define DSCC0_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0_MASK                                                    0x00001F00L
+#define DSCC0_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1_MASK                                                    0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO_MASK                                                        0x0F000000L
+#define DSCC0_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI_MASK                                                        0xF0000000L
+//DSCC0_DSCC_PPS_CONFIG12
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH0__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH1__SHIFT                                                        0x8
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH2__SHIFT                                                        0x10
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH3__SHIFT                                                        0x18
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH0_MASK                                                          0x000000FFL
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH1_MASK                                                          0x0000FF00L
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH2_MASK                                                          0x00FF0000L
+#define DSCC0_DSCC_PPS_CONFIG12__RC_BUF_THRESH3_MASK                                                          0xFF000000L
+//DSCC0_DSCC_PPS_CONFIG13
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH4__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH5__SHIFT                                                        0x8
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH6__SHIFT                                                        0x10
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH7__SHIFT                                                        0x18
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH4_MASK                                                          0x000000FFL
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH5_MASK                                                          0x0000FF00L
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH6_MASK                                                          0x00FF0000L
+#define DSCC0_DSCC_PPS_CONFIG13__RC_BUF_THRESH7_MASK                                                          0xFF000000L
+//DSCC0_DSCC_PPS_CONFIG14
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH8__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH9__SHIFT                                                        0x8
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH10__SHIFT                                                       0x10
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH11__SHIFT                                                       0x18
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH8_MASK                                                          0x000000FFL
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH9_MASK                                                          0x0000FF00L
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH10_MASK                                                         0x00FF0000L
+#define DSCC0_DSCC_PPS_CONFIG14__RC_BUF_THRESH11_MASK                                                         0xFF000000L
+//DSCC0_DSCC_PPS_CONFIG15
+#define DSCC0_DSCC_PPS_CONFIG15__RC_BUF_THRESH12__SHIFT                                                       0x0
+#define DSCC0_DSCC_PPS_CONFIG15__RC_BUF_THRESH13__SHIFT                                                       0x8
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_MIN_QP0__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_MAX_QP0__SHIFT                                                         0x15
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0__SHIFT                                                     0x1a
+#define DSCC0_DSCC_PPS_CONFIG15__RC_BUF_THRESH12_MASK                                                         0x000000FFL
+#define DSCC0_DSCC_PPS_CONFIG15__RC_BUF_THRESH13_MASK                                                         0x0000FF00L
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_MIN_QP0_MASK                                                           0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_MAX_QP0_MASK                                                           0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0_MASK                                                       0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG16
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MIN_QP1__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MAX_QP1__SHIFT                                                         0x5
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1__SHIFT                                                     0xa
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MIN_QP2__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MAX_QP2__SHIFT                                                         0x15
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2__SHIFT                                                     0x1a
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MIN_QP1_MASK                                                           0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MAX_QP1_MASK                                                           0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1_MASK                                                       0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MIN_QP2_MASK                                                           0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_MAX_QP2_MASK                                                           0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2_MASK                                                       0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG17
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MIN_QP3__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MAX_QP3__SHIFT                                                         0x5
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3__SHIFT                                                     0xa
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MIN_QP4__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MAX_QP4__SHIFT                                                         0x15
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4__SHIFT                                                     0x1a
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MIN_QP3_MASK                                                           0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MAX_QP3_MASK                                                           0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3_MASK                                                       0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MIN_QP4_MASK                                                           0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_MAX_QP4_MASK                                                           0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4_MASK                                                       0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG18
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MIN_QP5__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MAX_QP5__SHIFT                                                         0x5
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5__SHIFT                                                     0xa
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MIN_QP6__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MAX_QP6__SHIFT                                                         0x15
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6__SHIFT                                                     0x1a
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MIN_QP5_MASK                                                           0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MAX_QP5_MASK                                                           0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5_MASK                                                       0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MIN_QP6_MASK                                                           0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_MAX_QP6_MASK                                                           0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6_MASK                                                       0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG19
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MIN_QP7__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MAX_QP7__SHIFT                                                         0x5
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7__SHIFT                                                     0xa
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MIN_QP8__SHIFT                                                         0x10
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MAX_QP8__SHIFT                                                         0x15
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8__SHIFT                                                     0x1a
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MIN_QP7_MASK                                                           0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MAX_QP7_MASK                                                           0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7_MASK                                                       0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MIN_QP8_MASK                                                           0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_MAX_QP8_MASK                                                           0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8_MASK                                                       0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG20
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MIN_QP9__SHIFT                                                         0x0
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MAX_QP9__SHIFT                                                         0x5
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9__SHIFT                                                     0xa
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MIN_QP10__SHIFT                                                        0x10
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MAX_QP10__SHIFT                                                        0x15
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10__SHIFT                                                    0x1a
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MIN_QP9_MASK                                                           0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MAX_QP9_MASK                                                           0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9_MASK                                                       0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MIN_QP10_MASK                                                          0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_MAX_QP10_MASK                                                          0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10_MASK                                                      0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG21
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MIN_QP11__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MAX_QP11__SHIFT                                                        0x5
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11__SHIFT                                                    0xa
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MIN_QP12__SHIFT                                                        0x10
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MAX_QP12__SHIFT                                                        0x15
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12__SHIFT                                                    0x1a
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MIN_QP11_MASK                                                          0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MAX_QP11_MASK                                                          0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11_MASK                                                      0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MIN_QP12_MASK                                                          0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_MAX_QP12_MASK                                                          0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12_MASK                                                      0xFC000000L
+//DSCC0_DSCC_PPS_CONFIG22
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MIN_QP13__SHIFT                                                        0x0
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MAX_QP13__SHIFT                                                        0x5
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13__SHIFT                                                    0xa
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MIN_QP14__SHIFT                                                        0x10
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MAX_QP14__SHIFT                                                        0x15
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14__SHIFT                                                    0x1a
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MIN_QP13_MASK                                                          0x0000001FL
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MAX_QP13_MASK                                                          0x000003E0L
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13_MASK                                                      0x0000FC00L
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MIN_QP14_MASK                                                          0x001F0000L
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_MAX_QP14_MASK                                                          0x03E00000L
+#define DSCC0_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14_MASK                                                      0xFC000000L
+//DSCC0_DSCC_MEM_POWER_CONTROL0
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC0_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC0_DSCC_MEM_POWER_CONTROL1
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC0_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC0_DSCC_MEM_POWER_CONTROL2
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC0_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC0_DSCC_SLICE_CTX_SELECT
+#define DSCC0_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT__SHIFT                                             0x0
+#define DSCC0_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT_MASK                                               0x00000007L
+//DSCC0_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL
+#define DSCC0_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__SHIFT           0x0
+#define DSCC0_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_MASK             0x0000FFFFL
+//DSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL
+#define DSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__SHIFT             0x0
+#define DSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR__SHIFT       0x18
+#define DSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_MASK               0x0000FFFFL
+#define DSCC0_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR_MASK         0x01000000L
+//DSCC0_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__SHIFT   0x0
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_MASK     0x0001FFFFL
+//DSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__SHIFT     0x0
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR__SHIFT  0x18
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_MASK       0x0001FFFFL
+#define DSCC0_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR_MASK  0x01000000L
+//DSCC0_DSCC_RESET_CONTROL
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT__SHIFT                                             0x0
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT__SHIFT                                              0x10
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_RESET_MODE__SHIFT                                                      0x1f
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT_MASK                                               0x00003FFFL
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT_MASK                                                0x03FF0000L
+#define DSCC0_DSCC_RESET_CONTROL__DSCC_RESET_MODE_MASK                                                        0x80000000L
+//DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE__SHIFT                                  0x0
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE__SHIFT                                  0x8
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE__SHIFT                                  0x10
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE__SHIFT                                  0x18
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE_MASK                                    0x0000001FL
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE_MASK                                    0x00001F00L
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE_MASK                                    0x001F0000L
+#define DSCC0_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE_MASK                                    0x1F000000L
+
+
+// addressBlock: dce_dc_dsc0_dispdec_dsc_top_dispdec
+//DSC_TOP0_DSC_TOP_CONTROL
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_CLOCK_EN__SHIFT                                                         0x0
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS__SHIFT                                               0x4
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS__SHIFT                                                0x8
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS__SHIFT                                                     0xc
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                     0x10
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                    0x18
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_CLOCK_EN_MASK                                                           0x00000001L
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS_MASK                                                 0x00000010L
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS_MASK                                                  0x00000100L
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS_MASK                                                       0x00001000L
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                       0x00010000L
+#define DSC_TOP0_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                      0x01000000L
+//DSC_TOP0_DSC_DEBUG_CONTROL
+#define DSC_TOP0_DSC_DEBUG_CONTROL__DSC_DBG_EN__SHIFT                                                         0x0
+#define DSC_TOP0_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL__SHIFT                                             0x4
+#define DSC_TOP0_DSC_DEBUG_CONTROL__DSC_DBG_EN_MASK                                                           0x00000001L
+#define DSC_TOP0_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL_MASK                                               0x000000F0L
+
+
+// addressBlock: dce_dc_dsc1_dispdec_dscc_dispdec
+//DSCC1_DSCC_CONFIG0
+#define DSCC1_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE__SHIFT                                                   0x0
+#define DSCC1_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE__SHIFT                                                  0x4
+#define DSCC1_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN__SHIFT                                                  0x8
+#define DSCC1_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION__SHIFT                                     0x10
+#define DSCC1_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE_MASK                                                     0x00000001L
+#define DSCC1_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE_MASK                                                    0x00000070L
+#define DSCC1_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN_MASK                                                    0x00000100L
+#define DSCC1_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION_MASK                                       0xFFFF0000L
+//DSCC1_DSCC_CONFIG1
+#define DSCC1_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE__SHIFT                                        0x0
+#define DSCC1_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE_MASK                                          0x0003FFFFL
+//DSCC1_DSCC_CONFIG2
+#define DSCC1_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD__SHIFT                                         0x0
+#define DSCC1_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD__SHIFT                                  0x10
+#define DSCC1_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD_MASK                                           0x0000FFFFL
+#define DSCC1_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD_MASK                                    0xFFFF0000L
+//DSCC1_DSCC_CONFIG3
+#define DSCC1_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET__SHIFT                                                  0x0
+#define DSCC1_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN__SHIFT                           0xc
+#define DSCC1_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY__SHIFT                                       0x10
+#define DSCC1_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET_MASK                                                    0x000007FFL
+#define DSCC1_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN_MASK                             0x00001000L
+#define DSCC1_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_MASK                                         0x03FF0000L
+//DSCC1_DSCC_STATUS
+#define DSCC1_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                       0x0
+#define DSCC1_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                         0x00000001L
+//DSCC1_DSCC_INTERRUPT_CONTROL0
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0__SHIFT        0x0
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1__SHIFT        0x1
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2__SHIFT        0x2
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3__SHIFT        0x3
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4__SHIFT        0x4
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5__SHIFT        0x5
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6__SHIFT        0x6
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7__SHIFT        0x7
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0__SHIFT       0x10
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1__SHIFT       0x11
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2__SHIFT       0x12
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3__SHIFT       0x13
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4__SHIFT       0x14
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5__SHIFT       0x15
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6__SHIFT       0x16
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7__SHIFT       0x17
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0_MASK          0x00000001L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1_MASK          0x00000002L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2_MASK          0x00000004L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3_MASK          0x00000008L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4_MASK          0x00000010L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5_MASK          0x00000020L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6_MASK          0x00000040L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7_MASK          0x00000080L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0_MASK         0x00010000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1_MASK         0x00020000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2_MASK         0x00040000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3_MASK         0x00080000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4_MASK         0x00100000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5_MASK         0x00200000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6_MASK         0x00400000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7_MASK         0x00800000L
+//DSCC1_DSCC_INTERRUPT_CONTROL1
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0__SHIFT                    0x0
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1__SHIFT                    0x1
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2__SHIFT                    0x2
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3__SHIFT                    0x3
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4__SHIFT                    0x4
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5__SHIFT                    0x5
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6__SHIFT                    0x6
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7__SHIFT                    0x7
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0__SHIFT                   0x10
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1__SHIFT                   0x11
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2__SHIFT                   0x12
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3__SHIFT                   0x13
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4__SHIFT                   0x14
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5__SHIFT                   0x15
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6__SHIFT                   0x16
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7__SHIFT                   0x17
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0_MASK                      0x00000001L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1_MASK                      0x00000002L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2_MASK                      0x00000004L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3_MASK                      0x00000008L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4_MASK                      0x00000010L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5_MASK                      0x00000020L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6_MASK                      0x00000040L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7_MASK                      0x00000080L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0_MASK                     0x00010000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1_MASK                     0x00020000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2_MASK                     0x00040000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3_MASK                     0x00080000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4_MASK                     0x00100000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5_MASK                     0x00200000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6_MASK                     0x00400000L
+#define DSCC1_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7_MASK                     0x00800000L
+//DSCC1_DSCC_INTERRUPT_CONTROL2
+#define DSCC1_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN__SHIFT                   0x0
+#define DSCC1_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN_MASK                     0x00000001L
+//DSCC1_DSCC_INTERRUPT_STATUS0
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0__SHIFT                0x0
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1__SHIFT                0x1
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2__SHIFT                0x2
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3__SHIFT                0x3
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4__SHIFT                0x4
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5__SHIFT                0x5
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6__SHIFT                0x6
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7__SHIFT                0x7
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0__SHIFT               0x10
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1__SHIFT               0x11
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2__SHIFT               0x12
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3__SHIFT               0x13
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4__SHIFT               0x14
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5__SHIFT               0x15
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6__SHIFT               0x16
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7__SHIFT               0x17
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0_MASK                  0x00000001L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1_MASK                  0x00000002L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2_MASK                  0x00000004L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3_MASK                  0x00000008L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4_MASK                  0x00000010L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5_MASK                  0x00000020L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6_MASK                  0x00000040L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7_MASK                  0x00000080L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0_MASK                 0x00010000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1_MASK                 0x00020000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2_MASK                 0x00040000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3_MASK                 0x00080000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4_MASK                 0x00100000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5_MASK                 0x00200000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6_MASK                 0x00400000L
+#define DSCC1_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7_MASK                 0x00800000L
+//DSCC1_DSCC_INTERRUPT_STATUS1
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0__SHIFT                            0x0
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1__SHIFT                            0x1
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2__SHIFT                            0x2
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3__SHIFT                            0x3
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4__SHIFT                            0x4
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5__SHIFT                            0x5
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6__SHIFT                            0x6
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7__SHIFT                            0x7
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0__SHIFT                           0x10
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1__SHIFT                           0x11
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2__SHIFT                           0x12
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3__SHIFT                           0x13
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4__SHIFT                           0x14
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5__SHIFT                           0x15
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6__SHIFT                           0x16
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7__SHIFT                           0x17
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0_MASK                              0x00000001L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1_MASK                              0x00000002L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2_MASK                              0x00000004L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3_MASK                              0x00000008L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4_MASK                              0x00000010L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5_MASK                              0x00000020L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6_MASK                              0x00000040L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7_MASK                              0x00000080L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0_MASK                             0x00010000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1_MASK                             0x00020000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2_MASK                             0x00040000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3_MASK                             0x00080000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4_MASK                             0x00100000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5_MASK                             0x00200000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6_MASK                             0x00400000L
+#define DSCC1_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7_MASK                             0x00800000L
+//DSCC1_DSCC_INTERRUPT_STATUS2
+#define DSCC1_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED__SHIFT                           0x0
+#define DSCC1_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_MASK                             0x00000001L
+//DSCC1_DSCC_INTERRUPT_CLEAR0
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0__SHIFT                    0x0
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1__SHIFT                    0x1
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2__SHIFT                    0x2
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3__SHIFT                    0x3
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4__SHIFT                    0x4
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5__SHIFT                    0x5
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6__SHIFT                    0x6
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7__SHIFT                    0x7
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0__SHIFT                   0x10
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1__SHIFT                   0x11
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2__SHIFT                   0x12
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3__SHIFT                   0x13
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4__SHIFT                   0x14
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5__SHIFT                   0x15
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6__SHIFT                   0x16
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7__SHIFT                   0x17
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0_MASK                      0x00000001L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1_MASK                      0x00000002L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2_MASK                      0x00000004L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3_MASK                      0x00000008L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4_MASK                      0x00000010L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5_MASK                      0x00000020L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6_MASK                      0x00000040L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7_MASK                      0x00000080L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0_MASK                     0x00010000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1_MASK                     0x00020000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2_MASK                     0x00040000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3_MASK                     0x00080000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4_MASK                     0x00100000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5_MASK                     0x00200000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6_MASK                     0x00400000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7_MASK                     0x00800000L
+//DSCC1_DSCC_INTERRUPT_CLEAR1
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0__SHIFT                                0x0
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1__SHIFT                                0x1
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2__SHIFT                                0x2
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3__SHIFT                                0x3
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4__SHIFT                                0x4
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5__SHIFT                                0x5
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6__SHIFT                                0x6
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7__SHIFT                                0x7
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0__SHIFT                               0x10
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1__SHIFT                               0x11
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2__SHIFT                               0x12
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3__SHIFT                               0x13
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4__SHIFT                               0x14
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5__SHIFT                               0x15
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6__SHIFT                               0x16
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7__SHIFT                               0x17
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0_MASK                                  0x00000001L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1_MASK                                  0x00000002L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2_MASK                                  0x00000004L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3_MASK                                  0x00000008L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4_MASK                                  0x00000010L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5_MASK                                  0x00000020L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6_MASK                                  0x00000040L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7_MASK                                  0x00000080L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0_MASK                                 0x00010000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1_MASK                                 0x00020000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2_MASK                                 0x00040000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3_MASK                                 0x00080000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4_MASK                                 0x00100000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5_MASK                                 0x00200000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6_MASK                                 0x00400000L
+#define DSCC1_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7_MASK                                 0x00800000L
+//DSCC1_DSCC_INTERRUPT_CLEAR2
+#define DSCC1_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR__SHIFT                               0x0
+#define DSCC1_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR_MASK                                 0x00000001L
+//DSCC1_DSCC_PPS_CONFIG0
+#define DSCC1_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR__SHIFT                                                      0x0
+#define DSCC1_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR__SHIFT                                                      0x4
+#define DSCC1_DSCC_PPS_CONFIG0__PPS_IDENTIFIER__SHIFT                                                         0x8
+#define DSCC1_DSCC_PPS_CONFIG0__LINEBUF_DEPTH__SHIFT                                                          0x18
+#define DSCC1_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT__SHIFT                                                     0x1c
+#define DSCC1_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR_MASK                                                        0x0000000FL
+#define DSCC1_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR_MASK                                                        0x000000F0L
+#define DSCC1_DSCC_PPS_CONFIG0__PPS_IDENTIFIER_MASK                                                           0x0000FF00L
+#define DSCC1_DSCC_PPS_CONFIG0__LINEBUF_DEPTH_MASK                                                            0x0F000000L
+#define DSCC1_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT_MASK                                                       0xF0000000L
+//DSCC1_DSCC_PPS_CONFIG1
+#define DSCC1_DSCC_PPS_CONFIG1__BITS_PER_PIXEL__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG1__VBR_ENABLE__SHIFT                                                             0xa
+#define DSCC1_DSCC_PPS_CONFIG1__SIMPLE_422__SHIFT                                                             0xb
+#define DSCC1_DSCC_PPS_CONFIG1__CONVERT_RGB__SHIFT                                                            0xc
+#define DSCC1_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE__SHIFT                                                      0xd
+#define DSCC1_DSCC_PPS_CONFIG1__NATIVE_422__SHIFT                                                             0xe
+#define DSCC1_DSCC_PPS_CONFIG1__NATIVE_420__SHIFT                                                             0xf
+#define DSCC1_DSCC_PPS_CONFIG1__CHUNK_SIZE__SHIFT                                                             0x10
+#define DSCC1_DSCC_PPS_CONFIG1__BITS_PER_PIXEL_MASK                                                           0x000003FFL
+#define DSCC1_DSCC_PPS_CONFIG1__VBR_ENABLE_MASK                                                               0x00000400L
+#define DSCC1_DSCC_PPS_CONFIG1__SIMPLE_422_MASK                                                               0x00000800L
+#define DSCC1_DSCC_PPS_CONFIG1__CONVERT_RGB_MASK                                                              0x00001000L
+#define DSCC1_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE_MASK                                                        0x00002000L
+#define DSCC1_DSCC_PPS_CONFIG1__NATIVE_422_MASK                                                               0x00004000L
+#define DSCC1_DSCC_PPS_CONFIG1__NATIVE_420_MASK                                                               0x00008000L
+#define DSCC1_DSCC_PPS_CONFIG1__CHUNK_SIZE_MASK                                                               0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG2
+#define DSCC1_DSCC_PPS_CONFIG2__PIC_WIDTH__SHIFT                                                              0x0
+#define DSCC1_DSCC_PPS_CONFIG2__PIC_HEIGHT__SHIFT                                                             0x10
+#define DSCC1_DSCC_PPS_CONFIG2__PIC_WIDTH_MASK                                                                0x0000FFFFL
+#define DSCC1_DSCC_PPS_CONFIG2__PIC_HEIGHT_MASK                                                               0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG3
+#define DSCC1_DSCC_PPS_CONFIG3__SLICE_WIDTH__SHIFT                                                            0x0
+#define DSCC1_DSCC_PPS_CONFIG3__SLICE_HEIGHT__SHIFT                                                           0x10
+#define DSCC1_DSCC_PPS_CONFIG3__SLICE_WIDTH_MASK                                                              0x0000FFFFL
+#define DSCC1_DSCC_PPS_CONFIG3__SLICE_HEIGHT_MASK                                                             0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG4
+#define DSCC1_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY__SHIFT                                                     0x0
+#define DSCC1_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY__SHIFT                                                      0x10
+#define DSCC1_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY_MASK                                                       0x000003FFL
+#define DSCC1_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY_MASK                                                        0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG5
+#define DSCC1_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE__SHIFT                                                    0x0
+#define DSCC1_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL__SHIFT                                               0x10
+#define DSCC1_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE_MASK                                                      0x0000003FL
+#define DSCC1_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL_MASK                                                 0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG6
+#define DSCC1_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL__SHIFT                                               0x0
+#define DSCC1_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET__SHIFT                                                  0x10
+#define DSCC1_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET__SHIFT                                                 0x18
+#define DSCC1_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL_MASK                                                 0x00000FFFL
+#define DSCC1_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET_MASK                                                    0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET_MASK                                                   0x1F000000L
+//DSCC1_DSCC_PPS_CONFIG7
+#define DSCC1_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET__SHIFT                                                       0x10
+#define DSCC1_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC1_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET_MASK                                                         0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG8
+#define DSCC1_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ__SHIFT                                                 0x10
+#define DSCC1_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC1_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ_MASK                                                   0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG9
+#define DSCC1_DSCC_PPS_CONFIG9__INITIAL_OFFSET__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG9__FINAL_OFFSET__SHIFT                                                           0x10
+#define DSCC1_DSCC_PPS_CONFIG9__INITIAL_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC1_DSCC_PPS_CONFIG9__FINAL_OFFSET_MASK                                                             0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG10
+#define DSCC1_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP__SHIFT                                                       0x0
+#define DSCC1_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP__SHIFT                                                       0x8
+#define DSCC1_DSCC_PPS_CONFIG10__RC_MODEL_SIZE__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP_MASK                                                         0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP_MASK                                                         0x00001F00L
+#define DSCC1_DSCC_PPS_CONFIG10__RC_MODEL_SIZE_MASK                                                           0xFFFF0000L
+//DSCC1_DSCC_PPS_CONFIG11
+#define DSCC1_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0__SHIFT                                                  0x8
+#define DSCC1_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1__SHIFT                                                  0x10
+#define DSCC1_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO__SHIFT                                                      0x18
+#define DSCC1_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI__SHIFT                                                      0x1c
+#define DSCC1_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR_MASK                                                          0x0000000FL
+#define DSCC1_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0_MASK                                                    0x00001F00L
+#define DSCC1_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1_MASK                                                    0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO_MASK                                                        0x0F000000L
+#define DSCC1_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI_MASK                                                        0xF0000000L
+//DSCC1_DSCC_PPS_CONFIG12
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH0__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH1__SHIFT                                                        0x8
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH2__SHIFT                                                        0x10
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH3__SHIFT                                                        0x18
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH0_MASK                                                          0x000000FFL
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH1_MASK                                                          0x0000FF00L
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH2_MASK                                                          0x00FF0000L
+#define DSCC1_DSCC_PPS_CONFIG12__RC_BUF_THRESH3_MASK                                                          0xFF000000L
+//DSCC1_DSCC_PPS_CONFIG13
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH4__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH5__SHIFT                                                        0x8
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH6__SHIFT                                                        0x10
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH7__SHIFT                                                        0x18
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH4_MASK                                                          0x000000FFL
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH5_MASK                                                          0x0000FF00L
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH6_MASK                                                          0x00FF0000L
+#define DSCC1_DSCC_PPS_CONFIG13__RC_BUF_THRESH7_MASK                                                          0xFF000000L
+//DSCC1_DSCC_PPS_CONFIG14
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH8__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH9__SHIFT                                                        0x8
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH10__SHIFT                                                       0x10
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH11__SHIFT                                                       0x18
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH8_MASK                                                          0x000000FFL
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH9_MASK                                                          0x0000FF00L
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH10_MASK                                                         0x00FF0000L
+#define DSCC1_DSCC_PPS_CONFIG14__RC_BUF_THRESH11_MASK                                                         0xFF000000L
+//DSCC1_DSCC_PPS_CONFIG15
+#define DSCC1_DSCC_PPS_CONFIG15__RC_BUF_THRESH12__SHIFT                                                       0x0
+#define DSCC1_DSCC_PPS_CONFIG15__RC_BUF_THRESH13__SHIFT                                                       0x8
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_MIN_QP0__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_MAX_QP0__SHIFT                                                         0x15
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0__SHIFT                                                     0x1a
+#define DSCC1_DSCC_PPS_CONFIG15__RC_BUF_THRESH12_MASK                                                         0x000000FFL
+#define DSCC1_DSCC_PPS_CONFIG15__RC_BUF_THRESH13_MASK                                                         0x0000FF00L
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_MIN_QP0_MASK                                                           0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_MAX_QP0_MASK                                                           0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0_MASK                                                       0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG16
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MIN_QP1__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MAX_QP1__SHIFT                                                         0x5
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1__SHIFT                                                     0xa
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MIN_QP2__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MAX_QP2__SHIFT                                                         0x15
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2__SHIFT                                                     0x1a
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MIN_QP1_MASK                                                           0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MAX_QP1_MASK                                                           0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1_MASK                                                       0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MIN_QP2_MASK                                                           0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_MAX_QP2_MASK                                                           0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2_MASK                                                       0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG17
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MIN_QP3__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MAX_QP3__SHIFT                                                         0x5
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3__SHIFT                                                     0xa
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MIN_QP4__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MAX_QP4__SHIFT                                                         0x15
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4__SHIFT                                                     0x1a
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MIN_QP3_MASK                                                           0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MAX_QP3_MASK                                                           0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3_MASK                                                       0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MIN_QP4_MASK                                                           0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_MAX_QP4_MASK                                                           0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4_MASK                                                       0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG18
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MIN_QP5__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MAX_QP5__SHIFT                                                         0x5
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5__SHIFT                                                     0xa
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MIN_QP6__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MAX_QP6__SHIFT                                                         0x15
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6__SHIFT                                                     0x1a
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MIN_QP5_MASK                                                           0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MAX_QP5_MASK                                                           0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5_MASK                                                       0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MIN_QP6_MASK                                                           0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_MAX_QP6_MASK                                                           0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6_MASK                                                       0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG19
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MIN_QP7__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MAX_QP7__SHIFT                                                         0x5
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7__SHIFT                                                     0xa
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MIN_QP8__SHIFT                                                         0x10
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MAX_QP8__SHIFT                                                         0x15
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8__SHIFT                                                     0x1a
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MIN_QP7_MASK                                                           0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MAX_QP7_MASK                                                           0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7_MASK                                                       0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MIN_QP8_MASK                                                           0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_MAX_QP8_MASK                                                           0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8_MASK                                                       0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG20
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MIN_QP9__SHIFT                                                         0x0
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MAX_QP9__SHIFT                                                         0x5
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9__SHIFT                                                     0xa
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MIN_QP10__SHIFT                                                        0x10
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MAX_QP10__SHIFT                                                        0x15
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10__SHIFT                                                    0x1a
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MIN_QP9_MASK                                                           0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MAX_QP9_MASK                                                           0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9_MASK                                                       0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MIN_QP10_MASK                                                          0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_MAX_QP10_MASK                                                          0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10_MASK                                                      0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG21
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MIN_QP11__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MAX_QP11__SHIFT                                                        0x5
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11__SHIFT                                                    0xa
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MIN_QP12__SHIFT                                                        0x10
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MAX_QP12__SHIFT                                                        0x15
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12__SHIFT                                                    0x1a
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MIN_QP11_MASK                                                          0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MAX_QP11_MASK                                                          0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11_MASK                                                      0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MIN_QP12_MASK                                                          0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_MAX_QP12_MASK                                                          0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12_MASK                                                      0xFC000000L
+//DSCC1_DSCC_PPS_CONFIG22
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MIN_QP13__SHIFT                                                        0x0
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MAX_QP13__SHIFT                                                        0x5
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13__SHIFT                                                    0xa
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MIN_QP14__SHIFT                                                        0x10
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MAX_QP14__SHIFT                                                        0x15
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14__SHIFT                                                    0x1a
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MIN_QP13_MASK                                                          0x0000001FL
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MAX_QP13_MASK                                                          0x000003E0L
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13_MASK                                                      0x0000FC00L
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MIN_QP14_MASK                                                          0x001F0000L
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_MAX_QP14_MASK                                                          0x03E00000L
+#define DSCC1_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14_MASK                                                      0xFC000000L
+//DSCC1_DSCC_MEM_POWER_CONTROL0
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC1_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC1_DSCC_MEM_POWER_CONTROL1
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC1_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC1_DSCC_MEM_POWER_CONTROL2
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC1_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC1_DSCC_SLICE_CTX_SELECT
+#define DSCC1_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT__SHIFT                                             0x0
+#define DSCC1_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT_MASK                                               0x00000007L
+//DSCC1_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL
+#define DSCC1_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__SHIFT           0x0
+#define DSCC1_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_MASK             0x0000FFFFL
+//DSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL
+#define DSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__SHIFT             0x0
+#define DSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR__SHIFT       0x18
+#define DSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_MASK               0x0000FFFFL
+#define DSCC1_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR_MASK         0x01000000L
+//DSCC1_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__SHIFT   0x0
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_MASK     0x0001FFFFL
+//DSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__SHIFT     0x0
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR__SHIFT  0x18
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_MASK       0x0001FFFFL
+#define DSCC1_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR_MASK  0x01000000L
+//DSCC1_DSCC_RESET_CONTROL
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT__SHIFT                                             0x0
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT__SHIFT                                              0x10
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_RESET_MODE__SHIFT                                                      0x1f
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT_MASK                                               0x00003FFFL
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT_MASK                                                0x03FF0000L
+#define DSCC1_DSCC_RESET_CONTROL__DSCC_RESET_MODE_MASK                                                        0x80000000L
+//DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE__SHIFT                                  0x0
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE__SHIFT                                  0x8
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE__SHIFT                                  0x10
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE__SHIFT                                  0x18
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE_MASK                                    0x0000001FL
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE_MASK                                    0x00001F00L
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE_MASK                                    0x001F0000L
+#define DSCC1_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE_MASK                                    0x1F000000L
+
+
+// addressBlock: dce_dc_dsc1_dispdec_dsc_top_dispdec
+//DSC_TOP1_DSC_TOP_CONTROL
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_CLOCK_EN__SHIFT                                                         0x0
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS__SHIFT                                               0x4
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS__SHIFT                                                0x8
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS__SHIFT                                                     0xc
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                     0x10
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                    0x18
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_CLOCK_EN_MASK                                                           0x00000001L
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS_MASK                                                 0x00000010L
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS_MASK                                                  0x00000100L
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS_MASK                                                       0x00001000L
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                       0x00010000L
+#define DSC_TOP1_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                      0x01000000L
+//DSC_TOP1_DSC_DEBUG_CONTROL
+#define DSC_TOP1_DSC_DEBUG_CONTROL__DSC_DBG_EN__SHIFT                                                         0x0
+#define DSC_TOP1_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL__SHIFT                                             0x4
+#define DSC_TOP1_DSC_DEBUG_CONTROL__DSC_DBG_EN_MASK                                                           0x00000001L
+#define DSC_TOP1_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL_MASK                                               0x000000F0L
+
+
+// addressBlock: dce_dc_dsc2_dispdec_dscc_dispdec
+//DSCC2_DSCC_CONFIG0
+#define DSCC2_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE__SHIFT                                                   0x0
+#define DSCC2_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE__SHIFT                                                  0x4
+#define DSCC2_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN__SHIFT                                                  0x8
+#define DSCC2_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION__SHIFT                                     0x10
+#define DSCC2_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE_MASK                                                     0x00000001L
+#define DSCC2_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE_MASK                                                    0x00000070L
+#define DSCC2_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN_MASK                                                    0x00000100L
+#define DSCC2_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION_MASK                                       0xFFFF0000L
+//DSCC2_DSCC_CONFIG1
+#define DSCC2_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE__SHIFT                                        0x0
+#define DSCC2_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE_MASK                                          0x0003FFFFL
+//DSCC2_DSCC_CONFIG2
+#define DSCC2_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD__SHIFT                                         0x0
+#define DSCC2_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD__SHIFT                                  0x10
+#define DSCC2_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD_MASK                                           0x0000FFFFL
+#define DSCC2_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD_MASK                                    0xFFFF0000L
+//DSCC2_DSCC_CONFIG3
+#define DSCC2_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET__SHIFT                                                  0x0
+#define DSCC2_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN__SHIFT                           0xc
+#define DSCC2_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY__SHIFT                                       0x10
+#define DSCC2_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET_MASK                                                    0x000007FFL
+#define DSCC2_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN_MASK                             0x00001000L
+#define DSCC2_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_MASK                                         0x03FF0000L
+//DSCC2_DSCC_STATUS
+#define DSCC2_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                       0x0
+#define DSCC2_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                         0x00000001L
+//DSCC2_DSCC_INTERRUPT_CONTROL0
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0__SHIFT        0x0
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1__SHIFT        0x1
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2__SHIFT        0x2
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3__SHIFT        0x3
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4__SHIFT        0x4
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5__SHIFT        0x5
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6__SHIFT        0x6
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7__SHIFT        0x7
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0__SHIFT       0x10
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1__SHIFT       0x11
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2__SHIFT       0x12
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3__SHIFT       0x13
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4__SHIFT       0x14
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5__SHIFT       0x15
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6__SHIFT       0x16
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7__SHIFT       0x17
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0_MASK          0x00000001L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1_MASK          0x00000002L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2_MASK          0x00000004L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3_MASK          0x00000008L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4_MASK          0x00000010L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5_MASK          0x00000020L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6_MASK          0x00000040L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7_MASK          0x00000080L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0_MASK         0x00010000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1_MASK         0x00020000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2_MASK         0x00040000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3_MASK         0x00080000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4_MASK         0x00100000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5_MASK         0x00200000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6_MASK         0x00400000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7_MASK         0x00800000L
+//DSCC2_DSCC_INTERRUPT_CONTROL1
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0__SHIFT                    0x0
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1__SHIFT                    0x1
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2__SHIFT                    0x2
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3__SHIFT                    0x3
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4__SHIFT                    0x4
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5__SHIFT                    0x5
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6__SHIFT                    0x6
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7__SHIFT                    0x7
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0__SHIFT                   0x10
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1__SHIFT                   0x11
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2__SHIFT                   0x12
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3__SHIFT                   0x13
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4__SHIFT                   0x14
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5__SHIFT                   0x15
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6__SHIFT                   0x16
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7__SHIFT                   0x17
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0_MASK                      0x00000001L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1_MASK                      0x00000002L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2_MASK                      0x00000004L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3_MASK                      0x00000008L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4_MASK                      0x00000010L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5_MASK                      0x00000020L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6_MASK                      0x00000040L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7_MASK                      0x00000080L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0_MASK                     0x00010000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1_MASK                     0x00020000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2_MASK                     0x00040000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3_MASK                     0x00080000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4_MASK                     0x00100000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5_MASK                     0x00200000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6_MASK                     0x00400000L
+#define DSCC2_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7_MASK                     0x00800000L
+//DSCC2_DSCC_INTERRUPT_CONTROL2
+#define DSCC2_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN__SHIFT                   0x0
+#define DSCC2_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN_MASK                     0x00000001L
+//DSCC2_DSCC_INTERRUPT_STATUS0
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0__SHIFT                0x0
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1__SHIFT                0x1
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2__SHIFT                0x2
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3__SHIFT                0x3
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4__SHIFT                0x4
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5__SHIFT                0x5
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6__SHIFT                0x6
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7__SHIFT                0x7
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0__SHIFT               0x10
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1__SHIFT               0x11
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2__SHIFT               0x12
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3__SHIFT               0x13
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4__SHIFT               0x14
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5__SHIFT               0x15
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6__SHIFT               0x16
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7__SHIFT               0x17
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0_MASK                  0x00000001L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1_MASK                  0x00000002L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2_MASK                  0x00000004L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3_MASK                  0x00000008L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4_MASK                  0x00000010L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5_MASK                  0x00000020L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6_MASK                  0x00000040L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7_MASK                  0x00000080L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0_MASK                 0x00010000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1_MASK                 0x00020000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2_MASK                 0x00040000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3_MASK                 0x00080000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4_MASK                 0x00100000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5_MASK                 0x00200000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6_MASK                 0x00400000L
+#define DSCC2_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7_MASK                 0x00800000L
+//DSCC2_DSCC_INTERRUPT_STATUS1
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0__SHIFT                            0x0
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1__SHIFT                            0x1
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2__SHIFT                            0x2
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3__SHIFT                            0x3
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4__SHIFT                            0x4
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5__SHIFT                            0x5
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6__SHIFT                            0x6
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7__SHIFT                            0x7
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0__SHIFT                           0x10
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1__SHIFT                           0x11
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2__SHIFT                           0x12
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3__SHIFT                           0x13
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4__SHIFT                           0x14
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5__SHIFT                           0x15
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6__SHIFT                           0x16
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7__SHIFT                           0x17
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0_MASK                              0x00000001L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1_MASK                              0x00000002L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2_MASK                              0x00000004L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3_MASK                              0x00000008L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4_MASK                              0x00000010L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5_MASK                              0x00000020L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6_MASK                              0x00000040L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7_MASK                              0x00000080L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0_MASK                             0x00010000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1_MASK                             0x00020000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2_MASK                             0x00040000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3_MASK                             0x00080000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4_MASK                             0x00100000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5_MASK                             0x00200000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6_MASK                             0x00400000L
+#define DSCC2_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7_MASK                             0x00800000L
+//DSCC2_DSCC_INTERRUPT_STATUS2
+#define DSCC2_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED__SHIFT                           0x0
+#define DSCC2_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_MASK                             0x00000001L
+//DSCC2_DSCC_INTERRUPT_CLEAR0
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0__SHIFT                    0x0
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1__SHIFT                    0x1
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2__SHIFT                    0x2
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3__SHIFT                    0x3
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4__SHIFT                    0x4
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5__SHIFT                    0x5
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6__SHIFT                    0x6
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7__SHIFT                    0x7
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0__SHIFT                   0x10
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1__SHIFT                   0x11
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2__SHIFT                   0x12
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3__SHIFT                   0x13
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4__SHIFT                   0x14
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5__SHIFT                   0x15
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6__SHIFT                   0x16
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7__SHIFT                   0x17
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0_MASK                      0x00000001L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1_MASK                      0x00000002L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2_MASK                      0x00000004L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3_MASK                      0x00000008L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4_MASK                      0x00000010L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5_MASK                      0x00000020L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6_MASK                      0x00000040L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7_MASK                      0x00000080L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0_MASK                     0x00010000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1_MASK                     0x00020000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2_MASK                     0x00040000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3_MASK                     0x00080000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4_MASK                     0x00100000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5_MASK                     0x00200000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6_MASK                     0x00400000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7_MASK                     0x00800000L
+//DSCC2_DSCC_INTERRUPT_CLEAR1
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0__SHIFT                                0x0
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1__SHIFT                                0x1
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2__SHIFT                                0x2
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3__SHIFT                                0x3
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4__SHIFT                                0x4
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5__SHIFT                                0x5
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6__SHIFT                                0x6
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7__SHIFT                                0x7
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0__SHIFT                               0x10
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1__SHIFT                               0x11
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2__SHIFT                               0x12
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3__SHIFT                               0x13
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4__SHIFT                               0x14
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5__SHIFT                               0x15
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6__SHIFT                               0x16
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7__SHIFT                               0x17
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0_MASK                                  0x00000001L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1_MASK                                  0x00000002L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2_MASK                                  0x00000004L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3_MASK                                  0x00000008L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4_MASK                                  0x00000010L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5_MASK                                  0x00000020L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6_MASK                                  0x00000040L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7_MASK                                  0x00000080L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0_MASK                                 0x00010000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1_MASK                                 0x00020000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2_MASK                                 0x00040000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3_MASK                                 0x00080000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4_MASK                                 0x00100000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5_MASK                                 0x00200000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6_MASK                                 0x00400000L
+#define DSCC2_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7_MASK                                 0x00800000L
+//DSCC2_DSCC_INTERRUPT_CLEAR2
+#define DSCC2_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR__SHIFT                               0x0
+#define DSCC2_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR_MASK                                 0x00000001L
+//DSCC2_DSCC_PPS_CONFIG0
+#define DSCC2_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR__SHIFT                                                      0x0
+#define DSCC2_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR__SHIFT                                                      0x4
+#define DSCC2_DSCC_PPS_CONFIG0__PPS_IDENTIFIER__SHIFT                                                         0x8
+#define DSCC2_DSCC_PPS_CONFIG0__LINEBUF_DEPTH__SHIFT                                                          0x18
+#define DSCC2_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT__SHIFT                                                     0x1c
+#define DSCC2_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR_MASK                                                        0x0000000FL
+#define DSCC2_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR_MASK                                                        0x000000F0L
+#define DSCC2_DSCC_PPS_CONFIG0__PPS_IDENTIFIER_MASK                                                           0x0000FF00L
+#define DSCC2_DSCC_PPS_CONFIG0__LINEBUF_DEPTH_MASK                                                            0x0F000000L
+#define DSCC2_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT_MASK                                                       0xF0000000L
+//DSCC2_DSCC_PPS_CONFIG1
+#define DSCC2_DSCC_PPS_CONFIG1__BITS_PER_PIXEL__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG1__VBR_ENABLE__SHIFT                                                             0xa
+#define DSCC2_DSCC_PPS_CONFIG1__SIMPLE_422__SHIFT                                                             0xb
+#define DSCC2_DSCC_PPS_CONFIG1__CONVERT_RGB__SHIFT                                                            0xc
+#define DSCC2_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE__SHIFT                                                      0xd
+#define DSCC2_DSCC_PPS_CONFIG1__NATIVE_422__SHIFT                                                             0xe
+#define DSCC2_DSCC_PPS_CONFIG1__NATIVE_420__SHIFT                                                             0xf
+#define DSCC2_DSCC_PPS_CONFIG1__CHUNK_SIZE__SHIFT                                                             0x10
+#define DSCC2_DSCC_PPS_CONFIG1__BITS_PER_PIXEL_MASK                                                           0x000003FFL
+#define DSCC2_DSCC_PPS_CONFIG1__VBR_ENABLE_MASK                                                               0x00000400L
+#define DSCC2_DSCC_PPS_CONFIG1__SIMPLE_422_MASK                                                               0x00000800L
+#define DSCC2_DSCC_PPS_CONFIG1__CONVERT_RGB_MASK                                                              0x00001000L
+#define DSCC2_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE_MASK                                                        0x00002000L
+#define DSCC2_DSCC_PPS_CONFIG1__NATIVE_422_MASK                                                               0x00004000L
+#define DSCC2_DSCC_PPS_CONFIG1__NATIVE_420_MASK                                                               0x00008000L
+#define DSCC2_DSCC_PPS_CONFIG1__CHUNK_SIZE_MASK                                                               0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG2
+#define DSCC2_DSCC_PPS_CONFIG2__PIC_WIDTH__SHIFT                                                              0x0
+#define DSCC2_DSCC_PPS_CONFIG2__PIC_HEIGHT__SHIFT                                                             0x10
+#define DSCC2_DSCC_PPS_CONFIG2__PIC_WIDTH_MASK                                                                0x0000FFFFL
+#define DSCC2_DSCC_PPS_CONFIG2__PIC_HEIGHT_MASK                                                               0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG3
+#define DSCC2_DSCC_PPS_CONFIG3__SLICE_WIDTH__SHIFT                                                            0x0
+#define DSCC2_DSCC_PPS_CONFIG3__SLICE_HEIGHT__SHIFT                                                           0x10
+#define DSCC2_DSCC_PPS_CONFIG3__SLICE_WIDTH_MASK                                                              0x0000FFFFL
+#define DSCC2_DSCC_PPS_CONFIG3__SLICE_HEIGHT_MASK                                                             0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG4
+#define DSCC2_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY__SHIFT                                                     0x0
+#define DSCC2_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY__SHIFT                                                      0x10
+#define DSCC2_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY_MASK                                                       0x000003FFL
+#define DSCC2_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY_MASK                                                        0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG5
+#define DSCC2_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE__SHIFT                                                    0x0
+#define DSCC2_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL__SHIFT                                               0x10
+#define DSCC2_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE_MASK                                                      0x0000003FL
+#define DSCC2_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL_MASK                                                 0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG6
+#define DSCC2_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL__SHIFT                                               0x0
+#define DSCC2_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET__SHIFT                                                  0x10
+#define DSCC2_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET__SHIFT                                                 0x18
+#define DSCC2_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL_MASK                                                 0x00000FFFL
+#define DSCC2_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET_MASK                                                    0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET_MASK                                                   0x1F000000L
+//DSCC2_DSCC_PPS_CONFIG7
+#define DSCC2_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET__SHIFT                                                       0x10
+#define DSCC2_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC2_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET_MASK                                                         0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG8
+#define DSCC2_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ__SHIFT                                                 0x10
+#define DSCC2_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC2_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ_MASK                                                   0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG9
+#define DSCC2_DSCC_PPS_CONFIG9__INITIAL_OFFSET__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG9__FINAL_OFFSET__SHIFT                                                           0x10
+#define DSCC2_DSCC_PPS_CONFIG9__INITIAL_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC2_DSCC_PPS_CONFIG9__FINAL_OFFSET_MASK                                                             0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG10
+#define DSCC2_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP__SHIFT                                                       0x0
+#define DSCC2_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP__SHIFT                                                       0x8
+#define DSCC2_DSCC_PPS_CONFIG10__RC_MODEL_SIZE__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP_MASK                                                         0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP_MASK                                                         0x00001F00L
+#define DSCC2_DSCC_PPS_CONFIG10__RC_MODEL_SIZE_MASK                                                           0xFFFF0000L
+//DSCC2_DSCC_PPS_CONFIG11
+#define DSCC2_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0__SHIFT                                                  0x8
+#define DSCC2_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1__SHIFT                                                  0x10
+#define DSCC2_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO__SHIFT                                                      0x18
+#define DSCC2_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI__SHIFT                                                      0x1c
+#define DSCC2_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR_MASK                                                          0x0000000FL
+#define DSCC2_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0_MASK                                                    0x00001F00L
+#define DSCC2_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1_MASK                                                    0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO_MASK                                                        0x0F000000L
+#define DSCC2_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI_MASK                                                        0xF0000000L
+//DSCC2_DSCC_PPS_CONFIG12
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH0__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH1__SHIFT                                                        0x8
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH2__SHIFT                                                        0x10
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH3__SHIFT                                                        0x18
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH0_MASK                                                          0x000000FFL
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH1_MASK                                                          0x0000FF00L
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH2_MASK                                                          0x00FF0000L
+#define DSCC2_DSCC_PPS_CONFIG12__RC_BUF_THRESH3_MASK                                                          0xFF000000L
+//DSCC2_DSCC_PPS_CONFIG13
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH4__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH5__SHIFT                                                        0x8
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH6__SHIFT                                                        0x10
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH7__SHIFT                                                        0x18
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH4_MASK                                                          0x000000FFL
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH5_MASK                                                          0x0000FF00L
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH6_MASK                                                          0x00FF0000L
+#define DSCC2_DSCC_PPS_CONFIG13__RC_BUF_THRESH7_MASK                                                          0xFF000000L
+//DSCC2_DSCC_PPS_CONFIG14
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH8__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH9__SHIFT                                                        0x8
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH10__SHIFT                                                       0x10
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH11__SHIFT                                                       0x18
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH8_MASK                                                          0x000000FFL
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH9_MASK                                                          0x0000FF00L
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH10_MASK                                                         0x00FF0000L
+#define DSCC2_DSCC_PPS_CONFIG14__RC_BUF_THRESH11_MASK                                                         0xFF000000L
+//DSCC2_DSCC_PPS_CONFIG15
+#define DSCC2_DSCC_PPS_CONFIG15__RC_BUF_THRESH12__SHIFT                                                       0x0
+#define DSCC2_DSCC_PPS_CONFIG15__RC_BUF_THRESH13__SHIFT                                                       0x8
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_MIN_QP0__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_MAX_QP0__SHIFT                                                         0x15
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0__SHIFT                                                     0x1a
+#define DSCC2_DSCC_PPS_CONFIG15__RC_BUF_THRESH12_MASK                                                         0x000000FFL
+#define DSCC2_DSCC_PPS_CONFIG15__RC_BUF_THRESH13_MASK                                                         0x0000FF00L
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_MIN_QP0_MASK                                                           0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_MAX_QP0_MASK                                                           0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0_MASK                                                       0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG16
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MIN_QP1__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MAX_QP1__SHIFT                                                         0x5
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1__SHIFT                                                     0xa
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MIN_QP2__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MAX_QP2__SHIFT                                                         0x15
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2__SHIFT                                                     0x1a
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MIN_QP1_MASK                                                           0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MAX_QP1_MASK                                                           0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1_MASK                                                       0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MIN_QP2_MASK                                                           0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_MAX_QP2_MASK                                                           0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2_MASK                                                       0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG17
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MIN_QP3__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MAX_QP3__SHIFT                                                         0x5
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3__SHIFT                                                     0xa
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MIN_QP4__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MAX_QP4__SHIFT                                                         0x15
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4__SHIFT                                                     0x1a
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MIN_QP3_MASK                                                           0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MAX_QP3_MASK                                                           0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3_MASK                                                       0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MIN_QP4_MASK                                                           0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_MAX_QP4_MASK                                                           0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4_MASK                                                       0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG18
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MIN_QP5__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MAX_QP5__SHIFT                                                         0x5
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5__SHIFT                                                     0xa
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MIN_QP6__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MAX_QP6__SHIFT                                                         0x15
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6__SHIFT                                                     0x1a
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MIN_QP5_MASK                                                           0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MAX_QP5_MASK                                                           0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5_MASK                                                       0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MIN_QP6_MASK                                                           0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_MAX_QP6_MASK                                                           0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6_MASK                                                       0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG19
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MIN_QP7__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MAX_QP7__SHIFT                                                         0x5
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7__SHIFT                                                     0xa
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MIN_QP8__SHIFT                                                         0x10
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MAX_QP8__SHIFT                                                         0x15
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8__SHIFT                                                     0x1a
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MIN_QP7_MASK                                                           0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MAX_QP7_MASK                                                           0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7_MASK                                                       0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MIN_QP8_MASK                                                           0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_MAX_QP8_MASK                                                           0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8_MASK                                                       0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG20
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MIN_QP9__SHIFT                                                         0x0
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MAX_QP9__SHIFT                                                         0x5
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9__SHIFT                                                     0xa
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MIN_QP10__SHIFT                                                        0x10
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MAX_QP10__SHIFT                                                        0x15
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10__SHIFT                                                    0x1a
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MIN_QP9_MASK                                                           0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MAX_QP9_MASK                                                           0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9_MASK                                                       0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MIN_QP10_MASK                                                          0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_MAX_QP10_MASK                                                          0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10_MASK                                                      0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG21
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MIN_QP11__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MAX_QP11__SHIFT                                                        0x5
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11__SHIFT                                                    0xa
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MIN_QP12__SHIFT                                                        0x10
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MAX_QP12__SHIFT                                                        0x15
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12__SHIFT                                                    0x1a
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MIN_QP11_MASK                                                          0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MAX_QP11_MASK                                                          0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11_MASK                                                      0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MIN_QP12_MASK                                                          0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_MAX_QP12_MASK                                                          0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12_MASK                                                      0xFC000000L
+//DSCC2_DSCC_PPS_CONFIG22
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MIN_QP13__SHIFT                                                        0x0
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MAX_QP13__SHIFT                                                        0x5
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13__SHIFT                                                    0xa
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MIN_QP14__SHIFT                                                        0x10
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MAX_QP14__SHIFT                                                        0x15
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14__SHIFT                                                    0x1a
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MIN_QP13_MASK                                                          0x0000001FL
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MAX_QP13_MASK                                                          0x000003E0L
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13_MASK                                                      0x0000FC00L
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MIN_QP14_MASK                                                          0x001F0000L
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_MAX_QP14_MASK                                                          0x03E00000L
+#define DSCC2_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14_MASK                                                      0xFC000000L
+//DSCC2_DSCC_MEM_POWER_CONTROL0
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC2_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC2_DSCC_MEM_POWER_CONTROL1
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC2_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC2_DSCC_MEM_POWER_CONTROL2
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC2_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC2_DSCC_SLICE_CTX_SELECT
+#define DSCC2_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT__SHIFT                                             0x0
+#define DSCC2_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT_MASK                                               0x00000007L
+//DSCC2_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL
+#define DSCC2_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__SHIFT           0x0
+#define DSCC2_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_MASK             0x0000FFFFL
+//DSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL
+#define DSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__SHIFT             0x0
+#define DSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR__SHIFT       0x18
+#define DSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_MASK               0x0000FFFFL
+#define DSCC2_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR_MASK         0x01000000L
+//DSCC2_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__SHIFT   0x0
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_MASK     0x0001FFFFL
+//DSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__SHIFT     0x0
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR__SHIFT  0x18
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_MASK       0x0001FFFFL
+#define DSCC2_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR_MASK  0x01000000L
+//DSCC2_DSCC_RESET_CONTROL
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT__SHIFT                                             0x0
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT__SHIFT                                              0x10
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_RESET_MODE__SHIFT                                                      0x1f
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT_MASK                                               0x00003FFFL
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT_MASK                                                0x03FF0000L
+#define DSCC2_DSCC_RESET_CONTROL__DSCC_RESET_MODE_MASK                                                        0x80000000L
+//DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE__SHIFT                                  0x0
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE__SHIFT                                  0x8
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE__SHIFT                                  0x10
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE__SHIFT                                  0x18
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE_MASK                                    0x0000001FL
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE_MASK                                    0x00001F00L
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE_MASK                                    0x001F0000L
+#define DSCC2_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE_MASK                                    0x1F000000L
+
+
+// addressBlock: dce_dc_dsc2_dispdec_dsc_top_dispdec
+//DSC_TOP2_DSC_TOP_CONTROL
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_CLOCK_EN__SHIFT                                                         0x0
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS__SHIFT                                               0x4
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS__SHIFT                                                0x8
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS__SHIFT                                                     0xc
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                     0x10
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                    0x18
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_CLOCK_EN_MASK                                                           0x00000001L
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS_MASK                                                 0x00000010L
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS_MASK                                                  0x00000100L
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS_MASK                                                       0x00001000L
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                       0x00010000L
+#define DSC_TOP2_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                      0x01000000L
+//DSC_TOP2_DSC_DEBUG_CONTROL
+#define DSC_TOP2_DSC_DEBUG_CONTROL__DSC_DBG_EN__SHIFT                                                         0x0
+#define DSC_TOP2_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL__SHIFT                                             0x4
+#define DSC_TOP2_DSC_DEBUG_CONTROL__DSC_DBG_EN_MASK                                                           0x00000001L
+#define DSC_TOP2_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL_MASK                                               0x000000F0L
+
+
+// addressBlock: dce_dc_dsc3_dispdec_dscc_dispdec
+//DSCC3_DSCC_CONFIG0
+#define DSCC3_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE__SHIFT                                                   0x0
+#define DSCC3_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE__SHIFT                                                  0x4
+#define DSCC3_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN__SHIFT                                                  0x8
+#define DSCC3_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION__SHIFT                                     0x10
+#define DSCC3_DSCC_CONFIG0__ICH_RESET_AT_END_OF_LINE_MASK                                                     0x00000001L
+#define DSCC3_DSCC_CONFIG0__NUMBER_OF_SLICES_PER_LINE_MASK                                                    0x00000070L
+#define DSCC3_DSCC_CONFIG0__ALTERNATE_ICH_ENCODING_EN_MASK                                                    0x00000100L
+#define DSCC3_DSCC_CONFIG0__NUMBER_OF_SLICES_IN_VERTICAL_DIRECTION_MASK                                       0xFFFF0000L
+//DSCC3_DSCC_CONFIG1
+#define DSCC3_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE__SHIFT                                        0x0
+#define DSCC3_DSCC_CONFIG1__DSCC_RATE_CONTROL_BUFFER_MODEL_SIZE_MASK                                          0x0003FFFFL
+//DSCC3_DSCC_CONFIG2
+#define DSCC3_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD__SHIFT                                         0x0
+#define DSCC3_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD__SHIFT                                  0x10
+#define DSCC3_DSCC_CONFIG2__OUTPUT_BUFFER_ELASTICITY_THRESHOLD_MASK                                           0x0000FFFFL
+#define DSCC3_DSCC_CONFIG2__OUTPUT_BUFFER_TOTAL_PIXEL_COUNT_THRESHOLD_MASK                                    0xFFFF0000L
+//DSCC3_DSCC_CONFIG3
+#define DSCC3_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET__SHIFT                                                  0x0
+#define DSCC3_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN__SHIFT                           0xc
+#define DSCC3_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY__SHIFT                                       0x10
+#define DSCC3_DSCC_CONFIG3__INITIAL_XMIT_DELAY_OFFSET_MASK                                                    0x000007FFL
+#define DSCC3_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_OVERRIDE_EN_MASK                             0x00001000L
+#define DSCC3_DSCC_CONFIG3__GROUP_DELAY_AFTER_INITIAL_XMIT_DELAY_MASK                                         0x03FF0000L
+//DSCC3_DSCC_STATUS
+#define DSCC3_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING__SHIFT                                       0x0
+#define DSCC3_DSCC_STATUS__DSCC_DOUBLE_BUFFER_REG_UPDATE_PENDING_MASK                                         0x00000001L
+//DSCC3_DSCC_INTERRUPT_CONTROL0
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0__SHIFT        0x0
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1__SHIFT        0x1
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2__SHIFT        0x2
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3__SHIFT        0x3
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4__SHIFT        0x4
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5__SHIFT        0x5
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6__SHIFT        0x6
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7__SHIFT        0x7
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0__SHIFT       0x10
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1__SHIFT       0x11
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2__SHIFT       0x12
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3__SHIFT       0x13
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4__SHIFT       0x14
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5__SHIFT       0x15
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6__SHIFT       0x16
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7__SHIFT       0x17
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN0_MASK          0x00000001L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN1_MASK          0x00000002L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN2_MASK          0x00000004L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN3_MASK          0x00000008L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN4_MASK          0x00000010L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN5_MASK          0x00000020L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN6_MASK          0x00000040L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED_INT_EN7_MASK          0x00000080L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN0_MASK         0x00010000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN1_MASK         0x00020000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN2_MASK         0x00040000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN3_MASK         0x00080000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN4_MASK         0x00100000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN5_MASK         0x00200000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN6_MASK         0x00400000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED_INT_EN7_MASK         0x00800000L
+//DSCC3_DSCC_INTERRUPT_CONTROL1
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0__SHIFT                    0x0
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1__SHIFT                    0x1
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2__SHIFT                    0x2
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3__SHIFT                    0x3
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4__SHIFT                    0x4
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5__SHIFT                    0x5
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6__SHIFT                    0x6
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7__SHIFT                    0x7
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0__SHIFT                   0x10
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1__SHIFT                   0x11
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2__SHIFT                   0x12
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3__SHIFT                   0x13
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4__SHIFT                   0x14
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5__SHIFT                   0x15
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6__SHIFT                   0x16
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7__SHIFT                   0x17
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN0_MASK                      0x00000001L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN1_MASK                      0x00000002L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN2_MASK                      0x00000004L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN3_MASK                      0x00000008L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN4_MASK                      0x00000010L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN5_MASK                      0x00000020L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN6_MASK                      0x00000040L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED_INT_EN7_MASK                      0x00000080L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN0_MASK                     0x00010000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN1_MASK                     0x00020000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN2_MASK                     0x00040000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN3_MASK                     0x00080000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN4_MASK                     0x00100000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN5_MASK                     0x00200000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN6_MASK                     0x00400000L
+#define DSCC3_DSCC_INTERRUPT_CONTROL1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED_INT_EN7_MASK                     0x00800000L
+//DSCC3_DSCC_INTERRUPT_CONTROL2
+#define DSCC3_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN__SHIFT                   0x0
+#define DSCC3_DSCC_INTERRUPT_CONTROL2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_INT_EN_MASK                     0x00000001L
+//DSCC3_DSCC_INTERRUPT_STATUS0
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0__SHIFT                0x0
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1__SHIFT                0x1
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2__SHIFT                0x2
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3__SHIFT                0x3
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4__SHIFT                0x4
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5__SHIFT                0x5
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6__SHIFT                0x6
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7__SHIFT                0x7
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0__SHIFT               0x10
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1__SHIFT               0x11
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2__SHIFT               0x12
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3__SHIFT               0x13
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4__SHIFT               0x14
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5__SHIFT               0x15
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6__SHIFT               0x16
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7__SHIFT               0x17
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED0_MASK                  0x00000001L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED1_MASK                  0x00000002L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED2_MASK                  0x00000004L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED3_MASK                  0x00000008L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED4_MASK                  0x00000010L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED5_MASK                  0x00000020L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED6_MASK                  0x00000040L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_OCCURRED7_MASK                  0x00000080L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED0_MASK                 0x00010000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED1_MASK                 0x00020000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED2_MASK                 0x00040000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED3_MASK                 0x00080000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED4_MASK                 0x00100000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED5_MASK                 0x00200000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED6_MASK                 0x00400000L
+#define DSCC3_DSCC_INTERRUPT_STATUS0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_OCCURRED7_MASK                 0x00800000L
+//DSCC3_DSCC_INTERRUPT_STATUS1
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0__SHIFT                            0x0
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1__SHIFT                            0x1
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2__SHIFT                            0x2
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3__SHIFT                            0x3
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4__SHIFT                            0x4
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5__SHIFT                            0x5
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6__SHIFT                            0x6
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7__SHIFT                            0x7
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0__SHIFT                           0x10
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1__SHIFT                           0x11
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2__SHIFT                           0x12
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3__SHIFT                           0x13
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4__SHIFT                           0x14
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5__SHIFT                           0x15
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6__SHIFT                           0x16
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7__SHIFT                           0x17
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED0_MASK                              0x00000001L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED1_MASK                              0x00000002L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED2_MASK                              0x00000004L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED3_MASK                              0x00000008L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED4_MASK                              0x00000010L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED5_MASK                              0x00000020L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED6_MASK                              0x00000040L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_OVERFLOW_OCCURRED7_MASK                              0x00000080L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED0_MASK                             0x00010000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED1_MASK                             0x00020000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED2_MASK                             0x00040000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED3_MASK                             0x00080000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED4_MASK                             0x00100000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED5_MASK                             0x00200000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED6_MASK                             0x00400000L
+#define DSCC3_DSCC_INTERRUPT_STATUS1__DSCC_OUTPUT_BUFFER_UNDERFLOW_OCCURRED7_MASK                             0x00800000L
+//DSCC3_DSCC_INTERRUPT_STATUS2
+#define DSCC3_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED__SHIFT                           0x0
+#define DSCC3_DSCC_INTERRUPT_STATUS2__DSCC_END_OF_FRAME_NOT_REACHED_OCCURRED_MASK                             0x00000001L
+//DSCC3_DSCC_INTERRUPT_CLEAR0
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0__SHIFT                    0x0
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1__SHIFT                    0x1
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2__SHIFT                    0x2
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3__SHIFT                    0x3
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4__SHIFT                    0x4
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5__SHIFT                    0x5
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6__SHIFT                    0x6
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7__SHIFT                    0x7
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0__SHIFT                   0x10
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1__SHIFT                   0x11
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2__SHIFT                   0x12
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3__SHIFT                   0x13
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4__SHIFT                   0x14
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5__SHIFT                   0x15
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6__SHIFT                   0x16
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7__SHIFT                   0x17
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR0_MASK                      0x00000001L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR1_MASK                      0x00000002L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR2_MASK                      0x00000004L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR3_MASK                      0x00000008L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR4_MASK                      0x00000010L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR5_MASK                      0x00000020L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR6_MASK                      0x00000040L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_OVERFLOW_CLEAR7_MASK                      0x00000080L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR0_MASK                     0x00010000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR1_MASK                     0x00020000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR2_MASK                     0x00040000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR3_MASK                     0x00080000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR4_MASK                     0x00100000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR5_MASK                     0x00200000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR6_MASK                     0x00400000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR0__DSCC_RATE_CONTROL_BUFFER_MODEL_UNDERFLOW_CLEAR7_MASK                     0x00800000L
+//DSCC3_DSCC_INTERRUPT_CLEAR1
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0__SHIFT                                0x0
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1__SHIFT                                0x1
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2__SHIFT                                0x2
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3__SHIFT                                0x3
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4__SHIFT                                0x4
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5__SHIFT                                0x5
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6__SHIFT                                0x6
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7__SHIFT                                0x7
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0__SHIFT                               0x10
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1__SHIFT                               0x11
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2__SHIFT                               0x12
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3__SHIFT                               0x13
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4__SHIFT                               0x14
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5__SHIFT                               0x15
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6__SHIFT                               0x16
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7__SHIFT                               0x17
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR0_MASK                                  0x00000001L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR1_MASK                                  0x00000002L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR2_MASK                                  0x00000004L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR3_MASK                                  0x00000008L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR4_MASK                                  0x00000010L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR5_MASK                                  0x00000020L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR6_MASK                                  0x00000040L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_OVERFLOW_CLEAR7_MASK                                  0x00000080L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR0_MASK                                 0x00010000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR1_MASK                                 0x00020000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR2_MASK                                 0x00040000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR3_MASK                                 0x00080000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR4_MASK                                 0x00100000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR5_MASK                                 0x00200000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR6_MASK                                 0x00400000L
+#define DSCC3_DSCC_INTERRUPT_CLEAR1__DSCC_OUTPUT_BUFFER_UNDERFLOW_CLEAR7_MASK                                 0x00800000L
+//DSCC3_DSCC_INTERRUPT_CLEAR2
+#define DSCC3_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR__SHIFT                               0x0
+#define DSCC3_DSCC_INTERRUPT_CLEAR2__DSCC_END_OF_FRAME_NOT_REACHED_CLEAR_MASK                                 0x00000001L
+//DSCC3_DSCC_PPS_CONFIG0
+#define DSCC3_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR__SHIFT                                                      0x0
+#define DSCC3_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR__SHIFT                                                      0x4
+#define DSCC3_DSCC_PPS_CONFIG0__PPS_IDENTIFIER__SHIFT                                                         0x8
+#define DSCC3_DSCC_PPS_CONFIG0__LINEBUF_DEPTH__SHIFT                                                          0x18
+#define DSCC3_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT__SHIFT                                                     0x1c
+#define DSCC3_DSCC_PPS_CONFIG0__DSC_VERSION_MINOR_MASK                                                        0x0000000FL
+#define DSCC3_DSCC_PPS_CONFIG0__DSC_VERSION_MAJOR_MASK                                                        0x000000F0L
+#define DSCC3_DSCC_PPS_CONFIG0__PPS_IDENTIFIER_MASK                                                           0x0000FF00L
+#define DSCC3_DSCC_PPS_CONFIG0__LINEBUF_DEPTH_MASK                                                            0x0F000000L
+#define DSCC3_DSCC_PPS_CONFIG0__BITS_PER_COMPONENT_MASK                                                       0xF0000000L
+//DSCC3_DSCC_PPS_CONFIG1
+#define DSCC3_DSCC_PPS_CONFIG1__BITS_PER_PIXEL__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG1__VBR_ENABLE__SHIFT                                                             0xa
+#define DSCC3_DSCC_PPS_CONFIG1__SIMPLE_422__SHIFT                                                             0xb
+#define DSCC3_DSCC_PPS_CONFIG1__CONVERT_RGB__SHIFT                                                            0xc
+#define DSCC3_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE__SHIFT                                                      0xd
+#define DSCC3_DSCC_PPS_CONFIG1__NATIVE_422__SHIFT                                                             0xe
+#define DSCC3_DSCC_PPS_CONFIG1__NATIVE_420__SHIFT                                                             0xf
+#define DSCC3_DSCC_PPS_CONFIG1__CHUNK_SIZE__SHIFT                                                             0x10
+#define DSCC3_DSCC_PPS_CONFIG1__BITS_PER_PIXEL_MASK                                                           0x000003FFL
+#define DSCC3_DSCC_PPS_CONFIG1__VBR_ENABLE_MASK                                                               0x00000400L
+#define DSCC3_DSCC_PPS_CONFIG1__SIMPLE_422_MASK                                                               0x00000800L
+#define DSCC3_DSCC_PPS_CONFIG1__CONVERT_RGB_MASK                                                              0x00001000L
+#define DSCC3_DSCC_PPS_CONFIG1__BLOCK_PRED_ENABLE_MASK                                                        0x00002000L
+#define DSCC3_DSCC_PPS_CONFIG1__NATIVE_422_MASK                                                               0x00004000L
+#define DSCC3_DSCC_PPS_CONFIG1__NATIVE_420_MASK                                                               0x00008000L
+#define DSCC3_DSCC_PPS_CONFIG1__CHUNK_SIZE_MASK                                                               0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG2
+#define DSCC3_DSCC_PPS_CONFIG2__PIC_WIDTH__SHIFT                                                              0x0
+#define DSCC3_DSCC_PPS_CONFIG2__PIC_HEIGHT__SHIFT                                                             0x10
+#define DSCC3_DSCC_PPS_CONFIG2__PIC_WIDTH_MASK                                                                0x0000FFFFL
+#define DSCC3_DSCC_PPS_CONFIG2__PIC_HEIGHT_MASK                                                               0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG3
+#define DSCC3_DSCC_PPS_CONFIG3__SLICE_WIDTH__SHIFT                                                            0x0
+#define DSCC3_DSCC_PPS_CONFIG3__SLICE_HEIGHT__SHIFT                                                           0x10
+#define DSCC3_DSCC_PPS_CONFIG3__SLICE_WIDTH_MASK                                                              0x0000FFFFL
+#define DSCC3_DSCC_PPS_CONFIG3__SLICE_HEIGHT_MASK                                                             0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG4
+#define DSCC3_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY__SHIFT                                                     0x0
+#define DSCC3_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY__SHIFT                                                      0x10
+#define DSCC3_DSCC_PPS_CONFIG4__INITIAL_XMIT_DELAY_MASK                                                       0x000003FFL
+#define DSCC3_DSCC_PPS_CONFIG4__INITIAL_DEC_DELAY_MASK                                                        0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG5
+#define DSCC3_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE__SHIFT                                                    0x0
+#define DSCC3_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL__SHIFT                                               0x10
+#define DSCC3_DSCC_PPS_CONFIG5__INITIAL_SCALE_VALUE_MASK                                                      0x0000003FL
+#define DSCC3_DSCC_PPS_CONFIG5__SCALE_INCREMENT_INTERVAL_MASK                                                 0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG6
+#define DSCC3_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL__SHIFT                                               0x0
+#define DSCC3_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET__SHIFT                                                  0x10
+#define DSCC3_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET__SHIFT                                                 0x18
+#define DSCC3_DSCC_PPS_CONFIG6__SCALE_DECREMENT_INTERVAL_MASK                                                 0x00000FFFL
+#define DSCC3_DSCC_PPS_CONFIG6__FIRST_LINE_BPG_OFFSET_MASK                                                    0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG6__SECOND_LINE_BPG_OFFSET_MASK                                                   0x1F000000L
+//DSCC3_DSCC_PPS_CONFIG7
+#define DSCC3_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET__SHIFT                                                       0x10
+#define DSCC3_DSCC_PPS_CONFIG7__NFL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC3_DSCC_PPS_CONFIG7__SLICE_BPG_OFFSET_MASK                                                         0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG8
+#define DSCC3_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ__SHIFT                                                 0x10
+#define DSCC3_DSCC_PPS_CONFIG8__NSL_BPG_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC3_DSCC_PPS_CONFIG8__SECOND_LINE_OFFSET_ADJ_MASK                                                   0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG9
+#define DSCC3_DSCC_PPS_CONFIG9__INITIAL_OFFSET__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG9__FINAL_OFFSET__SHIFT                                                           0x10
+#define DSCC3_DSCC_PPS_CONFIG9__INITIAL_OFFSET_MASK                                                           0x0000FFFFL
+#define DSCC3_DSCC_PPS_CONFIG9__FINAL_OFFSET_MASK                                                             0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG10
+#define DSCC3_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP__SHIFT                                                       0x0
+#define DSCC3_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP__SHIFT                                                       0x8
+#define DSCC3_DSCC_PPS_CONFIG10__RC_MODEL_SIZE__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG10__FLATNESS_MIN_QP_MASK                                                         0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG10__FLATNESS_MAX_QP_MASK                                                         0x00001F00L
+#define DSCC3_DSCC_PPS_CONFIG10__RC_MODEL_SIZE_MASK                                                           0xFFFF0000L
+//DSCC3_DSCC_PPS_CONFIG11
+#define DSCC3_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0__SHIFT                                                  0x8
+#define DSCC3_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1__SHIFT                                                  0x10
+#define DSCC3_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO__SHIFT                                                      0x18
+#define DSCC3_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI__SHIFT                                                      0x1c
+#define DSCC3_DSCC_PPS_CONFIG11__RC_EDGE_FACTOR_MASK                                                          0x0000000FL
+#define DSCC3_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT0_MASK                                                    0x00001F00L
+#define DSCC3_DSCC_PPS_CONFIG11__RC_QUANT_INCR_LIMIT1_MASK                                                    0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_LO_MASK                                                        0x0F000000L
+#define DSCC3_DSCC_PPS_CONFIG11__RC_TGT_OFFSET_HI_MASK                                                        0xF0000000L
+//DSCC3_DSCC_PPS_CONFIG12
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH0__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH1__SHIFT                                                        0x8
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH2__SHIFT                                                        0x10
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH3__SHIFT                                                        0x18
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH0_MASK                                                          0x000000FFL
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH1_MASK                                                          0x0000FF00L
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH2_MASK                                                          0x00FF0000L
+#define DSCC3_DSCC_PPS_CONFIG12__RC_BUF_THRESH3_MASK                                                          0xFF000000L
+//DSCC3_DSCC_PPS_CONFIG13
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH4__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH5__SHIFT                                                        0x8
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH6__SHIFT                                                        0x10
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH7__SHIFT                                                        0x18
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH4_MASK                                                          0x000000FFL
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH5_MASK                                                          0x0000FF00L
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH6_MASK                                                          0x00FF0000L
+#define DSCC3_DSCC_PPS_CONFIG13__RC_BUF_THRESH7_MASK                                                          0xFF000000L
+//DSCC3_DSCC_PPS_CONFIG14
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH8__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH9__SHIFT                                                        0x8
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH10__SHIFT                                                       0x10
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH11__SHIFT                                                       0x18
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH8_MASK                                                          0x000000FFL
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH9_MASK                                                          0x0000FF00L
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH10_MASK                                                         0x00FF0000L
+#define DSCC3_DSCC_PPS_CONFIG14__RC_BUF_THRESH11_MASK                                                         0xFF000000L
+//DSCC3_DSCC_PPS_CONFIG15
+#define DSCC3_DSCC_PPS_CONFIG15__RC_BUF_THRESH12__SHIFT                                                       0x0
+#define DSCC3_DSCC_PPS_CONFIG15__RC_BUF_THRESH13__SHIFT                                                       0x8
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_MIN_QP0__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_MAX_QP0__SHIFT                                                         0x15
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0__SHIFT                                                     0x1a
+#define DSCC3_DSCC_PPS_CONFIG15__RC_BUF_THRESH12_MASK                                                         0x000000FFL
+#define DSCC3_DSCC_PPS_CONFIG15__RC_BUF_THRESH13_MASK                                                         0x0000FF00L
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_MIN_QP0_MASK                                                           0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_MAX_QP0_MASK                                                           0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG15__RANGE_BPG_OFFSET0_MASK                                                       0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG16
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MIN_QP1__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MAX_QP1__SHIFT                                                         0x5
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1__SHIFT                                                     0xa
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MIN_QP2__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MAX_QP2__SHIFT                                                         0x15
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2__SHIFT                                                     0x1a
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MIN_QP1_MASK                                                           0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MAX_QP1_MASK                                                           0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET1_MASK                                                       0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MIN_QP2_MASK                                                           0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_MAX_QP2_MASK                                                           0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG16__RANGE_BPG_OFFSET2_MASK                                                       0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG17
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MIN_QP3__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MAX_QP3__SHIFT                                                         0x5
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3__SHIFT                                                     0xa
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MIN_QP4__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MAX_QP4__SHIFT                                                         0x15
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4__SHIFT                                                     0x1a
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MIN_QP3_MASK                                                           0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MAX_QP3_MASK                                                           0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET3_MASK                                                       0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MIN_QP4_MASK                                                           0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_MAX_QP4_MASK                                                           0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG17__RANGE_BPG_OFFSET4_MASK                                                       0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG18
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MIN_QP5__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MAX_QP5__SHIFT                                                         0x5
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5__SHIFT                                                     0xa
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MIN_QP6__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MAX_QP6__SHIFT                                                         0x15
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6__SHIFT                                                     0x1a
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MIN_QP5_MASK                                                           0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MAX_QP5_MASK                                                           0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET5_MASK                                                       0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MIN_QP6_MASK                                                           0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_MAX_QP6_MASK                                                           0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG18__RANGE_BPG_OFFSET6_MASK                                                       0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG19
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MIN_QP7__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MAX_QP7__SHIFT                                                         0x5
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7__SHIFT                                                     0xa
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MIN_QP8__SHIFT                                                         0x10
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MAX_QP8__SHIFT                                                         0x15
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8__SHIFT                                                     0x1a
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MIN_QP7_MASK                                                           0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MAX_QP7_MASK                                                           0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET7_MASK                                                       0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MIN_QP8_MASK                                                           0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_MAX_QP8_MASK                                                           0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG19__RANGE_BPG_OFFSET8_MASK                                                       0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG20
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MIN_QP9__SHIFT                                                         0x0
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MAX_QP9__SHIFT                                                         0x5
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9__SHIFT                                                     0xa
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MIN_QP10__SHIFT                                                        0x10
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MAX_QP10__SHIFT                                                        0x15
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10__SHIFT                                                    0x1a
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MIN_QP9_MASK                                                           0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MAX_QP9_MASK                                                           0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET9_MASK                                                       0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MIN_QP10_MASK                                                          0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_MAX_QP10_MASK                                                          0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG20__RANGE_BPG_OFFSET10_MASK                                                      0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG21
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MIN_QP11__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MAX_QP11__SHIFT                                                        0x5
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11__SHIFT                                                    0xa
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MIN_QP12__SHIFT                                                        0x10
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MAX_QP12__SHIFT                                                        0x15
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12__SHIFT                                                    0x1a
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MIN_QP11_MASK                                                          0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MAX_QP11_MASK                                                          0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET11_MASK                                                      0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MIN_QP12_MASK                                                          0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_MAX_QP12_MASK                                                          0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG21__RANGE_BPG_OFFSET12_MASK                                                      0xFC000000L
+//DSCC3_DSCC_PPS_CONFIG22
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MIN_QP13__SHIFT                                                        0x0
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MAX_QP13__SHIFT                                                        0x5
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13__SHIFT                                                    0xa
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MIN_QP14__SHIFT                                                        0x10
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MAX_QP14__SHIFT                                                        0x15
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14__SHIFT                                                    0x1a
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MIN_QP13_MASK                                                          0x0000001FL
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MAX_QP13_MASK                                                          0x000003E0L
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET13_MASK                                                      0x0000FC00L
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MIN_QP14_MASK                                                          0x001F0000L
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_MAX_QP14_MASK                                                          0x03E00000L
+#define DSCC3_DSCC_PPS_CONFIG22__RANGE_BPG_OFFSET14_MASK                                                      0xFC000000L
+//DSCC3_DSCC_MEM_POWER_CONTROL0
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC3_DSCC_MEM_POWER_CONTROL0__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC3_DSCC_MEM_POWER_CONTROL1
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC3_DSCC_MEM_POWER_CONTROL1__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC3_DSCC_MEM_POWER_CONTROL2
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0x0
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE__SHIFT                                              0x4
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS__SHIFT                                                0x8
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE__SHIFT                                              0x10
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00000003L
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_FORCE_MASK                                                0x00000030L
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_DIS_MASK                                                  0x00000100L
+#define DSCC3_DSCC_MEM_POWER_CONTROL2__DSCC_MEM_PWR_STATE_MASK                                                0x00030000L
+//DSCC3_DSCC_SLICE_CTX_SELECT
+#define DSCC3_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT__SHIFT                                             0x0
+#define DSCC3_DSCC_SLICE_CTX_SELECT__DSCC_SLICE_CTX_SELECT_MASK                                               0x00000007L
+//DSCC3_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL
+#define DSCC3_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__SHIFT           0x0
+#define DSCC3_DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_INST_FULLNESS_LEVEL_MASK             0x0000FFFFL
+//DSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL
+#define DSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__SHIFT             0x0
+#define DSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR__SHIFT       0x18
+#define DSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_MASK               0x0000FFFFL
+#define DSCC3_DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL__DSCC_OUTPUT_BUFFER_MAX_FULLNESS_LEVEL_CLEAR_MASK         0x01000000L
+//DSCC3_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__SHIFT   0x0
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_INST_FULLNESS_LEVEL_MASK     0x0001FFFFL
+//DSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__SHIFT     0x0
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR__SHIFT  0x18
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_MASK       0x0001FFFFL
+#define DSCC3_DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL__DSCC_RATE_BUFFER_MODEL_MAX_FULLNESS_LEVEL_CLEAR_MASK  0x01000000L
+//DSCC3_DSCC_RESET_CONTROL
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT__SHIFT                                             0x0
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT__SHIFT                                              0x10
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_RESET_MODE__SHIFT                                                      0x1f
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_DISPCLK_RESET_COUNT_MASK                                               0x00003FFFL
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_DSCCLK_RESET_COUNT_MASK                                                0x03FF0000L
+#define DSCC3_DSCC_RESET_CONTROL__DSCC_RESET_MODE_MASK                                                        0x80000000L
+//DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE__SHIFT                                  0x0
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE__SHIFT                                  0x8
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE__SHIFT                                  0x10
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE__SHIFT                                  0x18
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS0_ROTATE_MASK                                    0x0000001FL
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS1_ROTATE_MASK                                    0x00001F00L
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS2_ROTATE_MASK                                    0x001F0000L
+#define DSCC3_DSCC_TEST_DEBUG_BUS_ROTATE__DSCC_TEST_DEBUG_BUS3_ROTATE_MASK                                    0x1F000000L
+
+
+// addressBlock: dce_dc_dsc3_dispdec_dsc_top_dispdec
+//DSC_TOP3_DSC_TOP_CONTROL
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_CLOCK_EN__SHIFT                                                         0x0
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS__SHIFT                                               0x4
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS__SHIFT                                                0x8
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS__SHIFT                                                     0xc
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                     0x10
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN__SHIFT                                    0x18
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_CLOCK_EN_MASK                                                           0x00000001L
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DISPCLK_R_GATE_DIS_MASK                                                 0x00000010L
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DSCCLK_R_GATE_DIS_MASK                                                  0x00000100L
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_FGCG_REP_DIS_MASK                                                       0x00001000L
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DSCCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                       0x00010000L
+#define DSC_TOP3_DSC_TOP_CONTROL__DSC_DISPCLK_DYNAMIC_CLOCK_GATE_EN_MASK                                      0x01000000L
+//DSC_TOP3_DSC_DEBUG_CONTROL
+#define DSC_TOP3_DSC_DEBUG_CONTROL__DSC_DBG_EN__SHIFT                                                         0x0
+#define DSC_TOP3_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL__SHIFT                                             0x4
+#define DSC_TOP3_DSC_DEBUG_CONTROL__DSC_DBG_EN_MASK                                                           0x00000001L
+#define DSC_TOP3_DSC_DEBUG_CONTROL__DSC_TEST_CLOCK_MUX_SEL_MASK                                               0x000000F0L
+
+
+// addressBlock: dce_dc_dcoh_dcoh_top_dispdec
+//DCOH_TOP_CLOCK_CONTROL
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_DISPCLK_G_GATE_DIS__SHIFT                                                0x0
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_DISPCLK_R_GATE_DIS__SHIFT                                                0x4
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_REFCLK_G_GATE_DIS__SHIFT                                                 0x8
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_REFCLK_R_GATE_DIS__SHIFT                                                 0xc
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_FGCG_REP_DIS__SHIFT                                                      0x10
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_DISPCLK_G_GATE_DIS_MASK                                                  0x00000001L
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_DISPCLK_R_GATE_DIS_MASK                                                  0x00000010L
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_REFCLK_G_GATE_DIS_MASK                                                   0x00000100L
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_REFCLK_R_GATE_DIS_MASK                                                   0x00001000L
+#define DCOH_TOP_CLOCK_CONTROL__DCOH_FGCG_REP_DIS_MASK                                                        0x00010000L
+//DCOH_TOP_SPARE
+#define DCOH_TOP_SPARE__DCOH_TOP_SPARE__SHIFT                                                                 0x0
+#define DCOH_TOP_SPARE__DCOH_TOP_SPARE_MASK                                                                   0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_dcoh_hdcp2_misc_dispdec
+//PSP_INTERRUPT_STATUS
+#define PSP_INTERRUPT_STATUS__PSP_INTERRUPT_STATUS__SHIFT                                                     0x0
+#define PSP_INTERRUPT_STATUS__PSP_INTERRUPT_MESSAGE__SHIFT                                                    0x1
+#define PSP_INTERRUPT_STATUS__PSP_INTERRUPT_STATUS_MASK                                                       0x00000001L
+#define PSP_INTERRUPT_STATUS__PSP_INTERRUPT_MESSAGE_MASK                                                      0xFFFFFFFEL
+//PSP_INTERRUPT_CLEAR
+#define PSP_INTERRUPT_CLEAR__PSP_INTERRUPT_CLEAR__SHIFT                                                       0x0
+#define PSP_INTERRUPT_CLEAR__PSP_INTERRUPT_CLEAR_MASK                                                         0x00000001L
+
+
+// addressBlock: dce_dc_dcoh_phy_mux0_dispdec
+//PHY_MUX0_PHY_MUX_CONTROL
+#define PHY_MUX0_PHY_MUX_CONTROL__ENC_TYPE_SEL__SHIFT                                                         0x0
+#define PHY_MUX0_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL__SHIFT                                                     0x4
+#define PHY_MUX0_PHY_MUX_CONTROL__HPO_DP_ENC_SEL__SHIFT                                                       0x8
+#define PHY_MUX0_PHY_MUX_CONTROL__ENC_TYPE_SEL_MASK                                                           0x00000003L
+#define PHY_MUX0_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL_MASK                                                       0x00000070L
+#define PHY_MUX0_PHY_MUX_CONTROL__HPO_DP_ENC_SEL_MASK                                                         0x00000700L
+//PHY_MUX0_PORT_TYPE
+#define PHY_MUX0_PORT_TYPE__PORT_TYPE__SHIFT                                                                  0x0
+#define PHY_MUX0_PORT_TYPE__PORT_TYPE_MASK                                                                    0x00000001L
+
+
+// addressBlock: dce_dc_dcoh_phy_mux1_dispdec
+//PHY_MUX1_PHY_MUX_CONTROL
+#define PHY_MUX1_PHY_MUX_CONTROL__ENC_TYPE_SEL__SHIFT                                                         0x0
+#define PHY_MUX1_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL__SHIFT                                                     0x4
+#define PHY_MUX1_PHY_MUX_CONTROL__HPO_DP_ENC_SEL__SHIFT                                                       0x8
+#define PHY_MUX1_PHY_MUX_CONTROL__ENC_TYPE_SEL_MASK                                                           0x00000003L
+#define PHY_MUX1_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL_MASK                                                       0x00000070L
+#define PHY_MUX1_PHY_MUX_CONTROL__HPO_DP_ENC_SEL_MASK                                                         0x00000700L
+//PHY_MUX1_PORT_TYPE
+#define PHY_MUX1_PORT_TYPE__PORT_TYPE__SHIFT                                                                  0x0
+#define PHY_MUX1_PORT_TYPE__PORT_TYPE_MASK                                                                    0x00000001L
+
+
+// addressBlock: dce_dc_dcoh_phy_mux2_dispdec
+//PHY_MUX2_PHY_MUX_CONTROL
+#define PHY_MUX2_PHY_MUX_CONTROL__ENC_TYPE_SEL__SHIFT                                                         0x0
+#define PHY_MUX2_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL__SHIFT                                                     0x4
+#define PHY_MUX2_PHY_MUX_CONTROL__HPO_DP_ENC_SEL__SHIFT                                                       0x8
+#define PHY_MUX2_PHY_MUX_CONTROL__ENC_TYPE_SEL_MASK                                                           0x00000003L
+#define PHY_MUX2_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL_MASK                                                       0x00000070L
+#define PHY_MUX2_PHY_MUX_CONTROL__HPO_DP_ENC_SEL_MASK                                                         0x00000700L
+//PHY_MUX2_PORT_TYPE
+#define PHY_MUX2_PORT_TYPE__PORT_TYPE__SHIFT                                                                  0x0
+#define PHY_MUX2_PORT_TYPE__PORT_TYPE_MASK                                                                    0x00000001L
+
+
+// addressBlock: dce_dc_dcoh_phy_mux3_dispdec
+//PHY_MUX3_PHY_MUX_CONTROL
+#define PHY_MUX3_PHY_MUX_CONTROL__ENC_TYPE_SEL__SHIFT                                                         0x0
+#define PHY_MUX3_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL__SHIFT                                                     0x4
+#define PHY_MUX3_PHY_MUX_CONTROL__HPO_DP_ENC_SEL__SHIFT                                                       0x8
+#define PHY_MUX3_PHY_MUX_CONTROL__ENC_TYPE_SEL_MASK                                                           0x00000003L
+#define PHY_MUX3_PHY_MUX_CONTROL__HPO_HDMI_ENC_SEL_MASK                                                       0x00000070L
+#define PHY_MUX3_PHY_MUX_CONTROL__HPO_DP_ENC_SEL_MASK                                                         0x00000700L
+//PHY_MUX3_PORT_TYPE
+#define PHY_MUX3_PORT_TYPE__PORT_TYPE__SHIFT                                                                  0x0
+#define PHY_MUX3_PORT_TYPE__PORT_TYPE_MASK                                                                    0x00000001L
+
+
+// addressBlock: dce_dc_dcoh_dp_aux0_dispdec
+//DP_AUX0_AUX_CONTROL
+#define DP_AUX0_AUX_CONTROL__AUX_EN__SHIFT                                                                    0x0
+#define DP_AUX0_AUX_CONTROL__AUX_RESET__SHIFT                                                                 0x4
+#define DP_AUX0_AUX_CONTROL__AUX_RESET_DONE__SHIFT                                                            0x5
+#define DP_AUX0_AUX_CONTROL__AUX_LS_READ_EN__SHIFT                                                            0x8
+#define DP_AUX0_AUX_CONTROL__AUX_LS_UPDATE_DISABLE__SHIFT                                                     0xc
+#define DP_AUX0_AUX_CONTROL__AUX_IGNORE_HPD_DISCON__SHIFT                                                     0x10
+#define DP_AUX0_AUX_CONTROL__AUX_MODE_DET_EN__SHIFT                                                           0x12
+#define DP_AUX0_AUX_CONTROL__AUX_HPD_SEL__SHIFT                                                               0x14
+#define DP_AUX0_AUX_CONTROL__AUX_IMPCAL_REQ_EN__SHIFT                                                         0x18
+#define DP_AUX0_AUX_CONTROL__AUX_TEST_MODE__SHIFT                                                             0x1c
+#define DP_AUX0_AUX_CONTROL__AUX_EN_MASK                                                                      0x00000001L
+#define DP_AUX0_AUX_CONTROL__AUX_RESET_MASK                                                                   0x00000010L
+#define DP_AUX0_AUX_CONTROL__AUX_RESET_DONE_MASK                                                              0x00000020L
+#define DP_AUX0_AUX_CONTROL__AUX_LS_READ_EN_MASK                                                              0x00000100L
+#define DP_AUX0_AUX_CONTROL__AUX_LS_UPDATE_DISABLE_MASK                                                       0x00001000L
+#define DP_AUX0_AUX_CONTROL__AUX_IGNORE_HPD_DISCON_MASK                                                       0x00010000L
+#define DP_AUX0_AUX_CONTROL__AUX_MODE_DET_EN_MASK                                                             0x00040000L
+#define DP_AUX0_AUX_CONTROL__AUX_HPD_SEL_MASK                                                                 0x00700000L
+#define DP_AUX0_AUX_CONTROL__AUX_IMPCAL_REQ_EN_MASK                                                           0x01000000L
+#define DP_AUX0_AUX_CONTROL__AUX_TEST_MODE_MASK                                                               0x10000000L
+//DP_AUX0_AUX_SW_CONTROL
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_GO__SHIFT                                                              0x0
+#define DP_AUX0_AUX_SW_CONTROL__AUX_LS_READ_TRIG__SHIFT                                                       0x2
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_START_DELAY__SHIFT                                                     0x4
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_WR_BYTES__SHIFT                                                        0x10
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_GO_MASK                                                                0x00000001L
+#define DP_AUX0_AUX_SW_CONTROL__AUX_LS_READ_TRIG_MASK                                                         0x00000004L
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_START_DELAY_MASK                                                       0x000000F0L
+#define DP_AUX0_AUX_SW_CONTROL__AUX_SW_WR_BYTES_MASK                                                          0x001F0000L
+//DP_AUX0_AUX_ARB_CONTROL
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_ARB_PRIORITY__SHIFT                                                      0x0
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS__SHIFT                                                0x2
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO__SHIFT                                                   0x8
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO__SHIFT                                                   0xa
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ__SHIFT                                                0x10
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG__SHIFT                                             0x11
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ__SHIFT                                              0x18
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG__SHIFT                                           0x19
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_ARB_PRIORITY_MASK                                                        0x00000001L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS_MASK                                                  0x0000000CL
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO_MASK                                                     0x00000100L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO_MASK                                                     0x00000400L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ_MASK                                                  0x00010000L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG_MASK                                               0x00020000L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ_MASK                                                0x01000000L
+#define DP_AUX0_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG_MASK                                             0x02000000L
+//DP_AUX0_AUX_INTERRUPT_CONTROL
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT__SHIFT                                                 0x0
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK__SHIFT                                                 0x1
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK__SHIFT                                                0x2
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT__SHIFT                                                 0x4
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK__SHIFT                                                 0x5
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK__SHIFT                                                0x6
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT_MASK                                                   0x00000001L
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK_MASK                                                   0x00000002L
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK_MASK                                                  0x00000004L
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT_MASK                                                   0x00000010L
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK_MASK                                                   0x00000020L
+#define DP_AUX0_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK_MASK                                                  0x00000040L
+//DP_AUX0_AUX_SW_STATUS
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_DONE__SHIFT                                                             0x0
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_REQ__SHIFT                                                              0x1
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX0_AUX_SW_STATUS__AUX_ARB_STATUS__SHIFT                                                          0x1d
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_DONE_MASK                                                               0x00000001L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_REQ_MASK                                                                0x00000002L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX0_AUX_SW_STATUS__AUX_ARB_STATUS_MASK                                                            0x60000000L
+//DP_AUX0_AUX_LS_STATUS
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_DONE__SHIFT                                                             0x0
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_REQ__SHIFT                                                              0x1
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_CP_IRQ__SHIFT                                                           0x1d
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_UPDATED__SHIFT                                                          0x1e
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_UPDATED_ACK__SHIFT                                                      0x1f
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_DONE_MASK                                                               0x00000001L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_REQ_MASK                                                                0x00000002L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_CP_IRQ_MASK                                                             0x20000000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_UPDATED_MASK                                                            0x40000000L
+#define DP_AUX0_AUX_LS_STATUS__AUX_LS_UPDATED_ACK_MASK                                                        0x80000000L
+//DP_AUX0_AUX_SW_DATA
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_DATA_RW__SHIFT                                                            0x0
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_DATA__SHIFT                                                               0x8
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_INDEX__SHIFT                                                              0x10
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT                                              0x1f
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_DATA_RW_MASK                                                              0x00000001L
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_INDEX_MASK                                                                0x001F0000L
+#define DP_AUX0_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK                                                0x80000000L
+//DP_AUX0_AUX_LS_DATA
+#define DP_AUX0_AUX_LS_DATA__AUX_LS_DATA__SHIFT                                                               0x8
+#define DP_AUX0_AUX_LS_DATA__AUX_LS_INDEX__SHIFT                                                              0x10
+#define DP_AUX0_AUX_LS_DATA__AUX_LS_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX0_AUX_LS_DATA__AUX_LS_INDEX_MASK                                                                0x001F0000L
+//DP_AUX0_AUX_DPHY_TX_REF_CONTROL
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL__SHIFT                                                0x0
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE__SHIFT                                                   0x4
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV__SHIFT                                                0x10
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL_MASK                                                  0x00000001L
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE_MASK                                                     0x00000030L
+#define DP_AUX0_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV_MASK                                                  0x01FF0000L
+//DP_AUX0_AUX_DPHY_TX_CONTROL
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN__SHIFT                                              0x0
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL__SHIFT                                          0x4
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME__SHIFT                                             0x6
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS__SHIFT                                          0x8
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY__SHIFT                                          0x10
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MASK                                                0x0000000FL
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL_MASK                                            0x00000030L
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME_MASK                                               0x00000040L
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS_MASK                                            0x00003F00L
+#define DP_AUX0_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY_MASK                                            0x00070000L
+//DP_AUX0_AUX_DPHY_RX_CONTROL0
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW__SHIFT                                              0x4
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW__SHIFT                                            0x8
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN__SHIFT                                       0xc
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN__SHIFT                                      0x10
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT__SHIFT                        0x11
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START__SHIFT                               0x12
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP__SHIFT                                0x13
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN__SHIFT                                          0x14
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD__SHIFT                                       0x1c
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW_MASK                                                0x00000070L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW_MASK                                              0x00000700L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN_MASK                                         0x00003000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN_MASK                                        0x00010000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT_MASK                          0x00020000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START_MASK                                 0x00040000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP_MASK                                  0x00080000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN_MASK                                            0x00300000L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD_MASK                                         0x70000000L
+//DP_AUX0_AUX_DPHY_RX_CONTROL1
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP__SHIFT                                            0x0
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN__SHIFT                                               0x8
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL__SHIFT                                           0xf
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP_MASK                                              0x000000FFL
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MASK                                                 0x00007F00L
+#define DP_AUX0_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL_MASK                                             0x00018000L
+//DP_AUX0_AUX_DPHY_TX_STATUS
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE__SHIFT                                                      0x0
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_STATE__SHIFT                                                       0x4
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD__SHIFT                                             0x10
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE_MASK                                                        0x00000001L
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_STATE_MASK                                                         0x00000070L
+#define DP_AUX0_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD_MASK                                               0x01FF0000L
+//DP_AUX0_AUX_DPHY_RX_STATUS
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_STATE__SHIFT                                                       0x0
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT__SHIFT                                            0x8
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT__SHIFT                                       0x10
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD__SHIFT                                             0x15
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_STATE_MASK                                                         0x00000007L
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT_MASK                                              0x00001F00L
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT_MASK                                         0x001F0000L
+#define DP_AUX0_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_MASK                                               0x3FE00000L
+//DP_AUX0_AUX_PHY_WAKE_CNTL
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO__SHIFT                                                  0x0
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING__SHIFT                                             0x1
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY__SHIFT                                            0x2
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK__SHIFT                                                 0x3
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO_MASK                                                    0x00000001L
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING_MASK                                               0x00000002L
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY_MASK                                              0x00000004L
+#define DP_AUX0_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK_MASK                                                   0x00000008L
+//DP_AUX0_AUX_PHY_WAKE_STATUS
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE__SHIFT                                    0x4
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT__SHIFT                                          0x7
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON__SHIFT                                           0x9
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE__SHIFT                                         0xb
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL__SHIFT                                   0xc
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP__SHIFT                                     0xe
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L__SHIFT                                   0x11
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H__SHIFT                                   0x12
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET__SHIFT                                      0x14
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H__SHIFT                                   0x16
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L__SHIFT                                   0x17
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE_MASK                                      0x00000070L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_MASK                                            0x00000080L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON_MASK                                             0x00000200L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE_MASK                                           0x00000800L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL_MASK                                     0x00001000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP_MASK                                       0x00004000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L_MASK                                     0x00020000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H_MASK                                     0x00040000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET_MASK                                        0x00100000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H_MASK                                     0x00400000L
+#define DP_AUX0_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L_MASK                                     0x00800000L
+
+
+// addressBlock: dce_dc_dcoh_dp_aux1_dispdec
+//DP_AUX1_AUX_CONTROL
+#define DP_AUX1_AUX_CONTROL__AUX_EN__SHIFT                                                                    0x0
+#define DP_AUX1_AUX_CONTROL__AUX_RESET__SHIFT                                                                 0x4
+#define DP_AUX1_AUX_CONTROL__AUX_RESET_DONE__SHIFT                                                            0x5
+#define DP_AUX1_AUX_CONTROL__AUX_LS_READ_EN__SHIFT                                                            0x8
+#define DP_AUX1_AUX_CONTROL__AUX_LS_UPDATE_DISABLE__SHIFT                                                     0xc
+#define DP_AUX1_AUX_CONTROL__AUX_IGNORE_HPD_DISCON__SHIFT                                                     0x10
+#define DP_AUX1_AUX_CONTROL__AUX_MODE_DET_EN__SHIFT                                                           0x12
+#define DP_AUX1_AUX_CONTROL__AUX_HPD_SEL__SHIFT                                                               0x14
+#define DP_AUX1_AUX_CONTROL__AUX_IMPCAL_REQ_EN__SHIFT                                                         0x18
+#define DP_AUX1_AUX_CONTROL__AUX_TEST_MODE__SHIFT                                                             0x1c
+#define DP_AUX1_AUX_CONTROL__AUX_EN_MASK                                                                      0x00000001L
+#define DP_AUX1_AUX_CONTROL__AUX_RESET_MASK                                                                   0x00000010L
+#define DP_AUX1_AUX_CONTROL__AUX_RESET_DONE_MASK                                                              0x00000020L
+#define DP_AUX1_AUX_CONTROL__AUX_LS_READ_EN_MASK                                                              0x00000100L
+#define DP_AUX1_AUX_CONTROL__AUX_LS_UPDATE_DISABLE_MASK                                                       0x00001000L
+#define DP_AUX1_AUX_CONTROL__AUX_IGNORE_HPD_DISCON_MASK                                                       0x00010000L
+#define DP_AUX1_AUX_CONTROL__AUX_MODE_DET_EN_MASK                                                             0x00040000L
+#define DP_AUX1_AUX_CONTROL__AUX_HPD_SEL_MASK                                                                 0x00700000L
+#define DP_AUX1_AUX_CONTROL__AUX_IMPCAL_REQ_EN_MASK                                                           0x01000000L
+#define DP_AUX1_AUX_CONTROL__AUX_TEST_MODE_MASK                                                               0x10000000L
+//DP_AUX1_AUX_SW_CONTROL
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_GO__SHIFT                                                              0x0
+#define DP_AUX1_AUX_SW_CONTROL__AUX_LS_READ_TRIG__SHIFT                                                       0x2
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_START_DELAY__SHIFT                                                     0x4
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_WR_BYTES__SHIFT                                                        0x10
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_GO_MASK                                                                0x00000001L
+#define DP_AUX1_AUX_SW_CONTROL__AUX_LS_READ_TRIG_MASK                                                         0x00000004L
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_START_DELAY_MASK                                                       0x000000F0L
+#define DP_AUX1_AUX_SW_CONTROL__AUX_SW_WR_BYTES_MASK                                                          0x001F0000L
+//DP_AUX1_AUX_ARB_CONTROL
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_ARB_PRIORITY__SHIFT                                                      0x0
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS__SHIFT                                                0x2
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO__SHIFT                                                   0x8
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO__SHIFT                                                   0xa
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ__SHIFT                                                0x10
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG__SHIFT                                             0x11
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ__SHIFT                                              0x18
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG__SHIFT                                           0x19
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_ARB_PRIORITY_MASK                                                        0x00000001L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS_MASK                                                  0x0000000CL
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO_MASK                                                     0x00000100L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO_MASK                                                     0x00000400L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ_MASK                                                  0x00010000L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG_MASK                                               0x00020000L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ_MASK                                                0x01000000L
+#define DP_AUX1_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG_MASK                                             0x02000000L
+//DP_AUX1_AUX_INTERRUPT_CONTROL
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT__SHIFT                                                 0x0
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK__SHIFT                                                 0x1
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK__SHIFT                                                0x2
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT__SHIFT                                                 0x4
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK__SHIFT                                                 0x5
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK__SHIFT                                                0x6
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT_MASK                                                   0x00000001L
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK_MASK                                                   0x00000002L
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK_MASK                                                  0x00000004L
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT_MASK                                                   0x00000010L
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK_MASK                                                   0x00000020L
+#define DP_AUX1_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK_MASK                                                  0x00000040L
+//DP_AUX1_AUX_SW_STATUS
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_DONE__SHIFT                                                             0x0
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_REQ__SHIFT                                                              0x1
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX1_AUX_SW_STATUS__AUX_ARB_STATUS__SHIFT                                                          0x1d
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_DONE_MASK                                                               0x00000001L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_REQ_MASK                                                                0x00000002L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX1_AUX_SW_STATUS__AUX_ARB_STATUS_MASK                                                            0x60000000L
+//DP_AUX1_AUX_LS_STATUS
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_DONE__SHIFT                                                             0x0
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_REQ__SHIFT                                                              0x1
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_CP_IRQ__SHIFT                                                           0x1d
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_UPDATED__SHIFT                                                          0x1e
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_UPDATED_ACK__SHIFT                                                      0x1f
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_DONE_MASK                                                               0x00000001L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_REQ_MASK                                                                0x00000002L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_CP_IRQ_MASK                                                             0x20000000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_UPDATED_MASK                                                            0x40000000L
+#define DP_AUX1_AUX_LS_STATUS__AUX_LS_UPDATED_ACK_MASK                                                        0x80000000L
+//DP_AUX1_AUX_SW_DATA
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_DATA_RW__SHIFT                                                            0x0
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_DATA__SHIFT                                                               0x8
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_INDEX__SHIFT                                                              0x10
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT                                              0x1f
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_DATA_RW_MASK                                                              0x00000001L
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_INDEX_MASK                                                                0x001F0000L
+#define DP_AUX1_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK                                                0x80000000L
+//DP_AUX1_AUX_LS_DATA
+#define DP_AUX1_AUX_LS_DATA__AUX_LS_DATA__SHIFT                                                               0x8
+#define DP_AUX1_AUX_LS_DATA__AUX_LS_INDEX__SHIFT                                                              0x10
+#define DP_AUX1_AUX_LS_DATA__AUX_LS_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX1_AUX_LS_DATA__AUX_LS_INDEX_MASK                                                                0x001F0000L
+//DP_AUX1_AUX_DPHY_TX_REF_CONTROL
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL__SHIFT                                                0x0
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE__SHIFT                                                   0x4
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV__SHIFT                                                0x10
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL_MASK                                                  0x00000001L
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE_MASK                                                     0x00000030L
+#define DP_AUX1_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV_MASK                                                  0x01FF0000L
+//DP_AUX1_AUX_DPHY_TX_CONTROL
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN__SHIFT                                              0x0
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL__SHIFT                                          0x4
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME__SHIFT                                             0x6
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS__SHIFT                                          0x8
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY__SHIFT                                          0x10
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MASK                                                0x0000000FL
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL_MASK                                            0x00000030L
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME_MASK                                               0x00000040L
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS_MASK                                            0x00003F00L
+#define DP_AUX1_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY_MASK                                            0x00070000L
+//DP_AUX1_AUX_DPHY_RX_CONTROL0
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW__SHIFT                                              0x4
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW__SHIFT                                            0x8
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN__SHIFT                                       0xc
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN__SHIFT                                      0x10
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT__SHIFT                        0x11
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START__SHIFT                               0x12
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP__SHIFT                                0x13
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN__SHIFT                                          0x14
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD__SHIFT                                       0x1c
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW_MASK                                                0x00000070L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW_MASK                                              0x00000700L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN_MASK                                         0x00003000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN_MASK                                        0x00010000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT_MASK                          0x00020000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START_MASK                                 0x00040000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP_MASK                                  0x00080000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN_MASK                                            0x00300000L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD_MASK                                         0x70000000L
+//DP_AUX1_AUX_DPHY_RX_CONTROL1
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP__SHIFT                                            0x0
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN__SHIFT                                               0x8
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL__SHIFT                                           0xf
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP_MASK                                              0x000000FFL
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MASK                                                 0x00007F00L
+#define DP_AUX1_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL_MASK                                             0x00018000L
+//DP_AUX1_AUX_DPHY_TX_STATUS
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE__SHIFT                                                      0x0
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_STATE__SHIFT                                                       0x4
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD__SHIFT                                             0x10
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE_MASK                                                        0x00000001L
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_STATE_MASK                                                         0x00000070L
+#define DP_AUX1_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD_MASK                                               0x01FF0000L
+//DP_AUX1_AUX_DPHY_RX_STATUS
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_STATE__SHIFT                                                       0x0
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT__SHIFT                                            0x8
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT__SHIFT                                       0x10
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD__SHIFT                                             0x15
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_STATE_MASK                                                         0x00000007L
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT_MASK                                              0x00001F00L
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT_MASK                                         0x001F0000L
+#define DP_AUX1_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_MASK                                               0x3FE00000L
+//DP_AUX1_AUX_PHY_WAKE_CNTL
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO__SHIFT                                                  0x0
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING__SHIFT                                             0x1
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY__SHIFT                                            0x2
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK__SHIFT                                                 0x3
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO_MASK                                                    0x00000001L
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING_MASK                                               0x00000002L
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY_MASK                                              0x00000004L
+#define DP_AUX1_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK_MASK                                                   0x00000008L
+//DP_AUX1_AUX_PHY_WAKE_STATUS
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE__SHIFT                                    0x4
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT__SHIFT                                          0x7
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON__SHIFT                                           0x9
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE__SHIFT                                         0xb
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL__SHIFT                                   0xc
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP__SHIFT                                     0xe
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L__SHIFT                                   0x11
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H__SHIFT                                   0x12
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET__SHIFT                                      0x14
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H__SHIFT                                   0x16
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L__SHIFT                                   0x17
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE_MASK                                      0x00000070L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_MASK                                            0x00000080L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON_MASK                                             0x00000200L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE_MASK                                           0x00000800L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL_MASK                                     0x00001000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP_MASK                                       0x00004000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L_MASK                                     0x00020000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H_MASK                                     0x00040000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET_MASK                                        0x00100000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H_MASK                                     0x00400000L
+#define DP_AUX1_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L_MASK                                     0x00800000L
+
+
+// addressBlock: dce_dc_dcoh_dp_aux2_dispdec
+//DP_AUX2_AUX_CONTROL
+#define DP_AUX2_AUX_CONTROL__AUX_EN__SHIFT                                                                    0x0
+#define DP_AUX2_AUX_CONTROL__AUX_RESET__SHIFT                                                                 0x4
+#define DP_AUX2_AUX_CONTROL__AUX_RESET_DONE__SHIFT                                                            0x5
+#define DP_AUX2_AUX_CONTROL__AUX_LS_READ_EN__SHIFT                                                            0x8
+#define DP_AUX2_AUX_CONTROL__AUX_LS_UPDATE_DISABLE__SHIFT                                                     0xc
+#define DP_AUX2_AUX_CONTROL__AUX_IGNORE_HPD_DISCON__SHIFT                                                     0x10
+#define DP_AUX2_AUX_CONTROL__AUX_MODE_DET_EN__SHIFT                                                           0x12
+#define DP_AUX2_AUX_CONTROL__AUX_HPD_SEL__SHIFT                                                               0x14
+#define DP_AUX2_AUX_CONTROL__AUX_IMPCAL_REQ_EN__SHIFT                                                         0x18
+#define DP_AUX2_AUX_CONTROL__AUX_TEST_MODE__SHIFT                                                             0x1c
+#define DP_AUX2_AUX_CONTROL__AUX_EN_MASK                                                                      0x00000001L
+#define DP_AUX2_AUX_CONTROL__AUX_RESET_MASK                                                                   0x00000010L
+#define DP_AUX2_AUX_CONTROL__AUX_RESET_DONE_MASK                                                              0x00000020L
+#define DP_AUX2_AUX_CONTROL__AUX_LS_READ_EN_MASK                                                              0x00000100L
+#define DP_AUX2_AUX_CONTROL__AUX_LS_UPDATE_DISABLE_MASK                                                       0x00001000L
+#define DP_AUX2_AUX_CONTROL__AUX_IGNORE_HPD_DISCON_MASK                                                       0x00010000L
+#define DP_AUX2_AUX_CONTROL__AUX_MODE_DET_EN_MASK                                                             0x00040000L
+#define DP_AUX2_AUX_CONTROL__AUX_HPD_SEL_MASK                                                                 0x00700000L
+#define DP_AUX2_AUX_CONTROL__AUX_IMPCAL_REQ_EN_MASK                                                           0x01000000L
+#define DP_AUX2_AUX_CONTROL__AUX_TEST_MODE_MASK                                                               0x10000000L
+//DP_AUX2_AUX_SW_CONTROL
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_GO__SHIFT                                                              0x0
+#define DP_AUX2_AUX_SW_CONTROL__AUX_LS_READ_TRIG__SHIFT                                                       0x2
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_START_DELAY__SHIFT                                                     0x4
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_WR_BYTES__SHIFT                                                        0x10
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_GO_MASK                                                                0x00000001L
+#define DP_AUX2_AUX_SW_CONTROL__AUX_LS_READ_TRIG_MASK                                                         0x00000004L
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_START_DELAY_MASK                                                       0x000000F0L
+#define DP_AUX2_AUX_SW_CONTROL__AUX_SW_WR_BYTES_MASK                                                          0x001F0000L
+//DP_AUX2_AUX_ARB_CONTROL
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_ARB_PRIORITY__SHIFT                                                      0x0
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS__SHIFT                                                0x2
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO__SHIFT                                                   0x8
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO__SHIFT                                                   0xa
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ__SHIFT                                                0x10
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG__SHIFT                                             0x11
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ__SHIFT                                              0x18
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG__SHIFT                                           0x19
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_ARB_PRIORITY_MASK                                                        0x00000001L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS_MASK                                                  0x0000000CL
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO_MASK                                                     0x00000100L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO_MASK                                                     0x00000400L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ_MASK                                                  0x00010000L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG_MASK                                               0x00020000L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ_MASK                                                0x01000000L
+#define DP_AUX2_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG_MASK                                             0x02000000L
+//DP_AUX2_AUX_INTERRUPT_CONTROL
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT__SHIFT                                                 0x0
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK__SHIFT                                                 0x1
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK__SHIFT                                                0x2
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT__SHIFT                                                 0x4
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK__SHIFT                                                 0x5
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK__SHIFT                                                0x6
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT_MASK                                                   0x00000001L
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK_MASK                                                   0x00000002L
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK_MASK                                                  0x00000004L
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT_MASK                                                   0x00000010L
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK_MASK                                                   0x00000020L
+#define DP_AUX2_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK_MASK                                                  0x00000040L
+//DP_AUX2_AUX_SW_STATUS
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_DONE__SHIFT                                                             0x0
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_REQ__SHIFT                                                              0x1
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX2_AUX_SW_STATUS__AUX_ARB_STATUS__SHIFT                                                          0x1d
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_DONE_MASK                                                               0x00000001L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_REQ_MASK                                                                0x00000002L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX2_AUX_SW_STATUS__AUX_ARB_STATUS_MASK                                                            0x60000000L
+//DP_AUX2_AUX_LS_STATUS
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_DONE__SHIFT                                                             0x0
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_REQ__SHIFT                                                              0x1
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_CP_IRQ__SHIFT                                                           0x1d
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_UPDATED__SHIFT                                                          0x1e
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_UPDATED_ACK__SHIFT                                                      0x1f
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_DONE_MASK                                                               0x00000001L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_REQ_MASK                                                                0x00000002L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_CP_IRQ_MASK                                                             0x20000000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_UPDATED_MASK                                                            0x40000000L
+#define DP_AUX2_AUX_LS_STATUS__AUX_LS_UPDATED_ACK_MASK                                                        0x80000000L
+//DP_AUX2_AUX_SW_DATA
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_DATA_RW__SHIFT                                                            0x0
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_DATA__SHIFT                                                               0x8
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_INDEX__SHIFT                                                              0x10
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT                                              0x1f
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_DATA_RW_MASK                                                              0x00000001L
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_INDEX_MASK                                                                0x001F0000L
+#define DP_AUX2_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK                                                0x80000000L
+//DP_AUX2_AUX_LS_DATA
+#define DP_AUX2_AUX_LS_DATA__AUX_LS_DATA__SHIFT                                                               0x8
+#define DP_AUX2_AUX_LS_DATA__AUX_LS_INDEX__SHIFT                                                              0x10
+#define DP_AUX2_AUX_LS_DATA__AUX_LS_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX2_AUX_LS_DATA__AUX_LS_INDEX_MASK                                                                0x001F0000L
+//DP_AUX2_AUX_DPHY_TX_REF_CONTROL
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL__SHIFT                                                0x0
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE__SHIFT                                                   0x4
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV__SHIFT                                                0x10
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL_MASK                                                  0x00000001L
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE_MASK                                                     0x00000030L
+#define DP_AUX2_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV_MASK                                                  0x01FF0000L
+//DP_AUX2_AUX_DPHY_TX_CONTROL
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN__SHIFT                                              0x0
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL__SHIFT                                          0x4
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME__SHIFT                                             0x6
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS__SHIFT                                          0x8
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY__SHIFT                                          0x10
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MASK                                                0x0000000FL
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL_MASK                                            0x00000030L
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME_MASK                                               0x00000040L
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS_MASK                                            0x00003F00L
+#define DP_AUX2_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY_MASK                                            0x00070000L
+//DP_AUX2_AUX_DPHY_RX_CONTROL0
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW__SHIFT                                              0x4
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW__SHIFT                                            0x8
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN__SHIFT                                       0xc
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN__SHIFT                                      0x10
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT__SHIFT                        0x11
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START__SHIFT                               0x12
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP__SHIFT                                0x13
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN__SHIFT                                          0x14
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD__SHIFT                                       0x1c
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW_MASK                                                0x00000070L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW_MASK                                              0x00000700L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN_MASK                                         0x00003000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN_MASK                                        0x00010000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT_MASK                          0x00020000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START_MASK                                 0x00040000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP_MASK                                  0x00080000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN_MASK                                            0x00300000L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD_MASK                                         0x70000000L
+//DP_AUX2_AUX_DPHY_RX_CONTROL1
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP__SHIFT                                            0x0
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN__SHIFT                                               0x8
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL__SHIFT                                           0xf
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP_MASK                                              0x000000FFL
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MASK                                                 0x00007F00L
+#define DP_AUX2_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL_MASK                                             0x00018000L
+//DP_AUX2_AUX_DPHY_TX_STATUS
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE__SHIFT                                                      0x0
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_STATE__SHIFT                                                       0x4
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD__SHIFT                                             0x10
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE_MASK                                                        0x00000001L
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_STATE_MASK                                                         0x00000070L
+#define DP_AUX2_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD_MASK                                               0x01FF0000L
+//DP_AUX2_AUX_DPHY_RX_STATUS
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_STATE__SHIFT                                                       0x0
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT__SHIFT                                            0x8
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT__SHIFT                                       0x10
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD__SHIFT                                             0x15
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_STATE_MASK                                                         0x00000007L
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT_MASK                                              0x00001F00L
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT_MASK                                         0x001F0000L
+#define DP_AUX2_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_MASK                                               0x3FE00000L
+//DP_AUX2_AUX_PHY_WAKE_CNTL
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO__SHIFT                                                  0x0
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING__SHIFT                                             0x1
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY__SHIFT                                            0x2
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK__SHIFT                                                 0x3
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO_MASK                                                    0x00000001L
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING_MASK                                               0x00000002L
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY_MASK                                              0x00000004L
+#define DP_AUX2_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK_MASK                                                   0x00000008L
+//DP_AUX2_AUX_PHY_WAKE_STATUS
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE__SHIFT                                    0x4
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT__SHIFT                                          0x7
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON__SHIFT                                           0x9
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE__SHIFT                                         0xb
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL__SHIFT                                   0xc
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP__SHIFT                                     0xe
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L__SHIFT                                   0x11
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H__SHIFT                                   0x12
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET__SHIFT                                      0x14
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H__SHIFT                                   0x16
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L__SHIFT                                   0x17
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE_MASK                                      0x00000070L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_MASK                                            0x00000080L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON_MASK                                             0x00000200L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE_MASK                                           0x00000800L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL_MASK                                     0x00001000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP_MASK                                       0x00004000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L_MASK                                     0x00020000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H_MASK                                     0x00040000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET_MASK                                        0x00100000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H_MASK                                     0x00400000L
+#define DP_AUX2_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L_MASK                                     0x00800000L
+
+
+// addressBlock: dce_dc_dcoh_dp_aux3_dispdec
+//DP_AUX3_AUX_CONTROL
+#define DP_AUX3_AUX_CONTROL__AUX_EN__SHIFT                                                                    0x0
+#define DP_AUX3_AUX_CONTROL__AUX_RESET__SHIFT                                                                 0x4
+#define DP_AUX3_AUX_CONTROL__AUX_RESET_DONE__SHIFT                                                            0x5
+#define DP_AUX3_AUX_CONTROL__AUX_LS_READ_EN__SHIFT                                                            0x8
+#define DP_AUX3_AUX_CONTROL__AUX_LS_UPDATE_DISABLE__SHIFT                                                     0xc
+#define DP_AUX3_AUX_CONTROL__AUX_IGNORE_HPD_DISCON__SHIFT                                                     0x10
+#define DP_AUX3_AUX_CONTROL__AUX_MODE_DET_EN__SHIFT                                                           0x12
+#define DP_AUX3_AUX_CONTROL__AUX_HPD_SEL__SHIFT                                                               0x14
+#define DP_AUX3_AUX_CONTROL__AUX_IMPCAL_REQ_EN__SHIFT                                                         0x18
+#define DP_AUX3_AUX_CONTROL__AUX_TEST_MODE__SHIFT                                                             0x1c
+#define DP_AUX3_AUX_CONTROL__AUX_EN_MASK                                                                      0x00000001L
+#define DP_AUX3_AUX_CONTROL__AUX_RESET_MASK                                                                   0x00000010L
+#define DP_AUX3_AUX_CONTROL__AUX_RESET_DONE_MASK                                                              0x00000020L
+#define DP_AUX3_AUX_CONTROL__AUX_LS_READ_EN_MASK                                                              0x00000100L
+#define DP_AUX3_AUX_CONTROL__AUX_LS_UPDATE_DISABLE_MASK                                                       0x00001000L
+#define DP_AUX3_AUX_CONTROL__AUX_IGNORE_HPD_DISCON_MASK                                                       0x00010000L
+#define DP_AUX3_AUX_CONTROL__AUX_MODE_DET_EN_MASK                                                             0x00040000L
+#define DP_AUX3_AUX_CONTROL__AUX_HPD_SEL_MASK                                                                 0x00700000L
+#define DP_AUX3_AUX_CONTROL__AUX_IMPCAL_REQ_EN_MASK                                                           0x01000000L
+#define DP_AUX3_AUX_CONTROL__AUX_TEST_MODE_MASK                                                               0x10000000L
+//DP_AUX3_AUX_SW_CONTROL
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_GO__SHIFT                                                              0x0
+#define DP_AUX3_AUX_SW_CONTROL__AUX_LS_READ_TRIG__SHIFT                                                       0x2
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_START_DELAY__SHIFT                                                     0x4
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_WR_BYTES__SHIFT                                                        0x10
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_GO_MASK                                                                0x00000001L
+#define DP_AUX3_AUX_SW_CONTROL__AUX_LS_READ_TRIG_MASK                                                         0x00000004L
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_START_DELAY_MASK                                                       0x000000F0L
+#define DP_AUX3_AUX_SW_CONTROL__AUX_SW_WR_BYTES_MASK                                                          0x001F0000L
+//DP_AUX3_AUX_ARB_CONTROL
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_ARB_PRIORITY__SHIFT                                                      0x0
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS__SHIFT                                                0x2
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO__SHIFT                                                   0x8
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO__SHIFT                                                   0xa
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ__SHIFT                                                0x10
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG__SHIFT                                             0x11
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ__SHIFT                                              0x18
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG__SHIFT                                           0x19
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_ARB_PRIORITY_MASK                                                        0x00000001L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_REG_RW_CNTL_STATUS_MASK                                                  0x0000000CL
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_NO_QUEUED_SW_GO_MASK                                                     0x00000100L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_NO_QUEUED_LS_GO_MASK                                                     0x00000400L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_SW_USE_AUX_REG_REQ_MASK                                                  0x00010000L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_SW_DONE_USING_AUX_REG_MASK                                               0x00020000L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_DMCU_USE_AUX_REG_REQ_MASK                                                0x01000000L
+#define DP_AUX3_AUX_ARB_CONTROL__AUX_DMCU_DONE_USING_AUX_REG_MASK                                             0x02000000L
+//DP_AUX3_AUX_INTERRUPT_CONTROL
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT__SHIFT                                                 0x0
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK__SHIFT                                                 0x1
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK__SHIFT                                                0x2
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT__SHIFT                                                 0x4
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK__SHIFT                                                 0x5
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK__SHIFT                                                0x6
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_INT_MASK                                                   0x00000001L
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_ACK_MASK                                                   0x00000002L
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_SW_DONE_MASK_MASK                                                  0x00000004L
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_INT_MASK                                                   0x00000010L
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_ACK_MASK                                                   0x00000020L
+#define DP_AUX3_AUX_INTERRUPT_CONTROL__AUX_LS_DONE_MASK_MASK                                                  0x00000040L
+//DP_AUX3_AUX_SW_STATUS
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_DONE__SHIFT                                                             0x0
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_REQ__SHIFT                                                              0x1
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX3_AUX_SW_STATUS__AUX_ARB_STATUS__SHIFT                                                          0x1d
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_DONE_MASK                                                               0x00000001L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_REQ_MASK                                                                0x00000002L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_SW_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX3_AUX_SW_STATUS__AUX_ARB_STATUS_MASK                                                            0x60000000L
+//DP_AUX3_AUX_LS_STATUS
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_DONE__SHIFT                                                             0x0
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_REQ__SHIFT                                                              0x1
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE__SHIFT                                                 0x4
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT__SHIFT                                                       0x7
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW__SHIFT                                                      0x8
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_HPD_DISCON__SHIFT                                                       0x9
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE__SHIFT                                                  0xa
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE__SHIFT                                                     0xb
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL__SHIFT                                                0xc
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP__SHIFT                                                  0xe
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L__SHIFT                                                0x11
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H__SHIFT                                                0x12
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_INVALID_START__SHIFT                                                 0x13
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET__SHIFT                                                   0x14
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H__SHIFT                                                0x16
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L__SHIFT                                                0x17
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT__SHIFT                                                 0x18
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_CP_IRQ__SHIFT                                                           0x1d
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_UPDATED__SHIFT                                                          0x1e
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_UPDATED_ACK__SHIFT                                                      0x1f
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_DONE_MASK                                                               0x00000001L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_REQ_MASK                                                                0x00000002L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_STATE_MASK                                                   0x00000070L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_TIMEOUT_MASK                                                         0x00000080L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_OVERFLOW_MASK                                                        0x00000100L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_HPD_DISCON_MASK                                                         0x00000200L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_PARTIAL_BYTE_MASK                                                    0x00000400L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_NON_AUX_MODE_MASK                                                       0x00000800L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_MIN_COUNT_VIOL_MASK                                                  0x00001000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_INVALID_STOP_MASK                                                    0x00004000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_L_MASK                                                  0x00020000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_SYNC_INVALID_H_MASK                                                  0x00040000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_INVALID_START_MASK                                                   0x00080000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_NO_DET_MASK                                                     0x00100000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_H_MASK                                                  0x00400000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_RX_RECV_INVALID_L_MASK                                                  0x00800000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_REPLY_BYTE_COUNT_MASK                                                   0x1F000000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_CP_IRQ_MASK                                                             0x20000000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_UPDATED_MASK                                                            0x40000000L
+#define DP_AUX3_AUX_LS_STATUS__AUX_LS_UPDATED_ACK_MASK                                                        0x80000000L
+//DP_AUX3_AUX_SW_DATA
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_DATA_RW__SHIFT                                                            0x0
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_DATA__SHIFT                                                               0x8
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_INDEX__SHIFT                                                              0x10
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE__SHIFT                                              0x1f
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_DATA_RW_MASK                                                              0x00000001L
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_INDEX_MASK                                                                0x001F0000L
+#define DP_AUX3_AUX_SW_DATA__AUX_SW_AUTOINCREMENT_DISABLE_MASK                                                0x80000000L
+//DP_AUX3_AUX_LS_DATA
+#define DP_AUX3_AUX_LS_DATA__AUX_LS_DATA__SHIFT                                                               0x8
+#define DP_AUX3_AUX_LS_DATA__AUX_LS_INDEX__SHIFT                                                              0x10
+#define DP_AUX3_AUX_LS_DATA__AUX_LS_DATA_MASK                                                                 0x0000FF00L
+#define DP_AUX3_AUX_LS_DATA__AUX_LS_INDEX_MASK                                                                0x001F0000L
+//DP_AUX3_AUX_DPHY_TX_REF_CONTROL
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL__SHIFT                                                0x0
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE__SHIFT                                                   0x4
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV__SHIFT                                                0x10
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_SEL_MASK                                                  0x00000001L
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_RATE_MASK                                                     0x00000030L
+#define DP_AUX3_AUX_DPHY_TX_REF_CONTROL__AUX_TX_REF_DIV_MASK                                                  0x01FF0000L
+//DP_AUX3_AUX_DPHY_TX_CONTROL
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN__SHIFT                                              0x0
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL__SHIFT                                          0x4
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME__SHIFT                                             0x6
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS__SHIFT                                          0x8
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY__SHIFT                                          0x10
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MASK                                                0x0000000FL
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_LEN_MUL_MASK                                            0x00000030L
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_OE_ASSERT_TIME_MASK                                               0x00000040L
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_TX_PRECHARGE_SYMBOLS_MASK                                            0x00003F00L
+#define DP_AUX3_AUX_DPHY_TX_CONTROL__AUX_MODE_DET_CHECK_DELAY_MASK                                            0x00070000L
+//DP_AUX3_AUX_DPHY_RX_CONTROL0
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW__SHIFT                                              0x4
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW__SHIFT                                            0x8
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN__SHIFT                                       0xc
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN__SHIFT                                      0x10
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT__SHIFT                        0x11
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START__SHIFT                               0x12
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP__SHIFT                                0x13
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN__SHIFT                                          0x14
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD__SHIFT                                       0x1c
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_START_WINDOW_MASK                                                0x00000070L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_RECEIVE_WINDOW_MASK                                              0x00000700L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_HALF_SYM_DETECT_LEN_MASK                                         0x00003000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_TRANSITION_FILTER_EN_MASK                                        0x00010000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT_MASK                          0x00020000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_START_MASK                                 0x00040000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_ALLOW_BELOW_THRESHOLD_STOP_MASK                                  0x00080000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_PHASE_DETECT_LEN_MASK                                            0x00300000L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL0__AUX_RX_DETECTION_THRESHOLD_MASK                                         0x70000000L
+//DP_AUX3_AUX_DPHY_RX_CONTROL1
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP__SHIFT                                            0x0
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN__SHIFT                                               0x8
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL__SHIFT                                           0xf
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_PRECHARGE_SKIP_MASK                                              0x000000FFL
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MASK                                                 0x00007F00L
+#define DP_AUX3_AUX_DPHY_RX_CONTROL1__AUX_RX_TIMEOUT_LEN_MUL_MASK                                             0x00018000L
+//DP_AUX3_AUX_DPHY_TX_STATUS
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE__SHIFT                                                      0x0
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_STATE__SHIFT                                                       0x4
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD__SHIFT                                             0x10
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_ACTIVE_MASK                                                        0x00000001L
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_STATE_MASK                                                         0x00000070L
+#define DP_AUX3_AUX_DPHY_TX_STATUS__AUX_TX_HALF_SYM_PERIOD_MASK                                               0x01FF0000L
+//DP_AUX3_AUX_DPHY_RX_STATUS
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_STATE__SHIFT                                                       0x0
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT__SHIFT                                            0x8
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT__SHIFT                                       0x10
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD__SHIFT                                             0x15
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_STATE_MASK                                                         0x00000007L
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_SYNC_VALID_COUNT_MASK                                              0x00001F00L
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_FRACT_MASK                                         0x001F0000L
+#define DP_AUX3_AUX_DPHY_RX_STATUS__AUX_RX_HALF_SYM_PERIOD_MASK                                               0x3FE00000L
+//DP_AUX3_AUX_PHY_WAKE_CNTL
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO__SHIFT                                                  0x0
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING__SHIFT                                             0x1
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY__SHIFT                                            0x2
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK__SHIFT                                                 0x3
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_GO_MASK                                                    0x00000001L
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PENDING_MASK                                               0x00000002L
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_PRIORITY_MASK                                              0x00000004L
+#define DP_AUX3_AUX_PHY_WAKE_CNTL__DP_AUX_PHY_WAKE_ACK_MASK                                                   0x00000008L
+//DP_AUX3_AUX_PHY_WAKE_STATUS
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE__SHIFT                                    0x4
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT__SHIFT                                          0x7
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON__SHIFT                                           0x9
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE__SHIFT                                         0xb
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL__SHIFT                                   0xc
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP__SHIFT                                     0xe
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L__SHIFT                                   0x11
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H__SHIFT                                   0x12
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET__SHIFT                                      0x14
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H__SHIFT                                   0x16
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L__SHIFT                                   0x17
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_STATE_MASK                                      0x00000070L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_TIMEOUT_MASK                                            0x00000080L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_HPD_DISCON_MASK                                             0x00000200L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_NON_AUX_MODE_MASK                                           0x00000800L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_MIN_COUNT_VIOL_MASK                                     0x00001000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_INVALID_STOP_MASK                                       0x00004000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_L_MASK                                     0x00020000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_SYNC_INVALID_H_MASK                                     0x00040000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_NO_DET_MASK                                        0x00100000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_H_MASK                                     0x00400000L
+#define DP_AUX3_AUX_PHY_WAKE_STATUS__AUX_PHY_WAKE_ACK_RECV_INVALID_L_MASK                                     0x00800000L
+
+
+// addressBlock: dce_dc_dcoh_hpd0_dispdec
+//HPD0_DC_HPD_INT_STATUS
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS__SHIFT                                                      0x0
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_SENSE__SHIFT                                                           0x1
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED__SHIFT                                                   0x4
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS__SHIFT                                                   0x8
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL__SHIFT                                       0xc
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL__SHIFT                                    0x18
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS_MASK                                                        0x00000001L
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_SENSE_MASK                                                             0x00000002L
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED_MASK                                                     0x00000010L
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS_MASK                                                     0x00000100L
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL_MASK                                         0x000FF000L
+#define HPD0_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL_MASK                                      0xFF000000L
+//HPD0_DC_HPD_INT_CONTROL
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK__SHIFT                                                        0x0
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY__SHIFT                                                   0x8
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_EN__SHIFT                                                         0x10
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK__SHIFT                                                     0x14
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN__SHIFT                                                      0x18
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK_MASK                                                          0x00000001L
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY_MASK                                                     0x00000100L
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_INT_EN_MASK                                                           0x00010000L
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK_MASK                                                       0x00100000L
+#define HPD0_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN_MASK                                                        0x01000000L
+//HPD0_DC_HPD_CONTROL
+#define HPD0_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER__SHIFT                                                   0x0
+#define HPD0_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER__SHIFT                                                       0x10
+#define HPD0_DC_HPD_CONTROL__DC_HPD_EN__SHIFT                                                                 0x1c
+#define HPD0_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER_MASK                                                     0x00001FFFL
+#define HPD0_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER_MASK                                                         0x03FF0000L
+#define HPD0_DC_HPD_CONTROL__DC_HPD_EN_MASK                                                                   0x10000000L
+//HPD0_DC_HPD_FAST_TRAIN_CNTL
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY__SHIFT                                       0x0
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY__SHIFT                                   0xc
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN__SHIFT                                          0x18
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN__SHIFT                                      0x1c
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY_MASK                                         0x000000FFL
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY_MASK                                     0x000FF000L
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN_MASK                                            0x01000000L
+#define HPD0_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN_MASK                                        0x10000000L
+//HPD0_DC_HPD_TOGGLE_FILT_CNTL
+#define HPD0_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY__SHIFT                                         0x0
+#define HPD0_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY__SHIFT                                      0x14
+#define HPD0_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY_MASK                                           0x000000FFL
+#define HPD0_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY_MASK                                        0x0FF00000L
+
+
+// addressBlock: dce_dc_dcoh_hpd1_dispdec
+//HPD1_DC_HPD_INT_STATUS
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS__SHIFT                                                      0x0
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_SENSE__SHIFT                                                           0x1
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED__SHIFT                                                   0x4
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS__SHIFT                                                   0x8
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL__SHIFT                                       0xc
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL__SHIFT                                    0x18
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS_MASK                                                        0x00000001L
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_SENSE_MASK                                                             0x00000002L
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED_MASK                                                     0x00000010L
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS_MASK                                                     0x00000100L
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL_MASK                                         0x000FF000L
+#define HPD1_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL_MASK                                      0xFF000000L
+//HPD1_DC_HPD_INT_CONTROL
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK__SHIFT                                                        0x0
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY__SHIFT                                                   0x8
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_EN__SHIFT                                                         0x10
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK__SHIFT                                                     0x14
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN__SHIFT                                                      0x18
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK_MASK                                                          0x00000001L
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY_MASK                                                     0x00000100L
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_INT_EN_MASK                                                           0x00010000L
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK_MASK                                                       0x00100000L
+#define HPD1_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN_MASK                                                        0x01000000L
+//HPD1_DC_HPD_CONTROL
+#define HPD1_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER__SHIFT                                                   0x0
+#define HPD1_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER__SHIFT                                                       0x10
+#define HPD1_DC_HPD_CONTROL__DC_HPD_EN__SHIFT                                                                 0x1c
+#define HPD1_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER_MASK                                                     0x00001FFFL
+#define HPD1_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER_MASK                                                         0x03FF0000L
+#define HPD1_DC_HPD_CONTROL__DC_HPD_EN_MASK                                                                   0x10000000L
+//HPD1_DC_HPD_FAST_TRAIN_CNTL
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY__SHIFT                                       0x0
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY__SHIFT                                   0xc
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN__SHIFT                                          0x18
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN__SHIFT                                      0x1c
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY_MASK                                         0x000000FFL
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY_MASK                                     0x000FF000L
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN_MASK                                            0x01000000L
+#define HPD1_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN_MASK                                        0x10000000L
+//HPD1_DC_HPD_TOGGLE_FILT_CNTL
+#define HPD1_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY__SHIFT                                         0x0
+#define HPD1_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY__SHIFT                                      0x14
+#define HPD1_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY_MASK                                           0x000000FFL
+#define HPD1_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY_MASK                                        0x0FF00000L
+
+
+// addressBlock: dce_dc_dcoh_hpd2_dispdec
+//HPD2_DC_HPD_INT_STATUS
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS__SHIFT                                                      0x0
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_SENSE__SHIFT                                                           0x1
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED__SHIFT                                                   0x4
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS__SHIFT                                                   0x8
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL__SHIFT                                       0xc
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL__SHIFT                                    0x18
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS_MASK                                                        0x00000001L
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_SENSE_MASK                                                             0x00000002L
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED_MASK                                                     0x00000010L
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS_MASK                                                     0x00000100L
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL_MASK                                         0x000FF000L
+#define HPD2_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL_MASK                                      0xFF000000L
+//HPD2_DC_HPD_INT_CONTROL
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK__SHIFT                                                        0x0
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY__SHIFT                                                   0x8
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_EN__SHIFT                                                         0x10
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK__SHIFT                                                     0x14
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN__SHIFT                                                      0x18
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK_MASK                                                          0x00000001L
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY_MASK                                                     0x00000100L
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_INT_EN_MASK                                                           0x00010000L
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK_MASK                                                       0x00100000L
+#define HPD2_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN_MASK                                                        0x01000000L
+//HPD2_DC_HPD_CONTROL
+#define HPD2_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER__SHIFT                                                   0x0
+#define HPD2_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER__SHIFT                                                       0x10
+#define HPD2_DC_HPD_CONTROL__DC_HPD_EN__SHIFT                                                                 0x1c
+#define HPD2_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER_MASK                                                     0x00001FFFL
+#define HPD2_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER_MASK                                                         0x03FF0000L
+#define HPD2_DC_HPD_CONTROL__DC_HPD_EN_MASK                                                                   0x10000000L
+//HPD2_DC_HPD_FAST_TRAIN_CNTL
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY__SHIFT                                       0x0
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY__SHIFT                                   0xc
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN__SHIFT                                          0x18
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN__SHIFT                                      0x1c
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY_MASK                                         0x000000FFL
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY_MASK                                     0x000FF000L
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN_MASK                                            0x01000000L
+#define HPD2_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN_MASK                                        0x10000000L
+//HPD2_DC_HPD_TOGGLE_FILT_CNTL
+#define HPD2_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY__SHIFT                                         0x0
+#define HPD2_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY__SHIFT                                      0x14
+#define HPD2_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY_MASK                                           0x000000FFL
+#define HPD2_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY_MASK                                        0x0FF00000L
+
+
+// addressBlock: dce_dc_dcoh_hpd3_dispdec
+//HPD3_DC_HPD_INT_STATUS
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS__SHIFT                                                      0x0
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_SENSE__SHIFT                                                           0x1
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED__SHIFT                                                   0x4
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS__SHIFT                                                   0x8
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL__SHIFT                                       0xc
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL__SHIFT                                    0x18
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_INT_STATUS_MASK                                                        0x00000001L
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_SENSE_MASK                                                             0x00000002L
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_SENSE_DELAYED_MASK                                                     0x00000010L
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_RX_INT_STATUS_MASK                                                     0x00000100L
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_CON_TIMER_VAL_MASK                                         0x000FF000L
+#define HPD3_DC_HPD_INT_STATUS__DC_HPD_TOGGLE_FILT_DISCON_TIMER_VAL_MASK                                      0xFF000000L
+//HPD3_DC_HPD_INT_CONTROL
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK__SHIFT                                                        0x0
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY__SHIFT                                                   0x8
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_EN__SHIFT                                                         0x10
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK__SHIFT                                                     0x14
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN__SHIFT                                                      0x18
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_ACK_MASK                                                          0x00000001L
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_POLARITY_MASK                                                     0x00000100L
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_INT_EN_MASK                                                           0x00010000L
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_ACK_MASK                                                       0x00100000L
+#define HPD3_DC_HPD_INT_CONTROL__DC_HPD_RX_INT_EN_MASK                                                        0x01000000L
+//HPD3_DC_HPD_CONTROL
+#define HPD3_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER__SHIFT                                                   0x0
+#define HPD3_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER__SHIFT                                                       0x10
+#define HPD3_DC_HPD_CONTROL__DC_HPD_EN__SHIFT                                                                 0x1c
+#define HPD3_DC_HPD_CONTROL__DC_HPD_CONNECTION_TIMER_MASK                                                     0x00001FFFL
+#define HPD3_DC_HPD_CONTROL__DC_HPD_RX_INT_TIMER_MASK                                                         0x03FF0000L
+#define HPD3_DC_HPD_CONTROL__DC_HPD_EN_MASK                                                                   0x10000000L
+//HPD3_DC_HPD_FAST_TRAIN_CNTL
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY__SHIFT                                       0x0
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY__SHIFT                                   0xc
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN__SHIFT                                          0x18
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN__SHIFT                                      0x1c
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_DELAY_MASK                                         0x000000FFL
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_DELAY_MASK                                     0x000FF000L
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_AUX_TX_EN_MASK                                            0x01000000L
+#define HPD3_DC_HPD_FAST_TRAIN_CNTL__DC_HPD_CONNECT_FAST_TRAIN_EN_MASK                                        0x10000000L
+//HPD3_DC_HPD_TOGGLE_FILT_CNTL
+#define HPD3_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY__SHIFT                                         0x0
+#define HPD3_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY__SHIFT                                      0x14
+#define HPD3_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_CONNECT_INT_DELAY_MASK                                           0x000000FFL
+#define HPD3_DC_HPD_TOGGLE_FILT_CNTL__DC_HPD_DISCONNECT_INT_DELAY_MASK                                        0x0FF00000L
+
+
+// addressBlock: dce_dc_hpo_hpo_top_dispdec
+//HPO_TOP_CLOCK_CONTROL
+#define HPO_TOP_CLOCK_CONTROL__HPO_DISPCLK_R_GATE_DIS__SHIFT                                                  0x0
+#define HPO_TOP_CLOCK_CONTROL__HPO_DISPCLK_GATE_DIS__SHIFT                                                    0x1
+#define HPO_TOP_CLOCK_CONTROL__HPO_SOCCLK_R_GATE_DIS__SHIFT                                                   0x4
+#define HPO_TOP_CLOCK_CONTROL__HPO_SOCCLK_GATE_DIS__SHIFT                                                     0x5
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMISTREAMCLK_R_GATE_DIS__SHIFT                                            0x8
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMISTREAMCLK_G_GATE_DIS__SHIFT                                            0x9
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMICHARCLK_R_GATE_DIS__SHIFT                                              0xc
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMICHARCLK_G_GATE_DIS__SHIFT                                              0xd
+#define HPO_TOP_CLOCK_CONTROL__HPO_DPSTREAMCLK_R_GATE_DIS__SHIFT                                              0x10
+#define HPO_TOP_CLOCK_CONTROL__HPO_DPSTREAMCLK_G_GATE_DIS__SHIFT                                              0x11
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_SE_R_GATE_DIS__SHIFT                                              0x12
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_SE_G_GATE_DIS__SHIFT                                              0x13
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_LE_R_GATE_DIS__SHIFT                                              0x14
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_LE_G_GATE_DIS__SHIFT                                              0x15
+#define HPO_TOP_CLOCK_CONTROL__HPO_FGCG_REP_DIS__SHIFT                                                        0x17
+#define HPO_TOP_CLOCK_CONTROL__HPO_TEST_CLK_SEL__SHIFT                                                        0x18
+#define HPO_TOP_CLOCK_CONTROL__HPO_DISPCLK_R_GATE_DIS_MASK                                                    0x00000001L
+#define HPO_TOP_CLOCK_CONTROL__HPO_DISPCLK_GATE_DIS_MASK                                                      0x00000002L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SOCCLK_R_GATE_DIS_MASK                                                     0x00000010L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SOCCLK_GATE_DIS_MASK                                                       0x00000020L
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMISTREAMCLK_R_GATE_DIS_MASK                                              0x00000100L
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMISTREAMCLK_G_GATE_DIS_MASK                                              0x00000200L
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMICHARCLK_R_GATE_DIS_MASK                                                0x00001000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_HDMICHARCLK_G_GATE_DIS_MASK                                                0x00002000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_DPSTREAMCLK_R_GATE_DIS_MASK                                                0x00010000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_DPSTREAMCLK_G_GATE_DIS_MASK                                                0x00020000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_SE_R_GATE_DIS_MASK                                                0x00040000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_SE_G_GATE_DIS_MASK                                                0x00080000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_LE_R_GATE_DIS_MASK                                                0x00100000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_SYMCLK32_LE_G_GATE_DIS_MASK                                                0x00200000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_FGCG_REP_DIS_MASK                                                          0x00800000L
+#define HPO_TOP_CLOCK_CONTROL__HPO_TEST_CLK_SEL_MASK                                                          0xFF000000L
+//HPO_TOP_HW_CONTROL
+#define HPO_TOP_HW_CONTROL__HPO_IO_EN__SHIFT                                                                  0x0
+#define HPO_TOP_HW_CONTROL__HPO_IO_EN_MASK                                                                    0x00000001L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_mapper_dispdec
+//DP_STREAM_MAPPER_CONTROL0
+#define DP_STREAM_MAPPER_CONTROL0__DP_STREAM_LINK_TARGET__SHIFT                                               0x0
+#define DP_STREAM_MAPPER_CONTROL0__DP_STREAM_LINK_TARGET_MASK                                                 0x00000007L
+//DP_STREAM_MAPPER_CONTROL1
+#define DP_STREAM_MAPPER_CONTROL1__DP_STREAM_LINK_TARGET__SHIFT                                               0x0
+#define DP_STREAM_MAPPER_CONTROL1__DP_STREAM_LINK_TARGET_MASK                                                 0x00000007L
+//DP_STREAM_MAPPER_CONTROL2
+#define DP_STREAM_MAPPER_CONTROL2__DP_STREAM_LINK_TARGET__SHIFT                                               0x0
+#define DP_STREAM_MAPPER_CONTROL2__DP_STREAM_LINK_TARGET_MASK                                                 0x00000007L
+//DP_STREAM_MAPPER_CONTROL3
+#define DP_STREAM_MAPPER_CONTROL3__DP_STREAM_LINK_TARGET__SHIFT                                               0x0
+#define DP_STREAM_MAPPER_CONTROL3__DP_STREAM_LINK_TARGET_MASK                                                 0x00000007L
+
+
+// addressBlock: dce_dc_hpo_hpo_dcperfmon_dc_perfmon_dispdec
+//DC_PERFMON18_PERFCOUNTER_CNTL
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL__SHIFT                                           0x0
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL__SHIFT                                          0x9
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE__SHIFT                                            0xc
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL__SHIFT                                         0xf
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE__SHIFT                                          0x10
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS__SHIFT                                    0x16
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN__SHIFT                                          0x17
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN__SHIFT                                              0x18
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK__SHIFT                                            0x19
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE__SHIFT                                              0x1a
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL__SHIFT                                            0x1d
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_EVENT_SEL_MASK                                             0x000001FFL
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CVALUE_SEL_MASK                                            0x00000E00L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_INC_MODE_MASK                                              0x00007000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_HW_CNTL_SEL_MASK                                           0x00008000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_RUNEN_MODE_MASK                                            0x00010000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CNTOFF_START_DIS_MASK                                      0x00400000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_RESTART_EN_MASK                                            0x00800000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_INT_EN_MASK                                                0x01000000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_OFF_MASK_MASK                                              0x02000000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_ACTIVE_MASK                                                0x04000000L
+#define DC_PERFMON18_PERFCOUNTER_CNTL__PERFCOUNTER_CNTL_SEL_MASK                                              0xE0000000L
+//DC_PERFMON18_PERFCOUNTER_CNTL2
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE__SHIFT                                 0x0
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL__SHIFT                                       0x2
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL__SHIFT                                       0x3
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL__SHIFT                                         0x8
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL__SHIFT                                          0x1d
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_COUNTED_VALUE_TYPE_MASK                                   0x00000003L
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP1_SEL_MASK                                         0x00000004L
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_HW_STOP2_SEL_MASK                                         0x00000008L
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTOFF_SEL_MASK                                           0x00003F00L
+#define DC_PERFMON18_PERFCOUNTER_CNTL2__PERFCOUNTER_CNTL2_SEL_MASK                                            0xE0000000L
+//DC_PERFMON18_PERFCOUNTER_STATE
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE__SHIFT                                         0x0
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0__SHIFT                                         0x2
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE__SHIFT                                         0x4
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1__SHIFT                                         0x6
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE__SHIFT                                         0x8
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2__SHIFT                                         0xa
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE__SHIFT                                         0xc
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3__SHIFT                                         0xe
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE__SHIFT                                         0x10
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4__SHIFT                                         0x12
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE__SHIFT                                         0x14
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5__SHIFT                                         0x16
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE__SHIFT                                         0x18
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6__SHIFT                                         0x1a
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE__SHIFT                                         0x1c
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7__SHIFT                                         0x1e
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT0_STATE_MASK                                           0x00000003L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL0_MASK                                           0x00000004L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT1_STATE_MASK                                           0x00000030L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL1_MASK                                           0x00000040L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT2_STATE_MASK                                           0x00000300L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL2_MASK                                           0x00000400L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT3_STATE_MASK                                           0x00003000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL3_MASK                                           0x00004000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT4_STATE_MASK                                           0x00030000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL4_MASK                                           0x00040000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT5_STATE_MASK                                           0x00300000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL5_MASK                                           0x00400000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT6_STATE_MASK                                           0x03000000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL6_MASK                                           0x04000000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_CNT7_STATE_MASK                                           0x30000000L
+#define DC_PERFMON18_PERFCOUNTER_STATE__PERFCOUNTER_STATE_SEL7_MASK                                           0x40000000L
+//DC_PERFMON18_PERFMON_CNTL
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_STATE__SHIFT                                                       0x0
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_RPT_COUNT__SHIFT                                                   0x8
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR__SHIFT                                               0x1c
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN__SHIFT                                               0x1d
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS__SHIFT                                           0x1e
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK__SHIFT                                              0x1f
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_STATE_MASK                                                         0x00000003L
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_RPT_COUNT_MASK                                                     0x0FFFFF00L
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_AND_OR_MASK                                                 0x10000000L
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_EN_MASK                                                 0x20000000L
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_STATUS_MASK                                             0x40000000L
+#define DC_PERFMON18_PERFMON_CNTL__PERFMON_CNTOFF_INT_ACK_MASK                                                0x80000000L
+//DC_PERFMON18_PERFMON_CNTL2
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE__SHIFT                                            0x0
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_CLK_ENABLE__SHIFT                                                 0x1
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL__SHIFT                                       0x2
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL__SHIFT                                        0xa
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_CNTOFF_INT_TYPE_MASK                                              0x00000001L
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_CLK_ENABLE_MASK                                                   0x00000002L
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_RUN_ENABLE_START_SEL_MASK                                         0x000003FCL
+#define DC_PERFMON18_PERFMON_CNTL2__PERFMON_RUN_ENABLE_STOP_SEL_MASK                                          0x0003FC00L
+//DC_PERFMON18_PERFMON_CVALUE_INT_MISC
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS__SHIFT                                  0x0
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS__SHIFT                                  0x1
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS__SHIFT                                  0x2
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS__SHIFT                                  0x3
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS__SHIFT                                  0x4
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS__SHIFT                                  0x5
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS__SHIFT                                  0x6
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS__SHIFT                                  0x7
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK__SHIFT                                     0x8
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK__SHIFT                                     0x9
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK__SHIFT                                     0xa
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK__SHIFT                                     0xb
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK__SHIFT                                     0xc
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK__SHIFT                                     0xd
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK__SHIFT                                     0xe
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK__SHIFT                                     0xf
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI__SHIFT                                        0x10
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_STATUS_MASK                                    0x00000001L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_STATUS_MASK                                    0x00000002L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_STATUS_MASK                                    0x00000004L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_STATUS_MASK                                    0x00000008L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_STATUS_MASK                                    0x00000010L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_STATUS_MASK                                    0x00000020L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_STATUS_MASK                                    0x00000040L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_STATUS_MASK                                    0x00000080L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT0_ACK_MASK                                       0x00000100L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT1_ACK_MASK                                       0x00000200L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT2_ACK_MASK                                       0x00000400L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT3_ACK_MASK                                       0x00000800L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT4_ACK_MASK                                       0x00001000L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT5_ACK_MASK                                       0x00002000L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT6_ACK_MASK                                       0x00004000L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFCOUNTER_INT7_ACK_MASK                                       0x00008000L
+#define DC_PERFMON18_PERFMON_CVALUE_INT_MISC__PERFMON_CVALUE_HI_MASK                                          0xFFFF0000L
+//DC_PERFMON18_PERFMON_CVALUE_LOW
+#define DC_PERFMON18_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW__SHIFT                                            0x0
+#define DC_PERFMON18_PERFMON_CVALUE_LOW__PERFMON_CVALUE_LOW_MASK                                              0xFFFFFFFFL
+//DC_PERFMON18_PERFMON_HI
+#define DC_PERFMON18_PERFMON_HI__PERFMON_HI__SHIFT                                                            0x0
+#define DC_PERFMON18_PERFMON_HI__PERFMON_READ_SEL__SHIFT                                                      0x1d
+#define DC_PERFMON18_PERFMON_HI__PERFMON_HI_MASK                                                              0x0000FFFFL
+#define DC_PERFMON18_PERFMON_HI__PERFMON_READ_SEL_MASK                                                        0xE0000000L
+//DC_PERFMON18_PERFMON_LOW
+#define DC_PERFMON18_PERFMON_LOW__PERFMON_LOW__SHIFT                                                          0x0
+#define DC_PERFMON18_PERFMON_LOW__PERFMON_LOW_MASK                                                            0xFFFFFFFFL
+//DC_PERFMON18_PERFMON_TEST_DEBUG_INDEX
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX__SHIFT                                0x0
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN__SHIFT                             0x8
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_INDEX_MASK                                  0x000000FFL
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_INDEX__PERFMON_TEST_DEBUG_WRITE_EN_MASK                               0x00000100L
+//DC_PERFMON18_PERFMON_TEST_DEBUG_DATA
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA__SHIFT                                  0x0
+#define DC_PERFMON18_PERFMON_TEST_DEBUG_DATA__PERFMON_TEST_DEBUG_DATA_MASK                                    0xFFFFFFFFL
+
+
+// addressBlock: dce_dc_hpo_hpo_dme_rm_mem0_dme_rm_dispdec
+//DME_RM2_DME_MEMORY_CONTROL
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE__SHIFT                                                  0x0
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS__SHIFT                                                    0x4
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE__SHIFT                                                  0x8
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE_MASK                                                    0x00000003L
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS_MASK                                                      0x00000010L
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE_MASK                                                    0x00000300L
+#define DME_RM2_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//DME_RM2_DME_RM_MEM_CTRL
+#define DME_RM2_DME_RM_MEM_CTRL__DME_SRC_SEL__SHIFT                                                           0x0
+#define DME_RM2_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE__SHIFT                                                      0x3
+#define DME_RM2_DME_RM_MEM_CTRL__DME_MEM_ENABLE__SHIFT                                                        0x5
+#define DME_RM2_DME_RM_MEM_CTRL__DME_SRC_SEL_MASK                                                             0x00000007L
+#define DME_RM2_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE_MASK                                                        0x00000008L
+#define DME_RM2_DME_RM_MEM_CTRL__DME_MEM_ENABLE_MASK                                                          0x00000020L
+
+
+// addressBlock: dce_dc_hpo_hpo_dme_rm_mem1_dme_rm_dispdec
+//DME_RM3_DME_MEMORY_CONTROL
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE__SHIFT                                                  0x0
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS__SHIFT                                                    0x4
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE__SHIFT                                                  0x8
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                                0xc
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_FORCE_MASK                                                    0x00000003L
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_DIS_MASK                                                      0x00000010L
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_PWR_STATE_MASK                                                    0x00000300L
+#define DME_RM3_DME_MEMORY_CONTROL__DME_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                                  0x00003000L
+//DME_RM3_DME_RM_MEM_CTRL
+#define DME_RM3_DME_RM_MEM_CTRL__DME_SRC_SEL__SHIFT                                                           0x0
+#define DME_RM3_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE__SHIFT                                                      0x3
+#define DME_RM3_DME_RM_MEM_CTRL__DME_MEM_ENABLE__SHIFT                                                        0x5
+#define DME_RM3_DME_RM_MEM_CTRL__DME_SRC_SEL_MASK                                                             0x00000007L
+#define DME_RM3_DME_RM_MEM_CTRL__DME_SRC_ENC_TYPE_MASK                                                        0x00000008L
+#define DME_RM3_DME_RM_MEM_CTRL__DME_MEM_ENABLE_MASK                                                          0x00000020L
+
+
+// addressBlock: dce_dc_hpo_hdmi_link_enc0_dispdec
+//HDMI_LINK_ENC_CONTROL
+#define HDMI_LINK_ENC_CONTROL__HDMI_LINK_ENC_ENABLE__SHIFT                                                    0x0
+#define HDMI_LINK_ENC_CONTROL__HDMI_LINK_ENC_SOFT_RESET__SHIFT                                                0x4
+#define HDMI_LINK_ENC_CONTROL__HDMI_LINK_ENC_ENABLE_MASK                                                      0x00000001L
+#define HDMI_LINK_ENC_CONTROL__HDMI_LINK_ENC_SOFT_RESET_MASK                                                  0x00000010L
+//HDMI_LINK_ENC_CLK_CTRL
+#define HDMI_LINK_ENC_CLK_CTRL__HDMI_LINK_ENC_CLOCK_EN__SHIFT                                                 0x0
+#define HDMI_LINK_ENC_CLK_CTRL__HDMI_LINK_ENC_CLOCK_ON_HDMICHARCLK__SHIFT                                     0x1
+#define HDMI_LINK_ENC_CLK_CTRL__HDMI_LINK_ENC_CLOCK_EN_MASK                                                   0x00000001L
+#define HDMI_LINK_ENC_CLK_CTRL__HDMI_LINK_ENC_CLOCK_ON_HDMICHARCLK_MASK                                       0x00000002L
+
+
+// addressBlock: dce_dc_hpo_hdmi_frl_enc0_dispdec
+//HDMI_FRL_ENC_CONFIG
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE_COUNT__SHIFT                                                      0x0
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_TRAINING_ENABLE__SHIFT                                                 0x1
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE0_TRAINING_PATTERN__SHIFT                                          0x10
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE1_TRAINING_PATTERN__SHIFT                                          0x14
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE2_TRAINING_PATTERN__SHIFT                                          0x18
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE3_TRAINING_PATTERN__SHIFT                                          0x1c
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE_COUNT_MASK                                                        0x00000001L
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_TRAINING_ENABLE_MASK                                                   0x00000002L
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE0_TRAINING_PATTERN_MASK                                            0x000F0000L
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE1_TRAINING_PATTERN_MASK                                            0x00F00000L
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE2_TRAINING_PATTERN_MASK                                            0x0F000000L
+#define HDMI_FRL_ENC_CONFIG__HDMI_LINK_LANE3_TRAINING_PATTERN_MASK                                            0xF0000000L
+//HDMI_FRL_ENC_CONFIG2
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_MAX_JITTER_VALUE__SHIFT                                               0x0
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_THRESHOLD__SHIFT                                               0xc
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_CAL_EN__SHIFT                                                  0x18
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_RC_COMPRESS_DISABLE__SHIFT                                            0x19
+#define HDMI_FRL_ENC_CONFIG2__HDMI_FRL_HDMISTREAMCLK_DB_SEL__SHIFT                                            0x1a
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_MAX_JITTER_VALUE_RESET__SHIFT                                         0x1c
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_EXCEED_STATUS__SHIFT                                           0x1d
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_METER_BUFFER_OVERFLOW_STATUS__SHIFT                                   0x1e
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_MAX_JITTER_VALUE_MASK                                                 0x000001FFL
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_THRESHOLD_MASK                                                 0x001FF000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_CAL_EN_MASK                                                    0x01000000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_RC_COMPRESS_DISABLE_MASK                                              0x02000000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_FRL_HDMISTREAMCLK_DB_SEL_MASK                                              0x0C000000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_MAX_JITTER_VALUE_RESET_MASK                                           0x10000000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_JITTER_EXCEED_STATUS_MASK                                             0x20000000L
+#define HDMI_FRL_ENC_CONFIG2__HDMI_LINK_METER_BUFFER_OVERFLOW_STATUS_MASK                                     0x40000000L
+//HDMI_FRL_ENC_METER_BUFFER_STATUS
+#define HDMI_FRL_ENC_METER_BUFFER_STATUS__HDMI_LINK_MAX_METER_BUFFER_LEVEL__SHIFT                             0x0
+#define HDMI_FRL_ENC_METER_BUFFER_STATUS__HDMI_LINK_METER_BUFFER_MAX_LEVEL_RESET__SHIFT                       0x1f
+#define HDMI_FRL_ENC_METER_BUFFER_STATUS__HDMI_LINK_MAX_METER_BUFFER_LEVEL_MASK                               0x0000007FL
+#define HDMI_FRL_ENC_METER_BUFFER_STATUS__HDMI_LINK_METER_BUFFER_MAX_LEVEL_RESET_MASK                         0x80000000L
+//HDMI_FRL_ENC_MEM_CTRL
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_DIS__SHIFT                                                 0x0
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_FORCE__SHIFT                                               0x1
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_STATE__SHIFT                                               0x4
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                             0x8
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_DIS_MASK                                                   0x00000001L
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_FORCE_MASK                                                 0x00000006L
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_PWR_STATE_MASK                                                 0x00000030L
+#define HDMI_FRL_ENC_MEM_CTRL__METERBUFFER_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                               0x00000300L
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_dispdec
+//HDMI_STREAM_ENC_CLOCK_CONTROL
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_EN__SHIFT                                        0x0
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_ON_DISPCLK__SHIFT                                0x4
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_ON_SOCCLK__SHIFT                             0x9
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_ON_HDMISTREAMCLK__SHIFT                          0xc
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_ON_HDMISTREAMCLK__SHIFT                      0xd
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_EN_MASK                                          0x00000001L
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_ON_DISPCLK_MASK                                  0x00000010L
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_ON_SOCCLK_MASK                               0x00000200L
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_CLOCK_ON_HDMISTREAMCLK_MASK                            0x00001000L
+#define HDMI_STREAM_ENC_CLOCK_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_ON_HDMISTREAMCLK_MASK                        0x00002000L
+//HDMI_STREAM_ENC_INPUT_MUX_CONTROL
+#define HDMI_STREAM_ENC_INPUT_MUX_CONTROL__HDMI_STREAM_ENC_INPUT_MUX_SOURCE_SEL__SHIFT                        0x0
+#define HDMI_STREAM_ENC_INPUT_MUX_CONTROL__HDMI_STREAM_ENC_INPUT_MUX_SOURCE_SEL_MASK                          0x00000007L
+//HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE__SHIFT                          0x0
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET__SHIFT                           0x4
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_PIXEL_ENCODING_TYPE__SHIFT             0x8
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_UNCOMPRESSED_PIXEL_FORMAT__SHIFT       0xc
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_COMPRESSED_PIXEL_FORMAT__SHIFT         0x10
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE__SHIFT                      0x14
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE__SHIFT             0x18
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR__SHIFT                           0x1c
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE_MASK                            0x00000001L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_MASK                             0x00000010L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_PIXEL_ENCODING_TYPE_MASK               0x00000100L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_UNCOMPRESSED_PIXEL_FORMAT_MASK         0x00001000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_COMPRESSED_PIXEL_FORMAT_MASK           0x00010000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE_MASK                        0x00100000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE_MASK               0x01000000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR_MASK                             0x30000000L
+//HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL__SHIFT             0x0
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE__SHIFT             0x1
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX__SHIFT             0x2
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL__SHIFT                 0x4
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY__SHIFT                 0xa
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL__SHIFT                   0xc
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL__SHIFT                   0x10
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL__SHIFT               0x18
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED__SHIFT                      0x1f
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL_MASK               0x00000001L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE_MASK               0x00000002L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX_MASK               0x00000004L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL_MASK                   0x000003F0L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY_MASK                   0x00000C00L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL_MASK                     0x0000F000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL_MASK                     0x001F0000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL_MASK                 0x3F000000L
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED_MASK                        0x80000000L
+//HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2__FIFO_READ_START_LEVEL__SHIFT                0x0
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2__FIFO_READ_CLOCK_SRC__SHIFT                  0x6
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2__FIFO_READ_START_LEVEL_MASK                  0x0000003FL
+#define HDMI_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL2__FIFO_READ_CLOCK_SRC_MASK                    0x00000040L
+//HDMI_STREAM_ENC_AUDIO_CONTROL
+#define HDMI_STREAM_ENC_AUDIO_CONTROL__HDMI_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT               0x0
+#define HDMI_STREAM_ENC_AUDIO_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_EN__SHIFT                                    0x8
+#define HDMI_STREAM_ENC_AUDIO_CONTROL__HDMI_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK                 0x00000007L
+#define HDMI_STREAM_ENC_AUDIO_CONTROL__HDMI_STREAM_ENC_APG_CLOCK_EN_MASK                                      0x00000100L
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_apg_apg_dispdec
+//APG4_APG_CONTROL
+#define APG4_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG4_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG4_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG4_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG4_APG_CONTROL2
+#define APG4_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG4_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG4_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG4_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG4_APG_DBG_GEN_CONTROL
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG4_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG4_APG_PACKET_CONTROL
+#define APG4_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG4_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG4_APG_DBG_60958_0
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG4_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG4_APG_DBG_60958_1
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG4_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG4_APG_DBG_60958_2
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG4_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG4_APG_MEM_PWR
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG4_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG4_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG4_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_dme_dme_dispdec
+//DME4_DME_CONTROL
+#define DME4_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME4_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME4_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME4_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME4_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME4_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME4_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME4_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME4_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME4_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME4_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME4_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME4_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME4_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME4_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME4_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME4_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME4_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME4_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME4_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_hpo_hdmi_stream_enc0_vpg_vpg_dispdec
+//VPG4_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG4_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG4_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG4_VPG_GENERIC_PACKET_DATA
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG4_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG4_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG4_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG4_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG4_VPG_GENERIC_STATUS
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG4_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG4_VPG_MEM_PWR
+#define VPG4_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG4_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG4_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG4_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG4_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG4_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG4_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG4_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG4_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG4_VPG_ISRC1_2_DATA
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG4_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_hpo_hdmi_tb_enc0_dispdec
+//HDMI_TB_ENC_CONTROL
+#define HDMI_TB_ENC_CONTROL__HDMI_TB_ENC_EN__SHIFT                                                            0x0
+#define HDMI_TB_ENC_CONTROL__HDMI_RESET__SHIFT                                                                0x4
+#define HDMI_TB_ENC_CONTROL__HDMI_RESET_DONE__SHIFT                                                           0x8
+#define HDMI_TB_ENC_CONTROL__HDMI_TB_ENC_EN_MASK                                                              0x00000001L
+#define HDMI_TB_ENC_CONTROL__HDMI_RESET_MASK                                                                  0x00000010L
+#define HDMI_TB_ENC_CONTROL__HDMI_RESET_DONE_MASK                                                             0x00000100L
+//HDMI_TB_ENC_PIXEL_FORMAT
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DEEP_COLOR_ENABLE__SHIFT                                               0x0
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DEEP_COLOR_DEPTH__SHIFT                                                0x8
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_PIXEL_ENCODING__SHIFT                                                  0x10
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DSC_MODE__SHIFT                                                        0x18
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DEEP_COLOR_ENABLE_MASK                                                 0x00000001L
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DEEP_COLOR_DEPTH_MASK                                                  0x00000300L
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_PIXEL_ENCODING_MASK                                                    0x00030000L
+#define HDMI_TB_ENC_PIXEL_FORMAT__HDMI_DSC_MODE_MASK                                                          0x03000000L
+//HDMI_TB_ENC_PACKET_CONTROL
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_MAX_PACKETS_PER_LINE__SHIFT                                          0x0
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_MAX_ISLANDS_PER_LINE__SHIFT                                          0x8
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_OVERFLOW__SHIFT                                        0xc
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_TB_ENC_PACKET_ERROR_CLEAR__SHIFT                                     0x10
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_MAX_PACKETS_PER_LINE_MASK                                            0x0000001FL
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_MAX_ISLANDS_PER_LINE_MASK                                            0x00000300L
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_OVERFLOW_MASK                                          0x00001000L
+#define HDMI_TB_ENC_PACKET_CONTROL__HDMI_TB_ENC_PACKET_ERROR_CLEAR_MASK                                       0x00010000L
+//HDMI_TB_ENC_ACR_PACKET_CONTROL
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SEND__SHIFT                                                  0x0
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_CONT__SHIFT                                                  0x1
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SELECT__SHIFT                                                0x4
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE__SHIFT                                                0x8
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND__SHIFT                                             0xc
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE__SHIFT                                            0x10
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_AUDIO_PRIORITY__SHIFT                                        0x1f
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SEND_MASK                                                    0x00000001L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_CONT_MASK                                                    0x00000002L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SELECT_MASK                                                  0x00000030L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_SOURCE_MASK                                                  0x00000100L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_AUTO_SEND_MASK                                               0x00001000L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_N_MULTIPLE_MASK                                              0x00070000L
+#define HDMI_TB_ENC_ACR_PACKET_CONTROL__HDMI_ACR_AUDIO_PRIORITY_MASK                                          0x80000000L
+//HDMI_TB_ENC_VBI_PACKET_CONTROL1
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_GC_SEND__SHIFT                                                  0x0
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_GC_CONT__SHIFT                                                  0x1
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_SEND__SHIFT                                                0x4
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_CONT__SHIFT                                                0x5
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_LINE_REFERENCE__SHIFT                                      0x6
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ACP_SEND__SHIFT                                                 0x8
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ACP_LINE_REFERENCE__SHIFT                                       0x9
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_SEND__SHIFT                                          0xc
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_LINE_REFERENCE__SHIFT                                0xe
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_LINE__SHIFT                                          0x10
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_GC_SEND_MASK                                                    0x00000001L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_GC_CONT_MASK                                                    0x00000002L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_SEND_MASK                                                  0x00000010L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_CONT_MASK                                                  0x00000020L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ISRC_LINE_REFERENCE_MASK                                        0x00000040L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ACP_SEND_MASK                                                   0x00000100L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_ACP_LINE_REFERENCE_MASK                                         0x00000200L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_SEND_MASK                                            0x00001000L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_LINE_REFERENCE_MASK                                  0x00004000L
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL1__HDMI_AUDIO_INFO_LINE_MASK                                            0x7FFF0000L
+//HDMI_TB_ENC_VBI_PACKET_CONTROL2
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL2__HDMI_ISRC_LINE__SHIFT                                                0x0
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL2__HDMI_ACP_LINE__SHIFT                                                 0x10
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL2__HDMI_ISRC_LINE_MASK                                                  0x00007FFFL
+#define HDMI_TB_ENC_VBI_PACKET_CONTROL2__HDMI_ACP_LINE_MASK                                                   0x7FFF0000L
+//HDMI_TB_ENC_GC_CONTROL
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_GC_AVMUTE__SHIFT                                                         0x0
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_GC_AVMUTE_CONT__SHIFT                                                    0x2
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_DEFAULT_PHASE__SHIFT                                                     0x4
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_ACTIVE_AVMUTE__SHIFT                                                     0x8
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_GC_AVMUTE_MASK                                                           0x00000001L
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_GC_AVMUTE_CONT_MASK                                                      0x00000004L
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_DEFAULT_PHASE_MASK                                                       0x00000010L
+#define HDMI_TB_ENC_GC_CONTROL__HDMI_ACTIVE_AVMUTE_MASK                                                       0x00000100L
+//HDMI_TB_ENC_GENERIC_PACKET_CONTROL0
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND__SHIFT                                        0x0
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT__SHIFT                                        0x1
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LOCK_EN__SHIFT                                     0x2
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE__SHIFT                              0x3
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND__SHIFT                                        0x4
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT__SHIFT                                        0x5
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LOCK_EN__SHIFT                                     0x6
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE__SHIFT                              0x7
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND__SHIFT                                        0x8
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT__SHIFT                                        0x9
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LOCK_EN__SHIFT                                     0xa
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE__SHIFT                              0xb
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND__SHIFT                                        0xc
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT__SHIFT                                        0xd
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LOCK_EN__SHIFT                                     0xe
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE__SHIFT                              0xf
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND__SHIFT                                        0x10
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT__SHIFT                                        0x11
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LOCK_EN__SHIFT                                     0x12
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE__SHIFT                              0x13
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND__SHIFT                                        0x14
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT__SHIFT                                        0x15
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LOCK_EN__SHIFT                                     0x16
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE__SHIFT                              0x17
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND__SHIFT                                        0x18
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT__SHIFT                                        0x19
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LOCK_EN__SHIFT                                     0x1a
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE__SHIFT                              0x1b
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND__SHIFT                                        0x1c
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT__SHIFT                                        0x1d
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LOCK_EN__SHIFT                                     0x1e
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE__SHIFT                              0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_SEND_MASK                                          0x00000001L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_CONT_MASK                                          0x00000002L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LOCK_EN_MASK                                       0x00000004L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC0_LINE_REFERENCE_MASK                                0x00000008L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_SEND_MASK                                          0x00000010L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_CONT_MASK                                          0x00000020L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LOCK_EN_MASK                                       0x00000040L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC1_LINE_REFERENCE_MASK                                0x00000080L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_SEND_MASK                                          0x00000100L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_CONT_MASK                                          0x00000200L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LOCK_EN_MASK                                       0x00000400L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC2_LINE_REFERENCE_MASK                                0x00000800L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_SEND_MASK                                          0x00001000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_CONT_MASK                                          0x00002000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LOCK_EN_MASK                                       0x00004000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC3_LINE_REFERENCE_MASK                                0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_SEND_MASK                                          0x00010000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_CONT_MASK                                          0x00020000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LOCK_EN_MASK                                       0x00040000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC4_LINE_REFERENCE_MASK                                0x00080000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_SEND_MASK                                          0x00100000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_CONT_MASK                                          0x00200000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LOCK_EN_MASK                                       0x00400000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC5_LINE_REFERENCE_MASK                                0x00800000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_SEND_MASK                                          0x01000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_CONT_MASK                                          0x02000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LOCK_EN_MASK                                       0x04000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC6_LINE_REFERENCE_MASK                                0x08000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_SEND_MASK                                          0x10000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_CONT_MASK                                          0x20000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LOCK_EN_MASK                                       0x40000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL0__HDMI_GENERIC7_LINE_REFERENCE_MASK                                0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET_CONTROL1
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_SEND__SHIFT                                        0x0
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_CONT__SHIFT                                        0x1
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_LOCK_EN__SHIFT                                     0x2
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_LINE_REFERENCE__SHIFT                              0x3
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_SEND__SHIFT                                        0x4
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_CONT__SHIFT                                        0x5
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_LOCK_EN__SHIFT                                     0x6
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_LINE_REFERENCE__SHIFT                              0x7
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_SEND__SHIFT                                       0x8
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_CONT__SHIFT                                       0x9
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_LOCK_EN__SHIFT                                    0xa
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_LINE_REFERENCE__SHIFT                             0xb
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_SEND__SHIFT                                       0xc
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_CONT__SHIFT                                       0xd
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_LOCK_EN__SHIFT                                    0xe
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_LINE_REFERENCE__SHIFT                             0xf
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_SEND__SHIFT                                       0x10
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_CONT__SHIFT                                       0x11
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_LOCK_EN__SHIFT                                    0x12
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_LINE_REFERENCE__SHIFT                             0x13
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_SEND__SHIFT                                       0x14
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_CONT__SHIFT                                       0x15
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_LOCK_EN__SHIFT                                    0x16
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_LINE_REFERENCE__SHIFT                             0x17
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_SEND__SHIFT                                       0x18
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_CONT__SHIFT                                       0x19
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_LOCK_EN__SHIFT                                    0x1a
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_LINE_REFERENCE__SHIFT                             0x1b
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_SEND_MASK                                          0x00000001L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_CONT_MASK                                          0x00000002L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_LOCK_EN_MASK                                       0x00000004L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC8_LINE_REFERENCE_MASK                                0x00000008L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_SEND_MASK                                          0x00000010L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_CONT_MASK                                          0x00000020L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_LOCK_EN_MASK                                       0x00000040L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC9_LINE_REFERENCE_MASK                                0x00000080L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_SEND_MASK                                         0x00000100L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_CONT_MASK                                         0x00000200L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_LOCK_EN_MASK                                      0x00000400L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC10_LINE_REFERENCE_MASK                               0x00000800L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_SEND_MASK                                         0x00001000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_CONT_MASK                                         0x00002000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_LOCK_EN_MASK                                      0x00004000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC11_LINE_REFERENCE_MASK                               0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_SEND_MASK                                         0x00010000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_CONT_MASK                                         0x00020000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_LOCK_EN_MASK                                      0x00040000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC12_LINE_REFERENCE_MASK                               0x00080000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_SEND_MASK                                         0x00100000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_CONT_MASK                                         0x00200000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_LOCK_EN_MASK                                      0x00400000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC13_LINE_REFERENCE_MASK                               0x00800000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_SEND_MASK                                         0x01000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_CONT_MASK                                         0x02000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_LOCK_EN_MASK                                      0x04000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL1__HDMI_GENERIC14_LINE_REFERENCE_MASK                               0x08000000L
+//HDMI_TB_ENC_GENERIC_PACKET_CONTROL2
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC0_IMMEDIATE_SEND__SHIFT                              0x0
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING__SHIFT                      0x1
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC1_IMMEDIATE_SEND__SHIFT                              0x2
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING__SHIFT                      0x3
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_IMMEDIATE_SEND__SHIFT                              0x4
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING__SHIFT                      0x5
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_IMMEDIATE_SEND__SHIFT                              0x6
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING__SHIFT                      0x7
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC4_IMMEDIATE_SEND__SHIFT                              0x8
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING__SHIFT                      0x9
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC5_IMMEDIATE_SEND__SHIFT                              0xa
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING__SHIFT                      0xb
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC6_IMMEDIATE_SEND__SHIFT                              0xc
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING__SHIFT                      0xd
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC7_IMMEDIATE_SEND__SHIFT                              0xe
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING__SHIFT                      0xf
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC8_IMMEDIATE_SEND__SHIFT                              0x10
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING__SHIFT                      0x11
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC9_IMMEDIATE_SEND__SHIFT                              0x12
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING__SHIFT                      0x13
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC10_IMMEDIATE_SEND__SHIFT                             0x14
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING__SHIFT                     0x15
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC11_IMMEDIATE_SEND__SHIFT                             0x16
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING__SHIFT                     0x17
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC12_IMMEDIATE_SEND__SHIFT                             0x18
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING__SHIFT                     0x19
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC13_IMMEDIATE_SEND__SHIFT                             0x1a
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING__SHIFT                     0x1b
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC14_IMMEDIATE_SEND__SHIFT                             0x1c
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING__SHIFT                     0x1d
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC0_IMMEDIATE_SEND_MASK                                0x00000001L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC0_IMMEDIATE_SEND_PENDING_MASK                        0x00000002L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC1_IMMEDIATE_SEND_MASK                                0x00000004L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC1_IMMEDIATE_SEND_PENDING_MASK                        0x00000008L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_IMMEDIATE_SEND_MASK                                0x00000010L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC2_IMMEDIATE_SEND_PENDING_MASK                        0x00000020L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_IMMEDIATE_SEND_MASK                                0x00000040L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC3_IMMEDIATE_SEND_PENDING_MASK                        0x00000080L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC4_IMMEDIATE_SEND_MASK                                0x00000100L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC4_IMMEDIATE_SEND_PENDING_MASK                        0x00000200L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC5_IMMEDIATE_SEND_MASK                                0x00000400L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC5_IMMEDIATE_SEND_PENDING_MASK                        0x00000800L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC6_IMMEDIATE_SEND_MASK                                0x00001000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC6_IMMEDIATE_SEND_PENDING_MASK                        0x00002000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC7_IMMEDIATE_SEND_MASK                                0x00004000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC7_IMMEDIATE_SEND_PENDING_MASK                        0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC8_IMMEDIATE_SEND_MASK                                0x00010000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC8_IMMEDIATE_SEND_PENDING_MASK                        0x00020000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC9_IMMEDIATE_SEND_MASK                                0x00040000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC9_IMMEDIATE_SEND_PENDING_MASK                        0x00080000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC10_IMMEDIATE_SEND_MASK                               0x00100000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC10_IMMEDIATE_SEND_PENDING_MASK                       0x00200000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC11_IMMEDIATE_SEND_MASK                               0x00400000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC11_IMMEDIATE_SEND_PENDING_MASK                       0x00800000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC12_IMMEDIATE_SEND_MASK                               0x01000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC12_IMMEDIATE_SEND_PENDING_MASK                       0x02000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC13_IMMEDIATE_SEND_MASK                               0x04000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC13_IMMEDIATE_SEND_PENDING_MASK                       0x08000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC14_IMMEDIATE_SEND_MASK                               0x10000000L
+#define HDMI_TB_ENC_GENERIC_PACKET_CONTROL2__HDMI_GENERIC14_IMMEDIATE_SEND_PENDING_MASK                       0x20000000L
+//HDMI_TB_ENC_GENERIC_PACKET0_1_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC0_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC0_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC1_LINE__SHIFT                                         0x10
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC1_EMP__SHIFT                                          0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC0_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC0_EMP_MASK                                            0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC1_LINE_MASK                                           0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET0_1_LINE__HDMI_GENERIC1_EMP_MASK                                            0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET2_3_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC2_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC2_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC3_LINE__SHIFT                                         0x10
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC3_EMP__SHIFT                                          0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC2_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC2_EMP_MASK                                            0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC3_LINE_MASK                                           0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET2_3_LINE__HDMI_GENERIC3_EMP_MASK                                            0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET4_5_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC4_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC4_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC5_LINE__SHIFT                                         0x10
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC5_EMP__SHIFT                                          0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC4_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC4_EMP_MASK                                            0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC5_LINE_MASK                                           0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET4_5_LINE__HDMI_GENERIC5_EMP_MASK                                            0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET6_7_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC6_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC6_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC7_LINE__SHIFT                                         0x10
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC7_EMP__SHIFT                                          0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC6_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC6_EMP_MASK                                            0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC7_LINE_MASK                                           0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET6_7_LINE__HDMI_GENERIC7_EMP_MASK                                            0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET8_9_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC8_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC8_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC9_LINE__SHIFT                                         0x10
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC9_EMP__SHIFT                                          0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC8_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC8_EMP_MASK                                            0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC9_LINE_MASK                                           0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET8_9_LINE__HDMI_GENERIC9_EMP_MASK                                            0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET10_11_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC10_LINE__SHIFT                                      0x0
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC10_EMP__SHIFT                                       0xf
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC11_LINE__SHIFT                                      0x10
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC11_EMP__SHIFT                                       0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC10_LINE_MASK                                        0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC10_EMP_MASK                                         0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC11_LINE_MASK                                        0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET10_11_LINE__HDMI_GENERIC11_EMP_MASK                                         0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET12_13_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC12_LINE__SHIFT                                      0x0
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC12_EMP__SHIFT                                       0xf
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC13_LINE__SHIFT                                      0x10
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC13_EMP__SHIFT                                       0x1f
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC12_LINE_MASK                                        0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC12_EMP_MASK                                         0x00008000L
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC13_LINE_MASK                                        0x7FFF0000L
+#define HDMI_TB_ENC_GENERIC_PACKET12_13_LINE__HDMI_GENERIC13_EMP_MASK                                         0x80000000L
+//HDMI_TB_ENC_GENERIC_PACKET14_LINE
+#define HDMI_TB_ENC_GENERIC_PACKET14_LINE__HDMI_GENERIC14_LINE__SHIFT                                         0x0
+#define HDMI_TB_ENC_GENERIC_PACKET14_LINE__HDMI_GENERIC14_EMP__SHIFT                                          0xf
+#define HDMI_TB_ENC_GENERIC_PACKET14_LINE__HDMI_GENERIC14_LINE_MASK                                           0x00007FFFL
+#define HDMI_TB_ENC_GENERIC_PACKET14_LINE__HDMI_GENERIC14_EMP_MASK                                            0x00008000L
+//HDMI_TB_ENC_DB_CONTROL
+#define HDMI_TB_ENC_DB_CONTROL__HDMI_DB_PENDING__SHIFT                                                        0x0
+#define HDMI_TB_ENC_DB_CONTROL__HDMI_DB_DISABLE__SHIFT                                                        0xc
+#define HDMI_TB_ENC_DB_CONTROL__VUPDATE_DB_PENDING__SHIFT                                                     0xf
+#define HDMI_TB_ENC_DB_CONTROL__HDMI_DB_PENDING_MASK                                                          0x00000001L
+#define HDMI_TB_ENC_DB_CONTROL__HDMI_DB_DISABLE_MASK                                                          0x00001000L
+#define HDMI_TB_ENC_DB_CONTROL__VUPDATE_DB_PENDING_MASK                                                       0x00008000L
+//HDMI_TB_ENC_ACR_32_0
+#define HDMI_TB_ENC_ACR_32_0__HDMI_ACR_CTS_32__SHIFT                                                          0xc
+#define HDMI_TB_ENC_ACR_32_0__HDMI_ACR_CTS_32_MASK                                                            0xFFFFF000L
+//HDMI_TB_ENC_ACR_32_1
+#define HDMI_TB_ENC_ACR_32_1__HDMI_ACR_N_32__SHIFT                                                            0x0
+#define HDMI_TB_ENC_ACR_32_1__HDMI_ACR_N_32_MASK                                                              0x000FFFFFL
+//HDMI_TB_ENC_ACR_44_0
+#define HDMI_TB_ENC_ACR_44_0__HDMI_ACR_CTS_44__SHIFT                                                          0xc
+#define HDMI_TB_ENC_ACR_44_0__HDMI_ACR_CTS_44_MASK                                                            0xFFFFF000L
+//HDMI_TB_ENC_ACR_44_1
+#define HDMI_TB_ENC_ACR_44_1__HDMI_ACR_N_44__SHIFT                                                            0x0
+#define HDMI_TB_ENC_ACR_44_1__HDMI_ACR_N_44_MASK                                                              0x000FFFFFL
+//HDMI_TB_ENC_ACR_48_0
+#define HDMI_TB_ENC_ACR_48_0__HDMI_ACR_CTS_48__SHIFT                                                          0xc
+#define HDMI_TB_ENC_ACR_48_0__HDMI_ACR_CTS_48_MASK                                                            0xFFFFF000L
+//HDMI_TB_ENC_ACR_48_1
+#define HDMI_TB_ENC_ACR_48_1__HDMI_ACR_N_48__SHIFT                                                            0x0
+#define HDMI_TB_ENC_ACR_48_1__HDMI_ACR_N_48_MASK                                                              0x000FFFFFL
+//HDMI_TB_ENC_ACR_STATUS_0
+#define HDMI_TB_ENC_ACR_STATUS_0__HDMI_ACR_CTS__SHIFT                                                         0xc
+#define HDMI_TB_ENC_ACR_STATUS_0__HDMI_ACR_CTS_MASK                                                           0xFFFFF000L
+//HDMI_TB_ENC_ACR_STATUS_1
+#define HDMI_TB_ENC_ACR_STATUS_1__HDMI_ACR_N__SHIFT                                                           0x0
+#define HDMI_TB_ENC_ACR_STATUS_1__HDMI_ACR_N_MASK                                                             0x000FFFFFL
+//HDMI_TB_ENC_BUFFER_CONTROL
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_PREFILL_OVERRIDE_EN__SHIFT                              0x0
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_RATE_BUFFER_PREFILL_OVERRIDE_EN__SHIFT                               0x1
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_MAX_MIN_LEVEL_RESET__SHIFT                              0x4
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_PREFILL_OVERRIDE_LEVEL__SHIFT                           0x8
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_RATE_BUFFER_PREFILL_OVERRIDE_LEVEL__SHIFT                            0x18
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_PREFILL_OVERRIDE_EN_MASK                                0x00000001L
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_RATE_BUFFER_PREFILL_OVERRIDE_EN_MASK                                 0x00000002L
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_MAX_MIN_LEVEL_RESET_MASK                                0x00000010L
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_BORROWBUFFER_PREFILL_OVERRIDE_LEVEL_MASK                             0x0000FF00L
+#define HDMI_TB_ENC_BUFFER_CONTROL__HDMI_RATE_BUFFER_PREFILL_OVERRIDE_LEVEL_MASK                              0x1F000000L
+//HDMI_TB_ENC_MEM_CTRL
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_DIS__SHIFT                                                 0x0
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_FORCE__SHIFT                                               0x1
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_STATE__SHIFT                                               0x4
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_DEFAULT_MEM_LOW_POWER_STATE__SHIFT                             0x8
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_DIS_MASK                                                   0x00000001L
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_FORCE_MASK                                                 0x00000006L
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_PWR_STATE_MASK                                                 0x00000030L
+#define HDMI_TB_ENC_MEM_CTRL__BORROWBUFFER_MEM_DEFAULT_MEM_LOW_POWER_STATE_MASK                               0x00000300L
+//HDMI_TB_ENC_METADATA_PACKET_CONTROL
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE__SHIFT                               0x0
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE__SHIFT                       0x4
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED__SHIFT                               0x8
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE__SHIFT                                 0x10
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_ENABLE_MASK                                 0x00000001L
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_REFERENCE_MASK                         0x00000010L
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_MISSED_MASK                                 0x00000100L
+#define HDMI_TB_ENC_METADATA_PACKET_CONTROL__HDMI_METADATA_PACKET_LINE_MASK                                   0xFFFF0000L
+//HDMI_TB_ENC_H_ACTIVE_BLANK
+#define HDMI_TB_ENC_H_ACTIVE_BLANK__HDMI_H_ACTIVE__SHIFT                                                      0x0
+#define HDMI_TB_ENC_H_ACTIVE_BLANK__HDMI_H_BLANK__SHIFT                                                       0x10
+#define HDMI_TB_ENC_H_ACTIVE_BLANK__HDMI_H_ACTIVE_MASK                                                        0x00007FFFL
+#define HDMI_TB_ENC_H_ACTIVE_BLANK__HDMI_H_BLANK_MASK                                                         0x7FFF0000L
+//HDMI_TB_ENC_HC_ACTIVE_BLANK
+#define HDMI_TB_ENC_HC_ACTIVE_BLANK__HDMI_HC_ACTIVE__SHIFT                                                    0x0
+#define HDMI_TB_ENC_HC_ACTIVE_BLANK__HDMI_HC_BLANK__SHIFT                                                     0x10
+#define HDMI_TB_ENC_HC_ACTIVE_BLANK__HDMI_HC_ACTIVE_MASK                                                      0x00007FFFL
+#define HDMI_TB_ENC_HC_ACTIVE_BLANK__HDMI_HC_BLANK_MASK                                                       0x7FFF0000L
+//HDMI_TB_ENC_CRC_CNTL
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_EN__SHIFT                                                              0x0
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_CONT_EN__SHIFT                                                         0x1
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_TYPE__SHIFT                                                            0x8
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_SRC_SEL__SHIFT                                                         0xa
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_INTERLACE_EN__SHIFT                                                    0x10
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_INTERLACE_MODE__SHIFT                                                  0x11
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_EN_MASK                                                                0x00000001L
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_CONT_EN_MASK                                                           0x00000002L
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_TYPE_MASK                                                              0x00000300L
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_SRC_SEL_MASK                                                           0x00000C00L
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_INTERLACE_EN_MASK                                                      0x00010000L
+#define HDMI_TB_ENC_CRC_CNTL__HDMI_CRC_INTERLACE_MODE_MASK                                                    0x00060000L
+//HDMI_TB_ENC_CRC_RESULT_0
+#define HDMI_TB_ENC_CRC_RESULT_0__CRC_TRIBYTE0__SHIFT                                                         0x0
+#define HDMI_TB_ENC_CRC_RESULT_0__CRC_TRIBYTE1__SHIFT                                                         0x10
+#define HDMI_TB_ENC_CRC_RESULT_0__CRC_TRIBYTE0_MASK                                                           0x0000FFFFL
+#define HDMI_TB_ENC_CRC_RESULT_0__CRC_TRIBYTE1_MASK                                                           0xFFFF0000L
+//HDMI_TB_ENC_ENCRYPTION_CONTROL
+#define HDMI_TB_ENC_ENCRYPTION_CONTROL__HDMI_EESS_ENABLE__SHIFT                                               0x0
+#define HDMI_TB_ENC_ENCRYPTION_CONTROL__HDMI_EESS_WHEN_AVMUTE__SHIFT                                          0x4
+#define HDMI_TB_ENC_ENCRYPTION_CONTROL__HDMI_EESS_ENABLE_MASK                                                 0x00000001L
+#define HDMI_TB_ENC_ENCRYPTION_CONTROL__HDMI_EESS_WHEN_AVMUTE_MASK                                            0x00000010L
+//HDMI_TB_ENC_MODE
+#define HDMI_TB_ENC_MODE__HDMI_BORROW_MODE__SHIFT                                                             0x0
+#define HDMI_TB_ENC_MODE__HDMI_SKIP_FIRST_HBLANK__SHIFT                                                       0x8
+#define HDMI_TB_ENC_MODE__HDMI_BORROW_MODE_MASK                                                               0x00000003L
+#define HDMI_TB_ENC_MODE__HDMI_SKIP_FIRST_HBLANK_MASK                                                         0x00000100L
+//HDMI_TB_ENC_INPUT_FIFO_STATUS
+#define HDMI_TB_ENC_INPUT_FIFO_STATUS__INPUT_FIFO_ERROR__SHIFT                                                0x0
+#define HDMI_TB_ENC_INPUT_FIFO_STATUS__INPUT_FIFO_ERROR_MASK                                                  0x00000001L
+//HDMI_TB_ENC_CRC_RESULT_1
+#define HDMI_TB_ENC_CRC_RESULT_1__CRC_TRIBYTE2__SHIFT                                                         0x0
+#define HDMI_TB_ENC_CRC_RESULT_1__CRC_TRIBYTE2_MASK                                                           0x0000FFFFL
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_dispdec
+//DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN__SHIFT                             0x0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK__SHIFT                     0x4
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK__SHIFT                  0x9
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK__SHIFT                 0xc
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32__SHIFT                    0x10
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32__SHIFT                0x11
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN_MASK                               0x00000001L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK_MASK                       0x00000010L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK_MASK                    0x00000200L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK_MASK                   0x00001000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32_MASK                      0x00010000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32_MASK                  0x00020000L
+//DP_STREAM_ENC0_DP_STREAM_ENC_INPUT_MUX_CONTROL
+#define DP_STREAM_ENC0_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL__SHIFT  0x0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL_MASK  0x00000007L
+//DP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL
+#define DP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT    0x0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN__SHIFT                         0x8
+#define DP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK      0x00000007L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN_MASK                           0x00000100L
+//DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE__SHIFT             0x0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET__SHIFT              0x4
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL__SHIFT   0x8
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC__SHIFT     0x10
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE__SHIFT         0x14
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE__SHIFT  0x18
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR__SHIFT              0x1c
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE_MASK               0x00000001L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_MASK                0x00000010L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL_MASK     0x00003F00L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC_MASK       0x00010000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE_MASK           0x00100000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE_MASK  0x01000000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR_MASK                0x30000000L
+//DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL__SHIFT  0x0
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE__SHIFT  0x1
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX__SHIFT  0x2
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL__SHIFT    0x4
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY__SHIFT    0xa
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL__SHIFT      0xc
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL__SHIFT      0x10
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL__SHIFT  0x18
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED__SHIFT         0x1f
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL_MASK  0x00000001L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE_MASK  0x00000002L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX_MASK  0x00000004L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL_MASK      0x000003F0L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY_MASK      0x00000C00L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL_MASK        0x0000F000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL_MASK        0x001F0000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL_MASK    0x3F000000L
+#define DP_STREAM_ENC0_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED_MASK           0x80000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_apg_apg_dispdec
+//APG5_APG_CONTROL
+#define APG5_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG5_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG5_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG5_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG5_APG_CONTROL2
+#define APG5_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG5_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG5_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG5_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG5_APG_DBG_GEN_CONTROL
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG5_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG5_APG_PACKET_CONTROL
+#define APG5_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG5_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG5_APG_DBG_60958_0
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG5_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG5_APG_DBG_60958_1
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG5_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG5_APG_DBG_60958_2
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG5_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG5_APG_MEM_PWR
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG5_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG5_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG5_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_dme_dme_dispdec
+//DME5_DME_CONTROL
+#define DME5_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME5_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME5_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME5_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME5_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME5_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME5_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME5_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME5_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME5_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME5_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME5_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME5_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME5_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME5_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME5_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME5_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME5_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME5_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME5_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc0_vpg_vpg_dispdec
+//VPG5_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG5_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG5_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG5_VPG_GENERIC_PACKET_DATA
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG5_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG5_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG5_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG5_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG5_VPG_GENERIC_STATUS
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG5_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG5_VPG_MEM_PWR
+#define VPG5_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG5_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG5_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG5_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG5_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG5_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG5_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG5_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG5_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG5_VPG_ISRC1_2_DATA
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG5_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc0_dispdec
+//DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE__SHIFT                                        0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET__SHIFT                                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE__SHIFT                                    0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE_MASK                                          0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_MASK                                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE_MASK                                      0x00000100L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE__SHIFT                       0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET__SHIFT                        0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE__SHIFT                   0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS__SHIFT              0xc
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE_MASK                         0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_MASK                          0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE_MASK                     0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS_MASK                0x00001000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE__SHIFT             0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING__SHIFT            0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE_MASK               0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING_MASK              0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING__SHIFT  0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING_MASK  0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                               0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING__SHIFT                       0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                      0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                 0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING_MASK                         0x00000030L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                        0x00000300L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA0__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA0__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA1__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA1__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA2__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA2__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA3__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA3__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA4__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA4__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA5__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA5__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA6
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA6__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA6__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA7__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA7__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA8__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA8__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                           0x0000FFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY__SHIFT                                          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE__SHIFT                                       0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY_MASK                                            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE_MASK                                         0x00000100L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE__SHIFT                                      0x1
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE__SHIFT                                      0x2
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE__SHIFT                                      0x3
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE__SHIFT                                     0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY__SHIFT                                    0x5
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER__SHIFT                              0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE__SHIFT                                      0x1c
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS__SHIFT                               0x1d
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE_MASK                                        0x00000002L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE_MASK                                        0x00000004L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE_MASK                                        0x00000008L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE_MASK                                       0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY_MASK                                      0x00000020L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER_MASK                                0x00003F00L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_MASK                                        0x10000000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS_MASK                                 0x20000000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE__SHIFT                 0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE__SHIFT          0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE__SHIFT          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING__SHIFT  0xc
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER__SHIFT  0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE_MASK                   0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE_MASK            0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE_MASK            0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING_MASK    0x00001000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER_MASK  0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                   0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE__SHIFT                            0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER__SHIFT                       0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                     0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE_MASK                              0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER_MASK                         0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE__SHIFT        0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER__SHIFT          0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE_MASK          0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER_MASK            0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER__SHIFT                        0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS__SHIFT                               0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER_MASK                          0x00000030L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS_MASK                                 0x00000100L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE__SHIFT                                         0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE__SHIFT                               0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE_MASK                                           0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE_MASK                                 0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_STATUS
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT__SHIFT                                       0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT_MASK                                         0x0000FFFFL
+//DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET__SHIFT                                0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET_MASK                                  0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER__SHIFT                                     0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE__SHIFT                                  0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST__SHIFT                                         0x14
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE__SHIFT                                            0x18
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING__SHIFT                                         0x1c
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER_MASK                                       0x0000FFFFL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE_MASK                                    0x00010000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST_MASK                                           0x00100000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE_MASK                                              0x01000000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING_MASK                                           0x10000000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER__SHIFT                                      0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE__SHIFT                                   0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST__SHIFT                                          0x14
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE__SHIFT                                             0x18
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING__SHIFT                                          0x1c
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER_MASK                                        0x0000FFFFL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE_MASK                                     0x00010000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST_MASK                                            0x00100000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE_MASK                                               0x01000000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING_MASK                                            0x10000000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET__SHIFT                                   0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET__SHIFT                                    0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET_MASK                                     0x0000FFFFL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET_MASK                                      0xFFFF0000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_READY_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE__SHIFT                                0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE_MASK                                  0x00000001L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE__SHIFT                                  0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE__SHIFT                            0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER__SHIFT                            0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE_MASK                                    0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE_MASK                              0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER_MASK                              0x0000FF00L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE__SHIFT                                    0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE__SHIFT                            0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME__SHIFT                                          0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE_MASK                                      0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE_MASK                              0x00000010L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME_MASK                                            0x0000FF00L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_START_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE__SHIFT                                     0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE_MASK                                       0x00000001L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER__SHIFT                            0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE__SHIFT                         0x10
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER__SHIFT                           0x14
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE__SHIFT                                 0x1c
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER_MASK                              0x0000FFFFL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE_MASK                           0x00010000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER_MASK                             0x0FF00000L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE_MASK                                   0x10000000L
+//DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED__SHIFT                                0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR__SHIFT                                   0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED_MASK                                  0x00000001L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR_MASK                                     0x00000010L
+//DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE__SHIFT                      0x0
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE__SHIFT                                    0x4
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS__SHIFT                                      0x8
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE__SHIFT                                    0xc
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE_MASK                        0x00000003L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE_MASK                                      0x00000030L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS_MASK                                        0x00000100L
+#define DP_SYM32_ENC0_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE_MASK                                      0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_dispdec
+//DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN__SHIFT                             0x0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK__SHIFT                     0x4
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK__SHIFT                  0x9
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK__SHIFT                 0xc
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32__SHIFT                    0x10
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32__SHIFT                0x11
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN_MASK                               0x00000001L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK_MASK                       0x00000010L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK_MASK                    0x00000200L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK_MASK                   0x00001000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32_MASK                      0x00010000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32_MASK                  0x00020000L
+//DP_STREAM_ENC1_DP_STREAM_ENC_INPUT_MUX_CONTROL
+#define DP_STREAM_ENC1_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL__SHIFT  0x0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL_MASK  0x00000007L
+//DP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL
+#define DP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT    0x0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN__SHIFT                         0x8
+#define DP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK      0x00000007L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN_MASK                           0x00000100L
+//DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE__SHIFT             0x0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET__SHIFT              0x4
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL__SHIFT   0x8
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC__SHIFT     0x10
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE__SHIFT         0x14
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE__SHIFT  0x18
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR__SHIFT              0x1c
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE_MASK               0x00000001L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_MASK                0x00000010L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL_MASK     0x00003F00L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC_MASK       0x00010000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE_MASK           0x00100000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE_MASK  0x01000000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR_MASK                0x30000000L
+//DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL__SHIFT  0x0
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE__SHIFT  0x1
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX__SHIFT  0x2
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL__SHIFT    0x4
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY__SHIFT    0xa
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL__SHIFT      0xc
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL__SHIFT      0x10
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL__SHIFT  0x18
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED__SHIFT         0x1f
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL_MASK  0x00000001L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE_MASK  0x00000002L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX_MASK  0x00000004L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL_MASK      0x000003F0L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY_MASK      0x00000C00L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL_MASK        0x0000F000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL_MASK        0x001F0000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL_MASK    0x3F000000L
+#define DP_STREAM_ENC1_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED_MASK           0x80000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_apg_apg_dispdec
+//APG6_APG_CONTROL
+#define APG6_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG6_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG6_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG6_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG6_APG_CONTROL2
+#define APG6_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG6_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG6_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG6_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG6_APG_DBG_GEN_CONTROL
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG6_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG6_APG_PACKET_CONTROL
+#define APG6_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG6_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG6_APG_DBG_60958_0
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG6_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG6_APG_DBG_60958_1
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG6_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG6_APG_DBG_60958_2
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG6_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG6_APG_MEM_PWR
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG6_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG6_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG6_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_dme_dme_dispdec
+//DME6_DME_CONTROL
+#define DME6_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME6_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME6_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME6_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME6_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME6_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME6_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME6_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME6_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME6_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME6_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME6_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME6_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME6_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME6_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME6_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME6_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME6_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME6_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME6_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc1_vpg_vpg_dispdec
+//VPG6_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG6_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG6_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG6_VPG_GENERIC_PACKET_DATA
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG6_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG6_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG6_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG6_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG6_VPG_GENERIC_STATUS
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG6_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG6_VPG_MEM_PWR
+#define VPG6_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG6_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG6_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG6_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG6_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG6_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG6_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG6_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG6_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG6_VPG_ISRC1_2_DATA
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG6_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc1_dispdec
+//DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE__SHIFT                                        0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET__SHIFT                                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE__SHIFT                                    0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE_MASK                                          0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_MASK                                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE_MASK                                      0x00000100L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE__SHIFT                       0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET__SHIFT                        0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE__SHIFT                   0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS__SHIFT              0xc
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE_MASK                         0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_MASK                          0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE_MASK                     0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS_MASK                0x00001000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE__SHIFT             0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING__SHIFT            0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE_MASK               0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING_MASK              0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING__SHIFT  0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING_MASK  0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                               0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING__SHIFT                       0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                      0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                 0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING_MASK                         0x00000030L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                        0x00000300L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA0__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA0__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA1__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA1__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA2__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA2__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA3__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA3__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA4__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA4__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA5__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA5__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA6
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA6__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA6__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA7__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA7__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA8__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA8__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_HBLANK_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                           0x0000FFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY__SHIFT                                          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE__SHIFT                                       0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY_MASK                                            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE_MASK                                         0x00000100L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE__SHIFT                                      0x1
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE__SHIFT                                      0x2
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE__SHIFT                                      0x3
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE__SHIFT                                     0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY__SHIFT                                    0x5
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER__SHIFT                              0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE__SHIFT                                      0x1c
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS__SHIFT                               0x1d
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE_MASK                                        0x00000002L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE_MASK                                        0x00000004L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE_MASK                                        0x00000008L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE_MASK                                       0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY_MASK                                      0x00000020L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER_MASK                                0x00003F00L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_MASK                                        0x10000000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS_MASK                                 0x20000000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE__SHIFT                 0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE__SHIFT          0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE__SHIFT          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING__SHIFT  0xc
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER__SHIFT  0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE_MASK                   0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE_MASK            0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE_MASK            0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING_MASK    0x00001000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER_MASK  0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                   0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE__SHIFT                            0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER__SHIFT                       0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                     0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE_MASK                              0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER_MASK                         0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE__SHIFT        0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER__SHIFT          0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE_MASK          0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER_MASK            0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER__SHIFT                        0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS__SHIFT                               0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER_MASK                          0x00000030L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS_MASK                                 0x00000100L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE__SHIFT                                         0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE__SHIFT                               0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE_MASK                                           0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE_MASK                                 0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_STATUS
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT__SHIFT                                       0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT_MASK                                         0x0000FFFFL
+//DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET__SHIFT                                0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET_MASK                                  0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER__SHIFT                                     0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE__SHIFT                                  0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST__SHIFT                                         0x14
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE__SHIFT                                            0x18
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING__SHIFT                                         0x1c
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER_MASK                                       0x0000FFFFL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE_MASK                                    0x00010000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST_MASK                                           0x00100000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE_MASK                                              0x01000000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING_MASK                                           0x10000000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER__SHIFT                                      0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE__SHIFT                                   0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST__SHIFT                                          0x14
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE__SHIFT                                             0x18
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING__SHIFT                                          0x1c
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER_MASK                                        0x0000FFFFL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE_MASK                                     0x00010000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST_MASK                                            0x00100000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE_MASK                                               0x01000000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING_MASK                                            0x10000000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET__SHIFT                                   0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET__SHIFT                                    0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET_MASK                                     0x0000FFFFL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET_MASK                                      0xFFFF0000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_READY_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE__SHIFT                                0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE_MASK                                  0x00000001L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE__SHIFT                                  0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE__SHIFT                            0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER__SHIFT                            0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE_MASK                                    0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE_MASK                              0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER_MASK                              0x0000FF00L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE__SHIFT                                    0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE__SHIFT                            0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME__SHIFT                                          0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE_MASK                                      0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE_MASK                              0x00000010L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME_MASK                                            0x0000FF00L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_START_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE__SHIFT                                     0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE_MASK                                       0x00000001L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER__SHIFT                            0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE__SHIFT                         0x10
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER__SHIFT                           0x14
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE__SHIFT                                 0x1c
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER_MASK                              0x0000FFFFL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE_MASK                           0x00010000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER_MASK                             0x0FF00000L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE_MASK                                   0x10000000L
+//DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED__SHIFT                                0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR__SHIFT                                   0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED_MASK                                  0x00000001L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR_MASK                                     0x00000010L
+//DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE__SHIFT                      0x0
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE__SHIFT                                    0x4
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS__SHIFT                                      0x8
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE__SHIFT                                    0xc
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE_MASK                        0x00000003L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE_MASK                                      0x00000030L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS_MASK                                        0x00000100L
+#define DP_SYM32_ENC1_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE_MASK                                      0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_dispdec
+//DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN__SHIFT                             0x0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK__SHIFT                     0x4
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK__SHIFT                  0x9
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK__SHIFT                 0xc
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32__SHIFT                    0x10
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32__SHIFT                0x11
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN_MASK                               0x00000001L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK_MASK                       0x00000010L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK_MASK                    0x00000200L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK_MASK                   0x00001000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32_MASK                      0x00010000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32_MASK                  0x00020000L
+//DP_STREAM_ENC2_DP_STREAM_ENC_INPUT_MUX_CONTROL
+#define DP_STREAM_ENC2_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL__SHIFT  0x0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL_MASK  0x00000007L
+//DP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL
+#define DP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT    0x0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN__SHIFT                         0x8
+#define DP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK      0x00000007L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN_MASK                           0x00000100L
+//DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE__SHIFT             0x0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET__SHIFT              0x4
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL__SHIFT   0x8
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC__SHIFT     0x10
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE__SHIFT         0x14
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE__SHIFT  0x18
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR__SHIFT              0x1c
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE_MASK               0x00000001L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_MASK                0x00000010L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL_MASK     0x00003F00L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC_MASK       0x00010000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE_MASK           0x00100000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE_MASK  0x01000000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR_MASK                0x30000000L
+//DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL__SHIFT  0x0
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE__SHIFT  0x1
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX__SHIFT  0x2
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL__SHIFT    0x4
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY__SHIFT    0xa
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL__SHIFT      0xc
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL__SHIFT      0x10
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL__SHIFT  0x18
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED__SHIFT         0x1f
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL_MASK  0x00000001L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE_MASK  0x00000002L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX_MASK  0x00000004L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL_MASK      0x000003F0L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY_MASK      0x00000C00L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL_MASK        0x0000F000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL_MASK        0x001F0000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL_MASK    0x3F000000L
+#define DP_STREAM_ENC2_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED_MASK           0x80000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_apg_apg_dispdec
+//APG7_APG_CONTROL
+#define APG7_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG7_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG7_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG7_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG7_APG_CONTROL2
+#define APG7_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG7_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG7_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG7_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG7_APG_DBG_GEN_CONTROL
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG7_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG7_APG_PACKET_CONTROL
+#define APG7_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG7_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG7_APG_DBG_60958_0
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG7_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG7_APG_DBG_60958_1
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG7_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG7_APG_DBG_60958_2
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG7_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG7_APG_MEM_PWR
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG7_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG7_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG7_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_dme_dme_dispdec
+//DME7_DME_CONTROL
+#define DME7_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME7_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME7_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME7_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME7_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME7_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME7_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME7_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME7_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME7_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME7_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME7_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME7_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME7_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME7_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME7_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME7_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME7_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME7_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME7_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc2_vpg_vpg_dispdec
+//VPG7_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG7_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG7_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG7_VPG_GENERIC_PACKET_DATA
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG7_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG7_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG7_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG7_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG7_VPG_GENERIC_STATUS
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG7_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG7_VPG_MEM_PWR
+#define VPG7_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG7_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG7_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG7_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG7_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG7_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG7_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG7_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG7_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG7_VPG_ISRC1_2_DATA
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG7_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc2_dispdec
+//DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE__SHIFT                                        0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET__SHIFT                                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE__SHIFT                                    0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE_MASK                                          0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_MASK                                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE_MASK                                      0x00000100L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE__SHIFT                       0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET__SHIFT                        0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE__SHIFT                   0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS__SHIFT              0xc
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE_MASK                         0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_MASK                          0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE_MASK                     0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS_MASK                0x00001000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE__SHIFT             0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING__SHIFT            0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE_MASK               0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING_MASK              0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING__SHIFT  0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING_MASK  0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                               0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING__SHIFT                       0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                      0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                 0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING_MASK                         0x00000030L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                        0x00000300L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA0__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA0__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA1__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA1__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA2__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA2__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA3__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA3__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA4__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA4__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA5__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA5__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA6
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA6__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA6__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA7__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA7__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA8__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA8__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_HBLANK_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                           0x0000FFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY__SHIFT                                          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE__SHIFT                                       0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY_MASK                                            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE_MASK                                         0x00000100L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE__SHIFT                                      0x1
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE__SHIFT                                      0x2
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE__SHIFT                                      0x3
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE__SHIFT                                     0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY__SHIFT                                    0x5
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER__SHIFT                              0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE__SHIFT                                      0x1c
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS__SHIFT                               0x1d
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE_MASK                                        0x00000002L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE_MASK                                        0x00000004L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE_MASK                                        0x00000008L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE_MASK                                       0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY_MASK                                      0x00000020L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER_MASK                                0x00003F00L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_MASK                                        0x10000000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS_MASK                                 0x20000000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE__SHIFT                 0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE__SHIFT          0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE__SHIFT          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING__SHIFT  0xc
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER__SHIFT  0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE_MASK                   0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE_MASK            0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE_MASK            0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING_MASK    0x00001000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER_MASK  0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                   0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE__SHIFT                            0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER__SHIFT                       0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                     0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE_MASK                              0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER_MASK                         0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE__SHIFT        0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER__SHIFT          0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE_MASK          0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER_MASK            0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER__SHIFT                        0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS__SHIFT                               0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER_MASK                          0x00000030L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS_MASK                                 0x00000100L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE__SHIFT                                         0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE__SHIFT                               0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE_MASK                                           0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE_MASK                                 0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_STATUS
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT__SHIFT                                       0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT_MASK                                         0x0000FFFFL
+//DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET__SHIFT                                0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET_MASK                                  0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER__SHIFT                                     0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE__SHIFT                                  0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST__SHIFT                                         0x14
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE__SHIFT                                            0x18
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING__SHIFT                                         0x1c
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER_MASK                                       0x0000FFFFL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE_MASK                                    0x00010000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST_MASK                                           0x00100000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE_MASK                                              0x01000000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING_MASK                                           0x10000000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER__SHIFT                                      0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE__SHIFT                                   0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST__SHIFT                                          0x14
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE__SHIFT                                             0x18
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING__SHIFT                                          0x1c
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER_MASK                                        0x0000FFFFL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE_MASK                                     0x00010000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST_MASK                                            0x00100000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE_MASK                                               0x01000000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING_MASK                                            0x10000000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET__SHIFT                                   0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET__SHIFT                                    0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET_MASK                                     0x0000FFFFL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET_MASK                                      0xFFFF0000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_READY_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE__SHIFT                                0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE_MASK                                  0x00000001L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE__SHIFT                                  0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE__SHIFT                            0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER__SHIFT                            0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE_MASK                                    0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE_MASK                              0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER_MASK                              0x0000FF00L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE__SHIFT                                    0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE__SHIFT                            0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME__SHIFT                                          0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE_MASK                                      0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE_MASK                              0x00000010L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME_MASK                                            0x0000FF00L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_START_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE__SHIFT                                     0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE_MASK                                       0x00000001L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER__SHIFT                            0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE__SHIFT                         0x10
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER__SHIFT                           0x14
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE__SHIFT                                 0x1c
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER_MASK                              0x0000FFFFL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE_MASK                           0x00010000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER_MASK                             0x0FF00000L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE_MASK                                   0x10000000L
+//DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED__SHIFT                                0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR__SHIFT                                   0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED_MASK                                  0x00000001L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR_MASK                                     0x00000010L
+//DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE__SHIFT                      0x0
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE__SHIFT                                    0x4
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS__SHIFT                                      0x8
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE__SHIFT                                    0xc
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE_MASK                        0x00000003L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE_MASK                                      0x00000030L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS_MASK                                        0x00000100L
+#define DP_SYM32_ENC2_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE_MASK                                      0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_dispdec
+//DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN__SHIFT                             0x0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK__SHIFT                     0x4
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK__SHIFT                  0x9
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK__SHIFT                 0xc
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32__SHIFT                    0x10
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32__SHIFT                0x11
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_EN_MASK                               0x00000001L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DISPCLK_MASK                       0x00000010L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SOCCLK_MASK                    0x00000200L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_DPSTREAMCLK_MASK                   0x00001000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_CLOCK_ON_SYMCLK32_MASK                      0x00010000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_CONTROL__DP_STREAM_ENC_APG_CLOCK_ON_SYMCLK32_MASK                  0x00020000L
+//DP_STREAM_ENC3_DP_STREAM_ENC_INPUT_MUX_CONTROL
+#define DP_STREAM_ENC3_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL__SHIFT  0x0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_INPUT_MUX_CONTROL__DP_STREAM_ENC_INPUT_MUX_PIXEL_STREAM_SOURCE_SEL_MASK  0x00000007L
+//DP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL
+#define DP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL__SHIFT    0x0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN__SHIFT                         0x8
+#define DP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_INPUT_MUX_AUDIO_STREAM_SOURCE_SEL_MASK      0x00000007L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_AUDIO_CONTROL__DP_STREAM_ENC_APG_CLOCK_EN_MASK                           0x00000100L
+//DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE__SHIFT             0x0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET__SHIFT              0x4
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL__SHIFT   0x8
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC__SHIFT     0x10
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE__SHIFT         0x14
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE__SHIFT  0x18
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR__SHIFT              0x1c
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ENABLE_MASK               0x00000001L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_MASK                0x00000010L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_START_LEVEL_MASK     0x00003F00L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_READ_CLOCK_SRC_MASK       0x00010000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_RESET_DONE_MASK           0x00100000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_VIDEO_STREAM_ACTIVE_MASK  0x01000000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL0__FIFO_ERROR_MASK                0x30000000L
+//DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL__SHIFT  0x0
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE__SHIFT  0x1
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX__SHIFT  0x2
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL__SHIFT    0x4
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY__SHIFT    0xa
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL__SHIFT      0xc
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL__SHIFT      0x10
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL__SHIFT  0x18
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED__SHIFT         0x1f
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_USE_OVERWRITE_LEVEL_MASK  0x00000001L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECAL_AVERAGE_MASK  0x00000002L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_FORCE_RECOMP_MINMAX_MASK  0x00000004L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_OVERWRITE_LEVEL_MASK      0x000003F0L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_LEVEL_DET_DELAY_MASK      0x00000C00L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MINIMUM_LEVEL_MASK        0x0000F000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_MAXIMUM_LEVEL_MASK        0x001F0000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CAL_AVERAGE_LEVEL_MASK    0x3F000000L
+#define DP_STREAM_ENC3_DP_STREAM_ENC_CLOCK_RAMP_ADJUSTER_FIFO_STATUS_CONTROL1__FIFO_CALIBRATED_MASK           0x80000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_apg_apg_dispdec
+//APG8_APG_CONTROL
+#define APG8_APG_CONTROL__APG_RESET__SHIFT                                                                    0x1
+#define APG8_APG_CONTROL__APG_RESET_DONE__SHIFT                                                               0x2
+#define APG8_APG_CONTROL__APG_RESET_MASK                                                                      0x00000002L
+#define APG8_APG_CONTROL__APG_RESET_DONE_MASK                                                                 0x00000004L
+//APG8_APG_CONTROL2
+#define APG8_APG_CONTROL2__APG_ENABLE__SHIFT                                                                  0x0
+#define APG8_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID__SHIFT                                                      0x8
+#define APG8_APG_CONTROL2__APG_ENABLE_MASK                                                                    0x00000001L
+#define APG8_APG_CONTROL2__APG_DP_AUDIO_STREAM_ID_MASK                                                        0x0000FF00L
+//APG8_APG_DBG_GEN_CONTROL
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE__SHIFT                                                   0x0
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET__SHIFT                                                    0x1
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE__SHIFT                                         0x8
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE__SHIFT                                        0x18
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_GEN_ENABLE_MASK                                                     0x00000001L
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_GEN_RESET_MASK                                                      0x00000002L
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_CHANNEL_ENABLE_MASK                                           0x0000FF00L
+#define APG8_APG_DBG_GEN_CONTROL__APG_DBG_AUDIO_TEST_CH_DISABLE_MASK                                          0xFF000000L
+//APG8_APG_PACKET_CONTROL
+#define APG8_APG_PACKET_CONTROL__APG_DBG_MUX_SEL__SHIFT                                                       0x0
+#define APG8_APG_PACKET_CONTROL__APG_DBG_MUX_SEL_MASK                                                         0x00000001L
+//APG8_APG_DBG_60958_0
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_A__SHIFT                                                       0x0
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_B__SHIFT                                                       0x1
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_C__SHIFT                                                       0x2
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_D__SHIFT                                                       0x3
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_MODE__SHIFT                                                    0x6
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE__SHIFT                                           0x8
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER__SHIFT                                           0x10
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L__SHIFT                                        0x14
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY__SHIFT                                      0x18
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY__SHIFT                                          0x1c
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_A_MASK                                                         0x00000001L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_B_MASK                                                         0x00000002L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_C_MASK                                                         0x00000004L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_D_MASK                                                         0x00000038L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_MODE_MASK                                                      0x000000C0L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CATEGORY_CODE_MASK                                             0x0000FF00L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_SOURCE_NUMBER_MASK                                             0x000F0000L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CHANNEL_NUMBER_L_MASK                                          0x00F00000L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_SAMPLING_FREQUENCY_MASK                                        0x0F000000L
+#define APG8_APG_DBG_60958_0__APG_DBG_60958_CS_CLOCK_ACCURACY_MASK                                            0x30000000L
+//APG8_APG_DBG_60958_1
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH__SHIFT                                             0x0
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT                             0x4
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_VALID__SHIFT                                                      0x10
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R__SHIFT                                        0x14
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_WORD_LENGTH_MASK                                               0x0000000FL
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK                               0x000000F0L
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_VALID_MASK                                                        0x00010000L
+#define APG8_APG_DBG_60958_1__APG_DBG_60958_CS_CHANNEL_NUMBER_R_MASK                                          0x00F00000L
+//APG8_APG_DBG_60958_2
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2__SHIFT                                        0x0
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3__SHIFT                                        0x4
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4__SHIFT                                        0x8
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5__SHIFT                                        0xc
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6__SHIFT                                        0x10
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7__SHIFT                                        0x14
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_2_MASK                                          0x0000000FL
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_3_MASK                                          0x000000F0L
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_4_MASK                                          0x00000F00L
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_5_MASK                                          0x0000F000L
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_6_MASK                                          0x000F0000L
+#define APG8_APG_DBG_60958_2__APG_DBG_60958_CS_CHANNEL_NUMBER_7_MASK                                          0x00F00000L
+//APG8_APG_MEM_PWR
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_DIS__SHIFT                                                              0x0
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_FORCE__SHIFT                                                            0x4
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_STATE__SHIFT                                                            0x8
+#define APG8_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE__SHIFT                                              0xc
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_DIS_MASK                                                                0x00000001L
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_FORCE_MASK                                                              0x00000030L
+#define APG8_APG_MEM_PWR__APG_MEM_PWR_STATE_MASK                                                              0x00000300L
+#define APG8_APG_MEM_PWR__APG_MEM_DEFAULT_LOW_POWER_STATE_MASK                                                0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_dme_dme_dispdec
+//DME8_DME_CONTROL
+#define DME8_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID__SHIFT                                                   0x0
+#define DME8_DME_CONTROL__METADATA_ENGINE_EN__SHIFT                                                           0x4
+#define DME8_DME_CONTROL__METADATA_STREAM_TYPE__SHIFT                                                         0x8
+#define DME8_DME_CONTROL__METADATA_DB_PENDING__SHIFT                                                          0xc
+#define DME8_DME_CONTROL__METADATA_DB_TAKEN__SHIFT                                                            0xd
+#define DME8_DME_CONTROL__METADATA_DB_TAKEN_CLR__SHIFT                                                        0x10
+#define DME8_DME_CONTROL__METADATA_DB_DISABLE__SHIFT                                                          0x14
+#define DME8_DME_CONTROL__METADATA_TRANSMISSION_MISSED__SHIFT                                                 0x18
+#define DME8_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR__SHIFT                                             0x19
+#define DME8_DME_CONTROL__METADATA_ENGINE_EN_STATUS__SHIFT                                                    0x1a
+#define DME8_DME_CONTROL__METADATA_HUBP_REQUESTOR_ID_MASK                                                     0x00000007L
+#define DME8_DME_CONTROL__METADATA_ENGINE_EN_MASK                                                             0x00000010L
+#define DME8_DME_CONTROL__METADATA_STREAM_TYPE_MASK                                                           0x00000100L
+#define DME8_DME_CONTROL__METADATA_DB_PENDING_MASK                                                            0x00001000L
+#define DME8_DME_CONTROL__METADATA_DB_TAKEN_MASK                                                              0x00002000L
+#define DME8_DME_CONTROL__METADATA_DB_TAKEN_CLR_MASK                                                          0x00010000L
+#define DME8_DME_CONTROL__METADATA_DB_DISABLE_MASK                                                            0x00100000L
+#define DME8_DME_CONTROL__METADATA_TRANSMISSION_MISSED_MASK                                                   0x01000000L
+#define DME8_DME_CONTROL__METADATA_TRANSMISSION_MISSED_CLR_MASK                                               0x02000000L
+#define DME8_DME_CONTROL__METADATA_ENGINE_EN_STATUS_MASK                                                      0x04000000L
+
+
+// addressBlock: dce_dc_hpo_dp_stream_enc3_vpg_vpg_dispdec
+//VPG8_VPG_GENERIC_PACKET_ACCESS_CTRL
+#define VPG8_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX__SHIFT                                    0x0
+#define VPG8_VPG_GENERIC_PACKET_ACCESS_CTRL__VPG_GENERIC_DATA_INDEX_MASK                                      0x000000FFL
+//VPG8_VPG_GENERIC_PACKET_DATA
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0__SHIFT                                           0x0
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1__SHIFT                                           0x8
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2__SHIFT                                           0x10
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3__SHIFT                                           0x18
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE0_MASK                                             0x000000FFL
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE1_MASK                                             0x0000FF00L
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE2_MASK                                             0x00FF0000L
+#define VPG8_VPG_GENERIC_PACKET_DATA__VPG_GENERIC_DATA_BYTE3_MASK                                             0xFF000000L
+//VPG8_VPG_GSP_FRAME_UPDATE_CTRL
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE__SHIFT                                      0x0
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE__SHIFT                                      0x1
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE__SHIFT                                      0x2
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE__SHIFT                                      0x3
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE__SHIFT                                      0x4
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE__SHIFT                                      0x5
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE__SHIFT                                      0x6
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE__SHIFT                                      0x7
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE__SHIFT                                      0x8
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE__SHIFT                                      0x9
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE__SHIFT                                     0xa
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE__SHIFT                                     0xb
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE__SHIFT                                     0xc
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE__SHIFT                                     0xd
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE__SHIFT                                     0xe
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING__SHIFT                              0x10
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING__SHIFT                              0x11
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING__SHIFT                              0x12
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING__SHIFT                              0x13
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING__SHIFT                              0x14
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING__SHIFT                              0x15
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING__SHIFT                              0x16
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING__SHIFT                              0x17
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING__SHIFT                              0x18
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING__SHIFT                              0x19
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING__SHIFT                             0x1a
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING__SHIFT                             0x1b
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING__SHIFT                             0x1c
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING__SHIFT                             0x1d
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING__SHIFT                             0x1e
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_MASK                                        0x00000001L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_MASK                                        0x00000002L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_MASK                                        0x00000004L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_MASK                                        0x00000008L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_MASK                                        0x00000010L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_MASK                                        0x00000020L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_MASK                                        0x00000040L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_MASK                                        0x00000080L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_MASK                                        0x00000100L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_MASK                                        0x00000200L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_MASK                                       0x00000400L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_MASK                                       0x00000800L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_MASK                                       0x00001000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_MASK                                       0x00002000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_MASK                                       0x00004000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC0_FRAME_UPDATE_PENDING_MASK                                0x00010000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC1_FRAME_UPDATE_PENDING_MASK                                0x00020000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC2_FRAME_UPDATE_PENDING_MASK                                0x00040000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC3_FRAME_UPDATE_PENDING_MASK                                0x00080000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC4_FRAME_UPDATE_PENDING_MASK                                0x00100000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC5_FRAME_UPDATE_PENDING_MASK                                0x00200000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC6_FRAME_UPDATE_PENDING_MASK                                0x00400000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC7_FRAME_UPDATE_PENDING_MASK                                0x00800000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC8_FRAME_UPDATE_PENDING_MASK                                0x01000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC9_FRAME_UPDATE_PENDING_MASK                                0x02000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC10_FRAME_UPDATE_PENDING_MASK                               0x04000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC11_FRAME_UPDATE_PENDING_MASK                               0x08000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC12_FRAME_UPDATE_PENDING_MASK                               0x10000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC13_FRAME_UPDATE_PENDING_MASK                               0x20000000L
+#define VPG8_VPG_GSP_FRAME_UPDATE_CTRL__VPG_GENERIC14_FRAME_UPDATE_PENDING_MASK                               0x40000000L
+//VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE__SHIFT                              0x0
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE__SHIFT                              0x1
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE__SHIFT                              0x2
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE__SHIFT                              0x3
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE__SHIFT                              0x4
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE__SHIFT                              0x5
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE__SHIFT                              0x6
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE__SHIFT                              0x7
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE__SHIFT                              0x8
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE__SHIFT                              0x9
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE__SHIFT                             0xa
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE__SHIFT                             0xb
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE__SHIFT                             0xc
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE__SHIFT                             0xd
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE__SHIFT                             0xe
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x10
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x11
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x12
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x13
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x14
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x15
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x16
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x17
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x18
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING__SHIFT                      0x19
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1a
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1b
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1c
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1d
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING__SHIFT                     0x1e
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_MASK                                0x00000001L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_MASK                                0x00000002L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_MASK                                0x00000004L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_MASK                                0x00000008L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_MASK                                0x00000010L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_MASK                                0x00000020L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_MASK                                0x00000040L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_MASK                                0x00000080L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_MASK                                0x00000100L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_MASK                                0x00000200L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_MASK                               0x00000400L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_MASK                               0x00000800L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_MASK                               0x00001000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_MASK                               0x00002000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_MASK                               0x00004000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC0_IMMEDIATE_UPDATE_PENDING_MASK                        0x00010000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC1_IMMEDIATE_UPDATE_PENDING_MASK                        0x00020000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC2_IMMEDIATE_UPDATE_PENDING_MASK                        0x00040000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC3_IMMEDIATE_UPDATE_PENDING_MASK                        0x00080000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC4_IMMEDIATE_UPDATE_PENDING_MASK                        0x00100000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC5_IMMEDIATE_UPDATE_PENDING_MASK                        0x00200000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC6_IMMEDIATE_UPDATE_PENDING_MASK                        0x00400000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC7_IMMEDIATE_UPDATE_PENDING_MASK                        0x00800000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC8_IMMEDIATE_UPDATE_PENDING_MASK                        0x01000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC9_IMMEDIATE_UPDATE_PENDING_MASK                        0x02000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC10_IMMEDIATE_UPDATE_PENDING_MASK                       0x04000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC11_IMMEDIATE_UPDATE_PENDING_MASK                       0x08000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC12_IMMEDIATE_UPDATE_PENDING_MASK                       0x10000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC13_IMMEDIATE_UPDATE_PENDING_MASK                       0x20000000L
+#define VPG8_VPG_GSP_IMMEDIATE_UPDATE_CTRL__VPG_GENERIC14_IMMEDIATE_UPDATE_PENDING_MASK                       0x40000000L
+//VPG8_VPG_GENERIC_STATUS
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS__SHIFT                                               0x0
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED__SHIFT                                          0x1
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR__SHIFT                                              0x4
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_LOCK_STATUS_MASK                                                 0x00000001L
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_OCCURED_MASK                                            0x00000002L
+#define VPG8_VPG_GENERIC_STATUS__VPG_GENERIC_CONFLICT_CLR_MASK                                                0x00000010L
+//VPG8_VPG_MEM_PWR
+#define VPG8_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS__SHIFT                                                  0x0
+#define VPG8_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE__SHIFT                                                    0x4
+#define VPG8_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE__SHIFT                                                        0x8
+#define VPG8_VPG_MEM_PWR__VPG_GSP_MEM_LIGHT_SLEEP_DIS_MASK                                                    0x00000001L
+#define VPG8_VPG_MEM_PWR__VPG_GSP_LIGHT_SLEEP_FORCE_MASK                                                      0x00000010L
+#define VPG8_VPG_MEM_PWR__VPG_GSP_MEM_PWR_STATE_MASK                                                          0x00000100L
+//VPG8_VPG_ISRC1_2_ACCESS_CTRL
+#define VPG8_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX__SHIFT                                           0x0
+#define VPG8_VPG_ISRC1_2_ACCESS_CTRL__VPG_ISRC1_2_DATA_INDEX_MASK                                             0x0000000FL
+//VPG8_VPG_ISRC1_2_DATA
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0__SHIFT                                                     0x0
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1__SHIFT                                                     0x8
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2__SHIFT                                                     0x10
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3__SHIFT                                                     0x18
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE0_MASK                                                       0x000000FFL
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE1_MASK                                                       0x0000FF00L
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE2_MASK                                                       0x00FF0000L
+#define VPG8_VPG_ISRC1_2_DATA__VPG_ISRC_DATA_BYTE3_MASK                                                       0xFF000000L
+
+
+// addressBlock: dce_dc_hpo_dp_sym32_enc3_dispdec
+//DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE__SHIFT                                        0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET__SHIFT                                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE__SHIFT                                    0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_ENABLE_MASK                                          0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_MASK                                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_CONTROL__DP_SYM32_ENC_RESET_DONE_MASK                                      0x00000100L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE__SHIFT                       0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET__SHIFT                        0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE__SHIFT                   0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS__SHIFT              0xc
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_ENABLE_MASK                         0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_MASK                          0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_RESET_DONE_MASK                     0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_FIFO_CONTROL__PIXEL_TO_SYMBOL_FIFO_OVERFLOW_STATUS_MASK                0x00001000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE__SHIFT             0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING__SHIFT            0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_ENABLE_MASK               0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_DOUBLE_BUFFER_CONTROL__MSA_DOUBLE_BUFFER_PENDING_MASK              0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING__SHIFT  0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT_DOUBLE_BUFFER_CONTROL__PIXEL_FORMAT_DOUBLE_BUFFER_PENDING_MASK  0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE__SHIFT                               0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING__SHIFT                       0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH__SHIFT                      0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__PIXEL_ENCODING_TYPE_MASK                                 0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_PIXEL_ENCODING_MASK                         0x00000030L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PIXEL_FORMAT__UNCOMPRESSED_COMPONENT_DEPTH_MASK                        0x00000300L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA0__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA0__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA1__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA1__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA2__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA2__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA3__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA3__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA4__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA4__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA5__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA5__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA6
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA6__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA6__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA7__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA7__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA8__MSA_DATA__SHIFT                                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA8__MSA_DATA_MASK                                                    0xFFFFFFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_HBLANK_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH__SHIFT                         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_HBLANK_CONTROL__HBLANK_MINIMUM_SYMBOL_WIDTH_MASK                           0x0000FFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL0__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL1__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL2__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL3__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL4__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL5__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL6__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL7__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL8__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT           0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                         0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                     0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE__SHIFT                                  0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE__SHIFT                                 0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                  0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING__SHIFT                         0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                      0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK             0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_SEND_MASK                           0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                       0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_ENABLE_MASK                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_PAYLOAD_SIZE_MASK                                    0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_SOF_REFERENCE_MASK                                   0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                    0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_DOUBLE_BUFFER_PENDING_MASK                           0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL9__GSP_TRANSMISSION_LINE_NUMBER_MASK                        0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL10__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL11__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL12__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL13__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE__SHIFT          0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND__SHIFT                        0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION__SHIFT                    0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE__SHIFT                         0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE__SHIFT                                 0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE__SHIFT                                0x7
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED__SHIFT         0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING__SHIFT                 0x9
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING__SHIFT                        0xa
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER__SHIFT                     0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_VIDEO_CONTINUOUS_TRANSMISSION_ENABLE_MASK           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_IDLE_CONTINUOUS_TRANSMISSION_ENABLE_MASK            0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_SEND_MASK                          0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_ONE_SHOT_POSITION_MASK                      0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_ENABLE_MASK                           0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_PAYLOAD_SIZE_MASK                                   0x00000060L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_SOF_REFERENCE_MASK                                  0x00000080L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_DEADLINE_MISSED_MASK           0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRIGGER_TRANSMISSION_PENDING_MASK                   0x00000200L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_DOUBLE_BUFFER_PENDING_MASK                          0x00000400L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_GSP_CONTROL14__GSP_TRANSMISSION_LINE_NUMBER_MASK                       0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY__SHIFT                                          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE__SHIFT                                       0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__SDP_STREAM_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__GSP0_PRIORITY_MASK                                            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_CONTROL__SDP_CRC16_ENABLE_MASK                                         0x00000100L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE__SHIFT                                      0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE__SHIFT                                      0x1
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE__SHIFT                                      0x2
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE__SHIFT                                      0x3
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE__SHIFT                                     0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY__SHIFT                                    0x5
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER__SHIFT                              0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE__SHIFT                                      0x1c
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS__SHIFT                               0x1d
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_ENABLE_MASK                                        0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_ENABLE_MASK                                        0x00000002L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AIP_ENABLE_MASK                                        0x00000004L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ACM_ENABLE_MASK                                        0x00000008L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ISRC_ENABLE_MASK                                       0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ASP_PRIORITY_MASK                                      0x00000020L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__ATP_VERSION_NUMBER_MASK                                0x00003F00L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_MASK                                        0x10000000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_AUDIO_CONTROL0__AUDIO_MUTE_STATUS_MASK                                 0x20000000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE__SHIFT                 0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE__SHIFT          0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE__SHIFT          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING__SHIFT  0xc
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER__SHIFT  0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_ENABLE_MASK                   0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_DOUBLE_BUFFER_ENABLE_MASK            0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_SOF_REFERENCE_MASK            0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_DOUBLE_BUFFER_PENDING_MASK    0x00001000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SDP_METADATA_PACKET_CONTROL__METADATA_PACKET_TRANSMISSION_LINE_NUMBER_MASK  0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN__SHIFT                   0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE__SHIFT                            0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER__SHIFT                       0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_MISC1_STEREOSYNC_OVERRIDE_EN_MASK                     0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_ENABLE_MASK                              0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_MSA_CONTROL__MSA_TRANSMISSION_LINE_NUMBER_MASK                         0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE__SHIFT        0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER__SHIFT          0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_SOF_REFERENCE_MASK          0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_VBID_CONTROL__VBID_6_COMPRESSEDSTREAM_FLAG_LINE_NUMBER_MASK            0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER__SHIFT                        0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS__SHIFT                               0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_DISABLE_DEFER_MASK                          0x00000030L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_STREAM_CONTROL__VID_STREAM_STATUS_MASK                                 0x00000100L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE__SHIFT  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE__SHIFT  0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_ENABLE_MASK  0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_PANEL_REPLAY_CONTROL__PANEL_REPLAY_TUNNELING_OPTIMIZATION_DOUBLE_BUFFER_ENABLE_MASK  0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE__SHIFT                                         0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE__SHIFT                               0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_ENABLE_MASK                                           0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_VID_CRC_CONTROL__CRC_CONT_MODE_ENABLE_MASK                                 0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_STATUS
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT__SHIFT                                       0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_STATUS__BS_COUNT_MASK                                         0x0000FFFFL
+//DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE__SHIFT                               0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET__SHIFT                                0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_ENABLE_MASK                                 0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_SYMBOL_COUNT_CONTROL__BS_COUNT_RESET_MASK                                  0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER__SHIFT                                     0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE__SHIFT                                  0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST__SHIFT                                         0x14
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE__SHIFT                                            0x18
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING__SHIFT                                         0x1c
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_NUMBER_MASK                                       0x0000FFFFL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__LINE_REFERENCE_MASK                                    0x00010000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__REQUEST_MASK                                           0x00100000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__MODE_MASK                                              0x01000000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_SLEEP_CONTROL__PENDING_MASK                                           0x10000000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER__SHIFT                                      0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE__SHIFT                                   0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST__SHIFT                                          0x14
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE__SHIFT                                             0x18
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING__SHIFT                                          0x1c
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_NUMBER_MASK                                        0x0000FFFFL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__LINE_REFERENCE_MASK                                     0x00010000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__REQUEST_MASK                                            0x00100000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__MODE_MASK                                               0x01000000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_CONTROL__PENDING_MASK                                            0x10000000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET__SHIFT                                   0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET__SHIFT                                    0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__SLEEP_OFFSET_MASK                                     0x0000FFFFL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_REQUEST_OFFSET__WAKE_OFFSET_MASK                                      0xFFFF0000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_READY_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE__SHIFT                                0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_READY_CONTROL__SDP_PENDING_MODE_MASK                                  0x00000001L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE__SHIFT                                  0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE__SHIFT                            0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER__SHIFT                            0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__ENABLE_MASK                                    0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__DISABLE_MODE_MASK                              0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_HARDWARE_MODE_CONTROL__FRAME_NUMBER_MASK                              0x0000FF00L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE__SHIFT                                    0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE__SHIFT                            0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME__SHIFT                                          0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_SLEEP_STATE_MASK                                      0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_HARDWARE_MODE_STATE_MASK                              0x00000010L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_STATUS__CURRENT_FRAME_MASK                                            0x0000FF00L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_START_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE__SHIFT                                     0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_START_CONTROL__START_STATE_MASK                                       0x00000001L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER__SHIFT                            0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE__SHIFT                         0x10
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER__SHIFT                           0x14
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE__SHIFT                                 0x1c
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_NUMBER_MASK                              0x0000FFFFL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__LINE_REFERENCE_MASK                           0x00010000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__FRAME_NUMBER_MASK                             0x0FF00000L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_CONTROL__ENABLE_MASK                                   0x10000000L
+//DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED__SHIFT                                0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR__SHIFT                                   0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__OCCURRED_MASK                                  0x00000001L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_ALPM_WAKE_INTERRUPT_STATUS__CLEAR_MASK                                     0x00000010L
+//DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE__SHIFT                      0x0
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE__SHIFT                                    0x4
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS__SHIFT                                      0x8
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE__SHIFT                                    0xc
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_DEFAULT_LOW_POWER_STATE_MASK                        0x00000003L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_FORCE_MASK                                      0x00000030L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_DIS_MASK                                        0x00000100L
+#define DP_SYM32_ENC3_DP_SYM32_ENC_MEM_POWER_CONTROL__MEM_PWR_STATE_MASK                                      0x00003000L
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc0_dispdec
+//DP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL
+#define DP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN__SHIFT                                   0x0
+#define DP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32__SHIFT                          0x4
+#define DP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN_MASK                                     0x00000001L
+#define DP_LINK_ENC0_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32_MASK                            0x00000010L
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym320_dispdec
+//DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE__SHIFT                                              0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__DPHY_RESET__SHIFT                                               0x1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE__SHIFT                                          0x2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__MODE__SHIFT                                                     0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__NUM_LANES__SHIFT                                                0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD__SHIFT                                   0xc
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP__SHIFT                                         0xd
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE_MASK                                                0x00000001L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__DPHY_RESET_MASK                                                 0x00000002L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE_MASK                                            0x00000004L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__MODE_MASK                                                       0x00000030L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__NUM_LANES_MASK                                                  0x00000300L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD_MASK                                     0x00001000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP_MASK                                           0x00002000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__STATUS__SHIFT                                                    0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__RESET_STATUS__SHIFT                                              0x1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__CURRENT_MODE__SHIFT                                              0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED__SHIFT                                        0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING__SHIFT                                       0xc
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING__SHIFT                                        0x10
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS__SHIFT                                          0x12
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__CM_MODE_EN__SHIFT                                                0x14
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__STATUS_MASK                                                      0x00000001L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__RESET_STATUS_MASK                                                0x00000002L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__CURRENT_MODE_MASK                                                0x00000030L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED_MASK                                          0x00000100L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING_MASK                                         0x00001000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING_MASK                                          0x00030000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS_MASK                                            0x000C0000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_STATUS__CM_MODE_EN_MASK                                                  0x00100000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_UPDATE
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE__SHIFT                                            0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE_MASK                                              0x00000003L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE__SHIFT                                      0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH__SHIFT                           0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE_MASK                                        0x00000001L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH_MASK                             0x00000030L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR0__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR0__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR1__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR1__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR2__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR2__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR3__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_EDP_ASSR3__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS__SHIFT                                  0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL__SHIFT                              0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT__SHIFT                                    0xc
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME__SHIFT                                     0x10
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS_MASK                                    0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL_MASK                                0x00000FF0L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT_MASK                                      0x0000F000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME_MASK                                       0x00FF0000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD__SHIFT                                    0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD_MASK                                      0x0003FFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY__SHIFT                                         0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES__SHIFT                                    0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY_MASK                                           0x0000007FL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES_MASK                                      0x000FFF00L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0__SHIFT                                           0x4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1__SHIFT                                             0x8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1__SHIFT                                           0xc
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2__SHIFT                                             0x10
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2__SHIFT                                           0x14
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3__SHIFT                                             0x18
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3__SHIFT                                           0x1c
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0_MASK                                               0x00000007L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0_MASK                                             0x00000070L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1_MASK                                               0x00000700L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1_MASK                                             0x00007000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2_MASK                                               0x00070000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2_MASK                                             0x00700000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3_MASK                                               0x07000000L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3_MASK                                             0x70000000L
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_SQ_PULSE
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH__SHIFT                                    0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH_MASK                                      0x000000FFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM4
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM5
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM6
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM7
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM8
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM9
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM10
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM__SHIFT                                            0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM_MASK                                              0x00FFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT__SHIFT                                  0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT_MASK                                    0x0000FFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT__SHIFT                                 0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT_MASK                                   0xFFFFFFFFL
+//DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE__SHIFT                           0x0
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET__SHIFT                            0x1
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE__SHIFT                          0x2
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET__SHIFT                           0x3
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE_MASK                             0x00000001L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET_MASK                              0x00000002L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE_MASK                            0x00000004L
+#define DP_DPHY_SYM320_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET_MASK                             0x00000008L
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc1_dispdec
+//DP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL
+#define DP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN__SHIFT                                   0x0
+#define DP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32__SHIFT                          0x4
+#define DP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN_MASK                                     0x00000001L
+#define DP_LINK_ENC1_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32_MASK                            0x00000010L
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym321_dispdec
+//DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE__SHIFT                                              0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__DPHY_RESET__SHIFT                                               0x1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE__SHIFT                                          0x2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__MODE__SHIFT                                                     0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__NUM_LANES__SHIFT                                                0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD__SHIFT                                   0xc
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP__SHIFT                                         0xd
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE_MASK                                                0x00000001L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__DPHY_RESET_MASK                                                 0x00000002L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE_MASK                                            0x00000004L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__MODE_MASK                                                       0x00000030L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__NUM_LANES_MASK                                                  0x00000300L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD_MASK                                     0x00001000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP_MASK                                           0x00002000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__STATUS__SHIFT                                                    0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__RESET_STATUS__SHIFT                                              0x1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__CURRENT_MODE__SHIFT                                              0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED__SHIFT                                        0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING__SHIFT                                       0xc
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING__SHIFT                                        0x10
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS__SHIFT                                          0x12
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__CM_MODE_EN__SHIFT                                                0x14
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__STATUS_MASK                                                      0x00000001L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__RESET_STATUS_MASK                                                0x00000002L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__CURRENT_MODE_MASK                                                0x00000030L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED_MASK                                          0x00000100L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING_MASK                                         0x00001000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING_MASK                                          0x00030000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS_MASK                                            0x000C0000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_STATUS__CM_MODE_EN_MASK                                                  0x00100000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_UPDATE
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE__SHIFT                                            0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE_MASK                                              0x00000003L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE__SHIFT                                      0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH__SHIFT                           0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE_MASK                                        0x00000001L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH_MASK                             0x00000030L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR0__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR0__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR1__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR1__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR2__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR2__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR3__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_EDP_ASSR3__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS__SHIFT                                  0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL__SHIFT                              0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT__SHIFT                                    0xc
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME__SHIFT                                     0x10
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS_MASK                                    0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL_MASK                                0x00000FF0L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT_MASK                                      0x0000F000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME_MASK                                       0x00FF0000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD__SHIFT                                    0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD_MASK                                      0x0003FFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY__SHIFT                                         0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES__SHIFT                                    0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY_MASK                                           0x0000007FL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES_MASK                                      0x000FFF00L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0__SHIFT                                           0x4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1__SHIFT                                             0x8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1__SHIFT                                           0xc
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2__SHIFT                                             0x10
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2__SHIFT                                           0x14
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3__SHIFT                                             0x18
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3__SHIFT                                           0x1c
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0_MASK                                               0x00000007L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0_MASK                                             0x00000070L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1_MASK                                               0x00000700L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1_MASK                                             0x00007000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2_MASK                                               0x00070000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2_MASK                                             0x00700000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3_MASK                                               0x07000000L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3_MASK                                             0x70000000L
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_SQ_PULSE
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH__SHIFT                                    0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH_MASK                                      0x000000FFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM4
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM5
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM6
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM7
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM8
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM9
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM10
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM__SHIFT                                            0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM_MASK                                              0x00FFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT__SHIFT                                  0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT_MASK                                    0x0000FFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT__SHIFT                                 0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT_MASK                                   0xFFFFFFFFL
+//DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE__SHIFT                           0x0
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET__SHIFT                            0x1
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE__SHIFT                          0x2
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET__SHIFT                           0x3
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE_MASK                             0x00000001L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET_MASK                              0x00000002L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE_MASK                            0x00000004L
+#define DP_DPHY_SYM321_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET_MASK                             0x00000008L
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc2_dispdec
+//DP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL
+#define DP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN__SHIFT                                   0x0
+#define DP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32__SHIFT                          0x4
+#define DP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN_MASK                                     0x00000001L
+#define DP_LINK_ENC2_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32_MASK                            0x00000010L
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym322_dispdec
+//DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE__SHIFT                                              0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__DPHY_RESET__SHIFT                                               0x1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE__SHIFT                                          0x2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__MODE__SHIFT                                                     0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__NUM_LANES__SHIFT                                                0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD__SHIFT                                   0xc
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP__SHIFT                                         0xd
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE_MASK                                                0x00000001L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__DPHY_RESET_MASK                                                 0x00000002L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE_MASK                                            0x00000004L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__MODE_MASK                                                       0x00000030L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__NUM_LANES_MASK                                                  0x00000300L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD_MASK                                     0x00001000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP_MASK                                           0x00002000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__STATUS__SHIFT                                                    0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__RESET_STATUS__SHIFT                                              0x1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__CURRENT_MODE__SHIFT                                              0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED__SHIFT                                        0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING__SHIFT                                       0xc
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING__SHIFT                                        0x10
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS__SHIFT                                          0x12
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__CM_MODE_EN__SHIFT                                                0x14
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__STATUS_MASK                                                      0x00000001L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__RESET_STATUS_MASK                                                0x00000002L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__CURRENT_MODE_MASK                                                0x00000030L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED_MASK                                          0x00000100L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING_MASK                                         0x00001000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING_MASK                                          0x00030000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS_MASK                                            0x000C0000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_STATUS__CM_MODE_EN_MASK                                                  0x00100000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_UPDATE
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE__SHIFT                                            0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE_MASK                                              0x00000003L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE__SHIFT                                      0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH__SHIFT                           0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE_MASK                                        0x00000001L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH_MASK                             0x00000030L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR0__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR0__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR1__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR1__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR2__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR2__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR3__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_EDP_ASSR3__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS__SHIFT                                  0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL__SHIFT                              0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT__SHIFT                                    0xc
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME__SHIFT                                     0x10
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS_MASK                                    0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL_MASK                                0x00000FF0L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT_MASK                                      0x0000F000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME_MASK                                       0x00FF0000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD__SHIFT                                    0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD_MASK                                      0x0003FFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY__SHIFT                                         0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES__SHIFT                                    0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY_MASK                                           0x0000007FL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES_MASK                                      0x000FFF00L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0__SHIFT                                           0x4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1__SHIFT                                             0x8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1__SHIFT                                           0xc
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2__SHIFT                                             0x10
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2__SHIFT                                           0x14
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3__SHIFT                                             0x18
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3__SHIFT                                           0x1c
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0_MASK                                               0x00000007L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0_MASK                                             0x00000070L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1_MASK                                               0x00000700L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1_MASK                                             0x00007000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2_MASK                                               0x00070000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2_MASK                                             0x00700000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3_MASK                                               0x07000000L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3_MASK                                             0x70000000L
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_SQ_PULSE
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH__SHIFT                                    0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH_MASK                                      0x000000FFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM4
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM5
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM6
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM7
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM8
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM9
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM10
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM__SHIFT                                            0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM_MASK                                              0x00FFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT__SHIFT                                  0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT_MASK                                    0x0000FFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT__SHIFT                                 0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT_MASK                                   0xFFFFFFFFL
+//DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE__SHIFT                           0x0
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET__SHIFT                            0x1
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE__SHIFT                          0x2
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET__SHIFT                           0x3
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE_MASK                             0x00000001L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET_MASK                              0x00000002L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE_MASK                            0x00000004L
+#define DP_DPHY_SYM322_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET_MASK                             0x00000008L
+
+
+// addressBlock: dce_dc_hpo_dp_link_enc3_dispdec
+//DP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL
+#define DP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN__SHIFT                                   0x0
+#define DP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32__SHIFT                          0x4
+#define DP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_EN_MASK                                     0x00000001L
+#define DP_LINK_ENC3_DP_LINK_ENC_CLOCK_CONTROL__DP_LINK_ENC_CLOCK_ON_SYMCLK32_MASK                            0x00000010L
+
+
+// addressBlock: dce_dc_hpo_dp_dphy_sym323_dispdec
+//DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE__SHIFT                                              0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__DPHY_RESET__SHIFT                                               0x1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE__SHIFT                                          0x2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__MODE__SHIFT                                                     0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__NUM_LANES__SHIFT                                                0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD__SHIFT                                   0xc
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP__SHIFT                                         0xd
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__DPHY_ENABLE_MASK                                                0x00000001L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__DPHY_RESET_MASK                                                 0x00000002L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__PRECODER_ENABLE_MASK                                            0x00000004L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__MODE_MASK                                                       0x00000030L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__NUM_LANES_MASK                                                  0x00000300L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__SHORT_LAST_TPS2_PERIOD_MASK                                     0x00001000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_CONTROL__START_FROM_SLEEP_MASK                                           0x00002000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__STATUS__SHIFT                                                    0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__RESET_STATUS__SHIFT                                              0x1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__CURRENT_MODE__SHIFT                                              0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED__SHIFT                                        0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING__SHIFT                                       0xc
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING__SHIFT                                        0x10
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS__SHIFT                                          0x12
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__CM_MODE_EN__SHIFT                                                0x14
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__STATUS_MASK                                                      0x00000001L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__RESET_STATUS_MASK                                                0x00000002L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__CURRENT_MODE_MASK                                                0x00000030L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__ENCRYPTION_ENABLED_MASK                                          0x00000100L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__RATE_UPDATE_PENDING_MASK                                         0x00001000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__SAT_UPDATE_PENDING_MASK                                          0x00030000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__SCHEDULER_STATUS_MASK                                            0x000C0000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_STATUS__CM_MODE_EN_MASK                                                  0x00100000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_UPDATE
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE__SHIFT                                            0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_UPDATE__SAT_UPDATE_MASK                                              0x00000003L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL0__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL1__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL2__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y__SHIFT                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X__SHIFT                                   0x19
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_Y_MASK                                     0x01FFFFFFL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_VC_RATE_CNTL3__STREAM_VC_RATE_X_MASK                                     0xFE000000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC0__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC1__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC2__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE__SHIFT                                        0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE__SHIFT                                    0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE__SHIFT                                      0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT__SHIFT                                           0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_STREAM_SOURCE_MASK                                          0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_ENABLE_MASK                                      0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_ENCRYPTION_TYPE_MASK                                        0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC3__SAT_SLOT_COUNT_MASK                                             0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS0__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS1__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS2__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE__SHIFT                                 0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE__SHIFT                             0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE__SHIFT                               0x5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT__SHIFT                                    0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_STREAM_SOURCE_MASK                                   0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_ENABLE_MASK                               0x00000010L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_ENCRYPTION_TYPE_MASK                                 0x00000020L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SAT_VC_STATUS3__SAT_SLOT_COUNT_MASK                                      0x00007F00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE__SHIFT                                      0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH__SHIFT                           0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0__EDP_MODE_ENABLE_MASK                                        0x00000001L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_CONFIG0__EDP_LINK_SECURITY_STRENGTH_MASK                             0x00000030L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR0__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR0__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR1__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR1__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR2__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR2__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR3__SEED__SHIFT                                                   0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_EDP_ASSR3__SEED_MASK                                                     0x007FFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS__SHIFT                                  0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL__SHIFT                              0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT__SHIFT                                    0xc
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME__SHIFT                                     0x10
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_PATTERNS_MASK                                    0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__PATTERN_INTERVAL_MASK                                0x00000FF0L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__NUM_REPEAT_MASK                                      0x0000F000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_SLEEP_CONFIG0__HOLD_TIME_MASK                                       0x00FF0000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD__SHIFT                                    0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_WAKE_CONFIG0__LOCK_PERIOD_MASK                                      0x0003FFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY__SHIFT                                         0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES__SHIFT                                    0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL__SLEEP_DELAY_MASK                                           0x0000007FL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_ALPM_CONTROL__MIN_SLEEP_CYCLES_MASK                                      0x000FFF00L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0__SHIFT                                           0x4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1__SHIFT                                             0x8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1__SHIFT                                           0xc
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2__SHIFT                                             0x10
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2__SHIFT                                           0x14
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3__SHIFT                                             0x18
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3__SHIFT                                           0x1c
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT0_MASK                                               0x00000007L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL0_MASK                                             0x00000070L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT1_MASK                                               0x00000700L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL1_MASK                                             0x00007000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT2_MASK                                               0x00070000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL2_MASK                                             0x00700000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_SELECT3_MASK                                               0x07000000L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CONFIG__TP_PRBS_SEL3_MASK                                             0x70000000L
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED0__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED1__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED2__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED__SHIFT                                       0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_PRBS_SEED3__TP_PRBS_SEED_MASK                                         0x7FFFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_SQ_PULSE
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH__SHIFT                                    0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_SQ_PULSE__TP_SQ_PULSE_WIDTH_MASK                                      0x000000FFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM0__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM1__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM2__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM3__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM4
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM4__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM5
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM5__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM6
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM6__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM7
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM7__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM8
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM8__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM9
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM__SHIFT                                             0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM9__TP_CUSTOM_MASK                                               0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM10
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM__SHIFT                                            0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_TP_CUSTOM10__TP_CUSTOM_MASK                                              0x00FFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT__SHIFT                                  0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS0__LLCP_COUNT_MASK                                    0x0000FFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT__SHIFT                                 0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_STATUS1__CYCLE_COUNT_MASK                                   0xFFFFFFFFL
+//DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE__SHIFT                           0x0
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET__SHIFT                            0x1
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE__SHIFT                          0x2
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET__SHIFT                           0x3
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_ENABLE_MASK                             0x00000001L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__LLCP_COUNT_RESET_MASK                              0x00000002L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_ENABLE_MASK                            0x00000004L
+#define DP_DPHY_SYM323_DP_DPHY_SYM32_SYMBOL_COUNT_CONTROL__CYCLE_COUNT_RESET_MASK                             0x00000008L
+
+
+// addressBlock: dce_dc_dchvm_hvm_dispdec
+//DCHVM_CTRL0
+#define DCHVM_CTRL0__HOSTVM_INIT_REQ__SHIFT                                                                   0x0
+#define DCHVM_CTRL0__HOSTVM_INIT_REQ_MASK                                                                     0x00000001L
+//DCHVM_CTRL1
+#define DCHVM_CTRL1__DUMMY1__SHIFT                                                                            0x0
+#define DCHVM_CTRL1__DUMMY1_MASK                                                                              0xFFFFFFFFL
+//DCHVM_CLK_CTRL
+#define DCHVM_CLK_CTRL__HVM_DISPCLK_R_GATE_DIS__SHIFT                                                         0x0
+#define DCHVM_CLK_CTRL__HVM_DISPCLK_G_GATE_DIS__SHIFT                                                         0x1
+#define DCHVM_CLK_CTRL__HVM_DCFCLK_R_GATE_DIS__SHIFT                                                          0x4
+#define DCHVM_CLK_CTRL__HVM_DCFCLK_G_GATE_DIS__SHIFT                                                          0x5
+#define DCHVM_CLK_CTRL__TR_REQ_REQCLKREQ_MODE__SHIFT                                                          0x8
+#define DCHVM_CLK_CTRL__TW_RSP_COMPCLKREQ_MODE__SHIFT                                                         0xa
+#define DCHVM_CLK_CTRL__HVM_FGCG_REP_DIS__SHIFT                                                               0xc
+#define DCHVM_CLK_CTRL__TW_RSP_COMPCLKCTL_MODE__SHIFT                                                         0xf
+#define DCHVM_CLK_CTRL__TW_REQ_CREDIT_DELAY__SHIFT                                                            0x14
+#define DCHVM_CLK_CTRL__FFBM_DCFCLK_R_GATE_DIS__SHIFT                                                         0x18
+#define DCHVM_CLK_CTRL__FFBM_DCFCLK_G_GATE_DIS__SHIFT                                                         0x19
+#define DCHVM_CLK_CTRL__HVM_DISPCLK_R_GATE_DIS_MASK                                                           0x00000001L
+#define DCHVM_CLK_CTRL__HVM_DISPCLK_G_GATE_DIS_MASK                                                           0x00000002L
+#define DCHVM_CLK_CTRL__HVM_DCFCLK_R_GATE_DIS_MASK                                                            0x00000010L
+#define DCHVM_CLK_CTRL__HVM_DCFCLK_G_GATE_DIS_MASK                                                            0x00000020L
+#define DCHVM_CLK_CTRL__TR_REQ_REQCLKREQ_MODE_MASK                                                            0x00000300L
+#define DCHVM_CLK_CTRL__TW_RSP_COMPCLKREQ_MODE_MASK                                                           0x00000C00L
+#define DCHVM_CLK_CTRL__HVM_FGCG_REP_DIS_MASK                                                                 0x00001000L
+#define DCHVM_CLK_CTRL__TW_RSP_COMPCLKCTL_MODE_MASK                                                           0x00008000L
+#define DCHVM_CLK_CTRL__TW_REQ_CREDIT_DELAY_MASK                                                              0x00F00000L
+#define DCHVM_CLK_CTRL__FFBM_DCFCLK_R_GATE_DIS_MASK                                                           0x01000000L
+#define DCHVM_CLK_CTRL__FFBM_DCFCLK_G_GATE_DIS_MASK                                                           0x02000000L
+//DCHVM_MEM_CTRL
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_PWR_REQ_DIS__SHIFT                                                       0x0
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_FORCE_REQ__SHIFT                                                         0x2
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_POWER_STATUS__SHIFT                                                      0x4
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_PWR_REQ_DIS__SHIFT                                                        0x8
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_FORCE_REQ__SHIFT                                                          0xa
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_POWER_STATUS__SHIFT                                                       0xc
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_PWR_REQ_DIS_MASK                                                         0x00000001L
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_FORCE_REQ_MASK                                                           0x0000000CL
+#define DCHVM_MEM_CTRL__HVM_GPUVMRET_POWER_STATUS_MASK                                                        0x00000030L
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_PWR_REQ_DIS_MASK                                                          0x00000100L
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_FORCE_REQ_MASK                                                            0x00000C00L
+#define DCHVM_MEM_CTRL__HVM_FFBMTLB_POWER_STATUS_MASK                                                         0x00003000L
+//DCHVM_RIOMMU_CTRL0
+#define DCHVM_RIOMMU_CTRL0__HOSTVM_PREFETCH_REQ__SHIFT                                                        0x0
+#define DCHVM_RIOMMU_CTRL0__HOSTVM_POWERSTATUS__SHIFT                                                         0x1
+#define DCHVM_RIOMMU_CTRL0__HOSTVM_PREFETCH_REQ_MASK                                                          0x00000001L
+#define DCHVM_RIOMMU_CTRL0__HOSTVM_POWERSTATUS_MASK                                                           0x00000002L
+//DCHVM_RIOMMU_STAT0
+#define DCHVM_RIOMMU_STAT0__RIOMMU_ACTIVE__SHIFT                                                              0x0
+#define DCHVM_RIOMMU_STAT0__HOSTVM_PREFETCH_DONE__SHIFT                                                       0x1
+#define DCHVM_RIOMMU_STAT0__RIOMMU_ACTIVE_MASK                                                                0x00000001L
+#define DCHVM_RIOMMU_STAT0__HOSTVM_PREFETCH_DONE_MASK                                                         0x00000002L
+//DCHVM_PREFETCH_VFID
+#define DCHVM_PREFETCH_VFID__HOSTVM_PREFETCH_VFID__SHIFT                                                      0x0
+#define DCHVM_PREFETCH_VFID__HOSTVM_PREFETCH_VFID_MASK                                                        0xFFFFFFFFL
+//DCHVM_VMID0_CTRL
+#define DCHVM_VMID0_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID0_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID0_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID0_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID1_CTRL
+#define DCHVM_VMID1_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID1_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID1_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID1_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID2_CTRL
+#define DCHVM_VMID2_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID2_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID2_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID2_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID3_CTRL
+#define DCHVM_VMID3_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID3_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID3_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID3_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID4_CTRL
+#define DCHVM_VMID4_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID4_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID4_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID4_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID5_CTRL
+#define DCHVM_VMID5_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID5_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID5_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID5_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID6_CTRL
+#define DCHVM_VMID6_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID6_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID6_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID6_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID7_CTRL
+#define DCHVM_VMID7_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID7_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID7_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID7_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID8_CTRL
+#define DCHVM_VMID8_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID8_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID8_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID8_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID9_CTRL
+#define DCHVM_VMID9_CTRL__VFID__SHIFT                                                                         0x0
+#define DCHVM_VMID9_CTRL__VF__SHIFT                                                                           0x7
+#define DCHVM_VMID9_CTRL__VFID_MASK                                                                           0x0000001FL
+#define DCHVM_VMID9_CTRL__VF_MASK                                                                             0x00000080L
+//DCHVM_VMID10_CTRL
+#define DCHVM_VMID10_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID10_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID10_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID10_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_VMID11_CTRL
+#define DCHVM_VMID11_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID11_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID11_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID11_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_VMID12_CTRL
+#define DCHVM_VMID12_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID12_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID12_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID12_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_VMID13_CTRL
+#define DCHVM_VMID13_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID13_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID13_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID13_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_VMID14_CTRL
+#define DCHVM_VMID14_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID14_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID14_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID14_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_VMID15_CTRL
+#define DCHVM_VMID15_CTRL__VFID__SHIFT                                                                        0x0
+#define DCHVM_VMID15_CTRL__VF__SHIFT                                                                          0x7
+#define DCHVM_VMID15_CTRL__VFID_MASK                                                                          0x0000001FL
+#define DCHVM_VMID15_CTRL__VF_MASK                                                                            0x00000080L
+//DCHVM_FFBM_ACCESS_CNTL
+#define DCHVM_FFBM_ACCESS_CNTL__TLB_ACCESS_GRANT__SHIFT                                                       0x0
+#define DCHVM_FFBM_ACCESS_CNTL__TLB_ACCESS_REQ__SHIFT                                                         0x1
+#define DCHVM_FFBM_ACCESS_CNTL__TLB_ACCESS_GRANT_MASK                                                         0x00000001L
+#define DCHVM_FFBM_ACCESS_CNTL__TLB_ACCESS_REQ_MASK                                                           0x00000002L
+//DCHVM_FFBM_ADDRESS_HI
+#define DCHVM_FFBM_ADDRESS_HI__ADDRESS__SHIFT                                                                 0x0
+#define DCHVM_FFBM_ADDRESS_HI__ADDRESS_MASK                                                                   0x007FFFFFL
+//DCHVM_FFBM_ADDRESS_LO
+#define DCHVM_FFBM_ADDRESS_LO__READ__SHIFT                                                                    0x0
+#define DCHVM_FFBM_ADDRESS_LO__VFID__SHIFT                                                                    0x2
+#define DCHVM_FFBM_ADDRESS_LO__ADDRESS__SHIFT                                                                 0x18
+#define DCHVM_FFBM_ADDRESS_LO__READ_MASK                                                                      0x00000001L
+#define DCHVM_FFBM_ADDRESS_LO__VFID_MASK                                                                      0x0000007CL
+#define DCHVM_FFBM_ADDRESS_LO__ADDRESS_MASK                                                                   0xFF000000L
+//DCHVM_FFBM_CONFIG
+#define DCHVM_FFBM_CONFIG__TLB_PAGE_SIZE__SHIFT                                                               0x0
+#define DCHVM_FFBM_CONFIG__TLB_PAGE_SIZE_MASK                                                                 0x0000003FL
+//DCHVM_FFBM_ENABLE_CNTL
+#define DCHVM_FFBM_ENABLE_CNTL__FFBM_ENABLE__SHIFT                                                            0x0
+#define DCHVM_FFBM_ENABLE_CNTL__FFBM_ENABLE_MASK                                                              0x00000001L
+//DCHVM_FFBM_DATA_HI
+#define DCHVM_FFBM_DATA_HI__FB_SPA__SHIFT                                                                     0x0
+#define DCHVM_FFBM_DATA_HI__FB_SPA_MASK                                                                       0x007FFFFFL
+//DCHVM_FFBM_DATA_LO
+#define DCHVM_FFBM_DATA_LO__VALID__SHIFT                                                                      0x0
+#define DCHVM_FFBM_DATA_LO__READ_PERMISSION__SHIFT                                                            0x1
+#define DCHVM_FFBM_DATA_LO__WRITE_PERMISSION__SHIFT                                                           0x2
+#define DCHVM_FFBM_DATA_LO__FRAGMENT__SHIFT                                                                   0x6
+#define DCHVM_FFBM_DATA_LO__FB_SPA__SHIFT                                                                     0x18
+#define DCHVM_FFBM_DATA_LO__VALID_MASK                                                                        0x00000001L
+#define DCHVM_FFBM_DATA_LO__READ_PERMISSION_MASK                                                              0x00000002L
+#define DCHVM_FFBM_DATA_LO__WRITE_PERMISSION_MASK                                                             0x00000004L
+#define DCHVM_FFBM_DATA_LO__FRAGMENT_MASK                                                                     0x00000FC0L
+#define DCHVM_FFBM_DATA_LO__FB_SPA_MASK                                                                       0xFF000000L
+//DCHVM_FFBM_INVALIDATE_REQ
+#define DCHVM_FFBM_INVALIDATE_REQ__REQUEST__SHIFT                                                             0x0
+#define DCHVM_FFBM_INVALIDATE_REQ__VFID__SHIFT                                                                0x1
+#define DCHVM_FFBM_INVALIDATE_REQ__REQUEST_MASK                                                               0x00000001L
+#define DCHVM_FFBM_INVALIDATE_REQ__VFID_MASK                                                                  0xFFFFFFFEL
+//DCHVM_FFBM_INVALIDATE_RSP
+#define DCHVM_FFBM_INVALIDATE_RSP__ACK__SHIFT                                                                 0x0
+#define DCHVM_FFBM_INVALIDATE_RSP__ACK_MASK                                                                   0x00000001L
+//DCHVM_VM_FB_OFFSET
+#define DCHVM_VM_FB_OFFSET__FB_OFFSET__SHIFT                                                                  0x0
+#define DCHVM_VM_FB_OFFSET__FB_OFFSET_MASK                                                                    0x0FFFFFFFL
+//DCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF0_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF1_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF2_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF3_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF4_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF5_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF6_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF7_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF8_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL__VF_FB_SIZE__SHIFT                                                   0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL__VF_FB_OFFSET__SHIFT                                                 0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL__VF_FB_SIZE_MASK                                                     0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF9_CTRL__VF_FB_OFFSET_MASK                                                   0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF10_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF11_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF12_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF13_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF14_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF15_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF16_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF17_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF18_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF19_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF20_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF21_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF22_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF23_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF24_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF25_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF26_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF27_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF28_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF29_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL__VF_FB_SIZE__SHIFT                                                  0x0
+#define DCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL__VF_FB_OFFSET__SHIFT                                                0x10
+#define DCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL__VF_FB_SIZE_MASK                                                    0x0000FFFFL
+#define DCHVM_VM_FB_SIZE_OFFSET_VF30_CTRL__VF_FB_OFFSET_MASK                                                  0xFFFF0000L
+//DCHVM_FFBM_DEBUG_CNTL
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_INDEX__SHIFT                                                               0x0
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_READ__SHIFT                                                                0x14
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_DIRECT_DEBUG_SEL__SHIFT                                                    0x1c
+#define DCHVM_FFBM_DEBUG_CNTL__FFBM_PREFETCH_VFID_MODE__SHIFT                                                 0x1e
+#define DCHVM_FFBM_DEBUG_CNTL__FFBM_EN_TO_HUBP__SHIFT                                                         0x1f
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_INDEX_MASK                                                                 0x00007FFFL
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_READ_MASK                                                                  0x00100000L
+#define DCHVM_FFBM_DEBUG_CNTL__TLB_DIRECT_DEBUG_SEL_MASK                                                      0x30000000L
+#define DCHVM_FFBM_DEBUG_CNTL__FFBM_PREFETCH_VFID_MODE_MASK                                                   0x40000000L
+#define DCHVM_FFBM_DEBUG_CNTL__FFBM_EN_TO_HUBP_MASK                                                           0x80000000L
+//DCHVM_FFBM_TLB_DEBUG_DATA
+#define DCHVM_FFBM_TLB_DEBUG_DATA__TLB_DEBUG_DATA__SHIFT                                                      0x0
+#define DCHVM_FFBM_TLB_DEBUG_DATA__FFBM_INVALIDATION_ACK__SHIFT                                               0x1f
+#define DCHVM_FFBM_TLB_DEBUG_DATA__TLB_DEBUG_DATA_MASK                                                        0x00FFFFFFL
+#define DCHVM_FFBM_TLB_DEBUG_DATA__FFBM_INVALIDATION_ACK_MASK                                                 0x80000000L
+//DCHVM_DEBUG_CTRL0
+#define DCHVM_DEBUG_CTRL0__DCHVM_DBG_EN__SHIFT                                                                0x0
+#define DCHVM_DEBUG_CTRL0__DCHVM_DCFCLK_DBG_DIRECT_OUT_SEL__SHIFT                                             0x4
+#define DCHVM_DEBUG_CTRL0__DCHVM_DBG_EN_MASK                                                                  0x00000001L
+#define DCHVM_DEBUG_CTRL0__DCHVM_DCFCLK_DBG_DIRECT_OUT_SEL_MASK                                               0x000000F0L
+//DCHVM_TEST_DEBUG_INDEX
+#define DCHVM_TEST_DEBUG_INDEX__DCHVM_TEST_DEBUG_INDEX__SHIFT                                                 0x0
+#define DCHVM_TEST_DEBUG_INDEX__DCHVM_TEST_DEBUG_INDEX_MASK                                                   0x000000FFL
+//DCHVM_TEST_DEBUG_DATA
+#define DCHVM_TEST_DEBUG_DATA__DCHVM_TEST_DEBUG_DATA__SHIFT                                                   0x0
+#define DCHVM_TEST_DEBUG_DATA__DCHVM_TEST_DEBUG_DATA_MASK                                                     0xFFFFFFFFL
+
+
+// addressBlock: azendpoint_f2codecind
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT                         0x0
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT                            0x4
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT                        0x8
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT                       0xb
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT                           0xe
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                                0xf
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK                           0x0000000FL
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                              0x00000070L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK                          0x00000700L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK                         0x00003800L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK                             0x00004000L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                                  0x00008000L
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                                0x0
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                                 0x4
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                                  0x0000000FL
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                                   0x000000F0L
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                                     0x0
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                                         0x1
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                                      0x2
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                                       0x3
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                                      0x4
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                                 0x5
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                                       0x6
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                                         0x7
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                                        0x8
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                                 0x17
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                                       0x00000001L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                                           0x00000002L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                                        0x00000004L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                                         0x00000008L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                                        0x00000010L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                                   0x00000020L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                                         0x00000040L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                                           0x00000080L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                                          0x00007F00L
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                                   0x00800000L
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_2
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_2__CC__SHIFT                                      0x0
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_2__CC_MASK                                        0x0000007FL
+//AZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                                       0x0
+#define AZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                                    0x14
+#define AZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                                         0x00000003L
+#define AZALIA_F2_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                                      0x00700000L
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_3
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_3__KEEPALIVE__SHIFT                               0x7
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER_3__KEEPALIVE_MASK                                 0x00000080L
+//AZALIA_F2_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                                         0x0
+#define AZALIA_F2_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                                           0x000000FFL
+//AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT      0x0
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT         0x1
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT        0x2
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT    0x3
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT                 0x4
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                          0x5
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT               0x6
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT                 0x8
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                         0x9
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT                   0xa
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                         0xb
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                            0x14
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK        0x00000001L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK           0x00000002L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK          0x00000004L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK      0x00000008L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK                   0x00000010L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                            0x00000020L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK                 0x00000040L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK   0x00000080L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK                   0x00000100L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                           0x00000200L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK                     0x00000400L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                           0x00000800L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK   0x000F0000L
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                              0x00F00000L
+//AZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT              0x0
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT               0x10
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK                0x00000FFFL
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK                 0x001F0000L
+//AZALIA_F2_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT                             0x0
+#define AZALIA_F2_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                               0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONNECTION_LIST_ENTRY
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONNECTION_LIST_ENTRY__CONNECTION_LIST_ENTRY__SHIFT              0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONNECTION_LIST_ENTRY__CONNECTION_LIST_ENTRY_MASK                0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZALIA_F2_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                                         0x6
+#define AZALIA_F2_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                                           0x00000040L
+//AZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                                          0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                                       0x7
+#define AZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                                            0x0000003FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                                         0x00000080L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                                0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__PRESENCE_DETECT__SHIFT                                0x1f
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                                  0x7FFFFFFFL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__PRESENCE_DETECT_MASK                                  0x80000000L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT                           0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT                0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                               0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                              0xc
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT                    0x10
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT                     0x14
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT                           0x18
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT                  0x1e
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK                             0x0000000FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK                  0x000000F0L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                                 0x00000F00L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                                0x0000F000L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK                      0x000F0000L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK                       0x00F00000L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK                             0x3F000000L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK                    0xC0000000L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2__MISC__SHIFT                             0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2__COLOR__SHIFT                            0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2__MISC_MASK                               0x0000000FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_2__COLOR_MASK                              0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3__CONNECTION_TYPE__SHIFT                  0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3__DEFAULT_DEVICE__SHIFT                   0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3__CONNECTION_TYPE_MASK                    0x0000000FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_3__DEFAULT_DEVICE_MASK                     0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4__LOCATION__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4__PORT_CONNECTIVITY__SHIFT                0x6
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4__LOCATION_MASK                           0x0000003FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT_4__PORT_CONNECTIVITY_MASK                  0x000000C0L
+//AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__SPEAKER_ALLOCATION__SHIFT                    0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__HDMI_CONNECTION__SHIFT                       0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__DP_CONNECTION__SHIFT                         0x9
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__EXTRA_CONNECTION_INFO__SHIFT                 0xa
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__SPEAKER_ALLOCATION_MASK                      0x0000007FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__HDMI_CONNECTION_MASK                         0x00000100L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__DP_CONNECTION_MASK                           0x00000200L
+#define AZALIA_F2_CODEC_PIN_CONTROL_RESPONSE_SPEAKER_ALLOCATION__EXTRA_CONNECTION_INFO_MASK                   0x0000FC00L
+//AZALIA_F2_CODEC_PIN_CONTROL_CHANNEL_ALLOCATION
+#define AZALIA_F2_CODEC_PIN_CONTROL_CHANNEL_ALLOCATION__CHANNEL_ALLOCATION__SHIFT                             0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_CHANNEL_ALLOCATION__CHANNEL_ALLOCATION_MASK                               0x000000FFL
+//AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__LFE_PLAYBACK_LEVEL__SHIFT                                  0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__LEVEL_SHIFT__SHIFT                                         0x3
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__DOWN_MIX_INHIBIT__SHIFT                                    0x7
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__LFE_PLAYBACK_LEVEL_MASK                                    0x00000003L
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__LEVEL_SHIFT_MASK                                           0x00000078L
+#define AZALIA_F2_CODEC_PIN_CONTROL_DOWN_MIX_INFO__DOWN_MIX_INHIBIT_MASK                                      0x00000080L
+//AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__ACP_INDEX__SHIFT                                               0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__SUPPORTS_AI__SHIFT                                             0x6
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__ACP_PACKET_ENABLE__SHIFT                                       0x7
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__ACP_INDEX_MASK                                                 0x0000003FL
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__SUPPORTS_AI_MASK                                               0x00000040L
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_INDEX__ACP_PACKET_ENABLE_MASK                                         0x00000080L
+//AZALIA_F2_CODEC_PIN_CONTROL_ACP_DATA
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_DATA__ACP_DATA__SHIFT                                                 0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_ACP_DATA__ACP_DATA_MASK                                                   0x000000FFL
+//AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__MAX_CHANNELS__SHIFT                                     0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__FORMAT_CODE__SHIFT                                      0x3
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__SUPPORTED_FREQUENCIES__SHIFT                            0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__DESCRIPTOR_BYTE_2__SHIFT                                0x10
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__SUPPORTED_FREQUENCIES_STEREO__SHIFT                     0x18
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__MAX_CHANNELS_MASK                                       0x00000007L
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__FORMAT_CODE_MASK                                        0x00000078L
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__SUPPORTED_FREQUENCIES_MASK                              0x0000FF00L
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__DESCRIPTOR_BYTE_2_MASK                                  0x00FF0000L
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR__SUPPORTED_FREQUENCIES_STEREO_MASK                       0xFF000000L
+//AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR_DATA
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR_DATA__DESCRIPTOR__SHIFT                                  0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR_DATA__DESCRIPTOR_MASK                                    0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_ENABLE__SHIFT                       0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_MUTE__SHIFT                         0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT                   0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_ENABLE_MASK                         0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_MUTE_MASK                           0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL01_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK                     0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_ENABLE__SHIFT                       0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_MUTE__SHIFT                         0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT                   0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_ENABLE_MASK                         0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_MUTE_MASK                           0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL23_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK                     0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_ENABLE__SHIFT                       0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_MUTE__SHIFT                         0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT                   0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_ENABLE_MASK                         0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_MUTE_MASK                           0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL45_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK                     0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_ENABLE__SHIFT                       0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_MUTE__SHIFT                         0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT                   0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_ENABLE_MASK                         0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_MUTE_MASK                           0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL67_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK                     0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC
+#define AZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC__VIDEO_LIPSYNC__SHIFT                                             0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC__AUDIO_LIPSYNC__SHIFT                                             0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC__VIDEO_LIPSYNC_MASK                                               0x000000FFL
+#define AZALIA_F2_CODEC_PIN_CONTROL_LIPSYNC__AUDIO_LIPSYNC_MASK                                               0x0000FF00L
+//AZALIA_F2_CODEC_PIN_CONTROL_HBR
+#define AZALIA_F2_CODEC_PIN_CONTROL_HBR__HBR_CAPABLE__SHIFT                                                   0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_HBR__HBR_ENABLE__SHIFT                                                    0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_HBR__HBR_CAPABLE_MASK                                                     0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_HBR__HBR_ENABLE_MASK                                                      0x00000010L
+//AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_INDEX
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_INDEX__SINK_INFO_INDEX__SHIFT                             0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_INDEX__SINK_INFO_INDEX_MASK                               0x000000FFL
+//AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_DATA
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_DATA__SINK_DATA__SHIFT                                    0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_AUDIO_SINK_INFO_DATA__SINK_DATA_MASK                                      0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_ENABLE__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_MUTE__SHIFT                           0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_CHANNEL_ID__SHIFT                     0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_ENABLE_MASK                           0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_MUTE_MASK                             0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL1_ENABLE__MULTICHANNEL1_CHANNEL_ID_MASK                       0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_ENABLE__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_MUTE__SHIFT                           0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_CHANNEL_ID__SHIFT                     0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_ENABLE_MASK                           0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_MUTE_MASK                             0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL3_ENABLE__MULTICHANNEL3_CHANNEL_ID_MASK                       0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_ENABLE__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_MUTE__SHIFT                           0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_CHANNEL_ID__SHIFT                     0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_ENABLE_MASK                           0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_MUTE_MASK                             0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL5_ENABLE__MULTICHANNEL5_CHANNEL_ID_MASK                       0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_ENABLE__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_MUTE__SHIFT                           0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_CHANNEL_ID__SHIFT                     0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_ENABLE_MASK                           0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_MUTE_MASK                             0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL7_ENABLE__MULTICHANNEL7_CHANNEL_ID_MASK                       0x000000F0L
+//AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                               0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                                 0x00000001L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                                   0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT                          0x2
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                                     0x00000003L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK                            0x0000003CL
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT                         0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT                0x2
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT                            0x3
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT                   0x7
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK                           0x00000003L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK                  0x00000004L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                              0x00000078L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK                     0x00000080L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT                     0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT            0x6
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK                       0x0000003FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK              0x00000040L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT            0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT   0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK              0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK     0x00000010L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT               0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT                     0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                                 0x5
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT                           0x7
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK                 0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK                       0x00000010L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                                   0x00000060L
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK                             0x00000080L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT                       0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT                       0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK                         0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK                         0x000000F0L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT                       0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT                       0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK                         0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK                         0x000000F0L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT                       0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT                       0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK                         0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK                         0x000000F0L
+//AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT                       0x0
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT                       0x4
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK                         0x0000000FL
+#define AZALIA_F2_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK                         0x000000F0L
+//AZALIA_F2_CODEC_PIN_ASSOCIATION_INFO
+#define AZALIA_F2_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                                         0x0
+#define AZALIA_F2_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                                           0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZALIA_F2_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                               0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                                 0x00000001L
+//AZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT                          0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT                    0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK                            0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK                      0x0000FF00L
+//AZALIA_F2_CODEC_PIN_CONTROL_LPIB
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                                           0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT                           0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK                             0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZALIA_F2_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                                           0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                                             0x000000FFL
+//AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                                     0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT                       0x1
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                               0x8
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT                             0x10
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                                       0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK                         0x00000002L
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                                 0x0000FF00L
+#define AZALIA_F2_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                               0x00FF0000L
+//AZALIA_F2_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZALIA_F2_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT   0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK     0x00000003L
+//AZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT                     0x4
+#define AZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK                           0x00000001L
+#define AZALIA_F2_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK                       0x00000010L
+//AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT            0x0
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT               0x1
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT              0x2
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT          0x3
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                                0x5
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT                     0x6
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT       0x7
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT                       0x8
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                               0x9
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT                         0xa
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                               0xb
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT       0x10
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                                  0x14
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK              0x00000001L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK                 0x00000002L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK                0x00000004L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK            0x00000008L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                                  0x00000020L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK                       0x00000040L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK         0x00000080L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK                         0x00000100L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                                 0x00000200L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK                           0x00000400L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                                 0x00000800L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK         0x000F0000L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                                    0x00F00000L
+//AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT                            0x0
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                                   0x1
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT                          0x2
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT                            0x3
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                                     0x4
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                                      0x5
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                                  0x6
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                               0x7
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                                       0x8
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                                       0x10
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                                 0x18
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                              0x00000001L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                                     0x00000002L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK                            0x00000004L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                              0x00000008L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                                       0x00000010L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                                        0x00000020L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                                    0x00000040L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                                 0x00000080L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                                         0x0000FF00L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                                         0x00010000L
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                                   0x01000000L
+//AZALIA_F2_CODEC_PIN_PARAMETER_CONNECTION_LIST_LENGTH
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CONNECTION_LIST_LENGTH__CONNECTION_LIST_LENGTH__SHIFT                   0x0
+#define AZALIA_F2_CODEC_PIN_PARAMETER_CONNECTION_LIST_LENGTH__CONNECTION_LIST_LENGTH_MASK                     0xFFFFFFFFL
+
+
+// addressBlock: azendpoint_descriptorind
+//AUDIO_DESCRIPTOR0
+#define AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR1
+#define AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR2
+#define AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR3
+#define AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR4
+#define AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR5
+#define AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR6
+#define AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR7
+#define AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR8
+#define AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR9
+#define AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                                                                0x0
+#define AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT                                                       0x8
+#define AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                                                           0x10
+#define AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                                0x18
+#define AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                                                                  0x00000007L
+#define AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK                                                         0x0000FF00L
+#define AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                                                             0x00FF0000L
+#define AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_STEREO_MASK                                                  0xFF000000L
+//AUDIO_DESCRIPTOR10
+#define AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                                                               0x0
+#define AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT                                                      0x8
+#define AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                                                          0x10
+#define AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                               0x18
+#define AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                                                                 0x00000007L
+#define AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK                                                        0x0000FF00L
+#define AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                                                            0x00FF0000L
+#define AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_STEREO_MASK                                                 0xFF000000L
+//AUDIO_DESCRIPTOR11
+#define AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                                                               0x0
+#define AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT                                                      0x8
+#define AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                                                          0x10
+#define AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                               0x18
+#define AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                                                                 0x00000007L
+#define AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK                                                        0x0000FF00L
+#define AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                                                            0x00FF0000L
+#define AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_STEREO_MASK                                                 0xFF000000L
+//AUDIO_DESCRIPTOR12
+#define AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                                                               0x0
+#define AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT                                                      0x8
+#define AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                                                          0x10
+#define AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                               0x18
+#define AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                                                                 0x00000007L
+#define AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK                                                        0x0000FF00L
+#define AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                                                            0x00FF0000L
+#define AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_STEREO_MASK                                                 0xFF000000L
+//AUDIO_DESCRIPTOR13
+#define AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                                                               0x0
+#define AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT                                                      0x8
+#define AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                                                          0x10
+#define AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_STEREO__SHIFT                                               0x18
+#define AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                                                                 0x00000007L
+#define AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK                                                        0x0000FF00L
+#define AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                                                            0x00FF0000L
+#define AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_STEREO_MASK                                                 0xFF000000L
+
+
+// addressBlock: azendpoint_sinkinfoind
+//AZALIA_F2_CODEC_PIN_CONTROL_MANUFACTURER_ID
+#define AZALIA_F2_CODEC_PIN_CONTROL_MANUFACTURER_ID__MANUFACTURER_ID__SHIFT                                   0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_MANUFACTURER_ID__MANUFACTURER_ID_MASK                                     0x0000FFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_PRODUCT_ID
+#define AZALIA_F2_CODEC_PIN_CONTROL_PRODUCT_ID__PRODUCT_ID__SHIFT                                             0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_PRODUCT_ID__PRODUCT_ID_MASK                                               0x0000FFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_SINK_DESCRIPTION_LEN
+#define AZALIA_F2_CODEC_PIN_CONTROL_SINK_DESCRIPTION_LEN__SINK_DESCRIPTION_LEN__SHIFT                         0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_SINK_DESCRIPTION_LEN__SINK_DESCRIPTION_LEN_MASK                           0x000000FFL
+//AZALIA_F2_CODEC_PIN_CONTROL_PORTID0
+#define AZALIA_F2_CODEC_PIN_CONTROL_PORTID0__PORTID__SHIFT                                                    0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_PORTID0__PORTID_MASK                                                      0xFFFFFFFFL
+//AZALIA_F2_CODEC_PIN_CONTROL_PORTID1
+#define AZALIA_F2_CODEC_PIN_CONTROL_PORTID1__PORTID__SHIFT                                                    0x0
+#define AZALIA_F2_CODEC_PIN_CONTROL_PORTID1__PORTID_MASK                                                      0xFFFFFFFFL
+//SINK_DESCRIPTION0
+#define SINK_DESCRIPTION0__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION0__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION1
+#define SINK_DESCRIPTION1__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION1__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION2
+#define SINK_DESCRIPTION2__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION2__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION3
+#define SINK_DESCRIPTION3__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION3__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION4
+#define SINK_DESCRIPTION4__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION4__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION5
+#define SINK_DESCRIPTION5__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION5__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION6
+#define SINK_DESCRIPTION6__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION6__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION7
+#define SINK_DESCRIPTION7__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION7__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION8
+#define SINK_DESCRIPTION8__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION8__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION9
+#define SINK_DESCRIPTION9__DESCRIPTION__SHIFT                                                                 0x0
+#define SINK_DESCRIPTION9__DESCRIPTION_MASK                                                                   0x000000FFL
+//SINK_DESCRIPTION10
+#define SINK_DESCRIPTION10__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION10__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION11
+#define SINK_DESCRIPTION11__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION11__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION12
+#define SINK_DESCRIPTION12__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION12__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION13
+#define SINK_DESCRIPTION13__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION13__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION14
+#define SINK_DESCRIPTION14__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION14__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION15
+#define SINK_DESCRIPTION15__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION15__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION16
+#define SINK_DESCRIPTION16__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION16__DESCRIPTION_MASK                                                                  0x000000FFL
+//SINK_DESCRIPTION17
+#define SINK_DESCRIPTION17__DESCRIPTION__SHIFT                                                                0x0
+#define SINK_DESCRIPTION17__DESCRIPTION_MASK                                                                  0x000000FFL
+
+
+// addressBlock: azroot_f2codecind
+//AZALIA_F2_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__AZALIA_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__SHIFT  0x0
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID__AZALIA_CODEC_ROOT_PARAMETER_VENDOR_AND_DEVICE_ID_MASK  0xFFFFFFFFL
+//AZALIA_F2_CODEC_ROOT_PARAMETER_REVISION_ID
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_REVISION_ID__AZALIA_CODEC_ROOT_PARAMETER_REVISION_ID__SHIFT            0x0
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_REVISION_ID__AZALIA_CODEC_ROOT_PARAMETER_REVISION_ID_MASK              0xFFFFFFFFL
+//AZALIA_F2_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT__AZALIA_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT__SHIFT  0x0
+#define AZALIA_F2_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT__AZALIA_CODEC_ROOT_PARAMETER_SUBORDINATE_NODE_COUNT_MASK  0xFFFFFFFFL
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SET__SHIFT                                  0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_ACT__SHIFT                                  0x4
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__CLKSTOPOK__SHIFT                                        0x9
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SETTINGS_RESET__SHIFT                       0xa
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SET_MASK                                    0x0000000FL
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_ACT_MASK                                    0x000000F0L
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__CLKSTOPOK_MASK                                          0x00000200L
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_POWER_STATE__POWER_STATE_SETTINGS_RESET_MASK                         0x00000400L
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE0__SHIFT                     0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE1__SHIFT                     0x8
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE2__SHIFT                     0x10
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE3__SHIFT                     0x18
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE0_MASK                       0x000000FFL
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE1_MASK                       0x0000FF00L
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE2_MASK                       0x00FF0000L
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID__SUBSYSTEM_ID_BYTE3_MASK                       0xFF000000L
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_2
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_2__SUBSYSTEM_ID_BYTE1__SHIFT                   0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_2__SUBSYSTEM_ID_BYTE1_MASK                     0x000000FFL
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_3
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_3__SUBSYSTEM_ID_BYTE2__SHIFT                   0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_3__SUBSYSTEM_ID_BYTE2_MASK                     0x000000FFL
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_4
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_4__SUBSYSTEM_ID_BYTE3__SHIFT                   0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESPONSE_SUBSYSTEM_ID_4__SUBSYSTEM_ID_BYTE3_MASK                     0x000000FFL
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION__CONVERTER_SYNCHRONIZATION__SHIFT          0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_CONVERTER_SYNCHRONIZATION__CONVERTER_SYNCHRONIZATION_MASK            0x000000FFL
+//AZALIA_F2_CODEC_FUNCTION_CONTROL_RESET
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESET__CODEC_RESET__SHIFT                                            0x0
+#define AZALIA_F2_CODEC_FUNCTION_CONTROL_RESET__CODEC_RESET_MASK                                              0x00000001L
+//AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT__AZALIA_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT__SHIFT  0x0
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT__AZALIA_CODEC_FUNCTION_PARAMETER_SUBORDINATE_NODE_COUNT_MASK  0xFFFFFFFFL
+//AZALIA_F2_CODEC_FUNCTION_PARAMETER_GROUP_TYPE
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__AZALIA_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__SHIFT      0x0
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_GROUP_TYPE__AZALIA_CODEC_FUNCTION_PARAMETER_GROUP_TYPE_MASK        0xFFFFFFFFL
+//AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT               0x0
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT                0x10
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK                 0x00000FFFL
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK                  0x001F0000L
+//AZALIA_F2_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__AZALIA_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__SHIFT  0x0
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS__AZALIA_CODEC_FUNCTION_PARAMETER_STREAM_FORMATS_MASK  0xFFFFFFFFL
+//AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__AZALIA_CODEC_FUNCTION_PARAMETER_POWER_STATES__SHIFT  0x0
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__CLKSTOP__SHIFT                                       0x1e
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__EPSS__SHIFT                                          0x1f
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__AZALIA_CODEC_FUNCTION_PARAMETER_POWER_STATES_MASK    0x3FFFFFFFL
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__CLKSTOP_MASK                                         0x40000000L
+#define AZALIA_F2_CODEC_FUNCTION_PARAMETER_POWER_STATES__EPSS_MASK                                            0x80000000L
+
+
+// addressBlock: azf0stream0_streamind
+//AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM0_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM0_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM0_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM0_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM0_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM0_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM0_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM0_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM0_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM0_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM0_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM0_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM0_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM0_AZALIA_STREAM_DEBUG
+#define AZF0STREAM0_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM0_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream1_streamind
+//AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM1_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM1_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM1_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM1_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM1_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM1_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM1_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM1_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM1_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM1_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM1_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM1_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM1_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM1_AZALIA_STREAM_DEBUG
+#define AZF0STREAM1_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM1_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream2_streamind
+//AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM2_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM2_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM2_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM2_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM2_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM2_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM2_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM2_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM2_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM2_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM2_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM2_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM2_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM2_AZALIA_STREAM_DEBUG
+#define AZF0STREAM2_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM2_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream3_streamind
+//AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM3_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM3_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM3_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM3_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM3_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM3_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM3_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM3_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM3_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM3_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM3_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM3_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM3_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM3_AZALIA_STREAM_DEBUG
+#define AZF0STREAM3_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM3_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream4_streamind
+//AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM4_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM4_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM4_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM4_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM4_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM4_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM4_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM4_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM4_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM4_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM4_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM4_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM4_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM4_AZALIA_STREAM_DEBUG
+#define AZF0STREAM4_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM4_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream5_streamind
+//AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM5_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM5_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM5_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM5_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM5_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM5_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM5_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM5_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM5_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM5_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM5_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM5_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM5_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM5_AZALIA_STREAM_DEBUG
+#define AZF0STREAM5_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM5_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream6_streamind
+//AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM6_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM6_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM6_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM6_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM6_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM6_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM6_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM6_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM6_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM6_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM6_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM6_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM6_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM6_AZALIA_STREAM_DEBUG
+#define AZF0STREAM6_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM6_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream7_streamind
+//AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM7_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM7_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM7_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM7_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM7_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM7_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM7_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM7_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM7_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM7_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM7_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM7_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM7_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM7_AZALIA_STREAM_DEBUG
+#define AZF0STREAM7_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM7_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream8_streamind
+//AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM8_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM8_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM8_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM8_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM8_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM8_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM8_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM8_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM8_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM8_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM8_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM8_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM8_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM8_AZALIA_STREAM_DEBUG
+#define AZF0STREAM8_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM8_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream9_streamind
+//AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                            0x0
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                            0x8
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                      0x10
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                              0x0000007FL
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                              0x00007F00L
+#define AZF0STREAM9_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                        0x00FF0000L
+//AZF0STREAM9_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM9_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                       0x0
+#define AZF0STREAM9_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                         0x00000001L
+//AZF0STREAM9_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM9_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                     0x0
+#define AZF0STREAM9_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                       0xFFFFFFFFL
+//AZF0STREAM9_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM9_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                   0x0
+#define AZF0STREAM9_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM9_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM9_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                   0x0
+#define AZF0STREAM9_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                     0xFFFFFFFFL
+//AZF0STREAM9_AZALIA_STREAM_DEBUG
+#define AZF0STREAM9_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                             0x0
+#define AZF0STREAM9_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                               0xFFFFFFFFL
+
+
+// addressBlock: azf0stream10_streamind
+//AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM10_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM10_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM10_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM10_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM10_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM10_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM10_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM10_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM10_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM10_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM10_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM10_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM10_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM10_AZALIA_STREAM_DEBUG
+#define AZF0STREAM10_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM10_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0stream11_streamind
+//AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM11_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM11_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM11_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM11_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM11_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM11_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM11_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM11_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM11_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM11_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM11_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM11_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM11_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM11_AZALIA_STREAM_DEBUG
+#define AZF0STREAM11_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM11_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0stream12_streamind
+//AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM12_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM12_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM12_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM12_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM12_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM12_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM12_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM12_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM12_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM12_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM12_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM12_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM12_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM12_AZALIA_STREAM_DEBUG
+#define AZF0STREAM12_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM12_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0stream13_streamind
+//AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM13_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM13_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM13_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM13_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM13_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM13_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM13_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM13_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM13_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM13_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM13_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM13_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM13_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM13_AZALIA_STREAM_DEBUG
+#define AZF0STREAM13_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM13_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0stream14_streamind
+//AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM14_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM14_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM14_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM14_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM14_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM14_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM14_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM14_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM14_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM14_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM14_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM14_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM14_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM14_AZALIA_STREAM_DEBUG
+#define AZF0STREAM14_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM14_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0stream15_streamind
+//AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE__SHIFT                                           0x0
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE__SHIFT                                           0x8
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT__SHIFT                                     0x10
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MIN_FIFO_SIZE_MASK                                             0x0000007FL
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MAX_FIFO_SIZE_MASK                                             0x00007F00L
+#define AZF0STREAM15_AZALIA_FIFO_SIZE_CONTROL__MAX_LATENCY_SUPPORT_MASK                                       0x00FF0000L
+//AZF0STREAM15_AZALIA_LATENCY_COUNTER_CONTROL
+#define AZF0STREAM15_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET__SHIFT                      0x0
+#define AZF0STREAM15_AZALIA_LATENCY_COUNTER_CONTROL__AZALIA_LATENCY_COUNTER_RESET_MASK                        0x00000001L
+//AZF0STREAM15_AZALIA_WORSTCASE_LATENCY_COUNT
+#define AZF0STREAM15_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT__SHIFT                    0x0
+#define AZF0STREAM15_AZALIA_WORSTCASE_LATENCY_COUNT__AZALIA_WORSTCASE_LATENCY_COUNT_MASK                      0xFFFFFFFFL
+//AZF0STREAM15_AZALIA_CUMULATIVE_LATENCY_COUNT
+#define AZF0STREAM15_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT__SHIFT                  0x0
+#define AZF0STREAM15_AZALIA_CUMULATIVE_LATENCY_COUNT__AZALIA_CUMULATIVE_LATENCY_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM15_AZALIA_CUMULATIVE_REQUEST_COUNT
+#define AZF0STREAM15_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT__SHIFT                  0x0
+#define AZF0STREAM15_AZALIA_CUMULATIVE_REQUEST_COUNT__AZALIA_CUMULATIVE_REQUEST_COUNT_MASK                    0xFFFFFFFFL
+//AZF0STREAM15_AZALIA_STREAM_DEBUG
+#define AZF0STREAM15_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA__SHIFT                                            0x0
+#define AZF0STREAM15_AZALIA_STREAM_DEBUG__STREAM_DEBUG_DATA_MASK                                              0xFFFFFFFFL
+
+
+// addressBlock: azf0endpoint0_endpointind
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT0_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT0_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT0_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT0_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT0_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint1_endpointind
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT1_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT1_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT1_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT1_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT1_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint2_endpointind
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT2_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT2_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT2_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT2_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT2_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint3_endpointind
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT3_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT3_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT3_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT3_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT3_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint4_endpointind
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT4_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT4_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT4_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT4_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT4_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint5_endpointind
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT5_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT5_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT5_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT5_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT5_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint6_endpointind
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT6_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT6_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT6_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT6_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT6_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+// addressBlock: azf0endpoint7_endpointind
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG__SHIFT                                0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PIN_DEBUG__AZALIA_DEBUG_MASK                                  0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE__SHIFT   0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT            0x5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT  0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT   0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT           0x9
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT     0xa
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT           0xb
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT              0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK  0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__FORMAT_OVERRIDE_MASK     0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK              0x00000020L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK   0x00000040L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK     0x00000100L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK             0x00000200L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK       0x00000400L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK             0x00000800L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                0x00F00000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS__SHIFT           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE__SHIFT              0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR__SHIFT          0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE__SHIFT         0xb
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE__SHIFT             0xe
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE__SHIFT                  0xf
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__NUMBER_OF_CHANNELS_MASK             0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__BITS_PER_SAMPLE_MASK                0x00000070L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_DIVISOR_MASK            0x00000700L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_MULTIPLE_MASK           0x00003800L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__SAMPLE_BASE_RATE_MASK               0x00004000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CONVERTER_FORMAT__STREAM_TYPE_MASK                    0x00008000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID__SHIFT                  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID__SHIFT                   0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__CHANNEL_ID_MASK                    0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_CHANNEL_STREAM_ID__STREAM_ID_MASK                     0x000000F0L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN__SHIFT                       0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V__SHIFT                           0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG__SHIFT                        0x2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE__SHIFT                         0x3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY__SHIFT                        0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO__SHIFT                   0x5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO__SHIFT                         0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L__SHIFT                           0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC__SHIFT                          0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE__SHIFT                   0x17
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__DIGEN_MASK                         0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__V_MASK                             0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__VCFG_MASK                          0x00000004L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRE_MASK                           0x00000008L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__COPY_MASK                          0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__NON_AUDIO_MASK                     0x00000020L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__PRO_MASK                           0x00000040L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__L_MASK                             0x00000080L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__CC_MASK                            0x00007F00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_DIGITAL_CONVERTER__KEEPALIVE_MASK                     0x00800000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS__SHIFT               0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_STREAM_FORMATS__STREAM_FORMATS_MASK                 0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES__SHIFT  0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_RATE_CAPABILITIES_MASK  0x00000FFFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_PARAMETER_SUPPORTED_SIZE_RATES__AUDIO_BIT_CAPABILITIES_MASK   0x001F0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL__SHIFT                         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY__SHIFT                      0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CONTROL_MASK                           0x00000003L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_STRIPE_CONTROL__STRIPE_CAPABILITY_MASK                        0x00700000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE__SHIFT                           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_CONVERTER_CONTROL_RAMP_RATE__RAMP_RATE_MASK                             0x000000FFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT__SHIFT  0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT__SHIFT  0x2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE__SHIFT  0x3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE__SHIFT                  0x5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET__SHIFT       0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY__SHIFT  0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST__SHIFT         0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL__SHIFT                 0x9
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL__SHIFT           0xa
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP__SHIFT                 0xb
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY__SHIFT  0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE__SHIFT                    0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_CHANNEL_CAPABILITIES_MASK  0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__INPUT_AMPLIFIER_PRESENT_MASK   0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__OUTPUT_AMPLIFIER_PRESENT_MASK  0x00000004L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AMPLIFIER_PARAMETER_OVERRIDE_MASK  0x00000008L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__STRIPE_MASK                    0x00000020L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__PROCESSING_WIDGET_MASK         0x00000040L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__UNSOLICITED_RESPONSE_CAPABILITY_MASK  0x00000080L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__CONNECTION_LIST_MASK           0x00000100L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__DIGITAL_MASK                   0x00000200L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__POWER_CONTROL_MASK             0x00000400L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__LR_SWAP_MASK                   0x00000800L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__AUDIO_WIDGET_CAPABILITIES_DELAY_MASK  0x000F0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_AUDIO_WIDGET_CAPABILITIES__TYPE_MASK                      0x00F00000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE__SHIFT              0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED__SHIFT                     0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY__SHIFT            0x2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE__SHIFT              0x3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE__SHIFT                       0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE__SHIFT                        0x5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS__SHIFT                    0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI__SHIFT                                 0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL__SHIFT                         0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE__SHIFT                         0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP__SHIFT                                   0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__IMPEDANCE_SENSE_CAPABLE_MASK                0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__TRIGGER_REQUIRED_MASK                       0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__JACK_DETECTION_CAPABILITY_MASK              0x00000004L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HEADPHONE_DRIVE_CAPABLE_MASK                0x00000008L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__OUTPUT_CAPABLE_MASK                         0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__INPUT_CAPABLE_MASK                          0x00000020L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__BALANCED_I_O_PINS_MASK                      0x00000040L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__HDMI_MASK                                   0x00000080L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__VREF_CONTROL_MASK                           0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__EAPD_CAPABLE_MASK                           0x00010000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_PARAMETER_CAPABILITIES__DP_MASK                                     0x01000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG__SHIFT                            0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE__SHIFT                         0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__TAG_MASK                              0x0000003FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE__ENABLE_MASK                           0x00000080L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE__SHIFT                  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_PIN_SENSE__IMPEDANCE_SENSE_MASK                    0x7FFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE__SHIFT                           0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIDGET_CONTROL__OUT_ENABLE_MASK                             0x00000040L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION__SHIFT                  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION__SHIFT                  0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION__SHIFT                     0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION__SHIFT                       0x11
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO__SHIFT               0x12
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL__SHIFT                  0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT__SHIFT                         0x1b
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT__SHIFT                    0x1f
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__SPEAKER_ALLOCATION_MASK                    0x0000007FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__CHANNEL_ALLOCATION_MASK                    0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__HDMI_CONNECTION_MASK                       0x00010000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DP_CONNECTION_MASK                         0x00020000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__EXTRA_CONNECTION_INFO_MASK                 0x00FC0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LFE_PLAYBACK_LEVEL_MASK                    0x03000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__LEVEL_SHIFT_MASK                           0x78000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER__DOWN_MIX_INHIBIT_MASK                      0x80000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX__SHIFT                                  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI__SHIFT                                0x6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE__SHIFT                          0x7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE__SHIFT                                   0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0__SHIFT                   0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1__SHIFT                   0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_INDEX_MASK                                    0x0000003FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__SUPPORTS_AI_MASK                                  0x00000040L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_PACKET_ENABLE_MASK                            0x00000080L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_MASK                                     0x00000300L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE0_MASK                     0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_ACP_DATA__ACP_TYPE_DEPENDENT_BYTE1_MASK                     0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO__SHIFT      0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR0__SUPPORTED_FREQUENCIES_STEREO_MASK        0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR1__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR2__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR3__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR4__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR5__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR6__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR7__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR8__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2__SHIFT                 0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__MAX_CHANNELS_MASK                        0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__SUPPORTED_FREQUENCIES_MASK               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR9__DESCRIPTOR_BYTE_2_MASK                   0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR10__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR11__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR12__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES__SHIFT            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2__SHIFT                0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__MAX_CHANNELS_MASK                       0x00000007L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__SUPPORTED_FREQUENCIES_MASK              0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13__DESCRIPTOR_BYTE_2_MASK                  0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL01_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL23_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL45_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE__MULTICHANNEL67_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC__SHIFT                      0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC__SHIFT                      0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__VIDEO_LIPSYNC_MASK                        0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC__AUDIO_LIPSYNC_MASK                        0x0000FF00L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE__SHIFT                            0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE__SHIFT                             0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_CAPABLE_MASK                              0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_HBR__HBR_ENABLE_MASK                               0x00000010L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID__SHIFT                          0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID__SHIFT                               0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__MANUFACTURER_ID_MASK                            0x0000FFFFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO0__PRODUCT_ID_MASK                                 0xFFFF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1__SINK_DESCRIPTION_LEN_MASK                       0x000000FFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0__SHIFT                                 0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO2__PORT_ID0_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1__SHIFT                                 0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO3__PORT_ID1_MASK                                   0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0__SHIFT                             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1__SHIFT                             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2__SHIFT                             0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3__SHIFT                             0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION0_MASK                               0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION1_MASK                               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION2_MASK                               0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO4__DESCRIPTION3_MASK                               0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4__SHIFT                             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5__SHIFT                             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6__SHIFT                             0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7__SHIFT                             0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION4_MASK                               0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION5_MASK                               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION6_MASK                               0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO5__DESCRIPTION7_MASK                               0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8__SHIFT                             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9__SHIFT                             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10__SHIFT                            0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11__SHIFT                            0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION8_MASK                               0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION9_MASK                               0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION10_MASK                              0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO6__DESCRIPTION11_MASK                              0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12__SHIFT                            0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13__SHIFT                            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14__SHIFT                            0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15__SHIFT                            0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION12_MASK                              0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION13_MASK                              0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION14_MASK                              0x00FF0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO7__DESCRIPTION15_MASK                              0xFF000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16__SHIFT                            0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17__SHIFT                            0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION16_MASK                              0x000000FFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO8__DESCRIPTION17_MASK                              0x0000FF00L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE__SHIFT               0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE__SHIFT                     0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED__SHIFT                      0x1f
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_GATING_DISABLE_MASK                 0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__CLOCK_ON_STATE_MASK                       0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_HOT_PLUG_CONTROL__AUDIO_ENABLED_MASK                        0x80000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE__SHIFT  0x1c
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_PAYLOAD_MASK  0x03FFFFFFL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_UNSOLICITED_RESPONSE_FORCE__UNSOLICITED_RESPONSE_FORCE_MASK  0x10000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE__SHIFT             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION__SHIFT  0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC__SHIFT                 0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR__SHIFT                0xc
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE__SHIFT      0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE__SHIFT       0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION__SHIFT             0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY__SHIFT    0x1e
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__SEQUENCE_MASK               0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_ASSOCIATION_MASK    0x000000F0L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__MISC_MASK                   0x00000F00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__COLOR_MASK                  0x0000F000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__CONNECTION_TYPE_MASK        0x000F0000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__DEFAULT_DEVICE_MASK         0x00F00000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__LOCATION_MASK               0x3F000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_RESPONSE_CONFIGURATION_DEFAULT__PORT_CONNECTIVITY_MASK      0xC0000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE__SHIFT             0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID__SHIFT       0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE__SHIFT           0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE__SHIFT             0x9
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID__SHIFT       0xc
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE__SHIFT           0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE__SHIFT             0x11
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID__SHIFT       0x14
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE__SHIFT           0x18
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE__SHIFT             0x19
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID__SHIFT       0x1c
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_MUTE_MASK               0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL1_CHANNEL_ID_MASK         0x000000F0L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_ENABLE_MASK             0x00000100L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_MUTE_MASK               0x00000200L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL3_CHANNEL_ID_MASK         0x0000F000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_ENABLE_MASK             0x00010000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_MUTE_MASK               0x00020000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL5_CHANNEL_ID_MASK         0x00F00000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_ENABLE_MASK             0x01000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_MUTE_MASK               0x02000000L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_ENABLE2__MULTICHANNEL7_CHANNEL_ID_MASK         0xF0000000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE__SHIFT                 0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_MULTICHANNEL_MODE__MULTICHANNEL_MODE_MASK                   0x00000001L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE__SHIFT                     0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER__SHIFT            0x2
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_MODE_MASK                       0x00000003L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_0__IEC_60958_CS_SOURCE_NUMBER_MASK              0x0000003CL
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY__SHIFT           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN__SHIFT  0x2
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH__SHIFT              0x3
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN__SHIFT     0x7
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_MASK             0x00000003L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_CLOCK_ACCURACY_OVRRD_EN_MASK    0x00000004L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_MASK                0x00000078L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_1__IEC_60958_CS_WORD_LENGTH_OVRRD_EN_MASK       0x00000080L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY__SHIFT       0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x6
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_MASK         0x0000003FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_2__IEC_60958_CS_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000040L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN__SHIFT  0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_MASK  0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_3__IEC_60958_CS_ORIGINAL_SAMPLING_FREQUENCY_OVRRD_EN_MASK  0x00000010L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO__SHIFT       0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A__SHIFT                   0x5
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID__SHIFT             0x7
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_SAMPLING_FREQUENCY_COEFF_MASK   0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_MPEG_SURROUND_INFO_MASK         0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_MASK                     0x00000060L
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_4__IEC_60958_CS_CGMS_A_VALID_MASK               0x00000080L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L__SHIFT         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R__SHIFT         0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_L_MASK           0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_5__IEC_60958_CS_CHANNEL_NUMBER_R_MASK           0x000000F0L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2__SHIFT         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3__SHIFT         0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_2_MASK           0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_6__IEC_60958_CS_CHANNEL_NUMBER_3_MASK           0x000000F0L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4__SHIFT         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5__SHIFT         0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_4_MASK           0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_7__IEC_60958_CS_CHANNEL_NUMBER_5_MASK           0x000000F0L
+//AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6__SHIFT         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7__SHIFT         0x4
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_6_MASK           0x0000000FL
+#define AZF0ENDPOINT7_AZALIA_F0_PIN_CONTROL_CODEC_CS_OVERRIDE_8__IEC_60958_CS_CHANNEL_NUMBER_7_MASK           0x000000F0L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO__SHIFT                           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_ASSOCIATION_INFO__ASSOCIATION_INFO_MASK                             0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE__SHIFT                 0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_DIGITAL_OUTPUT_STATUS__OUTPUT_ACTIVE_MASK                   0x00000001L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK__SHIFT            0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT__SHIFT      0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__LPIB_SNAPSHOT_LOCK_MASK              0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_SNAPSHOT_CONTROL__CYCLIC_BUFFER_WRAP_COUNT_MASK        0x0000FF00L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB__SHIFT                                           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB__LPIB_MASK                                             0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT__SHIFT             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_LPIB_TIMER_SNAPSHOT__LPIB_TIMER_SNAPSHOT_MASK               0xFFFFFFFFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE__SHIFT                             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_CODING_TYPE__CODING_TYPE_MASK                               0x000000FFL
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED__SHIFT                       0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE__SHIFT         0x1
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON__SHIFT                 0x8
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE__SHIFT               0x10
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_MASK                         0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGED_ACK_UR_ENABLE_MASK           0x00000002L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_REASON_MASK                   0x0000FF00L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_FORMAT_CHANGED__FORMAT_CHANGE_RESPONSE_MASK                 0x00FF0000L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION__SHIFT  0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_WIRELESS_DISPLAY_IDENTIFICATION__WIRELESS_DISPLAY_IDENTIFICATION_MASK  0x00000003L
+//AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE__SHIFT           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY__SHIFT       0x4
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_ENABLE_MASK             0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_CODEC_PIN_CONTROL_REMOTE_KEEPALIVE__REMOTE_KEEP_ALIVE_CAPABILITY_MASK         0x00000010L
+//AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLE_STATUS
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS__SHIFT                               0x0
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLE_STATUS__AUDIO_ENABLE_STATUS_MASK                                 0x00000001L
+//AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG__SHIFT                           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK__SHIFT                           0x4
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE__SHIFT                           0x8
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_FLAG_MASK                             0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_MASK_MASK                             0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_ENABLED_INT_STATUS__AUDIO_ENABLED_TYPE_MASK                             0x00000100L
+//AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG__SHIFT                         0x0
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK__SHIFT                         0x4
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE__SHIFT                         0x8
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_FLAG_MASK                           0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_MASK_MASK                           0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_DISABLED_INT_STATUS__AUDIO_DISABLED_TYPE_MASK                           0x00000100L
+//AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG__SHIFT             0x0
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK__SHIFT             0x4
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE__SHIFT             0x8
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_FLAG_MASK               0x00000001L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_MASK_MASK               0x00000010L
+#define AZF0ENDPOINT7_AZALIA_F0_AUDIO_FORMAT_CHANGED_INT_STATUS__AUDIO_FORMAT_CHANGED_TYPE_MASK               0x00000100L
+//AZF0ENDPOINT7_AZALIA_F0_ENDPOINT_FGCG_REP_DIS
+#define AZF0ENDPOINT7_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS__SHIFT                           0x0
+#define AZF0ENDPOINT7_AZALIA_F0_ENDPOINT_FGCG_REP_DIS__ENDPOINT_FGCG_REP_DIS_MASK                             0x00000001L
+
+
+#endif
diff --git a/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_offset.h b/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_offset.h
new file mode 100644
index 00000000000000..ffe38bed827443
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_offset.h
@@ -0,0 +1,47 @@
+/*
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+ */
+
+
+#ifndef _dpcs_6_0_0_OFFSET_HEADER
+#define _dpcs_6_0_0_OFFSET_HEADER
+
+// addressBlock: dpcssys_dcio_dcio_dispdec
+// base address: 0x0
+#define regHPD_CTRL                                                                                     0x286c
+#define regHPD_CTRL_BASE_IDX                                                                            2
+#define regDC_PINSTRAPS                                                                                 0x2880
+#define regDC_PINSTRAPS_BASE_IDX                                                                        2
+
+// addressBlock: dpcssys_dcio_dcio_chip_dispdec
+// base address: 0x0
+#define regDC_GPIO_DDC1_MASK                                                                            0x28d0
+#define regDC_GPIO_DDC1_MASK_BASE_IDX                                                                   2
+#define regDC_GPIO_DDC2_MASK                                                                            0x28d4
+#define regDC_GPIO_DDC2_MASK_BASE_IDX                                                                   2
+#define regDC_GPIO_DDC3_MASK                                                                            0x28d8
+#define regDC_GPIO_DDC3_MASK_BASE_IDX                                                                   2
+#define regDC_GPIO_DDC4_MASK                                                                            0x28dc
+#define regDC_GPIO_DDC4_MASK_BASE_IDX                                                                   2
+#define regPHY_AUX_CNTL                                                                                 0x28ff
+#define regPHY_AUX_CNTL_BASE_IDX                                                                        2
+#define regDC_GPIO_AUX_CTRL_5                                                                           0x291d
+#define regDC_GPIO_AUX_CTRL_5_BASE_IDX                                                                  2
+
+// addressBlock: dpcssys_dcio_i3c_pad_control_ddc1_dc_i3c_dispdec
+// base address: 0x0
+#define regDC_I3C0_DC_I3CPAD_CONTROL0                                                                   0x2f6c
+#define regDC_I3C0_DC_I3CPAD_CONTROL0_BASE_IDX                                                          2
+#define regDC_I3C0_DC_I3CPAD_CONTROL1                                                                   0x2f6d
+#define regDC_I3C0_DC_I3CPAD_CONTROL1_BASE_IDX                                                          2
+
+// addressBlock: dpcssys_dcio_i3c_pad_control_ddc2_dc_i3c_dispdec
+// base address: 0x8
+#define regDC_I3C1_DC_I3CPAD_CONTROL0                                                                   0x2f6e
+#define regDC_I3C1_DC_I3CPAD_CONTROL0_BASE_IDX                                                          2
+#define regDC_I3C1_DC_I3CPAD_CONTROL1                                                                   0x2f6f
+#define regDC_I3C1_DC_I3CPAD_CONTROL1_BASE_IDX                                                          2
+
+#endif
diff --git a/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_sh_mask.h
new file mode 100644
index 00000000000000..08e9e656933de9
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/dpcs/dpcs_6_0_0_sh_mask.h
@@ -0,0 +1,55 @@
+/*
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+ */
+
+#ifndef _dpcs_6_0_0_SH_MASK_HEADER
+#define _dpcs_6_0_0_SH_MASK_HEADER
+
+// addressBlock: dpcssys_dcio_dcio_dispdec
+//HPD_CTRL
+#define HPD_CTRL__HPD1_Y_POL_INVERT__SHIFT                                                                    0x0
+#define HPD_CTRL__HPD2_Y_POL_INVERT__SHIFT                                                                    0x1
+#define HPD_CTRL__HPD3_Y_POL_INVERT__SHIFT                                                                    0x2
+#define HPD_CTRL__HPD4_Y_POL_INVERT__SHIFT                                                                    0x3
+#define HPD_CTRL__HPD1_Y_POL_INVERT_MASK                                                                      0x00000001L
+#define HPD_CTRL__HPD2_Y_POL_INVERT_MASK                                                                      0x00000002L
+#define HPD_CTRL__HPD3_Y_POL_INVERT_MASK                                                                      0x00000004L
+#define HPD_CTRL__HPD4_Y_POL_INVERT_MASK                                                                      0x00000008L
+//DC_PINSTRAPS
+#define DC_PINSTRAPS__DC_PINSTRAPS_AUDIO__SHIFT                                                               0xe
+#define DC_PINSTRAPS__DC_PINSTRAPS_AUDIO_MASK                                                                 0x0000C000L
+
+// addressBlock: dpcssys_dcio_dcio_chip_dispdec
+//DC_GPIO_DDC1_MASK
+#define DC_GPIO_DDC1_MASK__AUX_PAD1_MODE__SHIFT                                                               0x10
+#define DC_GPIO_DDC1_MASK__AUX_PAD1_MODE_MASK                                                                 0x00010000L
+
+// addressBlock: dpcssys_dcio_i3c_pad_control_ddc1_dc_i3c_dispdec
+//DC_I3C0_DC_I3CPAD_CONTROL0
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DDCCLK_MASK__SHIFT                                              0x0
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DDCDATA_MASK__SHIFT                                             0x1
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_PD_EN__SHIFT                                                    0x3
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_A__SHIFT                                                    0x5
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_A__SHIFT                                                   0x8
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_EN__SHIFT                                                   0xc
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_EN__SHIFT                                                  0x10
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_Y__SHIFT                                                    0x14
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_Y__SHIFT                                                   0x18
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DDCCLK_MASK_MASK                                                0x00000001L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DDCDATA_MASK_MASK                                               0x00000002L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_PD_EN_MASK                                                      0x00000018L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_A_MASK                                                      0x00000020L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_A_MASK                                                     0x00000100L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_EN_MASK                                                     0x00001000L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_EN_MASK                                                    0x00010000L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_CLK_Y_MASK                                                      0x00100000L
+#define DC_I3C0_DC_I3CPAD_CONTROL0__DC_I3CPAD_DATA_Y_MASK                                                     0x01000000L
+//DC_I3C0_DC_I3CPAD_CONTROL1
+#define DC_I3C0_DC_I3CPAD_CONTROL1__DC_I3CPAD_STR__SHIFT                                                      0x0
+#define DC_I3C0_DC_I3CPAD_CONTROL1__DC_I3CPAD_RXSEL__SHIFT                                                    0x6
+#define DC_I3C0_DC_I3CPAD_CONTROL1__DC_I3CPAD_STR_MASK                                                        0x0000000FL
+#define DC_I3C0_DC_I3CPAD_CONTROL1__DC_I3CPAD_RXSEL_MASK                                                      0x000000C0L
+
+#endif
diff --git a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_offset.h b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_offset.h
new file mode 100644
index 00000000000000..a65e78e130f64e
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_offset.h
@@ -0,0 +1,17 @@
+/*
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+ */
+
+
+#ifndef _mmhub_5_0_1_OFFSET_HEADER
+#define _mmhub_5_0_1_OFFSET_HEADER
+
+// addressBlock: mmhub_mmhubdec
+#define regMMMC_VM_FB_LOCATION_BASE                                                                     0x05d0
+#define regMMMC_VM_FB_LOCATION_BASE_BASE_IDX                                                            1
+#define regMMMC_VM_FB_OFFSET                                                                            0x0803
+#define regMMMC_VM_FB_OFFSET_BASE_IDX                                                                   1
+
+#endif
diff --git a/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_sh_mask.h
new file mode 100644
index 00000000000000..0da2bbc4996a49
--- /dev/null
+++ b/drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_5_0_1_sh_mask.h
@@ -0,0 +1,17 @@
+/*
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+ */
+
+#ifndef _mmhub_5_0_1_SH_MASK_HEADER
+#define _mmhub_5_0_1_SH_MASK_HEADER
+
+//MMMC_VM_FB_LOCATION_BASE
+#define MMMC_VM_FB_LOCATION_BASE__FB_BASE__SHIFT                                                              0x0
+#define MMMC_VM_FB_LOCATION_BASE__FB_BASE_MASK                                                                0x00FFFFFFL
+//MMMC_VM_FB_OFFSET
+#define MMMC_VM_FB_OFFSET__FB_OFFSET__SHIFT                                                                   0x0
+#define MMMC_VM_FB_OFFSET__FB_OFFSET_MASK                                                                     0x00FFFFFFL
+
+#endif

From bb3502307a71d326c4d1464d5d758c8e9657aea5 Mon Sep 17 00:00:00 2001
From: Junhao He <hejunhao3@h-partners.com>
Date: Wed, 27 May 2026 16:27:07 +0800
Subject: [PATCH 0352/1982] ACPI: APEI: Handle repeated SEA error storms

[ Upstream commit e61487226b7df39e5f4683b036ee6aa7a5039d7b ]

When hardware memory corruption occurs and a user process accesses the
corrupted page, the CPU triggers a Synchronous External Abort (SEA).
The kernel invokes do_sea() to handle the exception, which calls
memory_failure() to handle the faulty page.

Scenario 1: Memory Error Interrupt First, then SEA
The page is already poisoned by the memory error interrupt path. The
subsequent SEA handler sends a SIGBUS to the task, which accesses the
poisoned page. This flow is correct.

Scenario 2: SEA first, then memory error interrupt (problematic scenario)
If a user task directly accesses corrupted memory through a PFNMAP-style
mapping (e.g., devmem), the page may still be in the free-buddy state when
SEA is handled. In this case, memory_failure() will poison the page without
invoking kill_accessing_process(), and then takes the free-buddy recovery
path.

After the CPU returns to the task context, the task re-enters the SEA
handler due to the same access. However, ghes_estatus_cached() suppresses
all subsequent entries during the 10-second window, preventing
ghes_do_proc() from being called. This suppression blocks the
MF_ACTION_REQUIRED-based SIGBUS delivery, causing the kernel to fail to
kill the task immediately. Consequently, the process keeps re-entering
the SEA handler, leading to an SEA storm. Later, the memory error
interrupt path also cannot kill the task, leaving the system stuck in
this repeated loop.

The following error logs are explained using the devmem process:
  NOTICE:  SEA Handle
  [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 9
  [Hardware Error]: event severity: recoverable
  [Hardware Error]:   section_type: ARM processor error
  [Hardware Error]:    physical fault address: 0x0000001000093c00
  [T54990] Memory failure: 0x1000093: recovery action for free buddy page: Recovered
  [ T9955] EDAC MC0: 1 UE Multi-bit ECC on unknown memory
           (page:0x1000093 offset:0xc00 grain:1 - APEI location: ...)
  NOTICE:  SEA Handle
  NOTICE:  SEA Handle
  ...
  ...        ---> SEA storm
  ...
  NOTICE:  SEA Handle
  [ T9955] Memory failure: 0x1000093: already hardware poisoned
  ghes_print_estatus: 1 callbacks suppressed
  [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 9
  [Hardware Error]: event severity: recoverable
  [Hardware Error]:   section_type: ARM processor error
  [Hardware Error]:    physical fault address: 0x0000001000093c00
  [T54990] Memory failure: 0x1000093: already hardware poisoned
  [T54990] 0x1000093: Sending SIGBUS to devmem:54990 due to hardware memory corruption

To resolve this, return an error when encountering the same SEA again.
The subsequent SEA handler invocation uses arm64_notify_die() to send a
SIGBUS signal to the task, which terminates the process and prevents it
from re-entering the handler loop.

Signed-off-by: Junhao He <hejunhao3@h-partners.com>
Reviewed-by: Wupeng Ma <mawupeng1@huawei.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://patch.msgid.link/20260527082707.2013499-1-hejunhao3@h-partners.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/apei/ghes.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 5b52455d86e02c..1a77aba0475be4 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1371,8 +1371,16 @@ static int ghes_in_nmi_queue_one_entry(struct ghes *ghes,
 	ghes_clear_estatus(ghes, &tmp_header, buf_paddr, fixmap_idx);
 
 	/* This error has been reported before, don't process it again. */
-	if (ghes_estatus_cached(estatus))
+	if (ghes_estatus_cached(estatus)) {
+		/*
+		 * Return failure on duplicate SEA entries so that the
+		 * subsequent SEA handler invocation sends a SIGBUS signal to
+		 * the task to prevent it from re-entering the handler loop.
+		 */
+		if (is_hest_sync_notify(ghes))
+			rc = -ECANCELED;
 		goto no_work;
+	}
 
 	llist_add(&estatus_node->llnode, &ghes_estatus_llist);
 

From 5c462ae712133368283aad90dfbcde3eaa5a91fe Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Fri, 7 Aug 2026 20:58:56 +0800
Subject: [PATCH 0353/1982] ALSA: hda/realtek: Fix headset mic on ASUS Vivobook
 S14 S5406SA

[ Upstream commit f2d08f3651fb12634347fef2c41687a807a7dcba ]

On the ASUS Vivobook S14 S5406SA (subsystem 0x104310c4, Lunar Lake
platform) with an ALC294 codec, the headset microphone (3.5mm jack)
fails to capture any audio. Adding the ALC2XX_FIXUP_HEADSET_MIC
quirk resolves the issue and restores proper headset mic recording.

Link: https://github.com/thesofproject/linux/issues/5729
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260807125857.678297-3-zhangheng@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 97ab2269dc472c..8fdfe1bbe7affc 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7101,6 +7101,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x10a4, "ASUS TP3407SA", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+	SND_PCI_QUIRK(0x1043, 0x10c4, "ASUS Vivobook S14 S5406SA", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x1154, "ASUS TP3607SH", ALC287_FIXUP_TAS2781_I2C),

From 5af0fb2f2579e14f0a5f1d05f249ed4242a14e2b Mon Sep 17 00:00:00 2001
From: Garrett Blackmon <garrett@blackmon.dev>
Date: Fri, 7 Aug 2026 10:07:08 -0500
Subject: [PATCH 0354/1982] ALSA: hda/realtek: Fix speakers on ASUS ROG
 Zephyrus G14 GA403UM

[ Upstream commit 140fe610af607fd70da95c447943fc2690855519 ]

The GA403UM (SSID 1043:1044) uses the same ALC285 codec + dual CS35L56
I2C amplifier topology as the GA403U and GA403W variants, which already
have quirk entries (1043:1b13, 1043:1024). Without the quirk, the
woofers sit on a separate DAC from the tweeters, so the hardware volume
control only scales part of the speaker system and the headset
microphone pins are not configured.

Apply the existing ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC fixup to the
GA403UM as well.

Signed-off-by: Garrett Blackmon <garrett@blackmon.dev>
Link: https://patch.msgid.link/20260807150708.33785-1-garrett@blackmon.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 8fdfe1bbe7affc..05e7fcc2f67e66 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7094,6 +7094,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1034, "ASUS GU605C", ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+	SND_PCI_QUIRK(0x1043, 0x1044, "ASUS GA403UM", ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1054, "ASUS G614FH/FM/FP", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x106f, "ASUS VivoBook X515UA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),

From 1e475880c031bfe8d3b94533401c49e27f15d4ee Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Fri, 7 Aug 2026 20:58:57 +0800
Subject: [PATCH 0355/1982] ALSA: hda/conexant: Add pin config quirk for Huawei
 Matebook

[ Upstream commit d152afd1cd7a69c752236b6e825c4e62a74788eb ]

The headphone jack is not detected on this Huawei Matebook (Conexant
SN6140 codec). The BIOS incorrectly marks Pin 0x18 as [N/A], causing
the driver to report hp_outs=0 and no "Headphones" output appears.

Override the pin configuration for NID 0x18 to set it as a headphone
jack, which restores proper detection and audio routing.

Link: https://github.com/thesofproject/sof/issues/10687
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260807125857.678297-4-zhangheng@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/conexant.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index 56d6fbdd9b06de..ef40f1cb1158e3 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -298,6 +298,7 @@ enum {
 	CXT_PINCFG_TOP_SPEAKER,
 	CXT_FIXUP_HP_A_U,
 	CXT_FIXUP_ACER_SWIFT_HP,
+	CXT_FIXUP_HUAWEI_MATEBOOK_HP,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
@@ -1043,6 +1044,13 @@ static const struct hda_fixup cxt_fixups[] = {
 			{ }
 		},
 	},
+	[CXT_FIXUP_HUAWEI_MATEBOOK_HP] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x18, 0x03211020 }, /* Headphone */
+			{ }
+		},
+	},
 };
 
 static const struct hda_quirk cxt5045_fixups[] = {
@@ -1143,6 +1151,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI),
+	SND_PCI_QUIRK(0x19e5, 0x3289, "Huawei Matebook", CXT_FIXUP_HUAWEI_MATEBOOK_HP),
 	SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
 	SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
 	SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),

From ea138f7a5a69cd10b125301cded99d5cd97510f7 Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Fri, 7 Aug 2026 20:58:54 +0800
Subject: [PATCH 0356/1982] ALSA: hda/realtek: Add quirk for Acer Nitro
 ANV16-42 headset mic

[ Upstream commit e00a6a89900dfa4cda3669558d2f3581cd41a656 ]

The Acer Nitro ANV16-42 (subsystem 0x1025:0x1909, Realtek ALC245)
does not detect the headset microphone jack. Adding the
ALC2XX_FIXUP_HEADSET_MIC quirk resolves the issue and restores
proper headset mic functionality.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221623
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260807125857.678297-1-zhangheng@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 05e7fcc2f67e66..9ec18f779a700c 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6595,6 +6595,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x1826, "Acer Helios ZPC", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1025, 0x182c, "Acer Helios ZPD", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1025, 0x1844, "Acer Helios ZPS", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x1025, 0x1909, "Acer Nitro ANV16-42", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
 	SND_PCI_QUIRK(0x1028, 0x053c, "Dell Latitude E5430", ALC292_FIXUP_DELL_E7X),
 	SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),

From 6594a73c6b1b03c66d13549d55ed195ab5b97048 Mon Sep 17 00:00:00 2001
From: Chen Changcheng <chenchangcheng@kylinos.cn>
Date: Wed, 22 Jul 2026 16:31:36 +0800
Subject: [PATCH 0357/1982] Bluetooth: btrsi: Move set_bt_context after
 successful HCI registration

[ Upstream commit 290a3644609526f7ac12529cd1618042fa5a32db ]

In rsi_hci_attach(), ops->set_bt_context() stores the newly allocated
h_adapter into common->bt_adapter before hci_alloc_dev() and
hci_register_dev() are called. If either of these fails, h_adapter
is freed but common->bt_adapter remains a non-NULL dangling pointer.

This causes a deterministically reachable use-after-free when the
device operates in a BT+WiFi coexistence mode and CONFIG_RSI_COEX
is enabled. The following software-only trigger paths exist:

  1. SDIO driver .remove  (rsi_disconnect)
  2. USB  driver .disconnect (rsi_disconnect)
  3. SDIO driver .shutdown (rsi_shutdown)
  4. Hibernation .freeze  (rsi_freeze)

All four paths check:
    if (IS_ENABLED(CONFIG_RSI_COEX) && coex_mode > 1 && bt_adapter)
        rsi_bt_ops.detach(bt_adapter);  // use-after-free

coex_mode is set during rsi_91x_init(), before rsi_hci_attach() is
called, and is not cleared on attach failure. Since set_bt_context()
already wrote bt_adapter before the failure, the deinit paths see a
non-NULL dangling pointer and proceed to detach it.

Fix this by moving set_bt_context() after hci_register_dev() succeeds.
On failure paths bt_adapter stays NULL, and the deinit callers correctly
skip the detach call.

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btrsi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btrsi.c b/drivers/bluetooth/btrsi.c
index 6c1f584c8a3372..0e2894e93e82e2 100644
--- a/drivers/bluetooth/btrsi.c
+++ b/drivers/bluetooth/btrsi.c
@@ -117,7 +117,6 @@ static int rsi_hci_attach(void *priv, struct rsi_proto_ops *ops)
 		return -ENOMEM;
 
 	h_adapter->priv = priv;
-	ops->set_bt_context(priv, h_adapter);
 	h_adapter->proto_ops = ops;
 
 	hdev = hci_alloc_dev();
@@ -146,6 +145,8 @@ static int rsi_hci_attach(void *priv, struct rsi_proto_ops *ops)
 		goto err;
 	}
 
+	ops->set_bt_context(priv, h_adapter);
+
 	return 0;
 err:
 	h_adapter->hdev = NULL;

From 3fb4a0376b4ee5e831c5042492a5fdd3d5f9381f Mon Sep 17 00:00:00 2001
From: Li Qiang <liqiang01@kylinos.cn>
Date: Thu, 16 Jul 2026 16:47:30 +0800
Subject: [PATCH 0358/1982] Bluetooth: hci_bcsp: validate received packet
 lengths

[ Upstream commit ceea75ad8925425ee6520ead964b55888fe871ec ]

The BCSP transmit path reads an HCI command header when an extension
packet has only been tested for a nonzero length. Its LE configuration
packet handler also indexes bytes through offset seven without a length
check.

Validate the complete command and LE configuration packet headers
before accessing their fields.

Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_bcsp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 591abe6d63ddb5..6461492cf653b9 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -194,7 +194,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
 		return NULL;
 	}
 
-	if (hciextn && chan == 5) {
+	if (hciextn && chan == 5 && len > HCI_COMMAND_HDR_SIZE) {
 		__le16 opcode = ((struct hci_command_hdr *)data)->opcode;
 
 		/* Vendor specific commands */
@@ -402,6 +402,9 @@ static void bcsp_handle_le_pkt(struct hci_uart *hu)
 	u8 sync_pkt[4]     = { 0xda, 0xdc, 0xed, 0xed };
 
 	/* spot "conf" pkts and reply with a "conf rsp" pkt */
+	if (bcsp->rx_skb->len < 8)
+		return;
+
 	if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
 	    !memcmp(&bcsp->rx_skb->data[4], conf_pkt, 4)) {
 		struct sk_buff *nskb = alloc_skb(4, GFP_ATOMIC);

From cb2e195752677e3f9ea113c3d45a54e6217da82f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iva=20Kasprzakov=C3=A1?= <iva@yenya.net>
Date: Wed, 22 Jul 2026 15:08:49 +0200
Subject: [PATCH 0359/1982] Bluetooth: fix BT dependency for submodules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6ec1896b5331563fedf3f01014aba9c9e35d7f29 ]

The modules rfcomm (BT_RFCOMM), bnep (BT_BNEP), hidp (BT_HIDP), and
bluetooth_6lowpan (BT_6LOWPAN) are dependent on the bluetooth module
(BT, tristate) only transitively through the boolean BT_BREDR for the
first three and through the boolean BT_LE for the bluetooth_6lowpan.
Therefore, the modules can be selected as built-in even if the BT=m.
The combination of BT=m and =y for the said modules leads to the kernel
build system silently ignoring those modules, without ever compiling
them as built-in or as loadable modules.

Add BT as a direct dependency to the Kconfig of rfcomm, bnep, hidp, and
bluetooth_6lowpan. The modules set to =y when BT=m will default to =m,
rather then getting silently ignored by the build system.

Signed-off-by: Iva Kasprzaková <iva@yenya.net>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/Kconfig        | 2 +-
 net/bluetooth/bnep/Kconfig   | 2 +-
 net/bluetooth/hidp/Kconfig   | 2 +-
 net/bluetooth/rfcomm/Kconfig | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 6b2b65a667008b..86618afb855d34 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -83,7 +83,7 @@ config BT_LE_L2CAP_ECRED
 
 config BT_6LOWPAN
 	tristate "Bluetooth 6LoWPAN support"
-	depends on BT_LE && 6LOWPAN
+	depends on BT && BT_LE && 6LOWPAN
 	help
 	  IPv6 compression over Bluetooth Low Energy.
 
diff --git a/net/bluetooth/bnep/Kconfig b/net/bluetooth/bnep/Kconfig
index aac02b5b0d170b..f8087e2d2c00e9 100644
--- a/net/bluetooth/bnep/Kconfig
+++ b/net/bluetooth/bnep/Kconfig
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config BT_BNEP
 	tristate "BNEP protocol support"
-	depends on BT_BREDR
+	depends on BT && BT_BREDR
 	select CRC32
 	help
 	  BNEP (Bluetooth Network Encapsulation Protocol) is Ethernet
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index e08aae35351a7a..ba52c7296f18f0 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config BT_HIDP
 	tristate "HIDP protocol support"
-	depends on BT_BREDR && HID
+	depends on BT && BT_BREDR && HID
 	help
 	  HIDP (Human Interface Device Protocol) is a transport layer
 	  for HID reports.  HIDP is required for the Bluetooth Human
diff --git a/net/bluetooth/rfcomm/Kconfig b/net/bluetooth/rfcomm/Kconfig
index 9b9953ebf4c027..e7af2d565cea86 100644
--- a/net/bluetooth/rfcomm/Kconfig
+++ b/net/bluetooth/rfcomm/Kconfig
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config BT_RFCOMM
 	tristate "RFCOMM protocol support"
-	depends on BT_BREDR
+	depends on BT && BT_BREDR
 	help
 	  RFCOMM provides connection oriented stream transport.  RFCOMM
 	  support is required for Dialup Networking, OBEX and other Bluetooth

From 9f8852db6036a66d8e6d645dbe0477e9a3364272 Mon Sep 17 00:00:00 2001
From: Muhammad Saheed <muhammad.saheed.iam@gmail.com>
Date: Wed, 5 Aug 2026 01:40:51 +0530
Subject: [PATCH 0360/1982] Bluetooth: hci_sync: Disable legacy instance's ext
 adv before setup snapshot

[ Upstream commit 75722cde87ee24029e93e4e32d85309989f55991 ]

hci_setup_ext_adv_instance_sync(...) only disabled
HCI_OP_LE_SET_EXT_ADV_ENABLE before setup snapshot in case of non-legacy
instances (instance > 0) and never disabled the same for legacy instance
(instance == 0). This would lead to failure in setting ext adv params
with HCI_ERROR_COMMAND_DISALLOWED (0x0c) error like below, when toggling
the discoverable/connectable property of a controller with advertising
enabled.
```
$ btmgmt advertising off
hci0 Set Advertising complete, settings: powered ssp br/edr le
  secure-conn wide-band-speech cis-central cis-peripheral
$ btmgmt connectable on
hci0 Set Connectable complete, settings: powered connectable ssp br/edr
  le secure-conn wide-band-speech cis-central cis-peripheral
$ btmgmt connectable off
hci0 Set Connectable complete, settings: powered ssp br/edr le
  secure-conn wide-band-speech cis-central cis-peripheral

$ btmgmt advertising on
hci0 Set Advertising complete, settings: powered connectable ssp br/edr
  le advertising secure-conn wide-band-speech cis-central cis-peripheral
$ btmgmt connectable on
Set Connectable for hci0 failed with status 0x0a (Busy)
$ btmgmt connectable off
Set Connectable for hci0 failed with status 0x0a (Busy)

$ dmesg
...
[   21.970527] hci0: Opcode 0x2036
[   21.970529] hci0: opcode 0x2036 plen 25
[   21.970537] hci0: skb len 28
[   21.970539] hci0: length 1
[   21.976099] hci0: result 0x0c
[   21.976105] hci0: end: err -16
[   21.976114] Bluetooth: hci0: Opcode 0x2036 failed: -16
```

Signed-off-by: Muhammad Saheed <muhammad.saheed.iam@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_sync.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 70fce6811d0a9b..8da58c61e9723b 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1184,6 +1184,32 @@ int hci_update_random_address_sync(struct hci_dev *hdev, bool require_privacy,
 	return 0;
 }
 
+static int hci_disable_ext_adv_legacy_instance_sync(struct hci_dev *hdev)
+{
+	struct hci_cp_le_set_ext_adv_enable *cp;
+	struct hci_cp_ext_adv_set *set;
+	u8 data[sizeof(*cp) + sizeof(*set) * 1];
+	u8 size;
+
+	if (!hci_dev_test_flag(hdev, HCI_LE_ADV_0))
+		return 0;
+
+	memset(data, 0, sizeof(data));
+
+	cp = (void *)data;
+	set = (void *)cp->data;
+
+	cp->num_of_sets = 0x01;
+	cp->enable = 0x00;
+
+	set->handle = 0x00;
+
+	size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets;
+
+	return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE,
+				     size, data, HCI_CMD_TIMEOUT);
+}
+
 static int hci_disable_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 {
 	struct hci_cp_le_set_ext_adv_enable *cp;
@@ -1409,6 +1435,10 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 			return -EINVAL;
 		}
 	} else {
+		err = hci_disable_ext_adv_legacy_instance_sync(hdev);
+		if (err)
+			return err;
+
 		adv = NULL;
 	}
 

From 7723752655f250b66aba4815980360f3b9e20d86 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Tue, 4 Aug 2026 04:10:40 +0100
Subject: [PATCH 0361/1982] net: dsa: mt7530: error out on failed PHY_IAC
 command writes

[ Upstream commit 1c95dcb7e923beebccdc79adc3dc1ec8c52295d0 ]

MT7531_PHY_ACS_ST is only ever set by the command write that precedes
each poll in the MT7531 indirect PHY access functions, and that
write's return value is discarded. A failed write leaves ACS_ST at 0
from the previous access, so the poll succeeds on its first iteration
and the functions return stale IAC contents as if they were fresh PHY
data. Check the writes and bail out before polling.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/c34602e63a20ebbfb97babd145c82832d7a0b523.1785811140.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mt7530.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index bd0a37ead0dec9..24c7cb225da1a3 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -557,7 +557,9 @@ mt7531_ind_c45_phy_read(struct mt7530_priv *priv, int port, int devad,
 
 	reg = MT7531_MDIO_CL45_ADDR | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_DEV_ADDR(devad) | regnum;
-	mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, val,
 				       !(val & MT7531_PHY_ACS_ST), 20, 100000);
@@ -568,7 +570,9 @@ mt7531_ind_c45_phy_read(struct mt7530_priv *priv, int port, int devad,
 
 	reg = MT7531_MDIO_CL45_READ | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_DEV_ADDR(devad);
-	mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, val,
 				       !(val & MT7531_PHY_ACS_ST), 20, 100000);
@@ -602,7 +606,9 @@ mt7531_ind_c45_phy_write(struct mt7530_priv *priv, int port, int devad,
 
 	reg = MT7531_MDIO_CL45_ADDR | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_DEV_ADDR(devad) | regnum;
-	mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, val,
 				       !(val & MT7531_PHY_ACS_ST), 20, 100000);
@@ -613,7 +619,9 @@ mt7531_ind_c45_phy_write(struct mt7530_priv *priv, int port, int devad,
 
 	reg = MT7531_MDIO_CL45_WRITE | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_DEV_ADDR(devad) | data;
-	mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, val,
 				       !(val & MT7531_PHY_ACS_ST), 20, 100000);
@@ -646,7 +654,9 @@ mt7531_ind_c22_phy_read(struct mt7530_priv *priv, int port, int regnum)
 	val = MT7531_MDIO_CL22_READ | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_REG_ADDR(regnum);
 
-	mt7530_mii_write(priv, MT7531_PHY_IAC, val | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, val | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, val,
 				       !(val & MT7531_PHY_ACS_ST), 20, 100000);
@@ -681,7 +691,9 @@ mt7531_ind_c22_phy_write(struct mt7530_priv *priv, int port, int regnum,
 	reg = MT7531_MDIO_CL22_WRITE | MT7531_MDIO_PHY_ADDR(port) |
 	      MT7531_MDIO_REG_ADDR(regnum) | data;
 
-	mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	ret = mt7530_mii_write(priv, MT7531_PHY_IAC, reg | MT7531_PHY_ACS_ST);
+	if (ret < 0)
+		goto out;
 
 	ret = regmap_read_poll_timeout(priv->regmap, MT7531_PHY_IAC, reg,
 				       !(reg & MT7531_PHY_ACS_ST), 20, 100000);

From 851a01505ed711a04ed8d11898a7dc03d3071697 Mon Sep 17 00:00:00 2001
From: Laxman Acharya <acharyalaxman8848@gmail.com>
Date: Wed, 5 Aug 2026 23:22:01 +0545
Subject: [PATCH 0362/1982] Bluetooth: hci_event: fix out-of-bounds read in LE
 PA report reassembly

[ Upstream commit e3643fbddb257c928c075cab05bbd929106b56ee ]

hci_le_per_adv_report_evt() is dispatched with a minimum length of
sizeof(struct hci_ev_le_per_adv_report), which only covers the fixed
part of the event and not the trailing data[] array:

	struct hci_ev_le_per_adv_report {
		__le16   sync_handle;
		__u8     tx_power;
		__u8     rssi;
		__u8     cte_type;
		__u8     data_status;
		__u8     length;
		__u8     data[];
	} __packed;

The handler notifies the ISO layer via hci_proto_connect_ind(), which
reaches iso_connect_ind(). That function retrieves the stored event with
hci_recv_event_data() and, while reassembling the periodic advertising
data, does:

	memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset,
	       ev->data, ev->length);

ev->length is taken directly from the event and is never validated
against the amount of data the event actually carries.  A controller
that reports a length larger than the received event therefore causes
the memcpy() to read past the end of the event buffer.  The leaked bytes
are stored in hcon->le_per_adv_data and can subsequently be read back
from user space via getsockopt(BT_ISO_BASE).

Validate that the event contains ev->length data bytes before it is
consumed, mirroring the check already performed by
hci_le_ext_adv_report_evt() and hci_le_adv_report_evt().

Signed-off-by: Laxman Acharya <acharyalaxman8848@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 23fe327a0fcd6c..fd823baf644151 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6580,6 +6580,13 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
 
 	bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
 
+	/* The reassembly in iso_connect_ind() copies ev->length bytes from the
+	 * stored event, so make sure the event actually carries that many data
+	 * bytes before it is consumed.
+	 */
+	if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_PER_ADV_REPORT, ev->length))
+		return;
+
 	hci_dev_lock(hdev);
 
 	mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, PA_LINK, &flags);

From f3cd9a1d3828d887764df8151d76583d4758985d Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Tue, 4 Aug 2026 04:10:33 +0100
Subject: [PATCH 0363/1982] net: dsa: mt7530: check bus->read() error in
 core_rmw()

[ Upstream commit 573d6e3afe3d01e34dc82c77bf22ca96a74d805e ]

core_rmw() accesses the MMD core registers directly rather than
through the regmap and has the same unchecked bus->read() as the
one just fixed in the MDIO regmap backend: a negative errno is
consumed as register data, modified and written back to the switch.
Check the read and bail out like the surrounding bus accesses do.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/48bb9f0b311a9efeda2a6b24a7e05d4792393a3b.1785811140.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mt7530.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 24c7cb225da1a3..d2dcc2f1522f42 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -124,8 +124,12 @@ core_rmw(struct mt7530_priv *priv, u32 reg, u32 mask, u32 set)
 		goto err;
 
 	/* Read the content of the MMD's selected register */
-	val = bus->read(bus, MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr),
+	ret = bus->read(bus, MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr),
 			MII_MMD_DATA);
+	if (ret < 0)
+		goto err;
+	val = ret;
+
 	val &= ~mask;
 	val |= set;
 	/* Write the data into MMD's selected register */

From 77eed1651eb6f8119bc6982e75416205abf80456 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Tue, 4 Aug 2026 04:10:26 +0100
Subject: [PATCH 0364/1982] net: pcs: mtk-lynxi: check regmap reads in
 mtk_pcs_lynxi_get_state()

[ Upstream commit 5cc65c01cdc577621d1320f4aa03a1382c5a4a45 ]

mtk_pcs_lynxi_get_state() ignores regmap_read()'s return value; a
failed read leaves bm and adv holding uninitialized stack values
which are then decoded into the reported link state. The regmaps
backing the MT7531 SGMII PCS instances sit on an MDIO bus where
reads can fail. Check both reads and report the link as down on
error; phylink presets state->link before the callback, so a bare
return would leave a failed read reported as link-up.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/fce70657fc03bbaf60a04c0fbf2f418531135c4f.1785811140.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/pcs/pcs-mtk-lynxi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/pcs/pcs-mtk-lynxi.c b/drivers/net/pcs/pcs-mtk-lynxi.c
index 87df3a9dfc9bcc..64fb17c189afca 100644
--- a/drivers/net/pcs/pcs-mtk-lynxi.c
+++ b/drivers/net/pcs/pcs-mtk-lynxi.c
@@ -110,8 +110,11 @@ static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,
 	unsigned int bm, adv;
 
 	/* Read the BMSR and LPA */
-	regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm);
-	regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv);
+	if (regmap_read(mpcs->regmap, SGMSYS_PCS_CONTROL_1, &bm) ||
+	    regmap_read(mpcs->regmap, SGMSYS_PCS_ADVERTISE, &adv)) {
+		state->link = false;
+		return;
+	}
 
 	phylink_mii_c22_pcs_decode_state(state, neg_mode,
 					 FIELD_GET(SGMII_BMSR, bm),

From 2c6e0e56225900be64ae591945f3c30faf2ab951 Mon Sep 17 00:00:00 2001
From: Daniel Golle <daniel@makrotopia.org>
Date: Tue, 4 Aug 2026 04:10:46 +0100
Subject: [PATCH 0365/1982] net: dsa: mt7530: check CORE_PLL_GROUP4 access in
 mt7531_setup()

[ Upstream commit 1ae63b018d3d70e96d420b59a1334860cf232bc6 ]

mt7531_setup() reads CORE_PLL_GROUP4 through the MT7531 indirect c45
PHY access, modifies it and writes it back to enable the PHY core
PLL, but checks neither the read nor the write. Now that the indirect
access functions propagate command-write failures, a failed read
returns a negative errno that would be bit-modified and written back
into the PLL register, and a failed write-back would go unnoticed.
Check both and bail out. The adjacent EEE advertisement writes push a
constant value and cannot corrupt state, so they are left as is.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://patch.msgid.link/a7dfe3b66ea6ac1ae7915034de0527060e6ddcd4.1785811140.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mt7530.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index d2dcc2f1522f42..4f391ef797ea35 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -2758,14 +2758,20 @@ mt7531_setup(struct dsa_switch *ds)
 	 * phy_[read,write]_mmd_indirect is called, we provide our own
 	 * mt7531_ind_mmd_phy_[read,write] to complete this function.
 	 */
-	val = mt7531_ind_c45_phy_read(priv,
+	ret = mt7531_ind_c45_phy_read(priv,
 				      MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr),
 				      MDIO_MMD_VEND2, CORE_PLL_GROUP4);
+	if (ret < 0)
+		return ret;
+
+	val = ret;
 	val |= MT7531_RG_SYSPLL_DMY2 | MT7531_PHY_PLL_BYPASS_MODE;
 	val &= ~MT7531_PHY_PLL_OFF;
-	mt7531_ind_c45_phy_write(priv,
-				 MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr),
-				 MDIO_MMD_VEND2, CORE_PLL_GROUP4, val);
+	ret = mt7531_ind_c45_phy_write(priv,
+				       MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr),
+				       MDIO_MMD_VEND2, CORE_PLL_GROUP4, val);
+	if (ret < 0)
+		return ret;
 
 	/* Disable EEE advertisement on the switch PHYs. */
 	for (i = MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr);

From 38c960fb5b83ac2c94208df1799763df661ad24b Mon Sep 17 00:00:00 2001
From: Rui Qi <qirui.001@bytedance.com>
Date: Fri, 7 Aug 2026 19:24:33 -0600
Subject: [PATCH 0366/1982] riscv: kprobes: Prevent probes in breakpoint
 handlers

[ Upstream commit e7d8ea6c6d1bc685a8943ffad2d3679be92d164f ]

The ftrace selftest multiple_kprobes.tc registers kprobe events on
the first 256 text symbols from /proc/kallsyms. If handle_break() is
selected as a probe target on RISC-V, the breakpoint exception path
can trap again before it reaches the kprobe breakpoint handler. That
recursively enters do_trap_break() and can make the system
unresponsive.

Mark handle_break() and its local probe dispatch helpers as nokprobe
symbols so they are added to the kprobe blacklist, matching other
low-level breakpoint exception paths.

Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260806043807.2583001-1-qirui.001@bytedance.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kernel/traps.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
index 47afea4ff1a8d2..e7e45cbb089990 100644
--- a/arch/riscv/kernel/traps.c
+++ b/arch/riscv/kernel/traps.c
@@ -272,6 +272,7 @@ static bool probe_single_step_handler(struct pt_regs *regs)
 
 	return user ? uprobe_single_step_handler(regs) : kprobe_single_step_handler(regs);
 }
+NOKPROBE_SYMBOL(probe_single_step_handler);
 
 static bool probe_breakpoint_handler(struct pt_regs *regs)
 {
@@ -279,6 +280,7 @@ static bool probe_breakpoint_handler(struct pt_regs *regs)
 
 	return user ? uprobe_breakpoint_handler(regs) : kprobe_breakpoint_handler(regs);
 }
+NOKPROBE_SYMBOL(probe_breakpoint_handler);
 
 void handle_break(struct pt_regs *regs)
 {
@@ -303,6 +305,7 @@ void handle_break(struct pt_regs *regs)
 	else
 		die(regs, "Kernel BUG");
 }
+NOKPROBE_SYMBOL(handle_break);
 
 asmlinkage __visible __trap_section void do_trap_break(struct pt_regs *regs)
 {

From 8020e4ad1c59f89fbe5d77c50e9328bf6b007397 Mon Sep 17 00:00:00 2001
From: Atish Patra <atishp@meta.com>
Date: Fri, 7 Aug 2026 19:24:30 -0600
Subject: [PATCH 0367/1982] RISC-V: perf: fix resource cleanup on driver probe
 failure

[ Upstream commit e24a1418e90beac2ef4384bc9b0b5a10f19b806e ]

Sashiko pointed out various UAF and memory leak issues around
pmu_sbi_device_probe() error paths.

If the probe fails, here are list of cleanups needed.
a. Already registered pmu must be freed
b. per cpu IRQ must be released
c. pmu_ctr_list data structure must be freed
d. cpu hotplug state must be cleaned up only if added.

Fix the resource cleanup by reorganizing the code around probe failure.

Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Signed-off-by: Atish Patra <atishp@meta.com>
Link: https://patch.msgid.link/20260807-counter_delegation-v9-1-58658104e487@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/riscv_pmu_sbi.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index 25f3a45dd78699..10f64b7b60c53b 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -1258,22 +1258,29 @@ static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pde
 					  DOMAIN_BUS_ANY);
 	if (!domain) {
 		pr_err("Failed to find INTC IRQ root domain\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err;
 	}
 
 	riscv_pmu_irq = irq_create_mapping(domain, riscv_pmu_irq_num);
 	if (!riscv_pmu_irq) {
 		pr_err("Failed to map PMU interrupt for node\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err;
 	}
 
 	ret = request_percpu_irq(riscv_pmu_irq, pmu_sbi_ovf_handler, "riscv-pmu", hw_events);
 	if (ret) {
 		pr_err("registering percpu irq failed [%d]\n", ret);
-		return ret;
+		irq_dispose_mapping(riscv_pmu_irq);
+		riscv_pmu_irq = 0;
+		goto err;
 	}
 
 	return 0;
+err:
+	riscv_pmu_use_irq = false;
+	return ret;
 }
 
 #ifdef CONFIG_CPU_PM
@@ -1340,7 +1347,8 @@ static void riscv_pmu_destroy(struct riscv_pmu *pmu)
 		}
 	}
 	riscv_pm_pmu_unregister(pmu);
-	cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
+	if (!hlist_unhashed(&pmu->node))
+		cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
 }
 
 static void pmu_sbi_event_init(struct perf_event *event)
@@ -1462,6 +1470,7 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
 	struct riscv_pmu *pmu = NULL;
 	int ret = -ENODEV;
 	int num_counters;
+	bool irq_requested = false;
 
 	pr_info("SBI PMU extension is available\n");
 	pmu = riscv_pmu_alloc();
@@ -1490,6 +1499,7 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
 		pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
 		pmu->pmu.capabilities |= PERF_PMU_CAP_NO_EXCLUDE;
 	}
+	irq_requested = (ret == 0);
 
 	pmu->pmu.attr_groups = riscv_pmu_attr_groups;
 	pmu->pmu.parent = &pdev->dev;
@@ -1508,11 +1518,11 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
 
 	ret = riscv_pm_pmu_register(pmu);
 	if (ret)
-		goto out_unregister;
+		goto out_destroy;
 
 	ret = perf_pmu_register(&pmu->pmu, "cpu", PERF_TYPE_RAW);
 	if (ret)
-		goto out_unregister;
+		goto out_destroy;
 
 	/* SBI PMU Snapsphot is only available in SBI v2.0 */
 	if (sbi_v2_available) {
@@ -1553,9 +1563,20 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
 	return 0;
 
 out_unregister:
+	perf_pmu_unregister(&pmu->pmu);
+
+out_destroy:
 	riscv_pmu_destroy(pmu);
+	if (irq_requested) {
+		free_percpu_irq(riscv_pmu_irq, pmu->hw_events);
+		irq_dispose_mapping(riscv_pmu_irq);
+		riscv_pmu_irq = 0;
+	}
 
 out_free:
+	free_percpu(pmu->hw_events);
+	kfree(pmu_ctr_list);
+	pmu_ctr_list = NULL;
 	kfree(pmu);
 	return ret;
 }

From 8b9b1c171bafe87ac6a7c02b7cf33fd09e237642 Mon Sep 17 00:00:00 2001
From: Andreas Kemnade <andreas@kemnade.info>
Date: Thu, 2 Jul 2026 17:50:35 +0200
Subject: [PATCH 0368/1982] fbdev: omap2: dsi: do not copy isr table

[ Upstream commit 31875c51c31edec57b3620f278680c23a823763b ]

To te able to unregister stuff from isrs, the corresponding table was
copied.  Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.

Suggested-by: sashiko-bot@kernel.org
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
index 370e8623754ec3..b1df2c014b00c2 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
@@ -326,8 +326,6 @@ struct dsi_data {
 
 	spinlock_t irq_lock;
 	struct dsi_isr_tables isr_tables;
-	/* space for a copy used by the interrupt handler */
-	struct dsi_isr_tables isr_tables_copy;
 
 	int update_channel;
 #ifdef DSI_PERF_MEASURE
@@ -838,15 +836,10 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
 		timer_delete(&dsi->te_timer);
 #endif
 
-	/* make a copy and unlock, so that isrs can unregister
-	 * themselves */
-	memcpy(&dsi->isr_tables_copy, &dsi->isr_tables,
-		sizeof(dsi->isr_tables));
 
+	dsi_handle_isrs(&dsi->isr_tables, irqstatus, vcstatus, ciostatus);
 	spin_unlock(&dsi->irq_lock);
 
-	dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
-
 	dsi_handle_irq_errors(dsidev, irqstatus, vcstatus, ciostatus);
 
 	dsi_collect_irq_stats(dsidev, irqstatus, vcstatus, ciostatus);

From 01f4a7eeedac8e8f597dde77e61538dbd2be541d Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Mon, 6 Jul 2026 17:30:38 +0800
Subject: [PATCH 0369/1982] fbdev: udlfb: validate vendor descriptor items

[ Upstream commit 3cc2fad376ac7360b4518277aa923752624db59c ]

dlfb_parse_vendor_descriptor() walks key-length-value items inside the
DisplayLink vendor descriptor.

Require each item to contain its key, length and declared value bytes
before reading item-specific fields such as max_area.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/udlfb.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 70ff38f35096a7..1c82ee6984c8d1 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1586,19 +1586,29 @@ static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb,
 		desc += 5; /* the fixed header we've already parsed */
 
 		while (desc < desc_end) {
+			char *value;
 			u8 length;
 			u16 key;
 
-			key = *desc++;
-			key |= (u16)*desc++ << 8;
+			if (desc_end - desc < sizeof(key) + sizeof(length))
+				goto unrecognized;
+
+			key = get_unaligned_le16(desc);
+			desc += sizeof(key);
 			length = *desc++;
 
+			if (length > desc_end - desc)
+				goto unrecognized;
+
+			value = desc;
 			switch (key) {
 			case 0x0200: { /* max_area */
-				u32 max_area = *desc++;
-				max_area |= (u32)*desc++ << 8;
-				max_area |= (u32)*desc++ << 16;
-				max_area |= (u32)*desc++ << 24;
+				u32 max_area;
+
+				if (length < sizeof(max_area))
+					goto unrecognized;
+
+				max_area = get_unaligned_le32(value);
 				dev_warn(&intf->dev,
 					 "DL chip limited to %d pixel modes\n",
 					 max_area);

From 1b8a5b21ef8d9ba3f7b59e5e606b8e94a26fe76f Mon Sep 17 00:00:00 2001
From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Date: Wed, 5 Aug 2026 07:42:57 +0800
Subject: [PATCH 0370/1982] iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting
 shared variables in flush loop

[ Upstream commit 3846e469c1ba1407260066070bff5c88ee39a4c7 ]

In cache_tag_flush_range(), the CACHE_TAG_NESTING_DEVTLB case modifies the
shared local variables 'addr' and 'mask' before falling through to
CACHE_TAG_DEVTLB. This causes all subsequent CACHE_TAG_DEVTLB entries in
the same loop iteration to incorrectly use the full-range flush parameters
(addr=0, mask=MAX_AGAW_PFN_WIDTH) instead of the precisely calculated PSI
range. This is not the intended behavior, as regular DEVTLB entries should
always perform targeted range-based invalidation.

Fix this by having CACHE_TAG_NESTING_DEVTLB directly call
cache_tag_flush_devtlb_psi() with the full-range constants and break,
instead of modifying shared variables and falling through. This ensures
CACHE_TAG_DEVTLB always uses the original calculated addr and mask for
precise range flush.

This change slightly affects trace_cache_tag_flush_range() behavior.
Previously, after addr/mask were overwritten, the tracepoint could record
a full-range flush even when the caller requested a narrower range.

The tracepoint should reflect caller intent. Although this helper may
widen the actual hardware invalidation range for implementation reasons,
that does not change what the caller requested, so logging the requested
range is the correct behavior.

If the actual invalidation range sent to hardware is needed, it is already
visible via the qi_submit trace event, which records the invalidation
descriptors emitted by the driver.

Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel/cache.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c
index 385ae5cfb30d4a..e6bc730fac3b06 100644
--- a/drivers/iommu/intel/cache.c
+++ b/drivers/iommu/intel/cache.c
@@ -468,9 +468,8 @@ void cache_tag_flush_range(struct dmar_domain *domain, unsigned long start,
 			 * affected by a change in S2. So just flush the entire
 			 * device cache.
 			 */
-			addr = 0;
-			mask = MAX_AGAW_PFN_WIDTH;
-			fallthrough;
+			cache_tag_flush_devtlb_psi(domain, tag, 0, MAX_AGAW_PFN_WIDTH);
+			break;
 		case CACHE_TAG_DEVTLB:
 			cache_tag_flush_devtlb_psi(domain, tag, addr, mask);
 			break;

From ad47c1a094740ce3207bb28477b0c83d352ad5a0 Mon Sep 17 00:00:00 2001
From: Michal Pecio <michal.pecio@gmail.com>
Date: Mon, 10 Aug 2026 07:57:28 +0200
Subject: [PATCH 0371/1982] ALSA: usx2y: Stop clearing urb->hcpriv before
 submission

[ Upstream commit fabae5548149ef5c8a056875d9ebdc38366db539 ]

This is managed by USB core and drivers aren't expected to touch it.

It should only be not NULL on a submitted URB, in which case clearing
defeats the "submitted while active" sanity check in usb_submit_urb()
and may crash the HCD handling the URB and panic the kernel.

Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Link: https://patch.msgid.link/20260810075728.483c827e.michal.pecio@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/usx2y/usbusx2yaudio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index c7c7ec9c228b4f..1ea181e9bb2839 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -167,7 +167,6 @@ static int usx2y_urb_submit(struct snd_usx2y_substream *subs, struct urb *urb, i
 	if (!urb)
 		return -ENODEV;
 	urb->start_frame = frame + NRURBS * nr_of_packs();  // let hcd do rollover sanity checks
-	urb->hcpriv = NULL;
 	urb->dev = subs->usx2y->dev; /* we need to set this at each time */
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err < 0) {

From 5db10037b9c1288d70680c3dde2b8553f35aa62e Mon Sep 17 00:00:00 2001
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
Date: Fri, 17 Jul 2026 16:03:35 +0800
Subject: [PATCH 0372/1982] perf/x86: Unregister PMI handler on PMU init
 failure

[ Upstream commit 91787047b1dc52b1fee68b07f79af70aae5fce47 ]

Fix an NMI handler leak in init_hw_perf_events(). When PMU
initialization fails after register_nmi_handler(), the error path
exits without calling unregister_nmi_handler(), leaving a stale
NMI_LOCAL "PMI" handler registered. Add the missing call before
clearing x86_pmu state.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
Reviewed-by: Zide Chen <zide.chen@intel.com>
Link: https://patch.msgid.link/20260717080342.1879573-2-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 330c2ba41f076a..2aa9270446634e 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2175,7 +2175,7 @@ static int __init init_hw_perf_events(void)
 	err = cpuhp_setup_state(CPUHP_PERF_X86_PREPARE, "perf/x86:prepare",
 				x86_pmu_prepare_cpu, x86_pmu_dead_cpu);
 	if (err)
-		return err;
+		goto pmi_unregister;
 
 	err = cpuhp_setup_state(CPUHP_AP_PERF_X86_STARTING,
 				"perf/x86:starting", x86_pmu_starting_cpu,
@@ -2229,6 +2229,8 @@ static int __init init_hw_perf_events(void)
 	cpuhp_remove_state(CPUHP_AP_PERF_X86_STARTING);
 out:
 	cpuhp_remove_state(CPUHP_PERF_X86_PREPARE);
+pmi_unregister:
+	unregister_nmi_handler(NMI_LOCAL, "PMI");
 out_bad_pmu:
 	memset(&x86_pmu, 0, sizeof(x86_pmu));
 	return err;

From 1f8ddae246332537b4681fae2918d9a788d17c91 Mon Sep 17 00:00:00 2001
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
Date: Fri, 17 Jul 2026 16:03:36 +0800
Subject: [PATCH 0373/1982] perf/x86: Free hybrid state on PMU init failure

[ Upstream commit 96746e731e1626545e343974ca4673739dceb31b ]

If PMU initialization fails, for example in check_hw_exists(), hybrid
state can be left partially initialized: x86_pmu.hybrid_pmu is not freed
and perf_is_hybrid remains set. This can leak memory and leave stale
hybrid state reachable after a failed init path.

Add x86_pmu_free_hybrid() and use it on PMU init failure paths so all
hybrid-related state is consistently reset.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
Reviewed-by: Zide Chen <zide.chen@intel.com>
Link: https://patch.msgid.link/20260717080342.1879573-3-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 2aa9270446634e..7c37c228a88a47 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2087,6 +2087,17 @@ void x86_pmu_show_pmu_cap(struct pmu *pmu)
 	pr_info("... global_ctrl mask:          %016llx\n", hybrid(pmu, intel_ctrl));
 }
 
+static void x86_pmu_free_hybrid(void)
+{
+	if (!x86_pmu.hybrid_pmu)
+		return;
+
+	static_branch_disable(&perf_is_hybrid);
+	kfree(x86_pmu.hybrid_pmu);
+	x86_pmu.hybrid_pmu = NULL;
+	x86_pmu.num_hybrid_pmus = 0;
+}
+
 static int __init init_hw_perf_events(void)
 {
 	struct x86_pmu_quirk *quirk;
@@ -2214,9 +2225,6 @@ static int __init init_hw_perf_events(void)
 			for (j = 0; j < i; j++)
 				perf_pmu_unregister(&x86_pmu.hybrid_pmu[j].pmu);
 			pr_warn("Failed to register hybrid PMUs\n");
-			kfree(x86_pmu.hybrid_pmu);
-			x86_pmu.hybrid_pmu = NULL;
-			x86_pmu.num_hybrid_pmus = 0;
 			goto out2;
 		}
 	}
@@ -2232,6 +2240,7 @@ static int __init init_hw_perf_events(void)
 pmi_unregister:
 	unregister_nmi_handler(NMI_LOCAL, "PMI");
 out_bad_pmu:
+	x86_pmu_free_hybrid();
 	memset(&x86_pmu, 0, sizeof(x86_pmu));
 	return err;
 }

From def617fb61508dcfc921ee293fade45ed8129d03 Mon Sep 17 00:00:00 2001
From: Hari Mishal <harimishal1@gmail.com>
Date: Fri, 17 Jul 2026 16:43:53 +0200
Subject: [PATCH 0374/1982] nvmet: passthru: fix OOB reads when parsing ns id
 descriptor list

[ Upstream commit bc7f75eba50012ed447654d8ce169ebaba695193 ]

nvmet_passthru_override_id_descs() walks a namespace identification
descriptor list populated from the underlying passthru controller's
Identify response, which is device reported. The loop advanced pos by
device controlled amounts (sizeof(*cur) + nidl) without checking that
the next descriptor header actually fits inside the buffer, so a
malicious device could push pos to within a few bytes of the buffer end
and cause cur->nidl, cur->nidt or the reserved field to be read past the
allocation.

Additionally, when a CSI descriptor lands exactly at the last valid
header offset, cur + 1 points one byte past the end of the buffer.
The unconditional memcpy(&csi, cur + 1, NVME_NIDT_CSI_LEN) could read
that out-of-bounds byte and copy it back to the initiator via
nvmet_copy_to_sgl(), leaking adjacent heap memory.

Bounds check both the descriptor header and the CSI value before
dereferencing them.

Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/passthru.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c
index 0c361b1e356656..6d7469c94610ed 100644
--- a/drivers/nvme/target/passthru.c
+++ b/drivers/nvme/target/passthru.c
@@ -53,13 +53,22 @@ static u16 nvmet_passthru_override_id_descs(struct nvmet_req *req)
 	for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) {
 		struct nvme_ns_id_desc *cur = data + pos;
 
+		if (pos + sizeof(*cur) > NVME_IDENTIFY_DATA_SIZE)
+			break;
+
 		if (cur->nidl == 0)
 			break;
+
 		if (cur->nidt == NVME_NIDT_CSI) {
+			if (pos + sizeof(*cur) + NVME_NIDT_CSI_LEN >
+						NVME_IDENTIFY_DATA_SIZE)
+				break;
+
 			memcpy(&csi, cur + 1, NVME_NIDT_CSI_LEN);
 			csi_seen = true;
 			break;
 		}
+
 		len = sizeof(struct nvme_ns_id_desc) + cur->nidl;
 	}
 

From 9407cfd34fe29d2804a79c2a50fbc078a89652d9 Mon Sep 17 00:00:00 2001
From: Brian Grech <bgrech@redhat.com>
Date: Thu, 6 Aug 2026 10:16:45 -0500
Subject: [PATCH 0375/1982] selftests/net: fin_ack_lat: fix latency threshold
 typo

[ Upstream commit 2373107782a98ba15931a37bbd9dd46d7213e5aa ]

The commit message for af8c8a450bf4 ("selftests: net: Add FIN_ACK
processing order related latency spike test") states: "if the latency
is larger than 1 second (spike), print a message". However the code
uses a threshold of 100000 us (100 ms), not 1000000 us (1 s).

The lower threshold causes false positives on slower hardware where
normal connection latency occasionally exceeds 100 ms but never
approaches the 1 s spike that indicates the actual FIN/ACK race bug.

Fix the threshold to match the documented intent.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Brian Grech <bgrech@redhat.com>
Link: https://patch.msgid.link/20260806151645.4172900-1-bgrech@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/fin_ack_lat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/fin_ack_lat.c b/tools/testing/selftests/net/fin_ack_lat.c
index 70187494b57af1..4117332eb1a9c6 100644
--- a/tools/testing/selftests/net/fin_ack_lat.c
+++ b/tools/testing/selftests/net/fin_ack_lat.c
@@ -69,7 +69,7 @@ static void client(int port)
 		lat = timediff(start, end);
 		sum_lat += lat;
 		nr_lat++;
-		if (lat < 100000)
+		if (lat < 1000000)
 			goto close;
 
 		if (getsockname(sock, (struct sockaddr *)&laddr, &len) == -1)

From 42a29688f693bb3fdb0c39d6b581167570b8b293 Mon Sep 17 00:00:00 2001
From: Zhe Liu <liuzhe1@kylinos.cn>
Date: Mon, 10 Aug 2026 14:35:35 +0800
Subject: [PATCH 0376/1982] docs: cgroup-v2: fix stale "io" controller
 introduction

[ Upstream commit 3345c7248a9e2a91cb9e2477c29af16881706f4f ]

The introductory paragraph for the IO controller still states that
weight based distribution is "available only if cfq-iosched is in use"
and that "neither scheme is available for blk-mq devices".  This text
dates from when the cgroup v2 documentation was first written (2015)
and was correct at the time, but is no longer accurate:

  * cfq-iosched was removed in v5.0;
  * blk-mq is now the only block I/O path, and both the absolute limit
    scheme (io.max via blk-throttle) and the weight based scheme
    (io.weight via iocost, or io.bfq.weight under BFQ) work on it;
  * latency based protection (iolatency) and I/O priority (ioprio)
    controllers have since been added.

The rest of the section already documents io.weight, io.max,
io.cost.{qos,model}, io.latency and io.prio.class correctly, so the
introduction is the only part that contradicts them.  Rewrite it to
reflect the current state.

Signed-off-by: Zhe Liu <liuzhe1@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/admin-guide/cgroup-v2.rst | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index edcd125d6992fb..a62505e55dd07f 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -1959,9 +1959,13 @@ IO
 
 The "io" controller regulates the distribution of IO resources.  This
 controller implements both weight based and absolute bandwidth or IOPS
-limit distribution; however, weight based distribution is available
-only if cfq-iosched is in use and neither scheme is available for
-blk-mq devices.
+limit distribution.  Absolute BPS and IOPS limits are enforced by
+blk-throttle and apply to all devices, while weight based proportional
+distribution is provided by the iocost cost model controller
+(CONFIG_BLK_CGROUP_IOCOST) and, when the BFQ I/O scheduler is in use
+for a device, by BFQ's own cgroup support.  Latency-based protection
+(CONFIG_BLK_CGROUP_IOLATENCY) and I/O priority assignment
+(CONFIG_BLK_CGROUP_IOPRIO) are also available.
 
 
 IO Interface Files

From 852e06e77d7eced54aabf42c5f002d306c7a26de Mon Sep 17 00:00:00 2001
From: Geliang Tang <tanggeliang@kylinos.cn>
Date: Sun, 26 Jul 2026 10:46:49 +0800
Subject: [PATCH 0377/1982] nvme-tcp: look up host_iface in the current netns

[ Upstream commit 58202950e39c127d593ec4f0624d8b8985a285b1 ]

nvme_tcp_alloc_ctrl() looks opts->host_iface up in &init_net, the boot-time
netns. When called from any other netns - e.g. the selftest's ns2, where
ns2eth1 actually lives - the lookup misses and the controller setup fails
with "invalid interface passed":

 nvmet: adding nsid 1 to subsystem nqn.2014-08.org.nvmexpress.mptcpdev
 nvmet_tcp: enabling port 24660 (0.0.0.0:24099)
 # nvme discover -a 10.1.1.1 --tos=0x10 --host-iface=ns2eth1
 nvme_tcp: invalid interface passed: ns2eth1
 # failed to add controller, error invalid interface

Look the device up in current->nsproxy->net_ns instead so the check sees
the calling task's netns.

Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index beef2b576102a0..1f26e35d7a99ee 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2999,7 +2999,8 @@ static struct nvme_tcp_ctrl *nvme_tcp_alloc_ctrl(struct device *dev,
 	}
 
 	if (opts->mask & NVMF_OPT_HOST_IFACE) {
-		if (!__dev_get_by_name(&init_net, opts->host_iface)) {
+		if (!__dev_get_by_name(current->nsproxy->net_ns,
+				       opts->host_iface)) {
 			pr_err("invalid interface passed: %s\n",
 			       opts->host_iface);
 			ret = -ENODEV;

From 2f99cf389f72032776898fb2aa29842786ad4651 Mon Sep 17 00:00:00 2001
From: Rongguang Wei <weirongguang@kylinos.cn>
Date: Fri, 7 Aug 2026 15:09:14 +0800
Subject: [PATCH 0378/1982] tap: fix incorrect variable used for USO check in
 set_offload()

[ Upstream commit fac7973f004de6dd51fb15a33e33ed37718e58bb ]

The USO features in set_offload() incorrectly uses feature_mask and
features argument.

The USO feature was written to the local features variable instead of
feature_mask. All other offload bits (TSO, TSO_ECN) are stored in
feature_mask which becomes tap->tap_features and is used by
tap_handle_frame() for GSO segmentation. Without NETIF_F_GSO_UDP_L4
in tap->tap_features, making USO on tap effectively non-functional.

Keeping the USO handling inside the TUN_F_CSUM block avoids enabling
GRO/LRO when userspace requests USO without CSUM.

This has not worked since the beginning, so
commit 399e0827642f ("driver/net/tun: Added features for USO.")

Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260807070914.112698-1-clementwei90@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/tap.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 1aeaecd4030fad..9eea418afe2fca 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -883,7 +883,7 @@ static int set_offload(struct tap_queue *q, unsigned long arg)
 
 		/* TODO: for now USO4 and USO6 should work simultaneously */
 		if ((arg & (TUN_F_USO4 | TUN_F_USO6)) == (TUN_F_USO4 | TUN_F_USO6))
-			features |= NETIF_F_GSO_UDP_L4;
+			feature_mask |= NETIF_F_GSO_UDP_L4;
 	}
 
 	/* tun/tap driver inverts the usage for TSO offloads, where
@@ -894,8 +894,7 @@ static int set_offload(struct tap_queue *q, unsigned long arg)
 	 * When user space turns off TSO, we turn off GSO/LRO so that
 	 * user-space will not receive TSO frames.
 	 */
-	if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6) ||
-	    (feature_mask & (TUN_F_USO4 | TUN_F_USO6)) == (TUN_F_USO4 | TUN_F_USO6))
+	if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_GSO_UDP_L4))
 		features |= RX_OFFLOADS;
 	else
 		features &= ~RX_OFFLOADS;

From 0929249787896b9b7a0daab3c5301b19faa9fa52 Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Tue, 28 Jul 2026 13:14:49 -0700
Subject: [PATCH 0379/1982] apparmor: fix auditing of mount binary data

[ Upstream commit b9f2181b90ec047488dcb4fb1c631d417aff07e0 ]

AppArmor only mediates non-binary mount data, and should only
audit the mount data if it is non-binary.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/mount.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index 2f5d918832c10c..31f792817643cd 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -344,8 +344,8 @@ static int match_mnt_path_str(const struct cred *subj_cred,
 
 audit:
 	return audit_mount(subj_cred, profile, OP_MOUNT, mntpnt, devname,
-			   type, NULL,
-			   flags, data, AA_MAY_MOUNT, &perms, info, error);
+			   type, NULL, flags, !binary ? data : NULL,
+			   AA_MAY_MOUNT, &perms, info, error);
 }
 
 /**

From 7c42cf55b15fef029488b97623156f12540b07d6 Mon Sep 17 00:00:00 2001
From: Feng Tang <feng.tang@linux.alibaba.com>
Date: Fri, 7 Aug 2026 08:24:36 +0800
Subject: [PATCH 0380/1982] selftests: net: reuseport_bpf_numa: consider
 cpuless numa node

[ Upstream commit 88b8d85e889e2fe1cce3e66e50c3029dda94842a ]

reuseport_bpf_numa case failed when testing on a platform with CXL
memory:

    #./reuseport_bpf_numa
    ---- IPv4 UDP ----
    send node 0, receive socket 0
    ./reuseport_bpf_numa: failed to pin to node: Invalid argument

The root cause is that the platform has 2 numa nodes: node 0 has
both cpu and memory, while node 1 is a CXL node which only has
memory, and caused numa_run_on_node() to fail.

Add sanity check to skip cpuless numa node for the numa binding test.

Signed-off-by: Feng Tang <feng.tang@linux.alibaba.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260807002436.43991-1-feng.tang@linux.alibaba.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/net/reuseport_bpf_numa.c        | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/tools/testing/selftests/net/reuseport_bpf_numa.c b/tools/testing/selftests/net/reuseport_bpf_numa.c
index c9ba36aa688e25..b04b511809ad25 100644
--- a/tools/testing/selftests/net/reuseport_bpf_numa.c
+++ b/tools/testing/selftests/net/reuseport_bpf_numa.c
@@ -104,6 +104,26 @@ static void attach_bpf(int fd)
 	close(bpf_fd);
 }
 
+/*
+ * Return true if it is a cpuless node. Return false if it isn't or any
+ * error (very unlikely) happens during the libnuma calls.
+ */
+static bool is_cpuless_node(int node_id)
+{
+	struct bitmask *cpumask;
+	bool ret = false;
+
+	cpumask = numa_allocate_cpumask();
+	if (!cpumask)
+		return ret;
+
+	if (!numa_node_to_cpus(node_id, cpumask) && !numa_bitmask_weight(cpumask))
+		ret = true;
+
+	numa_bitmask_free(cpumask);
+	return ret;
+}
+
 static void send_from_node(int node_id, int family, int proto)
 {
 	struct sockaddr_storage saddr, daddr;
@@ -213,6 +233,8 @@ static void test(int *rcv_fd, int len, int family, int proto)
 	for (node = 0; node < len; ++node) {
 		if (!numa_bitmask_isbitset(numa_nodes_ptr, node))
 			continue;
+		if (is_cpuless_node(node))
+			continue;
 		send_from_node(node, family, proto);
 		receive_on_node(rcv_fd, len, epfd, node, proto);
 	}
@@ -221,6 +243,8 @@ static void test(int *rcv_fd, int len, int family, int proto)
 	for (node = len - 1; node >= 0; --node) {
 		if (!numa_bitmask_isbitset(numa_nodes_ptr, node))
 			continue;
+		if (is_cpuless_node(node))
+			continue;
 		send_from_node(node, family, proto);
 		receive_on_node(rcv_fd, len, epfd, node, proto);
 	}

From 8f22f2b887fcfa62fd5f62f1b98c67be727b8632 Mon Sep 17 00:00:00 2001
From: Vasant Hegde <vasant.hegde@amd.com>
Date: Tue, 11 Aug 2026 04:08:58 +0000
Subject: [PATCH 0381/1982] iommu/amd: Fix missing CMD_COMPLETE_PPR response
 for invalid PPR requests

[ Upstream commit bc1f5ec826bfa510e7138e2be5aad23907850874 ]

The AMD IOMMU spec, requires the host to respond with a CMD_COMPLETE_PPR
command when an EVENT_TYPE_INV_PPR_REQ event is received with the RX bit
cleared. This response was missing in the current implementation, leaving
invalid PPR requests unacknowledged.

Introduce amd_iommu_report_ppr_err() to handle EVENT_TYPE_INV_PPR_REQ
events. The new function logs the invalid PPR request and when the RX
bit is cleared, sends CMD_COMPLETE_PPR response.

Reported-by: Gaultier Delbarre <Gaultier.Delbarre@amd.com>
Co-developed-by: Wei Huang <wei.huang2@amd.com>
Signed-off-by: Wei Huang <wei.huang2@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd/amd_iommu_types.h |  1 +
 drivers/iommu/amd/iommu.c           | 38 ++++++++++++++++++++++++-----
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index dee077bd149b79..5f43a0fcdd1e30 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -158,6 +158,7 @@
 #define EVENT_FLAGS_SHIFT	0x10
 #define EVENT_FLAG_RW		0x020
 #define EVENT_FLAG_I		0x008
+#define EVENT_FLAG_PPR_RX	0x001
 
 /* feature control bits */
 #define CONTROL_IOMMU_EN	0
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index e64e6da08a5f7c..49587eafc0a8fb 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -883,10 +883,40 @@ static void amd_iommu_report_page_fault(struct amd_iommu *iommu,
 		pci_dev_put(pdev);
 }
 
+static void amd_iommu_report_ppr_err(struct amd_iommu *iommu, volatile u32 *event,
+				     u16 devid, u64 address, int flags)
+{
+	struct pci_dev *pdev;
+	struct device *dev = iommu->iommu.dev;
+	u32 pasid = PPR_PASID(*((u64 *)event));
+	int tag = event[1] & 0x03FF;
+
+	dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n",
+		iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+		pasid, address, flags, tag);
+
+	/* Skip COMPLETE_PPR_REQUEST response if RX=1 */
+	if (flags & EVENT_FLAG_PPR_RX)
+		return;
+
+	pdev = pci_get_domain_bus_and_slot(iommu->pci_seg->id, PCI_BUS_NUM(devid),
+					   devid & 0xff);
+	if (!pdev)
+		return;
+
+	if (!dev_iommu_priv_get(&pdev->dev)) {
+		pci_dev_put(pdev);
+		return;
+	}
+
+	amd_iommu_complete_ppr(&pdev->dev, pasid, IOMMU_PAGE_RESP_FAILURE, tag);
+	pci_dev_put(pdev);
+}
+
 static void iommu_print_event(struct amd_iommu *iommu, void *__evt)
 {
 	struct device *dev = iommu->iommu.dev;
-	int type, devid, flags, tag;
+	int type, devid, flags;
 	volatile u32 *event = __evt;
 	int count = 0;
 	u64 address, ctrl;
@@ -960,11 +990,7 @@ static void iommu_print_event(struct amd_iommu *iommu, void *__evt)
 		amd_iommu_report_rmp_hw_error(iommu, event);
 		break;
 	case EVENT_TYPE_INV_PPR_REQ:
-		pasid = PPR_PASID(*((u64 *)__evt));
-		tag = event[1] & 0x03FF;
-		dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n",
-			iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
-			pasid, address, flags, tag);
+		amd_iommu_report_ppr_err(iommu, event, devid, address, flags);
 		break;
 	default:
 		dev_err(dev, "Event logged [UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n",

From d72106a40a554fae26e600214bac2aaeb12e4203 Mon Sep 17 00:00:00 2001
From: Griffin Kroah-Hartman <griffin@kroah.com>
Date: Tue, 7 Jul 2026 16:22:17 +0200
Subject: [PATCH 0382/1982] nfc: mrvl: spi: Unregister dev on allocation fail

[ Upstream commit d832b95697384a2b67f20b35106bbf925358cde9 ]

Call nfcmrvl_nci_unregister_dev() if nci_spi_allocate_spi() fails,
unwrapping the previous call to nfcmrvl_nci_register_dev() during the
nfcmrvl_spi_probe() function.

Assisted-by: gkh-clanker-2000
Cc: David Heidelberg <david@ixit.cz>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026070716-crucial-slouchy-b8a9@gregkh
Signed-off-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/nfcmrvl/spi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c
index 9c8cde1250fb5e..dad07c8e13b84d 100644
--- a/drivers/nfc/nfcmrvl/spi.c
+++ b/drivers/nfc/nfcmrvl/spi.c
@@ -168,6 +168,10 @@ static int nfcmrvl_spi_probe(struct spi_device *spi)
 
 	drv_data->nci_spi = nci_spi_allocate_spi(drv_data->spi, 0, 10,
 						 drv_data->priv->ndev);
+	if (!drv_data->nci_spi) {
+		nfcmrvl_nci_unregister_dev(drv_data->priv);
+		return -ENOMEM;
+	}
 
 	/* Init completion for slave handshake */
 	init_completion(&drv_data->handshake_completion);

From 9c5a037acdec408a7db4a85fbc78217109ee72e7 Mon Sep 17 00:00:00 2001
From: Griffin Kroah-Hartman <griffin@kroah.com>
Date: Tue, 7 Jul 2026 16:23:27 +0200
Subject: [PATCH 0383/1982] nfc: nxp-nci: Add remove on IRQ error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 56345cea6a30dc7a1b036d5fb7900434b4a4c5e8 ]

Add a call to nxp_nci_remove() in nxp_nci_i2c_probe() when the
request_threaded_irq() fails.
Previously, IRQ resources were not being freed upon error.

Assisted-by: gkh_clanker_2000
Cc: David Heidelberg <david@ixit.cz>
Cc: Carl Lee <carl.lee@amd.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Cc: Ian Ray <ian.ray@gehealthcare.com>
Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@baylibre.com>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Ian Ray <ian.ray@gehealthcare.com>
Link: https://patch.msgid.link/2026070726-observer-fang-9716@gregkh
Signed-off-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/nxp-nci/i2c.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
index a6c08175d9dd93..213d3eea7dd048 100644
--- a/drivers/nfc/nxp-nci/i2c.c
+++ b/drivers/nfc/nxp-nci/i2c.c
@@ -326,8 +326,10 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
 				 nxp_nci_i2c_irq_thread_fn,
 				 irqflags | IRQF_ONESHOT,
 				 NXP_NCI_I2C_DRIVER_NAME, phy);
-	if (r < 0)
+	if (r < 0) {
 		nfc_err(&client->dev, "Unable to register IRQ handler\n");
+		nxp_nci_remove(phy->ndev);
+	}
 
 	return r;
 }

From f360874df64b9268d2e8b0ebaa75a8e73459afba Mon Sep 17 00:00:00 2001
From: Chao Shi <coshi036@gmail.com>
Date: Mon, 10 Aug 2026 18:02:58 -0400
Subject: [PATCH 0384/1982] nvme: ratelimit the completion-path messages driven
 by device data

[ Upstream commit c05c86681170e381e24498257db3a879deb1ae89 ]

nvme_find_rq() and nvme_handle_cqe() print an unratelimited message for
every completion queue entry whose command id does not resolve to an
in-flight request.  Both are reached from the completion interrupt path
(nvme_irq() -> nvme_poll_cq() -> nvme_handle_cqe()) and the decision to
print is made entirely from device-supplied data, so a controller that
posts a stream of bogus command ids drives unbounded printk from hard
interrupt context.

This is not hypothetical.  A single boot under an emulated controller
that posts invalid completions produced 846 "could not locate request
for tag 0x0", 846 "invalid id 0 completed on queue 2" and 123 "genctr
mismatch" lines.  Once the tag set has been torn down every subsequent
completion resolves to nothing, so the print rate is bounded only by how
fast the device can post entries.

Ratelimit the three messages.  The information they carry is diagnostic
and repeats, so the suppression count printed by the ratelimit helpers
is enough to tell that the condition persists.  This matches how the
other device-driven error prints in the driver are already handled, for
example the status messages in nvme_log_error() and
nvme_log_err_passthru().

nvme_find_rq() lives in nvme.h and is shared by pci, tcp, rdma, apple and
target-loop, so all transports are covered.

Found by FuzzNvme.

Signed-off-by: Chao Shi <coshi036@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/nvme.h | 6 +++---
 drivers/nvme/host/pci.c  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index ec03a07617af1e..b28c1a82f79e63 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -672,12 +672,12 @@ static inline struct request *nvme_find_rq(struct blk_mq_tags *tags,
 
 	rq = blk_mq_tag_to_rq(tags, tag);
 	if (unlikely(!rq)) {
-		pr_err("could not locate request for tag %#x\n",
-			tag);
+		pr_err_ratelimited("could not locate request for tag %#x\n",
+				   tag);
 		return NULL;
 	}
 	if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) != genctr)) {
-		dev_err(nvme_req(rq)->ctrl->device,
+		dev_err_ratelimited(nvme_req(rq)->ctrl->device,
 			"request %#x genctr mismatch (got %#x expected %#x)\n",
 			tag, genctr, nvme_genctr_mask(nvme_req(rq)->genctr));
 		return NULL;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4efb55f1e3833b..6e4261b0a0821d 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1375,9 +1375,9 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
 
 	req = nvme_find_rq(nvme_queue_tagset(nvmeq), command_id);
 	if (unlikely(!req)) {
-		dev_warn(nvmeq->dev->ctrl.device,
-			"invalid id %d completed on queue %d\n",
-			command_id, le16_to_cpu(cqe->sq_id));
+		dev_warn_ratelimited(nvmeq->dev->ctrl.device,
+				     "invalid id %d completed on queue %d\n",
+				     command_id, le16_to_cpu(cqe->sq_id));
 		return;
 	}
 

From 340894cf9332883e20eed0b1f051e4efb6af1861 Mon Sep 17 00:00:00 2001
From: Matt Turner <mattst88@gmail.com>
Date: Mon, 10 Aug 2026 16:28:34 -0400
Subject: [PATCH 0385/1982] alpha: run the remote RTC access in a worker, not
 an IPI callback

[ Upstream commit 6f45effbd74012f1715584ba51abaa3196a47c08 ]

On Marvel the CMOS clock is only reachable from the boot cpu, so
remote_read_time() and remote_set_time() bounce the access there with
smp_call_function_single(), whose callback runs in hard interrupt
context.

alpha_rtc_read_time() calls mc146818_get_time() with a 10 ms timeout.
That waits out the RTC update cycle in mc146818_avoid_UIP(), which drops
rtc_lock and udelay()s 100 us at a time until the update completes or
the timeout expires:

	for (i = 0; UIP_RECHECK_LOOPS_MS(i) < timeout; i++) {
		spin_lock_irqsave(&rtc_lock, flags);
		...
		if (CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) {
			spin_unlock_irqrestore(&rtc_lock, flags);
			udelay(UIP_RECHECK_DELAY);
			continue;
		}

So a clock read from a non-boot cpu can spin for up to 10 ms in hard
interrupt context on the boot cpu, while the cpu that sent the request
spins in smp_call_function_single() waiting for it to finish.

mc146818_set_time() does not poll, but it takes rtc_lock too, and
rtc_lock is a spinlock_t.  Only raw spinlocks may be taken in hard
interrupt context, so lockdep reports the write path as soon as a
non-boot cpu sets the clock:

  [ BUG: Invalid wait context ]
  -----------------------------
  swapper/0/0 is trying to lock:
  fffffc0003690470 (rtc_lock){....}-{3:3}, at: mc146818_set_time+0x74/0x450
  other info that might help us debug this:
  context-{2:2}
  no locks held by swapper/0/0.
  stack backtrace:
  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc1 #1 NONE
  Trace:
  [<fffffc000102ebb0>] dump_stack+0x28/0x44
  [<fffffc000110efcc>] __lock_acquire+0xb0c/0x1060
  [<fffffc000110f5f0>] lock_acquire.part.0+0xd0/0x300
  [...]
  [<fffffc0001b0d834>] mc146818_set_time+0x74/0x450
  [<fffffc0001f090cc>] _raw_spin_lock_irqsave+0x7c/0xc0
  [<fffffc0001042f90>] do_remote_set+0x90/0xc0
  [<fffffc000119c1a4>] __flush_smp_call_function_queue+0x314/0x5c0
  [<fffffc000119c474>] generic_smp_call_function_single_interrupt+0x24/0x40
  [<fffffc000103d984>] handle_ipi+0xa4/0x230
  [<fffffc0001037044>] do_entInt+0x1a4/0x2e0

The rtc class ops are always called from process context, so there is no
reason to run the access from an interrupt at all.  Use work_on_cpu() to
run it in a worker on the boot cpu.  Alpha does not support cpu hotplug,
so the boot cpu cannot go offline while the work is pending.

Tested on an AlphaServer ES47 (Marvel/EV7): hwclock read and write
pinned to a non-boot cpu, twenty times, with no splat.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260810202835.3592833-1-mattst88@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/rtc.c | 37 ++++++++++++-------------------------
 1 file changed, 12 insertions(+), 25 deletions(-)

diff --git a/arch/alpha/kernel/rtc.c b/arch/alpha/kernel/rtc.c
index cfdf90bc8b3f86..9e7d714ef6f858 100644
--- a/arch/alpha/kernel/rtc.c
+++ b/arch/alpha/kernel/rtc.c
@@ -15,6 +15,7 @@
 #include <linux/bcd.h>
 #include <linux/rtc.h>
 #include <linux/platform_device.h>
+#include <linux/workqueue.h>
 
 #include "proto.h"
 
@@ -142,54 +143,40 @@ static const struct rtc_class_ops alpha_rtc_ops = {
 };
 
 /*
- * Similarly, except do the actual CMOS access on the boot cpu only.
- * This requires marshalling the data across an interprocessor call.
+ * Similarly, except do the actual CMOS access on the boot cpu only.  The
+ * access polls for the RTC update cycle and takes rtc_lock, so run it in a
+ * worker on that cpu rather than from an interprocessor interrupt.
  */
 
 #if defined(CONFIG_SMP) && \
     (defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_MARVEL))
 # define HAVE_REMOTE_RTC 1
 
-union remote_data {
-	struct rtc_time *tm;
-	long retval;
-};
-
-static void
+static long
 do_remote_read(void *data)
 {
-	union remote_data *x = data;
-	x->retval = alpha_rtc_read_time(NULL, x->tm);
+	return alpha_rtc_read_time(NULL, data);
 }
 
 static int
 remote_read_time(struct device *dev, struct rtc_time *tm)
 {
-	union remote_data x;
-	if (smp_processor_id() != boot_cpuid) {
-		x.tm = tm;
-		smp_call_function_single(boot_cpuid, do_remote_read, &x, 1);
-		return x.retval;
-	}
+	if (smp_processor_id() != boot_cpuid)
+		return work_on_cpu(boot_cpuid, do_remote_read, tm);
 	return alpha_rtc_read_time(NULL, tm);
 }
 
-static void
+static long
 do_remote_set(void *data)
 {
-	union remote_data *x = data;
-	x->retval = alpha_rtc_set_time(NULL, x->tm);
+	return alpha_rtc_set_time(NULL, data);
 }
 
 static int
 remote_set_time(struct device *dev, struct rtc_time *tm)
 {
-	union remote_data x;
-	if (smp_processor_id() != boot_cpuid) {
-		x.tm = tm;
-		smp_call_function_single(boot_cpuid, do_remote_set, &x, 1);
-		return x.retval;
-	}
+	if (smp_processor_id() != boot_cpuid)
+		return work_on_cpu(boot_cpuid, do_remote_set, tm);
 	return alpha_rtc_set_time(NULL, tm);
 }
 

From 2ed996cb5d14db93bee46813a682e99bd0e09b9d Mon Sep 17 00:00:00 2001
From: Dmytro Moroziuk <dmorozyk1@gmail.com>
Date: Wed, 12 Aug 2026 15:18:56 +0300
Subject: [PATCH 0386/1982] ALSA: hda/conexant: Add mute LED quirk for HP
 ProBook 440 G5

[ Upstream commit 191fe151eb85ff6cb24189fc88c970745497c057 ]

The HP ProBook 440 G5 requires the CXT_FIXUP_MUTE_LED_GPIO quirk to
properly toggle the physical mute and mic-mute LEDs via the CX8200 codec.
Without this quirk, the LEDs remain permanently dark.

Signed-off-by: Dmytro Moroziuk <dmorozyk1@gmail.com>
Link: https://patch.msgid.link/20260812121856.30353-1-dmorozyk1@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/conexant.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index ef40f1cb1158e3..862fcbe74e4f08 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -1115,6 +1115,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
 	SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x82b4, "HP ProDesk 600 G3", CXT_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+	SND_PCI_QUIRK(0x103c, 0x837b, "HP ProBook 440 G5", CXT_FIXUP_MUTE_LED_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
 	SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),

From fe976b0e3c8a4f4c738dec7e0746f03c60bf0de3 Mon Sep 17 00:00:00 2001
From: Jiaming Zhang <r772577952@gmail.com>
Date: Mon, 10 Aug 2026 17:24:21 +0800
Subject: [PATCH 0387/1982] hfsplus: validate extent record length before
 writing it back

[ Upstream commit 627b7865c062ff642c0000f3a4775f1a44b986a4 ]

__hfsplus_ext_write_extent() writes the cached extent record back into a
B-tree node using fd->entrylength as the length, and fd->entrylength is
derived in __hfs_brec_find() from two on-disk values:

	fd->entrylength = len - keylen;

A crafted image can keep both len and keylen valid but make fd->entrylength
negative (keylen > len). __hfsplus_ext_write_extent() doesn't check
fd->entrylength before consuming it, and hfs_bnode_write() takes the length
as u32, so the negative value turns into a huge one. The copy then reads
data past the end of hip->cached_extents, which is only
sizeof(hfsplus_extent_rec) bytes long, and leaks kernel memory into the
image.

Reject an fd->entrylength that does not match sizeof(hfsplus_extent_rec) in
__hfsplus_ext_write_extent(), mirroring the check already performed in
__hfsplus_ext_read_extent().

Link: https://lore.kernel.org/lkml/cbd7003314c530d4f910eacf019ff80adad6687e.camel@dubeyko.com/
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260810092422.1691377-1-r772577952@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/hfsplus/extents.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index 8e886514d27f1e..11c990d18ac8aa 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -110,6 +110,8 @@ static int __hfsplus_ext_write_extent(struct inode *inode,
 	} else {
 		if (res)
 			return res;
+		if (fd->entrylength != sizeof(hfsplus_extent_rec))
+			return -EIO;
 		hfs_bnode_write(fd->bnode, hip->cached_extents,
 				fd->entryoffset, fd->entrylength);
 		hip->extent_state &= ~HFSPLUS_EXT_DIRTY;

From 14ecf77177cb1d432dd415a9aed2fe88dc1cc02a Mon Sep 17 00:00:00 2001
From: Arash Golgol <arash.golgol@gmail.com>
Date: Wed, 12 Aug 2026 16:20:54 +0330
Subject: [PATCH 0388/1982] regulator: fan53555: Add support for FAN53555BUC23X
 type

[ Upstream commit e739acbe05b06de78ef7089470f122432f651faa ]

FAN53555BUC23X has the ID 0 and REV 0xc, starts at 600mV and
increments in 12.5mV steps.

Per the datasheet, the FAN53555BUC23X (23 option) is grouped with
the 00 and 13 options for soft-start timing (t_SS = 300us typ.),
so the existing enable_time = 400 is reused here as well.

This variant is found on the ASUS Tinker Edge R (RK3399Pro) as the
supply regulator for both vdd_gpu and vdd_cpu_b. Verified across
the full GPU OPP table with the userspace devfreq governor.

Signed-off-by: Arash Golgol <arash.golgol@gmail.com>
Link: https://patch.msgid.link/20260812125054.19111-1-arash.golgol@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/fan53555.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c
index c282236959b180..59155cad99bc6c 100644
--- a/drivers/regulator/fan53555.c
+++ b/drivers/regulator/fan53555.c
@@ -113,6 +113,7 @@ enum {
 enum {
 	FAN53555_CHIP_REV_00 = 0x3,
 	FAN53555_CHIP_REV_13 = 0xf,
+	FAN53555_CHIP_REV_23 = 0xc,
 };
 
 enum {
@@ -305,6 +306,11 @@ static int fan53555_voltages_setup_fairchild(struct fan53555_device_info *di)
 			di->vsel_step = 10000;
 			di->enable_time = 400;
 			break;
+		case FAN53555_CHIP_REV_23:
+			di->vsel_min = 600000;
+			di->vsel_step = 12500;
+			di->enable_time = 400;
+			break;
 		default:
 			dev_err(di->dev,
 				"Chip ID %d with rev %d not supported!\n",

From c2d18aa6481632b69f7af787a35b52a3f78d0913 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Fri, 7 Aug 2026 13:14:25 +0100
Subject: [PATCH 0389/1982] soundwire: dmi-quirks: Disable ghost Realtek on
 Asus ROG Zephyrus Duo

[ Upstream commit 5b08a3afd2995e5312c4c47ffea9d21b651e8e13 ]

The Asus ROG Zephyrus Duo also has a Realtek device in the ACPI that
doesn't exist in the physical hardware. This confuses the machine
driver into attempting to create DAI links for the device. Add a
quirk to remove this device.

Suggested-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260807121425.1952003-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/dmi-quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index f738e547a1f30a..768255dd12db6d 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -193,6 +193,13 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
 		},
 		.driver_data = (void *)ghost_realtek,
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
+			DMI_MATCH(DMI_BOARD_NAME, "GX651AR"),
+		},
+		.driver_data = (void *)ghost_realtek,
+	},
 	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),

From 6def7dd96f0408dd2bb7e6d5a6835b7d56f19583 Mon Sep 17 00:00:00 2001
From: Michail Tatas <michail.tatas@gmail.com>
Date: Fri, 7 Aug 2026 01:30:20 +0300
Subject: [PATCH 0390/1982] ipmi: Fix leak in __ipmi_bmc_register

[ Upstream commit 18e633dd9674c8bf118ea8583bb5a531edc2728a ]

In case that ida_alloc(&ipmi_bmc_ida,...) succeeds and then
platform_device_register() fails, ipmi_bmc_ida is leaked.
Fix by freeing the error path

Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
Message-ID: <anUK_HOy_pCgvsBm@michalis-linux>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/ipmi/ipmi_msghandler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0247079db185ec..dc4704b067b942 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3306,6 +3306,7 @@ static int __ipmi_bmc_register(struct ipmi_smi *intf,
 	list_del(&intf->bmc_link);
 	mutex_unlock(&bmc->dyn_mutex);
 	intf->bmc = &intf->tmp_bmc;
+	ida_free(&ipmi_bmc_ida, bmc->pdev.id);
 	put_device(&bmc->pdev.dev);
 	goto out;
 }

From 9409d38fdde0b598573cb4c7d0fe4608053205af Mon Sep 17 00:00:00 2001
From: Farhan Ali <alifm@linux.ibm.com>
Date: Wed, 5 Aug 2026 09:55:16 -0700
Subject: [PATCH 0391/1982] PCI: Avoid saving config space state if
 inaccessible

[ Upstream commit e18d1abc3bff0a24a5299f3c150ab9546e9439aa ]

The current reset process saves the device's config space state before
reset and restores it afterward. However errors may occur unexpectedly and
it may then be impossible to save config space because the device may be
inaccessible (e.g. DPC). This results in saving invalid values that get
written back to the device during state restoration.

With a reset we want to recover/restore the device into a functional state.
So avoid saving the state of the config space when the device config space
is inaccessible.

Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
[bhelgaas: comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260805165518.794-4-alifm@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 78d4411e3255bb..bab3213bafbda5 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -725,6 +725,28 @@ u16 pci_find_dvsec_capability(struct pci_dev *dev, u16 vendor, u16 dvsec)
 }
 EXPORT_SYMBOL_GPL(pci_find_dvsec_capability);
 
+static bool pci_dev_config_accessible(struct pci_dev *dev, char *msg)
+{
+	u32 val;
+
+	/*
+	 * If a device's config space is inaccessible, reads typically
+	 * return ~0.  Since Device and Vendor ID are always ~0 for VFs,
+	 * check the Command and Status registers instead.
+	 *
+	 * N.B. This is racy because the device may become inaccessible
+	 * before the next access.
+	 */
+	pci_read_config_dword(dev, PCI_COMMAND, &val);
+	if (PCI_POSSIBLE_ERROR(val)) {
+		pci_warn(dev, "Device config space inaccessible; unable to %s\n",
+				msg);
+		return false;
+	}
+
+	return true;
+}
+
 /**
  * pci_find_parent_resource - return resource region of parent bus of given
  *			      region
@@ -5016,6 +5038,9 @@ static void pci_dev_save_and_disable(struct pci_dev *dev)
 	 */
 	pci_set_power_state(dev, PCI_D0);
 
+	if (!pci_dev_config_accessible(dev, "save state"))
+		return;
+
 	pci_save_state(dev);
 	/*
 	 * Disable the device by clearing the Command register, except for

From d80451f7f980fc45eee9fe2b3b3ed9cd6bad1a8f Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 13 Aug 2026 17:03:49 +0200
Subject: [PATCH 0392/1982] ALSA: hda/intel: Add sanity check for BAR0 size

[ Upstream commit 9895573b0185f922be4cf500a0f2e5b9560ab1c3 ]

The recent reports from syzkaller showed that we can bind any wild PCI
device to HD-audio controller, and if PCI BAR of the device is too
small, it may lead to a crash, as the driver believes as if the full
register range were accessible.

For avoiding such a problem, add a safeguard before the actual probe
to check the available BAR0 size.

Note that the threshold (0x200) is chosen to cover all needed
registers at probing.  But this doesn't mean that it would cover fully
for all features including the extended ones.

Reported-by: syzbot+10cd2d1efe8eeb604bee@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=10cd2d1efe8eeb604bee
Reported-by: syzbot+5ebe7cd17e48b4293660@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5ebe7cd17e48b4293660
Link: https://patch.msgid.link/20260813150354.763502-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/controllers/intel.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
index f07fc5dc5cede6..3ed33cba7d83fb 100644
--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -2155,6 +2155,15 @@ static int azx_probe(struct pci_dev *pci,
 		dev_warn(&pci->dev, "dmic_detect option is deprecated, pass snd-intel-dspcfg.dsp_driver=1 option instead\n");
 	}
 
+	/* A sanity check against wild device binding;
+	 * here the range 0x200 is enough for the registers used at probe,
+	 * but it doesn't mean covering all HD-audio registers
+	 */
+	if (pci_resource_len(pci, 0) < 0x200) {
+		dev_err(&pci->dev, "Too small PCI BAR0\n");
+		return -EINVAL;
+	}
+
 	err = snd_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE,
 			   0, &card);
 	if (err < 0) {

From 89e76d0fc8d25a47c391b56d5c34367759612c8e Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 6 Aug 2026 17:20:59 +0300
Subject: [PATCH 0393/1982] xhci: include all root port children in recovery
 prevention on link error

[ Upstream commit e3d757dc9257f2638ca61eda4faef26c2daeea10 ]

Driver already prevents useless transfer retry and endpoint recovery
for devices directly connected to a root port with link errors.

These devices are either disconnecting or will be reset. Link is gone.

Move the flag indicating link error from the xhci device structure to
the root port strucure, allowing all child devices behind hubs to easily
check for root port link errors, avoiding useless transfer retries and
endpoint recovery.

This extends the previous endpoint recovery prevention in
commit b8c3b718087b ("usb: xhci: Don't try to recover an endpoint if port
is in error state.")
Only root port link errors can be detected early by xhci driver,
not link errors between external hubs and their children.

Tested-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260806142113.2436238-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-ring.c | 27 +++++++++++++++------------
 drivers/usb/host/xhci.c      |  4 +---
 drivers/usb/host/xhci.h      |  9 +--------
 3 files changed, 17 insertions(+), 23 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6ce5874fc4b3db..dc18da8385a216 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1008,7 +1008,7 @@ static int xhci_handle_halted_endpoint(struct xhci_hcd *xhci,
 	 * Avoid resetting endpoint if link is inactive. Can cause host hang.
 	 * Device will be reset soon to recover the link so don't do anything
 	 */
-	if (ep->vdev->flags & VDEV_PORT_ERROR)
+	if (ep->vdev->rhub_port->link_inactive)
 		return -ENODEV;
 
 	/* add td to cancelled list and let reset ep handler take care of it */
@@ -2007,13 +2007,15 @@ static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
 static void handle_port_status(struct xhci_hcd *xhci, union xhci_trb *event)
 {
 	struct xhci_virt_device *vdev = NULL;
-	struct usb_hcd *hcd;
-	u32 port_id;
-	u32 portsc, cmd_reg;
-	unsigned int hcd_portnum;
 	struct xhci_bus_state *bus_state;
-	bool bogus_port_status = false;
 	struct xhci_port *port;
+	struct usb_hcd *hcd;
+	bool bogus_port_status = false;
+	unsigned int hcd_portnum;
+	u32 cmd_reg;
+	u32 port_id;
+	u32 portsc;
+	u32 pls;
 
 	/* Port status change events always have a successful completion code */
 	if (GET_COMP_CODE(le32_to_cpu(event->generic.field[2])) != COMP_SUCCESS)
@@ -2050,6 +2052,7 @@ static void handle_port_status(struct xhci_hcd *xhci, union xhci_trb *event)
 	bus_state = &port->rhub->bus_state;
 	hcd_portnum = port->hcd_portnum;
 	portsc = xhci_portsc_readl(port);
+	pls = portsc & PORT_PLS_MASK;
 
 	xhci_dbg(xhci, "Port change event, %d-%d, id %d, portsc: 0x%x\n",
 		 hcd->self.busnum, hcd_portnum + 1, port_id, portsc);
@@ -2061,12 +2064,12 @@ static void handle_port_status(struct xhci_hcd *xhci, union xhci_trb *event)
 		usb_hcd_resume_root_hub(hcd);
 	}
 
-	if (vdev && (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) {
-		if (!(portsc & PORT_RESET))
-			vdev->flags |= VDEV_PORT_ERROR;
-	} else if (vdev && portsc & PORT_RC) {
-		vdev->flags &= ~VDEV_PORT_ERROR;
-	}
+	/*
+	 * Tag broken links to avoid retries while hub driver sorts it out.
+	 * Link status is not relible while port is in reset.
+	 */
+	if (!(portsc & PORT_RESET))
+		port->link_inactive = (pls == XDEV_INACTIVE);
 
 	if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) {
 		xhci_dbg(xhci, "port resume event for port %d\n", port_id);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 14eeb16f668b28..a4fab82da76b68 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1674,7 +1674,7 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 		goto free_priv;
 	}
 
-	if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) {
+	if (xhci->devs[slot_id]->rhub_port->link_inactive) {
 		xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n");
 		ret = -ENODEV;
 		goto free_priv;
@@ -4038,7 +4038,6 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
 				xhci_get_slot_state(xhci, virt_dev->out_ctx));
 		xhci_dbg(xhci, "Not freeing device rings.\n");
 		/* Don't treat this as an error.  May change my mind later. */
-		virt_dev->flags = 0;
 		ret = 0;
 		goto command_cleanup;
 	case COMP_SUCCESS:
@@ -4090,7 +4089,6 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
 	}
 	/* If necessary, update the number of active TTs on this root port */
 	xhci_update_tt_active_eps(xhci, virt_dev, old_active_eps);
-	virt_dev->flags = 0;
 	ret = 0;
 
 command_cleanup:
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index caa3fbee29f2c7..87d43bc95bf331 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -741,14 +741,6 @@ struct xhci_virt_device {
 	struct xhci_port		*rhub_port;
 	struct xhci_interval_bw_table	*bw_table;
 	struct xhci_tt_bw_info		*tt_info;
-	/*
-	 * flags for state tracking based on events and issued commands.
-	 * Software can not rely on states from output contexts because of
-	 * latency between events and xHC updating output context values.
-	 * See xhci 1.1 section 4.8.3 for more details
-	 */
-	unsigned long			flags;
-#define VDEV_PORT_ERROR			BIT(0) /* Port error, link inactive */
 
 	/* The current max exit latency for the enabled USB3 link states. */
 	u16				current_mel;
@@ -1469,6 +1461,7 @@ struct xhci_port {
 	int			hcd_portnum;
 	struct xhci_hub		*rhub;
 	struct xhci_port_cap	*port_cap;
+	unsigned int		link_inactive:1;
 	unsigned int		lpm_incapable:1;
 	unsigned long		resume_timestamp;
 	bool			rexit_active;

From 9f38adcea4f3b01558e97a9aad7c3c2605ffaa64 Mon Sep 17 00:00:00 2001
From: Neil Andrews <neil@androos.io>
Date: Thu, 13 Aug 2026 20:41:24 +0000
Subject: [PATCH 0394/1982] ALSA: usb-audio: Rename the Audient iD14 monitor
 mix volume control

[ Upstream commit 9c0564fcc21aec4f5b7648f61865ce3fc2b84a7f ]

On the Audient iD14 (2708:0008), feature unit 12 is traced through to
the Speaker output terminal and is therefore exported as "Speaker
Playback Volume".  The name fits it badly.  It advertises Volume on
only four of its six logical channels, which the driver records as
cmask=0xf, channels=4 on a 6-channel playback stream, and it sits on
the monitor mixer branch rather than in the direct playback path:

  INPUT_TERMINAL 2 (USB streaming, 6ch) -> EXTENSION_UNIT 51 ->
    FEATURE_UNIT 10 (no controls) -> OUTPUT_TERMINAL 20 (Speaker)

while FU 12 hangs off MIXER_UNIT 60 and feeds back into
EXTENSION_UNIT 51.

Userspace adopts the control as the stream's hardware playback volume,
so any setting below 0 dB attenuates part of the stream and not the
rest.  Measured over the device's own digital loopback, with one
-12 dBFS tone per channel played straight to hw:, PCM channel 0 is
unaffected while channel 1 tracks the control: at 107/127 (-20 dB) the
two read -15.89 and -35.89 dBFS, a 20.00 dB imbalance, and at 127/127
both read -15.89 dBFS.

Give the unit a non-standard name so that it is no longer taken for
the stream's master volume.  Dropping the control instead also fixes
the imbalance, but FU 12 keeps its value across a module reload, so
dropping it strands a device that is already attenuated with nothing
able to reset it.  Renaming leaves the monitor gain reachable and that
recovery path intact.

The mapped name ends in "Playback" because a name from the map
suppresses the automatic " Playback" but still gets " Volume"
appended; the control comes out as "Monitor Mix Playback Volume".

Tested on the ACP path with PipeWire, which is where the problem
reproduces: the control now stays at 127 at every volume setting and
the imbalance is 0.00 dB, and setting it by hand to 107 and back to
127 gives 20.00 dB and 0.00 dB as before.

Link: https://lore.kernel.org/linux-sound/0102019fed22f9d3-fa294ec5-02f1-4fd3-b3fa-76efc14331cc-000000@eu-west-1.amazonses.com/T/#u
Signed-off-by: Neil Andrews <neil@androos.io>
Link: https://patch.msgid.link/0102019ffcdbb1e6-9b59d3cc-ef05-4df1-8f9f-fb2f425bcda2-000000@eu-west-1.amazonses.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer_maps.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index ce27fc871f5139..8046d5987d5b1c 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -505,6 +505,19 @@ static const struct usbmix_connector_map gigabyte_b450_connector_map[] = {
 	{}
 };
 
+/* Audient iD14: FU 12 advertises Volume on only 4 of its 6 logical channels
+ * and sits on the monitor mixer branch, but it is traced through to the
+ * Speaker output terminal and gets named "Speaker Playback Volume".  Userspace
+ * then adopts it as the stream's hardware volume, and any setting below 0 dB
+ * attenuates some channels but not others (20 dB imbalance at 80%).  Give it a
+ * non-standard name so that it is no longer taken for the stream's master
+ * volume, while remaining reachable for anyone who wants the monitor gain.
+ */
+static const struct usbmix_name_map audient_id14_map[] = {
+	{ 12, "Monitor Mix Playback" },	/* FU, partial coverage */
+	{}
+};
+
 /*
  * Control map entries
  */
@@ -588,6 +601,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.id = USB_ID(0x2573, 0x0008),
 		.map = maya44_map,
 	},
+	{
+		/* Audient iD14 */
+		.id = USB_ID(0x2708, 0x0008),
+		.map = audient_id14_map,
+	},
 	{
 		/* KEF X300A */
 		.id = USB_ID(0x27ac, 0x1000),

From 72e4aeb3b6e707db3c9b0a0ece0034cc2777cee1 Mon Sep 17 00:00:00 2001
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Date: Mon, 3 Aug 2026 23:22:27 +0530
Subject: [PATCH 0395/1982] HID: amd_sfh: Serialize access to the shared emp2
 pointer

[ Upstream commit c57016bcf6d0b57cda5579e5d6856bd9bbe52a77 ]

The SFH accessors reach the device through a file-global emp2 pointer
that is published at probe and cleared on remove. amd_get_sfh_info() is
exported and called from other modules on unrelated threads, so a reader
can observe a non-NULL emp2 and then race a concurrent unbind that clears
it and frees the device.

Serialize the emp2 publish/clear and all readers under a mutex, so a
reader either sees a live device for the whole access or sees NULL.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
index 837d59e7a66102..dd2720bae65c30 100644
--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
+++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c
@@ -8,12 +8,14 @@
  * Author: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
  */
 #include <linux/amd-pmf-io.h>
+#include <linux/cleanup.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
 #include <linux/iopoll.h>
 
 #include "amd_sfh_interface.h"
 
 static struct amd_mp2_dev *emp2;
+static DEFINE_MUTEX(emp2_lock);
 
 static int amd_sfh_wait_response(struct amd_mp2_dev *mp2, u8 sid, u32 cmd_id)
 {
@@ -78,12 +80,14 @@ static struct amd_mp2_ops amd_sfh_ops = {
 
 void sfh_deinit_emp2(void)
 {
+	guard(mutex)(&emp2_lock);
 	emp2 = NULL;
 }
 
 void sfh_interface_init(struct amd_mp2_dev *mp2)
 {
 	mp2->mp2_ops = &amd_sfh_ops;
+	guard(mutex)(&emp2_lock);
 	emp2 = mp2;
 }
 
@@ -160,6 +164,8 @@ static int amd_sfh_als_info(u32 *ambient_light)
 
 int amd_get_sfh_info(struct amd_sfh_info *sfh_info, enum sfh_message_type op)
 {
+	guard(mutex)(&emp2_lock);
+
 	if (sfh_info) {
 		switch (op) {
 		case MT_HPD:

From 524a770828a39e6c25debc75d0d21aeb4b44ab32 Mon Sep 17 00:00:00 2001
From: Anuj Bolewar <bolewara@gmail.com>
Date: Sun, 2 Aug 2026 22:05:17 +0530
Subject: [PATCH 0396/1982] drm/virtio: reclaim pending vbufs before tearing
 down vqs

[ Upstream commit 61d85f99b5a55d4f717c4bb2f4c4acabf22ee3fc ]

virtio_gpu_free_vbufs() destroys the vbufs kmem_cache after the virtqueues
have already been released. Commands that were queued but never completed
by the device leave their vbuffers stranded in the virtqueue, so the cache
still holds live objects when virtio_gpu_deinit() tears everything down.
This triggers a WARNING in virtio_gpu_free_vbufs:

    BUG virtio-gpu-vbufs (Not tainted): Objects remaining in cache
    on __kmem_cache_shutdown()

Drain any buffers still sitting in the control and cursor virtqueues in
virtio_gpu_deinit() after the device has been reset and before the
virtqueues are deleted, following the same pattern used by virtio_console's
remove_vqs(). Each reclaimed buffer is released with free_vbuf(), dropping
the reference on any GEM objects it holds. Pending RESOURCE_UNREF
commands are handled as well: their resp_cb_data still references a GEM
object, so it is cleaned up with virtio_gpu_cleanup_object() to avoid
leaking it on teardown.

Reported-by: syzbot+06f9b2a53ba4a5a47644@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=06f9b2a53ba4a5a47644
Signed-off-by: Anuj Bolewar <bolewara@gmail.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260802-virtio-gpu-reclaim-vbufs-v2-1-5767fb860691@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_drv.h |  1 +
 drivers/gpu/drm/virtio/virtgpu_kms.c |  1 +
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 15 +++++++++++++++
 3 files changed, 17 insertions(+)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 51b78f8a8aa2e4..d52f35a09a1b02 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -355,6 +355,7 @@ void virtio_gpu_array_put_free_work(struct work_struct *work);
 /* virtgpu_vq.c */
 int virtio_gpu_alloc_vbufs(struct virtio_gpu_device *vgdev);
 void virtio_gpu_free_vbufs(struct virtio_gpu_device *vgdev);
+void virtio_gpu_reclaim_vbufs(struct virtio_gpu_device *vgdev);
 void virtio_gpu_cmd_create_resource(struct virtio_gpu_device *vgdev,
 				    struct virtio_gpu_object *bo,
 				    struct virtio_gpu_object_params *params,
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 4a25347734fda4..01ea5cd5ea7f13 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -289,6 +289,7 @@ void virtio_gpu_deinit(struct drm_device *dev)
 	flush_work(&vgdev->cursorq.dequeue_work);
 	flush_work(&vgdev->config_changed_work);
 	virtio_reset_device(vgdev->vdev);
+	virtio_gpu_reclaim_vbufs(vgdev);
 	vgdev->vdev->config->del_vqs(vgdev->vdev);
 }
 
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 244a791ab915e1..f7e7d212fc67c2 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -207,6 +207,21 @@ static void free_vbuf(struct virtio_gpu_device *vgdev,
 	kmem_cache_free(vgdev->vbufs, vbuf);
 }
 
+void virtio_gpu_reclaim_vbufs(struct virtio_gpu_device *vgdev)
+{
+	struct virtio_gpu_vbuffer *vbuf;
+
+	while ((vbuf = virtqueue_detach_unused_buf(vgdev->ctrlq.vq))) {
+		if (vbuf->objs)
+			virtio_gpu_array_put_free(vbuf->objs);
+		if (vbuf->resp_cb_data)
+			virtio_gpu_cleanup_object(vbuf->resp_cb_data);
+		free_vbuf(vgdev, vbuf);
+	}
+	while ((vbuf = virtqueue_detach_unused_buf(vgdev->cursorq.vq)))
+		free_vbuf(vgdev, vbuf);
+}
+
 static void reclaim_vbufs(struct virtqueue *vq, struct list_head *reclaim_list)
 {
 	struct virtio_gpu_vbuffer *vbuf;

From edff0fa7834abdb22a82ded0b5d63131174952ac Mon Sep 17 00:00:00 2001
From: Yang Wen <anmuxixixi@gmail.com>
Date: Thu, 13 Aug 2026 22:29:19 +0800
Subject: [PATCH 0397/1982] exfat: keep FITRIM within the requested range

[ Upstream commit 2de727471b3b13409466a4af4f8824a86073bf4b ]

exfat_find_free_bitmap() searches the entire allocation bitmap and may
wrap around to its beginning. exfat_trim_fs() does not verify that the
returned cluster is still within the requested FITRIM range.

As a result, a partial FITRIM operation may discard free clusters outside
the user-specified range and report a trimmed length larger than the
requested length.

Validate each returned cluster against the requested range and stop the
search when it wraps around or passes the range end.

Signed-off-by: Yang Wen <anmuxixixi@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exfat/balloc.c | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c
index 0b6466b3490a06..4013034375dbeb 100644
--- a/fs/exfat/balloc.c
+++ b/fs/exfat/balloc.c
@@ -327,14 +327,27 @@ int exfat_trim_fs(struct inode *inode, struct fstrim_range *range)
 	mutex_lock(&sbi->bitmap_lock);
 
 	trim_begin = trim_end = exfat_find_free_bitmap(sb, clu_start);
-	if (trim_begin == EXFAT_EOF_CLUSTER)
+	/*
+	 * exfat_find_free_bitmap() may wrap around to the beginning of
+	 * the bitmap. Reject a cluster outside the requested range.
+	 */
+	if (trim_begin == EXFAT_EOF_CLUSTER ||
+		trim_begin < clu_start || trim_begin > clu_end)
 		goto unlock;
 
-	next_free_clu = exfat_find_free_bitmap(sb, trim_end + 1);
-	if (next_free_clu == EXFAT_EOF_CLUSTER)
-		goto unlock;
+	for (;;) {
+		if (trim_end >= clu_end)
+			break;
+
+		next_free_clu = exfat_find_free_bitmap(sb, trim_end + 1);
+		/*
+		 * Stop if the search wrapped around or moved beyond the requested
+		 * FITRIM range.
+		 */
+		if (next_free_clu == EXFAT_EOF_CLUSTER ||
+			next_free_clu <= trim_end || next_free_clu > clu_end)
+			break;
 
-	do {
 		if (next_free_clu == trim_end + 1) {
 			/* extend trim range for continuous free cluster */
 			trim_end++;
@@ -355,17 +368,11 @@ int exfat_trim_fs(struct inode *inode, struct fstrim_range *range)
 			trim_begin = trim_end = next_free_clu;
 		}
 
-		if (next_free_clu >= clu_end)
-			break;
-
 		if (fatal_signal_pending(current)) {
 			err = -ERESTARTSYS;
 			goto unlock;
 		}
-
-		next_free_clu = exfat_find_free_bitmap(sb, next_free_clu + 1);
-	} while (next_free_clu != EXFAT_EOF_CLUSTER &&
-			next_free_clu > trim_end);
+	}
 
 	/* try to trim remainder */
 	count = trim_end - trim_begin + 1;

From fa2697301e7ef0eb0809368f09c386e5bb51ebc4 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 12 Aug 2026 14:22:57 +0000
Subject: [PATCH 0398/1982] gre: fix ERSPAN o_flags race/corruption in xmit and
 fill_info

[ Upstream commit 9958e69b98930834a576e156f6458166d1db1c02 ]

For IPv4 ERSPAN:
In erspan_xmit(), the driver clears IP_TUNNEL_SEQ_BIT (for version 0)
and IP_TUNNEL_KEY_BIT directly in the shared tunnel->parms.o_flags
structure. Since transmit paths can run locklessly and concurrently,
this leads to a data race.

Furthermore, modifying tunnel->parms.o_flags permanently alters the
tunnel configuration. To work around this, erspan_fill_info() (which
reports config to userspace) was setting IP_TUNNEL_KEY_BIT back. If
erspan_fill_info (running under RTNL) and erspan_xmit (running locklessly)
race, erspan_xmit might see IP_TUNNEL_KEY_BIT set when it shouldn't,
leading to GRE header corruption (injecting a key field into the ERSPAN
GRE header).

Fix this by:
1) Passing flags as an argument to __gre_xmit().
2) Using local stack flags in ipgre_xmit(), gre_tap_xmit(), and erspan_xmit()
   to prevent TOCTOU data races with concurrent configuration updates,
   and passing them to __gre_xmit().
3) Removing the racy modification of t->parms.o_flags in erspan_fill_info().
4) Forcing IP_TUNNEL_KEY_BIT in the reported flags for ERSPAN locally
   in ipgre_fill_info().

For IPv6 ERSPAN:
ip6erspan_tunnel_xmit() was locklessly clearing IP_TUNNEL_KEY_BIT in
t->parms.o_flags even though it does not use these flags for building
the GRE header (it uses local flags). This permanently corrupts the
configuration and races with ip6gre_fill_info() which reads it.

Remove the redundant and racy modification.
This should remove false sharing in a fast path.

Add const qualifiers in ipgre_fill_info(), erspan_fill_info()
and ip6gre_fill_info() to clarify that these methods are not
supposed to write any live parameters.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260812142257.21283-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_gre.c  | 42 +++++++++++++++++++++++-------------------
 net/ipv6/ip6_gre.c |  5 ++---
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b15cc4ee0d9208..b1ec4f92d34628 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -474,12 +474,9 @@ static int gre_rcv(struct sk_buff *skb)
 
 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
 		       const struct iphdr *tnl_params,
-		       __be16 proto)
+		       __be16 proto, const unsigned long *flags)
 {
 	struct ip_tunnel *tunnel = netdev_priv(dev);
-	IP_TUNNEL_DECLARE_FLAGS(flags);
-
-	ip_tunnel_flags_copy(flags, tunnel->parms.o_flags);
 
 	/* Push GRE header. */
 	gre_build_header(skb, tunnel->tun_hlen,
@@ -652,6 +649,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 			      struct net_device *dev)
 {
 	struct ip_tunnel *tunnel = netdev_priv(dev);
+	IP_TUNNEL_DECLARE_FLAGS(flags);
 	const struct iphdr *tnl_params;
 
 	if (!pskb_inet_may_pull(skb))
@@ -687,11 +685,12 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 		tnl_params = &tunnel->parms.iph;
 	}
 
-	if (gre_handle_offloads(skb, test_bit(IP_TUNNEL_CSUM_BIT,
-					      tunnel->parms.o_flags)))
+	ip_tunnel_flags_copy(flags, tunnel->parms.o_flags);
+
+	if (gre_handle_offloads(skb, test_bit(IP_TUNNEL_CSUM_BIT, flags)))
 		goto free_skb;
 
-	__gre_xmit(skb, dev, tnl_params, skb->protocol);
+	__gre_xmit(skb, dev, tnl_params, skb->protocol, flags);
 	return NETDEV_TX_OK;
 
 free_skb:
@@ -704,6 +703,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 			       struct net_device *dev)
 {
 	struct ip_tunnel *tunnel = netdev_priv(dev);
+	IP_TUNNEL_DECLARE_FLAGS(flags);
 	bool truncate = false;
 	__be16 proto;
 
@@ -727,10 +727,12 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 		truncate = true;
 	}
 
+	ip_tunnel_flags_copy(flags, tunnel->parms.o_flags);
+
 	/* Push ERSPAN header */
 	if (tunnel->erspan_ver == 0) {
 		proto = htons(ETH_P_ERSPAN);
-		__clear_bit(IP_TUNNEL_SEQ_BIT, tunnel->parms.o_flags);
+		__clear_bit(IP_TUNNEL_SEQ_BIT, flags);
 	} else if (tunnel->erspan_ver == 1) {
 		erspan_build_header(skb, ntohl(tunnel->parms.o_key),
 				    tunnel->index,
@@ -745,8 +747,8 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 		goto free_skb;
 	}
 
-	__clear_bit(IP_TUNNEL_KEY_BIT, tunnel->parms.o_flags);
-	__gre_xmit(skb, dev, &tunnel->parms.iph, proto);
+	__clear_bit(IP_TUNNEL_KEY_BIT, flags);
+	__gre_xmit(skb, dev, &tunnel->parms.iph, proto, flags);
 	return NETDEV_TX_OK;
 
 free_skb:
@@ -759,6 +761,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
 				struct net_device *dev)
 {
 	struct ip_tunnel *tunnel = netdev_priv(dev);
+	IP_TUNNEL_DECLARE_FLAGS(flags);
 
 	if (!pskb_inet_may_pull(skb))
 		goto free_skb;
@@ -768,14 +771,15 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
 		return NETDEV_TX_OK;
 	}
 
-	if (gre_handle_offloads(skb, test_bit(IP_TUNNEL_CSUM_BIT,
-					      tunnel->parms.o_flags)))
+	ip_tunnel_flags_copy(flags, tunnel->parms.o_flags);
+
+	if (gre_handle_offloads(skb, test_bit(IP_TUNNEL_CSUM_BIT, flags)))
 		goto free_skb;
 
 	if (skb_cow_head(skb, dev->needed_headroom))
 		goto free_skb;
 
-	__gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB));
+	__gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB), flags);
 	return NETDEV_TX_OK;
 
 free_skb:
@@ -1571,12 +1575,15 @@ static size_t ipgre_get_size(const struct net_device *dev)
 
 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
-	struct ip_tunnel *t = netdev_priv(dev);
-	struct ip_tunnel_parm_kern *p = &t->parms;
+	const struct ip_tunnel *t = netdev_priv(dev);
+	const struct ip_tunnel_parm_kern *p = &t->parms;
 	IP_TUNNEL_DECLARE_FLAGS(o_flags);
 
 	ip_tunnel_flags_copy(o_flags, p->o_flags);
 
+	if (t->erspan_ver != 0 && !t->collect_md)
+		__set_bit(IP_TUNNEL_KEY_BIT, o_flags);
+
 	if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
 	    nla_put_be16(skb, IFLA_GRE_IFLAGS,
 			 gre_tnl_flags_to_gre_flags(p->i_flags)) ||
@@ -1619,12 +1626,9 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 
 static int erspan_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
-	struct ip_tunnel *t = netdev_priv(dev);
+	const struct ip_tunnel *t = netdev_priv(dev);
 
 	if (t->erspan_ver <= 2) {
-		if (t->erspan_ver != 0 && !t->collect_md)
-			__set_bit(IP_TUNNEL_KEY_BIT, t->parms.o_flags);
-
 		if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
 			goto nla_put_failure;
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index e3aedef13ceedf..c14c76b78b9846 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -966,7 +966,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
 	if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen))
 		goto tx_err;
 
-	__clear_bit(IP_TUNNEL_KEY_BIT, t->parms.o_flags);
 	IPCB(skb)->flags = 0;
 
 	/* For collect_md mode, derive fl6 from the tunnel key,
@@ -2109,8 +2108,8 @@ static size_t ip6gre_get_size(const struct net_device *dev)
 
 static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
-	struct ip6_tnl *t = netdev_priv(dev);
-	struct __ip6_tnl_parm *p = &t->parms;
+	const struct ip6_tnl *t = netdev_priv(dev);
+	const struct __ip6_tnl_parm *p = &t->parms;
 	IP_TUNNEL_DECLARE_FLAGS(o_flags);
 
 	ip_tunnel_flags_copy(o_flags, p->o_flags);

From 9bfa6187948e267cbf406256ae944d4195daf99a Mon Sep 17 00:00:00 2001
From: "David C.C.M. Gall" <david.ccm.gall@googlemail.com>
Date: Fri, 7 Aug 2026 18:13:52 +0200
Subject: [PATCH 0399/1982] crypto: keembay - use crypto_memneq() to compare
 GCM AEAD tags

[ Upstream commit 353b3a85136f2a0cf3e872acf8ad6c1dec0b7a8e ]

Use crypto_memneq() for constant-time comparison.

The GCM path in keembay-ocs-aes-core.c verifes the received
authentication tag with memcmp(), which returns early on the first
mismatched byte. This leaks valid-prefix length and allows for valid
tag forgery which violates the INT-CTXT guarantee of AEAD.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
index 419f88af1031b0..c4fd5e1849cdff 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
@@ -11,6 +11,7 @@
 #include <crypto/internal/aead.h>
 #include <crypto/internal/skcipher.h>
 #include <crypto/scatterwalk.h>
+#include <crypto/utils.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
 #include <linux/dma-mapping.h>
@@ -919,7 +920,7 @@ static int kmb_ocs_aead_run(struct aead_request *req)
 
 	/* For GCM decrypt, we have to compare in_tag with out_tag. */
 	if (rctx->instruction == OCS_DECRYPT) {
-		rc = memcmp(rctx->in_tag, rctx->out_tag, tag_size) ?
+		rc = crypto_memneq(rctx->in_tag, rctx->out_tag, tag_size) ?
 		     -EBADMSG : 0;
 		goto exit;
 	}

From 80cb14cc834a2a30cd1a043f737449c410ebcc28 Mon Sep 17 00:00:00 2001
From: "David C.C.M. Gall" <david.ccm.gall@googlemail.com>
Date: Fri, 7 Aug 2026 17:44:16 +0200
Subject: [PATCH 0400/1982] crypto: sa2ul - use crypto_memneq() to compare AEAD
 tag

[ Upstream commit 7064af16d2b418d61571dba9bb0116a547ade124 ]

Use crypto_memneq() for a constant-time comparison.

sa_aead_dma_in_callback() compares the computed authentication tag
against the received tag with memcmp(), which short-circuits on the
first differing byte. An attacker who can submit decrypt requests and
observe completion latency could recover the expected tag byte by byte.

Valid tag forgery for AEAD breaks the INT-CTXT guarantee.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/sa2ul.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index 73034aeb638629..4a766e43519704 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -22,6 +22,7 @@
 
 #include <crypto/aes.h>
 #include <crypto/authenc.h>
+#include <crypto/utils.h>
 #include <crypto/des.h>
 #include <crypto/internal/aead.h>
 #include <crypto/internal/hash.h>
@@ -1688,7 +1689,7 @@ static void sa_aead_dma_in_callback(void *data)
 		scatterwalk_map_and_copy(auth_tag, req->src, start, authsize,
 					 0);
 
-		err = memcmp(&mdptr[4], auth_tag, authsize) ? -EBADMSG : 0;
+		err = crypto_memneq(&mdptr[4], auth_tag, authsize) ? -EBADMSG : 0;
 	}
 
 	sa_free_sa_rx_data(rxd);

From 567499907e178711bff40802f3427917d1d4fa6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Israel=20T=C3=A9llez=20Garc=C3=ADa?= <i.tellez@btesa.com>
Date: Fri, 14 Aug 2026 14:48:43 +0200
Subject: [PATCH 0401/1982] libbpf: Fix ring buffer consumer loop on 32-bit
 position wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fdd4fad0bbbd08501465c5f9b556963093c5d58a ]

ringbuf_process_ring() walks the records between the consumer and the
producer with an ordering comparison:

	while (cons_pos < prod_pos) {

cons_pos and prod_pos mirror the kernel's ring positions and are
unsigned long here too, so on 32-bit they wrap at 2^32 bytes of traffic.
When producer_pos has wrapped and consumer_pos has not, prod_pos is the
smaller of the two, the loop body never runs and no record is consumed.
Since consumer_pos only advances inside that loop, it never wraps either
and the consumer stops delivering samples for good, with no error
returned to the caller: ring_buffer__poll() keeps reporting zero
records while the kernel side fills up and starts dropping.

Compare the distance instead. The consumer never runs ahead of the
producer, so prod_pos - cons_pos is the amount of unconsumed data and
stays correct across the wrap.

64-bit hosts are unaffected in practice: the counters would need 16 EiB
to wrap. This is the userspace counterpart of the kernel-side walk fixed
in "bpf: Fix pending_pos walk on 32-bit ring position wrap"; a 32-bit
consumer hits whichever of the two comes first.

Signed-off-by: Israel Téllez García <i.tellez@btesa.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260814124843.22041-5-i.tellez@btesa.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/ringbuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/ringbuf.c b/tools/lib/bpf/ringbuf.c
index 00ec4837a06de2..c8fe57401a8b55 100644
--- a/tools/lib/bpf/ringbuf.c
+++ b/tools/lib/bpf/ringbuf.c
@@ -244,7 +244,7 @@ static int64_t ringbuf_process_ring(struct ring *r, size_t n)
 	do {
 		got_new_data = false;
 		prod_pos = smp_load_acquire(r->producer_pos);
-		while (cons_pos < prod_pos) {
+		while (prod_pos - cons_pos > 0) {
 			len_ptr = r->data + (cons_pos & r->mask);
 			len = smp_load_acquire(len_ptr);
 

From 220e3f51071bdeef20bb23ec508b0c14a3d1d1a8 Mon Sep 17 00:00:00 2001
From: "David C.C.M. Gall" <david.ccm.gall@googlemail.com>
Date: Fri, 7 Aug 2026 18:22:00 +0200
Subject: [PATCH 0402/1982] crypto: keembay - use crypto_memneq() to compare
 CCM AEAD tags

[ Upstream commit ff2ac77a034e03b64e2ba34f775097427dfa5547 ]

Use crypto_memneq() for constant-time comparison.

The CCM path in ocs-aes.c verifes the received authentication tag with
memcmp(), which returns early on the first mismatched byte. This leaks
valid-prefix length and allows for valid tag forgery which violates the
INT-CTXT guarantee of AEAD.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/keembay/ocs-aes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/keembay/ocs-aes.c b/drivers/crypto/intel/keembay/ocs-aes.c
index bb6f33f6b4d394..13ba7573617fee 100644
--- a/drivers/crypto/intel/keembay/ocs-aes.c
+++ b/drivers/crypto/intel/keembay/ocs-aes.c
@@ -17,6 +17,7 @@
 
 #include <crypto/aes.h>
 #include <crypto/gcm.h>
+#include <crypto/utils.h>
 
 #include "ocs-aes.h"
 
@@ -1283,7 +1284,7 @@ static inline int ccm_compare_tag_to_yr(struct ocs_aes_dev *aes_dev,
 				 (i * sizeof(u32)));
 	}
 
-	return memcmp(tag, yr, tag_size_bytes) ? -EBADMSG : 0;
+	return crypto_memneq(tag, yr, tag_size_bytes) ? -EBADMSG : 0;
 }
 
 /**

From 8db0eab85a89cf8f41e3c81b5aab66e64c790409 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sun, 5 Jul 2026 15:55:14 +0900
Subject: [PATCH 0403/1982] ksmbd: protect private extended attributes

[ Upstream commit 4ea46ea602fc7055eee4b5b0e84f90f22da7f7e7 ]

SMB clients can currently create an EA named NTACL because SMB EAs are
mapped into the user namespace while the ksmbd security descriptor is
stored as security.NTACL. Allowing the reserved logical name makes the
server-private ACL metadata appear writable through the SMB EA API.

Reject NTACL, DOSATTRIB, and DosStream-prefixed EA names without regard
to case. Filter the same private names from EA query results so stale or
externally-created user namespace attributes cannot be exposed.

This fixes smb2.ea.acl_xattr when acl_xattr_name is configured as
NTACL.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index c97f2a128651f5..7909d1ce679373 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2378,6 +2378,22 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work)
 	return err;
 }
 
+static bool smb2_is_private_ea(const char *name, size_t name_len)
+{
+	if (name_len == SD_PREFIX_LEN &&
+	    !strncasecmp(name, SD_PREFIX, SD_PREFIX_LEN))
+		return true;
+	if (name_len == DOS_ATTRIBUTE_PREFIX_LEN &&
+	    !strncasecmp(name, DOS_ATTRIBUTE_PREFIX,
+			   DOS_ATTRIBUTE_PREFIX_LEN))
+		return true;
+	if (name_len >= STREAM_PREFIX_LEN &&
+	    !strncasecmp(name, STREAM_PREFIX, STREAM_PREFIX_LEN))
+		return true;
+
+	return false;
+}
+
 /**
  * smb2_set_ea() - handler for setting extended attributes using set
  *		info command
@@ -2419,6 +2435,10 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len,
 			rc = -EINVAL;
 			break;
 		}
+		if (smb2_is_private_ea(eabuf->name, eabuf->EaNameLength)) {
+			rc = -EACCES;
+			break;
+		}
 
 		memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
 		memcpy(&attr_name[XATTR_USER_PREFIX_LEN], eabuf->name,
@@ -4828,17 +4848,13 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
 		if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
 			continue;
 
-		if (!strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX,
-			     STREAM_PREFIX_LEN))
-			continue;
-
 		if (req->InputBufferLength &&
 		    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
 			    ea_req->EaNameLength))
 			continue;
 
-		if (!strncmp(&name[XATTR_USER_PREFIX_LEN],
-			     DOS_ATTRIBUTE_PREFIX, DOS_ATTRIBUTE_PREFIX_LEN))
+		if (smb2_is_private_ea(&name[XATTR_USER_PREFIX_LEN],
+				       name_len - XATTR_USER_PREFIX_LEN))
 			continue;
 
 		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))

From 8b47ffa0476201566e30287ec540eb031af12c3b Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Tue, 7 Jul 2026 00:49:37 +0900
Subject: [PATCH 0404/1982] ksmbd: preserve access denied status for copychunk

[ Upstream commit f7c0366e0a80bf8cd5eacc5479927abb50958b5e ]

The copychunk error mapping handles -EACCES in an independent if
statement. The following error chain therefore reaches its final else
clause and overwrites STATUS_ACCESS_DENIED with
STATUS_UNEXPECTED_IO_ERROR.

Join the -EACCES check to the remaining error chain so an access failure
is returned as STATUS_ACCESS_DENIED.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 7909d1ce679373..8d078d0abbe142 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8073,7 +8073,7 @@ static int fsctl_copychunk(struct ksmbd_work *work,
 	if (ret < 0) {
 		if (ret == -EACCES)
 			rsp->hdr.Status = STATUS_ACCESS_DENIED;
-		if (ret == -EAGAIN)
+		else if (ret == -EAGAIN)
 			rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
 		else if (ret == -EBADF)
 			rsp->hdr.Status = STATUS_INVALID_HANDLE;

From ea8bcc91689202155f91567b86c302d48703e188 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sun, 5 Jul 2026 16:01:27 +0900
Subject: [PATCH 0405/1982] ksmbd: allow I/O on directory named streams

[ Upstream commit 8184c425a19d44f138d42b44cc363917c08e5f1c ]

Named streams are stored as extended attributes on the base inode. The
VFS read and write helpers reject directory inodes before or together
with checking whether the handle represents a stream.

Permit read and write operations when a directory-backed handle is a
named stream. Continue rejecting direct I/O on ordinary directory
handles.

This fixes creation of the directory stream in smb2.getinfo.complex.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/vfs.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 3ac5f3f48121dd..47c289ad9c3dc9 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -372,7 +372,7 @@ int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count,
 	ssize_t nbytes = 0;
 	struct inode *inode = file_inode(filp);
 
-	if (S_ISDIR(inode->i_mode))
+	if (S_ISDIR(inode->i_mode) && !ksmbd_stream_fd(fp))
 		return -EISDIR;
 
 	if (unlikely(count == 0))
@@ -500,7 +500,8 @@ int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp,
 
 	if (work->conn->connection_type) {
 		if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE)) ||
-		    S_ISDIR(file_inode(fp->filp)->i_mode)) {
+		    (S_ISDIR(file_inode(fp->filp)->i_mode) &&
+		     !ksmbd_stream_fd(fp))) {
 			pr_err("no right to write(%pD)\n", fp->filp);
 			err = -EACCES;
 			goto out;

From a5f2f277999973be810af3e5a2b4e041ea2e8734 Mon Sep 17 00:00:00 2001
From: Gael Blivet <gael.blivet@gmail.com>
Date: Thu, 9 Jul 2026 02:01:06 +0200
Subject: [PATCH 0406/1982] ksmbd: fix durable handle v2 default timeout units
 (60 -> 60000)

[ Upstream commit c1d7bbfc5e081875053723d1a69eb2cf341eaaf1 ]

When a client's Durable Handle Request V2 sets Timeout=0 ("let the
server choose"), fp->durable_timeout was set to 60. Every other use
of this field is in milliseconds: DURABLE_HANDLE_MAX_TIMEOUT (300000)
in smb2pdu.h, the nonzero branch immediately above
(min_t(unsigned int, dh_info.timeout, DURABLE_HANDLE_MAX_TIMEOUT),
where dh_info.timeout is the wire value and already milliseconds per
spec), and the scavenger in vfs_cache.c, which adds it directly to
jiffies_to_msecs(jiffies).

60 is off by 1000x: the handle becomes scavenger-eligible 60
milliseconds after close instead of 60 seconds. A client requesting
Timeout=0 is relying entirely on the server's default to cover the
gap between a dropped connection and its reconnect -- 60ms is not
enough time for even a fast network blip to be detected and
reconnected, so any real disruption loses the race and a subsequent
DH2C reconnect fails with a durable-handle lookup miss instead of
succeeding.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 8d078d0abbe142..a5f9876182313e 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3681,10 +3681,17 @@ int smb2_open(struct ksmbd_work *work)
 					min_t(unsigned int, dh_info.timeout,
 					      DURABLE_HANDLE_MAX_TIMEOUT);
 			else
-				fp->durable_timeout = 60;
+				fp->durable_timeout = 60000;
 		}
 	}
 
+	/*
+	 * conn->is_aapl detection above (this function's create-context
+	 * parsing) is skipped on the reconnect path below, since a
+	 * reconnect always arrives on a fresh connection -- if the client
+	 * cares, it sends its own AAPL context on this same CREATE, which
+	 * this function's normal (non-reconnect) parsing already handles.
+	 */
 reconnected_fp:
 	rsp->StructureSize = cpu_to_le16(89);
 	opinfo = opinfo_get(fp);

From b0b3a3f35df6c5792b181dd0b3154df177641e12 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sat, 4 Jul 2026 18:21:33 +0900
Subject: [PATCH 0407/1982] ksmbd: reject SMB3.1.1 binding with mismatched
 cipher

[ Upstream commit 7019a11f79dc408f2b47b1027240e7f198784c9a ]

SMB3.1.1 multichannel connections belonging to the same session must use
the same negotiated encryption cipher.

ksmbd validates the dialect and client GUID during session binding, but
does not compare the cipher negotiated by the new connection with the
cipher used by the existing session channels. This allows a channel
negotiated with AES-128-CCM to bind to a session using AES-128-GCM.

Compare the new connection's cipher with an existing session channel and
return STATUS_INVALID_PARAMETER when they differ.

This fixes smb2.session.bind_negative_smb3encGtoCs.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a5f9876182313e..eec5cb16bfe53a 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1747,6 +1747,21 @@ int smb2_sess_setup(struct ksmbd_work *work)
 			goto out_err;
 		}
 
+		if (conn->dialect == SMB311_PROT_ID) {
+			struct channel *chann;
+			unsigned long index;
+
+			down_read(&sess->chann_lock);
+			xa_for_each(&sess->ksmbd_chann_list, index, chann) {
+				if (conn->cipher_type != chann->conn->cipher_type)
+					rc = -EINVAL;
+				break;
+			}
+			up_read(&sess->chann_lock);
+			if (rc)
+				goto out_err;
+		}
+
 		if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) {
 			rc = -EINVAL;
 			goto out_err;

From 0adca6c5265c68122d208a11fcc82265ba5ccdd6 Mon Sep 17 00:00:00 2001
From: Gael Blivet <gael.blivet@gmail.com>
Date: Tue, 7 Jul 2026 11:55:01 +0200
Subject: [PATCH 0408/1982] ksmbd: fix off-by-one rejecting minimal COPYCHUNK
 query-limits request

[ Upstream commit d68d4b3293034f549d55f407a23b4c0a6c90e50a ]

The FSCTL_COPYCHUNK/FSCTL_COPYCHUNK_WRITE input length check uses
in_buf_len <= sizeof(struct copychunk_ioctl_req), which rejects a
buffer that is exactly sizeof(struct copychunk_ioctl_req) bytes -- the
minimal, valid request containing only the fixed header with
ChunkCount=0 and no chunk entries, used by clients to query the
server's copy limits before issuing a real copychunk.

Since copychunk_ioctl_req ends in a flexible array member, the correct
minimum is that the buffer covers the fixed header, so use
offsetof(..., Chunks) with '<' instead of '<=' against sizeof(): same
value, but the boundary case is now correctly accepted.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index eec5cb16bfe53a..b17296c7b64ee5 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8581,7 +8581,7 @@ int smb2_ioctl(struct ksmbd_work *work)
 			goto out;
 		}
 
-		if (in_buf_len <= sizeof(struct copychunk_ioctl_req)) {
+		if (in_buf_len < offsetof(struct copychunk_ioctl_req, Chunks)) {
 			ret = -EINVAL;
 			goto out;
 		}

From ca4bc2ab7e747e5f27b4daa375fcf35429232f13 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Tue, 7 Jul 2026 00:19:39 +0900
Subject: [PATCH 0409/1982] ksmbd: return buffer too small for short security
 queries

[ Upstream commit 2103add92a02505bdd536ba6fce7f64a427222a2 ]

SMB2 QUERY_INFO security requests with an output buffer too small for
the self-relative security descriptor header can fall through descriptor
construction and be reported as STATUS_INVALID_INFO_CLASS.

After validating the file handle, reject buffers shorter than struct
smb_ntsd with STATUS_BUFFER_TOO_SMALL before building the descriptor.

This fixes smb2.getinfo.qsec_buffercheck.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b17296c7b64ee5..0de707a77faa05 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5907,6 +5907,12 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
 	if (!fp)
 		return -ENOENT;
 
+	if (le32_to_cpu(req->OutputBufferLength) < sizeof(struct smb_ntsd)) {
+		rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL;
+		ksmbd_fd_put(work, fp);
+		return -ENOSPC;
+	}
+
 	idmap = file_mnt_idmap(fp->filp);
 	inode = file_inode(fp->filp);
 	ksmbd_acls_fattr(&fattr, idmap, inode);

From d4b647621230fc847b3ce9cbd636302f52c6a53f Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Thu, 9 Jul 2026 20:08:10 +0900
Subject: [PATCH 0410/1982] ksmbd: handle empty QUERY_ALLOCATED_RANGES output

[ Upstream commit 7f07791522a251e2be087d11ae9cd51eb3408f1d ]

FSCTL_QUERY_ALLOCATED_RANGES can be issued with a valid input buffer but
without room for an output range.  Do not reject the request before
looking at the file layout.  If the query would produce a range, return
STATUS_BUFFER_TOO_SMALL.  If it produces no ranges, return success with an
empty output.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 0de707a77faa05..84fcd84d6a6667 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8307,8 +8307,6 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id,
 	int ret = 0;
 
 	*out_count = 0;
-	if (in_count == 0)
-		return -EINVAL;
 
 	start = le64_to_cpu(qar_req->file_offset);
 	length = le64_to_cpu(qar_req->length);
@@ -8320,8 +8318,18 @@ static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id,
 	if (!fp)
 		return -ENOENT;
 
-	ret = ksmbd_vfs_fqar_lseek(fp, start, length,
-				   qar_rsp, in_count, out_count);
+	if (!in_count) {
+		struct file_allocated_range_buffer range;
+
+		ret = ksmbd_vfs_fqar_lseek(fp, start, length, &range, 1,
+					   out_count);
+		if (!ret && *out_count)
+			ret = -ENOSPC;
+		*out_count = 0;
+	} else {
+		ret = ksmbd_vfs_fqar_lseek(fp, start, length,
+					   qar_rsp, in_count, out_count);
+	}
 	if (ret && ret != -E2BIG)
 		*out_count = 0;
 

From 752103a26dc1360f15c403f1f5cb668f8f2d92ff Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sun, 12 Jul 2026 00:03:34 +0900
Subject: [PATCH 0411/1982] ksmbd: honor byte-range locks for zero data

[ Upstream commit 8b57448a147d2378088e63cd473e7f2a967d6802 ]

FSCTL_SET_ZERO_DATA changes file allocation state and must respect
byte-range locks over the affected part of the file. Check the requested
range, clipped to EOF, before issuing the fallocate operation.

Return STATUS_FILE_LOCK_CONFLICT when the range conflicts with an
existing lock. Ranges starting past EOF are left untouched by the lock
check so they continue to succeed.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c |  7 ++++++-
 fs/smb/server/vfs.c     | 12 ++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 84fcd84d6a6667..86535283b49a67 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8670,8 +8670,13 @@ int smb2_ioctl(struct ksmbd_work *work)
 
 			ret = ksmbd_vfs_zero_data(work, fp, off, len);
 			ksmbd_fd_put(work, fp);
-			if (ret < 0)
+			if (ret == -EAGAIN) {
+				rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
+				ret = 0;
 				goto out;
+			} else if (ret < 0) {
+				goto out;
+			}
 		}
 		break;
 	}
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 47c289ad9c3dc9..f894092901bc55 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1003,6 +1003,18 @@ int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
 	int err;
 
 	smb_break_all_levII_oplock(work, fp, 1);
+	if (!work->tcon->posix_extensions) {
+		loff_t size = i_size_read(file_inode(fp->filp));
+
+		if (off < size) {
+			err = check_lock_range(fp->filp, off,
+					       min(off + len, size) - 1,
+					       WRITE);
+			if (err)
+				return -EAGAIN;
+		}
+	}
+
 	saved_cred = override_creds(fp->filp->f_cred);
 	if (fp->f_ci->m_fattr & FILE_ATTRIBUTE_SPARSE_FILE_LE)
 		err = vfs_fallocate(fp->filp,

From 1373a9aba9ee59b1c344175847e8f3cc5ef5ee66 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 8 Jul 2026 22:21:25 +0900
Subject: [PATCH 0412/1982] ksmbd: allow FSCTL_SET_SPARSE without input buffer

[ Upstream commit 86c84cc760080929b7be44bceebe5854957b99da ]

FSCTL_SET_SPARSE without an input buffer sets a file sparse.  Treat a
zero-length input buffer as SetSparse=true and keep rejecting truncated
non-empty buffers.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 86535283b49a67..bfc60fc9fb275e 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8617,15 +8617,21 @@ int smb2_ioctl(struct ksmbd_work *work)
 				rsp);
 		break;
 	case FSCTL_SET_SPARSE:
-		if (in_buf_len < sizeof(struct file_sparse)) {
+	{
+		struct file_sparse sparse = {0};
+
+		if (in_buf_len && in_buf_len < sizeof(struct file_sparse)) {
 			ret = -EINVAL;
 			goto out;
 		}
 
-		ret = fsctl_set_sparse(work, id, (struct file_sparse *)buffer);
+		*(u8 *)&sparse = 1;
+		ret = fsctl_set_sparse(work, id, in_buf_len ?
+				       (struct file_sparse *)buffer : &sparse);
 		if (ret < 0)
 			goto out;
 		break;
+	}
 	case FSCTL_SET_ZERO_DATA:
 	{
 		struct file_zero_data_information *zero_data;

From 1ffa534cbaa0c178b47f5c978f8e6eccf8371968 Mon Sep 17 00:00:00 2001
From: Gael Blivet <gael.blivet@gmail.com>
Date: Thu, 9 Jul 2026 02:01:11 +0200
Subject: [PATCH 0413/1982] ksmbd: skip fallocate for
 SMB2_CREATE_ALLOCATION_SIZE on a stream handle

[ Upstream commit bfdf81c62f4f52a3626ea62db0744def6778e83f ]

smb2_open() calls vfs_fallocate(fp->filp, ...) unconditionally when a
client's CREATE request includes an AllocationSize create context.
For a stream handle, fp->filp refers to the base file's data fork
(streams are xattr-backed on the same underlying file, not separate
files), so this pre-allocates storage on the base file's actual data
instead of doing anything meaningful for the stream -- fallocate has
no applicability to an xattr-backed stream at all.

Skip the fallocate call for stream handles.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index bfc60fc9fb275e..e473cd3bbee362 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3633,13 +3633,22 @@ int smb2_open(struct ksmbd_work *work)
 			ksmbd_debug(SMB,
 				    "request smb2 create allocate size : %llu\n",
 				    alloc_size);
-			smb_break_all_levII_oplock(work, fp, 1);
-			err = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0,
-					    alloc_size);
-			if (err < 0)
-				ksmbd_debug(SMB,
-					    "vfs_fallocate is failed : %d\n",
-					    err);
+			/*
+			 * fp->filp is the base file's data fork for a stream
+			 * handle (streams are xattr-backed on the same
+			 * underlying file) -- fallocate has no meaning for a
+			 * stream and would otherwise pre-allocate storage on
+			 * the base file's data instead.
+			 */
+			if (!ksmbd_stream_fd(fp)) {
+				smb_break_all_levII_oplock(work, fp, 1);
+				err = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0,
+						    alloc_size);
+				if (err < 0)
+					ksmbd_debug(SMB,
+						    "vfs_fallocate is failed : %d\n",
+						    err);
+			}
 		}
 
 		context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4);

From d5eaa5dc2d91ee9f0862a1ba5d91319aea3aba12 Mon Sep 17 00:00:00 2001
From: Gael Blivet <gael.blivet@gmail.com>
Date: Thu, 9 Jul 2026 18:50:46 +0200
Subject: [PATCH 0414/1982] ksmbd: report actual xattr value length in stream
 enumeration

[ Upstream commit 689f1eb3719d61700b58f984ac8602837f004f8c ]

get_file_stream_info() (FileStreamInformation QUERY_INFO) reported
each enumerated stream's StreamSize/StreamAllocationSize as
stream_name_len -- the byte length of the stream's *name*, not its
data. This is the same bug class already fixed for EndOfFile/
AllocationSize on an open stream handle (ksmbd_stream_eof()), just
missed at this second site: a client enumerating streams sees a size
derived from the name string length instead of the stream's actual
content length, inconsistent with what querying the same stream by
handle reports.

Compute the real value length the same way ksmbd_stream_eof() does,
via ksmbd_vfs_casexattr_len() on the already-known xattr key.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index e473cd3bbee362..16dea2c8b9267b 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5166,6 +5166,8 @@ static int get_file_stream_info(struct ksmbd_work *work,
 	struct kstat stat;
 	const struct path *path = &fp->filp->f_path;
 	ssize_t xattr_list_len;
+	ssize_t slen;
+	loff_t ssize;
 	int nbytes = 0, streamlen, stream_name_len, next, idx = 0;
 	int buf_free_len;
 	int ret;
@@ -5227,8 +5229,20 @@ static int get_file_stream_info(struct ksmbd_work *work,
 		streamlen *= 2;
 		kfree(stream_buf);
 		file_info->StreamNameLength = cpu_to_le32(streamlen);
-		file_info->StreamSize = cpu_to_le64(stream_name_len);
-		file_info->StreamAllocationSize = cpu_to_le64(stream_name_len);
+		/*
+		 * stream_name_len is the byte length of the xattr's *name*,
+		 * not its value -- same class of bug ksmbd_stream_eof()
+		 * (smb2pdu.c) already fixes for EndOfFile/AllocationSize on
+		 * a stream handle; this enumeration path needs the same
+		 * real xattr value length, not the name length reused as a
+		 * size.
+		 */
+		slen = ksmbd_vfs_casexattr_len(file_mnt_idmap(fp->filp),
+						path->dentry, stream_name,
+						strlen(stream_name) + 1);
+		ssize = slen < 0 ? 0 : (loff_t)slen;
+		file_info->StreamSize = cpu_to_le64(ssize);
+		file_info->StreamAllocationSize = cpu_to_le64(ssize);
 
 		nbytes += next;
 		buf_free_len -= next;

From bbcfc51648fbf32f8c899163b0851fa812628080 Mon Sep 17 00:00:00 2001
From: ChenXiaoSong <chenxiaosong@kylinos.cn>
Date: Thu, 23 Jul 2026 04:11:30 +0000
Subject: [PATCH 0415/1982] smb/server: cancel async requests when closing
 connection

[ Upstream commit 4fd5bad647bfa45eb86bfd2f03ba1bef3fcd5851 ]

An async request may still be waiting when a connection is closed.
This can stop the connection from closing.

Cancel active async requests before waiting for them to finish.

Suggested-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/connection.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 16fcedf45739f3..8f1b70e39362e7 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -232,6 +232,26 @@ void ksmbd_conn_try_dequeue_request(struct ksmbd_work *work)
 	wake_up_all(&conn->req_running_q);
 }
 
+static void ksmbd_conn_cancel_async_requests(struct ksmbd_conn *conn)
+{
+	struct ksmbd_work *work, *tmp;
+
+	ksmbd_debug(CONN, "Cancel pending async requests on releasing connection\n");
+	spin_lock(&conn->request_lock);
+	list_for_each_entry_safe(work, tmp, &conn->async_requests,
+				 async_request_entry) {
+		if (work->state != KSMBD_WORK_ACTIVE)
+			continue;
+
+		ksmbd_debug(CONN, "Cancel async request id %d\n",
+			    work->async_id);
+		work->state = KSMBD_WORK_CANCELLED;
+		if (work->cancel_fn)
+			work->cancel_fn(work->cancel_argv);
+	}
+	spin_unlock(&conn->request_lock);
+}
+
 void ksmbd_conn_lock(struct ksmbd_conn *conn)
 {
 	mutex_lock(&conn->srv_mutex);
@@ -543,6 +563,7 @@ int ksmbd_conn_handler_loop(void *p)
 
 out:
 	ksmbd_conn_set_releasing(conn);
+	ksmbd_conn_cancel_async_requests(conn);
 	/* Wait till all reference dropped to the Server object*/
 	ksmbd_debug(CONN, "Wait for all pending requests(%d)\n", atomic_read(&conn->r_count));
 	wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);

From 6cdc0ac0c455bacda275e1ba6ff6362285c7c689 Mon Sep 17 00:00:00 2001
From: Yashraj Ghule <yashrajghule.221@gmail.com>
Date: Sun, 16 Aug 2026 16:36:55 +0530
Subject: [PATCH 0416/1982] ALSA: hda/realtek: Fix mute LED for HP Victus
 15-fa1xxx (MB 8C3F)

[ Upstream commit 19b02fecd8f857909af779afe3816e487ac10cd0 ]

The HP Victus 15-fa1xxx with motherboard 8C3F is missing the
existing mute LED quirk for ALC245 codecs.

Add the 103c:8c3f subsystem ID to the existing
ALC245_FIXUP_HP_MUTE_LED_COEFBIT quirk.

Tested on HP Victus 15-fa1xxx (MB 8C3F). The mute LED works
as intended.

Signed-off-by: Yashraj Ghule <yashrajghule.221@gmail.com>
Link: https://patch.msgid.link/20260816110655.11592-1-yashrajghule.221@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 9ec18f779a700c..bc33930e83b9fb 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6974,6 +6974,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8c21, "HP Pavilion Plus Laptop 14-ey0XXX", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x8c2d, "HP Victus 15-fa1xxx (MB 8C2D)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c30, "HP Victus 15-fb1xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
+	SND_PCI_QUIRK(0x103c, 0x8c3f, "HP Victus 15-fa1xxx (MB 8C3F)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c46, "HP EliteBook 830 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c47, "HP EliteBook 840 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c48, "HP EliteBook 860 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),

From 394898ff40cd1e6d03191142fed6d9747981638a Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 29 Jul 2026 21:24:11 +0900
Subject: [PATCH 0417/1982] ksmbd: fix SMB2 byte-range lock end offset

[ Upstream commit 54d90311f9b4eb23f3b0b62650b0cfddb11a12ef ]

SMB2 describes a byte-range lock using an offset and a length, while
Linux file_lock uses an inclusive end offset. smb2_lock() currently sets
fl_end to start + length and consequently locks one extra byte for every
nonzero-length request.

Translate nonzero lengths to start + length - 1 and reject ranges that
cannot be represented by loff_t instead of silently truncating them at
OFFSET_MAX. Track zero-length locks from the request length so one-byte
ranges are not mistaken for zero-length locks after endpoint conversion.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 44 +++++++++++++----------------------------
 1 file changed, 14 insertions(+), 30 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 16dea2c8b9267b..fba9c75b9f8785 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7609,7 +7609,7 @@ static int smb2_set_flock_flags(struct file_lock *flock, int flags)
 }
 
 static struct ksmbd_lock *smb2_lock_init(struct file_lock *flock,
-					 unsigned int cmd, int flags,
+					 unsigned int cmd, int flags, bool zero_len,
 					 struct list_head *lock_list)
 {
 	struct ksmbd_lock *lock;
@@ -7623,8 +7623,7 @@ static struct ksmbd_lock *smb2_lock_init(struct file_lock *flock,
 	lock->start = flock->fl_start;
 	lock->end = flock->fl_end;
 	lock->flags = flags;
-	if (lock->start == lock->end)
-		lock->zero_len = 1;
+	lock->zero_len = zero_len;
 	INIT_LIST_HEAD(&lock->clist);
 	INIT_LIST_HEAD(&lock->flist);
 	INIT_LIST_HEAD(&lock->llist);
@@ -7717,32 +7716,18 @@ int smb2_lock(struct ksmbd_work *work)
 
 		lock_start = le64_to_cpu(lock_ele[i].Offset);
 		lock_length = le64_to_cpu(lock_ele[i].Length);
-		if (lock_start > U64_MAX - lock_length) {
+		if (lock_start > OFFSET_MAX ||
+		    (lock_length &&
+		     lock_length - 1 > OFFSET_MAX - lock_start)) {
 			pr_err("Invalid lock range requested\n");
 			rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
 			locks_free_lock(flock);
 			goto out;
 		}
 
-		if (lock_start > OFFSET_MAX)
-			flock->fl_start = OFFSET_MAX;
-		else
-			flock->fl_start = lock_start;
-
-		lock_length = le64_to_cpu(lock_ele[i].Length);
-		if (lock_length > OFFSET_MAX - flock->fl_start)
-			lock_length = OFFSET_MAX - flock->fl_start;
-
-		flock->fl_end = flock->fl_start + lock_length;
-
-		if (flock->fl_end < flock->fl_start) {
-			ksmbd_debug(SMB,
-				    "the end offset(%llx) is smaller than the start offset(%llx)\n",
-				    flock->fl_end, flock->fl_start);
-			rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
-			locks_free_lock(flock);
-			goto out;
-		}
+		flock->fl_start = lock_start;
+		flock->fl_end = lock_length ?
+			flock->fl_start + lock_length - 1 : flock->fl_start;
 
 		/* Check conflict locks in one request */
 		list_for_each_entry(cmp_lock, &lock_list, llist) {
@@ -7758,7 +7743,8 @@ int smb2_lock(struct ksmbd_work *work)
 			}
 		}
 
-		smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list);
+		smb_lock = smb2_lock_init(flock, cmd, flags, !lock_length,
+					   &lock_list);
 		if (!smb_lock) {
 			err = -EINVAL;
 			locks_free_lock(flock);
@@ -7832,7 +7818,7 @@ int smb2_lock(struct ksmbd_work *work)
 				/* check zero byte lock range */
 				if (cmp_lock->zero_len && !smb_lock->zero_len &&
 				    cmp_lock->start > smb_lock->start &&
-				    cmp_lock->start < smb_lock->end) {
+				    cmp_lock->start <= smb_lock->end) {
 					spin_unlock(&conn->llist_lock);
 					up_read(&conn_list_lock);
 					pr_err("previous lock conflict with zero byte lock range\n");
@@ -7841,17 +7827,15 @@ int smb2_lock(struct ksmbd_work *work)
 
 				if (smb_lock->zero_len && !cmp_lock->zero_len &&
 				    smb_lock->start > cmp_lock->start &&
-				    smb_lock->start < cmp_lock->end) {
+				    smb_lock->start <= cmp_lock->end) {
 					spin_unlock(&conn->llist_lock);
 					up_read(&conn_list_lock);
 					pr_err("current lock conflict with zero byte lock range\n");
 					goto out;
 				}
 
-				if (((cmp_lock->start <= smb_lock->start &&
-				      cmp_lock->end > smb_lock->start) ||
-				     (cmp_lock->start < smb_lock->end &&
-				      cmp_lock->end >= smb_lock->end)) &&
+				if (cmp_lock->start <= smb_lock->end &&
+				    smb_lock->start <= cmp_lock->end &&
 				    !cmp_lock->zero_len && !smb_lock->zero_len) {
 					spin_unlock(&conn->llist_lock);
 					up_read(&conn_list_lock);

From 010ebd24940f104152f8f98f5daf8a3a30e47ac6 Mon Sep 17 00:00:00 2001
From: Gael Blivet <gael.blivet@gmail.com>
Date: Fri, 17 Jul 2026 09:37:20 +0200
Subject: [PATCH 0418/1982] ksmbd: fix AsyncId zeroed before use in smb2_lock()
 cancel response

[ Upstream commit 7b461610882c8baa64d56dade57cdbfb686739fa ]

release_async_work() zeroes work->async_id before the CANCELLED path
calls smb2_send_interim_resp(work, STATUS_CANCELLED), which reads
work->async_id to build the response's AsyncId field. The cancellation
response for a cancelled blocked-lock request is sent with AsyncId=0
instead of the id the client received in the original STATUS_PENDING
response for this request.

Checked against every other release_async_work() call site in this
file: smb2_read()/smb2_write() don't send a further async response
afterward (their status goes out on the synchronous path instead), and
smb2_notify()'s two async paths already transfer the id to a separate
struct before releasing, so this reordering is scoped to smb2_lock()
only.

Send the STATUS_CANCELLED response while work->async_id is still valid,
then release the async work afterward.

Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index fba9c75b9f8785..edbac6c9b577c0 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7914,22 +7914,25 @@ int smb2_lock(struct ksmbd_work *work)
 				spin_unlock(&fp->f_lock);
 
 				list_del(&smb_lock->llist);
-				release_async_work(work);
-
-				if (work->state == KSMBD_WORK_ACTIVE)
-					goto retry;
-
-				locks_free_lock(flock);
 
 				if (work->state == KSMBD_WORK_CANCELLED) {
 					rsp->hdr.Status = STATUS_CANCELLED;
 					kfree(smb_lock);
 					smb2_send_interim_resp(work,
 							STATUS_CANCELLED);
+					release_async_work(work);
+					locks_free_lock(flock);
 					work->send_no_response = 1;
 					goto out;
 				}
 
+				release_async_work(work);
+
+				if (work->state == KSMBD_WORK_ACTIVE)
+					goto retry;
+
+				locks_free_lock(flock);
+
 				rsp->hdr.Status =
 					STATUS_RANGE_NOT_LOCKED;
 				kfree(smb_lock);

From 3a728c25f7142f09606c129ea91866faeb3112f4 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 29 Jul 2026 21:26:26 +0900
Subject: [PATCH 0419/1982] ksmbd: reject blocking compound lock requests

[ Upstream commit 16a7f7c2ecf3c893b65f0fb78fa7a7171ae0ba9e ]

Clients set SMB2_LOCKFLAG_FAIL_IMMEDIATELY when a LOCK request contains
multiple lock elements, and servers reject requests that omit it.
Accepting such a request can leave earlier elements locked while a later
element waits asynchronously, enabling prolonged partial lock ownership
and avoidable deadlocks.

Return STATUS_INVALID_PARAMETER before processing any element when a
multi-element lock request contains a blocking lock. Unlock arrays remain
unaffected.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index edbac6c9b577c0..40d7e3b6ed7e15 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7753,6 +7753,13 @@ int smb2_lock(struct ksmbd_work *work)
 	}
 
 	list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) {
+		if (lock_count > 1 &&
+		    !(le32_to_cpu(lock_ele[0].Flags) & SMB2_LOCKFLAG_UNLOCK) &&
+		    !(smb_lock->flags & SMB2_LOCKFLAG_FAIL_IMMEDIATELY)) {
+			err = -EINVAL;
+			goto out;
+		}
+
 		if (smb_lock->cmd < 0) {
 			err = -EINVAL;
 			goto out;

From 2b24e1a49f9797f2b89cbd0274527d832fb1b461 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Fri, 17 Jul 2026 12:05:00 +0900
Subject: [PATCH 0420/1982] ksmbd: honor client signing-required in all modes

[ Upstream commit bc2f3f3dd69424f76e2ed3dc53d29bfd6c9966d4 ]

The SMB2 NEGOTIATE request's SMB2_NEGOTIATE_SIGNING_REQUIRED bit requires
the server to set Connection.ShouldSign. KSMBD represents that state with
conn->sign, but previously set it only when its signing configuration was
auto or disabled.

Set conn->sign whenever the client requires signing, independently of the
server's signing mode. Keep the mandatory server-mode handling unchanged.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 40d7e3b6ed7e15..61f16f54a810b8 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1253,11 +1253,9 @@ int smb2_handle_negotiate(struct ksmbd_work *work)
 	rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE;
 	conn->use_spnego = true;
 
-	if ((server_conf.signing == KSMBD_CONFIG_OPT_AUTO ||
-	     server_conf.signing == KSMBD_CONFIG_OPT_DISABLED) &&
-	    req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED_LE)
+	if (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED_LE)
 		conn->sign = true;
-	else if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) {
+	if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) {
 		server_conf.enforced_signing = true;
 		rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE;
 		conn->sign = true;

From b6534d1bd7dea87dafc8aa034d8c5d18c71de152 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 12 Aug 2026 21:36:32 +0900
Subject: [PATCH 0421/1982] smb: server: Make sure that passkey is not leaked
 on the heap in user_config.c

[ Upstream commit 2c5a176882695f73b52482df03b0017b006ef2d1 ]

Use kfree_sensitive() to free the user->passkey (and the struct
ksmbd_login_response in ksmbd_login_user() that contains the same
information) to avoid that this information could leak somewhere
else via the heap.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/mgmt/user_config.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/mgmt/user_config.c b/fs/smb/server/mgmt/user_config.c
index 0e5fcd6f95c15d..909f219c79faae 100644
--- a/fs/smb/server/mgmt/user_config.c
+++ b/fs/smb/server/mgmt/user_config.c
@@ -28,7 +28,7 @@ struct ksmbd_user *ksmbd_login_user(const char *account)
 	user = ksmbd_alloc_user(resp, resp_ext);
 	kvfree(resp_ext);
 out:
-	kvfree(resp);
+	kvfree_sensitive(resp, sizeof(*resp));
 	return user;
 }
 
@@ -82,7 +82,7 @@ struct ksmbd_user *ksmbd_alloc_user(struct ksmbd_login_response *resp,
 
 err_free:
 	kfree(user->name);
-	kfree(user->passkey);
+	kfree_sensitive(user->passkey);
 	kfree(user);
 	return NULL;
 }
@@ -92,7 +92,7 @@ void ksmbd_free_user(struct ksmbd_user *user)
 	ksmbd_ipc_logout_request(user->name, user->flags);
 	kfree(user->sgid);
 	kfree(user->name);
-	kfree(user->passkey);
+	kfree_sensitive(user->passkey);
 	kfree(user);
 }
 

From 290e5d72744c8b0df25d7cdf293f1f9932c2a341 Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Thu, 25 Jun 2026 08:05:49 -0400
Subject: [PATCH 0422/1982] pNFS: honor clora_changed when recalling a layout

[ Upstream commit aceaa5991bdf744e9c3fa1e5ad73405b1801eaab ]

When the metadata server recalls a layout with clora_changed FALSE, the
layout is not changing and the client may complete its modified writes to
the storage devices before returning the layout (RFC 8881, Section
20.3.3).  Only when clora_changed is TRUE -- the server is restriping, or
a storage device has failed -- should the client stop writing to the
storage devices and redirect through the metadata server.

Since commit b739a5bd9d9f ("NFSv4/flexfiles: Cancel I/O if the layout is
recalled or revoked") the client cancels in-flight I/O on every recall,
regardless of clora_changed.  For an unchanged recall this abandons
writes whose data may already have reached the storage device; such a
write can then land after the LAYOUTRETURN, which the server sees as a
write without a layout.

Pass the recall's clora_changed value through
pnfs_mark_matching_lsegs_return() and only cancel in-flight I/O when the
layout is actually changing.  When it is not, the existing deferred
return path waits for the in-flight writes to drain before sending the
LAYOUTRETURN.  Other callers, which are tearing down or returning the
layout for their own reasons, continue to cancel as before.

Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/callback_proc.c |  3 ++-
 fs/nfs/pnfs.c          | 22 +++++++++++++---------
 fs/nfs/pnfs.h          |  2 +-
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 4f41986b875e86..72c25b8864fe54 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -288,7 +288,8 @@ static u32 initiate_file_draining(struct nfs_client *clp,
 	pnfs_set_layout_stateid(lo, &args->cbl_stateid, NULL, true);
 	switch (pnfs_mark_matching_lsegs_return(lo, &free_me_list,
 				&args->cbl_range,
-				be32_to_cpu(args->cbl_stateid.seqid))) {
+				be32_to_cpu(args->cbl_stateid.seqid),
+				args->cbl_layoutchanged)) {
 	case 0:
 	case -EBUSY:
 		/* There are layout segments that need to be returned */
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index cf0dcf9e35d75b..e2c723e21cb725 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -432,7 +432,8 @@ bool nfs4_layout_refresh_old_stateid(nfs4_stateid *dst,
 			goto out;
 		}
 		/* Try to update the seqid to the most recent */
-		err = pnfs_mark_matching_lsegs_return(lo, &head, &range, 0);
+		err = pnfs_mark_matching_lsegs_return(lo, &head, &range, 0,
+						      true);
 		if (err != -EBUSY) {
 			dst->seqid = lo->plh_stateid.seqid;
 			*dst_range = range;
@@ -486,7 +487,7 @@ static int pnfs_mark_layout_stateid_return(struct pnfs_layout_hdr *lo,
 		.length = NFS4_MAX_UINT64,
 	};
 
-	return pnfs_mark_matching_lsegs_return(lo, lseg_list, &range, seq);
+	return pnfs_mark_matching_lsegs_return(lo, lseg_list, &range, seq, true);
 }
 
 static int
@@ -524,7 +525,7 @@ pnfs_layout_io_set_failed(struct pnfs_layout_hdr *lo, u32 iomode)
 
 	spin_lock(&inode->i_lock);
 	pnfs_layout_set_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
-	pnfs_mark_matching_lsegs_return(lo, &head, &range, 0);
+	pnfs_mark_matching_lsegs_return(lo, &head, &range, 0, true);
 	spin_unlock(&inode->i_lock);
 	pnfs_free_lseg_list(&head);
 	dprintk("%s Setting layout IOMODE_%s fail bit\n", __func__,
@@ -1461,7 +1462,7 @@ _pnfs_return_layout(struct inode *ino)
 	}
 	valid_layout = pnfs_layout_is_valid(lo);
 	pnfs_clear_layoutcommit(ino, &tmp_list);
-	pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
+	pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0, true);
 
 
 	/* Don't send a LAYOUTRETURN if list was initially empty */
@@ -2603,7 +2604,7 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
 			.iomode = IOMODE_ANY,
 			.length = NFS4_MAX_UINT64,
 		};
-		pnfs_mark_matching_lsegs_return(lo, &free_me, &range, 0);
+		pnfs_mark_matching_lsegs_return(lo, &free_me, &range, 0, true);
 		goto out_forget;
 	} else {
 		/* We have a completely new layout */
@@ -2635,6 +2636,7 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
  * @tmp_list: list header to be used with pnfs_free_lseg_list()
  * @return_range: describe layout segment ranges to be returned
  * @seq: stateid seqid to match
+ * @cancel_io: signal io be cancelled
  *
  * This function is mainly intended for use by layoutrecall. It attempts
  * to free the layout segment immediately, or else to mark it for return
@@ -2649,7 +2651,7 @@ int
 pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
 				struct list_head *tmp_list,
 				const struct pnfs_layout_range *return_range,
-				u32 seq)
+				u32 seq, bool cancel_io)
 {
 	struct pnfs_layout_segment *lseg, *next;
 	struct nfs_server *server = NFS_SERVER(lo->plh_inode);
@@ -2675,7 +2677,8 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
 				continue;
 			remaining++;
 			set_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags);
-			pnfs_lseg_cancel_io(server, lseg);
+			if (cancel_io)
+				pnfs_lseg_cancel_io(server, lseg);
 		}
 
 	if (remaining) {
@@ -2710,7 +2713,8 @@ pnfs_mark_layout_for_return(struct inode *inode,
 	 * segments at hand when sending layoutreturn. See pnfs_put_lseg()
 	 * for how it works.
 	 */
-	if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, range, 0) != -EBUSY) {
+	if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, range, 0,
+					    true) != -EBUSY) {
 		const struct cred *cred;
 		nfs4_stateid stateid;
 		enum pnfs_iomode iomode;
@@ -2825,7 +2829,7 @@ static int pnfs_layout_return_unused_byserver(struct nfs_server *server,
 		pnfs_get_layout_hdr(lo);
 		pnfs_set_plh_return_info(lo, range->iomode, 0);
 		if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
-						    range, 0) != 0 ||
+						    range, 0, true) != 0 ||
 		    !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) {
 			spin_unlock(&inode->i_lock);
 			rcu_read_unlock();
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 7b3ba2e64e6f35..14d2a91250f24b 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -301,7 +301,7 @@ int pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo,
 int pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
 				struct list_head *tmp_list,
 				const struct pnfs_layout_range *recall_range,
-				u32 seq);
+				u32 seq, bool cancel_io);
 int pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo,
 		struct list_head *lseg_list);
 bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args,

From 7b3f00649f044f1788a2bc257fc5fa9100c93783 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sat, 15 Aug 2026 22:19:38 +0900
Subject: [PATCH 0423/1982] ksmbd: notify parent directory leases on child
 create

[ Upstream commit abe5acb34282206c2a6303d0e09b3165b1addf0e ]

BVT_DirectoryLeasing_ReadWriteHandleCaching requires a parent directory
lease break notification when another client creates a child in the
leased directory. A child CREATE without a lease context did not notify
the parent lease holders because the notification path expected a
non-NULL lease context.

Allow the parent lease notification helper to handle a NULL child lease
context and notify matching parent leases. Invoke it after a child is
created without a lease context while preserving the existing lease-key
filtering for requests that provide one.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/oplock.c  | 9 +++++----
 fs/smb/server/smb2pdu.c | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 08e3e4504b03fe..7d78d4ae43acb0 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1271,7 +1271,7 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 	struct ksmbd_inode *p_ci = NULL;
 	LIST_HEAD(brk_list);
 
-	if (lctx->version != 2)
+	if (lctx && lctx->version != 2)
 		return;
 
 	p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent);
@@ -1284,9 +1284,10 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 			continue;
 
 		if (opinfo->o_lease->state != SMB2_OPLOCK_LEVEL_NONE &&
-		    (!(lctx->flags & SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE) ||
-		     !compare_guid_key(opinfo, fp->conn->ClientGUID,
-				      lctx->parent_lease_key))) {
+		    (!lctx ||
+		     (!(lctx->flags & SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET_LE) ||
+		      !compare_guid_key(opinfo, fp->conn->ClientGUID,
+			       lctx->parent_lease_key)))) {
 			if (!atomic_inc_not_zero(&opinfo->refcount))
 				continue;
 
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 61f16f54a810b8..7a9eac676cbb90 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3565,6 +3565,9 @@ int smb2_open(struct ksmbd_work *work)
 			goto err_out1;
 		}
 	} else {
+		if (created && !lc)
+			smb_send_parent_lease_break_noti(fp, NULL);
+
 		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) {
 			if (S_ISDIR(file_inode(filp)->i_mode)) {
 				lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE;

From 085a1eb885f171debf15c3c92dd21acbe0bc548e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 11 Aug 2026 17:46:18 +0200
Subject: [PATCH 0424/1982] smb: server: Free session data in user_session.c
 with kfree_sensitive()

[ Upstream commit 9a4bd6507c21f66e84dc021705a4b9d84773111e ]

struct ksmbd_session contains some arrays with sensitive information, like
sess_key, smb3encryptionkey, smb3decryptionkey and smb3signingkey. Thus
let's make sure that this information cannot leak via the heap and use
kfree_sensitive() to free it.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/mgmt/user_session.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index 3a2591434b5f87..973db0466575ee 100644
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -168,10 +168,10 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)
 	ksmbd_launch_ksmbd_durable_scavenger();
 	ksmbd_session_rpc_clear_list(sess);
 	free_channel_list(sess);
-	kfree(sess->Preauth_HashValue);
+	kfree_sensitive(sess->Preauth_HashValue);
 	ksmbd_release_id(&session_ida, sess->id);
 	ida_destroy(&sess->tree_conn_ida);
-	kfree(sess);
+	kfree_sensitive(sess);
 }
 
 struct ksmbd_session *__session_lookup(unsigned long long id)

From d44771126e5498f0b150e16dad094abd2a461b52 Mon Sep 17 00:00:00 2001
From: ZhangGuoDong <zhangguodong@kylinos.cn>
Date: Fri, 3 Jul 2026 14:54:48 +0800
Subject: [PATCH 0425/1982] NFS: Verify symlink inode before caching target

[ Upstream commit 3265f1998ae9a9282a8a6ca95467d9572d6ebb82 ]

nfs_symlink() copies the symlink target into a folio before issuing the
SYMLINK RPC.  After a successful reply, it caches that folio in the
instantiated inode mapping and assumes that the dentry now names a
symlink.

If the dentry is instantiated with a non-symlink inode, the raw symlink
target folio can be inserted into the wrong mapping.  When that inode is
a directory, reclaim or unmount later calls nfs_readdir_clear_array()
through nfs_dir_aops and interprets the symlink target as a readdir
cache array, which can lead to invalid kfree() calls.

A vmcore from a 4.19-based kernel showed the crash when reclaiming a
directory mapping on unmount:

  Stack trace:
   nfs_readdir_clear_array+0x4d/0x70 [nfs]
   page_cache_free_page.isra.35+0x1a/0x90
   delete_from_page_cache_batch+0x1cf/0x2c0
   truncate_inode_pages_range+0x24d/0x910
   [...]
   nfs_evict_inode+0x15/0x30 [nfs]
   evict+0x115/0x2b0
   dispose_list+0x48/0x60
   evict_inodes+0x16c/0x1b0
   generic_shutdown_super+0x3f/0x120
   nfs_kill_super+0x1b/0x40 [nfs]
   deactivate_locked_super+0x3f/0x70
   cleanup_mnt+0x3b/0x80

The current code still has the same unchecked cache insertion pattern,
so it may be susceptible to the same failure mode.

Verify that the instantiated inode is a symlink before caching the
target folio.  If the type is wrong, drop the suspect dentry and skip
the cache insertion while preserving the successful SYMLINK result.

Co-developed-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/dir.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 38b0834e3ebf16..0d8ac9a7448aff 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2632,6 +2632,12 @@ int nfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 		return error;
 	}
 
+	if (unlikely(!d_is_symlink(dentry))) {
+		d_drop(dentry);
+		folio_put(folio);
+		return 0;
+	}
+
 	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
 
 	/*

From eb8a4524d32e1c53e654c1cb91d84c4358026850 Mon Sep 17 00:00:00 2001
From: Xu Rao <raoxu@uniontech.com>
Date: Mon, 17 Aug 2026 16:55:31 +0800
Subject: [PATCH 0426/1982] ALSA: hda: Add Lisuan HDMI controller and codec
 support

[ Upstream commit ceaebef91d1aff671a512d5f003766ea41152d94 ]

Lisuan GPUs expose an HD-audio controller at PCI ID 4c54:5010 and an
HDMI/DP codec with codec ID 0x4c545020.  Neither ID is currently matched
by the HDA stack, leaving HDMI/DP audio unavailable on these devices.

The existing downstream support uses the generic HDMI codec path and
attaches no Lisuan-specific capability flags to the controller.  Its
dedicated AZX driver type only changes the short driver name.

Use the corresponding generic upstream paths instead: bind 4c54:5010 to
AZX_DRIVER_GENERIC, register 0x4c545020 as MODEL_GENERIC, and add the
Lisuan codec vendor name.  This keeps the enablement minimal and avoids
a vendor-only AZX driver type with no vendor-specific behavior.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/DE1B62191D573D37+20260817085531.992573-1-raoxu@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/hdmi/hdmi.c  | 1 +
 sound/hda/controllers/intel.c | 2 ++
 sound/hda/core/device.c       | 1 +
 3 files changed, 4 insertions(+)

diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index 42e4dc0949ec9d..480d1c5f129fd3 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -2348,6 +2348,7 @@ static const struct hda_device_id snd_hda_id_generichdmi[] = {
 	HDA_CODEC_ID_MODEL(0x1d179f8e, "KX-7000 HDMI/DP",	MODEL_GF),
 	HDA_CODEC_ID_MODEL(0x1d179f8f, "KX-7000 HDMI/DP",	MODEL_GF),
 	HDA_CODEC_ID_MODEL(0x1d179f90, "KX-7000 HDMI/DP",	MODEL_GF),
+	HDA_CODEC_ID_MODEL(0x4c545020, "Lisuan HDMI/DP",	MODEL_GENERIC),
 	HDA_CODEC_ID_MODEL(0x67663d82, "Arise 82 HDMI/DP",	MODEL_GF),
 	HDA_CODEC_ID_MODEL(0x67663d83, "Arise 83 HDMI/DP",	MODEL_GF),
 	HDA_CODEC_ID_MODEL(0x67663d84, "Arise 84 HDMI/DP",	MODEL_GF),
diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
index 3ed33cba7d83fb..fd61dc8e21a531 100644
--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -2830,6 +2830,8 @@ static const struct pci_device_id azx_ids[] = {
 	/* Hygon HDAudio */
 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_HYGON_18H_M05H_HDA),
 	  .driver_data = AZX_DRIVER_HYGON | AZX_DCAPS_POSFIX_LPIB | AZX_DCAPS_NO_MSI },
+	/* Lisuan HD-audio */
+	{ PCI_DEVICE(0x4c54, 0x5010), .driver_data = AZX_DRIVER_GENERIC },
 	{ 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
diff --git a/sound/hda/core/device.c b/sound/hda/core/device.c
index ebaa106d0f0185..010dd38007a99d 100644
--- a/sound/hda/core/device.c
+++ b/sound/hda/core/device.c
@@ -664,6 +664,7 @@ static const struct hda_vendor_id hda_vendor_ids[] = {
 	{ 0x1af4, "QEMU" },
 	{ 0x1fa8, "Senarytech" },
 	{ 0x434d, "C-Media" },
+	{ 0x4c54, "Lisuan" },
 	{ 0x8086, "Intel" },
 	{ 0x8384, "SigmaTel" },
 	{} /* terminator */

From 628874afc85eb52d9d972e992e794a8b3dada4fb Mon Sep 17 00:00:00 2001
From: Jia Zhu <zhujia.zj@bytedance.com>
Date: Tue, 7 Jul 2026 21:36:23 +0800
Subject: [PATCH 0427/1982] NFSv4: pin the superblock for active state owners

[ Upstream commit 8cb1ce7aa0e8ac30e55f5bccfb80125f2e43e84a ]

NFSv4 open state can outlive the file and dentry that created it. This
was observed in production when NFSv4 state recovery, such as after a
server reboot or lease expiration, raced with unmount.

The race requires recovery to hold an open state reference while the last
open file is closed and the filesystem is unmounted, allowing the
superblock's active reference to drop to zero between
refcount_inc(&state->count) and nfs4_put_open_state():

    state manager                    umount

    nfs4_run_state_manager()
      nfs4_do_reclaim()
        nfs4_reclaim_open_state()
          refcount_inc(&state->count)
          ...
                                      close last file
                                      generic_shutdown_super()
                                        "Busy inodes after unmount"
                                      nfs_free_server()
          nfs4_put_open_state()
            iput(inode)
              evict()
                nfs_clear_inode()
                  nfs_zap_acl_cache()

The "VFS: Busy inodes after unmount" warning is the visible symptom of
that lifetime mismatch: superblock teardown proceeds even though the NFS
open state still pins an inode. After umount has freed the server, the
state manager can then run nfs4_put_open_state() for the last open-state
reference. The resulting iput(inode) can evict an NFS inode with freed
server data, causing crashes at nfs_zap_acl_cache(). This can be
reproduced by delaying the reclaim path before nfs4_put_open_state(),
then closing the last file and unmounting the NFS mount.

Pin the superblock while a state owner is active, and drop the pin when
the owner becomes idle again, so the NFS server stays alive until all
open state associated with the owner has been released.

Assisted-by: Codex:GPT-5
Signed-off-by: Jia Zhu <zhujia.zj@bytedance.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4state.c | 40 +++++++++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 01179f7de32256..6147d8c0ee111b 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -403,6 +403,26 @@ const struct cred *nfs4_get_clid_cred(struct nfs_client *clp)
 	return cred;
 }
 
+static bool
+nfs4_get_state_owner_active_locked(struct nfs4_state_owner *sp)
+{
+	struct nfs_server *server = sp->so_server;
+
+	/*
+	 * A counted state owner may dereference so_server until the final
+	 * nfs4_put_state_owner().  Pin the superblock when reviving an idle
+	 * owner so umount cannot free the server underneath it.
+	 */
+	if (atomic_read(&sp->so_count) == 0) {
+		if (!nfs_sb_active(server->super))
+			return false;
+		if (!list_empty(&sp->so_lru))
+			list_del_init(&sp->so_lru);
+	}
+	atomic_inc(&sp->so_count);
+	return true;
+}
+
 static struct nfs4_state_owner *
 nfs4_find_state_owner_locked(struct nfs_server *server, const struct cred *cred)
 {
@@ -421,9 +441,8 @@ nfs4_find_state_owner_locked(struct nfs_server *server, const struct cred *cred)
 		else if (cmp > 0)
 			p = &parent->rb_right;
 		else {
-			if (!list_empty(&sp->so_lru))
-				list_del_init(&sp->so_lru);
-			atomic_inc(&sp->so_count);
+			if (!nfs4_get_state_owner_active_locked(sp))
+				return NULL;
 			return sp;
 		}
 	}
@@ -449,9 +468,8 @@ nfs4_insert_state_owner_locked(struct nfs4_state_owner *new)
 		else if (cmp > 0)
 			p = &parent->rb_right;
 		else {
-			if (!list_empty(&sp->so_lru))
-				list_del_init(&sp->so_lru);
-			atomic_inc(&sp->so_count);
+			if (!nfs4_get_state_owner_active_locked(sp))
+				return NULL;
 			return sp;
 		}
 	}
@@ -501,6 +519,10 @@ nfs4_alloc_state_owner(struct nfs_server *server,
 	sp = kzalloc(sizeof(*sp), gfp_flags);
 	if (!sp)
 		return NULL;
+	if (!nfs_sb_active(server->super)) {
+		kfree(sp);
+		return NULL;
+	}
 	sp->so_seqid.owner_id = atomic64_inc_return(&server->owner_ctr);
 	sp->so_server = server;
 	sp->so_cred = get_cred(cred);
@@ -586,8 +608,10 @@ struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *server,
 	spin_lock(&clp->cl_lock);
 	sp = nfs4_insert_state_owner_locked(new);
 	spin_unlock(&clp->cl_lock);
-	if (sp != new)
+	if (sp != new) {
 		nfs4_free_state_owner(new);
+		nfs_sb_deactive(server->super);
+	}
 out:
 	nfs4_gc_state_owners(server);
 	return sp;
@@ -609,6 +633,7 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
 {
 	struct nfs_server *server = sp->so_server;
 	struct nfs_client *clp = server->nfs_client;
+	struct super_block *sb = server->super;
 
 	if (!atomic_dec_and_lock(&sp->so_count, &clp->cl_lock))
 		return;
@@ -616,6 +641,7 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
 	sp->so_expires = jiffies;
 	list_add_tail(&sp->so_lru, &server->state_owners_lru);
 	spin_unlock(&clp->cl_lock);
+	nfs_sb_deactive(sb);
 }
 
 /**

From b486934bcabda26cf28d97e7d878bf0f72211d9a Mon Sep 17 00:00:00 2001
From: Alex Elder <elder@riscstar.com>
Date: Wed, 12 Aug 2026 11:38:30 -0500
Subject: [PATCH 0428/1982] net: stmmac: use dma_addr_t for DMA addresses

[ Upstream commit 0c1f9020d2ada55aed8a2e055903ad9cd5d49dab ]

In jumbo_frm() (implemented in both "chain_mode.c" and "ring_mode.c"),
an unsigned integer local variable is used to hold the value returned
by dma_map_single().  On systems where a dma_addr_t is 64 bits, the
subsequent dma_mapping_error() check of the returned value operates
only on the low 32 bits (whose high bit won't be sign-extended).  In
this case, dma_mapping_error() would return 0 (no error) even if there
were one.

Fix this in both spots by using a dma_addr_t for the local variable.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-devicetree/20260606010122.21A211F00899@smtp.kernel.org/
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
Link: https://patch.msgid.link/20260812163832.271742-2-elder@riscstar.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 3 ++-
 drivers/net/ethernet/stmicro/stmmac/ring_mode.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index 25156088782356..5b0bab33ce4b68 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -20,9 +20,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
 	unsigned int nopaged_len = skb_headlen(skb);
 	struct stmmac_priv *priv = tx_q->priv_data;
 	unsigned int entry = tx_q->cur_tx;
-	unsigned int bmax, buf_len, des2;
+	unsigned int bmax, buf_len;
 	unsigned int i = 1, len;
 	struct dma_desc *desc;
+	dma_addr_t des2;
 
 	desc = tx_q->dma_tx + entry;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index 88a8d22812f5d6..1e6541937cb27a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -20,8 +20,9 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
 	unsigned int nopaged_len = skb_headlen(skb);
 	struct stmmac_priv *priv = tx_q->priv_data;
 	unsigned int entry = tx_q->cur_tx;
-	unsigned int bmax, len, des2;
+	unsigned int bmax, len;
 	struct dma_desc *desc;
+	dma_addr_t des2;
 
 	if (priv->extend_desc)
 		desc = (struct dma_desc *)(tx_q->dma_etx + entry);

From 6a5808b62103572e8611333f96ffed81b30928ff Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Thu, 25 Jun 2026 08:05:50 -0400
Subject: [PATCH 0429/1982] NFSv4/flexfiles: report cancelled I/O as a layout
 error

[ Upstream commit 4a013b0e881e0466cc2c6a5518d2f6cda3a4f19f ]

When a layout is recalled or revoked the client cancels its in-flight I/O
so the layout can be returned.  The metadata server needs to learn that
this I/O to the storage device did not complete, so that it can reconcile
the affected mirror instance (or, if none remains, take other action).

The cancellation completed with -EAGAIN, which ff_layout_io_track_ds_error()
does not recognise: it fell through the switch and recorded nothing, so no
error was reported to the server.

-EAGAIN is overloaded in the RPC layer, so rather than key the reporting on
it, cancel the I/O with -ECANCELED and map that to NFS4ERR_NXIO in
ff_layout_io_track_ds_error() -- the status the client already reports for
the transport errors that leave an in-flight write incomplete.  The
cancelled I/O is then reported to the server via LAYOUTERROR / LAYOUTRETURN.

Unlike a genuine transport error, though, we aborted the I/O ourselves and
have no evidence the device is at fault, so once the error is recorded we
skip marking the device unreachable and forcing a further layout return.

The retry disposition is unchanged from the original -EAGAIN cancellation:
both NFS4ERR_NXIO and -ECANCELED are no-ops in ff_layout_async_handle_error(),
which still resets the I/O to pNFS (or the MDS), so it is re-driven as before.

Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 8099bfc4fe2f83..c708724bb53f28 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1546,6 +1546,17 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 		case -EACCES:
 			*op_status = status = NFS4ERR_ACCESS;
 			break;
+		case -ECANCELED:
+			/*
+			 * In-flight I/O we cancelled to return a recalled or
+			 * revoked layout.  Report it as a failure to reach the
+			 * device (NFS4ERR_NXIO), like the transport errors
+			 * above, so the server can reconcile the affected mirror
+			 * instance.  We aborted the I/O ourselves rather than
+			 * observe the device fail, so don't condemn it below.
+			 */
+			*op_status = status = NFS4ERR_NXIO;
+			break;
 		default:
 			return;
 		}
@@ -1556,6 +1567,15 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 				       mirror, dss_id, offset, length, status, opnum,
 				       nfs_io_gfp_mask());
 
+	/*
+	 * I/O we cancelled ourselves to return a recalled or revoked layout
+	 * is reported above so the server can reconcile the mirror, but we
+	 * have no evidence the device is at fault: don't mark it unreachable
+	 * or force a return.
+	 */
+	if (error == -ECANCELED)
+		goto out;
+
 	switch (status) {
 	case NFS4ERR_DELAY:
 	case NFS4ERR_GRACE:
@@ -1575,6 +1595,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 						  lseg);
 	}
 
+out:
 	dprintk("%s: err %d op %d status %u\n", __func__, err, opnum, status);
 }
 
@@ -2465,7 +2486,7 @@ static void ff_layout_cancel_io(struct pnfs_layout_segment *lseg)
 			clnt = ds_clp->cl_rpcclient;
 			if (!clnt)
 				continue;
-			if (!rpc_cancel_tasks(clnt, -EAGAIN,
+			if (!rpc_cancel_tasks(clnt, -ECANCELED,
 					      ff_layout_match_io, lseg))
 				continue;
 			rpc_clnt_disconnect(clnt);

From 504309a6d93410c7a85b9b70ba824042a9dd3ad0 Mon Sep 17 00:00:00 2001
From: Yaroslav Dudkov <aroslavdudkov622@gmail.com>
Date: Fri, 7 Aug 2026 18:05:53 +0000
Subject: [PATCH 0430/1982] platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC
 firmware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0b30e6e583b2988864ffa7aeb2905bc2d0c7d575 ]

Add the firmware string '17L1EMS1.107' to the ALLOWED_FW_13 array.
This enables Embedded Controller support, including battery charge
thresholds, for the MSI Katana GF76 11UEK (MS-17L1) laptop.

Tested on MSI Katana GF76 11UEK with EC firmware 17L1EMS1.107 and
BIOS E17L1IMS.312.

Signed-off-by: Yaroslav Dudkov <aroslavdudkov622@gmail.com>
Link: https://patch.msgid.link/20260807180553.869371-1-aroslavdudkov622@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/msi-ec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/msi-ec.c b/drivers/platform/x86/msi-ec.c
index 0157e233e43009..0cec54d497d1e9 100644
--- a/drivers/platform/x86/msi-ec.c
+++ b/drivers/platform/x86/msi-ec.c
@@ -1054,6 +1054,7 @@ static struct msi_ec_conf CONF12 __initdata = {
 
 static const char * const ALLOWED_FW_13[] __initconst = {
 	"1594EMS1.109", // MSI Prestige 16 Studio A13VE
+	"17L1EMS1.107", // MSI Katana GF76 11UEK
 	NULL
 };
 

From 2c6395235c3cd3d46a2448e360f97358cedffc36 Mon Sep 17 00:00:00 2001
From: Andrew Onyshchuk <andryk.rv@gmail.com>
Date: Thu, 6 Aug 2026 08:44:17 -0700
Subject: [PATCH 0431/1982] platform/x86: thinkpad_acpi: Fix fan speed
 reporting on Edge E330
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8d840dad456f88374d8a3b03851452a280d6ee50 ]

The ThinkPad Edge E330 with H3 firmware uses the non-standard EC fan
register block. Without a matching quirk, thinkpad_acpi reads the legacy
tachometer registers and reports 0 RPM.

Add the H3 BIOS family to TPACPI_FAN_NS so the driver reads the fan
period from EC register 0x95 using the existing non-standard reporting
path.

Tested on a ThinkPad Edge E330 with BIOS H3ET77WW and EC H3EC35WW.

Signed-off-by: Andrew Onyshchuk <andryk.rv@gmail.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://patch.msgid.link/20260806154417.618575-1-andryk.rv@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/lenovo/thinkpad_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/lenovo/thinkpad_acpi.c b/drivers/platform/x86/lenovo/thinkpad_acpi.c
index 075543cd0e77e0..f3b2e3c7945719 100644
--- a/drivers/platform/x86/lenovo/thinkpad_acpi.c
+++ b/drivers/platform/x86/lenovo/thinkpad_acpi.c
@@ -8854,6 +8854,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
 	TPACPI_Q_LNV3('R', '0', 'T', TPACPI_FAN_NS),	/* 11e Gen5 GL */
 	TPACPI_Q_LNV3('R', '1', 'D', TPACPI_FAN_NS),	/* 11e Gen5 GL-R */
 	TPACPI_Q_LNV3('R', '0', 'V', TPACPI_FAN_NS),	/* 11e Gen5 KL-Y */
+	TPACPI_Q_LNV('H', '3', TPACPI_FAN_NS),		/* Edge E330 */
 	TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN),	/* X1 Tablet (2nd gen) */
 	TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */
 	TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR),		/* ThinkPad x120e */

From f65a37638f236abc7f6c7f2c70d1e2871961788d Mon Sep 17 00:00:00 2001
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date: Tue, 18 Aug 2026 01:46:29 +0000
Subject: [PATCH 0432/1982] ASoC: codec: max98926: fixup invert setup mask

[ Upstream commit dd0ae9a2e19a24c532c9aa80a44f572b4907bcdf ]

invert might have both WCI/BCI mask, but regmap_update_bits() masks
BCI only. It needs both mask. Fixup it.

	static int max98926_dai_set_fmt(...)
	{
		...
		switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
		case SND_SOC_DAIFMT_NB_NF:
			break;
		case SND_SOC_DAIFMT_NB_IF:
=>			invert = MAX98926_DAI_WCI_MASK;
			break;   ^^^^^^^^^^^^^^^^^^^^^
		case SND_SOC_DAIFMT_IB_NF:
=>			invert = MAX98926_DAI_BCI_MASK;
			break;   ^^^^^^^^^^^^^^^^^^^^^
		case SND_SOC_DAIFMT_IB_IF:
=>			invert = MAX98926_DAI_BCI_MASK | MAX98926_DAI_WCI_MASK;
			break;   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
		default:
			...
		}
		...
		regmap_update_bits(max98926->regmap, MAX98926_FORMAT,
				MAX98926_DAI_BCI_MASK, invert);
		...		^^^^^^^^^^^^^^^^^^^^^
	}

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87wltomc97.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/max98926.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/max98926.c b/sound/soc/codecs/max98926.c
index ae962bda163ebf..8f48f702d56216 100644
--- a/sound/soc/codecs/max98926.c
+++ b/sound/soc/codecs/max98926.c
@@ -360,7 +360,7 @@ static int max98926_dai_set_fmt(struct snd_soc_dai *codec_dai,
 	regmap_write(max98926->regmap,
 			MAX98926_FORMAT, MAX98926_DAI_DLY_MASK);
 	regmap_update_bits(max98926->regmap, MAX98926_FORMAT,
-			MAX98926_DAI_BCI_MASK, invert);
+			MAX98926_DAI_BCI_MASK | MAX98926_DAI_WCI_MASK, invert);
 	return 0;
 }
 

From 848b8e33af21825095925cd75a4fd43271c74547 Mon Sep 17 00:00:00 2001
From: Xiong Weimin <xiongweimin@kylinos.cn>
Date: Fri, 26 Jun 2026 10:05:45 +0800
Subject: [PATCH 0433/1982] vdpa_sim: hold iommu_lock across dma_unmap
 passthrough transition

[ Upstream commit 7b411448c668bfab0d0e572cee5a592cea396ce7 ]

vdpasim_dma_map() updates the IOTLB and the passthrough (iommu_pt)
state under iommu_lock.  vdpasim_dma_unmap() clears iommu_pt and
resets the IOTLB before taking iommu_lock, then deletes the mapping
while holding the lock.

A concurrent dma_map(), dma_unmap(), or reset path that also touches
the same address space can therefore observe or modify the IOTLB and
iommu_pt state without consistent locking.

Perform the passthrough transition and range deletion under the same
iommu_lock scope, matching dma_map().

Tested-on: openEuler VM (6.16.8, /usr/src/linux-6.16.8)
Tested-by: Xiong Weimin <xiongweimin@kylinos.cn>

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260626020545.607600-3-15927021679@163.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vdpa/vdpa_sim/vdpa_sim.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
index 9df300c467452d..44055778b6940e 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -736,12 +736,11 @@ static int vdpasim_dma_unmap(struct vdpa_device *vdpa, unsigned int asid,
 	if (asid >= vdpasim->dev_attr.nas)
 		return -EINVAL;
 
+	spin_lock(&vdpasim->iommu_lock);
 	if (vdpasim->iommu_pt[asid]) {
 		vhost_iotlb_reset(&vdpasim->iommu[asid]);
 		vdpasim->iommu_pt[asid] = false;
 	}
-
-	spin_lock(&vdpasim->iommu_lock);
 	vhost_iotlb_del_range(&vdpasim->iommu[asid], iova, iova + size - 1);
 	spin_unlock(&vdpasim->iommu_lock);
 

From ad008eeee1e9ba2bec2215e3acf7d9f4ba90fc81 Mon Sep 17 00:00:00 2001
From: Gilles Risch <gilles.risch@gmail.com>
Date: Mon, 17 Aug 2026 02:43:26 +0200
Subject: [PATCH 0434/1982] drm/radeon: fix internal display on iMac11, 1
 (RV770/DCE3.1)

[ Upstream commit 275c3332585bbabcefad109a6978cc0cbecf2008 ]

The Apple iMac11,1 (27-inch, Late 2009) uses a Mobility Radeon HD 4850
(RV770/DCE3.1) with a 2560x1440 internal panel on an internal
DisplayPort path. Without this fix the display stays dark under KMS.

This machine suffers from the same issue as iMac10,1 and iMac11,2:
Apple routes the internal display through Link B of the DIG encoder
instead of Link A. Add iMac11,1 to the existing DMI quirk and move
the Apple-specific encoder assignment into its own block, independent
of the DCE version check.

Additionally, the 2560x1440 panel requires RADEON_PLL_USE_FRAC_FB_DIV
and ATOM_ENCODER_CMD_DP_VIDEO_ON, limited to iMac11,1 via dmi_match()
to avoid affecting other boards.

Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Gilles Risch <gilles.risch@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/atombios_crtc.c     |  5 ++++-
 drivers/gpu/drm/radeon/atombios_encoders.c | 23 ++++++++++++----------
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 9b3a3a9d60e203..837700ab8079f6 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -24,6 +24,8 @@
  *          Alex Deucher
  */
 
+#include <linux/dmi.h>
+
 #include <drm/drm_fixed.h>
 #include <drm/drm_fourcc.h>
 #include <drm/drm_framebuffer.h>
@@ -594,7 +596,8 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
 		if (((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
 		    && !radeon_crtc->ss_enabled)
 			radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
-		if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
+		if ((ASIC_IS_DCE32(rdev) || dmi_match(DMI_PRODUCT_NAME, "iMac11,1"))
+		    && mode->clock > 165000)
 			radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
 	} else {
 		radeon_crtc->pll_flags |= RADEON_PLL_LEGACY;
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 3d9f47bc807af2..ddfa31a7b83a52 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1707,7 +1707,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
 			/* DP_SET_POWER_D0 is set in radeon_dp_link_train */
 			radeon_dp_link_train(encoder, connector);
-			if (ASIC_IS_DCE4(rdev))
+			if (ASIC_IS_DCE4(rdev) || dmi_match(DMI_PRODUCT_NAME, "iMac11,1"))
 				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
 		}
 		if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
@@ -2123,17 +2123,20 @@ int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder, int fe_idx)
 	}
 
 	/*
-	 * On DCE32 any encoder can drive any block so usually just use crtc id,
-	 * but Apple thinks different at least on iMac10,1 and iMac11,2, so there use linkb,
-	 * otherwise the internal eDP panel will stay dark.
+	 * Apple routes the internal eDP panel through Link B of the DIG encoder
+	 * instead of Link A on the iMac10,1, iMac11,1 and iMac11,2.
+	 * Use linkb to avoid a dark display.
 	 */
-	if (ASIC_IS_DCE32(rdev)) {
-		if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") ||
-		    dmi_match(DMI_PRODUCT_NAME, "iMac11,2"))
-			enc_idx = (dig->linkb) ? 1 : 0;
-		else
-			enc_idx = radeon_crtc->crtc_id;
+	if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") ||
+	    dmi_match(DMI_PRODUCT_NAME, "iMac11,1") ||
+	    dmi_match(DMI_PRODUCT_NAME, "iMac11,2")) {
+		enc_idx = (dig->linkb) ? 1 : 0;
+		goto assigned;
+	}
 
+	/* on DCE32 and encoder can driver any block so just crtc id */
+	if (ASIC_IS_DCE32(rdev)) {
+		enc_idx = radeon_crtc->crtc_id;
 		goto assigned;
 	}
 

From b34f1cc7838e7c1a0151dfba638e88e8493b1803 Mon Sep 17 00:00:00 2001
From: Weimin Xiong <xiongwm2026@163.com>
Date: Thu, 16 Jul 2026 13:43:53 +0800
Subject: [PATCH 0435/1982] vdpa/mlx5: roll back MR update after VQ setup
 failure

[ Upstream commit 11f79e2780043ad94424a8db02a7a9022ba93252 ]

mlx5_vdpa_change_map() must install the new MR before rebuilding or
resuming virtqueues, because both paths read the MR keys from
mvdev->mres.mr[].

If rebuilding the virtqueue resources fails, the new MR must not remain
installed after its reference is released. Keep an extra reference to
the old MR before replacing it. On setup failure, restore the old MR;
the saved reference then becomes the map reference, while replacing the
new MR drops its map reference.

Make mlx5_vdpa_change_map() consume new_mr on all error paths so that
set_map_data() does not release an MR already released during rollback.

v2:
- Keep the new MR installed while virtqueues are rebuilt.
- Restore the old MR only after setup_vq_resources() fails.

Signed-off-by: Weimin Xiong <xiongwm2026@163.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Message-ID: <20260716054353.155805-1-xiongwm2026@163.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vdpa/mlx5/net/mlx5_vnet.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 44062e9d68f006..c49167d760a620 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -3044,18 +3044,24 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
 				unsigned int asid)
 {
 	struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
+	struct mlx5_vdpa_mr *old_mr;
 	bool teardown = !is_resumable(ndev);
 	int err;
 
 	suspend_vqs(ndev, 0, ndev->cur_num_vqs);
 	if (teardown) {
 		err = save_channels_info(ndev);
-		if (err)
+		if (err) {
+			mlx5_vdpa_put_mr(mvdev, new_mr);
 			return err;
+		}
 
 		teardown_vq_resources(ndev);
 	}
 
+	/* Keep the old MR alive in case rebuilding the VQs fails. */
+	old_mr = mvdev->mres.mr[asid];
+	mlx5_vdpa_get_mr(mvdev, old_mr);
 	mlx5_vdpa_update_mr(mvdev, new_mr, asid);
 
 	for (int i = 0; i < mvdev->max_vqs; i++)
@@ -3063,17 +3069,22 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,
 						MLX5_VIRTQ_MODIFY_MASK_DESC_GROUP_MKEY;
 
 	if (!(mvdev->status & VIRTIO_CONFIG_S_DRIVER_OK) || mvdev->suspended)
-		return 0;
+		goto out;
 
 	if (teardown) {
 		restore_channels_info(ndev);
 		err = setup_vq_resources(ndev, true);
-		if (err)
+		if (err) {
+			/* The saved reference becomes the restored map reference. */
+			mlx5_vdpa_update_mr(mvdev, old_mr, asid);
 			return err;
+		}
 	}
 
 	resume_vqs(ndev, 0, ndev->cur_num_vqs);
 
+out:
+	mlx5_vdpa_put_mr(mvdev, old_mr);
 	return 0;
 }
 
@@ -3357,15 +3368,11 @@ static int set_map_data(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
 		err = mlx5_vdpa_change_map(mvdev, new_mr, asid);
 		if (err) {
 			mlx5_vdpa_err(mvdev, "change map failed(%d)\n", err);
-			goto out_err;
+			return err;
 		}
 	}
 
 	return mlx5_vdpa_update_cvq_iotlb(mvdev, iotlb, asid);
-
-out_err:
-	mlx5_vdpa_put_mr(mvdev, new_mr);
-	return err;
 }
 
 static int mlx5_vdpa_set_map(struct vdpa_device *vdev, unsigned int asid,

From 085c485d4952414eec75e2dd2539e2a721555e43 Mon Sep 17 00:00:00 2001
From: Chad Talbott <chad.talbott@gmail.com>
Date: Tue, 18 Aug 2026 14:32:37 -1000
Subject: [PATCH 0436/1982] ALSA: usb-audio: Add MIN_MUTE quirk for Creative
 Sound Blaster Play! 3

[ Upstream commit 352cef030f9036a658e6eb03d6bb85fa19c7c103 ]

The Creative Sound Blaster Play! 3 (041e:324d) exposes a Feature Unit
volume control with a range of -44.00 dB .. 0.00 dB over raw values
0..88, but raw value 0 is in fact a hard mute rather than -44.00 dB.

Tested on hardware.

Signed-off-by: Chad Talbott <chad.talbott@gmail.com>
Link: https://patch.msgid.link/20260819003237.452807-1-chad.talbott@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index b08e07324f830f..8dcba375bd4a36 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2152,6 +2152,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 		   QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
 	DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
+	DEVICE_FLG(0x041e, 0x324d, /* Creative Sound Blaster Play! 3 */
+		   QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
 	DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */
 		   QUIRK_FLAG_GET_SAMPLE_RATE),
 	DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */

From cfc695ac470db028c4a4935297d8954a3fe6402d Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Wed, 24 Jun 2026 16:08:46 +0200
Subject: [PATCH 0437/1982] virtio_balloon: warn on failed buffer add in
 tell_host()

[ Upstream commit 198eda395067b56ee605de076f0519620f4e5d90 ]

tell_host() ignores the return value of virtqueue_add_outbuf() and goes
on to kick the queue and wait_event() for the host's ack. The comment
claims "We should always be able to add one buffer to an empty queue",
but that does not hold once the virtqueue has been broken (e.g. on
device shutdown): the add then fails with -EIO and the following
wait_event() would block forever on a buffer the host can never return.

Warn and bail out on failure, mirroring virtballoon_free_page_report().

Suggested-by: David Hildenbrand <david@kernel.org>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260624140846.2616797-5-den@openvz.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_balloon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index a3995e77a652ca..0386e7b459bb1c 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -185,16 +185,18 @@ static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq)
 {
 	struct scatterlist sg;
 	unsigned int len;
+	int err;
 
 	sg_init_one(&sg, vb->pfns, sizeof(vb->pfns[0]) * vb->num_pfns);
 
 	/* We should always be able to add one buffer to an empty queue. */
-	virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	err = virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	if (WARN_ON_ONCE(err))
+		return;
 	virtqueue_kick(vq);
 
 	/* When host has read buffer, this completes via balloon_ack */
 	wait_event(vb->acked, virtqueue_get_buf(vq, &len));
-
 }
 
 static int virtballoon_free_page_report(struct page_reporting_dev_info *pr_dev_info,

From b330ab215f2818660ca96b4b2b3b82642d6b50c6 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 23:25:28 +0800
Subject: [PATCH 0438/1982] rtc: ab-eoz9: add missing MODULE_DEVICE_TABLE()

[ Upstream commit 7490b8356e52e09c196645912f2c054f79aa5f3a ]

The driver has a match table for the i2c bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704152528.53258-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ab-eoz9.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/rtc-ab-eoz9.c b/drivers/rtc/rtc-ab-eoz9.c
index de002f7a39bf40..8dc656bb78bfba 100644
--- a/drivers/rtc/rtc-ab-eoz9.c
+++ b/drivers/rtc/rtc-ab-eoz9.c
@@ -549,6 +549,7 @@ static const struct i2c_device_id abeoz9_id[] = {
 	{ "abeoz9" },
 	{ }
 };
+MODULE_DEVICE_TABLE(i2c, abeoz9_id);
 
 static struct i2c_driver abeoz9_driver = {
 	.driver = {

From 60ae1e266f40a4dbb994b9ea39db18c2fd665828 Mon Sep 17 00:00:00 2001
From: Szymon Durawa <szymon.durawa@linux.intel.com>
Date: Wed, 19 Aug 2026 13:05:22 +0000
Subject: [PATCH 0439/1982] PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL)
 Device IDs

[ Upstream commit 55aa45154fe48b7d8e96bc031ad27d5b0edfcdb8 ]

Add VMD Device ID Support for Intel NVL/DNL processors.

Suggested-by: Nirmal Patel <nirmal.patel@linux.intel.com>
Signed-off-by: Szymon Durawa <szymon.durawa@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Nirmal Patel <nirmal.patel@linux.intel.com>
Cc: Jonathan Derrick <jonathan.derrick@linux.dev>
Link: https://patch.msgid.link/20260819130523.398493-1-szymon.durawa@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/vmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index 5d3e6cc7e4feb4..aa6d4f56f612a7 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -1141,6 +1141,10 @@ static const struct pci_device_id vmd_ids[] = {
                 .driver_data = VMD_FEATS_CLIENT,},
 	{PCI_VDEVICE(INTEL, 0xb07f),
                 .driver_data = VMD_FEATS_CLIENT,},
+	{PCI_VDEVICE(INTEL, 0xd70b),
+		.driver_data = VMD_FEATS_CLIENT,},
+	{PCI_VDEVICE(INTEL, 0xd73b),
+		.driver_data = VMD_FEATS_CLIENT,},
 	{0,}
 };
 MODULE_DEVICE_TABLE(pci, vmd_ids);

From c4726cf942f00fd658f62f52316b1ff3248adcbd Mon Sep 17 00:00:00 2001
From: Jinqian Yang <yangjinqian1@huawei.com>
Date: Thu, 16 Jul 2026 19:59:40 +0800
Subject: [PATCH 0440/1982] virtio_ring: fix infinite loop in
 virtnet_poll_cleantx when device is broken

[ Upstream commit 0d0eff39ceb3dcbf7847a6f4517086c207c60081 ]

virtnet_poll_cleantx() contains a do-while loop that cleans up
transmitted TX buffers and calls virtqueue_enable_cb_delayed() to check
whether more buffers need processing. When the virtio backend stops
responding during guest reboot, used->idx is never updated, so
virtqueue_enable_cb_delayed() always returns false and the loop never
terminates. Then it will block reboot process, and the guest will hang.

The problem occurs during guest reboot under network traffic:

  1. kernel_restart() -> device_shutdown() traverses the device list
  2. virtio_dev_shutdown() calls virtio_break_device() which sets
     vq->broken = true
  3. virtio_dev_shutdown() then calls virtio_synchronize_cbs() to wait
     for in-flight callbacks to complete
  4. A virtio interrupt fires, softirq is deferred to ksoftirqd which
     calls net_rx_action() -> virtnet_poll() -> virtnet_poll_cleantx()
  5. virtnet_poll_cleantx() enters the do-while loop and never exits
     because the QEMU backend has stopped updating used->idx, despite
     vq->broken having been set to true in step 2.

Since the loop runs inside ksoftirqd (a SCHED_OTHER kthread), it is
visible to the scheduler and does not trigger a hard lockup. However,
the kthread never leaves the loop, so RCU detects it as a CPU stall
and reports it periodically. Meanwhile, the reboot process remains
blocked in device_shutdown() because virtio_dev_shutdown() cannot
complete its synchronization step, and the guest hangs permanently.

This can be reproduced on a guest with a virtio-net device: run iperf3
traffic in the guest, then trigger reboot. The reboot occasionally hangs
permanently with RCU stall on ksoftirqd.

Observed on ARM64 KVM guest:

  CPU#1 RCU stall (ksoftirqd/1), repeated periodically:
    virtqueue_enable_cb_delayed_split <- virtnet_poll <- __napi_poll <-
    net_rx_action <- handle_softirqs <- run_ksoftirqd <-
    smpboot_thread_fn <- kthread

Fix by adding a vq->broken check in virtqueue_enable_cb_delayed(), so
that the loop exits immediately when the device is broken, allowing
the device shutdown to proceed.

Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260716115940.394832-1-yangjinqian1@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index b8199e578ea98a..5c0139f3b98111 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -2667,6 +2667,14 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
+	/*
+	 * When the device is broken there is no point in polling used->idx,
+	 * the backend will never update it. Return true to let callers
+	 * exit their cleanup loops instead of spinning forever.
+	 */
+	if (unlikely(vq->broken))
+		return true;
+
 	if (vq->event_triggered)
 		data_race(vq->event_triggered = false);
 

From c6e3c175c3ffcee68a195bd128b087b4f350648d Mon Sep 17 00:00:00 2001
From: Jack Yu <jack.yu@realtek.com>
Date: Thu, 20 Aug 2026 17:24:15 +0800
Subject: [PATCH 0441/1982] ASoC: rt712-sdca: Pull high JD2 to prevent from
 entering TV mode

[ Upstream commit dfb8bc1d286fd97b7cf47e3af5df84cfb068d214 ]

Add a patch setting to prevent ALC712 from entering TV mode which
may cause unexpected issues.

Signed-off-by: Jack Yu <jack.yu@realtek.com>
Link: https://patch.msgid.link/20260820092415.2979641-1-jack.yu@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt712-sdca.c | 1 +
 sound/soc/codecs/rt712-sdca.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sound/soc/codecs/rt712-sdca.c b/sound/soc/codecs/rt712-sdca.c
index d8b40663fa92fa..a799b8aab73aa1 100644
--- a/sound/soc/codecs/rt712-sdca.c
+++ b/sound/soc/codecs/rt712-sdca.c
@@ -1786,6 +1786,7 @@ static void rt712_sdca_vb_io_init(struct rt712_sdca_priv *rt712)
 	dev_dbg(dev, "%s jack/mic/amp func_status=0x%x, 0x%x, 0x%x\n",
 		__func__, jack_func_status, mic_func_status, amp_func_status);
 
+	rt712_sdca_index_write(rt712, RT712_VENDOR_REG, RT712_JD_CTL3, 0x7778);
 	/* DMIC */
 	if ((mic_func_status & FUNCTION_NEEDS_INITIALIZATION) || (!rt712->first_hw_init)) {
 		rt712_sdca_index_write(rt712, RT712_VENDOR_HDA_CTL, RT712_DMIC2_FU_IT_FLOAT_CTL, 0x1526);
diff --git a/sound/soc/codecs/rt712-sdca.h b/sound/soc/codecs/rt712-sdca.h
index 7ab7d5feb50a29..46740281a5c17f 100644
--- a/sound/soc/codecs/rt712-sdca.h
+++ b/sound/soc/codecs/rt712-sdca.h
@@ -74,6 +74,7 @@ struct rt712_dmic_kctrl_priv {
 #define RT712_JD_PRODUCT_NUM			0x00
 #define RT712_ANALOG_BIAS_CTL3			0x04
 #define RT712_JD_CTL1				0x09
+#define RT712_JD_CTL3				0x0b
 #define RT712_IO_CTL				0x0c
 #define RT712_LDO2_3_CTL1			0x0e
 #define RT712_PARA_VERB_CTL			0x1a

From 889c7d21115ac30e9e7713fb6e364ad4f25cac83 Mon Sep 17 00:00:00 2001
From: Robert Leussler <robert.leussler@leica-geosystems.com>
Date: Tue, 21 Jul 2026 08:19:07 +0000
Subject: [PATCH 0442/1982] rtc: ds1307: fix RX8130 wakeup alarm WADA bit for
 day-of-month mode

[ Upstream commit 878d93aaa596a861dbc8d71f7c38e62a2e805f01 ]

The RX8130 wakeup alarm never fired when set via
/sys/class/rtc/rtc0/wakealarm. The root cause is that the WADA bit
(bit 3) in the Extension register (0x1c) was never set before
programming the alarm registers.

Per the RX8130 datasheet:
WADA=0 - Week alarm: register 0x19 is compared against day-of-week
WADA=1 - Day alarm:  register 0x19 is compared against day-of-month

rx8130_set_alarm() always writes a BCD day-of-month value to alarm
register 0x19, so WADA must be 1. With WADA=0 the hardware matched the
day-of-month value (e.g. 15) as a day-of-week index, which is always
out of range (valid weekdays are 0-6), so the alarm interrupt was never
asserted.

Fix by setting the WADA bit in rx8130_set_alarm() before writing the
Extension register back to the device.

This is consistent with rx8130_read_alarm(), which decodes the same
register under the same assumption (24-hour and day-of-month mode).

Signed-off-by: Robert Leussler <robert.leussler@leica-geosystems.com>
Link: https://patch.msgid.link/20260721081907.3518648-1-robert.leussler@leica-geosystems.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1307.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 9ba5958ca7a6e6..d9a8e5045e37d7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -662,7 +662,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
 	if (ret < 0)
 		return ret;
 
-	ctl[0] &= RX8130_REG_EXTENSION_WADA;
+	ctl[0] |= RX8130_REG_EXTENSION_WADA;
 	ctl[1] &= ~RX8130_REG_FLAG_AF;
 	ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
 

From 48e991d80a2057c2692ad1ddfc4e642446b498f6 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 4 Jul 2026 20:17:34 +0800
Subject: [PATCH 0443/1982] rtc: brcmstb-waketimer: add missing
 MODULE_DEVICE_TABLE()

[ Upstream commit 402c89d28fecd28652a4bfe997f08f6544836381 ]

The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().

Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.

This is a source-level fix.  It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704121734.54941-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-brcmstb-waketimer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/rtc-brcmstb-waketimer.c b/drivers/rtc/rtc-brcmstb-waketimer.c
index fb47c32ab5ff4f..55c15aad42cff4 100644
--- a/drivers/rtc/rtc-brcmstb-waketimer.c
+++ b/drivers/rtc/rtc-brcmstb-waketimer.c
@@ -413,6 +413,7 @@ static const __maybe_unused struct of_device_id brcmstb_waketmr_of_match[] = {
 	{ .compatible = "brcm,brcmstb-waketimer" },
 	{ /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, brcmstb_waketmr_of_match);
 
 static struct platform_driver brcmstb_waketmr_driver = {
 	.probe			= brcmstb_waketmr_probe,

From 5c54d87cbe634c6a1ef7e0450663f89e8571156f Mon Sep 17 00:00:00 2001
From: Li Jun <lijun01@kylinos.cn>
Date: Thu, 20 Aug 2026 17:23:51 +0800
Subject: [PATCH 0444/1982] spi: loongson: pm: add .freeze .poweroff .thaw
 .restore

[ Upstream commit a9c2f0d401fd1e11ce59e4243946a59bd818e8c5 ]

after execute s4, the spi error,
[ 1104.754246][ 4] [    T1] tpm_tis_spi spi-SMO0768:00: SPI transfer failed: -110
[ 1104.761503][ 4] [    T1] spi_master spi1: failed to transfer one message from queue
[ 1104.769201][ 4] [    T1] spi_master spi1: noqueue transfer failed
[ 1104.776344][ 4] [    T1] tpm_tis_spi spi-SMO0768:00: SPI transfer failed: -110
[ 1104.783609][ 4] [    T1] spi_master spi1: failed to transfer one message from queue
[ 1104.791308][ 4] [    T1] spi_master spi1: noqueue transfer failed
[ 1104.797446][ 4] [    T1] gttadd tpm_chip_start1 ret = -110
and in s4 the loongson_spi_resume&suspend are not
called at all. use DEFINE_SIMPLE_DEV_PM_OPS() add .freeze .poweroff
.thaw .restore, after s4 the spi communication is normal.

Signed-off-by: Li Jun <lijun01@kylinos.cn>
Link: https://patch.msgid.link/20260820092351.101605-1-lijun01@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-loongson-core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/spi/spi-loongson-core.c b/drivers/spi/spi-loongson-core.c
index b46f072a0387b1..f07ee432f96b51 100644
--- a/drivers/spi/spi-loongson-core.c
+++ b/drivers/spi/spi-loongson-core.c
@@ -270,10 +270,8 @@ static int __maybe_unused loongson_spi_resume(struct device *dev)
 	return 0;
 }
 
-const struct dev_pm_ops loongson_spi_dev_pm_ops = {
-	.suspend = loongson_spi_suspend,
-	.resume = loongson_spi_resume,
-};
+DEFINE_SIMPLE_DEV_PM_OPS(loongson_spi_dev_pm_ops, loongson_spi_suspend, loongson_spi_resume);
+
 EXPORT_SYMBOL_NS_GPL(loongson_spi_dev_pm_ops, "SPI_LOONGSON_CORE");
 
 MODULE_DESCRIPTION("Loongson SPI core driver");

From c63885314e5b19586f16200e527351aeb5d4607f Mon Sep 17 00:00:00 2001
From: Carlos Song <carlos.song@nxp.com>
Date: Thu, 16 Jul 2026 15:19:56 +0800
Subject: [PATCH 0445/1982] i2c: imx-lpi2c: properly unwind resources on probe
 failure

[ Upstream commit cbd043b00ee3f542c115c8809c4d9a67465c07d5 ]

When probe fails at devm_clk_rate_exclusive_get() or clk_get_rate(),
which occur before runtime PM is initialized, the clocks enabled by
clk_bulk_prepare_enable() are never disabled.

When probe fails after runtime PM is initialized, the previous error
path called pm_runtime_put_sync(), which triggers the runtime suspend
callback. However, due to different clock management strategies on
different SoCs[1] (to avoid deadlocks between the global prepare_lock
and runtime PM), the callback may only disable clocks without
unpreparing them, causing an incomplete unwind.

Introduce a new error label 'clk_disable' to explicitly invoke
clk_bulk_disable_unprepare(). Replace pm_runtime_put_sync() with the
sequence of pm_runtime_disable(), pm_runtime_set_suspended() and
pm_runtime_put_noidle() to bypass the runtime suspend callback during
error recovery. During the LPI2C driver probe phase, clock APIs are
used exclusively to manage clocks. Once probing succeeds, clock
management is handed over to the runtime PM core.

[1] https://lore.kernel.org/all/20251125084718.2156168-1-carlos.song@nxp.com/

Signed-off-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260716071957.2670263-2-carlos.song@oss.nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-imx-lpi2c.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index 24c70ea371bb9f..7c560a4f683197 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -1500,14 +1500,18 @@ static int lpi2c_imx_probe(struct platform_device *pdev)
 	 * each transfer
 	 */
 	ret = devm_clk_rate_exclusive_get(&pdev->dev, lpi2c_imx->clks[0].clk);
-	if (ret)
-		return dev_err_probe(&pdev->dev, ret,
-				     "can't lock I2C peripheral clock rate\n");
+	if (ret) {
+		ret = dev_err_probe(&pdev->dev, ret,
+				    "can't lock I2C peripheral clock rate\n");
+		goto clk_disable;
+	}
 
 	lpi2c_imx->rate_per = clk_get_rate(lpi2c_imx->clks[0].clk);
-	if (!lpi2c_imx->rate_per)
-		return dev_err_probe(&pdev->dev, -EINVAL,
-				     "can't get I2C peripheral clock rate\n");
+	if (!lpi2c_imx->rate_per) {
+		ret = dev_err_probe(&pdev->dev, -EINVAL,
+				    "can't get I2C peripheral clock rate\n");
+		goto clk_disable;
+	}
 
 	pm_runtime_set_autosuspend_delay(&pdev->dev, I2C_PM_TIMEOUT);
 	pm_runtime_use_autosuspend(&pdev->dev);
@@ -1545,8 +1549,11 @@ static int lpi2c_imx_probe(struct platform_device *pdev)
 
 rpm_disable:
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
-	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
+	pm_runtime_set_suspended(&pdev->dev);
+	pm_runtime_put_noidle(&pdev->dev);
+clk_disable:
+	clk_bulk_disable_unprepare(lpi2c_imx->num_clks, lpi2c_imx->clks);
 
 	return ret;
 }

From a4467fbe41147b347a6c2d738afcc4ad79b6d45f Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Thu, 13 Aug 2026 16:29:34 -0700
Subject: [PATCH 0446/1982] fbdev: maxine: fix 64-bit build error

[ Upstream commit 3adec5c640dc09dca5605043e138412fd5a0629d ]

The KSEG1ADDR() macro is only defined for non-64BIT builds.
Use the CKSEG1ADDR() macro instead.

In file included from ../drivers/video/fbdev/maxinefb.c:34:
../drivers/video/fbdev/maxinefb.c: In function 'maxinefb_ims332_write_register':
../include/video/maxinefb.h:16:41: error: implicit declaration of function 'KSEG1ADDR'; did you mean 'CKSEG1ADDR'? [-Wimplicit-function-declaration]
   16 | #define MAXINEFB_IMS332_ADDRESS         KSEG1ADDR(0x1c140000)
../drivers/video/fbdev/maxinefb.c:66:49: note: in expansion of macro 'MAXINEFB_IMS332_ADDRESS'
   66 |         register unsigned char *regs = (char *) MAXINEFB_IMS332_ADDRESS;
../drivers/video/fbdev/maxinefb.c:66:40: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
   66 |         register unsigned char *regs = (char *) MAXINEFB_IMS332_ADDRESS;

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/video/maxinefb.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/video/maxinefb.h b/include/video/maxinefb.h
index 6aeb4acca2bdb7..2b66b32f355cf7 100644
--- a/include/video/maxinefb.h
+++ b/include/video/maxinefb.h
@@ -13,13 +13,13 @@
 /*
  * IMS332 video controller register base address
  */
-#define MAXINEFB_IMS332_ADDRESS		KSEG1ADDR(0x1c140000)
+#define MAXINEFB_IMS332_ADDRESS		CKSEG1ADDR(0x1c140000)
 
 /*
  * Begin of DECstation 5000/xx onboard framebuffer memory, default resolution
  * is 1024x768x8
  */
-#define DS5000_xx_ONBOARD_FBMEM_START	KSEG1ADDR(0x0a000000)
+#define DS5000_xx_ONBOARD_FBMEM_START	CKSEG1ADDR(0x0a000000)
 
 /*
  *      The IMS 332 video controller used in the DECstation 5000/xx series

From 890a3b249d461e2cf732898576722524faf194f5 Mon Sep 17 00:00:00 2001
From: BingKun Yue <yuebingkun@kylinos.cn>
Date: Mon, 17 Aug 2026 14:39:42 +0800
Subject: [PATCH 0447/1982] fbdev: platinumfb: add error checking for ioremap
 calls

[ Upstream commit ba13226fc966004713aed47931db8922b84d1960 ]

The ioremap() and ioremap_wt() calls in platinumfb_probe() were not
checked for failure. If any of these mappings fail, the driver would
dereference NULL pointers, leading to a kernel panic.

Add proper error checking and use goto-based cleanup to avoid code
duplication across the error paths.

Signed-off-by: BingKun Yue <yuebingkun@kylinos.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/platinumfb.c | 35 ++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c
index a08d955d9b4394..81fdaa3541db93 100644
--- a/drivers/video/fbdev/platinumfb.c
+++ b/drivers/video/fbdev/platinumfb.c
@@ -567,15 +567,30 @@ static int platinumfb_probe(struct platform_device* odev)
 	/* frame buffer - map only 4MB */
 	pinfo->frame_buffer_phys = pinfo->rsrc_fb.start;
 	pinfo->frame_buffer = ioremap_wt(pinfo->rsrc_fb.start, 0x400000);
+	if (!pinfo->frame_buffer) {
+		dev_err(&odev->dev, "failed to ioremap frame buffer\n");
+		rc = -ENOMEM;
+		goto err_release_fb;
+	}
 	pinfo->base_frame_buffer = pinfo->frame_buffer;
 
 	/* registers */
 	pinfo->platinum_regs_phys = pinfo->rsrc_reg.start;
 	pinfo->platinum_regs = ioremap(pinfo->rsrc_reg.start, 0x1000);
+	if (!pinfo->platinum_regs) {
+		dev_err(&odev->dev, "failed to ioremap registers\n");
+		rc = -ENOMEM;
+		goto err_unmap_fb;
+	}
 
 	pinfo->cmap_regs_phys = 0xf301b000;	/* XXX not in prom? */
 	request_mem_region(pinfo->cmap_regs_phys, 0x1000, "platinumfb cmap");
 	pinfo->cmap_regs = ioremap(pinfo->cmap_regs_phys, 0x1000);
+	if (!pinfo->cmap_regs) {
+		dev_err(&odev->dev, "failed to ioremap cmap registers\n");
+		rc = -ENOMEM;
+		goto err_release_cmap;
+	}
 
 	/* Grok total video ram */
 	out_be32(&pinfo->platinum_regs->reg[16].r, (unsigned)pinfo->frame_buffer_phys);
@@ -623,13 +638,21 @@ static int platinumfb_probe(struct platform_device* odev)
 	dev_set_drvdata(&odev->dev, info);
 
 	rc = platinum_init_fb(info);
-	if (rc != 0) {
-		iounmap(pinfo->frame_buffer);
-		iounmap(pinfo->platinum_regs);
-		iounmap(pinfo->cmap_regs);
-		framebuffer_release(info);
-	}
+	if (rc != 0)
+		goto err_unmap_cmap;
+
+	return 0;
 
+err_unmap_cmap:
+	iounmap(pinfo->cmap_regs);
+err_release_cmap:
+	release_mem_region(pinfo->cmap_regs_phys, 0x1000);
+	iounmap(pinfo->platinum_regs);
+err_unmap_fb:
+	iounmap(pinfo->frame_buffer);
+err_release_fb:
+	release_mem_region(pinfo->rsrc_fb.start, resource_size(&pinfo->rsrc_fb));
+	framebuffer_release(info);
 	return rc;
 }
 

From b78a4334a8927d4dcc692382a45b420109bcb071 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 19 Aug 2026 10:01:11 +0900
Subject: [PATCH 0448/1982] ksmbd: enable TCP keepalive for accepted
 connections

[ Upstream commit 56549c18a4f75309161ca780feaa4d17904e3ee9 ]

A client that disappears without sending a FIN or RST can leave its
ksmbd connection in ESTABLISHED indefinitely. ksmbd sets a socket
receive timeout, but the connection receive loop retries timeout errors
without a limit, so the connection remains in conn_list and consumes the
per-IP connection quota.

Enable SO_KEEPALIVE on accepted TCP sockets so the TCP stack can detect a
silent peer failure. The keepalive idle time, interval, and probe count
remain controlled by the existing TCP sysctl settings.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/transport_tcp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
index 472d387098767e..ede54bb049532a 100644
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -312,6 +312,12 @@ static int ksmbd_kthread_fn(void *p)
 		ksmbd_debug(CONN, "connect success: accepted new connection\n");
 		client_sk->sk->sk_rcvtimeo = KSMBD_TCP_RECV_TIMEOUT;
 		client_sk->sk->sk_sndtimeo = KSMBD_TCP_SEND_TIMEOUT;
+		/*
+		 * Detect peers that disappear without sending a FIN or RST.
+		 * Otherwise the connection handler can retry receive timeouts
+		 * indefinitely and keep the connection in conn_list.
+		 */
+		sock_set_keepalive(client_sk->sk);
 
 		ksmbd_tcp_new_connection(client_sk);
 	}

From 59f9c4989e6acfb949f87deea646bd184f2d4595 Mon Sep 17 00:00:00 2001
From: Tao Cui <cuitao@kylinos.cn>
Date: Fri, 14 Aug 2026 22:41:16 +0800
Subject: [PATCH 0449/1982] sched_ext/scx_flatcg: expire cached hweights on
 weight changes

[ Upstream commit 94c20e1fb334c2082b443c4470a86ad982f67282 ]

fcg_cgroup_set_weight() updates cgc->weight and the parent's
child_weight_sum but doesn't bump hweight_gen, so the hweights cached by
cgrp_refresh_hweight() stay stale until some task activation bumps the
generation. For cgroups whose tasks never go through a 0->n runnable
transition (e.g. persistently busy ones), a cpu.weight change never
propagates to scheduling at all.

Bump hweight_gen on weight changes so the next refresh recomputes with
the new weight.

Verified on a flatcg VM: a live cpu.weight 100->800 change on a busy
cgroup leaves HWT update at 0 and the distribution unchanged; with it,
hweight_gen increments and the refresh recomputes.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/sched_ext/scx_flatcg.bpf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/sched_ext/scx_flatcg.bpf.c b/tools/sched_ext/scx_flatcg.bpf.c
index d1fc6cb8206c0b..3f01441731b7ef 100644
--- a/tools/sched_ext/scx_flatcg.bpf.c
+++ b/tools/sched_ext/scx_flatcg.bpf.c
@@ -605,6 +605,9 @@ void BPF_STRUCT_OPS(fcg_cgroup_set_weight, struct cgroup *cgrp, u32 weight)
 		pcgc->child_weight_sum += (s64)weight - cgc->weight;
 	cgc->weight = weight;
 	bpf_spin_unlock(&cgv_tree_lock);
+
+	/* expire cached hweights so the new weight propagates */
+	__sync_fetch_and_add(&hweight_gen, 1);
 }
 
 static bool try_pick_next_cgroup(u64 *cgidp)

From 167b5e23acf63ea754e98de06827905cd88df5a8 Mon Sep 17 00:00:00 2001
From: Robin Everaars <robineveraars@pm.me>
Date: Mon, 17 Aug 2026 14:14:17 +0000
Subject: [PATCH 0450/1982] ACPI: button: Add DMI quirk for Razer Blade Pro 17
 early 2020 lid switch

[ Upstream commit 415125669c2ddc773c579a60df108f75712dfa83 ]

The lid switch reports "close" but can miss the matching "open", leaving
_LID closed after resume. systemd-logind then suspends the system again
roughly every 35 seconds.

Reading the embedded controller's PSTA byte while _LID is stale shows that
bit 0x04 is set, which the DSDT treats as open. The DSDT returns the cached
LIDS byte from _LID. Its wake path aborts in RTEC on an unhandled
SystemCMOS region before copying PSTA to LIDS.

Initialize the lid state to open on resume, matching the existing quirk
for the Razer Blade Stealth 13 late 2019. With
button.lid_init_state=open, a physical close suspended once and resume
reported open without another suspend.

Signed-off-by: Robin Everaars <robineveraars@pm.me>
Link: https://patch.msgid.link/20260817141414.213075-1-robineveraars@pm.me
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/button.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 384caea90ce5f6..4ddaee8955c302 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -132,6 +132,17 @@ static const struct dmi_system_id dmi_lid_quirks[] = {
 		},
 		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
 	},
+	{
+		/*
+		 * Razer Blade Pro 17 early 2020, notification of the LID device
+		 * only happens on close, not on open and _LID keeps returning closed.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Blade Pro 17 (Early 2020) - RZ09-0329"),
+		},
+		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+	},
 	{
 		/*
 		 * Samsung galaxybook2 ,initial _LID device notification returns

From e0414672a6878b1bade5fe6e04b45667e79d21dc Mon Sep 17 00:00:00 2001
From: Daeho Jeong <daehojeong@google.com>
Date: Thu, 20 Aug 2026 09:43:40 -0700
Subject: [PATCH 0451/1982] f2fs: avoid setting SBI_NEED_FSCK on transient
 resize failure

[ Upstream commit 258c95150c26a30db1896eacd3bdef26314f2ca1 ]

When free_segment_range() fails in f2fs_resize_fs(), no on-disk
superblock or filesystem metadata has been modified yet, and
free_segment_range() safely restores all in-memory counters before
returning.

However, the current error recovery path unconditionally sets the
SBI_NEED_FSCK flag and prints a scary error message on any error,
forcing an unnecessary and time-consuming fsck.f2fs repair on the
subsequent mount/reboot.

Fix this by separating the error recovery path with a dedicated
recover_user_blocks label to bypass setting SBI_NEED_FSCK on
free_segment_range() failures.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Sunmin Jeong <s_min.jeong@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/gc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 02bd008d79b5c3..e85d7f239e7d0f 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2415,7 +2415,7 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 	set_sbi_flag(sbi, SBI_IS_RESIZEFS);
 	err = free_segment_range(sbi, secs, false);
 	if (err)
-		goto recover_out;
+		goto recover_user_blocks;
 
 	update_sb_metadata(sbi, -secs);
 
@@ -2437,11 +2437,14 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 		f2fs_commit_super(sbi, false);
 	}
 recover_out:
-	clear_sbi_flag(sbi, SBI_IS_RESIZEFS);
 	if (err) {
+		f2fs_bug_on(sbi, err == -EAGAIN);
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
 		f2fs_err(sbi, "resize_fs failed, should run fsck to repair!");
-
+	}
+recover_user_blocks:
+	clear_sbi_flag(sbi, SBI_IS_RESIZEFS);
+	if (err) {
 		spin_lock(&sbi->stat_lock);
 		sbi->user_block_count += shrunk_blocks;
 		spin_unlock(&sbi->stat_lock);

From 75e1a1c2738a29adf5da44c19b552703dcd0b91a Mon Sep 17 00:00:00 2001
From: Csaba Budai <ilyr73@gmail.com>
Date: Fri, 21 Aug 2026 12:25:14 +0200
Subject: [PATCH 0452/1982] ALSA: hda/realtek: Fix ALC700 audio on Intel Hades
 Canyon

[ Upstream commit 1fcccdc20a76b4639b00124cf2a379b837bd2bf7 ]

On Intel Hades Canyon systems with an ALC700 codec, analog audio can
become unusable after rebooting from Windows into Linux.

The affected system uses codec subsystem ID 8086:2073. In the broken
state, Realtek coefficient 0x1b has value 0x4a4b. Setting bit 0x0400
changes it to 0x4e4b and immediately restores normal analog playback.

The BIOS also sets this bit after disabling and re-enabling onboard
audio, while Windows may leave it cleared. Linux currently does not
restore it during codec initialization.

Add a machine-specific fixup for Intel Hades Canyon which sets only
bit 0x0400 of coefficient 0x1b during HDA_FIXUP_ACT_INIT.

The fix has been verified across Windows -> Linux reboots on an Intel
NUC8i7HNB with an ALC700 codec.

Signed-off-by: Csaba Budai <ilyr73@gmail.com>
Link: https://patch.msgid.link/20260821102514.11194-1-ilyr73@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index bc33930e83b9fb..8196235c31d2b6 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -3820,6 +3820,7 @@ enum {
 	ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
 	ALC225_FIXUP_S3_POP_NOISE,
 	ALC700_FIXUP_INTEL_REFERENCE,
+	ALC700_FIXUP_INTEL_HADES_CANYON,
 	ALC274_FIXUP_DELL_BIND_DACS,
 	ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
 	ALC298_FIXUP_TPT470_DOCK_FIX,
@@ -4040,6 +4041,19 @@ static void alc287_fixup_lenovo_yoga_book_9i(struct hda_codec *codec,
 	__snd_hda_apply_fixup(codec, id, action, 0);
 }
 
+static void alc700_fixup_intel_hades_canyon(struct hda_codec *codec,
+					    const struct hda_fixup *fix,
+					    int action)
+{
+	/*
+	 * Windows may leave coef 0x1b bit 0x0400 cleared, causing broken
+	 * analog playback after rebooting into Linux.  Restore the bit
+	 * during codec initialization.
+	 */
+	if (action == HDA_FIXUP_ACT_INIT)
+		alc_update_coef_idx(codec, 0x1b, 0x0400, 0x0400);
+}
+
 static const struct hda_fixup alc269_fixups[] = {
 	[ALC233_FIXUP_WUJIE_SPEAKERS] = {
 		.type = HDA_FIXUP_PINS,
@@ -5092,6 +5106,10 @@ static const struct hda_fixup alc269_fixups[] = {
 			{}
 		}
 	},
+	[ALC700_FIXUP_INTEL_HADES_CANYON] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc700_fixup_intel_hades_canyon,
+	},
 	[ALC274_FIXUP_DELL_BIND_DACS] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc274_fixup_bind_dacs,
@@ -7653,6 +7671,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x2782, 0xa128, "Positivo N15RPE-S", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x2782, 0xa212, "Lunnen Ground 14", ALC269VC_FIXUP_LUNNEN_GROUND_14),
 	SND_PCI_QUIRK(0x7017, 0x2014, "Star Labs StarFighter", ALC233_FIXUP_STARLABS_STARFIGHTER),
+	SND_PCI_QUIRK(0x8086, 0x2073, "Intel NUC 8 Hades Canyon",
+		      ALC700_FIXUP_INTEL_HADES_CANYON),
 	SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
 	SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
 	SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),

From 15f26d38bcf58ade0b9b52a68fb8564a0f8453c7 Mon Sep 17 00:00:00 2001
From: Will Porter <mrwillporter@gmail.com>
Date: Sat, 22 Aug 2026 20:53:53 -0500
Subject: [PATCH 0453/1982] ALSA: usb-audio: Add iD14 MkI to monitor-mix volume
 quirk

[ Upstream commit 17056a36d276a740f09dca723de1bc6aa3eb4ef9 ]

Add the iD14 MkI USB ID to the existing audient_id14_map. This
names feature unit 12 Monitor Mix Playback Volume.

Live meter A/B testing on MkI USB ID 2708:0002 reproduced the same
asymmetric attenuation seen on MkII. At ALSA value 104, the right
channel was 23.07 dB below the left. At 127, both channels were equal.

The misleading Speaker Playback Volume name causes PipeWire to adopt
FU12 as the stream master. Reuse the existing map to keep the control
available while preventing that selection.

Hardware-tested on Bazzite 7.2.0-ogc4.1.fc44.x86_64 with this change
backported. ALSA exposed Monitor Mix Playback Volume after module load
and USB reconnect. PipeWire volume changes from 100% to 35% and back
left all four FU12 values at 127. Channel-isolated left/right playback
remained balanced after reconnect.

Build-tested with CONFIG_SND_USB_AUDIO=m using the focused sound/usb
target.

Assisted-by: Codex:gpt-5
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Link: https://patch.msgid.link/20260823015353.686080-1-mrwillporter@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer_maps.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 8046d5987d5b1c..ace4ccad8f51c9 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -505,13 +505,13 @@ static const struct usbmix_connector_map gigabyte_b450_connector_map[] = {
 	{}
 };
 
-/* Audient iD14: FU 12 advertises Volume on only 4 of its 6 logical channels
- * and sits on the monitor mixer branch, but it is traced through to the
- * Speaker output terminal and gets named "Speaker Playback Volume".  Userspace
- * then adopts it as the stream's hardware volume, and any setting below 0 dB
- * attenuates some channels but not others (20 dB imbalance at 80%).  Give it a
- * non-standard name so that it is no longer taken for the stream's master
- * volume, while remaining reachable for anyone who wants the monitor gain.
+/* Audient iD14 MkI and MkII: FU 12 sits on the monitor mixer branch but is
+ * traced through to the Speaker output terminal, so it is named "Speaker
+ * Playback Volume".  On MkII it controls only 4 of 6 playback channels.  MkI
+ * testing found asymmetric attenuation within the main stereo pair.  Userspace
+ * adopts this control as the stream's hardware volume, causing imbalance below
+ * 0 dB.  Give it a non-standard name so that userspace no longer treats it as
+ * the stream master, while keeping the monitor gain reachable.
  */
 static const struct usbmix_name_map audient_id14_map[] = {
 	{ 12, "Monitor Mix Playback" },	/* FU, partial coverage */
@@ -602,7 +602,12 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.map = maya44_map,
 	},
 	{
-		/* Audient iD14 */
+		/* Audient iD14 MkI */
+		.id = USB_ID(0x2708, 0x0002),
+		.map = audient_id14_map,
+	},
+	{
+		/* Audient iD14 MkII */
 		.id = USB_ID(0x2708, 0x0008),
 		.map = audient_id14_map,
 	},

From 0337af8a6c39d6cdb9d8b500e351cb9461c4b9c0 Mon Sep 17 00:00:00 2001
From: Chen Changcheng <chenchangcheng@kylinos.cn>
Date: Mon, 27 Jul 2026 15:34:38 +0800
Subject: [PATCH 0454/1982] scsi: snic: Fix SCSI host leak on workqueue
 allocation failure

[ Upstream commit 12e67eb89eb2b9516685c744d3f7de0a2d1bd701 ]

In snic_add_host(), if scsi_add_host() succeeds but
alloc_ordered_workqueue() fails, the function returns -ENOMEM with
shost->work_q left as NULL. The caller's error path then calls
snic_del_host(), which returns early when !shost->work_q without calling
scsi_remove_host(). The Scsi_Host remains registered in sysfs as a zombie
device even after the probe has failed. This causes:

 - The leaked host remains visible in /sys/class/scsi_host/ after probe
   failure, with state "running".

 - Subsequent SCSI host numbering is permanently shifted (the leaked host
   ID from ida_alloc() is never reclaimed).

 - Memory leak: the Scsi_Host allocation can never be freed because
   device_add() took a reference that can only be released by device_del()
   inside scsi_remove_host().

Fix by adding scsi_remove_host() in the workqueue allocation failure path
inside snic_add_host(), undoing the successful scsi_add_host() before
returning the error. This is cleaner than modifying snic_del_host() because
snic_del_host() is called from a shared error label that also serves paths
where snic_add_host() was never invoked.

Reproducer (requires no real SNIC hardware):

 - Build CONFIG_SCSI_SNIC=y (built-in)

 - Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline

 - Boot with a PCI device matching the snic driver (e.g. QEMU edu device,
   PCI ID 0x1234:0x11e8, temporarily added to the driver's PCI ID table)

Before the fix:

  # /sys/class/scsi_host/ contains a zombie host0:
  $ cat /sys/class/scsi_host/host0/proc_name
  snic_scsi
  $ cat /sys/class/scsi_host/host0/state
  running
  # ata_piix gets host1, host2 (host0 stuck):
  scsi host1: ata_piix
  scsi host2: ata_piix

After the fix:

  # host0 is properly freed and reused by ata_piix:
  scsi host0: ata_piix
  scsi host1: ata_piix
  # No zombie host in /sys/class/scsi_host/

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Acked-by: Narsimhulu Musini <nmusini@cisco.com>
Link: https://patch.msgid.link/20260727073438.209673-1-chenchangcheng@kylinos.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/snic/snic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c
index 1c24517e4e6501..912f9f15dddc38 100644
--- a/drivers/scsi/snic/snic_main.c
+++ b/drivers/scsi/snic/snic_main.c
@@ -305,6 +305,7 @@ snic_add_host(struct Scsi_Host *shost, struct pci_dev *pdev)
 	if (!shost->work_q) {
 		SNIC_HOST_ERR(shost, "Failed to Create ScsiHost wq.\n");
 
+		scsi_remove_host(shost);
 		ret = -ENOMEM;
 	}
 

From c3d7738b2665a6dab47bd72c29a87ffd38c33de5 Mon Sep 17 00:00:00 2001
From: Jenson Johnathon Reggentin <mail@jregg.de>
Date: Wed, 19 Aug 2026 21:23:59 +0200
Subject: [PATCH 0455/1982] docs: block: fix dead http link in blk-mq.rst

[ Upstream commit b40a680ea4efe4ef2addada63e304a94d19500d1 ]

The current link http://kernel.dk/blk-mq.pdf leads to a 404 error page.
https://www.kernel.dk/blk-mq.pdf leads to the correct document.

v2 to add the missing www. prefix in the actual file change.

Signed-off-by: Jenson Johnathon Reggentin <mail@jregg.de>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260819192422.42189-1-mail@jregg.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/block/blk-mq.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/block/blk-mq.rst b/Documentation/block/blk-mq.rst
index fc06761b6ea906..2798761efe0d62 100644
--- a/Documentation/block/blk-mq.rst
+++ b/Documentation/block/blk-mq.rst
@@ -139,7 +139,7 @@ completed.
 Further reading
 ---------------
 
-- `Linux Block IO: Introducing Multi-queue SSD Access on Multi-core Systems <http://kernel.dk/blk-mq.pdf>`_
+- `Linux Block IO: Introducing Multi-queue SSD Access on Multi-core Systems <https://www.kernel.dk/blk-mq.pdf>`_
 
 - `NOOP scheduler <https://en.wikipedia.org/wiki/Noop_scheduler>`_
 

From 855236abde29727de86a39fa7b2371098f166f6b Mon Sep 17 00:00:00 2001
From: Shiji Yang <yangshiji66@outlook.com>
Date: Wed, 19 Aug 2026 21:07:07 +0800
Subject: [PATCH 0456/1982] net: ethernet: mtk_wed: increase WED v2 WDMA
 RESV_BUFF to 0x80

[ Upstream commit c0ef04232f9fac083c3d8a77ce58ba32243e6734 ]

Change WDMA RESV_BUFF from 0x40 to 0x80 to avoid CDM TX FIFO overflow.
Without this patch mt7986 and mt7981 may have WDMA TX hang issue. This
patch was pulled from mtk-openwrt-feeds GPL open source project.

Link: https://github.com/mediatek/mtk-openwrt-feeds/commit/07c87502e854b68b48544d101b6fe17ec059b97b
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/OSZPR01MB779537889255E2F606E47EABBCA52@OSZPR01MB7795.jpnprd01.prod.outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mediatek/mtk_wed.c      | 5 +++++
 drivers/net/ethernet/mediatek/mtk_wed_regs.h | 1 +
 2 files changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
index 1ed1f88dd7f8bc..fdb487e5d46e16 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -2071,6 +2071,11 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
 		wdma_set(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
 	}
 
+	if (mtk_wed_is_v2(dev->hw))
+		wdma_m32(dev, MTK_WDMA_GLO_CFG,
+			 MTK_WDMA_GLO_CFG_RESV_BUFF,
+			 FIELD_PREP(MTK_WDMA_GLO_CFG_RESV_BUFF, 0x80));
+
 	wed_set(dev, MTK_WED_GLO_CFG,
 		MTK_WED_GLO_CFG_TX_DMA_EN |
 		MTK_WED_GLO_CFG_RX_DMA_EN);
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_regs.h b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
index c71190924816c5..e5f83100ded522 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
@@ -433,6 +433,7 @@ struct mtk_wdma_desc {
 #define MTK_WDMA_GLO_CFG_TX_DMA_BUSY			BIT(1)
 #define MTK_WDMA_GLO_CFG_RX_DMA_EN			BIT(2)
 #define MTK_WDMA_GLO_CFG_RX_DMA_BUSY			BIT(3)
+#define MTK_WDMA_GLO_CFG_RESV_BUFF			GENMASK(23, 16)
 #define MTK_WDMA_GLO_CFG_RX_INFO3_PRERES		BIT(26)
 #define MTK_WDMA_GLO_CFG_RX_INFO2_PRERES		BIT(27)
 #define MTK_WDMA_GLO_CFG_RX_INFO1_PRERES		BIT(28)

From 582a89109ad98566d54e913d78bdca9f526a7b4f Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 22 Aug 2026 12:03:15 +0200
Subject: [PATCH 0457/1982] fbcon: Fix KASAN slab-out-of-bounds Read in
 fbcon_prepare_logo

[ Upstream commit 94e6a058b16820e02f25e1221a4c4e713ba23550 ]

Ensure the logo will not exceed the screen size, which then should
fix a reported KASAN: slab-out-of-bounds Read in fbcon_prepare_logo.

Reported-by: syzbot+0c815b25cdb3678e7083@syzkaller.appspotmail.com
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/core/fbcon.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 532522c2aed053..903823c9ce5672 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -600,6 +600,13 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
 		erase &= ~0x400;
 	logo_height = fb_prepare_logo(info, par->rotate);
 	logo_lines = DIV_ROUND_UP(logo_height, vc->vc_font.height);
+	logo_lines = min(logo_lines, rows);
+	logo_lines = min(logo_lines, new_rows - 1);
+	if (logo_lines <= 0) {
+		logo_lines = 0;
+		logo_shown = FBCON_LOGO_DONTSHOW;
+		return;
+	}
 	q = (unsigned short *) (vc->vc_origin +
 				vc->vc_size_row * rows);
 	step = logo_lines * cols;

From 14222a8d56295659a6ab0b1d925ae0e15d9f5595 Mon Sep 17 00:00:00 2001
From: Sumeet Pawnikar <sumeet4linux@gmail.com>
Date: Sat, 22 Aug 2026 15:16:57 +0530
Subject: [PATCH 0458/1982] powercap: intel_rapl: Fix kernel panic during PMU
 unbind

[ Upstream commit 916b61abba586d950a4d8264e2841cc5ccfa4df1 ]

rapl_package_add_pmu() fails internally at perf_pmu_register(),
and rapl_pmu_update() leaves the global rapl_pmu.pmu structure
zero-initialized via memset and returns an error. But any
previously probed packages retain has_pmu = true.

When the driver is subsequently unbound or removed,
rapl_package_remove_pmu_locked() sees has_pmu == true and
unconditionally calls perf_pmu_unregister(&rapl_pmu.pmu) on the
zeroed-out structure. This attempts a list_del_rcu() on a NULL
list head, immediately causing a kernel panic.

Fix this by checking if the PMU is actually registered before
attempting to unregister it.

Signed-off-by: Sumeet Pawnikar <sumeet4linux@gmail.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
[ rjw: Added empty line after the new conditional ]
Link: https://patch.msgid.link/20260822094657.12489-1-sumeet4linux@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/powercap/intel_rapl_common.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c
index f08ac99f5e55e9..977c4c90923d5a 100644
--- a/drivers/powercap/intel_rapl_common.c
+++ b/drivers/powercap/intel_rapl_common.c
@@ -2106,7 +2106,9 @@ void rapl_package_remove_pmu(struct rapl_package *rp)
 			return;
 	}
 
-	perf_pmu_unregister(&rapl_pmu.pmu);
+	if (rapl_pmu.registered)
+		perf_pmu_unregister(&rapl_pmu.pmu);
+
 	memset(&rapl_pmu, 0, sizeof(struct rapl_pmu));
 }
 EXPORT_SYMBOL_GPL(rapl_package_remove_pmu);

From d1687e52368c510ea984ce9e384dd3ead5e3f637 Mon Sep 17 00:00:00 2001
From: Md Rabbani <rabbanyhmm@gmail.com>
Date: Fri, 21 Aug 2026 11:57:18 +0600
Subject: [PATCH 0459/1982] net: stmmac: fix device node reference leaks in
 stmmac_mtl_setup()

[ Upstream commit 317fe168f4c0fc30e5c375c22d9c8911940aea9b ]

In stmmac_mtl_setup(), q_node is shared across the RX and TX queue
parsing loops. When the RX queue loop breaks early because the number
of parsed queues reaches plat->rx_queues_to_use, q_node retains an
acquired reference count. If the error check passes
(queue == plat->rx_queues_to_use), execution proceeds directly to the
TX queue loop, where of_get_next_child() immediately overwrites q_node
with the first TX child, permanently leaking the retained RX child
device node reference.

Switch both loops to for_each_child_of_node_scoped() so child node
references are automatically dropped upon loop exit or early break,
and remove the now-unnecessary function-scoped q_node variable and
its manual of_node_put() at the exit label.

Signed-off-by: Md Rabbani <rabbanyhmm@gmail.com>
Link: https://patch.msgid.link/20260821055718.57-1-rabbanyhmm@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 0cb51935c40560..ceb913a3a6c696 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -131,7 +131,6 @@ static struct stmmac_axi *stmmac_axi_setup(struct platform_device *pdev)
 static int stmmac_mtl_setup(struct platform_device *pdev,
 			    struct plat_stmmacenet_data *plat)
 {
-	struct device_node *q_node;
 	struct device_node *rx_node;
 	struct device_node *tx_node;
 	u8 queue = 0;
@@ -174,7 +173,7 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 		plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
 
 	/* Processing individual RX queue config */
-	for_each_child_of_node(rx_node, q_node) {
+	for_each_child_of_node_scoped(rx_node, q_node) {
 		if (queue >= plat->rx_queues_to_use)
 			break;
 
@@ -237,7 +236,7 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 	queue = 0;
 
 	/* Processing individual TX queue config */
-	for_each_child_of_node(tx_node, q_node) {
+	for_each_child_of_node_scoped(tx_node, q_node) {
 		if (queue >= plat->tx_queues_to_use)
 			break;
 
@@ -290,7 +289,6 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 out:
 	of_node_put(rx_node);
 	of_node_put(tx_node);
-	of_node_put(q_node);
 
 	return ret;
 }

From 74460c60c40e927a77018bd27785227f26693833 Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Mon, 24 Aug 2026 20:37:52 +0800
Subject: [PATCH 0460/1982] ALSA: hda/realtek: Add quirk for Lenovo IdeaPad
 Slim 3 15ABR8

[ Upstream commit be79a45e2ec289eb9fad519e8f5a3d4fc3789dd0 ]

The internal microphone on Lenovo IdeaPad Slim 3 15ABR8 (subsystem
17aa:3862) exhibits severe distortion at default gain levels. The
Capture Volume is fixed at 63 (max) and cannot be lowered without
explicit userspace intervention. The existing fixup
ALC269_FIXUP_LIMIT_INT_MIC_BOOST limits the gain range and resolves
the issue.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221891
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260824123752.525173-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 8196235c31d2b6..bc87062f86da77 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7515,6 +7515,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3855, "Legion 7 16ITHG6", ALC287_FIXUP_LEGION_16ITHG6),
+	SND_PCI_QUIRK(0x17aa, 0x3862, "Lenovo IdeaPad Slim 3 15ABR8", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x3865, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3866, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),

From ce5368025a427efebc16cba9626cd3fde0f6d4c0 Mon Sep 17 00:00:00 2001
From: Jimmy Zuber <jamz@amazon.com>
Date: Mon, 24 Aug 2026 14:30:51 +0000
Subject: [PATCH 0461/1982] fuse: zero the partial EOF page when extending a
 file

[ Upstream commit 34b5c4a6e4fb9dbb3f9d87f3b0fb0372105c8302 ]

Extending a fuse file past a non-page-aligned EOF does not zero the tail of
the old last page.  When that page is cached and has been mmap-dirtied beyond
the old EOF, the now in-bounds tail is served to later reads as stale data
rather than zeros, which violates POSIX file-extension semantics.

Some file systems get this zeroing automatically at writeback time
(block_write_full_folio() / iomap_writeback_handle_eof() zero the tail of the
folio straddling i_size).  A non-writeback caching fuse file system uses neither
path, so it has to zero the tail itself from the size-extending paths, like
XFS (xfs_file_write_zero_eof()) and ext4 (ext4_block_zero_eof()) do.

Call truncate_pagecache_range() over the newly-exposed range up front from the
three paths that extend a file, before the new size is published:

  - a buffered write whose position is past the old EOF (fuse_perform_write());
  - a size-extending setattr/truncate (fuse_do_setattr());
  - a size-extending fallocate (fuse_file_fallocate()).

This unmaps the stale mappings and zeroes the partial tail of the old EOF
folio, so a later read returns zeros.  Truncating [old EOF, write start) before
a buffered write keeps the dropped range disjoint from the written data, so a
write that lands inside the old EOF folio is preserved.

writeback_cache connections are unaffected, as their writes go through
iomap_file_buffered_write(), which zeroes post-EOF folios.  The bug is
observable on a non-writeback_cache server that returns FOPEN_KEEP_CACHE on
writable files (without FOPEN_DIRECT_IO), and is caught by the new
write_extend_eof fuse selftest.

Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/dir.c  | 3 +++
 fs/fuse/file.c | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index a013fad843b2cd..9e20bc9dbdac44 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -2095,6 +2095,9 @@ int fuse_do_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 	 */
 	if ((is_truncate || !is_wb) &&
 	    S_ISREG(inode->i_mode) && oldsize != outarg.attr.size) {
+		if (outarg.attr.size > oldsize)
+			truncate_pagecache_range(inode, oldsize,
+						 outarg.attr.size - 1);
 		truncate_pagecache(inode, outarg.attr.size);
 		invalidate_inode_pages2(mapping);
 	}
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 0812eee881519c..a7a3ac5b34f422 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1290,9 +1290,13 @@ static ssize_t fuse_perform_write(struct kiocb *iocb, struct iov_iter *ii)
 	struct fuse_conn *fc = get_fuse_conn(inode);
 	struct fuse_inode *fi = get_fuse_inode(inode);
 	loff_t pos = iocb->ki_pos;
+	loff_t old_size = i_size_read(inode);
 	int err = 0;
 	ssize_t res = 0;
 
+	if (pos > old_size)
+		truncate_pagecache_range(inode, old_size, pos - 1);
+
 	if (inode->i_size < pos + iov_iter_count(ii))
 		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
 
@@ -2952,6 +2956,11 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
 
 	/* we could have extended the file */
 	if (!(mode & FALLOC_FL_KEEP_SIZE)) {
+		loff_t oldsize = i_size_read(inode);
+
+		if (offset + length > oldsize)
+			truncate_pagecache_range(inode, oldsize,
+						 offset + length - 1);
 		if (fuse_write_update_attr(inode, offset + length, length))
 			file_update_time(file);
 	}

From 18f4f406663b4bcffc403c0a7bd6a558c5e8fd6f Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Mon, 24 Aug 2026 21:03:02 +0800
Subject: [PATCH 0462/1982] ASoC: amd: yc: Add DMI entry for Alienware m18 R1
 AMD

[ Upstream commit fd8ed52ecea6b93e23d52cb2758fb4fb4029067f ]

Add DMI entry so the YC machine driver probes on this model and
the internal DMIC works.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221485
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260824130302.553419-1-zhangheng@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
index 666ac5b36e7d62..8e203c034851f3 100644
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -514,6 +514,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17 R5 AMD"),
 		}
 	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Alienware"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m18 R1 AMD"),
+		}
+	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {

From cd95f97f3cd2c34ed9b5bc8b82dd98ffc0b1f3fa Mon Sep 17 00:00:00 2001
From: Vadim Klishko <vadim@cirque.corp-partner.google.com>
Date: Mon, 27 Jul 2026 22:17:18 -0600
Subject: [PATCH 0463/1982] HID: i2c-hid: Add a quirk for a Cirque I2C device.

[ Upstream commit 1c942462c3969b287a86ab6dbb143324289d564e ]

Cirque touchpads with PID D0C1 generate an error when probed
by the I2C HID driver, resulting in no hidraw device created.
Adding I2C_HID_QUIRK_NO_IRQ_AFTER_RESET fixes the issue.

Signed-off-by: Vadim Klishko <vadim@cirque.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h              | 1 +
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5169713539bc38..11f120a5d1b90e 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -333,6 +333,7 @@
 
 #define I2C_VENDOR_ID_CIRQUE           0x0488
 #define I2C_PRODUCT_ID_CIRQUE_1063     0x1063
+#define I2C_PRODUCT_ID_CIRQUE_D0C1     0xD0C1
 
 #define USB_VENDOR_ID_CJTOUCH		0x24b8
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020	0x0020
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 6d407cbed1886e..29c4f624f3c5cf 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -136,6 +136,8 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_BAD_INPUT_SIZE },
 	{ I2C_VENDOR_ID_CIRQUE, I2C_PRODUCT_ID_CIRQUE_1063,
 		I2C_HID_QUIRK_NO_SLEEP_ON_SUSPEND },
+	{ I2C_VENDOR_ID_CIRQUE, I2C_PRODUCT_ID_CIRQUE_D0C1,
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	/*
 	 * Without additional power on command, at least some QTEC devices send garbage
 	 */

From a9b39298d6db729fccd839576ce88b2986a16ea8 Mon Sep 17 00:00:00 2001
From: Dave Carey <carvsdriver@gmail.com>
Date: Thu, 30 Jul 2026 08:43:36 -0400
Subject: [PATCH 0464/1982] HID: multitouch: Fix stale MT slots when contact
 count drops to zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e8e60b6439eed340a611e9d7a5b9bcbd0ef62725 ]

The INGENIC 17EF:6161 touchscreen (Lenovo Yoga Book 9 14IAH10) reports
HID_DG_CONTACTCOUNT=0 in the frame immediately following the last finger
lift rather than omitting the frame entirely.  In mt_touch_report() the
existing code only updates num_expected when contact_count is non-zero,
so a zero contact count on the first packet of a new frame leaves
num_expected at its previous value (e.g. 2 for a two-finger gesture).
The sync check "num_received >= num_expected" then evaluates "0 >= 2"
and never fires, preventing INPUT_MT_DROP_UNUSED from releasing the
stale slots.  Those slots remain active in the kernel MT layer until the
next touch, at which point they are released in a batch alongside the
new contact — causing the userspace event consumer to miss the
intervening finger-up sequence and corrupt its gesture session state.

Fix by resetting num_expected to 0 when contact_count is zero and
num_received is still 0 (i.e., this is the first and only packet of the
frame, not a continuation packet in a multi-packet sequence).  With
num_expected=0 the sync check "0 >= 0" fires immediately, calling
input_mt_sync_frame() which drops the stale slots via
INPUT_MT_DROP_UNUSED.

The num_received==0 guard is critical: continuation packets in a
multi-packet frame arrive after at least one contact has already been
processed (num_received>0), so they are correctly excluded from this
path and the existing multi-packet logic is unaffected.

Signed-off-by: Dave Carey <carvsdriver@gmail.com>
Tested-by: Dave Carey <carvsdriver@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-multitouch.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 2461d84eb0e981..8dd69c6e7edf8b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1332,21 +1332,18 @@ static void mt_touch_report(struct hid_device *hid,
 	 * Includes multi-packet support where subsequent
 	 * packets are sent with zero contactcount.
 	 */
-	if (contact_count >= 0) {
+	if (contact_count > 0)
+		app->num_expected = contact_count;
+	else if (app->num_received == 0 && app->prev_scantime != scantime) {
 		/*
+		 * New multi-report frame:
+		 *
 		 * For Win8 PTPs the first packet (td->num_received == 0) may
 		 * have a contactcount of 0 if there only is a button event.
-		 * We double check that this is not a continuation packet
-		 * of a possible multi-packet frame be checking that the
-		 * timestamp has changed.
+		 *
+		 * Some other devices use a sentinel frame with 0 to release all contacts
 		 */
-		if ((app->quirks & MT_QUIRK_WIN8_PTP_BUTTONS) &&
-		    app->num_received == 0 &&
-		    app->prev_scantime != scantime)
-			app->num_expected = contact_count;
-		/* A non 0 contact count always indicates a first packet */
-		else if (contact_count)
-			app->num_expected = contact_count;
+		app->num_expected = 0;
 	}
 	app->prev_scantime = scantime;
 

From 115270245d39b659b00721b6c14c7d15f53b5183 Mon Sep 17 00:00:00 2001
From: Li Jun <lijun01@kylinos.cn>
Date: Wed, 12 Aug 2026 18:09:14 +0800
Subject: [PATCH 0465/1982] tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume
 is null

[ Upstream commit b4d1adc70471d0752bba674552d19971ed9fa869 ]

if no define CONFIG_TCG_TIS_SPI_CR50 in config,
the add of tpm_tis_spi_resume is null, this cause the tpm chip to
fail to resume.

Signed-off-by: Li Jun <lijun01@kylinos.cn>
Link: https://lore.kernel.org/r/20260812100914.3540149-1-lijun01@kylinos.cn
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_tis_spi.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_spi.h b/drivers/char/tpm/tpm_tis_spi.h
index d0f66f6f193189..ced416ecd92c27 100644
--- a/drivers/char/tpm/tpm_tis_spi.h
+++ b/drivers/char/tpm/tpm_tis_spi.h
@@ -40,8 +40,12 @@ static inline int cr50_spi_probe(struct spi_device *spi)
 }
 #endif
 
-#if defined(CONFIG_PM_SLEEP) && defined(CONFIG_TCG_TIS_SPI_CR50)
-extern int tpm_tis_spi_resume(struct device *dev);
+#if defined(CONFIG_PM_SLEEP)
+	#if defined(CONFIG_TCG_TIS_SPI_CR50)
+		extern int tpm_tis_spi_resume(struct device *dev);
+	#else
+		#define  tpm_tis_spi_resume tpm_tis_resume
+	#endif
 #else
 #define tpm_tis_spi_resume	NULL
 #endif

From f71c9aa7c0d07c9c3a39642fd3c3c6b0cd8a29ce Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sun, 12 Jul 2026 20:32:34 +0200
Subject: [PATCH 0466/1982] tpm: atmel: depend on X86

[ Upstream commit 4bfacee94f309346bef0b598ea091088b9150af9 ]

tpm_atmel probes for the chip at fixed x86 Super-I/O ports (0x4e) with
inb()/outb(), so it only works on x86. TCG_ATMEL nevertheless depends
only on HAS_IOPORT_MAP/HAS_IOPORT, which arm and arm64 also satisfy.
There the probe is useless, and on platforms whose unbacked I/O access
faults it oopses in init_atmel() at boot (e.g. arm/versatile):

  Unable to handle kernel paging request at virtual address fee0004e
  PC is at init_atmel+0x34/0x244

TCG_NSC and TCG_TIS already "depends on X86" (commit 2f592f2a7d74 ("TPM:
NSC and TIS drivers X86 dependency fix")); TCG_ATMEL was missed. Add the
same dependency.

Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260712183234.23125-1-kmehltretter@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/Kconfig | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 8a8f692b60880c..5f672f2c01b04c 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -163,8 +163,7 @@ config TCG_NSC
 
 config TCG_ATMEL
 	tristate "Atmel TPM Interface"
-	depends on HAS_IOPORT_MAP
-	depends on HAS_IOPORT
+	depends on X86
 	help
 	  If you have a TPM security chip from Atmel say Yes and it 
 	  will be accessible from within Linux.  To compile this driver 

From 498f2b22fb4a89dbecd79c4286d99cce98b5dbf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Federico=20Valent=C3=ADn=20Andrade?=
 <fandrade@frba.utn.edu.ar>
Date: Mon, 24 Aug 2026 11:02:11 -0300
Subject: [PATCH 0467/1982] ALSA: usb-audio: Skip mixer creation on M-Audio
 Venom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4c0ec35e011309bd7091053ad5bbc01420967a66 ]

The M-Audio Venom (0763:2084) does not answer any GET_CUR request
of its feature units, hanging up the USB microcontroller and
"responding" with timeouts. So the mixer building lasts around 47
seconds, and the device does not stream at all.

The same GET_CUR requests issued through libusb (with no kernel
driver bound) complete correctly and blazingly fast. So it seems
to only happen during the initial probe.

I defined an explicit composite quirk to bypass the mixer creation,
as it is not needed (the synth already comes with volume controls).

With both this and the device flag applied, the synth works
flawlessly.

Signed-off-by: Federico Valentín Andrade <fandrade@frba.utn.edu.ar>
Link: https://patch.msgid.link/20260824140211.17003-3-fandrade@frba.utn.edu.ar
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks-table.h | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index d783dae1850a0c..061d21da91fbed 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1814,6 +1814,28 @@ YAMAHA_DEVICE(0x7010, "UB99"),
 		}
 	}
 },
+{
+	/*
+	 * M-Audio Venom
+	 *
+	 * The AudioControl interface times out on every GET_CUR request,
+	 * which adds around 47 seconds to the card registration and
+	 * freezes the device, blocking streaming.
+	 * Using an explicit composite quirk to skip the mixer entirely.
+	 */
+	USB_DEVICE_VENDOR_SPEC(0x0763, 0x2084),
+	QUIRK_DRIVER_INFO {
+		.vendor_name = "M-Audio",
+		.product_name = "Venom",
+		QUIRK_DATA_COMPOSITE {
+			{ QUIRK_DATA_IGNORE(0) },
+			{ QUIRK_DATA_STANDARD_AUDIO(1) },
+			{ QUIRK_DATA_STANDARD_AUDIO(2) },
+			{ QUIRK_DATA_STANDARD_MIDI(3) },
+			QUIRK_COMPOSITE_END
+		}
+	}
+},
 
 /* Casio devices */
 {

From d2176dd74e28f61b5b025ff64b443b22d8d2830c Mon Sep 17 00:00:00 2001
From: Mehmet Aysel <mehmet4ysel@gmail.com>
Date: Tue, 25 Aug 2026 12:24:32 +0300
Subject: [PATCH 0468/1982] ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI
 quirk

[ Upstream commit c1a39c228aceebc0ede83781ea906d257e324009 ]

Add matching DMI table entry for the ES83xx machine driver, so the
HUAWEI HVY-WXX9 / M1060 board (MateBook D16 2021, Ryzen 5 4600H) can
successfully probe its ES8316 codec via the acp3x-es83xx machine
driver, consistent with the existing M1010/M1020/M1040 entries for
the same board name.

Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com>
Link: https://patch.msgid.link/20260825092432.56292-2-mehmet4ysel@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c b/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c
index eb5d4a5baef241..b18a8971aec949 100644
--- a/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c
+++ b/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c
@@ -379,6 +379,14 @@ static const struct dmi_system_id acp3x_es83xx_dmi_table[] = {
 		},
 		.driver_data = (void *)(ES83XX_ENABLE_DMIC),
 	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "HUAWEI"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HVY-WXX9"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "M1060"),
+		},
+		.driver_data = (void *)(ES83XX_ENABLE_DMIC),
+	},
 	{}
 };
 

From 1fa62b20936a9021502bc6317c94102282e66827 Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubo.li@clyso.com>
Date: Thu, 23 Jul 2026 14:28:19 +0800
Subject: [PATCH 0469/1982] ceph: do not cache negative dentries for snapped
 directories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit af59562a5b3d34fb3aa7753f2543393578d06dbf ]

When a LOOKUP/LOOKUPSNAP in a snapped directory returns ENOENT
without a trace, ceph_finish_lookup() creates a negative dentry
via d_add(dentry, NULL).  For live directories this is fine — the
dentry naturally expires.  But for snapped directories,
ceph_d_revalidate() unconditionally trusts all cached dentries
(valid = 1), so a negative dentry created by a transient error
persists forever, hiding entries that genuinely exist in the
snapshot.

Only cache negative dentries for live (non-snapshotted) parent
directories.  For snapped parents, skip the negative dentry so
that VFS retries the lookup on the next access.  Since the
conditions that trigger a negative dentry (MDS transient error,
local ENOENT shortcut, or MDS null dentry lease) are all rare in
snapped directories, the performance impact of this change is
negligible.

Link: https://tracker.ceph.com/issues/78529
Reported-by: Andras Pataki <apataki@flatironinstitute.org>
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/dir.c   | 10 ++++++++--
 fs/ceph/inode.c |  3 ++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 24abe4dbf774d0..a253286214feee 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -774,8 +774,13 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req,
 				d_drop(dentry);
 				err = -ENOENT;
 			} else {
-				if (d_unhashed(dentry))
-					d_add(dentry, NULL);
+				if (d_unhashed(dentry)) {
+					struct inode *parent =
+						d_inode(dentry->d_parent);
+					if (!parent ||
+					    ceph_snap(parent) == CEPH_NOSNAP)
+						d_add(dentry, NULL);
+				}
 			}
 		}
 	}
@@ -840,6 +845,7 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry,
 			    dentry->d_name.len) &&
 		    !is_root_ceph_dentry(dir, dentry) &&
 		    ceph_test_mount_opt(fsc, DCACHE) &&
+		    ceph_snap(dir) == CEPH_NOSNAP &&
 		    __ceph_dir_is_complete(ci) &&
 		    __ceph_caps_issued_mask_metric(ci, CEPH_CAP_FILE_SHARED, 1)) {
 			__ceph_touch_fmode(ci, mdsc, CEPH_FILE_MODE_RD);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index b6c60d787692e1..fddeeb9527fb33 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1783,7 +1783,8 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req)
 				ceph_dir_clear_ordered(dir);
 				d_delete(dn);
 			} else if (have_lease) {
-				if (d_unhashed(dn))
+				if (d_unhashed(dn) &&
+				    ceph_snap(dir) == CEPH_NOSNAP)
 					d_add(dn, NULL);
 			}
 

From 2aeb9dce7d76c9edab40820bb1a3aa263290973d Mon Sep 17 00:00:00 2001
From: Bob Song <songxiebing@kylinos.cn>
Date: Wed, 26 Aug 2026 19:53:44 +0800
Subject: [PATCH 0470/1982] ALSA: hda/conexant: Always enable the headset-mic
 pin on plugin

[ Upstream commit 9642a5e843758686e02a7f0d1df9eb0f7f96603c ]

Rename the function to cx_process_headset_detect_plug_type() to reflect
that it only reports the detected plug type, and move the pin control
write into cx_update_headset_mic_vref() so that node 0x19 is always set
to enable the headset mic with the 80% VREF whenever the mic is
present, regardless of the type detection result.

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
Link: https://patch.msgid.link/20260826115344.2128835-1-songxiebing@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/conexant.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index 862fcbe74e4f08..faaabc326f560a 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -213,7 +213,7 @@ static void cx_remove(struct hda_codec *codec)
 	snd_hda_gen_remove(codec);
 }
 
-static void cx_process_headset_plugin(struct hda_codec *codec)
+static void cx_process_headset_detect_plug_type(struct hda_codec *codec)
 {
 	unsigned int val;
 	unsigned int count = 0;
@@ -249,10 +249,12 @@ static void cx_update_headset_mic_vref(struct hda_codec *codec, struct hda_jack_
 	 * Check hp&mic tag to process headset plugin & plugout.
 	 */
 	mic_present = snd_hda_codec_read(codec, 0x19, 0, AC_VERB_GET_PIN_SENSE, 0x0);
-	if (!(mic_present & AC_PINSENSE_PRESENCE)) /* mic plugout */
+	if (!(mic_present & AC_PINSENSE_PRESENCE)) { /* mic plugout */
 		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x20);
-	else
-		cx_process_headset_plugin(codec);
+	} else {
+		cx_process_headset_detect_plug_type(codec);
+		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24);
+	}
 }
 
 static int cx_suspend(struct hda_codec *codec)

From e3b41c907cb3352a1d9594cb64779934ccaf6a2f Mon Sep 17 00:00:00 2001
From: Mehmet Aysel <mehmet4ysel@gmail.com>
Date: Tue, 25 Aug 2026 12:24:31 +0300
Subject: [PATCH 0471/1982] ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk

[ Upstream commit 032bb633e0c34a88b70a4bfc65ebd4e2b510f706 ]

Add DMI match table entry for HUAWEI HVY-WXX9 board, product version
M1060, a MateBook D16 2021 (Ryzen 5 4600H) revision not covered by the
existing M1010/M1020/M1040 entries. This board uses the same
FLAG_AMD_LEGACY / ACP_PCI_DEV_ID configuration as the other HVY-WXX9
variants.

Signed-off-by: Mehmet Aysel <mehmet4ysel@gmail.com>
Link: https://patch.msgid.link/20260825092432.56292-1-mehmet4ysel@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/acp-config.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/sound/soc/amd/acp-config.c b/sound/soc/amd/acp-config.c
index 365209ea53f365..653e8ce946082b 100644
--- a/sound/soc/amd/acp-config.c
+++ b/sound/soc/amd/acp-config.c
@@ -159,6 +159,20 @@ static const struct config_entry config_table[] = {
 			{}
 		},
 	},
+	{
+		.flags = FLAG_AMD_LEGACY,
+		.device = ACP_PCI_DEV_ID,
+		.dmi_table = (const struct dmi_system_id []) {
+			{
+				.matches = {
+					DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "HUAWEI"),
+					DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HVY-WXX9"),
+					DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "M1060"),
+				},
+			},
+			{}
+		},
+	},
 };
 
 static int snd_amd_acp_acpi_find_config(struct pci_dev *pci)

From f08a043321aa8e6d4c32c0df0fe6025b29841414 Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubo.li@clyso.com>
Date: Tue, 14 Jul 2026 14:20:37 +0800
Subject: [PATCH 0472/1982] ceph: fix use-after-dereference of NULL ci in
 __ceph_remove_cap()

[ Upstream commit a354d7eaa1a57f1532c8072a424cc2d339a73cc0 ]

The NULL check for "ci" in __ceph_remove_cap() was dead code because
ci was dereferenced via &ci->netfs.inode before the check, and
cap->session was dereferenced via session->s_mdsc->fsc->client even
earlier.  On a double-remove, both cap->ci and cap->session are set
to NULL by the first call, so the second call would crash before
ever reaching the guard.

Move ci, session, cl, and inode initializations after the NULL check
so that the early-return actually works.

Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 7f4bb62df3defb..91cb305815cbdd 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1141,18 +1141,21 @@ int ceph_is_any_caps(struct inode *inode)
  */
 void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
 {
-	struct ceph_mds_session *session = cap->session;
-	struct ceph_client *cl = session->s_mdsc->fsc->client;
-	struct ceph_inode_info *ci = cap->ci;
-	struct inode *inode = &ci->netfs.inode;
+	struct ceph_mds_session *session;
+	struct ceph_client *cl;
+	struct ceph_inode_info *ci;
+	struct inode *inode;
 	struct ceph_mds_client *mdsc;
 	int removed = 0;
 
 	/* 'ci' being NULL means the remove have already occurred */
-	if (!ci) {
-		doutc(cl, "inode is NULL\n");
+	ci = cap->ci;
+	if (!ci)
 		return;
-	}
+
+	session = cap->session;
+	cl = session->s_mdsc->fsc->client;
+	inode = &ci->netfs.inode;
 
 	lockdep_assert_held(&ci->i_ceph_lock);
 

From 6938950bd00aa1e8956d62fa94bcca44890b59a9 Mon Sep 17 00:00:00 2001
From: Fernando Fernandez Mancera <fmancera@suse.de>
Date: Mon, 1 Jun 2026 21:30:46 +0200
Subject: [PATCH 0473/1982] netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for
 protocol fallbacks

[ Upstream commit 1f0391aea883e99d402d0f77ba3530e4e879350d ]

Replace WARN_ON calls with DEBUG_NET_WARN_ON_ONCE in the default switch
blocks of nf_tproxy_get_sock_v4 and v6. Unsupported transport protocols
are already safely handled by returning a NULL socket pointer. This
prevents unnecessary system panics when panic_on_warn=1 is enabled in
production systems.

Link: https://patch.msgid.link/cover.1786968834.git.zhilinz@nebusec.ai/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +-
 net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c
index 041c3f37f237b9..5eab7a2dc8ef2f 100644
--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c
+++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c
@@ -137,7 +137,7 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 		}
 		break;
 	default:
-		WARN_ON(1);
+		DEBUG_NET_WARN_ON_ONCE(1);
 		sk = NULL;
 	}
 
diff --git a/net/ipv6/netfilter/nf_tproxy_ipv6.c b/net/ipv6/netfilter/nf_tproxy_ipv6.c
index b2f59ed9d7cc0b..12ec36a6be2e11 100644
--- a/net/ipv6/netfilter/nf_tproxy_ipv6.c
+++ b/net/ipv6/netfilter/nf_tproxy_ipv6.c
@@ -136,7 +136,7 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 		}
 		break;
 	default:
-		WARN_ON(1);
+		DEBUG_NET_WARN_ON_ONCE(1);
 		sk = NULL;
 	}
 

From aa8d2e53bee52b7bd4b77ab26321125180bf7d21 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sat, 11 Jul 2026 23:20:41 +0900
Subject: [PATCH 0474/1982] ksmbd: handle allocated range queries on dense
 files

[ Upstream commit 350684e0498512d06963858b810101f58563810b ]

FSCTL_QUERY_ALLOCATED_RANGES currently relies on SEEK_DATA and SEEK_HOLE
for every file. That works for files with holes, but it is not a good
match for dense files.

A zeroed range in a dense file may be represented as an unwritten extent
and skipped by SEEK_DATA. The server can then return no allocated ranges
even though the file should still be treated as allocated from the
protocol point of view.

For dense files, report the requested range clipped to EOF as allocated
instead of probing holes. Keep using SEEK_DATA and SEEK_HOLE for files
marked with FILE_ATTRIBUTE_SPARSE_FILE, and wait for writeback before
probing so punch-hole updates are visible to the filesystem seek
implementation.

This fixes the case where a query after zeroing data could return no
ranges for a dense file.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/vfs.c | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index f894092901bc55..cd0d3c13da3e72 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1034,7 +1034,8 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,
 {
 	struct file *f = fp->filp;
 	struct inode *inode = file_inode(fp->filp);
-	loff_t maxbytes = (u64)inode->i_sb->s_maxbytes, end;
+	loff_t maxbytes = (u64)inode->i_sb->s_maxbytes, end, query_start;
+	loff_t query_length, size;
 	loff_t extent_start, extent_end;
 	int ret = 0;
 
@@ -1050,11 +1051,33 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,
 	if (length > maxbytes || (maxbytes - length) < start)
 		length = maxbytes - start;
 
-	if (start + length > inode->i_size)
-		length = inode->i_size - start;
+	size = i_size_read(inode);
+	if (start >= size)
+		return 0;
+
+	if (!length)
+		return 0;
+
+	if (start + length > size)
+		length = size - start;
 
 	*out_count = 0;
+	query_start = start;
+	query_length = length;
 	end = start + length;
+	if (!(fp->f_ci->m_fattr & FILE_ATTRIBUTE_SPARSE_FILE_LE)) {
+		ranges[0].file_offset = cpu_to_le64(query_start);
+		ranges[0].length = cpu_to_le64(query_length);
+		*out_count = 1;
+		return 0;
+	}
+
+	if (start < end) {
+		ret = file_write_and_wait_range(f, start, end - 1);
+		if (ret)
+			return ret;
+	}
+
 	while (start < end && *out_count < in_count) {
 		extent_start = vfs_llseek(f, start, SEEK_DATA);
 		if (extent_start < 0) {

From 3f89968d6aee399addd1fda4ec546753b8ff7c2e Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Tue, 1 Sep 2026 22:55:42 +0100
Subject: [PATCH 0475/1982] regmap: irq: Free the irqdomain we create

[ Upstream commit 2e42cade8ff1ff579e77976d9869db4df1feaf74 ]

When domain support was added to regmap-irq it was not possible to
remove domains, this was added later by 8ee99ada293b (irqdomain: Support
removal of IRQ domains.).  We did update the main removal path to free
the domain but forgot the error unwinding case during creation that is
now in regmap_add_irq_chip_fwnode() after some code motion, meaning that
errors during instantiation result in an unused irqchip being left
hanging around.  Add the missing irq_remove_domain() call where the
comment says it should be.

Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Reported-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260901-regmap-irq-deallocate-domain-v1-1-4bfed4aff559@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6112d942499be2..8c297156ea402e 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -941,7 +941,7 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle *fwnode,
 	return 0;
 
 err_domain:
-	/* Should really dispose of the domain but... */
+	irq_domain_remove(d->domain);
 err_mutex:
 	mutex_destroy(&d->lock);
 	lockdep_unregister_key(&d->lock_key);

From aac2603cd82977601e3e6fad71e9b3353dc85c57 Mon Sep 17 00:00:00 2001
From: Youth Cao <cocoh2os08@gmail.com>
Date: Fri, 4 Sep 2026 00:14:44 +0800
Subject: [PATCH 0476/1982] HID: i2c-hid: Add i2c-hid-quirk-bad-input-size
 quirk for 0911:5288 device

[ Upstream commit 58d97b45f3f43af0afd9c74e8480d22d36fd3f72 ]

I have recently acquired a cheap Apollo Lake-based laptop that uses a
Hynitron CST128-A touchpad controller. While booting from a Debian LiveCD,
the kernel log is flooded with the following error (though the touchpad
works well):

  i2c_hid_acpi i2c-ALPS0001:00: i2c_hid_get_input: incomplete report (27/42405)

The CST128-A was identified via ACPI as ALPS0001:00, and the I2C HID
device ID (0911:5288) was shared with the Hantick 5288.

Add the I2C_HID_QUIRK_BAD_INPUT_SIZE quirk option to the existing Hantick
5288 quirk entry to suppress the kernel log flood.

Signed-off-by: Youth Cao <cocoh2os08@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 29c4f624f3c5cf..e5a4c7deba5027 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -123,7 +123,7 @@ static const struct i2c_hid_quirks {
 	__u32 quirks;
 } i2c_hid_quirks[] = {
 	{ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
-		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET | I2C_HID_QUIRK_BAD_INPUT_SIZE },
 	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,

From 0b034e308564cd5b690fb83d912787501486ab78 Mon Sep 17 00:00:00 2001
From: Oleg Keri <okerixx@gmail.com>
Date: Thu, 10 Sep 2026 08:30:50 +0200
Subject: [PATCH 0477/1982] HID: i2c-hid: add reset quirk for Lenovo Yoga Slim
 7x Gen 11 keyboard

[ Upstream commit 39e8e085710a2d36d9ceade11739fb7b87f5aeb0 ]

The ITE controller behind the keyboard of the Lenovo Yoga Slim 7x Gen 11
(048d:83db) carries out a reset but never raises the interrupt that
acknowledges it. i2c_hid_finish_hwreset() therefore waits out its full
one second timeout and logs "device did not ack reset within 1000 ms" on
every probe and every resume, before the keyboard comes up regardless.

Set I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for it, as is already done for
several other ITE parts, so the reset is followed by a fixed 100 ms sleep
instead.

Signed-off-by: Oleg Keri <okerixx@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h              | 1 +
 drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 11f120a5d1b90e..a10b4ae0e3d8e8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -737,6 +737,7 @@
 #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720	0x837a
 #define USB_DEVICE_ID_ITE_LENOVO_YOGA900	0x8396
 #define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD	0x8987
+#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD	0x83db
 #define USB_DEVICE_ID_ITE8595		0x8595
 #define USB_DEVICE_ID_ITE_MEDION_E1239T	0xce50
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index e5a4c7deba5027..62b3dd0390a7c5 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -126,6 +126,8 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET | I2C_HID_QUIRK_BAD_INPUT_SIZE },
 	{ I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+	{ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_G11_KEYBOARD,
+		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,

From bd351a43669053363d2f4a9263e962ba86e7a713 Mon Sep 17 00:00:00 2001
From: Berke Durak <berke.durak@gmail.com>
Date: Mon, 7 Sep 2026 11:47:19 -0700
Subject: [PATCH 0478/1982] HID: elecom: Add support for ELECOM M-XT4DRBK
 (018E)

[ Upstream commit f3c2b266b8fd7cf816d36168d19f67e716f2c080 ]

The 2025 revision of the left-handed EX-G wireless trackball
(M-XT4DRBK-G) reports USB ID 056e:018e instead of 056e:00fd. Its report
descriptor declares an 8-bit button field (Report Count 8) but only five
usages (Usage Maximum 5), so the sixth (Fn) button ends up as a
duplicate of button 5 and is unusable.

The report descriptor has the same layout as the M-XT3DRBK 018C
(button usage maximum at offset 16, button report count at 22, button
report size at 24, padding report size at 30), so reuse that fixup.

Rename the existing M_XT4DRBK define to M_XT4DRBK_00FD to match the
convention used for the other EX-G revisions.

Tested on a Raspberry Pi 5 with the same fixup in an
out-of-tree module on 6.12 (6.12.96+rpt-rpi-2712);
all six buttons are reported after the fix, and they
work (tested with xev as well).

Report descriptor as sent by the device, pre-fix (056e:018e,
215 bytes):

 05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01
 29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00
 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10
 95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75
 08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75
 08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01
 85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0
 05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A
 3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85
 03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95
 01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95
 01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0
 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00
 75 08 95 07 B1 02 C0

Assisted-by: LLM
Signed-off-by: Berke Durak <berke.durak@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-elecom.c | 6 ++++--
 drivers/hid/hid-ids.h    | 3 ++-
 drivers/hid/hid-quirks.c | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index 37d88ce57f6718..d21ead40bb076b 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -79,7 +79,7 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 	case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
 	case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
 	case USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC:
-	case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+	case USB_DEVICE_ID_ELECOM_M_XT4DRBK_00FD:
 		/*
 		 * Report descriptor format:
 		 * 12: button bit count
@@ -104,6 +104,7 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8);
 		break;
 	case USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C:
+	case USB_DEVICE_ID_ELECOM_M_XT4DRBK_018E:
 		/*
 		 * Report descriptor format:
 		 * 22: button bit count
@@ -148,7 +149,8 @@ static const struct hid_device_id elecom_devices[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK_00FD) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK_018E) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT2DRBK) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a10b4ae0e3d8e8..ca5c62f29aebe6 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -466,7 +466,8 @@
 #define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F	0x018f
 #define USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC	0x00fc
 #define USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C	0x018c
-#define USB_DEVICE_ID_ELECOM_M_XT4DRBK	0x00fd
+#define USB_DEVICE_ID_ELECOM_M_XT4DRBK_00FD	0x00fd
+#define USB_DEVICE_ID_ELECOM_M_XT4DRBK_018E	0x018e
 #define USB_DEVICE_ID_ELECOM_M_DT1URBK	0x00fe
 #define USB_DEVICE_ID_ELECOM_M_DT1DRBK	0x00ff
 #define USB_DEVICE_ID_ELECOM_M_DT2DRBK	0x018d
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 8d2ac32c5ac123..debd00ed9062aa 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -431,7 +431,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_018C) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK_00FD) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK_018E) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT2DRBK) },

From 7076e590e98f748239ca39043ecaee7d88813099 Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Tue, 8 Sep 2026 16:34:34 +0200
Subject: [PATCH 0479/1982] nvme-fc: do not warn on controller removal race

[ Upstream commit 62b70e6c87121ae5b79ca20c3a5b005590336ec5 ]

In nvme_fc_reconnect_or_delete(), the system attempts to remove
the controller when reconnect limits are reached by calling
nvme_delete_ctrl(). This call is currently wrapped in a WARN_ON().

If a user concurrently deletes the controller via sysfs, the
controller's state may have already transitioned out of the
CONNECTING state. When this happens, nvme_delete_ctrl() correctly
rejects the operation and returns -EBUSY. Because of the WARN_ON()
wrapper, this race condition triggers an unnecessary kernel warning
stack trace.

Remove the WARN_ON() macro around nvme_delete_ctrl();
this allows the system to safely ignore the -EBUSY return value
if the controller is already being deleted.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/fc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index fc7aa3fc6c2b5c..186d1beecf32b2 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3334,7 +3334,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
 				ctrl->cnum, min_t(int, portptr->dev_loss_tmo,
 					(ctrl->ctrl.opts->max_reconnects *
 					 ctrl->ctrl.opts->reconnect_delay)));
-		WARN_ON(nvme_delete_ctrl(&ctrl->ctrl));
+		nvme_delete_ctrl(&ctrl->ctrl);
 	}
 }
 

From 7e2fa3109c1fba7556ac1c3a2e08b25e906f6185 Mon Sep 17 00:00:00 2001
From: Dmitry Antipov <dmantipov@yandex.ru>
Date: Wed, 2 Sep 2026 12:45:49 +0300
Subject: [PATCH 0480/1982] HID: roccat: fix locking in roccat_connect() and
 roccat_disconnect()

[ Upstream commit d76994443eed0af297cb82bd038ae9d76327ef90 ]

Extend critical section in roccat_connect() to ensure that partially
initialized 'struct roccat_device' is never exposed in 'devices' list,
and do the same in roccat_disconnect() to avoid racy 'devices' access
against roccat_release().

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-roccat.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index e54b6a8a92ef77..77042c7edf7655 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -344,8 +344,6 @@ int roccat_connect(const struct class *klass, struct hid_device *hid, int report
 		return temp;
 	}
 
-	mutex_unlock(&devices_lock);
-
 	init_waitqueue_head(&device->wait);
 	INIT_LIST_HEAD(&device->readers);
 	mutex_init(&device->readers_lock);
@@ -356,6 +354,7 @@ int roccat_connect(const struct class *klass, struct hid_device *hid, int report
 	device->cbuf_end = 0;
 	device->report_size = report_size;
 
+	mutex_unlock(&devices_lock);
 	return minor;
 }
 EXPORT_SYMBOL_GPL(roccat_connect);
@@ -369,15 +368,12 @@ void roccat_disconnect(int minor)
 
 	mutex_lock(&devices_lock);
 	device = devices[minor];
-	mutex_unlock(&devices_lock);
 
 	device->exist = 0; /* TODO exist maybe not needed */
 
 	device_destroy(device->dev->class, MKDEV(roccat_major, minor));
 
-	mutex_lock(&devices_lock);
 	devices[minor] = NULL;
-	mutex_unlock(&devices_lock);
 
 	if (device->open) {
 		hid_hw_close(device->hid);
@@ -385,6 +381,8 @@ void roccat_disconnect(int minor)
 	} else {
 		roccat_free_device(device);
 	}
+
+	mutex_unlock(&devices_lock);
 }
 EXPORT_SYMBOL_GPL(roccat_disconnect);
 

From 2c7a144e9e077bc5aad3059adc38770f0fc289a6 Mon Sep 17 00:00:00 2001
From: "Ewan D. Milne" <emilne@redhat.com>
Date: Tue, 15 Sep 2026 13:38:00 -0400
Subject: [PATCH 0481/1982] scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC
 Symmetrix

[ Upstream commit f06a44e235ef188689ba23ffc72e9e89b10951a9 ]

EMC Symmetrix returns an error on MODE SENSE for page 0Ah subpage 05h
because it does not implement the SBC-5 I/O hints.  These commands began to
be sent as a result of commit 4f53138fffc2 ("scsi: sd: Translate data
lifetime information").  Add BLIST_SKIP_IO_HINTS to avoid sending these
commands because in large configurations the failed commands are displacing
other useful information in internal error logs.

Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Link: https://patch.msgid.link/20260915173800.39117-1-emilne@redhat.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_devinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index c51146882a1fa9..a438e510f2caed 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -161,7 +161,7 @@ static struct {
 	{"DGC", "DISK", NULL, BLIST_SPARSELUN},	/* EMC CLARiiON, no storage on LUN 0 */
 	{"EMC",  "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
 	{"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN |
-	 BLIST_REPORTLUN2 | BLIST_RETRY_ITF},
+	 BLIST_REPORTLUN2 | BLIST_RETRY_ITF | BLIST_SKIP_IO_HINTS},
 	{"EMULEX", "MD21/S2     ESDI", NULL, BLIST_SINGLELUN},
 	{"easyRAID", "16P", NULL, BLIST_NOREPORTLUN},
 	{"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN},

From 88b0f77c612654475dfb9d4b7b2e3795fb4f8d5b Mon Sep 17 00:00:00 2001
From: Seiji Adachi <seiji_adachi@yahoo.co.jp>
Date: Thu, 17 Sep 2026 22:18:51 +0900
Subject: [PATCH 0482/1982] ASoC: amd: yc: Add Lenovo ThinkPad E16 Gen 2 (21JN)
 to quirks

[ Upstream commit 4cae4ca34992d210d115e8e891f1e88c9df5f24c ]

Signed-off-by: Seiji Adachi <seiji_adachi@yahoo.co.jp>
Link: https://patch.msgid.link/20260917131851.2122144-1-seiji_adachi@yahoo.co.jp
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
index 8e203c034851f3..507c07efc069b6 100644
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -234,6 +234,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "21J6"),
 		}
 	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "21JN"),
+		}
+	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {

From 257610f2b6d8bfb7f4057f70df5fc7f75f9b7342 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Mon, 14 Sep 2026 17:44:06 -0700
Subject: [PATCH 0483/1982] gpio: mvebu: keep resume masks within the irqchip
 cache

[ Upstream commit 02af7eac17bc62a72335c1fc8c4af4471654f6cc ]

mvebu_gpio_resume() writes the edge/level mask registers saved at
suspend time straight back to hardware, bypassing the irqchip's
mask_cache_priv.  genirq skips mask_irq() for a line it already
considers masked, so restoring a bit in hardware that genirq thinks
is still masked leaves that line unmasked behind genirq's back.  An
asserted level line then has nobody to ack it, and the moment
interrupts are re-enabled the chained handler storms, hanging resume.

AND the restored mask values with the matching irqchip mask cache so
only lines genirq currently considers unmasked are unmasked again.
Read the caches under gc->lock to keep them consistent with the
mask/unmask handlers.

Tested on Helios4 (armhf): 5 suspend cycles woken by magic packet,
no hang; mvebu_gpio_resume() returns in 6 usecs.

Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260915004406.115230-1-rosenp@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mvebu.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 39a7ad6585f251..c613d74ed48d0e 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1006,6 +1006,8 @@ static int mvebu_gpio_suspend(struct platform_device *pdev, pm_message_t state)
 static int mvebu_gpio_resume(struct platform_device *pdev)
 {
 	struct mvebu_gpio_chip *mvchip = platform_get_drvdata(pdev);
+	u32 edge_cache = ~0U, level_cache = ~0U;
+	unsigned long flags;
 	int i;
 
 	regmap_write(mvchip->regs, GPIO_OUT_OFF + mvchip->offset,
@@ -1017,32 +1019,51 @@ static int mvebu_gpio_resume(struct platform_device *pdev)
 	regmap_write(mvchip->regs, GPIO_IN_POL_OFF + mvchip->offset,
 		     mvchip->in_pol_reg);
 
+	/*
+	 * genirq skips mask_irq() for a line it already considers masked, so
+	 * unmasking one behind its back leaves an asserted level line that
+	 * nobody masks. Restore only bits the irqchip cache still has set.
+	 *
+	 * Snapshot the caches under the raw spinlock, but release it before
+	 * the regmap writes below: regmap_write() takes a sleepable lock on
+	 * PREEMPT_RT.
+	 */
+	if (mvchip->domain) {
+		struct irq_chip_generic *gc;
+
+		gc = irq_get_domain_generic_chip(mvchip->domain, 0);
+		raw_spin_lock_irqsave(&gc->lock, flags);
+		level_cache = gc->chip_types[0].mask_cache_priv;
+		edge_cache = gc->chip_types[1].mask_cache_priv;
+		raw_spin_unlock_irqrestore(&gc->lock, flags);
+	}
+
 	switch (mvchip->soc_variant) {
 	case MVEBU_GPIO_SOC_VARIANT_ORION:
 	case MVEBU_GPIO_SOC_VARIANT_A8K:
 		regmap_write(mvchip->regs, GPIO_EDGE_MASK_OFF + mvchip->offset,
-			     mvchip->edge_mask_regs[0]);
+			     mvchip->edge_mask_regs[0] & edge_cache);
 		regmap_write(mvchip->regs, GPIO_LEVEL_MASK_OFF + mvchip->offset,
-			     mvchip->level_mask_regs[0]);
+			     mvchip->level_mask_regs[0] & level_cache);
 		break;
 	case MVEBU_GPIO_SOC_VARIANT_MV78200:
 		for (i = 0; i < 2; i++) {
 			regmap_write(mvchip->regs,
 				     GPIO_EDGE_MASK_MV78200_OFF(i),
-				     mvchip->edge_mask_regs[i]);
+				     mvchip->edge_mask_regs[i] & edge_cache);
 			regmap_write(mvchip->regs,
 				     GPIO_LEVEL_MASK_MV78200_OFF(i),
-				     mvchip->level_mask_regs[i]);
+				     mvchip->level_mask_regs[i] & level_cache);
 		}
 		break;
 	case MVEBU_GPIO_SOC_VARIANT_ARMADAXP:
 		for (i = 0; i < 4; i++) {
 			regmap_write(mvchip->regs,
 				     GPIO_EDGE_MASK_ARMADAXP_OFF(i),
-				     mvchip->edge_mask_regs[i]);
+				     mvchip->edge_mask_regs[i] & edge_cache);
 			regmap_write(mvchip->regs,
 				     GPIO_LEVEL_MASK_ARMADAXP_OFF(i),
-				     mvchip->level_mask_regs[i]);
+				     mvchip->level_mask_regs[i] & level_cache);
 		}
 		break;
 	default:

From 43d6e9c812edcd8feebdc07485fe958308f9cfa7 Mon Sep 17 00:00:00 2001
From: Andy Moreton <andy.moreton@amd.com>
Date: Wed, 16 Sep 2026 13:56:41 +0100
Subject: [PATCH 0484/1982] sfc: add X4D PF support

[ Upstream commit 24fedc7a569bce181728f0dd616504bef9f1513b ]

X4D is an X4 controller instance as an IP block in an SoC.
It has the same feature set as X4.

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Reviewed-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260916125641.12238-1-alucerop@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sfc/efx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 112e55b98ed3b6..62df7b6a26fa56 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -903,6 +903,10 @@ static const struct pci_device_id efx_pci_table[] = {
 	 .driver_data = (unsigned long)&efx_x4_nic_type},
 	{PCI_DEVICE(PCI_VENDOR_ID_SOLARFLARE, 0x2c03),  /* X4 PF (FF only) */
 	 .driver_data = (unsigned long)&efx_x4_nic_type},
+	{PCI_DEVICE(PCI_VENDOR_ID_SOLARFLARE, 0x8c03),  /* X4D PF (FF/LL) */
+	 .driver_data = (unsigned long)&efx_x4_nic_type},
+	{PCI_DEVICE(PCI_VENDOR_ID_SOLARFLARE, 0xac03),  /* X4D PF (FF only) */
+	 .driver_data = (unsigned long)&efx_x4_nic_type},
 	{0}			/* end of list */
 };
 

From a66633b2171ac447b2f154e940e3f9ad8596ce80 Mon Sep 17 00:00:00 2001
From: Daniel Ortiz <letargopausado@gmail.com>
Date: Sat, 19 Sep 2026 20:19:20 -0500
Subject: [PATCH 0485/1982] ASoC: amd: yc: Add DMI quirk for Lenovo V15 G6 ARP

[ Upstream commit d395e1b62d9694f2e4add9122f8d473eacd374aa ]

The Lenovo V15 G6 ARP (product name 83UU) uses the ACP6x PDM interface
for its internal digital microphone array. Its firmware exposes neither
the AcpDmicConnected _DSD property nor the _WOV method, so acp6x_probe()
falls through to the DMI check and returns -ENODEV, leaving
acp_yc_mach.0 unbound and no capture device registered.

Add a DMI quirk entry for this model. With it, the machine driver binds
and the DMIC capture device is created:

  acp_yc_mach acp_yc_mach.0: Enabling ACP DMIC support via DMI
  card 2: acp6x [acp6x], device 0: DMIC capture dmic-hifi-0

Capture was verified working with arecord and PipeWire.

Signed-off-by: Daniel Ortiz <letargopausado@gmail.com>
Link: https://patch.msgid.link/20260920011920.2482786-1-letargopausado@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
index 507c07efc069b6..209ac43f9e31ec 100644
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -374,6 +374,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"),
 		}
 	},
+	{
+		.driver_data = &acp6x_card,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "83UU"),
+		}
+	},
 	{
 		.driver_data = &acp6x_card,
 		.matches = {

From 874ef161d968489579a9fb67982bf85b351c98e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= <tomasz.pakula.oficjalny@gmail.com>
Date: Tue, 22 Sep 2026 15:17:58 +0200
Subject: [PATCH 0486/1982] HID: universal-pidff: Add support for Turtle Beach
 VelocityOne Race
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 53f7f7955a684e820bdd6bd6792c45c4b434f637 ]

Add usb VID and device PID to hid-ids.h

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h             | 3 +++
 drivers/hid/hid-universal-pidff.c | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index ca5c62f29aebe6..69b1b0f98c99d6 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1415,6 +1415,9 @@
 #define USB_DEVICE_ID_ASUS_MD_5110	0x5110
 #define USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART	0x7100
 
+#define USB_VENDOR_ID_TURTLE_BEACH	0x10f5
+#define USB_DEVICE_ID_TB_VELOCITYONE_RACE	0x7077
+
 #define USB_VENDOR_ID_TWINHAN		0x6253
 #define USB_DEVICE_ID_TWINHAN_IR_REMOTE	0x0100
 
diff --git a/drivers/hid/hid-universal-pidff.c b/drivers/hid/hid-universal-pidff.c
index 60180467a0bfd9..f1854cfe42d0d9 100644
--- a/drivers/hid/hid-universal-pidff.c
+++ b/drivers/hid/hid-universal-pidff.c
@@ -187,6 +187,7 @@ static const struct hid_device_id universal_pidff_devices[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASETEK, USB_DEVICE_ID_ASETEK_FORTE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASETEK, USB_DEVICE_ID_ASETEK_LA_PRIMA) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASETEK, USB_DEVICE_ID_ASETEK_TONY_KANAAN) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_TURTLE_BEACH, USB_DEVICE_ID_TB_VELOCITYONE_RACE)},
 	{}
 };
 MODULE_DEVICE_TABLE(hid, universal_pidff_devices);

From c6e94c4f31025a6acf82827034db255b7ddeff49 Mon Sep 17 00:00:00 2001
From: Even Xu <even.xu@intel.com>
Date: Tue, 22 Sep 2026 10:46:38 +0800
Subject: [PATCH 0487/1982] HID: Intel-thc-hid: Intel-quickspi: Fix buffer
 overflow

[ Upstream commit a1cdd72371270640bd357bd3e3b2ec0be17c9536 ]

The input buffers are used to store complete HID-over-SPI packets,
including their protocol headers. However, their sizes are
currently calculated from the payload length only.

Allocate enough space for both the payload and the packet header to
prevent a buffer overflow when the payload reaches its maximum size.

Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index 1c96d1d85845cb..48387a73416049 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -549,7 +549,8 @@ static int quickspi_alloc_report_buf(struct quickspi_device *qsdev)
 	max_input_len = max(le16_to_cpu(qsdev->dev_desc.rep_desc_len),
 			    le16_to_cpu(qsdev->dev_desc.max_input_len));
 
-	qsdev->input_buf = devm_kzalloc(qsdev->dev, max_input_len, GFP_KERNEL);
+	qsdev->input_buf = devm_kzalloc(qsdev->dev,
+					HIDSPI_INPUT_BODY_SIZE(max_input_len), GFP_KERNEL);
 	if (!qsdev->input_buf)
 		return -ENOMEM;
 

From 2a6254baab5cb17d95ef8323d16ce67867004d1d Mon Sep 17 00:00:00 2001
From: Even Xu <even.xu@intel.com>
Date: Tue, 22 Sep 2026 10:46:37 +0800
Subject: [PATCH 0488/1982] HID: Intel-thc-hid: Intel-quicki2c: Fix buffer
 overflow

[ Upstream commit 5e5c3b9db1c5910d6a9175c97b76a95566e4dc32 ]

The input and output buffers are used to store complete HID-over-I2C
packets, including their protocol headers. However, their sizes are
currently calculated from the payload length only.

Allocate enough space for both the payload and the packet header to
prevent a buffer overflow when the payload reaches its maximum size.

Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
index c6ba6886072ad4..4588c55cf255d4 100644
--- a/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
+++ b/drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c
@@ -586,7 +586,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
 	 */
 	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_input_len), SZ_4K);
 
-	qcdev->input_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
+	qcdev->input_buf = devm_kzalloc(qcdev->dev,
+					HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);
 	if (!qcdev->input_buf)
 		return -ENOMEM;
 
@@ -596,7 +597,8 @@ static int quicki2c_alloc_report_buf(struct quicki2c_device *qcdev)
 	max_report_len = max(le16_to_cpu(qcdev->dev_desc.max_output_len),
 			     max_report_len);
 
-	qcdev->report_buf = devm_kzalloc(qcdev->dev, max_report_len, GFP_KERNEL);
+	qcdev->report_buf = devm_kzalloc(qcdev->dev,
+					 HIDI2C_PACKET_LEN(max_report_len), GFP_KERNEL);
 	if (!qcdev->report_buf)
 		return -ENOMEM;
 

From 93449e64cdee84f1c3a9746d4f2186673fd694fa Mon Sep 17 00:00:00 2001
From: Jasper Firth <jasper.m.f@hotmail.com>
Date: Fri, 25 Sep 2026 23:06:25 +1000
Subject: [PATCH 0489/1982] ASoC: Intel: bytcr_rt5651: Add quirk for Chuwi Hi8
 with generic DMI strings

[ Upstream commit c5a8fc2abe05cf6db71f57ff0177fddc59861a1a ]

Some Chuwi Hi8 tablets with model number CWI513 ship with a BIOS
(American Megatrends 5.11, dated 05/21/2016) whose DMI sys_vendor and
product_name are both "Default string". The tested unit is labelled
just "Hi8", but its model number is the same as the existing "Chuwi Hi8
Pro (CWI513)" entry, and it needs the same quirks. That entry matches on
sys_vendor "Hampoo" and product_name "X1D3_C806N", so it never applies
to these units.

Without its quirks the internal speaker, whose amplifier has a
differential input wired across LOUT left and right, cancels to a faint
distorted residual for any centred (L == R) content, and the headphone
channels are swapped.

Add an entry matching board_vendor "Hampoo" and board_name "Cherry Trail
CR", plus the BIOS date since those two are too generic on their own.
drivers/platform/x86/touchscreen_dmi.c already matches the Chuwi HiBook
the same way.

The quirks are those of the existing Hi8 Pro entry, except for the
over-current detection scale factor: 1.0 instead of the 0.75 from
BYT_RT5651_DEFAULT_QUIRKS. With 0.75 and a CTIA headset (inline mic and
one button), loud speech into the mic, and headphone playback coupling
onto the mic line, were reported as spurious KEY_PLAYPAUSE presses, one
of them held for a whole 8 second speech window. With 1.0 the same test
gave no spurious events, and 3 real button presses were reported as
exactly 3 press/release pairs.

Tested on a unit with the generic DMI strings, with a module built from
this patch and no quirk module parameter. The quirks were applied via
the new entry, the card components read "cfg-spk:1 cfg-mic:in2
cfg-hp:lrswap", and the following all work: speaker, headphone left/right
order, jack and headset-mic detection, headset button, and the internal
and headset mics.

The problem was diagnosed with the help of an AI coding assistant, which
also drafted this changelog.

Assisted-by: Claude Opus 5.5
Signed-off-by: Jasper Firth <jasper.m.f@hotmail.com>
Link: https://patch.msgid.link/20260925-hi8-quirk-v1-1-ffd00b0447f9@hotmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/bytcr_rt5651.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index ca540a66f22ce0..723acb58e248e6 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -409,6 +409,23 @@ static const struct dmi_system_id byt_rt5651_quirk_table[] = {
 					BYT_RT5651_HP_LR_SWAPPED |
 					BYT_RT5651_MONO_SPEAKER),
 	},
+	{
+		/* Chuwi Hi8 (CWI513) with a BIOS using generic DMI strings */
+		.callback = byt_rt5651_quirk_cb,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
+			DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+			/* Above matches are too generic, add bios-date match */
+			DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+		},
+		.driver_data = (void *)(BYT_RT5651_MCLK_EN |
+					BYT_RT5651_JD1_1 |
+					BYT_RT5651_OVCD_TH_2000UA |
+					BYT_RT5651_OVCD_SF_1P0 |
+					BYT_RT5651_IN2_MAP |
+					BYT_RT5651_HP_LR_SWAPPED |
+					BYT_RT5651_MONO_SPEAKER),
+	},
 	{
 		/* Chuwi Vi8 Plus (CWI519) */
 		.callback = byt_rt5651_quirk_cb,

From bf4fde54d928dff3b81e3fc10947899863d6ff9e Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 14 Sep 2026 16:48:53 +0900
Subject: [PATCH 0490/1982] nvme-tcp: delay nvme_tcp_reclassify_socket()

[ Upstream commit 447a7a3026eda85ac2738cbe6ee5ab066a39dad0 ]

Commit 841aee4d75f1 ("nvme-tcp: lockdep: annotate in-kernel sockets")
introduced nvme_tcp_reclassify_socket() to resolve a lockdep WARN by
distinguishing userspace sockets from nvme-tcp sockets. After that, TLS
encryption support was introduced to nvme-tcp and it added another lock
dependency on userspace socket handling by tlshd, which resulted in a
new lockdep WARN. This WARN was hidden by the commit 19bdb70c77d3
("nvme-tcp: lockdep: use dynamic lockdep keys per socket instance").
However, it turned out the commit 19bdb70c77d3 has a bug of lockdep key
lifetime management, and it is to be reverted by another patch in this
series. After the revert, the WARN was unveiled and observed at the
blktests test case nvme/062:

  WARNING: possible circular locking dependency detected
  7.3.0-rc2+ #455 Tainted: G        W
  ------------------------------------------------------
  tlshd/75867 is trying to acquire lock:
  ffffffff91ada5e0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x64/0x6d0

  but task is already holding lock:
  ffff888197808258 (sk_lock-AF_INET-NVME){+.+.}-{0:0}, at: do_tcp_setsockopt+0x499/0x26a0

  which lock already depends on the new lock.

To fix the lockdep WARN caused by the TLS encryption support, delay the
reclassification of the nvme-tcp sockets. Currently the reclassification
happens before the TLS handshake starts, which pulls in the additional
lock dependencies related to tlshd. Reclassify the sockets after the TLS
handshake instead, to cut that dependency.

Link: https://lore.kernel.org/lkml/CANn89i+wnTLC==UnXCpjsS4YxvEfhe5oK0N7fttbqr1zKyqdug@mail.gmail.com/
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 1f26e35d7a99ee..9f15feff661328 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1859,7 +1859,6 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid,
 	}
 
 	sk_net_refcnt_upgrade(queue->sock->sk);
-	nvme_tcp_reclassify_socket(queue->sock);
 
 	/* Single syn retry */
 	tcp_sock_set_syncnt(queue->sock->sk, 1);
@@ -1948,6 +1947,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid,
 			goto err_init_connect;
 	}
 
+	nvme_tcp_reclassify_socket(queue->sock);
+
 	ret = nvme_tcp_init_connection(queue);
 	if (ret)
 		goto err_init_connect;

From 0ce65d3accd68a6a672bfc6ea46932cbe20c6b08 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 23 Sep 2026 14:28:00 +0200
Subject: [PATCH 0491/1982] docs: update the unmount propagation rule

[ Upstream commit 3f5dc09141a7bfe286620a6869d1d70ffe32d6b8 ]

Section 5f still describes the rule propagate_umount() used before
commit f0d0ba19985d ("Rewrite of propagate_umount()"). It states that a
mount that receives the unmount by propagation is left alone as soon as
it has any submount. That's not true anymore.

A propagated unmount unmounts a mount with sub-mounts as long as every
sub-mount gets unmounted together with it. This is the case when the
sub-mounts are unmounted by the same propagation. Only a sub-mount that
cannot be unmounted keeps its parent mounted.

The section also only describes a single mount without sub-mounts. But
lazy unmounts take a tree and every mount of the tree propagates its
unmount from its parent mount.

Link: https://patch.msgid.link/20260923-work-mount-fixes-v1-8-f424cf8d3242@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/filesystems/sharedsubtree.rst | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/Documentation/filesystems/sharedsubtree.rst b/Documentation/filesystems/sharedsubtree.rst
index 8b7dc915908377..8bae6d9a7e0479 100644
--- a/Documentation/filesystems/sharedsubtree.rst
+++ b/Documentation/filesystems/sharedsubtree.rst
@@ -564,8 +564,8 @@ f) Unmount semantics
    where 'A' is a mount mounted on mount 'B' at dentry 'b'.
 
    If mount 'B' is shared, then all most-recently-mounted mounts at dentry
-   'b' on mounts that receive propagation from mount 'B' and does not have
-   sub-mounts within them are unmounted.
+   'b' on mounts that receive propagation from mount 'B' are unmounted as
+   well, if every mount below them is also unmounted.
 
    Example: Let's say 'B1', 'B2', 'B3' are shared mounts that propagate to
    each other.
@@ -584,10 +584,18 @@ f) Unmount semantics
 
    So all 'C1', 'C2' and 'C3' should be unmounted.
 
-   If any of 'C2' or 'C3' has some child mounts, then that mount is not
-   unmounted, but all other mounts are unmounted. However if 'C1' is told
-   to be unmounted and 'C1' has some sub-mounts, the umount operation is
-   failed entirely.
+   If any of 'C2' or 'C3' has a child mount that cannot be unmounted
+   then that mount is not unmounted. But all other mounts are unmounted.
+   A child mount that is itself unmounted by the same unmount
+   propagation does not keep its parent mounted. However if 'C1' is
+   supposed to be unmounted and 'C1' has some sub-mounts, the unmount
+   fails.
+
+   A lazy umount (MNT_DETACH) takes a whole tree. Every mount of the
+   tree then propagates its unmount from its own parent as described
+   above, so the mounts that receive propagation lose the corresponding
+   trees as well. Documentation/filesystems/propagate_umount.txt has the
+   precise rules, including the ones for locked mounts.
 
 g) Clone Namespace
 

From 654906c34da2bc27dd0d62c95b53f579d8ceb928 Mon Sep 17 00:00:00 2001
From: Hernan Ganzo <gp@sneemgp.com>
Date: Mon, 21 Sep 2026 21:55:38 +0100
Subject: [PATCH 0492/1982] ALSA: hda/realtek: Limit internal mic boost on HP
 Pavilion 15 (103c:2164)

[ Upstream commit 786fb6b3f513937f712db5a9ba6a12cbc6982ba9 ]

The HP Pavilion 15 with the ALC3227 codec (SSID 103c:2164) exposes the full
four-step internal mic boost on pin 0x12: nsteps=3 with stepsize=0x2f, that is
0, 12, 24 and 36 dB. Combined with the ADC capture gain of +30 dB the analogue
cascade reaches 66 dB, and the internal microphone clips on the ambient noise of
a quiet room; the upper two steps are unusable at any useful input level. This
is the defect class ALC269_FIXUP_LIMIT_INT_MIC_BOOST exists for.

The machine matches no SSID quirk and falls through to the pin table, which
selects ALC269_FIXUP_HP_MUTE_LED_MIC1 through a pin signature shared with
several other HP models. Add an SSID entry instead, using
ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED: the existing fixup that applies
alc269_fixup_limit_int_mic_boost() and chains to the same mute LED fixup, as
already done for 103c:218b. The boost becomes 0 or 12 dB and the LED handling is
unchanged.

Tested on the affected machine by selecting the same fixup through the model
string (snd-hda-intel.model), which bypasses the SSID and pin tables, with the
driver confirming the selection:

  snd_hda_codec_alc269 hdaudioC1D0: ALC3227: picked fixup limit-mic-boost (model specified)

With that, Internal Mic Boost reports Limits 0 - 1 (0 or 12 dB) instead of 0 - 3
(0 to 36 dB), so alc269_fixup_limit_int_mic_boost() clamps this codec's internal
mic pin as intended. Note that /proc/asound/card1/codec#0 keeps printing the
unclamped hardware caps (nsteps=0x03): that file reads codec parameters uncached
by design, while the fixup overrides the driver's cached parameter that the
control is built from.

This does not by itself make the default capture volume sane -- the remaining
12 dB on top of the +30 dB ADC gain is still hotter than this machine's usable
operating point. It removes the two unusable steps from the hardware range, which
is what a quirk of this class can do.

Signed-off-by: Hernan Ganzo <gp@sneemgp.com>
Link: https://patch.msgid.link/20260921205538.41192-1-gp@sneemgp.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index bc87062f86da77..10d930d8fed722 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6707,6 +6707,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
 	SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x2164, "HP Pavilion 15 Notebook PC", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
 	SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),

From 888a43640be370c10dd1a701075a93f4d914dd09 Mon Sep 17 00:00:00 2001
From: Tomasz Bojanowski <tomasz@bojanowski.me>
Date: Wed, 23 Sep 2026 20:49:57 +0200
Subject: [PATCH 0493/1982] ALSA: usb-audio: Add mixer mapping for MSI MAG
 B850M MORTAR WIFI

[ Upstream commit 7b457ae8cf711831f19d20963f5ed2fdf4842d3a ]

The USB audio device 0db0:cc78 (Realtek ALC4080) on the MSI MAG B850M
MORTAR WIFI motherboard exposes all playback controls as "PCM", which
makes it hard to tell the outputs apart.

Its mixer layout matches the one of the MSI MPG X570S Carbon Max Wifi
(units 29, 30 and 32), so reuse msi_mpg_x570s_carbon_max_wifi_alc4080_map
for this device too. With the mapping applied, the controls show up as
"Speaker", "Front Headphone" and "IEC958".

Tested with a patched snd-usb-audio module on a 7.2.7 kernel.

Signed-off-by: Tomasz Bojanowski <tomasz@bojanowski.me>
Link: https://patch.msgid.link/20260923184957.6687-1-tomasz@bojanowski.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer_maps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index ace4ccad8f51c9..a82b9c1d578d96 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -718,6 +718,10 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.id = USB_ID(0x0db0, 0xa073),
 		.map = msi_mpg_x570s_carbon_max_wifi_alc4080_map,
 	},
+	{	/* MSI MAG B850M MORTAR WIFI */
+		.id = USB_ID(0x0db0, 0xcc78),
+		.map = msi_mpg_x570s_carbon_max_wifi_alc4080_map,
+	},
 	{	/* MSI TRX40 */
 		.id = USB_ID(0x0db0, 0x543d),
 		.map = trx40_mobo_map,

From 1e2dd3f061e0d7ca57b100ed49cf5cbf99591d32 Mon Sep 17 00:00:00 2001
From: KIM MinWoo <phrimm136@gmail.com>
Date: Wed, 23 Sep 2026 10:37:56 +0900
Subject: [PATCH 0494/1982] ALSA: hda/realtek: Add quirk for Lenovo ThinkBook
 16p Gen 3 ARH (21EK)

[ Upstream commit 3867e38b2d4b844d89076f988c7b9741c87a9858 ]

The ThinkBook 16p Gen 3 ARH (SSID 17aa:3871) has a TI TAS2563
amplifier device on I2C, exposed by ACPI as INT8866, the same
arrangement as the Yoga 7 14ARB7 (SSID 17aa:3870). Without a quirk,
the codec falls back to the vendor-wide Lenovo quirk
(ALC269_FIXUP_LENOVO_XPAD_ACPI), the amplifier is never bound, and the
internal speakers stay silent while the headphone output works.

Reuse the Yoga 7 14ARB7 fixup, which binds the INT8866 device as a side
codec. ALC287_FIXUP_TAS2781_I2C does not work on this machine because it
looks for a TIAS2781 device.

Assisted-by: LLM
Signed-off-by: KIM MinWoo <phrimm136@gmail.com>
Link: https://patch.msgid.link/20260923013756.106033-1-phrimm136@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 10d930d8fed722..b1cb93922c3bcb 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7527,6 +7527,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	HDA_CODEC_QUIRK(0x17aa, 0x38a7, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */
 	SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
+	SND_PCI_QUIRK(0x17aa, 0x3871, "Lenovo ThinkBook 16p Gen 3 ARH", ALC287_FIXUP_YOGA7_14ARB7_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x3874, "Legion 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x3878, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),

From 359096b8ff07f45a19f181531eff9589e297bffe Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Mon, 21 Sep 2026 20:44:49 +0800
Subject: [PATCH 0495/1982] ALSA: hda/realtek: Add quirk for Lenovo ThinkBook
 G8+

[ Upstream commit 4322ac247f4ce7932edbd46aa37f3dae62cde424 ]

Fix Bass Speaker volume control on Lenovo ThinkBook G8+ by adding
quirk 17aa:38dc with ALC285_FIXUP_SPEAKER2_TO_DAC1.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221799
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260921124450.639601-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index b1cb93922c3bcb..6afb35769f7467 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7572,6 +7572,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x38d5, "Yoga S990-16 Pro IMH YC Quad", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38d6, "Yoga S990-16 Pro IMH VECO Quad", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38d7, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x38dc, "Lenovo ThinkBook G8", ALC285_FIXUP_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x17aa, 0x38df, "Yoga Y990 Intel YC Dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38e0, "Yoga Y990 Intel VECO Dual", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x17aa, 0x38f8, "Yoga Book 9i", ALC287_FIXUP_TAS2781_I2C),

From 634410e636357abaf6a3954396246ae074b2aafc Mon Sep 17 00:00:00 2001
From: Luis Banha <luisbanha26@gmail.com>
Date: Tue, 22 Sep 2026 00:01:05 +0100
Subject: [PATCH 0496/1982] ALSA: hda/realtek: Add mute LED quirk for HP
 Pavilion 15-ec1xxx

[ Upstream commit 775aa96c310d59f3d15a6e5a9bd1796fd1ba95ec ]

The mute LED on the HP Pavilion Gaming Laptop 15-ec1xxx (103c:87b2)
does not work automatically. Add the ALC285_FIXUP_HP_MUTE_LED quirk
to fix this behavior.

Signed-off-by: Luis Banha <luisbanha26@gmail.com>
Link: https://patch.msgid.link/20260921230105.16844-1-luisbanha26@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 6afb35769f7467..1fcf2ba795e8a5 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6822,6 +6822,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8786, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8787, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
+	SND_PCI_QUIRK(0x103c, 0x87b2, "HP Pavilion Gaming Laptop 15-ec1xxx", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87cb, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),

From 14d1a67641d350040479f03131033d7911245ee6 Mon Sep 17 00:00:00 2001
From: Tarun Noonemunthala <ntarun2000@gmail.com>
Date: Wed, 23 Sep 2026 15:10:14 +0530
Subject: [PATCH 0497/1982] ALSA: hda/realtek: Add quirk for HP ENVY 13-aq1xxx

[ Upstream commit a01a223bd685be42e908d970de32eeb3646097f3 ]

The HP ENVY Laptop 13-aq1xxx (PCI SSID 103c:86ad) uses an ALC285 codec
with two speaker pairs: front (pin 0x14) and bottom (pin 0x17).

The BIOS leaves pin 0x14 as [N/A] ("not connected"), so the generic
parser never enables the front pair and only the bottom speakers are
audible.  The vendor driver (RTKVHD64.sys) programs that pin with the
value 0x90170150 and runs the HP amplifier initialization, which is
already implemented in the driver as ALC285_FIXUP_HP_GPIO_AMP_INIT.

Add a board fixup that applies the pin configuration for 0x14 and chains
to the existing amplifier init fixup.

The pin value was recovered from the vendor driver's own configuration
data.  The patch and this changelog were prepared with an AI coding
assistant (see the Assisted-by tag below); the change was reviewed and
tested by the submitter on the affected machine.

Tested on an HP ENVY 13-aq1xxx by rebuilding snd-hda-codec-alc269 from
the Fedora 7.1.10 source and loading it: the codec now reports
"line_outs=2 (0x14/0x17)", pin 0x14 comes up as an output (Pin-ctls
0x40) with its amplifier unmuted, and both speaker pairs play.

Assisted-by: OpenCode:deepseek-v4.1-flash checkpatch
Signed-off-by: Tarun Noonemunthala <ntarun2000@gmail.com>
Link: https://patch.msgid.link/20260923094014.58867-1-ntarun2000@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 1fcf2ba795e8a5..0a3df8b78aae6a 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -3774,6 +3774,7 @@ enum {
 	ALC285_FIXUP_HP_SPECTRE_X360_EB1,
 	ALC285_FIXUP_HP_SPECTRE_X360_DF1,
 	ALC285_FIXUP_HP_ENVY_X360,
+	ALC285_FIXUP_HP_ENVY_13AQ,
 	ALC288_FIXUP_DELL_HEADSET_MODE,
 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
 	ALC288_FIXUP_DELL_XPS_13,
@@ -5981,6 +5982,15 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT,
 	},
+	[ALC285_FIXUP_HP_ENVY_13AQ] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x14, 0x90170150 }, /* front speakers */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT,
+	},
 	[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_ideapad_s740_coef,
@@ -6794,6 +6804,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x864f, "HP Laptop 15-dy0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+	SND_PCI_QUIRK(0x103c, 0x86ad, "HP ENVY 13-aq1xxx", ALC285_FIXUP_HP_ENVY_13AQ),
 	SND_PCI_QUIRK(0x103c, 0x86c1, "HP Laptop 15-da3001TU", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
 	SND_PCI_QUIRK(0x103c, 0x86c8, "HP Laptop 14s-dr1xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),

From 3b75fa0871d32647fa3e4d18447950e5ae48041c Mon Sep 17 00:00:00 2001
From: Krish Gulati <krishgulati7@gmail.com>
Date: Mon, 21 Sep 2026 18:47:03 +0530
Subject: [PATCH 0498/1982] ALSA: hda/realtek: Add mute LED quirk for HP Victus
 15-fb2xxx

[ Upstream commit c748c42abb9b549fc79c41ea55e1f220eadb60ec ]

The HP Victus 15-fb2xxx (PCI SSID 103c:8c2f) with the ALC245 codec
does not turn on the mute LED when audio is muted.
Add a quirk entry to enable it.

Reported-by: erph.briones27@gmail.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221946
Signed-off-by: Krish Gulati <krishgulati7@gmail.com>
Tested-by: Raphael Briones <erph.briones27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260921131728.8999-1-krishgulati7@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 0a3df8b78aae6a..4eefd5d87f04bf 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7004,6 +7004,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8c17, "HP Spectre x360 2-in-1 Laptop 16-aa0xxx", ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX),
 	SND_PCI_QUIRK(0x103c, 0x8c21, "HP Pavilion Plus Laptop 14-ey0XXX", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x8c2d, "HP Victus 15-fa1xxx (MB 8C2D)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
+	SND_PCI_QUIRK(0x103c, 0x8c2f, "HP Victus 15-fb2xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c30, "HP Victus 15-fb1xxx", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c3f, "HP Victus 15-fa1xxx (MB 8C3F)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8c46, "HP EliteBook 830 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),

From 022127b8df54997648b34d2c7d5b3b207526544c Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Mon, 21 Sep 2026 20:44:50 +0800
Subject: [PATCH 0499/1982] ALSA: hda/realtek: Add quirk for Acer Nitro
 AN515-45

[ Upstream commit 0d90a929836344f1d3b39f22f08ccecc62378a59 ]

The Acer Nitro AN515-45 requires ALC2XX_FIXUP_HEADSET_MIC to make the
headset microphone work properly.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221925
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260921124450.639601-2-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 4eefd5d87f04bf..fa5bc54ff083d8 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6615,6 +6615,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),
+	SND_PCI_QUIRK(0x1025, 0x151e, "Acer Nitro AN515-45", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1539, "Acer Nitro 5 AN515-57", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),

From b639fb18ad69035c9ca0c0dcd88bbb5a3dc33f49 Mon Sep 17 00:00:00 2001
From: Muhtasham Nawr al-Mahmud <muhtaseem2005@gmail.com>
Date: Thu, 24 Sep 2026 20:45:12 +0600
Subject: [PATCH 0500/1982] ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA

[ Upstream commit 0eee030c2c09c7a44be778de5f451d9e7a2f09c1 ]

The ASUS ExpertBook PM3406CHA uses an ALC256 codec with subsystem
ID 1043:1664. On Linux boot, the internal speakers are silent even
though playback is routed to the codec and the speaker pin is
configured for output.

The codec starts with coefficient 0x10 set to 0x1d20. Writing 0x7f20
to coefficient 0x10 immediately restores internal speaker output.

This was reproduced on the affected hardware from a fresh boot using
hda-verb. Reducing a larger initialization sequence showed that this
coefficient write alone is sufficient; no GPIO, EAPD, pin-control, or
other coefficient changes are required. After applying the coefficient
in userspace, speaker output also remains functional across suspend
and resume.

Add a machine-specific HDA fixup that writes the required coefficient.

The fixup has been compile-tested, but could not be boot-tested because
the affected hardware is no longer available.

Closes: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/2162718
Signed-off-by: Muhtasham Nawr al-Mahmud <muhtaseem2005@gmail.com>
Link: https://patch.msgid.link/20260924144512.3989-1-muhtaseem2005@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index fa5bc54ff083d8..a40b85fbaf393b 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -3678,6 +3678,7 @@ enum {
 	ALC269_FIXUP_SONY_VAIO,
 	ALC275_FIXUP_SONY_VAIO_GPIO2,
 	ALC269_FIXUP_DELL_M101Z,
+	ALC256_FIXUP_ASUS_PM3406CHA,
 	ALC269_FIXUP_SKU_IGNORE,
 	ALC269_FIXUP_ASUS_G73JW,
 	ALC269_FIXUP_ASUS_N7601ZM_PINS,
@@ -4089,6 +4090,14 @@ static const struct hda_fixup alc269_fixups[] = {
 			{}
 		}
 	},
+	[ALC256_FIXUP_ASUS_PM3406CHA] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x10 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x7f20 },
+			{}
+		}
+	},
 	[ALC269_FIXUP_SKU_IGNORE] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_sku_ignore,
@@ -7184,6 +7193,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1652, "ASUS ROG Zephyrus Do 15 SE", ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK),
 	SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
 	SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1043, 0x1664, "ASUS ExpertBook PM3406CHA", ALC256_FIXUP_ASUS_PM3406CHA),
 	SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),

From a6c911aa993bf979ff2ea53e80c12f3dbbe22cf9 Mon Sep 17 00:00:00 2001
From: renpanpan <renpanpan@kylinos.cn>
Date: Wed, 30 Sep 2026 14:55:04 +0800
Subject: [PATCH 0501/1982] ALSA: hda/realtek: Add mute LED quirk for HP
 Pavilion 14-dv1001TU

[ Upstream commit ece609abc95cc0f75e633d93f3d868b030d9a8fe ]

The HP Pavilion 14-dv1001TU (subsystem ID 103c:8987) uses a Realtek
ALC287 codec. The mute LED on this machine is controlled by GPIO bit
0x10, which was verified via hda-verb, but the subsystem ID is missing
from the quirk table. As a result, the ALC287_FIXUP_HP_GPIO_LED fixup
that drives GPIO 0x10 is never applied and the mute LED stays off even
though the associated LED class device toggles correctly.

Add the missing SND_PCI_QUIRK entry to map this subsystem ID to
ALC287_FIXUP_HP_GPIO_LED so the mute LED works as expected.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221810
Signed-off-by: renpanpan <renpanpan@kylinos.cn>
Link: https://patch.msgid.link/20260930065504.24151-1-rppxj178543@163.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index a40b85fbaf393b..2a466ef894697d 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6902,6 +6902,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8975, "HP EliteBook x360 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x897d, "HP mt440 Mobile Thin Client U74", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8981, "HP Elite Dragonfly G3", ALC245_FIXUP_CS35L41_SPI_4),
+	SND_PCI_QUIRK(0x103c, 0x8987, "HP Pavilion 14-dv1001TU", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x898a, "HP Pavilion 15-eg100", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x898e, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x898f, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),

From 0ec1ea7f38d6de78d0f6d3da1187ee9f21fef132 Mon Sep 17 00:00:00 2001
From: Vladimir Murzin <vladimir.murzin@arm.com>
Date: Tue, 22 Sep 2026 11:37:56 +0100
Subject: [PATCH 0502/1982] usb: mtu3: Fix double dereference in TP_printk

[ Upstream commit cfb3293c4573289f11f913611f530ea6b1926d67 ]

Paul reported kernel splat:

[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] ------------[ cut here ]------------
[    0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : test_double_dereference+0x144/0x14c
[    0.000000] lr : test_double_dereference+0x144/0x14c
[    0.000000] sp : ffffc80aa7633bf0
[    0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
[    0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
[    0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
[    0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
[    0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
[    0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
[    0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
[    0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
[    0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
[    0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
[    0.000000] Call trace:
[    0.000000]  test_double_dereference+0x144/0x14c (P)
[    0.000000]  trace_event_raw_init+0x37c/0x5d8
[    0.000000]  event_init+0x34/0xc0
[    0.000000]  trace_event_init+0xec/0x588
[    0.000000]  trace_init+0x24/0x6e0
[    0.000000]  start_kernel+0x4a0/0x8ec
[    0.000000]  __primary_switched+0x88/0x90
[    0.000000] irq event stamp: 0
[    0.000000] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[    0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
[    0.000000] softirqs last  enabled at (0): [<0000000000000000>] 0x0
[    0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma

Which also observed by Mark and myself.

The splat it result of new check introduced by b5cc230af5e5 ("tracing:
Warn when an event dereferences a pointer in TP_printk()") which
correctly catches issue with %pad dereferencing the address saved in
the ring buffer. TP_fast_assign() logic gets executed when the
tracepoint is triggered, however the TP_printk() is executed when the
user reads the trace buffer which could be seconds, minutes, hours,
days, even months later and nothing guarantee that __entry->gpd_ring
pointer will still be pointing to what it was when it was recorded.

Fix the issue by capturing immediate value of gpd_ring.dma when trace
point is triggered.

Reported-by: Paul E. McKenney <paulmck@kernel.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/mtu3/mtu3_trace.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d63561..9aaa167d69c130 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
 		__field(unsigned int, flags)
 		__field(unsigned int, direction)
 		__field(struct mtu3_gpd_ring *, gpd_ring)
+		__field(dma_addr_t, gpd_ring_dma)
 	),
 	TP_fast_assign(
 		__assign_str(name);
@@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
 		__entry->flags = mep->flags;
 		__entry->direction = mep->is_in;
 		__entry->gpd_ring = &mep->gpd_ring;
+		__entry->gpd_ring_dma = mep->gpd_ring.dma
 	),
 	TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
 		__get_str(name), usb_ep_type_string(__entry->type),
 		__entry->maxp, __entry->slot,
 		__entry->mult, __entry->maxburst,
-		__entry->gpd_ring, &__entry->gpd_ring->dma,
+		__entry->gpd_ring, &__entry->gpd_ring_dma,
 		__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
 		__entry->flags & MTU3_EP_STALL ? 'S' : 's',
 		__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',

From 96e38c6a49f58c023f4d5ccfd955510d2b74f4a1 Mon Sep 17 00:00:00 2001
From: Reinhard Speyerer <rspmn@arcor.de>
Date: Fri, 25 Sep 2026 15:14:32 +0200
Subject: [PATCH 0503/1982] net: usb: qmi_wwan: add Rolling Wireless RN947R

[ Upstream commit 7375d38364a9aa66fb31716bcefef38aecad75d8 ]

Add Rolling Wireless RN947R 0x9300 composition:

DIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL

T:  Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#=  6 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=33f8 ProdID=9300 Rev= 0.00
S:  Manufacturer=Rolling Wireless
S:  Product=RN947R
S:  SerialNumber=xxxxxxxxxxx
C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=21 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=22 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
Link: https://patch.msgid.link/arZzuOOvLUZtdOlv@arcor.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index aa66a30e56cdcf..85d2daae805fd1 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1453,6 +1453,7 @@ static const struct usb_device_id products[] = {
 	{QMI_QUIRK_SET_DTR(0x1546, 0x1312, 4)},	/* u-blox LARA-R6 01B */
 	{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)},	/* u-blox LARA-L6 */
 	{QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */
+	{QMI_QUIRK_SET_DTR(0x33f8, 0x9300, 8)}, /* Rolling RN947R RMNET */
 	{QMI_FIXED_INTF(0x2dee, 0x4d22, 5)},    /* MeiG Smart SRM825L */
 	{QMI_QUIRK_SET_DTR(0x2dee, 0x4d63, 0)}, /* MeiG SRM813Q w/ Modem(PPP) */
 	{QMI_QUIRK_SET_DTR(0x2dee, 0x4d64, 0)}, /* MeiG SRM813Q w/ NMEA */

From 13c12f98618d8dd170dce7b4daa6210637b7c2c1 Mon Sep 17 00:00:00 2001
From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
Date: Thu, 1 Oct 2026 20:34:00 +0200
Subject: [PATCH 0504/1982] ALSA: hda/realtek: Add quirk for ASRock NUC
 BOX-358H

[ Upstream commit 9a44b828dd7c0be1d0d6d6cf178d9727ceb6da6e ]

Fix headphone jack detection for some devices

Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://patch.msgid.link/20261001183403.103990-1-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 2a466ef894697d..0bfa64bee9d3b0 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7640,6 +7640,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1849, 0x0269, "Positivo Master C6400", ALC269VB_FIXUP_ASUS_ZENBOOK),
 	SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK),
+	SND_PCI_QUIRK(0x1849, 0x6256, "ASRock NUC Box 358H", ALC233_FIXUP_NO_AUDIO_JACK),
 	SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1854, 0x0440, "LG CQ6", ALC256_FIXUP_HEADPHONE_AMP_VOL),
 	SND_PCI_QUIRK(0x1854, 0x0441, "LG CQ6 AIO", ALC256_FIXUP_HEADPHONE_AMP_VOL),

From 60f0adc41d88682fef4ececd80045ddb73f41baa Mon Sep 17 00:00:00 2001
From: Zeyu Li <13776528859@163.com>
Date: Sat, 26 Sep 2026 22:03:36 +0800
Subject: [PATCH 0505/1982] ALSA: hda/realtek: Add ALC235 support for headset
 mode

[ Upstream commit 9ee4266827cfb67b9fbb89136ea6a8f3d7809f5c ]

The ALC235 (0x10ec0235) is registered as the ALC255 codec variant in
patch_alc269(), but the headset mode functions were missing a case
for it, so the CTIA/OMTP jack type detection and routing never ran
on this codec. As a result, a plugged-in headset is detected (jack
presence works) but the microphone signal is never routed, leaving
the capture stream permanently silent.

Verified on an ASUS M5451GA laptop (HDA:10ec0235,10431814): with the
ALC255 coef sequence applied, the headset microphone works correctly.

Signed-off-by: Zeyu Li <13776528859@163.com>
Link: https://patch.msgid.link/20260926140336.27896-1-13776528859@163.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/realtek.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/codecs/realtek/realtek.c b/sound/hda/codecs/realtek/realtek.c
index ca377a5adadb5b..a1529650950d80 100644
--- a/sound/hda/codecs/realtek/realtek.c
+++ b/sound/hda/codecs/realtek/realtek.c
@@ -1305,6 +1305,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
 	}
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
 		break;
@@ -1420,6 +1421,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
 	};
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_write_coef_idx(codec, 0x45, 0xc489);
 		snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
@@ -1575,6 +1577,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)
 		alc_process_coef_fw(codec, coef0225);
 		alc_hp_enable_unmute(codec, 75);
 		break;
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
 		break;
@@ -1676,6 +1679,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
 	};
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
 		break;
@@ -1793,6 +1797,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
 	};
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
 		break;
@@ -1894,6 +1899,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
 	}
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0235:
 	case 0x10ec0255:
 		alc_process_coef_fw(codec, coef0255);
 		msleep(300);

From ba06038fba12f20a824e6e0c7be5faa409c7f557 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Thu, 1 Oct 2026 17:14:44 +0200
Subject: [PATCH 0506/1982] spi: cadence-qspi: Fix status polling with octal
 DTR chips

[ Upstream commit fd99864b0ac936e870c7ae28354c5cd3dad5efd0 ]

Most SPI NOR chips today use 0x05 as ReaD Status Register (RDSR)
opcode. After almost every transaction, the core will wait for the said
transation to be digested by the chip by polling its status
register. This mechanism has been automated by certain chips, such as
the Cadence QSPI controller. Unfortunately, the feature has been
disabled for various (relevant) reasons. Disabling this feature has been
done by setting WRITE_COMPLETION_CTRL_REG.DISABLE_POLLING_FLD, keeping
the rest of the register intact. In this same register, there is also a
field named WRITE_COMPLETION_CTRL_REG.OPCODE_FLD, which by default also
contains 0x05, as primary RDSR opcode.

As a result, both the SPI NOR and SPI NAND cores, primary users through
spi-mem of the spi_mem_ops interface, do send their own RDSR. In this
driver, such command goes through one of the fifth possible data path
specifically crafted for short register-like commands, named STIG. In
STIG mode, the opcode of the operation is written to
OSPI_FLASH_CMD_CTRL_REG. This means that the opcode field of STIG
configuration and the opcode field of the automatic polling
configuration contain the same value.

Unfortunately, the TRM explains in two different places that this
configuration is forbidden, without explaining why it is problematic:

$12.4.2.4.11 OSPI Software-Triggered Instruction Generator (STIG)
```
OSPI_FLASH_CMD_CTRL_REG[31-24] CMD_OPCODE_FLD bits should be set
different than OSPI_DEV_INSTR_RD_CONFIG_REG[7-0] RD_OPCODE_NON_XIP_FLD
and OSPI_DEV_INSTR_WR_CONFIG_REG[7-0] WR_OPCODE_FLD.
```

and

$12.4.2.5.2 Configuring the OSPI Controller for Optimal Use
```
When using the OSPI Controller, the opcodes in
OSPI_DEV_INSTR_RD_CONFIG_REG[7-0] RD_OPCODE_NON_XIP_FLD,
OSPI_DEV_INSTR_WR_CONFIG_REG[7-0] WR_OPCODE_FLD and
OSPI_WRITE_COMPLETION_CTRL_REG[7-0] OPCODE_FLD bit fields shall not
match the opcode in the OSPI_FLASH_CMD_CTRL_REG[31-24] CMD_OPCODE_FLD
bit field.
```

For some reasons, this is only unveiled now when testing in ODTR
mode. Plain SDR modes work flawlessly with the same chips. One possible
reason for this, is that the internal data path in ODTR mode is
very different due to the extra opcode extension/repetition which may be
interpreted differently (this is a wild guess). For sure there is an
interference, as even the TRM states that there is some magic happening:

$12.4.2.4.13 OSPI Command Translation
```
The WREN and the RDSR device instructions are the only ones that are
sent by the controller under the hood.
```

I cannot probe the bus when the problem arises, so I don't know exactly
what is sent on the bus. Practically speaking, the chip was driving the
lines low (reading all 0s), which is not the usual default state when
the chip is not driving the lines (all 1s). Other people on the mailing
list claimed successfully using ODTR chips with this controller. My take
here is that either they were using a variant of the IP without write
completion at all (there is a quirk for it), or they were using chips
slightly more flexible about their opcode sequency or maybe with
different addr/dummy requirements.

Clearing the WRITE_COMPLETION_CTRL_REG.OPCODE_FLD while disabling write
completion polling entirely seems the best compromise.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20261001-winbond-spi-next-cadence-rdsr-fix-v1-1-ec5ff594ba5d@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-cadence-quadspi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
index 0a32e28eefd515..441426bc232ef4 100644
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -1058,8 +1058,7 @@ static int cqspi_write_setup(struct cqspi_flash_pdata *f_pdata,
 	 * care of polling the status register.
 	 */
 	if (cqspi->wr_completion) {
-		reg = readl(reg_base + CQSPI_REG_WR_COMPLETION_CTRL);
-		reg |= CQSPI_REG_WR_DISABLE_AUTO_POLL;
+		reg = CQSPI_REG_WR_DISABLE_AUTO_POLL;
 		writel(reg, reg_base + CQSPI_REG_WR_COMPLETION_CTRL);
 		/*
 		 * DAC mode require auto polling as flash needs to be polled

From c1e50fa372a8bc1b8558a0f1fb52e1ceff404e54 Mon Sep 17 00:00:00 2001
From: Jaidheer Sirigineedi <jaidheer7@gmail.com>
Date: Fri, 2 Oct 2026 13:59:51 -0500
Subject: [PATCH 0507/1982] ALSA: hda/realtek: Add mute LED quirk for HP
 Pavilion 15-eg3xxx (103c:8bfd)

[ Upstream commit 13dffca9043500ed6033d770b491a043fb952bc5 ]

The mute LED on the HP Pavilion Laptop 15-eg3xxx (PCI SSID 103c:8bfd,
Realtek ALC287) does not work because the machine has no entry in the
quirk table. No fixup is applied, so the mute LED is never driven, even
though the mute function itself works.

The LED is controlled via GPIO pin 4 (mask 0x10), which is exactly what
ALC287_FIXUP_HP_GPIO_LED configures. This was verified on the hardware
with hda-verb: setting the GPIO data bit lights the mute LED, and
clearing it turns the LED off.

  hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_MASK 0x10
  hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DIRECTION 0x10
  hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DATA 0x10   # LED on
  hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DATA 0x00   # LED off

Add a quirk entry for 103c:8bfd using ALC287_FIXUP_HP_GPIO_LED.

Signed-off-by: Jaidheer Sirigineedi <jaidheer7@gmail.com>
Link: https://patch.msgid.link/20261002185951.33855-1-jaidheer7@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 0bfa64bee9d3b0..a25c92834e722b 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7010,6 +7010,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8be8, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x8be9, "HP Envy 15", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8bfd, "HP Pavilion 15-eg3xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8c15, "HP Spectre x360 2-in-1 Laptop 14-eu0xxx", ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX),
 	SND_PCI_QUIRK(0x103c, 0x8c16, "HP Spectre x360 2-in-1 Laptop 16-aa0xxx", ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX),
 	SND_PCI_QUIRK(0x103c, 0x8c17, "HP Spectre x360 2-in-1 Laptop 16-aa0xxx", ALC245_FIXUP_HP_SPECTRE_X360_16_AA0XXX),

From 4de130f28ae8cc497324d2ee7f81b30b425f956c Mon Sep 17 00:00:00 2001
From: Matus Gajdos <matuszpd@gmail.com>
Date: Fri, 2 Oct 2026 14:52:37 +0200
Subject: [PATCH 0508/1982] ALSA: usb-audio: Add native DSD support for
 Cambridge Audio streamers

[ Upstream commit 4e1462e7cd6a9b920f441842726cc2b9d232673e ]

The Cambridge Audio streamer advertises the UAC2 RAW_DATA format on
altsetting 2 of its playback interface, but without the DSD_RAW quirk
flag the driver exposes it only as a SPECIAL format that cannot be
used.

Add QUIRK_FLAG_DSD_RAW for the device (USB ID 22e8:ca10), so the
altsetting is exposed as DSD_U32_BE, enabling native DSD64/128/256
playback.

Tested with: gst-launch-1.0 filesrc location=file.dsf ! \
                            avdemux_dsf ! dsdconvert ! \
                            alsasink device=hw:2,0

Signed-off-by: Matus Gajdos <matuszpd@gmail.com>
Link: https://patch.msgid.link/20261002125237.82188-1-matuszpd@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 8dcba375bd4a36..be80d9d14e0ad9 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2379,6 +2379,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 		   QUIRK_FLAG_DSD_RAW),
 	DEVICE_FLG(0x21b4, 0x0232, /* Ayre QX-5 Twenty */
 		   QUIRK_FLAG_DSD_RAW),
+	DEVICE_FLG(0x22e8, 0xca10, /* Cambridge Audio streamers */
+		   QUIRK_FLAG_DSD_RAW),
 	DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */
 		   QUIRK_FLAG_SET_IFACE_FIRST),
 	DEVICE_FLG(0x262a, 0x9302, /* ddHiFi TC44C */

From 771bdf5dd8b111f73c5de064fe80d19d5046c765 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Wed, 16 Sep 2026 13:44:27 +0800
Subject: [PATCH 0509/1982] drm/amdgpu/gfx12: set KMD_QUEUE for kernel gfx
 queues

[ Upstream commit 9fe5745f9d8eca38d31d9b672a1998edf856f651 ]

Set KMD_QUEUE in the GFX MQD and kernel ring control registers so CP
preserves kernel IB VMIDs instead of replacing them with the queue VMID.
Use prop->kernel_queue to distinguish kernel and user MQDs.

Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 14741c01680a803050e949744089b57fa53e02f7)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
index 433381f806b2bf..06fde713b92297 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
@@ -2733,6 +2733,7 @@ static int gfx_v12_0_cp_gfx_resume(struct amdgpu_device *adev)
 	rb_bufsz = order_base_2(ring->ring_size / 8);
 	tmp = REG_SET_FIELD(0, CP_RB0_CNTL, RB_BUFSZ, rb_bufsz);
 	tmp = REG_SET_FIELD(tmp, CP_RB0_CNTL, RB_BLKSZ, rb_bufsz - 2);
+	tmp = REG_SET_FIELD(tmp, CP_RB0_CNTL, KMD_QUEUE, 1);
 	WREG32_SOC15(GC, 0, regCP_RB0_CNTL, tmp);
 
 	/* Initialize the ring buffer's write pointers */
@@ -3025,6 +3026,7 @@ static int gfx_v12_0_gfx_mqd_init(struct amdgpu_device *adev, void *m,
 	tmp = regCP_GFX_HQD_CNTL_DEFAULT;
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, RB_BUFSZ, rb_bufsz);
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, RB_BLKSZ, rb_bufsz - 2);
+	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, KMD_QUEUE, prop->kernel_queue);
 #ifdef __BIG_ENDIAN
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, BUF_SWAP, 1);
 #endif

From b213051fc40b1d25b705b03d29c49e169dca6fe7 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Wed, 16 Sep 2026 13:44:41 +0800
Subject: [PATCH 0510/1982] drm/amdgpu/gfx11: set KMD_QUEUE for kernel gfx
 queues

[ Upstream commit 8228688eb40cc116127e80394cb8157417854c70 ]

Set KMD_QUEUE in the GFX MQD and kernel ring control registers so CP
preserves kernel IB VMIDs instead of replacing them with the queue VMID.
Use prop->kernel_queue to distinguish kernel and user MQDs.

Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 893642e0e3b2f5aa818e0ee4a49e2d401d541e3a)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
index a78e8f98f4d00c..5ade48c8d43f87 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -3737,6 +3737,7 @@ static int gfx_v11_0_cp_gfx_resume(struct amdgpu_device *adev)
 	rb_bufsz = order_base_2(ring->ring_size / 8);
 	tmp = REG_SET_FIELD(0, CP_RB0_CNTL, RB_BUFSZ, rb_bufsz);
 	tmp = REG_SET_FIELD(tmp, CP_RB0_CNTL, RB_BLKSZ, rb_bufsz - 2);
+	tmp = REG_SET_FIELD(tmp, CP_RB0_CNTL, KMD_QUEUE, 1);
 	WREG32_SOC15(GC, 0, regCP_RB0_CNTL, tmp);
 
 	/* Initialize the ring buffer's write pointers */
@@ -4145,6 +4146,7 @@ static int gfx_v11_0_gfx_mqd_init(struct amdgpu_device *adev, void *m,
 	tmp = regCP_GFX_HQD_CNTL_DEFAULT;
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, RB_BUFSZ, rb_bufsz);
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, RB_BLKSZ, rb_bufsz - 2);
+	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, KMD_QUEUE, prop->kernel_queue);
 #ifdef __BIG_ENDIAN
 	tmp = REG_SET_FIELD(tmp, CP_GFX_HQD_CNTL, BUF_SWAP, 1);
 #endif

From 4c6e3d81f8d49f5c8eca2bde4b07177903de62bf Mon Sep 17 00:00:00 2001
From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Date: Mon, 5 Oct 2026 19:02:38 -0600
Subject: [PATCH 0511/1982] RISC-V: errata: Add SiFive MAL-9092 workaround

[ Upstream commit 148ab873d8194cb44f29474da3b4428fa2e100d1 ]

SiFive cores with MAL-9092 require fence.rw instructions around
HLV/HLVX/HSV hypervisor instructions to ensure proper memory ordering
when accessing guest memory.

Note that HSTATUS.HU is cleared during KVM initialization, restricting
hypervisor instructions to HS-mode only. If future changes enable
HSTATUS.HU for U-mode access, additional errata considerations will be
needed.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20260817-sifive-errata-v1-1-6a80f1a2743d@sifive.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/Kconfig.errata                    | 14 ++++++++++++++
 arch/riscv/errata/sifive/errata.c            | 20 ++++++++++++++++++++
 arch/riscv/include/asm/errata_list_vendors.h |  3 ++-
 arch/riscv/include/asm/insn-def.h            | 16 +++++++++++++---
 4 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/arch/riscv/Kconfig.errata b/arch/riscv/Kconfig.errata
index 6f230aebd49685..65d00fb9db9d7b 100644
--- a/arch/riscv/Kconfig.errata
+++ b/arch/riscv/Kconfig.errata
@@ -95,6 +95,20 @@ config ERRATA_STARFIVE_JH7100
 	  Say "Y" if you want to support the BeagleV Starlight and/or
 	  StarFive VisionFive V1 boards.
 
+config ERRATA_SIFIVE_MAL_9092
+	bool "Apply SiFive HLV/HLVX/HSV fence errata"
+	depends on ERRATA_SIFIVE && 64BIT
+	default y
+	help
+	  This will apply the SiFive MAL-9092 errata to add fence.rw
+	  instructions around all HLV/HLVX/HSV instructions.
+
+	  Note: HSTATUS.HU is cleared during KVM initialization. If future
+	  changes enable HSTATUS.HU to allow hypervisor instructions in
+	  U-mode, additional errata handling may be required.
+
+	  If you don't know what to do here, say "Y".
+
 config ERRATA_THEAD
 	bool "T-HEAD errata"
 	depends on RISCV_ALTERNATIVE
diff --git a/arch/riscv/errata/sifive/errata.c b/arch/riscv/errata/sifive/errata.c
index 38aac2c47845a0..3025b9d6966f80 100644
--- a/arch/riscv/errata/sifive/errata.c
+++ b/arch/riscv/errata/sifive/errata.c
@@ -51,6 +51,22 @@ static bool errata_cip_1200_check_func(unsigned long  arch_id, unsigned long imp
 	return true;
 }
 
+static bool errata_mal_9092_check_func(unsigned long  arch_id, unsigned long impid)
+{
+	/*
+	 * Affected cores:
+	 * Architecture ID: 0x8000000000000109
+	 * Implementation ID: 0x19251031, 0x19251217, 0x19260320
+	 */
+
+	if (arch_id != 0x8000000000000109)
+		return false;
+	if (impid != 0x19251031 && impid != 0x19251217 && impid != 0x19260320)
+		return false;
+
+	return true;
+}
+
 static struct errata_info_t errata_list[ERRATA_SIFIVE_NUMBER] = {
 	{
 		.name = "cip-453",
@@ -60,6 +76,10 @@ static struct errata_info_t errata_list[ERRATA_SIFIVE_NUMBER] = {
 		.name = "cip-1200",
 		.check_func = errata_cip_1200_check_func
 	},
+	{
+		.name = "mal-9092",
+		.check_func = errata_mal_9092_check_func
+	},
 };
 
 static u32 __init_or_module sifive_errata_probe(unsigned long archid,
diff --git a/arch/riscv/include/asm/errata_list_vendors.h b/arch/riscv/include/asm/errata_list_vendors.h
index ec7eba3734371a..c62a82f60468a3 100644
--- a/arch/riscv/include/asm/errata_list_vendors.h
+++ b/arch/riscv/include/asm/errata_list_vendors.h
@@ -11,7 +11,8 @@
 #ifdef CONFIG_ERRATA_SIFIVE
 #define	ERRATA_SIFIVE_CIP_453 0
 #define	ERRATA_SIFIVE_CIP_1200 1
-#define	ERRATA_SIFIVE_NUMBER 2
+#define	ERRATA_SIFIVE_MAL_9092 2
+#define	ERRATA_SIFIVE_NUMBER 3
 #endif
 
 #ifdef CONFIG_ERRATA_THEAD
diff --git a/arch/riscv/include/asm/insn-def.h b/arch/riscv/include/asm/insn-def.h
index d29da6ccd3dd84..b1b97eab91007e 100644
--- a/arch/riscv/include/asm/insn-def.h
+++ b/arch/riscv/include/asm/insn-def.h
@@ -191,18 +191,28 @@
 	INSN_R(OPCODE_SYSTEM, FUNC3(0), FUNC7(49),		\
 	       __RD(0), RS1(gaddr), RS2(vmid))
 
+#define ALT_SIFIVE_MAL_9092_FENCE					\
+ALTERNATIVE("nop", "fence rw, rw", SIFIVE_VENDOR_ID,			\
+	    ERRATA_SIFIVE_MAL_9092, CONFIG_ERRATA_SIFIVE_MAL_9092)
+
 #define HLVX_HU(dest, addr)					\
+	ALT_SIFIVE_MAL_9092_FENCE "\n"				\
 	INSN_R(OPCODE_SYSTEM, FUNC3(4), FUNC7(50),		\
-	       RD(dest), RS1(addr), __RS2(3))
+	       RD(dest), RS1(addr), __RS2(3)) "\n"		\
+	ALT_SIFIVE_MAL_9092_FENCE
 
 #define HLV_W(dest, addr)					\
+	ALT_SIFIVE_MAL_9092_FENCE "\n"				\
 	INSN_R(OPCODE_SYSTEM, FUNC3(4), FUNC7(52),		\
-	       RD(dest), RS1(addr), __RS2(0))
+	       RD(dest), RS1(addr), __RS2(0)) "\n"		\
+	ALT_SIFIVE_MAL_9092_FENCE
 
 #ifdef CONFIG_64BIT
 #define HLV_D(dest, addr)					\
+	ALT_SIFIVE_MAL_9092_FENCE "\n"				\
 	INSN_R(OPCODE_SYSTEM, FUNC3(4), FUNC7(54),		\
-	       RD(dest), RS1(addr), __RS2(0))
+	       RD(dest), RS1(addr), __RS2(0)) "\n"		\
+	ALT_SIFIVE_MAL_9092_FENCE
 #else
 #define HLV_D(dest, addr)					\
 	__ASM_STR(.error "hlv.d requires 64-bit support")

From 781ced4acf432d0f0865c54f70026c75148f41f1 Mon Sep 17 00:00:00 2001
From: Michael Reeves <michael.reeves077@gmail.com>
Date: Tue, 6 Oct 2026 18:03:15 +1100
Subject: [PATCH 0512/1982] regmap: Remove debugfs before cache teardown

[ Upstream commit 834035934cef9e60169de682f4dc9feafd49e51a ]

regmap_exit() and regmap_reinit_cache() destroy the register cache before
removing debugfs. A concurrent debugfs cache operation can therefore
access cache state after the backend exit callback starts freeing it.

Remove debugfs before cache teardown, and clear the debugfs pointer after
removal. During cache reinitialization, recreate debugfs only after the
new cache initializes successfully.

Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20261006-regcache-lifecycle-submit-v3-1-37bdd82fd47c@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-debugfs.c |  1 +
 drivers/base/regmap/regmap.c         | 15 +++++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index c9b4c04b1cf608..98debe5020641e 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -657,6 +657,7 @@ void regmap_debugfs_exit(struct regmap *map)
 {
 	if (map->debugfs) {
 		debugfs_remove_recursive(map->debugfs);
+		map->debugfs = NULL;
 		mutex_lock(&map->cache_lock);
 		regmap_debugfs_free_dump_cache(map);
 		mutex_unlock(&map->cache_lock);
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index a6482185072364..b80bbe9033188a 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1424,8 +1424,8 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 {
 	int ret;
 
-	regcache_exit(map);
 	regmap_debugfs_exit(map);
+	regcache_exit(map);
 
 	map->max_register = config->max_register;
 	map->max_register_is_set = map->max_register ?: config->max_register_is_0;
@@ -1441,12 +1441,16 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 	if (ret)
 		return ret;
 
-	regmap_debugfs_init(map);
-
 	map->cache_bypass = false;
 	map->cache_only = false;
 
-	return regcache_init(map, config);
+	ret = regcache_init(map, config);
+	if (ret)
+		return ret;
+
+	regmap_debugfs_init(map);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
@@ -1460,9 +1464,8 @@ void regmap_exit(struct regmap *map)
 	struct regmap_async *async;
 
 	regmap_detach_dev(map->dev, map);
-	regcache_exit(map);
-
 	regmap_debugfs_exit(map);
+	regcache_exit(map);
 	regmap_range_exit(map);
 	if (map->bus && map->bus->free_context)
 		map->bus->free_context(map->bus_context);

From ebb9d776e297f388d01ca825ecb2d4308b57d6bf Mon Sep 17 00:00:00 2001
From: Petr Mladek <pmladek@suse.com>
Date: Tue, 13 Oct 2026 17:41:41 +0200
Subject: [PATCH 0513/1982] nbcon/reboot: Switch NBCON consoles into the
 emergency mode in emergency_restart()

[ Upstream commit d8e5fc3002294a28af53e97f6c83a35956e738f3 ]

When the system is going down a normal way, the NBCON kthreads are
flushed and stopped properly via a syscore shutdown callback, see
printk_kthreads_shutdown().

One missing piece is emergency_restart() where the kthreads are not
stopped. It might be called from several non-panic code paths,
e.g. sysrq-o, kdb_reboot(), or some watchdogs.

Fix it by explicitly entering the emergency (atomic) mode and trying
to flush the consoles there.

Note that printk_trigger_flush() must be used instead of pr_flush()
because the later is not safe in an atomic context.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202608061008.48a1e76e-lkp@intel.com/
Suggested-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Link: https://patch.msgid.link/20261013154141.94016-1-pmladek@suse.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/reboot.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index 61924a0560c421..665a25684c70a0 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -8,6 +8,7 @@
 #define pr_fmt(fmt)	"reboot: " fmt
 
 #include <linux/atomic.h>
+#include <linux/console.h>
 #include <linux/ctype.h>
 #include <linux/export.h>
 #include <linux/kexec.h>
@@ -94,6 +95,14 @@ void emergency_restart(void)
 {
 	kmsg_dump(KMSG_DUMP_EMERG);
 	system_state = SYSTEM_RESTART;
+
+	/*
+	 * NBCON kthreads won't be flushed and stopped properly in
+	 * the emergency restart. Move them to the atomic mode.
+	 */
+	nbcon_cpu_emergency_enter();
+	printk_trigger_flush();
+
 	machine_emergency_restart();
 }
 EXPORT_SYMBOL_GPL(emergency_restart);

From 5712414af23936a01b48faefaafb93818fdfcc5b Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Fri, 16 Oct 2026 10:50:57 +0200
Subject: [PATCH 0514/1982] Revert "namei: don't reveal overmounted entries in
 refwalk"

[ Upstream commit 214897acc8c2e5d6b63189d23ccaed6fa2af45a9 ]

This reverts commit 8189ab688f5a2c745dc90b63374da02f213d6994.

This bug class is bigger than can be fixed with this simple patch.
Back out of it and give us some time to fix this properly.

Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/namei.c | 29 -----------------------------
 1 file changed, 29 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index fc2f463c6ea4da..39169df7bcaeab 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1973,33 +1973,6 @@ static const char *pick_link(struct nameidata *nd, struct path *link,
 	return NULL;
 }
 
-/*
- * Be careful in case the dentry is unlinked or renamed. Any mounts
- * stacked on top of it are going away. We need to make sure that we
- * don't reveal the underyling dentry during refwalk. In rcuwalk we
- * catch this via d_seq and another lookup for the name. Give the same
- * guarantee in refwalk.
- */
-static bool unlink_may_reveal(struct nameidata *nd, int flags,
-			      struct path *path, struct dentry *dentry)
-{
-	/* ".." and LOOKUP_DOWN may land on an unhashed directory */
-	if (flags & WALK_NOFOLLOW)
-		return false;
-	if (nd->flags & LOOKUP_REVAL)
-		return false;
-	/* We crossed onto a mount and the name led us here while it still existed */
-	if (path->mnt != nd->path.mnt)
-		return false;
-	/* only a name on its way out is flagged */
-	if (likely(!cant_mount(dentry)))
-		return false;
-	if (!d_unlinked(dentry))
-		return false;
-	dput(no_free_ptr(path->dentry));
-	return true;
-}
-
 /*
  * Do we need to follow links? We _really_ want to be able
  * to do this check without having to look at inode->i_op,
@@ -2028,8 +2001,6 @@ static const char *step_into(struct nameidata *nd, int flags,
 			if (unlikely(!inode))
 				return ERR_PTR(-ENOENT);
 		} else {
-			if (unlikely(unlink_may_reveal(nd, flags, &path, dentry)))
-				return ERR_PTR(-ESTALE);
 			dput(nd->path.dentry);
 			if (nd->path.mnt != path.mnt)
 				mntput(nd->path.mnt);

From 5259a82b1ac101a983a6bb88a860fee80e8001ba Mon Sep 17 00:00:00 2001
From: Rohinthan P <rokinthanp03@gmail.com>
Date: Wed, 23 Sep 2026 12:50:50 +0530
Subject: [PATCH 0515/1982] media: em28xx: use video_unregister_device for
 radio_dev

[ Upstream commit 2579cbe68005f46fc7f8f95364f6b101b07b9d1c ]

Commit 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
converted device unregistrations in em28xx to use
vb2_video_unregister_device() instead of video_unregister_device().

However, radio devices do not have an associated videobuf2 queue
(v4l2->radio_dev.queue is NULL). Calling vb2_video_unregister_device()
on a radio device triggers a WARNING in vb2_video_unregister_device():

    !vdev->queue
    WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1f8/0x200
    Call Trace:
     em28xx_v4l2_init+0x1c39/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3085

As documented in vb2_video_unregister_device(), video_unregister_device()
should be used instead when vdev->queue is NULL.

Revert to calling video_unregister_device() for v4l2->radio_dev in both
em28xx_v4l2_fini() and the em28xx_v4l2_init() error unwind path.

Fixes: 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index e2907b56220b74..7d9840f3f1c888 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2243,7 +2243,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
 	if (video_is_registered(&v4l2->radio_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		vb2_video_unregister_device(&v4l2->radio_dev);
+		video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
@@ -2901,7 +2901,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
 		dev_info(&dev->intf->dev,
 			 "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		vb2_video_unregister_device(&v4l2->radio_dev);
+		video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev,

From 277157864856d812c82f1ca8c156b392d368b8c7 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 26 Sep 2026 17:06:03 +0100
Subject: [PATCH 0516/1982] ARM: 9524/1: mm: align hugetlb mappings to the huge
 page size

commit 1eb87d8f77379d4e4b279487b8c859fb64bd1afb upstream.

mmap(MAP_HUGETLB) on 32-bit Arm can return an address which is not
aligned to the huge page size. In a QEMU virt guest, unmapping the VMA
then hits the alignment check in __unmap_hugepage_range():

  kernel BUG at mm/hugetlb.c:5213!
  Internal error: Oops - BUG: 0 [#1] SMP ARM
  PC is at __unmap_hugepage_range+0x540/0x584
  LR is at __zap_vma_range+0x13a0/0x1410

Commit 7bd3f1e1a9ae ("mm: make hugetlb mappings go through
mm_get_unmapped_area_vmflags") made hugetlb mappings use the
architecture's arch_get_unmapped_area(). The generic implementations
handle hugetlb alignment, but the Arm implementations only account for
the optional SHMLBA cache-colouring constraint. A 4 KiB-page kernel can
therefore align the mapping to 4 KiB or 16 KiB instead of the required
2 MiB.

Set the alignment mask from the file's hstate for hugetlb mappings in
both Arm implementations. Huge-page alignment also satisfies the
SHMLBA constraint.

Assisted-by: LLM

Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
Cc: stable@vger.kernel.org
Acked-by: Muchun Song <muchun.song@linux.dev>
Link: https://lore.kernel.org/r/20260901085740.66283-1-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mm/mmap.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 3dbb383c26d543..dbb3f07a778528 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -11,6 +11,7 @@
 #include <linux/io.h>
 #include <linux/personality.h>
 #include <linux/random.h>
+#include <linux/hugetlb.h>
 #include <asm/cachetype.h>
 
 #define COLOUR_ALIGN(addr,pgoff)		\
@@ -72,7 +73,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 	info.length = len;
 	info.low_limit = mm->mmap_base;
 	info.high_limit = TASK_SIZE;
-	info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
+	if (filp && is_file_hugepages(filp))
+		info.align_mask = huge_page_mask_align(filp);
+	else
+		info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
 	info.align_offset = pgoff << PAGE_SHIFT;
 	return vm_unmapped_area(&info);
 }
@@ -123,7 +127,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 	info.length = len;
 	info.low_limit = FIRST_USER_ADDRESS;
 	info.high_limit = mm->mmap_base;
-	info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
+	if (filp && is_file_hugepages(filp))
+		info.align_mask = huge_page_mask_align(filp);
+	else
+		info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
 	info.align_offset = pgoff << PAGE_SHIFT;
 	addr = vm_unmapped_area(&info);
 

From 37c957fbc8ac0bfd85259b37f03e47006c8e35e8 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun@linux.alibaba.com>
Date: Fri, 23 Oct 2026 16:19:08 +0800
Subject: [PATCH 0517/1982] blk-crypto: fix NULL deref and UAF in
 __blk_crypto_evict_key()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c8c53d669d4e45b3a804013251a34387d7e11bfb upstream.

Sashiko reported a possible NULL pointer dereference, triggered by the
following flow:

  dm-inlinecrypt ctor            # first use of the fallback
   ├─ blk_crypto_init_key()      # succeeds, ctx->key.size != 0
   ├─ blk_crypto_start_using_key()
   │   ├─ hw-wrapped key: -EOPNOTSUPP
   │   │    # profile never allocated (NULL)
   │   └─ raw key: fallback_start_using_mode()
   │      └─ blk_crypto_fallback_init() fails
   │         └─ kfree(profile)   # not NULLed
   ├─ goto bad
   └─ inlinecrypt_dtr()          # evicts whenever key.size is set
      └─ blk_crypto_evict_key()
         └─ blk_crypto_config_supported_natively() = false
            └─ blk_crypto_fallback_evict_key()
               └─ __blk_crypto_evict_key(blk_crypto_fallback_profile)
                  └─ profile->num_slots # BOOM!!!

This issue can be reproduced using the following commands:

  dd if=/dev/zero of=/tmp/backing bs=1M count=64
  LOOP=$(losetup -f --show /tmp/backing)
  SZ=$(blockdev --getsz $LOOP)
  KEY=$(head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n')
  dmsetup create ic --table "0 $SZ inlinecrypt aes-xts-plain64 \
    $KEY 0 $LOOP 0 1 keytype:hw-wrapped"

And the following oops is triggered:

  ==================================================================
  blk-crypto: loop0: no support for wrapped keys
  Oops: general protection fault, probably for non-canonical address
        0xdffffc000000000b: 0000 [#1] SMP KASAN PTI
  KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
  CPU: 5 UID: 0 PID: 901 Comm: dmsetup 7.3.0-rc3 #1 PREEMPT(lazy)
  RIP: 0010:__blk_crypto_evict_key+0x2e/0x3b0
  Call Trace:
   blk_crypto_evict_key+0x24c/0x320
   inlinecrypt_dtr+0xf6/0x160
   inlinecrypt_ctr+0x2d3/0xbd0
   dm_table_add_target+0x661/0xf40
   table_load+0x1c4/0x490
   ctl_ioctl+0x32f/0x5f0
   dm_ctl_ioctl+0xe/0x20
  ==================================================================

dm-inlinecrypt is the only caller that can evict a key that was never
started, as fscrypt frees such a key without evicting it.

Fix this by returning early from blk_crypto_fallback_evict_key() when
tfms_inited[] is not set for the key's mode.  tfms_inited[] is only set
after blk_crypto_fallback_init() has successfully initialized the
profile, so the crash above is no longer reachable.

The bug has been latent since commit c984ff1423ae ("blk-crypto:
dynamically allocate fallback profile") was merged in v6.5, and only
became actually triggerable when commit e7f57d2c47e2 ("dm-inlinecrypt:
add target for inline block device encryption") was merged in v7.2.

Fixes: c984ff1423ae ("blk-crypto: dynamically allocate fallback profile")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://patch.msgid.link/sashiko-outbox-167341@kernel.org
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20261014155131.GB322435@quark
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20261023081908.3505413-1-libaokun@linux.alibaba.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-crypto-fallback.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/block/blk-crypto-fallback.c b/block/blk-crypto-fallback.c
index f523b0cf143afd..df0471a7194358 100644
--- a/block/blk-crypto-fallback.c
+++ b/block/blk-crypto-fallback.c
@@ -465,6 +465,12 @@ bool blk_crypto_fallback_bio_prep(struct bio *bio)
 
 int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key)
 {
+	/*
+	 * Pairs with smp_store_release() in
+	 * blk_crypto_fallback_start_using_mode()
+	 */
+	if (!smp_load_acquire(&tfms_inited[key->crypto_cfg.crypto_mode]))
+		return 0;
 	return __blk_crypto_evict_key(blk_crypto_fallback_profile, key);
 }
 

From 49d7c1beac3810983869ed9260dcd444b6a51c8e Mon Sep 17 00:00:00 2001
From: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Date: Wed, 30 Sep 2026 15:09:45 +0800
Subject: [PATCH 0518/1982] ceph: fail readdir when the MDS reply carries no
 dirfrag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 728c856d7da04fb79f7aa00e974ffb6f55e55995 upstream.

A ceph mount oopses in ceph_readdir() when the MDS answers a READDIR
request with a reply whose extra blob is empty.  parse_reply_info()
skips reply blobs whose length is zero, so parse_reply_info_readdir()
never runs, r_reply_info.dir_dir stays NULL, and the reply still
parses as successful.  ceph_mdsc_do_request() returns 0 and
ceph_readdir() then reads rinfo->dir_dir->frag with no NULL check:

	/* extra */
	ceph_decode_32_safe(&p, end, len, bad);
	if (len > 0) {
		...
		err = parse_reply_info_extra(&p, p + len, req, features, s);
		...
	}

The oops on v7.3.0-rc4-00537-ga3ff15db6820, one getdents64(2) on the
mount root after an ms_mode=legacy mount, trimmed:

BUG: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 266 Comm: ls Tainted: G                 N  7.3.0-rc4-00537-ga3ff15db6820 #1 PREEMPT(lazy)
RIP: 0010:ceph_readdir+0xbff/0x3ea0
Call Trace:
 <TASK>
 ? __pfx_ceph_readdir+0x10/0x10
 wrap_directory_iterator+0xa2/0xe0
 iterate_dir+0x1da/0x5d0
 __x64_sys_getdents64+0x13b/0x2a0
 do_syscall_64+0xdd/0x4a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

The unconditional frag read came in with 81c6aea5275ea ("ceph: handle
frag mismatch between readdir request and reply"), so the bug is old.

Treat a reply with no dirfrag as a protocol violation: warn once,
drop the request and return -EIO, the same way ceph_readdir() already
handles the two malformed-reply cases later in the function.

Tested on v7.3.0-rc4-00537-ga3ff15db6820 (KASAN).  Unpatched, the
getdents64(2) above takes the machine down (oops=panic) on the first
READDIR reply.  With the patch it warns once and getdents64(2)
returns -EIO, no oops, no hang.  A conformant reply for an empty
directory — dirfrag present, zero entries, FRAG_END|FRAG_COMPLETE —
still lists "." and ".." and returns EOF on both kernels, so normal
readdir behavior is unchanged.  The oops is still present in
v7.3-rc5 (72d3fcf802c45).

Cc: stable@vger.kernel.org
Fixes: 81c6aea5275ea ("ceph: handle frag mismatch between readdir request and reply")
Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/dir.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index a253286214feee..94fc358f6c8596 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -466,6 +466,10 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
 		      (int)req->r_reply_info.hash_order);
 
 		rinfo = &req->r_reply_info;
+		if (WARN_ON_ONCE(!rinfo->dir_dir)) {
+			ceph_mdsc_put_request(req);
+			return -EIO;
+		}
 		if (le32_to_cpu(rinfo->dir_dir->frag) != frag) {
 			frag = le32_to_cpu(rinfo->dir_dir->frag);
 			if (!rinfo->hash_order) {

From 61adcab593ff6bb806ba09df8c2c3d7e19edc908 Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Thu, 10 Sep 2026 16:51:09 -0700
Subject: [PATCH 0519/1982] fuse: don't BUG when the copy buffer is exhausted

commit c1338aae7b4054e26f322155423f6aba90aeea23 upstream.

fuse_copy_fill() hits BUG_ON(!err) once the iterator backing the copy
runs out of pages.  Over io-uring the amount copied is not bounded by the
payload buffer the server registered, so an unprivileged user can drain
the iterator and panic the host - mount a FUSE filesystem with small
payload buffers, then setxattr() a larger value:

  kernel BUG at fs/fuse/dev.c:1064!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  CPU: 1 UID: 0 PID: 148 Comm: exploit Not tainted 7.3.0-rc1 #2
  RIP: 0010:fuse_copy_fill (fs/fuse/dev.c:1033)
  Call Trace:
   <TASK>
   fuse_copy_args (fs/fuse/dev.c:1354 fs/fuse/dev.c:1380)
   fuse_uring_args_to_ring (fs/fuse/dev_uring.c:891)
   fuse_uring_prepare_send (fs/fuse/dev_uring.c:940 fs/fuse/dev_uring.c:1057)
   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1745)
   tctx_task_work_run (io_uring/tw.c:96)
   tctx_task_work (io_uring/tw.c:133)
   task_work_run (kernel/task_work.c:233)
   io_run_task_work (io_uring/tw.h:84)
   io_cqring_wait (io_uring/wait.c:278)
   __do_sys_io_uring_enter (io_uring/io_uring.c:2676)
   do_syscall_64 (arch/x86/entry/syscall_64.c:61)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

The reply path can drain it the same way, via the server-supplied
payload_sz in fuse_uring_copy_from_ring().

Return -EIO instead.  All three fuse_copy_fill() callers already
propagate the error.

Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Suggested-by: Joanne Koong <joannelkoong@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 7c884532d9e736..69d178c9b39490 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -937,7 +937,8 @@ static int fuse_copy_fill(struct fuse_copy_state *cs)
 		err = iov_iter_get_pages2(cs->iter, &page, PAGE_SIZE, 1, &off);
 		if (err < 0)
 			return err;
-		BUG_ON(!err);
+		if (!err)
+			return -EIO;
 		cs->len = err;
 		cs->offset = off;
 		cs->pg = page;

From 068d3950e7180ee77faea2af617d32b8284e7d9f Mon Sep 17 00:00:00 2001
From: Fang Xieyan <fangxy@xiaopeng.com>
Date: Thu, 17 Sep 2026 18:43:06 +0800
Subject: [PATCH 0520/1982] kcov: ignore an out-of-range comparison count in
 write_comp_data()

commit f5263bee9eb84d2388fd7555a18d518e17226894 upstream.

write_comp_data() reads the comparison record count from area[0] and uses
it to index the coverage buffer:

	area = (u64 *)t->kcov_area;
	max_pos = t->kcov_size * sizeof(unsigned long);

	count = READ_ONCE(area[0]);

	/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
	start_index = 1 + count * KCOV_WORDS_PER_CMP;
	end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
	if (likely(end_pos <= max_pos)) {

The buffer is mmap'd writable into the collecting process, so count is
under its control and end_pos <= max_pos is its only bound.  A count that
wraps the u64 multiply leaves end_pos below max_pos, so the check passes
while the record store lands 24 bytes before the buffer, in the unmapped
vmalloc guard page, and faults:

  BUG: unable to handle page fault for address: ffa0000000b60fe8
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  Oops: 0002 [#1] SMP KASAN NOPTI
  RIP: 0010:write_comp_data+0x7e/0xa0
  ...
  Kernel panic - not syncing: Fatal exception

Bound count first: only max_pos / (sizeof(u64) * KCOV_WORDS_PER_CMP)
records fit, so a larger count is not a valid index and is dropped.
kcov_move_area() bounds the same untrusted count this way, and no count
the end_pos <= max_pos check accepts reaches that limit, so no valid
record is lost.

kcov is a root-only debugfs file (debugfs_create_file_unsafe("kcov", 0600,
...)) and write_comp_data() exists only under
CONFIG_KCOV_ENABLE_COMPARISONS, so this is a local, debug-kernel
robustness fix: the process corrupts its own buffer and the kernel oopses.
It crosses no privilege boundary.  Additional details at [1]

Link: https://lore.kernel.org/20260917104306.22145-1-fangxy@xiaopeng.com [1]
Fixes: ded97d2c2b2c ("kcov: support comparison operands collection")
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alexander Potapenko <glider@google.com>
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Victor Chibotaru <tchibo@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kcov.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/kcov.c b/kernel/kcov.c
index c0d2357c9046e1..2546992d2c810f 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -253,6 +253,14 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 
 	count = READ_ONCE(area[0]);
 
+	/*
+	 * area[0] is writable by the collecting process, so count cannot be
+	 * trusted. Bound it to the records that fit, as kcov_move_area()
+	 * does, so the end_pos multiply below cannot wrap past its check.
+	 */
+	if (count >= max_pos / (sizeof(u64) * KCOV_WORDS_PER_CMP))
+		return;
+
 	/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
 	start_index = 1 + count * KCOV_WORDS_PER_CMP;
 	end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);

From c93505aa0b2923c8116d3266b6708c94666eaa47 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Wed, 30 Sep 2026 15:38:30 +0200
Subject: [PATCH 0521/1982] kcsan: Avoid division by zero in
 kcsan_prandom_u32_max()

commit 99b6fcce87037cfb6b5e177848342e97f5141205 upstream.

KCSAN's skip_watch, udelay_task and udelay_interrupt parameters can be
changed at runtime through /sys/module/kcsan/parameters/, where 0 means
watching every access or not delaying at all. With the default
CONFIG_KCSAN_SKIP_WATCH_RANDOMIZE=y and CONFIG_KCSAN_DELAY_RANDOMIZE=y,
writing 0 to any of them makes the next watchpoint setup divide by zero:

  # echo 0 > /sys/module/kcsan/parameters/udelay_task
  Oops: divide error: 0000 [#1] SMP NOPTI
  CPU: 0 UID: 0 PID: 93 Comm: sh Not tainted 7.3.0-rc5 #3 PREEMPT(lazy)
  RIP: 0010:kcsan_setup_watchpoint+0x1b5/0x410
  Code: ... 65 89 05 ad 8d 98 02 d3 ee <f7> f6 29 d7 e8 22 0e 0f 01 ...
  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
  ...
   __show_trace_log_lvl+0x1bd/0x315
   __die_body.cold+0x19/0x2b
   die+0x34/0x50
  ...
  BUG: TASK stack guard page was hit at ffffd3ab001fbfe8 (...)

reset_kcsan_skip() and delay_access() pass these values unchecked to
kcsan_prandom_u32_max(), which returns "state % ep_ro". delay_access()
halves the delay for compound and assert accesses, so
udelay_interrupt=1 is enough there.

The oops path runs instrumented code, which faults again until the stack
overflows. With skip_watch=0 the guest hangs without printing anything.

The division came in with commit 71a076f4a61a ("kcsan: Rewrite
kcsan_prandom_u32_max() without prandom_u32_state()"). Before it, the
helper scaled the random value with a multiply-shift, which yields 0 for
ep_ro == 0. Go back to that via reciprocal_scale().

Tested in an x86-64 KCSAN guest with virtme-ng: after this patch,
writing 0 to each parameter, or 1 to udelay_interrupt, no longer
oopses. skip_watch=0 now watches every access, which is very slow with
the default delays but completes when they are set to 0.

Fixes: 71a076f4a61a ("kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Marco Elver <elver@google.com>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kcsan/core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
index 2db82661cd60a1..a3aa5e5b039dc3 100644
--- a/kernel/kcsan/core.c
+++ b/kernel/kcsan/core.c
@@ -290,8 +290,9 @@ should_watch(struct kcsan_ctx *ctx, const volatile void *ptr, size_t size, int t
 }
 
 /*
- * Returns a pseudo-random number in interval [0, ep_ro). Simple linear
- * congruential generator, using constants from "Numerical Recipes".
+ * Returns a pseudo-random number in interval [0, ep_ro), or 0 if ep_ro is 0,
+ * which the runtime-tunable callers may pass. Simple linear congruential
+ * generator, using constants from "Numerical Recipes".
  */
 static u32 kcsan_prandom_u32_max(u32 ep_ro)
 {
@@ -300,7 +301,7 @@ static u32 kcsan_prandom_u32_max(u32 ep_ro)
 	state = 1664525 * state + 1013904223;
 	this_cpu_write(kcsan_rand_state, state);
 
-	return state % ep_ro;
+	return reciprocal_scale(state, ep_ro);
 }
 
 static inline void reset_kcsan_skip(void)

From 04a04953b4828bfd8efd4ea3e7e9ad7dac5b083b Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Mon, 14 Sep 2026 18:42:43 -0700
Subject: [PATCH 0522/1982] libceph: bound mon_command ack decode to front len

commit 62b41a16d8603d4d809fda212f15c3e9c783a82b upstream.

handle_command_ack() bounds the decode with msg->front_alloc_len, the size
of the reply buffer, instead of msg->front.iov_len, the number of bytes the
monitor sent.  mon_alloc_msg() routes every CEPH_MSG_MON_COMMAND_ACK to
get_generic_reply(), which returns the preallocated ->reply of whichever
generic request carries the same tid, so the buffer keeps its fixed size
however short the reply is.  An ack with hdr.front_len below sizeof(struct
ceph_mon_request_header) + sizeof(u32), including 0, still passes
ceph_decode_need(), and ceph_decode_32() returns four bytes that were never
received: uninitialized slab memory, stale bytes of an earlier message, or
bytes the peer planted by sending a reply that lands in the same buffer and
is then rejected.  The read stays within the allocation, so KASAN does not
flag it.

req->result reaches userspace through ceph_monc_do_statfs(),
ceph_monc_get_version() and ceph_monc_blocklist_add(); rbd hands it back
from write() on /sys/bus/rbd/add_single_major, and rbd_get_client() passes
it to ERR_PTR() unchecked, which faults:

  rbd: failed to get latest osdmap: -186318427
  BUG: unable to handle page fault for address: fffffbfffe9ca034
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:do_rbd_add (drivers/block/rbd.c:7105)
  Call Trace:
   ...
   kernfs_fop_write_iter (fs/kernfs/file.c:345)
   vfs_write (fs/read_write.c:595 fs/read_write.c:687)
   ksys_write (fs/read_write.c:739)
   do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  Kernel panic - not syncing: Fatal exception

Use msg->front.iov_len, matching handle_subscribe_ack(),
handle_statfs_reply(), handle_get_version_reply() and handle_auth_reply().
A well-formed ack has front.iov_len >= 22 and is unaffected; a short one
takes the existing bad: path.  This applies commit d3c32939fa0e ("libceph:
bound get_version reply decode to front len") to the last decode-side
use of front_alloc_len in this file.

Cc: stable@vger.kernel.org
Fixes: 6305a3b41515 ("libceph: support for blacklisting clients")
Reported-by: co+25860fb17af97289@bugs.sh
Assisted-by: Cursor
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/mon_client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 96c9c4d0a375ef..614d2bba9fd60c 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -943,7 +943,7 @@ static void handle_command_ack(struct ceph_mon_client *monc,
 {
 	struct ceph_mon_generic_request *req;
 	void *p = msg->front.iov_base;
-	void *const end = p + msg->front_alloc_len;
+	void *const end = p + msg->front.iov_len;
 	u64 tid = le64_to_cpu(msg->hdr.tid);
 
 	dout("%s msg %p tid %llu\n", __func__, msg, tid);

From 324d30da90f26286eccc3d8d20ceab927460d52a Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sun, 13 Sep 2026 22:28:09 -0400
Subject: [PATCH 0523/1982] media: cx88: Disable PCI device on MPEG
 initialization failure

commit 80494a83223bc972145c23890b083d20651512bd upstream.

cx8802_init_common() enables the PCI device, then returns directly if
DMA mask setup or IRQ registration fails. cx8802_probe() frees the
device and drops the shared core reference without disabling PCI.

Disable the PCI device on both post-enable failures. Preserve -EIO for
a DMA mask failure and the original request_irq() error. Do not call
the full fini helper because the IRQ was not successfully requested.
The successful probe and normal removal paths are unchanged.

These missing error-path disables are present in the initial Git import.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/cx88/cx88-mpeg.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
index bc08b35e247e01..5f968c33d4b036 100644
--- a/drivers/media/pci/cx88/cx88-mpeg.c
+++ b/drivers/media/pci/cx88/cx88-mpeg.c
@@ -392,7 +392,8 @@ static int cx8802_init_common(struct cx8802_dev *dev)
 	err = dma_set_mask(&dev->pci->dev, DMA_BIT_MASK(32));
 	if (err) {
 		pr_err("Oops: no 32bit PCI DMA ???\n");
-		return -EIO;
+		err = -EIO;
+		goto fail_disable_device;
 	}
 
 	dev->pci_rev = dev->pci->revision;
@@ -413,13 +414,17 @@ static int cx8802_init_common(struct cx8802_dev *dev)
 			  IRQF_SHARED, dev->core->name, dev);
 	if (err < 0) {
 		pr_err("can't get IRQ %d\n", dev->pci->irq);
-		return err;
+		goto fail_disable_device;
 	}
 	cx_set(MO_PCI_INTMSK, core->pci_irqmask);
 
 	/* everything worked */
 	pci_set_drvdata(dev->pci, dev);
 	return 0;
+
+fail_disable_device:
+	pci_disable_device(dev->pci);
+	return err;
 }
 
 static void cx8802_fini_common(struct cx8802_dev *dev)

From dc0072c1b40fc376c6cbe821de947f3744ab254b Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Sat, 12 Sep 2026 17:29:45 -0700
Subject: [PATCH 0524/1982] media: em28xx: reject audio endpoint with zero
 packet size

commit aebfe430ba885d2f8fc882d7a6d60a7fdbe535d8 upstream.

em28xx_audio_urb_init() divides by the audio endpoint's wMaxPacketSize
without checking it, so a USB device that declares a zero-sized audio
endpoint divides by zero at probe time.

Reject a zero-sized audio endpoint like a missing one; the caller already
unwinds on a negative return.

  Oops: divide error: 0000 [#1] SMP NOPTI
  Workqueue: usb_hub_wq hub_event
  RIP: 0010:em28xx_audio_init (drivers/media/usb/em28xx/em28xx-audio.c:718)
  Call Trace:
   em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
   em28xx_init_dev.isra.0 (drivers/media/usb/em28xx/em28xx-cards.c:3887)
   em28xx_usb_probe (drivers/media/usb/em28xx/em28xx-cards.c:4258)
   usb_probe_interface (drivers/usb/core/driver.c:396)
   ...
   usb_set_configuration (drivers/usb/core/message.c:2268)
   usb_generic_driver_probe (drivers/usb/core/generic.c:250)
   usb_probe_device (drivers/usb/core/driver.c:291)
   ...
   usb_new_device (drivers/usb/core/hub.c:2703)
   hub_event (drivers/usb/core/hub.c:5961)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  Kernel panic - not syncing: Fatal exception

Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")
Cc: stable@vger.kernel.org
Reported-by: co+9782320f78c23f40@bugs.sh
Closes: https://lore.kernel.org/all/51lCz4R7QyTUKbh4mhXNaNzX0evpk0siOzbh%40bugs.sh/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/em28xx/em28xx-audio.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/media/usb/em28xx/em28xx-audio.c b/drivers/media/usb/em28xx/em28xx-audio.c
index ce1b0d9e0741de..2247bd08195c2b 100644
--- a/drivers/media/usb/em28xx/em28xx-audio.c
+++ b/drivers/media/usb/em28xx/em28xx-audio.c
@@ -693,6 +693,13 @@ static int em28xx_audio_urb_init(struct em28xx *dev)
 	}
 
 	ep_size = em28xx_audio_ep_packet_size(udev, ep);
+	if (ep_size == 0) {
+		dev_err(&dev->intf->dev,
+			"Audio endpoint 0x%02x has a zero packet size\n",
+			EM28XX_EP_AUDIO);
+		return -ENODEV;
+	}
+
 	interval = 1 << (ep->bInterval - 1);
 
 	dev_info(&dev->intf->dev,

From 8e2fc3941b4005eaeef0a6b69b44a8a4941b57ab Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Tue, 15 Sep 2026 20:45:34 -0700
Subject: [PATCH 0525/1982] media: go7007: only set audio_enabled if
 go7007_snd_init() succeeded

commit 2eacf058d2dbb0ae3aaf576459da9e5f2b6bbfbd upstream.

go7007_register_encoder() sets go->audio_enabled before calling
go7007_snd_init() and discards its return value.  go7007_snd_init()
assigns go->snd_context only on success, so a failed ALSA setup leaves
audio_enabled set with snd_context still NULL.  The disconnect path tests
audio_enabled and calls go7007_snd_remove(), which dereferences
snd_context unconditionally.

go7007_snd_init() returns -ENODEV once its never-decremented static card
counter reaches SNDRV_CARDS, so SNDRV_CARDS attach/detach cycles arm the
next attach; no memory pressure is needed.

Set go->audio_enabled only once go7007_snd_init() has succeeded.

  Oops: general protection fault, probably for non-canonical address ...
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  Workqueue: usb_hub_wq hub_event
  RIP: 0010:go7007_snd_remove (drivers/media/usb/go7007/snd-go7007.c:273)
  Call Trace:
   go7007_usb_disconnect (drivers/media/usb/go7007/go7007-usb.c:1336)
   usb_unbind_interface (drivers/usb/core/driver.c:461)
   device_remove (drivers/base/dd.c:618)
   device_release_driver_internal (drivers/base/dd.c:1349)
   bus_remove_device (drivers/base/bus.c:664)
   device_del (drivers/base/core.c:3965)
   usb_disable_device (drivers/usb/core/message.c:1478)
   usb_disconnect
   hub_event (drivers/usb/core/hub.c:5966)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  Kernel panic - not syncing: Fatal exception

Cc: stable@vger.kernel.org
Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/go7007/go7007-driver.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
index 468406302cd5a4..db1e7f1c2d5df9 100644
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -306,10 +306,9 @@ int go7007_register_encoder(struct go7007 *go, unsigned num_i2c_devs)
 	if (ret < 0)
 		return ret;
 
-	if (go->board_info->flags & GO7007_BOARD_HAS_AUDIO) {
+	if ((go->board_info->flags & GO7007_BOARD_HAS_AUDIO) &&
+	    go7007_snd_init(go) == 0)
 		go->audio_enabled = 1;
-		go7007_snd_init(go);
-	}
 	return 0;
 }
 EXPORT_SYMBOL(go7007_register_encoder);

From f9af5772ff0ef32fa4ffb43fc10861823e6a06e3 Mon Sep 17 00:00:00 2001
From: Kaho Jiang <kj2864@nyu.edu>
Date: Wed, 21 Oct 2026 19:57:33 -0400
Subject: [PATCH 0526/1982] net: ipv4: add zero check for snd_cwnd_clamp

commit 363c8c79220d0db4d65dcd570529ddda15067cb5 upstream.

When RTAX_CWND is locked, user is able to pass 0 into it.
This could lead to writing 0 to tp->snd_cwnd, leading to a
division by zero error.

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
Call Trace:
 <IRQ>
 tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
 tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
 tcp_rcv_established (net/ipv4/tcp_input.c:6685)
 tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
 tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
 ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
 ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
 ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
 ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
 __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
 __netif_receive_skb (net/core/dev.c:6410)
 process_backlog (net/core/dev.c:6761)
 __napi_poll.constprop.0 (net/core/dev.c:7830)
 net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
 handle_softirqs (kernel/softirq.c:645)
 __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
 irq_exit_rcu (kernel/softirq.c:775)
 sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)

Fix by checking if user pass in zero as parameter and if lock is present.

Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
Cc: stable@vger.kernel.org
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Reported-by: co+71b6509cb791e531@bugs.sh
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261021235732.1313305-2-kj2864@nyu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/metrics.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index 8ddac1f595ed8c..71704a586b39bc 100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -60,6 +60,11 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
 	if (ecn_ca)
 		metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
 
+	if ((metrics[RTAX_LOCK - 1] & (1 << RTAX_CWND)) && !metrics[RTAX_CWND - 1]) {
+		NL_SET_ERR_MSG(extack, "Locked cwnd metric must be non zero");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 

From 00c0c940c1c8941497a8cf511edc95fdde8c6382 Mon Sep 17 00:00:00 2001
From: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Date: Wed, 21 Oct 2026 10:03:09 +0800
Subject: [PATCH 0527/1982] net: usb: pegasus: do not advance rx_skb->data on
 dropped frames

commit bfa09dccf98cf78dd9282259b2140bd1472f5ae9 upstream.

For the 0x8513 chip, read_bulk_callback() skips the 2-byte receive
header by advancing pegasus->rx_skb->data in place. This is done before
the pkt_len > PEGASUS_MTU check, and when that check drops the frame
the good path resubmits the same skb with the advanced rx_skb->data as
the transfer buffer, still PEGASUS_MTU bytes long.

Every frame with an oversized length field therefore moves the receive
buffer two more bytes towards the end of the skb data area. A device
that keeps sending such frames makes the host controller write received
data over skb_shared_info and past the end of the allocation, and the
corrupted skb_shared_info is used when the skb is eventually freed.
With an emulated device sending frames filled with 0x5a on a KASAN
kernel:

  BUG: KASAN: slab-out-of-bounds in dummy_timer+0xade/0x3f00 [dummy_hcd]
  Write of size 1536 at addr ffff888105821202 by task swapper/1/0
  ...
  Oops: general protection fault, probably for non-canonical address 0xeb4b474b4b4b4b4c: 0000 [#1] PREEMPT SMP KASAN NOPTI
  KASAN: maybe wild-memory-access in range [0x5a5a5a5a5a5a5a60-0x5a5a5a5a5a5a5a67]
  RIP: 0010:skb_release_data+0x36f/0x800

Only skip the header with skb_reserve() once the frame is going to be
passed up, so the receive buffer always starts at the beginning of the
skb data area. Unlike the old pointer adjustment, skb_reserve() also
moves skb->tail, so the two header bytes now count against the buffer
size: lower the length limit for the 0x8513 accordingly, otherwise a
pkt_len of PEGASUS_MTU - 1 or PEGASUS_MTU would trip skb_over_panic().

Found by code review with LLM assistance and reproduced with an
emulated USB device (raw-gadget + dummy_hcd).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261021020310.34045-2-law.wei.jie@gt.tech.gov.sg
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/pegasus.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 8ec798f97f99b6..f5a26a0bc679a1 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -464,6 +464,7 @@ static void read_bulk_callback(struct urb *urb)
 	u8 *buf = urb->transfer_buffer;
 	int rx_status, count = urb->actual_length;
 	int status = urb->status;
+	int rx_offset = 0;
 	__u16 pkt_len;
 
 	if (!pegasus)
@@ -513,7 +514,7 @@ static void read_bulk_callback(struct urb *urb)
 	if (pegasus->chip == 0x8513) {
 		pkt_len = le32_to_cpu(*(__le32 *)urb->transfer_buffer);
 		pkt_len &= 0x0fff;
-		pegasus->rx_skb->data += 2;
+		rx_offset = 2;
 	} else {
 		pkt_len = buf[count - 3] << 8;
 		pkt_len += buf[count - 4];
@@ -525,13 +526,14 @@ static void read_bulk_callback(struct urb *urb)
 	 * If the packet is unreasonably long, quietly drop it rather than
 	 * kernel panicing by calling skb_put.
 	 */
-	if (pkt_len > PEGASUS_MTU)
+	if (pkt_len > PEGASUS_MTU - rx_offset)
 		goto goon;
 
 	/*
 	 * at this point we are sure pegasus->rx_skb != NULL
 	 * so we go ahead and pass up the packet.
 	 */
+	skb_reserve(pegasus->rx_skb, rx_offset);
 	skb_put(pegasus->rx_skb, pkt_len);
 	pegasus->rx_skb->protocol = eth_type_trans(pegasus->rx_skb, net);
 	netif_rx(pegasus->rx_skb);

From f43a5d7b665cf04199a3e8ea0dddc9e2dbd5ada6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ameer.hamza@truenas.com>
Date: Sun, 26 Jul 2026 17:46:58 +0500
Subject: [PATCH 0528/1982] nfsd: fix race between client_info_show() and
 free_client()

commit ee62dc03a69ee57855de35da1a8ab53b51d30b32 upstream.

client_info_show() renders /proc/fs/nfsd/clients/<id>/info and walks
clp->cl_sessions under clp->cl_lock to print each session's slot
counts.  free_client() tears down the same list without taking
cl_lock, and is the only unlocked mutator of cl_sessions.  A reader
can observe a client mid-teardown because get_nfsdfs_clp() pins the
nfs4_client but not its sessions: free_client() frees every session
before calling nfsd_client_rmdir(), so an in-flight seq_file reader
can follow a list_del()'d node whose ->next now holds LIST_POISON1
and take a general protection fault:

  Oops: general protection fault, probably for non-canonical address
        0xdead00000000014c
  CPU: 1 UID: 0 PID: 132488 Comm: cat
  RIP: 0010:client_info_show+0x2bf/0x3d0
  RAX: dead000000000100
  Call Trace:
   seq_read_iter+0x12a/0x4b0
   seq_read+0xf1/0x130
   vfs_read+0xbf/0x350
   ksys_read+0x6f/0xf0
   do_syscall_64+0x8b/0xcb0
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  Kernel panic - not syncing: Fatal exception

Detach cl_sessions onto a local reaplist under cl_lock, then free the
sessions after dropping the lock.  Removing entries from cl_sessions
under cl_lock matches unhash_session(), and the detach-then-reap shape
matches how __destroy_client() reaps cl_delegations.  The sessions
cannot be freed while cl_lock is held, since free_session() calls
nfsd4_del_conns(), which re-acquires it.

Reported-by: Nicholas Wolff <nicholas.wolff@truenas.com>
Fixes: 601c8cb349c2 ("nfsd: add session slot count to /proc/fs/nfsd/clients/*/info")
Cc: stable@vger.kernel.org
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Link: https://patch.msgid.link/20260726124658.1715711-1-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 59a9ce4858b0a1..b3ad502d89eb38 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2539,10 +2539,16 @@ static void drop_client(struct nfs4_client *clp)
 static void
 free_client(struct nfs4_client *clp)
 {
-	while (!list_empty(&clp->cl_sessions)) {
+	LIST_HEAD(reaplist);
+
+	/* client_info_show() walks cl_sessions under cl_lock */
+	spin_lock(&clp->cl_lock);
+	list_splice_init(&clp->cl_sessions, &reaplist);
+	spin_unlock(&clp->cl_lock);
+	while (!list_empty(&reaplist)) {
 		struct nfsd4_session *ses;
-		ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
-				se_perclnt);
+		ses = list_entry(reaplist.next, struct nfsd4_session,
+				 se_perclnt);
 		list_del(&ses->se_perclnt);
 		WARN_ON_ONCE(atomic_read(&ses->se_ref));
 		free_session(ses);

From 912327bb4cfdc38e83dd52300a087a7e68826ece Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Thu, 22 Oct 2026 17:09:10 +0800
Subject: [PATCH 0529/1982] ocfs2/dlm: drain join handlers before releasing
 module text

commit 28f366d84023651e50e32e29931401ba0df3e679 upstream.

The code for a registered DLM handler must remain resident until its
last invocation finishes. dlm_unregister_net_handlers() only removes
dlm_join_handlers from the o2net registry. o2net_handler_get() takes a
kref on the wrapper, but that reference does not pin ocfs2_dlm text.
o2net_process_message() calls nh_func after dropping o2net_handler_lock.

With CONFIG_OCFS2_FS_O2CB=m, ocfs2_dlm can be loaded independently of
ocfs2_stack_o2cb while nodemanager continues handling messages from a
configured, heartbeating peer. If no dependent module or module reference
prevents normal unload, the following ordering is possible:

  Receive worker                       Module unload
  --------------                       -------------
  o2net_handler_get()
    take wrapper kref
    drop handler lock
  <preempted>
                                       dlm_exit()
                                         unregister handlers
                                       release DLM module text
  call saved nh_func
    in released module text

Use o2net_unregister_and_flush_handler_list() in the shared DLM
unregister helper. It first prevents new lookups, then waits for the
ordered o2net workqueue to drain, including a concurrent destruction of
that queue. The acquired invocation therefore finishes before dlm_exit()
returns and the loader releases the callback code. The same helper
covers partial registration and dlm_init() error unwind before module
memory is released.

Skip the drain when the private join-handler list is empty. Early
dlm_init() failures can reach this helper before any handler has been
published. Partial-registration failure also reaches it a second time
after the first call has already unregistered and drained the list.
Neither case needs to take o2net_wq_mutex or drain unrelated work.
The list is changed only by serialized module init/exit paths; a
nonempty list still uses the full unregister-and-flush helper.

Oops report as below:

    Oops: int3: 0000 [#1] SMP KASAN NOPTI
    CPU: 2 UID: 0 PID: 54 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)

Hardware identification omitted.

    Workqueue: o2net o2net_rx_until_empty [ocfs2_nodemanager]
    RIP: 0010:0xffffffffc0423871
    [Instruction byte dump omitted.]

Register dump omitted.

    Call Trace:
     <TASK>
     ? o2net_rx_until_empty+0x19b1/0x3300 [ocfs2_nodemanager]
     ? __pfx_o2net_rx_until_empty+0x10/0x10 [ocfs2_nodemanager]
     ? lock_acquire+0x190/0x300
     ? process_one_work+0x935/0x1b40
     ? process_one_work+0x834/0x1b40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? process_one_work+0x9a8/0x1b40
     ? __pfx_process_one_work+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? lock_is_held_type+0x8f/0x100
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? worker_thread+0x65c/0xe40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __kthread_parkme+0x177/0x220
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_worker_thread+0x10/0x10
     ? kthread+0x351/0x460
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_kthread+0x10/0x10
     ? ret_from_fork+0x659/0x940
     ? __pfx_ret_from_fork+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __switch_to+0x74f/0xf70
     ? __pfx_kthread+0x10/0x10
     ? ret_from_fork_asm+0x1a/0x30
     </TASK>
    Modules linked in: ocfs2_nodemanager [last unloaded: ocfs2_dlm]
    ---[ end trace 0000000000000000 ]---

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0076-v6-12de5f4628f57fba3be3@gmail.com
Fixes: 6714d8e86bf4 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/dlm/dlmdomain.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 09bee7b86815eb..c8ccee42c843a1 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -2213,7 +2213,8 @@ static LIST_HEAD(dlm_join_handlers);
 
 static void dlm_unregister_net_handlers(void)
 {
-	o2net_unregister_handler_list(&dlm_join_handlers);
+	if (!list_empty(&dlm_join_handlers))
+		o2net_unregister_and_flush_handler_list(&dlm_join_handlers);
 }
 
 static int dlm_register_net_handlers(void)

From 1c77b387fc305c9c314f29cd034a490bff7f81bd Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Tue, 20 Oct 2026 11:45:04 +0800
Subject: [PATCH 0530/1982] ocfs2: drain quorum work before removing the
 cluster

commit b584c45b6066fd9799c44ffb9badcb5db351c8a6 upstream.

The configured cluster must remain available until an in-flight quorum
decision has finished using its fencing method.  o2quo_make_decision()
drops qs_lock before calling o2quo_fence_self(), which marks heartbeat
regions for unclean stop and then reads
o2nm_single_cluster->cl_fence_method.  Cluster removal clears the
singleton without waiting for this independent system-workqueue item.

When a failed-quorum decision overlaps removal of the heartbeat regions,
nodes and cluster through configfs, the worker can be preempted after
marking the regions and resume after the singleton has been cleared:

  Quorum worker                     Configfs removal
  select fence; drop qs_lock
  o2hb_stop_all_regions()
                                    remove regions; join heartbeat threads
                                    remove nodes; stop o2net
                                    clear singleton; release cluster
  read cl_fence_method

The resumed read dereferences NULL instead of applying the configured
fencing method. The heartbeat thread's dependency protects the local
node only until the thread exits, and draining o2net does not wait for
qs_work.

Add o2quo_flush_work() to drain pending or running quorum decisions
before clearing the singleton in o2nm_cluster_group_drop_item(). By
this point the heartbeat regions and nodes have been removed, so their
work publishers are stopped. The worker can finish while the cluster
and its configured fencing method remain available. It does not acquire
the configfs mutex held by the removal path.

Keep o2quo_exit() as the counterpart of o2quo_init() for module teardown
and initialization failure, and have it call the same drain helper.
Cluster removal uses only the explicitly named drain operation.

KASAN report as below:

    Oops: general protection fault, probably for non-canonical address 0xdffffc000000011b: 0000 [#1] SMP KASAN NOPTI
    KASAN: null-ptr-deref in range [0x00000000000008d8-0x00000000000008df]
    CPU: 0 UID: 0 PID: 72 Comm: kworker/0:2 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Workqueue: events o2quo_make_decision
    RIP: 0010:o2quo_fence_self+0x65/0x200

Register dump omitted.

    Call Trace:
     <TASK>
     o2quo_make_decision+0x345/0x3a0
     ? __pfx_o2quo_make_decision+0x10/0x10
     ? process_one_work+0x834/0x1b40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     ? srso_alias_return_thunk+0x5/0xfbef5
     process_one_work+0x9a8/0x1b40
     ? __pfx_process_one_work+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? lock_is_held_type+0x8f/0x100
     ? srso_alias_return_thunk+0x5/0xfbef5
     worker_thread+0x65c/0xe40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __kthread_parkme+0x177/0x220
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_worker_thread+0x10/0x10
     kthread+0x351/0x460
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x659/0x940
     ? __pfx_ret_from_fork+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __switch_to+0x74f/0xf70
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    Modules linked in:
    ---[ end trace 0000000000000000 ]---

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0064-v5-e3870bf6571b80b07b52@gmail.com
Fixes: f6656d26d17b ("ocfs2/cluster: Make fence method configurable - v2")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/cluster/nodemanager.c | 3 +++
 fs/ocfs2/cluster/quorum.c      | 7 ++++++-
 fs/ocfs2/cluster/quorum.h      | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index b65fc6eeae6e09..87aeb1a7a90aef 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -11,6 +11,7 @@
 #include "tcp.h"
 #include "nodemanager.h"
 #include "heartbeat.h"
+#include "quorum.h"
 #include "masklog.h"
 #include "sys.h"
 
@@ -739,6 +740,8 @@ static void o2nm_cluster_group_drop_item(struct config_group *group, struct conf
 	struct o2nm_cluster *cluster = to_o2nm_cluster(item);
 
 	BUG_ON(o2nm_single_cluster != cluster);
+	/* Drain quorum work before it loses access to the cluster. */
+	o2quo_flush_work();
 	o2nm_single_cluster = NULL;
 
 	configfs_remove_default_groups(&cluster->cl_group);
diff --git a/fs/ocfs2/cluster/quorum.c b/fs/ocfs2/cluster/quorum.c
index bfb8b456876cfe..ab5b3d4fd0e872 100644
--- a/fs/ocfs2/cluster/quorum.c
+++ b/fs/ocfs2/cluster/quorum.c
@@ -318,9 +318,14 @@ void o2quo_init(void)
 	INIT_WORK(&qs->qs_work, o2quo_make_decision);
 }
 
-void o2quo_exit(void)
+void o2quo_flush_work(void)
 {
 	struct o2quo_state *qs = &o2quo_state;
 
 	flush_work(&qs->qs_work);
 }
+
+void o2quo_exit(void)
+{
+	o2quo_flush_work();
+}
diff --git a/fs/ocfs2/cluster/quorum.h b/fs/ocfs2/cluster/quorum.h
index d64bf4482a4af5..1ce5fc2a8ca9d8 100644
--- a/fs/ocfs2/cluster/quorum.h
+++ b/fs/ocfs2/cluster/quorum.h
@@ -8,6 +8,7 @@
 
 void o2quo_init(void);
 void o2quo_exit(void);
+void o2quo_flush_work(void);
 
 void o2quo_hb_up(u8 node);
 void o2quo_hb_down(u8 node);

From f5e973e238ba686a17f19dfbccccdd1c4447a2be Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Fri, 16 Oct 2026 09:17:13 +0800
Subject: [PATCH 0531/1982] ocfs2: pin owning modules for open debugfs files

commit 26d7e34b4226709084461a07bf28d9066fa96d8c upstream.

The OCFS2 debugfs file operation tables do not set owner. The
full debugfs proxy obtains real_fops with fops_get() at open and
keeps it until final release. Without an owner, this does not acquire
a reference to the module containing the table and its callbacks.
Removing the debugfs entries does not drain retained open files.

An open connected_nodes file can therefore outlive ocfs2_nodemanager
and make full_proxy_release() read real_fops->release from freed
module memory. Heming also reproduced the issue with fs_state and
asked for the other OCFS2 debugfs operation tables to be checked.

Set owner to THIS_MODULE in all eleven explicit debugfs operation
tables: five in ocfs2_nodemanager, four in ocfs2_dlm, and two in
ocfs2. The existing debugfs get/put pair then holds the appropriate
module until final release. Leave the open, read and release callbacks
unchanged. The blockcheck table already sets owner through
DEFINE_DEBUGFS_ATTRIBUTE(), so it needs no change.

The original controlled test used an unloadable OCFS2 module and
case-local probe filters without changing the candidate open, unload
or release logic. Closing a retained connected_nodes file after
normal unload produced:

  BUG: unable to handle page fault for address: fffffbfff804cfef
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0xbf/0x190
  Call Trace:
   <TASK>
   __fput+0x39a/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0x114/0x620
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>
  Modules linked in: [last unloaded: ocfs2_nodemanager]

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0089-v6-f7fda843f80887488145@gmail.com
Fixes: 2309e9e040fe ("ocfs2/net: Add debug interface to o2net")
Fixes: 87d3d3f3931f ("ocfs2/hb: Expose the list of heartbeating nodes via debugfs")
Fixes: 3ba169ccec1c ("ocfs2/cluster: Add new function o2net_fill_node_map()")
Fixes: 50397507e856 ("ocfs2: Expose the file system state via debugfs")
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Fixes: 7209300a9b98 ("ocfs2/dlm: Dumps the purgelist into a debugfs file")
Fixes: d0129aceaecc ("ocfs2/dlm: Dumps the mles into a debugfs file")
Fixes: 4e3d24ed1a12 ("ocfs2/dlm: Dumps the lockres' into a debugfs file")
Fixes: 007dce53a29c ("ocfs2/dlm: Dump the dlm state in a debugfs file")
Fixes: db02754c8a12 ("ocfs2/cluster: Show o2net timing statistics")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Karl Mehltretter <kmehltretter@gmail.com>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Zhang Cen <rollkingzzc@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Kurt Hackel <kurt.hackel@oracle.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/cluster/heartbeat.c | 1 +
 fs/ocfs2/cluster/netdebug.c  | 4 ++++
 fs/ocfs2/dlm/dlmdebug.c      | 5 +++++
 fs/ocfs2/dlmglue.c           | 2 ++
 fs/ocfs2/super.c             | 1 +
 5 files changed, 13 insertions(+)

diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 2779f5fad59d49..46ac972e8dbb4c 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1428,6 +1428,7 @@ static ssize_t o2hb_debug_read(struct file *file, char __user *buf,
 #endif  /* CONFIG_DEBUG_FS */
 
 static const struct file_operations o2hb_debug_fops = {
+	.owner =	THIS_MODULE,
 	.open =		o2hb_debug_open,
 	.release =	o2hb_debug_release,
 	.read =		o2hb_debug_read,
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index bc27301eab6d97..350984c0f74f50 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -183,6 +183,7 @@ static int nst_fop_release(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations nst_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = nst_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -415,6 +416,7 @@ static int stats_fop_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations stats_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = stats_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -427,6 +429,7 @@ static int sc_fop_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations sc_seq_fops = {
+	.owner = THIS_MODULE,
 	.open = sc_fop_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
@@ -476,6 +479,7 @@ static ssize_t o2net_debug_read(struct file *file, char __user *buf,
 }
 
 static const struct file_operations nodes_fops = {
+	.owner		= THIS_MODULE,
 	.open		= nodes_fop_open,
 	.release	= o2net_debug_release,
 	.read		= o2net_debug_read,
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 38a6a99603a9c3..c44832e4fc231f 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -7,6 +7,7 @@
  * Copyright (C) 2004, 2008 Oracle.  All rights reserved.
  */
 
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/highmem.h>
@@ -341,6 +342,7 @@ static int debug_purgelist_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations debug_purgelist_fops = {
+	.owner =	THIS_MODULE,
 	.open =		debug_purgelist_open,
 	.release =	debug_release,
 	.read =		debug_read,
@@ -398,6 +400,7 @@ static int debug_mle_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations debug_mle_fops = {
+	.owner =	THIS_MODULE,
 	.open =		debug_mle_open,
 	.release =	debug_release,
 	.read =		debug_read,
@@ -605,6 +608,7 @@ static int debug_lockres_release(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations debug_lockres_fops = {
+	.owner =	THIS_MODULE,
 	.open =		debug_lockres_open,
 	.release =	debug_lockres_release,
 	.read =		seq_read,
@@ -800,6 +804,7 @@ static int debug_state_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations debug_state_fops = {
+	.owner =	THIS_MODULE,
 	.open =		debug_state_open,
 	.release =	debug_release,
 	.read =		debug_read,
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 8ade51f7ffa8bb..b4055ced93d967 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -7,6 +7,7 @@
  * Copyright (C) 2003, 2004 Oracle.  All rights reserved.
  */
 
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/highmem.h>
@@ -3311,6 +3312,7 @@ static int ocfs2_dlm_debug_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations ocfs2_dlm_debug_fops = {
+	.owner =	THIS_MODULE,
 	.open =		ocfs2_dlm_debug_open,
 	.release =	ocfs2_dlm_debug_release,
 	.read =		seq_read,
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index a4f5a868bec10f..dc252b53c7dcf3 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -387,6 +387,7 @@ static ssize_t ocfs2_debug_read(struct file *file, char __user *buf,
 #endif	/* CONFIG_DEBUG_FS */
 
 static const struct file_operations ocfs2_osb_debug_fops = {
+	.owner =	THIS_MODULE,
 	.open =		ocfs2_osb_debug_open,
 	.release =	ocfs2_debug_release,
 	.read =		ocfs2_debug_read,

From d764d3f28a38deafe2980f6671764968dcdb9bc5 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Tue, 13 Oct 2026 09:58:58 +0800
Subject: [PATCH 0532/1982] ocfs2: publish the filecheck owner before adding
 sysfs attributes

commit e062baf5680845705d21df415c8f0751c96b0792 upstream.

ocfs2_filecheck_create_sysfs() initializes the filecheck allocation before
calling kobject_init_and_add(), but assigns entry->fs_fcheck only after
that call returns.  The default attribute group can already be visible
while registration is in progress.  A concurrent read can therefore enter
ocfs2_filecheck_attr_show() with a NULL fs_fcheck and try to lock its
fc_lock.

Assign the initialized owner before adding the kobject, so every activated
attribute has valid state.  Clear the pointer when addition fails,
preserving the existing teardown guard and error cleanup.

A controlled probe-instrumented test kernel with the original OCFS2
registration ordering produced this Oops during a concurrent sysfs read:

  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
  RIP: 0010:kasan_byte_accessible+0x15/0x30
  Call Trace:
   <TASK>
   __kasan_check_byte+0x13/0x50
   lock_acquire+0x113/0x300
   _raw_spin_lock+0x31/0x40
   ocfs2_filecheck_attr_show+0x138/0x5f0
   ocfs2_filecheck_show+0x5d/0x90
   sysfs_kf_seq_show+0x1d3/0x360
   seq_read_iter+0x480/0x1110
   kernfs_fop_read_iter+0x419/0x5a0
   vfs_read+0x7d2/0xc20
   ksys_read+0x111/0x200
   do_syscall_64+0x114/0x620
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>
  Modules linked in:

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0086-v4-1b3a3c5fd05c1fb41df9@gmail.com
Fixes: 5f483c4abb50 ("ocfs2: add kobject for online file check")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Gang He <ghe@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/filecheck.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/filecheck.c b/fs/ocfs2/filecheck.c
index 3ad7baf6765807..47659ef73ca22b 100644
--- a/fs/ocfs2/filecheck.c
+++ b/fs/ocfs2/filecheck.c
@@ -179,17 +179,20 @@ int ocfs2_filecheck_create_sysfs(struct ocfs2_super *osb)
 	fcheck->fc_size = 0;
 	fcheck->fc_done = 0;
 
+	/* Publish the initialized owner before activating its sysfs callbacks. */
+	entry->fs_fcheck = fcheck;
 	entry->fs_kobj.kset = osb->osb_dev_kset;
 	init_completion(&entry->fs_kobj_unregister);
 	ret = kobject_init_and_add(&entry->fs_kobj, &ocfs2_ktype_filecheck,
 					NULL, "filecheck");
 	if (ret) {
+		/* Mount failure still calls ocfs2_filecheck_remove_sysfs(). */
+		entry->fs_fcheck = NULL;
 		kobject_put(&entry->fs_kobj);
 		kfree(fcheck);
 		return ret;
 	}
 
-	entry->fs_fcheck = fcheck;
 	return 0;
 }
 

From 85a8777c7ec5e17b999b4c9eb0c8cbf4ab936998 Mon Sep 17 00:00:00 2001
From: Jonathan Gopel <jgopel@gmail.com>
Date: Sun, 4 Oct 2026 11:13:50 -0600
Subject: [PATCH 0533/1982] thunderbolt: Do not RPM complete unrelated subtrees
 on unplug

commit 96a8479804e3f7af43e639e9df39f562f1a75fd5 upstream.

When a Thunderbolt device is unplugged, that switch and every switch
subsequent to it on the bus device list is `complete()`d, not just its
child devices. In the case of multiple domains, it may cause, eg, an
attempt to `complete()` the uninitialized domain 1 root switch RPM
completion on unplug of a switch from domain 0 (though ordering is not
guaranteed numerically sorted).

I initially noticed this issue on a Dell XPS9720 when the system would
seem to sporadically not wake after unplugging a Thunderbolt dock. I
tried multiple kernel versions including v7.2.7 and v7.3-rc4 to see if
that resolved the issue, but the issue persisted. Eventually I found
that I could consistently generate a kernel Oops reporting a page fault
at 0xffff_ffff_ffff_fff8 on unplug from one side of the laptop and went
bug hunting. I became suspicious of the `bus_for_each_dev()` walk that I
ultimately ended up changing. To confirm this issue, I did an eBPF trace
of `bus_for_each_dev()`, `complete_rpm()`, and `complete()` while
unplugging in a variety of situations and found that an unplug from
domain 0 tries to `complete_rpm()` domain 1's switch, whose RPM
completion is not initialized and thus is holding a null wait-list
pointer, triggering the page fault.

Here are the key sections of that eBPF trace. Note that HEAD denotes the
completion's own wait-list HEAD:

```
RESCAN_ENTER domain=0

COMPLETE rescan_domain=0 target=0-1 target_domain=0
         route=0x1 parent=0-0 unplugged=1
COMPLETION done=0 head=HEAD next=HEAD prev=HEAD

BUS_WALK domain=0 start=0-1 callback=complete_rpm
CALLBACK_ENTER rescan_domain=0 dev=1-0 parent=domain1 is_switch=1

COMPLETE rescan_domain=0 target=1-0 target_domain=1
         route=0x0 parent=domain1 unplugged=0
COMPLETION done=0 head=HEAD next=0 prev=0

        complete+5
        complete_rpm+43
        bus_for_each_dev+133
        icm_free_unplugged_children+250
        icm_rescan_work+42
```

This patch gates the `complete()` on an additional condition - that the
Thunderbolt domain matches the domain of the device that was unplugged.

I only have a single system with multiple Thunderbolt domains - the Dell
XPS9720. I am consistently able to reproduce the Oops on that system.
Since running with this patch, I have not seen the Oops reoccur. I have
also tested it on a Thinkpad X1-Gen12, and that system boots and runs
well with it, but it only has a single Thunderbolt domain, so it does
not exercise the multi-domain failure case.

Fixes: 4f7c2e0d8765 ("thunderbolt: Make sure device runtime resume completes before taking domain lock")
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Gopel <jgopel@gmail.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thunderbolt/icm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index cafd91a443bc89..a31a9519520240 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -2068,7 +2068,7 @@ static int complete_rpm(struct device *dev, void *data)
 {
 	struct tb_switch *sw = tb_to_switch(dev);
 
-	if (sw)
+	if (sw && sw->tb == data)
 		complete(&sw->rpm_complete);
 	return 0;
 }
@@ -2084,8 +2084,8 @@ static void remove_unplugged_switch(struct tb_switch *sw)
 	 * tb_switch_remove() calls pm_runtime_get_sync() that then waits
 	 * for it.
 	 */
-	complete_rpm(&sw->dev, NULL);
-	bus_for_each_dev(&tb_bus_type, &sw->dev, NULL, complete_rpm);
+	complete_rpm(&sw->dev, sw->tb);
+	bus_for_each_dev(&tb_bus_type, &sw->dev, sw->tb, complete_rpm);
 	tb_switch_remove(sw);
 
 	pm_runtime_mark_last_busy(parent);

From df713b82b4b9671c16b52b60f3412c677719e2b8 Mon Sep 17 00:00:00 2001
From: Giorgi Kobakhia <gkobakhi@asu.edu>
Date: Mon, 28 Sep 2026 13:04:45 -0700
Subject: [PATCH 0534/1982] udf: fix return value for non-recorded-allocated
 extents in udf_map_block()

commit 0f242ca0878896df30292f4922700a32e8fdd039 upstream.

When someone creates a corrupted UDF filesystem where symlink contains
other extent type than EXT_RECORDED_ALLOCATED, it can leads to a crash
like:

 Oops: general protection fault
 KASAN: maybe wild-memory-access
 RIP: 0010:page_get_link (fs/namei.c:6503)
 Call Trace:
  vfs_readlink (fs/namei.c:6419)
  do_readlinkat (fs/stat.c:583)
  __x64_sys_readlink (fs/stat.c:605 fs/stat.c:602 fs/stat.c:602)

This is because in this case udf_map_block() fails to convert return
value of inode_bmap() from 1 to 0. Returned '1' propagates through
udf_bread() all the way up to __page_get_link() where it ends up being
treated as a folio pointer with obvious results.

Move the reset to 0 line outside the if, so udf_map_block() returns either
0 or -errno, even if the extent type is not EXT_RECORDED_ALLOCATED.

Fixes: c226964ec786 ("udf: refactor inode_bmap() to handle error")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Tested-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Link: https://patch.msgid.link/20260928200445.18722-1-gkobakhi@asu.edu
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/udf/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index e50ecd67461046..d00b78523a967b 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -375,8 +375,8 @@ static int udf_map_block(struct inode *inode, struct udf_map_rq *map)
 			map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc,
 							offset);
 			map->oflags |= UDF_BLK_MAPPED;
-			ret = 0;
 		}
+		ret = 0;
 out_read:
 		up_read(&iinfo->i_data_sem);
 		brelse(epos.bh);

From 66b8f5bfc592e28214c1283333becd43890dfe75 Mon Sep 17 00:00:00 2001
From: Bui Viet Dung <dungvn2345@gmail.com>
Date: Thu, 8 Oct 2026 20:07:53 +0700
Subject: [PATCH 0535/1982] wwan: wwan_hwsim: Pin module for debugfs file
 operations

commit a388f17e23b7e305cb306aafd73bb10d6b8ca452 upstream.

An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, wwan_hwsim_debugfs_portdestroy_fops,
wwan_hwsim_debugfs_portcreate_fops, wwan_hwsim_debugfs_devdestroy_fops,
and wwan_hwsim_debugfs_devcreate_fops in wwan_hwsim.c have no
.owner set to THIS_MODULE.

As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the wwan_hwsim module. When a userspace
process opens any of these debugfs files, a subsequent module unload
(rmmod wwan_hwsim) can succeed while the file descriptor remains open.

When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():

  BUG: unable to handle page fault for address: fffffbfff84f90ef
  Oops: 0000 [#2] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x357/0xaa0
   fput_close_sync+0xe6/0x1a0
   file_close_fd_locked+0x17e/0x2f0
   do_close+0x33/0x70
   __x64_sys_close+0x44/0x80
   do_syscall_64+0xc3/0x590
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>

The issue was discovered via manual code audit of wwan_hwsim.c and
reproduced on a Linux 7.3-rc6 test VM with CONFIG_WWAN_HWSIM=m.

Set .owner = THIS_MODULE on all four debugfs file_operations structures
in wwan_hwsim.c so that debugfs pins the module until close has
completed.

Fixes: 9ee23f48f670 ("wwan_hwsim: add debugfs management interface")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20261008130753.313875-1-dungvn2345@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wwan/wwan_hwsim.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wwan/wwan_hwsim.c b/drivers/net/wwan/wwan_hwsim.c
index 733688cd4607c2..39cd2fefce6b4c 100644
--- a/drivers/net/wwan/wwan_hwsim.c
+++ b/drivers/net/wwan/wwan_hwsim.c
@@ -380,6 +380,7 @@ static ssize_t wwan_hwsim_debugfs_portdestroy_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_portdestroy_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_portdestroy_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -404,6 +405,7 @@ static ssize_t wwan_hwsim_debugfs_portcreate_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_portcreate_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_portcreate_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -425,6 +427,7 @@ static ssize_t wwan_hwsim_debugfs_devdestroy_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_devdestroy_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_devdestroy_write,
 	.open = simple_open,
 	.llseek = noop_llseek,
@@ -448,6 +451,7 @@ static ssize_t wwan_hwsim_debugfs_devcreate_write(struct file *file,
 }
 
 static const struct file_operations wwan_hwsim_debugfs_devcreate_fops = {
+	.owner = THIS_MODULE,
 	.write = wwan_hwsim_debugfs_devcreate_write,
 	.open = simple_open,
 	.llseek = noop_llseek,

From af17c2ffde0b14cda5c72acbd0f0865b753fb69c Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:02:18 -0700
Subject: [PATCH 0536/1982] xfs: fix integer overflow problem when setting
 large free areas

commit 7e55f84434f3a63d59feb8f89076d280ea9aa8e5 upstream.

LOLLM points out that the min_t comparison in xrep_rtbitmap_mark_free
operates on a 64-bit bitmap word offset quantity and a 32-bit
words-per-block ratio.  Unfortunately, I should have done the comparison
with the (64-bit) xrep_wordoff_t type, but used the 32-bit word count
type.  Oops.

Cc: stable@vger.kernel.org # v6.14
Fixes: 8defee8dff2b20 ("xfs: online repair of realtime bitmaps for a realtime group")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/rtbitmap_repair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/rtbitmap_repair.c b/fs/xfs/scrub/rtbitmap_repair.c
index d2669082d09343..1e9c34f5b25958 100644
--- a/fs/xfs/scrub/rtbitmap_repair.c
+++ b/fs/xfs/scrub/rtbitmap_repair.c
@@ -276,7 +276,7 @@ xrep_rtbitmap_mark_free(
 		xrep_wordoff_t	rem;
 		xrep_wordcnt_t	wordcnt;
 
-		wordcnt = min_t(xrep_wordcnt_t, nextwordoff - wordoff,
+		wordcnt = min_t(xrep_wordoff_t, nextwordoff - wordoff,
 				bufwsize);
 
 		/*

From bc6b1da681abe631ed21b7fdced48546189d64a4 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 18 Jun 2026 13:56:38 +0200
Subject: [PATCH 0537/1982] netfilter: nf_conntrack_expect: use conntrack GC to
 reap expectations

[ Upstream commit b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2 ]

This patch replaces the timer API by GC worker approach for
expectations, as it already happened in many other subsystems.

Use the existing conntrack GC worker to iterate over the local list of
expectations in the master conntrack to reap expired expectations.
Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct
expectation which nevers sets it. Hold the expectation spinlock while
iterating over the master conntrack expectation list to synchronize with
nf_ct_remove_expectations(). This also performs runtime packet path
garbage collection through the expectation insertion and lookup
functions while walking over one of the chains of the global expectation
hashtables. Unconfirmed conntrack entries are skipped since ct->ext can
be reallocated and dying are skipped since those will be gone soon.
Set on IPS_HELPER_BIT if the helper ct extension is added, then the new
GC worker does not need to bump the ct refcount to check if the ct->ext
helper is available.

This removes the extra bump on the refcount for expectation timers, this
allows to remove several nf_ct_expect_put() calls after the unlink,
after this update only refcount remains at 1 while on the expectation
hashes.

This patch implicitly addresses a race with the existing timer API
allowing an expectation to access a stale exp->master pointer which has
been already released when expectation removal loses races with an
expiring timer, ie. timer_del() reporting false.

Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This
is needed by nf_conntrack_unexpect_related() which is called in error
paths to invalidate newly created expectations that has been added into
the hashes. These expectactions cannot be inmediately released as GC or
nf_ct_remove_expectations() could race to make it. On expectation
insert, the runtime GC reaps stale expectations before checking the
expectation limit set by policy.

Set current timestamp in nf_ct_expect_alloc(), then add the expectation
policy timeout (or custom timeout specified added on top of this) to
specify the expectation lifetime.

Fixes: bffcaad9afdf ("netfilter: ctnetlink: ensure safe access to master conntrack")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[ sashal: adapted evict_oldest_expect() to the older signature that takes the master conntrack, and dropped the nft_ct helper refcount check absent in this tree. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_conntrack_expect.h   |  16 +-
 .../linux/netfilter/nf_conntrack_common.h     |   1 +
 net/netfilter/nf_conntrack_core.c             |  33 +++-
 net/netfilter/nf_conntrack_expect.c           | 145 +++++++++---------
 net/netfilter/nf_conntrack_h323_main.c        |   4 +-
 net/netfilter/nf_conntrack_helper.c           |  10 +-
 net/netfilter/nf_conntrack_netlink.c          |  22 ++-
 net/netfilter/nf_conntrack_sip.c              |  13 +-
 net/netfilter/nft_ct.c                        |   3 +-
 9 files changed, 139 insertions(+), 108 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 80f50fd0f7ad27..be4a120d549eb3 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -54,8 +54,8 @@ struct nf_conntrack_expect {
 	/* The conntrack of the master connection */
 	struct nf_conn *master;
 
-	/* Timer function; deletes the expectation. */
-	struct timer_list timeout;
+	/* jiffies32 when this expectation expires */
+	u32 timeout;
 
 #if IS_ENABLED(CONFIG_NF_NAT)
 	union nf_inet_addr saved_addr;
@@ -69,6 +69,14 @@ struct nf_conntrack_expect {
 	struct rcu_head rcu;
 };
 
+static inline bool nf_ct_exp_is_expired(const struct nf_conntrack_expect *exp)
+{
+	if (READ_ONCE(exp->flags) & NF_CT_EXPECT_DEAD)
+		return true;
+
+	return (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) <= 0;
+}
+
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
 	return read_pnet(&exp->net);
@@ -130,7 +138,6 @@ static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
 
 void nf_ct_remove_expectations(struct nf_conn *ct);
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
-bool nf_ct_remove_expect(struct nf_conntrack_expect *exp);
 
 void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data), void *data);
 void nf_ct_expect_iterate_net(struct net *net,
@@ -153,5 +160,8 @@ static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect,
 	return nf_ct_expect_related_report(expect, 0, 0, flags);
 }
 
+struct nf_conn_help;
+void nf_ct_expectation_gc(struct nf_conn_help *master_help);
+
 #endif /*_NF_CONNTRACK_EXPECT_H*/
 
diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index 56b6b60a814f5e..ee51045ae1d627 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -160,6 +160,7 @@ enum ip_conntrack_expect_events {
 #define NF_CT_EXPECT_USERSPACE		0x4
 
 #ifdef __KERNEL__
+#define NF_CT_EXPECT_DEAD		0x8
 #define NF_CT_EXPECT_MASK	(NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \
 				 NF_CT_EXPECT_USERSPACE)
 #endif
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 201d2ef8a6f02d..73315d53d28797 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1467,6 +1467,31 @@ static bool gc_worker_can_early_drop(const struct nf_conn *ct)
 	return false;
 }
 
+static void nf_ct_help_gc(struct nf_conn *ct)
+{
+	struct nf_conn_help *help;
+
+	if (!refcount_inc_not_zero(&ct->ct_general.use))
+		return;
+
+	/* load ->status after refcount increase */
+	smp_acquire__after_ctrl_dep();
+
+	if (!nf_ct_is_confirmed(ct) || nf_ct_is_dying(ct)) {
+		nf_ct_put(ct);
+		return;
+	}
+
+	/* re-check helper due to SLAB_TYPESAFE_BY_RCU */
+	if (test_bit(IPS_HELPER_BIT, &ct->status)) {
+		help = nfct_help(ct);
+		if (help)
+			nf_ct_expectation_gc(help);
+	}
+
+	nf_ct_put(ct);
+}
+
 static void gc_worker(struct work_struct *work)
 {
 	unsigned int i, hashsz, nf_conntrack_max95 = 0;
@@ -1539,7 +1564,13 @@ static void gc_worker(struct work_struct *work)
 			expires = (expires - (long)next_run) / ++count;
 			next_run += expires;
 
-			if (nf_conntrack_max95 == 0 || gc_worker_skip_ct(tmp))
+			if (gc_worker_skip_ct(tmp))
+				continue;
+
+			if (test_bit(IPS_HELPER_BIT, &tmp->status))
+				nf_ct_help_gc(tmp);
+
+			if (nf_conntrack_max95 == 0)
 				continue;
 
 			net = nf_ct_net(tmp);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 6266d4d2ffca4c..f2e26c9b944d87 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -43,6 +43,24 @@ unsigned int nf_ct_expect_max __read_mostly;
 static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
 static siphash_aligned_key_t nf_ct_expect_hashrnd;
 
+void nf_ct_expectation_gc(struct nf_conn_help *master_help)
+{
+	struct nf_conntrack_expect *exp;
+	struct hlist_node *next;
+
+	if (hlist_empty(&master_help->expectations))
+		return;
+
+	spin_lock_bh(&nf_conntrack_expect_lock);
+	hlist_for_each_entry_safe(exp, next, &master_help->expectations, lnode) {
+		if (!nf_ct_exp_is_expired(exp))
+			continue;
+
+		nf_ct_unlink_expect(exp);
+	}
+	spin_unlock_bh(&nf_conntrack_expect_lock);
+}
+
 /* nf_conntrack_expect helper functions */
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
 				u32 portid, int report)
@@ -53,7 +71,6 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
 
 	lockdep_nfct_expect_lock_held();
 	WARN_ON(!master_help);
-	WARN_ON(timer_pending(&exp->timeout));
 
 	hlist_del_rcu(&exp->hnode);
 
@@ -70,16 +87,6 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
 }
 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report);
 
-static void nf_ct_expectation_timed_out(struct timer_list *t)
-{
-	struct nf_conntrack_expect *exp = timer_container_of(exp, t, timeout);
-
-	spin_lock_bh(&nf_conntrack_expect_lock);
-	nf_ct_unlink_expect(exp);
-	spin_unlock_bh(&nf_conntrack_expect_lock);
-	nf_ct_expect_put(exp);
-}
-
 static unsigned int nf_ct_expect_dst_hash(const struct net *n, const struct nf_conntrack_tuple *tuple)
 {
 	struct {
@@ -117,19 +124,6 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple,
 	       nf_ct_exp_zone_equal_any(i, zone);
 }
 
-bool nf_ct_remove_expect(struct nf_conntrack_expect *exp)
-{
-	lockdep_nfct_expect_lock_held();
-
-	if (timer_delete(&exp->timeout)) {
-		nf_ct_unlink_expect(exp);
-		nf_ct_expect_put(exp);
-		return true;
-	}
-	return false;
-}
-EXPORT_SYMBOL_GPL(nf_ct_remove_expect);
-
 struct nf_conntrack_expect *
 __nf_ct_expect_find(struct net *net,
 		    const struct nf_conntrack_zone *zone,
@@ -144,6 +138,8 @@ __nf_ct_expect_find(struct net *net,
 
 	h = nf_ct_expect_dst_hash(net, tuple);
 	hlist_for_each_entry_rcu(i, &nf_ct_expect_hash[h], hnode) {
+		if (nf_ct_exp_is_expired(i))
+			continue;
 		if (nf_ct_exp_equal(tuple, i, zone, net))
 			return i;
 	}
@@ -178,6 +174,7 @@ nf_ct_find_expectation(struct net *net,
 {
 	struct nf_conntrack_net *cnet = nf_ct_pernet(net);
 	struct nf_conntrack_expect *i, *exp = NULL;
+	struct hlist_node *next;
 	unsigned int h;
 
 	lockdep_nfct_expect_lock_held();
@@ -186,7 +183,11 @@ nf_ct_find_expectation(struct net *net,
 		return NULL;
 
 	h = nf_ct_expect_dst_hash(net, tuple);
-	hlist_for_each_entry(i, &nf_ct_expect_hash[h], hnode) {
+	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
+		if (nf_ct_exp_is_expired(i)) {
+			nf_ct_unlink_expect(i);
+			continue;
+		}
 		if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
 		    nf_ct_exp_equal(tuple, i, zone, net)) {
 			exp = i;
@@ -196,13 +197,16 @@ nf_ct_find_expectation(struct net *net,
 	if (!exp)
 		return NULL;
 
+	if (!refcount_inc_not_zero(&exp->use))
+		return NULL;
+
 	/* If master is not in hash table yet (ie. packet hasn't left
 	   this machine yet), how can other end know about expected?
 	   Hence these are not the droids you are looking for (if
 	   master ct never got confirmed, we'd hold a reference to it
 	   and weird things would happen to future packets). */
 	if (!nf_ct_is_confirmed(exp->master))
-		return NULL;
+		goto err_release_exp;
 
 	/* Avoid race with other CPUs, that for exp->master ct, is
 	 * about to invoke ->destroy(), or nf_ct_delete() via timeout
@@ -214,18 +218,17 @@ nf_ct_find_expectation(struct net *net,
 	 */
 	if (unlikely(nf_ct_is_dying(exp->master) ||
 		     !refcount_inc_not_zero(&exp->master->ct_general.use)))
-		return NULL;
+		goto err_release_exp;
 
-	if (exp->flags & NF_CT_EXPECT_PERMANENT || !unlink) {
-		refcount_inc(&exp->use);
-		return exp;
-	} else if (timer_delete(&exp->timeout)) {
-		nf_ct_unlink_expect(exp);
+	if (exp->flags & NF_CT_EXPECT_PERMANENT || !unlink)
 		return exp;
-	}
-	/* Undo exp->master refcnt increase, if timer_delete() failed */
-	nf_ct_put(exp->master);
 
+	nf_ct_unlink_expect(exp);
+
+	return exp;
+
+err_release_exp:
+	nf_ct_expect_put(exp);
 	return NULL;
 }
 
@@ -241,9 +244,8 @@ void nf_ct_remove_expectations(struct nf_conn *ct)
 		return;
 
 	spin_lock_bh(&nf_conntrack_expect_lock);
-	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
-		nf_ct_remove_expect(exp);
-	}
+	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode)
+		nf_ct_unlink_expect(exp);
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
@@ -292,7 +294,7 @@ static bool master_matches(const struct nf_conntrack_expect *a,
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
 {
 	spin_lock_bh(&nf_conntrack_expect_lock);
-	nf_ct_remove_expect(exp);
+	WRITE_ONCE(exp->flags, exp->flags | NF_CT_EXPECT_DEAD);
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
@@ -308,6 +310,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 	if (!new)
 		return NULL;
 
+	new->timeout = nfct_time_stamp;
 	new->master = me;
 	refcount_set(&new->use, 1);
 	return new;
@@ -414,17 +417,12 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
 	struct net *net = nf_ct_exp_net(exp);
 	unsigned int h = nf_ct_expect_dst_hash(net, &exp->tuple);
 
-	/* two references : one for hash insert, one for the timer */
-	refcount_add(2, &exp->use);
+	refcount_inc(&exp->use);
 
-	timer_setup(&exp->timeout, nf_ct_expectation_timed_out, 0);
 	helper = rcu_dereference_protected(master_help->helper,
 					   lockdep_is_held(&nf_conntrack_expect_lock));
-	if (helper) {
-		exp->timeout.expires = jiffies +
-			helper->expect_policy[exp->class].timeout * HZ;
-	}
-	add_timer(&exp->timeout);
+	if (helper)
+		exp->timeout += helper->expect_policy[exp->class].timeout * HZ;
 
 	hlist_add_head_rcu(&exp->lnode, &master_help->expectations);
 	master_help->expecting[exp->class]++;
@@ -436,20 +434,27 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
 	NF_CT_STAT_INC(net, expect_create);
 }
 
-/* Race with expectations being used means we could have none to find; OK. */
 static void evict_oldest_expect(struct nf_conn *master,
-				struct nf_conntrack_expect *new)
+				struct nf_conntrack_expect *new,
+				const struct nf_conntrack_expect_policy *p)
 {
 	struct nf_conn_help *master_help = nfct_help(master);
 	struct nf_conntrack_expect *exp, *last = NULL;
+	struct hlist_node *next;
 
-	hlist_for_each_entry(exp, &master_help->expectations, lnode) {
+	hlist_for_each_entry_safe(exp, next, &master_help->expectations, lnode) {
+		if (nf_ct_exp_is_expired(exp)) {
+			nf_ct_unlink_expect(exp);
+			continue;
+		}
 		if (exp->class == new->class)
 			last = exp;
 	}
 
-	if (last)
-		nf_ct_remove_expect(last);
+	/* Still worth to evict oldest expectation after garbage collection? */
+	if (last &&
+	    master_help->expecting[last->class] >= p->max_expected)
+		nf_ct_unlink_expect(last);
 }
 
 static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
@@ -474,14 +479,18 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
 	}
 	h = nf_ct_expect_dst_hash(net, &expect->tuple);
 	hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
+		if (nf_ct_exp_is_expired(i)) {
+			nf_ct_unlink_expect(i);
+			continue;
+		}
 		if (master_matches(i, expect, flags) &&
 		    expect_matches(i, expect)) {
 			if (i->class != expect->class ||
 			    i->master != expect->master)
 				return -EALREADY;
 
-			if (nf_ct_remove_expect(i))
-				break;
+			nf_ct_unlink_expect(i);
+			break;
 		} else if (expect_clash(i, expect)) {
 			ret = -EBUSY;
 			goto out;
@@ -493,14 +502,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
 	if (helper) {
 		p = &helper->expect_policy[expect->class];
 		if (p->max_expected &&
-		    master_help->expecting[expect->class] >= p->max_expected) {
-			evict_oldest_expect(master, expect);
-			if (master_help->expecting[expect->class]
-						>= p->max_expected) {
-				ret = -EMFILE;
-				goto out;
-			}
-		}
+		    master_help->expecting[expect->class] >= p->max_expected)
+			evict_oldest_expect(master, expect, p);
 	}
 
 	cnet = nf_ct_pernet(net);
@@ -547,10 +550,8 @@ void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, vo
 		hlist_for_each_entry_safe(exp, next,
 					  &nf_ct_expect_hash[i],
 					  hnode) {
-			if (iter(exp, data) && timer_delete(&exp->timeout)) {
+			if (iter(exp, data))
 				nf_ct_unlink_expect(exp);
-				nf_ct_expect_put(exp);
-			}
 		}
 	}
 
@@ -577,10 +578,8 @@ void nf_ct_expect_iterate_net(struct net *net,
 			if (!net_eq(nf_ct_exp_net(exp), net))
 				continue;
 
-			if (iter(exp, data) && timer_delete(&exp->timeout)) {
+			if (iter(exp, data))
 				nf_ct_unlink_expect_report(exp, portid, report);
-				nf_ct_expect_put(exp);
-			}
 		}
 	}
 
@@ -657,17 +656,17 @@ static int exp_seq_show(struct seq_file *s, void *v)
 	struct net *net = seq_file_net(s);
 	struct hlist_node *n = v;
 	char *delim = "";
+	__s32 timeout;
 
 	expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
 
 	if (!net_eq(nf_ct_exp_net(expect), net))
 		return 0;
+	if (nf_ct_exp_is_expired(expect))
+		return 0;
 
-	if (expect->timeout.function)
-		seq_printf(s, "%ld ", timer_pending(&expect->timeout)
-			   ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
-	else
-		seq_puts(s, "- ");
+	timeout = (__s32)(READ_ONCE(expect->timeout) - nfct_time_stamp) / HZ;
+	seq_printf(s, "%d ", timeout > 0 ? timeout : 0);
 	seq_printf(s, "l3proto = %u proto=%u ",
 		   expect->tuple.src.l3num,
 		   expect->tuple.dst.protonum);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index a116c6629e2b81..279201f8a18f4e 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1396,8 +1396,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
 				 "timeout to %u seconds for",
 				 info->timeout);
 			nf_ct_dump_tuple(&exp->tuple);
-			mod_timer_pending(&exp->timeout,
-					  jiffies + info->timeout * HZ);
+			WRITE_ONCE(exp->timeout,
+				   nfct_time_stamp + (info->timeout * HZ));
 		}
 		spin_unlock_bh(&nf_conntrack_expect_lock);
 	}
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index ea0cdb7ec91512..2cef826e20fb99 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -180,10 +180,10 @@ nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp)
 	struct nf_conn_help *help;
 
 	help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp);
-	if (help)
+	if (help) {
+		__set_bit(IPS_HELPER_BIT, &ct->status);
 		INIT_HLIST_HEAD(&help->expectations);
-	else
-		pr_debug("failed to add helper extension area");
+	}
 	return help;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
@@ -202,10 +202,8 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 		return 0;
 
 	help = nfct_help(tmpl);
-	if (help != NULL) {
+	if (help)
 		helper = rcu_dereference(help->helper);
-		set_bit(IPS_HELPER_BIT, &ct->status);
-	}
 
 	help = nfct_help(ct);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 52115993571890..d7c4f34f1caf0a 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3006,8 +3006,8 @@ static int
 ctnetlink_exp_dump_expect(struct sk_buff *skb,
 			  const struct nf_conntrack_expect *exp)
 {
+	__s32 timeout = (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) / HZ;
 	struct nf_conn *master = exp->master;
-	long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
 	struct nf_conntrack_helper *helper;
 #if IS_ENABLED(CONFIG_NF_NAT)
 	struct nlattr *nest_parms;
@@ -3170,6 +3170,9 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 restart:
 		hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
 					 hnode) {
+			if (nf_ct_exp_is_expired(exp))
+				continue;
+
 			if (l3proto && exp->tuple.src.l3num != l3proto)
 				continue;
 
@@ -3449,11 +3452,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb,
 		}
 
 		/* after list removal, usage count == 1 */
-		if (timer_delete(&exp->timeout)) {
-			nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
-						   nlmsg_report(info->nlh));
-			nf_ct_expect_put(exp);
-		}
+		nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
+					   nlmsg_report(info->nlh));
 		spin_unlock_bh(&nf_conntrack_expect_lock);
 		/* have to put what we 'get' above.
 		 * after this line usage count == 0 */
@@ -3477,14 +3477,10 @@ static int
 ctnetlink_change_expect(struct nf_conntrack_expect *x,
 			const struct nlattr * const cda[])
 {
-	if (cda[CTA_EXPECT_TIMEOUT]) {
-		if (!timer_delete(&x->timeout))
-			return -ETIME;
+	if (cda[CTA_EXPECT_TIMEOUT])
+		WRITE_ONCE(x->timeout, nfct_time_stamp +
+			   ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ);
 
-		x->timeout.expires = jiffies +
-			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
-		add_timer(&x->timeout);
-	}
 	return 0;
 }
 
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 5b75e9bc99e9f9..449a6e53feae46 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -894,11 +894,10 @@ static int refresh_signalling_expectation(struct nf_conn *ct,
 		    exp->tuple.dst.protonum != proto ||
 		    exp->tuple.dst.u.udp.port != port)
 			continue;
-		if (mod_timer_pending(&exp->timeout, jiffies + expires * HZ)) {
-			exp->flags &= ~NF_CT_EXPECT_INACTIVE;
-			found = 1;
-			break;
-		}
+		WRITE_ONCE(exp->timeout, nfct_time_stamp + (expires * HZ));
+		WRITE_ONCE(exp->flags, exp->flags & ~NF_CT_EXPECT_INACTIVE);
+		found = 1;
+		break;
 	}
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 	return found;
@@ -914,8 +913,7 @@ static void flush_expectations(struct nf_conn *ct, bool media)
 	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 		if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 			continue;
-		if (!nf_ct_remove_expect(exp))
-			continue;
+		nf_ct_unlink_expect(exp);
 		if (!media)
 			break;
 	}
@@ -1385,7 +1383,6 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
 
 	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
 			  saddr, &daddr, proto, NULL, &port);
-	exp->timeout.expires = sip_timeout * HZ;
 	rcu_assign_pointer(exp->assign_helper, helper);
 	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
 
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index fa32bbb3130658..11d99778216f17 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -1147,7 +1147,6 @@ static void nft_ct_helper_obj_eval(struct nft_object *obj,
 	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
 	if (help) {
 		rcu_assign_pointer(help->helper, to_assign);
-		set_bit(IPS_HELPER_BIT, &ct->status);
 
 		if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
 			if (!nfct_seqadj_ext_add(ct))
@@ -1329,7 +1328,7 @@ static void nft_ct_expect_obj_eval(struct nft_object *obj,
 		          &ct->tuplehash[!dir].tuple.src.u3,
 		          &ct->tuplehash[!dir].tuple.dst.u3,
 		          priv->l4proto, NULL, &priv->dport);
-	exp->timeout.expires = jiffies + priv->timeout * HZ;
+	exp->timeout += priv->timeout * HZ;
 
 	if (nf_ct_expect_related(exp, 0) != 0)
 		regs->verdict.code = NF_DROP;

From f540bf1291a97d754b1db77d261fd1d739717825 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 1 Nov 2026 15:27:30 +0000
Subject: [PATCH 0538/1982] netfilter: nf_conntrack_expect: add and use
 nf_ct_expect_related_pair()

commit 4aa63842fc92de1bce59d4709a0d32e718890bb2 upstream.

Add a new function to insert a pair of expectations, this is required by
the SIP and H323 NAT helpers. The spinlock is held to check if there is
a slot for both expectations, in such case, insert them.

This removes the need for nf_ct_unexpect_related() inside the loop to
find a pair of consecutive ports, otherwise inserting expectations whose
dead flag is already set on can happen.

Bump master_help->expecting for the expectation class after checking if
the expectation fits in the master expectation list, which is needed for
this new _pair() function variant to run the eviction routine including
the preallocated slot for the first expectation in the pair.

[ Joas: nf_ct_expect_insert() and __nf_ct_expect_check() do not take
  a master_help argument in this tree, so keep their existing
  signatures; nf_ct_expect_related_report() gets master_help from
  nfct_help(expect->master) for the moved expecting[] increment. ]

Fixes: b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack GC to reap expectations")
Reported-by: Jaeyeong Lee <iostreampy@proton.me>
Link: https://patch.msgid.link/178377968720.33756.12204817361601593230@proton.me/
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_conntrack_expect.h |  3 ++
 net/ipv4/netfilter/nf_nat_h323.c            | 22 +++++--------
 net/netfilter/nf_conntrack_expect.c         | 35 ++++++++++++++++++++-
 net/netfilter/nf_nat_sip.c                  | 20 ++++--------
 4 files changed, 50 insertions(+), 30 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index be4a120d549eb3..8efc1ed0925a02 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -160,6 +160,9 @@ static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect,
 	return nf_ct_expect_related_report(expect, 0, 0, flags);
 }
 
+int nf_ct_expect_related_pair(struct nf_conntrack_expect *expect[],
+			      unsigned int flag);
+
 struct nf_conn_help;
 void nf_ct_expectation_gc(struct nf_conn_help *master_help);
 
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 10e1b0837731b7..d55994fccf5d4d 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -179,6 +179,7 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
 			struct nf_conntrack_expect *rtp_exp,
 			struct nf_conntrack_expect *rtcp_exp)
 {
+	struct nf_conntrack_expect *rtp_pair[2] = { rtp_exp, rtcp_exp };
 	struct nf_ct_h323_master *info = nfct_help_data(ct);
 	int dir = CTINFO2DIR(ctinfo);
 	int i;
@@ -221,22 +222,13 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
 		int ret;
 
 		rtp_exp->tuple.dst.u.udp.port = htons(nated_port);
-		ret = nf_ct_expect_related(rtp_exp, 0);
+		rtcp_exp->tuple.dst.u.udp.port = htons(nated_port + 1);
+		ret = nf_ct_expect_related_pair(rtp_pair, 0);
 		if (ret == 0) {
-			rtcp_exp->tuple.dst.u.udp.port =
-			    htons(nated_port + 1);
-			ret = nf_ct_expect_related(rtcp_exp, 0);
-			if (ret == 0)
-				break;
-			else if (ret == -EBUSY) {
-				nf_ct_unexpect_related(rtp_exp);
-				continue;
-			} else if (ret < 0) {
-				nf_ct_unexpect_related(rtp_exp);
-				nated_port = 0;
-				break;
-			}
-		} else if (ret != -EBUSY) {
+			break;
+		} else if (ret == -EBUSY) {
+			continue;
+		} else if (ret < 0) {
 			nated_port = 0;
 			break;
 		}
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index f2e26c9b944d87..1f4034788ceadf 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -425,7 +425,6 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
 		exp->timeout += helper->expect_policy[exp->class].timeout * HZ;
 
 	hlist_add_head_rcu(&exp->lnode, &master_help->expectations);
-	master_help->expecting[exp->class]++;
 
 	hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
 	cnet = nf_ct_pernet(net);
@@ -525,6 +524,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
 	if (ret < 0)
 		goto out;
 
+	nfct_help(expect->master)->expecting[expect->class]++;
 	nf_ct_expect_insert(expect);
 
 	nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report);
@@ -537,6 +537,39 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_related_report);
 
+int nf_ct_expect_related_pair(struct nf_conntrack_expect *expect[],
+			      unsigned int flags)
+{
+	struct nf_conn_help *master_help;
+	int i, ret;
+
+	spin_lock_bh(&nf_conntrack_expect_lock);
+	master_help = nfct_help(expect[0]->master);
+	if (!master_help || master_help != nfct_help(expect[1]->master)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	for (i = 0; i < 2; i++) {
+		ret = __nf_ct_expect_check(expect[i], flags);
+		if (ret < 0) {
+			if (i == 1)
+				master_help->expecting[expect[0]->class]--;
+			goto out;
+		}
+		master_help->expecting[expect[i]->class]++;
+	}
+
+	for (i = 0; i < 2; i++) {
+		nf_ct_expect_insert(expect[i]);
+		nf_ct_expect_event_report(IPEXP_NEW, expect[i], 0, 0);
+	}
+out:
+	spin_unlock_bh(&nf_conntrack_expect_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(nf_ct_expect_related_pair);
+
 void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data),
 				  void *data)
 {
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index 6b00c81084fe22..115d955bfaef0f 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -585,6 +585,7 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
 				     unsigned int medialen,
 				     union nf_inet_addr *rtp_addr)
 {
+	struct nf_conntrack_expect *rtp_pair[2] = { rtp_exp, rtcp_exp };
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
@@ -615,24 +616,15 @@ static unsigned int nf_nat_sdp_media(struct sk_buff *skb, unsigned int protoff,
 		int ret;
 
 		rtp_exp->tuple.dst.u.udp.port = htons(port);
-		ret = nf_ct_expect_related(rtp_exp,
-					   NF_CT_EXP_F_SKIP_MASTER);
-		if (ret == -EBUSY)
-			continue;
-		else if (ret < 0) {
-			port = 0;
-			break;
-		}
 		rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
-		ret = nf_ct_expect_related(rtcp_exp,
-					   NF_CT_EXP_F_SKIP_MASTER);
+
+		ret = nf_ct_expect_related_pair(rtp_pair,
+						NF_CT_EXP_F_SKIP_MASTER);
 		if (ret == 0)
 			break;
-		else if (ret == -EBUSY) {
-			nf_ct_unexpect_related(rtp_exp);
+		else if (ret == -EBUSY)
 			continue;
-		} else if (ret < 0) {
-			nf_ct_unexpect_related(rtp_exp);
+		else if (ret < 0) {
 			port = 0;
 			break;
 		}

From 8ced68fe293a58f290f6eb3bb5441bf2cf78e88b Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 12 Aug 2026 10:03:38 +0200
Subject: [PATCH 0539/1982] netfilter: ctnetlink: do not expose expectation
 DEAD flag

[ Upstream commit 322371b09058ad10d0282a0e7ec8eaa764e6aaac ]

Expose expectation flags included in the NF_CT_EXPECT_MASK bitmask
only. The DEAD flag is internal, do not expose it.

Fixes: b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack GC to reap expectations")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_netlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d7c4f34f1caf0a..6ccb23a640d853 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3050,7 +3050,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
 #endif
 	if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
 	    nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) ||
-	    nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
+	    nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags & NF_CT_EXPECT_MASK)) ||
 	    nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
 		goto nla_put_failure;
 

From db0f1d03fbd1bf8063392cd2bc557c255a9e9ac2 Mon Sep 17 00:00:00 2001
From: Qing Luo <luoqing@kylinos.cn>
Date: Mon, 2 Nov 2026 01:52:02 -0800
Subject: [PATCH 0540/1982] sctp: auth: discard auth_chunk when skb_clone fails

[ Upstream commit 9ae7ed101cf28613071ebfbc42668c8917a670cf ]

When processing AUTH + COOKIE-ECHO packets, if skb_clone() fails
due to memory pressure, chunk->auth_chunk is NULL. The original
code still sets chunk->auth = 1 and continues, leaving the
COOKIE-ECHO to be processed without a valid auth_chunk for
deferred verification.

Discard the AUTH chunk early via pdiscard when skb_clone() fails,
so that the receive loop can continue processing remaining chunks
in the inqueue instead of stalling the entire packet.

Signed-off-by: Qing Luo <luoqing@kylinos.cn>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260723061107.384106-1-l1138897701@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Harshvardhan Jha <harshvardhan.j.jha@oracle.com>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/associola.c   | 4 ++++
 net/sctp/endpointola.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index ca55be94e8d4dc..db339618ba55f9 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1009,6 +1009,10 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 							      GFP_ATOMIC);
+				if (!chunk->auth_chunk) {
+					chunk->pdiscard = 1;
+					continue;
+				}
 				chunk->auth = 1;
 				continue;
 			}
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 31e989dfe84669..be2e2bb2c11735 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -368,6 +368,10 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
 			if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
 				chunk->auth_chunk = skb_clone(chunk->skb,
 								GFP_ATOMIC);
+				if (!chunk->auth_chunk) {
+					chunk->pdiscard = 1;
+					continue;
+				}
 				chunk->auth = 1;
 				continue;
 			}

From 59a6d8eda1c5dddecbed8665d86723ee6adda34e Mon Sep 17 00:00:00 2001
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
Date: Thu, 15 Oct 2026 10:20:25 +0200
Subject: [PATCH 0541/1982] dt-bindings: interrupt-controller: gicv5: Relax IRS
 properties constraints

[ Upstream commit 1d77e79d62cfe46ad3619d42ee0d1ebd3f0f79f4 ]

An IRS is architecturally allowed to be stand-alone (ie with no direct
CPU connection).

Relax "cpus" and "arm,iaffids" properties constraints allowing a standalone
IRS configuration.

Fixes: 7d7299bd07c6 ("dt-bindings: interrupt-controller: Add Arm GICv5")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20261015-gicv5-irs-no-cpus-v1-1-d4b337b7f000@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../bindings/interrupt-controller/arm,gic-v5.yaml        | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
index 86ca7f3ac28103..b901e4288816a6 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml
@@ -120,13 +120,14 @@ patternProperties:
 
       cpus:
         description:
-          CPUs managed by the IRS.
+          CPUs managed by the IRS. Omit it if the IRS has no associated CPUs.
 
       arm,iaffids:
         $ref: /schemas/types.yaml#/definitions/uint16-array
         description:
           Interrupt AFFinity ID (IAFFID) associated with the CPU whose
           CPU node phandle is at the same index in the cpus array.
+          Omit it if the IRS has no associated CPUs.
 
     patternProperties:
       "^its@[0-9a-f]+$":
@@ -210,12 +211,14 @@ patternProperties:
           - reg
           - reg-names
 
+    dependencies:
+      cpus: [ "arm,iaffids" ]
+      arm,iaffids: [ cpus ]
+
     required:
       - compatible
       - reg
       - reg-names
-      - cpus
-      - arm,iaffids
 
 additionalProperties: false
 

From 7d38a96a93270e8ceba63c2d95807b6c1c748f5f Mon Sep 17 00:00:00 2001
From: Lorenzo Pieralisi <lpieralisi@kernel.org>
Date: Thu, 15 Oct 2026 10:20:26 +0200
Subject: [PATCH 0542/1982] irqchip/gic-v5: Fix standalone IRSes OF probe

[ Upstream commit 64212d63193cfd81849f5948365c7b0ecd011745 ]

An IRS is architecturally allowed to be standalone, namely, with no
direct CPUs connections. Make sure such configuration is allowed on
OF firmware by skipping "cpus" and "arm,iaffids" IRS node properties
parsing if they are not present so that the IRS configuration can
complete successfully.

Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20261015-gicv5-irs-no-cpus-v1-2-d4b337b7f000@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v5-irs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index cf951d4071cbba..554106a22d1a2c 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -604,6 +604,10 @@ static int __init gicv5_irs_of_init_affinity(struct device_node *node,
 	u16 iaffid_mask = GENMASK(iaffid_bits - 1, 0);
 	int ret, i, ncpus, niaffids;
 
+	/* An IRS is architecturally allowed to have no cpus associated with it */
+	if (!of_property_present(node, "cpus") && !of_property_present(node, "arm,iaffids"))
+		return 0;
+
 	ncpus = of_count_phandle_with_args(node, "cpus", NULL);
 	if (ncpus < 0)
 		return -EINVAL;

From 59c7c68ec4dec87942ed3179e1821cf4e9387e02 Mon Sep 17 00:00:00 2001
From: Matthew Auld <matthew.auld@intel.com>
Date: Fri, 12 Jun 2026 18:05:02 +0100
Subject: [PATCH 0543/1982] drm/xe/display: skip FORCE_WC and vm_bound check
 for external dma-bufs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3e493f88c84088ccd7b53cdd23ac5c875c9a60dd ]

Currently, xe_display_bo_framebuffer_init() unconditionally attempts to
apply XE_BO_FLAG_FORCE_WC to the buffer and rejects the FB creation with
-EINVAL if the BO is already VM_BINDed.

However, for imported dma-bufs (ttm_bo_type_sg), this check doesn't seem
to make much sense since CPU caching policy is entirely controlled by
the exporter. Plus there is no place to set this flag, in the first
place. Also this is not rejected if not yet vm_binded, but that seems
arbitrary since setting or not setting FORCE_WC should a noop either
way, at this stage, and whether it is currently VM_BINDed makes no
difference.

Currently if we run an app and offload rendering to an external dGPU,
like NV or another xe device, the dma-buf passed back to the compositor
(igpu) will be an actual external import from xe pov, and it will be
missing FORCE_WC, and if the compositor side did a VM_BIND before
turning into it into an fb the whole thing gets rejected.

So it looks like we either need to reject outright, no matter what, or
this usecase is valid and we need to loosen the restriction for sg
buffers.  Proposing here to loosen the restriction.

Assisted-by: Gemini:gemini-3.1-pro-preview
Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7919
Fixes: 44e694958b95 ("drm/xe/display: Implement display support")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Maarten Lankhorst <dev@lankhorst.se>
Cc: <stable@vger.kernel.org> # v6.12+
Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
Link: https://patch.msgid.link/20260612170501.550816-2-matthew.auld@intel.com
[ sashal: Used SCANOUT in place of FORCE_WC and adapted the hunks to the older intel_fb_bo.c and xe_fb_pin.c code, adding the ttm_bo_type_sg exemption to both the flag check and the pin-time drm_WARN_ON. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/xe/display/intel_fb_bo.c | 3 ++-
 drivers/gpu/drm/xe/display/xe_fb_pin.c   | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/xe/display/intel_fb_bo.c b/drivers/gpu/drm/xe/display/intel_fb_bo.c
index ebdb22c9499d7c..b98afefdc4c840 100644
--- a/drivers/gpu/drm/xe/display/intel_fb_bo.c
+++ b/drivers/gpu/drm/xe/display/intel_fb_bo.c
@@ -46,7 +46,8 @@ int intel_fb_bo_framebuffer_init(struct drm_framebuffer *fb,
 	if (ret)
 		goto err;
 
-	if (!(bo->flags & XE_BO_FLAG_SCANOUT)) {
+	if (!(bo->flags & XE_BO_FLAG_SCANOUT) &&
+	    bo->ttm.type != ttm_bo_type_sg) {
 		/*
 		 * XE_BO_FLAG_SCANOUT should ideally be set at creation, or is
 		 * automatically set when creating FB. We cannot change caching
diff --git a/drivers/gpu/drm/xe/display/xe_fb_pin.c b/drivers/gpu/drm/xe/display/xe_fb_pin.c
index fa5c70478713a2..c3e4645a946739 100644
--- a/drivers/gpu/drm/xe/display/xe_fb_pin.c
+++ b/drivers/gpu/drm/xe/display/xe_fb_pin.c
@@ -420,7 +420,8 @@ int intel_plane_pin_fb(struct intel_plane_state *new_plane_state,
 		return 0;
 
 	/* We reject creating !SCANOUT fb's, so this is weird.. */
-	drm_WARN_ON(bo->ttm.base.dev, !(bo->flags & XE_BO_FLAG_SCANOUT));
+	drm_WARN_ON(bo->ttm.base.dev, !(bo->flags & XE_BO_FLAG_SCANOUT) &&
+		    bo->ttm.type != ttm_bo_type_sg);
 
 	vma = __xe_pin_fb_vma(intel_fb, &new_plane_state->view.gtt, alignment);
 

From be58823c0e2cf441be84fca9076af30e6719f127 Mon Sep 17 00:00:00 2001
From: Yosry Ahmed <yosry@kernel.org>
Date: Mon, 13 Jul 2026 18:10:18 +0000
Subject: [PATCH 0544/1982] KVM: x86: Always initialize EFER reserved bits on
 vendor initialization

[ Upstream commit a4b8acd428ba3f03952ef309d7f438dbc357557b ]

EFER reserved bits are statically initialized, and do not reset if a
vendor module is re-loaded. For example, loading kvm_amd with nested=1
removes EFER.SVME (and potentially EFER.LMSLE) from the reserved bits.
Reloading kvm_amd with nested=0 does not add them back, allowing
userspace to set EFER.SVME with nested=0.

Re-initializing EFER reserved bits before configuring them on vendor
initialization.

Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260713181020.2735367-4-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
[ sashal: Moved the EFER reserved-bits reset into a new static kvm_init_efer_bits() in x86.c, called from kvm_x86_vendor_init() before hardware_setup(), since the MSR split files and kvm_setup_efer_caps() don't exist here. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/x86.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 907efeed6c91df..9493af5fa8275e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -106,8 +106,7 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_host);
 #define emul_to_vcpu(ctxt) \
 	((struct kvm_vcpu *)(ctxt)->vcpu)
 
-/* Enable syscall by default because its emulated by KVM */
-static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
+static u64 __read_mostly efer_reserved_bits;
 
 #define KVM_EXIT_HYPERCALL_VALID_MASK (1 << KVM_HC_MAP_GPA_RANGE)
 
@@ -1432,6 +1431,12 @@ static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 	return 0;
 }
 
+static void kvm_init_efer_bits(void)
+{
+	/* Enable syscall by default because its emulated by KVM */
+	efer_reserved_bits = ~((u64)EFER_SCE);
+}
+
 void kvm_enable_efer_bits(u64 mask)
 {
        efer_reserved_bits &= ~mask;
@@ -9757,6 +9762,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
 	if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
 		rdmsrq(MSR_IA32_ARCH_CAPABILITIES, kvm_host.arch_capabilities);
 
+	kvm_init_efer_bits();
+
 	r = ops->hardware_setup();
 	if (r != 0)
 		goto out_mmu_exit;

From fb59d3c60513f586a3e25f66ab52ae6d8aa465b9 Mon Sep 17 00:00:00 2001
From: Dev Jain <dev.jain@arm.com>
Date: Fri, 3 Jul 2026 11:41:57 +0000
Subject: [PATCH 0545/1982] mm/migrate: use huge_ptep_get() in
 remove_migration_pte()

[ Upstream commit ac1ec50d71b953524100ddc09057ee61a3dfaff3 ]

remove_migration_pte() converts migration entries back to present PTEs
after folio migration completes.  For hugetlb folios,
page_vma_mapped_walk() returns the pte pointer to the hugetlb folio in
pvmw.pte, but the code reads it with ptep_get().

On arches which provide their own huge_ptep_get() to dereference a huge
pte pointer, accessing via ptep_get() would cause pte_pfn(),
pte_present() etc to misbehave.

It is not clear whether this has a trivially visible effect to userspace.

Use huge_ptep_get() to dereference a huge pte pointer.

Link: https://lore.kernel.org/20260703114202.365553-5-dev.jain@arm.com
Fixes: 290408d4a250 ("hugetlb: hugepage migration core")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Jann Horn <jannh@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/migrate.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/mm/migrate.c b/mm/migrate.c
index 3159be53a00d36..08f1382318024d 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -370,7 +370,11 @@ static bool remove_migration_pte(struct folio *folio,
 			continue;
 		}
 #endif
-		old_pte = ptep_get(pvmw.pte);
+		if (folio_test_hugetlb(folio))
+			old_pte = huge_ptep_get(vma->vm_mm, pvmw.address,
+						pvmw.pte);
+		else
+			old_pte = ptep_get(pvmw.pte);
 		if (rmap_walk_arg->map_unused_to_zeropage &&
 		    try_to_map_unused_to_zeropage(&pvmw, folio, old_pte, idx))
 			continue;

From d7e0602fe5a4adaee247c050981cf78784c19e04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jose=20Villase=C3=B1or=20Montfort?= <pepemontfort@gmail.com>
Date: Tue, 28 Jul 2026 14:13:09 -0600
Subject: [PATCH 0546/1982] HID: input: read battery capacity from its actual
 report offset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d07644524b6511b622ee7b0e2e68c9ee43d522a4 ]

hidinput_query_battery_capacity() assumes the state-of-charge value is
the first byte following the report ID (buf[1]) and ignores where the
battery field actually sits within the report.

An Apple Magic Trackpad 2 precedes the AbsoluteStateOfCharge byte with a
byte of status flags in its battery reports, so this query returns the
flags byte instead of the charge level.

The device happens to make that easy to observe, because it exposes the
same cell twice: its report descriptor declares AbsoluteStateOfCharge in
two reports (0x90 and 0x9b), so hidinput_setup_battery() registers two
power supplies. Only the first one is refreshed by hid-magicmouse -- it
uses hid_get_battery(), which returns the first battery of the list --
and that refresh goes through the report event path, which parses the
field correctly. Nothing ever reports the second one, so every read of
its capacity takes the query path above. On a USB-C Magic Trackpad over
USB, on an unpatched 7.1.5:

  hid-<serial>-battery-144 = 100%  (Charging)      <- report event path
  hid-<serial>-battery-155 =   3%  (Discharging)   <- query path

Both are the same physical battery. A raw HIDIOCGINPUT of the two
reports at that same moment:

  report 0x90 -> [90 03 64]
  report 0x9b -> [9b 03 64 64 00 00 10 00 00 00 00 00 00 00]
                     ^flags ^SoC = 0x64 = 100%

The device answers correctly in both cases; only the offset the kernel
reads the capacity from is wrong. 0x03 is the flags byte (present,
charging), reported as "3%".

Bluetooth takes the same query path for its capacity, where the trackpad
reported a bogus near-constant ~4% -- 0b100, the FullyCharged flag --
regardless of the real charge.

Store the battery field's offset within the report at setup time and use
it when querying, so the capacity is read from its real position. The
report event path already parses the field correctly through the HID
core; only the explicit GET_REPORT query was wrong.

Devices whose capacity field is the first field in the report have a
report_offset of 0 and are unaffected (buf[1 + 0] == buf[1]).

Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
Cc: stable@vger.kernel.org
Signed-off-by: Jose Villaseñor Montfort <pepemontfort@gmail.com>
Reviewed-by: Alec Hall <signshop.alec@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
[ sashal: Adapted to the single-battery layout by using dev->battery_report_offset in struct hid_device instead of bat->report_offset in struct hid_battery, and kept the explicit kfree(buf) handling. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-input.c | 17 +++++++++++++----
 include/linux/hid.h     |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b2fa8c42f09b3c..6e1f2bd440ebad 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -437,19 +437,27 @@ static int hidinput_query_battery_capacity(struct hid_device *dev)
 {
 	u8 *buf;
 	int ret;
+	/*
+	 * The capacity field may not be the first field in the report: some
+	 * devices (e.g. the Apple Magic Trackpad 2 over Bluetooth) precede it
+	 * with status flags. Read it from its actual byte offset in the report
+	 * (report_offset is in bits; the leading byte is the report id).
+	 */
+	int offset = 1 + dev->battery_report_offset / 8;
+	int len = offset + 1;
 
-	buf = kmalloc(4, GFP_KERNEL);
+	buf = kmalloc(max(len, 4), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
-	ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4,
+	ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, max(len, 4),
 				 dev->battery_report_type, HID_REQ_GET_REPORT);
-	if (ret < 2) {
+	if (ret < len) {
 		kfree(buf);
 		return -ENODATA;
 	}
 
-	ret = hidinput_scale_battery_capacity(dev, buf[1]);
+	ret = hidinput_scale_battery_capacity(dev, buf[offset]);
 	kfree(buf);
 	return ret;
 }
@@ -567,6 +575,7 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
 	dev->battery_max = max;
 	dev->battery_report_type = report_type;
 	dev->battery_report_id = field->report->id;
+	dev->battery_report_offset = field->report_offset;
 	dev->battery_charge_status = POWER_SUPPLY_STATUS_DISCHARGING;
 
 	/*
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 29561887bea8c0..5c49f299129788 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -679,6 +679,7 @@ struct hid_device {
 	__s32 battery_max;
 	__s32 battery_report_type;
 	__s32 battery_report_id;
+	__s32 battery_report_offset;
 	__s32 battery_charge_status;
 	enum hid_battery_status battery_status;
 	bool battery_avoid_query;

From 215bf2a69844e59109027f02de865a3df8a7a7d8 Mon Sep 17 00:00:00 2001
From: Brendan Jackman <jackmanb@google.com>
Date: Wed, 15 Jul 2026 09:03:59 +0000
Subject: [PATCH 0547/1982] mm/page_alloc: don't spin_trylock() when disallowed
 in free_one_page()

[ Upstream commit 52dcc33881e55189650404f833c0e6b7913d6c16 ]

__free_frozen_pages() checks can_spin_trylock() before entering into the
main free_frozen_page_commit()/free_one_page() path, but before this it
can get to free_one_page() via the !pcp_allowed_order() and
MIGRATE_ISOLATE paths.

The !pcp_allowed_order() path depends on usage by callers so might not be
possible in practice.  The MIGRATE_ISOLATE path probably means kernel
crashes and privilege escalation if anyone ever did memory hotplug and BPF
tracing on a PREEMPT_RT or !SMP build.

Link: https://lore.kernel.org/20260715-alloc-nolock-fixes-v1-2-fadc49952dda@google.com
Signed-off-by: Brendan Jackman <jackmanb@google.com>
Fixes: 8c57b687e833 ("mm, bpf: Introduce free_pages_nolock()")
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260710-spin-trylock-followup-v1-0-affb5fe5ed00%40google.com?part=2
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ sashal: Replaced the missing can_spin_trylock() helper call in free_one_page() with its equivalent inline condition, matching the existing open-coded checks in this tree. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ec5ca89cbc0006..ff863a87f2b853 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1585,7 +1585,9 @@ static void free_one_page(struct zone *zone, struct page *page,
 	unsigned long flags;
 
 	if (unlikely(fpi_flags & FPI_TRYLOCK)) {
-		if (!spin_trylock_irqsave(&zone->lock, flags)) {
+		if ((IS_ENABLED(CONFIG_PREEMPT_RT) && (in_nmi() || in_hardirq())) ||
+		    (!IS_ENABLED(CONFIG_SMP) && in_nmi()) ||
+		    !spin_trylock_irqsave(&zone->lock, flags)) {
 			add_page_to_zone_llist(zone, page, order);
 			return;
 		}

From bbac028f2e9cf3497da69946f53a9c38b29035ed Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 7 Aug 2026 17:56:30 +0300
Subject: [PATCH 0548/1982] i3c: master: Fix potential UAF in
 i3c_device_uevent()

[ Upstream commit e5e8dd2e959f470524c16ca444d001c90d6bb3ad ]

i3c_device_uevent() dereferences i3cdev->desc without holding the bus
normal-use lock.  Since the descriptor pointer can be replaced
concurrently, including when a uevent is generated from sysfs, this can
result in dereferencing a stale descriptor and lead to a use-after-free.

Use i3c_device_get_info() instead, which protects access to the
descriptor with the normal-use lock.

Commit 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling
i3c_device_get_info() to avoid deadlock") replaced the accessor with a
direct descriptor dereference because i3c_device_get_info() would
recursively acquire bus->lock during device registration.

This change depends on "i3c: master: Fix recursive locking during device
registration", which moves device registration out from under bus->lock
and removes the possibility of that deadlock.  Without that change,
restoring the i3c_device_get_info() call would reintroduce the deadlock.

Fixes: 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock")
Cc: stable@vger.kernel.org # requires "i3c: master: Fix recursive locking during device registration"
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-7-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i3c/master.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c8ee43b70d5ec8..038f7b2ec8c485 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -315,8 +315,7 @@ static int i3c_device_uevent(const struct device *dev, struct kobj_uevent_env *e
 	struct i3c_device_info devinfo;
 	u16 manuf, part, ext;
 
-	if (i3cdev->desc)
-		devinfo = i3cdev->desc->info;
+	i3c_device_get_info(i3cdev, &devinfo);
 	manuf = I3C_PID_MANUF_ID(devinfo.pid);
 	part = I3C_PID_PART_ID(devinfo.pid);
 	ext = I3C_PID_EXTRA_INFO(devinfo.pid);

From 01a4c00041bea67eeb554ac158992ea70fe89db5 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Apr 2026 18:56:36 +0800
Subject: [PATCH 0549/1982] LoongArch: KVM: Check kvm_request_pending() in
 kvm_late_check_requests()

[ Upstream commit 14d2714d6537a9df5bea2515185034dbb9d30f03 ]

Add kvm_request_pending() checking firstly in kvm_late_check_requests(),
at most time there is no pending request, then the following pending bit
checking can be skipped.

Also embed function kvm_check_pmu() in to kvm_late_check_requests(), and
put it after the kvm_request_pending() checking.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Stable-dep-of: 32d05564a612 ("LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kvm/vcpu.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index 32768d8d9347ec..760985b8bd728c 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -148,14 +148,6 @@ static void kvm_lose_pmu(struct kvm_vcpu *vcpu)
 	kvm_restore_host_pmu(vcpu);
 }
 
-static void kvm_check_pmu(struct kvm_vcpu *vcpu)
-{
-	if (kvm_check_request(KVM_REQ_PMU, vcpu)) {
-		kvm_own_pmu(vcpu);
-		vcpu->arch.aux_inuse |= KVM_LARCH_PMU;
-	}
-}
-
 static void kvm_update_stolen_time(struct kvm_vcpu *vcpu)
 {
 	u32 version;
@@ -226,6 +218,15 @@ static int kvm_check_requests(struct kvm_vcpu *vcpu)
 static void kvm_late_check_requests(struct kvm_vcpu *vcpu)
 {
 	lockdep_assert_irqs_disabled();
+
+	if (!kvm_request_pending(vcpu))
+		return;
+
+	if (kvm_check_request(KVM_REQ_PMU, vcpu)) {
+		kvm_own_pmu(vcpu);
+		vcpu->arch.aux_inuse |= KVM_LARCH_PMU;
+	}
+
 	if (kvm_check_request(KVM_REQ_TLB_FLUSH_GPA, vcpu))
 		if (vcpu->arch.flush_gpa != INVALID_GPA) {
 			kvm_flush_tlb_gpa(vcpu, vcpu->arch.flush_gpa);
@@ -285,7 +286,6 @@ static int kvm_pre_enter_guest(struct kvm_vcpu *vcpu)
 		/* Make sure the vcpu mode has been written */
 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
 		kvm_check_vpid(vcpu);
-		kvm_check_pmu(vcpu);
 
 		/*
 		 * Called after function kvm_check_vpid()

From f26957f88034c4aacee8b3c59ed5eb0a06bbb7b2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 11 Jun 2026 20:46:43 +0800
Subject: [PATCH 0550/1982] LoongArch: KVM: Deliver interrupt after
 IN_GUEST_MODE is set

[ Upstream commit 8c5cd2b9d6a724998c1ab9af06ac897b6152d568 ]

Interrupt delivery should be called after IN_GUEST_MODE is set. Other
threads may be posting interrupt however does not send IPI to the vCPU,
since the vCPU is not in IN_GUEST_MODE yet.

Here move function call with kvm_deliver_intr() after IN_GUEST_MODE is
set, and set mode with OUTSIDE_GUEST_MODE with atomic method.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Stable-dep-of: 32d05564a612 ("LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kvm/vcpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index 760985b8bd728c..ee969e3957009a 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -281,10 +281,10 @@ static int kvm_pre_enter_guest(struct kvm_vcpu *vcpu)
 		 * check vmid before vcpu enter guest
 		 */
 		local_irq_disable();
-		kvm_deliver_intr(vcpu);
 		kvm_deliver_exception(vcpu);
 		/* Make sure the vcpu mode has been written */
 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
+		kvm_deliver_intr(vcpu);
 		kvm_check_vpid(vcpu);
 
 		/*
@@ -322,7 +322,7 @@ static int kvm_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu)
 	u32 intr = estat & CSR_ESTAT_IS;
 	u32 ecode = (estat & CSR_ESTAT_EXC) >> CSR_ESTAT_EXC_SHIFT;
 
-	vcpu->mode = OUTSIDE_GUEST_MODE;
+	smp_store_mb(vcpu->mode, OUTSIDE_GUEST_MODE);
 
 	/* Set a default exit reason */
 	run->exit_reason = KVM_EXIT_UNKNOWN;

From c7427dc319d3ad58f6ff49b0f2e7932a5273e61c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 10 Aug 2026 12:21:50 +0800
Subject: [PATCH 0551/1982] LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE
 is set

[ Upstream commit 32d05564a6128d59ea876cf9078fe6866a809e14 ]

In function kvm_make_vcpu_request(), it will send IPI to physical CPU
when vCPU is in IN_GUEST_MODE mode. And physical CPU is set in function
kvm_check_vpid(), thus it should be called before IN_GUEST_MODE is set.
Otherwise IPI will send to wrong old physical CPU where vCPU is running.

Cc: stable@vger.kernel.org
Fixes: 2fc3bd86db4b ("LoongArch: KVM: Implement basic vcpu interfaces")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kvm/vcpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
index ee969e3957009a..e0bd2ceeada4a9 100644
--- a/arch/loongarch/kvm/vcpu.c
+++ b/arch/loongarch/kvm/vcpu.c
@@ -282,10 +282,10 @@ static int kvm_pre_enter_guest(struct kvm_vcpu *vcpu)
 		 */
 		local_irq_disable();
 		kvm_deliver_exception(vcpu);
+		kvm_check_vpid(vcpu);
 		/* Make sure the vcpu mode has been written */
 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
 		kvm_deliver_intr(vcpu);
-		kvm_check_vpid(vcpu);
 
 		/*
 		 * Called after function kvm_check_vpid()

From 5f8e8c06c53f14e2b22e1fa62031392782b154d5 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Sat, 30 May 2026 09:19:20 -0400
Subject: [PATCH 0552/1982] nfsd: dedup nfs4_client_to_reclaim inserts

[ Upstream commit 9b57793863f69c608691c98e57c2f9be2db9dfed ]

nfs4_client_to_reclaim() unconditionally allocates a new
nfs4_client_reclaim, prepends it to reclaim_str_hashtbl[], and bumps
reclaim_str_hashtbl_size with no check for an existing entry for the
same client name.  After a reboot with a populated recovery directory
that inflates the counter by one for every client that reclaims:

    boot:    load_recdir()
               nfs4_client_to_reclaim(name)   /* entry #1, size++ */

    grace:   RECLAIM_COMPLETE
               __nfsd4_create_reclaim_record_grace()
                 nfs4_client_to_reclaim(name) /* entry #2, size++ */

inc_reclaim_complete() ends the grace period early only when

    atomic_inc_return(&nn->nr_reclaim_complete) ==
        nn->reclaim_str_hashtbl_size

With reclaim_str_hashtbl_size at 2N and nr_reclaim_complete capped at
N, the equality never holds and the fast end-of-grace path is dead.
The grace period always runs out the full 90-second laundromat timer,
and the shadow entry left in the hash table carries a dangling cr_clp
for any reader that walks it.

Fix nfs4_client_to_reclaim() to look the name up with
nfsd4_find_reclaim_client() first and, on a hit, fold the new
princhash into the existing record (if it lacks one) and return that
record without allocating or touching reclaim_str_hashtbl_size.  On
kmemdup() failure during the fold-in, return NULL so
__cld_pipe_inprogress_downcall() surfaces -EFAULT to nfsdcld, matching
the miss-path contract.

Add an rw_semaphore (reclaim_str_hashtbl_lock) to struct nfsd_net that
serialises all access to reclaim_str_hashtbl[] and
reclaim_str_hashtbl_size.  Writers (nfs4_client_to_reclaim,
nfs4_remove_reclaim_record callers) hold the write side; readers
(nfsd4_cld_check*, inc_reclaim_complete, clients_still_reclaiming,
nfs4_has_reclaimed_state, nfsd4_check_legacy_client) hold the read
side.  All call sites are in sleepable context, and none is a hot
path, so the rwsem cost is negligible.

Reported-by: Chris Mason <clm@meta.com>
Fixes: 362063a595be ("nfsd: keep a tally of RECLAIM_COMPLETE operations when using nfsdcld")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-4-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/netns.h       |  6 ++++-
 fs/nfsd/nfs4recover.c | 36 ++++++++++++++++++++-----
 fs/nfsd/nfs4state.c   | 61 ++++++++++++++++++++++++++++++++++++++-----
 3 files changed, 89 insertions(+), 14 deletions(-)

diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
index b9485b24df0a5c..ccb0256b9366e1 100644
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -93,6 +93,7 @@ struct nfsd_net {
 	 */
 	struct list_head *reclaim_str_hashtbl;
 	int reclaim_str_hashtbl_size;
+	struct rw_semaphore reclaim_str_hashtbl_lock;
 	struct list_head *conf_id_hashtbl;
 	struct rb_root conf_name_tree;
 	struct list_head *unconf_id_hashtbl;
@@ -105,7 +106,10 @@ struct nfsd_net {
 	 * close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
 	 * for last close replay.
 	 *
-	 * All of the above fields are protected by the client_mutex.
+	 * reclaim_str_hashtbl[], reclaim_str_hashtbl_size are protected by
+	 * reclaim_str_hashtbl_lock.
+	 *
+	 * All of the remaining fields are protected by the client_lock.
 	 */
 	struct list_head client_lru;
 	struct list_head close_lru;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 37006d0776ebdc..b78b41fbbd4ffb 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -337,10 +337,12 @@ __nfsd4_remove_reclaim_record_grace(const char *dname, int len,
 		return;
 	}
 	name.len = len;
+	down_write(&nn->reclaim_str_hashtbl_lock);
 	crp = nfsd4_find_reclaim_client(name, nn);
-	kfree(name.data);
 	if (crp)
 		nfs4_remove_reclaim_record(crp, nn);
+	up_write(&nn->reclaim_str_hashtbl_lock);
+	kfree(name.data);
 }
 
 static void
@@ -541,6 +543,7 @@ nfs4_legacy_state_init(struct net *net)
 	for (i = 0; i < CLIENT_HASH_SIZE; i++)
 		INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
 	nn->reclaim_str_hashtbl_size = 0;
+	init_rwsem(&nn->reclaim_str_hashtbl_lock);
 
 	return 0;
 }
@@ -660,13 +663,16 @@ nfsd4_check_legacy_client(struct nfs4_client *clp)
 		goto out_enoent;
 	}
 	name.len = HEXDIR_LEN;
+	down_read(&nn->reclaim_str_hashtbl_lock);
 	crp = nfsd4_find_reclaim_client(name, nn);
-	kfree(name.data);
 	if (crp) {
 		set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
 		crp->cr_clp = clp;
-		return 0;
 	}
+	up_read(&nn->reclaim_str_hashtbl_lock);
+	kfree(name.data);
+	if (crp)
+		return 0;
 
 out_enoent:
 	return -ENOENT;
@@ -1238,6 +1244,7 @@ nfsd4_cld_check(struct nfs4_client *clp)
 		return 0;
 
 	/* look for it in the reclaim hashtable otherwise */
+	down_read(&nn->reclaim_str_hashtbl_lock);
 	crp = nfsd4_find_reclaim_client(clp->cl_name, nn);
 	if (crp)
 		goto found;
@@ -1256,6 +1263,7 @@ nfsd4_cld_check(struct nfs4_client *clp)
 		if (!name.data) {
 			dprintk("%s: failed to allocate memory for name.data!\n",
 				__func__);
+			up_read(&nn->reclaim_str_hashtbl_lock);
 			return -ENOENT;
 		}
 		name.len = HEXDIR_LEN;
@@ -1266,9 +1274,11 @@ nfsd4_cld_check(struct nfs4_client *clp)
 
 	}
 #endif
+	up_read(&nn->reclaim_str_hashtbl_lock);
 	return -ENOENT;
 found:
 	crp->cr_clp = clp;
+	up_read(&nn->reclaim_str_hashtbl_lock);
 	return 0;
 }
 
@@ -1280,6 +1290,7 @@ nfsd4_cld_check_v2(struct nfs4_client *clp)
 	struct cld_net *cn = nn->cld_net;
 #endif
 	struct nfs4_client_reclaim *crp;
+	unsigned int princhashlen;
 	char *principal = NULL;
 
 	/* did we already find that this client is stable? */
@@ -1287,6 +1298,7 @@ nfsd4_cld_check_v2(struct nfs4_client *clp)
 		return 0;
 
 	/* look for it in the reclaim hashtable otherwise */
+	down_read(&nn->reclaim_str_hashtbl_lock);
 	crp = nfsd4_find_reclaim_client(clp->cl_name, nn);
 	if (crp)
 		goto found;
@@ -1305,6 +1317,7 @@ nfsd4_cld_check_v2(struct nfs4_client *clp)
 		if (!name.data) {
 			dprintk("%s: failed to allocate memory for name.data\n",
 					__func__);
+			up_read(&nn->reclaim_str_hashtbl_lock);
 			return -ENOENT;
 		}
 		name.len = HEXDIR_LEN;
@@ -1315,23 +1328,31 @@ nfsd4_cld_check_v2(struct nfs4_client *clp)
 
 	}
 #endif
+	up_read(&nn->reclaim_str_hashtbl_lock);
 	return -ENOENT;
 found:
-	if (crp->cr_princhash.len) {
+	princhashlen = crp->cr_princhash.len;
+	if (princhashlen) {
 		u8 digest[SHA256_DIGEST_SIZE];
+		u8 *pdata;
 
 		if (clp->cl_cred.cr_raw_principal)
 			principal = clp->cl_cred.cr_raw_principal;
 		else if (clp->cl_cred.cr_principal)
 			principal = clp->cl_cred.cr_principal;
-		if (principal == NULL)
+		if (principal == NULL) {
+			up_read(&nn->reclaim_str_hashtbl_lock);
 			return -ENOENT;
+		}
 		sha256(principal, strlen(principal), digest);
-		if (memcmp(crp->cr_princhash.data, digest,
-				crp->cr_princhash.len))
+		pdata = crp->cr_princhash.data;
+		if (memcmp(pdata, digest, princhashlen)) {
+			up_read(&nn->reclaim_str_hashtbl_lock);
 			return -ENOENT;
+		}
 	}
 	crp->cr_clp = clp;
+	up_read(&nn->reclaim_str_hashtbl_lock);
 	return 0;
 }
 
@@ -1431,6 +1452,7 @@ nfs4_cld_state_init(struct net *net)
 	for (i = 0; i < CLIENT_HASH_SIZE; i++)
 		INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
 	nn->reclaim_str_hashtbl_size = 0;
+	init_rwsem(&nn->reclaim_str_hashtbl_lock);
 	set_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags);
 	atomic_set(&nn->nr_reclaim_complete, 0);
 
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index b3ad502d89eb38..f5671861ef7e71 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2689,14 +2689,21 @@ static void inc_reclaim_complete(struct nfs4_client *clp)
 
 	if (!test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags))
 		return;
-	if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
+
+	down_read(&nn->reclaim_str_hashtbl_lock);
+	if (!nfsd4_find_reclaim_client(clp->cl_name, nn)) {
+		up_read(&nn->reclaim_str_hashtbl_lock);
 		return;
+	}
 	if (atomic_inc_return(&nn->nr_reclaim_complete) ==
 			nn->reclaim_str_hashtbl_size) {
+		up_read(&nn->reclaim_str_hashtbl_lock);
 		printk(KERN_INFO "NFSD: all clients done reclaiming, ending NFSv4 grace period (net %x)\n",
 				clp->net->ns.inum);
 		nfsd4_end_grace(nn);
+		return;
 	}
+	up_read(&nn->reclaim_str_hashtbl_lock);
 }
 
 static void expire_client(struct nfs4_client *clp)
@@ -6840,10 +6847,15 @@ static bool clients_still_reclaiming(struct nfsd_net *nn)
 
 	if (test_bit(NFSD_NET_GRACE_END_FORCED, &nn->flags))
 		return false;
-	if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags) &&
-			atomic_read(&nn->nr_reclaim_complete) ==
-			nn->reclaim_str_hashtbl_size)
-		return false;
+	if (test_bit(NFSD_NET_TRACK_RECLAIM_COMPLETES, &nn->flags)) {
+		int size;
+
+		down_read(&nn->reclaim_str_hashtbl_lock);
+		size = nn->reclaim_str_hashtbl_size;
+		up_read(&nn->reclaim_str_hashtbl_lock);
+		if (atomic_read(&nn->nr_reclaim_complete) == size)
+			return false;
+	}
 	if (!test_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
 		return false;
 	clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
@@ -9056,9 +9068,13 @@ bool
 nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
 {
 	struct nfs4_client_reclaim *crp;
+	bool found;
 
+	down_read(&nn->reclaim_str_hashtbl_lock);
 	crp = nfsd4_find_reclaim_client(name, nn);
-	return (crp && crp->cr_clp);
+	found = (crp && crp->cr_clp);
+	up_read(&nn->reclaim_str_hashtbl_lock);
+	return found;
 }
 
 /*
@@ -9071,10 +9087,39 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 	unsigned int strhashval;
 	struct nfs4_client_reclaim *crp;
 
+	down_write(&nn->reclaim_str_hashtbl_lock);
+
+	/*
+	 * A reclaim record for this client name may already exist (for
+	 * example, populated at boot from the recovery directory before
+	 * an in-grace RECLAIM_COMPLETE or an nfsdcld downcall delivers
+	 * the same name). Dedup here so reclaim_str_hashtbl_size stays
+	 * equal to the number of distinct client names; inc_reclaim_complete
+	 * relies on that equality to end the grace period via the fast path.
+	 */
+	crp = nfsd4_find_reclaim_client(name, nn);
+	if (crp) {
+		if (princhash.len && crp->cr_princhash.len == 0) {
+			void *pdata = kmemdup(princhash.data, princhash.len,
+					      GFP_KERNEL);
+			if (pdata) {
+				crp->cr_princhash.data = pdata;
+				crp->cr_princhash.len = princhash.len;
+			} else {
+				dprintk("%s: failed to allocate memory for princhash.data!\n",
+					__func__);
+				crp = NULL;
+			}
+		}
+		up_write(&nn->reclaim_str_hashtbl_lock);
+		return crp;
+	}
+
 	name.data = kmemdup(name.data, name.len, GFP_KERNEL);
 	if (!name.data) {
 		dprintk("%s: failed to allocate memory for name.data!\n",
 			__func__);
+		up_write(&nn->reclaim_str_hashtbl_lock);
 		return NULL;
 	}
 	if (princhash.len) {
@@ -9083,6 +9128,7 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 			dprintk("%s: failed to allocate memory for princhash.data!\n",
 				__func__);
 			kfree(name.data);
+			up_write(&nn->reclaim_str_hashtbl_lock);
 			return NULL;
 		}
 	} else
@@ -9102,6 +9148,7 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 		kfree(name.data);
 		kfree(princhash.data);
 	}
+	up_write(&nn->reclaim_str_hashtbl_lock);
 	return crp;
 }
 
@@ -9121,6 +9168,7 @@ nfs4_release_reclaim(struct nfsd_net *nn)
 	struct nfs4_client_reclaim *crp = NULL;
 	int i;
 
+	down_write(&nn->reclaim_str_hashtbl_lock);
 	for (i = 0; i < CLIENT_HASH_SIZE; i++) {
 		while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
 			crp = list_entry(nn->reclaim_str_hashtbl[i].next,
@@ -9129,6 +9177,7 @@ nfs4_release_reclaim(struct nfsd_net *nn)
 		}
 	}
 	WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
+	up_write(&nn->reclaim_str_hashtbl_lock);
 }
 
 /*

From 79d5f84e63a5dbd8a8fce9385b605501f17fb3cf Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 11 Jun 2026 16:00:56 -0400
Subject: [PATCH 0553/1982] nfsd: use test_and_clear_bit for somebody_reclaimed
 to prevent lost update

[ Upstream commit 0a5a548861ab09e79a6b3062ac17e410323af3cd ]

clients_still_reclaiming() uses separate test_bit() and clear_bit()
calls on NFSD_NET_SOMEBODY_RECLAIMED. A concurrent set_bit() from
the OPEN or LOCK reclaim path arriving between the test and clear
is silently lost, causing the next laundromat tick to end grace
prematurely.

Replace with test_and_clear_bit() to make the read-and-clear atomic.

Fixes: 8c67a210c90c ("nfsd: convert nfsd_net boolean flags to unsigned long flags word")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-13-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4state.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index f5671861ef7e71..e56f072d2e5de5 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6856,9 +6856,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn)
 		if (atomic_read(&nn->nr_reclaim_complete) == size)
 			return false;
 	}
-	if (!test_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
+	if (!test_and_clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags))
 		return false;
-	clear_bit(NFSD_NET_SOMEBODY_RECLAIMED, &nn->flags);
 	/*
 	 * If we've given them *two* lease times to reclaim, and they're
 	 * still not done, give up:

From 81648c2440fd9cf828cfb981accfb56fd0d900cf Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Mon, 17 Aug 2026 22:07:14 +0800
Subject: [PATCH 0554/1982] LoongArch: Expand module virtual address space to
 2GB

[ Upstream commit 18210a104bb97e28c26dc31fd9fc7b5c381fec62 ]

The current 256MB module virtual address space is easily exhausted when
loading massive graphics drivers such as amdgpu along with the large
unstripped symbol tables, resulting in allocation failures of "execmem:
unable to allocate memory".

Thus, expand the module virtual address space to 2GB while keeping
the current normal code model '-mcmodel=normal', rather than using the
medium code model '-mcmodel=medium'. This approach avoids the extra
performance overhead and larger binary size of forcing every function
call into a 2-instruction sequence of 'pcaddu18i + jirl'.

Given that individual module code segments rarely exceed 128MB, most
jumps remain fast direct calls by using the bl instruction. For the
long-distance jumps exceeding the +/-128MB limit, apply_r_larch_b26()
emits PLT entries, while signed_imm_check() guarantees the run-time
safety by rejecting any out-of-bound instruction offsets.

There is still a risk that the distance between .init.text and .text of
the same module exceeds 128MB. So we divide the 2GB virtual space to be
two sub-regions: the first 256MB is for module text, and the rest is for
module data.

Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
[ sashal: Kept the existing #ifdef CONFIG_EXECMEM guard in init.c instead of upstream's #if defined(CONFIG_EXECMEM) && defined(MODULES_VADDR), and added the new module text/data region defines after it. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/pgtable.h |  2 +-
 arch/loongarch/mm/init.c             | 17 ++++++++++++++---
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h
index e3563a52e5b5bf..e3ba4759b4d004 100644
--- a/arch/loongarch/include/asm/pgtable.h
+++ b/arch/loongarch/include/asm/pgtable.h
@@ -80,7 +80,7 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
  * still reliably trap.
  */
 #define MODULES_VADDR	(vm_map_base + PCI_IOSIZE + (2 * PAGE_SIZE))
-#define MODULES_END	(MODULES_VADDR + SZ_256M)
+#define MODULES_END	(MODULES_VADDR + SZ_2G) /* 256MB for text, rest for data */
 
 #ifdef CONFIG_KFENCE
 #define KFENCE_AREA_SIZE	(((CONFIG_KFENCE_NUM_OBJECTS + 1) * 2 + 2) * PAGE_SIZE)
diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
index 900ce1da75a436..aaf66c0a096c12 100644
--- a/arch/loongarch/mm/init.c
+++ b/arch/loongarch/mm/init.c
@@ -221,15 +221,26 @@ pte_t invalid_pte_table[PTRS_PER_PTE] __page_aligned_bss;
 EXPORT_SYMBOL(invalid_pte_table);
 
 #ifdef CONFIG_EXECMEM
+#define MODULES_TEXT_START (MODULES_VADDR)
+#define MODULES_TEXT_END   (MODULES_VADDR + SZ_256M)
+#define MODULES_DATA_START (MODULES_VADDR + SZ_256M)
+#define MODULES_DATA_END   (MODULES_END)
+
 static struct execmem_info execmem_info __ro_after_init;
 
 struct execmem_info __init *execmem_arch_setup(void)
 {
 	execmem_info = (struct execmem_info){
 		.ranges = {
-			[EXECMEM_DEFAULT] = {
-				.start	= MODULES_VADDR,
-				.end	= MODULES_END,
+			[EXECMEM_MODULE_TEXT] = {
+				.start	= MODULES_TEXT_START,
+				.end	= MODULES_TEXT_END,
+				.pgprot	= PAGE_KERNEL,
+				.alignment = 1,
+			},
+			[EXECMEM_MODULE_DATA] = {
+				.start	= MODULES_DATA_START,
+				.end	= MODULES_DATA_END,
 				.pgprot	= PAGE_KERNEL,
 				.alignment = 1,
 			},

From b396167a7e2145dd65e05d389eb914b41e8f2ee2 Mon Sep 17 00:00:00 2001
From: Gary Guo <gary@garyguo.net>
Date: Thu, 20 Aug 2026 14:57:32 +0100
Subject: [PATCH 0555/1982] rust: cfi: disable function merging if CFI is
 enabled

[ Upstream commit 29b03d1de967a177176d12811d970cac7882afcf ]

In Rust doc tests, there is a dummy `__module_firmware_test_init` function
generated by the example in `module_firmware!`'s documentation, which
just returns zero. Many other documentation examples generate functions
that produce zero. LKP test robot reports [1] a `Flags::zeroed` instance;
my local reproduction has a `Bounded::new::<0>`.

LLVM's MergeFunctionsPass incorrectly merges functions with different
KCFI types, causing `__module_firmware_test_init` to be merged into
one of the zero-returning functions. As module init is invoked via an
indirect function call, KCFI is checked and this produces a KCFI failure.

I've reported this bug to upstream LLVM [2]; in the meantime, disable
function merging if CFI is enabled. No separate treatment is needed for
CONFIG_RUST_INLINE_HELPERS, as Clang does not enable function merging
by default.

[ LLVM already has a pending PR:

    https://github.com/llvm/llvm-project/pull/217665

  which solves the issue. In addition, I asked upstream Rust if the
  unstable `-Zmerge-functions=disabled` flag will remain around:

    https://rust-lang.zulipchat.com/#narrow/channel/425075-rust-for-linux/topic/.60-Zmerge-functions.3Ddisabled.60/

  and it does indeed look like that will be the case. - Miguel ]

Reported-by: kernel test robot <yi1.lai@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202608201017.100a4511-lkp@intel.com [1]
Link: https://github.com/llvm/llvm-project/issues/217629 [2]
Signed-off-by: Gary Guo <gary@garyguo.net>
Cc: stable@vger.kernel.org
Fixes: ca627e636551 ("rust: cfi: add support for CFI_CLANG with Rust")
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://patch.msgid.link/20260820135733.37121-1-gary@kernel.org
[ Fixed typos as discussed. Reworded slightly for other typos. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 7c698d401dd54f..08be8b2cd2447a 100644
--- a/Makefile
+++ b/Makefile
@@ -1037,7 +1037,8 @@ endif
 ifdef CONFIG_RUST
 	# Always pass -Zsanitizer-cfi-normalize-integers as CONFIG_RUST selects
 	# CONFIG_CFI_ICALL_NORMALIZE_INTEGERS.
-	RUSTC_FLAGS_CFI   := -Zsanitizer=kcfi -Zsanitizer-cfi-normalize-integers
+	# Disable function merging as LLVM incorrectly merges functions with different KCFI types.
+	RUSTC_FLAGS_CFI   := -Zsanitizer=kcfi -Zsanitizer-cfi-normalize-integers -Zmerge-functions=disabled
 	KBUILD_RUSTFLAGS += $(RUSTC_FLAGS_CFI)
 	export RUSTC_FLAGS_CFI
 endif

From 8eaaabd4e9355e6dd567eb63b181eb389330c1d7 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
Date: Mon, 15 Jun 2026 10:49:07 -0700
Subject: [PATCH 0556/1982] mm/kmemleak: stop the task stack scan early when
 interrupted

[ Upstream commit eb11f56eeca56069613d00bf623607e305b271d9 ]

scan_block() already checks scan_should_stop() for every pointer and bails
out of the current block, but the task stack walk cannot tell and keeps
issuing a separate scan_should_stop() between every task.

Return that status from scan_block() and use it as the task stack loop
condition, so the walk stops as soon as a scan is interrupted.

Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-2-acecd7d7fd92@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Qian Cai <cai@lca.pw>
Cc: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 3541a2b06ecd ("mm/kmemleak: report RCU-tasks quiescent states during the scan")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/kmemleak.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 452f3714f337b8..b5e1a493f14628 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1518,22 +1518,25 @@ static int scan_should_stop(void)
 
 /*
  * Scan a memory block (exclusive range) for valid pointers and add those
- * found to the gray list.
+ * found to the gray list. Return non-zero if the scan was interrupted.
  */
-static void scan_block(void *_start, void *_end,
-		       struct kmemleak_object *scanned)
+static int scan_block(void *_start, void *_end,
+		      struct kmemleak_object *scanned)
 {
 	unsigned long *ptr;
 	unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
 	unsigned long *end = _end - (BYTES_PER_POINTER - 1);
 	unsigned long flags;
+	int stop = 0;
 
 	raw_spin_lock_irqsave(&kmemleak_lock, flags);
 	for (ptr = start; ptr < end; ptr++) {
 		unsigned long pointer;
 
-		if (scan_should_stop())
+		if (scan_should_stop()) {
+			stop = 1;
 			break;
+		}
 
 		kasan_disable_current();
 		pointer = *(unsigned long *)kasan_reset_tag((void *)ptr);
@@ -1543,6 +1546,8 @@ static void scan_block(void *_start, void *_end,
 		pointer_update_refs(scanned, pointer, OBJECT_PERCPU);
 	}
 	raw_spin_unlock_irqrestore(&kmemleak_lock, flags);
+
+	return stop;
 }
 
 /*
@@ -1698,6 +1703,7 @@ static void kmemleak_scan_task_stacks(void)
 {
 	struct pid *pid;
 	int nr = 1;
+	int stop = 0;
 
 	do {
 		struct task_struct *p = NULL;
@@ -1716,13 +1722,13 @@ static void kmemleak_scan_task_stacks(void)
 			void *stack = try_get_task_stack(p);
 
 			if (stack) {
-				scan_block(stack, stack + THREAD_SIZE, NULL);
+				stop = scan_block(stack, stack + THREAD_SIZE, NULL);
 				put_task_stack(p);
 			}
 			put_task_struct(p);
 		}
 		cond_resched();
-	} while (pid && !scan_should_stop());
+	} while (pid && !stop);
 }
 
 /*

From fa75d22453e523b207b37d1a04aa43309db8c2d8 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
Date: Mon, 20 Jul 2026 06:23:45 -0700
Subject: [PATCH 0557/1982] mm/kmemleak: report RCU-tasks quiescent states
 during the scan

[ Upstream commit 3541a2b06ecd78ba333188df04368dcf97273d6a ]

kmemleak_scan() can run for ages on large debug kernels. It was
causing some soft-lockups which I got fixed with commit
3175fcfec8b16baeb ("mm/kmemleak: avoid soft lockup when scanning task
stacks") with our beloved cond_resched().

I've got the fix above deployed in the Meta fleet, and now I am seeing:

  INFO: rcu_tasks detected stalls on tasks:
    task:kmemleak state:R ... nvcsw: 274/274 holdout: 1 idle_cpu: -1/3
     scan_block
     scan_gray_list
     kmemleak_scan

and, worse, blocks the callers waiting on that grace period.  Here a BPF
struct_ops map free, which waits via synchronize_rcu_mult(call_rcu,
call_rcu_tasks), is stuck long enough to also trip the hung task check:

  INFO: task kworker/...:bpf_map_free_deferred blocked for 122 seconds
     __wait_rcu_gp
     bpf_struct_ops_map_free

Then I've learned that cond_resched() is not an RCU-tasks quiescent
state, so, we need to use stronger primitives.

Use cond_resched_tasks_rcu_qs() at the scan reschedule points so the scan
reports an RCU-tasks quiescent state as it proceeds.

Inspired by commit b96285e10aad ("tracing: Have osnoise_main() add a
quiescent state for task rcu").

Link: https://lore.kernel.org/20260720-kmemleak_rcu_task-v1-1-5b460ade777d@debian.org
Fixes: c4b28963fd79 ("mm/kmemleak: rely on rcu for task stack scanning")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Puranjay Mohan <puranjay@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/kmemleak.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index b5e1a493f14628..52de6314204f06 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1562,7 +1562,7 @@ static void scan_large_block(void *start, void *end)
 		next = min(start + MAX_SCAN_SIZE, end);
 		scan_block(start, next, NULL);
 		start = next;
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 	}
 }
 #endif
@@ -1597,7 +1597,7 @@ static void scan_object(struct kmemleak_object *object)
 			scan_block(start, end, object);
 
 			raw_spin_unlock_irqrestore(&object->lock, flags);
-			cond_resched();
+			cond_resched_tasks_rcu_qs();
 			raw_spin_lock_irqsave(&object->lock, flags);
 			if (!(object->flags & OBJECT_ALLOCATED))
 				break;
@@ -1619,7 +1619,7 @@ static void scan_object(struct kmemleak_object *object)
 				break;
 
 			raw_spin_unlock_irqrestore(&object->lock, flags);
-			cond_resched();
+			cond_resched_tasks_rcu_qs();
 			raw_spin_lock_irqsave(&object->lock, flags);
 		} while (object->flags & OBJECT_ALLOCATED);
 	} else {
@@ -1647,7 +1647,7 @@ static void scan_gray_list(void)
 	 */
 	object = list_entry(gray_list.next, typeof(*object), gray_list);
 	while (&object->gray_list != &gray_list) {
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 
 		/* may add new objects to the list */
 		if (!scan_should_stop())
@@ -1682,7 +1682,7 @@ static void kmemleak_cond_resched(struct kmemleak_object *object)
 	raw_spin_unlock_irq(&kmemleak_lock);
 
 	rcu_read_unlock();
-	cond_resched();
+	cond_resched_tasks_rcu_qs();
 	rcu_read_lock();
 
 	raw_spin_lock_irq(&kmemleak_lock);
@@ -1727,7 +1727,7 @@ static void kmemleak_scan_task_stacks(void)
 			}
 			put_task_struct(p);
 		}
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 	} while (pid && !stop);
 }
 
@@ -1803,7 +1803,7 @@ static void kmemleak_scan(void)
 			struct page *page = pfn_to_online_page(pfn);
 
 			if (!(pfn & 63))
-				cond_resched();
+				cond_resched_tasks_rcu_qs();
 
 			if (!page)
 				continue;

From c9c29481d5d4a985a57ece2090a324ba48e362a7 Mon Sep 17 00:00:00 2001
From: Arvind Yadav <arvind.yadav@intel.com>
Date: Tue, 28 Jul 2026 11:58:32 +0530
Subject: [PATCH 0558/1982] mm/migrate_device: clear stale mapping after
 freeing swapcache

[ Upstream commit 34a00895d032a414830d41106a09329ae6c251b6 ]

__migrate_device_pages() reads the folio mapping before calling
folio_free_swap().  When folio_free_swap() succeeds, the folio is removed
from the swap cache, but the saved mapping still points to swap_space.

Passing the stale mapping to folio_migrate_mapping() makes it use the
mapped-folio path for a folio that is no longer in swapcache.  It can then
operate on swap_space.i_pages with invalid reference accounting,
eventually triggering a folio reference count BUG.

After a successful split, nr still contains the number of pages in the
original large folio, although each resulting page is now a separate
order-0 folio.  Reset nr to 1 so each split folio is processed separately,
including its own swapcache removal and mapping lookup.

Refresh the saved mapping after folio_free_swap() so the current folio
state is used during migration.

Link: https://lore.kernel.org/20260728062832.1107127-1-arvind.yadav@intel.com
Fixes: df263d9a7dff ("mm/migrate_device: try to handle swapcache pages")
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ sashal: Dropped the THP-only nr = 1 reset hunk and kept only the mapping = folio_mapping(folio) refresh after folio_free_swap(), since the split path doesn't exist here. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/migrate_device.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index 4abceeae55ab0f..6ae954ec011085 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -765,6 +765,12 @@ static void __migrate_device_pages(unsigned long *src_pfns,
 					src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
 					continue;
 				}
+
+				/*
+				 * folio_free_swap() removed the folio from the swap
+				 * cache. Refresh the saved mapping before migration.
+				 */
+				mapping = folio_mapping(folio);
 			}
 		} else if (folio_is_zone_device(newfolio)) {
 			/*

From 79345a5d14b851e9ed28d3a9fe53301661dbcf11 Mon Sep 17 00:00:00 2001
From: Yunpeng Tian <shionthanatos@gmail.com>
Date: Sun, 30 Aug 2026 18:46:56 -0700
Subject: [PATCH 0559/1982] smb: client: reject SetEA requests that do not fit
 the request buffer

[ Upstream commit 4aa2c106aef4bf3dfd97c30842db0767b26e8428 ]

CIFSSMBSetEA() copies the caller's extended attribute value into the
SMB request buffer without checking that it fits.  The requirement is
stated in the source but was never implemented:

	/*BB add length check to see if it would fit in
	     negotiated SMB buffer size BB */
	/* if (ea_value_len > buffer_size - 512 (enough for header)) */
	if (ea_value_len)
		memcpy(parm_data->list.name + name_len + 1,
		       ea_value, ea_value_len);

The only bound applied on the way in is in cifs_xattr_set():

	#define MAX_EA_VALUE_SIZE CIFSMaxBufSize
	...
	if (size > MAX_EA_VALUE_SIZE)

CIFSMaxBufSize is the full payload capacity of the buffer, so a value
of exactly that size leaves no room for the SMB header, the TRANS2
parameter block, the fealist header and the EA name that are written
ahead of it in the same object.

SendReceive() already enforces the correct limit on this very length:

	if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)

but it is called after the copy has taken place.  An unprivileged
setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte
value writes 16384 bytes starting 345 bytes into a 16588-byte
cifs_request object, ending 141 bytes past it:

  BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0
  Write of size 16384 at addr ffff888003aa0159 by task init/68
   __asan_memcpy+0x3c/0x60
   CIFSSMBSetEA+0xabc/0xde0
   cifs_xattr_set+0xd3a/0xff0
   __vfs_setxattr+0x13e/0x1a0
  The buggy address is located 345 bytes inside of
   allocated 16588-byte region

Apply SendReceive()'s limit to the assembled request before the copy
rather than after it, and widen the byte counters so the sum cannot
wrap before it is tested.

byte_count is also tested against U16_MAX, because it is stored in the
16-bit pSMB->ByteCount.  That becomes reachable when CIFSMaxBufSize is
raised at module load, where it may be set as high as 1024*127: with a
5-byte EA name and a 65521-byte value, count is exactly U16_MAX while
byte_count is 65556, and cpu_to_le16() would truncate it to 20 and
transmit a frame whose ByteCount does not match its length.  Testing
byte_count covers count as well, since byte_count is the larger of the
two and count's only 16-bit consumer is written after this point.

check_add_overflow() is evaluated first so that total_len is assigned
before it is reported.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yunpeng Tian <shionthanatos@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
[ sashal: Replaced the nonexistent in_len in the check_add_overflow() call with be32_to_cpu(pSMB->hdr.smb_buf_length) + 4, since header_assemble() here returns nothing. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/cifssmb.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 0f293819d5e1f9..88671e0a29295a 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -6245,8 +6245,10 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
 	int name_len;
 	int rc = 0;
 	int bytes_returned = 0;
-	__u16 params, param_offset, byte_count, offset, count;
+	__u16 params, param_offset;
+	unsigned int byte_count, offset, count;
 	int remap = cifs_remap(cifs_sb);
+	unsigned int total_len;
 
 	cifs_dbg(FYI, "In SetEA\n");
 SetEARetry:
@@ -6297,6 +6299,14 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
 	pSMB->Reserved3 = 0;
 	pSMB->SubCommand = cpu_to_le16(TRANS2_SET_PATH_INFORMATION);
 	byte_count = 3 /* pad */  + params + count;
+	if (check_add_overflow(be32_to_cpu(pSMB->hdr.smb_buf_length) + 4,
+			       byte_count, &total_len) ||
+	    byte_count > U16_MAX ||
+	    total_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
+		cifs_dbg(VFS, "EA request too large: %u bytes\n", total_len);
+		cifs_buf_release(pSMB);
+		return -E2BIG;
+	}
 	pSMB->DataCount = cpu_to_le16(count);
 	parm_data->list_len = cpu_to_le32(count);
 	parm_data->list.EA_flags = 0;

From d269ed9fff5215d2726d22aed160d45b9c1e23fb Mon Sep 17 00:00:00 2001
From: Andy Chiu <tchiu@tenstorrent.com>
Date: Mon, 31 Aug 2026 19:11:23 -0600
Subject: [PATCH 0560/1982] riscv: hwprobe: initialize pair->value in
 hwprobe_one_pair()

[ Upstream commit d0fc6fab20460add1f27402cd8b945d094a56b21 ]

The vendor-extension handlers reached from hwprobe_one_pair()
(hwprobe_isa_vendor_ext_thead_0() and friends) only OR the present bits
into pair->value via VENDOR_EXTENSION_SUPPORTED() and clear their own
missing bits; they assume the caller has already zeroed pair->value.

That holds for hwprobe_get_values() (it zeroes each pair) and
hwprobe_get_cpus() (it re-initializes its scratch pair per key), but not
for complete_hwprobe_vdso_data(), which reuses a single pair across all
keys without re-zeroing. A vendor key therefore inherits stale bits from
the previously probed key, and the wrong value is cached in the vDSO
all_cpu_hwprobe_values[] and handed to userspace on the fast patih.

Zero pair->value once at the top of hwprobe_one_pair() so every handler
starts from a clean value regardless of the caller, and drop the now
redundant zeroing in the *_BLOCK_SIZE cases. hwprobe_isa_ext0() keeps its
own zeroing because hwprobe_ext0_has() calls it directly, bypassing
hwprobe_one_pair().

Fixes: a5ea53da65c5 ("riscv: hwprobe: Add thead vendor extension probing")
Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Jesse Taube <jtaubepe@redhat.com>
Link: https://patch.msgid.link/20260725001614.2578617-2-tchiu@tenstorrent.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
[ sashal: Dropped the hunk that removes pair->value = 0; from the ZICBOP_BLOCK_SIZE case, since this tree has no ZICBOP key; the rest applies as upstream. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kernel/sys_hwprobe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kernel/sys_hwprobe.c b/arch/riscv/kernel/sys_hwprobe.c
index 460fb297672e68..9b254f3952811d 100644
--- a/arch/riscv/kernel/sys_hwprobe.c
+++ b/arch/riscv/kernel/sys_hwprobe.c
@@ -263,6 +263,8 @@ static u64 hwprobe_vec_misaligned(const struct cpumask *cpus)
 static void hwprobe_one_pair(struct riscv_hwprobe *pair,
 			     const struct cpumask *cpus)
 {
+	pair->value = 0;
+
 	switch (pair->key) {
 	case RISCV_HWPROBE_KEY_MVENDORID:
 	case RISCV_HWPROBE_KEY_MARCHID:
@@ -293,12 +295,10 @@ static void hwprobe_one_pair(struct riscv_hwprobe *pair,
 		break;
 
 	case RISCV_HWPROBE_KEY_ZICBOZ_BLOCK_SIZE:
-		pair->value = 0;
 		if (hwprobe_ext0_has(cpus, RISCV_HWPROBE_EXT_ZICBOZ))
 			pair->value = riscv_cboz_block_size;
 		break;
 	case RISCV_HWPROBE_KEY_ZICBOM_BLOCK_SIZE:
-		pair->value = 0;
 		if (hwprobe_ext0_has(cpus, RISCV_HWPROBE_EXT_ZICBOM))
 			pair->value = riscv_cbom_block_size;
 		break;

From fc1fc874ceed4db566a5efbff39313d3d91d424a Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Fri, 28 Aug 2026 22:23:43 +0300
Subject: [PATCH 0561/1982] ipv6: udp: Create exceptions before socket matching

[ Upstream commit ac76cab50e899a7346408b8d3c3a4192c2eefb9f ]

Currently, when ICMPv6 Packet Too Big and Redirect Message packets are
locally delivered and quote a UDP packet, an exception is only created
in the IPv6 exception cache if the kernel can match the UDP packet to an
existing socket.

This behavior allows off-path attackers to conduct a side-channel attack
on the exception cache in order to discover the ephemeral port used by a
connected UDP socket.

Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and
commit a00df2caffed ("ipv6: make exception cache less predictible") tried
to mitigate such attacks by making it harder for attackers to discover
hash collisions in the exception cache and by randomizing the number of
exceptions a hash bucket can hold, respectively. Unfortunately, both of
the mitigations can be bypassed.

Instead, mitigate such attacks by always creating an exception, even
before trying to find a matching socket. Do that by calling
ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted
packet did not originate from a socket.

This means that guesses (right or wrong) from an off-path attacker will
always result in an exception being created or updated in the cache that
the attacker can observe.

Pass the ifindex of the ingress device and the default uid, in a similar
fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any
nexthop in ip6_redirect_nh_match() and no exception would be created in
response to a Redirect Message.

Note that this does not allow attackers to create exceptions that they
could not create before, as both helpers can already be reached with
little to no validation. For example, by sending an ICMPv6 error that
quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that
matches a wildcard socket.

Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ip6_sk_update_pmtu() /
ip6_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the exception cache of the nexthop resolved by the no socket helpers
and another in the exception cache of the nexthop used by the socket.

Fixes: 2b760fcf5cfb ("ipv6: hook up exception table to store dst cache")
Cc: stable@vger.kernel.org
Reported-by: Amit Klein <aksecurity@gmail.com>
Reported-by: Noam Caspi <noam.caspi@mail.huji.ac.il>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260828192344.2596928-4-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ sashal: Adapted the change to __udp6_lib_err() with its extra udptable argument, placing the new helper above it and adding its call before the socket lookup, since udpv6_err() is only a wrapper here. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/udp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 7ae825cb5413b7..7468c1f0a4ff62 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -701,6 +701,17 @@ static struct sock *__udp6_lib_err_encap(struct net *net,
 	return sk;
 }
 
+static void udpv6_err_update_exception(struct net *net, struct sk_buff *skb,
+				       u8 type, __be32 info)
+{
+	if (type == ICMPV6_PKT_TOOBIG)
+		ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0,
+				sock_net_uid(net, NULL));
+	else if (type == NDISC_REDIRECT)
+		ip6_redirect(skb, net, skb->dev->ifindex, 0,
+			     sock_net_uid(net, NULL));
+}
+
 int __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		   u8 type, u8 code, int offset, __be32 info,
 		   struct udp_table *udptable)
@@ -716,6 +727,8 @@ int __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	int err;
 	struct net *net = dev_net(skb->dev);
 
+	udpv6_err_update_exception(net, skb, type, info);
+
 	sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source,
 			       inet6_iif(skb), inet6_sdif(skb), udptable, NULL);
 

From 39a2c4e5e606cf49b83595971b449b3fb80743c6 Mon Sep 17 00:00:00 2001
From: Sven Peter <sven@kernel.org>
Date: Sat, 29 Aug 2026 10:08:34 +0200
Subject: [PATCH 0562/1982] thunderbolt: Make the DP tunnel activation callback
 mandatory

[ Upstream commit 12f5d8b85a66a0ac08d082517d92ce136f8c0d42 ]

tb_tunnel_alloc_dp() takes an optional callback which is run from
dprx_work once the DPRX capabilities read has completed. Without that
callback tb_dp_dprx_start() reads the capabilities synchronously and
never queues the work. It however always takes a tunnel reference which
is only dropped by dprx_work itself or by tb_dp_dprx_stop() when
cancel_delayed_work() actually canceled that work. That reference is
thus leaked for every tunnel without a callback.

The only tunnels without one are those from tb_tunnel_discover_dp(),
which are activated again when restoring from hibernation.
Pass the callback to tb_tunnel_discover_dp() as well and drop the
synchronous path such that the DPRX capabilities are always read from
dprx_work. Hibernation restore then also no longer blocks for up to 12
seconds while waiting for that read to complete.

Also fix up the KUnit tests.

Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously")
Cc: stable@vger.kernel.org
Signed-off-by: Sven Peter <sven@kernel.org>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
[ sashal: Kept the existing dprx_canceled assignment in tb_dp_dprx_start() and added the new timeout and queue lines after it, and omitted the @paths kerneldoc line this tree lacks. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thunderbolt/tb.c     |  4 ++-
 drivers/thunderbolt/test.c   | 37 +++++++++++++++++++---------
 drivers/thunderbolt/tunnel.c | 47 ++++++++++++++++++++----------------
 drivers/thunderbolt/tunnel.h |  8 +++---
 4 files changed, 60 insertions(+), 36 deletions(-)

diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 51b56a304ae8ec..be29c56c587a6b 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -89,6 +89,7 @@ static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port,
 				       const char *reason);
 static void tb_queue_dp_bandwidth_request(struct tb *tb, u64 route, u8 port,
 					  int retry, unsigned long delay);
+static void tb_dp_tunnel_active(struct tb_tunnel *tunnel, void *data);
 
 static void tb_queue_hotplug(struct tb *tb, u64 route, u8 port, bool unplug)
 {
@@ -385,7 +386,8 @@ static void tb_switch_discover_tunnels(struct tb_switch *sw,
 
 		switch (port->config.type) {
 		case TB_TYPE_DP_HDMI_IN:
-			tunnel = tb_tunnel_discover_dp(tb, port, alloc_hopids);
+			tunnel = tb_tunnel_discover_dp(tb, port, alloc_hopids,
+						       tb_dp_tunnel_active, tb);
 			tb_increase_tmu_accuracy(tunnel);
 			break;
 
diff --git a/drivers/thunderbolt/test.c b/drivers/thunderbolt/test.c
index fb769005f7cd96..082dd33d61cb4e 100644
--- a/drivers/thunderbolt/test.c
+++ b/drivers/thunderbolt/test.c
@@ -1407,6 +1407,10 @@ static void tb_test_tunnel_pcie(struct kunit *test)
 	tb_tunnel_put(tunnel1);
 }
 
+static void tb_test_dp_tunnel_active(struct tb_tunnel *tunnel, void *data)
+{
+}
+
 static void tb_test_tunnel_dp(struct kunit *test)
 {
 	struct tb_switch *host, *dev;
@@ -1427,7 +1431,8 @@ static void tb_test_tunnel_dp(struct kunit *test)
 	in = &host->ports[5];
 	out = &dev->ports[13];
 
-	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				    tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, tunnel);
 	KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
@@ -1473,7 +1478,8 @@ static void tb_test_tunnel_dp_chain(struct kunit *test)
 	in = &host->ports[5];
 	out = &dev4->ports[14];
 
-	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				    tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, tunnel);
 	KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
@@ -1523,7 +1529,8 @@ static void tb_test_tunnel_dp_tree(struct kunit *test)
 	in = &dev2->ports[13];
 	out = &dev5->ports[13];
 
-	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				    tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, tunnel);
 	KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
@@ -1588,7 +1595,8 @@ static void tb_test_tunnel_dp_max_length(struct kunit *test)
 	in = &dev6->ports[13];
 	out = &dev12->ports[13];
 
-	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				    tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, tunnel);
 	KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
@@ -1658,7 +1666,8 @@ static void tb_test_tunnel_3dp(struct kunit *test)
 	out2 = &dev5->ports[13];
 	out3 = &dev4->ports[14];
 
-	tunnel1 = tb_tunnel_alloc_dp(NULL, in1, out1, 1, 0, 0, NULL, NULL);
+	tunnel1 = tb_tunnel_alloc_dp(NULL, in1, out1, 1, 0, 0,
+				     tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_TRUE(test, tunnel1 != NULL);
 	KUNIT_EXPECT_EQ(test, tunnel1->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel1->src_port, in1);
@@ -1666,7 +1675,8 @@ static void tb_test_tunnel_3dp(struct kunit *test)
 	KUNIT_ASSERT_EQ(test, tunnel1->npaths, 3);
 	KUNIT_ASSERT_EQ(test, tunnel1->paths[0]->path_length, 3);
 
-	tunnel2 = tb_tunnel_alloc_dp(NULL, in2, out2, 1, 0, 0, NULL, NULL);
+	tunnel2 = tb_tunnel_alloc_dp(NULL, in2, out2, 1, 0, 0,
+				     tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_TRUE(test, tunnel2 != NULL);
 	KUNIT_EXPECT_EQ(test, tunnel2->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel2->src_port, in2);
@@ -1674,7 +1684,8 @@ static void tb_test_tunnel_3dp(struct kunit *test)
 	KUNIT_ASSERT_EQ(test, tunnel2->npaths, 3);
 	KUNIT_ASSERT_EQ(test, tunnel2->paths[0]->path_length, 4);
 
-	tunnel3 = tb_tunnel_alloc_dp(NULL, in3, out3, 1, 0, 0, NULL, NULL);
+	tunnel3 = tb_tunnel_alloc_dp(NULL, in3, out3, 1, 0, 0,
+				     tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_TRUE(test, tunnel3 != NULL);
 	KUNIT_EXPECT_EQ(test, tunnel3->type, TB_TUNNEL_DP);
 	KUNIT_EXPECT_PTR_EQ(test, tunnel3->src_port, in3);
@@ -1771,7 +1782,8 @@ static void tb_test_tunnel_port_on_path(struct kunit *test)
 	in = &dev2->ports[13];
 	out = &dev5->ports[13];
 
-	dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				       tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, dp_tunnel);
 
 	KUNIT_EXPECT_TRUE(test, tb_tunnel_port_on_path(dp_tunnel, in));
@@ -2203,7 +2215,8 @@ static void tb_test_credit_alloc_dp(struct kunit *test)
 	in = &host->ports[5];
 	out = &dev->ports[14];
 
-	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+				    tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, tunnel);
 	KUNIT_ASSERT_EQ(test, tunnel->npaths, (size_t)3);
 
@@ -2439,7 +2452,8 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL1(struct kunit *test,
 
 	in = &host->ports[5];
 	out = &dev->ports[13];
-	dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+					tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, dp_tunnel1);
 	KUNIT_ASSERT_EQ(test, dp_tunnel1->npaths, (size_t)3);
 
@@ -2476,7 +2490,8 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL2(struct kunit *test,
 
 	in = &host->ports[6];
 	out = &dev->ports[14];
-	dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0, NULL, NULL);
+	dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0,
+					tb_test_dp_tunnel_active, NULL);
 	KUNIT_ASSERT_NOT_NULL(test, dp_tunnel2);
 	KUNIT_ASSERT_EQ(test, dp_tunnel2->npaths, (size_t)3);
 
diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
index 466e9da0293563..84e5cb7e92db55 100644
--- a/drivers/thunderbolt/tunnel.c
+++ b/drivers/thunderbolt/tunnel.c
@@ -1119,8 +1119,7 @@ static void tb_dp_dprx_work(struct work_struct *work)
 	}
 	mutex_unlock(&tb->lock);
 
-	if (tunnel->callback)
-		tunnel->callback(tunnel, tunnel->callback_data);
+	tunnel->callback(tunnel, tunnel->callback_data);
 	tb_tunnel_put(tunnel);
 	tb_domain_put(tb);
 }
@@ -1136,15 +1135,10 @@ static int tb_dp_dprx_start(struct tb_tunnel *tunnel)
 
 	tunnel->dprx_started = true;
 	tunnel->dprx_canceled = false;
+	tunnel->dprx_timeout = dprx_timeout_to_ktime(dprx_timeout);
+	queue_delayed_work(tunnel->tb->wq, &tunnel->dprx_work, 0);
 
-	if (tunnel->callback) {
-		tunnel->dprx_timeout = dprx_timeout_to_ktime(dprx_timeout);
-		queue_delayed_work(tunnel->tb->wq, &tunnel->dprx_work, 0);
-		return -EINPROGRESS;
-	}
-
-	return tb_dp_is_usb4(tunnel->src_port->sw) ?
-		tb_dp_wait_dprx(tunnel, dprx_timeout) : 0;
+	return -EINPROGRESS;
 }
 
 static void tb_dp_dprx_stop(struct tb_tunnel *tunnel)
@@ -1599,20 +1593,28 @@ static void tb_dp_dump(struct tb_tunnel *tunnel)
  * @tb: Pointer to the domain structure
  * @in: DP in adapter
  * @alloc_hopid: Allocate HopIDs from visited ports
+ * @callback: Callback that is called when the DP tunnel is fully
+ *	      activated (or there is an error)
+ * @callback_data: Data for @callback
  *
  * If @in adapter is active, follows the tunnel to the DP out adapter
  * and back. Returns the discovered tunnel or %NULL if there was no
- * tunnel.
+ * tunnel. See tb_tunnel_alloc_dp() for @callback.
  *
  * Return: Pointer to &struct tb_tunnel or %NULL if no tunnel found.
  */
 struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
-					bool alloc_hopid)
+					bool alloc_hopid,
+					void (*callback)(struct tb_tunnel *, void *),
+					void *callback_data)
 {
 	struct tb_tunnel *tunnel;
 	struct tb_port *port;
 	struct tb_path *path;
 
+	if (WARN_ON(!callback))
+		return NULL;
+
 	if (!tb_dp_port_is_enabled(in))
 		return NULL;
 
@@ -1628,6 +1630,9 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
 	tunnel->alloc_bandwidth = tb_dp_alloc_bandwidth;
 	tunnel->consumed_bandwidth = tb_dp_consumed_bandwidth;
 	tunnel->src_port = in;
+	tunnel->callback = callback;
+	tunnel->callback_data = callback_data;
+	INIT_DELAYED_WORK(&tunnel->dprx_work, tb_dp_dprx_work);
 
 	path = tb_path_discover(in, TB_DP_VIDEO_HOPID, NULL, -1,
 				&tunnel->dst_port, "Video", alloc_hopid);
@@ -1695,16 +1700,16 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
  *	    %0 if no available bandwidth.
  * @max_down: Maximum available downstream bandwidth for the DP tunnel.
  *	      %0 if no available bandwidth.
- * @callback: Optional callback that is called when the DP tunnel is
- *	      fully activated (or there is an error)
- * @callback_data: Optional data for @callback
+ * @callback: Callback that is called when the DP tunnel is fully
+ *	      activated (or there is an error)
+ * @callback_data: Data for @callback
  *
  * Allocates a tunnel between @in and @out that is capable of tunneling
- * Display Port traffic. If @callback is not %NULL it will be called
- * after tb_tunnel_activate() once the tunnel has been fully activated.
- * It can call tb_tunnel_is_active() to check if activation was
- * successful (or if it returns %false there was some sort of issue).
- * The @callback is called without @tb->lock held.
+ * Display Port traffic. The @callback is called after tb_tunnel_activate()
+ * once the tunnel has been fully activated. It can call
+ * tb_tunnel_is_active() to check if activation was successful (or if it
+ * returns %false there was some sort of issue). The @callback is called
+ * without @tb->lock held.
  *
  * Return: Pointer to @struct tb_tunnel or %NULL in case of failure.
  */
@@ -1719,7 +1724,7 @@ struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
 	struct tb_path *path;
 	bool pm_support;
 
-	if (WARN_ON(!in->cap_adap || !out->cap_adap))
+	if (WARN_ON(!in->cap_adap || !out->cap_adap || !callback))
 		return NULL;
 
 	tunnel = tb_tunnel_alloc(tb, 3, TB_TUNNEL_DP);
diff --git a/drivers/thunderbolt/tunnel.h b/drivers/thunderbolt/tunnel.h
index 2c44fc8a10bc45..84281aaf28ca72 100644
--- a/drivers/thunderbolt/tunnel.h
+++ b/drivers/thunderbolt/tunnel.h
@@ -67,8 +67,8 @@ enum tb_tunnel_state {
  * @dprx_canceled: Was DPRX capabilities read poll canceled
  * @dprx_timeout: If set DPRX capabilities read poll work will timeout after this passes
  * @dprx_work: Worker that is scheduled to poll completion of DPRX capabilities read
- * @callback: Optional callback called when DP tunnel is fully activated
- * @callback_data: Optional data for @callback
+ * @callback: Callback called when DP tunnel is fully activated
+ * @callback_data: Data for @callback
  */
 struct tb_tunnel {
 	struct kref kref;
@@ -116,7 +116,9 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
 bool tb_tunnel_reserved_pci(struct tb_port *port, int *reserved_up,
 			    int *reserved_down);
 struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
-					bool alloc_hopid);
+					bool alloc_hopid,
+					void (*callback)(struct tb_tunnel *, void *),
+					void *callback_data);
 struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
 				     struct tb_port *out, int link_nr,
 				     int max_up, int max_down,

From dab4a7fc7be2d5c8e6f7350203a5ee1bcd90a407 Mon Sep 17 00:00:00 2001
From: Austin Zheng <Austin.Zheng@amd.com>
Date: Thu, 11 Sep 2025 15:37:32 -0400
Subject: [PATCH 0563/1982] drm/amd/display: DML2.1 Reintegration

[ Upstream commit 0975c4deb6c2a5abc1865f0ba5502b10c87b7d27 ]

[Summary of changes]
- Updated structs
- Renaming of variables for clarity

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Austin Zheng <Austin.Zheng@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 93a77d353cb2 ("drm/amd/display: Remove const Qualifier From Non-Pointer Fields")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../dml21/inc/dml_top_display_cfg_types.h     |  11 +
 .../dml21/inc/dml_top_soc_parameter_types.h   |   7 +-
 .../display/dc/dml2/dml21/inc/dml_top_types.h |  13 +
 .../src/dml2_core/dml2_core_dcn4_calcs.c      |  55 ++-
 .../dml21/src/dml2_core/dml2_core_factory.c   |   2 +
 .../src/dml2_core/dml2_core_shared_types.h    |  10 +-
 .../dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c  | 459 +++++++++---------
 .../src/inc/dml2_internal_shared_types.h      |  36 +-
 8 files changed, 336 insertions(+), 257 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_display_cfg_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_display_cfg_types.h
index e8dc6471c0becb..13749c9fcf18b6 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_display_cfg_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_display_cfg_types.h
@@ -49,6 +49,11 @@ enum dml2_source_format_class {
 	dml2_422_packed_12 = 18
 };
 
+enum dml2_sample_positioning {
+	dml2_interstitial = 0,
+	dml2_cosited = 1
+};
+
 enum dml2_rotation_angle {
 	dml2_rotation_0 = 0,
 	dml2_rotation_90 = 1,
@@ -222,7 +227,11 @@ struct dml2_composition_cfg {
 
 	struct {
 		bool enabled;
+		bool easf_enabled;
+		bool isharp_enabled;
 		bool upsp_enabled;
+		enum dml2_sample_positioning upsp_sample_positioning;
+		unsigned int upsp_vtaps;
 		struct {
 			double h_ratio;
 			double v_ratio;
@@ -385,6 +394,7 @@ struct dml2_plane_parameters {
 		// The actual reserved vblank time used for the corresponding stream in mode_programming would be at least as much as this per-plane override.
 		long reserved_vblank_time_ns;
 		unsigned int max_vactive_det_fill_delay_us; // 0 = no reserved time, +ve = explicit max delay
+		unsigned int vactive_latency_to_hide_for_pstate_admissibility_us;
 		unsigned int gpuvm_min_page_size_kbytes;
 		unsigned int hostvm_min_page_size_kbytes;
 
@@ -456,6 +466,7 @@ struct dml2_display_cfg {
 				bool enable;
 				bool value;
 			} force_nom_det_size_kbytes;
+
 			bool mode_support_check_disable;
 			bool mcache_admissibility_check_disable;
 			bool surface_viewport_size_check_disable;
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_soc_parameter_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_soc_parameter_types.h
index 176f559476644e..4a9a0d5a09b767 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_soc_parameter_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_soc_parameter_types.h
@@ -145,6 +145,8 @@ struct dml2_soc_bb {
 	struct dml2_soc_vmin_clock_limits vmin_limit;
 
 	double lower_bound_bandwidth_dchub;
+	double fraction_of_urgent_bandwidth_nominal_target;
+	double fraction_of_urgent_bandwidth_flip_target;
 	unsigned int dprefclk_mhz;
 	unsigned int xtalclk_mhz;
 	unsigned int pcie_refclk_mhz;
@@ -170,6 +172,7 @@ struct dml2_soc_bb {
 struct dml2_ip_capabilities {
 	unsigned int pipe_count;
 	unsigned int otg_count;
+	unsigned int TDLUT_33cube_count;
 	unsigned int num_dsc;
 	unsigned int max_num_dp2p0_streams;
 	unsigned int max_num_hdmi_frl_outputs;
@@ -188,7 +191,9 @@ struct dml2_ip_capabilities {
 	unsigned int subvp_prefetch_end_to_mall_start_us;
 	unsigned int subvp_fw_processing_delay;
 	unsigned int max_vactive_det_fill_delay_us;
-
+	unsigned int ppt_max_allow_delay_ns;
+	unsigned int temp_read_max_allow_delay_us;
+	unsigned int dummy_pstate_max_allow_delay_us;
 	/* FAMS2 delays */
 	struct {
 		unsigned int max_allow_delay_us;
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_types.h
index 41adb1104d0fd4..8646ce5f1c01f6 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/inc/dml_top_types.h
@@ -70,6 +70,8 @@ struct dml2_pmo_options {
 	bool disable_dyn_odm;
 	bool disable_dyn_odm_for_multi_stream;
 	bool disable_dyn_odm_for_stream_with_svp;
+	struct dml2_pmo_pstate_strategy *override_strategy_lists[DML2_MAX_PLANES];
+	unsigned int num_override_strategies_per_list[DML2_MAX_PLANES];
 };
 
 struct dml2_options {
@@ -193,6 +195,14 @@ struct dml2_mcache_surface_allocation {
 	} informative;
 };
 
+enum dml2_pstate_type {
+	dml2_pstate_type_uclk,
+	dml2_pstate_type_ppt,
+	dml2_pstate_type_temp_read,
+	dml2_pstate_type_dummy_pstate,
+	dml2_pstate_type_count
+};
+
 enum dml2_pstate_method {
 	dml2_pstate_method_na = 0,
 	/* hw exclusive modes */
@@ -310,6 +320,7 @@ struct dml2_mode_support_info {
 	bool NumberOfOTGSupport;
 	bool NumberOfHDMIFRLSupport;
 	bool NumberOfDP2p0Support;
+	bool NumberOfTDLUT33cubeSupport;
 	bool WritebackScaleRatioAndTapsSupport;
 	bool CursorSupport;
 	bool PitchSupport;
@@ -357,6 +368,8 @@ struct dml2_mode_support_info {
 	unsigned int AlignedCPitch[DML2_MAX_PLANES];
 	bool g6_temp_read_support;
 	bool temp_read_or_ppt_support;
+	bool qos_bandwidth_support;
+	bool dcfclk_support;
 }; // dml2_mode_support_info
 
 struct dml2_display_cfg_programming {
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
index c32b704627085d..7ff30870aa601c 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
@@ -12778,7 +12778,7 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 {
 	const struct dml2_plane_parameters *plane_descriptor = &display_cfg->display_config.plane_descriptors[plane_index];
 	const struct dml2_stream_parameters *stream_descriptor = &display_cfg->display_config.stream_descriptors[plane_descriptor->stream_index];
-	const struct dml2_fams2_meta *stream_fams2_meta = &display_cfg->stage3.stream_fams2_meta[plane_descriptor->stream_index];
+	const struct dml2_pstate_meta *stream_pstate_meta = &display_cfg->stage3.stream_pstate_meta[plane_descriptor->stream_index];
 
 	struct dmub_fams2_cmd_stream_static_base_state *base_programming = &fams2_base_programming->stream_v1.base;
 	union dmub_fams2_cmd_stream_static_sub_state *sub_programming = &fams2_sub_programming->stream_v1.sub_state;
@@ -12793,24 +12793,24 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 	/* from display configuration */
 	base_programming->htotal = (uint16_t)stream_descriptor->timing.h_total;
 	base_programming->vtotal = (uint16_t)stream_descriptor->timing.v_total;
-	base_programming->vblank_start = (uint16_t)(stream_fams2_meta->nom_vtotal -
+	base_programming->vblank_start = (uint16_t)(stream_pstate_meta->nom_vtotal -
 		stream_descriptor->timing.v_front_porch);
-	base_programming->vblank_end = (uint16_t)(stream_fams2_meta->nom_vtotal -
+	base_programming->vblank_end = (uint16_t)(stream_pstate_meta->nom_vtotal -
 		stream_descriptor->timing.v_front_porch -
 		stream_descriptor->timing.v_active);
 	base_programming->config.bits.is_drr = stream_descriptor->timing.drr_config.enabled;
 
 	/* from meta */
 	base_programming->otg_vline_time_ns =
-		(unsigned int)(stream_fams2_meta->otg_vline_time_us * 1000.0);
-	base_programming->scheduling_delay_otg_vlines = (uint8_t)stream_fams2_meta->scheduling_delay_otg_vlines;
-	base_programming->contention_delay_otg_vlines = (uint8_t)stream_fams2_meta->contention_delay_otg_vlines;
-	base_programming->vline_int_ack_delay_otg_vlines = (uint8_t)stream_fams2_meta->vertical_interrupt_ack_delay_otg_vlines;
-	base_programming->drr_keepout_otg_vline = (uint16_t)(stream_fams2_meta->nom_vtotal -
+		(unsigned int)(stream_pstate_meta->otg_vline_time_us * 1000.0);
+	base_programming->scheduling_delay_otg_vlines = (uint8_t)stream_pstate_meta->scheduling_delay_otg_vlines;
+	base_programming->contention_delay_otg_vlines = (uint8_t)stream_pstate_meta->contention_delay_otg_vlines;
+	base_programming->vline_int_ack_delay_otg_vlines = (uint8_t)stream_pstate_meta->vertical_interrupt_ack_delay_otg_vlines;
+	base_programming->drr_keepout_otg_vline = (uint16_t)(stream_pstate_meta->nom_vtotal -
 		stream_descriptor->timing.v_front_porch -
-		stream_fams2_meta->method_drr.programming_delay_otg_vlines);
-	base_programming->allow_to_target_delay_otg_vlines = (uint8_t)stream_fams2_meta->allow_to_target_delay_otg_vlines;
-	base_programming->max_vtotal = (uint16_t)stream_fams2_meta->max_vtotal;
+		stream_pstate_meta->method_drr.programming_delay_otg_vlines);
+	base_programming->allow_to_target_delay_otg_vlines = (uint8_t)stream_pstate_meta->allow_to_target_delay_otg_vlines;
+	base_programming->max_vtotal = (uint16_t)stream_pstate_meta->max_vtotal;
 
 	/* from core */
 	base_programming->config.bits.min_ttu_vblank_usable = true;
@@ -12829,11 +12829,11 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 		/* legacy vactive */
 		base_programming->type = FAMS2_STREAM_TYPE_VACTIVE;
 		sub_programming->legacy.vactive_det_fill_delay_otg_vlines =
-			(uint8_t)stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines;
+			(uint8_t)stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines;
 		base_programming->allow_start_otg_vline =
-			(uint16_t)stream_fams2_meta->method_vactive.common.allow_start_otg_vline;
+			(uint16_t)stream_pstate_meta->method_vactive.common.allow_start_otg_vline;
 		base_programming->allow_end_otg_vline =
-			(uint16_t)stream_fams2_meta->method_vactive.common.allow_end_otg_vline;
+			(uint16_t)stream_pstate_meta->method_vactive.common.allow_end_otg_vline;
 		base_programming->config.bits.clamp_vtotal_min = true;
 		break;
 	case dml2_pstate_method_vblank:
@@ -12841,22 +12841,22 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 		/* legacy vblank */
 		base_programming->type = FAMS2_STREAM_TYPE_VBLANK;
 		base_programming->allow_start_otg_vline =
-			(uint16_t)stream_fams2_meta->method_vblank.common.allow_start_otg_vline;
+			(uint16_t)stream_pstate_meta->method_vblank.common.allow_start_otg_vline;
 		base_programming->allow_end_otg_vline =
-			(uint16_t)stream_fams2_meta->method_vblank.common.allow_end_otg_vline;
+			(uint16_t)stream_pstate_meta->method_vblank.common.allow_end_otg_vline;
 		base_programming->config.bits.clamp_vtotal_min = true;
 		break;
 	case dml2_pstate_method_fw_drr:
 		/* drr */
 		base_programming->type = FAMS2_STREAM_TYPE_DRR;
 		sub_programming->drr.programming_delay_otg_vlines =
-			(uint8_t)stream_fams2_meta->method_drr.programming_delay_otg_vlines;
+			(uint8_t)stream_pstate_meta->method_drr.programming_delay_otg_vlines;
 		sub_programming->drr.nom_stretched_vtotal =
-			(uint16_t)stream_fams2_meta->method_drr.stretched_vtotal;
+			(uint16_t)stream_pstate_meta->method_drr.stretched_vtotal;
 		base_programming->allow_start_otg_vline =
-			(uint16_t)stream_fams2_meta->method_drr.common.allow_start_otg_vline;
+			(uint16_t)stream_pstate_meta->method_drr.common.allow_start_otg_vline;
 		base_programming->allow_end_otg_vline =
-			(uint16_t)stream_fams2_meta->method_drr.common.allow_end_otg_vline;
+			(uint16_t)stream_pstate_meta->method_drr.common.allow_end_otg_vline;
 		/* drr only clamps to vtotal min for single display */
 		base_programming->config.bits.clamp_vtotal_min = display_cfg->display_config.num_streams == 1;
 		sub_programming->drr.only_stretch_if_required = true;
@@ -12869,13 +12869,13 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 			(uint16_t)(plane_descriptor->composition.scaler_info.plane0.v_ratio * 1000.0);
 		sub_programming->subvp.vratio_denominator = 1000;
 		sub_programming->subvp.programming_delay_otg_vlines =
-			(uint8_t)stream_fams2_meta->method_subvp.programming_delay_otg_vlines;
+			(uint8_t)stream_pstate_meta->method_subvp.programming_delay_otg_vlines;
 		sub_programming->subvp.prefetch_to_mall_otg_vlines =
-			(uint8_t)stream_fams2_meta->method_subvp.prefetch_to_mall_delay_otg_vlines;
+			(uint8_t)stream_pstate_meta->method_subvp.prefetch_to_mall_delay_otg_vlines;
 		sub_programming->subvp.phantom_vtotal =
-			(uint16_t)stream_fams2_meta->method_subvp.phantom_vtotal;
+			(uint16_t)stream_pstate_meta->method_subvp.phantom_vtotal;
 		sub_programming->subvp.phantom_vactive =
-			(uint16_t)stream_fams2_meta->method_subvp.phantom_vactive;
+			(uint16_t)stream_pstate_meta->method_subvp.phantom_vactive;
 		sub_programming->subvp.config.bits.is_multi_planar =
 			plane_descriptor->surface.plane1.height > 0;
 		sub_programming->subvp.config.bits.is_yuv420 =
@@ -12884,9 +12884,9 @@ void dml2_core_calcs_get_stream_fams2_programming(const struct dml2_core_interna
 			plane_descriptor->pixel_format == dml2_420_12;
 
 		base_programming->allow_start_otg_vline =
-			(uint16_t)stream_fams2_meta->method_subvp.common.allow_start_otg_vline;
+			(uint16_t)stream_pstate_meta->method_subvp.common.allow_start_otg_vline;
 		base_programming->allow_end_otg_vline =
-			(uint16_t)stream_fams2_meta->method_subvp.common.allow_end_otg_vline;
+			(uint16_t)stream_pstate_meta->method_subvp.common.allow_end_otg_vline;
 		base_programming->config.bits.clamp_vtotal_min = true;
 		break;
 	case dml2_pstate_method_reserved_hw:
@@ -13049,7 +13049,10 @@ void dml2_core_calcs_get_informative(const struct dml2_core_internal_display_mod
 	out->informative.mode_support_info.VRatioInPrefetchSupported = mode_lib->ms.support.VRatioInPrefetchSupported;
 	out->informative.mode_support_info.DISPCLK_DPPCLK_Support = mode_lib->ms.support.DISPCLK_DPPCLK_Support;
 	out->informative.mode_support_info.TotalAvailablePipesSupport = mode_lib->ms.support.TotalAvailablePipesSupport;
+	out->informative.mode_support_info.NumberOfTDLUT33cubeSupport = mode_lib->ms.support.NumberOfTDLUT33cubeSupport;
 	out->informative.mode_support_info.ViewportSizeSupport = mode_lib->ms.support.ViewportSizeSupport;
+	out->informative.mode_support_info.qos_bandwidth_support = mode_lib->ms.support.qos_bandwidth_support;
+	out->informative.mode_support_info.dcfclk_support = mode_lib->ms.support.dcfclk_support;
 
 	for (k = 0; k < out->display_config.num_planes; k++) {
 
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_factory.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_factory.c
index 640087e862f848..cc4f0663c6d671 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_factory.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_factory.c
@@ -15,6 +15,8 @@ bool dml2_core_create(enum dml2_project_id project_id, struct dml2_core_instance
 
 	memset(out, 0, sizeof(struct dml2_core_instance));
 
+	out->project_id = project_id;
+
 	switch (project_id) {
 	case dml2_project_dcn4x_stage1:
 		result = false;
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
index ffb8c09f37a5ce..ff1c47347610a9 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
@@ -37,6 +37,7 @@ struct dml2_core_ip_params {
 	unsigned int writeback_interface_buffer_size_kbytes;
 	unsigned int max_num_dpp;
 	unsigned int max_num_otg;
+	unsigned int TDLUT_33cube_count;
 	unsigned int max_num_wb;
 	unsigned int max_dchub_pscl_bw_pix_per_clk;
 	unsigned int max_pscl_lb_bw_pix_per_clk;
@@ -46,6 +47,7 @@ struct dml2_core_ip_params {
 	double max_vscl_ratio;
 	unsigned int max_hscl_taps;
 	unsigned int max_vscl_taps;
+	unsigned int odm_combine_support_mask;
 	unsigned int num_dsc;
 	unsigned int maximum_dsc_bits_per_component;
 	unsigned int maximum_pixels_per_line_per_dsc_unit;
@@ -82,7 +84,6 @@ struct dml2_core_ip_params {
 	unsigned int subvp_swath_height_margin_lines;
 	unsigned int subvp_fw_processing_delay_us;
 	unsigned int subvp_pstate_allow_width_us;
-
 	// MRQ
 	bool dcn_mrq_present;
 	unsigned int zero_size_buffer_entries;
@@ -103,6 +104,8 @@ struct dml2_core_internal_DmlPipe {
 	unsigned int DPPPerSurface;
 	bool ScalerEnabled;
 	bool UPSPEnabled;
+	unsigned int UPSPVTaps;
+	enum dml2_sample_positioning UPSPSamplePositioning;
 	enum dml2_rotation_angle RotationAngle;
 	bool mirrored;
 	unsigned int ViewportHeight;
@@ -230,6 +233,7 @@ struct dml2_core_internal_mode_support_info {
 	bool MSOOrODMSplitWithNonDPLink;
 	bool NotEnoughLanesForMSO;
 	bool NumberOfOTGSupport;
+	bool NumberOfTDLUT33cubeSupport;
 	bool NumberOfHDMIFRLSupport;
 	bool NumberOfDP2p0Support;
 	bool WritebackScaleRatioAndTapsSupport;
@@ -1306,7 +1310,7 @@ struct dml2_core_calcs_CalculateVMRowAndSwath_params {
 	unsigned int HostVMMinPageSize;
 	unsigned int DCCMetaBufferSizeBytes;
 	bool mrq_present;
-	enum dml2_pstate_method pstate_switch_modes[DML2_MAX_PLANES];
+	enum dml2_pstate_method *pstate_switch_modes;
 
 	// Output
 	bool *PTEBufferSizeNotExceeded;
@@ -2308,6 +2312,7 @@ struct dml2_core_calcs_mode_support_ex {
 	const struct dml2_display_cfg *in_display_cfg;
 	const struct dml2_mcg_min_clock_table *min_clk_table;
 	int min_clk_index;
+	enum dml2_project_id project_id;
 	//unsigned int in_state_index;
 	struct dml2_core_internal_mode_support_info *out_evaluation_info;
 };
@@ -2320,6 +2325,7 @@ struct dml2_core_calcs_mode_programming_ex {
 	const struct dml2_mcg_min_clock_table *min_clk_table;
 	const struct core_display_cfg_support_info *cfg_support_info;
 	int min_clk_index;
+	enum dml2_project_id project_id;
 	struct dml2_display_cfg_programming *programming;
 };
 
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c
index d88b3e0082dd47..5769c2638f9adf 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c
@@ -642,6 +642,11 @@ bool pmo_dcn4_fams2_initialize(struct dml2_pmo_initialize_in_out *in_out)
 	int i = 0;
 	struct dml2_pmo_instance *pmo = in_out->instance;
 
+	unsigned int base_list_size = 0;
+	const struct dml2_pmo_pstate_strategy *base_list = NULL;
+	unsigned int *expanded_list_size = NULL;
+	struct dml2_pmo_pstate_strategy *expanded_list = NULL;
+
 	pmo->soc_bb = in_out->soc_bb;
 	pmo->ip_caps = in_out->ip_caps;
 	pmo->mpc_combine_limit = 2;
@@ -656,53 +661,71 @@ bool pmo_dcn4_fams2_initialize(struct dml2_pmo_initialize_in_out *in_out)
 	pmo->options = in_out->options;
 
 	/* generate permutations of p-state configs from base strategy list */
-	for (i = 1; i <= PMO_DCN4_MAX_DISPLAYS; i++) {
-		switch (i) {
+	for (i = 0; i < PMO_DCN4_MAX_DISPLAYS; i++) {
+		switch (i+1) {
 		case 1:
-			DML_ASSERT(base_strategy_list_1_display_size <= PMO_DCN4_MAX_BASE_STRATEGIES);
-
-			/* populate list */
-			pmo_dcn4_fams2_expand_base_pstate_strategies(
-					base_strategy_list_1_display,
-					base_strategy_list_1_display_size,
-					i,
-					pmo->init_data.pmo_dcn4.expanded_strategy_list_1_display,
-					&pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i - 1]);
+			if (pmo->options->override_strategy_lists[i] && pmo->options->num_override_strategies_per_list[i]) {
+				base_list = pmo->options->override_strategy_lists[i];
+				base_list_size = pmo->options->num_override_strategies_per_list[i];
+			} else {
+				base_list = base_strategy_list_1_display;
+				base_list_size = base_strategy_list_1_display_size;
+			}
+
+			expanded_list_size = &pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i];
+			expanded_list = pmo->init_data.pmo_dcn4.expanded_strategy_list_1_display;
+
 			break;
 		case 2:
-			DML_ASSERT(base_strategy_list_2_display_size <= PMO_DCN4_MAX_BASE_STRATEGIES);
-
-			/* populate list */
-			pmo_dcn4_fams2_expand_base_pstate_strategies(
-					base_strategy_list_2_display,
-					base_strategy_list_2_display_size,
-					i,
-					pmo->init_data.pmo_dcn4.expanded_strategy_list_2_display,
-					&pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i - 1]);
+			if (pmo->options->override_strategy_lists[i] && pmo->options->num_override_strategies_per_list[i]) {
+				base_list = pmo->options->override_strategy_lists[i];
+				base_list_size = pmo->options->num_override_strategies_per_list[i];
+			} else {
+				base_list = base_strategy_list_2_display;
+				base_list_size = base_strategy_list_2_display_size;
+			}
+
+			expanded_list_size = &pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i];
+			expanded_list = pmo->init_data.pmo_dcn4.expanded_strategy_list_2_display;
+
 			break;
 		case 3:
-			DML_ASSERT(base_strategy_list_3_display_size <= PMO_DCN4_MAX_BASE_STRATEGIES);
-
-			/* populate list */
-			pmo_dcn4_fams2_expand_base_pstate_strategies(
-					base_strategy_list_3_display,
-					base_strategy_list_3_display_size,
-					i,
-					pmo->init_data.pmo_dcn4.expanded_strategy_list_3_display,
-					&pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i - 1]);
+			if (pmo->options->override_strategy_lists[i] && pmo->options->num_override_strategies_per_list[i]) {
+				base_list = pmo->options->override_strategy_lists[i];
+				base_list_size = pmo->options->num_override_strategies_per_list[i];
+			} else {
+				base_list = base_strategy_list_3_display;
+				base_list_size = base_strategy_list_3_display_size;
+			}
+
+			expanded_list_size = &pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i];
+			expanded_list = pmo->init_data.pmo_dcn4.expanded_strategy_list_3_display;
+
 			break;
 		case 4:
-			DML_ASSERT(base_strategy_list_4_display_size <= PMO_DCN4_MAX_BASE_STRATEGIES);
-
-			/* populate list */
-			pmo_dcn4_fams2_expand_base_pstate_strategies(
-					base_strategy_list_4_display,
-					base_strategy_list_4_display_size,
-					i,
-					pmo->init_data.pmo_dcn4.expanded_strategy_list_4_display,
-					&pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i - 1]);
+			if (pmo->options->override_strategy_lists[i] && pmo->options->num_override_strategies_per_list[i]) {
+				base_list = pmo->options->override_strategy_lists[i];
+				base_list_size = pmo->options->num_override_strategies_per_list[i];
+			} else {
+				base_list = base_strategy_list_4_display;
+				base_list_size = base_strategy_list_4_display_size;
+			}
+
+			expanded_list_size = &pmo->init_data.pmo_dcn4.num_expanded_strategies_per_list[i];
+			expanded_list = pmo->init_data.pmo_dcn4.expanded_strategy_list_4_display;
+
 			break;
 		}
+
+		DML_ASSERT(base_list_size <= PMO_DCN4_MAX_BASE_STRATEGIES);
+
+		/* populate list */
+		pmo_dcn4_fams2_expand_base_pstate_strategies(
+				base_list,
+				base_list_size,
+				i + 1,
+				expanded_list,
+				expanded_list_size);
 	}
 
 	return true;
@@ -1026,13 +1049,13 @@ static bool all_timings_support_vblank(const struct dml2_pmo_instance *pmo,
 	return synchronizable;
 }
 
-static unsigned int calc_svp_microschedule(const struct dml2_fams2_meta *fams2_meta)
+static unsigned int calc_svp_microschedule(const struct dml2_pstate_meta *pstate_meta)
 {
-	return fams2_meta->contention_delay_otg_vlines +
-		fams2_meta->method_subvp.programming_delay_otg_vlines +
-		fams2_meta->method_subvp.phantom_vtotal +
-		fams2_meta->method_subvp.prefetch_to_mall_delay_otg_vlines +
-		fams2_meta->dram_clk_change_blackout_otg_vlines;
+	return pstate_meta->contention_delay_otg_vlines +
+		pstate_meta->method_subvp.programming_delay_otg_vlines +
+		pstate_meta->method_subvp.phantom_vtotal +
+		pstate_meta->method_subvp.prefetch_to_mall_delay_otg_vlines +
+		pstate_meta->blackout_otg_vlines;
 }
 
 static bool all_timings_support_drr(const struct dml2_pmo_instance *pmo,
@@ -1042,29 +1065,29 @@ static bool all_timings_support_drr(const struct dml2_pmo_instance *pmo,
 	unsigned int i;
 	for (i = 0; i < DML2_MAX_PLANES; i++) {
 		const struct dml2_stream_parameters *stream_descriptor;
-		const struct dml2_fams2_meta *stream_fams2_meta;
+		const struct dml2_pstate_meta *stream_pstate_meta;
 
 		if (is_bit_set_in_bitfield(mask, i)) {
 			stream_descriptor = &display_config->display_config.stream_descriptors[i];
-			stream_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[i];
+			stream_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[i];
 
 			if (!stream_descriptor->timing.drr_config.enabled)
 				return false;
 
 			/* cannot support required vtotal */
-			if (stream_fams2_meta->method_drr.stretched_vtotal > stream_fams2_meta->max_vtotal) {
+			if (stream_pstate_meta->method_drr.stretched_vtotal > stream_pstate_meta->max_vtotal) {
 				return false;
 			}
 
 			/* check rr is within bounds */
-			if (stream_fams2_meta->nom_refresh_rate_hz < pmo->fams_params.v2.drr.refresh_rate_limit_min ||
-				stream_fams2_meta->nom_refresh_rate_hz > pmo->fams_params.v2.drr.refresh_rate_limit_max) {
+			if (stream_pstate_meta->nom_refresh_rate_hz < pmo->fams_params.v2.drr.refresh_rate_limit_min ||
+				stream_pstate_meta->nom_refresh_rate_hz > pmo->fams_params.v2.drr.refresh_rate_limit_max) {
 				return false;
 			}
 
 			/* check required stretch is allowed */
 			if (stream_descriptor->timing.drr_config.max_instant_vtotal_delta > 0 &&
-					stream_fams2_meta->method_drr.stretched_vtotal - stream_fams2_meta->nom_vtotal > stream_descriptor->timing.drr_config.max_instant_vtotal_delta) {
+					stream_pstate_meta->method_drr.stretched_vtotal - stream_pstate_meta->nom_vtotal > stream_descriptor->timing.drr_config.max_instant_vtotal_delta) {
 				return false;
 			}
 		}
@@ -1079,7 +1102,7 @@ static bool all_timings_support_svp(const struct dml2_pmo_instance *pmo,
 {
 	const struct dml2_stream_parameters *stream_descriptor;
 	const struct dml2_plane_parameters *plane_descriptor;
-	const struct dml2_fams2_meta *stream_fams2_meta;
+	const struct dml2_pstate_meta *stream_pstate_meta;
 	unsigned int microschedule_vlines;
 	unsigned int i;
 	unsigned int mcaches_per_plane;
@@ -1124,13 +1147,13 @@ static bool all_timings_support_svp(const struct dml2_pmo_instance *pmo,
 	for (i = 0; i < DML2_MAX_PLANES; i++) {
 		if (is_bit_set_in_bitfield(mask, i)) {
 			stream_descriptor = &display_config->display_config.stream_descriptors[i];
-			stream_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[i];
+			stream_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[i];
 
 			if (stream_descriptor->overrides.disable_subvp) {
 				return false;
 			}
 
-			microschedule_vlines = calc_svp_microschedule(&pmo->scratch.pmo_dcn4.stream_fams2_meta[i]);
+			microschedule_vlines = calc_svp_microschedule(&pmo->scratch.pmo_dcn4.stream_pstate_meta[i]);
 
 			/* block if using an interlaced timing */
 			if (stream_descriptor->timing.interlaced) {
@@ -1141,8 +1164,8 @@ static bool all_timings_support_svp(const struct dml2_pmo_instance *pmo,
 			*  2) refresh rate must be within the allowed bounds
 			*/
 			if (microschedule_vlines >= stream_descriptor->timing.v_active ||
-					(stream_fams2_meta->nom_refresh_rate_hz < pmo->fams_params.v2.subvp.refresh_rate_limit_min ||
-					stream_fams2_meta->nom_refresh_rate_hz > pmo->fams_params.v2.subvp.refresh_rate_limit_max)) {
+					(stream_pstate_meta->nom_refresh_rate_hz < pmo->fams_params.v2.subvp.refresh_rate_limit_min ||
+					stream_pstate_meta->nom_refresh_rate_hz > pmo->fams_params.v2.subvp.refresh_rate_limit_max)) {
 				return false;
 			}
 		}
@@ -1232,43 +1255,43 @@ static bool all_planes_match_method(const struct display_configuation_with_meta
 }
 
 static void build_method_scheduling_params(
-	struct dml2_fams2_per_method_common_meta *stream_method_fams2_meta,
-	struct dml2_fams2_meta *stream_fams2_meta)
+	struct dml2_pstate_per_method_common_meta *stream_method_pstate_meta,
+	struct dml2_pstate_meta *stream_pstate_meta)
 {
-	stream_method_fams2_meta->allow_time_us =
-			(double)((int)stream_method_fams2_meta->allow_end_otg_vline - (int)stream_method_fams2_meta->allow_start_otg_vline) *
-			stream_fams2_meta->otg_vline_time_us;
-	if (stream_method_fams2_meta->allow_time_us >= stream_method_fams2_meta->period_us) {
+	stream_method_pstate_meta->allow_time_us =
+			(double)((int)stream_method_pstate_meta->allow_end_otg_vline - (int)stream_method_pstate_meta->allow_start_otg_vline) *
+			stream_pstate_meta->otg_vline_time_us;
+	if (stream_method_pstate_meta->allow_time_us >= stream_method_pstate_meta->period_us) {
 		/* when allow wave overlaps an entire frame, it is always schedulable (DRR can do this)*/
-		stream_method_fams2_meta->disallow_time_us = 0.0;
+		stream_method_pstate_meta->disallow_time_us = 0.0;
 	} else {
-		stream_method_fams2_meta->disallow_time_us =
-				stream_method_fams2_meta->period_us - stream_method_fams2_meta->allow_time_us;
+		stream_method_pstate_meta->disallow_time_us =
+				stream_method_pstate_meta->period_us - stream_method_pstate_meta->allow_time_us;
 	}
 }
 
-static struct dml2_fams2_per_method_common_meta *get_per_method_common_meta(
+static struct dml2_pstate_per_method_common_meta *get_per_method_common_meta(
 	struct dml2_pmo_instance *pmo,
 	enum dml2_pstate_method stream_pstate_method,
 	int stream_idx)
 {
-	struct dml2_fams2_per_method_common_meta *stream_method_fams2_meta = NULL;
+	struct dml2_pstate_per_method_common_meta *stream_method_pstate_meta = NULL;
 
 	switch (stream_pstate_method) {
 	case dml2_pstate_method_vactive:
 	case dml2_pstate_method_fw_vactive_drr:
-		stream_method_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_idx].method_vactive.common;
+		stream_method_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_idx].method_vactive.common;
 		break;
 	case dml2_pstate_method_vblank:
 	case dml2_pstate_method_fw_vblank_drr:
-		stream_method_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_idx].method_vblank.common;
+		stream_method_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_idx].method_vblank.common;
 		break;
 	case dml2_pstate_method_fw_svp:
 	case dml2_pstate_method_fw_svp_drr:
-		stream_method_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_idx].method_subvp.common;
+		stream_method_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_idx].method_subvp.common;
 		break;
 	case dml2_pstate_method_fw_drr:
-		stream_method_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_idx].method_drr.common;
+		stream_method_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_idx].method_drr.common;
 		break;
 	case dml2_pstate_method_reserved_hw:
 	case dml2_pstate_method_reserved_fw:
@@ -1277,10 +1300,10 @@ static struct dml2_fams2_per_method_common_meta *get_per_method_common_meta(
 	case dml2_pstate_method_count:
 	case dml2_pstate_method_na:
 	default:
-		stream_method_fams2_meta = NULL;
+		stream_method_pstate_meta = NULL;
 	}
 
-	return stream_method_fams2_meta;
+	return stream_method_pstate_meta;
 }
 
 static bool is_timing_group_schedulable(
@@ -1288,10 +1311,10 @@ static bool is_timing_group_schedulable(
 		const struct display_configuation_with_meta *display_cfg,
 		const struct dml2_pmo_pstate_strategy *pstate_strategy,
 		const unsigned int timing_group_idx,
-		struct dml2_fams2_per_method_common_meta *group_fams2_meta)
+		struct dml2_pstate_per_method_common_meta *group_pstate_meta)
 {
 	unsigned int i;
-	struct dml2_fams2_per_method_common_meta *stream_method_fams2_meta;
+	struct dml2_pstate_per_method_common_meta *stream_method_pstate_meta;
 
 	unsigned int base_stream_idx = 0;
 	struct dml2_pmo_scratch *s = &pmo->scratch;
@@ -1305,31 +1328,31 @@ static bool is_timing_group_schedulable(
 	}
 
 	/* init allow start and end lines for timing group */
-	stream_method_fams2_meta = get_per_method_common_meta(pmo, pstate_strategy->per_stream_pstate_method[base_stream_idx], base_stream_idx);
-	if (!stream_method_fams2_meta)
+	stream_method_pstate_meta = get_per_method_common_meta(pmo, pstate_strategy->per_stream_pstate_method[base_stream_idx], base_stream_idx);
+	if (!stream_method_pstate_meta)
 		return false;
 
-	group_fams2_meta->allow_start_otg_vline = stream_method_fams2_meta->allow_start_otg_vline;
-	group_fams2_meta->allow_end_otg_vline = stream_method_fams2_meta->allow_end_otg_vline;
-	group_fams2_meta->period_us = stream_method_fams2_meta->period_us;
+	group_pstate_meta->allow_start_otg_vline = stream_method_pstate_meta->allow_start_otg_vline;
+	group_pstate_meta->allow_end_otg_vline = stream_method_pstate_meta->allow_end_otg_vline;
+	group_pstate_meta->period_us = stream_method_pstate_meta->period_us;
 	for (i = base_stream_idx + 1; i < display_cfg->display_config.num_streams; i++) {
 		if (is_bit_set_in_bitfield(pmo->scratch.pmo_dcn4.synchronized_timing_group_masks[timing_group_idx], i)) {
-			stream_method_fams2_meta = get_per_method_common_meta(pmo, pstate_strategy->per_stream_pstate_method[i], i);
-			if (!stream_method_fams2_meta)
+			stream_method_pstate_meta = get_per_method_common_meta(pmo, pstate_strategy->per_stream_pstate_method[i], i);
+			if (!stream_method_pstate_meta)
 				continue;
 
-			if (group_fams2_meta->allow_start_otg_vline < stream_method_fams2_meta->allow_start_otg_vline) {
+			if (group_pstate_meta->allow_start_otg_vline < stream_method_pstate_meta->allow_start_otg_vline) {
 				/* set group allow start to larger otg vline */
-				group_fams2_meta->allow_start_otg_vline = stream_method_fams2_meta->allow_start_otg_vline;
+				group_pstate_meta->allow_start_otg_vline = stream_method_pstate_meta->allow_start_otg_vline;
 			}
 
-			if (group_fams2_meta->allow_end_otg_vline > stream_method_fams2_meta->allow_end_otg_vline) {
+			if (group_pstate_meta->allow_end_otg_vline > stream_method_pstate_meta->allow_end_otg_vline) {
 				/* set group allow end to smaller otg vline */
-				group_fams2_meta->allow_end_otg_vline = stream_method_fams2_meta->allow_end_otg_vline;
+				group_pstate_meta->allow_end_otg_vline = stream_method_pstate_meta->allow_end_otg_vline;
 			}
 
 			/* check waveform still has positive width */
-			if (group_fams2_meta->allow_start_otg_vline >= group_fams2_meta->allow_end_otg_vline) {
+			if (group_pstate_meta->allow_start_otg_vline >= group_pstate_meta->allow_end_otg_vline) {
 				/* timing group is not schedulable */
 				return false;
 			}
@@ -1337,10 +1360,10 @@ static bool is_timing_group_schedulable(
 	}
 
 	/* calculate the rest of the meta */
-	build_method_scheduling_params(group_fams2_meta, &pmo->scratch.pmo_dcn4.stream_fams2_meta[base_stream_idx]);
+	build_method_scheduling_params(group_pstate_meta, &pmo->scratch.pmo_dcn4.stream_pstate_meta[base_stream_idx]);
 
-	return group_fams2_meta->allow_time_us > 0.0 &&
-			group_fams2_meta->disallow_time_us < pmo->ip_caps->fams2.max_allow_delay_us;
+	return group_pstate_meta->allow_time_us > 0.0 &&
+			group_pstate_meta->disallow_time_us < pmo->ip_caps->fams2.max_allow_delay_us;
 }
 
 static bool is_config_schedulable(
@@ -1354,7 +1377,7 @@ static bool is_config_schedulable(
 
 	double max_allow_delay_us = 0.0;
 
-	memset(s->pmo_dcn4.group_common_fams2_meta, 0, sizeof(s->pmo_dcn4.group_common_fams2_meta));
+	memset(s->pmo_dcn4.group_common_pstate_meta, 0, sizeof(s->pmo_dcn4.group_common_pstate_meta));
 	memset(s->pmo_dcn4.sorted_group_gtl_disallow_index, 0, sizeof(unsigned int) * DML2_MAX_PLANES);
 
 	/* search for a general solution to the schedule */
@@ -1369,12 +1392,12 @@ static bool is_config_schedulable(
 	for (i = 0; i < s->pmo_dcn4.num_timing_groups; i++) {
 		s->pmo_dcn4.sorted_group_gtl_disallow_index[i] = i;
 		s->pmo_dcn4.sorted_group_gtl_period_index[i] = i;
-		if (!is_timing_group_schedulable(pmo, display_cfg, pstate_strategy, i, &s->pmo_dcn4.group_common_fams2_meta[i])) {
+		if (!is_timing_group_schedulable(pmo, display_cfg, pstate_strategy, i, &s->pmo_dcn4.group_common_pstate_meta[i])) {
 			/* synchronized timing group was not schedulable */
 			schedulable = false;
 			break;
 		}
-		max_allow_delay_us += s->pmo_dcn4.group_common_fams2_meta[i].disallow_time_us;
+		max_allow_delay_us += s->pmo_dcn4.group_common_pstate_meta[i].disallow_time_us;
 	}
 
 	if ((schedulable && s->pmo_dcn4.num_timing_groups <= 1) || !schedulable) {
@@ -1391,8 +1414,8 @@ static bool is_config_schedulable(
 		bool swapped = false;
 
 		for (j = 0; j < s->pmo_dcn4.num_timing_groups - 1; j++) {
-			double j_disallow_us = s->pmo_dcn4.group_common_fams2_meta[s->pmo_dcn4.sorted_group_gtl_disallow_index[j]].disallow_time_us;
-			double jp1_disallow_us = s->pmo_dcn4.group_common_fams2_meta[s->pmo_dcn4.sorted_group_gtl_disallow_index[j + 1]].disallow_time_us;
+			double j_disallow_us = s->pmo_dcn4.group_common_pstate_meta[s->pmo_dcn4.sorted_group_gtl_disallow_index[j]].disallow_time_us;
+			double jp1_disallow_us = s->pmo_dcn4.group_common_pstate_meta[s->pmo_dcn4.sorted_group_gtl_disallow_index[j + 1]].disallow_time_us;
 			if (j_disallow_us < jp1_disallow_us) {
 				/* swap as A < B */
 				swap(s->pmo_dcn4.sorted_group_gtl_disallow_index[j],
@@ -1410,19 +1433,19 @@ static bool is_config_schedulable(
 	* other display, or when >2 streams continue to halve the remaining allow time.
 	*/
 	for (i = 0; i < s->pmo_dcn4.num_timing_groups; i++) {
-		if (s->pmo_dcn4.group_common_fams2_meta[i].disallow_time_us <= 0.0) {
+		if (s->pmo_dcn4.group_common_pstate_meta[i].disallow_time_us <= 0.0) {
 			/* this timing group always allows */
 			continue;
 		}
 
-		double max_allow_time_us = s->pmo_dcn4.group_common_fams2_meta[i].allow_time_us;
+		double max_allow_time_us = s->pmo_dcn4.group_common_pstate_meta[i].allow_time_us;
 		for (j = 0; j < s->pmo_dcn4.num_timing_groups; j++) {
 			unsigned int sorted_j = s->pmo_dcn4.sorted_group_gtl_disallow_index[j];
 			/* stream can't overlap itself */
-			if (i != sorted_j && s->pmo_dcn4.group_common_fams2_meta[sorted_j].disallow_time_us > 0.0) {
+			if (i != sorted_j && s->pmo_dcn4.group_common_pstate_meta[sorted_j].disallow_time_us > 0.0) {
 				max_allow_time_us = math_min2(
-						s->pmo_dcn4.group_common_fams2_meta[sorted_j].allow_time_us,
-						(max_allow_time_us - s->pmo_dcn4.group_common_fams2_meta[sorted_j].disallow_time_us) / 2);
+						s->pmo_dcn4.group_common_pstate_meta[sorted_j].allow_time_us,
+						(max_allow_time_us - s->pmo_dcn4.group_common_pstate_meta[sorted_j].disallow_time_us) / 2);
 
 				if (max_allow_time_us < 0.0) {
 					/* failed exit early */
@@ -1450,8 +1473,8 @@ static bool is_config_schedulable(
 		bool swapped = false;
 
 		for (j = 0; j < s->pmo_dcn4.num_timing_groups - 1; j++) {
-			double j_period_us = s->pmo_dcn4.group_common_fams2_meta[s->pmo_dcn4.sorted_group_gtl_period_index[j]].period_us;
-			double jp1_period_us = s->pmo_dcn4.group_common_fams2_meta[s->pmo_dcn4.sorted_group_gtl_period_index[j + 1]].period_us;
+			double j_period_us = s->pmo_dcn4.group_common_pstate_meta[s->pmo_dcn4.sorted_group_gtl_period_index[j]].period_us;
+			double jp1_period_us = s->pmo_dcn4.group_common_pstate_meta[s->pmo_dcn4.sorted_group_gtl_period_index[j + 1]].period_us;
 			if (j_period_us < jp1_period_us) {
 				/* swap as A < B */
 				swap(s->pmo_dcn4.sorted_group_gtl_period_index[j],
@@ -1470,7 +1493,7 @@ static bool is_config_schedulable(
 		unsigned int sorted_i = s->pmo_dcn4.sorted_group_gtl_period_index[i];
 		unsigned int sorted_ip1 = s->pmo_dcn4.sorted_group_gtl_period_index[i + 1];
 
-		if (s->pmo_dcn4.group_common_fams2_meta[sorted_i].allow_time_us < s->pmo_dcn4.group_common_fams2_meta[sorted_ip1].period_us ||
+		if (s->pmo_dcn4.group_common_pstate_meta[sorted_i].allow_time_us < s->pmo_dcn4.group_common_pstate_meta[sorted_ip1].period_us ||
 				(s->pmo_dcn4.group_is_drr_enabled[sorted_ip1] && s->pmo_dcn4.group_is_drr_active[sorted_ip1])) {
 			schedulable = false;
 			break;
@@ -1492,18 +1515,18 @@ static bool is_config_schedulable(
 		/* default period_0 > period_1 */
 		unsigned int lrg_idx = 0;
 		unsigned int sml_idx = 1;
-		if (s->pmo_dcn4.group_common_fams2_meta[0].period_us < s->pmo_dcn4.group_common_fams2_meta[1].period_us) {
+		if (s->pmo_dcn4.group_common_pstate_meta[0].period_us < s->pmo_dcn4.group_common_pstate_meta[1].period_us) {
 			/* period_0 < period_1 */
 			lrg_idx = 1;
 			sml_idx = 0;
 		}
-		period_ratio = s->pmo_dcn4.group_common_fams2_meta[lrg_idx].period_us / s->pmo_dcn4.group_common_fams2_meta[sml_idx].period_us;
-		shift_per_period = s->pmo_dcn4.group_common_fams2_meta[sml_idx].period_us * (period_ratio - math_floor(period_ratio));
-		max_shift_us = s->pmo_dcn4.group_common_fams2_meta[lrg_idx].disallow_time_us - s->pmo_dcn4.group_common_fams2_meta[sml_idx].allow_time_us;
-		max_allow_delay_us = max_shift_us / shift_per_period * s->pmo_dcn4.group_common_fams2_meta[lrg_idx].period_us;
+		period_ratio = s->pmo_dcn4.group_common_pstate_meta[lrg_idx].period_us / s->pmo_dcn4.group_common_pstate_meta[sml_idx].period_us;
+		shift_per_period = s->pmo_dcn4.group_common_pstate_meta[sml_idx].period_us * (period_ratio - math_floor(period_ratio));
+		max_shift_us = s->pmo_dcn4.group_common_pstate_meta[lrg_idx].disallow_time_us - s->pmo_dcn4.group_common_pstate_meta[sml_idx].allow_time_us;
+		max_allow_delay_us = max_shift_us / shift_per_period * s->pmo_dcn4.group_common_pstate_meta[lrg_idx].period_us;
 
 		if (shift_per_period > 0.0 &&
-			shift_per_period < s->pmo_dcn4.group_common_fams2_meta[lrg_idx].allow_time_us + s->pmo_dcn4.group_common_fams2_meta[sml_idx].allow_time_us &&
+			shift_per_period < s->pmo_dcn4.group_common_pstate_meta[lrg_idx].allow_time_us + s->pmo_dcn4.group_common_pstate_meta[sml_idx].allow_time_us &&
 			max_allow_delay_us < pmo->ip_caps->fams2.max_allow_delay_us) {
 			schedulable = true;
 		}
@@ -1661,7 +1684,7 @@ static unsigned int get_vactive_det_fill_latency_delay_us(const struct display_c
 	return max_vactive_fill_us;
 }
 
-static void build_fams2_meta_per_stream(struct dml2_pmo_instance *pmo,
+static void build_pstate_meta_per_stream(struct dml2_pmo_instance *pmo,
 	struct display_configuation_with_meta *display_config,
 	int stream_index)
 {
@@ -1669,7 +1692,7 @@ static void build_fams2_meta_per_stream(struct dml2_pmo_instance *pmo,
 	const struct dml2_stream_parameters *stream_descriptor = &display_config->display_config.stream_descriptors[stream_index];
 	const struct core_stream_support_info *stream_info = &display_config->mode_support_result.cfg_support_info.stream_support_info[stream_index];
 	const struct dml2_timing_cfg *timing = &stream_descriptor->timing;
-	struct dml2_fams2_meta *stream_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_index];
+	struct dml2_pstate_meta *stream_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_index];
 
 	/* worst case all other streams require some programming at the same time, 0 if only 1 stream */
 	unsigned int contention_delay_us = (ip_caps->fams2.vertical_interrupt_ack_delay_us +
@@ -1677,142 +1700,142 @@ static void build_fams2_meta_per_stream(struct dml2_pmo_instance *pmo,
 			(display_config->display_config.num_streams - 1);
 
 	/* common */
-	stream_fams2_meta->valid = true;
-	stream_fams2_meta->otg_vline_time_us = (double)timing->h_total / timing->pixel_clock_khz * 1000.0;
-	stream_fams2_meta->nom_vtotal = stream_descriptor->timing.vblank_nom + stream_descriptor->timing.v_active;
-	stream_fams2_meta->nom_refresh_rate_hz = timing->pixel_clock_khz * 1000.0 /
-			(stream_fams2_meta->nom_vtotal * timing->h_total);
-	stream_fams2_meta->nom_frame_time_us =
-			(double)stream_fams2_meta->nom_vtotal * stream_fams2_meta->otg_vline_time_us;
-	stream_fams2_meta->vblank_start = timing->v_blank_end + timing->v_active;
+	stream_pstate_meta->valid = true;
+	stream_pstate_meta->otg_vline_time_us = (double)timing->h_total / timing->pixel_clock_khz * 1000.0;
+	stream_pstate_meta->nom_vtotal = stream_descriptor->timing.vblank_nom + stream_descriptor->timing.v_active;
+	stream_pstate_meta->nom_refresh_rate_hz = timing->pixel_clock_khz * 1000.0 /
+			(stream_pstate_meta->nom_vtotal * timing->h_total);
+	stream_pstate_meta->nom_frame_time_us =
+			(double)stream_pstate_meta->nom_vtotal * stream_pstate_meta->otg_vline_time_us;
+	stream_pstate_meta->vblank_start = timing->v_blank_end + timing->v_active;
 
 	if (stream_descriptor->timing.drr_config.enabled == true) {
 		if (stream_descriptor->timing.drr_config.min_refresh_uhz != 0.0) {
-			stream_fams2_meta->max_vtotal = (unsigned int)math_floor((double)stream_descriptor->timing.pixel_clock_khz /
+			stream_pstate_meta->max_vtotal = (unsigned int)math_floor((double)stream_descriptor->timing.pixel_clock_khz /
 					((double)stream_descriptor->timing.drr_config.min_refresh_uhz * stream_descriptor->timing.h_total) * 1e9);
 		} else {
 			/* assume min of 48Hz */
-			stream_fams2_meta->max_vtotal = (unsigned int)math_floor((double)stream_descriptor->timing.pixel_clock_khz /
+			stream_pstate_meta->max_vtotal = (unsigned int)math_floor((double)stream_descriptor->timing.pixel_clock_khz /
 					(48000000.0 * stream_descriptor->timing.h_total) * 1e9);
 		}
 	} else {
-		stream_fams2_meta->max_vtotal = stream_fams2_meta->nom_vtotal;
-	}
-	stream_fams2_meta->min_refresh_rate_hz = timing->pixel_clock_khz * 1000.0 /
-			(stream_fams2_meta->max_vtotal * timing->h_total);
-	stream_fams2_meta->max_frame_time_us =
-			(double)stream_fams2_meta->max_vtotal * stream_fams2_meta->otg_vline_time_us;
-
-	stream_fams2_meta->scheduling_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.scheduling_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->vertical_interrupt_ack_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.vertical_interrupt_ack_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->contention_delay_otg_vlines =
-			(unsigned int)math_ceil(contention_delay_us / stream_fams2_meta->otg_vline_time_us);
+		stream_pstate_meta->max_vtotal = stream_pstate_meta->nom_vtotal;
+	}
+	stream_pstate_meta->min_refresh_rate_hz = timing->pixel_clock_khz * 1000.0 /
+			(stream_pstate_meta->max_vtotal * timing->h_total);
+	stream_pstate_meta->max_frame_time_us =
+			(double)stream_pstate_meta->max_vtotal * stream_pstate_meta->otg_vline_time_us;
+
+	stream_pstate_meta->scheduling_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.scheduling_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->vertical_interrupt_ack_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.vertical_interrupt_ack_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->contention_delay_otg_vlines =
+			(unsigned int)math_ceil(contention_delay_us / stream_pstate_meta->otg_vline_time_us);
 	/* worst case allow to target needs to account for all streams' allow events overlapping, and 1 line for error */
-	stream_fams2_meta->allow_to_target_delay_otg_vlines =
-			(unsigned int)(math_ceil((ip_caps->fams2.vertical_interrupt_ack_delay_us + contention_delay_us + ip_caps->fams2.allow_programming_delay_us) / stream_fams2_meta->otg_vline_time_us)) + 1;
-	stream_fams2_meta->min_allow_width_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.min_allow_width_us / stream_fams2_meta->otg_vline_time_us);
+	stream_pstate_meta->allow_to_target_delay_otg_vlines =
+			(unsigned int)(math_ceil((ip_caps->fams2.vertical_interrupt_ack_delay_us + contention_delay_us + ip_caps->fams2.allow_programming_delay_us) / stream_pstate_meta->otg_vline_time_us)) + 1;
+	stream_pstate_meta->min_allow_width_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.min_allow_width_us / stream_pstate_meta->otg_vline_time_us);
 	/* this value should account for urgent latency */
-	stream_fams2_meta->dram_clk_change_blackout_otg_vlines =
+	stream_pstate_meta->blackout_otg_vlines =
 			(unsigned int)math_ceil(pmo->soc_bb->power_management_parameters.dram_clk_change_blackout_us /
-			stream_fams2_meta->otg_vline_time_us);
+			stream_pstate_meta->otg_vline_time_us);
 
 	/* scheduling params should be built based on the worst case for allow_time:disallow_time */
 
 	/* vactive */
 	if (display_config->display_config.num_streams == 1) {
 		/* for single stream, guarantee at least an instant of allow */
-		stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines = (unsigned int)math_floor(
+		stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines = (unsigned int)math_floor(
 				math_max2(0.0,
-				timing->v_active - math_max2(1.0, stream_fams2_meta->min_allow_width_otg_vlines) - stream_fams2_meta->dram_clk_change_blackout_otg_vlines));
+				timing->v_active - math_max2(1.0, stream_pstate_meta->min_allow_width_otg_vlines) - stream_pstate_meta->blackout_otg_vlines));
 	} else {
 		/* for multi stream, bound to a max fill time defined by IP caps */
-		stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines =
-				(unsigned int)math_floor((double)ip_caps->max_vactive_det_fill_delay_us / stream_fams2_meta->otg_vline_time_us);
+		stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines =
+				(unsigned int)math_floor((double)ip_caps->max_vactive_det_fill_delay_us / stream_pstate_meta->otg_vline_time_us);
 	}
-	stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_us = stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines * stream_fams2_meta->otg_vline_time_us;
+	stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_us = stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines * stream_pstate_meta->otg_vline_time_us;
 
-	if (stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_us > 0.0) {
-		stream_fams2_meta->method_vactive.common.allow_start_otg_vline =
-			timing->v_blank_end + stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines;
-		stream_fams2_meta->method_vactive.common.allow_end_otg_vline =
-			stream_fams2_meta->vblank_start -
-			stream_fams2_meta->dram_clk_change_blackout_otg_vlines;
+	if (stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_us > 0.0) {
+		stream_pstate_meta->method_vactive.common.allow_start_otg_vline =
+			timing->v_blank_end + stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_otg_vlines;
+		stream_pstate_meta->method_vactive.common.allow_end_otg_vline =
+			stream_pstate_meta->vblank_start -
+			stream_pstate_meta->blackout_otg_vlines;
 	} else {
-		stream_fams2_meta->method_vactive.common.allow_start_otg_vline = 0;
-		stream_fams2_meta->method_vactive.common.allow_end_otg_vline = 0;
+		stream_pstate_meta->method_vactive.common.allow_start_otg_vline = 0;
+		stream_pstate_meta->method_vactive.common.allow_end_otg_vline = 0;
 	}
-	stream_fams2_meta->method_vactive.common.period_us = stream_fams2_meta->nom_frame_time_us;
-	build_method_scheduling_params(&stream_fams2_meta->method_vactive.common, stream_fams2_meta);
+	stream_pstate_meta->method_vactive.common.period_us = stream_pstate_meta->nom_frame_time_us;
+	build_method_scheduling_params(&stream_pstate_meta->method_vactive.common, stream_pstate_meta);
 
 	/* vblank */
-	stream_fams2_meta->method_vblank.common.allow_start_otg_vline = stream_fams2_meta->vblank_start;
-	stream_fams2_meta->method_vblank.common.allow_end_otg_vline =
-			stream_fams2_meta->method_vblank.common.allow_start_otg_vline + 1;
-	stream_fams2_meta->method_vblank.common.period_us = stream_fams2_meta->nom_frame_time_us;
-	build_method_scheduling_params(&stream_fams2_meta->method_vblank.common, stream_fams2_meta);
+	stream_pstate_meta->method_vblank.common.allow_start_otg_vline = stream_pstate_meta->vblank_start;
+	stream_pstate_meta->method_vblank.common.allow_end_otg_vline =
+			stream_pstate_meta->method_vblank.common.allow_start_otg_vline + 1;
+	stream_pstate_meta->method_vblank.common.period_us = stream_pstate_meta->nom_frame_time_us;
+	build_method_scheduling_params(&stream_pstate_meta->method_vblank.common, stream_pstate_meta);
 
 	/* subvp */
-	stream_fams2_meta->method_subvp.programming_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.subvp_programming_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->method_subvp.df_throttle_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.subvp_df_throttle_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->method_subvp.prefetch_to_mall_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.subvp_prefetch_to_mall_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->method_subvp.phantom_vactive =
-			stream_fams2_meta->allow_to_target_delay_otg_vlines +
-			stream_fams2_meta->min_allow_width_otg_vlines +
+	stream_pstate_meta->method_subvp.programming_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.subvp_programming_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->method_subvp.df_throttle_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.subvp_df_throttle_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->method_subvp.prefetch_to_mall_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.subvp_prefetch_to_mall_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->method_subvp.phantom_vactive =
+			stream_pstate_meta->allow_to_target_delay_otg_vlines +
+			stream_pstate_meta->min_allow_width_otg_vlines +
 			stream_info->phantom_min_v_active;
-	stream_fams2_meta->method_subvp.phantom_vfp =
-			stream_fams2_meta->method_subvp.df_throttle_delay_otg_vlines;
+	stream_pstate_meta->method_subvp.phantom_vfp =
+			stream_pstate_meta->method_subvp.df_throttle_delay_otg_vlines;
 	/* phantom vtotal = v_bp(vstartup) + v_sync(1) + v_fp(throttle_delay) + v_active(allow_to_target + min_allow + min_vactive)*/
-	stream_fams2_meta->method_subvp.phantom_vtotal =
+	stream_pstate_meta->method_subvp.phantom_vtotal =
 			stream_info->phantom_v_startup +
-			stream_fams2_meta->method_subvp.phantom_vfp +
+			stream_pstate_meta->method_subvp.phantom_vfp +
 			1 +
-			stream_fams2_meta->method_subvp.df_throttle_delay_otg_vlines +
-			stream_fams2_meta->method_subvp.phantom_vactive;
-	stream_fams2_meta->method_subvp.common.allow_start_otg_vline =
+			stream_pstate_meta->method_subvp.df_throttle_delay_otg_vlines +
+			stream_pstate_meta->method_subvp.phantom_vactive;
+	stream_pstate_meta->method_subvp.common.allow_start_otg_vline =
 			stream_descriptor->timing.v_blank_end +
-			stream_fams2_meta->contention_delay_otg_vlines +
-			stream_fams2_meta->method_subvp.programming_delay_otg_vlines +
-			stream_fams2_meta->method_subvp.phantom_vtotal +
-			stream_fams2_meta->method_subvp.prefetch_to_mall_delay_otg_vlines +
-			stream_fams2_meta->allow_to_target_delay_otg_vlines;
-	stream_fams2_meta->method_subvp.common.allow_end_otg_vline =
-			stream_fams2_meta->vblank_start -
-			stream_fams2_meta->dram_clk_change_blackout_otg_vlines;
-	stream_fams2_meta->method_subvp.common.period_us = stream_fams2_meta->nom_frame_time_us;
-	build_method_scheduling_params(&stream_fams2_meta->method_subvp.common, stream_fams2_meta);
+			stream_pstate_meta->contention_delay_otg_vlines +
+			stream_pstate_meta->method_subvp.programming_delay_otg_vlines +
+			stream_pstate_meta->method_subvp.phantom_vtotal +
+			stream_pstate_meta->method_subvp.prefetch_to_mall_delay_otg_vlines +
+			stream_pstate_meta->allow_to_target_delay_otg_vlines;
+	stream_pstate_meta->method_subvp.common.allow_end_otg_vline =
+			stream_pstate_meta->vblank_start -
+			stream_pstate_meta->blackout_otg_vlines;
+	stream_pstate_meta->method_subvp.common.period_us = stream_pstate_meta->nom_frame_time_us;
+	build_method_scheduling_params(&stream_pstate_meta->method_subvp.common, stream_pstate_meta);
 
 	/* drr */
-	stream_fams2_meta->method_drr.programming_delay_otg_vlines =
-			(unsigned int)math_ceil(ip_caps->fams2.drr_programming_delay_us / stream_fams2_meta->otg_vline_time_us);
-	stream_fams2_meta->method_drr.common.allow_start_otg_vline =
-			stream_fams2_meta->vblank_start +
-			stream_fams2_meta->allow_to_target_delay_otg_vlines;
-	stream_fams2_meta->method_drr.common.period_us = stream_fams2_meta->nom_frame_time_us;
+	stream_pstate_meta->method_drr.programming_delay_otg_vlines =
+			(unsigned int)math_ceil(ip_caps->fams2.drr_programming_delay_us / stream_pstate_meta->otg_vline_time_us);
+	stream_pstate_meta->method_drr.common.allow_start_otg_vline =
+			stream_pstate_meta->vblank_start +
+			stream_pstate_meta->allow_to_target_delay_otg_vlines;
+	stream_pstate_meta->method_drr.common.period_us = stream_pstate_meta->nom_frame_time_us;
 	if (display_config->display_config.num_streams <= 1) {
 		/* only need to stretch vblank for blackout time */
-		stream_fams2_meta->method_drr.stretched_vtotal =
-				stream_fams2_meta->nom_vtotal +
-				stream_fams2_meta->allow_to_target_delay_otg_vlines +
-				stream_fams2_meta->min_allow_width_otg_vlines +
-				stream_fams2_meta->dram_clk_change_blackout_otg_vlines;
+		stream_pstate_meta->method_drr.stretched_vtotal =
+				stream_pstate_meta->nom_vtotal +
+				stream_pstate_meta->allow_to_target_delay_otg_vlines +
+				stream_pstate_meta->min_allow_width_otg_vlines +
+				stream_pstate_meta->blackout_otg_vlines;
 	} else {
 		/* multi display needs to always be schedulable */
-		stream_fams2_meta->method_drr.stretched_vtotal =
-				stream_fams2_meta->nom_vtotal * 2 +
-				stream_fams2_meta->allow_to_target_delay_otg_vlines +
-				stream_fams2_meta->min_allow_width_otg_vlines +
-				stream_fams2_meta->dram_clk_change_blackout_otg_vlines;
-	}
-	stream_fams2_meta->method_drr.common.allow_end_otg_vline =
-			stream_fams2_meta->method_drr.stretched_vtotal -
-			stream_fams2_meta->dram_clk_change_blackout_otg_vlines;
-	build_method_scheduling_params(&stream_fams2_meta->method_drr.common, stream_fams2_meta);
+		stream_pstate_meta->method_drr.stretched_vtotal =
+				stream_pstate_meta->nom_vtotal * 2 +
+				stream_pstate_meta->allow_to_target_delay_otg_vlines +
+				stream_pstate_meta->min_allow_width_otg_vlines +
+				stream_pstate_meta->blackout_otg_vlines;
+	}
+	stream_pstate_meta->method_drr.common.allow_end_otg_vline =
+			stream_pstate_meta->method_drr.stretched_vtotal -
+			stream_pstate_meta->blackout_otg_vlines;
+	build_method_scheduling_params(&stream_pstate_meta->method_drr.common, stream_pstate_meta);
 }
 
 static void build_subvp_meta_per_stream(struct dml2_pmo_instance *pmo,
@@ -1820,14 +1843,14 @@ static void build_subvp_meta_per_stream(struct dml2_pmo_instance *pmo,
 	int stream_index)
 {
 	struct dml2_implicit_svp_meta *stream_svp_meta = &pmo->scratch.pmo_dcn4.stream_svp_meta[stream_index];
-	struct dml2_fams2_meta *stream_fams2_meta = &pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_index];
+	struct dml2_pstate_meta *stream_pstate_meta = &pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_index];
 
 	stream_svp_meta->valid = true;
 
 	/* PMO FAMS2 precaulcates these values */
-	stream_svp_meta->v_active = stream_fams2_meta->method_subvp.phantom_vactive;
-	stream_svp_meta->v_front_porch = stream_fams2_meta->method_subvp.phantom_vfp;
-	stream_svp_meta->v_total = stream_fams2_meta->method_subvp.phantom_vtotal;
+	stream_svp_meta->v_active = stream_pstate_meta->method_subvp.phantom_vactive;
+	stream_svp_meta->v_front_porch = stream_pstate_meta->method_subvp.phantom_vfp;
+	stream_svp_meta->v_total = stream_pstate_meta->method_subvp.phantom_vtotal;
 }
 
 bool pmo_dcn4_fams2_init_for_pstate_support(struct dml2_pmo_init_for_pstate_support_in_out *in_out)
@@ -1879,7 +1902,7 @@ bool pmo_dcn4_fams2_init_for_pstate_support(struct dml2_pmo_init_for_pstate_supp
 			set_bit_in_bitfield(&s->pmo_dcn4.stream_vactive_capability_mask, stream_index);
 
 		/* FAMS2 meta */
-		build_fams2_meta_per_stream(pmo, display_config, stream_index);
+		build_pstate_meta_per_stream(pmo, display_config, stream_index);
 
 		/* SVP meta */
 		build_subvp_meta_per_stream(pmo, display_config, stream_index);
@@ -2077,7 +2100,7 @@ static void setup_planes_for_vactive_by_mask(struct display_configuation_with_me
 
 			if (!pmo->options->disable_vactive_det_fill_bw_pad) {
 				display_config->display_config.plane_descriptors[plane_index].overrides.max_vactive_det_fill_delay_us =
-					(unsigned int)math_floor(pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_index].method_vactive.max_vactive_det_fill_delay_us);
+					(unsigned int)math_floor(pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_index].method_vactive.max_vactive_det_fill_delay_us);
 			}
 		}
 	}
@@ -2098,7 +2121,7 @@ static void setup_planes_for_vactive_drr_by_mask(struct display_configuation_wit
 
 			if (!pmo->options->disable_vactive_det_fill_bw_pad) {
 				display_config->display_config.plane_descriptors[plane_index].overrides.max_vactive_det_fill_delay_us =
-					(unsigned int)math_floor(pmo->scratch.pmo_dcn4.stream_fams2_meta[stream_index].method_vactive.max_vactive_det_fill_delay_us);
+					(unsigned int)math_floor(pmo->scratch.pmo_dcn4.stream_pstate_meta[stream_index].method_vactive.max_vactive_det_fill_delay_us);
 			}
 		}
 	}
@@ -2144,9 +2167,9 @@ static bool setup_display_config(struct display_configuation_with_meta *display_
 	/* copy FAMS2 meta */
 	if (success) {
 		display_config->stage3.fams2_required = fams2_required;
-		memcpy(&display_config->stage3.stream_fams2_meta,
-			&scratch->pmo_dcn4.stream_fams2_meta,
-			sizeof(struct dml2_fams2_meta) * DML2_MAX_PLANES);
+		memcpy(&display_config->stage3.stream_pstate_meta,
+			&scratch->pmo_dcn4.stream_pstate_meta,
+			sizeof(struct dml2_pstate_meta) * DML2_MAX_PLANES);
 	}
 
 	return success;
@@ -2188,12 +2211,12 @@ bool pmo_dcn4_fams2_test_for_pstate_support(struct dml2_pmo_test_for_pstate_supp
 		return false;
 
 	for (stream_index = 0; stream_index < in_out->base_display_config->display_config.num_streams; stream_index++) {
-		struct dml2_fams2_meta *stream_fams2_meta = &s->pmo_dcn4.stream_fams2_meta[stream_index];
+		struct dml2_pstate_meta *stream_pstate_meta = &s->pmo_dcn4.stream_pstate_meta[stream_index];
 
 		if (s->pmo_dcn4.pstate_strategy_candidates[s->pmo_dcn4.cur_pstate_candidate].per_stream_pstate_method[stream_index] == dml2_pstate_method_vactive ||
 				s->pmo_dcn4.pstate_strategy_candidates[s->pmo_dcn4.cur_pstate_candidate].per_stream_pstate_method[stream_index] == dml2_pstate_method_fw_vactive_drr) {
 			if (get_vactive_pstate_margin(in_out->base_display_config, s->pmo_dcn4.stream_plane_mask[stream_index]) < (MIN_VACTIVE_MARGIN_PCT * in_out->instance->soc_bb->power_management_parameters.dram_clk_change_blackout_us) ||
-					get_vactive_det_fill_latency_delay_us(in_out->base_display_config, s->pmo_dcn4.stream_plane_mask[stream_index]) > stream_fams2_meta->method_vactive.max_vactive_det_fill_delay_us) {
+					get_vactive_det_fill_latency_delay_us(in_out->base_display_config, s->pmo_dcn4.stream_plane_mask[stream_index]) > stream_pstate_meta->method_vactive.max_vactive_det_fill_delay_us) {
 				p_state_supported = false;
 				break;
 			}
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/inc/dml2_internal_shared_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/inc/dml2_internal_shared_types.h
index d52aa82283b369..9f562f0c479703 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/inc/dml2_internal_shared_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/inc/dml2_internal_shared_types.h
@@ -255,7 +255,7 @@ struct dml2_implicit_svp_meta {
 	unsigned long v_front_porch;
 };
 
-struct dml2_fams2_per_method_common_meta {
+struct dml2_pstate_per_method_common_meta {
 	/* generic params */
 	unsigned int allow_start_otg_vline;
 	unsigned int allow_end_otg_vline;
@@ -265,7 +265,7 @@ struct dml2_fams2_per_method_common_meta {
 	double period_us;
 };
 
-struct dml2_fams2_meta {
+struct dml2_pstate_meta {
 	bool valid;
 	double otg_vline_time_us;
 	unsigned int scheduling_delay_otg_vlines;
@@ -280,14 +280,14 @@ struct dml2_fams2_meta {
 	unsigned int max_vtotal;
 	double min_refresh_rate_hz;
 	double max_frame_time_us;
-	unsigned int dram_clk_change_blackout_otg_vlines;
+	unsigned int blackout_otg_vlines;
 	struct {
 		double max_vactive_det_fill_delay_us;
 		unsigned int max_vactive_det_fill_delay_otg_vlines;
-		struct dml2_fams2_per_method_common_meta common;
+		struct dml2_pstate_per_method_common_meta common;
 	} method_vactive;
 	struct {
-		struct dml2_fams2_per_method_common_meta common;
+		struct dml2_pstate_per_method_common_meta common;
 	} method_vblank;
 	struct {
 		unsigned int programming_delay_otg_vlines;
@@ -296,15 +296,24 @@ struct dml2_fams2_meta {
 		unsigned long phantom_vactive;
 		unsigned long phantom_vfp;
 		unsigned long phantom_vtotal;
-		struct dml2_fams2_per_method_common_meta common;
+		struct dml2_pstate_per_method_common_meta common;
 	} method_subvp;
 	struct {
 		unsigned int programming_delay_otg_vlines;
 		unsigned int stretched_vtotal;
-		struct dml2_fams2_per_method_common_meta common;
+		struct dml2_pstate_per_method_common_meta common;
 	} method_drr;
 };
 
+/* mask of synchronized timings by stream index */
+struct dml2_pmo_synchronized_timing_groups {
+	unsigned int num_timing_groups;
+	unsigned int synchronized_timing_group_masks[DML2_MAX_PLANES];
+	bool group_is_drr_enabled[DML2_MAX_PLANES];
+	bool group_is_drr_active[DML2_MAX_PLANES];
+	double group_line_time_us[DML2_MAX_PLANES];
+};
+
 struct dml2_optimization_stage3_state {
 	bool performed;
 	bool success;
@@ -319,7 +328,7 @@ struct dml2_optimization_stage3_state {
 
 	// Meta-data for FAMS2
 	bool fams2_required;
-	struct dml2_fams2_meta stream_fams2_meta[DML2_MAX_PLANES];
+	struct dml2_pstate_meta stream_pstate_meta[DML2_MAX_PLANES];
 
 	int min_clk_index_for_latency;
 };
@@ -472,6 +481,7 @@ struct dml2_core_scratch {
 };
 
 struct dml2_core_instance {
+	enum dml2_project_id project_id;
 	struct dml2_mcg_min_clock_table *minimum_clock_table;
 	struct dml2_core_internal_state_inputs inputs;
 	struct dml2_core_internal_state_intermediates intermediates;
@@ -619,6 +629,12 @@ struct dml2_pmo_optimize_for_stutter_in_out {
 #define PMO_DCN4_MAX_NUM_VARIANTS 2
 #define PMO_DCN4_MAX_BASE_STRATEGIES 10
 
+struct dml2_scheduling_check_locals {
+	struct dml2_pstate_per_method_common_meta group_common_pstate_meta[DML2_MAX_PLANES];
+	unsigned int sorted_group_gtl_disallow_index[DML2_MAX_PLANES];
+	unsigned int sorted_group_gtl_period_index[DML2_MAX_PLANES];
+};
+
 struct dml2_pmo_scratch {
 	union {
 		struct {
@@ -648,7 +664,7 @@ struct dml2_pmo_scratch {
 			// Stores all the implicit SVP meta information indexed by stream index of the display
 			// configuration under inspection, built at optimization stage init
 			struct dml2_implicit_svp_meta stream_svp_meta[DML2_MAX_PLANES];
-			struct dml2_fams2_meta stream_fams2_meta[DML2_MAX_PLANES];
+			struct dml2_pstate_meta stream_pstate_meta[DML2_MAX_PLANES];
 
 			unsigned int optimal_vblank_reserved_time_for_stutter_us[DML2_PMO_STUTTER_CANDIDATE_LIST_SIZE];
 			unsigned int num_stutter_candidates;
@@ -663,7 +679,7 @@ struct dml2_pmo_scratch {
 			double group_line_time_us[DML2_MAX_PLANES];
 
 			/* scheduling check locals */
-			struct dml2_fams2_per_method_common_meta group_common_fams2_meta[DML2_MAX_PLANES];
+			struct dml2_pstate_per_method_common_meta group_common_pstate_meta[DML2_MAX_PLANES];
 			unsigned int sorted_group_gtl_disallow_index[DML2_MAX_PLANES];
 			unsigned int sorted_group_gtl_period_index[DML2_MAX_PLANES];
 			double group_phase_offset[DML2_MAX_PLANES];

From 04a1c2898d4713d36225328dbf02737006c8506d Mon Sep 17 00:00:00 2001
From: Austin Zheng <Austin.Zheng@amd.com>
Date: Wed, 24 Sep 2025 10:23:24 -0400
Subject: [PATCH 0564/1982] drm/amd/display: Update P-state naming for clarity.

[ Upstream commit e44ee152a5ea8ee1b5f5440a754a9fd17639f230 ]

[Why & How]
P-state can refer to different things like UCLK P-state, PPT, or temp read
Update naming for clarity

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Austin Zheng <Austin.Zheng@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 93a77d353cb2 ("drm/amd/display: Remove const Qualifier From Non-Pointer Fields")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c |  2 +-
 .../src/dml2_core/dml2_core_shared_types.h     | 18 ++++++++++++------
 .../dml2/dml21/src/dml2_core/dml2_core_utils.c |  2 ++
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
index 7ff30870aa601c..d2a237fcf5b08f 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
@@ -13023,7 +13023,7 @@ void dml2_core_calcs_get_informative(const struct dml2_core_internal_display_mod
 	out->informative.mode_support_info.InvalidCombinationOfMALLUseForPState = mode_lib->ms.support.InvalidCombinationOfMALLUseForPState;
 	out->informative.mode_support_info.ExceededMALLSize = mode_lib->ms.support.ExceededMALLSize;
 	out->informative.mode_support_info.EnoughWritebackUnits = mode_lib->ms.support.EnoughWritebackUnits;
-	out->informative.mode_support_info.temp_read_or_ppt_support = mode_lib->ms.support.temp_read_or_ppt_support;
+	out->informative.mode_support_info.temp_read_or_ppt_support = mode_lib->ms.support.global_temp_read_or_ppt_supported;
 	out->informative.mode_support_info.g6_temp_read_support = mode_lib->ms.support.g6_temp_read_support;
 
 	out->informative.mode_support_info.ExceededMultistreamSlots = mode_lib->ms.support.ExceededMultistreamSlots;
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
index ff1c47347610a9..c09be5652f46f0 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
@@ -263,8 +263,11 @@ struct dml2_core_internal_mode_support_info {
 	bool DCCMetaBufferSizeNotExceeded;
 	enum dml2_pstate_change_support DRAMClockChangeSupport[DML2_MAX_PLANES];
 	enum dml2_pstate_change_support FCLKChangeSupport[DML2_MAX_PLANES];
+	enum dml2_pstate_change_support temp_read_or_ppt_support[DML2_MAX_PLANES];
+	bool global_dram_clock_change_support_required;
 	bool global_dram_clock_change_supported;
 	bool global_fclk_change_supported;
+	bool global_temp_read_or_ppt_supported;
 	bool USRRetrainingSupport;
 	bool AvgBandwidthSupport;
 	bool UrgVactiveBandwidthSupport;
@@ -335,7 +338,6 @@ struct dml2_core_internal_mode_support_info {
 	bool incorrect_imall_usage;
 
 	bool g6_temp_read_support;
-	bool temp_read_or_ppt_support;
 
 	struct dml2_core_internal_watermarks watermarks;
 	bool dcfclk_support;
@@ -643,7 +645,7 @@ struct dml2_core_internal_mode_support {
 	unsigned int DSTYAfterScaler[DML2_MAX_PLANES];
 	unsigned int DSTXAfterScaler[DML2_MAX_PLANES];
 
-	enum dml2_pstate_method pstate_switch_modes[DML2_MAX_PLANES];
+	enum dml2_pstate_method uclk_pstate_switch_modes[DML2_MAX_PLANES];
 };
 
 /// @brief A mega structure that houses various info for model programming step.
@@ -834,6 +836,7 @@ struct dml2_core_internal_mode_program {
 	double max_urgent_latency_us;
 	double df_response_time_us;
 
+	enum dml2_pstate_method uclk_pstate_switch_modes[DML2_MAX_PLANES];
 	// -------------------
 	// Output
 	// -------------------
@@ -960,11 +963,12 @@ struct dml2_core_internal_mode_program {
 	double MaxActiveFCLKChangeLatencySupported;
 	bool USRRetrainingSupport;
 	bool g6_temp_read_support;
-	bool temp_read_or_ppt_support;
 	enum dml2_pstate_change_support FCLKChangeSupport[DML2_MAX_PLANES];
 	enum dml2_pstate_change_support DRAMClockChangeSupport[DML2_MAX_PLANES];
+	enum dml2_pstate_change_support temp_read_or_ppt_support[DML2_MAX_PLANES];
 	bool global_dram_clock_change_supported;
 	bool global_fclk_change_supported;
+	bool global_temp_read_or_ppt_supported;
 	double MaxActiveDRAMClockChangeLatencySupported[DML2_MAX_PLANES];
 	double WritebackAllowFCLKChangeEndPosition[DML2_MAX_PLANES];
 	double WritebackAllowDRAMClockChangeEndPosition[DML2_MAX_PLANES];
@@ -1310,7 +1314,7 @@ struct dml2_core_calcs_CalculateVMRowAndSwath_params {
 	unsigned int HostVMMinPageSize;
 	unsigned int DCCMetaBufferSizeBytes;
 	bool mrq_present;
-	enum dml2_pstate_method *pstate_switch_modes;
+	enum dml2_pstate_method *uclk_pstate_switch_modes;
 
 	// Output
 	bool *PTEBufferSizeNotExceeded;
@@ -1737,10 +1741,12 @@ struct dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_param
 	unsigned int max_request_size_bytes;
 	unsigned int *meta_row_height_l;
 	unsigned int *meta_row_height_c;
+	enum dml2_pstate_method *uclk_pstate_switch_modes;
 
 	// Output
 	struct dml2_core_internal_watermarks *Watermark;
 	enum dml2_pstate_change_support *DRAMClockChangeSupport;
+	bool *global_dram_clock_change_support_required;
 	bool *global_dram_clock_change_supported;
 	double *MaxActiveDRAMClockChangeLatencySupported;
 	unsigned int *SubViewportLinesNeededInMALL;
@@ -1751,10 +1757,10 @@ struct dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_param
 	double *VActiveLatencyHidingMargin;
 	double *VActiveLatencyHidingUs;
 	bool *g6_temp_read_support;
-	bool *temp_read_or_ppt_support;
+	enum dml2_pstate_change_support *temp_read_or_ppt_support;
+	bool *global_temp_read_or_ppt_supported;
 };
 
-
 struct dml2_core_calcs_CalculateSwathAndDETConfiguration_params {
 	const struct dml2_display_cfg *display_cfg;
 	unsigned int ConfigReturnBufferSizeInKByte;
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_utils.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_utils.c
index 5f301befed1674..b57d0f6ea6a1c3 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_utils.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_utils.c
@@ -306,6 +306,8 @@ void dml2_core_utils_print_mode_support_info(const struct dml2_core_internal_mod
 		DML_LOG_VERBOSE("DML: support: ExceededMALLSize = %d\n", support->ExceededMALLSize);
 	if (!fail_only || support->g6_temp_read_support == 0)
 		DML_LOG_VERBOSE("DML: support: g6_temp_read_support = %d\n", support->g6_temp_read_support);
+	if (!fail_only || (support->global_dram_clock_change_supported == 0 && support->global_dram_clock_change_support_required))
+		DML_LOG_VERBOSE("DML: support: dram_clock_change_support = %d\n", support->global_dram_clock_change_supported);
 	if (!fail_only || support->ImmediateFlipSupport == 0)
 		DML_LOG_VERBOSE("DML: support: ImmediateFlipSupport = %d\n", support->ImmediateFlipSupport);
 	if (!fail_only || support->LinkCapacitySupport == 0)

From ebc73f622313ff50bff23baa20db85936105b02f Mon Sep 17 00:00:00 2001
From: Wenjing Liu <wenjing.liu@amd.com>
Date: Thu, 26 Mar 2026 17:13:27 -0400
Subject: [PATCH 0565/1982] drm/amd/display: add const qualifiers to watermark
 params struct

[ Upstream commit dd2308c1d007d7a3416c02e542abdc6acc23966d ]

[why]
There are few non const input pointer fields. Setting them to const to
prevent future modification of read-only data.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 93a77d353cb2 ("drm/amd/display: Remove const Qualifier From Non-Pointer Fields")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../src/dml2_core/dml2_core_shared_types.h    | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
index c09be5652f46f0..bc64e3fd5f209c 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
@@ -1718,30 +1718,30 @@ struct dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_param
 	double ReturnBW;
 	bool SynchronizeTimings;
 	bool SynchronizeDRRDisplaysForUCLKPStateChange;
-	unsigned int *dpte_group_bytes;
+	const unsigned int *dpte_group_bytes;
 	struct dml2_core_internal_SOCParametersList mmSOCParameters;
 	unsigned int WritebackChunkSize;
 	double SOCCLK;
 	double DCFClkDeepSleep;
-	unsigned int *DETBufferSizeY;
-	unsigned int *DETBufferSizeC;
-	unsigned int *SwathHeightY;
-	unsigned int *SwathHeightC;
-	unsigned int *SwathWidthY;
-	unsigned int *SwathWidthC;
-	unsigned int *DPPPerSurface;
-	double *BytePerPixelDETY;
-	double *BytePerPixelDETC;
-	unsigned int *DSTXAfterScaler;
-	unsigned int *DSTYAfterScaler;
+	const unsigned int *DETBufferSizeY;
+	const unsigned int *DETBufferSizeC;
+	const unsigned int *SwathHeightY;
+	const unsigned int *SwathHeightC;
+	const unsigned int *SwathWidthY;
+	const unsigned int *SwathWidthC;
+	const unsigned int *DPPPerSurface;
+	const double *BytePerPixelDETY;
+	const double *BytePerPixelDETC;
+	const unsigned int *DSTXAfterScaler;
+	const unsigned int *DSTYAfterScaler;
 	bool UnboundedRequestEnabled;
 	unsigned int CompressedBufferSizeInkByte;
 	bool max_outstanding_when_urgent_expected;
-	unsigned int max_outstanding_requests;
-	unsigned int max_request_size_bytes;
-	unsigned int *meta_row_height_l;
-	unsigned int *meta_row_height_c;
-	enum dml2_pstate_method *uclk_pstate_switch_modes;
+	const unsigned int max_outstanding_requests;
+	const unsigned int max_request_size_bytes;
+	const unsigned int *meta_row_height_l;
+	const unsigned int *meta_row_height_c;
+	const enum dml2_pstate_method *uclk_pstate_switch_modes;
 
 	// Output
 	struct dml2_core_internal_watermarks *Watermark;

From 18c77e2bd13c3dadeb3c88b475fa75d3dfc3878d Mon Sep 17 00:00:00 2001
From: Austin Zheng <Austin.Zheng@amd.com>
Date: Wed, 19 Aug 2026 09:33:57 -0400
Subject: [PATCH 0566/1982] drm/amd/display: Remove const Qualifier From
 Non-Pointer Fields

[ Upstream commit 93a77d353cb26772ae2fba50ae7321ae996b7f00 ]

[WHY/HOW]
Integer values for
dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_params
should not have the const qualifier.
This prevents using different values of the inputs when the
function is called again.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Austin Zheng <Austin.Zheng@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 342280aae4f33816e8d07c15cb538a3b375a7f8f)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
index bc64e3fd5f209c..01a316e46426ad 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_shared_types.h
@@ -1737,8 +1737,8 @@ struct dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_param
 	bool UnboundedRequestEnabled;
 	unsigned int CompressedBufferSizeInkByte;
 	bool max_outstanding_when_urgent_expected;
-	const unsigned int max_outstanding_requests;
-	const unsigned int max_request_size_bytes;
+	unsigned int max_outstanding_requests;
+	unsigned int max_request_size_bytes;
 	const unsigned int *meta_row_height_l;
 	const unsigned int *meta_row_height_c;
 	const enum dml2_pstate_method *uclk_pstate_switch_modes;

From b46e041ff51665529de1ce4731d5c7d1e1ef2208 Mon Sep 17 00:00:00 2001
From: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Date: Fri, 4 Sep 2026 21:44:53 +0800
Subject: [PATCH 0567/1982] LoongArch: KVM: Add unregister helpers for the KVM
 interrupt devices

[ Upstream commit 4af22177032ab2357bf551fbfcdebc8fd9f2502d ]

The IPI/EIOINTC/PCH-PIC/DMSINTC KVM devices each have a helper that
registers their kvm_device_ops, but there is no counterpart to remove
them, so a caller that needs to undo a registration has to open-code
kvm_unregister_device_ops() with the matching device type.

Add kvm_loongarch_unregister_{ipi,eiointc,pch_pic,dmsintc}_device()
next to the existing register helpers. kvm_unregister_device_ops() is a
no-op when the corresponding device type is not currently registered.

No functional change, as there are no callers yet.

Cc: stable@vger.kernel.org
Suggested-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
[ sashal: Dropped the DMSINTC hunks and files because this tree has no DMSINTC support, leaving only the IPI, EIOINTC and PCH-PIC unregister helpers, with context adjusted for older surrounding code. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/kvm_eiointc.h | 1 +
 arch/loongarch/include/asm/kvm_ipi.h     | 1 +
 arch/loongarch/include/asm/kvm_pch_pic.h | 1 +
 arch/loongarch/kvm/intc/eiointc.c        | 5 +++++
 arch/loongarch/kvm/intc/ipi.c            | 5 +++++
 arch/loongarch/kvm/intc/pch_pic.c        | 5 +++++
 6 files changed, 18 insertions(+)

diff --git a/arch/loongarch/include/asm/kvm_eiointc.h b/arch/loongarch/include/asm/kvm_eiointc.h
index a3a40aba8acf29..1cac3d49895801 100644
--- a/arch/loongarch/include/asm/kvm_eiointc.h
+++ b/arch/loongarch/include/asm/kvm_eiointc.h
@@ -118,6 +118,7 @@ struct loongarch_eiointc {
 };
 
 int kvm_loongarch_register_eiointc_device(void);
+void kvm_loongarch_unregister_eiointc_device(void);
 void eiointc_set_irq(struct loongarch_eiointc *s, int irq, int level);
 
 #endif /* __ASM_KVM_EIOINTC_H */
diff --git a/arch/loongarch/include/asm/kvm_ipi.h b/arch/loongarch/include/asm/kvm_ipi.h
index 060163dfb4a380..d1d72d4bb8d15e 100644
--- a/arch/loongarch/include/asm/kvm_ipi.h
+++ b/arch/loongarch/include/asm/kvm_ipi.h
@@ -41,5 +41,6 @@ struct ipi_state {
 #define IOCSR_ANY_SEND		0x158
 
 int kvm_loongarch_register_ipi_device(void);
+void kvm_loongarch_unregister_ipi_device(void);
 
 #endif
diff --git a/arch/loongarch/include/asm/kvm_pch_pic.h b/arch/loongarch/include/asm/kvm_pch_pic.h
index 7f33a303927285..c0aa2727587d64 100644
--- a/arch/loongarch/include/asm/kvm_pch_pic.h
+++ b/arch/loongarch/include/asm/kvm_pch_pic.h
@@ -69,6 +69,7 @@ struct loongarch_pch_pic {
 };
 
 int kvm_loongarch_register_pch_pic_device(void);
+void kvm_loongarch_unregister_pch_pic_device(void);
 void pch_pic_set_irq(struct loongarch_pch_pic *s, int irq, int level);
 void pch_msi_set_irq(struct kvm *kvm, int irq, int level);
 
diff --git a/arch/loongarch/kvm/intc/eiointc.c b/arch/loongarch/kvm/intc/eiointc.c
index 1380186fd5aed3..771d63f8cfa425 100644
--- a/arch/loongarch/kvm/intc/eiointc.c
+++ b/arch/loongarch/kvm/intc/eiointc.c
@@ -700,3 +700,8 @@ int kvm_loongarch_register_eiointc_device(void)
 {
 	return kvm_register_device_ops(&kvm_eiointc_dev_ops, KVM_DEV_TYPE_LOONGARCH_EIOINTC);
 }
+
+void kvm_loongarch_unregister_eiointc_device(void)
+{
+	kvm_unregister_device_ops(KVM_DEV_TYPE_LOONGARCH_EIOINTC);
+}
diff --git a/arch/loongarch/kvm/intc/ipi.c b/arch/loongarch/kvm/intc/ipi.c
index 0e2840f75673fa..0dd1e2c857a33d 100644
--- a/arch/loongarch/kvm/intc/ipi.c
+++ b/arch/loongarch/kvm/intc/ipi.c
@@ -476,3 +476,8 @@ int kvm_loongarch_register_ipi_device(void)
 {
 	return kvm_register_device_ops(&kvm_ipi_dev_ops, KVM_DEV_TYPE_LOONGARCH_IPI);
 }
+
+void kvm_loongarch_unregister_ipi_device(void)
+{
+	kvm_unregister_device_ops(KVM_DEV_TYPE_LOONGARCH_IPI);
+}
diff --git a/arch/loongarch/kvm/intc/pch_pic.c b/arch/loongarch/kvm/intc/pch_pic.c
index ab336cde24f6d9..d0197881851971 100644
--- a/arch/loongarch/kvm/intc/pch_pic.c
+++ b/arch/loongarch/kvm/intc/pch_pic.c
@@ -495,3 +495,8 @@ int kvm_loongarch_register_pch_pic_device(void)
 {
 	return kvm_register_device_ops(&kvm_pch_pic_dev_ops, KVM_DEV_TYPE_LOONGARCH_PCHPIC);
 }
+
+void kvm_loongarch_unregister_pch_pic_device(void)
+{
+	kvm_unregister_device_ops(KVM_DEV_TYPE_LOONGARCH_PCHPIC);
+}

From 46345b99ee5d4207ff1c58b46f9b488c03117d8c Mon Sep 17 00:00:00 2001
From: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Date: Fri, 4 Sep 2026 21:44:54 +0800
Subject: [PATCH 0568/1982] LoongArch: KVM: Fix resource leak in
 kvm_loongarch_env_init() error path

[ Upstream commit 910132bc7d72f26a8b288c2a38c32445a48d5be0 ]

kvm_loongarch_env_init() allocates the per-CPU kvm_context (vmcs) and
kvm_loongarch_ops, registers the perf callbacks, and then registers
the IPI/EIOINTC/PCH-PIC/DMSINTC KVM devices. If any of those device
registrations fails, the function returned the error directly, leaving
everything acquired so far in place: vmcs and kvm_loongarch_ops are
never freed, the perf callbacks stay registered, and all previously
registered KVM device operations remain registered. kvm_loongarch_init()
propagates the errors without calling kvm_loongarch_env_exit(), so
nothing else cleans up either.

Unwind the error path in reverse order of registration, so that each
failure only undoes what had actually been set up. Use the same helpers
in kvm_loongarch_env_exit() to remove the device registrations during
normal teardown as well.

Cc: stable@vger.kernel.org
Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
[ sashal: Dropped the DMSINTC registration, its error label and its exit-time unregister call, since this tree has no DMSINTC device, so the unwind covers only IPI, EIOINTC and PCH-PIC. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kvm/main.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kvm/main.c b/arch/loongarch/kvm/main.c
index 5af8fb2bad1e20..91d4827d7f6486 100644
--- a/arch/loongarch/kvm/main.c
+++ b/arch/loongarch/kvm/main.c
@@ -376,21 +376,40 @@ static int kvm_loongarch_env_init(void)
 	/* Register LoongArch IPI interrupt controller interface. */
 	ret = kvm_loongarch_register_ipi_device();
 	if (ret)
-		return ret;
+		goto err_env;
 
 	/* Register LoongArch EIOINTC interrupt controller interface. */
 	ret = kvm_loongarch_register_eiointc_device();
 	if (ret)
-		return ret;
+		goto err_ipi;
 
 	/* Register LoongArch PCH-PIC interrupt controller interface. */
 	ret = kvm_loongarch_register_pch_pic_device();
+	if (ret)
+		goto err_eiointc;
+
+	return 0;
+
+err_eiointc:
+	kvm_loongarch_unregister_eiointc_device();
+err_ipi:
+	kvm_loongarch_unregister_ipi_device();
+err_env:
+	kvm_unregister_perf_callbacks();
+	kfree(kvm_loongarch_ops);
+	kvm_loongarch_ops = NULL;
+	free_percpu(vmcs);
+	vmcs = NULL;
 
 	return ret;
 }
 
 static void kvm_loongarch_env_exit(void)
 {
+	kvm_loongarch_unregister_pch_pic_device();
+	kvm_loongarch_unregister_eiointc_device();
+	kvm_loongarch_unregister_ipi_device();
+
 	if (vmcs)
 		free_percpu(vmcs);
 

From 06a76084f3e56ad08765eb53d30c83af425bd8df Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Fri, 31 Jul 2026 18:50:01 +0200
Subject: [PATCH 0569/1982] s390/crypto: Replace cond_resched() with msleep(1)

[ Upstream commit e11733826f9779eb954abdcd2b60b273558f1a77 ]

With [1] cond_resched() is always compiled away and becomes a no-op.

The comments for all cond_resched() calls in crypto code however indicate
that the current process should be scheduled away to avoid instant
re-invocation of a callback. This is not what cond_resched() would do or
did.

Instead of just removing the cond_resched() calls, replace them with
msleep() calls, as suggested by Holger Dengler. This forces the current
task to be scheduled away (sleeps) like originally intended.

Holger provided information why this intended [2]:
"
Let me give a bit of background here: The protected key can only get
invalid, if the Linux instance (z/VM or KVM guest) is moved to another
hypervisor on a different machine (aka life guest relocation). In such a
case, the crypto accelerator card and the host has to exchange the "real
key", which is wrapped by the host and handed back to the guest as the
re-newed protected key. Unfortunately there is no asynchronous trigger
on completion, you have to re-try (and maybe get another "in progress"
return).

And as if that weren't bad enough, if this key exchange between card and
host is the first one, card and host has to instantiate a secure
communication channel (including a key exchange for the transport layer).
"

[1] commit 7dadeaa6e851 ("sched: Further restrict the preemption modes")
[2] https://lore.kernel.org/all/39570813-27b0-40f9-89c5-8e2dce05e2f0@linux.ibm.com/
[3] https://lore.kernel.org/all/20260731084027.GE776954@noisy.programming.kicks-ass.net/

[hca@linux.ibm.com: took Peter's patch [3] and provided commit message]

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Stable-dep-of: 403648373816 ("s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/crypto/paes_s390.c  | 44 ++++-------------------------------
 arch/s390/crypto/phmac_s390.c | 25 +++-----------------
 arch/s390/include/asm/pkey.h  | 16 +++++++++++++
 3 files changed, 23 insertions(+), 62 deletions(-)

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index 15ac83e5216159..b9cc0c25ba8c37 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -542,16 +542,7 @@ static int ecb_paes_do_one_request(struct crypto_engine *engine, void *areq)
 
 	rc = ecb_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
-		/*
-		 * Protected key expired, conversion is in process.
-		 * Trigger a re-schedule of this request by returning
-		 * -ENOSPC ("hardware queue is full") to the crypto engine.
-		 * To avoid immediately re-invocation of this callback,
-		 * tell the scheduler to voluntarily give up the CPU here.
-		 */
-		cond_resched();
-		pr_debug("rescheduling request\n");
-		return -ENOSPC;
+		return pkey_handle_expired();
 	} else if (rc) {
 		skcipher_walk_done(walk, rc);
 	}
@@ -806,16 +797,7 @@ static int cbc_paes_do_one_request(struct crypto_engine *engine, void *areq)
 
 	rc = cbc_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
-		/*
-		 * Protected key expired, conversion is in process.
-		 * Trigger a re-schedule of this request by returning
-		 * -ENOSPC ("hardware queue is full") to the crypto engine.
-		 * To avoid immediately re-invocation of this callback,
-		 * tell the scheduler to voluntarily give up the CPU here.
-		 */
-		cond_resched();
-		pr_debug("rescheduling request\n");
-		return -ENOSPC;
+		return pkey_handle_expired();
 	} else if (rc) {
 		skcipher_walk_done(walk, rc);
 	}
@@ -1113,16 +1095,7 @@ static int ctr_paes_do_one_request(struct crypto_engine *engine, void *areq)
 
 	rc = ctr_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
-		/*
-		 * Protected key expired, conversion is in process.
-		 * Trigger a re-schedule of this request by returning
-		 * -ENOSPC ("hardware queue is full") to the crypto engine.
-		 * To avoid immediately re-invocation of this callback,
-		 * tell the scheduler to voluntarily give up the CPU here.
-		 */
-		cond_resched();
-		pr_debug("rescheduling request\n");
-		return -ENOSPC;
+		return pkey_handle_expired();
 	} else if (rc) {
 		skcipher_walk_done(walk, rc);
 	}
@@ -1553,16 +1526,7 @@ static int xts_paes_do_one_request(struct crypto_engine *engine, void *areq)
 
 	rc = xts_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
-		/*
-		 * Protected key expired, conversion is in process.
-		 * Trigger a re-schedule of this request by returning
-		 * -ENOSPC ("hardware queue is full") to the crypto engine.
-		 * To avoid immediately re-invocation of this callback,
-		 * tell the scheduler to voluntarily give up the CPU here.
-		 */
-		cond_resched();
-		pr_debug("rescheduling request\n");
-		return -ENOSPC;
+		return pkey_handle_expired();
 	} else if (rc) {
 		skcipher_walk_done(walk, rc);
 	}
diff --git a/arch/s390/crypto/phmac_s390.c b/arch/s390/crypto/phmac_s390.c
index ecb1af4b821051..68ef96e0d4449e 100644
--- a/arch/s390/crypto/phmac_s390.c
+++ b/arch/s390/crypto/phmac_s390.c
@@ -893,16 +893,7 @@ static int phmac_do_one_request(struct crypto_engine *engine, void *areq)
 	case OP_FINUP:
 		rc = phmac_kmac_update(req, true);
 		if (rc == -EKEYEXPIRED) {
-			/*
-			 * Protected key expired, conversion is in process.
-			 * Trigger a re-schedule of this request by returning
-			 * -ENOSPC ("hardware queue full") to the crypto engine.
-			 * To avoid immediately re-invocation of this callback,
-			 * tell scheduler to voluntarily give up the CPU here.
-			 */
-			pr_debug("rescheduling request\n");
-			cond_resched();
-			return -ENOSPC;
+			return pkey_handle_expired();
 		} else if (rc) {
 			hwh_advance(hwh, rc);
 			goto out;
@@ -913,18 +904,8 @@ static int phmac_do_one_request(struct crypto_engine *engine, void *areq)
 		fallthrough;
 	case OP_FINAL:
 		rc = phmac_kmac_final(req, true);
-		if (rc == -EKEYEXPIRED) {
-			/*
-			 * Protected key expired, conversion is in process.
-			 * Trigger a re-schedule of this request by returning
-			 * -ENOSPC ("hardware queue full") to the crypto engine.
-			 * To avoid immediately re-invocation of this callback,
-			 * tell scheduler to voluntarily give up the CPU here.
-			 */
-			pr_debug("rescheduling request\n");
-			cond_resched();
-			return -ENOSPC;
-		}
+		if (rc == -EKEYEXPIRED)
+			return pkey_handle_expired();
 		break;
 	default:
 		/* unknown/unsupported/unimplemented asynch op */
diff --git a/arch/s390/include/asm/pkey.h b/arch/s390/include/asm/pkey.h
index b7b59faf16f497..3f47d496496fa7 100644
--- a/arch/s390/include/asm/pkey.h
+++ b/arch/s390/include/asm/pkey.h
@@ -13,6 +13,7 @@
 
 #include <linux/ioctl.h>
 #include <linux/types.h>
+#include <linux/delay.h>
 #include <uapi/asm/pkey.h>
 
 /*
@@ -38,4 +39,19 @@ int pkey_key2protkey(const u8 *key, u32 keylen,
  */
 #define PKEY_XFLAG_NOMEMALLOC 0x0001
 
+static inline int pkey_handle_expired(void)
+{
+	/*
+	 * Protected key expired due to relocation to another host. The long
+	 * running re-wrap has no asynchronous completion notification, so
+	 * polling is required. Trigger a re-schedule of this request by
+	 * returning -ENOSPC ("hardware queue full") to the crypto engine.
+	 * To avoid immediately re-invocation of this callback,
+	 * tell the scheduler to voluntarily give up the CPU here.
+	 */
+	msleep(1);
+	pr_debug("rescheduling request\n");
+	return -ENOSPC;
+}
+
 #endif /* _KAPI_PKEY_H */

From e97fcd8b6598a9cfcc539e87c904b04091ecf4a4 Mon Sep 17 00:00:00 2001
From: Harald Freudenberger <freude@linux.ibm.com>
Date: Mon, 31 Aug 2026 10:38:30 +0200
Subject: [PATCH 0570/1982] s390/crypto: Fix return code handling at
 skcipher_walk_done in PAES algorithms

[ Upstream commit 403648373816ae8eb76fe4a393836b0d65fa8f85 ]

All the 4 PAES cipher processing loops were not checking the return
value of skcipher_walk_done() immediately after calling it. This could
lead to error masking when both the walk operation failed and a
subsequent key conversion was needed (k < n condition).

Add immediate error checks after skcipher_walk_done() in all main
processing loops (ECB, CBC, CTR, XTS modes) to ensure walk errors are
properly propagated and not masked by subsequent operations.

With that comes a slight rework around the skcipher_walk_done()
invocation. It is now necessary to check if the walk has already been
finalized (walk->nbytes is then 0) or not to avoid double
de-allocation of resources held by the walk.

Fixes: 6cd87cb5ef6c ("s390/crypto: Rework protected key AES for true asynch support")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Cc: stable@vger.kernel.org # 6.16+
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/crypto/paes_s390.c | 38 +++++++++++++++++++++++++-----------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index b9cc0c25ba8c37..02bcac750a7228 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -428,8 +428,11 @@ static int ecb_paes_do_crypt(struct s390_paes_ctx *ctx,
 		n = nbytes & ~(AES_BLOCK_SIZE - 1);
 		k = cpacf_km(ctx->fc | req_ctx->modifier, param,
 			     walk->dst.virt.addr, walk->src.virt.addr, n);
-		if (k)
+		if (k) {
 			rc = skcipher_walk_done(walk, nbytes - k);
+			if (rc)
+				goto out;
+		}
 		if (k < n) {
 			if (!maysleep) {
 				rc = -EKEYEXPIRED;
@@ -490,7 +493,7 @@ static int ecb_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS)
+	if (rc != -EINPROGRESS && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
@@ -543,7 +546,7 @@ static int ecb_paes_do_one_request(struct crypto_engine *engine, void *areq)
 	rc = ecb_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
 		return pkey_handle_expired();
-	} else if (rc) {
+	} else if (rc && walk->nbytes) {
 		skcipher_walk_done(walk, rc);
 	}
 
@@ -684,6 +687,8 @@ static int cbc_paes_do_crypt(struct s390_paes_ctx *ctx,
 		if (k) {
 			memcpy(walk->iv, param->iv, AES_BLOCK_SIZE);
 			rc = skcipher_walk_done(walk, nbytes - k);
+			if (rc)
+				goto out;
 		}
 		if (k < n) {
 			if (!maysleep) {
@@ -745,7 +750,7 @@ static int cbc_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS)
+	if (rc != -EINPROGRESS && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
@@ -798,7 +803,7 @@ static int cbc_paes_do_one_request(struct crypto_engine *engine, void *areq)
 	rc = cbc_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
 		return pkey_handle_expired();
-	} else if (rc) {
+	} else if (rc && walk->nbytes) {
 		skcipher_walk_done(walk, rc);
 	}
 
@@ -960,6 +965,11 @@ static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
 				       AES_BLOCK_SIZE);
 			crypto_inc(walk->iv, AES_BLOCK_SIZE);
 			rc = skcipher_walk_done(walk, nbytes - k);
+			if (rc) {
+				if (locked)
+					mutex_unlock(&ctrblk_lock);
+				goto out;
+			}
 		}
 		if (k < n) {
 			if (!maysleep) {
@@ -1053,7 +1063,7 @@ static int ctr_paes_crypt(struct skcipher_request *req)
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS)
+	if (rc != -EINPROGRESS && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
@@ -1096,7 +1106,7 @@ static int ctr_paes_do_one_request(struct crypto_engine *engine, void *areq)
 	rc = ctr_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
 		return pkey_handle_expired();
-	} else if (rc) {
+	} else if (rc && walk->nbytes) {
 		skcipher_walk_done(walk, rc);
 	}
 
@@ -1274,8 +1284,11 @@ static int xts_paes_do_crypt_fullkey(struct s390_pxts_ctx *ctx,
 		n = nbytes & ~(AES_BLOCK_SIZE - 1);
 		k = cpacf_km(ctx->fc | req_ctx->modifier, param->key + offset,
 			     walk->dst.virt.addr, walk->src.virt.addr, n);
-		if (k)
+		if (k) {
 			rc = skcipher_walk_done(walk, nbytes - k);
+			if (rc)
+				goto out;
+		}
 		if (k < n) {
 			if (!maysleep) {
 				rc = -EKEYEXPIRED;
@@ -1367,8 +1380,11 @@ static int xts_paes_do_crypt_2keys(struct s390_pxts_ctx *ctx,
 		n = nbytes & ~(AES_BLOCK_SIZE - 1);
 		k = cpacf_km(ctx->fc | req_ctx->modifier, param->key + offset,
 			     walk->dst.virt.addr, walk->src.virt.addr, n);
-		if (k)
+		if (k) {
 			rc = skcipher_walk_done(walk, nbytes - k);
+			if (rc)
+				goto out;
+		}
 		if (k < n) {
 			if (!maysleep) {
 				rc = -EKEYEXPIRED;
@@ -1474,7 +1490,7 @@ static inline int xts_paes_crypt(struct skcipher_request *req, unsigned long mod
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS)
+	if (rc != -EINPROGRESS && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
@@ -1527,7 +1543,7 @@ static int xts_paes_do_one_request(struct crypto_engine *engine, void *areq)
 	rc = xts_paes_do_crypt(ctx, req_ctx, true);
 	if (rc == -EKEYEXPIRED) {
 		return pkey_handle_expired();
-	} else if (rc) {
+	} else if (rc && walk->nbytes) {
 		skcipher_walk_done(walk, rc);
 	}
 

From 6c3e51e44834bfb0956a0faa7e1107eee7fe216b Mon Sep 17 00:00:00 2001
From: Harald Freudenberger <freude@linux.ibm.com>
Date: Mon, 31 Aug 2026 10:38:32 +0200
Subject: [PATCH 0571/1982] s390/crypto: Fix use of mutex in atomic context in
 PAES

[ Upstream commit 749990db95d45cc3d96aab999ac7f110259b200c ]

The PAES CTR implementation used a mutex to lock one page of exclusive
memory for fast CTR processing. Unfortunately a mutex is not save to
use in atomic or interrupt context. So use a binary semaphore instead
which is save to use in such environments.

Furthermore rework the code to get rid of conditional locking. So
restructure the PAES CRT code by extracting the main loop into a
separate function and just give in information about the (locked) page
can be used or not (is not locked).

Fixes: 6cd87cb5ef6c ("s390/crypto: Rework protected key AES for true asynch support")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Cc: stable@vger.kernel.org # 6.16+
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
[ sashal: Dropped the tested parameter from __ctr_paes_do_crypt(), its callers and the paes_convert_key() calls, since this tree's API lacks it. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/crypto/paes_s390.c | 107 +++++++++++++++++++----------------
 1 file changed, 57 insertions(+), 50 deletions(-)

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index 02bcac750a7228..5198a99ec30ef2 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -20,7 +20,7 @@
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
-#include <linux/mutex.h>
+#include <linux/semaphore.h>
 #include <linux/spinlock.h>
 #include <crypto/aes.h>
 #include <crypto/algapi.h>
@@ -42,7 +42,7 @@
 #define PXTS_256_PROTKEY_SIZE	(32 + 32 + 32)	/* k1 + k2 + verification pattern */
 
 static u8 *ctrblk;
-static DEFINE_MUTEX(ctrblk_lock);
+static DEFINE_SEMAPHORE(ctrblk_sem, 1);
 
 static cpacf_mask_t km_functions, kmc_functions, kmctr_functions;
 
@@ -911,41 +911,14 @@ static inline unsigned int __ctrblk_init(u8 *ctrptr, u8 *iv, unsigned int nbytes
 	return n;
 }
 
-static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
-			     struct s390_pctr_req_ctx *req_ctx,
-			     bool maysleep)
+static int __ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
+			       struct ctr_param *param,
+			       struct skcipher_walk *walk,
+			       bool maysleep, bool locked)
 {
-	struct ctr_param *param = &req_ctx->param;
-	struct skcipher_walk *walk = &req_ctx->walk;
-	u8 buf[AES_BLOCK_SIZE], *ctrptr;
 	unsigned int nbytes, n, k;
-	int pk_state, locked, rc = 0;
-
-	if (!req_ctx->param_init_done) {
-		/* fetch and check protected key state */
-		spin_lock_bh(&ctx->pk_lock);
-		pk_state = ctx->pk_state;
-		switch (pk_state) {
-		case PK_STATE_NO_KEY:
-			rc = -ENOKEY;
-			break;
-		case PK_STATE_CONVERT_IN_PROGRESS:
-			rc = -EKEYEXPIRED;
-			break;
-		case PK_STATE_VALID:
-			memcpy(param->key, ctx->pk.protkey, sizeof(param->key));
-			req_ctx->param_init_done = true;
-			break;
-		default:
-			rc = pk_state < 0 ? pk_state : -EIO;
-			break;
-		}
-		spin_unlock_bh(&ctx->pk_lock);
-	}
-	if (rc)
-		goto out;
-
-	locked = mutex_trylock(&ctrblk_lock);
+	u8 *ctrptr;
+	int rc = 0;
 
 	/*
 	 * Note that in case of partial processing or failure the walk
@@ -965,37 +938,71 @@ static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
 				       AES_BLOCK_SIZE);
 			crypto_inc(walk->iv, AES_BLOCK_SIZE);
 			rc = skcipher_walk_done(walk, nbytes - k);
-			if (rc) {
-				if (locked)
-					mutex_unlock(&ctrblk_lock);
+			if (rc)
 				goto out;
-			}
 		}
 		if (k < n) {
 			if (!maysleep) {
-				if (locked)
-					mutex_unlock(&ctrblk_lock);
 				rc = -EKEYEXPIRED;
 				goto out;
 			}
 			rc = paes_convert_key(ctx);
-			if (rc) {
-				if (locked)
-					mutex_unlock(&ctrblk_lock);
+			if (rc)
 				goto out;
-			}
 			spin_lock_bh(&ctx->pk_lock);
 			memcpy(param->key, ctx->pk.protkey, sizeof(param->key));
 			spin_unlock_bh(&ctx->pk_lock);
 		}
 	}
-	if (locked)
-		mutex_unlock(&ctrblk_lock);
+
+out:
+	return rc;
+}
+
+static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
+			     struct s390_pctr_req_ctx *req_ctx,
+			     bool maysleep)
+{
+	struct ctr_param *param = &req_ctx->param;
+	struct skcipher_walk *walk = &req_ctx->walk;
+	u8 buf[AES_BLOCK_SIZE];
+	int pk_state, rc = 0;
+
+	if (!req_ctx->param_init_done) {
+		/* fetch and check protected key state */
+		spin_lock_bh(&ctx->pk_lock);
+		pk_state = ctx->pk_state;
+		switch (pk_state) {
+		case PK_STATE_NO_KEY:
+			rc = -ENOKEY;
+			break;
+		case PK_STATE_CONVERT_IN_PROGRESS:
+			rc = -EKEYEXPIRED;
+			break;
+		case PK_STATE_VALID:
+			memcpy(param->key, ctx->pk.protkey, sizeof(param->key));
+			req_ctx->param_init_done = true;
+			break;
+		default:
+			rc = pk_state < 0 ? pk_state : -EIO;
+			break;
+		}
+		spin_unlock_bh(&ctx->pk_lock);
+	}
+	if (rc)
+		goto out;
+
+	if (down_trylock(&ctrblk_sem) == 0) {
+		rc = __ctr_paes_do_crypt(ctx, param, walk, maysleep, true);
+		up(&ctrblk_sem);
+	} else {
+		rc = __ctr_paes_do_crypt(ctx, param, walk, maysleep, false);
+	}
 
 	/* final block may be < AES_BLOCK_SIZE, copy only nbytes */
-	if (nbytes) {
+	if (!rc && walk->nbytes > 0) {
 		memset(buf, 0, AES_BLOCK_SIZE);
-		memcpy(buf, walk->src.virt.addr, nbytes);
+		memcpy(buf, walk->src.virt.addr, walk->nbytes);
 		while (1) {
 			if (cpacf_kmctr(ctx->fc, param, buf,
 					buf, AES_BLOCK_SIZE,
@@ -1012,7 +1019,7 @@ static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
 			memcpy(param->key, ctx->pk.protkey, sizeof(param->key));
 			spin_unlock_bh(&ctx->pk_lock);
 		}
-		memcpy(walk->dst.virt.addr, buf, nbytes);
+		memcpy(walk->dst.virt.addr, buf, walk->nbytes);
 		crypto_inc(walk->iv, AES_BLOCK_SIZE);
 		rc = skcipher_walk_done(walk, 0);
 	}

From 4b24a1cbb10775fe67591806c403bd56f582b0ae Mon Sep 17 00:00:00 2001
From: Harald Freudenberger <freude@linux.ibm.com>
Date: Mon, 31 Aug 2026 10:38:34 +0200
Subject: [PATCH 0572/1982] s390/crypto: Fix handling of EBUSY in PAES when req
 is pushed to crypto engine

[ Upstream commit 3fec882c33d9b61983ee31456777f623dccd1a35 ]

When a request is transferred to the engine via
crypto_transfer_skcipher_request_to_engine() there are two return
codes signaling a successful transfer: EINPROGRESS and EBUSY. However
the correct handling of EBUSY was missing and has been added as a
return code indicating a successful transfer to the crypto engine.

Fixes: 6cd87cb5ef6c ("s390/crypto: Rework protected key AES for true asynch support")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Cc: stable@vger.kernel.org # 6.16+
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
[ sashal: Dropped the bool tested = crypto_skcipher_tested(tfm); context line, which this tree lacks, so only bool cleanup = true; is added in the four paes crypt functions. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/crypto/paes_s390.c | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index 5198a99ec30ef2..d5abf606e6f48e 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -458,6 +458,7 @@ static int ecb_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct s390_paes_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct skcipher_walk *walk = &req_ctx->walk;
+	bool cleanup = true;
 	int rc;
 
 	/*
@@ -489,15 +490,17 @@ static int ecb_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 	if (rc == 0 || rc == -EKEYEXPIRED) {
 		atomic_inc(&ctx->via_engine_ctr);
 		rc = crypto_transfer_skcipher_request_to_engine(paes_crypto_engine, req);
-		if (rc != -EINPROGRESS)
+		if (rc == -EINPROGRESS || rc == -EBUSY)
+			cleanup = false;
+		else
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS && walk->nbytes)
+	if (cleanup && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
-	if (rc != -EINPROGRESS)
+	if (cleanup)
 		memzero_explicit(&req_ctx->param, sizeof(req_ctx->param));
 	pr_debug("rc=%d\n", rc);
 	return rc;
@@ -715,6 +718,7 @@ static int cbc_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct s390_paes_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct skcipher_walk *walk = &req_ctx->walk;
+	bool cleanup = true;
 	int rc;
 
 	/*
@@ -746,15 +750,17 @@ static int cbc_paes_crypt(struct skcipher_request *req, unsigned long modifier)
 	if (rc == 0 || rc == -EKEYEXPIRED) {
 		atomic_inc(&ctx->via_engine_ctr);
 		rc = crypto_transfer_skcipher_request_to_engine(paes_crypto_engine, req);
-		if (rc != -EINPROGRESS)
+		if (rc == -EINPROGRESS || rc == -EBUSY)
+			cleanup = false;
+		else
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS && walk->nbytes)
+	if (cleanup && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
-	if (rc != -EINPROGRESS)
+	if (cleanup)
 		memzero_explicit(&req_ctx->param, sizeof(req_ctx->param));
 	pr_debug("rc=%d\n", rc);
 	return rc;
@@ -1036,6 +1042,7 @@ static int ctr_paes_crypt(struct skcipher_request *req)
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct s390_paes_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct skcipher_walk *walk = &req_ctx->walk;
+	bool cleanup = true;
 	int rc;
 
 	/*
@@ -1066,15 +1073,17 @@ static int ctr_paes_crypt(struct skcipher_request *req)
 	if (rc == 0 || rc == -EKEYEXPIRED) {
 		atomic_inc(&ctx->via_engine_ctr);
 		rc = crypto_transfer_skcipher_request_to_engine(paes_crypto_engine, req);
-		if (rc != -EINPROGRESS)
+		if (rc == -EINPROGRESS || rc == -EBUSY)
+			cleanup = false;
+		else
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS && walk->nbytes)
+	if (cleanup && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
-	if (rc != -EINPROGRESS)
+	if (cleanup)
 		memzero_explicit(&req_ctx->param, sizeof(req_ctx->param));
 	pr_debug("rc=%d\n", rc);
 	return rc;
@@ -1462,6 +1471,7 @@ static inline int xts_paes_crypt(struct skcipher_request *req, unsigned long mod
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct s390_pxts_ctx *ctx = crypto_skcipher_ctx(tfm);
 	struct skcipher_walk *walk = &req_ctx->walk;
+	bool cleanup = true;
 	int rc;
 
 	/*
@@ -1493,15 +1503,17 @@ static inline int xts_paes_crypt(struct skcipher_request *req, unsigned long mod
 	if (rc == 0 || rc == -EKEYEXPIRED) {
 		atomic_inc(&ctx->via_engine_ctr);
 		rc = crypto_transfer_skcipher_request_to_engine(paes_crypto_engine, req);
-		if (rc != -EINPROGRESS)
+		if (rc == -EINPROGRESS || rc == -EBUSY)
+			cleanup = false;
+		else
 			atomic_dec(&ctx->via_engine_ctr);
 	}
 
-	if (rc != -EINPROGRESS && walk->nbytes)
+	if (cleanup && walk->nbytes)
 		skcipher_walk_done(walk, rc);
 
 out:
-	if (rc != -EINPROGRESS)
+	if (cleanup)
 		memzero_explicit(&req_ctx->param, sizeof(req_ctx->param));
 	pr_debug("rc=%d\n", rc);
 	return rc;

From 949748d8279493934bd7427809ebe23f3d0d5ea2 Mon Sep 17 00:00:00 2001
From: Gregory CLEMENT <gregory.clement@bootlin.com>
Date: Mon, 27 Oct 2025 17:15:35 +0100
Subject: [PATCH 0573/1982] MIPS: Fix HOTPLUG_PARALLEL dependency

[ Upstream commit c8610c021be3808f0913b8d79822d22e05a5fbcf ]

With MIPS, it is possible to have SMP enabled without HOTPLUG_CPU
selected. However, in kernel/cpu.c, some code that uses
HOTPLUG_PARALLEL also requires HOTPLUG_CPU to be selected. Therefore,
we should fix the HOTPLUG_PARALLEL dependency to depend on
HOTPLUG_CPU, not just SMP.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202510270120.21wA1aX1-lkp@intel.com/
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Stable-dep-of: bbc448c541ed ("mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 83a6b68d8a39ae..d87db7c535ea1d 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -658,7 +658,7 @@ config EYEQ
 	select USB_UHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
 	select USB_UHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
 	select USE_OF
-	select HOTPLUG_PARALLEL if SMP
+	select HOTPLUG_PARALLEL if HOTPLUG_CPU
 	help
 	  Select this to build a kernel supporting EyeQ SoC from Mobileye.
 

From 5802a9fda4cede6af31a3e3b171480c0e446703c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Lebrun?= <theo.lebrun@bootlin.com>
Date: Fri, 28 Aug 2026 16:07:33 +0200
Subject: [PATCH 0574/1982] mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC
 from CONFIG_EYEQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bbc448c541ed90d52f9ec22f17394304e3bf170e ]

On I6500 CPU cores, lld and scd give no ordering guarantees (same as all
other instructions). To respect the assumption that arch_cmpxchg() is
fully ordered, we must inject sync instructions above and below our
lld/scd loops using the already in place WEAK_REORDERING_BEYOND_LLSC
infrastructure.

Otherwise, bad things can happen:

[   34.054496] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000000, epc == a80000080838e01c, ra == a80000080838dfc4
[   34.054559] Oops[#1]:
[   34.069561] CPU: 3 UID: 0 PID: 170 Comm: pipe_race Not tainted 7.2.0-rc6-01553-gb73c35220968-dirty #103 VOLUNTARY
[   34.079932] Hardware name: Mobile EyeQ5 MP5 Evaluation board
[   34.085592] $ 0   : 0000000000000000 0000000000000001 0000000000000000 0000000000000000
[   34.093616] $ 4   : a800000808ee2618 000000000b7a879d 0000000000001000 0000000000000000
[   34.101638] $ 8   : 0000000000e3f2c9 0000000000000000 a800000808a2a9f8 0000000000000000
[   34.109660] $12   : a8000008139ffcd8 ffffffff84080018 a80000080837fae0 7878787878787878
[   34.117682] $16   : a800000807e82940 0000000000001000 0000000000000000 0000000000000000
[   34.125704] $20   : a800000802920e00 a8000008139ffdf8 a800000802649400 0000000000e3f2c9
[   34.133726] $24   : 0000000000000006 00000001200406e0
[   34.141783] $28   : a8000008139fc000 a8000008139ffd10 0000000000e3f2c8 a80000080838dfc4
[   34.149837] epc   : a80000080838e01c anon_pipe_read+0xd4/0x428
[   34.155697] ra    : a80000080838dfc4 anon_pipe_read+0x7c/0x428
[   34.161549] Status: 140000e3  KX SX UX KERNEL EXL IE
[   34.166551] Cause : 40800408 (ExcCode 02)
[   34.170574] BadVA : 0000000000000000
[   34.174161] PrId  : 0001b028 (MIPS I6500)
[   34.178183] Process pipe_race (pid: 170, threadinfo=000000005ca35720, task=00000000e1013890, tls=000000014ebbb780)
[   34.188568] Stack : a800000802649400 0000000000000000 0000000000000000 a8000008139ffdd0
[   34.196623]	 0000000000000fba a800000808ee0000 0000000000000001 a8000008130c3e80
[   34.204676]	 a8000008080d1280 a8000008139ffd58 a8000008139ffd58 1dbd2b22ea1dd500
[   34.212729]	 a800000802649400 a800000808ee0000 ffffffffffffffea 0000000000000001
[   34.220783]	 0000000000001000 0000000000000000 00000001200ae518 ffffffffffffffff
[   34.228836]	 000000fffbe0e530 a80000080837edf4 000000fffbe0e530 0000000000000000
[   34.236890]	 0000000000000000 0000000000000000 000000014ebb55a0 0000000000001000
[   34.244943]	 0000000000000001 a800000802649400 0000000000000000 0000000000000000
[   34.252996]	 0000000000000000 0000400400000000 0000000000000000 1dbd2b22ea1dd500
[   34.261049]	 00000000140000e3 a800000802649400 a800000802649400 a800000808ee0000
[   34.269103]	 ...
[   34.271568] Call Trace:
[   34.274026] [<a80000080838e01c>] anon_pipe_read+0xd4/0x428
[   34.279533] [<a80000080837edf4>] vfs_read+0x25c/0x318
[   34.284607] [<a80000080837faac>] ksys_read+0x104/0x138
[   34.289763] [<a80000080802b9cc>] syscall_common+0x44/0x68
[   34.295187]
[   34.296689] Code: f84000cf  02209825  de020010 <dc420000> d8400004  02002825  0040f809  02802025  f84000c3
[   34.306504]
[   34.308099] ---[ end trace 0000000000000000 ]---

My initial reproducer was the xdp-tools test suite. A standalone
reproducer would be an lld/scd loop that, when the read is reordered by
the CPU, triggers a fault. We can achieve this from userspace by
stressing an anonymous pipe, which uses a mutex. Program used:

	// SPDX-License-Identifier: GPL-2.0
	// pipe_race.c - reproducer for MIPS LL/SC reordering vs fs/pipe.c
	//
	// Two userspace processes on an anonymous pipe:
	//   parent  = writer: tight write() loop
	//   child   = reader: tight read() loop

	#define _GNU_SOURCE
	#include <assert.h>
	#include <errno.h>
	#include <sched.h>
	#include <signal.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <time.h>
	#include <unistd.h>

	int main(void)
	{
		long wrsize = 70;	// bytes per write()
		long rdsize = 4096;	// bytes per read()
		int pfd[2];
		char *buf;
		pid_t pid;
		int ret;

		ret = pipe(pfd);
		assert(!ret);

		pid = fork();
		assert(pid >= 0);

		if (pid == 0) {			/* reader */
			close(pfd[1]);
			buf = malloc(rdsize);
			assert(buf);
			for (;;) {
				ssize_t n = read(pfd[0], buf, rdsize);

				if (n < 0 && errno == EINTR)
					continue;
				if (n <= 0)
					_exit(n < 0 ? 1 : 0);
			}
		}

		close(pfd[0]);			/* writer */
		buf = malloc(wrsize);
		assert(buf);
		memset(buf, 'x', wrsize);

		for (;;) {
			ssize_t n = write(pfd[1], buf, wrsize);

			if (n < 0 && errno == EINTR)
				continue;
			if (n != wrsize)
				break;
		}

		kill(pid, SIGKILL);
		wait(NULL);
		return 0;
	}

Fixes: fbe0fae601b7 ("MIPS: mobileye: Add EyeQ6H support")
Cc: stable@vger.kernel.org
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index d87db7c535ea1d..fadaeafae98e8a 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -659,6 +659,7 @@ config EYEQ
 	select USB_UHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
 	select USE_OF
 	select HOTPLUG_PARALLEL if HOTPLUG_CPU
+	select WEAK_REORDERING_BEYOND_LLSC
 	help
 	  Select this to build a kernel supporting EyeQ SoC from Mobileye.
 

From bd958a567974ae59f6d1ab4392127fa2c3db1696 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 6 Sep 2026 14:39:44 -0300
Subject: [PATCH 0575/1982] smb: client: fix uid/gid override in getattr with
 posix extensions

[ Upstream commit cf4d35896621b7298eef51b7a465e5c0cb22f670 ]

When mounting with 'multiuser,posix' options, cifs_getattr() overrides
the server-provided uid/gid with the current process's fsuid/fsgid.
This is because the condition only checks for unix extensions
(tcon->unix_ext) but not posix extensions (tcon->posix_extensions).

With SMB3 POSIX extensions, the server provides real uid/gid values
just like with unix extensions, so they should be preserved rather
than replaced with the caller's credentials.

Add a tcon->posix_extensions check to the condition so that uid/gid
from the server are properly reported in stat results.

Reported-by: Arthur Lesuisse <arthur.lesuisse@ulb.be>
Closes: https://lore.kernel.org/r/DB9P190MB2012266F6B8DECBE5D26A1798DB52@DB9P190MB2012.EURP190.PROD.OUTLOOK.COM
Suggested-by: Arthur Lesuisse <arthur.lesuisse@ulb.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Kept the inline cifs_sb_flags(cifs_sb) calls instead of the upstream cached sbflags local, since that cleanup is missing here, and applied only the posix_extensions condition and comment change. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/inode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index 995d6df9304f47..88d2732b73a05d 100644
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -2978,13 +2978,13 @@ int cifs_getattr(struct mnt_idmap *idmap, const struct path *path,
 		stat->attributes |= STATX_ATTR_ENCRYPTED;
 
 	/*
-	 * If on a multiuser mount without unix extensions or cifsacl being
-	 * enabled, and the admin hasn't overridden them, set the ownership
-	 * to the fsuid/fsgid of the current process.
+	 * If on a multiuser mount without unix extensions, posix extensions
+	 * or cifsacl being enabled, and the admin hasn't overridden them,
+	 * set the ownership to the fsuid/fsgid of the current process.
 	 */
 	if ((cifs_sb_flags(cifs_sb) & CIFS_MOUNT_MULTIUSER) &&
 	    !(cifs_sb_flags(cifs_sb) & CIFS_MOUNT_CIFS_ACL) &&
-	    !tcon->unix_ext) {
+	    !tcon->unix_ext && !tcon->posix_extensions) {
 		if (!(cifs_sb_flags(cifs_sb) & CIFS_MOUNT_OVERR_UID))
 			stat->uid = current_fsuid();
 		if (!(cifs_sb_flags(cifs_sb) & CIFS_MOUNT_OVERR_GID))

From 2f0a57ff8467fbc58953679fb499b0b64106ead9 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 6 Sep 2026 14:40:23 -0300
Subject: [PATCH 0576/1982] smb: client: fix WSL reparse point uid/gid override

[ Upstream commit cd2b2b57921d4caa7875e83198bb2aa71254328b ]

wsl_to_fattr() unconditionally overwrites cf_uid/cf_gid with values
from WSL extended attributes ($LXUID/$LXGID), ignoring the forceuid
and forcegid mount options.

Fix this by initializing cf_uid/cf_gid to the mount defaults and
gating the $LXUID/$LXGID EA parsing on forceuid/forcegid.

Closes: https://sashiko.dev/#/patchset/20260906190803.667489-1-pc%40manguebit.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Kept the existing fattr->cf_mode &= ~S_IFMT; line and added the new uid/gid default initialisation after it, and the S_DT() comparison context uses get_unaligned_le32(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/reparse.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c
index 2e773a1a671429..124ad21d6dff6d 100644
--- a/fs/smb/client/reparse.c
+++ b/fs/smb/client/reparse.c
@@ -1109,11 +1109,15 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
 			 struct cifs_sb_info *cifs_sb,
 			 u32 tag, struct cifs_fattr *fattr)
 {
+	unsigned int sbflags = cifs_sb_flags(cifs_sb);
 	struct smb2_file_full_ea_info *ea;
 	bool have_xattr_dev = false;
 	u32 next = 0;
 
 	fattr->cf_mode &= ~S_IFMT;
+	fattr->cf_uid = cifs_sb->ctx->linux_uid;
+	fattr->cf_gid = cifs_sb->ctx->linux_gid;
+
 	switch (tag) {
 	case IO_REPARSE_TAG_LX_SYMLINK:
 		fattr->cf_mode |= S_IFLNK;
@@ -1150,11 +1154,13 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
 		nlen = ea->ea_name_length;
 		v = (void *)((u8 *)ea->ea_data + ea->ea_name_length + 1);
 
-		if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen))
-			fattr->cf_uid = wsl_make_kuid(cifs_sb, v);
-		else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen))
-			fattr->cf_gid = wsl_make_kgid(cifs_sb, v);
-		else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) {
+		if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) {
+			if (!(sbflags & CIFS_MOUNT_OVERR_UID))
+				fattr->cf_uid = wsl_make_kuid(cifs_sb, v);
+		} else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) {
+			if (!(sbflags & CIFS_MOUNT_OVERR_GID))
+				fattr->cf_gid = wsl_make_kgid(cifs_sb, v);
+		} else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) {
 			/* File type in reparse point tag and in xattr mode must match. */
 			if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v)))
 				return false;

From ac3f7cc23265318d84be7ce255ce5d15d3f676da Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Tue, 9 Sep 2025 06:09:01 -0700
Subject: [PATCH 0577/1982] hwmon: (asus_rog_ryujin) Rely on subsystem locking

[ Upstream commit b4306c0c8e24f9e031185fb87de45391bc8c7fe9 ]

Attribute access is now serialized in the hardware monitoring core,
so locking in the driver code is no longer necessary. Drop it.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Stable-dep-of: 8042312e73c5 ("hwmon: (asus_rog_ryujin) Validate HID report lengths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/asus_rog_ryujin.c | 48 +++++++--------------------------
 1 file changed, 9 insertions(+), 39 deletions(-)

diff --git a/drivers/hwmon/asus_rog_ryujin.c b/drivers/hwmon/asus_rog_ryujin.c
index e5e93a20723c41..10a1f5aca988d8 100644
--- a/drivers/hwmon/asus_rog_ryujin.c
+++ b/drivers/hwmon/asus_rog_ryujin.c
@@ -81,10 +81,6 @@ static const char *const rog_ryujin_speed_label[] = {
 struct rog_ryujin_data {
 	struct hid_device *hdev;
 	struct device *hwmon_dev;
-	/* For locking access to buffer */
-	struct mutex buffer_lock;
-	/* For queueing multiple readers */
-	struct mutex status_report_request_mutex;
 	/* For reinitializing the completions below */
 	spinlock_t status_report_request_lock;
 	struct completion cooler_status_received;
@@ -153,18 +149,10 @@ static umode_t rog_ryujin_is_visible(const void *data,
 /* Writes the command to the device with the rest of the report filled with zeroes */
 static int rog_ryujin_write_expanded(struct rog_ryujin_data *priv, const u8 *cmd, int cmd_length)
 {
-	int ret;
-
-	mutex_lock(&priv->buffer_lock);
-
 	memcpy_and_pad(priv->buffer, MAX_REPORT_LENGTH, cmd, cmd_length, 0x00);
-	ret = hid_hw_output_report(priv->hdev, priv->buffer, MAX_REPORT_LENGTH);
-
-	mutex_unlock(&priv->buffer_lock);
-	return ret;
+	return hid_hw_output_report(priv->hdev, priv->buffer, MAX_REPORT_LENGTH);
 }
 
-/* Assumes priv->status_report_request_mutex is locked */
 static int rog_ryujin_execute_cmd(struct rog_ryujin_data *priv, const u8 *cmd, int cmd_length,
 				  struct completion *status_completion)
 {
@@ -196,14 +184,11 @@ static int rog_ryujin_execute_cmd(struct rog_ryujin_data *priv, const u8 *cmd, i
 
 static int rog_ryujin_get_status(struct rog_ryujin_data *priv)
 {
-	int ret = mutex_lock_interruptible(&priv->status_report_request_mutex);
-
-	if (ret < 0)
-		return ret;
+	int ret;
 
 	if (!time_after(jiffies, priv->updated + msecs_to_jiffies(STATUS_VALIDITY))) {
 		/* Data is up to date */
-		goto unlock_and_return;
+		return 0;
 	}
 
 	/* Retrieve cooler status */
@@ -211,36 +196,30 @@ static int rog_ryujin_get_status(struct rog_ryujin_data *priv)
 	    rog_ryujin_execute_cmd(priv, get_cooler_status_cmd, GET_CMD_LENGTH,
 				   &priv->cooler_status_received);
 	if (ret < 0)
-		goto unlock_and_return;
+		return ret;
 
 	/* Retrieve controller status (speeds) */
 	ret =
 	    rog_ryujin_execute_cmd(priv, get_controller_speed_cmd, GET_CMD_LENGTH,
 				   &priv->controller_status_received);
 	if (ret < 0)
-		goto unlock_and_return;
+		return ret;
 
 	/* Retrieve cooler duty */
 	ret =
 	    rog_ryujin_execute_cmd(priv, get_cooler_duty_cmd, GET_CMD_LENGTH,
 				   &priv->cooler_duty_received);
 	if (ret < 0)
-		goto unlock_and_return;
+		return ret;
 
 	/* Retrieve controller duty */
 	ret =
 	    rog_ryujin_execute_cmd(priv, get_controller_duty_cmd, GET_CMD_LENGTH,
 				   &priv->controller_duty_received);
-	if (ret < 0)
-		goto unlock_and_return;
-
-	priv->updated = jiffies;
-
-unlock_and_return:
-	mutex_unlock(&priv->status_report_request_mutex);
 	if (ret < 0)
 		return ret;
 
+	priv->updated = jiffies;
 	return 0;
 }
 
@@ -303,14 +282,11 @@ static int rog_ryujin_write_fixed_duty(struct rog_ryujin_data *priv, int channel
 		 * Retrieve cooler duty since both pump and internal fan are set
 		 * together, then write back with one of them modified.
 		 */
-		ret = mutex_lock_interruptible(&priv->status_report_request_mutex);
-		if (ret < 0)
-			return ret;
 		ret =
 		    rog_ryujin_execute_cmd(priv, get_cooler_duty_cmd, GET_CMD_LENGTH,
 					   &priv->cooler_duty_received);
 		if (ret < 0)
-			goto unlock_and_return;
+			return ret;
 
 		memcpy(set_cmd, set_cooler_duty_cmd, SET_CMD_LENGTH);
 
@@ -329,11 +305,7 @@ static int rog_ryujin_write_fixed_duty(struct rog_ryujin_data *priv, int channel
 			set_cmd[RYUJIN_SET_COOLER_FAN_DUTY_OFFSET] = val;
 		}
 
-		ret = rog_ryujin_execute_cmd(priv, set_cmd, SET_CMD_LENGTH, &priv->cooler_duty_set);
-unlock_and_return:
-		mutex_unlock(&priv->status_report_request_mutex);
-		if (ret < 0)
-			return ret;
+		return rog_ryujin_execute_cmd(priv, set_cmd, SET_CMD_LENGTH, &priv->cooler_duty_set);
 	} else {
 		/*
 		 * Controller fan duty (channel == 2). No need to retrieve current
@@ -538,8 +510,6 @@ static int rog_ryujin_probe(struct hid_device *hdev, const struct hid_device_id
 		goto fail_and_close;
 	}
 
-	mutex_init(&priv->status_report_request_mutex);
-	mutex_init(&priv->buffer_lock);
 	spin_lock_init(&priv->status_report_request_lock);
 	init_completion(&priv->cooler_status_received);
 	init_completion(&priv->controller_status_received);

From e32756e2f58abdca83f680de54a81f17d8128804 Mon Sep 17 00:00:00 2001
From: Arie Miller <renari@arimil.com>
Date: Wed, 12 Aug 2026 06:35:30 -0400
Subject: [PATCH 0578/1982] hwmon: (asus_rog_ryujin) Add per-device
 configuration

[ Upstream commit b20ee9aee8779427d2f9de99cbb578b048bf7c04 ]

Move model-specific report offsets and capabilities into a device
information structure. This prepares the driver for coolers which use
a different report layout or do not include the external fan
controller, while preserving the existing Ryujin II 360 behavior.

Handles an issue reported by Sashiko where an id could
be missing driver_data.

Link: https://lore.kernel.org/r/5a817284-a9f4-48b2-9f0f-802c5dc6963c@roeck-us.net
Assisted-by: Codex:gpt-5.6-sol sparse
Signed-off-by: Arie Miller <renari@arimil.com>
Reviewed-by: Aleksa Savic <savicaleksa83@gmail.com>
Link: https://lore.kernel.org/r/20260812103532.395049-2-renari@arimil.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Stable-dep-of: 8042312e73c5 ("hwmon: (asus_rog_ryujin) Validate HID report lengths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/asus_rog_ryujin.c | 75 +++++++++++++++++++++++----------
 1 file changed, 52 insertions(+), 23 deletions(-)

diff --git a/drivers/hwmon/asus_rog_ryujin.c b/drivers/hwmon/asus_rog_ryujin.c
index 10a1f5aca988d8..80563ce38519da 100644
--- a/drivers/hwmon/asus_rog_ryujin.c
+++ b/drivers/hwmon/asus_rog_ryujin.c
@@ -18,15 +18,25 @@
 #define USB_VENDOR_ID_ASUS_ROG		0x0b05
 #define USB_PRODUCT_ID_RYUJIN_AIO	0x1988	/* ASUS ROG RYUJIN II 360 */
 
+struct rog_ryujin_device_info {
+	u8 temp_offset;
+	u8 pump_speed_offset;
+	u8 fan_speed_offset;
+	u8 duty_channel;
+	bool has_controller;
+};
+
+static const struct rog_ryujin_device_info rog_ryujin_ii_360_info = {
+	.temp_offset = 3,
+	.pump_speed_offset = 5,
+	.fan_speed_offset = 7,
+	.duty_channel = 0,
+	.has_controller = true,
+};
+
 #define STATUS_VALIDITY		1500	/* ms */
 #define MAX_REPORT_LENGTH	65
 
-/* Cooler status report offsets */
-#define RYUJIN_TEMP_SENSOR_1		3
-#define RYUJIN_TEMP_SENSOR_2		4
-#define RYUJIN_PUMP_SPEED		5
-#define RYUJIN_INTERNAL_FAN_SPEED	7
-
 /* Cooler duty report offsets */
 #define RYUJIN_PUMP_DUTY		4
 #define RYUJIN_INTERNAL_FAN_DUTY	5
@@ -81,6 +91,7 @@ static const char *const rog_ryujin_speed_label[] = {
 struct rog_ryujin_data {
 	struct hid_device *hdev;
 	struct device *hwmon_dev;
+	const struct rog_ryujin_device_info *info;
 	/* For reinitializing the completions below */
 	spinlock_t status_report_request_lock;
 	struct completion cooler_status_received;
@@ -112,6 +123,8 @@ static int rog_ryujin_pwm_to_percent(long val)
 static umode_t rog_ryujin_is_visible(const void *data,
 				     enum hwmon_sensor_types type, u32 attr, int channel)
 {
+	const struct rog_ryujin_data *priv = data;
+
 	switch (type) {
 	case hwmon_temp:
 		switch (attr) {
@@ -123,6 +136,8 @@ static umode_t rog_ryujin_is_visible(const void *data,
 		}
 		break;
 	case hwmon_fan:
+		if (channel >= 2 && !priv->info->has_controller)
+			return 0;
 		switch (attr) {
 		case hwmon_fan_label:
 		case hwmon_fan_input:
@@ -132,6 +147,8 @@ static umode_t rog_ryujin_is_visible(const void *data,
 		}
 		break;
 	case hwmon_pwm:
+		if (channel >= 2 && !priv->info->has_controller)
+			return 0;
 		switch (attr) {
 		case hwmon_pwm_input:
 			return 0644;
@@ -198,12 +215,14 @@ static int rog_ryujin_get_status(struct rog_ryujin_data *priv)
 	if (ret < 0)
 		return ret;
 
-	/* Retrieve controller status (speeds) */
-	ret =
-	    rog_ryujin_execute_cmd(priv, get_controller_speed_cmd, GET_CMD_LENGTH,
-				   &priv->controller_status_received);
-	if (ret < 0)
-		return ret;
+	if (priv->info->has_controller) {
+		/* Retrieve controller status (speeds) */
+		ret = rog_ryujin_execute_cmd(priv, get_controller_speed_cmd,
+					     GET_CMD_LENGTH,
+					     &priv->controller_status_received);
+		if (ret < 0)
+			return ret;
+	}
 
 	/* Retrieve cooler duty */
 	ret =
@@ -212,12 +231,14 @@ static int rog_ryujin_get_status(struct rog_ryujin_data *priv)
 	if (ret < 0)
 		return ret;
 
-	/* Retrieve controller duty */
-	ret =
-	    rog_ryujin_execute_cmd(priv, get_controller_duty_cmd, GET_CMD_LENGTH,
-				   &priv->controller_duty_received);
-	if (ret < 0)
-		return ret;
+	if (priv->info->has_controller) {
+		/* Retrieve controller duty */
+		ret = rog_ryujin_execute_cmd(priv, get_controller_duty_cmd,
+					     GET_CMD_LENGTH,
+					     &priv->controller_duty_received);
+		if (ret < 0)
+			return ret;
+	}
 
 	priv->updated = jiffies;
 	return 0;
@@ -289,6 +310,7 @@ static int rog_ryujin_write_fixed_duty(struct rog_ryujin_data *priv, int channel
 			return ret;
 
 		memcpy(set_cmd, set_cooler_duty_cmd, SET_CMD_LENGTH);
+		set_cmd[2] = priv->info->duty_channel;
 
 		/* Cooler duties are set as 0-100% */
 		val = rog_ryujin_pwm_to_percent(val);
@@ -394,10 +416,12 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 
 	if (data[1] == RYUJIN_GET_COOLER_STATUS_CMD_RESPONSE) {
 		/* Received coolant temp and speeds of pump and internal fan */
-		priv->temp_input[0] =
-		    data[RYUJIN_TEMP_SENSOR_1] * 1000 + data[RYUJIN_TEMP_SENSOR_2] * 100;
-		priv->speed_input[0] = get_unaligned_le16(data + RYUJIN_PUMP_SPEED);
-		priv->speed_input[1] = get_unaligned_le16(data + RYUJIN_INTERNAL_FAN_SPEED);
+		priv->temp_input[0] = data[priv->info->temp_offset] * 1000 +
+			data[priv->info->temp_offset + 1] * 100;
+		priv->speed_input[0] =
+			get_unaligned_le16(data + priv->info->pump_speed_offset);
+		priv->speed_input[1] =
+			get_unaligned_le16(data + priv->info->fan_speed_offset);
 
 		if (!completion_done(&priv->cooler_status_received))
 			complete_all(&priv->cooler_status_received);
@@ -471,11 +495,15 @@ static int rog_ryujin_probe(struct hid_device *hdev, const struct hid_device_id
 	struct rog_ryujin_data *priv;
 	int ret;
 
+	if (!id->driver_data)
+		return -EINVAL;
+
 	priv = devm_kzalloc(&hdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
 
 	priv->hdev = hdev;
+	priv->info = (const struct rog_ryujin_device_info *)id->driver_data;
 	hid_set_drvdata(hdev, priv);
 
 	/*
@@ -546,7 +574,8 @@ static void rog_ryujin_remove(struct hid_device *hdev)
 }
 
 static const struct hid_device_id rog_ryujin_table[] = {
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS_ROG, USB_PRODUCT_ID_RYUJIN_AIO) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS_ROG, USB_PRODUCT_ID_RYUJIN_AIO),
+	  .driver_data = (kernel_ulong_t)&rog_ryujin_ii_360_info },
 	{ }
 };
 

From 49cc6d5c00a7f75540d1a4324e01be4067ee652c Mon Sep 17 00:00:00 2001
From: Arie Miller <renari@arimil.com>
Date: Thu, 3 Sep 2026 22:21:28 -0400
Subject: [PATCH 0579/1982] hwmon: (asus_rog_ryujin) Validate HID report
 lengths

[ Upstream commit 8042312e73c50de82634ce63eae7cf219464b481 ]

rog_ryujin_raw_event() parses response headers and payload fields without
first checking that they are present in the received report. A short report
can therefore make the driver consume uninitialized bytes from the HID
transport buffer and expose them as sensor values through sysfs.

Validate the response header and the fields used by each response type
before parsing them.

Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol sparse
Signed-off-by: Arie Miller <renari@arimil.com>
Link: https://patch.msgid.link/20260904022129.97896-2-renari@arimil.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/asus_rog_ryujin.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/asus_rog_ryujin.c b/drivers/hwmon/asus_rog_ryujin.c
index 80563ce38519da..593950802b39d5 100644
--- a/drivers/hwmon/asus_rog_ryujin.c
+++ b/drivers/hwmon/asus_rog_ryujin.c
@@ -411,10 +411,15 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 {
 	struct rog_ryujin_data *priv = hid_get_drvdata(hdev);
 
-	if (data[0] != RYUJIN_CMD_PREFIX)
+	if (size < 2 || data[0] != RYUJIN_CMD_PREFIX)
 		return 0;
 
 	if (data[1] == RYUJIN_GET_COOLER_STATUS_CMD_RESPONSE) {
+		if (size <= priv->info->temp_offset + 1 ||
+		    size <= priv->info->pump_speed_offset + 1 ||
+		    size <= priv->info->fan_speed_offset + 1)
+			return 0;
+
 		/* Received coolant temp and speeds of pump and internal fan */
 		priv->temp_input[0] = data[priv->info->temp_offset] * 1000 +
 			data[priv->info->temp_offset + 1] * 100;
@@ -426,6 +431,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 		if (!completion_done(&priv->cooler_status_received))
 			complete_all(&priv->cooler_status_received);
 	} else if (data[1] == RYUJIN_GET_CONTROLLER_SPEED_CMD_RESPONSE) {
+		if (size <= RYUJIN_CONTROLLER_SPEED_3 + 1)
+			return 0;
+
 		/* Received speeds of four fans attached to the controller */
 		priv->speed_input[2] = get_unaligned_le16(data + RYUJIN_CONTROLLER_SPEED_1);
 		priv->speed_input[3] = get_unaligned_le16(data + RYUJIN_CONTROLLER_SPEED_2);
@@ -435,6 +443,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 		if (!completion_done(&priv->controller_status_received))
 			complete_all(&priv->controller_status_received);
 	} else if (data[1] == RYUJIN_GET_COOLER_DUTY_CMD_RESPONSE) {
+		if (size <= RYUJIN_INTERNAL_FAN_DUTY)
+			return 0;
+
 		/* Received report for pump and internal fan duties (in %) */
 		if (data[RYUJIN_PUMP_DUTY] == 0 && data[RYUJIN_INTERNAL_FAN_DUTY] == 0) {
 			/*
@@ -461,6 +472,9 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 		if (!completion_done(&priv->cooler_duty_received))
 			complete_all(&priv->cooler_duty_received);
 	} else if (data[1] == RYUJIN_GET_CONTROLLER_DUTY_CMD_RESPONSE) {
+		if (size <= RYUJIN_CONTROLLER_DUTY)
+			return 0;
+
 		/* Received report for controller duty for fans (in PWM) */
 		if (data[RYUJIN_CONTROLLER_DUTY] == 0) {
 			/*

From d521b90533d080636422eec26d0a37f7eed0637e Mon Sep 17 00:00:00 2001
From: Arie Miller <renari@arimil.com>
Date: Thu, 3 Sep 2026 22:21:29 -0400
Subject: [PATCH 0580/1982] hwmon: (asus_rog_ryujin) Synchronize HID command
 and report handling

[ Upstream commit 06d48355bf41028c1321acda6a4391cd70098be8 ]

rog_ryujin_execute_cmd() holds status_report_request_lock while
reinitializing a completion, intending to exclude raw-event handling.
However, rog_ryujin_raw_event() does not acquire the lock when it updates
the completion. A response can therefore race with reinit_completion() and
be lost, leaving the command to time out.

Hold the lock while parsing reports and updating their completions. Use the
irqsave variants in both paths because raw-event handling may run in
interrupt context.

Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol sparse
Signed-off-by: Arie Miller <renari@arimil.com>
Link: https://patch.msgid.link/20260904022129.97896-3-renari@arimil.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/asus_rog_ryujin.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/hwmon/asus_rog_ryujin.c b/drivers/hwmon/asus_rog_ryujin.c
index 593950802b39d5..f352036f0e52e6 100644
--- a/drivers/hwmon/asus_rog_ryujin.c
+++ b/drivers/hwmon/asus_rog_ryujin.c
@@ -173,6 +173,7 @@ static int rog_ryujin_write_expanded(struct rog_ryujin_data *priv, const u8 *cmd
 static int rog_ryujin_execute_cmd(struct rog_ryujin_data *priv, const u8 *cmd, int cmd_length,
 				  struct completion *status_completion)
 {
+	unsigned long flags;
 	int ret;
 
 	/*
@@ -180,9 +181,9 @@ static int rog_ryujin_execute_cmd(struct rog_ryujin_data *priv, const u8 *cmd, i
 	 * completion. Reinit is done because hidraw could have triggered
 	 * the raw event parsing and marked the passed in completion as done.
 	 */
-	spin_lock_bh(&priv->status_report_request_lock);
+	spin_lock_irqsave(&priv->status_report_request_lock, flags);
 	reinit_completion(status_completion);
-	spin_unlock_bh(&priv->status_report_request_lock);
+	spin_unlock_irqrestore(&priv->status_report_request_lock, flags);
 
 	/* Send command for getting data */
 	ret = rog_ryujin_write_expanded(priv, cmd, cmd_length);
@@ -410,15 +411,18 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 				int size)
 {
 	struct rog_ryujin_data *priv = hid_get_drvdata(hdev);
+	unsigned long flags;
 
 	if (size < 2 || data[0] != RYUJIN_CMD_PREFIX)
 		return 0;
 
+	spin_lock_irqsave(&priv->status_report_request_lock, flags);
+
 	if (data[1] == RYUJIN_GET_COOLER_STATUS_CMD_RESPONSE) {
 		if (size <= priv->info->temp_offset + 1 ||
 		    size <= priv->info->pump_speed_offset + 1 ||
 		    size <= priv->info->fan_speed_offset + 1)
-			return 0;
+			goto unlock;
 
 		/* Received coolant temp and speeds of pump and internal fan */
 		priv->temp_input[0] = data[priv->info->temp_offset] * 1000 +
@@ -432,7 +436,7 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 			complete_all(&priv->cooler_status_received);
 	} else if (data[1] == RYUJIN_GET_CONTROLLER_SPEED_CMD_RESPONSE) {
 		if (size <= RYUJIN_CONTROLLER_SPEED_3 + 1)
-			return 0;
+			goto unlock;
 
 		/* Received speeds of four fans attached to the controller */
 		priv->speed_input[2] = get_unaligned_le16(data + RYUJIN_CONTROLLER_SPEED_1);
@@ -444,7 +448,7 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 			complete_all(&priv->controller_status_received);
 	} else if (data[1] == RYUJIN_GET_COOLER_DUTY_CMD_RESPONSE) {
 		if (size <= RYUJIN_INTERNAL_FAN_DUTY)
-			return 0;
+			goto unlock;
 
 		/* Received report for pump and internal fan duties (in %) */
 		if (data[RYUJIN_PUMP_DUTY] == 0 && data[RYUJIN_INTERNAL_FAN_DUTY] == 0) {
@@ -463,7 +467,7 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 				 * We're expecting a report, so parse it.
 				 */
 				goto read_cooler_duty;
-			return 0;
+			goto unlock;
 		}
 read_cooler_duty:
 		priv->duty_input[0] = rog_ryujin_percent_to_pwm(data[RYUJIN_PUMP_DUTY]);
@@ -473,7 +477,7 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 			complete_all(&priv->cooler_duty_received);
 	} else if (data[1] == RYUJIN_GET_CONTROLLER_DUTY_CMD_RESPONSE) {
 		if (size <= RYUJIN_CONTROLLER_DUTY)
-			return 0;
+			goto unlock;
 
 		/* Received report for controller duty for fans (in PWM) */
 		if (data[RYUJIN_CONTROLLER_DUTY] == 0) {
@@ -492,7 +496,7 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 				 * We're expecting a report, so parse it.
 				 */
 				goto read_controller_duty;
-			return 0;
+			goto unlock;
 		}
 read_controller_duty:
 		priv->duty_input[2] = data[RYUJIN_CONTROLLER_DUTY];
@@ -501,6 +505,8 @@ static int rog_ryujin_raw_event(struct hid_device *hdev, struct hid_report *repo
 			complete_all(&priv->controller_duty_received);
 	}
 
+unlock:
+	spin_unlock_irqrestore(&priv->status_report_request_lock, flags);
 	return 0;
 }
 

From 6ba19e15b3e17f0493ec7f8cd4a1c2bbf4e6ba1e Mon Sep 17 00:00:00 2001
From: Kevin Wang <kevin.wang@amd.com>
Date: Wed, 26 Aug 2026 09:51:55 +0800
Subject: [PATCH 0581/1982] drm/amd/pm: fix gpu metrics energy accumulator for
 smu 13.0.0/13.0.7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 13ddcc7acb9adbed7627e952a61d1d62cd9546fc ]

GPU metrics v1.3 defines energy_accumulator as a 64‑bit field.
The unsupported‑firmware code path assigns UINT_MAX, which is neither the
full‑width invalid value for this field nor its default value.

Fixes: 8de9edb35976 ("drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x")
Signed-off-by: Kevin Wang <kevin.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c2b948c4fe16eb13d98ff5d1371956cb2f55cdc6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 --
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
index f5c20f2320621b..e463a39efab227 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -2169,8 +2169,6 @@ static ssize_t smu_v13_0_0_get_gpu_metrics(struct smu_context *smu,
 	if ((mp1_ver == IP_VERSION(13, 0, 0) && smu->smc_fw_version <= 0x004e1e00) ||
 	    (mp1_ver == IP_VERSION(13, 0, 10) && smu->smc_fw_version <= 0x00500800))
 		gpu_metrics->energy_accumulator = metrics->EnergyAccumulator;
-	else
-		gpu_metrics->energy_accumulator = UINT_MAX;
 
 	if (metrics->AverageGfxActivity <= SMU_13_0_0_BUSY_THRESHOLD)
 		gpu_metrics->average_gfxclk_frequency = metrics->AverageGfxclkFrequencyPostDs;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
index 427f3569f1d392..0af98b5bf0ac2c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -2150,8 +2150,8 @@ static ssize_t smu_v13_0_7_get_gpu_metrics(struct smu_context *smu,
 					       metrics->Vcn1ActivityPercentage);
 
 	gpu_metrics->average_socket_power = metrics->AverageSocketPower;
-	gpu_metrics->energy_accumulator = smu->smc_fw_version <= 0x00521400 ?
-		metrics->EnergyAccumulator : UINT_MAX;
+	if (smu->smc_fw_version <= 0x00521400)
+		gpu_metrics->energy_accumulator = metrics->EnergyAccumulator;
 
 	if (metrics->AverageGfxActivity <= SMU_13_0_7_BUSY_THRESHOLD)
 		gpu_metrics->average_gfxclk_frequency = metrics->AverageGfxclkFrequencyPostDs;

From c70f93046f59cd98d02725e227cf967f93d86413 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Tue, 23 Dec 2025 11:27:42 +0800
Subject: [PATCH 0582/1982] selftests/ublk: fix Makefile to rebuild on header
 changes

[ Upstream commit a2ce133969175d36d708b7c76536b375d0522e53 ]

Add header dependencies to kublk build rule so that changes to
kublk.h, ublk_dep.h, or utils.h trigger a rebuild.

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: c4fa55f85c47 ("selftests: ublk: install test_common.sh and trace/ scripts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ublk/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/ublk/Makefile b/tools/testing/selftests/ublk/Makefile
index 770269efe42ab4..4bf7a686e21d2b 100644
--- a/tools/testing/selftests/ublk/Makefile
+++ b/tools/testing/selftests/ublk/Makefile
@@ -42,10 +42,10 @@ TEST_PROGS += test_stress_05.sh
 
 TEST_GEN_PROGS_EXTENDED = kublk
 
+LOCAL_HDRS += $(wildcard *.h)
 include ../lib.mk
 
-$(TEST_GEN_PROGS_EXTENDED): kublk.c null.c file_backed.c common.c stripe.c \
-	fault_inject.c
+$(TEST_GEN_PROGS_EXTENDED): $(wildcard *.c)
 
 check:
 	shellcheck -x -f gcc *.sh

From 5531d09ec91c7a2db651db1dc34a83643a3e49e7 Mon Sep 17 00:00:00 2001
From: Caleb Sander Mateos <csander@purestorage.com>
Date: Thu, 8 Jan 2026 02:19:41 -0700
Subject: [PATCH 0583/1982] selftests: ublk: add utility to get block device
 metadata size

[ Upstream commit 261b67f4e34716e793b0b95d2722b2fe780ed5f4 ]

Some block device integrity parameters are available in sysfs, but
others are only accessible using the FS_IOC_GETLBMD_CAP ioctl. Add a
metadata_size utility program to print out the logical block metadata
size, PI offset, and PI size within the metadata. Example output:
$ metadata_size /dev/ublkb0
metadata_size: 64
pi_offset: 56
pi_tuple_size: 8

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: c4fa55f85c47 ("selftests: ublk: install test_common.sh and trace/ scripts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ublk/Makefile        |  5 +--
 tools/testing/selftests/ublk/metadata_size.c | 36 ++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/ublk/metadata_size.c

diff --git a/tools/testing/selftests/ublk/Makefile b/tools/testing/selftests/ublk/Makefile
index 4bf7a686e21d2b..97be60993a2133 100644
--- a/tools/testing/selftests/ublk/Makefile
+++ b/tools/testing/selftests/ublk/Makefile
@@ -40,12 +40,13 @@ TEST_PROGS += test_stress_03.sh
 TEST_PROGS += test_stress_04.sh
 TEST_PROGS += test_stress_05.sh
 
-TEST_GEN_PROGS_EXTENDED = kublk
+TEST_GEN_PROGS_EXTENDED = kublk metadata_size
+STANDALONE_UTILS := metadata_size.c
 
 LOCAL_HDRS += $(wildcard *.h)
 include ../lib.mk
 
-$(TEST_GEN_PROGS_EXTENDED): $(wildcard *.c)
+$(OUTPUT)/kublk: $(filter-out $(STANDALONE_UTILS),$(wildcard *.c))
 
 check:
 	shellcheck -x -f gcc *.sh
diff --git a/tools/testing/selftests/ublk/metadata_size.c b/tools/testing/selftests/ublk/metadata_size.c
new file mode 100644
index 00000000000000..76ecddf04d25ee
--- /dev/null
+++ b/tools/testing/selftests/ublk/metadata_size.c
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <stdio.h>
+#include <sys/ioctl.h>
+
+int main(int argc, char **argv)
+{
+	struct logical_block_metadata_cap cap = {};
+	const char *filename;
+	int fd;
+	int result;
+
+	if (argc != 2) {
+		fprintf(stderr, "Usage: %s BLOCK_DEVICE\n", argv[0]);
+		return 1;
+	}
+
+	filename = argv[1];
+	fd = open(filename, O_RDONLY);
+	if (fd < 0) {
+		perror(filename);
+		return 1;
+	}
+
+	result = ioctl(fd, FS_IOC_GETLBMD_CAP, &cap);
+	if (result < 0) {
+		perror("ioctl");
+		return 1;
+	}
+
+	printf("metadata_size: %u\n", cap.lbmd_size);
+	printf("pi_offset: %u\n", cap.lbmd_pi_offset);
+	printf("pi_tuple_size: %u\n", cap.lbmd_pi_size);
+	return 0;
+}

From 59d9b928e7a9f2d3f142cb328a7701ce89f955a8 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Fri, 16 Jan 2026 22:18:55 +0800
Subject: [PATCH 0584/1982] selftests: ublk: increase timeout to 150 seconds

[ Upstream commit 4968fb7cc60676040258c8867f22931c8735126f ]

More tests need to be covered in existing generic tests, and default
45sec isn't enough, and timeout is often triggered, increase timeout
by adding setting file.

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: c4fa55f85c47 ("selftests: ublk: install test_common.sh and trace/ scripts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ublk/Makefile | 2 ++
 tools/testing/selftests/ublk/settings | 1 +
 2 files changed, 3 insertions(+)
 create mode 100644 tools/testing/selftests/ublk/settings

diff --git a/tools/testing/selftests/ublk/Makefile b/tools/testing/selftests/ublk/Makefile
index 97be60993a2133..0062784b1a3080 100644
--- a/tools/testing/selftests/ublk/Makefile
+++ b/tools/testing/selftests/ublk/Makefile
@@ -40,6 +40,8 @@ TEST_PROGS += test_stress_03.sh
 TEST_PROGS += test_stress_04.sh
 TEST_PROGS += test_stress_05.sh
 
+TEST_FILES := settings
+
 TEST_GEN_PROGS_EXTENDED = kublk metadata_size
 STANDALONE_UTILS := metadata_size.c
 
diff --git a/tools/testing/selftests/ublk/settings b/tools/testing/selftests/ublk/settings
new file mode 100644
index 00000000000000..682a40f1c8e6f9
--- /dev/null
+++ b/tools/testing/selftests/ublk/settings
@@ -0,0 +1 @@
+timeout=150

From b057eb6ab8005c415fb9d92811f8a1fc07d4363f Mon Sep 17 00:00:00 2001
From: Mahmoud Nagy Adam <mngyadam@amazon.de>
Date: Wed, 9 Sep 2026 15:26:03 +0200
Subject: [PATCH 0585/1982] selftests: ublk: install test_common.sh and trace/
 scripts

[ Upstream commit c4fa55f85c47cd5d54d717fb8170746edb10292e ]

Every ublk test script sources test_common.sh from its own directory:

    . "$(cd "$(dirname "$0")" && pwd)"/test_common.sh

and test_generic_02/12 additionally run bpftrace against the scripts in
trace/. Neither test_common.sh nor trace/ is listed in TEST_FILES, so
"make install" does not copy them into the install directory and every
ublk test fails when run from there:

  ./test_generic_02.sh: line 4: .../kselftest_install/ublk/test_common.sh: No such file or directory
  ./test_generic_02.sh: line 8: _have_program: command not found

The bpftrace tests are affected even when bpftrace is installed: the
missing trace/*.bt makes bpftrace exit immediately, and the tests then
report a skip rather than a failure, which hides the problem.

Add both to TEST_FILES, matching how other selftests ship their sourced
helpers (see kexec/kexec_common_lib.sh and zram/zram_lib.sh).

Fixes: 6aecda00b7d1e1 ("selftests: ublk: add kernel selftests for ublk")
Fixes: 723977cab4c0fd ("selftests: ublk: add generic_01 for verifying sequential IO order")
Cc: stable@vger.kernel.org # v6.15+
Assisted-by: Kiro:claude-opus-5
Signed-off-by: Mahmoud Nagy Adam <mngyadam@amazon.de>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20260909132602.68852-2-mngyadam@amazon.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ublk/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/ublk/Makefile b/tools/testing/selftests/ublk/Makefile
index 0062784b1a3080..d441483eb1e783 100644
--- a/tools/testing/selftests/ublk/Makefile
+++ b/tools/testing/selftests/ublk/Makefile
@@ -41,6 +41,8 @@ TEST_PROGS += test_stress_04.sh
 TEST_PROGS += test_stress_05.sh
 
 TEST_FILES := settings
+TEST_FILES += test_common.sh
+TEST_FILES += trace
 
 TEST_GEN_PROGS_EXTENDED = kublk metadata_size
 STANDALONE_UTILS := metadata_size.c

From 19b0188d02630f71ec0605f1ed0e141ee1fac2cb Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 13 Sep 2026 21:15:41 -0300
Subject: [PATCH 0586/1982] smb: client: fix fattr leaking on wsl_to_fattr()
 failure

[ Upstream commit e1253a82bb4c0fed6706a5839fc8b6e01be1abe2 ]

wsl_to_fattr() mutates fattr fields as it parses each WSL EA.  If
validation later fails, the function returns false with partially
mutated fattr fields that callers do not reset.

Fix this by parsing into local variables and only committing them to
fattr on success.

Closes: https://sashiko.dev/#/patchset/20260906200517.725015-1-pc%40manguebit.org
Fixes: 78e26bec4d6d ("smb: client: parse uid, gid, mode and dev from WSL reparse points")
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: stable@vger.kernel.org
[ sashal: Reordered context in the first hunk: the three setup assignments appear in a different order, so I removed them and added the local mode initialization. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/reparse.c | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c
index 124ad21d6dff6d..47c8413d9ed9d2 100644
--- a/fs/smb/client/reparse.c
+++ b/fs/smb/client/reparse.c
@@ -1110,29 +1110,30 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
 			 u32 tag, struct cifs_fattr *fattr)
 {
 	unsigned int sbflags = cifs_sb_flags(cifs_sb);
+	kuid_t uid = cifs_sb->ctx->linux_uid;
+	kgid_t gid = cifs_sb->ctx->linux_gid;
 	struct smb2_file_full_ea_info *ea;
 	bool have_xattr_dev = false;
+	dev_t rdev = 0;
+	umode_t mode;
 	u32 next = 0;
 
-	fattr->cf_mode &= ~S_IFMT;
-	fattr->cf_uid = cifs_sb->ctx->linux_uid;
-	fattr->cf_gid = cifs_sb->ctx->linux_gid;
-
+	mode = fattr->cf_mode & ~S_IFMT;
 	switch (tag) {
 	case IO_REPARSE_TAG_LX_SYMLINK:
-		fattr->cf_mode |= S_IFLNK;
+		mode |= S_IFLNK;
 		break;
 	case IO_REPARSE_TAG_LX_FIFO:
-		fattr->cf_mode |= S_IFIFO;
+		mode |= S_IFIFO;
 		break;
 	case IO_REPARSE_TAG_AF_UNIX:
-		fattr->cf_mode |= S_IFSOCK;
+		mode |= S_IFSOCK;
 		break;
 	case IO_REPARSE_TAG_LX_CHR:
-		fattr->cf_mode |= S_IFCHR;
+		mode |= S_IFCHR;
 		break;
 	case IO_REPARSE_TAG_LX_BLK:
-		fattr->cf_mode |= S_IFBLK;
+		mode |= S_IFBLK;
 		break;
 	}
 
@@ -1156,26 +1157,29 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data,
 
 		if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) {
 			if (!(sbflags & CIFS_MOUNT_OVERR_UID))
-				fattr->cf_uid = wsl_make_kuid(cifs_sb, v);
+				uid = wsl_make_kuid(cifs_sb, v);
 		} else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) {
 			if (!(sbflags & CIFS_MOUNT_OVERR_GID))
-				fattr->cf_gid = wsl_make_kgid(cifs_sb, v);
+				gid = wsl_make_kgid(cifs_sb, v);
 		} else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) {
 			/* File type in reparse point tag and in xattr mode must match. */
-			if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v)))
+			if (S_DT(mode) != S_DT(get_unaligned_le32(v)))
 				return false;
-			fattr->cf_mode = (umode_t)get_unaligned_le32(v);
+			mode = get_unaligned_le32(v);
 		} else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) {
-			fattr->cf_rdev = reparse_mkdev(v);
+			rdev = reparse_mkdev(v);
 			have_xattr_dev = true;
 		}
 	} while (next);
 out:
-
 	/* Major and minor numbers for char and block devices are mandatory. */
 	if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK))
 		return false;
 
+	fattr->cf_uid = uid;
+	fattr->cf_gid = gid;
+	fattr->cf_mode = mode;
+	fattr->cf_rdev = rdev;
 	return true;
 }
 

From 969825a50f58b64833edb8fda07b042a2360dc9c Mon Sep 17 00:00:00 2001
From: Xie Bo <xb@ultrarisc.com>
Date: Mon, 10 Aug 2026 13:15:43 +0800
Subject: [PATCH 0587/1982] RISC-V: KVM: Release unused page after MMU
 invalidation

[ Upstream commit ed54fdb460a6e81d5f8f38388d1f10b385dd4a58 ]

If an MMU invalidation races with a G-stage fault, the fault handler skips
installing the page but leaves ret set to zero. As a result,
kvm_release_faultin_page() treats the page as used and can unnecessarily
mark it dirty.

Track the invalidation retry separately and release the page as unused,
while preserving the existing return value so that the vCPU retries the
fault.

Fixes: 2ed90cb0938a ("KVM: RISC-V: Retry fault if vma_lookup() results become invalid")
Cc: stable@vger.kernel.org
Signed-off-by: Xie Bo <xb@ultrarisc.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260810051544.3953925-2-xb@ultrarisc.com
Signed-off-by: Anup Patel <anup@brainfault.org>
[ sashal: Dropped the is_hugetlb context line and used spin_lock/spin_unlock on mmu_lock instead of write_lock/write_unlock, so the unused flag hunks apply to this tree's older kvm_riscv_mmu_map(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kvm/mmu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
index b5a809a091d604..bdc8243e9c947a 100644
--- a/arch/riscv/kvm/mmu.c
+++ b/arch/riscv/kvm/mmu.c
@@ -308,6 +308,7 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
 {
 	int ret;
 	kvm_pfn_t hfn;
+	bool unused = false;
 	bool writable;
 	short vma_pageshift;
 	gfn_t gfn = gpa >> PAGE_SHIFT;
@@ -394,8 +395,10 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
 
 	spin_lock(&kvm->mmu_lock);
 
-	if (mmu_invalidate_retry(kvm, mmu_seq))
+	if (mmu_invalidate_retry(kvm, mmu_seq)) {
+		unused = true;
 		goto out_unlock;
+	}
 
 	if (writable) {
 		mark_page_dirty_in_slot(kvm, memslot, gfn);
@@ -410,7 +413,8 @@ int kvm_riscv_mmu_map(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot,
 		kvm_err("Failed to map in G-stage\n");
 
 out_unlock:
-	kvm_release_faultin_page(kvm, page, ret && ret != -EEXIST, writable);
+	kvm_release_faultin_page(kvm, page,
+				 unused || (ret && ret != -EEXIST), writable);
 	spin_unlock(&kvm->mmu_lock);
 	return ret;
 }

From 9044683dfdc40ec7c6457137199704426eb21e98 Mon Sep 17 00:00:00 2001
From: Zongmin Zhou <zhouzongmin@kylinos.cn>
Date: Wed, 26 Aug 2026 14:41:17 +0800
Subject: [PATCH 0588/1982] RISC-V: KVM: Fix sdata leak and stale snapshot_addr
 in snapshot_set_shmem

[ Upstream commit b7749531a9b195f4fd7db92ca3cc49bda1a4dc8d ]

A guest may call SBI_PMU_SNAPSHOT_SET_SHMEM repeatedly. Each call
overwrites kvpmu->sdata without freeing the old buffer (memory leak),
and if a later kvm_vcpu_write_guest() fails, the error path frees
sdata but leaves snapshot_addr stale. A subsequent
SBI_PMU_COUNTER_START then passes the INVALID_GPA check and crashes
the host with a NULL buffer in kvm_vcpu_read_guest().

Fix this by clearing the previously installed snapshot area before
installing a new one, which keeps sdata and snapshot_addr consistent.
The SBI spec suggests a single invocation but defines no error code
for repeated calls, so KVM must tolerate them.

Fixes: c2f41ddbcdd756 ("RISC-V: KVM: Implement SBI PMU Snapshot feature")
Cc: stable@vger.kernel.org
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260826064117.58029-1-min_halo@163.com
Signed-off-by: Anup Patel <anup@brainfault.org>
[ sashal: Kept the existing GFP_ATOMIC in the kzalloc context line, since __GFP_ACCOUNT isn't present here, and added the snapshot-area clear block unchanged. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kvm/vcpu_pmu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index be0c7ecc38e794..d5a0a3a33f6b2e 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -437,6 +437,14 @@ int kvm_riscv_vcpu_pmu_snapshot_set_shmem(struct kvm_vcpu *vcpu, unsigned long s
 		goto out;
 	}
 
+	/*
+	 * Clear any previously installed snapshot area to avoid leaking
+	 * the old sdata and to keep sdata/snapshot_addr consistent if
+	 * the re-install fails below.
+	 */
+	if (kvpmu->snapshot_addr != INVALID_GPA)
+		kvm_pmu_clear_snapshot_area(vcpu);
+
 	kvpmu->sdata = kzalloc(snapshot_area_size, GFP_ATOMIC);
 	if (!kvpmu->sdata) {
 		sbiret = SBI_ERR_FAILURE;

From 2548c31f3a194e9d6b69c2b050daf7bbac7ce02f Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 14 Sep 2026 22:37:36 -0700
Subject: [PATCH 0589/1982] xfs: don't cross reference rmapbt with bitmaps if
 they're incomplete

[ Upstream commit d7b92cbe566f6fe54368f62e4b515d9f80c43a18 ]

LOLLM points out that runtime errors (e.g. ENOMEM) when we're trying to
compute space usag bitmaps are silently dropped by the rmapbt scrubber.
We ought to flag that as an incomplete scrub instead of reporting
cross-referencing errors based on faulty data.

Cc: stable@vger.kernel.org # v6.4
Fixes: fed050f3452da0 ("xfs: cross-reference rmap records with ag btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/scrub/rmap.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/fs/xfs/scrub/rmap.c b/fs/xfs/scrub/rmap.c
index 39e9ad7cd8aea5..bd792b304af68b 100644
--- a/fs/xfs/scrub/rmap.c
+++ b/fs/xfs/scrub/rmap.c
@@ -493,11 +493,18 @@ xchk_rmapbt_walk_ag_metadata(
 	 * If there's an error, set XFAIL and disable the bitmap
 	 * cross-referencing checks, but proceed with the scrub anyway.
 	 */
-	if (error)
-		xchk_btree_xref_process_error(sc, sc->sa.rmap_cur,
-				sc->sa.rmap_cur->bc_nlevels - 1, &error);
-	else
-		cr->bitmaps_complete = true;
+	if (error) {
+		if (!xchk_btree_xref_process_error(sc, sc->sa.rmap_cur,
+				sc->sa.rmap_cur->bc_nlevels - 1, &error)) {
+			/* only set incomplete if we didn't set xfail */
+			if (error)
+				xchk_set_incomplete(sc);
+		}
+
+		return 0;
+	}
+
+	cr->bitmaps_complete = true;
 	return 0;
 }
 
@@ -567,7 +574,8 @@ xchk_rmapbt(
 	if (error)
 		goto out;
 
-	xchk_rmapbt_check_bitmaps(sc, cr);
+	if (cr->bitmaps_complete)
+		xchk_rmapbt_check_bitmaps(sc, cr);
 
 out:
 	xagb_bitmap_destroy(&cr->refcbt_owned);

From 2f16636913db49afa65d36324cc8187c76e0b567 Mon Sep 17 00:00:00 2001
From: Xiaogang Chen <xiaogang.chen@amd.com>
Date: Tue, 16 Jun 2026 17:18:59 -0500
Subject: [PATCH 0590/1982] drm/amdkfd: Guard m->cp_hqd_eop_control setting by
 q->eop_ring_buffer_size

[ Upstream commit 8cd2ea7bab77b7aa087b1a6cc26d2df03c2a6ed9 ]

To avoid wraparound if the value is 0.

Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c0cae35661868af207077a4306bc42c7c972947c)
Cc: stable@vger.kernel.org
Stable-dep-of: c883d0a132d4 ("drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 4 ++--
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 4 ++--
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 4 ++--
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
index 1695dd78ede8e6..d8faaa573e017e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
@@ -198,8 +198,8 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * more than (EOP entry count - 1) so a queue size of 0x800 dwords
 	 * is safe, giving a maximum field value of 0xA.
 	 */
-	m->cp_hqd_eop_control = min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1);
+	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
index bb439f385fc382..fd91e5cfbdbf4e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
@@ -251,8 +251,8 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * more than (EOP entry count - 1) so a queue size of 0x800 dwords
 	 * is safe, giving a maximum field value of 0xA.
 	 */
-	m->cp_hqd_eop_control = min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1);
+	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
index 565858b9044d46..df03938eb11f85 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
@@ -214,8 +214,8 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * more than (EOP entry count - 1) so a queue size of 0x800 dwords
 	 * is safe, giving a maximum field value of 0xA.
 	 */
-	m->cp_hqd_eop_control = min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1);
+	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
index c1fafc50251589..c55a858d523ab7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
@@ -209,8 +209,8 @@ static void __update_mqd(struct mqd_manager *mm, void *mqd,
 	 * more than (EOP entry count - 1) so a queue size of 0x800 dwords
 	 * is safe, giving a maximum field value of 0xA.
 	 */
-	m->cp_hqd_eop_control |= min(0xA,
-		order_base_2(q->eop_ring_buffer_size / 4) - 1);
+	m->cp_hqd_eop_control |= q->eop_ring_buffer_size ? min(0xA,
+		order_base_2(q->eop_ring_buffer_size / 4) - 1) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =

From 9e8f43579f849fba0dd1059160f50bd44a767366 Mon Sep 17 00:00:00 2001
From: David Francis <David.Francis@amd.com>
Date: Wed, 5 Aug 2026 09:51:35 -0400
Subject: [PATCH 0591/1982] drm/amdkfd: Avoid integer underflow with ffs in EOP
 ring size calc

[ Upstream commit c883d0a132d430ef7ebb23fd94323be94d0fbdb8 ]

The low 6 bits of cp_hqd_eop_control store the base-2 logarithm
of the EOP ring size. This was calculated as

ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1

But ffs can in theory return 1 or 0, so this could underflow
(although in practice the ring buffer size cannot be less than 4096).

Change this to

ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)

using properties of logarithms.

Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: David Francis <David.Francis@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)
Cc: stable@vger.kernel.org
[ sashal: Dropped the hunk for the GFX 12.1 MQD manager file since it doesn't exist in this tree, so only the v10, v11 and v12 changes are applied. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
index d8faaa573e017e..4a621791da230f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
@@ -199,7 +199,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * is safe, giving a maximum field value of 0xA.
 	 */
 	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
index fd91e5cfbdbf4e..ca90454b01acc1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
@@ -252,7 +252,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * is safe, giving a maximum field value of 0xA.
 	 */
 	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
index df03938eb11f85..1f6825a91db861 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
@@ -215,7 +215,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 * is safe, giving a maximum field value of 0xA.
 	 */
 	m->cp_hqd_eop_control = q->eop_ring_buffer_size ? min(0xA,
-		ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1) : 0;
+		ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =

From 3c97f7cb6c48826663648b6081b614c2befc8ac7 Mon Sep 17 00:00:00 2001
From: David Francis <David.Francis@amd.com>
Date: Wed, 5 Aug 2026 09:16:51 -0400
Subject: [PATCH 0592/1982] drm/amdkfd: Avoid integer underflow in EOP ring
 size calculation.

[ Upstream commit 8ee521b8b189799e361d4233c5180ba56656d4d4 ]

The low 6 bits of cp_hqd_eop_control store the base-2 logarithm
of the EOP ring size. This was calculated as

order_base_2(q->eop_ring_buffer_size / 4) - 1

But order_base_2 can in theory return 0, so this could underflow
(although in practice the ring buffer size cannot be less than 4096).

Change this to

order_base_2(q->eop_ring_buffer_size / 8)

using properties of logarithms.

Also add to the above comment to make the mathematics more clear.

Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: David Francis <David.Francis@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 6 +++++-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index e3a33a92b1799c..f0e7a7244a33f5 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -271,6 +271,10 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 		1 << CP_HQD_IB_CONTROL__IB_EXE_DISABLE__SHIFT;
 
 	/*
+	 * The lowest 6 bits of eop_control store the EOP ring size. If
+	 * their value is X, the ring size is 2^(X + 1) dwords, or
+	 * 2^(X + 3) bytes.
+	 *
 	 * HW does not clamp this field correctly. Maximum EOP queue size
 	 * is constrained by per-SE EOP done signal count, which is 8-bit.
 	 * Limit is 0xFF EOP entries (= 0x7F8 dwords). CP will not submit
@@ -282,7 +286,7 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
 	 *
 	 */
 	m->cp_hqd_eop_control = q->eop_ring_buffer_size ?
-		min(0xA, order_base_2(q->eop_ring_buffer_size / 4) - 1) : 0;
+		min(0xA, order_base_2(q->eop_ring_buffer_size / 8)) : 0;
 
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
index c55a858d523ab7..f0de0893bc5979 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
@@ -203,6 +203,9 @@ static void __update_mqd(struct mqd_manager *mm, void *mqd,
 			mtype << CP_HQD_IB_CONTROL__MTYPE__SHIFT;
 
 	/*
+	 * The lowest 6 bits of eop_control store the EOP ring size. If
+	 * their value is X, the ring size is 2^(X + 1) dwords, or
+	 * 2^(X + 3) bytes.
 	 * HW does not clamp this field correctly. Maximum EOP queue size
 	 * is constrained by per-SE EOP done signal count, which is 8-bit.
 	 * Limit is 0xFF EOP entries (= 0x7F8 dwords). CP will not submit
@@ -210,7 +213,7 @@ static void __update_mqd(struct mqd_manager *mm, void *mqd,
 	 * is safe, giving a maximum field value of 0xA.
 	 */
 	m->cp_hqd_eop_control |= q->eop_ring_buffer_size ? min(0xA,
-		order_base_2(q->eop_ring_buffer_size / 4) - 1) : 0;
+		order_base_2(q->eop_ring_buffer_size / 8)) : 0;
 	m->cp_hqd_eop_base_addr_lo =
 			lower_32_bits(q->eop_ring_buffer_address >> 8);
 	m->cp_hqd_eop_base_addr_hi =

From 59d30bdc3dd6fd3a8990f59bc7a137b1cbb3ed4e Mon Sep 17 00:00:00 2001
From: Adarsh Das <adarshdas950@gmail.com>
Date: Sat, 19 Sep 2026 16:27:32 +0530
Subject: [PATCH 0593/1982] smb: client: delete compound mids on send failure
 before unlock

[ Upstream commit 8f6f8a48399f82f4a83f7b9f25b9707e0062a4f9 ]

When sending a compound request fails, smb_send_rqst() kicks off a
reconnect. compound_send_recv() still has those mids on pending_mid_q,
but it unlocks the server without removing them first.

During reconnect, cifs_abort_connection() walks pending_mid_q and runs
each mid callback. With no response yet, those callbacks return credits
and drop in_flight. Then compound_send_recv()'s send-error path returns
the same credits again. in_flight ends up decremented twice and
smb2_add_credits() WARNs.

syzbot hits this during SMB2_negotiate when the socket send fails.

cifs_call_async() already calls delete_mid() before unlock on send
failure. Do the same for compound chains and set cancelled_mid[] so the
out: path does not delete them again.

Fixes: ee258d79159a ("CIFS: Move credit processing to mid callbacks for SMB3")
Reported-by: syzbot+eeb58d2197d88720a228@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/6a727d22.40259c87.584f4.04ce.GAE@google.com
Tested-by: syzbot+eeb58d2197d88720a228@syzkaller.appspotmail.com
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/transport.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
index 342664eae295ab..446edaf94cf4f3 100644
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@ -976,6 +976,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
 	if (rc < 0) {
 		revert_current_mid(server, num_rqst);
 		server->sequence_number -= 2;
+		for (i = 0; i < num_rqst; i++) {
+			delete_mid(mid[i]);
+			cancelled_mid[i] = true;
+		}
 	}
 
 	cifs_server_unlock(server);

From 908bc440a285d4db2b17b58267b7de21fd48d153 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Mon, 21 Sep 2026 14:16:08 -0700
Subject: [PATCH 0594/1982] KVM: x86: Fill kvm_run exit fields in common
 get_nested_state_pages() error paths

[ Upstream commit c1214f293d77c6e425a379f90d09bdb4815993a8 ]

Fill kvm_run with "internal error, emulation" in the common error handling
paths for getting nested state pages, as requiring each check to manually
fill kvm_run is error prone and requires a non-trivial amount of copy+paste.

Specifically, both SVM and VMX fail to fill kvm_run if load_pdptrs() fails,
and SVM fails to fill kvm_run if kvm_hv_verify_vp_assist() fails.  If those
flows fail, the *best* case scenario is that KVM will exit to userspace
with KVM_EXIT_UNKNOWN.  The worst case scenario is that KVM exits with a
stale exit_reason and confuses userspace.

Note, SVM never exits to userspace if something goes sideways when dealing
with vmcb12 assets while emulating VMRUN, i.e. lack of SVM-specific code is
not a bug.

Fixes: 0f85722341b0 ("KVM: nVMX: delay loading of PDPTRs to KVM_REQ_GET_NESTED_STATE_PAGES")
Fixes: 232f75d3b4b5 ("KVM: nSVM: call nested_svm_load_cr3 on nested state load")
Fixes: 3f4a812edf5c ("KVM: nSVM: hyper-v: Enable L2 TLB flush")
Cc: stable@vger.kernel.org
Reported-by: Jinwoo Lee <rkskek9254@gmail.com>
Closes: https://lore.kernel.org/all/20260813043932.3214460-1-rkskek9254@gmail.com
Reported-by: Stefan Teodorescu <fane@google.com>
Link: https://patch.msgid.link/20260921211608.1030158-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
[ sashal: Kept this tree's vmx->nested.nested_run_pending in the vmentry_failed: context line, since the field has not yet moved to vcpu->arch. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/svm/nested.c |  7 +------
 arch/x86/kvm/vmx/nested.c | 15 +++++----------
 arch/x86/kvm/x86.c        |  3 +++
 3 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 892b6fd48a0d7d..ec984fa88dbcea 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1949,13 +1949,8 @@ static bool svm_get_nested_state_pages(struct kvm_vcpu *vcpu)
 		if (CC(!load_pdptrs(vcpu, vcpu->arch.cr3)))
 			return false;
 
-	if (!nested_svm_merge_msrpm(vcpu)) {
-		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
-		vcpu->run->internal.suberror =
-			KVM_INTERNAL_ERROR_EMULATION;
-		vcpu->run->internal.ndata = 0;
+	if (!nested_svm_merge_msrpm(vcpu))
 		return false;
-	}
 
 	if (kvm_hv_verify_vp_assist(vcpu))
 		return false;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index be2ab71cd9eabd..6dd21c2938d99c 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3499,10 +3499,6 @@ static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
 		} else {
 			pr_debug_ratelimited("%s: no backing for APIC-access address in vmcs12\n",
 					     __func__);
-			vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
-			vcpu->run->internal.suberror =
-				KVM_INTERNAL_ERROR_EMULATION;
-			vcpu->run->internal.ndata = 0;
 			return false;
 		}
 	}
@@ -3573,11 +3569,6 @@ static bool vmx_get_nested_state_pages(struct kvm_vcpu *vcpu)
 	if (!nested_get_evmcs_page(vcpu)) {
 		pr_debug_ratelimited("%s: enlightened vmptrld failed\n",
 				     __func__);
-		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
-		vcpu->run->internal.suberror =
-			KVM_INTERNAL_ERROR_EMULATION;
-		vcpu->run->internal.ndata = 0;
-
 		return false;
 	}
 #endif
@@ -3965,8 +3956,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
 
 vmentry_failed:
 	vmx->nested.nested_run_pending = 0;
-	if (status == NVMX_VMENTRY_KVM_INTERNAL_ERROR)
+	if (status == NVMX_VMENTRY_KVM_INTERNAL_ERROR) {
+		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+		vcpu->run->internal.ndata = 0;
 		return 0;
+	}
 	if (status == NVMX_VMENTRY_VMEXIT)
 		return 1;
 	WARN_ON_ONCE(status != NVMX_VMENTRY_VMFAIL);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9493af5fa8275e..64e24e75a17c51 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10715,6 +10715,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 
 		if (kvm_check_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu)) {
 			if (unlikely(!kvm_nested_call(get_nested_state_pages)(vcpu))) {
+				vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+				vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+				vcpu->run->internal.ndata = 0;
 				kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
 				r = 0;
 				goto out;

From d4f2168ee9104d7c98154104c52e681e4c1787db Mon Sep 17 00:00:00 2001
From: Ilya Maximets <i.maximets@ovn.org>
Date: Mon, 21 Sep 2026 16:55:47 +0200
Subject: [PATCH 0595/1982] net/sched: act_ct: remove 'add_helper' dead code

[ Upstream commit 00df72e39f306e2f7adb68528a5c92109da6a0a9 ]

This variable can only become 'true' when the connection is not
confirmed, but it is only checked when it is confirmed.  So, it can be
treated as being always false and just removed.

Fixes: a21b06e73191 ("net: sched: add helper support in act_ct")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260921145655.3167436-6-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ sashal: Adapted the condition change to the branch's reordered helper block, since the context lines no longer matched, while keeping the branch's existing ordering and comment. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/act_ct.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 161c62dafaa147..9309dca79bf45f 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -984,7 +984,6 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
 	struct nf_hook_state state;
 	int nh_ofs, err, retval;
 	struct tcf_ct_params *p;
-	bool add_helper = false;
 	bool skb_is_ours = false;
 	bool skip_add = false;
 	bool defrag = false;
@@ -1094,7 +1093,7 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
 		err = __nf_ct_try_assign_helper(ct, p->tmpl, GFP_ATOMIC);
 		if (err)
 			goto drop;
-		add_helper = true;
+
 		if (nat && !nfct_seqadj(ct)) {
 			if (!nfct_seqadj_ext_add(ct))
 				goto drop;
@@ -1113,7 +1112,7 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
 	 * or if we're about to commit.  This has to be done after all the
 	 * extensions are already added.
 	 */
-	if (nf_ct_is_confirmed(ct) ? ((!cached && !skip_add) || add_helper) : commit) {
+	if (nf_ct_is_confirmed(ct) ? (!cached && !skip_add) : commit) {
 		err = nf_ct_helper(skb, ct, ctinfo, family);
 		if (err != NF_ACCEPT)
 			goto nf_error;

From f2bd7cf6a83e49c710e2b93d3064fa0ebb7e0006 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Fri, 4 Sep 2026 10:06:39 -0700
Subject: [PATCH 0596/1982] KVM: SVM: Preserve TLB control (i.e. pending TLB
 flush) on failed VMRUN

[ Upstream commit 60d93c27859fb3ec5b5a689e24de303f166477d0 ]

Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN,
as empirical testing shows that the CPU performs the requested TLB flush if
and only if VMRUN is successful, i.e. clearing TLB control on a failed
VMRUN effectively drops a TLB flush.

Explicitly track the need to flush all ASIDs on a per-CPU basis, as the
ASID reuse condition is tied to the pCPU, not to the vCPU.  As a bonus,
this also obviates the need to avoid clobbering FLUSH_ALL_ASID with
TLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid().

Deliberately don't bother saving/restoring the "old" tlb_ctl on failure,
in quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from
after pre_svm_run(), but before updating tlb_ctl for flush_all_asids.  If
VMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next
successful run of the VMCB *may* unnecessarily flush all ASIDs, which
strictly speaking could result in noisy neighbor issues.  However, the
fact that new_asid() is already guest-triggerable, because of KVM's flawed
behavior of clearing the ASID on emulated INIT, means that a guest can
already trigger a flush of all ASIDs at roughly the same rate.  And once
KVM stops clobbering the ASID on emulated INIT, *or* assigns a static ASID
to each vCPU, this flaw goes away.

Fixes: 38e5e92fe8c0 ("KVM: SVM: Implement Flush-By-Asid feature")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Suggested-by: Yosry Ahmed <yosry@kernel.org>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Jim Mattson <jmattson@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260904170642.3291466-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ sashal: Replaced the svm_is_vmrun_failure() helper with an exit_code != SVM_EXIT_ERR check and dropped the ERAPS CLEAR_RAP context block, since neither exists in this tree. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/svm/svm.c | 14 +++++++++++---
 arch/x86/kvm/svm/svm.h |  1 +
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 5f3c6d7974fb96..3de16ee6698a63 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1781,8 +1781,7 @@ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
 	if (sd->next_asid > sd->max_asid) {
 		++sd->asid_generation;
 		sd->next_asid = sd->min_asid;
-		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
-		vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
+		sd->flush_all_asids = true;
 	}
 
 	svm->current_vmcb->asid_generation = sd->asid_generation;
@@ -4334,6 +4333,11 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 		svm->vmcb->control.asid = svm->asid;
 		vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
 	}
+	if (this_cpu_ptr(&svm_data)->flush_all_asids) {
+		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
+		vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
+	}
+
 	svm->vmcb->save.cr2 = vcpu->arch.cr2;
 
 	svm_fixup_nested_rips(vcpu);
@@ -4416,7 +4420,11 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 		svm->nested.nested_run_pending = 0;
 	}
 
-	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
+	if (svm->vmcb->control.exit_code != SVM_EXIT_ERR) {
+		this_cpu_ptr(&svm_data)->flush_all_asids = false;
+		svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
+	}
+
 	vmcb_mark_all_clean(svm->vmcb);
 
 	/* if exit due to PF check for async PF */
diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index df081ae666f0d5..f8ea26ba714235 100644
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -351,6 +351,7 @@ struct svm_cpu_data {
 	u32 next_asid;
 	u32 min_asid;
 
+	bool flush_all_asids;
 	bool bp_spec_reduce_set;
 
 	struct vmcb *save_area;

From 5d06e2f861d61a03481348378fdf9cc3e68bff47 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Fri, 4 Sep 2026 10:06:40 -0700
Subject: [PATCH 0597/1982] KVM: SVM: Update control fields on #VMEXIT if and
 only if VMRUN succeeded

[ Upstream commit e27fc915c8f575ab5630e27d97465c2077d4b9d1 ]

Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,
because as per AMD:

  there's no explicit architectural guarantee about the behavior in the
  presence of VMRUN failures. So the best thing to do would be to assume
  that if VMRUN fails, the actions requested in the control fields may not
  have been performed.

Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260904170642.3291466-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ sashal: Dropped the ERAPS hunk because the tree lacks ERAPS support, so only the vmcb_mark_all_clean() move into the VMRUN-succeeded block is applied. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/svm/svm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 3de16ee6698a63..e31f807f65aa34 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4423,9 +4423,9 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 	if (svm->vmcb->control.exit_code != SVM_EXIT_ERR) {
 		this_cpu_ptr(&svm_data)->flush_all_asids = false;
 		svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
-	}
 
-	vmcb_mark_all_clean(svm->vmcb);
+		vmcb_mark_all_clean(svm->vmcb);
+	}
 
 	/* if exit due to PF check for async PF */
 	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)

From 6faf87bc7331684d55226603bd552a3eaf7740d4 Mon Sep 17 00:00:00 2001
From: Zhang Heng <zhangheng@kylinos.cn>
Date: Mon, 9 Feb 2026 21:41:49 +0800
Subject: [PATCH 0598/1982] ALSA: hda/realtek: add quirk for Acer Nitro
 ANV15-51

[ Upstream commit aa4876fe2d9fcbcaa0592b25f34ec6f6ea7876c1 ]

fix mute/micmute LEDs and headset microphone for Acer Nitro ANV15-51.

[ The headset microphone issue is solved by Kailang]

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220279
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260209134149.3076957-1-zhangheng@kylinos.cn
Stable-dep-of: 819f6aacbb1d ("ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index a25c92834e722b..d26277907b6a8a 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4007,6 +4007,7 @@ enum {
 	ALC269_FIXUP_POSITIVO_P15X_HEADSET_MIC,
 	ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK,
 	ALC256_FIXUP_VAIO_RPL_MIC_NO_PRESENCE,
+	ALC245_FIXUP_ACER_MICMUTE_LED,
 };
 
 /* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -6576,6 +6577,12 @@ static const struct hda_fixup alc269_fixups[] = {
 		},
 		.chained = true,
 		.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+	},
+	[ALC245_FIXUP_ACER_MICMUTE_LED] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc285_fixup_hp_coef_micmute_led,
+		.chained = true,
+		.chain_id = ALC2XX_FIXUP_HEADSET_MIC,
 	}
 };
 
@@ -6630,6 +6637,11 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
+	SND_PCI_QUIRK(0x1025, 0x171e, "Acer Nitro ANV15-51", ALC245_FIXUP_ACER_MICMUTE_LED),
+	SND_PCI_QUIRK(0x1025, 0x172c, "Acer Nitro ANV16-41", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1025, 0x1731, "Acer Predator PHN16-72", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1025, 0x173a, "Acer Swift SFG14-73", ALC245_FIXUP_ACER_MICMUTE_LED),
+	SND_PCI_QUIRK(0x1025, 0x1758, "Acer Nitro ANV15-41", ALC245_FIXUP_ACER_MICMUTE_LED),
 	SND_PCI_QUIRK(0x1025, 0x1826, "Acer Helios ZPC", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1025, 0x182c, "Acer Helios ZPD", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1025, 0x1844, "Acer Helios ZPS", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),

From 2fc1ffb15efd423ea8476abb54910a6f55945659 Mon Sep 17 00:00:00 2001
From: Jakub Gawlik <jakubgawlik13@gmail.com>
Date: Wed, 30 Sep 2026 16:58:39 +0200
Subject: [PATCH 0599/1982] ALSA: hda/realtek: Add micmute LED quirk for Acer
 Swift SFG16-72

[ Upstream commit 819f6aacbb1d1621c6a62721e708835fe1fb75d8 ]

The Acer Swift SFG16-72 (1025:173b) uses the ALC245 codec, but its
mic-mute LED is not enabled by default. Apply the existing
ALC245_FIXUP_ACER_MICMUTE_LED quirk to enable the mic-mute LED.

Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Jakub Gawlik <jakubgawlik13@gmail.com>
Link: https://patch.msgid.link/20260930145839.374762-1-jakubgawlik13@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index d26277907b6a8a..24bb4aa0f68458 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6641,6 +6641,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x172c, "Acer Nitro ANV16-41", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x1731, "Acer Predator PHN16-72", ALC2XX_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x173a, "Acer Swift SFG14-73", ALC245_FIXUP_ACER_MICMUTE_LED),
+	SND_PCI_QUIRK(0x1025, 0x173b, "Acer Swift SFG16-72", ALC245_FIXUP_ACER_MICMUTE_LED),
 	SND_PCI_QUIRK(0x1025, 0x1758, "Acer Nitro ANV15-41", ALC245_FIXUP_ACER_MICMUTE_LED),
 	SND_PCI_QUIRK(0x1025, 0x1826, "Acer Helios ZPC", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1025, 0x182c, "Acer Helios ZPD", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2),

From 0f79506b36735822d218d5ba9e2abde1f3584884 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 20 Sep 2026 15:05:44 -0300
Subject: [PATCH 0600/1982] smb: client: clear post-EOF pagecache when
 extending a file via truncate

[ Upstream commit 35024595f641e790e24609f3f046e1667e3b280a ]

cifs_setsize() relied on pagecache_isize_extended() to zero the tail of
the folio straddling the old EOF, but that helper is a no-op on CIFS
(i_blkbits is 14), so data dirtied past EOF through an mmap survived
and became visible once the file was extended.

Use netfs_clear_stale_post_isize() instead, called after i_size is
updated since cifs_setsize() callers hold i_rwsem exclusively for the
whole resize.  truncate_pagecache() is then called as in
truncate_setsize(): a no-op on extend, and it drops the pagecache
beyond the new EOF on shrink.

Also thread old_size as an explicit parameter through cifs_setsize()
and cifs_resize_file_locked(), captured by each caller before its own
resize RPC.  This closes a race where a concurrent stat() could adopt
the RPC's already-updated server size via is_size_safe_to_change()
before cifs_setsize() reads old_size itself.

Closes: https://sashiko.dev/#/patchset/20260921230755.1133425-1-pc%40manguebit.org
Fixes: c510edb9734a ("cifs: call pagecache_isize_extended() in cifs_setsize() when extending")
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Dropped the old_size local in cifs_setsize() (now a parameter) and kept this tree's plain i_blocks assignment, since it lacks the u64 blocks local and shrink-clamp context the patch expects. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/cifsfs.h  |  5 +++--
 fs/smb/client/file.c    |  3 ++-
 fs/smb/client/inode.c   | 22 ++++++++++++++--------
 fs/smb/client/smb2ops.c | 10 ++++++----
 4 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/fs/smb/client/cifsfs.h b/fs/smb/client/cifsfs.h
index 3d632d22da6fcb..3298311223b04c 100644
--- a/fs/smb/client/cifsfs.h
+++ b/fs/smb/client/cifsfs.h
@@ -134,8 +134,9 @@ extern ssize_t cifs_file_copychunk_range(unsigned int xid,
 					size_t len, unsigned int flags);
 
 long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg);
-void cifs_setsize(struct inode *inode, loff_t offset);
-void cifs_resize_file_locked(struct inode *inode, loff_t offset);
+void cifs_setsize(struct inode *inode, loff_t old_size, loff_t offset);
+void cifs_resize_file_locked(struct inode *inode, loff_t old_size,
+			     loff_t offset);
 
 struct fs_context;
 struct smb3_fs_context;
diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
index b24a7e191928b5..35f6c1cebd1a90 100644
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -1010,6 +1010,7 @@ static int cifs_do_truncate(const unsigned int xid, struct dentry *dentry)
 	if (!rc) {
 		if (cfile) {
 			struct netfs_inode *ictx = netfs_inode(inode);
+			loff_t old_size = i_size_read(inode);
 
 			tcon = tlink_tcon(cfile->tlink);
 			server = tcon->ses->server;
@@ -1018,7 +1019,7 @@ static int cifs_do_truncate(const unsigned int xid, struct dentry *dentry)
 							cfile, 0, false);
 			if (!rc) {
 				netfs_resize_file(&cinode->netfs, 0, true);
-				cifs_setsize(inode, 0);
+				cifs_setsize(inode, old_size, 0);
 				cifs_invalidate_cache(inode, 0);
 			}
 			mutex_unlock(&ictx->wb_lock);
diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index 88d2732b73a05d..382e83735da288 100644
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -3033,12 +3033,9 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start,
 	return -EOPNOTSUPP;
 }
 
-void cifs_setsize(struct inode *inode, loff_t offset)
+void cifs_setsize(struct inode *inode, loff_t old_size, loff_t offset)
 {
-	loff_t old_size;
-
 	spin_lock(&inode->i_lock);
-	old_size = i_size_read(inode);
 	i_size_write(inode, offset);
 	/*
 	 * Until we can query the server for actual allocation size,
@@ -3047,21 +3044,29 @@ void cifs_setsize(struct inode *inode, loff_t offset)
 	inode->i_blocks = CIFS_INO_BLOCKS(offset);
 	spin_unlock(&inode->i_lock);
 	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
+
+	/*
+	 * Zero the tail of the folio straddling the old EOF so data dirtied
+	 * past EOF through an mmap isn't exposed.  truncate_pagecache() then
+	 * drops any pagecache beyond the new EOF, as in truncate_setsize().
+	 */
 	if (offset > old_size)
-		pagecache_isize_extended(inode, old_size, offset);
+		netfs_clear_stale_post_isize(inode, old_size, offset);
+
 	truncate_pagecache(inode, offset);
 	netfs_wait_for_outstanding_io(inode);
 	fscache_resize_cookie(cifs_inode_cookie(inode), offset);
 }
 
-void cifs_resize_file_locked(struct inode *inode, loff_t offset)
+void cifs_resize_file_locked(struct inode *inode, loff_t old_size,
+			     loff_t offset)
 {
 	struct fscache_cookie *cookie = cifs_inode_cookie(inode);
 
 	lockdep_assert_held_write(&inode->i_rwsem);
 
 	netfs_resize_file(netfs_inode(inode), offset, true);
-	cifs_setsize(inode, offset);
+	cifs_setsize(inode, old_size, offset);
 
 	if (!cookie)
 		return;
@@ -3078,6 +3083,7 @@ int cifs_file_set_size(const unsigned int xid, struct dentry *dentry,
 	struct inode *inode = d_inode(dentry);
 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
 	struct cifsInodeInfo *cifsInode = CIFS_I(inode);
+	loff_t old_size = i_size_read(inode);
 	struct tcon_link *tlink = NULL;
 	struct cifs_tcon *tcon = NULL;
 	struct TCP_Server_Info *server;
@@ -3136,7 +3142,7 @@ int cifs_file_set_size(const unsigned int xid, struct dentry *dentry,
 
 set_size_out:
 	if (rc == 0)
-		cifs_resize_file_locked(inode, size);
+		cifs_resize_file_locked(inode, old_size, size);
 
 	return rc;
 }
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 600ecf4382fa3f..6f6d45afdfb678 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -2278,6 +2278,7 @@ smb2_duplicate_extents(const unsigned int xid,
 	struct duplicate_extents_to_file dup_ext_buf;
 	struct timespec64 ts;
 	struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink);
+	loff_t old_size;
 	u64 asize;
 
 	/* server fileays advertise duplicate extent support with this flag */
@@ -2296,11 +2297,12 @@ smb2_duplicate_extents(const unsigned int xid,
 			       trgtfile->fid.volatile_fid, tcon->tid,
 			       tcon->ses->Suid, src_off, dest_off, len);
 	inode = d_inode(trgtfile->dentry);
-	if (i_size_read(inode) < dest_off + len) {
+	old_size = i_size_read(inode);
+	if (old_size < dest_off + len) {
 		rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false);
 		if (rc)
 			goto duplicate_extents_out;
-		cifs_resize_file_locked(inode, dest_off + len);
+		cifs_resize_file_locked(inode, old_size, dest_off + len);
 	}
 	rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
 			trgtfile->fid.volatile_fid,
@@ -3902,7 +3904,7 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon,
 			}
 
 			new_eof = off + len;
-			cifs_resize_file_locked(inode, new_eof);
+			cifs_resize_file_locked(inode, old_eof, new_eof);
 
 			qrc = SMB2_query_info(xid, tcon,
 					      cfile->fid.persistent_fid,
@@ -3927,7 +3929,7 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon,
 		if (rc)
 			goto out;
 
-		cifs_resize_file_locked(inode, new_eof);
+		cifs_resize_file_locked(inode, old_eof, new_eof);
 
 		qrc = SMB2_query_info(xid, tcon,
 				      cfile->fid.persistent_fid,

From 7beb2f2a58023b2ff28fd52bdb72bed74257ee04 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 20 Sep 2026 16:38:03 -0300
Subject: [PATCH 0601/1982] smb: client: discard post-EOF pagecache when
 extending a file via clone range

[ Upstream commit 4721587f96cb8de8164f3fd203093a0875560999 ]

cifs_remap_file_range() discarded the pagecache only for the folios
overlapping the destination region, so when a clone extends the file the
folio straddling the old EOF - which may hold data dirtied past EOF
through an mmap - was never dropped and became visible as file content
once the file was extended.

Start the discard at the smaller of fstart and the old EOF.  i_size is
still old here, so nothing past the old EOF is flushed to the server.

Fixes: c54fc3a4f375 ("cifs: Fix flushing, invalidation and file size with FICLONE")
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Replaced the missing local i_size with (unsigned long long)i_size_read(target_inode) in the min() that bounds the pagecache discard, since the earlier refactor that adds i_size is absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/cifsfs.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 0429e90dcfd6d8..73a749d949f7e7 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -1429,9 +1429,16 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
 		target_cifsi->netfs.zero_point = fend + 1;
 	old_size = target_cifsi->netfs.remote_i_size;
 
-	/* Discard all the folios that overlap the destination region. */
+	/*
+	 * Discard all the folios that overlap the destination region.  Start at
+	 * the old EOF when extending so the folio straddling it, which may hold
+	 * data written past EOF through an mmap, is dropped too.
+	 */
 	cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend);
-	truncate_inode_pages_range(&target_inode->i_data, fstart, fend);
+	truncate_inode_pages_range(&target_inode->i_data,
+				   min(fstart,
+				       (unsigned long long)i_size_read(target_inode)),
+				   fend);
 
 	fscache_invalidate(cifs_inode_cookie(target_inode), NULL,
 			   i_size_read(target_inode), 0);

From e97dac26ed2cce04f9d159cc99e1eca828c5d49e Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sat, 26 Sep 2026 13:04:44 -0300
Subject: [PATCH 0602/1982] smb: client: drain and invalidate before
 server-side copy/clone

[ Upstream commit c9b1194e8ec99d95db25db45edd2fbf690f043ab ]

cifs_file_copychunk_range() and the clone (FICLONE) path of
cifs_remap_file_range() do not serialise the destination page cache
against the server-side copy the way the other server-side range
operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range()
and smb3_insert_range()) do.

cifs_file_copychunk_range() invalidates the destination range with
filemap_invalidate_inode(), which takes and drops the mapping's
invalidate_lock internally, so the lock is no longer held when the
copychunk ioctl is issued.  It also never drains in-flight netfs I/O on
the target.  The clone path never takes the invalidate_lock at all (only
i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not
drain outstanding I/O.

As a result an asynchronous destination writeback can complete after the
server-side copy/clone has run and reinstate stale data over the region
just written by the server, corrupting the file.  This is the same class
of corruption as commit d7d2adcd022b ("smb/client: flush dirty data
before punching a hole") and has been seen randomly in generic/363
against Windows Server.

Fix both paths to follow the established ordering: hold the target
mapping's invalidate_lock across the flush and invalidation of the
destination and the server ioctl, and call netfs_wait_for_outstanding_io()
on the target to drain in-flight writes before the ioctl is issued.  Only
the target inode's invalidate_lock is required, as the source is merely
flushed and not invalidated; i_rwsem (already held via
lock_two_nondirectories()) is acquired before the invalidate_lock,
matching the VFS lock ordering.  Since filemap_invalidate_inode() takes
that same lock internally, replace it with its own unmap/flush/invalidate
steps instead of calling it, and return early on a zero-length copy to
avoid a range underflow.

Fixes: 8101d6e112e2 ("cifs: Fix copy offload to flush destination region")
Fixes: c54fc3a4f375 ("cifs: Fix flushing, invalidation and file size with FICLONE")
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Adjusted context in cifs_remap_file_range() because the local i_size variable is absent, so the new netfs_wait_for_outstanding_io() call follows the truncate_inode_pages_range() call that uses i_size_read(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/cifsfs.c | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 73a749d949f7e7..23ec5c3666d3d3 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -1377,6 +1377,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
 	 * server could even support copy of range where source = target
 	 */
 	lock_two_nondirectories(target_inode, src_inode);
+	filemap_invalidate_lock(target_inode->i_mapping);
 
 	if (len == 0) {
 		loff_t src_size = i_size_read(src_inode);
@@ -1439,6 +1440,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
 				   min(fstart,
 				       (unsigned long long)i_size_read(target_inode)),
 				   fend);
+	netfs_wait_for_outstanding_io(target_inode);
 
 	fscache_invalidate(cifs_inode_cookie(target_inode), NULL,
 			   i_size_read(target_inode), 0);
@@ -1478,6 +1480,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
 	if (rc)
 		CIFS_I(target_inode)->time = 0;
 unlock:
+	filemap_invalidate_unlock(target_inode->i_mapping);
 	/* although unlocking in the reverse order from locking is not
 	   strictly necessary here it is a little cleaner to be consistent */
 	unlock_two_nondirectories(src_inode, target_inode);
@@ -1501,6 +1504,9 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
 	struct cifs_tcon *target_tcon;
 	ssize_t rc;
 
+	if (len == 0)
+		return 0;
+
 	cifs_dbg(FYI, "copychunk range\n");
 
 	if (!src_file->private_data || !dst_file->private_data) {
@@ -1530,6 +1536,7 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
 	 * server could even support copy of range where source = target
 	 */
 	lock_two_nondirectories(target_inode, src_inode);
+	filemap_invalidate_lock(target_inode->i_mapping);
 
 	cifs_dbg(FYI, "about to flush pages\n");
 
@@ -1555,11 +1562,24 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
 	 * Start at the old EOF when extending so the folio straddling it, which
 	 * may hold data written past EOF through an mmap, is dropped too.
 	 */
-	rc = filemap_invalidate_inode(target_inode, true,
-				      min(destoff, i_size_read(target_inode)),
-				      destoff + len - 1);
-	if (rc)
-		goto unlock;
+	if (target_inode->i_mapping->nrpages) {
+		loff_t fstart = min(destoff, i_size_read(target_inode));
+		loff_t fend = destoff + len - 1;
+
+		unmap_mapping_pages(target_inode->i_mapping,
+				    fstart >> PAGE_SHIFT,
+				    (fend >> PAGE_SHIFT) -
+				    (fstart >> PAGE_SHIFT) + 1,
+				    false);
+		rc = filemap_write_and_wait_range(target_inode->i_mapping,
+						  fstart, fend);
+		if (rc)
+			goto unlock;
+		invalidate_inode_pages2_range(target_inode->i_mapping,
+					      fstart >> PAGE_SHIFT,
+					      fend >> PAGE_SHIFT);
+	}
+	netfs_wait_for_outstanding_io(target_inode);
 
 	fscache_invalidate(cifs_inode_cookie(target_inode), NULL,
 			   i_size_read(target_inode), 0);
@@ -1587,6 +1607,7 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
 	CIFS_I(target_inode)->time = 0;
 
 unlock:
+	filemap_invalidate_unlock(target_inode->i_mapping);
 	/* although unlocking in the reverse order from locking is not
 	 * strictly necessary here it is a little cleaner to be consistent
 	 */

From 7448dcaaf747e89dce902f453ce5f8b6a30b0113 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sat, 26 Sep 2026 17:15:47 -0300
Subject: [PATCH 0603/1982] smb: client: only require read lease for
 size-extending zero range

[ Upstream commit fafc68cccf8a00ed0a1f47c1413a3f16ce4dcdfa ]

smb3_zero_range() refuses any FALLOC_FL_ZERO_RANGE that clears
FALLOC_FL_KEEP_SIZE with -EOPNOTSUPP whenever the inode is not read
caching:

	/* if file not oplocked can't be sure whether asking to extend size */
	rc = -EOPNOTSUPP;
	if (keep_size == false && !CIFS_CACHE_READ(cifsi))
		goto zero_range_exit;

The read lease is only needed to trust the cached i_size when deciding
whether the range extends the file. When it is not held, the size can
instead be fetched from the server, which is authoritative, rather than
refusing the request outright: query the server's end of file and take
the larger of it and the cached size for the interior-vs-extend
decision. The larger of the two is used because the server's end of
file reflects another client's growth while the cached size reflects
this client's own writes that may not have reached the server yet;
using the server size alone would wrongly shrink the file when the
range flush above left an extending write unwritten.

The query isn't lease-protected either, so its result is only trusted to
confirm the range is interior, never to justify extending: if it still
shows the range going past EOF, refuse with -EOPNOTSUPP instead of
calling SMB2_set_eof(), which could otherwise shrink the file if another
client extended it further between the query and the call.  For the same
reason, take the larger of the already-computed i_size and a fresh
i_size_read(inode) right before that call, instead of relying on either
alone: the local variable carries the query's result, which is never
written back to the inode, while a concurrent write on this client can
still extend the cached i_size during the flush, the query, or the
zero-data round trip that happen in between.

Rejecting interior ranges is observed as generic/363 randomly failing
against Windows Server with

	do_zero_range: fallocate: Operation not supported

fsx issues an interior, non-KEEP_SIZE zero range while the inode is
transiently not read caching: the server had just downgraded the file's
lease from RWH to RH after breaking the write caching, and the ensuing
handle reopen/revalidation left CIFS_CACHE_READ momentarily clear. The
range sat well within the server's end of file, so no extend was
needed, yet the range was refused and fsx aborted. This keeps the
emulation correct even when a genuine lease break from another client
leaves the inode without read caching -- the case the -EOPNOTSUPP guard
turned into a hard failure. The extra round trip only happens on the
no-lease path; the common cached case is unchanged.

Fixes: 30175628bf7f ("[SMB3] Enable fallocate -z support for SMB3 mounts")
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Declared only remote_i_size in smb3_zero_range() since this tree lacks the netfs_read_sizes() that upstream uses to fill i_size and remote_i_size. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/smb2ops.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 6f6d45afdfb678..5ad3804826d9ae 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -3512,6 +3512,21 @@ static long smb3_zero_data(struct file *file, struct cifs_tcon *tcon,
 			  0, NULL, NULL);
 }
 
+static long query_server_eof(const unsigned int xid,
+			     struct cifs_tcon *tcon,
+			     struct cifsFileInfo *cfile,
+			     unsigned long long *eof)
+{
+	struct smb2_file_all_info file_inf = {};
+	long rc;
+
+	rc = SMB2_query_info(xid, tcon, cfile->fid.persistent_fid,
+			     cfile->fid.volatile_fid, &file_inf);
+	if (!rc)
+		*eof = le64_to_cpu(file_inf.EndOfFile);
+	return rc;
+}
+
 static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
 			    unsigned long long offset, unsigned long long len,
 			    bool keep_size)
@@ -3520,7 +3535,7 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
 	struct inode *inode = file_inode(file);
 	struct cifsInodeInfo *cifsi = CIFS_I(inode);
 	struct cifsFileInfo *cfile = file->private_data;
-	unsigned long long i_size, new_size;
+	unsigned long long i_size, new_size, remote_i_size;
 	long rc;
 	unsigned int xid;
 
@@ -3555,10 +3570,16 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
 	truncate_pagecache_range(inode, min(offset, i_size), offset + len - 1);
 	netfs_wait_for_outstanding_io(inode);
 
-	/* if file not oplocked can't be sure whether asking to extend size */
-	rc = -EOPNOTSUPP;
-	if (keep_size == false && !CIFS_CACHE_READ(cifsi))
-		goto zero_range_exit;
+	if (!keep_size && !CIFS_CACHE_READ(cifsi)) {
+		rc = query_server_eof(xid, tcon, cfile, &remote_i_size);
+		if (rc)
+			goto zero_range_exit;
+		i_size = max(i_size, remote_i_size);
+		if (i_size < new_size) {
+			rc = -EOPNOTSUPP;
+			goto zero_range_exit;
+		}
+	}
 
 	rc = smb3_zero_data(file, tcon, offset, len, xid);
 	if (rc < 0)
@@ -3567,7 +3588,7 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
 	/*
 	 * do we also need to change the size of the file?
 	 */
-	if (keep_size == false && (unsigned long long)i_size_read(inode) < new_size) {
+	if (!keep_size && umax(i_size, i_size_read(inode)) < new_size) {
 		rc = SMB2_set_eof(xid, tcon, cfile->fid.persistent_fid,
 				  cfile->fid.volatile_fid, cfile->pid, new_size);
 		if (rc >= 0) {

From 850d8d4b2715185ec5cc461aa5ba93572ceb8539 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Mon, 28 Sep 2026 10:23:00 -0300
Subject: [PATCH 0604/1982] smb: client: require stable pages for signed
 connections

[ Upstream commit 53c5c2c1095eb21e214811fec16cd75f89d72ee2 ]

When signing, cifs computes the SMB signature over the pagecache folios
in place and then hands those same folios to the socket.  If a buffered
write mutates a folio while a write subrequest is still in flight, the
signature no longer matches the data that follows it, the server rejects
the write with STATUS_ACCESS_DENIED (-EACCES), and the error is latched
in the mapping, so the next fsync()/fallocate() returns -EIO.

Mark the mapping for stable writes so netfs_perform_write() waits for
writeback to complete before modifying an in-flight folio.  This is
only needed when the connection is signed.

Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib")
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
[ sashal: Replaced upstream's tcon->ses->server->sign with cifs_sb_master_tcon(cifs_sb)->ses->server->sign, because cifs_set_ops() has no tcon local variable in this tree. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/client/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
index 382e83735da288..7c638b8d5490f8 100644
--- a/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -87,6 +87,8 @@ static void cifs_set_ops(struct inode *inode)
 		else
 			inode->i_data.a_ops = &cifs_addr_ops;
 		mapping_set_large_folios(inode->i_mapping);
+		if (cifs_sb_master_tcon(cifs_sb)->ses->server->sign)
+			mapping_set_stable_writes(inode->i_mapping);
 		break;
 	case S_IFDIR:
 		if (IS_AUTOMOUNT(inode)) {

From 352c5f5b995ebef1cb6a8a469df57d064268dcc5 Mon Sep 17 00:00:00 2001
From: Ali Ahmet Memis <ali@iusegentoo.com>
Date: Thu, 30 Jul 2026 06:00:31 +0300
Subject: [PATCH 0605/1982] tools/power turbostat: Read complete CPU lists

[ Upstream commit c24362650f7a8573dc9a9991a034b8500af8eb19 ]

CPU_SUBSET_MAXCPUS accepts CPU IDs through 8191, but the sysfs and
cgroup CPU-list readers stop at 1024 bytes. A fragmented cpuset or
hybrid PMU CPU list can exceed that size and be truncated.
initialize_cpu_set_from_sysfs() can also pass a full, non-NUL-terminated
buffer to parse_cpu_str(), causing an out-of-bounds read.

Additionally, initialize_cpu_set_from_sysfs() returns with the file
still open on success. It is now called once per CPU for
thread_siblings_list, so large systems can leak thousands of descriptors
during topology discovery.

Use getline() so both readers receive a complete, NUL-terminated line.
Close and free the sysfs CPU-list resources on every path, and report
malformed input from the correct buffer.

Fixes: eb187540d13a ("tools/power turbostat: Increase CPU_SUBSET_MAXCPUS to 8192")
Fixes: 58839fdbd441 ("tools/power turbostat: Process HT siblings in CPU order")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Len Brown <len.brown@intel.com>
[ sashal: Dropped the initialize_cpu_set_from_sysfs() hunk because that function doesn't exist here, and adapted the update_effective_str() context, where the err() message still had a trailing \n. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/power/x86/turbostat/turbostat.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 3bab2677b06700..fb8f679549279b 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -6176,33 +6176,35 @@ int for_all_proc_cpus(int (func) (int))
 
 #define PATH_EFFECTIVE_CPUS	"/sys/fs/cgroup/cpuset.cpus.effective"
 
-static char cpu_effective_str[1024];
+static char *cpu_effective_str;
 
 static int update_effective_str(bool startup)
 {
 	FILE *fp;
-	char *pos;
-	char buf[1024];
+	char *buf = NULL;
+	size_t size = 0;
 	int ret;
 
-	if (cpu_effective_str[0] == '\0' && !startup)
+	if (!cpu_effective_str && !startup)
 		return 0;
 
 	fp = fopen(PATH_EFFECTIVE_CPUS, "r");
 	if (!fp)
 		return 0;
 
-	pos = fgets(buf, 1024, fp);
-	if (!pos)
-		err(1, "%s: file read failed\n", PATH_EFFECTIVE_CPUS);
+	if (getline(&buf, &size, fp) < 0)
+		err(1, "%s: file read failed", PATH_EFFECTIVE_CPUS);
 
 	fclose(fp);
 
-	ret = strncmp(cpu_effective_str, buf, 1024);
-	if (!ret)
+	ret = cpu_effective_str ? strcmp(cpu_effective_str, buf) : 1;
+	if (!ret) {
+		free(buf);
 		return 0;
+	}
 
-	strncpy(cpu_effective_str, buf, 1024);
+	free(cpu_effective_str);
+	cpu_effective_str = buf;
 	return 1;
 }
 

From bdb5784531b2148f00a5ff5df0fc61bceebf4525 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
Date: Wed, 23 Sep 2026 14:20:31 +0200
Subject: [PATCH 0606/1982] drm/amd/display: Fix fast updates on DCE 6.x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 88427119e1f039c8cdffd63726c136a986ef519f ]

DCE6 should use legacy fast updates, just like all DCE8 - DCN2.
Set that flag for DCE 6.0, 6.1 and 6.4 (all DCE6 versions).

Technically DCE6 should have been included when the fast update
code was refactored, but it just happened to work until now.

A recent commit "Attach only plane updates that actually changed"
has exposed this issue because with that commit, DC accidentally
took the new fast update code path for DCE6 as well, which caused
it to boot into a black screen with a flip done timeout.

This fix should be backported to all kernel versions that
have "Refactor fast update to use new HWSS build sequence",
but this patch won't apply cleanly to older kernels due to
another refactor in "Remove dc param from check_update".

Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence")
Fixes: 9ec11bb842b6 ("drm/amd/display: Remove dc param from check_update")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260923122033.1046651-1-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 698fda6e360625850413a2d1a90b72ae5f03073d)
Cc: stable@vger.kernel.org
[ sashal: Replaced the missing dc_check_config flag with dc->debug = debug_defaults, setting enable_legacy_fast_update = true in the DCE6 constructors, and adjusted the dce64_construct context because is_apu was already removed. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
index e67c73807f371d..9fa6c01f32c844 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
@@ -439,6 +439,10 @@ static const struct dce_abm_mask abm_mask = {
 		ABM_MASK_SH_LIST_DCE110(_MASK)
 };
 
+static const struct dc_debug_options debug_defaults = {
+	.enable_legacy_fast_update = true,
+};
+
 #define CTX  ctx
 #define REG(reg) mm ## reg
 
@@ -912,6 +916,7 @@ static bool dce60_construct(
 	dc->caps.max_cursor_size = 64;
 	dc->caps.dual_link_dvi = true;
 	dc->caps.extended_aux_timeout_support = false;
+	dc->debug = debug_defaults;
 
 	/*************************************************
 	 *  Create resources                             *
@@ -1109,6 +1114,7 @@ static bool dce61_construct(
 	dc->caps.i2c_speed_in_khz = 40;
 	dc->caps.max_cursor_size = 64;
 	dc->caps.is_apu = true;
+	dc->debug = debug_defaults;
 
 	/*************************************************
 	 *  Create resources                             *
@@ -1306,6 +1312,7 @@ static bool dce64_construct(
 	dc->caps.max_downscale_ratio = 200;
 	dc->caps.i2c_speed_in_khz = 40;
 	dc->caps.max_cursor_size = 64;
+	dc->debug = debug_defaults;
 
 	/*************************************************
 	 *  Create resources                             *

From 84cc155bf4cd4ab518bb91b517c1b760b0de6c04 Mon Sep 17 00:00:00 2001
From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Date: Mon, 15 Sep 2025 14:25:44 +0200
Subject: [PATCH 0607/1982] drm/amdgpu: remove gart_window_lock usage from gmc
 v12
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c79cf5a7d903a16459846b4296fc3cd988837c54 ]

This lock was part of the SDMA workaround originally implemented in
gmc_v10_0_flush_gpu_tlb (a70cb2176f7ef6f moved it to
amdgpu_gmc_flush_gpu_tlb).

This means this lock is useless and be safely dropped.

Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 0bfb1bfc82e8 ("drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
index 3746d39182707f..f22b4197a1c96d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
@@ -339,9 +339,7 @@ static void gmc_v12_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid,
 		return;
 	}
 
-	mutex_lock(&adev->mman.gtt_window_lock);
 	gmc_v12_0_flush_vm_hub(adev, vmid, vmhub, 0);
-	mutex_unlock(&adev->mman.gtt_window_lock);
 	return;
 }
 

From 81a1c7eba334786aed6806a29699bd284fc12029 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Fri, 25 Sep 2026 13:46:19 -0400
Subject: [PATCH 0608/1982] drm/amdgpu/gmc12: properly pass flush_type to
 gmc_v12_0_flush_vm_hub()

[ Upstream commit 0bfb1bfc82e8fa386d4fad1caa5812b6afafa626 ]

In gmc_v12_0_flush_gpu_tlb(), flush_type was not properly
passed to gmc_v12_0_flush_vm_hub().  This only affected
the MMIO path.  In most cases the flush would go through
MES.

Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6498e33f22a12fdc759a0c78bfe0547819277a36)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
index f22b4197a1c96d..7b326d502e6aba 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
@@ -339,7 +339,7 @@ static void gmc_v12_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid,
 		return;
 	}
 
-	gmc_v12_0_flush_vm_hub(adev, vmid, vmhub, 0);
+	gmc_v12_0_flush_vm_hub(adev, vmid, vmhub, flush_type);
 	return;
 }
 

From 5684a6c24c0d7c40ef2c4ccb3e4a64cffe76a791 Mon Sep 17 00:00:00 2001
From: Hari Mishal <harimishal1@gmail.com>
Date: Wed, 16 Sep 2026 16:23:32 +0200
Subject: [PATCH 0609/1982] drm/amd/display: guard dc_sink dereferences in MST
 mode validation

[ Upstream commit 217f64f348c90cba62164e7ff38e0ccf78a5ca09 ]

dm_dp_mst_is_port_support_mode() reads
aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check,
and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads
aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL
check. dc_sink is cleared asynchronously on MST unplug, and both
functions run from paths that the driver's own comments document as
racing that teardown: the connector probe worker's ->mode_valid
callback and a compositor's atomic check, neither of which holds the
MST manager lock that the teardown path uses. The former does have an
existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in
every path that clears dc_sink, so it doesn't cover this.

Fail the port-support check and skip the FRL conversion path when the
sink is already gone.

Fixes: f04d275d94e1 ("drm/amd/display: add mst port output bw check")
Fixes: 5c9b8b27a883 ("drm/amd/display: Tie FRL support into amdgpu_dm")
Assisted-by: gkh_clanker_t1000
Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Reviewed-by: Fangzhi Zuo <jerry.zuo@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)
Cc: stable@vger.kernel.org
[ sashal: Dropped the FRL hunk because the HDMI 2.1 FRL code isn't present, and applied only the dc_sink NULL check in dm_dp_mst_is_port_support_mode(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 2e0895f4f9b10f..642248a2511496 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -1867,6 +1867,9 @@ enum dc_status dm_dp_mst_is_port_support_mode(
 	struct dc_dsc_config_options dsc_options = {0};
 	uint32_t stream_kbps;
 
+	if (!aconnector->dc_sink)
+		return DC_FAIL_BANDWIDTH_VALIDATE;
+
 	/* DSC unnecessary case
 	 * Check if timing could be supported within end-to-end BW
 	 */

From 16c95870c95f2a3d78c81b9fbc0645f4b7178c11 Mon Sep 17 00:00:00 2001
From: Igor Paunovic <royalnet026@gmail.com>
Date: Sat, 5 Sep 2026 17:04:32 +0200
Subject: [PATCH 0610/1982] accel/rocket: search every core slot when looking
 up a scheduler

[ Upstream commit 89c2c777df17eb0201c8e22afabbf3691f2a28fe ]

sched_to_core() walks rdev->cores[] up to rdev->num_cores, and
rocket_remove() decrements num_cores for every core it removes. Unbind a
core that is not the last one and the cores behind it fall outside the
search, so sched_to_core() returns NULL for a core that is still bound and
still running jobs. Neither caller checks the result:

  rocket_job_run():      rocket_fence_create(core), core->dev
  rocket_job_timedout(): dev_err(core->dev, "NPU job timed out")

Unbinding the middle core of the three on an RK3588 while three clients are
submitting to all of them faults twice, once from the surviving core's
job queue and once from its reset work:

  KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
  Workqueue: fdad0000.npu drm_sched_run_job_work [gpu_sched]
  pc : rocket_job_run+0x234/0x838 [rocket]
  Call trace:
   rocket_job_run+0x234/0x838 [rocket]
   drm_sched_run_job_work+0x2cc/0xad8 [gpu_sched]
   process_one_work+0x640/0x14f0

  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  Workqueue: rocket-reset-2 drm_sched_job_timedout [gpu_sched]
  pc : rocket_job_timedout+0xf0/0x1e0 [rocket]
  Call trace:
   rocket_job_timedout+0xf0/0x1e0 [rocket]
   drm_sched_job_timedout+0x188/0x6a0 [gpu_sched]

Both are the third core: the workqueue names are its device and its
core->index, and it was left at slot 2 while num_cores had dropped to 2.

Search all the slots that were allocated, the way find_core_for_dev() now
does. A core that is still bound is then found, and the two callers get
the pointer they already assume they have.

This does not make unbinding one core out of several safe. An open client
keeps an entity pointing at the scheduler of the core that went away:
drm_sched reports it as not ready for every job that lands on it, and the
client waits in dma_fence_default_wait for a fence that will never signal.
Stopping the NULL dereference is what belongs in a fix; the rest wants
more thought.

Reported-by: Sidong Yang <sidong.yang@furiosa.ai>
Closes: https://lore.kernel.org/dri-devel/apwUewaRnoTNXHCt@rock-5b-plus/
Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Igor Paunovic <royalnet026@gmail.com>
Assisted-by: LLM sparse checkpatch
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260905150432.7477-1-royalnet026@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/accel/rocket/rocket_job.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index b374d7ee54b682..729b7d6d77d469 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -283,7 +283,7 @@ static struct rocket_core *sched_to_core(struct rocket_device *rdev,
 {
 	unsigned int core;
 
-	for (core = 0; core < rdev->num_cores; core++) {
+	for (core = 0; core < rdev->max_cores; core++) {
 		if (&rdev->cores[core].sched == sched)
 			return &rdev->cores[core];
 	}

From 73309ca08e71b8a26e94220debe4ae5831519cc5 Mon Sep 17 00:00:00 2001
From: Vlad Kulikov <vlad.kulikov.c@gmail.com>
Date: Tue, 21 Oct 2025 21:13:39 +0300
Subject: [PATCH 0611/1982] ipc: create_ipc_ns: drop mqueue mount on sysctl
 setup failure

[ Upstream commit 7229d74e5e8c1f140529d405c88d4493e37ce4e3 ]

If setup_mq_sysctls(ns) fails after mq_init_ns(ns) succeeds, the error
path skipped releasing the internal kernel mqueue mount kept in
ns->mq_mnt. That leaves the vfsmount/superblock referenced until final
namespace teardown, i.e. a resource leak on this rare failure edge.

Unwind it by calling mntput(ns->mq_mnt) before dropping user_ns and
freeing the IPC namespace. This mirrors the normal ordering used in
free_ipc_ns().

Link: https://lkml.kernel.org/r/20251021181341.670297-1-vlad_kulikov_c@pm.me
Signed-off-by: Vlad Kulikov <vlad_kulikov_c@pm.me>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: f0e48172a59e ("ipc: drop the mqueue mount with kern_unmount() on setup failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/namespace.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/ipc/namespace.c b/ipc/namespace.c
index 59b12fcb40bdf4..cf62d11a09b900 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -75,10 +75,10 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
 
 	err = -ENOMEM;
 	if (!setup_mq_sysctls(ns))
-		goto fail_put;
+		goto fail_mq_mount;
 
 	if (!setup_ipc_sysctls(ns))
-		goto fail_mq;
+		goto fail_mq_sysctls;
 
 	err = msg_init_ns(ns);
 	if (err)
@@ -92,9 +92,10 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
 
 fail_ipc:
 	retire_ipc_sysctls(ns);
-fail_mq:
+fail_mq_sysctls:
 	retire_mq_sysctls(ns);
-
+fail_mq_mount:
+	mntput(ns->mq_mnt);
 fail_put:
 	put_user_ns(ns->user_ns);
 	ns_common_free(ns);

From 4aef6ceb4d6acacd53bc047ac4849677c3edbec1 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Fri, 9 Oct 2026 23:51:55 +0200
Subject: [PATCH 0612/1982] ipc: drop the mqueue mount with kern_unmount() on
 setup failure

[ Upstream commit f0e48172a59e517e613b73f73cc35f24fd123aeb ]

mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its
->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls
or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain
mntput(). With ->mnt_ns set that takes the fast path of
mntput_no_expire(). The count drops to zero and nothing ever kills the
mount, so the mount and the mqueue superblock are leaked.

Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
added the first failure path after mq_init_ns() and never dropped the
mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on
sysctl setup failure") tried to fix that with a mntput() but that
doesn't help for a long-term mount.

Use kern_unmount(). free_ipc() open-codes the same thing for a namespace
that made it.

Fixes: dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace")
Fixes: 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-5-7446d2d335e6@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ipc/namespace.c b/ipc/namespace.c
index cf62d11a09b900..7aab1e6e0f86da 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -95,7 +95,7 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
 fail_mq_sysctls:
 	retire_mq_sysctls(ns);
 fail_mq_mount:
-	mntput(ns->mq_mnt);
+	kern_unmount(ns->mq_mnt);
 fail_put:
 	put_user_ns(ns->user_ns);
 	ns_common_free(ns);

From febee5fb9164793863ba216281fffd19e0f74e46 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Fri, 9 Oct 2026 23:51:58 +0200
Subject: [PATCH 0613/1982] ntfs3: free replaced mount options after a grace
 period

[ Upstream commit 56c3824de56b5275c02ff6b6aa27ddbacfbb9b25 ]

ntfs_fs_reconfigure() replaces the old mount options with new mount
options in sbi->options. The old mount options land in fs_context and
are freed as soon as remount returns. With a pathwalk held up in
ntfs_nls_to_utf16() between loading sbi->options and dereferencing it
while a remount replaces them:

  BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x7ae/0x7c0
  Read of size 8 at addr ff110001044fd448 by task walker/98
  Call Trace:
   <TASK>
   ntfs_nls_to_utf16+0x7ae/0x7c0
   ntfs_d_hash+0x22b/0x500
   link_path_walk+0x11ad/0x1d30
   path_lookupat+0x63/0xb00
   filename_lookup+0x1f1/0x5b0
   vfs_statx+0xd7/0x3b0
  [...]
  Allocated by task 95:
   __kmalloc_node_track_caller_noprof+0x2a2/0x730
   kmemdup_noprof+0x25/0x50
   ntfs_fill_super+0x1e5/0x4550
  [...]
  Freed by task 97:
   kfree+0x1db/0x5b0
   put_fs_context+0x13c/0x7d0
   path_mount+0x54a/0x2130
   __x64_sys_mount+0x20c/0x270

That info is needed in rcu lookup in the dentry hash and dentry compary
methods for ntfs3 and causes a UAF today. Delay freeing with an rcu
grace period.

ntfs_nls_to_utf16() reads ->nls and ->ads once under rcu_read_lock() so
the hooks pair with the release in ntfs_fs_reconfigure(). That also
covers callers outside of rcu pathwalk such as ntfs_lookup(). They don't
hold rcu_read_lock() themselves and wouldn't be protected by the grace
period otherwise. Remount refuses to change the iocharset so ->nls stays
valid after rcu_read_unlock().

Fixes: a3a956c78efa ("fs/ntfs3: Add option "nocase"")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-8-7446d2d335e6@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
[ sashal: Dropped the ads snapshot and its later use in ntfs_nls_to_utf16() because the ADS option and delimiter code don't exist here, keeping only the RCU snapshot of nls. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/dir.c     |  9 ++++++++-
 fs/ntfs3/ntfs_fs.h |  2 ++
 fs/ntfs3/super.c   | 16 +++++++++++++++-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index 6d588efaf9fdf9..9441a98feb5b9c 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -185,11 +185,18 @@ int ntfs_nls_to_utf16(struct ntfs_sb_info *sbi, const u8 *name, u32 name_len,
 {
 	int ret, slen;
 	const u8 *end;
-	struct nls_table *nls = sbi->options->nls;
+	struct ntfs_mount_options *opts;
+	struct nls_table *nls;
 	u16 *uname = uni->name;
 
 	static_assert(sizeof(wchar_t) == sizeof(u16));
 
+	/* ntfs_fs_reconfigure() may replace the options, but not ->nls */
+	rcu_read_lock();
+	opts = READ_ONCE(sbi->options);
+	nls = opts->nls;
+	rcu_read_unlock();
+
 	if (!nls) {
 		/* utf8 -> utf16 */
 		ret = _utf8s_to_utf16s(name, name_len, endian, uname, max_ulen);
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 9cacca33970555..f7ca4ea54e40ac 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -90,6 +90,8 @@ enum utf16_endian;
 struct ntfs_mount_options {
 	char *nls_name;
 	struct nls_table *nls;
+	/* ->d_hash() and ->d_compare() read the options in rcu pathwalk */
+	struct rcu_head rcu;
 
 	kuid_t fs_uid;
 	kgid_t fs_gid;
diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index 74f071ace3ad74..8b37eb02041149 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -249,6 +249,11 @@ static inline void put_mount_options(struct ntfs_mount_options *options)
 	kfree(options);
 }
 
+static void put_mount_options_rcu(struct rcu_head *head)
+{
+	put_mount_options(container_of(head, struct ntfs_mount_options, rcu));
+}
+
 enum Opt {
 	Opt_uid,
 	Opt_gid,
@@ -413,6 +418,7 @@ static int ntfs_fs_reconfigure(struct fs_context *fc)
 	struct super_block *sb = fc->root->d_sb;
 	struct ntfs_sb_info *sbi = sb->s_fs_info;
 	struct ntfs_mount_options *new_opts = fc->fs_private;
+	struct ntfs_mount_options *old_opts;
 	int ro_rw;
 
 	/* If ntfs3 is used as legacy ntfs enforce read-only mode. */
@@ -449,7 +455,15 @@ static int ntfs_fs_reconfigure(struct fs_context *fc)
 
 out:
 	sync_filesystem(sb);
-	swap(sbi->options, fc->fs_private);
+	old_opts = sbi->options;
+	/* pairs with the READ_ONCE() in ntfs_nls_to_utf16() */
+	smp_store_release(&sbi->options, new_opts);
+	fc->fs_private = NULL;
+	/*
+	 * ntfs_d_hash() and ntfs_d_compare() of a pathwalk in rcu mode may
+	 * still read the old options through the sbi.
+	 */
+	call_rcu(&old_opts->rcu, put_mount_options_rcu);
 
 	return 0;
 }

From 232c6e8486c7c33f0dcee8fce2c62e6db08ac150 Mon Sep 17 00:00:00 2001
From: Tom Zanussi <zanussi@kernel.org>
Date: Mon, 13 Apr 2026 17:35:37 -0500
Subject: [PATCH 0614/1982] tracing: Fix fully-qualified variable reference
 printing in histograms

[ Upstream commit 9236eebd138aa2753f7b30fc6cee7b7202841247 ]

The syntax for fully-qualified variable references in histograms is
subsys.event.$var, which is parsed correctly, but not displayed correctly
when printing a histogram spec. The current code puts the $ reference at
the beginning of the fully-qualified variable name i.e. $subsys.event.var,
which is incorrect.

Before:

trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-$sched.sched_wakeup.ts0: ...

After:

trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-sched.sched_wakeup.$ts0: ...

Link: https://patch.msgid.link/5dee9a86d062a4dd68c2214f3d90ac93811e1951.1776112478.git.zanussi@kernel.org
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Stable-dep-of: a0777b9e5315 ("tracing: Fix NULL dereference when copying keys for a field variable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events_hist.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 9254e6c17d6306..cbeb3c146d8fad 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1355,9 +1355,12 @@ static const char *hist_field_name(struct hist_field *field,
 		 field->flags & HIST_FIELD_FL_VAR_REF) {
 		if (field->system) {
 			static char full_name[MAX_FILTER_STR_VAL];
+			static char *fmt;
 			int len;
 
-			len = snprintf(full_name, sizeof(full_name), "%s.%s.%s",
+			fmt = field->flags & HIST_FIELD_FL_VAR_REF ? "%s.%s.$%s" : "%s.%s.%s";
+
+			len = snprintf(full_name, sizeof(full_name), fmt,
 				       field->system, field->event_name,
 				       field->name);
 			if (len < sizeof(full_name))
@@ -1734,9 +1737,10 @@ static const char *get_hist_field_flags(struct hist_field *hist_field)
 
 static void expr_field_str(struct hist_field *field, char *expr)
 {
-	if (field->flags & HIST_FIELD_FL_VAR_REF)
-		strcat(expr, "$");
-	else if (field->flags & HIST_FIELD_FL_CONST) {
+	if (field->flags & HIST_FIELD_FL_VAR_REF) {
+		if (!field->system)
+			strcat(expr, "$");
+	} else if (field->flags & HIST_FIELD_FL_CONST) {
 		char str[HIST_CONST_DIGITS_MAX];
 
 		snprintf(str, HIST_CONST_DIGITS_MAX, "%llu", field->constant);
@@ -6165,7 +6169,8 @@ static void hist_field_print(struct seq_file *m, struct hist_field *hist_field)
 	else if (field_name) {
 		if (hist_field->flags & HIST_FIELD_FL_VAR_REF ||
 		    hist_field->flags & HIST_FIELD_FL_ALIAS)
-			seq_putc(m, '$');
+			if (!hist_field->system)
+				seq_putc(m, '$');
 		seq_printf(m, "%s", field_name);
 	} else if (hist_field->flags & HIST_FIELD_FL_TIMESTAMP)
 		seq_puts(m, "common_timestamp");

From 4cb2b85da2bddc5aec846cdd5daa01d56c98c142 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Thu, 11 Jun 2026 13:59:43 +0800
Subject: [PATCH 0615/1982] tracing: Use __free() for expr_str() buffer

[ Upstream commit 988995c0552b6213b6bf16cea57258d4842c1488 ]

expr_str() allocates a temporary expression buffer and manually frees it
on some error paths.

Convert the buffer to __free(kfree) and return it with return_ptr() on
success. This keeps ownership handling separate from the later ERR_PTR()
conversion and string-bound change.

Link: https://patch.msgid.link/20260611055945.22348-2-pengpeng@iscas.ac.cn
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Stable-dep-of: a0777b9e5315 ("tracing: Fix NULL dereference when copying keys for a field variable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events_hist.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index cbeb3c146d8fad..b15e0b63dcf012 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1761,7 +1761,7 @@ static void expr_field_str(struct hist_field *field, char *expr)
 
 static char *expr_str(struct hist_field *field, unsigned int level)
 {
-	char *expr;
+	char *expr __free(kfree) = NULL;
 
 	if (level > 1)
 		return NULL;
@@ -1772,7 +1772,7 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 
 	if (!field->operands[0]) {
 		expr_field_str(field, expr);
-		return expr;
+		return_ptr(expr);
 	}
 
 	if (field->operator == FIELD_OP_UNARY_MINUS) {
@@ -1780,16 +1780,15 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 
 		strcat(expr, "-(");
 		subexpr = expr_str(field->operands[0], ++level);
-		if (!subexpr) {
-			kfree(expr);
+		if (!subexpr)
 			return NULL;
-		}
+
 		strcat(expr, subexpr);
 		strcat(expr, ")");
 
 		kfree(subexpr);
 
-		return expr;
+		return_ptr(expr);
 	}
 
 	expr_field_str(field->operands[0], expr);
@@ -1808,13 +1807,12 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 		strcat(expr, "*");
 		break;
 	default:
-		kfree(expr);
 		return NULL;
 	}
 
 	expr_field_str(field->operands[1], expr);
 
-	return expr;
+	return_ptr(expr);
 }
 
 /*

From 69c4a13c65873151477efbfcfc862993d2aaf104 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Thu, 11 Jun 2026 13:59:44 +0800
Subject: [PATCH 0616/1982] tracing: Return ERR_PTR() from expr_str()

[ Upstream commit a5ca27e8ff1c10e949af7cfe474d6d1a08fb5601 ]

expr_str() currently reports all failure cases as NULL, so callers cannot
distinguish invalid recursion depth from allocation failure or later
string construction errors.

Return ERR_PTR()-encoded errors from expr_str() and make parse_unary()
and parse_expr() propagate them. Clear expr->name before destroying the
hist field so the error pointer is not freed as a string.

Link: https://patch.msgid.link/20260611055945.22348-3-pengpeng@iscas.ac.cn
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Stable-dep-of: 935601a4276f ("tracing: Bound histogram expression strings with seq_buf")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events_hist.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index b15e0b63dcf012..511548b75ad899 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1764,11 +1764,11 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 	char *expr __free(kfree) = NULL;
 
 	if (level > 1)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	expr = kzalloc(MAX_FILTER_STR_VAL, GFP_KERNEL);
 	if (!expr)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	if (!field->operands[0]) {
 		expr_field_str(field, expr);
@@ -1780,8 +1780,8 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 
 		strcat(expr, "-(");
 		subexpr = expr_str(field->operands[0], ++level);
-		if (!subexpr)
-			return NULL;
+		if (IS_ERR(subexpr))
+			return subexpr;
 
 		strcat(expr, subexpr);
 		strcat(expr, ")");
@@ -1807,7 +1807,7 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 		strcat(expr, "*");
 		break;
 	default:
-		return NULL;
+		return ERR_PTR(-EINVAL);
 	}
 
 	expr_field_str(field->operands[1], expr);
@@ -2624,6 +2624,11 @@ static struct hist_field *parse_unary(struct hist_trigger_data *hist_data,
 	expr->is_signed = operand1->is_signed;
 	expr->operator = FIELD_OP_UNARY_MINUS;
 	expr->name = expr_str(expr, 0);
+	if (IS_ERR(expr->name)) {
+		ret = PTR_ERR(expr->name);
+		expr->name = NULL;
+		goto free;
+	}
 	expr->type = kstrdup_const(operand1->type, GFP_KERNEL);
 	if (!expr->type) {
 		ret = -ENOMEM;
@@ -2836,6 +2841,11 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data,
 		destroy_hist_field(operand1, 0);
 
 		expr->name = expr_str(expr, 0);
+		if (IS_ERR(expr->name)) {
+			ret = PTR_ERR(expr->name);
+			expr->name = NULL;
+			goto free_expr;
+		}
 	} else {
 		/* The operand sizes should be the same, so just pick one */
 		expr->size = operand1->size;
@@ -2849,6 +2859,11 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data,
 		}
 
 		expr->name = expr_str(expr, 0);
+		if (IS_ERR(expr->name)) {
+			ret = PTR_ERR(expr->name);
+			expr->name = NULL;
+			goto free_expr;
+		}
 	}
 
 	return expr;

From 9876738cd08eb1ee18e9d7028ef9b7f7d3891b88 Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Thu, 11 Jun 2026 13:59:45 +0800
Subject: [PATCH 0617/1982] tracing: Bound histogram expression strings with
 seq_buf

[ Upstream commit 935601a4276f28105498609f7f98aa66e86e9c96 ]

expr_str() allocates a fixed MAX_FILTER_STR_VAL buffer and then builds
expression names with a series of raw strcat() appends. Nested operands,
constants, field flags, and generated field names can push the rendered
string past that fixed limit before the name is attached to the hist
field.

Build expression strings with seq_buf and return -E2BIG when the
rendered name would exceed MAX_FILTER_STR_VAL. This keeps the existing
tracing-side limit while replacing the raw append logic with bounded
construction.

Link: https://patch.msgid.link/20260611055945.22348-4-pengpeng@iscas.ac.cn
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Stable-dep-of: a0777b9e5315 ("tracing: Fix NULL dereference when copying keys for a field variable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events_hist.c | 57 ++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 24 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 511548b75ad899..086a996c945b4f 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -94,7 +94,6 @@ typedef u64 (*hist_field_fn_t) (struct hist_field *field,
 #define HIST_FIELD_OPERANDS_MAX	2
 #define HIST_FIELDS_MAX		(TRACING_MAP_FIELDS_MAX + TRACING_MAP_VARS_MAX)
 #define HIST_ACTIONS_MAX	8
-#define HIST_CONST_DIGITS_MAX	21
 #define HIST_DIV_SHIFT		20  /* For optimizing division by constants */
 
 enum field_op_id {
@@ -1735,33 +1734,36 @@ static const char *get_hist_field_flags(struct hist_field *hist_field)
 	return flags_str;
 }
 
-static void expr_field_str(struct hist_field *field, char *expr)
+static bool expr_field_str(struct hist_field *field, struct seq_buf *s)
 {
+	const char *field_name;
+
 	if (field->flags & HIST_FIELD_FL_VAR_REF) {
 		if (!field->system)
-			strcat(expr, "$");
-	} else if (field->flags & HIST_FIELD_FL_CONST) {
-		char str[HIST_CONST_DIGITS_MAX];
+			seq_buf_putc(s, '$');
+	} else if (field->flags & HIST_FIELD_FL_CONST)
+		seq_buf_printf(s, "%llu", field->constant);
 
-		snprintf(str, HIST_CONST_DIGITS_MAX, "%llu", field->constant);
-		strcat(expr, str);
-	}
+	field_name = hist_field_name(field, 0);
+	if (!field_name)
+		return false;
 
-	strcat(expr, hist_field_name(field, 0));
+	seq_buf_puts(s, field_name);
 
 	if (field->flags && !(field->flags & HIST_FIELD_FL_VAR_REF)) {
 		const char *flags_str = get_hist_field_flags(field);
 
-		if (flags_str) {
-			strcat(expr, ".");
-			strcat(expr, flags_str);
-		}
+		if (flags_str)
+			seq_buf_printf(s, ".%s", flags_str);
 	}
+
+	return !seq_buf_has_overflowed(s);
 }
 
 static char *expr_str(struct hist_field *field, unsigned int level)
 {
 	char *expr __free(kfree) = NULL;
+	struct seq_buf s;
 
 	if (level > 1)
 		return ERR_PTR(-EINVAL);
@@ -1770,47 +1772,54 @@ static char *expr_str(struct hist_field *field, unsigned int level)
 	if (!expr)
 		return ERR_PTR(-ENOMEM);
 
+	seq_buf_init(&s, expr, MAX_FILTER_STR_VAL);
+
 	if (!field->operands[0]) {
-		expr_field_str(field, expr);
+		if (!expr_field_str(field, &s))
+			return ERR_PTR(-E2BIG);
+
 		return_ptr(expr);
 	}
 
 	if (field->operator == FIELD_OP_UNARY_MINUS) {
 		char *subexpr;
 
-		strcat(expr, "-(");
 		subexpr = expr_str(field->operands[0], ++level);
 		if (IS_ERR(subexpr))
 			return subexpr;
 
-		strcat(expr, subexpr);
-		strcat(expr, ")");
-
+		seq_buf_printf(&s, "-(%s)", subexpr);
 		kfree(subexpr);
 
+		if (seq_buf_has_overflowed(&s))
+			return ERR_PTR(-E2BIG);
+
 		return_ptr(expr);
 	}
 
-	expr_field_str(field->operands[0], expr);
+	if (!expr_field_str(field->operands[0], &s))
+		return ERR_PTR(-E2BIG);
 
 	switch (field->operator) {
 	case FIELD_OP_MINUS:
-		strcat(expr, "-");
+		seq_buf_putc(&s, '-');
 		break;
 	case FIELD_OP_PLUS:
-		strcat(expr, "+");
+		seq_buf_putc(&s, '+');
 		break;
 	case FIELD_OP_DIV:
-		strcat(expr, "/");
+		seq_buf_putc(&s, '/');
 		break;
 	case FIELD_OP_MULT:
-		strcat(expr, "*");
+		seq_buf_putc(&s, '*');
 		break;
 	default:
 		return ERR_PTR(-EINVAL);
 	}
 
-	expr_field_str(field->operands[1], expr);
+	if (seq_buf_has_overflowed(&s) ||
+	    !expr_field_str(field->operands[1], &s))
+		return ERR_PTR(-E2BIG);
 
 	return_ptr(expr);
 }

From b20c4193a4250353eeba887c446f151b6cdaf64f Mon Sep 17 00:00:00 2001
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Date: Mon, 14 Sep 2026 14:34:43 +0900
Subject: [PATCH 0618/1982] tracing: Fix NULL dereference when copying keys for
 a field variable

[ Upstream commit a0777b9e53157f1f6848a0fd0650f5465391ea81 ]

In event_hist_trigger_parse() where it needs to create actions like
"onmatch", it calls:

  event_hist_trigger_parse() {
    create_actions() {
      action_create() {
        trace_action_create() {
          trace_action_create_field_var() {
            create_field_var_hist()

Where create_field_var_hist() does a loop on the hist_data
representing the keys. The issue is, if the keys uses one of the
pseudo field types (like common_cpu), the hist_data field element
will have NULL for its field member causing a NULL pointer
dereference when accessing the key_field->field->name.

  # echo 'hist:keys=common_cpu:ts0=common_timestamp.usecs' > \
      events/sched/sched_waking/trigger
  # echo 'my_synth u64 lat; int prio' > synthetic_events
  # echo 'hist:keys=common_cpu:wakeup_lat=common_timestamp.usecs-$ts0:\
      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio)' > \
      events/sched/sched_switch/trigger

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:create_field_var_hist+0x771/0x1380
  Call Trace:
   trace_action_create_field_var+0x360/0x600
   trace_action_create+0x393/0xe80
   event_hist_trigger_parse+0x3e47/0x69e0
   trigger_process_regex+0x1a6/0x250
   event_trigger_write+0xce/0x160

Instead of accessing it directly, use the proper handler
expr_field_str() to get the name.

The three previous patches are prerequisites: without them a .buckets
key and a common_stacktrace key each render into a command that cannot
be parsed back.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914053443.981201-5-donggeunyoo.kernel@gmail.com
Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events_hist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 086a996c945b4f..882e10e776fe40 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -3096,7 +3096,7 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,
 		key_field = hist_data->fields[i];
 		if (!first)
 			seq_buf_putc(&s, ',');
-		seq_buf_puts(&s, key_field->field->name);
+		expr_field_str(key_field, &s);
 		first = false;
 	}
 

From b97686f158517c81b3936ac28b987cbdaf0b7f8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
Date: Tue, 6 Oct 2026 23:16:07 +0200
Subject: [PATCH 0619/1982] drm/amdgpu/uvd3.1: Fix checking whether UVD
 firmware keyselect was already set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 800ea86e83e137395eba54103e5c459c2bc9965f ]

The PASS_MASK is for a different register not for UVD_FW_START.
It was a mistake to check this flag. It should be enough to check
that the register is non-zero.

Fixes: 889a2cfd889c ("drm/amdgpu/uvd3.1: Don't validate the firmware when already validated")
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20261006211607.75407-1-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9dee462c83259ca769aa1bf82228adee9831685c)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
index 1df45633e81200..ccb65728911362 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
@@ -288,7 +288,7 @@ static int uvd_v3_1_fw_validate(struct amdgpu_device *adev)
 	int i;
 	uint32_t keysel = adev->uvd.keyselect;
 
-	if (RREG32(mmUVD_FW_START) & UVD_FW_STATUS__PASS_MASK) {
+	if (RREG32(mmUVD_FW_START)) {
 		dev_dbg(adev->dev, "UVD keyselect already set: 0x%x (on CPU: 0x%x)\n",
 			RREG32(mmUVD_FW_START), adev->uvd.keyselect);
 		return 0;

From 6cf00e646dc3f386dda8e608e2ca71a737c3dc14 Mon Sep 17 00:00:00 2001
From: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Date: Wed, 18 Mar 2026 09:29:56 +0000
Subject: [PATCH 0620/1982] RISC-V: KVM: Fix double-free of sdata in
 kvm_pmu_clear_snapshot_area()

[ Upstream commit 310e2096b082ae0010e7afef666073b966ac2fa7 ]

In kvm_riscv_vcpu_pmu_snapshot_set_shmem(), when kvm_vcpu_write_guest()
fails, kvpmu->sdata is freed but not set to NULL. This leaves a dangling
pointer that will be freed again when kvm_pmu_clear_snapshot_area() is
called during vcpu teardown, triggering a KASAN double-free report.

First free occurs in kvm_riscv_vcpu_pmu_snapshot_set_shmem():
 kvm_riscv_vcpu_pmu_snapshot_set_shmem arch/riscv/kvm/vcpu_pmu.c:443
 kvm_sbi_ext_pmu_handler arch/riscv/kvm/vcpu_sbi_pmu.c:74
 kvm_riscv_vcpu_sbi_ecall arch/riscv/kvm/vcpu_sbi.c:608
 kvm_riscv_vcpu_exit arch/riscv/kvm/vcpu_exit.c:240
 kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:1008
 kvm_vcpu_ioctl virt/kvm/kvm_main.c:4476

Second free (double-free) occurs in kvm_pmu_clear_snapshot_area():
 kvm_pmu_clear_snapshot_area arch/riscv/kvm/vcpu_pmu.c:403 [inline]
 kvm_riscv_vcpu_pmu_deinit.part arch/riscv/kvm/vcpu_pmu.c:905
 kvm_riscv_vcpu_pmu_deinit arch/riscv/kvm/vcpu_pmu.c:893
 kvm_arch_vcpu_destroy arch/riscv/kvm/vcpu.c:199
 kvm_vcpu_destroy virt/kvm/kvm_main.c:469 [inline]
 kvm_destroy_vcpus virt/kvm/kvm_main.c:489
 kvm_arch_destroy_vm arch/riscv/kvm/vm.c:54
 kvm_destroy_vm virt/kvm/kvm_main.c:1301 [inline]
 kvm_put_kvm virt/kvm/kvm_main.c:1338
 kvm_vm_release virt/kvm/kvm_main.c:1361

Fix it by setting kvpmu->sdata to NULL after kfree() in
kvm_riscv_vcpu_pmu_snapshot_set_shmem(), so that the subsequent
kfree(NULL) in kvm_pmu_clear_snapshot_area() becomes a safe no-op.

This bug was found by fuzzing the KVM RISC-V PMU interface.

Fixes: c2f41ddbcdd756 ("RISC-V: KVM: Implement SBI PMU Snapshot feature")
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260318092956.708246-1-xujiakai2025@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kvm/vcpu_pmu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
index d5a0a3a33f6b2e..b3ce82cfd78f3a 100644
--- a/arch/riscv/kvm/vcpu_pmu.c
+++ b/arch/riscv/kvm/vcpu_pmu.c
@@ -454,6 +454,7 @@ int kvm_riscv_vcpu_pmu_snapshot_set_shmem(struct kvm_vcpu *vcpu, unsigned long s
 	/* No need to check writable slot explicitly as kvm_vcpu_write_guest does it internally */
 	if (kvm_vcpu_write_guest(vcpu, saddr, kvpmu->sdata, snapshot_area_size)) {
 		kfree(kvpmu->sdata);
+		kvpmu->sdata = NULL;
 		sbiret = SBI_ERR_INVALID_ADDRESS;
 		goto out;
 	}

From 5d3e01de312090d93b53bc179bf21cd5891f6d1e Mon Sep 17 00:00:00 2001
From: Jamal Hadi Salim <jhs@mojatatu.com>
Date: Sat, 10 Oct 2026 17:02:49 -0400
Subject: [PATCH 0621/1982] net/sched: cls_bpf: accept dev-bound programs on
 shared blocks

commit d305547d1632a242818c5ebb430c85121a2ed434 upstream.

The issue:
Follow-up to commit 120977e2c096 ("net/sched: cls_bpf: reject dev-bound
programs bound to a different device"), which derived the target device
from block->q:

	dev = block->q ? qdisc_dev(block->q) : NULL;

tcf_block_create() leaves block->q NULL for shared blocks, so a
device-bound program attached through a shared block is rejected with
-EINVAL even when it is bound to a netdev that owns the block.  The
offload path (cls_bpf_offload_cmd()) never consults block->q and drives
the per-device callbacks for shared blocks as before.

The Fix:
Accept the attach on a shared block when bpf_offload_dev_match() matches
every netdev bound to the block, and reject an empty block.  Every member
must match because the offload path broadcasts the program to every
callback registered on the block, so an any-member check would re-admit
the wrong-device attach on a mixed block.  Every dev-bound SCHED_CLS
attach is skip_sw, which becomes err_stop and aborts the offload on the
first failing callback, so the all-members rule is the offload path's own
semantics.

Iterate the public block->ports xarray (913b47d3424e, v6.8-rc1) rather
than block->owner_list, which is private to cls_api.c.  The shared-block
rejection reports "Program is not bound to every device in the block",
distinct from the non-shared message, because a member can exist without
a registered callback (netdevsim registers its block callback
ingress-only).

Context note:
This patch is not an independent fix: it re-exposes the shared-block
replay path that commit 120977e2c096 ("net/sched: cls_bpf: reject
dev-bound programs bound to a different device") had closed, so patch 1
must be applied first, including in stable.  A stable tree taking this
patch alone would re-enable shared-block attaches on a kernel whose
netdevsim callback is still unchecked.

Conditions to recreate the bug:
  - CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
  - load a dev-bound SCHED_CLS program for netdevsim device B
    (prog_ifindex=B), pin it in bpffs
  - tc qdisc add dev B ingress_block 22 clsact
  - tc filter add block 22 ingress bpf da object-pinned <pin> skip_sw
  Unfixed, the filter add fails with -EINVAL ("Program is bound to a
  different device"); fixed, it succeeds.  Adding a second, independently
  backed netdevsim device to the same block makes the attach fail again.

Fixes: 120977e2c096 ("net/sched: cls_bpf: reject dev-bound programs bound to a different device")
Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
Cc: stable@vger.kernel.org
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-3@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_bpf.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 66b525a852875d..1c7589e91f31bd 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -392,11 +392,31 @@ static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog,
 	if (bpf_prog_is_dev_bound(fp->aux)) {
 		struct tcf_block *block = tp->chain->block;
 		struct net_device *dev;
+		unsigned long ifindex;
+		bool match = false;
+
+		/* A shared block has no qdisc of its own, but it may bind
+		 * several netdevs and the program is offloaded to all of them;
+		 * require a match with every member.
+		 */
+		if (!tcf_block_shared(block)) {
+			dev = qdisc_dev(tcf_block_q(block));
+			match = bpf_offload_dev_match(fp, dev);
+			if (!match)
+				NL_SET_ERR_MSG(extack,
+					       "Program is bound to a different device");
+		} else {
+			xa_for_each(&block->ports, ifindex, dev) {
+				match = bpf_offload_dev_match(fp, dev);
+				if (!match)
+					break;
+			}
+			if (!match)
+				NL_SET_ERR_MSG(extack,
+					       "Program is not bound to every device in the block");
+		}
 
-		dev = block->q ? qdisc_dev(block->q) : NULL;
-		if (!dev || !bpf_offload_dev_match(fp, dev)) {
-			NL_SET_ERR_MSG(extack,
-				       "Program is bound to a different device");
+		if (!match) {
 			bpf_prog_put(fp);
 			return -EINVAL;
 		}

From cdffcb89d84455158d057a6baa87a67225a7f062 Mon Sep 17 00:00:00 2001
From: Yuhang Zheng <z1652074432@gmail.com>
Date: Mon, 12 Oct 2026 09:07:19 +0800
Subject: [PATCH 0622/1982] net/sched: cls_flower: avoid stale mask references
 after delete

commit 58f7989da6e715ce834ac861b7ba6ae9f9bdb098 upstream.

Flower releases a mask reference when a filter is removed from the
classifier. The filter object can remain alive while dump, walk, or
hardware reoffload paths hold a reference to it. Those paths can then
dereference f->mask after the mask has already been released.

Keep the mask reference until the filter reference count reaches zero.
Release the mask synchronously from the final __fl_put() while the caller
still holds the tcf_proto reference, and leave the existing RCU work to
free the mask. This keeps the mask available to every reader that still
holds the filter.

The filter is still removed from the classifier indexes immediately.
Therefore, a deleted filter can temporarily retain an otherwise empty
mask; fl_delete() uses the handle IDR, rather than the mask list, to
determine whether the classifier has become empty.

Failed mask assignment can leave fnew->mask as an error or borrowed
pointer without an owned mask reference. Clear it before the common
failure path so the final put cannot release an unowned reference.

This fix does not add fields, snapshots, or per-filter memory.

Fixes: 92149190067d ("net: sched: flower: set unlocked flag for flower proto ops")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20261012010720.2248662-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_flower.c | 50 +++++++++++++++++++++++-------------------
 1 file changed, 28 insertions(+), 22 deletions(-)

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index cf1f94b559f488..3ebda12ecf2e13 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -522,15 +522,22 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f,
 	tcf_exts_hw_stats_update(&f->exts, &cls_flower.stats, cls_flower.use_act_stats);
 }
 
-static void __fl_put(struct cls_fl_filter *f)
+static bool __fl_put(struct tcf_proto *tp, struct cls_fl_filter *f)
 {
+	bool last = false;
+
 	if (!refcount_dec_and_test(&f->refcnt))
-		return;
+		return false;
+
+	if (f->mask)
+		last = fl_mask_put(fl_head_dereference(tp), f->mask);
 
 	if (tcf_exts_get_net(&f->exts))
 		tcf_queue_work(&f->rwork, fl_destroy_filter_work);
 	else
 		__fl_destroy_filter(f);
+
+	return last;
 }
 
 static struct cls_fl_filter *__fl_get(struct cls_fl_head *head, u32 handle)
@@ -576,11 +583,10 @@ static int __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
 	list_del_rcu(&f->list);
 	spin_unlock(&tp->lock);
 
-	*last = fl_mask_put(head, f->mask);
 	if (!tc_skip_hw(f->flags))
 		fl_hw_destroy_filter(tp, f, rtnl_held, extack);
 	tcf_unbind_filter(tp, &f->res);
-	__fl_put(f);
+	*last = __fl_put(tp, f);
 
 	return 0;
 }
@@ -621,7 +627,7 @@ static void fl_put(struct tcf_proto *tp, void *arg)
 {
 	struct cls_fl_filter *f = arg;
 
-	__fl_put(f);
+	__fl_put(tp, f);
 }
 
 static void *fl_get(struct tcf_proto *tp, u32 handle)
@@ -2492,12 +2498,14 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 	}
 
 	err = fl_check_assign_mask(head, fnew, fold, mask);
-	if (err)
+	if (err) {
+		fnew->mask = NULL;
 		goto unbind_filter;
+	}
 
 	err = fl_ht_insert_unique(fnew, fold, &in_ht);
 	if (err)
-		goto errout_mask;
+		goto unbind_filter;
 
 	if (!tc_skip_hw(fnew->flags)) {
 		err = fl_hw_replace_filter(tp, fnew, rtnl_held, extack);
@@ -2551,7 +2559,6 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 
 		spin_unlock(&tp->lock);
 
-		fl_mask_put(head, fold->mask);
 		if (!tc_skip_hw(fold->flags))
 			fl_hw_destroy_filter(tp, fold, rtnl_held, NULL);
 		tcf_unbind_filter(tp, &fold->res);
@@ -2559,7 +2566,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 		 * after this.
 		 */
 		refcount_dec(&fold->refcnt);
-		__fl_put(fold);
+		__fl_put(tp, fold);
 	} else {
 		idr_replace(&head->handle_idr, fnew, fnew->handle);
 
@@ -2584,9 +2591,6 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 	if (in_ht)
 		rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
 				       fnew->mask->filter_ht_params);
-errout_mask:
-	fl_mask_put(head, fnew->mask);
-
 unbind_filter:
 	if (bound_to_filter) {
 		if (flags & TCA_ACT_FLAGS_NO_RTNL)
@@ -2602,14 +2606,14 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 		idr_remove(&head->handle_idr, fnew->handle);
 		spin_unlock(&tp->lock);
 	}
-	__fl_put(fnew);
+	__fl_put(tp, fnew);
 errout_tb:
 	kfree(tb);
 errout_mask_alloc:
 	tcf_queue_work(&mask->rwork, fl_uninit_mask_free_work);
 errout_fold:
 	if (fold)
-		__fl_put(fold);
+		__fl_put(tp, fold);
 	return err;
 }
 
@@ -2622,8 +2626,10 @@ static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
 	int err = 0;
 
 	err = __fl_delete(tp, f, &last_on_mask, rtnl_held, extack);
-	*last = list_empty(&head->masks);
-	__fl_put(f);
+	spin_lock(&tp->lock);
+	*last = idr_is_empty(&head->handle_idr);
+	spin_unlock(&tp->lock);
+	__fl_put(tp, f);
 
 	return err;
 }
@@ -2645,12 +2651,12 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
 		rcu_read_unlock();
 
 		if (arg->fn(tp, f, arg) < 0) {
-			__fl_put(f);
+			__fl_put(tp, f);
 			arg->stop = 1;
 			rcu_read_lock();
 			break;
 		}
-		__fl_put(f);
+		__fl_put(tp, f);
 		arg->count++;
 		rcu_read_lock();
 	}
@@ -2701,7 +2707,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
 		cls_flower.rule =
 			flow_rule_alloc(tcf_exts_num_actions(&f->exts));
 		if (!cls_flower.rule) {
-			__fl_put(f);
+			__fl_put(tp, f);
 			return -ENOMEM;
 		}
 
@@ -2719,7 +2725,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
 		if (err) {
 			kfree(cls_flower.rule);
 			if (tc_skip_sw(f->flags)) {
-				__fl_put(f);
+				__fl_put(tp, f);
 				return err;
 			}
 			goto next_flow;
@@ -2735,11 +2741,11 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
 		kfree(cls_flower.rule);
 
 		if (err) {
-			__fl_put(f);
+			__fl_put(tp, f);
 			return err;
 		}
 next_flow:
-		__fl_put(f);
+		__fl_put(tp, f);
 	}
 
 	return 0;

From 87d636b302886e9793bb51bf81f797b2c04197e0 Mon Sep 17 00:00:00 2001
From: Jamal Hadi Salim <jhs@mojatatu.com>
Date: Sat, 24 Oct 2026 10:34:14 -0400
Subject: [PATCH 0623/1982] net/sched: sch_teql: fix slaves_lock IRQ deadlock

commit 8b2043279dae25483fe1f2d926e76d41ab95c398 upstream.

This is a followup of commit e5b811fe7931 ("net/sched: sch_teql:
Introduce slaves_lock to avoid race condition and UAF") as reported by
Sashiko.

The issue: master->slaves_lock serializes the master's ring of slave
qdiscs.  The control paths -- teql_dequeue(), teql_destroy() and
teql_qdisc_init() -- take it with spin_lock_bh(), while
teql_master_xmit() (the master's ndo_start_xmit) takes it with plain
spin_lock().

netpoll_send_skb() wraps the transmit in local_irq_save(), and
__netpoll_send_skb() asserts lockdep_assert_irqs_disabled(), so
teql_master_xmit() reached from netconsole always acquires slaves_lock
with hard IRQs disabled.  On PREEMPT_RT spinlock_t is an rtmutex, and
Documentation/locking/locktypes.rst names

	local_irq_disable();
	spin_lock(&lock);

as a sequence that breaks there because the rtmutex requires a fully
preemptible context.  This is reachable without any panic: the nbcon
printer thread calls netconsole's write_thread() callback on every
message.  The usual remedy -- folding the IRQ disable into the lock with
spin_lock_irqsave() -- is unavailable because the local_irq_save() is
netpoll's, not ours.

On non-RT the same asymmetry leaves slaves_lock acquirable with hard IRQs
disabled on one path and held with hard IRQs enabled on another.  That is
only exploitable during the panic console flush (netconsole is
CON_NBCON_ATOMIC_UNSAFE, so console_is_usable() admits its write_atomic()
only from nbcon_atomic_flush_unsafe(), which panic() alone calls), and
even then an IRQ-saving lock does not help if the holder oopsed inside the
section or was stopped by panic_other_cpus_shutdown().  So the non-RT half
is hardening; the PREEMPT_RT half is the bug.

The Fix: take slaves_lock as a raw spinlock with IRQs saved at every
site.  Since skb_queue_purge() takes the queue's spinlock_t and may not
nest inside a raw lock on PREEMPT_RT, move its call in teql_destroy()
outside the raw section; dat->q is the dying qdisc's own queue and was
never serialized by slaves_lock, so the move is behaviour-neutral.

The new critical sections contain only RCU pointer assignments and
netdev_get_tx_queue(); skb_queue_purge(), netif_wake_queue() and
dev_reset_queue() are all outside them.  teql_destroy()'s ring walk is
O(slaves), two pointer loads and a compare per iteration, so even a large
ring is microseconds with IRQs off.  Keeping the purge conditional rather
than dropping it outright is the conservative call for a backport.

Some context: commit 6301f6a34ed8 ("net/sched: sch_teql: move
rcu_read_lock()/spin_lock() from _bh variants") hardened the parent
fix; together they addressed the master->slaves resurrection
use-after-free and the xmit-side BH warning but left the reverse
direction -- a hard IRQ re-entering xmit while a control path holds the
lock -- unaddressed.

Conditions to recreate the bug:
- CONFIG_PREEMPT_RT, CONFIG_NET_SCH_TEQL, CONFIG_DUMMY and
  CONFIG_NETCONSOLE.
- Run `ip link add dev teqlslave0 type dummy`, bring teqlslave0 up, attach
  it with `tc qdisc add dev teqlslave0 root teql0`, and bring teql0 up.
- Configure a netconsole target on teql0 with explicit local and remote
  IP addresses and a remote MAC address, then emit a console message.
  The nbcon printer thread reaches teql_master_xmit() with hard IRQs
  disabled by netpoll; taking slaves_lock as a spinlock_t is invalid on
  PREEMPT_RT. No panic or concurrent qdisc change is required.
- Reachable by an admin with CAP_NET_ADMIN; teql devices exist only in the
  initial netns (no per-netns ops), so a user namespace does not suffice.

Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
Reported-by: Sashiko (gemini) <sashiko-bot@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260630150922.238714-1-jhs%40mojatatu.com
Link: https://lore.kernel.org/netdev/20260630150922.238714-1-jhs@mojatatu.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-1@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_teql.c | 45 +++++++++++++++++++++++++++-----------------
 1 file changed, 28 insertions(+), 17 deletions(-)

diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index d3baf17ebe6ce7..c14e3ea4ab63eb 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -53,7 +53,7 @@ struct teql_master {
 	struct Qdisc_ops qops;
 	struct net_device *dev;
 	struct Qdisc __rcu	*slaves;
-	spinlock_t		slaves_lock; /* serializes writes to ->slaves */
+	raw_spinlock_t		slaves_lock; /* serializes writes to ->slaves */
 	struct list_head master_list;
 	unsigned long	tx_bytes;
 	unsigned long	tx_packets;
@@ -92,6 +92,7 @@ teql_dequeue(struct Qdisc *sch)
 {
 	struct teql_sched_data *dat = qdisc_priv(sch);
 	struct netdev_queue *dat_queue;
+	unsigned long flags;
 	struct sk_buff *skb;
 	struct Qdisc *q;
 
@@ -102,9 +103,9 @@ teql_dequeue(struct Qdisc *sch)
 	if (skb == NULL) {
 		struct net_device *m = qdisc_dev(q);
 		if (m) {
-			spin_lock_bh(&dat->m->slaves_lock);
+			raw_spin_lock_irqsave(&dat->m->slaves_lock, flags);
 			rcu_assign_pointer(dat->m->slaves, sch);
-			spin_unlock_bh(&dat->m->slaves_lock);
+			raw_spin_unlock_irqrestore(&dat->m->slaves_lock, flags);
 			netif_wake_queue(m);
 		}
 	} else {
@@ -137,11 +138,13 @@ teql_destroy(struct Qdisc *sch)
 	struct teql_master *master = dat->m;
 	struct netdev_queue *txq = NULL;
 	bool reset_master_queue = false;
+	unsigned long flags;
+	bool purge = false;
 
 	if (!master)
 		return;
 
-	spin_lock_bh(&master->slaves_lock);
+	raw_spin_lock_irqsave(&master->slaves_lock, flags);
 	prev = rcu_dereference_protected(master->slaves,
 					 lockdep_is_held(&master->slaves_lock));
 	if (prev) {
@@ -169,12 +172,18 @@ teql_destroy(struct Qdisc *sch)
 					reset_master_queue = true;
 				}
 			}
-			skb_queue_purge(&dat->q);
+			purge = true;
 			break;
 		} while (prev != rcu_dereference_protected(master->slaves,
 							   lockdep_is_held(&master->slaves_lock)));
 	}
-	spin_unlock_bh(&master->slaves_lock);
+	raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
+
+	/* skb_queue_purge() takes the queue's spinlock_t, which cannot nest
+	 * inside a raw lock on PREEMPT_RT; purge after the raw section.
+	 */
+	if (purge)
+		skb_queue_purge(&dat->q);
 
 	if (reset_master_queue)
 		dev_reset_queue(master->dev, txq, NULL);
@@ -187,6 +196,7 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
 	struct teql_master *m = (struct teql_master *)sch->ops;
 	struct teql_sched_data *q = qdisc_priv(sch);
 	struct Qdisc *first;
+	unsigned long flags;
 
 	if (dev->hard_header_len > m->dev->hard_header_len)
 		return -EINVAL;
@@ -203,7 +213,7 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
 
 	skb_queue_head_init(&q->q);
 
-	spin_lock_bh(&m->slaves_lock);
+	raw_spin_lock_irqsave(&m->slaves_lock, flags);
 	first = rcu_dereference_protected(m->slaves, lockdep_is_held(&m->slaves_lock));
 	if (first) {
 		if (m->dev->flags & IFF_UP) {
@@ -214,7 +224,7 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
 			    (m->dev->flags & IFF_MULTICAST &&
 			     !(dev->flags & IFF_MULTICAST)) ||
 			    dev->mtu < m->dev->mtu) {
-				spin_unlock_bh(&m->slaves_lock);
+				raw_spin_unlock_irqrestore(&m->slaves_lock, flags);
 				return -EINVAL;
 			}
 		} else {
@@ -237,7 +247,7 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
 		m->dev->mtu = dev->mtu;
 		m->dev->flags = (m->dev->flags&~FMASK)|(dev->flags&FMASK);
 	}
-	spin_unlock_bh(&m->slaves_lock);
+	raw_spin_unlock_irqrestore(&m->slaves_lock, flags);
 	return 0;
 }
 
@@ -302,11 +312,12 @@ static inline int teql_resolve(struct sk_buff *skb,
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct teql_master *master = netdev_priv(dev);
-	struct Qdisc *start, *q;
-	int busy;
-	int nores;
 	int subq = skb_get_queue_mapping(skb);
 	struct sk_buff *skb_res = NULL;
+	struct Qdisc *start, *q;
+	unsigned long flags;
+	int nores;
+	int busy;
 
 restart:
 	nores = 0;
@@ -342,13 +353,13 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 				    netdev_start_xmit(skb, slave, slave_txq, false) ==
 				    NETDEV_TX_OK) {
 					__netif_tx_unlock(slave_txq);
-					spin_lock(&master->slaves_lock);
+					raw_spin_lock_irqsave(&master->slaves_lock, flags);
 					if (rcu_dereference_protected(master->slaves,
 								      lockdep_is_held(&master->slaves_lock)) == q)
 						rcu_assign_pointer(master->slaves,
 								   rcu_dereference_protected(NEXT_SLAVE(q),
 											     lockdep_is_held(&master->slaves_lock)));
-					spin_unlock(&master->slaves_lock);
+					raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
 					netif_wake_queue(dev);
 					master->tx_packets++;
 					master->tx_bytes += length;
@@ -361,13 +372,13 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 				busy = 1;
 			break;
 		case 1:
-			spin_lock(&master->slaves_lock);
+			raw_spin_lock_irqsave(&master->slaves_lock, flags);
 			if (rcu_dereference_protected(master->slaves,
 						      lockdep_is_held(&master->slaves_lock)) == q)
 				rcu_assign_pointer(master->slaves,
 						   rcu_dereference_protected(NEXT_SLAVE(q),
 									     lockdep_is_held(&master->slaves_lock)));
-			spin_unlock(&master->slaves_lock);
+			raw_spin_unlock_irqrestore(&master->slaves_lock, flags);
 			rcu_read_unlock();
 			return NETDEV_TX_OK;
 		default:
@@ -489,7 +500,7 @@ static __init void teql_master_setup(struct net_device *dev)
 	struct teql_master *master = netdev_priv(dev);
 	struct Qdisc_ops *ops = &master->qops;
 
-	spin_lock_init(&master->slaves_lock);
+	raw_spin_lock_init(&master->slaves_lock);
 	master->dev	= dev;
 	ops->priv_size  = sizeof(struct teql_sched_data);
 

From fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde Mon Sep 17 00:00:00 2001
From: owen kwan <owen@verialabs.com>
Date: Sat, 24 Oct 2026 10:34:15 -0400
Subject: [PATCH 0624/1982] net/sched: sch_teql: fix use-after-free on lower
 qdisc drop

commit 782d6bb8f9b8e9d8591181662222bf74cd3ecf79 upstream.

The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return
value against NETDEV_TX_OK alone. A slave that consumes the skb but
returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated
as if the skb were still owned, so the loop restores skb->dev and calls
__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()
from its ndo_start_xmit() (propagated since cbbef5e18307), and when the
lower qdisc drops the packet that value is NET_XMIT_DROP after the skb
has been freed, giving a use-after-free in teql_master_xmit().

The Fix: test for consumption with dev_xmit_complete(), which accepts
NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that
need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps
the packet counted in tx_packets/tx_bytes and advances the slave; a
consumed result that is neither a success nor NET_XMIT_CN ends the
attempt and is charged to tx_dropped, so lower-qdisc drops are no longer
reported as good transmits. NET_XMIT_CN is counted like success because
it can accompany acceptance of the current packet: pfifo_head_drop drops
the old head, enqueues the current skb and returns NET_XMIT_CN.

Conditions to recreate the bug:
With CONFIG_NET_SCH_TEQL,
CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and
lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0
and a teql0 root on lkrvlan0; bring teql0 up with an address and send one
UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower
qdisc while holding a freed skb.

Fixes: 572a9d7b6fc7 ("net: allow to propagate errors through ->ndo_hard_start_xmit()")
Link: https://lore.kernel.org/netdev/179248763469.3135.1739559328868319628@kernel.org/
Link: https://lore.kernel.org/netdev/20261023162821.GN708417@horms.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: owen kwan <owen@verialabs.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-2@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_teql.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index c14e3ea4ab63eb..d0e81d1d553c0f 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -347,12 +347,18 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 		case 0:
 			if (__netif_tx_trylock(slave_txq)) {
 				unsigned int length = qdisc_pkt_len(skb);
+				int rc = NETDEV_TX_BUSY;
 
 				skb->dev = slave;
-				if (!netif_xmit_frozen_or_stopped(slave_txq) &&
-				    netdev_start_xmit(skb, slave, slave_txq, false) ==
-				    NETDEV_TX_OK) {
-					__netif_tx_unlock(slave_txq);
+				if (!netif_xmit_frozen_or_stopped(slave_txq))
+					rc = netdev_start_xmit(skb, slave, slave_txq, false);
+				__netif_tx_unlock(slave_txq);
+				if (dev_xmit_complete(rc)) {
+					if (rc != NETDEV_TX_OK && rc != NET_XMIT_CN) {
+						master->tx_dropped++;
+						rcu_read_unlock();
+						return NETDEV_TX_OK;
+					}
 					raw_spin_lock_irqsave(&master->slaves_lock, flags);
 					if (rcu_dereference_protected(master->slaves,
 								      lockdep_is_held(&master->slaves_lock)) == q)
@@ -366,7 +372,6 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 					rcu_read_unlock();
 					return NETDEV_TX_OK;
 				}
-				__netif_tx_unlock(slave_txq);
 			}
 			if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)))
 				busy = 1;

From a3486bfb9d098473516cc0ec13061030d9f5c518 Mon Sep 17 00:00:00 2001
From: Antonio Quartulli <antonio@mandelbit.com>
Date: Mon, 26 Oct 2026 16:31:12 +0100
Subject: [PATCH 0625/1982] net/sched: fix packet reordering on requeue

commit 14368b9aa1017fee35d2589be7b17e0485c0f93e upstream.

dev_requeue_skb() appends requeued skbs to the tail of q->gso_skb, while
dequeue_skb() takes them back one at a time from the head. If the driver
returns NETDEV_TX_BUSY again for the first of them, it moves behind the
skbs still parked there and is sent after them.

This showed up as heavy TCP reordering while benchmarking over veth,
which returns NETDEV_TX_BUSY whenever its ring is full since
commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops").

Requeue the skbs at the head of gso_skb, keeping their order. With 4 TCP
streams over a veth pair with a pfifo qdisc, this removes about 1.3M
out-of-order segments and 15-37k retransmits per 15 seconds, and raises
throughput from about 40 to 76 Gbit/s.

Fixes: a53851e2c321 ("net: sched: explicit locking in gso_cpu fallback")
Fixes: 9540d977618c ("net: sched: fix skb leak in dev_requeue_skb()")
Cc: stable@vger.kernel.org
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20261026153113.3275494-1-antonio@mandelbit.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_generic.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index bf8bd129ce911b..26085d31be47c5 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -143,8 +143,11 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
 
 static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
+	struct sk_buff_head requeue;
 	spinlock_t *lock = NULL;
 
+	__skb_queue_head_init(&requeue);
+
 	if (q->flags & TCQ_F_NOLOCK) {
 		lock = qdisc_lock(q);
 		spin_lock(lock);
@@ -153,7 +156,7 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 	while (skb) {
 		struct sk_buff *next = skb->next;
 
-		__skb_queue_tail(&q->gso_skb, skb);
+		__skb_queue_tail(&requeue, skb);
 
 		/* it's still part of the queue */
 		if (qdisc_is_percpu_stats(q)) {
@@ -169,6 +172,11 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 		skb = next;
 	}
 
+	/* the skbs may come from the head of gso_skb, so put them back there:
+	 * appending them would let the ones still parked overtake them
+	 */
+	skb_queue_splice(&requeue, &q->gso_skb);
+
 	if (lock) {
 		spin_unlock(lock);
 		set_bit(__QDISC_STATE_MISSED, &q->state);

From 2f1111eb40d7c27d2261c012df42bfe0e3e4e627 Mon Sep 17 00:00:00 2001
From: Jamal Hadi Salim <jhs@mojatatu.com>
Date: Wed, 28 Oct 2026 13:27:03 +0100
Subject: [PATCH 0626/1982] net/sched: act_ife: do not consume the inner header
 on egress

commit 498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7 upstream.

The issue:
tcf_ife_decode() unconditionally calls eth_type_trans(), which pulls
ETH_HLEN.  On egress this consumes the inner Ethernet header, and the
device receives an skb whose data points to the L3 header:

- loopback_xmit() parses L3 data as Ethernet: the "ethertype" comes
  from the inner IPv4 source address, and the decapsulated packet is
  dropped or misparsed.
- a real NIC transmits the frame without its Ethernet header.

(The __skb_pull() BUG this used to trigger in loopback_xmit() when the
remaining linear area was short is handled by "loopback: use
eth_type_trans_careful()".)

The Fix:
Parse the inner Ethernet header with eth_type_trans() in both directions,
then restore the egress data position and MAC length.  On ingress the
existing behavior is unchanged.  On egress, push the inner Ethernet header
back after parsing so the xmit path sees the original frame and later
actions see a consistent network header.

Conditions to recreate the bug:
- egress tc filter on lo: action ife decode pipe;
- AF_PACKET SOCK_RAW frame: outer Ethernet with ETH_P_IFE, IFE metadata,
  inner Ethernet + a valid IPv4 ICMP echo request to a local address;
- before this patch, no echo is received; after it, the echo is
  delivered and answered.

Fixes: ef6980b6becb ("introduce IFE action")
Cc: stable@vger.kernel.org
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
[edumazet: reworded changelog, the crash is now handled in loopback]
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261028122703.2093730-6-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_ife.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index b0d66ba80baad1..cd8c8418ec0d8b 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -762,6 +762,10 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 
 	skb->protocol = eth_type_trans(skb, skb->dev);
 	skb_reset_network_header(skb);
+	if (!skb_at_tc_ingress(skb)) {
+		skb_push(skb, ETH_HLEN);
+		skb_reset_mac_len(skb);
+	}
 
 	return action;
 }

From 4a9a39ef6da4a3447e97033ec53077094fc2d69c Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 14 Oct 2026 15:31:08 +0200
Subject: [PATCH 0627/1982] driver core: take parent lock on deferred probe

commit 4059f8986c8f50102a04335cc1da4921dfd262d8 upstream.

USB interfaces should be probed with the parent USB device lock held,
but this is not honoured when probe is deferred.

Add a new bus_probe_device_deferred() helper to handle deferred probe
where the parent device lock is not held.

Fixes: d1c3414c2a9d ("drivercore: Add driver probe deferral mechanism")
Reported-by: Mario Peter <mario.peter@leica-geosystems.com>
Link: https://lore.kernel.org/20261007131514.1260696-1-mario.peter@leica-geosystems.com
Cc: stable@vger.kernel.org	# 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-3-johan@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/base.h |  1 +
 drivers/base/bus.c  | 28 +++++++++++++++++++++-------
 drivers/base/dd.c   |  7 ++++---
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/drivers/base/base.h b/drivers/base/base.h
index 86fa7fbb354891..7596c106bfa0b5 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -151,6 +151,7 @@ struct kobject *virtual_device_parent(void);
 
 int bus_add_device(struct device *dev);
 void bus_probe_device(struct device *dev);
+void bus_probe_device_deferred(struct device *dev);
 void bus_remove_device(struct device *dev);
 void bus_notify(struct device *dev, enum bus_notifier_event value);
 bool bus_is_registered(const struct bus_type *bus);
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index e5e700429f538b..75fcf08507320a 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -565,13 +565,7 @@ int bus_add_device(struct device *dev)
 	return error;
 }
 
-/**
- * bus_probe_device - probe drivers for a new device
- * @dev: device to probe
- *
- * - Automatically probe for a driver if the bus allows it.
- */
-void bus_probe_device(struct device *dev)
+static void __bus_probe_device(struct device *dev)
 {
 	struct subsys_private *sp = bus_to_subsys(dev->bus);
 	struct subsys_interface *sif;
@@ -590,6 +584,26 @@ void bus_probe_device(struct device *dev)
 	subsys_put(sp);
 }
 
+/**
+ * bus_probe_device - probe drivers for a new device
+ * @dev: device to probe
+ *
+ * - Automatically probe for a driver if the bus allows it.
+ */
+void bus_probe_device(struct device *dev)
+{
+	__bus_probe_device(dev);
+}
+
+void bus_probe_device_deferred(struct device *dev)
+{
+	if (dev->type && dev->type->need_parent_lock)
+		device_lock(dev->parent);
+	__bus_probe_device(dev);
+	if (dev->type && dev->type->need_parent_lock)
+		device_unlock(dev->parent);
+}
+
 /**
  * bus_remove_device - remove device from bus
  * @dev: device to be removed
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d019d0f98ad47c..008b6e52e67f94 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -86,8 +86,9 @@ static void deferred_probe_work_func(struct work_struct *work)
 	/*
 	 * This block processes every device in the deferred 'active' list.
 	 * Each device is removed from the active list and passed to
-	 * bus_probe_device() to re-attempt the probe.  The loop continues
-	 * until every device in the active list is removed and retried.
+	 * bus_probe_device_deferred() to re-attempt the probe.  The loop
+	 * continues until every device in the active list is removed and
+	 * retried.
 	 *
 	 * Note: Once the device is removed from the list and the mutex is
 	 * released, it is possible for the device get freed by another thread
@@ -121,7 +122,7 @@ static void deferred_probe_work_func(struct work_struct *work)
 		device_pm_move_to_tail(dev);
 
 		dev_dbg(dev, "Retrying from deferred list\n");
-		bus_probe_device(dev);
+		bus_probe_device_deferred(dev);
 		mutex_lock(&deferred_probe_mutex);
 
 		put_device(dev);

From 890096a9e7c26a43634f6cba5565fffc082bb111 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 27 Oct 2026 18:18:19 +0100
Subject: [PATCH 0628/1982] driver core: Limit the messages on a refused uevent

commit a01c8e5b1dff1ce489e6b339139e744db36b8bb3 upstream.

A write to a "uevent" file which is no valid action makes
kobject_synth_uevent() print a warning and uevent_store() an error every
time.  This is generally considered a bad thing so rate limit these
messages.

Fixes: b0e37c0d8a6a ("net-sysfs: make sure objects belong to container's owner")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/2026102718-conduit-glorious-a8dc@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c  | 4 +++-
 lib/kobject_uevent.c | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 5ba783e5055ae4..829eaef49db898 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2840,7 +2840,9 @@ static ssize_t uevent_store(struct device *dev, struct device_attribute *attr,
 	rc = kobject_synth_uevent(&dev->kobj, buf, count);
 
 	if (rc) {
-		dev_err(dev, "uevent: failed to send synthetic uevent: %d\n", rc);
+		dev_err_ratelimited(dev,
+				    "uevent: failed to send synthetic uevent: %d\n",
+				    rc);
 		return rc;
 	}
 
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 78e16b95d2101a..5a2480467ab987 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -223,9 +223,9 @@ int kobject_synth_uevent(struct kobject *kobj, const char *buf, size_t count)
 out:
 	if (r) {
 		devpath = kobject_get_path(kobj, GFP_KERNEL);
-		pr_warn("synth uevent: %s: %s\n",
-		       devpath ?: "unknown device",
-		       msg ?: "failed to send uevent");
+		pr_warn_ratelimited("synth uevent: %s: %s\n",
+				    devpath ?: "unknown device",
+				    msg ?: "failed to send uevent");
 		kfree(devpath);
 	}
 	return r;

From d4bded35edf8d9cd5133dd934a71c3268f89f501 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 14 Oct 2026 15:31:07 +0200
Subject: [PATCH 0629/1982] driver core: fix parent lock use-after-free on USB
 disconnect

commit 0f554506a3fc6a21e714adf38cc3eb0ffe1bb452 upstream.

USB interfaces should be probed with their parent USB device lock held
and the USB bus therefore sets the need_parent_lock bus flag so that
driver core takes the parent lock when needed.

Driver core is only guaranteed to hold a reference to the parent device
during initial probe however and nothing prevents the device and its
parent from being deregistered and the parent potentially freed, for
example, while iterating over devices in driver_attach() or
bus_rescan_devices_helper().

Since commit 524134d42231 ("USB: don't cancel queued resets when
unbinding drivers") USB interfaces hold a reference to their parent USB
device, but a parent hub may still go away while probing a USB device
(e.g. via the drivers_probe sysfs interface). This can lead to a
use-after-free when taking the parent device lock before checking the
device->p->dead flag of the device being probed.

As only USB interfaces actually need the parent lock, make the
need_parent_lock feature even more fine grained by making it a device
type rather than bus feature. By requiring that any users also make sure
that their devices hold a reference to their parents (like USB does),
driver core can lock a device and its parent without first checking if
the device has been deregistered.

Note that this will also increase parallelism when using asynchronous
probe as USB devices connected to the same hub can now be probed in
parallel.

Fixes: bf74ad5bc417 ("[PATCH] Hold the device's parent's lock during probe and remove")
Cc: stable@vger.kernel.org	# 2.6.16: 524134d42231: USB: don't cancel queued resets when unbinding drivers
Cc: stable@vger.kernel.org	# 2.6.16
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-2-johan@kernel.org
[ Fix mention of bus vs. device type in __device_driver_{un}lock().
  - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/bus.c         | 4 ++--
 drivers/base/dd.c          | 8 ++++----
 drivers/usb/core/driver.c  | 1 -
 drivers/usb/core/message.c | 1 +
 include/linux/device.h     | 5 +++++
 include/linux/device/bus.h | 3 ---
 6 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 75fcf08507320a..5e73e0bdb11274 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -826,10 +826,10 @@ static int __must_check bus_rescan_devices_helper(struct device *dev,
 	int ret = 0;
 
 	if (!dev->driver) {
-		if (dev->parent && dev->bus->need_parent_lock)
+		if (dev->type && dev->type->need_parent_lock)
 			device_lock(dev->parent);
 		ret = device_attach(dev);
-		if (dev->parent && dev->bus->need_parent_lock)
+		if (dev->type && dev->type->need_parent_lock)
 			device_unlock(dev->parent);
 	}
 	return ret < 0 ? ret : 0;
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 008b6e52e67f94..6ae212614e5448 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1163,7 +1163,7 @@ void device_initial_probe(struct device *dev)
 /*
  * __device_driver_lock - acquire locks needed to manipulate dev->drv
  * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the bus requires parent lock
+ * @parent: Parent device. Needed if the device type requires parent lock
  *
  * This function will take the required locks for manipulating dev->drv.
  * Normally this will just be the @dev lock, but when called for a USB
@@ -1171,7 +1171,7 @@ void device_initial_probe(struct device *dev)
  */
 static void __device_driver_lock(struct device *dev, struct device *parent)
 {
-	if (parent && dev->bus->need_parent_lock)
+	if (dev->type && dev->type->need_parent_lock && parent)
 		device_lock(parent);
 	device_lock(dev);
 }
@@ -1179,7 +1179,7 @@ static void __device_driver_lock(struct device *dev, struct device *parent)
 /*
  * __device_driver_unlock - release locks needed to manipulate dev->drv
  * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the bus requires parent lock
+ * @parent: Parent device. Needed if the device type requires parent lock
  *
  * This function will release the required locks for manipulating dev->drv.
  * Normally this will just be the @dev lock, but when called for a
@@ -1188,7 +1188,7 @@ static void __device_driver_lock(struct device *dev, struct device *parent)
 static void __device_driver_unlock(struct device *dev, struct device *parent)
 {
 	device_unlock(dev);
-	if (parent && dev->bus->need_parent_lock)
+	if (dev->type && dev->type->need_parent_lock && parent)
 		device_unlock(parent);
 }
 
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index acd05f87b8e141..2582895d480f6c 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -2083,5 +2083,4 @@ const struct bus_type usb_bus_type = {
 	.name =		"usb",
 	.match =	usb_device_match,
 	.uevent =	usb_uevent,
-	.need_parent_lock =	true,
 };
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index e291cec42c992c..2dd5def9dfb418 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1920,6 +1920,7 @@ const struct device_type usb_if_device_type = {
 	.name =		"usb_interface",
 	.release =	usb_release_interface,
 	.uevent =	usb_if_uevent,
+	.need_parent_lock =	true,
 };
 
 static struct usb_interface_assoc_descriptor *find_iad(struct usb_device *dev,
diff --git a/include/linux/device.h b/include/linux/device.h
index 56e5a9314367dc..e0d1ff5f95f6bb 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -84,6 +84,10 @@ int subsys_virtual_register(const struct bus_type *subsys,
  * information, equivalent to the kobj_type of a kobject.
  * If "name" is specified, the uevent will contain it in
  * the DEVTYPE variable.
+ *
+ * @need_parent_lock:	When probing or removing a device of this type,
+ *			driver core should lock the device's parent. Note that
+ *			the device must hold a reference to its parent.
  */
 struct device_type {
 	const char *name;
@@ -94,6 +98,7 @@ struct device_type {
 	void (*release)(struct device *dev);
 
 	const struct dev_pm_ops *pm;
+	bool need_parent_lock;
 };
 
 /**
diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h
index 15de0d7881f9ec..cc833c601684cd 100644
--- a/include/linux/device/bus.h
+++ b/include/linux/device/bus.h
@@ -66,8 +66,6 @@ struct fwnode_handle;
  * @driver_override:	Set to true if this bus supports the driver_override
  *			mechanism, which allows userspace to force a specific
  *			driver to bind to a device via a sysfs attribute.
- * @need_parent_lock:	When probing or removing a device on this bus, the
- *			device core should lock the device's parent.
  *
  * A bus is a channel between the processor and one or more devices. For the
  * purposes of the device model, all devices are connected via a bus, even if
@@ -108,7 +106,6 @@ struct bus_type {
 	const struct dev_pm_ops *pm;
 
 	bool driver_override;
-	bool need_parent_lock;
 };
 
 int __must_check bus_register(const struct bus_type *bus);

From f204bb7c5d10482067e095af567c391bc88ecb44 Mon Sep 17 00:00:00 2001
From: Kameron Carr <kameroncarr@linux.microsoft.com>
Date: Mon, 19 Oct 2026 16:09:46 -0700
Subject: [PATCH 0630/1982] Drivers: hv: vmbus: Bounds check the shared ring
 buffer indices

commit 1d287c17cc5bfd6386fe0770999be410b248d021 upstream.

In a CoCo VM the host is untrusted. Since the VMBus ring buffer read and
write indices live in shared memory, the guest has to treat both as
potentially malicious.

hv_ringbuffer_write() copies into the ring at write_index with no bounds
checking, so the host can make the guest write packet data at any offset
up to 4 GiB past the start of the ring buffer. read_index matters too:
the available space derived from both indices is the only bound on how
much is copied, and an out-of-range index can make it far larger than
the ring.

The fix is to validate both indices before use and to use the validated
snapshot instead of re-accessing. For invalid indices,
hv_ringbuffer_write() logs and returns -EIO.

One re-read of write_index is left unchecked in this patch:
hv_get_ring_bufferindices() fetches it again for the prev_indices
trailer. The value is only returned to the host and is not used as an
offset or length for indexing. Since this is not a security issue, it is
addressed later in the series.

Open-coding the bytes available arithmetic keeps the fix free of
prerequisites; a later patch refactors it into a helper function.

Fixes: 3e7ee4902fe6 ("Staging: hv: add the Hyper-V virtual bus")
Cc: stable@vger.kernel.org # 5.15.x
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Kameron Carr <kameroncarr@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hv/ring_buffer.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 23ce1fb70de143..af2b4eada92a67 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -70,15 +70,6 @@ static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel)
 	}
 }
 
-/* Get the next write location for the specified ring buffer. */
-static inline u32
-hv_get_next_write_location(struct hv_ring_buffer_info *ring_info)
-{
-	u32 next = ring_info->ring_buffer->write_index;
-
-	return next;
-}
-
 /* Set the next write location for the specified ring buffer. */
 static inline void
 hv_set_next_write_location(struct hv_ring_buffer_info *ring_info,
@@ -282,6 +273,7 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
 	u32 totalbytes_towrite = sizeof(u64);
 	u32 next_write_location;
 	u32 old_write;
+	u32 read_index;
 	u64 prev_indices;
 	unsigned long flags;
 	struct hv_ring_buffer_info *outring_info = &channel->outbound;
@@ -296,7 +288,20 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
 
 	spin_lock_irqsave(&outring_info->ring_lock, flags);
 
-	bytes_avail_towrite = hv_get_bytes_to_write(outring_info);
+	read_index = READ_ONCE(outring_info->ring_buffer->read_index);
+	old_write = READ_ONCE(outring_info->ring_buffer->write_index);
+	if (unlikely(read_index >= outring_info->ring_datasize ||
+		     old_write >= outring_info->ring_datasize)) {
+		spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+		pr_err_ratelimited("outbound ring indices out of range: relid %u read %u write %u size %u\n",
+				   channel->offermsg.child_relid, read_index,
+				   old_write, outring_info->ring_datasize);
+		return -EIO;
+	}
+
+	bytes_avail_towrite = old_write >= read_index ?
+		outring_info->ring_datasize - (old_write - read_index) :
+		read_index - old_write;
 
 	/*
 	 * If there is only room for the packet, assume it is full.
@@ -318,9 +323,7 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
 	channel->out_full_flag = false;
 
 	/* Write to the ring buffer */
-	next_write_location = hv_get_next_write_location(outring_info);
-
-	old_write = next_write_location;
+	next_write_location = old_write;
 
 	for (i = 0; i < kv_count; i++) {
 		next_write_location = hv_copyto_ringbuffer(outring_info,

From cf41ae5149f1eddbc874e5d1fa68708c1b7ee546 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 2 Oct 2026 23:04:39 -0400
Subject: [PATCH 0631/1982] backlight: lm3630a: Cancel delayed work before
 destroying workqueue

commit 2cf184caab8b406fdd9db126ee40d62418237456 upstream.

The interrupt handler queues delayed work to read the interrupt status.
After free_irq() stops the producer, this work can still be waiting on its
timer. destroy_workqueue() cannot drain delayed work that has not yet been
queued by its timer, so the timer can outlive both the workqueue and the
devm-allocated chip containing the work.

Cancel the delayed work synchronously after freeing the IRQ and before
destroying the workqueue. This also waits for any running status read to
finish before the chip's resources are released.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20261003030439.599330-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/lm3630a_bl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
index 37651c2b939330..cdfef511c8035c 100644
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -591,6 +591,7 @@ static void lm3630a_remove(struct i2c_client *client)
 
 	if (pchip->irq) {
 		free_irq(pchip->irq, pchip);
+		cancel_delayed_work_sync(&pchip->work);
 		destroy_workqueue(pchip->irqthread);
 	}
 }

From 8eee3226bccd34d7edced8913968a72a9c50d3b3 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Mon, 21 Sep 2026 12:46:22 +0200
Subject: [PATCH 0632/1982] backlight: qcom-wled: Fix NULL pointer dereference
 in wled_remove()

commit 1dbd46d4b2fb416a8202b1a8e4ef9d0cadbe075f upstream.

wled_probe() doesn't set the driver data for the platform device.
As a result, platform_get_drvdata() in wled_remove() will return NULL,
and the first dereference of it crashes on unbind.

Set the platform device driver data in wled_probe().

Cc: stable@vger.kernel.org
Fixes: feeab87b3072 ("backlight: qcom-wled: Add support for short circuit handling")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-1-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/qcom-wled.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 8054e4787725ef..93761f7a79c296 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1682,6 +1682,7 @@ static int wled_probe(struct platform_device *pdev)
 
 	wled->regmap = regmap;
 	wled->dev = &pdev->dev;
+	platform_set_drvdata(pdev, wled);
 
 	wled->version = (uintptr_t)of_device_get_match_data(&pdev->dev);
 	if (!wled->version) {

From e9bff555cc77ecb80c7fb7a816b1351ea4d5c738 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Mon, 21 Sep 2026 12:46:24 +0200
Subject: [PATCH 0633/1982] backlight: qcom-wled: Fix unbalanced OVP IRQ enable
 at probe

commit 5eda6b51461932f9fd835ef9e4574650c69c4fe8 upstream.

wled_configure_ovp_irq() derives the initial state of the OVP interrupt
from the hardware:

        /* Keep OVP irq disabled until module is enabled */
        if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
                disable_irq(wled->ovp_irq);

but wled->brightness, which is what the rest of the driver uses to tell
whether the module is on, is left at zero.

On boards where the bootloader hands the kernel a lit backlight the two
disagree. MOD_EN is already set, so the interrupt is left enabled, while
wled_update_status() still believes the backlight is off and takes

        if (!!brightness != !!wled->brightness)
                rc = wled_module_enable(wled, !!brightness);

on the first backlight update. wled_module_enable() then schedules
wled_ovp_work(), which calls enable_irq() on the already enabled
interrupt:

  Unbalanced enable for IRQ 176
  WARNING: CPU: 0 PID: 160 at kernel/irq/manage.c:774 __enable_irq+0x50/0x80
  Hardware name: Xiaomi Pocophone F1 (DT)
  Workqueue: events wled_ovp_work
  Call trace:
   __enable_irq+0x50/0x80
   enable_irq+0x48/0xa0
   wled_ovp_work+0x18/0x24
   process_one_work+0x1d0/0x350
   worker_thread+0x13c/0x460
   kthread+0x110/0x114
   ret_from_fork+0x10/0x20

The bootloader is not the only way to get there. The readback runs after
wledN_setup(), and wled4_setup() sets MOD_EN itself on the path where the
sink configuration does not already match, as does the tail of
wled_auto_string_detection(), which all three setup paths can reach
through wled_auto_detection_at_init(). A cold-booted board with a dark
panel can therefore reach the same disagreement.

Move the MOD_EN readback into wled_probe() and use it to seed
wled->brightness, so the driver starts out agreeing with the hardware,
and key the OVP interrupt off wled->brightness instead. The first
backlight update then only reprograms the brightness registers and
leaves both the module and the interrupt alone. The OVP interrupt also
stays armed from probe whenever the module is already enabled, rather
than being disabled at probe and only enabled once something writes
brightness.

Note that a backlight update requesting brightness 0 before any non-zero
one now really does turn the module off wherever MOD_EN was already set,
where before it was silently ignored.

wled->brightness is seeded with default-brightness rather than the level
the bootloader actually programmed, so the first update can still step
the brightness. Reading that level back is version specific and is done
in a follow-up, to keep this fix small enough to backport.

Assisted-by: LLM
Fixes: 8663c188beea ("backlight: qcom-wled: Add auto string detection logic")
Cc: stable@vger.kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-3-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/qcom-wled.c | 32 +++++++++++++++++++----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 93761f7a79c296..b851cabd6c1882 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1627,7 +1627,6 @@ static int wled_configure_ovp_irq(struct wled *wled,
 				  struct platform_device *pdev)
 {
 	int rc;
-	u32 val;
 
 	wled->ovp_irq = platform_get_irq_byname(pdev, "ovp");
 	if (wled->ovp_irq < 0) {
@@ -1645,13 +1644,8 @@ static int wled_configure_ovp_irq(struct wled *wled,
 		return 0;
 	}
 
-	rc = regmap_read(wled->regmap, wled->ctrl_addr +
-			 WLED3_CTRL_REG_MOD_EN, &val);
-	if (rc < 0)
-		return rc;
-
-	/* Keep OVP irq disabled until module is enabled */
-	if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
+	/* Keep the OVP irq disabled until the module is enabled */
+	if (!wled->brightness)
 		disable_irq(wled->ovp_irq);
 
 	return 0;
@@ -1667,6 +1661,7 @@ static int wled_probe(struct platform_device *pdev)
 	struct backlight_device *bl;
 	struct wled *wled;
 	struct regmap *regmap;
+	u32 mod_en;
 	u32 val;
 	int rc;
 
@@ -1737,6 +1732,24 @@ static int wled_probe(struct platform_device *pdev)
 
 	INIT_DELAYED_WORK(&wled->ovp_work, wled_ovp_work);
 
+	val = WLED_DEFAULT_BRIGHTNESS;
+	of_property_read_u32(pdev->dev.of_node, "default-brightness", &val);
+
+	/*
+	 * The module may already be enabled, either by a bootloader that left
+	 * the backlight lit or by the setup above. Record that, so that the
+	 * first brightness update does not enable an already enabled module,
+	 * and so that the OVP irq is armed from probe rather than from that
+	 * first update.
+	 */
+	rc = regmap_read(wled->regmap, wled->ctrl_addr + WLED3_CTRL_REG_MOD_EN,
+			 &mod_en);
+	if (rc < 0)
+		return rc;
+
+	if (mod_en & WLED3_CTRL_REG_MOD_EN_MASK)
+		wled->brightness = val;
+
 	rc = wled_configure_short_irq(wled, pdev);
 	if (rc < 0)
 		return rc;
@@ -1745,9 +1758,6 @@ static int wled_probe(struct platform_device *pdev)
 	if (rc < 0)
 		return rc;
 
-	val = WLED_DEFAULT_BRIGHTNESS;
-	of_property_read_u32(pdev->dev.of_node, "default-brightness", &val);
-
 	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.brightness = val;

From d85edc8f06eeffb583044098b7877b132f9517fe Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Mon, 21 Sep 2026 12:46:23 +0200
Subject: [PATCH 0634/1982] backlight: qcom-wled: Fix WLED3 brightness register
 stride

commit e60dc9c05e0f415ef8bc63b3179abdd49830a619 upstream.

WLED3 has a 16-bit brightness register pair per string, at 0x40 + 2*n,
which is what the pm8941-wled driver wrote to:

	rc = regmap_bulk_write(wled->regmap,
			wled->addr + WLED3_CTRL_REG_VAL_BASE + 2 * i,
			v, 2);

The restructuring for WLED3 turned that into WLED3_SINK_REG_BRIGHT(n),
defined as 0x40 + n, so the two byte writes for consecutive strings
overlap: string 1 overwrites the MSB of string 0 with its own LSB, and
with the default three strings only string 1 ends up with the requested
value.

Use the 2 byte stride.

Fixes: 775d2ffb4af6 ("backlight: qcom-wled: Restructure the driver for WLED3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-2-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/qcom-wled.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index b851cabd6c1882..f57af80dedff2c 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -59,7 +59,7 @@
 #define  WLED3_SINK_REG_CURR_SINK_SHFT			5
 
 /* WLED3 specific per-'string' registers below */
-#define WLED3_SINK_REG_BRIGHT(n)			(0x40 + n)
+#define WLED3_SINK_REG_BRIGHT(n)			(0x40 + (n * 0x2))
 
 #define WLED3_SINK_REG_STR_MOD_EN(n)			(0x60 + (n * 0x10))
 #define  WLED3_SINK_REG_STR_MOD_MASK			BIT(7)

From be28566c8264b9ae3d5e9b6bdce19d311bf918eb Mon Sep 17 00:00:00 2001
From: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Date: Mon, 19 Oct 2026 21:11:16 +0200
Subject: [PATCH 0635/1982] ksmbd: accept share config responses from
 ksmbd-tools before 3.5.3

commit 4f1ce9ffb996a524acf864316479a7806ae500c6 upstream.

ksmbd-tools releases before 3.5.2 do not have the payload_sz field in
struct ksmbd_share_config_response; the field occupies the last word of
their reserved[] area, so the kernel always sees payload_sz == 0 from
them.  ipc_validate_msg() and share_config_request() used to treat
payload_sz == 0 as "legacy userspace" and skip the payload size checks.

That case was removed by
commit f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config
responses").
With payload_sz == 0:

 - the IPC$ (pipe) response fails the final message size comparison:
   these tools always send a one-byte payload, so msg_sz is
   sizeof(*resp) + 1, but the expected size is now computed as
   sizeof(*resp) + 0;
 - every other share fails "payload_sz <= veto_list_sz".

In addition, ksmbd-tools before 3.5.3 copy a global "veto files" setting
into the IPC$ response, so with such a configuration IPC$ also fails the
now unconditional "veto_list_sz > payload_sz" check, even though pipe
shares never use a veto list.

ksmbd_ipc_share_config_request() then returns NULL and every tree
connect fails with STATUS_BAD_NETWORK_NAME, so ksmbd cannot serve any
share when used with these ksmbd-tools releases, for example the 3.5.1
package shipped by Ubuntu 24.04.  Login still works, which makes the
failure look like a configuration problem:

  CIFS: VFS: BAD_NETWORK_NAME: \\127.0.0.1\IPC$
  CIFS: VFS: \\127.0.0.1 failed to connect to IPC (rc=-2)

When payload_sz is zero, derive it from the size of the message actually
received and store it back in the response, so that the checks in
ipc_validate_msg() and the path and veto list parsing in
share_config_request() all use the same bound.  The response is the
kernel's own copy made by handle_response(), and msg_sz has already been
checked to be at least sizeof(*resp), so this cannot underflow.  All
checks added by that commit then apply unchanged, bounded by the bytes
that really arrived, and newer ksmbd-tools that fill in payload_sz are
unaffected.  Also skip the veto list size check for pipe shares:
share_config_request() reads neither the path nor the veto list for
them.

Tested in QEMU with ksmbd-tools 3.5.1 and 3.5.7 and the in-kernel SMB
client over loopback, with and without a global "veto files" setting.

Fixes: f25e93768fcc ("ksmbd: prevent out-of-bounds reads in share config responses")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/transport_ipc.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
index 7c30b50f23f04e..2d30dc3eeb9e14 100644
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -524,11 +524,25 @@ static int ipc_validate_msg(struct ipc_msg_table_entry *entry)
 		if (entry->msg_sz < sizeof(struct ksmbd_share_config_response))
 			return -EINVAL;
 
+		/*
+		 * ksmbd-tools releases before 3.5.2 leave payload_sz zero.
+		 * Derive it from the size of the message actually received so
+		 * the checks below bound the payload for those releases too.
+		 */
+		if (!resp->payload_sz)
+			resp->payload_sz = entry->msg_sz -
+				sizeof(struct ksmbd_share_config_response);
+
 		if (strnlen(resp->share_name, sizeof(resp->share_name)) ==
 		    sizeof(resp->share_name))
 			return -EINVAL;
 
-		if (resp->veto_list_sz > resp->payload_sz)
+		/*
+		 * Pipe shares carry no veto list, but ksmbd-tools before 3.5.3
+		 * copy a global "veto files" setting into the IPC$ response.
+		 */
+		if (!(resp->flags & KSMBD_SHARE_FLAG_PIPE) &&
+		    resp->veto_list_sz > resp->payload_sz)
 			return -EINVAL;
 
 		if (resp->flags != KSMBD_SHARE_FLAG_INVALID &&

From 99a9db401d16f37f47925ca009f77761102ff8cd Mon Sep 17 00:00:00 2001
From: DaeMyung Kang <charsyam@gmail.com>
Date: Sat, 17 Oct 2026 12:40:50 +0900
Subject: [PATCH 0636/1982] ksmbd: avoid restoring only in-memory EOF after
 allocation change

commit 9455e920aebe41217cabff3f81e90da4c407fdb6 upstream.

When SetAllocation requests a size below the allocated block count but
above EOF, ksmbd truncates the file to that size and restores only the
in-memory i_size. The larger EOF remains on disk and reappears after a
reboot. A 3-byte file preallocated to 64 KiB can acquire a 4 KiB EOF
after reducing its allocation to 4 KiB. Extending EOF this way is not
a reliable way to reclaim the preallocation beyond the old EOF either.

Only use this truncate path when the requested allocation is at or below
the observed EOF. A truncate to the existing EOF still lets filesystems
release preallocated blocks beyond EOF. Remove the in-memory-only i_size
restoration. The size check still precedes vfs_truncate() taking the
inode lock, so a concurrent shrink can make the truncate extend EOF;
that race also existed in the original path.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 7a9eac676cbb90..93ea4f01e1a69a 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6516,24 +6516,17 @@ static int set_file_allocation_info(struct ksmbd_work *work,
 			pr_err("vfs_fallocate is failed : %d\n", rc);
 			return rc;
 		}
-	} else if (alloc_blks < stat.blocks) {
-		loff_t size;
-
+	} else if (alloc_blks < stat.blocks &&
+		   alloc_blks * 512 <= i_size_read(inode)) {
 		/*
-		 * Allocation size could be smaller than original one
-		 * which means allocated blocks in file should be
-		 * deallocated. use truncate to cut out it, but inode
-		 * size is also updated with truncate offset.
-		 * inode size is retained by backup inode size.
+		 * Truncate at or below EOF to discard excess allocation.
+		 * Truncating above EOF would extend the file on disk.
 		 */
-		size = i_size_read(inode);
 		rc = ksmbd_vfs_truncate(work, fp, alloc_blks * 512);
 		if (rc) {
 			pr_err("truncate failed!, err %d\n", rc);
 			return rc;
 		}
-		if (size < alloc_blks * 512)
-			i_size_write(inode, size);
 	}
 	return 0;
 }

From 24455d79b91b960c99e5fae24ab5c3a7689aca8d Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sun, 4 Oct 2026 09:42:27 +0900
Subject: [PATCH 0637/1982] ksmbd: fix extended session security negotiation
 for raw NTLMSSP

commit 6868f857514bbfd2ed10b9b566664dc4a8ca039d upstream.

ksmbd_build_ntlmssp_challenge_blob() only advertises extended session
security when conn->use_spnego is true. As a result, raw NTLMSSP
negotiation drops NTLMSSP_NEGOTIATE_EXTENDED_SEC from the challenge even
when the client requested it.

A Windows capture shows an initial SPNEGO authentication succeeding,
followed by a raw NTLMSSP negotiation on the same TCP connection. The raw
challenge omits extended session security, and the client does not send
an AUTHENTICATE message. The unfinished session then occupies the pending
session slot, causing subsequent SESSION_SETUP requests to fail with
STATUS_INSUFFICIENT_RESOURCES.

Set NTLMSSP_NEGOTIATE_EXTENDED_SEC whenever the client requests it,
independently of the SPNEGO wrapper, as required by [MS-NLMP].

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: Tea La Forgia <tealaforgia+alias@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/auth.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 9844aaad7ab3da..698fb83ee458df 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -332,8 +332,7 @@ ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
 	if (cflags & NTLMSSP_REQUEST_TARGET)
 		flags |= NTLMSSP_REQUEST_TARGET;
 
-	if (conn->use_spnego &&
-	    (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
+	if (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)
 		flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;
 
 	if (cflags & NTLMSSP_NEGOTIATE_KEY_XCH)

From 93cb902b0ca04c9dc28b38776f7a03503c84b7ad Mon Sep 17 00:00:00 2001
From: Dairui Zhang <zhangdairui@gmail.com>
Date: Mon, 28 Sep 2026 13:20:26 +0800
Subject: [PATCH 0638/1982] ksmbd: fix OOB read and cross-share confusion in
 ksmbd_validate_name_reconnect()

commit 783a7fc454991544bf92268d8f2413af1a7c7eb8 upstream.

ksmbd_validate_name_reconnect() indexes
ab_pathname[share->path_sz + 1] without checking that the path is
longer than share->path_sz + 1 (d_path() fills the buffer from the
end). A durable fp is not bound to its original share, so a client
can preserve a file from a short-path share and reconnect it on a
long-path share, making strcmp() read past the PATH_MAX buffer -
with a long enough share path this oopses the kernel, and on a
mapped page it also gives a byte-equality oracle on adjacent heap
(the reconnect succeeds exactly when the out-of-bounds string
equals the requested name). A same-share variant with the durable
fp at the share root reads 1 byte past the buffer
(strlen(ab_pathname) == share->path_sz).

Check before comparing: the path must be longer than share->path_sz,
it must start with share->path, and the next character must be '/'.
The share root itself is accepted only for an empty name.

Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Reported-by: Dairui Zhang <zhangdairui@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Dairui Zhang <zhangdairui@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/vfs_cache.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index 970b8f185aacdf..5aa46e41ac6f8b 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1339,9 +1339,21 @@ int ksmbd_validate_name_reconnect(struct ksmbd_share_config *share,
 		return -EACCES;
 	}
 
-	if (name && strcmp(&ab_pathname[share->path_sz + 1], name)) {
-		ksmbd_debug(SMB, "invalid name reconnect %s\n", name);
-		ret = -EINVAL;
+	if (name) {
+		size_t len = strlen(ab_pathname);
+
+		if (len == share->path_sz && !strncmp(ab_pathname, share->path, len)) {
+			/* the durable fp is the share root itself */
+			if (name[0])
+				ret = -EINVAL;
+		} else if (len <= share->path_sz ||
+			   strncmp(ab_pathname, share->path, share->path_sz) ||
+			   ab_pathname[share->path_sz] != '/' ||
+			   strcmp(&ab_pathname[share->path_sz + 1], name)) {
+			ret = -EINVAL;
+		}
+		if (ret)
+			ksmbd_debug(SMB, "invalid name reconnect %s\n", name);
 	}
 
 	kfree(pathname);

From 4f238380ea3803afdc815c615521c6f6b13989a3 Mon Sep 17 00:00:00 2001
From: Giorgi Kobakhia <gkobakhi@asu.edu>
Date: Fri, 11 Sep 2026 17:08:17 -0700
Subject: [PATCH 0639/1982] ksmbd: fix overflow in dacloffset bounds check in
 build_sec_desc()

commit eb96e2a0e817807c48dc8387ca6a5249fdeae3a0 upstream.

When the large dacl_offset is provided, dacl_offset + sizeof(struct
smb_acl) overflows on 32-bit builds and the check is passed,
Which makes le16_to_cpu(ppdacl_ptr->size) read out-of-bounds. This
only happens for dacl_offset in range [0xFFFFFFF8, 0xFFFFFFFF]. So
the oob read is max 8 bytes preceding the allocated ppntsd.

    unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
    int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;

    if (!dacl_offset ||
	(dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
	    goto out;

Commit beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check")
fixes similar checks in other functions. But leaves this one out,
because it is only valid for 32-bit builds.

Reproduced on 32-bit ARM with KASAN, by a client sending SMB2
SET_INFO(SEC) with dacloffset=0xfffffff8, then QUERY_INFO(SEC) on the
same file:

 BUG: KASAN: slab-out-of-bounds in build_sec_desc (fs/smb/server/smbacl.c:1105)
 Read of size 2 at addr c2a273fa by task kworker/1:1/35
 CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Not tainted 7.3.0-rc2+ #5
 Workqueue: ksmbd-io handle_ksmbd_work
 Call trace:
  kasan_check_range from build_sec_desc (fs/smb/server/smbacl.c:1105)
  build_sec_desc from smb2_query_info (fs/smb/server/smb2pdu.c:7676)
  smb2_query_info from handle_ksmbd_work (fs/smb/server/server.c:160)
  handle_ksmbd_work from process_one_work (kernel/workqueue.c:3401)
  process_one_work from worker_thread (kernel/workqueue.c:3473)
  worker_thread from kthread (kernel/kthread.c:436)

Add overflow check.

Fixes: 8f0541186e9a ("ksmbd: fix heap-based overflow in set_ntacl_dacl()")
Cc: stable@vger.kernel.org
Assisted-by: LLM claude
Tested-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Giorgi Kobakhia <gkobakhi@asu.edu>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smbacl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index a4447c9c660dc8..a1dc0ead4fde06 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1093,9 +1093,12 @@ int build_sec_desc(struct mnt_idmap *idmap,
 			struct smb_acl *ppdacl_ptr;
 			unsigned int dacl_offset = le32_to_cpu(ppntsd->dacloffset);
 			int ppdacl_size, ntacl_size = ppntsd_size - dacl_offset;
+			size_t dacl_struct_end;
 
 			if (!dacl_offset ||
-			    (dacl_offset + sizeof(struct smb_acl) > ppntsd_size))
+			    check_add_overflow(dacl_offset, sizeof(struct smb_acl),
+					       &dacl_struct_end) ||
+			    dacl_struct_end > (size_t)ppntsd_size)
 				goto out;
 
 			ppdacl_ptr = (struct smb_acl *)((char *)ppntsd + dacl_offset);

From 93566781118cdff874023d5ca4e7b8054baaec31 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <cenzhang@linux.microsoft.com>
Date: Thu, 22 Oct 2026 00:12:16 -0400
Subject: [PATCH 0640/1982] ksmbd: fix parent dentry lifetime in directory
 enumeration

commit 171df27077fb49b4af2c53ad2cedcd0e39664fe8 upstream.

ksmbd_populate_dot_dotdot_entries() builds the ".." entry from
the open directory's d_parent and passes that pointer to
ksmbd_vfs_fill_dentry_attrs() without taking a reference. That pointer
is only valid while the directory stays under this parent. If a
concurrent rename moves the directory elsewhere, the old parent loses
its last reference; a following rmdir then turns it into a negative
dentry with d_inode cleared, and after the RCU grace period the dentry
itself is freed. The worker still holds the raw pointer and
dereferences d_inode through vfs_getattr() and vfs_getxattr().

A remote SMB client, authenticated or guest, triggers this by listing
a directory while that directory is moved under a new parent and the
old parent is deleted. It can be done by the client itself with write
access or by other concurrent writers, triggering null-ptr-deref and
slab-use-after-free on a KASAN build.

  KASAN: null-ptr-deref in range
      [0x0000000000000000-0x0000000000000007]
  Workqueue: ksmbd-io handle_ksmbd_work
  RIP: 0010:xattr_permission+0x9d/0x160
  Call Trace:
   vfs_getxattr+0x9c/0x1b0
   ksmbd_vfs_getxattr+0x82/0x100
   ksmbd_vfs_get_dos_attrib_xattr+0x7f/0x130
   ksmbd_vfs_fill_dentry_attrs+0x435/0x650
   ksmbd_populate_dot_dotdot_entries+0x25e/0x630
   smb2_query_dir+0xcf9/0x1a20
   handle_ksmbd_work+0x5f1/0x1c80
   process_one_work+0x90b/0x19d0

Fix by using the dentry reference counting APIs: take the parent with
dget_parent(), take a matching dget() on ".", and dput() the dentry
once ksmbd_vfs_fill_dentry_attrs() has returned or the pattern does
not match.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb_common.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
index 2f08c667e5ef0c..b8ddc5d2249aa0 100644
--- a/fs/smb/server/smb_common.c
+++ b/fs/smb/server/smb_common.c
@@ -447,16 +447,17 @@ int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level,
 			if (i == 0) {
 				d_info->name = ".";
 				d_info->name_len = 1;
-				dentry = dir->filp->f_path.dentry;
+				dentry = dget(dir->filp->f_path.dentry);
 			} else {
 				d_info->name = "..";
 				d_info->name_len = 2;
-				dentry = dir->filp->f_path.dentry->d_parent;
+				dentry = dget_parent(dir->filp->f_path.dentry);
 			}
 
 			if (!match_pattern(d_info->name, d_info->name_len,
 					   search_pattern)) {
 				dir->dot_dotdot[i] = 1;
+				dput(dentry);
 				continue;
 			}
 
@@ -465,6 +466,7 @@ int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level,
 							 idmap,
 							 dentry,
 							 &ksmbd_kstat);
+			dput(dentry);
 			if (rc)
 				break;
 

From 9582dc3a31784ac930293b15edaa36c897d74e27 Mon Sep 17 00:00:00 2001
From: Jan Koester <j.koester@act-marketing.de>
Date: Mon, 26 Oct 2026 10:25:37 +0100
Subject: [PATCH 0641/1982] ksmbd: ignore network devices of other namespaces

commit 1f5ce2b8b9164b3fcb93a18fe1e7b451c2fc6eea upstream.

With no interface list configured, ksmbd binds every interface that
comes up. ksmbd_netdev_event() does not look at the device's namespace,
and create_socket() opens the listener in the namespace of the task
raising NETDEV_UP. A container with its own address on a bridge brings
up its interface and finds port 445 in its namespace already taken by
ksmbd, so an SMB server running inside the container fails with
"Address already in use".

Interfaces are also matched by name only, so a container's eth0 going
down would stop the listener on the host's eth0.

Only handle netdev events for devices in init_net.

Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Koester <j.koester@act-marketing.de>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/transport_tcp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
index ede54bb049532a..130f3882b16911 100644
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -589,6 +589,15 @@ static int ksmbd_netdev_event(struct notifier_block *nb, unsigned long event,
 	struct interface *iface;
 	int ret;
 
+	/*
+	 * ksmbd serves the initial namespace only. create_socket() listens in
+	 * the namespace of the task raising the event, so a container bringing
+	 * up its own interface would get a listener on its port 445, and the
+	 * name-only interface lookup would let its interfaces stop ours.
+	 */
+	if (!net_eq(dev_net(netdev), &init_net))
+		return NOTIFY_DONE;
+
 	switch (event) {
 	case NETDEV_UP:
 		if (netif_is_bridge_port(netdev))

From 22464634d240f5132b0787048a10e8260ac7e639 Mon Sep 17 00:00:00 2001
From: DaeMyung Kang <charsyam@gmail.com>
Date: Fri, 9 Oct 2026 00:25:37 +0900
Subject: [PATCH 0642/1982] ksmbd: preserve unreadable named streams on open

commit 80c816c047f7cae3c99cc75740c1f5d2c4d97b45 upstream.

A write-only client can open an existing named stream with FILE_OPEN_IF
without permission to read the underlying file. The case-insensitive
lookup finds the xattr name, but querying its value length then fails
with -EACCES. smb2_set_stream_name_xattr() treats every negative result
as a missing stream and replaces the existing xattr with an empty value.

A failed xattr list is not proof that the stream is absent either:
for example, -ENOMEM can lead to the same empty replacement. Preserve
listing errors and create a stream only for -ENOENT or -ENODATA. The
latter can occur if the xattr is removed between listing its name and
querying its value. Return other lookup errors without changing the
stream.

A write-only FILE_OPEN now reports access denied instead of name not
found. FILE_OVERWRITE_IF and FILE_SUPERSEDE on an unreadable stream
also fail instead of appearing to replace it. Stream writes and EOF
changes already need to read the old value, so such handles cannot
update the stream after opening either.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 2 ++
 fs/smb/server/vfs.c     | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 93ea4f01e1a69a..6290997ad77ef1 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2543,6 +2543,8 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 				     xattr_stream_size);
 	if (rc >= 0)
 		return 0;
+	if (rc != -ENOENT && rc != -ENODATA)
+		return rc;
 
 	if (fp->cdoption == FILE_OPEN_LE) {
 		ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc);
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index cd0d3c13da3e72..2537bdd58648ef 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1818,7 +1818,11 @@ ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
 	ssize_t value_len = -ENOENT, xattr_list_len;
 
 	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
-	if (xattr_list_len <= 0)
+	if (xattr_list_len < 0) {
+		value_len = xattr_list_len;
+		goto out;
+	}
+	if (!xattr_list_len)
 		goto out;
 
 	for (name = xattr_list; name - xattr_list < xattr_list_len;

From 06a751809ebd33e95b05bf733697318a17a4872b Mon Sep 17 00:00:00 2001
From: Abdifatah Suruur <suruurism@gmail.com>
Date: Sat, 17 Oct 2026 13:54:54 +0300
Subject: [PATCH 0643/1982] ksmbd: reserve space for the UTF-16 terminator in
 stream info

commit a025c4991a7d83edc4dd339e3ea86d8ff6226eca upstream.

smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the
converted characters, but get_file_stream_info() budgets only
sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry
and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing
"::$DATA" entry. When an entry exactly fills the 448-byte small response
buffer, the terminator is written two bytes past the allocation.

Reserve one extra UTF-16 unit in both budget checks. The terminator is
not part of the wire format, so the reported lengths are unchanged.

Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 6290997ad77ef1..1019fe5fd178c4 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5220,7 +5220,8 @@ static int get_file_stream_info(struct ksmbd_work *work,
 				     ":%s", &stream_name[XATTR_NAME_STREAM_LEN]);
 
 		next = sizeof(struct smb2_file_stream_info) + streamlen * 2;
-		if (next > buf_free_len) {
+		/* smbConvertToUTF16() also writes a terminating UTF-16 unit. */
+		if (next + sizeof(__le16) > buf_free_len) {
 			kfree(stream_buf);
 			break;
 		}
@@ -5254,7 +5255,7 @@ static int get_file_stream_info(struct ksmbd_work *work,
 
 out:
 	if (!S_ISDIR(stat.mode) &&
-	    buf_free_len >= sizeof(struct smb2_file_stream_info) + 7 * 2) {
+	    buf_free_len >= sizeof(struct smb2_file_stream_info) + (7 + 1) * 2) {
 		file_info = (struct smb2_file_stream_info *)
 			&rsp->Buffer[nbytes];
 		streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName,

From 4f5ec4b0e9a89c02c25ee9932f7db09c17f784f8 Mon Sep 17 00:00:00 2001
From: DaeMyung Kang <charsyam@gmail.com>
Date: Fri, 9 Oct 2026 00:25:35 +0900
Subject: [PATCH 0644/1982] ksmbd: return end of file for reads past a named
 stream's data

commit 626611dc22a3b63b3264a7a797d9dbc530234fcd upstream.

A READ on a non-empty named stream at or beyond its end fails with
STATUS_INVALID_PARAMETER. ksmbd_vfs_stream_read() returns -EINVAL when
the offset is not below the stream length, and smb2_read() maps -EINVAL
to that status.

smb2_read() already turns a zero-byte read into STATUS_END_OF_FILE, the
status a regular file returns at its end, and an empty stream already
takes that path. Return 0 instead of -EINVAL so that non-empty streams
do the same. Clients that read a stream until end of file otherwise get
an error once they have read all of its data.

The buffered copychunk path converts a zero-byte source read to -EIO,
as it does for a regular file that shrinks during copying.

Fixes: 2ae1a6cc4302 ("cifsd: fix potential read overflow in ksmbd_vfs_stream_read()")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/vfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 2537bdd58648ef..c18ab8431e0d23 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -296,7 +296,7 @@ static int ksmbd_vfs_stream_read(struct ksmbd_file *fp, char *buf, loff_t *pos,
 		return (int)v_len;
 
 	if (v_len <= *pos) {
-		count = -EINVAL;
+		count = 0;
 		goto free_buf;
 	}
 

From fb743d9cb66e84f023c780ece7cef7953c4f5479 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 3 Oct 2026 01:29:38 +0200
Subject: [PATCH 0645/1982] ksmbd: use u8 for SMB2 oplock level values

commit f622fedabbb58c8006ee21373968ae07bf8a9467 upstream.

The SMB2 oplock level is an unsigned 8-bit wire value, but
smb20_oplock_break_ack() stores it in a plain char. On architectures where
plain char is signed, the value 0xff becomes -1 and cannot compare equal to
SMB2_OPLOCK_LEVEL_LEASE (0xff). The acknowledgment is consequently rejected
with STATUS_INVALID_OPLOCK_PROTOCOL instead of the intended
STATUS_INVALID_PARAMETER.

Use u8 for the request and response oplock-level variables. This preserves
all wire values in their original representation.

Fixes: 80a56d4a826c ("ksmbd: align SMB2 oplock break ack handling")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 1019fe5fd178c4..793c219b9a6107 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8871,7 +8871,7 @@ static void smb20_oplock_break_ack(struct ksmbd_work *work)
 	__le32 status = STATUS_SUCCESS;
 	int ret;
 	u64 volatile_id, persistent_id;
-	char req_oplevel = 0, rsp_oplevel = 0;
+	u8 req_oplevel = 0, rsp_oplevel = 0;
 
 	WORK_BUFFERS(work, req, rsp);
 

From e8aa0ac634f0d30a5df8106791ba67b17f71e2ae Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Sat, 17 Oct 2026 09:44:48 +0900
Subject: [PATCH 0646/1982] ksmbd: validate security descriptor offsets before
 pointer arithmetic

commit 3474e1a304fbf9f7c996b24adcd519e031227a90 upstream.

parse_sec_desc() constructs SID and DACL pointers by adding untrusted
32-bit offsets to the security descriptor before checking their bounds.
The existing checks reject offsets into the descriptor header, but do
not reject offsets beyond the descriptor's length.

On a 32-bit kernel, a large offset can wrap the pointer before the
descriptor. The end-only checks in parse_sid() and parse_dacl() can then
accept it, allowing an authenticated SMB2 SET_INFO request to access
memory outside the security descriptor and fault the kernel.

Check each nonzero offset against acl_len before constructing its
pointer. Initialize the optional owner and group SID pointers to NULL
so an omitted SID remains absent when parsing the DACL.

Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smbacl.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index a1dc0ead4fde06..49a35974dd2966 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -896,7 +896,7 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
 		   int acl_len, struct smb_fattr *fattr)
 {
 	int rc = 0;
-	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_sid *owner_sid_ptr = NULL, *group_sid_ptr = NULL;
 	struct smb_acl *dacl_ptr; /* no need for SACL ptr */
 	char *end_of_acl = ((char *)pntsd) + acl_len;
 	__u32 dacloffset;
@@ -908,12 +908,7 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
 	if (acl_len < sizeof(struct smb_ntsd))
 		return -EINVAL;
 
-	owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
-			le32_to_cpu(pntsd->osidoffset));
-	group_sid_ptr = (struct smb_sid *)((char *)pntsd +
-			le32_to_cpu(pntsd->gsidoffset));
 	dacloffset = le32_to_cpu(pntsd->dacloffset);
-	dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 	ksmbd_debug(SMB,
 		    "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
 		    pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
@@ -929,9 +924,12 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
 	pntsd->type = cpu_to_le16(DACL_PRESENT);
 
 	if (pntsd->osidoffset) {
-		if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd))
+		if (le32_to_cpu(pntsd->osidoffset) < sizeof(struct smb_ntsd) ||
+		    le32_to_cpu(pntsd->osidoffset) >= acl_len)
 			return -EINVAL;
 
+		owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
+				le32_to_cpu(pntsd->osidoffset));
 		rc = parse_sid(owner_sid_ptr, end_of_acl);
 		if (rc) {
 			pr_err("%s: Error %d parsing Owner SID\n", __func__, rc);
@@ -947,9 +945,12 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
 	}
 
 	if (pntsd->gsidoffset) {
-		if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd))
+		if (le32_to_cpu(pntsd->gsidoffset) < sizeof(struct smb_ntsd) ||
+		    le32_to_cpu(pntsd->gsidoffset) >= acl_len)
 			return -EINVAL;
 
+		group_sid_ptr = (struct smb_sid *)((char *)pntsd +
+				le32_to_cpu(pntsd->gsidoffset));
 		rc = parse_sid(group_sid_ptr, end_of_acl);
 		if (rc) {
 			pr_err("%s: Error %d mapping Owner SID to gid\n",
@@ -971,9 +972,10 @@ int parse_sec_desc(struct mnt_idmap *idmap, struct smb_ntsd *pntsd,
 		pntsd->type |= cpu_to_le16(DACL_PROTECTED);
 
 	if (dacloffset) {
-		if (dacloffset < sizeof(struct smb_ntsd))
+		if (dacloffset < sizeof(struct smb_ntsd) || dacloffset >= acl_len)
 			return -EINVAL;
 
+		dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 		rc = parse_dacl(idmap, dacl_ptr, end_of_acl,
 				owner_sid_ptr, group_sid_ptr, fattr);
 		if (rc)

From b3b56e95f6fad7fa7281450b443e861d82616fdb Mon Sep 17 00:00:00 2001
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: Wed, 6 May 2026 03:59:18 +0000
Subject: [PATCH 0647/1982] tcp: Fix potential UAF in reqsk_timer_handler().

commit 97c8a3c1f73d828de43a5a88e8a9a143efb2b661 upstream.

When TCP socket migration fails at inet_ehash_insert() in
reqsk_timer_handler(), we jump to the no_ownership: label
and free the new reqsk immediately with __reqsk_free().

Thus, we must stop the new reqsk's timer before jumping to the
label, but the timer might be missed since the cited commit,
resulting in UAF.

As we are in the original reqsk's timer context, we can safely
call timer_delete_sync() for the new reqsk.

Let's pass false to __inet_csk_reqsk_queue_drop() to stop
the new reqsk's timer.

Fixes: 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260506035954.1563147-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/inet_connection_sock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index a44c8096725fe3..6b36652d6bb9dc 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1135,7 +1135,7 @@ static void reqsk_timer_handler(struct timer_list *t)
 
 		if (!inet_ehash_insert(req_to_sk(nreq), req_to_sk(oreq), NULL)) {
 			/* delete timer */
-			__inet_csk_reqsk_queue_drop(sk_listener, nreq, true);
+			__inet_csk_reqsk_queue_drop(sk_listener, nreq, false);
 			goto no_ownership;
 		}
 

From 3d0d2b4ad54fc8acaee82a6994f8f24e0de23fb2 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@kernel.org>
Date: Tue, 13 Oct 2026 13:50:22 +0200
Subject: [PATCH 0648/1982] vlan: restore HW VLAN tag insertion with
 reorder_hdr off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c2124f80be4ceb6ec566ca3b5fc87f84ea9c36e0 ]

Commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling
HW VLAN offload") replaced vlan_passthru_header_ops with vlan_header_ops
unconditionally to avoid lockless data races when modifying
hard_header_len dynamically under RTNL.

Prior to that commit, vlan devices on top of a real device capable of
HW VLAN TX offload used vlan_passthru_header_ops, which never inserted
the 802.1Q header in the frame.

Now, with reorder_hdr=off (as done by Home Assistant OS / NetworkManager
when flags are omitted over D-Bus), vlan_dev_hard_header() always pushes
an in-band 802.1Q header, and vlan_dev_hard_start_xmit() hands the frame
to the real device as is, even if the real device supports HW VLAN TX
offload.

This is a regression for r8169 users (Realtek RTL8168h), who report
transmit queue timeouts (NETDEV WATCHDOG): this NIC stalls when asked
to offload checksum and/or TSO for frames carrying an in-band tag.
Users of r8152 based USB adapters were affected as well.

Reverting the blamed commit, disabling TX checksum offload (which
also disables TSO), or setting reorder_hdr=on were all reported to
work around the issue.

Keep vlan_dev_hard_header() as is: the in-band header keeps the frame
layout seen at the vlan device egress (taps, tc, netfilter) unchanged,
and is relied upon by stacked vlans (Q-in-Q) and by AF_PACKET SOCK_DGRAM
users sending ETH_P_8021Q frames.

Instead, when vlan_dev_hard_start_xmit() gets a frame carrying an
in-band tag with our protocol and the real device can insert tags,
move that tag to skb->vlan_tci with __skb_vlan_pop(), so that the real
device inserts it. Frames sent on the wire are unchanged, except that
frames shorter than 64 bytes with their tag now get up to 4 bytes of
extra padding, as with reorder_hdr=on and before 447cbe95ebb9.

skb_reset_mac_header() is needed first, because not all ndo_start_xmit()
callers set the mac header (e.g. AF_XDP copy mode, which uses
__dev_direct_xmit()).

vlan_set_encap_proto() may read the two bytes after the vlan header,
so frames whose linear part is shorter than VLAN_ETH_HLEN + 2 are sent
unchanged, as before. This also makes sure h_vlan_proto, read earlier
in the function, was in the linear part. Shared skbs (e.g. from
pktgen) are also sent unchanged, since popping the tag modifies the
skb, as are skbs already carrying a hwaccel tag (e.g. from generic XDP
redirect), whose tag must not be overwritten, skbs carrying XDP
metadata, which the pop would have to move, and CHECKSUM_PARTIAL skbs
whose csum_start lies within the first VLAN_ETH_HLEN bytes (only
possible with bogus offsets, e.g. from AF_XDP tx metadata), which the
pop would leave before skb->data.
If popping the header fails (memory allocation failure), the frame is
dropped and counted in tx_dropped, rather than handing the real device
a frame with an in-band tag.

tx_bytes is now sampled before the pop, so the vlan device statistics
do not change.

This also applies to frames provided by the sender with our tag
(AF_PACKET SOCK_RAW, or frames redirected from another reorder_hdr=off
vlan): the real device now inserts their tag too.

Fixes: 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload")
Reported-by: Jan Čermák <sairon@sairon.cz>
Closes: https://lore.kernel.org/netdev/CAPa5EdCj3v17tB-SF2JNecq5Q8s1Pranr-XzAFWNpNTBPgPG7w@mail.gmail.com/
Reported-by: Stefan Agner <stefan@agner.ch>
Reported-by: hitchin999 <hitchin999@users.noreply.github.com>
Closes: https://github.com/home-assistant/operating-system/issues/5019
Tested-by: Jan Čermák <sairon@sairon.cz>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://patch.msgid.link/20261013115022.1043024-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/8021q/vlan_dev.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 618c8617c2c430..27b84c41200825 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -110,6 +110,8 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
 	unsigned int len;
 	int ret;
 
+	len = skb->len;
+
 	/* Handle non-VLAN frames if they are sent to us, for example by DHCP.
 	 *
 	 * NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING
@@ -121,10 +123,39 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
 		vlan_tci = vlan->vlan_id;
 		vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb->priority);
 		__vlan_hwaccel_put_tag(skb, vlan->vlan_proto, vlan_tci);
+	} else if (skb_headlen(skb) >= VLAN_ETH_HLEN + sizeof(__be16) &&
+		   !skb_shared(skb) && !skb_vlan_tag_present(skb) &&
+		   !skb_metadata_len(skb) &&
+		   (skb->ip_summed != CHECKSUM_PARTIAL ||
+		    skb_checksum_start_offset(skb) >= VLAN_ETH_HLEN) &&
+		   vlan_hw_offload_capable(READ_ONCE(vlan->real_dev->features),
+					   vlan->vlan_proto)) {
+		u16 vlan_tci;
+
+		/* The frame carries its outer tag in-band, either inserted
+		 * by vlan_dev_hard_header() or provided by the sender.
+		 * Let the real device insert it: some NICs can not offload
+		 * checksum or TSO for frames carrying an in-band tag.
+		 * Not all ndo_start_xmit() callers set the mac header.
+		 * vlan_set_encap_proto() may read two bytes after the vlan
+		 * header, so frames with a shorter linear part are sent
+		 * unchanged, as are shared skbs (e.g. from pktgen), skbs
+		 * already carrying a hwaccel tag (e.g. from generic XDP
+		 * redirect), skbs carrying XDP metadata, and CHECKSUM_PARTIAL
+		 * skbs whose checksum starts within the header to be popped.
+		 * On allocation failure, drop the frame rather than handing
+		 * it to the real device with an in-band tag.
+		 */
+		skb_reset_mac_header(skb);
+		if (unlikely(__skb_vlan_pop(skb, &vlan_tci))) {
+			dev_kfree_skb_any(skb);
+			this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
+			return NETDEV_TX_OK;
+		}
+		__vlan_hwaccel_put_tag(skb, vlan->vlan_proto, vlan_tci);
 	}
 
 	skb->dev = vlan->real_dev;
-	len = skb->len;
 	if (unlikely(netpoll_tx_running(dev)))
 		return vlan_netpoll_send_skb(vlan, skb);
 

From d3d5560fb7550e74fb9851826d7dab505ffd05e0 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Tue, 20 Oct 2026 12:57:59 +0900
Subject: [PATCH 0649/1982] cgroup: serialize migrations of newly forked
 processes

[ Upstream commit bf6fbf46b5ff68c4eebad5aa52309eb124f4509c ]

With favordynmods enabled, a cgroup.procs migration takes the target
threadgroup's cgroup_threadgroup_rwsem for writing. A process fork holds
the forking threadgroup's semaphore for reading. These are different
semaphores when fork creates a new process.

copy_process() publishes the child's PID before cgroup_post_fork() links
the child to its css_set. A writer can find the child in that interval,
take its uncontended semaphore, and migrate it while child->cgroups still
points to init_css_set and child->cg_list is empty. Migration links the
node into init_css_set.mg_tasks. cgroup_post_fork() then adds the same
node to the intended css_set as though it were unlinked, corrupting both
task lists and their css_set ownership.

This regresses the fork/migration race fixed by commit b12b533fa523
("cgroups: add lock for child->cgroups in cgroup_post_fork()") and
restored again in 2012 after the lock had been removed. The old task_lock
protection was later superseded by global css_set and cgroup threadgroup
locking. The change identified by the Fixes tag narrowed only the migration
side back to a per-threadgroup lock, recreating the different-process
exclusion failure.

Take the new threadgroup's semaphore for reading before the child becomes
visible and hold it through cgroup_post_fork(). Use a nested lock subclass
because fork already holds the parent's semaphore. CLONE_THREAD children
share the parent's signal_struct and remain covered by the existing lock.
Migrations of unrelated, fully initialized threadgroups remain concurrent.

An AI coding assistant was used to identify and reproduce the regression
and to develop and test this fix.

Fixes: 0568f89d4fb8 ("cgroup: replace global percpu_rwsem with per threadgroup resem when writing to cgroup.procs")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cgroup.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 275c335c02a7f9..07e1e29228197b 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -6702,6 +6702,31 @@ static struct cgroup *cgroup_get_from_file(struct file *f)
 	return cgrp;
 }
 
+/*
+ * A new threadgroup gets its own cgroup_threadgroup_rwsem.  Once its PID is
+ * visible, a cgroup.procs writer can find the child and lock that rwsem even
+ * though cgroup_post_fork() has not linked the child to its css_set yet.
+ *
+ * cgroup_can_fork() already holds the global read lock, which keeps
+ * cgroup_enable_per_threadgroup_rwsem stable.  Lock the child's rwsem as a
+ * nested instance until cgroup_post_fork() finishes.  Threads share their
+ * parent's signal_struct and are covered by the existing read lock.
+ */
+static void cgroup_fork_child_lock(struct task_struct *child)
+{
+	if (cgroup_enable_per_threadgroup_rwsem &&
+	    child->signal != current->signal)
+		down_read_nested(&child->signal->cgroup_threadgroup_rwsem,
+				 SINGLE_DEPTH_NESTING);
+}
+
+static void cgroup_fork_child_unlock(struct task_struct *child)
+{
+	if (cgroup_enable_per_threadgroup_rwsem &&
+	    child->signal != current->signal)
+		up_read(&child->signal->cgroup_threadgroup_rwsem);
+}
+
 /**
  * cgroup_css_set_fork - find or create a css_set for a child process
  * @kargs: the arguments passed to create the child process
@@ -6867,6 +6892,7 @@ int cgroup_can_fork(struct task_struct *child, struct kernel_clone_args *kargs)
 			goto out_revert;
 	} while_each_subsys_mask();
 
+	cgroup_fork_child_lock(child);
 	return 0;
 
 out_revert:
@@ -6901,6 +6927,7 @@ void cgroup_cancel_fork(struct task_struct *child,
 		if (ss->cancel_fork)
 			ss->cancel_fork(child, kargs->cset);
 
+	cgroup_fork_child_unlock(child);
 	cgroup_css_set_put_fork(kargs);
 }
 
@@ -6998,6 +7025,7 @@ void cgroup_post_fork(struct task_struct *child,
 	if (unlikely(kill))
 		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, child, PIDTYPE_TGID);
 
+	cgroup_fork_child_unlock(child);
 	cgroup_css_set_put_fork(kargs);
 }
 

From eff110e062a51d3277c2af2f51cdefdc494dde29 Mon Sep 17 00:00:00 2001
From: Christoph Zwerschke <cito@online.de>
Date: Mon, 2 Nov 2026 16:32:40 +0100
Subject: [PATCH 0650/1982] Revert "Bluetooth: btusb: Add ASUS USB-BT600 for
 Realtek 8761CU"

This reverts commit bce588b4ca081833ed8fc62062291f71d4218278 which is
commit 6f0624b4427e38c3bb63a951c536cf8adaee1238 upstream.

With the device ID in the table, the adapter is handed over to btrtl,
which in this tree, together with the backport of commit 4a23ce935f74
("Bluetooth: btrtl: Add the support for RTL8761CUV"), now requires
rtl_bt/rtl8761cu_fw.bin. That file is only shipped by linux-firmware
since 20251111. On systems with older firmware packages, such as
Debian trixie, the adapter no longer initializes. Without the ID entry
it binds via the generic Bluetooth class and works on its ROM firmware,
as it did before the backport.

Mainline keeps the ID entry, so this revert is for 6.18.y only, as agreed
in the regression thread.

Reported-by: Erik Brangs <erik.brangs@gmx.de>
Closes: https://bugs.debian.org/1149377
Link: https://lore.kernel.org/all/179104011040.2214689.5921682013387867802@eldamar.lan/
Signed-off-by: Christoph Zwerschke <cito@online.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3c9d5d09769365..b571918aac953c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -847,8 +847,6 @@ static const struct usb_device_id quirks_table[] = {
 	/* Additional Realtek 8761CU Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
-	{ USB_DEVICE(0x0b05, 0x1d70), .driver_info = BTUSB_REALTEK |
-						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Additional Realtek 8821AE Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },

From 42a44fe738f67ebdf85251de6c53f1bafe3677ae Mon Sep 17 00:00:00 2001
From: Christoph Zwerschke <cito@online.de>
Date: Mon, 2 Nov 2026 16:32:41 +0100
Subject: [PATCH 0651/1982] Revert "Bluetooth: btusb: Add ASUS USB-BT540 for
 Realtek 8761CU"

This reverts commit aa7b93fe98ba726971b7d0c68320ce513e68aac2 which is
commit 980084de4d9b25193398d89a1c0430ba3501b683 upstream.

With the device ID in the table, the adapter is handed over to btrtl,
which in this tree, together with the backport of commit 4a23ce935f74
("Bluetooth: btrtl: Add the support for RTL8761CUV"), now requires
rtl_bt/rtl8761cu_fw.bin. That file is only shipped by linux-firmware
since 20251111. On systems with older firmware packages, such as
Debian trixie, the adapter no longer initializes. Without the ID entry
it binds via the generic Bluetooth class and works on its ROM firmware,
as it did before the backport.

Mainline keeps the ID entry, so this revert is for 6.18.y only, as agreed
in the regression thread.

Reported-by: Erik Brangs <erik.brangs@gmx.de>
Closes: https://bugs.debian.org/1149377
Link: https://lore.kernel.org/all/179104011040.2214689.5921682013387867802@eldamar.lan/
Signed-off-by: Christoph Zwerschke <cito@online.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b571918aac953c..0b8c2ecf0a64cd 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -844,10 +844,6 @@ static const struct usb_device_id quirks_table[] = {
 	{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 
-	/* Additional Realtek 8761CU Bluetooth devices */
-	{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
-						     BTUSB_WIDEBAND_SPEECH },
-
 	/* Additional Realtek 8821AE Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },

From 8a803deb2c7fb7782b723edae7a587c6ea0a1c82 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 30 Oct 2026 10:36:41 +0000
Subject: [PATCH 0652/1982] KVM: x86/mmu: pass PFERR_GUEST_PAGE/FINAL_MASK to
 kvm_translate_gpa

[ Upstream commit bd1c40114b02cf63ba33da8e7df71ed0fc2a3019 ]

The XS/XU bit for EPT are only applied to final accesses, and use the
U bit from the page walk itself.  While strictly speaking not necessary
(any value of PFERR_USER_MASK would be the same for page table accesses,
because they're reads and writes only), it is clearer and less hackish
to only apply MBEC to PFERR_GUEST_FINAL_MASK.  Allow kvm-intel.ko to
distinguish the two cases.

Tested-by: David Riley <d.riley@proxmox.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[doebel: load_pdptrs() lives in arch/x86/kvm/regs.c in this tree; keep
this tree's mmu_is_nested() in the Hyper-V hunk]
Stable-dep-of: 96b067b59ad9 ("KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits")
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/hyperv.c          | 3 ++-
 arch/x86/kvm/mmu/mmu.c         | 3 ++-
 arch/x86/kvm/mmu/paging_tmpl.h | 7 +++++--
 arch/x86/kvm/regs.c            | 3 ++-
 4 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 56325ba9ef367a..284adaf508688f 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -2056,7 +2056,8 @@ static u64 kvm_hv_flush_tlb(struct kvm_vcpu *vcpu, struct kvm_hv_hcall *hc)
 	 * read with kvm_read_guest().
 	 */
 	if (!hc->fast && mmu_is_nested(vcpu)) {
-		hc->ingpa = translate_nested_gpa(vcpu, hc->ingpa, 0, NULL);
+		hc->ingpa = translate_nested_gpa(vcpu, hc->ingpa,
+					PFERR_GUEST_FINAL_MASK, NULL);
 		if (unlikely(hc->ingpa == INVALID_GPA))
 			return HV_STATUS_INVALID_HYPERCALL_INPUT;
 	}
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 1fa251ca4dccf2..d365bba579d280 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4349,7 +4349,8 @@ static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
 {
 	if (exception)
 		exception->error_code = 0;
-	return kvm_translate_gpa(vcpu, mmu, vaddr, access, exception);
+	return kvm_translate_gpa(vcpu, mmu, vaddr, access | PFERR_GUEST_FINAL_MASK,
+				 exception);
 }
 
 static bool mmio_info_in_cache(struct kvm_vcpu *vcpu, u64 addr, bool direct)
diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index 07b0ddd15b9de3..9f8c4293bbe789 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -377,7 +377,8 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
 		walker->pte_gpa[walker->level - 1] = pte_gpa;
 
 		real_gpa = kvm_translate_gpa(vcpu, mmu, gfn_to_gpa(table_gfn),
-					     nested_access, &walker->fault);
+					     nested_access | PFERR_GUEST_PAGE_MASK,
+					     &walker->fault);
 
 		/*
 		 * FIXME: This can happen if emulation (for of an INS/OUTS
@@ -445,7 +446,9 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
 		gfn += pse36_gfn_delta(pte);
 #endif
 
-	real_gpa = kvm_translate_gpa(vcpu, mmu, gfn_to_gpa(gfn), access, &walker->fault);
+	real_gpa = kvm_translate_gpa(vcpu, mmu, gfn_to_gpa(gfn),
+				     access | PFERR_GUEST_FINAL_MASK,
+				     &walker->fault);
 	if (real_gpa == INVALID_GPA)
 		return 0;
 
diff --git a/arch/x86/kvm/regs.c b/arch/x86/kvm/regs.c
index 7b997c4e6329fd..d19a9e7e41f375 100644
--- a/arch/x86/kvm/regs.c
+++ b/arch/x86/kvm/regs.c
@@ -122,7 +122,8 @@ int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3)
 	 * to an L1 GPA.
 	 */
 	real_gpa = kvm_translate_gpa(vcpu, mmu, gfn_to_gpa(pdpt_gfn),
-				     PFERR_USER_MASK | PFERR_WRITE_MASK, NULL);
+				     PFERR_USER_MASK | PFERR_WRITE_MASK |
+				     PFERR_GUEST_PAGE_MASK, NULL);
 	if (real_gpa == INVALID_GPA)
 		return 0;
 

From 3b4df5414b99ab2dc5576e4d6f111497ad90bdee Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Fri, 30 Oct 2026 10:36:42 +0000
Subject: [PATCH 0653/1982] KVM: x86: Tell ->inject_page_fault() whether or a
 fault came from hardware

[ Upstream commit fe0b872d750023eda270cbc01c53ead52b1049d8 ]

When injecting a page fault (including nested TDP faults into L1), tell the
injection routine whether or not the fault originated in hardware, i.e. if
KVM is effectively forwarding a fault it intercept.  For nested TDP fault
injection, KVM needs to grab PAGE_WALK vs. GUEST_FINAL information from the
VMCB/VMCS, _if_ the fault originated in hardware.

Note, simply checking whether or not the original exit was due a #NPF or
EPT Violation isn't sufficient/correct, as the fault being synthesized for
L1 may or may not be the "same" fault that triggered a VM-Exit from L2.
E.g. if access to emulated MMIO in L2 hits a !PRESENT fault (EPT Violation
or #NPF), e.g. because MMIO caching is disabled or it's the first time the
GPA has been accessed by L2, then KVM will enter the emulator.  If
emulating the MMIO instruction then hits a nested TDP fault, e.g. because
L2 was accessing MMIO with a MOVSQ (memory-to-memory move), or because L1
has since unmapped the code stream, then the TDP fault synthesized to L1
will not be the same emulated fault the triggered the VM-Exit.

No functional change intended (nothing uses the new param, yet...).

Link: https://patch.msgid.link/20260522232701.3671446-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Stable-dep-of: 96b067b59ad9 ("KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits")
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/kvm_host.h | 18 ++++++++++++++----
 arch/x86/kvm/mmu/paging_tmpl.h  |  2 +-
 arch/x86/kvm/svm/nested.c       |  3 ++-
 arch/x86/kvm/vmx/nested.c       |  3 ++-
 arch/x86/kvm/x86.c              | 16 +++++++++-------
 5 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 3349623985660c..e1a59ec4c68bdf 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -459,7 +459,8 @@ struct kvm_mmu {
 	u64 (*get_pdptr)(struct kvm_vcpu *vcpu, int index);
 	int (*page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault);
 	void (*inject_page_fault)(struct kvm_vcpu *vcpu,
-				  struct x86_exception *fault);
+				  struct x86_exception *fault,
+				  bool from_hardware);
 	gpa_t (*gva_to_gpa)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
 			    gpa_t gva_or_gpa, u64 access,
 			    struct x86_exception *exception);
@@ -2258,9 +2259,18 @@ void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code);
 void kvm_queue_exception_p(struct kvm_vcpu *vcpu, unsigned nr, unsigned long payload);
 void kvm_requeue_exception(struct kvm_vcpu *vcpu, unsigned int nr,
 			   bool has_error_code, u32 error_code);
-void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault);
-void kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
-				    struct x86_exception *fault);
+void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault,
+			   bool from_hardware);
+void __kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
+				      struct x86_exception *fault,
+				      bool from_hardware);
+
+static inline void kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
+						  struct x86_exception *fault)
+{
+	__kvm_inject_emulated_page_fault(vcpu, fault, false);
+}
+
 bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
 bool kvm_require_dr(struct kvm_vcpu *vcpu, int dr);
 
diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index 9f8c4293bbe789..798e5be42e72be 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -785,7 +785,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 	 */
 	if (!r) {
 		if (!fault->prefetch)
-			kvm_inject_emulated_page_fault(vcpu, &walker.fault);
+			__kvm_inject_emulated_page_fault(vcpu, &walker.fault, true);
 
 		return RET_PF_RETRY;
 	}
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index ec984fa88dbcea..867a1ec004e9b3 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -35,7 +35,8 @@
 #define CC KVM_NESTED_VMENTER_CONSISTENCY_CHECK
 
 static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu,
-				       struct x86_exception *fault)
+				       struct x86_exception *fault,
+				       bool from_hardware)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 	struct vmcb *vmcb = svm->vmcb;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 6dd21c2938d99c..371c7ef6b44dc2 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -416,7 +416,8 @@ static void nested_ept_invalidate_addr(struct kvm_vcpu *vcpu, gpa_t eptp,
 }
 
 static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu,
-		struct x86_exception *fault)
+					 struct x86_exception *fault,
+					 bool from_hardware)
 {
 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 64e24e75a17c51..044c3601c4aa0a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -959,7 +959,8 @@ static int complete_emulated_insn_gp(struct kvm_vcpu *vcpu, int err)
 				       EMULTYPE_COMPLETE_USER_EXIT);
 }
 
-void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault)
+void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault,
+			   bool from_hardware)
 {
 	++vcpu->stat.pf_guest;
 
@@ -976,8 +977,9 @@ void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault)
 					fault->address);
 }
 
-void kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
-				    struct x86_exception *fault)
+void __kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
+				      struct x86_exception *fault,
+				      bool from_hardware)
 {
 	struct kvm_mmu *fault_mmu;
 	WARN_ON_ONCE(fault->vector != PF_VECTOR);
@@ -994,9 +996,9 @@ void kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
 		kvm_mmu_invalidate_addr(vcpu, fault_mmu, fault->address,
 					KVM_MMU_ROOT_CURRENT);
 
-	fault_mmu->inject_page_fault(vcpu, fault);
+	fault_mmu->inject_page_fault(vcpu, fault, from_hardware);
 }
-EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_inject_emulated_page_fault);
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(__kvm_inject_emulated_page_fault);
 
 void kvm_inject_nmi(struct kvm_vcpu *vcpu)
 {
@@ -13174,7 +13176,7 @@ bool kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu,
 		fault.nested_page_fault = false;
 		fault.address = work->arch.token;
 		fault.async_page_fault = true;
-		kvm_inject_page_fault(vcpu, &fault);
+		kvm_inject_page_fault(vcpu, &fault, false);
 		return true;
 	} else {
 		/*
@@ -13345,7 +13347,7 @@ void kvm_fixup_and_inject_pf_error(struct kvm_vcpu *vcpu, gva_t gva, u16 error_c
 		fault.address = gva;
 		fault.async_page_fault = false;
 	}
-	vcpu->arch.walk_mmu->inject_page_fault(vcpu, &fault);
+	vcpu->arch.walk_mmu->inject_page_fault(vcpu, &fault, true);
 }
 EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_fixup_and_inject_pf_error);
 

From 8519fc07a486e3dece785d4c4126f0b8ada9a655 Mon Sep 17 00:00:00 2001
From: Kevin Cheng <chengkev@google.com>
Date: Fri, 30 Oct 2026 10:36:43 +0000
Subject: [PATCH 0654/1982] KVM: VMX: Synthesize nested EPT violation
 GVA_IS_VALID/GVA_TRANSLATED bits

[ Upstream commit 96b067b59ad9ccede585fcadab27543188353bff ]

When injecting an EPT Violation into L2 in response to a fault detected
while emulating an L2 GVA access, synthesize the GVA_IS_VALID and
GVA_TRANSLATED bits using information provided by the walker, instead of
pulling the bits from vmcs02.EXIT_QUALIFICATION.  The information in
vmcs02.EXIT_QUALIFICATION is valid/correct if and only if the fault being
injected into L1 is the direct result of an EPT Violation VM-Exit from L2.

E.g. if KVM is emulating an I/O instruction and the memory operand's
translation through L1's EPT fails, using vmcs02.EXIT_QUALIFICATION is
wrong as the semantics for EXIT_QUALIFICATION would be for an I/O exit,
not an EPT Violation exit.

Opportunistically clean up the formatting for creating the mask of bits
to pull from vmcs02.EXIT_QUALIFICATION.

Signed-off-by: Kevin Cheng <chengkev@google.com>
[sean: use plumbed in @access bits, massage changelog]
Link: https://patch.msgid.link/20260522232701.3671446-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
[doebel: no advanced EPT vmexit info here, so the mask keeps only the two
GVA bits; set GVA_TRANSLATED via !(access & PFERR_GUEST_PAGE_MASK)]
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/mmu/paging_tmpl.h | 17 ++++++++++++++++-
 arch/x86/kvm/vmx/nested.c      | 23 +++++++++++++++++++----
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index 798e5be42e72be..a298955834d0be 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -495,7 +495,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
 	 * [2:0] - Derive from the access bits. The exit_qualification might be
 	 *         out of date if it is serving an EPT misconfiguration.
 	 * [5:3] - Calculated by the page walk of the guest EPT page tables
-	 * [7:8] - Derived from [7:8] of real exit_qualification
+	 * [7:8] - Derived from "fault stage" access bits
 	 *
 	 * The other bits are set to 0.
 	 */
@@ -509,6 +509,21 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
 		if (fetch_fault)
 			walker->fault.exit_qualification |= EPT_VIOLATION_ACC_INSTR;
 
+		/*
+		 * KVM doesn't emulate features that access GPAs directly, e.g.
+		 * Intel Processor Trace.  Assume the GVA is always valid; when
+		 * propagating faults from hardware, KVM will discard this info
+		 * and use the EXIT_QUALIFICATION bits from the VMCS.
+		 */
+		walker->fault.exit_qualification |= EPT_VIOLATION_GVA_IS_VALID;
+
+		/*
+		 * Accesses to guest paging structures are not the translation of
+		 * a guest linear address, i.e. GVA_TRANSLATED must be left clear.
+		 */
+		if (!(access & PFERR_GUEST_PAGE_MASK))
+			walker->fault.exit_qualification |= EPT_VIOLATION_GVA_TRANSLATED;
+
 		/*
 		 * Note, pte_access holds the raw RWX bits from the EPTE, not
 		 * ACC_*_MASK flags!
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 371c7ef6b44dc2..ab1558f1f9f8d4 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -449,10 +449,25 @@ static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu,
 			vm_exit_reason = EXIT_REASON_EPT_MISCONFIG;
 			exit_qualification = 0;
 		} else {
-			exit_qualification = fault->exit_qualification;
-			exit_qualification |= vmx_get_exit_qual(vcpu) &
-					      (EPT_VIOLATION_GVA_IS_VALID |
-					       EPT_VIOLATION_GVA_TRANSLATED);
+			const u64 mask = EPT_VIOLATION_GVA_IS_VALID |
+					 EPT_VIOLATION_GVA_TRANSLATED;
+
+			exit_qualification = fault->exit_qualification & ~mask;
+
+			/*
+			 * Use the EXIT_QUALIFICATION from the VMCS if and only
+			 * if the hardware VM-Exit from L2 was an EPT Violation.
+			 * If the fault is synthesized, then EXIT_QUALIFICATION
+			 * is stale and/or holds entirely different data.  And
+			 * conversely, KVM _must_ rely on EXIT_QUALIFICATION if
+			 * the fault came from hardware, because KVM only sees
+			 * and walks the faulting GPA.
+			 */
+			if (from_hardware)
+				exit_qualification |= vmx_get_exit_qual(vcpu) & mask;
+			else
+				exit_qualification |= fault->exit_qualification & mask;
+
 			vm_exit_reason = EXIT_REASON_EPT_VIOLATION;
 		}
 

From 41f968434a72f994d54aa86bdd18cead5b14493c Mon Sep 17 00:00:00 2001
From: Li RongQing <lirongqing@baidu.com>
Date: Mon, 15 Jun 2026 15:01:15 +0800
Subject: [PATCH 0655/1982] x86/ioperm: Prevent NULL dereference on theoretical
 missing IO bitmap

[ Upstream commit 2d36d3b451a94899db9c965adde15492ffe6027a ]

Outside the IOPL emulation path, the IO bitmap is always expected
to be allocated when TIF_IO_BITMAP is set. The paranoid WARN_ON_ONCE()
handles the case where the flag and the pointer got out of sync.
In this theoretical scenario, which presumes some other bug in the
code that triggers the WARN_ON_ONCe(), return early, instead of
continuing and dereferencing a NULL pointer.

[ mingo: Clarified the changelog. ]

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260615070115.4720-1-lirongqing@baidu.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/process.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 4c718f8adc592d..d5cd2177f18a54 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -486,6 +486,7 @@ void native_tss_update_io_bitmap(void)
 		if (WARN_ON_ONCE(!iobm)) {
 			clear_thread_flag(TIF_IO_BITMAP);
 			native_tss_invalidate_io_bitmap();
+			return;
 		}
 
 		/*

From ac7558126767d26198c94d21cdfe8a920ccccb79 Mon Sep 17 00:00:00 2001
From: Andreas Wendleder <gonsolo@gmail.com>
Date: Tue, 13 Oct 2026 02:01:24 +0200
Subject: [PATCH 0656/1982] wifi: b43: fix use-after-free in b43_bcma_remove()

commit c6c8bc355657115664131b38c53c5ddf7d93b072 upstream.

b43_one_core_detach() frees the struct b43_wldev it is given the bus
device of. b43_bcma_remove() then reads wldev->dev again to free the bus
device, which is a read of freed memory.

b43_ssb_remove() does not have the problem: it takes a copy of wldev->dev
at the start. Do the same here.

Fixes: 96838d61102a ("b43: Fix memory leaks in b43_bus_dev_ssb_init and b43_bus_dev_bcma_init")
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Wendleder <gonsolo@gmail.com>
Link: https://patch.msgid.link/20261013000124.48605-1-gonsolo@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/broadcom/b43/main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index f1a77c4c445fac..0dc261cddd6dcf 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -5663,6 +5663,7 @@ static void b43_bcma_remove(struct bcma_device *core)
 {
 	struct b43_wldev *wldev = bcma_get_drvdata(core);
 	struct b43_wl *wl = wldev->wl;
+	struct b43_bus_dev *dev = wldev->dev;
 
 	/* We must cancel any work here before unregistering from ieee80211,
 	 * as the ieee80211 unreg will destroy the workqueue. */
@@ -5677,14 +5678,14 @@ static void b43_bcma_remove(struct bcma_device *core)
 		ieee80211_unregister_hw(wl->hw);
 	}
 
-	b43_one_core_detach(wldev->dev);
+	b43_one_core_detach(dev);
 
 	/* Unregister HW RNG driver */
 	b43_rng_exit(wl);
 
 	b43_leds_unregister(wl);
 	ieee80211_free_hw(wl->hw);
-	kfree(wldev->dev);
+	kfree(dev);
 }
 
 static struct bcma_driver b43_bcma_driver = {

From 3c3b401650227e147c609c33fa458d5d963f2918 Mon Sep 17 00:00:00 2001
From: Zijing Yin <yzjaurora@gmail.com>
Date: Mon, 7 Sep 2026 01:54:35 -0700
Subject: [PATCH 0657/1982] SUNRPC: fix netns use-after-free in write_gssp()

commit e7a8721b7edb54a157623f9e31d71345333b5fb9 upstream.

While fuzzing with a customized syzkaller, I hit a refcount warning in
xprt_alloc(), reached from a write to /proc/net/rpc/use-gss-proxy:

  refcount_t: addition on 0; use-after-free.
  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xf8/0x120
  CPU: 0 PID: 10404 Comm: syz.0.17 Not tainted 7.3.0-rc1-00096-gcfebfd3db73d
  Call Trace:
   <TASK>
   xprt_alloc+0x83f/0x9d0
   xs_setup_xprt+0xaf/0x3c0
   xs_setup_local+0x47/0x7f0
   xprt_create_transport+0x16c/0x730
   rpc_create+0x38e/0x7f0
   gssp_rpc_create+0xe2/0x180
   set_gssp_clnt+0xba/0x1b0
   write_gssp+0x200/0x310
   proc_reg_write+0x240/0x330
   vfs_write+0x2aa/0x1050
   ksys_write+0x12a/0x250
   do_syscall_64+0x117/0x750
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

create_use_gss_proxy_proc_entry() stores the struct net pointer as the
proc entry's private data without taking a reference on it, and an open
file descriptor does not pin the namespace either, as procfs only pins
the proc_dir_entry. write_gssp() reads that pointer back with
pde_data() and hands it to set_gssp_clnt(), which reaches xprt_init():

	xprt->xprt_net = get_net_track(net, &xprt->ns_tracker, GFP_KERNEL);

get_net_track() -> get_net() -> refcount_inc() is unconditional, so
rpc_create() assumes its caller holds a reference on args.net.
write_gssp() does not.

Dropping the last ns.count reference does not make the file go away.
__put_net() only queues cleanup_net() on a workqueue, and the
remove_proc_entry() that fences off further writes runs from the
rpcsec_gss pernet .exit method, that is, from inside cleanup_net(). A
write landing between those two points increments a refcount that is
already zero. cleanup_net() does not re-read ns.count, so the namespace
is freed anyway and the rpc_xprt -- along with the AF_LOCAL socket
opened for it -- is left pointing at freed memory. The resurrected
count is visible to the rest of that teardown too: with
CONFIG_IPV6_MROUTE the same cleanup_net() worker then trips
!mr_can_free_table() in ip6mr_free_table(), which tests check_net() on
the namespace it is freeing.

It reduces to opening /proc/net/rpc/use-gss-proxy inside a new network
namespace, calling setns() back to the original one to drop the last
reference, and then writing "1" to the still-open descriptor.

Take the reference in write_gssp() itself and refuse the write when the
namespace is already gone. This is what procfs does for every other
/proc/net file: get_proc_net() is maybe_get_net(PDE_NET(PDE(inode)))
and seq_open_net() returns -ENXIO when it fails. PDE_NET() cannot be
reused here because the parent directory /proc/net/rpc carries no
namespace pointer. Adding a .pre_exit to rpcsec_gss_net_ops so the
entry is removed earlier would only narrow the window, since pre_exit
also runs from cleanup_net().

Live namespaces are unaffected: a write still returns the error from
set_gssp_clnt(), a write of "2" still returns -EINVAL, and reads are
untouched.

Fixes: 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Cc: stable@vger.kernel.org
Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
Link: https://patch.msgid.link/20260907085435.644076-1-yzjaurora@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f7f885ab0a4b9c..c595272eee6ae7 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1420,10 +1420,18 @@ static ssize_t write_gssp(struct file *file, const char __user *buf,
 		return res;
 	if (i != 1)
 		return -EINVAL;
+
+	/*
+	 * Neither the proc entry nor an open descriptor pins @net, so it
+	 * might already be dying when rpc_create() takes its reference.
+	 */
+	if (!maybe_get_net(net))
+		return -ENXIO;
+
 	res = set_gssp_clnt(net);
-	if (res)
-		return res;
-	res = set_gss_proxy(net, 1);
+	if (!res)
+		res = set_gss_proxy(net, 1);
+	put_net(net);
 	if (res)
 		return res;
 	return count;

From b5e5d035abd1b49ecc9c85320fd6dfcc57ef9c79 Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Date: Tue, 21 Jul 2026 11:36:15 +0200
Subject: [PATCH 0658/1982] spmi: Fix potential use-after-free by grabbing
 of_node reference

commit f7aa9de4f2b197cdd704cdc476901b68ee128433 upstream.

As noticed by Sashiko during a review run of an unrelated patch,
in of_spmi_register_devices(), for_each_available_child_of_node()
is used to loop through children, and to also assign a node to a
newly created SPMI child device.

Problem is that the refcount is dropped at every iteration so, in
the specific case of DT overlays, a use-after-free may occur when
an overlay is dynamically unloaded!

To resolve this, increase the of_node refcount when assigning (in
function of_spmi_register_devices) and release the reference in
spmi_device_remove().

Fixes: bc32bbd04011 ("spmi: Set fwnode for spmi devices")
Cc: stable@vger.kernel.org
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260608100949.36309-1-angelogioacchino.delregno@collabora.com?part=2
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spmi/spmi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
index 3cf8d9bd4566f0..4253328dc9df1d 100644
--- a/drivers/spmi/spmi.c
+++ b/drivers/spmi/spmi.c
@@ -24,6 +24,7 @@ static void spmi_dev_release(struct device *dev)
 {
 	struct spmi_device *sdev = to_spmi_device(dev);
 
+	of_node_put(dev->of_node);
 	kfree(sdev);
 }
 
@@ -517,7 +518,7 @@ static void of_spmi_register_devices(struct spmi_controller *ctrl)
 		if (!sdev)
 			continue;
 
-		device_set_node(&sdev->dev, of_fwnode_handle(node));
+		device_set_node(&sdev->dev, of_fwnode_handle(of_node_get(node)));
 		sdev->usid = (u8)reg[0];
 
 		err = spmi_device_add(sdev);

From 6c4c12b0fadcb71e4e6616e6c1ca529c772f2a15 Mon Sep 17 00:00:00 2001
From: Diego Oliva <diego@bynar.io>
Date: Tue, 29 Sep 2026 10:16:30 +0100
Subject: [PATCH 0659/1982] smb: client: fix use-after-free infoleak via the
 readdir resume name

commit 59131dd72f62b198fc9ea1489ad9d3573154f684 upstream.

CIFSFindNext() copies the resume name that cifs_save_resume_key()
recorded from the last entry of the previous response into its request;
psrch_inf->presume_name points into the response buffer that entry came
from, and nothing ever clears it. find_cifs_entry() records a new
name only from a response with a usable last entry, and cifs_readdir()
only from an entry it walks to, so a response that carries no entries
and leaves last_entry NULL, because CIFSFindFirst() or CIFSFindNext()
rejected LastNameOffset, refreshes neither and presume_name keeps
pointing into the previous response. That buffer has already been
released: by CIFSFindNext() before it installs the new response, or by
find_cifs_entry() when it rewinds the search, which does not drop the
name either and can then fail in initiate_cifs_search() before a new
response replaces it. The next CIFSFindNext() then copies up to
PATH_MAX - 1 bytes of the resume name out of the released buffer into
its request and sends them to the server: a use-after-free read
that leaks kernel memory to a malicious or compromised server, which
can provoke it with a single FindNext response that carries no entries
and a LastNameOffset above CIFSMaxBufSize, which is all the existing
check rejects.

With KASAN enabled, a server that answers a listing that way gives:

 CIFS: VFS: ignoring corrupt resume name
 ==================================================================
 BUG: KASAN: slab-use-after-free in CIFSFindNext+0x8ca/0x14c0
 Read of size 4080 at addr ffff88807c823f98 by task ls/83

 CPU: 0 UID: 0 PID: 83 Comm: ls Tainted: G    B               7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
 Tainted: [B]=BAD_PAGE
 Call Trace:
  <TASK>
  kasan_report+0xdf/0x1a0
  kasan_check_range+0x10f/0x1e0
  __asan_memcpy+0x23/0x60
  CIFSFindNext+0x8ca/0x14c0
  cifs_readdir+0xf51/0x29c0
  iterate_dir+0x1c0/0x570
  __x64_sys_getdents64+0x133/0x270
  do_syscall_64+0x109/0x5d0
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

 Allocated by task 83 on cpu 1 at 13.497119s:
  cifs_buf_get+0x36/0x90
  smb_init+0x4f/0x110
  CIFSFindNext+0xf7/0x14c0
  cifs_readdir+0xf51/0x29c0

 Freed by task 83 on cpu 0 at 13.584018s:
  cifs_buf_release+0x41/0x80
  CIFSFindNext+0xfce/0x14c0
  cifs_readdir+0xf51/0x29c0

 The buggy address is located 16280 bytes inside of
  freed 16588-byte region [ffff88807c820000, ffff88807c8240cc)
 ==================================================================

The same memcpy() first reads past the end of that object while it is
still live, a slab-out-of-bounds read that the following patches
bound; that is the taint the report above carries.

SMB1 is not negotiated by default; reaching this code requires an
explicit vers=1.0 mount.

Clear presume_name and resume_name_len whenever a new response is
installed and when the rewind path releases the search buffer, so that
the name never outlives the buffer it points into, and reset
resume_key with them, since it was taken from the same entry and would
otherwise be sent with an empty name. A response without a usable
last entry then continues the search with an empty resume name rather
than a stale one; CIFSFindNext() skips the copy of a zero-length name
so that it never runs on the NULL pointer.

The next patch in the series leaves last_entry NULL for a response
that carries no entries, and bounds LastNameOffset against the
received response rather than against CIFSMaxBufSize. Responses that
are given a last entry today then take the path fixed here, so that
patch must not be applied without this one.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: b77d753c413e ("[CIFS] Check that last search entry resume key is valid")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cifssmb.c | 11 ++++++++++-
 fs/smb/client/readdir.c |  3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 88671e0a29295a..9899a4e3d7aec7 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4444,6 +4444,9 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon,
 	psrch_inf->entries_in_buffer = le16_to_cpu(parms->SearchCount);
 	psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
 		psrch_inf->entries_in_buffer;
+	psrch_inf->presume_name = NULL;
+	psrch_inf->resume_name_len = 0;
+	psrch_inf->resume_key = 0;
 	lnoff = le16_to_cpu(parms->LastNameOffset);
 	if (CIFSMaxBufSize < lnoff) {
 		cifs_dbg(VFS, "ignoring corrupt resume name\n");
@@ -4507,7 +4510,10 @@ int CIFSFindNext(const unsigned int xid, struct cifs_tcon *tcon,
 	name_len = psrch_inf->resume_name_len;
 	params += name_len;
 	if (name_len < PATH_MAX) {
-		memcpy(pSMB->ResumeFileName, psrch_inf->presume_name, name_len);
+		if (name_len) {
+			memcpy(pSMB->ResumeFileName,
+			       psrch_inf->presume_name, name_len);
+		}
 		byte_count += name_len;
 		/* 14 byte parm len above enough for 2 byte null terminator */
 		pSMB->ResumeFileName[name_len] = 0;
@@ -4562,6 +4568,9 @@ int CIFSFindNext(const unsigned int xid, struct cifs_tcon *tcon,
 	psrch_inf->endOfSearch = !!parms->EndofSearch;
 	psrch_inf->entries_in_buffer = le16_to_cpu(parms->SearchCount);
 	psrch_inf->index_of_last_entry += psrch_inf->entries_in_buffer;
+	psrch_inf->presume_name = NULL;
+	psrch_inf->resume_name_len = 0;
+	psrch_inf->resume_key = 0;
 	lnoff = le16_to_cpu(parms->LastNameOffset);
 	if (CIFSMaxBufSize < lnoff) {
 		cifs_dbg(VFS, "ignoring corrupt resume name\n");
diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c
index 0cc5ed56571a6e..b19c36f6a78b44 100644
--- a/fs/smb/client/readdir.c
+++ b/fs/smb/client/readdir.c
@@ -749,6 +749,9 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
 			cfile->srch_inf.ntwrk_buf_start = NULL;
 			cfile->srch_inf.srch_entries_start = NULL;
 			cfile->srch_inf.last_entry = NULL;
+			cfile->srch_inf.presume_name = NULL;
+			cfile->srch_inf.resume_name_len = 0;
+			cfile->srch_inf.resume_key = 0;
 		}
 		rc = initiate_cifs_search(xid, file, full_path);
 		if (rc) {

From 8069935474b1502459ab50f75a67d7394a93cd5d Mon Sep 17 00:00:00 2001
From: Henry Martin <bsdhenrymartin@gmail.com>
Date: Sat, 10 Oct 2026 11:28:56 +0800
Subject: [PATCH 0660/1982] smb: client: fix use-after-free in
 cifs_ses_add_channel()

commit 031278577380e7875d95aed81a2b2bcac39be923 upstream.

The error path of cifs_ses_add_channel() calls cifs_put_tcp_session()
before cifs_chan_clear_need_reconnect().  The latter reaches
cifs_ses_get_chan_index(), which dereferences server->terminate; if
the put was the final reference, TCP_Server_Info is already freed and
this is a use-after-free.  Same put-then-use pattern as the recently
fixed sibling in commit 717e0a25036b ("cifs: Fix server use-after-free
in cifs_chan_skip_or_disable()").

Move the put last, but do not read chan->server after dropping
chan_lock: chan points into ses->chans[], and once chan_count is
decremented a concurrent add_channel can reuse the slot and overwrite
the pointer, so the put would act on the new channel's server.  Cache
the pointer under chan_lock, clear the reconnect bit and decrement
chan_count while still holding the reference, and release it after
the unlock.

This issue was discovered by Tencent CodeBuddy Security.

Fixes: ee1d21794e55a ("cifs: handle when server stops supporting multichannel")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/sess.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index 6f4194811ba7b9..042dcca4c3e8fd 100644
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -621,12 +621,13 @@ cifs_ses_add_channel(struct cifs_ses *ses,
 
 out:
 	if (rc && chan->server) {
-		cifs_put_tcp_session(chan->server, 0);
+		struct TCP_Server_Info *pserver;
 
 		spin_lock(&ses->chan_lock);
+		pserver = chan->server;
 
 		/* we rely on all bits beyond chan_count to be clear */
-		cifs_chan_clear_need_reconnect(ses, chan->server);
+		cifs_chan_clear_need_reconnect(ses, pserver);
 		ses->chan_count--;
 		/*
 		 * chan_count should never reach 0 as at least the primary
@@ -634,6 +635,7 @@ cifs_ses_add_channel(struct cifs_ses *ses,
 		 */
 		WARN_ON(ses->chan_count < 1);
 		spin_unlock(&ses->chan_lock);
+		cifs_put_tcp_session(pserver, 0);
 	}
 
 	kfree(ctx->UNC);

From e5388f15d595dd4d7599a43e9cb58c0656a6aec6 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 20:28:40 +0800
Subject: [PATCH 0661/1982] RDMA/irdma: avoid use-after-free in icrdma_remove

commit 8a8088b899e4cdfe558428cd6113d45df81625be upstream.

icrdma_remove() dereferences iwdev after calling
irdma_ib_unregister_device():

  irdma_ib_unregister_device(iwdev)
    -> ib_unregister_device(&iwdev->ibdev)
      -> __ib_unregister_device()
        -> ib_dealloc_device()

irdma registers irdma_ib_dealloc_device() as the dealloc_driver
callback in its ib_device_ops. The RDMA core explicitly documents
ib_unregister_device() that when ops.dealloc_driver is used, ib_dev
will be freed upon return from the function.

The ib_device is embedded in struct irdma_device and iwdev itself was
allocated by ib_alloc_device(irdma_device, ibdev). Consequently, once
irdma_ib_unregister_device() returns, iwdev must no longer be
dereferenced.

However, icrdma_remove() currently accesses iwdev->rf afterwards when
deinitializing interrupts, destroying ah_tbl_lock, and freeing rf.
Although the final ib_device storage is released with kfree_rcu(), the
object lifetime has already ended and callers must not rely on the RCU
grace period to continue dereferencing iwdev.

Save iwdev->rf before unregistering the RDMA device and use the saved
pointer for the remaining cleanup.

This issue was found by manual code inspection.

Fixes: 8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and implement private channel OPs")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260914122840.1709743-1-lgs201920130244@gmail.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/irdma/icrdma_if.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
index 6c1d285d1c1761..bbf8d1cf757cf9 100644
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -319,14 +319,15 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
 		container_of(aux_dev, struct iidc_rdma_core_auxiliary_dev, adev);
 	struct iidc_rdma_core_dev_info *cdev_info = idc_adev->cdev_info;
 	struct irdma_device *iwdev = auxiliary_get_drvdata(aux_dev);
-	u8 rdma_ver = iwdev->rf->rdma_ver;
+	struct irdma_pci_f *rf = iwdev->rf;
+	u8 rdma_ver = rf->rdma_ver;
 
 	ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
 	irdma_ib_unregister_device(iwdev);
-	icrdma_deinit_interrupts(iwdev->rf, cdev_info);
-	mutex_destroy(&iwdev->rf->ah_tbl_lock);
+	icrdma_deinit_interrupts(rf, cdev_info);
+	mutex_destroy(&rf->ah_tbl_lock);
 
-	kfree(iwdev->rf);
+	kfree(rf);
 
 	pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
 		 rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));

From 48157350b24ac0343374ee3fa34188d7ff30be81 Mon Sep 17 00:00:00 2001
From: James Kim <james010kim@gmail.com>
Date: Mon, 14 Sep 2026 13:23:27 +0900
Subject: [PATCH 0662/1982] rapidio: mport_cdev: fix use-after-free in
 mport_mm_close()

commit 0f2cd84858e67cf8e02438bf28243bcdc67aa49a upstream.

A use-after-free vulnerability was identified in mport_mm_close() in
drivers/rapidio/devices/rio_mport_cdev.c, identical to the pattern
previously addressed in dma_req_free().

This is observable from userspace when an application creates an mmap
mapping via the RapidIO character device and subsequently unmaps it (or
terminates, triggering exit_mmap()).  During munmap, mport_mm_close() is
invoked and drops the mapping reference via kref_put().

If kref_put() drops the last reference, mport_release_mapping() is called,
which frees the underlying rio_mport_mapping structure.  The subsequent
mutex_unlock() then dereferences map->md to unlock buf_mutex, leading to a
use-after-free:

   mport_mm_close()
     -> mutex_lock(&map->md->buf_mutex);
     ...
     -> kref_put(&map->ref, mport_release_mapping); /* map is freed */
     -> mutex_unlock(&map->md->buf_mutex);          /* UAF: map used */

Fix this by caching map->md before kref_put() and using the cached pointer
for mutex unlocking, ensuring that freed memory is not accessed.

Link: https://lore.kernel.org/20260914042327.49798-1-james010kim@gmail.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: James Kim <james010kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rapidio/devices/rio_mport_cdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index c3fa45b26c1bed..d5fe3d437b1245 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -2168,11 +2168,12 @@ static void mport_mm_open(struct vm_area_struct *vma)
 static void mport_mm_close(struct vm_area_struct *vma)
 {
 	struct rio_mport_mapping *map = vma->vm_private_data;
+	struct mport_dev *md = map->md;
 
 	rmcd_debug(MMAP, "%pad", &map->phys_addr);
-	mutex_lock(&map->md->buf_mutex);
+	mutex_lock(&md->buf_mutex);
 	kref_put(&map->ref, mport_release_mapping);
-	mutex_unlock(&map->md->buf_mutex);
+	mutex_unlock(&md->buf_mutex);
 }
 
 static const struct vm_operations_struct vm_ops = {

From ff2c27583cf9f4e009e30ca27b04f69bbc9b9674 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Mon, 21 Sep 2026 12:04:09 -0500
Subject: [PATCH 0663/1982] platform/x86/amd: hfi: Fix a use-after-free when
 unloading the driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 55d8406dfa2fa8ad8ac2f053c2a53a97d8b0ce48 upstream.

amd_hfi_probe() registers CPU hotplug callbacks with
cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, ...) and schedules the static
sched_amd_hfi_itmt_work work item, but amd_hfi_remove() tears down
neither.  The dynamically assigned hotplug state returned by
cpuhp_setup_state() is discarded, so cpuhp_remove_state() can never be
called, and the pending work is never cancelled.

After the module is unloaded and its memory is freed, any subsequent CPU
hotplug event or execution of the scheduled work dereferences the stale
callback and work function pointers, resulting in a use-after-free and
kernel panic.

Store the hotplug state returned by cpuhp_setup_state() and, on removal,
call cpuhp_remove_state() to unregister the callbacks and
cancel_work_sync() to flush the scheduled work before the module memory
goes away.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: bb20421c05fc ("platform/x86: hfi: Add online and offline callback support")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260921170411.1149960-2-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/amd/hfi/hfi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/platform/x86/amd/hfi/hfi.c b/drivers/platform/x86/amd/hfi/hfi.c
index a465ac6f607eac..ac6ef0b5b95b2d 100644
--- a/drivers/platform/x86/amd/hfi/hfi.c
+++ b/drivers/platform/x86/amd/hfi/hfi.c
@@ -76,6 +76,8 @@ struct amd_hfi_data {
 	struct amd_shmem_info	*shmem;
 
 	struct dentry *dbgfs_dir;
+
+	int cpuhp_state;
 };
 
 /**
@@ -245,6 +247,8 @@ static void amd_hfi_remove(struct platform_device *pdev)
 {
 	struct amd_hfi_data *dev = platform_get_drvdata(pdev);
 
+	cpuhp_remove_state(dev->cpuhp_state);
+	cancel_work_sync(&sched_amd_hfi_itmt_work);
 	debugfs_remove_recursive(dev->dbgfs_dir);
 }
 
@@ -502,6 +506,7 @@ static int amd_hfi_probe(struct platform_device *pdev)
 				amd_hfi_online, amd_hfi_offline);
 	if (ret < 0)
 		return ret;
+	amd_hfi_data->cpuhp_state = ret;
 
 	schedule_work(&sched_amd_hfi_itmt_work);
 

From 506c066da8fb2cef32210ca84439c7bb9855504f Mon Sep 17 00:00:00 2001
From: Daejun Park <daejun7.park@samsung.com>
Date: Fri, 2 Oct 2026 16:02:00 +0900
Subject: [PATCH 0664/1982] nvmet: fix use-after-free of the old registrant in
 nvmet_pr_preempt()

commit f316aa7f018840523939183425394931b373e4d7 upstream.

nvmet_pr_preempt() handles a preempt sent by the reservation holder by
changing the reservation type with nvmet_pr_update_reg_attr(), unless
the reservation is of an All Registrants type.  For the holder that
helper does not modify the registrant in place: it puts a copy on the
registrant list, points pr->holder to the copy and passes the old
registrant to kfree_rcu().

If the reservation type changed, nvmet_pr_preempt() then hands
&reg->hostid of that old registrant to nvmet_pr_resv_released().  Unless
the reservation released notification is masked, that function takes
subsys->lock and compares the host id against every controller of the
subsystem.  The caller only holds pr->pr_sem and is not in an RCU
read-side critical section, so nothing keeps the old registrant alive
while it is read.

The result is a read of 16 freed bytes that decides which controllers
get the notification.  Found by code inspection.  kfree_rcu() defers
the free, so it usually happens after the read; when the pending free
is forced to run before the read, KASAN reports the host id as freed
memory.

Pass the host id of the controller that sent the command instead.  The
registrant was looked up by that host id, and the controller outlives
the request.

Fixes: 5a47c2080a73 ("nvmet: support reservation feature")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/target/pr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/pr.c b/drivers/nvme/target/pr.c
index a3cad41323aa44..9ab50f821ad692 100644
--- a/drivers/nvme/target/pr.c
+++ b/drivers/nvme/target/pr.c
@@ -593,7 +593,7 @@ static u16 nvmet_pr_preempt(struct nvmet_req *req,
 		status = nvmet_pr_update_reg_attr(pr, holder,
 				nvmet_pr_update_holder_rtype, &rtype);
 		if (!status && original_rtype != rtype)
-			nvmet_pr_resv_released(pr, &reg->hostid);
+			nvmet_pr_resv_released(pr, &ctrl->hostid);
 		return status;
 	}
 

From 6324f087caf817f00840baa82664dec3c5634f1c Mon Sep 17 00:00:00 2001
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Date: Sun, 18 Oct 2026 00:38:05 +0900
Subject: [PATCH 0665/1982] nvmet-fc: fix use-after-free in
 nvmet_fc_ls_create_connection()

commit 2c29f8c9b9e598c09fa50aa02200136a107f6b3f upstream.

nvmet_fc_ls_create_connection() looks up the association with
nvmet_fc_find_target_assoc(), which returns it with a reference held,
and drops that reference as soon as the target queue has been allocated.
iod->assoc is then dereferenced again by nvmet_fc_makeconnid() while
building the connection id.

The queue only borrows the pointer and takes no reference of its own.
Once the lookup reference is dropped the association is kept alive
solely by the reference taken when it was created, so a disconnect LS or
a remote port unregister running concurrently can free it before
nvmet_fc_makeconnid() reads it:

BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167

Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work
Call Trace:
 <TASK>
 dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
 print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
 kasan_report (mm/kasan/report.c:595)
 nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
 process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
 worker_thread (kernel/workqueue.c:3486)
 kthread (kernel/kthread.c:436)
 ret_from_fork (archkernel/process.c:158)
 ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
 </TASK>

Freed by task 1167 on cpu 0 at 405.998150s:
 kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
 kasan_save_free_info (mm/kasan/generic.c:584)
 __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
 kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
 nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
 process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
 worker_thread (kernel/workqueue.c:3486)
 kthread (kernel/kthread.c:436)
 ret_from_fork (archkernel/process.c:158)
 ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

The buggy address belongs to the object at ffff888179f1b000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes inside of
 freed 2048-byte region [ffff888179f1b000, ffff888179f1b800)

Hold the lookup reference until the response has been built, and drop it
on the error path as well.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-nvme/20260731204504.2396434-1-shuangpeng.kernel@gmail.com
Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/target/fc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index a61c3c93b38205..1880fc78043261 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1802,9 +1802,6 @@ nvmet_fc_ls_create_connection(struct nvmet_fc_tgtport *tgtport,
 					be16_to_cpu(rqst->connect_cmd.sqsize));
 			if (!queue)
 				ret = VERR_QUEUE_ALLOC_FAIL;
-
-			/* release get taken in nvmet_fc_find_target_assoc */
-			nvmet_fc_tgt_a_put(iod->assoc);
 		}
 	}
 
@@ -1818,6 +1815,8 @@ nvmet_fc_ls_create_connection(struct nvmet_fc_tgtport *tgtport,
 					FCNVME_RJT_RC_INV_ASSOC :
 					FCNVME_RJT_RC_LOGIC,
 				FCNVME_RJT_EXP_NONE, 0);
+		if (iod->assoc)
+			nvmet_fc_tgt_a_put(iod->assoc);
 		return;
 	}
 
@@ -1839,6 +1838,9 @@ nvmet_fc_ls_create_connection(struct nvmet_fc_tgtport *tgtport,
 	acc->connectid.connection_id =
 			cpu_to_be64(nvmet_fc_makeconnid(iod->assoc,
 				be16_to_cpu(rqst->connect_cmd.qid)));
+
+	/* release get taken in nvmet_fc_find_target_assoc */
+	nvmet_fc_tgt_a_put(iod->assoc);
 }
 
 /*

From 439c23b897c8787f2d0c292ba9c1a2ee75595c0d Mon Sep 17 00:00:00 2001
From: Nirmoy Das <nirmoyd@nvidia.com>
Date: Wed, 14 Oct 2026 06:36:32 -0700
Subject: [PATCH 0666/1982] iommufd: Fix event queue release use-after-free

commit 440ca8a4b69f40088065b9e05ef11373292a254e upstream.

iommufd_eventq_fops_release() drops the file's users reference before
reading eventq->ictx. Once that reference is dropped, IOMMU_DESTROY in
another thread can remove and free the event queue, so the later load
accesses freed memory.

Read ictx while the users reference still pins the event queue, then
drop the reference and put the saved context. The context reference
taken by iommufd_eventq_init() keeps ictx valid until the put. Fault and
vEVENTQ file descriptors share this release path.

Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Cc: stable@vger.kernel.org
Assisted-by: LLM, Specula
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20261014133632.3440297-1-nirmoyd@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/iommufd/eventq.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/eventq.c b/drivers/iommu/iommufd/eventq.c
index 8971360c955aec..72a3032e8a0004 100644
--- a/drivers/iommu/iommufd/eventq.c
+++ b/drivers/iommu/iommufd/eventq.c
@@ -396,9 +396,11 @@ static __poll_t iommufd_eventq_fops_poll(struct file *filep,
 static int iommufd_eventq_fops_release(struct inode *inode, struct file *filep)
 {
 	struct iommufd_eventq *eventq = filep->private_data;
+	/* eventq may be freed once the users reference is dropped. */
+	struct iommufd_ctx *ictx = eventq->ictx;
 
 	refcount_dec(&eventq->obj.users);
-	iommufd_ctx_put(eventq->ictx);
+	iommufd_ctx_put(ictx);
 	return 0;
 }
 

From 2b61008c9f884ead174a67f1cc70342a9efee3e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>
Date: Tue, 6 Oct 2026 12:58:47 +0200
Subject: [PATCH 0667/1982] landlock: Fix superblock use-after-free in
 release_inode()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3e271a27c46fd591d1011c7de5a644a41e2010f1 upstream.

Without this fix, release_inode() (task 1) can race with a umount
operation in hook_sb_delete() (task 2).  The order of operations in
which the race occurs is:

* task 2: hook_sb_delete() arrives at the end of the function, waiting
  for landlock_superblock(sb)->inode_refs to become zero.
* task 1: release_inode(): does atomic_long_dec_and_test(), decrementing
  inode_refs to zero.
* task 2: gets woken up through some other means, sees that inode_refs
  is zero and returns.  The caller is the unmount operation and proceeds
  to release the superblock.
* task 1: Runs wake_up_var(&landlock_superblock(sb)->inode_refs),
  *dereferencing the sb_security on the freed-up superblock*.

Notably, wake_up_var() does not dereference the pointer passed to it,
and only uses it to determine an overapproximated set of tasks to wake
up. So while it's potentially possible for an attacker to provide a
different value for that pointer, this only results in the wrong set of
tasks getting woken up, and in this scenario, no further tasks are
actually waiting.

Nevertheless, KASAN detects it as a slab-use-after-free read on
sb->s_security:

  BUG: KASAN: slab-use-after-free in release_inode+0x196/0x290
  Read of size 8 at addr ffff888103b6c0a8 by task repro/217
   release_inode+0x196/0x290
   landlock_put_object+0x71/0x90
   landlock_free_rules+0x38/0xc0
   landlock_put_ruleset+0x47/0x130
   fop_ruleset_release+0x33/0x40
   __fput+0x305/0x780
  Freed by task 54:
   kfree+0x11c/0x390
   process_scheduled_works+0x766/0xe50
   worker_thread+0x7bc/0xb20

The fix is to determine &landlock_superblock(inode->i_sb)->inode_refs only once
earlier in release_inode(), and later use that precalculated address for the
wake_up_var() call, without having to dereference through the superblock.

Cc: stable@vger.kernel.org
Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
Assisted-by: LLM
Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20261006105847.2541190-1-gnoack@google.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/landlock/fs.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index a32658c18880fe..4fa57e255dde8c 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -57,7 +57,7 @@ static void release_inode(struct landlock_object *const object)
 	__releases(object->lock)
 {
 	struct inode *const inode = object->underobj;
-	struct super_block *sb;
+	atomic_long_t *inode_refs;
 
 	if (!inode) {
 		spin_unlock(&object->lock);
@@ -73,8 +73,8 @@ static void release_inode(struct landlock_object *const object)
 	 * Makes sure that if the filesystem is concurrently unmounted,
 	 * hook_sb_delete() will wait for us to finish iput().
 	 */
-	sb = inode->i_sb;
-	atomic_long_inc(&landlock_superblock(sb)->inode_refs);
+	inode_refs = &landlock_superblock(inode->i_sb)->inode_refs;
+	atomic_long_inc(inode_refs);
 	spin_unlock(&object->lock);
 	/*
 	 * Because object->underobj was not NULL, hook_sb_delete() and
@@ -88,8 +88,8 @@ static void release_inode(struct landlock_object *const object)
 	 */
 
 	iput(inode);
-	if (atomic_long_dec_and_test(&landlock_superblock(sb)->inode_refs))
-		wake_up_var(&landlock_superblock(sb)->inode_refs);
+	if (atomic_long_dec_and_test(inode_refs))
+		wake_up_var(inode_refs);
 }
 
 static const struct landlock_object_underops landlock_fs_underops = {

From 70825b251e5f7855fd7bd93afc0b698154e00e70 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 22 Aug 2026 21:40:15 -0400
Subject: [PATCH 0668/1982] lockd: Fix use-after-free in nlmsvc_retry_blocked

commit f5b7634f0f213299a07b461fb10385c8639a4ab8 upstream.

nlmsvc_retry_blocked() examines the block at the head of nlm_blocked
under nlm_blocked_lock, then releases the lock before calling
nlmsvc_grant_blocked() or retry_deferred_block(). The nlm_blocked list
reference is all that keeps the block alive across that window.
nlmsvc_grant_blocked() does take one of its own, but not until after
the lock has been dropped. Unmounting the nfsd filesystem while a lock
request is still blocked reaches nlmsvc_traverse_blocks(), which drops
the list reference and frees the block along with the nlm_rqst hanging
off it.

  BUG: KASAN: slab-use-after-free in nlm_async_call+0xd6/0x230
  Read of size 8 at addr ffff88811b04c808 by task lockd/8377
    nlm_async_call+0xd6/0x230
    nlmsvc_retry_blocked+0x61c/0x800
    lockd+0x144/0x1c0
  Freed by task 8392:
    nlmsvc_release_block+0x231/0x290
    nlmsvc_traverse_blocks+0x139/0x1b0
    nlm_traverse_files+0x1aa/0xa00
    nlmsvc_free_host_resources+0x12/0x60
    nlm_shutdown_hosts_net+0x127/0x280
    lockd_down+0xd5/0x1c0

Take a reference before releasing nlm_blocked_lock and drop it once
the retry has run.

Fixes: 0e4ac9d93515 ("lockd: handle fl_grant callbacks")
Cc: stable@vger.kernel.org
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-nfs/20260818235808.3458075-1-shuangpeng.kernel@gmail.com/
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260822-lockd-retry-blocked-uaf-v3-1-761661eae60c@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/lockd/svclock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index c35ffa1b4b89d4..6f60688bc6490a 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -1048,6 +1048,7 @@ nlmsvc_retry_blocked(struct svc_rqst *rqstp)
 			timeout = block->b_when - jiffies;
 			break;
 		}
+		kref_get(&block->b_count);
 		spin_unlock(&nlm_blocked_lock);
 
 		dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
@@ -1058,6 +1059,7 @@ nlmsvc_retry_blocked(struct svc_rqst *rqstp)
 			retry_deferred_block(block);
 		} else
 			nlmsvc_grant_blocked(block);
+		nlmsvc_release_block(block);
 		spin_lock(&nlm_blocked_lock);
 	}
 	spin_unlock(&nlm_blocked_lock);

From 95a1f45a82e51ff23bd82c0529bfd817c8ec437f Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Mon, 10 Aug 2026 05:51:28 +0000
Subject: [PATCH 0669/1982] media: au0828: fix use-after-free in bulk_timeout
 timer on disconnect

commit 521030837bee352515d5ea57cc6a29581db3506e upstream.

start_urb_transfer() arms dev->bulk_timeout, whose callback
au0828_bulk_timeout() queues dev->restart_streaming; that work in turn
calls start_urb_transfer() and re-arms the timer.

au0828_dvb_unregister() cancels restart_streaming on disconnect but does
not sync bulk_timeout. au0828_usb_release() then frees dev with kfree(),
so a timer still armed or pending at that point can fire after the free
and dereference dev through timer_container_of().

Sync the timer with timer_shutdown_sync() before cancel_work_sync().  The
timer callback queues the work, so the timer must be stopped first; the
shutdown variant is needed because the work re-arms the timer through
start_urb_transfer().  The dvb->frontend == NULL early return guards the
register-failure path where the timer was never set up.

This bug was found by static analysis.

Fixes: 53460c53b761 ("[media] au0828: Add timer to restart TS stream if no data arrives on bulk endpoint")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/au0828/au0828-dvb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c
index 5d0447ff7d06ed..51752a922a744a 100644
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -537,6 +537,7 @@ void au0828_dvb_unregister(struct au0828_dev *dev)
 	if (dvb->frontend == NULL)
 		return;
 
+	timer_shutdown_sync(&dev->bulk_timeout);
 	cancel_work_sync(&dev->restart_streaming);
 
 	dvb_net_release(&dvb->net);

From 2344922abe2ad811003794092931bf454b556109 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Tue, 4 Aug 2026 14:47:01 +0800
Subject: [PATCH 0670/1982] media: cx23885: Fix use-after-free in
 cx23885_finidev due to race condition

commit 75016a992d9b03f5cc6df1414d1da35840d4feeb upstream.

In cx23885_v4l2_dev_notify_init, &dev->cx25840_work is bound with
cx23885_av_work_handler, and &dev->ir_rx_work and &dev->ir_tx_work
are bound with cx23885_ir_rx_work_handler and
cx23885_ir_tx_work_handler. cx23885_irq can schedule these works on
system_wq when an AV_CORE interrupt is received, and the IR subdevice
can also schedule the IR works from its interrupt service routine via
the v4l2_device notify callback.

If we remove the device, cx23885_finidev makes cleanup and the memory
allocated for dev is released by kfree(dev), while the works mentioned
above may still be pending or running. The sequence of operations that
may lead to a UAF bug is as follows:

CPU0                                      CPU1

                                          | cx23885_irq
                                          | schedule_work(&dev->cx25840_work)
cx23885_finidev                           |
cx23885_input_fini(dev)                   |
cx23885_ir_fini(dev)                      |
cx23885_shutdown(dev)                     |
free_irq(pci_dev->irq, dev)               |
pci_disable_device(pci_dev)               |
cx23885_dev_unregister(dev)               |
v4l2_device_unregister(v4l2_dev)          |
kfree(dev)                                |
// dev is freed                           |
                                          | cx23885_av_work_handler
                                          | // use dev (use-after-free)

Fix it by canceling the works after the IRQ handler that can schedule
them has been stopped, and before proceeding with the remaining
cleanup in cx23885_finidev.

Note that the flush_work() calls in cx23885_input_ir_stop() do not
close this race: they only wait for works that are already queued or
running at that moment, they do not prevent the IRQ handler, which is
still registered at that point, from scheduling the works again
afterwards, and they are skipped entirely when dev->sd_ir is NULL.
The cancel_work_sync() calls are therefore placed after free_irq(),
the only point at which no new work can be scheduled.

Fixes: e5514f104d87 ("V4L/DVB: cx23885: Move AV Core irq handling to a work handler")
Cc: stable@vger.kernel.org
Assisted-by: Codex:deepseek-v4-flash
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/cx23885/cx23885-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 43d658a90f08e6..fd06557ad555fa 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -2233,6 +2233,10 @@ static void cx23885_finidev(struct pci_dev *pci_dev)
 	/* unregister stuff */
 	free_irq(pci_dev->irq, dev);
 
+	cancel_work_sync(&dev->cx25840_work);
+	cancel_work_sync(&dev->ir_rx_work);
+	cancel_work_sync(&dev->ir_tx_work);
+
 	pci_disable_device(pci_dev);
 
 	cx23885_dev_unregister(dev);

From e9deece85062873763dfbb8b1121e722ef2959a0 Mon Sep 17 00:00:00 2001
From: Anuj Bolewar <bolewara@gmail.com>
Date: Tue, 4 Aug 2026 10:18:21 +0530
Subject: [PATCH 0671/1982] media: hackrf: fix use-after-free in
 hackrf_alloc_urbs() error path

commit 6802ad4b6b267dda02209b5811edac7825c8a5f6 upstream.

hackrf_alloc_urbs() frees the URBs it allocated so far when one
allocation fails, but leaves the entries in dev->urb_list[] and
dev->urbs_initialized untouched. The caller, hackrf_start_streaming(),
then calls hackrf_free_urbs() on the error path, which walks
dev->urbs_initialized entries and calls usb_free_urb() a second time on
the already-freed URBs, causing a use-after-free (slab-use-after-free
Write in usb_free_urb()).

Drop the redundant cleanup loop inside hackrf_alloc_urbs() and let
hackrf_free_urbs(), which the caller already invokes on error, own the
cleanup of the successfully allocated URBs.

Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
Fixes: 969ec1f6bd92 ("[media] hackrf: HackRF SDR driver")
Cc: stable@vger.kernel.org
Signed-off-by: Anuj Bolewar <bolewara@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/hackrf/hackrf.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index c3c4247194d194..f7a0e4437be5a8 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -665,7 +665,7 @@ static int hackrf_free_urbs(struct hackrf_dev *dev)
 
 static int hackrf_alloc_urbs(struct hackrf_dev *dev, bool rcv)
 {
-	int i, j;
+	int i;
 	unsigned int pipe;
 	usb_complete_t complete;
 
@@ -681,11 +681,8 @@ static int hackrf_alloc_urbs(struct hackrf_dev *dev, bool rcv)
 	for (i = 0; i < MAX_BULK_BUFS; i++) {
 		dev_dbg(dev->dev, "alloc urb=%d\n", i);
 		dev->urb_list[i] = usb_alloc_urb(0, GFP_KERNEL);
-		if (!dev->urb_list[i]) {
-			for (j = 0; j < i; j++)
-				usb_free_urb(dev->urb_list[j]);
+		if (!dev->urb_list[i])
 			return -ENOMEM;
-		}
 		usb_fill_bulk_urb(dev->urb_list[i],
 				dev->udev,
 				pipe,

From c33165bb785cb0b496a196a5ca50b9d725bb7f82 Mon Sep 17 00:00:00 2001
From: Deepanshu Kartikey <kartikey406@gmail.com>
Date: Wed, 30 Sep 2026 14:05:51 +0530
Subject: [PATCH 0672/1982] media: imon: fix use-after-free in display_close
 via dev_dbg

commit 118a3590a4080c71c565265b05b3f92e814d7647 upstream.

ictx->dev is a raw pointer to the usb_interface's embedded device.
On disconnect, usb_disconnect() can drop the last reference on the
interface and free it while a userspace fd for /dev/lcd0 is still
open. When that fd is later closed, display_close() dereferences
the now-freed ictx->dev via dev_dbg(), causing a use-after-free.

Remove the dev_dbg() calls that dereference ictx->dev in
display_close() and free_imon_context(), rather than taking a
reference on the device.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
Link: https://lore.kernel.org/all/20260918054851.26083-1-kartikey406@gmail.com/T/ [v1]
Link: https://lore.kernel.org/all/20260928121230.35359-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/imon.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 4f974b88628f01..c925425ee5bbfd 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -492,16 +492,12 @@ MODULE_PARM_DESC(pad_thresh, "Threshold at which a pad push registers as an arro
 
 static void free_imon_context(struct imon_context *ictx)
 {
-	struct device *dev = ictx->dev;
-
 	usb_free_urb(ictx->tx_urb);
 	WARN_ON(ictx->dev_present_intf0);
 	usb_free_urb(ictx->rx_urb_intf0);
 	WARN_ON(ictx->dev_present_intf1);
 	usb_free_urb(ictx->rx_urb_intf1);
 	kfree_rcu(ictx, rcu);
-
-	dev_dbg(dev, "%s: iMON context freed\n", __func__);
 }
 
 /*
@@ -577,7 +573,6 @@ static int display_close(struct inode *inode, struct file *file)
 		retval = -EIO;
 	} else {
 		ictx->display_isopen = false;
-		dev_dbg(ictx->dev, "display port closed\n");
 	}
 
 	mutex_unlock(&ictx->lock);

From 8b87fd23be5a816ad572e23eb4e1e2bea027db6c Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <david@kernel.org>
Date: Thu, 15 Oct 2026 18:07:09 +0200
Subject: [PATCH 0673/1982] mm/hugetlb: fix use-after-free in
 hugetlb_mfill_atomic_pte()

commit d8a9cd7fd2fb01211430c933932da58839b8ca65 upstream.

Let's fix another instance where we use a folio after dropping the PTL,
where someone else could e.g., MADV_DONTNEED it once we drop the PTL,
making us trigger a use-after-free on the folio.

Link: https://lore.kernel.org/20261015-urgent_fixes-v1-3-42796911043b@kernel.org
Fixes: cb6acd01e2e4 ("hugetlbfs: fix races and page leaks during migration")
Fixes: 1c9e8def43a3 ("userfaultfd: hugetlbfs: add UFFDIO_COPY support for shared mappings")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 9df625de6dfe5c..db86d341effa59 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -7106,11 +7106,16 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte,
 	/* No need to invalidate - it was non-present before */
 	update_mmu_cache(dst_vma, dst_addr, dst_pte);
 
-	spin_unlock(ptl);
 	if (!is_continue)
 		folio_set_hugetlb_migratable(folio);
 	if (vm_shared || is_continue)
 		folio_unlock(folio);
+
+	/*
+	 * Hold the PTL until we're done with the folio: the page table owns the
+	 * folio reference now.
+	 */
+	spin_unlock(ptl);
 	ret = 0;
 out:
 	return ret;

From 1108d9a51c91bb459fa62506fd0176dc9e0927c5 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Thu, 15 Oct 2026 18:07:08 +0200
Subject: [PATCH 0674/1982] mm/hugetlb: fix use-after-free of a new anon folio

commit 824cc56bf43c714319992bad3558803cac6e77c0 upstream.

For a fault in a private mapping with nothing in the page cache,
hugetlb_no_page() allocates a folio, locks it and maps it.  The folio has
one reference, which belongs to the page table entry from then on.  After
dropping the page table lock the function still sets the migratable flag
of the folio and unlocks it.

Whoever zaps the entry in between frees the folio.  The fault holds the
fault mutex and the lock of the vma.  MADV_DONTNEED and the first unmap of
a hole punch, hugetlb_vmdelete_list(), do not take the fault mutex, and a
private vma only has a lock if it owns a reservation map: not with
MAP_NORESERVE, and not in the child after fork().

Then the flag is set in, and folio_unlock() is called on, a folio that is
free or has a new owner.  A surplus page goes back to the page allocator
while it is locked:

  BUG: Bad page state in process init  pfn:108e00
  flags: 0x200000000000059(locked|uptodate|dirty|head|node=0|zone=2)
  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set

A page of the pool can be given to the next user, of any file, who locks
it and loses the lock to the late folio_unlock():

  kernel BUG at mm/filemap.c:1532!
   hugetlb_no_page+0x111b/0x23e0
   hugetlb_fault+0x3a9/0x14a0

An unprivileged process is enough: threads that write to a MAP_PRIVATE |
MAP_NORESERVE hugetlb mapping, threads that call MADV_DONTNEED on it, and
one that takes the freed pages for another file.

Until commit 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more
pmd sharing synchronization") the fault held i_mmap_rwsem for reading,
which everybody who zaps takes for writing.  The lock that commit
bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs") gave
to private vmas closed the window again, but only for those with a
reservation map.

Be done with the folio before the page table lock is dropped, as
hugetlb_wp() is with its copy.  The function already unlocks page cache
folios under that lock.

Original fix generated by an LLM and sent in private by Josef.

[david@kernel.org: simplify+move comment]
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-2-42796911043b@kernel.org
Fixes: 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more pmd sharing synchronization")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index db86d341effa59..ebc78406335b3a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6628,8 +6628,6 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,
 		ret = hugetlb_wp(vmf);
 	}
 
-	spin_unlock(vmf->ptl);
-
 	/*
 	 * Only set hugetlb_migratable in newly allocated pages.  Existing pages
 	 * found in the pagecache may not have hugetlb_migratable if they have
@@ -6640,6 +6638,12 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,
 
 	if (folio_locked)
 		folio_unlock(folio);
+
+	/*
+	 * Hold the PTL until we're done with the folio: the page table owns the
+	 * folio reference now.
+	 */
+	spin_unlock(vmf->ptl);
 out:
 	hugetlb_vma_unlock_read(vma);
 

From 174b4b90ec6731934cf84eb267a86ad7152267fa Mon Sep 17 00:00:00 2001
From: Binbin Deng <18983559317@163.com>
Date: Wed, 23 Sep 2026 13:46:23 +0800
Subject: [PATCH 0675/1982] apparmor: fix a use-after-free in aa_lookupn_ns()

commit f292873ceb4bd3a1a0f75f884361cd556e457692 upstream.

aa_lookupn_ns() takes a reference on the namespace it finds with
aa_get_ns(), which is kref_get() on the reference count that the
namespace is released through, without checking whether the namespace
is still in use.  A concurrent removal of a ":"-prefixed namespace
looks the same namespace up and only then takes the parent lock to
remove it, so the last reference can be dropped between the lookup and
the aa_get_ns() call: the reference count then reports the increment on
a zero count and the kernel classifies the following use of the object
as a use-after-free.  A user with CAP_MAC_ADMIN can trigger this by
writing a ":<name>" removal and a ":<name>/<profile>" removal to
/sys/kernel/security/apparmor/.remove concurrently.

refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0xc0/0xe0, CPU#6
Call Trace:
 <TASK>
 aa_lookupn_ns+0xa9/0xc0
 aa_remove_profiles+0x4fb/0x730
 ? __kvmalloc_node_noprof+0x219/0x5c0
 ? __pfx_aa_remove_profiles+0x10/0x10
 ? aa_loaddata_alloc+0x65/0x1f0
 ? _copy_from_user+0x2d/0x80
 ? aa_loaddata_alloc+0x111/0x1f0
 profile_remove+0x2ee/0x4a0
 vfs_write+0x21e/0xcf0
 ? rcu_core+0x29c/0x1740
 ? timerqueue_linked_add+0x1f4/0x3d0
 ? __pfx_vfs_write+0x10/0x10
 ? mutex_lock+0x81/0xe0
 ? __pfx_mutex_lock+0x10/0x10
 ? __pfx_rcu_core+0x10/0x10
 ? __pfx_hrtimer_update_next_event+0x10/0x10
 ? mutex_unlock+0x7b/0xd0
 ? fdget_pos+0x24d/0x4b0
 ksys_write+0xf7/0x1c0
 ? __pfx_ksys_write+0x10/0x10
 ? restore_fpregs_from_fpstate+0x37/0xc0
 do_syscall_64+0xf9/0x540
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Fix by rejecting a namespace whose reference count is zero.

Fixes: 3664268f19ea0 ("apparmor: add namespace lookup fns()")
Cc: stable@vger.kernel.org
Signed-off-by: Binbin Deng <18983559317@163.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/apparmor/include/policy_ns.h | 16 ++++++++++++++++
 security/apparmor/policy_ns.c         |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h
index cc6e8415181209..4f835987547649 100644
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -117,6 +117,22 @@ static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
 	return ns;
 }
 
+/**
+ * aa_get_ns_not0 - increment references count on @ns found via lookup
+ * @ns: namespace to increment reference count of (MAYBE NULL)
+ *
+ * Returns: pointer to @ns, if @ns is NULL returns NULL,
+ *          NULL if @ns is being freed
+ * Requires: @ns must be held with valid refcount when called
+ */
+static inline struct aa_ns *aa_get_ns_not0(struct aa_ns *ns)
+{
+	if (ns && aa_get_profile_not0(ns->unconfined))
+		return ns;
+
+	return NULL;
+}
+
 /**
  * aa_put_ns - decrement refcount on @ns
  * @ns: namespace to put reference of
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index ff49a31ac27442..0738e78f4d2f66 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -207,7 +207,7 @@ struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n)
 	struct aa_ns *ns = NULL;
 
 	rcu_read_lock();
-	ns = aa_get_ns(__aa_lookupn_ns(view, name, n));
+	ns = aa_get_ns_not0(__aa_lookupn_ns(view, name, n));
 	rcu_read_unlock();
 
 	return ns;

From fd0dd0ee82ef62b8b4bda1ffceb361946f403404 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:58:51 +0000
Subject: [PATCH 0676/1982] ASoC: audio-graph-card2: Fix use-after-free in
 audio_graph2_link_c2c()

commit 5ea495bccfd746b063bc6702064f167467717b41 upstream.

of_graph_get_next_port() consumes the reference of its prev argument.
port0 is only borrowed from the caller's iterator, so the call drops a
reference the function does not own, and port0 is dereferenced again
afterwards. Pass an extra reference, as graph_count_c2c() does, so the
reference the callee consumes is the one taken here.

Fixes: 5f281c3e82b1 ("ASoC: audio-graph-card2: use __free(device_node) for device node")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260917165851.2163548-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/generic/audio-graph-card2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/generic/audio-graph-card2.c b/sound/soc/generic/audio-graph-card2.c
index 5dcc78c551a25b..03403f164a9a45 100644
--- a/sound/soc/generic/audio-graph-card2.c
+++ b/sound/soc/generic/audio-graph-card2.c
@@ -969,7 +969,8 @@ int audio_graph2_link_c2c(struct simple_util_priv *priv,
 	struct snd_soc_dai_link *dai_link = simple_priv_to_link(priv, li->link);
 	struct device_node *port0 = lnk;
 	struct device_node *ports __free(device_node) = port_to_ports(port0);
-	struct device_node *port1 __free(device_node) = of_graph_get_next_port(ports, port0);
+	struct device_node *port1 __free(device_node) =
+		of_graph_get_next_port(ports, of_node_get(port0));
 	u32 val = 0;
 	int ret = -EINVAL;
 

From 59eac6863eede5957bfd8872633608431ac42d3c Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Tue, 15 Sep 2026 10:41:29 +0200
Subject: [PATCH 0677/1982] ata: sata_fsl: Fix use-after-free of host_priv on
 probe() failure

commit 70b1196740d61aabda13b2ad0e9c1dfa2ef9cfa3 upstream.

sata_fsl_host_stop() releases hcr_base and host_priv:

	static void sata_fsl_host_stop(struct ata_host *host)
	{
		struct sata_fsl_host_priv *host_priv = host->private_data;

		iounmap(host_priv->hcr_base);
		kfree(host_priv);
	}

->host_stop() is called by the driver core through the ata_host_stop()
devres action which ata_host_start() registers, so it is called both when
the device is unbound and when probe() fails after the host has been
started.

The error_exit_with_cleanup label of sata_fsl_probe() releases hcr_base
and host_priv as well, and it is reachable from the two
device_create_file() calls which are done after the host has been
activated. In that case sata_fsl_host_stop() runs on an already freed
host_priv, resulting in a use-after-free and a double iounmap()/kfree().

Add a separate error label for the failures happening after the host has
been activated, which only detaches the host and leaves hcr_base and
host_priv to sata_fsl_host_stop().

Note that ata_host_detach() is dropped from error_exit_with_cleanup, as
that label is now only reachable while host is still NULL.

Fixes: 6c8ad7e8cf29 ("sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-11-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/sata_fsl.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 84da8d6ef28ece..040e5c3f635a96 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1499,7 +1499,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
 	host_priv->intr_coalescing.attr.mode = S_IRUGO | S_IWUSR;
 	retval = device_create_file(host->dev, &host_priv->intr_coalescing);
 	if (retval)
-		goto error_exit_with_cleanup;
+		goto error_exit_detach;
 
 	host_priv->rx_watermark.show = fsl_sata_rx_watermark_show;
 	host_priv->rx_watermark.store = fsl_sata_rx_watermark_store;
@@ -1509,16 +1509,24 @@ static int sata_fsl_probe(struct platform_device *ofdev)
 	retval = device_create_file(host->dev, &host_priv->rx_watermark);
 	if (retval) {
 		device_remove_file(&ofdev->dev, &host_priv->intr_coalescing);
-		goto error_exit_with_cleanup;
+		goto error_exit_detach;
 	}
 
 	return 0;
 
-error_exit_with_cleanup:
+error_exit_detach:
+	/*
+	 * Once the host has been activated, hcr_base and host_priv are
+	 * released by sata_fsl_host_stop(), which is called by the driver core
+	 * through the ata_host_stop() devres action registered by
+	 * ata_host_start(). Releasing them here as well would result in a
+	 * double iounmap() and a use-after-free.
+	 */
+	ata_host_detach(host);
 
-	if (host)
-		ata_host_detach(host);
+	return retval;
 
+error_exit_with_cleanup:
 	if (hcr_base)
 		iounmap(hcr_base);
 	kfree(host_priv);

From 3bcce6db59400fb643348179cd1f2a22a274b0e5 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 17:55:48 +0000
Subject: [PATCH 0678/1982] drm/msm: Fix vm_bo use-after-free in
 with_vm_locks()

commit 81878aa1a2f551f51a3d3aef2a9509503ec34d8b upstream.

The unwind loop drops the vm_bo reference taken while locking before
advancing to the next entry.  drm_gpuvm_bo_put() may drop the last
reference, removing and freeing the vm_bo, after which the plain list
iterator dereferences freed memory to advance.

Use the safe iterator, which saves the next entry before the body runs.

Fixes: fe4952b5f27cca5d ("drm/msm: Convert vm locking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Patchwork: https://patchwork.freedesktop.org/patch/754331/
Message-ID: <20260916175548.2089821-1-vulab@iscas.ac.cn>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/msm_gem_shrinker.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c
index 8f118b5185a1d9..31eb37ef93c404 100644
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -51,6 +51,7 @@ with_vm_locks(void (*fn)(struct drm_gem_object *obj),
 	 * success paths
 	 */
 	struct drm_gpuvm_bo *vm_bo, *last_locked = NULL;
+	struct drm_gpuvm_bo *next;
 	bool locked = true;
 
 	drm_gem_for_each_gpuvm_bo (vm_bo, obj) {
@@ -82,7 +83,7 @@ with_vm_locks(void (*fn)(struct drm_gem_object *obj),
 
 out_unlock:
 	if (last_locked) {
-		drm_gem_for_each_gpuvm_bo (vm_bo, obj) {
+		drm_gem_for_each_gpuvm_bo_safe(vm_bo, next, obj) {
 			struct dma_resv *resv = drm_gpuvm_resv(vm_bo->vm);
 
 			if (resv == obj->resv)

From ca06a46b6289ef395b5da46793a9ea7b2fd584f1 Mon Sep 17 00:00:00 2001
From: Sumanth Korikkar <sumanthk@linux.ibm.com>
Date: Tue, 6 Oct 2026 13:13:03 +0200
Subject: [PATCH 0679/1982] s390/cpum_cf: Check session mask before cpu offline

commit 99a95985dfc85eecad97f0991a2401d2fcef294c upstream.

cfset_offline_cpu() stops counter sets for every active session without
checking whether the outgoing cpu belongs to the session mask.

For example, run an hwctr session on cpu0 and a cpu bound perf event on
cpu1:

lshwc -l 9999 -i 5 0:b
perf stat -C 1 -e cpum_cf/CPU_CYCLES/ sleep 120
chcpu -d 1
chcpu -e 1

Although the hwctr session does not include cpu1, cfset_offline_cpu()
decrements its counter set reference count. The subsequent perf teardown
decrements it again, causing it to underflow.

The perf event keeps the percpu state alive across hotplug. When cpu1
comes online, the hwctr session is started there and the reference count
moves from -1 to 0. Stopping the hwctr session then decrements it to -1
again, so the zero triggered counter set disable path is skipped.

Check the session mask before stopping counter sets on the outgoing cpu.
This prevents the unmatched decrement and the resulting reference count
underflow.

Fixes: a029a4eab39e ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/perf_cpum_cf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index d866562cae383a..d82953ade00f21 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -1800,6 +1800,9 @@ static int cfset_offline_cpu(unsigned int cpu)
 
 	if (!list_empty(&cfset_session.head)) {
 		list_for_each_entry(rp, &cfset_session.head, node) {
+			if (!cpumask_test_cpu(cpu, &rp->mask))
+				continue;
+
 			p.sets = rp->ctrset;
 			cfset_ioctl_off(&p);
 			cpumask_clear_cpu(cpu, &rp->mask);

From 333a1435802c54e7d0ebdb9908e59e7ab7bade1e Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Fri, 2 Oct 2026 12:27:50 +0200
Subject: [PATCH 0680/1982] s390/extable: Fix mvcos instruction decoding

commit 4044466ff004c7ad5fd47be717cd933077e6e874 upstream.

If either the b1 or b2 field of the mvcos instruction is zero, register
zero is not used for address computation; zero is used instead, according
to the architecture. ex_handler_ua_mvcos() incorrectly uses the real
contents of register zero. Fix this.

This shouldn't be a problem for any generated code, since the compiler
would only generate such code if it is possible to prove at compile time
that either the source or destination address is within the first 4kb of
the designated address space. Such code should not exist (also confirmed
by an allyesconfig build and decoding all ~7000 mvcos instructions).

Fixes: c488f5187a24 ("s390/uaccess: Shorten raw_copy_from_user() / raw_copy_to_user() inline assemblies")
Cc: stable@vger.kernel.org
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/mm/extable.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
index 063b4346742d96..b6b63813df220d 100644
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -90,9 +90,9 @@ static bool ex_handler_ua_mvcos(const struct exception_table_entry *ex,
 	regs->psw.addr = extable_fixup(ex);
 	insn = (struct insn_ssf *)regs->psw.addr;
 	if (from)
-		uaddr = regs->gprs[insn->b2] + insn->d2;
+		uaddr = (insn->b2 ? regs->gprs[insn->b2] : 0) + insn->d2;
 	else
-		uaddr = regs->gprs[insn->b1] + insn->d1;
+		uaddr = (insn->b1 ? regs->gprs[insn->b1] : 0) + insn->d1;
 	remainder = PAGE_SIZE - (uaddr & (PAGE_SIZE - 1));
 	if (regs->gprs[insn->r3] <= remainder)
 		remainder = 0;

From 3a4da934737159d2ec5341fb8c8a5c9a0c6efee2 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Thu, 1 Oct 2026 12:32:16 +0200
Subject: [PATCH 0681/1982] s390/kprobes: Prevent kprobes on instructions with
 exception table entry

commit fc9bb0ecd310b53af5116415952a1fb89d4660b9 upstream.

The mvcos exception handler ex_handler_ua_mvcos() decodes the faulting
instruction, assuming it is an mvcos instruction. In case the instruction
is kprobed the decoded instruction is a breakpoint instruction instead,
which leads to incorrect instruction decoding and potential register
corruption.

Fix this by simply preventing to set a kprobe on such instructions,
similar like arm64 is doing it.

Fixes: c488f5187a24 ("s390/uaccess: Shorten raw_copy_from_user() / raw_copy_to_user() inline assemblies")
Cc: stable@vger.kernel.org
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/kprobes.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index c450120b447496..e806b124e4ba9c 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -85,6 +85,9 @@ static bool can_probe(unsigned long paddr)
 	if (!kallsyms_lookup_size_offset(paddr, NULL, &offset))
 		return false;
 
+	if (s390_search_extables(paddr))
+		return false;
+
 	/* Decode instructions */
 	addr = paddr - offset;
 	while (addr < paddr) {

From 0917637564e953daa79dd4f44fd86637816d2fc1 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Mon, 12 Oct 2026 10:36:27 +0200
Subject: [PATCH 0682/1982] s390/probes: Fix wrong opcode for cgrb fixup

commit d7ccab11a13475e656b9d2277900422c1bfc12c5 upstream.

The last byte of the cgrb instruction is 0xe4, however the probes code
compares against 0xe6. Fix it.

Fixes: 6b169ac9b434 ("s390/kprobes: add support for compare and branch instructions")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/lib/probes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/lib/probes.c b/arch/s390/lib/probes.c
index 1e184a03442d46..049300b68ddd76 100644
--- a/arch/s390/lib/probes.c
+++ b/arch/s390/lib/probes.c
@@ -99,8 +99,8 @@ int probe_get_fixup_type(u16 *insn)
 		break;
 	case 0xec:
 		switch (insn[2] & 0xff) {
+		case 0xe4: /* cgrb  */
 		case 0xe5: /* clgrb */
-		case 0xe6: /* cgrb  */
 		case 0xf6: /* crb   */
 		case 0xf7: /* clrb  */
 		case 0xfc: /* cgib  */

From 043da311673cd4d95dc9ad7a59ac83e8628ed049 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Tue, 13 Oct 2026 15:34:52 +0200
Subject: [PATCH 0683/1982] s390/signal: Fix incorrect return address in signal
 frame

commit adc9e872f7350e3ac29c1818d8c68b0760b4ba23 upstream.

exit_to_user_mode_loop() can call arch_do_signal_or_restart() multiple
times when signals are pending.

If the first call set up a vDSO system call restart by saving the real
user return address and adjusting psw.addr so it points to the vDSO stub,
a second call builds the signal frame with the wrong return address.

Restore psw.addr from arch_data, and set the return code to -EINTR before
building the signal frame.

This requires restart_block.arch_data to be properly initialized for all
tasks. Move the initialization in copy_thread() in front of the kernel
thread check, so that it also covers kernel threads and their children
(PID 1, usermode helpers). Only PID 0 is left uninitialized, since it
never returns to user space.

Fixes: df29a7440c4b ("s390/signal: switch to using vdso for sigreturn and syscall restart")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/process.c | 12 ++++++------
 arch/s390/kernel/signal.c  |  6 +++++-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index f18d7716c43425..5b83c7aca2d79c 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -132,6 +132,12 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 	p->thread.hardirq_timer = 0;
 	p->thread.softirq_timer = 0;
 	p->thread.last_break = 1;
+	/*
+	 * s390 stores the svc return address in arch_data when calling
+	 * sigreturn()/restart_syscall() via vdso. 1 means no valid address
+	 * stored.
+	 */
+	p->restart_block.arch_data = 1;
 
 	frame->sf.back_chain = 0;
 	frame->sf.gprs[11 - 6] = (unsigned long)&frame->childregs;
@@ -173,12 +179,6 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 			p->thread.acrs[1] = (unsigned int)tls;
 		}
 	}
-	/*
-	 * s390 stores the svc return address in arch_data when calling
-	 * sigreturn()/restart_syscall() via vdso. 1 means no valid address
-	 * stored.
-	 */
-	p->restart_block.arch_data = 1;
 	return 0;
 }
 
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index e48013cd832c16..9675fba83caa7b 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -488,7 +488,11 @@ void arch_do_signal_or_restart(struct pt_regs *regs)
 		}
 		/* No longer in a system call */
 		clear_pt_regs_flag(regs, PIF_SYSCALL);
-
+		if (!(current->restart_block.arch_data & 1)) {
+			regs->psw.addr = current->restart_block.arch_data;
+			current->restart_block.arch_data = 1;
+			regs->gprs[2] = -EINTR;
+		}
 		rseq_signal_deliver(&ksig, regs);
 		if (is_compat_task())
 			handle_signal32(&ksig, oldset, regs);

From bd30e2b60e811140861d53030cf9b6226b46c032 Mon Sep 17 00:00:00 2001
From: Harald Freudenberger <freude@linux.ibm.com>
Date: Tue, 6 Oct 2026 17:46:03 +0200
Subject: [PATCH 0684/1982] s390/zcrypt: Fix out-of-bounds ptr advance in
 cca_query_crypto_facility()

commit 9fd7fca66735307fd7afa3450882a55ef80f2add upstream.

The FQ reply parser code blindly advanced the walk pointer by a length
value read directly from the hardware reply payload without checking
that the advance stayed within the allocated reply buffer. A corrupt
or malicious device response could push ptr beyond the cprbmem region,
causing an out-of-bounds dereference or kernel memory exposure via the
subsequent memcpy().

Fix this by tracking the remaining reply buffer space in a variable
and validating each device-supplied length field against it before
advancing or dereferencing the pointer.

Fixes: 2004b57cde6b ("s390/zcrypt: code cleanup")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/crypto/zcrypt_ccamisc.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
index 700c2d902b791a..b0df254911dff1 100644
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1615,6 +1615,7 @@ int cca_query_crypto_facility(u16 cardnr, u16 domain,
 		u8  subfunc_code[2];
 		u8  lvdata[];
 	} __packed * prepparm;
+	size_t datalen;
 
 	/* get already prepared memory for 2 cprbs with param block each */
 	rc = alloc_and_prep_cprbmem(parmbsize, &mem,
@@ -1661,27 +1662,44 @@ int cca_query_crypto_facility(u16 cardnr, u16 domain,
 	prepcblk->rpl_parmb = (u8 __user *)ptr;
 	prepparm = (struct fqrepparm *)ptr;
 	ptr = prepparm->lvdata;
+	datalen = parmbsize - 2 * sizeof(u8);
 
 	/* check and possibly copy reply rule array */
 	len = *((u16 *)ptr);
+	if (len > datalen) {
+		ZCRYPT_DBF_ERR("%s reply rule array len %u exceeds datalen %zu\n",
+			       __func__, len, datalen);
+		rc = -EIO;
+		goto out;
+	}
+	datalen -= sizeof(u16);
+	ptr += sizeof(u16);
 	if (len > sizeof(u16)) {
-		ptr += sizeof(u16);
 		len -= sizeof(u16);
 		if (rarray && rarraylen && *rarraylen > 0) {
 			*rarraylen = (len > *rarraylen ? *rarraylen : len);
 			memcpy(rarray, ptr, *rarraylen);
 		}
+		datalen -= len;
 		ptr += len;
 	}
 	/* check and possible copy reply var array */
 	len = *((u16 *)ptr);
+	if (len > datalen) {
+		ZCRYPT_DBF_ERR("%s reply var array len %u exceeds datalen %zu\n",
+			       __func__, len, datalen);
+		rc = -EIO;
+		goto out;
+	}
+	datalen -= sizeof(u16);
+	ptr += sizeof(u16);
 	if (len > sizeof(u16)) {
-		ptr += sizeof(u16);
 		len -= sizeof(u16);
 		if (varray && varraylen && *varraylen > 0) {
 			*varraylen = (len > *varraylen ? *varraylen : len);
 			memcpy(varray, ptr, *varraylen);
 		}
+		datalen -= len;
 		ptr += len;
 	}
 

From 24d9994e439fe02dca87d35b66e7fd29120f2558 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee@kernel.org>
Date: Wed, 9 Sep 2026 11:12:23 +0000
Subject: [PATCH 0685/1982] HID: wacom: Use hdev->product in
 wacom_setup_touch_input_capabilities

commit 86472508a7ef74b525e79a79d2d02d911a641d6b upstream.

Replace the lookup-dependent 'wacom_wac->shared->touch->product' references
with 'hdev->product' inside wacom_setup_touch_input_capabilities() since
'hdev' is already available (via container_of) and represents the touch
device itself.

Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8feb8027be95e7..7cf2b4de52be75 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3966,8 +3966,8 @@ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
 int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 					 struct wacom_wac *wacom_wac)
 {
+	struct hid_device *hdev = container_of(wacom_wac, struct wacom, wacom_wac)->hdev;
 	struct wacom_features *features = &wacom_wac->features;
-
 	if (!(features->device_type & WACOM_DEVICETYPE_TOUCH))
 		return -ENODEV;
 
@@ -3976,9 +3976,11 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 	else
 		__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
 
-	if (features->type == HID_GENERIC)
+	if (features->type == HID_GENERIC) {
+		hid_dbg(hdev, "generic touch setup\n");
 		/* setup has already been done */
 		return 0;
+	}
 
 	input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
 	__set_bit(BTN_TOUCH, input_dev->keybit);
@@ -4010,19 +4012,17 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 		input_dev->evbit[0] |= BIT_MASK(EV_SW);
 		__set_bit(SW_MUTE_DEVICE, input_dev->swbit);
 
-		if (wacom_wac->shared->touch->product == 0x361) {
+		if (hdev->product == 0x361) {
 			input_set_abs_params(input_dev, ABS_MT_POSITION_X,
 					     0, 12440, 4, 0);
 			input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
 					     0, 8640, 4, 0);
-		}
-		else if (wacom_wac->shared->touch->product == 0x360) {
+		} else if (hdev->product == 0x360) {
 			input_set_abs_params(input_dev, ABS_MT_POSITION_X,
 					     0, 8960, 4, 0);
 			input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
 					     0, 5920, 4, 0);
-		}
-		else if (wacom_wac->shared->touch->product == 0x393) {
+		} else if (hdev->product == 0x393) {
 			input_set_abs_params(input_dev, ABS_MT_POSITION_X,
 					     0, 6400, 4, 0);
 			input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
@@ -4052,8 +4052,8 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 		fallthrough;
 
 	case WACOM_27QHDT:
-		if (wacom_wac->shared->touch->product == 0x32C ||
-		    wacom_wac->shared->touch->product == 0xF6) {
+		if (hdev->product == 0x32C ||
+		    hdev->product == 0xF6) {
 			input_dev->evbit[0] |= BIT_MASK(EV_SW);
 			__set_bit(SW_MUTE_DEVICE, input_dev->swbit);
 			wacom_wac->has_mute_touch_switch = true;

From 1df501b62a2fa6bc24c74a8eefba61ffc1cf6bea Mon Sep 17 00:00:00 2001
From: Lee Jones <lee@kernel.org>
Date: Wed, 9 Sep 2026 11:12:24 +0000
Subject: [PATCH 0686/1982] HID: wacom: Advertise SW_MUTE_DEVICE capability
 prior to registration

commit ba16e5ffbaa10fde960918d69af5e49f2b3fdd5e upstream.

Input subsystem guidelines require that device capabilities are advertised
before the input device is registered.  The Wacom driver was violating
this by advertising the SW_MUTE_DEVICE capability post-registration in
wacom_set_shared_values() (and duplicating it in device-specific setup
cases).

Resolve this by moving the SW_MUTE_DEVICE capability setup to
wacom_setup_touch_input_capabilities() for all touch devices that support
it.

For generic touch devices whose capabilities depend on mute switch
usages parsed from a sibling Pen/Pad interface, defer registration
with -EPROBE_DEFER until the sibling has parsed its descriptors and
initialized shared capabilities.

Cc: stable@vger.kernel.org
Fixes: d2ec58aee8b1 ("HID: wacom: generic: support generic touch switch")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 93 ++++++++++++++++++++++++++++++++---------
 drivers/hid/wacom_wac.c |  5 +++
 2 files changed, 79 insertions(+), 19 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 25dcd1bf8db0ae..74cbff69aa56e3 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -912,19 +912,14 @@ static int wacom_add_shared_data(struct hid_device *hdev)
 		list_add_tail(&data->list, &wacom_udev_list);
 	}
 
-	mutex_unlock(&wacom_udev_list_lock);
-
 	wacom_wac->shared = &data->shared;
 
-	retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
-	if (retval)
-		return retval;
+	if (wacom_wac->has_mute_touch_switch)
+		WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
 
-	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH)
-		wacom_wac->shared->touch = hdev;
-	else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN)
-		wacom_wac->shared->pen = hdev;
+	mutex_unlock(&wacom_udev_list_lock);
 
+	retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
 	return retval;
 }
 
@@ -2348,13 +2343,12 @@ static void wacom_release_resources(struct wacom *wacom)
 
 static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
 {
-	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
-		wacom_wac->shared->type = wacom_wac->features.type;
-		wacom_wac->shared->touch_input = wacom_wac->touch_input;
-	}
+	struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac);
+
+	guard(mutex)(&wacom_udev_list_lock);
 
 	if (wacom_wac->has_mute_touch_switch) {
-		wacom_wac->shared->has_mute_touch_switch = true;
+		WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
 		/* Hardware touch switch may be off. Wait until
 		 * we know the switch state to decide is_touch_on.
 		 * Softkey state should be initialized to "on" to
@@ -2364,14 +2358,69 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
 			wacom_wac->shared->is_touch_on = true;
 	}
 
-	if (wacom_wac->shared->has_mute_touch_switch &&
-	    wacom_wac->shared->touch_input) {
-		set_bit(EV_SW, wacom_wac->shared->touch_input->evbit);
-		input_set_capability(wacom_wac->shared->touch_input, EV_SW,
-				     SW_MUTE_DEVICE);
+	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
+		wacom_wac->shared->type = wacom_wac->features.type;
+		wacom_wac->shared->touch_input = wacom_wac->touch_input;
+		wacom_wac->shared->touch = wacom->hdev;
+	} else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
+		/* Pairs with smp_load_acquire() in wacom_sibling_pending() */
+		smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
 	}
 }
 
+static bool wacom_sibling_pending(struct wacom *wacom)
+{
+	const struct wacom_features *features = &wacom->wacom_wac.features;
+	struct hid_device *hdev = wacom->hdev;
+	struct usb_interface *sibling_intf;
+	int ifnum;
+
+	if (features->type != HID_GENERIC ||
+	    !(features->device_type & WACOM_DEVICETYPE_TOUCH))
+		return false;
+
+	if (wacom->wacom_wac.shared) {
+		/* Pairs with smp_store_release() in wacom_set_shared_values() */
+		if (smp_load_acquire(&wacom->wacom_wac.shared->pen))
+			return false;
+	}
+
+	if (!hid_is_usb(hdev) || !wacom->usbdev || !wacom->intf ||
+	    !wacom->intf->cur_altsetting)
+		return false;
+
+	ifnum = wacom->intf->cur_altsetting->desc.bInterfaceNumber;
+
+	/*
+	 * On composite Wacom devices, the Pen interface is always interface 0.
+	 * If the Touch interface is interface 0, there is no sibling Pen
+	 * interface on this device (standalone touch device).
+	 */
+	if (ifnum == 0)
+		return false;
+
+	/* Look for the sibling Pen interface at interface 0 */
+	sibling_intf = usb_ifnum_to_if(wacom->usbdev, 0);
+	if (!sibling_intf || !sibling_intf->cur_altsetting)
+		return false;
+
+	if (sibling_intf->cur_altsetting->desc.bInterfaceClass !=
+	    USB_INTERFACE_CLASS_HID)
+		return false;
+
+	if (sibling_intf->cur_altsetting->desc.bInterfaceSubClass == 1 &&
+	    (sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 1 ||
+	     sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 2))
+		return false;
+
+	/*
+	 * Interface 0 is a candidate HID interface on this composite device
+	 * whose probe has not completed yet (shared->pen is NULL). Defer until
+	 * interface 0 finishes probing and registers shared values.
+	 */
+	return true;
+}
+
 static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 {
 	struct wacom_wac *wacom_wac = &wacom->wacom_wac;
@@ -2449,6 +2498,11 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 	if (error)
 		goto fail;
 
+	if (wacom_sibling_pending(wacom)) {
+		error = -EPROBE_DEFER;
+		goto fail;
+	}
+
 	error = wacom_setup_inputs(wacom);
 	if (error)
 		goto fail;
@@ -2506,6 +2560,7 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 
 fail_hw_stop:
 	hid_hw_stop(hdev);
+	cancel_delayed_work_sync(&wacom->init_work);
 fail:
 	wacom_release_resources(wacom);
 	return error;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 7cf2b4de52be75..30df866feac801 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3978,6 +3978,11 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 
 	if (features->type == HID_GENERIC) {
 		hid_dbg(hdev, "generic touch setup\n");
+		if (wacom_wac->has_mute_touch_switch ||
+		    (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) {
+			input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE);
+			wacom_wac->has_mute_touch_switch = true;
+		}
 		/* setup has already been done */
 		return 0;
 	}

From ef74a8a685e272dbe0d21844c6e70841ccc9b1bc Mon Sep 17 00:00:00 2001
From: Lee Jones <lee@kernel.org>
Date: Wed, 9 Sep 2026 11:12:25 +0000
Subject: [PATCH 0687/1982] HID: wacom: Fix Use-After-Free in wacom_intuos_pad

commit ef32877368a7013c060ef6bd03a30b6da2fe0c41 upstream.

wacom_intuos_pad() accesses wacom->shared->touch_input locklessly
inside the interrupt handler context.  If the Touch sibling device
is disconnected, wacom_remove_shared_data() clears 'touch_input'
outside any lock, creating a Time-of-Check to Time-of-Use (TOCTOU)
race condition where a preempted reader in interrupt context
dereferences the freed pointer, leading to a Use-After-Free.

Resolve this by introducing RCU protection for the touch_input
pointer:

 - Annotate 'touch_input' in wacom_shared struct with __rcu
 - Wrap all lockless readers in wacom_wac.c with guard(rcu)() and
   rcu_dereference() using a unified wacom_report_touch_mute()
   helper
 - Update writers in wacom_sys.c using rcu_assign_pointer()
 - Call synchronize_rcu() in wacom_remove_shared_data() to ensure
   all active RCU readers have finished before the input device is
   freed

Also wrap wacom_set_shared_values() and touch/pen assignments in
wacom_add_shared_data() inside the wacom_udev_list_lock to serialize
concurrent probe assignments, and verify that 'shared->touch == hdev'
before setting touch_input to prevent concurrent sibling probe state
desynchronization.

Cc: stable@vger.kernel.org
Fixes: 961794a00eab ("Input: wacom - add reporting of SW_MUTE_DEVICE events")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 23 ++++++++++++++++-------
 drivers/hid/wacom_wac.c | 36 ++++++++++++++++++------------------
 drivers/hid/wacom_wac.h |  2 +-
 3 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 74cbff69aa56e3..d40faf63365e02 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -880,10 +880,16 @@ static void wacom_remove_shared_data(void *res)
 		data = container_of(wacom_wac->shared, struct wacom_hdev_data,
 				    shared);
 
-		if (wacom_wac->shared->touch == wacom->hdev)
-			wacom_wac->shared->touch = NULL;
-		else if (wacom_wac->shared->pen == wacom->hdev)
-			wacom_wac->shared->pen = NULL;
+		scoped_guard(mutex, &wacom_udev_list_lock) {
+			if (wacom_wac->shared->touch == wacom->hdev) {
+				wacom_wac->shared->touch = NULL;
+				rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
+			} else if (wacom_wac->shared->pen == wacom->hdev) {
+				wacom_wac->shared->pen = NULL;
+			}
+		}
+
+		synchronize_rcu();
 
 		kref_put(&data->kref, wacom_release_shared_data);
 		wacom_wac->shared = NULL;
@@ -920,6 +926,7 @@ static int wacom_add_shared_data(struct hid_device *hdev)
 	mutex_unlock(&wacom_udev_list_lock);
 
 	retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom);
+
 	return retval;
 }
 
@@ -2359,9 +2366,11 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
 	}
 
 	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
-		wacom_wac->shared->type = wacom_wac->features.type;
-		wacom_wac->shared->touch_input = wacom_wac->touch_input;
-		wacom_wac->shared->touch = wacom->hdev;
+		if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) {
+			wacom_wac->shared->type = wacom_wac->features.type;
+			wacom_wac->shared->touch = wacom->hdev;
+			rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input);
+		}
 	} else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
 		/* Pairs with smp_load_acquire() in wacom_sibling_pending() */
 		smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 30df866feac801..c5227530f291cb 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -510,6 +510,18 @@ static void wacom_intuos_schedule_prox_event(struct wacom_wac *wacom_wac)
 	}
 }
 
+static void wacom_report_touch_mute(struct wacom_wac *wacom_wac, bool mute)
+{
+	struct input_dev *touch_input;
+
+	guard(rcu)();
+	touch_input = rcu_dereference(wacom_wac->shared->touch_input);
+	if (touch_input) {
+		input_report_switch(touch_input, SW_MUTE_DEVICE, mute);
+		input_sync(touch_input);
+	}
+}
+
 static int wacom_intuos_pad(struct wacom_wac *wacom)
 {
 	struct wacom_features *features = &wacom->features;
@@ -650,12 +662,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
 	input_report_key(input, KEY_CONTROLPANEL, menu);
 	input_report_key(input, KEY_INFO, info);
 
-	if (wacom->shared && wacom->shared->touch_input) {
-		input_report_switch(wacom->shared->touch_input,
-				    SW_MUTE_DEVICE,
-				    !wacom->shared->is_touch_on);
-		input_sync(wacom->shared->touch_input);
-	}
+	if (wacom->shared)
+		wacom_report_touch_mute(wacom, !wacom->shared->is_touch_on);
 
 	input_report_abs(input, ABS_RX, strip1);
 	input_report_abs(input, ABS_RY, strip2);
@@ -2168,7 +2176,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
 	 */
 	if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) ||
 	   (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) {
-		if (wacom_wac->shared->touch_input) {
+		if (wacom_wac->shared) {
 			bool *is_touch_on = &wacom_wac->shared->is_touch_on;
 
 			if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value)
@@ -2176,9 +2184,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
 			else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)
 				*is_touch_on = value;
 
-			input_report_switch(wacom_wac->shared->touch_input,
-					    SW_MUTE_DEVICE, !(*is_touch_on));
-			input_sync(wacom_wac->shared->touch_input);
+			wacom_report_touch_mute(wacom_wac, !(*is_touch_on));
 		}
 		return;
 	}
@@ -3396,11 +3402,8 @@ static int wacom_wireless_irq(struct wacom_wac *wacom, size_t len)
 
 		if ((wacom->shared->type == INTUOSHT ||
 		    wacom->shared->type == INTUOSHT2) &&
-		    wacom->shared->touch_input &&
 		    wacom->shared->touch_max) {
-			input_report_switch(wacom->shared->touch_input,
-					SW_MUTE_DEVICE, data[5] & 0x40);
-			input_sync(wacom->shared->touch_input);
+			wacom_report_touch_mute(wacom, data[5] & 0x40);
 		}
 
 		pid = get_unaligned_be16(&data[6]);
@@ -3435,11 +3438,8 @@ static int wacom_status_irq(struct wacom_wac *wacom_wac, size_t len)
 
 	if ((features->type == INTUOSHT ||
 	    features->type == INTUOSHT2) &&
-	    wacom_wac->shared->touch_input &&
 	    features->touch_max) {
-		input_report_switch(wacom_wac->shared->touch_input,
-				    SW_MUTE_DEVICE, data[8] & 0x40);
-		input_sync(wacom_wac->shared->touch_input);
+		wacom_report_touch_mute(wacom_wac, data[8] & 0x40);
 	}
 
 	if (data[9] & 0x02) { /* wireless module is attached */
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index 126bec6e5c0c42..a8bbba4a6f3789 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -285,7 +285,7 @@ struct wacom_shared {
 	/* for wireless device to access USB interfaces */
 	unsigned touch_max;
 	int type;
-	struct input_dev *touch_input;
+	struct input_dev __rcu *touch_input;
 	struct hid_device *pen;
 	struct hid_device *touch;
 	bool has_mute_touch_switch;

From ac81120321a90b052cc50ecc9e38753c9471c75e Mon Sep 17 00:00:00 2001
From: Lee Jones <lee@kernel.org>
Date: Wed, 9 Sep 2026 11:12:26 +0000
Subject: [PATCH 0688/1982] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad

commit 3a523ecf9ac3fdd33f5eb31c43937ee44135395b upstream.

wacom_bamboo_pad_pen_event() accesses wacom->shared->pen locklessly
relative to wacom_remove_shared_data() which nullifies it.  This
can lead to a Use-After-Free if the sibling device is removed while
events are being processed.

Resolve this by introducing RCU protection for pen and touch
pointers:

 - Annotate 'pen' and 'touch' in wacom_shared struct with __rcu.
 - Wrap lockless readers in wacom_bamboo_pad_pen_event() with
   rcu_read_lock() and rcu_dereference().
 - Update writers in wacom_sys.c using rcu_assign_pointer().
 - Use rcu_dereference_protected for comparisons under
   wacom_udev_list_lock.
 - Also use rcu_access_pointer in wacom_sibling_pending() and
   wacom_mode_change_work() to avoid warnings (while lockless access in
   the latter remains a pre-existing issue).

Cc: stable@vger.kernel.org
Fixes: 8c97a765467c ("HID: wacom: add full support of the Wacom Bamboo PAD")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 40 ++++++++++++++++++++++++++--------------
 drivers/hid/wacom_wac.c | 13 ++++++-------
 drivers/hid/wacom_wac.h |  4 ++--
 3 files changed, 34 insertions(+), 23 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index d40faf63365e02..4f91c28b7ee67d 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -881,11 +881,18 @@ static void wacom_remove_shared_data(void *res)
 				    shared);
 
 		scoped_guard(mutex, &wacom_udev_list_lock) {
-			if (wacom_wac->shared->touch == wacom->hdev) {
-				wacom_wac->shared->touch = NULL;
+			struct hid_device *touch =
+				rcu_dereference_protected(wacom_wac->shared->touch,
+							  lockdep_is_held(&wacom_udev_list_lock));
+			struct hid_device *pen =
+				rcu_dereference_protected(wacom_wac->shared->pen,
+							  lockdep_is_held(&wacom_udev_list_lock));
+
+			if (touch == wacom->hdev) {
+				rcu_assign_pointer(wacom_wac->shared->touch, NULL);
 				rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
-			} else if (wacom_wac->shared->pen == wacom->hdev) {
-				wacom_wac->shared->pen = NULL;
+			} else if (pen == wacom->hdev) {
+				rcu_assign_pointer(wacom_wac->shared->pen, NULL);
 			}
 		}
 
@@ -2366,14 +2373,17 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
 	}
 
 	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
-		if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) {
+		struct hid_device *touch =
+			rcu_dereference_protected(wacom_wac->shared->touch,
+						  lockdep_is_held(&wacom_udev_list_lock));
+
+		if (touch == wacom->hdev || !touch) {
 			wacom_wac->shared->type = wacom_wac->features.type;
-			wacom_wac->shared->touch = wacom->hdev;
+			rcu_assign_pointer(wacom_wac->shared->touch, wacom->hdev);
 			rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input);
 		}
 	} else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
-		/* Pairs with smp_load_acquire() in wacom_sibling_pending() */
-		smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
+		rcu_assign_pointer(wacom_wac->shared->pen, wacom->hdev);
 	}
 }
 
@@ -2389,8 +2399,7 @@ static bool wacom_sibling_pending(struct wacom *wacom)
 		return false;
 
 	if (wacom->wacom_wac.shared) {
-		/* Pairs with smp_store_release() in wacom_set_shared_values() */
-		if (smp_load_acquire(&wacom->wacom_wac.shared->pen))
+		if (rcu_access_pointer(wacom->wacom_wac.shared->pen))
 			return false;
 	}
 
@@ -2857,16 +2866,19 @@ static void wacom_mode_change_work(struct work_struct *work)
 	bool is_direct = wacom->wacom_wac.is_direct_mode;
 	int error = 0;
 
-	if (shared->pen) {
-		wacom1 = hid_get_drvdata(shared->pen);
+	struct hid_device *pen = rcu_access_pointer(shared->pen);
+	struct hid_device *touch = rcu_access_pointer(shared->touch);
+
+	if (pen) {
+		wacom1 = hid_get_drvdata(pen);
 		wacom_release_resources(wacom1);
 		hid_hw_stop(wacom1->hdev);
 		wacom1->wacom_wac.has_mode_change = true;
 		wacom1->wacom_wac.is_direct_mode = is_direct;
 	}
 
-	if (shared->touch) {
-		wacom2 = hid_get_drvdata(shared->touch);
+	if (touch) {
+		wacom2 = hid_get_drvdata(touch);
 		wacom_release_resources(wacom2);
 		hid_hw_stop(wacom2->hdev);
 		wacom2->wacom_wac.has_mode_change = true;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index c5227530f291cb..c4cd87b781c451 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3307,6 +3307,7 @@ static int wacom_bpt_irq(struct wacom_wac *wacom, size_t len)
 static void wacom_bamboo_pad_pen_event(struct wacom_wac *wacom,
 		unsigned char *data)
 {
+	struct hid_device *pen;
 	unsigned char prefix;
 
 	/*
@@ -3319,13 +3320,11 @@ static void wacom_bamboo_pad_pen_event(struct wacom_wac *wacom,
 	prefix = data[0];
 	data[0] = WACOM_REPORT_BPAD_PEN;
 
-	/*
-	 * actually reroute the event.
-	 * No need to check if wacom->shared->pen is valid, hid_input_report()
-	 * will check for us.
-	 */
-	hid_input_report(wacom->shared->pen, HID_INPUT_REPORT, data,
-			 WACOM_PKGLEN_PENABLED, 1);
+	guard(rcu)();
+	pen = rcu_dereference(wacom->shared->pen);
+	if (pen)
+		hid_input_report(pen, HID_INPUT_REPORT, data,
+				 WACOM_PKGLEN_PENABLED, 1);
 
 	data[0] = prefix;
 }
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index a8bbba4a6f3789..170d6adbe02aa4 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -286,8 +286,8 @@ struct wacom_shared {
 	unsigned touch_max;
 	int type;
 	struct input_dev __rcu *touch_input;
-	struct hid_device *pen;
-	struct hid_device *touch;
+	struct hid_device __rcu *pen;
+	struct hid_device __rcu *touch;
 	bool has_mute_touch_switch;
 	bool is_touch_on;
 };

From 321da540c4a2091c0e23b5f4ced0131a1c77d679 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee@kernel.org>
Date: Wed, 9 Sep 2026 11:12:27 +0000
Subject: [PATCH 0689/1982] HID: wacom: Redesign shared sibling data lifecycle

commit 480c9cb14ae81f8e112ff83f8778b3d7b9324dc8 upstream.

The Wacom driver coordinates state between sibling interfaces of
the same physical device using a shared structure 'wacom_shared'
inside 'wacom_hdev_data'.  The driver kept a volatile representative
pointer 'data->dev' pointing to a sibling 'hid_device' for physical
path comparisons during sibling matching.

This pointer management is fragile.  When the representative device
is disconnected, wacom_remove_shared_data() failed to clear/update
'data->dev', leading to a Use-After-Free vulnerability when
subsequent sibling probes dereference the dangling 'data->dev'
pointer.

Resolve this issue by redesigning the sibling data lifecycle:

 - Eliminate the volatile 'data->dev' representative pointer
   completely
 - Redesign 'wacom_hdev_data' to store stable static copies of the
   required attributes upon first allocation: 'phys' path string,
   'vendor', 'product' IDs and the sibling's 'device_type'
 - Use these static attributes for stable sibling matching in
   wacom_are_sibling() and wacom_get_hdev_data()

This ensures sibling matching remains safe and stable even if
individual siblings are dynamically added or removed.

To secure the lifecycle against concurrent probe/disconnect races:

 - Switch kref_put() to kref_put_mutex() in
   wacom_remove_shared_data() to serialize refcount drops with list
   traversal and lookup
 - Modify wacom_release_shared_data() to assume the list lock is
   already held

Also, do not accumulate the 'device_type' capability flag during
subsequent sibling probes.  Keeping only the first probed sibling's
device_type exactly preserves the original sibling matching behavior
without introducing side effects.

Cc: stable@vger.kernel.org
Fixes: 4492efffffeb ("Input: wacom - share pen info with touch of the same ID")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 70 +++++++++++++++++++++++++++--------------
 1 file changed, 46 insertions(+), 24 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 4f91c28b7ee67d..b7c3774bc245a2 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -762,27 +762,47 @@ static void wacom_retrieve_hid_descriptor(struct hid_device *hdev,
 struct wacom_hdev_data {
 	struct list_head list;
 	struct kref kref;
-	struct hid_device *dev;
+	char phys[64];
+	__u32 vendor;
+	__u32 product;
+	__u32 device_type;
 	struct wacom_shared shared;
 };
 
+static bool wacom_compare_device_paths(struct hid_device *hdev_a,
+				       const char *phys_b, char separator)
+{
+	const char *p1 = strrchr(hdev_a->phys, separator);
+	const char *p2 = strrchr(phys_b, separator);
+	int n1, n2;
+
+	if (!p1 || !p2)
+		return false;
+
+	n1 = p1 - hdev_a->phys;
+	n2 = p2 - phys_b;
+
+	if (n1 != n2 || n1 <= 0 || n2 <= 0)
+		return false;
+
+	return !strncmp(hdev_a->phys, phys_b, n1);
+}
+
 static LIST_HEAD(wacom_udev_list);
 static DEFINE_MUTEX(wacom_udev_list_lock);
 
 static bool wacom_are_sibling(struct hid_device *hdev,
-		struct hid_device *sibling)
+		struct wacom_hdev_data *data)
 {
 	struct wacom *wacom = hid_get_drvdata(hdev);
 	struct wacom_features *features = &wacom->wacom_wac.features;
-	struct wacom *sibling_wacom = hid_get_drvdata(sibling);
-	struct wacom_features *sibling_features = &sibling_wacom->wacom_wac.features;
 	__u32 oVid = features->oVid ? features->oVid : hdev->vendor;
 	__u32 oPid = features->oPid ? features->oPid : hdev->product;
 
 	/* The defined oVid/oPid must match that of the sibling */
-	if (features->oVid != HID_ANY_ID && sibling->vendor != oVid)
+	if (features->oVid != HID_ANY_ID && data->vendor != oVid)
 		return false;
-	if (features->oPid != HID_ANY_ID && sibling->product != oPid)
+	if (features->oPid != HID_ANY_ID && data->product != oPid)
 		return false;
 
 	/*
@@ -790,11 +810,11 @@ static bool wacom_are_sibling(struct hid_device *hdev,
 	 * device path, while those with different VID/PID must share
 	 * the same physical parent device path.
 	 */
-	if (hdev->vendor == sibling->vendor && hdev->product == sibling->product) {
-		if (!hid_compare_device_paths(hdev, sibling, '/'))
+	if (hdev->vendor == data->vendor && hdev->product == data->product) {
+		if (!wacom_compare_device_paths(hdev, data->phys, '/'))
 			return false;
 	} else {
-		if (!hid_compare_device_paths(hdev, sibling, '.'))
+		if (!wacom_compare_device_paths(hdev, data->phys, '.'))
 			return false;
 	}
 
@@ -807,7 +827,7 @@ static bool wacom_are_sibling(struct hid_device *hdev,
 	 * devices.
 	 */
 	if ((features->device_type & WACOM_DEVICETYPE_DIRECT) &&
-	    !(sibling_features->device_type & WACOM_DEVICETYPE_DIRECT))
+	    !(data->device_type & WACOM_DEVICETYPE_DIRECT))
 		return false;
 
 	/*
@@ -815,17 +835,17 @@ static bool wacom_are_sibling(struct hid_device *hdev,
 	 * devices.
 	 */
 	if (!(features->device_type & WACOM_DEVICETYPE_DIRECT) &&
-	    (sibling_features->device_type & WACOM_DEVICETYPE_DIRECT))
+	    (data->device_type & WACOM_DEVICETYPE_DIRECT))
 		return false;
 
 	/* Pen devices may only be siblings of touch devices */
 	if ((features->device_type & WACOM_DEVICETYPE_PEN) &&
-	    !(sibling_features->device_type & WACOM_DEVICETYPE_TOUCH))
+	    !(data->device_type & WACOM_DEVICETYPE_TOUCH))
 		return false;
 
 	/* Touch devices may only be siblings of pen devices */
 	if ((features->device_type & WACOM_DEVICETYPE_TOUCH) &&
-	    !(sibling_features->device_type & WACOM_DEVICETYPE_PEN))
+	    !(data->device_type & WACOM_DEVICETYPE_PEN))
 		return false;
 
 	/*
@@ -841,7 +861,7 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
 	/* Try to find an already-probed interface from the same device */
 	list_for_each_entry(data, &wacom_udev_list, list) {
-		if (hid_compare_device_paths(hdev, data->dev, '/')) {
+		if (wacom_compare_device_paths(hdev, data->phys, '/')) {
 			kref_get(&data->kref);
 			return data;
 		}
@@ -849,7 +869,7 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
 	/* Fallback to finding devices that appear to be "siblings" */
 	list_for_each_entry(data, &wacom_udev_list, list) {
-		if (wacom_are_sibling(hdev, data->dev)) {
+		if (wacom_are_sibling(hdev, data)) {
 			kref_get(&data->kref);
 			return data;
 		}
@@ -863,18 +883,15 @@ static void wacom_release_shared_data(struct kref *kref)
 	struct wacom_hdev_data *data =
 		container_of(kref, struct wacom_hdev_data, kref);
 
-	mutex_lock(&wacom_udev_list_lock);
 	list_del(&data->list);
-	mutex_unlock(&wacom_udev_list_lock);
-
 	kfree(data);
 }
 
 static void wacom_remove_shared_data(void *res)
 {
-	struct wacom *wacom = res;
+	struct wacom *res_wacom = res;
 	struct wacom_hdev_data *data;
-	struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+	struct wacom_wac *wacom_wac = &res_wacom->wacom_wac;
 
 	if (wacom_wac->shared) {
 		data = container_of(wacom_wac->shared, struct wacom_hdev_data,
@@ -888,17 +905,19 @@ static void wacom_remove_shared_data(void *res)
 				rcu_dereference_protected(wacom_wac->shared->pen,
 							  lockdep_is_held(&wacom_udev_list_lock));
 
-			if (touch == wacom->hdev) {
+			if (touch == res_wacom->hdev) {
 				rcu_assign_pointer(wacom_wac->shared->touch, NULL);
 				rcu_assign_pointer(wacom_wac->shared->touch_input, NULL);
-			} else if (pen == wacom->hdev) {
+			} else if (pen == res_wacom->hdev) {
 				rcu_assign_pointer(wacom_wac->shared->pen, NULL);
 			}
 		}
 
 		synchronize_rcu();
 
-		kref_put(&data->kref, wacom_release_shared_data);
+		if (kref_put_mutex(&data->kref, wacom_release_shared_data, &wacom_udev_list_lock))
+			mutex_unlock(&wacom_udev_list_lock);
+
 		wacom_wac->shared = NULL;
 	}
 }
@@ -921,7 +940,10 @@ static int wacom_add_shared_data(struct hid_device *hdev)
 		}
 
 		kref_init(&data->kref);
-		data->dev = hdev;
+		strscpy(data->phys, hdev->phys, sizeof(data->phys));
+		data->vendor = hdev->vendor;
+		data->product = hdev->product;
+		data->device_type = wacom_wac->features.device_type;
 		list_add_tail(&data->list, &wacom_udev_list);
 	}
 

From c93698167e8d04dc05f1f3a3e3186a58ab492496 Mon Sep 17 00:00:00 2001
From: Ping Cheng <ping.cheng@wacom.com>
Date: Wed, 7 Oct 2026 15:03:35 -0700
Subject: [PATCH 0690/1982] HID: wacom: Setup SW_MUTE_DEVICE according to the
 order of input registration

commit 97ce491bcef2d231b8d51cee8e579183319a5ba4 upstream.

The refactored SW_MUTE_DEVICE code assumed that stylus will be
the first regiestered input. In reality, touch can be registered
before stylus, such as the Wacom Cintiq Pro 13 and 16.

This patch covers both touch-first and stylus-first cases.

Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index c4cd87b781c451..cf459c16b39a90 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3977,10 +3977,18 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 
 	if (features->type == HID_GENERIC) {
 		hid_dbg(hdev, "generic touch setup\n");
-		if (wacom_wac->has_mute_touch_switch ||
-		    (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) {
+
+		/*
+		 * This is to setup the touch switch for those devices that report
+		 * pen interface first. The setup can only be done here since this
+		 * routine is only called once. When we are here, the shared
+		 * has_mute_touch_switch has been set by the pad.
+
+		 * There are two ways of reporting inputs from firmware: stylus first
+		 * or touch first. This path covers the stylus input first case.
+		 */
+		if (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch)) {
 			input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE);
-			wacom_wac->has_mute_touch_switch = true;
 		}
 		/* setup has already been done */
 		return 0;
@@ -4403,7 +4411,26 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev,
 		break;
 
 	case INTUOSHT3_BT:
+		break;
+
 	case HID_GENERIC:
+		if (wacom_wac->shared) {
+			/*
+			 * The setup of touch switch capability can only be done
+			 * here for those devices, such as Cintiq Pro 13 and 16,
+			 * that have touch input registered before stylus and pad
+			 * inputs.
+			 *
+			 * There are two ways of reporting inputs from firmware:
+			 * stylus first or touch first. This path covers the touch
+			 * input first case.
+			 */
+			if (wacom_wac->has_mute_touch_switch &&
+			    wacom_wac->shared->touch_input) {
+				input_set_capability(wacom_wac->shared->touch_input,
+				    EV_SW, SW_MUTE_DEVICE);
+			}
+		}
 		break;
 
 	default:

From 9250253c0ad52a985183d557d59c9cd96af223b2 Mon Sep 17 00:00:00 2001
From: Ping Cheng <ping.cheng@wacom.com>
Date: Wed, 7 Oct 2026 15:00:27 -0700
Subject: [PATCH 0691/1982] HID: wacom: Write shared touch initial status only
 once

commit cae3031c691dff0be61a26bc64e31a6939010d5c upstream.

For consistency with how the shared has_mute_touch_switch is handled
during registration, let's apply WRITE_ONCE to is_touch_on too.

Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index b7c3774bc245a2..bcf35ffa4bdd87 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2391,7 +2391,7 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
 		 * match historic default.
 		 */
 		if (wacom_wac->is_soft_touch_switch)
-			wacom_wac->shared->is_touch_on = true;
+			WRITE_ONCE(wacom_wac->shared->is_touch_on, true);
 	}
 
 	if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {

From d655ef174056457d1c3bc06b4405097e0a9b3bf5 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Thu, 27 Aug 2026 06:17:08 +0200
Subject: [PATCH 0692/1982] klist: avoid accesses after waking klist_remove()

commit 732e3e10234cbe302d0dcbaa98c91c66628209cb upstream.

klist_remove() waits until a node is unreferenced so that its caller can
free the containing object.  klist_release() currently publishes
waiter->woken and wakes the waiter before its final accesses to the waiter
and node.  klist_remove() can then return, allowing its stack waiter and
the containing object to be freed or reused while klist_release() is still
running.  In particular, bus_remove_driver() can free drv->p while
__device_attach() walks the same bus klist with bus_for_each_drv().

On an arm64 Cortex-A72 system, an unpatched 7.2.0-rc3 kernel with
CONFIG_PREEMPT_RT=y and CONFIG_KASAN=y reproduced the bug through the
in-tree I2C/at24 path.  KASAN reported a use-after-free in
klist_dec_and_del() reached from klist_next()/bus_for_each_drv() while
at24 was being unregistered.

Clear n_klist and take a task reference before publishing woken.  Use
release/acquire accesses for that publication and wake the referenced
task.  The task reference keeps the waiter task alive if it returns and
exits before wake_up_process().

Link: https://lore.kernel.org/20260827041708.31682-1-kmehltretter@gmail.com
Fixes: 8b0c250be489 ("[PATCH] add klist_node_attached() to determine if a node is on a list or not.")
Fixes: 210272a28465 ("driver core: Remove completion from struct klist_node")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/klist.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/klist.c b/lib/klist.c
index 332a4fbf18ff08..f133740b1c2cb7 100644
--- a/lib/klist.c
+++ b/lib/klist.c
@@ -36,6 +36,7 @@
 #include <linux/klist.h>
 #include <linux/export.h>
 #include <linux/sched.h>
+#include <linux/sched/task.h>
 
 /*
  * Use the lowest bit of n_klist to mark deleted nodes and exclude
@@ -187,18 +188,24 @@ static void klist_release(struct kref *kref)
 
 	WARN_ON(!knode_dead(n));
 	list_del(&n->n_node);
+	knode_set_klist(n, NULL);
 	spin_lock(&klist_remove_lock);
 	list_for_each_entry_safe(waiter, tmp, &klist_remove_waiters, list) {
+		struct task_struct *p;
+
 		if (waiter->node != n)
 			continue;
 
+		p = waiter->process;
+		get_task_struct(p);
 		list_del(&waiter->list);
-		waiter->woken = 1;
+		/* Publish only after the final waiter and n accesses */
+		smp_store_release(&waiter->woken, 1);
 		mb();
-		wake_up_process(waiter->process);
+		wake_up_process(p);
+		put_task_struct(p);
 	}
 	spin_unlock(&klist_remove_lock);
-	knode_set_klist(n, NULL);
 }
 
 static int klist_dec_and_del(struct klist_node *n)
@@ -250,7 +257,8 @@ void klist_remove(struct klist_node *n)
 
 	for (;;) {
 		set_current_state(TASK_UNINTERRUPTIBLE);
-		if (waiter.woken)
+		/* Pairs with the release store in klist_release() */
+		if (smp_load_acquire(&waiter.woken))
 			break;
 		schedule();
 	}

From d2af35f84f51cb229c52680b552c538f09f7c123 Mon Sep 17 00:00:00 2001
From: Miguel Ojeda <ojeda@kernel.org>
Date: Sun, 18 Oct 2026 15:13:13 +0200
Subject: [PATCH 0693/1982] objtool/rust: add one more `noreturn` Rust function
 for Rust 1.101.0

commit 6b704ec9007a3f23ec5ded8f320825ac444f307d upstream.

Starting with Rust 1.101.0 (expected 2026-12-24), `objtool` may report:

    rust/kernel.o: warning: objtool: _R..._4core6result13unwrap_failed...()
    falls through to next function _R..._4core6result13unwrap_failed...()

(and others) due to calls to the `noreturn` symbol:

    core::result::unwrap_failed::unwrap_failed_inner

Rust introduced this helper when making `unwrap_failed` generic [1]. The
existing entry for `unwrap_failed` does not match the new helper.

Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.

See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
for more details.

Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://github.com/rust-lang/rust/pull/164059 [1]
Assisted-by: LLM
Link: https://patch.msgid.link/20261018131313.59391-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/objtool/check.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 141ff11f70a4ba..592352504dc322 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -221,6 +221,7 @@ static bool is_rust_noreturn(const struct symbol *func)
 	       str_ends_with(func->name, "_4core6option13expect_failed")				||
 	       str_ends_with(func->name, "_4core6option13unwrap_failed")				||
 	       str_ends_with(func->name, "_4core6result13unwrap_failed")				||
+	       str_ends_with(func->name, "_4core6result13unwrap_failed19unwrap_failed_inner")		||
 	       str_ends_with(func->name, "_4core9panicking5panic")					||
 	       str_ends_with(func->name, "_4core9panicking9panic_fmt")					||
 	       str_ends_with(func->name, "_4core9panicking14panic_explicit")				||

From 964002cb55d9f091807ff2aa8dab9971e7bd6da0 Mon Sep 17 00:00:00 2001
From: Eliot Courtney <ecourtney@nvidia.com>
Date: Wed, 30 Sep 2026 11:42:51 +0900
Subject: [PATCH 0694/1982] rust: bitmap: restrict bitmap length to at most
 i32::MAX

commit 931790a91378f6513ba82730eb5607479c3184a0 upstream.

It is currently possible to construct a non-`BitmapVec` backed `Bitmap`
using `Bitmap::from_raw` that is larger than `i32::MAX`, and it is not
part of the unsafe requirements. Restricting all bitmaps (even
non-`BitmapVec` backed ones) to a maximum size of `i32::MAX` simplifies
a few things and matches `BitmapVec::MAX_LEN`. For example,
`copy_and_extend` truncates `len` to u32, which is wrong for > u32::MAX
size. `__bitmap_set` and `__bitmap_clear` need i32 for `size` and u32
for `start` - so they can't be run on a `Bitmap` with a > i32::MAX size.
Rather than adding runtime checks to account for the case of a non
`BitmapVec` backed `Bitmap`, just include that in the requirements for
`Bitmap`.

Add that requirement to the unsafe requirements on `Bitmap::from_raw`
and `Bitmap::from_raw_mut`, and to the invariants on `Bitmap`.

This also fixes u32 casts truncating in `copy_and_extend`, which could
otherwise lead to OOB writes.

Fixes: 11eca92a2cae ("rust: add bitmap API.")
Link: https://lore.kernel.org/DKG0U8RLO7LZ.2I1AIH0S38PAP@nvidia.com
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Reviewed-by: Burak Emir <burak.emir@gmail.com>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Link: https://patch.msgid.link/20260930-chid-v9-2-0d6cca376cff@nvidia.com
Cc: stable@vger.kernel.org
[ Added a few intra-doc links. Added backticks to C types. Capitalize
  tagged comments. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/bitmap.rs | 70 ++++++++++++++++++++++++++++++-------------
 1 file changed, 49 insertions(+), 21 deletions(-)

diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs
index aa8fc7bf06fc99..c2634561b023b5 100644
--- a/rust/kernel/bitmap.rs
+++ b/rust/kernel/bitmap.rs
@@ -19,24 +19,59 @@ const BITS_PER_LONG: usize = bindings::BITS_PER_LONG as usize;
 /// # Invariants
 ///
 /// Must reference a `[c_ulong]` long enough to fit `data.len()` bits.
+/// Must not be longer than [`i32::MAX`] bits, so offsets and lengths used with
+/// [`Bitmap`] functions fit in the `int` and `unsigned int` arguments of the C bitmap API.
+/// This also matches [`BitmapVec::MAX_LEN`].
 #[cfg_attr(CONFIG_64BIT, repr(align(8)))]
 #[cfg_attr(not(CONFIG_64BIT), repr(align(4)))]
 pub struct Bitmap {
     data: [()],
 }
 
+macro_rules! bitmap_assert {
+    ($cond:expr, $($arg:tt)+) => {
+        #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
+        assert!($cond, $($arg)*);
+    }
+}
+
+macro_rules! bitmap_assert_return {
+    ($cond:expr, $($arg:tt)+) => {
+        #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
+        assert!($cond, $($arg)*);
+
+        #[cfg(not(CONFIG_RUST_BITMAP_HARDENED))]
+        if !($cond) {
+            pr_err!($($arg)*);
+            return
+        }
+    }
+}
+
 impl Bitmap {
     /// Borrows a C bitmap.
     ///
+    /// # Panics
+    ///
+    /// Panics if CONFIG_RUST_BITMAP_HARDENED is enabled and `nbits` exceeds [`i32::MAX`].
+    ///
     /// # Safety
     ///
     /// * `ptr` holds a non-null address of an initialized array of `unsigned long`
     ///   that is large enough to hold `nbits` bits.
+    /// * `nbits` must not exceed [`i32::MAX`].
     /// * the array must not be freed for the lifetime of this [`Bitmap`]
     /// * concurrent access only happens through atomic operations
     pub unsafe fn from_raw<'a>(ptr: *const usize, nbits: usize) -> &'a Bitmap {
+        bitmap_assert!(
+            nbits <= i32::MAX as usize,
+            "`nbits` must be <= {}, was {}",
+            i32::MAX,
+            nbits
+        );
         let data: *const [()] = core::ptr::slice_from_raw_parts(ptr.cast(), nbits);
         // INVARIANT: `data` references an initialized array that can hold `nbits` bits.
+        // INVARIANT: The caller guarantees that `nbits` does not exceed `i32::MAX`.
         // SAFETY:
         // The caller guarantees that `data` (derived from `ptr` and `nbits`)
         // points to a valid, initialized, and appropriately sized memory region
@@ -53,15 +88,27 @@ impl Bitmap {
 
     /// Borrows a C bitmap exclusively.
     ///
+    /// # Panics
+    ///
+    /// Panics if CONFIG_RUST_BITMAP_HARDENED is enabled and `nbits` exceeds [`i32::MAX`].
+    ///
     /// # Safety
     ///
     /// * `ptr` holds a non-null address of an initialized array of `unsigned long`
     ///   that is large enough to hold `nbits` bits.
+    /// * `nbits` must not exceed [`i32::MAX`].
     /// * the array must not be freed for the lifetime of this [`Bitmap`]
     /// * no concurrent access may happen.
     pub unsafe fn from_raw_mut<'a>(ptr: *mut usize, nbits: usize) -> &'a mut Bitmap {
+        bitmap_assert!(
+            nbits <= i32::MAX as usize,
+            "`nbits` must be <= {}, was {}",
+            i32::MAX,
+            nbits
+        );
         let data: *mut [()] = core::ptr::slice_from_raw_parts_mut(ptr.cast(), nbits);
         // INVARIANT: `data` references an initialized array that can hold `nbits` bits.
+        // INVARIANT: The caller guarantees that `nbits` does not exceed `i32::MAX`.
         // SAFETY:
         // The caller guarantees that `data` (derived from `ptr` and `nbits`)
         // points to a valid, initialized, and appropriately sized memory region
@@ -98,26 +145,6 @@ union BitmapRepr {
     ptr: NonNull<usize>,
 }
 
-macro_rules! bitmap_assert {
-    ($cond:expr, $($arg:tt)+) => {
-        #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
-        assert!($cond, $($arg)*);
-    }
-}
-
-macro_rules! bitmap_assert_return {
-    ($cond:expr, $($arg:tt)+) => {
-        #[cfg(CONFIG_RUST_BITMAP_HARDENED)]
-        assert!($cond, $($arg)*);
-
-        #[cfg(not(CONFIG_RUST_BITMAP_HARDENED))]
-        if !($cond) {
-            pr_err!($($arg)*);
-            return
-        }
-    }
-}
-
 /// Represents an owned bitmap.
 ///
 /// Wraps underlying C bitmap API. See [`Bitmap`] for available
@@ -401,7 +428,8 @@ impl Bitmap {
     #[inline]
     pub fn copy_and_extend(&mut self, src: &Bitmap) {
         let len = core::cmp::min(src.len(), self.len());
-        // SAFETY: access to `self` and `src` is within bounds.
+        // SAFETY: Access to `self` and `src` is within bounds. Both lengths fit in `u32`
+        // because a `Bitmap` is at most `i32::MAX` bits, so the casts are lossless.
         unsafe {
             bindings::bitmap_copy_and_extend(
                 self.as_mut_ptr(),

From 11c13964153dfe26b162e9906093573d06841c6e Mon Sep 17 00:00:00 2001
From: Andreas Hindborg <a.hindborg@kernel.org>
Date: Tue, 29 Sep 2026 11:34:02 +0200
Subject: [PATCH 0695/1982] rust: block: fix `Send` bound for `GenDisk`

commit e502b667ee70a7fa2a578e7722672ecd4fe0eb81 upstream.

The `Send` implementation for `GenDisk<T>` was conditioned on `T: Send`.
This constrains the wrong type. `T` is the `Operations` implementation,
which is typically a zero-sized marker type that carries no data, so `T:
Send` says nothing about whether the data a `GenDisk` actually owns can be
moved to another thread.

A `GenDisk<T>` owns the queue data `T::QueueData` (stored as the
`gendisk`'s `queuedata` and dropped when the `GenDisk` is dropped) and an
`Arc<TagSet<T>>`. These are the values transferred when a `GenDisk` is sent
across a thread boundary, so the `Send` bound must constrain exactly them.
Bound `T::QueueData: Send` and `Arc<TagSet<T>>: Send` instead.

Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module")
Cc: stable@vger.kernel.org
Reported-by: Priya Bala Govindasamy <pgovind2@uci.edu>, Dylan Zueck <dzueck@uci.edu>, Yuan Tan <ytan089@ucr.edu>
Closes: https://lore.kernel.org/all/cover.1780633578.git.ytan089@ucr.edu
Signed-off-by: Yuan Tan <ytan089@ucr.edu>
Link: https://msgid.link/20260709100100.604252-1-yuantan098@gmail.com
[ Andreas: Fix tags to make checkpatch happy. Change summary line. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260929-rust-block-for-v7-4-rc1-b4-v1-4-642a4c1aebd7@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/block/mq/gen_disk.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/rust/kernel/block/mq/gen_disk.rs b/rust/kernel/block/mq/gen_disk.rs
index 23c6a8929c3479..7f891d02f39eed 100644
--- a/rust/kernel/block/mq/gen_disk.rs
+++ b/rust/kernel/block/mq/gen_disk.rs
@@ -215,8 +215,14 @@ pub struct GenDisk<T: Operations> {
 }
 
 // SAFETY: `GenDisk` is an owned pointer to a `struct gendisk` and an `Arc` to a
-// `TagSet` It is safe to send this to other threads as long as T is Send.
-unsafe impl<T: Operations + Send> Send for GenDisk<T> {}
+// `TagSet`. It is safe to send this to other threads as long as these two are `Send`.
+unsafe impl<T> Send for GenDisk<T>
+where
+    T: Operations,
+    T::QueueData: Send,
+    Arc<TagSet<T>>: Send,
+{
+}
 
 impl<T: Operations> Drop for GenDisk<T> {
     fn drop(&mut self) {

From c6112b0a1627f25fcb9ff40fa57c75aa73c4947a Mon Sep 17 00:00:00 2001
From: Andreas Hindborg <a.hindborg@kernel.org>
Date: Tue, 29 Sep 2026 11:34:07 +0200
Subject: [PATCH 0696/1982] rust: block: require `Sync` for
 `Operations::QueueData`

commit 67b7a2728e4873e64405c5564fe50f7123012b71 upstream.

The queue data installed in a `GenDisk` is stored in the request queue and
handed back to the driver as a shared borrow through the `queue_rq` and
`commit_rqs` callbacks. Both callbacks obtain that borrow via
`ForeignOwnable::borrow` and may execute concurrently on several CPUs,
since the block layer runs one hardware queue per CPU. That means a shared
reference to the same queue data can be live on multiple threads at once,
which is only sound when the referent is `Sync`.

The initial `GenDisk` private data support omitted this bound, so a
driver could install a non-`Sync` type as queue data and then access
it concurrently from multiple CPUs without synchronization. Add a
`Sync` bound to the `QueueData` associated type to rule that out.

Fixes: 90d952fac8ac ("rust: block: add `GenDisk` private data support")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://msgid.link/20260608-queue-data-sync-v1-1-0efff051aaf3@kernel.org
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Link: https://patch.msgid.link/20260929-rust-block-for-v7-4-rc1-b4-v1-9-642a4c1aebd7@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/block/mq/operations.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/kernel/block/mq/operations.rs b/rust/kernel/block/mq/operations.rs
index f91a1719886c12..5871a2028294f2 100644
--- a/rust/kernel/block/mq/operations.rs
+++ b/rust/kernel/block/mq/operations.rs
@@ -30,7 +30,7 @@ type ForeignBorrowed<'a, T> = <T as ForeignOwnable>::Borrowed<'a>;
 pub trait Operations: Sized {
     /// Data associated with the `struct request_queue` that is allocated for
     /// the `GenDisk` associated with this `Operations` implementation.
-    type QueueData: ForeignOwnable;
+    type QueueData: ForeignOwnable + Sync;
 
     /// Called by the kernel to queue a request with the driver. If `is_last` is
     /// `false`, the driver is allowed to defer committing the request.

From dc1744584b2b9cd8a04e1b824f72bfec0e3c3374 Mon Sep 17 00:00:00 2001
From: Andreas Hindborg <a.hindborg@kernel.org>
Date: Mon, 8 Jun 2026 14:32:00 +0200
Subject: [PATCH 0697/1982] rust: configfs: fix data offset calculation for
 subsystem callbacks

commit e84c9b64df615e658e47561b835c1364dc48f0c0 upstream.

`get_group_data()` chooses between `Group::<Parent>::container_of()` and
`Subsystem::<Parent>::container_of()` based on whether `this` represents
the root group of a configfs subsystem. It detects this by checking
`(*this).cg_subsys.is_null()`, but `link_group()` in `fs/configfs/dir.c`
unconditionally sets `cg_subsys` for every `config_group` attached anywhere
in a registered subsystem, including the subsystem's own `su_group`. The
only `config_group` with a NULL `cg_subsys` is the configfs root, on which
userspace cannot trigger callbacks. The check is therefore always false at
runtime, and the `Subsystem` branch is dead. Subsystem-level callbacks
reach the `Group` branch and may read `data` at the wrong offset.

Thus change the `is_root` check to correctly identify whether a group is a
root group by comparing `this` to `subsys.su_group`.

Cc: stable@vger.kernel.org
Fixes: 446cafc295bf ("rust: configfs: introduce rust support for configfs")
Link: https://msgid.link/20260608-configfs-fix-offset-v1-1-7f01b8fb9e5f@kernel.org
[ Andreas: Fix clippy warning on 1.85.0 by moving safety comment. ]
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/configfs.rs | 43 +++++++++++++++++++++++++++--------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/rust/kernel/configfs.rs b/rust/kernel/configfs.rs
index 10f1547ca9f199..002de999ff23fa 100644
--- a/rust/kernel/configfs.rs
+++ b/rust/kernel/configfs.rs
@@ -298,26 +298,39 @@ unsafe impl<Data> HasGroup<Data> for Group<Data> {
 ///
 /// `this` must be a valid pointer.
 ///
-/// If `this` does not represent the root group of a configfs subsystem,
-/// `this` must be a pointer to a `bindings::config_group` embedded in a
-/// `Group<Parent>`.
+/// If `this` is the `su_group` field of a `bindings::configfs_subsystem`, that
+/// `configfs_subsystem` must be embedded in a `Subsystem<Parent>`.
 ///
-/// Otherwise, `this` must be a pointer to a `bindings::config_group` that
-/// is embedded in a `bindings::configfs_subsystem` that is embedded in a
-/// `Subsystem<Parent>`.
+/// Otherwise, `this` must be a pointer to a `bindings::config_group` embedded
+/// in a `Group<Parent>`.
 unsafe fn get_group_data<'a, Parent>(this: *mut bindings::config_group) -> &'a Parent {
     // SAFETY: `this` is a valid pointer.
-    let is_root = unsafe { (*this).cg_subsys.is_null() };
+    let subsys = unsafe { (*this).cg_subsys };
+
+    // `link_group()` in `fs/configfs/dir.c` assigns `cg_subsys` for every
+    // `config_group` attached anywhere in a registered subsystem, including
+    // the subsystem's own `su_group` (which gets a pointer to itself). The
+    // only `config_group` with a NULL `cg_subsys` is the configfs root, and
+    // userspace cannot trigger callbacks on it. The group is therefore the
+    // subsystem's `su_group` iff it equals `&cg_subsys->su_group`.
+    let is_root = !subsys.is_null()
+        && core::ptr::eq(
+            this.cast_const(),
+            // SAFETY: For every `config_group` the configfs core dispatches a
+            // callback on, `cg_subsys` was set by `link_group()` at registration time
+            // and points to a valid `configfs_subsystem` that outlives the callback.
+            unsafe { &raw const (*subsys).su_group },
+        );
 
-    if !is_root {
-        // SAFETY: By C API contact,`this` was returned from a call to
-        // `make_group`. The pointer is known to be embedded within a
-        // `Group<Parent>`.
-        unsafe { &(*Group::<Parent>::container_of(this)).data }
-    } else {
-        // SAFETY: By C API contract, `this` is a pointer to the
-        // `bindings::config_group` field within a `Subsystem<Parent>`.
+    if is_root {
+        // SAFETY: By the above, `this` is the `su_group` field of a
+        // `configfs_subsystem` that, by function safety requirements, is
+        // embedded in a `Subsystem<Parent>`.
         unsafe { &(*Subsystem::container_of(this)).data }
+    } else {
+        // SAFETY: By function safety requirements, `this` is a
+        // `config_group` embedded in a `Group<Parent>`.
+        unsafe { &(*Group::<Parent>::container_of(this)).data }
     }
 }
 

From 822d6761cdea1aad6e92eefe00b9e74d54333ecf Mon Sep 17 00:00:00 2001
From: Mehmet Koseoglu <mehmet.mkoseoglu@gmail.com>
Date: Thu, 1 Oct 2026 13:19:15 +0300
Subject: [PATCH 0698/1982] rust: cpufreq: reject NULL from cpufreq_cpu_get()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 02c5d7bfa8724789f6620f7787532666edc891a1 upstream.

cpufreq_cpu_get() returns either a referenced policy or NULL.
PolicyCpu::from_cpu() passed its return value to from_err_ptr(), which
rejects ERR_PTR values but accepts NULL.

If the lookup fails, Policy::from_raw_mut() therefore constructs a mutable
reference from NULL. Dropping the resulting PolicyCpu then passes the
invalid pointer to cpufreq_cpu_put(), causing an oops in kobject_put().

Reject NULL with NonNull before constructing the Policy reference. Return
ENODEV instead.

A KUnit negative-control run reproduced the oops with the original
conversion. The same test passed with this change. The reproducer is
available on request.

Fixes: 6ebdd7c93177 ("rust: cpufreq: Extend abstractions for policy and driver ops")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Mehmet Koseoglu <mehmet.mkoseoglu@gmail.com>
Reviewed-by: Onur Özkan <work@onurozkan.dev>
Reviewed-by: spidermana <xuyiwen14@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/cpufreq.rs | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs
index 1c378350f7ea13..be312f523ebecb 100644
--- a/rust/kernel/cpufreq.rs
+++ b/rust/kernel/cpufreq.rs
@@ -14,7 +14,13 @@ use crate::{
     cpumask,
     device::{Bound, Device},
     devres,
-    error::{code::*, from_err_ptr, from_result, to_result, Result, VTABLE_DEFAULT_ERROR},
+    error::{
+        code::*,
+        from_result,
+        to_result,
+        Result,
+        VTABLE_DEFAULT_ERROR, //
+    },
     ffi::{c_char, c_ulong},
     prelude::*,
     types::ForeignOwnable,
@@ -29,7 +35,10 @@ use core::{
     marker::PhantomData,
     ops::{Deref, DerefMut},
     pin::Pin,
-    ptr,
+    ptr::{
+        self,
+        NonNull, //
+    },
 };
 
 use macros::vtable;
@@ -686,12 +695,13 @@ struct PolicyCpu<'a>(&'a mut Policy);
 impl<'a> PolicyCpu<'a> {
     fn from_cpu(cpu: CpuId) -> Result<Self> {
         // SAFETY: It is safe to call `cpufreq_cpu_get` for any valid CPU.
-        let ptr = from_err_ptr(unsafe { bindings::cpufreq_cpu_get(u32::from(cpu)) })?;
+        let ptr =
+            NonNull::new(unsafe { bindings::cpufreq_cpu_get(u32::from(cpu)) }).ok_or(ENODEV)?;
 
         Ok(Self(
-            // SAFETY: The `ptr` is guaranteed to be valid and remains valid for the lifetime of
-            // the returned reference.
-            unsafe { Policy::from_raw_mut(ptr) },
+            // SAFETY: `ptr` is non-NULL and `cpufreq_cpu_get()` took a reference on it, so it is
+            // valid for writing and remains valid for the lifetime of the returned reference.
+            unsafe { Policy::from_raw_mut(ptr.as_ptr()) },
         ))
     }
 }

From b33aedc99e3cd61d44d568c30951eb508ce9b021 Mon Sep 17 00:00:00 2001
From: Frank Zhang <rmxpzlb@gmail.com>
Date: Fri, 4 Sep 2026 15:56:35 +0800
Subject: [PATCH 0699/1982] rust: rcpufreq_dt: add module alias

commit 53732733c7af437b0ed710a1df91a67a0d3dfc07 upstream.

Add the missing `platform:cpufreq-dt` module alias so that the driver
can be automatically loaded when the platform device is registered.

Fixes: 06149d8f2216 ("cpufreq: Add Rust-based cpufreq-dt driver")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cpufreq/rcpufreq_dt.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/rcpufreq_dt.rs b/drivers/cpufreq/rcpufreq_dt.rs
index 53923b8ef7a140..bad3c37ffc9645 100644
--- a/drivers/cpufreq/rcpufreq_dt.rs
+++ b/drivers/cpufreq/rcpufreq_dt.rs
@@ -219,4 +219,5 @@ module_platform_driver! {
     authors: ["Viresh Kumar <viresh.kumar@linaro.org>"],
     description: "Generic CPUFreq DT driver",
     license: "GPL v2",
+    alias: ["platform:cpufreq-dt"],
 }

From 04d11c4db269e76ded488e650af9b70d523c6cee Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 29 Sep 2026 14:53:42 +0200
Subject: [PATCH 0700/1982] ALSA: control: Fix UAF in snd_ctl_elem_add() on
 card disconnect

commit d4febca239be3c91498762dd0535a87d4af1eabc upstream.

A use-after-free can be triggered via SNDRV_CTL_IOCTL_ELEM_ADD when a
USB audio card is disconnected while an ELEM_ADD ioctl is in flight.

The reproducer parks the ioctl thread inside copy_from_user() using
userfaultfd, then tears down the USB device.  Unlike every other
ALSA control _user handler (ELEM_INFO, ELEM_READ, ELEM_WRITE, TLV_*),
snd_ctl_elem_add_user() never calls snd_power_ref_and_wait(), so the
parked thread holds no power reference.  snd_card_disconnect() therefore
cannot observe it via snd_power_sync_ref() and proceeds unimpeded:

  1. card->shutdown is set to 1
  2. device_del(&card->card_dev) drops the kobject reference on the
     parent USB interface device (card->dev = &intf->dev)
  3. The USB core drops its own reference and calls device_release(),
     freeing the struct usb_interface, including the embedded struct
     device that card->dev points to

When the userfaultfd is resolved and the thread resumes,
snd_ctl_elem_add() acquires controls_rwsem without checking
card->shutdown and calls __snd_ctl_add_replace().  Because the
reproducer pre-registered the same control, the CTL_ADD_EXCLUSIVE
path calls dev_err(card->dev, ...) on the freed USB interface:

  KASAN: slab-use-after-free Read in __dev_printk

Add a card->shutdown guard immediately after acquiring controls_rwsem
in snd_ctl_elem_add().  At that point card->shutdown is guaranteed to
be stable: snd_card_disconnect() sets it before freeing the parent
device, and it never transitions back to 0.  A thread that acquired
the lock before disconnect sees shutdown=0 and holds the write lock
through the rest of the operation, preventing concurrent disconnect
from proceeding past its own controls_rwsem-less shutdown=1 store
(which happened earlier, outside the lock) from racing with dev_err().

Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260929125346.1478631-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/control.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/core/control.c b/sound/core/control.c
index 652c09e110f6a3..1d13352afed2b6 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1676,6 +1676,8 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
 	alloc_size = compute_user_elem_size(private_size, count);
 
 	guard(rwsem_write)(&card->controls_rwsem);
+	if (card->shutdown)
+		return -ENODEV;
 	if (check_user_elem_overflow(card, alloc_size))
 		return -ENOMEM;
 

From af2b590be8feb62b5a0779dadd08e2ece5f370f2 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 20 Oct 2026 12:16:20 +0200
Subject: [PATCH 0701/1982] ALSA: emux: Fix UAF of soundfont zones at note-on

commit 34e3e04b8a1731a773797542f0781e99ce7cd755 upstream.

snd_emux_note_on() looks up the matching zones via
snd_soundfont_search_zone(), which takes sflist->lock only during the
lookup and returns the raw zone pointers after releasing it.  The
caller then stores them in vp->zone without any protection.
Meanwhile, a concurrent SNDRV_EMUX_IOCTL_REMOVE_LAST_SAMPLES ioctl may
unlink and free those zones in snd_soundfont_remove_unlocked(); this
leads to a use-after-free in snd_emux_note_on(), and later at
accessing the cached vp->zone, e.g. in snd_emux_send_effect().

Fix it by holding sflist->lock in snd_emux_note_on() over the whole
zone lookup and voice setup, and let snd_soundfont_search_zone()
require the caller to hold the lock, instead.
snd_soundfont_lock_preset() takes sflist->lock for setting
presets_locked, so the removal path now syncs with the note-on finish.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-697212bb-a434-4ff5-8778-25a84f5dad89
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/synth/emux/emux_synth.c | 3 +++
 sound/synth/emux/soundfont.c  | 9 ++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/sound/synth/emux/emux_synth.c b/sound/synth/emux/emux_synth.c
index 6982e1317da5e5..2cbf12364a1e56 100644
--- a/sound/synth/emux/emux_synth.c
+++ b/sound/synth/emux/emux_synth.c
@@ -60,6 +60,9 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
 		return;
 
 	key = note; /* remember the original note */
+
+	/* hold sflist->lock for protecting against concurrent free */
+	guard(spinlock_irqsave)(&emu->sflist->lock);
 	nvoices = get_zone(emu, port, &note, vel, chan, table);
 	if (! nvoices)
 		return;
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 59f3b1b6df4a24..30793a131746ee 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -1225,6 +1225,9 @@ delete_preset(struct snd_sf_list *sflist, struct snd_sf_zone *zp)
  * The found zones are stored on 'table' array.  max_layers defines
  * the maximum number of elements in this array.
  * This function returns the number of found zones.  0 if not found.
+ *
+ * The caller must hold sflist->lock, and keep holding it as long as
+ * the returned zones are accessed.
  */
 int
 snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
@@ -1234,11 +1237,11 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
 {
 	int nvoices;
 
-	/* this function is supposed to be called atomically,
-	 * so we check the lock.  if it's busy, just returns 0 to
+	lockdep_assert_held(&sflist->lock);
+
+	/* if the presets are being modified, just returns 0 to
 	 * tell the caller the busy state
 	 */
-	guard(spinlock_irqsave)(&sflist->lock);
 	if (sflist->presets_locked)
 		return 0;
 	nvoices = search_zones(sflist, notep, vel, preset, bank,

From 5cb07a5941b1e3dbe655110618869a81af68907e Mon Sep 17 00:00:00 2001
From: Sung Byeongchan <tjdqudcks0424@naver.com>
Date: Sat, 3 Oct 2026 19:18:54 +0900
Subject: [PATCH 0702/1982] ALSA: pcmtest: handle multiple wraps in random
 capture fill

commit 6541871e8e63e721733cd120af4d9cd22c5ef62f upstream.

The random capture helpers assume that the data generated for one timer
tick wraps the DMA ring at most once. However, b_rw describes 200 ms of
audio because the timer runs at 5 Hz, so it can be several times larger
than a small ring.

For 48 kHz, S16_LE, four-channel capture with a 512-frame buffer, the DMA
ring is 4096 bytes while one tick generates 76800 bytes. After filling the
4096-byte tail, the existing code issues a second 72704-byte write from the
ring base, writing 68608 bytes beyond the ring. Both interleaved and
non-interleaved capture are affected.

KASAN reports the first write into the adjacent free page as a
use-after-free in the random-byte generator. The underlying defect is an
out-of-bounds write from the live DMA ring, not a stale DMA allocation.

Split each random write repeatedly at the interleaved ring or per-channel
block boundary. Keep the hardware-pointer update exactly once after the
complete logical write.

The issue reproduced on three of three clean boots. With this change, the
same vulnerable geometry completed six times without a sanitizer finding.
Boundary, pattern-fill, no-timer, open/close, and module-reload controls
also completed normally.

snd-pcmtest is a test driver, and selecting random fill requires an
administrator-controlled module parameter. The written values come from the
kernel random generator; no privilege escalation or attacker-controlled
write primitive was demonstrated.

Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI Codex
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Link: https://patch.msgid.link/20261003101854.1423146-1-tjdqudcks0424@naver.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/drivers/pcmtest.c | 42 +++++++++++++++++++----------------------
 1 file changed, 19 insertions(+), 23 deletions(-)

diff --git a/sound/drivers/pcmtest.c b/sound/drivers/pcmtest.c
index 58fef1250f651b..1b95826e8754eb 100644
--- a/sound/drivers/pcmtest.c
+++ b/sound/drivers/pcmtest.c
@@ -280,39 +280,35 @@ static void fill_block_pattern(struct pcmtst_buf_iter *v_iter, struct snd_pcm_ru
 		fill_block_pattern_n(v_iter, runtime);
 }
 
+static void fill_random_block(char *buf, size_t buf_size, size_t pos,
+			      size_t count)
+{
+	while (count) {
+		size_t chunk = min(count, buf_size - pos);
+
+		get_random_bytes(buf + pos, chunk);
+		count -= chunk;
+		pos = 0;
+	}
+}
+
 static void fill_block_rand_n(struct pcmtst_buf_iter *v_iter, struct snd_pcm_runtime *runtime)
 {
 	unsigned int channels = runtime->channels;
-	// Remaining space in all channel buffers
-	size_t bytes_remain = runtime->dma_bytes - v_iter->buf_pos;
+	size_t pos = v_iter->buf_pos / channels;
 	unsigned int i;
 
-	for (i = 0; i < channels; i++) {
-		if (v_iter->b_rw <= bytes_remain) {
-			//b_rw - count of bytes must be written for all channels at each timer tick
-			get_random_bytes(runtime->dma_area + buf_pos_n(v_iter, channels, i),
-					 v_iter->b_rw / channels);
-		} else {
-			// Write to the end of buffer and start from the beginning of it
-			get_random_bytes(runtime->dma_area + buf_pos_n(v_iter, channels, i),
-					 bytes_remain / channels);
-			get_random_bytes(runtime->dma_area + v_iter->chan_block * i,
-					 (v_iter->b_rw - bytes_remain) / channels);
-		}
-	}
+	for (i = 0; i < channels; i++)
+		fill_random_block(runtime->dma_area + v_iter->chan_block * i,
+				  v_iter->chan_block, pos,
+				  v_iter->b_rw / channels);
 	inc_buf_pos(v_iter, v_iter->b_rw, runtime->dma_bytes);
 }
 
 static void fill_block_rand_i(struct pcmtst_buf_iter *v_iter, struct snd_pcm_runtime *runtime)
 {
-	size_t in_cur_block = runtime->dma_bytes - v_iter->buf_pos;
-
-	if (v_iter->b_rw <= in_cur_block) {
-		get_random_bytes(&runtime->dma_area[v_iter->buf_pos], v_iter->b_rw);
-	} else {
-		get_random_bytes(&runtime->dma_area[v_iter->buf_pos], in_cur_block);
-		get_random_bytes(runtime->dma_area, v_iter->b_rw - in_cur_block);
-	}
+	fill_random_block(runtime->dma_area, runtime->dma_bytes,
+			  v_iter->buf_pos, v_iter->b_rw);
 	inc_buf_pos(v_iter, v_iter->b_rw, runtime->dma_bytes);
 }
 

From 2ff55599528d7712c46956c038665a4d5a5160e5 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Tue, 29 Sep 2026 06:13:49 +0000
Subject: [PATCH 0703/1982] ASoC: amd: ps: fix snd_acp63_remove() teardown
 ordering

commit c53791d673ed4da6759d276078627ec4d0c6536b upstream.

The ACP IRQ handlers dereference the SoundWire, SoundWire DMA, and PDM
child platform devices, but snd_acp63_remove() unregisters them while
the interrupt is still held by devres, which frees it only after remove
returns. An interrupt in this window is a use-after-free.

Mask the ACP interrupt sources and call devm_free_irq() before the
first child device is unregistered. The masking goes through the new
acp_hw_ops->disable_interrupts callback, keeping the remove path
platform-agnostic. The interrupt line is shared, and acp_hw_deinit()
clears the sources only after the children are gone, which would
leave the line raised with no handler left to ack it. The window
predates the tagged refactor, which only reshaped the dereferences.

devm_free_irq() waits for in-flight handlers, but not for work the
hardirq has already queued: acp63_irq_handler() schedules
amd_sdw_irq_thread on the SoundWire manager. Draining that work in
the manager's remove path is a soundwire-side change and follows
separately.

This issue was found by an in-house static analysis tool.

Fixes: eaf825037d6d ("ASoC: amd: ps: refactor acp child platform device creation code")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260929061349.3879-1-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/amd/ps/acp63.h     | 8 ++++++++
 sound/soc/amd/ps/pci-ps.c    | 2 ++
 sound/soc/amd/ps/ps-common.c | 2 ++
 3 files changed, 12 insertions(+)

diff --git a/sound/soc/amd/ps/acp63.h b/sound/soc/amd/ps/acp63.h
index 90fc016dac0b98..f3960a2f17acc6 100644
--- a/sound/soc/amd/ps/acp63.h
+++ b/sound/soc/amd/ps/acp63.h
@@ -294,6 +294,7 @@ struct acp63_dev_data;
  * struct acp_hw_ops - ACP PCI driver platform specific ops
  * @acp_init: ACP initialization
  * @acp_deinit: ACP de-initialization
+ * @disable_interrupts: disable ACP interrupt sources
  * @acp_get_config: function to read the acp pin configuration
  * @acp_sdw_dma_irq_thread: ACP SoundWire DMA interrupt thread
  * acp_suspend: ACP system level suspend callback
@@ -304,6 +305,7 @@ struct acp63_dev_data;
 struct acp_hw_ops {
 	int (*acp_init)(void __iomem *acp_base, struct device *dev);
 	int (*acp_deinit)(void __iomem *acp_base, struct device *dev);
+	void (*disable_interrupts)(void __iomem *acp_base);
 	void (*acp_get_config)(struct pci_dev *pci, struct acp63_dev_data *acp_data);
 	void (*acp_sdw_dma_irq_thread)(struct acp63_dev_data *acp_data);
 	int (*acp_suspend)(struct device *dev);
@@ -395,6 +397,12 @@ static inline int acp_hw_deinit(struct acp63_dev_data *adata, struct device *dev
 	return -EOPNOTSUPP;
 }
 
+static inline void acp_hw_disable_interrupts(struct acp63_dev_data *adata)
+{
+	if (adata && adata->hw_ops && adata->hw_ops->disable_interrupts)
+		ACP_HW_OPS(adata, disable_interrupts)(adata->acp63_base);
+}
+
 static inline void acp_hw_get_config(struct pci_dev *pci, struct acp63_dev_data *adata)
 {
 	if (adata && adata->hw_ops && adata->hw_ops->acp_get_config)
diff --git a/sound/soc/amd/ps/pci-ps.c b/sound/soc/amd/ps/pci-ps.c
index cf06d4ae299b51..c75aac4af73b55 100644
--- a/sound/soc/amd/ps/pci-ps.c
+++ b/sound/soc/amd/ps/pci-ps.c
@@ -728,6 +728,8 @@ static void snd_acp63_remove(struct pci_dev *pci)
 	int ret;
 
 	adata = pci_get_drvdata(pci);
+	acp_hw_disable_interrupts(adata);
+	devm_free_irq(&pci->dev, pci->irq, adata);
 	if (adata->sdw) {
 		amd_sdw_exit(adata);
 		platform_device_unregister(adata->sdw_dma_dev);
diff --git a/sound/soc/amd/ps/ps-common.c b/sound/soc/amd/ps/ps-common.c
index 7b4966b75dc675..ea71cdf19c1ea1 100644
--- a/sound/soc/amd/ps/ps-common.c
+++ b/sound/soc/amd/ps/ps-common.c
@@ -248,6 +248,7 @@ void acp63_hw_init_ops(struct acp_hw_ops *hw_ops)
 {
 	hw_ops->acp_init = acp63_init;
 	hw_ops->acp_deinit = acp63_deinit;
+	hw_ops->disable_interrupts = acp63_disable_interrupts;
 	hw_ops->acp_get_config = acp63_get_config;
 	hw_ops->acp_sdw_dma_irq_thread = acp63_sdw_dma_irq_thread;
 	hw_ops->acp_suspend = snd_acp63_suspend;
@@ -484,6 +485,7 @@ void acp70_hw_init_ops(struct acp_hw_ops *hw_ops)
 {
 	hw_ops->acp_init = acp70_init;
 	hw_ops->acp_deinit = acp70_deinit;
+	hw_ops->disable_interrupts = acp70_disable_interrupts;
 	hw_ops->acp_get_config = acp70_get_config;
 	hw_ops->acp_sdw_dma_irq_thread = acp70_sdw_dma_irq_thread;
 	hw_ops->acp_suspend = snd_acp70_suspend;

From d5cc1f1333d47593fcc71b73d1fade556c8ece76 Mon Sep 17 00:00:00 2001
From: Bui Viet Dung <dungvn2345@gmail.com>
Date: Thu, 8 Oct 2026 11:54:13 +0700
Subject: [PATCH 0704/1982] Bluetooth: hci_vhci: Pin module for debugfs file
 operations

commit 645ee6b176c958579cff1c783413d5cff65c8197 upstream.

An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, force_suspend_fops, force_wakeup_fops,
aosp_capable_fops, and force_devcoredump_fops have no .owner set to
THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get()
which succeeds without taking a reference to the hci_vhci module.

When userspace opens any of these debugfs files and later closes
the /dev/vhci file descriptor (triggering vhci_release() and
debugfs file removal), the open debugfs file descriptor remains valid
in userspace. Because the module refcount was not incremented,
the hci_vhci module can be unloaded via delete_module (rmmod hci_vhci).

When the userspace process subsequently closes the debugfs file
descriptor, full_proxy_release() accesses the already unmapped
file_operations structure, resulting in a kernel page fault / oops:

  BUG: unable to handle page fault for address: fffffbfff846f18b
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x39f/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0xc3/0x590
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>
  Modules linked in: ... [last unloaded: hci_vhci(E)]

The issue was discovered via manual code audit of
drivers/bluetooth/hci_vhci.c and verified on a Linux 7.3-rc6 test VM
with CONFIG_BT_VHCI=m by keeping a debugfs file open across controller
teardown and module unload.

Set .owner = THIS_MODULE on all four file_operations structures so that
debugfs pins the module until all file descriptors are closed.

Fixes: 28010791193a ("Bluetooth: vhci: Prevent use-after-free by removing debugfs files early")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/hci_vhci.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 22edae35580804..4b4de3c995565c 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -155,6 +155,7 @@ static ssize_t force_suspend_write(struct file *file,
 }
 
 static const struct file_operations force_suspend_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_suspend_read,
 	.write		= force_suspend_write,
@@ -194,6 +195,7 @@ static ssize_t force_wakeup_write(struct file *file,
 }
 
 static const struct file_operations force_wakeup_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_wakeup_read,
 	.write		= force_wakeup_write,
@@ -263,6 +265,7 @@ static ssize_t aosp_capable_write(struct file *file,
 }
 
 static const struct file_operations aosp_capable_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= aosp_capable_read,
 	.write		= aosp_capable_write,
@@ -386,6 +389,7 @@ static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
 }
 
 static const struct file_operations force_devcoredump_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.write		= force_devcd_write,
 };

From aa0be226ff227b051205d05dcfd6d38c0200e5ae Mon Sep 17 00:00:00 2001
From: Osama Abdelkader <osama.abdelkader@gmail.com>
Date: Thu, 8 Oct 2026 12:09:35 +0200
Subject: [PATCH 0705/1982] drm/panthor: Fix TOCTOU race between
 GROUP_REGISTERED check and erase

commit 7764289d76a38c3a2f9b093bf17e193ab54acd70 upstream.

panthor_group_destroy() checks the GROUP_REGISTERED mark and then calls
xa_erase() without holding the xarray lock across both. If the handle is
destroyed by another thread in between, and a concurrent GROUP_CREATE
reuses the freed ID, the first destroy erases and releases the new,
still-initializing group, leading to a use-after-free in
panthor_group_create().

Do the mark check and erase atomically under xa_lock().

Fixes: eec7e23d848d ("drm/panthor: Prevent potential UAF in group creation")
Assisted-by: Claude:claude-opus-5.5
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20261008100935.3059587-1-osama.abdelkader@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panthor/panthor_sched.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 2170373ea78410..d2756ba36900c0 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3664,12 +3664,18 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
 	struct panthor_group_pool *gpool = pfile->groups;
 	struct panthor_device *ptdev = pfile->ptdev;
 	struct panthor_scheduler *sched = ptdev->scheduler;
-	struct panthor_group *group;
+	struct panthor_group *group = NULL;
 
-	if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))
-		return -EINVAL;
+	/*
+	 * Check the mark and erase the entry atomically, so a concurrent
+	 * destroy + create can't make us erase a group that's still being
+	 * initialized and happens to reuse the same handle.
+	 */
+	xa_lock(&gpool->xa);
+	if (xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))
+		group = __xa_erase(&gpool->xa, group_handle);
+	xa_unlock(&gpool->xa);
 
-	group = xa_erase(&gpool->xa, group_handle);
 	if (!group)
 		return -EINVAL;
 

From 3b0be34d9d1e7add0c9b99b0b4b969ca56d81066 Mon Sep 17 00:00:00 2001
From: Yibo Tan <lhfff@tju.edu.cn>
Date: Tue, 15 Sep 2026 22:45:28 +0800
Subject: [PATCH 0706/1982] fbdev: atmel_lcdfb: Prevent FIFO work after removal

commit 20b3b97cf89cb381bf07516090d99399cc9b91fd upstream.

The LCD controller IRQ schedules sinfo->task to recover from a FIFO
underflow.  Probe currently requests the IRQ before initializing the
work, so an early interrupt can schedule an uninitialized work item.

The probe error path and remove path cancel the work before freeing the
IRQ.  A FIFO-underflow interrupt can schedule the work again after that
cancellation.  framebuffer_release() may then free sinfo while the work
is still pending.

KASAN reported a use-after-free in atmel_lcdfb_task() when an underflow
interrupt occurred during removal.  With the IRQ freed before the work
was cancelled, the same test completed without a kernel diagnostic.

Initialize the work before requesting the IRQ.  In both cleanup paths,
free the IRQ before cancelling the work so that it cannot be scheduled
again after cancellation.

Fixes: d22579b83735 ("atmel_lcdfb: FIFO underflow management")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/atmel_lcdfb.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 9dfbc531021073..35862e83f7afa0 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1148,6 +1148,9 @@ static int atmel_lcdfb_probe(struct platform_device *pdev)
 	/* Initialize PWM for contrast or backlight ("off") */
 	init_contrast(sinfo);
 
+	/* Some LCDC recovery operations require process context. */
+	INIT_WORK(&sinfo->task, atmel_lcdfb_task);
+
 	/* interrupt */
 	ret = request_irq(sinfo->irq_base, atmel_lcdfb_interrupt, 0, pdev->name, info);
 	if (ret) {
@@ -1155,10 +1158,6 @@ static int atmel_lcdfb_probe(struct platform_device *pdev)
 		goto unmap_mmio;
 	}
 
-	/* Some operations on the LCDC might sleep and
-	 * require a preemptible task context */
-	INIT_WORK(&sinfo->task, atmel_lcdfb_task);
-
 	ret = atmel_lcdfb_init_fbinfo(sinfo);
 	if (ret < 0) {
 		dev_err(dev, "init fbinfo failed: %d\n", ret);
@@ -1194,8 +1193,8 @@ static int atmel_lcdfb_probe(struct platform_device *pdev)
 	dev_set_drvdata(dev, NULL);
 	fb_dealloc_cmap(&info->cmap);
 unregister_irqs:
-	cancel_work_sync(&sinfo->task);
 	free_irq(sinfo->irq_base, info);
+	cancel_work_sync(&sinfo->task);
 unmap_mmio:
 	exit_backlight(sinfo);
 	iounmap(sinfo->mmio);
@@ -1232,6 +1231,7 @@ static void atmel_lcdfb_remove(struct platform_device *pdev)
 		return;
 	sinfo = info->par;
 
+	free_irq(sinfo->irq_base, info);
 	cancel_work_sync(&sinfo->task);
 	exit_backlight(sinfo);
 	atmel_lcdfb_power_control(sinfo, 0);
@@ -1240,7 +1240,6 @@ static void atmel_lcdfb_remove(struct platform_device *pdev)
 	clk_put(sinfo->lcdc_clk);
 	clk_put(sinfo->bus_clk);
 	fb_dealloc_cmap(&info->cmap);
-	free_irq(sinfo->irq_base, info);
 	iounmap(sinfo->mmio);
  	release_mem_region(info->fix.mmio_start, info->fix.mmio_len);
 	if (platform_get_resource(pdev, IORESOURCE_MEM, 1)) {

From 1e13b8957510cfbc7367b3be1f08adc1757bb6d4 Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Sat, 12 Sep 2026 14:15:12 -0700
Subject: [PATCH 0707/1982] fbdev: udlfb: don't rebuild the mode list while the
 framebuffer is in use

commit ac9cfa552102b8e80e88c2872e80dc9cb5f07dda upstream.

dlfb_setup_modes() frees info->modelist with fb_destroy_modelist() and
rebuilds it, but fbcon holds raw pointers into that list in
fb_display[i].mode and nothing un-publishes them the way
do_unregister_framebuffer() and store_modes() do with
fbcon_delete_modelist(). The function does refuse to install a new mode
while the framebuffer has users (dlfb->fb_count != 0), but only after the
list is already destroyed. Reached from the 0666 "edid" sysfs attribute,
an unprivileged write to /sys/class/graphics/fb0/edid therefore fails with
-EINVAL and still leaves every fb_display[i].mode dangling; the next
console switch reads the freed fb_videomode in fb_videomode_to_var().

Test fb_count before touching the list. fbcon takes a reference through
fbcon_open(), so that condition covers exactly the states in which
fb_display[] points into the list, and the errno returned to userspace is
unchanged.

  BUG: KASAN: slab-use-after-free in fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905)
  Read of size 4 at addr ffff8880107b449c by task kworker/1:1/47
  Workqueue: events console_callback
  Call Trace:
   fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905)
   display_to_var (drivers/video/fbdev/core/fbcon.c:998)
   fbcon_switch (drivers/video/fbdev/core/fbcon.c:2182)
   redraw_screen (drivers/tty/vt/vt.c:994)
   complete_change_console (drivers/tty/vt/vt_ioctl.c:1141)
   console_callback (drivers/tty/vt/vt.c:3358)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  ...
  The buggy address is located 28 bytes inside of
   freed 96-byte region [ffff8880107b4480, ffff8880107b44e0)

Cc: stable@vger.kernel.org
Fixes: 7d9485e2c53c ("Staging: udlfb: Add functions to expose sysfs metrics and controls")
Reported-by: co+ed9902f2e44184d9@bugs.sh
Closes: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/udlfb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 1c82ee6984c8d1..f6da680c29eace 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1293,6 +1293,11 @@ static int dlfb_setup_modes(struct dlfb_data *dlfb,
 		goto error;
 	}
 
+	if (dlfb->fb_count) {
+		result = -EINVAL;
+		goto error;
+	}
+
 	fb_destroy_modelist(&info->modelist);
 	memset(&info->monspecs, 0, sizeof(info->monspecs));
 

From abc9c0f4f850d23e55f4230cd0f54938a64267bf Mon Sep 17 00:00:00 2001
From: Ngoc Quy <ngocquy0700@gmail.com>
Date: Wed, 14 Oct 2026 16:55:40 +0700
Subject: [PATCH 0708/1982] fs/proc/task_mmu: pin mm_users in do_pagemap_scan()

commit 4fb975471717c953f912776bb60301add1ffae11 upstream.

The PAGEMAP_SCAN ioctl takes mmap_read_lock() on an mm obtained from
/proc/<pid>/pagemap without holding a reference to mm_users.

proc_mem_open() deliberately grabs only mm_count, so a consumer that
touches the address space has to call mmget_not_zero() first.  Every other
consumer in this file does -- m_start(), do_procmap_query(),
show_smaps_rollup() and pagemap_read() -- but do_pagemap_scan() does not.

Without that reference the target can reach exit_mmap() concurrently, and
exit_mmap() calls unmap_vmas() while holding mmap_lock only for reading,
which does not exclude the scanner.  For ordinary VMAs this is harmless,
as free_pgtables() and remove_vma() run afterwards under mmap_write_lock.
A shared hugetlb VMA is different: __hugetlb_zap_end() frees the VMA's
hugetlb_vma_lock inside the read-locked phase.

walk_hugetlb_range() can therefore load vma->vm_private_data, have the
lock freed underneath it, and then down_read() a freed rw_semaphore.  The
load happens before the freeing side clears the pointer, so this is a
use-after-free and not a NULL dereference.  Any unprivileged user can
reach it with no huge pages configured, as hugetlb_reserve_pages()
allocates the lock before the VM_NORESERVE early return.

Pin mm_users across the scan, the way the other consumers do.  mmput()
from the exiting task can then no longer reach exit_mmap() while a walk is
in progress.

[akpm@linux-foundation.org: remove unneeded & undesirable test for !mm]
Link: https://lore.kernel.org/20261014095540.3261469-1-ngocquy0700@gmail.com
Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Signed-off-by: Ngoc Quy <ngocquy0700@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Muhammad Usama Anjum <usama.anjum@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/task_mmu.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 5c3d966b70f261..0f08913cfa529d 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -3098,15 +3098,18 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
 	size_t n_ranges_out = 0;
 	int ret;
 
+	if (!mmget_not_zero(mm))
+		return -ESRCH;
+
 	ret = pagemap_scan_get_args(&p.arg, uarg);
 	if (ret)
-		return ret;
+		goto out_mmput;
 
 	p.masks_of_interest = p.arg.category_mask | p.arg.category_anyof_mask |
 			      p.arg.return_mask;
 	ret = pagemap_scan_init_bounce_buffer(&p);
 	if (ret)
-		return ret;
+		goto out_mmput;
 
 	for (walk_start = p.arg.start; walk_start < p.arg.end;
 			walk_start = p.arg.walk_end) {
@@ -3161,6 +3164,8 @@ static long do_pagemap_scan(struct mm_struct *mm, unsigned long uarg)
 		ret = -EFAULT;
 
 	kfree(p.vec_buf);
+out_mmput:
+	mmput(mm);
 	return ret;
 }
 

From a6deaadd460a3a3cfd59c857247097e8da892af8 Mon Sep 17 00:00:00 2001
From: Richard Patel <ripatel@wii.dev>
Date: Fri, 9 Oct 2026 14:58:41 +0000
Subject: [PATCH 0709/1982] genirq: Defer kfree(irqaction) until
 irq_thread_dtor() finishes

commit d04adff6860587e843948b0c31174f8ae11b8dfe upstream.

When an interrupt thread exits abnormally via do_exit() (e.g. the interrupt
handler oopses) without returning from irq_thread(), a concurrent call to
free_irq() could free the irqaction before the irq_thread_dtor() exit task
work runs.

  irq thread (oopsed)                 free_irq()
  -------------------                 ----------
  do_exit()
    exit_mm()
      complete_vfork_done()  -------> kthread_stop() returns
    exit_files() ...                  kfree(action)
    exit_task_work()
      irq_thread_dtor()
        action->...                   <- use-after-free

Track the pending exit work with the IRQTF_EXIT_WORK thread flag, and have
__free_irq() wait for the bit to clear before kfree().

irq_thread_dtor() only runs on irq_thread abnormal exit. If that dtor also
faults, free_irq() will hang indefinitely, but double IRQ thread faults
require a reboot anyways.

[ tglx: Add missing include ]

Fixes: ed3e694d78cc ("move exit_task_work() past exit_files() et.al.")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-2-ripatel@wii.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/internals.h |  2 ++
 kernel/irq/manage.c    | 26 ++++++++++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 5568ed3a8b8520..d197854a93c8ff 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -31,6 +31,7 @@ extern struct irqaction chained_action;
  * IRQTF_AFFINITY  - irq thread is requested to adjust affinity
  * IRQTF_FORCED_THREAD  - irq action is force threaded
  * IRQTF_READY     - signals that irq thread is ready
+ * IRQTF_EXIT_WORK - irq thread exit task_work is pending
  */
 enum {
 	IRQTF_RUNTHREAD,
@@ -38,6 +39,7 @@ enum {
 	IRQTF_AFFINITY,
 	IRQTF_FORCED_THREAD,
 	IRQTF_READY,
+	IRQTF_EXIT_WORK,
 };
 
 /*
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 881d95c5af64d7..303d1064fc650c 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -21,6 +21,7 @@
 #include <linux/sched/isolation.h>
 #include <uapi/linux/sched/types.h>
 #include <linux/task_work.h>
+#include <linux/wait_bit.h>
 
 #include "internals.h"
 
@@ -1173,17 +1174,14 @@ void wake_threads_waitq(struct irq_desc *desc)
 		wake_up(&desc->wait_for_threads);
 }
 
-static void irq_thread_dtor(struct callback_head *unused)
+static void __irq_thread_dtor(struct irqaction *action)
 {
 	struct task_struct *tsk = current;
 	struct irq_desc *desc;
-	struct irqaction *action;
 
 	if (WARN_ON_ONCE(!(current->flags & PF_EXITING)))
 		return;
 
-	action = kthread_data(tsk);
-
 	pr_err("exiting task \"%s\" (%d) is an active IRQ thread (irq %d)\n",
 	       tsk->comm, tsk->pid, action->irq);
 
@@ -1200,6 +1198,14 @@ static void irq_thread_dtor(struct callback_head *unused)
 	irq_finalize_oneshot(desc, action);
 }
 
+static void irq_thread_dtor(struct callback_head *unused)
+{
+	struct irqaction *action = kthread_data(current);
+
+	__irq_thread_dtor(action);
+	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
+}
+
 static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action)
 {
 	struct irqaction *secondary = action->secondary;
@@ -1257,6 +1263,7 @@ static int irq_thread(void *data)
 	else
 		handler_fn = irq_thread_fn;
 
+	set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
 	init_task_work(&on_exit_work, irq_thread_dtor);
 	task_work_add(current, &on_exit_work, TWA_NONE);
 
@@ -1277,6 +1284,7 @@ static int irq_thread(void *data)
 	 * oneshot mask bit can be set.
 	 */
 	task_work_cancel_func(current, irq_thread_dtor);
+	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
 	return 0;
 }
 
@@ -1811,6 +1819,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 	return ret;
 }
 
+static void irq_stop_thread(struct irqaction *action)
+{
+	kthread_stop_put(action->thread);
+	wait_on_bit(&action->thread_flags, IRQTF_EXIT_WORK, TASK_UNINTERRUPTIBLE);
+}
+
 /*
  * Internal function to unregister an irqaction - used to free
  * regular and special interrupts that are part of the architecture.
@@ -1915,9 +1929,9 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 	 * the same bit to a newly requested action.
 	 */
 	if (action->thread) {
-		kthread_stop_put(action->thread);
+		irq_stop_thread(action);
 		if (action->secondary && action->secondary->thread)
-			kthread_stop_put(action->secondary->thread);
+			irq_stop_thread(action->secondary);
 	}
 
 	/* Last action releases resources */

From e1b124226d55bc62b24b8f825b220d9b48b324bc Mon Sep 17 00:00:00 2001
From: Richard Patel <ripatel@wii.dev>
Date: Fri, 9 Oct 2026 14:58:42 +0000
Subject: [PATCH 0710/1982] genirq: Move interrupt thread exit_work object to
 irqaction

commit 89a9e003a2ef73f67dff03dfd59e0a5474b56b0b upstream.

irq_thread() registers irq_thread_dtor() as exit task_work using a
stack-allocated callback_head.  On normal interrupt thread exit, this work
gets cancelled and never runs.

On x86, an abnormal interrupt thread exit (e.g. handler oops) discards the
stack, including the callback_head, while that callback_head is still
pending. By the time exit_task_work() runs, the stack memory formerly
backing callback_head is already clobbered.

  irq_thread()                      <-- on_exit_work allocated
    ** IRQ handler faults **
    oops_end()
      rewind_stack_and_make_dead()  <-- on_exit_work freed
  make_task_dead()
    do_exit(SIGSEGV)
      ...
      exit_shm()                    <-- on_exit_work clobbered
      ...
      exit_task_work()              <-- stack use-after-free
        exit_shm()+0x30             <-- wild jump to return addr

Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is
turned into a wild jump. This is caught by kernel IBT:

  ** first fault **
  Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI
  ...
  ** second fault **
  Missing ENDBR: exit_shm+0x30/0x1c0
  kernel BUG at arch/x86/kernel/cet.c:133!
  ...
   ? task_work_run+0x5c/0x90
   ? do_exit+0x209/0x460
   ? rewind_stack_and_make_dead+0x16/0x20
  ...
  note: irq/165-AudioDS[1427] exited with irqs disabled
  Fixing recursive fault but reboot is needed!

Fix this by storing the callback_head in struct irqaction.  The irqaction
is only freed once irq_thread_dtor() finishes.

Fixes: 2deb4be28077 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-3-ripatel@wii.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/interrupt.h | 2 ++
 kernel/irq/manage.c       | 9 ++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 8f1166bc3b1cef..972cd2561ee38b 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -118,6 +118,7 @@ typedef irqreturn_t (*irq_handler_t)(int, void *);
  * @thread_flags:	flags related to @thread
  * @thread_mask:	bitmask for keeping track of @thread activity
  * @dir:	pointer to the proc/irq/NN/name entry
+ * @thread_dtor:	task_work for @thread irregular exit cleanup
  */
 struct irqaction {
 	irq_handler_t		handler;
@@ -133,6 +134,7 @@ struct irqaction {
 	unsigned long		thread_mask;
 	const char		*name;
 	struct proc_dir_entry	*dir;
+	struct callback_head	thread_dtor;
 } ____cacheline_internodealigned_in_smp;
 
 extern irqreturn_t no_action(int cpl, void *dev_id);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 303d1064fc650c..a0b79bcc0e08b7 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1198,9 +1198,9 @@ static void __irq_thread_dtor(struct irqaction *action)
 	irq_finalize_oneshot(desc, action);
 }
 
-static void irq_thread_dtor(struct callback_head *unused)
+static void irq_thread_dtor(struct callback_head *work)
 {
-	struct irqaction *action = kthread_data(current);
+	struct irqaction *action = container_of(work, struct irqaction, thread_dtor);
 
 	__irq_thread_dtor(action);
 	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
@@ -1247,7 +1247,6 @@ static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc,
  */
 static int irq_thread(void *data)
 {
-	struct callback_head on_exit_work;
 	struct irqaction *action = data;
 	struct irq_desc *desc = irq_to_desc(action->irq);
 	irqreturn_t (*handler_fn)(struct irq_desc *desc,
@@ -1264,8 +1263,8 @@ static int irq_thread(void *data)
 		handler_fn = irq_thread_fn;
 
 	set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
-	init_task_work(&on_exit_work, irq_thread_dtor);
-	task_work_add(current, &on_exit_work, TWA_NONE);
+	init_task_work(&action->thread_dtor, irq_thread_dtor);
+	task_work_add(current, &action->thread_dtor, TWA_NONE);
 
 	while (!irq_wait_for_interrupt(desc, action)) {
 		irqreturn_t action_ret;

From 1b7b31f0d4bbfb9a87dd8acce1e001a3cf1c1623 Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Mon, 29 Jun 2026 17:29:47 +0200
Subject: [PATCH 0711/1982] HID: hiddev: keep state alive through disconnect
 unlock

commit 03f449b5de36a25fc5eba7dabf2b4494389bdb91 upstream.

mutex_unlock() clears the mutex owner before taking its wait lock. A
thread spinning in the final hiddev file release can acquire
existancelock after hiddev_disconnect() clears the owner, then free
hiddev before the disconnecting thread reaches the mutex wait lock. This
causes a use-after-free in the mutex slow unlock path.

Give the connection and each open file an explicit reference. Drop each
reference only after its existancelock critical section has completed,
so neither unlock path can free the mutex while the other is still using
it.

Fixes: 079034073faf ("HID: hiddev cleanup -- handle all error conditions properly")
Reported-by: syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/usbhid/hiddev.c | 37 +++++++++++++++++++------------------
 include/linux/hiddev.h      |  2 ++
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 59cf3ddfdf78c1..6b54d22f6b6970 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -46,6 +46,12 @@ struct hiddev_list {
 	struct mutex thread_lock;
 };
 
+static void hiddev_put(struct hiddev *hiddev)
+{
+	if (refcount_dec_and_test(&hiddev->refcount))
+		kfree(hiddev);
+}
+
 /*
  * Find a report, given the report's type and ID.  The ID can be specified
  * indirectly by REPORT_ID_FIRST (which returns the first report of the given
@@ -216,26 +222,21 @@ static int hiddev_fasync(int fd, struct file *file, int on)
 static int hiddev_release(struct inode * inode, struct file * file)
 {
 	struct hiddev_list *list = file->private_data;
+	struct hiddev *hiddev = list->hiddev;
 	unsigned long flags;
 
-	spin_lock_irqsave(&list->hiddev->list_lock, flags);
+	spin_lock_irqsave(&hiddev->list_lock, flags);
 	list_del(&list->node);
-	spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
+	spin_unlock_irqrestore(&hiddev->list_lock, flags);
 
-	mutex_lock(&list->hiddev->existancelock);
-	if (!--list->hiddev->open) {
-		if (list->hiddev->exist) {
-			hid_hw_close(list->hiddev->hid);
-			hid_hw_power(list->hiddev->hid, PM_HINT_NORMAL);
-		} else {
-			mutex_unlock(&list->hiddev->existancelock);
-			kfree(list->hiddev);
-			vfree(list);
-			return 0;
-		}
+	mutex_lock(&hiddev->existancelock);
+	if (!--hiddev->open && hiddev->exist) {
+		hid_hw_close(hiddev->hid);
+		hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
 	}
 
-	mutex_unlock(&list->hiddev->existancelock);
+	mutex_unlock(&hiddev->existancelock);
+	hiddev_put(hiddev);
 	vfree(list);
 
 	return 0;
@@ -270,6 +271,7 @@ static int __hiddev_open(struct hiddev *hiddev, struct file *file)
 	spin_unlock_irq(&hiddev->list_lock);
 
 	file->private_data = list;
+	refcount_inc(&hiddev->refcount);
 
 	return 0;
 
@@ -897,6 +899,7 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
 	INIT_LIST_HEAD(&hiddev->list);
 	spin_lock_init(&hiddev->list_lock);
 	mutex_init(&hiddev->existancelock);
+	refcount_set(&hiddev->refcount, 1);
 	hid->hiddev = hiddev;
 	hiddev->hid = hid;
 	hiddev->exist = 1;
@@ -937,9 +940,7 @@ void hiddev_disconnect(struct hid_device *hid)
 	if (hiddev->open) {
 		hid_hw_close(hiddev->hid);
 		wake_up_interruptible(&hiddev->wait);
-		mutex_unlock(&hiddev->existancelock);
-	} else {
-		mutex_unlock(&hiddev->existancelock);
-		kfree(hiddev);
 	}
+	mutex_unlock(&hiddev->existancelock);
+	hiddev_put(hiddev);
 }
diff --git a/include/linux/hiddev.h b/include/linux/hiddev.h
index 2164c03d2c7224..8e9f8a33e35976 100644
--- a/include/linux/hiddev.h
+++ b/include/linux/hiddev.h
@@ -13,6 +13,7 @@
 #ifndef _HIDDEV_H
 #define _HIDDEV_H
 
+#include <linux/refcount.h>
 #include <uapi/linux/hiddev.h>
 
 
@@ -24,6 +25,7 @@ struct hiddev {
 	int minor;
 	int exist;
 	int open;
+	refcount_t refcount;
 	struct mutex existancelock;
 	wait_queue_head_t wait;
 	struct hid_device *hid;

From 2efcf743664ab4a83b4fae1f152bbea1d298e73f Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Sun, 25 Oct 2026 02:27:52 +0000
Subject: [PATCH 0712/1982] io_uring/io-wq: save worker type before dropping
 its reference

commit 37e425460b7c41687e51e3254b1eb1d799da9614 upstream.

io_wq_cancel_tw_create() inspects cb->func after calling
io_worker_cancel_cb(). For an existing worker, that call can drop the
last worker reference and wake io_worker_exit(). If the canceling task
is preempted, the worker can be unlinked and freed by kfree_rcu() before
the callback function is inspected. KASAN reports a slab-use-after-free
read in this path.

Save whether the callback belongs to an unpublished continuation worker
while its reference is still held, then use the saved result for the
conditional free. This preserves the existing accounting and frees only
the worker allocated for the canceled continuation.

Fixes: e6db6f9398da ("io_uring/io-wq: only free worker if it was allocated for creation")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io-wq.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 2ed3eebd0a7bd3..7d89aa79d06ec5 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1420,14 +1420,16 @@ static void io_wq_cancel_tw_create(struct io_wq *wq)
 
 	while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) {
 		struct io_worker *worker;
+		bool free_worker;
 
 		worker = container_of(cb, struct io_worker, create_work);
-		io_worker_cancel_cb(worker);
 		/*
 		 * Only the worker continuation helper has worker allocated and
-		 * hence needs freeing.
+		 * hence needs freeing. Save this before dropping its reference.
 		 */
-		if (cb->func == create_worker_cont)
+		free_worker = cb->func == create_worker_cont;
+		io_worker_cancel_cb(worker);
+		if (free_worker)
 			kfree(worker);
 	}
 }

From 35096f62ca37ef7d929c89c35938372f365aad25 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Mon, 28 Sep 2026 10:48:06 +0200
Subject: [PATCH 0713/1982] iomap: don't resubmit an ioend after
 ->writeback_submit() failed

commit 3f517370076f1fedaa38cd8c78ceb73616b79336 upstream.

iomap_add_to_ioend() submits the pending ioend through
->writeback_submit() before allocating a new one for the current range.
When the submission fails the helper completes the ioend with an error,
but iomap_add_to_ioend() returns the error without clearing
wpc->wb_ctx.  iomap_writepages() then submits whatever wpc->wb_ctx
points to, so the already completed ioend is submitted a second time.

For XFS the second bio_endio() lands in xfs_end_bio(), which
list_add_tail()s the already linked ioend into ip->i_ioend_list.  This
corrupts the list and leaves a use-after-free/double-free window against
the ioend completion worker.  Reproduced with a fault-injected
->writeback_submit() failure on a reflinked XFS file with several
CoW writeback ranges in flight: the unfixed kernel hits repeated
"list_add double add" warnings from __list_add_valid_or_report(),
the fixed kernel fails writeback cleanly.

Clear wpc->wb_ctx when ->writeback_submit() fails.  The old
iomap_submit_ioend() cleared the context unconditionally; that clear was
lost when submission moved to iomap_ioend_writeback_submit().  The final
->writeback_submit() call in iomap_writepages() needs no equivalent fix:
it is the last thing the function does before returning, and every
caller allocates its iomap_writepage_ctx on the stack for a single call,
so wpc->wb_ctx is never read again afterwards.

Fixes: f4fa7981fa26 ("iomap: hide ioends from the generic writeback code")
Cc: stable@vger.kernel.org # v6.17
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/90fbd42df4f51306e57a95830d2d53873f630eb9.1790342457.git.parri.andrea@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/iomap/ioend.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/iomap/ioend.c b/fs/iomap/ioend.c
index 2a86b05c88efc3..272fccaa9d7643 100644
--- a/fs/iomap/ioend.c
+++ b/fs/iomap/ioend.c
@@ -187,8 +187,16 @@ ssize_t iomap_add_to_ioend(struct iomap_writepage_ctx *wpc, struct folio *folio,
 new_ioend:
 		if (ioend) {
 			error = wpc->ops->writeback_submit(wpc, 0);
-			if (error)
+			if (error) {
+				/*
+				 * ->writeback_submit() completed the ioend
+				 * with an error, so drop the stale context;
+				 * iomap_writepages() would otherwise submit
+				 * it a second time.
+				 */
+				wpc->wb_ctx = NULL;
 				return error;
+			}
 		}
 		wpc->wb_ctx = ioend = iomap_alloc_ioend(wpc, pos, ioend_flags);
 	}

From 881ec3e0d29aa3eabe19f0ff6aec60ae9efa71e0 Mon Sep 17 00:00:00 2001
From: Nicolin Chen <nicolinc@nvidia.com>
Date: Tue, 15 Sep 2026 09:38:13 -0700
Subject: [PATCH 0714/1982] iommu/arm-smmu-v3: Disable the impl before
 disabling the SMMU on shutdown

commit ab0dbf411aced59c04ce86fd8443faf13bdc9936 upstream.

arm_smmu_device_shutdown() only calls arm_smmu_device_disable(), and never
the impl_ops->device_disable() hook. On tegra241-cmdqv, that hook quiesces
every VINTF through tegra241_vintf_hw_deinit(), which issues a CMD_SYNC on
the shared CMDQ while it is still enabled.

arm_smmu_disable_action() already runs this hook before disabling the SMMU,
to cover an unbind or a probe failure, and no devres release ever follows a
reboot or a kexec to run it again. Have arm_smmu_device_shutdown() call it
directly, instead of reimplementing part of what it already does.

Fixes: 9ff145a25c5c ("iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown")
Cc: stable@vger.kernel.org
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Assisted-by: LLM
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 2c237ca4a38374..41c66c6498eb2e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4972,7 +4972,7 @@ static void arm_smmu_device_shutdown(struct platform_device *pdev)
 {
 	struct arm_smmu_device *smmu = platform_get_drvdata(pdev);
 
-	arm_smmu_device_disable(smmu);
+	arm_smmu_disable_action(smmu);
 }
 
 static const struct of_device_id arm_smmu_of_match[] = {

From 4ab2c987fd15a4bd28ef46a9ac871359886e6439 Mon Sep 17 00:00:00 2001
From: Amit Machhiwal <amachhiw@linux.ibm.com>
Date: Mon, 28 Sep 2026 17:58:35 +0530
Subject: [PATCH 0715/1982] KVM: PPC: Book3S HV: Add SRCU protection for
 virtual-mode HPT hcalls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 61a39797bb136243c48b46e2586d8a9e2cea6a89 upstream.

The virtual-mode HPT hcall handlers (H_ENTER, H_REMOVE, H_BULK_REMOVE,
H_CLEAR_REF, H_CLEAR_MOD) call into book3s_hv_rm_mmu.c, which accesses
memslots via kvm_memslots_raw().  kvm_memslots_raw() uses
rcu_dereference_raw_check() to bypass SRCU lockdep annotation checking.
This is safe in real mode because the entire guest entry/exit is wrapped
in srcu_read_lock/unlock inside kvmppc_run_core() and
kvmhv_run_single_vcpu().

However, since commit 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual
mode handlers for HPT hcalls and page faults"), these same handlers are
also executed in virtual mode via kvmppc_pseries_do_hcall(), which runs
after SRCU has already been released on guest exit.

A concurrent KVM_SET_USER_MEMORY_REGION deletion or move can therefore
call synchronize_srcu_expedited() — which does not wait for this thread —
and then kfree(slot) and vfree(slot->arch.rmap) while the hcall handler
still holds a raw pointer to the memslot.  lock_rmap() then writes to
freed vmalloc memory, leading to use-after-free and memory corruption.
Because kvm_memslots_raw() suppresses lockdep checks, this race is
entirely silent.

Fix this by factoring out the 7 HPT hcall handlers (H_REMOVE, H_ENTER,
H_READ, H_CLEAR_MOD, H_CLEAR_REF, H_PROTECT, H_BULK_REMOVE) into a
helper function, kvmppc_pseries_do_hpt_hcall(), and wrapping its call
site in srcu_read_lock(&kvm->srcu) / srcu_read_unlock(&kvm->srcu, idx).
Targeting only the HPT hcalls avoids wrapping non-HPT hcalls that sleep
(such as H_CONFER, H_REGISTER_VPA, H_PAGE_INIT) or handlers that already
acquire SRCU internally (such as H_RTAS).

Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-2-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_hv.c | 70 ++++++++++++++++++------------------
 1 file changed, 35 insertions(+), 35 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index aba6904591bc34..c3681742430294 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1155,6 +1155,38 @@ static long kvmppc_h_rpt_invalidate(struct kvm_vcpu *vcpu,
 	return H_SUCCESS;
 }
 
+static long kvmppc_pseries_do_hpt_hcall(struct kvm_vcpu *vcpu, unsigned long req)
+{
+	switch (req) {
+	case H_REMOVE:
+		return kvmppc_h_remove(vcpu, kvmppc_get_gpr(vcpu, 4),
+				       kvmppc_get_gpr(vcpu, 5),
+				       kvmppc_get_gpr(vcpu, 6));
+	case H_ENTER:
+		return kvmppc_h_enter(vcpu, kvmppc_get_gpr(vcpu, 4),
+				      kvmppc_get_gpr(vcpu, 5),
+				      kvmppc_get_gpr(vcpu, 6),
+				      kvmppc_get_gpr(vcpu, 7));
+	case H_READ:
+		return kvmppc_h_read(vcpu, kvmppc_get_gpr(vcpu, 4),
+				     kvmppc_get_gpr(vcpu, 5));
+	case H_CLEAR_MOD:
+		return kvmppc_h_clear_mod(vcpu, kvmppc_get_gpr(vcpu, 4),
+					  kvmppc_get_gpr(vcpu, 5));
+	case H_CLEAR_REF:
+		return kvmppc_h_clear_ref(vcpu, kvmppc_get_gpr(vcpu, 4),
+					  kvmppc_get_gpr(vcpu, 5));
+	case H_PROTECT:
+		return kvmppc_h_protect(vcpu, kvmppc_get_gpr(vcpu, 4),
+					kvmppc_get_gpr(vcpu, 5),
+					kvmppc_get_gpr(vcpu, 6));
+	case H_BULK_REMOVE:
+		return kvmppc_h_bulk_remove(vcpu);
+	}
+
+	return H_FUNCTION;
+}
+
 int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
 {
 	struct kvm *kvm = vcpu->kvm;
@@ -1170,47 +1202,15 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
 
 	switch (req) {
 	case H_REMOVE:
-		ret = kvmppc_h_remove(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5),
-					kvmppc_get_gpr(vcpu, 6));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_ENTER:
-		ret = kvmppc_h_enter(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5),
-					kvmppc_get_gpr(vcpu, 6),
-					kvmppc_get_gpr(vcpu, 7));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_READ:
-		ret = kvmppc_h_read(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_CLEAR_MOD:
-		ret = kvmppc_h_clear_mod(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_CLEAR_REF:
-		ret = kvmppc_h_clear_ref(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_PROTECT:
-		ret = kvmppc_h_protect(vcpu, kvmppc_get_gpr(vcpu, 4),
-					kvmppc_get_gpr(vcpu, 5),
-					kvmppc_get_gpr(vcpu, 6));
-		if (ret == H_TOO_HARD)
-			return RESUME_HOST;
-		break;
 	case H_BULK_REMOVE:
-		ret = kvmppc_h_bulk_remove(vcpu);
+		idx = srcu_read_lock(&kvm->srcu);
+		ret = kvmppc_pseries_do_hpt_hcall(vcpu, req);
+		srcu_read_unlock(&kvm->srcu, idx);
 		if (ret == H_TOO_HARD)
 			return RESUME_HOST;
 		break;

From cbe537c64b8fb1d0cf4bee20f89204fa51e384e5 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sat, 12 Sep 2026 22:05:54 -0400
Subject: [PATCH 0716/1982] media: cx23885: unregister DVB bus when SP2 CI
 setup fails

commit 22f552ff726a82a086be4ef02ce5099a0e8624b6 upstream.

The DVBSKY S950C, DVBSKY T980C and TechnoTrend CT2-4500 CI paths register
the DVB bus before attaching their SP2 CI client. If that client cannot be
created, bound, or pinned, the current error path removes the I2C frontend
components and only deallocates the frontend list, leaving the registered
DVB adapter behind. Removing an I2C demod before unregistering the DVB bus
can also expose the use-after-free ordering fixed for the normal remove
path.

Unregister the DVB bus immediately when SP2 CI setup fails, before the
existing I2C client cleanup. The bus helper empties the frontend list, so
the later frontend deallocation has nothing left to release. Keep failures
from vb2_dvb_register_bus() on the existing cleanup path. Also release an
unbound SP2 client and propagate the actual I2C creation or CI registration
error.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 2b0aac3011bc ("[media] cx23885: move CI/MAC registration to a separate function")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/cx23885/cx23885-dvb.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 05a7859cbe5795..b4a527479c61ab 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1158,8 +1158,12 @@ static int dvb_register_ci_mac(struct cx23885_tsport *port)
 		info.platform_data = &sp2_config;
 		request_module(info.type);
 		client_ci = i2c_new_client_device(&i2c_bus->i2c_adap, &info);
-		if (!i2c_client_has_driver(client_ci))
+		if (IS_ERR(client_ci))
+			return PTR_ERR(client_ci);
+		if (!client_ci->dev.driver) {
+			i2c_unregister_device(client_ci);
 			return -ENODEV;
+		}
 		if (!try_module_get(client_ci->dev.driver->owner)) {
 			i2c_unregister_device(client_ci);
 			return -ENODEV;
@@ -1202,7 +1206,7 @@ static int dvb_register(struct cx23885_tsport *port)
 	int (*p_set_voltage)(struct dvb_frontend *fe,
 			     enum fe_sec_voltage voltage) = NULL;
 	int mfe_shared = 0; /* bus not shared by default */
-	int ret;
+	int ret = -EINVAL;
 
 	/* Get the first frontend */
 	fe0 = vb2_dvb_get_frontend(&port->frontends, 1);
@@ -2584,8 +2588,10 @@ static int dvb_register(struct cx23885_tsport *port)
 		goto frontend_detach;
 
 	ret = dvb_register_ci_mac(port);
-	if (ret)
+	if (ret) {
+		vb2_dvb_unregister_bus(&port->frontends);
 		goto frontend_detach;
+	}
 
 	return 0;
 
@@ -2616,7 +2622,7 @@ static int dvb_register(struct cx23885_tsport *port)
 
 	port->gate_ctrl = NULL;
 	vb2_dvb_dealloc_frontends(&port->frontends);
-	return -EINVAL;
+	return ret;
 }
 
 int cx23885_dvb_register(struct cx23885_tsport *port)

From d02a2ed057372d3739ab23d778fc4e04d3330513 Mon Sep 17 00:00:00 2001
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Date: Wed, 12 Aug 2026 23:12:35 -0400
Subject: [PATCH 0717/1982] media: gspca: use vb2_video_unregister_device() on
 disconnect

commit 3dbbbc3cafa2de377d9b97af4e35b8b6b5282047 upstream.

gspca uses vb2_fop_release(), but gspca_disconnect() only unregisters
the video device. If the queue owner closes the device after USB
disconnect, vb2_fop_release() releases the queue and invokes
gspca_stop_streaming() at that point.

gspca_stream_off() calls subdriver stop callbacks and
usb_set_interface() through gspca_dev->dev. By the time the late close
runs, the USB core can have freed the usb_device, resulting in a
use-after-free. This was observed as a KASAN use-after-free in sd_stopN().

Use vb2_video_unregister_device() so the queue is released and streaming
is stopped synchronously during disconnect, while the usb_device is still
valid. Since the helper takes the queue lock, which is usb_lock, call it
after dropping that lock.

Fixes: f729ef5796d8 ("media: videobuf2-v4l2.c: add vb2_video_unregister_device helper function")
Cc: stable@vger.kernel.org # 5.10.x
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/gspca/gspca.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 3fc15d16df8e10..c81127cc02679a 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1641,9 +1641,8 @@ void gspca_disconnect(struct usb_interface *intf)
 #endif
 
 	v4l2_device_disconnect(&gspca_dev->v4l2_dev);
-	video_unregister_device(&gspca_dev->vdev);
-
 	mutex_unlock(&gspca_dev->usb_lock);
+	vb2_video_unregister_device(&gspca_dev->vdev);
 
 	/* (this will call gspca_release() immediately or on last close) */
 	v4l2_device_put(&gspca_dev->v4l2_dev);

From 49a0623994a10d3d333d48c304f89d816495f332 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Tue, 23 Jun 2026 10:30:31 +0000
Subject: [PATCH 0718/1982] media: imx-jpeg: cancel timeout worker when
 streaming stops

commit 78fdfbf117c409273eecbfa7a528ef42358a0e38 upstream.

Each per-fd context ctx owns a delayed_work (ctx->task_timer, callback
mxc_jpeg_device_run_timeout) armed via schedule_delayed_work() at the end
of mxc_jpeg_device_run() to recover a stalled encode/decode job. The only
existing cancellation is cancel_delayed_work() in the frame-done IRQ
handler, which de-queues a pending work item but does not wait for a
callback that has already started, and it only runs when a frame completes.

When the fd is closed while a job is in flight (the frame-done IRQ has not
fired yet), nothing syncs the worker before mxc_jpeg_release() frees ctx
with kfree() after v4l2_m2m_ctx_release(). A queued or executing
mxc_jpeg_device_run_timeout() can then recover ctx through
container_of(&ctx->task_timer) and dereference it (ctx->mxc_jpeg,
slot_data, dev_warn) after ctx has been freed.

Cancel the worker from mxc_jpeg_stop_streaming(). The cancel cannot live
in mxc_jpeg_release(): mxc_jpeg_device_run() arms the timer while holding
only hw_lock, not the mxc_jpeg->lock mutex that release holds, so a cancel
in release could still race a concurrent mxc_jpeg_device_run() that
re-arms the timer afterwards. mxc_jpeg_stop_streaming() instead runs inside
v4l2_m2m_ctx_release() -> vb2_queue_release(), i.e. after
v4l2_m2m_cancel_job() has set TRANS_ABORT and waited for any in-flight job
to finish (so __v4l2_m2m_try_queue() will not queue and v4l2_m2m_try_run()
will not run any further job for this context, which prevents
mxc_jpeg_device_run() from re-arming the timer) and before the m2m context
is freed. cancel_delayed_work_sync() removes a pending work item and waits
for a running callback, so the worker can no longer race with the
subsequent kfree(). The cancel is placed before the buffer-release loop so
a concurrently running timeout callback cannot race with it over the same
buffers. If the frame-done IRQ canceled a still-pending timer, this cancel
is a no-op; if the timeout callback has already started, it waits for the
callback to finish. The same mxc_jpeg_stop_streaming() call is also
reached from VIDIOC_STREAMOFF, which drains the worker early, although
STREAMOFF itself does not free ctx -- the use-after-free arises only
when the fd is later closed.

This bug was found by static analysis.

Fixes: cfed9632ca8e ("media: imx-jpeg: Add a timeout mechanism for each frame")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index df3ccdf767baf0..4ac4f576fdd108 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1735,6 +1735,8 @@ static void mxc_jpeg_stop_streaming(struct vb2_queue *q)
 
 	dev_dbg(ctx->mxc_jpeg->dev, "Stop streaming ctx=%p", ctx);
 
+	cancel_delayed_work_sync(&ctx->task_timer);
+
 	/* Release all active buffers */
 	for (;;) {
 		if (V4L2_TYPE_IS_OUTPUT(q->type))

From 12d0222809f943d9bcaffd5fe1d8b9d2c3c74f07 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Fri, 7 Aug 2026 05:35:53 +0000
Subject: [PATCH 0719/1982] media: marvell: mcam: stop DMA and cancel s_bh_work
 before freeing DMA buffers

commit 0f29f84317c1e35f6a9265277be33e60d3fc8c1c upstream.

In vmalloc mode the frame-completion IRQ queues mcam_frame_work() on
cam->s_bh_work, which memcpy()s from the dma_bufs[] that
mcam_free_dma_bufs() frees with dma_free_coherent().  mccic_shutdown()
frees those buffers without stopping the controller, so while streaming
a late frame IRQ can re-arm the work after the buffers are gone, causing a
use-after-free.

Stop the controller in mccic_shutdown() when streaming is still active
(gated on an open fd, which holds a runtime-PM reference, so the device
is powered), cancel s_bh_work in mcam_free_dma_bufs(), and move
INIT_WORK() into mccic_register() before the device can be published.

Fixes: 67a8dbbc4e04 ("[media] marvell-cam: Basic working MMP camera driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/marvell/mcam-core.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/marvell/mcam-core.c b/drivers/media/platform/marvell/mcam-core.c
index b8360d37000a7d..c9605317e8a79c 100644
--- a/drivers/media/platform/marvell/mcam-core.c
+++ b/drivers/media/platform/marvell/mcam-core.c
@@ -406,6 +406,8 @@ static void mcam_free_dma_bufs(struct mcam_camera *cam)
 {
 	int i;
 
+	cancel_work_sync(&cam->s_bh_work);
+
 	for (i = 0; i < cam->nbufs; i++) {
 		dma_free_coherent(cam->dev, cam->dma_buf_size,
 				cam->dma_bufs[i], cam->dma_handles[i]);
@@ -1306,7 +1308,6 @@ static int mcam_setup_vb2(struct mcam_camera *cam)
 		break;
 	case B_vmalloc:
 #ifdef MCAM_MODE_VMALLOC
-		INIT_WORK(&cam->s_bh_work, mcam_frame_work);
 		vq->ops = &mcam_vb2_ops;
 		vq->mem_ops = &vb2_vmalloc_memops;
 		cam->dma_setup = mcam_ctlr_dma_vmalloc;
@@ -1864,6 +1865,12 @@ int mccic_register(struct mcam_camera *cam)
 		goto out;
 	}
 
+#ifdef MCAM_MODE_VMALLOC
+	/* Init before sensor bind: armed by IRQ, cancelled on probe-error paths. */
+	if (cam->buffer_mode == B_vmalloc)
+		INIT_WORK(&cam->s_bh_work, mcam_frame_work);
+#endif
+
 	mutex_init(&cam->s_mutex);
 	cam->state = S_NOTREADY;
 	mcam_set_config_needed(cam, 1);
@@ -1922,10 +1929,15 @@ void mccic_shutdown(struct mcam_camera *cam)
 	 * take it down again will wedge the machine, which is frowned
 	 * upon.
 	 */
+	mutex_lock(&cam->s_mutex);
 	if (!list_empty(&cam->vdev.fh_list)) {
 		cam_warn(cam, "Removing a device with users!\n");
+		/* Stop so the IRQ can't re-arm s_bh_work after the buffers are freed. */
+		if (cam->state == S_STREAMING)
+			mcam_ctlr_stop_dma(cam);
 		sensor_call(cam, core, s_power, 0);
 	}
+	mutex_unlock(&cam->s_mutex);
 	if (cam->buffer_mode == B_vmalloc)
 		mcam_free_dma_bufs(cam);
 	v4l2_ctrl_handler_free(&cam->ctrl_handler);

From 9fa70d75ab03f5babb072ad872a54879af4be55c Mon Sep 17 00:00:00 2001
From: Cong Nguyen <congnt264@gmail.com>
Date: Sat, 8 Aug 2026 16:07:29 +0700
Subject: [PATCH 0720/1982] media: microchip-csi2dc: fix async notifier leak on
 probe error path

commit c7528789244ce7329ca883170fb9315d739ae985 upstream.

csi2dc_of_parse() ends up calling csi2dc_prepare_notifier(), which
registers the V4L2 async notifier with v4l2_async_nf_register(). The
probe error label csi2dc_probe_cleanup_notifier is reached after
csi2dc_of_parse() has already succeeded (e.g. when media entity init,
csi2dc_power() or v4l2_async_register_subdev() fail), but it calls only
v4l2_async_nf_cleanup() and never v4l2_async_nf_unregister().

The notifier therefore stays chained in the global notifier_list while
the enclosing struct csi2dc_device is freed, leading to list corruption
and a use-after-free when the list is next walked.

Unregister the notifier before cleaning it up on the error path,
matching the teardown already done in csi2dc_remove().

Fixes: 2de0b3c0f678 ("media: atmel: introduce microchip csi2dc driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/microchip/microchip-csi2dc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/microchip/microchip-csi2dc.c b/drivers/media/platform/microchip/microchip-csi2dc.c
index 70303a0b6919eb..59574258ab2b0f 100644
--- a/drivers/media/platform/microchip/microchip-csi2dc.c
+++ b/drivers/media/platform/microchip/microchip-csi2dc.c
@@ -736,6 +736,7 @@ static int csi2dc_probe(struct platform_device *pdev)
 	return 0;
 
 csi2dc_probe_cleanup_notifier:
+	v4l2_async_nf_unregister(&csi2dc->notifier);
 	v4l2_async_nf_cleanup(&csi2dc->notifier);
 csi2dc_probe_cleanup_entity:
 	media_entity_cleanup(&csi2dc->csi2dc_sd.entity);

From 1711d758ede7ad6dc9f9b96366a6eea5c8c867df Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:21:59 +0530
Subject: [PATCH 0721/1982] media: microchip-isc: take a reference on the
 parsed endpoints

commit f2eb2fd388bf3f1959556a326e797cacca341c86 upstream.

for_each_endpoint_of_node() drops the reference on the current node as
it advances. xisc_parse_dt() and isc_parse_dt() store the node in
subdev_entity->epn and release it later with of_node_put(), but never
took their own reference, so the stored pointer refers to an
already-released node. This underflows the refcount and can
use-after-free, reachable through the camera device tree overlay.

Take a reference with of_node_get() when storing the node, and drop it
in microchip_isc_subdev_cleanup() so the entities the bind loop never
reaches on an early exit do not leak it.

Fixes: c9aa973884a1 ("media: atmel: atmel-isc: add microchip-xisc driver")
Fixes: d6701f13bd07 ("media: atmel: Use v4l2_async_notifier_add_fwnode_remote_subdev")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../platform/microchip/microchip-isc-base.c     |  6 ++++++
 .../platform/microchip/microchip-sama5d2-isc.c  | 17 ++++++++++++-----
 .../platform/microchip/microchip-sama7g5-isc.c  | 17 ++++++++++++-----
 3 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index a7cdc743fda71d..32bdeae04ad079 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1860,6 +1860,12 @@ void microchip_isc_subdev_cleanup(struct isc_device *isc)
 	list_for_each_entry(subdev_entity, &isc->subdev_entities, list) {
 		v4l2_async_nf_unregister(&subdev_entity->notifier);
 		v4l2_async_nf_cleanup(&subdev_entity->notifier);
+		/*
+		 * Release the endpoint reference taken while parsing. It is
+		 * NULL for entities the bind loop already consumed, so this
+		 * only drops the ones left over on an early exit.
+		 */
+		of_node_put(subdev_entity->epn);
 	}
 
 	INIT_LIST_HEAD(&isc->subdev_entities);
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 66d3d7891991e9..88e6d8e1c6c9cf 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -356,28 +356,30 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
 	struct device_node *epn;
 	struct isc_subdev_entity *subdev_entity;
 	unsigned int flags;
+	int ret;
 
 	INIT_LIST_HEAD(&isc->subdev_entities);
 
 	for_each_endpoint_of_node(np, epn) {
 		struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
-		int ret;
 
 		ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
 						 &v4l2_epn);
 		if (ret) {
-			of_node_put(epn);
 			dev_err(dev, "Could not parse the endpoint\n");
-			return -EINVAL;
+			of_node_put(epn);
+			ret = -EINVAL;
+			goto err_cleanup;
 		}
 
 		subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
 					     GFP_KERNEL);
 		if (!subdev_entity) {
 			of_node_put(epn);
-			return -ENOMEM;
+			ret = -ENOMEM;
+			goto err_cleanup;
 		}
-		subdev_entity->epn = epn;
+		subdev_entity->epn = of_node_get(epn);
 
 		flags = v4l2_epn.bus.parallel.flags;
 
@@ -398,6 +400,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
 	}
 
 	return 0;
+
+err_cleanup:
+	list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+		of_node_put(subdev_entity->epn);
+	return ret;
 }
 
 static int microchip_isc_probe(struct platform_device *pdev)
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 7383341ec51d6e..77c6c183451bfe 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -340,6 +340,7 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
 	struct isc_subdev_entity *subdev_entity;
 	unsigned int flags;
 	bool mipi_mode;
+	int ret;
 
 	INIT_LIST_HEAD(&isc->subdev_entities);
 
@@ -347,23 +348,24 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
 
 	for_each_endpoint_of_node(np, epn) {
 		struct v4l2_fwnode_endpoint v4l2_epn = { .bus_type = 0 };
-		int ret;
 
 		ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(epn),
 						 &v4l2_epn);
 		if (ret) {
-			of_node_put(epn);
 			dev_err(dev, "Could not parse the endpoint\n");
-			return -EINVAL;
+			of_node_put(epn);
+			ret = -EINVAL;
+			goto err_cleanup;
 		}
 
 		subdev_entity = devm_kzalloc(dev, sizeof(*subdev_entity),
 					     GFP_KERNEL);
 		if (!subdev_entity) {
 			of_node_put(epn);
-			return -ENOMEM;
+			ret = -ENOMEM;
+			goto err_cleanup;
 		}
-		subdev_entity->epn = epn;
+		subdev_entity->epn = of_node_get(epn);
 
 		flags = v4l2_epn.bus.parallel.flags;
 
@@ -387,6 +389,11 @@ static int xisc_parse_dt(struct device *dev, struct isc_device *isc)
 	}
 
 	return 0;
+
+err_cleanup:
+	list_for_each_entry(subdev_entity, &isc->subdev_entities, list)
+		of_node_put(subdev_entity->epn);
+	return ret;
 }
 
 static int microchip_xisc_probe(struct platform_device *pdev)

From 98e3df13c9fd57cc4051e9ee1717cfc65ee04c7d Mon Sep 17 00:00:00 2001
From: Rik van Riel <riel@surriel.com>
Date: Sat, 8 Aug 2026 23:20:31 -0400
Subject: [PATCH 0722/1982] media: redrat3: fix UAF in probe error path leaving
 rc device registered

commit af452b9e01331b5338a1e5141624f17607239207 upstream.

redrat3 stores its device name and phys path inside the main rr3
structure, and the rc device's device_name and input_phys point into
rr3. When the RC device is registered, it keeps those pointers.

  KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648
  Read of size 1 at addr ffff888051fda758 by task udevd/7464
  Call Trace:
   string_nocheck lib/vsprintf.c:648 [inline]
   string+0x216/0x2d0 lib/vsprintf.c:730
   vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
   vscnprintf+0x41/0x90 lib/vsprintf.c:3014
   sysfs_emit+0x10e/0x180 fs/sysfs/file.c:761
   input_dev_show_name+0x58/0x70 drivers/input/input.c:1282

  Allocated by task 10:
   redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023
  Freed by task 10:
   redrat3_delete drivers/media/rc/redrat3.c:466 [inline]
   redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124

Syzkaller triggers this via usb probing. It probes the RedRat3 USB
interface, which calls redrat3_dev_probe() in redrat3.c. That function
allocates rr3, then builds an rc device whose name points into rr3 via
redrat3_init_rc_dev() in redrat3.c, and registers it with
rc_register_device().

When the detector enable fails after the RC device is registered, the
probe jumps to the led_free path. That path unregisters the LED but does
not unregister the RC device before freeing rr3 via redrat3_delete() in
redrat3.c. The RC device still holds device_name = rr3->name which is now
freed.

Later udevd reads /sys/.../input device name via sysfs_emit() in file.c,
which calls input_dev_show_name() in input.c, which emits dev->name which
is the freed rr3->name.

When the detector enable fails after the RC device is registered, the
error path must not leave the RC device registered. Make the probe error
path clean up the same way redrat3_dev_disconnect() does.

This change should be safe because the RC device is fully registered at
this point and its teardown via rc_unregister_device() is protected by
the input device mutex, and rr3 is still alive during unregister so
device_name remains valid until after unregister. The URBs are killed
before rc_free, so no completion can run after rc is freed. No new lock
ordering is introduced.

Reported-by: syzbot+302b9b575a06733ff60c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=302b9b575a06733ff60c
Link: https://lore.kernel.org/all/6a74a76d.ec7c9571.3ac9bb.0056.GAE@google.com/
Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org
Assisted-by: Hermes:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/redrat3.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index b8289327f6a206..3170bd72a8e6f1 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -977,6 +977,7 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	struct device *dev = &intf->dev;
 	struct usb_host_interface *uhi;
 	struct redrat3_dev *rr3;
+	struct rc_dev *rc;
 	struct usb_endpoint_descriptor *ep;
 	struct usb_endpoint_descriptor *ep_narrow = NULL;
 	struct usb_endpoint_descriptor *ep_wide = NULL;
@@ -1121,9 +1122,12 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	return 0;
 
 led_free:
+	rc_unregister_device(rr3->rc);
 	led_classdev_unregister(&rr3->led);
 redrat_free:
+	rc = rr3->rc;
 	redrat3_delete(rr3, rr3->udev);
+	rc_free_device(rc);
 
 no_endpoints:
 	return retval;

From e848c0bd189bd41189f20249a4d71895ff884f40 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Thu, 30 Jul 2026 07:15:52 +0000
Subject: [PATCH 0723/1982] media: s5p-mfc: use timer_shutdown_sync() for the
 self-rearming watchdog

commit 63069b5917cba2e15b1a78b3f4ff99e45102c56f upstream.

The MFC watchdog timer (s5p_mfc_watchdog) is self-rearming: every
callback re-arms itself with add_timer() and, on a timeout, schedules
watchdog_work. s5p_mfc_remove() tears this down with timer_delete_sync()
followed by flush_work().

timer_delete_sync() dequeues the timer and waits for a callback that is
already running, but it does not prevent a subsequent re-arm. Because the
watchdog callback re-arms via add_timer(), this is the wrong shutdown
primitive: once the wait returns nothing guarantees a just-queued re-arm
will not fire later, dereferencing dev (clock on/off, deinit_hw,
load_firmware, init_hw) after video_unregister_device(), DMA teardown and
s5p_mfc_final_pm() have run, a potential use-after-free.

Use timer_shutdown_sync(), which puts the timer into a shutdown state so
that any add_timer()/mod_timer() from the callback becomes a no-op and no
later firing is possible. Switch flush_work() to cancel_work_sync() so any
watchdog_work that was already queued before the timer was stopped is
cancelled rather than allowed to run to completion against the torn-down
device.

This issue was found by an in-house static analysis tool. No runtime
reproducer is available.

Fixes: af9357467810 ("[media] MFC: Add MFC 5.1 V4L2 driver")
Cc: stable@vger.kernel.org
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c
index 4948d734eb02c9..510b1dd8ceb391 100644
--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c
@@ -1474,8 +1474,8 @@ static void s5p_mfc_remove(struct platform_device *pdev)
 	}
 	mutex_unlock(&dev->mfc_mutex);
 
-	timer_delete_sync(&dev->watchdog_timer);
-	flush_work(&dev->watchdog_work);
+	timer_shutdown_sync(&dev->watchdog_timer);
+	cancel_work_sync(&dev->watchdog_work);
 
 	video_unregister_device(dev->vfd_enc);
 	video_unregister_device(dev->vfd_dec);

From 590f48b5644319437ad2bb8d64d5cfd4f5a5ed7b Mon Sep 17 00:00:00 2001
From: Imre Kaloz <kaloz@kernel.org>
Date: Wed, 14 Oct 2026 17:08:43 +0200
Subject: [PATCH 0724/1982] mm/slab: sample slab_state once in
 kmem_cache_destroy()

commit 088bfdc0d7947d623f4899b9011c866e4445074d upstream.

kmem_cache_release() tests slab_state >= FULL after kmem_cache_destroy()
has dropped slab_mutex and unlinked the cache, and for a
SLAB_TYPESAFE_BY_RCU cache after rcu_barrier(). If slab_late_init() runs
before that test it sets slab_state to FULL but skips the unlinked cache,
which never got a sysfs entry, so sysfs_slab_release() calls kobject_put()
on a kobject that was never initialized:

  WARNING: lib/kobject.c:734 at kobject_put+0x64/0x2c0, CPU#1: kworker/u8:3/55
  kobject: '(null)' ((____ptrval____)): is not initialized, yet kobject_put() is being called.
  refcount_t: underflow; use-after-free.
  kobject_put+0x64/0x2c0
  sysfs_slab_release+0xc/0x20
  kmem_cache_destroy+0x104/0x1e0
  bioset_exit+0x13c/0x1e0
  disk_release+0x54/0x140
  put_disk+0x18/0x40
  floppy_async_init+0xbec/0xd10

slab_state >= FULL asks whether the cache has a kobject, which cache
creation skips while slab_state <= UP. UP is the state just below FULL,
so a false sample cannot skip a kobject_put() that was owed.

Seen on sparc64 at boot, where the asynchronous floppy init tears down
its bio slab while the late initcalls are running.

Sample slab_state once, under slab_mutex which slab_late_init() holds
when it sets FULL, and use the result for both the unlink and the
release.

The history of this problem dates back to v3.2:

  Commit 69cb8e6b7c29 ("slub: free slabs without holding locks") in
  v3.2 moved sysfs_slab_remove() outside slub_lock and introduced
  a race condition between kmem_cache_destroy() and slab_sysfs_init().

  Commit 945cf2b6199be ("mm/sl[aou]b: Extract a common function for
  kmem_cache_destroy") in v3.7 accidentally closed the race while
  extracting a common implementation for kmem_cache_destroy().

  Commit 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
  in v3.8 re-opened the race by dropping slab_mutex around
  sysfs_slab_remove() in __kmem_cache_shutdown(), to avoid a lockdep
  splat between slab_mutex and the sysfs lock.

  Commit 657dc2f97220 ("slab: remove synchronous rcu_barrier() call in
  memcg cache release path") in v4.11 shifted from synchronous
  rcu_barrier() to asynchronous RCU work for SLAB_TYPESAFE_BY_RCU caches.
  That commit, again, accidentally closed the race by moving
  sysfs_slab_release() to shutdown_cache(), but only for
  !SLAB_TYPESAFE_BY_RCU caches because destruction of
  SLAB_TYPESAFE_BY_RCU caches is done in an RCU work.

  Commit 0495e337b703 ("mm/slab_common: Deleting kobject in
  kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") in
  v6.0 re-introduced the race for !SLAB_TYPESAFE_BY_RCU caches.

Fixes: 69cb8e6b7c29 ("slub: free slabs without holding locks")
Fixes: 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock")
Cc: stable@vger.kernel.org
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Link: https://patch.msgid.link/20261014150844.8536-1-kaloz@kernel.org
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slab_common.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index edd49796be4c95..0058d1f25905c6 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -498,10 +498,10 @@ EXPORT_SYMBOL(kmem_buckets_create);
  * and release of the kobject does not need slab_mutex or cpu_hotplug_lock
  * protection. So they are now done without holding those locks.
  */
-static void kmem_cache_release(struct kmem_cache *s)
+static void kmem_cache_release(struct kmem_cache *s, bool sysfs_ready)
 {
 	kfence_shutdown_cache(s);
-	if (__is_defined(SLAB_SUPPORTS_SYSFS) && slab_state >= FULL)
+	if (__is_defined(SLAB_SUPPORTS_SYSFS) && sysfs_ready)
 		sysfs_slab_release(s);
 	else
 		slab_kmem_cache_release(s);
@@ -516,6 +516,7 @@ void slab_kmem_cache_release(struct kmem_cache *s)
 
 void kmem_cache_destroy(struct kmem_cache *s)
 {
+	bool sysfs_ready;
 	int err;
 
 	if (unlikely(!s) || !kasan_check_byte(s))
@@ -563,10 +564,18 @@ void kmem_cache_destroy(struct kmem_cache *s)
 
 	list_del(&s->list);
 
+	/*
+	 * slab_late_init() sets slab_state to FULL under slab_mutex and adds
+	 * sysfs entries only for caches still on the list. Sample the state
+	 * here, so that a cache unlinked before that point is not handed to
+	 * sysfs_slab_release() with an uninitialized kobject.
+	 */
+	sysfs_ready = slab_state >= FULL;
+
 	mutex_unlock(&slab_mutex);
 	cpus_read_unlock();
 
-	if (slab_state >= FULL)
+	if (sysfs_ready)
 		sysfs_slab_unlink(s);
 	debugfs_slab_release(s);
 
@@ -576,7 +585,7 @@ void kmem_cache_destroy(struct kmem_cache *s)
 	if (s->flags & SLAB_TYPESAFE_BY_RCU)
 		rcu_barrier();
 
-	kmem_cache_release(s);
+	kmem_cache_release(s, sysfs_ready);
 }
 EXPORT_SYMBOL(kmem_cache_destroy);
 

From 325da0365ffa4f19ca50a9be2931a18bb252c07a Mon Sep 17 00:00:00 2001
From: Vernon Yang <yanglincheng@kylinos.cn>
Date: Wed, 9 Sep 2026 10:58:03 +0800
Subject: [PATCH 0725/1982] mm: khugepaged: fix folio is used after
 folio_put/unlock()

commit 9010383e71e6ce75fcd3c8f87133c8ce6c0e6ab4 upstream.

On the rollback path, folio_put() has already dropped the last reference
of new_folio.  On the success path, new_folio is already unlocked and can
be freed concurrently.  The trace_mm_khugepaged_collapse_file() is left
with a dangling folio pointer.

So using the folio_pfn() before dropping the reference, closing
use-after-free window.

Link: https://lore.kernel.org/20260909025804.3233645-4-vernon2gm@gmail.com
Fixes: 4c9473e87e75 ("mm/khugepaged: add tracepoint to collapse_file()")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/events/huge_memory.h | 6 +++---
 mm/khugepaged.c                    | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
index dd94d14a24272d..2276614691dfd9 100644
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -200,10 +200,10 @@ TRACE_EVENT(mm_khugepaged_scan_file,
 );
 
 TRACE_EVENT(mm_khugepaged_collapse_file,
-	TP_PROTO(struct mm_struct *mm, struct folio *new_folio, pgoff_t index,
+	TP_PROTO(struct mm_struct *mm, unsigned long new_pfn, pgoff_t index,
 			unsigned long addr, bool is_shmem, struct file *file,
 			int nr, int result),
-	TP_ARGS(mm, new_folio, index, addr, is_shmem, file, nr, result),
+	TP_ARGS(mm, new_pfn, index, addr, is_shmem, file, nr, result),
 	TP_STRUCT__entry(
 		__field(struct mm_struct *, mm)
 		__field(unsigned long, hpfn)
@@ -217,7 +217,7 @@ TRACE_EVENT(mm_khugepaged_collapse_file,
 
 	TP_fast_assign(
 		__entry->mm = mm;
-		__entry->hpfn = new_folio ? folio_pfn(new_folio) : -1;
+		__entry->hpfn = new_pfn;
 		__entry->index = index;
 		__entry->addr = addr;
 		__entry->is_shmem = is_shmem;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index a11e56ef99236f..e2ac26c05064f9 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1861,6 +1861,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr,
 	struct address_space *mapping = file->f_mapping;
 	struct page *dst;
 	struct folio *folio, *tmp, *new_folio;
+	unsigned long new_pfn = -1;
 	pgoff_t index = 0, end = start + HPAGE_PMD_NR;
 	LIST_HEAD(pagelist);
 	XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER);
@@ -1873,6 +1874,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr,
 	result = alloc_charge_folio(&new_folio, mm, cc);
 	if (result != SCAN_SUCCEED)
 		goto out;
+	new_pfn = folio_pfn(new_folio);
 
 	mapping_set_update(&xas, mapping);
 
@@ -2292,7 +2294,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr,
 	folio_put(new_folio);
 out:
 	VM_BUG_ON(!list_empty(&pagelist));
-	trace_mm_khugepaged_collapse_file(mm, new_folio, index, addr, is_shmem, file, HPAGE_PMD_NR, result);
+	trace_mm_khugepaged_collapse_file(mm, new_pfn, index, addr, is_shmem, file, HPAGE_PMD_NR, result);
 	return result;
 }
 

From a79de0e5e66bd0b69b38c855413a9e3a82926b24 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Fri, 11 Sep 2026 02:05:44 +0000
Subject: [PATCH 0726/1982] scsi: dc395x: sync the waiting_timer before freeing
 the host

commit 0b1a79f2791a06f139dce5450e487307cf0e241f upstream.

The waiting_timer callback re-arms itself and takes the host lock.
adapter_uninit() currently stops it with timer_delete(), which does not
wait for a callback already running on another CPU. The final
scsi_host_put() that frees the host (and the host lock the callback
dereferences) runs right after adapter_uninit(), so a concurrent or just
re-armed callback can fire after the free, leaving a potential
use-after-free window.

Replace timer_delete() with timer_shutdown_sync() at the top of
adapter_uninit(), before the host-lock section: the timer is dequeued,
a running callback is waited for and rearming is blocked before the chip
is halted, so it cannot fire at all once the adapter has ceased to
function. Waiting outside the lock avoids the self-deadlock that would
result from syncing a callback blocked on the lock we still hold.

No shutdown is needed for selto_timer because it has no reachable armer
or callback.

This issue was found by an in-house static analysis tool.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Cc: Jamie Lenehan <lenehan@twibble.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260911020544.42966-1-fanwu01@zju.edu.cn
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/dc395x.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 386c8359e1cc8a..23f237aba7ee1c 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -3814,13 +3814,11 @@ static void adapter_uninit_chip(struct AdapterCtlBlk *acb)
 static void adapter_uninit(struct AdapterCtlBlk *acb)
 {
 	unsigned long flags;
-	DC395x_LOCK_IO(acb->scsi_host, flags);
 
-	/* remove timers */
-	if (timer_pending(&acb->waiting_timer))
-		timer_delete(&acb->waiting_timer);
-	if (timer_pending(&acb->selto_timer))
-		timer_delete(&acb->selto_timer);
+	/* Drain the self-rearming timer; must not run under host_lock. */
+	timer_shutdown_sync(&acb->waiting_timer);
+
+	DC395x_LOCK_IO(acb->scsi_host, flags);
 
 	adapter_uninit_chip(acb);
 	adapter_remove_and_free_all_devices(acb);

From 0f332cce4d592d751aad89b404f68463099167c8 Mon Sep 17 00:00:00 2001
From: Igor Putko <igorpetindev@gmail.com>
Date: Sat, 3 Oct 2026 19:33:37 +0300
Subject: [PATCH 0727/1982] serial: core: shut down initialized port on removal

commit 810d467c11f0c85107874d08dfdd11acba6aa0c0 upstream.

When a serial port configured as a console is opened and subsequently
closed, tty_port_shutdown() skips invoking port->ops->shutdown() because
port->console is true. As a result, tty_port_initialized() remains true
and the port's interrupt handler stays registered in the irq subsystem.

If the underlying device is later unbound or removed (e.g. via sysfs
driver unbind or device hot-unplug), serial_core_remove_one_port()
unregisters the console, frees uport->name via kfree(), and tears down
the port without shutting it down or freeing its IRQ. Consequently, the
irqaction descriptor remains registered in genirq with action->name
pointing to freed memory.

This triggers a use-after-free read whenever genirq accesses action->name,
such as when reading /proc/interrupts:

  BUG: KASAN: slab-use-after-free in string+0x476/0x570
  Call Trace:
   string+0x476/0x570
   vsnprintf+0x422/0x1300
   seq_printf+0x...
   show_interrupts+...

Fix this by acquiring port->mutex in serial_core_remove_one_port() after
console unregistration, clearing port->console under the mutex to prevent
data races with concurrent tty_port_shutdown(), and invoking
uart_shutdown(NULL, state) if the port remains initialized. This ensures
that port->ops->shutdown() is called and the IRQ is freed before
kfree(uport->name).

Reported-by: syzbot+843bf2f48f4d12e6682e@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=843bf2f48f4d12e6682e
Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close")
Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct")
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20261003163337.45577-1-igorpetindev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/serial_core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 593f15213b72c0..602dfaf20fdf60 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3215,6 +3215,13 @@ static void serial_core_remove_one_port(struct uart_driver *drv,
 	if (uart_console(uport))
 		unregister_console(uport->cons);
 
+	scoped_guard(mutex, &port->mutex) {
+		port->console = false;
+
+		if (tty_port_initialized(port))
+			uart_shutdown(NULL, state);
+	}
+
 	/*
 	 * Free the port IO and memory resources, if any.
 	 */

From e64707d07fcda07c71d4f1405c1bedb0787a6889 Mon Sep 17 00:00:00 2001
From: Yuchao Zhang <ndaugoing@gmail.com>
Date: Tue, 22 Sep 2026 15:21:55 +0800
Subject: [PATCH 0728/1982] xen-blkfront: unbind irq before tearing down ring
 and shadow requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f3e27b7955727a4d7c0e9264a2a209fbba788bdc upstream.

In blkif_free_ring(), the driver tears down the ring's persistent grants,
shadow request arrays, and shared ring structure (xenbus_teardown_ring),
and only calls unbind_from_irqhandler() at the very end.

While blkif_free_ring() is freeing persistent grants and clearing the
shadow array, the event channel interrupt (blkif_interrupt) is still
registered and active.  If an interrupt arrives from the backend during
this teardown window, blkif_interrupt() reads rinfo->ring.sring and,
via blkif_completion(), accesses rinfo->shadow[id].grants_used and
rinfo->shadow[id].sg.  blkif_free_ring() tears these structures down
without holding rinfo->ring_lock, and the handler only checks
info->connected at entry, so this is a real race resulting in a
use-after-free or NULL pointer dereference.

Fix this by moving unbind_from_irqhandler() to the beginning of
blkif_free_ring().  Calling unbind_from_irqhandler() first frees the
IRQ and synchronizes with any in-flight interrupt handlers on other CPUs
before ring memory and shadow request structures are deallocated,
matching the teardown order in drivers/net/xen-netfront.c.

Fixes: 11659569f720 ("xen/blkfront: split per device io_lock")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260922072155.34625-1-ndaugoing@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkfront.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 04fc6b552c0498..f37290fd3c5dba 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1210,6 +1210,14 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
 	struct blkfront_info *info = rinfo->dev_info;
 	int i, j, segs;
 
+	/*
+	 * Interrupt teardown must be done ahead of freeing queue-related
+	 * data, otherwise the interrupt handler can race with the cleanup.
+	 */
+	if (rinfo->irq)
+		unbind_from_irqhandler(rinfo->irq, rinfo);
+	rinfo->evtchn = rinfo->irq = 0;
+
 	/*
 	 * Remove indirect pages, this only happens when using indirect
 	 * descriptors but not persistent grants
@@ -1292,10 +1300,6 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
 	/* Free resources associated with old device channel. */
 	xenbus_teardown_ring((void **)&rinfo->ring.sring, info->nr_ring_pages,
 			     rinfo->ring_ref);
-
-	if (rinfo->irq)
-		unbind_from_irqhandler(rinfo->irq, rinfo);
-	rinfo->evtchn = rinfo->irq = 0;
 }
 
 static void blkif_free(struct blkfront_info *info, int suspend)

From 49e05c8d3d8f546a9723e0fca20df02703f9015d Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Fri, 11 Sep 2026 14:31:44 -0700
Subject: [PATCH 0729/1982] wifi: ath9k: delete channel-context timers on
 deinit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 81394dfb9a7905472957628b560ae894eae3a30f upstream.

ath9k_deinit_channel_context() cancels chanctx_work but does not delete
the offchannel and sched timers set up by ath9k_init_channel_context().
If either timer fires after deinit (e.g. during driver unload or
suspend), it accesses sc->sc_ah which may already be freed by
ath9k_hw_deinit(), causing a use-after-free.

Delete both timers with timer_shutdown_sync() before cancelling the work
item.

Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Cc: stable@vger.kernel.org # v6.2+
Fixes: 705d0bf83dbe ("ath9k: Add a routine for initializing channel contexts")
Link: https://patch.msgid.link/20260911213144.130192-1-rosenp@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/channel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 8b27d8cc086ab7..cfb1c90eb4b6c7 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -1363,6 +1363,8 @@ void ath9k_init_channel_context(struct ath_softc *sc)
 
 void ath9k_deinit_channel_context(struct ath_softc *sc)
 {
+	timer_shutdown_sync(&sc->sched.timer);
+	timer_shutdown_sync(&sc->offchannel.timer);
 	cancel_work_sync(&sc->chanctx_work);
 }
 

From 26dc15da08f15e8320514d700d6a4c449d1bb047 Mon Sep 17 00:00:00 2001
From: Zhao Li <enderaoelyther@gmail.com>
Date: Tue, 25 Aug 2026 19:26:20 +0800
Subject: [PATCH 0730/1982] wifi: mt76: mt7996: unlink TWT flow if the MCU
 rejects the agreement

commit 022f5f8b7a0580da50fcbc34da853d03d4321fe2 upstream.

mt7996_mac_add_twt_setup() links a new flow into dev->twt_list before
asking the MCU to add the agreement, but exits without unlinking the flow
if the request fails. The flow-ID and table masks are only committed
after MCU success, so the still-linked flow is invisible to the
mask-gated teardown paths.

If the station retries the setup, the same slot is cleared and its
embedded list node reinitialized while it is still linked, corrupting
dev->twt_list. If the station disassociates instead, teardown skips the
flow and station storage can be freed while the node remains linked. A
later scheduling or debugfs twt_stats walk can then dereference the
freed flow, resulting in a use-after-free.

Unlink the flow when the MCU rejects the agreement. This restores the
list to its pre-request state while leaving the unchanged mask and
agreement accounting untouched.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260729173632.14387-3-enderaoelyther@gmail.com/
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Kimi:K3
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260825112620.97568-1-enderaoelyther@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index ed3508afc08445..8730a1eeac3896 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -3347,8 +3347,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 	flow->tsf = le64_to_cpu(twt_agrt->twt);
 
 	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
-				       MCU_TWT_AGRT_ADD))
+				       MCU_TWT_AGRT_ADD)) {
+		list_del(&flow->list);
 		goto unlock;
+	}
 
 	setup_cmd = TWT_SETUP_CMD_ACCEPT;
 	dev->twt.table_mask |= BIT(table_id);

From e7e89759445e97ccb445758c6c8d5caed4eb42f9 Mon Sep 17 00:00:00 2001
From: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Date: Tue, 11 Aug 2026 14:08:10 +0800
Subject: [PATCH 0731/1982] usb: gadget: fix refcount underflow in
 gadgetfs_bind() error path

commit cb3b441f2698455a48e9a023d5f7f4e3fcb94c73 upstream.

gadgetfs_bind() calls get_dev() only on the success path, but
gadgetfs_unbind() called from the enomem error label unconditionally
calls put_dev().  When bind fails (e.g. ENOMEM), put_dev() fires
without a matching get_dev(), leaving the refcount unbalanced.

A subsequent close of the ep0 file descriptor calls dev_release() ->
put_dev() which hits zero and frees the object; then gadgetfs_kill_sb()
calls put_dev(the_device) again on the already-freed pointer, triggering
a refcount underflow and use-after-free.

Fix by calling get_dev() at the start of gadgetfs_bind(), before any
error path that invokes gadgetfs_unbind(), so the reference is always
balanced regardless of whether bind succeeds or fails.

Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260811060810.295666-1-khiemtranzo532001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/legacy/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index a46b6a6b1f836e..677cd236f079c4 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1697,6 +1697,8 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
 
+	get_dev (dev);
+
 	/* preallocate control response and buffer */
 	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
 	if (!dev->req)
@@ -1711,7 +1713,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:

From c792858491ee39e8f6e1547c45422595cf25b415 Mon Sep 17 00:00:00 2001
From: YANXIN LI <fadouse@pm.me>
Date: Sat, 18 Jul 2026 19:03:07 +0000
Subject: [PATCH 0732/1982] ufs: use u64 for directory size in ufs_last_byte

commit 1eff23433e73d7da4f9e3529d2701e34962b161f upstream.

ufs1_read_inode() and ufs2_read_inode() copy the untrusted 64-bit
on-disk size into inode->i_size.  ufs_last_byte() then truncates that
value to an unsigned int before calculating the valid extent of a
directory folio.

A directory size of exactly 4 GiB is truncated to zero.  In
ufs_find_entry(), subtracting the requested record length from that zero
forms an endpoint almost 4 GiB beyond the mapped folio.  A crafted UFS2
image produces:

  BUG: KASAN: use-after-free in ufs_find_entry+0x583/0x6e0 [ufs]
  Read of size 1
  ...
  ufs_find_entry
  ufs_inode_by_name
  ufs_lookup
  __lookup_slow
  path_lookupat

The KASAN classification reflects that the adjacent physical page was
free; the source-level operation is an out-of-folio read.  A controlled
UFS1 test with CONFIG_UFS_FS_WRITE enabled also made ufs_find_entry()
return a directory entry from an adjacent anonymous page.  unlink() then
passed that pointer to ufs_delete_entry(), which cleared the adjacent
page's 3
2-bit d_ino.  This write result reproduced three out of three
times.

UFS normally requires a privileged mount path.  A relevant boundary is
a privileged automounter or image-processing service handling an
attacker-supplied filesystem.  The write primitive additionally requires
UFS1 to be mounted read-write with CONFIG_UFS_FS_WRITE enabled; the read
is reachable with read-only UFS2.

Keep the intermediate size arithmetic at 64 bits so non-final pages are
bounded at PAGE_SIZE.  With this change, the same controlled tests reach
the real on-disk directory entry and produce no adjacent-page write or
KASAN report.  A reproducer and full validation logs are available on
request.

The vulnerable helper is present in v7.2-rc3, v7.1, v6.18.38, v6.12.95,
v6.6.111, and upstream master at 1229e2e57a5c.  Runtime reproduction and
fix validation were performed in an x86-64 QEMU guest running v7.2-rc3
with generic KASAN.

Fixes: b71034e5e67d ("[PATCH] ufs: directory and page cache:  from blocks to pages")
Cc: stable@vger.kernel.org
Signed-off-by: YANXIN LI <fadouse@pm.me>
Link: https://patch.msgid.link/20260718190300.867109-1-fadouse@pm.me
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ufs/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ufs/dir.c b/fs/ufs/dir.c
index ec58edaf57c9ec..0953891f075680 100644
--- a/fs/ufs/dir.c
+++ b/fs/ufs/dir.c
@@ -212,7 +212,7 @@ static void *ufs_get_folio(struct inode *dir, unsigned long n,
 static unsigned
 ufs_last_byte(struct inode *inode, unsigned long page_nr)
 {
-	unsigned last_byte = inode->i_size;
+	u64 last_byte = inode->i_size;
 
 	last_byte -= page_nr << PAGE_SHIFT;
 	if (last_byte > PAGE_SIZE)

From 733552f8c5f5fdce6b2a135dfa2a05ead9f66e91 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Fri, 16 Oct 2026 10:00:36 +0800
Subject: [PATCH 0733/1982] spi: spi-pci1xxxx: quiesce DMA engines on transfer
 timeout

commit 0b591332a2bdc13d3f9163793131fe3651d1556a upstream.

If a DMA-mapped transfer times out waiting for DMA_TERM and neither DMA
abort interrupt arrived, pci1xxxx_spi_transfer_with_dma() returns
through the error label while both DMA engines are still enabled, the
done/abort interrupt status is still armed and the transfer state
(p->xfer, p->tx_sgl, p->rx_sgl) is still registered.

The ISRs keep firing afterwards: they reprogram the DMA engines from
p->tx_sgl / p->rx_sgl and signal completion through p->xfer and
p->spi_xfer_done, all of which the SPI core is free to unmap or reuse
once transfer_one() has returned, which is a use-after-free. A late
done interrupt can also start the next transfer queued behind the
failed one.

Stop both DMA engines, drain the pending done/abort interrupt status
and synchronize the DMA IRQs before dropping the in-progress state and
the transfer pointers, and re-enable the engines afterwards so that
subsequent transfers keep working. The engines are only turned back on
once both were confirmed to have stopped: re-enabling an engine that
failed to stop would cancel the pending stop request and let it keep
running into buffers the SPI core is about to unmap or free, which is
exactly the window this patch closes. An engine that failed to stop is
left disabled, as the abort paths already do.

The DMA interrupt status and mask registers are shared between the two
SPI instances, so the cleanup drains only this instance's done/abort
status bits instead of masking the interrupt lines, which would also
suppress the peer instance's completion interrupts.

Also make the DMA ISRs ignore interrupts while no transfer is in
progress so that a stray MSI after the cleanup can no longer act on
the cleared state.

No PCI1XXXX hardware was available for testing and QEMU has no model
of this PCIe part, so the timeout path was exercised with a userspace
replica of the timeout branch and the DMA ISRs, with the register and
interrupt accesses mocked: on the unfixed code both a wedged engine
that clears after the timeout and a late done interrupt touch the
freed transfer state, while with this fix applied neither does and an
engine that failed to stop is left disabled.  The module was also
loaded and unloaded in a QEMU x86_64 guest running a kernel with this
fix applied.

Fixes: 9538edeb72c9 ("spi: mchp-pci1xxxx: DMA support for copying data to and from SPI Buf")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261016020036.1333548-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-pci1xxxx.c | 71 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c
index 8577a19705de49..1ecb0ace3c2dba 100644
--- a/drivers/spi/spi-pci1xxxx.c
+++ b/drivers/spi/spi-pci1xxxx.c
@@ -542,6 +542,8 @@ static int pci1xxxx_spi_transfer_with_dma(struct spi_controller *spi_ctlr,
 	struct pci1xxxx_spi_internal *p = spi_controller_get_devdata(spi_ctlr);
 	struct pci1xxxx_spi *par = p->parent;
 	dma_addr_t tx_dma_addr = 0;
+	unsigned long flags;
+	bool engines_stopped;
 	int ret = 0;
 	u32 regval;
 
@@ -618,12 +620,72 @@ static int pci1xxxx_spi_transfer_with_dma(struct spi_controller *spi_ctlr,
 			p->dma_aborted_wr = false;
 			ret = -ECANCELED;
 		}
+
+		/*
+		 * A timed out transfer leaves the DMA engines running and
+		 * the done/abort interrupt status armed with p->xfer,
+		 * p->tx_sgl and p->rx_sgl still registered.  Stop the
+		 * engines, drain the pending status and synchronize the
+		 * IRQs before dropping the transfer state, otherwise a
+		 * late interrupt makes the ISRs reprogram the engines
+		 * from or signal completion through memory which the SPI
+		 * core is about to unmap or free.
+		 */
+		writel(SPI_DMA_ENGINE_DIS,
+		       par->dma_offset_bar + SPI_DMA_GLOBAL_WR_ENGINE_EN);
+		writel(SPI_DMA_ENGINE_DIS,
+		       par->dma_offset_bar + SPI_DMA_GLOBAL_RD_ENGINE_EN);
+		engines_stopped =
+			!(readl_poll_timeout(par->dma_offset_bar +
+					     SPI_DMA_GLOBAL_WR_ENGINE_EN,
+					     regval, regval == 0x0, 0,
+					     USEC_PER_MSEC) ||
+			  readl_poll_timeout(par->dma_offset_bar +
+					     SPI_DMA_GLOBAL_RD_ENGINE_EN,
+					     regval, regval == 0x0, 0,
+					     USEC_PER_MSEC));
+		if (!engines_stopped)
+			dev_warn(&par->dev->dev,
+				 "SPI DMA engines failed to stop\n");
+
+		spin_lock_irqsave(&par->dma_wr_reg_lock, flags);
+		writel((SPI_DMA_DONE_INT_MASK(p->hw_inst) |
+			SPI_DMA_ABORT_INT_MASK(p->hw_inst)),
+		       par->dma_offset_bar + SPI_DMA_INTR_WR_CLR);
+		spin_unlock_irqrestore(&par->dma_wr_reg_lock, flags);
+		spin_lock_irqsave(&par->dma_rd_reg_lock, flags);
+		writel((SPI_DMA_DONE_INT_MASK(p->hw_inst) |
+			SPI_DMA_ABORT_INT_MASK(p->hw_inst)),
+		       par->dma_offset_bar + SPI_DMA_INTR_RD_CLR);
+		spin_unlock_irqrestore(&par->dma_rd_reg_lock, flags);
+
+		p->spi_xfer_in_progress = false;
+		synchronize_irq(p->irq[1]);
+		synchronize_irq(p->irq[2]);
+
+		/*
+		 * Turn the engines back on only once both are confirmed
+		 * to have stopped: re-enabling an engine that failed to
+		 * stop would cancel the pending stop request and let it
+		 * run into buffers the SPI core is about to unmap or
+		 * free.  An engine that failed to stop is left disabled,
+		 * as the abort paths already do.
+		 */
+		if (engines_stopped) {
+			writel(SPI_DMA_ENGINE_EN,
+			       par->dma_offset_bar + SPI_DMA_GLOBAL_WR_ENGINE_EN);
+			writel(SPI_DMA_ENGINE_EN,
+			       par->dma_offset_bar + SPI_DMA_GLOBAL_RD_ENGINE_EN);
+		}
 		goto error;
 	}
 	ret = 0;
 
 error:
 	p->spi_xfer_in_progress = false;
+	p->xfer = NULL;
+	p->tx_sgl = NULL;
+	p->rx_sgl = NULL;
 
 	return ret;
 }
@@ -695,6 +757,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma_rd(int irq, void *dev)
 	unsigned long flags;
 	u32 regval;
 
+	if (!p->spi_xfer_in_progress)
+		return IRQ_NONE;
+
 	/* Clear the DMA RD INT and start spi xfer*/
 	regval = readl(p->parent->dma_offset_bar + SPI_DMA_INTR_RD_STS);
 	if (regval) {
@@ -723,6 +788,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma_wr(int irq, void *dev)
 	unsigned long flags;
 	u32 regval;
 
+	if (!p->spi_xfer_in_progress)
+		return IRQ_NONE;
+
 	/* Clear the DMA WR INT */
 	regval = readl(p->parent->dma_offset_bar + SPI_DMA_INTR_WR_STS);
 	if (regval) {
@@ -755,6 +823,9 @@ static irqreturn_t pci1xxxx_spi_isr_dma(int irq, void *dev)
 	irqreturn_t spi_int_fired = IRQ_NONE;
 	u32 regval;
 
+	if (!p->spi_xfer_in_progress)
+		return IRQ_NONE;
+
 	/* Clear the SPI GO_BIT Interrupt */
 	regval = readl(p->parent->reg_base + SPI_MST_EVENT_REG_OFFSET(p->hw_inst));
 	if (regval & SPI_INTR) {

From b3d771544f7d77bf191c7cc47c1f3f6feec1e05b Mon Sep 17 00:00:00 2001
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date: Fri, 16 Oct 2026 10:00:43 -0400
Subject: [PATCH 0734/1982] resource: report a devm_request_resource() conflict
 under the lock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d2f7bdfdeac8137e942b32e0badc40e181127d7b upstream.

devm_request_resource() calls request_resource_conflict(), which takes
resource_lock, tries to insert the new resource and returns a pointer to
the conflicting resource after dropping the lock.  The error message is
then formatted from that pointer: conflict->name and the %pR argument
read the name, start, end, flags and desc of a resource that nothing
pins any more.  The owner of the conflicting resource may call
release_resource() and free it the moment the lock is dropped.

The conflicting resource normally belongs to another device.  With two
devices whose drivers claim overlapping regions (two PCI host bridges
whose "ranges" windows overlap, two instances of a controller on the
same aperture, or a stale claim an administrator is replacing), the
following interleaving reads freed memory:

  CPU 0: driver B probe                  CPU 1: driver A unbind
  devm_request_resource(devB, root, resB)
    request_resource_conflict()
      write_lock(&resource_lock)
      __request_resource() -> resA
      write_unlock(&resource_lock)
                                         devres_release_all(devA)
                                           devm_resource_release()
                                             release_resource(resA)
                                         put_device() -> kfree(resA)
    dev_err(..., resA->name, resA)        use after free

Both halves are reachable from userspace on any kernel: a write to the
"unbind" file of the driver that holds the region and a write to the
"bind" file of the driver that wants it.  One in-tree path is
drivers/pci/bus.c devm_request_pci_bus_resources(), called from host
bridge probe for every bridge window; the windows are the embedded
struct resource of kzalloc'ed resource_entry objects that
pci_free_resource_list() frees when the other bridge is released.
In the common case the "resource collision" message is garbled; with
the slab object poisoned (CONFIG_SLUB_DEBUG) or reused, formatting
conflict->name oopses, and KASAN reports a slab-use-after-free read in
devm_request_resource().  All of this happens in a probe that is
already failing with -EBUSY.  The window is a few hundred instructions
wide and exists only when two devices actually collide, so the race
has not been observed outside of analysis.

Do the same here: take resource_lock, insert with __request_resource()
and print the diagnostic while the lock still keeps the conflicting
resource in the tree, then drop the lock.  The return values and the
devres handling are unchanged.

The change was built for x86_64 and RISC-V; the resource KUnit tests
pass on both.

Found by formal verification of kernel/resource.c against the kernel
binary.

Link: https://lore.kernel.org/20261016140043.790048-1-nickolai@csail.mit.edu
Fixes: 8d38821cbcf5 ("resources: Add device-managed request/release_resource()")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Assisted-by: LLM
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Cc: Thierry Reding <treding@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/resource.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index 5387c1fdf6956d..fe1327753a135a 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1645,10 +1645,15 @@ int devm_request_resource(struct device *dev, struct resource *root,
 
 	*ptr = new;
 
-	conflict = request_resource_conflict(root, new);
-	if (conflict) {
+	/* Report a conflict while the lock still keeps it in the tree. */
+	write_lock(&resource_lock);
+	conflict = __request_resource(root, new);
+	if (conflict)
 		dev_err(dev, "resource collision: %pR conflicts with %s %pR\n",
 			new, conflict->name, conflict);
+	write_unlock(&resource_lock);
+
+	if (conflict) {
 		devres_free(ptr);
 		return -EBUSY;
 	}

From 2ea5385758a7cc863d9e2f6b642c8e7820437980 Mon Sep 17 00:00:00 2001
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Fri, 18 Sep 2026 14:56:36 +0100
Subject: [PATCH 0735/1982] phy: core: Fix race-condition between _of_phy_get()
 and try_module_get()

commit 090055ee629523092688da42428558ba56d4272f upstream.

Sashiko asked during a patch review if the existing usage pattern had a
race condition; specifically in of_phy_get() if it was possible between
returning from _of_phy_get() and running try_module_get() that a module
might be unbound leading to use-after-free.

Looking at the code this appears to be so, there is no linkage between the
phy and module under a synchronisation primitive.

Using the phy_provider_mutex in phy_get() will ensure there is a link between
the returned phy pointer and the module_get() bumping the module reference
count.

Amend phy_get(), of_phy_get() and devm_of_phy_get_by_index() to fix the
same usage pattern.

phy_provider_unregister() must take the phy_provider_mutex so amending
phy_get()/of_phy_get() to take that same mutex guarantees there is no
use-after-free.

Fixes: ff764963479a1 ("drivers: phy: add generic PHY framework")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Tested-by: Oleg Keri <okerixx@gmail.com> # Lenovo Yoga Slim 7x Gen 11 (Glymur)
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://patch.msgid.link/20260918-b4-linux-next-25-03-13-dtsi-x1e80100-camss-v20-1-dc244e124e71@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/phy/phy-core.c | 45 ++++++++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 04a5a34e7a950a..fb3a6f93f0fa84 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -124,13 +124,13 @@ static struct phy *phy_find(struct device *dev, const char *con_id)
 	const char *dev_id = dev_name(dev);
 	struct phy_lookup *p, *pl = NULL;
 
-	mutex_lock(&phy_provider_mutex);
+	lockdep_assert_held(&phy_provider_mutex);
+
 	list_for_each_entry(p, &phys, node)
 		if (!strcmp(p->dev_id, dev_id) && !strcmp(p->con_id, con_id)) {
 			pl = p;
 			break;
 		}
-	mutex_unlock(&phy_provider_mutex);
 
 	return pl ? pl->phy : ERR_PTR(-ENODEV);
 }
@@ -602,6 +602,8 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
 	struct phy *phy = NULL;
 	struct of_phandle_args args;
 
+	lockdep_assert_held(&phy_provider_mutex);
+
 	ret = of_parse_phandle_with_args(np, "phys", "#phy-cells",
 		index, &args);
 	if (ret)
@@ -613,11 +615,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
 		goto out_put_node;
 	}
 
-	mutex_lock(&phy_provider_mutex);
 	phy_provider = of_phy_provider_lookup(args.np);
 	if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
 		phy = ERR_PTR(-EPROBE_DEFER);
-		goto out_unlock;
+		goto out_put_node;
 	}
 
 	if (!of_device_is_available(args.np)) {
@@ -631,8 +632,6 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
 out_put_module:
 	module_put(phy_provider->owner);
 
-out_unlock:
-	mutex_unlock(&phy_provider_mutex);
 out_put_node:
 	of_node_put(args.np);
 
@@ -656,15 +655,21 @@ struct phy *of_phy_get(struct device_node *np, const char *con_id)
 	if (con_id)
 		index = of_property_match_string(np, "phy-names", con_id);
 
+	mutex_lock(&phy_provider_mutex);
+
 	phy = _of_phy_get(np, index);
 	if (IS_ERR(phy))
-		return phy;
+		goto out_unlock;
 
-	if (!try_module_get(phy->ops->owner))
-		return ERR_PTR(-EPROBE_DEFER);
+	if (!try_module_get(phy->ops->owner)) {
+		phy = ERR_PTR(-EPROBE_DEFER);
+		goto out_unlock;
+	}
 
 	get_device(&phy->dev);
 
+out_unlock:
+	mutex_unlock(&phy_provider_mutex);
 	return phy;
 }
 EXPORT_SYMBOL_GPL(of_phy_get);
@@ -764,6 +769,7 @@ struct phy *phy_get(struct device *dev, const char *string)
 	struct phy *phy;
 	struct device_link *link;
 
+	mutex_lock(&phy_provider_mutex);
 	if (dev->of_node) {
 		if (string)
 			index = of_property_match_string(dev->of_node, "phy-names",
@@ -774,15 +780,18 @@ struct phy *phy_get(struct device *dev, const char *string)
 	} else {
 		if (string == NULL) {
 			dev_WARN(dev, "missing string\n");
-			return ERR_PTR(-EINVAL);
+			phy = ERR_PTR(-EINVAL);
+			goto out_unlock;
 		}
 		phy = phy_find(dev, string);
 	}
 	if (IS_ERR(phy))
-		return phy;
+		goto out_unlock;
 
-	if (!try_module_get(phy->ops->owner))
-		return ERR_PTR(-EPROBE_DEFER);
+	if (!try_module_get(phy->ops->owner)) {
+		phy = ERR_PTR(-EPROBE_DEFER);
+		goto out_unlock;
+	}
 
 	get_device(&phy->dev);
 
@@ -791,6 +800,8 @@ struct phy *phy_get(struct device *dev, const char *string)
 		dev_dbg(dev, "failed to create device link to %s\n",
 			dev_name(phy->dev.parent));
 
+out_unlock:
+	mutex_unlock(&phy_provider_mutex);
 	return phy;
 }
 EXPORT_SYMBOL_GPL(phy_get);
@@ -939,15 +950,17 @@ struct phy *devm_of_phy_get_by_index(struct device *dev, struct device_node *np,
 	if (!ptr)
 		return ERR_PTR(-ENOMEM);
 
+	mutex_lock(&phy_provider_mutex);
 	phy = _of_phy_get(np, index);
 	if (IS_ERR(phy)) {
 		devres_free(ptr);
-		return phy;
+		goto out_unlock;
 	}
 
 	if (!try_module_get(phy->ops->owner)) {
 		devres_free(ptr);
-		return ERR_PTR(-EPROBE_DEFER);
+		phy = ERR_PTR(-EPROBE_DEFER);
+		goto out_unlock;
 	}
 
 	get_device(&phy->dev);
@@ -960,6 +973,8 @@ struct phy *devm_of_phy_get_by_index(struct device *dev, struct device_node *np,
 		dev_dbg(dev, "failed to create device link to %s\n",
 			dev_name(phy->dev.parent));
 
+out_unlock:
+	mutex_unlock(&phy_provider_mutex);
 	return phy;
 }
 EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);

From fce1dd31b185ceadb9669162a5a35444b1059960 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sun, 4 Oct 2026 00:10:19 -0400
Subject: [PATCH 0736/1982] power: supply: sbs-battery: disable polling before
 supply teardown

commit 5c1c602463d597c5189ddc5a73dece588ba2c57a upstream.

The managed poll-work cancellation is registered before the power
supply, so cleanup unregisters the supply before draining polling.
A pending or running poller can then call power_supply_changed() on
the released supply.

Commit 8d59cf3887fb ("power: supply: sbs-battery: Fix use-after-free in
power_supply_changed()") moved the IRQ request after supply registration,
but did not change the poll-work cancellation order.

Add a later managed action that disables and drains polling before
supply teardown. Its retained disabled state prevents external-power
callbacks from rearming the poll work after it has been drained.
Keep the original autocancel to initialize work before supply callbacks
can run and to cover failed supply registration.

The teardown ordering issue was found by static analysis.

Fixes: 6d0c5de2fd84 ("power: supply: Clean-up few drivers by using managed work init")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261004041019.1123723-1-mhun512@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/power/supply/sbs-battery.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 3947429f6f8191..b190a4a8995297 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -1060,6 +1060,13 @@ static void sbs_alert(struct i2c_client *client, enum i2c_alert_protocol prot,
 	sbs_supply_changed(i2c_get_clientdata(client));
 }
 
+static void sbs_disable_work(void *data)
+{
+	struct sbs_info *chip = data;
+
+	disable_delayed_work_sync(&chip->work);
+}
+
 static void sbs_external_power_changed(struct power_supply *psy)
 {
 	struct sbs_info *chip = power_supply_get_drvdata(psy);
@@ -1200,6 +1207,10 @@ static int sbs_probe(struct i2c_client *client)
 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
 				     "Failed to register power supply\n");
 
+	rc = devm_add_action_or_reset(&client->dev, sbs_disable_work, chip);
+	if (rc)
+		return rc;
+
 	if (!chip->gpio_detect)
 		goto out;
 

From 006ad1a97ab79f0173e44d82f75340243b54024b Mon Sep 17 00:00:00 2001
From: Janne Grunau <j@jannau.net>
Date: Fri, 2 Oct 2026 11:13:29 +0100
Subject: [PATCH 0737/1982] nvmem: core: Fix OOB read for bit offsets of more
 than one byte

commit 24530401e8001aaa637dd5007fcdc6fbc00300be upstream.

When the bit offset is BITS_PER_BYTE or larger the read position is
advanced by `bytes_offset`. This is not taken into account in the
per-byte read loop which still reads `cell->bytes` resulting in an out of
bounds read of `bytes_offset` bytes. The information read OOB does not
leak directly as the erroneously read bits are cleared.

Detected by KASAN while looking for a use-after-free in simplefb.c.

Cc: stable@vger.kernel.org
Fixes: 7a06ef751077 ("nvmem: core: fix bit offsets of more than one byte")
Tested-by: Dmitry Sinyavin <sinyavin@gmail.com>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101329.1084348-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index b61028ae0651bd..4b1754d89b7a44 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1597,12 +1597,14 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell_entry *cell, void
 		*p = *b++ >> bit_offset;
 
 		/* setup rest of the bytes if any */
-		for (i = 1; i < cell->bytes; i++) {
+		for (i = 1; i < (cell->bytes - bytes_offset); i++) {
 			/* Get bits from next byte and shift them towards msb */
 			*p++ |= *b << (BITS_PER_BYTE - bit_offset);
 
 			*p = *b++ >> bit_offset;
 		}
+		/* point to end of the buffer unused bits will be cleared */
+		p = buf + cell->bytes - 1;
 	} else if (p != b) {
 		memmove(p, b, cell->bytes - bytes_offset);
 		p += cell->bytes - 1;

From 144ce635f8cc02955a9bfc7caf14b1818d957a63 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 12 Aug 2026 13:00:23 +0100
Subject: [PATCH 0738/1982] media: rc: Ensure that rc_unregister_device() does
 not free input device

commit 61c7ca95d2483c77dfdde1b007cbe846f145dec4 upstream.

During or after rc_unregister_device(), IR may still be reported which
results in a input event being reported. This could result in a null
pointer deref in rc_keydown() or a use-after-free of the input device if
the pointer was read before it is set to NULL.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-main.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 6bdf32cb4a17d8..e0a260c5017ce6 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1742,7 +1742,7 @@ void rc_free_device(struct rc_dev *dev)
 	if (!dev)
 		return;
 
-	input_free_device(dev->input_dev);
+	input_put_device(dev->input_dev);
 
 	put_device(&dev->dev);
 
@@ -1854,6 +1854,8 @@ static int rc_setup_rx_device(struct rc_dev *dev)
 	if (rc)
 		return rc;
 
+	input_get_device(dev->input_dev);
+
 	/*
 	 * Default delay of 250ms is too short for some protocols, especially
 	 * since the timeout is currently set to 250ms. Increase it to 500ms,
@@ -1880,10 +1882,8 @@ static void rc_free_rx_device(struct rc_dev *dev)
 	if (!dev)
 		return;
 
-	if (dev->input_dev) {
+	if (dev->input_dev)
 		input_unregister_device(dev->input_dev);
-		dev->input_dev = NULL;
-	}
 
 	ir_free_table(&dev->rc_map);
 }

From 63644a8b70dab7e67a8a6f563b7df9647324a41f Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Fri, 7 Aug 2026 11:50:22 +0100
Subject: [PATCH 0739/1982] media: rc: Ensure registered is cleared in error
 path

commit 37efd09ba2c62e46e3a3a793025c186f8cd1a417 upstream.

If rc_register_device() fails, ensure that registered is not set to true.
If lirc_register() succeeded, then userspace could have an open file
descriptor open. This leads to a use-after-free.

lirc_unregister() must be called with registered = false, else there is a
possibility that an fd is open and polling, which would never return
POLLERR unless registered is false.

Note that registered must be changed under dev->lock, many functions
read registered under lock (e.g. lirc_ioctl).

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-main.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index e0a260c5017ce6..06218779a91887 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1929,7 +1929,8 @@ int rc_register_device(struct rc_dev *dev)
 			goto out_raw;
 	}
 
-	dev->registered = true;
+	scoped_guard(mutex, &dev->lock)
+		dev->registered = true;
 
 	rc = device_add(&dev->dev);
 	if (rc)
@@ -1949,7 +1950,7 @@ int rc_register_device(struct rc_dev *dev)
 	if (dev->allowed_protocols != RC_PROTO_BIT_CEC) {
 		rc = lirc_register(dev);
 		if (rc < 0)
-			goto out_dev;
+			goto out_lirc;
 	}
 
 	if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
@@ -1972,11 +1973,18 @@ int rc_register_device(struct rc_dev *dev)
 out_rx:
 	rc_free_rx_device(dev);
 out_lirc:
-	if (dev->allowed_protocols != RC_PROTO_BIT_CEC)
+	scoped_guard(mutex, &dev->lock)
+		dev->registered = false;
+
+	if (device_is_registered(&dev->lirc_dev))
 		lirc_unregister(dev);
-out_dev:
 	device_del(&dev->dev);
+	/* registered already cleared above */
+	goto out_free_table;
 out_rx_free:
+	scoped_guard(mutex, &dev->lock)
+		dev->registered = false;
+out_free_table:
 	ir_free_table(&dev->rc_map);
 out_raw:
 	ir_raw_event_free(dev);

From d5e446e0a0541bf76e6e157a310f370699731cfd Mon Sep 17 00:00:00 2001
From: Weigang He <geoffreyhe2@gmail.com>
Date: Sat, 26 Sep 2026 15:49:29 +1000
Subject: [PATCH 0740/1982] media: rc: fintek-cir: process a full RX buffer
 instead of overflowing it

commit d1febef1bcfa7bbc401729f994c375b91a833911 upstream.

fintek_get_rx_ir_data() drains the CIR RX FIFO into fintek->buf[], which
holds RX_BUF_LEN (32) bytes, for as long as CIR_STATUS reports pending
RX data:

	do {
		sample = fintek_cir_reg_read(fintek, CIR_RX_DATA);
		...
		fintek->buf[fintek->pkts] = sample;
		fintek->pkts++;
		...
	} while (status & rx_irqs);

Nothing bounds fintek->pkts. If the hardware reports data for more than
RX_BUF_LEN reads in one interrupt, the loop writes past the end of
buf[], starting with the pkts counter that follows it in struct
fintek_dev.

Hand a full buffer to fintek_process_rx_ir_data(), which parses the
samples and resets fintek->pkts, before storing the next sample. This
keeps the parser state consistent and drops no samples. The loop still
relies on the status register to terminate.

The driver does not document the hardware FIFO depth, so it is not
known whether a working device can trigger this.

Found by static analysis tool CodeQL.

Fixes: 9bdc79ea07d9 ("[media] fintek-cir: new driver for Fintek LPC SuperIO CIR function")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/fintek-cir.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
index 9b789097cdd4c3..e9491d6cf855b7 100644
--- a/drivers/media/rc/fintek-cir.c
+++ b/drivers/media/rc/fintek-cir.c
@@ -340,6 +340,10 @@ static void fintek_get_rx_ir_data(struct fintek_dev *fintek, u8 rx_irqs)
 		sample = fintek_cir_reg_read(fintek, CIR_RX_DATA);
 		fit_dbg("%s: sample: 0x%02x", __func__, sample);
 
+		/* Process a full buffer before storing the next sample. */
+		if (fintek->pkts >= RX_BUF_LEN)
+			fintek_process_rx_ir_data(fintek);
+
 		fintek->buf[fintek->pkts] = sample;
 		fintek->pkts++;
 

From 87a2d2c15f1f7bc7ee210bf331d6668d511c0533 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 1 Sep 2026 10:34:51 +0100
Subject: [PATCH 0741/1982] media: rc: Fix race between bpf(BPG_PROG_ATTACH)
 and device unregister

commit b3f5daf3222999d3f92f606a4eb5e35ab90fd0e4 upstream.

Mark the device as unregistered before tearing down raw IR/bpf
state, so that racing bpf(BPF_PROG_{ATTACH,DETACH,QUERY}) calls
cannot slip in between ir_raw_event_unregister() completing and
dev->registered being cleared.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-main.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 06218779a91887..542fdbb1118b55 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -2026,18 +2026,18 @@ void rc_unregister_device(struct rc_dev *dev)
 	if (!dev)
 		return;
 
+	mutex_lock(&dev->lock);
+	dev->registered = false;
+	if (dev->users && dev->close)
+		dev->close(dev);
+	mutex_unlock(&dev->lock);
+
 	if (dev->driver_type == RC_DRIVER_IR_RAW)
 		ir_raw_event_unregister(dev);
 
 	timer_delete_sync(&dev->timer_keyup);
 	timer_delete_sync(&dev->timer_repeat);
 
-	mutex_lock(&dev->lock);
-	if (dev->users && dev->close)
-		dev->close(dev);
-	dev->registered = false;
-	mutex_unlock(&dev->lock);
-
 	rc_free_rx_device(dev);
 
 	/*

From 0e18282783cc426207127c1214b40967a18ef939 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 1 Sep 2026 11:02:22 +0100
Subject: [PATCH 0742/1982] media: rc: mce_kbd: Fix inconsistent locking of
 keylock

commit 29ee25fa9beb3232808e6d0b3e8ebfb0427cb820 upstream.

data->keylock is taken with spin_lock() in ir_mce_kbd_decode(), which
runs in the raw IR decode kthread with local interrupts enabled, but
with spin_lock_irqsave() in mce_kbd_rx_timeout(), the rx_timeout timer
callback, which runs in softirq context.

If the decode kthread is holding keylock via spin_lock() when a timer
interrupt fires on the same CPU and the softirq runs
mce_kbd_rx_timeout(), the softirq spins forever waiting for a lock
that only the now-preempted kthread can release, while the kthread
cannot run again until the softirq gives up the CPU. This deadlocks
the CPU.

Fixes: 53a62800efb2 ("media: rc: mce_kbd decoder: fix race condition")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/ir-mce_kbd-decoder.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/ir-mce_kbd-decoder.c b/drivers/media/rc/ir-mce_kbd-decoder.c
index bb2d7c37c26369..d1c9263511b092 100644
--- a/drivers/media/rc/ir-mce_kbd-decoder.c
+++ b/drivers/media/rc/ir-mce_kbd-decoder.c
@@ -219,6 +219,7 @@ static int ir_mce_kbd_decode(struct rc_dev *dev, struct ir_raw_event ev)
 	struct mce_kbd_dec *data = &dev->raw->mce_kbd;
 	u32 scancode;
 	unsigned long delay;
+	unsigned long flags;
 	struct lirc_scancode lsc = {};
 
 	if (!is_timing_event(ev)) {
@@ -319,7 +320,7 @@ static int ir_mce_kbd_decode(struct rc_dev *dev, struct ir_raw_event ev)
 			scancode = data->body & 0xffffff;
 			dev_dbg(&dev->dev, "keyboard data 0x%08x\n",
 				data->body);
-			spin_lock(&data->keylock);
+			spin_lock_irqsave(&data->keylock, flags);
 			if (scancode) {
 				delay = usecs_to_jiffies(dev->timeout) +
 					msecs_to_jiffies(100);
@@ -329,7 +330,7 @@ static int ir_mce_kbd_decode(struct rc_dev *dev, struct ir_raw_event ev)
 			}
 			/* Pass data to keyboard buffer parser */
 			ir_mce_kbd_process_keyboard_data(dev, scancode);
-			spin_unlock(&data->keylock);
+			spin_unlock_irqrestore(&data->keylock, flags);
 			lsc.rc_proto = RC_PROTO_MCIR2_KBD;
 			break;
 		case MCIR2_MOUSE_NBITS:

From 6d1be288650bb590aa3894bb060f8a5497c27bab Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 13 Jul 2026 11:18:39 +0100
Subject: [PATCH 0743/1982] media: rc: Use after free in ir_raw_event_handle()

commit 3ae19773168104fa57d2a2ec57731e89df54175f upstream.

If rc_unregister_device() is called while IR is being processed, then
ir_raw_event_handle() could call wake_up_process(dev->raw->thread)
after kthread_stop(dev->raw->thread). Avoid use after free by using
get_task_struct().

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-ir-raw.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 76c3d1307f9f1b..e5a681aaefecf8 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -648,8 +648,13 @@ int ir_raw_event_register(struct rc_dev *dev)
 
 void ir_raw_event_free(struct rc_dev *dev)
 {
-	kfree(dev->raw);
-	dev->raw = NULL;
+	if (dev->raw) {
+		timer_delete_sync(&dev->raw->edge_handle);
+		if (dev->raw->thread)
+			put_task_struct(dev->raw->thread);
+		kfree(dev->raw);
+		dev->raw = NULL;
+	}
 }
 
 void ir_raw_event_unregister(struct rc_dev *dev)
@@ -659,6 +664,13 @@ void ir_raw_event_unregister(struct rc_dev *dev)
 	if (!dev || !dev->raw)
 		return;
 
+	/*
+	 * After ir_raw_event_unregister() is called, an sync
+	 * call to ir_raw_event_handle() can still arrive. This function
+	 * may call wake_up_process(dev->raw->thread). Ensure this memory
+	 * is not freed by kthread_stop().
+	 */
+	get_task_struct(dev->raw->thread);
 	kthread_stop(dev->raw->thread);
 	timer_delete_sync(&dev->raw->edge_handle);
 

From e6ed118d14267f6bb03b9ad9ac60fdb8bd52f902 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Fri, 4 Sep 2026 14:07:44 +0100
Subject: [PATCH 0744/1982] media: rc: After rc_unregister_device() timers can
 be re-armed

commit ef41a67979aed4d7d4f393c56c1e25b6754e2b78 upstream.

If rc_keydown() is called after rc_register_device(), then the timers
can be re-armed. Delete them again for a final time.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 542fdbb1118b55..cb1a087ed869d1 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1742,6 +1742,11 @@ void rc_free_device(struct rc_dev *dev)
 	if (!dev)
 		return;
 
+	if (dev->input_dev) {
+		timer_delete_sync(&dev->timer_keyup);
+		timer_delete_sync(&dev->timer_repeat);
+	}
+
 	input_put_device(dev->input_dev);
 
 	put_device(&dev->dev);

From 4528f92222e7b90b2ea634338657888f63887d7a Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 18:47:51 +0100
Subject: [PATCH 0745/1982] media: rc: Fix use after free in bpf progs

commit f95a9f8472f97c30106513fc7494b7abad243949 upstream.

Since commit dccc0c3ddf8f ("media: rc: fix race between unregister and
urb/irq callbacks"), rcdev->raw is no longer set to NULL after device
unregister. raw->progs could point to stale data.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/bpf-lirc.c  | 18 +++++++++++++-----
 drivers/media/rc/rc-ir-raw.c | 11 +++--------
 2 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index 2f7564f26445ce..14ab611e744577 100644
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -148,12 +148,13 @@ static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)
 	if (ret)
 		return ret;
 
-	raw = rcdev->raw;
-	if (!raw) {
+	if (!rcdev->registered) {
 		ret = -ENODEV;
 		goto unlock;
 	}
 
+	raw = rcdev->raw;
+
 	old_array = lirc_rcu_dereference(raw->progs);
 	if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {
 		ret = -E2BIG;
@@ -186,12 +187,13 @@ static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
 	if (ret)
 		return ret;
 
-	raw = rcdev->raw;
-	if (!raw) {
+	if (!rcdev->registered) {
 		ret = -ENODEV;
 		goto unlock;
 	}
 
+	raw = rcdev->raw;
+
 	old_array = lirc_rcu_dereference(raw->progs);
 	ret = bpf_prog_array_copy(old_array, prog, NULL, 0, &new_array);
 	/*
@@ -235,7 +237,8 @@ void lirc_bpf_free(struct rc_dev *rcdev)
 	struct bpf_prog_array_item *item;
 	struct bpf_prog_array *array;
 
-	array = lirc_rcu_dereference(rcdev->raw->progs);
+	array = rcu_replace_pointer(rcdev->raw->progs, NULL,
+				    lockdep_is_held(&ir_raw_handler_lock));
 	if (!array)
 		return;
 
@@ -316,6 +319,11 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
 	if (ret)
 		goto put;
 
+	if (!rcdev->registered) {
+		ret = -ENODEV;
+		goto unlock;
+	}
+
 	progs = lirc_rcu_dereference(rcdev->raw->progs);
 	cnt = progs ? bpf_prog_array_length(progs) : 0;
 
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index e5a681aaefecf8..a770418b59c504 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -650,8 +650,11 @@ void ir_raw_event_free(struct rc_dev *dev)
 {
 	if (dev->raw) {
 		timer_delete_sync(&dev->raw->edge_handle);
+		mutex_lock(&ir_raw_handler_lock);
 		if (dev->raw->thread)
 			put_task_struct(dev->raw->thread);
+		lirc_bpf_free(dev);
+		mutex_unlock(&ir_raw_handler_lock);
 		kfree(dev->raw);
 		dev->raw = NULL;
 	}
@@ -661,9 +664,6 @@ void ir_raw_event_unregister(struct rc_dev *dev)
 {
 	struct ir_raw_handler *handler;
 
-	if (!dev || !dev->raw)
-		return;
-
 	/*
 	 * After ir_raw_event_unregister() is called, an sync
 	 * call to ir_raw_event_handle() can still arrive. This function
@@ -683,11 +683,6 @@ void ir_raw_event_unregister(struct rc_dev *dev)
 
 	lirc_bpf_free(dev);
 
-	/*
-	 * A user can be calling bpf(BPF_PROG_{QUERY|ATTACH|DETACH}), so
-	 * ensure that the raw member is null on unlock; this is how
-	 * "device gone" is checked.
-	 */
 	mutex_unlock(&ir_raw_handler_lock);
 }
 

From f185fc81aee9ecf6011addacb077380958df5299 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 12 Aug 2026 15:46:42 +0100
Subject: [PATCH 0746/1982] media: rc: Fix ABBA deadlock by making locks more
 fine grained

commit c6d68866ad8aa1e957a3e5a6ede971148f1e3d59 upstream.

The ir_raw_event_unregister() function takes the ir_raw_handler_lock
first and then the rc_dev->lock. Other functions like change_protocol
do this in the reverse order.

This means that an ir decoder module unload and writing to the protocol
sysfs file can cause a deadlock.

ir_raw_handler_lock protects the client list, amongst other things.
Split this out into a separate lock so we can ensure the locking
order is always the same.

Fixes: 93cffffc18f6 ("[media] media: rc: fix decoder module unloading")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-ir-raw.c | 39 ++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index a770418b59c504..6da12803fd9e03 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -10,7 +10,8 @@
 #include <linux/sched.h>
 #include "rc-core-priv.h"
 
-/* Used to keep track of IR raw clients, protected by ir_raw_handler_lock */
+/* Used to keep track of IR raw clients, protected by ir_raw_client_lock */
+static DEFINE_MUTEX(ir_raw_client_lock);
 static LIST_HEAD(ir_raw_client_list);
 
 /* Used to handle IR raw handler extensions */
@@ -288,13 +289,6 @@ static int change_protocol(struct rc_dev *dev, u64 *rc_proto)
 	return 0;
 }
 
-static void ir_raw_disable_protocols(struct rc_dev *dev, u64 protocols)
-{
-	mutex_lock(&dev->lock);
-	dev->enabled_protocols &= ~protocols;
-	mutex_unlock(&dev->lock);
-}
-
 /**
  * ir_raw_gen_manchester() - Encode data with Manchester (bi-phase) modulation.
  * @ev:		Pointer to pointer to next free event. *@ev is incremented for
@@ -633,15 +627,18 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
 	struct task_struct *thread;
 
+	/* Holding dev->lock could result in a dead-lock */
+	lockdep_assert_not_held(&dev->lock);
+
 	thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u", dev->minor);
 	if (IS_ERR(thread))
 		return PTR_ERR(thread);
 
 	dev->raw->thread = thread;
 
-	mutex_lock(&ir_raw_handler_lock);
+	mutex_lock(&ir_raw_client_lock);
 	list_add_tail(&dev->raw->list, &ir_raw_client_list);
-	mutex_unlock(&ir_raw_handler_lock);
+	mutex_unlock(&ir_raw_client_lock);
 
 	return 0;
 }
@@ -674,16 +671,19 @@ void ir_raw_event_unregister(struct rc_dev *dev)
 	kthread_stop(dev->raw->thread);
 	timer_delete_sync(&dev->raw->edge_handle);
 
-	mutex_lock(&ir_raw_handler_lock);
+	mutex_lock(&ir_raw_client_lock);
 	list_del(&dev->raw->list);
+
+	mutex_lock(&ir_raw_handler_lock);
 	list_for_each_entry(handler, &ir_raw_handler_list, list)
 		if (handler->raw_unregister &&
 		    (handler->protocols & dev->enabled_protocols))
 			handler->raw_unregister(dev);
 
 	lirc_bpf_free(dev);
-
 	mutex_unlock(&ir_raw_handler_lock);
+
+	mutex_unlock(&ir_raw_client_lock);
 }
 
 /*
@@ -706,15 +706,24 @@ void ir_raw_handler_unregister(struct ir_raw_handler *ir_raw_handler)
 	struct ir_raw_event_ctrl *raw;
 	u64 protocols = ir_raw_handler->protocols;
 
+	mutex_lock(&ir_raw_client_lock);
+
 	mutex_lock(&ir_raw_handler_lock);
 	list_del(&ir_raw_handler->list);
+	atomic64_andnot(protocols, &available_protocols);
+	mutex_unlock(&ir_raw_handler_lock);
+
 	list_for_each_entry(raw, &ir_raw_client_list, list) {
+		mutex_lock(&raw->dev->lock);
+		mutex_lock(&ir_raw_handler_lock);
 		if (ir_raw_handler->raw_unregister &&
 		    (raw->dev->enabled_protocols & protocols))
 			ir_raw_handler->raw_unregister(raw->dev);
-		ir_raw_disable_protocols(raw->dev, protocols);
+		raw->dev->enabled_protocols &= ~protocols;
+		mutex_unlock(&ir_raw_handler_lock);
+		mutex_unlock(&raw->dev->lock);
 	}
-	atomic64_andnot(protocols, &available_protocols);
-	mutex_unlock(&ir_raw_handler_lock);
+
+	mutex_unlock(&ir_raw_client_lock);
 }
 EXPORT_SYMBOL(ir_raw_handler_unregister);

From 3e05df6bd33a920687c90061a6c0cc67cf71464a Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Fri, 9 Oct 2026 13:21:42 +0800
Subject: [PATCH 0747/1982] ocfs2/heartbeat: unlink live slots when their node
 is missing

commit 3ccd24c3f7a577b84a532cb027f1378385b82ef6 upstream.

o2hb_shutdown_slot() returns immediately when its node is no longer in the
configfs registry.  A slot can still be linked in o2hb_live_slots when
that lookup fails.  Region teardown or startup-error cleanup then frees
the slot array without removing its embedded list member.

With the same peer live in another region, the next list update can follow
a predecessor into the freed array.  Reusing the node number can also make
a later insertion encounter that stale member.

Always remove the slot under o2hb_live_lock, even when node lookup fails.
Preserve aggregate membership accounting and the last-region DOWN
callback: the existing callback interface explicitly permits a NULL node
for DOWN events.  Only drop the node reference when lookup returned one.
This closes both normal release and startup-abort paths without changing
the publication or callback locking protocol.

Also require a configured node before admitting a new live slot in
o2hb_check_slot().  The early live-bitmap check is not held through
admission: the last live slot in another region can be removed in between.
Without a node, admission can then queue an UP event with a NULL argument
and hit the event helper's BUG_ON.  Existing live slots can still leave
and generate NULL-node DOWN events.

A controlled probe-instrumented test reproduced this while stopping one of
two regions after removing the peer from configfs.  Its KASAN report
includes:

  BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x1e0/0x210
  Read of size 8 at addr ffff888106a4ac60 by task o2hb-pmbd0058_b/497
  Call Trace:
   <TASK>
   dump_stack_lvl+0x93/0xd0
   print_report+0xce/0x630
   kasan_report+0xe0/0x110
   __list_del_entry_valid_or_report+0x1e0/0x210
   o2hb_do_disk_heartbeat+0x1591/0x2c50
   o2hb_thread+0x1ed/0xe70
   kthread+0x351/0x460
   ret_from_fork+0x659/0x940
   ret_from_fork_asm+0x1a/0x30
   </TASK>
  Allocated by task 491:
   kasan_save_stack+0x33/0x60
   kasan_save_track+0x14/0x30
   __kasan_kmalloc+0xaa/0xb0
   __kmalloc_noprof+0x2de/0x780
   o2hb_region_dev_store+0x7c2/0x1b60
   configfs_write_iter+0x2f9/0x4f0
   vfs_write+0x639/0x1010
   ksys_write+0x111/0x200
   do_syscall_64+0x114/0x620
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  Freed by task 491:
   kasan_save_stack+0x33/0x60
   kasan_save_track+0x14/0x30
   kasan_save_free_info+0x3b/0x60
   __kasan_slab_free+0x5f/0x80
   kfree+0x308/0x580
   o2hb_unmap_slot_data+0x1db/0x330
   o2hb_region_release+0x14b/0x4f0
   config_item_cleanup+0x14b/0x230
   config_item_put+0x79/0x90
   configfs_rmdir+0x58a/0x910
   vfs_rmdir+0x2e8/0x820
   filename_rmdir+0x3b1/0x520
   __x64_sys_rmdir+0x4b/0x70
   do_syscall_64+0x114/0x620
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0058-v2-9446113c2b16c817c538@gmail.com
Fixes: a7f6a5fb4bde ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/cluster/heartbeat.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 46ac972e8dbb4c..61e5eb0090d392 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -868,8 +868,11 @@ static void o2hb_shutdown_slot(struct o2hb_disk_slot *slot)
 	int queued = 0;
 
 	node = o2nm_get_node_by_num(slot->ds_node_num);
-	if (!node)
-		return;
+	/*
+	 * The node may have been removed from the node table while this
+	 * region's slot is still linked.  The list member must still be
+	 * removed before the region releases its slot array.
+	 */
 
 	spin_lock(&o2hb_live_lock);
 	if (!list_empty(&slot->ds_live_item)) {
@@ -891,7 +894,8 @@ static void o2hb_shutdown_slot(struct o2hb_disk_slot *slot)
 	if (queued)
 		o2hb_run_event_list(&event);
 
-	o2nm_node_put(node);
+	if (node)
+		o2nm_node_put(node);
 }
 
 static void o2hb_set_quorum_device(struct o2hb_region *reg)
@@ -1026,7 +1030,7 @@ static int o2hb_check_slot(struct o2hb_region *reg,
 fire_callbacks:
 	/* dead nodes only come to life after some number of
 	 * changes at any time during their dead time */
-	if (list_empty(&slot->ds_live_item) &&
+	if (node && list_empty(&slot->ds_live_item) &&
 	    slot->ds_changed_samples >= O2HB_LIVE_THRESHOLD) {
 		mlog(ML_HEARTBEAT, "Node %d (id 0x%llx) joined my region\n",
 		     slot->ds_node_num, (long long)slot->ds_last_generation);

From f4ae0b96a4abc7d59088eb2e0a2ee524c15f3bf0 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Tue, 13 Oct 2026 23:39:29 +0800
Subject: [PATCH 0748/1982] ocfs2/dlm: hold a lock reference across grant AST
 enqueue

commit 71743471204e21113295c786e5cfa570294234a4 upstream.

A newly granted remote lock must remain alive until its grant AST is
queued.  dlmlock_master() publishes the lock on res->granted with its base
and queue references, then drops res->spinlock before calling
dlm_queue_ast().  The resource's reserved AST count does not retain the
lock itself.

This can fail when a peer dies with an immediately grantable CREATE
buffered on its socket.  O2NET's node-down callback flushes receive work
before DLM cleanup, but the flush only waits for work queued on entry.  A
data-ready callback that already selected the socket container can queue
new receive work after the flush advances its work color.  Socket shutdown
does not discard bytes already queued for TCP receive.

The late receive work and DLM node-down cleanup can interleave as
follows (the lock reference operations shown are before this fix):

  Socket data-ready        Node-down thread         Receive worker
  -----------------        ----------------         --------------
  o2net_data_ready()
    select sc under
    callback read lock
                           o2net_disconnect_node()
                             queue shutdown
                             begin flush; new color
    queue sc_rx_work
    in the new color
    release callback lock
                             shutdown socket
                             flush returns
                                                    read buffered CREATE
                                                    dlmlock_master()
                                                      lock res->spinlock
                                                      add lock to granted
                                                      unlock res->spinlock
                           DLM node-down cleanup
                             lock res->spinlock
                             dlm_free_dead_locks()
                               unlink lock
                               put queue/base refs
                               free lock
                             unlock res->spinlock
                                                    dlm_queue_ast()
                                                      __dlm_queue_ast()
                                                      read lock->lockres
                                                      (use-after-free)

DLM cleanup holds res->spinlock while dlm_free_dead_locks() drops the
queue and base references.  The CREATE handler no longer holds that
spinlock when __dlm_queue_ast() reads the lock, before taking its AST list
reference.

Take a temporary lock reference under res->spinlock when a grant AST will
be queued, and drop it after dlm_queue_ast().  This keeps the lock alive
across cleanup until the AST path has taken its own reference, without
reversing the existing AST/resource lock order.

KASAN report as below:

    BUG: KASAN: slab-use-after-free in __dlm_queue_ast+0x8a4/0xc00
    Read of size 8 at addr ffff88810ead5940 by task kworker/u16:3/52

    CPU: 3 UID: 0 PID: 52 Comm: kworker/u16:3 Not tainted 7.3.0-rc4-next-20260921-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Workqueue: o2net o2net_rx_until_empty
    Call Trace:
     <TASK>
     dump_stack_lvl+0x93/0xd0
     print_report+0xce/0x630
     ? __dlm_queue_ast+0x8a4/0xc00
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __virt_addr_valid+0x20e/0x420
     ? __dlm_queue_ast+0x8a4/0xc00
     kasan_report+0xe0/0x110
     ? __dlm_queue_ast+0x8a4/0xc00
     __dlm_queue_ast+0x8a4/0xc00
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? do_raw_spin_lock+0x130/0x270
     ? __pfx___dlm_queue_ast+0x10/0x10
     ? __pfx_do_raw_spin_lock+0x10/0x10
     ? _raw_spin_unlock_irqrestore+0x45/0x60
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lockdep_hardirqs_on_prepare+0xeb/0x1a0
     dlm_queue_ast+0x46/0x70
     dlmlock_master+0x51f/0xf50
     ? __pfx_dlmlock_master+0x10/0x10
     ? dlm_create_lock_handler+0x2b2/0x870
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     dlm_create_lock_handler+0x35b/0x870
     ? __pfx_dlm_create_lock_handler+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on+0x18/0x160
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? kvm_clock_get_cycles+0x31/0x60
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_dlm_create_lock_handler+0x10/0x10
     o2net_rx_until_empty+0x1dae/0x32c0
     ? reacquire_held_locks+0xdd/0x200
     ? __pfx_o2net_rx_until_empty+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? process_one_work+0x935/0x1b40
     ? process_one_work+0x834/0x1b40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     ? srso_alias_return_thunk+0x5/0xfbef5
     process_one_work+0x9a8/0x1b40
     ? __pfx_process_one_work+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? lock_is_held_type+0x8f/0x100
     ? srso_alias_return_thunk+0x5/0xfbef5
     worker_thread+0x65c/0xe40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __kthread_parkme+0x177/0x220
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_worker_thread+0x10/0x10
     kthread+0x351/0x460
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x659/0x940
     ? __pfx_ret_from_fork+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __switch_to+0x74f/0xf70
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>

    Allocated by task 52:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_slab_alloc+0x89/0x90
     kmem_cache_alloc_noprof+0x20b/0x5c0
     dlm_new_lock+0x39/0x5f0
     dlm_create_lock_handler+0x16e/0x870
     o2net_rx_until_empty+0x1dae/0x32c0
     process_one_work+0x9a8/0x1b40
     worker_thread+0x65c/0xe40
     kthread+0x351/0x460
     ret_from_fork+0x659/0x940
     ret_from_fork_asm+0x1a/0x30

    Freed by task 603:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x5f/0x80
     kmem_cache_free+0x242/0x580
     dlm_lock_release+0x1df/0x2f0
     dlm_lock_put+0x51/0x80
     __dlm_hb_node_down+0x15be/0x2710
     dlm_hb_node_down_cb+0x6c/0xa0
     o2hb_run_event_list+0x34a/0x500
     o2hb_do_disk_heartbeat+0x1a07/0x2950
     o2hb_thread+0x1ed/0xdc0
     kthread+0x351/0x460
     ret_from_fork+0x659/0x940
     ret_from_fork_asm+0x1a/0x30

    The buggy address belongs to the object at ffff88810ead5900
     which belongs to the cache o2dlm_lock of size 184
    The buggy address is located 64 bytes inside of
     freed 184-byte region [ffff88810ead5900, ffff88810ead59b8)

    [Page and shadow memory dumps omitted.]

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0043-v5-1ad07df761ff49638789@gmail.com
Fixes: 2c5c54aca9d0 ("ocfs2/dlm: Add missing dlm_lock_put()s")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/dlm/dlmlock.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index 041fd1791ae78d..195d4c5c16f2fd 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -138,6 +138,8 @@ static enum dlm_status dlmlock_master(struct dlm_ctxt *dlm,
 					  res->lockname.len)) {
 			kick_thread = 1;
 			call_ast = 1;
+			/* Keep the lock alive through AST enqueue. */
+			dlm_lock_get(lock);
 		} else {
 			mlog(0, "%s: returning DLM_NORMAL to "
 			     "node %u for reco lock\n", dlm->name,
@@ -166,10 +168,12 @@ static enum dlm_status dlmlock_master(struct dlm_ctxt *dlm,
 	wake_up(&res->wq);
 
 	/* either queue the ast or release it */
-	if (call_ast)
+	if (call_ast) {
 		dlm_queue_ast(dlm, lock);
-	else
+		dlm_lock_put(lock);
+	} else {
 		dlm_lockres_release_ast(dlm, res);
+	}
 
 	dlm_lockres_calc_usage(dlm, res);
 	if (kick_thread)

From a3dd8d3af023837516d8715393acbaa7b252f6d7 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Wed, 14 Oct 2026 19:23:21 +0800
Subject: [PATCH 0749/1982] ocfs2/dlm: hold the lookup reference across convert
 AST enqueue

commit 125fe08ff6cfa064e1212f586f01993ee45c0330 upstream.

dlm_convert_lock_handler() drops the reference it took when it found the
lock on res->granted at its leave label, one statement before it calls
dlm_queue_ast().  dlm_free_dead_locks() takes res->spinlock and drops the
list and base references, so a peer death landing in that gap leaves the
handler's own put as the one that frees the lock, and __dlm_queue_ast()
then reads lock->lockres from freed memory.

The handler is registered next to dlm_create_lock_handler(), so a convert
message buffered on a dying peer's socket arrives on the same o2net
receive work that o2net_disconnect_node() does not wait for.  The two can
interleave as follows, with the reference counts as they are before this
fix:

  Socket data-ready       Node-down thread      Receive worker
  -----------------       ----------------      --------------
  o2net_data_ready()
    select sc under
    callback read lock
                          o2net_disconnect_node()
                            queue shutdown
                            begin flush; new color
    queue sc_rx_work
    in the new color
    release callback lock
                            shutdown socket
                            flush returns
                                                read buffered convert_lock
                                                dlm_convert_lock_handler()
                                                  find lock on res->granted
                                                  dlm_lock_get()  refs = 3
                                                  lock res->spinlock
                                                  __dlmconvert_master()
                                                    call_ast = 1
                                                  unlock res->spinlock
                          DLM node-down cleanup
                            lock res->spinlock
                            dlm_free_dead_locks()
                              unlink lock
                              put list ref  refs = 2
                              put base ref  refs = 1
                            unlock res->spinlock
                                                dlm_lock_put()  refs = 0
                                                  free lock
                                                dlm_queue_ast()
                                                  __dlm_queue_ast()
                                                  read lock->lockres
                                                  (use-after-free)

__dlmconvert_master() only moves the lock between lists, so the count
entering the gap is base, list and lookup.  Drop the lookup reference
after the AST is queued instead of before it and the race ends with the
one __dlm_queue_ast() took, which dlm_flush_asts() releases later with
ast_pending cleared and ast_list unlinked.  No extra get is needed, and
the normal case ends with the same count as before.

dlmconvert_master() has the same shape but is only reached from dlmlock()
for a lock this node owns, which dlm_free_dead_locks() never matches.

Link: https://lore.kernel.org/20261014112321.2955584-1-joseph.qi@linux.alibaba.com
Fixes: 2c5c54aca9d0 ("ocfs2/dlm: Add missing dlm_lock_put()s")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/dlm/dlmconvert.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index 450d46eefab324..8a828448ba958a 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -534,15 +534,19 @@ int dlm_convert_lock_handler(struct o2net_msg *msg, u32 len, void *data,
 	}
 
 leave:
-	if (lock)
-		dlm_lock_put(lock);
-
 	/* either queue the ast or release it, if reserved */
 	if (call_ast)
 		dlm_queue_ast(dlm, lock);
 	else if (ast_reserved)
 		dlm_lockres_release_ast(dlm, res);
 
+	/*
+	 * Keep the lock alive through AST enqueue: a concurrent
+	 * dlm_free_dead_locks() drops the list and base references.
+	 */
+	if (lock)
+		dlm_lock_put(lock);
+
 	if (kick_thread)
 		dlm_kick_thread(dlm, res);
 

From 5ff0f92064ab9bb344e7389c198cc9fd7ed30e29 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Wed, 14 Oct 2026 11:43:40 +0800
Subject: [PATCH 0750/1982] ocfs2: cancel quota sync work before freeing quota
 info

commit 1dd1f005026d52642b994d63baa16b0b31f3b14f upstream.

OCFS2 quota info owns dqi_sync_work and must outlive both its timer and
qsync_work_fn().  ocfs2_local_free_info() frees that owner without
cancelling the work, relying on the quota suspend/disable wrappers.

Loading quotas on a read-only to read-write remount can successfully queue
the work in ocfs2_global_read_info() and then fail while attaching a dquot
to an existing inode in add_dquot_ref().  The quota core unwinds that
failure directly through dquot_disable(), bypassing the OCFS2 wrapper:

  Remount task (s_umount write)        Timer/workqueue
  ocfs2_global_read_info()
    schedules dqi_sync_work
  add_dquot_ref() returns an error
  dquot_disable()
    ocfs2_local_free_info()
      frees oinfo
                                     delayed-work timer expires
                                     qsync_work_fn() reads oinfo

The timer core can then write to the freed embedded timer, or
qsync_work_fn() can read oinfo->dqi_gqinode before its s_umount trylock.
The outer ocfs2_disable_quotas() cleanup skips the failed type because
dquot_disable() has already cleared its loaded state.

Cancel dqi_sync_work synchronously at the start of
ocfs2_local_free_info(), before dropping the global inode or freeing any
owner state. The work is initialized whenever read_file_info() succeeds.
dquot_disable() holds s_umount for write, so the callback skips its quota
scan via down_read_trylock() and can finish without waiting for teardown.
The synchronous cancel also handles its self-rearm.

KASAN report as below:

    BUG: KASAN: slab-use-after-free in __run_timers+0x9e9/0xa10
    Write of size 8 at addr ffff888111b0aad0 by task swapper/3/0

    Call Trace:
     <IRQ>
     dump_stack_lvl+0x93/0xd0
     print_report+0xce/0x630
     ? __run_timers+0x9e9/0xa10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __virt_addr_valid+0x20e/0x420
     ? __run_timers+0x9e9/0xa10
     kasan_report+0xe0/0x110
     ? __run_timers+0x9e9/0xa10
     __run_timers+0x9e9/0xa10
     ? __pfx___run_timers+0x10/0x10
     ? __lock_acquire+0x5a3/0x2140
     ? __pfx_do_raw_spin_lock+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     timer_expire_remote+0xfa/0x160
     ? __pfx_timer_expire_remote+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on+0x18/0x160
     tmigr_handle_remote_up+0x4ba/0x9d0
     ? __pfx_tmigr_handle_remote_up+0x10/0x10
     ? tmigr_handle_remote+0x21a/0x340
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     ? __pfx_tmigr_handle_remote_up+0x10/0x10
     __walk_groups_from+0x5a/0x160
     tmigr_handle_remote+0x24f/0x340
     ? __pfx_tmigr_handle_remote+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     run_timer_softirq+0x222/0x270
     ? __pfx_run_timer_softirq+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lockdep_hardirqs_on_prepare+0xb8/0x1a0
     ? srso_alias_return_thunk+0x5/0xfbef5
     handle_softirqs+0x1fa/0x8d0
     ? __pfx_handle_softirqs+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? _raw_spin_unlock+0x23/0x40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __hrtimer_rearm_deferred+0x1fb/0x5d0
     __irq_exit_rcu+0x113/0x1e0
     irq_exit_rcu+0xe/0x20
     sysvec_apic_timer_interrupt+0x6c/0x80
     </IRQ>
     <TASK>
     asm_sysvec_apic_timer_interrupt+0x1a/0x20
     ? ct_kernel_exit.constprop.0+0xc5/0xf0
     ? do_idle+0x3ae/0x650
     default_idle+0x9/0x10
     default_idle_call+0x6c/0xb0
     do_idle+0x3ae/0x650
     ? cpuhp_online_idle+0x9c/0xb0
     ? __pfx_do_idle+0x10/0x10
     ? __entry_text_end+0x1020f6/0x1020f9
     ? lockdep_hardirqs_on_prepare+0xeb/0x1a0
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on+0x18/0x160
     ? srso_alias_return_thunk+0x5/0xfbef5
     cpu_startup_entry+0x54/0x60
     start_secondary+0x223/0x2d0
     ? __pfx_start_secondary+0x10/0x10
     common_startup_64+0x13e/0x158
     </TASK>

    Allocated by task 523:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0xaa/0xb0
     __kmalloc_cache_noprof+0x28d/0x610
     ocfs2_local_read_info+0x181/0x1580
     dquot_load_quota_sb+0x69e/0x11c0
     dquot_load_quota_inode+0x227/0x3e0
     ocfs2_enable_quotas+0x27c/0x520
     ocfs2_reconfigure+0x964/0xd00
     reconfigure_super+0x3ca/0xa70
     path_mount+0x141e/0x1e80
     __x64_sys_mount+0x24b/0x2d0
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Freed by task 523:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x5f/0x80
     kfree+0x308/0x580
     ocfs2_local_free_info+0x47b/0x800
     dquot_disable+0x5d9/0x17a0
     dquot_load_quota_sb+0xd3c/0x11c0
     dquot_load_quota_inode+0x227/0x3e0
     ocfs2_enable_quotas+0x27c/0x520
     ocfs2_reconfigure+0x964/0xd00
     reconfigure_super+0x3ca/0xa70
     path_mount+0x141e/0x1e80
     __x64_sys_mount+0x24b/0x2d0
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    The buggy address belongs to the object at ffff888111b0a800
     which belongs to the cache kmalloc-1k of size 1024
    The buggy address is located 720 bytes inside of
     freed 1024-byte region [ffff888111b0a800, ffff888111b0ac00)

Host details, register and page dumps omitted.

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0052-v3-b4904bd6c85daf033adf@gmail.com
Fixes: 1a6152d36dee ("quota: propagate error from __dquot_initialize")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Chao Yu <chao@kernel.org>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/quota_local.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index bd3eb098097f50..15f3e8b38664b2 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -816,6 +816,9 @@ static int ocfs2_local_free_info(struct super_block *sb, int type)
 	int mark_clean = 1, len;
 	int status = 0;
 
+	/* Quota-core error paths can bypass ocfs2_disable_quotas(). */
+	cancel_delayed_work_sync(&oinfo->dqi_sync_work);
+
 	iput(oinfo->dqi_gqinode);
 	ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock);
 	ocfs2_lock_res_free(&oinfo->dqi_gqlock);

From 59d336153d40649afe86ff57d3bde1ac1588e850 Mon Sep 17 00:00:00 2001
From: Jiaming Zhang <r772577952@gmail.com>
Date: Mon, 14 Sep 2026 11:49:40 +0800
Subject: [PATCH 0751/1982] ocfs2: fix chunk number of the first chunk in a
 local quota file

commit 4effccfd50baee4f325694964aeee997dca7bd96 upstream.

Mounting a crafted OCFS2 image can corrupt kernel memory.  When the
local quota file header of such an image claims zero chunks, the first
quota entry allocated during the mount gets a chunk number taken from a
kernel pointer, and releasing that entry clears a bit far outside the
chunk bitmap.

The write will corrupt the data stored at that address, and the
corruption may lead to a system crash or damage unrelated data.
Mounting requires CAP_SYS_ADMIN, so it takes an untrusted image, such
as removable media or a loop mount of a file from elsewhere.

Since the chunk number comes from a kernel pointer, the address of the
bit that gets cleared differs from boot to boot, and the issue has been
reported under several titles:

- BUG: unable to handle kernel paging request in ocfs2_local_release_dquot
- KASAN: use-after-free Write in ocfs2_local_release_dquot
- KASAN: slab-out-of-bounds Write in ocfs2_local_release_dquot
- KASAN: slab-use-after-free Write in ocfs2_local_release_dquot
- KFENCE: use-after-free write in ocfs2_local_release_dquot

Note that none of these is a use-after-free in the quota code: the
chunk and its buffer head are alive.  The bit that gets cleared lies
far outside the bitmap.  KASAN and KFENCE name each report based on the
object occupying that address, which explains why the same issue is
reported under so many different titles.  In the report I sent, the
address fell in a free page, which KASAN labels use-after-free.

There are known reproducers.  Both a syzkaller and a C reproducer are
available from the Google Drive link [1] in my report thread.  The
issue was found by our modified syzkaller, not a theoretical thing
found by an LLM.  I have not seen it outside fuzzing, so it is not
affecting me in the real world.

The local quota file in OCFS2 is divided into chunks, and each chunk
begins with a header block holding a bitmap of the quota entries that
chunk has handed out.  Chunks are numbered from zero, and that number is
used to convert the file offset of an entry back into a bit position in
the bitmap.  ocfs2_local_quota_add_chunk() appends a new chunk to the
in-memory list and numbers it one past the chunk that was last:

	list_add_tail(&chunk->qc_chunk, &oinfo->dqi_chunk);
	chunk->qc_num = list_entry(chunk->qc_chunk.prev,
				   struct ocfs2_quota_chunk,
				   qc_chunk)->qc_num + 1;

The predecessor is looked up after the new chunk is added to the list, so
if the list was empty, the prev pointer is the list head itself.  The head
is the dqi_chunk member of struct ocfs2_mem_dqinfo and is not a chunk, so
reading qc_num through it lands 16 bytes past the start of the head, on
the dqi_gqinode pointer that follows it.  The first chunk of the file is
then numbered with the lower half of a kernel pointer instead of 0.

The list is empty when the local quota file header claims the file has no
chunks.  ocfs2_local_read_info() takes dqi_chunks from that header without
validating it, so an image with dqi_chunks == 0 takes this path when the
first quota entry is allocated.

ocfs2_create_local_dquot() turns the bad number into a file offset with
ol_dqblk_off(), which shifts a 32-bit block number left by the block size
bits, so the top bits of such a large block number are lost.
ocfs2_local_release_dquot() turns the offset back into a bit index with
ol_dqblk_chunk_off(), using the full chunk number, so the lost bits push
that index far outside the bitmap, and clearing it corrupts unrelated
memory.

Compute the chunk number before putting the chunk on the list, and use 0
when the list is empty.

Link: https://lore.kernel.org/20260914034940.4070970-1-r772577952@gmail.com
Link: https://drive.google.com/drive/folders/1-LzPTgOALEc3eOjmgM6oOfRKkYXJ-bnO?usp=drive_link [1]
Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://lore.kernel.org/lkml/CANypQFZ05tpth0Xc33gmP6jgPnkY4VuezyHcsajV-SqCsmN_gg@mail.gmail.com/
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: Claude Code:claude-opus-5
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/quota_local.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 15f3e8b38664b2..a52bf3895ae251 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -1074,10 +1074,13 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
 		goto out;
 	}
 
+	if (list_empty(&oinfo->dqi_chunk))
+		chunk->qc_num = 0;
+	else
+		chunk->qc_num = list_entry(oinfo->dqi_chunk.prev,
+					   struct ocfs2_quota_chunk,
+					   qc_chunk)->qc_num + 1;
 	list_add_tail(&chunk->qc_chunk, &oinfo->dqi_chunk);
-	chunk->qc_num = list_entry(chunk->qc_chunk.prev,
-				   struct ocfs2_quota_chunk,
-				   qc_chunk)->qc_num + 1;
 	chunk->qc_headerbh = bh;
 	*offset = 0;
 	return chunk;

From 7ff4f020f7b03fddd529735f0b61ac0a8dd92c9e Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Wed, 14 Oct 2026 11:47:15 +0800
Subject: [PATCH 0752/1982] ocfs2: pin refcount trees before dropping the
 lookup lock

commit 8c714a074074af7ae59233c1fa6ef9d7aa710462 upstream.

A refcount tree returned to ocfs2_lock_refcount_tree() must stay alive
until that caller releases its operation reference. However,
ocfs2_get_refcount_tree() returns the cached pointer after dropping
osb_lock, and the caller only takes its kref afterwards. The registry
reference does not protect this gap from concurrent removal.

This can happen when another node frees a refcount root and reuses its
block with a different generation while this mount retains the old
cached tree. Two local operations on different inodes sharing the new
root, such as data CoW and an external xattr update, can then look up
the same stale tree. Their inode locks are independent, and both the
REFCOUNT DLM lock and rf_sem are acquired after the first operation
reference.

The following ordering is possible, with no other operation references:

  Data CoW                         Xattr update
  --------                         ------------
  Look up the old tree under
    osb_lock, then drop osb_lock
                                   Look up the same tree and take a kref
                                   Acquire the tree locks and read the
                                     new on-disk generation
                                   Erase the old tree under osb_lock
                                   Unlock and drop the operation kref
                                   Drop the registry kref, freeing tree
  Take a kref through the
    freed tree pointer

The final kref_get() accesses freed rf_getcnt storage, and subsequent
accesses in ocfs2_lock_refcount_tree() also use the freed allocation.

Take the operation reference in ocfs2_get_refcount_tree() before
releasing osb_lock, including when an insertion loses to another lookup.
Removal must acquire the same lock, so it cannot drop the registry
reference before the lookup has pinned the tree. Keep the existing
unlock and error path puts. The two callers that already hold the
refcount tree lock keep their borrowed lookup behavior and do not
acquire an extra reference.

KASAN report as below:

    BUG: KASAN: slab-use-after-free in ocfs2_lock_refcount_tree+0x94a/0x9b0
    Read of size 4 at addr ffff888117212820 by task python3/497

[Kernel and hardware identification omitted.]

    Call Trace:
     <TASK>
     dump_stack_lvl+0x93/0xd0
     print_report+0xce/0x630
     ? ocfs2_lock_refcount_tree+0x94a/0x9b0
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __virt_addr_valid+0x20e/0x420
     ? ocfs2_lock_refcount_tree+0x94a/0x9b0
     kasan_report+0xe0/0x110
     ? ocfs2_lock_refcount_tree+0x94a/0x9b0
     ocfs2_lock_refcount_tree+0x94a/0x9b0
     ? __pfx_ocfs2_lock_refcount_tree+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? ocfs2_refcount_cow+0x3b6/0xd90
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __kmalloc_cache_noprof+0x28d/0x610
     ? ocfs2_refcount_cow+0x3b6/0xd90
     ocfs2_refcount_cow+0x410/0xd90
     ? __pfx_ocfs2_refcount_cow+0x10/0x10
     ? __pfx___might_resched+0x10/0x10
     ? down_write+0x11a/0x1f0
     ? __pfx_down_write+0x10/0x10
     ? ocfs2_inode_unlock+0x1a9/0x260
     ? __pfx_ocfs2_inode_unlock+0x10/0x10
     ? ocfs2_file_write_iter+0x1413/0x1d30
     ocfs2_file_write_iter+0x157b/0x1d30
     ? __pfx_ocfs2_file_write_iter+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? __x64_sys_pwrite64+0x1b7/0x220
     ? __pfx___might_resched+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? security_file_permission+0x26/0x80
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_is_held_type+0x8f/0x100
     vfs_write+0x639/0x1010
     ? __pfx_ocfs2_file_write_iter+0x10/0x10
     ? lock_vma_under_rcu+0x154/0x4a0
     ? __pfx_vfs_write+0x10/0x10
     ? lock_release+0x121/0x290
     ? srso_alias_return_thunk+0x5/0xfbef5
     __x64_sys_pwrite64+0x1b7/0x220
     ? __pfx___x64_sys_pwrite64+0x10/0x10
     ? irqentry_exit+0xbe/0x820
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on_prepare+0x11d/0x150
     ? srso_alias_return_thunk+0x5/0xfbef5
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

[Register dump omitted.]

     </TASK>

    Allocated by task 491:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0xaa/0xb0
     __kmalloc_cache_noprof+0x28d/0x610
     ocfs2_allocate_refcount_tree+0x49/0x1a0
     ocfs2_create_refcount_tree+0x5d7/0x1630
     ocfs2_attach_refcount_tree+0x57d/0x1100
     __ocfs2_reflink.isra.0+0x1c4/0x1940
     ocfs2_reflink+0x501/0x9b0
     ocfs2_reflink_ioctl+0x6b2/0x920
     ocfs2_ioctl+0x538/0x640
     __x64_sys_ioctl+0x163/0x1d0
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Freed by task 498:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x5f/0x80
     kfree+0x308/0x580
     ocfs2_lock_refcount_tree+0x672/0x9b0
     ocfs2_xattr_set+0x72c/0x2530
     ocfs2_xattr_user_set+0xaf/0xf0
     __vfs_setxattr+0x143/0x1b0
     __vfs_setxattr_noperm+0x112/0x5b0
     __vfs_setxattr_locked+0xfe/0x2b0
     vfs_setxattr+0x13c/0x370
     do_setxattr+0x128/0x170
     filename_setxattr+0x147/0x190
     path_setxattrat+0x1ac/0x260
     __x64_sys_setxattr+0xcb/0x140
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    The buggy address belongs to the object at ffff888117212800
     which belongs to the cache kmalloc-1k of size 1024
    The buggy address is located 32 bytes inside of
     freed 1024-byte region [ffff888117212800, ffff888117212c00)

[Page and memory dumps omitted.]

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0037-v4-9f1a261dfbc341721689@gmail.com
Fixes: 374a263e790c ("ocfs2: Add refcount tree lock mechanism.")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Tao Ma <tao.ma@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/refcounttree.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 54a030e6779dac..6f605702a5590e 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -348,8 +348,10 @@ ocfs2_allocate_refcount_tree(struct ocfs2_super *osb, u64 rf_blkno)
 	return new;
 }
 
+/* Callers without the refcount tree lock must request a reference. */
 static int ocfs2_get_refcount_tree(struct ocfs2_super *osb, u64 rf_blkno,
-				   struct ocfs2_refcount_tree **ret_tree)
+				   struct ocfs2_refcount_tree **ret_tree,
+				   bool get_ref)
 {
 	int ret = 0;
 	struct ocfs2_refcount_tree *tree, *new = NULL;
@@ -406,6 +408,8 @@ static int ocfs2_get_refcount_tree(struct ocfs2_super *osb, u64 rf_blkno,
 	new = NULL;
 
 out:
+	if (get_ref)
+		ocfs2_refcount_tree_get(tree);
 	*ret_tree = tree;
 
 	osb->osb_ref_tree_lru = tree;
@@ -479,14 +483,12 @@ int ocfs2_lock_refcount_tree(struct ocfs2_super *osb,
 	struct ocfs2_refcount_block *rb;
 
 again:
-	ret = ocfs2_get_refcount_tree(osb, ref_blkno, &tree);
+	ret = ocfs2_get_refcount_tree(osb, ref_blkno, &tree, true);
 	if (ret) {
 		mlog_errno(ret);
 		return ret;
 	}
 
-	ocfs2_refcount_tree_get(tree);
-
 	ret = __ocfs2_lock_refcount_tree(osb, tree, rw);
 	if (ret) {
 		mlog_errno(ret);
@@ -2323,7 +2325,8 @@ int ocfs2_decrease_refcount(struct inode *inode,
 		goto out;
 	}
 
-	ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb), ref_blkno, &tree);
+	ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb), ref_blkno,
+				      &tree, false);
 	if (ret) {
 		mlog_errno(ret);
 		goto out;
@@ -2558,7 +2561,7 @@ int ocfs2_prepare_refcount_change_for_del(struct inode *inode,
 	BUG_ON(!ocfs2_is_refcount_inode(inode));
 
 	ret = ocfs2_get_refcount_tree(OCFS2_SB(inode->i_sb),
-				      refcount_loc, &tree);
+				      refcount_loc, &tree, false);
 	if (ret) {
 		mlog_errno(ret);
 		goto out;

From f976692490bbdf670d4cc241b8951c8cfddb1583 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Thu, 22 Oct 2026 17:08:41 +0800
Subject: [PATCH 0753/1982] ocfs2: snapshot dentry names in file and setattr
 traces

commit 8cd3ff30659775a6831c66687a69d2b83d163591 upstream.

Patch series "ocfs2: stabilize dentry names in file and setattr traces",
v4.

Snapshot names at all six users of ocfs2__file_ops and at the separate
setattr event. Patch 1 handles the five ordinary file-operation callers
and setattr. Patch 2 handles release separately to preserve its locked
open-count sample and take the snapshot outside that critical section.

The release explanation distinguishes its existing RCU lifetime coverage
from name/length consistency. It does not claim that the ordinary
callers' external-name UAF interleaving crosses the held inode spinlock.
The release source change is unchanged from v3.

Patch 1 also removes the read callback's redundant NULL-inode check.
The two patches apply independently and leave trace formats unchanged.


This patch (of 2):

The open, fsync, read, write and splice-read trace calls pass the live
dentry name and length to the shared ocfs2__file_ops event class.
ocfs2_setattr() passes the same unprotected arguments to its own event.
Both events size and copy a __string field separately. A reference to
the dentry does not pin the external storage backing an individual name.

With an event enabled, a caller can be preempted after loading the name
pointer. A long-to-short rename can then replace the name and reclaim its
old external allocation before the trace callback sizes or copies it,
provided no other snapshot retains that allocation.

The setattr inode lock does not exclude every rename: a same-directory
rename of a source directory need not take that directory's inode lock.
It can therefore change the dentry name while setattr records its event.
Inline names and separately loaded lengths can also change during trace
record sizing and copying.

Take a dentry name snapshot around each of these six trace calls and
pass both the string and length from the snapshot. Check event enablement
before taking a snapshot. Keep the event classes and formats unchanged.

Also remove the redundant NULL-inode check in the read callback.
file_inode() returns the open file's inode, which is already used by the
trace call above the check.

The historical report below is from the read path.

KASAN report as below:

    BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0
    Read of size 1 at addr ffff88810a5b2b18 by task python3/496

    [CPU and host details omitted.]
    Call Trace:
     <TASK>
     dump_stack_lvl+0x93/0xd0
     print_report+0xce/0x630
     ? strlen+0x85/0xa0
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __virt_addr_valid+0x20e/0x420
     ? strlen+0x85/0xa0
     kasan_report+0xe0/0x110
     ? strlen+0x85/0xa0
     strlen+0x85/0xa0
     trace_event_raw_event_ocfs2__file_ops+0xf0/0x480
     ? __pfx_trace_event_raw_event_ocfs2__file_ops+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? pmbd_probe_hit_cookie+0xe7/0x1c0
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_pmbd_probe_hit_cookie+0x10/0x10
     ocfs2_file_read_iter+0x6cd/0xb30
     ? __pfx_ocfs2_file_read_iter+0x10/0x10
     ? selinux_file_permission+0x11d/0x540
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? security_file_permission+0x26/0x80
     vfs_read+0x7d2/0xc20
     ? __pfx_vfs_read+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_do_sys_openat2+0x10/0x10
     ksys_read+0x111/0x200
     ? __pfx_ksys_read+0x10/0x10
     ? irqentry_exit+0xbe/0x820
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on_prepare+0x11d/0x150
     ? srso_alias_return_thunk+0x5/0xfbef5
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    [User register dump omitted.]
     </TASK>

    Allocated by task 489:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0xaa/0xb0
     __kmalloc_noprof+0x2de/0x780
     __d_alloc+0x5fc/0x8c0
     d_alloc_parallel+0x106/0x11d0
     lookup_open+0x3ff/0x13e0
     path_openat+0x95e/0x2020
     do_file_open+0x21e/0x470
     do_sys_openat2+0xf4/0x1b0
     __x64_sys_openat+0x136/0x1e0
     do_syscall_64+0x114/0x620
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Freed by task 0:
     kasan_save_stack+0x33/0x60
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x5f/0x80
     __rcu_free_sheaf_prepare+0x65/0x2a0
     rcu_free_sheaf_nobarn+0x1d/0x50
     rcu_core+0x6be/0x1ed0
     handle_softirqs+0x1fa/0x8d0
     __irq_exit_rcu+0x113/0x1e0
     irq_exit_rcu+0xe/0x20
     sysvec_apic_timer_interrupt+0x6c/0x80
     asm_sysvec_apic_timer_interrupt+0x1a/0x20

    The buggy address belongs to the object at ffff88810a5b2b00
     which belongs to the cache kmalloc-rcl-192 of size 192
    The buggy address is located 24 bytes inside of
     freed 192-byte region [ffff88810a5b2b00, ffff88810a5b2bc0)

    [Page and shadow-memory dumps omitted.]

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-0@gmail.com
Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-1@gmail.com
Fixes: 468eedde23d6 ("ocfs2: Remove mlog(0) from fs/ocfs2/file.c")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/file.c | 100 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 64 insertions(+), 36 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 21d797ccccd068..a0df92a23498aa 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -84,10 +84,17 @@ static int ocfs2_file_open(struct inode *inode, struct file *file)
 	int mode = file->f_flags;
 	struct ocfs2_inode_info *oi = OCFS2_I(inode);
 
-	trace_ocfs2_file_open(inode, file, file->f_path.dentry,
-			      (unsigned long long)oi->ip_blkno,
-			      file->f_path.dentry->d_name.len,
-			      file->f_path.dentry->d_name.name, mode);
+	if (trace_ocfs2_file_open_enabled()) {
+		struct dentry *dentry = file->f_path.dentry;
+		struct name_snapshot name;
+
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_file_open(inode, file, dentry,
+				      oi->ip_blkno,
+				      name.name.len, name.name.name,
+				      mode);
+		release_dentry_name_snapshot(&name);
+	}
 
 	if (file->f_mode & FMODE_WRITE) {
 		status = dquot_initialize(inode);
@@ -173,11 +180,17 @@ static int ocfs2_sync_file(struct file *file, loff_t start, loff_t end,
 	tid_t commit_tid;
 	bool needs_barrier = false;
 
-	trace_ocfs2_sync_file(inode, file, file->f_path.dentry,
-			      oi->ip_blkno,
-			      file->f_path.dentry->d_name.len,
-			      file->f_path.dentry->d_name.name,
-			      (unsigned long long)datasync);
+	if (trace_ocfs2_sync_file_enabled()) {
+		struct dentry *dentry = file->f_path.dentry;
+		struct name_snapshot name;
+
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_sync_file(inode, file, dentry,
+				      oi->ip_blkno,
+				      name.name.len, name.name.name,
+				      (unsigned long long)datasync);
+		release_dentry_name_snapshot(&name);
+	}
 
 	if (ocfs2_is_hard_readonly(osb) || ocfs2_is_soft_readonly(osb))
 		return -EROFS;
@@ -1126,15 +1139,19 @@ int ocfs2_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 	int had_lock;
 	struct ocfs2_lock_holder oh;
 
-	trace_ocfs2_setattr(inode, dentry,
-			    (unsigned long long)OCFS2_I(inode)->ip_blkno,
-			    dentry->d_name.len, dentry->d_name.name,
-			    attr->ia_valid,
-				attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
-				attr->ia_valid & ATTR_UID ?
+	if (trace_ocfs2_setattr_enabled()) {
+		struct name_snapshot name;
+
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_setattr(inode, dentry, OCFS2_I(inode)->ip_blkno,
+				    name.name.len, name.name.name, attr->ia_valid,
+				    attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
+				    attr->ia_valid & ATTR_UID ?
 					from_kuid(&init_user_ns, attr->ia_uid) : 0,
-				attr->ia_valid & ATTR_GID ?
+				    attr->ia_valid & ATTR_GID ?
 					from_kgid(&init_user_ns, attr->ia_gid) : 0);
+		release_dentry_name_snapshot(&name);
+	}
 
 	/* ensuring we don't even attempt to truncate a symlink */
 	if (S_ISLNK(inode->i_mode))
@@ -2380,11 +2397,17 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
 	int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
 	int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
 
-	trace_ocfs2_file_write_iter(inode, file, file->f_path.dentry,
-		(unsigned long long)OCFS2_I(inode)->ip_blkno,
-		file->f_path.dentry->d_name.len,
-		file->f_path.dentry->d_name.name,
-		(unsigned int)from->nr_segs);	/* GRRRRR */
+	if (trace_ocfs2_file_write_iter_enabled()) {
+		struct dentry *dentry = file->f_path.dentry;
+		struct name_snapshot name;
+
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_file_write_iter(inode, file, dentry,
+					    OCFS2_I(inode)->ip_blkno,
+					    name.name.len, name.name.name,
+					    (unsigned int)from->nr_segs);
+		release_dentry_name_snapshot(&name);
+	}
 
 	if (!direct_io && nowait)
 		return -EOPNOTSUPP;
@@ -2530,17 +2553,16 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
 	int direct_io = iocb->ki_flags & IOCB_DIRECT ? 1 : 0;
 	int nowait = iocb->ki_flags & IOCB_NOWAIT ? 1 : 0;
 
-	trace_ocfs2_file_read_iter(inode, filp, filp->f_path.dentry,
-			(unsigned long long)OCFS2_I(inode)->ip_blkno,
-			filp->f_path.dentry->d_name.len,
-			filp->f_path.dentry->d_name.name,
-			to->nr_segs);	/* GRRRRR */
-
+	if (trace_ocfs2_file_read_iter_enabled()) {
+		struct dentry *dentry = filp->f_path.dentry;
+		struct name_snapshot name;
 
-	if (!inode) {
-		ret = -EINVAL;
-		mlog_errno(ret);
-		goto bail;
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_file_read_iter(inode, filp, dentry,
+					   OCFS2_I(inode)->ip_blkno,
+					   name.name.len, name.name.name,
+					   to->nr_segs);
+		release_dentry_name_snapshot(&name);
 	}
 
 	if (!direct_io && nowait)
@@ -2612,11 +2634,17 @@ static ssize_t ocfs2_file_splice_read(struct file *in, loff_t *ppos,
 	ssize_t ret = 0;
 	int lock_level = 0;
 
-	trace_ocfs2_file_splice_read(inode, in, in->f_path.dentry,
-				     (unsigned long long)OCFS2_I(inode)->ip_blkno,
-				     in->f_path.dentry->d_name.len,
-				     in->f_path.dentry->d_name.name,
-				     flags);
+	if (trace_ocfs2_file_splice_read_enabled()) {
+		struct dentry *dentry = in->f_path.dentry;
+		struct name_snapshot name;
+
+		take_dentry_name_snapshot(&name, dentry);
+		trace_ocfs2_file_splice_read(inode, in, dentry,
+					     OCFS2_I(inode)->ip_blkno,
+					     name.name.len, name.name.name,
+					     flags);
+		release_dentry_name_snapshot(&name);
+	}
 
 	/*
 	 * We're fine letting folks race truncates and extending writes with

From daee49d7a51f1edb062581d49684c9cbfb3d7dc9 Mon Sep 17 00:00:00 2001
From: Diego Oliva <diego@bynar.io>
Date: Tue, 29 Sep 2026 10:16:31 +0100
Subject: [PATCH 0754/1982] smb: client: fix OOB last_entry pointer from
 unbounded LastNameOffset

commit 570c783a96f054dd3ac409a92772e9afb705d21c upstream.

CIFSFindFirst() and CIFSFindNext() locate the last entry of a
TRANS2_FIND_FIRST2 or TRANS2_FIND_NEXT2 response by adding the
LastNameOffset of the response parameters to the start of the data
area, and store the result in psrch_inf->last_entry. MS-CIFS 2.2.6.2.2
defines that offset as the offset of the entry's file name; the client
follows the reading of NT and Samba servers, which point it at the
entry. LastNameOffset is only checked against CIFSMaxBufSize, which
says nothing about the response actually received: validate_t2() lets
the data area start up to 1024 bytes into the buffer, and SendReceive()
copies at most CIFSMaxBufSize + MAX_CIFS_HDR_SIZE bytes of a response,
16468 by default, into a cifs_request allocation of CIFSMaxBufSize +
MAX_SMB2_HDR_SIZE bytes, 16588 by default. The pointer itself can
therefore be placed anywhere from the end of the received data to 820
bytes past the end of the allocation.

The read through that pointer is far larger than its displacement.
find_cifs_entry() hands last_entry to cifs_save_resume_key() after every
FindNext and after the FindFirst of a search rewind, and
cifs_fill_dirent() takes the length of the name from the entry itself: a
__le32 FileNameLength for most levels, a __u8 for
SMB_FIND_FILE_INFO_STANDARD, and for SMB_FIND_FILE_UNIX the result of a
scan for the terminating NUL over up to PATH_MAX + 1 UTF-16 units. The
name is recorded as the resume name of the search, and the next
CIFSFindNext() rejects only a recorded length of PATH_MAX or more before
copying the name into the ResumeFileName of its request and sending it
with the resume key taken from the same entry: up to 4 KiB of memory
from past the end of the allocation leaks to the server, and for
SMB_FIND_FILE_UNIX the NUL scan runs about twice as far before the
length is even known. The entry does not have to lie outside the
response for that either: a maximal response ends about 120 bytes before
the end of the allocation, so an entry in its last bytes with a name
just under PATH_MAX has nearly all of that name copied from past the
allocation.

It needs nothing unusual from the client: a FindNext response that
reports no entries and does not end the search makes find_cifs_entry()
send the next FindNext at once, carrying whatever was parsed at
LastNameOffset, and a search rewind can do the same after its
FindFirst. SMB1 is not negotiated by default: this takes a malicious
or compromised server, a mount of it with an explicit vers=1.0, which
CONFIG_CIFS_ALLOW_INSECURE_LEGACY (default y) permits, and a directory
listing on that mount.

With KASAN enabled, a response that places the last entry past the
buffer, with a large DataOffset and a LastNameOffset near the end of
its range, gives:

 ==================================================================
 BUG: KASAN: slab-out-of-bounds in cifs_save_resume_key.isra.0+0x7aa/0x7f0
 Read of size 4 at addr ffff88807b55c33b by task ls/83

 CPU: 1 UID: 0 PID: 83 Comm: ls Not tainted 7.3.0-rc4-00457-gf14572c203d5 #69 PREEMPT(lazy)
 Call Trace:
  <TASK>
  kasan_report+0xdf/0x1a0
  cifs_save_resume_key.isra.0+0x7aa/0x7f0
  cifs_readdir+0x1ed6/0x29c0
  iterate_dir+0x1c0/0x570
  __x64_sys_getdents64+0x133/0x270
  do_syscall_64+0x109/0x5d0
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

 Allocated by task 83 on cpu 0 at 19.317556s:
  cifs_buf_get+0x36/0x90
  smb_init+0x4f/0x110
  CIFSFindNext+0xf7/0x14c0
  cifs_readdir+0xf51/0x29c0

 The buggy address belongs to the object at ffff88807b558000
  which belongs to the cache cifs_request of size 16588
 The buggy address is located 623 bytes to the right of
  allocated 16588-byte region [ffff88807b558000, ffff88807b55c0cc)
 ==================================================================

The four bytes read there are the FileNameLength of the entry, which
cifs_fill_dirent() takes before anything checks where the entry lies.

Ignore the last entry when it does not start inside the received
response or the response holds no entries; for a response without
entries, last_entry pointed into or past its empty data area and
cifs_save_resume_key() parsed whatever the buffer held there. The
entry is bounded by the response that was received, which is what the
buffer holds, rather than by the data area the response declares,
which a later patch checks against the received length. Record the
search handle before the last entry is examined, since a response
without a usable last entry still carries the handle that the search
is continued and closed with; leaving the assignment in the else
branch would drop the handle of every response without entries.

This bounds where the last entry starts, not how far it is parsed: an
entry that starts within the final bytes of the response still has
its fixed part read past the end of the received data and its name,
up to 4095 bytes, copied from past the end of the allocation, until
the following patch bounds the parse itself. A response without a
usable last entry continues the search with an empty resume name,
since the preceding patch, "smb: client: fix use-after-free infoleak
via the readdir resume name", drops the recorded name whenever a new
response is installed. This patch applies on top of that one and
relies on it: without it, every response rejected here would leave
the previous name in place, pointing into a buffer that has been
released.

A conforming server is not affected: the last entry lies inside the
data area of the response.

Fixes: 0752f1522a91 ("[CIFS] make sure we have the right resume info before calling CIFSFindNext")
Fixes: b77d753c413e ("[CIFS] Check that last search entry resume key is valid")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Diego Oliva <diego@bynar.io>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cifssmb.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 9899a4e3d7aec7..127efa6fc36845 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -4447,14 +4447,17 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon,
 	psrch_inf->presume_name = NULL;
 	psrch_inf->resume_name_len = 0;
 	psrch_inf->resume_key = 0;
+	if (pnetfid)
+		*pnetfid = parms->SearchHandle;
 	lnoff = le16_to_cpu(parms->LastNameOffset);
-	if (CIFSMaxBufSize < lnoff) {
+	if (!psrch_inf->entries_in_buffer) {
+		psrch_inf->last_entry = NULL;
+	} else if (psrch_inf->srch_entries_start + lnoff >=
+		   psrch_inf->ntwrk_buf_start + bytes_returned) {
 		cifs_dbg(VFS, "ignoring corrupt resume name\n");
 		psrch_inf->last_entry = NULL;
 	} else {
 		psrch_inf->last_entry = psrch_inf->srch_entries_start + lnoff;
-		if (pnetfid)
-			*pnetfid = parms->SearchHandle;
 	}
 	return 0;
 }
@@ -4572,7 +4575,10 @@ int CIFSFindNext(const unsigned int xid, struct cifs_tcon *tcon,
 	psrch_inf->resume_name_len = 0;
 	psrch_inf->resume_key = 0;
 	lnoff = le16_to_cpu(parms->LastNameOffset);
-	if (CIFSMaxBufSize < lnoff) {
+	if (!psrch_inf->entries_in_buffer) {
+		psrch_inf->last_entry = NULL;
+	} else if (psrch_inf->srch_entries_start + lnoff >=
+		   psrch_inf->ntwrk_buf_start + bytes_returned) {
 		cifs_dbg(VFS, "ignoring corrupt resume name\n");
 		psrch_inf->last_entry = NULL;
 	} else {

From ecc327edd96a65ac177379664cc0972d8a23dfa4 Mon Sep 17 00:00:00 2001
From: Weiming Shi <bestswngs@gmail.com>
Date: Sun, 25 Oct 2026 02:07:30 -0700
Subject: [PATCH 0755/1982] smb: client: stop processing a read response after
 a receive error

commit 51efca72345acdbedc4af76782d464bd15ba50ff upstream.

cifs_read_iter_from_socket() may call cifs_reconnect() before returning an
error.  The reconnect path aborts pending mids and invokes their callbacks.
The callback can then release the cifs_io_subrequest containing rdata.

cifs_readv_receive() nevertheless continues after a negative return and may
dereference rdata in cifs_readv_discard().  KASAN reports the resulting
UAF:

  BUG: KASAN: slab-use-after-free in cifs_readv_receive
  Read of size 4 by task cifsd
  cifs_readv_receive (fs/smb/client/transport.c:1284)
  cifs_demultiplex_thread (fs/smb/client/connect.c:1355)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:158)

  Freed by task 148:
  netfs_put_subrequest (fs/netfs/objects.c:267)
  netfs_read_collection (fs/netfs/read_collect.c:460)
  netfs_wait_for_in_progress (fs/netfs/misc.c:462)

Return the socket error immediately, as this path did before the iterator
conversion.  This also avoids adding a negative length to total_read.

Cc: stable@vger.kernel.org
Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Reported-by: co+24c7c12d69e63c6d@bugs.sh
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/transport.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
index 446edaf94cf4f3..821a949772e721 100644
--- a/fs/smb/client/transport.c
+++ b/fs/smb/client/transport.c
@@ -1312,6 +1312,8 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 #endif
 		length = cifs_read_iter_from_socket(server, &rdata->subreq.io_iter,
 						    data_len);
+	if (length < 0)
+		return length;
 	if (length > 0)
 		rdata->got_bytes += length;
 	server->total_read += length;

From 7805739ce4577f2c53f5a30be2d48e83e91c63bc Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 10:01:19 +0000
Subject: [PATCH 0756/1982] ovl: set OVL_WHITEOUTS before publishing the upper
 dir

commit cbec8610ec5aaf35df50094ff639febc23f20773 upstream.

Listing a directory while it is copied up causes a use-after-free of
the readdir cache.

A merge directory must never be iterated as a real upper directory:
that mode frees the cache in OVL_I(inode)->cache without looking at
its refcount, while files opened in merged mode still use it.
ovl_copy_up_workdir() publishes the upper dentry before it sets
OVL_WHITEOUTS, and ovl_dir_open() samples both without a lock, so an
open between the two stores finds the upper directory and takes it
for a real one.

With a delay between the two stores, an unprivileged process that
listed a directory during its copy-up saw only "." and "..", and its
next getdents freed the readdir cache of another descriptor.

Fix this by setting OVL_WHITEOUTS before ovl_inode_update(), so that
ovl_dir_reset() agrees with ovl_dir_open(), and by testing
OVL_TYPE_MERGE() of the path type in ovl_dir_open(), so that an open
that observes the upper dentry never iterates a merge dir as a real
dir, regardless of the order in which it observes the flag.

Fixes: b79e05aaa166 ("ovl: no direct iteration for dir with origin xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: test OVL_TYPE_MERGE() instead of smp_rmb() in ovl_dir_open()]
Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxh-1J2OBjnDVbrrrjy1puSOW0kABvghN85ih6dtKUBTyA@mail.gmail.com/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 2 +-
 fs/overlayfs/readdir.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 89317e1e7361b8..d89b154b056630 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -843,9 +843,9 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c)
 
 	if (!c->metacopy)
 		ovl_set_upperdata(inode);
-	ovl_inode_update(inode, temp);
 	if (S_ISDIR(inode->i_mode))
 		ovl_set_flag(OVL_WHITEOUTS, inode);
+	ovl_inode_update(inode, temp);
 out:
 	ovl_end_write(c->dentry);
 
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 3c27e7a16f94b1..828210d507081d 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -1053,7 +1053,8 @@ static int ovl_dir_open(struct inode *inode, struct file *file)
 		return PTR_ERR(realfile);
 	}
 	od->realfile = realfile;
-	od->is_real = ovl_dir_is_real(inode);
+	od->is_real = !OVL_TYPE_MERGE(type) &&
+		      !ovl_test_flag(OVL_WHITEOUTS, inode);
 	od->is_upper = OVL_TYPE_UPPER(type);
 	file->private_data = od;
 

From c7e2808209899b2b94dbbcc3b28d44f6c065df62 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 10:34:08 +0000
Subject: [PATCH 0757/1982] ovl: take a snapshot of the name for copy up

commit 65bf000962a33ec9d2488e4e1797b6cf630abcbb upstream.

The copy up of a directory reads a freed dentry name when a lookup
moves the directory at the same time.

A pointer to the name of a dentry is only valid while something stops
a move of the dentry. ovl_do_copy_up() keeps a plain copy of
c->dentry->d_name in c->destname, and ovl_copy_up_start() only keeps
ovl_rename() away. When a lookup finds the same directory under another
name after a change to the lower layer, d_splice_alias() moves the
dentry and frees its external name.

With a delay in ovl_do_copy_up(), a chmod of a lower-only directory with
a 60 byte name raced with a rename of that directory in the lower layer
and a stat of the new name, and KASAN reported a use-after-free in
lookup_noperm_common().

Fix this by using take_dentry_name_snapshot() for c->destname.

Fixes: 829c28be9bb9 ("ovl: use d_splice_alias() in place of d_add() in lookup")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index d89b154b056630..c66d66120cf758 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -948,6 +948,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
 	struct ovl_fs *ofs = OVL_FS(c->dentry->d_sb);
 	struct dentry *origin = c->lowerpath.dentry;
 	struct ovl_fh *fh = NULL;
+	struct name_snapshot name;
 	bool to_index = false;
 
 	/*
@@ -985,12 +986,15 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
 		goto out_free_fh;
 	} else {
 		/*
-		 * c->dentry->d_name is stabilzed by ovl_copy_up_start(),
-		 * because if we got here, it means that c->dentry has no upper
-		 * alias and changing ->d_name means going through ovl_rename()
-		 * that will call ovl_copy_up() on source and target dentry.
+		 * ovl_copy_up_start() keeps ovl_rename() away from c->dentry,
+		 * because ovl_rename() calls ovl_copy_up() on source and target
+		 * dentry.  It does not stop d_splice_alias() from moving a
+		 * directory that a lookup found under another name after a
+		 * change to the lower layer.  That move frees an external name,
+		 * so take a snapshot.
 		 */
-		c->destname = c->dentry->d_name;
+		take_dentry_name_snapshot(&name, c->dentry);
+		c->destname = name.name;
 		/*
 		 * Mark parent "impure" because it may now contain non-pure
 		 * upper
@@ -999,7 +1003,7 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
 		err = ovl_set_impure(c->parent, c->destdir);
 		ovl_end_write(c->dentry);
 		if (err)
-			goto out_free_fh;
+			goto out;
 	}
 
 	/* Should we copyup with O_TMPFILE or with workdir? */
@@ -1033,6 +1037,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
 out:
 	if (to_index)
 		kfree(c->destname.name);
+	else
+		release_dentry_name_snapshot(&name);
 out_free_fh:
 	kfree(fh);
 	return err;

From b219cdaea16b2f3e8e13a63662d462addd8a2cd0 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 10:47:10 +0000
Subject: [PATCH 0758/1982] ovl: use the pinned upper dir in ovl_fix_origin()

commit 4f61ff2ebfb3d2967b83b6a4d456242244d5a61f upstream.

Renames made directly on the upper filesystem during a lookup crash the
kernel.

A dentry that is passed to vfs_setxattr() must be pinned.
ovl_fix_origin() passes upper->d_parent to ovl_set_impure() without a
reference, and the lookup holds no lock of the upper directory. A
rename on the upper filesystem changes d_parent, and only the child
pins the new parent, so a second rename and an rmdir free it.

With delays in ovl_fix_origin() and ovl_set_impure(), renaming the upper
directory twice and removing the intermediate parent during the lookup
of a merge directory without an origin xattr gave a KASAN
use-after-free in vfs_setxattr().

Fix this by passing the upper dentry that the overlay parent holds.

Fixes: 9678e6303057 ("ovl: fix inconsistent d_ino for legacy merge dir")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: add helper ovl_set_impure_dir()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/namei.c     | 6 ++++--
 fs/overlayfs/overlayfs.h | 6 ++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index e93bcc5727bcaf..f30564484b62f1 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -936,8 +936,10 @@ static int ovl_fix_origin(struct ovl_fs *ofs, struct dentry *dentry,
 		goto out;
 
 	err = ovl_set_origin_fh(ofs, fh, upper);
-	if (!err)
-		err = ovl_set_impure(dentry->d_parent, upper->d_parent);
+	if (!err) {
+		/* upper->d_parent is not stable, use the overlay parent */
+		err = ovl_set_impure_dir(dentry->d_parent);
+	}
 
 	ovl_drop_write(dentry);
 out:
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 696b13d9e1f102..7e5fdc3023231b 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -559,6 +559,12 @@ int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry,
 		       enum ovl_xattr ox, const void *value, size_t size,
 		       int xerr);
 int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+
+static inline int ovl_set_impure_dir(struct dentry *dentry)
+{
+	return ovl_set_impure(dentry, ovl_dentry_upper(dentry));
+}
+
 bool ovl_inuse_trylock(struct dentry *dentry);
 void ovl_inuse_unlock(struct dentry *dentry);
 bool ovl_is_inuse(struct dentry *dentry);

From b050952bc4e3409c655a4abcd987131bd77ef570 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Fri, 16 Oct 2026 21:17:07 +0000
Subject: [PATCH 0759/1982] ovl: always encode the origin fh when index is
 enabled

commit 949f9d8a5580c77a45fa759123367682aba4d173 upstream.

On an overlay with index=on,nfs_export=on, copy up of a directory
crashes the kernel once an LSM has started to deny CAP_DAC_READ_SEARCH
to the mounter, the task that mounted the overlay. The mount and the LSM
policy change require root. After that, any user who can write to a
directory that exists only in a lower layer triggers the oops by doing
so.

Before a file or directory that exists only in a lower layer is changed
for the first time, overlayfs copies it to the writable upper layer.
This is called copy up.

On copy up, ovl_get_origin_fh() encodes the file handle of the lower
inode, called the origin. It returns NULL if ovl_can_decode_fh() says
that the lower filesystem cannot decode handles. Whether the callers can
handle NULL depends on the index option:

- Without an index, NULL is fine: the callers store an empty origin
  xattr.
- With index enabled, overlayfs keeps entries for copied up inodes in an
  internal index directory. The name of an index entry is derived from
  the handle, so ovl_get_origin_fh() must return a handle or an error.

The mount only enables the index if ovl_can_decode_fh() succeeds for all
layers, but the result can change later. The function checks the export
operations of the filesystem and capable(CAP_DAC_READ_SEARCH). Copy up
runs with the mounter's credentials, and an LSM can start to deny the
capability to those credentials after the mount. ovl_get_origin_fh()
then returns NULL with index enabled.

This goes wrong in two callers:

- With nfs_export=on, copy up of a directory creates an index entry for
  the directory. ovl_create_index() passes the NULL handle to
  ovl_get_index_name_fh(), which dereferences it.
- If the result changes while mount(2) is still running,
  ovl_get_indexdir() passes a NULL from ovl_get_origin_fh() to
  ovl_verify_set_fh() in the same way.

Before the commit in the Fixes tag, these two callers encoded the handle
themselves, without consulting ovl_can_decode_fh().

Reproduced with a BPF LSM program that started to deny the capability
after the mount. An unprivileged touch in a directory that had not been
copied up yet oopsed in ovl_get_index_name_fh(). With this patch the
touch succeeds and the directory gets its index entry.

Fix this by calling ovl_can_decode_fh() in ovl_get_origin_fh() only when
index is disabled.

Fixes: 5b02bfc1e7e3 ("ovl: do not encode lower fh with upper sb_writers held")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index c66d66120cf758..cabb5ab2a77415 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -476,8 +476,12 @@ struct ovl_fh *ovl_get_origin_fh(struct ovl_fs *ofs, struct dentry *origin)
 	 * When lower layer doesn't support export operations store a 'null' fh,
 	 * so we can use the overlay.origin xattr to distignuish between a copy
 	 * up and a pure upper inode.
+	 *
+	 * With index enabled, mount already found that all layers can decode
+	 * file handles.  Do not ask again, because an LSM may change its answer
+	 * about CAP_DAC_READ_SEARCH and index users cannot cope with a 'null' fh.
 	 */
-	if (!ovl_can_decode_fh(origin->d_sb))
+	if (!ofs->config.index && !ovl_can_decode_fh(origin->d_sb))
 		return NULL;
 
 	return ovl_encode_real_fh(ofs, d_inode(origin), false);

From 6a49ab7c9a68ad9ace8c7fb6fdd7126f4f3411c8 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Fri, 16 Oct 2026 21:17:17 +0000
Subject: [PATCH 0760/1982] ovl: check the casefold flag of directories only

commit 1d27da7de3f74405b1de85ad26c5ea90f826114b upstream.

On an overlay over casefolded (case-insensitive) directories, every
lookup of a file that is not a directory fails with EREMOTE, and the
first file create triggers a kernel warning. No privilege is needed: an
unprivileged user can cause both in a user namespace, with the layers on
a tmpfs that they have mounted with the casefold option.

Some filesystems support casefolding, which is case-insensitive name
lookup. It is enabled per directory, and the inode of a casefolded
directory has the S_CASEFOLD flag.

overlayfs accepts layers on a filesystem that supports casefolding as
long as casefolding is enabled on every directory of the layers, or on
none. The mount records which of the two applies in ofs->casefold.
ovl_lookup_single() compares the S_CASEFOLD flag of each file that it
finds against ofs->casefold and returns -EREMOTE on a mismatch.

Filesystems only set S_CASEFOLD on directories, so with casefolded
layers a regular file, a symlink or a special file never matches and its
lookup fails.

ovl_get_inode() does the same comparison in a WARN_ON_ONCE() for each
new overlay inode. A failed lookup never gets that far, so it is the
first file create that trips the warning.

Reproduced on an overlay over casefolded tmpfs or ext4 directories, with
stat() of a regular file, a symlink and a FIFO, and with a file create:
each stat() failed with EREMOTE. For an unprivileged user in a user
namespace, on tmpfs, stat() of a regular file failed in the same way,
and the file create triggered the warning.

Fix this by limiting both checks to directories.

Fixes: 16754d61dc69 ("ovl: Support mounting case-insensitive enabled layers")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/inode.c | 2 +-
 fs/overlayfs/namei.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 1cc1b60fc70fb1..2887cb7bf6fcab 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -1280,7 +1280,7 @@ struct inode *ovl_get_inode(struct super_block *sb,
 	}
 	ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev);
 	ovl_inode_init(inode, oip, ino, fsid);
-	WARN_ON_ONCE(!!IS_CASEFOLDED(inode) != ofs->casefold);
+	WARN_ON_ONCE(is_dir && !!IS_CASEFOLDED(inode) != ofs->casefold);
 
 	if (upperdentry && ovl_is_impuredir(sb, upperdentry))
 		ovl_set_flag(OVL_IMPURE, inode);
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index f30564484b62f1..c327208f5ecaeb 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -260,7 +260,8 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
 		goto out_err;
 	}
 
-	if (ofs->casefold != ovl_dentry_casefolded(this)) {
+	/* Filesystems set the casefold flag only on directories */
+	if (d_is_dir(this) && ofs->casefold != ovl_dentry_casefolded(this)) {
 		warn = "child wrong casefold";
 		err = -EREMOTE;
 		goto out_warn;

From 628260a7204314ab5f1cd93bddb1721cc0226b38 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 09:45:28 +0000
Subject: [PATCH 0761/1982] ovl: do not copy up an xattr value that was never
 read

commit 755b5c5c9277be251a51623d6065abab948c61bc upstream.

Copy-up stores uninitialized kernel memory in an xattr of the upper
file, where the user can read it.

ovl_copy_xattr() may only pass bytes to ovl_do_setxattr() that
ovl_do_getxattr() has read. When the read fails with -ERANGE the
function asks for the size again, and if the new size fits the buffer
it stores the buffer although nothing was read into it. The buffer
comes from kvmalloc(), or it still holds the value of the previous
xattr.

A FUSE lower layer that answers every sized GETXATTR with -ERANGE made
copy-up store 4096 bytes that the server never sent, with a kernel
pointer in them, as an xattr of the upper file.

Fix this by failing the copy-up with -EIO when the size that follows
-ERANGE fits the buffer.

Reported-by: Fahad Alharbi <fahad@codepure.com>
Closes: https://lore.kernel.org/linux-fsdevel/CAOQ4uxjhfpNVvoVrTayj46H2CViTOc3oxzM6xdb8+E7ikE2CSA@mail.gmail.com/
Fixes: e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index cabb5ab2a77415..09a498b2170e7f 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -131,8 +131,12 @@ int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct de
 
 retry:
 		size = ovl_do_getxattr(oldpath, name, value, value_size);
-		if (size == -ERANGE)
+		if (size == -ERANGE) {
 			size = ovl_do_getxattr(oldpath, name, NULL, 0);
+			/* Nothing was read into value, so it must not be used */
+			if (size >= 0 && size <= value_size)
+				size = -EIO;
+		}
 
 		if (size < 0) {
 			error = size;

From b9f57bb52124aec87bbe344d70a30806fe22b992 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 7 Oct 2026 12:10:59 +0000
Subject: [PATCH 0762/1982] ovl: fix a torn path in ovl_get_redirect()

commit 2001cd7ca5560198131e46c6ca3c3472b06145c2 upstream.

A hard link of a metacopy file that races with a rename of an ancestor
stores a redirect to the wrong lower file.

Each component of an absolute redirect must be the name that a dentry
has in the parent that the walk continues with. ovl_get_redirect()
copies the name under d_lock and calls dget_parent() after the unlock,
and the callers for a hard link hold no lock that stops a rename across
directories. A rename between the two steps combines the old name with
the new parent.

With delays in ovl_get_redirect(), an unprivileged user hard-linked a
metacopy file while renaming its ancestor to another directory, the
stored redirect named another lower path, and after a remount the file
showed the data of a root-only file.

Fix this by taking the parent first and checking it again under d_lock.

Fixes: e04527fefba6 ("ovl: fix dentry leak in ovl_get_redirect")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/dir.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 1abe533304ba4c..74ce0ded72a42c 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1007,7 +1007,19 @@ static char *ovl_get_redirect(struct dentry *dentry, bool abs_redirect)
 		const char *name;
 		int thislen;
 
+		/*
+		 * A rename can move d to another directory at any time.  Hold
+		 * d_lock to copy the name that d has in this very parent, or
+		 * else the path mixes the old name with the new parent.
+		 */
+		tmp = dget_parent(d);
 		spin_lock(&d->d_lock);
+		if (unlikely(tmp != d->d_parent)) {
+			spin_unlock(&d->d_lock);
+			dput(tmp);
+			continue;
+		}
+
 		name = ovl_dentry_get_redirect(d);
 		if (name) {
 			thislen = strlen(name);
@@ -1020,13 +1032,13 @@ static char *ovl_get_redirect(struct dentry *dentry, bool abs_redirect)
 		if (thislen + (name[0] != '/') > buflen) {
 			ret = ERR_PTR(-EXDEV);
 			spin_unlock(&d->d_lock);
+			dput(tmp);
 			goto out_put;
 		}
 
 		buflen -= thislen;
 		memcpy(&buf[buflen], name, thislen);
 		spin_unlock(&d->d_lock);
-		tmp = dget_parent(d);
 
 		dput(d);
 		d = tmp;

From 37537892ca404fa94050114ccebe02f64b9ffad7 Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Fri, 16 Oct 2026 09:33:58 +0200
Subject: [PATCH 0763/1982] ovl: fortify ovl_copy_xattr() against underlying
 layer modifications

commit e6b9117076fb4c0ff4a670efa9c876d9a50d79ab upstream.

Adapt ovl_getxattr_value() to be used from ovl_copy_xattr(), by
allowing to pass it a pre-allocated buffer, which can be resized
and by handling the ENODATA/EOPNOTSUPP return codes in the caller.

This replaces the retry loop in ovl_copy_xattr() with a single retry
after resizing the buffer. If the value changed again by then, the
underlying layer was modified, so return -EIO instead of retrying.

As a side effect, ovl_copy_up_meta_inode_data() now returns -EIO instead
of -ERANGE in this case of underlying xattr size changes.

Reported-by: Fahad Alharbi <fahad@codepure.com>
Tested-by: Fahad Alharbi <fahad@codepure.com>
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Link: https://lore.kernel.org/linux-fsdevel/CAJfpegsVoUyqy0dYkTvBGRZvgdv_nmzmCw_uF+LP-Vq3EhEkSg@mail.gmail.com/
Fixes: e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 68 ++++++++++++++++++++----------------------
 1 file changed, 32 insertions(+), 36 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 09a498b2170e7f..ea360e27d19e02 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -72,6 +72,9 @@ static int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
 	return err;
 }
 
+static ssize_t ovl_getxattr_value(const struct path *path, char *name,
+				  char **value, ssize_t *value_size);
+
 int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct dentry *new)
 {
 	struct dentry *old = oldpath->dentry;
@@ -129,34 +132,12 @@ int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct de
 			break;
 		}
 
-retry:
-		size = ovl_do_getxattr(oldpath, name, value, value_size);
-		if (size == -ERANGE) {
-			size = ovl_do_getxattr(oldpath, name, NULL, 0);
-			/* Nothing was read into value, so it must not be used */
-			if (size >= 0 && size <= value_size)
-				size = -EIO;
-		}
-
+		size = ovl_getxattr_value(oldpath, name, &value, &value_size);
 		if (size < 0) {
 			error = size;
 			break;
 		}
 
-		if (size > value_size) {
-			void *new;
-
-			new = kvmalloc(size, GFP_KERNEL);
-			if (!new) {
-				error = -ENOMEM;
-				break;
-			}
-			kvfree(value);
-			value = new;
-			value_size = size;
-			goto retry;
-		}
-
 		error = ovl_do_setxattr(OVL_FS(sb), new, name, value, size, 0);
 		if (error) {
 			if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name))
@@ -1082,26 +1063,39 @@ static bool ovl_need_meta_copy_up(struct dentry *dentry, umode_t mode,
 	return true;
 }
 
-static ssize_t ovl_getxattr_value(const struct path *path, char *name, char **value)
+static ssize_t ovl_getxattr_value(const struct path *path, char *name,
+				  char **value, ssize_t *value_size)
 {
 	ssize_t res;
 	char *buf;
 
-	res = ovl_do_getxattr(path, name, NULL, 0);
-	if (res == -ENODATA || res == -EOPNOTSUPP)
-		res = 0;
+	res = ovl_do_getxattr(path, name, *value, *value_size);
+	if (res == -ERANGE) {
+		res = ovl_do_getxattr(path, name, NULL, 0);
+		/* Xattr changed underneath us? */
+		if (res >= 0 && res <= *value_size)
+			return -EIO;
+	}
 
-	if (res > 0) {
-		buf = kzalloc(res, GFP_KERNEL);
+	if (res > *value_size) {
+		buf = kvmalloc(res, GFP_KERNEL);
 		if (!buf)
 			return -ENOMEM;
 
 		res = ovl_do_getxattr(path, name, buf, res);
-		if (res < 0)
-			kfree(buf);
-		else
-			*value = buf;
+		if (res < 0) {
+			kvfree(buf);
+			/* Xattr changed underneath us? */
+			if (res == -ERANGE)
+				return -EIO;
+			return res;
+		}
+
+		kvfree(*value);
+		*value = buf;
+		*value_size = res;
 	}
+
 	return res;
 }
 
@@ -1112,7 +1106,7 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
 	struct path upperpath;
 	int err;
 	char *capability = NULL;
-	ssize_t cap_size;
+	ssize_t cap_size = 0;
 
 	ovl_path_upper(c->dentry, &upperpath);
 	if (WARN_ON(upperpath.dentry == NULL))
@@ -1120,7 +1114,9 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
 
 	if (c->stat.size) {
 		err = cap_size = ovl_getxattr_value(&upperpath, XATTR_NAME_CAPS,
-						    &capability);
+						    &capability, &cap_size);
+		if (cap_size == -ENODATA || cap_size == -EOPNOTSUPP)
+			cap_size = 0;
 		if (cap_size < 0)
 			goto out;
 	}
@@ -1150,7 +1146,7 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
 	ovl_clear_flag(OVL_VERIFIED_DIGEST, d_inode(c->dentry));
 	ovl_set_upperdata(d_inode(c->dentry));
 out_free:
-	kfree(capability);
+	kvfree(capability);
 out:
 	return err;
 }

From 9b50f28c22c948b0c134d5c5dbd62ea0ada97fc3 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Fri, 16 Oct 2026 21:17:04 +0000
Subject: [PATCH 0764/1982] ovl: read the nlink xattr of every indexed non-dir

commit eb644ed5c6d9afdb1554c41cef1f39d150fbc554 upstream.

With nfs_export=on, data written through a file handle to a lower file,
i.e. a file that exists only in a lower layer of the overlay, can be
lost on the next mount. A lookup of the file by name then returns -EIO.
Also, a file with one name reports st_nlink 2 once it has been copied to
the upper layer. After such a file is removed, its file handle can still
open it until the next mount.

Before a lower file is changed for the first time, overlayfs copies it
to the writable upper layer. This is called copy up.

The index directory is $workdir/index, where $workdir is the directory
given by the workdir= option. Each entry is named after the file handle
of a lower inode, so that overlayfs can get from the handle to the
copied up inode.

With nfs_export=on, copy up indexes every non-directory: it copies the
file to an entry in the index directory and then hard links that entry
into the upper directory. The index entry is an extra link to the upper
inode, so overlayfs stores the link count that users should see in the
overlay.nlink xattr.

A file can also be opened by handle, either by an NFS client or by a
process with CAP_DAC_READ_SEARCH calling open_by_handle_at(). If the
file is not in the dcache, its overlay dentry is disconnected, i.e. it
has no parent yet. Copy up then creates the index entry but no hard link
in the upper directory. The index entry has i_nlink 1 and holds the only
copy of the data written to the file.

ovl_get_nlink() reads the stored count. Its caller passes a default,
which the function returns if there is no stored count. If the lower
inode has i_nlink 1, the function returns the default without reading
the xattr. That was correct as long as only lower files with multiple
links were indexed.

On the next mount, ovl_verify_index() looks for orphans, i.e. index
entries of files whose last name was removed. For an index entry with
i_nlink 1, it passes a default of 0 to ovl_get_nlink() and treats a
result of 0 as an orphan. Here the lower inode also has i_nlink 1, so
the result is the default. ovl_indexdir_cleanup() then replaces the
entry with a whiteout, which in the index marks a file as deleted. The
written data is lost.

A lookup by name then returns -EIO, because a whiteout as the index
entry of a lower file that still exists is a bad index.

ovl_get_inode() gets the wrong count the same way. Its default is the
i_nlink of the upper inode, which includes the index entry, so a copied
up file with one name reports st_nlink 2.

When that name is removed, the count drops to 1 rather than 0.
ovl_nlink_end() replaces the index entry with a whiteout only at a count
of 0, so the entry stays, and the handle of the removed file still opens
it.

Reproduced by writing through open_by_handle_at() to an uncached lower
file with one link. After a remount the data was lost, and the name
returned EIO.

Fix this by adding an argument to ovl_get_nlink() that says whether the
caller found an index entry, and by skipping the xattr only if the
caller found none.

Known gaps:
- An index entry that a kernel without this patch left behind for a
  removed file now stays, and the handle of that file keeps working. The
  entry has i_nlink 1 and a stored count of 1, just like the entry of a
  file that was only written by handle. Without this patch, the next
  mount treated it as an orphan.

Fixes: fbd2d2074bde ("ovl: index all non-dir on copy up for NFS export")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/inode.c     | 14 +++++++++++---
 fs/overlayfs/namei.c     |  2 +-
 fs/overlayfs/overlayfs.h |  2 +-
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 2887cb7bf6fcab..78803e40c9619e 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -1000,7 +1000,7 @@ int ovl_set_nlink_lower(struct dentry *dentry)
 }
 
 unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry,
-			   struct dentry *upperdentry,
+			   struct dentry *upperdentry, bool indexed,
 			   unsigned int fallback)
 {
 	int nlink_diff;
@@ -1008,7 +1008,15 @@ unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry,
 	char buf[13];
 	int err;
 
-	if (!lowerdentry || !upperdentry || d_inode(lowerdentry)->i_nlink == 1)
+	if (!lowerdentry || !upperdentry)
+		return fallback;
+
+	/*
+	 * A lower inode with one link is not indexed on copy up, unless all
+	 * files are indexed for NFS export.  If the caller found an index entry,
+	 * then the xattr holds the union nlink, whatever the lower nlink is.
+	 */
+	if (!indexed && d_inode(lowerdentry)->i_nlink == 1)
 		return fallback;
 
 	err = ovl_getxattr_upper(ofs, upperdentry, OVL_XATTR_NLINK,
@@ -1265,7 +1273,7 @@ struct inode *ovl_get_inode(struct super_block *sb,
 		/* Recalculate nlink for non-dir due to indexing */
 		if (!is_dir)
 			nlink = ovl_get_nlink(ofs, lowerdentry, upperdentry,
-					      nlink);
+					      oip->index, nlink);
 		set_nlink(inode, nlink);
 		ino = key->i_ino;
 	} else {
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index c327208f5ecaeb..c20be56c9b9d68 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -707,7 +707,7 @@ int ovl_verify_index(struct ovl_fs *ofs, struct dentry *index)
 		if (err)
 			goto fail;
 
-		if (ovl_get_nlink(ofs, origin.dentry, index, 0) == 0)
+		if (ovl_get_nlink(ofs, origin.dentry, index, true, 0) == 0)
 			goto orphan;
 	}
 
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 7e5fdc3023231b..22555205c84ce0 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -795,7 +795,7 @@ static inline bool ovl_dir_is_real(struct inode *dir)
 int ovl_set_nlink_upper(struct dentry *dentry);
 int ovl_set_nlink_lower(struct dentry *dentry);
 unsigned int ovl_get_nlink(struct ovl_fs *ofs, struct dentry *lowerdentry,
-			   struct dentry *upperdentry,
+			   struct dentry *upperdentry, bool indexed,
 			   unsigned int fallback);
 int ovl_permission(struct mnt_idmap *idmap, struct inode *inode,
 		   int mask);

From 8cd9ec121a63c544d89744e9b07ca8f5f8535cdf Mon Sep 17 00:00:00 2001
From: Hungyu Lin <dennylin0707@gmail.com>
Date: Wed, 28 Oct 2026 19:51:33 +0000
Subject: [PATCH 0765/1982] ovl: reserve space for the casefolded name
 terminator

commit a65eb1808177a4381718abe563dddebf840598f9 upstream.

ovl_casefold() allocates NAME_MAX bytes and passes that capacity to
utf8_casefold(), which also needs room for a terminating NUL. A valid
name whose folded form is exactly NAME_MAX bytes therefore fails to
fold, and ovl_fill_merge() falls back to comparing the original bytes.

For example, when two casefolded layers contain directories named with
255 uppercase and lowercase ASCII letters respectively, readdir lists
both names even though lookup treats them as the same directory. The
same names merge correctly at 254 bytes.

Reserve one additional byte in both the allocation and the folding
capacity so that NAME_MAX-byte folded names use the canonical merge key.

Fixes: ee95c5fc86dd ("ovl: Create ovl_casefold() to support casefolded strncmp()")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/readdir.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 828210d507081d..2e7cf7774f34a8 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -79,13 +79,13 @@ static int ovl_casefold(struct ovl_readdir_data *rdd, const char *str, int len,
 	if (!IS_ENABLED(CONFIG_UNICODE) || !rdd->map || is_dot_dotdot(str, len))
 		return 0;
 
-	cf_name = kmalloc(NAME_MAX, GFP_KERNEL);
+	cf_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
 	if (!cf_name) {
 		rdd->err = -ENOMEM;
 		return -ENOMEM;
 	}
 
-	cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX);
+	cf_len = utf8_casefold(rdd->map, &qstr, cf_name, NAME_MAX + 1);
 	if (cf_len > 0)
 		*dst = cf_name;
 	else

From 7ecbeb1a84f2d099012ccd95a8a7588e1306cc46 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Fri, 16 Oct 2026 21:17:23 +0000
Subject: [PATCH 0766/1982] ovl: set the revalidate flags after d_instantiate()

commit 75e89c0055c1d7f7eeb462995f11253ca5864f79 upstream.

stat() of a file on an overlayfs mount triggers a kernel warning and
fails with ECHILD if another task is creating that file at the same
time. This happens on an overlay with a FUSE upper layer, which is the
layer where overlayfs creates new files. Write access to a directory on
such an overlay is all a user needs to run the two tasks.

The revalidate flags are DCACHE_OP_REVALIDATE and
DCACHE_OP_WEAK_REVALIDATE. They tell path walk to call ->d_revalidate()
or ->d_weak_revalidate() on a dentry, so that the filesystem can check
that the cached dentry is still valid. An overlay dentry only has one of
these flags if a dentry in one of its layers has it. FUSE dentries have
the first one.

When a flag is set on an overlay dentry, path walk calls
ovl_dentry_revalidate_common(). That function only expects a dentry
without an inode in RCU walk, while the dentry is being destroyed. For
such a dentry outside of RCU walk, it hits a WARN_ON() and
returns -ECHILD. So a negative overlay dentry must never have the flags
set.

ovl_instantiate() breaks this rule. When a task creates a file, the
overlay dentry for the new name is hashed but still negative.
ovl_instantiate() then works in this order:

- It copies the flags from the new upper dentry to the overlay dentry.
- It calls ovl_get_inode(), which can sleep in a getxattr request to the
  FUSE server.
- Only then does it call d_instantiate().

A second task that looks up the name between the first step and the last
finds a negative dentry with the flags set and revalidates it.

Reproduced with a FUSE server that delays its getxattr reply: stat() of
a name that was being created hit the WARN_ON() and failed with ECHILD.

Fix this by setting the flags after d_instantiate().

Fixes: bccece1ead36 ("ovl: allow remote upper")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/dir.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 74ce0ded72a42c..8377f112feca30 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -295,7 +295,6 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode,
 	};
 
 	ovl_dentry_set_upper_alias(dentry);
-	ovl_dentry_init_reval(dentry, newdentry, NULL);
 
 	if (!hardlink) {
 		/*
@@ -326,6 +325,13 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode,
 		d_mark_tmpfile(tmpfile, inode);
 
 	d_instantiate(dentry, inode);
+	/*
+	 * Unless it is a tmpfile, the dentry is hashed and a path walk can find
+	 * it at any time.  Set the revalidate flags only now, because
+	 * ovl_dentry_revalidate_common() does not expect them on a negative
+	 * dentry.
+	 */
+	ovl_dentry_init_reval(dentry, ovl_dentry_upper(dentry), NULL);
 	if (inode != oip.newinode) {
 		pr_warn_ratelimited("newly created inode found in cache (%pd2)\n",
 				    dentry);

From 5c6a8b2f2f4dc3a0da89c7379ae64962850ba1e3 Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Sun, 18 Oct 2026 11:52:52 +0200
Subject: [PATCH 0767/1982] ovl: skip copy up of empty security.capability

commit 50912a1715b8a7c614b654011a0db750e372b43e upstream.

ovl_copy_xattr() gives up if it can't read an attribute that
listxattr() has named.  An empty security.capability, which anybody has
been able to store on any file for a long time, is such a case: it is
listed, and getxattr() has nothing to return for it.  A file in a lower
layer that carries one can't be copied up: it can't be written to,
renamed or have its mode changed.

There is nothing to copy if there are no data.  Go on with the next
one.

Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: treat -EINVAL as no capability too, and do the same in
 ovl_copy_up_meta_inode_data()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index ea360e27d19e02..488ce3cc3fc79d 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -75,6 +75,15 @@ static int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
 static ssize_t ovl_getxattr_value(const struct path *path, char *name,
 				  char **value, ssize_t *value_size);
 
+/*
+ * Any user can store an empty security.capability, which fails to read with
+ * -EINVAL.  It grants no capability, so treat it as none, like no xattr.
+ */
+static bool ovl_no_fscap(ssize_t err)
+{
+	return err == -ENODATA || err == -EOPNOTSUPP || err == -EINVAL;
+}
+
 int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct dentry *new)
 {
 	struct dentry *old = oldpath->dentry;
@@ -134,6 +143,10 @@ int ovl_copy_xattr(struct super_block *sb, const struct path *oldpath, struct de
 
 		size = ovl_getxattr_value(oldpath, name, &value, &value_size);
 		if (size < 0) {
+			if (!strcmp(name, XATTR_NAME_CAPS) && ovl_no_fscap(size)) {
+				error = 0;
+				continue;
+			}
 			error = size;
 			break;
 		}
@@ -1115,9 +1128,9 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
 	if (c->stat.size) {
 		err = cap_size = ovl_getxattr_value(&upperpath, XATTR_NAME_CAPS,
 						    &capability, &cap_size);
-		if (cap_size == -ENODATA || cap_size == -EOPNOTSUPP)
+		if (ovl_no_fscap(cap_size))
 			cap_size = 0;
-		if (cap_size < 0)
+		else if (cap_size < 0)
 			goto out;
 	}
 

From fa21d1f4f6176e95d110302e66d2a70a4c54b4ab Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:01:31 -0700
Subject: [PATCH 0768/1982] xfs: clear the symlink zapped flag if inline
 symlink is ok

commit f8d0d90f2e24b1f4a14796ae63cebfd820cadfcd upstream.

LOLLM noticed that we fail to clear the SYMLINK_ZAPPED flag if an inline
symlink checks out ok, even after a repair.  Fix that.

Cc: stable@vger.kernel.org # v6.8
Fixes: d9041681dd2f53 ("xfs: set inode sick state flags when we zap either ondisk fork")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/symlink.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/fs/xfs/scrub/symlink.c b/fs/xfs/scrub/symlink.c
index c848bcc07cd5b0..5fa9db115879e9 100644
--- a/fs/xfs/scrub/symlink.c
+++ b/fs/xfs/scrub/symlink.c
@@ -70,21 +70,20 @@ xchk_symlink(
 		return 0;
 	}
 
-	/* Inline symlink? */
 	if (ifp->if_format == XFS_DINODE_FMT_LOCAL) {
+		/* Inline symlink? */
 		if (len > xfs_inode_data_fork_size(ip) ||
 		    len > strnlen(ifp->if_data, xfs_inode_data_fork_size(ip)))
 			xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
-		return 0;
+	} else {
+		/* Remote symlink; must read the contents. */
+		error = xfs_symlink_remote_read(sc->ip, sc->buf);
+		if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
+			return error;
+		if (strnlen(sc->buf, XFS_SYMLINK_MAXLEN) < len)
+			xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
 	}
 
-	/* Remote symlink; must read the contents. */
-	error = xfs_symlink_remote_read(sc->ip, sc->buf);
-	if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
-		return error;
-	if (strnlen(sc->buf, XFS_SYMLINK_MAXLEN) < len)
-		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
-
 	/* If a remote symlink is clean, it is clearly not zapped. */
 	xchk_mark_healthy_if_clean(sc, XFS_SICK_INO_SYMLINK_ZAPPED);
 	return 0;

From 9c16395459335b1266864bc441fb31051c2b4507 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:01:16 -0700
Subject: [PATCH 0769/1982] xfs: mark cow extents bad if there's no rmap
 mapping for them

commit 2ffc0619c9c2881443c5fffb10db8f2bc0aa2ce8 upstream.

LOLLM noticed that we fail to mark cow staging extents as bad if there's
a cow staging extent but no rmap record for the cow staging event.
Close this gap.

Cc: stable@vger.kernel.org # v6.8
Fixes: dbbdbd0086320a ("xfs: repair problems in CoW forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/cow_repair.c | 84 +++++++++++++++++++++++++--------------
 1 file changed, 55 insertions(+), 29 deletions(-)

diff --git a/fs/xfs/scrub/cow_repair.c b/fs/xfs/scrub/cow_repair.c
index 87627ab8943c13..bd090ca6c9c771 100644
--- a/fs/xfs/scrub/cow_repair.c
+++ b/fs/xfs/scrub/cow_repair.c
@@ -199,29 +199,35 @@ xrep_cow_mark_missing_staging_rmap(
 	void				*priv)
 {
 	struct xrep_cow			*xc = priv;
-	xfs_agblock_t			rec_bno;
-	xfs_extlen_t			rec_len;
-	unsigned int			adj;
-
-	if (rec->rm_owner == XFS_RMAP_OWN_COW)
-		return 0;
+	const xfs_agblock_t		rec_end =
+			rec->rm_startblock + rec->rm_blockcount;
+	int				error = 0;
 
-	rec_bno = rec->rm_startblock;
-	rec_len = rec->rm_blockcount;
-	if (rec_bno < xc->irec_startbno) {
-		adj = xc->irec_startbno - rec_bno;
-		rec_len -= adj;
-		rec_bno += adj;
+	/* Was there a gap since the last rmap? */
+	if (xc->next_bno < rec->rm_startblock) {
+		error = xrep_cow_mark_file_range(xc,
+				xfs_gbno_to_fsb(cur->bc_group, xc->next_bno),
+				rec->rm_startblock - xc->next_bno);
+		if (error)
+			return error;
 	}
 
-	if (rec_bno + rec_len > xc->irec_startbno + xc->irec.br_blockcount) {
-		adj = (rec_bno + rec_len) -
-		      (xc->irec_startbno + xc->irec.br_blockcount);
-		rec_len -= adj;
+	if (rec->rm_owner != XFS_RMAP_OWN_COW) {
+		const xfs_agblock_t	bad_bno =
+				max(xc->irec_startbno, rec->rm_startblock);
+		const xfs_agblock_t	irec_end =
+				xc->irec_startbno + xc->irec.br_blockcount;
+		const xfs_extlen_t	bad_end = min(irec_end, rec_end);
+
+		error = xrep_cow_mark_file_range(xc,
+				xfs_gbno_to_fsb(cur->bc_group, bad_bno),
+				bad_end - bad_bno);
+		if (error)
+			return error;
 	}
 
-	return xrep_cow_mark_file_range(xc,
-			xfs_gbno_to_fsb(cur->bc_group, rec_bno), rec_len);
+	xc->next_bno = max(xc->next_bno, rec_end);
+	return error;
 }
 
 /*
@@ -239,10 +245,12 @@ xrep_cow_find_bad(
 	struct xfs_perag		*pag;
 	struct xfs_scrub		*sc = xc->sc;
 	xfs_agnumber_t			agno;
+	xfs_agblock_t			irec_end;
 	int				error;
 
 	agno = XFS_FSB_TO_AGNO(sc->mp, xc->irec.br_startblock);
 	xc->irec_startbno = XFS_FSB_TO_AGBNO(sc->mp, xc->irec.br_startblock);
+	irec_end = xc->irec_startbno + xc->irec.br_blockcount;
 
 	pag = xfs_perag_get(sc->mp, agno);
 	if (!pag)
@@ -254,7 +262,7 @@ xrep_cow_find_bad(
 
 	/* Mark any CoW fork extents that are shared. */
 	rc_low.rc_startblock = xc->irec_startbno;
-	rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	rc_high.rc_startblock = irec_end - 1;
 	rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_SHARED;
 	error = xfs_refcount_query_range(sc->sa.refc_cur, &rc_low, &rc_high,
 			xrep_cow_mark_shared_staging, xc);
@@ -263,7 +271,7 @@ xrep_cow_find_bad(
 
 	/* Make sure there are CoW staging extents for the whole mapping. */
 	rc_low.rc_startblock = xc->irec_startbno;
-	rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	rc_high.rc_startblock = irec_end - 1;
 	rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_COW;
 	xc->next_bno = xc->irec_startbno;
 	error = xfs_refcount_query_range(sc->sa.refc_cur, &rc_low, &rc_high,
@@ -271,11 +279,10 @@ xrep_cow_find_bad(
 	if (error)
 		goto out_sa;
 
-	if (xc->next_bno < xc->irec_startbno + xc->irec.br_blockcount) {
+	if (xc->next_bno < irec_end) {
 		error = xrep_cow_mark_file_range(xc,
 				xfs_agbno_to_fsb(pag, xc->next_bno),
-				xc->irec_startbno + xc->irec.br_blockcount -
-				xc->next_bno);
+				irec_end - xc->next_bno);
 		if (error)
 			goto out_sa;
 	}
@@ -284,11 +291,20 @@ xrep_cow_find_bad(
 	rm_low.rm_startblock = xc->irec_startbno;
 	memset(&rm_high, 0xFF, sizeof(rm_high));
 	rm_high.rm_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	xc->next_bno = xc->irec_startbno;
 	error = xfs_rmap_query_range(sc->sa.rmap_cur, &rm_low, &rm_high,
 			xrep_cow_mark_missing_staging_rmap, xc);
 	if (error)
 		goto out_sa;
 
+	if (xc->next_bno < irec_end) {
+		error = xrep_cow_mark_file_range(xc,
+				xfs_agbno_to_fsb(pag, xc->next_bno),
+				irec_end - xc->next_bno);
+		if (error)
+			goto out_sa;
+	}
+
 	/*
 	 * If userspace is forcing us to rebuild the CoW fork or someone turned
 	 * on the debugging knob, replace everything in the CoW fork.
@@ -319,9 +335,11 @@ xrep_cow_find_bad_rt(
 	struct xfs_rmap_irec		rm_high = { 0 };
 	struct xfs_scrub		*sc = xc->sc;
 	struct xfs_rtgroup		*rtg;
+	xfs_agblock_t			irec_end;
 	int				error = 0;
 
 	xc->irec_startbno = xfs_rtb_to_rgbno(sc->mp, xc->irec.br_startblock);
+	irec_end = xc->irec_startbno + xc->irec.br_blockcount;
 
 	rtg = xfs_rtgroup_get(sc->mp,
 			xfs_rtb_to_rgno(sc->mp, xc->irec.br_startblock));
@@ -335,7 +353,7 @@ xrep_cow_find_bad_rt(
 
 	/* Mark any CoW fork extents that are shared. */
 	rc_low.rc_startblock = xc->irec_startbno;
-	rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	rc_high.rc_startblock = irec_end - 1;
 	rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_SHARED;
 	error = xfs_refcount_query_range(sc->sr.refc_cur, &rc_low, &rc_high,
 			xrep_cow_mark_shared_staging, xc);
@@ -344,7 +362,7 @@ xrep_cow_find_bad_rt(
 
 	/* Make sure there are CoW staging extents for the whole mapping. */
 	rc_low.rc_startblock = xc->irec_startbno;
-	rc_high.rc_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	rc_high.rc_startblock = irec_end - 1;
 	rc_low.rc_domain = rc_high.rc_domain = XFS_REFC_DOMAIN_COW;
 	xc->next_bno = xc->irec_startbno;
 	error = xfs_refcount_query_range(sc->sr.refc_cur, &rc_low, &rc_high,
@@ -352,11 +370,10 @@ xrep_cow_find_bad_rt(
 	if (error)
 		goto out_sr;
 
-	if (xc->next_bno < xc->irec_startbno + xc->irec.br_blockcount) {
+	if (xc->next_bno < irec_end) {
 		error = xrep_cow_mark_file_range(xc,
 				xfs_rgbno_to_rtb(rtg, xc->next_bno),
-				xc->irec_startbno + xc->irec.br_blockcount -
-				xc->next_bno);
+				irec_end - xc->next_bno);
 		if (error)
 			goto out_sr;
 	}
@@ -364,12 +381,21 @@ xrep_cow_find_bad_rt(
 	/* Mark any area has an rmap that isn't a COW staging extent. */
 	rm_low.rm_startblock = xc->irec_startbno;
 	memset(&rm_high, 0xFF, sizeof(rm_high));
-	rm_high.rm_startblock = xc->irec_startbno + xc->irec.br_blockcount - 1;
+	rm_high.rm_startblock = irec_end - 1;
+	xc->next_bno = xc->irec_startbno;
 	error = xfs_rmap_query_range(sc->sr.rmap_cur, &rm_low, &rm_high,
 			xrep_cow_mark_missing_staging_rmap, xc);
 	if (error)
 		goto out_sr;
 
+	if (xc->next_bno < irec_end) {
+		error = xrep_cow_mark_file_range(xc,
+				xfs_rgbno_to_rtb(rtg, xc->next_bno),
+				irec_end - xc->next_bno);
+		if (error)
+			goto out_sr;
+	}
+
 	/*
 	 * If userspace is forcing us to rebuild the CoW fork or someone
 	 * turned on the debugging knob, replace everything in the

From af6d2f0a32325299264c8bbd64964c96ef5143ad Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:01:00 -0700
Subject: [PATCH 0770/1982] xfs: compute the correct fdblocks/frextents for
 repair when they're negative

commit f98d007017acf0eaec2e116ff9c0ece735f61bb3 upstream.

LOLLM observed that if either fdblocks or frextents are negative, we'll
set the CORRUPT flag and exit immediately.  This doesn't work for a
repair because we still have to walk the filesystem metadata to compute
the correct summary counters so that we can install the new values.
Currently we just write zeroes into the summary counters, which isn't
right.

Cc: stable@vger.kernel.org # v6.9
Fixes: 4ed080cd7cb077 ("xfs: repair summary counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/fscounters.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index cebd0d5269260e..ac9457796bbd6f 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -541,7 +541,10 @@ xchk_fscounters(
 			return -EDEADLOCK;
 
 		xchk_set_corrupt(sc);
-		return 0;
+
+		/* Need to compute all the fields in fsc for a repair */
+		if (!xchk_could_repair(sc))
+			return 0;
 	}
 
 	/* See if icount is obviously wrong. */

From 95941108be83dd9bdeb9f53b7b72dbfafdef1827 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 22:59:11 -0700
Subject: [PATCH 0771/1982] xfs: fix ondisk symlink target validation in
 xrep_dinode_check_dfork

commit aafe21c23ad8263251085291019d8860ddc51da9 upstream.

LOLLM noticed that online repair of a broken symlink file could fail
unnecessarily if a local-format symlink target isn't null terminated.
The ondisk target isn't required to be null terminated, but repair
enforces that anyway because it uses the validator for the incore
symlink target.  (The incore buffer is always null-terminated).  Fix
this by reverting the changes to xfs_symlink_shortform_verify and adding
an ondisk-specific helper in inode_repair.c.

Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dgc@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_inode_fork.c     |  4 +---
 fs/xfs/libxfs/xfs_symlink_remote.c |  8 ++++++--
 fs/xfs/libxfs/xfs_symlink_remote.h |  2 +-
 fs/xfs/scrub/inode_repair.c        | 26 +++++++++++++++++++++++++-
 4 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 1772d82f2d68b6..08fa8df5f1d76c 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -683,9 +683,7 @@ xfs_ifork_verify_local_data(
 		break;
 	}
 	case S_IFLNK: {
-		struct xfs_ifork	*ifp = xfs_ifork_ptr(ip, XFS_DATA_FORK);
-
-		fa = xfs_symlink_shortform_verify(ifp->if_data, ifp->if_bytes);
+		fa = xfs_symlink_shortform_verify(ip);
 		break;
 	}
 	default:
diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
index fb47a76ead18c2..13fa918e040b5f 100644
--- a/fs/xfs/libxfs/xfs_symlink_remote.c
+++ b/fs/xfs/libxfs/xfs_symlink_remote.c
@@ -208,11 +208,15 @@ xfs_symlink_local_to_remote(
  */
 xfs_failaddr_t
 xfs_symlink_shortform_verify(
-	void			*sfp,
-	int64_t			size)
+	struct xfs_inode	*ip)
 {
+	struct xfs_ifork	*ifp = xfs_ifork_ptr(ip, XFS_DATA_FORK);
+	char			*sfp = (char *)ifp->if_data;
+	int			size = ifp->if_bytes;
 	char			*endp = sfp + size;
 
+	ASSERT(ifp->if_format == XFS_DINODE_FMT_LOCAL);
+
 	/*
 	 * Zero length symlinks should never occur in memory as they are
 	 * never allowed to exist on disk.
diff --git a/fs/xfs/libxfs/xfs_symlink_remote.h b/fs/xfs/libxfs/xfs_symlink_remote.h
index c1672fe1f17bb2..3f6590602473d0 100644
--- a/fs/xfs/libxfs/xfs_symlink_remote.h
+++ b/fs/xfs/libxfs/xfs_symlink_remote.h
@@ -18,7 +18,7 @@ bool xfs_symlink_hdr_ok(xfs_ino_t ino, uint32_t offset,
 void xfs_symlink_local_to_remote(struct xfs_trans *tp, struct xfs_buf *bp,
 				 struct xfs_inode *ip, struct xfs_ifork *ifp,
 				 void *priv);
-xfs_failaddr_t xfs_symlink_shortform_verify(void *sfp, int64_t size);
+xfs_failaddr_t xfs_symlink_shortform_verify(struct xfs_inode *ip);
 int xfs_symlink_remote_read(struct xfs_inode *ip, char *link);
 int xfs_symlink_write_target(struct xfs_trans *tp, struct xfs_inode *ip,
 		xfs_ino_t owner, const char *target_path, int pathlen,
diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 9aa7f8d3ff89ee..45fd71fabc73d0 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1024,6 +1024,30 @@ xrep_dinode_bad_metabt_fork(
 	return false;
 }
 
+static xfs_failaddr_t
+xrep_symlink_shortform_verify(
+	void			*sfp,
+	int64_t			size)
+{
+	/*
+	 * Zero length symlinks should never occur in memory as they are
+	 * never allowed to exist on disk.
+	 */
+	if (!size)
+		return __this_address;
+
+	/* No negative sizes or overly long symlink targets. */
+	if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+		return __this_address;
+
+	/* No NULLs in the target either. */
+	if (memchr(sfp, 0, size))
+		return __this_address;
+
+	/* ondisk symlink target isn't null terminated, unlike incore */
+	return NULL;
+}
+
 /*
  * Check the data fork for things that will fail the ifork verifiers or the
  * ifork formatters.
@@ -1099,7 +1123,7 @@ xrep_dinode_check_dfork(
 			return true;
 		/* symlink structure must pass verification. */
 		if (S_ISLNK(mode) &&
-		    xfs_symlink_shortform_verify(dfork_ptr, data_size) != NULL)
+		    xrep_symlink_shortform_verify(dfork_ptr, data_size) != NULL)
 			return true;
 		break;
 	case XFS_DINODE_FMT_EXTENTS:

From 6afaf9a32817c7871d8a8b54ed13eba7c82c83cf Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 22:58:55 -0700
Subject: [PATCH 0772/1982] xfs: fix xfs_rename_space_res for non-pptr
 filesystems

commit a800b926346c3aa2482421f5c0272280ee7d32e8 upstream.

We don't need to reserve space for a parent pointer update for an
existing target if parent pointers are disabled.  Fix this regression
(which LOLLM noticed) so that rename reservations go back to what they
were before parent pointers.

Cc: stable@vger.kernel.org # v6.10
Fixes: 5a8338c88284df ("xfs: Add parent pointers to rename")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_trans_space.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_trans_space.c b/fs/xfs/libxfs/xfs_trans_space.c
index b9dc3752f702ce..ff276cadf3f7f7 100644
--- a/fs/xfs/libxfs/xfs_trans_space.c
+++ b/fs/xfs/libxfs/xfs_trans_space.c
@@ -112,10 +112,10 @@ xfs_rename_space_res(
 		if (has_whiteout)
 			ret += xfs_parent_calc_space_res(mp, src_namelen);
 		ret += 2 * xfs_parent_calc_space_res(mp, target_namelen);
-	}
 
-	if (target_exists)
-		ret += xfs_parent_calc_space_res(mp, target_namelen);
+		if (target_exists)
+			ret += xfs_parent_calc_space_res(mp, target_namelen);
+	}
 
 	return ret;
 }

From 83c2efaba8665aca902e440ff78d9b22c0449728 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 22:57:37 -0700
Subject: [PATCH 0773/1982] xfs: fix missing xfs_qm_adjust_dqlimits call in
 quotacheck repair

commit da483b8a9c2c3e7b23655699680feb57a194000c upstream.

LOLLM noticed that everywhere else in the kernel, a call to
xfs_qm_adjust_dqlimits precedes every call to xfs_qm_adjust_dqtimers.
In particular, mount-time quotacheck does this, but online quotacheck
does not.

Looking at xfs_qm_adjust_dqlimits, that function is in charge of
conveying default limits to a dquot if that dquot's limits have been
zeroed.  That's quite possible in a repair, so we actually need to do
that.

However, there's a pre-existing pattern in the kernel -- for non-root
dquots, first we call xfs_qm_adjust_dqlimits to set the dquot's limits
to the defaults if they are zero, and then xfs_qm_adjust_dqtimers to
start grace periods if the dquot's usage is above the softlimit.  The
grace period decision cannot be made correctly if we forget to import
the default limits.

Therefore, let's combine both into a single xfs_qm_adjust_dqenforcement
helper that takes care of both pieces, which fixes quotacheck and makes
it hard to repeat this mistake.

Cc: stable@vger.kernel.org # v6.9
Fixes: 96ed2ae4a9b06b ("xfs: repair dquots based on live quotacheck results")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/quota_repair.c      |  5 +----
 fs/xfs/scrub/quotacheck_repair.c |  3 +--
 fs/xfs/xfs_dquot.c               | 20 +++++++++++++++-----
 fs/xfs/xfs_dquot.h               |  2 +-
 fs/xfs/xfs_qm.c                  |  6 +-----
 fs/xfs/xfs_trans_dquot.c         |  6 +-----
 6 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/fs/xfs/scrub/quota_repair.c b/fs/xfs/scrub/quota_repair.c
index 811eb6093bb6af..43cb7e5c635805 100644
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -252,10 +252,7 @@ xrep_quota_item(
 
 	dq->q_flags |= XFS_DQFLAG_DIRTY;
 	xfs_trans_dqjoin(sc->tp, dq);
-	if (dq->q_id) {
-		xfs_qm_adjust_dqlimits(dq);
-		xfs_qm_adjust_dqtimers(dq);
-	}
+	xfs_qm_adjust_dqenforcement(dq);
 	xfs_trans_log_dquot(sc->tp, dq);
 	error = xfs_trans_roll(&sc->tp);
 	xfs_dqlock(dq);
diff --git a/fs/xfs/scrub/quotacheck_repair.c b/fs/xfs/scrub/quotacheck_repair.c
index dd8554c755b5bf..e78bdb45d0eec1 100644
--- a/fs/xfs/scrub/quotacheck_repair.c
+++ b/fs/xfs/scrub/quotacheck_repair.c
@@ -112,8 +112,7 @@ xqcheck_commit_dquot(
 
 	/* Commit the dirty dquot to disk. */
 	dq->q_flags |= XFS_DQFLAG_DIRTY;
-	if (dq->q_id)
-		xfs_qm_adjust_dqtimers(dq);
+	xfs_qm_adjust_dqenforcement(dq);
 	xfs_trans_log_dquot(xqc->sc->tp, dq);
 
 	/*
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index cce1f86098bd35..8c134e999a4eaf 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -115,18 +115,15 @@ xfs_qm_dqdestroy(
  * We overwrite the dquot limits only if they are zero and this
  * is not the root dquot.
  */
-void
+static void
 xfs_qm_adjust_dqlimits(
 	struct xfs_dquot	*dq)
 {
 	struct xfs_mount	*mp = dq->q_mount;
 	struct xfs_quotainfo	*q = mp->m_quotainfo;
-	struct xfs_def_quota	*defq;
+	struct xfs_def_quota	*defq = xfs_get_defquota(q, xfs_dquot_type(dq));
 	int			prealloc = 0;
 
-	ASSERT(dq->q_id);
-	defq = xfs_get_defquota(q, xfs_dquot_type(dq));
-
 	if (!dq->q_blk.softlimit) {
 		dq->q_blk.softlimit = defq->blk.soft;
 		prealloc = 1;
@@ -223,6 +220,19 @@ xfs_qm_adjust_dqtimers(
 	xfs_qm_adjust_res_timer(dq->q_mount, &dq->q_rtb, &defq->rtb);
 }
 
+/* Adjust enforcement limits and timers after a change in usage. */
+void
+xfs_qm_adjust_dqenforcement(
+	struct xfs_dquot	*dq)
+{
+	if (dq->q_id == 0)
+		return;
+
+	xfs_qm_adjust_dqlimits(dq);
+	xfs_qm_adjust_dqtimers(dq);
+	dq->q_flags |= XFS_DQFLAG_DIRTY;
+}
+
 /*
  * initialize a buffer full of dquots and log the whole thing
  */
diff --git a/fs/xfs/xfs_dquot.h b/fs/xfs/xfs_dquot.h
index 61217adf5ba551..37e944fd616977 100644
--- a/fs/xfs/xfs_dquot.h
+++ b/fs/xfs/xfs_dquot.h
@@ -220,7 +220,7 @@ void		xfs_qm_dqdestroy(struct xfs_dquot *dqp);
 int		xfs_qm_dqflush(struct xfs_dquot *dqp, struct xfs_buf *bp);
 void		xfs_qm_dqunpin_wait(struct xfs_dquot *dqp);
 void		xfs_qm_adjust_dqtimers(struct xfs_dquot *d);
-void		xfs_qm_adjust_dqlimits(struct xfs_dquot *d);
+void		xfs_qm_adjust_dqenforcement(struct xfs_dquot *d);
 xfs_dqid_t	xfs_qm_id_for_quotatype(struct xfs_inode *ip,
 				xfs_dqtype_t type);
 int		xfs_qm_dqget(struct xfs_mount *mp, xfs_dqid_t id,
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 48a5a294f0a132..5008b174ebd2b2 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -1341,11 +1341,7 @@ xfs_qm_quotacheck_dqadjust(
 	 *
 	 * There are no timers for the default values set in the root dquot.
 	 */
-	if (dqp->q_id) {
-		xfs_qm_adjust_dqlimits(dqp);
-		xfs_qm_adjust_dqtimers(dqp);
-	}
-
+	xfs_qm_adjust_dqenforcement(dqp);
 	dqp->q_flags |= XFS_DQFLAG_DIRTY;
 out_unlock:
 	xfs_qm_dqput(dqp);
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 765456bf342851..0168b979de525a 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -566,11 +566,7 @@ xfs_trans_apply_dquot_deltas(
 			 * Get any default limits in use.
 			 * Start/reset the timer(s) if needed.
 			 */
-			if (dqp->q_id) {
-				xfs_qm_adjust_dqlimits(dqp);
-				xfs_qm_adjust_dqtimers(dqp);
-			}
-
+			xfs_qm_adjust_dqenforcement(dqp);
 			dqp->q_flags |= XFS_DQFLAG_DIRTY;
 			/*
 			 * add this to the list of items to get logged

From 173eb03891f4cf7f390521e66cdc5f203dbed591 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 22:58:08 -0700
Subject: [PATCH 0774/1982] xfs: fix buffer overruns in xfs_ioc_attr_list

commit 0b9081a774ee7b9dff1e9ac3765b73c1d6bba5b2 upstream.

When we converted the al_offset array in struct xfs_attrlist into a VLA,
the size of the object shrank by 4 bytes.  Unfortunately, the buffer
size validation in the attrlist ioctl wasn't updated to notice this, so
the al_offset[0] assignment blindly writes off the end of the buffer.
LOLLM noticed the omitted check and complained.

Cc: stable@vger.kernel.org # v6.5
Fixes: 371baf5c9750a2 ("xfs: convert flex-array declarations in struct xfs_attrlist*")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_handle.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_handle.c b/fs/xfs/xfs_handle.c
index f19fce557354ec..7c9bfe023de2ec 100644
--- a/fs/xfs/xfs_handle.c
+++ b/fs/xfs/xfs_handle.c
@@ -431,7 +431,7 @@ xfs_ioc_attr_list(
 	void				*buffer;
 	int				error;
 
-	if (bufsize < sizeof(struct xfs_attrlist) ||
+	if (bufsize < struct_size(alist, al_offset, 1) ||
 	    bufsize > XFS_XATTR_LIST_MAX)
 		return -EINVAL;
 

From c937966701c230d273cf0b953049fc9f9e48bba6 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 22:57:53 -0700
Subject: [PATCH 0775/1982] xfs: online quotacheck must dirty dquot if
 enforcement adjustments needed

commit 244425cf63d7e3a0ff5736b41f0e0afe807f7031 upstream.

LOLLM noticed that we have no way to force xchk_commit_dquot to call
xfs_qm_adjust_dqenforcement if nothing else is wrong with the dquot.
Therefore, add a new predicate to force the dirty flag if the dquot has
zero limits and there are default limits; or if the grace period timer
needs adjusting.

Cc: stable@vger.kernel.org # v6.9
Fixes: 96ed2ae4a9b06b ("xfs: repair dquots based on live quotacheck results")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/quotacheck_repair.c | 51 ++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/fs/xfs/scrub/quotacheck_repair.c b/fs/xfs/scrub/quotacheck_repair.c
index e78bdb45d0eec1..fcafda71017888 100644
--- a/fs/xfs/scrub/quotacheck_repair.c
+++ b/fs/xfs/scrub/quotacheck_repair.c
@@ -39,6 +39,54 @@
  * dquot is locked.
  */
 
+static bool
+xqcheck_dqres_force_dirty(
+	const struct xfs_dquot_res	*res,
+	const struct xfs_quota_limits	*qlim)
+{
+	/* zero limits mean that we should set the default limits */
+	if (res->softlimit == 0 && qlim->soft != 0)
+		return true;
+	if (res->hardlimit == 0 && qlim->hard != 0)
+		return true;
+
+	/* do we need to adjust the timer setting? */
+	if ((res->softlimit && res->count > res->softlimit) ||
+	    (res->hardlimit && res->count > res->hardlimit)) {
+		if (!res->timer)
+			return true;
+	} else {
+		if (res->timer)
+			return true;
+	}
+
+	return false;
+}
+
+/* Decide if we need to adjust the dquot limits or timers */
+static bool
+xqcheck_dquot_force_dirty(
+	const struct xfs_dquot	*dq)
+{
+	struct xfs_quotainfo	*qi = dq->q_mount->m_quotainfo;
+	struct xfs_def_quota	*defq;
+
+	/* root dquot does not enforce limits */
+	if (dq->q_id == 0)
+		return false;
+
+	defq = xfs_get_defquota(qi, xfs_dquot_type(dq));
+
+	if (xqcheck_dqres_force_dirty(&dq->q_blk, &defq->blk))
+		return true;
+	if (xqcheck_dqres_force_dirty(&dq->q_ino, &defq->ino))
+		return true;
+	if (xqcheck_dqres_force_dirty(&dq->q_rtb, &defq->rtb))
+		return true;
+
+	return false;
+}
+
 /* Commit new counters to a dquot. */
 static int
 xqcheck_commit_dquot(
@@ -93,6 +141,9 @@ xqcheck_commit_dquot(
 		dirty = true;
 	}
 
+	if (!dirty && xqcheck_dquot_force_dirty(dq))
+		dirty = true;
+
 	xcdq.flags |= (XQCHECK_DQUOT_REPAIR_SCANNED | XQCHECK_DQUOT_WRITTEN);
 	error = xfarray_store(counts, dq->q_id, &xcdq);
 	if (error == -EFBIG) {

From 84c0abd7e70fde9f2f61f06287dbee82734e664a Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:03:52 -0700
Subject: [PATCH 0776/1982] xfs: avoid cross-rtgroup reaping after a repair

commit d7c204d4ea7ef0cf0dac908388984c2936f1f94e upstream.

LOLLM notices that the extents stored in a xrtb_bitmap (aka xfs_rtblock
bitmap) can span multiple rtgroups due to two circumstances.  The first
is that the size of an rtgroup is an exact power of two, which means
that rtgroups are adjacent in the segmented xfs_rtblock_t address space.
This is fairly common to reduce the amount of multiplication and
division needed to handle space on the rt volume.

The second is that (unlike in the original rtgroups design), rtgroups do
not have fixed-location metadata like AGs do, which means that there's
nothing to force a break between rtgroups.

Therefore, we must loop through the rtgroups in xreap_rtmeta_extent to
avoid running off the end of an rtgroup while reaping.

Cc: stable@vger.kernel.org # v6.14
Fixes: fd97fe1112088c ("xfs: fix CoW forks for realtime files")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/reap.c | 59 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 48 insertions(+), 11 deletions(-)

diff --git a/fs/xfs/scrub/reap.c b/fs/xfs/scrub/reap.c
index 116afa89b1b3e1..a2c68bda7b7c08 100644
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -1080,26 +1080,23 @@ xreap_configure_rgcow_limits(
 				 XFS_RTGLOCK_RMAP | \
 				 XFS_RTGLOCK_REFCOUNT)
 
-/*
- * Break a rt file metadata extent into sub-extents by fate (crosslinked, not
- * crosslinked), and dispose of each sub-extent separately.  The extent must
- * be aligned to a realtime extent.
- */
-STATIC int
-xreap_rtmeta_extent(
-	uint64_t		rtbno,
+static int
+xreap_rtgroup_extent(
+	struct xreap_state	*rs,
+	xfs_rtblock_t		rtbno,
 	uint64_t		len,
-	void			*priv)
+	xfs_rgblock_t		*done)
 {
-	struct xreap_state	*rs = priv;
 	struct xfs_scrub	*sc = rs->sc;
 	xfs_rgblock_t		rgbno = xfs_rtb_to_rgbno(sc->mp, rtbno);
-	xfs_rgblock_t		rgbno_next = rgbno + len;
+	xfs_rgblock_t		rgbno_next;
 	int			error = 0;
 
 	ASSERT(sc->ip != NULL);
 	ASSERT(!sc->sr.rtg);
 
+	*done = 0;
+
 	/*
 	 * We're reaping blocks after repairing file metadata, which means that
 	 * we have to init the xchk_ag structure ourselves.
@@ -1110,6 +1107,7 @@ xreap_rtmeta_extent(
 
 	xfs_rtgroup_lock(sc->sr.rtg, XREAP_RTGLOCK_ALL);
 
+	rgbno_next = rgbno + min(len, (uint64_t)rtg_blocks(sc->sr.rtg) - rgbno);
 	while (rgbno < rgbno_next) {
 		xfs_extlen_t	rglen;
 		bool		crosslinked;
@@ -1136,6 +1134,7 @@ xreap_rtmeta_extent(
 		}
 
 		rgbno += rglen;
+		*done += rglen;
 	}
 
 out_unlock:
@@ -1145,6 +1144,44 @@ xreap_rtmeta_extent(
 	return error;
 }
 
+/*
+ * Break a rt file metadata extent into sub-extents by fate (crosslinked, not
+ * crosslinked), and dispose of each sub-extent separately.  The extent must
+ * be aligned to a realtime extent.
+ */
+STATIC int
+xreap_rtmeta_extent(
+	uint64_t		rtbno,
+	uint64_t		len,
+	void			*priv)
+{
+	struct xreap_state	*rs = priv;
+	int			error;
+
+	/*
+	 * Space from adjacent rtgroups can be stored as a single bitmap extent
+	 * because rtgroups do not have fixed-location metadata such as a
+	 * per-group superblock that cannot be reaped.  Handle these overlaps
+	 * by only reaping within a single rtgroup at a time.
+	 *
+	 * In the somewhat unlikely event that an rtgroup size is not a power
+	 * of two, the segmented nature of xfs_rtblock_t prevents space in
+	 * adjacent rtgroups from merging in the bitmap.
+	 */
+	while (len > 0) {
+		xfs_rgblock_t	done = 0;
+
+		error = xreap_rtgroup_extent(rs, rtbno, len, &done);
+		if (error)
+			return error;
+
+		rtbno += done;
+		len -= done;
+	}
+
+	return 0;
+}
+
 /*
  * Dispose of every block of every rt metadata extent in the bitmap.
  * Do not use this to dispose of the mappings in an ondisk inode fork.

From 83f274a69ba6379a50780a7cb117b9052d3a8e6f Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:03:36 -0700
Subject: [PATCH 0777/1982] xfs: actually lock the metafile reservation when
 adjusting after repair

commit e53c620b3670fc0c162b5f768a10a3a17d0c04f6 upstream.

LOLLM reported that xrep_reset_metafile_resv performs unlocked loads
and stores to the metadata file space reservation counters and thus can
race with other threads.  Fix this by taking the lock.

Cc: hch@lst.de
Cc: stable@vger.kernel.org # v6.15
Fixes: 1df8d75030b787 ("xfs: make metabtree reservations global")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/repair.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/xfs/scrub/repair.c b/fs/xfs/scrub/repair.c
index 99d7f697fbbdb3..be49cc936a0d65 100644
--- a/fs/xfs/scrub/repair.c
+++ b/fs/xfs/scrub/repair.c
@@ -1377,12 +1377,14 @@ xrep_reset_metafile_resv(
 {
 	struct xfs_mount	*mp = sc->mp;
 	int64_t			delta;
-	int			error;
+	int			error = 0;
+
+	mutex_lock(&mp->m_metafile_resv_lock);
 
 	delta = mp->m_metafile_resv_used + mp->m_metafile_resv_avail -
 		mp->m_metafile_resv_target;
 	if (delta == 0)
-		return 0;
+		goto out_resv_lock;
 
 	/*
 	 * Too many blocks have been reserved, transfer some from the incore
@@ -1398,7 +1400,7 @@ xrep_reset_metafile_resv(
 			mp->m_metafile_resv_avail -= give_back;
 		}
 
-		return 0;
+		goto out_resv_lock;
 	}
 
 	/*
@@ -1412,14 +1414,18 @@ xrep_reset_metafile_resv(
 		if (delta == 0) {
 			xfs_warn(sc->mp,
 "Insufficient free space to reset metabtree reservation after repair.");
-			return 0;
+			error = 0;
+			goto out_resv_lock;
 		}
 		error = xfs_dec_fdblocks(mp, delta, true);
 	}
 	if (error)
-		return error;
+		goto out_resv_lock;
 
 	xfs_mod_sb_delalloc(mp, delta);
 	mp->m_metafile_resv_avail += delta;
-	return 0;
+
+out_resv_lock:
+	mutex_unlock(&mp->m_metafile_resv_lock);
+	return error;
 }

From 1519f7a63f663afef62a2c2e1ec1b75881220936 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:03:20 -0700
Subject: [PATCH 0778/1982] xfs: fix unnecessary dapos truncation in
 xchk_dir_walk

commit f60a2ef8d8a7ac6dedf4d0c3325cc3fc2fe0d948 upstream.

LOLLM points out that the all the implementations of xchk_dirent_fn can
handle a signed @dapos parameter, so the truncation here breaks the
information captured in scrub tracepoints if the directory is very
large.  I don't think it ever made sense to do the truncation for the
VFS readdir code for programs that can handle 64-bit offsets, but commit
15440319767942 has been around for 17 years without complaints so I'll
leave that alone.

Stumbled-over: 15440319767942 ("[XFS] truncate readdir offsets to signed 32 bit values")
Cc: stable@vger.kernel.org # v6.4
Fixes: 4c233b5c4f29df ("xfs: streamline the directory iteration code for scrub")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/readdir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/readdir.c b/fs/xfs/scrub/readdir.c
index 01c9a2dc0f2c48..a95e460d60473d 100644
--- a/fs/xfs/scrub/readdir.c
+++ b/fs/xfs/scrub/readdir.c
@@ -238,7 +238,7 @@ xchk_dir_walk_leaf(
 		dep = bp->b_addr + offset;
 		length = xfs_dir2_data_entsize(mp, dep->namelen);
 
-		dapos = xfs_dir2_byte_to_dataptr(curoff) & 0x7fffffff;
+		dapos = xfs_dir2_byte_to_dataptr(curoff);
 		ino = be64_to_cpu(dep->inumber);
 		name.name = dep->name;
 		name.len = dep->namelen;

From 779f9d180b4b1fdf2d4b045a1acd763043ee83c3 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:02:34 -0700
Subject: [PATCH 0779/1982] xfs: fix buffer overflow in corrupt inline attr
 structure

commit 017dd7a84ff4cd2275eb62f4ee6d63c705bac107 upstream.

LOLLM noticed a buffer overrun if the xattr scrubber encounters a file
with a shortform attr fork with sf->count > 0 but if_bytes ==
sizeof(struct xfs_attr_sf_hdr).  Basically, we have enough data to have
a header with a nonzero count, but no space for any of those shortform
entries.  In this case, the xfs_attr_sf_nextentry() call will run off
the end of if_data and blow up.

Cc: stable@vger.kernel.org # v6.4
Fixes: ae0506eba78fd1 ("xfs: check used space of shortform xattr structures")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr.c        | 11 +++++++++--
 fs/xfs/scrub/attr_repair.c |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index a0878fdbcf3866..de50760cdc988e 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -590,12 +590,17 @@ xchk_xattr_check_sf(
 	}
 
 	for (i = 0; i < sf->count; i++) {
-		unsigned char		*name = sfe->nameval;
-		unsigned char		*value = &sfe->nameval[sfe->namelen];
+		unsigned char		*name;
+		unsigned char		*value;
 
 		if (xchk_should_terminate(sc, &error))
 			return error;
 
+		if ((unsigned char *)(sfe + 1) >= end) {
+			xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
+			break;
+		}
+
 		next = xfs_attr_sf_nextentry(sfe);
 		if ((unsigned char *)next > end) {
 			xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, 0);
@@ -618,6 +623,7 @@ xchk_xattr_check_sf(
 			break;
 		}
 
+		name = sfe->nameval;
 		if (!xchk_xattr_set_map(sc, ab->usedmap,
 				(char *)name - (char *)sf,
 				sfe->namelen)) {
@@ -625,6 +631,7 @@ xchk_xattr_check_sf(
 			break;
 		}
 
+		value = &sfe->nameval[sfe->namelen];
 		if (!xchk_xattr_set_map(sc, ab->usedmap,
 				(char *)value - (char *)sf,
 				sfe->valuelen)) {
diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index 6f668ddea81975..1aa70316ec304d 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -477,6 +477,9 @@ xrep_xattr_recover_sf(
 		if (xchk_should_terminate(sc, &error))
 			return error;
 
+		if ((unsigned char *)(sfe + 1) >= end)
+			break;
+
 		next = xfs_attr_sf_nextentry(sfe);
 		if ((unsigned char *)next > end)
 			break;

From b50c563a99cb35e9edf1b00934ab3d5f0da4d3a5 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:02:49 -0700
Subject: [PATCH 0780/1982] xfs: actually report corrupt xattrs as XFAIL during
 cross-referencing

commit b339cc253019518c61b8b150fb7ea727fdae59f4 upstream.

Some LLM reports that xchk_dir_parent_pointer really ought to report
xattr corruption errors as XFAIL (cross-referencing failed) when a
directory scrub tries to find the parent pointer for a dirent name.
Let's do that.

Cc: stable@vger.kernel.org # v6.10
Fixes: 61b3f0df5c2358 ("xfs: check dirents have parent pointers")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dir.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index 95ddb991e4787d..7b0a9d2aea3ec1 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -155,6 +155,8 @@ xchk_dir_parent_pointer(
 			&sd->pptr_args);
 	if (error == -ENOATTR)
 		xchk_fblock_xref_set_corrupt(sc, XFS_DATA_FORK, 0);
+	else
+		xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error);
 
 	return 0;
 }

From 3b7198678a3a91660db33c41625dfdc4056ffe29 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 22 Sep 2026 23:02:02 -0700
Subject: [PATCH 0781/1982] xfs: fix inode btree repair when a cluster is
 larger than a chunk

commit 65b89ac3e8c2f041384f715a71b9d113edfa32e5 upstream.

LOLLM noticed that on filesystems where an inode cluster buffer is
larger than an inode chunk, we can run through the loop body in
xrep_ibt_process_cluster more than once, and the number of inodes that
we pass to xrep_ibt_cluster_record is incorrectly large.  In this case
we can run right off the end of the buffer.  Fix this by moving the
nr_inodes computation inside the loop.

Note that this is only likely to happen on filesystems with (say) 512b
inodes and 64k fsblocks.

Cc: stable@vger.kernel.org # v6.8
Fixes: dbfbf3bdf639a2 ("xfs: repair inode btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/ialloc_repair.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/xfs/scrub/ialloc_repair.c b/fs/xfs/scrub/ialloc_repair.c
index f28459f58832f4..15842954a787d1 100644
--- a/fs/xfs/scrub/ialloc_repair.c
+++ b/fs/xfs/scrub/ialloc_repair.c
@@ -294,12 +294,8 @@ xrep_ibt_process_cluster(
 	struct xfs_ino_geometry	*igeo = M_IGEO(mp);
 	xfs_agino_t		cluster_ag_base;
 	xfs_agino_t		irec_index;
-	unsigned int		nr_inodes;
 	int			error;
 
-	nr_inodes = min_t(unsigned int, igeo->inodes_per_cluster,
-			XFS_INODES_PER_CHUNK);
-
 	/*
 	 * Grab the inode cluster buffer.  This is safe to do with a broken
 	 * inobt because imap_to_bp directly maps the buffer without touching
@@ -320,6 +316,10 @@ xrep_ibt_process_cluster(
 	for (irec_index = 0;
 	     irec_index < igeo->inodes_per_cluster;
 	     irec_index += XFS_INODES_PER_CHUNK) {
+		unsigned int	nr_inodes =
+			min_t(unsigned int, XFS_INODES_PER_CHUNK,
+					igeo->inodes_per_cluster - irec_index);
+
 		error = xrep_ibt_cluster_record(ri,
 				cluster_ag_base + irec_index, cluster_bp,
 				nr_inodes);

From a9e94a4cd5a0ed3e875f03c9495f014d3ba71744 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:56:35 -0700
Subject: [PATCH 0782/1982] xfs: always reset incore attr fork buffer when
 resetting fork

commit 71cb13685e72a3c5d118732559c727a0c9090b7f upstream.

LOLLM noticed that the local format attr fork verifier depends on
if_bytes being set correctly.  However, the fork reset function doesn't
reset that correctly, which can cause post-repair verifier failures.
Fix that.

Cc: stable@vger.kernel.org # v6.10
Fixes: e5d7ce0364d8ee ("xfs: replay unlocked parent pointer updates that accrue during xattr repair")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr_repair.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index 1aa70316ec304d..015aedee2f7508 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -840,11 +840,11 @@ xrep_xattr_full_reset(
 
 		ASSERT(ifp->if_bytes == 0);
 		ifp->if_format = XFS_DINODE_FMT_LOCAL;
-		xfs_idata_realloc(sc->tempip, sizeof(*hdr), XFS_ATTR_FORK);
 	}
 
 	/* Reinitialize the attr fork to an empty shortform structure. */
-	hdr = ifp->if_data;
+	hdr = xfs_idata_realloc(sc->tempip,
+			(int64_t)sizeof(*hdr) - ifp->if_bytes, XFS_ATTR_FORK);
 	memset(hdr, 0, sizeof(*hdr));
 	hdr->totsize = cpu_to_be16(sizeof(*hdr));
 	xfs_trans_log_inode(sc->tp, sc->tempip, XFS_ILOG_CORE | XFS_ILOG_ADATA);

From 56192355a67e9a42b1b941c3c6a615c909df4350 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:56:20 -0700
Subject: [PATCH 0783/1982] xfs: don't pass iget failures up when marking
 ondisk inodes

commit 7f5e8bf335e5e257fb82cf5b3521980ded60e863 upstream.

LOLLM observes a couple of problems with this callsite -- an ENOMEM
return is completely ignored and a subsequent run through the loop body
obliterates the return value completely.  Also, an error value
indicating that the list is corrupt can get passed up (thus terminating
the repair) even though we can handle corrupt lists.  Fix the callsite
not to have these problems.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/agheader_repair.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/agheader_repair.c b/fs/xfs/scrub/agheader_repair.c
index 925b761e56fbb0..caa04b5c60bc36 100644
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1331,8 +1331,12 @@ xrep_iunlink_mark_ondisk_rec(
 		 */
 		error = xchk_iget(ragi->sc, xfs_agino_to_ino(sc->sa.pag, agino),
 				&ip);
-		if (error)
+		if (error == -ENOMEM)
+			return error;
+		if (error) {
+			error = 0;
 			continue;
+		}
 
 		trace_xrep_iunlink_reload_ondisk(ip);
 

From e065e5f8dfa4a40fb5b2f89281c50af0bed2ed59 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:55:48 -0700
Subject: [PATCH 0784/1982] xfs: zero out di_metatype when removing the metadir
 file iflag

commit f5b4d8c8ce16675f77c25a4ff06caaa9a2739f31 upstream.

LOLLM pointed out that we should zero di_metatype (fka di_onlink) when
we're clearing the METADIR inode flag because the file is no longer a
metadata file.

Cc: stable@vger.kernel.org # v6.13
Fixes: 7297fd0bebbd70 ("xfs: enforce metadata inode flag")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 45fd71fabc73d0..daefe74349b28d 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -579,8 +579,10 @@ xrep_dinode_flags(
 
 		fa = xfs_dinode_verify_metadir(sc->mp, dip, mode, flags,
 				flags2);
-		if (fa)
+		if (fa) {
 			flags2 &= ~XFS_DIFLAG2_METADATA;
+			dip->di_metatype = cpu_to_be16(XFS_METAFILE_UNKNOWN);
+		}
 	}
 
 	dip->di_flags = cpu_to_be16(flags);

From 6b7f9ab7610b42d5d8c3f425f53a1dc3dffb8667 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:55:33 -0700
Subject: [PATCH 0785/1982] xfs: flag excessive delalloc rt extents as
 corruption

commit 2b47be015a5e54f4a3d62afa636ba593de9b67f6 upstream.

LOLLM observed that we should not allow repairs to proceed if the count
of delayed-allocation realtime extents exceeds the number of free rt
extents because we can't install negative numbers into the superblock.
It's unclear how we could end up in that state in real life, but let's
at least complain loudly about it if we ever encounter it.

Cc: stable@vger.kernel.org # v6.2
Fixes: e74331d6fa2c21 ("xfs: online checking of the free rt extent count")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/fscounters.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index ac9457796bbd6f..69c9eb18bc2a31 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -607,6 +607,13 @@ xchk_fscounters(
 			try_again = true;
 	}
 
+	if (!xfs_has_zoned(mp) && fsc->frextents < fsc->frextents_delayed) {
+		if (fsc->frozen)
+			xchk_set_incomplete(sc);
+		else
+			try_again = true;
+	}
+
 	if (!xfs_has_zoned(mp) &&
 	    !xchk_fscount_within_range(sc, frextents,
 			&mp->m_free[XC_FREE_RTEXTENTS].count,

From 18773e41e92b21f4f8082f12750404bea4caab0a Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:18:57 -0700
Subject: [PATCH 0786/1982] xfs: don't fix the directory tree if live update
 fails

commit c8226f3d1a7eafe472addc232689e9c9a0c36a1c upstream.

LOLLM complains that we don't double-check dl->aborted one last time to
before committing repairs to the filesystem.  This is important because
the live update handler could have set ->aborted if it encountered a
runtime error.

Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dirtree_repair.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 219c6b4c6b7a11..5cdb7467766b65 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -427,6 +427,11 @@ xrep_dirtree_unlink(
 		error = -ESTALE;
 		goto out_trans_cancel;
 	}
+	if (dl->aborted) {
+		mutex_unlock(&dl->lock);
+		error = -EIO;
+		goto out_trans_cancel;
+	}
 	xrep_dirpath_set_outcome(dl, path, XREP_DIRPATH_DELETING);
 	mutex_unlock(&dl->lock);
 

From 8edb7edb9d33714d128758c5127324059b703b4f Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@redhat.com>
Date: Tue, 29 Sep 2026 18:13:05 -0500
Subject: [PATCH 0787/1982] xfs: validate rc_domain in
 xchk_rtrefcount_mergeable

commit f04361fb8694bff98ec61e2e2030a1993426fdca upstream.

xchk_refcount_mergeable validates that the domains match, but this
was omitted from the realtime version of the check; fix it.

Fixes: c27929670de144 ("xfs: scrub the realtime refcount btree")
Cc: stable@vger.kernel.org # v6.14
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/rtrefcount.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/scrub/rtrefcount.c b/fs/xfs/scrub/rtrefcount.c
index a6f2d66de3a8b1..089d7cd0398637 100644
--- a/fs/xfs/scrub/rtrefcount.c
+++ b/fs/xfs/scrub/rtrefcount.c
@@ -380,6 +380,8 @@ xchk_rtrefcount_mergeable(
 	if (r1->rc_blockcount == 0)
 		return false;
 
+	if (r1->rc_domain != r2->rc_domain)
+		return false;
 	if (r1->rc_startblock + r1->rc_blockcount != r2->rc_startblock)
 		return false;
 	if (r1->rc_refcount != r2->rc_refcount)

From 0c5802d7be2bd122ddd8922f262cab8be2e977d5 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:18:41 -0700
Subject: [PATCH 0788/1982] xfs: don't proceed with xattr repair if the live
 update fails

commit 833f98b3be45bc7c6ce4c87bdc4892f546ab72ee upstream.

LOLLM observes that we ought to make one last check for failed live
updates before replacing the xattr structure.  Let's be cautious here.

Cc: stable@vger.kernel.org # v6.10
Fixes: e5d7ce0364d8ee ("xfs: replay unlocked parent pointer updates that accrue during xattr repair")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr_repair.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index 015aedee2f7508..a1d33a1ceaf899 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1477,6 +1477,9 @@ xrep_xattr_rebuild_tree(
 	if (error)
 		return error;
 
+	if (rx->live_update_aborted)
+		return -EIO;
+
 	/*
 	 * Exchange the blocks mapped by the tempfile's attr fork with the file
 	 * being repaired.  The old attr blocks will then be attached to the

From b5891acd62d82d8ef24b81cf1ca72206aa566d98 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:18:25 -0700
Subject: [PATCH 0789/1982] xfs: fix skipped inode mask handling in iscan

commit 63341d4af16fe850716b454fcd18990590d07d97 upstream.

xfs_highbit64() returns -1 if none of the bits in its argument are set.
In this particular callsite, a totally zeroed mask means that no inodes
were skipped, so executing the if-body is incorrect.  Fix that.

Cc: stable@vger.kernel.org # v6.9
Fixes: 82334a79c6eb1c ("xfs: iscan batching should handle unallocated inodes too")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/iscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/iscan.c b/fs/xfs/scrub/iscan.c
index 84f117667ca2bf..c455e8494b26b0 100644
--- a/fs/xfs/scrub/iscan.c
+++ b/fs/xfs/scrub/iscan.c
@@ -545,7 +545,7 @@ xchk_iscan_finish_batch(
 
 	mutex_lock(&iscan->lock);
 
-	if (iscan->__batch_ino != NULLFSINO) {
+	if (iscan->__batch_ino != NULLFSINO && iscan->__skipped_inomask) {
 		highest_skipped = iscan->__batch_ino +
 					xfs_highbit64(iscan->__skipped_inomask);
 		iscan->__visited_ino = max(iscan->__visited_ino,

From 1fc1a5a2419a5315872c239e8c56c6dbf26539ae Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:17:23 -0700
Subject: [PATCH 0790/1982] xfs: don't repair fs summary counters with garbage

commit 22a8a7501c0146dba4ce99b8256975ffe945125d upstream.

LOLLM noticed that if we scan the filesystem and come up with totally
garbage numbers for the summary counters, we don't actually mark the
scan incomplete.  Because we don't do this, repair can install the
garbage values into the filesystem, making things worse.  Don't do that.

Cc: stable@vger.kernel.org # v6.9
Fixes: 4ed080cd7cb077 ("xfs: repair summary counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/fscounters.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index 69c9eb18bc2a31..c32c08443c7a30 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -368,8 +368,10 @@ xchk_fscount_aggregate_agcounts(
 	/* Bail out if the values we compute are totally nonsense. */
 	if (fsc->icount < fsc->icount_min || fsc->icount > fsc->icount_max ||
 	    fsc->fdblocks > mp->m_sb.sb_dblocks ||
-	    fsc->ifree > fsc->icount_max)
+	    fsc->ifree > fsc->icount_max) {
+		xchk_set_incomplete(sc);
 		return -EFSCORRUPTED;
+	}
 
 	/*
 	 * If ifree > icount then we probably had some perturbation in the

From 5cdd8d436feba462a2f7a41bf04bc3bfe84c17fc Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:18:10 -0700
Subject: [PATCH 0791/1982] xfs: fix lost errno returned from xfarray_foliosort

commit 8c4f172c246717b1420f138a159ed15c315a58bd upstream.

LOLLM noticed that we stop the sort early but don't actually pass along
the error code, which could enable repair code to continue running with
an unsorted array.  Fix that.

Cc: stable@vger.kernel.org # v6.9
Fixes: ee13fc67205b98 ("xfs: convert xfarray_pagesort to deal with large folios")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/xfarray.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/xfarray.c b/fs/xfs/scrub/xfarray.c
index a3ad0b3235761f..ccf7cfb63bbc81 100644
--- a/fs/xfs/scrub/xfarray.c
+++ b/fs/xfs/scrub/xfarray.c
@@ -943,8 +943,10 @@ xfarray_sort(
 		 * problems, we're done.
 		 */
 		ret = xfarray_foliosort(si, lo, hi);
-		if (ret < 0)
+		if (ret < 0) {
+			error = ret;
 			goto out_free;
+		}
 		if (ret == 1) {
 			si->stack_depth--;
 			continue;

From 09b787d595590f3abba4c71f7b28d27a8d52aeb7 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:17:38 -0700
Subject: [PATCH 0792/1982] xfs: allow softlimit with no hardlimit in quota
 scrub

commit 342c2e00b3a99099a7088f7b8c8f075670c603a9 upstream.

LOLLM observes that the sysadmin can set a user's soft limit to a
nonzero value and the hard limit to zero, so those aren't corruptions.

Cc: stable@vger.kernel.org # v4.15
Fixes: c2fc338c87a31f ("xfs: scrub quota information")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/quota.c        | 8 ++++----
 fs/xfs/scrub/quota_repair.c | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/xfs/scrub/quota.c b/fs/xfs/scrub/quota.c
index 5d43a8924f090d..40d88784cfb6fa 100644
--- a/fs/xfs/scrub/quota.c
+++ b/fs/xfs/scrub/quota.c
@@ -185,21 +185,21 @@ xchk_quota_item(
 	 * suspect, which is why we flag it for review.
 	 *
 	 * Complain about corruption if the soft limit is greater than
-	 * the hard limit.
+	 * the hard limit and there's a hard limit set.
 	 */
 	if (dq->q_blk.hardlimit > mp->m_sb.sb_dblocks)
 		xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
-	if (dq->q_blk.softlimit > dq->q_blk.hardlimit)
+	if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit)
 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
 
 	if (dq->q_ino.hardlimit > M_IGEO(mp)->maxicount)
 		xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
-	if (dq->q_ino.softlimit > dq->q_ino.hardlimit)
+	if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit)
 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
 
 	if (dq->q_rtb.hardlimit > mp->m_sb.sb_rblocks)
 		xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
-	if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
+	if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
 
 	/* Check the resource counts. */
diff --git a/fs/xfs/scrub/quota_repair.c b/fs/xfs/scrub/quota_repair.c
index 43cb7e5c635805..a9c87b218224ca 100644
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -197,17 +197,17 @@ xrep_quota_item(
 		return error;
 
 	/* Check the limits. */
-	if (dq->q_blk.softlimit > dq->q_blk.hardlimit) {
+	if (dq->q_blk.hardlimit && dq->q_blk.softlimit > dq->q_blk.hardlimit) {
 		dq->q_blk.softlimit = dq->q_blk.hardlimit;
 		dirty = true;
 	}
 
-	if (dq->q_ino.softlimit > dq->q_ino.hardlimit) {
+	if (dq->q_ino.hardlimit && dq->q_ino.softlimit > dq->q_ino.hardlimit) {
 		dq->q_ino.softlimit = dq->q_ino.hardlimit;
 		dirty = true;
 	}
 
-	if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
+	if (dq->q_rtb.hardlimit && dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
 		dq->q_rtb.softlimit = dq->q_rtb.hardlimit;
 		dirty = true;
 	}

From 006556968a49b4afe63cbe3c311f5c40086c793f Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:17:54 -0700
Subject: [PATCH 0793/1982] xfs: assign an owner to scrub_stats_fops

commit fe67a493c7a76cf75556152af24285a114f69d34 upstream.

LOLLM complains that file_operations structs for debugfs files are
supposed to have an owner set so that the module can't get unloaded if
someone's sitting on a debugfs file long after unmount/rmmod.  Fix that.

Cc: stable@vger.kernel.org # v6.6
Fixes: d7a74cad8f4513 ("xfs: track usage statistics of online fsck")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/stats.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/scrub/stats.c b/fs/xfs/scrub/stats.c
index 425a90b38e2500..dd2f7de6a9d553 100644
--- a/fs/xfs/scrub/stats.c
+++ b/fs/xfs/scrub/stats.c
@@ -294,6 +294,7 @@ xchk_scrub_stats_read(
 }
 
 static const struct file_operations scrub_stats_fops = {
+	.owner			= THIS_MODULE,
 	.open			= simple_open,
 	.read			= xchk_scrub_stats_read,
 };
@@ -321,6 +322,7 @@ xchk_clear_scrub_stats_write(
 }
 
 static const struct file_operations clear_scrub_stats_fops = {
+	.owner			= THIS_MODULE,
 	.open			= simple_open,
 	.write			= xchk_clear_scrub_stats_write,
 };

From 1f5def7e91a6ebb668620c44c59e8f82c9dab839 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:16:51 -0700
Subject: [PATCH 0794/1982] xfs: bail out of directory tree repairs on error

commit d83ca4e7cc65dce6a02fd3427cefd174517657a3 upstream.

LOLLM complains that we ignore errors returned by
xrep_dirpath_retain_parent and can set the dotdot entry to random stack
garbage.  Fix that by passing errors all the way out.

Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dirtree_repair.c | 57 ++++++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 21 deletions(-)

diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 5cdb7467766b65..6314f222ee8783 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -94,7 +94,7 @@ xrep_dirtree_delete_all_paths(
 }
 
 /* Since this is the surviving path, set the dotdot entry to this value. */
-STATIC void
+STATIC int
 xrep_dirpath_retain_parent(
 	struct xchk_dirtree		*dl,
 	struct xchk_dirpath		*path)
@@ -104,18 +104,20 @@ xrep_dirpath_retain_parent(
 
 	error = xfarray_load(dl->path_steps, path->first_step, &step);
 	if (error)
-		return;
+		return error;
 
 	dl->parent_ino = be64_to_cpu(step.pptr_rec.p_ino);
+	return 0;
 }
 
 /* Find the one surviving path so we know how to set dotdot. */
-STATIC void
+STATIC int
 xrep_dirtree_find_surviving_path(
 	struct xchk_dirtree		*dl,
 	struct xchk_dirtree_outcomes	*oc)
 {
 	struct xchk_dirpath		*path;
+	int				error;
 	bool				foundit = false;
 
 	xchk_dirtree_for_each_path(dl, path) {
@@ -124,7 +126,10 @@ xrep_dirtree_find_surviving_path(
 		case XCHK_DIRPATH_LOOP:
 		case XCHK_DIRPATH_OK:
 			if (!foundit) {
-				xrep_dirpath_retain_parent(dl, path);
+				error = xrep_dirpath_retain_parent(dl, path);
+				if (error)
+					return error;
+
 				foundit = true;
 				continue;
 			}
@@ -136,16 +141,19 @@ xrep_dirtree_find_surviving_path(
 	}
 
 	ASSERT(oc->suspect + oc->good == 1);
+
+	return 0;
 }
 
 /* Delete all paths except for the one good one. */
-STATIC void
+STATIC int
 xrep_dirtree_keep_one_good_path(
 	struct xchk_dirtree		*dl,
 	struct xchk_dirtree_outcomes	*oc)
 {
 	struct xchk_dirpath		*path;
 	bool				foundit = false;
+	int				error;
 
 	xchk_dirtree_for_each_path(dl, path) {
 		switch (path->outcome) {
@@ -157,7 +165,10 @@ xrep_dirtree_keep_one_good_path(
 			break;
 		case XCHK_DIRPATH_OK:
 			if (!foundit) {
-				xrep_dirpath_retain_parent(dl, path);
+				error = xrep_dirpath_retain_parent(dl, path);
+				if (error)
+					return error;
+
 				foundit = true;
 				continue;
 			}
@@ -172,23 +183,28 @@ xrep_dirtree_keep_one_good_path(
 
 	ASSERT(oc->suspect == 0);
 	ASSERT(oc->good < 2);
+	return 0;
 }
 
 /* Delete all paths except for one suspect one. */
-STATIC void
+STATIC int
 xrep_dirtree_keep_one_suspect_path(
 	struct xchk_dirtree		*dl,
 	struct xchk_dirtree_outcomes	*oc)
 {
 	struct xchk_dirpath		*path;
 	bool				foundit = false;
+	int				error = 0;
 
 	xchk_dirtree_for_each_path(dl, path) {
 		switch (path->outcome) {
 		case XCHK_DIRPATH_CORRUPT:
 		case XCHK_DIRPATH_LOOP:
 			if (!foundit) {
-				xrep_dirpath_retain_parent(dl, path);
+				error = xrep_dirpath_retain_parent(dl, path);
+				if (error)
+					return error;
+
 				foundit = true;
 				continue;
 			}
@@ -206,13 +222,14 @@ xrep_dirtree_keep_one_suspect_path(
 
 	ASSERT(oc->suspect == 1);
 	ASSERT(oc->good == 0);
+	return error;
 }
 
 /*
  * Figure out what to do with the paths we tried to find.  Returns -EDEADLOCK
  * if the scan results have become stale.
  */
-STATIC void
+STATIC int
 xrep_dirtree_decide_fate(
 	struct xchk_dirtree		*dl,
 	struct xchk_dirtree_outcomes	*oc)
@@ -222,36 +239,32 @@ xrep_dirtree_decide_fate(
 	/* Parentless directories should not have any paths at all. */
 	if (xchk_dirtree_parentless(dl)) {
 		xrep_dirtree_delete_all_paths(dl, oc);
-		return;
+		return 0;
 	}
 
 	/* One path is exactly the number of paths we want. */
-	if (oc->good + oc->suspect == 1) {
-		xrep_dirtree_find_surviving_path(dl, oc);
-		return;
-	}
+	if (oc->good + oc->suspect == 1)
+		return xrep_dirtree_find_surviving_path(dl, oc);
 
 	/* Zero paths means we should reattach the subdir to the orphanage. */
 	if (oc->good + oc->suspect == 0) {
 		if (dl->sc->orphanage)
 			oc->needs_adoption = true;
-		return;
+		return 0;
 	}
 
 	/*
 	 * Otherwise, this subdirectory has too many parents.  If there's at
 	 * least one good path, keep it and delete the others.
 	 */
-	if (oc->good > 0) {
-		xrep_dirtree_keep_one_good_path(dl, oc);
-		return;
-	}
+	if (oc->good > 0)
+		return xrep_dirtree_keep_one_good_path(dl, oc);
 
 	/*
 	 * There are no good paths and there are too many suspect paths.
 	 * Keep the first suspect path and delete the rest.
 	 */
-	xrep_dirtree_keep_one_suspect_path(dl, oc);
+	return xrep_dirtree_keep_one_suspect_path(dl, oc);
 }
 
 /*
@@ -824,7 +837,9 @@ xrep_dirtree(
 		 * to walk again.
 		 */
 		if (!dl->stale) {
-			xrep_dirtree_decide_fate(dl, &oc);
+			error = xrep_dirtree_decide_fate(dl, &oc);
+			if (error)
+				break;
 
 			trace_xrep_dirtree_decided_fate(dl, &oc);
 

From 50dd205bf3c00f512d817fe9254983ff7a81a2e5 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:17:07 -0700
Subject: [PATCH 0795/1982] xfs: fix revalidation of xchk_dquot_iter cached
 mappings

commit 6c64d650460b455980a6023d43bc6c8859c1cfd2 upstream.

LOLLM noticed that the purpose of xchk_dquot_iter_revalidate_bmap is to
revalidate the quota file mapping after we've (presumably) done
something to the quota file contents.  However, the "yes this is valid"
code isn't quite strong enough -- the mapping must cover at least the
block at fileoff, not just end after fileoff.  Fix that.

Cc: stable@vger.kernel.org # v6.8
Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dqiterate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/xfs/scrub/dqiterate.c b/fs/xfs/scrub/dqiterate.c
index 998b0d640d6131..ed7a1de7fbb1f3 100644
--- a/fs/xfs/scrub/dqiterate.c
+++ b/fs/xfs/scrub/dqiterate.c
@@ -58,6 +58,7 @@ xchk_dquot_iter_revalidate_bmap(
 	 * no need to reread the bmbt.
 	 */
 	if (cursor->bmap.br_startoff != NULLFILEOFF &&
+	    cursor->bmap.br_startoff <= fileoff &&
 	    cursor->if_seq == ifp->if_seq &&
 	    cursor->bmap.br_startoff + cursor->bmap.br_blockcount > fileoff)
 		return 0;

From 31f79a0919e3f0d96f7df2c3aa4f7896394f2356 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 27 Sep 2026 23:16:36 -0700
Subject: [PATCH 0796/1982] xfs: abort dirtree repair if the live update hook
 dies

commit 07732dea4f5d0410e1566b81a58a1154bf9dcb29 upstream.

LOLLM notices that if the live update hook for the directory tree repair
code hits an error, it will set dl->aborted and stops working.  If the
repair code ever sees that condition, it ought to bail out immediately
instead of continuing with obsolete data.

Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dirtree_repair.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 6314f222ee8783..3b9d7c21cf5357 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -831,6 +831,11 @@ xrep_dirtree(
 	 */
 	mutex_lock(&dl->lock);
 	do {
+		if (dl->aborted) {
+			error = -EIO;
+			break;
+		}
+
 		/*
 		 * Decide what we're going to do, then do it.  An -ESTALE
 		 * return here means the scan results are invalid and we have

From c67017f673bc4a118fac377bc99d39b34465f426 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:13:38 -0700
Subject: [PATCH 0797/1982] xfs: check fork type against dabtree block magic
 number

commit 43030b72a11a532e7e3c21ac84a8625425b4201b upstream.

LOLLM complains that we fail to flag dabtree blocks that should never be
associated with the file fork -- data forks can't point to xattr leaves,
and attr forks can't point to dirent blocks.  Add the missing checks.

Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dabtree.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index a6a5d3a75d994e..4722d67be9301c 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -410,6 +410,10 @@ xchk_da_btree_block(
 				XFS_BLFT_ATTR_LEAF_BUF);
 		blk->magic = XFS_ATTR_LEAF_MAGIC;
 		blk->hashval = xfs_attr_leaf_lasthash(blk->bp, pmaxrecs);
+		if (dargs->whichfork != XFS_ATTR_FORK) {
+			xchk_da_set_corrupt(ds, level);
+			goto out_freebp;
+		}
 		if (ds->tree_level != 0)
 			xchk_da_set_corrupt(ds, level);
 		break;
@@ -419,6 +423,10 @@ xchk_da_btree_block(
 				XFS_BLFT_DIR_LEAFN_BUF);
 		blk->magic = XFS_DIR2_LEAFN_MAGIC;
 		blk->hashval = xfs_dir2_leaf_lasthash(ip, blk->bp, pmaxrecs);
+		if (dargs->whichfork != XFS_DATA_FORK) {
+			xchk_da_set_corrupt(ds, level);
+			goto out_freebp;
+		}
 		if (ds->tree_level != 0)
 			xchk_da_set_corrupt(ds, level);
 		break;
@@ -428,6 +436,10 @@ xchk_da_btree_block(
 				XFS_BLFT_DIR_LEAF1_BUF);
 		blk->magic = XFS_DIR2_LEAF1_MAGIC;
 		blk->hashval = xfs_dir2_leaf_lasthash(ip, blk->bp, pmaxrecs);
+		if (dargs->whichfork != XFS_DATA_FORK) {
+			xchk_da_set_corrupt(ds, level);
+			goto out_freebp;
+		}
 		if (ds->tree_level != 0)
 			xchk_da_set_corrupt(ds, level);
 		break;

From 44cc66d047efa739b2bd816177dd3ebad3c0e76c Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:13:22 -0700
Subject: [PATCH 0798/1982] xfs: mark overfull dabtree node blocks as corrupt

commit f61c91a2e5994fa81141d6c06dadae1fed206018 upstream.

LOLLM observes that we need to range-check the dabtree node record count
before using it to index an array.  Fix that.

Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dabtree.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index 4722d67be9301c..52ff4c4b6588ea 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -451,6 +451,10 @@ xchk_da_btree_block(
 		node = blk->bp->b_addr;
 		xfs_da3_node_hdr_from_disk(ip->i_mount, &nodehdr, node);
 		btree = nodehdr.btree;
+		if (nodehdr.count > dargs->geo->node_ents) {
+			xchk_da_set_corrupt(ds, level);
+			goto out_freebp;
+		}
 		*pmaxrecs = nodehdr.count;
 		blk->hashval = be32_to_cpu(btree[*pmaxrecs - 1].hashval);
 		if (level == 0) {

From 2b33121ec2a85d660a1d6cf78cb365961019d645 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:13:06 -0700
Subject: [PATCH 0799/1982] xfs: jump out of xchk_bmap_check_rmap if fatal
 signals

commit 49d300a51442bd64b627645b7b0b1cd66e492905 upstream.

LOLLM observes that we never check for fatal signals inside the loop
that checks file fork mappings against the rmapbt.  This can lead to
lengthy delays in responding to a ^C, so add some bailout checks.

Cc: stable@vger.kernel.org # v4.17
Fixes: 5e777b62b0bcb6 ("xfs: bmap scrubber should do rmap xref with bmap for sparse files")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/bmap.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
index 687f2cd8a47fc4..519bb5834a1d40 100644
--- a/fs/xfs/scrub/bmap.c
+++ b/fs/xfs/scrub/bmap.c
@@ -626,6 +626,10 @@ xchk_bmap_check_rmap(
 	struct xfs_ifork		*ifp;
 	struct xfs_scrub		*sc = sbcri->sc;
 	bool				have_map;
+	int				error = 0;
+
+	if (xchk_should_terminate(sc, &error))
+		return error;
 
 	/* Is this even the right fork? */
 	if (rec->rm_owner != sc->ip->i_ino)
@@ -657,6 +661,9 @@ xchk_bmap_check_rmap(
 	 */
 	check_rec = *rec;
 	while (have_map) {
+		if (xchk_should_terminate(sc, &error))
+			return error;
+
 		if (irec.br_startoff != check_rec.rm_offset)
 			xchk_fblock_set_corrupt(sc, sbcri->whichfork,
 					check_rec.rm_offset);

From 38a595275d276c25466ed774f6b4d9108bc8355d Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:10:45 -0700
Subject: [PATCH 0800/1982] xfs: adjust checks for cross-AG reaping issues

commit 4c6668ecebc61bb0a53d4c6e95509bc960cf6bbc upstream.

While analyzing the reaping code for the previous patch, I studied the
xfs_fsblock_t code to reconstruct how this code works.  AGs have a
superblock at the start of each AG which means that regions in the
xfsb_bitmap (aka xfs_fsblock_t bitmap) cannot cross an AG boundary, so
we don't need a loop here like we do for xfs_rtblock_t bitmaps.

However, the checks here are not quite right -- there can be quite a lot
of reserved space in COW forks, which means that the bitmap extent
actually can exceed XFS_MAX_BMBT_EXTLEN.  We also don't have an explicit
debugging check that we never cross AGs, so add that here.

Cc: stable@vger.kernel.org # v6.8
Fixes: 66da11280f7ecd ("xfs: reintroduce reaping of file metadata blocks to xrep_reap_extents")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/reap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/reap.c b/fs/xfs/scrub/reap.c
index a2c68bda7b7c08..c36f90e293e2f9 100644
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -796,9 +796,9 @@ xreap_fsmeta_extent(
 	xfs_agblock_t		agbno_next = agbno + len;
 	int			error = 0;
 
-	ASSERT(len <= XFS_MAX_BMBT_EXTLEN);
 	ASSERT(sc->ip != NULL);
 	ASSERT(!sc->sa.pag);
+	ASSERT(agno == XFS_FSB_TO_AGNO(sc->mp, fsbno + len - 1));
 
 	/*
 	 * We're reaping blocks after repairing file metadata, which means that

From 7f25f443a4a6156ad706aafc3b76ef0d842eea68 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:11:01 -0700
Subject: [PATCH 0801/1982] xfs: actually check XFS_DIFLAG2_METADATA for
 metadata btree data forks

commit 436ae68743a6974021fefa21fd3093d9bf8e66e4 upstream.

LOLLM noticed that xrep_dinode_check_dfork doesn't require that the
inode has the METADATA flag set in flags2.  Add that check.

Cc: stable@vger.kernel.org # v6.14
Fixes: 702c90f4516223 ("xfs: support file data forks containing metadata btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index daefe74349b28d..7a6f9d27c373b5 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1014,6 +1014,11 @@ xrep_dinode_bad_metabt_fork(
 	if (whichfork != XFS_DATA_FORK)
 		return true;
 
+	if (!xfs_has_metadir(sc->mp))
+		return true;
+	if (!(dip->di_flags2 & cpu_to_be64(XFS_DIFLAG2_METADATA)))
+		return true;
+
 	switch (be16_to_cpu(dip->di_metatype)) {
 	case XFS_METAFILE_RTRMAP:
 		return xrep_dinode_bad_rtrmapbt_fork(sc, dip, dfork_size);

From f799665b9c8dc07e865263f43ca23a5105b29488 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Thu, 24 Sep 2026 21:11:17 -0700
Subject: [PATCH 0802/1982] xfs: fix xchk_stats_estimate_bufsize to allow for
 the trailing null

commit 6b8d60784b61a17bd591cb4c6e8aa9ed29c24f5c upstream.

LOLLM complains that xchk_stats_estimate_bufsize underestimates the
buffer size by 1 byte because scnprintf wants to store a null byte after
the newline in each line.  Each call to scnprintf overwrites the null
left by the previous call, but we still need the null byte for the last
line in the file.

Cc: stable@vger.kernel.org # v6.6
Fixes: d7a74cad8f4513 ("xfs: track usage statistics of online fsck")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/stats.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/stats.c b/fs/xfs/scrub/stats.c
index dd2f7de6a9d553..ddc64ed2852e92 100644
--- a/fs/xfs/scrub/stats.c
+++ b/fs/xfs/scrub/stats.c
@@ -166,7 +166,8 @@ xchk_stats_estimate_bufsize(
 		ret += field_width + 1;
 	}
 
-	return ret;
+	/* null byte for scnprintf */
+	return ret + 1;
 }
 
 /* Clear all counters. */

From 92c9bc8561a7cb0274752b1409b2bb6a89d6ecc5 Mon Sep 17 00:00:00 2001
From: Richard Cheng <icheng@nvidia.com>
Date: Tue, 3 Nov 2026 19:07:48 +0000
Subject: [PATCH 0803/1982] sched_ext: sync disable_irq_work in bpf_scx_unreg()

[ Upstream commit 510a27055446b8f0d29487ca8b8d2033dc2b6ca6 ]

When unregistered my self-written scx scheduler, the following panic
occurs.

[  229.923133] Kernel text patching generated an invalid instruction at 0xffff80009bc2c1f8!
[  229.923146] Internal error: Oops - BRK: 00000000f2000100 [#1]  SMP
[  230.077871] CPU: 48 UID: 0 PID: 1760 Comm: kworker/u583:7 Not tainted 7.0.0+ #3 PREEMPT(full)
[  230.086677] Hardware name: NVIDIA GB200 NVL/P3809-BMC, BIOS 02.05.12 20251107
[  230.093972] Workqueue: events_unbound bpf_map_free_deferred
[  230.099675] Sched_ext: invariant_0.1.0_aarch64_unknown_linux_gnu_debug (disabling), task: runnable_at=-174ms
[  230.116843] pc : 0xffff80009bc2c1f8
[  230.120406] lr : dequeue_task_scx+0x270/0x2d0
[  230.217749] Call trace:
[  230.228515]  0xffff80009bc2c1f8 (P)
[  230.232077]  dequeue_task+0x84/0x188
[  230.235728]  sched_change_begin+0x1dc/0x250
[  230.240000]  __set_cpus_allowed_ptr_locked+0x17c/0x240
[  230.245250]  __set_cpus_allowed_ptr+0x74/0xf0
[  230.249701]  ___migrate_enable+0x4c/0xa0
[  230.253707]  bpf_map_free_deferred+0x1a4/0x1b0
[  230.258246]  process_one_work+0x184/0x540
[  230.262342]  worker_thread+0x19c/0x348
[  230.266170]  kthread+0x13c/0x150
[  230.269465]  ret_from_fork+0x10/0x20
[  230.281393] Code: d4202000 d4202000 d4202000 d4202000 (d4202000)
[  230.287621] ---[ end trace 0000000000000000 ]---
[  231.160046] Kernel panic - not syncing: Oops - BRK: Fatal exception in interrupt

The root cause is that the JIT page backing ops->quiescent() is freed
before all callers of that function have stopped.

The expected ordering during teardown is:
    bitmap_zero(sch->has_op) + synchronize_rcu()
        -> guarantees no CPU will ever call sch->ops.* again
    -> only THEN free the BPF struct_ops JIT page

bpf_scx_unreg() is supposed to enforce the order, but after
commit f4a6c506d118 ("sched_ext: Always bounce scx_disable() through
irq_work"), disable_work is no longer queued directly, causing
kthread_flush_work() to be a noop. Thus, the caller drops the struct_ops
map too early and poisoned with AARCH64_BREAK_FAULT before
disable_workfn ever execute.

So the subsequent dequeue_task() still sees SCX_HAS_OP(sch, quiescent)
as true and calls ops.quiescent, which hit on the poisoned page and BRK
panic.

Add a helper scx_flush_disable_work() so the future use cases that want
to flush disable_work can use it.
Also amend the call for scx_root_enable_workfn() and
scx_sub_enable_workfn() which have similar pattern in the error path.

Fixes: f4a6c506d118 ("sched_ext: Always bounce scx_disable() through irq_work")
Signed-off-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Reviewed-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[ 6.18.y has neither f4a6c506d118 nor sub-schedulers. Here, the flush is
  a no-op when scx_disable() loses the exit claim to scx_vexit(), whose
  error_irq_work queues disable_work later. Sync error_irq_work instead
  of disable_irq_work and drop the scx_sub_enable_workfn() hunk. ]
Signed-off-by: Kuba Piecuch <jpiecuch@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/ext.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index f3e3146e5febf5..d2460a88fba352 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -4207,6 +4207,20 @@ static void scx_disable(struct scx_sched *sch, enum scx_exit_kind kind)
 		kthread_queue_work(sch->helper, &sch->disable_work);
 }
 
+/**
+ * scx_flush_disable_work - flush the disable work and wait for it to finish
+ * @sch: the scheduler
+ *
+ * sch->disable_work might still not queued, causing kthread_flush_work()
+ * as a noop. Syncing the irq_work first is required to guarantee the
+ * kthread work has been queued before waiting for it.
+ */
+static void scx_flush_disable_work(struct scx_sched *sch)
+{
+	irq_work_sync(&sch->error_irq_work);
+	kthread_flush_work(&sch->disable_work);
+}
+
 static void dump_newline(struct seq_buf *s)
 {
 	trace_sched_ext_dump("");
@@ -4968,7 +4982,7 @@ static void scx_root_enable_workfn(struct kthread_work *work)
 	 * completion. sch's base reference will be put by bpf_scx_unreg().
 	 */
 	scx_error(sch, "scx_root_enable() failed (%d)", ret);
-	kthread_flush_work(&sch->disable_work);
+	scx_flush_disable_work(sch);
 	cmd->ret = 0;
 }
 
@@ -5142,7 +5156,7 @@ static void bpf_scx_unreg(void *kdata, struct bpf_link *link)
 	struct scx_sched *sch = ops->priv;
 
 	scx_disable(sch, SCX_EXIT_UNREG);
-	kthread_flush_work(&sch->disable_work);
+	scx_flush_disable_work(sch);
 	kobject_put(&sch->kobj);
 }
 

From 03c67f33c3d9ee28842aef2ed39e582751be3f1f Mon Sep 17 00:00:00 2001
From: Cheng-Yang Chou <yphbchou0911@gmail.com>
Date: Tue, 3 Nov 2026 19:07:49 +0000
Subject: [PATCH 0804/1982] sched_ext: Fix scx_flush_disable_work() UAF race

[ Upstream commit d99f7a32f09dccbe396187370ec1a74a31b73d7e ]

scx_flush_disable_work() calls irq_work_sync() followed by
kthread_flush_work() to ensure that the disable kthread work has
fully completed before bpf_scx_unreg() frees the SCX scheduler.

However, a concurrent scx_vexit() (e.g., triggered by a watchdog stall)
creates a race window between scx_claim_exit() and irq_work_queue():

  CPU A (scx_vexit (watchdog))        CPU B (bpf_scx_unreg)
  ----                                ----
  scx_claim_exit()
    atomic_try_cmpxchg(NONE->kind)
  stack_trace_save()
  vscnprintf()
                                      scx_disable()
                                        scx_claim_exit() -> FAIL
                                      scx_flush_disable_work()
                                        irq_work_sync()      // no-op: not queued yet
                                        kthread_flush_work() // no-op: not queued yet
                                      kobject_put(&sch->kobj) -> free %sch
  irq_work_queue() -> UAF on %sch
  scx_disable_irq_workfn()
    kthread_queue_work() -> UAF

The root cause is that CPU B's scx_flush_disable_work() returns after
syncing an irq_work that has not yet been queued, while CPU A is still
executing the code between scx_claim_exit() and irq_work_queue().

Loop until exit_kind reaches SCX_EXIT_DONE or SCX_EXIT_NONE, draining
disable_irq_work and disable_work in each pass. This ensures that any
work queued after the previous check is caught, while also correctly
handling cases where no disable was triggered (e.g., the
scx_sub_enable_workfn() abort path).

Fixes: 510a27055446 ("sched_ext: sync disable_irq_work in bpf_scx_unreg()")
Reported-by: https://sashiko.dev/#/patchset/20260424100221.32407-1-icheng%40nvidia.com
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[ Sync error_irq_work instead of disable_irq_work. ]
Signed-off-by: Kuba Piecuch <jpiecuch@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/ext.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index d2460a88fba352..78f15ddc0aa5a8 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -4217,8 +4217,13 @@ static void scx_disable(struct scx_sched *sch, enum scx_exit_kind kind)
  */
 static void scx_flush_disable_work(struct scx_sched *sch)
 {
-	irq_work_sync(&sch->error_irq_work);
-	kthread_flush_work(&sch->disable_work);
+	int kind;
+
+	do {
+		irq_work_sync(&sch->error_irq_work);
+		kthread_flush_work(&sch->disable_work);
+		kind = atomic_read(&sch->exit_kind);
+	} while (kind != SCX_EXIT_NONE && kind != SCX_EXIT_DONE);
 }
 
 static void dump_newline(struct seq_buf *s)

From 65367b0545955c945739a3fb193186f04fa01e24 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Sat, 16 May 2026 23:23:21 +0800
Subject: [PATCH 0805/1982] netfilter: disable payload mangling in userns

[ Upstream commit 968cc2c96390f06e56ed6a43f935bfebdefed28f ]

Several parts of network stack rely on iph->ihl validation
done by network stack before PRE_ROUTING.

Disable this feature for user namespaces for now.

tcp option handling is likely safe even for LOCAL_IN, so this
this leaves tcp option mangling via nft_exthdr.c as-is.

I don't think these are the only means to alter packets, but these
appear to be relatively prominent.

This could be relaxed later.  Example:
 - allow userns for ingress hook.
 - allow userns if base is transport header.

 Also, we should revalidate or restrict generally:
 - Don't allow linklayer writes to spill into network header
 - restrict ipv4 and ipv6 to 'known safe' writes, e.g.
   saddr/daddr/check/tos

Reported-by: Qi Tang <tpluszz77@gmail.com>
Reported-by: Tong Liu <lyutoon@gmail.com>
Tested-by: Qi Tang <tpluszz77@gmail.com>
Link: https://lore.kernel.org/netfilter-devel/20260515100411.3141-1-fw@strlen.de/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_queue.c | 6 ++++--
 net/netfilter/nft_payload.c     | 3 +++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cf545ed26161a6..463abfb3fb54e5 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1190,6 +1190,9 @@ nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int di
 {
 	struct sk_buff *nskb;
 
+	if (e->state.net->user_ns != &init_user_ns)
+		return -EPERM;
+
 	if (diff < 0) {
 		unsigned int min_len = skb_transport_offset(e->skb);
 
@@ -1592,8 +1595,7 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
 		if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
 				 payload_len, entry, diff) < 0)
 			verdict = NF_DROP;
-
-		if (ct && diff)
+		else if (ct && diff)
 			nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff);
 	}
 
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index e07888aaf1475a..4034d61e2a135b 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -917,6 +917,9 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
 	struct nft_payload_set *priv = nft_expr_priv(expr);
 	int err;
 
+	if (ctx->net->user_ns != &init_user_ns)
+		return -EPERM;
+
 	priv->base        = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
 	priv->len         = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
 

From 819b2241c43e6bbd9dbca9301d5ca557b2ff1a57 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Wed, 29 Apr 2026 17:46:48 +0200
Subject: [PATCH 0806/1982] ipv6: Implement limits on extension header parsing

[ Upstream commit 3744b0964d5267c0b651bcd8f8c25db6bf4ccbac ]

ipv6_{skip_exthdr,find_hdr}() and ip6_{tnl_parse_tlv_enc_lim,
protocol_deliver_rcu}() iterate over IPv6 extension headers until they
find a non-extension-header protocol or run out of packet data. The
loops have no iteration counter, relying solely on the packet length
to bound them. For a crafted packet with 8-byte extension headers
filling a 64KB jumbogram, this means a worst case of up to ~8k
iterations with a skb_header_pointer call each. ipv6_skip_exthdr(),
for example, is used where it parses the inner quoted packet inside
an incoming ICMPv6 error:

  - icmpv6_rcv
    - checksum validation
    - case ICMPV6_DEST_UNREACH
      - icmpv6_notify
        - pskb_may_pull()       <- pull inner IPv6 header
        - ipv6_skip_exthdr()    <- iterates here
        - pskb_may_pull()
        - ipprot->err_handler() <- sk lookup

The per-iteration cost of ipv6_skip_exthdr itself is generally
light, but skb_header_pointer becomes more costly on reassembled
packets: the first ~1232 bytes of the inner packet are in the skb's
linear area, but the remaining ~63KB are in the frag_list where
skb_copy_bits is needed to read data.

Initially, the idea was to add a configurable limit via a new
sysctl knob with default 8, in line with knobs from commit
47d3d7ac656a ("ipv6: Implement limits on Hop-by-Hop and Destination
options"), but two reasons eventually argued against it:

- It adds to UAPI that needs to be maintained forever, and
  upcoming work is restricting extension header ordering anyway,
  leaving little reason for another sysctl knob
- exthdrs_core.c is always built-in even when CONFIG_IPV6=n,
  where struct net has no .ipv6 member, so the read site would
  need an ifdef'd fallback to a constant anyway

Therefore, just use a constant (IP6_MAX_EXT_HDRS_CNT). All four
extension header walking functions are now bound by this limit.

Note that the check in ip6_protocol_deliver_rcu() happens right
before the goto resubmit, such that we don't have to have a test
for ipv6_ext_hdr() in the fast-path.

There's an ongoing IETF draft-iurman-6man-eh-occurrences to enforce
IPv6 extension headers ordering and occurrence. The latter also
discusses security implications. As per RFC8200 section 4.1, the
occurrence rules for extension headers provide a practical upper
bound which is 8. In order to be conservative, let's define
IP6_MAX_EXT_HDRS_CNT as 12 to leave enough room for quirky setups.
In the unlikely event that this is still not enough, then we might
need to reconsider a sysctl.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260429154648.809751-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/dropreason-core.h | 6 ++++++
 include/net/ipv6.h            | 3 +++
 net/ipv6/exthdrs_core.c       | 7 +++++++
 net/ipv6/ip6_input.c          | 5 +++++
 net/ipv6/ip6_tunnel.c         | 4 ++++
 5 files changed, 25 insertions(+)

diff --git a/include/net/dropreason-core.h b/include/net/dropreason-core.h
index de74e537b4ede4..811057ae8ed255 100644
--- a/include/net/dropreason-core.h
+++ b/include/net/dropreason-core.h
@@ -101,6 +101,7 @@
 	FN(FRAG_TOO_FAR)		\
 	FN(TCP_MINTTL)			\
 	FN(IPV6_BAD_EXTHDR)		\
+	FN(IPV6_TOO_MANY_EXTHDRS)	\
 	FN(IPV6_NDISC_FRAG)		\
 	FN(IPV6_NDISC_HOP_LIMIT)	\
 	FN(IPV6_NDISC_BAD_CODE)		\
@@ -508,6 +509,11 @@ enum skb_drop_reason {
 	SKB_DROP_REASON_TCP_MINTTL,
 	/** @SKB_DROP_REASON_IPV6_BAD_EXTHDR: Bad IPv6 extension header. */
 	SKB_DROP_REASON_IPV6_BAD_EXTHDR,
+	/**
+	 * @SKB_DROP_REASON_IPV6_TOO_MANY_EXTHDRS: Number of IPv6 extension
+	 * headers in the packet exceeds IP6_MAX_EXT_HDRS_CNT.
+	 */
+	SKB_DROP_REASON_IPV6_TOO_MANY_EXTHDRS,
 	/** @SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). */
 	SKB_DROP_REASON_IPV6_NDISC_FRAG,
 	/** @SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. */
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index b03467b337f4fd..dffa1b7b96be07 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -90,6 +90,9 @@ struct ip_tunnel_info;
 #define IP6_DEFAULT_MAX_DST_OPTS_LEN	 INT_MAX /* No limit */
 #define IP6_DEFAULT_MAX_HBH_OPTS_LEN	 INT_MAX /* No limit */
 
+/* Hard limit on traversed IPv6 extension headers */
+#define IP6_MAX_EXT_HDRS_CNT		 12
+
 /*
  *	Addr type
  *	
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index ce3724f49e33ae..4a9748338cf400 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -73,6 +73,7 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
 		     __be16 *frag_offp)
 {
 	u8 nexthdr = *nexthdrp;
+	int exthdr_cnt = 0;
 
 	*frag_offp = 0;
 
@@ -82,6 +83,8 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
 
 		if (nexthdr == NEXTHDR_NONE)
 			return -1;
+		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
+			return -1;
 		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
 		if (!hp)
 			return -1;
@@ -190,6 +193,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 {
 	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
 	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+	int exthdr_cnt = 0;
 	bool found;
 
 	if (fragoff)
@@ -216,6 +220,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 			return -ENOENT;
 		}
 
+		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
+			return -EBADMSG;
+
 		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
 		if (!hp)
 			return -EBADMSG;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 673c6f0ce617df..be8836cc70e737 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -363,6 +363,7 @@ INDIRECT_CALLABLE_DECLARE(int tcp_v6_rcv(struct sk_buff *));
 void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
 			      bool have_final)
 {
+	int exthdr_cnt = IP6CB(skb)->flags & IP6SKB_HOPBYHOP ? 1 : 0;
 	const struct inet6_protocol *ipprot;
 	struct inet6_dev *idev;
 	unsigned int nhoff;
@@ -447,6 +448,10 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
 				nexthdr = ret;
 				goto resubmit_final;
 			} else {
+				if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT)) {
+					SKB_DR_SET(reason, IPV6_TOO_MANY_EXTHDRS);
+					goto discard;
+				}
 				goto resubmit;
 			}
 		} else if (ret == 0) {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2560c0f8b2930f..a6499f654e85ad 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -400,11 +400,15 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 	unsigned int nhoff = raw - skb->data;
 	unsigned int off = nhoff + sizeof(*ipv6h);
 	u8 nexthdr = ipv6h->nexthdr;
+	int exthdr_cnt = 0;
 
 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
 		struct ipv6_opt_hdr *hdr;
 		u16 optlen;
 
+		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
+			break;
+
 		if (!pskb_may_pull(skb, off + sizeof(*hdr)))
 			break;
 

From 40089f2f78aa95fc9fb9c35ee550a70d3f21ef06 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 9 Jun 2026 13:51:53 +0200
Subject: [PATCH 0807/1982] netfilter: nfnetlink_queue: restrict writes to
 network header

[ Upstream commit 54f34607d184c1cc056c59a5b3d86d96dd6a515c ]

nfnetlink_queue doesn't allow selective replacements of some part of the
payload, only complete replacement.
If the new data is shorter, skb is trimmed, otherwise expanded.

Add minimal validation of the new ip/ipv6 header.  Check total len
matches skb length.  Disallow ip option modifications.

IPv6 extension headers are also disabled.
IP options and exthdrs could be allowed later after validation pass or
ip option recompile.

Transport header is not checked.

Bridge modifications are rejected.  Given userspace doesn't even receive
L2 headers, use is limited and I don't think there are any users of
bridge nfnetlink_queue, let alone users that modifiy payload.

Arp isn't supported at all.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_queue.c | 170 ++++++++++++++++++++++++++++++++
 1 file changed, 170 insertions(+)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 463abfb3fb54e5..7cfb1bdf0e88fd 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1185,6 +1185,173 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
 	return err;
 }
 
+static bool nfqnl_validate_ipopts(const struct iphdr *iph_new,
+				  const struct nf_queue_entry *e)
+{
+	const struct iphdr *iph_orig = ip_hdr(e->skb);
+	unsigned int ihl = iph_new->ihl * 4;
+
+	if (iph_new->ihl != iph_orig->ihl)
+		return false;
+	if (ihl == sizeof(*iph_orig))
+		return true;
+
+	return memcmp(iph_new + 1, ip_hdr(e->skb) + 1, ihl - sizeof(*iph_orig)) == 0;
+}
+
+static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len,
+			       const struct nf_queue_entry *e)
+{
+	unsigned int ihl;
+
+	if (data_len < sizeof(*iph))
+		return false;
+
+	ihl = iph->ihl * 4u;
+	if (ihl < sizeof(*iph) || data_len < ihl)
+		return false;
+
+	if (iph->version != 4 ||
+	    ((iph->frag_off ^ ip_hdr(e->skb)->frag_off) & ~htons(IP_DF)) != 0)
+		return false;
+
+	/* BIG TCP won't work; netlink attr len is u16 */
+	if (ntohs(iph->tot_len) != data_len)
+		return false;
+
+	/* support for ipopts mangling would require
+	 * recompile + skb transport header update.
+	 */
+	return nfqnl_validate_ipopts(iph, e);
+}
+
+static bool nfqnl_validate_one_exthdr(const u8 *data,
+				      unsigned int data_len,
+				      const struct nf_queue_entry *e,
+				      int start, int hdrlen)
+{
+	u16 octets;
+
+	if (data_len < hdrlen || hdrlen < 2)
+		return false;
+
+	while (hdrlen > 0) {
+		if (data_len < sizeof(octets))
+			return false;
+		data_len -= sizeof(octets);
+
+		if (skb_copy_bits(e->skb, start, &octets, sizeof(octets)))
+			return false;
+
+		if (hdrlen < sizeof(octets))
+			return false;
+
+		hdrlen -= sizeof(octets);
+		if (memcmp(data, &octets, sizeof(octets)))
+			return false;
+
+		start += sizeof(octets);
+		data += sizeof(octets);
+	}
+
+	return true;
+}
+
+static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
+				  unsigned int data_len,
+				  const struct nf_queue_entry *e)
+{
+	const struct ipv6hdr *ip6_orig = ipv6_hdr(e->skb);
+	int exthdr_cnt = 0, start = sizeof(*ip6_orig);
+	const u8 *data = (const u8 *)ip6_new;
+	u8 orig_nexthdr = ip6_orig->nexthdr;
+	u8 new_nexthdr = ip6_new->nexthdr;
+
+	if (new_nexthdr != orig_nexthdr)
+		return false;
+
+	data += sizeof(*ip6_new);
+	data_len -= sizeof(*ip6_new);
+
+	while (ipv6_ext_hdr(orig_nexthdr)) {
+		const struct ipv6_opt_hdr *hp;
+		struct ipv6_opt_hdr _hdr;
+		int hdrlen;
+
+		if (orig_nexthdr == NEXTHDR_NONE)
+			return true;
+
+		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
+			return false;
+
+		hp = skb_header_pointer(e->skb, start, sizeof(_hdr), &_hdr);
+		if (!hp)
+			return false;
+
+		switch (orig_nexthdr) {
+		case NEXTHDR_FRAGMENT:
+			hdrlen = sizeof(struct frag_hdr);
+			break;
+		case NEXTHDR_AUTH:
+			hdrlen = ipv6_authlen(hp);
+			break;
+		default:
+			hdrlen = ipv6_optlen(hp);
+			break;
+		}
+
+		if (!nfqnl_validate_one_exthdr(data, data_len, e,
+					       start, hdrlen))
+			return false;
+
+		orig_nexthdr = hp->nexthdr;
+		hp = (const void *)data;
+		new_nexthdr = hp->nexthdr;
+
+		if (new_nexthdr != orig_nexthdr)
+			return false;
+
+		data_len -= hdrlen;
+		start += hdrlen;
+		data += hdrlen;
+	}
+
+	return true;
+}
+
+static bool nfqnl_validate_ip6(const struct ipv6hdr *ip6, unsigned int data_len,
+			       const struct nf_queue_entry *e)
+{
+	if (data_len < sizeof(*ip6))
+		return false;
+
+	/* BIG TCP/jumbograms won't work; netlink attr len is u16 */
+	if (ntohs(ip6->payload_len) != data_len - sizeof(*ip6))
+		return false;
+
+	if (ip6->version != 6)
+		return false;
+
+	return nfqnl_validate_exthdr(ip6, data_len, e);
+}
+
+static bool nfqnl_validate_write(const void *data, unsigned int data_len,
+				 const struct nf_queue_entry *e)
+{
+	switch (e->state.pf) {
+	case NFPROTO_IPV4:
+		return nfqnl_validate_ip4(data, data_len, e);
+	case NFPROTO_IPV6:
+		return nfqnl_validate_ip6(data, data_len, e) &&
+		       !(IP6CB(e->skb)->flags & IP6SKB_JUMBOGRAM);
+	case NFPROTO_BRIDGE:
+		/* No write support. Bridge is dubious: userspace doesn't even see L2 header */
+		return false;
+	}
+
+	return false;
+}
+
 static int
 nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)
 {
@@ -1193,6 +1360,9 @@ nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int di
 	if (e->state.net->user_ns != &init_user_ns)
 		return -EPERM;
 
+	if (!nfqnl_validate_write(data, data_len, e))
+		return -EINVAL;
+
 	if (diff < 0) {
 		unsigned int min_len = skb_transport_offset(e->skb);
 

From 9b02841c69dc59652c86e8d3a7858de8469daeae Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 22 Mar 2026 23:51:47 +0100
Subject: [PATCH 0808/1982] netfilter: nft_meta: add double-tagged vlan and
 pppoe support

[ Upstream commit 3785091c6c16a1ce4a5e0460881fc81ed8d2c8a1 ]

Currently:

  add rule netdev x y ip saddr 1.1.1.1

does not work with neither double-tagged vlan nor pppoe packets. This is
because the network and transport header offset are not pointing to the
IP and transport protocol headers in the stack.

This patch expands NFT_META_PROTOCOL and NFT_META_L4PROTO to parse
double-tagged vlan and pppoe packets so matching network and transport
header fields becomes possible with the existing userspace generated
bytecode. Note that this parser only supports double-tagged vlan which
is composed of vlan offload + vlan header in the skb payload area for
simplicity.

NFT_META_PROTOCOL is used by bridge and netdev family as an implicit
dependency in the bytecode to match on network header fields.
Similarly, there is also NFT_META_L4PROTO, which is also used as an
implicit dependency when matching on the transport protocol header
fields.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_tables.h      |  4 ++
 include/net/netfilter/nf_tables_ipv4.h | 17 +++++---
 include/net/netfilter/nf_tables_ipv6.h | 16 +++++---
 net/netfilter/nf_tables_core.c         |  2 +-
 net/netfilter/nft_meta.c               | 54 +++++++++++++++++++++++++-
 net/netfilter/nft_payload.c            |  2 +-
 6 files changed, 82 insertions(+), 13 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 4c691d5e4ae9b2..ac04b4eb17d783 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -32,7 +32,9 @@ struct nft_pktinfo {
 	const struct nf_hook_state	*state;
 	u8				flags;
 	u8				tprot;
+	__be16				ethertype;
 	u16				fragoff;
+	u16				nhoff;
 	u16				thoff;
 	u16				inneroff;
 };
@@ -84,6 +86,8 @@ static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)
 {
 	pkt->flags = 0;
 	pkt->tprot = 0;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = 0;
 	pkt->thoff = 0;
 	pkt->fragoff = 0;
 }
diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index fcf967286e37cb..e715405a73cb97 100644
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -12,16 +12,19 @@ static inline void nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt)
 	ip = ip_hdr(pkt->skb);
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = ip->protocol;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = 0;
 	pkt->thoff = ip_hdrlen(pkt->skb);
 	pkt->fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 }
 
-static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
+static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
+						  int nhoff)
 {
 	struct iphdr *iph, _iph;
 	u32 len, thoff, skb_len;
 
-	iph = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb),
+	iph = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb) + nhoff,
 				 sizeof(*iph), &_iph);
 	if (!iph)
 		return -1;
@@ -31,7 +34,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
 
 	len = iph_totlen(pkt->skb, iph);
 	thoff = iph->ihl * 4;
-	skb_len = pkt->skb->len - skb_network_offset(pkt->skb);
+	skb_len = pkt->skb->len - skb_network_offset(pkt->skb) - nhoff;
 
 	if (skb_len < len)
 		return -1;
@@ -42,7 +45,9 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = iph->protocol;
-	pkt->thoff = skb_network_offset(pkt->skb) + thoff;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = nhoff;
+	pkt->thoff = skb_network_offset(pkt->skb) + nhoff + thoff;
 	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
 
 	return 0;
@@ -50,7 +55,7 @@ static inline int __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
 
 static inline void nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt)
 {
-	if (__nft_set_pktinfo_ipv4_validate(pkt) < 0)
+	if (__nft_set_pktinfo_ipv4_validate(pkt, 0) < 0)
 		nft_set_pktinfo_unspec(pkt);
 }
 
@@ -78,6 +83,8 @@ static inline int nft_set_pktinfo_ipv4_ingress(struct nft_pktinfo *pkt)
 	}
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = 0;
 	pkt->tprot = iph->protocol;
 	pkt->thoff = thoff;
 	pkt->fragoff = ntohs(iph->frag_off) & IP_OFFSET;
diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index c53ac00bb974d6..d7b8c559b795bf 100644
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -20,21 +20,23 @@ static inline void nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt)
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = protohdr;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = 0;
 	pkt->thoff = thoff;
 	pkt->fragoff = frag_off;
 }
 
-static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
+static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt, int nhoff)
 {
 #if IS_ENABLED(CONFIG_IPV6)
 	unsigned int flags = IP6_FH_F_AUTH;
 	struct ipv6hdr *ip6h, _ip6h;
-	unsigned int thoff = 0;
+	unsigned int thoff = nhoff;
 	unsigned short frag_off;
 	u32 pkt_len, skb_len;
 	int protohdr;
 
-	ip6h = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb),
+	ip6h = skb_header_pointer(pkt->skb, skb_network_offset(pkt->skb) + nhoff,
 				  sizeof(*ip6h), &_ip6h);
 	if (!ip6h)
 		return -1;
@@ -43,7 +45,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
 		return -1;
 
 	pkt_len = ipv6_payload_len(pkt->skb, ip6h);
-	skb_len = pkt->skb->len - skb_network_offset(pkt->skb);
+	skb_len = pkt->skb->len - skb_network_offset(pkt->skb) - nhoff;
 	if (pkt_len + sizeof(*ip6h) > skb_len)
 		return -1;
 
@@ -53,6 +55,8 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = protohdr;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = nhoff;
 	pkt->thoff = thoff;
 	pkt->fragoff = frag_off;
 
@@ -64,7 +68,7 @@ static inline int __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
 
 static inline void nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt)
 {
-	if (__nft_set_pktinfo_ipv6_validate(pkt) < 0)
+	if (__nft_set_pktinfo_ipv6_validate(pkt, 0) < 0)
 		nft_set_pktinfo_unspec(pkt);
 }
 
@@ -99,6 +103,8 @@ static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt)
 
 	pkt->flags = NFT_PKTINFO_L4PROTO;
 	pkt->tprot = protohdr;
+	pkt->ethertype = pkt->skb->protocol;
+	pkt->nhoff = 0;
 	pkt->thoff = thoff;
 	pkt->fragoff = frag_off;
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 6557a4018c0993..5ddd5b6e135f1c 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -151,7 +151,7 @@ static bool nft_payload_fast_eval(const struct nft_expr *expr,
 	unsigned char *ptr;
 
 	if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
-		ptr = skb_network_header(skb);
+		ptr = skb_network_header(skb) + pkt->nhoff;
 	else {
 		if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
 			return false;
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index f3c7b7edb10c08..a6e83279d0b6b0 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -24,6 +24,8 @@
 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables_core.h>
+#include <net/netfilter/nf_tables_ipv4.h>
+#include <net/netfilter/nf_tables_ipv6.h>
 #include <net/netfilter/nft_meta.h>
 #include <net/netfilter/nf_tables_offload.h>
 
@@ -308,6 +310,54 @@ nft_meta_get_eval_sdifname(u32 *dest, const struct nft_pktinfo *pkt)
 	nft_meta_store_ifname(dest, dev);
 }
 
+static void nft_meta_pktinfo_may_update(struct nft_pktinfo *pkt)
+{
+	struct sk_buff *skb = pkt->skb;
+	struct vlan_ethhdr *veth;
+	__be16 ethertype;
+	int nhoff;
+
+	/* Is this an IP packet? Then, skip. */
+	if (pkt->flags)
+		return;
+
+	/* ... else maybe an IP packet over PPPoE or Q-in-Q? */
+	switch (skb->protocol) {
+	case htons(ETH_P_8021Q):
+		if (!pskb_may_pull(skb, skb_mac_offset(skb) + sizeof(*veth)))
+			return;
+
+		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
+		nhoff = VLAN_HLEN;
+		ethertype = veth->h_vlan_encapsulated_proto;
+		break;
+	case htons(ETH_P_PPP_SES):
+		if (!nf_flow_pppoe_proto(skb, &ethertype))
+			return;
+
+		nhoff = PPPOE_SES_HLEN;
+		break;
+	default:
+		return;
+	}
+
+	nhoff += skb_network_offset(skb);
+	switch (ethertype) {
+	case htons(ETH_P_IP):
+		if (__nft_set_pktinfo_ipv4_validate(pkt, nhoff))
+			nft_set_pktinfo_unspec(pkt);
+		break;
+	case htons(ETH_P_IPV6):
+		if (__nft_set_pktinfo_ipv6_validate(pkt, nhoff))
+			nft_set_pktinfo_unspec(pkt);
+		break;
+	default:
+		break;
+	}
+
+	pkt->ethertype = ethertype;
+}
+
 void nft_meta_get_eval(const struct nft_expr *expr,
 		       struct nft_regs *regs,
 		       const struct nft_pktinfo *pkt)
@@ -321,12 +371,14 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 		*dest = skb->len;
 		break;
 	case NFT_META_PROTOCOL:
-		nft_reg_store16(dest, (__force u16)skb->protocol);
+		nft_meta_pktinfo_may_update((struct nft_pktinfo *)pkt);
+		nft_reg_store16(dest, (__force u16)pkt->ethertype);
 		break;
 	case NFT_META_NFPROTO:
 		nft_reg_store8(dest, nft_pf(pkt));
 		break;
 	case NFT_META_L4PROTO:
+		nft_meta_pktinfo_may_update((struct nft_pktinfo *)pkt);
 		if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
 			goto err;
 		nft_reg_store8(dest, pkt->tprot);
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 4034d61e2a135b..125650be78436e 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -183,7 +183,7 @@ void nft_payload_eval(const struct nft_expr *expr,
 		offset = skb_mac_header(skb) - skb->data;
 		break;
 	case NFT_PAYLOAD_NETWORK_HEADER:
-		offset = skb_network_offset(skb);
+		offset = skb_network_offset(skb) + pkt->nhoff;
 		break;
 	case NFT_PAYLOAD_TRANSPORT_HEADER:
 		if (!(pkt->flags & NFT_PKTINFO_L4PROTO) || pkt->fragoff)

From fe189691a7938dfc901d64195bdbb29ca2ab8a40 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 9 Jun 2026 13:51:54 +0200
Subject: [PATCH 0809/1982] netfilter: nftables: restrict linklayer and network
 header writes

[ Upstream commit df07998dfd40796a05fff7ffea2661ad65ed42a7 ]

Don't permit arbitrary writes to linklayer and network header data.
Several spots in network stack trust header validation performed in
ipv4/ipv6 before PRE_ROUTING hook.

For linklayer, allow writes for netdev ingress. For other hooks, only
allow link layer writes that do not spill into network header.

For network header, check the offset/length combinations:
 - changing dscp requires store at offset 0 for checsum fixups, so
 make sure ip version + length field isn't altered.
 - ip6 dscp starts directly after the version field, so make sure it
   remains 6.

Several of these checks could already be done at rule insertion time.
Risk is that this might cause ruleset load failures for existing
rulesets. With this change such writes are silently skipped and packet
passes unchanged.

Transport and inner header bases are not checked / restricted.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_payload.c | 170 ++++++++++++++++++++++++++++++++++++
 1 file changed, 170 insertions(+)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 125650be78436e..2562af7b879ab7 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -824,6 +824,172 @@ nft_payload_set_vlan(const u32 *src, struct sk_buff *skb, u16 offset, u8 len,
 	return true;
 }
 
+/* Ingress is very early, before l3 protocol handlers.
+ * There should be no in-tree code that trusts l3/l4 headers
+ * between ingress and NF_INET_PRE_ROUTING hooks.
+ */
+static bool nft_in_ingress(const struct nf_hook_state *s)
+{
+	return s->pf == NFPROTO_NETDEV && s->hook == NF_NETDEV_INGRESS;
+}
+
+static bool nft_nh_write_ok_ip4(const struct nft_pktinfo *pkt,
+				const struct nft_payload_set *priv,
+				const u32 *src)
+{
+	unsigned int offset = priv->offset + skb_network_offset(pkt->skb);
+	const u8 *new_octets = (const u8 *)src;
+	u8 old_octet;
+
+	switch (priv->offset) {
+	case 0: /* csum fixups does expand dscp/tos store to 2 bytes.
+		 * make sure ihl/version remain unchanged.
+		 */
+		if (skb_copy_bits(pkt->skb, offset, &old_octet, sizeof(old_octet)))
+			return false;
+
+		return priv->len == 2 &&
+		       *new_octets == old_octet;
+	case offsetof(struct iphdr, tos):
+		return priv->len == 1;
+	case offsetof(struct iphdr, id):
+		return priv->len == 2;
+	case offsetof(struct iphdr, ttl):
+		if (priv->len == 1)
+			return true;
+
+		if (priv->len != 2)
+			return false;
+
+		/* same, csum fixup does expand ttl store to two bytes.
+		 * check protocol is not altered.
+		 */
+		if (skb_copy_bits(pkt->skb, offset + 1, &old_octet, sizeof(old_octet)))
+			return false;
+
+		return new_octets[1] == old_octet;
+	case offsetof(struct iphdr, check):
+		return priv->len <= 2 + 4 + 4;
+	case offsetof(struct iphdr, saddr):
+		return priv->len <= 4 + 4;
+	case offsetof(struct iphdr, daddr):
+		return priv->len <= 4;
+	}
+
+	return false;
+}
+
+static bool nft_nh_write_ok_ip6(const struct nft_pktinfo *pkt,
+				const struct nft_payload_set *priv,
+				const u32 *src)
+{
+	const struct ipv6hdr *ih = (const void *)src;
+
+	switch (priv->offset) {
+	case 0: /* store to dscp must not alter ip6 version */
+		return priv->len <= 4 && ih->version == 6;
+	case 2:
+		return priv->len <= 2;
+	case offsetof(struct ipv6hdr, hop_limit):
+		return priv->len == 1;
+	case offsetof(struct ipv6hdr, saddr):
+		return priv->len <= 16 + 16;
+	case offsetof(struct ipv6hdr, daddr):
+		return priv->len <= 16;
+	}
+
+	return false;
+}
+
+static bool nft_nh_write_ok_arp(const struct nft_payload_set *priv)
+{
+	/* Variable size for standard ethernet arp */
+	const unsigned int eth_ip = 2 * (ETH_ALEN + 4);
+	unsigned int offset = priv->offset;
+
+	switch (offset) {
+	case offsetof(struct arphdr, ar_op):
+		return priv->len == 2;
+	default:
+		break;
+	}
+
+	/* permit writes post fixed arp header size. offset + len are
+	 * checked vs skb size via skb_ensure_writable.
+	 */
+	return offset >= sizeof(struct arphdr) && priv->len <= eth_ip;
+}
+
+static bool nft_nh_write_ok_netdev(const struct nft_pktinfo *pkt,
+				   const struct nft_payload_set *priv,
+				   const u32 *src)
+{
+#ifdef CONFIG_NF_TABLES_NETDEV
+	switch (pkt->skb->protocol) {
+	case htons(ETH_P_ARP):
+		return nft_nh_write_ok_arp(priv);
+	case htons(ETH_P_IP):
+		return nft_nh_write_ok_ip4(pkt, priv, src);
+	case htons(ETH_P_IPV6):
+		return nft_nh_write_ok_ip6(pkt, priv, src);
+	}
+#endif
+	/* default to false for now, relax later in case we have
+	 * use-cases that need inner header manipulation for
+	 * encapsulated traffic like vlan or PPPoE.
+	 */
+	return false;
+}
+
+static bool nft_nh_write_ok_bridge(const struct nft_pktinfo *pkt,
+				   const struct nft_payload_set *priv,
+				   const u32 *src)
+{
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+	switch (pkt->ethertype) {
+	case htons(ETH_P_ARP):
+		return nft_nh_write_ok_arp(priv);
+	case htons(ETH_P_IP):
+		return nft_nh_write_ok_ip4(pkt, priv, src);
+	case htons(ETH_P_IPV6):
+		return nft_nh_write_ok_ip6(pkt, priv, src);
+	}
+#endif
+	/* see nft_nh_write_ok_netdev: default to false */
+	return false;
+}
+
+static bool nft_nh_write_ok(const struct nft_pktinfo *pkt,
+			    const struct nft_payload_set *priv,
+			    const u32 *src)
+{
+	switch (pkt->state->pf) {
+	case NFPROTO_ARP:
+		return nft_nh_write_ok_arp(priv);
+	case NFPROTO_BRIDGE:
+		return nft_nh_write_ok_bridge(pkt, priv, src);
+	case NFPROTO_IPV4:
+		return nft_nh_write_ok_ip4(pkt, priv, src);
+	case NFPROTO_IPV6:
+		return nft_nh_write_ok_ip6(pkt, priv, src);
+	case NFPROTO_NETDEV:
+		if (pkt->state->hook == NF_NETDEV_INGRESS)
+			return true;
+		return nft_nh_write_ok_netdev(pkt, priv, src);
+	}
+
+	return false;
+}
+
+/* check linklayer modifications don't spill into network header. */
+static bool nft_ll_write_ok(const struct nft_pktinfo *pkt, int offset)
+{
+	if (nft_in_ingress(pkt->state))
+		return true;
+
+	return offset <= skb_network_offset(pkt->skb);
+}
+
 static void nft_payload_set_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
@@ -851,8 +1017,12 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
 		}
 
 		offset = skb_mac_header(skb) - skb->data - vlan_hlen;
+		if (!nft_ll_write_ok(pkt, priv->len + priv->offset + offset))
+			goto err;
 		break;
 	case NFT_PAYLOAD_NETWORK_HEADER:
+		if (!nft_nh_write_ok(pkt, priv, src))
+			goto err;
 		offset = skb_network_offset(skb);
 		break;
 	case NFT_PAYLOAD_TRANSPORT_HEADER:

From 593971fdc06d6e17685e5aeb1be4a2ab6657a64b Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 9 Jun 2026 13:51:55 +0200
Subject: [PATCH 0810/1982] netfilter: nftables: restrict checkum update offset

[ Upstream commit c3716a3c43465641ded6e01c0b187de42e87a80d ]

After previous patch, writes to network header are restricted.
However, there is another way to manipulate the l3 header: The
checksum update function.

Restrict this for network header writes, only the ipv4 header is
allowed.  This needs run-time checks because BRIDGE, INET, NETDEV
families can carry l3 headers other than IP.

checksum updates to the udp/tcp (l4) headers are not restricted.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_payload.c | 100 ++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 2562af7b879ab7..a6f379ecee8a2e 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -990,6 +990,83 @@ static bool nft_ll_write_ok(const struct nft_pktinfo *pkt, int offset)
 	return offset <= skb_network_offset(pkt->skb);
 }
 
+static bool nft_payload_validate_inet_csum_offset(const struct nft_ctx *ctx,
+						  const struct nft_payload_set *priv)
+{
+	switch (priv->base) {
+	case NFT_PAYLOAD_LL_HEADER:
+		break;
+	case NFT_PAYLOAD_NETWORK_HEADER:
+		if (ctx->family == NFPROTO_IPV4) {
+			if (offsetof(struct iphdr, check) == priv->csum_offset)
+				return true;
+
+			return false;
+		}
+		return true; /* run time validation required */
+	case NFT_PAYLOAD_TRANSPORT_HEADER:
+		if (priv->csum_flags) /* makes no sense, asks for "re-update" of L4 checksum */
+			return false;
+
+		/* no further check here; offset can't be negative so bogus
+		 * offsets can corrupt L4 or payload but not l3 headers.
+		 * We already allow arbitrary l4/inner payload writes.
+		 */
+		return true;
+	case NFT_PAYLOAD_INNER_HEADER:
+		return true;
+	case NFT_PAYLOAD_TUN_HEADER:
+		break;
+	}
+
+	return false;
+}
+
+/* do not allow arbitrary network header mangling via bogus csum_off.
+ * We only support ipv4.  Only NFPROTO_IPV4 can be checked from control
+ * plane.
+ */
+static bool nft_payload_csum_nh_write_ok(const struct nft_payload_set *priv,
+					 const struct nft_pktinfo *pkt)
+{
+	switch (pkt->state->pf) {
+	case NFPROTO_IPV4:
+		/* Warning: NFPROTO_INET was not checked; we can't return true here. */
+		return priv->csum_offset == offsetof(struct iphdr, check);
+	case NFPROTO_IPV6:
+		return false;
+	case NFPROTO_BRIDGE:
+		return pkt->ethertype == htons(ETH_P_IP) &&
+		       priv->csum_offset == offsetof(struct iphdr, check);
+	case NFPROTO_NETDEV:
+		return pkt->skb->protocol == htons(ETH_P_IP) &&
+		       priv->csum_offset == offsetof(struct iphdr, check);
+	}
+
+	return false;
+}
+
+static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
+				      const struct nft_payload_set *priv)
+{
+	switch (priv->base) {
+	case NFT_PAYLOAD_LL_HEADER:
+		break;
+	case NFT_PAYLOAD_NETWORK_HEADER:
+		return nft_payload_csum_nh_write_ok(priv, pkt);
+	case NFT_PAYLOAD_TRANSPORT_HEADER:
+	case NFT_PAYLOAD_INNER_HEADER:
+		/* neither offsets are validated, offsets cannot be
+		 * negative so real l3 headers cannot be mangled.
+		 */
+		return true;
+	case NFT_PAYLOAD_TUN_HEADER:
+		break;
+	}
+
+	return false;
+}
+
 static void nft_payload_set_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
@@ -1054,6 +1131,7 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
 		tsum = csum_partial(src, priv->len, 0);
 
 		if (priv->csum_type == NFT_PAYLOAD_CSUM_INET &&
+		    nft_payload_csum_write_ok(pkt, priv) &&
 		    nft_payload_csum_inet(skb, src, fsum, tsum, csum_offset))
 			goto err;
 
@@ -1120,7 +1198,26 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
 
 	switch (csum_type) {
 	case NFT_PAYLOAD_CSUM_NONE:
+		if (priv->csum_offset) /* nonsensical */
+			return -EINVAL;
+
+		if (priv->csum_flags == 0)
+			break;
+
+		/* Userspace requests L4 checksum update, e.g.:
+		 * - IPv6 stateless NAT (no l3 csum)
+		 * - transport header mangling
+		 * - inner data mangling
+		 */
+		if (priv->base == NFT_PAYLOAD_NETWORK_HEADER ||
+		    priv->base == NFT_PAYLOAD_TRANSPORT_HEADER ||
+		    priv->base == NFT_PAYLOAD_INNER_HEADER)
+			break;
+
+		return -EINVAL;
 	case NFT_PAYLOAD_CSUM_INET:
+		if (!nft_payload_validate_inet_csum_offset(ctx, priv))
+			return -EINVAL;
 		break;
 	case NFT_PAYLOAD_CSUM_SCTP:
 		if (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER)
@@ -1128,6 +1225,9 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
 
 		if (priv->csum_offset != offsetof(struct sctphdr, checksum))
 			return -EINVAL;
+
+		if (priv->csum_flags)
+			return -EINVAL;
 		break;
 	default:
 		return -EOPNOTSUPP;

From 3199bbed3a0bdf72bf294c61eb540472ac4fb6a2 Mon Sep 17 00:00:00 2001
From: Zhiling Zou <zhilinz@nebusec.ai>
Date: Mon, 3 Aug 2026 09:11:23 +0800
Subject: [PATCH 0811/1982] netfilter: validate L4 headers after userspace
 packet writes

[ Upstream commit 112e447d17f78d08485b3076a8baa1dfb9794bd8 ]

NFQUEUE and nft_payload can hand packet data modified by userspace back
to the stack. Recent restrictions keep link and network headers stable,
but transport header fields can still be changed.

A packet can therefore keep the same network header and conntrack entry
while changing the transport header layout. For TCP, increasing doff can
make later helper or NAT code use a different transport-header base than
the parser used, and can make offsets point past skb->tail.

Extend NFQUEUE payload validation to check the final L4 protocol and
known base headers after IPv4 options or IPv6 extension headers. Reject
packets whose L4 protocol no longer matches an attached non-template
conntrack entry, and reject IP fragments that already have such a
conntrack entry before trying to validate transport headers. Unknown L4
protocols are left to their normal protocol handlers.

For nft payload writes, reject transport-header stores that overlap TCP
doff. nft_nh_write_ok() already rejects network-header protocol changes,
so keeping doff stable prevents nft payload writes from changing the TCP
header length underneath conntrack and helper users.

This patch is a follow up to commit df07998dfd40 ("netfilter: nftables:
restrict linklayer and network header writes") and commit 54f34607d184
("netfilter: nfnetlink_queue: restrict writes to network header").

Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_queue.c | 72 +++++++++++++++++++++++++++++++--
 net/netfilter/nft_payload.c     | 13 ++++++
 2 files changed, 82 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7cfb1bdf0e88fd..c5f3307936f8cc 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -28,10 +28,17 @@
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_queue.h>
 #include <linux/netfilter/nf_conntrack_common.h>
+#include <linux/icmp.h>
+#include <linux/icmpv6.h>
+#include <linux/ip.h>
 #include <linux/list.h>
+#include <linux/sctp.h>
 #include <linux/cgroup-defs.h>
 #include <linux/rhashtable.h>
 #include <linux/jhash.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <net/gre.h>
 #include <net/gso.h>
 #include <net/ip.h>
 #include <net/sock.h>
@@ -1199,10 +1206,62 @@ static bool nfqnl_validate_ipopts(const struct iphdr *iph_new,
 	return memcmp(iph_new + 1, ip_hdr(e->skb) + 1, ihl - sizeof(*iph_orig)) == 0;
 }
 
+static bool nfqnl_validate_l4(const u8 *data, unsigned int data_len,
+			      const struct nf_queue_entry *e, u8 proto,
+			      bool fragment)
+{
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+	enum ip_conntrack_info ctinfo;
+	const struct nf_conn *ct;
+
+	ct = nf_ct_get(e->skb, &ctinfo);
+	if (ct && !nf_ct_is_template(ct)) {
+		if (fragment || nf_ct_protonum(ct) != proto)
+			return false;
+	}
+#endif
+
+	if (fragment)
+		return true;
+
+	switch (proto) {
+	case IPPROTO_TCP: {
+		const struct tcphdr *th = (const struct tcphdr *)data;
+		unsigned int thlen;
+
+		if (data_len < sizeof(*th))
+			return false;
+
+		thlen = __tcp_hdrlen(th);
+		if (thlen < sizeof(*th) || data_len < thlen)
+			return false;
+
+		return true;
+	}
+	case IPPROTO_UDP:
+		return data_len >= sizeof(struct udphdr);
+	case IPPROTO_ICMP:
+		return data_len >= sizeof(struct icmphdr);
+	case IPPROTO_ICMPV6:
+		return data_len >= sizeof(struct icmp6hdr);
+	case IPPROTO_SCTP:
+		return data_len >= sizeof(struct sctphdr);
+	case IPPROTO_GRE:
+		return data_len >= sizeof(struct gre_base_hdr);
+	case IPPROTO_AH:
+		return data_len >= sizeof(struct ip_auth_hdr);
+	case IPPROTO_ESP:
+		return data_len >= sizeof(struct ip_esp_hdr);
+	}
+
+	return true;
+}
+
 static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len,
 			       const struct nf_queue_entry *e)
 {
 	unsigned int ihl;
+	bool fragment;
 
 	if (data_len < sizeof(*iph))
 		return false;
@@ -1219,10 +1278,14 @@ static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len,
 	if (ntohs(iph->tot_len) != data_len)
 		return false;
 
+	fragment = iph->frag_off & htons(IP_MF | IP_OFFSET);
+
 	/* support for ipopts mangling would require
 	 * recompile + skb transport header update.
 	 */
-	return nfqnl_validate_ipopts(iph, e);
+	return nfqnl_validate_ipopts(iph, e) &&
+	       nfqnl_validate_l4((const u8 *)iph + ihl, data_len - ihl, e,
+				 iph->protocol, fragment);
 }
 
 static bool nfqnl_validate_one_exthdr(const u8 *data,
@@ -1266,6 +1329,7 @@ static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
 	const u8 *data = (const u8 *)ip6_new;
 	u8 orig_nexthdr = ip6_orig->nexthdr;
 	u8 new_nexthdr = ip6_new->nexthdr;
+	bool fragment = false;
 
 	if (new_nexthdr != orig_nexthdr)
 		return false;
@@ -1279,7 +1343,8 @@ static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
 		int hdrlen;
 
 		if (orig_nexthdr == NEXTHDR_NONE)
-			return true;
+			return nfqnl_validate_l4(data, data_len, e,
+						 new_nexthdr, fragment);
 
 		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
 			return false;
@@ -1290,6 +1355,7 @@ static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
 
 		switch (orig_nexthdr) {
 		case NEXTHDR_FRAGMENT:
+			fragment = true;
 			hdrlen = sizeof(struct frag_hdr);
 			break;
 		case NEXTHDR_AUTH:
@@ -1316,7 +1382,7 @@ static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
 		data += hdrlen;
 	}
 
-	return true;
+	return nfqnl_validate_l4(data, data_len, e, new_nexthdr, fragment);
 }
 
 static bool nfqnl_validate_ip6(const struct ipv6hdr *ip6, unsigned int data_len,
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index a6f379ecee8a2e..592fe48a73f84c 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -1067,6 +1067,17 @@ static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
 	return false;
 }
 
+static bool nft_th_write_ok(const struct nft_pktinfo *pkt,
+			    const struct nft_payload_set *priv)
+{
+	unsigned int doff = offsetof(struct tcphdr, ack_seq) + sizeof(__be32);
+
+	if (pkt->tprot != IPPROTO_TCP)
+		return true;
+
+	return priv->offset > doff || priv->offset + priv->len <= doff;
+}
+
 static void nft_payload_set_eval(const struct nft_expr *expr,
 				 struct nft_regs *regs,
 				 const struct nft_pktinfo *pkt)
@@ -1105,6 +1116,8 @@ static void nft_payload_set_eval(const struct nft_expr *expr,
 	case NFT_PAYLOAD_TRANSPORT_HEADER:
 		if (!(pkt->flags & NFT_PKTINFO_L4PROTO) || pkt->fragoff)
 			goto err;
+		if (!nft_th_write_ok(pkt, priv))
+			goto err;
 		offset = nft_thoff(pkt);
 		break;
 	case NFT_PAYLOAD_INNER_HEADER:

From d1f2c892c6cb5801a51817b12bd0326b22b27880 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Sat, 5 Sep 2026 07:01:50 +0200
Subject: [PATCH 0812/1982] netfilter: nft_payload: restrict checksum offsets
 to known values

[ Upstream commit c2226f0c7fe90b67732e5ae36dc5c3cc01ddf888 ]

We need to prevent userspace from corrupting e.g. tcp->doff, because
many locations in conntrack and conntrack helpers rely on
nf_conntrack_in() having validated the packet headers.
nft_payload allows to alter headers later which invalidates this
assumption.

The 'Fixes' commit restricts writes to safe fields, but there is
another side channel: the checksum location.

Restrict this too.  Reported via sashiko/gemini.

Fixes: 112e447d17f7 ("netfilter: validate L4 headers after userspace packet writes")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_payload.c | 40 ++++++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 592fe48a73f84c..7f9561111c8dbe 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -20,6 +20,7 @@
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <net/gre.h>
+#include <linux/icmp.h>
 #include <linux/icmpv6.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
@@ -1008,11 +1009,14 @@ static bool nft_payload_validate_inet_csum_offset(const struct nft_ctx *ctx,
 		if (priv->csum_flags) /* makes no sense, asks for "re-update" of L4 checksum */
 			return false;
 
-		/* no further check here; offset can't be negative so bogus
-		 * offsets can corrupt L4 or payload but not l3 headers.
-		 * We already allow arbitrary l4/inner payload writes.
-		 */
-		return true;
+		/* Validate csum_offset is one of the supported transport header checksums */
+		if (priv->csum_offset == offsetof(struct tcphdr, check) ||
+		    priv->csum_offset == offsetof(struct udphdr, check) ||
+		    priv->csum_offset == offsetof(struct icmphdr, checksum) ||
+		    priv->csum_offset == offsetof(struct icmp6hdr, icmp6_cksum))
+			return true;
+
+		return false;
 	case NFT_PAYLOAD_INNER_HEADER:
 		return true;
 	case NFT_PAYLOAD_TUN_HEADER:
@@ -1046,6 +1050,27 @@ static bool nft_payload_csum_nh_write_ok(const struct nft_payload_set *priv,
 	return false;
 }
 
+static bool nft_payload_csum_th_write_ok(const struct nft_payload_set *priv,
+					 const struct nft_pktinfo *pkt)
+{
+	if (!(pkt->flags & NFT_PKTINFO_L4PROTO))
+		return false;
+
+	switch (pkt->tprot) {
+	case IPPROTO_TCP:
+		return priv->csum_offset == offsetof(struct tcphdr, check);
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		return priv->csum_offset == offsetof(struct udphdr, check);
+	case IPPROTO_ICMPV6:
+		return priv->csum_offset == offsetof(struct icmp6hdr, icmp6_cksum);
+	case IPPROTO_ICMP:
+		return priv->csum_offset == offsetof(struct icmphdr, checksum);
+	}
+
+	return false;
+}
+
 static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
 				      const struct nft_payload_set *priv)
 {
@@ -1055,9 +1080,10 @@ static bool nft_payload_csum_write_ok(const struct nft_pktinfo *pkt,
 	case NFT_PAYLOAD_NETWORK_HEADER:
 		return nft_payload_csum_nh_write_ok(priv, pkt);
 	case NFT_PAYLOAD_TRANSPORT_HEADER:
+		return nft_payload_csum_th_write_ok(priv, pkt);
 	case NFT_PAYLOAD_INNER_HEADER:
-		/* neither offsets are validated, offsets cannot be
-		 * negative so real l3 headers cannot be mangled.
+		/* offset is not validated, offset cannot be
+		 * negative so real l3/l4 headers cannot be mangled.
 		 */
 		return true;
 	case NFT_PAYLOAD_TUN_HEADER:

From 8fd7a71a70955fce73f75911799a43c8fcb7a7f9 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 29 Apr 2026 08:21:35 +0200
Subject: [PATCH 0813/1982] netfilter: nf_tables: fix netdev hook allocation
 memleak with dormant tables

[ Upstream commit 63bac027860308d1344f761cb47aabb3b30973fd ]

sashiko says:
 could the related code in __nf_tables_abort() leak the struct nft_hook objects when the table is dormant?

 In __nf_tables_abort(), when rolling back a NEWCHAIN transaction that
 updates hooks, the code conditionally unregisters and frees the hooks only
 if the table is not dormant [..]
            if (!(table->flags & NFT_TABLE_F_DORMANT)) {
                nft_netdev_unregister_hooks(net,
                                            &nft_trans_chain_hooks(trans),
                                            true);
            }
            ...
            nft_trans_destroy(trans);

Unfortunately netdev family mixes hook registration and allocation.
Push table struct down and only check for the flag to unregister.

Fixes: 216e7bf7402c ("netfilter: nf_tables: skip netdev hook unregistration if table is dormant")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_tables_api.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 31c3ff79b2d5cd..76876761698eba 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -404,6 +404,7 @@ static void nft_netdev_unregister_trans_hook(struct net *net,
 }
 
 static void nft_netdev_unregister_hooks(struct net *net,
+					const struct nft_table *table,
 					struct list_head *hook_list,
 					bool release_netdev)
 {
@@ -411,8 +412,10 @@ static void nft_netdev_unregister_hooks(struct net *net,
 	struct nf_hook_ops *ops;
 
 	list_for_each_entry_safe(hook, next, hook_list, list) {
-		list_for_each_entry(ops, &hook->ops_list, list)
-			nf_unregister_net_hook(net, ops);
+		if (!(table->flags & NFT_TABLE_F_DORMANT)) {
+			list_for_each_entry(ops, &hook->ops_list, list)
+				nf_unregister_net_hook(net, ops);
+		}
 		if (release_netdev)
 			nft_netdev_hook_unlink_free_rcu(hook);
 	}
@@ -449,20 +452,25 @@ static void __nf_tables_unregister_hook(struct net *net,
 	struct nft_base_chain *basechain;
 	const struct nf_hook_ops *ops;
 
-	if (table->flags & NFT_TABLE_F_DORMANT ||
-	    !nft_is_base_chain(chain))
+	if (!nft_is_base_chain(chain))
 		return;
 	basechain = nft_base_chain(chain);
 	ops = &basechain->ops;
 
+	/* must also be called for dormant tables */
+	if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
+		nft_netdev_unregister_hooks(net, table, &basechain->hook_list,
+					    release_netdev);
+		return;
+	}
+
+	if (table->flags & NFT_TABLE_F_DORMANT)
+		return;
+
 	if (basechain->type->ops_unregister)
 		return basechain->type->ops_unregister(net, ops);
 
-	if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
-		nft_netdev_unregister_hooks(net, &basechain->hook_list,
-					    release_netdev);
-	else
-		nf_unregister_net_hook(net, &basechain->ops);
+	nf_unregister_net_hook(net, &basechain->ops);
 }
 
 static void nf_tables_unregister_hook(struct net *net,
@@ -11296,11 +11304,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
 			break;
 		case NFT_MSG_NEWCHAIN:
 			if (nft_trans_chain_update(trans)) {
-				if (!(table->flags & NFT_TABLE_F_DORMANT)) {
-					nft_netdev_unregister_hooks(net,
-								    &nft_trans_chain_hooks(trans),
-								    true);
-				}
+				nft_netdev_unregister_hooks(net, table,
+							    &nft_trans_chain_hooks(trans),
+							    true);
 				free_percpu(nft_trans_chain_stats(trans));
 				kfree(nft_trans_chain_name(trans));
 				nft_trans_destroy(trans);

From 818a9fd779443b931b05c025d85f29680efb26c2 Mon Sep 17 00:00:00 2001
From: Yongjun Gwon <d3bugee@gmail.com>
Date: Mon, 2 Nov 2026 17:15:26 -0500
Subject: [PATCH 0814/1982] ksmbd: serialize directory emptiness checks with
 readdir

[ Upstream commit 7220980b2423d06a0604516129bfa4cec8a697ae ]

SMB2 QUERY_DIRECTORY holds fp->readdir_lock while it calls iterate_dir()
on fp->filp. An SMB2 SET_INFO request with FILE_DISPOSITION_INFORMATION
can resolve the same FileId and call ksmbd_vfs_empty_dir() on the same
filp without that lock.

iterate_dir()'s inode read lock permits concurrent readers and does not
serialize per-file iterator state. ext4 stores its dx readdir cursor and
fname RB tree in file->private_data. Concurrent reset or refill can
therefore free a fname node while the other worker still traverses it or
retains its RB-tree link, resulting in use-after-free accesses.

An authenticated SMB client with list and delete rights on a directory in
a writable KSMBD share backed by ext4 can trigger this when the directory
takes the dx readdir path. The client overlaps an SMB2 QUERY_DIRECTORY
request with an SMB2 SET_INFO request carrying FILE_DISPOSITION_INFORMATION
on one live FileId.

In one x86_64 SMP KASAN multi-shot guest using ksmbd-for-next at
171df27077fb, the unmodified kernel reported a cross-worker use-after-free
before a panic. The first report's access and free stacks show the two
request paths directly (trimmed):

  BUG: KASAN: slab-use-after-free in ext4_htree_store_dirent+0x488/0x550
  Read of size 8 by task kworker/2:0/29
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   ext4_htree_store_dirent+0x488/0x550
   htree_dirblock_to_tree+0x535/0x990
   ext4_htree_fill_tree+0x319/0xba0
   ext4_readdir+0x175a/0x2f40
   iterate_dir+0x1b6/0x630
   smb2_query_dir+0x1003/0x1cc0

  Freed by task 279:
   free_rb_tree_fname+0x67/0xc0
   ext4_readdir+0x13a9/0x2f40
   iterate_dir+0x1b6/0x630
   ksmbd_vfs_empty_dir+0xa2/0x100
   smb2_set_info+0x2ffa/0x45d0

Take fp->readdir_lock across the entire emptiness check. This places both
iterators over that handle's filp in the same lock domain while
preserving the disposition status handling. The exact code change
completed a warning-free x86_64 KASAN bzImage build. Tracing three request
pairs showed that the two iterate_dir() calls no longer overlapped and the
expected statuses were preserved. A further 1,600 reproducer iterations
completed with expected statuses and no KASAN report, Oops, or panic.

The reproducer and complete guest configuration are available privately
to maintainers on request.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yongjun Gwon <d3bugee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: adjusted set_file_disposition_info() context for the existing directory condition and older oplock/delete-pending helpers ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/smb2pdu.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 793c219b9a6107..5ba6869038f3dd 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6592,6 +6592,7 @@ static int set_file_disposition_info(struct ksmbd_work *work,
 				     struct smb2_file_disposition_info *file_info)
 {
 	struct inode *inode;
+	int err;
 
 	if (!(fp->daccess & FILE_DELETE_LE)) {
 		pr_err("no right to delete : 0x%x\n", fp->daccess);
@@ -6600,9 +6601,13 @@ static int set_file_disposition_info(struct ksmbd_work *work,
 
 	inode = file_inode(fp->filp);
 	if (file_info->DeletePending) {
-		if (S_ISDIR(inode->i_mode) &&
-		    ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY)
-			return -EBUSY;
+		if (S_ISDIR(inode->i_mode)) {
+			mutex_lock(&fp->readdir_lock);
+			err = ksmbd_vfs_empty_dir(fp);
+			mutex_unlock(&fp->readdir_lock);
+			if (err == -ENOTEMPTY)
+				return -EBUSY;
+		}
 		smb_break_all_levII_oplock(work, fp, 0);
 		ksmbd_set_inode_pending_delete(fp);
 	} else {

From 0bc2d40b9c01be44ecc73435038c32ccf4b3a692 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Tue, 3 Nov 2026 19:08:03 +0800
Subject: [PATCH 0815/1982] ksmbd: fix breaking_cnt leak on early return in
 oplock_break()

For leases, oplock_break() increments breaking_cnt before calling
oplock_break_pending(), and returns early when the pending check
reports nothing to break: the level is already at or below the
requested level and, for a lease, the state is not HANDLE|READ
caching.  Neither early return decrements the counter, and
wait_lease_breaking(), the only place that force-clears it, sits
below those returns, so breaking_cnt stays elevated for the life of
the open.

A stuck breaking_cnt makes same_client_has_lease() skip lease
upgrades forever, and every subsequent same-client CREATE on that
lease is answered with SMB2_LEASE_FLAG_BREAK_IN_PROGRESS, so the
client never resumes caching.

The ordering dates back to the original SMB3 server code, but the
early return became routinely reachable for leases already broken to
NONE when smb_break_all_levII_oplock() stopped filtering out
non-level-II leases in 17699905a381, "ksmbd: fix lease break and ack
state handling".

Move the increment below the pending check so the early returns
cannot strand the counter.  This is the minimal equivalent of the
reorder that mainline made in b0148dc5625d, "ksmbd: serialize oplock
close with pending break ownership".

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/smb/server/oplock.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 7d78d4ae43acb0..90cd8c962f7856 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1012,10 +1012,15 @@ static int oplock_break(struct oplock_info *brk_opinfo, struct ksmbd_inode *ci,
 	if (brk_opinfo->is_lease) {
 		struct lease *lease = brk_opinfo->o_lease;
 
-		atomic_inc(&brk_opinfo->breaking_cnt);
 		err = oplock_break_pending(brk_opinfo, req_op_level);
 		if (err)
 			return err < 0 ? err : 0;
+		/*
+		 * Increment breaking_cnt only after the pending check
+		 * above: its early returns would otherwise strand the
+		 * counter, as wait_lease_breaking() is never reached.
+		 */
+		atomic_inc(&brk_opinfo->breaking_cnt);
 
 		if (brk_opinfo->open_trunc) {
 			/*

From 9e3a6b707681a6291a410d1b7ce15840a9912a86 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Thu, 1 Oct 2026 16:30:39 +0200
Subject: [PATCH 0816/1982] rtnetlink: wait for RCU readers in
 rtnl_link_unregister()

[ Upstream commit 3b70edea393de445255da6c706eebb823117a955 ]

rtnl_link_ops_get() finds ops on link_ops under rcu_read_lock() and only
then takes ops->srcu. rtnl_link_unregister() unlinks ops, then calls
synchronize_srcu() and cleanup_srcu_struct() without first waiting for
RCU readers. A reader that found ops before list_del_rcu() and has not yet
taken ops->srcu is not waited for.

Such a reader then locks a cleaned-up srcu_struct and keeps using ops
after the module that owns it is gone. rtnl_newlink() and
rtnl_dump_ifinfo() both look up ops without RTNL, the latter for any
user that dumps links filtered by kind.

With delays added between the lookup and srcu_read_lock() in
rtnl_link_ops_get(), and before rtnl_link_ops_put() in
rtnl_dump_ifinfo(), running "ip link show type dummy" alongside
"rmmod dummy" on a KASAN kernel gives:

  BUG: KASAN: vmalloc-out-of-bounds in __srcu_read_unlock+0x57/0x70
  Read of size 8 at addr ffffffffc02ff318 by task ip/147
  Call Trace:
   __srcu_read_unlock+0x57/0x70
   rtnl_dump_ifinfo.cold+0x30/0x3b
   rtnl_dumpit+0x7a/0x1b0
   netlink_dump+0x486/0x11b0
   __netlink_dump_start+0x661/0x910
   rtnetlink_rcv_msg+0x611/0x9e0
   netlink_rcv_skb+0x126/0x380
   netlink_unicast+0x605/0x830
   netlink_sendmsg+0x6d0/0xbb0
   __sys_sendto+0x335/0x3a0

Call synchronize_rcu() before synchronize_srcu(), as
rtnl_af_unregister() already does. This should be enough because
rtnl_link_ops_get() is the only RCU walker of link_ops, and it takes
ops->srcu before rcu_read_unlock(), so every reader that found ops is
covered by synchronize_srcu() once the RCU grace period ends. The extra
grace period only costs time at module unload.

Readers and the writer were serialized by RTNL until link_ops got its
own mutex, which is why the missing RCU wait did not matter before.

Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Fixes: 6b57ff21a310 ("rtnetlink: Protect link_ops by mutex.")
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261001143040.28467-1-parri.andrea@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/rtnetlink.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b0e6a6eff23ba8..23f693d61d9080 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -682,6 +682,10 @@ void rtnl_link_unregister(struct rtnl_link_ops *ops)
 	list_del_rcu(&ops->list);
 	mutex_unlock(&link_ops_mutex);
 
+	/* Wait for rtnl_link_ops_get() readers that found ops but have
+	 * not yet taken ops->srcu.
+	 */
+	synchronize_rcu();
 	synchronize_srcu(&ops->srcu);
 	cleanup_srcu_struct(&ops->srcu);
 

From 47c65443173086a38726770178e55d3d59b71bc6 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 3 Nov 2026 17:04:39 +0100
Subject: [PATCH 0817/1982] EDAC/mc: Really fix error path ordering in
 edac_mc_alloc()

The backport of 51520e03e70d ("EDAC/mc: Fix error path ordering in
edac_mc_alloc()") to stable kernel branches is incomplete due to a
different memory allocation scheme. In v6.19 and earlier, the device
initialization must be moved further up so that all jumps to the
error label are covered.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: stable@kernel.org # v6.19-
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_mc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index b510919e49c0ee..ebac0690f9a419 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -366,13 +366,13 @@ struct mem_ctl_info *edac_mc_alloc(unsigned int mc_num,
 	if (!mci)
 		return NULL;
 
+	mci->dev.release = mci_release;
+	device_initialize(&mci->dev);
+
 	mci->layers = kcalloc(n_layers, sizeof(struct edac_mc_layer), GFP_KERNEL);
 	if (!mci->layers)
 		goto error;
 
-	mci->dev.release = mci_release;
-	device_initialize(&mci->dev);
-
 	mci->pvt_info = kzalloc(sz_pvt, GFP_KERNEL);
 	if (!mci->pvt_info)
 		goto error;

From 9d275d40b6ece705ba1f10410883b6c374b9e24b Mon Sep 17 00:00:00 2001
From: Hazem Mohamed Abuelfotoh <abuehaze@amazon.com>
Date: Tue, 3 Nov 2026 17:45:41 +0000
Subject: [PATCH 0818/1982] Revert "net: Convert proto_ops bind() callbacks to
 use sockaddr_unsized"

Revert commit 946dc5835c8fbe5eb5ceb13f5717778911ff4586 which is commit
0e50474fa514822e9d990874e554bf8043a201d7 upstream.

Commit 946dc5835c8f ("net: Convert proto_ops bind() callbacks to use
sockaddr_unsized") is a backport of upstream commit 0e50474fa514. It was
queued for v6.18.57 only as a Stable-dep-of commit 56e78b670356
("Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback"),
but it is not a dependency of that fix:

 - Commit 56e78b670356 ("Bluetooth: hci_sync: hold conn in
   hci_connect_big_sync() callback") touches only
   net/bluetooth/hci_sync.c. Commit 0e50474fa514 ("net: Convert
   proto_ops bind() callbacks to use sockaddr_unsized") changes 74
   files and none of them is net/bluetooth/hci_sync.c.

 - The same fix went into 6.12.y as commit 117d8bcaf1ab ("Bluetooth:
   hci_sync: hold conn in hci_connect_big_sync() callback") without
   commit 0e50474fa514 ("net: Convert proto_ops bind() callbacks to use
   sockaddr_unsized"). Its +/- lines are identical to the 6.18.y
   version, commit ff5625d27415 ("Bluetooth: hci_sync: hold conn in
   hci_connect_big_sync() callback").

 - Commit ff5625d27415 ("Bluetooth: hci_sync: hold conn in
   hci_connect_big_sync() callback") cherry-picks cleanly onto the
   parent of commit 946dc5835c8f ("net: Convert proto_ops bind()
   callbacks to use sockaddr_unsized"), and the resulting
   net/bluetooth/hci_sync.c matches the one in v6.18.57.

Upstream commit 0e50474fa514 ("net: Convert proto_ops bind() callbacks
to use sockaddr_unsized") carries no Fixes: or Cc: stable tag. It is an
API conversion ("No binary changes expected"), not a fix. It also
needed non-trivial adaptation for 6.18.y. Commit bf33247a90d3 ("net:
Add struct sockaddr_unsized for sockaddr of unknown length") is not in
6.18.y, so the backport adds its own definition of struct
sockaddr_unsized to include/linux/socket.h.

The result is a half-converted in-kernel socket API, which no mainline
release ever had:

               kernel_bind()               kernel_connect()
  v6.18.56     struct sockaddr *           struct sockaddr *
  v6.18.57+    struct sockaddr_unsized *   struct sockaddr *
  v6.19        struct sockaddr_unsized *   struct sockaddr_unsized *

Code that probes for struct sockaddr_unsized via kernel_bind() and then
assumes the mainline (v6.19+) kernel_connect() signature breaks on
6.18.57+ with -Werror=incompatible-pointer-types.

Nothing in 6.18.y after v6.18.57 depends on this commit. With it
reverted on top of v6.18.59, the tree contains no references to
struct sockaddr_unsized.

Signed-off-by: Hazem Mohamed Abuelfotoh <abuehaze@amazon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/af_alg.c                                 |  2 +-
 drivers/block/drbd/drbd_receiver.c              |  4 ++--
 drivers/infiniband/hw/erdma/erdma_cm.c          |  4 ++--
 drivers/infiniband/sw/siw/siw_cm.c              |  6 +++---
 drivers/isdn/mISDN/l1oip_core.c                 |  2 +-
 drivers/isdn/mISDN/socket.c                     |  4 ++--
 drivers/net/ppp/pptp.c                          |  4 ++--
 drivers/nvme/host/tcp.c                         |  2 +-
 drivers/nvme/target/tcp.c                       |  2 +-
 drivers/target/iscsi/iscsi_target_login.c       |  2 +-
 drivers/xen/pvcalls-back.c                      |  2 +-
 fs/afs/rxrpc.c                                  |  6 +++---
 fs/dlm/lowcomms.c                               |  6 +++---
 fs/ocfs2/cluster/tcp.c                          |  4 ++--
 fs/smb/client/connect.c                         |  2 +-
 fs/smb/server/transport_tcp.c                   |  4 ++--
 include/linux/net.h                             |  4 ++--
 include/linux/socket.h                          | 17 -----------------
 include/net/inet_common.h                       |  2 +-
 include/net/ipv6.h                              |  2 +-
 include/net/sock.h                              |  2 +-
 net/9p/trans_fd.c                               |  2 +-
 net/appletalk/ddp.c                             |  2 +-
 net/atm/pvc.c                                   |  4 ++--
 net/atm/svc.c                                   |  2 +-
 net/ax25/af_ax25.c                              |  2 +-
 net/bluetooth/hci_sock.c                        |  2 +-
 net/bluetooth/iso.c                             |  4 ++--
 net/bluetooth/l2cap_sock.c                      |  2 +-
 net/bluetooth/rfcomm/core.c                     |  4 ++--
 net/bluetooth/rfcomm/sock.c                     |  2 +-
 net/bluetooth/sco.c                             |  2 +-
 net/can/isotp.c                                 |  2 +-
 net/can/j1939/socket.c                          |  2 +-
 net/can/raw.c                                   |  2 +-
 net/core/sock.c                                 |  2 +-
 net/ieee802154/socket.c                         |  4 ++--
 net/ipv4/af_inet.c                              |  4 ++--
 net/ipv4/udp_tunnel_core.c                      |  2 +-
 net/ipv6/af_inet6.c                             |  4 ++--
 net/ipv6/ip6_udp_tunnel.c                       |  2 +-
 net/iucv/af_iucv.c                              |  2 +-
 net/l2tp/l2tp_core.c                            |  4 ++--
 net/llc/af_llc.c                                |  2 +-
 net/mctp/af_mctp.c                              |  2 +-
 net/mctp/test/route-test.c                      |  2 +-
 net/mctp/test/utils.c                           |  2 +-
 net/mptcp/protocol.c                            |  6 +++---
 net/mptcp/subflow.c                             |  2 +-
 net/netfilter/ipvs/ip_vs_sync.c                 |  4 ++--
 net/netlink/af_netlink.c                        |  2 +-
 net/netrom/af_netrom.c                          |  2 +-
 net/nfc/llcp_sock.c                             |  4 ++--
 net/packet/af_packet.c                          | 11 +++++------
 net/phonet/socket.c                             |  8 ++++----
 net/qrtr/af_qrtr.c                              |  2 +-
 net/qrtr/ns.c                                   |  2 +-
 net/rds/bind.c                                  |  2 +-
 net/rds/rds.h                                   |  2 +-
 net/rds/tcp_connect.c                           |  2 +-
 net/rds/tcp_listen.c                            |  2 +-
 net/rose/af_rose.c                              |  2 +-
 net/rxrpc/af_rxrpc.c                            |  2 +-
 net/rxrpc/rxperf.c                              |  2 +-
 net/smc/af_smc.c                                |  2 +-
 net/smc/smc.h                                   |  2 +-
 net/socket.c                                    |  6 +++---
 net/sunrpc/clnt.c                               |  4 ++--
 net/sunrpc/svcsock.c                            |  2 +-
 net/sunrpc/xprtsock.c                           |  4 ++--
 net/tipc/socket.c                               |  4 ++--
 net/unix/af_unix.c                              |  4 ++--
 net/vmw_vsock/af_vsock.c                        |  4 ++--
 net/x25/af_x25.c                                |  2 +-
 net/xdp/xsk.c                                   |  2 +-
 .../selftests/bpf/test_kmods/bpf_testmod.c      |  2 +-
 76 files changed, 113 insertions(+), 131 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 33adc1882276cc..3c3cb965fd74eb 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -145,7 +145,7 @@ void af_alg_release_parent(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(af_alg_release_parent);
 
-static int alg_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
 	struct sock *sk = sock->sk;
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index ede589d1149ec3..acac73b75c7cbb 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -450,7 +450,7 @@ static struct socket *drbd_try_connect(struct drbd_connection *connection)
 	*  a free one dynamically.
 	*/
 	what = "bind before connect";
-	err = sock->ops->bind(sock, (struct sockaddr_unsized *) &src_in6, my_addr_len);
+	err = sock->ops->bind(sock, (struct sockaddr *) &src_in6, my_addr_len);
 	if (err < 0)
 		goto out;
 
@@ -537,7 +537,7 @@ static int prepare_listen_socket(struct drbd_connection *connection, struct acce
 	drbd_setbufsize(s_listen, sndbuf_size, rcvbuf_size);
 
 	what = "bind before listen";
-	err = s_listen->ops->bind(s_listen, (struct sockaddr_unsized *)&my_addr, my_addr_len);
+	err = s_listen->ops->bind(s_listen, (struct sockaddr *)&my_addr, my_addr_len);
 	if (err < 0)
 		goto out;
 
diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
index 189f6c9424677c..f0c8ebf62a0578 100644
--- a/drivers/infiniband/hw/erdma/erdma_cm.c
+++ b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -993,7 +993,7 @@ static int kernel_bindconnect(struct socket *s, struct sockaddr *laddr,
 	int ret;
 
 	sock_set_reuseaddr(s->sk);
-	ret = s->ops->bind(s, (struct sockaddr_unsized *)laddr, laddrlen);
+	ret = s->ops->bind(s, laddr, laddrlen);
 	if (ret)
 		return ret;
 	ret = s->ops->connect(s, raddr, raddrlen, flags);
@@ -1313,7 +1313,7 @@ int erdma_create_listen(struct iw_cm_id *id, int backlog)
 	if (ipv4_is_zeronet(laddr->sin_addr.s_addr))
 		s->sk->sk_bound_dev_if = dev->netdev->ifindex;
 
-	ret = s->ops->bind(s, (struct sockaddr_unsized *)laddr,
+	ret = s->ops->bind(s, (struct sockaddr *)laddr,
 			   sizeof(struct sockaddr_in));
 	if (ret)
 		goto error;
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 31fc9987a27531..04fabab440581b 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1342,7 +1342,7 @@ static int kernel_bindconnect(struct socket *s, struct sockaddr *laddr,
 			return rv;
 	}
 
-	rv = s->ops->bind(s, (struct sockaddr_unsized *)laddr, size);
+	rv = s->ops->bind(s, laddr, size);
 	if (rv < 0)
 		return rv;
 
@@ -1793,7 +1793,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
 				goto error;
 			}
 		}
-		rv = s->ops->bind(s, (struct sockaddr_unsized *)laddr,
+		rv = s->ops->bind(s, (struct sockaddr *)laddr,
 				  sizeof(struct sockaddr_in));
 	} else {
 		struct sockaddr_in6 *laddr = &to_sockaddr_in6(id->local_addr);
@@ -1817,7 +1817,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
 				goto error;
 			}
 		}
-		rv = s->ops->bind(s, (struct sockaddr_unsized *)laddr,
+		rv = s->ops->bind(s, (struct sockaddr *)laddr,
 				  sizeof(struct sockaddr_in6));
 	}
 	if (rv) {
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 6ab036e4a35fbe..f732f6614d3707 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -676,7 +676,7 @@ l1oip_socket_thread(void *data)
 	hc->sin_remote.sin_port = htons((unsigned short)hc->remoteport);
 
 	/* bind to incoming port */
-	if (socket->ops->bind(socket, (struct sockaddr_unsized *)&hc->sin_local,
+	if (socket->ops->bind(socket, (struct sockaddr *)&hc->sin_local,
 			      sizeof(hc->sin_local))) {
 		printk(KERN_ERR "%s: Failed to bind socket to port %d.\n",
 		       __func__, hc->localport);
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 77b900db1cac27..b215b28cad7b76 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -462,7 +462,7 @@ static int data_sock_getsockopt(struct socket *sock, int level, int optname,
 }
 
 static int
-data_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
+data_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	struct sockaddr_mISDN *maddr = (struct sockaddr_mISDN *) addr;
 	struct sock *sk = sock->sk;
@@ -696,7 +696,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 }
 
 static int
-base_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
+base_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	struct sockaddr_mISDN *maddr = (struct sockaddr_mISDN *) addr;
 	struct sock *sk = sock->sk;
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index d07e87a0974c03..90737cb718928a 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -382,8 +382,8 @@ static int pptp_rcv(struct sk_buff *skb)
 	return NET_RX_DROP;
 }
 
-static int pptp_bind(struct socket *sock, struct sockaddr_unsized *uservaddr,
-		     int sockaddr_len)
+static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
+	int sockaddr_len)
 {
 	struct sock *sk = sock->sk;
 	struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 9f15feff661328..b7e4624f1dcd82 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1894,7 +1894,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid,
 	sk_set_memalloc(queue->sock->sk);
 
 	if (nctrl->opts->mask & NVMF_OPT_HOST_TRADDR) {
-		ret = kernel_bind(queue->sock, (struct sockaddr_unsized *)&ctrl->src_addr,
+		ret = kernel_bind(queue->sock, (struct sockaddr *)&ctrl->src_addr,
 			sizeof(ctrl->src_addr));
 		if (ret) {
 			dev_err(nctrl->device,
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index b4d212bbbe1206..b9a904f184892d 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -2150,7 +2150,7 @@ static int nvmet_tcp_add_port(struct nvmet_port *nport)
 	if (so_priority > 0)
 		sock_set_priority(port->sock->sk, so_priority);
 
-	ret = kernel_bind(port->sock, (struct sockaddr_unsized *)&port->addr,
+	ret = kernel_bind(port->sock, (struct sockaddr *)&port->addr,
 			sizeof(port->addr));
 	if (ret) {
 		pr_err("failed to bind port socket %d\n", ret);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4e455d8a20e75c..6108a9f3bdd549 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -822,7 +822,7 @@ int iscsit_setup_np(
 	sock_set_reuseaddr(sock->sk);
 	ip_sock_set_freebind(sock->sk);
 
-	ret = kernel_bind(sock, (struct sockaddr_unsized *)&np->np_sockaddr, len);
+	ret = kernel_bind(sock, (struct sockaddr *)&np->np_sockaddr, len);
 	if (ret < 0) {
 		pr_err("kernel_bind() failed: %d\n", ret);
 		goto fail;
diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index da1b516b9cfddb..fd7ed65e0197d7 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -650,7 +650,7 @@ static int pvcalls_back_bind(struct xenbus_device *dev,
 	if (ret < 0)
 		goto out;
 
-	ret = inet_bind(map->sock, (struct sockaddr_unsized *)&req->u.bind.addr,
+	ret = inet_bind(map->sock, (struct sockaddr *)&req->u.bind.addr,
 			req->u.bind.len);
 	if (ret < 0)
 		goto out;
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 6415f42cf7ff85..b3207e141343b6 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -82,16 +82,16 @@ int afs_open_socket(struct afs_net *net)
 	if (ret < 0)
 		pr_err("Couldn't create RxGK CM key: %d\n", ret);
 
-	ret = kernel_bind(socket, (struct sockaddr_unsized *) &srx, sizeof(srx));
+	ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
 	if (ret == -EADDRINUSE) {
 		srx.transport.sin6.sin6_port = 0;
-		ret = kernel_bind(socket, (struct sockaddr_unsized *) &srx, sizeof(srx));
+		ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
 	}
 	if (ret < 0)
 		goto error_2;
 
 	srx.srx_service = YFS_CM_SERVICE;
-	ret = kernel_bind(socket, (struct sockaddr_unsized *) &srx, sizeof(srx));
+	ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
 	if (ret < 0)
 		goto error_2;
 
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 0500421b6e3bd2..9a0b6c2b6b01e4 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -1134,7 +1134,7 @@ static int sctp_bind_addrs(struct socket *sock, __be16 port)
 		make_sockaddr(&localaddr, port, &addr_len);
 
 		if (!i)
-			result = kernel_bind(sock, (struct sockaddr_unsized *)addr, addr_len);
+			result = kernel_bind(sock, addr, addr_len);
 		else
 			result = sock_bind_add(sock->sk, addr, addr_len);
 
@@ -1813,7 +1813,7 @@ static int dlm_tcp_bind(struct socket *sock)
 	memcpy(&src_addr, &dlm_local_addr[0], sizeof(src_addr));
 	make_sockaddr(&src_addr, 0, &addr_len);
 
-	result = kernel_bind(sock, (struct sockaddr_unsized *)&src_addr,
+	result = kernel_bind(sock, (struct sockaddr *)&src_addr,
 			     addr_len);
 	if (result < 0) {
 		/* This *may* not indicate a critical error */
@@ -1852,7 +1852,7 @@ static int dlm_tcp_listen_bind(struct socket *sock)
 
 	/* Bind to our port */
 	make_sockaddr(&dlm_local_addr[0], dlm_config.ci_tcp_port, &addr_len);
-	return kernel_bind(sock, (struct sockaddr_unsized *)&dlm_local_addr[0],
+	return kernel_bind(sock, (struct sockaddr *)&dlm_local_addr[0],
 			   addr_len);
 }
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index d65a445535a32f..32048c65b66bac 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1645,7 +1645,7 @@ static void o2net_start_connect(struct work_struct *work)
 	myaddr.sin_addr.s_addr = mynode->nd_ipv4_address;
 	myaddr.sin_port = htons(0); /* any port */
 
-	ret = sock->ops->bind(sock, (struct sockaddr_unsized *)&myaddr,
+	ret = sock->ops->bind(sock, (struct sockaddr *)&myaddr,
 			      sizeof(myaddr));
 	if (ret) {
 		mlog(ML_ERROR, "bind failed with %d at address %pI4\n",
@@ -2072,7 +2072,7 @@ static int o2net_open_listening_sock(__be32 addr, __be16 port)
 	INIT_WORK(&o2net_listen_work, o2net_accept_many);
 
 	sock->sk->sk_reuse = SK_CAN_REUSE;
-	ret = sock->ops->bind(sock, (struct sockaddr_unsized *)&sin, sizeof(sin));
+	ret = sock->ops->bind(sock, (struct sockaddr *)&sin, sizeof(sin));
 	if (ret < 0) {
 		printk(KERN_ERR "o2net: Error %d while binding socket at "
 		       "%pI4:%u\n", ret, &addr, ntohs(port)); 
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index e908d522920c81..3089b469b80183 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -3121,7 +3121,7 @@ bind_socket(struct TCP_Server_Info *server)
 		struct socket *socket = server->ssocket;
 
 		rc = kernel_bind(socket,
-				 (struct sockaddr_unsized *) &server->srcaddr,
+				 (struct sockaddr *) &server->srcaddr,
 				 sizeof(server->srcaddr));
 		if (rc < 0) {
 			struct sockaddr_in *saddr4;
diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
index 130f3882b16911..a25237f82cd763 100644
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -536,10 +536,10 @@ static int create_socket(struct interface *iface)
 	}
 
 	if (ipv4)
-		ret = kernel_bind(ksmbd_socket, (struct sockaddr_unsized *)&sin,
+		ret = kernel_bind(ksmbd_socket, (struct sockaddr *)&sin,
 				  sizeof(sin));
 	else
-		ret = kernel_bind(ksmbd_socket, (struct sockaddr_unsized *)&sin6,
+		ret = kernel_bind(ksmbd_socket, (struct sockaddr *)&sin6,
 				  sizeof(sin6));
 	if (ret) {
 		pr_err("Failed to bind socket: %d\n", ret);
diff --git a/include/linux/net.h b/include/linux/net.h
index 0e316f06311307..ec09620f40f709 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -163,7 +163,7 @@ struct proto_ops {
 	struct module	*owner;
 	int		(*release)   (struct socket *sock);
 	int		(*bind)	     (struct socket *sock,
-				      struct sockaddr_unsized *myaddr,
+				      struct sockaddr *myaddr,
 				      int sockaddr_len);
 	int		(*connect)   (struct socket *sock,
 				      struct sockaddr *vaddr,
@@ -345,7 +345,7 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec,
 int kernel_recvmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec,
 		   size_t num, size_t len, int flags);
 
-int kernel_bind(struct socket *sock, struct sockaddr_unsized *addr, int addrlen);
+int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen);
 int kernel_listen(struct socket *sock, int backlog);
 int kernel_accept(struct socket *sock, struct socket **newsock, int flags);
 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 7b1a01be29da8c..3b262487ec0603 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -40,23 +40,6 @@ struct sockaddr {
 	};
 };
 
-/**
- * struct sockaddr_unsized - Unspecified size sockaddr for callbacks
- * @sa_family: Address family (AF_UNIX, AF_INET, AF_INET6, etc.)
- * @sa_data: Flexible array for address data
- *
- * This structure is designed for callback interfaces where the
- * total size is known via the sockaddr_len parameter. Unlike struct
- * sockaddr which has a fixed 14-byte sa_data limit or struct
- * sockaddr_storage which has a fixed 128-byte sa_data limit, this
- * structure can accommodate addresses of any size, but must be used
- * carefully.
- */
-struct sockaddr_unsized {
-	__kernel_sa_family_t	sa_family;	/* address family, AF_xxx */
-	char			sa_data[];	/* flexible address data */
-};
-
 struct linger {
 	int		l_onoff;	/* Linger active		*/
 	int		l_linger;	/* How long to linger for	*/
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index 0978b2e27d3517..0f4626776b2961 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -42,7 +42,7 @@ int inet_shutdown(struct socket *sock, int how);
 int inet_listen(struct socket *sock, int backlog);
 int __inet_listen_sk(struct sock *sk, int backlog);
 void inet_sock_destruct(struct sock *sk);
-int inet_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len);
+int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
 int inet_bind_sk(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 /* Don't allocate port at this moment, defer to connect. */
 #define BIND_FORCE_ADDRESS_NO_PORT	(1 << 0)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index dffa1b7b96be07..d001d6046c2803 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1207,7 +1207,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu);
 void inet6_cleanup_sock(struct sock *sk);
 void inet6_sock_destruct(struct sock *sk);
 int inet6_release(struct socket *sock);
-int inet6_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len);
+int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
 int inet6_bind_sk(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
 		  int peer);
diff --git a/include/net/sock.h b/include/net/sock.h
index 50c11bd0fcfc38..fb91d72a955ddb 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1907,7 +1907,7 @@ int sock_cmsg_send(struct sock *sk, struct msghdr *msg,
  * Functions to fill in entries in struct proto_ops when a protocol
  * does not implement a particular function.
  */
-int sock_no_bind(struct socket *sock, struct sockaddr_unsized *saddr, int len);
+int sock_no_bind(struct socket *, struct sockaddr *, int);
 int sock_no_connect(struct socket *, struct sockaddr *, int, int);
 int sock_no_socketpair(struct socket *, struct socket *);
 int sock_no_accept(struct socket *, struct socket *, struct proto_accept_arg *);
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index ef517bb307e27e..a516745f732f71 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -966,7 +966,7 @@ static int p9_bind_privport(struct socket *sock)
 			((struct sockaddr_in *)&stor)->sin_port = htons((ushort)port);
 		else
 			((struct sockaddr_in6 *)&stor)->sin6_port = htons((ushort)port);
-		err = kernel_bind(sock, (struct sockaddr_unsized *)&stor, sizeof(stor));
+		err = kernel_bind(sock, (struct sockaddr *)&stor, sizeof(stor));
 		if (err != -EADDRINUSE)
 			break;
 	}
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 45db43cde67f19..30242fe1034191 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1149,7 +1149,7 @@ static int atalk_autobind(struct sock *sk)
 }
 
 /* Set the address 'our end' of the connection */
-static int atalk_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int atalk_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sockaddr_at *addr = (struct sockaddr_at *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 62fdf07c53dead..66d9a9bd589672 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -24,7 +24,7 @@ static int pvc_shutdown(struct socket *sock, int how)
 	return 0;
 }
 
-static int pvc_bind(struct socket *sock, struct sockaddr_unsized *sockaddr,
+static int pvc_bind(struct socket *sock, struct sockaddr *sockaddr,
 		    int sockaddr_len)
 {
 	struct sock *sk = sock->sk;
@@ -59,7 +59,7 @@ static int pvc_bind(struct socket *sock, struct sockaddr_unsized *sockaddr,
 static int pvc_connect(struct socket *sock, struct sockaddr *sockaddr,
 		       int sockaddr_len, int flags)
 {
-	return pvc_bind(sock, (struct sockaddr_unsized *)sockaddr, sockaddr_len);
+	return pvc_bind(sock, sockaddr, sockaddr_len);
 }
 
 static int pvc_setsockopt(struct socket *sock, int level, int optname,
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 1906a493c8aa06..f8137ae693b08c 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -97,7 +97,7 @@ static int svc_release(struct socket *sock)
 	return 0;
 }
 
-static int svc_bind(struct socket *sock, struct sockaddr_unsized *sockaddr,
+static int svc_bind(struct socket *sock, struct sockaddr *sockaddr,
 		    int sockaddr_len)
 {
 	DEFINE_WAIT(wait);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 32114f659b8d90..5ce59d1ba8221c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1147,7 +1147,7 @@ static int ax25_release(struct socket *sock)
  *	that we've implemented support for SO_BINDTODEVICE. It is however small
  *	and trivially backward compatible.
  */
-static int ax25_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
 	struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 910fa591283818..42e9d9101f617f 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1196,7 +1196,7 @@ static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd,
 }
 #endif
 
-static int hci_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
 			 int addr_len)
 {
 	struct sockaddr_hci haddr;
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index e43aaa8289a091..0af1e5939ec7f9 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1017,7 +1017,7 @@ static int iso_sock_create(struct net *net, struct socket *sock, int protocol,
 	return 0;
 }
 
-static int iso_sock_bind_bc(struct socket *sock, struct sockaddr_unsized *addr,
+static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
 			    int addr_len)
 {
 	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
@@ -1095,7 +1095,7 @@ static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa,
 	return err;
 }
 
-static int iso_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
 			 int addr_len)
 {
 	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index e78866e02bfc20..bb383ee188bbc8 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -81,7 +81,7 @@ static int l2cap_validate_le_psm(u16 psm)
 	return 0;
 }
 
-static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen)
+static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
 	struct sock *sk = sock->sk;
 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 59fb93be9c20e0..77f7c7fa40d370 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -845,7 +845,7 @@ static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst,
 	addr.l2_psm    = 0;
 	addr.l2_cid    = 0;
 	addr.l2_bdaddr_type = BDADDR_BREDR;
-	*err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
+	*err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 	if (*err < 0)
 		goto failed;
 
@@ -2200,7 +2200,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
 	addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
 	addr.l2_cid    = 0;
 	addr.l2_bdaddr_type = BDADDR_BREDR;
-	err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
+	err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 	if (err < 0) {
 		BT_ERR("Bind failed %d", err);
 		goto failed;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index aeb50468c43924..c7aaf469b73bc6 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -337,7 +337,7 @@ static int rfcomm_sock_create(struct net *net, struct socket *sock,
 	return 0;
 }
 
-static int rfcomm_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
+static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	struct sockaddr_rc sa;
 	struct sock *sk = sock->sk;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f45bf97ad327b3..40386023c4cfc9 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -701,7 +701,7 @@ static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 	return 0;
 }
 
-static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
 			 int addr_len)
 {
 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
diff --git a/net/can/isotp.c b/net/can/isotp.c
index 525ed477d15cd7..6c88f7777965ac 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1513,7 +1513,7 @@ static int isotp_release(struct socket *sock)
 	return 0;
 }
 
-static int isotp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len)
+static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 {
 	struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 852e1b1b805f26..f550c1fffef606 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -441,7 +441,7 @@ static int j1939_sk_sanity_check(struct sockaddr_can *addr, int len)
 	return 0;
 }
 
-static int j1939_sk_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len)
+static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 {
 	struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
 	struct j1939_sock *jsk = j1939_sk(sock->sk);
diff --git a/net/can/raw.c b/net/can/raw.c
index def1d83c567cb1..9f0fa8baff85ad 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -459,7 +459,7 @@ static int raw_release(struct socket *sock)
 	return 0;
 }
 
-static int raw_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len)
+static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 {
 	struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/core/sock.c b/net/core/sock.c
index b8c723d6ac593d..03136176c7d0f9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3433,7 +3433,7 @@ EXPORT_SYMBOL_GPL(sk_set_peek_off);
  * function, some default processing is provided.
  */
 
-int sock_no_bind(struct socket *sock, struct sockaddr_unsized *saddr, int len)
+int sock_no_bind(struct socket *sock, struct sockaddr *saddr, int len)
 {
 	return -EOPNOTSUPP;
 }
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index 550485ec32daa7..dc0de5ae6afbdb 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -96,13 +96,13 @@ static int ieee802154_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 	return sk->sk_prot->sendmsg(sk, msg, len);
 }
 
-static int ieee802154_sock_bind(struct socket *sock, struct sockaddr_unsized *uaddr,
+static int ieee802154_sock_bind(struct socket *sock, struct sockaddr *uaddr,
 				int addr_len)
 {
 	struct sock *sk = sock->sk;
 
 	if (sk->sk_prot->bind)
-		return sk->sk_prot->bind(sk, (struct sockaddr *)uaddr, addr_len);
+		return sk->sk_prot->bind(sk, uaddr, addr_len);
 
 	return sock_no_bind(sock, uaddr, addr_len);
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 5f6f6019b298e0..72cb7d9aee9100 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -464,9 +464,9 @@ int inet_bind_sk(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	return __inet_bind(sk, uaddr, addr_len, flags);
 }
 
-int inet_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-	return inet_bind_sk(sock->sk, (struct sockaddr *)uaddr, addr_len);
+	return inet_bind_sk(sock->sk, uaddr, addr_len);
 }
 EXPORT_SYMBOL(inet_bind);
 
diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
index 11e5a88c923de2..54386e06a81365 100644
--- a/net/ipv4/udp_tunnel_core.c
+++ b/net/ipv4/udp_tunnel_core.c
@@ -29,7 +29,7 @@ int udp_sock_create4(struct net *net, struct udp_port_cfg *cfg,
 	udp_addr.sin_family = AF_INET;
 	udp_addr.sin_addr = cfg->local_ip;
 	udp_addr.sin_port = cfg->local_udp_port;
-	err = kernel_bind(sock, (struct sockaddr_unsized *)&udp_addr,
+	err = kernel_bind(sock, (struct sockaddr *)&udp_addr,
 			  sizeof(udp_addr));
 	if (err < 0)
 		goto error;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3111db617b88b8..1c45e1d15506c4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -465,9 +465,9 @@ int inet6_bind_sk(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 }
 
 /* bind for INET6 API */
-int inet6_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-	return inet6_bind_sk(sock->sk, (struct sockaddr *)uaddr, addr_len);
+	return inet6_bind_sk(sock->sk, uaddr, addr_len);
 }
 EXPORT_SYMBOL(inet6_bind);
 
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index b0d9286b33c88c..0ff547a4bff71d 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -40,7 +40,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
 	memcpy(&udp6_addr.sin6_addr, &cfg->local_ip6,
 	       sizeof(udp6_addr.sin6_addr));
 	udp6_addr.sin6_port = cfg->local_udp_port;
-	err = kernel_bind(sock, (struct sockaddr_unsized *)&udp6_addr,
+	err = kernel_bind(sock, (struct sockaddr *)&udp6_addr,
 			  sizeof(udp6_addr));
 	if (err < 0)
 		goto error;
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 8ec56556be3b30..3472bdde31af4a 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -579,7 +579,7 @@ static void __iucv_auto_name(struct iucv_sock *iucv)
 }
 
 /* Bind an unbound socket */
-static int iucv_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
 			  int addr_len)
 {
 	DECLARE_SOCKADDR(struct sockaddr_iucv *, sa, addr);
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 60bd9d5e4dea14..fd78928e9be266 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1511,7 +1511,7 @@ static int l2tp_tunnel_sock_create(struct net *net,
 			memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
 			       sizeof(ip6_addr.l2tp_addr));
 			ip6_addr.l2tp_conn_id = tunnel_id;
-			err = kernel_bind(sock, (struct sockaddr_unsized *)&ip6_addr,
+			err = kernel_bind(sock, (struct sockaddr *)&ip6_addr,
 					  sizeof(ip6_addr));
 			if (err < 0)
 				goto out;
@@ -1538,7 +1538,7 @@ static int l2tp_tunnel_sock_create(struct net *net,
 			ip_addr.l2tp_family = AF_INET;
 			ip_addr.l2tp_addr = cfg->local_ip;
 			ip_addr.l2tp_conn_id = tunnel_id;
-			err = kernel_bind(sock, (struct sockaddr_unsized *)&ip_addr,
+			err = kernel_bind(sock, (struct sockaddr *)&ip_addr,
 					  sizeof(ip_addr));
 			if (err < 0)
 				goto out;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6f6336634ddbdc..1863cacc63a875 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -338,7 +338,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
  *	otherwise all hell will break loose.
  *	Returns: 0 upon success, negative otherwise.
  */
-static int llc_ui_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addrlen)
+static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 {
 	struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
index 5b1ef50637b708..b99ba14f39d2bf 100644
--- a/net/mctp/af_mctp.c
+++ b/net/mctp/af_mctp.c
@@ -49,7 +49,7 @@ static bool mctp_sockaddr_ext_is_ok(const struct sockaddr_mctp_ext *addr)
 	       !addr->__smctp_pad0[2];
 }
 
-static int mctp_bind(struct socket *sock, struct sockaddr_unsized *addr, int addrlen)
+static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
 {
 	struct sock *sk = sock->sk;
 	struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk);
diff --git a/net/mctp/test/route-test.c b/net/mctp/test/route-test.c
index be9149ac79dd28..69a3ccfc6310cd 100644
--- a/net/mctp/test/route-test.c
+++ b/net/mctp/test/route-test.c
@@ -205,7 +205,7 @@ static void __mctp_route_test_init(struct kunit *test,
 	addr.smctp_network = netid;
 	addr.smctp_addr.s_addr = 8;
 	addr.smctp_type = 0;
-	rc = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
+	rc = kernel_bind(sock, (struct sockaddr *)&addr, sizeof(addr));
 	KUNIT_ASSERT_EQ(test, rc, 0);
 
 	*devp = dev;
diff --git a/net/mctp/test/utils.c b/net/mctp/test/utils.c
index 5a1c65fa49779a..953d4190277189 100644
--- a/net/mctp/test/utils.c
+++ b/net/mctp/test/utils.c
@@ -292,5 +292,5 @@ void mctp_test_bind_run(struct kunit *test,
 	addr.smctp_type = setup->bind_type;
 
 	*ret_bind_errno =
-		kernel_bind(*sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
+		kernel_bind(*sock, (struct sockaddr *)&addr, sizeof(addr));
 }
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 50eaa8ace5d558..e14a49180eefe1 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3964,7 +3964,7 @@ static struct proto mptcp_prot = {
 	.no_autobind	= true,
 };
 
-static int mptcp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int mptcp_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct mptcp_sock *msk = mptcp_sk(sock->sk);
 	struct sock *ssk, *sk = sock->sk;
@@ -3978,10 +3978,10 @@ static int mptcp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int a
 	}
 
 	if (sk->sk_family == AF_INET)
-		err = inet_bind_sk(ssk, (struct sockaddr *)uaddr, addr_len);
+		err = inet_bind_sk(ssk, uaddr, addr_len);
 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
 	else if (sk->sk_family == AF_INET6)
-		err = inet6_bind_sk(ssk, (struct sockaddr *)uaddr, addr_len);
+		err = inet6_bind_sk(ssk, uaddr, addr_len);
 #endif
 	if (!err)
 		mptcp_copy_inaddrs(sk, ssk);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 7e96537365241e..1932fcf9f92528 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1672,7 +1672,7 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_pm_local *local,
 		addrlen = sizeof(struct sockaddr_in6);
 #endif
 	ssk->sk_bound_dev_if = local->ifindex;
-	err = kernel_bind(sf, (struct sockaddr_unsized *)&addr, addrlen);
+	err = kernel_bind(sf, (struct sockaddr *)&addr, addrlen);
 	if (err) {
 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNTXBINDERR);
 		pr_debug("msk=%p local=%d remote=%d bind error: %d\n",
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 4bd959a5d363b3..b835f61886d6d4 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1459,7 +1459,7 @@ static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 	sin.sin_addr.s_addr  = addr;
 	sin.sin_port         = 0;
 
-	return kernel_bind(sock, (struct sockaddr_unsized *)&sin, sizeof(sin));
+	return kernel_bind(sock, (struct sockaddr *)&sin, sizeof(sin));
 }
 
 static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
@@ -1566,7 +1566,7 @@ static int make_receive_sock(struct netns_ipvs *ipvs, int id,
 
 	get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
 	sock->sk->sk_bound_dev_if = dev->ifindex;
-	result = kernel_bind(sock, (struct sockaddr_unsized *)&mcast_addr, salen);
+	result = kernel_bind(sock, (struct sockaddr *)&mcast_addr, salen);
 	if (result < 0) {
 		pr_err("Error binding to the multicast addr\n");
 		goto error;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6c0aabca5dbadd..fec8b52ed05e76 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -968,7 +968,7 @@ static void netlink_undo_bind(int group, long unsigned int groups,
 			nlk->netlink_unbind(sock_net(sk), undo + 1);
 }
 
-static int netlink_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 			int addr_len)
 {
 	struct sock *sk = sock->sk;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index d9c484705c9e76..c9433b1a28721a 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -564,7 +564,7 @@ static int nr_release(struct socket *sock)
 	return 0;
 }
 
-static int nr_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
 	struct nr_sock *nr = nr_sk(sk);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 21cef27e2032fc..0601ddb4304aa6 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -56,7 +56,7 @@ static struct proto llcp_sock_proto = {
 	.obj_size = sizeof(struct nfc_llcp_sock),
 };
 
-static int llcp_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen)
+static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
 	struct sock *sk = sock->sk;
 	struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
@@ -146,7 +146,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, in
 	return ret;
 }
 
-static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
+static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
 			      int alen)
 {
 	struct sock *sk = sock->sk;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fc56efe64a28e0..4516e54525223a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3346,12 +3346,11 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
  *	Bind a packet socket to a device
  */
 
-static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr,
+static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
 			    int addr_len)
 {
 	struct sock *sk = sock->sk;
-	struct sockaddr *sa = (struct sockaddr *)uaddr;
-	char name[sizeof(sa->sa_data_min) + 1];
+	char name[sizeof(uaddr->sa_data_min) + 1];
 
 	/*
 	 *	Check legality
@@ -3362,13 +3361,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr_unsized *uaddr,
 	/* uaddr->sa_data comes from the userspace, it's not guaranteed to be
 	 * zero-terminated.
 	 */
-	memcpy(name, sa->sa_data, sizeof(sa->sa_data_min));
-	name[sizeof(sa->sa_data_min)] = 0;
+	memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min));
+	name[sizeof(uaddr->sa_data_min)] = 0;
 
 	return packet_do_bind(sk, name, 0, 0);
 }
 
-static int packet_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index ac21a83d9a4da2..f0e2a8bf8fdc7c 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -153,7 +153,7 @@ EXPORT_SYMBOL(pn_sock_unhash);
 
 static DEFINE_MUTEX(port_mutex);
 
-static int pn_socket_bind(struct socket *sock, struct sockaddr_unsized *addr, int len)
+static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
 {
 	struct sock *sk = sock->sk;
 	struct pn_sock *pn = pn_sk(sk);
@@ -163,7 +163,7 @@ static int pn_socket_bind(struct socket *sock, struct sockaddr_unsized *addr, in
 	u8 saddr;
 
 	if (sk->sk_prot->bind)
-		return sk->sk_prot->bind(sk, (struct sockaddr *)addr, len);
+		return sk->sk_prot->bind(sk, addr, len);
 
 	if (len < sizeof(struct sockaddr_pn))
 		return -EINVAL;
@@ -206,8 +206,8 @@ static int pn_socket_autobind(struct socket *sock)
 
 	memset(&sa, 0, sizeof(sa));
 	sa.spn_family = AF_PHONET;
-	err = pn_socket_bind(sock, (struct sockaddr_unsized *)&sa,
-			     sizeof(struct sockaddr_pn));
+	err = pn_socket_bind(sock, (struct sockaddr *)&sa,
+				sizeof(struct sockaddr_pn));
 	/*
 	 * pn_socket_bind() also returns -EINVAL when sk_state != TCP_CLOSE
 	 * without a prior bind, so -EINVAL alone is not sufficient to infer
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 0c08ac0d888135..1f40496d84a33b 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -819,7 +819,7 @@ static int qrtr_autobind(struct socket *sock)
 }
 
 /* Bind socket to specified sockaddr. */
-static int qrtr_bind(struct socket *sock, struct sockaddr_unsized *saddr, int len)
+static int qrtr_bind(struct socket *sock, struct sockaddr *saddr, int len)
 {
 	DECLARE_SOCKADDR(struct sockaddr_qrtr *, addr, saddr);
 	struct qrtr_sock *ipc = qrtr_sk(sock->sk);
diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index b418188822c11c..e8e3ba1b3b8239 100644
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -771,7 +771,7 @@ int qrtr_ns_init(void)
 	sq.sq_port = QRTR_PORT_CTRL;
 	qrtr_ns.local_node = sq.sq_node;
 
-	ret = kernel_bind(qrtr_ns.sock, (struct sockaddr_unsized *)&sq, sizeof(sq));
+	ret = kernel_bind(qrtr_ns.sock, (struct sockaddr *)&sq, sizeof(sq));
 	if (ret < 0) {
 		pr_err("failed to bind to socket\n");
 		goto err_wq;
diff --git a/net/rds/bind.c b/net/rds/bind.c
index f800d920d96903..97a29172a8eec4 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -160,7 +160,7 @@ void rds_remove_bound(struct rds_sock *rs)
 	rs->rs_bound_addr = in6addr_any;
 }
 
-int rds_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
 	struct rds_sock *rs = rds_sk_to_rs(sk);
diff --git a/net/rds/rds.h b/net/rds/rds.h
index dcbc4610735d56..a1dd83c2f9a290 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -746,7 +746,7 @@ extern wait_queue_head_t rds_poll_waitq;
 
 
 /* bind.c */
-int rds_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len);
+int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
 void rds_remove_bound(struct rds_sock *rs);
 struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
 				__u32 scope_id);
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index 1eff3b03ab7749..a0046e99d6df71 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -145,7 +145,7 @@ int rds_tcp_conn_path_connect(struct rds_conn_path *cp)
 		addrlen = sizeof(sin);
 	}
 
-	ret = kernel_bind(sock, (struct sockaddr_unsized *)addr, addrlen);
+	ret = kernel_bind(sock, addr, addrlen);
 	if (ret) {
 		rdsdebug("bind failed with %d at address %pI6c\n",
 			 ret, &conn->c_laddr);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 53e59e22752160..93e8ee10bc8d7a 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -289,7 +289,7 @@ struct socket *rds_tcp_listen_init(struct net *net, bool isv6)
 		addr_len = sizeof(*sin);
 	}
 
-	ret = kernel_bind(sock, (struct sockaddr_unsized *)&ss, addr_len);
+	ret = kernel_bind(sock, (struct sockaddr *)&ss, addr_len);
 	if (ret < 0) {
 		rdsdebug("could not bind %s listener socket: %d\n",
 			 isv6 ? "IPv6" : "IPv4", ret);
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4fca64156640e0..4912138bb2f692 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -729,7 +729,7 @@ static int rose_release(struct socket *sock)
 	return 0;
 }
 
-static int rose_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
 	struct rose_sock *rose = rose_sk(sk);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 76c6b2875d315e..885a28e3afc5ba 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -127,7 +127,7 @@ static int rxrpc_validate_address(struct rxrpc_sock *rx,
 /*
  * bind a local address to an RxRPC socket
  */
-static int rxrpc_bind(struct socket *sock, struct sockaddr_unsized *saddr, int len)
+static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 {
 	struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr;
 	struct rxrpc_local *local;
diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c
index 98ea76fae70f3e..2ea71e3831f75d 100644
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -211,7 +211,7 @@ static int rxperf_open_socket(void)
 
 	ret = rxrpc_sock_set_security_keyring(socket->sk, rxperf_sec_keyring);
 
-	ret = kernel_bind(socket, (struct sockaddr_unsized *)&srx, sizeof(srx));
+	ret = kernel_bind(socket, (struct sockaddr *)&srx, sizeof(srx));
 	if (ret < 0)
 		goto error_2;
 
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index daf235b6a112b6..1db56310fda01f 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -435,7 +435,7 @@ static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
 	return sk;
 }
 
-int smc_bind(struct socket *sock, struct sockaddr_unsized *uaddr,
+int smc_bind(struct socket *sock, struct sockaddr *uaddr,
 	     int addr_len)
 {
 	struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 107d813fa9961a..1425fd756d3434 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -42,7 +42,7 @@ void smc_unhash_sk(struct sock *sk);
 void smc_release_cb(struct sock *sk);
 
 int smc_release(struct socket *sock);
-int smc_bind(struct socket *sock, struct sockaddr_unsized *uaddr,
+int smc_bind(struct socket *sock, struct sockaddr *uaddr,
 	     int addr_len);
 int smc_connect(struct socket *sock, struct sockaddr *addr,
 		int alen, int flags);
diff --git a/net/socket.c b/net/socket.c
index 7da40583ff2936..4ce6ddd768fb46 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1873,7 +1873,7 @@ int __sys_bind_socket(struct socket *sock, struct sockaddr_storage *address,
 				   addrlen);
 	if (!err)
 		err = READ_ONCE(sock->ops)->bind(sock,
-						 (struct sockaddr_unsized *)address,
+						 (struct sockaddr *)address,
 						 addrlen);
 	return err;
 }
@@ -3584,13 +3584,13 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd,
  *	Returns 0 or an error.
  */
 
-int kernel_bind(struct socket *sock, struct sockaddr_unsized *addr, int addrlen)
+int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
 {
 	struct sockaddr_storage address;
 
 	memcpy(&address, addr, addrlen);
 
-	return READ_ONCE(sock->ops)->bind(sock, (struct sockaddr_unsized *)&address,
+	return READ_ONCE(sock->ops)->bind(sock, (struct sockaddr *)&address,
 					  addrlen);
 }
 EXPORT_SYMBOL(kernel_bind);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index c6cfa04dc85ff0..07de0efaf37db9 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1484,12 +1484,12 @@ static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen,
 	switch (sap->sa_family) {
 	case AF_INET:
 		err = kernel_bind(sock,
-				(struct sockaddr_unsized *)&rpc_inaddr_loopback,
+				(struct sockaddr *)&rpc_inaddr_loopback,
 				sizeof(rpc_inaddr_loopback));
 		break;
 	case AF_INET6:
 		err = kernel_bind(sock,
-				(struct sockaddr_unsized *)&rpc_in6addr_loopback,
+				(struct sockaddr *)&rpc_in6addr_loopback,
 				sizeof(rpc_in6addr_loopback));
 		break;
 	default:
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0ebd038095edbd..0ed8d563747144 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1617,7 +1617,7 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
 		ip6_sock_set_v6only(sock->sk);
 	if (type == SOCK_STREAM)
 		sock->sk->sk_reuse = SK_CAN_REUSE; /* allow address reuse */
-	error = kernel_bind(sock, (struct sockaddr_unsized *)sin, len);
+	error = kernel_bind(sock, sin, len);
 	if (error < 0)
 		goto bummer;
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 183891b511a548..2946f6b562fbc8 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1847,8 +1847,8 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
 	memcpy(&myaddr, &transport->srcaddr, transport->xprt.addrlen);
 	do {
 		rpc_set_port((struct sockaddr *)&myaddr, port);
-		err = kernel_bind(sock, (struct sockaddr_unsized *)&myaddr,
-				  transport->xprt.addrlen);
+		err = kernel_bind(sock, (struct sockaddr *)&myaddr,
+				transport->xprt.addrlen);
 		if (err == 0) {
 			if (transport->xprt.reuseport)
 				transport->srcport = port;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index ae7d47c2dc303e..af14b50933f5c8 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -711,7 +711,7 @@ int tipc_sk_bind(struct socket *sock, struct sockaddr *skaddr, int alen)
 	return res;
 }
 
-static int tipc_bind(struct socket *sock, struct sockaddr_unsized *skaddr, int alen)
+static int tipc_bind(struct socket *sock, struct sockaddr *skaddr, int alen)
 {
 	struct tipc_uaddr *ua = (struct tipc_uaddr *)skaddr;
 	u32 atype = ua->addrtype;
@@ -727,7 +727,7 @@ static int tipc_bind(struct socket *sock, struct sockaddr_unsized *skaddr, int a
 			return -EACCES;
 		}
 	}
-	return tipc_sk_bind(sock, (struct sockaddr *)skaddr, alen);
+	return tipc_sk_bind(sock, skaddr, alen);
 }
 
 /**
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d1615e3f44c4f0..a1e832e531bf31 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -855,7 +855,7 @@ static int unix_listen(struct socket *sock, int backlog)
 }
 
 static int unix_release(struct socket *);
-static int unix_bind(struct socket *, struct sockaddr_unsized *, int);
+static int unix_bind(struct socket *, struct sockaddr *, int);
 static int unix_stream_connect(struct socket *, struct sockaddr *,
 			       int addr_len, int flags);
 static int unix_socketpair(struct socket *, struct socket *);
@@ -1478,7 +1478,7 @@ static int unix_bind_abstract(struct sock *sk, struct sockaddr_un *sunaddr,
 	return err;
 }
 
-static int unix_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
 	struct sock *sk = sock->sk;
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 049bd852e68988..999b18f2d17f1a 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1021,7 +1021,7 @@ static int vsock_release(struct socket *sock)
 }
 
 static int
-vsock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
+vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	int err;
 	struct sock *sk;
@@ -1029,7 +1029,7 @@ vsock_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
 
 	sk = sock->sk;
 
-	if (vsock_addr_cast((struct sockaddr *)addr, addr_len, &vm_addr) != 0)
+	if (vsock_addr_cast(addr, addr_len, &vm_addr) != 0)
 		return -EINVAL;
 
 	lock_sock(sk);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 65d8057ae1b4c2..13ba76effe5d67 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -670,7 +670,7 @@ static int x25_release(struct socket *sock)
 	return 0;
 }
 
-static int x25_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len)
+static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
 	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 68194711dded03..5d2067777d3510 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -1508,7 +1508,7 @@ static bool xsk_validate_queues(struct xdp_sock *xs)
 	return xs->fq_tmp && xs->cq_tmp;
 }
 
-static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr_len)
+static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	struct sockaddr_xdp *sxdp = (struct sockaddr_xdp *)addr;
 	struct sock *sk = sock->sk;
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 37d2723062a673..ed0a4721d8fd59 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -949,7 +949,7 @@ __bpf_kfunc int bpf_kfunc_call_kernel_bind(struct addr_args *args)
 		goto out;
 	}
 
-	err = kernel_bind(sock, (struct sockaddr_unsized *)&args->addr, args->addrlen);
+	err = kernel_bind(sock, (struct sockaddr *)&args->addr, args->addrlen);
 out:
 	mutex_unlock(&sock_lock);
 

From f9362852c8b91f76fdf182d7961bf345cc30021a Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 2 Nov 2026 17:14:48 -0500
Subject: [PATCH 0819/1982] media: usbtv: drop redundant device reference

[ Upstream commit dbc6798b80481a20f9aff671bc4d529eae63c9e8 ]

Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Stable-dep-of: cb705f75d03e ("media: usbtv: fix null-pointer dereference on disconnect")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/usbtv/usbtv-core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index 1f7620cd2996d9..4925113af96038 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -91,7 +91,7 @@ static int usbtv_probe(struct usb_interface *intf,
 	if (usbtv == NULL)
 		return -ENOMEM;
 	usbtv->dev = dev;
-	usbtv->udev = usb_get_dev(interface_to_usbdev(intf));
+	usbtv->udev = interface_to_usbdev(intf);
 
 	usbtv->iso_size = size;
 
@@ -119,7 +119,6 @@ static int usbtv_probe(struct usb_interface *intf,
 
 usbtv_video_fail:
 	usb_set_intfdata(intf, NULL);
-	usb_put_dev(usbtv->udev);
 	kfree(usbtv);
 
 	return ret;
@@ -137,7 +136,6 @@ static void usbtv_disconnect(struct usb_interface *intf)
 	usbtv_audio_free(usbtv);
 	usbtv_video_free(usbtv);
 
-	usb_put_dev(usbtv->udev);
 	usbtv->udev = NULL;
 
 	/* the usbtv structure will be deallocated when v4l2 will be

From 42451fefb076230cdeac1da4e85b08e18af67d18 Mon Sep 17 00:00:00 2001
From: Aleksandr Nogikh <nogikh@google.com>
Date: Mon, 2 Nov 2026 17:14:49 -0500
Subject: [PATCH 0820/1982] media: usbtv: fix null-pointer dereference on
 disconnect

[ Upstream commit cb705f75d03e946a4514488beb9e3bac9bcdb2e6 ]

A null-pointer dereference can occur in usb_make_path() when called from
usbtv_querycap() (and other ioctl handlers) during device disconnection.

Oops: general protection fault, probably for non-canonical address
0xdffffc000000000a: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
RIP: 0010:usb_make_path include/linux/usb.h:985 [inline]
RIP: 0010:usbtv_querycap+0x9c/0x100
drivers/media/usb/usbtv/usbtv-video.c:612
...
Call Trace:
 <TASK>
 v4l_querycap+0x236/0x470 drivers/media/v4l2-core/v4l2-ioctl.c:1106
 __video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
 video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
 v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94

This happens due to a race condition between the USB device disconnect
routine (usbtv_disconnect()) and V4L2 ioctls. When the device is
disconnected, usbtv_disconnect() sets usbtv->udev = NULL without holding
the usbtv->v4l2_lock mutex. Concurrently, an ioctl handler like
usbtv_querycap() can be executing under the v4l2_lock and attempt to use
usbtv->udev, leading to a crash.

To fix this, move the usbtv->udev = NULL assignment into usbtv_video_free()
and protect it with mutex_lock(&usbtv->v4l2_lock). This ensures that no
non-queue ioctl handler can run concurrently with the pointer being
nullified. If an ioctl is already running, the mutex will block the
disconnect path until the ioctl finishes. If an ioctl is blocked waiting
for the lock, it will acquire it after the disconnect routine releases it,
but will then check video_is_registered() (which was cleared by
vb2_video_unregister_device()) and safely return -ENODEV.

Acquiring v4l2_lock after vb2_video_unregister_device() avoids
reintroducing a historical deadlock issue, and usbtv_audio_free() remains
safe as it is called before usbtv_video_free().

Fixes: 65e6a2773d65 ("media: usbtv: Remove useless locks in usbtv_video_free()")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+37a57a84893052ab6071@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37a57a84893052ab6071
Link: https://syzkaller.appspot.com/ai_job?id=5abbe65a-5853-4bc2-9135-5c75f88d51ed
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/usbtv/usbtv-core.c  | 2 --
 drivers/media/usb/usbtv/usbtv-video.c | 4 ++++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index 4925113af96038..a444ef56b46680 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -136,8 +136,6 @@ static void usbtv_disconnect(struct usb_interface *intf)
 	usbtv_audio_free(usbtv);
 	usbtv_video_free(usbtv);
 
-	usbtv->udev = NULL;
-
 	/* the usbtv structure will be deallocated when v4l2 will be
 	   done using it */
 	v4l2_device_put(&usbtv->v4l2_dev);
diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
index de0328100a60dd..ef066df7124697 100644
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -968,5 +968,9 @@ void usbtv_video_free(struct usbtv *usbtv)
 	vb2_video_unregister_device(&usbtv->vdev);
 	v4l2_device_disconnect(&usbtv->v4l2_dev);
 
+	mutex_lock(&usbtv->v4l2_lock);
+	usbtv->udev = NULL;
+	mutex_unlock(&usbtv->v4l2_lock);
+
 	v4l2_device_put(&usbtv->v4l2_dev);
 }

From de55e799f549e9aa0f7899dcb03a2a816df2d87b Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:06:14 -0700
Subject: [PATCH 0821/1982] xfs: reduce new btree slack factor if free space is
 negative

commit 80f13dc7225eec318da7499c7a562d7a34d25e6a upstream.

LOLLM points out that if the incore fdblocks counter is negative, the
assignment to uint64_t will mask this possibly low space situation and
we don't pack the btree blocks as tightly as we probably ought to.  If
it's the case that there's some free space and fdblocks is too low due
to an error in the superblock field, then we can end up failing btree
rebuilds due to ENOSPC unnecessarily.  This is a corner case, but let's
fix it anyway.

Cc: stable@vger.kernel.org # v6.8
Fixes: be408417630427 ("xfs: implement block reservation accounting for btrees we're staging")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/newbt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/newbt.c b/fs/xfs/scrub/newbt.c
index 2a9547789c5c1a..bdcdc87fb227a7 100644
--- a/fs/xfs/scrub/newbt.c
+++ b/fs/xfs/scrub/newbt.c
@@ -71,7 +71,7 @@ xrep_newbt_estimate_slack(
 		free = sc->sa.pag->pagf_freeblks;
 		sz = xfs_ag_block_count(sc->mp, pag_agno(sc->sa.pag));
 	} else {
-		free = xfs_sum_freecounter_raw(sc->mp, XC_FREE_BLOCKS);
+		free = xfs_sum_freecounter(sc->mp, XC_FREE_BLOCKS);
 		sz = sc->mp->m_sb.sb_dblocks;
 	}
 

From 5e730e4a26c4242d9deac359e4bd1dd41c06acaf Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:22:41 -0700
Subject: [PATCH 0822/1982] xfs: reject absurdly large xattr value lengths in
 xchk_xattr_actor

commit fd012955641881169a9f01a00f656f6ca73842ec upstream.

LOLLM suggests that we shouldn't try to allocate absurdly large buffers
for xattr value checks because that will push reclaim very hard, never
succeed, and is pointless because nobody can create xattrs that large.
Since the xattr repair code ignores values larger than XATTR_SIZE_MAX,
we can flag the corruption and return early.

Cc: stable@vger.kernel.org # v5.3
Fixes: 6d6ccedd76823c ("xfs: only allocate memory for scrubbing attributes when we need it")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr.c          | 6 ++++++
 fs/xfs/scrub/parent_repair.c | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index de50760cdc988e..7315d0cb1e2e74 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -216,6 +216,12 @@ xchk_xattr_actor(
 		return -ECANCELED;
 	}
 
+	/* Don't even try to handle a bizarrely large xattr. */
+	if (valuelen > XATTR_SIZE_MAX) {
+		xchk_fblock_set_corrupt(sc, XFS_ATTR_FORK, args.blkno);
+		return -ECANCELED;
+	}
+
 	/*
 	 * Try to allocate enough memory to extract the attr value.  If that
 	 * doesn't work, return -EDEADLOCK as a signal to try again with a
diff --git a/fs/xfs/scrub/parent_repair.c b/fs/xfs/scrub/parent_repair.c
index 897902c54178d4..76b0c0cd50e5a0 100644
--- a/fs/xfs/scrub/parent_repair.c
+++ b/fs/xfs/scrub/parent_repair.c
@@ -910,6 +910,10 @@ xrep_parent_fetch_xattr_remote(
 	};
 	int			error;
 
+	/* Don't even try to handle a bizarrely large xattr. */
+	if (valuelen > XATTR_SIZE_MAX)
+		return -EFSCORRUPTED;
+
 	/*
 	 * If we need a larger value buffer, try to allocate one.  If that
 	 * fails, return with -EDEADLOCK to try harder.

From c2cd6b3b480ef2ae9752ed924a2199c8c90569a1 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Wed, 23 Sep 2026 08:58:22 -0300
Subject: [PATCH 0823/1982] xfs: reject out-of-range attribute value lengths in
 xfs_attr_copy_value

commit 0643549ffecaeb716c0b75590a9b76dfa5eb35b3 upstream.

xfs_attr_copy_value() takes the value length as a signed int and, for a
remote xattr, is handed args->rmtvaluelen.  That field is filled from the
on-disk __be32 xfs_attr_leaf_name_remote.valuelen in
xfs_attr3_leaf_getvalue(), so a crafted length such as 0x80000000 is
stored into the signed rmtvaluelen as a negative number.

The "buffer too small" guard in xfs_attr_copy_value() is a signed
comparison:

	if (args->valuelen < valuelen)
		return -ERANGE;

A negative valuelen therefore compares as smaller than the caller's
buffer size, skips the -ERANGE path, and is then used as a copy length,
leading to an out-of-bounds copy of a full remote block into a small
getxattr(2) buffer on a mounted crafted image.

Reject a value length that is negative or larger than the maximum xattr
size before it is used, so a bogus on-disk length can no longer slip
through the value copier.

Fixes: 9df243a1a9e6 ("xfs: consolidate attribute value copying")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_attr_leaf.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index dd3923fdcb2057..4d58718cd965a1 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -581,6 +581,17 @@ xfs_attr_copy_value(
 	unsigned char		*value,
 	int			valuelen)
 {
+	/*
+	 * A value length that is negative or larger than the maximum xattr
+	 * size is on-disk corruption.  The remote value length is an on-disk
+	 * __be32 stored into the signed args->rmtvaluelen, so a crafted value
+	 * such as 0x80000000 becomes negative and would slip past the
+	 * "args->valuelen < valuelen" check below and be used as a copy
+	 * length.  Reject it before that can happen.
+	 */
+	if (valuelen < 0 || valuelen > XFS_XATTR_SIZE_MAX)
+		return -EFSCORRUPTED;
+
 	/*
 	 * Parent pointer lookups require the caller to specify the name and
 	 * value, so don't copy anything.

From 97b85a593188f63e133883525c9159f77e660197 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Wed, 23 Sep 2026 08:58:23 -0300
Subject: [PATCH 0824/1982] xfs: reject remote xattr entries with an
 out-of-range value length

commit 15ccd92a782a0253f4a17895f3d3f71e5c1d1973 upstream.

xfs_attr3_leaf_verify_entry() validates a remote attribute entry's name
but never bounds its on-disk value length (xfs_attr_leaf_name_remote.
valuelen, a __be32). A crafted leaf with valuelen = 0x80000000 passes
the verifier and the CRC.

That length is later assigned into the signed int args->rmtvaluelen
(xfs_attr3_leaf_getvalue), becoming negative, which slips past the signed
-ERANGE check in xfs_attr_copy_value(); a getxattr() with a small buffer
then memcpy()s a full remote block into the small kvalue buffer
(xfs_attr_rmtval_copyout) -- a heap out-of-bounds write with
attacker-controlled content, from an unprivileged getxattr(2) on a
mounted crafted image.

Reject remote entries whose value length exceeds XFS_XATTR_SIZE_MAX in
the leaf verifier, so the malicious block is rejected at read time.

Fixes: c84760659dcf ("xfs: check attribute leaf block structure")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_attr_leaf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 4d58718cd965a1..914f5dfb6463a8 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -296,6 +296,8 @@ xfs_attr3_leaf_verify_entry(
 		if (!(ent->flags & XFS_ATTR_INCOMPLETE) &&
 		    rentry->valueblk == 0)
 			return __this_address;
+		if (be32_to_cpu(rentry->valuelen) > XFS_XATTR_SIZE_MAX)
+			return __this_address;
 	}
 
 	if (name_end > buf_end)

From 741d01a5f49023bf10071ab4a0fc144ddd4766d5 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:57:53 -0700
Subject: [PATCH 0825/1982] xfs: release ip after unlinked list store failure

commit 9a263723d7c9ab0615bab3f5cc145d3d24454a5c upstream.

If, while processing an unlinked list we see an inode that has nonzero
link count, we fail to store the incore prev/next pointers, we should
release the incore inode instead of leaking it.  This was in the llm
fixes branch but fell out for -rc7.  Weird.

Cc: stable@vger.kernel.org # v7.2-rc7
Fixes: 0052633527158b ("xfs: don't ignore runtime errors in xrep_iunlink_reload_next")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/agheader_repair.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/scrub/agheader_repair.c b/fs/xfs/scrub/agheader_repair.c
index caa04b5c60bc36..bd1abdf62358eb 100644
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1081,12 +1081,9 @@ xrep_iunlink_reload_next(
 	if (VFS_I(ip)->i_nlink != 0) {
 		error = xrep_iunlink_store_next(ragi, agino, NULLAGINO);
 		if (error)
-			return error;
+			goto rele;
 
 		error = xrep_iunlink_store_prev(ragi, agino, LINKED_AGINO);
-		if (error)
-			return error;
-
 		goto rele;
 	}
 
@@ -1100,7 +1097,7 @@ xrep_iunlink_reload_next(
 	 */
 rele:
 	xchk_irele(sc, ip);
-	return 0;
+	return error;
 }
 
 /*

From 96a80a3312b433a79eaffa55250071640140f902 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:09:07 -0700
Subject: [PATCH 0826/1982] xfs: rescan the AGs if incore delalloc counter is
 negative

commit 47b1e941bb55f735d82ba2649412260da78b98f8 upstream.

LOLLM complains that percpu_counter_sum can return a negative number but
we instead misinterpret that into a huge unsigned value and do bad
things to fdblocks.  It shouldn't do that, so let's add a retry loop and
an attempt to freeze the filesystem to (hopefully) zero out the incore
delalloc counter.  It probably won't work, but at least failing the
repair beats doing the wrong thing.

Cc: stable@vger.kernel.org # v5.2
Fixes: 75efa57d0bf5fc ("xfs: add online scrub for superblock counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/fscounters.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index c32c08443c7a30..5ccffbaa875e41 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -297,7 +297,7 @@ xchk_fscount_aggregate_agcounts(
 {
 	struct xfs_mount	*mp = sc->mp;
 	struct xfs_perag	*pag = NULL;
-	uint64_t		delayed;
+	int64_t			delayed;
 	int			tries = 8;
 	int			error = 0;
 
@@ -359,6 +359,11 @@ xchk_fscount_aggregate_agcounts(
 	 * of the computation.
 	 */
 	delayed = percpu_counter_sum(&mp->m_delalloc_blks);
+	if (delayed < 0) {
+		ASSERT(delayed >= 0);
+		xchk_set_incomplete(sc);
+		return -EFSCORRUPTED;
+	}
 	fsc->fdblocks -= delayed;
 
 	trace_xchk_fscounters_calc(mp, fsc->icount, fsc->ifree, fsc->fdblocks,
@@ -412,6 +417,7 @@ xchk_fscount_count_frextents(
 {
 	struct xfs_mount	*mp = sc->mp;
 	struct xfs_rtgroup	*rtg = NULL;
+	int64_t			delayed;
 	int			error;
 
 	fsc->frextents = 0;
@@ -437,7 +443,14 @@ xchk_fscount_count_frextents(
 		}
 	}
 
-	fsc->frextents_delayed = percpu_counter_sum(&mp->m_delalloc_rtextents);
+	delayed = percpu_counter_sum(&mp->m_delalloc_rtextents);
+	if (delayed < 0) {
+		ASSERT(delayed >= 0);
+		xchk_set_incomplete(sc);
+		return -EFSCORRUPTED;
+	}
+	fsc->frextents_delayed = delayed;
+
 	return 0;
 }
 #else

From c548d0de41b0ffc142af218ee0c7e3231d8aee35 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:09:38 -0700
Subject: [PATCH 0827/1982] xfs: update quota flags on secondary supers when
 metadir enabled

commit 9d9ea6e6cbc4cb1a36fb79f873d97e1ac2fe1a64 upstream.

xfs/085 exposes an interesting bug when metadir is enabled, quotas are
enabled via mount option, and the primary superblock crc fails
validation:

 Phase 1 - find and verify superblock...
 bad primary superblock - bad CRC in superblock !!!

 attempting to find secondary superblock...
 .found candidate secondary superblock...
 verified secondary superblock...
 quota accounting and enforcement flags lost

<snip>

 Phase 3 - for each AG...
         - scan and clear agi unlinked lists...
         - process known inodes and perform inode discovery...
         - agno = 0
         - agno = 1
         - agno = 2
 unexpected regular file inode 16908418 with metadata flag will zap
 cleared inode 16908418
 unexpected regular file inode 16908419 with metadata flag will zap
 cleared inode 16908419
 unexpected regular file inode 16908420 with metadata flag will zap
 cleared inode 16908420
         - agno = 3
         - process newly discovered inodes...

Quota files have been created, but xfs_repair thinks that quotas aren't
enabled and trashes the quota files.  Looking at the filesystem reveals
that the quota accounting flags were indeed persisted to the primary
superblock but not the secondary:

 # xfs_db -c 'sb 0' -c 'print qflags' -c 'sb 1' -c 'print qflags' /dev/sdf
 Metadata corruption detected at 0x561c68436080, inode 0x81 dinode
 xfs_db: Failed to load metadir root directory, error 117
 Metadata corruption detected at 0x561c683f7c80, xfs_agf block 0x1/0x200
 xfs_db: cannot init perag data (117). Continuing anyway.
 Metadata CRC error detected at 0x561c6844d1b5, xfs_sb block 0x0/0x200
 qflags = 0x7cf
 qflags = 0

On a metadir filesystem, quota state is supposed to persist across
mount cycles if the sysadmin doesn't provide any quota mount options.
Therefore, any time we update the quota flags on a metadir filesystem,
we should write the same change to the secondary supers so that
xfs_repair will find the quota data if it ever has to restore from a
secondary.

Cc: stable@vger.kernel.org # v6.13
Fixes: d5d9dd5b3026a8 ("xfs: persist quota flags with metadir")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_mount.c |  9 ++++++++-
 fs/xfs/xfs_qm.c    | 36 +++++++++++++++++++++++++++++++++++-
 fs/xfs/xfs_quota.h |  9 +++++++++
 3 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 8848aea99c87f4..a94697db788a58 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -448,6 +448,8 @@ int
 xfs_mount_reset_sbqflags(
 	struct xfs_mount	*mp)
 {
+	int			error;
+
 	mp->m_qflags = 0;
 
 	/* It is OK to look at sb_qflags in the mount path without m_sb_lock. */
@@ -460,7 +462,12 @@ xfs_mount_reset_sbqflags(
 	if (!xfs_fs_writable(mp, SB_FREEZE_WRITE))
 		return 0;
 
-	return xfs_sync_sb(mp, false);
+	error = xfs_sync_sb(mp, false);
+	if (error)
+		return error;
+
+	xfs_qm_update_secondary_sb(mp);
+	return 0;
 }
 
 static const char *const xfs_free_pool_name[] = {
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 5008b174ebd2b2..cd2d7448dd9791 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -741,6 +741,32 @@ xfs_qm_create_metadir_qinos(
 	return 0;
 }
 
+/*
+ * For metadir filesystems, quota flag state persists across mounts, so update
+ * secondary superblocks in case xfs_repair ever has to recover the primary
+ * from a secondary.  growfs also updates backup supers so lock against that.
+ * Note that the secondary backups are opportunistic, so we log but do not
+ * return write errors.
+ */
+void
+__xfs_qm_update_secondary_sb(
+	struct xfs_mount	*mp,
+	const char		*func)
+{
+	int			error;
+
+	if (!xfs_has_metadir(mp))
+		return;
+
+	mutex_lock(&mp->m_growlock);
+	error = xfs_update_secondary_sbs(mp);
+	mutex_unlock(&mp->m_growlock);
+
+	if (error)
+		xfs_alert(mp, "%s: Secondary super update failed, err=%d!",
+				func, error);
+}
+
 /*
  * Add QUOTABIT to sb_versionnum and initialize qflags in preparation for
  * creating quota files on a metadir filesystem.
@@ -766,7 +792,12 @@ xfs_qm_prep_metadir_sb(
 	spin_unlock(&mp->m_sb_lock);
 	xfs_log_sb(tp);
 
-	return xfs_trans_commit(tp);
+	error = xfs_trans_commit(tp);
+	if (error)
+		return error;
+
+	xfs_qm_update_secondary_sb(mp);
+	return 0;
 }
 
 /*
@@ -1721,6 +1752,9 @@ xfs_qm_mount_quotas(
 			ASSERT(!(XFS_IS_QUOTA_ON(mp)));
 			xfs_alert(mp, "%s: Superblock update failed!",
 				__func__);
+		} else {
+			/* Primary update succeeded, try to write secondary */
+			xfs_qm_update_secondary_sb(mp);
 		}
 	}
 
diff --git a/fs/xfs/xfs_quota.h b/fs/xfs/xfs_quota.h
index 105e6eb5762011..b323a72dafbcde 100644
--- a/fs/xfs/xfs_quota.h
+++ b/fs/xfs/xfs_quota.h
@@ -151,6 +151,8 @@ void xfs_dqtrx_hook_setup(struct xfs_dqtrx_hook *hook, notifier_fn_t mod_fn,
 		xfs_trans_mod_dquot((tp), (dqp), (field), (delta))
 # endif /* CONFIG_XFS_LIVE_HOOKS */
 
+void __xfs_qm_update_secondary_sb(struct xfs_mount *mp,
+		const char *func);
 #else
 static inline int
 xfs_qm_vop_dqalloc(struct xfs_inode *ip, kuid_t kuid, kgid_t kgid,
@@ -216,8 +218,15 @@ static inline int xfs_quota_reserve_blkres(struct xfs_inode *ip, int64_t blocks)
 #  define xfs_dqtrx_hook_disable()		((void)0)
 # endif /* CONFIG_XFS_LIVE_HOOKS */
 
+static inline void __xfs_qm_update_secondary_sb(struct xfs_mount *mp,
+		const char *func)
+{
+}
 #endif /* CONFIG_XFS_QUOTA */
 
+#define xfs_qm_update_secondary_sb(mp) \
+	__xfs_qm_update_secondary_sb((mp), __func__)
+
 static inline void
 xfs_quota_unreserve_blkres(struct xfs_inode *ip, uint64_t blocks)
 {

From 4b4979ebf938728ef577803f73c0d10e6d2cb4d2 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:21:07 -0700
Subject: [PATCH 0828/1982] xfs: abort directory tree repair whenever
 dl->aborted is set

commit 4582327e7068194d55941b49dd66be211b9e3f90 upstream.

LOLLM observed that if the live update hooks for the directory tree
repair code ever fail, they'll set dl->aborted, but then the main repair
code path won't check it to exit early.  This can cause incorrect
repairs, so let's check for hook errors and abort the repair.

Cc: stable@vger.kernel.org # v6.10
Fixes: 3f31406aef493b ("xfs: fix corruptions in the directory tree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dirtree_repair.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/xfs/scrub/dirtree_repair.c b/fs/xfs/scrub/dirtree_repair.c
index 3b9d7c21cf5357..397883dee71f74 100644
--- a/fs/xfs/scrub/dirtree_repair.c
+++ b/fs/xfs/scrub/dirtree_repair.c
@@ -575,6 +575,8 @@ xrep_dirtree_delete_path(
 
 	if (!error && dl->stale)
 		error = -ESTALE;
+	if (!error && dl->aborted)
+		error = -EIO;
 	return error;
 }
 
@@ -720,6 +722,11 @@ xrep_dirtree_adopt(
 		error = -ESTALE;
 		goto out_trans;
 	}
+	if (dl->aborted) {
+		mutex_unlock(&dl->lock);
+		error = -EIO;
+		goto out_trans;
+	}
 	error = xrep_dirtree_create_adoption_path(dl);
 	mutex_unlock(&dl->lock);
 	if (error)
@@ -780,6 +787,8 @@ xrep_dirtree_move_to_orphanage(
 
 	if (!error && dl->stale)
 		error = -ESTALE;
+	if (!error && dl->aborted)
+		error = -EIO;
 	return error;
 }
 

From 8cce27911eb3f8bb16f04b0a913277de6b7506b4 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:58:25 -0700
Subject: [PATCH 0829/1982] xfs: always forget cached ACLs if the attr fork
 swap succeeds

commit 41ee987f53785b9443388a756912b1a0fe3c9592 upstream.

LOLLM complains that xrep_xattr_rebuild_tree omits the xfs_forget_acl
call if the attr fork swap succeeds (and hence the acls might have
changed) but reaping the old attr fork fails.  Fix it so that we always
purge the cached acls if the swap succeeds, even if subsequent steps do
not.  This avoids some cache coherency problems with access controls.

Cc: stable@vger.kernel.org # v6.10
Fixes: e47dcf113ae348 ("xfs: repair extended attributes")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr_repair.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index a1d33a1ceaf899..766119325234e4 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1491,7 +1491,7 @@ xrep_xattr_rebuild_tree(
 
 	error = xrep_xattr_reset_tempfile_fork(sc);
 	if (error)
-		return error;
+		goto forget_acls;
 
 	/*
 	 * Roll to get a transaction without any inodes joined to it.  Then we
@@ -1500,7 +1500,7 @@ xrep_xattr_rebuild_tree(
 	 */
 	error = xfs_trans_roll(&sc->tp);
 	if (error)
-		return error;
+		goto forget_acls;
 
 	xrep_tempfile_iunlock(sc);
 	xrep_tempfile_iounlock(sc);
@@ -1509,7 +1509,7 @@ xrep_xattr_rebuild_tree(
 	/* Invalidate cached ACLs now that we've reloaded all the xattrs. */
 	xfs_forget_acl(VFS_I(sc->ip), SGI_ACL_FILE);
 	xfs_forget_acl(VFS_I(sc->ip), SGI_ACL_DEFAULT);
-	return 0;
+	return error;
 }
 
 /* Tear down all the incore scan stuff we created. */

From 782bcf8c6d3683f91cd40cd6cc169eb62106da4e Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:22:09 -0700
Subject: [PATCH 0830/1982] xfs: always report inode repair setup failures

commit ce9098338a7e1a77246684242d10779fc4d4a539 upstream.

LOLLM noticed that xchk_setup_inode silently discards errors being
returned by xrep_setup_inode.  Fix that, and fix the stub macro so that
it actually "returns" a value.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode.c  | 2 +-
 fs/xfs/scrub/repair.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/inode.c b/fs/xfs/scrub/inode.c
index 9a7fb91996d28f..723ef494c99341 100644
--- a/fs/xfs/scrub/inode.c
+++ b/fs/xfs/scrub/inode.c
@@ -212,7 +212,7 @@ xchk_setup_inode(
 	 * make repairs to the ondisk inode buffer.
 	 */
 	if (xchk_could_repair(sc))
-		xrep_setup_inode(sc, &imap);
+		return xrep_setup_inode(sc, &imap);
 	return 0;
 
 out_cancel:
diff --git a/fs/xfs/scrub/repair.h b/fs/xfs/scrub/repair.h
index 2bb125c4f9bf2b..1af568651e20a1 100644
--- a/fs/xfs/scrub/repair.h
+++ b/fs/xfs/scrub/repair.h
@@ -239,7 +239,7 @@ xrep_setup_nothing(
 #define xrep_setup_rtrmapbt		xrep_setup_nothing
 #define xrep_setup_rtrefcountbt		xrep_setup_nothing
 
-#define xrep_setup_inode(sc, imap)	((void)0)
+#define xrep_setup_inode(sc, imap)	(0)
 
 static inline int xrep_setup_symlink(struct xfs_scrub *sc, unsigned int *x)
 {

From e1903c3144d8ce946c64e7ce2fd3393d05191643 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:08:04 -0700
Subject: [PATCH 0831/1982] xfs: always report scrub errors in tracepoints

commit 1ccc8f553d885d49c1bfe141ea1f331511940b3a upstream.

LOLLM complains that the error processing functions in scrub will
sometimes zero out *error before recording a tracepoint.  This makes
diagnosing problems harder, so let's fix that.

Cc: stable@vger.kernel.org # v4.15
Fixes: 4700d22980d459 ("xfs: create helpers to record and deal with scrub problems")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/btree.c   | 8 +++++++-
 fs/xfs/scrub/common.c  | 7 +++++--
 fs/xfs/scrub/dabtree.c | 6 +++++-
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index b497f6a474c778..e926e338e80091 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -46,8 +46,14 @@ __xchk_btree_process_error(
 	case -ENODATA:
 		/* Note the badness but don't abort. */
 		sc->sm->sm_flags |= errflag;
+		if (cur->bc_ops->type == XFS_BTREE_TYPE_INODE)
+			trace_xchk_ifork_btree_op_error(sc, cur, level,
+					*error, ret_ip);
+		else
+			trace_xchk_btree_op_error(sc, cur, level,
+					*error, ret_ip);
 		*error = 0;
-		fallthrough;
+		break;
 	default:
 		if (cur->bc_ops->type == XFS_BTREE_TYPE_INODE)
 			trace_xchk_ifork_btree_op_error(sc, cur, level,
diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c
index ecbf965ad68975..92371a09dfc39f 100644
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -107,8 +107,9 @@ __xchk_process_error(
 	case -ENODATA:
 		/* Note the badness but don't abort. */
 		sc->sm->sm_flags |= errflag;
+		trace_xchk_op_error(sc, agno, bno, *error, ret_ip);
 		*error = 0;
-		fallthrough;
+		break;
 	default:
 		trace_xchk_op_error(sc, agno, bno, *error, ret_ip);
 		break;
@@ -183,8 +184,10 @@ __xchk_fblock_process_error(
 	case -ENODATA:
 		/* Note the badness but don't abort. */
 		sc->sm->sm_flags |= errflag;
+		trace_xchk_file_op_error(sc, whichfork, offset, *error,
+				ret_ip);
 		*error = 0;
-		fallthrough;
+		break;
 	default:
 		trace_xchk_file_op_error(sc, whichfork, offset, *error,
 				ret_ip);
diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index 52ff4c4b6588ea..3ef92483a49e45 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -49,8 +49,12 @@ xchk_da_process_error(
 	case -ENODATA:
 		/* Note the badness but don't abort. */
 		sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
+		trace_xchk_file_op_error(sc, ds->dargs.whichfork,
+				xfs_dir2_da_to_db(ds->dargs.geo,
+					ds->state->path.blk[level].blkno),
+				*error, __return_address);
 		*error = 0;
-		fallthrough;
+		break;
 	default:
 		trace_xchk_file_op_error(sc, ds->dargs.whichfork,
 				xfs_dir2_da_to_db(ds->dargs.geo,

From bd805c0a79143baca5104d9f6607b2c35efcdb1e Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:58:09 -0700
Subject: [PATCH 0832/1982] xfs: always zero the whole shortform header when
 zeroing attr fork

commit 52aa50cea408e27454d206cccecbe4f694a6c1e1 upstream.

LOLLM noticed that xrep_xattr_fork_remove can decide to reset the attr
fork contents to an empty shortform header, but then fails to zero the
padding byte in the header.  Fix that.

Cc: stable@vger.kernel.org # v6.10
Fixes: e47dcf113ae348 ("xfs: repair extended attributes")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/attr_repair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index 766119325234e4..ab5bd7a4d4abba 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -970,7 +970,7 @@ xrep_xattr_fork_remove(
 		ifp->if_format = XFS_DINODE_FMT_LOCAL;
 		hdr = xfs_idata_realloc(ip, (int)sizeof(*hdr) - ifp->if_bytes,
 				XFS_ATTR_FORK);
-		hdr->count = 0;
+		memset(hdr, 0, sizeof(*hdr));
 		hdr->totsize = cpu_to_be16(sizeof(*hdr));
 		xfs_trans_log_inode(sc->tp, ip,
 				XFS_ILOG_CORE | XFS_ILOG_ADATA);

From 5909f2935ca2897b51800d00f58a48605253ef4b Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Wed, 23 Sep 2026 08:57:54 -0300
Subject: [PATCH 0833/1982] xfs: bound da-node entry count against the correct
 geometry

commit 3df5e5aaa3bc0913236c48ab29b7df3a785aa29f upstream.

xfs_da3_node_verify() bounds the node entry count against the larger of
the directory and attribute geometries because, as a buffer verifier, it
cannot tell whether the block belongs to the directory or the attribute
tree. When the directory block size exceeds the fs block size (e.g.
mkfs.xfs -n size=64k -b size=4k), an attribute node buffer is a single fs
block that holds only m_attr_geo->node_ents entries, yet a crafted attr
node may claim a count up to m_dir_geo->node_ents and still pass the
verifier.

xfs_da3_node_lookup_int() then indexes btree[] up to that count during
its binary search -- an out-of-bounds read via getxattr/listxattr on a
mounted crafted image.

The buffer verifier is the wrong place to tighten this: it has no fork
context, and the transaction-less read path used by getxattr does not run
xfs_da3_node_set_type() either. xfs_da3_node_lookup_int(), on the other
hand, always runs on that path and holds args->geo, the geometry of the
fork actually being searched. Bound the entry count against
args->geo->node_ents there, before walking the entries.

Fixes: 7ab610f9e0f1 ("xfs: move node entry counts to xfs_da_geometry")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_da_btree.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index ca5f99c0878f22..42754ee7ab5b19 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -1787,6 +1787,20 @@ xfs_da3_node_lookup_int(
 		} else
 			expected_level--;
 
+		/*
+		 * The node verifier cannot tell whether this block belongs to
+		 * the directory or the attribute tree, so it only bounds the
+		 * entry count against the larger of the two geometries.  Here
+		 * args->geo is the geometry of the fork we are actually
+		 * searching, so reject a count that would walk btree[] off the
+		 * end of this node buffer.
+		 */
+		if (nodehdr.count > args->geo->node_ents) {
+			xfs_buf_mark_corrupt(blk->bp);
+			xfs_da_mark_sick(args);
+			return -EFSCORRUPTED;
+		}
+
 		max = nodehdr.count;
 		blk->hashval = be32_to_cpu(btree[max - 1].hashval);
 

From f2cc5001ffcc1d8e5e16607ce4b6920ea30c2cfe Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Wed, 23 Sep 2026 08:57:44 -0300
Subject: [PATCH 0834/1982] xfs: bound inode fork length against the fork size
 during log recovery

commit 9232301894a06e664d8de2da97175cf98419bd16 upstream.

xlog_recover_inode_commit_pass2() copies an inode log item's data/attr
fork region into the inode buffer using the on-log region length without
bounding it against the fork capacity, e.g.:

	len = item->ri_buf[2].iov_len;
	memcpy(XFS_DFORK_DPTR(dip), src, len);

The only guard is an ASSERT, which is a no-op on production kernels
(CONFIG_XFS_DEBUG off), and xfs_dinode_verify() runs only after the copy.
A crafted image with a dirty log can therefore drive a heap out-of-bounds
write at mount time. The XFS_ILOG_DBROOT sibling already passes
XFS_DFORK_DSIZE as a bound; the DDATA/DEXT and ADATA/AEXT memcpy paths
did not.

Bound each logged fork region against the destination fork size before
copying it, and reject the log item with -EFSCORRUPTED when it does not
fit. Because the recovered inode is only verified after the fork data has
been copied in, the checks are done up front, before any memcpy into the
on-disk inode.

Fixes: 658fa68b6f34 ("xfs: refactor log recovery inode item dispatch for pass2 commit functions")
Cc: stable@vger.kernel.org # v5.8
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_inode_item_recover.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_inode_item_recover.c b/fs/xfs/xfs_inode_item_recover.c
index 9d1999d41be16f..2b687548b67e46 100644
--- a/fs/xfs/xfs_inode_item_recover.c
+++ b/fs/xfs/xfs_inode_item_recover.c
@@ -507,6 +507,25 @@ xlog_recover_inode_commit_pass2(
 	ASSERT(!(fields & XFS_ILOG_DFORK) ||
 	       (len == xlog_calc_iovec_len(in_f->ilf_dsize)));
 
+	/*
+	 * The recovered inode is verified only after the fork data has been
+	 * copied into it, so bound each logged fork region against the size of
+	 * its fork now, before the memcpy below can overrun the on-disk inode.
+	 * The DBROOT/ABROOT cases already bound their copies against the fork
+	 * size.
+	 */
+	if ((fields & (XFS_ILOG_DDATA | XFS_ILOG_DEXT)) &&
+	    item->ri_buf[2].iov_len > XFS_DFORK_DSIZE(dip, mp)) {
+		error = -EFSCORRUPTED;
+		goto out_release;
+	}
+	if ((fields & (XFS_ILOG_ADATA | XFS_ILOG_AEXT)) &&
+	    item->ri_buf[(fields & XFS_ILOG_DFORK) ? 3 : 2].iov_len >
+	    XFS_DFORK_ASIZE(dip, mp)) {
+		error = -EFSCORRUPTED;
+		goto out_release;
+	}
+
 	switch (fields & XFS_ILOG_DFORK) {
 	case XFS_ILOG_DDATA:
 	case XFS_ILOG_DEXT:
@@ -546,7 +565,6 @@ xlog_recover_inode_commit_pass2(
 		case XFS_ILOG_ADATA:
 		case XFS_ILOG_AEXT:
 			dest = XFS_DFORK_APTR(dip);
-			ASSERT(len <= XFS_DFORK_ASIZE(dip, mp));
 			memcpy(dest, src, len);
 			break;
 

From 821a9d99caf16de8bd5298762b4463445adae39f Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:07:01 -0700
Subject: [PATCH 0835/1982] xfs: check for fragments when full-extent sharing
 matches

commit 95e213c1ddb40dfb0a8178ed35c9f29992a320e1 upstream.

LOLLM noticed that xchk_refcountbt_process_rmap_fragments returns early
if there are enough rmap records that overlap the space referenced by a
refcountbt record to match the refcount in that refcountbt record.
Unfortunately, it never checks the fragment list in this case, so it
won't find the discrepancy between the rmap and refcount btrees.

Cc: stable@vger.kernel.org # v4.16
Fixes: dbde19da963706 ("xfs: cross-reference the rmapbt data with the refcountbt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/refcount.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/refcount.c b/fs/xfs/scrub/refcount.c
index 0951b3def0be1d..8d0b1f47ef99a1 100644
--- a/fs/xfs/scrub/refcount.c
+++ b/fs/xfs/scrub/refcount.c
@@ -174,8 +174,11 @@ xchk_refcountbt_process_rmap_fragments(
 	xfs_nlink_t			target_nr;
 
 	target_nr = refchk->refcount - refchk->seen;
-	if (target_nr == 0)
+	if (target_nr == 0) {
+		if (!list_empty(&refchk->fragments))
+			refchk->seen = 0;
 		return;
+	}
 
 	/*
 	 * There are (refchk->rc.rc_refcount - refchk->nr refcount)

From 27d1f450dec6ef87fcbcc7b3a72f41c1f34481e8 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:20:35 -0700
Subject: [PATCH 0836/1982] xfs: check for termination during rmap btree walk

commit 1fc241cdeab276dc6c3ec14840faa706ed7712ff upstream.

LOLLM complains that we should check for a fatal signal *every* time we
walk a record in the rmap btree as part of rebuilding the free space
btrees.  Fix that, and improve responsiveness to ^C of xfs_scrub.

Cc: stable@vger.kernel.org # v6.8
Fixes: 4bdfd7d15747b1 ("xfs: repair free space btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/alloc_repair.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/alloc_repair.c b/fs/xfs/scrub/alloc_repair.c
index 3f4e164bec5a64..ab900660e35ef9 100644
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -227,7 +227,10 @@ xrep_abt_walk_rmap(
 	void				*priv)
 {
 	struct xrep_abt			*ra = priv;
-	int				error;
+	int				error = 0;
+
+	if (xchk_should_terminate(ra->sc, &error))
+		return error;
 
 	/* Record all the OWN_AG blocks... */
 	if (rec->rm_owner == XFS_RMAP_OWN_AG) {

From c73ee3683ab45eb70f65acb0c55c3a7cfe38c703 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:23:27 -0700
Subject: [PATCH 0837/1982] xfs: clarify various parts of the bitmap API

commit 00f32fdf54983371d39162efef7df693e2842ffb upstream.

LOLLM pointed out some underspecified parts of the xbitmap{32,64} API.
Specifically, the behavior of set/clear/test functions when the length
parameter is zero is not well defined, nor is what happens when someone
tries to disunion a bitmap with itself.  None of these situations are
expected, but we'll define zero-length set and clear to be nops, and the
rest to be checked by assertions.

Cc: stable@vger.kernel.org # v6.8
Fixes: 6ece924b952262 ("xfs: create separate structures and code for u32 bitmaps")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/bitmap.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/fs/xfs/scrub/bitmap.c b/fs/xfs/scrub/bitmap.c
index 7ba35a7a7920ed..4571cf3c16b5da 100644
--- a/fs/xfs/scrub/bitmap.c
+++ b/fs/xfs/scrub/bitmap.c
@@ -77,6 +77,9 @@ xbitmap64_clear(
 	struct xbitmap64_node	*new_bn;
 	uint64_t		last = start + len - 1;
 
+	if (!len)
+		return 0;
+
 	while ((bn = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last))) {
 		if (bn->bn_start < start && bn->bn_last > last) {
 			uint64_t	old_last = bn->bn_last;
@@ -127,6 +130,9 @@ xbitmap64_set(
 	uint64_t		last = start + len - 1;
 	int			error;
 
+	if (!len)
+		return 0;
+
 	/* Is this whole range already set? */
 	left = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last);
 	if (left && left->bn_start <= start && left->bn_last >= last)
@@ -218,6 +224,8 @@ xbitmap64_disunion(
 	struct xbitmap64_node	*bn;
 	int			error;
 
+	ASSERT(bitmap != sub);
+
 	if (xbitmap64_empty(bitmap) || xbitmap64_empty(sub))
 		return 0;
 
@@ -282,6 +290,8 @@ xbitmap64_test(
 	struct xbitmap64_node	*bn;
 	uint64_t		last = start + *len - 1;
 
+	ASSERT(*len > 0);
+
 	bn = xbitmap64_tree_iter_first(&bitmap->xb_root, start, last);
 	if (!bn)
 		return false;
@@ -352,6 +362,9 @@ xbitmap32_clear(
 	struct xbitmap32_node	*new_bn;
 	uint32_t		last = start + len - 1;
 
+	if (!len)
+		return 0;
+
 	while ((bn = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last))) {
 		if (bn->bn_start < start && bn->bn_last > last) {
 			uint32_t	old_last = bn->bn_last;
@@ -402,6 +415,9 @@ xbitmap32_set(
 	uint32_t		last = start + len - 1;
 	int			error;
 
+	if (!len)
+		return 0;
+
 	/* Is this whole range already set? */
 	left = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last);
 	if (left && left->bn_start <= start && left->bn_last >= last)
@@ -493,6 +509,8 @@ xbitmap32_disunion(
 	struct xbitmap32_node	*bn;
 	int			error;
 
+	ASSERT(bitmap != sub);
+
 	if (xbitmap32_empty(bitmap) || xbitmap32_empty(sub))
 		return 0;
 
@@ -557,6 +575,8 @@ xbitmap32_test(
 	struct xbitmap32_node	*bn;
 	uint32_t		last = start + *len - 1;
 
+	ASSERT(*len > 0);
+
 	bn = xbitmap32_tree_iter_first(&bitmap->xb_root, start, last);
 	if (!bn)
 		return false;

From 85975166223d129d8dcc74127ea9dcc01e951406 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:07:33 -0700
Subject: [PATCH 0838/1982] xfs: clear set[ug]id mode bits when zapping attr
 fork

commit eb20a959760c21e3547cd811d0d9b0b29df98959 upstream.

LOLLM observes that zapping a file's attr fork could result in ACLs
being removed from the file.  Because we have no idea what we're
deleting, we should clear the setuid and setgid bits in addition to the
access mode bits so that nobody can access the file.

Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 7a6f9d27c373b5..4b7e2937294c17 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1307,7 +1307,12 @@ xrep_dinode_zap_afork(
 	 */
 	if (dip->di_format != XFS_DINODE_FMT_BTREE)
 		dip->di_forkoff = 0;
-	dip->di_mode = cpu_to_be16(mode & ~0777);
+
+	/*
+	 * Zapping the attr fork could remove ACLs, so we clear suid/sgid and
+	 * all access mode bits.
+	 */
+	dip->di_mode = cpu_to_be16(mode & ~(S_ISUID | S_ISGID | 0777));
 	dip->di_uid = 0;
 	dip->di_gid = 0;
 }

From b5eb4ffd63fd2207568fcf2b76abffa86bbcf1ed Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:23:43 -0700
Subject: [PATCH 0839/1982] xfs: complain loudly when dirtree checker finds
 broken links

commit e09438cab72c2c6a32665829d4186155346bfee8 upstream.

LOLLM observed that the directory tree walk code bails out if it finds
broken parent pointers along the way.  However, it flattens the return
code to zero, which means that we can end up in the repair code having
not completed the scan.  We should never proceed with a repair in this
state, so let's mark the scrub incomplete and exit.

Cc: stable@vger.kernel.org # v6.10
Fixes: 928b721a11789a ("xfs: teach online scrub to find directory tree structure problems")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dirtree.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/dirtree.c b/fs/xfs/scrub/dirtree.c
index 686437ce10e556..f87b318185a853 100644
--- a/fs/xfs/scrub/dirtree.c
+++ b/fs/xfs/scrub/dirtree.c
@@ -860,7 +860,8 @@ xchk_dirtree_find_paths_to_root(
 				 * A parent pointer of @sc->ip is bad, don't
 				 * bother continuing.
 				 */
-				break;
+				xchk_set_incomplete(sc);
+				return error;
 			}
 			if (error == -ESTALE) {
 				/* This had better be an invalidation. */
@@ -981,6 +982,7 @@ xchk_dirtree(
 		 * parent pointers are corrupt; this scan cannot be completed
 		 * without full information.
 		 */
+		xchk_set_incomplete(sc);
 		xchk_ip_xref_set_corrupt(sc, sc->ip);
 		error = 0;
 		goto out_scanlock;

From 7ba6cf053eaf1350e23c438a9d1576f620512998 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:57:22 -0700
Subject: [PATCH 0840/1982] xfs: don't allow sm_agno for non-group metadir path
 checking

commit 20c5a56bc4f2329872d21561e4a2d4b8576004c9 upstream.

LOLLM noticed that the metadata directory tree path checker accepts
non-zero values in the sm_agno field for non-group metadata.  Make that
case return -EINVAL.

Cc: stable@vger.kernel.org # v6.13
Fixes: a74923333d9c3b ("xfs: scrub metadir paths for rtgroup metadata")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/metapath.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/xfs/scrub/metapath.c b/fs/xfs/scrub/metapath.c
index 3bae7581562789..24f60f93d0dff0 100644
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -128,6 +128,8 @@ static int
 xchk_setup_metapath_rtdir(
 	struct xfs_scrub	*sc)
 {
+	if (sc->sm->sm_agno)
+		return -EINVAL;
 	if (!sc->mp->m_rtdirip)
 		return -ENOENT;
 
@@ -175,6 +177,8 @@ xchk_setup_metapath_quotadir(
 {
 	struct xfs_quotainfo	*qi = sc->mp->m_quotainfo;
 
+	if (sc->sm->sm_agno)
+		return -EINVAL;
 	if (!qi || !qi->qi_dirip)
 		return -ENOENT;
 
@@ -191,6 +195,8 @@ xchk_setup_metapath_dqinode(
 	struct xfs_quotainfo	*qi = sc->mp->m_quotainfo;
 	struct xfs_inode	*ip = NULL;
 
+	if (sc->sm->sm_agno)
+		return -EINVAL;
 	if (!qi)
 		return -ENOENT;
 

From 8310008293296958de8cbe6ed1856f71dff3e254 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:07:17 -0700
Subject: [PATCH 0841/1982] xfs: don't clear COWEXTSIZE on directories on
 reflink filesystems

commit 3978b1f3109dfd5c648442bb040f9abd58608226 upstream.

LOLLM noticed that xrep_dinode_flags clears the COWEXTSIZE flag
unnecessarily on directories on reflink filesystems.  Directories just
pass the hint along to new children, so it's valid to leave the flag
set.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 4b7e2937294c17..46e11656a078cc 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -563,6 +563,8 @@ xrep_dinode_flags(
 	 */
 	if (xfs_has_reflink(mp) && S_ISREG(mode))
 		flags2 |= XFS_DIFLAG2_REFLINK;
+	else if (xfs_has_reflink(mp) && S_ISDIR(mode))
+		flags2 &= ~XFS_DIFLAG2_REFLINK;
 	else
 		flags2 &= ~(XFS_DIFLAG2_REFLINK | XFS_DIFLAG2_COWEXTSIZE);
 	if (!xfs_has_bigtime(mp))

From 6b93f0aeb8815a3ad296492e97173f9fc137340e Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:05:28 -0700
Subject: [PATCH 0842/1982] xfs: don't overrun incore inode when cleaning attr
 forks

commit c28b4b48deac17749ed1ebe4289a4ba73541ddc6 upstream.

LOLLM noticed that xrep_dinode_check_afork doesn't check for a
di_forkoff value that is so large that the attr fork would begin after
the end of the inode space.  This causes afork_{ptr,size} to be
nonsense.  What we really ought to do here is zap the attr fork.

Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 46e11656a078cc..46208ea45178a5 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1243,6 +1243,8 @@ xrep_dinode_check_afork(
 	if (XFS_DFORK_BOFF(dip) == 0)
 		return dip->di_aformat != XFS_DINODE_FMT_EXTENTS ||
 		       xfs_dfork_attr_extents(dip) != 0;
+	if (XFS_DFORK_BOFF(dip) >= XFS_LITINO(sc->mp))
+		return true;
 
 	afork_size = XFS_DFORK_SIZE(dip, sc->mp, XFS_ATTR_FORK);
 	afork_ptr = XFS_DFORK_PTR(dip, XFS_ATTR_FORK);

From 83b5bfa2400c5af79f869fb3ac79c2563871855f Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:06:30 -0700
Subject: [PATCH 0843/1982] xfs: don't queue rmap update twice when reaping a
 fork

commit 219ff8a734d8438e24eb346a847c9b1ad9b7ab5d upstream.

LOLLM noticed that xrep_reap_bmapi_iter calls xfs_bmap_unmap_extent and
xfs_rmap_unmap_extent to remove a mapping from a file fork and its
reverse mapping.  However, xfs_bmap_del_extent_real also queues a
deferred rmap removal log item, which means that we incorrectly queue
two rmap removal operations.  Fix that by removing the extra call and
updating the comment to mention this subtlety that I forgot, having
written the code. :P

Cc: stable@vger.kernel.org # v6.10
Fixes: 5befb047b9f4de ("xfs: add the ability to reap entire inode forks")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/reap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/reap.c b/fs/xfs/scrub/reap.c
index c36f90e293e2f9..ff450640fe59a2 100644
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -1480,12 +1480,12 @@ xrep_reap_bmapi_iter(
 		/*
 		 * t0: Schedule removal of the mapping from the fork.  We use
 		 * deferred log intents in this function to control the exact
-		 * sequence of metadata updates.
+		 * sequence of metadata updates.  The BUI queues a RUI to
+		 * remove the reverse mapping.
 		 */
 		xfs_bmap_unmap_extent(sc->tp, rs->ip, rs->whichfork, imap);
 		xfs_trans_mod_dquot_byino(sc->tp, rs->ip, XFS_TRANS_DQ_BCOUNT,
 				-(int64_t)imap->br_blockcount);
-		xfs_rmap_unmap_extent(sc->tp, rs->ip, rs->whichfork, imap);
 		return 0;
 	}
 

From 1a5bcf87b6110f7dc52af2ab0b616dd3050f3613 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:08:51 -0700
Subject: [PATCH 0844/1982] xfs: don't rescan ifree and icount when frozen

commit 18028768415e3c05ab7edb22d740e2f4dc52836a upstream.

LOLLM points out that it's pointless to rescan the AGs if we've already
frozen the filesystem because there won't be any more perturbations.
Fix this to mark the scan incomplete and exit.

Cc: stable@vger.kernel.org # v5.2
Fixes: 75efa57d0bf5fc ("xfs: add online scrub for superblock counters")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/fscounters.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/scrub/fscounters.c b/fs/xfs/scrub/fscounters.c
index 5ccffbaa875e41..9a5d093f0854dc 100644
--- a/fs/xfs/scrub/fscounters.c
+++ b/fs/xfs/scrub/fscounters.c
@@ -384,6 +384,11 @@ xchk_fscount_aggregate_agcounts(
 	 * to maintain ifree <= icount before giving up.
 	 */
 	if (fsc->ifree > fsc->icount) {
+		if (fsc->frozen) {
+			xchk_set_incomplete(sc);
+			return -EFSCORRUPTED;
+		}
+
 		if (tries--)
 			goto retry;
 		return -EDEADLOCK;

From fb6d5c9a2edff47753dd97934821741dab97e5b4 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:08:20 -0700
Subject: [PATCH 0845/1982] xfs: don't scan across metadata/regular directory
 trees for dirents

commit 03ce4ca43c00394364493865f417d646e252bac2 upstream.

LOLLM points out that the directory repair code should never scan files
in the regular directory tree when fixing a metadata directory and
vice-versa.  Amend the scan predicate to check this condition.

Cc: stable@vger.kernel.org # v6.13
Fixes: 4f3d4dd1b04b2b ("xfs: define the on-disk format for the metadir feature")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dir_repair.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index ad3d414d9705d0..1b3f4e8030c175 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1189,7 +1189,9 @@ xrep_dir_want_scan(
 	struct xrep_dir		*rd,
 	const struct xfs_inode	*ip)
 {
-	return ip != rd->sc->ip && !xrep_is_tempfile(ip);
+	return ip != rd->sc->ip &&
+	       xfs_is_metadir_inode(ip) == xfs_is_metadir_inode(rd->sc->ip) &&
+	       !xrep_is_tempfile(ip);
 }
 
 /*

From 32b3e288e22c597e1a73f59fe28c3277ab33f62e Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:08:35 -0700
Subject: [PATCH 0846/1982] xfs: don't set a metadata directory's parent to
 sb_rootino

commit c9f98b0f4f70c8cfd617dc2886bf2fc0a36ab9da upstream.

LOLLM complains that it's weird to set a metadata directory's parent
inumber to the regular directory tree root.  Fix this even if nobody's
ever going to notice this because metadata path lookups don't access
dotdot.

Cc: stable@vger.kernel.org # v6.13
Fixes: 4f3d4dd1b04b2b ("xfs: define the on-disk format for the metadir feature")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dir_repair.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 1b3f4e8030c175..9aafe5c31cbe37 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1674,7 +1674,10 @@ xrep_dir_swap(
 	ASSERT(sc->ilock_flags & XFS_ILOCK_EXCL);
 	if (rd->pscan.parent_ino == NULLFSINO) {
 		rd->needs_adoption = true;
-		rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_rootino;
+		if (xfs_is_metadir_inode(rd->sc->ip))
+			rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_metadirino;
+		else
+			rd->pscan.parent_ino = rd->sc->mp->m_sb.sb_rootino;
 	}
 
 	/*

From 3e8c3ed178c1e8a1cc93f773ed15c6e487c7885e Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:20:51 -0700
Subject: [PATCH 0847/1982] xfs: don't subtract excess usage twice when
 computing agf_btreeblks

commit 4439b626fb5104204952aa2f169451688fb6be26 upstream.

LOLLM noticed that the free space btree repair code calculates
agf_btreeblks from the number of blocks we wrote to rebuild the free
space btrees (minus the roots).  That's correct.  However, it observes
that we subtract the "excess" reservation, which is not correct.  Fix
this accounting problem.

Cc: stable@vger.kernel.org # v6.8
Fixes: 4bdfd7d15747b1 ("xfs: repair free space btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/alloc_repair.c |  6 +-----
 fs/xfs/scrub/newbt.c        | 13 -------------
 fs/xfs/scrub/newbt.h        |  1 -
 3 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/fs/xfs/scrub/alloc_repair.c b/fs/xfs/scrub/alloc_repair.c
index ab900660e35ef9..c4fe9ae2dd4151 100644
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -663,15 +663,11 @@ xrep_abt_reset_counters(
 
 	/*
 	 * Compute the contribution to agf_btreeblks for the new free space
-	 * btrees.  This is the computed btree size minus anything we didn't
-	 * use.
+	 * btrees.  This is the computed btree size minus the root block.
 	 */
 	freesp_btreeblks += ra->new_bnobt.bload.nr_blocks - 1;
 	freesp_btreeblks += ra->new_cntbt.bload.nr_blocks - 1;
 
-	freesp_btreeblks -= xrep_newbt_unused_blocks(&ra->new_bnobt);
-	freesp_btreeblks -= xrep_newbt_unused_blocks(&ra->new_cntbt);
-
 	/*
 	 * The AGF header contains extra information related to the free space
 	 * btrees, so we must update those fields here.
diff --git a/fs/xfs/scrub/newbt.c b/fs/xfs/scrub/newbt.c
index bdcdc87fb227a7..e757665d4b545d 100644
--- a/fs/xfs/scrub/newbt.c
+++ b/fs/xfs/scrub/newbt.c
@@ -600,16 +600,3 @@ xrep_newbt_claim_block(
 	/* Relog all the EFIs. */
 	return xrep_defer_finish(xnr->sc);
 }
-
-/* How many reserved blocks are unused? */
-unsigned int
-xrep_newbt_unused_blocks(
-	struct xrep_newbt	*xnr)
-{
-	struct xrep_newbt_resv	*resv;
-	unsigned int		unused = 0;
-
-	list_for_each_entry(resv, &xnr->resv_list, list)
-		unused += resv->len - resv->used;
-	return unused;
-}
diff --git a/fs/xfs/scrub/newbt.h b/fs/xfs/scrub/newbt.h
index 5ce785599287be..e5ebd3200c1849 100644
--- a/fs/xfs/scrub/newbt.h
+++ b/fs/xfs/scrub/newbt.h
@@ -71,6 +71,5 @@ void xrep_newbt_cancel(struct xrep_newbt *xnr);
 int xrep_newbt_commit(struct xrep_newbt *xnr);
 int xrep_newbt_claim_block(struct xfs_btree_cur *cur, struct xrep_newbt *xnr,
 		union xfs_btree_ptr *ptr);
-unsigned int xrep_newbt_unused_blocks(struct xrep_newbt *xnr);
 
 #endif /* __XFS_SCRUB_NEWBT_H__ */

From f12cbd5e2029427d5ca44703de1b0bf5f8e1a293 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:09:22 -0700
Subject: [PATCH 0848/1982] xfs: don't try to repair rtsummary if the summary
 file isn't computed

commit 6e82b7641889ad0198f3bf17a5e4c6fe7aab0850 upstream.

LOLLM observed that we can erroneously try to repair the rtsummary file
if we've not yet computed its contents.  That results in a corrupt
summary file, so let's add a flag to track whether or not the incore
data is complete.

Cc: stable@vger.kernel.org # v6.10
Fixes: abf039e2e4afde ("xfs: online repair of realtime summaries")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/rtsummary.c        | 9 ++++++++-
 fs/xfs/scrub/rtsummary.h        | 1 +
 fs/xfs/scrub/rtsummary_repair.c | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/rtsummary.c b/fs/xfs/scrub/rtsummary.c
index 8fb06ce4a20036..c090c8ae30dfb7 100644
--- a/fs/xfs/scrub/rtsummary.c
+++ b/fs/xfs/scrub/rtsummary.c
@@ -213,13 +213,20 @@ xchk_rtsum_compute(
 {
 	struct xfs_mount	*mp = sc->mp;
 	struct xfs_rtgroup	*rtg = sc->sr.rtg;
+	struct xchk_rtsummary	*rts = sc->buf;
+	int			error;
 
 	/* If the bitmap size doesn't match the computed size, bail. */
 	if (XFS_FSB_TO_B(mp, xfs_rtbitmap_blockcount(mp)) !=
 	    rtg_bitmap(rtg)->i_disk_size)
 		return -EFSCORRUPTED;
 
-	return xfs_rtalloc_query_all(rtg, sc->tp, xchk_rtsum_record_free, sc);
+	error = xfs_rtalloc_query_all(rtg, sc->tp, xchk_rtsum_record_free, sc);
+	if (error)
+		return error;
+
+	rts->summary_computed = true;
+	return 0;
 }
 
 /* Compare the rtsummary file against the one we computed. */
diff --git a/fs/xfs/scrub/rtsummary.h b/fs/xfs/scrub/rtsummary.h
index e44b04cb6e2d5e..af1ab64c3f2125 100644
--- a/fs/xfs/scrub/rtsummary.h
+++ b/fs/xfs/scrub/rtsummary.h
@@ -17,6 +17,7 @@ struct xchk_rtsummary {
 	xfs_filblks_t		rsumblocks;
 	unsigned int		rsumlevels;
 	unsigned int		resblks;
+	bool			summary_computed;
 
 	/* suminfo position of xfile as we write buffers to disk. */
 	xfs_rtsumoff_t		prep_wordoff;
diff --git a/fs/xfs/scrub/rtsummary_repair.c b/fs/xfs/scrub/rtsummary_repair.c
index c94e485a8837d7..d6f56f3450ad18 100644
--- a/fs/xfs/scrub/rtsummary_repair.c
+++ b/fs/xfs/scrub/rtsummary_repair.c
@@ -122,7 +122,7 @@ xrep_rtsummary(
 		return -EOPNOTSUPP;
 
 	/* Walk away if we disagree on the size of the rt bitmap. */
-	if (rts->rbmblocks != mp->m_sb.sb_rbmblocks)
+	if (rts->rbmblocks != mp->m_sb.sb_rbmblocks || !rts->summary_computed)
 		return 0;
 
 	/* Make sure any problems with the fork are fixed. */

From 1bde9463d75244ade3f870e34e9e60f2cb686c44 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:57:07 -0700
Subject: [PATCH 0849/1982] xfs: don't try to scrub self-referential dirent in
 metapath checker

commit 1e7337a3ecebab1bb2ba02187d88b94e5146e4f0 upstream.

LOLLM observes that the _ilock_both helper will loop forever trying to
double-lock the same inode if mpath->dp == sc->ip.  Callers are not
supposed to call us with parent == child because that makes no sense.
Trigger an assertion, mark the scan incomplete, and return IO error
so that this fails noisily.

Cc: stable@vger.kernel.org # v6.13
Fixes: b3c03efa5972f0 ("xfs: check metadata directory file path connectivity")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/metapath.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/xfs/scrub/metapath.c b/fs/xfs/scrub/metapath.c
index 24f60f93d0dff0..78c5bab49f7202 100644
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -324,6 +324,13 @@ xchk_metapath(
 		return 0;
 	}
 
+	/* Callers should not set the parent to the child. */
+	if (mpath->dp == sc->ip) {
+		ASSERT(mpath->dp != sc->ip);
+		xchk_set_incomplete(sc);
+		return -EIO;
+	}
+
 	xchk_trans_alloc_empty(sc);
 
 	error = xchk_metapath_ilock_both(mpath);

From 9702d68ad6264299994b188d2c835dd062a45217 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:21:54 -0700
Subject: [PATCH 0850/1982] xfs: fix correction of unwritten extents in quota
 file data fork

commit 6f2792720673f569fa3e1f68181b9d6fd26802b5 upstream.

LOLLM noticed a couple of problems with the code that fixes unwritten
mappings in the quota file's data fork: first, we should zero the ondisk
contents as part of converting them to "unwritten" just in case we crash
shortly after the conversion.  Second, and more importantly, it noticed
that we fail to resynchronize the iext tree cursor after modifying the
iext tree.  If the tree shape changes, we could be in a world of hurt.
Third, we should force a quotacheck if we reset an ondisk dquot.  Fix
all issues.

Cc: stable@vger.kernel.org # v6.8
Fixes: a5b91555403e3a ("xfs: repair quotas")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/quota_repair.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/quota_repair.c b/fs/xfs/scrub/quota_repair.c
index a9c87b218224ca..c8829cb8192ffc 100644
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -418,7 +418,9 @@ xrep_quota_data_fork(
 	/* Check for data fork problems that apply only to quota files. */
 	max_dqid_off = XFS_DQ_ID_MAX / qi->qi_dqperchunk;
 	ifp = xfs_ifork_ptr(sc->ip, XFS_DATA_FORK);
-	for_each_xfs_iext(ifp, &icur, &irec) {
+	xfs_iext_first(ifp, &icur);
+
+	while (xfs_iext_get_extent(ifp, &icur, &irec)) {
 		if (isnullstartblock(irec.br_startblock)) {
 			error = -EFSCORRUPTED;
 			goto out;
@@ -442,16 +444,35 @@ xrep_quota_data_fork(
 
 			error = xfs_bmapi_write(sc->tp, sc->ip,
 					irec.br_startoff, irec.br_blockcount,
-					XFS_BMAPI_CONVERT, 0, &nrec, &nmap);
+					XFS_BMAPI_CONVERT | XFS_BMAPI_ZERO, 0,
+					&nrec, &nmap);
 			if (error)
 				goto out;
 			ASSERT(nrec.br_startoff == irec.br_startoff);
 			ASSERT(nrec.br_blockcount == irec.br_blockcount);
 
+			/*
+			 * We just zeroed the ondisk dquot, so counts could be
+			 * wrong.  Schedule a quotacheck to fix that.
+			 */
+			xrep_force_quotacheck(sc, dqtype);
 			error = xfs_defer_finish(&sc->tp);
 			if (error)
 				goto out;
+
+			/*
+			 * Set cursor to the next block past the extent we just
+			 * converted because bmapi write could have merged
+			 * records.
+			 */
+			if (!xfs_iext_lookup_extent(sc->ip, ifp,
+					irec.br_startoff + irec.br_blockcount,
+					&icur, &irec))
+				break;
+			continue;
 		}
+
+		xfs_iext_next(ifp, &icur);
 	}
 
 	if (!joined) {

From 55a29b330617978e571c1ddb4f96ad5f916522ef Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:05:43 -0700
Subject: [PATCH 0851/1982] xfs: fix data fork block count check in
 xrep_inode_blockcounts

commit 147f9f8300cb284923e08bb8a7b32ba9681c45ed upstream.

LOLLM notices that for non-reflink realtime files, the @count output of
xchk_inode_count_blocks includes both the file blocks on the realtime
volume and the bmap btree blocks on the data volume.  Therefore, we must
compare this value to rblocks + dblocks to avoid unnecessary failure.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index 46208ea45178a5..a24ad3ba5159cf 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -1720,7 +1720,7 @@ xrep_inode_blockcounts(
 		 */
 		;
 	} else if (XFS_IS_REALTIME_INODE(sc->ip)) {
-		if (count >= sc->mp->m_sb.sb_rblocks)
+		if (count >= sc->mp->m_sb.sb_rblocks + sc->mp->m_sb.sb_dblocks)
 			return -EFSCORRUPTED;
 	} else {
 		if (count >= sc->mp->m_sb.sb_dblocks)

From 9ee0b919b7df67ce8f73b650cf2ad1194cd51b94 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:57:38 -0700
Subject: [PATCH 0852/1982] xfs: init inode number for tracepoint

commit e98643f794d0d7a7fde8b29276d74e09fa0d5d19 upstream.

LOLLM complains that if the xchk_dir_lookup call fails, it won't set ino
to anything.  ino is then passed into the tracepoint function, which
means that it reports random stack garbage.  Set it to NULLFSINO instead
so that the circumstance is more obvious.

Cc: stable@vger.kernel.org # v6.13
Fixes: 0d2c636e489c11 ("xfs: repair metadata directory file path connectivity")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/metapath.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/metapath.c b/fs/xfs/scrub/metapath.c
index 78c5bab49f7202..b97ae09b0981a6 100644
--- a/fs/xfs/scrub/metapath.c
+++ b/fs/xfs/scrub/metapath.c
@@ -441,7 +441,7 @@ xrep_metapath_try_link(
 	xfs_ino_t		*alleged_child)
 {
 	struct xfs_scrub	*sc = mpath->sc;
-	xfs_ino_t		ino;
+	xfs_ino_t		ino = NULLFSINO;
 	int			error;
 
 	/* Allocate transaction, lock inodes, join to transaction. */
@@ -540,7 +540,7 @@ xrep_metapath_try_unlink(
 {
 	struct xfs_scrub	*sc = mpath->sc;
 	struct xfs_inode	*ip = NULL;
-	xfs_ino_t		ino;
+	xfs_ino_t		ino = NULLFSINO;
 	int			error;
 
 	ASSERT(*alleged_child != sc->ip->i_ino);

From a20e7217f69462b4c373747fa08a975e6e102229 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:21:38 -0700
Subject: [PATCH 0853/1982] xfs: never reset the default quota timer

commit ddf4fe30c3fd7d37cf9bad3887ddb69984954cf4 upstream.

LOLLM notices that xrep_quota_fix_timer doesn't check the dquot id,
which means that it can inadvertently reset the default quota timer when
we really meant to ensure that a (non-root) quota overage timeout has a
sane timestamp.  Fix that.

Cc: stable@vger.kernel.org # v6.8
Fixes: a5b91555403e3a ("xfs: repair quotas")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/quota_repair.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/scrub/quota_repair.c b/fs/xfs/scrub/quota_repair.c
index c8829cb8192ffc..baf77a158eac89 100644
--- a/fs/xfs/scrub/quota_repair.c
+++ b/fs/xfs/scrub/quota_repair.c
@@ -274,6 +274,9 @@ xrep_quota_fix_timer(
 	time64_t		new_timer;
 	uint32_t		t;
 
+	/* never reset the default quota timer */
+	if (ddq->d_id == 0)
+		return;
 	if (!soft || count <= soft || *timer != 0)
 		return;
 

From 05fd50e646ea0ced39af7b9cc7de96dff27613b6 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:06:46 -0700
Subject: [PATCH 0854/1982] xfs: only written file data blocks can be shared

commit 634b63baf05062988456a0bd5df2696c14ea2949 upstream.

LOLLM noticed that xchk_refcountbt_rmap_check (and its rt equivalent)
will count any rmap owner towards the shared count.  However, the only
blocks that can be shared between xfs files are written file data
blocks; and the only blocks that can have single-refcount entries are
COW staging extents.  Fix the checking code.

Cc: stable@vger.kernel.org # v4.16
Fixes: dbde19da963706 ("xfs: cross-reference the rmapbt data with the refcountbt")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/refcount.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/xfs/scrub/refcount.c b/fs/xfs/scrub/refcount.c
index 8d0b1f47ef99a1..f812a5857cbcdf 100644
--- a/fs/xfs/scrub/refcount.c
+++ b/fs/xfs/scrub/refcount.c
@@ -129,6 +129,18 @@ xchk_refcountbt_rmap_check(
 		return 0;
 	}
 
+	/*
+	 * The refcount btree should only have records for written file data
+	 * blocks or for COW staging blocks.
+	 */
+	if ((XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) &&
+	     rec->rm_owner != XFS_RMAP_OWN_COW) ||
+	    (rec->rm_flags & (XFS_RMAP_ATTR_FORK | XFS_RMAP_BMBT_BLOCK |
+			      XFS_RMAP_UNWRITTEN))) {
+		xchk_btree_xref_set_corrupt(refchk->sc, cur, 0);
+		return 0;
+	}
+
 	if (rec->rm_startblock <= refchk->bno && rm_last >= rc_last) {
 		/*
 		 * The rmap overlaps the refcount record, so we can confirm

From 27b6057c988473d8ffd78f9d60996a995645e662 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 23:07:48 -0700
Subject: [PATCH 0855/1982] xfs: opportunistically skip btree block checks

commit 4ce244b234c251963fca6dff9de6edf26a209d08 upstream.

LOLLM notices that both callers of xchk_btree_get_block will return
early if *pblock is NULL after a successful return.  However,
xchk_btree_get_block itself can return 0 after flagging a corruption.
There's no point in continuing after we've found a corruption, so null
the pointer out.

Cc: stable@vger.kernel.org # v4.15
Fixes: cc3e0948d2686f ("xfs: scrub the shape of a metadata btree")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/btree.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index e926e338e80091..8aa53fb2e72f74 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -608,6 +608,14 @@ xchk_btree_get_block(
 	xfs_btree_get_block(bs->cur, level, pbp);
 	if (__xfs_btree_check_block(bs->cur, *pblock, level, *pbp)) {
 		xchk_btree_set_corrupt(bs->sc, bs->cur, level);
+		/*
+		 * The btree block fails basic checks, so we know it's corrupt.
+		 * There's no need to continue looking for corruptions, so we
+		 * null out pblock.  If *pbp is non-null then it's also
+		 * attached to the transaction so we won't leak it despite the
+		 * 0 return code.
+		 */
+		*pblock = NULL;
 		return 0;
 	}
 	if (*pbp)

From a312988016bd083fc964b1fb57febec9e2de76d5 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Sun, 4 Oct 2026 22:56:51 -0700
Subject: [PATCH 0856/1982] xfs: propagate errors while checking null siblings

commit e5bde75a816b3549942f4b09a8bf09006b7ea9de upstream.

LOLLM observes that if xfs_da3_path_shift returns an error here, scrub
doesn't handle it the way that it handles most runtime errors.  Instead,
it drops the error and keeps going, even though that's not how that's
supposed to work.  Fix that by calling xchk_da_process_error to set
corruption flags and then jump out of the flow of execution.

Cc: stable@vger.kernel.org # v4.15
Fixes: 7c4a07a424c18d ("xfs: scrub directory/attribute btrees")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/dabtree.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index 3ef92483a49e45..fe4d05c232b662 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -257,9 +257,10 @@ xchk_da_btree_block_check_sibling(
 	if (sibling == 0) {
 		error = xfs_da3_path_shift(ds->state, altpath, direction,
 				false, &retval);
-		if (error == 0 && retval == 0)
+		if (!xchk_da_process_error(ds, level, &error))
+			goto out;
+		if (retval == 0)
 			xchk_da_set_corrupt(ds, level);
-		error = 0;
 		goto out;
 	}
 

From e6338cdc1003b8f3c5518bad6ed73b220c29c291 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:22:25 -0700
Subject: [PATCH 0857/1982] xfs: range-check bc_levels array access in scrub
 tracepoints

commit 73b7276b8a4b5eb272f3c3b36ea3042e786f4741 upstream.

LOLLM noticed xchk_btree()'s odd habit of passing cur->bc_nlevels to
xchk_btree_ptr_ok when we're checking the pointer to the root block at
the start of the btree scan.  This enables us to skip checking the
pointer for an inode btree's root (since it doesn't have one) but
doesn't handle per-AG btrees quite correctly.  There isn't a problem for
__xfs_btree_check_ptr itself, but the corruption tracepoint naively
walks off the end of bc_level[].  Fix that by adding a helper to do an
implicit range check.

Cc: stable@vger.kernel.org # v5.16
Fixes: 6ca444cfd66354 ("xfs: prepare xfs_btree_cur for dynamic cursor heights")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/trace.c | 13 +++++++++++++
 fs/xfs/scrub/trace.h | 10 +++++-----
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/scrub/trace.c b/fs/xfs/scrub/trace.c
index 987313a52e6401..1d76b1fa299659 100644
--- a/fs/xfs/scrub/trace.c
+++ b/fs/xfs/scrub/trace.c
@@ -42,6 +42,9 @@ xchk_btree_cur_fsbno(
 	struct xfs_btree_cur	*cur,
 	int			level)
 {
+	if (level < 0)
+		return NULLFSBLOCK;
+
 	if (level < cur->bc_nlevels && cur->bc_levels[level].bp)
 		return XFS_DADDR_TO_FSB(cur->bc_mp,
 				xfs_buf_daddr(cur->bc_levels[level].bp));
@@ -53,6 +56,16 @@ xchk_btree_cur_fsbno(
 	return NULLFSBLOCK;
 }
 
+static inline int
+xchk_btree_cur_ptr(
+	const struct xfs_btree_cur	*cur,
+	int				level)
+{
+	if (level >= 0 && level < cur->bc_nlevels)
+		return cur->bc_levels[level].ptr;
+	return -1;
+}
+
 /*
  * We include this last to have the helpers above available for the trace
  * event implementations.
diff --git a/fs/xfs/scrub/trace.h b/fs/xfs/scrub/trace.h
index d3610959374577..789de92cd7df1c 100644
--- a/fs/xfs/scrub/trace.h
+++ b/fs/xfs/scrub/trace.h
@@ -577,7 +577,7 @@ TRACE_EVENT(xchk_btree_op_error,
 		__entry->level = level;
 		__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
 		__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
-		__entry->ptr = cur->bc_levels[level].ptr;
+		__entry->ptr = xchk_btree_cur_ptr(cur, level);
 		__entry->error = error;
 		__entry->ret_ip = ret_ip;
 	),
@@ -618,7 +618,7 @@ TRACE_EVENT(xchk_ifork_btree_op_error,
 		__entry->type = sc->sm->sm_type;
 		__assign_str(name);
 		__entry->level = level;
-		__entry->ptr = cur->bc_levels[level].ptr;
+		__entry->ptr = xchk_btree_cur_ptr(cur, level);
 		__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
 		__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
 		__entry->error = error;
@@ -660,7 +660,7 @@ TRACE_EVENT(xchk_btree_error,
 		__entry->level = level;
 		__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
 		__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
-		__entry->ptr = cur->bc_levels[level].ptr;
+		__entry->ptr = xchk_btree_cur_ptr(cur, level);
 		__entry->ret_ip = ret_ip;
 	),
 	TP_printk("dev %d:%d type %s %sbt level %d ptr %d agno 0x%x agbno 0x%x ret_ip %pS",
@@ -700,7 +700,7 @@ TRACE_EVENT(xchk_ifork_btree_error,
 		__entry->level = level;
 		__entry->agno = XFS_FSB_TO_AGNO(cur->bc_mp, fsbno);
 		__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
-		__entry->ptr = cur->bc_levels[level].ptr;
+		__entry->ptr = xchk_btree_cur_ptr(cur, level);
 		__entry->ret_ip = ret_ip;
 	),
 	TP_printk("dev %d:%d ino 0x%llx fork %s type %s %sbt level %d ptr %d agno 0x%x agbno 0x%x ret_ip %pS",
@@ -740,7 +740,7 @@ DECLARE_EVENT_CLASS(xchk_sbtree_class,
 		__entry->bno = XFS_FSB_TO_AGBNO(cur->bc_mp, fsbno);
 		__entry->level = level;
 		__entry->nlevels = cur->bc_nlevels;
-		__entry->ptr = cur->bc_levels[level].ptr;
+		__entry->ptr = xchk_btree_cur_ptr(cur, level);
 	),
 	TP_printk("dev %d:%d type %s %sbt agno 0x%x agbno 0x%x level %d nlevels %d ptr %d",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),

From 30fb9f2ad94a84ed36bcf514f220e535dcdc5f7c Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Mon, 12 Oct 2026 08:21:22 -0700
Subject: [PATCH 0858/1982] xfs: reattach dquots after changing inode ids

commit 2f528e4a8f89daa6d0cc64b044f6f94c018fe9ae upstream.

LOLLM noticed that xrep_inode_ids can change the user, group, or project
id of any given file.  When this happens, we need to detach any existing
incore dquot and attach the correct ones.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/scrub/inode_repair.c | 133 +++++++++++++++++++++++++++++++++++-
 1 file changed, 132 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/scrub/inode_repair.c b/fs/xfs/scrub/inode_repair.c
index a24ad3ba5159cf..ecec04e4dc3c74 100644
--- a/fs/xfs/scrub/inode_repair.c
+++ b/fs/xfs/scrub/inode_repair.c
@@ -41,6 +41,8 @@
 #include "xfs_rtgroup.h"
 #include "xfs_rtrmap_btree.h"
 #include "xfs_rtrefcount_btree.h"
+#include "xfs_dquot_item.h"
+#include "xfs_dquot.h"
 #include "scrub/xfs_scrub.h"
 #include "scrub/scrub.h"
 #include "scrub/common.h"
@@ -1762,6 +1764,20 @@ xrep_inode_ids(
 
 	trace_xrep_inode_ids(sc);
 
+	/*
+	 * We changed one of the file IDs, so we must detach the dquots to
+	 * prevent further changes from being accounted to them, and try to
+	 * attach the dquot for the new id to absorb any other block usage
+	 * changes.  We can't do that right now because the existing dquots
+	 * might be attached to the scrub transaction and we're in the middle
+	 * of fixing the inode, so we'll switch the incore dquot pointers
+	 * later.
+	 *
+	 * Schedule a quotacheck so the accounting discrepancies will get fixed
+	 * eventually.  We'll have to repeat this later when we do the actual
+	 * switch.
+	 */
+
 	if (!uid_valid(VFS_I(sc->ip)->i_uid)) {
 		i_uid_write(VFS_I(sc->ip), 0);
 		dirty = true;
@@ -2072,6 +2088,113 @@ xrep_inode_unlinked(
 	return 0;
 }
 
+#ifdef CONFIG_XFS_QUOTA
+static inline bool
+xrep_inode_need_reset_dquots(
+	struct xfs_scrub	*sc)
+{
+	struct xfs_mount	*mp = sc->mp;
+	struct xfs_inode	*ip = sc->ip;
+
+	if (!XFS_IS_QUOTA_ON(mp))
+		return false;
+	if (xfs_is_quota_inode(&mp->m_sb, I_INO(ip)))
+		return false;
+	if (xfs_is_metadir_inode(ip))
+		return false;
+
+	if (XFS_IS_UQUOTA_ON(sc->mp) &&
+	    (!ip->i_udquot || ip->i_udquot->q_id != i_uid_read(VFS_I(ip))))
+		return true;
+	if (XFS_IS_GQUOTA_ON(sc->mp) &&
+	    (!ip->i_gdquot || ip->i_gdquot->q_id != i_gid_read(VFS_I(ip))))
+		return true;
+	if (XFS_IS_PQUOTA_ON(sc->mp) &&
+	    (!ip->i_pdquot || ip->i_pdquot->q_id != ip->i_projid))
+		return true;
+
+	return false;
+}
+
+/* Switch dquot, return dqtype if we need quotacheck */
+static xfs_dqtype_t
+xrep_inode_switch_dquot(
+	struct xfs_scrub	*sc,
+	xfs_dqtype_t		type,
+	struct xfs_dquot	**dqp)
+{
+	xfs_dqtype_t		ret = 0;
+	xfs_dqid_t		id = xfs_qm_id_for_quotatype(sc->ip, type);
+
+	if (*dqp != NULL && (*dqp)->q_id != id) {
+		xfs_qm_dqrele(*dqp);
+		*dqp = NULL;
+	}
+
+	if (!*dqp) {
+		xfs_qm_dqget_inode(sc->ip, type, true, dqp);
+		ret = type;
+	}
+	return ret;
+}
+
+static int
+xrep_inode_reset_dquots(
+	struct xfs_scrub	*sc)
+{
+	xfs_dqtype_t		need = 0;
+	int			error;
+
+	/*
+	 * If we changed the file IDs, then we need to drop the transaction so
+	 * that we can detach the dquots and attach new ones.
+	 *
+	 * Commit the scrub transaction so that there are no dangling
+	 * references to any dquots that might get detached, and retain the
+	 * ILOCK, as required by the dqattach code.
+	 *
+	 * Note that dqattach can cycle the ILOCK when creating a new dquot, so
+	 * this must be the very last thing that the repair function does.
+	 */
+	error = xrep_trans_commit(sc);
+	if (error)
+		return error;
+
+	if (XFS_IS_UQUOTA_ON(sc->mp))
+		need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_USER,
+				&sc->ip->i_udquot);
+	if (XFS_IS_GQUOTA_ON(sc->mp))
+		need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_GROUP,
+				&sc->ip->i_gdquot);
+	if (XFS_IS_PQUOTA_ON(sc->mp))
+		need |= xrep_inode_switch_dquot(sc, XFS_DQTYPE_PROJ,
+				&sc->ip->i_pdquot);
+
+	xchk_iunlock(sc, XFS_ILOCK_EXCL);
+
+	/*
+	 * Now that we've updated the dquots, force quotacheck once again.
+	 * In theory we could be racing against a concurrent quotacheck.
+	 * Note that we can't hold the ILOCK when allocating a transaction.
+	 */
+	error = xchk_trans_alloc(sc, 0);
+	if (error)
+		return error;
+
+	if (need & XFS_DQTYPE_USER)
+		xrep_force_quotacheck(sc, XFS_DQTYPE_USER);
+	if (need & XFS_DQTYPE_GROUP)
+		xrep_force_quotacheck(sc, XFS_DQTYPE_GROUP);
+	if (need & XFS_DQTYPE_PROJ)
+		xrep_force_quotacheck(sc, XFS_DQTYPE_PROJ);
+
+	return 0;
+}
+#else
+# define xrep_inode_need_reset_dquots(sc)	(false)
+# define xrep_inode_reset_dquots(sc)		(0)
+#endif
+
 /* Repair an inode's fields. */
 int
 xrep_inode(
@@ -2126,5 +2249,13 @@ xrep_inode(
 	if (error)
 		return error;
 
-	return xrep_defer_finish(sc);
+	error = xrep_defer_finish(sc);
+	if (error)
+		return error;
+
+	/* Must come last */
+	if (xrep_inode_need_reset_dquots(sc))
+		return xrep_inode_reset_dquots(sc);
+
+	return 0;
 }

From 70daf37bef86eeafc9242ba32a5911e89e887ecb Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Fri, 21 Aug 2026 18:32:31 -0700
Subject: [PATCH 0859/1982] x86/bugs: Adapt SRSO mitigation to Zen6

commit ae1d2082d93bc04604dc08e9b7f9cdba5e0c28e6 upstream.

Zen6 has BTB protection which isolates the different contexts
(user/kernel, guest/host) from one another. This makes the SafeRET
mitigation there unnecessary leaving the user/user and guest/guest
attack vectors open, whose protection is handled by the Spectre v2
mitigation setting to do IBPB on a context switch.

Detect that setting and report it with a new mitigation string.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260822013231.1109255-1-bp@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpufeatures.h |  1 +
 arch/x86/kernel/cpu/bugs.c         | 18 ++++++++++++++++--
 arch/x86/kernel/cpu/scattered.c    |  1 +
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index f4c85555b7e49e..b60b4a82ea20a0 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -411,6 +411,7 @@
 #define X86_FEATURE_OVERFLOW_RECOV	(17*32+ 0) /* "overflow_recov" MCA overflow recovery support */
 #define X86_FEATURE_SUCCOR		(17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
 #define X86_FEATURE_SMCA		(17*32+ 3) /* "smca" Scalable MCA */
+#define X86_FEATURE_BTB_CTX_ISOLATION	(17*32+ 4) /* AMD: Branch predictions contexts isolated */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW	(18*32+ 2) /* "avx512_4vnniw" AVX-512 Neural Network Instructions */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index fbc465555e67c8..a39d97eee8bdb9 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1320,6 +1320,7 @@ enum srso_mitigation {
 	SRSO_MITIGATION_IBPB,
 	SRSO_MITIGATION_IBPB_ON_VMEXIT,
 	SRSO_MITIGATION_BP_SPEC_REDUCE,
+	SRSO_MITIGATION_USER_IBPB,
 };
 
 static enum srso_mitigation srso_mitigation __ro_after_init = SRSO_MITIGATION_AUTO;
@@ -3055,7 +3056,8 @@ static const char * const srso_strings[] = {
 	[SRSO_MITIGATION_SAFE_RET]		= "Mitigation: Safe RET",
 	[SRSO_MITIGATION_IBPB]			= "Mitigation: IBPB",
 	[SRSO_MITIGATION_IBPB_ON_VMEXIT]	= "Mitigation: IBPB on VMEXIT only",
-	[SRSO_MITIGATION_BP_SPEC_REDUCE]	= "Mitigation: Reduced Speculation"
+	[SRSO_MITIGATION_BP_SPEC_REDUCE]	= "Mitigation: Reduced Speculation",
+	[SRSO_MITIGATION_USER_IBPB]		= "Mitigation: IBPB on context switch",
 };
 
 static int __init srso_parse_cmdline(char *str)
@@ -3095,7 +3097,9 @@ static void __init srso_select_mitigation(void)
 		 * required.  Otherwise the 'microcode' mitigation is sufficient
 		 * to protect the user->user and guest->guest vectors.
 		 */
-		if (cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) ||
+		if ((cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST) &&
+		    !boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION))
+					||
 		    (cpu_attack_vector_mitigated(CPU_MITIGATE_USER_KERNEL) &&
 		     !boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO))) {
 			srso_mitigation = SRSO_MITIGATION_SAFE_RET;
@@ -3171,6 +3175,16 @@ static void __init srso_update_mitigation(void)
 	    boot_cpu_has(X86_FEATURE_IBPB_BRTYPE))
 		srso_mitigation = SRSO_MITIGATION_IBPB;
 
+	/*
+	 * See if IBPB on context switch is the only thing needed to address
+	 * GUEST/GUEST and USER/USER vectors.
+	 */
+	if (srso_mitigation == SRSO_MITIGATION_MICROCODE  &&
+	    boot_cpu_has(X86_FEATURE_SRSO_USER_KERNEL_NO) &&
+	    boot_cpu_has(X86_FEATURE_BTB_CTX_ISOLATION) &&
+	    spectre_v2_user_ibpb != SPECTRE_V2_USER_NONE)
+		srso_mitigation = SRSO_MITIGATION_USER_IBPB;
+
 	pr_info("%s\n", srso_strings[srso_mitigation]);
 }
 
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index caa4dc885c214f..c4bc3c259f3fc9 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -56,6 +56,7 @@ static const struct cpuid_bit cpuid_bits[] = {
 	{ X86_FEATURE_TSA_SQ_NO,		CPUID_ECX,  1, 0x80000021, 0 },
 	{ X86_FEATURE_TSA_L1_NO,		CPUID_ECX,  2, 0x80000021, 0 },
 	{ X86_FEATURE_AMD_WORKLOAD_CLASS,	CPUID_EAX, 22, 0x80000021, 0 },
+	{ X86_FEATURE_BTB_CTX_ISOLATION,	CPUID_ECX,  8, 0x80000021, 0 },
 	{ X86_FEATURE_PERFMON_V2,		CPUID_EAX,  0, 0x80000022, 0 },
 	{ X86_FEATURE_AMD_LBR_V2,		CPUID_EAX,  1, 0x80000022, 0 },
 	{ X86_FEATURE_AMD_LBR_PMC_FREEZE,	CPUID_EAX,  2, 0x80000022, 0 },

From 93d1fbe38f0c1f230fdd24410353b1fd9e5883d3 Mon Sep 17 00:00:00 2001
From: VeroFess <coderzeng@hotmail.com>
Date: Mon, 26 Oct 2026 15:01:03 +0900
Subject: [PATCH 0860/1982] smb: server: size directory name conversion buffer
 correctly

commit f1f37834eaba5904103af1f18afe3510c7e9dc71 upstream.

A 2048-byte ASCII directory name needs 4098 bytes when converted to
UTF-16, including the terminator. ksmbd_convert_dir_info_name() caps
its allocation at PATH_MAX and writes past the end of that buffer.

Allocate space for one UTF-16 code unit per input byte plus the
terminator. Use kmalloc_array() to check the size calculation.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: gpt 6 sol with daybreak blue
Signed-off-by: VeroFess <coderzeng@hotmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/misc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/smb/server/misc.c b/fs/smb/server/misc.c
index d6abe574fc89b7..1564b9f5cad067 100644
--- a/fs/smb/server/misc.c
+++ b/fs/smb/server/misc.c
@@ -291,12 +291,13 @@ char *ksmbd_convert_dir_info_name(struct ksmbd_dir_info *d_info,
 				  int *conv_len)
 {
 	char *conv;
-	int  sz = min(4 * d_info->name_len, PATH_MAX);
 
-	if (!sz)
+	if (d_info->name_len <= 0)
 		return NULL;
 
-	conv = kmalloc(sz, KSMBD_DEFAULT_GFP);
+	/* One UTF-16 code unit per input byte, plus the terminating NUL. */
+	conv = kmalloc_array((size_t)d_info->name_len + 1,
+			     sizeof(__le16), KSMBD_DEFAULT_GFP);
 	if (!conv)
 		return NULL;
 
@@ -305,7 +306,6 @@ char *ksmbd_convert_dir_info_name(struct ksmbd_dir_info *d_info,
 				      d_info->name_len, local_nls, 0);
 	*conv_len *= 2;
 
-	/* We allocate buffer twice bigger than needed. */
 	conv[*conv_len] = 0x00;
 	conv[*conv_len + 1] = 0x00;
 	return conv;

From b304a9268f7d54eb75ce62f75013c9a90eabf084 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Sun, 25 Oct 2026 20:48:08 -0300
Subject: [PATCH 0861/1982] smb: client: don't resurrect an exiting tcon from
 cached dir workers

commit d58e7b40908a8a57755811d5b37af1df3380278f upstream.

cfids_laundromat_worker() bumps tcon->tc_count for every expired open
cfid and queues cached_dir_offload_close() without checking whether the
tcon is already being torn down.  Racing with the final cifs_put_tcon(),
the tcon comes back from zero and gets torn down twice:

  T1                                  T2
  cifs_put_tcon()
   --tc_count == 0, TID_EXITING
   tconInfoFree()
    free_cached_dirs()
     cancel_delayed_work_sync()       cfids_laundromat_worker()
                                       ++tc_count == 1
                                       queue_work(serverclose_wq)
    kfree(tcon->origin_fullpath)
    kfree(tcon)
                                      cached_dir_offload_close()
                                       close_cached_dir()  [UAF]
                                       cifs_put_tcon()
                                        tconInfoFree()     [double free]

cached_dir_lease_break() also bumps tc_count without tc_lock, racing with
the laundromat's locked update.

Take the tcon reference through a helper that refuses once the tcon is
TID_EXITING or its refcount has dropped to zero.  Queued put_work and
close_work then always hold a tcon reference, so tconInfoFree() can't
run before they finish and free_cached_dirs() doesn't need to flush any
workqueue.  If the laundromat can't get a reference, put the cfid back on
the dying list for free_cached_dirs() to free; its handle goes away with
the tree connection.

The lease break path finds the tcon on ses->tcon_list under
cifs_tcp_ses_lock, so it can't see TID_EXITING, but it now takes tc_lock.

Fixes: 3fa640d035e5 ("smb: During unmount, ensure all cached dir instances drop their dentry")
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cached_dir.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c
index 0c8c0e69e1ea2c..3c2549fea72578 100644
--- a/fs/smb/client/cached_dir.c
+++ b/fs/smb/client/cached_dir.c
@@ -648,6 +648,17 @@ void invalidate_all_cached_dirs(struct cifs_tcon *tcon)
 	flush_delayed_work(&cfids->laundromat_work);
 }
 
+static bool cached_dir_get_tcon(struct cifs_tcon *tcon,
+				enum smb3_tcon_ref_trace trace)
+{
+	guard(spinlock)(&tcon->tc_lock);
+	if (tcon->status == TID_EXITING || tcon->tc_count <= 0)
+		return false;
+	++tcon->tc_count;
+	trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, trace);
+	return true;
+}
+
 static void
 cached_dir_offload_close(struct work_struct *work)
 {
@@ -692,6 +703,9 @@ bool cached_dir_lease_break(struct cifs_tcon *tcon, __u8 lease_key[16])
 		    !memcmp(lease_key,
 			    cfid->fid.lease_key,
 			    SMB2_LEASE_KEY_SIZE)) {
+			if (!cached_dir_get_tcon(tcon,
+						 netfs_trace_tcon_ref_get_cached_lease_break))
+				break;
 			cfid->has_lease = false;
 			cfid->time = 0;
 			/*
@@ -702,9 +716,6 @@ bool cached_dir_lease_break(struct cifs_tcon *tcon, __u8 lease_key[16])
 			cfid->on_list = false;
 			cfids->num_entries--;
 
-			++tcon->tc_count;
-			trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
-					    netfs_trace_tcon_ref_get_cached_lease_break);
 			queue_work(cfid_put_wq, &cfid->put_work);
 			spin_unlock(&cfids->cfid_list_lock);
 			return true;
@@ -812,12 +823,13 @@ static void cfids_laundromat_worker(struct work_struct *work)
 		cfid->dentry = NULL;
 
 		if (cfid->is_open) {
-			spin_lock(&cfid->tcon->tc_lock);
-			++cfid->tcon->tc_count;
-			trace_smb3_tcon_ref(cfid->tcon->debug_id, cfid->tcon->tc_count,
-					    netfs_trace_tcon_ref_get_cached_laundromat);
-			spin_unlock(&cfid->tcon->tc_lock);
-			queue_work(serverclose_wq, &cfid->close_work);
+			if (cached_dir_get_tcon(cfid->tcon,
+						netfs_trace_tcon_ref_get_cached_laundromat)) {
+				queue_work(serverclose_wq, &cfid->close_work);
+				continue;
+			}
+			scoped_guard(spinlock, &cfids->cfid_list_lock)
+				list_add_tail(&cfid->entry, &cfids->dying);
 		} else
 			/*
 			 * Drop the ref-count from above, either the lease-ref (if there

From acf25a7be39dccdbf60fdf3d437dd7832fa4b6d3 Mon Sep 17 00:00:00 2001
From: Luxiao Xu <rakukuip@gmail.com>
Date: Fri, 16 Oct 2026 15:11:01 +0800
Subject: [PATCH 0862/1982] smb: client: fix buffer overflow in SMB2_tcon()

commit 73cc469b0ff7551f8537ea919709973e6dc4f514 upstream.

In SMB2_tcon(), unc_path is allocated with a fixed buffer size of
MAX_SHARENAME_LENGTH * 2 bytes (672 bytes). However, the user-controlled
UNC path (tree) length is passed to cifs_strtoUTF16(), which assumes the
destination buffer is large enough and writes strlen(tree) + 1 UTF-16 code
units.

Commit 62a1a439e0fd ("cifs: clean up handling of unc= option") removed the
length check on UNC mount options, allowing mount paths to exceed
MAX_SHARENAME_LENGTH while retaining the fixed-size buffer allocation in
SMB2_tcon(). Consequently, an oversized UNC string causes cifs_strtoUTF16()
to write past the end of the heap object, resulting in a slab-out-of-bounds
write. Furthermore, if a tree exceeds MAX_TREE_SIZE characters, strscpy()
truncates it in cifs_tcon::tree_name, causing subsequent reconnects or
failovers to fail.

Fix this by first verifying that the length of tree does not exceed
MAX_TREE_SIZE, returning -EINVAL if it does. Then, dynamically allocate
unc_path based on the length of tree so that it safely accommodates all
UTF-16 code units for paths within MAX_TREE_SIZE.

Fixes: 62a1a439e0fd ("cifs: clean up handling of unc= option")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Closes: https://bugtracker.nebusec.ai/f/3292
Assisted-by: LLM
Suggested-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
[pc: remove unused MAX_SHARENAME_LENGTH]
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/smb2pdu.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index cb6db40c435891..6d610f136f43e4 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2017,8 +2017,6 @@ static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
 	cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
 }
 
-#define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
-
 /* These are similar values to what Windows uses */
 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
 {
@@ -2049,7 +2047,15 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 	if (!server || !tree)
 		return -EIO;
 
-	unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
+	total_len = strlen(tree);
+	if (total_len > MAX_TREE_SIZE) {
+		cifs_server_dbg(VFS | ONCE,
+				"%s: tree name exceeded %u characters\n",
+				__func__, MAX_TREE_SIZE);
+		return -EINVAL;
+	}
+
+	unc_path = kmalloc((total_len + 1) * sizeof(*unc_path), GFP_KERNEL);
 	if (unc_path == NULL)
 		return -ENOMEM;
 

From 4a426ca5be7e3dedbe76575b967db04fbf01136f Mon Sep 17 00:00:00 2001
From: Abdifatah Suruur <suruurism@gmail.com>
Date: Fri, 23 Oct 2026 14:52:46 +0300
Subject: [PATCH 0863/1982] smb: client: fix fiemap wild read on empty
 truncated response

commit f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc upstream.

smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob
and loops for the next chunk. If the server reports
STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns
-E2BIG with out_data == NULL and out_data_len == 0, and the existing
length checks accept the empty result. The loop then evaluates

	next = out_data[num - 1].file_offset + ...

with num == 0, reading 16 bytes before NULL.

Reject a truncated range blob that contains no range, so the resume
offset is never computed from an empty response. Also require the last
range in a truncated blob to advance the resume offset without
overflowing, and to stay within the requested range; a malicious or
broken server could otherwise make no progress or underflow len and loop
forever. Free the previous response buffer before retrying.

Reproduced on 6.6.87.2 with a malicious SMB2 server that answers
FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and
OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in
cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged
on mainline.

Fixes: 2f3ebaba13ce ("cifs: add fiemap support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/smb2ops.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 5ad3804826d9ae..f47f0f9ca781bb 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4293,6 +4293,15 @@ static int smb3_fiemap(struct cifs_tcon *tcon,
 		goto out;
 	}
 
+	/*
+	 * A truncated range blob must contain at least one range, otherwise
+	 * there is no offset to resume from and out_data is NULL.
+	 */
+	if (!last_blob && out_data_len == 0) {
+		rc = -EINVAL;
+		goto out;
+	}
+
 	num = out_data_len / sizeof(struct file_allocated_range_buffer);
 	for (i = 0; i < num; i++) {
 		flags = 0;
@@ -4313,10 +4322,25 @@ static int smb3_fiemap(struct cifs_tcon *tcon,
 	}
 
 	if (!last_blob) {
-		next = le64_to_cpu(out_data[num - 1].file_offset) +
-		  le64_to_cpu(out_data[num - 1].length);
-		len = len - (next - start);
+		u64 last_start, last_len;
+
+		last_start = le64_to_cpu(out_data[num - 1].file_offset);
+		last_len = le64_to_cpu(out_data[num - 1].length);
+
+		if (check_add_overflow(last_start, last_len, &next) ||
+		    next <= start) {
+			rc = -EINVAL;
+			goto out;
+		}
+		if (next - start >= len) {
+			rc = 0;
+			goto out;
+		}
+
+		len -= next - start;
 		start = next;
+		kfree(out_data);
+		out_data = NULL;
 		goto again;
 	}
 

From ba57bfe1a9fa1566757cd3f3310ccdf88f4b7673 Mon Sep 17 00:00:00 2001
From: Dominik Maier <dmnk@google.com>
Date: Fri, 23 Oct 2026 01:21:16 +0200
Subject: [PATCH 0864/1982] smb: client: fix slab-out-of-bounds write in
 id_mode_to_cifs_acl()

commit a377a3645c7d0246af0bc4ef24db94bb2670bdde upstream.

In id_mode_to_cifs_acl(), while the chown branch reserves
sizeof(struct smb_ntsd) + 2 * sizeof(struct smb_sid) (plus
sizeof(struct smb_acl) and the worst-case ACE space after
commit 0ee150794c75 ("smb: client: fix heap overflow in DACL owner/group
rewrite")), the chmod branch only adds 2 * sizeof(struct smb_ace) or
5 * sizeof(struct smb_ace) to secdesclen (or 1 * sizeof(struct smb_ace)
on posix).

However, the chmod branch also invokes build_sec_desc() ->
copy_sec_desc(), which unconditionally writes the Owner SID at
pnntsd + sidsoffset and the Group SID at
pnntsd + sidsoffset + sizeof(struct smb_sid) (2 * 68 = 136 bytes total),
and set_chmod_dacl() always writes a struct smb_acl header (8 bytes)
even when the source descriptor has dacloffset == 0. When a security
descriptor has compact or overlapping Owner/Group SIDs (or
dacloffset == 0), calling chmod() under-allocates pnntsd and writes past
the end of the slab buffer.

Reserve sizeof(struct smb_acl) + 2 * sizeof(struct smb_sid) (plus
sizeof(struct smb_ntsd) on the posix path) in the chmod branch of
id_mode_to_cifs_acl().

Fixes: 7ee0b4c635c0 ("cifs: fix hardcoded default security descriptor length")
Fixes: f5065508897a ("cifs: Retain old ACEs when converting between mode bits and ACL.")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cifsacl.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c
index b03560f5cd8785..bb4a258b2c17dd 100644
--- a/fs/smb/client/cifsacl.c
+++ b/fs/smb/client/cifsacl.c
@@ -1772,12 +1772,15 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
 
 	/* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */
 	if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */
+		nsecdesclen = sizeof(struct smb_acl) +
+			2 * sizeof(struct smb_sid);
 		if (posix)
-			nsecdesclen = 1 * sizeof(struct smb_ace);
+			nsecdesclen += sizeof(struct smb_ntsd) +
+				       sizeof(struct smb_ace);
 		else if (mode_from_sid)
-			nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace));
+			nsecdesclen += secdesclen + 2 * sizeof(struct smb_ace);
 		else /* cifsacl */
-			nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace));
+			nsecdesclen += secdesclen + 5 * sizeof(struct smb_ace);
 	} else { /* chown */
 		/* When ownership changes, changes new owner sid length could be different */
 		nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2);

From 520b48753e3c54172a078e7e4b82aec83ae2e08d Mon Sep 17 00:00:00 2001
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Date: Sat, 17 Oct 2026 23:15:05 +0200
Subject: [PATCH 0865/1982] smb: client: validate NT transaction response
 layout and offsets

commit 83d0d5e0ca22233c75daf139ec0063b9d2ff1ac7 upstream.

validate_ntransact() assumes that the response uses the fixed 18-word NT
transaction layout. A different WordCount makes get_bcc() locate the byte
count at a different offset from pSMBr->ByteCount, allowing the subsequent
bounds checks to use inconsistent response boundaries.

The function also turns the 32-bit ParameterOffset and DataOffset fields
into pointers before checking their bounds. On a 32-bit client, a large
offset can wrap the pointer below end_of_smb and pass the one-sided pointer
comparison. The caller then dereferences the parameter pointer or copies
from the data pointer.

Require the expected WordCount before reading the byte count. Check each
offset and count against the received SMB length as integers before forming
either pointer. Use subtraction after validating the offset so that the
range checks cannot overflow.

Reported-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Fixes: 0a4b92c05ed0 ("[CIFS] Add worker function for Get ACL cifs style")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cifssmb.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index 127efa6fc36845..6e4b845a4078cc 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -3715,9 +3715,10 @@ static int
 validate_ntransact(char *buf, char **ppparm, char **ppdata,
 		   __u32 *pparmlen, __u32 *pdatalen)
 {
-	char *end_of_smb;
 	__u32 data_count, data_offset, parm_count, parm_offset;
 	struct smb_com_ntransact_rsp *pSMBr;
+	size_t buflen;
+	char *end_buf;
 	u16 bcc;
 
 	*pdatalen = 0;
@@ -3728,37 +3729,42 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata,
 
 	pSMBr = (struct smb_com_ntransact_rsp *)buf;
 
+	if (pSMBr->hdr.WordCount != 18) {
+		cifs_dbg(FYI, "invalid NT transaction WordCount %u\n",
+			 pSMBr->hdr.WordCount);
+		return -EINVAL;
+	}
+
 	bcc = get_bcc(&pSMBr->hdr);
-	end_of_smb = 2 /* sizeof byte count */ + bcc +
-			(char *)&pSMBr->ByteCount;
+	end_buf = 2 /* sizeof byte count */ + bcc + (char *)&pSMBr->ByteCount;
+	buflen = end_buf - buf;
 
 	data_offset = le32_to_cpu(pSMBr->DataOffset);
 	data_count = le32_to_cpu(pSMBr->DataCount);
 	parm_offset = le32_to_cpu(pSMBr->ParameterOffset);
 	parm_count = le32_to_cpu(pSMBr->ParameterCount);
 
-	*ppparm = (char *)&pSMBr->hdr.Protocol + parm_offset;
-	*ppdata = (char *)&pSMBr->hdr.Protocol + data_offset;
-
 	/* should we also check that parm and data areas do not overlap? */
-	if (*ppparm > end_of_smb) {
+	if (parm_offset > buflen) {
 		cifs_dbg(FYI, "parms start after end of smb\n");
 		return -EINVAL;
-	} else if (parm_count + *ppparm > end_of_smb) {
+	} else if (parm_count > buflen - parm_offset) {
 		cifs_dbg(FYI, "parm end after end of smb\n");
 		return -EINVAL;
-	} else if (*ppdata > end_of_smb) {
+	} else if (data_offset > buflen) {
 		cifs_dbg(FYI, "data starts after end of smb\n");
 		return -EINVAL;
-	} else if (data_count + *ppdata > end_of_smb) {
-		cifs_dbg(FYI, "data %p + count %d (%p) past smb end %p start %p\n",
-			 *ppdata, data_count, (data_count + *ppdata),
-			 end_of_smb, pSMBr);
+	} else if (data_count > buflen - data_offset) {
+		cifs_dbg(FYI, "data offset %u + count %u past smb length %zu\n",
+			 data_offset, data_count, buflen);
 		return -EINVAL;
 	} else if (parm_count + data_count > bcc) {
 		cifs_dbg(FYI, "parm count and data count larger than SMB\n");
 		return -EINVAL;
 	}
+
+	*ppparm = buf + parm_offset;
+	*ppdata = buf + data_offset;
 	*pdatalen = data_count;
 	*pparmlen = parm_count;
 	return 0;

From bed2aa2307e427525ce71bd8d60331418d5b2629 Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:06 -0400
Subject: [PATCH 0866/1982] pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume
 ndc_immediate

commit a0cb76dc3b2919af8257fc08b4f9a79a35442483 upstream.

decode_devicenotify_args() gated the trailing ndc_immediate on
cbd_layout_type rather than cbd_notify_type, so the flag was never
consumed and a multi-item cnda_changes<> misaligned after the first
entry.

Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/callback_xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index ada04a7230c223..1aa6a6e14b0574 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -316,7 +316,7 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
 		memcpy(dev->cbd_dev_id.data, p, NFS4_DEVICEID4_SIZE);
 		p += XDR_QUADLEN(NFS4_DEVICEID4_SIZE);
 
-		if (dev->cbd_layout_type == NOTIFY_DEVICEID4_CHANGE) {
+		if (dev->cbd_notify_type == NOTIFY_DEVICEID4_CHANGE) {
 			p = xdr_inline_decode(xdr, sizeof(uint32_t));
 			if (unlikely(p == NULL)) {
 				status = htonl(NFS4ERR_BADXDR);

From 7b757e120aaffef893fa9a8ecfdf9144566cbc96 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 1 Sep 2026 16:19:45 -0400
Subject: [PATCH 0867/1982] pnfs/blocklayout: Complete a device upcall only on
 its own reply

commit acfbea6c5e27c68d6b6d12849eb2b7f8466ccf06 upstream.

bl_pipe_downcall() wakes bl_resolve_deviceid() on any write of the
right size, without checking that blkmapd has read the upcall being
replied to. A write that arrives first returns the waiter while its
struct rpc_pipe_msg is still queued on the pipe, which then holds a
list_head into a dead stack frame. Reaching the pipe takes root, so
the trigger is a broken or hostile blkmapd.

The wait has two further defects. bl_resolve_deviceid() sets
TASK_UNINTERRUPTIBLE only after rpc_queue_upcall() has made the
message visible, so a reply that lands in between wakes a running
task and the schedule() that follows sleeps forever holding
bl_mutex. And nn->bl_mount_reply is never reset, so when the pipe
purges an unread upcall the waiter takes the previous reply as its
own.

Move the message into struct nfs_net, where bl_mutex already limits
the pipe to one upcall per net namespace. Accept a reply only while
blkmapd has read the whole message and no earlier reply has been
taken, and reject any other write with -EINVAL. Wait for that reply
on a completion so it cannot slip past the sleep, and check
msg->errno before trusting it.

Fixes: fe0a9b740881 ("pnfsblock: add device operations")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-5-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/blocklayout/blocklayout.h |  5 ---
 fs/nfs/blocklayout/rpc_pipefs.c  | 58 ++++++++++++++++++++------------
 fs/nfs/netns.h                   |  5 ++-
 3 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 6da40ca1957049..e242b1d5b4bdac 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -161,11 +161,6 @@ BLK_LSEG2EXT(struct pnfs_layout_segment *lseg)
 	return BLK_LO2EXT(lseg->pls_layout);
 }
 
-struct bl_pipe_msg {
-	struct rpc_pipe_msg msg;
-	wait_queue_head_t *bl_wq;
-};
-
 struct bl_msg_hdr {
 	u8  type;
 	u16 totallen; /* length of entire message, including hdr itself */
diff --git a/fs/nfs/blocklayout/rpc_pipefs.c b/fs/nfs/blocklayout/rpc_pipefs.c
index d526f5ba7887a2..50f276a905278f 100644
--- a/fs/nfs/blocklayout/rpc_pipefs.c
+++ b/fs/nfs/blocklayout/rpc_pipefs.c
@@ -55,17 +55,15 @@ bl_resolve_deviceid(struct nfs_server *server, struct pnfs_block_volume *b,
 	struct net *net = server->nfs_client->cl_net;
 	struct nfs_net *nn = net_generic(net, nfs_net_id);
 	struct bl_dev_msg *reply = &nn->bl_mount_reply;
-	struct bl_pipe_msg bl_pipe_msg;
-	struct rpc_pipe_msg *msg = &bl_pipe_msg.msg;
+	struct rpc_pipe_msg *msg = &nn->bl_pipe_msg;
+	struct rpc_pipe *pipe = nn->bl_device_pipe;
 	struct bl_msg_hdr *bl_msg;
-	DECLARE_WAITQUEUE(wq, current);
 	dev_t dev = 0;
 	int rc;
 
 	dprintk("%s CREATING PIPEFS MESSAGE\n", __func__);
 
 	mutex_lock(&nn->bl_mutex);
-	bl_pipe_msg.bl_wq = &nn->bl_wq;
 
 	b->simple.len += 4;	/* single volume */
 	if (b->simple.len > PAGE_SIZE)
@@ -83,17 +81,15 @@ bl_resolve_deviceid(struct nfs_server *server, struct pnfs_block_volume *b,
 	nfs4_encode_simple(msg->data + sizeof(*bl_msg), b);
 
 	dprintk("%s CALLING USERSPACE DAEMON\n", __func__);
-	add_wait_queue(&nn->bl_wq, &wq);
-	rc = rpc_queue_upcall(nn->bl_device_pipe, msg);
-	if (rc < 0) {
-		remove_wait_queue(&nn->bl_wq, &wq);
+	reinit_completion(&nn->bl_done);
+	rc = rpc_queue_upcall(pipe, msg);
+	if (rc < 0)
 		goto out_free_data;
-	}
 
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	schedule();
-	remove_wait_queue(&nn->bl_wq, &wq);
+	wait_for_completion(&nn->bl_done);
 
+	if (msg->errno < 0)
+		goto out_free_data;
 	if (reply->status != BL_DEVICE_REQUEST_PROC) {
 		printk(KERN_WARNING "%s failed to decode device: %d\n",
 			__func__, reply->status);
@@ -113,26 +109,46 @@ static ssize_t bl_pipe_downcall(struct file *filp, const char __user *src,
 {
 	struct nfs_net *nn = net_generic(file_inode(filp)->i_sb->s_fs_info,
 					 nfs_net_id);
+	struct rpc_pipe *pipe = nn->bl_device_pipe;
+	struct bl_dev_msg reply;
+	bool accepted;
 
-	if (mlen != sizeof (struct bl_dev_msg))
+	if (mlen != sizeof(reply))
 		return -EINVAL;
-
-	if (copy_from_user(&nn->bl_mount_reply, src, mlen) != 0)
+	if (copy_from_user(&reply, src, mlen) != 0)
 		return -EFAULT;
 
-	wake_up(&nn->bl_wq);
-
+	/*
+	 * Accept a reply only after blkmapd has read the whole upcall.
+	 * Completion retires the message, here and in
+	 * bl_pipe_destroy_msg(), so a later reply finds nothing in
+	 * flight.
+	 */
+	spin_lock(&pipe->lock);
+	accepted = rpc_msg_is_inflight(&nn->bl_pipe_msg);
+	if (accepted) {
+		nn->bl_pipe_msg.copied = 0;
+		nn->bl_mount_reply = reply;
+		complete(&nn->bl_done);
+	}
+	spin_unlock(&pipe->lock);
+	if (!accepted)
+		return -EINVAL;
 	return mlen;
 }
 
 static void bl_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 {
-	struct bl_pipe_msg *bl_pipe_msg =
-		container_of(msg, struct bl_pipe_msg, msg);
+	struct nfs_net *nn = container_of(msg, struct nfs_net, bl_pipe_msg);
+	struct rpc_pipe *pipe = nn->bl_device_pipe;
 
 	if (msg->errno >= 0)
 		return;
-	wake_up(bl_pipe_msg->bl_wq);
+
+	spin_lock(&pipe->lock);
+	msg->copied = 0;
+	spin_unlock(&pipe->lock);
+	complete(&nn->bl_done);
 }
 
 static const struct rpc_pipe_ops bl_upcall_ops = {
@@ -221,7 +237,7 @@ static int nfs4blocklayout_net_init(struct net *net)
 	int err;
 
 	mutex_init(&nn->bl_mutex);
-	init_waitqueue_head(&nn->bl_wq);
+	init_completion(&nn->bl_done);
 	nn->bl_device_pipe = rpc_mkpipe_data(&bl_upcall_ops, 0);
 	if (IS_ERR(nn->bl_device_pipe))
 		return PTR_ERR(nn->bl_device_pipe);
diff --git a/fs/nfs/netns.h b/fs/nfs/netns.h
index 6ba3ea39e928c0..0495efbe231b7b 100644
--- a/fs/nfs/netns.h
+++ b/fs/nfs/netns.h
@@ -10,6 +10,8 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <linux/sunrpc/stats.h>
+#include <linux/sunrpc/rpc_pipe_fs.h>
+#include <linux/completion.h>
 
 struct bl_dev_msg {
 	int32_t status;
@@ -21,8 +23,9 @@ struct nfs_netns_client;
 struct nfs_net {
 	struct cache_detail *nfs_dns_resolve;
 	struct rpc_pipe *bl_device_pipe;
+	struct rpc_pipe_msg bl_pipe_msg;
 	struct bl_dev_msg bl_mount_reply;
-	wait_queue_head_t bl_wq;
+	struct completion bl_done;
 	struct mutex bl_mutex;
 	struct list_head nfs_client_list;
 	struct list_head nfs_volume_list;

From 9b89bd161183277fe08077f7877b495ec53a2440 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 1 Sep 2026 16:19:48 -0400
Subject: [PATCH 0868/1982] pnfs/blocklayout: Complete a device upcall when the
 pipe is closed

commit 2a25cc8e984610828a526086313b8a7aeefe507d upstream.

Once blkmapd has read a whole upcall, rpc_pipe_read() unlinks the
message from every pipe list, so the purges in rpc_pipe_release()
and rpc_close_pipes() no longer reach it. bl_upcall_ops supplies no
.release_pipe callback, and bl_pipe_destroy_msg() returns without
completing the upcall because a downcall is expected to follow. A
daemon that exits between the read and the write therefore strands
its waiter: bl_resolve_deviceid() sleeps in wait_for_completion()
and never returns, and it holds nn->bl_mutex across that wait, so
every later device resolution in the net namespace blocks behind
it.

Add a .release_pipe that completes an upcall blkmapd has consumed
and left unanswered. Completing an upcall retires it, so a message
the framework has already purged is no longer in flight and is not
completed a second time here.

Fixes: fe0a9b740881 ("pnfsblock: add device operations")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-8-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/blocklayout/rpc_pipefs.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/fs/nfs/blocklayout/rpc_pipefs.c b/fs/nfs/blocklayout/rpc_pipefs.c
index 50f276a905278f..f0004a8249e786 100644
--- a/fs/nfs/blocklayout/rpc_pipefs.c
+++ b/fs/nfs/blocklayout/rpc_pipefs.c
@@ -151,10 +151,31 @@ static void bl_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 	complete(&nn->bl_done);
 }
 
+/*
+ * An upcall blkmapd has consumed is off every pipe list, so the
+ * purges in rpc_pipe_release() and rpc_close_pipes() cannot reach it.
+ * No downcall can arrive once the pipe is closed; release its waiter
+ * here.
+ */
+static void bl_release_pipe(struct inode *inode)
+{
+	struct nfs_net *nn = net_generic(inode->i_sb->s_fs_info, nfs_net_id);
+	struct rpc_pipe *pipe = nn->bl_device_pipe;
+
+	spin_lock(&pipe->lock);
+	if (rpc_msg_is_inflight(&nn->bl_pipe_msg)) {
+		nn->bl_pipe_msg.copied = 0;
+		nn->bl_pipe_msg.errno = -EPIPE;
+		complete(&nn->bl_done);
+	}
+	spin_unlock(&pipe->lock);
+}
+
 static const struct rpc_pipe_ops bl_upcall_ops = {
 	.upcall		= rpc_pipe_generic_upcall,
 	.downcall	= bl_pipe_downcall,
 	.destroy_msg	= bl_pipe_destroy_msg,
+	.release_pipe	= bl_release_pipe,
 };
 
 static int nfs4blocklayout_register_sb(struct super_block *sb,

From cf4c0b3acb1d0600acc39ecb2f3b22647ac6ddb1 Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:03 -0400
Subject: [PATCH 0869/1982] NFSv4/pnfs: Free the netid when draining a
 data-server address list

commit a7c8e96d1b9fa327cbdea514d047c8295b28d49a upstream.

nfs4_pnfs_ds_addr_free() releases all three of an address entry's
allocations, but the four sites that drain a decoded list before it
reaches a data server open-code the loop and free only da_remotestr and
the entry, leaking da_netid.  Both layout drivers drain that list when
nfs4_pnfs_ds_add() returned a data server already in the cache, and
again on their error exits.

Lift the drain into nfs4_pnfs_ds_addr_list_free() so an address list has
one owner.  A striping mount reaches the cached case on nearly every
GETDEVICEINFO, since many deviceIDs name the same data servers.

Fixes: 4be78d26810b ("NFSv4/pNFS: Store the transport type in struct nfs4_pnfs_ds_addr")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/filelayout/filelayoutdev.c         | 17 ++---------------
 fs/nfs/flexfilelayout/flexfilelayoutdev.c | 17 ++---------------
 fs/nfs/pnfs.h                             |  1 +
 fs/nfs/pnfs_nfs.c                         | 21 +++++++++++++--------
 4 files changed, 18 insertions(+), 38 deletions(-)

diff --git a/fs/nfs/filelayout/filelayoutdev.c b/fs/nfs/filelayout/filelayoutdev.c
index e13d880de581f9..f005f63bc55170 100644
--- a/fs/nfs/filelayout/filelayoutdev.c
+++ b/fs/nfs/filelayout/filelayoutdev.c
@@ -177,27 +177,14 @@ nfs4_fl_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 		trace_fl_getdevinfo(server, &pdev->dev_id, dsaddr->ds_list[i]->ds_remotestr);
 
 		/* If DS was already in cache, free ds addrs */
-		while (!list_empty(&dsaddrs)) {
-			da = list_first_entry(&dsaddrs,
-					      struct nfs4_pnfs_ds_addr,
-					      da_node);
-			list_del_init(&da->da_node);
-			kfree(da->da_remotestr);
-			kfree(da);
-		}
+		nfs4_pnfs_ds_addr_list_free(&dsaddrs);
 	}
 
 	folio_put(scratch);
 	return dsaddr;
 
 out_err_drain_dsaddrs:
-	while (!list_empty(&dsaddrs)) {
-		da = list_first_entry(&dsaddrs, struct nfs4_pnfs_ds_addr,
-				      da_node);
-		list_del_init(&da->da_node);
-		kfree(da->da_remotestr);
-		kfree(da);
-	}
+	nfs4_pnfs_ds_addr_list_free(&dsaddrs);
 out_err_free_deviceid:
 	nfs4_fl_free_deviceid(dsaddr);
 	/* stripe_indicies was part of dsaddr */
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index cb88c51346d999..b59afe5d28831f 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -155,26 +155,13 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
 		goto out_err_drain_dsaddrs;
 
 	/* If DS was already in cache, free ds addrs */
-	while (!list_empty(&dsaddrs)) {
-		da = list_first_entry(&dsaddrs,
-				      struct nfs4_pnfs_ds_addr,
-				      da_node);
-		list_del_init(&da->da_node);
-		kfree(da->da_remotestr);
-		kfree(da);
-	}
+	nfs4_pnfs_ds_addr_list_free(&dsaddrs);
 
 	folio_put(scratch);
 	return new_ds;
 
 out_err_drain_dsaddrs:
-	while (!list_empty(&dsaddrs)) {
-		da = list_first_entry(&dsaddrs, struct nfs4_pnfs_ds_addr,
-				      da_node);
-		list_del_init(&da->da_node);
-		kfree(da->da_remotestr);
-		kfree(da);
-	}
+	nfs4_pnfs_ds_addr_list_free(&dsaddrs);
 
 	kfree(ds_versions);
 out_scratch:
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 14d2a91250f24b..9d612bed74e3c1 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -426,6 +426,7 @@ int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
 struct nfs4_pnfs_ds_addr *nfs4_decode_mp_ds_addr(struct net *net,
 						 struct xdr_stream *xdr,
 						 gfp_t gfp_flags);
+void nfs4_pnfs_ds_addr_list_free(struct list_head *dsaddrs);
 void pnfs_layout_mark_request_commit(struct nfs_page *req,
 				     struct pnfs_layout_segment *lseg,
 				     struct nfs_commit_info *cinfo,
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 5e85ea0ef5846c..4743828872440b 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -633,23 +633,28 @@ static void nfs4_pnfs_ds_addr_free(struct nfs4_pnfs_ds_addr *da)
 	kfree(da);
 }
 
-static void destroy_ds(struct nfs4_pnfs_ds *ds)
+void nfs4_pnfs_ds_addr_list_free(struct list_head *dsaddrs)
 {
 	struct nfs4_pnfs_ds_addr *da;
 
+	while (!list_empty(dsaddrs)) {
+		da = list_first_entry(dsaddrs, struct nfs4_pnfs_ds_addr,
+				      da_node);
+		list_del_init(&da->da_node);
+		nfs4_pnfs_ds_addr_free(da);
+	}
+}
+EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_addr_list_free);
+
+static void destroy_ds(struct nfs4_pnfs_ds *ds)
+{
 	dprintk("--> %s\n", __func__);
 	ifdebug(FACILITY)
 		print_ds(ds);
 
 	nfs_put_client(ds->ds_clp);
 
-	while (!list_empty(&ds->ds_addrs)) {
-		da = list_first_entry(&ds->ds_addrs,
-				      struct nfs4_pnfs_ds_addr,
-				      da_node);
-		list_del_init(&da->da_node);
-		nfs4_pnfs_ds_addr_free(da);
-	}
+	nfs4_pnfs_ds_addr_list_free(&ds->ds_addrs);
 
 	kfree(ds->ds_remotestr);
 	kfree(ds);

From bfa512d906cdbd5de45529746ef3f20d5e9c2b0a Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Fri, 4 Sep 2026 08:56:02 -0400
Subject: [PATCH 0870/1982] NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from
 LAYOUTGET

commit 28c950413605fb5b6cb3863c5e3274ea69701097 upstream.

If the layout for the requested range is larger than the size the
client advertised in loga_maxcount, RFC 8881 Section 18.43.3 has the
metadata server return NFS4ERR_TOOSMALL.  The client caps
loga_maxcount at a single page, so a flexfiles server that stripes a
layout segment across several dozen data servers produces this error
today.

The client has no handling for it: nfs4_stat_to_errno() maps the
error to -ETOOSMALL during decode, which nothing in the layoutget
path recognizes and nfs_error_is_fatal() does not consider fatal, so
pnfs_update_layout() clears the layout fail bit and returns no
segment.  The I/O falls back to the MDS, but because no fail bit was
set, every subsequent pageio attempt sends another LAYOUTGET that is
doomed to the same NFS4ERR_TOOSMALL.  Files whose layouts do not fit
the reply buffer never use pNFS and pay an extra round trip on every
pageio.

Map -ETOOSMALL to -EMSGSIZE in the layoutget exception handler and
have pnfs_update_layout() treat it like NFS4ERR_LAYOUTUNAVAILABLE:
mark the layout mode as failed and fall back to I/O through the MDS.

Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c | 8 ++++++++
 fs/nfs/pnfs.c     | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 84ba899bf0a74d..d856be907e3194 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -9937,6 +9937,14 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
 	case -NFS4ERR_BADLAYOUT:
 		status = -EOVERFLOW;
 		goto out;
+	/*
+	 * NFS4ERR_TOOSMALL means the layout for the requested range
+	 * exceeds what the client advertised in loga_maxcount (see
+	 * RFC8881 section 18.43.3).
+	 */
+	case -ETOOSMALL:
+		status = -EMSGSIZE;
+		goto out;
 	/*
 	 * NFS4ERR_LAYOUTTRYLATER is a conflict with another client
 	 * (or clients) writing to the same RAID stripe except when
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index e2c723e21cb725..7fe272c6a86717 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2319,6 +2319,8 @@ pnfs_update_layout(struct inode *ino,
 			break;
 		case -ENODATA:
 			/* The server returned NFS4ERR_LAYOUTUNAVAILABLE */
+		case -EMSGSIZE:
+			/* The layout exceeded loga_maxcount (NFS4ERR_TOOSMALL) */
 			pnfs_layout_set_fail_bit(
 				lo, pnfs_iomode_to_fail_bit(iomode));
 			lseg = NULL;

From 8581c8ea5fd2bc2cd0ac41704084e03cab06950b Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:09 -0400
Subject: [PATCH 0871/1982] NFSv4/filelayout: Anchor page coalescing on
 pattern_offset

commit 7f2d221b01f356b6bb3bb6efef998f8b28339824 upstream.

filelayout_pg_test() bounds page coalescing to a single stripe unit
using an offset relative to pls_range.offset, but the data server is
selected by nfs4_fl_calc_j_index() using an offset relative to
pattern_offset.  When a segment's pattern_offset and range offset are
not congruent modulo the stripe unit, the coalescing window is shifted
off the DS-selection grid, so a coalesced I/O can straddle a stripe
boundary and send the bytes past it to the wrong data server.

Anchor coalescing on pattern_offset to match nfs4_fl_calc_j_index().
Stripe-congruent segments, including the common whole-file pattern_offset
0 case, are unchanged.

Fixes: c6194271f94b ("pnfs: filelayout: support non page aligned layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/filelayout/filelayout.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index c933e3b695bc36..90924129b4e834 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -796,7 +796,7 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 	unsigned int size;
 	u64 p_stripe, r_stripe;
 	u32 stripe_offset;
-	u64 segment_offset = pgio->pg_lseg->pls_range.offset;
+	u64 pattern_offset = FILELAYOUT_LSEG(pgio->pg_lseg)->pattern_offset;
 	u32 stripe_unit = FILELAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
 
 	/* calls nfs_generic_pg_test */
@@ -808,8 +808,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 
 	/* see if req and prev are in the same stripe */
 	if (prev) {
-		p_stripe = (u64)req_offset(prev) - segment_offset;
-		r_stripe = (u64)req_offset(req) - segment_offset;
+		p_stripe = (u64)req_offset(prev) - pattern_offset;
+		r_stripe = (u64)req_offset(req) - pattern_offset;
 		do_div(p_stripe, stripe_unit);
 		do_div(r_stripe, stripe_unit);
 
@@ -818,7 +818,7 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 	}
 
 	/* calculate remaining bytes in the current stripe */
-	div_u64_rem((u64)req_offset(req) - segment_offset,
+	div_u64_rem((u64)req_offset(req) - pattern_offset,
 			stripe_unit,
 			&stripe_offset);
 	WARN_ON_ONCE(stripe_offset > stripe_unit);

From 938f374ec83912d1383810a1d31aa7ac1940b11e Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <bcodding@hammerspace.com>
Date: Thu, 15 Oct 2026 07:33:07 -0400
Subject: [PATCH 0872/1982] NFSv4/flexfiles: fail I/O to the data server once a
 lock is lost

commit 7fa2ad367abe6d3155daefb57331e7fce1a17afd upstream.

When a client loses a byte-range lock, because its lease expired and it
may not recover the lock (nfs.recover_lost_locks=0) or because reclaim
failed, it marks the lock state NFS_LOCK_LOST and fails further I/O by
that lock owner.  Otherwise an application that believes it holds a
lock over a range is never told that the lock is gone, and can
overwrite data that another client has since written under its own
lock on that range.

The NFSv4 READ/WRITE and file layout I/O paths apply this in
rpc_call_prepare, where nfs4_set_rw_stateid() returns -EIO for a lost
lock.  The flexfiles data server I/O path does not: the NFSv3 data
server path never checked, and the check on the NFSv4 path was removed
when the data server stateid began to be taken from the layout.

Fail read and write RPCs to the data server in rpc_call_prepare when the
lock is lost.  The data server path has no use for the stateid that
nfs4_set_rw_stateid() selects, and selecting it looks up a delegation
or open stateid on every I/O.
Instead add nfs4_lock_context_lost(), which only tests NFS_LOCK_LOST,
and check it alongside the open state.  Its lookup,
__nfs4_lookup_lock_state(), is split out of __nfs4_find_lock_state()
and takes no reference: a lock state is only unlinked from
state->lock_states under state->state_lock, so one found while holding
that lock cannot be freed before it is released.  Use it in
nfs4_copy_lock_stateid() as well, which only reads the lock state under
that lock.  That drops a reference get and put from stateid selection
for all NFSv4 I/O without changing the stateid selected.

Terminating the RPC in rpc_call_prepare is not enough on its own.  The
done callback reads the -EIO as a data server connection error, forgets
the device ID, and resets the I/O to pNFS (or, for an NFSv4 data
server, possibly to the MDS).  After a reset to pNFS a new LAYOUTGET is
granted and rpc_call_prepare fails the I/O again, without end.  The
existing NFS_CONTEXT_BAD check does not loop, since the open state is
then invalid and pnfs_update_layout() fails the reset I/O, but it still
forgets the device ID.

So when an RPC that was never sent fails and the open context is bad,
the open state is invalid, or the lock is lost, complete it with -EIO
without error handling.  An RPC that was sent and failed is handled as
before, so a real data server error is still reported to the MDS.

Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Fixes: bb21ce0ad227 ("flexfiles: use per-mirror specified stateid for IO")
Cc: stable@vger.kernel.org
Tested-by: Arun Potharaju <arun.potharaju@hammerspace.com>
Assisted-by: LLM
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 25 +++++++++++++++--
 fs/nfs/nfs4_fs.h                       |  2 ++
 fs/nfs/nfs4state.c                     | 38 +++++++++++++++++++++++---
 3 files changed, 59 insertions(+), 6 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index c708724bb53f28..d052140cb0568a 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1599,6 +1599,15 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 	dprintk("%s: err %d op %d status %u\n", __func__, err, opnum, status);
 }
 
+static bool ff_layout_io_state_lost(const struct nfs_pgio_header *hdr)
+{
+	struct nfs_open_context *ctx = hdr->args.context;
+
+	return test_bit(NFS_CONTEXT_BAD, &ctx->flags) ||
+	       !nfs4_valid_open_stateid(ctx->state) ||
+	       nfs4_lock_context_lost(ctx->state, hdr->args.lock_context);
+}
+
 /* NFS_PROTO call done callback routines */
 static int ff_layout_read_done_cb(struct rpc_task *task,
 				struct nfs_pgio_header *hdr)
@@ -1610,6 +1619,12 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
 		hdr->args.offset);
 	int err;
 
+	if (task->tk_status < 0 && !RPC_WAS_SENT(task) &&
+	    ff_layout_io_state_lost(hdr)) {
+		task->tk_status = -EIO;
+		return 0;
+	}
+
 	if (task->tk_status < 0) {
 		ff_layout_io_track_ds_error(hdr->lseg,
 					    hdr->pgio_mirror_idx, dss_id,
@@ -1726,7 +1741,7 @@ static void ff_layout_read_record_layoutstats_done(struct rpc_task *task,
 static int ff_layout_read_prepare_common(struct rpc_task *task,
 					 struct nfs_pgio_header *hdr)
 {
-	if (unlikely(test_bit(NFS_CONTEXT_BAD, &hdr->args.context->flags))) {
+	if (unlikely(ff_layout_io_state_lost(hdr))) {
 		rpc_exit(task, -EIO);
 		return -EIO;
 	}
@@ -1815,6 +1830,12 @@ static int ff_layout_write_done_cb(struct rpc_task *task,
 	loff_t end_offs = 0;
 	int err;
 
+	if (task->tk_status < 0 && !RPC_WAS_SENT(task) &&
+	    ff_layout_io_state_lost(hdr)) {
+		task->tk_status = -EIO;
+		return 0;
+	}
+
 	if (task->tk_status < 0) {
 		ff_layout_io_track_ds_error(hdr->lseg,
 					    hdr->pgio_mirror_idx, dss_id,
@@ -1952,7 +1973,7 @@ static void ff_layout_write_record_layoutstats_done(struct rpc_task *task,
 static int ff_layout_write_prepare_common(struct rpc_task *task,
 					  struct nfs_pgio_header *hdr)
 {
-	if (unlikely(test_bit(NFS_CONTEXT_BAD, &hdr->args.context->flags))) {
+	if (unlikely(ff_layout_io_state_lost(hdr))) {
 		rpc_exit(task, -EIO);
 		return -EIO;
 	}
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index c34c89af9c7d5f..e5beda66c6d688 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -520,6 +520,8 @@ extern int nfs4_select_rw_stateid(struct nfs4_state *, fmode_t,
 		const struct cred **);
 extern bool nfs4_copy_open_stateid(nfs4_stateid *dst,
 		struct nfs4_state *state);
+extern bool nfs4_lock_context_lost(struct nfs4_state *state,
+		const struct nfs_lock_context *l_ctx);
 
 extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_mask);
 extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6147d8c0ee111b..53a52859ac0bc3 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -864,10 +864,13 @@ void nfs4_close_sync(struct nfs4_state *state, fmode_t fmode)
  * be made.  Failing that, a "consistent" choice is preferable.  The
  * consistent choice we make is to prefer the first owner, that of a
  * Posix lock.
+ *
+ * Called with state->state_lock held.  No reference is taken: a lock
+ * state is freed only after it is unlinked under state->state_lock.
  */
 static struct nfs4_lock_state *
-__nfs4_find_lock_state(struct nfs4_state *state,
-		       fl_owner_t owner, fl_owner_t owner2)
+__nfs4_lookup_lock_state(struct nfs4_state *state,
+			 fl_owner_t owner, fl_owner_t owner2)
 {
 	struct nfs4_lock_state *pos, *ret = NULL;
 	list_for_each_entry(pos, &state->lock_states, ls_locks) {
@@ -878,6 +881,16 @@ __nfs4_find_lock_state(struct nfs4_state *state,
 		if (pos->ls_owner == owner2)
 			ret = pos;
 	}
+	return ret;
+}
+
+static struct nfs4_lock_state *
+__nfs4_find_lock_state(struct nfs4_state *state,
+		       fl_owner_t owner, fl_owner_t owner2)
+{
+	struct nfs4_lock_state *ret;
+
+	ret = __nfs4_lookup_lock_state(state, owner, owner2);
 	if (ret)
 		refcount_inc(&ret->ls_count);
 	return ret;
@@ -1020,7 +1033,7 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
 	fl_flock_owner = l_ctx->open_context->flock_owner;
 
 	spin_lock(&state->state_lock);
-	lsp = __nfs4_find_lock_state(state, owner, fl_flock_owner);
+	lsp = __nfs4_lookup_lock_state(state, owner, fl_flock_owner);
 	if (lsp && test_bit(NFS_LOCK_LOST, &lsp->ls_flags))
 		ret = -EIO;
 	else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
@@ -1028,11 +1041,28 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
 		ret = 0;
 	}
 	spin_unlock(&state->state_lock);
-	nfs4_put_lock_state(lsp);
 out:
 	return ret;
 }
 
+bool nfs4_lock_context_lost(struct nfs4_state *state,
+			    const struct nfs_lock_context *l_ctx)
+{
+	struct nfs4_lock_state *lsp;
+	bool ret;
+
+	if (!test_bit(LK_STATE_IN_USE, &state->flags))
+		return false;
+
+	spin_lock(&state->state_lock);
+	lsp = __nfs4_lookup_lock_state(state, l_ctx->lockowner,
+				       l_ctx->open_context->flock_owner);
+	ret = lsp && test_bit(NFS_LOCK_LOST, &lsp->ls_flags);
+	spin_unlock(&state->state_lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(nfs4_lock_context_lost);
+
 bool nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
 {
 	bool ret;

From 12326bd73a61676cf1a42e2629251430ac8f96af Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:07 -0400
Subject: [PATCH 0873/1982] NFSv4/flexfiles: Use the full 64-bit offset for
 read DS selection

commit 448591e1f82902e5714bd436d6367adc7fbaea90 upstream.

The read data-server selection helpers declare their offset parameter
as u32, truncating the file offset before nfs4_ff_layout_calc_dss_id()
computes the stripe index.  The write path already passes the full
offset; make the read path match.

Fixes: 4934ccbeaed3 ("NFSv4/flexfiles: Read path updates for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index d052140cb0568a..d5fe8b6c9734ed 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -880,7 +880,7 @@ ff_layout_mark_ds_reachable(struct pnfs_layout_segment *lseg, u32 idx, u32 dss_i
 static struct nfs4_pnfs_ds *
 ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg,
 			     u32 start_idx, u32 *best_idx,
-			     u32 offset, u32 *dss_id,
+			     u64 offset, u32 *dss_id,
 			     bool check_device)
 {
 	struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
@@ -916,7 +916,7 @@ ff_layout_choose_ds_for_read(struct pnfs_layout_segment *lseg,
 static struct nfs4_pnfs_ds *
 ff_layout_choose_any_ds_for_read(struct pnfs_layout_segment *lseg,
 				 u32 start_idx, u32 *best_idx,
-				 u32 offset, u32 *dss_id)
+				 u64 offset, u32 *dss_id)
 {
 	return ff_layout_choose_ds_for_read(lseg, start_idx, best_idx,
 					    offset, dss_id, false);
@@ -925,7 +925,7 @@ ff_layout_choose_any_ds_for_read(struct pnfs_layout_segment *lseg,
 static struct nfs4_pnfs_ds *
 ff_layout_choose_valid_ds_for_read(struct pnfs_layout_segment *lseg,
 				   u32 start_idx, u32 *best_idx,
-				   u32 offset, u32 *dss_id)
+				   u64 offset, u32 *dss_id)
 {
 	return ff_layout_choose_ds_for_read(lseg, start_idx, best_idx,
 					    offset, dss_id, true);
@@ -934,7 +934,7 @@ ff_layout_choose_valid_ds_for_read(struct pnfs_layout_segment *lseg,
 static struct nfs4_pnfs_ds *
 ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
 				  u32 start_idx, u32 *best_idx,
-				  u32 offset, u32 *dss_id)
+				  u64 offset, u32 *dss_id)
 {
 	struct nfs4_pnfs_ds *ds;
 
@@ -949,7 +949,7 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
 static struct nfs4_pnfs_ds *
 ff_layout_get_ds_for_read(struct nfs_pageio_descriptor *pgio,
 			  u32 *best_idx,
-			  u32 offset,
+			  u64 offset,
 			  u32 *dss_id)
 {
 	struct pnfs_layout_segment *lseg = pgio->pg_lseg;

From 43b9e0c39eed665be2267329b5c041ba2b2a997c Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:04 -0400
Subject: [PATCH 0874/1982] NFSv4/flexfiles: Use the full 64-bit stripe_unit

commit 0cc1191538b1523dfe944eedc799fdd146c05fbf upstream.

ff_layout_alloc_lseg() decodes stripe_unit as the 64-bit value the
protocol defines and struct nfs4_ff_layout_segment stores it as one, but
both consumers narrow it back to 32 bits: nfs4_ff_layout_calc_dss_id()
divides with do_div(), which casts the divisor, and ff_layout_pg_test()
copies it into a u32 first.  A stripe_unit that does not fit is silently
truncated, so the client stripes on a unit the server did not specify --
or divides by zero, if the low 32 bits happen to be clear.

Divide by the full value, with div64_u64() and div64_u64_rem().

Fixes: 20b1d75fb840 ("NFSv4/flexfiles: Add support for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 12 ++++++------
 fs/nfs/flexfilelayout/flexfilelayout.h |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index d5fe8b6c9734ed..d1172df6fe0cf1 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -997,9 +997,9 @@ ff_layout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 {
 	unsigned int size;
 	u64 p_stripe, r_stripe;
-	u32 stripe_offset;
+	u64 stripe_offset;
 	u64 segment_offset = pgio->pg_lseg->pls_range.offset;
-	u32 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
+	u64 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
 
 	/* calls nfs_generic_pg_test */
 	size = pnfs_generic_pg_test(pgio, prev, req);
@@ -1012,21 +1012,21 @@ ff_layout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 	if (prev) {
 		p_stripe = (u64)req_offset(prev) - segment_offset;
 		r_stripe = (u64)req_offset(req) - segment_offset;
-		do_div(p_stripe, stripe_unit);
-		do_div(r_stripe, stripe_unit);
+		p_stripe = div64_u64(p_stripe, stripe_unit);
+		r_stripe = div64_u64(r_stripe, stripe_unit);
 
 		if (p_stripe != r_stripe)
 			return 0;
 	}
 
 	/* calculate remaining bytes in the current stripe */
-	div_u64_rem((u64)req_offset(req) - segment_offset,
+	div64_u64_rem((u64)req_offset(req) - segment_offset,
 			stripe_unit,
 			&stripe_offset);
 	WARN_ON_ONCE(stripe_offset > stripe_unit);
 	if (stripe_offset >= stripe_unit)
 		return 0;
-	return min(stripe_unit - (unsigned int)stripe_offset, size);
+	return min_t(u64, stripe_unit - stripe_offset, size);
 }
 
 static void
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index a5bd00f69e8242..ec69cd1c3ae963 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -220,7 +220,7 @@ nfs4_ff_layout_calc_dss_id(const u64 stripe_unit, const u32 dss_count, const lof
 	if (dss_count == 1 || stripe_unit == 0)
 		return 0;
 
-	do_div(tmp, stripe_unit);
+	tmp = div64_u64(tmp, stripe_unit);
 
 	return do_div(tmp, dss_count);
 }

From d2609b2db66a161d95b588e28aa2b473a5c6b054 Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <ben.coddington@hammerspace.com>
Date: Tue, 15 Sep 2026 08:22:08 -0400
Subject: [PATCH 0875/1982] NFSv4/flexfiles: Bound page coalescing on the
 absolute stripe offset

commit a84c62c4f03706b2c2f01dcc5fe614a4233ee75d upstream.

ff_layout_pg_test() was copied from the files layout, which partitions
data servers relative to pattern_offset and bounds coalescing with a
segment-relative offset.  Flexfiles has no pattern_offset:
nfs4_ff_layout_calc_dss_id() partitions on the absolute file offset
(RFC 8435 Section 6).  So when a layout segment's offset is not
stripe-unit-aligned, the segment-relative coalescing window is shifted
off the absolute stripe grid and a coalesced I/O can straddle a stripe
boundary, sending the bytes past it to the wrong data server.

Bound coalescing on the absolute offset to match calc_dss_id().  Aligned
segments, including all whole-file layouts, are unchanged.

Fixes: 4934ccbeaed3 ("NFSv4/flexfiles: Read path updates for striped layouts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index d1172df6fe0cf1..7af81b4cf9a14b 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -998,7 +998,6 @@ ff_layout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 	unsigned int size;
 	u64 p_stripe, r_stripe;
 	u64 stripe_offset;
-	u64 segment_offset = pgio->pg_lseg->pls_range.offset;
 	u64 stripe_unit = FF_LAYOUT_LSEG(pgio->pg_lseg)->stripe_unit;
 
 	/* calls nfs_generic_pg_test */
@@ -1010,8 +1009,8 @@ ff_layout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 
 	/* see if req and prev are in the same stripe */
 	if (prev) {
-		p_stripe = (u64)req_offset(prev) - segment_offset;
-		r_stripe = (u64)req_offset(req) - segment_offset;
+		p_stripe = (u64)req_offset(prev);
+		r_stripe = (u64)req_offset(req);
 		p_stripe = div64_u64(p_stripe, stripe_unit);
 		r_stripe = div64_u64(r_stripe, stripe_unit);
 
@@ -1020,7 +1019,7 @@ ff_layout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
 	}
 
 	/* calculate remaining bytes in the current stripe */
-	div64_u64_rem((u64)req_offset(req) - segment_offset,
+	div64_u64_rem((u64)req_offset(req),
 			stripe_unit,
 			&stripe_offset);
 	WARN_ON_ONCE(stripe_offset > stripe_unit);

From 209ad0993faea7bbf5c8f981a56c120813473e07 Mon Sep 17 00:00:00 2001
From: Jimmy Zuber <jamz@amazon.com>
Date: Tue, 22 Sep 2026 17:56:56 +0000
Subject: [PATCH 0876/1982] NFS: Fix stale negative cache on failed nfs_mkdir()

commit 211cda4fdf33011cee39f8970c4625b207142d6b upstream.

Since commit 8376583b84a1 ("nfs: change mkdir inode_operation to return
alternate dentry if needed"), nfs_mkdir() no longer drops the dentry on
RPC failure.  A negative cache value can then result in spurious ENOENT
results for further operations within that directory, such as open or
stat.

We observed this breaking some applications where an EEXIST on mkdir
caused the application to assume the directory to exist, only to fail
operations within that directory due to the retained negative cache
entry.  The other create paths, nfs_create() and nfs_mknod(), still drop
the dentry on failure.  This patch restores the previous behavior.

Fixes: 8376583b84a1 ("nfs: change mkdir inode_operation to return alternate dentry if needed")
Cc: stable@vger.kernel.org # v6.15+
Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/dir.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 0d8ac9a7448aff..f54c1a485095db 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2442,6 +2442,8 @@ struct dentry *nfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 	trace_nfs_mkdir_enter(dir, dentry);
 	ret = NFS_PROTO(dir)->mkdir(dir, dentry, &attr);
 	trace_nfs_mkdir_exit(dir, dentry, PTR_ERR_OR_ZERO(ret));
+	if (IS_ERR(ret))
+		d_drop(dentry);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nfs_mkdir);

From c4faa631e9e12ccc40b8fca99eed1596bdc10075 Mon Sep 17 00:00:00 2001
From: Mike Snitzer <snitzer@kernel.org>
Date: Mon, 28 Sep 2026 11:54:25 -0400
Subject: [PATCH 0877/1982] NFS/localio: fix nfs_local_dio_misaligned
 tracepoint

commit 1ea352a0db8bcb6ff6820e9a8715aac0aa3c761f upstream.

The intended focus of nfs_local_iters_setup_dio()'s call to
trace_nfs_local_dio_misaligned() is on the middle segment being
misaligned, yet the @offset passed in was local_dio->start_len.
It would appear this was a cut-n-paste bug from the preceding
nfs_local_iter_setup() call that passes local_dio->start_len.

Fix this by passing the @offset as local_dio->middle_offset and
calculate the start segment's offset rather than assume.

Example traces, before this fix:

   python3-32744   [006] .l... 132946.352360:
   nfs_local_dio_write: fileid=00:33:1286 fhandle=0xf1f7c10b
   offset=1048759 count=1048576 mem_align=4 offset_align=512
   start=1048759+329 middle=1049088+1048064 end=2097152+183

   python3-32744   [006] .l... 132946.352360:
   nfs_local_dio_misaligned: fileid=00:33:1286 fhandle=0xf1f7c10b
   offset=329 count=1048064 mem_align=4 offset_align=512
   start=329+329 middle=1049088+1048064 end=2097152+183

After this fix:

   python3-32744   [006] .l... 132946.352360:
   nfs_local_dio_write: fileid=00:33:1286 fhandle=0xf1f7c10b
   offset=1048759 count=1048576 mem_align=4 offset_align=512
   start=1048759+329 middle=1049088+1048064 end=2097152+183

   python3-32744   [006] .l... 132946.352360:
   nfs_local_dio_misaligned: fileid=00:33:1286 fhandle=0xf1f7c10b
   offset=1049088 count=1048064 mem_align=4 offset_align=512
   start=1048759+329 middle=1049088+1048064 end=2097152+183

Fixes: 6a218b9c3183e ("nfs/localio: do not issue misaligned DIO out-of-order")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/localio.c  | 2 +-
 fs/nfs/nfstrace.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 358d686d2ae330..aa1c1d8d181c91 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -448,7 +448,7 @@ nfs_local_iters_setup_dio(struct nfs_local_kiocb *iocb, int rw,
 
 	if (unlikely(!iocb->iter_is_dio_aligned[n_iters])) {
 		trace_nfs_local_dio_misaligned(iocb->hdr->inode,
-			local_dio->start_len, local_dio->middle_len, local_dio);
+			local_dio->middle_offset, local_dio->middle_len, local_dio);
 		return 0; /* no DIO-aligned IO possible */
 	}
 	iocb->end_iter_index = n_iters;
diff --git a/fs/nfs/nfstrace.h b/fs/nfs/nfstrace.h
index 9f9ce4a565ea68..fcdcc6caaf404a 100644
--- a/fs/nfs/nfstrace.h
+++ b/fs/nfs/nfstrace.h
@@ -1771,7 +1771,10 @@ DECLARE_EVENT_CLASS(nfs_local_dio_class,
 		__entry->count = count;
 		__entry->mem_align = local_dio->mem_align;
 		__entry->offset_align = local_dio->offset_align;
-		__entry->start = offset;
+		if (local_dio->start_len)
+			__entry->start = local_dio->middle_offset - local_dio->start_len;
+		else
+			__entry->start = 0;
 		__entry->start_len = local_dio->start_len;
 		__entry->middle = local_dio->middle_offset;
 		__entry->middle_len = local_dio->middle_len;

From 7c4846faba43c30736f77e5680de698cb55cf0de Mon Sep 17 00:00:00 2001
From: Mike Snitzer <snitzer@kernel.org>
Date: Mon, 28 Sep 2026 11:54:27 -0400
Subject: [PATCH 0878/1982] NFS/localio: report the stability a DIO WRITE
 actually has

commit 077d39c1ac8c9b2e2fad8e66a2ba6250ced1a860 upstream.

Since commit d32ddfeb5593 ("nfs/localio: Ensure DIO WRITE's IO on
stable storage upon completion") a DIO WRITE issued through LOCALIO
is persisted before it completes: nfs_local_iters_init() sets
IOCB_DSYNC|IOCB_SYNC on it despite whatever the caller asked for, so
that the buffered head and tail and the O_DIRECT middle of a
misaligned write cannot complete out of order.  The reply still
reported the stability that was asked for, so an UNSTABLE write came
back UNSTABLE, the client kept its pages on the commit list, and the
COMMIT that followed ran an fsync for data that is already on stable
storage.

Report the stability the kiocb actually carries instead: FILE_SYNC
when IOCB_SYNC is set, DATA_SYNC when only IOCB_DSYNC is.  A write
told FILE_SYNC has no reason to COMMIT and sends none.  Buffered
writes, and any write that asked for at least what it got, are
unchanged.

Fixes: d32ddfeb5593 ("nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/localio.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index aa1c1d8d181c91..3c5891d3ab8971 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -911,6 +911,7 @@ nfs_local_do_write(struct nfs_local_kiocb *iocb,
 		   const struct rpc_call_ops *call_ops)
 {
 	struct nfs_pgio_header *hdr = iocb->hdr;
+	enum nfs3_stable_how committed = hdr->args.stable;
 
 	dprintk("%s: vfs_write count=%u pos=%llu %s\n",
 		__func__, hdr->args.count, hdr->args.offset,
@@ -926,9 +927,20 @@ nfs_local_do_write(struct nfs_local_kiocb *iocb,
 		iocb->kiocb.ki_flags |= IOCB_DSYNC|IOCB_SYNC;
 	}
 
+	/*
+	 * Report the stability the write will actually have.  A DIO WRITE
+	 * is persisted before it completes whatever was asked for, see
+	 * nfs_local_iters_init(), and a caller told so has no reason to
+	 * COMMIT data that is already on stable storage.
+	 */
+	if (iocb->kiocb.ki_flags & IOCB_SYNC)
+		committed = NFS_FILE_SYNC;
+	else if (iocb->kiocb.ki_flags & IOCB_DSYNC)
+		committed = NFS_DATA_SYNC;
+
 	nfs_local_pgio_init(hdr, call_ops);
 
-	nfs_set_local_verifier(hdr->inode, hdr->res.verf, hdr->args.stable);
+	nfs_set_local_verifier(hdr->inode, hdr->res.verf, committed);
 
 	INIT_WORK(&iocb->work, nfs_local_call_write);
 	queue_work(nfslocaliod_workqueue, &iocb->work);

From f256b39c64e956d9db46c5a42be99f9fe9685919 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Tue, 1 Sep 2026 09:39:39 -0400
Subject: [PATCH 0879/1982] NFSD: cap the number of listeners accepted in
 listener_set

commit 9a05e5ee0a98b9550521df86936b5f825bc07ec2 upstream.

nfsd_nl_listener_set_doit() matches each requested listener against the
existing set. The nested loop that does this is O(N * M), where N is the
requested count and M is the existing count. The loop runs under sv_lock
with bottom halves disabled. A userland request with a very large listener
list can therefore spin in atomic context for a long time.

Reject a request that carries more than NFSD_NL_LISTENER_MAX (1024)
entries. The check goes in nfsd_nl_validate_listeners(), before the code
takes any lock. The limit is far above any realistic configuration.

This patch does not cap M. Only the message size bounded N; real sockets
bound M. A listener_set result set is the requested set, so that path also
holds M at the cap, but __write_ports_addxprt() adds two listeners per call
and removes none, so repeated calls can push M past it. The worst case
under sv_lock is therefore 1024 * M, plus 1024 nla_parse_nested() calls.
Both interfaces require CAP_NET_ADMIN.

Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-1-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsctl.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 888872bb7cf5b8..4d27150b75e41c 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1913,21 +1913,22 @@ int nfsd_nl_version_get_doit(struct sk_buff *skb, struct genl_info *info)
 	return err;
 }
 
+/* Upper bound on the number of listeners a single request may carry. */
+#define NFSD_NL_LISTENER_MAX	1024
+
 /**
  * nfsd_nl_validate_listeners - sanity-check the listener list from userland
  * @info: netlink metadata and command arguments
  *
- * Walk every NFSD_A_SERVER_SOCK_ADDR attribute and confirm that each entry
- * is well-formed: it parses against the policy, carries both an address and
- * a transport name, and the address is long enough for its family. Doing
- * this up front lets the callers below assume every entry is valid and
- * guarantees we make no changes when the request is malformed.
+ * Walk every NFSD_A_SERVER_SOCK_ADDR attribute and confirm that the list is
+ * not oversized and that each entry is well-formed.
  *
  * Return: 0 if every entry is valid, or a negative errno otherwise.
  */
 static int nfsd_nl_validate_listeners(struct genl_info *info)
 {
 	const struct nlattr *attr;
+	unsigned int count = 0;
 	int rem;
 
 	nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
@@ -1936,6 +1937,11 @@ static int nfsd_nl_validate_listeners(struct genl_info *info)
 		struct sockaddr *sa;
 		int err;
 
+		if (++count > NFSD_NL_LISTENER_MAX) {
+			NL_SET_ERR_MSG(info->extack, "too many listeners");
+			return -E2BIG;
+		}
+
 		err = nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
 				       nfsd_sock_nl_policy, info->extack);
 		if (err < 0)

From 624531ecd48b96be2a94c964685762960bd11208 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Tue, 15 Sep 2026 13:01:19 -0300
Subject: [PATCH 0880/1982] nfsd: clear XDR padding in GETXATTR replies

commit daba58690339ae86f1ebeb5197aa1369fae37e57 upstream.

nfsd4_vbuf_to_stream() uses a raw memcpy() for the first fragment of an
attribute value. xdr_reserve_space() aligns the reservation but does not
initialize the extra bytes. If the complete value fits in that fragment,
the loop that clears padding for the final fragment is never entered.

A remote client reading an attribute whose length is not a multiple of
four can therefore receive one to three stale bytes from the response
page.

Encode the first fragment with xdr_encode_opaque_fixed(), matching the
final-fragment path and ensuring that any XDR padding is zeroed.

Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160119.3105745-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 9f49e3c9e75276..95c8c999f8682b 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5543,7 +5543,7 @@ nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen)
 	if (!p)
 		return nfserr_resource;
 
-	memcpy(p, buf, cplen);
+	xdr_encode_opaque_fixed(p, buf, cplen);
 	buf += cplen;
 	buflen -= cplen;
 

From 20b76bdbd029343ea98944cb88bf016da2371739 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Tue, 15 Sep 2026 13:00:22 -0300
Subject: [PATCH 0881/1982] NFSD: copy SETXATTR data from all XDR buffer
 segments

commit b01319947c69b0e3ea0fcd4b675eb892f9cad8a0 upstream.

nfsd4_vbuf_from_vector() manually copies the head followed by whole
pages starting at offset zero. This assumes that all remaining data
starts at the beginning of the page array and that no data is stored
in the tail.

However, nfsd4_decode_setxattr() passes an xdr_buf returned by
xdr_stream_subsegment(). Such a sub-buffer can have a nonzero
page_base and can span its page and tail segments. Ignoring that
layout can copy the wrong bytes into the value passed to
vfs_setxattr().

Use read_bytes_from_xdr_buf(), which observes the complete xdr_buf
layout.

Fixes: c1346a1216ab ("NFSD: Replace the internals of the READ_BUF() macro")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160022.3105295-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 95c8c999f8682b..6f073807bdc298 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2172,10 +2172,8 @@ static __be32
 nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr,
 		       char **bufp, size_t buflen)
 {
-	struct page **pages = xdr->pages;
 	struct kvec *head = xdr->head;
-	char *tmp, *dp;
-	u32 len;
+	char *tmp;
 
 	if (buflen <= head->iov_len) {
 		/*
@@ -2190,19 +2188,8 @@ nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr,
 	if (tmp == NULL)
 		return nfserr_jukebox;
 
-	dp = tmp;
-	memcpy(dp, head->iov_base, head->iov_len);
-	buflen -= head->iov_len;
-	dp += head->iov_len;
-
-	while (buflen > 0) {
-		len = min_t(u32, buflen, PAGE_SIZE);
-		memcpy(dp, page_address(*pages), len);
-
-		buflen -= len;
-		dp += len;
-		pages++;
-	}
+	if (read_bytes_from_xdr_buf(xdr, 0, tmp, buflen))
+		return nfserr_bad_xdr;
 
 	*bufp = tmp;
 	return 0;

From b202a337fddfb81c5d159e66441fb84c7783f537 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Mon, 17 Aug 2026 21:08:36 -0400
Subject: [PATCH 0882/1982] NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients

commit 95ff0c079b9cab91f2327beb4197a3bc48c71f55 upstream.

deleg_reaper() sends CB_RECALL_ANY to every ACTIVE client holding
delegations, but CB_RECALL_ANY is an NFSv4.1 operation. An NFSv4.0
client's callback service accepts only CB_GETATTR and CB_RECALL, so it
replies OP_ILLEGAL. The decoder maps the unexpected opnum to -EIO, and
nfsd4_cb_done() marks the client's callback channel down.

Nothing brings the channel back. nfsd4_run_cb_work() sets NFSD4_CB_UP
only for a minor version above zero, and the only nfsd4_probe_callback()
call site an NFSv4.0 client reaches is nfsd4_setclientid_confirm(). One
visit from the reaper therefore leaves the channel marked down until the
client re-establishes its clientid. RENEW then returns
NFS4ERR_CB_PATH_DOWN for as long as the client holds delegations.
nfsd4_cb_channel_good() stops returning true, so the client is granted
no further delegations.

Skip clients at minor version zero.

Fixes: 44df6f439a17 ("NFSD: add delegation reaper to react to low memory condition")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260817-recall-any-keep-count-v5-1-3b2cffce701e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index e56f072d2e5de5..49cc52fba97d92 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7281,6 +7281,8 @@ deleg_reaper(struct nfsd_net *nn)
 	list_for_each_safe(pos, next, &nn->client_lru) {
 		clp = list_entry(pos, struct nfs4_client, cl_lru);
 
+		if (clp->cl_minorversion == 0)
+			continue;
 		if (clp->cl_state != NFSD4_ACTIVE)
 			continue;
 		if (list_empty(&clp->cl_delegations))

From f6d1f1072243a1adb1ae15425f6e36f86be94078 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 1 Sep 2026 16:19:41 -0400
Subject: [PATCH 0883/1982] NFSD: Don't complete a cld upcall the daemon has
 not read

commit 7f4bf851aca4e18940ebf2bddf4ba6783802ee81 upstream.

cld_pipe_downcall() matches a reply to its upcall on the xid alone.
A write that arrives before the daemon has read that upcall
completes __cld_pipe_upcall() while its struct rpc_pipe_msg is still
queued on the pipe. The waiter returns, its stack frame goes away,
and the pipe keeps a list_head that points into it. The next
rpc_queue_upcall() walks that pointer:

  BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report
  Read of size 8 at addr ffffc90007027950 by task syz.0.96/13066
   __list_add_valid_or_report+0x6a/0x130
   rpc_queue_upcall
   cld_pipe_upcall
   nfsd4_cld_grace_start
   nfsd4_cld_tracking_init

The pipe is mode 0600 in rpc_pipefs, so the trigger is a broken or
hostile nfsdcld rather than an unprivileged task.

Record whether the daemon has consumed the whole message and
complete only when it has. cld_pipe_destroy_msg() runs on every path
by which the pipe releases a message, so it can maintain that flag
under cn_lock. nfsdcld sends its -EINPROGRESS downcalls only after
reading the upcall, so the new check does not break the GraceStart
record stream.

Fixes: f3f8014862d8 ("nfsd: add the infrastructure to handle the cld upcall")
Cc: stable@vger.kernel.org
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://lore.kernel.org/linux-nfs/CA+0ovCjVF58WLeen2ctdzHyWUASAAW3Y=Yjihyq0pFApYawtDg@mail.gmail.com/
Link: https://patch.msgid.link/20260901-alemi-v2-1-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4recover.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index b78b41fbbd4ffb..646e2a934a3f3c 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -709,6 +709,8 @@ struct cld_upcall {
 	struct list_head	 cu_list;
 	struct cld_net		*cu_net;
 	struct completion	 cu_done;
+	/* daemon has read the whole upcall; protected by cn_lock */
+	bool			 cu_inflight;
 	union {
 		struct cld_msg_hdr	 cu_hdr;
 		struct cld_msg		 cu_msg;
@@ -869,6 +871,13 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 	spin_lock(&cn->cn_lock);
 	list_for_each_entry(tmp, &cn->cn_list, cu_list) {
 		if (get_unaligned(&tmp->cu_u.cu_hdr.cm_xid) == xid) {
+			/*
+			 * Completing now would return the waiter
+			 * while its message is still queued on the
+			 * pipe.
+			 */
+			if (!tmp->cu_inflight)
+				break;
 			cup = tmp;
 			if (status != -EINPROGRESS)
 				list_del_init(&cup->cu_list);
@@ -877,9 +886,9 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 	}
 	spin_unlock(&cn->cn_lock);
 
-	/* couldn't find upcall? */
+	/* no upcall to complete? */
 	if (!cup) {
-		dprintk("%s: couldn't find upcall -- xid=%u\n", __func__, xid);
+		dprintk("%s: no completable upcall -- xid=%u\n", __func__, xid);
 		return -EINVAL;
 	}
 
@@ -899,8 +908,16 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 	struct cld_msg *cmsg = msg->data;
 	struct cld_upcall *cup = container_of(cmsg, struct cld_upcall,
 						 cu_u.cu_msg);
+	struct cld_net *cn = cup->cu_net;
+
+	/*
+	 * errno >= 0 means the daemon read the whole message and a
+	 * downcall will complete the upcall.
+	 */
+	spin_lock(&cn->cn_lock);
+	cup->cu_inflight = msg->errno >= 0;
+	spin_unlock(&cn->cn_lock);
 
-	/* errno >= 0 means we got a downcall */
 	if (msg->errno >= 0)
 		return;
 

From 0b5149b7ad8ccd64c61e887e2cf1af068b6210c9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ameer.hamza@truenas.com>
Date: Mon, 24 Aug 2026 22:36:41 +0500
Subject: [PATCH 0884/1982] nfsd: don't modify a session slot when replaying
 its cached reply

commit 2987838317501ff67b672ac2a441fe34b7729f3d upstream.

nfsd4_sequence() claims a session slot by setting NFSD4_SLOT_INUSE
under nn->client_lock. A reply served from the slot's reply cache does
not claim it, and that distinction lived only in cstate->status, which
nfsd4_sequence() set to nfserr_replay_cache. Commit cc028a10a48c
("NFSD: Hoist status code encoding into XDR encoder functions") moved
nfsd4_proc_compound()'s cstate->status assignment below the out:
label, and the replay path's goto out was the one path that relied on
skipping it. The test in nfsd4_sequence_done() therefore no longer
identifies a replay, and every replay now stores its reply and clears
NFSD4_SLOT_INUSE as though it owned the slot.

NFSD4_SLOT_INUSE is the interlock: check_slot_seqid() rejects every
sequence id for a slot that is in use, before replay_matches_cache()
runs. A replay never sets it, so two replays can be in flight on the
same slot at once. One can read slot->sl_cred under nn->client_lock
while the other's completion frees and rebuilds it from the XDR
encoder without that lock. Two completions can also collide with each
other and release the same group_info twice. free_svc_cred() leaves
cr_uid, cr_gid and cr_flavor intact, so the reader passes every
earlier test in same_creds() and dereferences a NULL cr_group_info.
From a 6.12.91 production server:

  BUG: kernel NULL pointer dereference, address: 0000000000000004
  CPU: 63 UID: 0 PID: 39015 Comm: nfsd
  RIP: 0010:same_creds+0x38/0xa0 [nfsd]
  RDX: 0000000000000000
  Call Trace:
   nfsd4_sequence+0x6a8/0x910 [nfsd]
   nfsd4_proc_compound+0x345/0x670 [nfsd]
   nfsd_dispatch+0x100/0x220 [nfsd]
   svc_process_common+0x311/0x700 [sunrpc]
   svc_process+0x131/0x1c0 [sunrpc]
   svc_recv+0x7ef/0x9c0 [sunrpc]
   nfsd+0xa3/0x100 [nfsd]
  Kernel panic - not syncing: Fatal exception

Since v6.14 a live session's slot table can shrink, and the unowned
store becomes a use-after-free write. nfsd4_sequence() defers the
shrink while a slot is in use, but it tests NFSD4_SLOT_INUSE, which a
replay does not set, so free_session_slots() can kfree() the slot the
replay still holds in cstate->slot.

Record the claim in cstate->slot_owned when nfsd4_sequence() accepts a
request and test that in nfsd4_sequence_done(), so only the request
that claimed the slot updates its cached reply and clears
NFSD4_SLOT_INUSE. svc_generic_init_request() zeroes the compound
response before each request, so the flag starts clear.

Fixes: cc028a10a48c ("NFSD: Hoist status code encoding into XDR encoder functions")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260824173641.3274260-1-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 7 ++++++-
 fs/nfsd/xdr4.h      | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 49cc52fba97d92..ebb6a18b410dec 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4661,6 +4661,7 @@ nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
 
 	cstate->slot = slot;
+	cstate->slot_owned = true;
 	cstate->session = session;
 	cstate->clp = clp;
 
@@ -4723,7 +4724,11 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp)
 	struct nfsd4_compound_state *cs = &resp->cstate;
 
 	if (nfsd4_has_session(cs)) {
-		if (cs->status != nfserr_replay_cache) {
+		/*
+		 * Only the request that claimed the slot may update its
+		 * cached reply and clear NFSD4_SLOT_INUSE.
+		 */
+		if (cs->slot_owned) {
 			nfsd4_store_cache_entry(resp);
 			cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
 		}
diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
index d0ef5e7f10778f..0b8f62bc83d712 100644
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -188,6 +188,7 @@ struct nfsd4_compound_state {
 	struct nfsd4_slot	*slot;
 	int			data_offset;
 	bool                    spo_must_allowed;
+	bool			slot_owned;
 	size_t			iovlen;
 	u32			minorversion;
 	__be32			status;

From 36fcebcb656aca84499ff6cb7877ffd5ac6d0dec Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sun, 16 Aug 2026 13:19:14 -0400
Subject: [PATCH 0885/1982] NFSD: Fail a pool_threads read whose reply does not
 fit

commit e27c63245903402ccfdb46c576462981a7e032e3 upstream.

The reply to a pool_threads read is the list of per-pool thread counts,
formatted into a buffer of SIMPLE_TRANSACTION_LIMIT bytes. snprintf()
truncates its last write and strlen() measures only what fit, so a reply
too long for that buffer ends mid-number with no terminating newline. A
pool running 4096 threads is reported as 40. Nothing marks the reply as
incomplete, so an administrator reads a plausible but wrong count.

Take snprintf()'s return value, which reports the truncation strlen()
cannot see, and fail the read with -ENAMETOOLONG when the list does
not fit. That is the errno svc_one_xprt_name() already returns for the
same condition.

Suggested-by: David Laight <david.laight.linux@gmail.com>
Fixes: eed2965af1ba ("[PATCH] knfsd: allow admin to set nthreads per node")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260812193349.13347-1-david.laight.linux@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsctl.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 4d27150b75e41c..ec33b5e4f54648 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -468,7 +468,7 @@ static ssize_t write_pool_threads(struct file *file, char *buf, size_t size)
 	char *mesg = buf;
 	int i;
 	int rv;
-	int len;
+	size_t len;
 	int npools;
 	int *nthreads;
 	struct net *net = netns(file);
@@ -522,9 +522,13 @@ static ssize_t write_pool_threads(struct file *file, char *buf, size_t size)
 
 	mesg = buf;
 	size = SIMPLE_TRANSACTION_LIMIT;
-	for (i = 0; i < npools && size > 0; i++) {
-		snprintf(mesg, size, "%d%c", nthreads[i], (i == npools-1 ? '\n' : ' '));
-		len = strlen(mesg);
+	for (i = 0; i < npools; i++) {
+		len = snprintf(mesg, size, "%d%c", nthreads[i],
+			       (i == npools - 1 ? '\n' : ' '));
+		if (len >= size) {
+			rv = -ENAMETOOLONG;
+			goto out_free;
+		}
 		size -= len;
 		mesg += len;
 	}

From fa5fbc8f5fbd5de34e0dec395d45fa7b66dbf086 Mon Sep 17 00:00:00 2001
From: David Flynn <david.flynn@hammerspace.com>
Date: Tue, 8 Sep 2026 12:34:46 -0400
Subject: [PATCH 0886/1982] nfsd: fetch direct I/O alignment for files handed
 to the filecache

commit ace72c3d263294df7111477caaeff37438aa10af upstream.

nfsd_file_do_acquire() fetches a file's direct I/O alignment
attributes (nf_dio_mem_align, nf_dio_offset_align and
nf_dio_read_offset_align) only on the branch where NFSD opens the
file itself. The other branch, taken when the caller supplies an
already-open struct file, stores that file in the nfsd_file and
leaves the three alignment fields zero.

NFSv4 OPEN with CREATE takes the supplied-file branch:
nfsd4_create_file() creates the file with dentry_create() and passes
the resulting struct file as open->op_filp, which nfs4_get_vfs_file()
hands to nfsd_file_acquire_opened(). The cached nfsd_file therefore
keeps zero alignment for its whole life, and
nfsd_write_dio_iters_init() refuses direct I/O for every WRITE to a
file the client has just created.

Observed on an export whose backing device reports a dio_mem_align of
4: all 16 of 16 1 MiB NFSv4.2 writes that followed an OPEN(CREATE)
took the buffered path, while 16 of 16 writes to the same file
reopened without CREATE went direct.

Hoist the nfsd_file_get_dio_attrs() call out of the open branch so
that it runs once, for both branches, whenever the acquire has
otherwise succeeded. A getattr failure now fails the acquire on the
supplied-file branch exactly as it already does on the open branch.

Fixes: d11f6cd1bb4a ("NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5.1
Signed-off-by: David Flynn <david.flynn@hammerspace.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20260908163448.30841-4-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/filecache.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
index 7c2d7fca4a9efc..49bbac72b49a07 100644
--- a/fs/nfsd/filecache.c
+++ b/fs/nfsd/filecache.c
@@ -1197,9 +1197,9 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net,
 			}
 			status = nfserrno(ret);
 			trace_nfsd_file_open(nf, status);
-			if (status == nfs_ok)
-				status = nfsd_file_get_dio_attrs(fhp, nf);
 		}
+		if (status == nfs_ok)
+			status = nfsd_file_get_dio_attrs(fhp, nf);
 	} else
 		status = nfserr_jukebox;
 	/*

From e48996466d78606890613a950fcddbdaa8fd41e8 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:31:54 +0000
Subject: [PATCH 0887/1982] nfsd: Fix id-to-name cache entry leak in
 idtoname_parse()

commit 8ca3b74c0c447af17d0e27e76658a3d4cae3c5ba upstream.

idtoname_lookup() returns the id-to-name cache entry with a new
reference. The name is parsed between the lookup and the update call,
and when the parsed name is malformed (negative length or longer than
IDMAP_NAMESZ), idtoname_parse() jumps to the error label without
dropping the reference returned by idtoname_lookup(), leaking the cache
entry.

Release the reference with cache_put() before taking the error exit.

Fixes: f9ecc921b5b5 ("[PATCH] knfsd: Use new cache code for name/id lookup caches")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260917163154.2162438-1-vulab@iscas.ac.cn
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4idmap.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index c319c31b0f6476..727bc93a1d3db3 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -252,8 +252,10 @@ idtoname_parse(struct cache_detail *cd, char *buf, int buflen)
 	/* Name */
 	error = -EINVAL;
 	len = qword_get(&buf, buf1, PAGE_SIZE);
-	if (len < 0 || len >= IDMAP_NAMESZ)
+	if (len < 0 || len >= IDMAP_NAMESZ) {
+		cache_put(&res->h, cd);
 		goto out;
+	}
 	if (len == 0)
 		set_bit(CACHE_NEGATIVE, &ent.h.flags);
 	else

From 676b048197cd4b83d63690fc7452a3af9bfd0c43 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Mon, 24 Aug 2026 10:04:40 -0400
Subject: [PATCH 0888/1982] NFSD: Fix out-of-bounds read in the rpc_status dump

commit cbea14890783fead76f878caf0775a62a42049bf upstream.

nfsd_nl_rpc_status_get_dumpit() loads args->opcnt and
args->ops separately, then walks ops[] before rechecking
rq_status_counter. A COMPOUND that completes between the two loads
runs nfsd4_release_compoundargs(), which zeroes opcnt and points ops
back at the eight-entry inline array. A dump that already sampled an
opcnt of 200 clamps it to the sixteen slots in rq_opnum, then indexes
iops[0..15]. iops is the last member of struct nfsd4_compoundargs and
rq_argp is allocated at exactly that size, so the walk runs off the
end of the allocation. The trailing recheck discards the sampled data,
but the read has already happened. NFSD_CMD_RPC_STATUS_GET carries
no GENL_ADMIN_PERM, so an unprivileged local user can repeat the dump
against a busy server until it lands in the window.

Sample opcnt and ops into locals, then finish the counter recheck
before dereferencing ops. An unchanged counter means both came from the
same COMPOUND, where opcnt cannot exceed what ops holds.

Fixes: bd9d6a3efa97 ("NFSD: add rpc_status netlink support")
Cc: stable@vger.kernel.org
Reported-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
Closes: https://lore.kernel.org/linux-nfs/20260823113255.3417-1-prabhakar.pujeri@dell.com/
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260824-nfsd-posix-acl-ownership-v1-1-090fffc608ec@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsctl.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index ec33b5e4f54648..a0c30a10f9bce0 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1576,14 +1576,29 @@ int nfsd_nl_rpc_status_get_dumpit(struct sk_buff *skb,
 			    rqstp->rq_proc == NFSPROC4_COMPOUND) {
 				/* NFSv4 compound */
 				struct nfsd4_compoundargs *args;
+				struct nfsd4_op *ops;
+				u32 opcnt;
 				int j;
 
 				args = rqstp->rq_argp;
-				genl_rqstp.rq_opcnt = min_t(u32, args->opcnt,
+				opcnt = READ_ONCE(args->opcnt);
+				ops = READ_ONCE(args->ops);
+
+				/*
+				 * Finish the seqcount retry before
+				 * dereferencing ops. An unchanged counter means
+				 * opcnt and ops came from the same COMPOUND,
+				 * where opcnt cannot exceed what ops holds.
+				 */
+				smp_rmb();
+				if (READ_ONCE(rqstp->rq_status_counter) !=
+				    status_counter)
+					continue;
+
+				genl_rqstp.rq_opcnt = min_t(u32, opcnt,
 							    ARRAY_SIZE(genl_rqstp.rq_opnum));
 				for (j = 0; j < genl_rqstp.rq_opcnt; j++)
-					genl_rqstp.rq_opnum[j] =
-						args->ops[j].opnum;
+					genl_rqstp.rq_opnum[j] = ops[j].opnum;
 			}
 #endif /* CONFIG_NFSD_V4 */
 

From 540649cb8543472f6edfe9ae8b42c04aa3bd67e9 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft Security FORGE Labs)" <blbllhy@gmail.com>
Date: Fri, 28 Aug 2026 00:19:25 -0400
Subject: [PATCH 0889/1982] nfsd: hold cl_lock in client_has_openowners()

commit 5336899b5491eaa2ac22c2925d87daab2b140eb3 upstream.

client_has_openowners() walks clp->cl_openowners and reads so_stateids
without clp->cl_lock. nfs4_put_stateowner() unhashes that openowner under
cl_lock and then frees it, so a concurrent EXCHANGE_ID with mismatched
creds can use-after-free the nfs4_openowner.

BUG: KASAN: slab-use-after-free in client_has_state+0x10a/0x140
  fs/nfsd/nfs4state.c:3718 client_has_openowners()
  nfsd4_exchange_id
  nfsd4_proc_compound
  nfsd_dispatch
  svc_process

Take clp->cl_lock while client_has_openowners() walks the openowner
list.

Fixes: 4eaea1342507 ("nfsd: improve client_has_state to check for unused openowners")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Cc: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <blbllhy@gmail.com>
Link: https://patch.msgid.link/20260828041925.36758-1-blbllhy@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index ebb6a18b410dec..99a639bd2cd06b 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3759,12 +3759,18 @@ nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
 static bool client_has_openowners(struct nfs4_client *clp)
 {
 	struct nfs4_openowner *oo;
+	bool found = false;
 
+	spin_lock(&clp->cl_lock);
 	list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
-		if (!list_empty(&oo->oo_owner.so_stateids))
-			return true;
+		if (!list_empty(&oo->oo_owner.so_stateids)) {
+			found = true;
+			break;
+		}
 	}
-	return false;
+	spin_unlock(&clp->cl_lock);
+
+	return found;
 }
 
 static bool client_has_state(struct nfs4_client *clp)

From 5733621eee9f20c30865406cbfd2385560bd68a4 Mon Sep 17 00:00:00 2001
From: NeilBrown <neil@brown.name>
Date: Fri, 17 Jul 2026 19:27:49 +1000
Subject: [PATCH 0890/1982] nfsd: honour client-provided attributes for
 NFS4_CREATE_EXCLUSIVE4_1

commit ddfabbc7840891e09cd500ab97c9cd36b650ec24 upstream.

When a file is created with a v4.1 OPEN which requests
NFS4_CREATE_EXCLUSIVE4_1, the request can include attributes to be set.
However when the mtime/atime are set to hold the verifier, the other
ia_valid flags are cleared, so no attributes requested by the client are
used.

This code was originally written for NFSv3 where NFS3_CREATE_EXCLUSIVE
never includes attributes.  When it was updated for v4.1, the fact that an
exclusive create CAN include attributes was not handled properly.

Fixes: ac6721a13e5b ("nfsd41: make sure nfs server process OPEN with EXCLUSIVE4_1 correctly")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260717093001.1972119-2-neilb@ownmail.net
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4proc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 864eebb1f07609..1bf4a84d6a19c9 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -363,8 +363,8 @@ nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
 	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
 		iap->ia_valid &= ~ATTR_SIZE;
 	if (nfsd4_create_is_exclusive(open->op_createmode)) {
-		iap->ia_valid = ATTR_MTIME | ATTR_ATIME |
-				ATTR_MTIME_SET|ATTR_ATIME_SET;
+		iap->ia_valid |= ATTR_MTIME | ATTR_ATIME |
+				 ATTR_MTIME_SET|ATTR_ATIME_SET;
 		iap->ia_mtime.tv_sec = v_mtime;
 		iap->ia_atime.tv_sec = v_atime;
 		iap->ia_mtime.tv_nsec = 0;

From 16ee8e3e0615c23435691a992fd16a1c8a701351 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 15 Sep 2026 20:42:40 -0400
Subject: [PATCH 0891/1982] NFSD: map fh_verify() status codes for NFS_ACLv3
 replies

commit b1eb9f1aea88a0d7ec8116a70c33b7b31ad0a3eb upstream.

The NFS_ACLv3 protocol shares its status code space with NFSv3,
which has NFS3ERR_BADHANDLE but no NFSERR_NOFILEHANDLE. An
NFS_ACLv3 GETACL or SETACL request that carries an empty file
handle gets a reply with status 10020, a value the client cannot
interpret.

Commit 1459ad57673b ("nfsd: Move error code mapping to per-version
proc code.") made fh_verify() return nfserr_nofilehandle for an
empty handle regardless of protocol version. The NFSv3 procedures
gained nfsd3_map_status() in exchange, but the NFS_ACLv3 procedures
did not, so the unmapped status reaches the encoder.

Add the same mapping to the NFS_ACLv3 procedures.

Fixes: 1459ad57673b ("nfsd: Move error code mapping to per-version proc code.")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260916004240.141975-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs3acl.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index a87f9d7f32be26..e704a7ea8eed80 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -13,6 +13,19 @@
 #include "xdr3.h"
 #include "vfs.h"
 
+static __be32 nfsd3_map_status(__be32 status)
+{
+	switch (status) {
+	case nfserr_nofilehandle:
+		status = nfserr_badhandle;
+		break;
+	case nfserr_wrongsec:
+		status = nfserr_acces;
+		break;
+	}
+	return status;
+}
+
 /*
  * NULL call.
  */
@@ -71,6 +84,7 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp)
 
 	/* resp->acl_{access,default} are released in nfs3svc_release_getacl. */
 out:
+	resp->status = nfsd3_map_status(resp->status);
 	return rpc_success;
 
 fail:
@@ -124,6 +138,7 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst *rqstp)
 	resp->status = nfserrno(error);
 out:
 	/* argp->acl_{access,default} are released in nfs3svc_release_setacl. */
+	resp->status = nfsd3_map_status(resp->status);
 	return rpc_success;
 }
 

From 76bb89e8155fe29da36ecf0121e9e98afc0f4184 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Mon, 20 Jul 2026 12:37:24 -0400
Subject: [PATCH 0892/1982] NFSD: Map flex file layout IDs through the
 request's user namespace

commit f913d5d2130a584d1a027ffe3dfd88b6be2e0540 upstream.

nfsd4_ff_proc_layoutget() and nfsd4_ff_encode_layoutget() translate
the file's owner and group with init_user_ns, but every other identity
nfsd places on the wire goes through nfsd_user_namespace(). When the
transport carries a credential from a non-initial user namespace, the
flex file layout reports host-global IDs. The client copies those IDs
into the AUTH_SYS credential it presents to the data server, and
svcauth_unix_accept() resolves that credential in the transport's
namespace, so data server I/O runs under an identity unrelated to the
file's owner.

Switching to the request's namespace introduces a second hazard.
from_kuid() returns (uid_t)-1 when the target namespace has no
mapping for the owner, and the IOMODE_READ arm adds one to that
result to derive an identity for which the data server denies
writes. The addition would wrap to zero, handing the client uid 0
instead of an identity distinct from the owner.

Translate both IDs in nfsd4_ff_proc_layoutget(), which has the
svc_rqst, and carry the wire values in struct pnfs_ff_layout.
from_kuid_munged() substitutes overflowuid for an unmapped owner and
thus never returns (uid_t)-1, so the increment cannot wrap to zero.

Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260720141442.783935-1-cel@kernel.org?part=3
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260720163724.810227-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/flexfilelayout.c    | 20 ++++++++++++--------
 fs/nfsd/flexfilelayoutxdr.c |  4 ++--
 fs/nfsd/flexfilelayoutxdr.h |  5 +++--
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/fs/nfsd/flexfilelayout.c b/fs/nfsd/flexfilelayout.c
index 0f1a35400cd5f1..64b85b9fd9f413 100644
--- a/fs/nfsd/flexfilelayout.c
+++ b/fs/nfsd/flexfilelayout.c
@@ -14,6 +14,7 @@
 #include <linux/sunrpc/addr.h>
 
 #include "flexfilelayoutxdr.h"
+#include "auth.h"
 #include "pnfs.h"
 #include "vfs.h"
 
@@ -23,10 +24,10 @@ static __be32
 nfsd4_ff_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
 		const struct svc_fh *fhp, struct nfsd4_layoutget *args)
 {
+	struct user_namespace *userns = nfsd_user_namespace(rqstp);
 	struct nfsd4_layout_seg *seg = &args->lg_seg;
 	u32 device_generation = 0;
 	int error;
-	uid_t u;
 
 	struct pnfs_ff_layout *fl;
 
@@ -49,13 +50,16 @@ nfsd4_ff_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
 	fl->flags = FF_FLAGS_NO_LAYOUTCOMMIT | FF_FLAGS_NO_IO_THRU_MDS |
 		    FF_FLAGS_NO_READ_IO;
 
-	/* Do not allow a IOMODE_READ segment to have write pemissions */
-	if (seg->iomode == IOMODE_READ) {
-		u = from_kuid(&init_user_ns, inode->i_uid) + 1;
-		fl->uid = make_kuid(&init_user_ns, u);
-	} else
-		fl->uid = inode->i_uid;
-	fl->gid = inode->i_gid;
+	fl->uid = from_kuid_munged(userns, inode->i_uid);
+	fl->gid = from_kgid_munged(userns, inode->i_gid);
+
+	/*
+	 * Do not allow an IOMODE_READ segment to have write permissions.
+	 * The group is left intact so group-readable files stay readable;
+	 * nfsd_setuser() squashes an unmapped uid to the export's anon ID.
+	 */
+	if (seg->iomode == IOMODE_READ)
+		fl->uid++;
 
 	error = nfsd4_set_deviceid(&fl->deviceid, fhp, device_generation);
 	if (error)
diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c
index 374e52d3064a65..b80352f41c0d01 100644
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -32,8 +32,8 @@ nfsd4_ff_encode_layoutget(struct xdr_stream *xdr,
 
 	fh_len = 4 + xdr_align_size(fl->fh.size);
 
-	uid.len = sprintf(uid.buf, "%u", from_kuid(&init_user_ns, fl->uid));
-	gid.len = sprintf(gid.buf, "%u", from_kgid(&init_user_ns, fl->gid));
+	uid.len = sprintf(uid.buf, "%u", fl->uid);
+	gid.len = sprintf(gid.buf, "%u", fl->gid);
 
 	/* data server entry: deviceid + efficiency + stateid + fh list +
 	 * user + group + flags + stats_collect_hint
diff --git a/fs/nfsd/flexfilelayoutxdr.h b/fs/nfsd/flexfilelayoutxdr.h
index 6d5a1066a903c1..3e1876d49db234 100644
--- a/fs/nfsd/flexfilelayoutxdr.h
+++ b/fs/nfsd/flexfilelayoutxdr.h
@@ -35,8 +35,9 @@ struct pnfs_ff_device_addr {
 struct pnfs_ff_layout {
 	u32				flags;
 	u32				stats_collect_hint;
-	kuid_t				uid;
-	kgid_t				gid;
+	/* Values to encode; nfsd4_ff_proc_layoutget() has mapped these */
+	u32				uid;
+	u32				gid;
 	struct nfsd4_deviceid		deviceid;
 	stateid_t			stateid;
 	struct nfs_fh			fh;

From 37fc2ec211630360e9aefcaaec8730db964645f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Mon, 17 Aug 2026 20:57:14 -0400
Subject: [PATCH 0893/1982] nfsd: preflight SEQUENCE replies before accepting a
 slot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 35ff1a7a7e3835c3e974bc5c45d335897564ceae upstream.

nfsd4_sequence() narrows the reply buffer to the session's cached
reply limit before it accepts the slot seqid. A client may negotiate
ca_maxresponsesize_cached down to NFSD_MIN_HDR_SEQ_SZ, and
nfsd4_alloc_slot() then gives every slot a zero-length sl_data[]. A
COMPOUND tag can fill that narrowed buffer until it holds the
SEQUENCE opcode but not the status word that follows.
nfsd4_encode_operation() returns without running
nfsd4_encode_sequence(), so cstate.data_offset stays zero. It leaves
op->status at nfs_ok as well, so the COMPOUND is treated as having
succeeded.

nfsd4_store_cache_entry() declines to cache a lone SEQUENCE that
returned an error. That test reads the status the operation
reported, so it passes here. The copy starts at offset zero and
takes the whole reply, RPC and COMPOUND headers included, into the
zero-length sl_data[]. The COMPOUND tag is copied along with it, so
the client picks most of the bytes written past the end of the slot:

  BUG: KASAN: slab-out-of-bounds in read_bytes_from_xdr_buf+0x1bc/0x390
  Write of size 80 at addr ffff888003a549cd by task kunit_try_catch/24
   __asan_memcpy+0x38/0x60
   read_bytes_from_xdr_buf+0x1bc/0x390
   nfsd4_sequence_done+0x5b0/0x810
   nfs4svc_encode_compoundres+0x1bf/0x240

Check that the fixed-size SEQUENCE result, plus room for a following
operation's error status, fits the negotiated limit before narrowing
the buffer and consuming the slot seqid. The slot and its reply
cache are left unchanged, as RFC 8881 Section 2.10.6.1.2 requires of
an error returned from SEQUENCE.

Fixes: 47ee52986472 ("nfsd4: adjust buflen to session channel limit")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Tested-by: Mayank Jangid (OpenSec Intelligence) <mayank.jangid.moon@gmail.com>
Link: https://patch.msgid.link/20260817-jean-v1-1-9e356596ab85@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 99a639bd2cd06b..42035bfebda7af 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4565,6 +4565,7 @@ __be32
 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		union nfsd4_op_u *u)
 {
+	struct nfsd4_compoundargs *args = rqstp->rq_argp;
 	struct nfsd4_sequence *seq = &u->sequence;
 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
 	struct xdr_stream *xdr = resp->xdr;
@@ -4574,6 +4575,7 @@ nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 	struct nfsd4_conn *conn;
 	__be32 status;
 	int buflen;
+	u32 maxlen, respsize;
 	struct net *net = SVC_NET(rqstp);
 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 
@@ -4651,7 +4653,22 @@ nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 			session->se_fchannel.maxresp_sz;
 	status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
 				    nfserr_rep_too_big;
-	if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
+	if (buflen < rqstp->rq_auth_slack)
+		goto out_put_session;
+	maxlen = buflen - rqstp->rq_auth_slack;
+
+	/*
+	 * A SEQUENCE result too large for maxlen never reaches
+	 * nfsd4_encode_sequence(), so cstate.data_offset stays zero and
+	 * the reply cache overruns the slot.
+	 */
+	respsize = nfsd4_max_reply(rqstp, &args->ops[0]);
+	if (!nfsd4_last_compound_op(rqstp))
+		respsize += COMPOUND_ERR_SLACK_SPACE;
+	if (xdr->buf->len + respsize > maxlen)
+		goto out_put_session;
+
+	if (xdr_restrict_buflen(xdr, maxlen))
 		goto out_put_session;
 	svc_reserve_auth(rqstp, buflen);
 

From 7d464c3e93214a8d1fcbd226f5d622993232bbb3 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Tue, 15 Sep 2026 09:56:36 -0300
Subject: [PATCH 0894/1982] nfsd: propagate SETXATTR value decode errors

commit cfcfe0b38a66bbc4122c78a2b75e1b97b3534761 upstream.

nfsd4_decode_setxattr() stores the status returned while assembling a
non-empty attribute value, but then unconditionally returns nfs_ok. An
allocation failure can therefore leave a NULL value buffer paired with a
non-zero length and allow compound processing to continue.

Return the decoder status so that the operation stops on the original
error.

Fixes: 23e50fe3a5e6 ("nfsd: implement the xattr functions and en/decode logic")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915125636.2849626-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 6f073807bdc298..c9fd616b34de38 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2306,7 +2306,7 @@ nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
 						&setxattr->setxa_buf, size);
 	}
 
-	return nfs_ok;
+	return status;
 }
 
 static __be32

From af501c516757bc9a6b9aefe4ad28428a764f6878 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 1 Sep 2026 16:19:44 -0400
Subject: [PATCH 0895/1982] NFSD: Reject an oversized principal hash from
 nfsdcld

commit dbed9418c48906dae1a7bc328fb3bc0d0d0020c8 upstream.

__cld_pipe_inprogress_downcall() takes the principal hash length
from the daemon's GraceStart downcall without checking it against
the cc_princhash payload it describes, which holds at most
SHA256_DIGEST_SIZE bytes. The length is stored verbatim in the
reclaim record, and nfsd4_cld_check_v2() later hands it to memcmp()
against a digest array of SHA256_DIGEST_SIZE bytes on the stack. A
length up to U8_MAX reads past the end of that array, and the stray
bytes can only make the comparison fail, denying the client its
reclaim. The pipe is mode 0600 in rpc_pipefs, so the trigger is a
broken or hostile nfsdcld rather than an unprivileged task.

Reject a length larger than the wire field, as the existing check
on the client name length does.

Fixes: 6ee95d1c8991 ("nfsd: add support for upcall version 2")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-4-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4recover.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 646e2a934a3f3c..b84c837868c715 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -790,6 +790,11 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 			name.len = namelen;
 			if (get_user(princhashlen, &ci->cc_princhash.cp_len))
 				return -EFAULT;
+			if (princhashlen > SHA256_DIGEST_SIZE) {
+				dprintk("%s: invalid princhashlen (%u)",
+					__func__, princhashlen);
+				return -EINVAL;
+			}
 			if (princhashlen > 0) {
 				princhashcopy = memdup_user(
 					&ci->cc_princhash.cp_data,

From ea993a4e9ad93dc8208c356e5f4994428de4cdb8 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 18 Aug 2026 14:41:51 -0400
Subject: [PATCH 0896/1982] NFSD: Resolve the recall-any mask names in the
 trace format

commit c563a1f0679566d7d586802e5346591d0af8da78 upstream.

RCA4_TYPE_MASK_* are enum constants, so the preprocessor cannot fold
them into the print format that show_rca_mask() builds for the
nfsd_cb_recall_any event. Nothing declares an eval map for them
either, so trace_event_eval_update() has no substitution to apply at
module load, and the event's format file ships the enumerator names
verbatim. trace-cmd and perf cannot decode the bmval0 field.

Declare the eval maps for the nine mask bits show_rca_mask() decodes.
The format then carries the shift counts as integers, the same shape
the SUNRPC trace points already emit from their BIT() flag decoders.

Fixes: 638593be55c0 ("NFSD: add CB_RECALL_ANY tracepoints")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260818184151.31180-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/misc/nfs.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/trace/misc/nfs.h b/include/trace/misc/nfs.h
index a394b4d38e18fa..f796db58c5a266 100644
--- a/include/trace/misc/nfs.h
+++ b/include/trace/misc/nfs.h
@@ -358,6 +358,16 @@ TRACE_DEFINE_ENUM(IOMODE_ANY);
 		{ IOMODE_RW,			"RW" }, \
 		{ IOMODE_ANY,			"ANY" })
 
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_RDATA_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_WDATA_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_DIR_DLG);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_FILE_LAYOUT);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_BLK_LAYOUT);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OBJ_LAYOUT_MIN);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OBJ_LAYOUT_MAX);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OTHER_LAYOUT_MIN);
+TRACE_DEFINE_ENUM(RCA4_TYPE_MASK_OTHER_LAYOUT_MAX);
+
 #define show_rca_mask(x) \
 	__print_flags(x, "|", \
 		{ BIT(RCA4_TYPE_MASK_RDATA_DLG),	"RDATA_DLG" }, \

From f4d884c878991bceb8a8e7a6f9d18667fe381e3d Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Fri, 28 Aug 2026 19:18:41 -0400
Subject: [PATCH 0897/1982] NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE
 on a non-regular file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 07649099cc8c449ea8d37d0e8d6b532fecb24bf8 upstream.

Commit 0ac903d1bfdc ("NFS: NFSERR_INVAL is not defined by NFSv2")
changed the status NFSD returns for an NFSv2 READ or WRITE of a
symlink or other non-regular file from NFSERR_INVAL to NFSERR_IO.
RFC 1094 defines neither an INVAL nor a SYMLINK status.

U-Boot's NFS client follows a symlink only when READ fails with
NFSERR_ISDIR or NFSERR_INVAL. Since that commit it cannot load a
boot image through a symlink exported by a Linux NFS server: the
load completes with zero bytes transferred.

Solaris returns NFSERR_ISDIR when the target of an NFSv2 READ or
WRITE is not a regular file. Return the same status from NFSD.
Other NFSv2 procedures continue to return NFSERR_IO.

Fixes: 0ac903d1bfdc ("NFS: NFSERR_INVAL is not defined by NFSv2")
Cc: stable@vger.kernel.org
Reported-by: Jörg Sommer <joerg@jo-so.de>
Closes: https://lore.kernel.org/linux-nfs/apE90ZRZB8IW_AiS@jo-so.de/
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260828231841.282003-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsproc.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 35f409b6555230..c561d7014b49f2 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -39,6 +39,21 @@ static __be32 nfsd_map_status(__be32 status)
 	return status;
 }
 
+/*
+ * Because NFSv2 does not have an NFSERR_SYMLINK, Solaris returns
+ * NFSERR_ISDIR when the target of a READ or WRITE is any object
+ * that is not a regular file.
+ */
+static __be32 nfsd_map_io_status(__be32 status)
+{
+	switch (status) {
+	case nfserr_symlink:
+	case nfserr_wrong_type:
+		return nfserr_isdir;
+	}
+	return nfsd_map_status(status);
+}
+
 static __be32
 nfsd_proc_null(struct svc_rqst *rqstp)
 {
@@ -237,7 +252,7 @@ nfsd_proc_read(struct svc_rqst *rqstp)
 		resp->status = fh_getattr(&resp->fh, &resp->stat);
 	else if (resp->status == nfserr_jukebox)
 		set_bit(RQ_DROPME, &rqstp->rq_flags);
-	resp->status = nfsd_map_status(resp->status);
+	resp->status = nfsd_map_io_status(resp->status);
 	return rpc_success;
 }
 
@@ -270,7 +285,7 @@ nfsd_proc_write(struct svc_rqst *rqstp)
 		resp->status = fh_getattr(&resp->fh, &resp->stat);
 	else if (resp->status == nfserr_jukebox)
 		set_bit(RQ_DROPME, &rqstp->rq_flags);
-	resp->status = nfsd_map_status(resp->status);
+	resp->status = nfsd_map_io_status(resp->status);
 	return rpc_success;
 }
 

From c12f04f29dac29fba1f4eafe54455d48b4ca8df0 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Tue, 1 Sep 2026 16:19:46 -0400
Subject: [PATCH 0898/1982] NFSD: Set nn->cld_net before registering the cld
 pipe

commit 14996e662f3b734427e2d645cacffc27b779f7d1 upstream.

rpc_mkpipe_dentry() instantiates the pipe's dentry before it returns,
so the cld pipe can be opened as soon as nfsd4_cld_register_net() has
run. __nfsd4_init_cld_pipe() does not store the new cld_net in
nn->cld_net until after that call. cld_pipe_downcall() reaches the
cld_net only through that pointer and takes cn_lock without checking
it, so a write() that lands in the window oopses.

Store nn->cld_net once @cn is fully initialized and before the pipe is
registered, and clear it again when registration fails.

Fixes: f3f8014862d8 ("nfsd: add the infrastructure to handle the cld upcall")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260901-alemi-v2-6-e163f94a3a6e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4recover.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index b84c837868c715..d04a7d3aabbc8d 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -999,18 +999,24 @@ __nfsd4_init_cld_pipe(struct net *net)
 	}
 	spin_lock_init(&cn->cn_lock);
 	INIT_LIST_HEAD(&cn->cn_list);
+#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
+	cn->cn_has_legacy = false;
+#endif
+
+	/*
+	 * The pipe's methods reach @cn through nn->cld_net, so set
+	 * it before the pipe can be opened.
+	 */
+	nn->cld_net = cn;
 
 	ret = nfsd4_cld_register_net(net, cn->cn_pipe);
 	if (unlikely(ret))
 		goto err_destroy_data;
 
-#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
-	cn->cn_has_legacy = false;
-#endif
-	nn->cld_net = cn;
 	return 0;
 
 err_destroy_data:
+	nn->cld_net = NULL;
 	rpc_destroy_pipe_data(cn->cn_pipe);
 err:
 	kfree(cn);

From f5a336ad931afdd609c809cea4b3d910e781bd6f Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Tue, 1 Sep 2026 09:39:40 -0400
Subject: [PATCH 0899/1982] NFSD: validate transport name in listener_set
 before serv creation

commit 421becdc5cf4d7d2fbda393e78ca76d25d277c0f upstream.

nfsd_nl_listener_set_doit() holds nfsd_mutex for the whole listener
teardown and rebuild. The code checks NFSD_A_SOCK_TRANSPORT_NAME for
presence only, and not for content. An arbitrary name therefore reaches
svc_xprt_create_from_sa(). There, a name that matches no registered class
calls request_module("svc%s", name). That call is a TASK_KILLABLE usermode
helper upcall, and it runs under nfsd_mutex.

Check the name against the classes that NFSD can create: tcp, udp and
rdma. The check goes in nfsd_nl_validate_listeners(), which runs before
the code takes nfsd_mutex. The rejection names the offending attribute
through extack, since -EPROTONOSUPPORT on its own does not say which
entry carried the bad name.

This narrows the upcall. It does not remove it. NFSD accepts "rdma"
without a condition, so on a kernel that does not build svcrdma the name
still reaches request_module("svcrdma") under nfsd_mutex. That is
necessary for the modular case, where the autoload is legitimate.

Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Link: https://syzkaller.appspot.com/bug?extid=c7eae0eb80858a2dba0f
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-2-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsctl.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index a0c30a10f9bce0..967c5bf30d0519 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1932,6 +1932,23 @@ int nfsd_nl_version_get_doit(struct sk_buff *skb, struct genl_info *info)
 	return err;
 }
 
+/*
+ * Transport classes NFSD knows how to instantiate. Vetting the name here
+ * keeps a bogus string from reaching svc_xprt_create_from_sa(), where an
+ * unknown name triggers a request_module("svc%s", name) upcall under
+ * nfsd_mutex.
+ */
+static bool nfsd_nl_transport_supported(const char *name)
+{
+	static const char * const supported[] = { "tcp", "udp", "rdma" };
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(supported); i++)
+		if (!strcmp(name, supported[i]))
+			return true;
+	return false;
+}
+
 /* Upper bound on the number of listeners a single request may carry. */
 #define NFSD_NL_LISTENER_MAX	1024
 
@@ -1969,6 +1986,13 @@ static int nfsd_nl_validate_listeners(struct genl_info *info)
 		if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
 			return -EINVAL;
 
+		if (!nfsd_nl_transport_supported(nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]))) {
+			NL_SET_ERR_MSG_ATTR(info->extack,
+					    tb[NFSD_A_SOCK_TRANSPORT_NAME],
+					    "unsupported transport name");
+			return -EPROTONOSUPPORT;
+		}
+
 		sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
 		if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(sa->sa_family))
 			return -EINVAL;

From c1e38828c93e5fc958a3d6155c5703d6e7b3de8e Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Tue, 15 Sep 2026 13:00:49 -0300
Subject: [PATCH 0900/1982] nfsd: zero NFSv4 COMPOUND tag padding

commit 3f1181cb09c85499286c7f462d93530b0ebcafcc upstream.

nfs4svc_encode_compoundres() copies the tag bytes into reserved XDR space
and skips directly to the aligned end of the field. xdr_reserve_space()
rounds the reservation up but does not initialize the padding bytes.

A remote client can choose a tag length that is not a multiple of four,
causing one to three stale bytes from the response page to be returned in
the COMPOUND reply.

Use xdr_encode_opaque_fixed() to copy the tag and clear its XDR padding.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915160049.3105481-1-qwe.aldo@gmail.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index c9fd616b34de38..2fe4767dca5b5c 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -6051,8 +6051,7 @@ nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
 
 	*p++ = resp->cstate.status;
 	*p++ = htonl(resp->taglen);
-	memcpy(p, resp->tag, resp->taglen);
-	p += XDR_QUADLEN(resp->taglen);
+	p = xdr_encode_opaque_fixed(p, resp->tag, resp->taglen);
 	*p++ = htonl(resp->opcnt);
 
 	nfsd4_sequence_done(resp);

From d514dd81771aff1192e84a57ae60428c13f07ccb Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Wed, 2 Sep 2026 09:31:01 -0400
Subject: [PATCH 0901/1982] SUNRPC: Copy the deferred RPC Call from the head
 buffer

commit 2192a56b0686599358909c3e12e9a366f5b5d452 upstream.

svc_defer() snapshots the RPC Call for replay once a pending cache
upcall resolves. It copies the Call starting (rq_arg.len -
head[0].iov_len) bytes before head[0].iov_base, a back-up that once
covered a transport header. No transport has had one since commit
983084b2672c ("SUNRPC: Remove svc_rqst::rq_xprt_hlen"), so the two
lengths are meant to be equal.

An RPCSEC_GSS Call breaks that assumption. Unwrapping the integrity
service truncates rq_arg.len by the length of the trailing checksum,
and unwrapping the privacy service leaves rq_arg.len short by an
amount the client sets with trailing bytes after the wrap token.
Neither adjusts head[0].iov_len. Both lengths are size_t, so the
subtraction underflows and the copy starts past head[0].iov_base.
Every deferred integrity Call replays a shifted snapshot.

A deferred replay skips GSS verification, so a shifted snapshot runs
as an authenticated Call. With the privacy service the offset is
client-chosen. A forged Call placed in that window, naming another
user's GSS context handle, runs under that identity.

Copy the Call from head[0].iov_base. Refuse to defer a Call whose
length runs past the head buffer, so the copy cannot read out of
bounds.

Fixes: 260c1d1298f6 ("svc: Add transport hdr size for defer/revisit")
Cc: stable@vger.kernel.org
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Reported-by: Yilin Zhang <yilinzhang@moonshot.ai>
Link: https://patch.msgid.link/20260902133101.48914-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svc_xprt.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 6973184ff66752..34f97009e85696 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1173,13 +1173,8 @@ static void svc_revisit(struct cache_deferred_req *dreq, int too_many)
 }
 
 /*
- * Save the request off for later processing. The request buffer looks
- * like this:
- *
- * <xprt-header><rpc-header><rpc-pagelist><rpc-tail>
- *
- * This code can only handle requests that consist of an xprt-header
- * and rpc-header.
+ * Save the request off for later processing. Only a Call that fits
+ * entirely in rq_arg.head[0] can be deferred.
  */
 static struct cache_deferred_req *svc_defer(struct cache_req *req)
 {
@@ -1192,8 +1187,11 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
 		dr = rqstp->rq_deferred;
 		rqstp->rq_deferred = NULL;
 	} else {
-		size_t skip;
 		size_t size;
+
+		if (rqstp->rq_arg.len > rqstp->rq_arg.head[0].iov_len)
+			return NULL;
+
 		/* FIXME maybe discard if size too large */
 		size = sizeof(struct svc_deferred_req) + rqstp->rq_arg.len;
 		dr = kmalloc(size, GFP_KERNEL);
@@ -1207,9 +1205,7 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
 		dr->daddr = rqstp->rq_daddr;
 		dr->argslen = rqstp->rq_arg.len >> 2;
 
-		/* back up head to the start of the buffer and copy */
-		skip = rqstp->rq_arg.len - rqstp->rq_arg.head[0].iov_len;
-		memcpy(dr->args, rqstp->rq_arg.head[0].iov_base - skip,
+		memcpy(dr->args, rqstp->rq_arg.head[0].iov_base,
 		       dr->argslen << 2);
 	}
 	dr->xprt_ctxt = rqstp->rq_xprt_ctxt;
@@ -1232,17 +1228,13 @@ static noinline int svc_deferred_recv(struct svc_rqst *rqstp)
 
 	trace_svc_defer_recv(dr);
 
-	/* setup iov_base past transport header */
 	rqstp->rq_arg.head[0].iov_base = dr->args;
-	/* The iov_len does not include the transport header bytes */
 	rqstp->rq_arg.head[0].iov_len = dr->argslen << 2;
 	rqstp->rq_arg.page_len = 0;
-	/* The rq_arg.len includes the transport header bytes */
 	rqstp->rq_arg.len     = dr->argslen << 2;
 	rqstp->rq_prot        = dr->prot;
 	memcpy(&rqstp->rq_addr, &dr->addr, dr->addrlen);
 	rqstp->rq_addrlen     = dr->addrlen;
-	/* Save off transport header len in case we get deferred again */
 	rqstp->rq_daddr       = dr->daddr;
 	rqstp->rq_respages    = rqstp->rq_pages;
 	rqstp->rq_xprt_ctxt   = dr->xprt_ctxt;

From 67d36b376f76a71e52a5f8ed4a4d9d90b8b68133 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 8 Aug 2026 11:40:09 -0400
Subject: [PATCH 0902/1982] SUNRPC: Do not credit control-record octets to the
 RPC stream

commit 129e7107b971009bc81643d23f3ab949f540d321 upstream.

svc_tcp_sock_recv_cmsg() receives up to two octets into a local
buffer, and returns that count for any record type other than
TLS_RECORD_TYPE_ALERT. Nothing reached the caller's buffer, but
svc_tcp_read_marker() adds the count to sk_tcplen and
svc_tcp_read_msg()'s caller adds it to sk_datalen. The RPC stream
advances over octets it never received. The fragment marker is
assembled from stale sk_marker octets. The message body comes from
pages nothing wrote.

A conforming client reaches this. RFC 8446 Section 4.6.3 lets either
peer send KeyUpdate once it has sent its Finished, and svcsock has no
rekey path. kTLS leaves the partially consumed record on ctx->rx_list,
so the body drains two octets per svc_tcp_recvfrom() call. Each pair
is credited the same way.

Return -EAGAIN for a record that is not an alert. That is what
svc_tcp_sock_process_cmsg()'s default arm returned before the receive
moved into a local buffer.

Fixes: bee47cb026e7 ("sunrpc: fix handling of server side tls alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-1-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcsock.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0ed8d563747144..7c270f12c0a97b 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -289,8 +289,13 @@ svc_tcp_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags)
 	iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1,
 		      alert_kvec.iov_len);
 	ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT);
-	if (ret > 0 &&
-	    tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) {
+	if (ret > 0) {
+		/* Returning the count would credit the RPC stream with
+		 * octets that never reached the caller's buffer.
+		 */
+		if (tls_get_record_type(sock->sk, &u.cmsg) !=
+		    TLS_RECORD_TYPE_ALERT)
+			return -EAGAIN;
 		iov_iter_revert(&msg.msg_iter, ret);
 		ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN);
 	}

From 1cc4b3089eabec479b9cce2d6999ab2263d7def2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Thu, 10 Sep 2026 12:51:20 +0000
Subject: [PATCH 0903/1982] SUNRPC: fix oversized GSS proxy token copy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 62319c2534b603b416fa2aa2f3ef18c311f75010 upstream.

gss_read_proxy_verf() allocates one page per token chunk, but it copies the
entire linear head of an RPC request into in_token->pages[0]. A UDP datagram
can leave more than PAGE_SIZE bytes in the linear head, so a large
RPCSEC_GSS INIT token overwrites following pages.

Copy the linear head in page-sized chunks before switching to the request
page array. The linear head itself can span multiple pages.

Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Assisted-by: Codex:gpt-5
Link: https://patch.msgid.link/20260910125120.3798995-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index c595272eee6ae7..159e1c9c1aa7e3 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1085,10 +1085,11 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
 	}
 
 	length = min_t(unsigned int, inlen, (char *)xdr->end - (char *)xdr->p);
-	if (length)
-		memcpy(page_address(in_token->pages[0]), xdr->p, length);
+	for (to_offs = 0; to_offs < length; to_offs += PAGE_SIZE)
+		memcpy(page_address(in_token->pages[to_offs >> PAGE_SHIFT]),
+		       (char *)xdr->p + to_offs,
+		       min_t(unsigned int, length - to_offs, PAGE_SIZE));
 	inlen -= length;
-
 	to_offs = length;
 	from_offs = rqstp->rq_arg.page_base;
 	while (inlen) {

From c5862ac50d8d057f9922bac001dd0e81d78721b1 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Tue, 1 Sep 2026 09:39:41 -0400
Subject: [PATCH 0904/1982] SUNRPC: keep the first error in svc_register()

commit 9ed91d7c4698e611ea5bfca45076008def831fb3 upstream.

svc_register() assigns every pg_rpcbind_set() result to the same "error"
variable and returns the last one, so a later result erases an earlier
failure.

Keep the first error instead of the last.

Fixes: 642ee6b209c2 ("SUNRPC: Allow further customisation of RPC program registration")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260901-nfsd-nl-hang-v5-3-a540d86668b0@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 1c7410488236e5..61c3c3a743289e 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1236,13 +1236,16 @@ int svc_register(const struct svc_serv *serv, struct net *net,
 		struct svc_program *progp = &serv->sv_programs[p];
 
 		for (i = 0; i < progp->pg_nvers; i++) {
+			int ret;
 
-			error = progp->pg_rpcbind_set(net, progp, i,
+			ret = progp->pg_rpcbind_set(net, progp, i,
 					family, proto, port);
-			if (error < 0) {
+			if (ret < 0) {
 				printk(KERN_WARNING "svc: failed to register "
 					"%sv%u RPC service (errno %d).\n",
-					progp->pg_name, i, -error);
+					progp->pg_name, i, -ret);
+				if (!error)
+					error = ret;
 				break;
 			}
 		}

From f735700c06303335067a49ad4ad8f0b60eb43897 Mon Sep 17 00:00:00 2001
From: Chris Mason <clm@meta.com>
Date: Sun, 13 Sep 2026 12:07:06 -0400
Subject: [PATCH 0905/1982] sunrpc: pin gss module across auth_domain RCU free

commit b64d21116374688c33302a6704387c27d1156d72 upstream.

A gss auth_domain stores a raw pointer to svcauthops_gss in
dom->flavour, and its release queues svcauth_gss_domain_release_rcu()
via call_rcu(). Both live in auth_rpcgss.ko text, and nothing pins the
module while a domain referencing it is reachable. rmmod auth_rpcgss
can therefore unmap that text while an NFSD export still holds a
reference to the domain.

The export cache is one such holder. When the export is finally
released, the domain reference drops from module text:

    svc_export_put()
      auth_domain_put(exp->ex_client)
        auth_domain_release()
          dom->flavour->domain_release(dom)   /* into module text */
            svcauth_gss_domain_release()
              call_rcu(&dom->rcu_head,
                       svcauth_gss_domain_release_rcu)

Once auth_rpcgss is unloaded, the domain_release call lands in
unmapped memory. The rcu_barrier() in exit_rpcsec_gss() does not
help: it waits only for callbacks already queued, and this one is
not queued until the export goes away.

NFSD's NFSv4 objects import symbols from auth_rpcgss.ko, so only a
server built without CONFIG_NFSD_V4 can unload auth_rpcgss while
exports still name a gss domain.

Take a module reference in svcauth_gss_register_pseudoflavor() before
publishing the domain and drop it at the end of
svcauth_gss_domain_release_rcu(). The rcu_barrier() then holds the
module image until this callback has returned.

Fixes: 608a0ab2f54a ("SUNRPC: Add lockless lookup of the server's auth domain")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
[ cel: rewrote description ]
Link: https://patch.msgid.link/20260913160706.384180-1-cel@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 159e1c9c1aa7e3..9944bc14c761f6 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -824,12 +824,18 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
 	new->h.flavour = &svcauthops_gss;
 	new->pseudoflavor = pseudoflavor;
 
+	if (!try_module_get(svcauthops_gss.owner)) {
+		stat = -ENODEV;
+		goto out_free_name;
+	}
+
 	test = auth_domain_lookup(name, &new->h);
 	if (test != &new->h) {
 		pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n",
 			name);
 		stat = -EADDRINUSE;
 		auth_domain_put(test);
+		module_put(svcauthops_gss.owner);
 		goto out_free_name;
 	}
 	return test;
@@ -2004,9 +2010,11 @@ svcauth_gss_domain_release_rcu(struct rcu_head *head)
 {
 	struct auth_domain *dom = container_of(head, struct auth_domain, rcu_head);
 	struct gss_domain *gd = container_of(dom, struct gss_domain, h);
+	struct module *owner = dom->flavour->owner;
 
 	kfree(dom->name);
 	kfree(gd);
+	module_put(owner);
 }
 
 static void

From f44daa50489fede01012c575d9f5e7b11a212fe4 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 15 Aug 2026 12:28:44 -0400
Subject: [PATCH 0906/1982] SUNRPC: Reject a socket that already has an
 svc_sock attached

commit 0995447b8059c4d23853cdcddbe789c4a2b6bb88 upstream.

Writing the same socket descriptor to /proc/fs/nfsd/portlist twice
attaches a second svc_sock to one socket. svc_setup_socket() saves
the socket's callbacks before installing its own, so the second
attach records svc_write_space() as the old write_space callback.
svc_udp_init() invokes that callback by way of svc_sock_setbufsize(),
and svc_write_space() then calls itself until the kernel stack is
exhausted:

  BUG: TASK stack guard page was hit at ffffc900037d7ff8
   svc_write_space+0x90/0x2b0 net/sunrpc/svcsock.c:429
   svc_write_space+0xe6/0x2b0 net/sunrpc/svcsock.c:430
   ... 700 more ...
   svc_sock_setbufsize+0x18d/0x220 net/sunrpc/svcsock.c:386
   svc_udp_init net/sunrpc/svcsock.c:854 [inline]
   svc_setup_socket+0xb2f/0x1090 net/sunrpc/svcsock.c:1498
   svc_addsock+0x2fd/0x760 net/sunrpc/svcsock.c:1547
   __write_ports_addfd fs/nfsd/nfsctl.c:742 [inline]
   write_ports+0xa5b/0xcc0 fs/nfsd/nfsctl.c:861
   nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:112

svc_data_ready() and svc_tcp_state_change() chain through their saved
callbacks the same way, so a TCP descriptor added twice recurses on
the next incoming segment instead. Reaching any of this takes a
writer on portlist, and the nfsd filesystem sets no FS_USERNS_MOUNT,
so the reproducer needs CAP_SYS_ADMIN in the initial user namespace.

Reject a socket that already carries sk_user_data. svc_setup_socket()
overwrites that field unconditionally, so a socket some other
consumer has claimed is one NFSD would corrupt whether or not the
callbacks recurse.

Fixes: b41b66d63c73 ("[PATCH] knfsd: allow sockets to be passed to nfsd via 'portlist'")
Cc: stable@vger.kernel.org
Reported-by: syzbot+54cdc566f64abf51b7f1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=54cdc566f64abf51b7f1
Link: https://patch.msgid.link/20260815162844.8219-1-cel@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcsock.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 7c270f12c0a97b..ceb4d504409f46 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1550,6 +1550,9 @@ int svc_addsock(struct svc_serv *serv, struct net *net, const int fd,
 	err = -EISCONN;
 	if (so->state > SS_UNCONNECTED)
 		goto out;
+	err = -EBUSY;
+	if (so->sk->sk_user_data)
+		goto out;
 	err = -ENOENT;
 	if (!try_module_get(THIS_MODULE))
 		goto out;

From 560956c8d2479bbf3a215b94391d9ada2063206e Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 8 Aug 2026 11:40:10 -0400
Subject: [PATCH 0907/1982] SUNRPC: Reject a TLS alert record that is not two
 octets

commit d16bebe45272ced4f962d27b9efd8b32a3876bd9 upstream.

tls_alert_recv() reads two octets from the kvec it is handed and does
not check the length (net/handshake/alert.c). svc_tcp_sock_recv_cmsg()
calls it for any positive receive, and the alert[] buffer it supplies
carries no initializer. A one-octet alert body leaves the description
read from uninitialized stack and reported through
trace_tls_alert_recv().

The peer controls that length. Neither tls_rx_msg_size() nor
tls_rx_one_record() enforces the two-octet Alert payload. A TLS 1.3
record carrying only the inner content-type octet decrypts to a
zero-length payload. RFC 8446 Section 5.1 requires a record with an
Alert type to carry exactly one message, so any other length is
malformed.

Require exactly two octets before parsing and return -EBADMSG
otherwise. That closes the transport rather than acting on a partly
uninitialized alert. Gate the path on a control message rather than a
positive count so that a zero-length record reaches the check.

Fixes: bee47cb026e7 ("sunrpc: fix handling of server side tls alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-2-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcsock.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index ceb4d504409f46..51031450062f24 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -289,13 +289,23 @@ svc_tcp_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags)
 	iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1,
 		      alert_kvec.iov_len);
 	ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT);
-	if (ret > 0) {
+	/* put_cmsg() shrinks msg_controllen, so a short one means
+	 * kTLS filled in u.cmsg.
+	 */
+	if (ret >= 0 && msg.msg_controllen < sizeof(u)) {
 		/* Returning the count would credit the RPC stream with
 		 * octets that never reached the caller's buffer.
 		 */
 		if (tls_get_record_type(sock->sk, &u.cmsg) !=
 		    TLS_RECORD_TYPE_ALERT)
 			return -EAGAIN;
+		/* An Alert record carries exactly one two-octet message
+		 * (RFC 8446 Section 5.1). alert_kvec caps the receive at two,
+		 * so a longer record produces the same count. MSG_EOR appears
+		 * only once kTLS has drained the whole record.
+		 */
+		if (ret != sizeof(alert) || !(msg.msg_flags & MSG_EOR))
+			return -EBADMSG;
 		iov_iter_revert(&msg.msg_iter, ret);
 		ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN);
 	}

From 03bfe7879fa8ac500f79c62b7afd848d2e5f3e16 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 8 Aug 2026 11:40:12 -0400
Subject: [PATCH 0908/1982] SUNRPC: Resume receiving after a TLS control record

commit 8079c660b247f282340fbe7f55cf8a354009db9e upstream.

A TLS control record delivers no payload to the RPC layer.
svc_tcp_recvfrom() clears XPT_DATA before the receive, and
svc_tcp_sock_recv_cmsg() returns -EAGAIN for the record it consumed.
Nothing marks the transport ready again. kTLS raises data_ready for
arriving TCP segments, not for records it has already decrypted. An
RPC Call queued behind an alert or a KeyUpdate waits until the client
sends more. The client blocks until its RPC timeout expires.

The receive takes only the first two octets of the record. kTLS holds
the remainder on its receive list, where each later receive takes two
octets more.

Drain a record that is not an alert, then mark the transport ready
once a control record has been consumed.

Fixes: 5e052dda121e ("SUNRPC: Recognize control messages in server-side TCP socket code")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-4-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcsock.c | 55 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 52 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 51031450062f24..53d02920d11299 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -238,6 +238,39 @@ static int svc_one_sock_name(struct svc_sock *svsk, char *buf, int remaining)
 	return len;
 }
 
+/*
+ * kTLS delivers a record only up to the caller's buffer and keeps
+ * the remainder on its receive list, where no further data_ready
+ * announces it. Consume the whole record.
+ */
+static void
+svc_tcp_sock_drain_record(struct socket *sock)
+{
+	union {
+		struct cmsghdr	cmsg;
+		u8		buf[CMSG_SPACE(sizeof(u8))];
+	} u;
+	u8 discard[64];
+	struct kvec discard_kvec = {
+		.iov_base = discard,
+		.iov_len = sizeof(discard),
+	};
+
+	for (;;) {
+		struct msghdr msg = {
+			.msg_control = &u,
+			.msg_controllen = sizeof(u),
+		};
+
+		iov_iter_kvec(&msg.msg_iter, ITER_DEST, &discard_kvec, 1,
+			      discard_kvec.iov_len);
+		if (sock_recvmsg(sock, &msg, MSG_DONTWAIT) <= 0)
+			break;
+		if (msg.msg_flags & MSG_EOR)
+			break;
+	}
+}
+
 static int
 svc_tcp_sock_process_cmsg(struct socket *sock, struct msghdr *msg,
 			  struct cmsghdr *cmsg, int ret)
@@ -293,12 +326,20 @@ svc_tcp_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags)
 	 * kTLS filled in u.cmsg.
 	 */
 	if (ret >= 0 && msg.msg_controllen < sizeof(u)) {
+		u8 content_type = tls_get_record_type(sock->sk, &u.cmsg);
+
 		/* Returning the count would credit the RPC stream with
 		 * octets that never reached the caller's buffer.
 		 */
-		if (tls_get_record_type(sock->sk, &u.cmsg) !=
-		    TLS_RECORD_TYPE_ALERT)
+		if (content_type != TLS_RECORD_TYPE_ALERT) {
+			/* An application data record carries RPC payload.
+			 * Draining one breaks RPC fragment framing.
+			 */
+			if (content_type != TLS_RECORD_TYPE_DATA &&
+			    !(msg.msg_flags & MSG_EOR))
+				svc_tcp_sock_drain_record(sock);
 			return -EAGAIN;
+		}
 		/* An Alert record carries exactly one two-octet message
 		 * (RFC 8446 Section 5.1). alert_kvec caps the receive at two,
 		 * so a longer record produces the same count. MSG_EOR appears
@@ -321,8 +362,16 @@ svc_tcp_sock_recvmsg(struct svc_sock *svsk, struct msghdr *msg)
 	ret = sock_recvmsg(sock, msg, MSG_DONTWAIT);
 	if (msg->msg_flags & MSG_CTRUNC) {
 		msg->msg_flags &= ~(MSG_CTRUNC | MSG_EOR);
-		if (ret == 0 || ret == -EIO)
+		if (ret == 0 || ret == -EIO) {
 			ret = svc_tcp_sock_recv_cmsg(sock, &msg->msg_flags);
+			/* A control record delivers nothing to the caller,
+			 * and kTLS announces no data_ready for records it
+			 * already holds. Mark the transport ready so that
+			 * the records behind this one can be received.
+			 */
+			if (ret == -EAGAIN)
+				set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+		}
 	}
 	return ret;
 }

From fd7b12865b2078f16406834631c4a68262d28346 Mon Sep 17 00:00:00 2001
From: Zhiling Zou <zhilinz@nebusec.ai>
Date: Sat, 12 Sep 2026 21:56:09 +0800
Subject: [PATCH 0909/1982] SUNRPC: trace an accepted transport before
 publishing it

commit 06f90cf104fc21ee01e7ef1eb80e092173089b9f upstream.

svc_handle_xprt() publishes a newly accepted transport before tracing
it. svc_add_new_temp_xprt() places the transport on sv_tempsocks and
clears XPT_BUSY, so another nfsd thread can dequeue it at once. If the
peer has already closed the connection, that thread runs
svc_delete_xprt(), which drops the list reference, the only reference
the new transport holds. trace_svc_xprt_accept() then reads the
transport's addresses and network namespace from freed memory.

Before publication the accepting thread owns the transport
exclusively: XPT_BUSY is still set from svc_xprt_init() and the
transport is on no list. Emit the tracepoint there.

Fixes: 11bbb0f76e99 ("SUNRPC: Trace a few more generic svc_xprt events")
Cc: stable@vger.kernel.org
Reported-by: VEGA <vega@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Link: https://patch.msgid.link/d15495bff2247e3f9d4f9ef36df8e246a3898380.1789220778.git.zhilinz@nebusec.ai
[ cel: trace before publication instead of taking an extra reference ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svc_xprt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 34f97009e85696..4700bc84e915ce 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -783,8 +783,8 @@ static void svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
 		newxpt = xprt->xpt_ops->xpo_accept(xprt);
 		if (newxpt) {
 			newxpt->xpt_cred = get_cred(xprt->xpt_cred);
-			svc_add_new_temp_xprt(serv, newxpt);
 			trace_svc_xprt_accept(newxpt, serv->sv_name);
+			svc_add_new_temp_xprt(serv, newxpt);
 		} else {
 			module_put(xprt->xpt_class->xcl_owner);
 		}

From 8067c654ae8c6d88aa0d499e9974b59ab2fe5042 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ameer.hamza@truenas.com>
Date: Sat, 15 Aug 2026 03:19:52 +0500
Subject: [PATCH 0910/1982] sunrpc: treat empty auth.unix.gid replies as
 negative entries

commit a12cc0930235b86b934ade7c077a1935c2ac333d upstream.

When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
failure, e.g. while winbind or sssd is briefly unreachable), it
answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
installs that as a valid positive entry, and svcauth_unix_set_client()
then replaces the credential's group list with the empty one on
every request, RPCSEC_GSS included via svcauth_gss_set_client().
One failed lookup strips that uid of all supplementary groups on
every export for up to mountd's configured TTL (30 minutes by
default), long after the NSS backend has recovered.

mountd cannot send an empty list for a successful lookup, since
getgrouplist(3) always includes at least the user's primary group,
so a zero-group reply can only mean the lookup failed. Record it as
a negative entry: unix_gid_find() then returns -ENOENT and
svcauth_unix_set_client() keeps the groups the RPC credential
already carries. This is the fallback that
commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
gid list when using AUTH_UNIX authentication") promised when no
answer is available, and the same state try_to_negate_entry()
already creates when no listener holds the channel open.

Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid list when using AUTH_UNIX authentication")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>
Link: https://patch.msgid.link/20260814221953.108837-2-ameer.hamza@truenas.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcauth_unix.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 8ca98b146ec8ca..abe058726e311b 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -537,6 +537,13 @@ static int unix_gid_parse(struct cache_detail *cd,
 	if (ugp) {
 		struct cache_head *ch;
 		ug.h.flags = 0;
+		/*
+		 * mountd sends at least the user's primary group on
+		 * success, so an empty list can only mean the lookup
+		 * failed. Keep the credential's own groups instead.
+		 */
+		if (gids == 0)
+			set_bit(CACHE_NEGATIVE, &ug.h.flags);
 		ug.h.expiry_time = expiry;
 		ch = sunrpc_cache_update(cd,
 					 &ug.h, &ugp->h,

From e77fe4052e155f6ab7872fe0aa71c2d91843847c Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Sat, 8 Aug 2026 11:40:11 -0400
Subject: [PATCH 0911/1982] SUNRPC: Treat every TLS error alert as fatal

commit 2c0dfe9d6d81e4bc9201b11dab3876cbfd01884e upstream.

svc_tcp_sock_process_cmsg() decides whether an alert ends the session
by reading the alert's level octet. RFC 8446 Section 6 retired that
field. The severity is implicit in the description, and a receiver
treats every alert listed in Section 6.2 as an error alert
"regardless of the AlertLevel in the message". A peer that aborts
with unexpected_message but leaves the legacy octet set to warning
makes the server return -EAGAIN. svc_tcp_recvfrom() then leaves a
dead TLS session attached to an open transport. NFSD keeps polling
it.

Decide from the alert description instead. close_notify and
user_canceled are the closure alerts (RFC 8446 Section 6.1). Every
other description ends the session, including one this kernel does
not recognize.

Fixes: 39067dda1d86 ("SUNRPC: Use new helpers to handle TLS Alerts")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808-svcsock-cmsg-fixes-v3-3-62d9a631c880@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svcsock.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 53d02920d11299..5cf9b43f27831a 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -290,8 +290,17 @@ svc_tcp_sock_process_cmsg(struct socket *sock, struct msghdr *msg,
 		break;
 	case TLS_RECORD_TYPE_ALERT:
 		tls_alert_recv(sock->sk, msg, &level, &description);
-		ret = (level == TLS_ALERT_LEVEL_FATAL) ?
-			-ENOTCONN : -EAGAIN;
+		/* RFC 8446 Section 6: every alert but a closure alert is
+		 * an error alert.
+		 */
+		switch (description) {
+		case TLS_ALERT_DESC_CLOSE_NOTIFY:
+		case TLS_ALERT_DESC_USER_CANCELED:
+			ret = -EAGAIN;
+			break;
+		default:
+			ret = -ENOTCONN;
+		}
 		break;
 	default:
 		/* discard this record type */

From 965456110cf6952cc4eec80761171503e6e424df Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 6 Oct 2026 14:29:55 +0100
Subject: [PATCH 0912/1982] rxrpc: Fix update of call->tx_pending without
 holding lock

commit 7801c42c3bb737cfb06194a383873fcad8daacf5 upstream.

Currently, rxrpc_send_data() updates call->tx_pending just before it
returns - but it won't be holding the call->user_mutex when it does this if
a wait was interrupted by a signal.  This would allow a parallel sendmsg()
to race.

Further, both the callers of rxrpc_send_data() call it with the lock held,
and then it returns an indication through the parameter list to say whether
it has dropped the lock or not - after which the callers both just drop the
lock if it's still held.

Fix this by:

 (1) Moving the release of call->user_mutex down into rxrpc_send_data() and
     get rid of the indicator parameter.  This makes it easier to see where
     the lock is held.

 (2) After waiting, if the attempt to reacquire the mutex is interrupted,
     just return directly there rather than going to out_unlock

 (3) Restricting the txb variable to inside the buffering loop and leaving
     ->tx_pending set until we've queued the buffer.

Note that there's a slight change in behaviour in that wait_for_space
failure now doesn't check for completion because it doesn't hold the call
user_mutex.  The caller, however, should re-issue the send and pick up any
error at a second attempt.

Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg")
Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-4-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/sendmsg.c | 63 +++++++++++++++++++++------------------------
 1 file changed, 29 insertions(+), 34 deletions(-)

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 65e2f5626947ed..5588d731d5c535 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -320,10 +320,9 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct rxrpc_call *call)
 static int rxrpc_send_data(struct rxrpc_sock *rx,
 			   struct rxrpc_call *call,
 			   struct msghdr *msg, size_t len,
-			   rxrpc_notify_end_tx_t notify_end_tx,
-			   bool *_dropped_lock)
+			   rxrpc_notify_end_tx_t notify_end_tx)
+	__releases(&call->user_mutex)
 {
-	struct rxrpc_txbuf *txb;
 	struct sock *sk = &rx->sk;
 	enum rxrpc_call_state state;
 	long timeo;
@@ -334,30 +333,26 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 		trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send,
 				  call->cid, call->call_id, call->rx_consumed,
 				  0, -EPROTO);
-		return -EPROTO;
+		ret = -EPROTO;
+		goto out_unlock;
 	}
 
 	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
 
 	ret = rxrpc_wait_to_be_connected(call, &timeo);
 	if (ret < 0)
-		return ret;
+		goto out_unlock;
 
 	if (call->conn->state == RXRPC_CONN_CLIENT_UNSECURED) {
 		ret = rxrpc_init_client_conn_security(call->conn);
 		if (ret < 0)
-			return ret;
+			goto out_unlock;
 	}
 
 	/* this should be in poll */
 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 
 reload:
-	txb = call->tx_pending;
-	call->tx_pending = NULL;
-	if (txb)
-		rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
-
 	ret = -EPIPE;
 	if (sk->sk_shutdown & SEND_SHUTDOWN)
 		goto maybe_error;
@@ -386,6 +381,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 	}
 
 	do {
+		struct rxrpc_txbuf *txb = call->tx_pending;
+
 		if (!txb) {
 			size_t remain;
 
@@ -411,6 +408,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 				ret = -ENOMEM;
 				goto maybe_error;
 			}
+			call->tx_pending = txb;
+		} else {
+			rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
 		}
 
 		_debug("append");
@@ -445,9 +445,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 
 			ret = call->security->secure_packet(call, txb);
 			if (ret < 0)
-				goto out;
+				goto out_unlock;
 			rxrpc_queue_packet(rx, call, txb, notify_end_tx);
-			txb = NULL;
+			call->tx_pending = NULL;
 		}
 	} while (msg_data_left(msg) > 0);
 
@@ -456,45 +456,46 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 	if (rxrpc_call_is_complete(call) &&
 	    call->error < 0)
 		ret = call->error;
-out:
-	call->tx_pending = txb;
+out_unlock:
+	mutex_unlock(&call->user_mutex);
 	_leave(" = %d", ret);
 	return ret;
 
 call_terminated:
-	rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted);
-	_leave(" = %d", call->error);
-	return call->error;
+	ret = call->error;
+	goto out_unlock;
 
 maybe_error:
 	if (copied)
 		goto success;
-	goto out;
+	goto out_unlock;
 
 efault:
 	ret = -EFAULT;
-	goto out;
+	goto out_unlock;
 
 wait_for_space:
 	ret = -EAGAIN;
 	if (msg->msg_flags & MSG_DONTWAIT)
 		goto maybe_error;
 	mutex_unlock(&call->user_mutex);
-	*_dropped_lock = true;
+
 	ret = rxrpc_wait_for_tx_window(rx, call, &timeo,
 				       msg->msg_flags & MSG_WAITALL);
 	if (ret < 0)
-		goto maybe_error;
+		goto out_nolock;
 	if (call->interruptibility == RXRPC_INTERRUPTIBLE) {
 		if (mutex_lock_interruptible(&call->user_mutex) < 0) {
 			ret = sock_intr_errno(timeo);
-			goto maybe_error;
+			goto out_nolock;
 		}
 	} else {
 		mutex_lock(&call->user_mutex);
 	}
-	*_dropped_lock = false;
 	goto reload;
+out_nolock:
+	_leave(" = %d [intr]", ret);
+	return copied ?: ret;
 }
 
 /*
@@ -660,7 +661,6 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg,
 int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 {
 	struct rxrpc_call *call;
-	bool dropped_lock = false;
 	int ret;
 
 	struct rxrpc_send_params p = {
@@ -769,16 +769,15 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 		ret = 0;
 		break;
 	case RXRPC_CMD_SEND_DATA:
-		ret = rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock);
-		break;
+		ret = rxrpc_send_data(rx, call, msg, len, NULL);
+		goto error_put;
 	default:
 		ret = -EINVAL;
 		break;
 	}
 
 out_put_unlock:
-	if (!dropped_lock)
-		mutex_unlock(&call->user_mutex);
+	mutex_unlock(&call->user_mutex);
 error_put:
 	rxrpc_put_call(call, rxrpc_call_put_sendmsg);
 	_leave(" = %d", ret);
@@ -808,7 +807,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
 			   struct msghdr *msg, size_t len,
 			   rxrpc_notify_end_tx_t notify_end_tx)
 {
-	bool dropped_lock = false;
 	int ret;
 
 	_enter("{%d},", call->debug_id);
@@ -819,12 +817,9 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
 	mutex_lock(&call->user_mutex);
 
 	ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len,
-			      notify_end_tx, &dropped_lock);
+			      notify_end_tx);
 	if (ret == -ESHUTDOWN)
 		ret = call->error;
-
-	if (!dropped_lock)
-		mutex_unlock(&call->user_mutex);
 	_leave(" = %d", ret);
 	return ret;
 }

From 8b9efc7b27bf7d3f12f5ba3d5d9ab39a76883637 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 6 Oct 2026 14:29:56 +0100
Subject: [PATCH 0913/1982] rxrpc: Fix lack of short-send handling in
 rxrpc_kernel_send_data()

commit af208f36ae22440cf6011a43cb3064fd525d85b4 upstream.

Fix rxrpc_kernel_send_data() to loop around if it detects a short send.
David Laight suggested doing it here rather than wrapping all the calls in
loops.  Further, remove the len argument and use the iterator count instead
and return 0 on success, not the amount copied.

Note this is also a prerequisite for changing the way rxrpc_send_data()
works to return a short send rather than an error if some data was
buffered.

Fixes: 651350d10f93 ("[AF_RXRPC]: Add an interface to the AF_RXRPC module for the AFS filesystem to use")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-5-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/rxrpc.rst |  8 +++++---
 fs/afs/rxrpc.c                     | 32 ++++++++++++------------------
 include/net/af_rxrpc.h             |  5 ++---
 net/rxrpc/rxperf.c                 | 25 ++++++++++-------------
 net/rxrpc/sendmsg.c                | 27 +++++++++++++++++--------
 5 files changed, 49 insertions(+), 48 deletions(-)

diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/rxrpc.rst
index 8926dab8e2e60d..9239f7bd888510 100644
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -870,7 +870,6 @@ The kernel interface functions are as follows:
 	int rxrpc_kernel_send_data(struct socket *sock,
 				   struct rxrpc_call *call,
 				   struct msghdr *msg,
-				   size_t len,
 				   rxrpc_notify_end_tx_t notify_end_rx);
 
      This is used to supply either the request part of a client call or the
@@ -879,14 +878,17 @@ The kernel interface functions are as follows:
      exclusively to in-kernel virtual addresses.  msg.msg_flags may be given
      MSG_MORE if there will be subsequent data sends for this call.
 
-     The msg must not specify a destination address, control data or any flags
-     other than MSG_MORE.  len is the total amount of data to transmit.
+     msg must not specify a destination address, control data or any flags
+     other than MSG_MORE or MSG_WAITALL.
 
      notify_end_rx can be NULL or it can be used to specify a function to be
      called when the call changes state to end the Tx phase.  This function is
      called with a spinlock held to prevent the last DATA packet from being
      transmitted until the function returns.
 
+     It returns 0 if all the provided data has been buffered and a negative
+     error code on failure.
+
  (#) Receive data from a call::
 
 	int rxrpc_kernel_recv_data(struct socket *sock,
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index b3207e141343b6..2e28ad8aca68af 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -412,8 +412,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
 	msg.msg_controllen	= 0;
 	msg.msg_flags		= MSG_WAITALL | (call->write_iter ? MSG_MORE : 0);
 
-	ret = rxrpc_kernel_send_data(call->net->socket, rxcall,
-				     &msg, call->request_size,
+	ret = rxrpc_kernel_send_data(call->net->socket, rxcall, &msg,
 				     afs_notify_end_request_tx);
 	if (ret < 0)
 		goto error_do_abort;
@@ -425,7 +424,6 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
 
 		ret = rxrpc_kernel_send_data(call->net->socket,
 					     call->rxcall, &msg,
-					     iov_iter_count(&msg.msg_iter),
 					     afs_notify_end_request_tx);
 		*call->write_iter = msg.msg_iter;
 
@@ -871,7 +869,7 @@ void afs_send_empty_reply(struct afs_call *call)
 	msg.msg_controllen	= 0;
 	msg.msg_flags		= 0;
 
-	switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0,
+	switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
 				       afs_notify_end_reply_tx)) {
 	case 0:
 		_leave(" [replied]");
@@ -897,7 +895,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 	struct afs_net *net = call->net;
 	struct msghdr msg;
 	struct kvec iov[1];
-	int n;
+	int ret;
 
 	_enter("");
 
@@ -912,21 +910,17 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 	msg.msg_controllen	= 0;
 	msg.msg_flags		= 0;
 
-	n = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, len,
-				   afs_notify_end_reply_tx);
-	if (n >= 0) {
-		/* Success */
-		_leave(" [replied]");
-		return;
-	}
-
-	if (n == -ENOMEM) {
-		_debug("oom");
-		rxrpc_kernel_abort_call(net->socket, call->rxcall,
-					RXGEN_SS_MARSHAL, -ENOMEM,
-					afs_abort_oom);
+	ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
+				     afs_notify_end_reply_tx);
+	if (ret < 0) {
+		if (ret == -ENOMEM) {
+			_debug("oom");
+			rxrpc_kernel_abort_call(net->socket, call->rxcall,
+						RXGEN_SS_MARSHAL, -ENOMEM,
+						afs_abort_oom);
+		}
+		_leave(" [error]");
 	}
-	_leave(" [error]");
 }
 
 /*
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 0fb4c41c9bbf55..f3980348ed343e 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -64,9 +64,8 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
 					   bool upgrade,
 					   enum rxrpc_interruptibility interruptibility,
 					   unsigned int debug_id);
-int rxrpc_kernel_send_data(struct socket *, struct rxrpc_call *,
-			   struct msghdr *, size_t,
-			   rxrpc_notify_end_tx_t);
+int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
+			   struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx);
 int rxrpc_kernel_recv_data(struct socket *, struct rxrpc_call *,
 			   struct iov_iter *, size_t *, bool, u32 *, u16 *);
 bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,
diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c
index 2ea71e3831f75d..6f1d4114f86060 100644
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -513,8 +513,8 @@ static int rxperf_process_call(struct rxperf_call *call)
 	struct msghdr msg = {};
 	struct bio_vec bv;
 	struct kvec iov[1];
-	ssize_t n;
 	size_t reply_len = call->reply_len, len;
+	int ret;
 
 	rxrpc_kernel_set_tx_length(rxperf_socket, call->rxcall,
 				   reply_len + sizeof(rxperf_magic_cookie));
@@ -524,13 +524,11 @@ static int rxperf_process_call(struct rxperf_call *call)
 		bvec_set_page(&bv, ZERO_PAGE(0), len, 0);
 		iov_iter_bvec(&msg.msg_iter, WRITE, &bv, 1, len);
 		msg.msg_flags = MSG_MORE;
-		n = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
-					   len, rxperf_notify_end_reply_tx);
-		if (n < 0)
-			return n;
-		if (n == 0)
-			return -EIO;
-		reply_len -= n;
+		ret = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
+					     rxperf_notify_end_reply_tx);
+		if (ret < 0)
+			return ret;
+		reply_len -= len;
 	}
 
 	len = sizeof(rxperf_magic_cookie);
@@ -538,16 +536,13 @@ static int rxperf_process_call(struct rxperf_call *call)
 	iov[0].iov_len	= len;
 	iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len);
 	msg.msg_flags = 0;
-	n = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, len,
-				   rxperf_notify_end_reply_tx);
-	if (n >= 0)
-		return 0; /* Success */
-
-	if (n == -ENOMEM)
+	ret = rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg,
+				     rxperf_notify_end_reply_tx);
+	if (ret == -ENOMEM)
 		rxrpc_kernel_abort_call(rxperf_socket, call->rxcall,
 					RXGEN_SS_MARSHAL, -ENOMEM,
 					rxperf_abort_oom);
-	return n;
+	return ret;
 }
 
 /*
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 5588d731d5c535..29c3e95906b651 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -793,7 +793,6 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
  * @sock: The socket the call is on
  * @call: The call to send data through
  * @msg: The data to send
- * @len: The amount of data to send
  * @notify_end_tx: Notification that the last packet is queued.
  *
  * Allow a kernel service to send data on a call.  The call must be in an state
@@ -804,8 +803,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
  * Return: %0 if successful and a negative error code otherwise.
  */
 int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
-			   struct msghdr *msg, size_t len,
-			   rxrpc_notify_end_tx_t notify_end_tx)
+			   struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx)
 {
 	int ret;
 
@@ -814,12 +812,25 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
 	ASSERTCMP(msg->msg_name, ==, NULL);
 	ASSERTCMP(msg->msg_control, ==, NULL);
 
-	mutex_lock(&call->user_mutex);
+	for (;;) {
+		mutex_lock(&call->user_mutex);
+
+		ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg,
+				      msg_data_left(msg), notify_end_tx);
+		if (ret == -ESHUTDOWN)
+			ret = call->error;
+		if (ret < 0)
+			break;
+		if (msg_data_left(msg) == 0) {
+			ret = 0;
+			break;
+		}
+		if (ret == 0) {
+			ret = -EIO;
+			break;
+		}
+	}
 
-	ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len,
-			      notify_end_tx);
-	if (ret == -ESHUTDOWN)
-		ret = call->error;
 	_leave(" = %d", ret);
 	return ret;
 }

From ff518f5f7adc035d10c70216c0475305f58c004c Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 6 Oct 2026 14:29:57 +0100
Subject: [PATCH 0914/1982] afs: Fix afs to abort the rxrpc call on send error

commit 3e6af08a571fe2943a006acf3e890f36322602bc upstream.

Fix afs_send_empty_reply() and afs_send_simple_reply() to always try to
abort the rxrpc call rather than just aborting on -ENOMEM and otherwise
abandoning it.  If the call is already complete due to network failure or a
received abort, this will do nothing.

Also make afs_make_call() always abort on send error; again, it does
nothing if the rxrpc call is already dead.

Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_RXRPC.")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-6-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/afs/rxrpc.c               | 37 +++++++++++++-----------------------
 include/trace/events/rxrpc.h |  2 +-
 2 files changed, 14 insertions(+), 25 deletions(-)

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 2e28ad8aca68af..b02e9ab5a73def 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -441,10 +441,8 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
 	return;
 
 error_do_abort:
-	if (ret != -ECONNABORTED)
-		rxrpc_kernel_abort_call(call->net->socket, rxcall,
-					RX_USER_ABORT, ret,
-					afs_abort_send_data_error);
+	rxrpc_kernel_abort_call(call->net->socket, rxcall,
+				RX_USER_ABORT, ret, afs_abort_send_data_error);
 	if (call->async) {
 		afs_see_call(call, afs_call_trace_async_abort);
 		return;
@@ -857,6 +855,7 @@ void afs_send_empty_reply(struct afs_call *call)
 {
 	struct afs_net *net = call->net;
 	struct msghdr msg;
+	int ret;
 
 	_enter("");
 
@@ -869,21 +868,13 @@ void afs_send_empty_reply(struct afs_call *call)
 	msg.msg_controllen	= 0;
 	msg.msg_flags		= 0;
 
-	switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
-				       afs_notify_end_reply_tx)) {
-	case 0:
-		_leave(" [replied]");
-		return;
-
-	case -ENOMEM:
-		_debug("oom");
+	ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
+				     afs_notify_end_reply_tx);
+	if (ret < 0) {
 		rxrpc_kernel_abort_call(net->socket, call->rxcall,
-					RXGEN_SS_MARSHAL, -ENOMEM,
-					afs_abort_oom);
-		fallthrough;
-	default:
-		_leave(" [error]");
-		return;
+					RXGEN_SS_MARSHAL, ret,
+					afs_abort_send_error);
+		afs_set_call_complete(call, ret, RXGEN_SS_MARSHAL);
 	}
 }
 
@@ -913,12 +904,10 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 	ret = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg,
 				     afs_notify_end_reply_tx);
 	if (ret < 0) {
-		if (ret == -ENOMEM) {
-			_debug("oom");
-			rxrpc_kernel_abort_call(net->socket, call->rxcall,
-						RXGEN_SS_MARSHAL, -ENOMEM,
-						afs_abort_oom);
-		}
+		rxrpc_kernel_abort_call(net->socket, call->rxcall,
+					RXGEN_SS_MARSHAL, ret,
+					afs_abort_send_error);
+		afs_set_call_complete(call, ret, RXGEN_SS_MARSHAL);
 		_leave(" [error]");
 	}
 }
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 704a10de667004..554dfb777b93e1 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -20,10 +20,10 @@
 	/* AFS errors */						\
 	EM(afs_abort_general_error,		"afs-error")		\
 	EM(afs_abort_interrupted,		"afs-intr")		\
-	EM(afs_abort_oom,			"afs-oom")		\
 	EM(afs_abort_op_not_supported,		"afs-op-notsupp")	\
 	EM(afs_abort_probeuuid_negative,	"afs-probeuuid-neg")	\
 	EM(afs_abort_send_data_error,		"afs-send-data")	\
+	EM(afs_abort_send_error,		"afs-send-error")	\
 	EM(afs_abort_unmarshal_error,		"afs-unmarshal")	\
 	EM(afs_abort_unsupported_sec_class,	"afs-unsup-sec-class")	\
 	/* rxperf errors */						\

From 7ea62525912d575c12928ed60efa6a6f94af7389 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 6 Oct 2026 14:30:00 +0100
Subject: [PATCH 0915/1982] rxrpc: Fix double IRQ enablement

commit 41eb0af096ba8754e584d47e6de42f1e4980ceae upstream.

rxrpc_notify_socket() explicitly disables and then re-enables IRQs, but one
of its call chains (rxrpc_input_queue_data() -> rxrpc_end_rx_phase() ->
rxrpc_call_completed() -> rxrpc_set_call_completion()) has IRQs disabled
around it.

Fix this by making rxrpc_notify_socket() use irqsave spinlocks.

Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/O thread")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.979970-6-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20261006133011.531806-9-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/recvmsg.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index efcba4b2e74f0c..56fa324d0962e2 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -24,6 +24,7 @@ void rxrpc_notify_socket(struct rxrpc_call *call)
 {
 	struct rxrpc_sock *rx;
 	struct sock *sk;
+	unsigned long flags;
 
 	_enter("%d", call->debug_id);
 
@@ -38,16 +39,16 @@ void rxrpc_notify_socket(struct rxrpc_call *call)
 	sk = &rx->sk;
 	if (rx && sk->sk_state < RXRPC_CLOSE) {
 		if (call->notify_rx) {
-			spin_lock_irq(&call->notify_lock);
+			spin_lock_irqsave(&call->notify_lock, flags);
 			call->notify_rx(sk, call, call->user_call_ID);
-			spin_unlock_irq(&call->notify_lock);
+			spin_unlock_irqrestore(&call->notify_lock, flags);
 		} else {
-			spin_lock_irq(&rx->recvmsg_lock);
+			spin_lock_irqsave(&rx->recvmsg_lock, flags);
 			if (list_empty(&call->recvmsg_link)) {
 				rxrpc_get_call(call, rxrpc_call_get_notify_socket);
 				list_add_tail(&call->recvmsg_link, &rx->recvmsg_q);
 			}
-			spin_unlock_irq(&rx->recvmsg_lock);
+			spin_unlock_irqrestore(&rx->recvmsg_lock, flags);
 
 			if (!sock_flag(sk, SOCK_DEAD)) {
 				_debug("call %ps", sk->sk_data_ready);

From 7ace4531de8a7d9d2a8f5abb69524d775d20b114 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 6 Oct 2026 14:30:01 +0100
Subject: [PATCH 0916/1982] rxrpc: Fix return in rxrpc_recvmsg_data() for
 service calls

commit 18a71e111c7505e16c2de91480561fc491f41341 upstream.

When rxrpc_recvmsg_data() gets called on a service call that has received
all of the request, RXRPC_CALL_RECVMSG_READ_ALL has been set, and this
causes rxrpc_recvmsg_data() to jump straight out, indicating the end of the
call (ie. rxrpc_kernel_recv_data() returns 1) without waiting for the call
to be processed or the reply to be transmitted.

rxperf_deliver_to_call() also has to be altered to call
rxrpc_kernel_recv_data() to collect the final ACK on a service call as does
afs_deliver_to_call().

Fixes: d001648ec7cf ("rxrpc: Don't expose skbs to in-kernel users [ver #2]")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260914151340.3227501-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-10-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/rxrpc.rst | 13 +++++++++----
 fs/afs/rxrpc.c                     |  4 ++--
 net/rxrpc/recvmsg.c                | 13 ++++++++++---
 net/rxrpc/rxperf.c                 | 16 ++++++++++++++--
 4 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/rxrpc.rst
index 9239f7bd888510..eca055a536aa1b 100644
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -909,10 +909,15 @@ The kernel interface functions are as follows:
       want_more should be true if further data will be required after this is
       satisfied and false if this is the last item of the receive phase.
 
-      There are three normal returns: 0 if the buffer was filled and want_more
-      was true; 1 if the buffer was filled, the last DATA packet has been
-      emptied and want_more was false; and -EAGAIN if the function needs to be
-      called again.
+      For client calls, there are three normal returns: 0 if the buffer was
+      filled and want_more was true; 1 if the buffer was filled, the last DATA
+      packet has been emptied and want_more was false; and -EAGAIN if the
+      function needs to be called again.
+
+      For service calls, there are four normal returns: 0 and -EAGAIN are the
+      same as for client calls; 2 indicates that the last DATA packet of the
+      request has been received, want_more was false and the call is still in
+      progress; and 1 indicates that the call is now successfully complete.
 
       If the last DATA packet is processed but the buffer contains less than
       the amount requested, EBADMSG is returned.  If want_more wasn't set, but
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index b02e9ab5a73def..9a17cbbc35929f 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -541,7 +541,7 @@ void afs_deliver_to_call(struct afs_call *call)
 						     &call->service_id);
 			trace_afs_receive_data(call, &call->def_iter, false, ret);
 
-			if (ret == -EINPROGRESS || ret == -EAGAIN)
+			if (ret == -EAGAIN || ret == 2)
 				return;
 			if (ret < 0 || ret == 1) {
 				if (ret == 1)
@@ -934,7 +934,7 @@ int afs_extract_data(struct afs_call *call, bool want_more)
 		return ret;
 
 	state = READ_ONCE(call->state);
-	if (ret == 1) {
+	if (ret == 1 || ret == 2) {
 		switch (state) {
 		case AFS_CALL_CL_AWAIT_REPLY:
 			afs_set_call_state(call, state, AFS_CALL_CL_PROC_REPLY);
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 56fa324d0962e2..0c960f13b5fc48 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -638,9 +638,11 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
  * Note that we may return %-EAGAIN to drain empty packets at the end
  * of the data, even if we've already copied over the requested data.
  *
- * Return: %0 if got what was asked for and there's more available, %1
- * if we got what was asked for and we're at the end of the data and
- * %-EAGAIN if we need more data.
+ * Return: %0 if got what was asked for and there's more available, %1 if we
+ * got what was asked for and we're at the end of the call, %2 if a service
+ * call received all of the request but is still in progress and %-EAGAIN if we
+ * need more data.  A variety of other errors can be returned if the call
+ * completed with failure.
  */
 int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
 			   struct iov_iter *iter, size_t *_len,
@@ -679,6 +681,11 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
 
 read_phase_complete:
 	ret = 1;
+	if (rxrpc_is_service_call(call)) {
+		if (rxrpc_call_is_complete(call))
+			goto call_failed;
+		ret = 2;
+	}
 out:
 	if (_service)
 		*_service = call->dest_srx.srx_service;
diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c
index 6f1d4114f86060..91ecd5d64bc34f 100644
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -293,8 +293,20 @@ static void rxperf_deliver_to_call(struct work_struct *work)
 	       state == RXPERF_CALL_SV_AWAIT_ACK
 	       ) {
 		if (state == RXPERF_CALL_SV_AWAIT_ACK) {
-			if (!rxrpc_kernel_check_life(rxperf_socket, call->rxcall))
+			size_t len = 0;
+			iov_iter_kvec(&call->iter, ITER_DEST, NULL, 0, 0);
+			ret = rxrpc_kernel_recv_data(rxperf_socket,
+						     call->rxcall, &call->iter,
+						     &len, false, &remote_abort,
+						     &call->service_id);
+
+			if (ret == -EAGAIN || ret == 2)
+				return;
+			if (ret < 0 || ret == 1) {
+				if (ret == 1)
+					ret = 0;
 				goto call_complete;
+			}
 			return;
 		}
 
@@ -369,7 +381,7 @@ static int rxperf_extract_data(struct rxperf_call *call, bool want_more)
 	if (ret == 0 || ret == -EAGAIN)
 		return ret;
 
-	if (ret == 1) {
+	if (ret == 1 || ret == 2) {
 		switch (call->state) {
 		case RXPERF_CALL_SV_AWAIT_REQUEST:
 			rxperf_set_call_state(call, RXPERF_CALL_SV_REPLYING);

From ff30731bbce188f00a516e900ce585daa81c40a1 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Thu, 22 Oct 2026 14:01:32 -0700
Subject: [PATCH 0917/1982] x86/cpuid: Mark CPUID function 0x23 as being
 indexed

commit 108775fa28fe04a16f19a828a779689f3d0ea9f0 upstream.

Add function 0x23 to the set of CPUID functions that are indexed, as per
the SDM and the many sub-leafs defined in leaf_types.h.

Closes: https://lore.kernel.org/all/213d614fe73e183a230c8f4e0c8fa1cc3d45df39.camel@intel.com
Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261022210134.612848-2-seanjc@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpuid/api.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/include/asm/cpuid/api.h b/arch/x86/include/asm/cpuid/api.h
index 44fa82e1267ce9..ea1d9fe438a4fc 100644
--- a/arch/x86/include/asm/cpuid/api.h
+++ b/arch/x86/include/asm/cpuid/api.h
@@ -180,6 +180,7 @@ static __always_inline bool cpuid_function_is_indexed(u32 function)
 	case 0x1d:
 	case 0x1e:
 	case 0x1f:
+	case 0x23:
 	case 0x24:
 	case 0x8000001d:
 		return true;

From da31978b9ccbe7628885d79a19da5531cea63b5d Mon Sep 17 00:00:00 2001
From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
Date: Thu, 13 Aug 2026 12:01:28 +0300
Subject: [PATCH 0918/1982] x86/mm/pat: Fix effective RW computation in
 lookup_address_in_pgd_attr()

commit ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482 upstream.

lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of
the walked page table levels so that verify_rwx() can detect mappings that
are both writable and executable.

The RW bits are folded into a bool with

	rw &= pXd_flags(*pXd) & _PAGE_RW;

but _PAGE_RW is 0x2. So consider the accumulation line:

        rw &= pXd_flags(*pXd) & _PAGE_RW;

where rw=0x1 and the right side evaluates down to 0x2. It'll end up doing:

        rw = 0x1 & 0x2

and rw always ends up 0.

This way rw becomes false at the first level walked, regardless of the
actual permissions, and verify_rwx() treats every mapping as non-writable
and never reports a W^X violation.

Add double negation to the right side to normalize the _PAGE_RW flag to
0 or 1.

Assisted-by: Copilot:claude-opus-4.8
Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: syzbot@syzkaller.appspotmail.com
Tested-by: Atish Patra <atishp@meta.com>
Tested-by: Nikunj A Dadhania <nikunj@amd.com>
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260813-cpa-fixes-v2-5-39b4ff90f91d@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/pat/set_memory.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 62e7c4ee06f9d6..12b7de5f0957e9 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -753,7 +753,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
 
 	*level = PG_LEVEL_512G;
 	*nx |= pgd_flags(*pgd) & _PAGE_NX;
-	*rw &= pgd_flags(*pgd) & _PAGE_RW;
+	*rw &= !!(pgd_flags(*pgd) & _PAGE_RW);
 
 	p4d = p4d_offset(pgd, address);
 	if (p4d_none(*p4d))
@@ -764,7 +764,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
 
 	*level = PG_LEVEL_1G;
 	*nx |= p4d_flags(*p4d) & _PAGE_NX;
-	*rw &= p4d_flags(*p4d) & _PAGE_RW;
+	*rw &= !!(p4d_flags(*p4d) & _PAGE_RW);
 
 	pud = pud_offset(p4d, address);
 	if (pud_none(*pud))
@@ -775,7 +775,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
 
 	*level = PG_LEVEL_2M;
 	*nx |= pud_flags(*pud) & _PAGE_NX;
-	*rw &= pud_flags(*pud) & _PAGE_RW;
+	*rw &= !!(pud_flags(*pud) & _PAGE_RW);
 
 	pmd = pmd_offset(pud, address);
 	if (pmd_none(*pmd))
@@ -786,7 +786,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
 
 	*level = PG_LEVEL_4K;
 	*nx |= pmd_flags(*pmd) & _PAGE_NX;
-	*rw &= pmd_flags(*pmd) & _PAGE_RW;
+	*rw &= !!(pmd_flags(*pmd) & _PAGE_RW);
 
 	return pte_offset_kernel(pmd, address);
 }

From 058173bce103b6ac405b2bbf61e29a7f3767348f Mon Sep 17 00:00:00 2001
From: Yosry Ahmed <yosry@kernel.org>
Date: Thu, 3 Sep 2026 22:32:58 +0000
Subject: [PATCH 0919/1982] KVM: SVM: Trigger new ASID allocation in both VMCBs
 on pCPU switch

commit bf260dc9e7b8bfcd06c1a8e739797b1cf0917c72 upstream.

When the pCPU where the VMCB was most recently used is switched, reset
the ASID generation in both VMCBs, triggering new ASID allocation for
the immediate VMRUN as well as the next VMRUN on the other VMCB.

The ASID is shared between vmcb01 and vmcb02, and gets flushed on every
nested transition. However, since pCPU tracking is done per VMCB, it is
possible for one VMCB to allocate a new ASID when migrated to a new
pCPU, and then the other VMCB reuses that ASID on the old pCPU. This can
result in the same ASID being used by multiple vCPUs on the old pCPU.

Example scenario:
- vCPU runs on pCPU A, vmcb01 is active, asid=1.
- vCPU migrates to pCPU B, vmcb01 pCPU changes, new asid=2.
- Another vCPU runs on pCPU A and allocates asid=2 as well.
- vCPU migrates back to pCPU A, and then switches to vmcb02 before it
  runs again with vmcb01.
- No pCPU switch is detected for vmcb02, so VMRUN is done with asid=2.
- Two vCPUs end up using asid=2 on the same pCPU.

Keep the VMCB dirtying to the active VMCB only. Clean bits are tracked
by a pCPU for each VMCB, so do not unnecessarily dirty a VMCB if its
pCPU does not change.

Additionally, initialize the tracked pCPU for vmcb02 to -1 on nested
enablement as hardening, so that a new ASID allocation is always
triggered when nested is disabled and re-enabled.

No performance regression was noticed when overcommitting L1 vCPUs in L0
(to force rescheduling), pinning L1 <-> L2 vCPUs, and running CPUID in a
tight loop bouncing between 2 vCPUs in L2.

An alternative (and perhaps more proper) fix would be tracking the ASID
per-VMCB instead (e.g. [1]). However, that's a more involved change, and
it would result in having different ASIDs for L1 and L2 without actually
properly maintaining them. It would probably work because all TLB
flushes target the current VMCB, and the other VMCB is always flushed on
nested transitions, but the code ends up in an arguably more fragile
state. Punt a proper clean fix to an incoming (and overdue) overhaul of
SVM's ASID usage [2].

[1] https://lore.kernel.org/lkml/20250205182402.2147495-2-yosry.ahmed@linux.dev
[2] https://lore.kernel.org/kvm/20260728003557.1136583-1-yosry@kernel.org

Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Nikunj A Dadhania <nikunj@amd.com>
Link: https://patch.msgid.link/20260903223258.486034-1-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/nested.c |  1 +
 arch/x86/kvm/svm/svm.c    | 19 +++++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 867a1ec004e9b3..0be0615595b692 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1346,6 +1346,7 @@ int svm_allocate_nested(struct vcpu_svm *svm)
 	if (!svm->nested.msrpm)
 		goto err_free_vmcb02;
 
+	svm->nested.vmcb02.cpu = -1;
 	svm->nested.initialized = true;
 	return 0;
 
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index e31f807f65aa34..16022d518ff3ff 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3613,14 +3613,25 @@ static int pre_svm_run(struct kvm_vcpu *vcpu)
 	struct vcpu_svm *svm = to_svm(vcpu);
 
 	/*
-	 * If the previous vmrun of the vmcb occurred on a different physical
-	 * cpu, then mark the vmcb dirty and assign a new asid.  Hardware's
-	 * vmcb clean bits are per logical CPU, as are KVM's asid assignments.
+	 * If the previous VMRUN of the VMCB occurred on a different physical
+	 * cpu, then mark the VMCB dirty as hardware's clean bits are per pCPU.
+	 *
+	 * Reset the ASID generation in both VMCBs. This will lead to assigning
+	 * a new ASID now, and then again when switching to the other VMCB.
+	 * However, this is needed as the ASID is shared between the VMCBs, and
+	 * otherwise it would be possible to use an ASID allocated on one pCPU
+	 * on another, for example:
+	 * - vCPU migrates from pCPU A to pCPU B, allocates a new ASID.
+	 * - vCPU migrates back to pCPU A, and then switches the VMCB.
+	 * - The new VMCB does not detect a pCPU change and runs on pCPU A with
+	 *   the new ASID allocated on pCPU B, which is potentially used by
+	 *   another vCPU/VM.
 	 */
 	if (unlikely(svm->current_vmcb->cpu != vcpu->cpu)) {
-		svm->current_vmcb->asid_generation = 0;
 		vmcb_mark_all_dirty(svm->vmcb);
 		svm->current_vmcb->cpu = vcpu->cpu;
+		svm->vmcb01.asid_generation = 0;
+		svm->nested.vmcb02.asid_generation = 0;
         }
 
 	if (sev_guest(vcpu->kvm))

From a4c2d0a9a9019e71c94ff2b8f56b8f7fc97bd71d Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 2 Sep 2026 16:20:25 -0700
Subject: [PATCH 0920/1982] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when
 preparing L2 state

commit 1c4c84a643b704e473cb171f7b61359ff29b12a4 upstream.

Force EFER.LMA=0 if EFER.LME=0 when preparing L2 state for VMRUN, i.e.
mimic real hardware's behavior of ignoring EFER.LMA if EFER.LME=0.  VMRUN
unfortunately allows the nonsensical combination, i.e. doesn't fail, but
KVM itself has an invariant EFER.LMA can be set et if and only if EFER.LME
is set.   Breaking that invariant can lead to a variety of issue,
particularly in MMU code that keys off EFER.LMA when determining whether to
emulate/virtualization 4/5-level paging versus PAE paging.

Cc: stable@vger.kernel.org
Cc: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260902232028.2767071-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/nested.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 0be0615595b692..064a2bb9cf8ede 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -671,6 +671,10 @@ static void nested_vmcb02_prepare_save(struct vcpu_svm *svm, struct vmcb *vmcb12
 
 	kvm_set_rflags(vcpu, vmcb12->save.rflags | X86_EFLAGS_FIXED);
 
+	/* SVM ignores EFER.LMA if EFER.LME=0 (instead of failing VMRUN). */
+	if (!(svm->nested.save.efer & EFER_LME))
+		svm->nested.save.efer &= ~EFER_LMA;
+
 	svm_set_efer(vcpu, svm->nested.save.efer);
 
 	svm_set_cr0(vcpu, svm->nested.save.cr0);

From a12e105e9753b641624f170b9c0f26d626103880 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Mon, 21 Sep 2026 17:13:28 -0700
Subject: [PATCH 0921/1982] KVM: Use goto to handle errors during memslot
 preparation

commit 23a205797cec86f391d0be886b9bc741e1262063 upstream.

Use a goto to unwind early memslot changes if preparing for a memslot
operation fails.  This will allow moving the creation of guest_memfd
bindings into kvm_set_memslot() without needing to copy+paste the unwind
logic.

No functional change intended.

Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Link: https://patch.msgid.link/20260922001332.1121266-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 virt/kvm/kvm_main.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index ba09b1dabc4b7e..23e7d1bb80b04d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1937,21 +1937,8 @@ static int kvm_set_memslot(struct kvm *kvm,
 	}
 
 	r = kvm_prepare_memory_region(kvm, old, new, change);
-	if (r) {
-		/*
-		 * For DELETE/MOVE, revert the above INVALID change.  No
-		 * modifications required since the original slot was preserved
-		 * in the inactive slots.  Changing the active memslots also
-		 * release slots_arch_lock.
-		 */
-		if (change == KVM_MR_DELETE || change == KVM_MR_MOVE) {
-			kvm_activate_memslot(kvm, invalid_slot, old);
-			kfree(invalid_slot);
-		} else {
-			mutex_unlock(&kvm->slots_arch_lock);
-		}
-		return r;
-	}
+	if (r)
+		goto err;
 
 	/*
 	 * For DELETE and MOVE, the working slot is now active as the INVALID
@@ -1983,6 +1970,20 @@ static int kvm_set_memslot(struct kvm *kvm,
 	kvm_commit_memory_region(kvm, old, new, change);
 
 	return 0;
+
+err:
+	/*
+	 * For DELETE/MOVE, revert the above INVALID change.  No modifications
+	 * required since the original slot was preserved in the inactive slots.
+	 * Changing the active memslots also release slots_arch_lock.
+	 */
+	if (change == KVM_MR_DELETE || change == KVM_MR_MOVE) {
+		kvm_activate_memslot(kvm, invalid_slot, old);
+		kfree(invalid_slot);
+	} else {
+		mutex_unlock(&kvm->slots_arch_lock);
+	}
+	return r;
 }
 
 static bool kvm_check_memslot_overlap(struct kvm_memslots *slots, int id,

From 196450c52f3517e4b7d6199e3841485e11c6f7c8 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Thu, 3 Sep 2026 18:03:46 -0700
Subject: [PATCH 0922/1982] KVM: VMX: Disallow using to_vmx() in common VT code

commit f305fd31f52a8d3ce4d2bf0c88c45bb7a373809c upstream.

Poison to_vmx() in main.c and posted_intr.c so that attempting to interpret
the vCPU as a VMX vCPU will fail at compile time, as opposed to failing at
runtime, or worse corrupting state without outright failing.

Note, to_tdx() is buried in tdx.c, i.e. isn't broadly reachable, and so
doesn't need the same treatment as to_vmx().

Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Tested-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260904010353.3175819-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/main.c        | 2 ++
 arch/x86/kvm/vmx/posted_intr.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index 0eb2773b2ae235..5fd9ff0bfab6ba 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -10,6 +10,8 @@
 #include "tdx.h"
 #include "tdx_arch.h"
 
+#pragma GCC poison to_vmx
+
 #ifdef CONFIG_KVM_INTEL_TDX
 static_assert(offsetof(struct vcpu_vmx, vt) == offsetof(struct vcpu_tdx, vt));
 
diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 4a6d9a17da238c..24221ba553be18 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -14,6 +14,8 @@
 #include "vmx.h"
 #include "tdx.h"
 
+#pragma GCC poison to_vmx
+
 /*
  * Maintain a per-CPU list of vCPUs that need to be awakened by wakeup_handler()
  * when a WAKEUP_VECTOR interrupted is posted.  vCPUs are added to the list when

From 4ef5e623d2fe29a48a497f96b06ade68034718de Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 19 Aug 2026 17:49:01 +0800
Subject: [PATCH 0923/1982] KVM: VMX: Make handle_bus_lock_vmexit() a shared
 helper

commit 326fa2c9b4d3e6cab58c139eb55aaabd7179192e upstream.

Move handle_bus_lock_vmexit() from vmx.c to main.c to make it a shared
helper so that TDX can use it for Bus Lock VM exit handling as well.
Rename it to add vt_ prefix to reflect that it is a helper for both VMX
and TDX.

Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://patch.msgid.link/20260819094903.3060020-8-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/common.h |  1 +
 arch/x86/kvm/vmx/main.c   | 11 +++++++++++
 arch/x86/kvm/vmx/vmx.c    | 13 +------------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/arch/x86/kvm/vmx/common.h b/arch/x86/kvm/vmx/common.h
index 412d0829d7a217..a02d7c003475a2 100644
--- a/arch/x86/kvm/vmx/common.h
+++ b/arch/x86/kvm/vmx/common.h
@@ -176,5 +176,6 @@ static inline void __vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu,
 }
 
 noinstr void vmx_handle_nmi(struct kvm_vcpu *vcpu);
+int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu);
 
 #endif /* __KVM_X86_VMX_COMMON_H */
diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index 5fd9ff0bfab6ba..30c4c833b46132 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -849,6 +849,17 @@ static int vt_gmem_max_mapping_level(struct kvm *kvm, kvm_pfn_t pfn,
 #define vt_op_tdx_only(name) NULL
 #endif /* CONFIG_KVM_INTEL_TDX */
 
+int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu)
+{
+	/*
+	 * Hardware may or may not set the BUS_LOCK_DETECTED flag on BUS_LOCK
+	 * VM-Exits. Unconditionally set the flag here and leave the handling
+	 * to .handle_exit() callback.
+	 */
+	to_vt(vcpu)->exit_reason.bus_lock_detected = true;
+	return 1;
+}
+
 #define VMX_REQUIRED_APICV_INHIBITS				\
 	(BIT(APICV_INHIBIT_REASON_DISABLED) |			\
 	 BIT(APICV_INHIBIT_REASON_ABSENT) |			\
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 5bae3d5ce6eec2..11662ebdb7f6aa 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6052,17 +6052,6 @@ static int handle_encls(struct kvm_vcpu *vcpu)
 }
 #endif /* CONFIG_X86_SGX_KVM */
 
-static int handle_bus_lock_vmexit(struct kvm_vcpu *vcpu)
-{
-	/*
-	 * Hardware may or may not set the BUS_LOCK_DETECTED flag on BUS_LOCK
-	 * VM-Exits. Unconditionally set the flag here and leave the handling to
-	 * vmx_handle_exit().
-	 */
-	to_vt(vcpu)->exit_reason.bus_lock_detected = true;
-	return 1;
-}
-
 static int handle_notify(struct kvm_vcpu *vcpu)
 {
 	unsigned long exit_qual = vmx_get_exit_qual(vcpu);
@@ -6162,7 +6151,7 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
 	[EXIT_REASON_VMFUNC]		      = handle_vmx_instruction,
 	[EXIT_REASON_PREEMPTION_TIMER]	      = handle_preemption_timer,
 	[EXIT_REASON_ENCLS]		      = handle_encls,
-	[EXIT_REASON_BUS_LOCK]                = handle_bus_lock_vmexit,
+	[EXIT_REASON_BUS_LOCK]                = vt_handle_bus_lock_vmexit,
 	[EXIT_REASON_NOTIFY]		      = handle_notify,
 	[EXIT_REASON_SEAMCALL]		      = handle_tdx_instruction,
 	[EXIT_REASON_TDCALL]		      = handle_tdx_instruction,

From 87152138116af6c9fc4e4e682c1ca087e2062323 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 19 Aug 2026 17:49:00 +0800
Subject: [PATCH 0924/1982] KVM: VMX: Preserve negative return value in
 vmx_handle_exit() with bus lock detected

commit cef48693da1e964e9f192bfc16cd0ed287c48337 upstream.

Preserve the negative return value from __vmx_handle_exit() when a bus
lock is detected, instead of always overwriting it with 0.

The purpose of bus_lock_detected handling is to force a userspace exit to
inform userspace that a bus lock happened. The negative return value can
achieve this purpose, and changing the negative value to 0 fails to return
an error to userspace. So, preserve the negative return value.

Fixes: fe6b6bc802b4 ("KVM: VMX: Enable bus lock VM exit")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260805034602.5B2BB1F000E9@smtp.kernel.org/
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-7-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 11662ebdb7f6aa..2b50db2c633db9 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6645,11 +6645,12 @@ int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
 	 * a bus lock in guest.
 	 */
 	if (vmx_get_exit_reason(vcpu).bus_lock_detected) {
-		if (ret > 0)
+		if (ret > 0) {
 			vcpu->run->exit_reason = KVM_EXIT_X86_BUS_LOCK;
+			ret = 0;
+		}
 
 		vcpu->run->flags |= KVM_RUN_X86_BUS_LOCK;
-		return 0;
 	}
 	return ret;
 }

From 54afd548602bb96b3fbb0b4b11ccbbfeb5fb46fc Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 2 Sep 2026 16:20:26 -0700
Subject: [PATCH 0925/1982] KVM: x86/mmu: Bug the VM if KVM attempts to walk
 more levels than the MMU has

commit 115f9405a2ed6d78ee7ad8436bdd638743f6d1d4 upstream.

Extend the "EFER.LMA && !CR4.PAE" check, which exists largely to guard
against KVM configuring a paging32 MMU with more than 2 levels of paging,
with a very explicit check for exactly that: that KVM isn't trying to walk
more levels of paging than the MMU template provides.  I.e. harden KVM
against all bugs that would cause KVM to generates accesses beyond the
bounds of guest_walker's arrays, regardless of how KVM ended up with the
misconfigured MMU.

Note, don't use w->cpu_role.base.level directly as the paging64 template
only provides two levels of page tables for PAE paging on 32-bit hosts, and
handles the third level by manually emulating the PDPTR access.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260902232028.2767071-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/paging_tmpl.h | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index a298955834d0be..4e84b5a1eeaaad 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -349,13 +349,14 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
 	pte_access = ~0;
 
 	/*
-	 * Queue a page fault for injection if this assertion fails, as callers
-	 * assume that walker.fault contains sane info on a walk failure.  I.e.
-	 * avoid making the situation worse by inducing even worse badness
-	 * between when the assertion fails and when KVM kicks the vCPU out to
-	 * userspace (because the VM is bugged).
+	 * Queue a page fault for injection if any of the below assertions fail,
+	 * as callers assume that walker.fault contains sane info on a walk
+	 * failure.  I.e. avoid making the situation worse by inducing even
+	 * worse badness between when the assertion fails and when KVM kicks
+	 * the vCPU out to userspace (because the VM is bugged).
 	 */
-	if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm))
+	if (KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm) ||
+	    KVM_BUG_ON(walker->max_level > PT_MAX_FULL_LEVELS, vcpu->kvm))
 		goto error;
 
 	++walker->level;

From fea3d340226302c89a4a790f6904479818b0ba3a Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 2 Sep 2026 16:20:27 -0700
Subject: [PATCH 0926/1982] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role
 with EFER.LMA=1 && CR4.PAE=0

commit 34dacbe7ae93f2d3c26cd0bf3e08200b1fa2c180 upstream.

Bug the VM if KVM attempts to construct a CPU role with the should-be-
impossible combination of long mode being active without PAE paging being
enabled.  KVM's MMU construction assumes that EFER.LMA can be set if and
only CR4.PAE is set, and will create a completely invalid MMU if that
assumption fails.  FNAME(walk_addr_generic) already has sanity checks to
try and mitigate the fallout, but attempt to catch such bugs earlier, as
this is (at least) the second time KVM has had bugs that escaped into
FNAME(walk_addr_generic), and it's entirely possible the bad state could
cause problems elsewhere.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260902232028.2767071-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index d365bba579d280..551d707a4f27bb 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -5639,6 +5639,9 @@ static union kvm_cpu_role kvm_calc_cpu_role(struct kvm_vcpu *vcpu,
 		return role;
 	}
 
+	if (KVM_BUG_ON(____is_efer_lma(regs) && !____is_cr4_pae(regs), vcpu->kvm))
+		*(u64 *)&regs->efer &= ~EFER_LMA;
+
 	role.base.efer_nx = ____is_efer_nx(regs);
 	role.base.cr0_wp = ____is_cr0_wp(regs);
 	role.base.smep_andnot_wp = ____is_cr4_smep(regs) && !____is_cr0_wp(regs);

From b7af8dc92af17e107d15360e62470ec862fa3d7f Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Mon, 31 Aug 2026 22:26:37 +0100
Subject: [PATCH 0927/1982] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info
 registration

commit eacdb76c5f04956035c5d7f7e1973028f30684a2 upstream.

Xen's map_guest_area() enforces that vcpu_info is aligned to
sizeof(xen_ulong_t). KVM has no such check, allowing a guest to
register vcpu_info at an arbitrary byte alignment.

Enforce unconditional 4-byte alignment regardless of the current
shinfo mode. This is sufficient because subsequent commits ensure
that all locked atomic operations on vcpu_info fields use at most
32-bit accesses. Return -ENXIO on failure, matching Xen's
map_guest_area() behaviour for unaligned requests.

Originally observed in review of an unrelated patch:
https://lore.kernel.org/all/20260604193554.1BA311F00893@smtp.kernel.org/

Cc: stable@vger.kernel.org
Fixes: 73e69a86347a ("KVM: x86/xen: register vcpu info")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260604193554.1BA311F00893@smtp.kernel.org
Assisted-by: Kiro:claude-opus-4.6-1m
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Link: https://patch.msgid.link/20260831213632.81023-7-dwmw2@infradead.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/xen.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index d6b2a665b499dc..a03a8c06eb07a4 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -926,6 +926,10 @@ int kvm_xen_vcpu_set_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data)
 				break;
 			}
 
+			r = -ENXIO;
+			if (!IS_ALIGNED(data->u.gpa, sizeof(u32)))
+				break;
+
 			r = kvm_gpc_activate(&vcpu->arch.xen.vcpu_info_cache,
 					     data->u.gpa, sizeof(struct vcpu_info));
 		} else {
@@ -935,6 +939,10 @@ int kvm_xen_vcpu_set_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data)
 				break;
 			}
 
+			r = -ENXIO;
+			if (!IS_ALIGNED(data->u.hva, sizeof(u32)))
+				break;
+
 			r = kvm_gpc_activate_hva(&vcpu->arch.xen.vcpu_info_cache,
 						 data->u.hva, sizeof(struct vcpu_info));
 		}

From 46f5df89f55cc454fa2098fe25b5ee4cd53bfa2f Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Mon, 31 Aug 2026 22:26:41 +0100
Subject: [PATCH 0928/1982] KVM: x86/xen: Take kvm->srcu in
 __kvm_xen_has_interrupt()

commit aa8ad943f242ef14d136c5440b1178de77466c9e upstream.

kvm_gpc_check() checks the cached memslot generation against the current
one, which dereferences kvm->memslots and therefore requires kvm->srcu to
be held. __kvm_xen_has_interrupt() does not take it.

Most callers do happen to hold kvm->srcu, but not all of them:

 - kvm_emulate_halt() on the VM-Exit path, via kvm_vcpu_has_events() and
   kvm_cpu_has_extint(). vcpu_enter_guest() drops the vCPU's SRCU lock
   before entering the guest, so it is not held on the way back out.

 - kvm_vcpu_block() -> kvm_vcpu_check_block() -> kvm_arch_vcpu_runnable(),
   which is the case the existing comment in this function describes.

On a PROVE_RCU kernel the former produces:

  WARNING: suspicious RCU usage
  include/linux/kvm_host.h:1092 suspicious rcu_dereference_check() usage!
  ...
   kvm_gpc_check+0x344/0x3e0 [kvm]
   __kvm_xen_has_interrupt+0x83/0x310 [kvm]
   kvm_cpu_has_extint+0x1ff/0x370 [kvm]
   kvm_cpu_has_interrupt+0x16/0x100 [kvm]
   kvm_vcpu_has_events+0x4ce/0x690 [kvm]
   kvm_emulate_halt+0x52/0x1f0 [kvm]
   vmx_vcpu_run+0x988/0x2630 [kvm_intel]

Use guard(srcu) so that the three existing early returns don't each need
an explicit unlock. SRCU read sections nest, so this is harmless on the
paths which already hold it, and srcu_read_lock() does not sleep, so it
is also safe in the atomic case which this function already handles.

Fixes: 7caf9571563e ("KVM: x86/xen: Use gfn_to_pfn_cache for vcpu_info")
Cc: stable@vger.kernel.org
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Assisted-by: Claude:claude-mythos-5
Reviewed-by: Paul Durrant <paul@xen.org>
Link: https://patch.msgid.link/20260831213632.81023-11-dwmw2@infradead.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/xen.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index a03a8c06eb07a4..19148bd3327e4e 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -713,6 +713,16 @@ int __kvm_xen_has_interrupt(struct kvm_vcpu *v)
 	BUILD_BUG_ON(sizeof(rc) !=
 		     sizeof_field(struct compat_vcpu_info, evtchn_upcall_pending));
 
+	/*
+	 * kvm_gpc_check() checks the memslot generation, so kvm->srcu must be
+	 * held. Most callers hold it already, but this is also reached from
+	 * kvm_emulate_halt() on the VM-Exit path and from kvm_vcpu_block(),
+	 * where vcpu_enter_guest() has already dropped the vCPU's SRCU lock.
+	 * Taking SRCU does not sleep, so it is safe even in the atomic case
+	 * which is handled below.
+	 */
+	guard(srcu)(&v->kvm->srcu);
+
 	read_lock_irqsave(&gpc->lock, flags);
 	while (!kvm_gpc_check(gpc, sizeof(struct vcpu_info))) {
 		read_unlock_irqrestore(&gpc->lock, flags);

From 8239d357a9373f985d5921e3dc12c137d130a283 Mon Sep 17 00:00:00 2001
From: Keqiang Duan <duankeqiangcym@gmail.com>
Date: Thu, 20 Aug 2026 20:35:12 +0800
Subject: [PATCH 0929/1982] KVM: x86: Clear hardware HLT state when userspace
 makes a vCPU not-halted

commit 883719f57f5d3898637b130d6db4742471cad618 upstream.

Force a vCPU out of its hardware-tracked halted state when userspace puts
the vCPU into any state other than HALTED via KVM_SET_MP_STATE, i.e. clear
VMCS.GUEST_ACTIVITY_STATE if it says the vCPU is halted.  Add an optional
kvm_x86_ops hook to do the clearing, as SVM has no equivalent VMCB field.

When HLT-exiting is disabled for a VM (KVM_CAP_X86_DISABLE_EXITS with
KVM_X86_DISABLE_EXITS_HLT, e.g. QEMU's "-overcommit cpu-pm=on"), a guest
HLT halts the physical CPU instead of exiting to KVM, and hardware saves
GUEST_ACTIVITY_STATE=HLT into the VMCS on the next VM-Exit.  That field is
sticky: it survives VM-Exit/VM-Enter and is only cleared by vmx_clear_hlt()
on event injection, or by vmx_vcpu_reset() on INIT / vCPU creation.

Nothing clears it on a userspace-driven state change.  KVM_SET_REGS only
writes the software register cache and KVM_SET_MP_STATE only writes
vcpu->arch.mp_state; kvm_vcpu_running() likewise consults software state
only.  A VMM that emulates a machine reset therefore ends up with a vCPU
that KVM happily VM-Enters while hardware refuses to fetch instructions.

Reproduce with a Linux guest by triggering a panic/kdump on a non-boot
vCPU: nmi_shootdown_cpus() parks the other vCPUs -- including vCPU0 -- in
crash_nmi_callback(), which does local_irq_disable() followed by a bare
HLT.  The capture kernel then resets the machine via port 0xCF9.  QEMU
rewrites RIP to 0xfff0 and sets mp_state to RUNNABLE, but vCPU0's
GUEST_ACTIVITY_STATE is still HLT, so the BSP never executes the reset
vector, never sends SIPIs, and the entire VM hangs at "reboot: machine
restart" forever.  Only destroying and recreating the VM recovers it.

Key off "not HALTED" rather than "is RUNNABLE" as HALTED is the only target
state for which retaining the hardware halted state is meaningful; every
other transition either can't be reached on VMX, e.g. AP_RESET_HOLD, or
goes through vmx_vcpu_reset(), which stuffs GUEST_ACTIVITY_ACTIVE anyways.
This also captures the intent more directly: KVM only ever drops the
hardware halted state, it never installs it.

Hook KVM_SET_MP_STATE rather than the VM-Enter path so that the clearing
is driven by an explicit userspace declaration, and so that no work is
added to vmx_vcpu_run().  Gate the call on kvm_hlt_in_guest() even though
vmx_clear_hlt() checks it as well, as the check is cheap and makes it
obvious in common code when the hardware state can exist at all.

Do nothing for TDX vCPUs as TDX doesn't support disabling HLT-exiting and
KVM cannot access a TD's VMCS, i.e. the VMCS used to run the vCPU can't
in HALTED state, and even if it were, KVM can't change it.

Fixes: caa057a2cad6 ("KVM: X86: Provide a capability to disable HLT intercepts")
Cc: stable@vger.kernel.org
Tested-by: Qinguang Chen <chenqinguang@kuaishou.com>
Signed-off-by: Zhiping Du <duzhiping@kuaishou.com>
Signed-off-by: Keqiang Duan <duankeqiangcym@gmail.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Link: https://patch.msgid.link/20260820123512.87236-1-duankeqiangcym@gmail.com
[sean: drop claim that spurious wakeups are ok, massage changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/kvm-x86-ops.h |  1 +
 arch/x86/include/asm/kvm_host.h    |  7 +++++++
 arch/x86/kvm/vmx/main.c            | 13 +++++++++++++
 arch/x86/kvm/vmx/vmx.c             |  2 +-
 arch/x86/kvm/vmx/x86_ops.h         |  1 +
 arch/x86/kvm/x86.c                 | 13 +++++++++++++
 6 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h
index 617c5a44a96d0d..40a263b6b50f8b 100644
--- a/arch/x86/include/asm/kvm-x86-ops.h
+++ b/arch/x86/include/asm/kvm-x86-ops.h
@@ -80,6 +80,7 @@ KVM_X86_OP(interrupt_allowed)
 KVM_X86_OP(nmi_allowed)
 KVM_X86_OP(get_nmi_mask)
 KVM_X86_OP(set_nmi_mask)
+KVM_X86_OP_OPTIONAL(clear_hlt)
 KVM_X86_OP(enable_nmi_window)
 KVM_X86_OP(enable_irq_window)
 KVM_X86_OP_OPTIONAL(update_cr8_intercept)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index e1a59ec4c68bdf..319aeac052f14e 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1824,6 +1824,13 @@ struct kvm_x86_ops {
 	int (*nmi_allowed)(struct kvm_vcpu *vcpu, bool for_injection);
 	bool (*get_nmi_mask)(struct kvm_vcpu *vcpu);
 	void (*set_nmi_mask)(struct kvm_vcpu *vcpu, bool masked);
+	/*
+	 * Force the vCPU out of any hardware-tracked halted/inactive state so
+	 * that it will fetch and execute instructions on the next VM-Enter.
+	 * Only needed by VMX, where VMCS.GUEST_ACTIVITY_STATE persists across
+	 * VM-Exit/VM-Enter; SVM has no equivalent VMCB field.
+	 */
+	void (*clear_hlt)(struct kvm_vcpu *vcpu);
 	/* Whether or not a virtual NMI is pending in hardware. */
 	bool (*is_vnmi_pending)(struct kvm_vcpu *vcpu);
 	/*
diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
index 30c4c833b46132..4cba80e238b759 100644
--- a/arch/x86/kvm/vmx/main.c
+++ b/arch/x86/kvm/vmx/main.c
@@ -590,6 +590,18 @@ static void vt_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
 	vmx_set_nmi_mask(vcpu, masked);
 }
 
+static void vt_clear_hlt(struct kvm_vcpu *vcpu)
+{
+	/*
+	 * TDX doesn't support disabling HLT-exiting, and KVM can't access a
+	 * TD's VMCS, so there is never any hardware halted state to clear.
+	 */
+	if (is_td_vcpu(vcpu))
+		return;
+
+	vmx_clear_hlt(vcpu);
+}
+
 static void vt_enable_nmi_window(struct kvm_vcpu *vcpu)
 {
 	/* Refer to the comments in tdx_inject_nmi(). */
@@ -947,6 +959,7 @@ struct kvm_x86_ops vt_x86_ops __initdata = {
 	.nmi_allowed = vt_op(nmi_allowed),
 	.get_nmi_mask = vt_op(get_nmi_mask),
 	.set_nmi_mask = vt_op(set_nmi_mask),
+	.clear_hlt = vt_op(clear_hlt),
 	.enable_nmi_window = vt_op(enable_nmi_window),
 	.enable_irq_window = vt_op(enable_irq_window),
 	.update_cr8_intercept = vt_op(update_cr8_intercept),
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 2b50db2c633db9..0afbfbd4cfb115 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1772,7 +1772,7 @@ int vmx_skip_emulated_instruction(struct kvm_vcpu *vcpu)
 	return skip_emulated_instruction(vcpu);
 }
 
-static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
+void vmx_clear_hlt(struct kvm_vcpu *vcpu)
 {
 	/*
 	 * Ensure that we clear the HLT state in the VMCS.  We don't need to
diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
index 9697368d65b3a1..889fbcd88ea2a3 100644
--- a/arch/x86/kvm/vmx/x86_ops.h
+++ b/arch/x86/kvm/vmx/x86_ops.h
@@ -95,6 +95,7 @@ int vmx_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection);
 int vmx_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection);
 bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
 void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
+void vmx_clear_hlt(struct kvm_vcpu *vcpu);
 void vmx_enable_nmi_window(struct kvm_vcpu *vcpu);
 void vmx_enable_irq_window(struct kvm_vcpu *vcpu);
 void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 044c3601c4aa0a..203f67feda8f81 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11698,6 +11698,19 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
 	}
 
 	kvm_set_mp_state(vcpu, mp_state->mp_state);
+
+	/*
+	 * Force the vCPU out of any hardware-tracked halted state, e.g. VMX's
+	 * GUEST_ACTIVITY_STATE=HLT, when userspace puts the vCPU into a state
+	 * other than HALTED.  The hardware state is sticky across VM-Exit and
+	 * VM-Enter and is not touched by any other ioctl, so a vCPU that halted
+	 * with HLT-exiting disabled stays wedged even after userspace rewrites
+	 * its registers, e.g. when a VMM emulates a machine reset.
+	 */
+	if (kvm_hlt_in_guest(vcpu->kvm) &&
+	    mp_state->mp_state != KVM_MP_STATE_HALTED)
+		kvm_x86_call(clear_hlt)(vcpu);
+
 	kvm_make_request(KVM_REQ_EVENT, vcpu);
 
 	ret = 0;

From a58917a271cb48ece05208111f9e0ea8891316b0 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 30 Sep 2026 12:36:23 -0700
Subject: [PATCH 0930/1982] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when
 delivering #DB payload

commit 719a1d58bf43edd03b271df90b67c58c1e9a7da4 upstream.

Preserve Bus Lock Detect if it isn't present in the payload.  Unlike RTM,
which is explicitly modified on every #DB,  DR6.BLD is modified if and only
if the #DB is due to a (coincident) Bus Lock Detect.

Per Intel's SDM:

  Other debug exceptions do not modify this bit.

And AMD's APM

  All other #DB exceptions leave DR6[BLD] unmodified,

Restore the explicit RTM handling that was clobbered by commit
9a3ecd5e2aa1 ("KVM: X86: Rename DR6_INIT to DR6_ACTIVE_LOW"), as the
semantics of any given bit are feature specific, i.e. are obviously not
consistent for active-high versus active-low.  In other words, while the
bug was technically introduced when support for Bus Lock Detect was added,
it's really that attempt to genericize handling of active-low bits that set
KVM up to fail.

Fixes: e8ea85fb280e ("KVM: X86: Add support for the emulation of DR6_BUS_LOCK bit")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260930193634.3415089-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 52 ++++++++++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 203f67feda8f81..0da4c2408d7f97 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -770,30 +770,37 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,
 	switch (ex->vector) {
 	case DB_VECTOR:
 		/*
-		 * "Certain debug exceptions may clear bit 0-3.  The
-		 * remaining contents of the DR6 register are never
-		 * cleared by the processor".
-		 */
-		vcpu->arch.dr6 &= ~DR_TRAP_BITS;
-		/*
-		 * In order to reflect the #DB exception payload in guest
-		 * dr6, three components need to be considered: active low
-		 * bit, FIXED_1 bits and active high bits (e.g. DR6_BD,
-		 * DR6_BS and DR6_BT)
-		 * DR6_ACTIVE_LOW contains the FIXED_1 and active low bits.
-		 * In the target guest dr6:
-		 * FIXED_1 bits should always be set.
-		 * Active low bits should be cleared if 1-setting in payload.
-		 * Active high bits should be set if 1-setting in payload.
+		 * DR6 is a mess.  Reserved/unused bits are fixed-to-1, and so
+		 * to maintain backwards compatibility with existing software,
+		 * features that use previously-reserved bits have active-low
+		 * semantics, i.e. clear the bit when the feature is present in
+		 * the payload.
+		 *
+		 * Further complicating matters, some DR6 bits are preserved by
+		 * hardware, while others are explicitly modified on every #DB.
+		 * The trap bits are always set based on the payload, as is the
+		 * RTM flag (but it's active low).  All other bits are modified
+		 * if and only if a relevant debug exception occurs, e.g. BD,
+		 * BS, and BT are never cleared by hardware, and BLD is never
+		 * set by hardware (when supported, excepting RESET).
 		 *
-		 * Note, the payload is compatible with the pending debug
-		 * exceptions/exit qualification under VMX, that active_low bits
-		 * are active high in payload.
-		 * So they need to be flipped for DR6.
+		 * Lastly, the payload does NOT have active-low semantics, e.g.
+		 * so that it's compatible VMX's pending debug exceptions and
+		 * qualification fields, and to avoid bleeding the DR6 madness
+		 * into other KVM code.
+		 *
+		 * To compute DR6:
+		 *
+		 *  1. "Reset" the bits that are modified on all #DBs
+		 *  2. Clear active-low bits that are present in the payload.
+		 *  3. Set active-high bits that are present in the payload.
+		 *  4. Clear fixed-0 bits.
+		 *  5. Set fixed-1 bits.
 		 */
-		vcpu->arch.dr6 |= DR6_ACTIVE_LOW;
-		vcpu->arch.dr6 |= ex->payload;
-		vcpu->arch.dr6 ^= ex->payload & DR6_ACTIVE_LOW;
+		vcpu->arch.dr6 &= ~DR_TRAP_BITS;
+		vcpu->arch.dr6 |= DR6_RTM;
+		vcpu->arch.dr6 &= ~(ex->payload & DR6_ACTIVE_LOW);
+		vcpu->arch.dr6 |= (ex->payload & ~DR6_ACTIVE_LOW);
 
 		/*
 		 * The #DB payload is defined as compatible with the 'pending
@@ -802,6 +809,7 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,
 		 * breakpoint), it is reserved and must be zero in DR6.
 		 */
 		vcpu->arch.dr6 &= ~BIT(12);
+		vcpu->arch.dr6 |= DR6_FIXED_1;
 		break;
 	case PF_VECTOR:
 		vcpu->arch.cr2 = ex->payload;

From a92a07205e010029796b35924655aebb903b2e7c Mon Sep 17 00:00:00 2001
From: Loc Nguyen <loc@ryzome.com>
Date: Fri, 2 Oct 2026 05:42:54 +0000
Subject: [PATCH 0931/1982] KVM: x86: Request event processing for exception
 VM-Exits

commit 88b23a2e8286b7016c3b58dc10093cf28c22aa3d upstream.

Request event processing whenever kvm_queue_exception_vmexit() queues an
exception VM-Exit.  Most callers reach the helper through
kvm_multiple_exception(), which already sets KVM_REQ_EVENT, but nested
asynchronous page faults call it directly.

Without another event request, vcpu_enter_guest() skips
kvm_check_and_inject_events() and re-enters L2.  A subsequent VM-Exit can
clear the pending exception while reconstructing vectoring state, losing
the synthetic #PF VM-Exit.  The APF reason remains PAGE_NOT_PRESENT and a
later regular #PF can consume the stale value.

Setting KVM_REQ_EVENT in the common helper ensures that L1 receives the
queued VM-Exit before KVM re-enters L2.

Fixes: 7709aba8f716 ("KVM: x86: Morph pending exceptions to pending VM-Exits at queue time")
Cc: stable@vger.kernel.org
Signed-off-by: Loc Nguyen <loc@ryzome.com>
Link: https://patch.msgid.link/20261002053723.3275202-2-loc@ryzome.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0da4c2408d7f97..72f63324643ad3 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -827,6 +827,8 @@ static void kvm_queue_exception_vmexit(struct kvm_vcpu *vcpu, unsigned int vecto
 {
 	struct kvm_queued_exception *ex = &vcpu->arch.exception_vmexit;
 
+	kvm_make_request(KVM_REQ_EVENT, vcpu);
+
 	ex->vector = vector;
 	ex->injected = false;
 	ex->pending = true;

From ec9df57c8e00f189d58d927cc9a1f49592f687af Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <nicoyip.dev@gmail.com>
Date: Wed, 26 Aug 2026 02:39:24 +0800
Subject: [PATCH 0932/1982] KVM: x86: Take SRCU in kvm_zap_gfn_range()

commit b59a87c1ba3c347e8aec5f932eb7abf13064fd62 upstream.

kvm_zap_gfn_range() walks memslots and rmaps and may drop mmu_lock to
reschedule. Callers that do not already hold kvm->srcu (or slots_lock)
can race with memslot deletion: synchronize_srcu_expedited() does not
wait, kvm_free_memslot() frees the old slot and its rmap, and the zap
resumes on freed memory.

The VFIO noncoherent-DMA path hits this by zapping the entire GPA
space without SRCU. KASAN reported:

  BUG: KASAN: vmalloc-out-of-bounds in slot_rmap_walk_next+0x82/0x1c0
  Read of size 8 at addr ffffc900005c1008
  Call Trace:
   slot_rmap_walk_next+0x82/0x1c0
   __kvm_rmap_zap_gfn_range+0x17a/0x280
   kvm_zap_gfn_range+0x2a6/0x6a0
   kvm_vfio_set_attr+0x576/0x770
   kvm_device_ioctl+0x1ff/0x3b0

Take SRCU inside kvm_zap_gfn_range() so every caller is covered.
Nesting with an existing kvm->srcu critical section is fine; the
helper uses a local index. Drop the now-redundant SRCU pair from
__kvm_set_or_clear_apicv_inhibit().

Fixes: 362ff6dca541 ("KVM: x86/mmu: Zap KVM TDP when noncoherent DMA assignment starts/stops")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260825183924.237727-1-nicoyip.dev@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c | 2 ++
 arch/x86/kvm/x86.c     | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 551d707a4f27bb..24f22c10e6774d 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -6876,6 +6876,8 @@ void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)
 	if (WARN_ON_ONCE(gfn_end <= gfn_start))
 		return;
 
+	guard(srcu)(&kvm->srcu);
+
 	write_lock(&kvm->mmu_lock);
 
 	kvm_mmu_invalidate_begin(kvm);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 72f63324643ad3..6576c692a94eb6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10619,10 +10619,8 @@ void __kvm_set_or_clear_apicv_inhibit(struct kvm *kvm,
 		kvm->arch.apicv_inhibit_reasons = new;
 		if (new) {
 			unsigned long gfn = gpa_to_gfn(APIC_DEFAULT_PHYS_BASE);
-			int idx = srcu_read_lock(&kvm->srcu);
 
 			kvm_zap_gfn_range(kvm, gfn, gfn+1);
-			srcu_read_unlock(&kvm->srcu, idx);
 		}
 	} else {
 		kvm->arch.apicv_inhibit_reasons = new;

From ab15e4093e2aff170ea2087ab994f64530a13cba Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 26 Aug 2026 11:44:49 -0700
Subject: [PATCH 0933/1982] KVM: x86: Zero reserved synic flags when delivering
 message to avoid stack leak

commit 2616f497506a772db53e7bb1024cde50b4c165e0 upstream.

Ensure all reserved flags are zeroed when setting the msg_pending flag as
part of SynIC message delivery, as setting only msg_pending can leak seven
bits of kernel stack data to the guest.  E.g. gcc typically uses a
bitwise-OR to set the msg_pending flag, without initializing the on-stack
variable.

Precisely zero the flags, e.g. as opposed to zeroing the entire structure,
to make it somewhat more obvious that the flags *need* to be zeroed.  E.g.
it would be quite easy to misread the initial read of guest memory and
think that zeroing the entire structure is completely superfluous.

Fixes: 3a0e7731724f ("x86: kvm: hyperv: simplify SynIC message delivery")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://patch.msgid.link/20260826184449.814130-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/hyperv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 284adaf508688f..a72348edd239da 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -798,7 +798,9 @@ static int synic_deliver_msg(struct kvm_vcpu_hv_synic *synic, u32 sint,
 		if (no_retry)
 			return 0;
 
+		hv_hdr.message_flags.asu8 = 0;
 		hv_hdr.message_flags.msg_pending = 1;
+
 		r = kvm_vcpu_write_guest_page(vcpu, msg_page_gfn,
 					      &hv_hdr.message_flags,
 					      msg_off +

From c16bdb1a49985f3fe55e35518910d37f1f33b8b3 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 19 Aug 2026 17:48:56 +0800
Subject: [PATCH 0934/1982] KVM: TDX: Check if there is valid exit infos based
 on vp_enter_ret

commit 0966c881ea13be5ec89820c185de4d55568e80ed upstream.

Check if there is valid exit info based on vp_enter_ret instead of relying
on the clobbered Exit Reason, in tdx_get_exit_info().

Current KVM uses "Exit Reason is not equal to the synthesized invalid
Exit Reason, -1u," as the condition to identify there is a real TD Exit
and valid exit infos.  However, there is one issue with this approach:
KVM updates the Exit Reason to the synthesized invalid Exit Reason for
real EPT MISCONFIG as well.  This is a false positive for real EPT
MISCONFIG, which has valid exit infos.

Though the issue can be addressed by changing the handling for real EPT
MISCONFIG to not update the Exit Reason to the synthesized one, relying
on the clobbered Exit Reason itself is brittle.  Instead, check
vp_enter_ret directly to identify if it is a valid Exit Reason.

Fixes: da407fe45908 ("KVM: TDX: Handle EPT violation/misconfig exit")
Cc: stable@vger.kernel.org
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-3-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/tdx.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 7534397defa295..b593295ae4a9f3 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -885,21 +885,27 @@ static __always_inline u32 tdcall_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
 	return EXIT_REASON_TDCALL;
 }
 
-static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+static __always_inline bool tdx_is_exit_reason_valid(u64 vp_enter_ret)
 {
-	struct vcpu_tdx *tdx = to_tdx(vcpu);
-	u32 exit_reason;
-
-	switch (tdx->vp_enter_ret & TDX_SEAMCALL_STATUS_MASK) {
+	switch (vp_enter_ret & TDX_SEAMCALL_STATUS_MASK) {
 	case TDX_SUCCESS:
 	case TDX_NON_RECOVERABLE_VCPU:
 	case TDX_NON_RECOVERABLE_TD:
 	case TDX_NON_RECOVERABLE_TD_NON_ACCESSIBLE:
 	case TDX_NON_RECOVERABLE_TD_WRONG_APIC_MODE:
-		break;
+		return true;
 	default:
-		return -1u;
+		return false;
 	}
+}
+
+static __always_inline u32 tdx_to_vmx_exit_reason(struct kvm_vcpu *vcpu)
+{
+	struct vcpu_tdx *tdx = to_tdx(vcpu);
+	u32 exit_reason;
+
+	if (!tdx_is_exit_reason_valid(tdx->vp_enter_ret))
+		return -1u;
 
 	exit_reason = tdx->vp_enter_ret;
 
@@ -2153,7 +2159,7 @@ void tdx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
 	struct vcpu_tdx *tdx = to_tdx(vcpu);
 
 	*reason = tdx->vt.exit_reason.full;
-	if (*reason != -1u) {
+	if (tdx_is_exit_reason_valid(tdx->vp_enter_ret)) {
 		*info1 = vmx_get_exit_qual(vcpu);
 		*info2 = tdx->ext_exit_qualification;
 		*intr_info = vmx_get_intr_info(vcpu);

From 216729d9780df7d4cf91435af38c8f65d51ce93d Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 19 Aug 2026 17:48:55 +0800
Subject: [PATCH 0935/1982] KVM: TDX: Enable Notify VM exit

commit d93395058c1951bb657c8895dd1fc0f22263f1cc upstream.

Enable Notify VM exit functionality for TDX guests.

Notify VM exit is an existing feature supported by KVM.  Userspace can
enable Notify VM exit through KVM_CAP_X86_NOTIFY_VMEXIT when it's
reported as supported.  However, KVM reports the support of this CAP just
based on the hardware capability but doesn't differentiate between VMX
and TDX.  This leads to the issue that userspace can enable this cap for
TDX guests without getting an error, but the feature is not actually
enabled because KVM doesn't call the TDX module API to program the
relevant TD VMCS fields.

Enable Notify VM exit for TDX guests by:

  - Invoking TDX module API calls to set NOTIFY_VM_EXITING and Notify
    Window in TD VMCS.  It's done in tdx_vcpu_init() where other TD VMCS
    bits are set.  Since TDX vCPU cannot be reset, it only needs to be
    configured once when initializing the TDX vCPU.

  - Adding corresponding exit handler for TDX Notify VM Exit.

Notify VM exit can happen when executing the IRET instruction.  If the
IRET unblocks the NMI blocking state, bit 12 of the exit qualification
is set.  In this case, the VMM needs to restore the "blocked by NMI" state
when it decides to re-enter the guest.  For TDX, KVM cannot manage the
GUEST_INTERRUPTIBILITY_INFO and it's TDX module's responsibility to
handle it.  Extract the common part without NMI blocking handling into a
helper in common.h so that it can be shared between VMX and TDX.

Note, KVM uses "pre-production" terminology for the feature formally called
Notify VM-Exit.  All public versions of the SDM refer to the feature as
Instruction Timeout.  This will be remedied in the near future, for now,
use KVM's terminology for consistency.

Note, #2, there is no enumeration bit for Notify VM exit by TDX module
because all TDX modules support it, and allow to set the corresponding
TD VMCS fields as long as the hardware supports the feature.

Fixes: 161d34609f9b ("KVM: TDX: Make TDX VM type supported")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260819094903.3060020-2-xiaoyao.li@intel.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/common.h | 19 +++++++++++++++++++
 arch/x86/kvm/vmx/tdx.c    | 10 ++++++++++
 arch/x86/kvm/vmx/vmx.c    | 13 +------------
 3 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/arch/x86/kvm/vmx/common.h b/arch/x86/kvm/vmx/common.h
index a02d7c003475a2..80c78b35d168c1 100644
--- a/arch/x86/kvm/vmx/common.h
+++ b/arch/x86/kvm/vmx/common.h
@@ -4,6 +4,7 @@
 
 #include <linux/kvm_host.h>
 #include <asm/posted_intr.h>
+#include <asm/vmx.h>
 
 #include "mmu.h"
 
@@ -175,6 +176,24 @@ static inline void __vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu,
 	kvm_vcpu_trigger_posted_interrupt(vcpu, POSTED_INTR_VECTOR);
 }
 
+static inline int __vt_handle_notify(struct kvm_vcpu *vcpu,
+				     unsigned long exit_qual)
+{
+	bool context_invalid = exit_qual & NOTIFY_VM_CONTEXT_INVALID;
+
+	++vcpu->stat.notify_window_exits;
+
+	if (vcpu->kvm->arch.notify_vmexit_flags & KVM_X86_NOTIFY_VMEXIT_USER ||
+	    context_invalid) {
+		vcpu->run->exit_reason = KVM_EXIT_NOTIFY;
+		vcpu->run->notify.flags = context_invalid ?
+					  KVM_NOTIFY_CONTEXT_INVALID : 0;
+		return 0;
+	}
+
+	return 1;
+}
+
 noinstr void vmx_handle_nmi(struct kvm_vcpu *vcpu);
 int vt_handle_bus_lock_vmexit(struct kvm_vcpu *vcpu);
 
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index b593295ae4a9f3..dcbfcd79791c89 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -2140,6 +2140,9 @@ int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
 		 * - If it's not an MSMI, no need to do anything here.
 		 */
 		return 1;
+	case EXIT_REASON_NOTIFY:
+		/* NMI blocking state is handled by TDX module */
+		return __vt_handle_notify(vcpu, vmx_get_exit_qual(vcpu));
 	default:
 		break;
 	}
@@ -3141,6 +3144,13 @@ static int tdx_vcpu_init(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *cmd)
 	td_vmcs_write64(tdx, POSTED_INTR_DESC_ADDR, __pa(&tdx->vt.pi_desc));
 	td_vmcs_setbit32(tdx, PIN_BASED_VM_EXEC_CONTROL, PIN_BASED_POSTED_INTR);
 
+	if (kvm_notify_vmexit_enabled(vcpu->kvm)) {
+		td_vmcs_setbit32(tdx, SECONDARY_VM_EXEC_CONTROL,
+				 SECONDARY_EXEC_NOTIFY_VM_EXITING);
+		td_vmcs_write32(tdx, NOTIFY_WINDOW,
+				vcpu->kvm->arch.notify_window);
+	}
+
 	tdx->state = VCPU_TD_STATE_INITIALIZED;
 
 	return 0;
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 0afbfbd4cfb115..8da96a6c617737 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6055,9 +6055,6 @@ static int handle_encls(struct kvm_vcpu *vcpu)
 static int handle_notify(struct kvm_vcpu *vcpu)
 {
 	unsigned long exit_qual = vmx_get_exit_qual(vcpu);
-	bool context_invalid = exit_qual & NOTIFY_VM_CONTEXT_INVALID;
-
-	++vcpu->stat.notify_window_exits;
 
 	/*
 	 * Notify VM exit happened while executing iret from NMI,
@@ -6067,15 +6064,7 @@ static int handle_notify(struct kvm_vcpu *vcpu)
 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
 			      GUEST_INTR_STATE_NMI);
 
-	if (vcpu->kvm->arch.notify_vmexit_flags & KVM_X86_NOTIFY_VMEXIT_USER ||
-	    context_invalid) {
-		vcpu->run->exit_reason = KVM_EXIT_NOTIFY;
-		vcpu->run->notify.flags = context_invalid ?
-					  KVM_NOTIFY_CONTEXT_INVALID : 0;
-		return 0;
-	}
-
-	return 1;
+	return __vt_handle_notify(vcpu, exit_qual);
 }
 
 static int vmx_get_msr_imm_reg(struct kvm_vcpu *vcpu)

From 7a02dfbd2f4a7dec468221d639f740a51d4483e1 Mon Sep 17 00:00:00 2001
From: Amit Machhiwal <amachhiw@linux.ibm.com>
Date: Mon, 28 Sep 2026 17:58:36 +0530
Subject: [PATCH 0936/1982] KVM: PPC: Book3S HV: Add preempt_disable() around
 virtual-mode HPTE bit-lock users

commit abbbe5ff83e7c9ed3a4d61b73011f1df7bf87907 upstream.

kvmppc_hv_find_lock_hpte() requires virtual-mode callers to run with
preemption disabled, because it can return with HPTE_V_HVLOCK still held
until the caller later unlocks the HPTE.  Existing virtual-mode callers
in book3s_64_mmu_hv.c already follow that rule.

Two virtual-mode call paths do not:

1. kvmppc_handle_exit_hv() calls kvmppc_hpte_hv_fault() for hash-mode
   data-side and instruction-side faults after guest exit, with
   preemption already enabled.  kvmppc_hpte_hv_fault() calls
   kvmppc_hv_find_lock_hpte() directly.

2. kvmppc_pseries_do_hcall() executes virtual-mode handlers for HPT
   hcalls via kvmppc_pseries_do_hpt_hcall() with preemption enabled.
   The handlers for H_ENTER, H_REMOVE, H_READ, H_CLEAR_MOD, H_CLEAR_REF,
   H_PROTECT, and H_BULK_REMOVE spin on try_lock_hpte() or lock_rmap(),
   and H_ENTER also reaches kvmppc_do_h_enter(), which uses
   arch_spin_lock() on kvm->mmu_lock.  That raw lock choice is
   intentional because kvmppc_do_h_enter() is also used by real-mode
   callers, so the correct fix is to establish the proper preemption
   context at the virtual-mode caller boundary.

If a vCPU thread is preempted while holding HPTE_V_HVLOCK, any other
thread on the same CPU trying to acquire the same bit-lock can spin
indefinitely.  The same applies to lock_rmap() users and to the H_ENTER
path while holding the raw mmu_lock.

Fix this by adding preempt_disable()/preempt_enable() pairs around the
two kvmppc_hpte_hv_fault() call sites in kvmppc_handle_exit_hv(), and
around the kvmppc_pseries_do_hpt_hcall() invocation in
kvmppc_pseries_do_hcall().  Targeting only the HPT hcall helper avoids
wrapping non-HPT hcalls (such as H_RTAS, H_CONFER, H_REGISTER_VPA) that
perform page faults, blocking memory allocations, or context switches.

Fixes: 6165d5dd99db ("KVM: PPC: Book3S HV: add virtual mode handlers for HPT hcalls and page faults")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-3-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_hv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index c3681742430294..ca566f2c4d893c 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1208,9 +1208,11 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
 	case H_CLEAR_REF:
 	case H_PROTECT:
 	case H_BULK_REMOVE:
+		preempt_disable();
 		idx = srcu_read_lock(&kvm->srcu);
 		ret = kvmppc_pseries_do_hpt_hcall(vcpu, req);
 		srcu_read_unlock(&kvm->srcu, idx);
+		preempt_enable();
 		if (ret == H_TOO_HARD)
 			return RESUME_HOST;
 		break;
@@ -1830,8 +1832,10 @@ static int kvmppc_handle_exit_hv(struct kvm_vcpu *vcpu,
 		else
 			vsid = vcpu->arch.fault_gpa;
 
+		preempt_disable();
 		err = kvmppc_hpte_hv_fault(vcpu, vcpu->arch.fault_dar,
 				vsid, vcpu->arch.fault_dsisr, true);
+		preempt_enable();
 		if (err == 0) {
 			r = RESUME_GUEST;
 		} else if (err == -1 || err == -2) {
@@ -1877,8 +1881,10 @@ static int kvmppc_handle_exit_hv(struct kvm_vcpu *vcpu,
 		else
 			vsid = vcpu->arch.fault_gpa;
 
+		preempt_disable();
 		err = kvmppc_hpte_hv_fault(vcpu, vcpu->arch.fault_dar,
 				vsid, vcpu->arch.fault_dsisr, false);
+		preempt_enable();
 		if (err == 0) {
 			r = RESUME_GUEST;
 		} else if (err == -1) {

From d4de3f8bd52854572bfc03b89ab236b94bf8a14c Mon Sep 17 00:00:00 2001
From: Amit Machhiwal <amachhiw@linux.ibm.com>
Date: Mon, 28 Sep 2026 17:58:37 +0530
Subject: [PATCH 0937/1982] KVM: PPC: Fix get_d_signext() 12-bit displacement
 for paired-single D-form
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 31895b0ff96778b524c74b43a108090581271603 upstream.

get_d_signext() has two compounding bugs since its introduction in 2010:

1. The extraction mask 0x8FF silently drops bits 8-10 of the 12-bit D
   field (PPC ISA bits 21-23), corrupting any displacement that has any
   of those bits set.

2. The sign-magnitude idiom "-(d & 0x7ff)" is wrong for two's-complement:
   for D=0xFFC (encoding of -4) it returns -252 instead of -4.

Together these errors produce a wrong effective address for psq_l, psq_lu,
psq_st, and psq_stu whenever the displacement is negative or is a positive
value >= 0x100 with bits 8-10 set — essentially any real-world paired-
single stack-relative access.

The D field occupies the bottom 12 bits of the instruction word (confirmed
by the adjacent W and I extractions via inst_get_field(inst,16,16) and
inst_get_field(inst,17,19)). Replace the open-coded logic with the standard
sign_extend32(inst & 0xfff, 11), which correctly performs two's-complement
sign extension from 12 bits to 32 bits.

Fixes: 831317b605e7 ("KVM: PPC: Implement Paired Single emulation")
Cc: stable@vger.kernel.org
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260928122837.8782-4-amachhiw@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_paired_singles.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_paired_singles.c b/arch/powerpc/kvm/book3s_paired_singles.c
index bc39c76c9d9feb..532f96293de0fb 100644
--- a/arch/powerpc/kvm/book3s_paired_singles.c
+++ b/arch/powerpc/kvm/book3s_paired_singles.c
@@ -479,12 +479,7 @@ static bool kvmppc_inst_is_paired_single(struct kvm_vcpu *vcpu, u32 inst)
 
 static int get_d_signext(u32 inst)
 {
-	int d = inst & 0x8ff;
-
-	if (d & 0x800)
-		return -(d & 0x7ff);
-
-	return (d & 0x7ff);
+	return sign_extend32(inst & 0xfff, 11);
 }
 
 static int kvmppc_ps_three_in(struct kvm_vcpu *vcpu, bool rc,

From 30e55a93cdc6b24e9cef7b975376b925098aad2b Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:13 +0800
Subject: [PATCH 0938/1982] HID: zydacron: validate key report length

commit 9932c9af185f8586e883d44ca562c12f4487c762 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  zc_raw_event() verifies the report ID in byte zero and then reads
the key code from byte one for report IDs 0x02 and 0x03 without checking
that the second byte is present.

A one-byte report reproduced the issue under KASAN:

  BUG: KASAN: slab-out-of-bounds in zc_raw_event+0x54c/0x580
  Read of size 1 by task hidtrigger/93
  Call Trace:
   zc_raw_event+0x54c/0x580
   __hid_input_report+0x2ef/0x3a0
   inject_store+0x479/0x490 [faketrans]

Require both the report ID and key code before processing the report.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: d0742abaa1c3 ("HID: add omitted hid-zydacron.c file")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-zydacron.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-zydacron.c b/drivers/hid/hid-zydacron.c
index 1aae80f848f503..02de153d5628c3 100644
--- a/drivers/hid/hid-zydacron.c
+++ b/drivers/hid/hid-zydacron.c
@@ -114,6 +114,9 @@ static int zc_raw_event(struct hid_device *hdev, struct hid_report *report,
 	unsigned key;
 	unsigned short index;
 
+	if (size < 2)
+		return 0;
+
 	if (report->id == data[0] && (hdev->claimed & HID_CLAIMED_INPUT)) {
 
 		/* break keys */

From 292e9c446a7c32b295392811ae97d0aeb0755c11 Mon Sep 17 00:00:00 2001
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Date: Tue, 6 Oct 2026 16:07:53 +0530
Subject: [PATCH 0939/1982] HID: amd_sfh: Remove unsupported motion-state field
 from accelerometer report

commit 6ff86122906357687735dd379c6279e3b2fa26af upstream.

The accelerometer HID report descriptor declares a trailing motion-state
field (usage 0x0451), but the Sensor Fusion Hub never reports this data,
so each accelerometer input report is one byte shorter than the descriptor
advertises.

This was previously harmless because hid-core zero-padded short reports.
Since commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") such reports are rejected instead:

  hid-sensor-hub 0020:1022:0001.0003: Event data for report 1 was too short (15 vs 14)

As a result the accelerometer input events are dropped and screen
auto-rotation stops working on AMD SFH systems.

Remove the motion-state field from the accelerometer report descriptor and
drop the unused in_accel_shake_detection member, so the descriptor matches
the report actually provided by the hardware.

Fixes: 1434f9fc0e47 ("SFH: Create HID report to Enable support of AMD sensor fusion Hub (SFH)")
Reported-by: Andrej Scek <scek.andrej@gmail.com>
Closes: https://lore.kernel.org/linux-input/CADrS85612m-Hh-G4BJmOhy-y6r3Ni3kD8_GM-2QRBeWWEEZWuA@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h  | 2 --
 .../amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h   | 7 -------
 2 files changed, 9 deletions(-)

diff --git a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h
index 882434b1501ff1..230fb69cacfdaa 100644
--- a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h
+++ b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h
@@ -48,8 +48,6 @@ struct accel3_input_report {
 	int in_accel_x_value;
 	int in_accel_y_value;
 	int in_accel_z_value;
-	/* include if required to support the "shake" event */
-	u8 in_accel_shake_detection;
 } __packed;
 
 struct gyro_feature_report {
diff --git a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h
index 67ec2d6a417de5..64cff842e5f261 100644
--- a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h
+++ b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h
@@ -169,13 +169,6 @@ static const u8 accel3_report_descriptor[] = {
 0x95, 1,		/* HID report count (1) */
 0x55, 0x0E,		/* HID unit exponent(0x0E) */
 0X81, 0x02,		/* HID Input (Data_Arr_Abs) */
-
-0x0A, 0x51, 0x04,	/* HID usage sensor data motion state */
-0x15, 0,		/* HID logical Min_8(0) False = Still*/
-0x25, 1,		/* HID logical Min_8(1) True = In motion */
-0x75, 8,		/* HID report size(8) */
-0x95, 1,		/* HID report count (1) */
-0X81, 0x02,		/* HID Input (Data_Arr_Abs) */
 0xC0			/* HID end collection */
 };
 

From 5652b50db002f6cd72c86886aaa1372a429375b9 Mon Sep 17 00:00:00 2001
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Date: Tue, 6 Oct 2026 16:07:54 +0530
Subject: [PATCH 0940/1982] HID: amd_sfh: Use report type from request node

commit 85f1bea97f1909f81577cfcf3e4db9017e7f5337 upstream.

Use report type from request node while sending feature and input reports
to HID core. The cli_data report type array is never assigned and
feature reports are sent as input reports.

Fixes: 1434f9fc0e47 ("SFH: Create HID report to Enable support of AMD sensor fusion Hub (SFH)")
Closes: https://github.com/ublue-os/bazzite/issues/5796
Cc: stable@vger.kernel.org
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/amd-sfh-hid/amd_sfh_client.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
index 7017bfa590931b..4e041b85a7c742 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -95,7 +95,7 @@ void amd_sfh_work(struct work_struct *work)
 						    cli_data->feature_report[current_index]);
 		if (report_size)
 			hid_input_report(cli_data->hid_sensor_hubs[current_index],
-					 cli_data->report_type[current_index],
+					 node_type,
 					 cli_data->feature_report[current_index], report_size, 0);
 		else
 			pr_err("AMDSFH: Invalid report size\n");
@@ -104,7 +104,7 @@ void amd_sfh_work(struct work_struct *work)
 		report_size = mp2_ops->get_in_rep(current_index, sensor_index, report_id, in_data);
 		if (report_size)
 			hid_input_report(cli_data->hid_sensor_hubs[current_index],
-					 cli_data->report_type[current_index],
+					 node_type,
 					 in_data->input_report[current_index], report_size, 0);
 		else
 			pr_err("AMDSFH: Invalid report size\n");

From 076bea989f998f4d5a62d74de2f04f6f5b94b3f3 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Sat, 10 Oct 2026 13:44:15 -0400
Subject: [PATCH 0941/1982] HID: core: Fix out-of-bounds left shift by 32 in
 s32ton()

commit 5fe63b415c636c7f4f6848a8e53bdd4bbf0c300d upstream.

Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
32) in the s32ton() routine in the HID core.  This routine converts a
signed 32-bit integer to a signed n-bit integer, and it caps the value
of n at 32.  But when n == 32 there's no need to do anything; it can
simply return the input value.  This will avoid calculating (1 << n)
when n is 32, which was the cause of the invalid shift.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift")
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/
Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 78adb5a48a6128..bd190d1377cfb0 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -71,8 +71,8 @@ static u32 s32ton(__s32 value, unsigned int n)
 	if (!value || !n)
 		return 0;
 
-	if (n > 32)
-		n = 32;
+	if (n >= 32)
+		return (u32) value;
 
 	a = value >> (n - 1);
 	if (a && a != -1)

From d618e93e9cf5611867b3a7546e09bedff4b65139 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:05 +0800
Subject: [PATCH 0942/1982] HID: cougar: reject short special-key reports

commit c6c0df8a4b73a0d563c5e64de640ef5ff525fc82 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  cougar_raw_event() reads the key code and action from offsets one
and two without checking that those bytes are present.  A short report on
the special interface can therefore cause an out-of-bounds read.

Consume reports that do not contain the action field before accessing the
fixed offsets, consistent with the callback's handling of other reports on
the special interface.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: b8e759b8f6da ("HID: cougar: Add support for the Cougar 500k Gaming Keyboard")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-cougar.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
index 5596dd94032230..c082ba4e40cd26 100644
--- a/drivers/hid/hid-cougar.c
+++ b/drivers/hid/hid-cougar.c
@@ -270,6 +270,9 @@ static int cougar_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (!shared->enabled || !shared->input)
 		return -EPERM;
 
+	if (size <= COUGAR_FIELD_ACTION)
+		return -EPERM;
+
 	code = data[COUGAR_FIELD_CODE];
 	action = data[COUGAR_FIELD_ACTION];
 	for (i = 0; cougar_mapping[i][0]; i++) {

From 94d0e789d8b0d2ea8e25ed5ff2fe2648e11f2297 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:06 +0800
Subject: [PATCH 0943/1982] HID: cp2112: validate response report lengths

commit fc54e71a063c0dcc4bceba6d0f71805a9b84082d upstream.

The HID core invokes raw_event callbacks before validating the report
length.  cp2112_raw_event() reads every field of a transfer status response
without checking size.  For a data response, it reads the length at offset
two and copies that many bytes from offset three, again without ensuring
that the input report contains them.

Require a complete transfer status structure.  For data responses, first
require the header and then ensure the clamped payload length fits in the
received report before copying it.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: e932d8178667 ("HID: add hid-cp2112 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-cp2112.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 803b883ae8750f..ea0f0ecb73b7f1 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1389,6 +1389,9 @@ static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report,
 
 	switch (data[0]) {
 	case CP2112_TRANSFER_STATUS_RESPONSE:
+		if (size < sizeof(*xfer))
+			return 0;
+
 		hid_dbg(hdev, "xfer status: %02x %02x %04x %04x\n",
 			xfer->status0, xfer->status1,
 			be16_to_cpu(xfer->retries), be16_to_cpu(xfer->length));
@@ -1422,11 +1425,16 @@ static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report,
 		atomic_set(&dev->xfer_avail, 1);
 		break;
 	case CP2112_DATA_READ_RESPONSE:
+		if (size < 3)
+			return 0;
+
 		hid_dbg(hdev, "read response: %02x %02x\n", data[1], data[2]);
 
 		dev->read_length = data[2];
 		if (dev->read_length > sizeof(dev->read_data))
 			dev->read_length = sizeof(dev->read_data);
+		if (dev->read_length > size - 3)
+			return 0;
 
 		memcpy(dev->read_data, &data[3], dev->read_length);
 		atomic_set(&dev->read_avail, 1);
@@ -1453,4 +1461,3 @@ module_hid_driver(cp2112_driver);
 MODULE_DESCRIPTION("Silicon Labs HID USB to SMBus master bridge");
 MODULE_AUTHOR("David Barksdale <dbarksdale@uplogix.com>");
 MODULE_LICENSE("GPL");
-

From 6a0a7d6418261e99e74ba7089b08889f1a93eafd Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:07 +0800
Subject: [PATCH 0944/1982] HID: elo: reject short touchscreen reports

commit 1cb92fcb2ac344d78737e3c5cb7b061dfb2850b1 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  elo_raw_event() only checks the first-byte packet marker before
elo_process_data() reads coordinates, flags, and pressure through offset
seven.  A truncated packet beginning with the expected marker can therefore
cause an out-of-bounds read.

Require the complete eight-byte SmartSet packet before parsing it.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-elo.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c
index cf17bdd14d9c40..cc4b716af4a3f1 100644
--- a/drivers/hid/hid-elo.c
+++ b/drivers/hid/hid-elo.c
@@ -85,6 +85,9 @@ static int elo_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (!(hdev->claimed & HID_CLAIMED_INPUT) || list_empty(&hdev->inputs))
 		return 0;
 
+	if (size < ELO_SMARTSET_PACKET_SIZE)
+		return 0;
+
 	hidinput = list_first_entry(&hdev->inputs, struct hid_input, list);
 
 	switch (report->id) {

From bf3e9e06e850c78673b373f3a6bb4baaf2949d66 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:08 +0800
Subject: [PATCH 0945/1982] HID: logitech-dj: validate unnumbered keyboard
 reports

commit c2deafcb4c8227771f768d77ed3c0a489250e9b2 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  For an unnumbered keyboard report, logi_dj_raw_event() uses the
second byte as temporary storage while prepending a report ID.  A one-byte
report therefore makes both the initial write and the later restoration
access data beyond the received report.

Reject unnumbered keyboard reports that do not provide the temporary byte.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 74808f9115ce ("HID: logitech-dj: add support for non unifying receivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-logitech-dj.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 7895f27c913510..e5727877d4be0e 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1682,6 +1682,9 @@ static int logi_dj_raw_event(struct hid_device *hdev,
 	if (!hdev->report_enum[HID_INPUT_REPORT].numbered) {
 
 		if (djrcv_dev->unnumbered_application == HID_GD_KEYBOARD) {
+			if (size < 2)
+				return false;
+
 			/*
 			 * For the keyboard, we can reuse the same report by
 			 * using the second byte which is constant in the USB

From 47f50fbfd664ceede78f502950eb5638b537ed74 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:09 +0800
Subject: [PATCH 0946/1982] HID: mcp2200: validate READ_ALL response length

commit 26ce0e6bf0b27fc6a2f490f38555dfd0a27c9605 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  mcp2200_raw_event() casts a READ_ALL response to struct
mcp_read_all_resp and reads fields through offset ten without checking that
the response contains the structure.

A one-byte READ_ALL response reproduced the issue under KASAN:

  BUG: KASAN: slab-out-of-bounds in mcp2200_raw_event+0x24b/0x3a0
  Read of size 1 by task hidtrigger/89
  Call Trace:
   mcp2200_raw_event+0x24b/0x3a0
   kasan_report+0x139/0x170

Reject an incomplete READ_ALL response with a protocol error before reading
its fields.  The common completion path then wakes the command waiter with
the error instead of leaving it to time out.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 740329d7120f ("HID: mcp2200: added driver for GPIOs of MCP2200")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-mcp2200.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hid/hid-mcp2200.c b/drivers/hid/hid-mcp2200.c
index dafdd5b4a0797b..c6fd5fb5d57854 100644
--- a/drivers/hid/hid-mcp2200.c
+++ b/drivers/hid/hid-mcp2200.c
@@ -301,6 +301,11 @@ static int mcp2200_raw_event(struct hid_device *hdev, struct hid_report *report,
 
 	switch (data[0]) {
 	case READ_ALL:
+		if (size < sizeof(*all_resp)) {
+			mcp->status = -EPROTO;
+			break;
+		}
+
 		all_resp = (struct mcp_read_all_resp *) data;
 		mcp->status = 0;
 		mcp->gpio_inval = all_resp->io_port_val_bmap;

From ee55408b95bdc28f1bd1eb4591185838037a1f98 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:10 +0800
Subject: [PATCH 0947/1982] HID: mcp2221: validate response report length

commit 1ae40774d386b7a51e4799200106429a7e14e8ec upstream.

MCP2221 responses are 64-byte reports, but mcp2221_raw_event() currently
accepts any report of at least four bytes.  Several response handlers read
far beyond that minimum.  In particular, the I2C status response reads
offset 20 and copies ADC samples starting at offset 50.  Other GPIO, SRAM,
and flash response handlers also access fixed offsets beyond byte three.

The HID core invokes raw_event callbacks before validating the report
length, so a truncated response can cause an out-of-bounds read.  Require a
complete protocol report before dispatching any response handler.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-mcp2221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index f10dea1045d15a..31334f7590054e 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -858,7 +858,7 @@ static int mcp2221_raw_event(struct hid_device *hdev,
 	u8 *buf;
 	struct mcp2221 *mcp = hid_get_drvdata(hdev);
 
-	if (size < 4)
+	if (size < sizeof(mcp->txbuf))
 		return 0;
 
 	switch (data[0]) {

From 14acfdfca5151537b623243a6c0e66a2e6fca7de Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:17:01 +0100
Subject: [PATCH 0948/1982] HID: picoLCD: check for fb_deferred_io_init() error

commit feade898fc958ff355101adf12d5632272e64220 upstream.

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently picolcd_init_framebuffer() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.

When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).

Fix this by checking for the error.

Also correct cleanup ordering - defio is initialised after the sysfs file,
so cleanup defio first.

Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-picolcd_fb.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
index 8c28e982e09d7a..a016dd9ca847a7 100644
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -531,17 +531,23 @@ int picolcd_init_framebuffer(struct picolcd_data *data)
 		goto err_cleanup;
 	}
 
-	fb_deferred_io_init(info);
+	error = fb_deferred_io_init(info);
+	if (error) {
+		dev_err(dev, "failed to initialize deferred I/O\n");
+		goto err_sysfs;
+	}
+
 	error = register_framebuffer(info);
 	if (error) {
 		dev_err(dev, "failed to register framebuffer\n");
-		goto err_sysfs;
+		goto err_defio;
 	}
 	return 0;
 
+err_defio:
+	fb_deferred_io_cleanup(info);
 err_sysfs:
 	device_remove_file(dev, &dev_attr_fb_update_rate);
-	fb_deferred_io_cleanup(info);
 err_cleanup:
 	data->fb_info    = NULL;
 

From ac0e2a0fbe429e4529e54852264c59c0e3c838b5 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:11 +0800
Subject: [PATCH 0949/1982] HID: prodikeys: validate fixed-format MIDI reports

commit 0ff37294c41bd925258893310398bc2b45fcd4a7 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  Prodikeys reports 0x01 and 0x04 are passed to handlers that always
read bytes one through three, regardless of the supplied size.  A truncated
report can therefore cause an out-of-bounds read.

Require four bytes for the two fixed-format reports.  Keep report 0x03 on
its existing variable-length path, which derives the number of note pairs
from size and only accesses complete pairs.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 3a370ca1dcf8 ("HID: Prodikeys PC-MIDI HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-prodikeys.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index 6e413df38358a4..d0144028760bb5 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -772,8 +772,13 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
 		if (report->id == data[0])
 			switch (report->id) {
 			case 0x01: /* midi keys (qwerty)*/
-			case 0x03: /* midi keyboard (musical)*/
 			case 0x04: /* extra/midi keys (qwerty)*/
+				if (size < 4)
+					break;
+				ret = pcmidi_handle_report(pm, report->id,
+							   data, size);
+				break;
+			case 0x03: /* midi keyboard (musical)*/
 				ret = pcmidi_handle_report(pm,
 						report->id, data, size);
 				break;

From d4cb80ade5f4c1494957d09d7227a8eb948eb590 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:44:12 +0800
Subject: [PATCH 0950/1982] HID: pxrc: reject short input reports

commit 0deb22da5a8c6663c3e071f55fd7d7e3189f5517 upstream.

The HID core invokes raw_event callbacks before validating the report
length.  pxrc_raw_event() reads byte seven and writes bytes one and seven
without checking that the report contains those bytes.

A one-byte input report reproduced the first invalid access under KASAN:

  BUG: KASAN: slab-out-of-bounds in pxrc_raw_event+0x161/0x260
  Read of size 1 by task hidtrigger/90
  Call Trace:
   pxrc_raw_event+0x161/0x260
   kasan_report+0x139/0x170

Require all eight bytes before reading or rewriting the report.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: acc3e34613da ("HID: Add driver for PhoenixRC Flight Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-pxrc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-pxrc.c b/drivers/hid/hid-pxrc.c
index 71fe0c06ddcdf3..e3755d8b85c226 100644
--- a/drivers/hid/hid-pxrc.c
+++ b/drivers/hid/hid-pxrc.c
@@ -55,6 +55,9 @@ static int pxrc_raw_event(struct hid_device *hdev, struct hid_report *report,
 {
 	struct pxrc_priv *priv = hid_get_drvdata(hdev);
 
+	if (size < 8)
+		return 0;
+
 	if (priv->alternate)
 		priv->slider = data[7];
 	else

From 6ebe75dbb9cf448b867782470ceb42cb2f73e704 Mon Sep 17 00:00:00 2001
From: Gabor Tanz <gabor.tanz@gmail.com>
Date: Mon, 12 Oct 2026 17:03:57 +0200
Subject: [PATCH 0951/1982] HID: quirks: Always poll the Anne Pro 2 with
 product ID a292

commit cbc13a78a89d087252947d0a51048e576cfcb3ef upstream.

The wired Anne Pro 2 identifying as 04d9:a292 stops delivering keyboard
input after a period of inactivity. Unplugging and reconnecting the
keyboard restores input.

Keeping ObinsKit running prevents the problem. A read-only userspace
reader that keeps USB HID interface 1 open also prevents it, as does
usbhid.quirks=0x04d9:0xa292:0x00000400 without either application running.

Commit ca28aff0e1dc ("HID: quirks: Always poll Obins Anne Pro 2
keyboard") added HID_QUIRK_ALWAYS_POLL for product ID a293.
The variant identifying as 04d9:a292 exhibits the same symptom.
Apply the quirk to this product ID as well.

Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Gabor Tanz <gabor.tanz@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 69b1b0f98c99d6..23308fa2ebfcb5 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -719,6 +719,7 @@
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081	0xa081
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2	0xa0c2
 #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096	0xa096
+#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A292	0xa292
 #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293	0xa293
 
 #define USB_VENDOR_ID_IMATION		0x0718
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index debd00ed9062aa..9366373efd153c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -102,6 +102,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A292), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT },

From 664627e3be18faa067c9c8f6def684a76791c1f2 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:11 +0800
Subject: [PATCH 0952/1982] HID: roccat: isku: reject short button reports

commit 93e5f7f6189af76a2b2e2dfe647838a7b9f99d21 upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It passes the buffer to helpers which inspect data[0] and, for a
button report, read the complete struct isku_report_button.  A truncated
report can therefore cause an out-of-bounds read.

Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: d41c2a7011df ("HID: roccat: Add support for Isku keyboard")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-isku.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-isku.c b/drivers/hid/hid-roccat-isku.c
index 339378771ed506..5f28f3bfe2ed2c 100644
--- a/drivers/hid/hid-roccat-isku.c
+++ b/drivers/hid/hid-roccat-isku.c
@@ -411,6 +411,9 @@ static int isku_raw_event(struct hid_device *hdev,
 	if (isku == NULL)
 		return 0;
 
+	if (size < sizeof(struct isku_report_button))
+		return 0;
+
 	isku_keep_values_up_to_date(isku, data);
 
 	if (isku->roccat_claimed)

From 6d1f22a55259462618c73284aa1de40c970b419b Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:12 +0800
Subject: [PATCH 0953/1982] HID: roccat: koneplus: reject short button reports

commit d879e17a8b4c572c0b53b4e42a36849484e8f00c upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It passes the buffer to helpers which inspect data[0] and, for a
button report, read the complete struct koneplus_mouse_report_button.  A
truncated report can therefore cause an out-of-bounds read.

Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: 47dbdbffe15b ("HID: roccat: Add support for Roccat Kone[+] v2")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-koneplus.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 77d45d36421a6e..068615465bcd10 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -523,6 +523,9 @@ static int koneplus_raw_event(struct hid_device *hdev,
 	if (koneplus == NULL)
 		return 0;
 
+	if (size < sizeof(struct koneplus_mouse_report_button))
+		return 0;
+
 	koneplus_keep_values_up_to_date(koneplus, data);
 
 	if (koneplus->roccat_claimed)

From 49360ac9b47ff9852eed6ed047c8428b54b2de3a Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:13 +0800
Subject: [PATCH 0954/1982] HID: roccat: konepure: reject short button reports

commit 1590b7c9bea0abe7a5d25dbfe06287c48c238a6f upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It reads the report number without checking the received length
and passes matching data to roccat_report_event(), which copies a complete
struct konepure_mouse_report_button.  A truncated report can therefore
cause an out-of-bounds read and expose adjacent data through the Roccat
character device.

Require a complete button report before inspecting or forwarding it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: 8936aa31cd5f ("HID: roccat: add support for Roccat Kone Pure gaming mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-konepure.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-konepure.c b/drivers/hid/hid-roccat-konepure.c
index 027bfc55ef9cea..3430c9119b2752 100644
--- a/drivers/hid/hid-roccat-konepure.c
+++ b/drivers/hid/hid-roccat-konepure.c
@@ -181,6 +181,9 @@ static int konepure_raw_event(struct hid_device *hdev,
 			!= USB_INTERFACE_PROTOCOL_MOUSE)
 		return 0;
 
+	if (size < sizeof(struct konepure_mouse_report_button))
+		return 0;
+
 	if (data[0] != KONEPURE_MOUSE_REPORT_NUMBER_BUTTON)
 		return 0;
 

From 196fff636bf4fd8ca7dcdeb46b17c275d9064766 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:14 +0800
Subject: [PATCH 0955/1982] HID: roccat: kovaplus: reject short button reports

commit e95917a606f486e46f5136fc1b72190742a091d6 upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It passes the buffer to helpers which inspect data[0] and read a
complete struct kovaplus_mouse_report_button for button reports.  A
truncated report can therefore cause an out-of-bounds read.

Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: 0e70f97f257e ("HID: roccat: Add support for Kova[+] mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-kovaplus.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index a66f1b4730f30a..c8f70d6560e222 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -614,6 +614,9 @@ static int kovaplus_raw_event(struct hid_device *hdev,
 	if (kovaplus == NULL)
 		return 0;
 
+	if (size < sizeof(struct kovaplus_mouse_report_button))
+		return 0;
+
 	kovaplus_keep_values_up_to_date(kovaplus, data);
 
 	if (kovaplus->roccat_claimed)

From 08a4c26838f185f42cb80e5c50826e57c1e18e88 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:15 +0800
Subject: [PATCH 0956/1982] HID: roccat: pyra: reject short button reports

commit 493268f459bb6aeeecbc77f2204c11ad74d05213 upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It passes the buffer to helpers which inspect data[0] and read a
complete struct pyra_mouse_event_button for button reports.  A truncated
report can therefore cause an out-of-bounds read.

Require enough data for the button report before calling either helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: cb7cf3da0daa ("HID: roccat: add driver for Roccat Pyra mouse")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-pyra.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index de2da6086e0b93..af7e506e80ebc2 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -557,6 +557,9 @@ static int pyra_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (pyra == NULL)
 		return 0;
 
+	if (size < sizeof(struct pyra_mouse_event_button))
+		return 0;
+
 	pyra_keep_values_up_to_date(pyra, data);
 
 	if (pyra->roccat_claimed)

From c2e90164acb61217f2b9fdda05d83c80657c963c Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:16 +0800
Subject: [PATCH 0957/1982] HID: roccat: ryos: reject short special reports

commit 02f3607d0beb82e76481568bf631235e6a319b47 upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It reads the report number without checking the received length
and passes matching data to roccat_report_event(), which copies a complete
struct ryos_report_special.  A truncated report can therefore cause an
out-of-bounds read and expose adjacent data through the Roccat character
device.

Require a complete special report before inspecting or forwarding it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: 6f3a19360545 ("HID: roccat: add support for Ryos MK keyboards")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-ryos.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-ryos.c b/drivers/hid/hid-roccat-ryos.c
index 36911c9da4fe30..74753f85e3ad32 100644
--- a/drivers/hid/hid-roccat-ryos.c
+++ b/drivers/hid/hid-roccat-ryos.c
@@ -189,6 +189,9 @@ static int ryos_raw_event(struct hid_device *hdev,
 			!= RYOS_USB_INTERFACE_PROTOCOL)
 		return 0;
 
+	if (size < sizeof(struct ryos_report_special))
+		return 0;
+
 	if (data[0] != RYOS_REPORT_NUMBER_SPECIAL)
 		return 0;
 

From ae8c2228af6b7778c10b693bd6c5e103ef9c9451 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Thu, 24 Sep 2026 22:29:17 +0800
Subject: [PATCH 0958/1982] HID: roccat: savu: reject short special reports

commit 76c51fdc825a0486f8d88ff896d39acec8f377b4 upstream.

The raw event callback runs before HID core validates and zero-pads the
report.  It passes the buffer to a helper which inspects data[0] and, for a
special report, reads the complete struct savu_mouse_report_special.  A
truncated report can therefore cause an out-of-bounds read.

Require enough data for the special report before calling the helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.

Fixes: 6a2a6390cf09 ("HID: roccat: add support for Roccat Savu")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-roccat-savu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-roccat-savu.c b/drivers/hid/hid-roccat-savu.c
index fb2e464c3ada8d..295e5f2454c350 100644
--- a/drivers/hid/hid-roccat-savu.c
+++ b/drivers/hid/hid-roccat-savu.c
@@ -182,6 +182,9 @@ static int savu_raw_event(struct hid_device *hdev,
 	if (savu == NULL)
 		return 0;
 
+	if (size < sizeof(struct savu_mouse_report_special))
+		return 0;
+
 	if (savu->roccat_claimed)
 		savu_report_to_chrdev(savu, data);
 

From 68439a05ed529a8b0350f8c6ff3618ff4a8d972d Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 19:45:14 +0100
Subject: [PATCH 0959/1982] ovl: check that the parents of volatile/dirty are
 dirs

commit e34d2ef818e4c7676d8d8e1bf43e6a1ed39efb2a upstream.

An unprivileged user crashes the kernel by mounting overlayfs with the
volatile option.

A dentry that serves as the parent of a lookup must be a directory.
ovl_create_volatile_dirty() walks work/incompat/volatile/dirty by name,
and ovl_lookup_or_create() returns an existing entry whatever its type.
A file or a symlink that another task creates during the mount becomes
the parent of the next lookup, which calls a NULL ->lookup.

An unprivileged user mounted overlayfs with "volatile" in a user
namespace while a second process created a symlink named work/incompat,
and the mount task oopsed on a NULL ->lookup call.

Fix this by returning -ENOTDIR from ovl_lookup_or_create() when the
caller asked for a directory and the existing entry is a non-dir.

Fixes: c86243b090bc ("ovl: provide a mount option "volatile"")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
[backport: no ovl_start_creating_upper(), check the child of
 ovl_lookup_upper() in ovl_lookup_or_create() instead]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/super.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index d727e56ef4b1fc..6a733632a64755 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -624,15 +624,23 @@ static int ovl_check_rename_whiteout(struct ovl_fs *ofs)
 
 static struct dentry *ovl_lookup_or_create(struct ovl_fs *ofs,
 					   struct dentry *parent,
-					   const char *name, umode_t mode)
+					   const char *name, bool is_dir)
 {
 	size_t len = strlen(name);
 	struct dentry *child;
 
 	inode_lock_nested(parent->d_inode, I_MUTEX_PARENT);
 	child = ovl_lookup_upper(ofs, name, parent, len);
-	if (!IS_ERR(child) && !child->d_inode)
-		child = ovl_create_real(ofs, parent, child, OVL_CATTR(mode));
+	if (!IS_ERR(child)) {
+		if (!child->d_inode) {
+			child = ovl_create_real(ofs, parent, child,
+						OVL_CATTR(is_dir ? S_IFDIR :
+								   S_IFREG));
+		} else if (is_dir && !d_can_lookup(child)) {
+			dput(child);
+			child = ERR_PTR(-ENOTDIR);
+		}
+	}
 	inode_unlock(parent->d_inode);
 	dput(parent);
 
@@ -653,7 +661,7 @@ static int ovl_create_volatile_dirty(struct ovl_fs *ofs)
 	const char *const *name = volatile_path;
 
 	for (ctr = ARRAY_SIZE(volatile_path); ctr; ctr--, name++) {
-		d = ovl_lookup_or_create(ofs, d, *name, ctr > 1 ? S_IFDIR : S_IFREG);
+		d = ovl_lookup_or_create(ofs, d, *name, ctr > 1);
 		if (IS_ERR(d))
 			return PTR_ERR(d);
 	}

From 0759376aa01168edeec9319f9cc8e5e9b9388c5c Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 19:45:15 +0100
Subject: [PATCH 0960/1982] ovl: hold a reference on the parent in readdir

commit 16d319e12328acafeafd3eecdf09c46d7fb43452 upstream.

Listing a directory on an overlay uses a freed dentry and crashes the
kernel when a lookup moves the directory at the same time.

Code that can sleep may only use d_parent without a reference while
something stops a move of the dentry. ovl_iterate_real(),
ovl_need_adjust_d_ino() and ovl_cache_update() use the d_parent of the
listed directory and hold only the lock of that directory. When a
lookup finds the directory under another parent after a change to a
layer, d_splice_alias() moves it without that lock and drops its
reference on the old parent.

With a delay in ovl_iterate_real(), getdents64 on an overlay directory
raced a rename in the lower layer and a lookup that moved its dentry,
and after an rmdir of the old parent KASAN reported a use-after-free in
security_inode_getattr().

Fix this by using dget_parent() in the three functions.

Fixes: b5efccbe0a12 ("ovl: constant d_ino across copy up")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: fix comments in ovl_need_adjust_d_ino()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
[backport: no ovl_need_adjust_d_ino(), take the parent with dget_parent()
 in ovl_iterate() and test a local flag]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/readdir.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 2e7cf7774f34a8..9ccbf78389f820 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -572,8 +572,8 @@ static int ovl_cache_update(const struct path *path, struct ovl_cache_entry *p,
 			goto get;
 		}
 		if (p->len == 2 && p->name[1] == '.') {
-			/* we shall not be moved */
-			this = dget(dir->d_parent);
+			/* d_splice_alias() can move even a locked dir */
+			this = dget_parent(dir);
 			goto get;
 		}
 	}
@@ -802,6 +802,7 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
 	struct dentry *dir = file->f_path.dentry;
 	struct ovl_fs *ofs = OVL_FS(dir->d_sb);
 	const struct ovl_layer *lower_layer = ovl_layer_lower(dir);
+	struct dentry *parent;
 	struct ovl_readdir_translate rdt = {
 		.ctx.actor = ovl_fill_real,
 		.ctx.count = ctx->count,
@@ -813,18 +814,26 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
 	if (rdt.xinobits && lower_layer)
 		rdt.fsid = lower_layer->fsid;
 
-	if (OVL_TYPE_MERGE(ovl_path_type(dir->d_parent))) {
+	/*
+	 * The lock on dir does not stop d_splice_alias() from moving it to
+	 * another parent, which drops the reference dir holds on this one.
+	 */
+	parent = dget_parent(dir);
+	if (OVL_TYPE_MERGE(ovl_path_type(parent))) {
 		struct kstat stat;
 		struct path statpath = file->f_path;
 
-		statpath.dentry = dir->d_parent;
+		statpath.dentry = parent;
 		err = vfs_getattr(&statpath, &stat, STATX_INO, 0);
-		if (err)
+		if (err) {
+			dput(parent);
 			return err;
+		}
 
 		WARN_ON_ONCE(dir->d_sb->s_dev != stat.dev);
 		rdt.parent_ino = stat.ino;
 	}
+	dput(parent);
 
 	if (ovl_is_impure_dir(file)) {
 		rdt.cache = ovl_cache_get_impure(&file->f_path);
@@ -853,6 +862,10 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
 		ovl_dir_reset(file);
 
 	if (od->is_real) {
+		struct dentry *parent = dget_parent(dentry);
+		bool parent_merge = OVL_TYPE_MERGE(ovl_path_type(parent));
+
+		dput(parent);
 		/*
 		 * If parent is merge, then need to adjust d_ino for '..', if
 		 * dir is impure then need to adjust d_ino for copied up
@@ -860,8 +873,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
 		 */
 		if (ovl_xino_bits(ofs) ||
 		    (ovl_same_fs(ofs) &&
-		     (ovl_is_impure_dir(file) ||
-		      OVL_TYPE_MERGE(ovl_path_type(dentry->d_parent))))) {
+		     (ovl_is_impure_dir(file) || parent_merge))) {
 			err = ovl_iterate_real(file, ctx);
 		} else {
 			err = iterate_dir(od->realfile, ctx);

From 1d9706fb79a9499f5a0f7d7f755b6bb9b14cc426 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 19:45:16 +0100
Subject: [PATCH 0961/1982] ovl: do not copy up a dentry that was removed

commit f635192ad223d2009ee640b63adf5ce3198aa338 upstream.

A change to a removed file through an open descriptor replaces whatever
has its old name in the upper layer.

Copy up must only create a name in the upper directory, never replace
one. After an unlink, an rmdir or a rename over a lower dentry, a
dentry that an open file keeps alive still has its old parent and name,
but in the upper directory that name is now a whiteout or a new object.
ovl_copy_up_workdir() renames the copy over it, which brings back the
removed object and destroys whatever took its name.

An unprivileged user opened a lower FIFO and unlinked it, root created
a file at that name, and fchmod on the old descriptor replaced the file
of root with the FIFO.

Fix this by looking up the target name of the rename in
ovl_copy_up_workdir() with LOOKUP_EXCL, so that copy up fails with
-EEXIST if the name is taken, as copy up with O_TMPFILE already does
when it links the copy to the name.

Fixes: e9be9d5e76e3 ("overlay filesystem")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[amir: use LOOKUP_EXCL instead of relying on d_unhashed()]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
[backport: no start_renaming_dentry() and LOOKUP_EXCL, fail with -EEXIST if
 the target of ovl_lookup_upper() is positive]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/copy_up.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 488ce3cc3fc79d..6f95fbd96340d7 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -830,6 +830,13 @@ static int ovl_copy_up_workdir(struct ovl_copy_up_ctx *c)
 	if (IS_ERR(upper))
 		goto cleanup;
 
+	/* The name may have been taken since lookup, never replace it */
+	err = -EEXIST;
+	if (d_is_positive(upper)) {
+		dput(upper);
+		goto cleanup;
+	}
+
 	err = ovl_do_rename(ofs, c->workdir, temp, c->destdir, upper, 0);
 	unlock_rename(c->workdir, c->destdir);
 	dput(upper);

From 224e9856b8aab0ae7e6d63335554a9394ed4d2de Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Sat, 17 Oct 2026 18:43:30 +0200
Subject: [PATCH 0962/1982] ovl: fix mount setup failing when override_creds
 drops CAP_SYS_ADMIN

commit 333ad304d4794d6384087ea7fc16e58ab642809b upstream.

When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
"override_creds"), overlayfs saves those restricted credentials in
ofs->creator_cred. ovl_fill_super() then wraps the entire mount setup in
with_ovl_creds(), switching to those restricted credentials for the
duration.

Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
against current credentials. With restricted credentials active, this
check fails with -EPERM even though the task issuing
FSCONFIG_CMD_CREATE is fully privileged.

Use the mounter's real credentials only for cloning the private layer
mounts. Keep all other backing filesystem operations during mount setup
under the stashed credentials.

Reported-by: Disha Goel <disgoel@linux.ibm.com>
Closes: https://lore.kernel.org/linux-unionfs/20260924112858.51392-1-disgoel@linux.ibm.com
Fixes: c28f922c9dcee ("clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
[backport: 6.18 has no scoped_with_creds(), use scoped_class(override_creds)]
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/super.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 6a733632a64755..8d4ef5b2f1780e 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -498,6 +498,20 @@ static int ovl_report_in_use(struct ovl_fs *ofs, const char *name)
 	}
 }
 
+/*
+ * clone_private_mount() checks CAP_SYS_ADMIN in current->cred.
+ * ovl_fill_super() runs under the stashed creator cred, which
+ * override_creds may have dropped.
+ * The task that issued FSCONFIG_CMD_CREATE is still current->real_cred, so
+ * use that only for the clone. creator_cred stays in effect for every other
+ * backing-fs operation.
+ */
+static struct vfsmount *ovl_clone_private_mount(const struct path *path)
+{
+	scoped_class(override_creds, cred, current_real_cred())
+		return clone_private_mount(path);
+}
+
 static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
 			 struct ovl_layer *upper_layer,
 			 const struct path *upperpath)
@@ -521,7 +535,7 @@ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
 	if (err)
 		goto out;
 
-	upper_mnt = clone_private_mount(upperpath);
+	upper_mnt = ovl_clone_private_mount(upperpath);
 	err = PTR_ERR(upper_mnt);
 	if (IS_ERR(upper_mnt)) {
 		pr_err("failed to clone upperpath\n");
@@ -1102,7 +1116,7 @@ static int ovl_get_layers(struct super_block *sb, struct ovl_fs *ofs,
 			}
 		}
 
-		mnt = clone_private_mount(&l->path);
+		mnt = ovl_clone_private_mount(&l->path);
 		err = PTR_ERR(mnt);
 		if (IS_ERR(mnt)) {
 			pr_err("failed to clone lowerpath\n");

From 1f5c774488fa2dabe6667cb26888aaea39c4ead6 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 23 Oct 2026 19:26:09 +0900
Subject: [PATCH 0963/1982] smb: smbdirect: fix buffer length underflow in RDMA
 transfers

commit 7193241a49c958782ba4b8df06da3734d1e317d2 upstream.

When a remote buffer descriptor is larger than the remaining local
buffer, smbdirect_connection_rdma_xmit() clamps its length and sets
buf_len to zero. The common accounting code then subtracts the clamped
length from buf_len, causing it to underflow. If another descriptor
follows, the loop processes it with a wrapped remaining length and
includes memory beyond the local buffer in the RDMA transfer.

A client can trigger an out-of-bounds kernel write with an SMB WRITE
request, or an out-of-bounds kernel read with an SMB READ request, by
supplying multiple RDMA buffer descriptors with an oversized descriptor
before the last one.

Remove the premature assignment to buf_len. Subtracting the clamped length
already consumes the remaining buffer, so the next iteration stops and
only descriptors within the local buffer are used to build work requests.

Fixes: e628bf939aaf ("ksmbd: reduce descriptor size if remaining bytes is less than request size")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-33549
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ metze: in 6.18 the code is smb_direct_rdma_xmit() in
  fs/smb/server/transport_rdma.c ]
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/transport_rdma.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 3f9bcd10a0b3f3..fed0c7db224f11 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -1724,7 +1724,6 @@ static int smb_direct_rdma_xmit(struct smb_direct_transport *t,
 		if (desc_buf_len > buf_len) {
 			desc_buf_len = buf_len;
 			desc[i].length = cpu_to_le32(desc_buf_len);
-			buf_len = 0;
 		}
 
 		credits_needed += calc_rw_credits(sc, desc_buf, desc_buf_len);

From 4b3c285f9c5ac80bfe985b3b8778c756063e9105 Mon Sep 17 00:00:00 2001
From: Yichong Chen <chenyichong@uniontech.com>
Date: Wed, 4 Nov 2026 11:44:02 -0700
Subject: [PATCH 0964/1982] io_uring/kbuf: advance head when a pickup empties
 the buffer ring

Commit 8742f4b5a472c347fe568a73468a2d9e4d630b33 upstream.

io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
buffers it picked were the last ones available, comparing head to tail.
When the loop breaks because max_len was exhausted the buffer was picked,
but head is left pointing at it, so the flag isn't set if it was the last
buffer. A bundle receive then retries, finds no buffer, and the request,
which has received data, is marked as failed on account of the -ENOBUFS.
That severs a link, and ends a multishot.

Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023091711.83481-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/kbuf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index e1f4ee8727407c..c091c3c462e18b 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -314,8 +314,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
 		arg->out_len += len;
 		arg->max_len -= len;
-		if (!arg->max_len)
+		if (!arg->max_len) {
+			head++;
 			break;
+		}
 
 		buf = io_ring_head_to_buf(br, ++head, bl->mask);
 	} while (--nr_iovs);

From 87160b45abf0ec5beafe312e4a9761ccb596196b Mon Sep 17 00:00:00 2001
From: Yichong Chen <chenyichong@uniontech.com>
Date: Wed, 4 Nov 2026 11:44:03 -0700
Subject: [PATCH 0965/1982] io_uring/net: keep recvmsg buffer select length
 within MAX_RW_COUNT

Commit 18d3f56eb6e6500a65d81cf265f0fe74fd9ecab6 upstream.

io_recvmsg() takes the transfer length from the ring provided buffer when
sqe->len is 0, and such a buffer can be up to 4G. min_ret is an int, so 2G
or more makes it negative and the (ret < min_ret) block is skipped, and the
oversized length reaches the socket layer unchanged: an empty socket then
completes with 0 instead of arming poll, and a short read is reported as
complete. Clamp the length to MAX_RW_COUNT, as io_recv() does.

Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023112209.87979-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/io_uring/net.c b/io_uring/net.c
index 163ded47602da7..622d40336f5ad0 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1066,6 +1066,7 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags)
 		sel = io_buffer_select(req, &len, sr->buf_group, issue_flags);
 		if (!sel.addr)
 			return -ENOBUFS;
+		len = min_t(size_t, len, MAX_RW_COUNT);
 
 		if (req->flags & REQ_F_APOLL_MULTISHOT) {
 			ret = io_recvmsg_prep_multishot(kmsg, sr, &sel.addr, &len);

From 6621b094bc684625d54f80c68ba81bc1f39989de Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan@amutable.com>
Date: Wed, 4 Nov 2026 11:44:04 -0700
Subject: [PATCH 0966/1982] io_uring/net: don't retry a non-blocking connect()
 that fails with -EAGAIN

Commit 71537ed811107c514c0342e98902d489d6d2b7cd upstream.

IORING_OP_CONNECT on an O_NONBLOCK AF_UNIX stream socket retries a
connect that fails with -EAGAIN because the listener's backlog is full.
Polling the client socket doesn't help: an unconnected stream socket
reports EPOLLOUT and EPOLLHUP right away, before the backlog drains. So
io_uring retries the connect until the apoll retry limit is hit, then
punts the request to io-wq. With a full backlog, io_connect() runs 128
times in the submitting task and once more in a new io-wq worker. That
worker stays in the task's thread group, so a later
unshare(CLONE_NEWUSER) fails with -EINVAL.

None of this changes the result. __sys_connect_file() adds the socket's
own O_NONBLOCK to every attempt, so the attempt from io-wq fails with
-EAGAIN as well. That -EAGAIN becomes the CQE result, and connect(2)
returns the same -EAGAIN.

Let's complete the request with -EAGAIN right away when the socket has
O_NONBLOCK set, like connect(2) does. io_accept() already completes
-EAGAIN this way for IORING_ACCEPT_DONTWAIT. -EINPROGRESS still waits
for the connection to complete. A blocking socket still ends up in
io-wq, where the connect sleeps until the listener accepts.

Fixes: f8e85cf255ad ("io_uring: add support for IORING_OP_CONNECT")
Signed-off-by: Daan De Meyer <daan@amutable.com>
Link: https://patch.msgid.link/20261027-b4-io-uring-connect-eagain-v1-1-f4e3aaaa49ee@amutable.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/net.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/io_uring/net.c b/io_uring/net.c
index 622d40336f5ad0..e78ec89ca5ddf1 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1864,6 +1864,17 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
 			if (connect->seen_econnaborted)
 				goto out;
 			connect->seen_econnaborted = true;
+		} else if (req->file->f_flags & O_NONBLOCK) {
+			/*
+			 * __sys_connect_file() adds O_NONBLOCK from the socket
+			 * to every attempt, so a retry from io-wq fails with
+			 * -EAGAIN as well. A poll on the socket doesn't wait
+			 * until a retry can succeed. For example, an AF_UNIX
+			 * client reports EPOLLOUT right away while the
+			 * listener's backlog is full. Complete the request
+			 * with -EAGAIN, like connect(2) does.
+			 */
+			goto out;
 		}
 		return -EAGAIN;
 	}

From 2b8f16724d51019325d2412c6324cde0850f8085 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 4 Nov 2026 11:44:05 -0700
Subject: [PATCH 0967/1982] io_uring/io-wq: no new workers once the exit has
 begun

Commit 47c68f925062a6013235d06add85a59f7d91e0fb upstream.

io_wq_exit_start() sets IO_WQ_BIT_EXIT, but worker creation task_work
queued before that stays queued until io_wq_exit_workers() cancels it.
In between the task runs its task_work while canceling requests, and a
worker can still get created.

That's a problem for exec. begin_new_exec() calls io_uring_task_cancel()
after de_thread(), when it's supposedly the only thread left, and
io_wq_exit_workers() only waits for ->worker_done, which a worker
completes before do_exit(). So the exiting worker is still in the thread
group, using the mm, files and sighand, while exec replaces them. Easy
to hit with a signal pending when create_io_thread() fails and the retry
gets queued right before execve().

Cancel the queued creation task_work as soon as the exit bit is set.
Pending work that isn't otherwise canceled now ends with -ECANCELED when
the io-wq is destroyed, rather than depending on whether the task
happened to run its task_work first.

Fixes: 685fe7feedb9 ("io-wq: eliminate the need for a manager thread")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
[axboe: the barrier is already upstream, see 0e5663856b69, only the
 cancel is new]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io-wq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 7d89aa79d06ec5..fd53297af26ecd 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1412,6 +1412,12 @@ void io_wq_exit_start(struct io_wq *wq)
 	set_bit(IO_WQ_BIT_EXIT, &wq->state);
 	/* Pairs with task_work_add() in io_queue_worker_create(). */
 	smp_mb__after_atomic();
+	/*
+	 * No more workers from here on. The caller is going to run its task
+	 * work, and on exec a thread that is created now would still be
+	 * around, exiting, by the time that the caller must be on its own.
+	 */
+	io_wq_cancel_tw_create(wq);
 }
 
 static void io_wq_cancel_tw_create(struct io_wq *wq)

From 963c6e849b70259e17855214a999808391a32dd3 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 11:44:06 -0700
Subject: [PATCH 0968/1982] io_uring/rsrc: charge buffer arrays and nodes to
 memcg

Commit 075d5837bafc317e796548f721b8fbf7add6821d upstream.

The io_mapped_ubuf of a registered buffer has one bio_vec per page,
unless the pages coalesce into huge pages. Huge pages only count against
RLIMIT_MEMLOCK once per ring, so a buffer that maps the same 2MB folio
over and over in a way that defeats coalescing gets a full bvec array
per registration while only the one folio counts as locked. 1GB of that
registered in 100 slots took several times a 64MB memory.max, with 2.6MB
charged.

Allocate the io_mapped_ubuf and the io_rsrc_node with
GFP_KERNEL_ACCOUNT. An object reused from the ring caches stays charged
to whoever allocated it first, same as the io_kiocb cache.

Fixes: de2939388be5 ("io_uring: improve registered buffer accounting for huge pages")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[axboe: 6.18 uses kvmalloc() + struct_size_t() rather than
kvmalloc_flex()]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/rsrc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 8d28c6bfebb1ec..41e5755bd9aac3 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -110,9 +110,9 @@ static struct io_mapped_ubuf *io_alloc_imu(struct io_ring_ctx *ctx,
 					   int nr_bvecs)
 {
 	if (nr_bvecs <= IO_CACHED_BVECS_SEGS)
-		return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL);
+		return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL_ACCOUNT);
 	return kvmalloc(struct_size_t(struct io_mapped_ubuf, bvec, nr_bvecs),
-			GFP_KERNEL);
+			GFP_KERNEL_ACCOUNT);
 }
 
 static void io_free_imu(struct io_ring_ctx *ctx, struct io_mapped_ubuf *imu)
@@ -140,7 +140,7 @@ struct io_rsrc_node *io_rsrc_node_alloc(struct io_ring_ctx *ctx, int type)
 {
 	struct io_rsrc_node *node;
 
-	node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL);
+	node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL_ACCOUNT);
 	if (node) {
 		node->type = type;
 		node->refs = 1;

From 9089fd4d2ad6e5692b6971035f7460b97d3a5aaf Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 11:44:07 -0700
Subject: [PATCH 0969/1982] io_uring: charge tctx nodes and personalities

Commit 0b34e7b20a48710b6f53716bf7030920b69fdbdd upstream.

The io_tctx_node allocated the first time a task touches a ring, and
the XArray nodes behind tctx->xa and ctx->personalities, are plain
GFP_KERNEL. tctx->xa is indexed by the ring pointer, so nearly every
entry needs nodes of its own, and a task gets one entry per ring it has
used. 642 threads on 4000 rings held 2.3GB with 59MB charged against a
64MB memory.max.

Allocate the node with GFP_KERNEL_ACCOUNT and set XA_FLAGS_ACCOUNT on
both XArrays.

Fixes: 0f2122045b94 ("io_uring: don't rely on weak ->files references")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[axboe: 6.18 has kmalloc() for the node, inline in
__io_uring_add_tctx_node()]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 2 +-
 io_uring/tctx.c     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 04a90824c1905d..f1cd0e2b5b68d0 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -332,7 +332,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
 	if (ret)
 		goto free_ref;
 	init_completion(&ctx->ref_comp);
-	xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
+	xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
 	mutex_init(&ctx->uring_lock);
 	init_waitqueue_head(&ctx->cq_wait);
 	init_waitqueue_head(&ctx->poll_wq);
diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index 03c278aa58120f..bf851ba5ca1a36 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -91,7 +91,7 @@ __cold int io_uring_alloc_task_context(struct task_struct *task,
 	}
 
 	tctx->task = task;
-	xa_init(&tctx->xa);
+	xa_init_flags(&tctx->xa, XA_FLAGS_ACCOUNT);
 	init_waitqueue_head(&tctx->wait);
 	atomic_set(&tctx->in_cancel, 0);
 	atomic_set(&tctx->inflight_tracked, 0);
@@ -131,7 +131,7 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
 	if (tctx->io_wq)
 		io_wq_set_exit_on_idle(tctx->io_wq, false);
 	if (!xa_load(&tctx->xa, (unsigned long)ctx)) {
-		node = kmalloc(sizeof(*node), GFP_KERNEL);
+		node = kmalloc(sizeof(*node), GFP_KERNEL_ACCOUNT);
 		if (!node)
 			return -ENOMEM;
 		node->ctx = ctx;

From 9063d0bcba9598ad87d24a892d9b5ef074b95f70 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 11:44:08 -0700
Subject: [PATCH 0970/1982] io_uring: free XArray nodes left by a failed store

Commit 51bab09b7ca1a9a6dd9303a3b7ee346f8128c963 upstream.

A failed xa_store() can leave nodes without entries in the tree, and
erasing every entry doesn't free those. An XArray needs xa_destroy()
before it goes away, even an empty one. That was dropped for tctx->xa in
commit ca6484cd308a ("io_uring: no need to call xa_destroy() on empty
xarray") over a lockdep report from freeing the tctx in softirq context,
and ctx->personalities never had it.

Now that the nodes are charged, a store can fail at memory.max and the
leaked nodes stay charged. Call xa_destroy() in io_uring_clean_tctx(),
which the task runs itself in process context before the tctx is freed,
in the error path of __io_uring_add_tctx_node(), and for
ctx->personalities in io_ring_ctx_free().

Fixes: ca6484cd308a ("io_uring: no need to call xa_destroy() on empty xarray")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[axboe: 6.18 installs the tctx before adding the node and has no error
path that frees it, drop that hunk. There's no ctx->hpage_acct either]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 1 +
 io_uring/tctx.c     | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index f1cd0e2b5b68d0..ac097a9ac8c068 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3039,6 +3039,7 @@ static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx)
 	io_napi_free(ctx);
 	kvfree(ctx->cancel_table.hbs);
 	xa_destroy(&ctx->io_bl_xa);
+	xa_destroy(&ctx->personalities);
 	kfree(ctx);
 }
 
diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index bf851ba5ca1a36..0e4445d3a83c9e 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -206,6 +206,8 @@ __cold void io_uring_clean_tctx(struct io_uring_task *tctx)
 		io_uring_del_tctx_node(index);
 		cond_resched();
 	}
+	/* A failed xa_store() leaves nodes with no entry behind. */
+	xa_destroy(&tctx->xa);
 	if (wq) {
 		/*
 		 * Must be after io_uring_del_tctx_node() (removes nodes under

From 8bfd0b6319261f08b29945228b3377f89211f303 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Wed, 4 Nov 2026 11:44:09 -0700
Subject: [PATCH 0971/1982] io_uring/sqpoll: don't wait for the thread to exit

Commit 360395e8dbf9d23579f74b84a1af11190813b0f8 upstream.

io_sq_thread_stop() wakes the SQPOLL thread and waits for it to exit.
The thread belongs to the thread group that created the ring, so a
SIGSTOP or the cgroup freezer holds it in get_signal(), and the wake up
doesn't change that. io_ring_exit_work() then sleeps in that wait until
someone continues or kills the process. iou_exit has 64 slots, so 64
closed SQPOLL rings of a stopped process keep every other ring from
being freed, for everyone.

Don't wait. Set the stop bit, wake the thread, and let it exit when it
gets to run again. The sqd can now outlive its last ring, so give it a
second refcount with one reference for the rings and one for the thread,
and free it with the last one. The thread can't reach a freed ring,
rings leave ctx_list before dropping their reference, and the io-wq hash
is refcounted.

Fixes: 16efa4fce3b7 ("io_uring: allow IO worker threads to be frozen")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/sqpoll.c | 28 +++++++++++++++++++++++-----
 io_uring/sqpoll.h |  3 ++-
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index 448fa81ed87e7a..406029c14fbce7 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -62,6 +62,24 @@ void io_sq_thread_park(struct io_sq_data *sqd)
 	}
 }
 
+/*
+ * The sqd has two holders: its rings, as one, and its thread. Neither waits
+ * for the other to let go. The one that lets go last frees the sqd.
+ */
+static void io_sq_data_release(struct io_sq_data *sqd)
+{
+	if (refcount_dec_and_test(&sqd->free_refs))
+		kfree(sqd);
+}
+
+/*
+ * Ask the thread to exit, and don't wait for it. A thread that is stopped or
+ * frozen exits only when a user lets it run again, and the exit work of the
+ * ring would keep its place in the workqueue until then. All rings have left
+ * ctx_list by now and have no request left, so the thread can reach none of
+ * them. What it still uses is its own or counted: the sqd by free_refs, the
+ * hash of its io-wq by hash->refs.
+ */
 void io_sq_thread_stop(struct io_sq_data *sqd)
 {
 	struct task_struct *tsk;
@@ -76,7 +94,6 @@ void io_sq_thread_stop(struct io_sq_data *sqd)
 		wake_up_process(tsk);
 	}
 	mutex_unlock(&sqd->lock);
-	wait_for_completion(&sqd->exited);
 }
 
 void io_put_sq_data(struct io_sq_data *sqd)
@@ -85,7 +102,7 @@ void io_put_sq_data(struct io_sq_data *sqd)
 		WARN_ON_ONCE(atomic_read(&sqd->park_pending));
 
 		io_sq_thread_stop(sqd);
-		kfree(sqd);
+		io_sq_data_release(sqd);
 	}
 }
 
@@ -159,10 +176,10 @@ static struct io_sq_data *io_get_sq_data(struct io_uring_params *p,
 
 	atomic_set(&sqd->park_pending, 0);
 	refcount_set(&sqd->refs, 1);
+	refcount_set(&sqd->free_refs, 2);
 	INIT_LIST_HEAD(&sqd->ctx_list);
 	mutex_init(&sqd->lock);
 	init_waitqueue_head(&sqd->wait);
-	init_completion(&sqd->exited);
 	return sqd;
 }
 
@@ -429,7 +446,7 @@ static int io_sq_thread(void *data)
 	io_run_task_work();
 	mutex_unlock(&sqd->lock);
 err_out:
-	complete(&sqd->exited);
+	io_sq_data_release(sqd);
 	do_exit(0);
 }
 
@@ -543,7 +560,8 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 	}
 	return 0;
 err_sqpoll:
-	complete(&ctx->sq_data->exited);
+	/* no thread was made: let go of its share */
+	io_sq_data_release(ctx->sq_data);
 err:
 	io_sq_thread_finish(ctx);
 	return ret;
diff --git a/io_uring/sqpoll.h b/io_uring/sqpoll.h
index fd2f6f29b516ef..024a51dc306966 100644
--- a/io_uring/sqpoll.h
+++ b/io_uring/sqpoll.h
@@ -2,6 +2,8 @@
 
 struct io_sq_data {
 	refcount_t		refs;
+	/* one for all the rings, one for the thread: the last put frees */
+	refcount_t		free_refs;
 	atomic_t		park_pending;
 	struct mutex		lock;
 
@@ -18,7 +20,6 @@ struct io_sq_data {
 
 	u64			work_time;
 	unsigned long		state;
-	struct completion	exited;
 };
 
 int io_sq_offload_create(struct io_ring_ctx *ctx, struct io_uring_params *p);

From 0ac8f069a8bd7a507df59c505182065ae720e946 Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Wed, 4 Nov 2026 11:44:10 -0700
Subject: [PATCH 0972/1982] io_uring: defer foreign io-wq enqueues to task_work

Commit 3de16279b43dc285ed2222aba06cebdc82fdb28b upstream.

An IOPOLL ring without DEFER_TASKRUN can be reaped by a task other than
the one that submitted the I/O. If a polled request is marked
REQ_F_REISSUE, io_free_batch_list() calls io_queue_iowq() with the
original tctx. Ordinary task exit can tear down tctx->io_wq after
draining only the tracked requests. The live request pins the task, but
not its io-wq, so the foreign task can race io_wq_put_and_exit() and
enqueue through a freed or NULL queue.

Forward foreign userspace enqueues to the owning task before accessing
tctx->io_wq. Use a dedicated task_work callback so reissues still go
straight to io-wq, and fail them if task_work is running in cancellation
mode. Preserve the existing PF_KTHREAD cancellation path. This also
covers the other callers of io_queue_iowq() without changing the
worker-owned enqueue path.

Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[axboe: 6.18 lacks 13b0742fd058, which removed io_req_queue_iowq(). Name
the new task_work callback io_queue_iowq_foreign_tw() so it doesn't
clash with the existing io_req_queue_iowq_tw()]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index ac097a9ac8c068..4a9f3a0fe50628 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -483,6 +483,19 @@ static __always_inline bool io_assign_file(struct io_kiocb *req,
 	return !!req->file;
 }
 
+static void io_queue_iowq(struct io_kiocb *req);
+
+static void io_queue_iowq_foreign_tw(struct io_tw_req tw_req, io_tw_token_t tw)
+{
+	struct io_kiocb *req = tw_req.req;
+
+	io_tw_lock(req->ctx, tw);
+	if (unlikely(tw.cancel))
+		io_req_defer_failed(req, -ECANCELED);
+	else
+		io_queue_iowq(req);
+}
+
 static void io_queue_iowq(struct io_kiocb *req)
 {
 	struct io_uring_task *tctx = req->tctx;
@@ -490,10 +503,17 @@ static void io_queue_iowq(struct io_kiocb *req)
 	BUG_ON(!tctx);
 	lockdep_assert_held(&req->ctx->uring_lock);
 
-	if ((current->flags & PF_KTHREAD) || !tctx->io_wq) {
-		io_req_task_queue_fail(req, -ECANCELED);
+	if (current->flags & PF_KTHREAD)
+		goto cancel;
+
+	/* Only the submitter can safely access its io-wq during task exit. */
+	if (unlikely(current != tctx->task)) {
+		req->io_task_work.func = io_queue_iowq_foreign_tw;
+		io_req_task_work_add(req);
 		return;
 	}
+	if (!tctx->io_wq)
+		goto cancel;
 
 	/*
 	 * The file is looked up as late as possible, as it may be the result
@@ -522,6 +542,9 @@ static void io_queue_iowq(struct io_kiocb *req)
 
 	trace_io_uring_queue_async_work(req, io_wq_is_hashed(&req->work));
 	io_wq_enqueue(tctx->io_wq, &req->work);
+	return;
+cancel:
+	io_req_task_queue_fail(req, -ECANCELED);
 }
 
 static void io_req_queue_iowq_tw(struct io_tw_req tw_req, io_tw_token_t tw)

From b5e22247346f6bd20b3bf7250c000865e323bead Mon Sep 17 00:00:00 2001
From: Cheng Yongkang <teel4res@gmail.com>
Date: Wed, 4 Nov 2026 11:44:11 -0700
Subject: [PATCH 0973/1982] io_uring/timeout: count cancelled timeouts in
 cq_timeouts

Commit 1c8b49851543f41fc8bb18bcd1f15cc93d14b530 upstream.

io_timeout_cancel() posts the cancelled timeout's -ECANCELED CQE without
advancing ctx->cq_timeouts.  io_timeout_fn() and io_kill_timeout()
advance it for every timeout CQE they post, and io_flush_timeouts()
computes the number of non-timeout completions as

    seq = cached_cq_tail - cq_timeouts

to compare against each off timeout's target_seq.  The cancelled
timeout's CQE is therefore counted as a regular completion, so every
cancellation makes an already armed off timeout fire one completion
early.

A ring with a keep-alive timeout of off=4 completes it after two NOPs
when one off=100 victim is cancelled through IORING_OP_ASYNC_CANCEL, and
before any NOP when two victims are cancelled.  The cancel CQE should
count, but the cancelled timeouts' -ECANCELED CQEs must not: the
expected counts are three and two NOPs respectively.

Advance cq_timeouts when io_timeout_extract() succeeds, under
timeout_lock and before the -ECANCELED completion is queued, matching
io_timeout_fn() and io_kill_timeout().  The -ENOENT and -EALREADY paths
post no new timeout CQE and keep their accounting.  Both the
ASYNC_CANCEL and the TIMEOUT_REMOVE path go through io_timeout_cancel().

Fixes: bfe68a221905 ("io_uring: off timeouts based only on completions")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
Link: https://patch.msgid.link/179328314078.648427.13761781546953594668@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/timeout.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index dbbb9615ec9e0a..2637c8bb61a082 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -327,6 +327,9 @@ int io_timeout_cancel(struct io_ring_ctx *ctx, struct io_cancel_data *cd)
 
 	raw_spin_lock_irq(&ctx->timeout_lock);
 	req = io_timeout_extract(ctx, cd);
+	if (!IS_ERR(req))
+		atomic_set(&ctx->cq_timeouts,
+			   atomic_read(&ctx->cq_timeouts) + 1);
 	raw_spin_unlock_irq(&ctx->timeout_lock);
 
 	if (IS_ERR(req))

From 0eec7b84e83ff90b81bc302a49f463728f2e9572 Mon Sep 17 00:00:00 2001
From: Cheng Yongkang <teel4res@gmail.com>
Date: Wed, 4 Nov 2026 11:44:12 -0700
Subject: [PATCH 0974/1982] io_uring/net: fix multishot recv length limit
 accounting

Commit 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c upstream.

io_recv_finish() debits sr->mshot_total_len with min_t(int, sel->val,
sr->mshot_total_len).  sel->val is the cumulative byte count of the
request: on a bundle retry the receive path adds sr->done_io back to the
return value, and the bundle branch in io_recv_finish() recovers the new
bytes with this_ret = sel->val - sr->done_io.  The debit therefore uses
the wrong value after a bundle retry, and the int cast truncates a limit
above INT_MAX.

For an IORING_OP_RECV multishot request with optlen above INT_MAX, the
limit becomes negative when cast to int, so the first completion debits
the entire limit and ends the multishot with IORING_RECV_MSHOT_DONE
while the socket still holds data that covers the limit.  With 120 bytes
queued, a 64-byte buffer and optlen 0x80000000, the first 64-byte CQE
lacks IORING_CQE_F_MORE and 56 bytes remain unread; the same setup with
optlen 0x7fffffff posts 64 and 56 bytes with F_MORE.

After a bundle retry, the bytes already debited for the previous
attempts are debited again, so the limit is exhausted early.  With 1400
bytes queued, optlen 1000 and buffers of 600, 100, 100, 50, 50 and 200
bytes, the first attempt delivers 700 bytes and retries; the second
delivers 200 more, but the debit accounts for 900 and finishes the
request with a terminal 900-byte CQE while 500 bytes remain unread.  The
limit could have been reached.

Debit only the bytes received by this invocation, sel->val -
sr->done_io, and compare as unsigned so a limit above INT_MAX is
accounted correctly. Non-bundle multishot requests keep sr->done_io at
zero, so their accounting is unchanged.

Fixes: 0ebc9a7ecf6a ("io_uring/net: Support multishot receive len cap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
Link: https://patch.msgid.link/179328314078.648427.10086632105828535293@gmail.com
[axboe: fix-up near-by incorrect comment while in there]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/net.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index e78ec89ca5ddf1..e8d5d17fc754ba 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -879,12 +879,15 @@ static inline bool io_recv_finish(struct io_kiocb *req,
 		cflags |= IORING_CQE_F_SOCK_NONEMPTY;
 
 	if (sel->val > 0 && sr->flags & IORING_RECV_MSHOT_LIM) {
+		unsigned int this_len = sel->val - sr->done_io;
+
 		/*
-		 * If sr->len hits zero, the limit has been reached. Mark
-		 * mshot as finished, and flag MSHOT_DONE as well to prevent
-		 * a potential bundle from being retried.
+		 * If sr->mshot_total_len hits zero, the limit has been reached.
+		 * Mark mshot as finished, and flag MSHOT_DONE as well to
+		 * prevent a potential bundle from being retried.
 		 */
-		sr->mshot_total_len -= min_t(int, sel->val, sr->mshot_total_len);
+		sr->mshot_total_len -= min_t(unsigned int, this_len,
+					     sr->mshot_total_len);
 		if (!sr->mshot_total_len) {
 			sr->flags |= IORING_RECV_MSHOT_DONE;
 			mshot_finished = true;

From ee793cc8dcd58ed9afa0a69a84d66df4f8eacd88 Mon Sep 17 00:00:00 2001
From: Zikang Gao <2715417602@qq.com>
Date: Mon, 2 Nov 2026 17:14:57 -0500
Subject: [PATCH 0975/1982] smb: client: do not pass a NULL buf to
 is_oplock_break()

[ Upstream commit 2225ab306575e424b3dad2ee1be2521c89249d15 ]

receive_encrypted_read() sets *num_mids = 1 and never writes the
caller's bufs[]. Offload returns -1 with *num_mids = 0, so the
demultiplex thread skips the frame. The inline decrypt path
returns 0 even when smb2_find_mid() fails.

cifs_demultiplex_thread() then treats mids[i] == NULL as an
oplock break and calls is_oplock_break(bufs[i], server) with
bufs[i] still NULL. smb2_is_valid_oplock_break() reads
hdr.Command at offset 12 and oopses.

A large encrypted READ whose MessageId does not match is enough
to panic cifsd.

    Oops: general protection fault, probably for non-canonical address
    0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
    KASAN: null-ptr-deref in range
    [0x0000000000000008-0x000000000000000f]
    CPU: 0 PID: 100 Comm: cifsd
    RIP: smb2_is_valid_oplock_break+0xc8/0x2270 [cifs]
    cifs_demultiplex_thread
    Kernel panic - not syncing: Fatal exception

Return -1 when inline decrypt finds no mid, and skip
is_oplock_break() plus the unknown-frame dump when bufs[i]
is NULL. receive_encrypted_standard() already assigns
bufs[*num_mids].

Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses")
Assisted-by: LLM
Signed-off-by: Zikang Gao <2715417602@qq.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: stable@vger.kernel.org
[ sashal: Adjusted context to retain the existing one-argument mid_execute_callback() and release_mid() calls. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/connect.c | 4 +++-
 fs/smb/client/smb2ops.c | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 3089b469b80183..2cbbbf0c93b809 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1400,12 +1400,14 @@ cifs_demultiplex_thread(void *p)
 					mid_execute_callback(mids[i]);
 
 				release_mid(mids[i]);
-			} else if (server->ops->is_oplock_break &&
+			} else if (bufs[i] && server->ops->is_oplock_break &&
 				   server->ops->is_oplock_break(bufs[i],
 								server)) {
 				smb2_add_credits_from_hdr(bufs[i], server);
 				cifs_dbg(FYI, "Received oplock break\n");
 			} else {
+				if (!bufs[i])
+					continue;
 				cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
 						atomic_read(&mid_count));
 				cifs_dump_mem("Received Data is: ", bufs[i],
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index f47f0f9ca781bb..7cf6419df037d1 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5381,6 +5381,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
 	*mid = smb2_find_mid(server, buf);
 	if (*mid == NULL) {
 		cifs_dbg(FYI, "mid not found\n");
+		rc = -1;
 	} else {
 		cifs_dbg(FYI, "mid found\n");
 		(*mid)->decrypted = true;

From 4d6e1b44d1fbfa70b045a670b18200dc4824226b Mon Sep 17 00:00:00 2001
From: Fredric Cover <fredric.cover.lkernel@gmail.com>
Date: Mon, 2 Nov 2026 17:15:04 -0500
Subject: [PATCH 0976/1982] smb: client: fix early procfs exposure race

[ Upstream commit 7b1afb631395c958993cda4631002258ef4151ea ]

Currently, init_cifs() calls cifs_proc_init() near the beginning of
the function, before INIT_LIST_HEAD, leading to a momentarily
uninitialized, but exposed, procfs. If a userspace process reads this
empty procfs, iterating over a zeroed list_head leads to a NULL
pointer dereference and a kernel oops/panic.

For example, if a delay is added between cifs_proc_init() and
INIT_LIST_HEAD, and a userspace process is polling
/proc/fs/cifs/DebugData, the following oops occurs:

BUG: kernel NULL pointer dereference, address: 0000000000000608
Oops: Oops: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 3477 Comm: cat Not tainted
7.3.0-02212-g4df4d2a577db-dirty #6 PREEMPT(lazy)
RIP: 0010:cifs_debug_data_proc_show+0x103/0xd80 [cifs]
Call Trace:
<TASK>
 ? seq_read_iter+0x86/0x400
 ? seq_read_iter+0x86/0x400
 seq_read_iter+0x183/0x400
 proc_reg_read_iter+0x62/0x90
 copy_splice_read+0x215/0x310
 splice_file_to_pipe+0xec/0x1c0
 do_splice+0x4b8/0x780
 __se_sys_splice+0x18f/0x250
 do_syscall_64+0x109/0x330
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>

Fix this by moving cifs_proc_init() down in init_cifs(), ensuring it runs
only after all internal lists, locks, counters, and workqueues are fully
ready, but before registering the filesystem. Update the error cleanup
ladder and exit_cifs() to maintain proper LIFO order.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
[ sashal: Adjusted init_cifs() context because smb1_init_maperror() and smb2_init_maperror() are absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/client/cifsfs.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 23ec5c3666d3d3..3da0fc08ffd94e 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -1972,7 +1972,6 @@ static int __init
 init_cifs(void)
 {
 	int rc = 0;
-	cifs_proc_init();
 	INIT_LIST_HEAD(&cifs_tcp_ses_list);
 /*
  *  Initialize Global counters
@@ -2021,10 +2020,8 @@ init_cifs(void)
 	cifsiod_wq = alloc_workqueue("cifsiod",
 				     WQ_FREEZABLE | WQ_MEM_RECLAIM | WQ_PERCPU,
 				     0);
-	if (!cifsiod_wq) {
-		rc = -ENOMEM;
-		goto out_clean_proc;
-	}
+	if (!cifsiod_wq)
+		return -ENOMEM;
 
 	/*
 	 * Consider in future setting limit!=0 maybe to min(num_of_cores - 1, 3)
@@ -2115,19 +2112,22 @@ init_cifs(void)
 	if (rc)
 		goto out_cifs_swn_init;
 
+	cifs_proc_init();
+
 	rc = register_filesystem(&cifs_fs_type);
 	if (rc)
-		goto out_init_cifs_idmap;
+		goto out_clean_proc;
 
 	rc = register_filesystem(&smb3_fs_type);
 	if (rc) {
 		unregister_filesystem(&cifs_fs_type);
-		goto out_init_cifs_idmap;
+		goto out_clean_proc;
 	}
 
 	return 0;
 
-out_init_cifs_idmap:
+out_clean_proc:
+	cifs_proc_clean();
 	exit_cifs_idmap();
 out_cifs_swn_init:
 #ifdef CONFIG_CIFS_SWN_UPCALL
@@ -2163,8 +2163,6 @@ init_cifs(void)
 	destroy_workqueue(decrypt_wq);
 out_destroy_cifsiod_wq:
 	destroy_workqueue(cifsiod_wq);
-out_clean_proc:
-	cifs_proc_clean();
 	return rc;
 }
 
@@ -2174,6 +2172,7 @@ exit_cifs(void)
 	cifs_dbg(NOISY, "exit_smb3\n");
 	unregister_filesystem(&cifs_fs_type);
 	unregister_filesystem(&smb3_fs_type);
+	cifs_proc_clean();
 	cifs_release_automount_timer();
 	exit_cifs_idmap();
 #ifdef CONFIG_CIFS_SWN_UPCALL
@@ -2196,7 +2195,6 @@ exit_cifs(void)
 	destroy_workqueue(serverclose_wq);
 	destroy_workqueue(cfid_put_wq);
 	destroy_workqueue(cifsiod_wq);
-	cifs_proc_clean();
 }
 
 MODULE_AUTHOR("Steve French");

From 2af51c1d68e6ff96d26e4e5e9cf62bf253149442 Mon Sep 17 00:00:00 2001
From: Vincent Liu <vincent.liu@nutanix.com>
Date: Tue, 3 Nov 2026 08:43:17 -0500
Subject: [PATCH 0977/1982] driver core: Check drivers_autoprobe for all added
 devices

[ Upstream commit ea34511aaf755349999a1067b2984a541bee1492 ]

When a device is hot-plugged, the drivers_autoprobe sysfs attribute is
not checked (at least for PCI devices). This means that
drivers_autoprobe is not working as intended, e.g. hot-plugged PCI
devices will still be autoprobed and bound to drivers even with
drivers_autoprobe disabled.

The problem likely started when device_add() was removed from
pci_bus_add_device() in commit 4f535093cf8f ("PCI: Put pci_dev in device
tree as early as possible") which means that the check for
drivers_autoprobe which used to happen in bus_probe_device() is no
longer present (previously bus_add_device() calls bus_probe_device()).
Conveniently, in commit 91703041697c ("PCI: Allow built-in drivers to
use async initial probing") device_attach() was replaced with
device_initial_probe() which faciliates this change to push the check
for drivers_autoprobe into device_initial_probe().

Make sure all devices check drivers_autoprobe by pushing the
drivers_autoprobe check into device_initial_probe(). This will only
affect devices on the PCI bus for now as device_initial_probe() is only
called by pci_bus_add_device() and bus_probe_device(), but
bus_probe_device() already checks for autoprobe, so callers of
bus_probe_device() should not observe changes on autoprobing.
Note also that pushing this check into device_initial_probe() rather
than device_attach() makes it only affect automatic probing of
drivers (e.g. when a device is hot-plugged), userspace can still choose
to manually bind a driver by writing to drivers_probe sysfs attribute,
even with autoprobe disabled.

Any future callers of device_initial_probe() will respect the
drivers_autoprobe sysfs attribute, which is the intended purpose of
drivers_autoprobe.

Signed-off-by: Vincent Liu <vincent.liu@nutanix.com>
Link: https://patch.msgid.link/20251022120740.2476482-1-vincent.liu@nutanix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 187a62f99da2 ("driver core: take parent lock in async device attach")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/bus.c |  3 +--
 drivers/base/dd.c  | 10 +++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 5e73e0bdb11274..069e1aa991e686 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -573,8 +573,7 @@ static void __bus_probe_device(struct device *dev)
 	if (!sp)
 		return;
 
-	if (sp->drivers_autoprobe)
-		device_initial_probe(dev);
+	device_initial_probe(dev);
 
 	mutex_lock(&sp->mutex);
 	list_for_each_entry(sif, &sp->interfaces, node)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 6ae212614e5448..707d65396f2e03 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1157,7 +1157,15 @@ EXPORT_SYMBOL_GPL(device_attach);
 
 void device_initial_probe(struct device *dev)
 {
-	__device_attach(dev, true);
+	struct subsys_private *sp = bus_to_subsys(dev->bus);
+
+	if (!sp)
+		return;
+
+	if (sp->drivers_autoprobe)
+		__device_attach(dev, true);
+
+	subsys_put(sp);
 }
 
 /*

From 1f1a7cdcc7a9a73b5496a45390fb13b7bf7b088f Mon Sep 17 00:00:00 2001
From: Mario Peter <mario.peter@leica-geosystems.com>
Date: Tue, 3 Nov 2026 08:43:18 -0500
Subject: [PATCH 0978/1982] driver core: take parent lock in async device
 attach

[ Upstream commit 187a62f99da29b1a55602b0d401a783d8dc86161 ]

For device types with need_parent_lock set (only USB interfaces),
probe() must run with the parent device locked. A synchronous attach
after device_add() gets this from the caller, e.g.
usb_set_configuration() holds the udev lock while adding interfaces.
__device_attach_async_helper() runs the probe from an async worker
instead, where that lock isn't held, and only takes device_lock(dev).

With async probing enabled for the hub driver (e.g. driver_async_probe=*
or driver_async_probe=hub), this races when a multi-TT hub is
configured. For multi-TT hubs, hub_probe() calls
usb_set_interface(hdev, 0, 1) to select the TT-per-port altsetting, and
usb_set_interface() creates the endpoint devices of the interface a
second time:

  usb_set_configuration()           async worker
    [udev locked]
    device_add(intf)
      queues the probe  ----------> __device_attach_async_helper()
                                      [intf locked, udev not locked]
                                      hub_probe()
                                        usb_set_interface(hdev, 0, 1)
    create_intf_ep_devs(intf)             create_intf_ep_devs(intf)

create_intf_ep_devs() checks and sets intf->ep_devs_created without a
lock of its own. If usb_set_configuration() has created ep_81 but not
yet set the flag, usb_set_interface() skips removing the endpoint
devices of the old altsetting and creates ep_81 again. With a
synchronous probe, hub_probe() runs inside device_add() with the udev
lock held, and usb_set_configuration() then finds ep_devs_created
already set.

Single-TT hubs don't call usb_set_interface() from hub_probe() and
don't show this warning, but their probe runs without the udev lock as
well.

On an i.MX8MM board with an onboard USB2514 hub this hit 11 of 100
boots:

  sysfs: cannot create duplicate filename '.../1-1/1-1:1.0/ep_81'
  Call trace:
   sysfs_warn_dup
   usb_create_ep_devs
   create_intf_ep_devs
   usb_set_interface
   hub_probe
   usb_probe_interface
   really_probe
   __device_attach_async_helper
   async_run_entry_fn

It also shows on v7.3-rc6 in QEMU, with dummy_hcd and a raw-gadget
program emulating a multi-TT hub: re-authorizing the hub in a loop,
while a SCHED_FIFO task preempts the writing task at random points for
3 ms, hit the warning in 29 of 6000 iterations.

Take the parent lock in __device_attach_async_helper() as well, like
__driver_attach_async_helper() does, and move
__device_driver_lock/unlock() up for that. With this the warning was
gone in 300 boots on the board and in 6000 iterations in QEMU.

Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers")
Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
Cc: stable@vger.kernel.org	# 4.2
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ johan: switch to async_schedule_dev_nocall() to avoid deadlock if
         async_schedule_dev() runs synchronously when parent lock is
	 held ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261014133109.1392265-4-johan@kernel.org
[ Fold the nested conditions into a single if statement; correct commit
  message to mention "device types" rather than "buses" for
  "need_parent_lock". - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/dd.c | 83 +++++++++++++++++++++++++----------------------
 1 file changed, 45 insertions(+), 38 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 707d65396f2e03..2a94aad0f71e47 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1042,6 +1042,38 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
 	return ret == 0;
 }
 
+/*
+ * __device_driver_lock - acquire locks needed to manipulate dev->drv
+ * @dev: Device we will update driver info for
+ * @parent: Parent device. Needed if the device type requires parent lock
+ *
+ * This function will take the required locks for manipulating dev->drv.
+ * Normally this will just be the @dev lock, but when called for a USB
+ * interface, @parent lock will be held as well.
+ */
+static void __device_driver_lock(struct device *dev, struct device *parent)
+{
+	if (dev->type && dev->type->need_parent_lock && parent)
+		device_lock(parent);
+	device_lock(dev);
+}
+
+/*
+ * __device_driver_unlock - release locks needed to manipulate dev->drv
+ * @dev: Device we will update driver info for
+ * @parent: Parent device. Needed if the device type requires parent lock
+ *
+ * This function will release the required locks for manipulating dev->drv.
+ * Normally this will just be the @dev lock, but when called for a
+ * USB interface, @parent lock will be released as well.
+ */
+static void __device_driver_unlock(struct device *dev, struct device *parent)
+{
+	device_unlock(dev);
+	if (dev->type && dev->type->need_parent_lock && parent)
+		device_unlock(parent);
+}
+
 static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
 {
 	struct device *dev = _dev;
@@ -1051,7 +1083,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
 		.want_async	= true,
 	};
 
-	device_lock(dev);
+	__device_driver_lock(dev, dev->parent);
 
 	/*
 	 * Check if device has already been removed or claimed. This may
@@ -1073,7 +1105,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
 	if (dev->parent)
 		pm_runtime_put(dev->parent);
 out_unlock:
-	device_unlock(dev);
+	__device_driver_unlock(dev, dev->parent);
 
 	put_device(dev);
 }
@@ -1130,8 +1162,11 @@ static int __device_attach(struct device *dev, bool allow_async)
 	}
 out_unlock:
 	device_unlock(dev);
-	if (async)
-		async_schedule_dev(__device_attach_async_helper, dev);
+	if (async && !async_schedule_dev_nocall(__device_attach_async_helper, dev)) {
+		put_device(dev);
+		ret = 2;	/* retry synchronously */
+	}
+
 	return ret;
 }
 
@@ -1158,48 +1193,20 @@ EXPORT_SYMBOL_GPL(device_attach);
 void device_initial_probe(struct device *dev)
 {
 	struct subsys_private *sp = bus_to_subsys(dev->bus);
+	int ret;
 
 	if (!sp)
 		return;
 
-	if (sp->drivers_autoprobe)
-		__device_attach(dev, true);
+	if (sp->drivers_autoprobe) {
+		ret = __device_attach(dev, true);
+		if (ret == 2)
+			__device_attach(dev, false);
+	}
 
 	subsys_put(sp);
 }
 
-/*
- * __device_driver_lock - acquire locks needed to manipulate dev->drv
- * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the device type requires parent lock
- *
- * This function will take the required locks for manipulating dev->drv.
- * Normally this will just be the @dev lock, but when called for a USB
- * interface, @parent lock will be held as well.
- */
-static void __device_driver_lock(struct device *dev, struct device *parent)
-{
-	if (dev->type && dev->type->need_parent_lock && parent)
-		device_lock(parent);
-	device_lock(dev);
-}
-
-/*
- * __device_driver_unlock - release locks needed to manipulate dev->drv
- * @dev: Device we will update driver info for
- * @parent: Parent device. Needed if the device type requires parent lock
- *
- * This function will release the required locks for manipulating dev->drv.
- * Normally this will just be the @dev lock, but when called for a
- * USB interface, @parent lock will be released as well.
- */
-static void __device_driver_unlock(struct device *dev, struct device *parent)
-{
-	device_unlock(dev);
-	if (dev->type && dev->type->need_parent_lock && parent)
-		device_unlock(parent);
-}
-
 /**
  * device_driver_attach - attach a specific driver to a specific device
  * @drv: Driver to attach

From 28db998d396a9b2e6e9ecf69c2a201b8f06df2b2 Mon Sep 17 00:00:00 2001
From: Aamir Ahmed <elb12345@hotmail.co.uk>
Date: Tue, 3 Nov 2026 09:59:19 -0500
Subject: [PATCH 0979/1982] ksmbd: deny access for an empty DACL instead of
 granting the request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit de0cffef897c1c232ed973f89928cd6c93d0b1e3 ]

smb_check_perm_dacl() returns the access mask it computes to the SMB2
CREATE handler, which uses it as the granted access for the open. For a
security descriptor whose DACL is present but contains no ACEs, the
function is supposed to deny access: an empty (non-NULL) DACL grants no
access to anyone except the object owner's implicit READ_CONTROL and
WRITE_DAC (MS-DTYP 2.4.5).

The empty-DACL branch only denies when both

  - the DACL has no trailing bytes (pdacl_size == sizeof(struct smb_acl)),
    and
  - the request contains bits beyond READ_CONTROL / WRITE_DAC.

In every other case it takes the shared "goto err_out" with rc still 0,
which returns success without modifying *pdaccess, so the caller grants
the full requested access. Three problems follow:

  - The READ_CONTROL / WRITE_DAC carve-out models the owner's implicit
    rights, but the check runs before is_owner is computed, so those
    rights are handed to *every* caller, not just the owner. For
    READ_CONTROL the SMB2 CREATE path does not fall back to
    inode_permission(), so any user can read the security descriptor of
    an object whose empty DACL is meant to deny them.

  - A request of exactly READ_CONTROL and/or WRITE_DAC is granted to any
    caller. WRITE_DAC lets the handle rewrite the DACL.

  - A DACL that declares zero ACEs but carries trailing bytes
    (pdacl_size > sizeof(struct smb_acl)) skips the deny entirely and is
    granted whatever was requested.

On shares where the NT ACL is the authoritative access control -- e.g.
"force user" shares, where every client maps to one POSIX identity so
POSIX cannot distinguish users -- this is an access-control bypass.

Compute is_owner before the empty-DACL branch and deny access from an
empty DACL unless the caller is the owner requesting no more than
READ_CONTROL / WRITE_DAC.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: added missing ownership declarations and initialization of is_owner using the mount’s ID mapping ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smbacl.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c
index 49a35974dd2966..33a607e709f183 100644
--- a/fs/smb/server/smbacl.c
+++ b/fs/smb/server/smbacl.c
@@ -1469,6 +1469,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
 	struct posix_acl_entry *pa_entry;
 	unsigned int sid_type = SIDOWNER;
 	unsigned short ace_size;
+	bool is_owner;
+	vfsuid_t vfsuid;
 
 	ksmbd_debug(SMB, "check permission using windows acl\n");
 	pntsd_size = ksmbd_vfs_get_sd_xattr(conn, idmap,
@@ -1489,19 +1491,27 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path,
 	if (pdacl_size > acl_size || pdacl_size < sizeof(struct smb_acl))
 		goto err_out;
 
+	if (!uid)
+		sid_type = SIDUNIX_USER;
+	id_to_sid(uid, sid_type, &sid);
+	vfsuid = i_uid_into_vfsuid(idmap, d_inode(path->dentry));
+	is_owner = uid == from_kuid(&init_user_ns, vfsuid_into_kuid(vfsuid));
+
 	if (!pdacl->num_aces) {
-		if (!(pdacl_size - sizeof(struct smb_acl)) &&
-		    *pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)) {
+		/*
+		 * An empty (present, zero-ACE) DACL grants no access to
+		 * anyone except the object owner's implicit READ_CONTROL
+		 * and WRITE_DAC (MS-DTYP 2.4.5). Deny every other caller,
+		 * deny the owner any access beyond those two bits, and do
+		 * not let trailing bytes after a zero-ACE DACL become an
+		 * implicit grant.
+		 */
+		if (!is_owner ||
+		    (*pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)))
 			rc = -EACCES;
-			goto err_out;
-		}
 		goto err_out;
 	}
 
-	if (!uid)
-		sid_type = SIDUNIX_USER;
-	id_to_sid(uid, sid_type, &sid);
-
 	if (*pdaccess & FILE_MAXIMAL_ACCESS_LE) {
 		access_bits = READ_CONTROL | WRITE_DAC | FILE_READ_ATTRIBUTES |
 			DELETE;

From 38cddb9f7c9102f23652d198748c658072cf0df5 Mon Sep 17 00:00:00 2001
From: Ian Bridges <icb@fastmail.org>
Date: Tue, 3 Nov 2026 10:29:53 -0500
Subject: [PATCH 0980/1982] ksmbd: fix session reference leak on compounded
 SESSION_SETUP

[ Upstream commit 03bd8f5279e490e15e0c0f0fa388ffbd2fbacd65 ]

A compound request can place SESSION_SETUP after another command. That
earlier command leaves a reference to its session in work->sess.
smb2_sess_setup() then overwrites work->sess with the session it looks up
or creates, and the dispatcher later puts work->sess only once. The
inherited reference is never dropped. That leaks the session, together
with its setup connection and socket, and every repeat of the compound
leaks another.

  unreferenced object (size 512):
    __kmalloc_cache_noprof+0x32c/0x3a0
    ksmbd_smb2_session_create+0xf6/0x9c0 [ksmbd]
    smb2_sess_setup+0xda4/0x6280 [ksmbd]
    handle_ksmbd_work+0x88c/0x1cb0 [ksmbd]

Save the inherited session on entry. After the request has been
processed, release it once, but only when smb2_sess_setup() has replaced
work->sess with its own session or cleared it. Do this after
ksmbd_conn_unlock() so the put does not run under srv_mutex. An error path
may instead leave the inherited session in work->sess. Keep it there, so
the dispatcher still puts it and the error response is still signed or
encrypted with it as before.

Fixes: 7aa8804c0b67 ("ksmbd: fix user-after-free from session log off")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Omitted the installed = true assignment for the absent rejected-binding signature-check block. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 5ba6869038f3dd..39c98fc304f3f2 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1698,6 +1698,8 @@ int smb2_sess_setup(struct ksmbd_work *work)
 	struct smb2_sess_setup_req *req;
 	struct smb2_sess_setup_rsp *rsp;
 	struct ksmbd_session *sess;
+	struct ksmbd_session *prev_sess = work->sess;
+	bool installed = false;
 	struct negotiate_message *negblob;
 	unsigned int negblob_len, negblob_off;
 	int rc = 0;
@@ -1835,6 +1837,7 @@ int smb2_sess_setup(struct ksmbd_work *work)
 		conn->binding = false;
 	}
 	work->sess = sess;
+	installed = true;
 
 	negblob_off = le16_to_cpu(req->SecurityBufferOffset);
 	negblob_len = le16_to_cpu(req->SecurityBufferLength);
@@ -1988,6 +1991,14 @@ int smb2_sess_setup(struct ksmbd_work *work)
 	}
 
 	ksmbd_conn_unlock(conn);
+
+	/*
+	 * Later in a compound, work->sess holds the reference that an
+	 * earlier command took. Drop it once this request has installed
+	 * its own session there or cleared it.
+	 */
+	if (prev_sess && (installed || !work->sess))
+		ksmbd_user_session_put(prev_sess);
 	return rc;
 }
 

From 2756a41a82d618bf1d8b41d74108311815cb695c Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Tue, 3 Nov 2026 10:34:00 -0500
Subject: [PATCH 0981/1982] ksmbd: prevent share root removal through empty
 paths

[ Upstream commit 9fd1fcbbf84986a7bcf601a2b90540899069d263 ]

A FileLinkInformation request can supply "/" as the new link name.
smb2_get_name() strips the trailing slash and passes an empty string to
ksmbd_vfs_kern_path_start_removing().

ksmbd_vfs_path_lookup() resolves an empty pathname as the configured share
path, without LOOKUP_BENEATH. With ReplaceIfExists set, smb2_create_link()
can therefore remove the share root from its parent before link creation
fails. An authenticated client with a writable share and DELETE access to
a file can trigger this if the share root is empty and the mapped user
has write and search permission on its parent directory.

Return -EINVAL for empty pathnames when for_remove is set, before
resolving the share path or acquiring removal resources. Ordinary lookups
continue to accept empty pathnames for opening the share root.

Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name")
Cc: stable@vger.kernel.org
Reported-by: Zachariah Mithani (AploSec) <zachariah@aplosai.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Replaced for_remove with the existing do_lock parameter. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/vfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index c18ab8431e0d23..29b204776b961b 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -78,6 +78,10 @@ static int ksmbd_vfs_path_lookup(struct ksmbd_share_config *share_conf,
 	struct dentry *d;
 
 	if (pathname[0] == '\0') {
+		/* The share root must never be removed. */
+		if (do_lock)
+			return -EINVAL;
+
 		pathname = share_conf->path;
 		root_share_path = NULL;
 	} else {

From fbe9fcda7ae8835b454c376de1d49232ab6bbcfb Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Tue, 3 Nov 2026 10:47:24 -0500
Subject: [PATCH 0982/1982] ksmbd: prevent stale data from being written by
 SMB2 WRITE requests

[ Upstream commit bc0e0f5ac1d7b044d403f859406b4b66d4b1ce9b ]

Initialize the compatibility byte in request buffers without zeroing
the entire allocation. Keep the one-byte compatibility exception for
SMB2 messages so valid zero-length WRITE requests remain compatible,
and validate the data range in the WRITE handlers against the current
compound request before accessing it.

This prevents stale request-buffer data from being written to files or
sent to IPC pipes.

Fixes: 443d61d1fa9f ("ksmbd: allocate one more byte for implied bcc[0]")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-32436
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Inlined the unavailable smb2_current_req_len() helper and omitted the decompression change because compression support is absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/connection.c |  1 +
 fs/smb/server/smb2pdu.c    | 34 +++++++++++++++++++++++++---------
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 8f1b70e39362e7..e8739b482b2fe5 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -520,6 +520,7 @@ int ksmbd_conn_handler_loop(void *p)
 		if (!conn->request_buf)
 			break;
 
+		conn->request_buf[pdu_size + 4] = 0;
 		memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
 
 		/*
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 39c98fc304f3f2..9688c70385a23f 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7218,23 +7218,28 @@ static noinline int smb2_write_pipe(struct ksmbd_work *work)
 	int err = 0, ret = 0;
 	char *data_buf;
 	size_t length;
+	unsigned int data_offset, req_len;
 
 	WORK_BUFFERS(work, req, rsp);
 
 	length = le32_to_cpu(req->Length);
 	id = req->VolatileFileId;
+	data_offset = le16_to_cpu(req->DataOffset);
+	req_len = le32_to_cpu(req->hdr.NextCommand);
+	if (!req_len)
+		req_len = get_rfc1002_len(work->request_buf) -
+			work->next_smb2_rcv_hdr_off;
 
-	if ((u64)le16_to_cpu(req->DataOffset) + length >
-	    get_rfc1002_len(work->request_buf)) {
-		pr_err("invalid write data offset %u, smb_len %u\n",
-		       le16_to_cpu(req->DataOffset),
-		       get_rfc1002_len(work->request_buf));
+	if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+	    data_offset > req_len || length > req_len - data_offset) {
+		pr_err("invalid write data offset %u, length %zu, req_len %u\n",
+		       data_offset, length, req_len);
 		err = -EINVAL;
 		goto out;
 	}
 
 	data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
-			   le16_to_cpu(req->DataOffset));
+			   data_offset);
 
 	rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length);
 	if (rpc_resp) {
@@ -7391,14 +7396,25 @@ int smb2_write(struct ksmbd_work *work)
 		writethrough = true;
 
 	if (is_rdma_channel == false) {
-		if (le16_to_cpu(req->DataOffset) <
-		    offsetof(struct smb2_write_req, Buffer)) {
+		unsigned int data_offset = le16_to_cpu(req->DataOffset);
+		unsigned int req_len = le32_to_cpu(req->hdr.NextCommand);
+
+		if (!req_len)
+			req_len = get_rfc1002_len(work->request_buf) -
+				work->next_smb2_rcv_hdr_off;
+
+		if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+		    data_offset > req_len ||
+		    length > req_len - data_offset) {
+			ksmbd_debug(SMB,
+				    "invalid write data offset %u, length %zu, req_len %u\n",
+				    data_offset, length, req_len);
 			err = -EINVAL;
 			goto out;
 		}
 
 		data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
-				    le16_to_cpu(req->DataOffset));
+				    data_offset);
 
 		ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n",
 			    fp->filp, offset, length);

From 4a7f332fd43eee2541197d6e1e297b9ef2e1b07f Mon Sep 17 00:00:00 2001
From: Henry Hu <huhai@kylinos.cn>
Date: Tue, 3 Nov 2026 14:48:15 -0500
Subject: [PATCH 0983/1982] ksmbd: fix invalid pointer dereference when
 get_inode_acl() fails

[ Upstream commit 19d180c7baab7126af5848ed87d5f7b5add0cef2 ]

When get_inode_acl() fails, it returns an ERR_PTR(), but
ksmbd_acls_fattr() stored that pointer in smb_fattr without
checking for errors. Later callers then passed the error pointer
to security descriptor helpers or posix_acl_release(), resulting
in an invalid pointer dereference.

This was reproduced on an XFS-backed share when xfs_get_acl()
returned ERR_PTR(-ENOMEM). Querying the SMB ACL from a CIFS client
triggered the crash:

  BUG: unable to handle page fault for address: fffffffffffffff8
  RIP: smb_acl_sec_desc_scratch_len+0x58/0x90 [ksmbd]
  Call Trace:
   smb2_query_info+0x40d/0x17c0 [ksmbd]
   handle_ksmbd_work+0x1ca/0x770 [ksmbd]

Fix this by checking the return values from get_inode_acl() in
ksmbd_acls_fattr(). Treat -EOPNOTSUPP as indicating that no ACL is
available, and propagate all other errors to the callers. Update
smb2_open() and smb2_get_info_sec() to handle these errors.

Cc: stable@vger.kernel.org
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Henry Hu <huhai@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: retained the non-const mnt_idmap parameter in ksmbd_acls_fattr() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 42 +++++++++++++++++++++++++++++++++--------
 1 file changed, 34 insertions(+), 8 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 9688c70385a23f..070da678d2ce08 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2730,10 +2730,11 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work,
 			    le32_to_cpu(sd_buf->ccontext.DataLength), true, false);
 }
 
-static void ksmbd_acls_fattr(struct smb_fattr *fattr,
-			     struct mnt_idmap *idmap,
-			     struct inode *inode)
+static int ksmbd_acls_fattr(struct smb_fattr *fattr,
+			    struct mnt_idmap *idmap,
+			    struct inode *inode)
 {
+	struct posix_acl *acl;
 	vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
 	vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
 
@@ -2744,10 +2745,28 @@ static void ksmbd_acls_fattr(struct smb_fattr *fattr,
 	fattr->cf_dacls = NULL;
 
 	if (IS_ENABLED(CONFIG_FS_POSIX_ACL)) {
-		fattr->cf_acls = get_inode_acl(inode, ACL_TYPE_ACCESS);
-		if (S_ISDIR(inode->i_mode))
-			fattr->cf_dacls = get_inode_acl(inode, ACL_TYPE_DEFAULT);
+		acl = get_inode_acl(inode, ACL_TYPE_ACCESS);
+		if (IS_ERR(acl)) {
+			if (acl != ERR_PTR(-EOPNOTSUPP))
+				return PTR_ERR(acl);
+			acl = NULL;
+		}
+		fattr->cf_acls = acl;
+
+		if (S_ISDIR(inode->i_mode)) {
+			acl = get_inode_acl(inode, ACL_TYPE_DEFAULT);
+			if (IS_ERR(acl)) {
+				if (acl != ERR_PTR(-EOPNOTSUPP)) {
+					posix_acl_release(fattr->cf_acls);
+					return PTR_ERR(acl);
+				}
+				acl = NULL;
+			}
+			fattr->cf_dacls = acl;
+		}
 	}
+
+	return 0;
 }
 
 enum {
@@ -3482,7 +3501,10 @@ int smb2_open(struct ksmbd_work *work)
 					int pntsd_size;
 					size_t scratch_len;
 
-					ksmbd_acls_fattr(&fattr, idmap, inode);
+					rc = ksmbd_acls_fattr(&fattr, idmap, inode);
+					if (rc)
+						goto err_out;
+
 					scratch_len = smb_acl_sec_desc_scratch_len(&fattr,
 							NULL, 0,
 							OWNER_SECINFO | GROUP_SECINFO |
@@ -5953,7 +5975,11 @@ static int smb2_get_info_sec(struct ksmbd_work *work,
 
 	idmap = file_mnt_idmap(fp->filp);
 	inode = file_inode(fp->filp);
-	ksmbd_acls_fattr(&fattr, idmap, inode);
+	rc = ksmbd_acls_fattr(&fattr, idmap, inode);
+	if (rc) {
+		ksmbd_fd_put(work, fp);
+		return rc;
+	}
 
 	if (test_share_config_flag(work->tcon->share_conf,
 				   KSMBD_SHARE_FLAG_ACL_XATTR))

From 52a8eb87416e775c6af5018dc5fc04733abedafc Mon Sep 17 00:00:00 2001
From: DaeMyung Kang <charsyam@gmail.com>
Date: Tue, 3 Nov 2026 14:48:46 -0500
Subject: [PATCH 0984/1982] ksmbd: use the existing xattr name for a named
 stream

[ Upstream commit a7d1d52748e0fe4d06fdb871fc9899904fbba93f ]

SMB stream names are case-insensitive, but ksmbd stores each named
stream in an xattr whose name is case-sensitive. Opening an existing
stream finds its xattr with a case-insensitive match, yet the handle
keeps the name as the client spelled it, and every later operation that
needs an exact name uses that spelling:

 - a WRITE or an end-of-file change creates a second xattr, so a stream
   created as "Foo" and written through "foo" ends up stored twice, and
   which value a later lookup returns depends on xattr list order;
 - delete-on-close and delete-pending removal can fail with -ENODATA,
   or remove only a case-variant copy and leave the original;
 - the share mode check compares stream names with strcmp(), so two
   opens of the same stream that differ only in case do not conflict.

Have ksmbd_vfs_casexattr_len() copy the matching xattr's name into the
handle when the stream is opened, so later operations use the name
already on disk. The match must have the same length as the name it
replaces; the stream lookup passes a length that includes the
terminating NUL, which already guarantees that, and the check makes the
copy safe for any caller. A stream that does not exist yet keeps the
client's spelling, as before.

smb2_rename() compares and looks up fp->stream.name case-insensitively,
so it behaves the same with either spelling.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: adapted stream lookup signature changes to the existing callers and non-const mnt_idmap interface ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 8 ++++----
 fs/smb/server/vfs.c     | 7 ++++++-
 fs/smb/server/vfs.h     | 2 +-
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 070da678d2ce08..847470490a2098 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2475,7 +2475,7 @@ static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len,
 						     path->dentry,
 						     attr_name,
 						     XATTR_USER_PREFIX_LEN +
-						     eabuf->EaNameLength);
+						     eabuf->EaNameLength, NULL);
 
 			/* delete the EA only when it exits */
 			if (rc > 0) {
@@ -2547,11 +2547,11 @@ static noinline int smb2_set_stream_name_xattr(const struct path *path,
 	fp->stream.name = xattr_stream_name;
 	fp->stream.size = xattr_stream_size;
 
-	/* Check if there is stream prefix in xattr space */
+	/* Keep the existing xattr's case for subsequent writes and removal. */
 	rc = ksmbd_vfs_casexattr_len(idmap,
 				     path->dentry,
 				     xattr_stream_name,
-				     xattr_stream_size);
+				     xattr_stream_size, xattr_stream_name);
 	if (rc >= 0)
 		return 0;
 	if (rc != -ENOENT && rc != -ENODATA)
@@ -5276,7 +5276,7 @@ static int get_file_stream_info(struct ksmbd_work *work,
 		 */
 		slen = ksmbd_vfs_casexattr_len(file_mnt_idmap(fp->filp),
 						path->dentry, stream_name,
-						strlen(stream_name) + 1);
+						strlen(stream_name) + 1, NULL);
 		ssize = slen < 0 ? 0 : (loff_t)slen;
 		file_info->StreamSize = cpu_to_le64(ssize);
 		file_info->StreamAllocationSize = cpu_to_le64(ssize);
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 29b204776b961b..0a27cb445cc17d 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -1816,7 +1816,7 @@ int ksmbd_vfs_fill_dentry_attrs(struct ksmbd_work *work,
 
 ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
 				struct dentry *dentry, char *attr_name,
-				int attr_name_len)
+				int attr_name_len, char *actual_name)
 {
 	char *name, *xattr_list = NULL;
 	ssize_t value_len = -ENOENT, xattr_list_len;
@@ -1834,8 +1834,13 @@ ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
 		ksmbd_debug(VFS, "%s, len %zd\n", name, strlen(name));
 		if (strncasecmp(attr_name, name, attr_name_len))
 			continue;
+		if (actual_name && strlen(name) + 1 != attr_name_len)
+			continue;
 
 		value_len = ksmbd_vfs_xattr_len(idmap, dentry, name);
+		/* The caller provides attr_name_len bytes for the actual name. */
+		if (value_len >= 0 && actual_name)
+			memcpy(actual_name, name, attr_name_len);
 		break;
 	}
 
diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h
index df6421b4590bae..ccf289592718c7 100644
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@ -107,7 +107,7 @@ ssize_t ksmbd_vfs_getxattr(struct mnt_idmap *idmap,
 			   char **xattr_buf);
 ssize_t ksmbd_vfs_casexattr_len(struct mnt_idmap *idmap,
 				struct dentry *dentry, char *attr_name,
-				int attr_name_len);
+				int attr_name_len, char *actual_name);
 int ksmbd_vfs_setxattr(struct mnt_idmap *idmap,
 		       const struct path *path, const char *attr_name,
 		       void *attr_value, size_t attr_size, int flags,

From 3092d8a596efaeccdebe0804bf263e5e6eef39d7 Mon Sep 17 00:00:00 2001
From: Ian Bridges <icb@fastmail.org>
Date: Tue, 3 Nov 2026 14:48:59 -0500
Subject: [PATCH 0985/1982] ksmbd: fix out-of-bounds read when padding the
 final compound response

[ Upstream commit 714f27729121d59f103ca4dad7b0c2d1c125cd71 ]

Compound response handling pads the last response of a compound to an
8-byte boundary by growing the final iov and the RFC1002 length.
smb2_allocate_rsp_buf() allocates exactly response_sz. A command can
fill the response buffer to within 7 bytes of its end, for example a
QUERY_INFO whose output is bounded only by the space left. The padding
can then run past the allocation, and ksmbd_tcp_writev() reads those
bytes when it sends the response.

  BUG: KASAN: slab-out-of-bounds in _copy_from_iter+0x744/0x10e0
  Call Trace:
   _copy_from_iter+0x744/0x10e0
   tcp_sendmsg_locked+0x2290/0x3f80
   ksmbd_tcp_writev+0x10c7/0x1ab0 [ksmbd]

Allocate room for the padding when the request is a compound, as
smb2_read() and smb2_read_pipe() do for their payloads. response_sz is
unchanged, so commands still fill only up to it, and kvzalloc() zeroes
the padding.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Adjusted context to retain work->conn->vals->max_trans_size instead of vals->max_trans_size. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 847470490a2098..8204207620e3b5 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -539,7 +539,7 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work)
 	struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
 	size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
 	size_t large_sz = small_sz + work->conn->vals->max_trans_size;
-	size_t sz = small_sz;
+	size_t sz = small_sz, pad_sz = 0;
 	int cmd = le16_to_cpu(hdr->Command);
 
 	if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE)
@@ -561,10 +561,17 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work)
 	}
 
 	/* allocate large response buf for chained commands */
-	if (le32_to_cpu(hdr->NextCommand) > 0)
+	if (le32_to_cpu(hdr->NextCommand) > 0) {
 		sz = large_sz;
+		/*
+		 * is_chained_smb2_message() pads the last response of a
+		 * compound to 8 bytes, which can take it past response_sz.
+		 * Leave room for the padding. kvzalloc() zeroes it.
+		 */
+		pad_sz = ALIGN(sz - sizeof(__be32), 8) - (sz - sizeof(__be32));
+	}
 
-	work->response_buf = kvzalloc(sz, KSMBD_DEFAULT_GFP);
+	work->response_buf = kvzalloc(sz + pad_sz, KSMBD_DEFAULT_GFP);
 	if (!work->response_buf)
 		return -ENOMEM;
 

From c81681bcb7f088f1c2509bbc1a046b0403f5fbb6 Mon Sep 17 00:00:00 2001
From: DaeMyung Kang <charsyam@gmail.com>
Date: Tue, 3 Nov 2026 16:37:54 -0500
Subject: [PATCH 0986/1982] ksmbd: fix named stream write and EOF handling

[ Upstream commit 02165c8d402392278a5cd2cf97645ed73a7ad4a1 ]

An SMB WRITE to an existing named stream can silently discard data after
its written range. ksmbd stores streams as xattr values, but the write
path passes offset + count as the length of the replacement xattr even
when the old stream is longer. Writing 26 bytes at offset 0 to a 60-byte
stream reports 26 bytes written while discarding the remaining 34 bytes.

Keep the existing xattr length when an in-place write ends before EOF.
Reject writes that cross XATTR_SIZE_MAX rather than storing only the
portion that fits while reporting the full requested count.

Commit 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
intentionally skipped ordinary inode truncation for stream handles: an
EOF SetInfo on an ADS had truncated the base file. That fixed the base
file corruption but left stream EOF changes reporting success without
resizing the stream. Handle these requests by resizing only the stream
xattr; the base file size remains untouched. Zero-fill stream extensions.
This is needed alongside the write fix: a short write's accidental
truncation previously masked an ignored explicit EOF change. The stream
resize helper returns xattr errors directly rather than using the
base-file truncate path's EBADF conversion.

Fixes: f44158485826 ("cifsd: add file operations")
Fixes: 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: changed const struct mnt_idmap pointers to non-const pointers ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c |  5 +--
 fs/smb/server/vfs.c     | 72 ++++++++++++++++++++++++++++++++++++-----
 fs/smb/server/vfs.h     |  1 +
 3 files changed, 68 insertions(+), 10 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 8204207620e3b5..358186d13a4b96 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6590,6 +6590,8 @@ static int set_end_of_file_info(struct ksmbd_work *work, struct ksmbd_file *fp,
 
 	newsize = le64_to_cpu(file_eof_info->EndOfFile);
 	inode = file_inode(fp->filp);
+	if (ksmbd_stream_fd(fp))
+		return ksmbd_vfs_stream_truncate(fp, newsize);
 
 	/*
 	 * If FILE_END_OF_FILE_INFORMATION of set_info_file is called
@@ -6598,8 +6600,7 @@ static int set_end_of_file_info(struct ksmbd_work *work, struct ksmbd_file *fp,
 	 * truncate of some filesystem like FAT32 fill zero data in
 	 * truncated range.
 	 */
-	if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC &&
-	    ksmbd_stream_fd(fp) == false) {
+	if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC) {
 		ksmbd_debug(SMB, "truncated to newsize %lld\n", newsize);
 		rc = ksmbd_vfs_truncate(work, fp, newsize);
 		if (rc) {
diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 0a27cb445cc17d..130dd0a4001f2c 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -418,23 +418,21 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
 	const struct cred *saved_cred;
 	char *stream_buf = NULL, *wbuf;
 	struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);
-	size_t size;
+	size_t size, write_end;
 	ssize_t v_len;
 	int err = 0;
 
 	ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
 		    *pos, count);
 
-	if (*pos >= XATTR_SIZE_MAX) {
+	if (*pos < 0 || *pos >= XATTR_SIZE_MAX) {
 		pr_err("stream write position %lld is out of bounds\n",	*pos);
 		return -EINVAL;
 	}
 
-	size = *pos + count;
-	if (size > XATTR_SIZE_MAX) {
-		size = XATTR_SIZE_MAX;
-		count = XATTR_SIZE_MAX - *pos;
-	}
+	if (count > XATTR_SIZE_MAX - *pos)
+		return -EFBIG;
+	write_end = *pos + count;
 
 	saved_cred = override_creds(fp->filp->f_cred);
 	v_len = ksmbd_vfs_getcasexattr(idmap,
@@ -447,6 +445,8 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
 		err = v_len;
 		goto out_revert;
 	}
+	/* Preserve the tail of an existing stream on an in-place write. */
+	size = max_t(size_t, v_len, write_end);
 
 	if (v_len < size) {
 		wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
@@ -475,13 +475,69 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
 	if (err < 0)
 		goto out;
 	else
-		fp->stream.pos = size;
+		fp->stream.pos = write_end;
 	err = 0;
 out:
 	kvfree(stream_buf);
 	return err;
 }
 
+/**
+ * ksmbd_vfs_stream_truncate() - change the length of a named stream
+ * @fp:		stream file handle
+ * @newsize:	new stream length
+ *
+ * Resize the stream xattr without changing the base inode size.
+ *
+ * Return: 0 on success, otherwise a negative error code
+ */
+int ksmbd_vfs_stream_truncate(struct ksmbd_file *fp, loff_t newsize)
+{
+	const struct cred *saved_cred;
+	struct mnt_idmap *idmap = file_mnt_idmap(fp->filp);
+	char *stream_buf = NULL, *new_buf = NULL;
+	ssize_t v_len;
+	int err;
+
+	if (newsize < 0)
+		return -EINVAL;
+	if (newsize > XATTR_SIZE_MAX)
+		return -EFBIG;
+
+	saved_cred = override_creds(fp->filp->f_cred);
+	v_len = ksmbd_vfs_getcasexattr(idmap, fp->filp->f_path.dentry,
+				       fp->stream.name, fp->stream.size,
+				       &stream_buf);
+	if (v_len < 0) {
+		err = v_len;
+		goto out;
+	}
+	if (v_len == newsize) {
+		err = 0;
+		goto out;
+	}
+
+	new_buf = stream_buf;
+	if (newsize > v_len) {
+		new_buf = kvzalloc(newsize, KSMBD_DEFAULT_GFP);
+		if (!new_buf) {
+			err = -ENOMEM;
+			goto out;
+		}
+		if (v_len)
+			memcpy(new_buf, stream_buf, v_len);
+	}
+
+	err = ksmbd_vfs_setxattr(idmap, &fp->filp->f_path, fp->stream.name,
+				 new_buf, newsize, 0, true);
+	if (new_buf != stream_buf)
+		kvfree(new_buf);
+out:
+	kvfree(stream_buf);
+	revert_creds(saved_cred);
+	return err;
+}
+
 /**
  * ksmbd_vfs_write() - vfs helper for smb file write
  * @work:	work
diff --git a/fs/smb/server/vfs.h b/fs/smb/server/vfs.h
index ccf289592718c7..e9a5798d7baedf 100644
--- a/fs/smb/server/vfs.h
+++ b/fs/smb/server/vfs.h
@@ -82,6 +82,7 @@ int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count,
 int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp,
 		    char *buf, size_t count, loff_t *pos, bool sync,
 		    ssize_t *written);
+int ksmbd_vfs_stream_truncate(struct ksmbd_file *fp, loff_t newsize);
 int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id);
 int ksmbd_vfs_remove_file(struct ksmbd_work *work, const struct path *path);
 int ksmbd_vfs_link(struct ksmbd_work *work,

From 7f30b886c5a1a2b3d9342ea82d0699eff812a472 Mon Sep 17 00:00:00 2001
From: Dairui Zhang <zhangdairui@gmail.com>
Date: Tue, 3 Nov 2026 16:38:12 -0500
Subject: [PATCH 0987/1982] ksmbd: verify transform SessionId matches the
 decrypted header

[ Upstream commit 798214e6fafcdcc29f5ba2661a473232b5e70cfb ]

When an encrypted request comes in, the decryption key is picked by
the SessionId in the transform header, but the request is then
authorized under whatever session the decrypted inner header names.
Nothing ever compares the two, so on a connection with more than
one session a client can get a request decrypted with one session's
key and run it as another session. Encrypted requests are exempt
from signing too, so a valid AEAD tag is the only proof of session
identity, and it is checked against the wrong session.

MS-SMB2 says the server must check that the transform SessionId
matches the one in the decrypted SMB2 header and treat a mismatch
as a protocol error. Add that check in __handle_ksmbd_work() after
decryption, before dispatching: the message has to be at least one
fixed SMB2 header, the first operation must not set
SMB2_FLAGS_RELATED_OPERATIONS and its SessionId must match the
transform SessionId, and every following non-related operation in
a compound chain must carry the same SessionId. NextCommand
offsets must be 8-byte aligned and stay inside the message; the
bounds check is done by subtraction so it cannot wrap.

When the decrypted payload is a compression transform, the
existing decompression step runs first and the decompressed SMB2
message is checked instead, since a compression transform header
carries no SessionId.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Reported-by: Dairui Zhang <zhangdairui@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Dairui Zhang <zhangdairui@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Placed session validation directly after decryption because the intervening decompression code is absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/server.c  | 16 ++++++++++++
 fs/smb/server/smb2pdu.c | 54 +++++++++++++++++++++++++++++++++++++++++
 fs/smb/server/smb2pdu.h |  1 +
 3 files changed, 71 insertions(+)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 85f14d1cc0cd36..ba625b52c63753 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -169,12 +169,28 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,
 
 	if (conn->ops->is_transform_hdr &&
 	    conn->ops->is_transform_hdr(work->request_buf)) {
+		u64 tr_sess_id;
+
+		if (get_rfc1002_len(work->request_buf) <
+		    sizeof(struct smb2_transform_hdr)) {
+			ksmbd_conn_abort(conn);
+			return;
+		}
+		tr_sess_id = le64_to_cpu(((struct smb2_transform_hdr *)
+				smb_get_msg(work->request_buf))->SessionId);
+
 		rc = conn->ops->decrypt_req(work);
 		if (rc < 0) {
 			ksmbd_conn_abort(conn);
 			return;
 		}
 		work->encrypted = true;
+
+		rc = ksmbd_check_transform_session(work, tr_sess_id);
+		if (rc < 0) {
+			ksmbd_conn_abort(conn);
+			return;
+		}
 	}
 
 	if (conn->ops->allocate_rsp_buf(work))
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 358186d13a4b96..560ce630f1863a 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9480,6 +9480,60 @@ bool smb3_is_transform_hdr(void *buf)
 	return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM;
 }
 
+/*
+ * The decryption key is selected by the transform SessionId, but
+ * the request is authorized under the session named in the
+ * decrypted SMB2 header. Per MS-SMB2 the two must match, so check
+ * the decrypted message and its compound chain before dispatch.
+ */
+int ksmbd_check_transform_session(struct ksmbd_work *work, u64 tr_sess_id)
+{
+	struct smb2_hdr *hdr = smb_get_msg(work->request_buf);
+	size_t msg_len = get_rfc1002_len(work->request_buf);
+	size_t off = 0;
+	bool first = true;
+
+	if (msg_len < sizeof(*hdr)) {
+		pr_err_ratelimited("Decrypted message is smaller than SMB2 header\n");
+		return -ECONNABORTED;
+	}
+
+	for (;;) {
+		u64 sid = le64_to_cpu(hdr->SessionId);
+		u32 next;
+
+		if (first) {
+			if (hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS) {
+				pr_err_ratelimited("RELATED_OPERATIONS set on first operation\n");
+				return -ECONNABORTED;
+			}
+			if (sid != tr_sess_id) {
+				pr_err_ratelimited("SessionId mismatch between transform and inner header\n");
+				return -ECONNABORTED;
+			}
+			first = false;
+		} else if (!(hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS) &&
+			   sid != tr_sess_id) {
+			pr_err_ratelimited("SessionId mismatch in compound chain\n");
+			return -ECONNABORTED;
+		}
+
+		next = le32_to_cpu(hdr->NextCommand);
+		if (!next)
+			return 0;
+		if (next % 8) {
+			pr_err_ratelimited("NextCommand %u is not 8-byte aligned\n", next);
+			return -ECONNABORTED;
+		}
+		if (next > msg_len - off - sizeof(*hdr)) {
+			pr_err_ratelimited("NextCommand %u is out of the message\n", next);
+			return -ECONNABORTED;
+		}
+		off += next;
+		hdr = (struct smb2_hdr *)((u8 *)smb_get_msg(work->request_buf) + off);
+	}
+}
+
 int smb3_decrypt_req(struct ksmbd_work *work)
 {
 	struct ksmbd_session *sess;
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 6833342407013b..23abb70ea5d3d5 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -441,6 +441,7 @@ struct channel *lookup_chann_list(struct ksmbd_session *sess,
 void smb3_preauth_hash_rsp(struct ksmbd_work *work);
 bool smb3_is_transform_hdr(void *buf);
 int smb3_decrypt_req(struct ksmbd_work *work);
+int ksmbd_check_transform_session(struct ksmbd_work *work, u64 tr_sess_id);
 int smb3_encrypt_resp(struct ksmbd_work *work);
 bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work);
 int smb2_set_rsp_credits(struct ksmbd_work *work);

From bd47ee501b6ac4a26ae41f780a43b7967302a269 Mon Sep 17 00:00:00 2001
From: Ian Bridges <icb@fastmail.org>
Date: Tue, 3 Nov 2026 17:40:00 -0500
Subject: [PATCH 0988/1982] ksmbd: fix use-after-free after a failed durable
 reconnect

[ Upstream commit 248b5819591c577727930e4e255a455235fab50a ]

ksmbd_reopen_durable_fd() republishes a detached durable handle in the
reconnecting session's file table and takes no reference for that entry.
If smb2_open() then fails, cleanup relies on the final ksmbd_fd_put() to
remove the volatile id.

Two reconnects of the same handle can both take a lookup reference before
either attaches it. If the one that reopens first then fails and drops
its references first, the other request makes the final put through
ksmbd_put_durable_fd(). That frees the handle without removing the first
session's table entry, so tearing that session down writes to freed
memory.

  BUG: KASAN: slab-use-after-free in __close_file_table_ids+0x14d/0x740 [ksmbd]
  Call Trace:
   __close_file_table_ids+0x14d/0x740 [ksmbd]
   ksmbd_destroy_file_table+0x76/0x100 [ksmbd]
   ksmbd_session_destroy+0xf8/0x480 [ksmbd]
   ksmbd_dispose_sessions+0x13e/0x200 [ksmbd]
   ksmbd_conn_sessions_cleanup+0x4c3/0x6d0 [ksmbd]
  Freed by task 1030:
   __ksmbd_close_fd+0x97d/0x1000 [ksmbd]
   smb2_open+0x14eb/0xd9f0 [ksmbd]

Commit 3515503322f4 ("ksmbd: fix durable reconnect error path file
lifetime") handles a final put made by the reconnecting request, but not
one made by another holder.

Remove the volatile id under the file-table lock on this error path,
before the references are dropped, as ksmbd_close_fd() does on the
request_open path just above. Removal then no longer depends on which
holder makes the final put. The stale comment in the reconnect cleanup
is updated to match. A successful reconnect is unchanged.

Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: Adapted the cleanup call to a braced if (fp) block because the replay and request-open cleanup branches are absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/smb/server/smb2pdu.c   | 12 +++++++-----
 fs/smb/server/vfs_cache.c | 28 ++++++++++++++++++++++++++++
 fs/smb/server/vfs_cache.h |  2 ++
 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 560ce630f1863a..a8a42fde4ca022 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3933,8 +3933,11 @@ int smb2_open(struct ksmbd_work *work)
 		if (!rsp->hdr.Status)
 			rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
 
-		if (fp)
+		if (fp) {
+			if (dh_info.reconnected && fp == dh_info.fp)
+				ksmbd_unpublish_reopened_fd(work, fp);
 			ksmbd_fd_put(work, fp);
+		}
 		smb2_set_err_rsp(work);
 		ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
 	}
@@ -3942,10 +3945,9 @@ int smb2_open(struct ksmbd_work *work)
 	if (dh_info.reconnected) {
 		/*
 		 * If reconnect succeeded, fp was republished in the
-		 * session file table.  On a later error, ksmbd_fd_put()
-		 * above drops the session reference; drop the durable
-		 * lookup reference through the same session-aware path so
-		 * final close removes the volatile id before freeing fp.
+		 * session file table, and the error path above has
+		 * already removed its volatile id.  Drop the durable
+		 * lookup reference through the same session-aware path.
 		 */
 		if (rc && fp == dh_info.fp)
 			ksmbd_fd_put(work, dh_info.fp);
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index 5aa46e41ac6f8b..bde487fb300540 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -486,6 +486,34 @@ static void set_close_state_blocked_works(struct ksmbd_file *fp)
 	spin_unlock(&fp->f_lock);
 }
 
+/**
+ * ksmbd_unpublish_reopened_fd() - remove a reopened durable handle from the
+ *	session file table after its CREATE failed
+ * @work:	smb work of the failed CREATE
+ * @fp:		durable handle republished by ksmbd_reopen_durable_fd()
+ *
+ * The reopen publishes @fp in this session's table without taking a reference
+ * for the entry, so the CREATE error path's puts need not be the last ones.
+ * Another holder of a global-table reference, such as a concurrent reconnect
+ * of the same handle, can drop the last one through ksmbd_put_durable_fd(),
+ * which frees @fp without touching this table.  Remove the id here, while
+ * the caller still holds its references.
+ *
+ * Every path that removes the id before the final put also clears
+ * @fp->volatile_id under ft->lock, so a valid id is still @fp's entry.
+ */
+void ksmbd_unpublish_reopened_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+	struct ksmbd_file_table *ft = &work->sess->file_table;
+
+	write_lock(&ft->lock);
+	if (has_file_id(fp->volatile_id)) {
+		idr_remove(ft->idr, fp->volatile_id);
+		fp->volatile_id = KSMBD_NO_FID;
+	}
+	write_unlock(&ft->lock);
+}
+
 int ksmbd_close_fd(struct ksmbd_work *work, u64 id)
 {
 	struct ksmbd_file	*fp;
diff --git a/fs/smb/server/vfs_cache.h b/fs/smb/server/vfs_cache.h
index 38ccf2957c1744..3801872409193b 100644
--- a/fs/smb/server/vfs_cache.h
+++ b/fs/smb/server/vfs_cache.h
@@ -158,6 +158,8 @@ static inline bool ksmbd_stream_fd(struct ksmbd_file *fp)
 int ksmbd_init_file_table(struct ksmbd_file_table *ft);
 void ksmbd_destroy_file_table(struct ksmbd_session *sess);
 int ksmbd_close_fd(struct ksmbd_work *work, u64 id);
+void ksmbd_unpublish_reopened_fd(struct ksmbd_work *work,
+				 struct ksmbd_file *fp);
 struct ksmbd_file *ksmbd_lookup_fd_fast(struct ksmbd_work *work, u64 id);
 struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, u64 id);
 struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, u64 id,

From d1df2ec20a6ddac6ae553b34b39472a20c5de9c6 Mon Sep 17 00:00:00 2001
From: Yibo Tan <lhfff@tju.edu.cn>
Date: Wed, 4 Nov 2026 10:58:03 -0500
Subject: [PATCH 0989/1982] media: ipu-bridge: Fix use-after-free in IVSC error
 path

[ Upstream commit 3d42d1c82717f0853379b516a7fab54b636e09cc ]

ipu_bridge_get_ivsc_acpi_dev() returns an ACPI device with a reference
held. If no matching CSI device is found, ipu_bridge_check_ivsc_dev()
drops that reference before passing the device to dev_err(). Concurrent
CSI device and ACPI namespace removal can drop the other references,
making this the final put. dev_err() then reads the freed struct
acpi_device and its kobject name.

This was reproduced without kprobes by racing normal CSI platform-device
unregistration and ACPI configfs table removal against the production
ipu_bridge_init() entry. KASAN reported the final free through
device_release(), followed by invalid reads through _dev_err().

Emit the error message while the lookup reference is still held, then
drop the reference as before.

Source reproducers and vulnerable/fixed serial logs, with only the build
hostname redacted, are available at:
https://github.com/kimaiden1984-boop/linux-ipu-bridge-acpi-uaf-reproducer

The fixed target builds with W=1 on x86-64. This was not tested on
physical IPU hardware. The tests establish runtime reachability but do
not measure occurrence frequency on shipping systems or establish
exploitability.

Fixes: c66821f381ae ("media: pci: intel: Add IVSC support for IPU bridge driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
[ sashal: Retained the existing "MEI CSI dev" diagnostic because CVS support is absent. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/intel/ipu-bridge.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c
index 4e579352ab2c0b..a5e221f42193b2 100644
--- a/drivers/media/pci/intel/ipu-bridge.c
+++ b/drivers/media/pci/intel/ipu-bridge.c
@@ -191,8 +191,8 @@ static int ipu_bridge_check_ivsc_dev(struct ipu_sensor *sensor,
 	if (adev) {
 		csi_dev = ipu_bridge_get_ivsc_csi_dev(adev);
 		if (!csi_dev) {
-			acpi_dev_put(adev);
 			dev_err(ADEV_DEV(adev), "Failed to find MEI CSI dev\n");
+			acpi_dev_put(adev);
 			return -ENODEV;
 		}
 

From 2b2a1d370f16fa545902f60b2eb95738285f4b8b Mon Sep 17 00:00:00 2001
From: Jori Koolstra <jkoolstra@xs4all.nl>
Date: Wed, 4 Nov 2026 10:58:22 -0500
Subject: [PATCH 0990/1982] pps: change pps_gen_class to a const struct

[ Upstream commit 4dc0c899b14c3ea2c9b5f42b523301040d1c8100 ]

The class_create() call has been deprecated in favor of class_register()
as the driver core now allows for a struct class to be in read-only
memory. Change pps_gen_class to be a const struct class and drop the
class_create() call.

Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260302142436.3292766-1-jkoolstra@xs4all.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d19552611cb2 ("pps: generators: fix use-after-free when closing a removed device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pps/generators/pps_gen.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index 5b8bb454913cd8..e064ff32c9cd99 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -26,7 +26,10 @@
  */
 
 static dev_t pps_gen_devt;
-static struct class *pps_gen_class;
+static const struct class pps_gen_class = {
+	.name		= "pps-gen",
+	.dev_groups	= pps_gen_groups
+};
 
 static DEFINE_IDA(pps_gen_ida);
 
@@ -183,7 +186,7 @@ static int pps_gen_register_cdev(struct pps_gen_device *pps_gen)
 				MAJOR(pps_gen_devt), pps_gen->id);
 		goto free_ida;
 	}
-	pps_gen->dev = device_create(pps_gen_class, pps_gen->info->parent, devt,
+	pps_gen->dev = device_create(&pps_gen_class, pps_gen->info->parent, devt,
 				     pps_gen, "pps-gen%d", pps_gen->id);
 	if (IS_ERR(pps_gen->dev)) {
 		err = PTR_ERR(pps_gen->dev);
@@ -207,7 +210,7 @@ static int pps_gen_register_cdev(struct pps_gen_device *pps_gen)
 static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
 {
 	pr_debug("unregistering pps-gen%d\n", pps_gen->id);
-	device_destroy(pps_gen_class, pps_gen->dev->devt);
+	device_destroy(&pps_gen_class, pps_gen->dev->devt);
 }
 
 /*
@@ -307,7 +310,7 @@ EXPORT_SYMBOL(pps_gen_event);
 
 static void __exit pps_gen_exit(void)
 {
-	class_destroy(pps_gen_class);
+	class_unregister(&pps_gen_class);
 	unregister_chrdev_region(pps_gen_devt, PPS_GEN_MAX_SOURCES);
 }
 
@@ -315,12 +318,11 @@ static int __init pps_gen_init(void)
 {
 	int err;
 
-	pps_gen_class = class_create("pps-gen");
-	if (IS_ERR(pps_gen_class)) {
-		pr_err("failed to allocate class\n");
-		return PTR_ERR(pps_gen_class);
+	err = class_register(&pps_gen_class);
+	if (err) {
+		pr_err("failed to register class\n");
+		return err;
 	}
-	pps_gen_class->dev_groups = pps_gen_groups;
 
 	err = alloc_chrdev_region(&pps_gen_devt, 0,
 					PPS_GEN_MAX_SOURCES, "pps-gen");
@@ -332,7 +334,7 @@ static int __init pps_gen_init(void)
 	return 0;
 
 remove_class:
-	class_destroy(pps_gen_class);
+	class_unregister(&pps_gen_class);
 	return err;
 }
 

From 63dc56500a91591ad9b42e09ca4646b0a4d03406 Mon Sep 17 00:00:00 2001
From: Danish Khateeb <danishkhateeb03@gmail.com>
Date: Wed, 4 Nov 2026 10:58:23 -0500
Subject: [PATCH 0991/1982] pps: generators: fix use-after-free when closing a
 removed device

[ Upstream commit d19552611cb2eb6329826871565e5309bec2f288 ]

The cdev of a PPS generator is embedded in struct pps_gen_device, but
nothing ties the lifetime of that structure to the cdev: pps_gen is
freed by the release function of its device, and an open file holds a
device reference only until pps_gen_cdev_release() drops it.

When the generator is unregistered while /dev/pps-genN is open, that
put_device() drops the last reference and frees pps_gen, and __fput()
then calls cdev_put() on the freed cdev:

  BUG: KASAN: slab-use-after-free in cdev_put+0x53/0x60
  Read of size 8 at addr ffff88801383e138 by task ppsgen64/149
  Call Trace:
   cdev_put+0x53/0x60
   __fput+0x745/0xad0
   fput_close_sync+0xd9/0x1b0
   __x64_sys_close+0x86/0xf0
  ...
  Freed by task 149:
   kfree+0x25a/0x6d0
   device_release+0xca/0x3c0
   kobject_put+0x169/0x320
   pps_gen_cdev_release+0x51/0x80
   __fput+0x36a/0xad0

pps.c had the same bug, fixed in commit c79a39dc8d06 ("pps: Fix a
use-after-free").

Fix it the usual way: embed the struct device in pps_gen_device and
register both with cdev_device_add(). This makes the device the parent
of the cdev, so the cdev holds a device reference until the last file
is closed.

Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-2-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pps/generators/pps_gen.c | 63 ++++++++++++++++----------------
 include/linux/pps_gen_kernel.h   |  2 +-
 2 files changed, 32 insertions(+), 33 deletions(-)

diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index e064ff32c9cd99..69a470fa164d69 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -63,7 +63,7 @@ static long pps_gen_cdev_ioctl(struct file *file,
 
 	switch (cmd) {
 	case PPS_GEN_SETENABLE:
-		dev_dbg(pps_gen->dev, "PPS_GEN_SETENABLE\n");
+		dev_dbg(&pps_gen->dev, "PPS_GEN_SETENABLE\n");
 
 		ret = get_user(status, uiuarg);
 		if (ret)
@@ -77,7 +77,7 @@ static long pps_gen_cdev_ioctl(struct file *file,
 		break;
 
 	case PPS_GEN_USESYSTEMCLOCK:
-		dev_dbg(pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
+		dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
 
 		ret = put_user(pps_gen->info->use_system_clock, uiuarg);
 		if (ret)
@@ -89,12 +89,12 @@ static long pps_gen_cdev_ioctl(struct file *file,
 		struct pps_gen_event info;
 		unsigned int ev = pps_gen->last_ev;
 
-		dev_dbg(pps_gen->dev, "PPS_GEN_FETCHEVENT\n");
+		dev_dbg(&pps_gen->dev, "PPS_GEN_FETCHEVENT\n");
 
 		ret = wait_event_interruptible(pps_gen->queue,
 				ev != pps_gen->last_ev);
 		if (ret == -ERESTARTSYS) {
-			dev_dbg(pps_gen->dev, "pending signal caught\n");
+			dev_dbg(&pps_gen->dev, "pending signal caught\n");
 			return -EINTR;
 		}
 
@@ -121,7 +121,7 @@ static int pps_gen_cdev_open(struct inode *inode, struct file *file)
 	struct pps_gen_device *pps_gen = container_of(inode->i_cdev,
 				struct pps_gen_device, cdev);
 
-	get_device(pps_gen->dev);
+	get_device(&pps_gen->dev);
 	file->private_data = pps_gen;
 	return 0;
 }
@@ -130,7 +130,7 @@ static int pps_gen_cdev_release(struct inode *inode, struct file *file)
 {
 	struct pps_gen_device *pps_gen = file->private_data;
 
-	put_device(pps_gen->dev);
+	put_device(&pps_gen->dev);
 	return 0;
 }
 
@@ -151,19 +151,15 @@ static void pps_gen_device_destruct(struct device *dev)
 {
 	struct pps_gen_device *pps_gen = dev_get_drvdata(dev);
 
-	cdev_del(&pps_gen->cdev);
-
 	pr_debug("deallocating pps-gen%d\n", pps_gen->id);
 	ida_free(&pps_gen_ida, pps_gen->id);
 
-	kfree(dev);
 	kfree(pps_gen);
 }
 
 static int pps_gen_register_cdev(struct pps_gen_device *pps_gen)
 {
 	int err;
-	dev_t devt;
 
 	err = ida_alloc_max(&pps_gen_ida, PPS_GEN_MAX_SOURCES - 1, GFP_KERNEL);
 	if (err < 0) {
@@ -171,46 +167,52 @@ static int pps_gen_register_cdev(struct pps_gen_device *pps_gen)
 			pr_err("too many PPS sources in the system\n");
 			err = -EBUSY;
 		}
+		kfree(pps_gen);
 		return err;
 	}
 	pps_gen->id = err;
 
-	devt = MKDEV(MAJOR(pps_gen_devt), pps_gen->id);
+	/*
+	 * From here on pps_gen belongs to its device and is freed by
+	 * pps_gen_device_destruct(). The cdev holds a reference to the
+	 * device, so pps_gen stays around until the last file is closed.
+	 */
+	device_initialize(&pps_gen->dev);
+	pps_gen->dev.class = &pps_gen_class;
+	pps_gen->dev.parent = pps_gen->info->parent;
+	pps_gen->dev.devt = MKDEV(MAJOR(pps_gen_devt), pps_gen->id);
+	pps_gen->dev.release = pps_gen_device_destruct;
+	dev_set_drvdata(&pps_gen->dev, pps_gen);
 
 	cdev_init(&pps_gen->cdev, &pps_gen_cdev_fops);
 	pps_gen->cdev.owner = pps_gen->info->owner;
 
-	err = cdev_add(&pps_gen->cdev, devt, 1);
+	err = dev_set_name(&pps_gen->dev, "pps-gen%d", pps_gen->id);
+	if (err)
+		goto put_dev;
+
+	err = cdev_device_add(&pps_gen->cdev, &pps_gen->dev);
 	if (err) {
 		pr_err("failed to add char device %d:%d\n",
 				MAJOR(pps_gen_devt), pps_gen->id);
-		goto free_ida;
+		goto put_dev;
 	}
-	pps_gen->dev = device_create(&pps_gen_class, pps_gen->info->parent, devt,
-				     pps_gen, "pps-gen%d", pps_gen->id);
-	if (IS_ERR(pps_gen->dev)) {
-		err = PTR_ERR(pps_gen->dev);
-		goto del_cdev;
-	}
-	pps_gen->dev->release = pps_gen_device_destruct;
-	dev_set_drvdata(pps_gen->dev, pps_gen);
 
 	pr_debug("generator got cdev (%d:%d)\n",
 			MAJOR(pps_gen_devt), pps_gen->id);
 
 	return 0;
 
-del_cdev:
-	cdev_del(&pps_gen->cdev);
-free_ida:
-	ida_free(&pps_gen_ida, pps_gen->id);
+put_dev:
+	put_device(&pps_gen->dev);
 	return err;
 }
 
 static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
 {
 	pr_debug("unregistering pps-gen%d\n", pps_gen->id);
-	device_destroy(&pps_gen_class, pps_gen->dev->devt);
+	cdev_device_del(&pps_gen->cdev, &pps_gen->dev);
+	put_device(&pps_gen->dev);
 }
 
 /*
@@ -244,18 +246,15 @@ struct pps_gen_device *pps_gen_register_source(const struct pps_gen_source_info
 	init_waitqueue_head(&pps_gen->queue);
 	spin_lock_init(&pps_gen->lock);
 
-	/* Create the char device */
+	/* Create the char device, this frees pps_gen on failure */
 	err = pps_gen_register_cdev(pps_gen);
 	if (err < 0) {
 		pr_err(" unable to create char device\n");
-		goto kfree_pps_gen;
+		goto pps_gen_register_source_exit;
 	}
 
 	return pps_gen;
 
-kfree_pps_gen:
-	kfree(pps_gen);
-
 pps_gen_register_source_exit:
 	pr_err("unable to register generator\n");
 
@@ -289,7 +288,7 @@ void pps_gen_event(struct pps_gen_device *pps_gen,
 {
 	unsigned long flags;
 
-	dev_dbg(pps_gen->dev, "PPS generator event %u\n", event);
+	dev_dbg(&pps_gen->dev, "PPS generator event %u\n", event);
 
 	spin_lock_irqsave(&pps_gen->lock, flags);
 
diff --git a/include/linux/pps_gen_kernel.h b/include/linux/pps_gen_kernel.h
index 6214c8aa2e0208..f26f6aac000dcc 100644
--- a/include/linux/pps_gen_kernel.h
+++ b/include/linux/pps_gen_kernel.h
@@ -54,7 +54,7 @@ struct pps_gen_device {
 
 	unsigned int id;			/* PPS generator unique ID */
 	struct cdev cdev;
-	struct device *dev;
+	struct device dev;
 	struct fasync_struct *async_queue;	/* fasync method */
 	spinlock_t lock;
 };

From 3594027c292b09d9301b4be80fa8e0c815ffaf2a Mon Sep 17 00:00:00 2001
From: Zi Yan <ziy@nvidia.com>
Date: Mon, 12 Oct 2026 22:20:16 -0400
Subject: [PATCH 0992/1982] mm/rmap: don't discard lazyfree THPs at PMD level

commit 984c0700854e35779a2bcce6b02783e709b6efa2 upstream.

__discard_anon_folio_pmd_locked() clears a lazyfree THP's PMD before it
determines whether the folio can be discarded, and restores it if the
folio is dirty or has extra references.  It is done under only the PMD
lock and the anon_vma read lock inside try_to_unmap_one() and no mmap lock
is held.  The temporarily none PMD causes UAF.

A parallel munmap() or mremap() is supposed to serialize with it on the
PMD lock, but zap_pmd_range() (called by munmap()) and move_page_tables()
(called by mremap()) do not take the lock when they see the temporarily
none PMD and skip the PMD.  There is no more page table walk after the
none PMD is restored:

- munmap(): free_pgtables() waits in unlink_anon_vmas() for the anon_vma
  lock, then free_pmd_range() drops the restored PMD as bad without
  removing the rmap, so the folio keeps a stale mapcount.

- whole-VMA MREMAP_DONTUNMAP: dontunmap_complete() unlinks the source VMA
  from its anon_vma while the restored PMD still maps the folio.

- plain mremap(): the THP is not moved but unmapped, so the THP's data is
  lost.

In the first two cases, the folio stays mapped, but no VMA that maps it is
linked to its anon_vma.  When the anon_vma is freed, it is still reachable
when one rmap walks the folio.  Racing lazyfree reclaim against
MREMAP_DONTUNMAP as an unprivileged user reproduces a KASAN use-after-free
in folio_lock_anon_vma_read() as reported in the Closes link.

One solution is to use an invalidated PMD instead of a cleared one until
the discard is committed, but it needs arch fixes first.
1. GUP-fast still follows an invalidated PMD on riscv, LoongArch and s390.
2. sparc64 miscounts thp_pte_count when an invalidated PMD is set again or
   cleared.

To keep the fix simple for backport, stop discarding lazyfree THPs at PMD
level instead. try_to_unmap_one() splits the PMD and discards the folio at
PTE level.

unmap_huge_pmd_locked() and __discard_anon_folio_pmd_locked() are left in
place, unused, to minimize this fix for backport and the invalidated PMD
approach is planned as a follow-up series to use them again.

Link: https://lore.kernel.org/20261012-lazyfree-stable-fix-v2-1-6387d6e30063@nvidia.com
Fixes: 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Kyle Zeng <kylebot@openai.com>
Closes: https://lore.kernel.org/r/20261009165214.40212-2-kylebot@openai.com
Reviewed-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Tested-by: JongHyuk Kim(MalHyuk) <malhyuk97@gmail.com>
  Link: https://lore.kernel.org/CADQRuqvXQ=YE=7T3oR66vTxE33pi=ygEeZKPTOU=cALZL0Figw@mail.gmail.com
Assisted-by: LLM
Cc: Rik van Riel <riel@surriel.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Harry Yoo <harry@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/rmap.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/mm/rmap.c b/mm/rmap.c
index 4f7a44093a09f4..03d7d666cc5782 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1963,17 +1963,6 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
 		}
 
 		if (!pvmw.pte) {
-			if (folio_test_anon(folio) && !folio_test_swapbacked(folio)) {
-				if (unmap_huge_pmd_locked(vma, pvmw.address, pvmw.pmd, folio))
-					goto walk_done;
-				/*
-				 * unmap_huge_pmd_locked has either already marked
-				 * the folio as swap-backed or decided to retain it
-				 * due to GUP or speculative references.
-				 */
-				goto walk_abort;
-			}
-
 			if (flags & TTU_SPLIT_HUGE_PMD) {
 				/*
 				 * We temporarily have to drop the PTL and

From 7dc33618ae473d3354277a7f76df256c435d7713 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 23 Sep 2026 09:32:02 +0100
Subject: [PATCH 0993/1982] media: rc: Fix build failure with CONFIG_LIRC
 disabled

commit 0c795849fd70d6bdb99aea5dd08d9b43128612f6 upstream.

commit 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error
path") broke the build if CONFIG_LIRC was not enabled.

Fixes: 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error path")
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202609230511.Em5Osw74-lkp@intel.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/lirc_dev.c | 3 +++
 drivers/media/rc/rc-main.c  | 3 +--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 7d4942925993a3..92f788683b5afe 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -775,6 +775,9 @@ void lirc_unregister(struct rc_dev *dev)
 	unsigned long flags;
 	struct lirc_fh *fh;
 
+	if (!device_is_registered(&dev->lirc_dev))
+		return;
+
 	dev_dbg(&dev->dev, "lirc_dev: driver %s unregistered from minor = %d\n",
 		dev->driver_name, MINOR(dev->lirc_dev.devt));
 
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index cb1a087ed869d1..2f1684a81eb145 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1981,8 +1981,7 @@ int rc_register_device(struct rc_dev *dev)
 	scoped_guard(mutex, &dev->lock)
 		dev->registered = false;
 
-	if (device_is_registered(&dev->lirc_dev))
-		lirc_unregister(dev);
+	lirc_unregister(dev);
 	device_del(&dev->dev);
 	/* registered already cleared above */
 	goto out_free_table;

From 27f2fdcb6be2e8762ad660a579827e834644beea Mon Sep 17 00:00:00 2001
From: Alexander Atanasov <alex@zazolabs.com>
Date: Sun, 25 Jan 2026 08:57:46 +0000
Subject: [PATCH 0994/1982] selftests: ublk: add missing gitignore for
 metadata_size binary

commit 8e5bcc3a955a2cc4460b391f55d3b49905eb248e upstream.

A new utility metadata_size was added in
commit 261b67f4e347 ("selftests: ublk: add utility to get block device metadata size")
but it was not added to .gitignore. Fix that by adding it there.

While at it sort all entries alphabetically and add a SPDX license header.

Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 261b67f4e347 ("selftests: ublk: add utility to get block device metadata size")
Signed-off-by: Alexander Atanasov <alex@zazolabs.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/ublk/.gitignore | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/ublk/.gitignore b/tools/testing/selftests/ublk/.gitignore
index 8b2871ea775116..e17bd28f27e046 100644
--- a/tools/testing/selftests/ublk/.gitignore
+++ b/tools/testing/selftests/ublk/.gitignore
@@ -1,3 +1,5 @@
-kublk
-/tools
+# SPDX-License-Identifier: GPL-2.0
 *-verify.state
+/tools
+kublk
+metadata_size

From 34bdda87c1890b18f0dc40211ec755e392168c6c Mon Sep 17 00:00:00 2001
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Date: Thu, 25 Jun 2026 10:25:24 +0530
Subject: [PATCH 0995/1982] drm/amdgpu/powerplay: Align get_tonga_state_array()
 header with prototype

commit 4986757d3207383c052689532e505edccc6df7c8 upstream.

The function header above get_tonga_state_array() still refers to
check_powerplay_tables() and does not describe all of the function
parameters.

Update it to match the current function prototype and include the
missing parameter description.

Fixes: 1ac24df78c56 ("drm/amd/pm: Validate Tonga PowerPlay state array bounds")
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Yang Wang <lkevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
index 78037edb4752cc..ff6a3778bc92f8 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
@@ -1500,11 +1500,12 @@ static int init_thermal_controller(
 }
 
 /**
- * check_powerplay_tables - Private Function used during initialization.
- * Inspect the PowerPlay table for obvious signs of corruption.
+ * get_tonga_state_array - Get the Tonga state array from the PowerPlay table.
  * @hwmgr: Pointer to the hardware manager.
  * @powerplay_table: Pointer to the PowerPlay Table.
- * Exception:  2 if the powerplay table is incorrect.
+ * @state_array: Pointer to the returned Tonga state array.
+ *
+ * Return: 0 on success, negative error code on failure.
  */
 static int get_tonga_state_array(struct pp_hwmgr *hwmgr,
 	const ATOM_Tonga_POWERPLAYTABLE *powerplay_table,

From 4225b4944f9d11e2d59562867ff0b027ba0025b9 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 10 Aug 2026 10:18:22 +0200
Subject: [PATCH 0996/1982] netfilter: conntrack: always lower timeout for
 non-closing RST packets

commit 73df81b38cb7f70a347a97370386378a86e53019 upstream.

The existing check might extend the timeout if the ESTABLISHED timeout
has been tuned to be lower than UNACK via sysctl. Reported by sashiko.

Fixes: bf80e6802273 ("netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_conntrack_proto_tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 456721e40ed0c0..03b32bd397d322 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1326,7 +1326,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
 	    timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
 		timeout = timeouts[TCP_CONNTRACK_RETRANS];
 	else if (unlikely(index == TCP_RST_SET &&
-			  new_state == TCP_CONNTRACK_ESTABLISHED))
+			  new_state == TCP_CONNTRACK_ESTABLISHED) &&
+		 timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
 		timeout = timeouts[TCP_CONNTRACK_UNACK];
 	else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&

From 9ec1c52ba989baeb3a6daa118dc22f9802406524 Mon Sep 17 00:00:00 2001
From: Peter Griffin <peter.griffin@linaro.org>
Date: Tue, 8 Sep 2026 12:37:27 +0000
Subject: [PATCH 0997/1982] opp: fix use after free in _update_opp_table_clk()

commit 1f6de65e3314519ce462bfd3a1d29e918f97e4e5 upstream.

dev_pm_opp_put_opp_table() frees the opp_table which is subsquently used
by dev_err_probe(). This causes an Oops during boot on gs101-oriole.

cpu cpu0: error 000000006b6b6b6b: Couldn't find clock
Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cd3
...
Hardware name: Oriole (DT)
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : _of_add_table_indexed+0x80/0xbb0
lr : _of_add_table_indexed+0x6c/0xbb0
...
Call trace:
 _of_add_table_indexed+0x80/0xbb0 (P)
 dev_pm_opp_of_cpumask_add_table+0x70/0x120
 dt_cpufreq_probe+0x23c/0x480
 platform_probe+0x64/0xb8

Fixes: 84f05af0975c9 ("opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer")
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
[ Viresh: use return value of dev_err_probe() ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/opp/core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index a41ad136e90e0f..fc2a7ee936ba28 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -1579,6 +1579,8 @@ static struct opp_table *_update_opp_table_clk(struct device *dev,
 					       struct opp_table *opp_table,
 					       bool getclk)
 {
+	int ret;
+
 	/*
 	 * Return early if we don't need to get clk or we have already done it
 	 * earlier.
@@ -1605,9 +1607,9 @@ static struct opp_table *_update_opp_table_clk(struct device *dev,
 	opp_table->clk = clk_get_optional(dev, NULL);
 
 	if (IS_ERR(opp_table->clk)) {
+		ret = dev_err_probe(dev, PTR_ERR(opp_table->clk), "Couldn't find clock\n");
 		dev_pm_opp_put_opp_table(opp_table);
-		dev_err_probe(dev, PTR_ERR(opp_table->clk), "Couldn't find clock\n");
-		return ERR_CAST(opp_table->clk);
+		return ERR_PTR(ret);
 	}
 
 	if (opp_table->clk)

From 3c5bfeef8f711ceb355f26390ab53871025e93db Mon Sep 17 00:00:00 2001
From: Scott Gauche <scott-dev@scottgauche.com>
Date: Mon, 5 Oct 2026 11:40:17 -0400
Subject: [PATCH 0998/1982] ALSA: hda/realtek: Fix audio after Windows reboot
 on ASUS Q423SA

commit 8acd6469f42784f38872ad83b14c41152d986b63 upstream.

The ASUS Vivobook S 14 Q423SA-U5512 (DMI family S5406SA) with the
ALC294 codec has working analog audio when booted directly after a full
shutdown. After a warm reboot from Windows 11, audio works briefly during
Linux startup, then both the internal speakers and headphones become
silent. PCM playback continues without errors.

Coefficient 0x1b is 0x4e4b on a direct cold boot, but 0x4a4b after the
Windows warm reboot. Restoring bit 10 changes it back to 0x4e4b and
immediately enables both analog outputs. Speaker playback, headphone
playback, jack switching, cold boot, and suspend/resume were tested
successfully. The same 0x4a4b state and immediate recovery with 0x4e4b
were independently confirmed on another S5406SA with subsystem 1043:10c4.

The same coefficient write is already used by
ALC294_FIXUP_ASUS_COEF_1B for the ASUS UX431DA. That fixup cannot be
reused here because it chains to ALC289_FIXUP_ASUS_GA401 and applies
unrelated DAC routing and microphone pin configuration.

Add a model-specific fixup for subsystem 1043:10c4 and chain it to the
existing ALC2XX_FIXUP_HEADSET_MIC fixup instead.

Link: https://github.com/thesofproject/sof/issues/11051
Fixes: f2d08f3651fb ("ALSA: hda/realtek: Fix headset mic on ASUS Vivobook S14 S5406SA")
Signed-off-by: Scott Gauche <scott-dev@scottgauche.com>
Link: https://patch.msgid.link/20261005154017.1164657-1-scott-dev@scottgauche.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/hda/codecs/realtek/alc269.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 24bb4aa0f68458..03265550c0eef2 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -3842,6 +3842,7 @@ enum {
 	ALC294_FIXUP_ASUS_I2C_HEADSET_MIC,
 	ALC294_FIXUP_ASUS_SPI_HEADSET_MIC,
 	ALC294_FIXUP_ASUS_SPK,
+	ALC294_FIXUP_ASUS_Q423SA,
 	ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 	ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
 	ALC255_FIXUP_ACER_HEADSET_MIC,
@@ -5263,6 +5264,17 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
 	},
+	[ALC294_FIXUP_ASUS_Q423SA] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			/* Restore bit 10 lost after reboot from Windows */
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x1b },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b },
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC2XX_FIXUP_HEADSET_MIC,
+	},
 	[ALC295_FIXUP_CHROME_BOOK] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc295_fixup_chromebook,
@@ -7161,7 +7173,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x10a4, "ASUS TP3407SA", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
-	SND_PCI_QUIRK(0x1043, 0x10c4, "ASUS Vivobook S14 S5406SA", ALC2XX_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1043, 0x10c4, "ASUS S5406SA/Q423SA", ALC294_FIXUP_ASUS_Q423SA),
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x1154, "ASUS TP3607SH", ALC287_FIXUP_TAS2781_I2C),

From 2f92c0286cfd58bff9d6d54c01a771073d5eb775 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Tue, 20 Oct 2026 10:48:10 +0100
Subject: [PATCH 0999/1982] tun: Require CAP_NET_ADMIN to attach to an
 ownerless device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ffdf678dd16610e3f006dac904bd37c09684673c upstream.

Twenty years ago I made creating a tuntap device require CAP_NET_ADMIN
in commit ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to create tuntap
devices.")

The idea was to allow the permissions on /dev/net/tun to be relaxed to
0666 and thus allow owners of tun devices assigned with TUNSETOWNER to
actually open it and get at their devices.

What we missed at the time was that persistent devices with *no* owner
were already essentially world-consumable, and anyone who could open
the device node could also attach to those.

Even then, using persistent devices with no explicitly set owner — on
the (false) presumption that CAP_NET_ADMIN would be required to open
them — wasn't an egregious userspace bug. There are cases where it does
make sense to separate the creation/configuration of the netdevice, from
the process which shovels packets into it.

Since then, TUNSETGROUP was added a year later in commit 8c644623fe7e
("[NET]: Allow group ownership of TUN/TAP devices."). Its commit message
noted that if both uid and gid are set, both have to match (in itself a
bizarre choice) — but still not that with *neither* set, no permission
at all was required.

Then in 2012 commit c8d68e6be1c3 ("tuntap: multiqueue support") allowed
new queues to be attached to a device from the moment of its creation,
with no way for userspace to close the race between creation and a
subsequent TUNSET{OWNER,GROUP}.

In 2024, commit 3ca459eaba1bf ("tun: fix group permission check") tried
to fix things to be saner: only require the user *or* the group to
match, in line with standard POSIX permissions, and require
CAP_NET_ADMIN if neither the user nor group authorised the access
(although it put the CAP_NET_ADMIN check first, and would wrongly have
reported the capability as having been used even when it was not).

That fix was reverted in commit a70c7b3cbc06 ("tun: revert fix group
permission check") due to allegedly causing a regression in an selinux
test suite which *expected* the attachment to succeed when authorised
by none of user, group, nor CAP_NET_ADMIN:
https://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/

We should not break UAPI. But we don't have to consider an selinux test
case which deliberately exercises a security flaw to be UAPI worth
preserving either. To which end, I have fixed it in selinux-testsuite
commit b2f894f0016b ("tests/tun_tap: set an owner on the device for the
relabel tests").

So: fix the lack of CAP_NET_ADMIN check on devices which *haven't* been
assigned an owner or group, while leaving the weird tun ownership model
as it was (user *and* group have to match, if both are set). If someone
still wants to fix the latter (which wasn't actually the reason the
previous attempt was reverted), they can do it under separate cover.

Permit attaching to an existing device only if an owner and/or group was
set and the caller matches all that were set, or if the caller has
CAP_NET_ADMIN. The only behavioural change is that a device with no
owner or group now requires CAP_NET_ADMIN to attach — precisely the
loophole we want to close.

And put the CAP_NET_ADMIN check in the right place this time.

Fixes: ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to create tuntap devices.")
Reported-by: Andrew Lutomirski <luto@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/3c77f88acff5b3c2617b22d64faad15f6212619c.camel@infradead.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 172273ae65754f..636a7094577c35 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -510,14 +510,18 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
 	return ret;
 }
 
-static inline bool tun_not_capable(struct tun_struct *tun)
+static inline bool tun_permitted(struct tun_struct *tun)
 {
 	const struct cred *cred = current_cred();
 	struct net *net = dev_net(tun->dev);
 
-	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
-		(gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
-		!ns_capable(net->user_ns, CAP_NET_ADMIN);
+	/* If both uid and gid are set, *both* must match */
+	if ((uid_valid(tun->owner) || gid_valid(tun->group)) &&
+	    (!uid_valid(tun->owner) || uid_eq(cred->euid, tun->owner)) &&
+	    (!gid_valid(tun->group) || in_egroup_p(tun->group)))
+		return true;
+
+	return ns_capable(net->user_ns, CAP_NET_ADMIN);
 }
 
 static void tun_set_real_num_queues(struct tun_struct *tun)
@@ -2738,7 +2742,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 		    !!(tun->flags & IFF_MULTI_QUEUE))
 			return -EINVAL;
 
-		if (tun_not_capable(tun))
+		if (!tun_permitted(tun))
 			return -EPERM;
 		err = security_tun_dev_open(tun->security);
 		if (err < 0)

From 4d14072b93fa78cad4f05a13f3c63090d9ba5e8f Mon Sep 17 00:00:00 2001
From: Alice Ryhl <aliceryhl@google.com>
Date: Tue, 25 Nov 2025 13:59:37 +0000
Subject: [PATCH 1000/1982] rust: bitmap: add MAX_LEN and MAX_INLINE_LEN
 constants

commit f5535d78e12600deb30a9fb3c628c425f0caec21 upstream.

To avoid hard-coding these values in drivers, define constants for them
that drivers can reference. Also, update all instances in bitmap.rs and
id_pool.rs that use these values to use the new constants.

Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Burak Emir <bqe@google.com>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 rust/kernel/bitmap.rs  | 33 +++++++++++++++++++--------------
 rust/kernel/id_pool.rs | 39 ++++++++++++++++++++++-----------------
 2 files changed, 41 insertions(+), 31 deletions(-)

diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs
index c2634561b023b5..0e5e825aefb6c7 100644
--- a/rust/kernel/bitmap.rs
+++ b/rust/kernel/bitmap.rs
@@ -12,8 +12,6 @@ use crate::bindings;
 use crate::pr_err;
 use core::ptr::NonNull;
 
-const BITS_PER_LONG: usize = bindings::BITS_PER_LONG as usize;
-
 /// Represents a C bitmap. Wraps underlying C bitmap API.
 ///
 /// # Invariants
@@ -176,14 +174,14 @@ union BitmapRepr {
 ///
 /// # Invariants
 ///
-/// * `nbits` is `<= i32::MAX` and never changes.
-/// * if `nbits <= bindings::BITS_PER_LONG`, then `repr` is a `usize`.
+/// * `nbits` is `<= MAX_LEN`.
+/// * if `nbits <= MAX_INLINE_LEN`, then `repr` is a `usize`.
 /// * otherwise, `repr` holds a non-null pointer to an initialized
 ///   array of `unsigned long` that is large enough to hold `nbits` bits.
 pub struct BitmapVec {
     /// Representation of bitmap.
     repr: BitmapRepr,
-    /// Length of this bitmap. Must be `<= i32::MAX`.
+    /// Length of this bitmap. Must be `<= MAX_LEN`.
     nbits: usize,
 }
 
@@ -191,7 +189,7 @@ impl core::ops::Deref for BitmapVec {
     type Target = Bitmap;
 
     fn deref(&self) -> &Bitmap {
-        let ptr = if self.nbits <= BITS_PER_LONG {
+        let ptr = if self.nbits <= BitmapVec::MAX_INLINE_LEN {
             // SAFETY: Bitmap is represented inline.
             #[allow(unused_unsafe, reason = "Safe since Rust 1.92.0")]
             unsafe {
@@ -210,7 +208,7 @@ impl core::ops::Deref for BitmapVec {
 
 impl core::ops::DerefMut for BitmapVec {
     fn deref_mut(&mut self) -> &mut Bitmap {
-        let ptr = if self.nbits <= BITS_PER_LONG {
+        let ptr = if self.nbits <= BitmapVec::MAX_INLINE_LEN {
             // SAFETY: Bitmap is represented inline.
             #[allow(unused_unsafe, reason = "Safe since Rust 1.92.0")]
             unsafe {
@@ -240,7 +238,7 @@ unsafe impl Sync for BitmapVec {}
 
 impl Drop for BitmapVec {
     fn drop(&mut self) {
-        if self.nbits <= BITS_PER_LONG {
+        if self.nbits <= BitmapVec::MAX_INLINE_LEN {
             return;
         }
         // SAFETY: `self.ptr` was returned by the C `bitmap_zalloc`.
@@ -253,23 +251,29 @@ impl Drop for BitmapVec {
 }
 
 impl BitmapVec {
+    /// The maximum possible length of a `BitmapVec`.
+    pub const MAX_LEN: usize = i32::MAX as usize;
+
+    /// The maximum length that uses the inline representation.
+    pub const MAX_INLINE_LEN: usize = usize::BITS as usize;
+
     /// Constructs a new [`BitmapVec`].
     ///
     /// Fails with [`AllocError`] when the [`BitmapVec`] could not be allocated. This
-    /// includes the case when `nbits` is greater than `i32::MAX`.
+    /// includes the case when `nbits` is greater than `MAX_LEN`.
     #[inline]
     pub fn new(nbits: usize, flags: Flags) -> Result<Self, AllocError> {
-        if nbits <= BITS_PER_LONG {
+        if nbits <= BitmapVec::MAX_INLINE_LEN {
             return Ok(BitmapVec {
                 repr: BitmapRepr { bitmap: 0 },
                 nbits,
             });
         }
-        if nbits > i32::MAX.try_into().unwrap() {
+        if nbits > Self::MAX_LEN {
             return Err(AllocError);
         }
         let nbits_u32 = u32::try_from(nbits).unwrap();
-        // SAFETY: `BITS_PER_LONG < nbits` and `nbits <= i32::MAX`.
+        // SAFETY: `MAX_INLINE_LEN < nbits` and `nbits <= MAX_LEN`.
         let ptr = unsafe { bindings::bitmap_zalloc(nbits_u32, flags.as_raw()) };
         let ptr = NonNull::new(ptr).ok_or(AllocError)?;
         // INVARIANT: `ptr` returned by C `bitmap_zalloc` and `nbits` checked.
@@ -523,9 +527,10 @@ mod tests {
     #[test]
     fn bitmap_borrow() {
         let fake_bitmap: [usize; 2] = [0, 0];
+        let fake_bitmap_len = 2 * usize::BITS as usize;
         // SAFETY: `fake_c_bitmap` is an array of expected length.
-        let b = unsafe { Bitmap::from_raw(fake_bitmap.as_ptr(), 2 * BITS_PER_LONG) };
-        assert_eq!(2 * BITS_PER_LONG, b.len());
+        let b = unsafe { Bitmap::from_raw(fake_bitmap.as_ptr(), fake_bitmap_len) };
+        assert_eq!(fake_bitmap_len, b.len());
         assert_eq!(None, b.next_bit(0));
     }
 
diff --git a/rust/kernel/id_pool.rs b/rust/kernel/id_pool.rs
index a41a3404213ca9..0b1f720a1f7df8 100644
--- a/rust/kernel/id_pool.rs
+++ b/rust/kernel/id_pool.rs
@@ -7,8 +7,6 @@
 use crate::alloc::{AllocError, Flags};
 use crate::bitmap::BitmapVec;
 
-const BITS_PER_LONG: usize = bindings::BITS_PER_LONG as usize;
-
 /// Represents a dynamic ID pool backed by a [`BitmapVec`].
 ///
 /// Clients acquire and release IDs from unset bits in a bitmap.
@@ -97,13 +95,12 @@ impl ReallocRequest {
 impl IdPool {
     /// Constructs a new [`IdPool`].
     ///
-    /// A capacity below [`BITS_PER_LONG`] is adjusted to
-    /// [`BITS_PER_LONG`].
+    /// A capacity below [`MAX_INLINE_LEN`] is adjusted to [`MAX_INLINE_LEN`].
     ///
-    /// [`BITS_PER_LONG`]: srctree/include/asm-generic/bitsperlong.h
+    /// [`MAX_INLINE_LEN`]: BitmapVec::MAX_INLINE_LEN
     #[inline]
     pub fn new(num_ids: usize, flags: Flags) -> Result<Self, AllocError> {
-        let num_ids = core::cmp::max(num_ids, BITS_PER_LONG);
+        let num_ids = usize::max(num_ids, BitmapVec::MAX_INLINE_LEN);
         let map = BitmapVec::new(num_ids, flags)?;
         Ok(Self { map })
     }
@@ -116,28 +113,34 @@ impl IdPool {
 
     /// Returns a [`ReallocRequest`] if the [`IdPool`] can be shrunk, [`None`] otherwise.
     ///
-    /// The capacity of an [`IdPool`] cannot be shrunk below [`BITS_PER_LONG`].
+    /// The capacity of an [`IdPool`] cannot be shrunk below [`MAX_INLINE_LEN`].
     ///
-    /// [`BITS_PER_LONG`]: srctree/include/asm-generic/bitsperlong.h
+    /// [`MAX_INLINE_LEN`]: BitmapVec::MAX_INLINE_LEN
     ///
     /// # Examples
     ///
     /// ```
-    /// use kernel::alloc::{AllocError, flags::GFP_KERNEL};
-    /// use kernel::id_pool::{ReallocRequest, IdPool};
+    /// use kernel::{
+    ///     alloc::AllocError,
+    ///     bitmap::BitmapVec,
+    ///     id_pool::{
+    ///         IdPool,
+    ///         ReallocRequest,
+    ///     },
+    /// };
     ///
     /// let mut pool = IdPool::new(1024, GFP_KERNEL)?;
     /// let alloc_request = pool.shrink_request().ok_or(AllocError)?;
     /// let resizer = alloc_request.realloc(GFP_KERNEL)?;
     /// pool.shrink(resizer);
-    /// assert_eq!(pool.capacity(), kernel::bindings::BITS_PER_LONG as usize);
+    /// assert_eq!(pool.capacity(), BitmapVec::MAX_INLINE_LEN);
     /// # Ok::<(), AllocError>(())
     /// ```
     #[inline]
     pub fn shrink_request(&self) -> Option<ReallocRequest> {
         let cap = self.capacity();
-        // Shrinking below [`BITS_PER_LONG`] is never possible.
-        if cap <= BITS_PER_LONG {
+        // Shrinking below `MAX_INLINE_LEN` is never possible.
+        if cap <= BitmapVec::MAX_INLINE_LEN {
             return None;
         }
         // Determine if the bitmap can shrink based on the position of
@@ -146,13 +149,13 @@ impl IdPool {
         // bitmap should shrink to half its current size.
         let Some(bit) = self.map.last_bit() else {
             return Some(ReallocRequest {
-                num_ids: BITS_PER_LONG,
+                num_ids: BitmapVec::MAX_INLINE_LEN,
             });
         };
         if bit >= (cap / 4) {
             return None;
         }
-        let num_ids = usize::max(BITS_PER_LONG, cap / 2);
+        let num_ids = usize::max(BitmapVec::MAX_INLINE_LEN, cap / 2);
         Some(ReallocRequest { num_ids })
     }
 
@@ -177,11 +180,13 @@ impl IdPool {
 
     /// Returns a [`ReallocRequest`] for growing this [`IdPool`], if possible.
     ///
-    /// The capacity of an [`IdPool`] cannot be grown above [`i32::MAX`].
+    /// The capacity of an [`IdPool`] cannot be grown above [`MAX_LEN`].
+    ///
+    /// [`MAX_LEN`]: BitmapVec::MAX_LEN
     #[inline]
     pub fn grow_request(&self) -> Option<ReallocRequest> {
         let num_ids = self.capacity() * 2;
-        if num_ids > i32::MAX.try_into().unwrap() {
+        if num_ids > BitmapVec::MAX_LEN {
             return None;
         }
         Some(ReallocRequest { num_ids })

From 7ab573237315f5cba0603cb039698adebeb29094 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Nov 2026 12:06:15 -0500
Subject: [PATCH 1001/1982] Linux 6.18.61

Link: https://lore.kernel.org/r/20261104211043.516122098@linuxfoundation.org
Tested-by: SJ Park <sj@kernel.org>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Wentao Guan <guanwentao@uniontech.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Barry K. Nathan <barryn@pobox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 08be8b2cd2447a..3745cd4aab9681 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 18
-SUBLEVEL = 60
+SUBLEVEL = 61
 EXTRAVERSION =
 NAME = Baby Opossum Posse
 

From 37d5a73170579b30e67cc8b19ec69715eea3a6b6 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 6 Nov 2026 13:07:52 +0100
Subject: [PATCH 1002/1982] xen-netback: Fix UAF when reading statistics data

commit 5fb756f1bbec7a3862dda5d79028bf656271804c upstream.

The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state.  In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.

Fix that by calling synchronize_net() before freeing the queue data.

This is XSA-526 / CVE-2026-100080

Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/xenbus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 61b547aab286a2..5e4d522de36bd5 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -837,6 +837,7 @@ static void connect(struct backend_info *be)
 err:
 	if (be->vif->num_queues > 0)
 		xenvif_disconnect_data(be->vif); /* Clean up existing queues */
+	synchronize_net();
 	for (queue_index = 0; queue_index < be->vif->num_queues; ++queue_index)
 		xenvif_deinit_queue(&be->vif->queues[queue_index]);
 	vfree(be->vif->queues);

From 34f0f63dc6dc11895a17bb5672451b6b11622c99 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 6 Nov 2026 17:07:01 +0100
Subject: [PATCH 1003/1982] xen-netback: defer xenvif_mcast_addr_list_free()

commit bfddc420afe827d9f06458cdf8087cd602f8c9cb upstream.

In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).

Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().

This is XSA-527 / CVE-2026-100081.

Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt@proton.me>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/interface.c | 2 --
 drivers/net/xen-netback/xenbus.c    | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index a0a43888138808..b233834ec6cc75 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -812,8 +812,6 @@ void xenvif_disconnect_data(struct xenvif *vif)
 
 		xenvif_disconnect_queue(queue);
 	}
-
-	xenvif_mcast_addr_list_free(vif);
 }
 
 void xenvif_disconnect_ctrl(struct xenvif *vif)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 5e4d522de36bd5..aca25db2503b61 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -267,6 +267,8 @@ static void backend_disconnect(struct backend_info *be)
 		vif->num_queues = 0;
 		synchronize_net();
 
+		xenvif_mcast_addr_list_free(vif);
+
 		for (queue_index = 0; queue_index < num_queues; ++queue_index)
 			xenvif_deinit_queue(&vif->queues[queue_index]);
 

From c49934da934cf495faf782aa5d84f413221c9be6 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Thu, 5 Nov 2026 08:27:38 +0100
Subject: [PATCH 1004/1982] xen-blkback: Avoid UAF when reading I/O statistics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a02926f7c89bfc798ee9514e09694ff4279928a1 upstream.

Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.

Use a rwlock for synchronizing.

This is XSA-528 / CVE-2026-100082

Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross@suse.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/common.h |  2 ++
 drivers/block/xen-blkback/xenbus.c | 31 +++++++++++++++++++++++-------
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index b427d54bc1205e..f5890b3f1df9c0 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -318,8 +318,10 @@ struct xen_blkif {
 	unsigned int		nr_ring_pages;
 	bool			multi_ref;
 	/* All rings for this device. */
+	rwlock_t		rings_lock;
 	struct xen_blkif_ring	*rings;
 	unsigned int		nr_rings;
+
 	unsigned long		buffer_squeeze_end;
 };
 
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 0621878940ae57..628611ff4b8e1c 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -127,15 +127,23 @@ static void xen_update_blkif_status(struct xen_blkif *blkif)
 	return;
 }
 
-static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
+static int xen_blkif_alloc_rings(struct xen_blkif *blkif,
+				 unsigned int nr_rings)
 {
 	unsigned int r;
+	struct xen_blkif_ring *rings;
 
-	blkif->rings = kcalloc(blkif->nr_rings, sizeof(struct xen_blkif_ring),
-			       GFP_KERNEL);
-	if (!blkif->rings)
+	rings = kcalloc(nr_rings, sizeof(struct xen_blkif_ring), GFP_KERNEL);
+	if (!rings)
 		return -ENOMEM;
 
+	write_lock(&blkif->rings_lock);
+
+	blkif->rings = rings;
+	blkif->nr_rings = nr_rings;
+
+	write_unlock(&blkif->rings_lock);
+
 	for (r = 0; r < blkif->nr_rings; r++) {
 		struct xen_blkif_ring *ring = &blkif->rings[r];
 
@@ -175,6 +183,7 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
 	blkif->domid = domid;
 	atomic_set(&blkif->refcnt, 1);
 	init_completion(&blkif->drain_complete);
+	rwlock_init(&blkif->rings_lock);
 
 	/*
 	 * Because freeing back to the cache may be deferred, it is not
@@ -269,6 +278,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 	struct pending_req *req, *n;
 	unsigned int j, r;
 	bool busy = false;
+	struct xen_blkif_ring *rings;
 
 	for (r = 0; r < blkif->nr_rings; r++) {
 		struct xen_blkif_ring *ring = &blkif->rings[r];
@@ -335,10 +345,16 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 	 * blkif->rings was allocated in connect_ring, so we should free it in
 	 * here.
 	 */
-	kfree(blkif->rings);
+	write_lock(&blkif->rings_lock);
+
+	rings = blkif->rings;
 	blkif->rings = NULL;
 	blkif->nr_rings = 0;
 
+	write_unlock(&blkif->rings_lock);
+
+	kfree(rings);
+
 	return 0;
 }
 
@@ -386,6 +402,7 @@ void xen_blkif_interface_fini(void)
 		unsigned int i;						\
 		unsigned long long result = 0;				\
 									\
+		read_lock(&blkif->rings_lock);				\
 		if (!blkif->rings)				\
 			goto out;					\
 									\
@@ -396,6 +413,7 @@ void xen_blkif_interface_fini(void)
 		}							\
 									\
 out:									\
+		read_unlock(&blkif->rings_lock);			\
 		return sprintf(buf, format, result);			\
 	}								\
 	static DEVICE_ATTR(name, 0444, show_##name, NULL)
@@ -1105,8 +1123,7 @@ static int connect_ring(struct backend_info *be)
 				requested_num_queues, xenblk_max_queues);
 		return -ENOSYS;
 	}
-	blkif->nr_rings = requested_num_queues;
-	if (xen_blkif_alloc_rings(blkif))
+	if (xen_blkif_alloc_rings(blkif, requested_num_queues))
 		return -ENOMEM;
 
 	pr_info("%s: using %d queues, protocol %d (%s) %s\n", dev->nodename,

From c3f63d70f236bb7685e6d11d1d9b5b351552e600 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Nov 2026 13:17:37 -0500
Subject: [PATCH 1005/1982] Linux 6.18.62

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3745cd4aab9681..ae234882e7e55f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 18
-SUBLEVEL = 61
+SUBLEVEL = 62
 EXTRAVERSION =
 NAME = Baby Opossum Posse
 

From de5b233cfc33e0e8355599a487a69dbbeba2150c Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Wed, 5 Nov 2025 20:16:52 +0100
Subject: [PATCH 1006/1982] x86/bugs: Mitigate TSA on AMD Zen5

Commit cf27412f19c9cc5909b9107cd1b3f4ab7608e362 upstream.

Zen5 is affected by TSA too, along with a third variant called TSA_FILL.
Detect the vuln there and mitigate it. For Zen5, a table of microcode
revisions is not needed because appropriate microcode sets the VERW_CLEAR
CPUID bit, which simplifies mitigation detection considerably.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpufeatures.h | 1 +
 arch/x86/kernel/cpu/amd.c          | 9 +++++++--
 arch/x86/kernel/cpu/common.c       | 5 +++--
 arch/x86/kernel/cpu/scattered.c    | 1 +
 arch/x86/kvm/cpuid.c               | 1 +
 arch/x86/kvm/reverse_cpuid.h       | 2 ++
 6 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index b60b4a82ea20a0..de7da218835e6b 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -502,6 +502,7 @@
 #define X86_FEATURE_IBPB_EXIT_TO_USER	(21*32+14) /* Use IBPB on exit-to-userspace, see VMSCAPE bug */
 #define X86_FEATURE_ABMC		(21*32+15) /* Assignable Bandwidth Monitoring Counters */
 #define X86_FEATURE_MSR_IMM		(21*32+16) /* MSR immediate form instructions */
+#define X86_FEATURE_TSA_FILL_NO		(21*32+17) /* AMD CPU not vulnerable to TSA-FILL */
 
 /*
  * BUG word(s)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index ca4265a1f4bb76..bd274c2b4c6a30 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -413,9 +413,14 @@ static void tsa_init(struct cpuinfo_x86 *c)
 		else
 			pr_debug("%s: current revision: 0x%x\n", __func__, c->microcode);
 	} else {
-		setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO);
-		setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO);
+		if (!cpu_has(c, X86_FEATURE_ZEN5)) {
+			setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO);
+			setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO);
+		}
 	}
+
+	if (!cpu_has(c, X86_FEATURE_ZEN5))
+		setup_force_cpu_cap(X86_FEATURE_TSA_FILL_NO);
 }
 
 static void bsp_init_amd(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 3ffeadad024479..b0de3aabcd791d 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1299,7 +1299,7 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
 	VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO | VMSCAPE),
 	VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO | VMSCAPE),
 	VULNBL_AMD(0x19, SRSO | TSA | VMSCAPE),
-	VULNBL_AMD(0x1a, SRSO | VMSCAPE),
+	VULNBL_AMD(0x1a, SRSO | TSA | VMSCAPE),
 	{}
 };
 
@@ -1564,7 +1564,8 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 
 	if (c->x86_vendor == X86_VENDOR_AMD) {
 		if (!cpu_has(c, X86_FEATURE_TSA_SQ_NO) ||
-		    !cpu_has(c, X86_FEATURE_TSA_L1_NO)) {
+		    !cpu_has(c, X86_FEATURE_TSA_L1_NO) ||
+		    !cpu_has(c, X86_FEATURE_TSA_FILL_NO)) {
 			if (cpu_matches(cpu_vuln_blacklist, TSA) ||
 			    /* Enable bug on Zen guests to allow for live migration. */
 			    (cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_ZEN)))
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index c4bc3c259f3fc9..083403886da225 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -55,6 +55,7 @@ static const struct cpuid_bit cpuid_bits[] = {
 	{ X86_FEATURE_ABMC,			CPUID_EBX,  5, 0x80000020, 0 },
 	{ X86_FEATURE_TSA_SQ_NO,		CPUID_ECX,  1, 0x80000021, 0 },
 	{ X86_FEATURE_TSA_L1_NO,		CPUID_ECX,  2, 0x80000021, 0 },
+	{ X86_FEATURE_TSA_FILL_NO,		CPUID_ECX,  7, 0x80000021, 0 },
 	{ X86_FEATURE_AMD_WORKLOAD_CLASS,	CPUID_EAX, 22, 0x80000021, 0 },
 	{ X86_FEATURE_BTB_CTX_ISOLATION,	CPUID_ECX,  8, 0x80000021, 0 },
 	{ X86_FEATURE_PERFMON_V2,		CPUID_EAX,  0, 0x80000022, 0 },
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 913ffb995279af..a35ca056fe3e7b 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -1231,6 +1231,7 @@ void kvm_set_cpu_caps(void)
 	kvm_cpu_cap_init(CPUID_8000_0021_ECX,
 		SYNTHESIZED_F(TSA_SQ_NO),
 		SYNTHESIZED_F(TSA_L1_NO),
+		SYNTHESIZED_F(TSA_FILL_NO),
 	);
 
 	kvm_cpu_cap_init(CPUID_8000_0022_EAX,
diff --git a/arch/x86/kvm/reverse_cpuid.h b/arch/x86/kvm/reverse_cpuid.h
index 743ab25ba7872b..dcd8ed7c5ed4c7 100644
--- a/arch/x86/kvm/reverse_cpuid.h
+++ b/arch/x86/kvm/reverse_cpuid.h
@@ -58,6 +58,7 @@
 /* CPUID level 0x80000021 (ECX) */
 #define KVM_X86_FEATURE_TSA_SQ_NO	KVM_X86_FEATURE(CPUID_8000_0021_ECX, 1)
 #define KVM_X86_FEATURE_TSA_L1_NO	KVM_X86_FEATURE(CPUID_8000_0021_ECX, 2)
+#define KVM_X86_FEATURE_TSA_FILL_NO	KVM_X86_FEATURE(CPUID_8000_0021_ECX, 7)
 
 struct cpuid_reg {
 	u32 function;
@@ -133,6 +134,7 @@ static __always_inline u32 __feature_translate(int x86_feature)
 	KVM_X86_TRANSLATE_FEATURE(TSA_SQ_NO);
 	KVM_X86_TRANSLATE_FEATURE(TSA_L1_NO);
 	KVM_X86_TRANSLATE_FEATURE(MSR_IMM);
+	KVM_X86_TRANSLATE_FEATURE(TSA_FILL_NO);
 	default:
 		return x86_feature;
 	}

From f960356fa9eea57cb2237ccbe738d8fa7b7ff4df Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Thu, 5 Nov 2026 12:02:08 +0000
Subject: [PATCH 1007/1982] KVM: VMX: Formally define KVM's "0xdead" exit
 reason used for failed VM-Enter

[ Upstream commit d85f7dc8cf3c91a131946dae4c3aa8d9c97322d7 ]

Add EXIT_REASON_UNDEFINED to track KVM's magic "0xdead" value that's used
to stuff the exit reason on a failed VM-Enter so that the magic can be
reused by TDX, and to make it more obvious that it's an arbitrary, KVM-
defined value (though the whole "dead" thing makes it pretty darn obvious).

Opportunistically add a compile-time assert to ensure the KVM-defined exit
reason never collides with a "real" exit reason.

No functional change intended.

Cc: Xiaoyao Li <xiaoyao.li@intel.com>
Cc: Yan Zhao <yan.y.zhao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Rick Edgecombe <rick.p.edgecombe@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260921235656.1107929-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/vmx.h | 8 ++++++++
 arch/x86/kvm/vmx/vmx.c     | 4 +++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index c85c500195239b..a9daddd84ad6c7 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -20,6 +20,14 @@
 #include <asm/trapnr.h>
 #include <asm/vmxfeatures.h>
 
+/*
+ * UNDEFINED is a KVM-defined value used to indicate that the basic exit reason
+ * is undefined/invalid, e.g. on VM-Fail or if TDX never attempted VM-Enter.
+ * The value itself is arbitrary, it just needs to not collide with a real exit
+ * reason.
+ */
+#define EXIT_REASON_UNDEFINED			0xdead
+
 #define VMCS_CONTROL_BIT(x)	BIT(VMX_FEATURE_##x & 0x1f)
 
 /*
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 8da96a6c617737..ced20415a14f09 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6151,6 +6151,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
 static const int kvm_vmx_max_exit_handlers =
 	ARRAY_SIZE(kvm_vmx_exit_handlers);
 
+static_assert(EXIT_REASON_UNDEFINED >= ARRAY_SIZE(kvm_vmx_exit_handlers));
+
 void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
 		       u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code)
 {
@@ -7333,7 +7335,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu,
 	vmx_enable_fb_clear(vmx);
 
 	if (unlikely(vmx->fail)) {
-		vmx->vt.exit_reason.full = 0xdead;
+		vmx->vt.exit_reason.full = EXIT_REASON_UNDEFINED;
 		goto out;
 	}
 

From a37727a99d00923768932c9ee81e7dfef5f37cf8 Mon Sep 17 00:00:00 2001
From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
Date: Sun, 13 Sep 2026 10:37:27 +0300
Subject: [PATCH 1008/1982] x86/mm/pat: Use pr_warn() for early W^X warnings

[ Upstream commit ea6fd393cb9e6811a748c7551de0dd3090f9dcde ]

Nathan Chancellor reports the following warning:

  CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00

from its_alloc() doing set_memory_x() during early retpoline setup.

The warning is not factually wrong but it is unproductive. First, the RWX
permission is temporary and fixed up by execmem_restore_rox(). Second,
at the time of the warning, all kernel text is mapped RWX. So there is not
even a transient actual security issue.

The right way to fix this up is to relax RWX detection during boot but
make a final verification pass over all kernel page tables before running
userspace.  There is code to do that today (debug_checkwx()) but it
must be enabled explicitly in Kconfig.

For now, retain the warning even if it's unproductive, but make it
scream less loudly: use pr_warn_once() rather than WARN_ONCE().

Remove the warning once debug_checkwx() behavior becomes unconditional.

Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://patch.msgid.link/20260913-fixes-verify-rwx-v3-1-5e1d6a08bd02@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/pat/set_memory.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 12b7de5f0957e9..9fc18a091311f0 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -718,6 +718,21 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 		return new;
 
 	end = start + npg * PAGE_SIZE - 1;
+
+	/*
+	 * If the kernel text is still RWX, gently complain, this could be a
+	 * false positive.
+	 * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
+	 * the warning can be removed completely.
+	 */
+	if (!kernel_set_to_readonly) {
+		pr_warn_once("CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
+		  (unsigned long long)pgprot_val(old),
+		  (unsigned long long)pgprot_val(new),
+		  start, end, pfn);
+		return new;
+	}
+
 	WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
 		  (unsigned long long)pgprot_val(old),
 		  (unsigned long long)pgprot_val(new),

From 8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <imv4bel@gmail.com>
Date: Fri, 30 Oct 2026 06:42:16 +0900
Subject: [PATCH 1009/1982] inet: reject unhashed sockets during established
 lookups

[ Upstream commit 4e2b3ef19e0e04adca38442f07dd6bc93c712bf1 ]

TCP established ehash lookups are lockless. The socket caches involved
use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader
that retained its old address has finished.

After a tuple match, __inet_lookup_established() and
__inet6_lookup_established() acquire a reference and repeat the tuple
check. They do not check whether the new object is hashed. If the
address is reused for a socket with the same tuple, the lookup can
acquire a reference to the new object and return it while its nulls node
is unhashed.

A PoC that drives reuse with a SYN cookie request socket reproduced the
crash. The new request socket is unhashed and has a NULL rsk_listener.
A lookup that had loaded the address of the old request socket acquired
the reference published by tcp_get_cookie_sock() and returned the new
object. tcp_v4_rcv() then read sk_state through the NULL listener.

The resulting crash was:

  BUG: kernel NULL pointer dereference, address: 0000000000000012
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  ...
  Oops: Oops: 0000 [#1] SMP NOPTI
  CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)
  ...
  RIP: 0010:tcp_v4_rcv+0x44e/0x1280
  ...
  R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000
  ...
  CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0
  ...
  Call Trace:
   <IRQ>
   ? raw_local_deliver+0xae/0x240
   ip_protocol_deliver_rcu+0x2d/0x180
   ip_local_deliver_finish+0x84/0x100
   ip_sublist_rcv_finish+0x5f/0x70
   ip_sublist_rcv+0x12a/0x1d0
   ip_list_rcv+0xfd/0x130
   __netif_receive_skb_list_core+0x223/0x250
   netif_receive_skb_list_internal+0x1d2/0x2c0
   ? try_fill_recv+0x39/0x7b0
   napi_complete_done+0x74/0x170
   virtnet_poll+0x445/0x600
   __napi_poll+0x27/0x1e0
   net_rx_action+0x2fe/0x3b0
   handle_softirqs+0xc2/0x2c0
   __irq_exit_rcu+0x74/0xd0
   common_interrupt+0x7f/0x90
   </IRQ>
  ...
  Kernel panic - not syncing: Fatal exception in interrupt

After taking a reference, check whether the nulls node is unhashed in
both IPv4 and IPv6 established lookups. If it is unhashed or the tuple
no longer matches, drop the reference and restart the lookup.

Lookups racing with the TIME_WAIT hashdance, or with a request being
replaced by its child, now restart and find the new socket instead of
returning the old one.

Request sockets that were never inserted into ehash can have a nonzero
refcount, and a stale lookup can hold a transient reference. Therefore,
when SYN cookie, Fast Open, and request migration paths fail after
setting a nonzero refcount, release the references held by those paths
with reqsk_put() instead of freeing the request directly.

Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261029214219.1035176-2-imv4bel@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/inet_connection_sock.c | 10 +++++++---
 net/ipv4/inet_hashtables.c      |  5 +++--
 net/ipv4/syncookies.c           |  2 ++
 net/ipv4/tcp_input.c            |  4 +++-
 net/ipv6/inet6_hashtables.c     |  4 +++-
 5 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 6b36652d6bb9dc..3e9eaf9d341d1e 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1154,10 +1154,14 @@ static void reqsk_timer_handler(struct timer_list *t)
 	 */
 	if (nreq) {
 		__NET_INC_STATS(net, LINUX_MIB_TCPMIGRATEREQFAILURE);
+		/* The timer was not armed, drop its reference here. */
+		reqsk_put(nreq);
 no_ownership:
 		reqsk_migrate_reset(nreq);
 		reqsk_queue_removed(queue, nreq);
-		__reqsk_free(nreq);
+		/* Drop the temporary reference and the one reserved for ehash. */
+		reqsk_put(nreq);
+		reqsk_put(nreq);
 	}
 
 drop:
@@ -1460,7 +1464,7 @@ struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
 
 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMIGRATEREQFAILURE);
 			reqsk_migrate_reset(nreq);
-			__reqsk_free(nreq);
+			reqsk_put(nreq);
 		} else if (inet_csk_reqsk_queue_add(sk, req, child)) {
 			return child;
 		}
@@ -1515,7 +1519,7 @@ void inet_csk_listen_stop(struct sock *sk)
 					__NET_INC_STATS(sock_net(nsk),
 							LINUX_MIB_TCPMIGRATEREQFAILURE);
 					reqsk_migrate_reset(nreq);
-					__reqsk_free(nreq);
+					reqsk_put(nreq);
 				}
 				rcu_read_unlock();
 
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index a57e33ff92d77a..49c70d752a8925 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -549,8 +549,9 @@ struct sock *__inet_lookup_established(const struct net *net,
 		if (likely(inet_match(net, sk, acookie, ports, dif, sdif))) {
 			if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
 				goto out;
-			if (unlikely(!inet_match(net, sk, acookie,
-						 ports, dif, sdif))) {
+			if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+				     !inet_match(net, sk, acookie, ports, dif,
+						 sdif))) {
 				sock_gen_put(sk);
 				goto begin;
 			}
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b5f0a65c678645..8b3d4e8ee4556c 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -218,6 +218,8 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 
 		bh_unlock_sock(child);
 		sock_put(child);
+		reqsk_put(req);
+		return NULL;
 	}
 	__reqsk_free(req);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e1785140bf9b1c..6a2c05dff42152 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7561,7 +7561,9 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
 		if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
 			bh_unlock_sock(fastopen_sk);
 			sock_put(fastopen_sk);
-			goto drop_and_free;
+			/* tcp_disconnect() already dropped one reqsk ref. */
+			reqsk_put(req);
+			goto drop;
 		}
 		READ_ONCE(sk->sk_data_ready)(sk);
 		bh_unlock_sock(fastopen_sk);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 182d38e6d6d8da..f4f39a20e9514a 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -73,7 +73,9 @@ struct sock *__inet6_lookup_established(const struct net *net,
 		if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
 			goto out;
 
-		if (unlikely(!inet6_match(net, sk, saddr, daddr, ports, dif, sdif))) {
+		if (unlikely(hlist_nulls_unhashed_lockless(&sk->sk_nulls_node) ||
+			     !inet6_match(net, sk, saddr, daddr, ports, dif,
+					  sdif))) {
 			sock_gen_put(sk);
 			goto begin;
 		}

From e8660dc5713f8d5104c78bf6fe5a9825addd838b Mon Sep 17 00:00:00 2001
From: Honglei Huang <honghuan@amd.com>
Date: Fri, 29 May 2026 10:23:17 +0800
Subject: [PATCH 1010/1982] drm/amdgpu: drop retry loop in
 amdgpu_hmm_range_get_pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 ]

Since commit c08972f55594 ("drm/amdgpu: fix amdgpu_hmm_range_get_pages")
moved mmu_interval_read_begin() out of the per-chunk loop, the
captured notifier_seq is no longer refreshed across retries. As a
result, the existing -EBUSY retry path can never make progress:

  hmm_range_fault() returns -EBUSY only when
  mmu_interval_check_retry(notifier, notifier_seq) reports that the
  sequence is stale. Once the sequence has advanced, the stored seq
  will never match again, so every subsequent call within the same
  invocation returns -EBUSY immediately.

The "goto retry" therefore degenerates into a busy spin that simply
burns CPU for the full HMM_RANGE_DEFAULT_TIMEOUT (~1s) window before
finally bailing out with -EAGAIN. This is pure latency with no chance
of recovery, and it actively hurts the KFD userptr stack: the caller
ends up blocked for a second while holding mmap_lock, only to return
-EAGAIN to the restore worker (or to userspace) which would have
re-driven the operation immediately anyway.

Drop the retry/timeout entirely and let -EBUSY propagate straight to
out_free_pfns, where it is already translated to -EAGAIN. Recovery is
handled at a higher level: the KFD restore_userptr_worker reschedules
itself, and the userptr ioctl path returns -EAGAIN to userspace.

No functional regression: the previous behaviour on -EBUSY was already
to fail with -EAGAIN after a 1s stall; we just skip the stall.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Honglei Huang <honghuan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ sashal: Adjusted the declaration context: this tree allocates hmm_range with kzalloc() as a plain pointer rather than embedding it, so only the timeout declaration was dropped. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
index db2bb5cb671d32..fa3676c5babcd2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c
@@ -173,7 +173,6 @@ int amdgpu_hmm_range_get_pages(struct mmu_interval_notifier *notifier,
 	const u64 max_bytes = SZ_2G;
 
 	struct hmm_range *hmm_range;
-	unsigned long timeout;
 	unsigned long *pfns;
 	unsigned long end;
 	int r;
@@ -204,15 +203,9 @@ int amdgpu_hmm_range_get_pages(struct mmu_interval_notifier *notifier,
 		pr_debug("hmm range: start = 0x%lx, end = 0x%lx",
 			hmm_range->start, hmm_range->end);
 
-		timeout = jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
-
-retry:
 		r = hmm_range_fault(hmm_range);
-		if (unlikely(r)) {
-			if (r == -EBUSY && !time_after(jiffies, timeout))
-				goto retry;
+		if (unlikely(r))
 			goto out_free_pfns;
-		}
 
 		if (hmm_range->end == end)
 			break;

From 1706461eb1af814366b6d0ab413edd0876bd8033 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 4 Nov 2026 17:36:02 -0500
Subject: [PATCH 1011/1982] KVM: guest_memfd: Gracefully handle xarray errors
 when binding a memslot

[ Upstream commit e6ecb88711d93b9e014532f17d3d29b57e80932c ]

If inserting a memslot into a guest_memfd's bindings xarray fails,
propagate the error back to the caller, i.e. fail memslot creation as well.
Signalling success and continuing on with memslot creation results in
use-after-free, as the guest_memfd instance will remain reachable via the
memslot after the file is freed (kvm_gmem_release() won't nullify the file
pointer due to lack of a valid binding).

Opportunistically WARN and reject binding if KVM_MEMSLOT_GMEM_ONLY is
already set, partly to guard against goofs elsewhere, but mostly so that
KVM doesn't need to worry about clobbering flags when unwinding on failure.

Regarding the unwind, the slot must be fully prepared before inserting it
into the bindings, at which point the slot becomes reachable.  I.e. waiting
to update the slot in order to avoid the ugly unwind isn't an option.  And
as part of the unwind, explicitly nullify the relevant bindings, as xarray
can store a subset of entries when populating a range.

Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Cc: stable@vger.kernel.org
Reported-by: Stefan Teodorescu <fane@google.com>
Reported-by: Dennis Tighe <dtighe@google.com>
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260823135031.4F6DC1F000E9%40smtp.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Link: https://patch.msgid.link/20260922001332.1121266-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
[ sashal: Changed the two &f->bindings references to &gmem->bindings to match the existing variable name. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/guest_memfd.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index a59a4446b8461c..2ab7bb46a371e7 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -576,6 +576,9 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
 	BUILD_BUG_ON(sizeof(gpa_t) != sizeof(offset));
 	BUILD_BUG_ON(sizeof(gfn_t) != sizeof(slot->gmem.pgoff));
 
+	if (WARN_ON_ONCE(slot->flags & KVM_MEMSLOT_GMEM_ONLY))
+		return -EINVAL;
+
 	file = fget(fd);
 	if (!file)
 		return -EBADF;
@@ -613,7 +616,13 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
 	if (kvm_gmem_supports_mmap(inode))
 		slot->flags |= KVM_MEMSLOT_GMEM_ONLY;
 
-	xa_store_range(&gmem->bindings, start, end - 1, slot, GFP_KERNEL);
+	r = xa_err(xa_store_range(&gmem->bindings, start, end - 1, slot, GFP_KERNEL));
+	if (r) {
+		xa_store_range(&gmem->bindings, start, end - 1, NULL, GFP_KERNEL);
+		slot->gmem.file = NULL;
+		slot->gmem.pgoff = 0;
+		slot->flags &= ~KVM_MEMSLOT_GMEM_ONLY;
+	}
 	filemap_invalidate_unlock(inode->i_mapping);
 
 	/*
@@ -621,7 +630,6 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
 	 * not the other way 'round.  Active bindings are invalidated if the
 	 * file is closed before memslots are destroyed.
 	 */
-	r = 0;
 err:
 	fput(file);
 	return r;

From 0fab93d241cfb6f3aae29530a9a214157bb64087 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Wed, 4 Nov 2026 18:24:09 -0500
Subject: [PATCH 1012/1982] mm/truncate: look up the end-edge straddler by
 index

[ Upstream commit f47dee903b9f0f1e4e7181e8a398a7678cabf0a5 ]

In truncate_inode_partial_folio(), after the first split at the start
edge, folio_split() unlocks and drops the refcount of the after-split
sub-folios.  The sub-folio straddling the end of the truncation range is
therefore unlocked and only transiently ref'd in the page cache while the
code still derives it from a page pointer inside the original folio.

Between the first split finishing and page_folio() resolving split_at2,
that tail page can be reclaimed, freed and reallocated as a new large
folio in the same mapping at a different file offset.  folio2 then points
at a folio that does not cover the end boundary, yet folio2->mapping ==
folio->mapping still holds, so the stale pointer passes the mapping check
and folio_split_or_unmap() splits a folio at a wrong position (or, with a
transient refcount, a use-after-free window opens between try_get and the
split).  __folio_split()'s own folio != page_folio(split_at) check cannot
catch this either since split_at2 has been reallocated as part of the new
folio, so page_folio(split_at2) resolves back to folio2.

Look the straddler up by its page index instead.  __filemap_get_folio()
returns the folio currently covering the boundary, ref'd and locked, with
the mapping validated under the lock, so the split target is always the
real folio at the end edge.

Link: https://lore.kernel.org/20260928120833.3440834-3-yi.zhang@huaweicloud.com
Link: https://lore.kernel.org/linux-mm/DLGXT0ERY79Z.3C5DYVJVX6S9Z@nvidia.com/
Fixes: 7460b470a131 ("mm/truncate: use folio_split() in truncate operation")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260916094500.C30061F00893%40smtp.kernel.org
Suggested-by: Jan Kara <jack@suse.cz>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Joanne Koong <joannelkoong@gmail.com>
Cc: Darrick J. Wong <djwong@kernel.org>
Cc: <yizhang089@gmail.com>
Cc: Yang Erkun <yangerkun@huawei.com>
Cc: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: <yukuai@fnnas.com>
Cc: <stable@vger.kernel.org>
[ sashal: Retained try_folio_split_or_unmap() instead of folio_split_or_unmap() to preserve the uniform-split fallback. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/truncate.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/mm/truncate.c b/mm/truncate.c
index 4bf64fd610c949..9b1baa688a1046 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -259,30 +259,32 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end)
 		 * for shmem truncate
 		 */
 		struct folio *folio2;
+		pgoff_t end_idx;
 
 		if (offset + length == size)
 			goto no_split;
 
-		split_at2 = folio_page(folio,
-				PAGE_ALIGN_DOWN(offset + length) / PAGE_SIZE);
-		folio2 = page_folio(split_at2);
-
-		if (!folio_try_get(folio2))
+		/*
+		 * After the first split at the start edge, the folio at the
+		 * end edge may be freed and reused concurrently.
+		 * __filemap_get_folio() looks up the straddler at end_idx
+		 * and returns it locked and ref'd with the mapping
+		 * validated.
+		 */
+		end_idx = (pos + offset + length) >> PAGE_SHIFT;
+		folio2 = __filemap_get_folio(folio->mapping, end_idx,
+					     FGP_LOCK | FGP_NOWAIT, 0);
+		if (IS_ERR(folio2))
 			goto no_split;
 
+		/* make sure folio2 is large */
 		if (!folio_test_large(folio2))
 			goto out;
 
-		if (!folio_trylock(folio2))
-			goto out;
-
-		/* make sure folio2 is large and does not change its mapping */
-		if (folio_test_large(folio2) &&
-		    folio2->mapping == folio->mapping)
-			try_folio_split_or_unmap(folio2, split_at2, min_order);
-
-		folio_unlock(folio2);
+		split_at2 = folio_page(folio2, (end_idx - folio2->index));
+		try_folio_split_or_unmap(folio2, split_at2, min_order);
 out:
+		folio_unlock(folio2);
 		folio_put(folio2);
 no_split:
 		return true;

From aaaf89f4bca97080e7297265d6e1bf486e1e5741 Mon Sep 17 00:00:00 2001
From: Khasar Munkh-Erdene <02khasar@gmail.com>
Date: Wed, 4 Nov 2026 18:46:26 -0500
Subject: [PATCH 1013/1982] staging: rtl8723bs: fix spacing around operators in
 rtw_recv.c

[ Upstream commit 393b267e6f04a11d4b18b7dc1423fa59f173f72b ]

Fix coding style issues by adding missing spaces around binary and
ternary operators, as reported by checkpatch.pl.

Signed-off-by: Khasar Munkh-Erdene <02khasar@gmail.com>
Link: https://patch.msgid.link/20260225032909.72799-1-02khasar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 495cb31c791b ("staging: rtl8723bs: fix protected RX frame validation in decrypt path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8723bs/core/rtw_recv.c | 84 +++++++++++------------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
index 4727f94df4355b..9f9d80e42e4db1 100644
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -316,7 +316,7 @@ static void rtw_handle_tkip_mic_err(struct adapter *padapter, u8 bgroup)
 	} else {
 		cur_time = jiffies;
 
-		if (cur_time - psecuritypriv->last_mic_err_time < 60*HZ) {
+		if (cur_time - psecuritypriv->last_mic_err_time < 60 * HZ) {
 			psecuritypriv->btkip_countermeasure = true;
 			psecuritypriv->last_mic_err_time = 0;
 			psecuritypriv->btkip_countermeasure_time = cur_time;
@@ -384,13 +384,13 @@ static signed int recvframe_chkmic(struct adapter *adapter,  union recv_frame *p
 				mickey = &stainfo->dot11tkiprxmickey.skey[0];
 			}
 
-			datalen = precvframe->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len-prxattrib->icv_len-8;/* icv_len included the mic code */
+			datalen = precvframe->u.hdr.len - prxattrib->hdrlen - prxattrib->iv_len - prxattrib->icv_len - 8;/* icv_len included the mic code */
 			pframe = precvframe->u.hdr.rx_data;
-			payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
+			payload = pframe + prxattrib->hdrlen + prxattrib->iv_len;
 
 			rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0], (unsigned char)prxattrib->priority); /* care the length of the data */
 
-			pframemic = payload+datalen;
+			pframemic = payload + datalen;
 
 			bmic_err = false;
 
@@ -437,9 +437,9 @@ static union recv_frame *decryptor(struct adapter *padapter, union recv_frame *p
 	u32  res = _SUCCESS;
 
 	if (prxattrib->encrypt > 0) {
-		u8 *iv = precv_frame->u.hdr.rx_data+prxattrib->hdrlen;
+		u8 *iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
 
-		prxattrib->key_index = (((iv[3])>>6)&0x3);
+		prxattrib->key_index = (((iv[3]) >> 6) & 0x3);
 
 		if (prxattrib->key_index > WEP_KEYS) {
 			switch (prxattrib->encrypt) {
@@ -561,7 +561,7 @@ static signed int recv_decache(union recv_frame *precv_frame, u8 bretry, struct
 {
 	signed int tid = precv_frame->u.hdr.attrib.priority;
 
-	u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+	u16 seq_ctrl = ((precv_frame->u.hdr.attrib.seq_num & 0xffff) << 4) |
 		(precv_frame->u.hdr.attrib.frag_num & 0xf);
 
 	if (tid > 15)
@@ -625,29 +625,29 @@ static void process_wmmps_data(struct adapter *padapter, union recv_frame *precv
 	if (!psta->qos_option)
 		return;
 
-	if (!(psta->qos_info&0xf))
+	if (!(psta->qos_info & 0xf))
 		return;
 
-	if (psta->state&WIFI_SLEEP_STATE) {
+	if (psta->state & WIFI_SLEEP_STATE) {
 		u8 wmmps_ac = 0;
 
 		switch (pattrib->priority) {
 		case 1:
 		case 2:
-			wmmps_ac = psta->uapsd_bk&BIT(1);
+			wmmps_ac = psta->uapsd_bk & BIT(1);
 			break;
 		case 4:
 		case 5:
-			wmmps_ac = psta->uapsd_vi&BIT(1);
+			wmmps_ac = psta->uapsd_vi & BIT(1);
 			break;
 		case 6:
 		case 7:
-			wmmps_ac = psta->uapsd_vo&BIT(1);
+			wmmps_ac = psta->uapsd_vo & BIT(1);
 			break;
 		case 0:
 		case 3:
 		default:
-			wmmps_ac = psta->uapsd_be&BIT(1);
+			wmmps_ac = psta->uapsd_be & BIT(1);
 			break;
 		}
 
@@ -967,20 +967,20 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
 		switch (pattrib->priority) {
 		case 1:
 		case 2:
-			wmmps_ac = psta->uapsd_bk&BIT(0);
+			wmmps_ac = psta->uapsd_bk & BIT(0);
 			break;
 		case 4:
 		case 5:
-			wmmps_ac = psta->uapsd_vi&BIT(0);
+			wmmps_ac = psta->uapsd_vi & BIT(0);
 			break;
 		case 6:
 		case 7:
-			wmmps_ac = psta->uapsd_vo&BIT(0);
+			wmmps_ac = psta->uapsd_vo & BIT(0);
 			break;
 		case 0:
 		case 3:
 		default:
-			wmmps_ac = psta->uapsd_be&BIT(0);
+			wmmps_ac = psta->uapsd_be & BIT(0);
 			break;
 		}
 
@@ -992,7 +992,7 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
 			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
 		}
 
-		if ((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid))) {
+		if ((psta->state & WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap & BIT(psta->aid))) {
 			struct list_head	*xmitframe_plist, *xmitframe_phead;
 			struct xmit_frame *pxmitframe = NULL;
 			struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -1036,7 +1036,7 @@ static signed int validate_recv_ctrl_frame(struct adapter *padapter, union recv_
 				/* spin_unlock_bh(&psta->sleep_q.lock); */
 				spin_unlock_bh(&pxmitpriv->lock);
 
-				if (pstapriv->tim_bitmap&BIT(psta->aid)) {
+				if (pstapriv->tim_bitmap & BIT(psta->aid)) {
 					if (psta->sleepq_len == 0) {
 						/* issue nulldata with More data bit = 0 to indicate we have no buffered packets */
 						issue_nulldata_in_interrupt(padapter, psta->hwaddr);
@@ -1412,9 +1412,9 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
 				goto validate_80211w_fail;
 			precv_frame = decryptor(adapter, precv_frame);
 			/* save actual management data frame body */
-			memcpy(mgmt_DATA, ptr+pattrib->hdrlen+pattrib->iv_len, data_len);
+			memcpy(mgmt_DATA, ptr + pattrib->hdrlen + pattrib->iv_len, data_len);
 			/* overwrite the iv field */
-			memcpy(ptr+pattrib->hdrlen, mgmt_DATA, data_len);
+			memcpy(ptr + pattrib->hdrlen, mgmt_DATA, data_len);
 			/* remove the iv and icv length */
 			pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
 			kfree(mgmt_DATA);
@@ -1470,7 +1470,7 @@ static signed int validate_recv_frame(struct adapter *adapter, union recv_frame
 	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
 
 	u8 *ptr = precv_frame->u.hdr.rx_data;
-	u8  ver = (unsigned char) (*ptr)&0x3;
+	u8  ver = (unsigned char) (*ptr) & 0x3;
 
 	/* add version chk */
 	if (ver != 0) {
@@ -1508,7 +1508,7 @@ static signed int validate_recv_frame(struct adapter *adapter, union recv_frame
 		retval = _FAIL; /*  only data frame return _SUCCESS */
 		break;
 	case WIFI_DATA_TYPE: /* data */
-		pattrib->qos = (subtype & BIT(7)) ? 1:0;
+		pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
 		retval = validate_recv_data_frame(adapter, precv_frame);
 		if (retval == _FAIL) {
 			struct recv_priv *precvpriv = &adapter->recvpriv;
@@ -1553,8 +1553,8 @@ static signed int wlanhdr_to_ethhdr(union recv_frame *precvframe)
 	if (pattrib->encrypt)
 		recvframe_pull_tail(precvframe, pattrib->icv_len);
 
-	psnap = (struct ieee80211_snap_hdr	*)(ptr+pattrib->hdrlen + pattrib->iv_len);
-	psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	psnap = (struct ieee80211_snap_hdr	*)(ptr + pattrib->hdrlen + pattrib->iv_len);
+	psnap_type = ptr + pattrib->hdrlen + pattrib->iv_len + SNAP_SIZE;
 	/* convert hdr + possible LLC headers into Ethernet header */
 	/* eth_type = (psnap_type[0] << 8) | psnap_type[1]; */
 	if ((!memcmp(psnap, rfc1042_header, SNAP_SIZE) &&
@@ -1568,37 +1568,37 @@ static signed int wlanhdr_to_ethhdr(union recv_frame *precvframe)
 		/* Leave Ethernet header part of hdr and full payload */
 		bsnaphdr = false;
 
-	rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr?SNAP_SIZE:0);
+	rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
 	len = precvframe->u.hdr.len - rmv_len;
 
-	memcpy(&be_tmp, ptr+rmv_len, 2);
+	memcpy(&be_tmp, ptr + rmv_len, 2);
 	eth_type = ntohs(be_tmp); /* pattrib->ether_type */
 	pattrib->eth_type = eth_type;
 
 	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == true)) {
 		ptr += rmv_len;
 		*ptr = 0x87;
-		*(ptr+1) = 0x12;
+		*(ptr + 1) = 0x12;
 
 		eth_type = 0x8712;
 		/*  append rx status for mp test packets */
-		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+		ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24);
 		if (!ptr)
 			return _FAIL;
 		memcpy(ptr, get_rxmem(precvframe), 24);
 		ptr += 24;
 	} else {
-		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr?2:0)));
+		ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
 		if (!ptr)
 			return _FAIL;
 	}
 
 	memcpy(ptr, pattrib->dst, ETH_ALEN);
-	memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+	memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN);
 
 	if (!bsnaphdr) {
 		be_tmp = htons(len);
-		memcpy(ptr+12, &be_tmp, 2);
+		memcpy(ptr + 12, &be_tmp, 2);
 	}
 
 	return _SUCCESS;
@@ -1736,7 +1736,7 @@ static int amsdu_to_msdu(struct adapter *padapter, union recv_frame *prframe)
 		pdata += nSubframe_Length;
 		a_len -= nSubframe_Length;
 		if (a_len != 0) {
-			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
+			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4 - 1));
 			if (padding_len == 4)
 				padding_len = 0;
 
@@ -2002,7 +2002,7 @@ static int recv_indicatepkt_reorder(struct adapter *padapter, union recv_frame *
 
 			rtw_recv_indicatepkt(padapter, prframe);
 
-			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) % 4096;
 
 			return _SUCCESS;
 		}
@@ -2012,7 +2012,7 @@ static int recv_indicatepkt_reorder(struct adapter *padapter, union recv_frame *
 
 			retval = amsdu_to_msdu(padapter, prframe);
 
-			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) % 4096;
 
 			if (retval != _SUCCESS) {
 			}
@@ -2201,7 +2201,7 @@ static int recv_func(struct adapter *padapter, union recv_frame *rframe)
 			!psecuritypriv->busetkipkey) {
 			rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
 
-			if (recvpriv->free_recvframe_cnt < NR_RECVFRAME/4) {
+			if (recvpriv->free_recvframe_cnt < NR_RECVFRAME / 4) {
 				/* to prevent from recvframe starvation, get recvframe from uc_swdec_pending_queue to free_recvframe_cnt  */
 				rframe = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue);
 				if (rframe)
@@ -2289,19 +2289,19 @@ static void rtw_signal_stat_timer_hdl(struct timer_list *t)
 		}
 
 		/* update value of signal_strength, rssi, signal_qual */
-		tmp_s = (avg_signal_strength+(_alpha-1)*recvpriv->signal_strength);
+		tmp_s = (avg_signal_strength + (_alpha - 1) * recvpriv->signal_strength);
 		if (tmp_s % _alpha)
-			tmp_s = tmp_s/_alpha + 1;
+			tmp_s = tmp_s / _alpha + 1;
 		else
-			tmp_s = tmp_s/_alpha;
+			tmp_s = tmp_s / _alpha;
 		if (tmp_s > 100)
 			tmp_s = 100;
 
-		tmp_q = (avg_signal_qual+(_alpha-1)*recvpriv->signal_qual);
+		tmp_q = (avg_signal_qual + (_alpha - 1) * recvpriv->signal_qual);
 		if (tmp_q % _alpha)
-			tmp_q = tmp_q/_alpha + 1;
+			tmp_q = tmp_q / _alpha + 1;
 		else
-			tmp_q = tmp_q/_alpha;
+			tmp_q = tmp_q / _alpha;
 		if (tmp_q > 100)
 			tmp_q = 100;
 

From 33e8f5740319996788395d85a4c100f61593cb75 Mon Sep 17 00:00:00 2001
From: Tianchu Chen <flynnnchen@tencent.com>
Date: Wed, 4 Nov 2026 18:46:27 -0500
Subject: [PATCH 1014/1982] staging: rtl8723bs: fix protected RX frame
 validation in decrypt path

[ Upstream commit 495cb31c791bdf3f9efef255a9587b05b0526c9d ]

The RX software decrypt path mishandles crafted protected frames from a
malicious AP in two ways:

1) decryptor() never checks that a protected frame is long enough to
hold the 802.11 header plus the per-cipher trailer.  All of
rtw_wep_decrypt(), rtw_tkip_decrypt() and rtw_aes_decrypt() compute

	length = hdr.len - hdrlen - iv_len;

and act on the result, and recvframe_chkmic() similarly computes

	datalen = hdr.len - hdrlen - iv_len - icv_len - 8;

for TKIP (the 8-byte Michael MIC is not accounted for in icv_len).
A frame shorter than hdrlen + iv_len + icv_len (+ 8 for TKIP) underflows
these unsigned subtractions, turning into a ~4 GiB iteration count in
aes_decipher()/arc4_crypt()/rtw_seccalctkipmic() or a ~4 GiB crc32_le()
length, causing out-of-bounds reads/writes of up to ~4 GiB starting from
the rx skb.  Reject such frames in decryptor() before touching the IV;
this covers all three ciphers and the TKIP MIC check, and also keeps the
unconditional iv[3] access within the frame.

2) validate_80211w_mgmt() keeps using the frame - two memcpys through
the stale rx_data pointer and a pkt_len update - before checking
whether decryptor() returned NULL.  On decrypt failure (e.g. a unicast
protected deauth/disassoc/action frame with a bad MIC, which this path
always software-decrypts) the skb has already been freed, so this is a
use-after-free read/write, and the caller's error path frees the frame
a second time, drifting free_recvframe_cnt.  Bail out immediately when
decryptor() fails, freeing the temporary mgmt_DATA buffer first.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8ee3bdd1c45034200cb1aa9a7e9b575b9584643a@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8723bs/core/rtw_recv.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
index 9f9d80e42e4db1..f8ade0bea1da0e 100644
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -437,8 +437,21 @@ static union recv_frame *decryptor(struct adapter *padapter, union recv_frame *p
 	u32  res = _SUCCESS;
 
 	if (prxattrib->encrypt > 0) {
-		u8 *iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
+		u8 *iv;
+		u32 min_len = prxattrib->hdrlen + prxattrib->iv_len + prxattrib->icv_len;
 
+		/* TKIP appends an 8-byte Michael MIC that icv_len doesn't account for */
+		if (prxattrib->encrypt == _TKIP_)
+			min_len += 8;
+
+		/* a protected frame must be long enough to hold the IV and ICV/MIC */
+		if (precv_frame->u.hdr.len < min_len) {
+			rtw_free_recvframe(precv_frame,
+					   &padapter->recvpriv.free_recv_queue);
+			return NULL;
+		}
+
+		iv = precv_frame->u.hdr.rx_data + prxattrib->hdrlen;
 		prxattrib->key_index = (((iv[3]) >> 6) & 0x3);
 
 		if (prxattrib->key_index > WEP_KEYS) {
@@ -1411,6 +1424,10 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
 			if (!mgmt_DATA)
 				goto validate_80211w_fail;
 			precv_frame = decryptor(adapter, precv_frame);
+			if (!precv_frame) {
+				kfree(mgmt_DATA);
+				goto validate_80211w_fail;
+			}
 			/* save actual management data frame body */
 			memcpy(mgmt_DATA, ptr + pattrib->hdrlen + pattrib->iv_len, data_len);
 			/* overwrite the iv field */
@@ -1418,8 +1435,6 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame
 			/* remove the iv and icv length */
 			pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
 			kfree(mgmt_DATA);
-			if (!precv_frame)
-				goto validate_80211w_fail;
 		} else if (is_multicast_ether_addr(GetAddr1Ptr(ptr)) &&
 			(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC)) {
 			signed int BIP_ret = _SUCCESS;

From 6cc288d84ef286e2ff80e80948f72ff1ddf4f131 Mon Sep 17 00:00:00 2001
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: Wed, 4 Nov 2026 18:46:54 -0500
Subject: [PATCH 1015/1982] tcp: Remove timeout arg from reqsk_timeout().

[ Upstream commit 207ce0f6bc131812c96cf4f6db328af5396cebac ]

reqsk_timeout() is always called with @timeout being TCP_RTO_MAX.

Let's remove the arg.

As a prep for the next patch, reqsk_timeout() is moved to tcp.h
and renamed to tcp_reqsk_timeout().

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251106003357.273403-5-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: c9c90cf437a9 ("mptcp: hold MP_JOIN msk ref when cloning reqsk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/inet_connection_sock.h | 8 --------
 include/net/tcp.h                  | 7 +++++++
 net/ipv4/inet_connection_sock.c    | 2 +-
 net/ipv4/tcp_minisocks.c           | 5 +++--
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index d50e0afc3193f8..39ccb785dd4c18 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -297,14 +297,6 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
 bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
 void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req);
 
-static inline unsigned long
-reqsk_timeout(struct request_sock *req, unsigned long max_timeout)
-{
-	u64 timeout = (u64)req->timeout << req->num_timeout;
-
-	return (unsigned long)min_t(u64, timeout, max_timeout);
-}
-
 void inet_csk_destroy_sock(struct sock *sk);
 void inet_csk_prepare_for_destroy_sock(struct sock *sk);
 void inet_csk_prepare_forced_close(struct sock *sk);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e40bad56064861..f9bcfa8773a3aa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -838,6 +838,13 @@ static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
 	return usecs_to_jiffies((tp->srtt_us >> 3) + tp->rttvar_us);
 }
 
+static inline unsigned long tcp_reqsk_timeout(struct request_sock *req)
+{
+	u64 timeout = (u64)req->timeout << req->num_timeout;
+
+	return (unsigned long)min_t(u64, timeout, TCP_RTO_MAX);
+}
+
 u32 tcp_delack_max(const struct sock *sk);
 
 /* Compute the actual rto_min value */
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 3e9eaf9d341d1e..9a87ea6c63b463 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1128,7 +1128,7 @@ static void reqsk_timer_handler(struct timer_list *t)
 	     inet_rsk(req)->acked)) {
 		if (req->num_timeout++ == 0)
 			atomic_dec(&queue->young);
-		mod_timer(&req->rsk_timer, jiffies + reqsk_timeout(req, TCP_RTO_MAX));
+		mod_timer(&req->rsk_timer, jiffies + tcp_reqsk_timeout(req));
 
 		if (!nreq)
 			return;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d05009f985afcc..2d78801866396c 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -717,7 +717,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 			 * it can be estimated (approximately)
 			 * from another data.
 			 */
-			tmp_opt.ts_recent_stamp = ktime_get_seconds() - reqsk_timeout(req, TCP_RTO_MAX) / HZ;
+			tmp_opt.ts_recent_stamp = ktime_get_seconds() -
+				tcp_reqsk_timeout(req) / HZ;
 			paws_reject = tcp_paws_reject(&tmp_opt, th->rst);
 		}
 	}
@@ -756,7 +757,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 		    !tcp_rtx_synack(sk, req)) {
 			unsigned long expires = jiffies;
 
-			expires += reqsk_timeout(req, TCP_RTO_MAX);
+			expires += tcp_reqsk_timeout(req);
 			if (!fastopen)
 				mod_timer_pending(&req->rsk_timer, expires);
 			else

From fb3f7101fec5ce9de523d8227811625a2e8ab9f8 Mon Sep 17 00:00:00 2001
From: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
Date: Wed, 4 Nov 2026 18:46:55 -0500
Subject: [PATCH 1016/1982] tcp: accecn: unset ECT if receive or send ACE=0 in
 AccECN negotiaion

[ Upstream commit 4024081feb87fb11ac7bd36d8c397ccdd81ed302 ]

Based on specification:
  https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt

Based on Section 3.1.5 of AccECN spec (RFC9768), a TCP Server in
AccECN mode MUST NOT set ECT on any packet for the rest of the connection,
if it has received or sent at least one valid SYN or Acceptable SYN/ACK
with (AE,CWR,ECE) = (0,0,0) during the handshake.

In addition, a host in AccECN mode that is feeding back the IP-ECN
field on a SYN or SYN/ACK MUST feed back the IP-ECN field on the
latest valid SYN or acceptable SYN/ACK to arrive.

Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260131222515.8485-11-chia-yu.chang@nokia-bell-labs.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: c9c90cf437a9 ("mptcp: hold MP_JOIN msk ref when cloning reqsk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/inet_connection_sock.c |  3 +++
 net/ipv4/tcp_input.c            |  2 ++
 net/ipv4/tcp_minisocks.c        | 36 ++++++++++++++++++++++++---------
 net/ipv4/tcp_output.c           |  5 ++++-
 net/ipv4/tcp_timer.c            |  3 +++
 5 files changed, 38 insertions(+), 11 deletions(-)

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 9a87ea6c63b463..15ad4414cbdb9f 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -20,6 +20,7 @@
 #include <net/tcp_states.h>
 #include <net/xfrm.h>
 #include <net/tcp.h>
+#include <net/tcp_ecn.h>
 #include <net/sock_reuseport.h>
 #include <net/addrconf.h>
 
@@ -1126,6 +1127,8 @@ static void reqsk_timer_handler(struct timer_list *t)
 	    (!resend ||
 	     !tcp_rtx_synack(sk_listener, req) ||
 	     inet_rsk(req)->acked)) {
+		if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+			tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
 		if (req->num_timeout++ == 0)
 			atomic_dec(&queue->young);
 		mod_timer(&req->rsk_timer, jiffies + tcp_reqsk_timeout(req));
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6a2c05dff42152..28db1353445bf9 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6236,6 +6236,8 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
 	if (th->syn) {
 		if (tcp_ecn_mode_accecn(tp)) {
 			accecn_reflector = true;
+			tp->syn_ect_rcv = TCP_SKB_CB(skb)->ip_dsfield &
+					  INET_ECN_MASK;
 			if (tp->rx_opt.accecn &&
 			    tp->saw_accecn_opt < TCP_ACCECN_OPT_COUNTER_SEEN) {
 				u8 saw_opt = tcp_accecn_option_init(skb, tp->rx_opt.accecn);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 2d78801866396c..ebcd78ad13efaf 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -484,6 +484,10 @@ static void tcp_ecn_openreq_child(struct sock *sk,
 		tp->syn_ect_snt = treq->syn_ect_snt;
 		tcp_accecn_third_ack(sk, skb, treq->syn_ect_snt);
 		tp->saw_accecn_opt = treq->saw_accecn_opt;
+		if (treq->accecn_fail_mode & TCP_ACCECN_ACE_FAIL_SEND)
+			tcp_accecn_fail_mode_set(tp, TCP_ACCECN_ACE_FAIL_SEND);
+		if (treq->accecn_fail_mode & TCP_ACCECN_ACE_FAIL_RECV)
+			tcp_accecn_fail_mode_set(tp, TCP_ACCECN_ACE_FAIL_RECV);
 		tp->prev_ecnfield = treq->syn_ect_rcv;
 		tp->accecn_opt_demand = 1;
 		tcp_ecn_received_counters_payload(sk, skb);
@@ -752,16 +756,28 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 		 */
 		if (!tcp_oow_rate_limited(sock_net(sk), skb,
 					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,
-					  &tcp_rsk(req)->last_oow_ack_time) &&
-
-		    !tcp_rtx_synack(sk, req)) {
-			unsigned long expires = jiffies;
-
-			expires += tcp_reqsk_timeout(req);
-			if (!fastopen)
-				mod_timer_pending(&req->rsk_timer, expires);
-			else
-				req->rsk_timer.expires = expires;
+					  &tcp_rsk(req)->last_oow_ack_time)) {
+			if (tcp_rsk(req)->accecn_ok) {
+				u8 ect_rcv = TCP_SKB_CB(skb)->ip_dsfield &
+					     INET_ECN_MASK;
+
+				tcp_rsk(req)->syn_ect_rcv = ect_rcv;
+				if (tcp_accecn_ace(tcp_hdr(skb)) == 0x0)
+					tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_RECV;
+			}
+			if (!tcp_rtx_synack(sk, req)) {
+				unsigned long expires = jiffies;
+
+				if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+					tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
+
+				expires += tcp_reqsk_timeout(req);
+				if (!fastopen)
+					mod_timer_pending(&req->rsk_timer,
+							  expires);
+				else
+					req->rsk_timer.expires = expires;
+			}
 		}
 		return NULL;
 	}
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ddcc7e53f2e34f..f6210d4a3408ff 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -333,8 +333,11 @@ static void tcp_ecn_send(struct sock *sk, struct sk_buff *skb,
 		return;
 
 	if (tcp_ecn_mode_accecn(tp)) {
-		if (!tcp_accecn_ace_fail_recv(tp))
+		if (!tcp_accecn_ace_fail_recv(tp) &&
+		    !tcp_accecn_ace_fail_send(tp))
 			INET_ECN_xmit(sk);
+		else
+			INET_ECN_dontxmit(sk);
 		tcp_accecn_set_ace(tp, skb, th);
 		skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ACCECN;
 	} else {
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index eb549fea8fdd94..017a52022a1a2e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <net/tcp.h>
+#include <net/tcp_ecn.h>
 #include <net/rstreason.h>
 
 static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
@@ -482,6 +483,8 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
 	 * it's not good to give up too easily.
 	 */
 	tcp_rtx_synack(sk, req);
+	if (req->num_retrans > 1 && tcp_rsk(req)->accecn_ok)
+		tcp_rsk(req)->accecn_fail_mode |= TCP_ACCECN_ACE_FAIL_SEND;
 	req->num_timeout++;
 	tcp_update_rto_stats(sk);
 	if (!tp->retrans_stamp)

From c290f8641e41c535c8201e40d6c903f40c6d6e94 Mon Sep 17 00:00:00 2001
From: Ruide Cao <caoruide123@gmail.com>
Date: Wed, 4 Nov 2026 18:46:56 -0500
Subject: [PATCH 1017/1982] mptcp: hold MP_JOIN msk ref when cloning reqsk

[ Upstream commit c9c90cf437a9e6597611b6d3aad6e255fad22867 ]

TCP request migration clones pending request sockets with
inet_reqsk_clone().  For MPTCP MP_JOIN requests this byte-copies
subflow_req->msk, but the clone does not own a reference.

The original and cloned requests can consequently drop the same msk
reference, leaving one request with a dangling pointer.  This manifests as
a KASAN slab-use-after-free in subflow_req_destructor():

  BUG: KASAN: slab-use-after-free in subflow_req_destructor (net/mptcp/subflow.c:45)
  Write of size 4 at addr ff1100010e008d40 by task swapper/0/0
  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full)

  Call Trace:
   subflow_req_destructor (net/mptcp/subflow.c:45)
   subflow_v4_req_destructor (net/mptcp/subflow.c:694)
   __reqsk_free (net/ipv4/inet_connection_sock.c:906)
   reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147)

  Allocated by task 10014:
   sk_prot_alloc (net/core/sock.c:2246)
   sk_clone (net/core/sock.c:2488)
   mptcp_sk_clone_init (include/net/sock.h:1848 net/mptcp/protocol.c:3564)
   subflow_syn_recv_sock (net/mptcp/subflow.c:883)
   tcp_check_req (net/ipv4/tcp_minisocks.c:934)

  Freed by task 0:
   slab_free_after_rcu_debug (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6439)
   rcu_core (kernel/rcu/tree.c:2645 kernel/rcu/tree.c:2897)

  Last potentially related work creation:
   kmem_cache_free (mm/slub.c:2638 mm/slub.c:6377 mm/slub.c:6504)
   __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
   sk_destruct (net/core/sock.c:2419)
   __sk_free (net/core/sock.c:2430)
   sk_free (net/core/sock.c:2441)
   mptcp_close (include/net/sock.h:2020 net/mptcp/protocol.c:3399)
   inet_release (net/ipv4/af_inet.c:442)

  The buggy address belongs to the cache MPTCP of size 2968
  The buggy address is 128 bytes inside a freed 2968-byte region

A non-NULL subflow_req->msk means that the request owns one reference. The
third ACK can concurrently transfer the original request reference to the
child and release it, so taking an unconditional hold on the copied pointer
is unsafe.

MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all current inet_reqsk_clone()
callers run in an RCU read-side critical section. Document and
lockdep-check that calling-context requirement.  Read the pointer from the
original request and acquire a reference only if it is still live.  Use
refcount_inc_not_zero_acquire() so the subsequent ownership validation
cannot be reordered before the try-get, then re-read the original request
to verify that it still owns the same msk. If either check fails, clear the
clone pointer; otherwise its normal destructor balances the new reference.
Mark the ownership-transfer store with WRITE_ONCE() to match the lockless
reads.

The following patch completes the clone fixup for MP_CAPABLE token
ownership. Both patches carry the same Fixes tag and are required for
stable backports.

Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Reported-by: David Lee <david.lee@trailofbits.com>
Reported-by: Vega <vega@nebusec.ai>
Closes: https://lore.kernel.org/all/20260804095051.715355-1-david.lee@trailofbits.com/
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-3-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/mptcp.h             |  9 +++++++++
 net/ipv4/inet_connection_sock.c |  4 ++++
 net/mptcp/subflow.c             | 35 ++++++++++++++++++++++++++++++++-
 3 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/include/net/mptcp.h b/include/net/mptcp.h
index f7263fe2a2e40b..a296f711e92f3f 100644
--- a/include/net/mptcp.h
+++ b/include/net/mptcp.h
@@ -219,6 +219,9 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
 struct request_sock *mptcp_subflow_reqsk_alloc(const struct request_sock_ops *ops,
 					       struct sock *sk_listener,
 					       bool attach_listener);
+/* Caller must hold an RCU read-side lock. */
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+			       struct request_sock *new_req);
 
 __be32 mptcp_get_reset_option(const struct sk_buff *skb);
 
@@ -314,6 +317,12 @@ static inline struct request_sock *mptcp_subflow_reqsk_alloc(const struct reques
 	return NULL;
 }
 
+/* Caller must hold an RCU read-side lock. */
+static inline void mptcp_subflow_reqsk_clone(struct request_sock *req,
+					     struct request_sock *new_req)
+{
+}
+
 static inline __be32 mptcp_reset_option(const struct sk_buff *skb)  { return htonl(0u); }
 
 static inline void mptcp_active_detect_blackhole(struct sock *sk, bool expired) { }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 15ad4414cbdb9f..dd14944ad3edd0 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -21,6 +21,7 @@
 #include <net/xfrm.h>
 #include <net/tcp.h>
 #include <net/tcp_ecn.h>
+#include <net/mptcp.h>
 #include <net/sock_reuseport.h>
 #include <net/addrconf.h>
 
@@ -983,6 +984,9 @@ static struct request_sock *inet_reqsk_clone(struct request_sock *req,
 		rcu_assign_pointer(tcp_sk(nreq->sk)->fastopen_rsk, nreq);
 	}
 
+	if (rsk_is_mptcp(req))
+		mptcp_subflow_reqsk_clone(req, nreq);
+
 	return nreq;
 }
 
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 1932fcf9f92528..e020960f093e05 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -47,6 +47,39 @@ static void subflow_req_destructor(struct request_sock *req)
 	mptcp_token_destroy_request(req);
 }
 
+void mptcp_subflow_reqsk_clone(struct request_sock *req,
+			       struct request_sock *new_req)
+{
+	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
+	struct mptcp_subflow_request_sock *new_subflow_req;
+	struct mptcp_sock *msk;
+
+	new_subflow_req = mptcp_subflow_rsk(new_req);
+	RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(),
+			 "MPTCP reqsk clone called without RCU");
+
+	/* A non-NULL ->msk means the request owns one reference.  The clone
+	 * copied only the pointer, while the original request can concurrently
+	 * transfer its reference to the child.  Acquire a reference for the
+	 * clone, then verify that the original request still owns the same msk.
+	 * MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all clone callers run in
+	 * an RCU read-side critical section, keeping the memory stable here.
+	 */
+	msk = READ_ONCE(subflow_req->msk);
+	if (msk) {
+		struct sock *sk = (struct sock *)msk;
+
+		if (!refcount_inc_not_zero_acquire(&sk->sk_refcnt)) {
+			msk = NULL;
+		} else if (READ_ONCE(subflow_req->msk) != msk) {
+			sock_put(sk);
+			msk = NULL;
+		}
+	}
+
+	new_subflow_req->msk = msk;
+}
+
 static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
 				  void *hmac)
 {
@@ -925,7 +958,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
 			}
 
 			/* move the msk reference ownership to the subflow */
-			subflow_req->msk = NULL;
+			WRITE_ONCE(subflow_req->msk, NULL);
 			ctx->conn = (struct sock *)owner;
 
 			if (subflow_use_different_sport(owner, sk)) {

From c05c367e7a99521cd654b56042757979968b5644 Mon Sep 17 00:00:00 2001
From: Weiming Shi <bestswngs@gmail.com>
Date: Wed, 4 Nov 2026 19:16:18 -0500
Subject: [PATCH 1018/1982] virtio_net: atomically disable rx mode work

[ Upstream commit 1234707482053f1d1ac7c5756207d2c29057974c ]

virtio-net uses a boolean to gate rx_mode_work during device teardown.
The flag is changed under RTNL, but ndo_set_rx_mode checks it under the
address-list lock. A callback can therefore pass the check and enqueue work
after teardown has flushed it. The work is also enabled before late
probe operations that can fail, allowing probe unwind to free the netdev
with work still queued.

KASAN reports the worker using a virtqueue that probe unwind already freed:

  BUG: KASAN: slab-use-after-free in virtqueue_add_split
  Workqueue: events virtnet_rx_mode_work
  Call Trace:
   virtqueue_add_split (drivers/virtio/virtio_ring.c:706)
   virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2839)
   virtnet_send_command_reply (drivers/net/virtio_net.c:3565)
   virtnet_rx_mode_work (drivers/net/virtio_net.c:3833)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3405)
  Freed by task 119:
   kfree (mm/slub.c:6625)
   vp_del_vq.isra.0 (drivers/virtio/virtio_pci_common.c:259)
   vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)
   virtnet_probe (drivers/net/virtio_net.c:7129)

Use the workqueue disable mechanism to atomically reject new queue attempts
and drain running work. Keep work disabled until probe succeeds or restore
has reattached the netdev, then enable it and replay receive-mode state for
a running interface. Disable it before resource teardown in freeze and
remove.

Fixes: b9f7425239a0 ("virtio-net: convert rx mode setting to use workqueue")
Cc: stable@vger.kernel.org
Reported-by: <co+d17c2bc750a9cbbb@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20261017114237.2786302-2-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ sashal: Adjusted context to preserve existing refill handling and restore error paths. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/virtio_net.c | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b7ab57f4e277a4..34390befdf8a89 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -458,9 +458,6 @@ struct virtnet_info {
 	/* Work struct for setting rx mode */
 	struct work_struct rx_mode_work;
 
-	/* OK to queue work setting RX mode? */
-	bool rx_mode_work_enabled;
-
 	/* Does the affinity hint is set for virtqueues? */
 	bool affinity_hint_set;
 
@@ -740,16 +737,13 @@ static void disable_delayed_refill(struct virtnet_info *vi)
 
 static void enable_rx_mode_work(struct virtnet_info *vi)
 {
-	rtnl_lock();
-	vi->rx_mode_work_enabled = true;
-	rtnl_unlock();
+	if (enable_work(&vi->rx_mode_work) && netif_running(vi->dev))
+		schedule_work(&vi->rx_mode_work);
 }
 
 static void disable_rx_mode_work(struct virtnet_info *vi)
 {
-	rtnl_lock();
-	vi->rx_mode_work_enabled = false;
-	rtnl_unlock();
+	disable_work_sync(&vi->rx_mode_work);
 }
 
 static void virtqueue_napi_schedule(struct napi_struct *napi,
@@ -3996,8 +3990,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
 
-	if (vi->rx_mode_work_enabled)
-		schedule_work(&vi->rx_mode_work);
+	schedule_work(&vi->rx_mode_work);
 }
 
 static int virtnet_vlan_rx_add_vid(struct net_device *dev,
@@ -5813,7 +5806,6 @@ static void virtnet_freeze_down(struct virtio_device *vdev)
 	/* Make sure no work handler is accessing the device */
 	flush_work(&vi->config_work);
 	disable_rx_mode_work(vi);
-	flush_work(&vi->rx_mode_work);
 
 	if (netif_running(vi->dev)) {
 		rtnl_lock();
@@ -5840,7 +5832,6 @@ static int virtnet_restore_up(struct virtio_device *vdev)
 	virtio_device_ready(vdev);
 
 	enable_delayed_refill(vi);
-	enable_rx_mode_work(vi);
 
 	if (netif_running(vi->dev)) {
 		rtnl_lock();
@@ -5853,6 +5844,8 @@ static int virtnet_restore_up(struct virtio_device *vdev)
 	netif_tx_lock_bh(vi->dev);
 	netif_device_attach(vi->dev);
 	netif_tx_unlock_bh(vi->dev);
+
+	enable_rx_mode_work(vi);
 	return err;
 }
 
@@ -6952,6 +6945,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 
 	INIT_WORK(&vi->config_work, virtnet_config_changed_work);
 	INIT_WORK(&vi->rx_mode_work, virtnet_rx_mode_work);
+	disable_work(&vi->rx_mode_work);
 	spin_lock_init(&vi->refill_lock);
 
 	if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) {
@@ -7103,8 +7097,6 @@ static int virtnet_probe(struct virtio_device *vdev)
 	if (vi->has_rss || vi->has_rss_hash_report)
 		virtnet_init_default_rss(vi);
 
-	enable_rx_mode_work(vi);
-
 	/* serialize netdev register + virtio_device_ready() with ndo_open() */
 	rtnl_lock();
 
@@ -7204,6 +7196,8 @@ static int virtnet_probe(struct virtio_device *vdev)
 		goto free_unregister_netdev;
 	}
 
+	enable_rx_mode_work(vi);
+
 	pr_debug("virtnet: registered device %s with %d RX and TX vq's\n",
 		 dev->name, max_queue_pairs);
 
@@ -7255,7 +7249,6 @@ static void virtnet_remove(struct virtio_device *vdev)
 	/* Make sure no work handler is accessing the device. */
 	flush_work(&vi->config_work);
 	disable_rx_mode_work(vi);
-	flush_work(&vi->rx_mode_work);
 
 	virtnet_free_irq_moder(vi);
 

From a7ba1a5a0c16d3aad161681b01933703419fd52d Mon Sep 17 00:00:00 2001
From: Danish Khateeb <danishkhateeb03@gmail.com>
Date: Wed, 4 Nov 2026 19:38:10 -0500
Subject: [PATCH 1019/1982] pps: generators: don't use the driver's info after
 unregister

[ Upstream commit 4e8063cae337cb7328e6856235cf4de5d165516e ]

A file that was opened before pps_gen_unregister_source() keeps
pps_gen, and with it the pointer to the driver's pps_gen_source_info.
PPS_GEN_SETENABLE and PPS_GEN_USESYSTEMCLOCK keep using that pointer
after the driver has gone:

 - pps_gen_tio allocates its info with devm_kzalloc(), so after an
   unbind both ioctls read freed memory, and SETENABLE calls the
   driver's enable() with its freed private data.

 - pps_gen-dummy does not set info->owner, so it can be unloaded while
   the file is open, and the ioctls then read the unloaded module's
   data and call its code.

TIO can't probe in a VM, as it needs ART. A test driver that registers
its info in devm memory like TIO does, unbound while /dev/pps-gen0 is
open, gives:

  BUG: KASAN: slab-use-after-free in pps_gen_cdev_ioctl+0x4c1/0x580
  Read of size 1 at addr ffff88800e647f38 by task ppsgen64/145
  ...
  Freed by task 146:
   kfree+0x25a/0x6d0
   release_nodes+0xd1/0x140
   devres_release_all+0x10e/0x1a0
   device_unbind_cleanup+0x71/0x250
   device_release_driver_internal+0x41b/0x570
   unbind_store+0xd9/0x100

and unloading pps_gen-dummy while its file is open oopses:

  BUG: unable to handle page fault for address: ffffffffa0203040
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:pps_gen_cdev_ioctl+0x372/0x580

Protect info in the ioctl handler with a mutex, and clear it under the
mutex on unregister, so that unregister waits for the ioctls using it
and later ones fail with -ENODEV. PPS_KC_BIND does the same for a
removed PPS device since commit 3649f9a6b897 ("pps: don't allow
PPS_KC_BIND on removed devices"). The sysfs attributes need nothing
new: they are removed, and their callbacks drained, before info is
cleared.

Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-3-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pps/generators/pps_gen.c | 31 ++++++++++++++++++++++++++-----
 include/linux/pps_gen_kernel.h   |  2 ++
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index 69a470fa164d69..630a8804d63e7e 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -69,17 +69,28 @@ static long pps_gen_cdev_ioctl(struct file *file,
 		if (ret)
 			return -EFAULT;
 
-		ret = pps_gen->info->enable(pps_gen, status);
-		if (ret)
-			return ret;
-		pps_gen->enabled = status;
+		scoped_guard(mutex, &pps_gen->info_lock) {
+			if (!pps_gen->info)
+				return -ENODEV;
+
+			ret = pps_gen->info->enable(pps_gen, status);
+			if (ret)
+				return ret;
+			pps_gen->enabled = status;
+		}
 
 		break;
 
 	case PPS_GEN_USESYSTEMCLOCK:
 		dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n");
 
-		ret = put_user(pps_gen->info->use_system_clock, uiuarg);
+		scoped_guard(mutex, &pps_gen->info_lock) {
+			if (!pps_gen->info)
+				return -ENODEV;
+			status = pps_gen->info->use_system_clock;
+		}
+
+		ret = put_user(status, uiuarg);
 		if (ret)
 			return -EFAULT;
 
@@ -212,6 +223,15 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
 {
 	pr_debug("unregistering pps-gen%d\n", pps_gen->id);
 	cdev_device_del(&pps_gen->cdev, &pps_gen->dev);
+
+	/*
+	 * An open file keeps pps_gen around, but the driver may free info as
+	 * soon as we return. The sysfs files are gone now, so wait for the
+	 * ioctls using info and make later ones fail.
+	 */
+	scoped_guard(mutex, &pps_gen->info_lock)
+		pps_gen->info = NULL;
+
 	put_device(&pps_gen->dev);
 }
 
@@ -243,6 +263,7 @@ struct pps_gen_device *pps_gen_register_source(const struct pps_gen_source_info
 	pps_gen->info = info;
 	pps_gen->enabled = false;
 
+	mutex_init(&pps_gen->info_lock);
 	init_waitqueue_head(&pps_gen->queue);
 	spin_lock_init(&pps_gen->lock);
 
diff --git a/include/linux/pps_gen_kernel.h b/include/linux/pps_gen_kernel.h
index f26f6aac000dcc..c4d22b1af11865 100644
--- a/include/linux/pps_gen_kernel.h
+++ b/include/linux/pps_gen_kernel.h
@@ -11,6 +11,7 @@
 #include <linux/pps_gen.h>
 #include <linux/cdev.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 
 /*
  * Global defines
@@ -44,6 +45,7 @@ struct pps_gen_source_info {
 /* The main struct */
 struct pps_gen_device {
 	const struct pps_gen_source_info *info;	/* PSS generator info */
+	struct mutex info_lock;			/* protects info */
 	bool enabled;				/* PSS generator status */
 
 	unsigned int event;

From 10dc8299d1ff5bcf3523ebb324145fb776563f36 Mon Sep 17 00:00:00 2001
From: Marco Crivellari <marco.crivellari@suse.com>
Date: Wed, 4 Nov 2026 19:53:59 -0500
Subject: [PATCH 1020/1982] nvmet: replace use of system_wq with
 system_percpu_wq

[ Upstream commit 3d553be6d295b6cca8fd35cb673fd13934ac4cbc ]

This patch continues the effort to refactor workqueue APIs, which has begun
with the changes introducing new workqueues and a new alloc_workqueue flag:

   commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
   commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")

The point of the refactoring is to eventually alter the default behavior of
workqueues to become unbound by default so that their workload placement is
optimized by the scheduler.

Before that to happen, workqueue users must be converted to the better named
new workqueues with no intended behaviour changes:

   system_wq -> system_percpu_wq
   system_unbound_wq -> system_dfl_wq

This way the old obsolete workqueues (system_wq, system_unbound_wq) can be
removed in the future.

Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
Suggested-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 53f6efe00cea ("nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/admin-cmd.c        | 2 +-
 drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index fa9920787a8fff..623b5303de2aaf 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -1606,7 +1606,7 @@ void nvmet_execute_keep_alive(struct nvmet_req *req)
 
 	pr_debug("ctrl %d update keep-alive timer for %d secs\n",
 		ctrl->cntlid, ctrl->kato);
-	mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+	mod_delayed_work(system_percpu_wq, &ctrl->ka_work, ctrl->kato * HZ);
 out:
 	nvmet_req_complete(req, status);
 }
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 5b010318286e46..af712c6624b36c 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -410,7 +410,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 	    req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
 		unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
 
-		mod_delayed_work(system_wq, &req->sq->auth_expired_work,
+		mod_delayed_work(system_percpu_wq, &req->sq->auth_expired_work,
 				 auth_expire_secs * HZ);
 		goto complete;
 	}

From edb4f7bcffdb768103c561c588de310f34dd26ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Wed, 4 Nov 2026 19:54:00 -0500
Subject: [PATCH 1021/1982] nvmet-auth: serialize access to DH-HMAC-CHAP state
 to fix UAF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 53f6efe00cea0c0cf7bd99debe3cdac8567170b5 ]

A REPLY AUTH_SEND command can derive a dhchap_skey key while a
concurrent AUTH_RECEIVE command observing this REPLY state executes
the failure path and frees that key. The REPLY command then continues
and writes into freed memory, causing a use-after-free. KASAN reports
it as:

  BUG: KASAN: slab-use-after-free in __sha256_final
  Write of size 4 at addr ffff88800359c540
  ...
  nvmet_auth_sq_free (drivers/nvme/target/auth.c:237)
  nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:621)

Add a mutex to each submission queue to serialize authentication
commands and timeout handling. Unlock the mutex before completing
requests and ignore outdated timeout callbacks. Limit timeout delays
to prevent immediate expiry on 32-bit kernels.

Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/auth.c             |  1 +
 drivers/nvme/target/fabrics-cmd-auth.c | 32 ++++++++++++++++++++++----
 drivers/nvme/target/nvmet.h            |  2 ++
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 8230a0563616b9..4c68225411be31 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -238,6 +238,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq, bool reset)
 
 void nvmet_auth_sq_free(struct nvmet_sq *sq)
 {
+	sq->auth_expiry_active = false;
 	cancel_delayed_work(&sq->auth_expired_work);
 #ifdef CONFIG_NVME_TARGET_TCP_TLS
 	sq->tls_key = NULL;
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index af712c6624b36c..20a2dfcbbc57f2 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -6,6 +6,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/blkdev.h>
+#include <linux/jiffies.h>
 #include <linux/random.h>
 #include <linux/nvme-auth.h>
 #include <crypto/hash.h>
@@ -18,16 +19,27 @@ static void nvmet_auth_expired_work(struct work_struct *work)
 	struct nvmet_sq *sq = container_of(to_delayed_work(work),
 			struct nvmet_sq, auth_expired_work);
 
+	mutex_lock(&sq->auth_lock);
+	/* A command may have cancelled or rearmed this timeout. */
+	if (!sq->auth_expiry_active ||
+	    delayed_work_pending(&sq->auth_expired_work))
+		goto out_unlock;
+	sq->auth_expiry_active = false;
+
 	pr_debug("%s: ctrl %d qid %d transaction %u expired, resetting\n",
 		 __func__, sq->ctrl->cntlid, sq->qid, sq->dhchap_tid);
 	sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
 	sq->dhchap_tid = -1;
+out_unlock:
+	mutex_unlock(&sq->auth_lock);
 }
 
 void nvmet_auth_sq_init(struct nvmet_sq *sq)
 {
 	/* Initialize in-band authentication */
+	mutex_init(&sq->auth_lock);
 	INIT_DELAYED_WORK(&sq->auth_expired_work, nvmet_auth_expired_work);
+	sq->auth_expiry_active = false;
 	sq->authenticated = false;
 	sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
 }
@@ -258,6 +270,8 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 	u16 status = 0;
 	u8 dhchap_status;
 
+	mutex_lock(&req->sq->auth_lock);
+
 	if (req->cmd->auth_send.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
 		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
@@ -283,8 +297,10 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 			offsetof(struct nvmf_auth_send_command, tl);
 		goto done;
 	}
-	if (!nvmet_check_transfer_len(req, tl)) {
+	if (unlikely(tl != req->transfer_len)) {
 		pr_debug("%s: transfer length mismatch (%u)\n", __func__, tl);
+		mutex_unlock(&req->sq->auth_lock);
+		nvmet_check_transfer_len(req, tl);
 		return;
 	}
 
@@ -408,10 +424,12 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 			 status, req->error_loc);
 	if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
 	    req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
-		unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
+		unsigned long auth_expire = min_t(u64, MAX_JIFFY_OFFSET,
+			(u64)(ctrl->kato ? ctrl->kato : 120) * HZ);
 
+		req->sq->auth_expiry_active = true;
 		mod_delayed_work(system_percpu_wq, &req->sq->auth_expired_work,
-				 auth_expire_secs * HZ);
+				 auth_expire);
 		goto complete;
 	}
 	/* Final states, clear up variables */
@@ -420,6 +438,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 		nvmet_ctrl_fatal_error(ctrl);
 
 complete:
+	mutex_unlock(&req->sq->auth_lock);
 	nvmet_req_complete(req, status);
 }
 
@@ -538,6 +557,8 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
 	u32 al;
 	u16 status = 0;
 
+	mutex_lock(&req->sq->auth_lock);
+
 	if (req->cmd->auth_receive.secp != NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER) {
 		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc =
@@ -563,8 +584,10 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
 			offsetof(struct nvmf_auth_receive_command, al);
 		goto done;
 	}
-	if (!nvmet_check_transfer_len(req, al)) {
+	if (unlikely(al != req->transfer_len)) {
 		pr_debug("%s: transfer length mismatch (%u)\n", __func__, al);
+		mutex_unlock(&req->sq->auth_lock);
+		nvmet_check_transfer_len(req, al);
 		return;
 	}
 
@@ -623,5 +646,6 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
 		nvmet_auth_sq_free(req->sq);
 		nvmet_ctrl_fatal_error(ctrl);
 	}
+	mutex_unlock(&req->sq->auth_lock);
 	nvmet_req_complete(req, status);
 }
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 87e2fdbd186567..45fc188412d28a 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -156,8 +156,10 @@ struct nvmet_sq {
 	u32			sqhd;
 	bool			sqhd_disabled;
 #ifdef CONFIG_NVME_TARGET_AUTH
+	struct mutex		auth_lock;
 	bool			authenticated;
 	struct delayed_work	auth_expired_work;
+	bool			auth_expiry_active;
 	u16			dhchap_tid;
 	u8			sc_c;
 	u8			dhchap_status;

From 3809bde861d7a2b236a53fbe0227e01f44f4136e Mon Sep 17 00:00:00 2001
From: Sami Tolvanen <samitolvanen@google.com>
Date: Wed, 4 Nov 2026 17:36:48 -0500
Subject: [PATCH 1022/1982] rust: irq: declare cfi_encoding for irqreturn

[ Upstream commit 01f3e6b4b1c8c1748e59ba53631ab1f5d9ad0ea4 ]

The IRQ callbacks return c_uint. C calls them through irq_handler_t,
which returns enum irqreturn. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.

Generate irqreturn as a newtype with a cfi_encoding, as is done for
lru_status, and return bindings::irqreturn_t from the callbacks.

Fixes: 0851d34a8cc3 ("rust: irq: add support for non-threaded IRQs and handlers")
Fixes: 135d40523244 ("rust: irq: add support for threaded IRQs and handlers")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-1-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ sashal: replaced bindgen's custom enum attribute option with sed post-processing to support older bindgen ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 rust/Makefile              |  3 ++-
 rust/bindgen_parameters    |  3 +++
 rust/bindings/lib.rs       |  1 +
 rust/kernel/irq/request.rs | 22 +++++++++++-----------
 4 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index d4618f646b05b3..3867ff14fbdec1 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -367,7 +367,8 @@ quiet_cmd_bindgen = BINDGEN $@
 $(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
     $(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
 $(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
-    sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@
+    sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+    sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
 $(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
     $(src)/bindgen_parameters FORCE
 	$(call if_changed_dep,bindgen)
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index e13c6f9dd17b22..9e02500dc9792b 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -23,6 +23,9 @@
 # warning. We don't need to peek into it anyway.
 --opaque-type spinlock
 
+# enums that appear in indirect function calls should specify a cfi type
+--newtype-enum irqreturn
+
 # `seccomp`'s comment gets understood as a doctest
 --no-doc-comments
 
diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index 8305adbdf8cbf2..37f584727eba1c 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -23,6 +23,7 @@
     unreachable_pub,
     unsafe_op_in_unsafe_fn
 )]
+#![feature(cfi_encoding)]
 
 #[allow(dead_code)]
 #[allow(clippy::as_underscore)]
diff --git a/rust/kernel/irq/request.rs b/rust/kernel/irq/request.rs
index 70700f43ddd373..4f2b315856b9b2 100644
--- a/rust/kernel/irq/request.rs
+++ b/rust/kernel/irq/request.rs
@@ -20,10 +20,10 @@ use crate::sync::{aref::ARef, Arc};
 #[repr(u32)]
 pub enum IrqReturn {
     /// The interrupt was not from this device or was not handled.
-    None = bindings::irqreturn_IRQ_NONE,
+    None = bindings::irqreturn::IRQ_NONE.0,
 
     /// The interrupt was handled by this device.
-    Handled = bindings::irqreturn_IRQ_HANDLED,
+    Handled = bindings::irqreturn::IRQ_HANDLED.0,
 }
 
 /// Callbacks for an IRQ handler.
@@ -275,7 +275,7 @@ impl<T: Handler + 'static> Registration<T> {
 unsafe extern "C" fn handle_irq_callback<T: Handler + 'static>(
     _irq: i32,
     ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
     // SAFETY: `ptr` is a pointer to `RegistrationInner` set in `Registration::new`
     let inner = unsafe { &*(ptr as *const RegistrationInner) };
     // SAFETY: `inner.handler` is a pointer to `T` set in `Registration::new`
@@ -284,20 +284,20 @@ unsafe extern "C" fn handle_irq_callback<T: Handler + 'static>(
     // callback is running implies that the device has not yet been unbound.
     let device = unsafe { inner.dev.as_bound() };
 
-    T::handle(handler, device) as c_uint
+    bindings::irqreturn_t(T::handle(handler, device) as c_uint)
 }
 
 /// The value that can be returned from [`ThreadedHandler::handle`].
 #[repr(u32)]
 pub enum ThreadedIrqReturn {
     /// The interrupt was not from this device or was not handled.
-    None = bindings::irqreturn_IRQ_NONE,
+    None = bindings::irqreturn::IRQ_NONE.0,
 
     /// The interrupt was handled by this device.
-    Handled = bindings::irqreturn_IRQ_HANDLED,
+    Handled = bindings::irqreturn::IRQ_HANDLED.0,
 
     /// The handler wants the handler thread to wake up.
-    WakeThread = bindings::irqreturn_IRQ_WAKE_THREAD,
+    WakeThread = bindings::irqreturn::IRQ_WAKE_THREAD.0,
 }
 
 /// Callbacks for a threaded IRQ handler.
@@ -501,7 +501,7 @@ impl<T: ThreadedHandler + 'static> ThreadedRegistration<T> {
 unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler + 'static>(
     _irq: i32,
     ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
     // SAFETY: `ptr` is a pointer to `RegistrationInner` set in `ThreadedRegistration::new`
     let inner = unsafe { &*(ptr as *const RegistrationInner) };
     // SAFETY: `inner.handler` is a pointer to `T` set in `ThreadedRegistration::new`
@@ -510,7 +510,7 @@ unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler + 'static>(
     // callback is running implies that the device has not yet been unbound.
     let device = unsafe { inner.dev.as_bound() };
 
-    T::handle(handler, device) as c_uint
+    bindings::irqreturn_t(T::handle(handler, device) as c_uint)
 }
 
 /// # Safety
@@ -519,7 +519,7 @@ unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler + 'static>(
 unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler + 'static>(
     _irq: i32,
     ptr: *mut c_void,
-) -> c_uint {
+) -> bindings::irqreturn_t {
     // SAFETY: `ptr` is a pointer to `RegistrationInner` set in `ThreadedRegistration::new`
     let inner = unsafe { &*(ptr as *const RegistrationInner) };
     // SAFETY: `inner.handler` is a pointer to `T` set in `ThreadedRegistration::new`
@@ -528,5 +528,5 @@ unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler + 'static>(
     // callback is running implies that the device has not yet been unbound.
     let device = unsafe { inner.dev.as_bound() };
 
-    T::handle_threaded(handler, device) as c_uint
+    bindings::irqreturn_t(T::handle_threaded(handler, device) as c_uint)
 }

From 5a13e8528e0b11f0e53031998854335687046197 Mon Sep 17 00:00:00 2001
From: Sami Tolvanen <samitolvanen@google.com>
Date: Fri, 6 Nov 2026 15:47:20 +0100
Subject: [PATCH 1023/1982] rust: hrtimer: declare cfi_encoding for
 hrtimer_restart

commit 39fe6892fd52faed6325ff7f13a92da01ab35727 upstream.

The hrtimer callbacks return bindings::hrtimer_restart, which bindgen
generates as c_uint. C calls them through hrtimer->function, which
returns enum hrtimer_restart. kCFI encodes enum types by name even with
integer normalization, so the type ids never match and every call fails
the CFI check.

Generate hrtimer_restart as a newtype with a cfi_encoding, as is done
for lru_status, and adapt HrTimerRestart to the newtype.

Fixes: 8a8afe9349fb ("rust: hrtimer: introduce hrtimer support")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Tested-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Acked-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-2-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Replaced bindgen's custom enum attribute option with sed
  post-processing to support older bindgen. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 rust/Makefile               | 1 +
 rust/bindgen_parameters     | 1 +
 rust/kernel/time/hrtimer.rs | 6 +++---
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index 3867ff14fbdec1..3f1abad648e668 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -368,6 +368,7 @@ $(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
     $(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
 $(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
     sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+    sed -Ei 's/^pub struct hrtimer_restart\(/#[cfi_encoding="15hrtimer_restart"]\n&/' $@; \
     sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
 $(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
     $(src)/bindgen_parameters FORCE
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 9e02500dc9792b..6f76fdcffd58dc 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -24,6 +24,7 @@
 --opaque-type spinlock
 
 # enums that appear in indirect function calls should specify a cfi type
+--newtype-enum hrtimer_restart
 --newtype-enum irqreturn
 
 # `seccomp`'s comment gets understood as a doctest
diff --git a/rust/kernel/time/hrtimer.rs b/rust/kernel/time/hrtimer.rs
index 856d2d929a0089..35ff2ef7d94412 100644
--- a/rust/kernel/time/hrtimer.rs
+++ b/rust/kernel/time/hrtimer.rs
@@ -498,14 +498,14 @@ pub unsafe trait HasHrTimer<T> {
 #[repr(u32)]
 pub enum HrTimerRestart {
     /// Timer should not be restarted.
-    NoRestart = bindings::hrtimer_restart_HRTIMER_NORESTART,
+    NoRestart = bindings::hrtimer_restart::HRTIMER_NORESTART.0,
     /// Timer should be restarted.
-    Restart = bindings::hrtimer_restart_HRTIMER_RESTART,
+    Restart = bindings::hrtimer_restart::HRTIMER_RESTART.0,
 }
 
 impl HrTimerRestart {
     fn into_c(self) -> bindings::hrtimer_restart {
-        self as bindings::hrtimer_restart
+        bindings::hrtimer_restart(self as c_uint)
     }
 }
 

From a3dc612f05f4084b766428fb05963410aa7d8a5f Mon Sep 17 00:00:00 2001
From: Sami Tolvanen <samitolvanen@google.com>
Date: Fri, 6 Nov 2026 15:47:21 +0100
Subject: [PATCH 1024/1982] rust: dma: declare cfi_encoding for
 dma_data_direction

commit 7d109178cd644268326cd31702ed46c7ac8bb300 upstream.

bindgen generates bindings::dma_data_direction as an integer by default,
while C callback tables such as dma_buf_ops declare the parameter as
enum dma_data_direction. kCFI encodes enum types by name even with
integer normalization, so the type ids would not match when C calls into
a Rust callback taking bindings::dma_data_direction.

Generate dma_data_direction as a newtype with a cfi_encoding, as is done
for lru_status, and convert DataDirection through the newtype's
constants.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c2437c43cfb1 ("rust: dma: implement DataDirection")
Link: https://patch.msgid.link/20261019-rust-cfi-fixes-v1-3-9503472ba738@google.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
[ Replaced bindgen's custom enum attribute option with sed
  post-processing to support older bindgen. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 rust/Makefile           |  1 +
 rust/bindgen_parameters |  1 +
 rust/kernel/dma.rs      | 21 +++++++++++----------
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index 3f1abad648e668..d6429e68949fee 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -368,6 +368,7 @@ $(obj)/bindings/bindings_generated.rs: private bindgen_target_flags = \
     $(shell grep -Ev '^#|^$$' $(src)/bindgen_parameters)
 $(obj)/bindings/bindings_generated.rs: private bindgen_target_extra = ; \
     sed -Ei 's/pub const RUST_CONST_HELPER_([a-zA-Z0-9_]*)/pub const \1/g' $@; \
+    sed -Ei 's/^pub struct dma_data_direction\(/#[cfi_encoding="18dma_data_direction"]\n&/' $@; \
     sed -Ei 's/^pub struct hrtimer_restart\(/#[cfi_encoding="15hrtimer_restart"]\n&/' $@; \
     sed -Ei 's/^pub struct irqreturn\(/#[cfi_encoding="9irqreturn"]\n&/' $@
 $(obj)/bindings/bindings_generated.rs: $(src)/bindings/bindings_helper.h \
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 6f76fdcffd58dc..a5d547dc8e8eae 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -24,6 +24,7 @@
 --opaque-type spinlock
 
 # enums that appear in indirect function calls should specify a cfi type
+--newtype-enum dma_data_direction
 --newtype-enum hrtimer_restart
 --newtype-enum irqreturn
 
diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
index 4ce9e5d7f3dd00..b6c73db358ced9 100644
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -267,25 +267,25 @@ pub enum DataDirection {
     ///
     /// This is used when the buffer can be both read from and written to by the device.
     /// The cache for the corresponding memory region is both flushed and invalidated.
-    Bidirectional = Self::const_cast(bindings::dma_data_direction_DMA_BIDIRECTIONAL),
+    Bidirectional = Self::const_cast(bindings::dma_data_direction::DMA_BIDIRECTIONAL),
 
     /// The DMA mapping is for data transfer from memory to the device (write).
     ///
     /// The CPU has prepared data in the buffer, and the device will read it.
     /// The cache for the corresponding memory region is flushed before device access.
-    ToDevice = Self::const_cast(bindings::dma_data_direction_DMA_TO_DEVICE),
+    ToDevice = Self::const_cast(bindings::dma_data_direction::DMA_TO_DEVICE),
 
     /// The DMA mapping is for data transfer from the device to memory (read).
     ///
     /// The device will write data into the buffer for the CPU to read.
     /// The cache for the corresponding memory region is invalidated before CPU access.
-    FromDevice = Self::const_cast(bindings::dma_data_direction_DMA_FROM_DEVICE),
+    FromDevice = Self::const_cast(bindings::dma_data_direction::DMA_FROM_DEVICE),
 
     /// The DMA mapping is not for data transfer.
     ///
     /// This is primarily for debugging purposes. With this direction, the DMA mapping API
     /// will not perform any cache coherency operations.
-    None = Self::const_cast(bindings::dma_data_direction_DMA_NONE),
+    None = Self::const_cast(bindings::dma_data_direction::DMA_NONE),
 }
 
 impl DataDirection {
@@ -297,7 +297,7 @@ impl DataDirection {
         // CAST: The C standard allows compilers to choose different integer types for enums.
         // To safely check the value, we cast it to a wide signed integer type (`i128`)
         // which can hold any standard C integer enum type without truncation.
-        let wide_val = val as i128;
+        let wide_val = val.0 as i128;
 
         // Check if the value is outside the valid range for the target type `u32`.
         // CAST: `u32::MAX` is cast to `i128` to match the type of `wide_val` for the comparison.
@@ -315,11 +315,12 @@ impl DataDirection {
 impl From<DataDirection> for bindings::dma_data_direction {
     /// Returns the raw representation of [`enum dma_data_direction`].
     fn from(direction: DataDirection) -> Self {
-        // CAST: `direction as u32` gets the underlying representation of our `#[repr(u32)]` enum.
-        // The subsequent cast to `Self` (the bindgen type) assumes the C enum is compatible
-        // with the enum variants of `DataDirection`, which is a valid assumption given our
-        // compile-time checks.
-        direction as u32 as Self
+        match direction {
+            DataDirection::Bidirectional => Self::DMA_BIDIRECTIONAL,
+            DataDirection::ToDevice => Self::DMA_TO_DEVICE,
+            DataDirection::FromDevice => Self::DMA_FROM_DEVICE,
+            DataDirection::None => Self::DMA_NONE,
+        }
     }
 }
 

From c4252273ead984541eb9313667f2924f2ff8d0e0 Mon Sep 17 00:00:00 2001
From: Vernon Yang <yanglincheng@kylinos.cn>
Date: Wed, 4 Nov 2026 18:12:29 -0500
Subject: [PATCH 1025/1982] mm: khugepaged: fix swap entry value to folio_pfn()

[ Upstream commit 942c8ec27aa4ffc587511650718349964e1696e6 ]

Patch series "mm: khugepaged: fix tracepoint UAF", v5.

The khugepaged tracepoints take a folio pointer and call folio_pfn(), but
by then the folio may no longer be valid: freed after folio_put(),
folio_unlock() or pte_unmap_unlock(), or not a folio at all but an
xarray-encoded swap entry.  On classic SPARSEMEM, dereferencing it oopses
khugepaged as soon as the trace event is enabled; on other memory models
it merely prints a bogus pfn.

Pass the pfn to the tracepoints directly, captured while the folio is
still pinned, closing the use-after-free windows in
mm_khugepaged_scan_file(), mm_khugepaged_scan_pmd() and
mm_khugepaged_collapse_file().

This patch (of 3):

When the swap entries found exceed max_ptes_swap, the loop is left via
break with folio still holding the xarray value that encodes the swap
entry, not valid folio pointer.

That value is passed to trace_mm_khugepaged_scan_file(), which feeds it to
folio_pfn().  On FLATMEM and SPARSEMEM_VMEMMAP, the page_to_pfn() is plain
pointer arithmetic, so the trace event merely prints bogus scan_pfn.  On
classic SPARSEMEM, the page_to_pfn() reads page->flags, dereferencing the
tiny encoded integer and oopsing khugepaged whenever the trace event is
enabled.

So when folio is the swap entry value, simply set pfn to -1, just like
exhausted scan naturally.

And the folio_put() has maybe dropped the last reference of folio.  The
trace_mm_khugepaged_scan_file() is left with a dangling folio pointer.  so
using the folio_pfn() before dropping the reference, closing
use-after-free window.

Link: https://lore.kernel.org/20260909025804.3233645-1-vernon2gm@gmail.com
Link: https://lore.kernel.org/20260909025804.3233645-2-vernon2gm@gmail.com
Fixes: d41fd2016ed0 ("mm/khugepaged: add tracepoint to hpage_collapse_scan_file()")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: <stable@vger.kernel.org>
[ sashal: Retained int result instead of enum scan_result in hpage_collapse_scan_file(). ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/trace/events/huge_memory.h | 6 +++---
 mm/khugepaged.c                    | 7 ++++++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
index 2276614691dfd9..1464d45c90abf0 100644
--- a/include/trace/events/huge_memory.h
+++ b/include/trace/events/huge_memory.h
@@ -167,10 +167,10 @@ TRACE_EVENT(mm_collapse_huge_page_swapin,
 
 TRACE_EVENT(mm_khugepaged_scan_file,
 
-	TP_PROTO(struct mm_struct *mm, struct folio *folio, struct file *file,
+	TP_PROTO(struct mm_struct *mm, unsigned long pfn, struct file *file,
 		 int present, int swap, int result),
 
-	TP_ARGS(mm, folio, file, present, swap, result),
+	TP_ARGS(mm, pfn, file, present, swap, result),
 
 	TP_STRUCT__entry(
 		__field(struct mm_struct *, mm)
@@ -183,7 +183,7 @@ TRACE_EVENT(mm_khugepaged_scan_file,
 
 	TP_fast_assign(
 		__entry->mm = mm;
-		__entry->pfn = folio ? folio_pfn(folio) : -1;
+		__entry->pfn = pfn;
 		__assign_str(filename);
 		__entry->present = present;
 		__entry->swap = swap;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index e2ac26c05064f9..cc3a09a0c25962 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -2308,6 +2308,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
 	int present, swap;
 	int node = NUMA_NO_NODE;
 	int result = SCAN_SUCCEED;
+	unsigned long failed_pfn = -1;
 
 	present = 0;
 	swap = 0;
@@ -2344,6 +2345,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
 		    folio->index == start) {
 			/* Maybe PMD-mapped */
 			result = SCAN_PTE_MAPPED_HUGEPAGE;
+			failed_pfn = folio_pfn(folio);
 			/*
 			 * For SCAN_PTE_MAPPED_HUGEPAGE, further processing
 			 * by the caller won't touch the page cache, and so
@@ -2357,6 +2359,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
 		node = folio_nid(folio);
 		if (hpage_collapse_scan_abort(node, cc)) {
 			result = SCAN_SCAN_ABORT;
+			failed_pfn = folio_pfn(folio);
 			folio_put(folio);
 			break;
 		}
@@ -2364,12 +2367,14 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
 
 		if (!folio_test_lru(folio)) {
 			result = SCAN_PAGE_LRU;
+			failed_pfn = folio_pfn(folio);
 			folio_put(folio);
 			break;
 		}
 
 		if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) {
 			result = SCAN_PAGE_COUNT;
+			failed_pfn = folio_pfn(folio);
 			folio_put(folio);
 			break;
 		}
@@ -2401,7 +2406,7 @@ static int hpage_collapse_scan_file(struct mm_struct *mm, unsigned long addr,
 		}
 	}
 
-	trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result);
+	trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present, swap, result);
 	return result;
 }
 

From c04b888b3955123931cee3652499c16734a46c4e Mon Sep 17 00:00:00 2001
From: Miguel Ojeda <ojeda@kernel.org>
Date: Fri, 6 Nov 2026 07:37:45 +0100
Subject: [PATCH 1026/1982] rust: bitmap: fix intra-doc link

`BitmapVec::MAX_LEN` does not exist in 6.18.y, so `rustdoc` warns:

    warning: unresolved link to `BitmapVec::MAX_LEN`
      --> rust/kernel/bitmap.rs:24:25
       |
    24 | /// This also matches [`BitmapVec::MAX_LEN`].
       |                         ^^^^^^^^^^^^^^^^^^ the struct `BitmapVec` has no field or associated item named `MAX_LEN`
       |
       = note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default

Thus link to `BitmapVec::new()` instead.

Fixes: 37f45fe068e0 ("rust: bitmap: restrict bitmap length to at most i32::MAX")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 rust/kernel/bitmap.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs
index 0e5e825aefb6c7..a00988bc8191ae 100644
--- a/rust/kernel/bitmap.rs
+++ b/rust/kernel/bitmap.rs
@@ -19,7 +19,7 @@ use core::ptr::NonNull;
 /// Must reference a `[c_ulong]` long enough to fit `data.len()` bits.
 /// Must not be longer than [`i32::MAX`] bits, so offsets and lengths used with
 /// [`Bitmap`] functions fit in the `int` and `unsigned int` arguments of the C bitmap API.
-/// This also matches [`BitmapVec::MAX_LEN`].
+/// This also matches the maximum length accepted by [`BitmapVec::new`].
 #[cfg_attr(CONFIG_64BIT, repr(align(8)))]
 #[cfg_attr(not(CONFIG_64BIT), repr(align(4)))]
 pub struct Bitmap {

From c518337e597df7204244b5a174277286eb6e14fa Mon Sep 17 00:00:00 2001
From: Zhenhao Wan <whi4ed0g@gmail.com>
Date: Thu, 13 Aug 2026 21:14:08 +0800
Subject: [PATCH 1027/1982] drm/nouveau: reject zero-size notifier object
 allocation

[ Upstream commit 38125d38d850bd2fdd5d7840c3bd52d9d208995b ]

nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled
info->size to nvkm_mm_head() as both size_max and size_min without a lower
bound.  A zero size satisfies the allocator's "e - s < size_min" gate
(size_min == 0 makes the unsigned comparison inert) and yields a
zero-length node, after which

	args.limit = ntfy->node->offset + ntfy->node->length - 1;

underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA
window.  The dma object constructor only rejects start > limit, so the
validly ordered [base, base + 0xffffffff] range passes and is programmed
into the GPU DMA context.  The ioctl is DRM_RENDER_ALLOW, so any render
node client can trigger this on pre-Fermi hardware.

Reject a zero-size request before allocating anything.

Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module format")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260813-nouveau-abi16-notifierobj-zero-size-v1-1-20dee38077cb@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index a3ba07fc48a087..a067c7244e7ecb 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -631,6 +631,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
 	if (unlikely(device->info.family >= NV_DEVICE_INFO_V0_FERMI))
 		return nouveau_abi16_put(abi16, -EINVAL);
 
+	/* zero size yields a zero-length node, underflowing args.limit */
+	if (unlikely(!info->size))
+		return nouveau_abi16_put(abi16, -EINVAL);
+
 	chan = nouveau_abi16_chan(abi16, info->channel);
 	if (!chan)
 		return nouveau_abi16_put(abi16, -ENOENT);

From 812500ab5bb8100003bbae1391c0ef16c9c3df7d Mon Sep 17 00:00:00 2001
From: Zhenhao Wan <whi4ed0g@gmail.com>
Date: Fri, 14 Aug 2026 18:00:05 +0800
Subject: [PATCH 1028/1982] drm/nouveau/svm: drain fault handler before freeing
 svmm

[ Upstream commit b46ddaf0823405f81e681eb26ec98508f3eb9a07 ]

The SVM fault handler nouveau_svm_fault() looks up each fault's
nouveau_svmm under svm->mutex, caches it in the fault array, then drops
svm->mutex and dereferences the svmm across blocking faults
(mmu_interval_notifier_insert(), hmm_range_fault()).

nouveau_svmm is not refcounted. On DRM file close nouveau_svmm_fini() ->
mmu_notifier_put() frees it asynchronously via call_srcu() without
waiting for the handler, and mmget_not_zero() pins the mm, not the svmm.
flush_work() on the fault buffer otherwise runs only at device removal
and suspend, never on close, so a fault handled concurrently with a close
can dereference a freed svmm.

The instance is already unlinked by nouveau_svmm_part() earlier in the
same close, so no new fault can resolve to it. Drain the handler in
nouveau_svmm_fini() before the free, guarding the flush with a NULL check
on drm->svm: on device teardown nouveau_svm_fini() runs first and frees
drm->svm (NULL) after blocking the notify and flushing the buffer, so the
handler is already drained; on per-client close drm->svm is alive and the
flush runs.

Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared virtual memory")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260814-nouveau-svm-svmm-uaf-v2-1-8e6590519f07@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_svm.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 6fa387da063715..dc6c79f57a56da 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -304,6 +304,19 @@ nouveau_svmm_fini(struct nouveau_svmm **psvmm)
 {
 	struct nouveau_svmm *svmm = *psvmm;
 	if (svmm) {
+		struct nouveau_svm *svm = svmm->vmm->cli->drm->svm;
+
+		/* The fault handler caches svmm pointers under svm->mutex and
+		 * dereferences them after dropping it, across blocking faults.
+		 * The instance is already unlinked (nouveau_svmm_part), so drain
+		 * the handler before the free to release any in-flight reference.
+		 *
+		 * On device teardown nouveau_svm_fini() ran first and freed
+		 * drm->svm (NULL) after draining the buffer; nothing to flush.
+		 */
+		if (svm)
+			flush_work(&svm->buffer[0].work);
+
 		mutex_lock(&svmm->mutex);
 		svmm->vmm = NULL;
 		mutex_unlock(&svmm->mutex);

From e8c6be50fcae43997eac73781894aeda2e43d1cb Mon Sep 17 00:00:00 2001
From: Marek Czernohous <marek@czernohous.de>
Date: Sun, 16 Aug 2026 15:09:04 +0200
Subject: [PATCH 1029/1982] drm/nouveau/pci: use config-space MSI rearm on
 MCP79/MCP7A (NVAC)

[ Upstream commit 354d47fb3f35461b7f942831c1b2a7105e92b57f ]

NVAC (MCP79/MCP7A) uses g94_pci_func, whose .msi_rearm is
nv40_pci_msi_rearm(): a re-arm write through the MMIO mirror of PCI
config space.  On this IGP that path is unreliable; when a re-arm is
missed the interrupt line stays dead, command submission times out and
the GPU appears hung until reboot.  On an Apple Mac mini (early 2009,
MCP79, boot0 0x0ac080b1) this showed as sporadic fifo timeouts and GPU
hangs under load unless MSI was disabled via config=NvMSI=0.

Give NVAC its own pci func that re-arms through real PCI config space
(nv46_pci_msi_rearm) instead.  This follows existing precedent: nv46.c
documents the MMIO-mirror re-arm as broken on several related parts,
and commit 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm") fixed g92
the same way while moving the remaining chipsets, NVAC included, into
the newly added shared g94 table, where NVAC stayed on the MMIO path.
This change completes that fix for NVAC.  The sibling IGP NVAA
(MCP77/MCP78) has MSI disabled entirely as "reported broken" in
nvkm_pci_new_(); NVAC works correctly once the re-arm goes through
config space, so disabling MSI is not necessary.

Only NVAC is switched: that is the hardware this has been validated
on.  The other users of g94_pci_func (G94/G96/G98/GT2xx and the
MCP77/MCP89 IGPs) keep their current behavior; MCP77 and MCP89
plausibly want the same treatment but were not tested.

Tested on the Mac mini as a daily driver for two months with MSI
enabled and zero fifo timeouts.  Independently confirmed stable on an
iMac9,1 (MCP79) running 6.12.90 with the v1 form of this change (the
same one-line functional switch, applied to that kernel's g94
implementation).

Fixes: 5112abc6a433 ("drm/nouveau/pci/g92: Fix rearm")
Cc: <stable@vger.kernel.org> # v6.16+
Tested-by: Fab Stz <fabstz-it@yahoo.fr>
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688574401.522643.12812428444459119913@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/nouveau/include/nvkm/subdev/pci.h |  1 +
 .../gpu/drm/nouveau/nvkm/engine/device/base.c |  2 +-
 .../gpu/drm/nouveau/nvkm/subdev/pci/Kbuild    |  1 +
 .../gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c   | 35 +++++++++++++++++++
 4 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c

diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
index 112b674ed9c8a0..0172e0d200f81a 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/pci.h
@@ -46,6 +46,7 @@ int nv4c_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct n
 int g84_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
 int g92_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
 int g94_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
+int mcp79_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
 int gf100_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
 int gf106_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
 int gk104_pci_new(struct nvkm_device *, enum nvkm_subdev_type, int inst, struct nvkm_pci **);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 3738c4664fb6a2..305b16d9bcc7af 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1237,7 +1237,7 @@ nvac_chipset = {
 	.mc       = { 0x00000001, g98_mc_new },
 	.mmu      = { 0x00000001, mcp77_mmu_new },
 	.mxm      = { 0x00000001, nv50_mxm_new },
-	.pci      = { 0x00000001, g94_pci_new },
+	.pci      = { 0x00000001, mcp79_pci_new },
 	.therm    = { 0x00000001, g84_therm_new },
 	.timer    = { 0x00000001, nv41_timer_new },
 	.volt     = { 0x00000001, nv40_volt_new },
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
index a14ea0f7b1c879..90f03baeb22ac9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/Kbuild
@@ -9,6 +9,7 @@ nvkm-y += nvkm/subdev/pci/nv4c.o
 nvkm-y += nvkm/subdev/pci/g84.o
 nvkm-y += nvkm/subdev/pci/g92.o
 nvkm-y += nvkm/subdev/pci/g94.o
+nvkm-y += nvkm/subdev/pci/mcp79.o
 nvkm-y += nvkm/subdev/pci/gf100.o
 nvkm-y += nvkm/subdev/pci/gf106.o
 nvkm-y += nvkm/subdev/pci/gk104.o
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
new file mode 100644
index 00000000000000..e2ae242f1aa771
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/mcp79.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Copyright 2026 Marek Czernohous
+ *
+ * MCP79/MCP7A (NVAC): like g94, but MSI re-arm goes through real PCI
+ * config space.  The MMIO-mirror re-arm is unreliable on this IGP and a
+ * missed re-arm kills the interrupt line (see the nv46 comment; g92
+ * already re-arms through config space for the same reason).
+ */
+#include "priv.h"
+
+static const struct nvkm_pci_func
+mcp79_pci_func = {
+	.cfg = { .addr = 0x088000, .size = 0x1000 },
+
+	.init = g84_pci_init,
+	.msi_rearm = nv46_pci_msi_rearm,
+
+	.pcie.init = g84_pcie_init,
+	.pcie.set_link = g84_pcie_set_link,
+
+	.pcie.max_speed = g84_pcie_max_speed,
+	.pcie.cur_speed = g84_pcie_cur_speed,
+
+	.pcie.set_version = g84_pcie_set_version,
+	.pcie.version = g84_pcie_version,
+	.pcie.version_supported = g92_pcie_version_supported,
+};
+
+int
+mcp79_pci_new(struct nvkm_device *device, enum nvkm_subdev_type type, int inst,
+	      struct nvkm_pci **ppci)
+{
+	return nvkm_pci_new_(&mcp79_pci_func, device, type, inst, ppci);
+}

From f688ffe4a23ae12d2947e68b10225b208c36022c Mon Sep 17 00:00:00 2001
From: Marek Czernohous <marek@czernohous.de>
Date: Sun, 16 Aug 2026 14:58:52 +0200
Subject: [PATCH 1030/1982] drm/nouveau: disable the fence uevent work instead
 of just cancelling it

[ Upstream commit 827eb9328eaed831d7cc426ac2705038a40835b6 ]

nouveau_fence_context_del() drains the uevent work while the event that
feeds it is still armed:

	cancel_work_sync(&fctx->uevent_work);
	nouveau_fence_context_kill(fctx, 0);
	nvif_event_dtor(&fctx->event);

nouveau_fence_wait_uevent_handler() queues the work unconditionally:

	schedule_work(&fctx->uevent_work);
	return NVIF_EVENT_KEEP;

so a non-stall interrupt arriving after cancel_work_sync() has returned
re-arms the work that was just drained.  The window closes in two steps,
neither of which is the drain.  The kill blocks the event when the last
fence holding a notify_ref is signalled, which reaches
atomic_xchg(&ntfy->allowed, 0) (nvkm/core/event.c:104), and
nvkm_event_ntfy() skips a ntfy that is not allowed (:183).  That stops
further handlers from starting, but not one that is already inside
nvkm_event_ntfy(): the event is created with wait = false
(nouveau_fence.c:201), so nvkm_event_ntfy_block_() leaves it on the list
and never takes event->list_lock.  Only nvif_event_dtor() waits that one
out: nvkm_event_ntfy_del() (:141) goes through nvkm_event_ntfy_remove(),
which takes write_lock_irq() on that same list_lock (:84).

Either way the re-arm happens after the drain, and the caller drops its
reference immediately afterwards, for example nv84_fence_context_del():

	nouveau_fence_context_del(&fctx->base);
	chan->fence = NULL;
	nouveau_fence_context_free(&fctx->base);

That is a kref_put() on fctx->fence_ref, so the context outlives the
teardown only while emitted fences still hold a reference of their own.
That is no safety net: whenever none do, the count reaches zero right
there and nouveau_fence_context_put() kfree()s fctx while the work is
still queued.  &fctx->uevent_work is embedded in that allocation, so the
workqueue already dereferences freed memory when it picks the item up,
and nouveau_fence_uevent_work() can then take fctx->lock on it.  With
CONFIG_DEBUG_OBJECTS_WORK and CONFIG_DEBUG_OBJECTS_FREE, kfree() of a
still-queued work item is reported as the free of an active object.

On live memory the re-armed work has nothing left to do:
nouveau_fence_context_kill() empties fctx->pending and sets fctx->killed
under fctx->lock, nouveau_fence_emit() then returns -ENODEV rather than
queueing anything new, and nouveau_fence_update() only reaches
nvif_event_block() if it signalled something off that list.  The defect
is the access to freed memory, not what the work would have found.

Only chips from G84 on can reach this at all: nouveau_fence_context_new()
returns before nvif_event_ctor() when priv->uevent is clear, and
nv84_fence_create() is the only place that sets it.
nv84_fence_context_del() is the context_del for all of those, because
nvc0_fence_create() and gv100_fence_create() build on nv84_fence_create()
and override only context_new.

Use disable_work_sync() instead.  It drains the work exactly like
cancel_work_sync() does, and additionally increments the work item's
disable count, after which "any attempt to queue @work will fail and
return %false" (kernel/workqueue.c, disable_work()).  The handler's
schedule_work() then has nothing to re-arm, and the teardown order stays
as it is.

Draining a second time after nvif_event_dtor() would close the window as
well, and without the newer API: once nvkm_event_ntfy_remove() has
returned, no handler can start or still be running, so nothing re-arms
the work past that point.  disable_work_sync() is preferred here because
it needs one synchronisation point instead of two, it keeps the work
from being queued at all rather than cleaning up after it, and it is
what drm has settled on for this (drm/xe, drm/panthor, drm_pagemap).
Blocking the event rather than the work is not an option: fctx->event is
created with wait = false, so a handler already inside nvkm_event_ntfy()
can still queue the work.

Note for backports: disable_work_sync() arrived in v6.10 with
commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed)
work items"), while the fix being corrected here reached 6.6.18 and
6.7.6.  linux-6.6.y therefore carries this bug without the API, and this
patch would apply there and then fail to build.  A 6.6.y backport wants
the second drain described above instead, as its own patch.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260812233022.159301F000E9@smtp.kernel.org/
Fixes: 39126abc5e20 ("nouveau: offload fence uevents work to workqueue")
Cc: <stable@vger.kernel.org> # 6.10.x
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178688513268.513871.3468844663561639695@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 4a193b7d6d9e40..7acf241c4daf36 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -95,7 +95,7 @@ nouveau_fence_context_kill(struct nouveau_fence_chan *fctx, int error)
 void
 nouveau_fence_context_del(struct nouveau_fence_chan *fctx)
 {
-	cancel_work_sync(&fctx->uevent_work);
+	disable_work_sync(&fctx->uevent_work);
 	nouveau_fence_context_kill(fctx, 0);
 	nvif_event_dtor(&fctx->event);
 	fctx->dead = 1;

From 3ea6031d2625fd93ee17994f65140c321de46a83 Mon Sep 17 00:00:00 2001
From: Marek Czernohous <marek@czernohous.de>
Date: Sat, 15 Aug 2026 21:54:20 +0200
Subject: [PATCH 1031/1982] drm/nouveau: cancel the DP IRQ work before freeing
 the connector

[ Upstream commit f60849975a886d70883bcb6b3658c0fa83c6971f ]

nouveau_connector_destroy() tears the two nvif events down and then
frees the connector, but never cancels the work the IRQ event queues:

	nvif_event_dtor(&nv_connector->irq);
	nvif_event_dtor(&nv_connector->hpd);
	kfree(nv_connector->edid);
	...
	kfree(connector);

nouveau_connector_irq() queues that work unconditionally:

	schedule_work(&nv_connector->irq_work);
	return NVIF_EVENT_KEEP;

A DP IRQ arriving just before nvif_event_dtor() therefore leaves
nv_connector->irq_work on the system queue past the kfree(). When it
runs, nouveau_dp_irq() derives both nv_connector and connector from the
work_struct and dereferences them, and goes on to take
outp->dp.hpd_irq_lock.

There is no cancel_work_sync() for irq_work anywhere in the driver, so
nothing else covers this. Add it after the event teardown, where no
further work can be queued, and before anything is freed.

Reported by the Sashiko review bot as a pre-existing issue, in its review
of an earlier nv04 FIFO series of mine, and confirmed against the source.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260812231330.705425-1-mczernohous@gmail.com?part=1
Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366002.3748010.4096452389040554615@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_connector.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 7c6d91ee2722d4..f9662e067c56c1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -397,6 +397,7 @@ nouveau_connector_destroy(struct drm_connector *connector)
 	struct nouveau_connector *nv_connector = nouveau_connector(connector);
 	nvif_event_dtor(&nv_connector->irq);
 	nvif_event_dtor(&nv_connector->hpd);
+	cancel_work_sync(&nv_connector->irq_work);
 	kfree(nv_connector->edid);
 	drm_connector_unregister(connector);
 	drm_connector_cleanup(connector);

From ddae760f399709fdfbf295a06f8eea557302ad9a Mon Sep 17 00:00:00 2001
From: Marek Czernohous <marek@czernohous.de>
Date: Sat, 15 Aug 2026 21:54:20 +0200
Subject: [PATCH 1032/1982] drm/nouveau: don't dereference outp before checking
 it in nouveau_dp_irq

[ Upstream commit 843bc34db94bff0612c8294861b156489958897b ]

nouveau_dp_irq() looks the encoder up and dereferences it in the same
breath, five lines before testing it:

	struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
	struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
	...
	if (!outp)
		return;

find_encoder() walks the connector's possible encoders and returns NULL
when none of them matches the requested type, so the NULL test is not
decoration: it is the author saying this can happen. The initialiser
above it dereferences the same pointer regardless.

The NULL test predates the dereference. commit 773eb04d14a1
("drm/nouveau/disp: expose conn event class") turned nouveau_dp_irq()
into a work callback, and since the drm pointer was no longer passed in
as an argument it was recovered from the encoder in the declaration
block, which put the dereference above the existing test.

Move the drm lookup below the test. No functional change when outp is
non-NULL.

Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/178682366004.3748010.14933649768375463967@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_dp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index 55691ec44abaa5..738802358d85c9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -486,7 +486,7 @@ nouveau_dp_irq(struct work_struct *work)
 		container_of(work, typeof(*nv_connector), irq_work);
 	struct drm_connector *connector = &nv_connector->base;
 	struct nouveau_encoder *outp = find_encoder(connector, DCB_OUTPUT_DP);
-	struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
+	struct nouveau_drm *drm;
 	struct nv50_mstm *mstm;
 	u64 hpd = 0;
 	int ret;
@@ -494,6 +494,8 @@ nouveau_dp_irq(struct work_struct *work)
 	if (!outp)
 		return;
 
+	drm = nouveau_drm(outp->base.base.dev);
+
 	mstm = outp->dp.mstm;
 	NV_DEBUG(drm, "service %s\n", connector->name);
 

From dc715d660d9255ed016b41a624e5dee69c0840a4 Mon Sep 17 00:00:00 2001
From: YuBiao Wang <YuBiao.Wang@amd.com>
Date: Wed, 29 Jul 2026 17:53:57 +0800
Subject: [PATCH 1033/1982] drm/amdgpu: recompute the dw estimate after
 allocating a new VM update job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a74c7832b11827907de560169c7d4ac94505fd87 ]

amdgpu_vm_sdma_update() keeps the number of free dwords of the current
job in a local variable. When the job runs out of room it is committed
and a new one is allocated, but that local variable is not refreshed and
still describes the job which was just submitted.

The stale value is then used to decide how many PTEs fit into the new
job. If it happens to be copy_pte_num_dw + 7, or one more than that, the
result is zero. copy_pte() encodes the transfer size as count * 8 - 1,
so a count of zero asks the engine for a 1GB copy starting inside the IB
pool. That runs off the end of the pool, faults on the first unmapped
GART page above it and hangs the ring.

Re-initialize the estimate from the newly allocated job, which is empty
and therefore has its full budget available.

Cc: stable@vger.kernel.org
Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
index 36805dcfa15988..902d0a538e4199 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c
@@ -254,6 +254,11 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,
 						     AMDGPU_KERNEL_JOB_ID_VM_UPDATE);
 			if (r)
 				return r;
+
+			/* The estimate above describes the job which was just
+			 * submitted, take the budget of the newly allocated one.
+			 */
+			ndw = p->num_dw_left;
 		}
 
 		if (!p->pages_addr) {

From 57a52158ca8cc8207ce957dbac8ec5ccbf33aedc Mon Sep 17 00:00:00 2001
From: Harry Wentland <harry.wentland@amd.com>
Date: Fri, 14 Aug 2026 17:18:16 -0400
Subject: [PATCH 1034/1982] drm/amd/display: Force GAMCOR for subsampled
 surfaces with PQ/Gamma22/HLG

[ Upstream commit 2ffaa7c4050605cb27756f5336f778d1b21268b9 ]

The ROM early-return checks for PQ, Gamma 2.2, and HLG in
mod_color_calculate_degamma_params() do not consider the map_user_ramp
parameter. When map_user_ramp is true (indicating a subsampled surface
that requires post-scaler degamma via GAMCOR), the function still takes
the ROM path, programming PRE_DEGAM instead.

For subsampled formats the chroma channels must be upsampled by the
scaler before degamma is applied. PRE_DEGAM sits before the scaler in
the pipeline (CNVC domain), while GAMCOR sits after it (CM domain).
Using the ROM for subsampled surfaces means degamma is applied to
subsampled chroma before upsampling, producing incorrect results.

Fix by gating the dcn_arch ROM capability checks on !map_user_ramp,
forcing PQ/Gamma22/HLG through the GAMCOR LUT path when the surface
is subsampled.

Fixes: a8bf71649088 ("drm/amd/display: Internal refactoring to abstract color caps")
Cc: stable@vger.kernel.org
Assisted-by: Copilot:claude-opus-4.6
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Tested-by: Robert Mader <robert.mader@collabora.com>
Link: https://patch.msgid.link/20260814211816.1219597-11-harry.wentland@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index a71df052cf2523..7103d8cfb4799b 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1694,7 +1694,8 @@ bool mod_color_calculate_degamma_params(struct dc_color_caps *dc_caps,
 			return true;
 
 		if (dc_caps != NULL &&
-			dc_caps->dpp.dcn_arch == 1) {
+			dc_caps->dpp.dcn_arch == 1 &&
+			!map_user_ramp) {
 
 			if (input_tf->tf == TRANSFER_FUNCTION_PQ &&
 					dc_caps->dpp.dgam_rom_caps.pq == 1)

From b59e31d1145d195bcfba2ed7b3e1138da1cb3115 Mon Sep 17 00:00:00 2001
From: Jakub Szczudlo <jakubszczudlo40@gmail.com>
Date: Tue, 4 Aug 2026 21:28:38 +0200
Subject: [PATCH 1035/1982] iio: adc: ti-ads1100: Fix incorrect reading when
 datarate changed in single mode

[ Upstream commit 38dbf24dfbd0a73b89fa2871a7148429aef05531 ]

When device is suspended and it is in single mode then changing
datarate doesn't make it actually wait for new measurement, so to
be sure that read after change is correct, functions that changes
datarate and gain will wait for a new data.

Fixes: 541880542f2b ("iio: adc: Add TI ADS1100 and ADS1000")
Signed-off-by: Jakub Szczudlo <jakubszczudlo40@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/ti-ads1100.c | 107 +++++++++++++++++++++++++++++++++--
 1 file changed, 103 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/adc/ti-ads1100.c b/drivers/iio/adc/ti-ads1100.c
index aa8946063c7d6d..5c08bed48018c9 100644
--- a/drivers/iio/adc/ti-ads1100.c
+++ b/drivers/iio/adc/ti-ads1100.c
@@ -15,10 +15,12 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
+#include <linux/iopoll.h>
 #include <linux/mutex.h>
 #include <linux/property.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
+#include <linux/time.h>
 #include <linux/units.h>
 
 #include <linux/iio/iio.h>
@@ -43,6 +45,9 @@
 static const int ads1100_data_rate[] = { 128, 32, 16, 8 };
 static const int ads1100_data_rate_bits[] = { 12, 14, 15, 16 };
 
+/* Timeout based on the minimum sample rate of 8 SPS (7500ms) */
+#define ADS1100_MAX_DRDY_TIMEOUT_US	(7500 * USEC_PER_MSEC)
+
 struct ads1100_data {
 	struct i2c_client *client;
 	struct regulator *reg_vdd;
@@ -123,10 +128,86 @@ static int ads1100_get_adc_result(struct ads1100_data *data, int chan, int *val)
 	return 0;
 }
 
+static int ads1100_conversion_busy(struct ads1100_data *data)
+{
+	u8 buffer[3];
+	int ret;
+
+	ret = i2c_master_recv(data->client, (char *)&buffer, sizeof(buffer));
+	if (ret < 0) {
+		dev_err(&data->client->dev, "I2C read fail: %d\n", ret);
+		return ret;
+	}
+
+	return FIELD_GET(ADS1100_CFG_ST_BSY, buffer[2]);
+}
+
+static int ads1100_wait_single_conversion(struct ads1100_data *data)
+{
+	int data_rate_index = FIELD_GET(ADS1100_DR_MASK, data->config);
+	int data_rate_Hz = ads1100_data_rate[data_rate_index];
+	unsigned long poll_us = DIV_ROUND_CLOSEST(USEC_PER_SEC, data_rate_Hz) / 4;
+	int busy;
+	int ret;
+
+	ret = readx_poll_timeout(ads1100_conversion_busy, data,
+				 busy, busy <= 0,
+				 poll_us, ADS1100_MAX_DRDY_TIMEOUT_US);
+	if (busy < 0)
+		return busy;
+
+	return ret;
+}
+
+static int ads1100_start_single_conversion(struct ads1100_data *data)
+{
+	u8 config = data->config | ADS1100_CFG_SC;
+	int ret;
+
+	ret = i2c_master_send(data->client, &config, sizeof(config));
+	if (ret < 0) {
+		dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+		return ret;
+	}
+	/* Need to wait because of change from continuous to single mode */
+	ret = ads1100_wait_single_conversion(data);
+	if (ret)
+		return ret;
+
+	config |= ADS1100_CFG_ST_BSY;
+
+	ret = i2c_master_send(data->client, &config, sizeof(config));
+	if (ret < 0) {
+		dev_err(&data->client->dev, "I2C write fail: %d\n", ret);
+		return ret;
+	}
+
+	/* No need to cache it, it's status bit */
+	data->config = config & ~ADS1100_CFG_ST_BSY;
+
+	return 0;
+}
+
+static int ads1100_poll_data_ready(struct ads1100_data *data)
+{
+	int ret;
+
+	ret = ads1100_start_single_conversion(data);
+	if (ret)
+		return ret;
+
+	ret = ads1100_wait_single_conversion(data);
+	if (ret)
+		return ret;
+
+	return ads1100_set_config_bits(data, ADS1100_CFG_SC, ADS1100_CONTINUOUS);
+}
+
 static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
 {
 	int microvolts;
 	int gain;
+	int ret;
 
 	/* With Vdd between 2.7 and 5V, the scale is always below 1 */
 	if (val)
@@ -135,6 +216,11 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
 	if (!val2)
 		return -EINVAL;
 
+	PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+	ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+	if (ret)
+		return ret;
+
 	microvolts = regulator_get_voltage(data->reg_vdd);
 	/*
 	 * val2 is in 'micro' units, n = val2 / 1000000
@@ -149,22 +235,35 @@ static int ads1100_set_scale(struct ads1100_data *data, int val, int val2)
 
 	ads1100_set_config_bits(data, ADS1100_PGA_MASK, ffs(gain) - 1);
 
-	return 0;
+	return ads1100_poll_data_ready(data);
 }
 
 static int ads1100_set_data_rate(struct ads1100_data *data, int chan, int rate)
 {
 	unsigned int i;
 	unsigned int size;
+	int ret;
 
 	size = data->supports_data_rate ? ARRAY_SIZE(ads1100_data_rate) : 1;
 	for (i = 0; i < size; i++) {
 		if (ads1100_data_rate[i] == rate)
-			return ads1100_set_config_bits(data, ADS1100_DR_MASK,
-						       FIELD_PREP(ADS1100_DR_MASK, i));
+			break;
 	}
 
-	return -EINVAL;
+	if (i == size)
+		return -EINVAL;
+
+	PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(&data->client->dev, pm);
+	ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+	if (ret)
+		return ret;
+
+	ret = ads1100_set_config_bits(data, ADS1100_DR_MASK,
+				      FIELD_PREP(ADS1100_DR_MASK, i));
+	if (ret)
+		return ret;
+
+	return ads1100_poll_data_ready(data);
 }
 
 static int ads1100_get_vdd_millivolts(struct ads1100_data *data)

From fc075bead27062522e26c74a7e719ccd031b558d Mon Sep 17 00:00:00 2001
From: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Date: Fri, 21 Aug 2026 10:45:39 +0200
Subject: [PATCH 1036/1982] cpufreq: airoha: fix probe failure with correct
 error check

[ Upstream commit 801ade22c4fc078ea9b11e1f3fe3aae8b8bef886 ]

dev_pm_domain_attach_list() returns the number of attached PM domains
on success (a positive count), or a negative error code on failure.
The driver checks "if (ret)" which treats a successful attachment of
one or more PM domains as an error, causing the probe to fail with
return code 1.

Fix by checking "if (ret < 0)" like all other users of this API.

Cc: stable@vger.kernel.org
Fixes: 84cf9e541ccc ("cpufreq: airoha: Add EN7581 CPUFreq SMCCC driver")
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/airoha-cpufreq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cpufreq/airoha-cpufreq.c b/drivers/cpufreq/airoha-cpufreq.c
index b6b1cdc4d11d69..ec9b2fc00f5e0e 100644
--- a/drivers/cpufreq/airoha-cpufreq.c
+++ b/drivers/cpufreq/airoha-cpufreq.c
@@ -64,7 +64,7 @@ static int airoha_cpufreq_probe(struct platform_device *pdev)
 	/* Attach PM for OPP */
 	ret = dev_pm_domain_attach_list(cpu_dev, &attach_data,
 					&priv->pd_list);
-	if (ret)
+	if (ret < 0)
 		goto clear_opp_config;
 
 	cpufreq_dt = platform_device_register_simple("cpufreq-dt", -1, NULL, 0);

From 5f475e1c007bd33bb54900a6eacd48abcf2317cf Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 12:25:43 +0100
Subject: [PATCH 1037/1982] media: streamzap: Add missing
 rc_unregister_device()

[ Upstream commit 3982d2eeb1bdf7a9c14e4ff69015cb456f11da51 ]

If usb_submit_urb() fails during probe, then the error path is missing a
call to rc_unregister_device(), which will leak various things like the
input device.

Fixes: 42844992664f ("media: rc: streamzap: Error handling in probe")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/streamzap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 8c85b9f30a3a96..e91cf2ffbc8760 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -365,6 +365,7 @@ static int streamzap_probe(struct usb_interface *intf,
 
 	return 0;
 rc_submit_fail:
+	rc_unregister_device(sz->rdev);
 	rc_free_device(sz->rdev);
 	usb_set_intfdata(intf, NULL);
 rc_dev_fail:

From 4c443c088a37a346a1cd4894e8b0523a9bf5cef1 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 13:57:10 +0100
Subject: [PATCH 1038/1982] media: redrat3: Ensure we don't read beyond the end
 of the packet

[ Upstream commit cd49f62f4161c7340d9c9f53b67757575900c0bc ]

The length and offset is provided by the usb device, so it should be
validated.

Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/redrat3.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3170bd72a8e6f1..4cbbe16a8ac470 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -358,8 +358,24 @@ static void redrat3_process_ir_data(struct redrat3_dev *rr3)
 
 	/* process each rr3 encoded byte into an int */
 	sig_size = be16_to_cpu(rr3->irdata.sig_size);
+
+	/*
+	 * Note we are not checking if we are reading beyond the end of the
+	 * packet which was sent, and reading stale data. If the device
+	 * sends a packet which is short then we get garbage IR, but no
+	 * out of bounds read.
+	 */
+	if (sig_size > RR3_MAX_SIG_SIZE) {
+		dev_err(dev, "length %u is incorrect\n", sig_size);
+		return;
+	}
+
 	for (i = 0; i < sig_size; i++) {
 		offset = rr3->irdata.sigdata[i];
+		if (offset >= RR3_DRIVER_MAXLENS) {
+			dev_err(dev, "offset %u is incorrect\n", offset);
+			return;
+		}
 		val = get_unaligned_be16(&rr3->irdata.lens[offset]);
 
 		/* we should always get pulse/space/pulse/space samples */

From 7d7521a954adb036e38cd353c595d527fd37c891 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 13 Jul 2026 13:04:31 +0100
Subject: [PATCH 1039/1982] media: redrat3: Ensure all urbs are suspended

[ Upstream commit 1582f545273f2aa4eb4ee6f3a89b433f5c85c68f ]

Ensure that the learn urb is stopped before suspend.

Fixes: c49fcdde38cb ("[media] redrat3: enable carrier reports using wideband receiver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/redrat3.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 4cbbe16a8ac470..c9a5c030f7726c 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1170,6 +1170,7 @@ static int redrat3_dev_suspend(struct usb_interface *intf, pm_message_t message)
 	usb_kill_urb(rr3->narrow_urb);
 	usb_kill_urb(rr3->wide_urb);
 	usb_kill_urb(rr3->flash_urb);
+	usb_kill_urb(rr3->learn_urb);
 	return 0;
 }
 

From ddaf428a0f8a163ab60fb7101a5533fe5a63e9e4 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 12:37:04 +0100
Subject: [PATCH 1040/1982] media: sunxi-cir: Ensure no more interrupts can
 occur before free

[ Upstream commit f9b33ec404200c03dd490ec133b8f9bf599c5444 ]

Only call rc_free_device() once the hardware has been stopped.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/sunxi-cir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
index 28e840a7e5b8c3..af1ee08ffdbec8 100644
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
 	struct sunxi_ir *ir = platform_get_drvdata(pdev);
 
 	rc_unregister_device(ir->rc);
-	rc_free_device(ir->rc);
 	sunxi_ir_hw_exit(&pdev->dev);
+	rc_free_device(ir->rc);
 }
 
 static void sunxi_ir_shutdown(struct platform_device *pdev)

From a842af958b4e870783f566dd5758474552beadf5 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 13:13:29 +0100
Subject: [PATCH 1041/1982] media: meson-ir-tx: Ensure clock is disabled on
 unbind

[ Upstream commit 1517326fcc9dfdb9acb24f42472366ac1b4b8237 ]

clk_prepare_enable() needs a call to clk_disable_unprepare() on
driver unbind. Make it devm managed.

Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/meson-ir-tx.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index fded2c256f2a62..6beb9e97453dde 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -288,11 +288,12 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
 	if (!np)
 		return -ENODEV;
 
-	clock = devm_clk_get(ir->dev, "xtal");
-	if (IS_ERR(clock) || clk_prepare_enable(clock))
+	*clk_nr = IRB_MOD_XTAL3_CLK;
+
+	clock = devm_clk_get_enabled(ir->dev, "xtal");
+	if (IS_ERR(clock))
 		return -ENODEV;
 
-	*clk_nr = IRB_MOD_XTAL3_CLK;
 	ir->clk_rate = clk_get_rate(clock) / 3;
 
 	if (ir->clk_rate < IRB_MOD_1US_CLK_RATE) {

From 36c95ef77d4343cdd403f8b8ba8b8b8bab6b15a8 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 6 Jul 2026 19:24:59 +0100
Subject: [PATCH 1042/1982] media: meson-ir-tx: Ensure rc_free_device() is
 called on unbind

[ Upstream commit 32999b8a9d5c4f497c9739e70ac4ee390cd650a7 ]

Make rc_dev devm managed.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/meson-ir-tx.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 6beb9e97453dde..e8e3c1a303279c 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -346,7 +346,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
 	if (ret)
 		return dev_err_probe(dev, ret, "irq request failed\n");
 
-	rc = rc_allocate_device(RC_DRIVER_IR_RAW_TX);
+	rc = devm_rc_allocate_device(dev, RC_DRIVER_IR_RAW_TX);
 	if (!rc)
 		return -ENOMEM;
 
@@ -359,10 +359,8 @@ static int meson_irtx_probe(struct platform_device *pdev)
 	rc->s_tx_duty_cycle = meson_irtx_set_duty_cycle;
 
 	ret = devm_rc_register_device(dev, rc);
-	if (ret < 0) {
-		rc_free_device(rc);
+	if (ret < 0)
 		return dev_err_probe(dev, ret, "rc_dev registration failed\n");
-	}
 
 	return 0;
 }

From 7f8cd3cfcba75ce80cabf346c6227a189cdd6f81 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 13 Jul 2026 13:52:43 +0100
Subject: [PATCH 1043/1982] media: meson-ir-tx: Ensure probe error is
 propagated

[ Upstream commit 2eb8a4cba70f521a8217021e227cfa28ba17724b ]

devm_clk_get_enabled() may return -EPROBE_DEFER which needs to be
propagated else the probe will not be deferred, it will fail instead.

Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/meson-ir-tx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index e8e3c1a303279c..1ab898069e67ff 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -292,7 +292,7 @@ static int meson_irtx_mod_clock_probe(struct meson_irtx *ir,
 
 	clock = devm_clk_get_enabled(ir->dev, "xtal");
 	if (IS_ERR(clock))
-		return -ENODEV;
+		return PTR_ERR(clock);
 
 	ir->clk_rate = clk_get_rate(clock) / 3;
 
@@ -325,7 +325,7 @@ static int meson_irtx_probe(struct platform_device *pdev)
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0)
-		return -ENODEV;
+		return irq;
 
 	ir->dev = dev;
 	ir->carrier = MIRTX_DEFAULT_CARRIER;

From eae391f3821000c84cb78163080c200d132b3466 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 7 Jul 2026 18:10:02 +0100
Subject: [PATCH 1044/1982] media: ir-hix5hd2: Ensure rdev is setup before
 interrupts are enabled

[ Upstream commit f7509d2567cf92eeccc31c363a2e2ae43188930c ]

Once the interrupt handler is enabled, priv->rdev can be used. Ensure
it is setup correctly so there is no race condition.

Fixes: a84fcdaa9058 ("[media] rc: Introduce hix5hd2 IR transmitter driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ir-hix5hd2.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index bb0f95833df57e..04982ffde68f9f 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -316,6 +316,9 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
 	if (ret < 0)
 		goto clkerr;
 
+	priv->rdev = rdev;
+	priv->dev = dev;
+
 	if (devm_request_irq(dev, priv->irq, hix5hd2_ir_rx_interrupt,
 			     0, pdev->name, priv) < 0) {
 		dev_err(dev, "IRQ %d register failed\n", priv->irq);
@@ -323,8 +326,6 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
 		goto regerr;
 	}
 
-	priv->rdev = rdev;
-	priv->dev = dev;
 	platform_set_drvdata(pdev, priv);
 
 	return ret;

From 52f216b8784f8ee32972d05b7d4827d3426b8413 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Wed, 24 Jun 2026 00:32:08 +0000
Subject: [PATCH 1045/1982] media: imx-jpeg: finish the job on device_run()
 error paths

[ Upstream commit 30b35fd2b999e1b8c26f8191d974d20c8848d2d6 ]

mxc_jpeg_device_run() returns early through a shared "end" label on several
error paths (no free slot, mxc_jpeg_alloc_slot_data() failure, or missing
buffers or queue data), and none of them calls v4l2_m2m_job_finish().
Since the delayed work is queued only after the hardware is started, those
paths neither finish the job directly nor queue timeout work that could
finish it later. The job is left with TRANS_RUNNING set, so the
wait_event() in v4l2_m2m_cancel_job() (reached from v4l2_m2m_ctx_release()
at close) waits indefinitely and the close hangs.

mxc_jpeg_alloc_slot_data() uses dma_alloc_coherent(), so the failure path
is reachable under memory pressure.

Return the src/dst buffers with VB2_BUF_STATE_ERROR and call
v4l2_m2m_job_finish() on those paths: paths that have buffers use a
"buf_finish" label; the no-buffer path uses "job_finish" directly. This
mirrors the existing jpeg_parse_error path.

This bug was found by static analysis.

Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/nxp/imx-jpeg/mxc-jpeg.c    | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index 4ac4f576fdd108..9f0794dd5c5449 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -1525,15 +1525,15 @@ static void mxc_jpeg_device_run(void *priv)
 	dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
 	if (!src_buf || !dst_buf) {
 		dev_err(dev, "Null src or dst buf\n");
-		goto end;
+		goto job_finish;
 	}
 
 	q_data_cap = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
 	if (!q_data_cap)
-		goto end;
+		goto buf_finish;
 	q_data_out = mxc_jpeg_get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
 	if (!q_data_out)
-		goto end;
+		goto buf_finish;
 	src_buf->sequence = q_data_out->sequence++;
 	dst_buf->sequence = q_data_cap->sequence++;
 
@@ -1571,11 +1571,11 @@ static void mxc_jpeg_device_run(void *priv)
 	ctx->slot = mxc_get_free_slot(&jpeg->slot_data);
 	if (ctx->slot < 0) {
 		dev_err(dev, "No more free slots\n");
-		goto end;
+		goto buf_finish;
 	}
 	if (!mxc_jpeg_alloc_slot_data(jpeg)) {
 		dev_err(dev, "Cannot allocate slot data\n");
-		goto end;
+		goto buf_finish;
 	}
 
 	mxc_jpeg_enable_slot(reg, ctx->slot);
@@ -1597,8 +1597,17 @@ static void mxc_jpeg_device_run(void *priv)
 		mxc_jpeg_dec_mode_go(dev, reg);
 	}
 	schedule_delayed_work(&ctx->task_timer, msecs_to_jiffies(hw_timeout));
-end:
+
 	spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+	return;
+buf_finish:
+	v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+	v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+	v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
+	v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
+job_finish:
+	spin_unlock_irqrestore(&ctx->mxc_jpeg->hw_lock, flags);
+	v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
 }
 
 static int mxc_jpeg_decoder_cmd(struct file *file, void *priv,

From ae3bdd1941d7686fef6c411e6e7141dd5295dcda Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Thu, 13 Aug 2026 04:40:26 +0200
Subject: [PATCH 1046/1982] microblaze: Fix MB_MANAGER build with older
 binutils

[ Upstream commit 79c8aa4da3d5453dd956d2170d1c9c716311ea06 ]

Commit 88707ebe77e2 ("microblaze: Add custom break vector handler for mb
manager") added the suspend mnemonic to the MB Manager break handler.

GNU as only learned this mnemonic in binutils 2.42. Linux supports
binutils 2.30, where enabling CONFIG_MB_MANAGER fails:

  arch/microblaze/kernel/entry.S:946: Error: unknown opcode "suspend"

The suspend mnemonic is an alias for mbar 24, and both encode as
0xbb020004. Use the underlying instruction, which GNU as 2.30 already
supports.

Fixes: 88707ebe77e2 ("microblaze: Add custom break vector handler for mb manager")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310310151.UhB396Qs-lkp@intel.com/
Suggested-by: Michal Simek <monstr@monstr.eu>
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260813024026.5402-1-kmehltretter@gmail.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/kernel/entry.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 582d7256d81547..ad44341a5dbc72 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -943,7 +943,7 @@ ret_from_break:
 	mbar	1
 	mbar	2
 	bri	4
-	suspend
+	mbar	24 /* suspend */
 	nop
 #endif
 

From 7b6d1a6763e6acbb99f12c16244b3016c865eb2e Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 31 Aug 2026 11:17:14 +0200
Subject: [PATCH 1047/1982] udf: Make sure there's enough space for LVID
 implementation use field

[ Upstream commit a61fb39759d719a4f4966742b4d28387e33d81c4 ]

udf_lvid_valid() verifies that the LVID has enough space for all the
tables and the reported length of ImplementationUse field. However it
doesn't make sure the reported length is large enough to contain
logicalVolIntegrityDescImpUse structure which OSTA specification
requires. This can thus lead to accesses beyond the end of LVID buffer
for suitably corrupted UDF filesystem. Add the length check.

Reported-by: Yunpeng Tian <shionthanatos@gmail.com>
Reported-by: Gongming Wang <gmwgg05@gmail.com>
Reported-by: Mingda Zhang <npczmd@qq.com>
Reported-by: Qinrun Dai <jupmouse@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 781d2a9a2fc7 ("udf: Check LVID earlier")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/super.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index f91b231b7d7bda..556540f2797aec 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1611,7 +1611,10 @@ static bool udf_lvid_valid(struct super_block *sb,
 
 	parts = le32_to_cpu(lvid->numOfPartitions);
 	impuselen = le32_to_cpu(lvid->lengthOfImpUse);
-	if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+	if (sizeof(struct logicalVolIntegrityDescImpUse) > impuselen ||
+	    impuselen >= sb->s_blocksize)
+		return false;
+	if (parts >= sb->s_blocksize ||
 	    sizeof(struct logicalVolIntegrityDesc) + impuselen +
 	    2 * parts * sizeof(u32) > sb->s_blocksize)
 		return false;

From 96540793dd7e55b81e0724e9efa024bbd26dbfaa Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Thu, 13 Aug 2026 22:38:43 +0900
Subject: [PATCH 1048/1982] aio: prevent eventfd/epoll recursion on poll

[ Upstream commit 398e3fa789aa5ffddc8689d8cbc7b31e1824130c ]

aio_poll_wake() can complete a keyed poll request inline while the
provider waitqueue lock is held.  If the polled file is an epoll instance
and the AIO result eventfd is watched by that same instance, signaling the
result can feed back into epoll and try to take the provider waitqueue lock
again.

For example, a timerfd wake can follow this path:

  timerfd -> ep_poll_callback -> aio_poll_wake -> aio_complete
          -> eventfd_signal -> ep_poll_callback -> ep_poll_safewake

The second ep_poll_safewake() recursively acquires ep->poll_wait.lock.
eventfd_signal_allowed() does not prevent this because the wake chain did
not begin in eventfd, so the task's eventfd recursion bit is still clear
when aio_poll_wake() decides to complete inline.

An unprivileged process can construct this graph and make a CPU spin on the
recursive lock.  DEBUG_SPINLOCK reports "BUG: spinlock recursion", and
lockdep reports the same epoll waitqueue lock as both held and requested.

Always defer eventfd-backed poll completions through the existing
aio_poll_put_work() path.  At this point the request has already been
detached from the waitqueue and active request list, so the work item can
publish the completion after the provider callback releases its lock.
Poll completions without a result eventfd remain inline.

Fixes: e8693bcfa0b4 ("aio: allow direct aio poll comletions for keyed wakeups")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260813133843.2933127-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/aio.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/aio.c b/fs/aio.c
index 5bc1333864078e..bd92bd3e13408e 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1816,7 +1816,12 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
 		list_del_init(&req->wait.entry);
 		list_del(&iocb->ki_list);
 		iocb->ki_res.res = mangle_poll(mask);
-		if (iocb->ki_eventfd && !eventfd_signal_allowed()) {
+		/*
+		 * We hold an arbitrary provider waitqueue lock here.  Signaling a
+		 * result eventfd can feed back through epoll and try to take the same
+		 * lock again.  Defer all eventfd-backed poll completions.
+		 */
+		if (iocb->ki_eventfd) {
 			iocb = NULL;
 			INIT_WORK(&req->work, aio_poll_put_work);
 			schedule_work(&req->work);

From 58291947b70a132144e1ed6fd6a4d9e043061a34 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Mon, 24 Aug 2026 13:23:59 +0900
Subject: [PATCH 1049/1982] ipc/mqueue: release notification resources during
 inode eviction

[ Upstream commit eb85469f0dd69ca145d63117450e14c31f67f698 ]

mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.

A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table.
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.

The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference. An
unprivileged process can repeat the sequence with new queues and sockets.

No inode users remain during eviction. Remove any stale registration there
after dropping info->lock, since netlink_sendskb() may release the final
socket reference.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260824042359.925145-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/mqueue.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 093551fe66a7eb..11eaf5df3645f7 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -529,6 +529,13 @@ static void mqueue_evict_inode(struct inode *inode)
 		list_add_tail(&msg->m_list, &tmp_msg);
 	kfree(info->node_cache);
 	spin_unlock(&info->lock);
+	/*
+	 * A shared file table can let the notification owner exit without
+	 * running ->flush(). No users of the inode remain during eviction, so
+	 * tear down any stale notification after dropping info->lock because
+	 * netlink_sendskb() may release the final socket reference.
+	 */
+	remove_notification(info);
 
 	list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
 		list_del(&msg->m_list);

From 078cbede4db36844b9ac256fdc1f4b1c4c668546 Mon Sep 17 00:00:00 2001
From: HyeongJun An <sammiee5311@gmail.com>
Date: Fri, 24 Jul 2026 11:53:22 +0900
Subject: [PATCH 1050/1982] remoteproc: elf_loader: Bound the section header
 table

[ Upstream commit b32177ead5f8925aa66ceed2bd533a85196f4f0c ]

The rproc_elf_sanity_check() only checks the image is big enough to hold
one section header. But find_table() walks e_shnum of them, and first
dereferences the header at e_shstrndx to locate the section name table.
Both fields are u16 and both come from the image, so an e_shstrndx of
65535 reads about 4 MB past the buffer.

The commit 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read
past the ELF header") added the same check to the MDT loader, and says
the header "is sanitized beforehand" under remoteproc. That is what this
patch makes true.

Check e_shoff against the image size first, so the two bounds can use
size_add() without an e_shoff above SIZE_MAX wrapping on 32-bit. The
bounds are separate because e_shnum may be zero while find_table() still
reads the e_shstrndx header.

Fixes: 400e64df6b23 ("remoteproc: add framework for controlling remote processors")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260724025322.2341205-1-sammiee5311@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_elf_loader.c | 23 ++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_elf_loader.c b/drivers/remoteproc/remoteproc_elf_loader.c
index 94177e4160473c..da3cddbe7d4cb3 100644
--- a/drivers/remoteproc/remoteproc_elf_loader.c
+++ b/drivers/remoteproc/remoteproc_elf_loader.c
@@ -46,8 +46,9 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
 	struct elf32_hdr *ehdr;
 	u32 elf_shdr_get_size;
 	u64 phoff, shoff;
+	size_t shend;
 	char class;
-	u16 phnum;
+	u16 phnum, shnum, shstrndx;
 
 	if (!fw) {
 		dev_err(dev, "failed to load %s\n", name);
@@ -90,9 +91,27 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
 	phoff = elf_hdr_get_e_phoff(class, fw->data);
 	shoff = elf_hdr_get_e_shoff(class, fw->data);
 	phnum =  elf_hdr_get_e_phnum(class, fw->data);
+	shnum = elf_hdr_get_e_shnum(class, fw->data);
+	shstrndx = elf_hdr_get_e_shstrndx(class, fw->data);
 	elf_shdr_get_size = elf_size_of_shdr(class);
 
-	if (fw->size < shoff + elf_shdr_get_size) {
+	/* keeps shoff in size_t range for the two bounds below */
+	if (shoff > fw->size) {
+		dev_err(dev, "Section header table is out of bounds\n");
+		return -EINVAL;
+	}
+
+	if (shnum) {
+		shend = size_add(size_mul(elf_shdr_get_size, shnum), shoff);
+		if (shend > fw->size) {
+			dev_err(dev, "Section headers are out of bounds\n");
+			return -EINVAL;
+		}
+	}
+
+	/* find_table() reads the header at shstrndx even with no sections */
+	shend = size_add(size_mul(elf_shdr_get_size, (size_t)shstrndx + 1), shoff);
+	if (shend > fw->size) {
 		dev_err(dev, "Image is too small\n");
 		return -EINVAL;
 	}

From 211532d38f7b513d666970991006169759670c9f Mon Sep 17 00:00:00 2001
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Date: Fri, 21 Aug 2026 12:06:17 +0530
Subject: [PATCH 1051/1982] soc: qcom: geni-se: Fix endian conversion for
 serial_protocol comparison

[ Upstream commit 0231382f070df26a8b267f9e68c5440928b87c89 ]

serial_protocol is declared as __le16 in struct se_fw_hdr, but was
decoded with le32_to_cpu(). On big-endian systems the extra byte swap
causes the field to always compare unequal to the protocol argument,
so no firmware segment is ever selected.

Use le16_to_cpu() to match the field width.

Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-1-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 2fa6a45904e979..53e53736766fcb 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1059,7 +1059,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 		if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
 			continue;
 
-		if (le32_to_cpu(sefw->serial_protocol) != protocol)
+		if (le16_to_cpu(sefw->serial_protocol) != protocol)
 			continue;
 
 		if (fw_size % 2 != 0) {

From 73c7e00cea7bd6b9df062c6852e6aed9ee69f657 Mon Sep 17 00:00:00 2001
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Date: Fri, 21 Aug 2026 12:06:18 +0530
Subject: [PATCH 1052/1982] soc: qcom: geni-se: Widen fw_size to u32 to prevent
 wrap-around

[ Upstream commit e976c865bf31b562ab3908f0f1e2160da77fa156 ]

fw_size is read from the 16-bit fw_size_in_items field and incremented
when the count is odd. If fw_size_in_items == 0xffff the increment
wraps to 0 as a u16, making the bounds check below pass for a firmware
segment whose actual size was not validated. Widen fw_size to u32 so
the increment never wraps.

Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-2-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 53e53736766fcb..f73ac13e900147 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -1009,7 +1009,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 	struct se_fw_hdr *sefw;
 	u32 fw_end, cfg_idx_end, cfg_val_end;
 	u32 prog_ram_depth;
-	u16 fw_size;
+	u32 fw_size;
 	int i;
 
 	if (!fw || fw->size < sizeof(struct elf32_hdr))

From bb6277d4f59e2e91fb236cbece000dc0ba3c443c Mon Sep 17 00:00:00 2001
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Date: Fri, 21 Aug 2026 12:06:19 +0530
Subject: [PATCH 1053/1982] soc: qcom: geni-se: Fix fw_end computed before
 round-up; propagate size to caller

[ Upstream commit d1750c530e9b9b75c8d1b29d3c76e052a049f51f ]

fw_end was computed from the raw fw_size_in_items, before the odd-word
round-up. A segment with an odd word count could pass the bounds check
at the unrounded value but then be copied one word past the validated
limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after
the round-up so they always reflect the true copy extent.

The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the
memcpy_toio() length, bypassing the validated and rounded value
established by geni_find_protocol_fw(). Add a fw_size_out output
parameter and use it in the caller.

Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-3-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index f73ac13e900147..917f43192e950a 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -991,6 +991,8 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
  * @se: Pointer to the serial engine structure.
  * @fw: Pointer to the firmware image.
  * @protocol: Expected serial engine protocol type.
+ * @fw_size_out: Non-NULL output parameter; receives the rounded, validated
+ *               firmware word count on success.
  *
  * Identifies the appropriate firmware image or configuration required for a
  * specific communication protocol instance running on a Qualcomm GENI
@@ -1000,7 +1002,8 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
  * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
  */
 static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
-					       enum geni_se_protocol_type protocol)
+					       enum geni_se_protocol_type protocol,
+					       u32 *fw_size_out)
 {
 	struct device *dev = se->dev;
 	const struct elf32_hdr *ehdr;
@@ -1050,11 +1053,6 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 
 		sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
 		fw_size = le16_to_cpu(sefw->fw_size_in_items);
-		fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
-		cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
-			      le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
-		cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
-			      le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
 
 		if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
 			continue;
@@ -1067,6 +1065,12 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 			sefw->fw_size_in_items = cpu_to_le16(fw_size);
 		}
 
+		fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
+		cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
+			      le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8);
+		cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) +
+			      le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32);
+
 		prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK,
 					   readl_relaxed(se->base + SE_HW_PARAM_2));
 		if (fw_size >= prog_ram_depth) {
@@ -1081,6 +1085,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 			continue;
 		}
 
+		*fw_size_out = fw_size;
 		return sefw;
 	}
 
@@ -1191,11 +1196,11 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
 {
 	const u32 *fw_data, *cfg_val_arr;
 	const u8 *cfg_idx_arr;
-	u32 i, reg_value;
+	u32 i, reg_value, fw_size_in_items;
 	int ret;
 	struct se_fw_hdr *hdr;
 
-	hdr = geni_find_protocol_fw(se, fw, protocol);
+	hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
 	if (!hdr)
 		return -EINVAL;
 
@@ -1272,7 +1277,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
 
 	/* Program RAM address space. */
 	memcpy_toio(se->base + SE_GENI_CFG_RAMN, fw_data,
-		    le16_to_cpu(hdr->fw_size_in_items) * sizeof(u32));
+		    fw_size_in_items * sizeof(u32));
 
 	/* Put default values on GENI's output pads. */
 	writel_relaxed(0x1, se->base + GENI_FORCE_DEFAULT_REG);

From ed48f8b0ec58dd970acb5ab8cedb29f11dd8a576 Mon Sep 17 00:00:00 2001
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Date: Fri, 21 Aug 2026 12:06:20 +0530
Subject: [PATCH 1054/1982] soc: qcom: geni-se: Fix write to read-only firmware
 buffer

[ Upstream commit 28b9c15f1829fff7b26db0dbbbde1c6b466cb156 ]

geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
pointer and writes back the rounded-up fw_size value:

        sefw->fw_size_in_items = cpu_to_le16(fw_size);

The firmware subsystem maps the firmware blob read-only. Writing through
the cast pointer causes a level-3 permission fault on AArch64 and
crashes the kernel during driver probe.

The write-back is no longer necessary: geni_find_protocol_fw() now
propagates the rounded size to the caller via fw_size_out. Remove the
write-back and make sefw (and the hdr pointer in the caller)
const-correct.

Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-4-43e6a3abd651@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 917f43192e950a..f85cac34c7260d 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -999,17 +999,17 @@ EXPORT_SYMBOL_GPL(geni_icc_disable);
  * controller. Validates the firmware size against the hardware PROG_RAM_DEPTH
  * read from SE_HW_PARAM_2.
  *
- * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise.
+ * Return: pointer to a valid 'const struct se_fw_hdr' if found, or NULL otherwise.
  */
-static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
-					       enum geni_se_protocol_type protocol,
-					       u32 *fw_size_out)
+static const struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw,
+						     enum geni_se_protocol_type protocol,
+						     u32 *fw_size_out)
 {
 	struct device *dev = se->dev;
 	const struct elf32_hdr *ehdr;
 	const struct elf32_phdr *phdrs;
 	const struct elf32_phdr	*phdr;
-	struct se_fw_hdr *sefw;
+	const struct se_fw_hdr *sefw;
 	u32 fw_end, cfg_idx_end, cfg_val_end;
 	u32 prog_ram_depth;
 	u32 fw_size;
@@ -1051,7 +1051,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 		if (phdr->p_filesz < sizeof(struct se_fw_hdr))
 			continue;
 
-		sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset);
+		sefw = (const struct se_fw_hdr *)(fw->data + phdr->p_offset);
 		fw_size = le16_to_cpu(sefw->fw_size_in_items);
 
 		if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1)
@@ -1060,10 +1060,8 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct
 		if (le16_to_cpu(sefw->serial_protocol) != protocol)
 			continue;
 
-		if (fw_size % 2 != 0) {
+		if (fw_size % 2 != 0)
 			fw_size++;
-			sefw->fw_size_in_items = cpu_to_le16(fw_size);
-		}
 
 		fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32);
 		cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) +
@@ -1198,15 +1196,15 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw,
 	const u8 *cfg_idx_arr;
 	u32 i, reg_value, fw_size_in_items;
 	int ret;
-	struct se_fw_hdr *hdr;
+	const struct se_fw_hdr *hdr;
 
 	hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items);
 	if (!hdr)
 		return -EINVAL;
 
-	fw_data = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->fw_offset));
+	fw_data = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->fw_offset));
 	cfg_idx_arr = (const u8 *)hdr + le16_to_cpu(hdr->cfg_idx_offset);
-	cfg_val_arr = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
+	cfg_val_arr = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset));
 
 	ret = geni_icc_set_bw(se);
 	if (ret)

From ba4121a804ada22bef4b35adfef5b7198c6e1b86 Mon Sep 17 00:00:00 2001
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
Date: Fri, 21 Aug 2026 17:18:06 +0200
Subject: [PATCH 1055/1982] microblaze: reserve the ABI argument-home area in
 the signal frame

[ Upstream commit c5947d28c20955de897eeb98430f96db0494f7d7 ]

The MicroBlaze procedure call standard reserves [r1+0] for the return
address and lets a callee store its incoming register arguments r5..r10
into the caller-provided home slots at [r1+4]..[r1+24].  When the kernel
enters a signal handler it sets r1 to point at struct rt_sigframe, whose
leading member is the siginfo prepared for the handler.  A handler that
homes its arguments - which an unoptimised (-O0) build always does -
therefore overwrites the first 24 bytes of that siginfo, so an
SA_SIGINFO handler reads corrupted values.  The stores stay within
siginfo (128 bytes) and do not reach the ucontext behind it.

Reserve the home area by making a seven-word gap -- the return-address
slot plus the six argument slots, 28 bytes -- the first member of struct
rt_sigframe, so the handler's argument stores land in scratch space
instead of clobbering siginfo.

Tested on qemu-system-microblazeel (petalogix-s3adsp1800) with the
uClibc-ng NPTL test suite: tst-timer4, tst-timer5, tst-mqueue5 and
tst-signal6 pass; before this change they failed because the handler
clobbered the signal frame.

Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-3-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/kernel/signal.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index c78a0ff480660d..4956014a993797 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -49,6 +49,14 @@ struct sigframe {
 };
 
 struct rt_sigframe {
+	/*
+	 * Home area for the handler's register arguments: the MicroBlaze
+	 * ABI reserves [r1+0] for the return address and lets the callee
+	 * store r5..r10 at [r1+4]..[r1+24], and r1 points at this frame
+	 * when the handler is entered.  Without the gap those stores
+	 * corrupt frame->info.
+	 */
+	unsigned long abi_gap[7];
 	struct siginfo info;
 	struct ucontext uc;
 	unsigned long tramp[2];	/* signal trampoline */

From 87f78edf4b3deb58a8405d7eb401312aca7229c8 Mon Sep 17 00:00:00 2001
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
Date: Fri, 21 Aug 2026 17:18:07 +0200
Subject: [PATCH 1056/1982] microblaze: don't clobber r3/r4 restored by
 rt_sigreturn

[ Upstream commit da6829138a39fa3b9ec318ca54ff89af9d94d350 ]

ret_from_trap begins by storing the system call return values r3 and r4
back into the saved user pt_regs.  That is right for an ordinary system
call, but sys_rt_sigreturn() returns through the same path and has to be
transparent: restore_sigcontext() has just filled pt_regs from the signal
frame, and every register must reach userspace exactly as saved.  The two
stores overwrite the restored r3/r4 with whatever the C function left in
those registers.

Only r4 is actually lost, and that follows from how sigreturn is written
everywhere rather than from chance.  Architectures have sys_rt_sigreturn()
return the restored return-value register precisely so that this writeback
stores the restored value -- arm returns regs->ARM_r0, riscv and csky
regs->a0, arc regs->r0 -- and microblaze does the same through
*rval_p = regs->r3 in restore_sigcontext().  But the entry macros treat r3
and r4 as a pair, so ret_from_trap writes back two registers while a C
function has only one return value; nothing carries the restored r4.

Commit 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper") introduced
this in v2.6.37.  The old wrapper saved r3/r4 before the call and reloaded
them from pt_regs afterwards; switching brlid to brid removed the only
point where they were reloaded, and the stores have been overwriting them
ever since.

Fix it the way the sibling paths already behave: ret_from_irq and
ret_from_exc restore the full register set and do not perform these stores
at all.  Label the instruction after the stores ret_from_trap_no_rval and
enter there, biasing r15 by -8 so that the ABI return "rtsd r15, 8" lands
on it; naming the entry rather than computing ret_from_trap + 8 keeps it
correct if the number of stores ever changes.  Restoring the old
save/reload would work too, but costs four memory accesses and a branch to
undo damage that is better not done.

Any value the compiler keeps in r4 across a signal is lost.  The tightest
windows are the lwx/swx compare-and-swap retry loops gcc emits for atomics:
in uClibc-ng's libc.so alone, 50 of 364 such loops hold the address in r4.
This is not specific to one libc -- musl passes the address as "r"(p), and
glibc has no microblaze atomic-machine.h and so uses gcc's __atomic
builtins, which expand the same way.  Triggering it needs threads plus a
signal storm, which is why it survived 15 years.

Reproduced on qemu-system-microblazeel (petalogix-s3adsp1800) by running
the uClibc-ng NPTL test tst-eintr1 40 times against an unchanged userspace:
on v7.2 built with gcc 16.2.0, 23 of 40 iterations died with SIGSEGV
without this patch and 0 of 40 with it; on v7.0 built with gcc 12.5.0 the
same comparison gave 6 of 40 against 0 of 40.  The register dump of a
failing iteration shows the signature: a zero r4 and a fault at address 0,
while r3 came back intact.

Fixes: 791d0a169b91 ("microblaze: Fix sys_rt_sigreturn_wrapper")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-4-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/kernel/entry.S | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index ad44341a5dbc72..efa4ab056fb5ff 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -434,7 +434,13 @@ C_ENTRY(_user_exception):
 C_ENTRY(ret_from_trap):
 	swi	r3, r1, PT_R3
 	swi	r4, r1, PT_R4
-
+/*
+ * Entry point for returns that must not store r3/r4 back into pt_regs,
+ * i.e. rt_sigreturn, which has already restored them from the signal
+ * context.  Reached as "rtsd r15, 8" with r15 set to this label minus 8,
+ * so it stays correct if the number of stores above ever changes.
+ */
+ret_from_trap_no_rval:
 	lwi	r11, r1, PT_MODE;
 /* See if returning to kernel mode, if so, skip resched &c.  */
 	bnei	r11, 2f;
@@ -518,6 +524,15 @@ C_ENTRY(ret_from_kernel_thread):
 
 C_ENTRY(sys_rt_sigreturn_wrapper):
 	addik	r30, r0, 0		/* no restarts */
+	/*
+	 * rt_sigreturn restores the full register set from the signal
+	 * context, so it must skip the r3/r4 syscall-return stores at the
+	 * head of ret_from_trap which would otherwise overwrite the
+	 * just-restored r3/r4.  Every C function returns with "rtsd r15, 8"
+	 * -- the ABI return, where the 8 skips the caller's branch and its
+	 * delay slot -- so bias r15 by -8 to land on ret_from_trap_no_rval.
+	 */
+	addik	r15, r0, ret_from_trap_no_rval - 8
 	brid	sys_rt_sigreturn	/* Do real work */
 	addik	r5, r1, 0;		/* add user context as 1st arg */
 

From 8237cd3e2fc24e2227c38a730ff29ad1009f48a7 Mon Sep 17 00:00:00 2001
From: Ramin Moussavi <ramin.moussavi@yacoub.de>
Date: Fri, 21 Aug 2026 17:18:08 +0200
Subject: [PATCH 1057/1982] microblaze: restore the ABI argument home area
 below pt_regs (PTO)

[ Upstream commit c35d40a3efd2e575ef51a761e983f2bf7113be6c ]

The MicroBlaze ABI has the caller reserve stack space for the arguments
it passes in registers: REG_PARM_STACK_SPACE is 24 and
OUTGOING_REG_PARM_STACK_SPACE is 1 in the gcc backend, so a callee may
write to [caller_sp + 4, caller_sp + 28).  The kernel calls C functions
from entry.S with r1 pointing at pt_regs, handing the callee license to
spill its incoming arguments over the saved registers -- the syscall
dispatch is the worst case, where the first argument slot is PT_R1, the
saved user stack pointer.

This was latent until GCC 15: since 3b9b8d6cfdf5 ("ira: Scale
save/restore costs of callee save registers with block frequency") the
allocator prefers spilling incoming arguments over copying them into
callee-saved registers, and a kernel built with gcc >= 15 (without the
TARGET_CALLEE_SAVE_COST workaround some distributions carry) corrupts
PT_R1 on the first syscall: init takes SIGSEGV and the kernel panics.

The kernel had exactly this reservation until 2011:
commit 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
removed STATE_SAVE_ARG_SPACE and with it the PTO offset, as part of
cleaning up what was thought to be copied-from-v850 leftovers.  Restore
it: the frame is STATE_SAVE_SIZE = PT_SIZE + PTO, r1 stays at the frame
base through every asm-to-C call, and the saved registers are reached
at r1 + PTO + PT_*.  PTO is 28 rather than the historic 24, which was
one word short: FIRST_PARM_OFFSET is 4 and REG_PARM_STACK_SPACE is 24,
so the area spans [sp+4, sp+28) and needs 28 bytes.  With 24 the last
argument slot overlapped pt_regs' r0 -- harmless only because r0 is the
constant-zero register.  STACK_BOUNDARY is 32 bits, so 28 needs no
further rounding.

Two places deliberately keep their mainline addressing.
hw_exception_handler.S needs no offset change: its real-mode handler
saves into the standalone pt_pool_space buffer rather than a stack
frame, and _unaligned_data_exception works through a pointer to pt_regs
in r7, where plain PT_* offsets are already right.  And the user-SP
reload after popping the frame keeps PT_R1 - PT_SIZE because PTO
cancels there: (PTO + PT_R1) - (PT_SIZE + PTO) = PT_R1 - PT_SIZE.  Both
are exactly as the pre-2011 code had them.

The instruction count is unchanged -- the same instructions with
different immediates, no per-call reservation and no trampolines.  The
cost is 28 bytes more kernel stack per saved frame.

Fixes: 6e83557c38b4 ("microblaze: Remove r0_ram pointer and PTO alignment")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-5-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/include/asm/entry.h           |  13 +
 arch/microblaze/include/asm/processor.h       |   2 +-
 arch/microblaze/kernel/entry.S                | 329 +++++++++---------
 arch/microblaze/kernel/hw_exception_handler.S |   5 +
 arch/microblaze/kernel/process.c              |   5 +-
 5 files changed, 189 insertions(+), 165 deletions(-)

diff --git a/arch/microblaze/include/asm/entry.h b/arch/microblaze/include/asm/entry.h
index 9efadf12397ca8..05acf4d7bc4b18 100644
--- a/arch/microblaze/include/asm/entry.h
+++ b/arch/microblaze/include/asm/entry.h
@@ -21,6 +21,19 @@
 
 #define PER_CPU(var) var
 
+/*
+ * The MicroBlaze ABI has the caller reserve an argument home area:
+ * REG_PARM_STACK_SPACE is 24 and OUTGOING_REG_PARM_STACK_SPACE is 1, so a
+ * callee may write to [caller_sp + 4, caller_sp + 28).  The kernel calls C
+ * with r1 at the frame base, so reserve that area below pt_regs and reach
+ * the saved registers through PTO.  This restores what 6e83557c38b4
+ * ("microblaze: Remove r0_ram pointer and PTO alignment") removed; the old
+ * value of 24 was one word short and left the last argument slot
+ * overlapping pt_regs' r0.
+ */
+#define PTO			28
+#define STATE_SAVE_SIZE		(PT_SIZE + PTO)
+
 # ifndef __ASSEMBLER__
 DECLARE_PER_CPU(unsigned int, KSP); /* Saved kernel stack pointer */
 DECLARE_PER_CPU(unsigned int, KM); /* Kernel/user mode */
diff --git a/arch/microblaze/include/asm/processor.h b/arch/microblaze/include/asm/processor.h
index d59bdfffca7cc0..595c24db272838 100644
--- a/arch/microblaze/include/asm/processor.h
+++ b/arch/microblaze/include/asm/processor.h
@@ -73,7 +73,7 @@ unsigned long __get_wchan(struct task_struct *p);
 #  define task_regs(task) ((struct pt_regs *)task_tos(task) - 1)
 
 #  define task_pt_regs_plus_args(tsk) \
-	((void *)task_pt_regs(tsk))
+	(((void *)task_pt_regs(tsk)) - PTO)
 
 #  define task_sp(task)	(task_regs(task)->r1)
 #  define task_pc(task)	(task_regs(task)->pc)
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index efa4ab056fb5ff..ebc8bcb98c5220 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -177,78 +177,78 @@ syscall_debug_table:
 1:
 
 #define SAVE_REGS \
-	swi	r2, r1, PT_R2;	/* Save SDA */			\
-	swi	r3, r1, PT_R3;					\
-	swi	r4, r1, PT_R4;					\
-	swi	r5, r1, PT_R5;					\
-	swi	r6, r1, PT_R6;					\
-	swi	r7, r1, PT_R7;					\
-	swi	r8, r1, PT_R8;					\
-	swi	r9, r1, PT_R9;					\
-	swi	r10, r1, PT_R10;					\
-	swi	r11, r1, PT_R11;	/* save clobbered regs after rval */\
-	swi	r12, r1, PT_R12;					\
-	swi	r13, r1, PT_R13;	/* Save SDA2 */			\
-	swi	r14, r1, PT_PC;	/* PC, before IRQ/trap */	\
-	swi	r15, r1, PT_R15;	/* Save LP */			\
-	swi	r16, r1, PT_R16;					\
-	swi	r17, r1, PT_R17;					\
-	swi	r18, r1, PT_R18;	/* Save asm scratch reg */	\
-	swi	r19, r1, PT_R19;					\
-	swi	r20, r1, PT_R20;					\
-	swi	r21, r1, PT_R21;					\
-	swi	r22, r1, PT_R22;					\
-	swi	r23, r1, PT_R23;					\
-	swi	r24, r1, PT_R24;					\
-	swi	r25, r1, PT_R25;					\
-	swi	r26, r1, PT_R26;					\
-	swi	r27, r1, PT_R27;					\
-	swi	r28, r1, PT_R28;					\
-	swi	r29, r1, PT_R29;					\
-	swi	r30, r1, PT_R30;					\
-	swi	r31, r1, PT_R31;	/* Save current task reg */	\
+	swi	r2, r1, PTO+PT_R2;	/* Save SDA */			\
+	swi	r3, r1, PTO+PT_R3;					\
+	swi	r4, r1, PTO+PT_R4;					\
+	swi	r5, r1, PTO+PT_R5;					\
+	swi	r6, r1, PTO+PT_R6;					\
+	swi	r7, r1, PTO+PT_R7;					\
+	swi	r8, r1, PTO+PT_R8;					\
+	swi	r9, r1, PTO+PT_R9;					\
+	swi	r10, r1, PTO+PT_R10;					\
+	swi	r11, r1, PTO+PT_R11;	/* save clobbered regs after rval */\
+	swi	r12, r1, PTO+PT_R12;					\
+	swi	r13, r1, PTO+PT_R13;	/* Save SDA2 */			\
+	swi	r14, r1, PTO+PT_PC;	/* PC, before IRQ/trap */	\
+	swi	r15, r1, PTO+PT_R15;	/* Save LP */			\
+	swi	r16, r1, PTO+PT_R16;					\
+	swi	r17, r1, PTO+PT_R17;					\
+	swi	r18, r1, PTO+PT_R18;	/* Save asm scratch reg */	\
+	swi	r19, r1, PTO+PT_R19;					\
+	swi	r20, r1, PTO+PT_R20;					\
+	swi	r21, r1, PTO+PT_R21;					\
+	swi	r22, r1, PTO+PT_R22;					\
+	swi	r23, r1, PTO+PT_R23;					\
+	swi	r24, r1, PTO+PT_R24;					\
+	swi	r25, r1, PTO+PT_R25;					\
+	swi	r26, r1, PTO+PT_R26;					\
+	swi	r27, r1, PTO+PT_R27;					\
+	swi	r28, r1, PTO+PT_R28;					\
+	swi	r29, r1, PTO+PT_R29;					\
+	swi	r30, r1, PTO+PT_R30;					\
+	swi	r31, r1, PTO+PT_R31;	/* Save current task reg */	\
 	mfs	r11, rmsr;		/* save MSR */			\
-	swi	r11, r1, PT_MSR;
+	swi	r11, r1, PTO+PT_MSR;
 
 #define RESTORE_REGS_GP \
-	lwi	r2, r1, PT_R2;	/* restore SDA */		\
-	lwi	r3, r1, PT_R3;					\
-	lwi	r4, r1, PT_R4;					\
-	lwi	r5, r1, PT_R5;					\
-	lwi	r6, r1, PT_R6;					\
-	lwi	r7, r1, PT_R7;					\
-	lwi	r8, r1, PT_R8;					\
-	lwi	r9, r1, PT_R9;					\
-	lwi	r10, r1, PT_R10;					\
-	lwi	r11, r1, PT_R11;	/* restore clobbered regs after rval */\
-	lwi	r12, r1, PT_R12;					\
-	lwi	r13, r1, PT_R13;	/* restore SDA2 */		\
-	lwi	r14, r1, PT_PC;	/* RESTORE_LINK PC, before IRQ/trap */\
-	lwi	r15, r1, PT_R15;	/* restore LP */		\
-	lwi	r16, r1, PT_R16;					\
-	lwi	r17, r1, PT_R17;					\
-	lwi	r18, r1, PT_R18;	/* restore asm scratch reg */	\
-	lwi	r19, r1, PT_R19;					\
-	lwi	r20, r1, PT_R20;					\
-	lwi	r21, r1, PT_R21;					\
-	lwi	r22, r1, PT_R22;					\
-	lwi	r23, r1, PT_R23;					\
-	lwi	r24, r1, PT_R24;					\
-	lwi	r25, r1, PT_R25;					\
-	lwi	r26, r1, PT_R26;					\
-	lwi	r27, r1, PT_R27;					\
-	lwi	r28, r1, PT_R28;					\
-	lwi	r29, r1, PT_R29;					\
-	lwi	r30, r1, PT_R30;					\
-	lwi	r31, r1, PT_R31;	/* Restore cur task reg */
+	lwi	r2, r1, PTO+PT_R2;	/* restore SDA */		\
+	lwi	r3, r1, PTO+PT_R3;					\
+	lwi	r4, r1, PTO+PT_R4;					\
+	lwi	r5, r1, PTO+PT_R5;					\
+	lwi	r6, r1, PTO+PT_R6;					\
+	lwi	r7, r1, PTO+PT_R7;					\
+	lwi	r8, r1, PTO+PT_R8;					\
+	lwi	r9, r1, PTO+PT_R9;					\
+	lwi	r10, r1, PTO+PT_R10;					\
+	lwi	r11, r1, PTO+PT_R11;	/* restore clobbered regs after rval */\
+	lwi	r12, r1, PTO+PT_R12;					\
+	lwi	r13, r1, PTO+PT_R13;	/* restore SDA2 */		\
+	lwi	r14, r1, PTO+PT_PC;	/* RESTORE_LINK PC, before IRQ/trap */\
+	lwi	r15, r1, PTO+PT_R15;	/* restore LP */		\
+	lwi	r16, r1, PTO+PT_R16;					\
+	lwi	r17, r1, PTO+PT_R17;					\
+	lwi	r18, r1, PTO+PT_R18;	/* restore asm scratch reg */	\
+	lwi	r19, r1, PTO+PT_R19;					\
+	lwi	r20, r1, PTO+PT_R20;					\
+	lwi	r21, r1, PTO+PT_R21;					\
+	lwi	r22, r1, PTO+PT_R22;					\
+	lwi	r23, r1, PTO+PT_R23;					\
+	lwi	r24, r1, PTO+PT_R24;					\
+	lwi	r25, r1, PTO+PT_R25;					\
+	lwi	r26, r1, PTO+PT_R26;					\
+	lwi	r27, r1, PTO+PT_R27;					\
+	lwi	r28, r1, PTO+PT_R28;					\
+	lwi	r29, r1, PTO+PT_R29;					\
+	lwi	r30, r1, PTO+PT_R30;					\
+	lwi	r31, r1, PTO+PT_R31;	/* Restore cur task reg */
 
 #define RESTORE_REGS \
-	lwi	r11, r1, PT_MSR;					\
+	lwi	r11, r1, PTO+PT_MSR;					\
 	mts	rmsr , r11;						\
 	RESTORE_REGS_GP
 
 #define RESTORE_REGS_RTBD \
-	lwi	r11, r1, PT_MSR;					\
+	lwi	r11, r1, PTO+PT_MSR;					\
 	andni	r11, r11, MSR_EIP;          /* clear EIP */             \
 	ori	r11, r11, MSR_EE | MSR_BIP; /* set EE and BIP */        \
 	mts	rmsr , r11;						\
@@ -265,11 +265,11 @@ syscall_debug_table:
 	lwi	r1, r0, TOPHYS(PER_CPU(ENTRY_SP));			\
 	/* FIXME: I can add these two lines to one */			\
 	/* tophys(r1,r1); */						\
-	/* addik	r1, r1, -PT_SIZE; */				\
-	addik	r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+	/* addik	r1, r1, -STATE_SAVE_SIZE; */				\
+	addik	r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE; \
 	SAVE_REGS							\
 	brid	2f;							\
-	swi	r1, r1, PT_MODE; 	 				\
+	swi	r1, r1, PTO+PT_MODE; 	 				\
 1:	/* User-mode state save.  */					\
 	lwi	r1, r0, TOPHYS(PER_CPU(CURRENT_SAVE)); /* get saved current */\
 	tophys(r1,r1);							\
@@ -277,12 +277,13 @@ syscall_debug_table:
 	/* MS these three instructions can be added to one */		\
 	/* addik	r1, r1, THREAD_SIZE; */				\
 	/* tophys(r1,r1); */						\
-	/* addik	r1, r1, -PT_SIZE; */			\
-	addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE; \
+	/* addik	r1, r1, -STATE_SAVE_SIZE; */			\
+	addik r1, r1, THREAD_SIZE + CONFIG_KERNEL_BASE_ADDR		\
+		- CONFIG_KERNEL_START - STATE_SAVE_SIZE;		\
 	SAVE_REGS							\
 	lwi	r11, r0, TOPHYS(PER_CPU(ENTRY_SP));			\
-	swi	r11, r1, PT_R1; /* Store user SP.  */		\
-	swi	r0, r1, PT_MODE; /* Was in user-mode.  */		\
+	swi	r11, r1, PTO+PT_R1; /* Store user SP.  */		\
+	swi	r0, r1, PTO+PT_MODE; /* Was in user-mode.  */		\
 	/* MS: I am clearing UMS even in case when I come from kernel space */ \
 	clear_ums; 							\
 2:	lwi	CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
@@ -292,7 +293,7 @@ syscall_debug_table:
 .extern cpuinfo
 
 C_ENTRY(mb_flush_dcache):
-	addik	r1, r1, -PT_SIZE
+	addik	r1, r1, -STATE_SAVE_SIZE
 	SAVE_REGS
 
 	addik	r3, r0, cpuinfo
@@ -305,12 +306,12 @@ C_ENTRY(mb_flush_dcache):
 	addk	r9, r9, r8
 
 	RESTORE_REGS
-	addik	r1, r1, PT_SIZE
+	addik	r1, r1, STATE_SAVE_SIZE
 	rtsd	r15, 8
 	nop
 
 C_ENTRY(mb_invalidate_icache):
-	addik	r1, r1, -PT_SIZE
+	addik	r1, r1, -STATE_SAVE_SIZE
 	SAVE_REGS
 
 	addik	r3, r0, cpuinfo
@@ -323,7 +324,7 @@ C_ENTRY(mb_invalidate_icache):
 	addk	r9, r9, r8
 
 	RESTORE_REGS
-	addik	r1, r1, PT_SIZE
+	addik	r1, r1, STATE_SAVE_SIZE
 	rtsd	r15, 8
 	nop
 
@@ -350,18 +351,18 @@ C_ENTRY(_user_exception):
 	addik	r1, r1, THREAD_SIZE;
 	tophys(r1,r1);
 
-	addik	r1, r1, -PT_SIZE; /* Make room on the stack.  */
+	addik	r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack.  */
 	SAVE_REGS
-	swi	r0, r1, PT_R3
-	swi	r0, r1, PT_R4
+	swi	r0, r1, PTO+PT_R3
+	swi	r0, r1, PTO+PT_R4
 
-	swi	r0, r1, PT_MODE;			/* Was in user-mode. */
+	swi	r0, r1, PTO+PT_MODE;			/* Was in user-mode. */
 	lwi	r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
-	swi	r11, r1, PT_R1;		/* Store user SP.  */
+	swi	r11, r1, PTO+PT_R1;		/* Store user SP.  */
 	clear_ums;
 2:	lwi	CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
 	/* Save away the syscall number.  */
-	swi	r12, r1, PT_R0;
+	swi	r12, r1, PTO+PT_R0;
 	tovirt(r1,r1)
 
 /* where the trap should return need -8 to adjust for rtsd r15, 8*/
@@ -380,18 +381,18 @@ C_ENTRY(_user_exception):
 	beqi	r11, 4f
 
 	addik	r3, r0, -ENOSYS
-	swi	r3, r1, PT_R3
+	swi	r3, r1, PTO+PT_R3
 	brlid	r15, do_syscall_trace_enter
-	addik	r5, r1, PT_R0
+	addik	r5, r1, PTO+PT_R0
 
 	# do_syscall_trace_enter returns the new syscall nr.
 	addk	r12, r0, r3
-	lwi	r5, r1, PT_R5;
-	lwi	r6, r1, PT_R6;
-	lwi	r7, r1, PT_R7;
-	lwi	r8, r1, PT_R8;
-	lwi	r9, r1, PT_R9;
-	lwi	r10, r1, PT_R10;
+	lwi	r5, r1, PTO+PT_R5;
+	lwi	r6, r1, PTO+PT_R6;
+	lwi	r7, r1, PTO+PT_R7;
+	lwi	r8, r1, PTO+PT_R8;
+	lwi	r9, r1, PTO+PT_R9;
+	lwi	r10, r1, PTO+PT_R10;
 4:
 /* Jump to the appropriate function for the system call number in r12
  * (r12 is not preserved), or return an error if r12 is not valid.
@@ -432,8 +433,8 @@ C_ENTRY(_user_exception):
 /* Entry point used to return from a syscall/trap */
 /* We re-enable BIP bit before state restore */
 C_ENTRY(ret_from_trap):
-	swi	r3, r1, PT_R3
-	swi	r4, r1, PT_R4
+	swi	r3, r1, PTO+PT_R3
+	swi	r4, r1, PTO+PT_R4
 /*
  * Entry point for returns that must not store r3/r4 back into pt_regs,
  * i.e. rt_sigreturn, which has already restored them from the signal
@@ -441,7 +442,7 @@ C_ENTRY(ret_from_trap):
  * so it stays correct if the number of stores above ever changes.
  */
 ret_from_trap_no_rval:
-	lwi	r11, r1, PT_MODE;
+	lwi	r11, r1, PTO+PT_MODE;
 /* See if returning to kernel mode, if so, skip resched &c.  */
 	bnei	r11, 2f;
 	/* We're returning to user mode, so check for various conditions that
@@ -453,7 +454,7 @@ ret_from_trap_no_rval:
 	beqi	r11, 1f
 
 	brlid	r15, do_syscall_trace_leave
-	addik	r5, r1, PT_R0
+	addik	r5, r1, PTO+PT_R0
 1:
 	/* We're returning to user mode, so check for various conditions that
 	 * trigger rescheduling. */
@@ -472,7 +473,7 @@ ret_from_trap_no_rval:
 	andi	r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
 	beqi	r11, 4f;		/* Signals to handle, handle them */
 
-	addik	r5, r1, 0;		/* Arg 1: struct pt_regs *regs */
+	addik	r5, r1, PTO;		/* Arg 1: struct pt_regs *regs */
 	bralid	r15, do_notify_resume;	/* Handle any signals */
 	add	r6, r30, r0;		/* Arg 2: int in_syscall */
 	add	r30, r0, r0		/* no more restarts */
@@ -484,7 +485,11 @@ ret_from_trap_no_rval:
 	VM_OFF;
 	tophys(r1,r1);
 	RESTORE_REGS_RTBD;
-	addik	r1, r1, PT_SIZE		/* Clean up stack space.  */
+	addik	r1, r1, STATE_SAVE_SIZE		/* Clean up stack space.  */
+	/*
+	 * Deliberately PT_SIZE, not STATE_SAVE_SIZE: r1 is back at the stack
+	 * top, so PTO cancels and the saved SP sits at PT_R1 - PT_SIZE.
+	 */
 	lwi	r1, r1, PT_R1 - PT_SIZE;/* Restore user stack pointer. */
 	bri	6f;
 
@@ -493,7 +498,7 @@ ret_from_trap_no_rval:
 	VM_OFF;
 	tophys(r1,r1);
 	RESTORE_REGS_RTBD;
-	addik	r1, r1, PT_SIZE		/* Clean up stack space.  */
+	addik	r1, r1, STATE_SAVE_SIZE		/* Clean up stack space.  */
 	tovirt(r1,r1);
 6:
 TRAP_return:		/* Make global symbol for debugging */
@@ -534,7 +539,7 @@ C_ENTRY(sys_rt_sigreturn_wrapper):
 	 */
 	addik	r15, r0, ret_from_trap_no_rval - 8
 	brid	sys_rt_sigreturn	/* Do real work */
-	addik	r5, r1, 0;		/* add user context as 1st arg */
+	addik	r5, r1, PTO;		/* add user context as 1st arg */
 
 /*
  * HW EXCEPTION rutine start
@@ -545,7 +550,7 @@ C_ENTRY(full_exception_trap):
 	addik	r17, r17, -4
 	SAVE_STATE /* Save registers */
 	/* PC, before IRQ/trap - this is one instruction above */
-	swi	r17, r1, PT_PC;
+	swi	r17, r1, PTO+PT_PC;
 	tovirt(r1,r1)
 	/* FIXME this can be store directly in PT_ESR reg.
 	 * I tested it but there is a fault */
@@ -555,7 +560,7 @@ C_ENTRY(full_exception_trap):
 	mfs	r7, rfsr;		/* save FSR */
 	mts	rfsr, r0;	/* Clear sticky fsr */
 	rted	r0, full_exception
-	addik	r5, r1, 0		 /* parameter struct pt_regs * regs */
+	addik	r5, r1, PTO		 /* parameter struct pt_regs * regs */
 
 /*
  * Unaligned data trap.
@@ -581,14 +586,14 @@ C_ENTRY(unaligned_data_trap):
 	lwi	r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
 	SAVE_STATE		/* Save registers.*/
 	/* PC, before IRQ/trap - this is one instruction above */
-	swi	r17, r1, PT_PC;
+	swi	r17, r1, PTO+PT_PC;
 	tovirt(r1,r1)
 	/* where the trap should return need -8 to adjust for rtsd r15, 8 */
 	addik	r15, r0, ret_from_exc-8
 	mfs	r3, resr		/* ESR */
 	mfs	r4, rear		/* EAR */
 	rtbd	r0, _unaligned_data_exception
-	addik	r7, r1, 0		/* parameter struct pt_regs * regs */
+	addik	r7, r1, PTO		/* parameter struct pt_regs * regs */
 
 /*
  * Page fault traps.
@@ -611,30 +616,30 @@ C_ENTRY(unaligned_data_trap):
 C_ENTRY(page_fault_data_trap):
 	SAVE_STATE		/* Save registers.*/
 	/* PC, before IRQ/trap - this is one instruction above */
-	swi	r17, r1, PT_PC;
+	swi	r17, r1, PTO+PT_PC;
 	tovirt(r1,r1)
 	/* where the trap should return need -8 to adjust for rtsd r15, 8 */
 	addik	r15, r0, ret_from_exc-8
 	mfs	r6, rear		/* parameter unsigned long address */
 	mfs	r7, resr		/* parameter unsigned long error_code */
 	rted	r0, do_page_fault
-	addik	r5, r1, 0		/* parameter struct pt_regs * regs */
+	addik	r5, r1, PTO		/* parameter struct pt_regs * regs */
 
 C_ENTRY(page_fault_instr_trap):
 	SAVE_STATE		/* Save registers.*/
 	/* PC, before IRQ/trap - this is one instruction above */
-	swi	r17, r1, PT_PC;
+	swi	r17, r1, PTO+PT_PC;
 	tovirt(r1,r1)
 	/* where the trap should return need -8 to adjust for rtsd r15, 8 */
 	addik	r15, r0, ret_from_exc-8
 	mfs	r6, rear		/* parameter unsigned long address */
 	ori	r7, r0, 0		/* parameter unsigned long error_code */
 	rted	r0, do_page_fault
-	addik	r5, r1, 0		/* parameter struct pt_regs * regs */
+	addik	r5, r1, PTO		/* parameter struct pt_regs * regs */
 
 /* Entry point used to return from an exception.  */
 C_ENTRY(ret_from_exc):
-	lwi	r11, r1, PT_MODE;
+	lwi	r11, r1, PTO+PT_MODE;
 	bnei	r11, 2f;		/* See if returning to kernel mode, */
 					/* ... if so, skip resched &c.  */
 
@@ -666,7 +671,7 @@ C_ENTRY(ret_from_exc):
 	 * complete register state.  Here we save anything not saved by
 	 * the normal entry sequence, so that it may be safely restored
 	 * (in a possibly modified form) after do_notify_resume returns. */
-	addik	r5, r1, 0;		/* Arg 1: struct pt_regs *regs */
+	addik	r5, r1, PTO;		/* Arg 1: struct pt_regs *regs */
 	bralid	r15, do_notify_resume;	/* Handle any signals */
 	addi	r6, r0, 0;		/* Arg 2: int in_syscall */
 	bri	1b
@@ -678,7 +683,7 @@ C_ENTRY(ret_from_exc):
 	tophys(r1,r1);
 
 	RESTORE_REGS_RTBD;
-	addik	r1, r1, PT_SIZE		/* Clean up stack space.  */
+	addik	r1, r1, STATE_SAVE_SIZE		/* Clean up stack space.  */
 
 	lwi	r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer. */
 	bri	6f;
@@ -687,7 +692,7 @@ C_ENTRY(ret_from_exc):
 	VM_OFF;
 	tophys(r1,r1);
 	RESTORE_REGS_RTBD;
-	addik	r1, r1, PT_SIZE		/* Clean up stack space.  */
+	addik	r1, r1, STATE_SAVE_SIZE		/* Clean up stack space.  */
 
 	tovirt(r1,r1);
 6:
@@ -720,10 +725,10 @@ C_ENTRY(_interrupt):
 	tophys(r1,r1); /* MS: I have in r1 physical address where stack is */
 	/* save registers */
 /* MS: Make room on the stack -> activation record */
-	addik	r1, r1, -PT_SIZE;
+	addik	r1, r1, -STATE_SAVE_SIZE;
 	SAVE_REGS
 	brid	2f;
-	swi	r1, r1, PT_MODE; /* 0 - user mode, 1 - kernel mode */
+	swi	r1, r1, PTO+PT_MODE; /* 0 - user mode, 1 - kernel mode */
 1:
 /* User-mode state save. */
  /* MS: get the saved current */
@@ -733,23 +738,23 @@ C_ENTRY(_interrupt):
 	addik	r1, r1, THREAD_SIZE;
 	tophys(r1,r1);
 	/* save registers */
-	addik	r1, r1, -PT_SIZE;
+	addik	r1, r1, -STATE_SAVE_SIZE;
 	SAVE_REGS
 	/* calculate mode */
-	swi	r0, r1, PT_MODE;
+	swi	r0, r1, PTO+PT_MODE;
 	lwi	r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
-	swi	r11, r1, PT_R1;
+	swi	r11, r1, PTO+PT_R1;
 	clear_ums;
 2:
 	lwi	CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
 	tovirt(r1,r1)
 	addik	r15, r0, irq_call;
 irq_call:rtbd	r0, do_IRQ;
-	addik	r5, r1, 0;
+	addik	r5, r1, PTO;
 
 /* MS: we are in virtual mode */
 ret_from_irq:
-	lwi	r11, r1, PT_MODE;
+	lwi	r11, r1, PTO+PT_MODE;
 	bnei	r11, 2f;
 
 1:
@@ -765,7 +770,7 @@ ret_from_irq:
 5:	andi	r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
 	beqid	r11, no_intr_resched
 /* Handle a signal return; Pending signals should be in r18. */
-	addik	r5, r1, 0; /* Arg 1: struct pt_regs *regs */
+	addik	r5, r1, PTO; /* Arg 1: struct pt_regs *regs */
 	bralid	r15, do_notify_resume;	/* Handle any signals */
 	addi	r6, r0, 0; /* Arg 2: int in_syscall */
 	bri	1b
@@ -778,7 +783,7 @@ no_intr_resched:
 	VM_OFF;
 	tophys(r1,r1);
 	RESTORE_REGS
-	addik	r1, r1, PT_SIZE /* MS: Clean up stack space. */
+	addik	r1, r1, STATE_SAVE_SIZE /* MS: Clean up stack space. */
 	lwi	r1, r1, PT_R1 - PT_SIZE;
 	bri	6f;
 /* MS: Return to kernel state. */
@@ -801,7 +806,7 @@ restore:
 	VM_OFF /* MS: turn off MMU */
 	tophys(r1,r1)
 	RESTORE_REGS
-	addik	r1, r1, PT_SIZE	/* MS: Clean up stack space. */
+	addik	r1, r1, STATE_SAVE_SIZE	/* MS: Clean up stack space. */
 	tovirt(r1,r1);
 6:
 IRQ_return: /* MS: Make global symbol for debugging */
@@ -820,29 +825,29 @@ C_ENTRY(_xtmr_manager_reset):
 	lwi	r1, r0, xmb_manager_stackpointer
 
 	/* Restore MSR */
-	lwi	r2, r1, PT_MSR
+	lwi	r2, r1, PTO+PT_MSR
 	mts	rmsr, r2
 	bri	4
 
 	/* restore Special purpose registers */
-	lwi	r2, r1, PT_PID
+	lwi	r2, r1, PTO+PT_PID
 	mts	rpid, r2
 
-	lwi	r2, r1, PT_TLBI
+	lwi	r2, r1, PTO+PT_TLBI
 	mts	rtlbx, r2
 
-	lwi	r2, r1, PT_ZPR
+	lwi	r2, r1, PTO+PT_ZPR
 	mts	rzpr, r2
 
 #if CONFIG_XILINX_MICROBLAZE0_USE_FPU
-	lwi	r2, r1, PT_FSR
+	lwi	r2, r1, PTO+PT_FSR
 	mts	rfsr, r2
 #endif
 
 	/* restore all the tlb's */
 	addik	r3, r0, TOPHYS(tlb_skip)
-	addik	r6, r0, PT_TLBL0
-	addik	r7, r0, PT_TLBH0
+	addik	r6, r0, PTO+PT_TLBL0
+	addik	r7, r0, PTO+PT_TLBH0
 restore_tlb:
 	add	r6, r6, r1
 	add	r7, r7, r1
@@ -868,9 +873,9 @@ ret_from_reset:
 	VM_OFF
 	/* MS: Restore all regs */
 	RESTORE_REGS
-	lwi	r14, r1, PT_R14
-	lwi	r16, r1, PT_PC
-	addik	r1, r1, PT_SIZE + 36
+	lwi	r14, r1, PTO+PT_R14
+	lwi	r16, r1, PTO+PT_PC
+	addik	r1, r1, STATE_SAVE_SIZE + 36
 	rtbd	r16, 0
 	nop
 
@@ -885,11 +890,11 @@ C_ENTRY(_xmb_manager_break):
 	 * Reserve memory in the stack for context store/restore
 	 * (which includes memory for storing tlbs (max two tlbs))
 	 */
-	addik	r1, r1, -PT_SIZE - 36
+	addik	r1, r1, -STATE_SAVE_SIZE - 36
 	swi	r1, r0, xmb_manager_stackpointer
 	SAVE_REGS
-	swi	r14, r1, PT_R14	/* rewrite saved R14 value */
-	swi	r16, r1, PT_PC; /* PC and r16 are the same */
+	swi	r14, r1, PTO+PT_R14	/* rewrite saved R14 value */
+	swi	r16, r1, PTO+PT_PC; /* PC and r16 are the same */
 
 	lwi	r6, r0, TOPHYS(xmb_manager_baseaddr)
 	lwi	r7, r0, TOPHYS(xmb_manager_crval)
@@ -903,25 +908,25 @@ C_ENTRY(_xmb_manager_break):
 
 	/* Save the special purpose registers  */
 	mfs	r2, rpid
-	swi	r2, r1, PT_PID
+	swi	r2, r1, PTO+PT_PID
 
 	mfs	r2, rtlbx
-	swi	r2, r1, PT_TLBI
+	swi	r2, r1, PTO+PT_TLBI
 
 	mfs	r2, rzpr
-	swi	r2, r1, PT_ZPR
+	swi	r2, r1, PTO+PT_ZPR
 
 #if CONFIG_XILINX_MICROBLAZE0_USE_FPU
 	mfs	r2, rfsr
-	swi	r2, r1, PT_FSR
+	swi	r2, r1, PTO+PT_FSR
 #endif
 	mfs	r2, rmsr
-	swi	r2, r1, PT_MSR
+	swi	r2, r1, PTO+PT_MSR
 
 	/* Save all the tlb's */
 	addik	r3, r0, TOPHYS(tlb_skip)
-	addik	r6, r0, PT_TLBL0
-	addik	r7, r0, PT_TLBH0
+	addik	r6, r0, PTO+PT_TLBL0
+	addik	r7, r0, PTO+PT_TLBH0
 save_tlb:
 	add	r6, r6, r1
 	add	r7, r7, r1
@@ -978,28 +983,28 @@ C_ENTRY(_debug_exception):
 	lwi	r1, r0, TOPHYS(PER_CPU(ENTRY_SP)); /* Reload kernel stack-ptr*/
 
 	/* BIP bit is set on entry, no interrupts can occur */
-	addik   r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - PT_SIZE;
+	addik   r1, r1, CONFIG_KERNEL_BASE_ADDR - CONFIG_KERNEL_START - STATE_SAVE_SIZE;
 	SAVE_REGS;
 	/* save all regs to pt_reg structure */
-	swi	r0, r1, PT_R0;	/* R0 must be saved too */
-	swi	r14, r1, PT_R14	/* rewrite saved R14 value */
-	swi	r16, r1, PT_PC; /* PC and r16 are the same */
+	swi	r0, r1, PTO+PT_R0;	/* R0 must be saved too */
+	swi	r14, r1, PTO+PT_R14	/* rewrite saved R14 value */
+	swi	r16, r1, PTO+PT_PC; /* PC and r16 are the same */
 	/* save special purpose registers to pt_regs */
 	mfs	r11, rear;
-	swi	r11, r1, PT_EAR;
+	swi	r11, r1, PTO+PT_EAR;
 	mfs	r11, resr;
-	swi	r11, r1, PT_ESR;
+	swi	r11, r1, PTO+PT_ESR;
 	mfs	r11, rfsr;
-	swi	r11, r1, PT_FSR;
+	swi	r11, r1, PTO+PT_FSR;
 
 	/* stack pointer is in physical address at it is decrease
-	 * by PT_SIZE but we need to get correct R1 value */
-	addik   r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + PT_SIZE;
-	swi	r11, r1, PT_R1
+	 * by STATE_SAVE_SIZE but we need to get correct R1 value */
+	addik   r11, r1, CONFIG_KERNEL_START - CONFIG_KERNEL_BASE_ADDR + STATE_SAVE_SIZE;
+	swi	r11, r1, PTO+PT_R1
 	/* MS: r31 - current pointer isn't changed */
 	tovirt(r1,r1)
 #ifdef CONFIG_KGDB
-	addi	r5, r1, 0 /* pass pt_reg address as the first arg */
+	addi	r5, r1, PTO /* pass pt_reg address as the first arg */
 	addik	r15, r0, dbtrap_call; /* return address */
 	rtbd	r0, microblaze_kgdb_break
 	nop;
@@ -1015,16 +1020,16 @@ C_ENTRY(_debug_exception):
 	addik	r1, r1, THREAD_SIZE;	/* calculate kernel stack pointer */
 	tophys(r1,r1);
 
-	addik	r1, r1, -PT_SIZE; /* Make room on the stack.  */
+	addik	r1, r1, -STATE_SAVE_SIZE; /* Make room on the stack.  */
 	SAVE_REGS;
-	swi	r16, r1, PT_PC;	/* Save LP */
-	swi	r0, r1, PT_MODE; /* Was in user-mode.  */
+	swi	r16, r1, PTO+PT_PC;	/* Save LP */
+	swi	r0, r1, PTO+PT_MODE; /* Was in user-mode.  */
 	lwi	r11, r0, TOPHYS(PER_CPU(ENTRY_SP));
-	swi	r11, r1, PT_R1; /* Store user SP.  */
+	swi	r11, r1, PTO+PT_R1; /* Store user SP.  */
 	lwi	CURRENT_TASK, r0, TOPHYS(PER_CPU(CURRENT_SAVE));
 	tovirt(r1,r1)
 	set_vms;
-	addik	r5, r1, 0;
+	addik	r5, r1, PTO;
 	addik	r15, r0, dbtrap_call;
 dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
 	rtbd	r0, sw_exception
@@ -1032,7 +1037,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
 
 	/* MS: The first instruction for the second part of the gdb/kgdb */
 	set_bip; /* Ints masked for state restore */
-	lwi	r11, r1, PT_MODE;
+	lwi	r11, r1, PTO+PT_MODE;
 	bnei	r11, 2f;
 /* MS: Return to user space - gdb */
 1:
@@ -1051,7 +1056,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
 5:	andi	r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
 	beqi	r11, 4f;		/* Signals to handle, handle them */
 
-	addik	r5, r1, 0;		/* Arg 1: struct pt_regs *regs */
+	addik	r5, r1, PTO;		/* Arg 1: struct pt_regs *regs */
 	bralid	r15, do_notify_resume;	/* Handle any signals */
 	addi  r6, r0, 0;	/* Arg 2: int in_syscall */
 	bri	1b
@@ -1062,7 +1067,7 @@ dbtrap_call: /* Return point for kernel/user entry + 8 because of rtsd r15, 8 */
 	tophys(r1,r1);
 	/* MS: Restore all regs */
 	RESTORE_REGS_RTBD
-	addik	r1, r1, PT_SIZE	 /* Clean up stack space */
+	addik	r1, r1, STATE_SAVE_SIZE	 /* Clean up stack space */
 	lwi	r1, r1, PT_R1 - PT_SIZE; /* Restore user stack pointer */
 DBTRAP_return_user: /* MS: Make global symbol for debugging */
 	rtbd	r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1073,9 +1078,9 @@ DBTRAP_return_user: /* MS: Make global symbol for debugging */
 	tophys(r1,r1);
 	/* MS: Restore all regs */
 	RESTORE_REGS_RTBD
-	lwi	r14, r1, PT_R14;
-	lwi	r16, r1, PT_PC;
-	addik	r1, r1, PT_SIZE; /* MS: Clean up stack space */
+	lwi	r14, r1, PTO+PT_R14;
+	lwi	r16, r1, PTO+PT_PC;
+	addik	r1, r1, STATE_SAVE_SIZE; /* MS: Clean up stack space */
 	tovirt(r1,r1);
 DBTRAP_return_kernel: /* MS: Make global symbol for debugging */
 	rtbd	r16, 0; /* MS: Instructions to return from a debug trap */
@@ -1173,7 +1178,7 @@ ENTRY(_switch_to)
 .ent xmb_inject_err
 .type xmb_inject_err, @function
 xmb_inject_err:
-	addik	r1, r1, -PT_SIZE
+	addik	r1, r1, -STATE_SAVE_SIZE
 	SAVE_REGS
 
 	/* Switch to real mode */
@@ -1197,7 +1202,7 @@ xmb_inject_err:
 	nop;
 1:
 	RESTORE_REGS
-	addik	r1, r1, PT_SIZE
+	addik	r1, r1, STATE_SAVE_SIZE
 	rtsd	r15, 8;
 	nop;
 .end xmb_inject_err
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 07ea23965f8175..4693916be52672 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -313,6 +313,11 @@ _MB_HW_ExceptionVectorTable:
 .align 4
 .ent _hw_exception_handler
 _hw_exception_handler:
+	/*
+	 * This handler saves into the static pt_pool_space buffer, not into a
+	 * stack frame, so the plain PT_* offsets are right here -- do not add
+	 * the PTO of entry.S's frames.
+	 */
 	swi	r1, r0, TOPHYS(pt_pool_space + PT_R1); /* GET_SP */
 	/* Save date to kernel memory. Here is the problem
 	 * when you came from user space */
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 6cbf642d7b801d..090e1697ea7aee 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -19,6 +19,7 @@
 #include <linux/bitops.h>
 #include <linux/ptrace.h>
 #include <asm/cacheflush.h>
+#include <asm/entry.h>
 
 void show_regs(struct pt_regs *regs)
 {
@@ -65,7 +66,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 		 * the registers. That's OK for a brand new thread.*/
 		memset(childregs, 0, sizeof(struct pt_regs));
 		memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
-		ti->cpu_context.r1  = (unsigned long)childregs;
+		ti->cpu_context.r1  = (unsigned long)childregs - PTO;
 		ti->cpu_context.r20 = (unsigned long)args->fn;
 		ti->cpu_context.r19 = (unsigned long)args->fn_arg;
 		childregs->pt_mode = 1;
@@ -79,7 +80,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 		childregs->r1 = usp;
 
 	memset(&ti->cpu_context, 0, sizeof(struct cpu_context));
-	ti->cpu_context.r1 = (unsigned long)childregs;
+	ti->cpu_context.r1 = (unsigned long)childregs - PTO;
 	childregs->msr |= MSR_UMS;
 
 	/* we should consider the fact that childregs is a copy of the parent

From 1f8722a7053ffe11eff0ee402b7c5150dc808089 Mon Sep 17 00:00:00 2001
From: Sam Price <thesamprice@gmail.com>
Date: Fri, 21 Aug 2026 17:18:09 +0200
Subject: [PATCH 1058/1982] microblaze: preserve the MSR carry flags across
 signals

[ Upstream commit ca35dd21a5f8343f47a23e4e5b3f0ffccf76a4ae ]

setup_sigcontext() and restore_sigcontext() copy r0-r31, pc, ear, esr and
fsr to and from the signal frame but never touch MSR.  The interrupted
MSR is therefore dropped from the signal context entirely: the handler's
ucontext does not expose it, a handler cannot adjust the resumed
arithmetic flags through uc_mcontext.regs.msr, and -- because
restore_sigcontext() leaves regs->msr as whatever the rt_sigreturn trap
left in it -- the interrupted context resumes with the carry produced by
the syscall entry path (_user_exception does "addi r14, r14, 4", which
writes carry), not with its own.

Other architectures round-trip the user-visible flags through the signal
frame (arm's cpsr, csky's carry, x86's eflags), so a handler can both read
and adjust the resumed flags; purely privileged status registers such as
riscv's sstatus are left out.  MicroBlaze should do the same for the
user-writable bits.

Concretely, MSR[C] (carry) is lost across signal delivery.  Code that
keeps a live carry across a point where a signal can be delivered -- for
example an lwx/swx compare-and-swap retry loop, between the swx and the
carry test -- resumes with the handler's carry and mis-evaluates the
result; the same failure class as the rt_sigreturn r3/r4 clobber, reached
through a different register.  Demonstrated under qemu-system-microblazeel
(machine petalogix-s3adsp1800): a handler that sets MSR_C in
uc_mcontext.regs.msr has no effect before this change (0 of 132 in-window
signals propagated) and takes effect after (130 of 132).

Save MSR in setup_sigcontext() so the handler's ucontext exposes it.  The
signal frame is user-writable, so restore_sigcontext() must not restore it
verbatim: MicroBlaze packs the user-writable carry (MSR_C, MSR_CC) and the
privileged control bits (MSR_UM, MSR_VM, MSR_IE, MSR_EE, ...) into the one
register, and a verbatim restore would let userspace alter privileged
return state -- rtbd derives the resumed mode from MSR_UMS/MSR_VMS.
Restore only MSR_C | MSR_CC from the frame and keep the rest from the
current regs->msr.  This mirrors x86's
restore_sigcontext(), which masks the restored EFLAGS to FIX_EFLAGS for
the same reason; arches whose status register is purely privileged (e.g.
riscv sstatus) simply do not restore it at all.

Comment on the exposed MSR reworded: it is not read-only,
restore_sigcontext() applies MSR_C|MSR_CC from the frame.  Author's
Signed-off-by kept; he agreed to comment and changelog cleanups.

Fixes: 2148daa9c45f ("microblaze_v8: Signal support")
Cc: stable@vger.kernel.org
Signed-off-by: Sam Price <thesamprice@gmail.com>
Signed-off-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://patch.msgid.link/20260821151809.1233057-6-ramin.moussavi@yacoub.de
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/kernel/signal.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index 4956014a993797..6bbc16f98d5ebb 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -33,6 +33,7 @@
 #include <linux/linkage.h>
 #include <linux/resume_user_mode.h>
 #include <asm/entry.h>
+#include <asm/registers.h>
 #include <asm/ucontext.h>
 #include <linux/uaccess.h>
 #include <linux/syscalls.h>
@@ -81,6 +82,22 @@ static int restore_sigcontext(struct pt_regs *regs,
 	COPY(pc);	COPY(ear);	COPY(esr);	COPY(fsr);
 #undef COPY
 
+	/*
+	 * The frame is user-writable, so restore only the user-writable
+	 * status flags (carry) and keep the kernel-controlled MSR bits
+	 * (UMS/VMS/IE/EE/...) from regs->msr: rtbd derives the resumed mode
+	 * from UMS/VMS, so a verbatim restore would hand userspace the
+	 * privileged return state.  Same idea as x86 masking the restored
+	 * EFLAGS to FIX_EFLAGS.
+	 */
+	{
+		unsigned long msr;
+
+		err |= __get_user(msr, &sc->regs.msr);
+		regs->msr = (regs->msr & ~(MSR_C | MSR_CC)) |
+			    (msr & (MSR_C | MSR_CC));
+	}
+
 	*rval_p = regs->r3;
 
 	return err;
@@ -140,6 +157,7 @@ setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
 	COPY(r26);	COPY(r27);	COPY(r28);	COPY(r29);
 	COPY(r30);	COPY(r31);
 	COPY(pc);	COPY(ear);	COPY(esr);	COPY(fsr);
+	COPY(msr);	/* restore_sigcontext() accepts only carry state */
 #undef COPY
 
 	err |= __put_user(mask, &sc->oldmask);

From 5aca21d188570b8b86356a562c7a668a51b1d088 Mon Sep 17 00:00:00 2001
From: Justin Chen <justin.chen@broadcom.com>
Date: Wed, 26 Aug 2026 13:14:58 -0700
Subject: [PATCH 1059/1982] memory: brcmstb_dpfe: Fix out-of-bounds access due
 to DCPU offset

[ Upstream commit 7c0b82d087908765c6c7daeb06943e21b78d523e ]

On API v1/v2 boards, the DCPU coprocessor can steer kernel readl_relaxed()
and writel_relaxed() to any address within 256 MB of the ioremapped DPFE
dmem or regs base. The DCPU firmware provides a 28-bit offset which the
driver adds to the ioremap base without any bounds checking in
get_msg_ptr().

This allows a compromised DCPU firmware to trick the host kernel into
reading or writing arbitrary memory-mapped I/O registers in vmalloc
space. When combined with a root-writable sysfs file like dpfe_refresh,
it provides an arbitrary MMIO write primitive. Similarly, world-readable
sysfs files can be used to leak other devices' register contents.

Fix this by recording the resource_size() of the dmem and regs ioremaps
at probe time, and rejecting any offset that, along with the largest
field accessed (DRAM_VENDOR_ERROR + sizeof(u32)), exceeds the recorded
mapping size.

Fixes: fee5f1ef6cf7 ("memory: brcmstb: dpfe: support new way of passing data from the DCPU")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-2-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/brcmstb_dpfe.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 08d9e05b1b3383..66343205f585bb 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -182,6 +182,8 @@ struct brcmstb_dpfe_priv {
 	void __iomem *regs;
 	void __iomem *dmem;
 	void __iomem *imem;
+	resource_size_t regs_size;
+	resource_size_t dmem_size;
 	struct device *dev;
 	const struct dpfe_api *dpfe_api;
 	struct mutex lock;
@@ -401,9 +403,14 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
 	 */
 	switch (msg_type) {
 	case 1:
+		if (DCPU_MSG_RAM_START + offset + DRAM_VENDOR_ERROR +
+		    sizeof(u32) > priv->regs_size)
+			goto bad_offset;
 		ptr = priv->regs + DCPU_MSG_RAM_START + offset;
 		break;
 	case 0:
+		if (offset + DRAM_VENDOR_ERROR + sizeof(u32) > priv->dmem_size)
+			goto bad_offset;
 		ptr = priv->dmem + offset;
 		break;
 	default:
@@ -415,6 +422,12 @@ static void __iomem *get_msg_ptr(struct brcmstb_dpfe_priv *priv, u32 response,
 	}
 
 	return ptr;
+
+bad_offset:
+	dev_err(priv->dev, "DCPU returned out-of-range offset %#x\n", offset);
+	if (buf && size)
+		*size = sprintf(buf, "ERROR: DCPU offset out of range\n");
+	return NULL;
 }
 
 static void __finalize_command(struct brcmstb_dpfe_priv *priv)
@@ -858,6 +871,7 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct brcmstb_dpfe_priv *priv;
+	struct resource *res;
 	int ret;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -869,17 +883,21 @@ static int brcmstb_dpfe_probe(struct platform_device *pdev)
 	mutex_init(&priv->lock);
 	platform_set_drvdata(pdev, priv);
 
-	priv->regs = devm_platform_ioremap_resource_byname(pdev, "dpfe-cpu");
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-cpu");
+	priv->regs = devm_ioremap_resource(dev, res);
 	if (IS_ERR(priv->regs)) {
 		dev_err(dev, "couldn't map DCPU registers\n");
 		return -ENODEV;
 	}
+	priv->regs_size = resource_size(res);
 
-	priv->dmem = devm_platform_ioremap_resource_byname(pdev, "dpfe-dmem");
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-dmem");
+	priv->dmem = devm_ioremap_resource(dev, res);
 	if (IS_ERR(priv->dmem)) {
 		dev_err(dev, "Couldn't map DCPU data memory\n");
 		return -ENOENT;
 	}
+	priv->dmem_size = resource_size(res);
 
 	priv->imem = devm_platform_ioremap_resource_byname(pdev, "dpfe-imem");
 	if (IS_ERR(priv->imem)) {

From 77b641503dddf57e0dcee9202edb60d3f1a985fd Mon Sep 17 00:00:00 2001
From: Justin Chen <justin.chen@broadcom.com>
Date: Wed, 26 Aug 2026 13:14:59 -0700
Subject: [PATCH 1060/1982] memory: brcmstb_dpfe: Bounds check DCPU-supplied
 MSG_ARG_COUNT

[ Upstream commit 6b07f8c06caca015a0db69e3f323b5186469bc66 ]

A compromised or buggy DCPU coprocessor can make any user who reads
world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
stack out-of-bounds read of arbitrary extent. This bounds checks
chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
message RAM.

Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-3-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/brcmstb_dpfe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 66343205f585bb..7b02c36c7fca7a 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -503,6 +503,8 @@ static int __send_command(struct brcmstb_dpfe_priv *priv, unsigned int cmd,
 		for (i = 0; i < MSG_FIELD_MAX; i++)
 			result[i] = readl_relaxed(regs + DCPU_MSG_RAM(i));
 		chksum_idx = result[MSG_ARG_COUNT] + MSG_ARG_COUNT + 1;
+		if (chksum_idx >= MSG_FIELD_MAX)
+			ret = -EINVAL;
 	}
 
 	/* Tell DCPU we are done */

From c408ff204a86f62e51a3558b108a2b87bccfd8a2 Mon Sep 17 00:00:00 2001
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Date: Mon, 27 Jul 2026 11:34:44 +0100
Subject: [PATCH 1061/1982] memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as
 volatile

[ Upstream commit 3db1fb5e1bb4c9eefc554f985f6f3316fa1292e5 ]

Add XSPI_CDD1BUF0 to the xSPI regmap volatile register table.

XSPI_CDD1BUF0 is a data buffer register used during manual transfers and,
like XSPI_CDD0BUF0, its contents are transient and should not be cached
by regmap. Mark it as volatile so reads always access the hardware
register.

Fixes: 687cac9559d8 ("memory: renesas-rpc-if: Add RZ/G3E xSPI support")
Cc: stable@vger.kernel.org
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20260727103449.3188105-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/renesas-rpc-if.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 4a417b69308059..7f75052b6ae34a 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -34,6 +34,7 @@ static const struct regmap_access_table rpcif_volatile_table = {
 
 static const struct regmap_range xspi_volatile_ranges[] = {
 	regmap_reg_range(XSPI_CDD0BUF0, XSPI_CDD0BUF0),
+	regmap_reg_range(XSPI_CDD1BUF0, XSPI_CDD1BUF0),
 };
 
 static const struct regmap_access_table xspi_volatile_table = {

From aa26d4a75f2c85e062270bc5e68ce9d495fa12f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=A4=E3=83=A0=E3=83=86=E3=82=A3=E3=83=A4=E3=82=BA?=
 <reza1234khan1234@gmail.com>
Date: Thu, 6 Aug 2026 03:09:41 +0600
Subject: [PATCH 1062/1982] wifi: rtw88: fix out-of-bounds CAM write when key
 table is full
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 10d58823cb44681466c022054030b8e68d94ce2f ]

In rtw_ops_set_key(), when the CAM table is full,
rtw_sec_get_free_cam() returns RTW_MAX_SEC_CAM_NUM (32) because
find_next_zero_bit()/find_first_zero_bit() return the bitmap size
when no free slot exists. The bounds check compares the returned
index with ">" against total_cam_num (32), so the invalid index 32
passes the check.

rtw_sec_write_cam() then indexes cam_table[32], an array declared
with RTW_MAX_SEC_CAM_NUM (32) entries, causing an out-of-bounds
write that corrupts the cam_map allocation bitmap. The write also
sets bit 32 of cam_map, which overruns the bitmap as well.

Fix the off-by-one by rejecting indices >= total_cam_num.

Tested on: RTL8821CE (PCIe) on kernel
7.2.0-rc6-rtw88test-00059-g0d8395707651. The patched module loaded
and associated to a WPA2 network; ping traffic passed with 0% packet
loss. Reassociation and disconnect/reconnect cycles completed
without errors, and the CAM table (debugfs dump_cam) showed valid
key entries. The CAM-full boundary (28+ pairwise keys) requires an
access point with 28+ clients and is not reachable in a
single-client setup, so that path was verified by code inspection.

Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Cc: stable@vger.kernel.org
Tested-by: イムティヤズ <reza1234khan1234@gmail.com>
Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260805210941.75136-1-reza1234khan1234@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
index 766f22d31079ee..3b6302f14de036 100644
--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
@@ -597,7 +597,7 @@ static int rtw_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 		hw_key_idx = key->keyidx;
 	}
 
-	if (hw_key_idx > sec->total_cam_num) {
+	if (hw_key_idx >= sec->total_cam_num) {
 		ret = -ENOSPC;
 		goto out;
 	}

From a83e3e33b781c15587ffaae5e860ace96a2d3c7c Mon Sep 17 00:00:00 2001
From: Yi Cong <yicong@kylinos.cn>
Date: Fri, 7 Aug 2026 16:10:06 +0800
Subject: [PATCH 1063/1982] wifi: rtw89: 8851b: fix swapped DPK
 channel/bandwidth backup fields

[ Upstream commit 7e080e17ca38b72f6cf01e3bc750c243573e69a7 ]

The .ch and .bw backup fields are swapped; .ch should store the channel
and .bw the bandwidth, matching all other chips.

Fixes: 0194a95cbe721a ("wifi: rtw89: 8851b: rfk: add DPK")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260807081006.240450-1-cong.yi@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
index 84c46d2f4d85ea..6d2382cb5cd8c9 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
@@ -1895,8 +1895,8 @@ static void _dpk_information(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy,
 	u8 kidx = dpk->cur_idx[path];
 
 	dpk->bp[path][kidx].band = chan->band_type;
-	dpk->bp[path][kidx].ch = chan->band_width;
-	dpk->bp[path][kidx].bw = chan->channel;
+	dpk->bp[path][kidx].ch = chan->channel;
+	dpk->bp[path][kidx].bw = chan->band_width;
 
 	rtw89_debug(rtwdev, RTW89_DBG_RFK,
 		    "[DPK] S%d[%d] (PHY%d): TSSI %s/ DBCC %s/ %s/ CH%d/ %s\n",

From 2bab8fa4826bda9e1960bf820bc31f1b1de15da0 Mon Sep 17 00:00:00 2001
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Date: Tue, 25 Aug 2026 23:29:38 +0545
Subject: [PATCH 1064/1982] wifi: rtw89: cap firmware section_num before
 parsing

[ Upstream commit 273b0a8be083df6d0319ce62caa870e927f94a31 ]

rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
The v0/v1 header parsers take section_num from an 8-bit firmware field
(0..255) and write info->section_info[i] with no cap.
rtw89_fw_download_suit() keeps that object on the stack, so a crafted
firmware blob overflows the stack.

Reject a truncated header and a section table that does not fit in the
firmware image before reading fw_hdr->sections[i].

Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260825174438.63168-1-acharyalaxman8848@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 32 +++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 299526220380f4..c4fb9c226faeb0 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -156,8 +156,24 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
 	if (!info)
 		return -EINVAL;
 
+	if (len < sizeof(*fw_hdr)) {
+		rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+		return -EINVAL;
+	}
+
 	info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
+	if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+		rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+			  info->section_num);
+		return -EINVAL;
+	}
+
 	base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+	if (base_hdr_len > len) {
+		rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+		return -EINVAL;
+	}
+
 	info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
 	info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
 
@@ -449,9 +465,25 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
 	int ret;
 	u32 i;
 
+	if (len < sizeof(*fw_hdr)) {
+		rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+		return -EINVAL;
+	}
+
 	info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
+	if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+		rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+			  info->section_num);
+		return -EINVAL;
+	}
+
 	info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
 	base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+	if (base_hdr_len > len) {
+		rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+		return -EINVAL;
+	}
+
 	info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
 	info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
 

From 2c1fdcbb95bd67e2abfa5e194c0aed287527d079 Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Thu, 20 Aug 2026 23:19:01 +0300
Subject: [PATCH 1065/1982] platform/x86: int3472: Fix uninitialised variable
 warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 70e6384fe0f4cf9768944f81924f6c1478b0ce43 ]

Fix a compiler warning about an uninitialised err_msg variable by printing
the error where it is handled:

drivers/platform/x86/intel/int3472/discrete.c:440:24: warning: ‘err_msg’ may be used uninitialized [-Wmaybe-uninitialized]
  440 |                 return dev_err_probe(int3472->dev, ret, err_msg);

Fixes: 5de691bffe57 ("platform/x86: Add intel_skl_int3472 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/int3472/discrete.c | 25 +++++++++++--------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index 1505fc3ef7a858..96c33ba80002fc 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -280,7 +280,6 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 	unsigned long gpio_flags;
 	union acpi_object *obj;
 	struct gpio_desc *gpio;
-	const char *err_msg;
 	const char *con_id;
 	int ret;
 
@@ -326,7 +325,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 	case INT3472_GPIO_TYPE_HOTPLUG_DETECT:
 		ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, con_id, gpio_flags);
 		if (ret)
-			err_msg = "Failed to map GPIO pin to sensor\n";
+			dev_err_probe(int3472->dev, ret,
+				      "Failed to map GPIO pin to sensor\n");
 
 		break;
 	case INT3472_GPIO_TYPE_CLK_ENABLE:
@@ -336,7 +336,7 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 		gpio = skl_int3472_gpiod_get_from_temp_lookup(int3472, agpio, con_id, gpio_flags);
 		if (IS_ERR(gpio)) {
 			ret = PTR_ERR(gpio);
-			err_msg = "Failed to get GPIO\n";
+			dev_err_probe(int3472->dev, ret, "Failed to get GPIO\n");
 			break;
 		}
 
@@ -344,13 +344,15 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 		case INT3472_GPIO_TYPE_CLK_ENABLE:
 			ret = skl_int3472_register_gpio_clock(int3472, gpio);
 			if (ret)
-				err_msg = "Failed to register clock\n";
+				dev_err_probe(int3472->dev, ret,
+					      "Failed to register clock\n");
 
 			break;
 		case INT3472_GPIO_TYPE_PRIVACY_LED:
 			ret = skl_int3472_register_pled(int3472, gpio);
 			if (ret)
-				err_msg = "Failed to register LED\n";
+				dev_err_probe(int3472->dev, ret,
+					      "Failed to register LED\n");
 
 			break;
 		case INT3472_GPIO_TYPE_POWER_ENABLE:
@@ -360,7 +362,8 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 			ret = skl_int3472_register_regulator(int3472, gpio, enable_time_us,
 							     con_id, second_sensor);
 			if (ret)
-				err_msg = "Failed to register regulator\n";
+				dev_err_probe(int3472->dev, ret,
+					      "Failed to register regulator\n");
 
 			break;
 		default: /* Never reached */
@@ -383,11 +386,11 @@ static int skl_int3472_handle_gpio_resources(struct acpi_resource *ares,
 	int3472->ngpios++;
 	ACPI_FREE(obj);
 
-	if (ret < 0)
-		return dev_err_probe(int3472->dev, ret, err_msg);
-
-	/* Tell acpi_dev_get_resources() to not make a copy of the resource */
-	return 1;
+	/*
+	 * Either return an error or tell acpi_dev_get_resources() to not make a
+	 * copy of the resource.
+	 */
+	return ret < 0 ? ret : 1;
 }
 
 int int3472_discrete_parse_crs(struct int3472_discrete_device *int3472)

From cfe382cbabf6d5be415009cad6c58a2cf4f6a8b8 Mon Sep 17 00:00:00 2001
From: hanzhijian <hanzhijian1991@gmail.com>
Date: Mon, 24 Aug 2026 22:28:00 +0800
Subject: [PATCH 1066/1982] clk: mstar: msc313-mpll: fix off-by-one in clock
 array allocation

[ Upstream commit 712b75152c00a8ab0c56dbfe34caf88e3870ddde ]

The hws array of mpll->clk_data is allocated with struct_size() using
ARRAY_SIZE(output_dividers) as the element count, giving it 7 elements.
But the probe function stores the MPLL clock at hws[0] and one
fixed-factor clock for each output divider at hws[i + 1] for i in
[0, ARRAY_SIZE(output_dividers)), writing 8 elements in total.  The
final write to hws[7] is past the end of the allocation.

clk_data->num is also set to NUMOUTPUTS (8), so the clock framework
reads hws[0..7], again accessing hws[7] out of bounds.

Use NUMOUTPUTS as the element count so the allocation matches the
number of clocks actually stored and exposed.

Found by smatch:
  drivers/clk/mstar/clk-msc313-mpll.c:134 msc313_mpll_probe()
  error: buffer overflow 'mpll->clk_data->hws' 7 <= 7

Fixes: bef7a78da716 ("clk: mstar: MStar/SigmaStar MPLL driver")
Cc: stable@vger.kernel.org
Signed-off-by: hanzhijian <hanzhijian1991@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mstar/clk-msc313-mpll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/mstar/clk-msc313-mpll.c b/drivers/clk/mstar/clk-msc313-mpll.c
index 61beb4e8752509..bd45aa0aec0116 100644
--- a/drivers/clk/mstar/clk-msc313-mpll.c
+++ b/drivers/clk/mstar/clk-msc313-mpll.c
@@ -105,7 +105,7 @@ static int msc313_mpll_probe(struct platform_device *pdev)
 		return PTR_ERR(mpll->loop_div_second);
 
 	mpll->clk_data = devm_kzalloc(dev, struct_size(mpll->clk_data, hws,
-			ARRAY_SIZE(output_dividers)), GFP_KERNEL);
+				NUMOUTPUTS), GFP_KERNEL);
 	if (!mpll->clk_data)
 		return -ENOMEM;
 

From 6922b35cb2bbbe0522031cd811796adc1693180c Mon Sep 17 00:00:00 2001
From: Yo'av Moshe <linux@yoavmoshe.com>
Date: Sun, 30 Aug 2026 17:51:00 +0200
Subject: [PATCH 1067/1982] ARM: imx: Fix suspend/resume crash with Clang CFI

[ Upstream commit 242757d109bd5c9b8fb7194fb4d44625be0b859a ]

The suspend code that runs from OCRAM is copied there with fncpy(),
which does not copy the kCFI type hash preceding the function. With
CONFIG_CFI=y the indirect call through imx6_suspend_in_ocram_fn
therefore panics.

Keep the call covered by CFI instead of exempting it:

- Add SYM_TYPED_FUNC_START_ALIGNED(), a variant of
  SYM_TYPED_FUNC_START() that aligns the function entry rather than
  the type hash preceding it, and use it to declare imx6_suspend():
  fncpy() requires the entry point of the function it copies to be
  8-byte aligned. The macro lives in arch/arm/include/asm/linkage.h
  since the requirement comes from arm's fncpy().

- Add a cfi_type member at the end of struct imx6_cpu_pm_info, which
  directly precedes the OCRAM copy of the function. It fits in the
  struct's tail padding, so no sizes or offsets change. Fill it using
  cfi_get_func_hash(), putting the hash where the caller's CFI check
  expects it: four bytes before the function entry.

Also mark ccm_base, suspend_ocram_base and imx6_suspend_in_ocram_fn
as __ro_after_init: they are only written during __init, and the
function pointer in particular should not be writable afterwards.

Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yo'av Moshe <linux@yoavmoshe.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/include/asm/linkage.h   | 29 +++++++++++++++++++++++++++++
 arch/arm/mach-imx/pm-imx6.c      | 26 +++++++++++++++++++++++---
 arch/arm/mach-imx/suspend-imx6.S |  6 ++++--
 3 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/arch/arm/include/asm/linkage.h b/arch/arm/include/asm/linkage.h
index c4670694ada796..bba992f5d7a804 100644
--- a/arch/arm/include/asm/linkage.h
+++ b/arch/arm/include/asm/linkage.h
@@ -9,4 +9,33 @@
   .type name, %function; \
   END(name)
 
+#ifdef __ASSEMBLY__
+
+/*
+ * Variants of SYM_TYPED_START/SYM_TYPED_FUNC_START that align the
+ * function entry itself instead of the kCFI type hash preceding it,
+ * for functions whose entry point must meet an alignment requirement,
+ * such as the 8-byte alignment fncpy() demands of its source.
+ */
+#ifdef CONFIG_CFI
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align)	\
+	linkage(name) ASM_NL				\
+	.balign align ASM_NL				\
+	.fill (align) - 4, 1, 0 ASM_NL			\
+	__CFI_TYPE(name) ASM_NL				\
+	name:
+
+#else /* CONFIG_CFI */
+
+#define SYM_TYPED_START_ALIGNED(name, linkage, align)	\
+	SYM_START(name, linkage, .balign align)
+
+#endif /* CONFIG_CFI */
+
+#define SYM_TYPED_FUNC_START_ALIGNED(name, align)	\
+	SYM_TYPED_START_ALIGNED(name, SYM_L_GLOBAL, align)
+
+#endif /* __ASSEMBLY__ */
+
 #endif
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index a671ca498f887f..3c73e2cdb8cebe 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -4,6 +4,8 @@
  * Copyright 2011 Linaro Ltd.
  */
 
+#include <linux/build_bug.h>
+#include <linux/cfi.h>
 #include <linux/clk/imx.h>
 #include <linux/delay.h>
 #include <linux/init.h>
@@ -18,6 +20,7 @@
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
+#include <linux/stddef.h>
 #include <linux/suspend.h>
 #include <asm/cacheflush.h>
 #include <asm/fncpy.h>
@@ -61,9 +64,9 @@
 #define MX6Q_SUSPEND_OCRAM_SIZE		0x1000
 #define MX6_MAX_MMDC_IO_NUM		33
 
-static void __iomem *ccm_base;
-static void __iomem *suspend_ocram_base;
-static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase);
+static void __iomem *ccm_base __ro_after_init;
+static void __iomem *suspend_ocram_base __ro_after_init;
+static void (*imx6_suspend_in_ocram_fn)(void __iomem *ocram_vbase) __ro_after_init;
 
 /*
  * suspend ocram space layout:
@@ -229,8 +232,18 @@ struct imx6_cpu_pm_info {
 	struct imx6_pm_base l2_base;
 	u32 mmdc_io_num; /* Number of MMDC IOs which need saved/restored. */
 	u32 mmdc_io_val[MX6_MAX_MMDC_IO_NUM][2]; /* To save offset and value */
+	u32 cfi_type; /* kCFI type hash of imx6_suspend() */
 } __aligned(8);
 
+/*
+ * The ocram copy of imx6_suspend() starts right after struct imx6_cpu_pm_info,
+ * and the CFI check on the indirect call reads the kCFI type hash from the
+ * four bytes preceding the function entry, so cfi_type must occupy the last
+ * four bytes of the struct, i.e. fit into its tail padding.
+ */
+static_assert(offsetofend(struct imx6_cpu_pm_info, cfi_type) ==
+	      sizeof(struct imx6_cpu_pm_info));
+
 void imx6_set_int_mem_clk_lpm(bool enable)
 {
 	u32 val = readl_relaxed(ccm_base + CGPR);
@@ -568,6 +581,13 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
 			mmdc_offset_array[i]);
 	}
 
+	/*
+	 * Mask out the Thumb bit, as cfi_get_func_hash() expects the
+	 * function's actual start address. Returns 0 if CONFIG_CFI=n.
+	 */
+	pm_info->cfi_type =
+		cfi_get_func_hash((void *)((uintptr_t)&imx6_suspend & ~1UL));
+
 	imx6_suspend_in_ocram_fn = fncpy(
 		suspend_ocram_base + sizeof(*pm_info),
 		&imx6_suspend,
diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index 63ccc2d0e920ac..95d5f723ea0ed9 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -3,6 +3,7 @@
  * Copyright 2014 Freescale Semiconductor, Inc.
  */
 
+#include <linux/cfi_types.h>
 #include <linux/linkage.h>
 #include <asm/assembler.h>
 #include <asm/asm-offsets.h>
@@ -148,7 +149,8 @@
 
 	.endm
 
-ENTRY(imx6_suspend)
+/* fncpy() requires an 8-byte-aligned entry; see arch/arm/include/asm/fncpy.h */
+SYM_TYPED_FUNC_START_ALIGNED(imx6_suspend, 8)
 	ldr	r1, [r0, #PM_INFO_PBASE_OFFSET]
 	ldr	r2, [r0, #PM_INFO_RESUME_ADDR_OFFSET]
 	ldr	r3, [r0, #PM_INFO_DDR_TYPE_OFFSET]
@@ -329,4 +331,4 @@ resume:
 	resume_mmdc
 
 	ret	lr
-ENDPROC(imx6_suspend)
+SYM_FUNC_END(imx6_suspend)

From f1f18007989bb359802623c6deebba8a31090f6e Mon Sep 17 00:00:00 2001
From: Yuan Chen <chenyuan@kylinos.cn>
Date: Mon, 31 Aug 2026 14:32:25 +0800
Subject: [PATCH 1068/1982] bpf: Fix queue/stack map u32 index overflow

[ Upstream commit 802a30c5db726639df7f93b3a1982ecc64202abe ]

The queue/stack map addresses elements[] with the product of a u32
head/tail index and value_size, but the storage itself is allocated in
64-bit arithmetic.  When max_entries * value_size reaches or exceeds
U32_MAX, the product wraps and push/peek/pop operate on the wrong
element, corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also make the u32 capacity counter
qs->size (max_entries + 1) wrap to 0 and permanently break the map.

The original bound check was removed by commit a37fb7ef24a4 ("bpf:
Eliminate rlimit-based memory accounting for queue_stack_maps maps"),
which deleted the bpf_map_charge_init() call and with it the
U32_MAX - PAGE_SIZE check that had earlier been moved into
bpf_map_charge_init() by c85d69135a91.  Oversized queue/stack maps can
therefore be created again.

Restore the bound in queue_stack_map_alloc_check() with a single
comparison that rejects any max_entries/value_size combination whose
element storage would reach or exceed U32_MAX bytes, keeping the u32
index multiplication overflow-free and the capacity counter valid.

Fixes: a37fb7ef24a4 ("bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260831063226.621309-2-chenyuan_fl@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/queue_stack_maps.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index c1c9dee4dcdd02..b5628e4149817c 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -59,6 +59,9 @@ static int queue_stack_map_alloc_check(union bpf_attr *attr)
 		 */
 		return -E2BIG;
 
+	if (attr->max_entries >= U32_MAX / attr->value_size)
+		return -E2BIG;
+
 	return 0;
 }
 

From bef63213e20824fd594a95dc40514ee6241550f5 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Mon, 31 Aug 2026 00:17:47 +0800
Subject: [PATCH 1069/1982] hte: tegra194: Initialize slice locks before
 registering chip

[ Upstream commit 1329abe1bae416ab2cff89c3312d33f745d341c7 ]

Registering the HTE chip publishes its request callbacks to consumers.
Initialize every slice lock before registration so a concurrent HTE
request cannot use an uninitialized lock.

Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Fixes: 09574cca6ad6 ("hte: Add Tegra194 HTE kernel provider")
Cc: stable@vger.kernel.org
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hte/hte-tegra194.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/hte/hte-tegra194.c b/drivers/hte/hte-tegra194.c
index 690eb9be30fb8f..4644677370022e 100644
--- a/drivers/hte/hte-tegra194.c
+++ b/drivers/hte/hte-tegra194.c
@@ -787,17 +787,17 @@ static int tegra_hte_probe(struct platform_device *pdev)
 
 	hte_dev->chip = gc;
 
+	for (i = 0; i < slices; i++) {
+		hte_dev->sl[i].flags = 0;
+		spin_lock_init(&hte_dev->sl[i].s_lock);
+	}
+
 	ret = devm_hte_register_chip(hte_dev->chip);
 	if (ret) {
 		dev_err(gc->dev, "hte chip register failed");
 		return ret;
 	}
 
-	for (i = 0; i < slices; i++) {
-		hte_dev->sl[i].flags = 0;
-		spin_lock_init(&hte_dev->sl[i].s_lock);
-	}
-
 	val = HTE_TECTRL_ENABLE_ENABLE |
 	      (HTE_TECTRL_INTR_ENABLE << HTE_TECTRL_INTR_SHIFT) |
 	      (hte_dev->itr_thrshld << HTE_TECTRL_OCCU_SHIFT);

From c99e574764c339ccbb7dc391fe8106b9323cfb68 Mon Sep 17 00:00:00 2001
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Date: Sat, 1 Aug 2026 17:19:09 +0530
Subject: [PATCH 1070/1982] wifi: ath11k: Fix possible memory leak in
 ath11k_dp_srng_setup()

[ Upstream commit 6132d70d0890c03546f6970893fd71938efb2a2f ]

In ath11k_dp_srng_setup(), the memory allocated for
ring->vaddr_unaligned is not freed in the error paths that follow.
Fix that by calling ath11k_dp_srng_cleanup() in those error paths.

Compile tested only. Issue found using a prototype static analysis tool
built on the LLVM compiler infrastructure.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260801114911.91483-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/dp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c
index 68c7ef190780ac..5e67f088962e54 100644
--- a/drivers/net/wireless/ath/ath11k/dp.c
+++ b/drivers/net/wireless/ath/ath11k/dp.c
@@ -316,6 +316,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
 	case HAL_RXDMA_DIR_BUF:
 		break;
 	default:
+		ath11k_dp_srng_cleanup(ab, ring);
 		ath11k_warn(ab, "Not a valid ring type in dp :%d\n", type);
 		return -EINVAL;
 	}
@@ -327,6 +328,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring,
 
 	ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, &params);
 	if (ret < 0) {
+		ath11k_dp_srng_cleanup(ab, ring);
 		ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n",
 			    ret, ring_num);
 		return ret;

From c42a610d574265e5a0dde85a303328008af5379e Mon Sep 17 00:00:00 2001
From: Serin Yeh <serin.yeh@intel.com>
Date: Thu, 6 Aug 2026 14:18:04 +0800
Subject: [PATCH 1071/1982] media: i2c: ov8856 : remove ACPI node bypass
 mechanism

[ Upstream commit 609a71568664acb7ee57b42de002ca782e3769e8 ]

On Intel platforms the sensor is enumerated via ACPI, and an INT3472
"discrete" companion device (the power-logic-control driver under
drivers/platform/x86/intel/int3472) registers the sensor's
reset/powerdown GPIOs and the regulator supply. These resources are
therefore discoverable and usable through the standard gpiod/regulator
lookups at probe time.

However, the driver guarded both the GPIO/regulator acquisition in
ov8856_get_hwcfg() and the whole power-on/off sequence with
is_acpi_node() and skipped them on ACPI. As a result the sensor was
never powered or reset by the driver, and probe failed when reading the
chip ID in ov8856_identify_module().

Remove the is_acpi_node() checks so the GPIO/regulator resources are
acquired and the full power sequence runs regardless of the firmware
interface. The driver now behaves consistently across DT and ACPI
platforms and initialises the hardware correctly.

Tested on Intel platforms with kernel 6.17 and 7.0.

Fixes: d2fa1134a48b ("media: i2c: ov8856: Use V4L2 legacy sensor clock helper")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov8856.c | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index dd01e1d515ff6d..2e104734ef0b1b 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2071,9 +2071,6 @@ static int ov8856_power_on(struct device *dev)
 	struct ov8856 *ov8856 = to_ov8856(sd);
 	int ret;
 
-	if (is_acpi_node(dev_fwnode(dev)))
-		return 0;
-
 	ret = clk_prepare_enable(ov8856->xvclk);
 	if (ret < 0) {
 		dev_err(dev, "failed to enable xvclk\n");
@@ -2109,9 +2106,6 @@ static int ov8856_power_off(struct device *dev)
 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
 	struct ov8856 *ov8856 = to_ov8856(sd);
 
-	if (is_acpi_node(dev_fwnode(dev)))
-		return 0;
-
 	gpiod_set_value_cansleep(ov8856->reset_gpio, 1);
 	regulator_bulk_disable(ARRAY_SIZE(ov8856_supply_names),
 			       ov8856->supplies);
@@ -2282,21 +2276,18 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
 		dev_warn(dev, "external clock rate %u is unsupported",
 			 xvclk_rate);
 
-	if (!is_acpi_node(fwnode)) {
-		ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-							     GPIOD_OUT_LOW);
-		if (IS_ERR(ov8856->reset_gpio))
-			return PTR_ERR(ov8856->reset_gpio);
+	ov8856->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+						     GPIOD_OUT_LOW);
+	if (IS_ERR(ov8856->reset_gpio))
+		return PTR_ERR(ov8856->reset_gpio);
 
-		for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
-			ov8856->supplies[i].supply = ov8856_supply_names[i];
+	for (i = 0; i < ARRAY_SIZE(ov8856_supply_names); i++)
+		ov8856->supplies[i].supply = ov8856_supply_names[i];
 
-		ret = devm_regulator_bulk_get(dev,
-					      ARRAY_SIZE(ov8856_supply_names),
-					      ov8856->supplies);
-		if (ret)
-			return ret;
-	}
+	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ov8856_supply_names),
+				      ov8856->supplies);
+	if (ret)
+		return ret;
 
 	ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
 	if (!ep)

From 06b4dabdc67a0abcdb92b3882196a9d2dfcf4858 Mon Sep 17 00:00:00 2001
From: Serin Yeh <serin.yeh@intel.com>
Date: Thu, 6 Aug 2026 14:18:19 +0800
Subject: [PATCH 1072/1982] media: i2c: ov8856: fix debug message to report
 actual CSI-2 lane count

[ Upstream commit a15976e69b1c70ea16ef1f7172a846f6ef5dfa14 ]

The driver currently prints the number of data lanes using
ov8856->cur_mode->data_lanes in ov8856_get_hwcfg(). However,
the ov8856->cur_mode structure is not assigned to a clearly
supported mode at that point. Due to the missing pointer,
enabling dynamic debug may lead to a kernel panic.

Instead, the correct number of CSI-2 data lanes should be taken
from bus_cfg.bus.mipi_csi2.num_data_lanes, which represents the
real hardware configuration determined at runtime.

Fixes: c492ec9ae9ed ("media: ov8856: Add support for 2 data lanes")
Cc: stable@vger.kernel.org
Signed-off-by: Serin Yeh <serin.yeh@intel.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov8856.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov8856.c b/drivers/media/i2c/ov8856.c
index 2e104734ef0b1b..27d7ca17d4d681 100644
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -2307,7 +2307,8 @@ static int ov8856_get_hwcfg(struct ov8856 *ov8856)
 		goto check_hwcfg_error;
 	}
 
-	dev_dbg(dev, "Using %u data lanes\n", ov8856->cur_mode->data_lanes);
+	dev_dbg(dev, "Using %u data lanes\n",
+		bus_cfg.bus.mipi_csi2.num_data_lanes);
 
 	if (bus_cfg.bus.mipi_csi2.num_data_lanes == 2)
 		ov8856->priv_lane = &lane_cfg_2;

From 8cbeaea4d325f0fc980736b44a06dd1a30e177ff Mon Sep 17 00:00:00 2001
From: HyeongJun An <sammiee5311@gmail.com>
Date: Mon, 20 Jul 2026 23:11:03 +0900
Subject: [PATCH 1073/1982] mtd: spi-nor: sfdp: check the length of the xSPI
 Profile 1.0 table

[ Upstream commit b9f34a95a81021fa1f3c9cb8cfd458e66824cad6 ]

The spi_nor_parse_profile1() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1,
DWORD4 and DWORD5 without ever checking the table is that long.

So if a flash reports a length of one, the buffer is only four bytes
while DWORD4 and DWORD5 sit at byte offsets 12 and 16. With a length of
zero kmalloc() returns ZERO_SIZE_PTR rather than an error, so the NULL
check doesn't catch it and the first read dereferences it. And the value
doesn't just get thrown away. It ends up as the dummy cycle count for
8D-8D-8D fast reads.

To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.

Fixes: fb27f198971a ("mtd: spi-nor: sfdp: parse xSPI Profile 1.0 table")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/sfdp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index a8324c2da0acf2..7d6a604b899545 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1175,6 +1175,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor,
 #define PROFILE1_DWORD5_DUMMY_166MHZ		GENMASK(31, 27)
 #define PROFILE1_DWORD5_DUMMY_133MHZ		GENMASK(21, 17)
 #define PROFILE1_DWORD5_DUMMY_100MHZ		GENMASK(11, 7)
+#define SFDP_PROFILE1_DWORD_MIN			5
 
 /**
  * spi_nor_parse_profile1() - parse the xSPI Profile 1.0 table
@@ -1192,6 +1193,9 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
 	int ret;
 	u8 dummy, opcode;
 
+	if (profile1_header->length < SFDP_PROFILE1_DWORD_MIN)
+		return -EINVAL;
+
 	len = profile1_header->length * sizeof(*dwords);
 	dwords = kmalloc(len, GFP_KERNEL);
 	if (!dwords)

From 7317c31a54bb84decb5b25d1bc03b11e0f63af6a Mon Sep 17 00:00:00 2001
From: HyeongJun An <sammiee5311@gmail.com>
Date: Mon, 20 Jul 2026 23:11:04 +0900
Subject: [PATCH 1074/1982] mtd: spi-nor: sfdp: check the length of the SCCR
 map

[ Upstream commit 1413f38f37194673502e61cd3749e091c031370b ]

The spi_nor_parse_sccr() sizes its buffer from the table length the
flash reports in the SFDP parameter header. But it then reads DWORD1
and DWORD22 without ever checking the table is that long.

So if a flash reports a length of one, the buffer is only four bytes
while DWORD22 sits at byte offset 84. With a length of zero kmalloc()
returns ZERO_SIZE_PTR rather than an error, so the NULL check doesn't
catch it and the first read dereferences it.

To fix this, reject a table that's too short for the highest DWORD the
parser reads, the way spi_nor_parse_4bait() already does. The table is
optional, so this isn't fatal. The spi_nor_parse_sfdp() warns and
carries on.

The spi_nor_parse_sccr_mc() doesn't need the same check. It works out
the number of dice from the length it allocated with, so its highest
index stays inside the buffer.

Fixes: 7ab8b810757a ("mtd: spi-nor: sfdp: Add support for SCCR map for multi-chip device")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/sfdp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index 7d6a604b899545..a9668c83ac5ef4 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1266,6 +1266,7 @@ static int spi_nor_parse_profile1(struct spi_nor *nor,
 }
 
 #define SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE		BIT(31)
+#define SFDP_SCCR_DWORD_MIN				22
 
 /**
  * spi_nor_parse_sccr() - Parse the Status, Control and Configuration Register
@@ -1284,6 +1285,9 @@ static int spi_nor_parse_sccr(struct spi_nor *nor,
 	size_t len;
 	int ret;
 
+	if (sccr_header->length < SFDP_SCCR_DWORD_MIN)
+		return -EINVAL;
+
 	len = sccr_header->length * sizeof(*dwords);
 	dwords = kmalloc(len, GFP_KERNEL);
 	if (!dwords)

From 1545217ceadc604730ae4fcc6221a7fea07ca7ef Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 11 Aug 2026 17:56:23 +0200
Subject: [PATCH 1075/1982] mtd: spi-nor: Unprepare legacy controllers upon RWW
 wait interruption

[ Upstream commit f594a33f9721f08facd98d0a31adc14ff6da9d70 ]

All the parallel locking helpers (spi_nor_prep_and_lock(),
spi_nor_prep_and_lock_pe() and spi_nor_prep_and_lock_rd()) call
spi_nor_prep() then wait with a killable sleep. If the sleep gets
killed, we leave the controller in its prepared state.

Call ->unprepare() in these cases.

Fixes: 74df43b3f626 ("mtd: spi-nor: Enhance locking to support reads while writes")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 037407fc2e113c..512d0e4e3b1f60 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -1281,6 +1281,9 @@ int spi_nor_prep_and_lock(struct spi_nor *nor)
 		ret = wait_event_killable(nor->rww.wait,
 					  spi_nor_rww_start_exclusive(nor));
 
+	if (ret)
+		spi_nor_unprep(nor);
+
 	return ret;
 }
 
@@ -1352,6 +1355,9 @@ static int spi_nor_prep_and_lock_pe(struct spi_nor *nor, loff_t start, size_t le
 		ret = wait_event_killable(nor->rww.wait,
 					  spi_nor_rww_start_pe(nor, start, len));
 
+	if (ret)
+		spi_nor_unprep(nor);
+
 	return ret;
 }
 
@@ -1425,6 +1431,9 @@ static int spi_nor_prep_and_lock_rd(struct spi_nor *nor, loff_t start, size_t le
 		ret = wait_event_killable(nor->rww.wait,
 					  spi_nor_rww_start_rd(nor, start, len));
 
+	if (ret)
+		spi_nor_unprep(nor);
+
 	return ret;
 }
 

From 3c21a1feaf89cda986bd2d74199a070688bd2b1e Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Thu, 3 Sep 2026 02:21:00 +0200
Subject: [PATCH 1076/1982] fs_pin: publish pins with RCU list helpers

[ Upstream commit 8d01d6b4c17c406f37a9b6edac93dfb858af30d0 ]

pin_insert() initializes a pin before adding it under pin_lock.  The kill
paths read the list heads under RCU without taking that lock.  Plain hlist
insertion does not publish the earlier initialization to those readers.

KCSAN weak-memory checking reported acct_on() callback initialization
racing with pin_kill() after the superblock-list publication.  The
corresponding LKMM model permits the stale read with plain publication;
the RCU release/acquire pair forbids it.

Use the RCU hlist add and dereference helpers for both pin lists.

Fixes: 2798d4ce6160 ("acct: get rid of acct_lock for acct->count")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260903002100.34822-1-kmehltretter@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs_pin.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/fs_pin.c b/fs/fs_pin.c
index 47ef3c71ce9077..1a508f2167e0a3 100644
--- a/fs/fs_pin.c
+++ b/fs/fs_pin.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/fs.h>
+#include <linux/rculist.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include "internal.h"
@@ -22,8 +23,8 @@ void pin_remove(struct fs_pin *pin)
 void pin_insert(struct fs_pin *pin, struct vfsmount *m)
 {
 	spin_lock(&pin_lock);
-	hlist_add_head(&pin->s_list, &m->mnt_sb->s_pins);
-	hlist_add_head(&pin->m_list, &real_mount(m)->mnt_pins);
+	hlist_add_head_rcu(&pin->s_list, &m->mnt_sb->s_pins);
+	hlist_add_head_rcu(&pin->m_list, &real_mount(m)->mnt_pins);
 	spin_unlock(&pin_lock);
 }
 
@@ -73,7 +74,7 @@ void mnt_pin_kill(struct mount *m)
 	while (1) {
 		struct hlist_node *p;
 		rcu_read_lock();
-		p = READ_ONCE(m->mnt_pins.first);
+		p = rcu_dereference(hlist_first_rcu(&m->mnt_pins));
 		if (!p) {
 			rcu_read_unlock();
 			break;
@@ -87,7 +88,7 @@ void group_pin_kill(struct hlist_head *p)
 	while (1) {
 		struct hlist_node *q;
 		rcu_read_lock();
-		q = READ_ONCE(p->first);
+		q = rcu_dereference(hlist_first_rcu(p));
 		if (!q) {
 			rcu_read_unlock();
 			break;

From ced6f89824f84baeb80a1775e72776978e641808 Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Wed, 2 Sep 2026 18:49:25 +0200
Subject: [PATCH 1077/1982] fs: make sure to call fsnotify_inoderemove() only
 once when inode is dead

[ Upstream commit 669bb5af15d41a21359d00a441490f87a88eb52a ]

Daehyeon reported a race wherein fsnotify_removeinode() can be called
when inode still has a live alias.  This can lead to several undesired
outcomes such as crashes in fsnotify code or avoidance of inode mark
notifications.

Check that inode is really "dead", meaning no nlink and no more aliases
before calling fsnotify_inoderemove() for final cleanup of inode marks.
Also do not allow open_by_handle() to add new aliases to a "dead" inode.

Ideally, we'd call fsnotify_inoderemove() once last inode reference is
dropped to make things simpler. Alas fsnotify inode marks currently hold
inode references and thus this doesn't work. Once we teach fsnotify to
avoid holding inode references, these games with dead inodes can go as
well.

Reported-and-tested-by: Daehyeon Ko <4ncienth@gmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/20260827045007.3831259-1-4ncienth@gmail.com/
CC: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260902164924.1333135-2-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dcache.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 5ee1c3d592c857..1b4c210338022a 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -442,6 +442,17 @@ static void dentry_free(struct dentry *dentry)
 		call_rcu(&dentry->d_u.d_rcu, __d_free);
 }
 
+/*
+ * If inode is unlinked and doesn't have any aliases (i.e., all fds pointing to
+ * it are closed), it is pretty much dead. Except that file handle lookup could
+ * still revive it which causes issues to fsnotify. So once inode reaches this
+ * state we make sure to block creating any new aliases.
+ */
+static bool inode_notify_dead(struct inode *inode)
+{
+	return !inode->i_nlink && hlist_empty(&inode->i_dentry);
+}
+
 /*
  * Release the dentry's inode, using the filesystem
  * d_iput() operation if defined.
@@ -451,14 +462,16 @@ static void dentry_unlink_inode(struct dentry * dentry)
 	__releases(dentry->d_inode->i_lock)
 {
 	struct inode *inode = dentry->d_inode;
+	bool notify_dead;
 
 	raw_write_seqcount_begin(&dentry->d_seq);
 	__d_clear_type_and_inode(dentry);
 	hlist_del_init(&dentry->d_u.d_alias);
 	raw_write_seqcount_end(&dentry->d_seq);
+	notify_dead = inode_notify_dead(inode);
 	spin_unlock(&dentry->d_lock);
 	spin_unlock(&inode->i_lock);
-	if (!inode->i_nlink)
+	if (notify_dead)
 		fsnotify_inoderemove(inode);
 	if (dentry->d_op && dentry->d_op->d_iput)
 		dentry->d_op->d_iput(dentry, inode);
@@ -2022,7 +2035,12 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
 
 	sb = inode->i_sb;
 
-	res = d_find_any_alias(inode); /* existing alias? */
+	spin_lock(&inode->i_lock);
+	if (!inode_notify_dead(inode))
+		res = __d_find_any_alias(inode);	/* existing alias? */
+	else
+		res = ERR_PTR(-ESTALE);
+	spin_unlock(&inode->i_lock);
 	if (res)
 		goto out;
 
@@ -2034,7 +2052,10 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
 
 	security_d_instantiate(new, inode);
 	spin_lock(&inode->i_lock);
-	res = __d_find_any_alias(inode); /* recheck under lock */
+	if (!inode_notify_dead(inode))
+		res = __d_find_any_alias(inode);	/* recheck under lock */
+	else
+		res = ERR_PTR(-ESTALE);
 	if (likely(!res)) { /* still no alias, attach a disconnected dentry */
 		unsigned add_flags = d_flags_for_inode(inode);
 

From 781364a1fb9dd60067d72b09bcf4e5f4b24a1b02 Mon Sep 17 00:00:00 2001
From: Francesco Dolcini <francesco.dolcini@toradex.com>
Date: Thu, 13 Aug 2026 13:12:36 +0200
Subject: [PATCH 1078/1982] arm64: dts: ti: k3-am62-verdin: Set MMC clock pins
 as OUTPUT

[ Upstream commit 0ddd661c19ec1465e1f2c204fa9b2488acfabf4b ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

Link: https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals [0]
Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Judith Mendez <jm@ti.com>
Link: https://patch.msgid.link/20260813111238.56892-1-francesco@dolcini.it
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
index 059ec492a973ec..5e8830fffb9499 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -573,7 +573,7 @@
 	pinctrl_sdhci0: main-mmc0-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x220, PIN_INPUT,        0) /*  (Y3) MMC0_CMD  */
-			AM62X_IOPAD(0x218, PIN_INPUT,        0) /* (AB1) MMC0_CLK  */
+			AM62X_IOPAD(0x218, PIN_OUTPUT,       0) /* (AB1) MMC0_CLK  */
 			AM62X_IOPAD(0x214, PIN_INPUT,        0) /* (AA2) MMC0_DAT0 */
 			AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
 			AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */
@@ -589,7 +589,7 @@
 	pinctrl_sdhci1: main-mmc1-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x23c, PIN_INPUT,        0) /* (A21) MMC1_CMD  */ /* SODIMM 74 */
-			AM62X_IOPAD(0x234, PIN_INPUT,        0) /* (B22) MMC1_CLK  */ /* SODIMM 78 */
+			AM62X_IOPAD(0x234, PIN_OUTPUT,       0) /* (B22) MMC1_CLK  */ /* SODIMM 78 */
 			AM62X_IOPAD(0x230, PIN_INPUT,        0) /* (A22) MMC1_DAT0 */ /* SODIMM 80 */
 			AM62X_IOPAD(0x22c, PIN_INPUT,        0) /* (B21) MMC1_DAT1 */ /* SODIMM 82 */
 			AM62X_IOPAD(0x228, PIN_INPUT,        0) /* (C21) MMC1_DAT2 */ /* SODIMM 70 */
@@ -601,7 +601,7 @@
 	pinctrl_sdhci2: main-mmc2-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x120, PIN_INPUT, 0) /* (C24) MMC2_CMD   */ /* WiFi_SDIO_CMD   */
-			AM62X_IOPAD(0x118, PIN_INPUT, 0) /* (D25) MMC2_CLK   */ /* WiFi_SDIO_CLK   */
+			AM62X_IOPAD(0x118, PIN_OUTPUT,0) /* (D25) MMC2_CLK   */ /* WiFi_SDIO_CLK   */
 			AM62X_IOPAD(0x114, PIN_INPUT, 0) /* (B24) MMC2_DAT0  */ /* WiFi_SDIO_DATA0 */
 			AM62X_IOPAD(0x110, PIN_INPUT, 0) /* (C25) MMC2_DAT1  */ /* WiFi_SDIO_DATA1 */
 			AM62X_IOPAD(0x10c, PIN_INPUT, 0) /* (E23) MMC2_DAT2  */ /* WiFi_SDIO_DATA2 */

From cb93d82e206c0ee10288a62b394b492939e0e670 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <thorsten.blum@linux.dev>
Date: Sat, 15 Aug 2026 11:01:34 +0200
Subject: [PATCH 1079/1982] thermal: intel: powerclamp: Reject invalid
 window_size values

[ Upstream commit 40989202104e498ff9adfb8c575d6cd159f13988 ]

window_size_set() sets ret to -EINVAL if new_window_size is outside the
valid range, but then falls through and still updates window_size to the
clamped value.

Return -EINVAL immediately and do not update window_size. Also drop the
now-redundant clamp() call.

Fixes: d6d71ee4a14a ("PM: Introduce Intel PowerClamp Driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260815090136.88540-2-thorsten.blum@linux.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/intel/intel_powerclamp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c
index 9a4cec00091061..61665f945b4c00 100644
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -290,9 +290,10 @@ static int window_size_set(const char *arg, const struct kernel_param *kp)
 		pr_err("Out of recommended window size %lu, between 2-10\n",
 			new_window_size);
 		ret = -EINVAL;
+		goto exit_win;
 	}
 
-	window_size = clamp(new_window_size, 2ul, 10ul);
+	window_size = new_window_size;
 	smp_mb();
 
 exit_win:

From 0a0fef460f20766febf4b7a9d36814b8c1b27a14 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Wed, 26 Aug 2026 17:31:43 +0200
Subject: [PATCH 1080/1982] thermal: intel: int340x: Fix temperature selection
 around 0 C

[ Upstream commit e56e2b49c67d132728e52ce493079e83cc914657 ]

Since commit 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to
support negative CPU temperature"), intel_tcc_get_temp() can report
negative temperatures.

proc_thermal_get_zone_temp() still uses *temp as the current maximum and
as an implicit "no reading yet" marker. However, this breaks when a CPU
reports 0 C, because a subsequent negative reading can overwrite it.

Use bool temp_valid to track whether a valid temperature has been read.
Initialize *temp with the first valid reading and only update it with
warmer readings.

Fixes: 7251b9e8a007 ("thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature")
Cc: 6.3+ <stable@vger.kernel.org> # 6.3+
Signed-off-by: Thorsten Blum <blum@kernel.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260826153144.299746-3-blum@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../intel/int340x_thermal/processor_thermal_device.c   | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 48e7849d48160e..dc9c82e8650e7e 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -178,17 +178,21 @@ static int proc_thermal_get_zone_temp(struct thermal_zone_device *zone,
 {
 	int cpu;
 	int curr_temp, ret;
-
-	*temp = 0;
+	bool temp_valid = false;
 
 	for_each_online_cpu(cpu) {
 		ret = intel_tcc_get_temp(cpu, &curr_temp, false);
 		if (ret < 0)
 			return ret;
-		if (!*temp || curr_temp > *temp)
+		if (!temp_valid || curr_temp > *temp) {
 			*temp = curr_temp;
+			temp_valid = true;
+		}
 	}
 
+	if (!temp_valid)
+		return -ENODATA;
+
 	*temp *= 1000;
 
 	return 0;

From ec0ec28012816a9e3b6904a9b89a9c71c7d61414 Mon Sep 17 00:00:00 2001
From: Baolin Liu <liubaolin@kylinos.cn>
Date: Mon, 7 Sep 2026 16:26:02 +0800
Subject: [PATCH 1081/1982] isofs: fix Rock Ridge CE extent validation on
 multisession media

[ Upstream commit 43de050fa4a31f7e7a73cf8974dcf6037e161a39 ]

Commit a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent
against volume size") compares the CE extent directly with s_nzones.  The
extent is an absolute block number, while s_nzones is the number of blocks
relative to the selected ISO session.  The comparison is therefore wrong
when a multisession disc starts at a non-zero block.

isofs_get_last_session() selects the last session on multisession
media, and its volume descriptors describe a volume beginning at that
session's LBA.
For example, a session beginning at LBA 45447 with 64 blocks can contain a
valid CE at absolute LBA 45467.  The existing check rejects that CE, so the
ER continuation record is not read, Rock Ridge is disabled, and the mount
falls back to Joliet names.

Save the selected session start in filesystem-block units and validate the
CE extent against the half-open interval [session_start, session_end).
Scale the session length to the same block units and retain a separate
block-device limit.  The lower bound is intentional: accepting arbitrary
blocks before the selected session could make a CE read data from a
previous session or another filesystem on the device.

Only apply the bounds check when cont_extent is non-zero.  A zero extent is
the in-memory sentinel indicating that no CE continuation was found, rather
than a request to read block zero.

For a single-session image, session_start is zero and the effective volume
boundary remains unchanged.

Build-tested with:

    make CONFIG_RUST= CONFIG_RUST_DRIVERS= fs/isofs/

Fixes: a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent against volume size")
Cc: stable@vger.kernel.org
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Link: https://patch.msgid.link/20260907082602.3777551-1-liubaolin12138@163.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/isofs/inode.c |  2 ++
 fs/isofs/isofs.h |  2 ++
 fs/isofs/rock.c  | 11 +++++++++--
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 3433fa14cd0146..8a0da54f391d0d 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -821,6 +821,8 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
 	if (!sb_set_blocksize(s, orig_zonesize))
 		goto out_freesbi;
 
+	sbi->s_session_start = (sector_t)vol_desc_start <<
+				(ISOFS_BLOCK_BITS - s->s_blocksize_bits);
 	sbi->s_nls_iocharset = NULL;
 
 #ifdef CONFIG_JOLIET
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index 50655583753334..a36a6347974358 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -35,6 +35,8 @@ struct isofs_sb_info {
 	unsigned long s_firstdatazone;
 	unsigned long s_log_zone_size;
 	unsigned long s_max_size;
+	/* Session start in filesystem block units. */
+	sector_t s_session_start;
 	
 	int           s_rock_offset; /* offset of SUSP fields within SU area */
 	s32           s_sbsector;
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index 869b331eff4f69..a4a337301b6f99 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -9,6 +9,7 @@
 
 #include <linux/slab.h>
 #include <linux/pagemap.h>
+#include <linux/blkdev.h>
 
 #include "isofs.h"
 #include "rock.h"
@@ -84,6 +85,10 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
  */
 static int rock_continue(struct rock_state *rs)
 {
+	struct super_block *sb = rs->inode->i_sb;
+	struct isofs_sb_info *sbi = ISOFS_SB(sb);
+	sector_t session_end = sbi->s_session_start +
+		((sector_t)sbi->s_nzones << (ISOFS_BLOCK_BITS - sb->s_blocksize_bits));
 	int ret = 1;
 	int blocksize = 1 << rs->inode->i_blkbits;
 	const int min_de_size = offsetof(struct rock_ridge, u);
@@ -101,11 +106,13 @@ static int rock_continue(struct rock_state *rs)
 		goto out;
 	}
 
-	if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) {
+	if (rs->cont_extent &&
+	    (rs->cont_extent < sbi->s_session_start ||
+	     rs->cont_extent >= session_end)) {
 		printk(KERN_NOTICE "rock: corrupted directory entry. "
 			"extent=%u out of volume (nzones=%lu)\n",
 			(unsigned)rs->cont_extent,
-			ISOFS_SB(rs->inode->i_sb)->s_nzones);
+			sbi->s_nzones);
 		ret = -EIO;
 		goto out;
 	}

From ced0704d1e0cb404ef2068789953fa6fd0d4563d Mon Sep 17 00:00:00 2001
From: Andrea Pesaresi <andreapesaresi82@gmail.com>
Date: Sat, 29 Aug 2026 17:19:55 +0200
Subject: [PATCH 1082/1982] arm64: dts: mediatek: mt7986: correct timer
 frequency

[ Upstream commit 1cf18e4b9815beaf0439c5b57b65b45151c82ad7 ]

The MT7986 architected timer runs at 12,986,200 Hz rather than 13 MHz.
Firmware reports 13 MHz through CNTFRQ_EL0, causing the system clock to
run slow by about 1062 ppm. This exceeds the kernel's 500 ppm NTP
correction limit and leaves clock discipline saturated.

The corrected rate comes from MediaTek's downstream OpenWrt feed, where
it is applied to both MT7986A and MT7986B. Since upstream mt7986b.dtsi
includes mt7986a.dtsi, add it once to the common timer node so the
architected timer driver uses the actual counter rate.

Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support")
Cc: stable@vger.kernel.org
Link: https://github.com/mediatek/mtk-openwrt-feeds/commit/6a4c41c41410cd5042ad10c39da6593ba036283c
Link: https://github.com/openwrt/openwrt/issues/24789
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 6786e5b590e85a..df5f7d831d8191 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -653,6 +653,7 @@
 	timer {
 		compatible = "arm,armv8-timer";
 		interrupt-parent = <&gic>;
+		clock-frequency = <12986200>;
 		interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
 			     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
 			     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,

From 5c8ecd9ebc95523c950b3616703d4c19ee5e8b33 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Wed, 29 Jul 2026 07:26:13 +0000
Subject: [PATCH 1083/1982] media: cx231xx-audio: drain wq_trigger before audio
 fini

[ Upstream commit a691c54986412e1fa87f036d2577d5a78a75e658 ]

audio_trigger() is deferred work (dev->wq_trigger) armed from
snd_cx231xx_capture_trigger() on every PCM START/STOP; it dereferences
dev->adev state and may free the URBs via cx231xx_isoc_audio_deinit().
cx231xx_audio_fini() tore down that state without draining wq_trigger,
so work armed before or racing fini ran against freed state.

Use disable_work_sync() in fini to drain the work and prevent further
queueing.  Initialize the work, lock and stream_started counter at the
top of cx231xx_audio_init(), before any fallible allocation, and clear
the partially-built audio state on its error path, so fini is safe even
if a later step fails.

This issue was found by an in-house static analysis tool.

Fixes: 61b04cb24a12 ("[media] cx231xx-audio: fix some locking issues")
Cc: stable@vger.kernel.org # v6.10+
Link: https://lore.kernel.org/r/8c7e1294-b906-4636-890c-b64d03b0e1d0@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/cx231xx/cx231xx-audio.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index 9c71b32552df3a..1179cb0334f4d7 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -576,12 +576,19 @@ static int cx231xx_audio_init(struct cx231xx *dev)
 	dev_dbg(dev->dev,
 		"probing for cx231xx non standard usbaudio\n");
 
+	/*
+	 * Extension init errors are ignored by the cx231xx core, so fini()
+	 * must be safe even if initialization fails part way through.
+	 */
+	spin_lock_init(&adev->slock);
+	INIT_WORK(&dev->wq_trigger, audio_trigger);
+	atomic_set(&dev->stream_started, 0);
+
 	err = snd_card_new(dev->dev, index[devnr], "Cx231xx Audio",
 			   THIS_MODULE, 0, &card);
 	if (err < 0)
 		return err;
 
-	spin_lock_init(&adev->slock);
 	err = snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm);
 	if (err < 0)
 		goto err_free_card;
@@ -596,8 +603,6 @@ static int cx231xx_audio_init(struct cx231xx *dev)
 	strscpy(card->shortname, "Cx231xx Audio", sizeof(card->shortname));
 	strscpy(card->longname, "Conexant cx231xx Audio", sizeof(card->longname));
 
-	INIT_WORK(&dev->wq_trigger, audio_trigger);
-
 	err = snd_card_register(card);
 	if (err < 0)
 		goto err_free_card;
@@ -651,8 +656,10 @@ static int cx231xx_audio_init(struct cx231xx *dev)
 
 err_free_pkt_size:
 	kfree(adev->alt_max_pkt_size);
+	adev->alt_max_pkt_size = NULL;
 err_free_card:
 	snd_card_free(card);
+	adev->sndcard = NULL;
 
 	return err;
 }
@@ -669,6 +676,8 @@ static int cx231xx_audio_fini(struct cx231xx *dev)
 		return 0;
 	}
 
+	disable_work_sync(&dev->wq_trigger);
+
 	if (dev->adev.sndcard) {
 		snd_card_free_when_closed(dev->adev.sndcard);
 		kfree(dev->adev.alt_max_pkt_size);

From c7091528ab213890694dada122a3f75a63c735e3 Mon Sep 17 00:00:00 2001
From: Andi Shyti <andi.shyti@kernel.org>
Date: Fri, 28 Aug 2026 15:59:50 +0200
Subject: [PATCH 1084/1982] media: cx231xx: Fix cleanup path on failure

[ Upstream commit 6e30287eaf3e41b86dfb86df3b811526693d74b4 ]

If cx231xx_init_v4l2() fails the probe currently jumps to
err_init, which only unregisters the V4L2 device. The analog
devices and I2C resources are left registered while the driver
state can be released.

A subsequent driver bind attempts to create the same I2C mux
channel links and triggers a warning when the existing
"channel-0" link is encountered. The remaining devices may also
access released driver state. This produces the following warning

    can't create symlink to channel 0
    WARNING: drivers/i2c/i2c-mux.c:403 at i2c_mux_add_adapter+0xcd8/0xeb0
    Call Trace:
     i2c_mux_add_adapter+0xcdc/0xeb0
     cx231xx_dev_init+0x2fb/0x1260
     cx231xx_usb_probe+0xc48/0x2140
     usb_probe_interface+0x657/0xc70
     ...

Jump to err_video_alt instead, which performs the full device
cleanup before unregistering the V4L2 device.

Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://github.com/farhad-alemi/public_bug_reports/tree/main/185-warning-in-i2c-mux-add-adapter/
Fixes: 4d2a7d3509f5 ("[media] cx231xx: move analog init code to a separate function")
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: <stable@vger.kernel.org> # v3.17+
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index d96b9ab276b766..1824e36e541f81 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1828,7 +1828,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
 
 	retval = cx231xx_init_v4l2(dev, udev, interface, isoc_pipe);
 	if (retval)
-		goto err_init;
+		goto err_video_alt;
 
 	if (dev->current_pcb_config.ts1_source != 0xff) {
 		/* compute alternate max packet sizes for TS1 */

From 3fcfab4339c8ecdadbc7a33033a6973d8fdd1e71 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Tue, 8 Sep 2026 21:28:40 +0900
Subject: [PATCH 1085/1982] firewire: core: fix source bus ID detection for AT
 context in big-endian systems

[ Upstream commit 6393d75914a6ac95a05621db8d9d6a98eafe72f7 ]

The source bus ID bit in AT DMA context is not detected correctly on
big-endian systems because the little-endian data is not converted to
CPU endianness.

Fix the bug. The helper functions related to this are never used in
driver code, so extend the test to check the field instead.

Cc: stable@vger.kernel.org # v6.12
Fixes: 8db9d1557122 ("firewire: ohci: add static inline functions to serialize/deserialize data of AT DMA")
Link: https://lore.kernel.org/r/20260908122840.2886621-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firewire/ohci-serdes-test.c | 4 ++--
 drivers/firewire/ohci.h             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/firewire/ohci-serdes-test.c b/drivers/firewire/ohci-serdes-test.c
index 258f668619ef1c..87b136e041de3b 100644
--- a/drivers/firewire/ohci-serdes-test.c
+++ b/drivers/firewire/ohci-serdes-test.c
@@ -43,7 +43,7 @@ static void test_self_id_receive_buffer_deserialization(struct kunit *test)
 static void test_at_data_serdes(struct kunit *test)
 {
 	static const __le32 expected[] = {
-		cpu_to_le32(0x00020e80),
+		cpu_to_le32(0x00820e80),
 		cpu_to_le32(0xffc2ffff),
 		cpu_to_le32(0xe0000000),
 	};
@@ -56,7 +56,7 @@ static void test_at_data_serdes(struct kunit *test)
 	unsigned int destination_id = ohci1394_at_data_get_destination_id(expected);
 	u64 destination_offset = ohci1394_at_data_get_destination_offset(expected);
 
-	KUNIT_EXPECT_FALSE(test, has_src_bus_id);
+	KUNIT_EXPECT_TRUE(test, has_src_bus_id);
 	KUNIT_EXPECT_EQ(test, 0x02, speed);
 	KUNIT_EXPECT_EQ(test, 0x03, tlabel);
 	KUNIT_EXPECT_EQ(test, 0x02, retry);
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 218666cfe14a5e..63ccf2f4450458 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -178,7 +178,7 @@
 
 static inline bool ohci1394_at_data_get_src_bus_id(const __le32 *data)
 {
-	return !!((data[0] & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
+	return !!((le32_to_cpu(data[0]) & OHCI1394_AT_DATA_Q0_srcBusID_MASK) >> OHCI1394_AT_DATA_Q0_srcBusID_SHIFT);
 }
 
 static inline void ohci1394_at_data_set_src_bus_id(__le32 *data, bool src_bus_id)

From 5bb8c5b1727ca8593df5711c186e6a9263436c27 Mon Sep 17 00:00:00 2001
From: Ruoyu Wang <ruoyuw560@gmail.com>
Date: Fri, 14 Aug 2026 21:41:00 +0800
Subject: [PATCH 1086/1982] media: au0828: Free URBs when starting DVB
 streaming fails

[ Upstream commit b8dd133d96a40012f4b67fd48d8ddd7306a3e024 ]

start_urb_transfer() stores each allocated URB in dev->urbs[], but sets
urb_streaming only after all URBs have been submitted. If a later URB or
transfer buffer allocation fails, earlier entries are left allocated. A
submission failure calls stop_urb_transfer(), but that function returns
immediately while urb_streaming is false, leaving both submitted and
unsubmitted URBs behind.

Make stop_urb_transfer() release every populated slot regardless of the
streaming flag and clear each slot after release. Route all start errors
through this cleanup. usb_kill_urb() safely handles both submitted and
unsubmitted URBs, while the existing preallocation check preserves the
lifetime of shared transfer buffers.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 265a6510629a ("V4L/DVB (7621): Add support for Hauppauge HVR950Q/HVR850/FusioHDTV7-USB")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/au0828/au0828-dvb.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c
index 51752a922a744a..4dc6377466858e 100644
--- a/drivers/media/usb/au0828/au0828-dvb.c
+++ b/drivers/media/usb/au0828/au0828-dvb.c
@@ -163,9 +163,6 @@ static int stop_urb_transfer(struct au0828_dev *dev)
 
 	dprintk(2, "%s()\n", __func__);
 
-	if (!dev->urb_streaming)
-		return 0;
-
 	if (dev->bulk_timeout_running == 1) {
 		dev->bulk_timeout_running = 0;
 		timer_delete(&dev->bulk_timeout);
@@ -179,6 +176,7 @@ static int stop_urb_transfer(struct au0828_dev *dev)
 				kfree(dev->urbs[i]->transfer_buffer);
 
 			usb_free_urb(dev->urbs[i]);
+			dev->urbs[i] = NULL;
 		}
 	}
 
@@ -200,8 +198,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
 	for (i = 0; i < URB_COUNT; i++) {
 
 		dev->urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
-		if (!dev->urbs[i])
-			return -ENOMEM;
+		if (!dev->urbs[i]) {
+			ret = -ENOMEM;
+			goto err;
+		}
 
 		purb = dev->urbs[i];
 
@@ -217,7 +217,7 @@ static int start_urb_transfer(struct au0828_dev *dev)
 			ret = -ENOMEM;
 			pr_err("%s: failed big buffer allocation, err = %d\n",
 			       __func__, ret);
-			return ret;
+			goto err;
 		}
 
 		purb->status = -EINPROGRESS;
@@ -235,10 +235,9 @@ static int start_urb_transfer(struct au0828_dev *dev)
 	for (i = 0; i < URB_COUNT; i++) {
 		ret = usb_submit_urb(dev->urbs[i], GFP_ATOMIC);
 		if (ret != 0) {
-			stop_urb_transfer(dev);
 			pr_err("%s: failed urb submission, err = %d\n",
 			       __func__, ret);
-			return ret;
+			goto err;
 		}
 	}
 
@@ -249,6 +248,10 @@ static int start_urb_transfer(struct au0828_dev *dev)
 	dev->bulk_timeout_running = 1;
 
 	return 0;
+
+err:
+	stop_urb_transfer(dev);
+	return ret;
 }
 
 static void au0828_start_transport(struct au0828_dev *dev)

From 2cdba0da8c13dbc29dbb7a98fe5955588c585a8b Mon Sep 17 00:00:00 2001
From: Linkai Gong <gonglinkai@kylinos.cn>
Date: Tue, 25 Aug 2026 10:26:16 +0800
Subject: [PATCH 1087/1982] media: i2c: tc358743: add missing color-space
 strings

[ Upstream commit cb37e83f1bbdf0964ed0a9524ce45a0694f98205 ]

VI_STATUS3 S_V_COLOR is four bits, so the index after the shift
is 0-15. input_color_space[] only has 14 entries. Add the two
reserved values so log_status() cannot walk off the table.

Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tc358743.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index a0ca19359c4314..aefc442b5737c6 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1373,7 +1373,8 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
 	static const char * const input_color_space[] = {
 		"RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
 		"xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
-		"NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+		"NA(10)", "NA(11)", "NA(12)", "opYCC 601", "NA(14)",
+		"NA(15)"};
 
 	v4l2_info(sd, "-----Chip status-----\n");
 	v4l2_info(sd, "Chip ID: 0x%02x\n",

From d208c267148f61a041a1927fec5f48c793e5d975 Mon Sep 17 00:00:00 2001
From: Shengzhuo Wei <me@cherr.cc>
Date: Thu, 27 Aug 2026 22:59:10 +0800
Subject: [PATCH 1088/1982] media: go7007: bound EZ-USB I2C transfers to the
 usb_buf size

[ Upstream commit 816c4628b23e8c3d925978433f4dd1a13620c01b ]

go7007_usb_i2c_master_xfer() copies msgs[i].len bytes into go->usb_buf,
a 16-byte buffer embedded in struct go7007, without any length check.
The adapter declares no transfer limits, so an SMBus block transfer
issued through /dev/i2c-N can write up to 34 bytes into it and corrupt
the struct fields that follow the buffer.

Bound the transfer size with i2c_adapter_quirks so the I2C core
rejects oversized messages before they reach the driver.

Fixes: 7955f03d18d1 ("[media] go7007: move out of staging into drivers/media/usb.")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Assisted-by: GLM:5.3
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-usb.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index 334cdde81a5c82..bf3cf320b2c9cd 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1029,10 +1029,16 @@ static const struct i2c_algorithm go7007_usb_algo = {
 	.functionality	= go7007_usb_functionality,
 };
 
+static const struct i2c_adapter_quirks go7007_usb_quirks = {
+	.max_write_len	= 12,
+	.max_read_len	= 15,
+};
+
 static struct i2c_adapter go7007_usb_adap_templ = {
 	.owner			= THIS_MODULE,
 	.name			= "WIS GO7007SB EZ-USB",
 	.algo			= &go7007_usb_algo,
+	.quirks			= &go7007_usb_quirks,
 };
 
 /********************* USB add/remove functions *********************/

From 0b0fbacea9a0e9f26bbf997a91b2a9814e5123bb Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Sun, 30 Aug 2026 22:30:02 +0800
Subject: [PATCH 1089/1982] media: saa7146: Initialize interrupt lock before
 requesting IRQ

[ Upstream commit e07c75a6bc4adf1ed09ede31756261e2c6bdede5 ]

The saa7146 interrupt handler can call SAA7146_IER_DISABLE(), which
serializes register access with dev->int_slock. request_irq() allows the
shared handler to run before saa7146_init_one() reaches the current lock
initialization block.

Initialize dev->int_slock before requesting the interrupt so every handler
path sees an initialized lock.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/saa7146/saa7146_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
index 27c53eed8fe39a..e908af0693d265 100644
--- a/drivers/media/common/saa7146/saa7146_core.c
+++ b/drivers/media/common/saa7146/saa7146_core.c
@@ -340,6 +340,8 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
 		goto out;
 	}
 
+	spin_lock_init(&dev->int_slock);
+
 	/* create a nice device name */
 	sprintf(dev->name, "saa7146 (%d)", saa7146_num);
 
@@ -425,7 +427,6 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
 	dev->ext = ext;
 
 	mutex_init(&dev->v4l2_lock);
-	spin_lock_init(&dev->int_slock);
 	spin_lock_init(&dev->slock);
 
 	mutex_init(&dev->i2c_lock);

From b64ea8c8e00850c067bb6f20bcee5b9b45dd72b0 Mon Sep 17 00:00:00 2001
From: Younho Choi <gdool88@mju.ac.kr>
Date: Tue, 26 May 2026 21:22:05 +0900
Subject: [PATCH 1090/1982] media: vim2m: keep transaction buffer count stable
 while streaming

[ Upstream commit 50f5fed44d8e24081e8feed5154746fe193f11b8 ]

V4L2_CID_TRANS_NUM_BUFS controls how many buffer pairs a vim2m
mem2mem job processes before the job is completed. The driver stores
the value in ctx->translen and device_work() uses it later to decide
whether the current transaction should continue.

Letting userspace change this control while streaming is active can
make a queued job observe a different transaction length than the one
it started with. That leaves the transaction state inconsistent with
the buffers currently queued for the job.

Grab the transaction buffer count control while either queue is
streaming, and release it only after both queues have stopped
streaming. The V4L2 control framework then rejects changes with
-EBUSY while the value is in use, while still allowing userspace to
configure the value before streaming starts.

Keep the control handler alive until after v4l2_m2m_ctx_release(),
since releasing the mem2mem context can call stop_streaming(), which
now ungrabs the control.

Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device")
Cc: stable@vger.kernel.org
Signed-off-by: Younho Choi <gdool88@mju.ac.kr>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vim2m.c | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
index 86c32699111adc..5db440bf728e9a 100644
--- a/drivers/media/test-drivers/vim2m.c
+++ b/drivers/media/test-drivers/vim2m.c
@@ -205,6 +205,7 @@ struct vim2m_ctx {
 	struct vim2m_dev	*dev;
 
 	struct v4l2_ctrl_handler hdl;
+	struct v4l2_ctrl	*trans_num_bufs_ctrl;
 
 	/* Processed buffers in this transaction */
 	u8			num_processed;
@@ -1270,9 +1271,27 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count)
 		ctx->aborting = 0;
 
 	q_data->sequence = 0;
+	v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, true);
+
 	return 0;
 }
 
+static bool vim2m_other_queue_is_streaming(struct vim2m_ctx *ctx,
+					   struct vb2_queue *q)
+{
+	struct vb2_queue *other_vq;
+
+	if (!ctx->fh.m2m_ctx)
+		return false;
+
+	if (V4L2_TYPE_IS_OUTPUT(q->type))
+		other_vq = v4l2_m2m_get_dst_vq(ctx->fh.m2m_ctx);
+	else
+		other_vq = v4l2_m2m_get_src_vq(ctx->fh.m2m_ctx);
+
+	return vb2_is_streaming(other_vq);
+}
+
 static void vim2m_stop_streaming(struct vb2_queue *q)
 {
 	struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
@@ -1286,11 +1305,14 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
 		else
 			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
 		if (!vbuf)
-			return;
+			break;
 		v4l2_ctrl_request_complete(vbuf->vb2_buf.req_obj.req,
 					   &ctx->hdl);
 		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
 	}
+
+	if (!vim2m_other_queue_is_streaming(ctx, q))
+		v4l2_ctrl_grab(ctx->trans_num_bufs_ctrl, false);
 }
 
 static void vim2m_buf_request_complete(struct vb2_buffer *vb)
@@ -1392,7 +1414,8 @@ static int vim2m_open(struct file *file)
 
 	vim2m_ctrl_trans_time_msec.def = default_transtime;
 	v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_time_msec, NULL);
-	v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
+	ctx->trans_num_bufs_ctrl =
+		v4l2_ctrl_new_custom(hdl, &vim2m_ctrl_trans_num_bufs, NULL);
 	if (hdl->error) {
 		rc = hdl->error;
 		v4l2_ctrl_handler_free(hdl);
@@ -1447,10 +1470,10 @@ static int vim2m_release(struct file *file)
 
 	v4l2_fh_del(&ctx->fh, file);
 	v4l2_fh_exit(&ctx->fh);
-	v4l2_ctrl_handler_free(&ctx->hdl);
 	mutex_lock(&dev->dev_mutex);
 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
 	mutex_unlock(&dev->dev_mutex);
+	v4l2_ctrl_handler_free(&ctx->hdl);
 	kfree(ctx);
 
 	atomic_dec(&dev->num_inst);

From 1b317507238bbee272de232a11b6585d35166db1 Mon Sep 17 00:00:00 2001
From: Junrui Luo <moonafterrain@outlook.com>
Date: Sat, 15 Aug 2026 22:56:36 +0800
Subject: [PATCH 1091/1982] media: vicodec: fix out-of-bounds write on
 under-rounded coded dimensions

[ Upstream commit 0183746ebca4c478027e2261b904f844f1443b19 ]

A capture format whose width or height is one more than a multiple of 16
makes the FWHT codec write one 8x8 block row, or column, past the end of
the capture plane, and read the same block out of the reference frame for
P-coded frames.

vic_round_dim() is documented to round a frame dimension up so that both
the luma and the chroma plane end up a multiple of 8, but it only rounds
the chroma plane:

	round_up((dim) / (div), 8) * (div)

For div == 2 the result is a multiple of 16 in every case but one: when
dim % 16 == 1, dim / div is already a multiple of 8 and the macro returns
dim - 1. encode_plane() and decode_plane() round the same dimension with
round_up(dim, 8), which yields dim + 7 -- one block more than the coded
dimension that sized the buffer.

On a KASAN-enabled kernel, a 641x360 YUYV P-frame triggers:

  BUG: KASAN: slab-out-of-bounds in add_deltas+0x450/0xcc0
  Read of size 1 at addr ffff888009070800 by task trigger_bin/70

  Call Trace:
   add_deltas+0x450/0xcc0
   decode_plane+0x1916/0x3390
   fwht_decode_frame+0x173/0x620
   v4l2_fwht_decode+0x751/0x1120
   device_run+0x6bb/0x1850

Round the dimension itself up to a multiple of 8 * div. The rounding
changes only for div == 2 and dim % 16 == 1, and MAX_WIDTH and MAX_HEIGHT
are both multiples of 16, so the rounded value still fits the advertised
limits.

Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vicodec/codec-fwht.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vicodec/codec-fwht.h b/drivers/media/test-drivers/vicodec/codec-fwht.h
index 0eab24020e9e6e..4b4d3903108992 100644
--- a/drivers/media/test-drivers/vicodec/codec-fwht.h
+++ b/drivers/media/test-drivers/vicodec/codec-fwht.h
@@ -61,7 +61,7 @@
  * both luma and chroma components resolutions are rounded up to
  * a multiple of 8
  */
-#define vic_round_dim(dim, div) (round_up((dim) / (div), 8) * (div))
+#define vic_round_dim(dim, div) round_up(dim, 8 * (div))
 
 struct fwht_cframe_hdr {
 	u32 magic1;

From 72b9c63beb0151c917bdc538daaefb636f442b17 Mon Sep 17 00:00:00 2001
From: Junrui Luo <moonafterrain@outlook.com>
Date: Sat, 15 Aug 2026 22:56:38 +0800
Subject: [PATCH 1092/1982] media: vicodec: make encoder CAPTURE dimensions
 read-only

[ Upstream commit 2532e9d2f8ccb330a9c924b1ee34c5629240d352 ]

Setting the encoder's compressed CAPTURE format to a smaller resolution
than the raw OUTPUT format makes the encoder write past the end of the
CAPTURE buffer.

For a stateful encoder the CAPTURE width and height are not
client-settable; Documentation/userspace-api/media/v4l/dev-encoder.rst
specifies them as "ignored (read-only)" on VIDIOC_S_FMT. vicodec only
implements half of that: vidioc_s_fmt_vid_out() derives the CAPTURE coded
size and sizeimage from the OUTPUT format, but S_FMT on the CAPTURE queue
overwrites them. The encoder then takes its geometry from the OUTPUT
queue alone, and v4l2_fwht_encode() gets no destination length.

Overwrite the requested width and height with the OUTPUT queue's coded
dimensions in vidioc_try_fmt_vid_cap(), making them read-only as the
interface requires.

Fixes: efec9c815e5d ("media: vicodec: pass on enc output format to capture side")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vicodec/vicodec-core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 654da27b11406d..cdc3af33b4bbe1 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -893,6 +893,8 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 				  struct v4l2_format *f)
 {
 	struct vicodec_ctx *ctx = file2ctx(file);
+	struct vicodec_q_data *q_data_out =
+		get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
 	struct v4l2_pix_format_mplane *pix_mp;
 	struct v4l2_pix_format *pix;
 
@@ -903,6 +905,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 		pix = &f->fmt.pix;
 		pix->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
 				   find_fmt(f->fmt.pix.pixelformat)->id;
+		if (ctx->is_enc) {
+			pix->width = q_data_out->coded_width;
+			pix->height = q_data_out->coded_height;
+		}
 		pix->colorspace = ctx->state.colorspace;
 		pix->xfer_func = ctx->state.xfer_func;
 		pix->ycbcr_enc = ctx->state.ycbcr_enc;
@@ -914,6 +920,10 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 		pix_mp = &f->fmt.pix_mp;
 		pix_mp->pixelformat = ctx->is_enc ? V4L2_PIX_FMT_FWHT :
 				      find_fmt(pix_mp->pixelformat)->id;
+		if (ctx->is_enc) {
+			pix_mp->width = q_data_out->coded_width;
+			pix_mp->height = q_data_out->coded_height;
+		}
 		pix_mp->colorspace = ctx->state.colorspace;
 		pix_mp->xfer_func = ctx->state.xfer_func;
 		pix_mp->ycbcr_enc = ctx->state.ycbcr_enc;

From b0f8a0f8058e2e5811ed975cc24757f64c2962ce Mon Sep 17 00:00:00 2001
From: Piyush Patle <piyushpatle228@gmail.com>
Date: Mon, 24 Aug 2026 19:21:15 +0530
Subject: [PATCH 1093/1982] media: vidtv: fix frontend reference leak on unbind

[ Upstream commit 6f412f9fe6a1f3ce9694757f50353bbec221d832 ]

dvb_register_frontend() keeps two references to the frontend. One is
released by dvb_unregister_frontend(), and the other by
dvb_frontend_detach(). vidtv only called dvb_unregister_frontend(), so
the second reference was never released. As a result,
__dvb_frontend_free() was never called, leaking the frontend private
data and its struct dvb_device.

The detach call was removed by commit 63101b756893 ("media: vidtv: fix
driver unbind/remove") because it caused an OOPS. The demod .release
callback freed vidtv_demod_state, and the I2C remove callbacks then
accessed the freed state.

That commit also removed those accesses from the I2C remove callbacks.
Restore the detach call, but remove the demod .release callback.
vidtv_demod_state is owned by the I2C client and is already freed by
vidtv_demod_i2c_remove(), so the frontend detach path should not free
it.

Tested with kmemleak and KASAN over 10 bind/unbind cycles. The reported
frontend and dvb_device leaks were present before the fix and were gone
after it, with no KASAN reports.

Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=32f018fd65e799f79ae0
Fixes: 63101b756893 ("media: vidtv: fix driver unbind/remove")
Cc: stable@vger.kernel.org
Tested-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
 drivers/media/test-drivers/vidtv/vidtv_demod.c  | 9 ---------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index 8a8e097d2ac965..d6b90290bd4dd9 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -474,6 +474,7 @@ static int vidtv_bridge_dvb_init(struct vidtv_dvb *dvb)
 fail_demod_probe:
 	for (i = i - 1; i >= 0; --i) {
 		dvb_unregister_frontend(dvb->fe[i]);
+		dvb_frontend_detach(dvb->fe[i]);
 fail_fe:
 		dvb_module_release(dvb->i2c_client_tuner[i]);
 fail_tuner_probe:
@@ -552,6 +553,7 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
 
 	for (i = 0; i < NUM_FE; ++i) {
 		dvb_unregister_frontend(dvb->fe[i]);
+		dvb_frontend_detach(dvb->fe[i]);
 		dvb_module_release(dvb->i2c_client_tuner[i]);
 		dvb_module_release(dvb->i2c_client_demod[i]);
 	}
diff --git a/drivers/media/test-drivers/vidtv/vidtv_demod.c b/drivers/media/test-drivers/vidtv/vidtv_demod.c
index 505f96fccbf300..36bfeb33476b28 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_demod.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_demod.c
@@ -343,13 +343,6 @@ static int vidtv_diseqc_send_burst(struct dvb_frontend *fe,
 	return 0;
 }
 
-static void vidtv_demod_release(struct dvb_frontend *fe)
-{
-	struct vidtv_demod_state *state = fe->demodulator_priv;
-
-	kfree(state);
-}
-
 static const struct dvb_frontend_ops vidtv_demod_ops = {
 	.delsys = {
 		SYS_DVBT,
@@ -390,8 +383,6 @@ static const struct dvb_frontend_ops vidtv_demod_ops = {
 			FE_CAN_HIERARCHY_AUTO,
 	},
 
-	.release = vidtv_demod_release,
-
 	.set_frontend = vidtv_demod_set_frontend,
 	.get_frontend = vidtv_demod_get_frontend,
 

From b60a01c63970755090eeac0ba4f8246efad77995 Mon Sep 17 00:00:00 2001
From: Jeffin Philip <jeffinphilip14@gmail.com>
Date: Thu, 27 Aug 2026 09:52:29 +0530
Subject: [PATCH 1094/1982] media: vidtv: fix uaf in
 vidtv_bridge_on_new_pkts_avail

[ Upstream commit 2af02ccd048b77713695d7817cf645ca50bf349e ]

Attempting to unbind a dvbdevice that is in the process of feeding
data causes a UAF as we free the underlying device without
stopping the feed first. Fix this by stopping the stream first using
vidtv_stop_streaming(). However, our codepath in the reproducer
(mentioned in the below reply) does not decrement our users
(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
by our read() in the reproducer, that is only possible on .release.
This can cause a task hang as dvb_dmxdev_release() uses wait_event()
in the wait_queue unless we use a close(fd)(in the reproducer).
Is this a problem? Please advise.

Reported-by: syzbot+c7fc4794e59786f5b4dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c7fc4794e59786f5b4dc
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index d6b90290bd4dd9..60310ece35302b 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -551,6 +551,8 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
 
 	mutex_destroy(&dvb->feed_lock);
 
+	vidtv_stop_streaming(dvb);
+
 	for (i = 0; i < NUM_FE; ++i) {
 		dvb_unregister_frontend(dvb->fe[i]);
 		dvb_frontend_detach(dvb->fe[i]);

From f01bdf7f3fc2353fdb2f2468a76bd7bfefb639e4 Mon Sep 17 00:00:00 2001
From: Julian Braha <julianbraha@gmail.com>
Date: Sat, 1 Aug 2026 18:53:54 +0100
Subject: [PATCH 1095/1982] media: marvell-cam: fix unmet dependency for
 VIDEO_MMP_CAMERA

[ Upstream commit 1179929b3abd4adb6ca7fae91d649c64a7293aca ]

VIDEO_MMP_CAMERA selects I2C_GPIO without ensuring
'GPIOLIB || COMPILE_TEST' is enabled, despite I2C_GPIO depending on it.

Let's add the same dependency to VIDEO_MMP_CAMERA.

This unmet dependency bug was found by kconfirm, a static analysis tool for
Kconfig.

Fixes: 67a8dbbc4e04 ("[media] marvell-cam: Basic working MMP camera driver")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Braha <julianbraha@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/marvell/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/marvell/Kconfig b/drivers/media/platform/marvell/Kconfig
index d31f4730f2a38b..ab58175e433c33 100644
--- a/drivers/media/platform/marvell/Kconfig
+++ b/drivers/media/platform/marvell/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_MMP_CAMERA
 	depends on V4L_PLATFORM_DRIVERS
 	depends on I2C && VIDEO_DEV
 	depends on ARCH_MMP || COMPILE_TEST
+	depends on GPIOLIB || COMPILE_TEST
 	depends on COMMON_CLK
 	select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR
 	select I2C_GPIO

From 228b1b7be79d17aa1aa4f3f8867b12601d02e71f Mon Sep 17 00:00:00 2001
From: Punnay Sharma <punnaysharma805@gmail.com>
Date: Sat, 8 Aug 2026 00:04:42 +0530
Subject: [PATCH 1096/1982] staging: media: av7110: fix corrupted BER reporting
 in sp8870

[ Upstream commit 5764f9bd7b7a72c6df49db6c8c00d4f9994a55ba ]

In sp8870_read_ber(), the 14-bit Bit Error Rate (BER) is assembled by
reading two I2C registers: 0xC08 (lower 6 bits) and 0xC07 (upper 8 bits).

The current implementation masks the lower bits via `tmp = ret & 0x3F;`
but subsequently overwrites `tmp` entirely when processing the upper
bits using a direct assignment (`tmp = ret << 6;`). This logical error
causes the lower 6 bits of the BER hardware metric to be silently
discarded.

Fix this by using a bitwise OR (`tmp |= ret << 6;`) to correctly merge
the MSB and LSB payloads before returning the metric to the DVB core.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/av7110/sp8870.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 0c813860f5b207..96fd7387777447 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -401,7 +401,7 @@ static int sp8870_read_ber(struct dvb_frontend *fe, u32 *ber)
 	if (ret < 0)
 		return -EIO;
 
-	tmp = ret << 6;
+	tmp |= ret << 6;
 	if (tmp >= 0x3FFF0)
 		tmp = ~0;
 

From 17de34822aeb26f531f71ea57f319b13d55fdd50 Mon Sep 17 00:00:00 2001
From: Punnay Sharma <punnaysharma805@gmail.com>
Date: Sat, 8 Aug 2026 00:04:43 +0530
Subject: [PATCH 1097/1982] staging: media: av7110: fix sp8870 initialization
 failure state

[ Upstream commit 30684fa98394bc0eb4362282908612aab7d4dad9 ]

The SP8870 DVB frontend driver prematurely flags the device as
initialized at the very beginning of the sp8870_init() routine, prior
to requesting the firmware (dvb-fe-sp8870.fw) and executing the I2C
upload sequence.

If request_firmware() times out or sp8870_firmware_upload() encounters
an I2C bus error, the function aborts and returns -EIO. However,
because `state->initialised` is already set to 1, all subsequent
invocations of `fe->ops.init()` by the DVB core will immediately return
0 (success) without attempting to load the firmware again. This leaves
the demodulator microcontroller halted and the frontend permanently dead
until the module is forcibly reloaded.

Relocate the `state->initialised = 1` assignment to the end of
sp8870_init(), ensuring the flag is only set after the firmware is
successfully uploaded and the system controller is actually restarted.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Punnay Sharma <punnaysharma805@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/av7110/sp8870.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/av7110/sp8870.c b/drivers/staging/media/av7110/sp8870.c
index 96fd7387777447..b5b49f1ef5e7b1 100644
--- a/drivers/staging/media/av7110/sp8870.c
+++ b/drivers/staging/media/av7110/sp8870.c
@@ -315,7 +315,6 @@ static int sp8870_init(struct dvb_frontend *fe)
 	sp8870_wake_up(state);
 	if (state->initialised)
 		return 0;
-	state->initialised = 1;
 
 	dprintk("initialising frontend...\n");
 
@@ -353,6 +352,8 @@ static int sp8870_init(struct dvb_frontend *fe)
 	sp8870_writereg(state, 0x0D00, 0x010);
 	sp8870_writereg(state, 0x0D01, 0x000);
 
+	state->initialised = 1;
+
 	return 0;
 }
 

From 02b1ca9a3793b84da5bff1ae777ab45611ed723c Mon Sep 17 00:00:00 2001
From: Xu Rao <raoxu@uniontech.com>
Date: Tue, 11 Aug 2026 19:28:40 +0800
Subject: [PATCH 1098/1982] media: m2m-deinterlace: fix default capture field

[ Upstream commit 4ee3ebede5d01efdcdd88c94f9df271d2eb237de ]

queue_init() initializes default formats for both the source and capture
queues.  It first sets the source field to V4L2_FIELD_SEQ_TB, but then
stores the capture default, V4L2_FIELD_INTERLACED_TB, in the source queue
again while initializing the capture queue.

This overwrites the valid source default and leaves the capture field at
its zero-initialized value, V4L2_FIELD_ANY.  vidioc_streamon() accepts
only V4L2_FIELD_SEQ_TB or V4L2_FIELD_SEQ_BT on the source queue, and
requires the capture queue to use a compatible interlaced or NONE field.
Userspace that relies on the default formats can therefore get -EINVAL
when starting streaming.

Initialize the capture field instead.  The bug is usually hidden because
mem2mem applications commonly call S_FMT on both queues before streaming;
the TRY_FMT paths normalize the fields and S_FMT overwrites q_data[].field.

Fixes: 8f0755c06b90 ("[media] media: Add mem2mem deinterlacing driver")
Cc: stable@vger.kernel.org
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/m2m-deinterlace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/m2m-deinterlace.c b/drivers/media/platform/m2m-deinterlace.c
index e07e57d4206baa..83d6c54f015db4 100644
--- a/drivers/media/platform/m2m-deinterlace.c
+++ b/drivers/media/platform/m2m-deinterlace.c
@@ -829,7 +829,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq,
 	q_data[V4L2_M2M_DST].width = 640;
 	q_data[V4L2_M2M_DST].height = 480;
 	q_data[V4L2_M2M_DST].sizeimage = (640 * 480 * 3) / 2;
-	q_data[V4L2_M2M_SRC].field = V4L2_FIELD_INTERLACED_TB;
+	q_data[V4L2_M2M_DST].field = V4L2_FIELD_INTERLACED_TB;
 
 	return vb2_queue_init(dst_vq);
 }

From 82cbf1a3e91aea21f901b8dc179b1eee28a9507e Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date: Tue, 8 Sep 2026 09:28:01 +0100
Subject: [PATCH 1099/1982] ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1
 addresses on v2.5+

[ Upstream commit 233d36a96009682208cc4ca1139b9e5641a8bf09 ]

wsa_macro_set_spkr_mode() unconditionally writes CDC_WSA_COMPANDER1_CTL3
(0x5CC) and CDC_WSA_COMPANDER1_CTL7 (0x5DC).  On v2.5+ silicon these
registers moved to CDC_2_5_WSA_COMPANDER1_CTL3 (0x5EC) and
CDC_2_5_WSA_COMPANDER1_CTL7 (0x5FC); the v2.1 addresses are dead on
that hardware, so the update_bits() calls take a bus error:

  wsa_macro 6c90000.codec: ASoC error (-5): at
    snd_soc_component_update_bits() on 6c90000.codec for
    register: [0x000005dc]

The flat regcache had been hiding the read side of this by returning
the zero-initialised cache slot instead of doing a bus read, so the
error only becomes visible once the cache reports the miss honestly
and regmap falls back to a real bus read.

Select the correct address for Compander1 CTL3/CTL7 based on
codec_version.  The Compander0 and Boost registers used in the same
function have the same address across versions, so they stay
unchanged.  Also collapse the two mode branches to a single sequence
with mode-selected values, which is what the switch was doing anyway.

Fixes: 727de4fbc546 ("ASoC: codecs: lpass-wsa-macro: Correct support for newer v2.5 version")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260908082806.648797-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/lpass-wsa-macro.c | 42 ++++++++++++++++++------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
index 8350b02b575fb0..f094225ba40a4c 100644
--- a/sound/soc/codecs/lpass-wsa-macro.c
+++ b/sound/soc/codecs/lpass-wsa-macro.c
@@ -1129,27 +1129,35 @@ static const struct regmap_config wsa_regmap_config = {
 int wsa_macro_set_spkr_mode(struct snd_soc_component *component, int mode)
 {
 	struct wsa_macro *wsa = snd_soc_component_get_drvdata(component);
+	unsigned int comp1_ctl3, comp1_ctl7;
+	u8 comp_val, boost_val;
 
 	wsa->spkr_mode = mode;
 
-	switch (mode) {
-	case WSA_MACRO_SPKR_MODE_1:
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x00);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x00);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x00);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x00);
-		snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x44);
-		snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x44);
-		break;
-	default:
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, 0x80);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL3, 0x80, 0x80);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, 0x01);
-		snd_soc_component_update_bits(component, CDC_WSA_COMPANDER1_CTL7, 0x01, 0x01);
-		snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, 0x58);
-		snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, 0x58);
-		break;
+	/* Compander1 CTL3/CTL7 moved on v2.5+ silicon. */
+	if (wsa->codec_version >= LPASS_CODEC_VERSION_2_5) {
+		comp1_ctl3 = CDC_2_5_WSA_COMPANDER1_CTL3;
+		comp1_ctl7 = CDC_2_5_WSA_COMPANDER1_CTL7;
+	} else {
+		comp1_ctl3 = CDC_WSA_COMPANDER1_CTL3;
+		comp1_ctl7 = CDC_WSA_COMPANDER1_CTL7;
 	}
+
+	if (mode == WSA_MACRO_SPKR_MODE_1) {
+		comp_val = 0x00;
+		boost_val = 0x44;
+	} else {
+		comp_val = 0x80;
+		boost_val = 0x58;
+	}
+
+	snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL3, 0x80, comp_val);
+	snd_soc_component_update_bits(component, comp1_ctl3, 0x80, comp_val);
+	snd_soc_component_update_bits(component, CDC_WSA_COMPANDER0_CTL7, 0x01, comp_val ? 0x01 : 0x00);
+	snd_soc_component_update_bits(component, comp1_ctl7, 0x01, comp_val ? 0x01 : 0x00);
+	snd_soc_component_update_bits(component, CDC_WSA_BOOST0_BOOST_CTL, 0x7C, boost_val);
+	snd_soc_component_update_bits(component, CDC_WSA_BOOST1_BOOST_CTL, 0x7C, boost_val);
+
 	return 0;
 }
 EXPORT_SYMBOL(wsa_macro_set_spkr_mode);

From d1dbcb4346875598c6ee1652d3fc522c25bd1043 Mon Sep 17 00:00:00 2001
From: Wang Yan <wangyan01@kylinos.cn>
Date: Mon, 24 Aug 2026 10:55:53 +0800
Subject: [PATCH 1100/1982] perf powerpc-vpadtl: Fix off-by-one in
 auxtrace_info minimum size check

[ Upstream commit d9c7e2ede92ce258a5d4a6cbc55f75acd379c97d ]

min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements.  POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself.  A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.

This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").

Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.

Fixes: c4bbd4ec2e50a9ed ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/powerpc-vpadtl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index 55b9b6e0707463..eacc845ebda262 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -681,7 +681,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
 				  struct perf_session *session)
 {
 	struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
-	size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
+	size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
 	struct powerpc_vpadtl *vpa;
 	int err;
 

From bd676daa63715c270eef21dea7ae71477450d2c4 Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:21:58 +0530
Subject: [PATCH 1101/1982] media: microchip-isc: fix awb_mutex and lock
 lifecycle

[ Upstream commit 5540b48c0702f6a1389db3d473d7fd0db930422a ]

isc->lock and awb_mutex were initialised in isc_async_complete() and
destroyed in isc_async_unbind(), tying their lifetime to the subdev
bind/unbind cycle instead of the device:

 - isc_async_unbind() destroyed awb_mutex before cancel_work_sync(),
   which takes it;
 - a failed .complete() left them initialised, and isc->lock was
   destroyed only on the .complete() error path, so the normal unbind
   path leaked it;
 - a rebind runs .complete() again and reinitialises a live mutex.

Initialise both with devm_mutex_init() at probe so they live for the
whole device lifetime and are freed at remove, and drop the init and
destroy from the .complete()/.unbind() callbacks.

isc_async_complete_err then only returned ret, so drop the label and
return directly at each error site.

Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/microchip/microchip-isc-base.c | 15 ++++-----------
 .../platform/microchip/microchip-sama5d2-isc.c    |  9 +++++++++
 .../platform/microchip/microchip-sama7g5-isc.c    |  9 +++++++++
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 32bdeae04ad079..ca4f3b5f58aa98 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1703,7 +1703,6 @@ static void isc_async_unbind(struct v4l2_async_notifier *notifier,
 {
 	struct isc_device *isc = container_of(notifier->v4l2_dev,
 					      struct isc_device, v4l2_dev);
-	mutex_destroy(&isc->awb_mutex);
 	cancel_work_sync(&isc->awb_work);
 	video_unregister_device(&isc->video_dev);
 	v4l2_ctrl_handler_free(&isc->ctrls.handler);
@@ -1767,8 +1766,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
 
 	isc->current_subdev = container_of(notifier,
 					   struct isc_subdev_entity, notifier);
-	mutex_init(&isc->lock);
-	mutex_init(&isc->awb_mutex);
 
 	init_completion(&isc->comp);
 
@@ -1787,7 +1784,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
 	ret = vb2_queue_init(q);
 	if (ret < 0) {
 		dev_err(isc->dev, "vb2_queue_init() failed: %d\n", ret);
-		goto isc_async_complete_err;
+		return ret;
 	}
 
 	/* Init video dma queues */
@@ -1798,13 +1795,13 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
 	ret = isc_set_default_fmt(isc);
 	if (ret) {
 		dev_err(isc->dev, "Could not set default format\n");
-		goto isc_async_complete_err;
+		return ret;
 	}
 
 	ret = isc_ctrl_init(isc);
 	if (ret) {
 		dev_err(isc->dev, "Init isc ctrols failed: %d\n", ret);
-		goto isc_async_complete_err;
+		return ret;
 	}
 
 	/* Register video device */
@@ -1824,7 +1821,7 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
 	ret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);
 	if (ret < 0) {
 		dev_err(isc->dev, "video_register_device failed: %d\n", ret);
-		goto isc_async_complete_err;
+		return ret;
 	}
 
 	ret = isc_scaler_link(isc);
@@ -1839,10 +1836,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
 
 isc_async_complete_unregister_device:
 	video_unregister_device(vdev);
-
-isc_async_complete_err:
-	mutex_destroy(&isc->awb_mutex);
-	mutex_destroy(&isc->lock);
 	return ret;
 }
 
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 88e6d8e1c6c9cf..18e1ec0b94fa62 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -30,6 +30,7 @@
 #include <linux/interrupt.h>
 #include <linux/math64.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_graph.h>
 #include <linux/platform_device.h>
@@ -424,6 +425,14 @@ static int microchip_isc_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, isc);
 	isc->dev = dev;
 
+	ret = devm_mutex_init(dev, &isc->lock);
+	if (ret)
+		return ret;
+
+	ret = devm_mutex_init(dev, &isc->awb_mutex);
+	if (ret)
+		return ret;
+
 	io_base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(io_base))
 		return PTR_ERR(io_base);
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 77c6c183451bfe..07cfe1109ff092 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -33,6 +33,7 @@
 #include <linux/interrupt.h>
 #include <linux/math64.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_graph.h>
 #include <linux/platform_device.h>
@@ -413,6 +414,14 @@ static int microchip_xisc_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, isc);
 	isc->dev = dev;
 
+	ret = devm_mutex_init(dev, &isc->lock);
+	if (ret)
+		return ret;
+
+	ret = devm_mutex_init(dev, &isc->awb_mutex);
+	if (ret)
+		return ret;
+
 	io_base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(io_base))
 		return PTR_ERR(io_base);

From d1d04f10ad77feb94f7b85be27b355727c5b0c45 Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:22:00 +0530
Subject: [PATCH 1102/1982] media: microchip-isc: synchronize the IRQ before
 disabling clocks on stop

[ Upstream commit 19fa5407da5ef3e605cacfcd90f70d8b2c121cd7 ]

isc_stop_streaming() masks the DMA interrupt and then drops the runtime
PM reference, which disables the ISC clocks. microchip_isc_interrupt()
may still be executing on another CPU at that point; it reads ISC_INTSR
over regmap, and touching the unclocked registers triggers an external
abort.

Store the IRQ number at probe and call synchronize_irq() after masking
the interrupt, before dropping the PM reference.

Fixes: 106267444f12 ("[media] atmel-isc: add the Image Sensor Controller code")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/microchip/microchip-isc-base.c    | 3 +++
 drivers/media/platform/microchip/microchip-isc.h         | 1 +
 drivers/media/platform/microchip/microchip-sama5d2-isc.c | 2 ++
 drivers/media/platform/microchip/microchip-sama7g5-isc.c | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index ca4f3b5f58aa98..debbc38717de15 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -425,6 +425,9 @@ static void isc_stop_streaming(struct vb2_queue *vq)
 	/* Disable DMA interrupt */
 	regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
 
+	/* let a running IRQ handler finish before the clock is disabled */
+	synchronize_irq(isc->irq);
+
 	pm_runtime_put_sync(isc->dev);
 
 	/* Disable stream on the sub device */
diff --git a/drivers/media/platform/microchip/microchip-isc.h b/drivers/media/platform/microchip/microchip-isc.h
index ad4e98a1dd8fca..f5e322c2e36bc9 100644
--- a/drivers/media/platform/microchip/microchip-isc.h
+++ b/drivers/media/platform/microchip/microchip-isc.h
@@ -287,6 +287,7 @@ struct isc_device {
 	u32			dcfg;
 
 	struct device		*dev;
+	int			irq;
 	struct v4l2_device	v4l2_dev;
 	struct video_device	video_dev;
 
diff --git a/drivers/media/platform/microchip/microchip-sama5d2-isc.c b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
index 18e1ec0b94fa62..5bd109e93a8fb8 100644
--- a/drivers/media/platform/microchip/microchip-sama5d2-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama5d2-isc.c
@@ -448,6 +448,8 @@ static int microchip_isc_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return irq;
 
+	isc->irq = irq;
+
 	ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
 			       "microchip-sama5d2-isc", isc);
 	if (ret < 0) {
diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
index 07cfe1109ff092..d978ce448a4d28 100644
--- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c
+++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c
@@ -437,6 +437,8 @@ static int microchip_xisc_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return irq;
 
+	isc->irq = irq;
+
 	ret = devm_request_irq(dev, irq, microchip_isc_interrupt, 0,
 			       "microchip-sama7g5-xisc", isc);
 	if (ret < 0) {

From 6dc8e17c26a9042291f7b6e70042c1499a20929a Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:22:01 +0530
Subject: [PATCH 1103/1982] media: microchip-isc: disable histogram and flush
 AWB work on teardown

[ Upstream commit 00d87c379915a3689b2488bd37f490875d79e20f ]

isc_stop_streaming() and the isc_start_streaming() error path dropped the
runtime PM reference with the histogram still enabled. A HISDONE firing
just before the stop, or a failed isc_update_profile() on the start path,
can queue isc_awb_work(), which reads the histogram registers before
taking its own PM reference and faults on the unclocked device.

Disable the histogram, synchronize the IRQ and flush the work before the
device is left unclocked. isc_configure() is the one enabling the
histogram and then calling isc_update_profile(), so do the cleanup in its
own failure path; isc_stop_streaming() does the same on teardown.
synchronize_irq() must come before cancel_work_sync(), so an in-flight
handler cannot re-queue awb_work after it is cancelled.

Fixes: 93d4a26c3dab ("[media] atmel-isc: add the isc pipeline function")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/microchip/microchip-isc-base.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index debbc38717de15..0f486dd5bd82cc 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -289,6 +289,7 @@ static int isc_configure(struct isc_device *isc)
 	struct regmap *regmap = isc->regmap;
 	u32 pfe_cfg0, dcfg, mask, pipeline;
 	struct isc_subdev_entity *subdev = isc->current_subdev;
+	int ret;
 
 	pfe_cfg0 = isc->config.sd_format->pfe_cfg0_bps;
 	pipeline = isc->config.bits_pipeline;
@@ -321,7 +322,15 @@ static int isc_configure(struct isc_device *isc)
 		isc_set_histogram(isc, false);
 
 	/* Update profile */
-	return isc_update_profile(isc);
+	ret = isc_update_profile(isc);
+	if (ret) {
+		/* flush the histogram work before the clocks are gated */
+		isc_set_histogram(isc, false);
+		synchronize_irq(isc->irq);
+		cancel_work_sync(&isc->awb_work);
+	}
+
+	return ret;
 }
 
 static int isc_prepare_streaming(struct vb2_queue *vq)
@@ -425,9 +434,13 @@ static void isc_stop_streaming(struct vb2_queue *vq)
 	/* Disable DMA interrupt */
 	regmap_write(isc->regmap, ISC_INTDIS, ISC_INT_DDONE);
 
+	isc_set_histogram(isc, false);
+
 	/* let a running IRQ handler finish before the clock is disabled */
 	synchronize_irq(isc->irq);
 
+	cancel_work_sync(&isc->awb_work);
+
 	pm_runtime_put_sync(isc->dev);
 
 	/* Disable stream on the sub device */

From a517178cce67bb52562300d41cf648f4c5a23777 Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:22:02 +0530
Subject: [PATCH 1104/1982] media: microchip-isc: do not touch WB registers
 when not streaming

[ Upstream commit d8983c47d4d95eb1ed889dbb7516d3738fa854d8 ]

isc_s_awb_ctrl() called isc_update_awb_ctrls() unconditionally, writing
the white balance registers even when the device is runtime suspended;
on many ARM platforms accessing the unclocked registers is an external
abort. The write was also done without awb_lock, racing isc_awb_work(),
which holds it so the DMA done IRQ cannot latch a half-updated pipeline.

Write the registers only while streaming and not stopping, under
awb_lock, and update the profile there. The isc->stop check covers the
window where isc_stop_streaming() has gated the clocks but vb2 still
reports streaming. Otherwise the new values stay cached and
isc_configure() programs them at the next stream start.

Fixes: 4e52889f48fe ("media: atmel: atmel-isc-base: expose white balance as v4l2 controls")
Cc: stable@vger.kernel.org
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/microchip/microchip-isc-base.c   | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 0f486dd5bd82cc..cf4611443fd136 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1511,20 +1511,24 @@ static int isc_s_awb_ctrl(struct v4l2_ctrl *ctrl)
 		if (ctrl->cluster[ISC_CTRL_GB_OFF]->is_new)
 			ctrls->offset[ISC_HIS_CFG_MODE_GB] = isc->gb_off_ctrl->val;
 
-		isc_update_awb_ctrls(isc);
-
 		mutex_lock(&isc->awb_mutex);
-		if (vb2_is_streaming(&isc->vb2_vidq)) {
+		if (vb2_is_streaming(&isc->vb2_vidq) && !isc->stop) {
+			unsigned long flags;
+
 			/*
-			 * If we are streaming, we can update profile to
-			 * have the new settings in place.
+			 * awb_lock keeps the DMA done IRQ from latching a
+			 * partially written WB pipeline.
 			 */
+			spin_lock_irqsave(&isc->awb_lock, flags);
+			isc_update_awb_ctrls(isc);
+			spin_unlock_irqrestore(&isc->awb_lock, flags);
+
 			isc_update_profile(isc);
 		} else {
 			/*
-			 * The auto cluster will activate automatically this
-			 * control. This has to be deactivated when not
-			 * streaming.
+			 * Not streaming: keep the cached values for the next
+			 * stream start and deactivate the cluster-activated
+			 * do_white_balance button.
 			 */
 			v4l2_ctrl_activate(isc->do_wb_ctrl, false);
 		}

From da7a07ad6fe000e1869c835603f26cc53f44715c Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Mon, 17 Aug 2026 12:22:05 +0530
Subject: [PATCH 1105/1982] media: microchip-isc: fix PM runtime leak in AWB
 work handler

[ Upstream commit 21ad8225822a892c4c273bf1368d477a83a19dbb ]

Early return when streaming stops skips pm_runtime_put_sync(),
leaking the reference and preventing runtime suspend.

Fixes: 314c96e5203d ("media: atmel: atmel-isc-base: use mutex to lock awb workq from streaming")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/microchip/microchip-isc-base.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index cf4611443fd136..21d108eb93c7b4 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -1432,7 +1432,7 @@ static void isc_awb_work(struct work_struct *w)
 	/* streaming is not active anymore */
 	if (isc->stop) {
 		mutex_unlock(&isc->awb_mutex);
-		return;
+		goto out_pm_put;
 	}
 
 	isc_update_profile(isc);
@@ -1443,6 +1443,7 @@ static void isc_awb_work(struct work_struct *w)
 	if (ctrls->awb)
 		regmap_write(regmap, ISC_CTRLEN, ISC_CTRL_HISREQ);
 
+out_pm_put:
 	pm_runtime_put_sync(isc->dev);
 }
 

From 79058f6929412847262ab3ea2955debd5f8f3261 Mon Sep 17 00:00:00 2001
From: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Date: Wed, 19 Aug 2026 11:49:20 +0530
Subject: [PATCH 1106/1982] media: microchip-isc: don't sleep in the clk
 .is_enabled callback

[ Upstream commit 61490ff518c7b3ea3ff1cd16bbc012e9e4f1ab74 ]

isc_clk_is_enabled() calls pm_runtime_resume_and_get() and
pm_runtime_put_sync(), which can sleep and are not safe here, as
.is_enabled must run in atomic context. clk_disable_unused() calls it so
at boot, and CONFIG_DEBUG_ATOMIC_SLEEP reports a "sleeping function
called from invalid context" BUG.

Use the atomic-safe pm_runtime_get_if_active() and pm_runtime_put()
instead. A suspended ISC has its clocks gated, so report the clock
disabled when the device is not already active.

Fixes: 01192aa1c5c2 ("media: atmel-isc: Enable the clocks during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@microchip.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/microchip/microchip-isc-clk.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/microchip/microchip-isc-clk.c b/drivers/media/platform/microchip/microchip-isc-clk.c
index 24358d804e75d7..66dc522a619081 100644
--- a/drivers/media/platform/microchip/microchip-isc-clk.c
+++ b/drivers/media/platform/microchip/microchip-isc-clk.c
@@ -98,15 +98,14 @@ static int isc_clk_is_enabled(struct clk_hw *hw)
 {
 	struct isc_clk *isc_clk = to_isc_clk(hw);
 	u32 status;
-	int ret;
 
-	ret = pm_runtime_resume_and_get(isc_clk->dev);
-	if (ret < 0)
+	/* Runs in atomic context, so must not sleep to resume the ISC. */
+	if (pm_runtime_get_if_active(isc_clk->dev) <= 0)
 		return 0;
 
 	regmap_read(isc_clk->regmap, ISC_CLKSR, &status);
 
-	pm_runtime_put_sync(isc_clk->dev);
+	pm_runtime_put(isc_clk->dev);
 
 	return status & ISC_CLK(isc_clk->id) ? 1 : 0;
 }

From de26b77e6e3acffc3c017aa594db0963ed9f5b6f Mon Sep 17 00:00:00 2001
From: Alain Volmat <alain.volmat@foss.st.com>
Date: Tue, 21 Jul 2026 21:01:19 +0200
Subject: [PATCH 1107/1982] media: stm32: csi: correct remote pad retrieval

[ Upstream commit b83651d321d4fd07979a59f359dcb0266391f17a ]

The function media_entity_get_fwnode_pad is called in order to
retrieve the remote pad, which is the source of the CSI.
However this function is expecting the sensor endpoint fwnode
and not sensor device fwnode as it is currently given.
Correct this by properly relying on the notified matched fwnode
data instead of the subdev entity fwnode.

Cc: stable@kernel.org
Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/st/stm32/stm32-csi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index fd2b6dfbd44c57..ecd0ed8e76b59c 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -825,7 +825,7 @@ static int stm32_csi_async_bound(struct v4l2_async_notifier *notifier,
 	int remote_pad;
 
 	remote_pad = media_entity_get_fwnode_pad(&s_subdev->entity,
-						 s_subdev->fwnode,
+						 asd->match.fwnode,
 						 MEDIA_PAD_FL_SOURCE);
 	if (remote_pad < 0) {
 		dev_err(csidev->dev, "Couldn't find output pad for subdev %s\n",

From ea3a418d73b0ccf15e6b60efee1606484acf91de Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Wed, 29 Jul 2026 11:18:34 +0900
Subject: [PATCH 1108/1982] media: stm32: csi: unregister async notifier on
 cleanup

[ Upstream commit 4957d480a0c87cf3d024e6ff1f57d1222f9212cb ]

stm32_csi_parse_dt() registers the async notifier before probe finishes.
If a later operation fails, the error path only cleans up the notifier's
connections.  It does not unregister the notifier, leaving its entry on
the global notifier list after the devm-allocated csidev is freed.

The remove path has the same problem.  A later async operation can then
walk the stale notifier entry and access freed memory.

Unregister the notifier before cleaning up its resources on both paths.

Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/st/stm32/stm32-csi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index ecd0ed8e76b59c..78c68cf90ffcbf 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev)
 	return 0;
 
 err_cleanup:
+	v4l2_async_nf_unregister(&csidev->notifier);
 	v4l2_async_nf_cleanup(&csidev->notifier);
 	return ret;
 }
@@ -1067,6 +1068,8 @@ static void stm32_csi_remove(struct platform_device *pdev)
 {
 	struct stm32_csi_dev *csidev = platform_get_drvdata(pdev);
 
+	v4l2_async_nf_unregister(&csidev->notifier);
+	v4l2_async_nf_cleanup(&csidev->notifier);
 	v4l2_async_unregister_subdev(&csidev->sd);
 
 	pm_runtime_disable(&pdev->dev);

From d2606c2c6d490828c8e052028d2dcfa7a5c3d16f Mon Sep 17 00:00:00 2001
From: James Hilliard <james.hilliard1@gmail.com>
Date: Fri, 4 Sep 2026 19:05:37 -0600
Subject: [PATCH 1109/1982] mtd: rawnand: sunxi: reject ECC maximization on
 small pages

[ Upstream commit a3c84084a73e170374b7dd493947efdef4ee57bc ]

When nand-ecc-maximize is set, the driver selects a 1024-byte ECC step
and divides the available OOB bytes by the resulting number of steps. A
NAND with a smaller page therefore produces zero steps and a division by
zero.

The older controllers also provide a 512-byte ECC block mode, but the
hardware documentation describes that as an ECC block size within NAND
pages whose supported sizes start at 1024 bytes. It does not document a
512-byte NAND page mode.

Reject pages smaller than 1024 bytes before deriving the step count. This
prevents the division by zero at the point where the incompatible
maximized geometry is selected without changing explicitly configured
512-byte ECC block handling.

Fixes: 4796d8655915 ("mtd: nand: sunxi: Support ECC maximization")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/sunxi_nand.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 75db1713e6177e..f9b72671c52531 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1631,6 +1631,9 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
 	if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) {
 		int bytes;
 
+		if (mtd->writesize < 1024)
+			return -EINVAL;
+
 		ecc->size = 1024;
 		nsectors = mtd->writesize / ecc->size;
 

From 486eccf2f4bed764904353ae30403619a7ac1c1c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Apr 2026 15:49:44 +0200
Subject: [PATCH 1110/1982] media: adv7604: avoid negative array index in
 log_status when cp_read fails

[ Upstream commit 10d8dfda1c08f6788049aa100685e223d857f901 ]

cp_read() returns the negative errno from regmap_read() on I2C failure.
adv76xx_log_status() shifts the result right by 4 and uses it directly
to index csc_coeff_sel_rb[16] causing the right shift of a negative
number to result in -1, reading a negative place in the array.

Commit 8163419e3e05 ("media: adv7842: Avoid possible out-of-bounds
array accesses in adv7842_cp_log_status()") fixed the identical pattern
in the adv7842, so do the same thing here.

Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV7604 video decoder")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/adv7604.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 516553fb17e983..cfecfff4c3aaa9 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2641,8 +2641,9 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
 					"(16-235)" : "(0-255)",
 				(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
 	}
+	ret = cp_read(sd, info->cp_csc) >> 4;
 	v4l2_info(sd, "Color space conversion: %s\n",
-			csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]);
+			ret < 0 ? "" : csc_coeff_sel_rb[ret]);
 
 	if (!is_digital_input(sd))
 		return 0;

From de92aa70a36a4f01b6007f8792ca89c6d6993185 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Apr 2026 15:49:45 +0200
Subject: [PATCH 1111/1982] media: stv090x: bound DiSEqC reply length to msg[]
 size

[ Upstream commit bad6ce6e0856f344910ba95b006e6c0ebee2d9c8 ]

The FIFO_BYTENBR_FIELD register field is 4 bits wide, giving a length
of 0..15, but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply.
A faulty or malicious DiSEqC slave (or i2c bus glitch) reporting more
than 4 bytes will the array and clobber the stack.

The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.

Fixes: e415c689a884 ("V4L/DVB (11579): Initial go at TT S2-1600")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/stv090x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
index f273efa330cfe2..b95b6b4a69c73f 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -3902,6 +3902,8 @@ static int stv090x_recv_slave_reply(struct dvb_frontend *fe, struct dvb_diseqc_s
 
 	if (rx_end) {
 		reply->msg_len = STV090x_GETFIELD_Px(reg, FIFO_BYTENBR_FIELD);
+		if (reply->msg_len > sizeof(reply->msg))
+			reply->msg_len = sizeof(reply->msg);
 		for (i = 0; i < reply->msg_len; i++)
 			reply->msg[i] = STV090x_READ_DEMOD(state, DISRXDATA);
 	}

From 8018d370be35e9f9ad9193a785b44179d4d55251 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Apr 2026 15:49:46 +0200
Subject: [PATCH 1112/1982] media: stv0900: bound DiSEqC reply length to msg[]
 size

[ Upstream commit 6d7e70111b9c80a9e4cb17fe6a6c4f5470847722 ]

The FIFO_BYTENBR field is 4 bits (mask 0x0f), giving a length of 0..15
but reply->msg is __u8[4] in struct dvb_diseqc_slave_reply.  A faulty or
malicious device reporting more than 4 bytes will the array and clobber
the stack.

The stb0899, tda10071, and s5h1420 drivers all properly bound the FIFO
count against sizeof(reply->msg) before the read loop, so do the same
thing in this driver.

Fixes: 99277b3824e4 ("V4L/DVB (10803): Add core code for ST STV0900 dual demodulator.")
Cc: stable@kernel.org
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/stv0900_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c
index e7b9b9b11d7df9..ce228f2ef330cc 100644
--- a/drivers/media/dvb-frontends/stv0900_core.c
+++ b/drivers/media/dvb-frontends/stv0900_core.c
@@ -1775,6 +1775,8 @@ static int stv0900_recv_slave_reply(struct dvb_frontend *fe,
 
 	if (stv0900_get_bits(intp, RX_END)) {
 		reply->msg_len = stv0900_get_bits(intp, FIFO_BYTENBR);
+		if (reply->msg_len > sizeof(reply->msg))
+			reply->msg_len = sizeof(reply->msg);
 
 		for (i = 0; i < reply->msg_len; i++)
 			reply->msg[i] = stv0900_read_reg(intp, DISRXDATA);

From 8b25a49e4bd7d33f57d22ebd9439005a0072d891 Mon Sep 17 00:00:00 2001
From: Alexander Shiyan <eagle.alexander923@gmail.com>
Date: Fri, 3 Jul 2026 10:00:29 +0300
Subject: [PATCH 1113/1982] media: synopsys: hdmirx: use
 request_any_context_irq() for 5V detection IRQ

[ Upstream commit fce1e4fa3867c0ff19a31f9977741696710855a6 ]

Replace devm_request_irq() with devm_request_any_context_irq()
for the 5V detection interrupt handler. This allows the kernel
to choose the appropriate execution context (hardirq or threaded)
depending on the underlying interrupt controller. On some platforms,
the interrupt may be nested or require a threaded handler, and
using the fixed hardirq version can cause probe failures.
Switching to the more flexible function improves driver portability
without affecting functionality.

Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@kernel.org
Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index 8e6f452f76c73c..dbbd33f5908e58 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -2532,10 +2532,11 @@ static int hdmirx_setup_irq(struct snps_hdmirx_dev *hdmirx_dev,
 	irq_set_status_flags(irq, IRQ_NOAUTOEN);
 
 	hdmirx_dev->det_irq = irq;
-	ret = devm_request_irq(dev, irq, hdmirx_5v_det_irq_handler,
-			       IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING,
-			       "rk_hdmirx-5v", hdmirx_dev);
-	if (ret) {
+	ret = devm_request_any_context_irq(dev, irq, hdmirx_5v_det_irq_handler,
+					   IRQF_TRIGGER_FALLING |
+					   IRQF_TRIGGER_RISING,
+					   "rk_hdmirx-5v", hdmirx_dev);
+	if (ret < 0) {
 		dev_err_probe(dev, ret, "failed to request hdmirx-5v irq\n");
 		return ret;
 	}

From 79800ff17a5f487c8cb75481eb71f14ab949eaa4 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Thu, 16 Jul 2026 10:15:39 +0000
Subject: [PATCH 1114/1982] media: nuvoton: npcm-video: quiesce VCD IRQ before
 teardown

[ Upstream commit ae8a4b51df30e39c07704efd5500361d8138c4d0 ]

The VCD IRQ is devm-requested, but npcm_video_remove() frees the video
object before devres releases that IRQ.  The threaded handler dereferences
video->vcd_regmap before checking VIDEO_STREAMING, so an interrupt in that
interval can access freed memory.

Request the IRQ with IRQF_NO_AUTOEN.  Enable it after starting capture and
setting VIDEO_STREAMING, and disable it first in stop_streaming().
disable_irq() waits for an in-flight threaded handler to finish, after
which stop_streaming() can mask and reset the VCD without a handler
re-enabling it.

Use vb2_video_unregister_device() during remove.  It releases the vb2
queue and calls stop_streaming() for an active stream, ensuring that the
IRQ is disabled before the video object is freed.  Do not release the queue
separately.

If streaming is never started, IRQF_NO_AUTOEN keeps the IRQ disabled
until devres releases it.

This issue was found by an in-house static analysis tool.

Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Tested-by: Marvin Lin <kflin@nuvoton.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/nuvoton/npcm-video.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/nuvoton/npcm-video.c b/drivers/media/platform/nuvoton/npcm-video.c
index c4c5c318f7865a..d10bda3757efe8 100644
--- a/drivers/media/platform/nuvoton/npcm-video.c
+++ b/drivers/media/platform/nuvoton/npcm-video.c
@@ -120,6 +120,7 @@ struct npcm_video {
 
 	struct list_head buffers;
 	struct mutex buffer_lock; /* buffer list lock */
+	int irq;
 	unsigned long flags;
 	unsigned int sequence;
 
@@ -1486,6 +1487,7 @@ static int npcm_video_start_streaming(struct vb2_queue *q, unsigned int count)
 	}
 
 	set_bit(VIDEO_STREAMING, &video->flags);
+	enable_irq(video->irq);
 	return 0;
 }
 
@@ -1494,6 +1496,7 @@ static void npcm_video_stop_streaming(struct vb2_queue *q)
 	struct npcm_video *video = vb2_get_drv_priv(q);
 	struct regmap *vcd = video->vcd_regmap;
 
+	disable_irq(video->irq);
 	clear_bit(VIDEO_STREAMING, &video->flags);
 	regmap_write(vcd, VCD_INTE, 0);
 	regmap_write(vcd, VCD_STAT, VCD_STAT_CLEAR);
@@ -1707,9 +1710,10 @@ static int npcm_video_init(struct npcm_video *video)
 		dev_err(dev, "Failed to find VCD IRQ\n");
 		return -ENODEV;
 	}
+	video->irq = irq;
 
 	rc = devm_request_threaded_irq(dev, irq, NULL, npcm_video_irq,
-				       IRQF_ONESHOT, DEVICE_NAME, video);
+				       IRQF_ONESHOT | IRQF_NO_AUTOEN, DEVICE_NAME, video);
 	if (rc < 0) {
 		dev_err(dev, "Failed to request IRQ %d\n", irq);
 		return rc;
@@ -1807,8 +1811,7 @@ static void npcm_video_remove(struct platform_device *pdev)
 	struct v4l2_device *v4l2_dev = dev_get_drvdata(dev);
 	struct npcm_video *video = to_npcm_video(v4l2_dev);
 
-	video_unregister_device(&video->vdev);
-	vb2_queue_release(&video->queue);
+	vb2_video_unregister_device(&video->vdev);
 	v4l2_ctrl_handler_free(&video->ctrl_handler);
 	v4l2_device_unregister(v4l2_dev);
 	if (video->ece.enable)

From 0b39ce62d9226a8e09dda11a4f886b5bb15515ce Mon Sep 17 00:00:00 2001
From: Damon Ding <damon.ding@rock-chips.com>
Date: Fri, 28 Aug 2026 14:51:51 +0800
Subject: [PATCH 1115/1982] drm/bridge: analogix_dp: Restore mandatory samsung
 DP DT properties

[ Upstream commit 02f569dd66c94dd67b2586f776235cf4177409ed ]

Revert the change that made samsung,link-rate and samsung,lane-count
optional for Exynos DP. Add error checking to fail probe early if the
required DT properties are missing.

If these properties are missing, video_info->max_link_rate and
video_info->max_lane_count remain zero, and so do link_train.link_rate
and link_train.lane_count used in the subsequent link training flow,
resulting in link training failure.

There is no way at all a device can work without these properties.
Here is the code flow when either max_link_rate or max_lane_count is 0:

  analogix_dp_commit()
    -> analogix_dp_full_link_train(dp, max_lanes = 0, max_rate = 0)

  analogix_dp_full_link_train(max_lanes, max_rate):
      // Read sink capabilities via DPCD and sanitize them
      link_rate  = read_dpcd(DP_MAX_LINK_RATE);  // >= 0x06 after fixup
      lane_count = read_dpcd(DP_MAX_LANE_COUNT); // >= 1 after fixup

      // Clamp by the limits from DT
      if (link_rate > max_rate)    // 0x06 > 0, always true
          link_rate = max_rate;    // link_rate = 0
      if (lane_count > max_lanes)  // 1 > 0, always true
          lane_count = max_lanes;  // lane_count = 0

      // Configure TX with the zeroed values
      set_link_bandwidth(link_rate = 0)
          // writel() is only executed for bwtype == 0x06/0x0a,
          // so LINK_BW_SET is never written and stays at
          // reset value; phy_configure() gets link_rate = 0.

      set_lane_count(lane_count = 0)
          // writel(0, ANALOGIX_DP_LANE_COUNT_SET) enables 0 lanes;
          // phy_configure() is called with lanes = 0.

      // Program sink for link training
      drm_dp_dpcd_write(DP_LINK_BW_SET, {link_rate = 0/lane_count = 0})
          // DP spec requires link rate in {0x06, 0x0a, 0x14} and
          // lane count in {1, 2, 4}. Writing zeros is illegal, so
          // the sink cannot enter the training state.

      // Training loop
      for (lane = 0; lane < lane_count /* 0 */; lane++)
          // loop body never executes; training_lane[] stays
          // uninitialized and no training register is programmed

Since the sanitized sink values are always non-zero (link_rate >= 0x06,
lane_count >= 1), the clamping with a zero maximum unconditionally
forces the training parameters to zero. Clock recovery can never be
achieved, so link training fails deterministically.

Consequently, making these properties mandatory again cannot break
any existing device: a DT without them could never have worked in
the first place. Failing probe early with a clear error message is
more helpful than a silent link training failure at runtime.

Fixes: 0d0abd894ead ("drm: bridge: analogix/dp: add max link rate and lane count limit for RK3288")
Cc: stable@vger.kernel.org
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Link: https://patch.msgid.link/20260828065153.590802-4-damon.ding@rock-chips.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index efe534977d12de..44761f7161f6f1 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1389,6 +1389,7 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
 {
 	struct device_node *dp_node = dp->dev->of_node;
 	struct video_info *video_info = &dp->video_info;
+	u32 val;
 
 	switch (dp->plat_data->dev_type) {
 	case RK3288_DP:
@@ -1409,10 +1410,14 @@ static int analogix_dp_dt_parse_pdata(struct analogix_dp_device *dp)
 		 * NOTE: those property parseing code is used for
 		 * providing backward compatibility for samsung platform.
 		 */
-		of_property_read_u32(dp_node, "samsung,link-rate",
-				     &video_info->max_link_rate);
-		of_property_read_u32(dp_node, "samsung,lane-count",
-				     &video_info->max_lane_count);
+		if (of_property_read_u32(dp_node, "samsung,link-rate", &val))
+			return dev_err_probe(dp->dev, -EINVAL,
+					     "Failed to get samsung,link-rate\n");
+		video_info->max_link_rate = val;
+		if (of_property_read_u32(dp_node, "samsung,lane-count", &val))
+			return dev_err_probe(dp->dev, -EINVAL,
+					     "Failed to get samsung,lane-count\n");
+		video_info->max_lane_count = val;
 		break;
 	}
 

From d56c604bae3a923b83f462e4d34d4dd97016f142 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Sun, 30 Aug 2026 13:33:08 +0800
Subject: [PATCH 1116/1982] dmaengine: altera-msgdma: initialize state before
 requesting IRQ

[ Upstream commit a5f8e3471fc20567df888267885dec3eb340eb37 ]

msgdma_probe() registers the IRQ before initializing the tasklet, lock,
and descriptor lists used by the interrupt handler. A pending interrupt
can access incomplete state during probe.

Initialize the handler state before requesting the IRQ so the interrupt
path observes ready software state.

Fixes: a85c6f1b2921 ("dmaengine: Add driver for Altera / Intel mSGDMA IP core")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260830053308.2190597-1-runyu.xiao@seu.edu.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/altera-msgdma.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index e1811a9be0bbe0..2d4bca495b3d55 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -849,11 +849,6 @@ static int msgdma_probe(struct platform_device *pdev)
 	if (mdev->irq < 0)
 		return -ENXIO;
 
-	ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
-			       0, dev_name(&pdev->dev), mdev);
-	if (ret)
-		return ret;
-
 	tasklet_setup(&mdev->irq_tasklet, msgdma_tasklet);
 
 	dma_cookie_init(&mdev->dmachan);
@@ -865,6 +860,11 @@ static int msgdma_probe(struct platform_device *pdev)
 	INIT_LIST_HEAD(&mdev->done_list);
 	INIT_LIST_HEAD(&mdev->free_list);
 
+	ret = devm_request_irq(&pdev->dev, mdev->irq, msgdma_irq_handler,
+			       0, dev_name(&pdev->dev), mdev);
+	if (ret)
+		return ret;
+
 	dma_dev = &mdev->dmadev;
 
 	/* Set DMA capabilities */

From 2cb1b55431ae5eab6efe0135b489a2f03f396540 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Thu, 27 Aug 2026 07:37:41 +0200
Subject: [PATCH 1117/1982] ACPI: pfr_update: zero-initialize capability query
 result

[ Upstream commit d776369a9eded071df83e4738e1572c4c5b912d7 ]

query_capability() copies four ACPI buffers into fixed-size fields using
the firmware-supplied lengths.  The existing overflow guard rejects
oversized buffers, but shorter buffers are accepted and leave trailing
bytes of the stack-allocated cap_hdr uninitialized.  PFRU_IOC_QUERY_CAP
then copies the entire structure to userspace.

Zero-initialize cap_hdr before querying the firmware.  This preserves the
existing handling of short firmware responses while preventing disclosure
of kernel stack data.  Oversized buffers remain rejected.

A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix
bytes in all four fields.  With this change, the ioctl still succeeds and
each unwritten suffix is zero-filled, while 64-byte buffers continue to
return -EINVAL.

Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260827053741.79425-1-kmehltretter@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/pfr_update.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
index 9afd2c52fdbd88..98ace679601b85 100644
--- a/drivers/acpi/pfr_update.c
+++ b/drivers/acpi/pfr_update.c
@@ -422,7 +422,7 @@ static int start_update(int action, struct pfru_device *pfru_dev)
 
 static long pfru_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-	struct pfru_update_cap_info cap_hdr;
+	struct pfru_update_cap_info cap_hdr = {};
 	struct pfru_device *pfru_dev = to_pfru_dev(file);
 	void __user *p = (void __user *)arg;
 	u32 rev;

From 9b26d77f89cab299cb1bf457fa7d46340a11191f Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Fri, 4 Sep 2026 14:11:37 +0800
Subject: [PATCH 1118/1982] hte: tegra194-test: shut down timer before GPIO
 release

[ Upstream commit 30167fadbf87fa901a2fee49c30a5c5a506a43e8 ]

tegra_hte_test_remove() releases GPIO descriptors before stopping
hte.timer. gpio_timer_cb() accesses hte.gpio_out and rearms the timer, so
a callback concurrent with remove can use a released descriptor and rearm
after teardown.

Shut down the timer before releasing the GPIO descriptors.
timer_shutdown_sync() waits for a running callback and prevents it from
being rearmed.

Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Dipen Patel <dipenp@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hte/hte-tegra194-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
index 94e931f4530596..4951049e00b094 100644
--- a/drivers/hte/hte-tegra194-test.c
+++ b/drivers/hte/hte-tegra194-test.c
@@ -218,10 +218,10 @@ static void tegra_hte_test_remove(struct platform_device *pdev)
 {
 	(void)pdev;
 
+	timer_shutdown_sync(&hte.timer);
 	free_irq(hte.gpio_in_irq, &hte);
 	gpiod_put(hte.gpio_in);
 	gpiod_put(hte.gpio_out);
-	timer_delete_sync(&hte.timer);
 }
 
 static struct platform_driver tegra_hte_test_driver = {

From 8e91b6b73f18cce4dca38a374068870ad98d9558 Mon Sep 17 00:00:00 2001
From: Robin Snyders <robin@snyders.xyz>
Date: Wed, 12 Aug 2026 01:29:58 +0200
Subject: [PATCH 1119/1982] power: supply: qcom_smbx: include base when petting
 watchdog

[ Upstream commit 2f0dec12007891398e6e3041aca0b8656918973d ]

BARK_BITE_WDOG_PET is an offset from the charger peripheral base, but
the watchdog bark handler writes it as an absolute SPMI address. This can
write another PMIC peripheral and leave the charger watchdog unserviced.

Add the charger base, as all other qcom_smbx register accesses do.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-1-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index b1cb925581ec6b..11aab7e6355923 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -757,7 +757,7 @@ static irqreturn_t smb_handle_wdog_bark(int irq, void *data)
 
 	power_supply_changed(chip->chg_psy);
 
-	rc = regmap_write(chip->regmap, BARK_BITE_WDOG_PET,
+	rc = regmap_write(chip->regmap, chip->base + BARK_BITE_WDOG_PET,
 			  BARK_BITE_WDOG_PET_BIT);
 	if (rc < 0)
 		dev_err(chip->dev, "Couldn't pet the dog rc=%d\n", rc);

From 287619a6cd07da5b210e306f06a6f358806ef5b6 Mon Sep 17 00:00:00 2001
From: Robin Snyders <robin@snyders.xyz>
Date: Wed, 12 Aug 2026 01:29:59 +0200
Subject: [PATCH 1120/1982] power: supply: qcom_smbx: test battery health
 status bits

[ Upstream commit 68f645192f64e1037685dbdb0dffb41a5a012056 ]

BATTERY_CHARGER_STATUS_2 contains independent status and fault bits.
Switching on the complete register only recognizes a fault when it is the
sole asserted bit, and can report a healthy battery when another status
bit is set at the same time.

Test the relevant fault bits in priority order, matching the Qualcomm
downstream driver handling.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-2-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 11aab7e6355923..6e976342a3fbda 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -629,26 +629,20 @@ static int smb_get_prop_health(struct smb_chip *chip, int *val)
 		return rc;
 	}
 
-	switch (stat) {
-	case CHARGER_ERROR_STATUS_BAT_OV_BIT:
+	if (stat & CHARGER_ERROR_STATUS_BAT_OV_BIT)
 		*val = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
-		return 0;
-	case BAT_TEMP_STATUS_TOO_COLD_BIT:
+	else if (stat & BAT_TEMP_STATUS_TOO_COLD_BIT)
 		*val = POWER_SUPPLY_HEALTH_COLD;
-		return 0;
-	case BAT_TEMP_STATUS_TOO_HOT_BIT:
+	else if (stat & BAT_TEMP_STATUS_TOO_HOT_BIT)
 		*val = POWER_SUPPLY_HEALTH_OVERHEAT;
-		return 0;
-	case BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT:
+	else if (stat & BAT_TEMP_STATUS_COLD_SOFT_LIMIT_BIT)
 		*val = POWER_SUPPLY_HEALTH_COOL;
-		return 0;
-	case BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT:
+	else if (stat & BAT_TEMP_STATUS_HOT_SOFT_LIMIT_BIT)
 		*val = POWER_SUPPLY_HEALTH_WARM;
-		return 0;
-	default:
+	else
 		*val = POWER_SUPPLY_HEALTH_GOOD;
-		return 0;
-	}
+
+	return 0;
 }
 
 static int smb_get_property(struct power_supply *psy,

From 29aeb5ac799010358dfb225e480b799d1ee8dc9f Mon Sep 17 00:00:00 2001
From: Robin Snyders <robin@snyders.xyz>
Date: Wed, 12 Aug 2026 01:30:00 +0200
Subject: [PATCH 1121/1982] power: supply: qcom_smbx: fix float voltage
 selector

[ Upstream commit 2a26d260e72a95e9f13b9e475f63aa404600fcb2 ]

FLOAT_VOLTAGE_CFG encodes 3,487,500 uV as selector zero and advances in
7,500 uV steps. The current calculation adds one to that selector, so it
programs the requested float voltage one step too high.

Remove the extra offset and name the hardware encoding constants.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-3-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 6e976342a3fbda..65ee918d1f09b2 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -349,6 +349,8 @@
 
 /* pmi8998 registers represent current in increments of 1/40th of an amp */
 #define CURRENT_SCALE_FACTOR				25000
+#define SMB2_FLOAT_VOLTAGE_MIN_UV			3487500
+#define SMB2_FLOAT_VOLTAGE_STEP_UV			7500
 /* clang-format on */
 
 enum charger_status {
@@ -987,7 +989,8 @@ static int smb_probe(struct platform_device *pdev)
 		return dev_err_probe(chip->dev, rc,
 				     "Failed to init status change work\n");
 
-	rc = (chip->batt_info->voltage_max_design_uv - 3487500) / 7500 + 1;
+	rc = (chip->batt_info->voltage_max_design_uv -
+	      SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
 	rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
 				FLOAT_VOLTAGE_SETTING_MASK, rc);
 	if (rc < 0)

From 3a476ea9a2f42b2f9f04f833bdde6c55d72ed7f9 Mon Sep 17 00:00:00 2001
From: Robin Snyders <robin@snyders.xyz>
Date: Wed, 12 Aug 2026 01:30:01 +0200
Subject: [PATCH 1122/1982] power: supply: qcom_smbx: validate battery float
 voltage

[ Upstream commit a2d7dc538da2cb4a7426f0742197e762cb635f38 ]

power_supply_get_battery_info() leaves absent optional properties at
-EINVAL. The driver uses voltage_max_design_uv without checking it, so a
missing or out-of-range value can become an invalid float-voltage
selector.

Prefer the constant-charge voltage because it describes the charger's CV
target, then fall back to the battery design voltage. Both properties are
optional in the simple-battery binding, so preserve the hardware setting
when neither is present. Reject a supplied target outside the SMB2 range.

smb_init_hw() enables charging before battery data is parsed and before
the remaining fallible probe steps. Save the initial charging-enable bit
and install a managed rollback before initialization. Keep the rollback
active across battery-info, voltage, IRQ and wake-IRQ setup, then remove it
only after probe can no longer fail.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-4-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 61 ++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 3 deletions(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 65ee918d1f09b2..dddc8f3e1073ad 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -350,6 +350,7 @@
 /* pmi8998 registers represent current in increments of 1/40th of an amp */
 #define CURRENT_SCALE_FACTOR				25000
 #define SMB2_FLOAT_VOLTAGE_MIN_UV			3487500
+#define SMB2_FLOAT_VOLTAGE_MAX_UV			4920000
 #define SMB2_FLOAT_VOLTAGE_STEP_UV			7500
 /* clang-format on */
 
@@ -377,6 +378,7 @@ struct smb_init_register {
  * @base:		Base address for smb registers
  * @regmap:		Register map
  * @batt_info:		Battery data from DT
+ * @initial_charge_enable: Charging enable state before hardware setup
  * @status_change_work: Worker to handle plug/unplug events
  * @cable_irq:		USB plugin IRQ
  * @wakeup_enabled:	If the cable IRQ will cause a wakeup
@@ -390,6 +392,7 @@ struct smb_chip {
 	unsigned int base;
 	struct regmap *regmap;
 	struct power_supply_battery_info *batt_info;
+	u8 initial_charge_enable;
 
 	struct delayed_work status_change_work;
 	int cable_irq;
@@ -898,6 +901,19 @@ static int smb_init_hw(struct smb_chip *chip)
 	return 0;
 }
 
+static void smb_restore_charge_enable(void *data)
+{
+	struct smb_chip *chip = data;
+	int rc;
+
+	rc = regmap_update_bits(chip->regmap,
+				chip->base + CHARGING_ENABLE_CMD,
+				CHARGING_ENABLE_CMD_BIT,
+				chip->initial_charge_enable);
+	if (rc < 0)
+		dev_err(chip->dev, "Couldn't restore charging state: %d\n", rc);
+}
+
 static int smb_init_irq(struct smb_chip *chip, int *irq, const char *name,
 			 irqreturn_t (*handler)(int irq, void *data))
 {
@@ -925,6 +941,9 @@ static int smb_probe(struct platform_device *pdev)
 	struct power_supply_config supply_config = {};
 	struct power_supply_desc *desc;
 	struct smb_chip *chip;
+	unsigned int charge_enable;
+	unsigned int float_voltage_sel;
+	int float_voltage_uv;
 	int rc, irq;
 
 	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -955,6 +974,18 @@ static int smb_probe(struct platform_device *pdev)
 				     "Couldn't get usbin_i IIO channel\n");
 	}
 
+	rc = regmap_read(chip->regmap, chip->base + CHARGING_ENABLE_CMD,
+			 &charge_enable);
+	if (rc < 0)
+		return dev_err_probe(chip->dev, rc,
+				     "Couldn't read charging state\n");
+
+	chip->initial_charge_enable = charge_enable & CHARGING_ENABLE_CMD_BIT;
+	rc = devm_add_action_or_reset(chip->dev, smb_restore_charge_enable, chip);
+	if (rc)
+		return dev_err_probe(chip->dev, rc,
+				     "Couldn't register charging state rollback\n");
+
 	rc = smb_init_hw(chip);
 	if (rc < 0)
 		return rc;
@@ -989,13 +1020,35 @@ static int smb_probe(struct platform_device *pdev)
 		return dev_err_probe(chip->dev, rc,
 				     "Failed to init status change work\n");
 
-	rc = (chip->batt_info->voltage_max_design_uv -
-	      SMB2_FLOAT_VOLTAGE_MIN_UV) / SMB2_FLOAT_VOLTAGE_STEP_UV;
+	if (power_supply_battery_info_has_prop(chip->batt_info,
+					       POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE_MAX)) {
+		float_voltage_uv =
+			chip->batt_info->constant_charge_voltage_max_uv;
+	} else if (power_supply_battery_info_has_prop(chip->batt_info,
+					      POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN)) {
+		float_voltage_uv = chip->batt_info->voltage_max_design_uv;
+	} else {
+		dev_warn(chip->dev, "No battery float voltage; preserving hardware setting\n");
+		goto skip_float_voltage;
+	}
+
+	if (float_voltage_uv < SMB2_FLOAT_VOLTAGE_MIN_UV ||
+	    float_voltage_uv > SMB2_FLOAT_VOLTAGE_MAX_UV)
+		return dev_err_probe(chip->dev, -EINVAL,
+				     "float voltage %d uV outside %d-%d uV\n",
+				     float_voltage_uv,
+				     SMB2_FLOAT_VOLTAGE_MIN_UV,
+				     SMB2_FLOAT_VOLTAGE_MAX_UV);
+
+	float_voltage_sel =
+		(float_voltage_uv - SMB2_FLOAT_VOLTAGE_MIN_UV) /
+		SMB2_FLOAT_VOLTAGE_STEP_UV;
 	rc = regmap_update_bits(chip->regmap, chip->base + FLOAT_VOLTAGE_CFG,
-				FLOAT_VOLTAGE_SETTING_MASK, rc);
+				FLOAT_VOLTAGE_SETTING_MASK, float_voltage_sel);
 	if (rc < 0)
 		return dev_err_probe(chip->dev, rc, "Couldn't set vbat max\n");
 
+skip_float_voltage:
 	rc = smb_init_irq(chip, &irq, "bat-ov", smb_handle_batt_overvoltage);
 	if (rc < 0)
 		return rc;
@@ -1019,6 +1072,8 @@ static int smb_probe(struct platform_device *pdev)
 	if (rc < 0)
 		return dev_err_probe(chip->dev, rc, "Couldn't set wake irq\n");
 
+	devm_remove_action(chip->dev, smb_restore_charge_enable, chip);
+
 	platform_set_drvdata(pdev, chip);
 
 	/* Initialise charger state */

From 29601cf266cac59cc5111618643076f722db3f2a Mon Sep 17 00:00:00 2001
From: Robin Snyders <robin@snyders.xyz>
Date: Wed, 12 Aug 2026 01:30:02 +0200
Subject: [PATCH 1123/1982] power: supply: qcom_smbx: notify battery
 overvoltage recovery

[ Upstream commit 2548e4fa576a87a3b0d1b15a9c3f909bc54887b5 ]

The battery-overvoltage IRQ is configured for both edges, but its handler
only notifies the power-supply core while the fault bit is asserted. The
falling edge therefore does not publish the recovered health and status.
The handler also ignores register-read failures before testing status.

Handle read errors, log only an asserted fault, and notify the
power-supply core after every successful edge read.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Robin Snyders <robin@snyders.xyz>
Link: https://patch.msgid.link/20260812-qcom-smbx-fixes-v1-5-eb48246be599@snyders.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index dddc8f3e1073ad..55fe31aa3df3db 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -715,16 +715,22 @@ static irqreturn_t smb_handle_batt_overvoltage(int irq, void *data)
 {
 	struct smb_chip *chip = data;
 	unsigned int status;
+	int rc;
 
-	regmap_read(chip->regmap, chip->base + BATTERY_CHARGER_STATUS_2,
-		    &status);
+	rc = regmap_read(chip->regmap,
+			 chip->base + BATTERY_CHARGER_STATUS_2, &status);
+	if (rc < 0) {
+		dev_err(chip->dev, "Couldn't read charger status: %d\n", rc);
+		return IRQ_HANDLED;
+	}
 
 	if (status & CHARGER_ERROR_STATUS_BAT_OV_BIT) {
 		/* The hardware stops charging automatically */
 		dev_err(chip->dev, "battery overvoltage detected\n");
-		power_supply_changed(chip->chg_psy);
 	}
 
+	power_supply_changed(chip->chg_psy);
+
 	return IRQ_HANDLED;
 }
 

From 4f2e159190dd54431de795adacfbbbf01c817b6f Mon Sep 17 00:00:00 2001
From: Shengzhuo Wei <me@cherr.cc>
Date: Thu, 27 Aug 2026 05:22:29 +0800
Subject: [PATCH 1124/1982] power: supply: bq27xxx: synchronize work
 cancellation on suspend

[ Upstream commit f0ff5673aa07ded2bb383ac526c1faee4fe9ca07 ]

The poll work requeues itself via mod_delayed_work() while the device
is not removed. cancel_delayed_work() does not wait for a callback
that is already running, so a poll racing with suspend can keep
issuing I2C transfers after suspend returns and requeue itself into
early resume.

Use cancel_delayed_work_sync() to quiesce polling before suspend
completes, as the teardown path already does.

Fixes: dfcb264a01a9 ("power: supply: bq27xxx: Stop and start delayed work in suspend and resume")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260827-bq27xxx-suspend-cancel-sync-v1-1-77a67711cbc3@cherr.cc
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq27xxx_battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 01c9ec1116fa09..4d4809a70b622c 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -2291,7 +2291,7 @@ static int bq27xxx_battery_suspend(struct device *dev)
 {
 	struct bq27xxx_device_info *di = dev_get_drvdata(dev);
 
-	cancel_delayed_work(&di->work);
+	cancel_delayed_work_sync(&di->work);
 	return 0;
 }
 

From 63181ae0a49b52dfcb30f41bfef45aa004177e39 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Thu, 3 Sep 2026 08:13:12 +0000
Subject: [PATCH 1125/1982] power: supply: bq27xxx: Ensure poll work is
 cancelled on remove

[ Upstream commit db560f4b1c5253853f978385db066220e0c218dc ]

The di->work poll work is queued from the poll callback itself and from
bq27xxx_external_power_changed(). The cancel_delayed_work_sync() in
bq27xxx_battery_teardown() runs while the power_supply is still
registered, so external_power_changed() can re-arm the work after the
cancel, and it runs after the driver data has been freed.

Register a devm_delayed_work_autocancel() before
devm_power_supply_register(), so on unwind the power_supply is
unregistered first, after which no new external_power_changed()
callback can be dispatched, and the poll work is cancelled only then.
Drop the now-redundant cancel from bq27xxx_battery_teardown().

This issue was found by an in-house static analysis tool.

Fixes: 740b755a3b34 ("bq27x00: Poll battery state")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260903081312.225535-1-fanwu01@zju.edu.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq27xxx_battery.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
index 4d4809a70b622c..cd30993b8a89e2 100644
--- a/drivers/power/supply/bq27xxx_battery.c
+++ b/drivers/power/supply/bq27xxx_battery.c
@@ -43,6 +43,7 @@
  */
 
 #include <linux/device.h>
+#include <linux/devm-helpers.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/param.h>
@@ -2234,7 +2235,6 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
 	};
 	int ret;
 
-	INIT_DELAYED_WORK(&di->work, bq27xxx_battery_poll);
 	ret = devm_mutex_init(di->dev, &di->lock);
 	if (ret)
 		return ret;
@@ -2255,6 +2255,12 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
 	psy_desc->get_property = bq27xxx_battery_get_property;
 	psy_desc->external_power_changed = bq27xxx_external_power_changed;
 
+	/* Cancel the poll work after the power_supply is unregistered. */
+	ret = devm_delayed_work_autocancel(di->dev, &di->work,
+					   bq27xxx_battery_poll);
+	if (ret)
+		return ret;
+
 	di->bat = devm_power_supply_register(di->dev, psy_desc, &psy_cfg);
 	if (IS_ERR(di->bat))
 		return dev_err_probe(di->dev, PTR_ERR(di->bat),
@@ -2281,8 +2287,6 @@ void bq27xxx_battery_teardown(struct bq27xxx_device_info *di)
 	mutex_lock(&di->lock);
 	di->removed = true;
 	mutex_unlock(&di->lock);
-
-	cancel_delayed_work_sync(&di->work);
 }
 EXPORT_SYMBOL_GPL(bq27xxx_battery_teardown);
 

From 90093af6a0b4ab03277ac553c05fe0dc6c70a9ff Mon Sep 17 00:00:00 2001
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Date: Thu, 3 Sep 2026 21:37:13 +0200
Subject: [PATCH 1126/1982] iio: imu: inv_icm42600: fix odr change not caught
 in certain cases

[ Upstream commit f670d4d3477386d62017936f0121909f93ac17f8 ]

When using both accel and gyro with different frequencies, the ODR
change flag in the FIFO header can be sometime in a packet with
invalid data. Since we are ignoring these packets, we miss the ODR
change and any further change are blocked until sensor is turned off.

Fix this by moving the packet data validity check after the ODR change
flag check.

Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 8 ++++----
 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c  | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index 96a6213770d41f..d19ff0e76c6680 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1225,15 +1225,15 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
 		if (size <= 0)
 			return size;
 
-		/* skip packet if no accel data or data is invalid */
-		if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
-			continue;
-
 		/* update odr */
 		if (odr & INV_ICM42600_SENSOR_ACCEL)
 			inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
 							st->fifo.nb.total, no);
 
+		/* skip packet if no accel data or data is invalid */
+		if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
+			continue;
+
 		memcpy(&buffer.accel, accel, sizeof(buffer.accel));
 		/* convert 8 bits FIFO temperature in high resolution format */
 		buffer.temp = temp ? (*temp * 64) : 0;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
index a18dcac939298a..194838d88284c6 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -806,15 +806,15 @@ int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev)
 		if (size <= 0)
 			return size;
 
-		/* skip packet if no gyro data or data is invalid */
-		if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
-			continue;
-
 		/* update odr */
 		if (odr & INV_ICM42600_SENSOR_GYRO)
 			inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
 							st->fifo.nb.total, no);
 
+		/* skip packet if no gyro data or data is invalid */
+		if (gyro == NULL || !inv_icm42600_fifo_is_data_valid(gyro))
+			continue;
+
 		memcpy(&buffer.gyro, gyro, sizeof(buffer.gyro));
 		/* convert 8 bits FIFO temperature in high resolution format */
 		buffer.temp = temp ? (*temp * 64) : 0;

From 946aa222b49d7015fc37e36af5b73915bdcea841 Mon Sep 17 00:00:00 2001
From: Eric Kim <seohyun.kim@outlook.kr>
Date: Tue, 18 Aug 2026 12:48:29 +0900
Subject: [PATCH 1127/1982] sched/fair: Reset NUMA fault locality after scan
 period update

[ Upstream commit e81ee06308379a5f2ededf997bcf17551bce5db7 ]

When updating the task scan period for NUMA locality checks,
update_task_scan_period() checks whether there were no faults or failed
migration on the last scan window, at which it prolongs the scan period.

However, p->numa_faults_locality, which is used to check for migration
failure and number of faults at the previous scan window is not cleared
after changing the scan period, which unintentionally increases
numa_scan_period up to numa_scan_period_max even when there were no
migration failures or no faults at previous scan.

Fix this by jumping to the out label on early exit at this case to
ensure p->numa_faults_locality is always cleared before returning.

Closes: https://lore.kernel.org/all/20250404095354.311156-1-qlsdnjs236@chungbuk.ac.kr/
Reported-by: Binwon Song <qlsdnjs236@chungbuk.ac.kr>
Signed-off-by: Eric Kim <seohyun.kim@outlook.kr>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/Message-ID:
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 67e8c2065d827d..fbc277c6963c5c 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2794,7 +2794,7 @@ static void update_task_scan_period(struct task_struct *p,
 		p->mm->numa_next_scan = jiffies +
 			msecs_to_jiffies(p->numa_scan_period);
 
-		return;
+		goto out;
 	}
 
 	/*
@@ -2838,7 +2838,10 @@ static void update_task_scan_period(struct task_struct *p,
 
 	p->numa_scan_period = clamp(p->numa_scan_period + diff,
 			task_scan_min(p), task_scan_max(p));
-	memset(p->numa_faults_locality, 0, sizeof(p->numa_faults_locality));
+
+out:
+	memset(p->numa_faults_locality, 0,
+	       sizeof(p->numa_faults_locality));
 }
 
 /*

From 00dd4a5c2b8c7391367c047ad79158043116723c Mon Sep 17 00:00:00 2001
From: Maxim Skokov <skokovmaksimevg@gmail.com>
Date: Sat, 5 Sep 2026 18:58:18 +0300
Subject: [PATCH 1128/1982] media: vivid: round the height down to the vertical
 subsampling factor

[ Upstream commit a2ec28dd2a88d0721fc4a30242861e2be01d4023 ]

syzbot reports a vmalloc out-of-bounds write in the test pattern
generator:

BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2617 [inline]
BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2063/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705
Write of size 720 at addr ffffc900038f9d50 by task vivid-000-vid-c/6017

The reproducer requests a 720x49 NV12 capture format, i.e. an odd
height for a format whose chroma plane is vertically subsampled.

The buffer size is derived from the height by a truncating division:

	sizes[p] = (tpg_g_line_width(&dev->tpg, p) * h) /
		   dev->fmt_cap->vdownsampling[p] +
		   dev->fmt_cap->data_offset[p];

For a single buffer holding both planes tpg_g_line_width() returns
720 + 720 / 2 = 1080, so 1080 * 49 = 52920 bytes get allocated.

tpg_fill_plane_buffer() however emits one chroma line for every two
luma lines, i.e. DIV_ROUND_UP(49, 2) = 25 lines, and thus needs
49 * 720 + 25 * 720 = 53280 bytes. The memcpy() of the last chroma
line runs 360 bytes past the end of the buffer.

An odd height is not meaningful for a 4:2:0 format in the first place,
since the chroma plane would have to hold half a line. Rather than
fixing up each of the ~10 sites that divide the height by
vdownsampling[], round the height down to a multiple of the vertical
subsampling factor where it enters the driver. Adjusting the format is
what TRY_FMT/S_FMT are for, and it keeps every later division exact.

Formats without vertical subsampling are unaffected and keep accepting
odd heights.

Tested with the syzbot reproducer, which no longer triggers the splat,
and by streaming NV12, NV21, YUV420, YVU420 and YUYV at heights 47,
48, 49, 51, 480, 481 and 1081. v4l2-compliance gives identical results
before and after (48 of 50 succeeded on the vivid device in both
cases; the two failures are pre-existing and unrelated).

Fixes: ddcaee9dd4c0 ("[media] vivid: add support for single buffer planar formats")
Cc: stable@kernel.org
Reported-by: syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb43e758a4dc84dd467f
Signed-off-by: Maxim Skokov <skokovmaksimevg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
index d1c09bdb2f3b0b..cc2b704717f391 100644
--- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c
+++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c
@@ -568,6 +568,7 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
 	const struct vivid_fmt *fmt;
 	unsigned bytesperline, max_bpl;
 	unsigned factor = 1;
+	unsigned int vdiv = 1;
 	unsigned w, h;
 	unsigned p;
 	bool user_set_csc = !!(mp->flags & V4L2_PIX_FMT_FLAG_SET_CSC);
@@ -620,6 +621,18 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv,
 		mp->height = r.height / factor;
 	}
 
+	/*
+	 * The chroma planes of vertically subsampled formats hold
+	 * height / vdownsampling lines. If the height is not a multiple of
+	 * the subsampling factor, then the buffer size calculations round
+	 * that number down while the test pattern generator rounds it up,
+	 * so the generator writes one line past the end of the buffer.
+	 * Round the height down to keep both in sync.
+	 */
+	for (p = 0; p < fmt->planes; p++)
+		vdiv = max(vdiv, fmt->vdownsampling[p]);
+	mp->height = rounddown(mp->height, vdiv);
+
 	/* This driver supports custom bytesperline values */
 
 	mp->num_planes = fmt->buffers;

From 876ba0c13671407f7bd48791b84d5013a21188b0 Mon Sep 17 00:00:00 2001
From: Juan Perdomo <jcperdomo100@gmail.com>
Date: Tue, 8 Sep 2026 00:07:34 -0400
Subject: [PATCH 1129/1982] media: cx231xx: preserve I2C transfer length

[ Upstream commit a19c9502a69bbd42c18816b09cbefdeb4cb68066 ]

The I2C core stores message lengths in u16, but cx231xx truncates them to
u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
becomes a zero-length request. USB treats zero-length control transfers as
OUT regardless of bRequestType, so the IN control pipe trips the
usb_submit_urb() direction warning.

Use u16 for buf_size, matching both i2c_msg.len and
VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
URB_MAX_CTRL_SIZE check and return -EINVAL.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: stable@kernel.org
Reported-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
Tested-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/cx231xx/cx231xx.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/cx231xx/cx231xx.h b/drivers/media/usb/cx231xx/cx231xx.h
index 19f5036a78d7f4..f85d054fbb5cf2 100644
--- a/drivers/media/usb/cx231xx/cx231xx.h
+++ b/drivers/media/usb/cx231xx/cx231xx.h
@@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data {
 	u8 direction;		/* 1 - IN, 0 - OUT */
 	u8 saddr_len;		/* sub address len */
 	u16 saddr_dat;		/* sub addr data */
-	u8 buf_size;		/* buffer size */
+	u16 buf_size;		/* buffer size */
 	u8 *p_buffer;		/* pointer to the buffer */
 };
 

From f16b697c94756db9a3bddc41c30f00b3b2332977 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Wed, 9 Sep 2026 08:13:41 +0000
Subject: [PATCH 1130/1982] media: vivid: cancel svid ctrl work on release

[ Upstream commit 1adaefca7111235ff0a2219dd4899ac24601d6e8 ]

vivid_dev_release() cancels update_hdmi_ctrl_work but not its sibling
update_svid_ctrl_work, which vivid_vid_cap_s_ctrl() queues on
update_svid_ctrls_workqueue when a VIVID_CID_SVID_IS_CONNECTED_TO_OUTPUT
control is changed. The two work items were added together, but only
one of them is cancelled on release.

If the svid work is still pending or running when the last v4l2_device
reference is dropped, update_svid_ctrls_work_handler() runs after
kfree(dev): the handler iterates the global vivid_devs[] array and
calls v4l2_ctrl_modify_range() on every vivid_dev instance, including
this one after it has been freed.

Add the missing cancel_work_sync() next to the hdmi sibling, before
vivid_free_controls() releases the control handlers the work uses.

This issue was found by an in-house static analysis tool.

Fixes: d7c969f37515 ("media: vivid: Add 'Is Connected To' menu controls")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vivid/vivid-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c
index f44930502bdaf1..64a15a24a9c37b 100644
--- a/drivers/media/test-drivers/vivid/vivid-core.c
+++ b/drivers/media/test-drivers/vivid/vivid-core.c
@@ -854,6 +854,7 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev)
 	struct vivid_dev *dev = container_of(v4l2_dev, struct vivid_dev, v4l2_dev);
 
 	cancel_work_sync(&dev->update_hdmi_ctrl_work);
+	cancel_work_sync(&dev->update_svid_ctrl_work);
 	vivid_free_controls(dev);
 	v4l2_device_unregister(&dev->v4l2_dev);
 #ifdef CONFIG_MEDIA_CONTROLLER

From f82d80f7b6f7c537f3047330940300117aebb8e1 Mon Sep 17 00:00:00 2001
From: Junrui Luo <moonafterrain@outlook.com>
Date: Tue, 8 Sep 2026 15:27:21 +0800
Subject: [PATCH 1131/1982] media: vicodec: zero-initialize stateful decoder
 heap buffers

[ Upstream commit 27953c044974baf7e24dee3e9342fe0103dea80c ]

The stateful decoder leaks uninitialized kernel heap memory to userspace.
A process that can open the decoder video node gets it back in the CAPTURE
buffers it dequeues.

The reference frame and the compressed frame buffer are allocated with
kvmalloc() in vicodec_start_streaming(), and the decoder can read them
before they have been written. The first frame is allowed to be a P-frame,
in which case it is decoded against a reference frame that was never
produced, and the padding rows below the visible area are never written
for any frame.

Use kvzalloc() for both allocations.

Fixes: 256bf813ba39 ("media: vicodec: add the virtual codec driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index cdc3af33b4bbe1..841dc03d0edd20 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -1606,9 +1606,9 @@ static int vicodec_start_streaming(struct vb2_queue *q,
 	}
 	state->ref_stride = q_data->coded_width * info->luma_alpha_step;
 
-	state->ref_frame.buf = kvmalloc(total_planes_size, GFP_KERNEL);
+	state->ref_frame.buf = kvzalloc(total_planes_size, GFP_KERNEL);
 	state->ref_frame.luma = state->ref_frame.buf;
-	new_comp_frame = kvmalloc(ctx->comp_max_size, GFP_KERNEL);
+	new_comp_frame = kvzalloc(ctx->comp_max_size, GFP_KERNEL);
 
 	if (!state->ref_frame.luma || !new_comp_frame) {
 		kvfree(state->ref_frame.luma);

From f3e35f116d69875a5d1e6615acb16bad47bf0061 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 29 Aug 2026 05:58:21 +0200
Subject: [PATCH 1132/1982] crypto: atmel-tdes - zero-initialize device state

[ Upstream commit dbe70508d507acd677e67eaf029040f5e3a3b2b3 ]

Commit c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of
kzalloc") accidentally replaced kzalloc() with devm_kmalloc(), so the
device state is no longer zeroed.

atmel_tdes_hw_init() tests dd->flags during probe: a stale TDES_FLAGS_INIT
skips the hardware reset, and a stale TDES_FLAGS_BUSY makes
atmel_tdes_handle_queue() treat the engine as permanently busy, leaving
every request queued and never dispatched.

Seen on a SAM9X75 Curiosity: the first TDES request after boot never
completes and the TDES interrupt count stays at zero, while the AES and
SHA engines on the same SoC work normally.

Switch to devm_kzalloc(), matching the Atmel AES and SHA drivers.

Fixes: c659d07f11a3 ("crypto: atmel-tdes - Switch to managed version of kzalloc")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/atmel-tdes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index d380f6741a2c5a..72e91e0bb1b476 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -945,7 +945,7 @@ static int atmel_tdes_probe(struct platform_device *pdev)
 	struct resource *tdes_res;
 	int err;
 
-	tdes_dd = devm_kmalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
+	tdes_dd = devm_kzalloc(&pdev->dev, sizeof(*tdes_dd), GFP_KERNEL);
 	if (!tdes_dd)
 		return -ENOMEM;
 

From 05c0ae1f3d3cd158f55fffcc5a78f75eea37a5ca Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 29 Aug 2026 06:26:04 +0200
Subject: [PATCH 1133/1982] crypto: atmel-aes - fix AADLENR for standalone
 GHASH

[ Upstream commit 0dd8cded0e6f8c9635fe1d79d60dc7b2599b099b ]

atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
to AES_AADLENR.  But the GHASH it runs hashes the dd->datalen bytes passed
in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
The data sheet requires AES_AADLENR to hold the length of that input.

With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
wrong.  Later requests only pass because dd->total still holds the
previous request's length.

This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
fails at boot:

  alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
  vector 0, cfg="in-place (one sglist)"

Without selftests the broken atmel-gcm-aes is preferred at priority 300.
Seen on a SAM9X75 Curiosity with 6.18 and current mainline.

Write dd->datalen instead.

Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/atmel-aes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index b393689400b4c1..e057be7fc71304 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -1272,7 +1272,7 @@ static int atmel_aes_gcm_ghash_init(struct atmel_aes_dev *dd)
 	struct atmel_aes_gcm_ctx *ctx = atmel_aes_gcm_ctx_cast(dd->ctx);
 
 	/* Set the data length. */
-	atmel_aes_write(dd, AES_AADLENR, dd->total);
+	atmel_aes_write(dd, AES_AADLENR, dd->datalen);
 	atmel_aes_write(dd, AES_CLENR, 0);
 
 	/* If needed, overwrite the GCM Intermediate Hash Word Registers */

From a7c9d73df0489afb3b92a23ea326189237d5df67 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 29 Aug 2026 11:18:49 +0200
Subject: [PATCH 1134/1982] lib/842: reject output overflows from index and
 short data

[ Upstream commit 38ed7182f3491ec1449ff246551e11ad82adba45 ]

The output length passed to sw842_decompress() is the caller's buffer
capacity. Indexed copies write 2, 4 or 8 bytes and short-data templates
write up to 7, but neither checks that capacity before writing and
decrementing p->olen.

Overwriting an undersized destination then underflows p->olen, which is
unsigned, so every later bounds check in the stream passes. Subsequent
operations keep writing past the destination, and a matching CRC lets
sw842_decompress() return success with an output length larger than the
capacity the caller supplied.

This is reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
made a KASAN kernel report vmalloc-out-of-bounds writes in __do_index() and
sw842_decompress() when zram read the page back.

Check the remaining output before both operations and return -ENOSPC,
matching the other output-producing templates.

Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/842/842_decompress.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 582085ef8b49c0..87d1e0f8a49265 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -165,6 +165,9 @@ static int __do_index(struct sw842_param *p, u8 size, u8 bits, u64 fsize)
 	u64 index, offset, total = round_down(p->out - p->ostart, 8);
 	int ret;
 
+	if (size > p->olen)
+		return -ENOSPC;
+
 	ret = next_bits(p, &index, bits);
 	if (ret)
 		return ret;
@@ -344,6 +347,8 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
 
 			if (!bytes || bytes > SHORT_DATA_BITS_MAX)
 				return -EINVAL;
+			if (bytes > p.olen)
+				return -ENOSPC;
 
 			while (bytes-- > 0) {
 				ret = next_bits(&p, &tmp, 8);

From ec3bb0b9bb79787d47292544bec1b9f0ab814942 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 29 Aug 2026 11:18:50 +0200
Subject: [PATCH 1135/1982] lib/842: require a complete history block for
 repeat templates

[ Upstream commit deb631649882bbf43f7c2fc79b5990139fd744ba ]

An 842 repeat template copies the preceding eight-byte output block. The
decoder rejects a repeat only when no output has been produced. A
short-data operation can produce between one and seven bytes before a
repeat.

Such a stream makes the repeat copy read before the start of the output
buffer. Depending on the surrounding mapping, this can fault or bring
preceding memory into the decompressed data.

This is also reachable through zram's compressed writeback path. With 842
selected, targeted corruption of the compressed data on its backing device
to a short-data-then-repeat stream made a KASAN kernel report a
vmalloc-out-of-bounds read when zram read the page back.

Require at least one complete output block before accepting a repeat.

Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/842/842_decompress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 87d1e0f8a49265..45a9815abd637f 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -309,7 +309,7 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
 			if (ret)
 				return ret;
 
-			if (p.out == out) /* no previous bytes */
+			if (p.out - p.ostart < 8) /* no complete previous block */
 				return -EINVAL;
 
 			/* copy rep + 1 */

From a1bcadec1debdbdb43b1cc84e11e8d6ee2bc8a0d Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Sun, 30 Aug 2026 09:51:04 +0800
Subject: [PATCH 1136/1982] crypto: ccp - Initialize DBC ioctl mutex before
 registering device

[ Upstream commit e9b1d168f2a70c0764d5748893fdf631c504c171 ]

dbc_dev_init() registers the DBC misc device before initializing
ioctl_mutex. Once misc_register() publishes the device, userspace can
open it and invoke dbc_ioctl() while the mutex is still uninitialized.

Initialize ioctl_mutex before calling misc_register() so the published
ioctl callback always sees an initialized mutex.

Fixes: c04cf9e14f10 ("crypto: ccp - Add support for fetching a nonce for dynamic boost control")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260829133410.1708684-1-runyu.xiao@seu.edu.cn/
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Assisted-by: Codex:GPT-5
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/dbc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/ccp/dbc.c b/drivers/crypto/ccp/dbc.c
index 410084a9039c98..4db49a14550c97 100644
--- a/drivers/crypto/ccp/dbc.c
+++ b/drivers/crypto/ccp/dbc.c
@@ -236,6 +236,8 @@ int dbc_dev_init(struct psp_device *psp)
 		goto cleanup_mbox;
 	}
 
+	mutex_init(&dbc_dev->ioctl_mutex);
+
 	dbc_dev->char_dev.minor = MISC_DYNAMIC_MINOR;
 	dbc_dev->char_dev.name = "dbc";
 	dbc_dev->char_dev.fops = &dbc_fops;
@@ -244,8 +246,6 @@ int dbc_dev_init(struct psp_device *psp)
 	if (ret)
 		goto cleanup_mbox;
 
-	mutex_init(&dbc_dev->ioctl_mutex);
-
 	return 0;
 
 cleanup_mbox:

From 58492634b0438c183df97b8a70bc66d2a74b6781 Mon Sep 17 00:00:00 2001
From: Bradley Morgan <include@grrlz.net>
Date: Thu, 13 Aug 2026 07:43:43 +0000
Subject: [PATCH 1137/1982] PM: CPU: Restore synchronize_rcu() to
 cpu_pm_unregister_notifier()

[ Upstream commit 61f7eee7d4664079fbce821576891c3ee5ccf597 ]

cpu_pm_notify() walks the notifier chain lockless under only
rcu_read_lock(). That only works if a removed notifier block is not
freed until every concurrent walker is done with it.

The chain used to be an atomic_notifier, whose unregister ends in
synchronize_rcu(). Commit b2f6662ac08d ("PM: cpu: Make notifier chain
use a raw_spinlock_t") switched it over to a raw_notifier, and in
doing so replaced that with raw_notifier_chain_unregister(), which
does not synchronize. The grace period quietly went away, so a driver
that frees the memory holding its notifier block right after
cpu_pm_unregister_notifier() returns can race with a concurrent
walker:

  cpu1 (idle exit)                  cpu2 (driver remove)
  ----------------                  --------------------
  cpu_pm_notify(CPU_PM_EXIT)
    rcu_read_lock()
    nb = rcu_dereference_raw(*nl)
                                    cpu_pm_unregister_notifier(&od->nb)
                                      unlink, no grace period
                                      remove() frees od (devm)
    nb->notifier_call(nb, ...)
      /* use after free */

The rcu_read_lock() on cpu1 does not stop cpu2 from freeing the
block, and nothing else does. The read side is the idle exit path,
so this can hit on any system where a driver with a cpu_pm notifier
gets unbound.

Add the grace period back. It is only needed when a notifier was
actually removed, so wait on success and return -ENOENT without
waiting otherwise. The kerneldoc gets back the "may sleep" note that
the same commit dropped.

Fixes: b2f6662ac08d ("PM: cpu: Make notifier chain use a raw_spinlock_t")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Bradley Morgan <include@grrlz.net>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260813074343.26460-3-include@grrlz.net
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cpu_pm.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
index 7481fbb947d32e..a2a598ad6e6d50 100644
--- a/kernel/cpu_pm.c
+++ b/kernel/cpu_pm.c
@@ -10,6 +10,7 @@
 #include <linux/cpu_pm.h>
 #include <linux/module.h>
 #include <linux/notifier.h>
+#include <linux/rcupdate.h>
 #include <linux/spinlock.h>
 #include <linux/syscore_ops.h>
 
@@ -76,7 +77,8 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
  *
  * Remove a driver from the CPU PM notifier list.
  *
- * This function has the same return conditions as raw_notifier_chain_unregister.
+ * This function may sleep, and has the same return conditions as
+ * raw_notifier_chain_unregister.
  */
 int cpu_pm_unregister_notifier(struct notifier_block *nb)
 {
@@ -86,6 +88,11 @@ int cpu_pm_unregister_notifier(struct notifier_block *nb)
 	raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
 	ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb);
 	raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+
+	/* Wait for the rcu_read_lock() walkers in cpu_pm_notify(). */
+	if (!ret)
+		synchronize_rcu();
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);

From dc4724be77c93c2d067aad80525437979c662832 Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Thu, 11 Jun 2026 14:21:10 -0700
Subject: [PATCH 1138/1982] affs: validate blocks before freeing them

[ Upstream commit 78ea2058abf3ee053c0bd9c1b9a77304cb4ae58b ]

affs_free_block() accepts block numbers from on-disk file block tables
when truncating or unlinking files. The function currently rejects only
block numbers greater than s_partition_size before subtracting
s_reserved and using the result to index the in-memory bitmap descriptor
array.

That check still accepts reserved blocks and the one-past-end block at
s_partition_size. A crafted image can therefore make the subtraction
underflow or make the computed bitmap index equal to s_bmap_count,
leading to an out-of-bounds access on s_bitmap before the bitmap block is
read and updated.

Use the existing AFFS block validity helper so freeing uses the same
range as block reads and writes: s_reserved <= block < s_partition_size.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/affs/bitmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/affs/bitmap.c b/fs/affs/bitmap.c
index 5ba9ef2742f6ee..f400b28eea28d6 100644
--- a/fs/affs/bitmap.c
+++ b/fs/affs/bitmap.c
@@ -46,7 +46,7 @@ affs_free_block(struct super_block *sb, u32 block)
 
 	pr_debug("%s(%u)\n", __func__, block);
 
-	if (block > sbi->s_partition_size)
+	if (!affs_validblock(sb, block))
 		goto err_range;
 
 	blk     = block - sbi->s_reserved;

From 1af45c0daaff688e1bcd276ad04752521a713d14 Mon Sep 17 00:00:00 2001
From: Matthew Sakai <msakai@redhat.com>
Date: Tue, 11 Aug 2026 15:02:33 -0400
Subject: [PATCH 1139/1982] dm vdo indexer: prevent delta list overflow on load

[ Upstream commit 936293c9f3f4f2a0d1b80df9332e96c552ac3b37 ]

Check for corrupted delta lists sizes that overflow the
memory available for the delta_lists. An overflow can
cause the delta list data to be written outside the
reserved delta memory space.

Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-vdo/indexer/delta-index.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-vdo/indexer/delta-index.c b/drivers/md/dm-vdo/indexer/delta-index.c
index 0ac2443f0df363..a42de1af4b6935 100644
--- a/drivers/md/dm-vdo/indexer/delta-index.c
+++ b/drivers/md/dm-vdo/indexer/delta-index.c
@@ -803,7 +803,7 @@ static void compute_new_list_offsets(struct delta_zone *delta_zone, u32 growing_
 		(delta_zone->size * BITS_PER_BYTE - delta_lists[tail_guard_index].size);
 }
 
-static void rebalance_lists(struct delta_zone *delta_zone)
+static int rebalance_lists(struct delta_zone *delta_zone)
 {
 	struct delta_list *delta_lists;
 	u32 i;
@@ -814,9 +814,17 @@ static void rebalance_lists(struct delta_zone *delta_zone)
 	for (i = 0; i <= delta_zone->list_count + 1; i++)
 		used_space += get_delta_list_byte_size(&delta_lists[i]);
 
+	if (delta_zone->size < used_space) {
+		return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+						"delta zone lists overflow zone size %zu",
+						delta_zone->size);
+	}
+
 	compute_new_list_offsets(delta_zone, 0, 0, used_space);
 	for (i = 1; i <= delta_zone->list_count + 1; i++)
 		delta_lists[i].start = delta_zone->new_offsets[i];
+
+	return UDS_SUCCESS;
 }
 
 /* Start restoring a delta index from multiple input streams. */
@@ -944,8 +952,11 @@ int uds_start_restoring_delta_index(struct delta_index *delta_index,
 	}
 
 	/* Prepare each zone to start receiving the delta list data. */
-	for (z = 0; z < delta_index->zone_count; z++)
-		rebalance_lists(&delta_index->delta_zones[z]);
+	for (z = 0; z < delta_index->zone_count; z++) {
+		result = rebalance_lists(&delta_index->delta_zones[z]);
+		if (result != UDS_SUCCESS)
+			return result;
+	}
 
 	return UDS_SUCCESS;
 }

From 9e6fc70c7ad4fa8dcc912e1b4fd4220bbca19c27 Mon Sep 17 00:00:00 2001
From: Matthew Sakai <msakai@redhat.com>
Date: Tue, 11 Aug 2026 15:02:34 -0400
Subject: [PATCH 1140/1982] dm vdo indexer: validate record page numbers better

[ Upstream commit e3683a76a313a81f3f7bc7f65e4fc1e61232838b ]

Move the record_page_number validation check into the
chapter index lookup function in order to detect (and
discard) corrupted values on all paths.

Signed-off-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-vdo/indexer/chapter-index.c | 15 +++++++++++----
 drivers/md/dm-vdo/indexer/volume.c        |  6 ------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/md/dm-vdo/indexer/chapter-index.c b/drivers/md/dm-vdo/indexer/chapter-index.c
index fb1db41c794b33..7a744b2da28f9e 100644
--- a/drivers/md/dm-vdo/indexer/chapter-index.c
+++ b/drivers/md/dm-vdo/indexer/chapter-index.c
@@ -284,10 +284,17 @@ int uds_search_chapter_index_page(struct delta_index_page *index_page,
 	if (result != UDS_SUCCESS)
 		return result;
 
-	if (was_entry_found(&entry, address))
-		*record_page_ptr = uds_get_delta_entry_value(&entry);
-	else
+	if (!was_entry_found(&entry, address)) {
 		*record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+		return UDS_SUCCESS;
+	}
 
-	return UDS_SUCCESS;
+	*record_page_ptr = uds_get_delta_entry_value(&entry);
+	result = VDO_ASSERT(*record_page_ptr < geometry->record_pages_per_chapter,
+			    "0 <= %d < %u", *record_page_ptr,
+			    geometry->record_pages_per_chapter);
+	if (result != VDO_SUCCESS)
+		*record_page_ptr = NO_CHAPTER_INDEX_ENTRY;
+
+	return result;
 }
diff --git a/drivers/md/dm-vdo/indexer/volume.c b/drivers/md/dm-vdo/indexer/volume.c
index 425b3a74f4dbae..f7de78e0d0dbd1 100644
--- a/drivers/md/dm-vdo/indexer/volume.c
+++ b/drivers/md/dm-vdo/indexer/volume.c
@@ -891,12 +891,6 @@ int uds_search_cached_record_page(struct volume *volume, struct uds_request *req
 	if (record_page_number == NO_CHAPTER_INDEX_ENTRY)
 		return UDS_SUCCESS;
 
-	result = VDO_ASSERT(record_page_number < geometry->record_pages_per_chapter,
-			    "0 <= %d < %u", record_page_number,
-			    geometry->record_pages_per_chapter);
-	if (result != VDO_SUCCESS)
-		return result;
-
 	page_number = geometry->index_pages_per_chapter + record_page_number;
 
 	physical_page = map_to_physical_page(volume->geometry, chapter, page_number);

From 241fcc1d7f9868992510a41fb0427c593440805c Mon Sep 17 00:00:00 2001
From: Jiucheng Xu <jiucheng.xu@amlogic.com>
Date: Mon, 7 Sep 2026 19:35:42 +0800
Subject: [PATCH 1141/1982] f2fs: force out-place update for all writes on
 compressed file

[ Upstream commit a64a3fec11e77a3a0dc0009bdc58b925e45a1bb4 ]

For compressed file, compressed write may fail and fall back to raw
write.

-Thread A                                         - Thread B
  - f2fs_write_multi_pages                          - f2fs_down_write(&sbi->cp_rwsem);
   - f2fs_write_compressed_pages                    - ...
    - f2fs_trylock_op                               - ...
     - f2fs_down_read_trylock(&sbi->cp_rwsem);      - ...
   - f2fs_write_raw_pages                           - ...

Thread B acquires the lock first, which causes Thread A to fail lock
acquisition and fall back to raw-data write.
IPU_FORCE is enabled on small-capacity storage devices (< 16GB),
so f2fs_write_raw_pages() overwrites the original compressed data
in-place.

The in-memory node has been updated with raw-data addresses, while the
node metadata stored on eMMC still remains in compressed state.
If a power-cut occurs before the node is flushed to disk, on-disk
inconsistency arises: disk data is raw, yet metadata treats it as a
compressed cluster, leading to decompression failure.

To eliminate this risk completely, force out-place update for all
write operations on compressed file.

Cc: stable@kernel.org
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 3455565b82451a..aa6a844ed34dd7 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2675,10 +2675,12 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
 		return true;
 	if (f2fs_used_in_atomic_write(inode))
 		return true;
-	/* rewrite low ratio compress data w/ OPU mode to avoid fragmentation */
-	if (f2fs_compressed_file(inode) &&
-		F2FS_OPTION(sbi).compress_mode == COMPR_MODE_USER &&
-		is_inode_flag_set(inode, FI_ENABLE_COMPRESS))
+	/*
+	 * rewrite low ratio compress data w/ OPU mode to avoid fragmentation.
+	 * If IO comes from compressed write path and fallback to raw write,
+	 * force out‑place to prevent metadata‑data inconsistency.
+	 */
+	if (f2fs_compressed_file(inode))
 		return true;
 
 	/* swap file is migrating in aligned write mode */

From c0d77acef537dd3f0b1dcf94c9d0a265936d4ba6 Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Thu, 10 Sep 2026 22:11:26 +0800
Subject: [PATCH 1142/1982] f2fs: compress: fix to handle race between truncate
 and writeback

[ Upstream commit c0337e331b065074ce20e4258a578e07dd7e4083 ]

fsstress reports a kernel BUG in f2fs_truncate_partial_cluster():

kernel BUG at fs/f2fs/compress.c:1238!
RIP: 0010:f2fs_truncate_partial_cluster+0x292/0x2a0
Call Trace:
 <TASK>
 f2fs_truncate+0xf6/0x210
 f2fs_setattr+0x6b7/0x770
 notify_change+0x33b/0x520
 do_truncate+0xc2/0xf0
 vfs_truncate+0x153/0x1d0
 ksys_truncate+0x78/0xd0
 __x64_sys_truncate+0x16/0x20
 do_syscall_64+0xbe/0x540

The root cause is that Thread A (truncate) and Thread B (background
writeback or fsync) can race as follows:

Thread A                             Thread B
- f2fs_setattr
 - f2fs_truncate
  - f2fs_truncate_blocks
   - f2fs_truncate_partial_cluster
    - f2fs_is_compressed_cluster
      return 1
                                     - f2fs_write_cache_pages
                                      - f2fs_write_multi_pages
                                       - f2fs_write_raw_pages
                                        - f2fs_write_single_data_page
                                          dn.data_blkaddr != COMPRESS_ADDR
                                          (cluster converted to normal)
    - f2fs_prepare_compress_overwrite
     - f2fs_is_compressed_cluster
       return 0
     - return 0
    - f2fs_bug_on(sbi, err == 0): BUG!

Writeback path does not acquire i_gc_rwsem or filemap_invalidate_lock.
When a compressed cluster fails compression during writeback, it is
overwritten with raw data blocks. If Thread A checked
f2fs_is_compressed_cluster() before the conversion, but calls
f2fs_prepare_compress_overwrite() after the conversion,
f2fs_prepare_compress_overwrite() returns 0 because the cluster is no
longer a compressed cluster.

To fix this, remove the f2fs_bug_on() and retry checking the cluster status
when f2fs_prepare_compress_overwrite() returns 0, so that it can fall back
to f2fs_do_truncate_blocks() to handle it as a normal cluster.

Cc: stable@kernel.org
Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/compress.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 0399db98fccfc3..8fea48dc50bad7 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1219,6 +1219,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
 	int i;
 	int err;
 
+repeat:
 	err = f2fs_is_compressed_cluster(inode, start_idx);
 	if (err < 0)
 		return err;
@@ -1230,12 +1231,11 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
 	/* truncate compressed cluster */
 	err = f2fs_prepare_compress_overwrite(inode, &pagep,
 						start_idx, &fsdata);
-
-	/* should not be a normal cluster */
-	f2fs_bug_on(F2FS_I_SB(inode), err == 0);
-
-	if (err <= 0)
+	if (err < 0)
 		return err;
+	else if (err == 0)
+		/* the cluster became non-compressed one due to race case */
+		goto repeat;
 
 	rpages = fsdata;
 

From 225230b9069823324b3ff5cac2784caa7ba4c75f Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Tue, 15 Sep 2026 10:41:27 +0200
Subject: [PATCH 1143/1982] ata: ahci_st: Do not ignore errors when getting the
 reset controls

[ Upstream commit c74ee9230a8d1d2f6fcbceff55f56f7dd9b9cccd ]

st_ahci_probe_resets() treats any error from devm_reset_control_get() as
"reset control not defined" and continues with a NULL reset control:

	drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
	if (IS_ERR(drv_data->pwr)) {
		dev_info(dev, "power reset control not defined\n");
		drv_data->pwr = NULL;
	}

This also swallows -EPROBE_DEFER, which is returned when the reset
controller providing the reset has not been probed yet. probe() then
continues as if the device tree did not specify any reset, so the resets
of the SATA IP are never deasserted, and st_ahci_configure_oob() and
ahci_platform_init_host() access the MMIO of an IP which is still held in
reset and powered down, which can result in an external abort.

The resets are optional in the binding, as they are not part of its
required properties, so use devm_reset_control_get_optional(), which
returns NULL if the reset is not specified in the device tree, and
propagate all other errors.

Note that an absent reset is now indicated by a NULL reset control
instead of an error, so the "reset control not defined" messages are
dropped.

Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-9-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/ahci_st.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 4336c8a6e20871..819269a022efd5 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -104,23 +104,20 @@ static int st_ahci_probe_resets(struct ahci_host_priv *hpriv,
 {
 	struct st_ahci_drv_data *drv_data = hpriv->plat_data;
 
-	drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
-	if (IS_ERR(drv_data->pwr)) {
-		dev_info(dev, "power reset control not defined\n");
-		drv_data->pwr = NULL;
-	}
-
-	drv_data->sw_rst = devm_reset_control_get(dev, "sw-rst");
-	if (IS_ERR(drv_data->sw_rst)) {
-		dev_info(dev, "soft reset control not defined\n");
-		drv_data->sw_rst = NULL;
-	}
-
-	drv_data->pwr_rst = devm_reset_control_get(dev, "pwr-rst");
-	if (IS_ERR(drv_data->pwr_rst)) {
-		dev_dbg(dev, "power soft reset control not defined\n");
-		drv_data->pwr_rst = NULL;
-	}
+	drv_data->pwr = devm_reset_control_get_optional(dev, "pwr-dwn");
+	if (IS_ERR(drv_data->pwr))
+		return dev_err_probe(dev, PTR_ERR(drv_data->pwr),
+				     "failed to get pwr-dwn reset\n");
+
+	drv_data->sw_rst = devm_reset_control_get_optional(dev, "sw-rst");
+	if (IS_ERR(drv_data->sw_rst))
+		return dev_err_probe(dev, PTR_ERR(drv_data->sw_rst),
+				     "failed to get sw-rst reset\n");
+
+	drv_data->pwr_rst = devm_reset_control_get_optional(dev, "pwr-rst");
+	if (IS_ERR(drv_data->pwr_rst))
+		return dev_err_probe(dev, PTR_ERR(drv_data->pwr_rst),
+				     "failed to get pwr-rst reset\n");
 
 	return st_ahci_deassert_resets(hpriv, dev);
 }

From 9135a4ba98db1d3d0d326dca84eb0faf914642bf Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Tue, 15 Sep 2026 10:41:28 +0200
Subject: [PATCH 1144/1982] ata: ahci_st: Assert the power down reset in the
 probe() error path

[ Upstream commit 91e0a7452d7a81e924a499b23f30f3bf85fddbd2 ]

st_ahci_probe_resets() deasserts the "pwr-dwn" reset, but the probe()
error path of st_ahci_probe() only releases the host resources, so the
SATA IP is left powered up when probe() fails after
st_ahci_probe_resets() has succeeded, e.g. when
ahci_platform_enable_resources() fails.

The reset is asserted by st_ahci_host_stop(), however ->host_stop() is
only called through the ata_host_stop() devres action registered by
ata_host_start(), so it does not cover any failure happening before the
host has been started.

Factor the assert out into st_ahci_assert_pwrdwn() and call it when
either ahci_platform_enable_resources() or ahci_platform_init_host()
fails. The "pwr-dwn" reset control is an exclusive one, so asserting it
once more from st_ahci_host_stop() is harmless.

No functional change intended for ->host_stop() and st_ahci_suspend().

Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-10-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/ahci_st.c | 51 +++++++++++++++++++++++++------------------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/drivers/ata/ahci_st.c b/drivers/ata/ahci_st.c
index 819269a022efd5..eea75961038cfb 100644
--- a/drivers/ata/ahci_st.c
+++ b/drivers/ata/ahci_st.c
@@ -83,18 +83,27 @@ static int st_ahci_deassert_resets(struct ahci_host_priv *hpriv,
 	return 0;
 }
 
-static void st_ahci_host_stop(struct ata_host *host)
+static int st_ahci_assert_pwrdwn(struct ahci_host_priv *hpriv,
+				 struct device *dev)
 {
-	struct ahci_host_priv *hpriv = host->private_data;
 	struct st_ahci_drv_data *drv_data = hpriv->plat_data;
-	struct device *dev = host->dev;
 	int err;
 
-	if (drv_data->pwr) {
-		err = reset_control_assert(drv_data->pwr);
-		if (err)
-			dev_err(dev, "unable to pwrdwn\n");
-	}
+	if (!drv_data->pwr)
+		return 0;
+
+	err = reset_control_assert(drv_data->pwr);
+	if (err)
+		dev_err(dev, "unable to pwrdwn\n");
+
+	return err;
+}
+
+static void st_ahci_host_stop(struct ata_host *host)
+{
+	struct ahci_host_priv *hpriv = host->private_data;
+
+	st_ahci_assert_pwrdwn(hpriv, host->dev);
 
 	ahci_platform_disable_resources(hpriv);
 }
@@ -159,38 +168,38 @@ static int st_ahci_probe(struct platform_device *pdev)
 
 	err = ahci_platform_enable_resources(hpriv);
 	if (err)
-		return err;
+		goto assert_pwrdwn;
 
 	st_ahci_configure_oob(hpriv->mmio);
 
 	err = ahci_platform_init_host(pdev, hpriv, &st_ahci_port_info,
 				      &ahci_platform_sht);
-	if (err) {
-		ahci_platform_disable_resources(hpriv);
-		return err;
-	}
+	if (err)
+		goto disable_resources;
 
 	return 0;
+
+disable_resources:
+	ahci_platform_disable_resources(hpriv);
+assert_pwrdwn:
+	st_ahci_assert_pwrdwn(hpriv, &pdev->dev);
+
+	return err;
 }
 
 static int st_ahci_suspend(struct device *dev)
 {
 	struct ata_host *host = dev_get_drvdata(dev);
 	struct ahci_host_priv *hpriv = host->private_data;
-	struct st_ahci_drv_data *drv_data = hpriv->plat_data;
 	int err;
 
 	err = ahci_platform_suspend_host(dev);
 	if (err)
 		return err;
 
-	if (drv_data->pwr) {
-		err = reset_control_assert(drv_data->pwr);
-		if (err) {
-			dev_err(dev, "unable to pwrdwn");
-			return err;
-		}
-	}
+	err = st_ahci_assert_pwrdwn(hpriv, dev);
+	if (err)
+		return err;
 
 	ahci_platform_disable_resources(hpriv);
 

From 6fe2e3756522e0a505fdd87016f5ab739b86e32d Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Tue, 15 Sep 2026 10:41:30 +0200
Subject: [PATCH 1145/1982] ata: libahci: Free the IRQs when activating a
 multi-IRQ host fails

[ Upstream commit 34a4a34431ed81d85d14f8fb8035e5a25214ad39 ]

ahci_host_activate_multi_irqs() requests one IRQ per port, but it does
not free them when requesting one of them, or when registering the host,
fails. The IRQs are only freed by the driver core, when it releases the
devres of the device after probe() has returned, while the caller of
ahci_host_activate() releases the resources of the host in its probe()
error path, e.g. ahci_probe() disables the clocks, regulators, resets and
PHYs of the host. An IRQ handler running in that window would access the
MMIO of a host which is no longer clocked.

ahci_host_activate_multi_irqs() did free the IRQs until commit
0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs"), which
removed the explicit free because devm makes it unnecessary. That is true
for freeing the IRQs as such, but not for the window described above:
devres is only released after probe() has returned, i.e. after the error
path of the caller has released the resources of the host.

Note that this window cannot be hit with the current users: the only user
of AHCI_HFLAG_MULTI_MSI is the AHCI PCI driver, which does not release
any resource in its probe() error path, and the ports of the host are
still frozen, i.e. their interrupts are masked, when ata_host_register()
fails.

Free the IRQs explicitly again, like ata_host_activate() does, so that
the IRQ handlers cannot run once ahci_host_activate() has failed.

Fixes: 0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-12-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci.c | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index ecb56bb50fd7cb..510516c75a5a25 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2739,11 +2739,33 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
 				0, pp->irq_desc, host->ports[i]);
 
 		if (rc)
-			return rc;
+			goto free_irqs;
 		ata_port_desc_misc(host->ports[i], irq);
 	}
 
-	return ata_host_register(host, sht);
+	rc = ata_host_register(host, sht);
+	if (rc)
+		goto free_irqs;
+
+	return 0;
+
+free_irqs:
+	/*
+	 * Free the IRQs which have been requested, so that the handlers can no
+	 * longer access the MMIO of the host once we return, e.g. after the
+	 * caller has disabled the clocks of the host.
+	 */
+	while (--i >= 0) {
+		struct ahci_port_priv *pp = host->ports[i]->private_data;
+
+		if (!pp)
+			continue;
+
+		devm_free_irq(host->dev, hpriv->get_irq_vector(host, i),
+			      host->ports[i]);
+	}
+
+	return rc;
 }
 
 /**

From 1b2d819c09f0bea5cff5c53ff7dcb4df47da6efd Mon Sep 17 00:00:00 2001
From: Niklas Cassel <cassel@kernel.org>
Date: Tue, 15 Sep 2026 10:41:31 +0200
Subject: [PATCH 1146/1982] ata: libata: Do not leave ata_host_stop()
 registered when activation fails

[ Upstream commit d2f977008cbbae195df678ee1e70e5802f9bd0b8 ]

ata_host_start() registers ata_host_stop() as a devres action as soon as
it has succeeded, which hands the release of the host resources over to
devres: ->port_stop() and ->host_stop() are then called by the driver
core when probe() fails.

ata_host_activate() and ahci_host_activate_multi_irqs() can both fail
after ata_host_start() has succeeded, e.g. if devm_request_irq() or
ata_host_register() fails, and they return the error with the devres
action still registered. A driver which releases the host resources in
its probe() error path therefore releases them twice: once itself and
once through ->host_stop().

All ahci-platform drivers are in that situation, e.g. ahci_probe() calls
ahci_platform_disable_resources() while ahci_host_stop() does the same
through devres. This gives refcount underflow warnings from the clk,
regulator and phy cores and, for shared resources, can disable resources
which are still in use by other devices.

Add ata_host_undo_start(), which stops the ports and drops the devres
action without calling ->host_stop(), and call it from both activation
helpers when they fail. Releasing the host resources on failure is then
always left to the caller, which is what all callers having a probe()
error path already assume.

This changes the semantics for the drivers which implement ->host_stop()
while also completely lacking error handling for the activate host call.
Add activate host error handling for sata_qstor and sata_fsl. For
sata_fsl this also means that hcr_base and host_priv are now released
when activating the host fails, which ->host_stop() did not do when
ata_host_start() itself failed.

Note that ata_pci_sff_activate_host() is deliberately left as is: none of
its callers releases the host resources in its probe() error path, they
all rely on ->host_stop() being called by devres, including
ata_pci_init_one(), which releases the devres group of the host itself.

Fixes: 1896b15eddb4 ("ahci_platform: perform platform exit in host_stop() hook")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-13-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci.c          |  2 +
 drivers/ata/libahci_platform.c |  4 ++
 drivers/ata/libata-core.c      | 75 +++++++++++++++++++++++++++++++---
 drivers/ata/libata-sff.c       |  5 +++
 drivers/ata/sata_fsl.c         |  6 ++-
 drivers/ata/sata_qstor.c       |  8 +++-
 include/linux/libata.h         |  1 +
 7 files changed, 91 insertions(+), 10 deletions(-)

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 510516c75a5a25..50b2c997b6bad4 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2765,6 +2765,8 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
 			      host->ports[i]);
 	}
 
+	ata_host_undo_start(host);
+
 	return rc;
 }
 
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 7308d48cf748b0..7703c22ef532dc 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -692,6 +692,10 @@ EXPORT_SYMBOL_GPL(ahci_platform_get_resources);
  * ahci-platform host, note any necessary resources (ie clks, phys, etc.)
  * must be initialized / enabled before calling this.
  *
+ * On failure, ->host_stop() is not called, so the caller has to release the
+ * resources it enabled (clocks, regulators, resets, PHYs) in its probe()
+ * error path.
+ *
  * RETURNS:
  * 0 on success otherwise a negative error code
  */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cd9c96560ddd3c..cb74c6a5d9aa13 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5976,6 +5976,46 @@ int ata_host_start(struct ata_host *host)
 }
 EXPORT_SYMBOL_GPL(ata_host_start);
 
+/**
+ *	ata_host_undo_start - undo ata_host_start()
+ *	@host: ATA host to undo_start
+ *
+ *	Stop the ports of @host and drop the devres action registered by
+ *	ata_host_start(), without calling ->host_stop().  Nothing is done if
+ *	@host has not been started.
+ *
+ *	This gives the release of the host resources back to the caller, which
+ *	is what a driver whose probe() error path releases those resources
+ *	itself needs when starting or activating the host fails.
+ *
+ *	LOCKING:
+ *	Inherited from calling layer (may sleep).
+ */
+void ata_host_undo_start(struct ata_host *host)
+{
+	int i;
+
+	if (!(host->flags & ATA_HOST_STARTED))
+		return;
+
+	for (i = 0; i < host->n_ports; i++) {
+		struct ata_port *ap = host->ports[i];
+
+		if (ap->ops->port_stop)
+			ap->ops->port_stop(ap);
+	}
+
+	/*
+	 * Drop the action added by ata_host_start() without calling it.
+	 * It does not exist if neither ->port_stop() nor ->host_stop() is
+	 * implemented, in which case there is nothing to drop.
+	 */
+	devres_destroy(host->dev, ata_host_stop, NULL, NULL);
+
+	host->flags &= ~ATA_HOST_STARTED;
+}
+EXPORT_SYMBOL_GPL(ata_host_undo_start);
+
 /**
  *	ata_host_init - Initialize a host struct for sas (ipr, libsas)
  *	@host:	host to initialize
@@ -6048,6 +6088,12 @@ static void async_port_probe(void *data, async_cookie_t cookie)
  *	starts ports, registers @host with ATA and SCSI layers and
  *	probe registered devices.
  *
+ *	On failure, the host remains started, i.e. the devres action
+ *	registered by ata_host_start() is kept, so ->host_stop() is called by
+ *	the driver core when probe() fails.  A caller which releases the host
+ *	resources in its own probe() error path must therefore call
+ *	ata_host_undo_start().
+ *
  *	LOCKING:
  *	Inherited from calling layer (may sleep).
  *
@@ -6141,6 +6187,10 @@ EXPORT_SYMBOL_GPL(ata_host_register);
  *	have set polling mode on the port. In this case, @irq_handler
  *	should be NULL.
  *
+ *	On failure, the ports are stopped again and the devres action
+ *	registered by ata_host_start() is dropped without calling
+ *	->host_stop(), so releasing the host resources is left to the caller.
+ *
  *	LOCKING:
  *	Inherited from calling layer (may sleep).
  *
@@ -6161,27 +6211,40 @@ int ata_host_activate(struct ata_host *host, int irq,
 	/* Special case for polling mode */
 	if (!irq) {
 		WARN_ON(irq_handler);
-		return ata_host_register(host, sht);
+		rc = ata_host_register(host, sht);
+		if (rc)
+			goto undo_start;
+
+		return 0;
 	}
 
 	irq_desc = devm_kasprintf(host->dev, GFP_KERNEL, "%s[%s]",
 				  dev_driver_string(host->dev),
 				  dev_name(host->dev));
-	if (!irq_desc)
-		return -ENOMEM;
+	if (!irq_desc) {
+		rc = -ENOMEM;
+		goto undo_start;
+	}
 
 	rc = devm_request_irq(host->dev, irq, irq_handler, irq_flags,
 			      irq_desc, host);
 	if (rc)
-		return rc;
+		goto undo_start;
 
 	for (i = 0; i < host->n_ports; i++)
 		ata_port_desc_misc(host->ports[i], irq);
 
 	rc = ata_host_register(host, sht);
-	/* if failed, just free the IRQ and leave ports alone */
-	if (rc)
+	if (rc) {
+		/* Free the IRQ, so that the handler can no longer run */
 		devm_free_irq(host->dev, irq, host);
+		goto undo_start;
+	}
+
+	return 0;
+
+undo_start:
+	ata_host_undo_start(host);
 
 	return rc;
 }
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 1e2a2c33cdc802..142347b5428dd0 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -2256,6 +2256,11 @@ EXPORT_SYMBOL_GPL(ata_pci_sff_prepare_host);
  *	hosts.  This separate helper is necessary because SFF hosts
  *	use two separate interrupts in legacy mode.
  *
+ *	Note that, unlike ata_host_activate(), the devres action registered
+ *	by ata_host_start() is kept on failure, i.e. ->host_stop() is called
+ *	by the driver core when probe() fails.  All callers of this function
+ *	rely on that, none of them releases the host resources itself.
+ *
  *	LOCKING:
  *	Inherited from calling layer (may sleep).
  *
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 040e5c3f635a96..a04e38cd41702e 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1489,8 +1489,10 @@ static int sata_fsl_probe(struct platform_device *ofdev)
 	 * device discovery process, invoking our port_start() handler &
 	 * error_handler() to execute a dummy Softreset EH session
 	 */
-	ata_host_activate(host, irq, sata_fsl_interrupt, SATA_FSL_IRQ_FLAG,
-			  &sata_fsl_sht);
+	retval = ata_host_activate(host, irq, sata_fsl_interrupt,
+				   SATA_FSL_IRQ_FLAG, &sata_fsl_sht);
+	if (retval)
+		goto error_exit_with_cleanup;
 
 	host_priv->intr_coalescing.show = fsl_sata_intr_coalescing_show;
 	host_priv->intr_coalescing.store = fsl_sata_intr_coalescing_store;
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index cfb9b5b61cd7eb..b2be1ce87878f4 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -584,8 +584,12 @@ static int qs_ata_init_one(struct pci_dev *pdev,
 	qs_host_init(host, board_idx);
 
 	pci_set_master(pdev);
-	return ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
-				 &qs_ata_sht);
+	rc = ata_host_activate(host, pdev->irq, qs_intr, IRQF_SHARED,
+			       &qs_ata_sht);
+	if (rc)
+		qs_host_stop(host);
+
+	return rc;
 }
 
 module_pci_driver(qs_ata_pci_driver);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 868af0a08f527d..a92908f07e2203 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -1136,6 +1136,7 @@ extern struct ata_host *ata_host_alloc_pinfo(struct device *dev,
 extern void ata_host_get(struct ata_host *host);
 extern void ata_host_put(struct ata_host *host);
 extern int ata_host_start(struct ata_host *host);
+void ata_host_undo_start(struct ata_host *host);
 extern int ata_host_register(struct ata_host *host,
 			     const struct scsi_host_template *sht);
 extern int ata_host_activate(struct ata_host *host, int irq,

From 1f5409c10ffa56e7c4fd13d4e3ff2dccb4fe746c Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 15:45:30 +0800
Subject: [PATCH 1147/1982] media: i2c: alvium-csi2: balance runtime PM usage
 count on remove

[ Upstream commit 0d2ca640318612402ae1c640d2da56b2914ff994 ]

alvium_probe() increments the runtime PM usage count with
pm_runtime_get_noresume() before enabling runtime PM. The probe error
path correctly balances this reference with pm_runtime_put_noidle(),
but the normal remove path only disables runtime PM.

pm_runtime_disable() does not decrement the usage count, so a
successful probe followed by driver removal leaves the runtime PM
usage count unbalanced.

Add the missing pm_runtime_put_noidle() to the remove path, matching
the existing probe error cleanup.

This issue was found by manual code inspection.

Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/alvium-csi2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
index 3d399af013222a..d08d01098a9a37 100644
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -2523,6 +2523,7 @@ static void alvium_remove(struct i2c_client *client)
 	 * make sure to turn power off manually.
 	 */
 	pm_runtime_disable(dev);
+	pm_runtime_put_noidle(dev);
 	if (!pm_runtime_status_suspended(dev))
 		alvium_set_power(alvium, false);
 	pm_runtime_set_suspended(dev);

From daa8a3cde7c8546b88c45443b886ea3352517eb1 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 16:50:31 +0800
Subject: [PATCH 1148/1982] media: i2c: ov2735: fix power cleanup on remove

[ Upstream commit 06d4f202f007b160e650e8dd861a5fc223024f34 ]

ov2735_probe() explicitly powers on the sensor before enabling runtime
PM. The probe failure paths call ov2735_power_off(), but the remove path
does not perform the corresponding power-off operation.

The managed runtime PM helpers only clean up the runtime PM state.
devm_pm_runtime_set_active_enabled() disables runtime PM and restores
the suspended state during device resource release, while
devm_pm_runtime_get_noresume() drops the runtime PM usage reference.
Neither helper invokes ov2735_power_off().

As a result, removing the driver after a successful probe can leave the
sensor clock and regulators enabled and the GPIOs in the powered state.

Call ov2735_power_off() from ov2735_remove() to match the successful
ov2735_power_on() performed during probe.

This issue was found by manual code inspection.

Fixes: fa9e6df636fb ("media: i2c: add ov2735 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov2735.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/ov2735.c b/drivers/media/i2c/ov2735.c
index b9660020414172..f248fdb352af6b 100644
--- a/drivers/media/i2c/ov2735.c
+++ b/drivers/media/i2c/ov2735.c
@@ -1081,6 +1081,7 @@ static void ov2735_remove(struct i2c_client *client)
 	v4l2_subdev_cleanup(&ov2735->sd);
 	media_entity_cleanup(&sd->entity);
 	v4l2_ctrl_handler_free(ov2735->sd.ctrl_handler);
+	ov2735_power_off(ov2735->dev);
 }
 
 static DEFINE_RUNTIME_DEV_PM_OPS(ov2735_pm_ops,

From a7e2d7c8aef36cfa6042c9152756c89ca2f853ff Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Tue, 15 Sep 2026 22:46:15 +0500
Subject: [PATCH 1149/1982] platform/x86: hp-bioscfg: fix slab-out-of-bounds
 write in hp_convert_hexstr_to_str()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6a6f3051e705b5c8facb0bf5984d5b981509e0b7 ]

hp_convert_hexstr_to_str() decodes an ACPI string made up of
space-separated ASCII hex-byte tokens of the form "0xHH". For
example, the four-byte input "0x41" decodes to the single
character 'A', and the nine-byte input "0x09 0x41" decodes to
"\tA": each token is read in a five-byte step (four characters for
the token, one for the trailing delimiter), and produces one output
byte, or two if that byte is '\\', '\r', '\n', or '\t', which are
written back out as a backslash followed by the matching letter.

The output buffer is sized with kmalloc(input_len, GFP_KERNEL), the
raw encoded length of the input, not the decoded length. For
well-formed input this is generous, since five input bytes never
decode to more than two output bytes. But input_len comes directly
from the ACPI string length reported by firmware and isn't
guaranteed to respect the five-byte encoding, so a short input_len
can undersize the allocation. With input_len == 1, only one byte is
allocated, yet decoding still produces at least one output byte
plus the NUL terminator written unconditionally afterwards, so two
bytes are needed. That terminator write then lands one byte past
the end of the allocation.

KASAN caught exactly this during BIOS attribute enumeration on
boot, triggered by a one-byte encoded input value:

BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)

Size the allocation to the worst-case decoded length instead of the
raw input length: two output bytes for every five-byte input chunk
(DIV_ROUND_UP(input_len, 5)), plus one byte for the terminator.

Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260915174615.63924-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 274bdecce68522..f665af1c118508 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
 	*len = 0;
 	*str = NULL;
 
-	new_str = kmalloc(input_len, GFP_KERNEL);
+	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
 	if (!new_str)
 		return -ENOMEM;
 

From c51c7e46b98c083ca7651c18e4e56357e5fb5c5a Mon Sep 17 00:00:00 2001
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
Date: Sun, 28 Jun 2026 11:55:59 +0200
Subject: [PATCH 1150/1982] ntfs3: bound index head insertions by buffer
 capacity

[ Upstream commit 2f497d23652ff23da07b08cfb4b4a1c2a87f1892 ]

hdr_insert_head() shifts the existing index entries by ins_bytes without
checking that the resulting used size fits within hdr->total. A directory
index root larger than the newly allocated index buffer can therefore make
the memmove write beyond the buffer.

Reject insertions whose size would exceed the index header capacity and
make both split callers unwind the new node when that happens.

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: syzbot+45ef5a8d661162757547@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=45ef5a8d661162757547
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/index.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 03ae5a817c1b47..97cbe176a83e59 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -596,6 +596,8 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr,
 
 	if (!e)
 		return NULL;
+	if (size_add(used, ins_bytes) > le32_to_cpu(hdr->total))
+		return NULL;
 
 	/* Now we just make room for the inserted entries and jam it in. */
 	to_move = used - le32_to_cpu(hdr->de_off);
@@ -1800,7 +1802,10 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni,
 	}
 
 	/* Copy root entries into new buffer. */
-	hdr_insert_head(hdr, re, to_move);
+	if (!hdr_insert_head(hdr, re, to_move)) {
+		err = -EINVAL;
+		goto out_put_n;
+	}
 
 	/* Update bitmap attribute. */
 	indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits);
@@ -1952,7 +1957,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
 	/* Copy all the entries <= sp into the new buffer. */
 	de_t = hdr_first_de(hdr1);
 	to_copy = PtrOffset(de_t, sp);
-	hdr_insert_head(hdr2, de_t, to_copy);
+	if (!hdr_insert_head(hdr2, de_t, to_copy)) {
+		err = -EINVAL;
+		put_indx_node(n2);
+		goto out;
+	}
 
 	/* Remove all entries (sp including) from hdr1. */
 	used = used1 - to_copy - sp_size;

From 800e6b3394f547085e79a7ae7f95d46425f10f40 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Wed, 2 Sep 2026 21:23:23 +0200
Subject: [PATCH 1151/1982] crypto: atmel-tdes - sync output bounce buffer
 before DMA

[ Upstream commit a38fdcb9c944525ca71e6aaf35e708586d0ae87d ]

The slow path maps its output bounce buffer once at probe time with
dma_map_single() and DMA_FROM_DEVICE, then reuses the mapping for every
request.  After the CPU copies a result from the buffer,
dma_sync_single_for_device() must hand the buffer back to the device before
the next DMA transfer.  The driver omits this call, so cache lines from the
previous result can remain valid while the device writes the next one.

This bug was masked by the completion paths calling
dma_sync_single_for_device() immediately before the CPU copied the output,
where dma_sync_single_for_cpu() was required.  For DMA_FROM_DEVICE on
ARM926, dma_sync_single_for_device() invokes arm926_dma_map_area(), which
invalidates the cache lines.  The misplaced call therefore discarded the
stale lines before every copy-out.

Commit c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
correctly changed the completion paths to call dma_sync_single_for_cpu().
On ARM926, that function invokes arm926_dma_unmap_area(), which is a no-op.
The missing pre-DMA dma_sync_single_for_device() was therefore exposed on
ARM926-based SAM9X60 and SAM9X7 SoCs.

With CONFIG_CRYPTO_SELFTESTS=y all four DES/TDES algorithms fail on
SAM9X75:

  alg: skcipher: atmel-ecb-tdes encryption test failed (wrong result) on
  test vector 2, cfg="unaligned buffer, offset=1"

Call dma_sync_single_for_device() for the output buffer before starting DMA
in both atmel_tdes_crypt_pdc() and atmel_tdes_crypt_dma().

Fixes: c8a9a647532f ("crypto: atmel-tdes - fix DMA sync direction")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/atmel-tdes.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c
index 72e91e0bb1b476..ac0be3c4cd01dc 100644
--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -373,6 +373,8 @@ static int atmel_tdes_crypt_pdc(struct atmel_tdes_dev *dd,
 	if (!(dd->flags & TDES_FLAGS_FAST)) {
 		dma_sync_single_for_device(dd->dev, dma_addr_in, length,
 					   DMA_TO_DEVICE);
+		dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+					   DMA_FROM_DEVICE);
 	}
 
 	len32 = DIV_ROUND_UP(length, sizeof(u32));
@@ -405,6 +407,8 @@ static int atmel_tdes_crypt_dma(struct atmel_tdes_dev *dd,
 	if (!(dd->flags & TDES_FLAGS_FAST)) {
 		dma_sync_single_for_device(dd->dev, dma_addr_in, length,
 					   DMA_TO_DEVICE);
+		dma_sync_single_for_device(dd->dev, dma_addr_out, length,
+					   DMA_FROM_DEVICE);
 	}
 
 	addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;

From 0d9e9643b93d6f6f8c2b4bb07037815de7065411 Mon Sep 17 00:00:00 2001
From: Liu Chao <liuc63@xiaopeng.com>
Date: Sun, 13 Sep 2026 20:04:58 +0800
Subject: [PATCH 1152/1982] usb: fotg210: validate endpoint index in ep0
 handlers

[ Upstream commit bbddb219b00af0792242a0ad1dc7fb3344f38733 ]

fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status()
use wIndex from the USB setup packet to index the fotg210->ep[] array
without verifying that the endpoint number falls below
FOTG210_MAX_NUM_EP (5).  USB_ENDPOINT_NUMBER_MASK is 0x0f, so a
malicious host can issue a setup packet with wIndex 5..15, resulting in
an out-of-bounds array read.  The resulting wild pointer is then
dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which
compute an MMIO register offset from ep->epnum and perform iowrite32
through it.

fotg210_clear_feature() is especially problematic: the out-of-bounds
access occurs at function entry (source-level) regardless of which
USB_RECIP_* case is taken, because the ep pointer is computed before the
switch statement.

Add upper-bound checks on the endpoint number derived from wIndex in
all three functions.  Invalid endpoint numbers in clear_feature now
trigger fotg210_request_error() (STALL) instead of silently falling
through to fotg210_set_cxdone().  Also add the missing le16_to_cpu()
conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse
endianness warning.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/fotg210/fotg210-udc.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c
index 0bae12e34f9a72..26f29dba58f270 100644
--- a/drivers/usb/fotg210/fotg210-udc.c
+++ b/drivers/usb/fotg210/fotg210-udc.c
@@ -661,7 +661,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
 	case USB_RECIP_ENDPOINT: {
 		u8 epnum;
 		epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
-		if (epnum)
+		if (epnum && epnum < FOTG210_MAX_NUM_EP)
 			fotg210_set_epnstall(fotg210->ep[epnum]);
 		else
 			fotg210_set_cxstall(fotg210);
@@ -677,8 +677,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
 static void fotg210_clear_feature(struct fotg210_udc *fotg210,
 				struct usb_ctrlrequest *ctrl)
 {
-	struct fotg210_ep *ep =
-		fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
+	u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+	struct fotg210_ep *ep;
 
 	switch (ctrl->bRequestType & USB_RECIP_MASK) {
 	case USB_RECIP_DEVICE:
@@ -688,7 +688,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210,
 		fotg210_set_cxdone(fotg210);
 		break;
 	case USB_RECIP_ENDPOINT:
-		if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
+		if (epnum >= FOTG210_MAX_NUM_EP) {
+			fotg210_request_error(fotg210);
+			break;
+		}
+		if (epnum) {
+			ep = fotg210->ep[epnum];
 			if (ep->wedged) {
 				fotg210_set_cxdone(fotg210);
 				break;
@@ -744,8 +749,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
 		fotg210->ep0_data = cpu_to_le16(0);
 		break;
 	case USB_RECIP_ENDPOINT:
-		epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
-		if (epnum)
+		epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+		if (epnum && epnum < FOTG210_MAX_NUM_EP)
 			fotg210->ep0_data =
 				cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
 					    << USB_ENDPOINT_HALT);

From 9e1878d7f4c66db8eaba2ac0cf8882c80af5d550 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 07:27:37 +0000
Subject: [PATCH 1153/1982] ASoC: wm8994: Fix runtime PM imbalance in
 wm8994_component_probe()

[ Upstream commit 480a5528cb6268d626632d45d4a1f29b4c0c11df ]

In wm8994_component_probe(), pm_runtime_get_sync() is invoked before
reading the GPIO configuration registers. If either regmap_read() fails,
the function jumps to err_irq without calling pm_runtime_put(), leaving
the runtime PM usage count incremented and causing a leak.

Add pm_runtime_put() on both GPIO read failure paths before jumping to
err_irq.

Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072737.1970990-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8994.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 128c3a59beac3d..71e8dd18b57be3 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4352,6 +4352,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
 	ret = regmap_read(control->regmap, WM8994_GPIO_1, &reg);
 	if (ret < 0) {
 		dev_err(component->dev, "Failed to read GPIO1 state: %d\n", ret);
+		pm_runtime_put(component->dev);
 		goto err_irq;
 	}
 	if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {
@@ -4364,6 +4365,7 @@ static int wm8994_component_probe(struct snd_soc_component *component)
 	ret = regmap_read(control->regmap, WM8994_GPIO_6, &reg);
 	if (ret < 0) {
 		dev_err(component->dev, "Failed to read GPIO6 state: %d\n", ret);
+		pm_runtime_put(component->dev);
 		goto err_irq;
 	}
 	if ((reg & WM8994_GPN_FN_MASK) != WM8994_GP_FN_PIN_SPECIFIC) {

From 4b67a0a7615b055a3df2830e42a18851f5e07fb9 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 07:29:00 +0000
Subject: [PATCH 1154/1982] ASoC: arizona-jack: Fix runtime PM imbalance in
 arizona_start_hpdet_acc_id()

[ Upstream commit e04dcb895b4622d67164e218a1179785e2c75999 ]

In arizona_start_hpdet_acc_id(), pm_runtime_get_sync() is called to keep
the device powered during headphone detection. If setting the HPDET mode
or starting the measurement fails and the function jumps to err,
pm_runtime_put_autosuspend() was not called while info->hpdet_active was
set to false, resulting in a runtime PM usage count leak.

Add pm_runtime_put_autosuspend() in the err error path to keep runtime PM
balanced.

Fixes: 9dd5e53d9d2f ("extcon: arizona: Retry HPDET identification for high impedance")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260916072900.1971595-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/arizona-jack.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/arizona-jack.c b/sound/soc/codecs/arizona-jack.c
index 6b55610ad535d6..b17c4539f4e490 100644
--- a/sound/soc/codecs/arizona-jack.c
+++ b/sound/soc/codecs/arizona-jack.c
@@ -713,6 +713,7 @@ static void arizona_start_hpdet_acc_id(struct arizona_priv *info)
 	snd_soc_jack_report(info->jack, SND_JACK_HEADPHONE,
 			    SND_JACK_LINEOUT | SND_JACK_HEADPHONE);
 
+	pm_runtime_put_autosuspend(arizona->dev);
 	info->hpdet_active = false;
 }
 

From da2591872e9a6c3b26de2b68524b4e225e8753ea Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 19:20:53 +0800
Subject: [PATCH 1155/1982] iio: accel: kxcjk-1013: Disable autosuspend on
 remove

[ Upstream commit 1de1206a42741adfb72ca8b37dc71a6bc80cb074 ]

kxcjk1013_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.

The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.

Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.

This issue was found by manual code inspection.

Fixes: 124e1b1d0924 ("iio: accel: kxcjk-1013: support runtime pm")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/kxcjk-1013.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 297853cd39e59e..a8652bdd011a69 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1548,6 +1548,7 @@ static void kxcjk1013_remove(struct i2c_client *client)
 
 	iio_device_unregister(indio_dev);
 
+	pm_runtime_dont_use_autosuspend(&client->dev);
 	pm_runtime_disable(&client->dev);
 	pm_runtime_set_suspended(&client->dev);
 

From 615dfc9c1094c4ee449570723d19379e6d15ff97 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 19:24:47 +0800
Subject: [PATCH 1156/1982] iio: accel: mma9551: disable autosuspend on remove

[ Upstream commit 8061720f6be1811478914f8b6143778d70f6033f ]

mma9551_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.

The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.

Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.

This issue was found by manual code inspection.

Fixes: 6da93a6710a3 ("iio: accel: mma9551: Add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/mma9551.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/accel/mma9551.c b/drivers/iio/accel/mma9551.c
index 02195deada49e5..28342a757c6cfe 100644
--- a/drivers/iio/accel/mma9551.c
+++ b/drivers/iio/accel/mma9551.c
@@ -503,6 +503,7 @@ static void mma9551_remove(struct i2c_client *client)
 
 	iio_device_unregister(indio_dev);
 
+	pm_runtime_dont_use_autosuspend(&client->dev);
 	pm_runtime_disable(&client->dev);
 	pm_runtime_set_suspended(&client->dev);
 

From de73e70146b16a3409cca37aa3cc2ff440792e10 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 19:30:12 +0800
Subject: [PATCH 1157/1982] iio: accel: mma9553: disable autosuspend on remove

[ Upstream commit 4dda1f9d25fb889649e81bbf015809daa512a049 ]

mma9553_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.

The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.

Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.

This issue was found by manual code inspection.

Fixes: 40cb761306d6 ("iio: add driver for Freescale MMA9553")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/mma9553.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/accel/mma9553.c b/drivers/iio/accel/mma9553.c
index f85384a7908f25..65533bc275eca5 100644
--- a/drivers/iio/accel/mma9553.c
+++ b/drivers/iio/accel/mma9553.c
@@ -1140,6 +1140,7 @@ static void mma9553_remove(struct i2c_client *client)
 
 	iio_device_unregister(indio_dev);
 
+	pm_runtime_dont_use_autosuspend(&client->dev);
 	pm_runtime_disable(&client->dev);
 	pm_runtime_set_suspended(&client->dev);
 

From ca766a199f45d2c423820ad4ed1e109cf66af623 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 19:34:22 +0800
Subject: [PATCH 1158/1982] iio: adc: at91-sama5d2: disable autosuspend on
 remove

[ Upstream commit 022996906e70c6bc9a7968ee663ebbe314fe1524 ]

at91_adc_probe() enables runtime PM autosuspend with
pm_runtime_use_autosuspend(). The probe error path correctly undoes
this setting with pm_runtime_dont_use_autosuspend(), but the normal
remove path only disables runtime PM.

The runtime PM API requires pm_runtime_use_autosuspend() to be undone
with pm_runtime_dont_use_autosuspend() at driver exit unless runtime PM
was enabled with devm_pm_runtime_enable(). Leaving the autosuspend flag
set therefore leaves the runtime PM state incompletely cleaned up after
the driver is unbound.

Add the missing pm_runtime_dont_use_autosuspend() call to the remove
path.

This issue was found by manual code inspection.

Fixes: 75d7556ac0e4 ("iio: adc: at91-sama5d2_adc: add runtime pm support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/at91-sama5d2_adc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index aa4ba3f5a50603..8c16c5938601c8 100644
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -2487,6 +2487,7 @@ static void at91_adc_remove(struct platform_device *pdev)
 
 	pm_runtime_disable(st->dev);
 	pm_runtime_set_suspended(st->dev);
+	pm_runtime_dont_use_autosuspend(st->dev);
 	clk_disable_unprepare(st->per_clk);
 
 	regulator_disable(st->vref);

From e4e9104f9ce463b6876144bae6d1e4484ceb3325 Mon Sep 17 00:00:00 2001
From: Cao Guanghui <caoguanghui@kylinos.cn>
Date: Thu, 27 Aug 2026 16:03:40 +0800
Subject: [PATCH 1159/1982] md/raid5: track disks array size to fix extra_page
 leak on error paths

[ Upstream commit 5028ceee173bfcf844469cfb0d1c151d3f6d0296 ]

free_conf() iterates conf->pool_size entries to free extra_page
allocations, but pool_size may not reflect the actual size of the
conf->disks array.  Two scenarios cause a mismatch:

1. setup_conf() early abort: pool_size is 0 (not yet set by
   grow_stripes) but conf->disks has max_disks entries with
   extra_page allocated.  The loop iterates 0 times, leaking all
   pages.

2. resize_stripes() Step 4 failure: conf->disks was replaced with
   a newsize-entry array in Step 3, but pool_size is only updated
   on success.  The loop iterates pool_size (old, smaller value)
   times, leaking (newsize - pool_size) pages.

Add a dedicated disks_cnt field to track the actual number of
entries in conf->disks.  Set it immediately after each allocation
or replacement (in setup_conf and resize_stripes Step 3, where the
array is safely stalled with no concurrent access), and use it in
free_conf() instead of pool_size.

This leaves pool_size untouched, preserving the check_reshape()
retry behavior that depends on pool_size only being updated on
full success.

Fixes: d7bd398e97f2 ("md/r5cache: handle alloc_page failure")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-1-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid5.c | 5 +++--
 drivers/md/raid5.h | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 56d7e05e94ce6f..fded4b3eb88b96 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2627,6 +2627,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 		} else {
 			kfree(conf->disks);
 			conf->disks = ndisks;
+			conf->disks_cnt = newsize;
 		}
 	} else
 		err = -ENOMEM;
@@ -7405,7 +7406,7 @@ static void free_conf(struct r5conf *conf)
 	free_thread_groups(conf);
 	shrink_stripes(conf);
 	raid5_free_percpu(conf);
-	for (i = 0; i < conf->pool_size; i++)
+	for (i = 0; i < conf->disks_cnt; i++)
 		if (conf->disks[i].extra_page)
 			put_page(conf->disks[i].extra_page);
 	kfree(conf->disks);
@@ -7588,7 +7589,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
 
 	if (!conf->disks)
 		goto abort;
-
+	conf->disks_cnt = max_disks;
 	for (i = 0; i < max_disks; i++) {
 		conf->disks[i].extra_page = alloc_page(GFP_KERNEL);
 		if (!conf->disks[i].extra_page)
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index eafc6e9ed6ee1c..fa9647a862adda 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -668,6 +668,7 @@ struct r5conf {
 	unsigned long		cache_state;
 	struct shrinker		*shrinker;
 	int			pool_size; /* number of disks in stripeheads in pool */
+	int			disks_cnt; /* number of entries in disks[] array */
 	spinlock_t		device_lock;
 	struct disk_info	*disks;
 	struct bio_set		bio_split;

From 45ceac48961d92e1d056457a5690cd95d2f25450 Mon Sep 17 00:00:00 2001
From: Cao Guanghui <caoguanghui@kylinos.cn>
Date: Thu, 27 Aug 2026 16:03:41 +0800
Subject: [PATCH 1160/1982] md/raid5: fix NULL pointer dereference in
 raid5_free_percpu

[ Upstream commit 41742e35268d6a45161b187f51f42bc2ade14d0d ]

If cpuhp_state_add_instance() fails in raid5_alloc_percpu() (e.g., the
startup callback raid456_cpu_up_prepare fails due to an allocation
failure), conf->node is never added to the cpuhp instance list and
its pprev remains NULL (from kzalloc initialization).

When setup_conf() then jumps to abort, free_conf() calls
raid5_free_percpu(), which checks conf->percpu (non-NULL, since it was
allocated before the cpuhp failure) and proceeds to call
cpuhp_state_remove_instance().  This calls hlist_del() on the unhashed
node, which dereferences node->pprev (NULL), causing a kernel panic.

Guard the removal with hlist_unhashed_lockless() so that the cpuhp
instance is only removed if it was actually added.  The lockless variant
uses READ_ONCE() for the pprev read, which is safe here because the
actual removal is synchronized by cpuhp_state_mutex inside
cpuhp_state_remove_instance().

Fixes: 29c6d1bbd7a2 ("md/raid5: Convert to hotplug state machine")
Cc: stable@vger.kernel.org
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Link: https://patch.msgid.link/20260827080341.112296-2-ghuicao@163.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid5.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index fded4b3eb88b96..6dfefbacfe3c09 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7392,7 +7392,8 @@ static void raid5_free_percpu(struct r5conf *conf)
 	if (!conf->percpu)
 		return;
 
-	cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
+	if (!hlist_unhashed_lockless(&conf->node))
+		cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node);
 	free_percpu(conf->percpu);
 }
 

From 9e2913245294f1b8390b8b5ecee67485f18cb432 Mon Sep 17 00:00:00 2001
From: Martin Wilck <martin.wilck@suse.com>
Date: Mon, 7 Sep 2026 17:51:03 +0200
Subject: [PATCH 1161/1982] md/raid5: validate payload size before calculating
 payload_len

[ Upstream commit 38c795105992bbaa3418dd39cbff7348ad17537c ]

Commit b0cc3ae97e89 ("md/raid5: validate payload size before accessing
journal metadata") introduced a bounds check to verify that a given payload
fits into the current metadata block. In order to calculate the payload
size, it has to access the members payload->header.type and payload->size,
the offset of which may already be past the end of the metadata block,
because the loop condition only checks that the first byte of the payload
is inside, and the payload entries have variable sizes. Later on,
payload->checksum[0] and payload->checksum[1] are accessed without
verifying that payload->size is large enough.

Add another check to make sure that payload->size can be safely
accessed, and make sure that the checksum fields are accessible.

This issue has been found by AI (gemma4, Gemini) during a backport
review.

Cc: Junrui Luo <moonafterrain@outlook.com>
Cc: stable@vger.kernel.org
Fixes: b0cc3ae97e89 ("md/raid5: validate payload size before accessing journal metadata")
Signed-off-by: Martin Wilck <mwilck@suse.com>
Link: https://patch.msgid.link/20260907155103.2325511-1-mwilck@suse.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/raid5-cache.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 2518781cbdf6d0..1f7bf680234d00 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2001,27 +2001,36 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
 	if (!page)
 		return -ENOMEM;
 
-	while (mb_offset < le32_to_cpu(mb->meta_size)) {
+	while (mb_offset + sizeof(struct r5l_payload_header) <= le32_to_cpu(mb->meta_size)) {
+		u32 payload_size;
 		sector_t payload_len;
 
 		payload = (void *)mb + mb_offset;
 		payload_flush = (void *)mb + mb_offset;
 
 		if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) {
+			if (mb_offset + sizeof(struct r5l_payload_data_parity)
+			    > le32_to_cpu(mb->meta_size))
+				goto mismatch;
+			payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
 			payload_len = sizeof(struct r5l_payload_data_parity) +
-				(sector_t)sizeof(__le32) *
-				(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
-			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+					(sector_t)sizeof(__le32) * payload_size;
+			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+			    payload_size < 1)
 				goto mismatch;
 			if (r5l_recovery_verify_data_checksum(
 				    log, ctx, page, log_offset,
 				    payload->checksum[0]) < 0)
 				goto mismatch;
 		} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) {
+			if (mb_offset + sizeof(struct r5l_payload_data_parity)
+			    > le32_to_cpu(mb->meta_size))
+				goto mismatch;
+			payload_size = le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9);
 			payload_len = sizeof(struct r5l_payload_data_parity) +
-				(sector_t)sizeof(__le32) *
-				(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
-			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+					(sector_t)sizeof(__le32) * payload_size;
+			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size) ||
+			    payload_size < conf->max_degraded)
 				goto mismatch;
 			if (r5l_recovery_verify_data_checksum(
 				    log, ctx, page, log_offset,
@@ -2035,6 +2044,9 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
 				    payload->checksum[1]) < 0)
 				goto mismatch;
 		} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
+			if (mb_offset + sizeof(struct r5l_payload_flush)
+			    > le32_to_cpu(mb->meta_size))
+				goto mismatch;
 			payload_len = sizeof(struct r5l_payload_flush) +
 				(sector_t)le32_to_cpu(payload_flush->size);
 			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
@@ -2096,7 +2108,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
 	mb_offset = sizeof(struct r5l_meta_block);
 	log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS);
 
-	while (mb_offset < le32_to_cpu(mb->meta_size)) {
+	while (mb_offset + sizeof(struct r5l_payload_header) < le32_to_cpu(mb->meta_size)) {
 		sector_t payload_len;
 		int dd;
 
@@ -2106,6 +2118,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
 		if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
 			int i, count;
 
+			if (mb_offset + sizeof(struct r5l_payload_flush) >
+			    le32_to_cpu(mb->meta_size))
+				return -EINVAL;
 			payload_len = sizeof(struct r5l_payload_flush) +
 				(sector_t)le32_to_cpu(payload_flush->size);
 			if (mb_offset + payload_len >
@@ -2130,6 +2145,9 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
 		}
 
 		/* DATA or PARITY payload */
+		if (mb_offset + sizeof(struct r5l_payload_data_parity) >
+		    le32_to_cpu(mb->meta_size))
+			return -EINVAL;
 		payload_len = sizeof(struct r5l_payload_data_parity) +
 			(sector_t)sizeof(__le32) *
 			(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

From 1bf651ae05d024728a629d5987a7b5e2381022aa Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Fri, 11 Sep 2026 14:43:54 +0200
Subject: [PATCH 1162/1982] drm/panic: Do not use un-escaped URL as format
 string

[ Upstream commit 6596aae25585b183ebd528206bde6f12efaf8db1 ]

Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.

As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.12+
Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index d4b6ea42db0fe6..b95d869257a84b 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -662,7 +662,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
 	char *kmsg;
 	int max_qr_data_size, url_len;
 
-	url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=",
+	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
+			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
 			   utsname()->machine, utsname()->release);
 
 	max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);

From c7683b4db5a2c034c7cfe2971d906299040f2a17 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Fri, 11 Sep 2026 14:43:55 +0200
Subject: [PATCH 1163/1982] drm/panic: Test address from kmap op for NULL

[ Upstream commit 6a6304ec3ceee879e3a2545b217eb11c8b7870e5 ]

Do nothing if kmap_local_page_try_from_panic() returns NULL. This is
not likely to hapen, as the previous page from the same memory area
has been mapped successfully.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 23437509a694 ("drm/panic: Fix 24bit pixel crossing page boundaries")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.18+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260911124540.279841-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index b95d869257a84b..9c4ac2febc9318 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -184,6 +184,8 @@ static void drm_panic_write_pixel24_xpage(void *vaddr, struct page *next_page,
 	u8 *p = vaddr + offset;
 
 	vaddr2 = kmap_local_page_try_from_panic(next_page);
+	if (!vaddr2)
+		return;
 
 	*p++ = color & 0xff;
 	color >>= 8;

From fc00ea2413ee6b3743e341c588360c5b3a5ec6b8 Mon Sep 17 00:00:00 2001
From: Johan Alvarado <contact@c127.dev>
Date: Fri, 11 Sep 2026 13:44:15 -0500
Subject: [PATCH 1164/1982] spi: spi-qpic-snand: publish the ECC context to
 snandc->qspi

[ Upstream commit f94c9b68bb5fdbef9f841da493d5305ff634ebb5 ]

qcom_spi_ooblayout_ecc() and qcom_spi_ooblayout_free() read the ECC
configuration through snandc->qspi->ecc. qcom_spi_probe() points it at a
zeroed scratch struct and only qcom_spi_ecc_prepare_io_req_pipelined(),
which runs on page I/O, ever updates it. qcom_spi_ecc_init_ctx_pipelined()
installs the ooblayout but does not publish the context it just
allocated, and qcom_spi_ecc_cleanup_ctx_pipelined() frees that context
without clearing the pointer.

spinand_init() calls mtd_ooblayout_count_freebytes() right after the ECC
context is created and before any page I/O, so the ooblayout always runs
against a pointer that does not describe the current context:

  - On a first probe it reads the zeroed struct from qcom_spi_probe(),
    so steps, bytes and bbm_size are 0. The count then returns 0 rather
    than an error, so the probe continues with mtd->oobavail set to 0.

  - On a probe retry it reads the ecc_cfg the previous attempt freed.

A retry is easy to hit. On IPQ5018 with the qcom,smem-part parser the
partition parse returns -EPROBE_DEFER until SMEM has probed, so the
first spi-nand probe defers. It defers inside
mtd_device_parse_register(), after mtd_otp_nvmem_add() has already read
the factory OTP - that read goes through prepare_io_req and leaves
snandc->qspi->ecc pointing at the context that spinand_cleanup() then
frees. The second probe allocates a new context, never publishes it, and
computes the OOB layout from the freed one. Once the slab has been
reused, qecc->steps holds garbage and

  oobregion->length = qecc->steps * 4;

goes negative. qcom_spi_ooblayout_free() only reports -ERANGE for
section 1 and later, so mtd_ooblayout_count_bytes() sums the regions and
returns that negative length as the byte count. The -512 below is
steps * 4 with steps == -128. It is a byte count that happens to
collide with -ERESTARTSYS, not an error the driver returned.
spinand_init() takes it as an error, and because it is not
-EPROBE_DEFER the driver core never retries and the NAND never appears:

  spi-nand spi0.0: ESMT SPI NAND was found.
  spi-nand spi0.0: probe with driver spi-nand failed with error -512
  UBI error: cannot open mtd rootfs, error -2
  Waiting for root device /dev/ubiblock0_1...

On a Mercusys MR80X (IPQ5018, ESMT F50D1G41LB) about half of the boots
failed to mount the rootfs, the outcome depending on whether the freed
memory had been overwritten yet.

Publish the context when it is created and clear the pointer when it is
destroyed. Clearing leaves snandc->qspi->ecc NULL after cleanup, which
is safe: the mtd is unregistered before cleanup_ctx runs, so no
ooblayout callback can follow.

Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Cc: stable@vger.kernel.org
Tested-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://patch.msgid.link/20260911184416.109790-2-contact@c127.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-qpic-snand.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
index 919e847c061db7..567485785ec960 100644
--- a/drivers/spi/spi-qpic-snand.c
+++ b/drivers/spi/spi-qpic-snand.c
@@ -391,6 +391,8 @@ static int qcom_spi_ecc_init_ctx_pipelined(struct nand_device *nand)
 	dev_dbg(snandc->dev, "ECC strength: %u bits per %u bytes\n",
 		ecc_cfg->strength, ecc_cfg->step_size);
 
+	snandc->qspi->ecc = ecc_cfg;
+
 	return 0;
 
 err_free_ecc_cfg:
@@ -407,6 +409,7 @@ static void qcom_spi_ecc_cleanup_ctx_pipelined(struct nand_device *nand)
 
 	kfree(snandc->qspi->oob_buf);
 	snandc->qspi->oob_buf = NULL;
+	snandc->qspi->ecc = NULL;
 	kfree(ecc_cfg);
 }
 

From 2c2b173c873b8bb803f99b7a2992600b9c069db9 Mon Sep 17 00:00:00 2001
From: Shengming Hu <hu.shengming@zte.com.cn>
Date: Wed, 16 Sep 2026 14:09:26 +0800
Subject: [PATCH 1165/1982] cpufreq: conservative: Restrict deferred
 downscaling to low load

[ Upstream commit 0fa55c5539173bceaeb400c69b1974aaa0cdb8dc ]

For a shared cpufreq policy, dbs_update() derives the load used for the
frequency decision from the maximum load among its CPUs, but it may
also record deferred idle periods accumulated by an idle CPU in the
policy.

Consequently, a single update can contain both a high decision load
from one CPU and multiple deferred idle periods from another CPU. The
conservative governor applies the deferred down steps before evaluating
the decision load. If that load subsequently triggers an up step, the
deferred down steps can outweigh the single up step and produce a net
frequency reduction.

This was observed on a policy shared by CPUs 2 and 3. A CPU-bound
SCHED_EXT task kept CPU 2 fully utilized while CPU 3 remained idle.
On this system, SCHED_EXT generated update-util callbacks less
frequently than CFS, resulting in sparse DBS updates such as:

 load=100 idle_periods=7 interval=59 ms
 load=100 idle_periods=4 interval=39 ms
 load=100 idle_periods=2 interval=19 ms
 load=100 idle_periods=7 interval=59 ms

With the default 5% frequency step and a 2.6 GHz policy maximum, seven
deferred periods reduce the requested frequency by seven 130 MHz steps
before the high decision load adds only one step. Repeated updates
therefore keep the policy near 530 MHz even though CPU 2 is fully
utilized.

There are two load values relevant to this behavior:

  * sample_load is calculated from the busy and elapsed time of the
    current sample.

  * decision_load is returned by dbs_update() for the governor's
    frequency decision. After a long idle interval, it may reuse
    prev_load to improve the response to a waking task and can therefore
    differ from sample_load.

The problem is that idle_periods is derived from accumulated idle time
and is applied independently of whether the current sample load is in
the conservative governor's downscaling region. A high sample load and
multiple deferred idle periods can therefore coexist, particularly
when updates are sparse.

As suggested by Zhongqiu Han, calculate the sample load separately from
the decision load. If no time has elapsed, use prev_load for the sample
load as the existing load calculation does, since no load can be
calculated for that interval.

Record the maximum sample load for the policy and apply deferred down
steps only when it is below down_threshold. This makes deferred
downscaling follow the same threshold that the conservative governor
normally uses to determine whether the policy load is low enough to
reduce the frequency.

The existing code applies deferred down steps whenever idle_periods is
valid, regardless of the sample load. When the decision load is in the
hold region, the locally adjusted frequency is not submitted unless
another frequency-update branch is taken. Thus, when the sample and
decision loads are the same and both are in the hold region, this
change does not alter the requested frequency.

The difference becomes visible when the decision load causes a
frequency update. In particular, if it exceeds up_threshold, the
governor applies a single up step after the deferred down steps and
submits the resulting request. Multiple deferred down steps can then
outweigh that up step and cause a frequency reduction even when the
sample load is above down_threshold.

With this change, deferred down steps are skipped whenever the maximum
sample load is at or above down_threshold, keeping deferred downscaling
consistent with the conservative governor's threshold semantics. The
requested frequency may therefore be higher than with the existing
behavior when deferred idle periods are present and the decision load
causes a frequency update. This is intentional, because the lower
request previously resulted from applying deferred downscaling while
the sampled policy load was outside the governor's downscaling region.
Accelerated deferred downscaling remains available when the policy
sample load is below down_threshold, including after a workload has
completed and the policy has become idle.

Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates")
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Luo Haiyang <luo.haiyang@zte.com.cn>
Reviewed-by: Run Zhang <zhang.run@zte.com.cn>
Suggested-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Link: https://patch.msgid.link/20260916140926740-DCokXh6dAgtqDn1EWdCh@zte.com.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/cpufreq_conservative.c |  8 ++++---
 drivers/cpufreq/cpufreq_governor.c     | 29 +++++++++++++++++++-------
 drivers/cpufreq/cpufreq_governor.h     |  2 ++
 3 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 60bab2b71b1b93..4ee6990ab2ba98 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -85,10 +85,12 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
 	freq_step = get_freq_step(cs_tuners, policy);
 
 	/*
-	 * Decrease requested_freq one freq_step for each idle period that
-	 * we didn't update the frequency.
+	 * Apply deferred down steps only when the policy sample load is
+	 * below down_threshold. Otherwise, multiple deferred down steps may
+	 * cause a net frequency decrease outside the downscaling region.
 	 */
-	if (policy_dbs->idle_periods < UINT_MAX) {
+	if (policy_dbs->max_sample_load < cs_tuners->down_threshold &&
+	    policy_dbs->idle_periods < UINT_MAX) {
 		unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
 
 		if (requested_freq > policy->min + freq_steps)
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 00a26fa6292c52..a10cf44600ffa4 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -116,7 +116,8 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
 	struct policy_dbs_info *policy_dbs = policy->governor_data;
 	struct dbs_data *dbs_data = policy_dbs->dbs_data;
 	unsigned int ignore_nice = dbs_data->ignore_nice_load;
-	unsigned int max_load = 0, idle_periods = UINT_MAX;
+	unsigned int max_load = 0, max_sample_load = 0;
+	unsigned int idle_periods = UINT_MAX;
 	unsigned int sampling_rate, io_busy, j;
 
 	/*
@@ -138,7 +139,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
 		struct cpu_dbs_info *j_cdbs = &per_cpu(cpu_dbs, j);
 		u64 update_time, cur_idle_time;
 		unsigned int idle_time, time_elapsed;
-		unsigned int load;
+		unsigned int load, sample_load;
 
 		cur_idle_time = get_cpu_idle_time(j, &update_time, io_busy);
 
@@ -171,6 +172,20 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
 			j_cdbs->prev_cpu_nice = cur_nice;
 		}
 
+		/*
+		 * Compute the sample load separately from the prev_load value
+		 * that may be reused after a long idle interval. The conservative
+		 * governor uses it to decide whether to apply deferred down steps.
+		 * If no time has elapsed, retain the existing behavior and use
+		 * prev_load.
+		 */
+		if (unlikely(!time_elapsed))
+			sample_load = j_cdbs->prev_load;
+		else if (time_elapsed > idle_time)
+			sample_load = 100 * (time_elapsed - idle_time) / time_elapsed;
+		else
+			sample_load = 0;
+
 		if (unlikely(!time_elapsed)) {
 			/*
 			 * That can only happen when this function is called
@@ -205,11 +220,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
 			load = j_cdbs->prev_load;
 			j_cdbs->prev_load = 0;
 		} else {
-			if (time_elapsed > idle_time)
-				load = 100 * (time_elapsed - idle_time) / time_elapsed;
-			else
-				load = 0;
-
+			load = sample_load;
 			j_cdbs->prev_load = load;
 		}
 
@@ -222,9 +233,13 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
 
 		if (load > max_load)
 			max_load = load;
+
+		if (sample_load > max_sample_load)
+			max_sample_load = sample_load;
 	}
 
 	policy_dbs->idle_periods = idle_periods;
+	policy_dbs->max_sample_load = max_sample_load;
 
 	return max_load;
 }
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 1462d59277bd12..ceb33336b2b305 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -94,6 +94,8 @@ struct policy_dbs_info {
 	/* Multiplier for increasing sample delay temporarily. */
 	unsigned int rate_mult;
 	unsigned int idle_periods;	/* For conservative */
+	/* Maximum load from the current policy sample. */
+	unsigned int max_sample_load;
 	/* Status indicators */
 	bool is_shared;		/* This object is used by multiple CPUs */
 	bool work_in_progress;	/* Work is being queued up or in progress */

From 4811e90d8e25b6520ff91451765f6f6b3b4e077b Mon Sep 17 00:00:00 2001
From: Jiaming Zhang <r772577952@gmail.com>
Date: Wed, 2 Sep 2026 19:21:21 +0800
Subject: [PATCH 1166/1982] nilfs2: force clear dirty state when restoring from
 the shadow map

[ Upstream commit cb6702e63e0a16afd83875294e5ce53becdd1b1f ]

When garbage collection fails, nilfs2 rolls the DAT metadata file's page
cache back to a shadow copy taken before GC started.
nilfs_clear_dirty_pages() drops the dirty state of the folios in the DAT
cache, then nilfs_copy_back_pages() overwrites them with the saved
contents and warns if one is still dirty:

	/* overwrite existing folio in the destination cache */
	WARN_ON(folio_test_dirty(dfolio));

nilfs_clear_dirty_pages() used to clear the dirty state unconditionally,
which is safe here because the rollback runs with the log writer
stopped, so nothing else can dirty the cache while it runs.  The same
helper is also used when writeback finds dirty folios after the
filesystem has degraded to read-only, where it does run concurrently
with the log writer, so commit ca76bb226bf4 ("nilfs2: do not force clear
folio if buffer is referenced") made nilfs_clear_folio_dirty() skip a
folio if any of its buffer heads is busy.  The rollback caller shares
that helper, so its clearing step can now return with a folio still
dirty.

A DAT folio can hold a busy buffer head without anyone modifying the
folio: nilfs_mdt_read_block() submits read-ahead for the blocks
following the one it was asked for and waits only for the first, so the
read-ahead buffers are still locked when it returns.  With a block size
smaller than the page size, a locked read-ahead buffer can share a folio
with a block that GC dirtied and keep the whole folio dirty past the
clearing step.

Add a force flag to nilfs_clear_dirty_pages() and
nilfs_clear_folio_dirty() that skips the busy buffer check, and set it
in the two calls from nilfs_mdt_restore_from_shadow_map().  The
read-only fallback callers keep passing false, so that commit still
protects them and the WARN_ON() is left alone.

Fixes: ca76bb226bf4 ("nilfs2: do not force clear folio if buffer is referenced")
Closes: https://lore.kernel.org/lkml/CANypQFZSYrtcshnUzOPiqatyLd-M8_OReOewQoAi_V5yY0dTtg@mail.gmail.com/
Cc: stable@vger.kernel.org
Suggested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/inode.c |  2 +-
 fs/nilfs2/mdt.c   |  6 +++---
 fs/nilfs2/page.c  | 50 +++++++++++++++++++++++++++--------------------
 fs/nilfs2/page.h  |  4 ++--
 4 files changed, 35 insertions(+), 27 deletions(-)

diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 87ddde159f0c93..1099864acabcbd 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -163,7 +163,7 @@ static int nilfs_writepages(struct address_space *mapping,
 	int err = 0;
 
 	if (sb_rdonly(inode->i_sb)) {
-		nilfs_clear_dirty_pages(mapping);
+		nilfs_clear_dirty_pages(mapping, false);
 		return -EROFS;
 	}
 
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 946b0d3534a5f2..79e662e2bf3341 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -407,7 +407,7 @@ static int nilfs_mdt_write_folio(struct folio *folio,
 		 * have dirty folios that try to be flushed in background.
 		 * So, here we simply discard this dirty folio.
 		 */
-		nilfs_clear_folio_dirty(folio);
+		nilfs_clear_folio_dirty(folio, false);
 		folio_unlock(folio);
 		return -EROFS;
 	}
@@ -650,10 +650,10 @@ void nilfs_mdt_restore_from_shadow_map(struct inode *inode)
 	if (mi->mi_palloc_cache)
 		nilfs_palloc_clear_cache(inode);
 
-	nilfs_clear_dirty_pages(inode->i_mapping);
+	nilfs_clear_dirty_pages(inode->i_mapping, true);
 	nilfs_copy_back_pages(inode->i_mapping, shadow->inode->i_mapping);
 
-	nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping);
+	nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping, true);
 	nilfs_copy_back_pages(ii->i_assoc_inode->i_mapping,
 			      NILFS_I(shadow->inode)->i_assoc_inode->i_mapping);
 
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 89180e2f59fefe..969e96ce0b8433 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -370,8 +370,9 @@ void nilfs_copy_back_pages(struct address_space *dmap,
 /**
  * nilfs_clear_dirty_pages - discard dirty pages in address space
  * @mapping: address space with dirty pages for discarding
+ * @force: whether to clear the dirty state regardless of busy buffer heads
  */
-void nilfs_clear_dirty_pages(struct address_space *mapping)
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force)
 {
 	struct folio_batch fbatch;
 	unsigned int i;
@@ -392,7 +393,7 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
 			 * was acquired.  Skip processing in that case.
 			 */
 			if (likely(folio->mapping == mapping))
-				nilfs_clear_folio_dirty(folio);
+				nilfs_clear_folio_dirty(folio, force);
 
 			folio_unlock(folio);
 		}
@@ -404,13 +405,16 @@ void nilfs_clear_dirty_pages(struct address_space *mapping)
 /**
  * nilfs_clear_folio_dirty - discard dirty folio
  * @folio: dirty folio that will be discarded
+ * @force: whether to clear the states regardless of busy buffer heads
  *
  * nilfs_clear_folio_dirty() clears working states including dirty state for
- * the folio and its buffers.  If the folio has buffers, clear only if it is
- * confirmed that none of the buffer heads are busy (none have valid
- * references and none are locked).
+ * the folio and its buffers.  If the folio has buffers and force is false,
+ * clear only if it is confirmed that none of the buffer heads are busy (none
+ * have valid references and none are locked).  If force is true, the states
+ * are cleared unconditionally, the caller should guarantee that the folio is
+ * not being modified concurrently.
  */
-void nilfs_clear_folio_dirty(struct folio *folio)
+void nilfs_clear_folio_dirty(struct folio *folio, bool force)
 {
 	struct buffer_head *bh, *head;
 
@@ -423,24 +427,28 @@ void nilfs_clear_folio_dirty(struct folio *folio)
 			 BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) |
 			 BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) |
 			 BIT(BH_Delay));
-		bool busy, invalidated = false;
+
+		if (!force) {
+			bool busy, invalidated = false;
 
 recheck_buffers:
-		busy = false;
-		bh = head;
-		do {
-			if (atomic_read(&bh->b_count) | buffer_locked(bh)) {
-				busy = true;
-				break;
+			busy = false;
+			bh = head;
+			do {
+				if (atomic_read(&bh->b_count) |
+				    buffer_locked(bh)) {
+					busy = true;
+					break;
+				}
+			} while (bh = bh->b_this_page, bh != head);
+
+			if (busy) {
+				if (invalidated)
+					return;
+				invalidate_bh_lrus();
+				invalidated = true;
+				goto recheck_buffers;
 			}
-		} while (bh = bh->b_this_page, bh != head);
-
-		if (busy) {
-			if (invalidated)
-				return;
-			invalidate_bh_lrus();
-			invalidated = true;
-			goto recheck_buffers;
 		}
 
 		bh = head;
diff --git a/fs/nilfs2/page.h b/fs/nilfs2/page.h
index 136cd1c143c9c1..c3ba3468af5cbe 100644
--- a/fs/nilfs2/page.h
+++ b/fs/nilfs2/page.h
@@ -41,8 +41,8 @@ void nilfs_folio_bug(struct folio *);
 
 int nilfs_copy_dirty_pages(struct address_space *, struct address_space *);
 void nilfs_copy_back_pages(struct address_space *, struct address_space *);
-void nilfs_clear_folio_dirty(struct folio *folio);
-void nilfs_clear_dirty_pages(struct address_space *mapping);
+void nilfs_clear_folio_dirty(struct folio *folio, bool force);
+void nilfs_clear_dirty_pages(struct address_space *mapping, bool force);
 unsigned int nilfs_page_count_clean_buffers(struct folio *folio,
 		unsigned int from, unsigned int to);
 unsigned long nilfs_find_uncommitted_extent(struct inode *inode,

From 48381e8b82b715be66ea24d257381ae5eb912eef Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 14:25:35 +0000
Subject: [PATCH 1167/1982] regulator: core: Fix c_rdev reference leak in
 regulator_resolve_coupling()

[ Upstream commit c41b69e9f76fd9632662714c1d37860468e8d773 ]

of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented, but regulator_resolve_coupling() returns
without dropping it when the coupled regulator belongs to a different
coupler, leaking the reference.

Fixes: d8ca7d184b33 ("regulator: core: Introduce API for regulators coupling customization")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142535.2156720-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index eae756c82c262d..ad7f26b14621b7 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5659,6 +5659,7 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev)
 		if (c_rdev->coupling_desc.coupler != coupler) {
 			rdev_err(rdev, "coupler mismatch with %s\n",
 				 rdev_get_name(c_rdev));
+			put_device(&c_rdev->dev);
 			return;
 		}
 

From 973f2d4bc9befa26b53fd05afed0d1c9eb81ae51 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 14:28:10 +0000
Subject: [PATCH 1168/1982] regulator: core: Fix rdev reference leak in
 regulator_resolve_supply()

[ Upstream commit 195bbe5e1c29aa1349655a6162958149c1176034 ]

regulator_resolve_supply() takes a reference on the looked-up regulator
with regulator_dev_lookup(), but when the supply resolves to the
regulator itself that reference is never dropped: it leaks on the early
return and is lost as well when r is replaced with the dummy regulator.

Release the reference before handling the self-referent case.

Fixes: 4b639e254d3d ("regulator: avoid resolve_supply() infinite recursion")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917142810.2156816-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index ad7f26b14621b7..e2328539b9fdc4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2110,6 +2110,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
 	if (r == rdev) {
 		dev_err(dev, "Supply for %s (%s) resolved to itself\n",
 			rdev->desc->name, rdev->supply_name);
+		put_device(&rdev->dev);
 		if (!have_full_constraints()) {
 			ret = -EINVAL;
 			goto out;

From a3048a0145db4d1c0e2624cfd3f07fe768f5eac2 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Sat, 1 Aug 2026 22:11:48 +0200
Subject: [PATCH 1169/1982] PCI: Skip Target Speed quirk on clamped ports with
 no link

[ Upstream commit ff8a969f7dc8e79ea6113abcfa983e070b2b585a ]

Since commit 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe
failed link retraining") the Target Speed quirk lifts a firmware-imposed
2.5GT/s restriction on any downstream port, without checking whether the
link is up.  Where nothing is plugged in, the retraining that follows can
never complete, so each attempt costs PCIE_LINK_RETRAIN_TIMEOUT_MS.  The
quirk makes two of them -- the initial one and the restore on the error
path -- adding a fixed 2 s to every boot.

On an MSI PRO Z690-A WIFI DDR4 (Intel 600 Series PCH) with one empty x1
slot, running v7.2-rc5:

  0.541 pci 0000:00:1c.0: removing 2.5GT/s downstream link speed restriction
  1.541 pci 0000:00:1c.0: retraining failed
  2.541 pci 0000:00:1c.2: [8086:7aba] type 01 class 0x060400

Where the Link Speed has already been clamped at 2.5GT/s and no link has
been established there is nothing worth doing, which is what the kerneldoc
for the quirk already describes: the restriction is to be lifted where
firmware arranged it "and the port reports its link already being up".
Bail out early in that case, before either the ASM2824 workaround or the
removal of the restriction is considered.

Ports whose link is up are unaffected, and so is the ASM2824 workaround,
which is reached with the Target Link Speed not clamped.

With this applied the quirk returns without touching the port: both
messages are gone, enumeration proceeds from 0000:00:1c.0 to 0000:00:1c.2
in 1 ms rather than 2 s, and the systemd "kernel" boot phase goes from
3.011 s to 1.036 s.

Fixes: 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining")
Reported-by: Andreas Wild <andiwild@gmail.com>
Closes: https://lore.kernel.org/lkml/20260801092152.5643-1-andiwild@gmail.com/
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221801
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Andreas Wild <andiwild@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Andreas Wild <andiwild@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260801201244.4421-1-andiwild@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index e03a3831bcc00f..199f2a762b22ae 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -103,7 +103,11 @@ int pcie_failed_link_retrain(struct pci_dev *dev)
 
 	pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
 	pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &oldlnkctl2);
-	if (!(lnksta & PCI_EXP_LNKSTA_DLLLA) && pcie_lbms_seen(dev, lnksta)) {
+	if (lnksta & PCI_EXP_LNKSTA_DLLLA) {
+		;
+	} else if (PCIE_LNKCTL2_TLS2SPEED(oldlnkctl2) == PCIE_SPEED_2_5GT) {
+		return ret;
+	} else if (pcie_lbms_seen(dev, lnksta)) {
 		pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
 		ret = pcie_set_target_speed(dev, PCIE_SPEED_2_5GT, false);
 		if (ret)

From 27c110a6bed20c95eca16ddc7857e3002a58e68f Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Tue, 8 Sep 2026 09:53:40 +0200
Subject: [PATCH 1170/1982] crypto: zynqmp-sha - fix NULL pointer dereference
 in init_tfm

[ Upstream commit 016f22d2268e02df705868110fe4e402b51bfffc ]

zynqmp_sha_init_tfm() checks crypto_shash_statesize(tfm_ctx->fbk_tfm)
before assigning the fallback transform to it, which dereferences a NULL
pointer since the transform context is zero-initialized. Use the local
fallback_tfm pointer for the size check instead.

Fixes: c1dd353d18e5 ("crypto: zynqmp-sha - Make descsize an algorithm attribute")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/xilinx/zynqmp-sha.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/xilinx/zynqmp-sha.c b/drivers/crypto/xilinx/zynqmp-sha.c
index 5813017b6b79d2..cd051e1f427535 100644
--- a/drivers/crypto/xilinx/zynqmp-sha.c
+++ b/drivers/crypto/xilinx/zynqmp-sha.c
@@ -59,7 +59,7 @@ static int zynqmp_sha_init_tfm(struct crypto_shash *hash)
 		return PTR_ERR(fallback_tfm);
 
 	if (crypto_shash_descsize(hash) <
-	    crypto_shash_statesize(tfm_ctx->fbk_tfm)) {
+	    crypto_shash_statesize(fallback_tfm)) {
 		crypto_free_shash(fallback_tfm);
 		return -EINVAL;
 	}

From dc6d28fd849c984a8e96a3f7a27a63a090be06f6 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Sat, 12 Sep 2026 22:41:16 +0800
Subject: [PATCH 1171/1982] crypto: omap-des - fix crypto engine cleanup

[ Upstream commit 5d69ed4cd4f9c68ff9a6ebb2e8a1079223a4ec6e ]

omap_des_probe() allocates and starts a crypto engine, but the remove
path does not call the matching crypto_engine_exit(). The probe failure
path already performs this cleanup.

crypto_engine_alloc_init() creates a kthread worker for processing
requests. Without crypto_engine_exit() during driver removal, the
worker is left running after the device is removed.

Call crypto_engine_exit() after unregistering the algorithms and before
tearing down the remaining request handling resources. This stops the
engine and destroys its worker.

This issue was found by manual code inspection.

Fixes: f1b77aaca85a ("crypto: omap-des - Integrate with the crypto engine framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-des.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 16d5c617d5ee8c..96b399c7eca697 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -1084,6 +1084,8 @@ static void omap_des_remove(struct platform_device *pdev)
 
 	omap_des_unregister_algs(dd->pdata);
 
+	crypto_engine_exit(dd->engine);
+
 	cancel_work_sync(&dd->done_task);
 	omap_des_dma_cleanup(dd);
 	pm_runtime_disable(dd->dev);

From a8d2a980f12a651df9fa8d78379fe7730a19d0a6 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:51:30 +0000
Subject: [PATCH 1172/1982] ASoC: codecs: wm8994: Fix runtime PM leak in
 wm8994_mic_detect()

[ Upstream commit b2c0e5bf750e33b0e1dcdfbb2df8103a06c7caab ]

wm8994_mic_detect() resumes the component before configuring the MICBIAS
pins, but the default case of the micbias switch returns -EINVAL right
after taking that reference, skipping the pm_runtime_put() on the
success path. This leaks a runtime PM reference on every call with an
invalid micbias.

Release the reference before returning -EINVAL.

Fixes: f5a2cda4f1db ("ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260917165130.2163278-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8994.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 71e8dd18b57be3..80b1bb7e177494 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3533,6 +3533,7 @@ int wm8994_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
 		break;
 	default:
 		dev_warn(component->dev, "Invalid MICBIAS %d\n", micbias);
+		pm_runtime_put(component->dev);
 		return -EINVAL;
 	}
 

From af9a4f6f57917b206e314ac72e651ff051242d52 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 12 Sep 2026 12:09:37 +0200
Subject: [PATCH 1173/1982] fpga: Fix of_fpga_mgr_get() reference in
 fpga_mgr_lock() docs

[ Upstream commit ac02245b0ca28388ba16273f2fa683c90da2e5dc ]

The fpga_mgr_lock() comment lists of_fpga_mgr_put() as a source of a
manager pointer. The helper which obtains that pointer is
of_fpga_mgr_get(). Correct the reference.

Fixes: ebf877a51ad7 ("fpga: mgr: separate getting/locking FPGA manager")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260912100937.86316-1-kmehltretter@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/fpga-mgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index 0f4035b089a2ea..f6856aabf27d5f 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -744,7 +744,7 @@ EXPORT_SYMBOL_GPL(fpga_mgr_put);
  * @mgr:	fpga manager
  *
  * Given a pointer to FPGA Manager (from fpga_mgr_get() or
- * of_fpga_mgr_put()) attempt to get the mutex. The user should call
+ * of_fpga_mgr_get()) attempt to get the mutex. The user should call
  * fpga_mgr_lock() and verify that it returns 0 before attempting to
  * program the FPGA.  Likewise, the user should call fpga_mgr_unlock
  * when done programming the FPGA.

From 5f3092b2fa08297b0eeaf4d360c7c2d73d494566 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 07:25:41 +0000
Subject: [PATCH 1174/1982] regulator: rt6190: Fix runtime PM imbalance in
 rt6190_out_enable()

[ Upstream commit e0d673e5a5c4084f0da90c06ed3b0bc45e47d679 ]

In rt6190_out_enable(), pm_runtime_get_sync() is called at the start of
the function. However, if any subsequent regmap or regulator operation
fails, the function returns directly without dropping the runtime PM
reference, causing a runtime PM reference leak.

Add an error handling path with pm_runtime_put() to keep the reference
count balanced on failure.

Fixes: e6999e7cca7e ("regulator: rt6190: Add support for Richtek RT6190 regulator")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: ChiYuan Huang <cy_huang@richtek.com>
Link: https://patch.msgid.link/20260916072541.1968033-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/rt6190-regulator.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/regulator/rt6190-regulator.c b/drivers/regulator/rt6190-regulator.c
index 3883440295edf8..bf99e18f6d5b01 100644
--- a/drivers/regulator/rt6190-regulator.c
+++ b/drivers/regulator/rt6190-regulator.c
@@ -109,19 +109,27 @@ static int rt6190_out_enable(struct regulator_dev *rdev)
 	ret = regmap_raw_read(regmap, RT6190_REG_OUTV, out_cfg,
 			      sizeof(out_cfg));
 	if (ret)
-		return ret;
+		goto err_pm_put;
 
 	ret = regulator_enable_regmap(rdev);
 	if (ret)
-		return ret;
+		goto err_pm_put;
 
 	ret = regmap_raw_write(regmap, RT6190_REG_OUTV, out_cfg,
 			       sizeof(out_cfg));
 	if (ret)
-		return ret;
+		goto err_pm_put;
+
+	ret = regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
+				 RT6190_ENGCP_MASK);
+	if (ret)
+		goto err_pm_put;
+
+	return 0;
 
-	return regmap_update_bits(regmap, RT6190_REG_SET5, RT6190_ENGCP_MASK,
-				  RT6190_ENGCP_MASK);
+err_pm_put:
+	pm_runtime_put(data->dev);
+	return ret;
 }
 
 static int rt6190_out_disable(struct regulator_dev *rdev)

From 00080c627a74133ebe95200717d1fe54ec3e76f7 Mon Sep 17 00:00:00 2001
From: Shehryar Ahmad <shehryar.amd@gmail.com>
Date: Wed, 16 Sep 2026 10:55:31 +0500
Subject: [PATCH 1175/1982] iio: accel: adis16201: fix channel order for buffer
 mode

[ Upstream commit a4b9f1137b76faab6891ce0bd3f5c02dda7c392d ]

Reshuffle adis16201_channels to ascending scan_index order to avoid data
corruption during IIO core demultiplexing since the ADIS driver builds
the buffer in channel array order, while the IIO core demultiplexes it
in scan_index order.

This changes the raw buffer byte layout for existing adis16201 users
reading buffered data directly.

Fixes: 591298e54cea ("Staging: iio: accel: adis16201: Move adis16201 driver out of staging")
Cc: stable@vger.kernel.org
Signed-off-by: Shehryar Ahmad <shehryar.amd@gmail.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/adis16201.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/accel/adis16201.c b/drivers/iio/accel/adis16201.c
index 5127e58eebc7d9..f0cf3783bcd9a3 100644
--- a/drivers/iio/accel/adis16201.c
+++ b/drivers/iio/accel/adis16201.c
@@ -202,19 +202,19 @@ static int adis16201_write_raw(struct iio_dev *indio_dev,
 }
 
 static const struct iio_chan_spec adis16201_channels[] = {
-	ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
-			 12),
-	ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
 	ADIS_ACCEL_CHAN(X, ADIS16201_XACCL_OUT_REG, ADIS16201_SCAN_ACC_X,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
 	ADIS_ACCEL_CHAN(Y, ADIS16201_YACCL_OUT_REG, ADIS16201_SCAN_ACC_Y,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
-	ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
 	ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
 	ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
 			BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 12),
-	IIO_CHAN_SOFT_TIMESTAMP(7)
+	ADIS_SUPPLY_CHAN(ADIS16201_SUPPLY_OUT_REG, ADIS16201_SCAN_SUPPLY, 0,
+			 12),
+	ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
+	ADIS_TEMP_CHAN(ADIS16201_TEMP_OUT_REG, ADIS16201_SCAN_TEMP, 0, 12),
+	IIO_CHAN_SOFT_TIMESTAMP(7),
 };
 
 static const struct iio_info adis16201_info = {

From dbdd30ac4a41751906ba4d06cde9eaa25238c995 Mon Sep 17 00:00:00 2001
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Date: Mon, 14 Sep 2026 14:43:42 +0200
Subject: [PATCH 1176/1982] iio: imu: inv_icm42600: force accel odr change when
 switching power mode

[ Upstream commit d52047d84963e5cf7c8ad502e0adf003fb0669de ]

When accel must switch from low-power mode to low-noise due to a change in
ODR, there is an hardware bug that sometimes prevent the ODR change flag
to be set in the FIFO header. If this happens, the driver is stuck waiting
for the ODR change flag that is never happening.

Fix this by using accel_force_odr flag set when switching mode for forcing
apply of ODR change. Do the apply after parsing FIFO data to let the flag
do the job if it is here.

Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/inv_icm42600/inv_icm42600.h        | 1 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c  | 9 ++++++++-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 2 ++
 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c   | 9 +++++++++
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600.h b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
index c8b48a5c5ed067..a44e4ea746a6d1 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h
@@ -177,6 +177,7 @@ struct inv_icm42600_state {
 	struct {
 		s64 gyro;
 		s64 accel;
+		bool accel_force_odr;
 	} timestamp;
 	struct inv_icm42600_apex apex;
 	struct inv_icm42600_fifo fifo;
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
index d19ff0e76c6680..d858acad3bfb6e 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -1226,9 +1226,11 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
 			return size;
 
 		/* update odr */
-		if (odr & INV_ICM42600_SENSOR_ACCEL)
+		if (odr & INV_ICM42600_SENSOR_ACCEL) {
 			inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
 							st->fifo.nb.total, no);
+			st->timestamp.accel_force_odr = false;
+		}
 
 		/* skip packet if no accel data or data is invalid */
 		if (accel == NULL || !inv_icm42600_fifo_is_data_valid(accel))
@@ -1241,5 +1243,10 @@ int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
 		iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ts_val);
 	}
 
+	if (st->timestamp.accel_force_odr) {
+		inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+		st->timestamp.accel_force_odr = false;
+	}
+
 	return 0;
 }
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
index 5c3840acf08579..2c3e41a24b33d3 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -396,6 +396,8 @@ static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
 	mutex_lock(&st->lock);
 
 	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+	if (sensor == INV_ICM42600_SENSOR_ACCEL)
+		st->timestamp.accel_force_odr = false;
 
 	ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
 	if (ret)
diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
index 76eb22488e5f31..e37b395dbd90b7 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -324,6 +324,15 @@ int inv_icm42600_set_accel_conf(struct inv_icm42600_state *st,
 		break;
 	}
 
+	/*
+	 * If we change mode from low-power to low-noise because of odr,
+	 * we need to force odr change.
+	 */
+	if (oldconf->mode == INV_ICM42600_SENSOR_MODE_LOW_POWER &&
+	    conf->mode == INV_ICM42600_SENSOR_MODE_LOW_NOISE &&
+	    conf->odr != oldconf->odr)
+		st->timestamp.accel_force_odr = true;
+
 	/* set ACCEL_CONFIG0 register (accel fullscale & odr) */
 	if (conf->fs != oldconf->fs || conf->odr != oldconf->odr) {
 		val = INV_ICM42600_ACCEL_CONFIG0_FS(conf->fs) |

From 7cec392ed369c45fa7216666d36292d6be706535 Mon Sep 17 00:00:00 2001
From: Tsz Shan Chan <tsz.chan.dev@gmail.com>
Date: Fri, 4 Sep 2026 11:19:48 +1000
Subject: [PATCH 1177/1982] iio: light: apds9306: fix default sampling
 frequency definition

[ Upstream commit a1c005f6336aa41f23552e66ea1b98b9ee493a86 ]

APDS9306_SAMP_FREQ_10HZ is defined as 0.

According to the datasheet (Broadcom AV02-4755EN, page 11,
ALS_MEAS_RATE), bits[2:0] set the measurement rate:
- 000: 25ms  (40Hz)
- 001: 20ms  (20Hz)
- 010: 100ms (10Hz)

Change APDS9306_SAMP_FREQ_10HZ from 0 to 2 to write the correct value
for 10Hz.

Datasheet: https://docs.broadcom.com/doc/AV02-4755EN
Fixes: 620d1e6c7a3f ("iio: light: Add support for APDS9306 Light Sensor")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Tsz Shan Chan <tchan@jacques.com.au>
Acked-by: Subhajit Ghosh <subhajit.ghosh@tweaklogic.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/light/apds9306.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/light/apds9306.c b/drivers/iio/light/apds9306.c
index 5ce01037ae5546..fc07518faec77e 100644
--- a/drivers/iio/light/apds9306.c
+++ b/drivers/iio/light/apds9306.c
@@ -61,7 +61,7 @@
 #define APDS9306_NUM_REPEAT_RATES	7
 #define APDS9306_INT_SRC_CLEAR	0
 #define APDS9306_INT_SRC_ALS	1
-#define APDS9306_SAMP_FREQ_10HZ	0
+#define APDS9306_SAMP_FREQ_10HZ	2
 
 /**
  * struct part_id_gts_multiplier - Part no. and corresponding gts multiplier

From 2c4be2b6248f94e3163ce9634db8112d8b9a93fa Mon Sep 17 00:00:00 2001
From: Hui Peng <benquike@gmail.com>
Date: Mon, 21 Sep 2026 03:25:55 +0000
Subject: [PATCH 1178/1982] ata: libata-scsi: abort multi-sector pass-through
 commands when multi_count is 0

[ Upstream commit 3bab8c7e0c6ba187a47163a1f71477213a278c48 ]

When an ATA_12, ATA_16, or ATA_32 pass-through command with a
multi-sector PIO command opcode (ATA_CMD_READ_MULTI,
ATA_CMD_WRITE_MULTI, ATA_CMD_READ_MULTI_EXT, ATA_CMD_WRITE_MULTI_EXT, or
ATA_CMD_WRITE_MULTI_FUA_EXT) is submitted via SG_IO on a device where
multiple-sector mode is not configured (dev->multi_count == 0),
ata_scsi_pass_thru() currently logs a warning and still dispatches the
taskfile. When the DRQ interrupt fires, ata_pio_sectors() triggers
WARN_ON_ONCE(qc->dev->multi_count == 0) and computes
nsect = min((qc->nbytes - qc->curbytes) / qc->sect_size, 0) = 0, failing
to transfer any sectors:

  ata1.00: invalid multi_count 1 ignored
  WARNING: drivers/ata/libata-sff.c:666 at ata_pio_sectors+0x27d/0x300
  Call Trace:
   <IRQ>
   ata_sff_hsm_move+0x211/0x22e0
   __ata_sff_port_intr+0x1c8/0x520
   ata_bmdma_port_intr+0xa1/0x5b0
   ata_bmdma_interrupt+0x1f5/0x550

Per ACS-3 section 7.12.7.21, if IDENTIFY DEVICE word 59 bit 8 is cleared
to zero (multi_count == 0) and a READ MULTIPLE or WRITE MULTIPLE command
is received without a preceding successful SET MULTIPLE MODE command, the
device returns command aborted (ABRT). Per the SAT specification, an ABRT
error translates to the ABORTED COMMAND sense key with NO ADDITIONAL SENSE
INFORMATION (0x00, 0x00).

Fail multi-sector taskfile commands in ata_scsi_pass_thru() with
ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0) when
dev->multi_count == 0.

Fixes: 1dce589c38c3 ("libata passthru: support PIO multi commands")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260921032556.1160734-1-benquike@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-scsi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index c780a7f157389f..8b9530c5053155 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3474,6 +3474,11 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
 	if (is_multi_taskfile(tf)) {
 		unsigned int multi_count = 1 << (cdb[1] >> 5);
 
+		if (!dev->multi_count) {
+			ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0);
+			return 1;
+		}
+
 		/* compare the passed through multi_count
 		 * with the cached multi_count of libata
 		 */

From 97bc751cfc38f3bccfd3716590decec9c7d7943b Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Mon, 21 Sep 2026 22:26:08 +0800
Subject: [PATCH 1179/1982] PCI: pciehp: Make 'pciehp_poll_mode' parameter
 read-only

[ Upstream commit 5ab17178fca6026d329cb6ced33c30f3b7d3e50a ]

pciehp_request_irq() and pciehp_free_irq() select different resources based
on the global pciehp_poll_mode parameter. The parameter is currently
writable through sysfs, so changing it while a controller is active can
make teardown try to stop a nonexistent polling thread or call free_irq()
for an IRQ that was not requested.

Keep the parameter available for boot and module configuration, but prevent
runtime changes to the registration mode.

Reproducer:
Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
e1000 device, using these device options:

  -device pcie-root-port,id=rp1,chassis=1,slot=1 -device e1000,bus=rp1

Pass "pcie_ports=native pciehp.pciehp_poll_mode=1" to the guest kernel.  As
root in the guest, replace the device name below with a bound pciehp
service device and run:

  # dev=0000:00:1c.0:pcie004
  # driver=/sys/bus/pci_express/drivers/pciehp
  # echo 0 > /sys/module/pciehp/parameters/poll_mode
  # echo "$dev" > "$driver/unbind"
  # dmesg | grep 'Trying to free already-free IRQ'

The unfixed kernel accepts the runtime mode change and reports the warning
when the service device is removed. The fixed kernel rejects the write and
removes the device without the warning. The mode change is a deliberate
privileged test action and is not expected during ordinary operation.

Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20260921142608.270312-1-runyu.xiao@seu.edu.cn
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/hotplug/pciehp_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index f59baa91297099..785b7d5e7c0967 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -38,7 +38,7 @@ int pciehp_poll_time;
  * not really modular, but the easiest way to keep compat with existing
  * bootargs behaviour is to continue using module_param here.
  */
-module_param(pciehp_poll_mode, bool, 0644);
+module_param(pciehp_poll_mode, bool, 0444);
 module_param(pciehp_poll_time, int, 0644);
 MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
 MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");

From 2f6a32c7a313e7d826642a57343cbba0ab202494 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Sun, 20 Sep 2026 18:12:31 +0300
Subject: [PATCH 1180/1982] i3c: master: Fix out-of-bounds read in DMA bounce
 buffer setup

[ Upstream commit 35b028b25451e17d63b2cd36a11a86c5e18df1b9 ]

When a bounce buffer is required for DMA_TO_DEVICE transfers,
i3c_master_dma_map_single() rounds the DMA mapping length up to a
cache-line boundary:

	map_len = ALIGN(len, cache_line_size());

It then allocates the bounce buffer with:

	kmemdup(buf, map_len, GFP_KERNEL);

kmemdup() copies the full allocation size, causing it to read map_len
bytes from buf even though only len bytes are valid.  This results in an
out-of-bounds read of up to cache_line_size() - 1 bytes past the end of
the caller's buffer.

Fix the issue by allocating the bounce buffer with kzalloc() and copying
only len bytes from the original buffer.  The remaining bytes up to
map_len stay zero-filled, avoiding both the out-of-bounds read and
exposure of unrelated memory contents to the DMA engine.

Fixes: f8d9e56aeb87 ("i3c: master: Add helpers for DMA mapping and bounce buffer handling")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i3c/master.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 038f7b2ec8c485..0dbcfb1a520491 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1955,12 +1955,11 @@ struct i3c_dma *i3c_master_dma_map_single(struct device *dev, void *buf,
 
 	if (force_bounce) {
 		dma_xfer->map_len = ALIGN(len, cache_line_size());
-		if (dir == DMA_FROM_DEVICE)
-			bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
-		else
-			bounce = kmemdup(buf, dma_xfer->map_len, GFP_KERNEL);
+		bounce = kzalloc(dma_xfer->map_len, GFP_KERNEL);
 		if (!bounce)
 			return NULL;
+		if (dir != DMA_FROM_DEVICE)
+			memcpy(bounce, buf, len);
 		dma_buf = bounce;
 	}
 

From 8c5f9461559f55bcf93207028f206bea6da92c3b Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Sun, 20 Sep 2026 18:12:32 +0300
Subject: [PATCH 1181/1982] i3c: mipi-i3c-hci: Bounce short reads irrespective
 of the IOMMU

[ Upstream commit b1a25e8e143ef880450e6399fb0733b66a1c29f0 ]

The controller writes whole DWORDs, so a read whose length is not a
multiple of 4 overwrites up to 3 bytes past the end of the destination
buffer. That is a property of the controller, not of the IOMMU, but the
bounce buffer that works around it was used only when the device was
IOMMU mapped. Everywhere else the buffer is left unprotected.

Drop the device_iommu_mapped() condition.

The overrun is easily seen with CONFIG_SLUB_DEBUG=y and kernel command
line options intel_iommu=off slub_debug=FZPU, which reports it as a
kmalloc redzone overwrite, like:

  [kmalloc Redzone overwritten] 0xffff8a354561570e-0xffff8a354561570f @offset=1806. First byte 0x15 instead of 0xcc
  =============================================================================
  BUG kmalloc-8 (Not tainted): Object corrupt
  Allocated in i3c_master_retrieve_dev_info+0xc1/0x760 age=40 cpu=6 pid=1
  ...
  Freed in i3c_master_enec_disec_locked+0xeb/0x140 age=40 cpu=6 pid=1
  ...
  WARNING: mm/slub.c:1233 at object_err+0x1c1/0x1cf, CPU#6: swapper/0/1
  ...

Fixes: 9e23897bca62 ("i3c: mipi-i3c-hci: Use physical device pointer with DMA API")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index 37717e530a250e..15a34429197b52 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -376,7 +376,7 @@ static void hci_dma_unmap_xfer(struct i3c_hci *hci,
 static struct i3c_dma *hci_dma_map_xfer(struct device *dev, struct hci_xfer *xfer)
 {
 	enum dma_data_direction dir = xfer->rnw ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
-	bool need_bounce = device_iommu_mapped(dev) && xfer->rnw && (xfer->data_len & 3);
+	bool need_bounce = xfer->rnw && (xfer->data_len & 3);
 
 	return i3c_master_dma_map_single(dev, xfer->data, xfer->data_len, need_bounce, dir);
 }

From c94b8c634a50ba19b7e14c41da7bbe7b37187969 Mon Sep 17 00:00:00 2001
From: Oleg Nesterov <oleg@redhat.com>
Date: Mon, 6 Apr 2026 15:37:32 +0200
Subject: [PATCH 1182/1982] signalfd: don't dequeue the forced fatal signals

[ Upstream commit d72e0fb3b00c6a1146bcfd7186ad9f6f609ba236 ]

These signals should act like SIGKILL, in that userspace must never dequeue
them. But as Kusaram explains, io_uring-driven signalfd_read_iter() called
from get_signal() -> task_work_run() paths can do this before get_signal()
has a chance to dequeue such a signal and notice SA_IMMUTABLE.

Change signalfd_poll() and signalfd_dequeue() to add pending SA_IMMUTABLE
signals to ctx->sigmask.

TODO: we should probably change force_sig_info_to_task(HANDLER_EXIT) to
make fatal_signal_pending() true, or add a fatal_or_forced_signal_pending()
helper. Then signalfd_dequeue() could just return -EINTR in this case.
This also makes sense for get_signal(), which could prioritize a fatal
signal sent by (say) force_sig_seccomp(force_coredump => true), just like
it already prioritizes SIGKILL.

Cc: stable@kernel.org
Reported-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0a4c46806941297fecb9
Tested-by: syzbot+0a4c46806941297fecb9@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/69d122fd.050a0220.2dbe29.001c.GAE@google.com/
Suggested-by: Kusaram Devineni <kusaram@devineni.in>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/adO3HG8bvwRPcmte@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/signalfd.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/fs/signalfd.c b/fs/signalfd.c
index d469782f97f4d3..0aa1657bbedf63 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -48,17 +48,30 @@ static int signalfd_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
+static void refine_sigmask(struct signalfd_ctx *ctx, sigset_t *sigmask)
+{
+	struct k_sigaction *k = current->sighand->action;
+	int n;
+
+	*sigmask = ctx->sigmask;
+	for (n = 1; n <= _NSIG; ++n, ++k) {
+		if (k->sa.sa_flags & SA_IMMUTABLE)
+			sigaddset(sigmask, n);
+	}
+}
+
 static __poll_t signalfd_poll(struct file *file, poll_table *wait)
 {
 	struct signalfd_ctx *ctx = file->private_data;
 	__poll_t events = 0;
+	sigset_t sigmask;
 
 	poll_wait(file, &current->sighand->signalfd_wqh, wait);
 
 	spin_lock_irq(&current->sighand->siglock);
-	if (next_signal(&current->pending, &ctx->sigmask) ||
-	    next_signal(&current->signal->shared_pending,
-			&ctx->sigmask))
+	refine_sigmask(ctx, &sigmask);
+	if (next_signal(&current->pending, &sigmask) ||
+	    next_signal(&current->signal->shared_pending, &sigmask))
 		events |= EPOLLIN;
 	spin_unlock_irq(&current->sighand->siglock);
 
@@ -155,11 +168,13 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
 				int nonblock)
 {
 	enum pid_type type;
-	ssize_t ret;
 	DECLARE_WAITQUEUE(wait, current);
+	sigset_t sigmask;
+	ssize_t ret;
 
 	spin_lock_irq(&current->sighand->siglock);
-	ret = dequeue_signal(&ctx->sigmask, info, &type);
+	refine_sigmask(ctx, &sigmask);
+	ret = dequeue_signal(&sigmask, info, &type);
 	switch (ret) {
 	case 0:
 		if (!nonblock)
@@ -174,7 +189,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
 	add_wait_queue(&current->sighand->signalfd_wqh, &wait);
 	for (;;) {
 		set_current_state(TASK_INTERRUPTIBLE);
-		ret = dequeue_signal(&ctx->sigmask, info, &type);
+		ret = dequeue_signal(&sigmask, info, &type);
 		if (ret != 0)
 			break;
 		if (signal_pending(current)) {
@@ -184,6 +199,7 @@ static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, kernel_siginfo_t *info
 		spin_unlock_irq(&current->sighand->siglock);
 		schedule();
 		spin_lock_irq(&current->sighand->siglock);
+		refine_sigmask(ctx, &sigmask);
 	}
 	spin_unlock_irq(&current->sighand->siglock);
 

From 872bd917485f9332469a793a10c164a450813d6a Mon Sep 17 00:00:00 2001
From: Hui Peng <benquike@gmail.com>
Date: Tue, 22 Sep 2026 02:32:04 +0000
Subject: [PATCH 1183/1982] seccomp: restore knotif->state when
 SECCOMP_ADDFD_FLAG_SEND is interrupted

[ Upstream commit 832b9b176be06a20747a267db6bc0010a24b74f4 ]

In seccomp_notify_addfd(), when SECCOMP_ADDFD_FLAG_SEND is set in
addfd.flags, knotif->state is optimistically transitioned from
SECCOMP_NOTIFY_SENT to SECCOMP_NOTIFY_REPLIED before waking the tracee
and waiting on kaddfd.completion:

	if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND) {
		knotif->state = SECCOMP_NOTIFY_REPLIED;
		...
	}

If wait_for_completion_interruptible(&kaddfd.completion) is interrupted
by a signal before the tracee dequeues the kaddfd request
(!list_empty(&kaddfd.list)), seccomp_notify_addfd() removes kaddfd from
knotif->addfd and returns -EINTR to the supervisor without having
installed the file descriptor.

However, knotif->state is left as SECCOMP_NOTIFY_REPLIED (with
knotif->error == 0 and knotif->val == 0). This causes two problems:

1. When the tracee runs in do_user_notif(), it checks
   if (knotif.state != SECCOMP_NOTIFY_REPLIED) after calling
   seccomp_handle_addfd(). Because knotif->state is already
   SECCOMP_NOTIFY_REPLIED, the tracee exits the notification wait loop
   prematurely and returns 0 from the trapped syscall without the file
   descriptor ever having been installed.

2. If the supervisor retries SECCOMP_IOCTL_NOTIF_ADDFD or
   SECCOMP_IOCTL_NOTIF_SEND before the tracee runs, it fails with
   -EINPROGRESS because knotif->state is no longer SECCOMP_NOTIFY_SENT.

Fix this by restoring knotif->state back to SECCOMP_NOTIFY_SENT if
SECCOMP_ADDFD_FLAG_SEND was set and kaddfd was not consumed before the
interrupted wait. Also add a seccomp_bpf selftest
(user_notification_addfd_send_interrupted) covering this race.

Tested in QEMU against Linux 7.3.0-rc3 using the
user_notification_addfd_send_interrupted selftest added in this patch
(./seccomp_bpf -t user_notification_addfd_send_interrupted): on the
unfixed kernel the test fails because the retry ioctl(listener,
SECCOMP_IOCTL_NOTIF_ADDFD, &addfd) returns -EINPROGRESS (-1) and the
tracee prematurely exits do_user_notif() with return value 0 instead of
FD 42, whereas with this patch applied the test passes.

Fixes: 0ae71c7720e3 ("seccomp: Support atomic "addfd + send reply"")
Cc: stable@vger.kernel.org
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260922023204.2504832-1-benquike@gmail.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/seccomp.c                              |   7 +-
 tools/testing/selftests/seccomp/seccomp_bpf.c | 179 ++++++++++++++++++
 2 files changed, 184 insertions(+), 2 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 25f62867a16d93..7fc3b3b13875a4 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1810,10 +1810,13 @@ static long seccomp_notify_addfd(struct seccomp_filter *filter,
 	 * We need to check again if the addfd request has been handled,
 	 * and if not, we will remove it from the queue.
 	 */
-	if (list_empty(&kaddfd.list))
+	if (list_empty(&kaddfd.list)) {
 		ret = kaddfd.ret;
-	else
+	} else {
 		list_del(&kaddfd.list);
+		if (addfd.flags & SECCOMP_ADDFD_FLAG_SEND)
+			knotif->state = SECCOMP_NOTIFY_SENT;
+	}
 
 out_unlock:
 	mutex_unlock(&filter->notify_lock);
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 19c9afa0be719e..a0c22cd7a9c0cb 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -4362,6 +4362,185 @@ TEST(user_notification_addfd_rlimit)
 	close(memfd);
 }
 
+/* Just take a signal and do nothing else. */
+static void empty_handler(int signo)
+{
+}
+
+/*
+ * Verify that when SECCOMP_IOCTL_NOTIF_ADDFD with SECCOMP_ADDFD_FLAG_SEND is
+ * interrupted by a signal before the tracee dequeues the addfd request,
+ * knotif->state is restored from SECCOMP_NOTIFY_REPLIED back to
+ * SECCOMP_NOTIFY_SENT so that:
+ *   1. The woken tracee sees knotif->state == SECCOMP_NOTIFY_SENT in
+ *      do_user_notif() and goes back to sleep instead of prematurely
+ *      returning 0 from the trapped syscall without the FD installed.
+ *   2. The supervisor can retry SECCOMP_IOCTL_NOTIF_ADDFD (or
+ *      SECCOMP_IOCTL_NOTIF_SEND) instead of failing with -EINPROGRESS.
+ *
+ * To deterministically hit the race window where the supervisor sleeps in
+ * wait_for_completion_interruptible(&kaddfd.completion) after waking the
+ * tracee (complete(&knotif->ready)) but before the tracee runs
+ * seccomp_handle_addfd(), pin all processes to a single CPU and enforce a
+ * strict 3-tier scheduling priority hierarchy on that CPU:
+ *   - Supervisor:            SCHED_FIFO priority 99 (highest)
+ *   - Signal helper (sig_pid): SCHED_FIFO priority 50 (middle)
+ *   - Tracee (pid):          SCHED_IDLE             (lowest)
+ */
+TEST(user_notification_addfd_send_interrupted)
+{
+	/*
+	 * Save parent_pid before user_notif_syscall(__NR_getppid, ...) installs
+	 * the seccomp filter on the calling process; children inherit that
+	 * filter, so sig_pid must not call getppid().
+	 */
+	pid_t tracee_pid, sig_pid, parent_pid = getpid();
+	long ret;
+	int status, listener, memfd, err;
+	struct seccomp_notif_addfd addfd = {};
+	struct seccomp_notif req = {};
+	struct sigaction sa = {};
+	struct sched_param sp_zero = { .sched_priority = 0 };
+	struct sched_param sp_fifo_high = { .sched_priority = 99 };
+	struct sched_param sp_fifo_mid = { .sched_priority = 50 };
+	struct timespec delay = { .tv_nsec = 15000000 };
+	cpu_set_t cpuset;
+	int cpu;
+
+	/* Pin the supervisor (and its future child processes) to one CPU. */
+	cpu = sched_getcpu();
+	if (cpu >= 0) {
+		CPU_ZERO(&cpuset);
+		CPU_SET(cpu, &cpuset);
+		sched_setaffinity(0, sizeof(cpuset), &cpuset);
+	}
+
+	sa.sa_handler = empty_handler;
+	ASSERT_EQ(sigaction(SIGUSR1, &sa, NULL), 0);
+
+	memfd = memfd_create("test", 0);
+	ASSERT_GE(memfd, 0);
+
+	ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+	ASSERT_EQ(0, ret) {
+		TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+	}
+
+	/*
+	 * Follow the convention of other user_notification_* tests in this
+	 * file by trapping __NR_getppid: because the filter is installed on
+	 * the supervisor before fork(), the trapped syscall must be a
+	 * side-effect-free syscall that the supervisor itself never invokes.
+	 * Even though getppid() does not normally return an FD,
+	 * SECCOMP_ADDFD_FLAG_SEND replaces the trapped syscall's return value
+	 * with the newly installed FD number (42).
+	 */
+	listener = user_notif_syscall(__NR_getppid,
+				      SECCOMP_FILTER_FLAG_NEW_LISTENER);
+	ASSERT_GE(listener, 0);
+
+	tracee_pid = fork();
+	ASSERT_GE(tracee_pid, 0);
+
+	if (tracee_pid == 0) {
+		/*
+		 * Tracee: invoke __NR_getppid as a dummy trigger syscall to
+		 * trap into do_user_notif(). Verify that the syscall returns
+		 * the injected FD number (42) and that FD 42 is open.
+		 */
+		ret = syscall(__NR_getppid);
+		exit(ret != 42 || fcntl(42, F_GETFD) < 0);
+	}
+
+	/* Wait for the tracee to trap in do_user_notif(). */
+	ASSERT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req), 0);
+
+	/*
+	 * Demote the tracee to SCHED_IDLE and promote the supervisor to
+	 * SCHED_FIFO(99) on the same CPU.
+	 */
+	ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_IDLE, &sp_zero), 0);
+	if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_high) != 0) {
+		kill(tracee_pid, SIGKILL);
+		waitpid(tracee_pid, NULL, 0);
+		SKIP(return, "SCHED_FIFO requires CAP_SYS_NICE");
+	}
+
+	addfd.srcfd = memfd;
+	addfd.newfd_flags = O_CLOEXEC;
+	addfd.newfd = 42;
+	addfd.id = req.id;
+	addfd.flags = SECCOMP_ADDFD_FLAG_SETFD | SECCOMP_ADDFD_FLAG_SEND;
+
+	/*
+	 * Fork a signal helper on the same CPU and set it to SCHED_FIFO(50).
+	 * Because the supervisor is currently running at SCHED_FIFO(99) on
+	 * this CPU, sig_pid is queued on the runqueue but cannot run until the
+	 * supervisor blocks inside the kernel.
+	 *
+	 * When the supervisor invokes ioctl(SECCOMP_IOCTL_NOTIF_ADDFD) below:
+	 *   1. seccomp_notify_addfd() sets knotif->state = SECCOMP_NOTIFY_REPLIED,
+	 *      wakes the tracee (SCHED_IDLE), and blocks in
+	 *      wait_for_completion_interruptible(&kaddfd.completion).
+	 *   2. The CPU scheduler immediately runs sig_pid (SCHED_FIFO 50)
+	 *      ahead of the woken tracee (SCHED_IDLE).
+	 *   3. sig_pid sends SIGUSR1 to parent_pid, waking the supervisor
+	 *      (SCHED_FIFO 99), which immediately preempts sig_pid, aborts the
+	 *      wait with -ERESTARTSYS (-EINTR), removes kaddfd from
+	 *      knotif->addfd, and restores knotif->state = SECCOMP_NOTIFY_SENT
+	 *      before the tracee has executed a single instruction.
+	 */
+	sig_pid = fork();
+	if (sig_pid < 0) {
+		sched_setscheduler(0, SCHED_OTHER, &sp_zero);
+		kill(tracee_pid, SIGKILL);
+		waitpid(tracee_pid, NULL, 0);
+	}
+	ASSERT_GE(sig_pid, 0);
+	if (sig_pid == 0) {
+		if (sched_setscheduler(0, SCHED_FIFO, &sp_fifo_mid) != 0)
+			_exit(1);
+		kill(parent_pid, SIGUSR1);
+		_exit(0);
+	}
+
+	ret = ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
+	err = errno;
+
+	/*
+	 * Restore normal scheduling ASAP so the supervisor does not remain
+	 * SCHED_FIFO on a single-CPU machine/VM/CI, then sleep briefly so the
+	 * woken tracee runs in do_user_notif(). With knotif->state restored to
+	 * SECCOMP_NOTIFY_SENT, the tracee must loop back to sleep waiting for
+	 * the notification reply rather than returning 0 from __NR_getppid.
+	 */
+	ASSERT_EQ(sched_setscheduler(0, SCHED_OTHER, &sp_zero), 0);
+	ASSERT_EQ(sched_setscheduler(tracee_pid, SCHED_OTHER, &sp_zero), 0);
+
+	EXPECT_EQ(ret, -1);
+	EXPECT_EQ(err, EINTR);
+	EXPECT_EQ(waitpid(sig_pid, &status, 0), sig_pid);
+	EXPECT_EQ(true, WIFEXITED(status));
+	EXPECT_EQ(0, WEXITSTATUS(status));
+
+	nanosleep(&delay, NULL);
+
+	/*
+	 * Retry SECCOMP_IOCTL_NOTIF_ADDFD. Because knotif->state is
+	 * SECCOMP_NOTIFY_SENT, the retry succeeds (returns 42) instead of
+	 * failing with -EINPROGRESS, installs FD 42 into the tracee, and wakes
+	 * the tracee to complete the syscall with return value 42.
+	 */
+	EXPECT_EQ(ioctl(listener, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd), 42);
+
+	EXPECT_EQ(waitpid(tracee_pid, &status, 0), tracee_pid);
+	EXPECT_EQ(true, WIFEXITED(status));
+	EXPECT_EQ(0, WEXITSTATUS(status));
+
+	close(listener);
+	close(memfd);
+}
+
 #ifndef SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP
 #define SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP (1UL << 0)
 #define SECCOMP_IOCTL_NOTIF_SET_FLAGS  SECCOMP_IOW(4, __u64)

From cf46d521bcb9df867c269f9fa454a353b9655111 Mon Sep 17 00:00:00 2001
From: Cong Nguyen <congnt264@gmail.com>
Date: Mon, 27 Jul 2026 17:49:27 +0700
Subject: [PATCH 1184/1982] staging: media: imx: csc-scaler: fix
 ipu_image_convert_run leak on queue error

[ Upstream commit 07643be7b1eff94f7a49e142c1e92a1029d3db21 ]

device_run() allocates an ipu_image_convert_run object and, on the
success path, hands it to the IPU image conversion core via
ipu_image_convert_queue(); the run object is then freed asynchronously
by the completion callback ipu_ic_pp_complete().

However, if ipu_image_convert_queue() fails, the core never takes
ownership of the run object and the completion callback is never
invoked. The "err" label finishes the mem2mem job and reports the
buffers as errored, but never frees the run object that was just
allocated, leaking it on every queue failure.

Free the run object in the error path. There is no risk of a double
free: the completion callback only runs after the object was
successfully queued, which is mutually exclusive with reaching the
error path. It is also safe for the earlier "goto err" on allocation
failure, since run is NULL there and kfree(NULL) is a no-op.

Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Cc: stable@kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
index 1869c5792ecb46..085f4f8eb8bde9 100644
--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -147,6 +147,7 @@ static void device_run(void *_ctx)
 	v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
 	v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
 	v4l2_m2m_job_finish(priv->m2m_dev, ctx->fh.m2m_ctx);
+	kfree(run);
 }
 
 /*

From 63e6c760dab0a59772e55cd7268fdbf4b9025421 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Thu, 10 Sep 2026 15:45:25 -0400
Subject: [PATCH 1185/1982] leds: ktd2692: Pass context to regulator cleanup

[ Upstream commit c73e9f04445f361d5f19ca2edfde742ce18348ef ]

regulator_disable_action() retrieves the driver context from device
driver data.  However, ktd2692_parse_dt() registers the action before
ktd2692_probe() stores the context with platform_set_drvdata().

If devm_add_action_or_reset() cannot allocate the action, it invokes the
callback immediately.  A later probe failure also invokes it during
managed-resource unwinding.  Both paths dereference a NULL context.

Pass the already allocated context directly to the action and retain the
device pointer in it for error reporting.  The context is allocated before
the action is registered, so reverse-order devres unwinding keeps it alive
through the callback.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: ee78b9360e14 ("leds: ktd2692: Fix an error handling path")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910194525.99654-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/flash/leds-ktd2692.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/leds/flash/leds-ktd2692.c b/drivers/leds/flash/leds-ktd2692.c
index 0f16eefcfe4cd3..04e2efdac3e6f3 100644
--- a/drivers/leds/flash/leds-ktd2692.c
+++ b/drivers/leds/flash/leds-ktd2692.c
@@ -69,6 +69,8 @@ const struct expresswire_timing ktd2692_timing = {
 };
 
 struct ktd2692_context {
+	struct device *dev;
+
 	/* Common ExpressWire properties (ctrl GPIO and timing) */
 	struct expresswire_common_props props;
 
@@ -196,13 +198,12 @@ static void ktd2692_setup(struct ktd2692_context *led)
 
 static void regulator_disable_action(void *_data)
 {
-	struct device *dev = _data;
-	struct ktd2692_context *led = dev_get_drvdata(dev);
+	struct ktd2692_context *led = _data;
 	int ret;
 
 	ret = regulator_disable(led->regulator);
 	if (ret)
-		dev_err(dev, "Failed to disable supply: %d\n", ret);
+		dev_err(led->dev, "Failed to disable supply: %d\n", ret);
 }
 
 static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
@@ -233,7 +234,7 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
 			dev_err(dev, "Failed to enable supply: %d\n", ret);
 		} else {
 			ret = devm_add_action_or_reset(dev,
-						regulator_disable_action, dev);
+						regulator_disable_action, led);
 			if (ret)
 				return ret;
 		}
@@ -290,6 +291,7 @@ static int ktd2692_probe(struct platform_device *pdev)
 	if (!led)
 		return -ENOMEM;
 
+	led->dev = &pdev->dev;
 	fled_cdev = &led->fled_cdev;
 	led_cdev = &fled_cdev->led_cdev;
 	led->props.timing = ktd2692_timing;

From dee5160991876c183962a21ba5d186980c3547dc Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 1 Sep 2026 11:29:02 +0100
Subject: [PATCH 1186/1982] media: ene_ir: Ensure teardown is done in the
 correct order

[ Upstream commit ae6cfbad7ca346b78f4cdac38438bbfaed8c18a0 ]

The timer can be re-armed from the irq, so ensure that the timers are
deleted after the irq and that we only free the rc device once we are
sure that the irq has been silenced.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ene_ir.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 136fc4192265da..7598b623e4e846 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1103,15 +1103,15 @@ static void ene_remove(struct pnp_dev *pnp_dev)
 	unsigned long flags;
 
 	rc_unregister_device(dev->rdev);
-	timer_delete_sync(&dev->tx_sim_timer);
 	spin_lock_irqsave(&dev->hw_lock, flags);
 	ene_rx_disable(dev);
 	ene_rx_restore_hw_buffer(dev);
 	spin_unlock_irqrestore(&dev->hw_lock, flags);
 
-	rc_free_device(dev->rdev);
 	free_irq(dev->irq, dev);
+	timer_delete_sync(&dev->tx_sim_timer);
 	release_region(dev->hw_io, ENE_IO_SIZE);
+	rc_free_device(dev->rdev);
 	kfree(dev);
 }
 

From 2c10ecb1205c11da58c0b15251e9b56f3f2af73d Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 1 Sep 2026 16:20:18 +0100
Subject: [PATCH 1187/1982] media: serial_ir: Fix race condition where timer
 can be re-armed

[ Upstream commit d74ac4016ba64cb3b20f395511d0b18025ca0ba9 ]

Ensure the timer cannot be re-armed.

Fixes: 2940c7e49775 ("[media] serial_ir: generate timeout")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/serial_ir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 992fff82b5245e..f6702b3df9a03c 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -798,7 +798,7 @@ static int __init serial_ir_init_module(void)
 
 static void __exit serial_ir_exit_module(void)
 {
-	timer_delete_sync(&serial_ir.timeout_timer);
+	timer_shutdown_sync(&serial_ir.timeout_timer);
 	serial_ir_exit();
 }
 

From ea6f38bc01df0ca4f7a209c23b27424fe125fb2a Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Fri, 4 Sep 2026 10:09:16 +0100
Subject: [PATCH 1188/1982] media: ir_toy: Validate the maximum tx carrier

[ Upstream commit 27303392aa87b61692faadec8b00e0ca66bf98dd ]

Reject any carrier the hardware cannot generate. This also fixes
a divide by zero if a carrier of U32_MAX/16 is set.

Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ir_toy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index e79de56997a426..ba6c0421270781 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -373,7 +373,7 @@ static int irtoy_tx_carrier(struct rc_dev *rc, uint32_t carrier)
 	u8 buf[3];
 	int err;
 
-	if (carrier < 11800)
+	if (carrier < 11800 || carrier > 3000000)
 		return -EINVAL;
 
 	buf[0] = 0x06;

From 979378aa62727f97e0f42793fa822da14875a6ed Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 9 Sep 2026 11:04:40 +0100
Subject: [PATCH 1189/1982] media: meson-ir-tx: Prevent divide by zero in
 meson_irtx_prepare_pulse()

[ Upstream commit 05d9c515cf13056875abbf73adb4a19dd7ba32eb ]

If an excesively high carrier is set, meson_irtx_prepare_pulse() will
cause a divide by zero if tb_us is 0. Prevent such a carrier from being
set.

Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/meson-ir-tx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/rc/meson-ir-tx.c b/drivers/media/rc/meson-ir-tx.c
index 1ab898069e67ff..a0d07da09f67af 100644
--- a/drivers/media/rc/meson-ir-tx.c
+++ b/drivers/media/rc/meson-ir-tx.c
@@ -219,6 +219,9 @@ static int meson_irtx_set_carrier(struct rc_dev *rc, u32 carrier)
 	if (carrier == 0)
 		return -EINVAL;
 
+	if (!DIV_ROUND_CLOSEST(USEC_PER_SEC, carrier))
+		return -EINVAL;
+
 	ir->carrier = carrier;
 	meson_irtx_set_mod(ir);
 

From a8c3c92d4ad454bf3c0a143f81ce44f111f483a1 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 07:31:36 +0000
Subject: [PATCH 1190/1982] ASoC: ti: davinci-mcasp: Fix runtime PM imbalance
 in __davinci_mcasp_set_clkdiv()

[ Upstream commit ba593d662183de74d2b733b4c6e8cd26f04f0a65 ]

In __davinci_mcasp_set_clkdiv(), pm_runtime_get_sync() is called at the
entry of the function. If an invalid div_id is provided, the function
hits the default switch case and directly returns -EINVAL without calling
pm_runtime_put(), resulting in a runtime PM reference leak.

Add pm_runtime_put() in the default case before returning -EINVAL.

Fixes: 4ed8c9b737b6 ("ASoC: McASP: add support for clock dividers")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Tested-by: Sen Wang <sen@ti.com>
Link: https://patch.msgid.link/20260916073136.1971673-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/ti/davinci-mcasp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index 621a9d5f9377a5..23a68ac3a3e3fc 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -647,6 +647,7 @@ static int __davinci_mcasp_set_clkdiv(struct davinci_mcasp *mcasp, int div_id,
 		break;
 
 	default:
+		pm_runtime_put(mcasp->dev);
 		return -EINVAL;
 	}
 

From 2cd49b55c4a5801806307632d2d5d31ca527ebf6 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:29 -0500
Subject: [PATCH 1191/1982] arm64: dts: ti: k3-am62a: Fix MMC0_CLK register
 address

[ Upstream commit 9852f2badc438de82b6828c11c80ef0a656f1d4d ]

MMC0_CLKLB and MMC0_CLK have incorrectly swapped register addresses
as per datasheet [0]. Set the correct MMC0_CLK address and drop the
unneeded MMC0_CLKLB pin configuration.

[0] https://www.ti.com/lit/gpn/am62a7 Rev. E: Table 5-1. Pin Attributes

Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Udit Kumar <u-kumar1@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-2-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index a902b88062093a..29e7673dde3313 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -313,8 +313,7 @@
 	main_mmc0_pins_default: main-mmc0-default-pins {
 		pinctrl-single,pins = <
 			AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
-			AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLKLB */
-			AM62AX_IOPAD(0x21c, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+			AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
 			AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
 			AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
 			AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */

From 9fec0d09d72ca30ae23dc5efaff6df62f018f30d Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:31 -0500
Subject: [PATCH 1192/1982] arm64: dts: ti: k3-am62a7-sk: Set eMMC clock pin as
 OUTPUT

[ Upstream commit aa7d5b1efa75e58c9d440dfd720205045fe6a806 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals

Fixes: e041ec6e86e7 ("arm64: dts: ti: k3-am62a7-sk: Enable eMMC support")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-4-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index 29e7673dde3313..a9141640c35e6c 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -313,7 +313,7 @@
 	main_mmc0_pins_default: main-mmc0-default-pins {
 		pinctrl-single,pins = <
 			AM62AX_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
-			AM62AX_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+			AM62AX_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
 			AM62AX_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
 			AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
 			AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */

From 91b895087d4f54f2dd765bdae292d5925960da68 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:32 -0500
Subject: [PATCH 1193/1982] arm64: dts: ti: k3-am62a7-sk: Set SD clock pin as
 OUTPUT

[ Upstream commit cfad4f39124b218c2cbbbe17e742971abc9ac8b4 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals

Fixes: 38c4a08c820c ("arm64: dts: ti: Add support for AM62A7-SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-5-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index a9141640c35e6c..17ae6f0ceecfc1 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -329,7 +329,7 @@
 	main_mmc1_pins_default: main-mmc1-default-pins {
 		pinctrl-single,pins = <
 			AM62AX_IOPAD(0x23c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
-			AM62AX_IOPAD(0x234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+			AM62AX_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
 			AM62AX_IOPAD(0x230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
 			AM62AX_IOPAD(0x22c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
 			AM62AX_IOPAD(0x228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */

From a1af1d48b4e8f25e369296a01627e8e4c1a89272 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:33 -0500
Subject: [PATCH 1194/1982] arm64: dts: ti: k3-am62a-phycore-som: Set eMMC
 clock pin as OUTPUT

[ Upstream commit 4834050197f205a649e36661ca150e6ac8295008 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruj16 Rev. C: Table 12-257. MMCSDi I/O Signals

Fixes: d69383885576 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM62Ax")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-6-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
index b3d012a5a26aa7..9da48a54855e08 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
@@ -120,7 +120,7 @@
 	main_mmc0_pins_default: main-mmc0-default-pins {
 		pinctrl-single,pins = <
 			AM62AX_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y6) MMC0_CMD */
-			AM62AX_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
+			AM62AX_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB7) MMC0_CLK */
 			AM62AX_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA6) MMC0_DAT0 */
 			AM62AX_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AB6) MMC0_DAT1 */
 			AM62AX_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (Y7) MMC0_DAT2 */

From 76d64e229e8d4a649ff1c066580bc9ebf5b225f0 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:34 -0500
Subject: [PATCH 1195/1982] arm64: dts: ti: k3-am62-lp-sk: Set eMMC clock pins
 as OUTPUT

[ Upstream commit 156f4c2208c8e5e04002402494de28c21c0afcbc ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: e6a51ffabfc1 ("arm64: ti: dts: Add support for AM62x LP SK")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-7-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
index 5ed757c19db605..fc79641d7bb5f6 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-lp-sk.dts
@@ -86,7 +86,7 @@
 		bootph-all;
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (V3) MMC0_CMD */
-			AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (Y1) MMC0_CLK */
+			AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (Y1) MMC0_CLK */
 			AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (V2) MMC0_DAT0 */
 			AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (V1) MMC0_DAT1 */
 			AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (W2) MMC0_DAT2 */

From a4506f5cdcaf5e30bccb5ab10b210e9b7e0f27f4 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:35 -0500
Subject: [PATCH 1196/1982] arm64: dts: ti: k3-am62-pocketbeagle2: Set SD clock
 pin as OUTPUT

[ Upstream commit 843c4d171975059eaa1436c8403d9a29f677a75c ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: 92d8c028aa92 ("arm64: dts: ti: Add k3-am62-pocketbeagle2")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-8-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
index 7a4cffc27bda31..1c691629d4ad07 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
@@ -235,7 +235,7 @@
 	main_mmc1_pins_default: main-mmc1-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
-			AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+			AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
 			AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
 			AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
 			AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */

From 8f4c662782775f01029f8f465cb987790960c577 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:36 -0500
Subject: [PATCH 1197/1982] arm64: dts: ti: k3-am625-beagleplay: Set MMC clock
 pins as OUTPUT

[ Upstream commit c074abebc76f0e59d13dea499f582806c6a3d94d ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: f5a731f0787f ("arm64: dts: ti: Add k3-am625-beagleplay")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-9-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
index 7028d9835c4a89..5d05f4b9a6d91a 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -323,7 +323,7 @@
 		bootph-all;
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x0220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
-			AM62X_IOPAD(0x0218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+			AM62X_IOPAD(0x0218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
 			AM62X_IOPAD(0x0214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
 			AM62X_IOPAD(0x0210, PIN_INPUT, 0) /* (AA1) MMC0_DAT1 */
 			AM62X_IOPAD(0x020c, PIN_INPUT, 0) /* (AA3) MMC0_DAT2 */
@@ -346,7 +346,7 @@
 		bootph-all;
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x023c, PIN_INPUT, 0) /* (A21) MMC1_CMD */
-			AM62X_IOPAD(0x0234, PIN_INPUT, 0) /* (B22) MMC1_CLK */
+			AM62X_IOPAD(0x0234, PIN_OUTPUT, 0) /* (B22) MMC1_CLK */
 			AM62X_IOPAD(0x0230, PIN_INPUT, 0) /* (A22) MMC1_DAT0 */
 			AM62X_IOPAD(0x022c, PIN_INPUT, 0) /* (B21) MMC1_DAT1 */
 			AM62X_IOPAD(0x0228, PIN_INPUT, 0) /* (C21) MMC1_DAT2 */
@@ -358,7 +358,7 @@
 	wifi_pins_default: wifi-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x0120, PIN_INPUT, 0) /* (C24) MMC2_CMD */
-			AM62X_IOPAD(0x0118, PIN_INPUT, 0) /* (D25) MMC2_CLK */
+			AM62X_IOPAD(0x0118, PIN_OUTPUT, 0) /* (D25) MMC2_CLK */
 			AM62X_IOPAD(0x0114, PIN_INPUT, 0) /* (B24) MMC2_DAT0 */
 			AM62X_IOPAD(0x0110, PIN_INPUT, 0) /* (C25) MMC2_DAT1 */
 			AM62X_IOPAD(0x010c, PIN_INPUT, 0) /* (E23) MMC2_DAT2 */

From 7a78d631d33afe4ec01a70e2086540111f670507 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:37 -0500
Subject: [PATCH 1198/1982] arm64: dts: ti: k3-am62x-sk-common: Set SD clock
 pin as OUTPUT

[ Upstream commit 1e2e5016bda94b2bcd86258b5eb77fe3006639a0 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-10-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
index 58f78c0de292de..3c5ef8fc9cdd62 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -187,7 +187,7 @@
 		bootph-all;
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x23c, PIN_INPUT, 0) /* (A21/C18) MMC1_CMD */
-			AM62X_IOPAD(0x234, PIN_INPUT, 0) /* (B22/A20) MMC1_CLK */
+			AM62X_IOPAD(0x234, PIN_OUTPUT, 0) /* (B22/A20) MMC1_CLK */
 			AM62X_IOPAD(0x230, PIN_INPUT, 0) /* (A22/A19) MMC1_DAT0 */
 			AM62X_IOPAD(0x22c, PIN_INPUT, 0) /* (B21/B19) MMC1_DAT1 */
 			AM62X_IOPAD(0x228, PIN_INPUT, 0) /* (C21/B20) MMC1_DAT2 */

From 87b48de7876bfec44bdd2e798d1b2c6e49e379c9 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:38 -0500
Subject: [PATCH 1199/1982] arm64: dts: ti: k3-am625-sk-common: Set eMMC clock
 pin as OUTPUT

[ Upstream commit 8ef8a0e38d1377c6d51c06f95c64d87641b2c717 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260909214743.899477-11-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
index fe0b98e1d10557..d492ff34c5b11d 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am625-sk-common.dtsi
@@ -98,7 +98,7 @@
 		bootph-all;
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */
-			AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */
+			AM62X_IOPAD(0x218, PIN_OUTPUT, 0) /* (AB1) MMC0_CLK */
 			AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */
 			AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
 			AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */

From 2b7e78230f3205f33fdbd04eac7b4f1619478383 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:39 -0500
Subject: [PATCH 1200/1982] arm64: dts: ti: k3-am62-phycore-som: Set eMMC clock
 pin as OUTPUT

[ Upstream commit a3c2b6c52e02d58941c0b91bfba052788aeff890 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: 3443c1c4ed61 ("arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM625")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-12-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
index eeca643fedbe99..19ac2dbe66cb57 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
@@ -146,7 +146,7 @@
 	main_mmc0_pins_default: main-mmc0-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x220, PIN_INPUT_PULLUP, 0) /* (Y3) MMC0_CMD */
-			AM62X_IOPAD(0x218, PIN_INPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
+			AM62X_IOPAD(0x218, PIN_OUTPUT_PULLDOWN, 0) /* (AB1) MMC0_CLK */
 			AM62X_IOPAD(0x214, PIN_INPUT_PULLUP, 0) /* (AA2) MMC0_DAT0 */
 			AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */
 			AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */

From 2014f2ee032b5c60ded5263944ed3e1c6ade2e04 Mon Sep 17 00:00:00 2001
From: Judith Mendez <jm@ti.com>
Date: Wed, 9 Sep 2026 16:47:43 -0500
Subject: [PATCH 1201/1982] arm64: dts: ti: k3-am62x-phyboard-lyra: Set SD
 clock pin as OUTPUT

[ Upstream commit 1d62ef8d47b535d31fb9cf38e5c36eb55b0189a4 ]

MMC clock pins must be configured as OUTPUT-only per TRM [0] with
receiver disabled (RXACTIVE bit = 0). Change MMC CLK pins from
PIN_INPUT to PIN_OUTPUT to match documentation.

[0] https://www.ti.com/lit/pdf/spruiv7 Rev. C: Table 12-246. MMCSDi I/O Signals

Fixes: f1b3adade045 ("arm64: dts: ti: Add am62x-phyboard-lyra carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Judith Mendez <jm@ti.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Acked-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20260909214743.899477-16-jm@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
index aab74d6019b0a3..5a09b4c1b659a4 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-phyboard-lyra.dtsi
@@ -227,7 +227,7 @@
 	main_mmc1_pins_default: main-mmc1-default-pins {
 		pinctrl-single,pins = <
 			AM62X_IOPAD(0x23c, PIN_INPUT_PULLUP, 0) /* (A21) MMC1_CMD */
-			AM62X_IOPAD(0x234, PIN_INPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
+			AM62X_IOPAD(0x234, PIN_OUTPUT_PULLDOWN, 0) /* (B22) MMC1_CLK */
 			AM62X_IOPAD(0x230, PIN_INPUT_PULLUP, 0) /* (A22) MMC1_DAT0 */
 			AM62X_IOPAD(0x22c, PIN_INPUT_PULLUP, 0) /* (B21) MMC1_DAT1 */
 			AM62X_IOPAD(0x228, PIN_INPUT_PULLUP, 0) /* (C21) MMC1_DAT2 */

From f49376986b09d9734fa6c6754f6f4b62a8382b83 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 10:21:12 +0000
Subject: [PATCH 1202/1982] drm/mali-dp: Fix runtime PM leak in
 malidp_crtc_atomic_enable()

[ Upstream commit 73ef663c75688168e31dbe9c585b939be410a945 ]

malidp_crtc_atomic_enable() resumes the device with
pm_runtime_get_sync() and returns early when the resume fails.  The
runtime PM usage count is incremented by pm_runtime_get_sync() even
when the resume fails, so returning without dropping the reference
leaks it and, once the error has been hit, prevents the device from
ever suspending again.

Drop the runtime PM reference with pm_runtime_put_noidle() on the
resume failure path before returning.

Fixes: 85f6421889ec ("drm: mali-dp: Enable power management for the device.")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260916102112.2018372-1-vulab@iscas.ac.cn
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/arm/malidp_crtc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c
index d72c22dcf6855a..591f71577937e6 100644
--- a/drivers/gpu/drm/arm/malidp_crtc.c
+++ b/drivers/gpu/drm/arm/malidp_crtc.c
@@ -56,6 +56,7 @@ static void malidp_crtc_atomic_enable(struct drm_crtc *crtc,
 
 	if (err < 0) {
 		DRM_DEBUG_DRIVER("Failed to enable runtime power management: %d\n", err);
+		pm_runtime_put_noidle(crtc->dev->dev);
 		return;
 	}
 

From e35f9b354d97cd5d4cfbba1e8eeb7204eb71f3e7 Mon Sep 17 00:00:00 2001
From: Wentao Guan <guanwentao@uniontech.com>
Date: Fri, 18 Sep 2026 17:09:10 +0800
Subject: [PATCH 1203/1982] cpufreq/amd-pstate: Skip auto_sel write when it
 already matches the mode

[ Upstream commit b400642c5e93863ec17ea15fcbd3efc81c299531 ]

Since commit 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active
mode on shared memory systems"), shmem_init_perf() programs
AUTONOMOUS_SELECTION_ENABLE unconditionally, including in active mode.

Platforms that exclusively support autonomous selection report this field
as an Integer of 1, as required by the ACPI specification, instead of as a
register descriptor.  cppc_get_reg_val() reads such a field back
successfully, but cppc_set_reg_val() rejects the write with -EOPNOTSUPP
because the entry is not an ACPI_TYPE_BUFFER.

shmem_init_perf() propagates that error, so every amd_pstate_epp_cpu_init()
fails, cpufreq_register_driver() ends up with an empty policy list and
returns -ENODEV, and amd-pstate refuses to load at all:

  amd_pstate: failed to set auto_sel, ret: -95
  amd_pstate: Failed to initialize CPU 0: -95
  ...
  amd_pstate: failed to register with return -19

Skip the write when the register already holds the value the requested mode
needs.  Active and guided mode are fixed on these platforms, which report
auto_sel as 1, while passive mode still fails to load on a platform that
cannot disable autonomous selection, exactly as it did before the
offending commit.

Fixes: 9dfd13f80c85 ("cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems")
Cc: stable@vger.kernel.org
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: LFRon <ronforever@outlook.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260918090909.86544-1-guanwentao@uniontech.com
Signed-off-by: Mario Limonciello <superm1@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/amd-pstate.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index b1a200531628ff..0b06bbd7215ffd 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -469,8 +469,10 @@ static int shmem_init_perf(struct amd_cpudata *cpudata)
 		return 0;
 	}
 
-	ret = cppc_set_auto_sel(cpudata->cpu,
-			(cppc_state == AMD_PSTATE_PASSIVE) ? 0 : 1);
+	if ((cppc_state != AMD_PSTATE_PASSIVE) == auto_sel)
+		return 0;
+
+	ret = cppc_set_auto_sel(cpudata->cpu, !auto_sel);
 
 	if (ret)
 		pr_warn("failed to set auto_sel, ret: %d\n", ret);

From 435a2d476c0f1a78eb3eb18af8a86346c3c62ac4 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Mon, 21 Sep 2026 12:19:39 -0300
Subject: [PATCH 1204/1982] nilfs2: fix checkpoint root lifetime on sysfs
 errors

[ Upstream commit 2cb947450e0e5a88bb6bb5fca6dbfda1910e74b0 ]

nilfs_find_or_create_root() links a new checkpoint root into the
checkpoint tree and drops ns_cptree_lock before creating the root's
sysfs group.  If nilfs_sysfs_create_snapshot_group() then fails, the
root is freed while it is still reachable from ns_cptree, so a
concurrent nilfs_lookup_root() can dereference freed memory.

nilfs_sysfs_create_snapshot_group() allocates memory and creates sysfs
nodes and may sleep, so it cannot run under the ns_cptree_lock spinlock.
Reorder the creation path so that the sysfs group is set up before the
root is published: initialize the root, create its sysfs group outside
the lock, and only then take ns_cptree_lock to link it into the tree.
On sysfs failure the root was never visible and is freed directly; in
the unlikely case a root with the same checkpoint number is already
present, the sysfs group of the new root is removed before it is freed.
Concurrent insertions are already serialized by ns_snapshot_mount_mutex,
so only the race against nilfs_lookup_root() needs to be closed.

Because kobject_put() does not guarantee that the embedded kobject's
release callback has run by the time it returns
(CONFIG_DEBUG_KOBJECT_RELEASE defers it), the container must not be
freed until the release completes.  Keep that wait_for_completion() of
snapshot_kobj_unregister inside the sysfs helpers, so both the creation
error path and nilfs_sysfs_delete_snapshot_group() wait for the release
before their callers free the root.

Fixes: dd70edbde262 ("nilfs2: integrate sysfs support into driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c     |  5 ++++-
 fs/nilfs2/the_nilfs.c | 34 +++++++++++++++++++++-------------
 2 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index bc52afbfc5c739..5bb74a45ad1ed1 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -195,8 +195,10 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
 					    "%llu", root->cno);
 	}
 
-	if (err)
+	if (err) {
 		kobject_put(&root->snapshot_kobj);
+		wait_for_completion(&root->snapshot_kobj_unregister);
+	}
 
 	return err;
 }
@@ -204,6 +206,7 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
 void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
 {
 	kobject_put(&root->snapshot_kobj);
+	wait_for_completion(&root->snapshot_kobj_unregister);
 }
 
 /************************************************************************
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 9911a484398a05..b453229db3af95 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -887,6 +887,26 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
 	if (!new)
 		return NULL;
 
+	new->cno = cno;
+	new->ifile = NULL;
+	new->nilfs = nilfs;
+	refcount_set(&new->count, 1);
+	atomic64_set(&new->inodes_count, 0);
+	atomic64_set(&new->blocks_count, 0);
+
+	/*
+	 * Register the sysfs group before publishing the root in the
+	 * checkpoint tree.  nilfs_sysfs_create_snapshot_group() can sleep,
+	 * so it must run outside ns_cptree_lock; creating it first also
+	 * ensures a concurrent nilfs_lookup_root() can never observe a root
+	 * whose sysfs registration later fails and gets freed.
+	 */
+	err = nilfs_sysfs_create_snapshot_group(new);
+	if (err) {
+		kfree(new);
+		return NULL;
+	}
+
 	spin_lock(&nilfs->ns_cptree_lock);
 
 	p = &nilfs->ns_cptree.rb_node;
@@ -903,29 +923,17 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
 		} else {
 			refcount_inc(&root->count);
 			spin_unlock(&nilfs->ns_cptree_lock);
+			nilfs_sysfs_delete_snapshot_group(new);
 			kfree(new);
 			return root;
 		}
 	}
 
-	new->cno = cno;
-	new->ifile = NULL;
-	new->nilfs = nilfs;
-	refcount_set(&new->count, 1);
-	atomic64_set(&new->inodes_count, 0);
-	atomic64_set(&new->blocks_count, 0);
-
 	rb_link_node(&new->rb_node, parent, p);
 	rb_insert_color(&new->rb_node, &nilfs->ns_cptree);
 
 	spin_unlock(&nilfs->ns_cptree_lock);
 
-	err = nilfs_sysfs_create_snapshot_group(new);
-	if (err) {
-		kfree(new);
-		new = NULL;
-	}
-
 	return new;
 }
 

From 91559a37ab89ab6677972cc823b271414a94a4ee Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 09:12:51 +0000
Subject: [PATCH 1205/1982] EDAC/i10nm: Fix mdev reference leak in
 i10nm_get_ddr_munits()

[ Upstream commit f0d8c34b3b5e845113581d7d3b24ddaa61bce1f0 ]

In i10nm_get_ddr_munits(), get_ddr_munit() returns a PCI device with
its reference count incremented.  If ioremap() fails to map the MMIO
space of the memory controller, the function returns -ENODEV without
putting the reference held by mdev, leaking it.

Put the device reference before returning on the ioremap failure path.

[Tony: Dropped the Cc: stable tag]

Fixes: c545f5e41225 ("EDAC/i10nm: Skip the absent memory controllers")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qzhuo@nvidia.com>
Link: https://patch.msgid.link/20260916091251.1997522-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/i10nm_base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index dfd49412f31998..59d359f3f3fb5c 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -834,6 +834,7 @@ static int i10nm_get_ddr_munits(void)
 
 			mbase = ioremap(base + off, size);
 			if (!mbase) {
+				pci_dev_put(mdev);
 				i10nm_printk(KERN_ERR, "Failed to ioremap 0x%llx\n",
 					     base + off);
 				return -ENODEV;

From 750960f85f5467d7271b54ddc215e5800b0a08db Mon Sep 17 00:00:00 2001
From: Yuchao Zhang <ndaugoing@gmail.com>
Date: Tue, 22 Sep 2026 12:46:06 +0800
Subject: [PATCH 1206/1982] md: validate bblog_size when loading v1.x badblocks
 metadata

[ Upstream commit ae5f89b23cb88667cfa1273b42d6a551db9c651e ]

In super_1_load(), when the on-disk feature_map does not have
MD_FEATURE_BAD_BLOCKS set but sb->bblog_offset is non-zero,
rdev->badblocks.shift is initialized to 0 without validating
sb->bblog_size.  The same field is validated in the
MD_FEATURE_BAD_BLOCKS branch ("sectors > (PAGE_SIZE / 512)"), but this
branch bypasses that check.

A forged on-disk superblock (malicious storage device or crafted
image) can therefore carry an oversized sb->bblog_size.  When bad
blocks are later recorded, super_1_sync() sets bb->size from
sb->bblog_size and md_write_metadata() issues a bio larger than the
single rdev->bb_page, reading beyond the page and leaking kernel
memory contents to disk.

sb->bblog_size is never modified by the kernel between load and sync,
and the MD_FEATURE_BAD_BLOCKS branch already validates it, so checking
it in this branch is sufficient to cover both paths.

Fix this by rejecting an oversized sb->bblog_size with -EINVAL,
matching the existing check in the MD_FEATURE_BAD_BLOCKS branch.

Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
Link: https://patch.msgid.link/20260922044606.30774-1-ndaugoing@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 44f44219ed7fe7..8d9e111939f64b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1930,8 +1930,11 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
 			if (!badblocks_set(&rdev->badblocks, sector, count, 1))
 				return -EINVAL;
 		}
-	} else if (sb->bblog_offset != 0)
+	} else if (sb->bblog_offset != 0) {
+		if (le16_to_cpu(sb->bblog_size) > (PAGE_SIZE / 512))
+			return -EINVAL;
 		rdev->badblocks.shift = 0;
+	}
 
 	if ((le32_to_cpu(sb->feature_map) &
 	    (MD_FEATURE_PPL | MD_FEATURE_MULTIPLE_PPLS))) {

From 15357a5ca07231c31f58b8b7f60dff0bd30433be Mon Sep 17 00:00:00 2001
From: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Date: Wed, 16 Sep 2026 07:55:36 +0000
Subject: [PATCH 1207/1982] crypto: qat - fix error source for QAT GEN6
 transmit interface faults

[ Upstream commit eeaf1ccd4c05d9c6ad67345862b36670e8e4dfc2 ]

TI_CD_PAR_STS faults were being decoded under ERRSOU1, which is
incorrect for QAT GEN6 devices. They are actually raised on ERRSOU3.

Move the handling of TI_CD_PAR_STS faults as part of the ERRSOU3 logic
and split the status bits by their actual source:

 - Bits 0-18 (TI_INT_ERR_DEVHALT) handled when a DEVHALT is signalled
   and are counted once as ADF_RAS_FATAL.
 - Bit 19 (TIMISCSTS) handled separately and counted as ADF_RAS_UNCORR.

Previously, a TI_INT_ERR_DEVHALT fault also incremented ADF_RAS_UNCORR
in addition to ADF_RAS_FATAL. Since a DEVHALT is already fatal, remove
the redundant increment.

Bits 20-25 of TI_CD_PAR_STS are unused/reserved on QAT GEN6. Remove them
from the mask.

Cc: stable@vger.kernel.org
Fixes: 7f3401d0a506 ("crypto: qat - enable RAS support for GEN6 devices")
Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../intel/qat/qat_common/adf_gen6_ras.c       | 20 +++++++++++++---
 .../intel/qat/qat_common/adf_gen6_ras.h       | 24 ++++++++++---------
 2 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
index 967253082a984b..902c4b1a23e3b1 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.c
@@ -323,14 +323,26 @@ static void adf_handle_ti_cd_par_sts(struct adf_accel_dev *accel_dev, void __iom
 	u32 ti_cd_par_sts;
 
 	ti_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
-	ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_MASK;
+	ti_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK;
 	if (ti_cd_par_sts) {
 		dev_err(&GET_DEV(accel_dev), "TI CD parity error: %#x\n", ti_cd_par_sts);
-		ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
 		ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_cd_par_sts);
 	}
 }
 
+static void adf_handle_ti_misc_cd_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
+{
+	u32 ti_misc_cd_par_sts;
+
+	ti_misc_cd_par_sts = ADF_CSR_RD(csr, ADF_GEN6_TI_CD_PAR_STS);
+	ti_misc_cd_par_sts &= ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK;
+	if (ti_misc_cd_par_sts) {
+		dev_err(&GET_DEV(accel_dev), "TI MISC CD parity error: %#x\n", ti_misc_cd_par_sts);
+		ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_UNCORR);
+		ADF_CSR_WR(csr, ADF_GEN6_TI_CD_PAR_STS, ti_misc_cd_par_sts);
+	}
+}
+
 static void adf_handle_ti_trnsb_par_sts(struct adf_accel_dev *accel_dev, void __iomem *csr)
 {
 	u32 ti_trnsb_par_sts;
@@ -367,7 +379,6 @@ static void adf_handle_ti_err(struct adf_accel_dev *accel_dev, void __iomem *csr
 	adf_handle_ti_ci_par_sts(accel_dev, csr);
 	adf_handle_ti_pullfub_par_sts(accel_dev, csr);
 	adf_handle_ti_pushfub_par_sts(accel_dev, csr);
-	adf_handle_ti_cd_par_sts(accel_dev, csr);
 	adf_handle_ti_trnsb_par_sts(accel_dev, csr);
 	adf_handle_iosfp_cmd_parerr(accel_dev, csr);
 }
@@ -591,6 +602,8 @@ static void adf_handle_timiscsts(struct adf_accel_dev *accel_dev, void __iomem *
 	if (!(errsou & ADF_GEN6_ERRSOU3_TIMISCSTS_BIT))
 		return;
 
+	adf_handle_ti_misc_cd_par_sts(accel_dev, csr);
+
 	timiscsts = ADF_CSR_RD(csr, ADF_GEN6_TIMISCSTS);
 	if (timiscsts) {
 		dev_err(&GET_DEV(accel_dev), "Fatal error in transmit interface: %#x\n",
@@ -730,6 +743,7 @@ static void adf_handle_ti_int_err_devhalt(struct adf_accel_dev *accel_dev, void
 	if (!(errsou & ADF_GEN6_ERRSOU3_TI_INT_ERR_DEVHALT_BIT))
 		return;
 
+	adf_handle_ti_cd_par_sts(accel_dev, csr);
 	dev_err(&GET_DEV(accel_dev), "DEVHALT due to a TI internal memory error\n");
 	ADF_RAS_ERR_CTR_INC(accel_dev->ras_errors, ADF_RAS_FATAL);
 }
diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
index 66ced271d17339..11f7b2986f567e 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen6_ras.h
@@ -170,23 +170,25 @@ struct adf_ras_ops;
 #define ADF_GEN6_TI_CD_PAR_ERR_MASK			0x500638
 
 /*
- * TI CD parity status mask
+ * TI CD parity status mask - TI_INT_ERR_DEVHALT bits
  * BIT(0) - BIT(15) - CtxMdRam[0:15]_sts parity status
  * BIT(16) - Leaf2ClusterRam_sts parity status
  * BIT(17) - BIT(18) - Ring2LeafRam[0:1]_sts parity status
- * BIT(19) - VirtualQ_sts parity status
- * BIT(20) - DtRdQ_sts parity status
- * BIT(21) - DtWrQ_sts parity status
- * BIT(22) - RiCmdQ_sts parity status
- * BIT(23) - BypassQ_sts parity status
- * BIT(24) - DtRdQ_sc_sts parity status
- * BIT(25) - DtWrQ_sc_sts parity status
  */
-#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+#define ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK \
 	(BIT(0) | BIT(1) | BIT(2) | BIT(3) | BIT(4) | BIT(5) | BIT(6) | \
 	 BIT(7) | BIT(8) | BIT(9) | BIT(10) | BIT(11) | BIT(12) | BIT(13) | \
-	 BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18) | BIT(19) | BIT(20) | \
-	 BIT(21) | BIT(22) | BIT(23) | BIT(24) | BIT(25))
+	 BIT(14) | BIT(15) | BIT(16) | BIT(17) | BIT(18))
+
+/*
+ * TI CD parity status mask - TIMISCSTS bit
+ * BIT(19) - VirtualQ_sts parity status
+ */
+#define ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK		BIT(19)
+
+#define ADF_GEN6_TI_CD_PAR_STS_MASK \
+	(ADF_GEN6_TI_CD_PAR_STS_TI_INT_ERR_DEVHALT_MASK | \
+	 ADF_GEN6_TI_CD_PAR_STS_TI_MISC_MASK)
 
 /* TI TRNSB parity status */
 #define ADF_GEN6_TI_TRNSB_PAR_STS			0x500648

From 4b13c56f7896907e9b4e854ea376dcd1654472d7 Mon Sep 17 00:00:00 2001
From: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Date: Fri, 18 Sep 2026 17:29:50 +0530
Subject: [PATCH 1208/1982] crypto: amlogic - Fix IRQ handler return value and
 fallthrough logic

[ Upstream commit 4b8ae2732070c5669adee2d5d3bb97b14af53a63 ]

In meson_irq_handler(), when an interrupt matches a flow but the status
register is empty, the driver prints an error but doesn't return. It
falls through the loop and incorrectly prints an `unknown irq` message.

Fix this by returning immediately. For empty status registers, return
IRQ_NONE instead of IRQ_HANDLED to avoid masking spurious interrupts and
allow the kernel to detect interrupt storms. Also use
dev_err_ratelimited() to prevent console lockups during an interrupt
storm.

Additionally, the handler returned IRQ_HANDLED for genuinely unknown
interrupts. Return IRQ_NONE instead for unhandled interrupts.

Cc: stable@vger.kernel.org
Fixes: 48fe583fe5417 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amlogic/amlogic-gxl-core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/amlogic/amlogic-gxl-core.c b/drivers/crypto/amlogic/amlogic-gxl-core.c
index 6cb33949915fe0..7194117518b9d4 100644
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -37,12 +37,13 @@ static irqreturn_t meson_irq_handler(int irq, void *data)
 				complete(&mc->chanlist[flow].complete);
 				return IRQ_HANDLED;
 			}
-			dev_err(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+			dev_err_ratelimited(mc->dev, "%s %d Got irq for flow %d but ctrl is empty\n", __func__, irq, flow);
+			return IRQ_NONE;
 		}
 	}
 
-	dev_err(mc->dev, "%s %d from unknown irq\n", __func__, irq);
-	return IRQ_HANDLED;
+	dev_err_ratelimited(mc->dev, "%s %d from unknown irq\n", __func__, irq);
+	return IRQ_NONE;
 }
 
 static struct meson_alg_template mc_algs[] = {

From 2ea0ae7e51226694f7437a2a1853b1be43a42441 Mon Sep 17 00:00:00 2001
From: Weili Qian <qianweili@huawei.com>
Date: Fri, 18 Sep 2026 20:27:20 +0800
Subject: [PATCH 1209/1982] crypto: hisilicon/hpre - fix pointer dereference
 before length check

[ Upstream commit 9770bb7d335f8f8db01e99168bbdd9ce2cb6238c ]

In hpre_rsa_drop_leading_zeros(), the loop condition dereferences *ptr
before checking *len, causing an out-of-bounds read when *len is zero.

Swap to while (*len && !**ptr) to test length first.

Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 839c1f67714369..37d5f12e0ef1cd 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -720,7 +720,7 @@ static void hpre_dh_exit_tfm(struct crypto_kpp *tfm)
 
 static void hpre_rsa_drop_leading_zeros(const char **ptr, size_t *len)
 {
-	while (!**ptr && *len) {
+	while (*len && !**ptr) {
 		(*ptr)++;
 		(*len)--;
 	}

From d6612d2b94c49f7d7e46942bb8cd9c1d0d20c544 Mon Sep 17 00:00:00 2001
From: Weili Qian <qianweili@huawei.com>
Date: Fri, 18 Sep 2026 20:27:22 +0800
Subject: [PATCH 1210/1982] crypto: hisilicon/hpre - return -EOVERFLOW for
 small ECDH output buffer

[ Upstream commit 232804a5ed70a8ace32c46d341d438aeba54bc67 ]

hpre_ecdh_msg_request_set() returns -EINVAL when the output buffer
is too small, after setting req->dst_len to the required size.
-EINVAL is misleading because the caller can retry with a larger
buffer. Return -EOVERFLOW as other kpp implementations do.

Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 37d5f12e0ef1cd..870b296d45b45f 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1460,7 +1460,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
 
 	if (req->dst_len < ctx->key_sz << 1) {
 		req->dst_len = ctx->key_sz << 1;
-		return -EINVAL;
+		return -EOVERFLOW;
 	}
 
 	tmp = kpp_request_ctx(req);

From ccfb1d79e90d56217d7c466184c6ba99747504a4 Mon Sep 17 00:00:00 2001
From: Weili Qian <qianweili@huawei.com>
Date: Fri, 18 Sep 2026 20:27:23 +0800
Subject: [PATCH 1211/1982] crypto: hisilicon/hpre - fix ECDH destination DMA
 mapping

[ Upstream commit 12d8edda8cdb41d18c4891851e25bf58be6be995 ]

hpre_ecdh_dst_data_init() rejects valid requests whose output length
does not equal ctx->key_sz << 1, and maps the user buffer using the
user-provided len instead of the hardware transfer size. Drop the
redundant length check and use ctx->key_sz << 1 for dma_map_single()
so the whole hardware output is mapped.

Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/hpre/hpre_crypto.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 870b296d45b45f..41fa978079780b 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -1520,13 +1520,13 @@ static int hpre_ecdh_dst_data_init(struct hpre_asym_request *hpre_req,
 	struct device *dev = ctx->dev;
 	dma_addr_t dma;
 
-	if (unlikely(!data || !sg_is_last(data) || len != ctx->key_sz << 1)) {
-		dev_err(dev, "data or data length is illegal!\n");
+	if (unlikely(!data || !sg_is_last(data))) {
+		dev_err(dev, "data is illegal!\n");
 		return -EINVAL;
 	}
 
 	hpre_req->dst = NULL;
-	dma = dma_map_single(dev, sg_virt(data), len, DMA_FROM_DEVICE);
+	dma = dma_map_single(dev, sg_virt(data), ctx->key_sz << 1, DMA_FROM_DEVICE);
 	if (unlikely(dma_mapping_error(dev, dma))) {
 		dev_err(dev, "dma map data err!\n");
 		return -ENOMEM;

From 97be63f3e99e53a861fb7e40a6c3bb3923c4c10b Mon Sep 17 00:00:00 2001
From: Weili Qian <qianweili@huawei.com>
Date: Fri, 18 Sep 2026 20:27:24 +0800
Subject: [PATCH 1212/1982] crypto: hisilicon/hpre - fix GFP flags for
 dma_alloc_coherent

[ Upstream commit 40ec9605cb195e065470f8f23ef94b1b541411a3 ]

The HPRE driver hard-codes GFP_ATOMIC for RSA/DH and GFP_KERNEL for
ECDH. This may cause "scheduling while atomic" in atomic context or
unnecessary allocation failures under memory pressure.

Select GFP flags dynamically based on CRYPTO_TFM_REQ_MAY_SLEEP and
store them in hpre_asym_request::flags. The areq field is a union of
rsa/dh/ecdh request pointers; reading base.flags through any union
member other than the one that was written would be type-punning, so
a dedicated flags field avoids that.

Fixes: 98dfa9343f37 ("crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq")
Cc: stable@vger.kernel.org
Signed-off-by: Weili Qian <qianweili@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/hpre/hpre_crypto.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index 41fa978079780b..af5d10add106cf 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -138,6 +138,7 @@ struct hpre_asym_request {
 	int err;
 	hpre_cb cb;
 	struct timespec64 req_time;
+	u32 flags;
 };
 
 static inline unsigned int hpre_align_sz(void)
@@ -186,6 +187,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
 				struct scatterlist *data, unsigned int len,
 				int is_src, dma_addr_t *tmp)
 {
+	gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
 	struct hpre_ctx *ctx = hpre_req->ctx;
 	struct device *dev = ctx->dev;
 	void *ptr;
@@ -195,7 +197,7 @@ static int hpre_prepare_dma_buf(struct hpre_asym_request *hpre_req,
 	if (unlikely(shift < 0))
 		return -EINVAL;
 
-	ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, GFP_ATOMIC);
+	ptr = dma_alloc_coherent(dev, ctx->key_sz, tmp, gfp);
 	if (unlikely(!ptr))
 		return -ENOMEM;
 
@@ -419,6 +421,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
 		h_req = PTR_ALIGN(tmp, hpre_align_sz());
 		h_req->cb = hpre_rsa_cb;
 		h_req->areq.rsa = akreq;
+		h_req->flags = akreq->base.flags;
 		msg = &h_req->req;
 		memset(msg, 0, sizeof(*msg));
 	} else {
@@ -433,6 +436,7 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
 		h_req = PTR_ALIGN(tmp, hpre_align_sz());
 		h_req->cb = hpre_dh_cb;
 		h_req->areq.dh = kreq;
+		h_req->flags = kreq->base.flags;
 		msg = &h_req->req;
 		memset(msg, 0, sizeof(*msg));
 		msg->key = cpu_to_le64(ctx->dh.dma_xa_p);
@@ -1467,6 +1471,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
 	h_req = PTR_ALIGN(tmp, hpre_align_sz());
 	h_req->cb = hpre_ecdh_cb;
 	h_req->areq.ecdh = req;
+	h_req->flags = req->base.flags;
 	msg = &h_req->req;
 	memset(msg, 0, sizeof(*msg));
 	msg->in = cpu_to_le64(DMA_MAPPING_ERROR);
@@ -1485,6 +1490,7 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
 static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
 				   struct scatterlist *data, unsigned int len)
 {
+	gfp_t gfp = hpre_req->flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
 	struct hpre_sqe *msg = &hpre_req->req;
 	struct hpre_ctx *ctx = hpre_req->ctx;
 	struct device *dev = ctx->dev;
@@ -1498,7 +1504,7 @@ static int hpre_ecdh_src_data_init(struct hpre_asym_request *hpre_req,
 	if (unlikely(shift < 0))
 		return -EINVAL;
 
-	ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, GFP_KERNEL);
+	ptr = dma_alloc_coherent(dev, ctx->key_sz << 2, &dma, gfp);
 	if (unlikely(!ptr))
 		return -ENOMEM;
 

From dd443f07c3fdfbdc1a02bda1648089a51d05e123 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 19 Sep 2026 07:49:34 +0200
Subject: [PATCH 1213/1982] crypto: qat - zero the VF migration state buffer on
 save

[ Upstream commit 5d504e65516dde8c88117378292e9c78f3d2cf58 ]

The QAT VF migration state buffer is allocated with kmalloc(), while
qat_vf_save_state() exposes all state_size bytes to userspace. The state
manager writes only the serialized sections, leaving the unused tail
unchanged. The first save can therefore disclose stale heap contents,
and subsequent saves can disclose data left by an earlier migration.

Zero the whole buffer before writing the setup data. Once the setup data
is present, preserve it and zero the remaining state area before each
state save.

Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
index adb21656a3ba86..91eff18a505b77 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c
@@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev *mdev)
 		return ret;
 	}
 
+	memset(mdev->state + mdev->setup_size, 0,
+	       mdev->state_size - mdev->setup_size);
+
 	adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size,
 			    mdev->state_size - mdev->setup_size);
 	if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
@@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev *mdev)
 	if (mdev->setup_size)
 		return 0;
 
+	memset(mdev->state, 0, mdev->state_size);
+
 	adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size);
 	if (!adf_mstate_preamble_add(vfmig->mstate_mgr))
 		return -EINVAL;

From 5c474f8dea049c9566c37412a6dd1d57bf438e5d Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <hppiscas@163.com>
Date: Sun, 20 Sep 2026 11:40:10 +0800
Subject: [PATCH 1214/1982] media: cec: extron: clear response tail before
 dispatch

[ Upstream commit a601427f03e015e3d4d2ba44cfa6e0de144983b9 ]

The serial receive buffer is reused between responses. Terminating a
short response with one NUL leaves bytes from the previous response
behind it, while the dispatcher also checks fixed offsets beyond some
prefixes. Those checks can consume stale tail bytes.

Clear up to ten bytes at the end of each completed response, limited by
the remaining array capacity. This includes the terminator and covers
the dispatcher's fixed-offset tests without adding a separate length
condition to every prefix branch.

The issue was found by our static-analysis tool.

Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
Cc: stable@vger.kernel.org
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
index 48410ce33490c4..638def4cb5691f 100644
--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
+++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c
@@ -846,7 +846,9 @@ static irqreturn_t extron_interrupt(struct serio *serio, unsigned char data,
 			return IRQ_HANDLED;
 		memcpy(extron->data, extron->buf, extron->idx);
 		extron->len = extron->idx;
-		extron->data[extron->len] = 0;
+		/* Keep fixed-offset response tests from using stale tail bytes. */
+		memset(extron->data + extron->len, 0,
+		       min_t(size_t, 10, sizeof(extron->data) - extron->len));
 		if (debug)
 			dev_info(extron->dev, "received %s\n", extron->data);
 		extron->idx = 0;

From 90379d750ee6146b8ccaf28d00e98f7708b074fd Mon Sep 17 00:00:00 2001
From: Rohinthan P <rokinthanp03@gmail.com>
Date: Sat, 19 Sep 2026 07:41:09 +0530
Subject: [PATCH 1215/1982] media: v4l2-ctrls: do nothing if controls[0] ==
 NULL in cluster functions

[ Upstream commit 9ff738f93084351ed6e818d4d58679a9e9083a8d ]

The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.

However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:

      ncontrols == 0 || controls[0] == NULL
      WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at v4l2_ctrl_cluster

Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.

Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.

Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Cc: stable@vger.kernel.org
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: simplified the v4l2_ctrl_auto_cluster code a bit]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-ctrls-core.c | 12 ++++++++++--
 include/media/v4l2-ctrls.h                |  6 ++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 02e2ae93d17648..579787f0be3513 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2431,7 +2431,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
 	int i;
 
 	/* The first control is the master control and it must not be NULL */
-	if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+	if (WARN_ON(ncontrols == 0))
+		return;
+
+	if (!controls[0])
 		return;
 
 	for (i = 0; i < ncontrols; i++) {
@@ -2453,8 +2456,13 @@ void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
 	u32 flag = 0;
 	int i;
 
+	if (WARN_ON(ncontrols <= 1))
+		return;
+
+	if (!master)
+		return;
+
 	v4l2_ctrl_cluster(ncontrols, controls);
-	WARN_ON(ncontrols <= 1);
 	WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
 	WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
 	master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index 31fc1bee3797bf..b900734ee9c1ce 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,9 @@ bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl);
  *
  * @ncontrols:	The number of controls in this cluster.
  * @controls:	The cluster control array of size @ncontrols.
+ *
+ *		If controls[0] is NULL, then this function does nothing and just
+ *		returns.
  */
 void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
 
@@ -845,6 +848,9 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
  * @ncontrols:	The number of controls in this cluster.
  * @controls:	The cluster control array of size @ncontrols. The first control
  *		must be the 'auto' control (e.g. autogain, autoexposure, etc.)
+ *
+ *		If controls[0] is NULL, then this function does nothing and just
+ *		returns.
  * @manual_val: The value for the first control in the cluster that equals the
  *		manual setting.
  * @set_volatile: If true, then all controls except the first auto control will

From d7a14af8ba0f538ba1e4d7fe42e75b7685036494 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 11 Sep 2026 13:55:37 -0400
Subject: [PATCH 1216/1982] media: marvell: manage the MMP camera clock
 provider

[ Upstream commit 9887716132d6c3c58cc67841dfb441c5a4a0d209 ]

mmpcam_probe() registers an OF clock provider before requesting the IRQ.
Neither a later probe failure nor driver removal unregisters that provider,
although the underlying clock is registered with devm_clk_register().
This leaves the provider referring to a clock whose lifetime has ended.

Use devm_of_clk_add_hw_provider() with the existing mclk_hw so the provider
is unregistered before the managed clock and camera storage are released.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:GPT-5.6
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/marvell/mmp-driver.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/marvell/mmp-driver.c b/drivers/media/platform/marvell/mmp-driver.c
index d3da7ebb4a2be6..4c31b62751a12a 100644
--- a/drivers/media/platform/marvell/mmp-driver.c
+++ b/drivers/media/platform/marvell/mmp-driver.c
@@ -25,6 +25,7 @@
 #include <linux/list.h>
 #include <linux/pm.h>
 #include <linux/clk.h>
+#include <linux/clk-provider.h>
 
 #include "mcam-core.h"
 
@@ -269,8 +270,8 @@ static int mmpcam_probe(struct platform_device *pdev)
 	/*
 	 * Add OF clock provider.
 	 */
-	ret = of_clk_add_provider(pdev->dev.of_node, of_clk_src_simple_get,
-								mcam->mclk);
+	ret = devm_of_clk_add_hw_provider(&pdev->dev, of_clk_hw_simple_get,
+					  &mcam->mclk_hw);
 	if (ret) {
 		dev_err(&pdev->dev, "can't add DT clock provider\n");
 		goto out;

From 50983f1424034fed18dde43b84f69f7d64f5729a Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sun, 13 Sep 2026 18:33:13 -0400
Subject: [PATCH 1217/1982] media: go7007: unregister the I2C adapter on USB
 probe failure

[ Upstream commit 14165cd16fa7c233aec6a407b56b304e7a283911 ]

USB probe failures after I2C adapter registration free the backing
go7007 structure without unregistering the adapter.

If i2c_adapter_online is set, unregister the adapter before releasing
USB resources so that I2C client removal can still use its callbacks.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 59aea928d57f ("[media] go7007: don't continue if firmware can't be loaded")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index bf3cf320b2c9cd..ad9cc44660dd39 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1326,6 +1326,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
 	return 0;
 
 allocfail:
+	if (go->i2c_adapter_online)
+		i2c_del_adapter(&go->i2c_adapter);
 	go7007_usb_release(go);
 	kfree(go);
 	return -ENOMEM;

From 3f87db958c388c0ba2b6c06a9d8ea4ea11b04682 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sun, 13 Sep 2026 22:28:08 -0400
Subject: [PATCH 1218/1982] media: cx18: Disable PCI device on probe failure

[ Upstream commit 2aefbc29765641e1e1a26b96cee194ac7d34ff49 ]

cx18_setup_pci() enables the PCI device but does not disable it when
DMA mask setup or the memory-region reservation fails. Later probe
failure paths release the region without balancing the enable either.

Unwind the enable inside cx18_setup_pci() when that helper fails after
enabling the device. Once setup succeeds, disable it in the probe
cleanup after releasing the memory region. Setup failures skip that
cleanup, so each successful enable is balanced exactly once.

Keep the existing error codes and normal removal path unchanged.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Assisted-by: OpenAI:GPT-5.6
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx18/cx18-driver.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
index 74c59a94b2b051..d3bd31e38efa4f 100644
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -806,12 +806,12 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
 	}
 	if (dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32))) {
 		CX18_ERR("No suitable DMA available, card %d\n", cx->instance);
-		return -EIO;
+		goto err_disable_device;
 	}
 	if (!request_mem_region(cx->base_addr, CX18_MEM_SIZE, "cx18 encoder")) {
 		CX18_ERR("Cannot request encoder memory region, card %d\n",
 			 cx->instance);
-		return -EIO;
+		goto err_disable_device;
 	}
 
 	/* Enable bus mastering and memory mapped IO for the CX23418 */
@@ -835,6 +835,10 @@ static int cx18_setup_pci(struct cx18 *cx, struct pci_dev *pci_dev,
 		   cx->pci_dev->irq, pci_latency, (u64)cx->base_addr);
 
 	return 0;
+
+err_disable_device:
+	pci_disable_device(pci_dev);
+	return -EIO;
 }
 
 static void cx18_init_subdevs(struct cx18 *cx)
@@ -1121,6 +1125,7 @@ static int cx18_probe(struct pci_dev *pci_dev,
 	cx18_iounmap(cx);
 free_mem:
 	release_mem_region(cx->base_addr, CX18_MEM_SIZE);
+	pci_disable_device(pci_dev);
 free_workqueues:
 	destroy_workqueue(cx->in_work_queue);
 err:

From dafdecfc883d4f266dc8128a640a32bcd14440ab Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Mon, 14 Sep 2026 21:11:05 -0400
Subject: [PATCH 1219/1982] media: tw68: balance PCI enable on cleanup

[ Upstream commit fc02261fdca3ea95e4dcb6b38ab77f0f197c3750 ]

tw68_initdev() leaves the PCI device enabled after a later probe failure
or tw68_finidev(). Use pcim_enable_device() to balance the enable reference
when the driver is detached or probe fails.

The managed disable runs after the managed IRQ has been released.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: e15d1c12c587 ("[media] tw68: refactor and cleanup the tw68 driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/tw68/tw68-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index 08b7ce1043aafc..27ce670197cc38 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -228,7 +228,7 @@ static int tw68_initdev(struct pci_dev *pci_dev,
 
 	/* pci init */
 	dev->pci = pci_dev;
-	if (pci_enable_device(pci_dev)) {
+	if (pcim_enable_device(pci_dev)) {
 		err = -EIO;
 		goto fail1;
 	}

From fe100b9f57a6a5ba65d7418527d1c16452de4f55 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Tue, 15 Sep 2026 16:26:38 +0800
Subject: [PATCH 1220/1982] media: adv7180: Initialize mutex before ancillary
 clients

[ Upstream commit 9d46d17a65e86010b1f5604e5cf61ce1e197f77a ]

The VPP ancillary-client error path unregisters the CSI client before
destroying state->mutex. For I2P variants, the failure can occur before
mutex_init(), so cleanup destroys an uninitialized mutex.

Initialize the mutex immediately after allocating the driver state, before
creating any ancillary clients. This keeps every cleanup path matched with
a completed mutex initialization.

A QEMU x86_64 test using an i2c-stub bus instantiated an ADV7280 client
at address 0x21 and occupied its VPP ancillary address 0x42. This forced
i2c_new_ancillary_device() to return -EBUSY. An instrumentation oracle
observed an uninitialized mutex on the buggy kernel and an initialized
mutex on the fixed kernel. The failure was deliberately injected to
exercise the error path; no natural crash was observed.

Fixes: 851a54effbd8 ("[media] adv7180: Add I2P support")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/adv7180.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 5cbc973df684d1..6223911e324ae3 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1425,6 +1425,7 @@ static int adv7180_probe(struct i2c_client *client)
 	if (state == NULL)
 		return -ENOMEM;
 
+	mutex_init(&state->mutex);
 	state->client = client;
 	state->field = V4L2_FIELD_ALTERNATE;
 	state->chip_info = i2c_get_match_data(client);
@@ -1466,7 +1467,6 @@ static int adv7180_probe(struct i2c_client *client)
 	}
 
 	state->irq = client->irq;
-	mutex_init(&state->mutex);
 	state->curr_norm = V4L2_STD_NTSC;
 
 	state->input = 0;

From 638d1d3b9d619a74e5a0527a707e73e9d5aac7e1 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 09:54:43 +0000
Subject: [PATCH 1221/1982] media: au0828: Fix media device leak in
 au0828_usb_probe()

[ Upstream commit 7b7a69c91c0537d48150942d9707614a4fdd3766 ]

au0828_media_device_init() takes a reference to a media device with
media_device_usb_allocate().  When au0828_v4l2_device_register()
fails right after, the error path only unregisters the entities and
frees au0828_dev, so that reference is never released.

Release it with media_device_delete() on that path.

Fixes: 812658d88d26 ("media: change au0828 to use Media Device Allocator API")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/au0828/au0828-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
index 1e246b47766dd5..c7ff52044bd257 100644
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -697,6 +697,10 @@ static int au0828_usb_probe(struct usb_interface *interface,
 	retval = au0828_v4l2_device_register(interface, dev);
 	if (retval) {
 		au0828_usb_v4l2_media_release(dev);
+#ifdef CONFIG_MEDIA_CONTROLLER
+		media_device_delete(dev->media_dev, KBUILD_MODNAME,
+				    THIS_MODULE);
+#endif
 		mutex_unlock(&dev->lock);
 		kfree(dev);
 		return retval;

From 163306dbd27e1c35dbaefb2f3289d47caa73bc07 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:12:22 +0000
Subject: [PATCH 1222/1982] media: vpif_capture: Fix i2c adapter reference leak
 in vpif_probe()

[ Upstream commit b00fbdad64d4ea7d594bc67988c1722fe5b3be50 ]

vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.

Release the reference with i2c_put_adapter() on the success path
and in the probe_subdev_out cleanup, and initialise i2c_adap so
that the cleanup is a no-op when the adapter was never acquired.

Fixes: 6ffefff5a9e7 ("V4L/DVB (12906c): V4L : vpif capture driver for DM6467")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/ti/davinci/vpif_capture.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/ti/davinci/vpif_capture.c b/drivers/media/platform/ti/davinci/vpif_capture.c
index 9fbef24025744e..5158417fe603eb 100644
--- a/drivers/media/platform/ti/davinci/vpif_capture.c
+++ b/drivers/media/platform/ti/davinci/vpif_capture.c
@@ -1603,7 +1603,7 @@ vpif_capture_get_pdata(struct platform_device *pdev,
 static int vpif_probe(struct platform_device *pdev)
 {
 	struct vpif_subdev_info *subdevdata;
-	struct i2c_adapter *i2c_adap;
+	struct i2c_adapter *i2c_adap = NULL;
 	int subdev_count;
 	int res_idx = 0;
 	int i, err;
@@ -1693,9 +1693,12 @@ static int vpif_probe(struct platform_device *pdev)
 		}
 	}
 
+	i2c_put_adapter(i2c_adap);
+
 	return 0;
 
 probe_subdev_out:
+	i2c_put_adapter(i2c_adap);
 	v4l2_async_nf_cleanup(&vpif_obj.notifier);
 	/* free sub devices memory */
 	kfree(vpif_obj.sd);

From 38a49d04e16f932f2ab08e70adbe5425d96653b7 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:13:47 +0000
Subject: [PATCH 1223/1982] media: vpif_display: Fix i2c adapter reference leak
 in vpif_probe()

[ Upstream commit f5863ea3f99265e5e297e3dcf0f47432fee2b8ac ]

vpif_probe() takes a reference to the i2c adapter with
i2c_get_adapter() and passes it to v4l2_i2c_new_subdev_board(),
which does not consume it, but the reference is never released, so
it is leaked both when the probe succeeds and when it fails after
the adapter has been acquired.

Release the reference with i2c_put_adapter() on the success path and
in the probe_subdev_out cleanup.

Fixes: e7332e3a552f ("V4L/DVB (12176): davinci/vpif_display: Add VPIF display driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/ti/davinci/vpif_display.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/ti/davinci/vpif_display.c b/drivers/media/platform/ti/davinci/vpif_display.c
index 1e7815e9f8e075..ba16370b70f983 100644
--- a/drivers/media/platform/ti/davinci/vpif_display.c
+++ b/drivers/media/platform/ti/davinci/vpif_display.c
@@ -1289,9 +1289,12 @@ static int vpif_probe(struct platform_device *pdev)
 	if (err)
 		goto probe_subdev_out;
 
+	i2c_put_adapter(i2c_adap);
+
 	return 0;
 
 probe_subdev_out:
+	i2c_put_adapter(i2c_adap);
 	kfree(vpif_obj.sd);
 vpif_unregister:
 	v4l2_device_unregister(&vpif_obj.v4l2_dev);

From 76e42a29a8b520ef806b67ae99c1e76027a9aa84 Mon Sep 17 00:00:00 2001
From: Lucas Sinn <lucas.sinn@wolfvision.net>
Date: Mon, 21 Sep 2026 09:15:33 +0200
Subject: [PATCH 1224/1982] media: synopsys: hdmirx: fetch colordepth before
 calculating pixelclock

[ Upstream commit e8554ac860356f1f4cd9bce454271dce1ed35fc1 ]

hdmirx_get_detected_timings() divides the TMDS clock by
hdmirx_dev->color_depth, but nothing on its own path ever sets it. The
only producer is hdmirx_get_colordepth(), reached solely from
hdmirx_format_change() at the tail of hdmirx_wait_signal_lock().

VIDIOC_QUERY_DV_TIMINGS does not come through there. It only refuses to
proceed while signal_not_lock() is true, and that reads the lock state
straight out of the hardware, so it can already be false while the work
ending in hdmirx_format_change() has yet to run. Query the timings in
that window, on the first lock after a boot, and color_depth is still
zero from devm_kzalloc().

The division does not fault. do_div() is plain C on 64 bit and arm64
compiles it to udiv, which returns zero for a zero divisor. What comes
out is a pixelclock of zero, and a stitched output frame.

Read the colordepth where it is used instead.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Lucas Sinn <lucas.sinn@wolfvision.net>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/synopsys/hdmirx/snps_hdmirx.c    | 71 ++++++++++---------
 1 file changed, 36 insertions(+), 35 deletions(-)

diff --git a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
index dbbd33f5908e58..22a5e137f5b6db 100644
--- a/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
+++ b/drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
@@ -154,7 +154,6 @@ struct snps_hdmirx_dev {
 	int num_clks;
 	u32 edid_blocks_written;
 	u32 cur_fmt_fourcc;
-	u32 color_depth;
 	spinlock_t rst_lock; /* to lock register access */
 	u8 edid[EDID_NUM_BLOCKS_MAX * EDID_BLOCK_SIZE];
 };
@@ -378,6 +377,38 @@ static void hdmirx_toggle_polarity(struct snps_hdmirx_dev *hdmirx_dev)
 			   VPROC_HSYNC_POL_OVR_EN, 0);
 }
 
+static u32 hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
+{
+	struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
+	u32 val, color_depth_reg, color_depth;
+
+	val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
+	color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
+
+	switch (color_depth_reg) {
+	case 0x4:
+		color_depth = 24;
+		break;
+	case 0x5:
+		color_depth = 30;
+		break;
+	case 0x6:
+		color_depth = 36;
+		break;
+	case 0x7:
+		color_depth = 48;
+		break;
+	default:
+		color_depth = 24;
+		break;
+	}
+
+	v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
+		 __func__, color_depth, color_depth_reg);
+
+	return color_depth;
+}
+
 /*
  * When querying DV timings during preview, if the DMA's timing is stable,
  * we retrieve the timings directly from the DMA. However, if the current
@@ -391,7 +422,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
 	struct v4l2_bt_timings *bt = &timings->bt;
 	u32 val, tmdsqpclk_freq, pix_clk;
 	unsigned int num_retries = 0;
-	u32 field_type, deframer_st;
+	u32 field_type, deframer_st, color_depth;
 	u64 tmp_data, tmds_clk;
 	bool is_dvi_mode;
 	int ret;
@@ -412,10 +443,11 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
 	deframer_st = hdmirx_readl(hdmirx_dev, DEFRAMER_STATUS);
 	is_dvi_mode = !(deframer_st & OPMODE_STS_MASK);
 
+	color_depth = hdmirx_get_colordepth(hdmirx_dev);
 	tmdsqpclk_freq = hdmirx_readl(hdmirx_dev, CMU_TMDSQPCLK_FREQ);
 	tmds_clk = tmdsqpclk_freq * 4 * 1000;
 	tmp_data = tmds_clk * 24;
-	do_div(tmp_data, hdmirx_dev->color_depth);
+	do_div(tmp_data, color_depth);
 	pix_clk = tmp_data;
 	bt->pixelclock = pix_clk;
 
@@ -427,7 +459,7 @@ static int hdmirx_get_detected_timings(struct snps_hdmirx_dev *hdmirx_dev,
 	v4l2_dbg(2, debug, v4l2_dev, "tmds_clk:%llu, pix_clk:%d\n", tmds_clk, pix_clk);
 	v4l2_dbg(1, debug, v4l2_dev, "interlace:%d, fmt:%d, color:%d, mode:%s\n",
 		 bt->interlaced, hdmirx_dev->pix_fmt,
-		 hdmirx_dev->color_depth,
+		 color_depth,
 		 is_dvi_mode ? "dvi" : "hdmi");
 	v4l2_dbg(2, debug, v4l2_dev, "deframer_st:%#x\n", deframer_st);
 
@@ -947,36 +979,6 @@ static void hdmirx_controller_init(struct snps_hdmirx_dev *hdmirx_dev)
 			   VS_REMAPFILTER_EN_QST | VS_FILTER_ORDER_QST(0x3));
 }
 
-static void hdmirx_get_colordepth(struct snps_hdmirx_dev *hdmirx_dev)
-{
-	struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
-	u32 val, color_depth_reg;
-
-	val = hdmirx_readl(hdmirx_dev, DMA_STATUS11);
-	color_depth_reg = (val & HDMIRX_COLOR_DEPTH_MASK) >> 3;
-
-	switch (color_depth_reg) {
-	case 0x4:
-		hdmirx_dev->color_depth = 24;
-		break;
-	case 0x5:
-		hdmirx_dev->color_depth = 30;
-		break;
-	case 0x6:
-		hdmirx_dev->color_depth = 36;
-		break;
-	case 0x7:
-		hdmirx_dev->color_depth = 48;
-		break;
-	default:
-		hdmirx_dev->color_depth = 24;
-		break;
-	}
-
-	v4l2_dbg(1, debug, v4l2_dev, "%s: color_depth: %d, reg_val:%d\n",
-		 __func__, hdmirx_dev->color_depth, color_depth_reg);
-}
-
 static void hdmirx_get_pix_fmt(struct snps_hdmirx_dev *hdmirx_dev)
 {
 	struct v4l2_device *v4l2_dev = &hdmirx_dev->v4l2_dev;
@@ -1087,7 +1089,6 @@ static void hdmirx_format_change(struct snps_hdmirx_dev *hdmirx_dev)
 	};
 
 	hdmirx_get_pix_fmt(hdmirx_dev);
-	hdmirx_get_colordepth(hdmirx_dev);
 	hdmirx_get_avi_infoframe(hdmirx_dev);
 
 	v4l2_dbg(1, debug, v4l2_dev, "%s: queue res_chg_event\n", __func__);

From 4f5219843098889ac4013e8a47873e98270b7041 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 19:25:10 +0800
Subject: [PATCH 1225/1982] media: atmel-isi: release unregistered video device
 on remove

[ Upstream commit c0a6d78dad3af1def80f04df82bfd70456ec406c ]

atmel_isi_probe() allocates the video device before registering the
V4L2 async notifier. The video device is registered later from the
notifier complete callback once the remote subdevice has been bound.

The remove path relies on the notifier unbind callback to unregister
the video device. However, if the remote subdevice is never bound, or
the complete callback fails before video_register_device() succeeds,
the video device remains unregistered. In that case the unbind path
does not release the object allocated by video_device_alloc(), and the
remove path leaks it.

Only unregister the video device from the unbind callback when it has
actually been registered, and clear the driver pointer afterwards.
After unregistering and cleaning up the notifier, release the video
device directly if the pointer is still present. This covers devices
that were allocated but never registered while avoiding a second
release of successfully registered devices.

This issue was found by manual code inspection.

Fixes: d12c9088c0b2a ("[media] atmel-isi: remove dependency of the soc-camera framework")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/atmel/atmel-isi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
index a05a744cbb7569..6a7e240c5b180a 100644
--- a/drivers/media/platform/atmel/atmel-isi.c
+++ b/drivers/media/platform/atmel/atmel-isi.c
@@ -1121,10 +1121,13 @@ static void isi_graph_notify_unbind(struct v4l2_async_notifier *notifier,
 {
 	struct atmel_isi *isi = notifier_to_isi(notifier);
 
+	if (!video_is_registered(isi->vdev))
+		return;
+
 	dev_dbg(isi->dev, "Removing %s\n", video_device_node_name(isi->vdev));
 
-	/* Checks internally if vdev have been init or not */
 	video_unregister_device(isi->vdev);
+	isi->vdev = NULL;
 }
 
 static int isi_graph_notify_bound(struct v4l2_async_notifier *notifier,
@@ -1323,6 +1326,8 @@ static void atmel_isi_remove(struct platform_device *pdev)
 	pm_runtime_disable(&pdev->dev);
 	v4l2_async_nf_unregister(&isi->notifier);
 	v4l2_async_nf_cleanup(&isi->notifier);
+	if (isi->vdev)
+		video_device_release(isi->vdev);
 	v4l2_device_unregister(&isi->v4l2_dev);
 }
 

From d0e4425481132ee2fc4f13c44755106513ee9299 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Wed, 23 Sep 2026 01:40:17 -0400
Subject: [PATCH 1226/1982] ASoC: fsl_xcvr: free IRQ before canceling reset
 work

[ Upstream commit 83701fdb2d8d644c547773791da48d6ecb3a5e1d ]

irq0_isr() schedules work_rst on a preamble error, and reset_rx_work()
touches regmap.  remove() cancels that work while the IRQ is still
registered, so the handler can queue it again during teardown.  The IRQ
is also requested before INIT_WORK() and spin_lock_init().  Probe
failure does not call remove(), so freeing the IRQ leaves queued work
running, and an earlier interrupt schedules uninitialized work.

Initialize the lock and devm_work_autocancel() before the IRQ.  Failed
probe then frees the IRQ and cancels the work.  Unbind frees the IRQ
before cancel_work_sync() and pm_runtime_disable().

Fixes: 1e5d0f106164 ("ASoC: fsl_xcvr: reset RX dpath after wrong preamble")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://patch.msgid.link/20260923054017.93553-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_xcvr.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
index d7a823384c08ae..08683f989cee20 100644
--- a/sound/soc/fsl/fsl_xcvr.c
+++ b/sound/soc/fsl/fsl_xcvr.c
@@ -3,6 +3,7 @@
 
 #include <linux/bitrev.h>
 #include <linux/clk.h>
+#include <linux/devm-helpers.h>
 #include <linux/firmware.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
@@ -57,6 +58,7 @@ struct fsl_xcvr {
 	struct snd_aes_iec958 tx_iec958;
 	u8 cap_ds[FSL_XCVR_CAPDS_SIZE];
 	struct work_struct work_rst;
+	int irq;
 	spinlock_t lock; /* Protect hw_reset and trigger */
 	struct snd_pcm_hw_constraint_list spdif_constr_rates;
 	u32 spdif_constr_rates_list[SPDIF_NUM_RATES];
@@ -1555,7 +1557,7 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
 	struct fsl_xcvr *xcvr;
 	struct resource *rx_res, *tx_res;
 	void __iomem *regs;
-	int ret, irq;
+	int ret;
 
 	xcvr = devm_kzalloc(dev, sizeof(*xcvr), GFP_KERNEL);
 	if (!xcvr)
@@ -1643,12 +1645,22 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
 		return dev_err_probe(dev, PTR_ERR(xcvr->reset),
 				     "failed to get XCVR reset control\n");
 
+	/*
+	 * irq0_isr() schedules work_rst. Prepare the work and its lock
+	 * before the IRQ, and register the cancel action first so a failed
+	 * probe frees the IRQ and then cancels any queued work.
+	 */
+	spin_lock_init(&xcvr->lock);
+	ret = devm_work_autocancel(dev, &xcvr->work_rst, reset_rx_work);
+	if (ret)
+		return ret;
+
 	/* get IRQs */
-	irq = platform_get_irq(pdev, 0);
-	if (irq < 0)
-		return irq;
+	xcvr->irq = platform_get_irq(pdev, 0);
+	if (xcvr->irq < 0)
+		return xcvr->irq;
 
-	ret = devm_request_irq(dev, irq, irq0_isr, 0, pdev->name, xcvr);
+	ret = devm_request_irq(dev, xcvr->irq, irq0_isr, 0, pdev->name, xcvr);
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to claim IRQ0\n");
 
@@ -1689,8 +1701,6 @@ static int fsl_xcvr_probe(struct platform_device *pdev)
 			fsl_xcvr_comp.name);
 	}
 
-	INIT_WORK(&xcvr->work_rst, reset_rx_work);
-	spin_lock_init(&xcvr->lock);
 	return ret;
 }
 
@@ -1698,6 +1708,8 @@ static void fsl_xcvr_remove(struct platform_device *pdev)
 {
 	struct fsl_xcvr *xcvr = dev_get_drvdata(&pdev->dev);
 
+	/* Free the IRQ first so irq0_isr() cannot requeue work_rst. */
+	devm_free_irq(&pdev->dev, xcvr->irq, xcvr);
 	cancel_work_sync(&xcvr->work_rst);
 	pm_runtime_disable(&pdev->dev);
 }

From 423c58547179873f708b962122fa47308769fcb8 Mon Sep 17 00:00:00 2001
From: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Date: Thu, 17 Sep 2026 17:59:25 -0600
Subject: [PATCH 1227/1982] memory: stm32_omm: fix child clock leak on
 set_amcr() error path

[ Upstream commit a22355280361d2a376a2020059a2bae11e6cea10 ]

When the mux is enabled, stm32_omm_configure() enables the two OSPI
child clocks via stm32_omm_toggle_child_clock(dev, true); they are meant
to stay enabled for the device's lifetime and are disabled again in
stm32_omm_remove() and on the devm_of_platform_populate() error path.

However, if the subsequent stm32_omm_set_amcr() call fails, the function
jumps to the "error:" label which only calls pm_runtime_put_sync_suspend()
before returning, leaving the two child clocks enabled. As this happens
during probe, the error is propagated and .remove() is never called, so
the clock enable references are leaked. devm_clk_bulk_get() only releases
the clock handles on unwind, it does not undo clk_prepare_enable().

Disable the child clocks on the set_amcr() error path, mirroring the
cleanup already done on the devm_of_platform_populate() failure path.

Fixes: 8181d061dcff ("memory: Add STM32 Octo Memory Manager driver")
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Link: https://patch.msgid.link/20260917235925.44185-1-diegomancera.dev@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/stm32_omm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memory/stm32_omm.c b/drivers/memory/stm32_omm.c
index 2a1af229d24445..faef9033424952 100644
--- a/drivers/memory/stm32_omm.c
+++ b/drivers/memory/stm32_omm.c
@@ -275,6 +275,8 @@ static int stm32_omm_configure(struct device *dev)
 	writel_relaxed(omm->cr, omm->io_base + OMM_CR);
 
 	ret = stm32_omm_set_amcr(dev, true);
+	if (ret && (mux & CR_MUXEN))
+		stm32_omm_toggle_child_clock(dev, false);
 
 error:
 	pm_runtime_put_sync_suspend(dev);

From f9077408c7653299199da84788da25c80e604341 Mon Sep 17 00:00:00 2001
From: Francesco Dolcini <francesco.dolcini@toradex.com>
Date: Wed, 16 Sep 2026 10:40:22 +0200
Subject: [PATCH 1228/1982] arm64: dts: freescale: imx8mm-verdin-ivy: fix
 DIGI_1/DIGI_2 gpio-line-names

[ Upstream commit 28cec01a2be2cf1e20aabd435f250f665ce24c8e ]

gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.

GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.

Fixes: adca46171ff7 ("arm64: dts: freescale: imx8mm-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
index 29075ff5eda63b..b64751aa31d50e 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-ivy.dtsi
@@ -270,8 +270,8 @@
 		"",
 		"",
 		"",
-		"DIG_1", /* SODIMM 56 */
-		"DIG_2", /* SODIMM 58 */
+		"DIGI_1", /* SODIMM 56 */
+		"DIGI_2", /* SODIMM 58 */
 		"REL1",  /* SODIMM 60 */
 		"REL2",  /* SODIMM 62 */
 		"", /* 10 */

From f2c6b74e201d3997a454f59bb94e471df5a22cef Mon Sep 17 00:00:00 2001
From: Francesco Dolcini <francesco.dolcini@toradex.com>
Date: Wed, 16 Sep 2026 10:40:23 +0200
Subject: [PATCH 1229/1982] arm64: dts: freescale: imx8mp-verdin-ivy: fix
 DIGI_1/DIGI_2 gpio-line-names

[ Upstream commit cb45264c27fad31f7c58fbb1a5c2f7ec16018dae ]

gpio3's gpio-line-names names the two Ivy digital inputs "DIG_1" and
"DIG_2", while the official Ivy Carrier Board datasheet (Section 2.10,
Table 12) names them DIGI_1 and DIGI_2, matching the
k3-am62-verdin-ivy.dtsi variant for the same carrier board pins.

GPIO line names are meant to be stable across the whole Verdin family
and its carrier boards, so userspace GPIO tooling that looks up a line
by name works the same regardless of which Verdin SoM is fitted on
Ivy.

Fixes: b98948b04295 ("arm64: dts: freescale: imx8mp-verdin: Add Ivy carrier board")
Cc: stable@vger.kernel.org
Link: https://docs.toradex.com/116799-ivy_carrier_board_datasheet.pdf
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
index db1b4ee7728c07..bf021e85cfc942 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-ivy.dtsi
@@ -333,8 +333,8 @@
 		"",
 		"",
 		"",
-		"DIG_1", /* SODIMM 56 */
-		"DIG_2", /* SODIMM 58 */
+		"DIGI_1", /* SODIMM 56 */
+		"DIGI_2", /* SODIMM 58 */
 		"REL1",  /* SODIMM 60 */
 		"REL2",  /* SODIMM 62 */
 		"", /* 10 */

From 0d1d31a3e35cb79c89de121134825796808143f3 Mon Sep 17 00:00:00 2001
From: Francesco Dolcini <francesco.dolcini@toradex.com>
Date: Tue, 15 Sep 2026 22:14:10 +0200
Subject: [PATCH 1230/1982] arm64: dts: freescale: imx8mp-toradex-smarc: fix
 SMARC_SLEEP# gpio-line-names typo

[ Upstream commit 90bc5a53c7f0733ec37a5c041b4e1aefa3d8d965 ]

gpio3's gpio-line-names has "SLEEP#" instead of "SMARC_SLEEP#" for the
SMARC SLEEP# connector signal, while the gpio-keys node driven by the
very same GPIO line already labels it "SMARC_SLEEP#", and the imx95
Toradex SMARC variant names the equivalent line "SMARC_SLEEP#" too.

GPIO line names are meant to be stable across the whole Toradex SMARC
family, using the official SMARC-connector signal names from the
SMARC specification and the SoM datasheet's pin assignment table, so
userspace GPIO tooling that looks up a line by name works the same on
any Toradex SMARC board.

Fixes: 97dc91c04558 ("arm64: dts: freescale: add Toradex SMARC iMX8MP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
index bebe19eb360f88..576da7875601ff 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-toradex-smarc.dtsi
@@ -323,7 +323,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_lvds_dsi_sel>;
 	gpio-line-names = "ETH_0_INT#", /* 0 */
-			  "SLEEP#",
+			  "SMARC_SLEEP#",
 			  "",
 			  "",
 			  "",

From bdd8930eb7414de2f85a54c43ef501c12b1e2c30 Mon Sep 17 00:00:00 2001
From: Francesco Dolcini <francesco.dolcini@toradex.com>
Date: Mon, 14 Sep 2026 20:39:31 +0200
Subject: [PATCH 1231/1982] arm64: dts: freescale: imx8mp-verdin-yavia: fix
 external GPIOs

[ Upstream commit f377ac5999a5d045168ddd25d204691c6653c06a ]

pinctrl_gpios_ext_yavia (SODIMM 64/66) is defined but never applied to
gpio3, so those pins stay at their NAND reset function instead of GPIO.

Fix SODIMM 64 to the correct pad, MX8MP_IOMUXC_NAND_READY_B (GPIO3_IO16).

Fixes: b694fbe2ff40 ("arm64: dts: imx8mp-verdin: Add yavia carrier board")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
index cc389cda2af2eb..20d99012d4f320 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-yavia.dtsi
@@ -117,6 +117,11 @@
 	status = "okay";
 };
 
+&gpio3 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_gpios_ext_yavia>;
+};
+
 &gpio4 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_ctrl_sleep_moci>;
@@ -262,7 +267,7 @@
 
 	pinctrl_gpios_ext_yavia: gpiosextyaviagrp {
 		fsl,pins = <
-			MX8MP_IOMUXC_NAND_CE1_B__GPIO3_IO02	0x106	/* SODIMM 64 */
+			MX8MP_IOMUXC_NAND_READY_B__GPIO3_IO16	0x106	/* SODIMM 64 */
 			MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14	0x106	/* SODIMM 66 */
 		>;
 	};

From 23091956b96971f0628afb176dc35b6d7b38dd9a Mon Sep 17 00:00:00 2001
From: Gabor Juhos <j4g8y7@gmail.com>
Date: Fri, 18 Sep 2026 11:27:49 +0200
Subject: [PATCH 1232/1982] clk: qcom: gcc-ipq5018: mark 'gpll0_main' clock as
 critical

[ Upstream commit 33f9cb56cc28d002511e471be74f8ff241984178 ]

On IPQ5018, the APCS core clock feeds the CPUs. It can use
different clocks as its parent, but during system boot it
utilizes GPLL0.

Under some cicumstances, the 'gpll0_main' clock is getting
disabled during kernel start which results in a system hang
then the hardware watchdog restarts the board after a while.

This can happen when a driver gets a clock in its probe function,
then releases it either directly or by devres cleanup on probe
failure.

For example, since v6.18 the kernel often fails to boot on the
TP-Link Archer AX55 v1 board by using the in-tree dts. In the
failing configuration, the 'ipq-cmn-pll' driver is built into
the kernel and the problem is caused by the pm_runtim_put()
call in the ipq_cmn_pll_clk_probe() function. Due to this call,
runtime pm disables the 'gcc_cmn_blk_ahb_clk' clock asynchronously
which results in disabling 'gpll0_main' as well.

Mark the clock as critical in order to avoid such hangs.

Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Tested-by: Stanislaw Pal <kuncy7@gmail.com>
Link: https://lore.kernel.org/r/20260918-ipq5018-mark-gpll0_main-critical-v1-1-fbe8f27a0106@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-ipq5018.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index 64792cda062021..e2d01cdc39c961 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -69,6 +69,15 @@ static struct clk_alpha_pll gpll0_main = {
 			.parent_data = gcc_xo_data,
 			.num_parents = ARRAY_SIZE(gcc_xo_data),
 			.ops = &clk_alpha_pll_stromer_ops,
+			/*
+			 * During system boot, this PLL feeds the CPUs.
+			 * Mark it as critical to ensure that CCF does
+			 * not disable it, even if there are no active
+			 * consumers. This is needed to avoid a system
+			 * hang caused by turning off the clock driving
+			 * the CPUs.
+			 */
+			.flags = CLK_IS_CRITICAL,
 		},
 	},
 };

From eea47a6e5b84944938e009197a0f44387204a714 Mon Sep 17 00:00:00 2001
From: Casey Connolly <casey.connolly@linaro.org>
Date: Tue, 8 Sep 2026 14:45:02 +0200
Subject: [PATCH 1233/1982] drm/panel: ebbg-ft8719: Set prepare_prev_first

[ Upstream commit 4eeeac9d7c3600a6cae75b2a7bc9c5b67530923c ]

This corrects the host initialisation sequence so that we can send
DSI/DCS commands in prepare().

Cc: stable@vger.kernel.org
Fixes: b00de0e237da ("drm/panel: introduce ebbg,ft8719 panel")
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Tested-by: Marco Mattiolo <marco.mattiolo@hotmail.it>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260908-ebbg-ft8719-fixups-v2-1-5454ae1f5581@ixit.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-ebbg-ft8719.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
index fb9f9f42be4f26..1ab09c50a63063 100644
--- a/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
+++ b/drivers/gpu/drm/panel/panel-ebbg-ft8719.c
@@ -198,6 +198,8 @@ static int ebbg_ft8719_probe(struct mipi_dsi_device *dsi)
 	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
 			  MIPI_DSI_CLOCK_NON_CONTINUOUS;
 
+	ctx->panel.prepare_prev_first = true;
+
 	ret = drm_panel_of_backlight(&ctx->panel);
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to get backlight\n");

From 7990fad78c398883b22128ea104c561ba53603e9 Mon Sep 17 00:00:00 2001
From: Hongyan Xu <getshell@seu.edu.cn>
Date: Fri, 14 Aug 2026 23:30:19 +0800
Subject: [PATCH 1234/1982] mfd: da903x: Cancel IRQ work during teardown

[ Upstream commit fd2258999ecdc7164ef0cda2d4102e4558a5660f ]

The IRQ handler disables the IRQ and schedules irq_work. Releasing the
IRQ does not drain that work, which can continue to use the devm-allocated
chip and notifier state.

Manage both IRQ-work cancellation and subdevice removal with devres.
Register the subdevice-removal action before requesting the IRQ, then add
the IRQ-work action after the request. This avoids leaving a live IRQ
without work cancellation if action registration fails. Devres cleanup
then disables the IRQ and drains the work before releasing the IRQ and
removing child devices. Register both actions before creating the children
so partial probe failures use the same ordering.

This issue was found by the author's in-house static analysis tool.
The patch was reviewed by the author against the latest mainline tree.

Fixes: 26b8f5e1e2d1 ("mfd: add base support for Dialog DA9030/DA9034 PMICs")
Cc: stable@vger.kernel.org
Suggested-by: Lee Jones <lee@kernel.org>
Assisted-by: Codex:GPT-5
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260814153019.1114-1-getshell@seu.edu.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/da903x.c | 34 +++++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index e86b39de3303a2..e4ad48e1f139be 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
+static void da903x_cancel_irq_work(void *data)
+{
+	struct da903x_chip *chip = data;
+
+	disable_irq(chip->client->irq);
+	cancel_work_sync(&chip->irq_work);
+}
+
 static const struct da903x_chip_ops da903x_ops[] = {
 	[0] = {
 		.init_chip	= da9030_init_chip,
@@ -456,6 +464,13 @@ static int da903x_remove_subdevs(struct da903x_chip *chip)
 	return device_for_each_child(chip->dev, NULL, __remove_subdev);
 }
 
+static void da903x_remove_subdevs_action(void *data)
+{
+	struct da903x_chip *chip = data;
+
+	da903x_remove_subdevs(chip);
+}
+
 static int da903x_add_subdevs(struct da903x_chip *chip,
 					struct da903x_platform_data *pdata)
 {
@@ -484,7 +499,6 @@ static int da903x_add_subdevs(struct da903x_chip *chip,
 	return 0;
 
 failed:
-	da903x_remove_subdevs(chip);
 	return ret;
 }
 
@@ -520,6 +534,11 @@ static int da903x_probe(struct i2c_client *client)
 	chip->ops->mask_events(chip, chip->events_mask);
 	chip->ops->read_events(chip, &tmp);
 
+	ret = devm_add_action_or_reset(&client->dev,
+				       da903x_remove_subdevs_action, chip);
+	if (ret)
+		return ret;
+
 	ret = devm_request_irq(&client->dev, client->irq, da903x_irq_handler,
 			IRQF_TRIGGER_FALLING,
 			"da903x", chip);
@@ -529,14 +548,12 @@ static int da903x_probe(struct i2c_client *client)
 		return ret;
 	}
 
-	return da903x_add_subdevs(chip, pdata);
-}
-
-static void da903x_remove(struct i2c_client *client)
-{
-	struct da903x_chip *chip = i2c_get_clientdata(client);
+	ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
+				       chip);
+	if (ret)
+		return ret;
 
-	da903x_remove_subdevs(chip);
+	return da903x_add_subdevs(chip, pdata);
 }
 
 static struct i2c_driver da903x_driver = {
@@ -544,7 +561,6 @@ static struct i2c_driver da903x_driver = {
 		.name	= "da903x",
 	},
 	.probe		= da903x_probe,
-	.remove		= da903x_remove,
 	.id_table	= da903x_id_table,
 };
 

From 95e47d590f04afd734dd1aa2cb81b09c1534a0ed Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Thu, 27 Aug 2026 16:27:41 +0200
Subject: [PATCH 1235/1982] mfd: Fix MAX77705 dependency on regmap

[ Upstream commit 2fdae2d590a0a5ad4cd60bf8e7a6ecba7265f268 ]

The max77705 uses devm_regmap_add_irq_chip(), so add REGMAP_IRQ
and REGMAP_I2C to what the core driver selects in order to provide
these APIs.
This fixes a build error:

drivers/mfd/max77705.o: in function `max77705_i2c_probe':
max77705.c:(.text+0x250): undefined reference to `devm_regmap_add_irq_chip'

Cc: stable@vger.kernel.org
Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260827-deps-reg-max77705-v1-1-c83a74d3d428@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 55a9fea95195bc..ae39cbf3171078 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -989,6 +989,8 @@ config MFD_MAX77705
 	depends on I2C
 	select MFD_CORE
 	select MFD_SIMPLE_MFD_I2C
+	select REGMAP_I2C
+	select REGMAP_IRQ
 	help
 	  Say yes here to add support for Maxim Integrated MAX77705 PMIC.
 	  This is a Power Management IC with Charger, safe LDOs, Flash, Haptic

From 845d3107c2fa1b04f70e624c597d78114d5d3094 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Thu, 3 Sep 2026 16:42:05 +0200
Subject: [PATCH 1236/1982] mfd: wcd934x: set DMA mask on parent to silence
 "DMA mask not set"

[ Upstream commit b296be1dc008fe3a536341afae01f66bb302e67f ]

The wcd934x MFD parent (a slim_device) never initializes its
dma_mask/coherent_dma_mask. When the DT-aware children pass through
of_dma_configure() this triggers the "DMA mask not set" warning for
each child.

Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Assisted-by: tencent:hy3
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v2-1-189cff560a28@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/wcd934x.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 3c3080e8c8cf7e..7bea64fc09562c 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -2,6 +2,7 @@
 // Copyright (c) 2019, Linaro Limited
 
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
@@ -217,6 +218,11 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
 	struct gpio_desc *reset_gpio;
 	int ret;
 
+	ret = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to set DMA mask\n");
+
 	ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
 	if (!ddata)
 		return	-ENOMEM;

From f2a360ec9f6c316dbd3bf1da00328d2ee618b4ad Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Thu, 3 Sep 2026 17:21:42 +0200
Subject: [PATCH 1237/1982] mfd: wcd934x: Fix NULL pointer dereference on IRQ
 probe deferral

[ Upstream commit dcf0e640b553d33512fbcaedb909c32ba9636a64 ]

ddata->dev is only assigned at the end of wcd934x_slim_probe(), but the
of_irq_get() error path has passed it to the error print since the
driver was added, while it is still NULL.

This used to be harmless with dev_err(), which copes with a NULL device
and was skipped on -EPROBE_DEFER. Since the switch to dev_err_probe(), a
deferred IRQ reaches device_set_deferred_probe_reason() ->
dev_driver_string(), which dereferences the NULL pointer and crashes
during probe. Use dev, which is already valid at this point.

Cc: stable@vger.kernel.org
Fixes: 0f1b1b899521 ("mfd: wcd934x: Simplify with dev_err_probe()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/mfd/20260903145651.AC1311F00ACA@smtp.kernel.org/
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260903-wcd-dma-v3-1-d3920c6563c4@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/wcd934x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c
index 7bea64fc09562c..d57796933d8732 100644
--- a/drivers/mfd/wcd934x.c
+++ b/drivers/mfd/wcd934x.c
@@ -229,7 +229,7 @@ static int wcd934x_slim_probe(struct slim_device *sdev)
 
 	ddata->irq = of_irq_get(np, 0);
 	if (ddata->irq < 0)
-		return dev_err_probe(ddata->dev, ddata->irq,
+		return dev_err_probe(dev, ddata->irq,
 				     "Failed to get IRQ\n");
 
 	ddata->extclk = devm_clk_get(dev, "extclk");

From 239d333dedc263083734af7cdd635fb21d64a4b4 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Thu, 24 Sep 2026 10:17:56 +0800
Subject: [PATCH 1238/1982] perf loongarch: Fix discarded const qualifier in
 _get_field()

[ Upstream commit ed1293302f811fa709897d4a90ad78592938e4aa ]

When building perf on LoongArch, the following compilation errors occur:

  CC      arch/loongarch/util/header.o
arch/loongarch/util/header.c: In function '_get_field':
arch/loongarch/util/header.c:31:15: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
   31 |         line2 = strrchr(line, ' ');
      |               ^
arch/loongarch/util/header.c:36:12: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
   36 |         nl = strrchr(line, '\n');
      |            ^
cc1: all warnings being treated as errors

Declare 'line2' and 'nl' as const char * to ensure type safety. In modern
glibc versions, strrchr() returns a 'const char *' if the input string is
const.

This is similar to commit 7378b6656aa4 ("perf riscv: Fix discarded const
qualifier in _get_field()").

Fixes: 492ac37fa38faf52 ("perf kvm: Add kvm-stat for loongarch64")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/arch/loongarch/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/arch/loongarch/util/header.c b/tools/perf/arch/loongarch/util/header.c
index 0c6d823334a21d..46f53a74f71e8c 100644
--- a/tools/perf/arch/loongarch/util/header.c
+++ b/tools/perf/arch/loongarch/util/header.c
@@ -26,7 +26,7 @@
 
 static char *_get_field(const char *line)
 {
-	char *line2, *nl;
+	const char *line2, *nl;
 
 	line2 = strrchr(line, ' ');
 	if (!line2)

From 582a0631a00df91e6fc3bbdfc21dfbc77c9bb825 Mon Sep 17 00:00:00 2001
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date: Thu, 24 Sep 2026 01:41:19 +0900
Subject: [PATCH 1239/1982] nilfs2: fix deadlock between nilfs_evict_inode()
 and find_inode()

[ Upstream commit ff1227f70eead8704ecfec69259fb4c041f92cda ]

Syzbot reported a deadlock between nilfs_evict_inode(), executed via
an asynchronous workqueue (kworker) as:

  process_one_work()
    process_scheduled_works()
      nilfs_iput_work_func()
        nilfs_dispose_list()
          iput()
            iput_final()
              evict()
                s_op->evict_inode()
                  nilfs_evict_inode()

and find_inode(), called via

  nilfs_mkdir()
    nilfs_new_inode()
      nilfs_insert_inode_locked()
        insert_inode_locked4()
          inode_insert5()
            find_inode()

When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears its
ifile bitmap entry and then synchronously triggers the log writer via
nilfs_transaction_commit() if IS_SYNC(inode) is true.

If a concurrent directory creation via nilfs_new_inode() attempts to
allocate the same newly freed inode number, however, find_inode() called
just before inserting it into the inode hash, blocks waiting for the old
inode's evict() to complete.

Meanwhile, the synchronous log writer invoked from nilfs_evict_inode()
tries to acquire a write lock on 'ns_segctor_sem' which is read locked
by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
resulting in a deadlock.

The synchronous log writer invocation from nilfs_evict_inode() is a
legacy artifact; it is no longer necessary because the call itself
(triggered by iput()) is now handled asynchronously with a kworker
if i_nlink == 0.  It merely increases the risk of deadlock.

Fix this deadlock by removing the synchronous log writer trigger from
nilfs_evict_inode().

Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor over I_SYNC flag")
Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/inode.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 1099864acabcbd..16e3745ce6e969 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -897,13 +897,7 @@ void nilfs_evict_inode(struct inode *inode)
 
 	nilfs_clear_inode(inode);
 
-	if (IS_SYNC(inode))
-		nilfs_set_transaction_flag(NILFS_TI_SYNC);
 	nilfs_transaction_commit(sb);
-	/*
-	 * May construct a logical segment and may fail in sync mode.
-	 * But delete_inode has no return value.
-	 */
 }
 
 int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,

From f622c427fab09a106b6b1208a31802c9138b614d Mon Sep 17 00:00:00 2001
From: Jiacheng Xu <stitch@zju.edu.cn>
Date: Sun, 20 Sep 2026 13:37:26 +0800
Subject: [PATCH 1240/1982] kobject: fix out-of-bounds access in
 kobject_action_type()

[ Upstream commit d516455c940555566642b975d1835c67f08136b3 ]

kobject_action_type() compares the input against each known action
using strncmp() and then indexes the action string using count_first
to check for an exact-length match.

An embedded NUL can make strncmp() return zero even when count_first
exceeds the length of the action string. For example, the five-byte
input "add\0X" makes the parser access kobject_actions[KOBJ_ADD][5],
which is beyond the end of the "add" string.

Check the action string length with strlen() instead of indexing it
with the input-derived offset. This rejects malformed action strings
containing embedded NUL bytes with -EINVAL instead of invoking
undefined behavior.

Cc: stable@kernel.org
Fixes: 60a96a59569b ("Driver core: accept all valid action-strings in uevent-trigger")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Link: https://patch.msgid.link/20260920053726.22626-1-stitch@zju.edu.cn
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 5a2480467ab987..bdc2720b7aac57 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
 			continue;
-		if (kobject_actions[action][count_first] != '\0')
+		if (strlen(kobject_actions[action]) != count_first)
 			continue;
 		if (args)
 			*args = args_start;

From 9ce18befc89449b92b48a12bea2c26dd03ab8ad6 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Thu, 24 Sep 2026 21:49:32 +0800
Subject: [PATCH 1241/1982] ASoC: Intel: atom: Fix platform device leak on
 probe failure

[ Upstream commit dcc36d766dc82bc57cd730915d484119befcfca8 ]

sst_acpi_probe() registers platform devices for the SST platform and
machine board using platform_device_register_data(), but does not
unregister them when later probe steps fail.

Fixes: caf94ed8629a ("ASoC: Intel: bytcr_rt5640: fixup DAI codec_name with HID")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924134932.1590967-1-lgs201920130244@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/atom/sst/sst_acpi.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 25718063047559..92a68dbd841edd 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -253,6 +253,11 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
 	return 0;
 }
 
+static void sst_unregister_platform_device(void *data)
+{
+	platform_device_unregister(data);
+}
+
 static int sst_acpi_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -341,7 +346,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
 			pdata->platform);
 		return PTR_ERR(plat_dev);
 	}
-
+	ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+				       plat_dev);
+	if (ret)
+		return ret;
 	/*
 	 * Create platform device for sst machine driver,
 	 * pass machine info as pdata
@@ -354,6 +362,10 @@ static int sst_acpi_probe(struct platform_device *pdev)
 		return PTR_ERR(mdev);
 	}
 
+	ret = devm_add_action_or_reset(dev, sst_unregister_platform_device,
+				       mdev);
+	if (ret)
+		return ret;
 	/* Fill sst platform data */
 	ctx->pdata = pdata;
 	strcpy(ctx->firmware_name, mach->fw_filename);

From e043acd7535f59ff58fe02caeba30930796478d3 Mon Sep 17 00:00:00 2001
From: Junjie Cao <junjie.cao@intel.com>
Date: Sun, 20 Sep 2026 10:42:32 +0800
Subject: [PATCH 1242/1982] ASoC: rt712-sdca-dmic: fix drvdata type in the gain
 controls

[ Upstream commit 0bc42544a4a06e8d76eb412d2b1414db910a311d ]

rt712_sdca_dmic_set_gain_get() and rt712_sdca_dmic_set_gain_put() take
the component drvdata as struct rt712_sdca_priv, but this driver stores
a struct rt712_sdca_dmic_priv.

regmap and mbq_regmap are at the same offsets in both structs, so the
register accesses work. slave is not: rt712_sdca_priv has dmic_component
in front of it, so its slave overlays rt712_sdca_dmic_priv's params,
which this driver never writes. When regmap_write() fails in the put
handler, dev_err() is called with &NULL->dev (RSI below):

  rt712-sdca-dmic sdw:0:3:025d:1713:01: Defer on undeferrable control: 40800f13
  BUG: kernel NULL pointer dereference, address: 0000000000000058
  RIP: 0010:__dev_printk+0x10/0x70
  RDX: ffffcdac45f83cd0 RSI: 0000000000000008 RDI: ffffffffa09cb5cb
  Call Trace:
   _dev_err+0x7f/0x99
   rt712_sdca_dmic_set_gain_put.cold+0x20/0x25 [snd_soc_rt712_sdca_dmic]
   snd_ctl_elem_write+0x19a/0x1f0 [snd]
   snd_ctl_ioctl+0x658/0x8a0 [snd]

Seen on a Dell Precision 5690 running 7.2.5-200.fc44, with alsactl
writing the control during boot. Compile-tested only.

Fixes: 63a511284c9e ("ASoC: rt712-sdca: Add RT712 SDCA driver for Mic topology")
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2532834
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20260920024232.710189-1-junjie.cao@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt712-sdca-dmic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/rt712-sdca-dmic.c b/sound/soc/codecs/rt712-sdca-dmic.c
index bc5b872f1e42f0..bbbea9af73cd23 100644
--- a/sound/soc/codecs/rt712-sdca-dmic.c
+++ b/sound/soc/codecs/rt712-sdca-dmic.c
@@ -247,7 +247,7 @@ static int rt712_sdca_dmic_set_gain_get(struct snd_kcontrol *kcontrol,
 		struct snd_ctl_elem_value *ucontrol)
 {
 	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
-	struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+	struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
 	struct rt712_sdca_dmic_kctrl_priv *p =
 		(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
 	unsigned int regvalue, ctl, i;
@@ -278,7 +278,7 @@ static int rt712_sdca_dmic_set_gain_put(struct snd_kcontrol *kcontrol,
 	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
 	struct rt712_sdca_dmic_kctrl_priv *p =
 		(struct rt712_sdca_dmic_kctrl_priv *)kcontrol->private_value;
-	struct rt712_sdca_priv *rt712 = snd_soc_component_get_drvdata(component);
+	struct rt712_sdca_dmic_priv *rt712 = snd_soc_component_get_drvdata(component);
 	unsigned int gain_val[4];
 	unsigned int i, adc_vol_flag = 0, changed = 0;
 	unsigned int regvalue[4];

From aba82b403719fca667b031d3154164cb5f694647 Mon Sep 17 00:00:00 2001
From: Aamir Ahmed <elb12345@hotmail.co.uk>
Date: Sat, 5 Sep 2026 21:48:07 +0100
Subject: [PATCH 1243/1982] clk: mvebu: ap-cpu-clk: Assign .num before
 accessing .hws

[ Upstream commit b4243850393f2f24e21b9f4b2c56233e60c904b4 ]

Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in ap_cpu_clock_probe(), which reads .hws[] to skip clusters
that have already been set up and writes it inside the CPU node loop,
but only assigns .num after the loop. With CONFIG_UBSAN_BOUNDS and a
compiler that implements __counted_by (GCC 15.1+ or Clang 20.1+), this
triggers an array-index-out-of-bounds report during probe of the AP806
and AP807 CPU clocks, and with CONFIG_UBSAN_TRAP the first access traps.

Initialize .num with nclusters, the number of elements .hws[] was
allocated with, right after the allocation. For the in-tree AP806 and
AP807 device trees, which list the CPU nodes in ascending order, this is
exactly the value the old assignment produced. It is also the correct
value for any other node order, since of_clk_hw_onecell_get() rejects
indices at or beyond .num.

Cc: stable@vger.kernel.org
Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by")
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/ap-cpu-clk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c
index 1e44ace7d95197..ed3ca59e0ee974 100644
--- a/drivers/clk/mvebu/ap-cpu-clk.c
+++ b/drivers/clk/mvebu/ap-cpu-clk.c
@@ -284,6 +284,8 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 	if (!ap_cpu_data)
 		return -ENOMEM;
 
+	ap_cpu_data->num = nclusters;
+
 	for_each_of_cpu_node(dn) {
 		char *clk_name = "cpu-cluster-0";
 		struct clk_init_data init;
@@ -333,8 +335,6 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		ap_cpu_data->hws[cluster_index] = &ap_cpu_clk[cluster_index].hw;
 	}
 
-	ap_cpu_data->num = cluster_index + 1;
-
 	ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, ap_cpu_data);
 	if (ret)
 		dev_err(dev, "failed to register OF clock provider\n");

From 07909b53a81ea6ec1b6e1e212f33659acd8d1eb6 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 14:30:52 +0000
Subject: [PATCH 1244/1982] regulator: core: Fix coupled regulators reference
 leak on removal

[ Upstream commit b9205f0837ca91a0bbe6aa9002207656840c1406 ]

of_parse_coupled_regulator() returns the coupled regulator with its
device reference incremented and regulator_resolve_coupling() stores it
in coupling_desc.coupled_rdevs[]. regulator_remove_coupling() clears
those pointers without dropping the references, so they are leaked when
the couple is torn down.

Release the reference of each coupled regulator while removing the
coupling.

Fixes: d3d64537c339 ("regulator: core: Resolve coupled regulators")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917143052.2156903-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e2328539b9fdc4..bb0b7268b2b58e 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5707,6 +5707,8 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
 
 		c_desc->coupled_rdevs[i] = NULL;
 		c_desc->n_resolved--;
+
+		put_device(&c_rdev->dev);
 	}
 
 	if (coupler && coupler->detach_regulator) {

From 7350d86fe19877d95233867dec28b5321c27bce0 Mon Sep 17 00:00:00 2001
From: Ridham Khurana <khurana.ridham222@gmail.com>
Date: Wed, 23 Sep 2026 17:25:48 +0000
Subject: [PATCH 1245/1982] hwmon: (lm95245) Fix negative temperature
 conversion

[ Upstream commit f58c16056f8585ebafb0f1f5d90c23085443a4b9 ]

temp_from_reg_signed() uses only the high byte when the sign bit is set
and drops the fractional bits in the low byte. Writing -500 to
temp2_offset stores 0xff80 (-0.5 degrees C) in the offset registers,
but reading temp2_offset back returns -1000.

Negative temp1_input and temp2_input values are rounded down to the
next whole degree the same way. The chip reports -0.125 degrees C as
0xffe0, which the driver returns as -1000.

Treat the register pair as a single 16-bit two's complement value.

Fixes: fffd80ccc1e6 ("hwmon: LM95245 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ridham Khurana <khurana.ridham222@gmail.com>
Link: https://patch.msgid.link/20260923172551.1593798-1-khurana.ridham222@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm95245.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/lm95245.c b/drivers/hwmon/lm95245.c
index 3bdc305308479b..9c977d2820f9c5 100644
--- a/drivers/hwmon/lm95245.c
+++ b/drivers/hwmon/lm95245.c
@@ -98,9 +98,9 @@ static int temp_from_reg_unsigned(u8 val_h, u8 val_l)
 
 static int temp_from_reg_signed(u8 val_h, u8 val_l)
 {
-	if (val_h & 0x80)
-		return (val_h - 0x100) * 1000;
-	return temp_from_reg_unsigned(val_h, val_l);
+	s16 val_hl = (val_h << 8) | val_l;
+
+	return val_hl * 1000 / 256;
 }
 
 static int lm95245_read_conversion_rate(struct lm95245_data *data)

From 81f311ccfd77de3596e841af149dd06183a832ec Mon Sep 17 00:00:00 2001
From: Joanne Koong <joannelkoong@gmail.com>
Date: Tue, 15 Sep 2026 16:53:41 -0700
Subject: [PATCH 1246/1982] fuse: don't drop destination page cache on a zero
 byte copy reply

[ Upstream commit f7585e1ce3418ec282485854b3d8d31c6a961e37 ]

__fuse_copy_file_range() clears the destination page cache after the
server replies:

	truncate_inode_pages_range(inode_out->i_mapping,
				   ALIGN_DOWN(pos_out, PAGE_SIZE),
				   ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);

A server may legitimately reply that it copied nothing, eg if the source
file turns out to be shorter than the size the kernel has cached for it.

If pos_out is 0 as well, the end of the range is ALIGN(0, PAGE_SIZE) - 1,
which is -1. lend is a uoff_t and truncate_inode_pages_range() takes -1
as its end of file sentinel, so rather than clearing nothing it drops
every folio in the destination mapping.

That is not only a cache drop. truncate_cleanup_folio() calls
folio_cancel_dirty(), and fuse_writeback_range() only wrote back
[pos_out, pos_out + len - 1], so dirty data elsewhere in the destination
file is discarded without ever reaching the server.

Skip the call when the server copied nothing, since there is nothing
stale to clear in that case.

Fixes: 9b46418c40fe ("fuse: copy_file_range should truncate cache")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/file.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a7a3ac5b34f422..18a3ef3a969539 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3094,9 +3094,11 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 		goto out;
 	}
 
-	truncate_inode_pages_range(inode_out->i_mapping,
-				   ALIGN_DOWN(pos_out, PAGE_SIZE),
-				   ALIGN(pos_out + bytes_copied, PAGE_SIZE) - 1);
+	if (bytes_copied)
+		truncate_inode_pages_range(inode_out->i_mapping,
+					   ALIGN_DOWN(pos_out, PAGE_SIZE),
+					   ALIGN(pos_out + bytes_copied,
+						 PAGE_SIZE) - 1);
 
 	file_update_time(file_out);
 	fuse_write_update_attr(inode_out, pos_out + bytes_copied, bytes_copied);

From 1cf4c1c5ab6ea5502c3f1bfd96dabc8484d720ba Mon Sep 17 00:00:00 2001
From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
Date: Thu, 10 Sep 2026 06:59:55 -0700
Subject: [PATCH 1247/1982] platform/x86/intel/pmt: Block mmap when callback is
 present
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0d4cd92b41dd33a3112959f9be86002ff309de73 ]

With the introduction of the .read_telem() callback, control
for access to a devices data area must be done by the callback
owner.

This means that an area cannot be mmap-ed with the default PMT
handler.

If the .read_telem() callback is present, do not support mmap.

Fixes: 045a513040cc ("platform/x86/intel/pmt: Use PMT callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20260910135954.1586360-2-michael.j.ruhl@intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/pmt/class.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/pmt/class.c b/drivers/platform/x86/intel/pmt/class.c
index 8077274726b5d7..9ec843617e3c98 100644
--- a/drivers/platform/x86/intel/pmt/class.c
+++ b/drivers/platform/x86/intel/pmt/class.c
@@ -339,7 +339,14 @@ static int intel_pmt_dev_register(struct intel_pmt_entry *entry,
 	sysfs_bin_attr_init(&entry->pmt_bin_attr);
 	entry->pmt_bin_attr.attr.name = ns->name;
 	entry->pmt_bin_attr.attr.mode = 0440;
-	entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
+	/*
+	 * The read_telem callback controls access to the memory area. Block
+	 * usage if the read_telem callback is present.
+	 */
+	if (!(entry->cb && entry->cb->read_telem))
+		entry->pmt_bin_attr.mmap = intel_pmt_mmap;
+
 	entry->pmt_bin_attr.read = intel_pmt_read;
 	entry->pmt_bin_attr.size = entry->size;
 

From b93e351abe15eacc578d7401dc9738f2b6c62bf6 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Wed, 16 Sep 2026 00:45:37 +0800
Subject: [PATCH 1248/1982] mtd: rawnand: nuvoton: fix clock cleanup on probe
 failure

[ Upstream commit 8a485a40f45a19c5fcafb5cbee7387c2762af7c4 ]

ma35_nand_probe() gets and enables the NAND clock with
devm_clk_get_enabled(), but the ma35_nand_chips_init() failure path
also calls clk_disable() before returning.

devm_clk_get_enabled() registers a managed cleanup that calls
clk_disable_unprepare() on probe failure and driver removal. Calling
clk_disable() explicitly first drops the clock enable count, so the
managed cleanup attempts to disable the clock again and triggers the
clock framework warning for an already disabled clock.

Remove the redundant clk_disable() and let the managed clock cleanup
handle the clock state.

This issue was found by manual code inspection.

Fixes: 5abb5d414d55 ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
index 1a285cd8fad62a..f659d3a6b9ef46 100644
--- a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
+++ b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c
@@ -993,7 +993,6 @@ static int ma35_nand_probe(struct platform_device *pdev)
 	ret = ma35_nand_chips_init(&pdev->dev, nand);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to init NAND chips\n");
-		clk_disable(nand->clk);
 		return ret;
 	}
 

From 42e84c6ec7a1c9b78ef09cc7b75e481c1dc15775 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:29:24 +0000
Subject: [PATCH 1249/1982] mtd: rawnand: atmel: Fix MCK clock leak in
 atmel_nand_controller_init()

[ Upstream commit 94edcda45d888c3bb1310de11e10e4537c166f00 ]

atmel_nand_controller_init() takes a reference to the MCK clock with
of_clk_get() and keeps it in nc->mck for the lifetime of the
controller.  If the "atmel,smc" phandle is missing or the SMC regmap
cannot be obtained afterwards, the error path jumps to out_release_dma
which only releases the DMA channel, so the clock reference is leaked.
The callers return the error directly and never run
atmel_nand_controller_cleanup(), where the clock is normally put.

Release the reference on those error paths.  The path on which
of_clk_get() itself fails keeps jumping to out_release_dma, as nc->mck
only holds an error pointer there.

Fixes: f9ce2eddf176 ("mtd: nand: atmel: Add ->setup_data_interface() hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/atmel/nand-controller.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index 83ba4ebd02d41a..b954e70b4c6b32 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2086,7 +2086,7 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
 	if (!np) {
 		dev_err(dev, "Missing or invalid atmel,smc property\n");
 		ret = -EINVAL;
-		goto out_release_dma;
+		goto out_put_mck;
 	}
 
 	nc->smc = syscon_node_to_regmap(np);
@@ -2094,11 +2094,13 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
 	if (IS_ERR(nc->smc)) {
 		ret = PTR_ERR(nc->smc);
 		dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
-		goto out_release_dma;
+		goto out_put_mck;
 	}
 
 	return 0;
 
+out_put_mck:
+	clk_put(nc->mck);
 out_release_dma:
 	if (nc->dmac)
 		dma_release_channel(nc->dmac);

From d977046bcfbfab830b3e8b92f3f11ffdbaf54e68 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Mon, 14 Sep 2026 21:06:47 -0400
Subject: [PATCH 1250/1982] mtd: maps: pci: balance PCI enable on cleanup

[ Upstream commit 3be16e5d4990bf96309ac5ba35cb369c6015bce7 ]

mtd_pci_probe() leaves the PCI device enabled on later probe failure and
mtd_pci_remove() does not disable it either. Use pcim_enable_device() to
release the enable reference after the existing map and region cleanup.

The imbalance is already present in the initial Git import.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/maps/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c
index ca00d211e73e47..c6bbce6aed4179 100644
--- a/drivers/mtd/maps/pci.c
+++ b/drivers/mtd/maps/pci.c
@@ -256,7 +256,7 @@ static int mtd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	struct mtd_info *mtd = NULL;
 	int err;
 
-	err = pci_enable_device(dev);
+	err = pcim_enable_device(dev);
 	if (err)
 		goto out;
 

From b0d4ff46a2195320957de9e8981313fe7da9c988 Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgads@gmail.com>
Date: Wed, 16 Sep 2026 16:27:31 +0000
Subject: [PATCH 1251/1982] mtd: cfi_cmdset_0002: cap the write-buffer chunk at
 256 bytes on an x8 device

[ Upstream commit cfc5ebc9540e29f8f96db88bbfa261139e5afedb ]

The Write to Buffer command takes the number of words to program minus
one, and do_write_buffer() sends that count as a single bus word:

	map_write(map, CMD(words - 1), cmd_adr);

CMD() replicates the value into every device lane, so each device reads
the count off its own data lines - eight of them on an x8 part. A count
that does not fit in eight bits is truncated there, which limits one
Write to Buffer to 256 words on an x8 device, however large a buffer the
chip advertises in its CFI query.

The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8)
advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers()
split the data into 512-byte chunks and do_write_buffer() sent a count of
511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the
program when the 257th arrived. Chunks below 256 bytes - the leading
partial chunk of a write - completed normally, so only the full-size ones
failed:

  MTD do_write_buffer_wait(): software timeout, address:0x03278bff.
  jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68
  jffs2: No space for garbage collection. Aborting GC thread

Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and
recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from
MaxBufWriteSize before the fixups run.

The clamp deliberately keys off the device width rather than the part,
even though the driver already recognises this one in is_m29ew(): the
ceiling comes from the width of a device's data bus, not from the chip,
so any x8 device advertising a larger buffer is told a count it cannot
receive. The M29EW is only where it was found.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/chips/cfi_cmdset_0002.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 7c91429a670bbb..c8a82b1592c9de 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -283,6 +283,21 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
 		pr_debug("Using buffer write method\n");
 		mtd->_write = cfi_amdstd_write_buffers;
 	}
+
+	/*
+	 * The word count of the Write to Buffer command is a single bus
+	 * word per device, so an x8 device can be told to program at most
+	 * 256 bytes however large a buffer it advertises - including when
+	 * several of them are interleaved on a wider bus, where CMD()
+	 * replicates the count into each device's lane and it is truncated
+	 * there.
+	 */
+	if (cfi->device_type == CFI_DEVICETYPE_X8 &&
+	    cfi->cfiq->MaxBufWriteSize > 8) {
+		cfi->cfiq->MaxBufWriteSize = 8;
+		mtd->writebufsize = cfi_interleave(cfi) <<
+				    cfi->cfiq->MaxBufWriteSize;
+	}
 }
 #endif /* !FORCE_WORD_WRITE */
 

From 9975c8d2d03e1e5317430d4d87386965d471869f Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:20:51 +0000
Subject: [PATCH 1252/1982] mtd: amd76xrom: Fix PCI device reference leak in
 amd76xrom_init_one()

[ Upstream commit 1a122f5fecbabd47b81b1be3f0934f57b78aad42 ]

init_amd76xrom() obtains the PCI device with pci_get_device() and
hands the reference over to amd76xrom_init_one(), which stores it in
window->pdev.  When reserving the ROM window fails, that function
returns -EBUSY directly instead of going through amd76xrom_cleanup(),
so the reference is neither released nor cleared.

Drop the reference and clear window->pdev on that path.

Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/maps/amd76xrom.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 281fcbaa74e70c..43411ec02ed595 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -152,6 +152,8 @@ static int amd76xrom_init_one(struct pci_dev *pdev,
 		printk(KERN_ERR MOD_NAME
 		       " %s(): Unable to register resource %pR - kernel bug?\n",
 		       __func__, &window->rsrc);
+		pci_dev_put(window->pdev);
+		window->pdev = NULL;
 		return -EBUSY;
 	}
 

From 433fe9882befbe12e8f560b5818799651654bcba Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:22:44 +0000
Subject: [PATCH 1253/1982] mtd: maps: l440gx: Fix double put of the ISA bridge
 in init_l440gx()

[ Upstream commit 521ad948e04934b2d70ae899bc016bbb38802e90 ]

init_l440gx() takes a single reference on the PIIX4 ISA bridge with
pci_get_device() and drops it again right after the lookups, before
the flash window is set up.  The pci_assign_resource() failure path
then calls pci_dev_put() on the same device a second time, releasing a
reference that is no longer owned and underflowing the reference count.

Remove the extra pci_dev_put().

Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/maps/l440gx.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 832b880d1aaf82..85cd273ce0654b 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
 
 		/* Allocate the resource region */
 		if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
-			pci_dev_put(dev);
 			pci_dev_put(pm_dev);
 			printk(KERN_WARNING "Could not allocate pm iobase resource\n");
 			iounmap(l440gx_map.virt);

From 9544576610d5d5aa20f41239040aaf7dc1cfb4c9 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:24:07 +0000
Subject: [PATCH 1254/1982] mtd: maps: l440gx: Fix double put of the PM device
 in init_l440gx()

[ Upstream commit e6ca524ee5b2705be30ea19ce2e55122d9f9ed8f ]

The PIIX4 PM device reference taken with pci_get_device() is dropped
again before the iobase resource is allocated.  If pci_assign_resource()
fails, the error path calls pci_dev_put() on pm_dev a second time,
releasing a reference that is no longer owned and underflowing the
reference count.

Remove the extra pci_dev_put().

Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/maps/l440gx.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c
index 85cd273ce0654b..1df5ea5fafcac1 100644
--- a/drivers/mtd/maps/l440gx.c
+++ b/drivers/mtd/maps/l440gx.c
@@ -110,7 +110,6 @@ static int __init init_l440gx(void)
 
 		/* Allocate the resource region */
 		if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) {
-			pci_dev_put(pm_dev);
 			printk(KERN_WARNING "Could not allocate pm iobase resource\n");
 			iounmap(l440gx_map.virt);
 			return -ENXIO;

From 23852ad0f72a62ab1cf20a69c35cbf00f792f364 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:25:50 +0000
Subject: [PATCH 1255/1982] mtd: mtdsuper: Fix MTD device reference leak in
 mtd_get_sb()

[ Upstream commit 62ee3da38f41bef83c1cf250f6816a0ee187674b ]

mtd_get_sb() is called with a reference to the MTD device already
taken by the caller.  When sget_dev() fails, the function returns the
error without dropping that reference, so the device is never released
and its refcount never reaches zero.  Every mount attempt on an MTD
device whose superblock cannot be set up leaks a reference.

Restore the put_mtd_device() that the fs_context conversion dropped on
this path.

Fixes: 0f071004109d ("mtd: Provide fs_context-aware mount_mtd() replacement")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdsuper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index b7e3763c47f0cd..22ddeaa7d52216 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -31,8 +31,10 @@ static int mtd_get_sb(struct fs_context *fc,
 	int ret;
 
 	sb = sget_dev(fc, MKDEV(MTD_BLOCK_MAJOR, mtd->index));
-	if (IS_ERR(sb))
+	if (IS_ERR(sb)) {
+		put_mtd_device(mtd);
 		return PTR_ERR(sb);
+	}
 
 	if (sb->s_root) {
 		/* new mountpoint for an already mounted superblock */

From 2b8b388320fa3cacbf0444ec2eccf7534b96cd4b Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Thu, 17 Sep 2026 16:53:29 +0200
Subject: [PATCH 1256/1982] mtd: Call get_wunit() on the master partition

[ Upstream commit 904f18430e8cce829cb9130eab7a93020e33fc89 ]

The code checks whether master has get_wunit() but still calls
it on the child. Fix this.

Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdcore.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 51c8ed48934809..f84e4213b67883 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -562,7 +562,7 @@ int mtd_pairing_info_to_wunit(struct mtd_info *mtd,
 		return -EINVAL;
 
 	if (master->pairing && master->pairing->get_wunit)
-		return mtd->pairing->get_wunit(master, info);
+		return master->pairing->get_wunit(master, info);
 
 	return info->pair;
 }

From 08e9f9476a80574a5053f4b12bb64d514e949f59 Mon Sep 17 00:00:00 2001
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Date: Thu, 24 Sep 2026 19:33:20 -0700
Subject: [PATCH 1257/1982] hwmon: (coretemp) Refresh the temperature on the
 first read

[ Upstream commit e463cd582ca125e359ad1a66cb076434c14638b2 ]

show_temp() reads the status MSR only when the cached temperature is
older than one second. Commit 5c0e64dde80f ("hwmon: (coretemp) Remove
obsolete temp_data->valid") dropped the tdata->valid check that used to
force the very first read, leaving that comparison as the only trigger.

A never-updated temp_data carries a zero timestamp, which does not look
stale on 32-bit kernels: jiffies starts 300 seconds short of wrapping,
so the comparison stays false until jiffies wraps and passes HZ. For the
first 301 seconds of uptime temp%d_input reports the zero left by the
allocator rather than the CPU temperature. 64-bit kernels are
unaffected: jiffies starts at a positive value there and does not wrap.

Backdate the timestamp when the temperature data is allocated. One jiffy
older than the caching interval is stale under either word size, and the
first refresh overwrites it.

Fixes: 5c0e64dde80f ("hwmon: (coretemp) Remove obsolete temp_data->valid")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20260924-coretemp-temp-fault-v1-1-1884f0ff97d5@linux.intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/coretemp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index a84a32ada8bd54..e8697d6b9998af 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -511,6 +511,11 @@ init_temp_data(struct platform_data *pdata, unsigned int cpu, int pkg_flag)
 	tdata->cpu = cpu;
 	tdata->cpu_core_id = topology_core_id(cpu);
 	tdata->attr_size = MAX_CORE_ATTRS;
+	/*
+	 * A zero timestamp does not look stale on 32-bit, where jiffies
+	 * starts just short of wrapping. Backdate it instead.
+	 */
+	tdata->last_updated = jiffies - HZ - 1;
 	mutex_init(&tdata->update_lock);
 	return tdata;
 }

From 07d54cfeba41db246bf72642fc8516aa5f265c0e Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
Date: Fri, 18 Sep 2026 04:01:57 -0700
Subject: [PATCH 1258/1982] dcache: report a Tasks-RCU quiescent state in
 dentry_kill()

[ Upstream commit a647a53bc89a046bee4a12a0a5627f2dfaaef807 ]

I am constantly seeing the following warning on Meta's fleet:

  INFO: rcu_tasks detected stalls on tasks:
    native_queued_spin_lock_slowpath
    locked_inode_to_wb_and_lock_list
    inode_io_list_del
    evict
    __dentry_kill
    shrink_dentry_list
    shrink_dcache_tree
    d_invalidate
    btrfs_delete_subvolume
    btrfs_ioctl_snap_destroy
    btrfs_ioctl
    do_syscall_64

dentry_kill() is the common funnel for dentry teardown: dput(),
shrink_dentry_list() and shrink_dcache_tree() all reach it, once per
dentry, and its cond_resched() is the only reschedule point on that path.

cond_resched() is not an RCU-tasks quiescent state.

Use cond_resched_tasks_rcu_qs() so the teardown reports an RCU-tasks
quiescent state as it proceeds.

Fixes: 9c5f1d30199d ("dcache: move cond_resched() into the end of __dentry_kill()")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260918-dcache-task-rcu-qa-v1-1-963ec83e6d0b@debian.org
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dcache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 1b4c210338022a..04adb623e584e9 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -686,7 +686,7 @@ static struct dentry *__dentry_kill(struct dentry *dentry)
 	if (dentry->d_op && dentry->d_op->d_release)
 		dentry->d_op->d_release(dentry);
 
-	cond_resched();
+	cond_resched_tasks_rcu_qs();
 	/* now that it's negative, ->d_parent is stable */
 	if (!IS_ROOT(dentry)) {
 		parent = dentry->d_parent;

From e2f717de9bf3673306a4a4ec36c3856bbf1ffbb1 Mon Sep 17 00:00:00 2001
From: David Cemin <dcemin@nvidia.com>
Date: Sat, 12 Sep 2026 11:21:31 -0700
Subject: [PATCH 1259/1982] ASoC: sdw_utils: clear stale RT711 device reference
 on exit

[ Upstream commit 7c7df141dcabaa5370b5e52a9d64e2c1ea13a338 ]

asoc_sdw_rt711_exit() drops the reference held in ctx->headset_codec_dev
but leaves the pointer populated. If the card cleanup path reaches the
exit hook more than once after a failed or deferred probe, a later
invocation reuses the stale pointer and calls put_device() again,
underflowing the refcount and leading to oopses when later probe,
driver bind, or suspend paths walk the SoundWire bus after the device
reference was released. Observed as boot- and suspend-time oopses on an
arm64 platform with an RT712 headset codec, reproducible
deterministically by repeated machine-driver probe cycling with the
codec drivers unloaded.

Clear the pointer after put_device() so repeated cleanup becomes a
no-op, which also makes the existing NULL check at the top of the exit
hook effective. This matches what commit 046173b98de3 ("ASoC: sdw_utils:
fix double put_device() on aggregated amps") did for the aggregated amp
references.

Fixes: 811648340707 ("ASoC: Intel: sof_sdw: avoid oops in error handling")
Cc: stable@vger.kernel.org
Signed-off-by: David Cemin <dcemin@nvidia.com>
Link: https://patch.msgid.link/20260912182131.1156475-1-dcemin@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sdw_utils/soc_sdw_rt711.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/sdw_utils/soc_sdw_rt711.c b/sound/soc/sdw_utils/soc_sdw_rt711.c
index 4aa93fdefef63a..1d020d44d474b2 100644
--- a/sound/soc/sdw_utils/soc_sdw_rt711.c
+++ b/sound/soc/sdw_utils/soc_sdw_rt711.c
@@ -123,6 +123,7 @@ int asoc_sdw_rt711_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_
 
 	device_remove_software_node(ctx->headset_codec_dev);
 	put_device(ctx->headset_codec_dev);
+	ctx->headset_codec_dev = NULL;
 
 	return 0;
 }

From 10867cbc902e6bd568063767abbb1f940c497aa4 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Mon, 14 Sep 2026 17:50:09 +0800
Subject: [PATCH 1260/1982] ASoC: wcd9335: Fix device reference leak in
 wcd9335_slim_status()

[ Upstream commit f0cc352be29ba616e0682f66f551d3f3029886fd ]

wcd9335_slim_status() obtains the SLIM interface device with
of_slim_get_device(), which uses device_find_child() internally and
returns the device with a reference held.  As the device_find_child()
documentation says: you will need to drop the reference with
put_device() after use. The reference is stored in wcd->slim_ifc_dev
and never dropped, so the SLIM interface device cannot be released.
Fix it by using devm_add_action_or_reset() or put_device() respectively.

Found by code review.

Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Link: https://patch.msgid.link/20260914095009.12049-1-make_ruc2021@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wcd9335.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 1c050b8c19de43..9887a10881b073 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5092,6 +5092,13 @@ static int wcd9335_slim_probe(struct slim_device *slim)
 	return 0;
 }
 
+static void wcd9335_put_device_action(void *data)
+{
+	struct device *dev = data;
+
+	put_device(dev);
+}
+
 static int wcd9335_slim_status(struct slim_device *sdev,
 			       enum slim_device_status status)
 {
@@ -5116,6 +5123,11 @@ static int wcd9335_slim_status(struct slim_device *sdev,
 		return -EINVAL;
 	}
 
+	ret = devm_add_action_or_reset(dev, wcd9335_put_device_action,
+			&wcd->slim_ifc_dev->dev);
+	if (ret)
+		return ret;
+
 	slim_get_logical_addr(wcd->slim_ifc_dev);
 
 	wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);

From 730424642a1719e3b5f080ffecb0aa2bdffbfce7 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 2 Sep 2026 22:26:00 +0800
Subject: [PATCH 1261/1982] peci: aspeed: Initialize state before requesting
 IRQ

[ Upstream commit 61cf765b654b76a62510269521a65e4e4a488f4c ]

The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.

Fixes: a85e4c52086c ("peci: Add peci-aspeed controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902142600.3580382-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/peci/controller/peci-aspeed.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/peci/controller/peci-aspeed.c b/drivers/peci/controller/peci-aspeed.c
index ad3a7d71ed4c61..57e1a713860742 100644
--- a/drivers/peci/controller/peci-aspeed.c
+++ b/drivers/peci/controller/peci-aspeed.c
@@ -527,14 +527,14 @@ static int aspeed_peci_probe(struct platform_device *pdev)
 	if (priv->irq < 0)
 		return priv->irq;
 
+	init_completion(&priv->xfer_complete);
+	spin_lock_init(&priv->lock);
+
 	ret = devm_request_irq(&pdev->dev, priv->irq, aspeed_peci_irq_handler,
 			       0, "peci-aspeed", priv);
 	if (ret)
 		return ret;
 
-	init_completion(&priv->xfer_complete);
-	spin_lock_init(&priv->lock);
-
 	priv->rst = devm_reset_control_get(&pdev->dev, NULL);
 	if (IS_ERR(priv->rst))
 		return dev_err_probe(priv->dev, PTR_ERR(priv->rst),

From 22ab7528546668f06a9c1b5ec1360ce197dc2da4 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 2 Sep 2026 23:22:56 +0800
Subject: [PATCH 1262/1982] peci: npcm: Initialize state before requesting IRQ

[ Upstream commit 425125e6d408b5969afb99c3e95a391f1f1ad81d ]

The PECI interrupt handler uses the lock and completion object as soon as
the interrupt is delivered. Initialize both before registering the
handler so an early interrupt cannot access uninitialized state.

Fixes: 3e16184a1bd8 ("peci: Add peci-npcm controller driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Iwona Winiarska <iwona.winiarska@intel.com>
Link: https://lore.kernel.org/r/20260902152256.3591658-1-runyu.xiao@seu.edu.cn
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/peci/controller/peci-npcm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/peci/controller/peci-npcm.c b/drivers/peci/controller/peci-npcm.c
index 9318689912412f..3cc4e959aff36f 100644
--- a/drivers/peci/controller/peci-npcm.c
+++ b/drivers/peci/controller/peci-npcm.c
@@ -253,14 +253,14 @@ static int npcm_peci_probe(struct platform_device *pdev)
 	if (priv->irq < 0)
 		return priv->irq;
 
+	init_completion(&priv->xfer_complete);
+	spin_lock_init(&priv->lock);
+
 	ret = devm_request_irq(&pdev->dev, priv->irq, npcm_peci_irq_handler,
 			       0, "peci-npcm-irq", priv);
 	if (ret)
 		return ret;
 
-	init_completion(&priv->xfer_complete);
-	spin_lock_init(&priv->lock);
-
 	ret = npcm_peci_init_ctrl(priv);
 	if (ret)
 		return ret;

From b37f9d7dbb25d71f16bae7f38197db4abb7a4ba7 Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgads@gmail.com>
Date: Tue, 15 Sep 2026 07:13:24 +0000
Subject: [PATCH 1263/1982] MIPS: mm: align hugetlb mappings in
 arch_get_unmapped_area()

[ Upstream commit 975d4a6a6d4d23a39e2f49cafcc082d937960bc4 ]

Since hugetlb mappings were made to go through the architecture's
arch_get_unmapped_area{,_topdown}(), every architecture that implements
those has to align hugetlb files itself. The generic implementation and
loongarch do it with huge_page_mask_align(); MIPS was left out.

A non-MAP_FIXED mmap() of a hugetlbfs file therefore returns an address
that is only SHMLBA aligned, and the kernel then installs 2 MB PMDs for
a VMA that starts in the middle of a PMD. The consequences on an
Octeon (CN63XX) board running a process that links libhugetlbfs with
HUGETLB_ELFMAP=R and HUGETLB_MORECORE=yes, all within a minute of
start: the neighbouring 4 KB page table is clobbered, the TLB ends up
with overlapping entries ("Caught Machine Check exception - caused by
multiple matching entries in the TLB"), process exit trips
BUG_ON(start & ~huge_page_mask(h)) in __unmap_hugepage_range(), and
freed pages leak into unrelated kernel structures (oopses in the irq
maple tree, in pte_offset_map, ...).

Do what loongarch does in commit 3109d5ff484b ("LoongArch: Set hugetlb
mmap base address aligned with pmd size"): when the file is a hugetlb
file, use its page mask as the search alignment instead of the cache
colour mask.

Fixes: 7bd3f1e1a9ae ("mm: make hugetlb mappings go through mm_get_unmapped_area_vmflags")
Cc: stable@vger.kernel.org # 6.13+
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mm/mmap.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 5d2a1225785b81..119edaa928f336 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -9,6 +9,7 @@
 #include <linux/compiler.h>
 #include <linux/elf-randomize.h>
 #include <linux/errno.h>
+#include <linux/hugetlb.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
 #include <linux/export.h>
@@ -72,8 +73,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
 	}
 
 	info.length = len;
-	info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
 	info.align_offset = pgoff << PAGE_SHIFT;
+	if (filp && is_file_hugepages(filp))
+		info.align_mask = huge_page_mask_align(filp);
+	else
+		info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
 
 	if (dir == DOWN) {
 		info.flags = VM_UNMAPPED_AREA_TOPDOWN;

From 6407390b5aa1303536508c37a054696bdd30598f Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgads@gmail.com>
Date: Tue, 15 Sep 2026 07:13:25 +0000
Subject: [PATCH 1264/1982] MIPS: mm: do not write a huge TLB entry when the
 probe misses

[ Upstream commit 0cb17268887e1df5c425ea052f5146b42d126323 ]

__update_tlb() probes for the 8K pair at the address it is given and,
for a huge pmd, writes the huge entry with tlbwi at the probed index or
with tlbwr when the probe misses. That works only if the caller passes
the faulting address, so that the probe finds the 4K entry the refill
handler loaded for the faulting page and the huge entry replaces it.

update_mmu_cache_pmd() is not called that way. do_set_pmd() has always
passed the huge-aligned address, and since commit ebcfc63d6bca ("mm:
abstract THP allocation") the anonymous THP fault path does too
(map_anon_folio_pmd()). The probe then misses the stale 4K entry, which
sits at the faulting page somewhere else in the 2 MB range, tlbwr adds
a huge entry next to it, and the TLB holds two entries matching the
faulting address. Octeon raises "Machine Check exception - caused by
multiple matching entries in the TLB" on the next refill of that page;
a process on a CN63XX board died this way within a second of start, on
the first anonymous THP of its bss.

Skip the write when the probe misses. The refill and TLBL/TLBS handlers
probe the faulting address themselves and rewrite the stale entry with
the huge one (they also set the software young bit), so the entry is
installed on the next access at the cost of one exception.

Fixes: fd062c847a8c ("MIPS: TLB support for hugetlbfs.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mm/tlb-r4k.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 24fe85fa169d16..78bafa317fa6ff 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -332,6 +332,19 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
 	/* this could be a huge page  */
 	if (pmd_leaf(*pmdp)) {
 		unsigned long lo;
+
+		/*
+		 * The probe above only covers the 8K pair at @address, and
+		 * a huge mapping is installed with the huge-aligned address
+		 * while the refill that started the fault left a 4K entry
+		 * for the faulting page elsewhere in the range. Writing the
+		 * huge entry to a random index would leave two entries
+		 * matching the faulting address; leave it to the refill and
+		 * TLBL/TLBS handlers, which probe the faulting address.
+		 */
+		if (idx < 0)
+			goto out;
+
 		write_c0_pagemask(PM_HUGE_MASK);
 		ptep = (pte_t *)pmdp;
 		lo = pte_to_entrylo(pte_val(*ptep));
@@ -339,10 +352,7 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
 		write_c0_entrylo1(lo + (HPAGE_SIZE >> 7));
 
 		mtc0_tlbw_hazard();
-		if (idx < 0)
-			tlb_write_random();
-		else
-			tlb_write_indexed();
+		tlb_write_indexed();
 		tlbw_use_hazard();
 		write_c0_pagemask(PM_DEFAULT_MASK);
 	} else
@@ -380,6 +390,9 @@ void __update_tlb(struct vm_area_struct * vma, unsigned long address, pte_t pte)
 			tlb_write_indexed();
 	}
 	tlbw_use_hazard();
+#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+out:
+#endif
 	htw_start();
 	flush_micro_tlb_vm(vma);
 

From f373581d54225fa09196bd3d907c83820aeb4955 Mon Sep 17 00:00:00 2001
From: Piotr Kubik <piotr@kubik.pl>
Date: Wed, 9 Sep 2026 16:49:29 +0200
Subject: [PATCH 1265/1982] netfilter: ctnetlink: fix inverted IPv6 address
 match in dump filter

[ Upstream commit 1ae2d094b0200f687923298c0e42579273558988 ]

ctnetlink_filter_match_tuple() rejects an entry when
!ipv6_addr_cmp(filter, entry) is true. ipv6_addr_cmp() is a memcmp() and
returns 0 for equal addresses, so the condition is true exactly when the
addresses match: a CTA_FILTER dump with an IPv6 CTA_IP_SRC or CTA_IP_DST
skips every entry that matches the requested address and returns all the
others. The IPv4 branch compares with != and behaves correctly.

Observed with libnetfilter_conntrack NFCT_FILTER_DUMP_TUPLE: a dump
filtered on src 2001:db8::10 returned only the unrelated entries, and a
dump filtered on ::1 returned every entry except the ::1 ones.
conntrack-tools does not use the tuple filter for -L, which is why this
went unnoticed.

Use ipv6_addr_equal() so the IPv6 branch mirrors the IPv4 one.

Fixes: cb8aa9a3affb ("netfilter: ctnetlink: add kernel side filtering for dump")
Cc: stable@vger.kernel.org
Signed-off-by: Piotr Kubik <piotr@kubik.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_netlink.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6ccb23a640d853..0ff9da922c392d 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1098,13 +1098,13 @@ static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple,
 		break;
 	case NFPROTO_IPV6:
 		if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) &&
-		    !ipv6_addr_cmp(&filter_tuple->src.u3.in6,
-				   &ct_tuple->src.u3.in6))
+		    !ipv6_addr_equal(&filter_tuple->src.u3.in6,
+				     &ct_tuple->src.u3.in6))
 			return 0;
 
 		if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) &&
-		    !ipv6_addr_cmp(&filter_tuple->dst.u3.in6,
-				   &ct_tuple->dst.u3.in6))
+		    !ipv6_addr_equal(&filter_tuple->dst.u3.in6,
+				     &ct_tuple->dst.u3.in6))
 			return 0;
 		break;
 	}

From 36c5520124515babba0615c2c8748206d3dc47bc Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Wed, 16 Sep 2026 00:25:46 +0200
Subject: [PATCH 1266/1982] arm64: dts: qcom: sdm845-xiaomi-beryllium: Extend
 the xbl_mem region

[ Upstream commit 511c4fea32708a065e03503c0e4d44f48990c530 ]

Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.

Cc: stable@vger.kernel.org
Fixes: 77809cf74a8c ("arm64: dts: qcom: Add support for Xiaomi Poco F1 (Beryllium)")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-1-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
index dbd5f08b5cdd35..3db935a7442ead 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi
@@ -27,6 +27,7 @@
 /delete-node/ &slpi_mem;
 /delete-node/ &spss_mem;
 /delete-node/ &rmtfs_mem;
+/delete-node/ &xbl_mem;
 
 / {
 	chassis-type = "handset";
@@ -55,6 +56,11 @@
 
 	/* Reserved memory changes from downstream */
 	reserved-memory {
+		xbl-mem@85d00000 {
+			reg = <0 0x85d00000 0 0x200000>;
+			no-map;
+		};
+
 		tz_mem: memory@86200000 {
 			reg = <0 0x86200000 0 0x4900000>;
 			no-map;

From 2597827c1f9b240e55280ed581dc1fa3438a33d9 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Wed, 16 Sep 2026 00:25:47 +0200
Subject: [PATCH 1267/1982] arm64: dts: qcom: sdm845-xiaomi-polaris: Extend the
 xbl_mem region

[ Upstream commit 38458f12419f456b16385c118bcacd76899d99b9 ]

Xiaomi's Oreo-era tree still had the CAF 1 MiB region, the 2 MiB version
arrived with the Pie import. This isn't a board-layout quirk, it tracks
the firmware. The later XBL wants one extra MiB below the old region.

Cc: stable@vger.kernel.org
Fixes: be497abe19bf ("arm64: dts: qcom: Add support for Xiaomi Mi Mix2s")

Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://patch.msgid.link/20260916-sdm845-xbl-mem-v1-2-6e3c88507997@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
index 1c50a0563bc472..8fc7cbc087ed1d 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts
@@ -32,6 +32,7 @@
 /delete-node/ &mba_region;
 /delete-node/ &slpi_mem;
 /delete-node/ &spss_mem;
+/delete-node/ &xbl_mem;
 
 / {
 	model = "Xiaomi Mi MIX 2S";
@@ -63,6 +64,11 @@
 	};
 
 	reserved-memory {
+		xbl-mem@85d00000 {
+			reg = <0 0x85d00000 0 0x200000>;
+			no-map;
+		};
+
 		adsp_mem: memory@8c500000 {
 			reg = <0 0x8c500000 0 0x1e00000>;
 			no-map;

From ae75a827b6fdaac38d52981632c019121c3c1b4f Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Date: Mon, 21 Sep 2026 11:49:37 +0530
Subject: [PATCH 1268/1982] arm64: dts: qcom: ipq9574: Wire up USB3 PHY PIPE
 clock to GCC

[ Upstream commit 117d8d40be1ded4f35f3252efa83607a7134d5e0 ]

Connect the QMP PHY USB3 output to GCC so the USB3 PHY pipe clock can
propagate to the USB controller.

Cc: stable@vger.kernel.org
Fixes: a98bfb31f676 ("arm64: dts: qcom: ipq9574: Add USB related nodes")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-4-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq9574.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq9574.dtsi b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
index 86c9cb9fffc98f..d3895259f25cca 100644
--- a/arch/arm64/boot/dts/qcom/ipq9574.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
@@ -432,7 +432,7 @@
 				 <&pcie1_phy>,
 				 <&pcie2_phy>,
 				 <&pcie3_phy>,
-				 <0>;
+				 <&usb_0_qmpphy>;
 			#clock-cells = <1>;
 			#reset-cells = <1>;
 			#interconnect-cells = <1>;

From e8168221d3c7d05b6533a36d9395aa27c578cba8 Mon Sep 17 00:00:00 2001
From: Lu Baolu <baolu.lu@linux.intel.com>
Date: Mon, 28 Sep 2026 11:27:15 +0800
Subject: [PATCH 1269/1982] iommu/vt-d: Avoid out-of-range shift in
 qi_desc_dev_iotlb_pasid()

[ Upstream commit ddea230c9fc28d1f2090ceeab3d66ce2bea658e9 ]

Callers request a full Device-TLB flush by passing MAX_AGAW_PFN_WIDTH
(64 - VTD_PAGE_SHIFT == 52) as @size_order.  Two expressions in
qi_desc_dev_iotlb_pasid() are not prepared for a value that large:

  unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
  ...
  if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))

The second evaluates to 1UL << 64, which is undefined on all
architectures.  On x86_64 the shift count masks to zero, IS_ALIGNED(addr,
1) is trivially true, and the alignment sanity check silently degrades
into a no-op.

The first evaluates to 1UL << 63.  That is well defined on 64-bit builds,
where unsigned long is 64 bits wide, but is undefined on 32-bit ones.  In
practice x86 masks the shift count to five bits, so the expression yields
1UL << 31 and ~mask becomes 0x7fffffff.  That value is zero-extended when
applied to the 64-bit descriptor, so

  desc->qw1 &= ~mask;

clears qw1[63:32] as well as bit 31, collapsing the ADDR field that had
just been filled with ones.  Reaching that requires a scalable-mode PASID
configuration on 32-bit x86, which is not a realistic deployment, but the
construct is wrong regardless.

Compute the mask with BIT_ULL() so that it is 64-bit on every
architecture, and skip the alignment check for a full flush, where it is
both meaningless and the source of the out-of-range shift.

Note that @size_order must not be clamped below 64 - VTD_PAGE_SHIFT.  With
S set, hardware derives the invalidation range from the least significant
zero bit N of ADDR and matches bits [63:N+1] of the incoming address.  For
size_order 52 the descriptor sets ADDR[63:12] and clears bit 63, making
N = 63 and the comparison range empty, so everything is invalidated.
Reducing @size_order to 51 would instead leave N = 62 and cause hardware
to compare address bit 63; since callers pass an address of 0, only the
lower half of the address space would be invalidated.  Bound @size_order
at 64 - VTD_PAGE_SHIFT so that a bogus caller cannot reintroduce an
out-of-range shift, without altering the full-flush encoding.

The non-PASID variant qi_desc_dev_iotlb() already uses 1ULL and is
unaffected.

Fixes: f701c9f36bcb7 ("iommu/vt-d: Factor out invalidation descriptor composition")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260623060122.3796325-1-guanghuifeng%40linux.alibaba.com
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel/iommu.h | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index e696e019e96979..33c9e06df63f9e 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1183,12 +1183,20 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
 					   unsigned int size_order,
 					   struct qi_desc *desc)
 {
-	unsigned long mask = 1UL << (VTD_PAGE_SHIFT + size_order - 1);
-
 	desc->qw0 = QI_DEV_EIOTLB_PASID(pasid) | QI_DEV_EIOTLB_SID(sid) |
 		QI_DEV_EIOTLB_QDEP(qdep) | QI_DEIOTLB_TYPE |
 		QI_DEV_IOTLB_PFSID(pfsid);
 
+	/*
+	 * The widest range the descriptor can express is a full flush, encoded
+	 * by making bit 63 the least significant zero bit of ADDR, that is
+	 * @size_order == 64 - VTD_PAGE_SHIFT.  Bound @size_order there so that
+	 * a caller passing something larger cannot produce an out-of-range
+	 * shift below.
+	 */
+	if (size_order > 64 - VTD_PAGE_SHIFT)
+		size_order = 64 - VTD_PAGE_SHIFT;
+
 	/*
 	 * If S bit is 0, we only flush a single page. If S bit is set,
 	 * The least significant zero bit indicates the invalidation address
@@ -1198,7 +1206,8 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
 	 * Max Invs Pending (MIP) is set to 0 for now until we have DIT in
 	 * ECAP.
 	 */
-	if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
+	if (size_order < 64 - VTD_PAGE_SHIFT &&
+	    !IS_ALIGNED(addr, BIT_ULL(VTD_PAGE_SHIFT + size_order)))
 		pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
 				    addr, size_order);
 
@@ -1214,7 +1223,7 @@ static inline void qi_desc_dev_iotlb_pasid(u16 sid, u16 pfsid, u32 pasid,
 		desc->qw1 |= GENMASK_ULL(size_order + VTD_PAGE_SHIFT - 1,
 					VTD_PAGE_SHIFT);
 		/* Clear size_order bit to indicate size */
-		desc->qw1 &= ~mask;
+		desc->qw1 &= ~BIT_ULL(VTD_PAGE_SHIFT + size_order - 1);
 		/* Set the S bit to indicate flushing more than 1 page */
 		desc->qw1 |= QI_DEV_EIOTLB_SIZE;
 	}

From ef6d993762b2198a098f2a82a0da7c29418aad5b Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Sun, 27 Sep 2026 17:38:09 +0800
Subject: [PATCH 1270/1982] ALSA: mpu401: shut down timer before freeing MPU

[ Upstream commit 9332af5220d42341bb1446a62c545c0518e990ef ]

When an MPU401 interface has no usable IRQ, the driver polls raw-MIDI
input and output with a timer. During raw-MIDI teardown, the timer callback
can already be running when snd_mpu401_uart_remove_timer() clears the last
mode bit and calls timer_delete(). That API neither waits for a running
callback nor prevents it from rearming the timer, and free_irq() does not
synchronize timer callbacks. snd_mpu401_uart_free() can therefore release
mpu while the timer callback still uses it.

Initialize the timer once when the MPU object is created and only rearm it
while a timer mode is active. Shut it down synchronously after freeing the
IRQ so an in-flight callback completes before mpu and its resources are
released.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260927093809.681726-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/drivers/mpu401/mpu401_uart.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
index 4af89822bf32b8..94213c1ff1700c 100644
--- a/sound/drivers/mpu401/mpu401_uart.c
+++ b/sound/drivers/mpu401/mpu401_uart.c
@@ -155,20 +155,20 @@ static void snd_mpu401_uart_timer(struct timer_list *t)
 
 	scoped_guard(spinlock_irqsave, &mpu->timer_lock) {
 		/*mpu->mode |= MPU401_MODE_TIMER;*/
-		mod_timer(&mpu->timer,  1 + jiffies);
+		if (mpu->timer_invoked)
+			mod_timer(&mpu->timer,  1 + jiffies);
 	}
 	if (mpu->rmidi)
 		_snd_mpu401_uart_interrupt(mpu);
 }
 
 /*
- * initialize the timer callback if not programmed yet
+ * arm the timer if it is not already active
  */
 static void snd_mpu401_uart_add_timer (struct snd_mpu401 *mpu, int input)
 {
 	guard(spinlock_irqsave)(&mpu->timer_lock);
 	if (mpu->timer_invoked == 0) {
-		timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
 		mod_timer(&mpu->timer, 1 + jiffies);
 	} 
 	mpu->timer_invoked |= input ? MPU401_MODE_INPUT_TIMER :
@@ -474,6 +474,7 @@ static void snd_mpu401_uart_free(struct snd_rawmidi *rmidi)
 	struct snd_mpu401 *mpu = rmidi->private_data;
 	if (mpu->irq >= 0)
 		free_irq(mpu->irq, (void *) mpu);
+	timer_shutdown_sync(&mpu->timer);
 	release_and_free_resource(mpu->res);
 	kfree(mpu);
 }
@@ -528,6 +529,7 @@ int snd_mpu401_uart_new(struct snd_card *card, int device,
 	spin_lock_init(&mpu->input_lock);
 	spin_lock_init(&mpu->output_lock);
 	spin_lock_init(&mpu->timer_lock);
+	timer_setup(&mpu->timer, snd_mpu401_uart_timer, 0);
 	mpu->hardware = hardware;
 	mpu->irq = -1;
 	mpu->rmidi = rmidi;

From 757e0634790ea7745b95097a7658c8fedc90e2eb Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:48:53 +0000
Subject: [PATCH 1271/1982] ASoC: codecs: wcd9335: Fix SLIM interface device
 leak in wcd9335_slim_status()

[ Upstream commit 082723fee626532f176727b6438b666a96d5246c ]

of_slim_get_device() returns a device with an elevated reference count,
and wcd->slim_ifc_dev is intentionally kept for the codec lifetime on
success. However, all the failure paths of wcd9335_slim_status() return
without dropping that reference, leaking the SLIM interface device
whenever the register maps cannot be created or the codec fails to come
up.

Put the device on each of those error paths.

Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917164853.2163184-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wcd9335.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 9887a10881b073..d607400b3976d1 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -5131,25 +5131,32 @@ static int wcd9335_slim_status(struct slim_device *sdev,
 	slim_get_logical_addr(wcd->slim_ifc_dev);
 
 	wcd->regmap = regmap_init_slimbus(sdev, &wcd9335_regmap_config);
-	if (IS_ERR(wcd->regmap))
+	if (IS_ERR(wcd->regmap)) {
+		put_device(&wcd->slim_ifc_dev->dev);
 		return dev_err_probe(dev, PTR_ERR(wcd->regmap),
 				     "Failed to allocate slim register map\n");
+	}
 
 	wcd->if_regmap = regmap_init_slimbus(wcd->slim_ifc_dev,
 						  &wcd9335_ifc_regmap_config);
-	if (IS_ERR(wcd->if_regmap))
+	if (IS_ERR(wcd->if_regmap)) {
+		put_device(&wcd->slim_ifc_dev->dev);
 		return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
 				     "Failed to allocate ifc register map\n");
+	}
 
 	ret = wcd9335_bring_up(wcd);
 	if (ret) {
 		dev_err(dev, "Failed to bringup WCD9335\n");
+		put_device(&wcd->slim_ifc_dev->dev);
 		return ret;
 	}
 
 	ret = wcd9335_irq_init(wcd);
-	if (ret)
+	if (ret) {
+		put_device(&wcd->slim_ifc_dev->dev);
 		return ret;
+	}
 
 	wcd9335_probe(wcd);
 

From 1b8bf087120529f811d2691b21fa35fc15f08dca Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 21:17:31 +0800
Subject: [PATCH 1272/1982] iio: dac: ad5755: validate SPI match data

[ Upstream commit 85e2c8ca7ac9e39a61e7fb18728918f6e966f439 ]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but ad5755_probe() stores and later dereferences the result.

Validate the match data before it is used.

Fixes: 62d3fb9dcc09 ("iio: dac: ad5755: make use of of_device_id table")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/dac/ad5755.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
index d0e5f35462b1b8..ce188c5a9ad157 100644
--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -819,6 +819,9 @@ static int ad5755_probe(struct spi_device *spi)
 	spi_set_drvdata(spi, indio_dev);
 
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
+
 	st->spi = spi;
 	st->pwr_down = 0xf;
 

From a3978818956647cea11dd12cede3c6c008a63edf Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 21:17:33 +0800
Subject: [PATCH 1273/1982] iio: frequency: adf4377: reject devices without
 match data

[ Upstream commit 2f3196d27e3bfcee0569d23a123aedcc6ddd39f1 ]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but the result is later dereferenced by the property parsing and
initialization paths.

Reject devices without match data before continuing probe.

Fixes: 6140a92cd086 ("iio: frequency: adf4377: add adf4378 support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/frequency/adf4377.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/frequency/adf4377.c b/drivers/iio/frequency/adf4377.c
index 48aa4b015a141e..0548f626bb45c3 100644
--- a/drivers/iio/frequency/adf4377.c
+++ b/drivers/iio/frequency/adf4377.c
@@ -964,6 +964,9 @@ static int adf4377_probe(struct spi_device *spi)
 	st->regmap = regmap;
 	st->spi = spi;
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
+
 	mutex_init(&st->lock);
 
 	ret = adf4377_properties_parse(st);

From aafccd547ea2a330120ade63677a06dccd138282 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 21:17:34 +0800
Subject: [PATCH 1274/1982] iio: imu: adis16400: validate SPI match data

[ Upstream commit 2c01a0a1c5550b4f502c7747c06d2e57a240cd87 ]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but adis16400_probe() immediately dereferences the result.

Validate the match data before it is used.

Fixes: 2ef920e0e5c0 ("iio: imu: adis16400: Use separate structures rather than an array for chip info")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/adis16400.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 7e85c1b8dc1601..9f8721c196a953 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -1150,6 +1150,9 @@ static int adis16400_probe(struct spi_device *spi)
 
 	/* setup the industrialio driver allocated elements */
 	st->variant = spi_get_device_match_data(spi);
+	if (!st->variant)
+		return -ENODATA;
+
 	indio_dev->name = spi_get_device_id(spi)->name;
 	indio_dev->channels = st->variant->channels;
 	indio_dev->num_channels = st->variant->num_channels;

From b46ccd625f991caf8d47929c1c2aebae4ada9754 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 21:17:35 +0800
Subject: [PATCH 1275/1982] iio: potentiometer: x9250: reject devices without
 match data

[ Upstream commit d13716e3defd5b8cec3ee2c27f4d9b7e01314067 ]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but x9250_probe() later dereferences the result while naming the IIO
device.

Reject devices without match data before enabling the regulators.

Fixes: 66bfc528a6fd ("iio: potentiometer: Add support for the Renesas X9250 potentiometers")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/potentiometer/x9250.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/potentiometer/x9250.c b/drivers/iio/potentiometer/x9250.c
index 7353484926997f..1c9e22459058b0 100644
--- a/drivers/iio/potentiometer/x9250.c
+++ b/drivers/iio/potentiometer/x9250.c
@@ -155,10 +155,15 @@ static const char *const x9250_regulator_names[] = {
 
 static int x9250_probe(struct spi_device *spi)
 {
+	const struct x9250_cfg *cfg;
 	struct iio_dev *indio_dev;
 	struct x9250 *x9250;
 	int ret;
 
+	cfg = spi_get_device_match_data(spi);
+	if (!cfg)
+		return -ENODATA;
+
 	ret = devm_regulator_bulk_get_enable(&spi->dev, ARRAY_SIZE(x9250_regulator_names),
 					     x9250_regulator_names);
 	if (ret)
@@ -176,7 +181,7 @@ static int x9250_probe(struct spi_device *spi)
 
 	x9250 = iio_priv(indio_dev);
 	x9250->spi = spi;
-	x9250->cfg = spi_get_device_match_data(spi);
+	x9250->cfg = cfg;
 	x9250->wp_gpio = devm_gpiod_get_optional(&spi->dev, "wp", GPIOD_OUT_LOW);
 	if (IS_ERR(x9250->wp_gpio))
 		return dev_err_probe(&spi->dev, PTR_ERR(x9250->wp_gpio),

From 2d3d960463e0c0778faf242f64e49506eaa9952d Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 21:17:36 +0800
Subject: [PATCH 1276/1982] iio: pressure: bmp280: validate SPI match data

[ Upstream commit 206fc54554c28d76c5d8f66091b846ef1dd88f64 ]

A device bound through driver_override need not match an entry in the
driver tables. In that case spi_get_device_match_data() returns NULL,
but bmp280_spi_probe() immediately dereferences the result.

Validate the match data before selecting the regmap bus.

Fixes: faac4dda9a91 ("iio: pressure: bmp280: Use spi_get_device_match_data()")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/pressure/bmp280-spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
index 3b90384f17d735..e303923df6757c 100644
--- a/drivers/iio/pressure/bmp280-spi.c
+++ b/drivers/iio/pressure/bmp280-spi.c
@@ -83,6 +83,8 @@ static int bmp280_spi_probe(struct spi_device *spi)
 	struct regmap *regmap;
 
 	chip_info = spi_get_device_match_data(spi);
+	if (!chip_info)
+		return -ENODATA;
 
 	if (chip_info->spi_read_extra_byte)
 		bmp_regmap_bus = &bmp380_regmap_bus;

From f4ca846273cfe403f2907215e85c4db21b00ffbd Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:57:40 +0800
Subject: [PATCH 1277/1982] iio: adc: ad7606: reject devices without match data

[ Upstream commit 7830650d5293a0f412a869225262ca51b661e49f ]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

ad7606_spi_probe() dereferences the returned bus information to pass
the chip information and bus operations to the core, causing a NULL
pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before entering the core.

Fixes: bc69e9fffde4 ("iio: adc: ad7606: Add compatibility to fw_nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/ad7606_spi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c
index f28e4ca3770763..bec3f656406bfa 100644
--- a/drivers/iio/adc/ad7606_spi.c
+++ b/drivers/iio/adc/ad7606_spi.c
@@ -456,7 +456,11 @@ static const struct ad7606_bus_info ad7616_bus_info = {
 
 static int ad7606_spi_probe(struct spi_device *spi)
 {
-	const struct ad7606_bus_info *bus_info = spi_get_device_match_data(spi);
+	const struct ad7606_bus_info *bus_info;
+
+	bus_info = spi_get_device_match_data(spi);
+	if (!bus_info)
+		return -ENODATA;
 
 	return ad7606_probe(&spi->dev, spi->irq, NULL,
 			    bus_info->chip_info, bus_info->bops);

From 3c35aa8d9ead9906b8f4a04d15416e36f3302743 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:57:42 +0800
Subject: [PATCH 1278/1982] iio: adc: max11205: reject devices without match
 data

[ Upstream commit a07b5db685b2a3084240f9b4a9ee44f3b478c6e3 ]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

max11205_probe() immediately dereferences the returned chip information
to set the IIO device name, causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before using the chip information.

Fixes: bf3c855be801 ("iio: adc: max11205: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/max11205.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/adc/max11205.c b/drivers/iio/adc/max11205.c
index 6c803df220b6e9..e8404973b01a04 100644
--- a/drivers/iio/adc/max11205.c
+++ b/drivers/iio/adc/max11205.c
@@ -117,6 +117,8 @@ static int max11205_probe(struct spi_device *spi)
 	ad_sd_init(&st->sd, indio_dev, spi, &max11205_sigma_delta_info);
 
 	st->chip_info = spi_get_device_match_data(spi);
+	if (!st->chip_info)
+		return -ENODATA;
 
 	indio_dev->name = st->chip_info->name;
 	indio_dev->modes = INDIO_DIRECT_MODE;

From e5290017ad1c046554705c0b22dec97796dad02e Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:57:43 +0800
Subject: [PATCH 1279/1982] iio: adc: mcp3911: reject devices without match
 data

[ Upstream commit d3410a48d5eb9dd8238099cb0ee368d12005a385 ]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

mcp3911_probe() stores the result and later calls through chip->config
and accesses other chip-specific fields, causing a NULL pointer
dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before continuing the probe.

Fixes: 732ad34260d3 ("iio: adc: mcp3911: add support for the whole MCP39xx family")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/mcp3911.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
index a6f21791c68591..5bdfe5e2671883 100644
--- a/drivers/iio/adc/mcp3911.c
+++ b/drivers/iio/adc/mcp3911.c
@@ -722,6 +722,8 @@ static int mcp3911_probe(struct spi_device *spi)
 	adc = iio_priv(indio_dev);
 	adc->spi = spi;
 	adc->chip = spi_get_device_match_data(spi);
+	if (!adc->chip)
+		return -ENODATA;
 
 	ret = devm_regulator_get_enable_read_voltage(dev, "vref");
 	if (ret < 0 && ret != -ENODEV)

From 8953416b6218474aaaf61f2ff38b50ad32a7d64e Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:57:44 +0800
Subject: [PATCH 1280/1982] iio: adc: ti-adc128s052: validate SPI match data

[ Upstream commit 4ac257f2fd2a9cac00e748486fa003b4e1cc453e ]

SPI driver_override allows a device to bind to this driver without
matching either the firmware tables or SPI device ID table. In that
case, spi_get_device_match_data() returns NULL.

adc128_probe() also obtains the IIO device name by dereferencing the
result of spi_get_device_id(), which is NULL on the same override path.
The probe can therefore crash before it reaches the match data access.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data and use the always available SPI
modalias for the IIO device name.

Fixes: d5f0da0c6972 ("iio: adc: ti-adc128s052: Switch to use spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/ti-adc128s052.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
index 4ae65793ad9b3c..19c30d60c504ce 100644
--- a/drivers/iio/adc/ti-adc128s052.c
+++ b/drivers/iio/adc/ti-adc128s052.c
@@ -196,12 +196,14 @@ static int adc128_probe(struct spi_device *spi)
 	adc = iio_priv(indio_dev);
 	adc->spi = spi;
 
-	indio_dev->name = spi_get_device_id(spi)->name;
+	config = spi_get_device_match_data(spi);
+	if (!config)
+		return -ENODATA;
+
+	indio_dev->name = spi->modalias;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &adc128_info;
 
-	config = spi_get_device_match_data(spi);
-
 	indio_dev->channels = config->channels;
 	indio_dev->num_channels = config->num_channels;
 

From 5381f1c9be61b7da2844ba118978959e5fd1694b Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:43:28 +0800
Subject: [PATCH 1281/1982] iio: accel: adxl313: reject devices without match
 data

[ Upstream commit defd4c0b29f1cd17caa5feebac33fc5fdf4e1916 ]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

adxl313_spi_probe() dereferences chip_data to select the regmap
configuration, causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data before selecting the configuration.

Fixes: d6e3ee74d16f ("iio: accel: adxl313: simplify with spi_get_device_match_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/adxl313_spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/accel/adxl313_spi.c b/drivers/iio/accel/adxl313_spi.c
index dedb0885c27725..b2287f4f4442f7 100644
--- a/drivers/iio/accel/adxl313_spi.c
+++ b/drivers/iio/accel/adxl313_spi.c
@@ -79,6 +79,8 @@ static int adxl313_spi_probe(struct spi_device *spi)
 		return ret;
 
 	chip_data = spi_get_device_match_data(spi);
+	if (!chip_data)
+		return -ENODATA;
 
 	regmap = devm_regmap_init_spi(spi,
 				      &adxl31x_spi_regmap_config[chip_data->type]);

From f5977b1359625cdc6dd9130243af2019ca630992 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 25 Sep 2026 20:43:30 +0800
Subject: [PATCH 1282/1982] iio: accel: adxl380: reject devices without match
 data

[ Upstream commit 9f6d174e9fa5b265e7a0a6caa0c5b579bf899702 ]

SPI driver_override allows a device to bind to this driver without
matching either the OF or SPI device ID table. In that case,
spi_get_device_match_data() returns NULL.

adxl380_spi_probe() passes the result to adxl380_probe(), which
dereferences chip_info to set the IIO device name and operations,
causing a NULL pointer dereference.

Commit 572a00852635 ("iio: dac: ad5686: missing NULL check on match
data") fixed the same driver_override issue in another SPI driver.
Reject devices without match data in the SPI frontend.

Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/adxl380_spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iio/accel/adxl380_spi.c b/drivers/iio/accel/adxl380_spi.c
index 6edd0d211ffad9..b51edc021b267f 100644
--- a/drivers/iio/accel/adxl380_spi.c
+++ b/drivers/iio/accel/adxl380_spi.c
@@ -26,6 +26,8 @@ static int adxl380_spi_probe(struct spi_device *spi)
 	struct regmap *regmap;
 
 	chip_data = spi_get_device_match_data(spi);
+	if (!chip_data)
+		return -ENODATA;
 
 	regmap = devm_regmap_init_spi(spi, &adxl380_spi_regmap_config);
 	if (IS_ERR(regmap))

From 621cb2fe38d5a2ba3c833b1d96607e089a144fba Mon Sep 17 00:00:00 2001
From: Cheick Traore <cheick.traore-ext@st.com>
Date: Thu, 24 Sep 2026 11:53:56 +0200
Subject: [PATCH 1283/1982] iio: adc: stm32: fix minimum sampling time values

[ Upstream commit ef04fdc999ee40a58d513ea48d391c7dc78c908c ]

- On stm32mp15: vddcpu and vddq_ddr are not connected to internal
channel, so their sampling time shouldn't be set.

- On stm32mp13: vddcpu and vddq_ddr are connected to internal channels
and the value for vddcore was not correct. Values from the datasheet
are 1us (e.g. 1000ns) for ts_vddcore, ts_vddcpu and ts_vddq_ddr.

Fixes: 7cb2303dd024 ("iio: adc: stm32: manage min sampling time on all internal channels")
Cc: stable@vger.kernel.org
Signed-off-by: Cheick Traore <cheick.traore-ext@st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/stm32-adc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index dae35ab929b624..ab4433210ad09b 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -2743,7 +2743,7 @@ static const struct stm32_adc_cfg stm32h7_adc_cfg = {
 	.set_ovs = stm32h7_adc_set_ovs,
 };
 
-static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 100, 100, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp1[] = { 100, 0, 0, 4300, 9800 };
 static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp1) == STM32_ADC_INT_CH_NB);
 
 static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
@@ -2765,7 +2765,7 @@ static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
 	.set_ovs = stm32h7_adc_set_ovs,
 };
 
-static const unsigned int stm32_adc_min_ts_mp13[] = { 100, 0, 0, 4300, 9800 };
+static const unsigned int stm32_adc_min_ts_mp13[] = { 1000, 1000, 1000, 4300, 9800 };
 static_assert(ARRAY_SIZE(stm32_adc_min_ts_mp13) == STM32_ADC_INT_CH_NB);
 
 static const struct stm32_adc_cfg stm32mp13_adc_cfg = {

From 6cea6cc1731b00b2879ec64a6dd6f2e7dc03ae45 Mon Sep 17 00:00:00 2001
From: Lucas Costa <2000.costalucas@gmail.com>
Date: Fri, 25 Sep 2026 16:30:08 -0300
Subject: [PATCH 1284/1982] spi: bcm2835: fix device_node reference leak in
 bcm2835_spi_setup()

[ Upstream commit 8db44cca03df066186d6220bfad9fa482d7cdc13 ]

of_find_compatible_node() returns a device_node with its reference count
incremented, but bcm2835_spi_setup() only uses the return value to test
for a matching node in the loop and never releases it.

Declare the node with a scope-based __free(device_node) cleanup so the
reference is dropped automatically when leaving the loop body, matching
the existing __free(kfree) usage in the same function.

Fixes: e19c1272c80a ("spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent")
Cc: stable@vger.kernel.org
Signed-off-by: Lucas Costa <2000.costalucas@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260925193008.127314-1-2000.costalucas@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm2835.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 192cc5ef65fb7b..61f70da3959e50 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1297,7 +1297,9 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 	}
 
 	for (i = 0; i < ARRAY_SIZE(pinctrl_compats); i++) {
-		if (of_find_compatible_node(NULL, NULL, pinctrl_compats[i]))
+		struct device_node *np __free(device_node) =
+			of_find_compatible_node(NULL, NULL, pinctrl_compats[i]);
+		if (np)
 			break;
 	}
 

From 5352e7447219bf7777aa0cffe0752f655d9a0060 Mon Sep 17 00:00:00 2001
From: Ibrahim Hashimov <security@auditcode.ai>
Date: Thu, 9 Jul 2026 00:46:18 +0200
Subject: [PATCH 1285/1982] fs/ntfs3: fix integer overflow in find_log_rec()
 causing OOB read

[ Upstream commit e2fcb0040b0b4097b2e97f3fbe77d3b66df9e816 ]

find_log_rec() validates the on-disk LFS_RECORD_HDR.client_data_len
field (`len`, a raw u32 read straight from a mounted $LogFile page)
against the log's total available space:

    len = le32_to_cpu(rh->client_data_len);
    rec_len = len + log->record_header_len;
    if (rec_len >= log->total_avail)
            return -EINVAL;

The addition is unchecked. For len in [0xffffffd0, 0xffffffff] (i.e.
log->record_header_len away from UINT_MAX), `rec_len` wraps to a small
u32 value that trivially clears the `rec_len >= log->total_avail`
guard, so a record whose declared length is actually ~4 GiB is
reported as valid and in-page.

Because find_log_rec() wrongly accepts the record, its caller
read_log_rec_lcb() hands it back to log_replay() as good. On the
transaction-table replay leg, log_replay() re-derives the record
length directly from the same raw, still-unclamped client_data_len
field and uses it to size the restart-table blob:

    rec_len = le32_to_cpu(frh->client_data_len);   /* ~0xffffffff */
    ...
    t16 = le16_to_cpu(lrh->redo_off);
    rt  = Add2Ptr(lrh, t16);
    t32 = rec_len - t16;                            /* still ~4 GiB */
    if (!check_rstbl(rt, t32))
            return -EINVAL;

check_rstbl()'s own `bytes < ts` bounds guard is defeated because the
caller-supplied `bytes` (t32) is itself the poisoned ~4 GiB value, so
the guard can never trigger. The subsequent entry-validation loop then
walks `rt->used` (also attacker-controlled) entries of
sizeof(struct RESTART_TABLE) == 0x18 bytes each straight past the end
of the kmalloc(log->page_size) log-page buffer allocated in
read_log_page(), producing an out-of-bounds read that is reachable
simply by mounting a crafted $LogFile (no genuine dirty-page /
crash-recovery state is required). Confirmed via KASAN as a
slab-out-of-bounds read in check_rstbl(), called from log_replay() ->
ntfs_loadlog_and_replay() -> ntfs_fill_super() -> mount(2).

Fix the root cause instead of hardening every downstream consumer of
the poisoned length: make the addition in find_log_rec() overflow-safe
with check_add_overflow(), mirroring the pattern fs/ntfs3/run.c
already uses to validate other attacker-controlled on-disk
length/offset arithmetic decoded from MAPPING_PAIRS runs, e.g.:

    if (check_add_overflow(vcn64, len, &next_vcn))
            return -EINVAL;
    ...
    if (check_add_overflow(lcn, len, &lcn_end))
            return -EINVAL;

(fs/ntfs3/run.c, run_unpack()).

With the overflow rejected instead of silently wrapped, `rec_len` is
only ever a true, non-wrapped sum, so the existing
`rec_len >= log->total_avail` check now correctly rejects any
oversized record up front. log_replay()'s transaction-table leg then
never gets a chance to re-read the poisoned client_data_len, and
check_rstbl() is never invoked with an attacker-inflated `bytes` for
this path.

Verified on a v6.19 KASAN build: mounting a crafted $LogFile whose
client_data_len overflows trips a KASAN slab-out-of-bounds-read
report in check_rstbl() before this fix; with check_add_overflow()
applied, the same image is cleanly rejected during log replay and no
KASAN report fires.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/fslog.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ae15c2fc48646a..ca3533a10d0646 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -7,6 +7,7 @@
 
 #include <linux/blkdev.h>
 #include <linux/fs.h>
+#include <linux/overflow.h>
 #include <linux/random.h>
 #include <linux/slab.h>
 
@@ -2455,7 +2456,8 @@ static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
 	 * Check that the length field isn't greater than the total
 	 * available space the log file.
 	 */
-	rec_len = len + log->record_header_len;
+	if (check_add_overflow(len, log->record_header_len, &rec_len))
+		return -EINVAL;
 	if (rec_len >= log->total_avail)
 		return -EINVAL;
 

From b0f54c804cc0f8ea47ffef685de9c01666233e43 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Sat, 26 Sep 2026 15:16:05 +0800
Subject: [PATCH 1286/1982] cxl/acpi: Check ACPI companion before use

[ Upstream commit 371c2ad1624283b6c7a62a28199f5161d388a738 ]

Platform drivers can be forced to match devices outside their ID tables
through driver_override.  cxl_acpi_probe() assumes that every bound device
has an ACPI companion and dereferences adev->dev.bus without checking the
result of ACPI_COMPANION().  Force-binding cxl_acpi to a platform device
without a companion therefore causes a NULL pointer dereference.

This was reproduced by setting the driver override for the pcspkr platform
device to cxl_acpi and binding it through sysfs:

  BUG: kernel NULL pointer dereference, address: 0000000000000280
  #PF: supervisor read access in kernel mode
  RIP: cxl_acpi_probe+0xf4/0x220
  Call Trace:
   platform_probe+0x4d/0x80
   really_probe+0x106/0x370
   device_driver_attach+0x4c/0xa0
   bind_store+0xd0/0x100

Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
companion before use") fixed the same force-binding issue in another
platform driver.  Check the companion before setting up the CXL root and
return -ENODEV when it is absent.

Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260926071605.3013893-1-yaojiale02@163.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cxl/acpi.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index bd2e282ca93a05..5e9bb0df46dd88 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -892,13 +892,17 @@ static int pair_cxl_resource(struct device *dev, void *data)
 
 static int cxl_acpi_probe(struct platform_device *pdev)
 {
-	int rc;
+	struct cxl_cfmws_context ctx;
+	struct acpi_device *adev;
 	struct resource *cxl_res;
 	struct cxl_root *cxl_root;
 	struct cxl_port *root_port;
 	struct device *host = &pdev->dev;
-	struct acpi_device *adev = ACPI_COMPANION(host);
-	struct cxl_cfmws_context ctx;
+	int rc;
+
+	adev = ACPI_COMPANION(host);
+	if (!adev)
+		return -ENODEV;
 
 	device_lock_set_class(&pdev->dev, &cxl_root_key);
 	rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,

From 01cc89543a136c799fa5ca36dd71b7d3b0cd83ee Mon Sep 17 00:00:00 2001
From: Hitesh Patel <hitesh@ebytelogic.com>
Date: Mon, 28 Sep 2026 17:45:03 +0530
Subject: [PATCH 1287/1982] media: qcom: camss: vfe-17x: Fix write master
 buffer done being dropped

[ Upstream commit eed550a8191c2f6984047a1b794b313d1bacf77d ]

The VFE 17x interrupt handler reads and clears the bus status
registers on every interrupt, but only acts on the per write master
BUF_DONE bits when bit 9 of IRQ_STATUS_0 is set as well. Bit 9 is the
ping-pong flag of image master 1. It has nothing to do with the other
write masters, and it is not guaranteed to be set in the same
interrupt in which a write master reports a completed buffer.

The bus status is read-to-clear. When a buffer done arrives while bit
9 is not set, the handler clears the status and never calls
wm_done() for it. The buffer stays queued in the driver and the video
node never receives that frame.

With one RDI streaming this is rare. With two RDIs streaming on the
same VFE, for instance two virtual channels demultiplexed by the CSID,
the interrupt rate doubles and one of the two lines loses buffer done
events continuously.

Act on the bus status alone, as the other gen2 VFE handlers do.

Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/camss/camss-vfe-17x.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index e5ee7e717b3bcb..c011f64f63e93e 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -364,9 +364,8 @@ static irqreturn_t vfe_isr(int irq, void *dev)
 			vfe->isr_ops.comp_done(vfe, i);
 
 	for (wm = 0; wm < MSM_VFE_IMAGE_MASTERS_NUM; wm++)
-		if (status0 & BIT(9))
-			if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
-				vfe->isr_ops.wm_done(vfe, wm);
+		if (vfe_bus_status[1] & STATUS1_WM_CLIENT_BUF_DONE(wm))
+			vfe->isr_ops.wm_done(vfe, wm);
 
 	return IRQ_HANDLED;
 }

From eef4734a50d6c9145999f17b391c81e7ae1bc1c1 Mon Sep 17 00:00:00 2001
From: Hitesh Patel <hitesh@ebytelogic.com>
Date: Mon, 28 Sep 2026 17:45:04 +0530
Subject: [PATCH 1288/1982] media: qcom: camss: vfe-17x: Fix write master
 selection for RDI lines

[ Upstream commit fc02156a3efb747b724a490cc50e1ad8c28a3b23 ]

On the gen2 VFE bus there is no crossbar between the RDI paths and
the bus write masters: RDI n is served by write master n. The common
vfe_get_output_v2() reflects this by mapping line->id to write master
line->id, and every gen2 VFE except 17x uses it.

The 17x code kept its own vfe_get_output(), which reserves whichever
write master is free first. That happens to be the right one as long
as a single line streams and it is RDI0. As soon as two lines of the
same VFE stream, for instance two virtual channels demultiplexed by
the CSID to RDI0 and RDI1, the second line to start is given the
write master of the other RDI. Both write masters are then programmed
with the buffer address and frame size of the wrong line. The frames
are truncated to the smaller of the two buffers and the SMMU faults
on the larger one.

Use vfe_get_output_v2() on 17x like the other gen2 VFEs and drop the
duplicate. This also removes an error path that released
output->wm_idx[0] before it had been assigned.

The gen1 VFEs are not affected: they have a bus crossbar and any write
master can serve any line, so vfe_reserve_wm() is correct there.

Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/qcom/camss/camss-vfe-17x.c | 41 +------------------
 1 file changed, 1 insertion(+), 40 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index c011f64f63e93e..62c2405359a06b 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -382,45 +382,6 @@ static int vfe_halt(struct vfe_device *vfe)
 	return 0;
 }
 
-static int vfe_get_output(struct vfe_line *line)
-{
-	struct vfe_device *vfe = to_vfe(line);
-	struct vfe_output *output;
-	unsigned long flags;
-	int wm_idx;
-
-	spin_lock_irqsave(&vfe->output_lock, flags);
-
-	output = &line->output;
-	if (output->state > VFE_OUTPUT_RESERVED) {
-		dev_err(vfe->camss->dev, "Output is running\n");
-		goto error;
-	}
-
-	output->wm_num = 1;
-
-	wm_idx = vfe_reserve_wm(vfe, line->id);
-	if (wm_idx < 0) {
-		dev_err(vfe->camss->dev, "Can not reserve wm\n");
-		goto error_get_wm;
-	}
-	output->wm_idx[0] = wm_idx;
-
-	output->drop_update_idx = 0;
-
-	spin_unlock_irqrestore(&vfe->output_lock, flags);
-
-	return 0;
-
-error_get_wm:
-	vfe_release_wm(vfe, output->wm_idx[0]);
-	output->state = VFE_OUTPUT_OFF;
-error:
-	spin_unlock_irqrestore(&vfe->output_lock, flags);
-
-	return -EINVAL;
-}
-
 /*
  * vfe_enable - Enable streaming on VFE line
  * @line: VFE line
@@ -441,7 +402,7 @@ static int vfe_enable(struct vfe_line *line)
 
 	mutex_unlock(&vfe->stream_lock);
 
-	ret = vfe_get_output(line);
+	ret = vfe_get_output_v2(line);
 	if (ret < 0)
 		goto error_get_output;
 

From f73b13bd811b876f9481697e9b197f28ad11e646 Mon Sep 17 00:00:00 2001
From: Hitesh Patel <hitesh@ebytelogic.com>
Date: Mon, 28 Sep 2026 17:45:05 +0530
Subject: [PATCH 1289/1982] media: qcom: camss: vfe: Fix VFE reset while
 another line is streaming

[ Upstream commit e5d4b0e69a4017fd39354499c9d7583f625f0524 ]

vfe_disable_output() stops the write masters of the line being
disabled and then resets the whole VFE. The reset is not limited to
that line.

When two lines of one VFE stream at the same time, which is the case
whenever a CSID demultiplexes several virtual channels to different
RDIs, stopping the first line resets the VFE underneath the second
line. The second line's write master configuration is wiped, the
buffers it had in flight are never completed, and the VFE is left in
a state in which the next global reset is not acknowledged. Stopping
or restarting the second line then fails with:

  VFE reset timeout

Move the reset to vfe_disable() and do it under stream_lock, as part
of the decrement that makes the count reach zero, so that exactly one
caller resets and no line can be enabled while the reset runs.
Stopping the line's write masters is enough to quiesce that line on
its own. With a single line streaming, the reset happens exactly as
before.

Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
Cc: stable@vger.kernel.org
Signed-off-by: Hitesh Patel <hitesh@ebytelogic.com>
Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
[bod: Converted vfe_disable_output to void]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/camss/camss-vfe.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index 20e0d6604fa936..bf76ac3fd4c52d 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -804,7 +804,7 @@ int vfe_put_output(struct vfe_line *line)
 	return 0;
 }
 
-static int vfe_disable_output(struct vfe_line *line)
+static void vfe_disable_output(struct vfe_line *line)
 {
 	struct vfe_device *vfe = to_vfe(line);
 	struct vfe_output *output = &line->output;
@@ -816,8 +816,6 @@ static int vfe_disable_output(struct vfe_line *line)
 		vfe->res->hw_ops->vfe_wm_stop(vfe, output->wm_idx[i]);
 	output->gen2.active_num = 0;
 	spin_unlock_irqrestore(&vfe->output_lock, flags);
-
-	return vfe_reset(vfe);
 }
 
 /*
@@ -829,21 +827,19 @@ static int vfe_disable_output(struct vfe_line *line)
 int vfe_disable(struct vfe_line *line)
 {
 	struct vfe_device *vfe = to_vfe(line);
-	int ret;
+	int ret = 0;
 
-	ret = vfe_disable_output(line);
-	if (ret)
-		goto error;
+	vfe_disable_output(line);
 
 	vfe_put_output(line);
 
 	mutex_lock(&vfe->stream_lock);
 
-	vfe->stream_count--;
+	if (--vfe->stream_count == 0)
+		ret = vfe_reset(vfe);
 
 	mutex_unlock(&vfe->stream_lock);
 
-error:
 	return ret;
 }
 

From 8e1efcccc8284d20ce70ac158e8c6b095c6439a8 Mon Sep 17 00:00:00 2001
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
Date: Thu, 23 Jul 2026 13:09:50 +0200
Subject: [PATCH 1290/1982] media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE
 lite clock lists

[ Upstream commit 583b27edfe669fe27c631b4ac77c0ce0250f7bba ]

The "gcc_axi_hf" clock is correctly listed in the clock list of the
8775p 2 main VFE-s, but it is missing from all the VFE-lite clock lists,
causing these to not work on platforms where the firmware allows turning
off "gcc_axi_hf".

Add the missing "gcc_axi_hf" to fix the VFE-lite blocks not working on
these platforms.

Fixes: 924f45e58b1fe ("media: qcom: camss: Add missing clocks for VFE lite on sa8775p")
Cc: stable@vger.kernel.org
Suggested-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Tested-by: Cory Keitz <ckeitz@amazon.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/camss/camss.c | 25 ++++++++++++++---------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index c1148f6ad6b265..0fb43cb6348da2 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2926,10 +2926,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
 	/* VFE2 (lite) */
 	{
 		.regulators = {},
-		.clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
-			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+		.clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+			   "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
 			   "vfe_lite", "camnoc_axi"},
 		.clock_rate = {
+			{ 0 },
 			{ 0 },
 			{ 0 },
 			{ 300000000, 400000000, 400000000, 400000000 },
@@ -2951,10 +2952,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
 	/* VFE3 (lite) */
 	{
 		.regulators = {},
-		.clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
-			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+		.clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+			   "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
 			   "vfe_lite", "camnoc_axi"},
 		.clock_rate = {
+			{ 0 },
 			{ 0 },
 			{ 0 },
 			{ 300000000, 400000000, 400000000, 400000000 },
@@ -2976,10 +2978,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
 	/* VFE4 (lite) */
 	{
 		.regulators = {},
-		.clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
-			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+		.clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+			   "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
 			   "vfe_lite", "camnoc_axi"},
 		.clock_rate = {
+			{ 0 },
 			{ 0 },
 			{ 0 },
 			{ 300000000, 400000000, 400000000, 400000000 },
@@ -3001,10 +3004,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
 	/* VFE5 (lite) */
 	{
 		.regulators = {},
-		.clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
-			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+		.clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+			   "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
 			   "vfe_lite", "camnoc_axi"},
 		.clock_rate = {
+			{ 0 },
 			{ 0 },
 			{ 0 },
 			{ 300000000, 400000000, 400000000, 400000000 },
@@ -3026,10 +3030,11 @@ static const struct camss_subdev_resources vfe_res_8775p[] = {
 	/* VFE6 (lite) */
 	{
 		.regulators = {},
-		.clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
-			   "vfe_lite_csid", "vfe_lite_cphy_rx",
+		.clock = { "cpas_ahb", "gcc_axi_hf", "cpas_vfe_lite",
+			   "vfe_lite_ahb", "vfe_lite_csid", "vfe_lite_cphy_rx",
 			   "vfe_lite", "camnoc_axi"},
 		.clock_rate = {
+			{ 0 },
 			{ 0 },
 			{ 0 },
 			{ 300000000, 400000000, 400000000, 400000000 },

From 5880a91e8119488d4e6f788eb4f1f7cec62ff3a5 Mon Sep 17 00:00:00 2001
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Date: Tue, 18 Aug 2026 20:43:23 +0530
Subject: [PATCH 1291/1982] media: venus: Fix iova allocation from restrict
 region

[ Upstream commit 953439251b596cee039fbfeaffeb1d88a4b40f43 ]

The VPU issues DMA through several SMMU streams, and the hardware does
not give every stream the same addressable range. The non-pixel stream
cannot address the low 600MB of IOVA space, while the pixel stream can
address the full range:
    +-----------------------------------------------------------+
    | non-pixel stream addressable range (600 MB - 3.5 GB)      |
    | 0x25800000 - 0xe0000000                                   |
    +-----------------------------------------------------------+
    | pixel stream addressable range (0 - 3.5 GB)               |
    | 0x00000000 - 0xe0000000                                   |
    +-----------------------------------------------------------+

A single "iommus" property on the video-codec node puts every stream
in one IOMMU domain sharing one IOVA space, so nothing stops a
non-pixel buffer from landing below 600MB. Once an allocation lands
below that boundary the hardware faults, which shows up as unhandled
SMMU page faults and spontaneous reboots.
https://gitlab.freedesktop.org/drm/msm/-/work_items/100

Fix this by reserving the 0-600MB range, below the boundary the
non-pixel stream cannot address, using dma_iova_try_alloc() so the
IOMMU-DMA core never hands that range out to a real DMA mapping. This
reserves only IOVA space, it does not allocate any physical memory.

Since sub-nodes for non-pixel, pixel, and secure streams do not exist
yet and only a single device is available, the restriction is applied
to both non-pixel and pixel stream IDs.

Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[bod: took iova_state description from iris and applied to venus in core.h]
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/core.c | 66 ++++++++++++++++++++++--
 drivers/media/platform/qcom/venus/core.h |  6 +++
 2 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 66a750ed160968..236934a0022a97 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -374,6 +374,57 @@ static int venus_add_dynamic_nodes(struct venus_core *core)
 static void venus_remove_dynamic_nodes(struct venus_core *core) {}
 #endif
 
+static void venus_unreserve_iova_region(struct device *dev, struct dma_iova_state *state)
+{
+	unsigned int i;
+
+	for (i = 0; dma_iova_size(&state[i]); i++)
+		dma_iova_free(dev, &state[i]);
+}
+
+static int venus_reserve_iova_region(struct device *dev, struct dma_iova_state **iova_state,
+				     unsigned long start, unsigned long size)
+{
+	unsigned long dma_limit = dev->bus_dma_limit;
+	unsigned long end, rem, chunk;
+	struct dma_iova_state *state;
+	unsigned int count = 0;
+	int ret = -ENOMEM;
+
+	state = devm_kcalloc(dev, BITS_PER_TYPE(dma_addr_t) + 1, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return ret;
+
+	end = start + size;
+	rem = end - max(start, PAGE_SIZE);
+	dev->bus_dma_limit = end - 1;
+
+	while (rem) {
+		chunk = min(end & -end, (u64)1 << (fls64(rem) - 1));
+
+		if (!dma_iova_try_alloc(dev, &state[count], 0, chunk))
+			goto err_free_iova;
+
+		if (state[count].addr != end - chunk || state[count].__size != chunk)
+			goto err_free_iova;
+
+		rem -= chunk;
+		end -= chunk;
+		count++;
+	}
+
+	*iova_state = state;
+	dev->bus_dma_limit = dma_limit;
+
+	return 0;
+
+err_free_iova:
+	venus_unreserve_iova_region(dev, state);
+	dev->bus_dma_limit = dma_limit;
+
+	return ret;
+}
+
 static int venus_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -418,10 +469,15 @@ static int venus_probe(struct platform_device *pdev)
 			return ret;
 	}
 
-	ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+	ret = venus_reserve_iova_region(dev, &core->iova_state, VENUS_NP_RESERVE_IOVA_START,
+					VENUS_NP_RESERVE_IOVA_SIZE);
 	if (ret)
 		goto err_core_put;
 
+	ret = dma_set_mask_and_coherent(dev, core->res->dma_mask);
+	if (ret)
+		goto err_unresv_iova_region;
+
 	dma_set_max_seg_size(dev, UINT_MAX);
 
 	INIT_LIST_HEAD(&core->instances);
@@ -431,13 +487,13 @@ static int venus_probe(struct platform_device *pdev)
 
 	ret = hfi_create(core, &venus_core_ops);
 	if (ret)
-		goto err_core_put;
+		goto err_unresv_iova_region;
 
 	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
 					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
 					"venus", core);
 	if (ret)
-		goto err_core_put;
+		goto err_unresv_iova_region;
 
 	venus_assign_register_offsets(core);
 
@@ -522,6 +578,8 @@ static int venus_probe(struct platform_device *pdev)
 	v4l2_device_unregister(&core->v4l2_dev);
 err_hfi_destroy:
 	hfi_destroy(core);
+err_unresv_iova_region:
+	venus_unreserve_iova_region(dev, core->iova_state);
 err_core_put:
 	if (core->pm_ops->core_put)
 		core->pm_ops->core_put(core);
@@ -559,6 +617,8 @@ static void venus_remove(struct platform_device *pdev)
 
 	hfi_destroy(core);
 
+	venus_unreserve_iova_region(dev, core->iova_state);
+
 	mutex_destroy(&core->pm_lock);
 	mutex_destroy(&core->lock);
 	venus_dbgfs_deinit(core);
diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
index 70e7b40affa938..497e8f50290fe4 100644
--- a/drivers/media/platform/qcom/venus/core.h
+++ b/drivers/media/platform/qcom/venus/core.h
@@ -8,6 +8,7 @@
 #define __VENUS_CORE_H_
 
 #include <linux/bitops.h>
+#include <linux/dma-mapping.h>
 #include <linux/list.h>
 #include <media/videobuf2-v4l2.h>
 #include <media/v4l2-ctrls.h>
@@ -30,6 +31,9 @@
 
 #define VENUS_MAX_FPS			240
 
+#define VENUS_NP_RESERVE_IOVA_START	0x0
+#define VENUS_NP_RESERVE_IOVA_SIZE	0x25800000
+
 extern int venus_fw_debug;
 
 struct freq_tbl {
@@ -183,6 +187,7 @@ struct venus_format {
  * @dump_core:	a flag indicating that a core dump is required
  * @ocs:	OF changeset pointer
  * @hwmode_dev:	a flag indicating that HW_CTRL_TRIGGER is used in clock driver
+ * @iova_state: a pointer to an array of dma_iova_state entries reserved for restricted IOVA region
  */
 struct venus_core {
 	void __iomem *base;
@@ -243,6 +248,7 @@ struct venus_core {
 	unsigned long dump_core;
 	struct of_changeset *ocs;
 	bool hwmode_dev;
+	struct dma_iova_state *iova_state;
 };
 
 struct vdec_controls {

From 4b1e1db849f7542a1896da1f35f26da72475c709 Mon Sep 17 00:00:00 2001
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Date: Tue, 18 Aug 2026 21:43:51 +0530
Subject: [PATCH 1292/1982] media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP

[ Upstream commit 1facae9bc3c1cfcabc77184754d64c349831cbc5 ]

The bus_info field returned by VIDIOC_QUERYCAP used the abbreviated
prefix "plat:" instead of the standard "platform:" prefix expected
for platform devices. v4l2-compliance validates that bus_info for
platform devices starts with "platform:", and fails otherwise:

fail: ../utils/v4l2-compliance/v4l2-compliance.cpp(671):
missing bus_info prefix ('plat:aa00000.video-codec:dec')

Update the format string in iris_querycap() to use "platform:" so
that v4l2-compliance bus_info check passes.

Fixes: 94ef75095d5e ("media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/iris/iris_vidc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index 83b2b0e59f035b..d6db5ae85990b1 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -462,7 +462,7 @@ static int iris_querycap(struct file *filp, void *fh, struct v4l2_capability *ca
 		info = "enc";
 	}
 	snprintf(cap->bus_info, sizeof(cap->bus_info),
-		 "plat:%s:%s", dev_name(core->dev), info);
+		 "platform:%s:%s", dev_name(core->dev), info);
 
 	return 0;
 }

From 6aa325b8aea61a8421a972fed49323ea44da8d2f Mon Sep 17 00:00:00 2001
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Date: Tue, 18 Aug 2026 21:24:18 +0530
Subject: [PATCH 1293/1982] media: iris: Fix frame interval enumeration for
 non-divisor framerates

[ Upstream commit 3ad393b701dd99274f09403185f71ec7a93135bd ]

iris_enum_frameintervals() advertised frame intervals using
V4L2_FRMIVAL_TYPE_STEPWISE with step=1/MAXIMUM_FPS where MAXIMUM_FPS
is 480. This caused client to enumerate only framerates of the form
MAXIMUM_FPS/n (where n is a positive integer), restricting support to
exact divisors of MAXIMUM_FPS (e.g., 480, 240, 160, 120, 96, 80, 60,
30, 24, 1).

Framerates that are not exact divisors of MAXIMUM_FPS, such as 29 fps,
25 fps, were excluded from the enumerated list. There is no hardware
restriction to framerates that are exact divisors of MAXIMUM_FPS. This
caused GStreamer caps negotiation to fail with an "internal data
stream error" when encoding content at such framerates.

Fix this by using V4L2_FRMIVAL_TYPE_CONTINUOUS. With CONTINUOUS type,
GStreamer creates a continuous framerate range [1, max_fps], allowing
any integer framerate within the range to pass caps negotiation. The
step field is set to 1/1 as required by the V4L2 specification for
continuous frame intervals.

Fixes: a6882431a138 ("media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/iris/iris_vidc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index d6db5ae85990b1..b916e8c8a64567 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -434,14 +434,14 @@ static int iris_enum_frameintervals(struct file *filp, void *fh,
 	mbpf = NUM_MBS_PER_FRAME(fival->height, fival->width);
 	fps = DIV_ROUND_UP(core->iris_platform_data->max_core_mbps, mbpf);
 
-	fival->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+	fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
 	fival->stepwise.min.numerator = 1;
 	fival->stepwise.min.denominator =
 			min_t(u32, fps, MAXIMUM_FPS);
 	fival->stepwise.max.numerator = 1;
 	fival->stepwise.max.denominator = 1;
 	fival->stepwise.step.numerator = 1;
-	fival->stepwise.step.denominator = MAXIMUM_FPS;
+	fival->stepwise.step.denominator = 1;
 
 	return 0;
 }

From e6bceb2fb629d582b96d54eaf5b7f40877608a22 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Tue, 29 Sep 2026 16:45:40 +0800
Subject: [PATCH 1294/1982] ALSA: sgio2audio: Only free successfully requested
 IRQs

[ Upstream commit af3d225b639c6f9fb8fd5e1e27f11672d56724b6 ]

snd_sgio2audio_create() calls snd_sgio2audio_free() when an IRQ
request fails. The cleanup helper currently walks the complete IRQ table,
including entries whose request_irq() calls have not been attempted yet.
free_irq() then receives an IRQ and dev_id pair that was never registered.

Pass the number of successfully requested IRQs to the cleanup helper on
the request failure path, while retaining the full-table cleanup for
teardown after all requests have succeeded.

Fixes: 862c2c0a61c5 ("ALSA: ALSA driver for SGI O2 audio board")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929084540.2065213-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/mips/sgio2audio.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
index 077fdf2181c15f..e3480f23f7f3ce 100644
--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -742,7 +742,8 @@ static struct {
 
 /* ALSA driver */
 
-static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
+static int snd_sgio2audio_free(struct snd_sgio2audio *chip,
+			       unsigned int irq_count)
 {
 	int i;
 
@@ -752,7 +753,7 @@ static int snd_sgio2audio_free(struct snd_sgio2audio *chip)
 	writeq(0, &mace->perif.audio.control);
 
 	/* release IRQ's */
-	for (i = 0; i < ARRAY_SIZE(snd_sgio2_isr_table); i++)
+	for (i = 0; i < irq_count; i++)
 		free_irq(snd_sgio2_isr_table[i].irq,
 			 &chip->channel[snd_sgio2_isr_table[i].idx]);
 
@@ -768,7 +769,7 @@ static int snd_sgio2audio_dev_free(struct snd_device *device)
 {
 	struct snd_sgio2audio *chip = device->device_data;
 
-	return snd_sgio2audio_free(chip);
+	return snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
 }
 
 static const struct snd_device_ops ops = {
@@ -819,7 +820,7 @@ static int snd_sgio2audio_create(struct snd_card *card,
 				0,
 				snd_sgio2_isr_table[i].desc,
 				&chip->channel[snd_sgio2_isr_table[i].idx])) {
-			snd_sgio2audio_free(chip);
+			snd_sgio2audio_free(chip, i);
 			printk(KERN_ERR "sgio2audio: cannot allocate irq %d\n",
 			       snd_sgio2_isr_table[i].irq);
 			return -EBUSY;
@@ -843,13 +844,13 @@ static int snd_sgio2audio_create(struct snd_card *card,
 	/* initialize the AD1843 codec */
 	err = ad1843_init(&chip->ad1843);
 	if (err < 0) {
-		snd_sgio2audio_free(chip);
+		snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
 		return err;
 	}
 
 	err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
 	if (err < 0) {
-		snd_sgio2audio_free(chip);
+		snd_sgio2audio_free(chip, ARRAY_SIZE(snd_sgio2_isr_table));
 		return err;
 	}
 	*rchip = chip;

From a14c5fffca888f55b518260492370bd93eb71aee Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Tue, 29 Sep 2026 16:54:00 +0800
Subject: [PATCH 1295/1982] m68k: dmasound: Keep the Q40 IRQ handler registered

[ Upstream commit fa2e77ac5bf81a60864e71fc72196227692d7162 ]

Q40PlayNextFrame() re-registers the sample IRQ after stopping it. This
function can be called with dmasound.lock held and from the sample IRQ
handler, so free_irq() and request_irq() can sleep or deadlock. A failed
re-registration can also leave playback without an IRQ.

Register one handler for the lifetime of the driver and select mono or
stereo sample handling inside that handler. Call the frame completion
path after releasing dmasound.lock so it can refill the queue safely.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929085400.2068977-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/oss/dmasound/dmasound_q40.c | 65 ++++++++++++++-----------------
 1 file changed, 29 insertions(+), 36 deletions(-)

diff --git a/sound/oss/dmasound/dmasound_q40.c b/sound/oss/dmasound/dmasound_q40.c
index e25a78dd1bf2af..339311e5d80702 100644
--- a/sound/oss/dmasound/dmasound_q40.c
+++ b/sound/oss/dmasound/dmasound_q40.c
@@ -49,9 +49,8 @@ static int Q40SetFormat(int format);
 static int Q40SetVolume(int volume);
 static void Q40PlayNextFrame(int index);
 static void Q40Play(void);
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy);
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy);
-static void Q40Interrupt(void);
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy);
+static void q40_frame_done(void);
 
 
 /*** Mid level stuff *********************************************************/
@@ -372,8 +371,8 @@ static void Q40Free(void *ptr, unsigned int size)
 static int __init Q40IrqInit(void)
 {
 	/* Register interrupt handler. */
-	if (request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
-		    "DMA sound", Q40Interrupt))
+	if (request_irq(Q40_IRQ_SAMPLE, q40_audio_interrupt, 0,
+			"DMA sound", q40_frame_done))
 		return 0;
 
 	return(1);
@@ -384,7 +383,7 @@ static int __init Q40IrqInit(void)
 static void Q40IrqCleanUp(void)
 {
         master_outb(0,SAMPLE_ENABLE_REG);
-	free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
+	free_irq(Q40_IRQ_SAMPLE, q40_frame_done);
 }
 #endif /* MODULE */
 
@@ -403,7 +402,6 @@ static void Q40PlayNextFrame(int index)
 	u_char *start;
 	u_long size;
 	u_char speed;
-	int error;
 
 	/* used by Q40Play() if all doubts whether there really is something
 	 * to be played are already wiped out.
@@ -420,15 +418,6 @@ static void Q40PlayNextFrame(int index)
 	speed=(dmasound.hard.speed==10000 ? 0 : 1);
 
 	master_outb( 0,SAMPLE_ENABLE_REG);
-	free_irq(Q40_IRQ_SAMPLE, Q40Interrupt);
-	if (dmasound.soft.stereo)
-		error = request_irq(Q40_IRQ_SAMPLE, Q40StereoInterrupt, 0,
-				    "Q40 sound", Q40Interrupt);
-	  else
-		error = request_irq(Q40_IRQ_SAMPLE, Q40MonoInterrupt, 0,
-				    "Q40 sound", Q40Interrupt);
-	if (error && printk_ratelimit())
-		pr_err("Couldn't register sound interrupt\n");
 
 	master_outb( speed, SAMPLE_RATE_REG);
 	master_outb( 1,SAMPLE_CLEAR_REG);
@@ -456,31 +445,35 @@ static void Q40Play(void)
 	spin_unlock_irqrestore(&dmasound.lock, flags);
 }
 
-static irqreturn_t Q40StereoInterrupt(int irq, void *dummy)
-{
-	spin_lock(&dmasound.lock);
-        if (q40_sc>1){
-            *DAC_LEFT=*q40_pp++;
-	    *DAC_RIGHT=*q40_pp++;
-	    q40_sc -=2;
-	    master_outb(1,SAMPLE_CLEAR_REG);
-	}else Q40Interrupt();
-	spin_unlock(&dmasound.lock);
-	return IRQ_HANDLED;
-}
-static irqreturn_t Q40MonoInterrupt(int irq, void *dummy)
+static irqreturn_t q40_audio_interrupt(int irq, void *dummy)
 {
+	bool frame_done = false;
+
 	spin_lock(&dmasound.lock);
-        if (q40_sc>0){
-            *DAC_LEFT=*q40_pp;
-	    *DAC_RIGHT=*q40_pp++;
-	    q40_sc --;
-	    master_outb(1,SAMPLE_CLEAR_REG);
-	}else Q40Interrupt();
+	if (dmasound.hard.stereo) {
+		if (q40_sc > 1) {
+			*DAC_LEFT = *q40_pp++;
+			*DAC_RIGHT = *q40_pp++;
+			q40_sc -= 2;
+			master_outb(1, SAMPLE_CLEAR_REG);
+		} else {
+			frame_done = true;
+		}
+	} else if (q40_sc > 0) {
+		*DAC_LEFT = *q40_pp;
+		*DAC_RIGHT = *q40_pp++;
+		q40_sc--;
+		master_outb(1, SAMPLE_CLEAR_REG);
+	} else {
+		frame_done = true;
+	}
 	spin_unlock(&dmasound.lock);
+	if (frame_done)
+		q40_frame_done();
 	return IRQ_HANDLED;
 }
-static void Q40Interrupt(void)
+
+static void q40_frame_done(void)
 {
 	if (!write_sq.active) {
 	          /* playing was interrupted and sq_reset() has already cleared

From 35530d26230b1ed9f2a1fbd082f8855d2d4a5ed7 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 29 Sep 2026 14:53:41 +0200
Subject: [PATCH 1296/1982] ALSA: core: Check shutdown flag at D0 power-state,
 too

[ Upstream commit ad63c5b62843895e8c3cd7291ed07cc659df0355 ]

The snd_power_ref_and_wait() skips the card->shutdown check when the
card is already in D0 state and immediately returns as successful, by
assuming the all-green in D0.  This assumption makes the code after
this sync point behaving as if all power is up and ready, even though
actually it might have been already at the disconnected state.

Add the missing check of shutdown flag there for the more consistent
behavior.

Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260929125346.1478631-2-tiwai@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/init.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/sound/core/init.c b/sound/core/init.c
index 3a45fa6fc515e6..2bf98de846f619 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1141,12 +1141,12 @@ EXPORT_SYMBOL(snd_card_file_remove);
 int snd_power_ref_and_wait(struct snd_card *card)
 {
 	snd_power_ref(card);
-	if (snd_power_get_state(card) == SNDRV_CTL_POWER_D0)
-		return 0;
-	wait_event_cmd(card->power_sleep,
-		       card->shutdown ||
-		       snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
-		       snd_power_unref(card), snd_power_ref(card));
+	if (snd_power_get_state(card) != SNDRV_CTL_POWER_D0) {
+		wait_event_cmd(card->power_sleep,
+			       card->shutdown ||
+			       snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
+			       snd_power_unref(card), snd_power_ref(card));
+	}
 	if (card->shutdown) {
 		snd_power_unref(card);
 		return  -ENODEV;

From 77f1aeef96b91de1a94b5a014ad9dcfc1ef913df Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 4 Jun 2026 06:43:14 +0000
Subject: [PATCH 1297/1982] clk: starfive: jh7110-isp: fix refcount leak in
 jh7110_ispcrg_probe()

[ Upstream commit 1c4f9480473917558908c083d1293b4ebb3d50c5 ]

In jh7110_ispcrg_probe(), the error path for pm_runtime_get_sync()
failure directly returns without releasing the runtime PM reference
count. The call to __pm_runtime_resume() increments the usage count
unconditionally before attempting to resume, and does not decrement it
on failure. Thus the leaked reference makes it impossible to suspend
the device later.

All other error paths correctly jump to err_exit and call
pm_runtime_put_sync(). Fix this by replacing pm_runtime_get_sync()
with pm_runtime_resume_and_get(), which properly balances the
reference count on error.

Cc: stable@vger.kernel.org
Fixes: 81279f5d0812 ("clk: starfive: Add StarFive JH7110 Image-Signal-Process clock driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Hal Feng <hal.feng@starfivetech.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/starfive/clk-starfive-jh7110-isp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/starfive/clk-starfive-jh7110-isp.c b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
index f3fa069db193e3..c02c8b29a12304 100644
--- a/drivers/clk/starfive/clk-starfive-jh7110-isp.c
+++ b/drivers/clk/starfive/clk-starfive-jh7110-isp.c
@@ -130,7 +130,7 @@ static int jh7110_ispcrg_probe(struct platform_device *pdev)
 
 	/* enable power domain and clocks */
 	pm_runtime_enable(priv->dev);
-	ret = pm_runtime_get_sync(priv->dev);
+	ret = pm_runtime_resume_and_get(priv->dev);
 	if (ret < 0)
 		return dev_err_probe(priv->dev, ret, "failed to turn on power\n");
 

From 4e535f89527546014be998cbac602dc937de8fea Mon Sep 17 00:00:00 2001
From: Srish Srinivasan <ssrish@linux.ibm.com>
Date: Wed, 23 Sep 2026 23:58:05 +0530
Subject: [PATCH 1298/1982] pseries/plpks: fix error handling in
 plpks_read_var()

[ Upstream commit d52a1659cb1718f93166ab8dd8621237e564a1c4 ]

When a PLPKS variable is initialized without a policy and used to read an
object with the PLPKS_WRAPPINGKEY policy set, the hypervisor returns
H_AUTHORITY along with the object's policy. However, plpks_read_var()
currently treats this the same as any other H_AUTHORITY failure and returns
an error without propagating the policy information to the caller.

Distinguish this case from other H_AUTHORITY failures and propagate the
returned policy to the caller while preserving the authorization error.
Remove the explicit assignment of zero to rc on H_SUCCESS, as it is
redundant.

Also validate the PLPKS variable pointer before dereferencing it.

Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-2-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/plpks.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index b1667ed05f9882..1ea3ef0a36254a 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -562,6 +562,9 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
 	u8 *output;
 	int rc;
 
+	if (!var)
+		return -EINVAL;
+
 	if (var->namelen > PLPKS_MAX_NAME_SIZE)
 		return -EINVAL;
 
@@ -593,22 +596,21 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
 				 virt_to_phys(var->name), var->namelen, virt_to_phys(output),
 				 maxobjsize);
 
-
 	if (rc != H_SUCCESS) {
 		rc = pseries_status_to_err(rc);
-		goto out_free_output;
+		if (rc != -EPERM || !retbuf[1])
+			goto out_free_output;
+		goto out_copy_policy;
 	}
 
 	if (!var->data || var->datalen > retbuf[0])
 		var->datalen = retbuf[0];
 
-	var->policy = retbuf[1];
-
 	if (var->data)
 		memcpy(var->data, output, var->datalen);
 
-	rc = 0;
-
+out_copy_policy:
+	var->policy = retbuf[1];
 out_free_output:
 	kfree(output);
 out_free_label:

From 3cc77e135802aa41181eb3f4c080f3675b814f93 Mon Sep 17 00:00:00 2001
From: Srish Srinivasan <ssrish@linux.ibm.com>
Date: Wed, 23 Sep 2026 23:58:07 +0530
Subject: [PATCH 1299/1982] pseries/plpks: validate input to
 plpks_signed_update_var()

[ Upstream commit b59ff2d50b817eeec1259f357aae821c7834007f ]

plpks_signed_update_var() dereferences the supplied PLPKS variable pointer
without validating it. A NULL argument could therefore result in a NULL
pointer dereference.

Reject a NULL pointer argument with -EINVAL.

Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-4-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/plpks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 1ea3ef0a36254a..3686d662772627 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -434,6 +434,9 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
 	u64 continuetoken = 0;
 	u64 timeout = 0;
 
+	if (!var)
+		return -EINVAL;
+
 	if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE)
 		return -EINVAL;
 

From 7a7140990a00482e5f58a86c7b2848f028614e5d Mon Sep 17 00:00:00 2001
From: Srish Srinivasan <ssrish@linux.ibm.com>
Date: Wed, 23 Sep 2026 23:58:08 +0530
Subject: [PATCH 1300/1982] pseries/plpks: clear sensitive PLPKS buffers

[ Upstream commit fe18716ff314eb32299048fd64242d31b4e852cf ]

PLPKS read, remove, and write operations use authentication buffers that
contain passwords. The read output buffer may also contain sensitive data.
Freeing these buffers with kfree(), without wiping the contents, can leave
sensitive data in memory.

Use kfree_sensitive() to wipe the buffers when freeing them.

Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore")
Cc: stable@vger.kernel.org # 6.0
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-5-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/plpks.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 3686d662772627..dbfbf12bda3c09 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -518,7 +518,7 @@ int plpks_write_var(struct plpks_var var)
 	rc = pseries_status_to_err(rc);
 	kfree(label);
 out:
-	kfree(auth);
+	kfree_sensitive(auth);
 
 	return rc;
 }
@@ -552,7 +552,7 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
 	rc = pseries_status_to_err(rc);
 	kfree(label);
 out:
-	kfree(auth);
+	kfree_sensitive(auth);
 
 	return rc;
 }
@@ -615,11 +615,11 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
 out_copy_policy:
 	var->policy = retbuf[1];
 out_free_output:
-	kfree(output);
+	kfree_sensitive(output);
 out_free_label:
 	kfree(label);
 out_free_auth:
-	kfree(auth);
+	kfree_sensitive(auth);
 
 	return rc;
 }

From 7e149d7105694503921ba29be5bef2beb507cc6f Mon Sep 17 00:00:00 2001
From: Srish Srinivasan <ssrish@linux.ibm.com>
Date: Wed, 23 Sep 2026 23:58:10 +0530
Subject: [PATCH 1301/1982] pseries/plpks: clear signed update authentication
 buffer

[ Upstream commit 63de55024e7c85975f4410380323edb05b186d7c ]

The PLPKS signed update operation uses an authentication buffer that
contains a password. Freeing this buffer with kfree(), without wiping
the contents, can leave sensitive data in memory.

Use kfree_sensitive() to wipe the buffer when freeing it.

Fixes: 899d9b8fee66 ("powerpc/pseries: Implement signed update for PLPKS objects")
Cc: stable@vger.kernel.org # 6.3
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-7-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/plpks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index dbfbf12bda3c09..719f7e513c5a49 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -479,7 +479,7 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
 
 	kfree(label);
 out:
-	kfree(auth);
+	kfree_sensitive(auth);
 
 	return rc;
 }

From 19f0f175168ef8b670dabbb14092e82b6a3542bc Mon Sep 17 00:00:00 2001
From: Srish Srinivasan <ssrish@linux.ibm.com>
Date: Wed, 23 Sep 2026 23:58:11 +0530
Subject: [PATCH 1302/1982] pseries/plpks: clear SED key data after use

[ Upstream commit 217ba01e5b9096091acc2c1a3776cb3eb88c00ff ]

Explicitly clear the temporary buffer containing SED key data after read
and write operations.

Fixes: ec8cf230cecc ("powerpc/pseries: PLPKS SED Opal keystore support")
Cc: stable@vger.kernel.org # 6.7
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Greg Joyce <gjoyce@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260923182816.151451-8-ssrish@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/plpks_sed_ops.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/plpks_sed_ops.c b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
index 7c873c9589effd..ac3ec2ca7fbee6 100644
--- a/arch/powerpc/platforms/pseries/plpks_sed_ops.c
+++ b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
@@ -84,14 +84,16 @@ int sed_read_key(char *keyname, char *key, u_int *keylen)
 
 	ret = plpks_read_os_var(&var);
 	if (ret != 0)
-		return ret;
+		goto out;
 
 	len = min_t(u16, be32_to_cpu(data.key_len), var.datalen);
 	memcpy(key, data.key, len);
 	key[len] = '\0';
 	*keylen = len;
 
-	return 0;
+out:
+	memzero_explicit(&data, sizeof(data));
+	return ret;
 }
 
 /*
@@ -102,6 +104,7 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
 	struct plpks_var var;
 	struct plpks_sed_object_data data;
 	struct plpks_var_name vname;
+	int ret;
 
 	plpks_init_var(&var, keyname);
 
@@ -127,5 +130,8 @@ int sed_write_key(char *keyname, char *key, u_int keylen)
 	vname.name = var.name;
 	plpks_remove_var(var.component, var.os, vname);
 
-	return plpks_write_var(var);
+	ret = plpks_write_var(var);
+	memzero_explicit(&data, sizeof(data));
+
+	return ret;
 }

From be094322526a406419180cc74967d441d59ef346 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Tue, 29 Sep 2026 17:59:20 +0800
Subject: [PATCH 1303/1982] ASoC: pcm6240: do not free an unrequested IRQ

[ Upstream commit 995b96380ba5d98131acc162608da3538e1395d8 ]

The driver obtains an IRQ number from device tree but never requests an
IRQ handler for the PCM6240 device.  Removing the device must not pass
that number to free_irq().

Leave IRQ ownership to a matching request path if one is added later.

Fixes: 1324eafd37aa ("ASoc: PCM6240: Create PCM6240 Family driver code")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260929095920.2092147-1-runyu.xiao@seu.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/pcm6240.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sound/soc/codecs/pcm6240.c b/sound/soc/codecs/pcm6240.c
index 08cc52b374a9a0..0275fb420ef2bd 100644
--- a/sound/soc/codecs/pcm6240.c
+++ b/sound/soc/codecs/pcm6240.c
@@ -2034,8 +2034,6 @@ static const struct regmap_config pcmdevice_i2c_regmap = {
 
 static void pcmdevice_remove(struct pcmdevice_priv *pcm_dev)
 {
-	if (pcm_dev->irq)
-		free_irq(pcm_dev->irq, pcm_dev);
 	mutex_destroy(&pcm_dev->codec_lock);
 }
 

From 1a84e432d44262c36ae3dcc2aa6331a879ba1612 Mon Sep 17 00:00:00 2001
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date: Tue, 29 Sep 2026 15:38:14 +0900
Subject: [PATCH 1304/1982] nilfs2: clear dirty flag on bdev buffers on log
 write failure

[ Upstream commit 6faad04a002603d800134398fcd042b403b32d35 ]

Since the commit referenced in the Fixes tag stopped directly calling
inode_attach_wb(), a dirty flag is set on buffers (with
mark_buffer_dirty()) allocated to the backing device for segment
summaries and the super root block during log writes.

While this dirty flag is cleared upon a successful log write, it remains
uncleared if the log write fails.

Consequently, when a log write fails, these backing device buffers are
left in an inconsistent state where their uptodate flag and the dirty
flag of the containing page/folio are cleared, but the buffer's dirty
flag remains as stale garbage.

Particularly when the block size is smaller than the page size, if other
buffers on the same page/folio become dirty, this buffer unexpectedly
becomes a target for writeback again.  As a result, if the block is
later reused for other data or metadata, that contents risks being
corrupted.

Fix this issue by calling clear_buffer_dirty() for the backing device
buffers when aborting log writes in nilfs_abort_logs().

Fixes: 68142cb628f7 ("nilfs2: do not call inode_attach_wb() directly")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/segment.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index c20340f4e0dc3e..f1f26647d7b3d0 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1825,6 +1825,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
 	list_for_each_entry(segbuf, logs, sb_list) {
 		list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
 				    b_assoc_buffers) {
+			clear_buffer_dirty(bh);
 			clear_buffer_uptodate(bh);
 			if (bh->b_folio != bd_folio) {
 				if (bd_folio)
@@ -1836,6 +1837,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
 		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
 				    b_assoc_buffers) {
 			if (bh == segbuf->sb_super_root) {
+				clear_buffer_dirty(bh);
 				clear_buffer_uptodate(bh);
 				if (bh->b_folio != bd_folio) {
 					folio_end_writeback(bd_folio);

From 5906e880cdf55ab7ebc2bf6446c543c7cfef2a89 Mon Sep 17 00:00:00 2001
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date: Wed, 30 Sep 2026 03:26:54 +0900
Subject: [PATCH 1305/1982] nilfs2: ignore non-fatal signals during synchronous
 log write wait

[ Upstream commit 7131aaa74bcc7c9da1f1d1c8724da75c775557a0 ]

Based on a syzbot report, Wang Jianjian pointed out that following a
successful directory operation in nilfs_rename(), a synchronous write
requested within nilfs_transaction_commit(), triggered by a sync flag
set by nilfs_commit_chunk(), could be interrupted by a user signal.
This interruption leaves in-memory metadata updates intact while
returning an error, causing inconsistency with the VFS dentry cache and
ultimately triggering a kernel warning.

According to "signal(7)", local disks are not classified as "slow
devices" (such as terminals, FIFOs, or pipes) and their I/O operations
on disk devices are not interrupted by signals.  In kernel space,
waiting for such disk I/O should therefore not be aborted by ordinary
(non-fatal) signals.

Suppress this issue by modifying nilfs_segctor_sync(), which waits for
the log writer thread to complete synchronous writes, to catch only
fatal signals via fatal_signal_pending() and return -EINTR rather than
-ERESTARTSYS.  To complement this change and prevent the wait loop from
busy-looping when schedule() returns immediately due to a pending
non-fatal signal, switch the wait state from TASK_INTERRUPTIBLE to
TASK_KILLABLE.

This serves as an effective interim stabilization measure without
structural changes until a comprehensive fix for metadata consistency
is implemented.

Reported-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6c7e1f1809f235eeb90
Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
Tested-by: syzbot+f6c7e1f1809f235eeb90@syzkaller.appspotmail.com
Cc: Wang Jianjian <wangjianjian3@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/ioctl.c    |  2 +-
 fs/nilfs2/recovery.c |  2 +-
 fs/nilfs2/segment.c  | 10 +++++-----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 913e1a472c8fea..bcb68f92f05e6a 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -972,10 +972,10 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
  * Return: 0 on success, or one of the following negative error codes on
  * failure:
  * * %-EFAULT		- Failure during execution of requested operation.
+ * * %-EINTR		- Interrupted.
  * * %-EIO		- I/O error.
  * * %-ENOMEM		- Insufficient memory available.
  * * %-ENOSPC		- No space left on device (only in a panic state).
- * * %-ERESTARTSYS	- Interrupted.
  * * %-EROFS		- Read only filesystem.
  */
 static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index a9c61d0492cbd4..dfff3bc84bcd3b 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -785,11 +785,11 @@ static void nilfs_abort_roll_forward(struct the_nilfs *nilfs)
  *
  * Return: 0 on success, or one of the following negative error codes on
  * failure:
+ * * %-EINTR		- Interrupted.
  * * %-EINVAL		- Inconsistent filesystem state.
  * * %-EIO		- I/O error.
  * * %-ENOMEM		- Insufficient memory available.
  * * %-ENOSPC		- No space left on device (only in a panic state).
- * * %-ERESTARTSYS	- Interrupted.
  */
 int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs,
 			      struct super_block *sb,
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index f1f26647d7b3d0..e967d16b2f130a 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2255,7 +2255,7 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
 	wake_up(&sci->sc_wait_daemon);
 
 	for (;;) {
-		set_current_state(TASK_INTERRUPTIBLE);
+		set_current_state(TASK_KILLABLE);
 
 		/*
 		 * Synchronize only while the log writer thread is alive.
@@ -2269,11 +2269,11 @@ static int nilfs_segctor_sync(struct nilfs_sc_info *sci)
 			err = wait_req.err;
 			break;
 		}
-		if (!signal_pending(current)) {
+		if (!fatal_signal_pending(current)) {
 			schedule();
 			continue;
 		}
-		err = -ERESTARTSYS;
+		err = -EINTR;
 		break;
 	}
 	finish_wait(&sci->sc_wait_request, &wait_req.wq);
@@ -2307,10 +2307,10 @@ static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err, bool force)
  *
  * Return: 0 on success, or one of the following negative error codes on
  * failure:
+ * * %-EINTR		- Interrupted.
  * * %-EIO		- I/O error (including metadata corruption).
  * * %-ENOMEM		- Insufficient memory available.
  * * %-ENOSPC		- No space left on device (only in a panic state).
- * * %-ERESTARTSYS	- Interrupted.
  * * %-EROFS		- Read only filesystem.
  */
 int nilfs_construct_segment(struct super_block *sb)
@@ -2337,10 +2337,10 @@ int nilfs_construct_segment(struct super_block *sb)
  *
  * Return: 0 on success, or one of the following negative error codes on
  * failure:
+ * * %-EINTR		- Interrupted.
  * * %-EIO		- I/O error (including metadata corruption).
  * * %-ENOMEM		- Insufficient memory available.
  * * %-ENOSPC		- No space left on device (only in a panic state).
- * * %-ERESTARTSYS	- Interrupted.
  * * %-EROFS		- Read only filesystem.
  */
 int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,

From 9313727ad7f02c6e73af625c17758be7df027f77 Mon Sep 17 00:00:00 2001
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Date: Tue, 29 Sep 2026 14:08:02 +0200
Subject: [PATCH 1306/1982] pwm: tiehrpwm: Clear period on disable to allow
 reconfiguration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e74b9a7ee50071aad25d3989bf985292f90b0c6e ]

Both channels share one period register, so ehrpwm_pwm_config() rejects a
period differing from the sibling's period_cycles[]. That value was cleared
only in .free(), not in .disable(), so a stopped channel kept blocking the
sibling from switching to a new frequency. Clear it in .disable() too.

Testcase:

  cd /sys/class/pwm/pwmchip0; echo 0 > export; echo 1 > export
  for p in pwm0 pwm1; do
    echo 1000000 > $p/period; echo 500000 > $p/duty_cycle
    echo 1 > $p/enable; echo 0 > $p/enable; echo 2000000 > $p/period
  done
  echo 1 > pwm0/enable	# before: -EINVAL, after: succeeds

Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20260929120806.2790355-1-alexander.sverdlin@siemens.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-tiehrpwm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 2533c95b0ba9d3..c02f69de44dcf7 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -358,6 +358,9 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 
 	/* Disable clock on PWM disable */
 	pm_runtime_put_sync(pwmchip_parent(chip));
+
+	/* A disabled channel must not constrain the sibling's period */
+	pc->period_cycles[pwm->hwpwm] = 0;
 }
 
 static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)

From 6266517f52b61a7e522fd2e5bae7ddb1bd8c0a42 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 30 Sep 2026 15:04:55 +0800
Subject: [PATCH 1307/1982] IB/hfi1: Shutdown self-rearming timers before
 freeing

[ Upstream commit 9d3259e41ccd5016cd2c6d013232b89df6d73011 ]

The HFI1 receive error and synthetic counter timers rearm themselves from
their callbacks. Their cleanup paths use timer_delete_sync(), which only
waits for a running callback and does not prevent a concurrent or
subsequent rearm.

Use timer_shutdown_sync() when releasing these timers. This prevents a
callback from enqueueing either timer after cleanup begins, before the
containing hfi1_devdata is freed.

Preserve the existing work cancellation and workqueue destruction ordering
for synthetic counters.

Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930070455.2934286-1-runyu.xiao@seu.edu.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/chip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 57c70384d21075..648b31f37aa806 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -5576,7 +5576,7 @@ static int init_rcverr(struct hfi1_devdata *dd)
 static void free_rcverr(struct hfi1_devdata *dd)
 {
 	if (dd->rcverr_timer.function)
-		timer_delete_sync(&dd->rcverr_timer);
+		timer_shutdown_sync(&dd->rcverr_timer);
 }
 
 static void handle_rxe_err(struct hfi1_devdata *dd, u32 unused, u64 reg)
@@ -12308,7 +12308,7 @@ static void free_cntrs(struct hfi1_devdata *dd)
 	int i;
 
 	if (dd->synth_stats_timer.function)
-		timer_delete_sync(&dd->synth_stats_timer);
+		timer_shutdown_sync(&dd->synth_stats_timer);
 	cancel_work_sync(&dd->update_cntr_work);
 	ppd = (struct hfi1_pportdata *)(dd + 1);
 	for (i = 0; i < dd->num_pports; i++, ppd++) {

From d4e9b82ddc6fded1bbcc0b7453fce6b06738ff0b Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Wed, 23 Sep 2026 08:53:40 +0000
Subject: [PATCH 1308/1982] i3c: master: adi: free the IRQ before unregistering
 the master

[ Upstream commit 1c1e2d90aa452764df66bb1dd774aa0d06d89cc8 ]

adi_i3c_master_irq() is requested with devm_request_irq(), so it stays
registered when adi_i3c_master_remove() runs, and the writes masking the
controller IRQ sources do not synchronize with a handler that is already
running on another CPU. i3c_master_unregister() then frees the
struct i3c_dev_desc objects that master->ibi.slots[] still point to, so
the IBI path in adi_i3c_master_handle_ibi() can dereference freed memory.

Fix this by storing the IRQ number in the private structure and calling
devm_free_irq() after the IRQ sources are masked, so a running handler
is finished before the master is torn down.

This issue was found by an in-house static analysis tool.

Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260923085340.490776-1-fanwu01@zju.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i3c/master/adi-i3c-master.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/i3c/master/adi-i3c-master.c b/drivers/i3c/master/adi-i3c-master.c
index 178029769bab40..d6278d03012db1 100644
--- a/drivers/i3c/master/adi-i3c-master.c
+++ b/drivers/i3c/master/adi-i3c-master.c
@@ -115,6 +115,7 @@ struct adi_i3c_master {
 		spinlock_t lock; /* Protect transfer */
 	} xferqueue;
 	void __iomem *regs;
+	int irq;
 	struct clk *clk;
 	unsigned long i3c_scl_lim;
 	struct {
@@ -957,6 +958,7 @@ static int adi_i3c_master_probe(struct platform_device *pdev)
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0)
 		return irq;
+	master->irq = irq;
 
 	version = readl(master->regs + ADI_AXI_REG_VERSION);
 	if (ADI_AXI_PCORE_VER_MAJOR(version) != 1)
@@ -1001,6 +1003,8 @@ static void adi_i3c_master_remove(struct platform_device *pdev)
 	writel(0x00, master->regs + REG_IRQ_MASK);
 	writel(0x01, master->regs + REG_ENABLE);
 
+	devm_free_irq(&pdev->dev, master->irq, master);
+
 	i3c_master_unregister(&master->base);
 }
 

From 41f7b9cd503ebc6bd624e5200ab7d2f03d1ad7a2 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Date: Fri, 11 Sep 2026 12:29:34 +0200
Subject: [PATCH 1309/1982] drm/msm/hdmi_phy: Cleanup after
 msm_hdmi_phy_resource_enable() failure

[ Upstream commit d27f831aaf20aaf06e41ceb1b260e10672269155 ]

If msm_hdmi_phy_resource_enable() fails, e.g. when enabling regulators,
it should reverse the state of things already changed.
msm_hdmi_phy_resource_enable() is used also in probe path, thus such
failure, which could be simple deferred probe, would leave these
resources permanently enabled for the rest of the runtime.

Cc: <stable@vger.kernel.org>
Fixes: 15b4a4523859 ("drm/msm/hdmi: Create a separate HDMI PHY driver")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752654/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-1-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
index 6777cba9255e2d..bc603a79c0851f 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_phy.c
@@ -67,16 +67,28 @@ int msm_hdmi_phy_resource_enable(struct hdmi_phy *phy)
 	ret = regulator_bulk_enable(cfg->num_regs, phy->regs);
 	if (ret) {
 		DRM_DEV_ERROR(dev, "failed to enable regulators: (%d)\n", ret);
-		return ret;
+		goto err_pm_put;
 	}
 
 	for (i = 0; i < cfg->num_clks; i++) {
 		ret = clk_prepare_enable(phy->clks[i]);
-		if (ret)
+		if (ret) {
 			DRM_DEV_ERROR(dev, "failed to enable clock: %s (%d)\n",
 				cfg->clk_names[i], ret);
+			goto err_clk_unprepare;
+		}
 	}
 
+	return 0;
+
+err_clk_unprepare:
+	for (; i > 0; i--)
+		clk_disable_unprepare(phy->clks[i - 1]);
+	regulator_bulk_disable(cfg->num_regs, phy->regs);
+
+err_pm_put:
+	pm_runtime_put_sync(dev);
+
 	return ret;
 }
 

From 96c66a1ef82384ea302fc571509a3c5bf3bb2280 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Date: Fri, 11 Sep 2026 12:29:35 +0200
Subject: [PATCH 1310/1982] drm/msm/hdmi: Handle msm_hdmi_power_on() errors
 during .atomic_pre_enable()

[ Upstream commit dd6ecace57851878e62367a6f1a26dd5b9aa217f ]

Properly handle power up failures during .atomic_pre_enable() by
aborting the .atomic_pre_enable() to avoid accessing registers why
blocks did not bring up.  Otherwise this could lead to imprecise aborts
when accessing MMIO while entire power domain is off.

Cc: <stable@vger.kernel.org>
Fixes: ba3d7bf3a7ab ("drm/msm/hdmi: Convert PHY files according to new design")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752652/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-2-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 30 ++++++++++++++++++--------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index 93a491a103e0a8..45bc4db5f66cd8 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -13,14 +13,16 @@
 #include "msm_kms.h"
 #include "hdmi.h"
 
-static void msm_hdmi_power_on(struct drm_bridge *bridge)
+static int msm_hdmi_power_on(struct drm_bridge *bridge)
 {
 	struct drm_device *dev = bridge->dev;
 	struct hdmi_bridge *hdmi_bridge = to_hdmi_bridge(bridge);
 	struct hdmi *hdmi = hdmi_bridge->hdmi;
 	int ret;
 
-	pm_runtime_resume_and_get(&hdmi->pdev->dev);
+	ret = pm_runtime_resume_and_get(&hdmi->pdev->dev);
+	if (ret)
+		return ret;
 
 	if (hdmi->extp_clk) {
 		DBG("pixclock: %lu", hdmi->pixclock);
@@ -29,9 +31,14 @@ static void msm_hdmi_power_on(struct drm_bridge *bridge)
 			DRM_DEV_ERROR(dev->dev, "failed to set extp clk rate: %d\n", ret);
 
 		ret = clk_prepare_enable(hdmi->extp_clk);
-		if (ret)
+		if (ret) {
 			DRM_DEV_ERROR(dev->dev, "failed to enable extp clk: %d\n", ret);
+			pm_runtime_put(&hdmi->pdev->dev);
+			return ret;
+		}
 	}
+
+	return 0;
 }
 
 static void power_off(struct drm_bridge *bridge)
@@ -302,13 +309,18 @@ static void msm_hdmi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
 
 	msm_hdmi_set_timings(hdmi, &crtc_state->adjusted_mode);
 
-	mutex_lock(&hdmi->state_mutex);
-	if (!hdmi->power_on) {
-		msm_hdmi_phy_resource_enable(phy);
-		msm_hdmi_power_on(bridge);
-		hdmi->power_on = true;
+	scoped_guard(mutex, &hdmi->state_mutex) {
+		if (!hdmi->power_on) {
+			if (msm_hdmi_phy_resource_enable(phy))
+				return;
+
+			if (msm_hdmi_power_on(bridge)) {
+				msm_hdmi_phy_resource_disable(phy);
+				return;
+			}
+			hdmi->power_on = true;
+		}
 	}
-	mutex_unlock(&hdmi->state_mutex);
 
 	if (connector->display_info.is_hdmi)
 		msm_hdmi_audio_update(hdmi);

From fd021c57e2c6a673ef9b66a54605a988d8925213 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Date: Fri, 11 Sep 2026 12:29:36 +0200
Subject: [PATCH 1311/1982] drm/msm/hdmi_bridge: Correct poweroff/audio cleanup
 order in post_disable

[ Upstream commit 0499f0576e4442d67c164119f9d7f75d3cc945e7 ]

Turning off the power in msm_hdmi_bridge_atomic_post_disable() should
follow reverse order of powering up, not only because it is logical, but
also because msm_hdmi_audio_update() accesses registers thus block
should still be powered on.

Depending on specific timing, existing code could have accesses to MMIO
of powered off block.

Cc: stable@vger.kernel.org
Fixes: c0c0d9eeeb8d ("drm/msm: hdmi audio support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/752655/
Link: https://lore.kernel.org/r/20260911-drm-msm-hdmi-fixes-before-eliza-v4-3-87bdb9f1987f@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
index 45bc4db5f66cd8..75dea34c43a88c 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -354,10 +354,10 @@ static void msm_hdmi_bridge_atomic_post_disable(struct drm_bridge *bridge,
 	msm_hdmi_phy_powerdown(phy);
 
 	if (hdmi->power_on) {
-		power_off(bridge);
 		hdmi->power_on = false;
 		if (hdmi->connector->display_info.is_hdmi)
 			msm_hdmi_audio_update(hdmi);
+		power_off(bridge);
 		msm_hdmi_phy_resource_disable(phy);
 	}
 	mutex_unlock(&hdmi->state_mutex);

From c4a692585615f76c8ac421015285cfd13a2f0969 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 17:57:38 +0000
Subject: [PATCH 1312/1982] drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g()

[ Upstream commit ab91ba61871a896ca2ecc6e048d80a152136da44 ]

dsi_tx_buf_alloc_6g() takes a reference to the kms VM with
drm_gpuvm_get() and stores it in msm_host->vm.  If
msm_gem_kernel_new() fails, the function returns early without
dropping that reference.  Since msm_host->tx_gem_obj is cleared on
the error path, msm_dsi_tx_buf_free() will never see a non-NULL
tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM
reference.

Drop the VM reference and clear msm_host->vm on the error path.

Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Rob Clark <rob.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/754332/
Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 4e93f8dd39d7d1..1827af24a3fa10 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1254,6 +1254,8 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size)
 
 	if (IS_ERR(data)) {
 		msm_host->tx_gem_obj = NULL;
+		drm_gpuvm_put(msm_host->vm);
+		msm_host->vm = NULL;
 		return PTR_ERR(data);
 	}
 

From d28f100d9975ecb74cd9dd3651251d52c2821873 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 7 Sep 2026 11:53:05 +0200
Subject: [PATCH 1313/1982] staging: greybus: uart: fix racy TIOCMIWAIT
 implementation

[ Upstream commit e94cda6551d4716b17353fc458baa9e85ddea9ff ]

Check the wakeup condition after adding the task to the waitqueue and
updating the task state to avoid missing a racing modem status update or
disconnect.

Store the old icount on entry and do not update it in the completion
handler to avoid missing events or reporting spurious ones (due to modem
status changes before TIOCMIWAIT was called).

Fixes: e68453ed28c5 ("greybus: uart-gb: now builds, more framework added")
Cc: stable@kernel.org	# 4.9
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260907095305.130762-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/uart.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
index 78bf8c4031e938..7d2844d9bcd9e9 100644
--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -53,7 +53,6 @@ struct gb_tty {
 	spinlock_t read_lock;
 	spinlock_t write_lock;
 	struct async_icount iocount;
-	struct async_icount oldcount;
 	wait_queue_head_t wioctl;
 	struct mutex mutex;
 	u8 ctrlin;	/* input control lines */
@@ -643,11 +642,16 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
 	if (!(arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD)))
 		return -EINVAL;
 
-	do {
+	spin_lock_irq(&gb_tty->read_lock);
+	old = gb_tty->iocount;
+	spin_unlock_irq(&gb_tty->read_lock);
+
+	add_wait_queue(&gb_tty->wioctl, &wait);
+	for (;;) {
+		set_current_state(TASK_INTERRUPTIBLE);
+
 		spin_lock_irq(&gb_tty->read_lock);
-		old = gb_tty->oldcount;
 		new = gb_tty->iocount;
-		gb_tty->oldcount = new;
 		spin_unlock_irq(&gb_tty->read_lock);
 
 		if ((arg & TIOCM_DSR) && (old.dsr != new.dsr))
@@ -657,18 +661,20 @@ static int wait_serial_change(struct gb_tty *gb_tty, unsigned long arg)
 		if ((arg & TIOCM_RI) && (old.rng != new.rng))
 			break;
 
-		add_wait_queue(&gb_tty->wioctl, &wait);
-		set_current_state(TASK_INTERRUPTIBLE);
-		schedule();
-		remove_wait_queue(&gb_tty->wioctl, &wait);
 		if (gb_tty->disconnected) {
-			if (arg & TIOCM_CD)
-				break;
 			retval = -ENODEV;
-		} else if (signal_pending(current)) {
+			break;
+		}
+
+		schedule();
+
+		if (signal_pending(current)) {
 			retval = -ERESTARTSYS;
+			break;
 		}
-	} while (!retval);
+	}
+	__set_current_state(TASK_RUNNING);
+	remove_wait_queue(&gb_tty->wioctl, &wait);
 
 	return retval;
 }

From 07a1b080c5a514449406f4c5842e6dd0d7b8b0df Mon Sep 17 00:00:00 2001
From: Tianchu Chen <flynnnchen@tencent.com>
Date: Fri, 11 Sep 2026 11:10:42 +0000
Subject: [PATCH 1314/1982] staging: rtl8723bs: fix RX buffer OOB write from
 device-reported length

[ Upstream commit c52929073fccbc149267a2fd7458626a7e9abcfc ]

sd_recv_rxfifo() trusts the device-reported RX0_REQ_LEN value
(hal->SdioRxFIFOSize, a u16 read from the card via CMD52) as the
size of the next RX packet and passes it to sdio_read_port(), which
copies that many bytes into the recvbuf skb whose data area is only
MAX_RECVBUF_SZ (10240) bytes. A bogus device on SDIO can report up to
65535 bytes, causing a heap overflow of up to ~55KB past the skb
buffer.

Bail out when the RX0_REQ_LEN exceeds MAX_RECVBUF_SZ. This is expected
to keep behavior unchanged on normal devices.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/8114c3adc1acaea78523cc0fb4d4b25f7665cee9@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8723bs/hal/sdio_ops.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/rtl8723bs/hal/sdio_ops.c b/drivers/staging/rtl8723bs/hal/sdio_ops.c
index 54228c41579eec..811720775eb838 100644
--- a/drivers/staging/rtl8723bs/hal/sdio_ops.c
+++ b/drivers/staging/rtl8723bs/hal/sdio_ops.c
@@ -791,6 +791,13 @@ static struct recv_buf *sd_recv_rxfifo(struct adapter *adapter, u32 size)
 	struct recv_priv *recv_priv;
 	struct recv_buf	*recvbuf;
 
+	/* RX0_REQ_LEN is device-reported; the skb buffer is only
+	 * MAX_RECVBUF_SZ bytes, reject bogus lengths instead of
+	 * overflowing past it.
+	 */
+	if (size > MAX_RECVBUF_SZ)
+		return NULL;
+
 	/*  Patch for some SDIO Host 4 bytes issue */
 	/*  ex. RK3188 */
 	readsize = round_up(size, 4);

From c1b1e81ed8b2bae7299243c5722332451b0c3338 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 19:08:58 +0800
Subject: [PATCH 1315/1982] media: tw686x: fix V4L2 device lifetime on probe
 failure

[ Upstream commit ce6c6dd632b3b4a2c2bfc9efd8f656f4d2137dbd ]

tw686x_video_init() registers the V4L2 device, which initializes its
reference count. Successfully registered video devices take additional
references to the V4L2 device as well.

The probe failure paths currently tear down the PCI resources and then
free the channel arrays and the tw686x device directly. This bypasses
the V4L2 device reference count and the tw686x_dev_release() callback.

If a video device still holds a reference, its eventual release will
drop a reference to the already freed V4L2 device. Even when no extra
references remain, directly freeing the device bypasses the lifetime
management established by v4l2_device_register().

After cleaning up the PCI resources, check whether the V4L2 device was
registered. If so, mark the hardware unavailable and drop the driver's
V4L2 device reference, letting tw686x_dev_release() free the backing
objects when the final reference is released. Keep the existing direct
free path for failures that occur before V4L2 device registration.

This issue was found by manual code inspection.

Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/tw686x/tw686x-core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c
index f39e0e34deb684..6dc8af345295f1 100644
--- a/drivers/media/pci/tw686x/tw686x-core.c
+++ b/drivers/media/pci/tw686x/tw686x-core.c
@@ -241,6 +241,7 @@ static int tw686x_probe(struct pci_dev *pci_dev,
 			const struct pci_device_id *pci_id)
 {
 	struct tw686x_dev *dev;
+	unsigned long flags;
 	int err;
 
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -352,6 +353,15 @@ static int tw686x_probe(struct pci_dev *pci_dev,
 	pci_release_regions(pci_dev);
 disable_pci:
 	pci_disable_device(pci_dev);
+	if (dev->v4l2_dev.dev) {
+		spin_lock_irqsave(&dev->lock, flags);
+		dev->pci_dev = NULL;
+		spin_unlock_irqrestore(&dev->lock, flags);
+
+		v4l2_device_put(&dev->v4l2_dev);
+		return err;
+	}
+
 free_audio:
 	kfree(dev->audio_channels);
 free_video:

From f8f37e179859d95a6dbd2c867d99125a2e5cbd74 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:09:24 +0000
Subject: [PATCH 1316/1982] media: pvrusb2: Fix USB parent device leak in
 class_dev_create()

[ Upstream commit 02421d7278e4a62c3daf37ad6c45d4af96ee4252 ]

class_dev_create() stores a reference to the USB device obtained with
get_device() in class_dev->parent, which class_dev_destroy() releases.
When device_register() fails the function only drops class_dev, so the
reference to the USB parent device is never released.

Drop the parent reference on the failure path as well.

Fixes: 28c4a5e6d324 ("V4L/DVB: pvrusb2: Fix USB parent device reference count")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/pvrusb2/pvrusb2-sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
index 3077399901aa1b..dd6fcc6245afc4 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-sysfs.c
@@ -633,6 +633,7 @@ static void class_dev_create(struct pvr2_sysfs *sfp)
 	if (ret) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
 			   "device_register failed");
+		put_device(class_dev->parent);
 		put_device(class_dev);
 		return;
 	}

From e4686b15bb97fe56231b12dcc309b68d1e586775 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Thu, 24 Sep 2026 21:55:14 +0800
Subject: [PATCH 1317/1982] media: rtl28xxu: fix SDR platform device leak

[ Upstream commit 083a92996598a5080965f1baa84175082e14a45b ]

rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but
does not unregister it if no driver is bound. It also does not take a
reference on the bound driver module.

Unregister the platform device when no driver is bound or the module
reference cannot be acquired. Drop the module reference in
rtl28xxu_tuner_detach() before unregistering the device.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 487c6ab784abd6..d2957e4bf0173f 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -1391,8 +1391,16 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
 						     "rtl2832_sdr",
 						     PLATFORM_DEVID_AUTO,
 						     &pdata, sizeof(pdata));
-		if (IS_ERR(pdev) || pdev->dev.driver == NULL)
+		if (IS_ERR(pdev))
 			break;
+		if (!pdev->dev.driver) {
+			platform_device_unregister(pdev);
+			break;
+		}
+		if (!try_module_get(pdev->dev.driver->owner)) {
+			platform_device_unregister(pdev);
+			break;
+		}
 		dev->platform_device_sdr = pdev;
 		break;
 	default:
@@ -1426,8 +1434,10 @@ static int rtl28xxu_tuner_detach(struct dvb_usb_adapter *adap)
 
 	/* remove platform SDR */
 	pdev = dev->platform_device_sdr;
-	if (pdev)
+	if (pdev) {
+		module_put(pdev->dev.driver->owner);
 		platform_device_unregister(pdev);
+	}
 
 	/* remove I2C tuner */
 	client = dev->i2c_client_tuner;

From 84ec201511634bc04fe850c9552211d2ef4f2662 Mon Sep 17 00:00:00 2001
From: Ginger Li <ginger.jzllee@gmail.com>
Date: Mon, 28 Sep 2026 09:47:44 +0200
Subject: [PATCH 1318/1982] media: exynos4-is: Fix a race between s_stream(0)
 and the interrupt handler

[ Upstream commit c65eb69f8170975802ddbede84420553eb681d62 ]

fimc_lite_subdev_s_stream(on = 0) sets ST_FLITE_OFF outside of the
fimc->slock protected region, and only then stops the capture in the
hardware.  flite_irq_handler() runs under fimc->slock and clears
ST_FLITE_OFF, so an interrupt can be handled in between: the handler finds
ST_FLITE_OFF already set, clears it and wakes up fimc->irq_queue before the
capture has actually been stopped.  The wait_event_timeout() right after it
then returns immediately and the driver continues as if the capture had
stopped.

Set ST_FLITE_OFF in the same critical section that stops the capture, as
fimc_lite_stop_capture() already does.

Fixes: 6319d6a002be ("[media] fimc-lite: Add ISP FIFO output support")
Cc: stable@vger.kernel.org
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/samsung/exynos4-is/fimc-lite.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
index 0ce293b0718b6a..0862fd14d41e3c 100644
--- a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
@@ -1209,9 +1209,8 @@ static int fimc_lite_subdev_s_stream(struct v4l2_subdev *sd, int on)
 			spin_unlock_irqrestore(&fimc->slock, flags);
 		}
 	} else {
-		set_bit(ST_FLITE_OFF, &fimc->state);
-
 		spin_lock_irqsave(&fimc->slock, flags);
+		set_bit(ST_FLITE_OFF, &fimc->state);
 		flite_hw_capture_stop(fimc);
 		spin_unlock_irqrestore(&fimc->slock, flags);
 

From ecf511b8157e0648080bdae37f4f2eb98328c4b2 Mon Sep 17 00:00:00 2001
From: Kaho Jiang <kj2864@nyu.edu>
Date: Mon, 28 Sep 2026 20:19:04 -0400
Subject: [PATCH 1319/1982] media: em28xx: fix double free in em28xx_alloc_urbs

[ Upstream commit fd427b8adae437cac78a2332241a03cac56e95c2 ]

When allocation of usb_bufs->buf[i] fails, em28xx_alloc_urbs()
explicitly frees all items within usb_bufs->buf before calling
em28xx_uninit_usb_xfer(), which also frees these items, causing them to be
freed twice.

BUG: KASAN: double-free in usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
Free of addr ffff88802fd37c00 by task kworker/1:2/1182
Workqueue: events request_module_async
Call Trace:
  kasan_report_invalid_free (mm/kasan/report.c:557)
  check_slab_allocation (mm/kasan/common.c:235)
  kfree (./include/linux/kasan.h:199 (discriminator 1) mm/slub.c:2693 (discriminator 1) mm/slub.c:6508 (discriminator 1) mm/slub.c:6801 (discriminator 1))
  usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
  usb_free_urb (drivers/usb/core/urb.c:95)
  em28xx_uninit_usb_xfer (drivers/media/usb/em28xx/em28xx-core.c:964)
  em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1076)
  em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
  em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
  request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
  process_one_work (kernel/workqueue.c:3396)
  worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:158)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  Allocated by task 1182:
  kasan_save_stack (mm/kasan/common.c:57)
  kasan_save_track (mm/kasan/common.c:78)
  __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
  __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
  em28xx_alloc_urbs (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/media/usb/em28xx/em28xx-core.c:1081)
  em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
  em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
  request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
  process_one_work (kernel/workqueue.c:3396)
  worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:158)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  Freed by task 1182:
  kasan_save_stack (mm/kasan/common.c:57)
  kasan_save_track (mm/kasan/common.c:78)
  kasan_save_free_info (mm/kasan/generic.c:584)
  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
  kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801)
  em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1084)
  em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
  em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
  request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
  process_one_work (kernel/workqueue.c:3396)
  worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:158)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

Remove the explicit cleanup loop and let em28xx_uninit_usb_xfer()
handle the cleanup.

Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Cc: stable@vger.kernel.org
Reported-by: co+6a04efcebe0fc0ce@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-core.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 1012bfb1864602..55528138751325 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -949,9 +949,6 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
 
 		usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
 		if (!usb_bufs->buf[i]) {
-			for (i--; i >= 0; i--)
-				kfree(usb_bufs->buf[i]);
-
 			em28xx_uninit_usb_xfer(dev, mode);
 			return -ENOMEM;
 		}

From affc1ebd65f517897f1c092fb87f2c42f0fc41f5 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:35:31 +0200
Subject: [PATCH 1320/1982] dm: fix a bug in dm_accept_partial_bio

[ Upstream commit a279804752e6c767b7f9ecbb32a15bdfd2b80aea ]

dm-writecache doesn't work in pmem mode - mkfs.ext4 and the following
fsck.ext4 fail with data corruption reported.

The commit 7dd76d1feec7 ("dm: improve bio splitting and associated IO
accounting") introduced a latent bug in dm_accept_partial_bio - it set
tio->io->sectors = n_sectors;. This is incorrect, according to the
diagram in the source code at dm_accept_partial_bio, it should be the
size of regions 1+2, not the region 2 alone.

The latent bug become real bug with the commit 8b211aaccb91 ("dm: add two
stage requeue mechanism").

dm-writecache in pmem mode is the only target that actually advances bio
with bio_advance and then calls dm_accept_partial_bio (so, the region 1
is non-empty). All the other targets call dm_accept_partial_bio with
region 1 empty, so bug went unnoticed for so long.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: 8b211aaccb91 ("dm: add two stage requeue mechanism")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f587b7229ce89a..077bf8b16a0bde 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1349,7 +1349,7 @@ void dm_accept_partial_bio(struct bio *bio, unsigned int n_sectors)
 	 * for accounting but it is being reduced so update accordingly.
 	 */
 	dm_io_set_flag(io, DM_IO_WAS_SPLIT);
-	io->sectors = n_sectors;
+	io->sectors = *tio->len_ptr;
 	io->sector_offset = bio_sectors(io->orig_bio);
 }
 EXPORT_SYMBOL_GPL(dm_accept_partial_bio);

From a05de3e14079f75fbe56f0e8401c42b63b0dc187 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:38:25 +0200
Subject: [PATCH 1321/1982] dm-writecache: report I/O error if flush failed

[ Upstream commit 78a6afc2999d26e5a30a56db77db34c22b88f5d5 ]

There was a bug that if writecache_flush fails due to I/O error, the
error is not reported in the FUA bio. This commit fixes it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: opencode:big-pickle
Cc: stable@vger.kernel.org
Fixes: 48debafe4f2f ("dm: add writecache target")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-writecache.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 34148aa4df799e..1e32053c271726 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1493,10 +1493,13 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
 		}
 	} while (bio->bi_iter.bi_size);
 
-	if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks))
+	if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
 		writecache_flush(wc);
-	else
+		if (writecache_has_error(wc))
+			bio->bi_status = BLK_STS_IOERR;
+	} else {
 		writecache_schedule_autocommit(wc);
+	}
 
 	return WC_MAP_SUBMIT;
 }

From 8b8734f39f524ed792d7f4a01f5a4ffe57ace9b7 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:39:44 +0200
Subject: [PATCH 1322/1982] dm-writecache: fix a quirk in statistics

[ Upstream commit c1ab80af0d99a906b60b769f2e692c37d2db1323 ]

writecache_bio_copy_ssd() unconditionally adds the number of extra blocks
in the merged bio to stats.writes_allocate. That is only correct when the
entries were taken off the freelist.

When the function is called with search_used == true -- i.e. from the
write_hits_uncommitted / write_hits_committed paths in
writecache_map_write() -- the first entry was found in the rbtree and
every following entry is picked up with rb_next(), so nothing is
allocated at all. Accordingly the writes_allocate++ that accompanies a
successful writecache_pop_from_freelist() is skipped for that case, but
the batch accounting below still adds n - 1.

An in-place overwrite of n contiguous cached blocks therefore reports n -
1 allocations that never happened. Only the dmsetup status output is
affected; there is no functional change.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: b2676e1482af ("dm writecache: count number of blocks written, not number of write bios")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-writecache.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 1e32053c271726..d29f6b3abce4d2 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1424,7 +1424,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
 	dm_accept_partial_bio(bio, bio_size >> SECTOR_SHIFT);
 
 	wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
-	wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
+	if (!search_used)
+		wc->stats.writes_allocate += (bio->bi_iter.bi_size - wc->block_size) >> wc->block_size_bits;
 
 	if (unlikely(wc->uncommitted_blocks >= wc->autocommit_blocks)) {
 		wc->uncommitted_blocks = 0;

From 6f3e29d421deb09aa8a8819fd62fd8dda9cac78e Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:41:11 +0200
Subject: [PATCH 1323/1982] dm-writecache: fix a crash if we attempt to use
 non-dax device

[ Upstream commit b15dc73f60ebf02410bc7014ce34fb7fd1040045 ]

If we specify a non-DAX device as a cache device in the 'P' mode,
dm-writecache crashes on NULL pointer dereference inside dax_synchronous.

Note that this is not a security bug because only root can trigger it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: a46624580376 ("dm writecache: reject asynchronous pmem devices")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-writecache.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index d29f6b3abce4d2..d3f93a871a1421 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -2511,6 +2511,11 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	}
 
 	if (WC_MODE_PMEM(wc)) {
+		if (!wc->ssd_dev->dax_dev) {
+			r = -EOPNOTSUPP;
+			ti->error = "Cache device is not a DAX device";
+			goto bad;
+		}
 		if (!dax_synchronous(wc->ssd_dev->dax_dev)) {
 			r = -EOPNOTSUPP;
 			ti->error = "Asynchronous persistent memory not supported as pmem cache";

From 33fedef97da9691dbadda81df8becad84033ae21 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:42:03 +0200
Subject: [PATCH 1324/1982] dm-writecache: fix uncommitted_blocks underflow

[ Upstream commit 8a0cc5f3446a324b13f62020eeddb32d6ba1c2db ]

Revert the commit 39495b12ef1cf602e6abd350dce2ef4199906531

writecache_bio_copy_ssd sets wc->uncommitted_blocks = 0; and then queues
the flush work: queue_work(wc->writeback_wq, &wc->flush_work);

It may be possible that discard is dispatched in this window, and the
discard would decrement wc->uncommitted_blocks to -1U.

Note that this bug is benign - wc->uncommitted_blocks is only used to
trigged autocommit, so decrementing it to -1U will trigger a spurious
autocommit, but won't cause any data corruption.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Fixes: 39495b12ef1c ("dm writecache: correct uncommitted_block when discarding uncommitted entry")
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-writecache.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index d3f93a871a1421..63e18c6f1325fd 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -899,8 +899,6 @@ static void writecache_discard(struct dm_writecache *wc, sector_t start, sector_
 				}
 				discarded_something = true;
 			}
-			if (!writecache_entry_is_committed(wc, e))
-				wc->uncommitted_blocks--;
 			writecache_free_entry(wc, e);
 		}
 

From bfef7c3b8be1f1838177df659643a82400d29b14 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 30 Sep 2026 21:43:26 +0200
Subject: [PATCH 1325/1982] dm-writecache: fix REQ_FUA processing

[ Upstream commit c0df022cb0fa2bbee74bd9b90c66790bcd4e3050 ]

REQ_FUA did not flush metadata in SSD mode, this commit fixes it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: c1005322ff02 ("dm writecache: handle REQ_FUA")
Assisted-by: Claude:claude-opus-5
Assisted-by: Codex:gpt-6-sol
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-writecache.c | 45 +++++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 10 deletions(-)

diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 63e18c6f1325fd..aa758d5ef6013b 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -194,6 +194,7 @@ struct dm_writecache {
 	struct task_struct *endio_thread;
 
 	struct task_struct *flush_thread;
+	spinlock_t flush_list_lock;
 	struct bio_list flush_list;
 
 	struct dm_kcopyd_client *dm_kcopyd;
@@ -1288,9 +1289,11 @@ static int writecache_flush_thread(void *data)
 		struct bio *bio;
 
 		wc_lock(wc);
+		spin_lock_irq(&wc->flush_list_lock);
 		bio = bio_list_pop(&wc->flush_list);
 		if (!bio) {
 			set_current_state(TASK_INTERRUPTIBLE);
+			spin_unlock_irq(&wc->flush_list_lock);
 			wc_unlock(wc);
 
 			if (unlikely(kthread_should_stop())) {
@@ -1301,6 +1304,7 @@ static int writecache_flush_thread(void *data)
 			schedule();
 			continue;
 		}
+		spin_unlock_irq(&wc->flush_list_lock);
 
 		if (bio_op(bio) == REQ_OP_DISCARD) {
 			writecache_discard(wc, bio->bi_iter.bi_sector,
@@ -1322,9 +1326,12 @@ static int writecache_flush_thread(void *data)
 
 static void writecache_offload_bio(struct dm_writecache *wc, struct bio *bio)
 {
+	unsigned long flags;
+	spin_lock_irqsave(&wc->flush_list_lock, flags);
 	if (bio_list_empty(&wc->flush_list))
 		wake_up_process(wc->flush_thread);
 	bio_list_add(&wc->flush_list, bio);
+	spin_unlock_irqrestore(&wc->flush_list_lock, flags);
 }
 
 enum wc_map_op {
@@ -1436,6 +1443,8 @@ static void writecache_bio_copy_ssd(struct dm_writecache *wc, struct bio *bio,
 static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio *bio)
 {
 	struct wc_entry *e;
+	enum wc_map_op ret = WC_MAP_SUBMIT;
+	bool need_flush = false;
 
 	do {
 		bool found_entry = false;
@@ -1472,7 +1481,8 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
 				writecache_map_remap_origin(wc, bio, e);
 				wc->stats.writes_around += bio->bi_iter.bi_size >> wc->block_size_bits;
 				wc->stats.writes += bio->bi_iter.bi_size >> wc->block_size_bits;
-				return WC_MAP_REMAP_ORIGIN;
+				ret = WC_MAP_REMAP_ORIGIN;
+				goto flush_pmem_and_ret;
 			}
 			wc->stats.writes_blocked_on_freelist++;
 			writecache_wait_on_freelist(wc);
@@ -1486,21 +1496,25 @@ static enum wc_map_op writecache_map_write(struct dm_writecache *wc, struct bio
 		if (WC_MODE_PMEM(wc)) {
 			bio_copy_block(wc, bio, memory_data(wc, e));
 			wc->stats.writes++;
+			need_flush = true;
 		} else {
 			writecache_bio_copy_ssd(wc, bio, e, search_used);
 			return WC_MAP_REMAP;
 		}
 	} while (bio->bi_iter.bi_size);
 
-	if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
-		writecache_flush(wc);
-		if (writecache_has_error(wc))
-			bio->bi_status = BLK_STS_IOERR;
-	} else {
-		writecache_schedule_autocommit(wc);
+flush_pmem_and_ret:
+	if (need_flush) {
+		if (unlikely(bio->bi_opf & REQ_FUA || wc->uncommitted_blocks >= wc->autocommit_blocks)) {
+			writecache_flush(wc);
+			if (writecache_has_error(wc))
+				ret = WC_MAP_ERROR;
+		} else {
+			writecache_schedule_autocommit(wc);
+		}
 	}
 
-	return WC_MAP_SUBMIT;
+	return ret;
 }
 
 static enum wc_map_op writecache_map_flush(struct dm_writecache *wc, struct bio *bio)
@@ -1590,7 +1604,10 @@ static int writecache_map(struct dm_target *ti, struct bio *bio)
 
 	case WC_MAP_REMAP:
 		/* make sure that writecache_end_io decrements bio_in_progress: */
-		bio->bi_private = (void *)1;
+		if (unlikely(bio->bi_opf & REQ_FUA) && bio_op(bio) == REQ_OP_WRITE)
+			bio->bi_private = (void *)3;
+		else
+			bio->bi_private = (void *)1;
 		atomic_inc(&wc->bio_in_progress[bio_data_dir(bio)]);
 		wc_unlock(wc);
 		return DM_MAPIO_REMAPPED;
@@ -1620,12 +1637,19 @@ static int writecache_end_io(struct dm_target *ti, struct bio *bio, blk_status_t
 {
 	struct dm_writecache *wc = ti->private;
 
-	if (bio->bi_private == (void *)1) {
+	if (bio->bi_private == (void *)1 || bio->bi_private == (void *)3) {
 		int dir = bio_data_dir(bio);
+		bool fua = bio->bi_private == (void *)3;
 
 		if (atomic_dec_and_test(&wc->bio_in_progress[dir]))
 			if (unlikely(waitqueue_active(&wc->bio_in_progress_wait[dir])))
 				wake_up(&wc->bio_in_progress_wait[dir]);
+
+		if (fua && likely(*status == BLK_STS_OK)) {
+			bio->bi_private = NULL;
+			writecache_offload_bio(wc, bio);
+			return DM_ENDIO_INCOMPLETE;
+		}
 	} else if (bio->bi_private == (void *)2) {
 		dm_iot_io_end(&wc->iot, 1);
 	}
@@ -2531,6 +2555,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 		wc->memory_map_size -= (uint64_t)wc->start_sector << SECTOR_SHIFT;
 
+		spin_lock_init(&wc->flush_list_lock);
 		bio_list_init(&wc->flush_list);
 		wc->flush_thread = kthread_run(writecache_flush_thread, wc, "dm_writecache_flush");
 		if (IS_ERR(wc->flush_thread)) {

From 2ea73c70014ff7839549a5eda350b00ecddba4c4 Mon Sep 17 00:00:00 2001
From: Vincent Donnefort <vdonnefort@google.com>
Date: Mon, 28 Sep 2026 10:54:50 +0100
Subject: [PATCH 1326/1982] KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs

[ Upstream commit 6c29285e78b5e4811145ebda382ac0ba732ce56a ]

Protected VM ID register emulation leaves unlisted fields at 0. This
creates two issues for TGRAN:

  * TGRAN16: 0 means non-implemented. It prevents 16KB protected VMs
    from booting even when the hardware supports it.

  * TGRAN4|TGRAN64: 0 means implemented. This may falsely advertise the
    feature even when the hardware does not support it.

Advertise all the TGRAN fields in pvmid_aa64mmfr0 so that the hardware
support is properly propagated.

Cc: stable@vger.kernel.org
Fixes: 6c30bfb18d0b ("KVM: arm64: Add handlers for protected VM System Registers")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260928095454.3255918-2-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/hyp/nvhe/sys_regs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
index 3108b5185c204d..168d473e084b4d 100644
--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c
+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
@@ -115,6 +115,9 @@ static const struct pvm_ftr_bits pvmid_aa64mmfr0[] = {
 	MAX_FEAT(ID_AA64MMFR0_EL1, SNSMEM, IMP),
 	MAX_FEAT(ID_AA64MMFR0_EL1, BIGENDEL0, IMP),
 	MAX_FEAT(ID_AA64MMFR0_EL1, EXS, IMP),
+	MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN4, IMP),
+	MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN16, IMP),
+	MAX_FEAT(ID_AA64MMFR0_EL1, TGRAN64, IMP),
 	FEAT_END
 };
 

From aaed8f7c2a65319745bd969e2e2dbbd13a2e45dc Mon Sep 17 00:00:00 2001
From: Danish Khateeb <danishkhateeb03@gmail.com>
Date: Tue, 29 Sep 2026 07:49:36 -0500
Subject: [PATCH 1327/1982] pps: generators: stop the generator on unregister

[ Upstream commit 3e75af9f41c7509884d0955245dec2b791287e8c ]

Both generator drivers stop their timer and then call
pps_gen_unregister_source(): pps_gen_tio_remove() cancels its hrtimer
and disables the TIO, and pps_gen_dummy_exit() deletes its timer. But
/dev/pps-genN and the sysfs "enable" attribute are still there until
the unregister, and a PPS_GEN_SETENABLE or a write to "enable" in
between starts the timer again. Nothing stops it after that: TIO's
hrtimer keeps running in the devm memory freed by the unbind, and the
dummy's timer is left in the unloaded module.

The drivers can't avoid this by unregistering first, as TIO's timer
callback uses pps_gen, which the unregister may free.

Stop the generator in pps_gen_unregister_cdev() instead, under
info_lock after the device and its sysfs files are gone, when nothing
can enable it again. pps_gen_unregister_source() then also does what
its kernel-doc says: "it disables the generator so no pulses are
generated anymore".

Fixes: 86b525bed275 ("drivers pps: add PPS generators support")
Cc: stable@vger.kernel.org
Suggested-by: Rodolfo Giometti <giometti@enneenne.com>
Assisted-by: LLM
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Link: https://patch.msgid.link/20260929124937.51114-4-danishkhateeb03@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pps/generators/pps_gen.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c
index 630a8804d63e7e..eda7fd933bec75 100644
--- a/drivers/pps/generators/pps_gen.c
+++ b/drivers/pps/generators/pps_gen.c
@@ -228,9 +228,18 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen)
 	 * An open file keeps pps_gen around, but the driver may free info as
 	 * soon as we return. The sysfs files are gone now, so wait for the
 	 * ioctls using info and make later ones fail.
+	 *
+	 * The driver may have stopped the generator before calling us, but
+	 * userspace could have enabled it again since. Nothing can enable it
+	 * after this point, so stop it here for good.
 	 */
-	scoped_guard(mutex, &pps_gen->info_lock)
+	scoped_guard(mutex, &pps_gen->info_lock) {
+		if (pps_gen->enabled) {
+			pps_gen->info->enable(pps_gen, false);
+			pps_gen->enabled = false;
+		}
 		pps_gen->info = NULL;
+	}
 
 	put_device(&pps_gen->dev);
 }

From 9a3288b2380d5904c1a9f0352bdee4b4ef452460 Mon Sep 17 00:00:00 2001
From: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
Date: Wed, 30 Sep 2026 14:32:26 +0000
Subject: [PATCH 1328/1982] block: drop the cached plug time when
 blk_add_rq_to_plug() flushes

[ Upstream commit e0f2224433b15a57125d6ac5d46182f99c6c9d08 ]

blk_time_get_ns() caches the current time in the task's plug. The idea
is that the cache lives for one plug and is dropped when the plug is
flushed. __blk_flush_plug() and finish_task_switch() do that.

blk_add_rq_to_plug() also flushes, when the plug has too many requests
or the last request is at least BLK_PLUG_FLUSH_SIZE. But it calls
blk_mq_flush_plug_list() directly and never drops the cached time. So
a task that keeps submitting without sleeping stamps every request
after that with the time first cached in the plug. start_time_ns and
io_start_time_ns are stale and the disk stats charge each request for
the whole time since the plug began.

Drop the cached time after the flush, same as __blk_flush_plug() does.

Fixes: da4c8c3d0975 ("block: cache current nsec time in struct blk_plug")
Cc: stable@vger.kernel.org
Signed-off-by: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
Link: https://patch.msgid.link/20260930-blk-plug-ts-flush-v1-1-bf8ca7bc5cd6@virtuozzo.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index ba0c48d58e1341..73ee5a9ea51d65 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1428,6 +1428,7 @@ static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
 		   (!blk_queue_nomerges(rq->q) &&
 		    blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) {
 		blk_mq_flush_plug_list(plug, false);
+		blk_plug_invalidate_ts();
 		last = NULL;
 		trace_block_plug(rq->q);
 	}

From 59e69a73f9b2ac2599218a9e16884c3fdf879275 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 30 Sep 2026 14:59:51 +0800
Subject: [PATCH 1329/1982] block: amiflop: synchronize flush timer before
 track flush

[ Upstream commit 9690943353cec1690a715e000ba6a74e5139f530 ]

The amiflop track buffer is shared with the timer callback. timer_delete()
does not wait for an in-flight callback, and that callback can rearm itself
when it cannot acquire the floppy controller. A synchronous track flush can
therefore race with the callback.

Stop the timer before synchronous track writes and use timer_delete_sync()
to wait for any callback already running. Keep callback rearming disabled
until the write is complete. Apply this to the FDFMTTRK path as well.

FDFLUSH, FDFMTTRK and close-time flushes run outside the blk-mq
request callback. Freeze their queues so an in-flight request cannot
change the shared track buffer while it is encoded and written. Restart
the timer if a track remains dirty after a failed flush.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260930065951.2932739-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/amiflop.c | 71 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 63 insertions(+), 8 deletions(-)

diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 2932b6653b6f0d..a477ada6b1ef51 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -265,6 +265,8 @@ static struct fd_data_type data_types[] = {
 static struct amiga_floppy_struct unit[FD_MAX_UNITS];
 
 static struct timer_list flush_track_timer[FD_MAX_UNITS];
+static DEFINE_SPINLOCK(flush_track_timer_lock);
+static bool flush_track_timer_stopped[FD_MAX_UNITS];
 static struct timer_list post_write_timer;
 static unsigned long post_write_timer_drive;
 static struct timer_list motor_on_timer;
@@ -1370,11 +1372,22 @@ static void flush_track_callback(struct timer_list *timer)
 					sizeof(flush_track_timer[0]);
 
 	nr&=3;
+	spin_lock(&flush_track_timer_lock);
+	if (flush_track_timer_stopped[nr]) {
+		spin_unlock(&flush_track_timer_lock);
+		return;
+	}
+	spin_unlock(&flush_track_timer_lock);
+
 	writefromint = 1;
 	if (!try_fdc(nr)) {
 		/* we might block in an interrupt, so try again later */
-		flush_track_timer[nr].expires = jiffies + 1;
-		add_timer(flush_track_timer + nr);
+		spin_lock(&flush_track_timer_lock);
+		if (!flush_track_timer_stopped[nr]) {
+			flush_track_timer[nr].expires = jiffies + 1;
+			add_timer(flush_track_timer + nr);
+		}
+		spin_unlock(&flush_track_timer_lock);
 		return;
 	}
 	get_fdc(nr);
@@ -1421,6 +1434,35 @@ static int non_int_flush_track (unsigned long nr)
 	return 1;
 }
 
+static void flush_track_timer_stop(unsigned int drive)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&flush_track_timer_lock, flags);
+	flush_track_timer_stopped[drive] = true;
+	spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+
+	timer_delete_sync(flush_track_timer + drive);
+}
+
+static void flush_track_timer_start(unsigned int drive)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&flush_track_timer_lock, flags);
+	flush_track_timer_stopped[drive] = false;
+	if (unit[drive].dirty)
+		mod_timer(flush_track_timer + drive, jiffies + 1);
+	spin_unlock_irqrestore(&flush_track_timer_lock, flags);
+}
+
+static void flush_track_timer_sync(unsigned int drive)
+{
+	flush_track_timer_stop(drive);
+	non_int_flush_track(drive);
+	flush_track_timer_start(drive);
+}
+
 static int get_track(int drive, int track)
 {
 	int error, errcnt;
@@ -1435,8 +1477,7 @@ static int get_track(int drive, int track)
 	}
 
 	if (unit[drive].dirty == 1) {
-		timer_delete(flush_track_timer + drive);
-		non_int_flush_track (drive);
+		flush_track_timer_sync(drive);
 	}
 	errcnt = 0;
 	while (errcnt < MAX_ERRORS) {
@@ -1562,6 +1603,12 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
 	case FDFMTTRK:
 		if (param < p->type->tracks * p->type->heads)
 		{
+			flush_track_timer_stop(drive);
+			if (unit[drive].dirty == 1 &&
+			    !non_int_flush_track(drive)) {
+				flush_track_timer_start(drive);
+				return -EIO;
+			}
 			get_fdc(drive);
 			if (fd_seek(drive,param) != 0){
 				memset(p->trackbuf, FD_FILL_BYTE,
@@ -1570,6 +1617,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
 			}
 			floppy_off(drive);
 			rel_fdc();
+			flush_track_timer_start(drive);
 		}
 		else
 			return -EINVAL;
@@ -1591,8 +1639,7 @@ static int fd_locked_ioctl(struct block_device *bdev, blk_mode_t mode,
 	case FDDEFPRM:
 		return -EINVAL;
 	case FDFLUSH: /* unconditionally, even if not needed */
-		timer_delete(flush_track_timer + drive);
-		non_int_flush_track(drive);
+		flush_track_timer_sync(drive);
 		break;
 #ifdef RAW_IOCTL
 	case IOCTL_RAW_TRACK:
@@ -1611,9 +1658,15 @@ static int fd_ioctl(struct block_device *bdev, blk_mode_t mode,
 			     unsigned int cmd, unsigned long param)
 {
 	int ret;
+	unsigned int memflags = 0;
+	bool freeze_queue = cmd == FDFMTTRK || cmd == FDFLUSH;
 
 	mutex_lock(&amiflop_mutex);
+	if (freeze_queue)
+		memflags = blk_mq_freeze_queue(bdev->bd_disk->queue);
 	ret = fd_locked_ioctl(bdev, mode, cmd, param);
+	if (freeze_queue)
+		blk_mq_unfreeze_queue(bdev->bd_disk->queue, memflags);
 	mutex_unlock(&amiflop_mutex);
 
 	return ret;
@@ -1711,11 +1764,12 @@ static void floppy_release(struct gendisk *disk)
 {
 	struct amiga_floppy_struct *p = disk->private_data;
 	int drive = p - unit;
+	unsigned int memflags;
 
 	mutex_lock(&amiflop_mutex);
+	memflags = blk_mq_freeze_queue(disk->queue);
 	if (unit[drive].dirty == 1) {
-		timer_delete(flush_track_timer + drive);
-		non_int_flush_track (drive);
+		flush_track_timer_sync(drive);
 	}
   
 	if (!fd_ref[drive]--) {
@@ -1725,6 +1779,7 @@ static void floppy_release(struct gendisk *disk)
 #ifdef MODULE
 	floppy_off (drive);
 #endif
+	blk_mq_unfreeze_queue(disk->queue, memflags);
 	mutex_unlock(&amiflop_mutex);
 }
 

From 3c379310c8b80e0f753d4cc1755919441f626f5a Mon Sep 17 00:00:00 2001
From: Imre Kaloz <kaloz@kernel.org>
Date: Wed, 30 Sep 2026 21:10:58 +0200
Subject: [PATCH 1330/1982] PCI: Disable MSI for ULi M1575 EHCI controller

[ Upstream commit 5f30217ec296fb5742f6fd306586dbca5b81b4eb ]

With MSI, the ULi M1575 EHCI controller (10b9:5239) intermittently stops
executing its asynchronous schedule. Control transfers time out ("device
not accepting address", "device descriptor read/64"), the port is handed to
the companion OHCI controller, and the device ends up at full speed. On a
configured hub the stall shows up as hub descriptor and status read
failures. Only re-initializing the controller recovers it.

On a Sun Ultra 45, 65 of 800 controller initializations stalled with MSI
and none of 200 with INTx. Each initialization is an unbind and bind of
ehci-pci on the EHCI function, with MSI or INTx selected through its
msi_bus attribute; with this quirk, 0 of 100 cycles of the same loop
stalled. The stall reproduces on a kernel that already contains commit
0b60557230ad ("usb: ehci: Prevent missed ehci interrupts with
edge-triggered MSI").

The OHCI functions (10b9:5237) keep MSI. They showed no stall, and the hub
enumerated through them on MSI during the EHCI failures, so only the EHCI
function is quirked.

The illumos EHCI driver also disables MSI on this chip, in
ehci_register_intrs_and_init_mutex() in
usr/src/uts/common/io/usb/hcd/ehci/ehci_util.c.

Until USB HCDs started trying MSI first in v5.9, the controller always used
INTx. Disable MSI so it uses INTx again on this chipset.

Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260930191100.6127-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 199f2a762b22ae..d29ff1da29b179 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1944,6 +1944,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi);
+/* ULi M1575 EHCI (10b9:5239): MSI stalls the async schedule */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, 0x5239, quirk_no_msi);
 
 static void quirk_pcie_mch(struct pci_dev *pdev)
 {

From 72af96b39afd6faa77d037080a15405336acd05c Mon Sep 17 00:00:00 2001
From: Wei Jie Law <98lawweijie@gmail.com>
Date: Mon, 7 Sep 2026 20:18:43 +0800
Subject: [PATCH 1331/1982] media: uvcvideo: Fix NULL deref on events for
 uninitialized controls

[ Upstream commit daa379e2b74d6c10ba4e3b56eeca5aa8c8704fca ]

A null-ptr-deref exists in v6.12.105 and upstream. KASAN crash log:

  KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
  Workqueue: events uvc_ctrl_status_event_work
  RIP: 0010:uvc_ctrl_status_event+0x105/0x280
   uvc_ctrl_status_event_work+0x82/0x240
   process_one_work+0x66f/0x10b0

XU controls are initialized lazily, on the first UVCIOC_CTRL_MAP or
UVCIOC_CTRL_QUERY.  Until then ctrl->info is all zeroes, so
info.mappings is not a valid list head, list_empty() returns false, and
uvc_ctrl_status_event() walks it from a NULL next pointer.

Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <98lawweijie@gmail.com>
Assisted-by: LLM
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260907121844.2592492-1-98lawweijie@gmail.com
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 2738ef74c7373b..7fd2e03f92e6c0 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2010,7 +2010,7 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
 	struct uvc_device *dev = chain->dev;
 	struct uvc_ctrl_work *w = &dev->async_ctrl;
 
-	if (list_empty(&ctrl->info.mappings))
+	if (!ctrl->initialized || list_empty(&ctrl->info.mappings))
 		return false;
 
 	w->data = data;

From f3e503a31d3cfdc8fae1baeb0ad5ba8471ceea9d Mon Sep 17 00:00:00 2001
From: ZhaoJinming <zhaojinming@uniontech.com>
Date: Wed, 23 Sep 2026 18:14:57 +0800
Subject: [PATCH 1332/1982] crypto: caam - fix double-free in
 caam_rsa_set_priv_key_form()

[ Upstream commit a91d9346a70b68f77884cba9d9ec3b70f96bf9d2 ]

caam_rsa_set_priv_key_form() frees the partially allocated key
components (p, q, tmp1, tmp2, dp, dq) with kfree_sensitive() on its
error path, but does not set those pointers to NULL afterward.

When the function returns an error, caam_rsa_set_priv_key() jumps to
its err label and calls caam_rsa_free_key(), which frees all of those
same pointers again, resulting in a double-free.

This is reachable when the allocation of q, tmp1, tmp2, dp, dq or qinv
fails, e.g. under memory pressure, or for a malformed key whose CRT
members decode to zero length and make caam_read_rsa_crt() return NULL.

Set each pointer to NULL right after freeing it so that the subsequent
caam_rsa_free_key() call becomes a no-op for the already-freed fields.

Fixes: 52e26d77b8b3 ("crypto: caam - add support for RSA key form 2")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caampkc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index cb001aa1de6618..ac515ed8c57552 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -1033,16 +1033,22 @@ static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
 
 free_dq:
 	kfree_sensitive(rsa_key->dq);
+	rsa_key->dq = NULL;
 free_dp:
 	kfree_sensitive(rsa_key->dp);
+	rsa_key->dp = NULL;
 free_tmp2:
 	kfree_sensitive(rsa_key->tmp2);
+	rsa_key->tmp2 = NULL;
 free_tmp1:
 	kfree_sensitive(rsa_key->tmp1);
+	rsa_key->tmp1 = NULL;
 free_q:
 	kfree_sensitive(rsa_key->q);
+	rsa_key->q = NULL;
 free_p:
 	kfree_sensitive(rsa_key->p);
+	rsa_key->p = NULL;
 	return -ENOMEM;
 }
 

From 987b7053bde1769caef4816ddedf68ffe84f4711 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Wed, 23 Sep 2026 22:12:58 +0200
Subject: [PATCH 1333/1982] hwrng: amd - report partial reads in non-blocking
 mode

[ Upstream commit e7f5ce911efb2017381f28bbedb6243a74a9c285 ]

amd_rng_read() returns 0 if no more data is available, even if some data
was already copied to the output buffer. Return the number of copied
bytes instead.

Fixes: 85962d2248fa ("hwrng: amd - Convert to new hwrng read() API")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/amd-rng.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 9a24d19236dc70..cc65d40a559842 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -80,7 +80,7 @@ static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
 				if (timeout-- == 0)
 					return read;
 			} else {
-				return 0;
+				return read;
 			}
 		} else {
 			*data = ioread32(priv->iobase + RNGDATA);

From 99cfdc3715846ce5ba03441decfce1eb83dade17 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Thu, 24 Sep 2026 11:33:59 +0200
Subject: [PATCH 1334/1982] hwrng: ba431 - fix reported byte count

[ Upstream commit 7e638679883ceff5b6e7b6dcad09c21a105e941f ]

Use the size of the buffer element instead of the pointer size to report
the number of bytes read. Since data is a u32 pointer and sizeof(data)
is 8 bytes on 64-bit systems, using the pointer size reports twice the
number of bytes actually read.

Fixes: 0289e9be5dc2 ("hwrng: ba431 - add support for BA431 hwrng")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/ba431-rng.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/hw_random/ba431-rng.c b/drivers/char/hw_random/ba431-rng.c
index 9de7466e68962f..c33fbc25b7cdfc 100644
--- a/drivers/char/hw_random/ba431-rng.c
+++ b/drivers/char/hw_random/ba431-rng.c
@@ -148,7 +148,7 @@ static int ba431_trng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
 		}
 	}
 
-	n *= sizeof(data);
+	n *= sizeof(*data);
 	return (n || !wait) ? n : -EIO;
 }
 

From 5393887ab975d2bfcda12283613bc4e03f1f7d0b Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Thu, 24 Sep 2026 23:21:13 +0200
Subject: [PATCH 1335/1982] hwrng: core - reject unknown RNG names

[ Upstream commit 7e7be8815143751c20260f80cb4e7fe14dd24b74 ]

In rng_current_store(), err is 0 after successfully locking rng_mutex,
and if the requested RNG name cannot be found, the function reports
success even though the current RNG was not changed.

Set err = -ENODEV before searching the RNG list to reject unknown names.

Fixes: 142a27f0a731 ("hwrng: core - Reset user selected rng by writing "" to rng_current")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <blum@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 054ffbc9e4220f..6412bfa792a29c 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -381,6 +381,7 @@ static ssize_t rng_current_store(struct device *dev,
 		cur_rng_set_by_user = 1;
 		drop_current_rng();
 	} else {
+		err = -ENODEV;
 		list_for_each_entry(rng, &rng_list, list) {
 			if (sysfs_streq(rng->name, buf)) {
 				err = set_current_rng(rng);

From 5ecd94581c322d6998f50c32e4fa00f935847059 Mon Sep 17 00:00:00 2001
From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Date: Fri, 25 Sep 2026 14:58:39 -0300
Subject: [PATCH 1336/1982] crypto: nx - validate 'ignore' before subtracting
 in decompress

[ Upstream commit b5c2df42977390a71f1940def5be9bd5c69ac2e0 ]

The decompress() function subtracts the header-supplied `ignore` value
(a u16 from the compressed stream) from `dlen` (the number of bytes
produced by the decompressor) without checking that ignore <= dlen.

If a caller decompresses a crafted buffer where `hdr->ignore` exceeds
the actual decompressed length, the subtraction wraps around to a
near-UINT_MAX value.  The subsequent memcpy() then copies gigabytes of
data past the destination buffer, causing an out-of-bounds kernel write.

Add a bounds check before the subtraction and return -EINVAL if the
value is inconsistent.

Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/nx/nx-842.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c
index 8b1dc05df8c8dc..ade5361571f14d 100644
--- a/drivers/crypto/nx/nx-842.c
+++ b/drivers/crypto/nx/nx-842.c
@@ -421,6 +421,8 @@ static int decompress(struct nx842_crypto_ctx *ctx,
 
 	slen -= spadding;
 
+	if (ignore > dlen)
+		return -EINVAL;
 	dlen -= ignore;
 	if (ignore)
 		pr_debug("ignoring last %x bytes\n", ignore);

From 8e9628f42c7c91c973420ec90f2ce7930f7bac68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Sat, 26 Sep 2026 20:43:26 +0000
Subject: [PATCH 1337/1982] crypto: ecc - Handle exceptional points in Shamir
 multiplication
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6fd70bc8bc01a578c7728b7bd1cb5689c62cc5b7 ]

Shamir multiplication mishandles equal points, opposite points and the
point at infinity. This rejects valid ECDSA signatures and can accept
invalid digest/signature tuples when the public key is G or -G. The
kernel incorrectly rejects 16 valid signatures from Wycheproof.

Handle doubling, cancellation and the point at infinity in precomputation
and accumulation. Add regression tests for P-256 ECDSA and 256/512-bit
EC-RDSA. The valid vectors are Wycheproof P1363 secp256r1/SHA-256 cases
60 and 210 converted to X9.62, two constructed ECDSA signatures for
Q = +/-G with k = 2, and six constructed EC-RDSA signatures for Q = G,
-G and -2G. Also add two invalid P-256 digest/signature tuples for
Q = +/-G that must return -EKEYREJECTED.

Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/ecc.c     |  33 ++++-
 crypto/testmgr.c |  11 +-
 crypto/testmgr.h | 327 ++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 363 insertions(+), 8 deletions(-)

diff --git a/crypto/ecc.c b/crypto/ecc.c
index f97ff234086ffb..a289d47d5651dc 100644
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -1410,9 +1410,22 @@ static void ecc_point_add(const struct ecc_point *result,
 	vli_set(result->x, q->x, ndigits);
 	vli_set(result->y, q->y, ndigits);
 	vli_mod_sub(z, result->x, p->x, curve->p, ndigits);
+	if (vli_is_zero(z, ndigits)) {
+		if (vli_cmp(p->y, q->y, ndigits)) {
+			/* P + (-P) is the point at infinity. */
+			vli_clear(result->x, ndigits);
+			vli_clear(result->y, ndigits);
+			return;
+		}
+		/* The co-Z addition formula does not handle P == Q. */
+		z[0] = 1;
+		ecc_point_double_jacobian(result->x, result->y, z, curve);
+		goto out;
+	}
 	vli_set(px, p->x, ndigits);
 	vli_set(py, p->y, ndigits);
 	xycz_add(px, py, result->x, result->y, curve);
+out:
 	vli_mod_inv(z, z, curve->p, ndigits);
 	apply_z(result->x, result->y, z, curve);
 }
@@ -1452,22 +1465,38 @@ void ecc_point_mult_shamir(const struct ecc_point *result,
 	vli_set(rx, point->x, ndigits);
 	vli_set(ry, point->y, ndigits);
 	vli_clear(z + 1, ndigits - 1);
-	z[0] = 1;
+	z[0] = !ecc_point_is_zero(point);
 
 	for (--i; i >= 0; i--) {
 		ecc_point_double_jacobian(rx, ry, z, curve);
 		idx = !!vli_test_bit(u1, i);
 		idx |= (!!vli_test_bit(u2, i)) << 1;
 		point = points[idx];
-		if (point) {
+		if (point && !ecc_point_is_zero(point)) {
 			u64 tx[ECC_MAX_DIGITS];
 			u64 ty[ECC_MAX_DIGITS];
 			u64 tz[ECC_MAX_DIGITS];
 
+			if (vli_is_zero(z, ndigits)) {
+				/* Adding to infinity starts a new accumulator. */
+				vli_set(rx, point->x, ndigits);
+				vli_set(ry, point->y, ndigits);
+				z[0] = 1;
+				continue;
+			}
 			vli_set(tx, point->x, ndigits);
 			vli_set(ty, point->y, ndigits);
 			apply_z(tx, ty, z, curve);
 			vli_mod_sub(tz, rx, tx, curve->p, ndigits);
+			if (vli_is_zero(tz, ndigits)) {
+				if (!vli_cmp(ry, ty, ndigits))
+					ecc_point_double_jacobian(rx, ry, z,
+								  curve);
+				else
+					/* Adding opposite points yields infinity. */
+					vli_clear(z, ndigits);
+				continue;
+			}
 			xycz_add(tx, ty, rx, ry, curve);
 			vli_mod_mult_fast(z, z, tz, curve);
 		}
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 6a490aaa71b9aa..8543e21a4259d7 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4061,16 +4061,17 @@ static int test_sig_one(struct crypto_sig *tfm, const struct sig_testvec *vecs)
 	 */
 	err = crypto_sig_verify(tfm, vecs->c, vecs->c_size,
 				vecs->m, vecs->m_size);
-	if (err) {
-		pr_err("alg: sig: verify test failed: err %d\n", err);
-		return err;
+	if (err != vecs->verify_error) {
+		pr_err("alg: sig: verify test failed: expected %d, got %d\n",
+		       vecs->verify_error, err);
+		return err ?: -EINVAL;
 	}
 
 	/*
 	 * Don't invoke sign test (which requires a private key)
-	 * for vectors with only a public key.
+	 * for vectors with only a public key or an invalid signature.
 	 */
-	if (vecs->public_key_vec)
+	if (vecs->public_key_vec || vecs->verify_error)
 		return 0;
 
 	sig_size = crypto_sig_maxsize(tfm);
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index 2682312272824b..210dafb684fd77 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -165,6 +165,7 @@ struct sig_testvec {
 	unsigned int param_len;
 	unsigned int m_size;
 	unsigned int c_size;
+	int verify_error;
 	bool public_key_vec;
 	enum OID algo;
 };
@@ -1447,6 +1448,140 @@ static const struct sig_testvec x962_ecdsa_nist_p192_tv_template[] = {
 };
 
 static const struct sig_testvec x962_ecdsa_nist_p256_tv_template[] = {
+	/* Invalid signature: Q = G, r = s, e = 3r mod n. */
+	{
+	.key =
+	"\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+	"\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+	"\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+	"\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+	"\xf5",
+	.key_len = 65,
+	.m =
+	"\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+	"\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+	.m_size = 32,
+	.c =
+	"\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+	"\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+	"\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+	"\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+	"\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+	.c_size = 72,
+	.verify_error = -EKEYREJECTED,
+	.public_key_vec = true,
+	},
+	/* Invalid signature: Q = -G, r = s, e = 3r mod n. */
+	{
+	.key =
+	"\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+	"\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+	"\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+	"\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+	"\x0a",
+	.key_len = 65,
+	.m =
+	"\xb2\xc3\x09\x72\x03\x17\x9d\xaa\x5c\x4a\xd8\xff\x02\xfe\xcb\x15"
+	"\x21\x53\x81\x77\x45\xec\x45\x24\x3d\x68\x10\xb9\xf2\xa5\x88\x3a",
+	.m_size = 32,
+	.c =
+	"\x30\x46\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e\x74\x18\xf2"
+	"\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3\x10\x60\x9e"
+	"\x7e\xfa\x58\x39\xd9\x02\x21\x00\x90\xeb\xad\xd0\x56\x5d\x34\x8e"
+	"\x74\x18\xf2\xff\xab\xaa\x43\xb1\x9f\x68\xd4\x0c\x4f\x01\x4b\xe3"
+	"\x10\x60\x9e\x7e\xfa\x58\x39\xd9",
+	.c_size = 72,
+	.verify_error = -EKEYREJECTED,
+	.public_key_vec = true,
+	},
+	/* Wycheproof secp256r1/SHA-256 tcId 60. */
+	{
+	.key =
+	"\x04\x29\x27\xb1\x05\x12\xba\xe3\xed\xdc\xfe\x46\x78\x28\x12\x8b"
+	"\xad\x29\x03\x26\x99\x19\xf7\x08\x60\x69\xc8\xc4\xdf\x6c\x73\x28"
+	"\x38\xc7\x78\x79\x64\xea\xac\x00\xe5\x92\x1f\xb1\x49\x8a\x60\xf4"
+	"\x60\x67\x66\xb3\xd9\x68\x50\x01\x55\x8d\x1a\x97\x4e\x73\x41\x51"
+	"\x3e",
+	.key_len = 65,
+	.m =
+	"\x70\x23\x9d\xd8\x77\xf7\xc9\x44\xc4\x22\xf4\x4d\xea\x4e\xd1\xa5"
+	"\x2f\x26\x27\x41\x6f\xaf\x2f\x07\x2f\xa5\x0c\x77\x2e\xd6\xf8\x07",
+	.m_size = 32,
+	.c =
+	"\x30\x44\x02\x20\x64\xa1\xaa\xb5\x00\x0d\x0e\x80\x4f\x3e\x2f\xc0"
+	"\x2b\xde\xe9\xbe\x8f\xf3\x12\x33\x4e\x2b\xa1\x6d\x11\x54\x7c\x97"
+	"\x71\x1c\x89\x8e\x02\x20\x6a\xf0\x15\x97\x1c\xc3\x0b\xe6\xd1\xa2"
+	"\x06\xd4\xe0\x13\xe0\x99\x77\x72\xa2\xf9\x1d\x73\x28\x6f\xfd\x68"
+	"\x3b\x9b\xb2\xcf\x4f\x1b",
+	.c_size = 70,
+	.public_key_vec = true,
+	},
+	/* Wycheproof secp256r1/SHA-256 tcId 210. */
+	{
+	.key =
+	"\x04\xc6\xa7\x71\x52\x70\x24\x22\x77\x92\x17\x0a\x6f\x8e\xee\x73"
+	"\x5b\xf3\x2b\x7f\x98\xaf\x66\x9e\xad\x29\x98\x02\xe3\x2d\x7c\x31"
+	"\x07\xbc\x3b\x4b\x5e\x65\xab\x88\x7b\xbd\x34\x35\x72\xb3\xe5\x61"
+	"\x92\x61\xfe\x3a\x07\x3e\x2f\xfd\x78\x41\x2f\x72\x68\x67\xdb\x58"
+	"\x9e",
+	.key_len = 65,
+	.m =
+	"\xbb\x5a\x52\xf4\x2f\x9c\x92\x61\xed\x43\x61\xf5\x94\x22\xa1\xe3"
+	"\x00\x36\xe7\xc3\x2b\x27\x0c\x88\x07\xa4\x19\xfe\xca\x60\x50\x23",
+	.m_size = 32,
+	.c =
+	"\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+	"\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+	"\x47\x66\x99\x78\x02\x21\x00\xb6\xdb\x6d\xb6\x24\x92\x49\x25\x49"
+	"\x24\x92\x49\x24\x92\x49\x24\x62\x5b\xd7\xa0\x9b\xec\x4c\xa8\x1b"
+	"\xcd\xd9\xf8\xfd\x6b\x63\xcc",
+	.c_size = 71,
+	.public_key_vec = true,
+	},
+	/* Q = G, d = 1, k = 2. */
+	{
+	.key =
+	"\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+	"\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+	"\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e"
+	"\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51"
+	"\xf5",
+	.key_len = 65,
+	.m =
+	"\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+	"\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+	.m_size = 32,
+	.c =
+	"\x30\x44\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+	"\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+	"\x47\x66\x99\x78\x02\x20\x59\x47\xc9\x21\x23\x0e\xd1\x34\x0b\x03"
+	"\xe6\xe3\x45\x6e\xab\x69\xf8\x66\xff\x7e\x8c\x7d\x1e\x13\x23\x17"
+	"\x06\x8a\x84\xec\x1d\x22",
+	.c_size = 70,
+	.public_key_vec = true,
+	},
+	/* Q = -G, d = n - 1, k = 2. */
+	{
+	.key =
+	"\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40"
+	"\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2"
+	"\x96\xb0\x1c\xbd\x1c\x01\xe5\x80\x65\x71\x18\x14\xb5\x83\xf0\x61"
+	"\xe9\xd4\x31\xcc\xa9\x94\xce\xa1\x31\x34\x49\xbf\x97\xc8\x40\xae"
+	"\x0a",
+	.key_len = 65,
+	.m =
+	"\x35\x9d\x17\x29\xb9\x1a\x52\xe9\x8b\xb5\x95\xc3\x86\x28\x3c\x10"
+	"\x30\x44\x95\x1a\xa1\x08\x20\xf0\xa0\x22\xc4\x18\xc2\x71\xa0\xcc",
+	.m_size = 32,
+	.c =
+	"\x30\x45\x02\x20\x7c\xf2\x7b\x18\x8d\x03\x4f\x7e\x8a\x52\x38\x03"
+	"\x04\xb5\x1a\xc3\xc0\x89\x69\xe2\x77\xf2\x1b\x35\xa6\x0b\x48\xfc"
+	"\x47\x66\x99\x78\x02\x21\x00\xdc\x55\x4e\x07\x96\x0b\x81\xb6\x80"
+	"\xb1\xae\xe0\x40\xb9\x90\xa5\xf4\xc4\x90\x49\xbb\xa2\xa1\x62\x70"
+	"\xc5\x88\x51\x39\xe8\xa8\xfb",
+	.c_size = 71,
+	.public_key_vec = true,
+	},
 	{
 	.key = /* secp256r1(sha1) */
 	"\x04\xb9\x7b\xbb\xd7\x17\x64\xd2\x7e\xfc\x81\x5d\x87\x06\x83\x41"
@@ -1831,7 +1966,8 @@ static const struct sig_testvec p1363_ecdsa_nist_p256_tv_template[] = {
 };
 
 /*
- * EC-RDSA test vectors are generated by gost-engine.
+ * EC-RDSA test vectors generated by gost-engine, followed by constructed
+ * exceptional-point regression vectors.
  */
 static const struct sig_testvec ecrdsa_tv_template[] = {
 	{
@@ -1977,6 +2113,195 @@ static const struct sig_testvec ecrdsa_tv_template[] = {
 	.m_size = 64,
 	.public_key_vec = true,
 	},
+	/*
+	 * Constructed EC-RDSA exceptional-point vectors.
+	 * With Q = dG, choose k = z1 + d*z2 (mod n), r = x(kG) mod n,
+	 * e = -r/z2 (mod n), and s = r*d + k*e (mod n).
+	 * The input digest is e, encoded little-endian.
+	 */
+	/* cp256a: Q=G, z1 = 3, z2 = 1. */
+	{
+	.key =
+	"\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+	"\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+	"\x91\x8d",
+	.key_len = 66,
+	.params = /* OID_gostCPSignA */
+	"\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+	"\x07\x01\x01\x02\x02",
+	.param_len = 21,
+	.c =
+	"\x1a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x4a\xed\x44\xae\xd4\x49"
+	"\x32\x67\xe0\x26\x16\xfd\xb7\xaf\xa4\xd7\x3e\x61\xd4\xf9\x7b\x94"
+	"\xf7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7"
+	"\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe7\x06\x3e\x70\x63\xe4\xb7",
+	.c_size = 64,
+	.m =
+	"\xdc\xd3\xfd\x46\xcb\x14\x9d\xe1\x8f\x92\x54\xb2\x0c\xa0\x22\x66"
+	"\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x18\x9c\x8f\xc1\xf9\x08",
+	.m_size = 32,
+	.algo = OID_gost2012PKey256,
+	.public_key_vec = true,
+	},
+	/* cp256a: Q=-G, z1 = 7, z2 = 6. */
+	{
+	.key =
+	"\x04\x40\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x83\xdf\x60\x61\x63\x36\x53\xdd\x4e\x1c\xdc\x20\xd2\xb0"
+	"\xd6\xca\x89\xd4\xc0\xba\xa5\xaf\x20\xd8\x25\x63\x67\x1f\x8e\x1b"
+	"\x6e\x72",
+	.key_len = 66,
+	.params = /* OID_gostCPSignA */
+	"\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+	"\x07\x01\x01\x02\x02",
+	.param_len = 21,
+	.c =
+	"\x2a\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+	"\x92\x10\x2d\x68\x19\x8f\x22\xd5\x60\xeb\x59\xd6\xf3\xe5\x9e\xc2"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+	.c_size = 64,
+	.m =
+	"\xc3\x9e\xe5\xf3\xd6\x59\xeb\x60\xd5\x22\x8f\x19\x68\x2d\x10\x92"
+	"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x2a",
+	.m_size = 32,
+	.algo = OID_gost2012PKey256,
+	.public_key_vec = true,
+	},
+	/* cp256a: Q=-2G, z1 = 5, z2 = 2. */
+	{
+	.key =
+	"\x04\x40\x95\xfd\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\x14\x1e\x9f\x9e\x9c\xc9\xac\x22\xb1\xe3\x23\xdf\x2d\x4f"
+	"\x29\x35\x76\x2b\x3f\x45\x5a\x50\xdf\x27\xda\x9c\x98\xe0\x71\xe4"
+	"\x91\x8d",
+	.key_len = 66,
+	.params = /* OID_gostCPSignA */
+	"\x30\x13\x06\x07\x2a\x85\x03\x02\x02\x23\x01\x06\x08\x2a\x85\x03"
+	"\x07\x01\x01\x02\x02",
+	.param_len = 21,
+	.c =
+	"\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xb6\x30\x88\x38\x4c\xad\x68\x80\x22\xc2\x0d\x84\xdb\xb0\xdc\x47"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+	.c_size = 64,
+	.m =
+	"\x49\xdc\xb0\xdb\x84\x0d\xc2\x22\x80\x68\xad\x4c\x38\x88\x30\xb6"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+	.m_size = 32,
+	.algo = OID_gost2012PKey256,
+	.public_key_vec = true,
+	},
+	/* tc512a: Q=G, z1 = 3, z2 = 1. */
+	{
+	.key =
+	"\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\xa4\xf2\x15\x52\xcb\x89\xa5\x89\xb8\xf5\x35\xc2\x5f"
+	"\xfe\x28\x80\xe9\x41\x3a\x0e\xa5\xe6\x75\x3d\xe9\x36\xd0\x4f\xbe"
+	"\x26\x16\xdf\x21\xa9\xef\xcb\xfd\x64\x80\x77\xc1\xab\xf1\xac\x93"
+	"\x1c\x5e\xce\xe6\x50\x54\xe2\x16\x88\x1b\xa6\xe3\x6a\x83\x7a\xe8"
+	"\xcf\x03\x75",
+	.key_len = 131,
+	.params = /* OID_gostTC26Sign512A */
+	"\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+	.param_len = 13,
+	.c =
+	"\xd8\xc0\xd7\xe3\xfb\xa6\xca\xff\x6a\xd1\xb4\xb4\x82\x1d\x15\x6f"
+	"\xa7\xc7\xbd\x63\x95\xb8\x29\x0d\xd4\xfa\xb1\x1c\x36\xbd\x32\x8d"
+	"\x1a\xba\xf1\x2e\xbc\x7b\xf2\x02\x96\xf8\xef\x2a\x5e\x72\x64\x86"
+	"\x67\x62\xfb\x62\x8e\x83\x53\x63\xb7\xe6\x78\x3c\x42\xd7\x0d\x1d"
+	"\xb7\xbf\xb8\x09\x56\xc8\x67\x00\x31\xba\x19\x19\x29\xf6\x4e\x30"
+	"\x1d\x68\x16\x34\x23\x6d\x47\xa6\x0e\x57\x1a\x4b\xed\xc0\xef\x25"
+	"\x74\x52\xef\x78\xb5\xb9\x8d\xbb\x3d\x9f\x31\x29\xd9\x34\x94\x33"
+	"\xce\x2a\x3a\x35\xcb\x51\x9c\x91\xe2\xd6\x33\xd7\xb3\x73\xae\x16",
+	.c_size = 128,
+	.m =
+	"\x5f\x04\x9d\x6b\x69\x7d\xf7\xe7\xcb\x1b\x81\x2f\x76\xfe\x20\xcd"
+	"\x2c\xcc\xd0\x74\x63\xfa\x52\x32\x56\xfb\xd3\x3e\xba\xa5\x93\xb3"
+	"\xd9\x10\x3f\x12\xb4\xe5\xa8\xf1\x59\xb8\x92\xdc\xcb\xe9\x97\xe2"
+	"\xcf\xb1\x09\xd6\xe6\xe6\x45\xce\xff\x98\x37\xa9\xf6\x47\x40\x48",
+	.m_size = 64,
+	.algo = OID_gost2012PKey512,
+	.public_key_vec = true,
+	},
+	/* tc512a: Q=-G, z1 = 7, z2 = 6. */
+	{
+	.key =
+	"\x04\x81\x80\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x23\x0b\xea\xad\x34\x76\x5a\x76\x47\x0a\xca\x3d\xa0"
+	"\x01\xd7\x7f\x16\xbe\xc5\xf1\x5a\x19\x8a\xc2\x16\xc9\x2f\xb0\x41"
+	"\xd9\xe9\x20\xde\x56\x10\x34\x02\x9b\x7f\x88\x3e\x54\x0e\x53\x6c"
+	"\xe3\xa1\x31\x19\xaf\xab\x1d\xe9\x77\xe4\x59\x1c\x95\x7c\x85\x17"
+	"\x30\xfc\x8a",
+	.key_len = 131,
+	.params = /* OID_gostTC26Sign512A */
+	"\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+	.param_len = 13,
+	.c =
+	"\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+	"\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x37"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+	.c_size = 128,
+	.m =
+	"\x3a\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+	"\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+	.m_size = 64,
+	.algo = OID_gost2012PKey512,
+	.public_key_vec = true,
+	},
+	/* tc512a: Q=-2G, z1 = 5, z2 = 2. */
+	{
+	.key =
+	"\x04\x81\x80\x7c\x13\xea\xd2\xd9\xaf\x82\xb9\x1f\xb2\xfd\xe1\x8d"
+	"\xf4\x5b\x37\xe4\xf2\x04\x6a\x2a\x1d\x15\x16\x95\x2a\x5d\x40\xcd"
+	"\xbb\x34\x44\x2f\x2b\x13\x0a\x47\xb0\xf6\xe5\xa5\x58\x3a\xf4\x54"
+	"\x09\xb0\x1d\xf5\x5c\xf1\xbf\x9d\x86\xa5\x97\xab\x96\x29\x62\xfc"
+	"\xdc\x89\x3b\x76\x3d\x50\x6e\x8a\xcf\x02\x4c\x74\x0e\x6e\xe0\x1f"
+	"\x28\xab\x27\x9b\x20\x02\xc8\xc4\x12\xcb\x8a\xe3\xa4\x27\xce\x39"
+	"\x62\xdf\x35\x6d\xc1\x65\x7f\x7b\x48\x90\x11\x8f\x19\x7c\x1e\x67"
+	"\x91\x97\xeb\x90\x85\x25\xfc\x86\xb3\x88\x6e\x5c\x57\x1f\x1d\x1d"
+	"\x3b\xec\x37",
+	.key_len = 131,
+	.params = /* OID_gostTC26Sign512A */
+	"\x30\x0b\x06\x09\x2a\x85\x03\x07\x01\x02\x01\x02\x01",
+	.param_len = 13,
+	.c =
+	"\x7f\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\x93\xf3\x4a\x99\x7a\x46\xc4\x88\xb7\xf9\x15\xc6\xa7\x02\xb0\x30"
+	"\x4d\xa5\x9c\x55\xfd\x69\x5c\x2e\xe5\x66\xd8\xa0\x8f\x88\x59\x33"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
+	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03",
+	.c_size = 128,
+	.m =
+	"\x39\x59\x88\x8f\xa0\xd8\x66\xe5\x2e\x5c\x69\xfd\x55\x9c\xa5\x4d"
+	"\x30\xb0\x02\xa7\xc6\x15\xf9\xb7\x88\xc4\x46\x7a\x99\x4a\xf3\x93"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
+	"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f",
+	.m_size = 64,
+	.algo = OID_gost2012PKey512,
+	.public_key_vec = true,
+	},
 };
 
 /*

From 21b1af61dafd5e7c8583a38860babe768f5f5536 Mon Sep 17 00:00:00 2001
From: Fuad Tabba <fuad.tabba@linux.dev>
Date: Thu, 1 Oct 2026 14:56:55 +0100
Subject: [PATCH 1338/1982] KVM: arm64: Validate the host vCPU's VM before
 reading it under pKVM

[ Upstream commit cf533b4d3630b229d78ad55567c5db2f365052a2 ]

On an MTE-capable host under pKVM, enter_exception64() reads the VM's
MTE flag through vcpu->kvm, which for a host vCPU is a host-writable
pointer nothing validates. The host can point it at any address in the
hyp linear map and read back bit 1 of that word through PSR_TCO in the
vCPU's CPSR, or panic the hypervisor with an unmapped one.

Get the VM through a get/put pair around the read: a loaded vCPU's is
the hyp VM, an unloaded host vCPU's is read once and pinned, and a
pointer the host never shared leaves TCO clear.

Fixes: ea7fc1bb1cd1b ("KVM: arm64: Introduce MTE VM feature")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260914070536.877D91F000FF@smtp.kernel.org/
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261001135711.1640520-3-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/hyp/exception.c             |  5 ++-
 arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 28 ++++++++++++++++
 arch/arm64/kvm/hyp/include/nvhe/pkvm.h     |  2 ++
 arch/arm64/kvm/hyp/nvhe/pkvm.c             | 37 ++++++++++++++++++++++
 4 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/hyp/exception.c b/arch/arm64/kvm/hyp/exception.c
index bef40ddb16dbc2..c041142896e35f 100644
--- a/arch/arm64/kvm/hyp/exception.c
+++ b/arch/arm64/kvm/hyp/exception.c
@@ -86,6 +86,7 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
 			      enum exception_type type)
 {
 	unsigned long sctlr, vbar, old, new, mode;
+	struct kvm *kvm;
 	u64 exc_offset;
 
 	mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
@@ -125,8 +126,10 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
 	new |= (old & PSR_C_BIT);
 	new |= (old & PSR_V_BIT);
 
-	if (kvm_has_mte(kern_hyp_va(vcpu->kvm)))
+	kvm = vcpu_get_kvm(vcpu);
+	if (kvm && kvm_has_mte(kvm))
 		new |= PSR_TCO_BIT;
+	vcpu_put_kvm(vcpu, kvm);
 
 	new |= (old & PSR_DIT_BIT);
 
diff --git a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
index 4fdfeabefeb432..f55950ee2a7e43 100644
--- a/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
+++ b/arch/arm64/kvm/hyp/include/hyp/adjust_pc.h
@@ -13,6 +13,34 @@
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_host.h>
 
+#ifdef __KVM_NVHE_HYPERVISOR__
+#include <nvhe/pkvm.h>
+
+/* Under pKVM a host vCPU's ->kvm is host-writable. */
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+	if (is_protected_kvm_enabled())
+		return pkvm_vcpu_get_kvm(vcpu);
+
+	return kern_hyp_va(vcpu->kvm);
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+	if (is_protected_kvm_enabled())
+		pkvm_vcpu_put_kvm(vcpu, kvm);
+}
+#else
+static inline struct kvm *vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+	return vcpu->kvm;
+}
+
+static inline void vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+}
+#endif
+
 static inline void kvm_skip_instr(struct kvm_vcpu *vcpu)
 {
 	if (vcpu_mode_is_32bit(vcpu)) {
diff --git a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
index 184ad7a3995072..25b2f477bb5b2b 100644
--- a/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
+++ b/arch/arm64/kvm/hyp/include/nvhe/pkvm.h
@@ -79,6 +79,8 @@ struct pkvm_hyp_vcpu *pkvm_load_hyp_vcpu(pkvm_handle_t handle,
 					 unsigned int vcpu_idx);
 void pkvm_put_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu);
 struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void);
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu);
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm);
 
 struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle);
 struct pkvm_hyp_vm *get_np_pkvm_hyp_vm(pkvm_handle_t handle);
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index bf0250806a781c..136c4008b93639 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -306,6 +306,43 @@ struct pkvm_hyp_vcpu *pkvm_get_loaded_hyp_vcpu(void)
 
 }
 
+static struct pkvm_hyp_vm *pkvm_get_loaded_hyp_vm(struct kvm_vcpu *vcpu)
+{
+	struct pkvm_hyp_vcpu *hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
+
+	if (hyp_vcpu &&
+	    (vcpu == &hyp_vcpu->vcpu || vcpu == hyp_vcpu->host_vcpu))
+		return pkvm_hyp_vcpu_to_hyp_vm(hyp_vcpu);
+
+	return NULL;
+}
+
+/*
+ * A loaded vCPU's VM is the hyp VM. An unloaded host vCPU's is mapped at
+ * EL2 only while pinned, so it's read once and pinned; the pin fails for
+ * memory the host isn't sharing.
+ */
+struct kvm *pkvm_vcpu_get_kvm(struct kvm_vcpu *vcpu)
+{
+	struct pkvm_hyp_vm *hyp_vm = pkvm_get_loaded_hyp_vm(vcpu);
+	struct kvm *kvm;
+
+	if (hyp_vm)
+		return &hyp_vm->kvm;
+
+	kvm = kern_hyp_va(READ_ONCE(vcpu->kvm));
+	if (hyp_pin_shared_mem(kvm, kvm + 1))
+		return NULL;
+
+	return kvm;
+}
+
+void pkvm_vcpu_put_kvm(struct kvm_vcpu *vcpu, struct kvm *kvm)
+{
+	if (kvm && !pkvm_get_loaded_hyp_vm(vcpu))
+		hyp_unpin_shared_mem(kvm, kvm + 1);
+}
+
 struct pkvm_hyp_vm *get_pkvm_hyp_vm(pkvm_handle_t handle)
 {
 	struct pkvm_hyp_vm *hyp_vm;

From 8f8319e45493fe7af0e558d9026b5099650bcd09 Mon Sep 17 00:00:00 2001
From: Kim Phillips <kim.phillips@amd.com>
Date: Mon, 31 Aug 2026 16:09:16 -0500
Subject: [PATCH 1339/1982] x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n
 mitigation reporting

[ Upstream commit 1847c80537891baead3975f3ca969233ff7b2a11 ]

When the kernel lacks retpoline support, spectre_v2_select_retpoline()
emits

  "Kernel not compiled with retpoline; no mitigation available!"

before returning SPECTRE_V2_NONE to its callers.  SPECTRE_V2_NONE is not
the final answer, though: spectre_v2_update_mitigation() runs afterwards
and can still upgrade the mitigation.

On an Intel CPU affected by RETBleed, built with

  CONFIG_MITIGATION_IBRS_ENTRY=y and
  CONFIG_MITIGATION_RETPOLINE=n,

and booted with spectre_v2=auto, retbleed_select_mitigation() picks
RETBLEED_MITIGATION_IBRS, and spectre_v2_update_mitigation() then promotes
SPECTRE_V2_NONE to SPECTRE_V2_IBRS.  The boot log claims no mitigation is
available immediately before reporting

  "Spectre V2 : Mitigation: IBRS",

and sysfs reports the machine as mitigated.  The message is alarming and
simply wrong.

Drop "no mitigation available!" because the final mitigation state is printed
afterwards in spectre_v2_update_mitigation() anyway.

  [ bp: Drop CC:stable, massage commit message. ]

Fixes: 480e803dacf8 ("x86/bugs: Restructure spectre_v2 mitigation")
Suggested-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Link: https://patch.msgid.link/20260831210916.987152-1-kim.phillips@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/bugs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a39d97eee8bdb9..90d0488d54c5c7 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2103,7 +2103,7 @@ early_param("spectre_v2", spectre_v2_parse_cmdline);
 static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
 {
 	if (!IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)) {
-		pr_err("Kernel not compiled with retpoline; no mitigation available!");
+		pr_err("Kernel not compiled with retpoline");
 		return SPECTRE_V2_NONE;
 	}
 

From 94829b1235137abeec22e27018b0a4f86cea2cd2 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 31 Aug 2026 10:10:01 +0200
Subject: [PATCH 1340/1982] KVM: arm64: vgic-v3: Undo assignment on iodev
 registration failure

[ Upstream commit 8a88a46b86ca3dbbd24522760d29edfb3f24ac2a ]

vgic_register_redist_iodev() assigns a redistributor region and base
address to the vCPU before adding its iodev to the MMIO bus. However, the
region's free_index is advanced only after registration succeeds.

If kvm_io_bus_register_dev() fails, the vCPU retains the assignment while
free_index still identifies the same slot as free. A later registration can
therefore reuse a slot that remains assigned to the vCPU.

Reserve the slot before registering its iodev. The caller holds slots_lock,
so a registration failure cannot race with a later assignment. Undo the
reservation and clear the cached assignment on failure.

Fixes: dbd9733ab674 ("KVM: arm/arm64: Replace the single rdist region by a list")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20260831081005.41346-2-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 051d9bf73879c9..7d90e6fe076c35 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -818,16 +818,21 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
 	rd_dev->nr_regions = ARRAY_SIZE(vgic_v3_rd_registers);
 	rd_dev->redist_vcpu = vcpu;
 
+	/* Protected by slots_lock */
+	rdreg->free_index++;
+
 	mutex_unlock(&kvm->arch.config_lock);
 
 	ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, rd_base,
 				      2 * SZ_64K, &rd_dev->dev);
-	if (ret)
-		return ret;
+	if (ret) {
+		guard(mutex)(&vcpu->kvm->arch.config_lock);
+		vgic_cpu->rdreg->free_index--;
+		vgic_cpu->rdreg = NULL;
+		vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
+	}
 
-	/* Protected by slots_lock */
-	rdreg->free_index++;
-	return 0;
+	return ret;
 
 out_unlock:
 	mutex_unlock(&kvm->arch.config_lock);

From 513f62c104189eb6a9e028a21766df280f68a75d Mon Sep 17 00:00:00 2001
From: Alexey Klimov <alexey.klimov@linaro.org>
Date: Wed, 30 Sep 2026 00:50:31 +0100
Subject: [PATCH 1341/1982] soc: samsung: exynos-pmu: fix error paths in
 cpuhotplug/idle states setup

[ Upstream commit f7b2b6acf658be412b0c4746d07d210a9e18f13b ]

The setup_cpuhp_and_cpuidle() initialisation sequence currently ignores
the return values of cpuhp_setup_state(), cpu_pm_register_notifier(), and
register_reboot_notifier(). If any of these registrations fail during
probe() routine, the driver returns 0, leaving the driver partially
configured.

Furthermore, if anything after setup_cpuhp_and_cpuidle() fails in probe()
routine, for instance devm_mfd_add_devices(), the probe() lacks an error
path and leaves notifiers and cpu hotplug states registered.

Introduce variables for the cpu hotplug state IDs in exynos_pmu_context
struct, that should be initialised to CPUHP_INVALID by default. Check all
return codes in setup_cpuhp_and_cpuidle(), and add an error path to remove
registered states on failure. Finally, add destroy_cpuhp_and_cpuidle()
helper to safely tear down notifiers and cpu hotplug states.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Link: https://patch.msgid.link/20260930-exynos-pmu-cpuhp-idle-fixes-v3-1-4269d8425978@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/samsung/exynos-pmu.c | 61 +++++++++++++++++++++++++++-----
 1 file changed, 53 insertions(+), 8 deletions(-)

diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 0fcbc08633f6b7..748be7ff2affbb 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -47,6 +47,8 @@ struct exynos_pmu_context {
 	unsigned long *in_cpuhp;
 	bool sys_insuspend;
 	bool sys_inreboot;
+	int cpuhp_prepare_state;
+	int cpuhp_online_state;
 };
 
 void __iomem *pmu_base_addr;
@@ -589,16 +591,55 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
 		gs101_cpuhp_pmu_online(cpu);
 
 	/* register CPU hotplug callbacks */
-	cpuhp_setup_state(CPUHP_BP_PREPARE_DYN,	"soc/exynos-pmu:prepare",
-			  gs101_cpuhp_pmu_online, NULL);
+	pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+	pmu_context->cpuhp_online_state = CPUHP_INVALID;
 
-	cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
-			  NULL, gs101_cpuhp_pmu_offline);
+	ret = cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
+				gs101_cpuhp_pmu_online, NULL);
+	if (ret < 0)
+		return ret;
+
+	pmu_context->cpuhp_prepare_state = ret;
+
+	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
+				NULL, gs101_cpuhp_pmu_offline);
+	if (ret < 0)
+		goto clean_cpuhp_state_prepare;
+
+	pmu_context->cpuhp_online_state = ret;
 
 	/* register CPU PM notifiers for cpuidle */
-	cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
-	register_reboot_notifier(&exynos_cpupm_reboot_nb);
-	return 0;
+	ret = cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
+	if (ret)
+		goto clean_cpuhp_states;
+
+	ret = register_reboot_notifier(&exynos_cpupm_reboot_nb);
+	if (!ret)
+		/* Success */
+		return ret;
+
+	cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+
+clean_cpuhp_states:
+	cpuhp_remove_state(pmu_context->cpuhp_online_state);
+	pmu_context->cpuhp_online_state = CPUHP_INVALID;
+
+clean_cpuhp_state_prepare:
+	cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+	pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+
+	return ret;
+}
+
+static void destroy_cpuhp_and_cpuidle(void)
+{
+	cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+	unregister_reboot_notifier(&exynos_cpupm_reboot_nb);
+
+	if (pmu_context->cpuhp_prepare_state != CPUHP_INVALID)
+		cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+	if (pmu_context->cpuhp_online_state != CPUHP_INVALID)
+		cpuhp_remove_state(pmu_context->cpuhp_online_state);
 }
 
 static int exynos_pmu_probe(struct platform_device *pdev)
@@ -669,8 +710,12 @@ static int exynos_pmu_probe(struct platform_device *pdev)
 
 	ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, exynos_pmu_devs,
 				   ARRAY_SIZE(exynos_pmu_devs), NULL, 0, NULL);
-	if (ret)
+	if (ret) {
+		if (pmu_context->pmu_data && pmu_context->pmu_data->pmu_cpuhp)
+			destroy_cpuhp_and_cpuidle();
+
 		return ret;
+	}
 
 	if (devm_of_platform_populate(dev))
 		dev_err(dev, "Error populating children, reboot and poweroff might not work properly\n");

From 6d8da67c1c0e673b3e25efaa0d7bd97842edd40e Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 31 Aug 2026 10:10:02 +0200
Subject: [PATCH 1342/1982] KVM: arm64: vgic-v3: Roll back assignments from the
 new region

[ Upstream commit a32c01324eb494dda811912eb847b0e907cd7270 ]

A failed REDIST_REGION write unregisters the redistributor iodevs of every
vCPU processed before the failure. This includes vCPUs assigned to older
regions. Their assignments remain cached, so a retry does not register the
iodevs again.

The vCPU whose registration fails has no assignment to roll back. For vCPUs
processed earlier, limit rollback to those assigned to the new region. The
region is removed on failure, so its free_index does not need restoring.

Resetting assignments from older regions is unsafe because a vCPU can own
one before kvm_for_each_vcpu() can see it. Rollback could then move
free_index behind that live assignment.

kvm_vgic_addr() holds slots_lock across the REDIST_REGION write. vCPU
creation takes the same lock before assigning a redistributor. A concurrent
vCPU cannot acquire an assignment from the new region before rollback
completes. The lock also keeps rdreg valid across the config_lock drop
required by MMIO-bus registration.

Fixes: c011f4ea106b ("KVM: arm/arm64: Check vcpu redist base before registering an iodev")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260831081005.41346-3-kmehltretter@gmail.com
[maz: moved helper into the sole caller]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/vgic/vgic-mmio-v3.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 7d90e6fe076c35..79e018cec0f964 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -846,7 +846,8 @@ void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
 	kvm_io_bus_unregister_dev(vcpu->kvm, KVM_MMIO_BUS, &rd_dev->dev);
 }
 
-static int vgic_register_all_redist_iodevs(struct kvm *kvm)
+static int vgic_register_all_redist_iodevs(struct kvm *kvm,
+					   struct vgic_redist_region *rdreg)
 {
 	struct kvm_vcpu *vcpu;
 	unsigned long c;
@@ -866,7 +867,14 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
 
 		for (i = 0; i < c; i++) {
 			vcpu = kvm_get_vcpu(kvm, i);
+			if (vcpu->arch.vgic_cpu.rdreg != rdreg)
+				continue;
+
 			vgic_unregister_redist_iodev(vcpu);
+
+			guard(mutex)(&vcpu->kvm->arch.config_lock);
+			vcpu->arch.vgic_cpu.rdreg = NULL;
+			vcpu->arch.vgic_cpu.rd_iodev.base_addr = VGIC_ADDR_UNDEF;
 		}
 	}
 
@@ -975,10 +983,13 @@ void vgic_v3_free_redist_region(struct kvm *kvm, struct vgic_redist_region *rdre
 
 int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
 {
+	struct vgic_redist_region *rdreg;
 	int ret;
 
 	mutex_lock(&kvm->arch.config_lock);
 	ret = vgic_v3_alloc_redist_region(kvm, index, addr, count);
+	if (!ret)
+		rdreg = vgic_v3_rdist_region_from_index(kvm, index);
 	mutex_unlock(&kvm->arch.config_lock);
 	if (ret)
 		return ret;
@@ -987,12 +998,9 @@ int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
 	 * Register iodevs for each existing VCPU.  Adding more VCPUs
 	 * afterwards will register the iodevs when needed.
 	 */
-	ret = vgic_register_all_redist_iodevs(kvm);
+	ret = vgic_register_all_redist_iodevs(kvm, rdreg);
 	if (ret) {
-		struct vgic_redist_region *rdreg;
-
 		mutex_lock(&kvm->arch.config_lock);
-		rdreg = vgic_v3_rdist_region_from_index(kvm, index);
 		vgic_v3_free_redist_region(kvm, rdreg);
 		mutex_unlock(&kvm->arch.config_lock);
 		return ret;

From 22f5872567c51b8e7522a47a8a24bdaac6705672 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <thorsten.blum@linux.dev>
Date: Mon, 26 Jan 2026 10:49:27 +0100
Subject: [PATCH 1343/1982] media: imagination: Fix value clamping in
 calculate_qp_tables

[ Upstream commit c8454a41da59d51fbcc5743f8c71a03b096a770f ]

The local variable 'val' was never clamped to 1 or 255 because the
return value of clamp() was not used. Fix this by assigning the clamped
value back to 'val'.

Cc: stable@vger.kernel.org
Fixes: a1e294045885 ("media: imagination: Add E5010 JPEG Encoder driver")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/imagination/e5010-jpeg-enc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/imagination/e5010-jpeg-enc.c b/drivers/media/platform/imagination/e5010-jpeg-enc.c
index c4e0097cb8b7fa..a36a2acc896c9e 100644
--- a/drivers/media/platform/imagination/e5010-jpeg-enc.c
+++ b/drivers/media/platform/imagination/e5010-jpeg-enc.c
@@ -175,12 +175,12 @@ static void calculate_qp_tables(struct e5010_context *ctx)
 		long long delta = v4l2_jpeg_ref_table_chroma_qt[i] * contrast + luminosity;
 		int val = (int)(v4l2_jpeg_ref_table_chroma_qt[i] + delta);
 
-		clamp(val, 1, 255);
+		val = clamp(val, 1, 255);
 		ctx->chroma_qp[i] = quality == -50 ? 1 : val;
 
 		delta = v4l2_jpeg_ref_table_luma_qt[i] * contrast + luminosity;
 		val = (int)(v4l2_jpeg_ref_table_luma_qt[i] + delta);
-		clamp(val, 1, 255);
+		val = clamp(val, 1, 255);
 		ctx->luma_qp[i] = quality == -50 ? 1 : val;
 	}
 

From aaa44163b04f024a98123a66b4555652e8bfd2fb Mon Sep 17 00:00:00 2001
From: Nas Chung <nas.chung@chipsnmedia.com>
Date: Fri, 4 Sep 2026 15:46:27 +0900
Subject: [PATCH 1344/1982] media: v4l2-common: Fix P010 format info

[ Upstream commit 8761a87aff8259eab0add8a9428cee2c280fb6eb ]

V4L2_PIX_FMT_P010 is a 10-bit 4:2:0 semi-planar format, but its
v4l2_format_info() entry described a 4:2:2 layout with a half-width
chroma plane. Correct bpp and vdiv to match P010's real layout,
consistent with the other semi-planar formats.

Cc: stable@vger.kernel.org
Fixes: 5374d8fb75f3 ("media: Add P010 video format")
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c
index 524c11e92aec54..0ca98df9e60b54 100644
--- a/drivers/media/v4l2-core/v4l2-common.c
+++ b/drivers/media/v4l2-core/v4l2-common.c
@@ -296,7 +296,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format)
 		{ .format = V4L2_PIX_FMT_NV20,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 5, 10, 0, 0 }, .bpp_div = { 4, 4, 1, 1 }, .hdiv = 2, .vdiv = 1 },
 		{ .format = V4L2_PIX_FMT_NV24,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
 		{ .format = V4L2_PIX_FMT_NV42,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 1, .vdiv = 1 },
-		{ .format = V4L2_PIX_FMT_P010,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 2, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 1 },
+		{ .format = V4L2_PIX_FMT_P010,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
 		{ .format = V4L2_PIX_FMT_P012,    .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 2, .vdiv = 2 },
 
 		{ .format = V4L2_PIX_FMT_YUV410,  .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 3, .bpp = { 1, 1, 1, 0 }, .bpp_div = { 1, 1, 1, 1 }, .hdiv = 4, .vdiv = 4 },

From 11b788b55f9248794f556c46ad6ff9a0246a9b4d Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 1 Jul 2026 23:06:10 +0800
Subject: [PATCH 1345/1982] media: sti: delta: use unaligned accessors for
 MJPEG SOF fields

[ Upstream commit fdc5bf02aeaef04e7d13895db9b6eaf8083953f9 ]

delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by
byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof().
The SOF parser then reads 16-bit big-endian fields directly from that
byte stream.

The SOF payload is not an aligned object. The marker scan can find the
payload at any byte position, and the SOF layout also puts frame_height
and frame_width after a one-byte sample_precision field. Those fields
therefore sit at odd offsets within the payload even when the payload
base happens to be 2-byte aligned.

Avoid casting the byte stream to __be16 pointers and use
get_unaligned_be16() for the SOF length, height, and width fields.

This issue was detected by our static analysis tool and confirmed by
manual audit. A focused UBSAN alignment validation of the same typed
load shape reported a misaligned __be16 access in delta_mjpeg_read_sof().

Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
index 90e5b2f72c82b6..849a5e118aec4d 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
@@ -4,6 +4,7 @@
  * Author: Hugues Fruchet <hugues.fruchet@st.com> for STMicroelectronics.
  */
 
+#include <linux/unaligned.h>
 #include "delta.h"
 #include "delta-mjpeg.h"
 
@@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx,
 		goto err_no_more;
 
 	memset(header, 0, sizeof(*header));
-	header->length           = be16_to_cpu(*(__be16 *)(data + offset));
+	header->length           = get_unaligned_be16(data + offset);
 	offset += sizeof(u16);
 	header->sample_precision = *(u8 *)(data + offset);
 	offset += sizeof(u8);
-	header->frame_height     = be16_to_cpu(*(__be16 *)(data + offset));
+	header->frame_height     = get_unaligned_be16(data + offset);
 	offset += sizeof(u16);
-	header->frame_width      = be16_to_cpu(*(__be16 *)(data + offset));
+	header->frame_width      = get_unaligned_be16(data + offset);
 	offset += sizeof(u16);
 	header->nb_of_components = *(u8 *)(data + offset);
 	offset += sizeof(u8);

From b683d0501f8b74f705d776c0b6551a7d8f24f381 Mon Sep 17 00:00:00 2001
From: Linmao Li <lilinmao@kylinos.cn>
Date: Fri, 17 Jul 2026 15:13:15 +0800
Subject: [PATCH 1346/1982] media: chips-media: wave5: Handle polling IRQ
 thread failure

[ Upstream commit 1d563e3d718a1c7c16355843374fbdd4c798ac66 ]

When falling back to polling mode, wave5_vpu_probe() does not check the
return value of kthread_run().  On failure, dev->irq_thread holds an
error pointer instead of a valid task pointer.

Both the probe error path and the remove path only check
dev->irq_thread against NULL before calling kthread_stop() on it, so an
error pointer passes the check and kthread_stop() crashes on it.

Check the kthread_run() result, clear dev->irq_thread and unwind the
probe on failure.

Fixes: e66ff2b08e4e ("media: chips-media: wave5: Fix Null reference while testing fluster")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 3216b499764473..6fa2ff1cbf128d 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -340,6 +340,13 @@ static int wave5_vpu_probe(struct platform_device *pdev)
 		dev_err(&pdev->dev, "failed to get irq resource, falling back to polling\n");
 		sema_init(&dev->irq_sem, 1);
 		dev->irq_thread = kthread_run(irq_thread, dev, "irq thread");
+		if (IS_ERR(dev->irq_thread)) {
+			ret = PTR_ERR(dev->irq_thread);
+			dev_err(&pdev->dev, "failed to create irq thread\n");
+			dev->irq_thread = NULL;
+			goto err_vdi_release;
+		}
+
 		hrtimer_setup(&dev->hrtimer, &wave5_vpu_timer_callback, CLOCK_MONOTONIC,
 			      HRTIMER_MODE_REL_PINNED);
 		dev->worker = kthread_run_worker(0, "vpu_irq_thread");

From df569382cf48e3de2aae00d2d6a0c47a06695b51 Mon Sep 17 00:00:00 2001
From: Linmao Li <lilinmao@kylinos.cn>
Date: Fri, 17 Jul 2026 15:57:14 +0800
Subject: [PATCH 1347/1982] media: chips-media: wave5: Balance runtime PM on
 encoder close errors

[ Upstream commit 4009daa5d9a72a67dd497bb4546632b2506a3650 ]

wave5_vpu_enc_close() resumes the device before taking the hardware lock.
Its three error paths call pm_runtime_resume_and_get() again instead of
dropping that reference.  Each failure therefore increments the runtime PM
usage count twice and can prevent the device from suspending afterward.

Replace the extra resume calls with pm_runtime_put_sync() to balance the
reference acquired on entry, matching the successful close path.  This
aligns wave5_vpu_enc_close() with wave5_vpu_dec_close(), which already
releases the reference on its error paths.

Fixes: 2092b3833487 ("media: chips-media: wave5: Support runtime suspend/resume")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/chips-media/wave5/wave5-vpuapi.c     | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
index e7ea2f6a99d5b4..c76d657cf8631f 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
@@ -729,7 +729,7 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
 
 	ret = mutex_lock_interruptible(&vpu_dev->hw_lock);
 	if (ret) {
-		pm_runtime_resume_and_get(inst->dev->dev);
+		pm_runtime_put_sync(inst->dev->dev);
 		return ret;
 	}
 
@@ -737,16 +737,13 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
 		ret = wave5_vpu_enc_finish_seq(inst, fail_res);
 		if (ret < 0 && *fail_res != WAVE5_SYSERR_VPU_STILL_RUNNING) {
 			dev_warn(inst->dev->dev, "enc_finish_seq timed out\n");
-			pm_runtime_resume_and_get(inst->dev->dev);
-			mutex_unlock(&vpu_dev->hw_lock);
-			return ret;
+			goto unlock_and_return;
 		}
 
 		if (*fail_res == WAVE5_SYSERR_VPU_STILL_RUNNING &&
 		    retry++ >= MAX_FIRMWARE_CALL_RETRY) {
-			pm_runtime_resume_and_get(inst->dev->dev);
-			mutex_unlock(&vpu_dev->hw_lock);
-			return -ETIMEDOUT;
+			ret = -ETIMEDOUT;
+			goto unlock_and_return;
 		}
 	} while (ret != 0);
 
@@ -762,10 +759,12 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
 	}
 
 	wave5_vdi_free_dma_memory(vpu_dev, &p_enc_info->vb_task);
+
+unlock_and_return:
 	mutex_unlock(&vpu_dev->hw_lock);
 	pm_runtime_put_sync(inst->dev->dev);
 
-	return 0;
+	return ret;
 }
 
 int wave5_vpu_enc_register_frame_buffer(struct vpu_instance *inst, unsigned int num,

From bdc3f5859be5a2bf8862ca175708762b74fece08 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Sat, 18 Jul 2026 21:00:36 +0800
Subject: [PATCH 1348/1982] media: chips-media: wave5: Check decoder qbuf
 runtime resume

[ Upstream commit 158b39a0f7d198454a1fb34dcca5c25de588d54f ]

wave5_vpu_dec_buf_queue_dst() resumes the VPU before it may clear a
decoder display flag. This is needed because clearing the display flag
accesses VPU registers.

However, the return value from pm_runtime_resume_and_get() is ignored.
If the resume fails, pm_runtime_resume_and_get() returns without holding
a runtime PM usage reference. The unconditional
pm_runtime_put_autosuspend() at the end of the function then drops an
unmatched reference.

The failed resume path can also continue into
wave5_vpu_dec_clr_disp_flag() while the device is still suspended.

Check the return value. If the resume fails, complete the queued buffer
with an error and return without touching the hardware or dropping an
unmatched runtime PM reference.

Fixes: cbb9c0d50e47 ("media: chips-media: wave5: Fix SError of kernel panic when closed")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index e1ad685a42e52b..6f93fdf28ab3a2 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1261,8 +1261,14 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
 	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
 	struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
 	struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
+	int ret;
+
+	ret = pm_runtime_resume_and_get(inst->dev->dev);
+	if (ret < 0) {
+		vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
+		return;
+	}
 
-	pm_runtime_resume_and_get(inst->dev->dev);
 	vbuf->sequence = inst->queued_dst_buf_num++;
 
 	if (inst->state == VPU_INST_STATE_PIC_RUN) {

From b186accb1d7d8f9aa7b5183d7eb9ff26ac568ce3 Mon Sep 17 00:00:00 2001
From: Michael Freidkin <freidkin@gmail.com>
Date: Mon, 28 Sep 2026 19:50:45 +0300
Subject: [PATCH 1349/1982] media: meson: vdec: size capture planes from the
 aligned canvas

[ Upstream commit b3a805dd5a83ba8c85e2085d3411eb9975e0aea4 ]

The decoder writes a whole canvas of ALIGN(width, 32) x ALIGN(height, 32)
(amvdec_set_canvases()) and reports bytesperline = ALIGN(width, 32), but
get_output_size() derives sizeimage from the raw width x height.

When the width is not a multiple of 32 the planes are too small for the
advertised stride: for 720x360 NV12M the luma plane is 262144 bytes while
736 * 360 = 264960 are needed (282624 for the canvas the firmware fills).
The decoder writes past the buffer, and importing the capture dma-buf
into DRM fails: drmModeAddFB2() returns -EINVAL, so e.g. Kodi plays the
sound over a black screen. 1280x720 and 1920x1080 are not affected.

Size the planes from the aligned canvas the hardware actually uses.

Tested on an S905X (GXL p212) board with LibreELEC 12 (6.16.0-rc3):
720x360 and 1920x1080 H.264 play through V4L2 m2m + DRM PRIME with no
AddFB2 errors.

Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Freidkin <freidkin@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/meson/vdec/vdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index ccb71de22b0a9f..49df5c6398b5c7 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -34,7 +34,7 @@ struct dummy_buf {
 
 static u32 get_output_size(u32 width, u32 height)
 {
-	return ALIGN(width * height, SZ_64K);
+	return ALIGN(ALIGN(width, 32) * ALIGN(height, 32), SZ_64K);
 }
 
 u32 amvdec_get_output_size(struct amvdec_session *sess)

From 4fc56ebae1e1f58f2e49a736e67dc7b0944f796c Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 25 Sep 2026 15:17:05 -0400
Subject: [PATCH 1350/1982] media: amphion: drain message work before releasing
 core state

[ Upstream commit ec95ae226f240ed657834fe4114abb7067e1af2d ]

vpu_core_unregister() frees core->msg_buffer before cancelling the message
workers, although core->msg_fifo still uses the buffer as its backing
storage. A queued worker can read it after it has been freed.

Drain the core and instance message work first, then release core->vpu
and the FIFO buffer. This follows the ordering in vpu_core_suspend().

Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/amphion/vpu_core.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index da00f5fc0e5da1..0501c2383ccf70 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -302,22 +302,23 @@ static void vpu_core_put_vpu(struct vpu_core *core)
 	core->vpu->put_vpu(core->vpu);
 }
 
+static void vpu_core_cancel_work(struct vpu_core *core);
+
 static int vpu_core_unregister(struct device *dev, struct vpu_core *core)
 {
 	list_del_init(&core->list);
 
-	vpu_core_put_vpu(core);
-	core->vpu = NULL;
-	vfree(core->msg_buffer);
-	core->msg_buffer = NULL;
-
 	if (core->workqueue) {
-		cancel_work_sync(&core->msg_work);
-		cancel_delayed_work_sync(&core->msg_delayed_work);
+		vpu_core_cancel_work(core);
 		destroy_workqueue(core->workqueue);
 		core->workqueue = NULL;
 	}
 
+	vpu_core_put_vpu(core);
+	core->vpu = NULL;
+	vfree(core->msg_buffer);
+	core->msg_buffer = NULL;
+
 	return 0;
 }
 

From eb0a592ae6629ced47a52b3bb8b03f17f7b66103 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 25 Sep 2026 15:17:06 -0400
Subject: [PATCH 1351/1982] media: amphion: prevent unbind while video
 instances are open

[ Upstream commit 96ea6bc6835f1b18b75303d536a7f9a3829c9bc1 ]

An open video instance holds a plain pointer to its devm-allocated core.
Unbinding the core or its parent through sysfs can release that memory
while the instance remains open. A later ioctl or close then uses the
stale pointer.

The video file operations pin the module, but sysfs unbind bypasses that
protection. Suppress manual bind and unbind for both platform drivers,
and warn if core removal ever encounters a live instance.

Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/amphion/vpu_core.c | 3 +++
 drivers/media/platform/amphion/vpu_drv.c  | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 0501c2383ccf70..56f6888f101cba 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -719,6 +719,8 @@ static void vpu_core_remove(struct platform_device *pdev)
 	struct vpu_core *core = platform_get_drvdata(pdev);
 	int ret;
 
+	WARN_ON(!list_empty(&core->instances));
+
 	vpu_core_remove_dbgfs_file(core);
 	ret = pm_runtime_resume_and_get(dev);
 	WARN_ON(ret < 0);
@@ -869,6 +871,7 @@ static struct platform_driver amphion_vpu_core_driver = {
 	.remove = vpu_core_remove,
 	.driver = {
 		.name = "amphion-vpu-core",
+		.suppress_bind_attrs = true,
 		.of_match_table = vpu_core_dt_match,
 		.pm = &vpu_core_pm_ops,
 	},
diff --git a/drivers/media/platform/amphion/vpu_drv.c b/drivers/media/platform/amphion/vpu_drv.c
index efbfd2652721f0..67d48c338fd118 100644
--- a/drivers/media/platform/amphion/vpu_drv.c
+++ b/drivers/media/platform/amphion/vpu_drv.c
@@ -230,6 +230,7 @@ static struct platform_driver amphion_vpu_driver = {
 	.remove = vpu_remove,
 	.driver = {
 		.name = "amphion-vpu",
+		.suppress_bind_attrs = true,
 		.of_match_table = vpu_dt_match,
 		.pm = &vpu_pm_ops,
 	},

From bf8913279f3ea5901ca6ca7e25d24adf7ce49de5 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Wed, 23 Sep 2026 08:59:21 +0000
Subject: [PATCH 1352/1982] media: mediatek: vpu: free IRQ before destroying
 watchdog workqueue

[ Upstream commit 2c50b58d4105f6dbaa36d6306087954b9100e9ae ]

mtk_vpu_remove() destroys the watchdog workqueue while the interrupt
handler requested with devm_request_irq() is still registered: the
devres core frees the interrupt only after remove() has returned. If
the VPU watchdog fires in that window, vpu_irq_handler() queues
vpu->wdt.ws on the already destroyed vpu->wdt.wq.

Fix this by calling devm_free_irq() before destroy_workqueue(), which
releases the interrupt and waits for a running handler, so no new work
can be queued while the workqueue is drained and freed.

This issue was found by an in-house static analysis tool.

Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index 8d8319f0cd2219..b6bd80b6844591 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -962,6 +962,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
 #ifdef CONFIG_DEBUG_FS
 	debugfs_remove(vpu_debugfs);
 #endif
+	devm_free_irq(&pdev->dev, vpu->reg.irq, vpu);
 	if (vpu->wdt.wq)
 		destroy_workqueue(vpu->wdt.wq);
 	vpu_free_ext_mem(vpu, P_FW);

From 5a603c6e1a8736c7a17e6dd718c0123df6f741e2 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:07:21 +0000
Subject: [PATCH 1353/1982] media: platform: mtk-mdp3: Fix device reference
 leak in mdp_comp_init()

[ Upstream commit ff3308afa9c9da0ef9113cb80803588adabef902 ]

mdp_comp_init() takes a reference to the component platform device
with of_find_device_by_node(), but the error path taken when the
clock array cannot be allocated and the one taken for a component
without a GCE EOF event return without dropping it.  The caller
frees the mdp_comp in those cases, so the reference is leaked.

Release the reference on both error paths.

Fixes: c4320f9721fd ("media: platform: mtk-mdp3: dynamically allocate component clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/mediatek/mdp3/mtk-mdp3-comp.c   | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
index 7fcb2fbdd64eea..acb2758a7b42df 100644
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
@@ -1730,6 +1730,7 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
 	struct device *dev = &mdp->pdev->dev;
 	struct platform_device *pdev_c;
 	int clk_ofst;
+	int ret;
 	int i;
 	s32 event;
 
@@ -1756,8 +1757,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
 	comp->clk_num = mdp->mdp_data->comp_data[id].info.clk_num;
 	comp->clks = devm_kzalloc(dev, sizeof(struct clk *) * comp->clk_num,
 				  GFP_KERNEL);
-	if (!comp->clks)
-		return -ENOMEM;
+	if (!comp->clks) {
+		ret = -ENOMEM;
+		goto err_put_device;
+	}
 
 	clk_ofst = mdp->mdp_data->comp_data[id].info.clk_ofst;
 
@@ -1782,7 +1785,8 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
 		if (of_property_read_u32_index(node, "mediatek,gce-events",
 					       MDP_GCE_EVENT_EOF, &event)) {
 			dev_err(dev, "Component id %d has no EOF\n", id);
-			return -EINVAL;
+			ret = -EINVAL;
+			goto err_put_device;
 		}
 	} else {
 		event = MDP_GCE_NO_EVENT;
@@ -1791,6 +1795,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
 	comp->gce_event[MDP_GCE_EVENT_EOF] = event;
 
 	return 0;
+
+err_put_device:
+	put_device(&pdev_c->dev);
+	return ret;
 }
 
 static void mdp_comp_deinit(struct mdp_comp *comp)

From a210840ed70921f04e7c74074950a3da1bbc5e2f Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:02:47 +0000
Subject: [PATCH 1354/1982] media: mtk-jpeg: Fix runtime PM leak in
 mtk_jpegdec_worker()

[ Upstream commit befd4506174addc5e85641b4ef304c9247b48c55 ]

pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails.  mtk_jpegdec_worker() jumps to
dec_end on that failure, which does not call pm_runtime_put(), so
the reference taken by the failed resume is leaked.

Use pm_runtime_resume_and_get() instead, which drops the reference
again when resuming the device fails.

Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index 5a9ba04d3d4800..fa47d2fb94aa00 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1740,7 +1740,7 @@ static void mtk_jpegdec_worker(struct work_struct *work)
 	jpeg_dst_buf->frame_num = ctx->total_frame_num;
 
 	mtk_jpegdec_set_hw_param(ctx, hw_id, src_buf, dst_buf);
-	ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+	ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
 	if (ret < 0) {
 		dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
 			__func__, __LINE__);

From f3cef7132743d49e831cccfb9990bf9dbc4becc3 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 10:04:37 +0000
Subject: [PATCH 1355/1982] media: mtk-jpeg: Fix runtime PM leak in
 mtk_jpegenc_worker()

[ Upstream commit 7ec8fd17f3a8059dcf94101065a35d0136031794 ]

pm_runtime_get_sync() leaves the device's runtime PM usage count
incremented even when it fails, and a failed clk_prepare_enable()
drops the reference as well.  mtk_jpegenc_worker() jumps to enc_end
in both cases, which does not call pm_runtime_put(), so the
reference taken by the successful resume is leaked.

Use pm_runtime_resume_and_get() for the resume failure and release
the reference explicitly when the clock cannot be enabled, as
mtk_jpegdec_worker() already does.

Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index fa47d2fb94aa00..0e2bb13f071afe 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1630,7 +1630,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
 	v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
 
 	mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
-	ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+	ret = pm_runtime_resume_and_get(comp_jpeg[hw_id]->dev);
 	if (ret < 0) {
 		dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
 			__func__, __LINE__);
@@ -1641,6 +1641,7 @@ static void mtk_jpegenc_worker(struct work_struct *work)
 	if (ret) {
 		dev_err(jpeg->dev, "%s : %d, jpegenc clk_prepare_enable fail\n",
 			__func__, __LINE__);
+		pm_runtime_put(comp_jpeg[hw_id]->dev);
 		goto enc_end;
 	}
 

From 2ebeb7f74276b0ef18cd8d096b645f80193a35fa Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 19:57:53 +0800
Subject: [PATCH 1356/1982] media: mediatek: vcodec: destroy core workqueue on
 remove

[ Upstream commit ceb6e96122e1013550f378c738e621a6e82d246b ]

The decoder probe allocates core_workqueue for architectures with a
LAT processor. The probe failure paths destroy the workqueues, but the
remove() function only destroys decode_workqueue.

As a result, removing a decoder on LAT architectures leaves core_workqueue
allocated after the device lifetime has ended.

Destroy core_workqueue during remove for latency-based decoder
architectures, matching the cleanup performed by the probe failure
paths.

This issue was found by manual code inspection.

Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
index 3b81fae9f9135c..7fec6b21684f27 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -570,6 +570,8 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
 	struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
 
 	destroy_workqueue(dev->decode_workqueue);
+	if (IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch))
+		destroy_workqueue(dev->core_workqueue);
 
 	if (media_devnode_is_registered(dev->mdev_dec.devnode)) {
 		media_device_unregister(&dev->mdev_dec);

From 7251a4a129f3aa3d1cd1264ece2908ad7fc9b06c Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Tue, 15 Sep 2026 20:10:25 +0800
Subject: [PATCH 1357/1982] media: mediatek: vpu: release reserved memory on
 remove

[ Upstream commit 8af0e2bdd9791848d9caf3761825ac51a67c2b9c ]

mtk_vpu_probe() may assign a reserved memory region to the VPU device
with of_reserved_mem_device_init(). The probe failure path releases the
assignment with of_reserved_mem_device_release(), but the normal remove
path does not perform the corresponding cleanup.

As a result, removing the VPU driver after a successful probe can leave
the reserved memory assignment associated with the device after its
lifetime has ended.

Release the reserved memory assignment after freeing the VPU external
firmware memory, matching the cleanup performed by the probe failure
path.

This issue was found by manual code inspection.

Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
index b6bd80b6844591..9dff1d971d37cb 100644
--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
@@ -967,6 +967,7 @@ static void mtk_vpu_remove(struct platform_device *pdev)
 		destroy_workqueue(vpu->wdt.wq);
 	vpu_free_ext_mem(vpu, P_FW);
 	vpu_free_ext_mem(vpu, D_FW);
+	of_reserved_mem_device_release(&pdev->dev);
 	mutex_destroy(&vpu->vpu_mutex);
 	clk_unprepare(vpu->clk);
 }

From 1c1507214f15d0047d248e0e8207595546f676c6 Mon Sep 17 00:00:00 2001
From: Michail Tatas <michail.tatas@gmail.com>
Date: Wed, 19 Aug 2026 12:28:12 +0300
Subject: [PATCH 1358/1982] media: verisilicon: rockchip: Fix leaks in init

[ Upstream commit 96f6b5e2295996a9e2dd1e2382d3872f98cbb554 ]

If one of the dma_alloc_coherent in the init function fails then
the previously allocated ones leak.

Fix by freeing them in the error path.

Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../verisilicon/rockchip_vpu981_hw_av1_dec.c  | 68 +++++++++++++++----
 1 file changed, 55 insertions(+), 13 deletions(-)

diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index 00aa566a4ccdba..2a145433e6d171 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -369,6 +369,7 @@ void rockchip_vpu981_av1_dec_exit(struct hantro_ctx *ctx)
 
 int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
 {
+	int ret = 0;
 	struct hantro_dev *vpu = ctx->dev;
 	struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
 
@@ -377,39 +378,54 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
 	av1_dec->global_model.cpu = dma_alloc_coherent(vpu->dev, GLOBAL_MODEL_SIZE,
 						       &av1_dec->global_model.dma,
 						       GFP_KERNEL);
-	if (!av1_dec->global_model.cpu)
-		return -ENOMEM;
+	if (!av1_dec->global_model.cpu) {
+		ret = -ENOMEM;
+		goto global_model_cpu_err;
+	}
+
 	av1_dec->global_model.size = GLOBAL_MODEL_SIZE;
 
 	av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE,
 						    &av1_dec->tile_info.dma,
 						    GFP_KERNEL);
-	if (!av1_dec->tile_info.cpu)
-		return -ENOMEM;
+	if (!av1_dec->tile_info.cpu) {
+		ret = -ENOMEM;
+		goto tile_info_cpu_err;
+	}
+
 	av1_dec->tile_info.size = AV1_TILE_INFO_SIZE;
 
 	av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev,
 						     ALIGN(sizeof(struct rockchip_av1_film_grain), 2048),
 						     &av1_dec->film_grain.dma,
 						     GFP_KERNEL);
-	if (!av1_dec->film_grain.cpu)
-		return -ENOMEM;
+	if (!av1_dec->film_grain.cpu) {
+		ret = -ENOMEM;
+		goto film_grain_cpu_err;
+	}
+
 	av1_dec->film_grain.size = ALIGN(sizeof(struct rockchip_av1_film_grain), 2048);
 
 	av1_dec->prob_tbl.cpu = dma_alloc_coherent(vpu->dev,
 						   ALIGN(sizeof(struct av1cdfs), 2048),
 						   &av1_dec->prob_tbl.dma,
 						   GFP_KERNEL);
-	if (!av1_dec->prob_tbl.cpu)
-		return -ENOMEM;
+	if (!av1_dec->prob_tbl.cpu) {
+		ret = -ENOMEM;
+		goto prob_tbl_cpu_err;
+	}
+
 	av1_dec->prob_tbl.size = ALIGN(sizeof(struct av1cdfs), 2048);
 
 	av1_dec->prob_tbl_out.cpu = dma_alloc_coherent(vpu->dev,
 						       ALIGN(sizeof(struct av1cdfs), 2048),
 						       &av1_dec->prob_tbl_out.dma,
 						       GFP_KERNEL);
-	if (!av1_dec->prob_tbl_out.cpu)
-		return -ENOMEM;
+	if (!av1_dec->prob_tbl_out.cpu) {
+		ret = -ENOMEM;
+		goto prob_tbl_out_cpu_err;
+	}
+
 	av1_dec->prob_tbl_out.size = ALIGN(sizeof(struct av1cdfs), 2048);
 	av1_dec->cdfs = &av1_dec->default_cdfs;
 	av1_dec->cdfs_ndvc = &av1_dec->default_cdfs_ndvc;
@@ -420,11 +436,37 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
 						   AV1_TILE_SIZE,
 						   &av1_dec->tile_buf.dma,
 						   GFP_KERNEL);
-	if (!av1_dec->tile_buf.cpu)
-		return -ENOMEM;
+	if (!av1_dec->tile_buf.cpu) {
+		ret = -ENOMEM;
+		goto tile_buf_cpu_err;
+	}
+
 	av1_dec->tile_buf.size = AV1_TILE_SIZE;
 
-	return 0;
+	return ret;
+
+tile_buf_cpu_err:
+	dma_free_coherent(vpu->dev, av1_dec->prob_tbl_out.size,
+			  av1_dec->prob_tbl_out.cpu,
+			  av1_dec->prob_tbl_out.dma);
+prob_tbl_out_cpu_err:
+	dma_free_coherent(vpu->dev, av1_dec->prob_tbl.size,
+			  av1_dec->prob_tbl.cpu,
+			  av1_dec->prob_tbl.dma);
+prob_tbl_cpu_err:
+	dma_free_coherent(vpu->dev, av1_dec->film_grain.size,
+			  av1_dec->film_grain.cpu,
+			  av1_dec->film_grain.dma);
+film_grain_cpu_err:
+	dma_free_coherent(vpu->dev, av1_dec->tile_info.size,
+			  av1_dec->tile_info.cpu,
+			  av1_dec->tile_info.dma);
+tile_info_cpu_err:
+	dma_free_coherent(vpu->dev, av1_dec->global_model.size,
+			  av1_dec->global_model.cpu,
+			  av1_dec->global_model.dma);
+global_model_cpu_err:
+	return ret;
 }
 
 static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx)

From b747b30491bf43e281fa44c857a01084b4c962fb Mon Sep 17 00:00:00 2001
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
Date: Sat, 15 Aug 2026 21:49:49 +0800
Subject: [PATCH 1359/1982] media: mediatek: jpeg: retry HW selection after
 successful wait

[ Upstream commit eb0bbd0ad679bf363387e3b8be8892cfbedabb72 ]

wait_event_interruptible_timeout() returns a positive value when its
condition becomes true before the timeout. mtk_jpegdec_worker() treats
every nonzero result as a failure, so a normal decoder wakeup finishes
the mem2mem job as though no hardware became available.

Handle interrupted waits and exhausted timeout retries separately, and
retry hardware selection after a successful wakeup. Increment the retry
count only for actual timeouts. The encoder uses
wait_event_interruptible(), whose successful return is zero, so its
existing check is correct; leave that separate no-timeout policy
unchanged.

Fixes: dedc21500334 ("media: mtk-jpegdec: add jpeg decode worker interface")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
index 0e2bb13f071afe..8e52b40e2423b5 100644
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1705,9 +1705,15 @@ static void mtk_jpegdec_worker(struct work_struct *work)
 		ret = wait_event_interruptible_timeout(jpeg->hw_wq,
 						       atomic_read(&jpeg->hw_rdy) > 0,
 						       MTK_JPEG_HW_TIMEOUT_MSEC);
-		if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
-			dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
-				__func__, __LINE__);
+		if (ret < 0) {
+			dev_err(jpeg->dev, "decoder HW wait interrupted: %d\n",
+				ret);
+			v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+			return;
+		}
+
+		if (!ret && i++ > MTK_JPEG_MAX_RETRY_TIME) {
+			dev_err(jpeg->dev, "all decoder HW are busy\n");
 			v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
 			return;
 		}

From 855012e5e1bb64b7f7e50422c02b2ebdcd872657 Mon Sep 17 00:00:00 2001
From: Junrui Luo <moonafterrain@outlook.com>
Date: Mon, 3 Aug 2026 15:29:36 +0800
Subject: [PATCH 1360/1982] media: vicodec: fix NULL deref on oversized frame

[ Upstream commit c657eb609197e289b054bc2c4e86a0fc32dd7ebe ]

job_ready() only honours the is_header_valid() verdict when
ctx->comp_has_frame is set, and comp_has_frame is only set once
comp_size reaches the full frame size. Since the copy is clamped to
ctx->comp_max_size, a header advertising a larger size leaves comp_size
stuck at comp_max_size, so comp_has_frame stays false and the failed
validation is discarded.

Control then falls into the resolution change branch, which calls
update_capture_data_from_header(). That function re-derives info via
info_from_header(), assigns it to q_dst->info and dereferences it as
q_dst->info->sizeimage_mult, with no NULL check of its own.
is_header_valid() does check that same info_from_header() result --
if (!info) return false which is precisely the false verdict
job_ready() discarded above. info_from_header() returns NULL whenever the
header flags resolve to no supported pixel format.

Drop the comp_has_frame conjunct so an invalid header always bails out.
The resolution change path is unaffected, as it is entered with a valid
header. Oversized frames are then rejected by device_process(), which
already returns -EINVAL when comp_frame_size exceeds comp_max_size.

Fixes: 3b15f68e19c2 ("media: vicodec: Add support for resolution change event.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vicodec/vicodec-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vicodec/vicodec-core.c b/drivers/media/test-drivers/vicodec/vicodec-core.c
index 841dc03d0edd20..3052d248a7286a 100644
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -652,7 +652,7 @@ static int job_ready(void *priv)
 	 * if the header is invalid the device_run will just drop the frame
 	 * with an error
 	 */
-	if (!is_header_valid(&ctx->state.header) && ctx->comp_has_frame)
+	if (!is_header_valid(&ctx->state.header))
 		return 1;
 	flags = ntohl(ctx->state.header.flags);
 	hdr_width_div = (flags & V4L2_FWHT_FL_CHROMA_FULL_WIDTH) ? 1 : 2;

From b7dcd99be024c99a35e6919c3a4058773f40bf2c Mon Sep 17 00:00:00 2001
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Date: Fri, 31 Jul 2026 14:07:51 +0000
Subject: [PATCH 1361/1982] media: hantro: Harden MPEG-2 control access against
 NULL

[ Upstream commit 2b685dba4226792933f45b1cbf8991e89ccd21ce ]

The MPEG-2 sequence and picture controls are validated
before a job is queued, so hantro_get_ctrl() is not expected to return
NULL in hantro_g1_mpeg2_dec_run(). The controls are nonetheless
dereferenced unconditionally.

Harden the invariant by checking the sequence and picture controls with
WARN_ON().

Found by code inspection.

Fixes: f329e21e9dad ("media: uapi: mpeg2: Split sequence and picture parameters")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
index e0d6bd0a6e44f5..6a942f4b8a2dda 100644
--- a/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
+++ b/drivers/media/platform/verisilicon/hantro_g1_mpeg2_dec.c
@@ -161,8 +161,13 @@ int hantro_g1_mpeg2_dec_run(struct hantro_ctx *ctx)
 
 	seq = hantro_get_ctrl(ctx,
 			      V4L2_CID_STATELESS_MPEG2_SEQUENCE);
+	if (WARN_ON(!seq))
+		return -EINVAL;
+
 	pic = hantro_get_ctrl(ctx,
 			      V4L2_CID_STATELESS_MPEG2_PICTURE);
+	if (WARN_ON(!pic))
+		return -EINVAL;
 
 	reg = G1_REG_DEC_AXI_RD_ID(0) |
 	      G1_REG_DEC_TIMEOUT_E(1) |

From 48969667d004244035ee3e02ec50557e920414cb Mon Sep 17 00:00:00 2001
From: Jiawen Liu <1298662399@qq.com>
Date: Sun, 26 Jul 2026 10:35:39 +0400
Subject: [PATCH 1362/1982] media: amphion: fix runtime PM imbalance on probe
 failure

[ Upstream commit 0cabf27cf1e6f7ee5f3c5893c0f1930814d949af ]

vpu_core_probe() enables runtime PM before calling
pm_runtime_resume_and_get().

If pm_runtime_resume_and_get() fails, it has already dropped the runtime PM
usage counter that it acquired before trying to resume the device.  Calling
pm_runtime_put_noidle() again on this error path drops the counter one
extra time.

Remove the extra put and keep the existing cleanup that marks the device
suspended before disabling runtime PM.

Fixes: 9f599f351e86ac ("media: amphion: add vpu core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/amphion/vpu_core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
index 56f6888f101cba..538ef56823b4c5 100644
--- a/drivers/media/platform/amphion/vpu_core.c
+++ b/drivers/media/platform/amphion/vpu_core.c
@@ -690,7 +690,6 @@ static int vpu_core_probe(struct platform_device *pdev)
 	pm_runtime_enable(dev);
 	ret = pm_runtime_resume_and_get(dev);
 	if (ret) {
-		pm_runtime_put_noidle(dev);
 		pm_runtime_set_suspended(dev);
 		goto err_runtime_disable;
 	}

From 6c01b58b23f95bd4ce98ff01e1a07b88ecd683f6 Mon Sep 17 00:00:00 2001
From: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Date: Wed, 22 Jul 2026 16:08:19 +0000
Subject: [PATCH 1363/1982] media: hantro: disable runtime PM before hardware
 teardown

[ Upstream commit 8e26d4c20ed218db6c3123480a4a4e2545680566 ]

Removing the Hantro driver may trigger an SError on RK3588:
	SError Interrupt on CPU6, code 0x00000000be000011 -- SError
	...
	do_serror+0x5c/0x74
	el1h_64_error_handler+0x34/0x50
	el1h_64_error+0x6c/0x70
	regmap_mmio_read32le+0x10/0x20 (P)
	_regmap_bus_reg_read+0x6c/0xb4
	_regmap_read+0x60/0xdc
	regmap_read+0x4c/0x80
	rockchip_pd_power+0xe4/0x600
	rockchip_pd_power_off+0x1c/0x60
	_genpd_power_off+0x98/0x198
	genpd_power_off.part.0+0x178/0x288
	genpd_runtime_suspend+0x210/0x300
	__rpm_callback+0x48/0x1e0
	rpm_callback+0x74/0x80
	rpm_suspend+0x10c/0x580
	rpm_idle+0x134/0x1b8
	update_autosuspend+0x30/0xc4
	__pm_runtime_use_autosuspend+0x48/0x64
	hantro_remove+0x8c/0xa8 [hantro_vpu]
	...

hantro_remove() currently asserts the device resets before disabling
runtime PM.

Calling pm_runtime_dont_use_autosuspend() causes an idle device to be
runtime-suspended immediately. At that point the Hantro hardware has
already been torn down, while the generic power-domain genpd code
still performs the power-off sequence. genpd regmap_mmio_read causes panic
subsequently because the reset lines were asserted.

Disable runtime PM before asserting the reset lines so that no runtime-PM
transition can race with hardware teardown.

Apply the same ordering to the probe error paths as well.

Fixes: ea71631b7129 ("media: hantro: add support for reset lines")
Cc: stable@vger.kernel.org
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/verisilicon/hantro_drv.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 418cfe3a141464..a35f6392c6fa2e 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1212,7 +1212,7 @@ static int hantro_probe(struct platform_device *pdev)
 	ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to prepare clocks\n");
-		goto err_rst_assert;
+		goto err_pm_disable_assert_reset;
 	}
 
 	ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev);
@@ -1266,8 +1266,11 @@ static int hantro_probe(struct platform_device *pdev)
 	v4l2_device_unregister(&vpu->v4l2_dev);
 err_clk_unprepare:
 	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
-err_rst_assert:
+err_pm_disable_assert_reset:
+	pm_runtime_dont_use_autosuspend(vpu->dev);
+	pm_runtime_disable(vpu->dev);
 	reset_control_assert(vpu->resets);
+	return ret;
 err_pm_disable:
 	pm_runtime_dont_use_autosuspend(vpu->dev);
 	pm_runtime_disable(vpu->dev);
@@ -1287,9 +1290,9 @@ static void hantro_remove(struct platform_device *pdev)
 	v4l2_m2m_put(vpu->m2m_dev);
 	v4l2_device_unregister(&vpu->v4l2_dev);
 	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
-	reset_control_assert(vpu->resets);
 	pm_runtime_dont_use_autosuspend(vpu->dev);
 	pm_runtime_disable(vpu->dev);
+	reset_control_assert(vpu->resets);
 }
 
 #ifdef CONFIG_PM

From a99338df4ab9c32c297374017402df22e4de7afa Mon Sep 17 00:00:00 2001
From: Maurizio Casciano <mauriziocasciano7@gmail.com>
Date: Fri, 25 Sep 2026 00:51:52 +0200
Subject: [PATCH 1364/1982] power: supply: core: Honor supplied-from with
 CONFIG_OF=y

[ Upstream commit 6bd80f22c764fe8c56c62c118387f86a3ca98cff ]

The supplied-from device property is the name-based counterpart to
firmware-node power-supplies references. It was added for non-DT platforms,
but its parser is compiled only when CONFIG_OF is disabled. CONFIG_OF is
a global kernel option, so x86 systems commonly enable it even when
individual power supplies are described by software nodes.

Consequently, these consumers never populate supplied_from and supplier
notifications do not reach their external_power_changed() callbacks. On a
Lenovo Yoga Book YB1-X91L, ftrace showed the Whiskey Cove supplier
notification running without invoking the BQ25892 callback, leaving the
input current limit at its boot-time value.

Use a single power_supply_check_supplies() implementation for all
configurations. Preserve firmware-node power-supplies references as the
preferred firmware description and use the name-based supplied-from
property only when no references are specified. Continue to honor an
explicitly provided supplied_from list first and propagate errors from
specified firmware references.

With the fix, ftrace shows the BQ25892 callback on hotplug. A boot-offline
test changes its input current limit from 500 mA to 2 A.

Fixes: 58a36bb06891 ("power: supply: core: Add support for supplied-from device-property")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Maurizio Casciano <mauriziocasciano7@gmail.com>
Link: https://patch.msgid.link/20260924225152.985489-1-mauriziocasciano7@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/power_supply_core.c | 84 ++++++++++++------------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 615dc27089a3a0..7edca0694eb7fa 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -190,7 +190,35 @@ static void power_supply_deferred_register_work(struct work_struct *work)
 		device_unlock(psy->dev.parent);
 }
 
-#ifdef CONFIG_OF
+static int power_supply_check_supplies_by_name(struct power_supply *psy)
+{
+	struct device *parent = psy->dev.parent;
+	int nval, ret;
+
+	if (!parent)
+		return 0;
+
+	nval = device_property_string_array_count(parent, "supplied-from");
+	if (nval <= 0)
+		return 0;
+
+	psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
+						sizeof(*psy->supplied_from),
+						GFP_KERNEL);
+	if (!psy->supplied_from)
+		return -ENOMEM;
+
+	ret = device_property_read_string_array(parent, "supplied-from",
+						(const char **)psy->supplied_from,
+						nval);
+	if (ret < 0)
+		return ret;
+
+	psy->num_supplies = nval;
+
+	return 0;
+}
+
 static int __power_supply_populate_supplied_from(struct power_supply *epsy,
 						 void *data)
 {
@@ -262,22 +290,21 @@ static int power_supply_find_supply_from_fwnode(struct fwnode_handle *supply_nod
 static int power_supply_check_supplies(struct power_supply *psy)
 {
 	struct fwnode_handle *np;
-	int cnt = 0;
+	int cnt, ret;
 
 	/* If there is already a list honor it */
 	if (psy->supplied_from && psy->num_supplies > 0)
 		return 0;
 
-	/* No device node found, nothing to do */
-	if (!psy->dev.fwnode)
-		return 0;
-
-	do {
-		int ret;
+	for (cnt = 0; psy->dev.fwnode; cnt++) {
+		np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt);
+		if (IS_ERR(np)) {
+			ret = PTR_ERR(np);
+			if (ret != -ENOENT)
+				return ret;
 
-		np = fwnode_find_reference(psy->dev.fwnode, "power-supplies", cnt++);
-		if (IS_ERR(np))
 			break;
+		}
 
 		ret = power_supply_find_supply_from_fwnode(np);
 		fwnode_handle_put(np);
@@ -286,48 +313,21 @@ static int power_supply_check_supplies(struct power_supply *psy)
 			dev_dbg(&psy->dev, "Failed to find supply!\n");
 			return ret;
 		}
-	} while (!IS_ERR(np));
+	}
 
-	/* Missing valid "power-supplies" entries */
-	if (cnt == 1)
-		return 0;
+	/* Fall back to the name-based property if no references were specified. */
+	if (!cnt)
+		return power_supply_check_supplies_by_name(psy);
 
 	/* All supplies found, allocate char * array for filling */
 	psy->supplied_from = devm_kcalloc(&psy->dev,
-					  cnt - 1, sizeof(*psy->supplied_from),
+					  cnt, sizeof(*psy->supplied_from),
 					  GFP_KERNEL);
 	if (!psy->supplied_from)
 		return -ENOMEM;
 
 	return power_supply_populate_supplied_from(psy);
 }
-#else
-static int power_supply_check_supplies(struct power_supply *psy)
-{
-	int nval, ret;
-
-	if (!psy->dev.parent)
-		return 0;
-
-	nval = device_property_string_array_count(psy->dev.parent, "supplied-from");
-	if (nval <= 0)
-		return 0;
-
-	psy->supplied_from = devm_kmalloc_array(&psy->dev, nval,
-						sizeof(char *), GFP_KERNEL);
-	if (!psy->supplied_from)
-		return -ENOMEM;
-
-	ret = device_property_read_string_array(psy->dev.parent,
-		"supplied-from", (const char **)psy->supplied_from, nval);
-	if (ret < 0)
-		return ret;
-
-	psy->num_supplies = nval;
-
-	return 0;
-}
-#endif
 
 struct psy_am_i_supplied_data {
 	struct power_supply *psy;

From 35af27e6cdefe33f0fdd7ff226f4967af3bc8e6e Mon Sep 17 00:00:00 2001
From: Andrey Albershteyn <aalbersh@kernel.org>
Date: Sat, 3 Oct 2026 00:36:47 +0200
Subject: [PATCH 1365/1982] fsverity: hoist statx reporting of fs-verity flag

[ Upstream commit f9e450420da2624c93ce9585deebfabb87932774 ]

All filesystems, supporting fsverity, report this status by checking
inode flag. Also, BTRFS was missing stat->attributes_mask, which is
fixed now.

Fixes: 146054090b08 ("btrfs: initial fsverity support")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261002223705.2175542-7-aalbersh@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode.c | 3 ---
 fs/ext4/inode.c  | 5 +----
 fs/f2fs/file.c   | 5 +----
 fs/stat.c        | 6 +++++-
 4 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 62858d8d66bd6f..6287e15bce110d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -8143,7 +8143,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
 	struct inode *inode = d_inode(path->dentry);
 	u32 blocksize = btrfs_sb(inode->i_sb)->sectorsize;
 	u32 bi_flags = BTRFS_I(inode)->flags;
-	u32 bi_ro_flags = BTRFS_I(inode)->ro_flags;
 
 	stat->result_mask |= STATX_BTIME;
 	stat->btime.tv_sec = BTRFS_I(inode)->i_otime_sec;
@@ -8156,8 +8155,6 @@ static int btrfs_getattr(struct mnt_idmap *idmap,
 		stat->attributes |= STATX_ATTR_IMMUTABLE;
 	if (bi_flags & BTRFS_INODE_NODUMP)
 		stat->attributes |= STATX_ATTR_NODUMP;
-	if (bi_ro_flags & BTRFS_INODE_RO_VERITY)
-		stat->attributes |= STATX_ATTR_VERITY;
 
 	stat->attributes_mask |= (STATX_ATTR_APPEND |
 				  STATX_ATTR_COMPRESSED |
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index c3fb5f16f6e39c..ed51c11f43ffb9 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6216,15 +6216,12 @@ int ext4_getattr(struct mnt_idmap *idmap, const struct path *path,
 		stat->attributes |= STATX_ATTR_IMMUTABLE;
 	if (flags & EXT4_NODUMP_FL)
 		stat->attributes |= STATX_ATTR_NODUMP;
-	if (flags & EXT4_VERITY_FL)
-		stat->attributes |= STATX_ATTR_VERITY;
 
 	stat->attributes_mask |= (STATX_ATTR_APPEND |
 				  STATX_ATTR_COMPRESSED |
 				  STATX_ATTR_ENCRYPTED |
 				  STATX_ATTR_IMMUTABLE |
-				  STATX_ATTR_NODUMP |
-				  STATX_ATTR_VERITY);
+				  STATX_ATTR_NODUMP);
 
 	generic_fillattr(idmap, request_mask, inode, stat);
 	return 0;
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 791f1cf198c16a..49febaa6608150 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1058,15 +1058,12 @@ int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
 		stat->attributes |= STATX_ATTR_IMMUTABLE;
 	if (flags & F2FS_NODUMP_FL)
 		stat->attributes |= STATX_ATTR_NODUMP;
-	if (IS_VERITY(inode))
-		stat->attributes |= STATX_ATTR_VERITY;
 
 	stat->attributes_mask |= (STATX_ATTR_COMPRESSED |
 				  STATX_ATTR_APPEND |
 				  STATX_ATTR_ENCRYPTED |
 				  STATX_ATTR_IMMUTABLE |
-				  STATX_ATTR_NODUMP |
-				  STATX_ATTR_VERITY);
+				  STATX_ATTR_NODUMP);
 
 	generic_fillattr(idmap, request_mask, inode, stat);
 
diff --git a/fs/stat.c b/fs/stat.c
index 8c110555b3d7b0..3bc049f0bc3dd5 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -203,8 +203,12 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
 	if (IS_DAX(inode))
 		stat->attributes |= STATX_ATTR_DAX;
 
+	if (IS_VERITY(inode))
+		stat->attributes |= STATX_ATTR_VERITY;
+
 	stat->attributes_mask |= (STATX_ATTR_AUTOMOUNT |
-				  STATX_ATTR_DAX);
+				  STATX_ATTR_DAX |
+				  STATX_ATTR_VERITY);
 
 	idmap = mnt_idmap(path->mnt);
 	if (inode->i_op->getattr) {

From c1c3af4603375255a22960d1b7aa981adec8d4b2 Mon Sep 17 00:00:00 2001
From: Henrik Enquist <henrik.enquist@gmail.com>
Date: Sat, 3 Oct 2026 15:26:11 +0200
Subject: [PATCH 1366/1982] ALSA: aloop: Don't constrain playback params in
 notify mode

[ Upstream commit ded106036984a9dd766e7e1451b02e2d15c81438 ]

With notify enabled (the pcm_notify module parameter or the "PCM
Notify" control), the playback side of a cable may change format, rate
and channels while a capture is running. loopback_check_format() then
stops the capture and notifies the "PCM Slave" controls, so that the
capture application can reopen with the new parameters. For this
reason loopback_open() still gives a notify mode playback the
unconstrained loopback_pcm_hardware.

Since commit 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints
adjustment") the hw rules refine against the shared cable->hw instead
of the substream's own runtime->hw. This pins the playback side to the
parameters of an open capture whatever the notify setting is. A player
probing the device sees only the capture's rate, format and channels,
and the format change path in loopback_check_format() can't be reached
by a new playback.

Skip the format, rate and channels rules for the playback substream
when notify is enabled. Skip the period bytes rule as well: with a
sound timer source, params_change() already takes the period size from
a notify mode playback, and keeping the old capture's period bytes
leaves a playback at another rate with a period that doesn't match the
timer. The capture side stays constrained to the cable parameters.

The capture stop this makes reachable again was hardened by commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") and
commit e5c33cdc6f40 ("ALSA: aloop: Fix peer runtime UAF during
format-change stop"), which need to be applied first when backporting.

Reproducer, with notify enabled on the cable:
  arecord -D hw:Loopback,1,0 -r 44100 -f S32_LE -c 2 /dev/null &
  aplay -D hw:Loopback,0,0 96k.wav
Before: aplay is forced to 44100 Hz and the capture keeps running.
After: aplay runs at 96000 Hz, the capture is stopped and "PCM Slave
Rate" reports 96000.

Fixes: 898dfe4687f4 ("ALSA: aloop: Fix racy hw constraints adjustment")
Reported-by: Pavel Hofman <pavel.hofman@ivitera.com>
Closes: https://lore.kernel.org/all/b4af9071-f8d7-5b47-4d7a-c5743bd67394@ivitera.com/
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Henrik Enquist <henrik.enquist@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261003-aloop-notify-fix-v1-1-ba5dfb831bf5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/drivers/aloop.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index d08027681c3732..eefc41f6284627 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -988,6 +988,18 @@ static unsigned int get_cable_index(struct snd_pcm_substream *substream)
 		return !substream->stream;
 }
 
+/*
+ * In notify mode the playback side may change format, rate, channels and,
+ * with a sound timer, the period size. A running capture that no longer
+ * matches is stopped by loopback_check_format().
+ * call in loopback->cable_lock
+ */
+static bool loopback_playback_unconstrained(struct loopback_pcm *dpcm)
+{
+	return dpcm->substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+	       get_notify(dpcm);
+}
+
 static int rule_format(struct snd_pcm_hw_params *params,
 		       struct snd_pcm_hw_rule *rule)
 {
@@ -997,6 +1009,8 @@ static int rule_format(struct snd_pcm_hw_params *params,
 
 	snd_mask_none(&m);
 	scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+		if (loopback_playback_unconstrained(dpcm))
+			return 0;
 		m.bits[0] = (u_int32_t)cable->hw.formats;
 		m.bits[1] = (u_int32_t)(cable->hw.formats >> 32);
 	}
@@ -1011,6 +1025,8 @@ static int rule_rate(struct snd_pcm_hw_params *params,
 	struct snd_interval t;
 
 	scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+		if (loopback_playback_unconstrained(dpcm))
+			return 0;
 		t.min = cable->hw.rate_min;
 		t.max = cable->hw.rate_max;
 	}
@@ -1027,6 +1043,8 @@ static int rule_channels(struct snd_pcm_hw_params *params,
 	struct snd_interval t;
 
 	scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+		if (loopback_playback_unconstrained(dpcm))
+			return 0;
 		t.min = cable->hw.channels_min;
 		t.max = cable->hw.channels_max;
 	}
@@ -1043,6 +1061,8 @@ static int rule_period_bytes(struct snd_pcm_hw_params *params,
 	struct snd_interval t;
 
 	scoped_guard(mutex, &dpcm->loopback->cable_lock) {
+		if (loopback_playback_unconstrained(dpcm))
+			return 0;
 		t.min = cable->hw.period_bytes_min;
 		t.max = cable->hw.period_bytes_max;
 	}

From 8bc833472436ac215caa1bbe501d2cad3a21a543 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linusw@kernel.org>
Date: Wed, 16 Sep 2026 08:49:23 +0200
Subject: [PATCH 1367/1982] power: supply: ab8500_fg: Accept status from
 supplied power

[ Upstream commit 16f506a13b58a55308449bbcbec89c817d619ca2 ]

Commit dc77721ea4aa ("power: supply: ab8500: Set typing and props")
changed the charging algorithm power supply type from battery to unknown
so userspace would not mistake it for a second battery. The fuel gauge,
however, processes status changes only from battery-type supplies. It
therefore never learns that charging started and keeps running its
discharge state machine.

The power supply relationship already limits the callback to supplies
naming the fuel gauge in supplied_to. Accept status from any such supply
while retaining the battery type checks for battery-specific properties.

The Samsung-GT-I8160-Codina and Samsung-GT-I8160_HD-Codina product trees
keep the charging algorithm typed as a battery. The
Samsung-GT-I8530-Gavini, Samsung-GT-S7710-Skomer,
Samsung-SGH-I407-Kyle and Samsung-SGH-T599-Codina-TMO alternative
fuel-gauge drivers instead pass cable state directly. Both approaches
preserve the charging state handoff that was lost in mainline.

Fixes: dc77721ea4aa ("power: supply: ab8500: Set typing and props")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-1-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/ab8500_fg.c | 60 ++++++++++++++------------------
 1 file changed, 27 insertions(+), 33 deletions(-)

diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index 969a75f4c016d9..b122bd473c7736 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -2205,42 +2205,36 @@ static int ab8500_fg_get_ext_psy_data(struct power_supply *ext, void *data)
 
 		switch (prop) {
 		case POWER_SUPPLY_PROP_STATUS:
-			switch (ext->desc->type) {
-			case POWER_SUPPLY_TYPE_BATTERY:
-				switch (ret.intval) {
-				case POWER_SUPPLY_STATUS_UNKNOWN:
-				case POWER_SUPPLY_STATUS_DISCHARGING:
-				case POWER_SUPPLY_STATUS_NOT_CHARGING:
-					if (!di->flags.charging)
-						break;
-					di->flags.charging = false;
-					di->flags.fully_charged = false;
-					if (di->bm->capacity_scaling)
-						ab8500_fg_update_cap_scalers(di);
-					queue_work(di->fg_wq, &di->fg_work);
+			switch (ret.intval) {
+			case POWER_SUPPLY_STATUS_UNKNOWN:
+			case POWER_SUPPLY_STATUS_DISCHARGING:
+			case POWER_SUPPLY_STATUS_NOT_CHARGING:
+				if (!di->flags.charging)
 					break;
-				case POWER_SUPPLY_STATUS_FULL:
-					if (di->flags.fully_charged)
-						break;
-					di->flags.fully_charged = true;
-					di->flags.force_full = true;
-					/* Save current capacity as maximum */
-					di->bat_cap.max_mah = di->bat_cap.mah;
-					queue_work(di->fg_wq, &di->fg_work);
-					break;
-				case POWER_SUPPLY_STATUS_CHARGING:
-					if (di->flags.charging &&
-						!di->flags.fully_charged)
-						break;
-					di->flags.charging = true;
-					di->flags.fully_charged = false;
-					if (di->bm->capacity_scaling)
-						ab8500_fg_update_cap_scalers(di);
-					queue_work(di->fg_wq, &di->fg_work);
+				di->flags.charging = false;
+				di->flags.fully_charged = false;
+				if (di->bm->capacity_scaling)
+					ab8500_fg_update_cap_scalers(di);
+				queue_work(di->fg_wq, &di->fg_work);
+				break;
+			case POWER_SUPPLY_STATUS_FULL:
+				if (di->flags.fully_charged)
 					break;
-				}
+				di->flags.fully_charged = true;
+				di->flags.force_full = true;
+				/* Save current capacity as maximum */
+				di->bat_cap.max_mah = di->bat_cap.mah;
+				queue_work(di->fg_wq, &di->fg_work);
 				break;
-			default:
+			case POWER_SUPPLY_STATUS_CHARGING:
+				if (di->flags.charging &&
+				    !di->flags.fully_charged)
+					break;
+				di->flags.charging = true;
+				di->flags.fully_charged = false;
+				if (di->bm->capacity_scaling)
+					ab8500_fg_update_cap_scalers(di);
+				queue_work(di->fg_wq, &di->fg_work);
 				break;
 			}
 			break;

From 3eeae9c6d55ed130a31cf4added4004eeda6bf13 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linusw@kernel.org>
Date: Wed, 16 Sep 2026 08:49:24 +0200
Subject: [PATCH 1368/1982] power: supply: ab8500_fg: Report sub-percent charge
 changes

[ Upstream commit 4d40dba1815d46c6ef9019ed80e3b998b0fc443d ]

The fuel gauge updates bat_cap.mah from the coulomb counter but exposes
bat_cap.prev_mah through CHARGE_NOW and ENERGY_NOW. It only refreshes
prev_mah when the rounded integer capacity percentage changes, making the
momentary properties appear frozen between percentage steps.

Refresh prev_mah and notify userspace whenever the new charge remains
within the currently accepted percentage. If a discharge estimate tries
to cross upward into a higher percentage, the existing rejection still
leaves both the reported percentage and charge unchanged.

The AB8500 fuel-gauge implementations in the Samsung-GT-I8160-Codina,
Samsung-GT-I8160_HD-Codina, Samsung-GT-I8530-Gavini,
Samsung-GT-S7710-Skomer, Samsung-SGH-I407-Kyle and
Samsung-SGH-T599-Codina-TMO product trees retain the same percentage-gated
prev_mah update and contain no finer-grained reporting workaround.

Fixes: 13151631b5bd ("ab8500-fg: A8500 fuel gauge driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260916-ab8500-charging-v1-2-e986ed321cc6@kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/ab8500_fg.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index b122bd473c7736..3b0a5bdd352b5c 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -1387,6 +1387,13 @@ static void ab8500_fg_check_capacity_limits(struct ab8500_fg *di, bool init)
 		}
 	}
 
+	/* Keep the charge properties current between percentage changes. */
+	if (di->bat_cap.prev_percent == percent &&
+	    di->bat_cap.prev_mah != di->bat_cap.mah) {
+		di->bat_cap.prev_mah = di->bat_cap.mah;
+		changed = true;
+	}
+
 	if (changed) {
 		if (di->bm->capacity_scaling) {
 			di->bat_cap.cap_scale.scaled_cap =

From 59ab22bedd52783497ff1a2a509890679747271d Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Wed, 2 Sep 2026 15:22:41 +0800
Subject: [PATCH 1369/1982] perf: xgene: initialize lock before requesting IRQ

[ Upstream commit d4b7b0c77142b3bc535192fa65130474a129c487 ]

xgene_pmu_probe() requests the PMU IRQ before initializing
xgene_pmu->lock. request_irq() enables IRQ handling before it returns,
so xgene_pmu_isr() can run in this window and acquire the uninitialized
raw spinlock.

Initialize the lock before requesting the IRQ so the handler always sees a
valid lock.

Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/xgene_pmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index 33b5497bdc06e4..ecbcd2d39f9ed9 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1873,6 +1873,8 @@ static int xgene_pmu_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return -EINVAL;
 
+	raw_spin_lock_init(&xgene_pmu->lock);
+
 	rc = devm_request_irq(&pdev->dev, irq, xgene_pmu_isr,
 				IRQF_NOBALANCING | IRQF_NO_THREAD,
 				dev_name(&pdev->dev), xgene_pmu);
@@ -1883,8 +1885,6 @@ static int xgene_pmu_probe(struct platform_device *pdev)
 
 	xgene_pmu->irq = irq;
 
-	raw_spin_lock_init(&xgene_pmu->lock);
-
 	/* Check for active MCBs and MCUs */
 	rc = xgene_pmu_probe_active_mcb_mcu_l3c(xgene_pmu, pdev);
 	if (rc) {

From 8e7e5b7b10da25341798c2b76648f2abc07409f9 Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Fri, 28 Aug 2026 09:50:34 -0400
Subject: [PATCH 1370/1982] svcrdma: Grant credits from the clamped
 sc_max_requests

[ Upstream commit b7037e5da3fb81abcd6309daecb112f1d5926760 ]

svc_rdma_accept() computes sc_fc_credits from sc_max_requests before
the Receive Queue depth is checked against the device's max_qp_wr.
When that check lowers sc_max_requests, the credit grant keeps the
original value, so the server advertises more credits than it has
Receives posted. A client that uses the full grant overruns the
Receive Queue, and the connection is lost with an RNR error.

Set sc_fc_credits after the clamp so the grant matches the number
of Receives the server posts.

Fixes: fc2e69db82c1 ("svcrdma: Clean up comment in svc_rdma_accept()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260828135036.796842-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtrdma/svc_rdma_transport.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 4afa662430cae8..d9bc86fa09bce9 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -469,7 +469,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
 	newxprt->sc_max_requests = svcrdma_max_requests;
 	newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
 	newxprt->sc_recv_batch = RPCRDMA_MAX_RECV_BATCH;
-	newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
 
 	/* Qualify the transport's resource defaults with the
 	 * capabilities of this particular device.
@@ -490,6 +489,8 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
 		newxprt->sc_max_bc_requests = 2;
 	}
 
+	newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
+
 	/* Estimate the needed number of rdma_rw contexts. The maximum
 	 * Read and Write chunks have one segment each. Each request
 	 * can involve one Read chunk and either a Write chunk or Reply

From 097a336a2dcd0a93842b7a80bbe2fc0745b78941 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Sat, 3 Oct 2026 00:10:45 -0400
Subject: [PATCH 1371/1982] ASoC: codecs: rt5682s: disable jack detection work
 on shutdown

[ Upstream commit ca552e3140e736ed6704fe5d47439d8f2d40b42e ]

The jack detection and button check works can queue each other. The
shutdown path cancels jack_detect_work first, but jd_check_work can
queue it again after that cancellation returns. Canceling jd_check_work
then leaves jack_detect_work pending or running while the device is
reset and, on removal, its managed resources are released.

Disable and drain both delayed works so neither callback can revive the
other after its cancellation. The I2C remove callback uses the same
shutdown path.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: c07ac3ee76e5 ("ASoC: rt5682s: Fix the wrong jack type detected")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20261003041045.650207-1-mhun512@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt5682s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
index 1d80a4b862e276..1147b332c83a36 100644
--- a/sound/soc/codecs/rt5682s.c
+++ b/sound/soc/codecs/rt5682s.c
@@ -3300,8 +3300,8 @@ static void rt5682s_i2c_shutdown(struct i2c_client *client)
 	struct rt5682s_priv *rt5682s = i2c_get_clientdata(client);
 
 	disable_irq(client->irq);
-	cancel_delayed_work_sync(&rt5682s->jack_detect_work);
-	cancel_delayed_work_sync(&rt5682s->jd_check_work);
+	disable_delayed_work_sync(&rt5682s->jack_detect_work);
+	disable_delayed_work_sync(&rt5682s->jd_check_work);
 
 	rt5682s_reset(rt5682s);
 }

From 79c9a5bb4b3c504ddf494f8dfaaeba86c7222464 Mon Sep 17 00:00:00 2001
From: "Denis Efremov (Oracle)" <efremov@linux.com>
Date: Thu, 24 Sep 2026 13:48:39 +0400
Subject: [PATCH 1372/1982] floppy: don't store a stack buffer in
 timeout_message

[ Upstream commit 66be62ee5d64b6ad1285978644798d8611add931 ]

request_done() formats "request done %d" into a buffer on its stack and
passes it to reschedule_timeout(), which keeps the pointer in
timeout_message. show_floppy() prints timeout_message long after
request_done() has returned, e.g. from result() in the interrupt
handler, and reads a dead stack frame:

  BUG: KASAN: stack-out-of-bounds in string+0x39c/0x3d0 lib/vsprintf.c:720
  Read of size 1 at addr ffffc900003cfc70 by task swapper/3/0
  Call Trace:
   <IRQ>
   ...
   show_floppy+0xb1/0x45f drivers/block/floppy.c:1838
   result.cold+0x2b/0x30 drivers/block/floppy.c:1183
   floppy_interrupt+0x191/0x340 drivers/block/floppy.c:1755
   floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66

uptodate is either 0 or 1, so pass one of two string literals instead.

Cc: stable@vger.kernel.org
Fixes: 73507e6cd8dc ("drivers/block/floppy.c: remove unnecessary argument from [__]reschedule_timeout")
Reported-by: syzbot+874c2707f97fac24b090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=874c2707f97fac24b090
Link: https://patch.msgid.link/20260924094839.3239569-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index c28786e0fe1c85..3ec5453672c159 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2278,11 +2278,10 @@ static void request_done(int uptodate)
 {
 	struct request *req = current_req;
 	int block;
-	char msg[sizeof("request done ") + sizeof(int) * 3];
 
 	probing = 0;
-	snprintf(msg, sizeof(msg), "request done %d", uptodate);
-	reschedule_timeout(MAXTIMEOUT, msg);
+	reschedule_timeout(MAXTIMEOUT,
+			   uptodate ? "request done 1" : "request done 0");
 
 	if (!req) {
 		pr_info("floppy.c: no request in request_done\n");

From 6bf6bf2db6e29233fc06a004db602ca290e190af Mon Sep 17 00:00:00 2001
From: "Denis Efremov (Oracle)" <efremov@linux.com>
Date: Thu, 24 Sep 2026 15:28:25 +0400
Subject: [PATCH 1373/1982] floppy: return the drive state flags from the
 32-bit FDGETDRVSTAT

[ Upstream commit bb38473f1bcb287567f2fa7980e483a778092504 ]

compat_getdrvstat() copies every field of the drive state to a 32-bit
caller except ->flags, which stays zero. 32-bit FDGETDRVSTAT and
FDPOLLDRVSTAT therefore never report FD_DISK_WRITABLE, FD_DISK_CHANGED
or FD_VERIFY: i386 fdutils (floppycontrol -P, fdmount), and other
32-bit users see every disk as write-protected and never see a disk
change. The compat code in block/compat_ioctl.c copied the field;
it was lost when that code moved into floppy.c

Also declare the field as compat_ulong_t: the 32-bit struct
floppy_drive_struct starts with an unsigned long, and a signed char at
offset 0 only lines up with its low byte on little-endian machines. The
size and offsets of the compat structure, and so FDGETDRVSTAT32, do not
change.

Cc: stable@vger.kernel.org
Fixes: 229b53c9bf4e ("take floppy compat ioctls to sodding floppy.c")
Link: https://patch.msgid.link/20260924112825.3525931-1-efremov@linux.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 3ec5453672c159..eed7de727e5474 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3602,7 +3602,7 @@ struct compat_floppy_drive_params {
 };
 
 struct compat_floppy_drive_struct {
-	signed char	flags;
+	compat_ulong_t	flags;
 	compat_ulong_t	spinup_date;
 	compat_ulong_t	select_date;
 	compat_ulong_t	first_read_date;
@@ -3786,6 +3786,7 @@ static int compat_getdrvstat(int drive, bool poll,
 			goto Eintr;
 		process_fd_request();
 	}
+	v.flags = drive_state[drive].flags;
 	v.spinup_date = drive_state[drive].spinup_date;
 	v.select_date = drive_state[drive].select_date;
 	v.first_read_date = drive_state[drive].first_read_date;

From dabc4681985f5ddaee8f3088e46c91733c99f3c5 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@kernel.org>
Date: Tue, 29 Sep 2026 07:17:35 +0000
Subject: [PATCH 1374/1982] dlm: fix send buffer backpressure handling

[ Upstream commit e234d7625598b2eaded84fa99f53c8062650828f ]

lowcomms.c tests and clears SOCKWQ_ASYNC_NOSPACE in con->sock->flags,
but this bit has not been stored there for ten years.

Commit 9cd3e072b0be ("net: rename SOCK_ASYNC_NOSPACE and
SOCK_ASYNC_WAITDATA") mechanically renamed the two dlm users, then
commit ceb5d58b2170 ("net: fix sock_wake_async() rcu protection") moved
the bit from socket->flags to the RCU protected socket_wq->flags, where
it is reachable only through sk_set_bit() and sk_clear_bit(), and is
only maintained for sockets having SOCK_FASYNC set.  dlm uses kernel
sockets, which never have SOCK_FASYNC set, and never sets the bit
itself, so the test in send_to_sock() has been false ever since.

The consequence is that when sock_sendmsg() returns -EAGAIN because the
socket send buffer is full, dlm no longer sets CF_APP_LIMITED, does not
increment sk_write_pending, and does not return DLM_IO_END to wait for
lowcomms_write_space().  It returns DLM_IO_RESCHED instead, and
process_send_sockets() immediately requeues the send work.  A connection
to a peer that is slow to drain thus keeps cycling through
sock_sendmsg() and -EAGAIN, burning CPU, instead of sleeping until TCP
reports that space is available again.

Test SOCK_NOSPACE instead.  This is the bit that lives in socket->flags,
that TCP sets whenever sendmsg() returns -EAGAIN for lack of send buffer
space (tcp_sendmsg_locked() and sk_stream_wait_memory()), and that
lowcomms_write_space() already clears.  This restores the semantics dlm
had before the bit moved.

Also remove the clear_bit() of SOCKWQ_ASYNC_NOSPACE from
lowcomms_write_space(), for the same reason.

SCTP connections are deliberately left as they are.  SCTP does not set
SOCK_NOSPACE, and it never calls sk->sk_write_space(): sctp_wfree() ends
up in sctp_wake_up_waiters(), which calls sctp_write_space() directly.
lowcomms_write_space() is thus never invoked for an SCTP connection, and
the test added here stays false, so send_to_sock() keeps returning
DLM_IO_RESCHED as it does today.  This is the only safe behavior, as
returning DLM_IO_END would wait for a callback that never comes.

Fixes: ceb5d58b2170 ("net: fix sock_wake_async() rcu protection")
Cc: stable@vger.kernel.org
Cc: David Teigland <teigland@redhat.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20260929071743.23624-2-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/lowcomms.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 9a0b6c2b6b01e4..dd68198f34ddee 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -520,10 +520,8 @@ static void lowcomms_write_space(struct sock *sk)
 	clear_bit(SOCK_NOSPACE, &con->sock->flags);
 
 	spin_lock_bh(&con->writequeue_lock);
-	if (test_and_clear_bit(CF_APP_LIMITED, &con->flags)) {
+	if (test_and_clear_bit(CF_APP_LIMITED, &con->flags))
 		con->sock->sk->sk_write_pending--;
-		clear_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags);
-	}
 
 	lowcomms_queue_swork(con);
 	spin_unlock_bh(&con->writequeue_lock);
@@ -1389,7 +1387,7 @@ static int send_to_sock(struct connection *con)
 	if (ret == -EAGAIN || ret == 0) {
 		lock_sock(con->sock->sk);
 		spin_lock_bh(&con->writequeue_lock);
-		if (test_bit(SOCKWQ_ASYNC_NOSPACE, &con->sock->flags) &&
+		if (test_bit(SOCK_NOSPACE, &con->sock->flags) &&
 		    !test_and_set_bit(CF_APP_LIMITED, &con->flags)) {
 			/* Notify TCP that we're limited by the
 			 * application window size.

From 5ed7a6aed407e83d7a5b4972bd553d764544b7ab Mon Sep 17 00:00:00 2001
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Date: Sat, 3 Oct 2026 19:22:21 +0900
Subject: [PATCH 1375/1982] PCI/DOE: Fix double free of a duplicate feature's
 sysfs name

[ Upstream commit 624ee129620a054466b6a29d98cd7a40ccc239cd ]

When a DOE feature is reported twice, sysfs_add_file_to_group() fails
with -EEXIST for the second copy and pci_doe_sysfs_feature_populate()
frees that attribute's name, but leaves the pointer in place.
pci_doe_sysfs_feature_remove() frees every name again when the device
is removed, or when a later feature fails to register, so the name is
freed twice:

  BUG: KASAN: double-free in pci_doe_sysfs_feature_remove+0x117/0x1b0
  Call Trace:
   kfree+0x11a/0x420
   pci_doe_sysfs_feature_remove+0x117/0x1b0
   pci_doe_sysfs_teardown+0x90/0xf0
   pci_remove_bus_device+0x128/0x2e0
   pci_stop_and_remove_bus_device_locked+0x1d/0x30
   remove_store+0xd2/0xf0

Clear the pointer after freeing the name.

Fixes: 2311ab1820fe ("PCI/DOE: Expose DOE features via sysfs")
Suggested-by: Alistair Francis <alistair@alistair23.me>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261003102221.59894-1-donggeunyoo.kernel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/doe.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c
index aae9a8a00406ed..3b0cc6db4402d9 100644
--- a/drivers/pci/doe.c
+++ b/drivers/pci/doe.c
@@ -210,8 +210,9 @@ static int pci_doe_sysfs_feature_populate(struct pci_dev *pdev,
 				pci_warn(pdev, "Failed adding %s to sysfs group\n",
 					 attrs[i].attr.name);
 				goto fail;
-			} else
-				kfree(attrs[i].attr.name);
+			}
+			kfree(attrs[i].attr.name);
+			attrs[i].attr.name = NULL;
 		}
 	}
 

From bbcd20a342158243d66a8c898515aac049ace138 Mon Sep 17 00:00:00 2001
From: Priyank Rathod <rathodpriyank@google.com>
Date: Mon, 28 Sep 2026 17:40:12 +0000
Subject: [PATCH 1376/1982] PCI/AER: Fix memory leak in aer_recover_queue() on
 kfifo buffer overflow

[ Upstream commit 07938f8a3cbf3e9cc27553b8982e2d56c15b354a ]

When ACPI APEI/GHES processes PCIe AER error records, it allocates memory
for aer_capability_regs (aer_regs) from ghes_estatus_pool and passes it to
aer_recover_queue() to be enqueued into aer_recover_ring.

If kfifo_in_spinlocked() fails due to a buffer overflow,
aer_recover_queue() logged an error message but returned without freeing
aer_regs. Because the entry was rejected and never inserted into the queue,
aer_recover_work_func() could never dequeue or free it, leaking the
allocated ghes_estatus_pool memory.

aer_recover_queue() returns void, so the caller ghes_handle_aer() cannot
free the buffer itself: ownership is transferred to the AER code, which
until now only released it on the success path.

Free aer_regs via ghes_estatus_pool_region_free() when
kfifo_in_spinlocked() fails on buffer overflow.

Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections")
Signed-off-by: Priyank Rathod <rathodpriyank@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260928-b4-fix-aer-memleaks-v5-1-ba6b94c9c9a6@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pcie/aer.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index 9f90abe3e88ed6..ad3fea4b56f888 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -1379,11 +1379,14 @@ void aer_recover_queue(int domain, unsigned int bus, unsigned int devfn,
 	};
 
 	if (kfifo_in_spinlocked(&aer_recover_ring, &entry, 1,
-				 &aer_recover_ring_lock))
+				 &aer_recover_ring_lock)) {
 		schedule_work(&aer_recover_work);
-	else
+	} else {
 		pr_err("buffer overflow in recovery for %04x:%02x:%02x.%x\n",
 		       domain, bus, PCI_SLOT(devfn), PCI_FUNC(devfn));
+		ghes_estatus_pool_region_free((unsigned long)aer_regs,
+					      sizeof(struct aer_capability_regs));
+	}
 }
 EXPORT_SYMBOL_GPL(aer_recover_queue);
 #endif

From 9c925a7c4dcda91581a6170880ad5af24732d0d9 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Mon, 5 Oct 2026 12:32:59 +0200
Subject: [PATCH 1377/1982] wifi: brcmsmac: Adjust txpwrindex value in
 nphy_ipa_rxcal_gaintbl_2GHz

[ Upstream commit f7463a9c99a506b3308a852f9aaaf2a26b659e95 ]

After a recent change in clang to warn on signed char conversions within
array initializers [1], there is a warning (or error with
CONFIG_WERROR=y / W=e) from nphy_ipa_rxcal_gaintbl_2GHz:

  drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c:224:18: error: implicit conversion from 'int' to 's8' (aka 'signed char') changes value from 128 to -128 [-Werror,-Wconstant-conversion]
    224 |         {0, 0, 0, 0, 0, 128},
        |         ~               ^~~
  1 error generated.

This value was introduced in the original staging merge of brcmsmac in
commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom
802.11n wireless LAN driver.") and it is the same in the proprietary
driver [2]. Presumably it is correct since there have been no reported issues,
so update the value to '-128' to be type correct and clear up the warning.

Cc: stable@vger.kernel.org
Fixes: a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.")
Link: https://github.com/llvm/llvm-project/commit/a5ef934a8d295dc03be3960f2b3744ec2e53238e [1]
Link: https://lore.kernel.org/1a107e21b08.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com/ [2]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20261005-brcmsmac-clang-24-constant-conversion-v1-1-a30c5692d582@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index b03d5a1f1a936e..7fd3e018affe21 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -221,7 +221,7 @@ static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_5GHz[] = {
 };
 
 static const struct nphy_ipa_txrxgain nphy_ipa_rxcal_gaintbl_2GHz[] = {
-	{0, 0, 0, 0, 0, 128},
+	{0, 0, 0, 0, 0, -128},
 	{0, 0, 0, 0, 0, 70},
 	{0, 0, 0, 0, 0, 20},
 	{0, 0, 0, 3, 0, 20},

From ad72cc6babdd6d60774f1edcc8faf0e85c5e9de9 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <nicoyip.dev@gmail.com>
Date: Mon, 24 Aug 2026 19:24:33 +0800
Subject: [PATCH 1378/1982] mm/ksm: mark migration stores with WRITE_ONCE()

[ Upstream commit d3863210464f69c18615cbe400d48a6e53e770d4 ]

ksm_get_folio() deliberately samples stable_node->kpfn and folio->mapping
without taking the folio lock because the KSM folio may be migrated
concurrently.  folio_migrate_ksm() updates the same state using plain
assignments.

The reader can load the old kpfn, then the migrator can store the new
kpfn, execute smp_wmb(), and clear the old folio's mapping before the
reader checks that mapping.  Thus the initial kpfn load can overlap its
update and the subsequent mapping load can overlap the clear, with no
common lock.  This leaves marked READ_ONCE() accesses racing with plain
stores.

The kernel reported:

  BUG: KCSAN: data-race in folio_migrate_ksm / ksm_get_folio

  read (marked) to 0xffff8ce401421330 of 8 bytes by task 48 on cpu 3:
   ksm_get_folio+0x7f/0x2a0
   ksm_scan_thread+0x1635/0x3330
   kthread+0x1af/0x1f0

  write to 0xffff8ce401421330 of 8 bytes by task 102 on cpu 1:
   folio_migrate_ksm+0x6a/0xd0
   folio_migrate_flags+0x193/0x420
   __migrate_folio.isra.0+0x162/0x1a0
   migrate_folio+0x4c/0x70
   move_to_new_folio+0xd6/0x170

Use WRITE_ONCE() for both stores to pair them with the existing lockless
reads.  This preserves the existing smp_wmb()/smp_rmb() migration protocol
and control flow while preventing compiler transformations of the shared
accesses.

Link: https://lore.kernel.org/20260824112433.191301-1-nicoyip.dev@gmail.com
Fixes: c8d6553b9580 ("ksm: make KSM page migration possible")
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/ksm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/ksm.c b/mm/ksm.c
index 4f672f4f21407d..80274ace8155e7 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1065,7 +1065,8 @@ static inline void folio_set_stable_node(struct folio *folio,
 					 struct ksm_stable_node *stable_node)
 {
 	VM_WARN_ON_FOLIO(folio_test_anon(folio) && PageAnonExclusive(&folio->page), folio);
-	folio->mapping = (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM);
+	WRITE_ONCE(folio->mapping,
+		   (void *)((unsigned long)stable_node | FOLIO_MAPPING_KSM));
 }
 
 #ifdef CONFIG_SYSFS
@@ -3248,7 +3249,7 @@ void folio_migrate_ksm(struct folio *newfolio, struct folio *folio)
 	stable_node = folio_stable_node(folio);
 	if (stable_node) {
 		VM_BUG_ON_FOLIO(stable_node->kpfn != folio_pfn(folio), folio);
-		stable_node->kpfn = folio_pfn(newfolio);
+		WRITE_ONCE(stable_node->kpfn, folio_pfn(newfolio));
 		/*
 		 * newfolio->mapping was set in advance; now we need smp_wmb()
 		 * to make sure that the new stable_node->kpfn is visible

From a793ea58f4a0f4797dabc8d57d92a143e02a9267 Mon Sep 17 00:00:00 2001
From: Qi Xi <xiqi2@huawei.com>
Date: Tue, 25 Aug 2026 20:05:48 +0800
Subject: [PATCH 1379/1982] mm/page_isolation: fix UBSAN shift-out-of-bounds
 warning

[ Upstream commit eba0e6297edd60a85bc96ff5cfb734d066af62dd ]

Patch series "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock", v3.

Patch 1 fixes a UBSAN shift-out-of-bounds warning in the PageBuddy branch
of isolate_single_pageblock() triggered by concurrent buddy allocation.

Patch 2 addresses the same class of issue in the PageCompound branch,
where racy compound_order() and compound_head() reads could lead to
out-of-range shifts or incorrect page skipping.

This patch (of 2):

A contig-range allocation racing with buddy allocation on the adjacent
pageblock can trigger:

 UBSAN: shift-out-of-bounds in mm/page_isolation.c:393:15
 shift exponent -749042176 is negative
 Call trace:
  isolate_single_pageblock
  start_isolate_page_range
  alloc_contig_frozen_range_noprof
  alloc_contig_range_noprof

isolate_single_pageblock() first calls set_migratetype_isolate() with
zone->lock held, which marks the pageblock MIGRATE_ISOLATE and moves any
free page straddling the boundary out of the way.  Once the lock is
dropped, it scans the MAX_ORDER_NR_PAGES-aligned window [start_pfn,
boundary_pfn) locklessly, only to skip the free pages already handled
above and to detect in-use pages straddling the boundary.  Since this
scan only reads page state to decide how far to skip and returns -EBUSY
on a straddling in-use page, it does not take the lock.

The window also covers the adjacent pageblock, whose free pages stay on
the normal movable/CMA freelist and can be allocated concurrently.  So
after the scan observes PageBuddy(page), another CPU can allocate the
page, leaving a stale value in page->private that makes "1 << order" shift
out of range.

Use buddy_order_unsafe() with READ_ONCE to read the order, and validate
it is within MAX_PAGE_ORDER before shifting to prevent UBSAN warnings.

Since pageblock_isolate_and_move_free_pages() already handles free pages
straddling boundary_pfn under zone->lock, bail out with -EBUSY instead
of VM_WARN_ON_ONCE() when a PageBuddy page appears to cross the boundary
during the lockless scan.

Link: https://lore.kernel.org/20260825120549.966271-2-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_isolation.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index f72b6cd38b958b..2ec974fa9726db 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -380,13 +380,19 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
 		}
 
 		if (PageBuddy(page)) {
-			int order = buddy_order(page);
+			unsigned int order = buddy_order_unsafe(page);
 
-			/* pageblock_isolate_and_move_free_pages() handled this */
-			VM_WARN_ON_ONCE(pfn + (1 << order) > boundary_pfn);
-
-			pfn += 1UL << order;
-			continue;
+			/* buddy_order_unsafe() is racy. Validate the order before shifting. */
+			if (order <= MAX_PAGE_ORDER &&
+				/*
+				 * pageblock_isolate_and_move_free_pages() splits
+				 * cross-boundary PageBuddy, verify it.
+				 */
+			    pfn + (1UL << order) <= boundary_pfn) {
+				pfn += 1UL << order;
+				continue;
+			}
+			goto failed;
 		}
 
 		/*

From 21550a58fa0269949d2204be890e76c69ff8d065 Mon Sep 17 00:00:00 2001
From: Qi Xi <xiqi2@huawei.com>
Date: Tue, 25 Aug 2026 20:05:49 +0800
Subject: [PATCH 1380/1982] mm/page_isolation: guard compound_order() against
 racing

[ Upstream commit 4c767c5dd9bc3521fed11e6fe1d52621fe5abf7b ]

The PageCompound branch reads compound_head() without holding a reference.
A racing split or free can cause compound_head() to return a stale
pointer, and compound_nr() reads the order from that stale head, leading
to out-of-range shifts and making the skip distance meaningless.

Read the order explicitly with compound_order() and validate it is within
MAX_FOLIO_ORDER before shifting.  Also verify the derived head_pfn against
the legitimate pfn: the head must not be past pfn, must be aligned to
nr_pages, and pfn must fall within the compound page.  Bail out with
-EBUSY if any check fails.

Link: https://lore.kernel.org/20260825120549.966271-3-xiqi2@huawei.com
Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_isolation.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 2ec974fa9726db..2e366e7bd5e93e 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -411,10 +411,28 @@ static int isolate_single_pageblock(unsigned long boundary_pfn,
 		if (PageCompound(page)) {
 			struct page *head = compound_head(page);
 			unsigned long head_pfn = page_to_pfn(head);
-			unsigned long nr_pages = compound_nr(head);
+			unsigned int order = compound_order(head);
+			unsigned long nr_pages;
+
+			/* compound_order() is racy. Cap it at MAX_FOLIO_ORDER. */
+			if (order > MAX_FOLIO_ORDER)
+				goto failed;
+
+			nr_pages = 1UL << order;
+
+			/*
+			 * compound_head() is also racy, so the derived head_pfn
+			 * needs additional checks to make sure it is valid.
+			 * Otherwise, just fail the check. pfn comes from
+			 * __first_valid_page() as a legitimate PFN, so use it to
+			 * check head_pfn.
+			 */
+			if (head_pfn > pfn || !IS_ALIGNED(head_pfn, nr_pages) ||
+			    pfn - head_pfn >= nr_pages)
+				goto failed;
 
 			if (head_pfn + nr_pages <= boundary_pfn ||
-			    PageHuge(page)) {
+			    PageHuge(head)) {
 				pfn = head_pfn + nr_pages;
 				continue;
 			}

From 1140b3a60d9d8a4ad32381077a8e3d3fa8f4d0bf Mon Sep 17 00:00:00 2001
From: Gregory Price <gourry@gourry.net>
Date: Fri, 28 Aug 2026 15:31:11 -0400
Subject: [PATCH 1381/1982] mm/mempolicy: take a cpuset cookie for the
 interleave node count

[ Upstream commit bbeeb4a29dc4ca6ac18ab3bafa3728bc984a4cde ]

alloc_pages_bulk_interleave() counts pol->nodes without a cpuset cookie:

	nodes = nodes_weight(pol->nodes);
	nr_pages_per_node = nr_pages / nodes;

nodemask_t spans several words once MAX_NUMNODES exceeds BITS_PER_LONG, so
a concurrent cpuset rebind can tear that read and yield an empty mask even
though neither version of it was empty.  The call then allocates nothing
and returns 0.

Some compilers will hoist the loop entry test above the division,
because nr_pages_per_node is dead when the loop does not run.

	682e:	call	...		<- nodes_weight()
	6838:	test	%eax,%eax
	683a:	jle	692d		<- nodes <= 0 skips the loop
	684a:	div	%rcx

So in most deployments, this div/0 is unreachable - but nothing in the
source guarantees that, it's just not easily exercised.

Take the cookie around the count and bail if the mask really is empty.
Only the count needs it, interleave_nodes() takes the cookie itself so so
a torn read there is already retried.

A rebind landing mid-loop can still leave the count disagreeing with the
mask, so the loop may revisit a node or skip one - but a rebind where
nodes change causes migration, so a handful of misplaced pages isn't
catastrophic in any sense.

Measured on a 72 node VM (NODES_SHIFT=10) with a cgroup v2 cpuset flipping
cpuset.mems between a word 0 and a word 1 node set, and the two word read
artificially widened: 330 zero counts in 130414 calls without the cookie,
and 401 retries with it.

Link: https://lore.kernel.org/20260828193111.1023497-1-gourry@gourry.net
Fixes: c00b6b961099 ("mm/vmalloc: introduce alloc_pages_bulk_array_mempolicy to accelerate memory allocation")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Closes: https://lore.kernel.org/all/20250907160829.91628-1-chelsyratnawat2001@gmail.com/
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Assisted-by: Claude:claude-opus-5
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chenwandun <chenwandun@huawei.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mempolicy.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 2a84cecf543556..197a5ea0d76d9a 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2519,6 +2519,7 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
 		struct mempolicy *pol, unsigned long nr_pages,
 		struct page **page_array)
 {
+	unsigned int cpuset_mems_cookie;
 	int nodes;
 	unsigned long nr_pages_per_node;
 	int delta;
@@ -2526,7 +2527,16 @@ static unsigned long alloc_pages_bulk_interleave(gfp_t gfp,
 	unsigned long nr_allocated;
 	unsigned long total_allocated = 0;
 
-	nodes = nodes_weight(pol->nodes);
+	/* count the nodes, retry if a rebind happened during the read */
+	do {
+		cpuset_mems_cookie = read_mems_allowed_begin();
+		nodes = nodes_weight(pol->nodes);
+	} while (read_mems_allowed_retry(cpuset_mems_cookie));
+
+	/* if the nodemask has become invalid, we cannot do anything */
+	if (!nodes)
+		return 0;
+
 	nr_pages_per_node = nr_pages / nodes;
 	delta = nr_pages - nodes * nr_pages_per_node;
 

From da32aae509221f877a7df222e572c4ed28818288 Mon Sep 17 00:00:00 2001
From: Joe Damato <joe@dama.to>
Date: Mon, 31 Aug 2026 10:48:35 -0700
Subject: [PATCH 1382/1982] mm: memcontrol: raise MEMCG_MAX for charges that
 fail without reclaiming

[ Upstream commit 374f65b1481992eb6b9c6bffd53f3afa5c2e94cf ]

Charges that exceed memory.max and return through the nomem label can
raise no event and simply return -ENOMEM.

A non-blocking charge can hit the limit, get rejected, but is not visible
in memory.events.

This was noticed in a production setting where bpf_mem_alloc() attempted
to refill its per-cpu freelists, which triggered a non-blocking charge
while at the limit.

Commit d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for
enforced allocations") added raised_max_event to cover charges that are
force charged without ever reaching reclaim, but charges that are rejected
outright were left out.  Getting an allocation failure without the
corresponding MEMCG_MAX event is unexpected and makes debugging and
monitoring harder.

Raise the event on the way out for rejected charges as well, by routing
the -ENOMEM return through the same exit path that already covers forced
charges.  The existing behavior of raising a MEMCG_MAX event on every
charge/reclaim/retry iteration is left unchanged.

Tested with a module that performs accounted GFP_NOWAIT page allocations
from a task in a cgroup at its memory.max, and measures the resulting
memory.events:max delta.  Without this patch the rejected charges raise no
event at all; with it the delta matches the number of rejected charges
exactly.  A GFP_KERNEL|__GFP_NORETRY control, which reaches reclaim,
raises the same two events per failed charge before and after, confirming
the existing charge/reclaim/retry accounting is unchanged.

Link: https://lore.kernel.org/20260831174836.3102406-1-joe@dama.to
Fixes: d6e103a757fa ("mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations")
Signed-off-by: Joe Damato <joe@dama.to>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memcontrol.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 82ad23d689c7fe..2aa741316b49f7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2311,10 +2311,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	bool raised_max_event = false;
 	unsigned long pflags;
 	bool allow_spinning = gfpflags_allow_spinning(gfp_mask);
+	int ret = 0;
 
 retry:
 	if (consume_stock(memcg, nr_pages))
-		return 0;
+		return ret;
 
 	if (!allow_spinning)
 		/* Avoid the refill and flush of the older stock */
@@ -2424,16 +2425,11 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	 * put the burden of reclaim on regular allocation requests
 	 * and let these go through as privileged allocations.
 	 */
-	if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH)))
-		return -ENOMEM;
+	if (!(gfp_mask & (__GFP_NOFAIL | __GFP_HIGH))) {
+		ret = -ENOMEM;
+		goto out;
+	}
 force:
-	/*
-	 * If the allocation has to be enforced, don't forget to raise
-	 * a MEMCG_MAX event.
-	 */
-	if (!raised_max_event)
-		__memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
-
 	/*
 	 * The allocation either can't fail or will lead to more memory
 	 * being freed very soon.  Allow memory usage go over the limit
@@ -2443,7 +2439,15 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	if (do_memsw_account())
 		page_counter_charge(&memcg->memsw, nr_pages);
 
-	return 0;
+out:
+	/*
+	 * Don't forget to raise a MEMCG_MAX event for forced or rejected
+	 * requests.
+	 */
+	if (!raised_max_event)
+		__memcg_memory_event(mem_over_limit, MEMCG_MAX, allow_spinning);
+
+	return ret;
 
 done_restock:
 	if (batch > nr_pages)
@@ -2502,7 +2506,7 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	    !(current->flags & PF_MEMALLOC) &&
 	    gfpflags_allow_blocking(gfp_mask))
 		__mem_cgroup_handle_over_high(gfp_mask);
-	return 0;
+	return ret;
 }
 
 static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,

From 5025b3035b74cba1bdd3a7d753338dc6cdaea47d Mon Sep 17 00:00:00 2001
From: Zhiling Zou <roxy520tt@gmail.com>
Date: Tue, 21 Jul 2026 23:56:38 +0800
Subject: [PATCH 1383/1982] mm/page_table_check: skip zero pages

[ Upstream commit 33afd07412a1efe5b750a3fd5eb0272ebdd12761 ]

page_table_check_set() accounts pages by whether they are PageAnon().  The
shared zero page is a special page, not an ordinary file-backed page.
Read faults on private anonymous mappings can install many read-only PTEs
that point at the zero page, but page_table_check currently accounts them
in file_map_count.

That lets an unprivileged process populate enough zero-page mappings to
overflow file_map_count and trip the BUG_ON() in page_table_check_set().

Skip zero pages in page_table_check accounting.  They do not need the
anonymous/file mapping conflict checks that page_table_check performs for
ordinary pages, and this keeps the existing counter size and page_ext
layout unchanged.

Link: https://lore.kernel.org/1f8848512d2e3ded944f8d595c29faee8fdaeab0.1784645969.git.roxy520tt@gmail.com
Fixes: df4e817b7108 ("mm: page table check")
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Cc: Ye Liu <liuye@kylinos.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_table_check.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/page_table_check.c b/mm/page_table_check.c
index 91c4dacc41fb82..fa2c12e76a9e75 100644
--- a/mm/page_table_check.c
+++ b/mm/page_table_check.c
@@ -67,7 +67,7 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
 	struct page *page;
 	bool anon;
 
-	if (!pfn_valid(pfn))
+	if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
 		return;
 
 	page = pfn_to_page(pfn);
@@ -102,7 +102,7 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt,
 	struct page *page;
 	bool anon;
 
-	if (!pfn_valid(pfn))
+	if (!pfn_valid(pfn) || is_zero_pfn(pfn) || is_huge_zero_pfn(pfn))
 		return;
 
 	page = pfn_to_page(pfn);

From 3f70cd14b0aa2d1f2162a2e072edad2ebe1e14de Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Tue, 1 Sep 2026 06:18:43 -0700
Subject: [PATCH 1384/1982] mm/damon/paddr: respect folio end for DAMOS_STAT

[ Upstream commit ac733f921d4fc02da70a98b175a6055a206b2a36 ]

The function for applying DAMOS_STAT in DAMON physical address space
operation set (paddr), namely damon_pa_stat(), applies DAMOS filters to
folios of the given region.  For that, it gets folios of addresses in the
region.  It starts from the region start address and advances the address
by the size of the folio of the address until it goes out of the region.
If the start address is in the middle of a large folio, and if the next
folios are small, some of the next folios could be skipped.  Fix the issue
by advancing the address to exactly the start address of the next folio.

The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate.  Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem.  It is arguably
not critical since it is only monitoring quality degradation.

Link: https://lore.kernel.org/20260901131850.98037-3-sj@kernel.org
Fixes: bdbe1d7bc325 ("mm/damon/paddr: increment pa_stat damon address range by folio size")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.14.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/paddr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 1854b4bb6bd296..5720e73930f842 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -300,7 +300,7 @@ static unsigned long damon_pa_stat(struct damon_region *r,
 
 		if (!damos_pa_filter_out(s, folio))
 			*sz_filter_passed += folio_size(folio) / addr_unit;
-		addr += folio_size(folio);
+		addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
 		folio_put(folio);
 	}
 	s->last_applied = folio;

From 9511b63a1f0df7aadf9e06247f66c8dd069bd0e3 Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Tue, 1 Sep 2026 06:18:44 -0700
Subject: [PATCH 1385/1982] mm/damon/paddr: respect folio end for DAMOS actions
 except STAT

[ Upstream commit 1613ac9edf385c35f171a25610e2706a7e6afad6 ]

A few functions for applying DAMOS actions including pageout, lru_[de]prio
and migrate_{hot,cold} in DAMON physical address space operation set
(paddr) collect folios of the given region by getting the folios of
region-internal addresses.  Then, those functions apply the action to the
collected folios at once.  The collection starts from the region start
address and advances the address by the size of the folio of the address
until it goes out of the region.  If the start address is in the middle of
a large folio, and if the next folios are small, some of the next folios
could be skipped.  Fix the issue by advancing the address to exactly the
start address of the next folio.

The user impact is that DAMOS action is applied to less than expected
amount of memory.  Given the best effort nature of DAMON, it is no big
problem, but it is clearly a bug that is better to be fixed.

The issue was discovered [1] by Sashiko.

Link: https://lore.kernel.org/20260901131850.98037-4-sj@kernel.org
Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1]
Fixes: 3a06696305e7 ("mm/damon/ops: have damon_get_folio return folio even for tail pages")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.15.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/paddr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c
index 5720e73930f842..ddd26a78a9bc62 100644
--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
@@ -183,7 +183,7 @@ static unsigned long damon_pa_pageout(struct damon_region *r,
 		else
 			list_add(&folio->lru, &folio_list);
 put_folio:
-		addr += folio_size(folio);
+		addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
 		folio_put(folio);
 	}
 	if (install_young_filter)
@@ -221,7 +221,7 @@ static inline unsigned long damon_pa_mark_accessed_or_deactivate(
 			folio_deactivate(folio);
 		applied += folio_nr_pages(folio);
 put_folio:
-		addr += folio_size(folio);
+		addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
 		folio_put(folio);
 	}
 	s->last_applied = folio;
@@ -271,7 +271,7 @@ static unsigned long damon_pa_migrate(struct damon_region *r,
 				folio_is_file_lru(folio));
 		list_add(&folio->lru, &folio_list);
 put_folio:
-		addr += folio_size(folio);
+		addr = PFN_PHYS(folio_pfn(folio)) + folio_size(folio);
 		folio_put(folio);
 	}
 	applied = damon_migrate_pages(&folio_list, s->target_nid);

From eea4e41924e88163d4ae72dff91736ab99fbec7c Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Tue, 1 Sep 2026 06:18:45 -0700
Subject: [PATCH 1386/1982] mm/damon/vaddr: respect folio end for DAMOS_STAT

[ Upstream commit 946351a5fc5d4e3afec2bdf735935d17d6c9ceb2 ]

For applying DAMOS_STAT action to a region, DAMON virtual address space
operation set (vaddr) calls walk_page_range[_vma]() for the region.  The
pmd walk entry function, namely damon_va_stat_pmd_entry(), applies DAMOS
filters to folios of addresses of the region in the pmd.  It starts from
the walking address and advances the address by the size of the folio of
the address until it goes out of the pmd or the region.

Let's suppose it is for the first pmd of the region, and the region start
address is in the middle of a large folio.  Also, the next folios are
small.  Then, some of the next folios could be skipped.  Fix the issue by
advancing the address to exactly the start address of the next folio.

The user impact is that the DAMOS_STAT-based page level monitoring results
become inaccurate.  Since the page level monitoring is supposed to provide
relatively high precision, this is definitely a problem.  It is arguably
not critical since it is only monitoring quality degradation.

The issue was discovered [1] by Sashiko.

Link: https://lore.kernel.org/20260901131850.98037-5-sj@kernel.org
Link: https://lore.kernel.org/20260514015053.149396-1-sj@kernel.org [1]
Fixes: 63f39737d1e3 ("mm/damon/vaddr: support stat-purpose DAMOS filters")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/vaddr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index cfa7849041ad92..7d4d7565e8ee3f 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -925,6 +925,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
 		return 0;
 
 	for (; addr < next; pte += nr, addr += nr * PAGE_SIZE) {
+		unsigned long page_idx;
+
 		nr = 1;
 		ptent = ptep_get(pte);
 
@@ -938,7 +940,8 @@ static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,
 
 		if (!damos_va_filter_out(s, folio, vma, addr, pte, NULL))
 			*sz_filter_passed += folio_size(folio);
-		nr = folio_nr_pages(folio);
+		page_idx = folio_page_idx(folio, pte_page(ptent));
+		nr = folio_nr_pages(folio) - page_idx;
 		s->last_applied = folio;
 	}
 	pte_unmap_unlock(start_pte, ptl);

From 34902f2cbcc8d218f64f0ff827c131f26ba01630 Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Tue, 1 Sep 2026 06:18:47 -0700
Subject: [PATCH 1387/1982] mm/damon/core: handle extreme memory state in
 damon_get_node_mem_bp()

[ Upstream commit 485a9149ad406e00949327a3231b9084d7073706 ]

In an extreme and unlikely situation, si_meminfo_node() might let the
caller show zero total ram.  That could cause a divide by zero in
damon_get_node_mem_bp().  It could also show free memory larger than the
total memory.  This could cause underflow and make DAMOS temporarily make
unexpected behavior.  Thanks to safety guards in the auto-tuning feedback
loop, that should not be a real problem, though.  Fix the problems by
respectively returning 100% and 0% for used and free memory queries in the
corner cases.

The issue was discovered [1] by Sashiko.

Link: https://lore.kernel.org/20260901131850.98037-7-sj@kernel.org
Link: https://lore.kernel.org/20260328133216.9697-1-sj@kernel.org [1]
Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org> # 6.16.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 8fa788b0d709c9..0bed1cd9e3a237 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2145,6 +2145,13 @@ static __kernel_ulong_t damos_get_node_mem_bp(
 	}
 
 	si_meminfo_node(&i, goal->nid);
+	if (!i.totalram || i.totalram < i.freeram) {
+		if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
+			return 10000;
+		else	/* DAMOS_QUOTA_NODE_MEM_FREE_BP */
+			return 0;
+	}
+
 	if (goal->metric == DAMOS_QUOTA_NODE_MEM_USED_BP)
 		numerator = i.totalram - i.freeram;
 	else	/* DAMOS_QUOTA_NODE_MEM_FREE_BP */

From 4a73bd9f0b78a97c91389dc8c356079e6085894d Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Tue, 1 Sep 2026 17:27:23 -0700
Subject: [PATCH 1388/1982] mm/damon/sysfs: set next refresh jiffies per sysfs
 context

[ Upstream commit b9100ecb5411d2de79175ed534df72ec41e94998 ]

When 'refresh_ms' is set, DAMON sysfs interface periodically updates
auto-tuned parameters and DAMOS stats.  The timestamp for the next refresh
is initialized when a DAMON context starts, and updated in its
damon_call() callback function.  That is, each DAMON context updates it.
However, the timestamp is a global variable that is shared with all the
contexts.  When there are multiple DAMON contexts having different
refresh_ms, the update frequency will be changed, depending on the order
of the contexts.  When there are multiple kdamonds, it will be even more
chaotic.  Fix the problem by having the timestamp per each context.

The user impact is not very critical.  It does not leak, corrupt or crash.
The update will not be faster or slower than the lowest and largest
refresh_ms values of the contexts, respectively.  The user can also
manually ask the updates on demand using kdamond state commands.  That
said, clearly this is a bug and can easily be reproduced.

Link: https://lore.kernel.org/20260902002725.108635-5-sj@kernel.org
Fixes: 9fd7bb5083d1 ("mm/damon/sysfs: change next_update_jiffies to a global variable")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lian Wang <lianux.mm@gmail.com>
Tested-by: Lian Wang <lianux.mm@gmail.com>
Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/sysfs.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
index 3a79d8c89b5bb6..1ae026d099a2ea 100644
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1199,6 +1199,7 @@ struct damon_sysfs_kdamond {
 	struct damon_sysfs_contexts *contexts;
 	struct damon_ctx *damon_ctx;
 	unsigned int refresh_ms;
+	unsigned long next_refresh_jiffies;
 };
 
 static struct damon_sysfs_kdamond *damon_sysfs_kdamond_alloc(void)
@@ -1567,17 +1568,15 @@ static struct damon_ctx *damon_sysfs_build_ctx(
 	return ctx;
 }
 
-static unsigned long damon_sysfs_next_update_jiffies;
-
 static int damon_sysfs_repeat_call_fn(void *data)
 {
 	struct damon_sysfs_kdamond *sysfs_kdamond = data;
 
 	if (!sysfs_kdamond->refresh_ms)
 		return 0;
-	if (time_before(jiffies, damon_sysfs_next_update_jiffies))
+	if (time_before(jiffies, sysfs_kdamond->next_refresh_jiffies))
 		return 0;
-	damon_sysfs_next_update_jiffies = jiffies +
+	sysfs_kdamond->next_refresh_jiffies = jiffies +
 		msecs_to_jiffies(sysfs_kdamond->refresh_ms);
 
 	if (!mutex_trylock(&damon_sysfs_lock))
@@ -1645,8 +1644,8 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
 	}
 	kdamond->damon_ctx = ctx;
 
-	damon_sysfs_next_update_jiffies =
-		jiffies + msecs_to_jiffies(kdamond->refresh_ms);
+	kdamond->next_refresh_jiffies = jiffies +
+		msecs_to_jiffies(kdamond->refresh_ms);
 
 	repeat_call_control->fn = damon_sysfs_repeat_call_fn;
 	repeat_call_control->data = kdamond;

From a1b937d0e196b32a6a99022b764f2c986e961838 Mon Sep 17 00:00:00 2001
From: DAI RENJIE <drj19981414013@gmail.com>
Date: Fri, 21 Aug 2026 14:08:17 +0000
Subject: [PATCH 1389/1982] resource: fix lost wakeup when waiting for a muxed
 region

[ Upstream commit 405c00e43a9c72a0b9b318cc2d2e298386ffb58e ]

A task waiting for a muxed region can sleep forever in
TASK_UNINTERRUPTIBLE even though the region it waits for is already free.
__request_region_locked() queues itself on muxed_resource_wait and drops
resource_lock before setting TASK_UNINTERRUPTIBLE, while
__release_region() wakes the queue after dropping the same lock.  A wakeup
landing in between finds TASK_RUNNING, does not match TASK_NORMAL and is
discarded; callers hold a muxed region only across a bounded transaction,
so no further release is coming.  The task is unkillable and its caller
never returns.

The window is one store wide, but an interrupt is enough to hold the
waiter in it, and the machine this was seen on runs PREEMPT_DYNAMIC in its
voluntary default.  Since v6.11 spd5118 exports the DDR5 sensors of AMD
boards through i2c-piix4, which takes a muxed region per SMBus
transaction; a third of the in-tree users of request_muxed_region() are
hwmon drivers, so reading a world-readable attribute is all an
unprivileged user needs to drive the contention.  The blocked task sleeps
holding the i2c adapter bus lock, and 27 more piled up behind it.

Reproduced by building a kernel with the two orderings selectable at
runtime and a 2ms delay inside the window.  Switching only that knob, a
two-thread barriered reproducer loses the wakeup 200 times out of 200
before the fix and 0 out of 200 after it; without the delay it goes 20000
times through the wait path and loses none.

Fix it by setting the task state before dropping resource_lock, as
prepare_to_wait() does: the releasing side needs resource_lock to unlink
the resource, so it cannot reach the wakeup before the state is published.

Link: https://lore.kernel.org/20260821-b4-resource-muxed-lost-wakeup-v1-1-37eb6473a76c@gmail.com
Fixes: 8b6d043b7ee2 ("resource: shared I/O region support")
Signed-off-by: DAI RENJIE <drj19981414013@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Mark Brown <broonie@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index fe1327753a135a..139fb5e19cbe09 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1300,8 +1300,8 @@ static int __request_region_locked(struct resource *res, struct resource *parent
 		}
 		if (conflict->flags & flags & IORESOURCE_MUXED) {
 			add_wait_queue(&muxed_resource_wait, &wait);
-			write_unlock(&resource_lock);
 			set_current_state(TASK_UNINTERRUPTIBLE);
+			write_unlock(&resource_lock);
 			schedule();
 			remove_wait_queue(&muxed_resource_wait, &wait);
 			write_lock(&resource_lock);

From 50f237e8fcf93c174848be346d11167c51b1eb5c Mon Sep 17 00:00:00 2001
From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Date: Tue, 25 Aug 2026 21:11:32 +0900
Subject: [PATCH 1390/1982] fat: fix fat_ent_write() for reverting the value

[ Upstream commit 63c4b67ee163b2a67a7561314bf2106d6c79c53c ]

commit 64d9183203ee ("fat: restore original value when fat_ent_write
failed") try to revert the fatent value to old value when got the error on
mirror FAT.

However it didn't work if the error is when writing the fatent bh.  In
that case, the bh is cleared the uptodate flag, so reuse bh is invalid.

Fix this by reverting the fatent only if got the error on mirror FAT.

Link: https://lore.kernel.org/87ik4yz9fv.fsf_-_@mail.parknet.co.jp
Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed")
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e64c6472a3d96a75172a
Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
Cc: Yemu Lu <prcups@krgm.moe>
Cc: Ren Wei <n05ec@lzu.edu.cn>
Cc: Yuan Tan <yuantan098@gmail.com>
Cc: Yifan Wu <yifanwucs@gmail.com>
Cc: Juefei Pu <tomapufckgml@gmail.com>
Cc: Xin Liu <bird@lzu.edu.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fat/fat.h    |  2 +-
 fs/fat/fatent.c | 21 ++++++++++++++++++---
 fs/fat/file.c   |  3 ++-
 fs/fat/misc.c   |  6 ++----
 4 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index d3e426de5f016a..6748dea6cd216c 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -389,7 +389,7 @@ extern void fat_ent_access_init(struct super_block *sb);
 extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
 			int entry);
 extern int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
-			 int new, int wait);
+			 int new, int old, int wait);
 extern int fat_alloc_clusters(struct inode *inode, int *cluster,
 			      int nr_cluster);
 extern int fat_free_clusters(struct inode *inode, int cluster);
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index a7061c2ad8e4d2..515bc0cfc64f10 100644
--- a/fs/fat/fatent.c
+++ b/fs/fat/fatent.c
@@ -408,7 +408,7 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
 }
 
 int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
-		  int new, int wait)
+		  int new, int old, int wait)
 {
 	struct super_block *sb = inode->i_sb;
 	const struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops;
@@ -417,10 +417,25 @@ int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
 	ops->ent_put(fatent, new);
 	if (wait) {
 		err = fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
-		if (err)
+		if (err) {
+			/*
+			 * bhs are not uptodate after I/O error. So we
+			 * can't simply re-dirty to revert. And it
+			 * would not have value to write again on I/O
+			 * error.
+			 */
 			return err;
+		}
 	}
-	return fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+
+	err = fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+	if (err) {
+		/* Try to revert if got the error on mirror FAT */
+		ops->ent_put(fatent, old);
+		if (wait)
+			fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
+	}
+	return err;
 }
 
 static inline int fat_ent_next(struct msdos_sb_info *sbi,
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 4fc49a614fb8fd..ca2f9db34da5c6 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -360,7 +360,8 @@ static int fat_free(struct inode *inode, int skip)
 				     __func__, MSDOS_I(inode)->i_pos);
 			ret = -EIO;
 		} else if (ret > 0) {
-			err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait);
+			err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, ret,
+					    wait);
 			if (err)
 				ret = err;
 		}
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index 5c45603bf77ea3..c0bc4356eded31 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -133,11 +133,9 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster)
 		ret = fat_ent_read(inode, &fatent, last);
 		if (ret >= 0) {
 			int wait = inode_needs_sync(inode);
-			int old = ret;
 
-			ret = fat_ent_write(inode, &fatent, new_dclus, wait);
-			if (ret < 0)
-				fat_ent_write(inode, &fatent, old, wait);
+			ret = fat_ent_write(inode, &fatent, new_dclus, ret,
+					    wait);
 			fatent_brelse(&fatent);
 		}
 		if (ret < 0)

From de69081c154e85db8f80ff260344881636e969a8 Mon Sep 17 00:00:00 2001
From: Michael Liang <mliang@purestorage.com>
Date: Fri, 21 Aug 2026 12:15:27 -0600
Subject: [PATCH 1391/1982] fault-inject: fix dentry leak

[ Upstream commit ceb43516a9aae0d969a4ec5ab40d45bd09e64229 ]

fault_create_debugfs_attr() has always taken an extra dentry reference on
the created directory (attr->dname = dget(dir)) so that fail_dump() could
print the name via %pd from any context.  Nothing anywhere in the tree
ever calls dput() on attr->dname.

For callers with a matching teardown, that unmatched reference causes one
dentry plus its attached inode to leak per fault_create_debugfs_attr /
debugfs_remove_recursive cycle.  simple_recursive_removal() drops
debugfs's own +1 ref on the child dentry, but the dget()'d ref keeps its
refcount at 1: the dentry ends up unhashed but pinned, and its inode is
never freed.

Boot-once callers (mm/failslab, block/blk-core, etc.) leak exactly once at
init and never destroy the tree, so the impact there is bounded.  But
per-lifecycle callers (drivers/nvme, drivers/infiniband/hw/hfi1,
drivers/mmc, drivers/iommu/iommufd, drivers/media, drivers/misc,
drivers/gpu/drm/msm, drivers/crypto, net/sunrpc) leak on every
create/destroy cycle.

We observed this in production: an NVMe/RDMA host repeatedly reconnecting
to a target that rejected the CRTO Property Get went through ~50 nvme
controller create/destroy cycles per second, and dentry and inode_cache
grew by ~13k pinned objects per 240 s -- unrecoverable through
drop_caches.  Byte math matched a per-cycle 1-dentry / 1-inode leak from
the "fault_inject" directory dentry.

Fix this by not holding any external reference in fault_attr.  Embed the
directory name as a fixed-size char array (FAULT_ATTR_DNAME_LEN, 64 bytes)
inside struct fault_attr, copied by strscpy() at
fault_create_debugfs_attr() time.  fail_dump() prints it via %s.

Advantages of an embedded array over kstrdup() + kfree() paired with a new
destroy API:

  - Zero API footprint.  No new export and no caller changes required:
    callers already own their fault_attr's memory and free it when
    they are done, and now that suffices.
  - No allocation on the create path.
  - fault_create_debugfs_attr() cannot fail from the name-copy step.
  - No lifetime coupling between attr->dname and debugfs; the string
    is valid for exactly as long as the containing struct.

The 64-byte length accommodates every in-tree caller with generous
headroom (the longest current name is "fail_dma_array_full", 19 chars).

The user-visible fail_dump() format changes from "name %pd" to "name %s",
but the printed content is identical -- %pd on the created directory
renders the same string that was passed in as @name.

drivers/infiniband/hw/hfi1/fault.c drops a now-invalid "attr.dname = NULL"
statement; the surrounding kzalloc() already zero-initialises the array.

Link: https://lore.kernel.org/20260821181527.3271414-1-mliang@purestorage.com
Fixes: 6adc4a22f20b ("fault-inject: add ratelimit option")
Signed-off-by: Michael Liang <mliang@purestorage.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Akinbou Mita <akinobu.mita@gmail.com>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/fault.c |  1 -
 include/linux/fault-inject.h       | 10 ++++++++--
 lib/fault-inject.c                 |  7 +++++--
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index a45cbffd52c71b..b6acc0edb116e4 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -216,7 +216,6 @@ int hfi1_fault_init_debugfs(struct hfi1_ibdev *ibd)
 	ibd->fault->attr.interval = 1;
 	ibd->fault->attr.require_end = ULONG_MAX;
 	ibd->fault->attr.stacktrace_depth = 32;
-	ibd->fault->attr.dname = NULL;
 	ibd->fault->attr.verbose = 0;
 	ibd->fault->enable = false;
 	ibd->fault->opcode = false;
diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h
index 8c829d28dcf356..f55b51f333467b 100644
--- a/include/linux/fault-inject.h
+++ b/include/linux/fault-inject.h
@@ -14,6 +14,13 @@ struct kmem_cache;
 #include <linux/configfs.h>
 #include <linux/ratelimit.h>
 
+/*
+ * Length of the debugfs directory name embedded in struct fault_attr.
+ * Chosen to accommodate every in-tree caller of fault_create_debugfs_attr()
+ * (the longest is "fail_dma_array_full", 19 chars) with generous headroom.
+ */
+#define FAULT_ATTR_DNAME_LEN	64
+
 /*
  * For explanation of the elements of this struct, see
  * Documentation/fault-injection/fault-injection.rst
@@ -33,7 +40,7 @@ struct fault_attr {
 
 	unsigned long count;
 	struct ratelimit_state ratelimit_state;
-	struct dentry *dname;
+	char dname[FAULT_ATTR_DNAME_LEN];
 };
 
 enum fault_flags {
@@ -47,7 +54,6 @@ enum fault_flags {
 		.stacktrace_depth = 32,					\
 		.ratelimit_state = RATELIMIT_STATE_INIT_DISABLED,	\
 		.verbose = 2,						\
-		.dname = NULL,						\
 	}
 
 #define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index 999053fa133e3f..02916ef2761c60 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -5,6 +5,7 @@
 #include <linux/debugfs.h>
 #include <linux/sched.h>
 #include <linux/stat.h>
+#include <linux/string.h>
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/export.h>
@@ -64,7 +65,7 @@ static void fail_dump(struct fault_attr *attr)
 {
 	if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) {
 		printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
-		       "name %pd, interval %lu, probability %lu, "
+		       "name %s, interval %lu, probability %lu, "
 		       "space %d, times %d\n", attr->dname,
 		       attr->interval, attr->probability,
 		       atomic_read(&attr->space),
@@ -261,7 +262,9 @@ struct dentry *fault_create_debugfs_attr(const char *name,
 	debugfs_create_xul("reject-end", mode, dir, &attr->reject_end);
 #endif /* CONFIG_FAULT_INJECTION_STACKTRACE_FILTER */
 
-	attr->dname = dget(dir);
+	if (strscpy(attr->dname, name, sizeof(attr->dname)) == -E2BIG)
+		pr_warn("FAULT_INJECTION: name '%s' truncated to '%s'\n",
+			name, attr->dname);
 	return dir;
 }
 EXPORT_SYMBOL_GPL(fault_create_debugfs_attr);

From afc4b63805254c0c1ae515e69383567c8b57d6ac Mon Sep 17 00:00:00 2001
From: Zi Yan <ziy@nvidia.com>
Date: Thu, 20 Aug 2026 09:19:12 -0400
Subject: [PATCH 1392/1982] USB: gadgetfs: do not WARN about excessively large
 memory allocations

[ Upstream commit a156148976eac47bee7210097afbb609cafe88b6 ]

GadgetFS passes an excessively large user input len to kmalloc and kmalloc
gives a WARN (see below for details).  Suppress it by passing __GFP_NOWARN
to kmalloc used by both ep_write_iter() and ep_read_iter().  Follow the
same method as commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about
excessively large memory allocations").

kmalloc is used to allocate physically contiguous memory for kernel
allocations.  For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc
uses the page allocator and can only support up to KMALLOC_MAX_SIZE.  For
request sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a
WARN because kmalloc allocates an order greater than MAX_PAGE_ORDER.

Link: https://lore.kernel.org/DKTTMAS94IMH.2C6ERY0ZIVWVZ@nvidia.com
Fixes: b3c466ce5129 ("page allocator: do not sanity check order in the fast path")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/legacy/inode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 677cd236f079c4..c14e8e250037de 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -615,7 +615,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
 		return -EBADMSG;
 	}
 
-	buf = kmalloc(len, GFP_KERNEL);
+	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
 	if (unlikely(!buf)) {
 		mutex_unlock(&epdata->lock);
 		return -ENOMEM;
@@ -677,7 +677,7 @@ ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
 		return -EBADMSG;
 	}
 
-	buf = kmalloc(len, GFP_KERNEL);
+	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
 	if (unlikely(!buf)) {
 		mutex_unlock(&epdata->lock);
 		return -ENOMEM;

From 46e0c9c62927b0dbef2d284d2aa770eab588ebb1 Mon Sep 17 00:00:00 2001
From: Thorsten Blum <blum@kernel.org>
Date: Wed, 26 Aug 2026 12:09:03 +0200
Subject: [PATCH 1393/1982] init: fix early boot crash with bare hostname
 parameter

[ Upstream commit b6bec5b63a5b812145e53aaad1e63661c7214f93 ]

When a bare hostname parameter is specified on the kernel command line
without the '=' separator, early parameter parsing passes NULL to
early_hostname(), which dereferences it in strscpy() and can crash the
system during early boot.

Reject NULL values in early_hostname() and return -EINVAL instead.

Link: https://lore.kernel.org/20260826100904.296151-2-blum@kernel.org
Fixes: 5a704629f2c1 ("init: add "hostname" kernel parameter")
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Moulding <dmoulding@me.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 init/version.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/init/version.c b/init/version.c
index 94c96f6fbfe6a2..0bd5c45aabc463 100644
--- a/init/version.c
+++ b/init/version.c
@@ -23,6 +23,9 @@ static int __init early_hostname(char *arg)
 	size_t maxlen  = bufsize - 1;
 	ssize_t arglen;
 
+	if (!arg)
+		return -EINVAL;
+
 	arglen = strscpy(init_uts_ns.name.nodename, arg, bufsize);
 	if (arglen < 0) {
 		pr_warn("hostname parameter exceeds %zd characters and will be truncated",

From 4db84320615453cf205febbc59a715ace31f9782 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Fri, 28 Aug 2026 19:28:23 +0800
Subject: [PATCH 1394/1982] ocfs2: exit recovery thread on mount error path

[ Upstream commit 6163a859649e9432e9c79c541f36dbf3bba9172f ]

When a mount fails after the cluster connection has been established, e.g.
in ocfs2_mount_volume(), ocfs2_fill_super() unwinds via
out_debugfs/out_super and frees the osb without disabling recovery.

A node failure event can concurrently launch the recovery thread, which
blocks in __ocfs2_wait_on_mount() waiting for the volume state to become
VOLUME_MOUNTED or VOLUME_DISABLED.  As the mount error path neither sets
VOLUME_DISABLED nor wakes osb_mount_event, the thread can never make
progress: the kthread leaks and stays blocked on the wait queue embedded
in the freed osb, which may then be accessed as freed memory.

Fix it by setting VOLUME_DISABLED and waking osb_mount_event on this path
so the thread bails out, and replace the plain kfree(osb->recovery_map)
with ocfs2_recovery_exit(), which waits for a running recovery thread to
exit before the recovery map is freed.

Link: https://lore.kernel.org/20260828112825.666097-1-joseph.qi@linux.alibaba.com
Fixes: f1e75d128b46 ("ocfs2: rewrite error handling of ocfs2_fill_super")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/super.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index dc252b53c7dcf3..433b673ae51584 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1170,8 +1170,17 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 out_debugfs:
 	debugfs_remove_recursive(osb->osb_debug_root);
 out_super:
+	/*
+	 * A recovery thread launched by a node failure event may still be
+	 * waiting for the volume to be mounted.  Set VOLUME_DISABLED and
+	 * wake it up, then wait for it to exit before osb is freed,
+	 * otherwise the kthread would leak and stay blocked on the wait
+	 * queue embedded in the freed osb.
+	 */
+	atomic_set(&osb->vol_state, VOLUME_DISABLED);
+	wake_up(&osb->osb_mount_event);
 	ocfs2_release_system_inodes(osb);
-	kfree(osb->recovery_map);
+	ocfs2_recovery_exit(osb);
 	ocfs2_delete_osb(osb);
 	kfree(osb);
 out:

From 407e148354ac954f70a1b54077b4a6ea0f669dbe Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Fri, 28 Aug 2026 19:28:24 +0800
Subject: [PATCH 1395/1982] ocfs2: free replay slots in ocfs2_recovery_exit()

[ Upstream commit 1ddadc6d41c1a29fd8fad1891bdcd2956e08b7f0 ]

Commit ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
added ocfs2_free_replay_slots() calls to the mount error paths
out_dismount and out_check_volume to fix a leak of osb->replay_map.
However these calls are unlocked while the bail path of the recovery
thread, which is woken up by out_dismount right before the call, also
frees the replay slots under osb->recovery_lock.  Both sides can thus
observe a non-NULL osb->replay_map and trigger a double free.

Fix this by moving ocfs2_free_replay_slots() into ocfs2_recovery_exit()
after ocfs2_recovery_disable(), which waits for a running recovery thread
to exit under osb->recovery_lock, and drop the unlocked call sites.  Both
ocfs2_dismount_volume() and the out_super path of ocfs2_fill_super() call
ocfs2_recovery_exit(), so the replay slots are freed on every path.  Since
super.c no longer references it, make ocfs2_free_replay_slots() static
again.

Link: https://lore.kernel.org/20260828112825.666097-2-joseph.qi@linux.alibaba.com
Fixes: ce2fcf1516d6 ("ocfs2: fix memory leak in ocfs2_mount_volume()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/journal.c | 3 ++-
 fs/ocfs2/journal.h | 1 -
 fs/ocfs2/super.c   | 5 +----
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 8c07610692d062..2b8b57e914f085 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -158,7 +158,7 @@ static void ocfs2_queue_replay_slots(struct ocfs2_super *osb,
 	replay_map->rm_state = REPLAY_DONE;
 }
 
-void ocfs2_free_replay_slots(struct ocfs2_super *osb)
+static void ocfs2_free_replay_slots(struct ocfs2_super *osb)
 {
 	struct ocfs2_replay_map *replay_map = osb->replay_map;
 
@@ -246,6 +246,7 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
 	/* XXX: Should we bug if there are dirty entries? */
 
 	kfree(rm);
+	ocfs2_free_replay_slots(osb);
 }
 
 static int __ocfs2_recovery_map_test(struct ocfs2_super *osb,
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index f8b3b2a3d6309e..19fc920d26b1cd 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -151,7 +151,6 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb);
 void ocfs2_recovery_disable_quota(struct ocfs2_super *osb);
 
 int ocfs2_compute_replay_slots(struct ocfs2_super *osb);
-void ocfs2_free_replay_slots(struct ocfs2_super *osb);
 /*
  *  Journal Control:
  *  Initialize, Load, Shutdown, Wipe a journal.
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 433b673ae51584..fe4ab1659e0d9d 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1163,7 +1163,6 @@ static int ocfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 out_dismount:
 	atomic_set(&osb->vol_state, VOLUME_DISABLED);
 	wake_up(&osb->osb_mount_event);
-	ocfs2_free_replay_slots(osb);
 	ocfs2_dismount_volume(sb, 1);
 	goto out;
 
@@ -1778,14 +1777,12 @@ static int ocfs2_mount_volume(struct super_block *sb)
 	status = ocfs2_truncate_log_init(osb);
 	if (status < 0) {
 		mlog_errno(status);
-		goto out_check_volume;
+		goto out_system_inodes;
 	}
 
 	ocfs2_super_unlock(osb, 1);
 	return 0;
 
-out_check_volume:
-	ocfs2_free_replay_slots(osb);
 out_system_inodes:
 	if (osb->local_alloc_state == OCFS2_LA_ENABLED)
 		ocfs2_shutdown_local_alloc(osb);

From 70ba414a149b74728e5debe71a6e5ac4f71d4152 Mon Sep 17 00:00:00 2001
From: Konstantin Khorenko <khorenko@virtuozzo.com>
Date: Fri, 14 Aug 2026 18:57:09 +0200
Subject: [PATCH 1396/1982] selftests/core: fix unshare_test with large
 fs.nr_open

[ Upstream commit df0b7e0ea59c43708cff8c7e34da5e2f8d430e5e ]

The test assumes fs.nr_open is close to the default 1048576, but some
systems set it much higher (e.g.  1073741816).  This is systemd's doing:
since systemd v240 (2018), PID 1 bumps fs.nr_open and fs.file-max to their
largest possible values on boot, as file descriptors are already accounted
for by memcg [1].

In that case, dup2() to nr_open + 64 requires the kernel to allocate a
file descriptor table with ~1 billion entries, which fails with ENOMEM.

On a kernel that already carries 04a2c4b4511d1, dup2() no longer fails
with ENOMEM.  The allocation is now rejected up front and the caller
gets EMFILE instead, without the WARNING, but the test still fails.

Cap the nr_open value used for the test's own arithmetic to a known
reasonable base value (1048576) and restore the true original value once
the test has completed.

Link: https://lore.kernel.org/20260814165709.513263-1-khorenko@virtuozzo.com
Link: https://github.com/systemd/systemd/commit/a8b627aaed409a15260c25988970c795bf963812 [1]
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/core/unshare_test.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/core/unshare_test.c b/tools/testing/selftests/core/unshare_test.c
index 7fec9dfb1b0e3a..6716e0f74d7da5 100644
--- a/tools/testing/selftests/core/unshare_test.c
+++ b/tools/testing/selftests/core/unshare_test.c
@@ -40,6 +40,14 @@ TEST(unshare_EMFILE)
 
 	ASSERT_EQ(sscanf(buf, "%d", &nr_open), 1);
 
+	/*
+	 * Cap nr_open for the duration of the test to avoid ENOMEM from a
+	 * huge fd table allocation; buf/n keep the real original value so
+	 * fs.nr_open can be restored to it once the test is done.
+	 */
+	if (nr_open > 1024 * 1024)
+		nr_open = 1024 * 1024;
+
 	ASSERT_EQ(0, getrlimit(RLIMIT_NOFILE, &rlimit));
 
 	/* bump fs.nr_open */
@@ -73,10 +81,13 @@ TEST(unshare_EMFILE)
 
 	if (pid == 0) {
 		int err;
+		char buf3[32];
+		ssize_t n3;
 
-		/* restore fs.nr_open */
+		/* restore fs.nr_open to the (possibly capped) test baseline */
+		n3 = sprintf(buf3, "%d\n", nr_open);
 		lseek(fd, 0, SEEK_SET);
-		write(fd, buf, n);
+		write(fd, buf3, n3);
 		/* ... and now unshare(CLONE_FILES) must fail with EMFILE */
 		err = unshare(CLONE_FILES);
 		EXPECT_EQ(err, -1)
@@ -89,6 +100,10 @@ TEST(unshare_EMFILE)
 	EXPECT_EQ(waitpid(pid, &status, 0), pid);
 	EXPECT_EQ(true, WIFEXITED(status));
 	EXPECT_EQ(0, WEXITSTATUS(status));
+
+	/* restore the real fs.nr_open value */
+	lseek(fd, 0, SEEK_SET);
+	write(fd, buf, n);
 }
 
 TEST_HARNESS_MAIN

From 68bcb60fcbba3a60517ddce226c8d30a09fff4c9 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Fri, 10 Jul 2026 14:39:57 +0200
Subject: [PATCH 1397/1982] fork: honor task_struct's declared alignment

[ Upstream commit 9decb604dc064099a6249150f0c4909525ed657c ]

Since commit cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant
size"), struct task_struct is declared __attribute__((aligned(64))) on all
architectures.

But fork_init() still sets the task_struct slab cache's alignment to

	align = max(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN)

which is smaller than 64 on architectures whose cache lines are below 64
bytes: e.g.  32 on ARMv5.

In practice plain SLUB happens to hand out 64-byte-aligned objects anyway.
With CONFIG_SLUB_DEBUG_ON the red-zone padding shifts objects to the
requested alignment.

With CONFIG_UBSAN_ALIGNMENT=y a boot on QEMU versatilepb (ARM926EJ-S,
v7.2-rc2, gcc 13.3) floods the console with reports like:

  UBSAN: misaligned-access in include/linux/sched.h:2087:9
  member access within misaligned address c295d7e0 for type 'struct task_struct'
  which requires 64 byte alignment
  CPU: 0 UID: 0 PID: 15 Comm: pr/ttyAMA-1 Not tainted 7.2.0-rc2 #1 VOLUNTARY

Set the slab alignment to at least the type's declared alignment.

Link: https://lore.kernel.org/20260710123957.31774-1-kmehltretter@gmail.com
Fixes: cb7ca40a3882 ("x86/fpu: Make task_struct::thread constant size")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Assisted-by: Claude:claude-fable-5
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index b7543a93f269a7..bc6078b910a6a7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -810,7 +810,8 @@ void __init fork_init(void)
 #ifndef ARCH_MIN_TASKALIGN
 #define ARCH_MIN_TASKALIGN	0
 #endif
-	int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
+	int align = max3(L1_CACHE_BYTES, ARCH_MIN_TASKALIGN,
+			 __alignof__(struct task_struct));
 	unsigned long useroffset, usersize;
 
 	/* create a slab on which task_structs can be allocated */

From de648cd4c54e659d5d212bdbe158f135569161cb Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Tue, 1 Sep 2026 20:52:18 +0800
Subject: [PATCH 1398/1982] ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to
 system inodes

[ Upstream commit 25bf9e549360b656a6763232e0e9e58a00c3aff7 ]

Patch series "ocfs2: validate suballoc slot and bit of metadata blocks", v3.

The ocfs2 metadata validators trust the on-disk suballoc slot and bit
without checking them against the slot range of the mounted filesystem and
the capacity of the block group bitmap.  A corrupted image can carry
OCFS2_INVALID_SLOT or another out-of-range slot, or a suballoc bit beyond
the bitmap, and once the corresponding inode, extent block, xattr block,
dir index root or refcount block gets freed, the bad value goes straight
into ocfs2_get_system_file_inode() or _ocfs2_free_suballoc_bits() and hits
a BUG_ON() or runs off the end of local_system_inodes[].

This series rejects such values at read time, in the existing validators,
so corrupted objects fail with -EROFS (and a read-only remount) instead of
crashing:

  patch 1 restricts OCFS2_INVALID_SLOT dinodes to system inodes,
        completing fe7a283b3916 ("ocfs2: add suballoc slot check in
        ocfs2_validate_inode_block()"), and turns the "system file
        state is ambiguous" BUG_ON() in ocfs2_read_locked_inode() into
        an ocfs2_error();
  patch 2 rejects oversized dinode suballoc bits;
  patch 3 validates the suballoc slot and bit of xattr and dir index
        blocks;
  patch 4 validates the suballoc slot and bit of extent and refcount
        blocks.

The checks only enforce what the kernel and mkfs.ocfs2 already write: a
valid slot from meta_ac->ac_alloc_slot and a bit within the block group
bitmap, with system inodes carrying OCFS2_INVALID_SLOT plus
OCFS2_SYSTEM_FL and extent blocks using slot 0.  Nothing changes for
healthy filesystems.

Each new check was exercised under QEMU by corrupting the field in
question with an out-of-range value; with the series applied the access
fails with -EROFS and the filesystem remounts read-only instead of hitting
the BUG_ON().

This patch (of 4):

ocfs2_validate_inode_block() currently permits i_suballoc_slot to be
OCFS2_INVALID_SLOT for any dinode.  Only system inodes created by
mkfs.ocfs2 are allocated from the global allocator and thus legitimately
carry this value; regular inodes are always allocated from a per-slot
suballocator and hence must have a valid slot.

If a corrupted regular inode with OCFS2_INVALID_SLOT is accepted,
ocfs2_remove_inode() will pass the slot to ocfs2_get_system_file_inode()
and get_local_system_inode() will hit BUG_ON(slot == OCFS2_INVALID_SLOT)
when the inode is deleted.  This can be triggered by an unprivileged user
unlinking such a corrupted file.

Reject OCFS2_INVALID_SLOT for non-system dinodes during validation, while
still accepting it for system inodes.  Note that a crafted dinode carrying
OCFS2_SYSTEM_FL passes the check above, yet a plain lookup of it still
used to BUG() in ocfs2_read_locked_inode() ("system file state is
ambiguous").  Since i_flags comes from disk, handle that mismatch with
ocfs2_error() instead of BUG_ON() as well.

Link: https://lore.kernel.org/20260901125221.1634686-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20260901125221.1634686-2-joseph.qi@linux.alibaba.com
Fixes: fe7a283b3916 ("ocfs2: add suballoc slot check in ocfs2_validate_inode_block()")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/inode.c | 37 ++++++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 835c00b90b7c8b..c1ac673ca456dd 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -637,14 +637,18 @@ static int ocfs2_read_locked_inode(struct inode *inode,
 	fe = (struct ocfs2_dinode *) bh->b_data;
 
 	/*
-	 * This is a code bug. Right now the caller needs to
-	 * understand whether it is asking for a system file inode or
-	 * not so the proper lock names can be built.
+	 * The caller must know whether it is asking for a system file inode
+	 * or not so the proper lock names can be built.  Since i_flags comes
+	 * from disk, a mismatch is filesystem corruption instead of a code
+	 * bug, so handle it with ocfs2_error() rather than BUG_ON().
 	 */
-	mlog_bug_on_msg(!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
-			!!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE),
-			"Inode %llu: system file state is ambiguous\n",
-			(unsigned long long)args->fi_blkno);
+	if (!!(fe->i_flags & cpu_to_le32(OCFS2_SYSTEM_FL)) !=
+	    !!(args->fi_flags & OCFS2_FI_FLAG_SYSFILE)) {
+		status = ocfs2_error(osb->sb,
+				     "Inode %llu: system file state is ambiguous\n",
+				     (unsigned long long)args->fi_blkno);
+		goto bail;
+	}
 
 	if (S_ISCHR(le16_to_cpu(fe->i_mode)) ||
 	    S_ISBLK(le16_to_cpu(fe->i_mode)))
@@ -1530,8 +1534,23 @@ int ocfs2_validate_inode_block(struct super_block *sb,
 		goto bail;
 	}
 
-	if (le16_to_cpu(di->i_suballoc_slot) != (u16)OCFS2_INVALID_SLOT &&
-	    (u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
+	/*
+	 * Only system inodes created by mkfs.ocfs2 are allocated from the
+	 * global allocator and thus legitimately carry OCFS2_INVALID_SLOT.
+	 * Regular inodes are always allocated from a per-slot suballocator.
+	 * If a regular inode with OCFS2_INVALID_SLOT was accepted here,
+	 * deleting it would pass the slot to get_local_system_inode() via
+	 * ocfs2_remove_inode() and trigger BUG_ON(slot == OCFS2_INVALID_SLOT).
+	 */
+	if (le16_to_cpu(di->i_suballoc_slot) == (u16)OCFS2_INVALID_SLOT) {
+		if (!(le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL)) {
+			rc = ocfs2_error(sb,
+					 "Invalid dinode %llu: suballoc slot %u for non-system inode\n",
+					 (unsigned long long)bh->b_blocknr,
+					 le16_to_cpu(di->i_suballoc_slot));
+			goto bail;
+		}
+	} else if ((u32)le16_to_cpu(di->i_suballoc_slot) > OCFS2_SB(sb)->max_slots - 1) {
 		rc = ocfs2_error(sb, "Invalid dinode %llu: suballoc slot %u\n",
 				 (unsigned long long)bh->b_blocknr,
 				 le16_to_cpu(di->i_suballoc_slot));

From 8463ea8d471edec1e9431fb6a955c476a17f5db4 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Thu, 3 Sep 2026 18:47:44 +0800
Subject: [PATCH 1399/1982] ocfs2: skip uninitialized lockres in
 ocfs2_mark_lockres_freeing()

[ Upstream commit 6a3ed6b290513859bd27d9fcb67739347d6315fa ]

A hard readonly mount skips ocfs2_dlm_init(), so the per-osb lock
resources are never initialized and osb->cconn stays NULL.  Before commit
550842cc60987 ("ocfs2: fix freeing uninitialized resource on
ocfs2_dlm_shutdown") ocfs2_dismount_volume() only called
ocfs2_dlm_shutdown() when osb->cconn was set.  It now calls it
unconditionally, so unmounting a hard readonly mount drops the osb locks
and takes the never initialized l_lock in ocfs2_mark_lockres_freeing().
With lockdep enabled this triggers:

INFO: trying to register non-static key.  The code is fine but needs
lockdep annotation, or maybe you didn't initialize this object before use?
turning off the locking correctness validator.

ocfs2_drop_lock() and ocfs2_lock_res_free() already skip lock resources
without OCFS2_LOCK_INITIALIZED.  Add the same check to
ocfs2_mark_lockres_freeing(), which is reachable before them through
ocfs2_simple_drop_lockres(), so an uninitialized lockres is never touched.

Link: https://lore.kernel.org/20260903104744.2164235-1-joseph.qi@linux.alibaba.com
Fixes: 550842cc6098 ("ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: ZW Tang <tangzw515@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/dlmglue.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index b4055ced93d967..90d23dd7d4c8fc 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3527,6 +3527,10 @@ void ocfs2_mark_lockres_freeing(struct ocfs2_super *osb,
 	struct ocfs2_mask_waiter mw;
 	unsigned long flags, flags2;
 
+	/* We didn't get anywhere near actually using this lockres. */
+	if (!(lockres->l_flags & OCFS2_LOCK_INITIALIZED))
+		return;
+
 	ocfs2_init_mask_waiter(&mw);
 
 	spin_lock_irqsave(&lockres->l_lock, flags);

From ffbb00ff33fe7399362dbbb23f34ef0c3e7704e0 Mon Sep 17 00:00:00 2001
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Date: Wed, 26 Aug 2026 05:27:55 -0400
Subject: [PATCH 1400/1982] wifi: mt76: mt76x02: validate TX-status rate index
 before mac80211 handoff

[ Upstream commit fbd12e8dabc8a9d2e81f427906749b4cff85d641 ]

mt76x02_mac_process_tx_rate() extracts the rate index straight from
the hardware's raw TX-status word with no bounds check for the
HT/HT_GF/VHT cases, and mt76x02_mac_fill_tx_status() ignores its
return value. A stale or corrupt hardware index reaches mac80211's
minstrel_ht rate control, whose per-group rate array is a fixed 10
entries (MCS_GROUP_RATES), causing an out-of-bounds write.

Validate the index in mt76x02_mac_process_tx_rate() (HT: 0-31,
VHT: MCS nibble 0-9) and have mt76x02_mac_fill_tx_status() bail out
cleanly on failure instead of passing an invalid index through.

Fixes: 7c1f88812690 ("mt76: unify send_tx_status and related helpers")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Link: https://patch.msgid.link/20260826092755.480190-1-markanthonyagarro@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/mediatek/mt76/mt76x02_mac.c  | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 17c97829153158..eef131c05f7638 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -302,10 +302,14 @@ mt76x02_mac_process_tx_rate(struct ieee80211_tx_rate *txrate, u16 rate,
 		txrate->flags |= IEEE80211_TX_RC_GREEN_FIELD;
 		fallthrough;
 	case MT_PHY_TYPE_HT:
+		if (idx > 31)
+			return -EINVAL;
 		txrate->flags |= IEEE80211_TX_RC_MCS;
 		txrate->idx = idx;
 		break;
 	case MT_PHY_TYPE_VHT:
+		if ((idx & 0xf) > 9)
+			return -EINVAL;
 		txrate->flags |= IEEE80211_TX_RC_VHT_MCS;
 		txrate->idx = idx;
 		break;
@@ -493,18 +497,21 @@ mt76x02_mac_fill_tx_status(struct mt76x02_dev *dev, struct mt76x02_sta *msta,
 		first_rate = st->rate & ~MT_PKTID_RATE;
 		first_rate |= st->pktid & MT_PKTID_RATE;
 
-		mt76x02_mac_process_tx_rate(&rate[0], first_rate,
-					    dev->mphy.chandef.chan->band);
+		if (mt76x02_mac_process_tx_rate(&rate[0], first_rate,
+						dev->mphy.chandef.chan->band))
+			return;
 	} else if (rate[0].idx < 0) {
 		if (!msta)
 			return;
 
-		mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
-					    dev->mphy.chandef.chan->band);
+		if (mt76x02_mac_process_tx_rate(&rate[0], msta->wcid.tx_info,
+						dev->mphy.chandef.chan->band))
+			return;
 	}
 
-	mt76x02_mac_process_tx_rate(&last_rate, st->rate,
-				    dev->mphy.chandef.chan->band);
+	if (mt76x02_mac_process_tx_rate(&last_rate, st->rate,
+					dev->mphy.chandef.chan->band))
+		return;
 
 	for (i = 0; i < ARRAY_SIZE(info->status.rates); i++) {
 		retry--;

From 9d67b9bf659ffb1eeb2b429a3b999b4a3c36b72d Mon Sep 17 00:00:00 2001
From: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Date: Thu, 13 Aug 2026 08:20:59 -0700
Subject: [PATCH 1401/1982] wifi: mt76: mt7615: do not tear down BSS/STA state
 for monitor vifs

[ Upstream commit f7517b3d8b7f1008e07edcb8bb692c6ca53ef23b ]

Tearing down a monitor interface oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:mt76_connac_mcu_uni_add_bss+0x144/0x370 [mt76_connac_lib]
  Call Trace:
   mt7615_remove_interface+0x6a/0x200 [mt7615_common]
   drv_remove_interface+0x60/0x140 [mac80211]
   ieee80211_del_virtual_monitor+0x8f/0xc0 [mac80211]
   ieee80211_do_open+0x550/0x7d0 [mac80211]
   ieee80211_open+0xaa/0xb0 [mac80211]
   __dev_open+0x11b/0x280

mt7615_remove_interface() tears down BSS and STA state for every vif type.
On MT7663 with offload firmware that reaches mt76_connac_mcu_uni_add_bss(),
which has no monitor case in its iftype switch. It takes WARN_ON(1), then
copies ETH_ALEN from vif->bss_conf.bssid, which is NULL for a monitor vif.

mt76_connac_mcu_bss_basic_tlv() in the same file handles this. It has an
NL80211_IFTYPE_MONITOR case and it copies phy->macaddr in place of the
bssid. The uni variant has neither.

There is nothing to tear down. mt7615_add_interface() only calls
mt7615_mcu_add_dev_info(). The BSS and STA state comes from beacon enable
in mt7615_bss_info_changed(), from mt7615_set_key() and from
mt7615_mac_sta_add(), so a monitor vif never has any.

Reported on mt7615e going from monitor back to managed, and on mt7663u on
an "ip link set down", both through ieee80211_del_virtual_monitor().

Fixes: d9852ab2f362 ("mt76: mt7615: keep mcu_add_bss_info enabled till interface removal")
Cc: stable@vger.kernel.org
Reported-by: Orly Orge <orlyorge2004@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/CANj5C4mTOHs6riyWee=dFdkE5p=714J8xs-x3hq3ewQ+r6O_Nw@mail.gmail.com/
Reported-by: Inanix <contact@inanix.fr>
Closes: https://github.com/morrownr/mt76/issues/79
Tested-by: Inanix <contact@inanix.fr>
Signed-off-by: Mark Anthony Agarro <markanthonyagarro@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260813152059.15747-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
index 25936fb309fbde..a6667e3a66d0bd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
@@ -254,8 +254,10 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw,
 
 	mt7615_mutex_acquire(dev);
 
-	mt7615_mcu_add_bss_info(phy, vif, NULL, false);
-	mt7615_mcu_sta_add(phy, vif, NULL, false);
+	if (vif->type != NL80211_IFTYPE_MONITOR) {
+		mt7615_mcu_add_bss_info(phy, vif, NULL, false);
+		mt7615_mcu_sta_add(phy, vif, NULL, false);
+	}
 
 	mt76_testmode_reset(phy->mt76, true);
 	if (vif == phy->monitor_vif)

From 2fff1ca283f1e4a49a259befdcc23bbbac4b45f7 Mon Sep 17 00:00:00 2001
From: Eason Lai <eason.lai@mediatek.com>
Date: Mon, 14 Sep 2026 10:19:19 +0800
Subject: [PATCH 1402/1982] wifi: mt76: mt792x: fix UAF in SDIO TX path when
 out of memory

[ Upstream commit f5dd4833463ed45794027e33928539b3c532f82d ]

Using __skb_pad() instead of skb_pad() in mt76_skb_adjust_pad()
to prevent double-free, as the caller handles cleanup.

Free the MCU message skb in __mt76x02u_mcu_send_msg() as well, which
relied on skb_pad() to release it.

Fixes: 808f2767d421 ("wifi: mt76: mt792x: Fix memory leak in SDIO TX path")
Cc: stable@vger.kernel.org
Closes: https://github.com/morrownr/mt76/issues/83
Co-developed-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Link: https://patch.msgid.link/20260914021920.32246-2-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 2 +-
 drivers/net/wireless/mediatek/mt76/tx.c              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
index b2cc449142945f..d06cc5ee07b2b9 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
@@ -90,7 +90,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
 	       MT_MCU_MSG_TYPE_CMD;
 	ret = mt76x02u_skb_dma_info(skb, CPU_TX_PORT, info);
 	if (ret)
-		return ret;
+		goto out;
 
 	ret = mt76u_bulk_msg(dev, skb->data, skb->len, NULL, 500,
 			     MT_EP_OUT_INBAND_CMD);
diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 93275bb692fa50..3fef2ad45dee44 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -885,7 +885,7 @@ int mt76_skb_adjust_pad(struct sk_buff *skb, int pad)
 		}
 	}
 
-	if (skb_pad(last, pad))
+	if (__skb_pad(last, pad, false))
 		return -ENOMEM;
 
 	__skb_put(last, pad);

From 001c88ed4a17ea6705b7c00cf00cdd73d60078e7 Mon Sep 17 00:00:00 2001
From: Eason Lai <eason.lai@mediatek.com>
Date: Mon, 14 Sep 2026 10:19:20 +0800
Subject: [PATCH 1403/1982] wifi: mt76: fix memory leak in USB TX path

[ Upstream commit 82856da2d3b6a30011f4db6ea5f34c13484e0ef8 ]

When errors occur in mt76u_tx_queue_skb(), the skb is not properly
freed, leading to memory leaks. This happens when:
- The queue is full
- tx_prepare_skb() drops zero-length frames (such as WMM NULL frames)
  to prevent hardware TX hangs
- Buffer setup fails

Fix by properly releasing the skb with ieee80211_tx_status_ext() when
the queue is full or tx_prepare_skb() fails, and using
mt76_tx_complete_skb() when mt76u_tx_setup_buffers() fails (since
tx_prepare_skb() has already succeeded and may have allocated resources
that need cleanup)

Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Cc: stable@vger.kernel.org
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Closes: https://github.com/morrownr/mt76/issues/83
Signed-off-by: Eason Lai <eason.lai@mediatek.com>
Tested-by: Hans Buchheim <hbuchheim@gmail.com>
Reported-by: Sergei Melnichenko <sergei.melnichenko@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20260914021920.32246-3-eason.lai@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/usb.c | 31 ++++++++++++++++++++----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index f9e67b8c3b3c89..b39dbf22dfc1d5 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -854,6 +854,9 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 		   enum mt76_txq_id qid, struct sk_buff *skb,
 		   struct mt76_wcid *wcid, struct ieee80211_sta *sta)
 {
+	struct ieee80211_tx_status status = {
+		.sta = sta,
+	};
 	struct mt76_tx_info tx_info = {
 		.skb = skb,
 	};
@@ -861,17 +864,27 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 	u16 idx = q->head;
 	int err;
 
-	if (q->queued == q->ndesc)
-		return -ENOSPC;
+	if (q->queued == q->ndesc) {
+		err = -ENOSPC;
+		goto err_free_skb;
+	}
 
 	skb->prev = skb->next = NULL;
 	err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info);
 	if (err < 0)
-		return err;
+		goto err_free_skb;
 
 	err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb);
-	if (err < 0)
-		return err;
+	if (err < 0) {
+		/*
+		 * mt76_tx_status_skb_get() walks the idr and dereferences
+		 * a freed skb. This SKB is not counted in non-AQL counter
+		 * due to error return, so using 0xffff as wcid to keep
+		 * balanced.
+		 */
+		mt76_tx_complete_skb(dev, 0xffff, tx_info.skb);
+		goto err_ret;
+	}
 
 	mt76u_fill_bulk_urb(dev, USB_DIR_OUT, q->ep, q->entry[idx].urb,
 			    mt76u_complete_tx, &q->entry[idx]);
@@ -882,6 +895,14 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 	q->queued++;
 
 	return idx;
+
+err_free_skb:
+	status.skb = tx_info.skb;
+	spin_lock_bh(&dev->rx_lock);
+	ieee80211_tx_status_ext(dev->hw, &status);
+	spin_unlock_bh(&dev->rx_lock);
+err_ret:
+	return err;
 }
 
 static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q)

From 09c14715c6c2241ca6d7b808f048b0d2cd639394 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Thu, 10 Sep 2026 17:54:41 -0400
Subject: [PATCH 1404/1982] wifi: mt76: mt7615: restore DBDC state after ext
 PHY failure

[ Upstream commit 7907d5270dc5c13b6a95754c08a77d5b06bbc786 ]

mt7615_register_ext_phy() limits the primary PHY to DBDC capabilities
before allocating and registering the secondary PHY. If allocation,
EEPROM override, or PHY registration fails, it returns without restoring
the primary PHY capabilities. The EEPROM override failure also leaks the
newly allocated ieee80211_hw.

Route all failures through common labels that free the secondary hardware
when it was allocated and restore the primary PHY capabilities.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 0f2173f093b3 ("mt76: mt7615: add support for registering a second wiphy via debugfs")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260910215441.76683-1-mhun512@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/mediatek/mt76/mt7615/init.c    | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index c4f5f6ee916aff..4b41462413bcf3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -541,8 +541,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 
 	mt7615_cap_dbdc_enable(dev);
 	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7615_ops, MT_BAND1);
-	if (!mphy)
-		return -ENOMEM;
+	if (!mphy) {
+		ret = -ENOMEM;
+		goto error;
+	}
 
 	phy = mphy->priv;
 	phy->dev = dev;
@@ -572,7 +574,7 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 
 	ret = mt76_eeprom_override(mphy);
 	if (ret)
-		return ret;
+		goto error_free_hw;
 
 	/* second phy can only handle 5 GHz */
 	mphy->cap.has_5ghz = true;
@@ -590,7 +592,14 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
 	ret = mt76_register_phy(mphy, true, mt76_rates,
 				ARRAY_SIZE(mt76_rates));
 	if (ret)
-		ieee80211_free_hw(mphy->hw);
+		goto error_free_hw;
+
+	return 0;
+
+error_free_hw:
+	ieee80211_free_hw(mphy->hw);
+error:
+	mt7615_cap_dbdc_disable(dev);
 
 	return ret;
 }

From ff57cd58c75d7d32b9b6fea5fdf04e78c321e29f Mon Sep 17 00:00:00 2001
From: Devin Wittmayer <lucid_duck@justthetip.ca>
Date: Sat, 3 Oct 2026 16:49:44 -0700
Subject: [PATCH 1405/1982] wifi: mt76: mt7925: cancel mlo_pm_work on the USB
 stop path

[ Upstream commit 9f299215d1d835aeeee8b269dad09e1be06f856e ]

Every other teardown path cancels this work, PCIe unbind included. USB
unbind does not: PCIe has its own unregister hook for it, while USB
shares a generic one and the stop callback that would have covered it is
replaced in probe.

That cancel came in commit 81faf578320d ("wifi: mt76: mt7925: cancel
mlo_pm_work on stop"), whose last line says it covers both buses. That's
mine and it's a boo-boo.

Give the USB path its own stop that cancels the work first.

Two-link MLO on a Netgear A9000, work armed then the interface down:

                   stock    patched
    stop ran        3/3      3/3
    work still ran  3/3      0/3

Skipping the stop entirely leaves both builds running it, so the zero is
the cancel.

Fixes: 276a56883257 ("wifi: mt76: mt7925: update the power-saving flow")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Link: https://patch.msgid.link/20261003234944.96066-1-lucid_duck@justthetip.ca
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index 95047ee48a425b..0ad86526dddc8f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -132,6 +132,15 @@ static int mt7925u_mac_reset(struct mt792x_dev *dev)
 	return err;
 }
 
+static void mt7925u_stop(struct ieee80211_hw *hw, bool suspend)
+{
+	struct mt792x_dev *dev = mt792x_hw_dev(hw);
+
+	cancel_delayed_work_sync(&dev->mlo_pm_work);
+
+	mt792xu_stop(hw, suspend);
+}
+
 static int mt7925u_probe(struct usb_interface *usb_intf,
 			 const struct usb_device_id *id)
 {
@@ -178,7 +187,7 @@ static int mt7925u_probe(struct usb_interface *usb_intf,
 	if (!ops)
 		return -ENOMEM;
 
-	ops->stop = mt792xu_stop;
+	ops->stop = mt7925u_stop;
 
 	mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), ops, &drv_ops);
 	if (!mdev)

From de7a5fdb25861a51ffaa13647c539129318b51a8 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Sun, 27 Sep 2026 18:10:40 +0800
Subject: [PATCH 1406/1982] wifi: mt76: mt7615: cancel reset work during
 unregister

[ Upstream commit 5b779c63fb1e20e6729d3241b78be7502759296d ]

The MCU error interrupt handler queues reset_work on the device workqueue.
Device removal can reach mt76_unregister_device() while that work is still
pending, since the workqueue is not destroyed until mt76_free_device().

If reset_work runs in this window, it operates on an unregistered hw and
can requeue mac_work after ieee80211_unregister_hw() has torn the device
down. Cancel it before unregistering the device so it cannot outlive the
registered hw.

Fixes: 61c4fa721968 ("mt76: mt7615: implement hardware reset support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927101041.957362-1-yaojiale02@163.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
index f607eee3fb479b..5e09f43926e028 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
@@ -116,6 +116,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev)
 	mcu_running = mt7615_wait_for_mcu_init(dev);
 
 	mt7615_unregister_ext_phy(dev);
+	cancel_work_sync(&dev->reset_work);
 	mt76_unregister_device(&dev->mt76);
 	if (mcu_running)
 		mt7615_mcu_exit(dev);

From 79bebd5637d4a7503eb6edae7cf61841251ab238 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 12:19:44 +0000
Subject: [PATCH 1407/1982] wifi: mt76: Fix of_node reference leak in
 mt76_get_rate_power_limits()

[ Upstream commit 8d604c899f7bd1a76a2eb21c0b706c02878abd36 ]

mt76_find_power_limits_node() and mt76_find_channel_node() return nodes
with the reference held, but mt76_get_rate_power_limits() overwrites the
"txpower-<band>" node reference and never releases the channel node
reference, leaking both.

Drop the intermediate and the channel node reference on every exit path,
and take a reference on the fallback node returned by
mt76_find_power_limits_node() so the caller's of_node_put() is balanced.

Fixes: 22b980badc0f ("mt76: add functions for parsing rate power limits from DT")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260917121944.2150737-1-vulab@iscas.ac.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/eeprom.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
index 6ce8e4af18fe53..281b2c3e9e7cfe 100644
--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
@@ -224,12 +224,14 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
 		struct property *regd = of_find_property(cur, "regdomain", NULL);
 
 		if (!country && !regd) {
-			fallback = cur;
+			of_node_put(fallback);
+			fallback = of_node_get(cur);
 			continue;
 		}
 
 		if (mt76_string_prop_find(country, dev->alpha2) ||
 		    mt76_string_prop_find(regd, region_name)) {
+			of_node_put(fallback);
 			of_node_put(np);
 			return cur;
 		}
@@ -356,7 +358,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
 			      s8 target_power)
 {
 	struct mt76_dev *dev = phy->dev;
-	struct device_node *np;
+	struct device_node *np, *band_np;
 	const s8 *val;
 	char name[16];
 	u32 mcs_rates = dev->drv->mcs_rates;
@@ -389,15 +391,18 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
 		band = '6';
 		break;
 	default:
+		of_node_put(np);
 		return target_power;
 	}
 
 	snprintf(name, sizeof(name), "txpower-%cg", band);
-	np = of_get_child_by_name(np, name);
-	if (!np)
+	band_np = of_get_child_by_name(np, name);
+	of_node_put(np);
+	if (!band_np)
 		return target_power;
 
-	np = mt76_find_channel_node(np, chan);
+	np = mt76_find_channel_node(band_np, chan);
+	of_node_put(band_np);
 	if (!np)
 		return target_power;
 
@@ -422,6 +427,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
 				     ARRAY_SIZE(dest->ru), val, len,
 				     target_power, txs_delta, &max_power);
 
+	of_node_put(np);
+
 	return max_power;
 }
 EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);

From b63fac9e76caf2586609d6728882254962cf7672 Mon Sep 17 00:00:00 2001
From: Linlin Yang <yanglinlin@kylinos.cn>
Date: Mon, 24 Aug 2026 17:29:37 +0800
Subject: [PATCH 1408/1982] wifi: mt76: mt7996: fix PCI device reference leak
 in mt7996_pci_init_hif2()

[ Upstream commit d92bac6b6af2602516ee82ae112709c71af27cf6 ]

pci_get_device() increments the reference count on the returned
struct pci_dev. In mt7996_pci_init_hif2(), three pci_get_device()
calls are made but their return values are only checked for NULL
and then discarded. pci_dev_put() is never called, causing a PCI
device reference count leak.

Fix this by storing the return value and calling pci_dev_put()
before returning, following the same pattern already used in the
sibling driver mt7915/pci.c.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Linlin Yang <yanglinlin@kylinos.cn>
Link: https://patch.msgid.link/20260824092937.683240-1-yanglinlin@kylinos.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
index 3f49bbbba3b9cc..1d9102b5e556ab 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
@@ -63,12 +63,18 @@ static void mt7996_put_hif2(struct mt7996_hif *hif)
 
 static struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev)
 {
+	struct pci_dev *tmp_pdev;
+
 	hif_idx++;
 
-	if (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL) &&
-	    !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL) &&
-	    !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL))
+	tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL);
+	if (!tmp_pdev)
+		tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL);
+	if (!tmp_pdev)
+		tmp_pdev = pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL);
+	if (!tmp_pdev)
 		return NULL;
+	pci_dev_put(tmp_pdev);
 
 	writel(hif_idx | MT_PCIE_RECOG_ID_SEM,
 	       pcim_iomap_table(pdev)[0] + MT_PCIE_RECOG_ID);

From 61cde0b5c12743ad672d928e57ac99cbb725ef6d Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Tue, 15 Sep 2026 04:54:26 +0000
Subject: [PATCH 1409/1982] clocksource/drivers/fttmr010: Fix clk reference
 leak in error paths

[ Upstream commit 277e5657237a92e279ee28da2f5c07902cc6aa0b ]

fttmr010_common_init() obtains the PCLK reference with
of_clk_get_by_name() but never calls clk_put(). If clk_prepare_enable()
fails the reference is leaked directly, and every error path that jumps
to out_disable_clock only calls clk_disable_unprepare(), which releases
the prepare/enable state but not the reference obtained from
of_clk_get_by_name().

Add clk_put() to the clk_prepare_enable() failure path and to the
out_disable_clock label so the clock reference is no longer leaked. The
success path keeps PCLK enabled for the lifetime of the timer and is
left untouched.

Fixes: dd98442e17a6 ("clocksource/drivers/fttmr010: Drop Gemini specifics")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260915045426.1726805-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-fttmr010.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
index 126fb1f259b289..0003d49768f621 100644
--- a/drivers/clocksource/timer-fttmr010.c
+++ b/drivers/clocksource/timer-fttmr010.c
@@ -292,6 +292,7 @@ static int __init fttmr010_common_init(struct device_node *np,
 	ret = clk_prepare_enable(clk);
 	if (ret) {
 		pr_err("failed to enable PCLK\n");
+		clk_put(clk);
 		return ret;
 	}
 
@@ -432,6 +433,7 @@ static int __init fttmr010_common_init(struct device_node *np,
 	kfree(fttmr010);
 out_disable_clock:
 	clk_disable_unprepare(clk);
+	clk_put(clk);
 
 	return ret;
 }

From 5dc170af53674ccebfc36a2a03dbd19e4ef86634 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Tue, 15 Sep 2026 04:52:42 +0000
Subject: [PATCH 1410/1982] clocksource/drivers/digicolor: Fix clk reference
 leak on request_irq failure

[ Upstream commit 9cc2e18b32f12d26ae6729c62a03640423956b17 ]

digicolor_timer_init() obtains the timer clock with of_clk_get() and
enables it, but the request_irq() failure path returns without releasing
the clock reference, leaking both the enable/prepare state and the
reference itself.

Disable and put the clock before returning on the request_irq() failure
path. The success path keeps the clock enabled for the lifetime of the
timer and is left untouched.

Fixes: 9b8bb7736b78 ("clocksource: Driver for Conexant Digicolor SoC timer")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Link: https://patch.msgid.link/20260915045242.1726702-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-digicolor.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clocksource/timer-digicolor.c b/drivers/clocksource/timer-digicolor.c
index 559aa96089c344..46e0c329957a26 100644
--- a/drivers/clocksource/timer-digicolor.c
+++ b/drivers/clocksource/timer-digicolor.c
@@ -190,6 +190,8 @@ static int __init digicolor_timer_init(struct device_node *node)
 			  &dc_timer_dev.ce);
 	if (ret) {
 		pr_warn("request of timer irq %d failed (%d)\n", irq, ret);
+		clk_disable_unprepare(clk);
+		clk_put(clk);
 		return ret;
 	}
 

From 66cb7a60e0aa81c3426895ca1f98deb33411c47d Mon Sep 17 00:00:00 2001
From: Pin-Hao Chen <billy920225@gmail.com>
Date: Tue, 6 Oct 2026 06:05:28 +0800
Subject: [PATCH 1411/1982] spi: stm32: fix double free of SRAM buffer on MDMA
 fallback

[ Upstream commit 0c5b0c3eb1d6daa1117dacd32589196f52109cab ]

When the "rxm2m" MDMA channel cannot be obtained, the driver frees the
SRAM buffer and falls back to DMA-only mode. However, sram_rx_buf is
left pointing to the freed buffer.

As a result, stm32_spi_unprepare_msg() may clear the released SRAM
area, while stm32_spi_remove() or a later probe error path may free the
buffer again, triggering BUG_ON() in gen_pool_free_owner().

The probe error path also checks sram_pool instead of sram_rx_buf. If
the SRAM allocation failed and a later probe step fails,
gen_pool_free() may therefore be called with an unallocated buffer.

Clear sram_rx_buf after freeing it on the MDMA fallback path and use
the buffer pointer to determine whether cleanup is needed.

Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
Cc: stable@vger.kernel.org
Signed-off-by: Pin-Hao Chen <billy920225@gmail.com>
Link: https://patch.msgid.link/20261005220528.7199-1-billy920225@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-stm32.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 7a6ee93be9bd4e..e5d483a9d38b16 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -2454,6 +2454,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
 					gen_pool_free(spi->sram_pool,
 						      (unsigned long)spi->sram_rx_buf,
 						      spi->sram_rx_buf_size);
+					spi->sram_rx_buf = NULL;
 					dev_warn(&pdev->dev,
 						 "failed to request rx mdma channel, DMA only\n");
 				}
@@ -2491,7 +2492,7 @@ static int stm32_spi_probe(struct platform_device *pdev)
 	if (spi->mdma_rx)
 		dma_release_channel(spi->mdma_rx);
 err_pool_free:
-	if (spi->sram_pool)
+	if (spi->sram_rx_buf)
 		gen_pool_free(spi->sram_pool, (unsigned long)spi->sram_rx_buf,
 			      spi->sram_rx_buf_size);
 err_dma_release:

From deea0b755ccba3491ccb957aa7343888c73ecfce Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 7 Oct 2026 17:52:29 +0000
Subject: [PATCH 1412/1982] aoe: pull in the headers each received packet type
 reads

[ Upstream commit e1274a6bc40a4618f6fbaebbdc51cca865d51bed ]

aoenet_rcv() only pulls the AoE and ATA headers into the skb head when
the packet is long enough to hold both.  A shorter packet goes through
unpulled, and aoenet_rcv() reads the AoE header from it anyway.  CFG
responses go on to aoecmd_cfg_rsp(), which reads the config header
after it, and ATA responses get queued for ktiocomplete(), which
skb_pull()s both headers.  Ethernet pads frames to 60 bytes, so this
mostly takes a virtual link, but nothing stops a short frame from
getting here.

Pull the AoE header up front and drop the packet if it isn't there,
then pull the ATA or config header in the switch arm that hands the
packet on, so each path gets the headers it reads.  This also replaces
the open-coded __pskb_pull_tail() with pskb_may_pull().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261007-b4-aoe-short-packets-v1-1-db5155f7bb9c@toxicpanda.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/aoe/aoenet.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index 66e617664c143a..cd7c735bb43b7d 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -131,9 +131,7 @@ static int
 aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt, struct net_device *orig_dev)
 {
 	struct aoe_hdr *h;
-	struct aoe_atahdr *ah;
 	u32 n;
-	int sn;
 
 	if (dev_net(ifp) != &init_net)
 		goto exit;
@@ -144,12 +142,8 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
 	if (!is_aoe_netif(ifp))
 		goto exit;
 	skb_push(skb, ETH_HLEN);	/* (1) */
-	sn = sizeof(*h) + sizeof(*ah);
-	if (skb->len >= sn) {
-		sn -= skb_headlen(skb);
-		if (sn > 0 && !__pskb_pull_tail(skb, sn))
-			goto exit;
-	}
+	if (!pskb_may_pull(skb, sizeof(*h)))
+		goto exit;
 	h = (struct aoe_hdr *) skb->data;
 	n = get_unaligned_be32(&h->tag);
 	if ((h->verfl & AOEFL_RSP) == 0 || (n & 1<<31))
@@ -171,10 +165,14 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
 
 	switch (h->cmd) {
 	case AOECMD_ATA:
+		if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_atahdr)))
+			goto exit;
 		/* ata_rsp may keep skb for later processing or give it back */
 		skb = aoecmd_ata_rsp(skb);
 		break;
 	case AOECMD_CFG:
+		if (!pskb_may_pull(skb, sizeof(*h) + sizeof(struct aoe_cfghdr)))
+			goto exit;
 		aoecmd_cfg_rsp(skb);
 		break;
 	default:

From 3d1e0085b5d24cb1053cf9ccb915376f15f6a4b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kwilczynski@kernel.org>
Date: Fri, 14 Aug 2026 07:05:22 +0000
Subject: [PATCH 1413/1982] PCI/sysfs: Pass the device name length in UTF-16
 code units
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit af5ca2d75147bf283239e8ef0fbf6e5e0488ca91 ]

Currently, dsm_label_utf16s_to_utf8s() passes the ACPI buffer length to
utf16s_to_utf8s() unchanged.  The Device Name _DSM may return the device
name as a buffer holding a UTF-16 string, and the ACPI length counts bytes
while the converter counts wchar_t elements.  The converter therefore
receives a count twice the number of code units the buffer holds, and that
count is its only bound on the input.

A NUL code unit ends the conversion early, so a name that carries one is
converted correctly and the error stays hidden.  ACPICA zeroes the entire
result allocation, and the padding placed after the buffer supplies that
NUL for most lengths.  Lengths that leave no padding, or a single byte of
it, do not, and the conversion then runs up to its own length in bytes past
the end of the allocation.  The bytes beyond the allocation are decoded
into the "label" attribute, which is world readable.

Divide the buffer length by the size of wchar_t so that the converter
receives a count of code units.  The division truncates, so the converter
is never told to read more bytes than the buffer holds, including for an
odd length.

Reaching the out of bounds read needs firmware that returns the name as a
buffer and omits the terminator.

Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260814070522.2327975-5-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-label.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index 0c644651964043..c224619b9a266f 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -144,7 +144,7 @@ static int dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
 	int len;
 
 	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
-			      obj->buffer.length,
+			      obj->buffer.length / sizeof(wchar_t),
 			      UTF16_LITTLE_ENDIAN,
 			      buf, PAGE_SIZE - 1);
 	buf[len++] = '\n';

From 92eb10d78d07b64788575d2fb347664aedf96be4 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Wed, 7 Oct 2026 16:17:21 +0000
Subject: [PATCH 1414/1982] wifi: rtw89: fix IE length passed to
 cfg80211_find_ie() in WoW AKM

[ Upstream commit 6c17c57d45ef1652d80f79a9834597b25412fd26 ]

__rtw89_wow_parse_akm() computes a pointer to the IE area from an
association request frame:

    ies = mgmt->u.assoc_req.variable;

but then passes skb->len as the IE data length to cfg80211_find_ie().
Since skb->len covers the entire frame including the 28-byte management
header and fixed fields, cfg80211_find_ie() may read past the end of the
actual IE data.

Fix by computing the correct IE data length as skb->len minus the
header offset, and validating the minimum frame length before parsing.

Fixes: 92790c4e50d2 ("wifi: rtw89: wow: parsing Auth Key Management from associate request")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20261007161721.261452-3-tristmd@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw89/wow.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 90046d6f620efc..144c4c2801bdb7 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,14 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
 {
 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 	struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+	size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
 	const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
 	struct rtw89_rsn_ie *rsn_ie;
 
-	rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+	if (skb->len < hdr_len)
+		return;
+
+	rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len - hdr_len);
 	if (!rsn)
 		return;
 

From ca4d514d32a9c4c293d742f7091c49d4d016cd11 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Sun, 4 Oct 2026 14:09:46 +0900
Subject: [PATCH 1415/1982] crypto: algif_skcipher - rewind rounded output
 bytes

[ Upstream commit 2f90facc7b94934653eb7ebfadcc25d503b89196 ]

af_alg_get_rsgl() advances the receive iterator by the unrounded RX
scatterlist length.  For a continuing skcipher request,
_skcipher_recvmsg() then rounds its local length down to a whole chunksize
without restoring the iterator.

A later chunk starts after bytes which the provider never wrote, while the
syscall returns only the processed length.  When copy_splice_read()
supplies non-zeroed pages and publishes that return as a dense prefix, the
gap exposes stale bytes from a previous page lifetime.

With unprivileged xts(aes), a 31-byte MSG_MORE request followed by one
final byte advances a 47-byte destination while returning 32 bytes.  A
hardened v7.2-rc5 image retained all 15 seeded stale bytes in 4,829 of
4,829 records.  With init_on_alloc enabled, all 72,345 gap bytes observed
were zero.

Rewind the iterator by the tail excluded during rounding, before rejecting
a zero processed length.  The crypto request uses only the rounded length;
af_alg_free_resources() releases the entire RX list before another receive
iteration.

The fixed target-like kernel returned byte-identical dense 48-byte output
in 4,771 of 4,771 rounds.  The unmodified kernel returned the vulnerable
32-byte short record in 2,409 of 2,409 rounds.

Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/algif_skcipher.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 35ebc3e0201b04..b245d37db76b70 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -116,12 +116,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
 	 * full block size buffers.
 	 */
 	if (ctx->more || len < ctx->used) {
-		if (len < bs) {
+		size_t excess = len % bs;
+
+		len -= excess;
+		iov_iter_revert(&msg->msg_iter, excess);
+
+		if (!len) {
 			err = -EINVAL;
 			goto free;
 		}
 
-		len -= len % bs;
 		cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL;
 	}
 

From d37861288c5de3c3041ef1890e22a0fab70d0b8f Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Thu, 8 Oct 2026 11:51:22 +0300
Subject: [PATCH 1416/1982] ALSA: hda/hdmi: clamp num_cvts against cvt_nids[]
 in hdmi_read_pin_conn

[ Upstream commit 6cf3ab38b0d53d41f00fe594b2986849bdf994ae ]

hdmi_add_cvt() stores each converter's NID into the fixed-size
spec->cvt_nids[] array (used only by the Intel Haswell pin-connection
fixup), but only when spec->num_cvts is still within
ARRAY_SIZE(cvt_nids); the num_cvts counter itself is incremented
unconditionally regardless of whether the store happened. A codec
that reports more converters than cvt_nids[] can hold therefore ends
up with num_cvts > ARRAY_SIZE(cvt_nids).

hdmi_read_pin_conn(), on the intel_hsw_fixup path, copies num_cvts
elements from cvt_nids[] with memcpy(), so once num_cvts exceeds the
array size this reads past cvt_nids[] and writes the resulting
garbage NIDs into per_pin->mux_nids[].

Clamp the copy length to the actual size of cvt_nids[] instead of
trusting num_cvts, which is also used unbounded as the size of the
separate, dynamically-sized spec->cvts array and must not be
truncated at the source.

Fixes: bce0d2a80e42 ("ALSA: hda - Allow unlimited pins and converters in patch_hdmi.c")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085122.9442-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/hdmi/hdmi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index 480d1c5f129fd3..a30072139f3527 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -983,7 +983,8 @@ static int hdmi_read_pin_conn(struct hda_codec *codec, int pin_idx)
 	snd_hda_set_dev_select(codec, pin_nid, dev_id);
 
 	if (spec->intel_hsw_fixup) {
-		conns = spec->num_cvts;
+		/* spec->cvt_nids[] only has ARRAY_SIZE(spec->cvt_nids) slots */
+		conns = min_t(int, spec->num_cvts, ARRAY_SIZE(spec->cvt_nids));
 		memcpy(per_pin->mux_nids, spec->cvt_nids,
 		       sizeof(hda_nid_t) * conns);
 	} else {

From 4bc8cef2303f0a3097ddbf30e037e9b93a2be4b3 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Thu, 8 Oct 2026 11:51:33 +0300
Subject: [PATCH 1417/1982] ALSA: hda/hdmi: clamp sad_count in ELD proc write
 handler

[ Upstream commit b3e7ddd694f8429217ba509b55b910a0e4361dfb ]

snd_hdmi_write_eld_info() parses a "sad_count N" line from the
root-writable ELD proc interface and assigns N directly to
e->sad_count with no upper bound, unlike the per-index "sadN_*" lines
a few lines below which are already bounded to ELD_MAX_SAD.

snd_hdmi_eld_update_pcm_info() later iterates
"for (i = 0; i < e->sad_count; i++)" over the fixed
e->sad[ELD_MAX_SAD] array, so an oversized sad_count read from the
proc file causes it to walk past the array.

Reject sad_count values above ELD_MAX_SAD, matching the existing
per-index guard.

Fixes: acb059938810 ("ALSA: hda - ELD proc interface write updates")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261008085133.9528-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/hdmi/eld.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/hda/codecs/hdmi/eld.c b/sound/hda/codecs/hdmi/eld.c
index 1464fd1c675bc3..fc6fe1b0873c3e 100644
--- a/sound/hda/codecs/hdmi/eld.c
+++ b/sound/hda/codecs/hdmi/eld.c
@@ -155,9 +155,11 @@ void snd_hdmi_write_eld_info(struct hdmi_eld *eld,
 			e->aud_synch_delay = val;
 		else if (!strcmp(name, "speakers"))
 			e->spk_alloc = val;
-		else if (!strcmp(name, "sad_count"))
+		else if (!strcmp(name, "sad_count")) {
+			if (val > ELD_MAX_SAD)
+				continue;
 			e->sad_count = val;
-		else if (!strncmp(name, "sad", 3)) {
+		} else if (!strncmp(name, "sad", 3)) {
 			sname = name + 4;
 			n = name[3] - '0';
 			if (name[4] >= '0' && name[4] <= '9') {

From 82c9bc868b49d87893ef3ce8c09ff21300dcb50e Mon Sep 17 00:00:00 2001
From: Matthias Goergens <matthias.goergens@gmail.com>
Date: Sat, 26 Sep 2026 10:08:51 +0800
Subject: [PATCH 1418/1982] fanotify: report names longer than NAME_MAX

[ Upstream commit ff05910cb1b77c2b229c5e6e260c6173a17b579b ]

fanotify keeps the length of a reported name in a u8, so it drops any
name longer than NAME_MAX and warns:

  WARNING: fs/notify/fanotify/fanotify.h:217 at fanotify_handle_event+0x2e82/0x39f0

Such names are legitimate on some filesystems.  vfat mounted with utf8
takes up to 255 UTF-16 characters, which are up to 765 bytes of UTF-8,
and FUSE accepts names up to PATH_MAX - 1.  readdir() and inotify report
them in full.  fanotify sends the event without the name, and for
FAN_RENAME it trips a second warning in copy_fid_info_to_user(), after
which read() fails with EFAULT and the event is lost.

When syzbot hit this, Jan suggested accommodating names up to PATH_MAX
[1], the limit readdir() already applies to a name
(verify_dirent_name()).  Store the name lengths as u16, which keeps
struct fanotify_info at 8 bytes, and drop without a warning only names
of PATH_MAX bytes or more, which no path can refer to.  An event with
such a name can exceed a page, so allocate name events with kvmalloc(),
as Jan also suggested.  Names up to NAME_MAX are reported exactly as
before, and the record format is unchanged: an event with a long name is
just longer.

Link: https://lore.kernel.org/all/20241112115059.ecvomkalee5m4i4i@quack3/ [1]
Fixes: 2d9374f09513 ("fanotify: use macros to get the offset to fanotify_info buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Link: https://patch.msgid.link/20260926020851.2938961-1-matthias.goergens@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/notify/fanotify/fanotify.c |  7 +++++--
 fs/notify/fanotify/fanotify.h | 21 ++++++++++++---------
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index cdb69c23e2e6c8..bb12baebd0c94b 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -650,6 +650,9 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
 	unsigned long name2_len = name2 ? name2->len : 0;
 	unsigned int len, size;
 
+	if (WARN_ON_ONCE(name_len >= PATH_MAX || name2_len >= PATH_MAX))
+		return NULL;
+
 	/* Reserve terminating null byte even for empty name */
 	size = sizeof(*fne) + name_len + name2_len + 2;
 	if (dir_fh_len)
@@ -658,7 +661,7 @@ static struct fanotify_event *fanotify_alloc_name_event(struct inode *dir,
 		size += FANOTIFY_FH_HDR_LEN + dir2_fh_len;
 	if (child_fh_len)
 		size += FANOTIFY_FH_HDR_LEN + child_fh_len;
-	fne = kmalloc(size, gfp);
+	fne = kvmalloc(size, gfp);
 	if (!fne)
 		return NULL;
 
@@ -1048,7 +1051,7 @@ static void fanotify_free_fid_event(struct fanotify_event *event)
 
 static void fanotify_free_name_event(struct fanotify_event *event)
 {
-	kfree(FANOTIFY_NE(event));
+	kvfree(FANOTIFY_NE(event));
 }
 
 static void fanotify_free_error_event(struct fsnotify_group *group,
diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h
index eb2ba71d5c81a5..775f55080dd4d4 100644
--- a/fs/notify/fanotify/fanotify.h
+++ b/fs/notify/fanotify/fanotify.h
@@ -42,9 +42,16 @@ struct fanotify_info {
 	u8 dir_fh_totlen;
 	u8 dir2_fh_totlen;
 	u8 file_fh_totlen;
-	u8 name_len;
-	u8 name2_len;
-	u8 pad[3];
+	u8 pad;
+	/*
+	 * Deliberately not limited to NAME_MAX: some filesystems return longer
+	 * names (vfat up to 255 UTF-16 characters, as Windows allows, which is
+	 * up to 765 bytes of UTF-8; FUSE up to PATH_MAX - 1), and readdir() and
+	 * inotify report them in full. Only names of PATH_MAX bytes or more,
+	 * which no path can refer to, are dropped.
+	 */
+	u16 name_len;
+	u16 name2_len;
 	unsigned char buf[];
 	/*
 	 * (struct fanotify_fh) dir_fh starts at buf[0]
@@ -167,7 +174,7 @@ static inline char *fanotify_info_name2(struct fanotify_info *info)
 static inline void fanotify_info_init(struct fanotify_info *info)
 {
 	BUILD_BUG_ON(FANOTIFY_FH_HDR_LEN + MAX_HANDLE_SZ > U8_MAX);
-	BUILD_BUG_ON(NAME_MAX > U8_MAX);
+	BUILD_BUG_ON(PATH_MAX > U16_MAX);
 
 	info->dir_fh_totlen = 0;
 	info->dir2_fh_totlen = 0;
@@ -213,8 +220,7 @@ static inline void fanotify_info_set_file_fh(struct fanotify_info *info,
 static inline void fanotify_info_copy_name(struct fanotify_info *info,
 					   const struct qstr *name)
 {
-	if (WARN_ON_ONCE(name->len > NAME_MAX) ||
-	    WARN_ON_ONCE(info->name2_len > 0))
+	if (WARN_ON_ONCE(info->name2_len > 0))
 		return;
 
 	info->name_len = name->len;
@@ -224,9 +230,6 @@ static inline void fanotify_info_copy_name(struct fanotify_info *info,
 static inline void fanotify_info_copy_name2(struct fanotify_info *info,
 					    const struct qstr *name)
 {
-	if (WARN_ON_ONCE(name->len > NAME_MAX))
-		return;
-
 	info->name2_len = name->len;
 	strcpy(fanotify_info_name2(info), name->name);
 }

From c8835d955dc6b3c4493c7139cd2afd4f880e3da1 Mon Sep 17 00:00:00 2001
From: guzebing <guzebing1612@gmail.com>
Date: Mon, 10 Aug 2026 23:12:00 +0800
Subject: [PATCH 1419/1982] ext4: only update tune mount options when requested

[ Upstream commit 981eec6c300bd4e84ffac8f3c28b762d00f13e9c ]

EXT4_IOC_SET_TUNE_SB_PARAM uses set_flags to indicate which superblock
fields the caller wants to update. ext4_sb_setparams() checks set_flags
before updating the other supported fields, but always copied mount_opts
into the on-disk s_mount_opts field.

As a result, callers that do not set EXT4_TUNE_FL_MOUNT_OPTS can still
clear or alter the on-disk default mount options through their unused
mount_opts buffer. This can affect subsequent mounts by changing the
filesystem's stored default mount options.

Only copy mount_opts into s_mount_opts when EXT4_TUNE_FL_MOUNT_OPTS is set,
matching the set_flags semantics used by the other tuneable superblock
fields.

Cc: stable@kernel.org
Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters")
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20260810151200.1405562-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/ioctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 9aec4ee780a7e3..cc85786be2704e 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1360,7 +1360,8 @@ static void ext4_sb_setparams(struct ext4_sb_info *sbi,
 		es->s_encoding = cpu_to_le16(params->encoding);
 	if (params->set_flags & EXT4_TUNE_FL_ENCODING_FLAGS)
 		es->s_encoding_flags = cpu_to_le16(params->encoding_flags);
-	strscpy_pad(es->s_mount_opts, params->mount_opts);
+	if (params->set_flags & EXT4_TUNE_FL_MOUNT_OPTS)
+		strscpy_pad(es->s_mount_opts, params->mount_opts);
 	if (params->set_flags & EXT4_TUNE_FL_EDIT_FEATURES) {
 		es->s_feature_compat |=
 			cpu_to_le32(params->set_feature_compat_mask);

From 9e7b9a6cb744844559911a5c8ff6e627aa9de9c6 Mon Sep 17 00:00:00 2001
From: Hsiu-Hsien Lee <swinds24@gmail.com>
Date: Wed, 12 Aug 2026 12:43:53 +0800
Subject: [PATCH 1420/1982] ext4: fix fast commit replay failing on a read-only
 mount

[ Upstream commit e1a881ea4674876721cab97680d1d8308f90e9a4 ]

A filesystem with fast_commit that needs recovery cannot be mounted
read-only:

  EXT4-fs (dm-0): INFO: recovery required on readonly filesystem
  EXT4-fs (dm-0): write access will be enabled during recovery
  WARNING: CPU: 22 PID: 5544 at fs/ext4/ext4_jbd2.c:73
   ext4_journal_check_start
   __ext4_journal_start_sb
   __ext4_unlink
   ext4_fc_replay
   do_one_pass
   jbd2_journal_recover
   jbd2_journal_load
   __ext4_fill_super
  JBD2: journal recovery failed
  EXT4-fs (dm-0): error loading journal

Fast commit replay runs ext4 metadata operations instead of writing
blocks through the buffer cache: ext4_fc_replay_{unlink,link,create}()
reach __ext4_unlink() and __ext4_link(), which start a handle.
ext4_journal_check_start() returns -EROFS on a read-only sb, and as
that is not -ENOENT it propagates out of jbd2_journal_recover() and
kills the whole recovery.  The EXT4_FC_REPLAY check that would hand
out a no-journal handle sits after the sb_rdonly() test, so replay can
never complete read-only.

ext4_load_journal() has already promised that write access will be
enabled during recovery, so make that true for the superblock as well:
clear SB_RDONLY across jbd2_journal_load() when recovery is needed on a
read-only mount and the devices are writable, as ext4_orphan_cleanup()
does.  Unlike ext4_handle_error(), which avoids SB_RDONLY because it
would need s_umount, the sb here is still inside ext4_fill_super() and
not published, so nothing can observe it.

The failure is not clean either: the replay handlers passing a NULL
handle (ext4_fc_replay_inode(), _add_range(), _del_range()) never hit
ext4_journal_check_start() and do write, leaving a partially applied
fast commit behind.

Reproducer, where the unlink only ever reaches the fast commit area:

  mke2fs -q -F -t ext4 -O fast_commit -b 4096 /dev/sdb3 262144
  mount /dev/sdb3 /mnt
  dd if=/dev/zero of=/mnt/victim bs=4k count=1 conv=fsync
  sync                          # victim now in a full commit
  rm /mnt/victim
  dd if=/dev/zero of=/mnt/trigger bs=4k count=1 conv=fsync
  <crash, or snapshot the device while mounted and write it back>
  mount -o ro /dev/sdb3 /mnt

Without this patch that mount fails; with it recovery completes and
victim is gone, i.e. the UNLINK record was really replayed.

Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Cc: stable@vger.kernel.org
Signed-off-by: Hsiu-Hsien Lee <swinds24@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260812044353.1018268-1-swinds24@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/super.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b4ff7e692986b8..2762628bbfc952 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6016,6 +6016,7 @@ static int ext4_load_journal(struct super_block *sb,
 	int err = 0;
 	int really_read_only;
 	int journal_dev_ro;
+	bool enable_write = false;
 
 	if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
 		return -EFSCORRUPTED;
@@ -6072,6 +6073,7 @@ static int ext4_load_journal(struct super_block *sb,
 			}
 			ext4_msg(sb, KERN_INFO, "write access will "
 			       "be enabled during recovery");
+			enable_write = true;
 		}
 	}
 
@@ -6088,7 +6090,19 @@ static int ext4_load_journal(struct super_block *sb,
 		if (save)
 			memcpy(save, ((char *) es) +
 			       EXT4_S_ERR_START, EXT4_S_ERR_LEN);
+		/*
+		 * Fast commit replay performs regular ext4 metadata updates
+		 * (see ext4_fc_replay()) which refuse to run on a read-only
+		 * superblock.  We promised write access above, so make that
+		 * true for the duration of the recovery, the same way
+		 * ext4_orphan_cleanup() does.  The superblock is not published
+		 * yet, so nothing can observe the transient state.
+		 */
+		if (enable_write)
+			sb->s_flags &= ~SB_RDONLY;
 		err = jbd2_journal_load(journal);
+		if (enable_write)
+			sb->s_flags |= SB_RDONLY;
 		if (save && memcmp(((char *) es) + EXT4_S_ERR_START,
 				   save, EXT4_S_ERR_LEN)) {
 			memcpy(((char *) es) + EXT4_S_ERR_START,

From d8c47fba16b9822f623d7131eed17c52c5b60b32 Mon Sep 17 00:00:00 2001
From: guzebing <guzebing1612@gmail.com>
Date: Fri, 14 Aug 2026 11:48:55 +0800
Subject: [PATCH 1421/1982] ext4: reject delalloc to nodelalloc before applying
 remount options

[ Upstream commit 26a3ff309c91986dbedb05d0e0f0050ea0aa629c ]

Commit 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on
remount") rejects switching a mounted filesystem from delalloc to
nodelalloc.  However, it performs the check after ext4_apply_options()
has already cleared EXT4_MOUNT_DELALLOC in the live superblock.  The
failure path eventually restores the bit, but leaves a window where
other CPUs can observe nodelalloc.

test_opt() reads s_mount_opt directly without a lock shared with
remount.  If a concurrent truncate's __es_remove_extent() hits this
window and observes nodelalloc, it sets count_reserved to false.
Delayed extent status entries are then removed without calculating
their cluster reservations, leaving reserved at zero.
ext4_es_remove_extent() therefore calls ext4_da_release_space() with
zero, leaving i_reserved_data_blocks and s_dirtyclusters_counter
elevated.  When the inode is later evicted after unlink,
ext4_destroy_inode() reports:

  i_reserved_data_blocks (...) not cleared!

CPU 0                             CPU 1
                                  ksys_truncate()
                                    ...
                                    ext4_es_remove_extent()
ext4_reconfigure()
  ext4_check_opt_consistency()
  __ext4_remount()
    ext4_apply_options()
      clear EXT4_MOUNT_DELALLOC
                                      __es_remove_extent()
                                        test_opt() sees !DELALLOC
                                        count_reserved = false
    reject delalloc -> nodelalloc
    restore EXT4_MOUNT_DELALLOC
                                        remove delayed ES
                                    ext4_da_release_space(0)

Follow the pre-apply validation approach used by
ext4_check_quota_consistency() and reject the transition in
ext4_check_opt_consistency(), before ext4_apply_options() changes live
state.  Use mask_s_mount_opt to determine whether delalloc/nodelalloc
was specified and ctx_test_mount_opt() to check the final parsed value.

Fixes: 97f5ec3b166d ("ext4: prevent delalloc to nodelalloc on remount")
Cc: stable@vger.kernel.org
Signed-off-by: guzebing <guzebing1612@gmail.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260814034855.1573759-1-guzebing1612@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/super.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2762628bbfc952..613b04b64b14d5 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2783,6 +2783,14 @@ static int ext4_check_opt_consistency(struct fs_context *fc,
 	}
 
 	if (is_remount) {
+		if (test_opt(sb, DELALLOC) &&
+		    (ctx->mask_s_mount_opt & EXT4_MOUNT_DELALLOC) &&
+		    !ctx_test_mount_opt(ctx, EXT4_MOUNT_DELALLOC)) {
+			ext4_msg(sb, KERN_ERR,
+				 "can't disable delalloc during remount");
+			return -EINVAL;
+		}
+
 		if (!sbi->s_journal &&
 		    ctx_test_mount_opt(ctx, EXT4_MOUNT_DATA_ERR_ABORT)) {
 			ext4_msg(NULL, KERN_WARNING,
@@ -6595,13 +6603,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
 		goto restore_opts;
 	}
 
-	if ((old_opts.s_mount_opt & EXT4_MOUNT_DELALLOC) &&
-	    !test_opt(sb, DELALLOC)) {
-		ext4_msg(sb, KERN_ERR, "can't disable delalloc during remount");
-		err = -EINVAL;
-		goto restore_opts;
-	}
-
 	sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
 		(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
 

From ab41325c105db07cebc9cd7ba2716a93b6946426 Mon Sep 17 00:00:00 2001
From: Daejun Park <daejun7.park@samsung.com>
Date: Wed, 19 Aug 2026 15:09:39 +0900
Subject: [PATCH 1422/1982] jbd2: don't advance j_fc_off before the buffer is
 recorded

[ Upstream commit 9f359c031885bb50add7d23c7a5a0e9755b134c9 ]

jbd2_fc_get_buf() increments journal->j_fc_off before jbd2_journal_bmap()
and __getblk() have had a chance to fail.  When either does, the slot
j_fc_wbuf[fc_off] is never assigned, but j_fc_off already counts it.

ext4 then fails the fast commit and falls back, and the fallback path
reaches jbd2_fc_release_bufs() via ext4_fc_commit ->
jbd2_fc_end_commit_fallback -> __jbd2_fc_end_commit -> ext4_fc_cleanup.
That walks down from j_fc_off - 1 and put_bh()es every slot until it
sees NULL, so it also touches the slot that was never written.
j_fc_wbuf comes from a plain kmalloc() and is never zeroed, so a slot
used for the first time holds uninitialised heap data.

Advance j_fc_off only after the buffer head has been stored.  That
restores the invariant that j_fc_off covers exactly the filled slots,
which is what jbd2_fc_release_bufs() relies on: the live buffers of the
current fast commit sit above the NULLs the previous one released, so
stopping at the first NULL is correct.

Reproduced on a KASAN kernel with an ext4 fast_commit filesystem on a
loop device, truncating the backing file under the live mount so that
only the journal's fast-commit region falls past the end of the device.
__getblk() then fails for the first fast-commit block while the rest of
the journal is still addressable, so the journal is not aborted and the
fast commit reaches the fallback path.  j_fc_wbuf was poisoned to make
the read of the never-written slot visible:

  BUG: KASAN: wild-memory-access in jbd2_fc_release_bufs+0x6b/0xd0
  Write of size 4 at addr 5a5a5a5a5a5a5ab2 by task sync/961
   jbd2_fc_release_bufs+0x6b/0xd0
   ext4_fc_cleanup+0x97/0x830
   __jbd2_fc_end_commit+0x37/0xc0
   ext4_fc_commit+0x524/0x560
   ext4_sync_file+0x3c4/0x4b0
   __x64_sys_fsync+0x20/0x30

With this patch the same run leaves j_fc_off at 0 across repeated
__getblk() failures and completes cleanly.

Fixes: ff780b91efe9 ("jbd2: add fast commit machinery")
Cc: stable@kernel.org
Reported-by: Yu Junzhe <junzheyu1@gmail.com>
Closes: https://lore.kernel.org/linux-ext4/7e4b109d-64c3-444f-a5dc-93c2ca4576cc@gmail.com/
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260819060939epcms2p37bb8589b2f8a52a2b14bef38fadcf69d@epcms2p3
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jbd2/journal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index fa0fb738db0c4a..1184dbad43e579 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -844,7 +844,6 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
 
 	fc_off = journal->j_fc_off;
 	blocknr = journal->j_fc_first + fc_off;
-	journal->j_fc_off++;
 	ret = jbd2_journal_bmap(journal, blocknr, &pblock);
 	if (ret)
 		return ret;
@@ -854,6 +853,7 @@ int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out)
 		return -ENOMEM;
 
 	journal->j_fc_wbuf[fc_off] = bh;
+	journal->j_fc_off++;
 
 	*bh_out = bh;
 

From 2de6fe2980963a1b23676bff90e4def80646d162 Mon Sep 17 00:00:00 2001
From: Hemanth Selam <hemanth.selam@gmail.com>
Date: Mon, 24 Aug 2026 15:15:12 +0530
Subject: [PATCH 1423/1982] ext4: skip extra isize expansion while unmounting

[ Upstream commit 418adcde99032194416248168df810535a1a93f9 ]

syzbot reports a WARN from ext4_xattr_inode_create() reached through the
unmount path:

  EXT4-fs warning (device loop0): ext4_xattr_inode_create:1485: refuse to
  create EA inode when umounting
  WARNING: fs/ext4/xattr.c:1486 at ext4_xattr_inode_lookup_create
   ext4_xattr_block_set
   ext4_expand_extra_isize_ea
   __ext4_expand_extra_isize
   __ext4_mark_inode_dirty
   ext4_dirty_inode
   __mark_inode_dirty
   sync_lazytime
   iput
   dentry_kill
   shrink_dentry_list
   shrink_dcache_for_umount
   generic_shutdown_super
   kill_block_super
   ext4_kill_sb

shrink_dcache_for_umount() clears s_root before generic_shutdown_super()
clears SB_ACTIVE, so during the dcache shrink the last iput() of a
lazytime inode still redirties it and reaches the isize expansion.  The
expansion can move xattrs out to a block, and creating the EA inode for
them needs s_root, which ext4_xattr_inode_create() refuses without.

ext4_try_to_expand_extra_isize() already declines to expand when the
superblock is not active, but that test does not cover this window.
Decline while s_root is gone as well.  The expansion is best effort and
__ext4_mark_inode_dirty() ignores its return value, so nothing else
changes; the inode can be expanded on a later mount.

Running the syzbot reproducer for 60 seconds produced 3583 splats before
this change and none after it, with the same number of mount cycles.

Cc: stable@kernel.org
Reported-by: syzbot+4b03894b6ec5753ddf24@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b03894b6ec5753ddf24
Fixes: f31173c19901 ("ext4: refuse to create ea block when umounted")
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Jun Nie <jun.nie@linaro.org>
Link: https://patch.msgid.link/20260824094512.2436628-1-hemanth.selam@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ed51c11f43ffb9..47ce682ae17fa1 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6479,8 +6479,14 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode,
 	 * When !SB_ACTIVE, iput triggers write_inode_now() which acquires
 	 * s_writepages_rwsem, causing a deadlock with the caller's active
 	 * jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle).
+	 *
+	 * Skip it while unmounting as well.  shrink_dcache_for_umount()
+	 * clears s_root before generic_shutdown_super() clears SB_ACTIVE, and
+	 * the last iput() of a lazytime inode in that window redirties it and
+	 * lands here.  Moving xattrs out to a block then needs a new EA inode,
+	 * which ext4_xattr_inode_create() refuses without s_root.
 	 */
-	if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE)))
+	if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE) || !inode->i_sb->s_root))
 		return -EBUSY;
 
 	/*

From 16c511466a87d53efab5fe100aa645e8633c7eda Mon Sep 17 00:00:00 2001
From: Daejun Park <daejun7.park@samsung.com>
Date: Thu, 27 Aug 2026 17:48:29 +0900
Subject: [PATCH 1424/1982] ext4: don't report delalloc data as a hole on
 indirect-mapped inodes

[ Upstream commit aed43f47e1edeee1454eea86006a8c09480e5ed3 ]

When a plain lookup finds no block, ext4_ind_map_blocks() sizes the hole
it reports by counting the empty subtrees under 'partial' in the on-disk
indirect tree.  That count knows nothing about delayed allocation, so a
range holding delalloc data that has not been written back yet is
reported as a plain hole.  The extent-mapped path does not have this
problem: it trims the hole it found at the first delayed extent before
returning it.

ext4_map_blocks() consults the extent status tree before it calls into
the mapping layer, so a query that starts exactly on the delayed block
still finds it.  A query that starts earlier does not, because the hole
reported for the earlier block already spans the delayed one.  On a
4k-block filesystem, lseek(SEEK_DATA) from offset 0 on a file whose only
data block is at logical block N and is still dirty returns:

  N = 0..11      direct blocks                 N << 12
  N = 12         first single-indirect block   N << 12
  N = 13..1035   inside that indirect block    -1 ENXIO
  N = 1036       first double-indirect block   N << 12

Blocks 12 and 1036 survive because the query lands on the delayed block
itself.  Blocks 13..1035 are swallowed by the 1024-block hole reported
for block 12.  fiemap loses the same data for the same reason.

An ext3 filesystem mounted as ext4 hits this during ordinary use: ext3
inodes stay indirect mapped, while mount -t ext4 turns on delayed
allocation even though mounting ext3 with -o delalloc is explicitly
rejected.  install(1) from coreutils uses SEEK_DATA to locate data in
its source file, so installing a sparse file that has not been written
back silently produces a destination of the right size holding none of
the data:

  truncate -s 1G img && mkfs.ext3 -F img && mount -t ext4 img mnt
  echo | dd of=mnt/src bs=1 count=1 seek=64K
  install mnt/src mnt/dst
  cmp mnt/src mnt/dst        # differ: char 65537

Reconciling a hole with the extent status tree does not depend on how
the hole was found, so instead of open coding it a second time, split
the delalloc handling out of ext4_ext_determine_insert_hole() into
ext4_determine_insert_hole(), which takes the hole the caller located,
and call that from ext4_ind_map_blocks() as well.  All the special cases
and the comments explaining them stay in one place.

Two things change for indirect-mapped inodes.  They now cache the holes
they report, as the extent-mapped path already does: ext4_punch_hole()
already puts EXTENT_STATUS_HOLE on such inodes, ext4_map_blocks() and
ext4_da_map_blocks() already handle a cached hole, the latter by
replacing it with the delayed extent, and consecutive hole entries
merge, so the tree does not grow with the length of a scan.  And when a
delayed extent covers the queried block itself - a race, since
ext4_map_blocks() found nothing in the tree just before - the hole is
now reported only up to the end of that extent instead of in full.

The indirect path passes hole_start == lblk, so the "delalloc extent in
front of the queried range" case cannot be reached there:
__es_tree_search() never returns an extent ending before the block it
was searched for.

With this the sweep above returns N << 12 for every N, while the
nodelalloc and extent-mapped controls are unchanged.  generic/225,
generic/285, generic/448 and generic/490 pass on ext4 made both with and
without the extent feature.  generic/286 and generic/436 pass on
extent-mapped ext4 and are skipped without it, since they need
fallocate.

Fixes: facab4d9711e ("ext4: return hole from ext4_map_blocks()")
Reported-by: Alexander Monakov <amonakov@ispras.ru>
Closes: https://lore.kernel.org/linux-ext4/594c17d9-c00f-e485-96fb-cedf27ce3aa3@ispras.ru/
Suggested-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827084829epcms2p6ecc0c39a71d0c3eebf9cb1ade77314f6@epcms2p6
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/ext4.h     |  3 +++
 fs/ext4/extents.c  | 26 +++++++++++++-------------
 fs/ext4/indirect.c | 17 +++++++++++++++++
 3 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ed546c52ebc321..9c67a2c28faf5e 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3809,6 +3809,9 @@ extern void ext4_ext_tree_init(handle_t *handle, struct inode *inode);
 extern int ext4_ext_index_trans_blocks(struct inode *inode, int extents);
 extern int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
 			       struct ext4_map_blocks *map, int flags);
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+				       ext4_lblk_t hole_start,
+				       ext4_lblk_t hole_len);
 extern int ext4_ext_truncate(handle_t *, struct inode *);
 extern int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
 				 ext4_lblk_t end);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 21fba12520a8e6..80d41be5156447 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4160,21 +4160,19 @@ static int get_implied_cluster_alloc(struct super_block *sb,
 }
 
 /*
- * Determine hole length around the given logical block, first try to
- * locate and expand the hole from the given @path, and then adjust it
- * if it's partially or completely converted to delayed extents, insert
- * it into the extent cache tree if it's indeed a hole, finally return
- * the length of the determined extent.
+ * Adjust the hole [@hole_start, @hole_start + @hole_len) the caller found
+ * around the queried block @lblk if it's partially or completely converted
+ * to delayed extents, insert it into the extent cache tree if it's indeed a
+ * hole, finally return the length of the determined extent starting at
+ * @lblk.  @hole_start must not be behind @lblk.
  */
-static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode,
-						  struct ext4_ext_path *path,
-						  ext4_lblk_t lblk)
+ext4_lblk_t ext4_determine_insert_hole(struct inode *inode, ext4_lblk_t lblk,
+				       ext4_lblk_t hole_start,
+				       ext4_lblk_t hole_len)
 {
-	ext4_lblk_t hole_start, len;
+	ext4_lblk_t len = hole_len;
 	struct extent_status es;
 
-	hole_start = lblk;
-	len = ext4_ext_find_hole(inode, path, &hole_start);
 again:
 	ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
 				  hole_start + len - 1, &es);
@@ -4342,9 +4340,11 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
 	 * we couldn't try to create block if flags doesn't contain EXT4_GET_BLOCKS_CREATE
 	 */
 	if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
-		ext4_lblk_t len;
+		ext4_lblk_t hole_start = map->m_lblk, len;
 
-		len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk);
+		len = ext4_ext_find_hole(inode, path, &hole_start);
+		len = ext4_determine_insert_hole(inode, map->m_lblk,
+						 hole_start, len);
 
 		map->m_pblk = 0;
 		map->m_len = min_t(unsigned int, map->m_len, len);
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index da76353b3a5750..50c567123b42de 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -586,6 +586,23 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
 		for (i = partial - chain + 1; i < depth; i++)
 			count = count * epb + (epb - offsets[i] - 1);
 		count++;
+
+		/*
+		 * The count knows nothing about delayed allocation, so let
+		 * the common helper reconcile it with the extent status
+		 * tree.  Only when the lookup really did find a hole:
+		 * ext4_get_branch() also returns a non-NULL partial when it
+		 * failed, and caching a hole for a range it could not read
+		 * would answer every later read from that cache instead of
+		 * retrying.  Clamp the count first, a subtree can be bigger
+		 * than the logical block space when the block size is large.
+		 */
+		if (!err) {
+			count = umin(count, EXT_MAX_BLOCKS - map->m_lblk);
+			count = ext4_determine_insert_hole(inode, map->m_lblk,
+							   map->m_lblk, count);
+		}
+
 		/* Fill in size of a hole we found */
 		map->m_pblk = 0;
 		map->m_len = umin(map->m_len, count);

From eb69dba4610f68465b95c1045716580f42f8c8ba Mon Sep 17 00:00:00 2001
From: Sergey Senozhatsky <senozhatsky@chromium.org>
Date: Thu, 27 Aug 2026 21:50:20 +0900
Subject: [PATCH 1425/1982] ext4: fix ABBA deadlock in ext4_rmdir()

[ Upstream commit 19e16597f9baf1b5719a3a6c710486446f6808fd ]

We observe the following ABBA deadlock (casefolding enabled):

 INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
 task:jbd2/dm-13-8    state:D stack:0     pid:447   tgid:447   ppid:2
 Call Trace:
  <TASK>
  __schedule+0xc2c/0xe60
  schedule+0x40/0xe0
  jbd2_journal_wait_updates+0x8f/0xf0
  jbd2_journal_commit_transaction+0x321/0x1850
  kjournald2+0xa9/0x230
  kthread+0x226/0x2a0
  ret_from_fork+0x101/0x1e0
  ret_from_fork_asm+0x1a/0x30

 INFO: task Thread-10:4161 blocked for more than 720 seconds.
 task:Thread-10       state:D stack:0     pid:4161  tgid:3848  ppid:540
 Call Trace:
  <TASK>
  __schedule+0xc2c/0xe60
  schedule+0x40/0xe0
  wait_transaction_locked+0x8c/0xd0
  start_this_handle+0x252/0x870
  jbd2__journal_start+0x120/0x280
  __ext4_journal_start_sb+0x11a/0x250
  ext4_evict_inode+0x208/0x760
  iput+0x222/0x5c0
  dput+0x293/0x690
  ____fput+0x145/0x2b0
  task_work_run+0x7a/0xb0
  exit_to_user_mode_loop+0xc0/0xd0
  do_syscall_64+0x14b/0xf10
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

 NMI backtrace for cpu 0
 CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
 RIP: 0010:d_walk+0x0/0x290
[..]
 Call Trace:
 <TASK>
  shrink_dcache_parent+0xb2/0x100
  d_invalidate+0x50/0x110
  ext4_rmdir+0x3a2/0x3d0
  vfs_rmdir+0x9d/0x1d0
  do_rmdir+0xf0/0x330
  __x64_sys_unlinkat+0x34/0x50
  do_syscall_64+0x61/0xf10

The problem is that ext4_rmdir() calls d_invalidate() before stopping
the jbd2 transaction handle.  Because d_invalidate() traverses child
dentries it can encounter dying or in-use dentries.  If a concurrent
thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
it requests a new transaction handle via ext4_journal_start(), which
waits for all running handles to close.  However, the thread executing
ext4_rmdir() still holds its active transaction handle while looping
in shrink_dcache_parent() waiting for the dying child dentry to complete
eviction.

Stop transaction handle in ext4_rmdir() before calling d_invalidate().

Cc: stable@kernel.org
Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20260827125158.4030598-1-senozhatsky@chromium.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 2c661155158f87..49bd70aab22552 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3204,19 +3204,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
 	ext4_fc_track_unlink(handle, dentry);
 	retval = ext4_mark_inode_dirty(handle, dir);
 
+end_rmdir:
+	brelse(bh);
+	if (handle)
+		ext4_journal_stop(handle);
+
 	/* VFS negative dentries are incompatible with Encoding and
 	 * Case-insensitiveness. Eventually we'll want avoid
 	 * invalidating the dentries here, alongside with returning the
 	 * negative dentries at ext4_lookup(), when it is better
 	 * supported by the VFS for the CI case.
 	 */
-	if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
+	if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
 		d_invalidate(dentry);
 
-end_rmdir:
-	brelse(bh);
-	if (handle)
-		ext4_journal_stop(handle);
 	return retval;
 }
 

From 02eea74948bda0409d7e359969218a814238a42a Mon Sep 17 00:00:00 2001
From: Jinjie Ruan <ruanjinjie@huawei.com>
Date: Wed, 2 Sep 2026 15:48:04 +0800
Subject: [PATCH 1426/1982] ext4: fix out-of-bounds read in
 ext4_get_group_info()

[ Upstream commit b067d3c1f90b536e9aa9f48b19580475a0b34f0f ]

A plain read of s_groups_count in ext4_get_group_info() allows CPU
load-load reordering. On weak memory models, speculative prefetch of
s_group_info prior to the boundary check could lead to an out-of-bounds
read if a concurrent online resize expands the array and increments
s_groups_count.

The data race occurs between the ioctl configuration path (holding the
resize lock via ext4_resize_begin) and the lockless metadata lookup path:

   CPU 0 (Writer, Resize Lock)                CPU 1 (Reader, Lockless)
   ---------------------------                ------------------------
   ext4_ioctl()
     [EXT4_IOC_GROUP_ADD]
     ext4_ioctl_group_add()
       ext4_resize_begin() // Takes lock
       ext4_group_add()
         ext4_mb_alloc_groupinfo()
           // Publishes expanded array via RCU
           rcu_assign_pointer(s_group_info, ...)

         ext4_flex_group_add()
           ext4_update_super()
                                              ext4_get_group_info()
                                                // Speculative / out-of-order read
                                                [Loads old/smaller s_group_info pointer]
             [Plain C store / smp_wmb()]
             sbi->s_groups_count += ...;
                                                // Reads new s_groups_count,
                                                // boundary check passes
                                                if (group >= s_groups_count)

                                                // Out-of-bounds array access!
                                                sbi_array_rcu_deref(..., s_group_info)

Fix this by using ext4_get_groups_count() to enforce acquire semantics.

Cc: stable@vger.kernel.org
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Baokun Li <libaokun@linux.alibaba.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Zhang Yi <yi.zhang@huawei.com>
Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://patch.msgid.link/20260902074805.398540-8-ruanjinjie@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/balloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 08556dd45760d1..b7d59eec7b3f62 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -329,7 +329,7 @@ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
 	struct ext4_group_info **grp_info;
 	long indexv, indexh;
 
-	if (unlikely(group >= EXT4_SB(sb)->s_groups_count))
+	if (unlikely(group >= ext4_get_groups_count(sb)))
 		return NULL;
 	if (unlikely(!EXT4_SB(sb)->s_group_info))
 		return NULL;

From 7bcffd24502d637b348a2e460093a0cabad4554e Mon Sep 17 00:00:00 2001
From: Jake Labelle <southampton.jake.labelle@gmail.com>
Date: Thu, 8 Oct 2026 20:52:48 +0900
Subject: [PATCH 1427/1982] nilfs2: validate directory position after llseek in
 readdir

[ Upstream commit de7f49c12566cc5c7437a2f26c6c754b9d4d5648 ]

nilfs_readdir() uses ctx->pos, which userspace can set to an arbitrary
value via llseek, as an offset into the directory folio and parses
whatever bytes sit there as a directory entry.  A position pointing
into the middle of an entry -- or at unused bytes of a corrupted image
that the page validator never inspected -- makes dir_emit() copy up to
255 (name_len) bytes from a bogus entry, possibly reading past the end
of the folio and returning unrelated memory contents to userspace.

Snap unaligned positions onto a valid entry boundary by walking the
rec_len chain from the chunk start before parsing, as ext2 does in
ext2_validate_entry().

[ryusuke: fixed offset wrap-around in nilfs_validate_entry() and
 conformed AI tag to guidelines]

Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations")
Assisted-by: Claude:claude-mythos-5
Signed-off-by: Jake Labelle <southampton.jake.labelle@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/dir.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 6ca3d74be1e16d..3e137c9ca1382e 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -231,11 +231,27 @@ static struct nilfs_dir_entry *nilfs_next_entry(struct nilfs_dir_entry *p)
 					  nilfs_rec_len_from_disk(p->rec_len));
 }
 
+static inline unsigned int
+nilfs_validate_entry(char *base, unsigned int offset, unsigned int mask)
+{
+	struct nilfs_dir_entry *de = (struct nilfs_dir_entry *)(base + offset);
+	struct nilfs_dir_entry *p =
+		(struct nilfs_dir_entry *)(base + (offset & mask));
+
+	while ((char *)p < (char *)de) {
+		if (p->rec_len == 0)
+			break;
+		p = nilfs_next_entry(p);
+	}
+	return (char *)p - base;
+}
+
 static int nilfs_readdir(struct file *file, struct dir_context *ctx)
 {
 	loff_t pos = ctx->pos;
 	struct inode *inode = file_inode(file);
 	struct super_block *sb = inode->i_sb;
+	unsigned int chunk_size = nilfs_chunk_size(inode);
 	unsigned int offset = pos & ~PAGE_MASK;
 	unsigned long n = pos >> PAGE_SHIFT;
 	unsigned long npages = dir_pages(inode);
@@ -254,6 +270,24 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx)
 			ctx->pos += PAGE_SIZE - offset;
 			return -EIO;
 		}
+		/*
+		 * ctx->pos comes from userspace via llseek and may point
+		 * into the middle of an entry -- or at unvalidated bytes
+		 * of a crafted image. offset is only nonzero here on the
+		 * very first iteration (subsequent pages always start at
+		 * offset 0, which -- like any chunk boundary -- is always
+		 * a legitimate entry start, since no rec_len chain crosses
+		 * a chunk boundary). Snap a non-chunk-aligned offset onto
+		 * a real entry boundary by walking the chain from the
+		 * enclosing chunk's start, as ext2 does; otherwise
+		 * dir_emit() copies name_len bytes from a fake entry,
+		 * reading past the end of the folio.
+		 */
+		if (offset & (chunk_size - 1)) {
+			offset = nilfs_validate_entry(kaddr, offset,
+					~(chunk_size - 1));
+			ctx->pos = ((loff_t)n << PAGE_SHIFT) + offset;
+		}
 		de = (struct nilfs_dir_entry *)(kaddr + offset);
 		limit = kaddr + nilfs_last_byte(inode, n) -
 			NILFS_DIR_REC_LEN(1);

From 49f6bd347a7b7da90aabc213b58eec620c295d64 Mon Sep 17 00:00:00 2001
From: Yogesh Gaur <yogeshgaur.83@gmail.com>
Date: Tue, 6 Oct 2026 17:59:04 +0530
Subject: [PATCH 1428/1982] md: don't hand out the array before md_alloc() has
 added mddev->kobj

[ Upstream commit d1472ca2ca5de8ecd2b358411eb14c031404ecf0 ]

md_alloc() publishes the gendisk before it is done setting the mddev up:

	disk->private_data = mddev;
	...
	error = add_disk(disk);
	if (error)
		goto out_put_disk;

	kobject_init(&mddev->kobj, &md_ktype);
	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");

add_disk() makes /dev/mdN openable.  mddev comes from mddev_alloc() and
is zeroed, so anything that gets in between add_disk() and kobject_add()
sees an mddev->kobj that has never been through kobject_init() - no
ktype, no kref, state_initialized clear.

syzbot opens the array in that window and issues ADD_NEW_DISK:

  kobject: '(null)' (ffff8880120640f0): is not initialized, yet
  kobject_get() is being called.
  WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0 lib/kobject.c:225
   kobject_add_varg lib/kobject.c:374 [inline]
   kobject_add+0x163/0x240 lib/kobject.c:426
   bind_rdev_to_array+0x80c/0xdd0 drivers/md/md.c:2621
   md_add_new_disk+0xe3b/0x1850 drivers/md/md.c:7684
   md_ioctl+0x200a/0x2610 drivers/md/md.c:8499

bind_rdev_to_array() is not the only way in.  md_run() calls
sysfs_create_group(&mddev->kobj, &md_redundancy_group), and
internal_create_group() has its own WARN_ON(!kobj->sd), so RUN_ARRAY in
the same window warns too.

Every ioctl that can reach mddev->kobj runs under reconfig_mutex, so
hold it across add_disk() and kobject_add().  An ioctl issued in the
window now waits for md_alloc() to finish instead of seeing a
half-built mddev, and opening the array still succeeds.  The ioctls
md_ioctl() serves without the mutex only read array state and return
-ENODEV on an array with no disks.

Hoisting kobject_init() above add_disk() is not an option: commit
ca39f7502425 ("md: fix mddev->kobj lifetime") moved it below add_disk()
so that md_alloc()'s error paths, which free the mddev directly, never
see an initialised kobject.

Fixes: ca39f7502425 ("md: fix mddev->kobj lifetime")
Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6aaf3284.514bccd6.255447.0003.GAE@google.com/
Suggested-by: Yu Kuai <yukuai@fygo.io>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20261006122904.1538-1-yogeshgaur.83@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8d9e111939f64b..937a2f4da84bab 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6258,12 +6258,22 @@ struct mddev *md_alloc(dev_t dev, char *name)
 
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
+
+	/*
+	 * add_disk() makes the array openable before mddev->kobj exists.
+	 * Hold reconfig_mutex until kobject_add() is done so that ioctls
+	 * issued in between wait instead of using an uninitialised kobj.
+	 */
+	mddev_lock_nointr(mddev);
 	error = add_disk(disk);
-	if (error)
+	if (error) {
+		mddev_unlock(mddev);
 		goto out_put_disk;
+	}
 
 	kobject_init(&mddev->kobj, &md_ktype);
 	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
+	mddev_unlock(mddev);
 	if (error) {
 		/*
 		 * The disk is already live at this point.  Clear the hold flag

From 61b405ef3e35b5890365090ab6a377855e9a9b71 Mon Sep 17 00:00:00 2001
From: Luxiao Xu <rakukuip@gmail.com>
Date: Thu, 10 Sep 2026 11:42:50 +0800
Subject: [PATCH 1429/1982] mm/memory: constrain generic_access_phys() to page
 boundary

[ Upstream commit ae0298a5fbeff32951c0d31398ccec97ec6aa0ea ]

This patch addresses an issue in generic_access_phys() where accessing
memory across page boundaries in PFNMAP VMAs assumes physical pages are
contiguous, which can lead to accessing unintended physical memory or
exceeding VMA boundaries.

generic_access_phys() improperly validates the memory access range: it
only validates the start address using follow_pfnmap_start() and passes
PAGE_ALIGN(len + offset) to ioremap_prot().

This poses two problems:
1. In PFNMAP VMAs, consecutive virtual pages are not guaranteed to be
   physically contiguous, and individual PTEs may have different access
   permissions or writability.
2. The mapping may cross VMA boundaries if len extends beyond vma->vm_end.

Constrain the access in generic_access_phys() to at most the current page
boundary (PAGE_SIZE - offset) and map only a single PAGE_SIZE via
ioremap_prot().  Since the caller __access_remote_vm() already loops over
the requested length and handles partial transfers, it will naturally
iterate over the remaining pages.

Also add a missing (resource_size_t) cast during PFN re-validation to
avoid truncation on 32-bit PAE systems.

Link: https://lore.kernel.org/e06e28a46c2a176238f03b5740df0913e57c2861.1788842306.git.rakukuip@gmail.com
Fixes: 9cb12d7b4cca ("mm/memory.c: actually remap enough memory")
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: David Hildenbrand <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Grazvydas Ignotas <notasas@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memory.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 72793ec6310725..d755b5c1f12876 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6813,6 +6813,12 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
 	bool writable;
 	struct follow_pfnmap_args args = { .vma = vma, .address = addr };
 
+	/*
+	 * Limit access to one page at a time, as that's what follow_pfnmap_start()
+	 * guarantees; expect the caller to retry to read larger ranges.
+	 */
+	len = min_t(int, len, PAGE_SIZE - offset);
+
 retry:
 	if (follow_pfnmap_start(&args))
 		return -EINVAL;
@@ -6824,7 +6830,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
 	if ((write & FOLL_WRITE) && !writable)
 		return -EINVAL;
 
-	maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+	maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
 	if (!maddr)
 		return -ENOMEM;
 
@@ -6832,7 +6838,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
 		goto out_unmap;
 
 	if ((pgprot_val(prot) != pgprot_val(args.pgprot)) ||
-	    (phys_addr != (args.pfn << PAGE_SHIFT)) ||
+	    (phys_addr != ((resource_size_t)args.pfn << PAGE_SHIFT)) ||
 	    (writable != args.writable)) {
 		follow_pfnmap_end(&args);
 		iounmap(maddr);

From e4dcde9709a25f5301f0a1cc5f6f76485aea2c48 Mon Sep 17 00:00:00 2001
From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
Date: Thu, 3 Sep 2026 18:49:58 +0300
Subject: [PATCH 1430/1982] mm/execmem: free ROX cache chunks only when they
 span an entire vm area

[ Upstream commit 52d95a55a0113408acd2d4ce0294a72c527f5092 ]

Patch series "mm/execmem: fixes and cleanups for the ROX cache".

Sashiko review of the ROX cache refill path asked what happens when the
PMD_SIZE allocation fails there.  Pulling that thread uncovered a bit more
than the fallback.

Patch 1 fixes a real bug, although rare bug: execmem_cache_clean() can
free a chunk that is still partially in use, because a PMD sized and PMD
aligned free range in the middle of a larger chunk looks exactly like a
chunk that nobody uses.

Patch 2 handles maple tree allocation failures in the cache.  They are
unlikely, but silently dropping an area from the tree is not a great way
to deal with them.

Patch 3 deals with the fallback that started all this.  The cache exists
to keep the direct map free of unnecessary splits, and the fallback
happily filled it with base page mapped areas that could never be freed
from the cache again.  Ask vmalloc for a huge mapping or nothing, and
serve whatever does not fit outside the cache.

Patches 4 and 5 convert the ROX cache to scope based cleanup.

The series was tested on x86 with module load/unload cycles, with PTDUMP
confirming that the cache is using 2M mappings, and with nohugevmalloc to
exercise the uncached fallback.

This patch (of 5):

When execmem refills the ROX cache, it vmalloc()s multiples of PMD_SIZE
aligned to PMD_SIZE.  For every such allocation vmalloc creates a vm area.

The first part of the vmalloc()ed chunk is returned to the allocation that
triggered the cache refill and the remaining part is added to the cache
and handed out for subsequent allocations with execmem_alloc().

When only the first part is freed, the entire vm area remains in the ROX
cache and can be handed out again.

In the case when the first allocation is larger than PMD_SIZE and the
second allocation from the freed first part of the chunk is exactly
PMD_SIZE, execmem_cache_clean() will free the entire chunk while part of
it is still in use.

For example:

	/*
	 * vmalloc(4M), return p0 to the caller
	 * add [p0 + 3M, p0 + 4M) to the cache
	 */
	p0 = execmem_alloc(3M);

	/* return p0 + 3M from the cache to the caller */
	p1 = execmem_alloc(1M);

	/* put [p0, p0 + 3M) back into the cache */
	execmem_free(p0);

	/* return p0 from the cache to the caller */
	p2 = execmem_alloc(2M);

	/* return p0 + 2M from the cache to the caller */
	p3 = execmem_alloc(1M);

	/* bah! execmem_cache_clean() frees the entire 4M chunk */
	execmem_free(p2);

Make sure that the ranges that execmem_cache_clean() frees cover the
entire vm area.

Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-0-11beb2a3d249@kernel.org
Link: https://lore.kernel.org/20260903-execmem-rox-cache-pmd-v1-v1-1-11beb2a3d249@kernel.org
Fixes: 2e45474ab14f ("execmem: add support for cache of large ROX pages")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: copilot:claude-opus-5
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Luis Chamberalin <mcgrof@kernel.org>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/execmem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/execmem.c b/mm/execmem.c
index 084a207e4278b2..9560441e57ab13 100644
--- a/mm/execmem.c
+++ b/mm/execmem.c
@@ -164,9 +164,11 @@ static void execmem_cache_clean(struct work_struct *work)
 
 	mutex_lock(mutex);
 	mas_for_each(&mas, area, ULONG_MAX) {
+		struct vm_struct *vm = find_vm_area(area);
 		size_t size = mas_range_len(&mas);
 
-		if (IS_ALIGNED(size, PMD_SIZE) &&
+		if (vm && get_vm_area_size(vm) == size &&
+		    IS_ALIGNED(size, PMD_SIZE) &&
 		    IS_ALIGNED(mas.index, PMD_SIZE)) {
 			struct vm_struct *vm = find_vm_area(area);
 

From 67c5a7bef45e14b41c971ef6d715d1eec53cd0fd Mon Sep 17 00:00:00 2001
From: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
Date: Wed, 9 Sep 2026 09:42:31 +0300
Subject: [PATCH 1431/1982] mm/nommu: reject wrapping ranges in
 access_remote_vm()

[ Upstream commit 51a8de81fd2edbf87d8046e352060329bb216fad ]

The NOMMU implementation of access_process_vm() rejects address ranges
whose end wraps around, but access_remote_vm() bypasses this check even
though both functions delegate to __access_remote_vm().

Move the wraparound check into __access_remote_vm() so it applies to both
entry points.

This is originally reported in [1].

Link: https://lore.kernel.org/20260909064231.18693-1-tasos.papagiannnis@gmail.com
Fixes: f55f199b7d76 ("NOMMU: implement access_remote_vm")
Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://lore.kernel.org/bpf/4ef240a5bea36ff84df9589671367832860795159386a4c8fba546a0fa8b786f@mail.kernel.org/ [1]
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Hajime Tazaki <thehajime@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/nommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/nommu.c b/mm/nommu.c
index c3a23b082adb94..d609ecdcf022b9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1644,6 +1644,9 @@ static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
 	struct vm_area_struct *vma;
 	int write = gup_flags & FOLL_WRITE;
 
+	if (addr + len < addr)
+		return 0;
+
 	if (mmap_read_lock_killable(mm))
 		return 0;
 
@@ -1697,9 +1700,6 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in
 {
 	struct mm_struct *mm;
 
-	if (addr + len < addr)
-		return 0;
-
 	mm = get_task_mm(tsk);
 	if (!mm)
 		return 0;

From 4b10d04a68b8e17bb805df65f81a36a9041dd7bd Mon Sep 17 00:00:00 2001
From: Jinmeng Zhou <jinmengzhou22@gmail.com>
Date: Mon, 7 Sep 2026 21:20:55 +0800
Subject: [PATCH 1432/1982] mm/hugetlb: fix subpool minimum reservation
 rollback

[ Upstream commit e4949a80f3b07e52dca76c34ce353633927a28a5 ]

When a reservation request is partially covered by a subpool minimum and
the remaining global reservation fails, the error path first calls
hugepage_subpool_put_pages() for the subpool-backed portion.  It removes
the failed global portion from used_hpages only afterwards.

hugepage_subpool_put_pages() uses used_hpages to decide whether rsv_hpages
should be restored.  Since used_hpages still includes the global portion,
it can remain at or above min_hpages and prevent that restoration.  It
then reports the subpool reservation as releasable, causing
hugetlb_acct_memory() to incorrectly decrement h->resv_huge_pages.

This was reproduced with four 2 MB huge pages and a hugetlbfs mount with
size=10M,min_size=8M.  After a successful three-page reservation, a
two-page reservation which needed one subpool page and one global page
failed with -ENOMEM.  HugePages_Rsvd incorrectly dropped from four to
three even though the subpool minimum was still four pages.

Roll back the failed global portion from used_hpages first, so that
hugepage_subpool_put_pages() evaluates the minimum reservation against the
current usage and returns the correct global adjustment.

Link: https://lore.kernel.org/20260907132055.26696-1-zhoujinmeng@bytedance.com
Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: Jinmeng Zhou <zhoujinmeng@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ebc78406335b3a..8832923dfbcd8f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -7427,15 +7427,6 @@ long hugetlb_reserve_pages(struct inode *inode,
 
 out_put_pages:
 	spool_resv = chg - gbl_reserve;
-	if (spool_resv) {
-		/* put sub pool's reservation back, chg - gbl_reserve */
-		gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
-		/*
-		 * subpool's reserved pages can not be put back due to race,
-		 * return to hstate.
-		 */
-		hugetlb_acct_memory(h, -gbl_resv);
-	}
 	/* Restore used_hpages for pages that failed global reservation */
 	if (gbl_reserve && spool) {
 		unsigned long flags;
@@ -7445,6 +7436,15 @@ long hugetlb_reserve_pages(struct inode *inode,
 			spool->used_hpages -= gbl_reserve;
 		unlock_or_release_subpool(spool, flags);
 	}
+	if (spool_resv) {
+		/* put sub pool's reservation back, chg - gbl_reserve */
+		gbl_resv = hugepage_subpool_put_pages(spool, spool_resv);
+		/*
+		 * subpool's reserved pages can not be put back due to race,
+		 * return to hstate.
+		 */
+		hugetlb_acct_memory(h, -gbl_resv);
+	}
 out_uncharge_cgroup:
 	hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h),
 					    chg * pages_per_huge_page(h), h_cg);

From 18223e4783fe08229e489b766c13d5abbd648b2a Mon Sep 17 00:00:00 2001
From: Longlong Xia <xialonglong@kylinos.cn>
Date: Tue, 8 Sep 2026 09:28:01 +0800
Subject: [PATCH 1433/1982] mm/zswap: publish the initial pool with
 list_add_rcu()

[ Upstream commit c1dd5e24a82d19bff8eef50ba8205d4776584aff ]

zswap_setup() publishes the pool on the zswap_pools list with a plain
list_add(), but the list is walked by concurrent RCU readers holding
nothing but rcu_read_lock() through zswap_total_pages(), e.g.
/proc/meminfo and the shrinker count path.

    CPU 0 (writer)                          CPU 1 (reader)
    --------------                          --------------
    zswap_pool_create():
      pool->zs_pool = zs_create_pool(); (1)
    list_add() -> __list_add():
      WRITE_ONCE(zswap_pools.next,
          &pool->list);                (2)   zswap_total_pages():
                                                pool = READ_ONCE(     (a)
                                                    zswap_pools.next);
                                                zs_get_total_pages(   (b)
                                                    pool->zs_pool);

If (2) becomes visible to CPU 1 before (1), CPU 1 finds the pool at (a)
but dereferences a wild pointer at (b).  Publish the node with
list_add_rcu().

Link: https://lore.kernel.org/20260908012801.1864430-1-xialonglong2025@163.com
Fixes: 91cdcd8d624b ("mm: zswap: optimize zswap pool size tracking")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260906133601.3563324-1-xialonglong2025%40163.com
Acked-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Nhat Pham <nphamcs@gmail.com>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/zswap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/zswap.c b/mm/zswap.c
index 18249dd96ef867..e4b2f6abefafb9 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1818,7 +1818,7 @@ static int zswap_setup(void)
 	pool = __zswap_pool_create_fallback();
 	if (pool) {
 		pr_info("loaded using pool %s\n", pool->tfm_name);
-		list_add(&pool->list, &zswap_pools);
+		list_add_rcu(&pool->list, &zswap_pools);
 		zswap_has_pool = true;
 		static_branch_enable(&zswap_ever_enabled);
 	} else {

From fac98d283c77acc9649b65164ae65982f9505e79 Mon Sep 17 00:00:00 2001
From: Longlong Xia <xialonglong@kylinos.cn>
Date: Sun, 6 Sep 2026 21:59:38 +0800
Subject: [PATCH 1434/1982] mm/zswap: enable zswap_ever_enabled in
 zswap_pool_create()

[ Upstream commit 91b4edb993e1549afdc3c2495216734b9f13f00e ]

If zswap is enabled by default at boot and pool creation fails, then a
pool is later created by updating the compressor, data written to zswap is
corrupted on swapin.

Enable the static key in zswap_pool_create(), covering boot-time and
runtime pool creation with a single site.

Verified with fault injection on a stock kernel (compressor builtin,
CONFIG_ZSWAP_DEFAULT_ON=n):

  1. Boot with zswap.enabled=1; pool creation fails, init completes
     pool-less (static key off).
  2. Echo an available compressor name to zswap.compressor.
  3. Enable zswap.
  4. madvise(MADV_PAGEOUT) a pattern-verified 512 MiB region, then
     fault it back in and verify.

Step 4 reads back 131072/131072 zeroed pages (zswpin=0, zswpout=131072)
without this patch; all pages intact (zswpin=131072) with it.

Link: https://lore.kernel.org/20260906135938.3568108-1-xialonglong2025@163.com
Fixes: 2d4d2b1cfb85 ("mm: zswap: add zswap_never_enabled()")
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Yosry Ahmed <yosry@kernel.org>
Assisted-by: Zcode:GLM-5.3
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/zswap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/zswap.c b/mm/zswap.c
index e4b2f6abefafb9..d2e5f0cff71dbf 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -288,6 +288,8 @@ static struct zswap_pool *zswap_pool_create(char *compressor)
 
 	zswap_pool_debug("created", pool);
 
+	static_branch_enable(&zswap_ever_enabled);
+
 	return pool;
 
 ref_fail:
@@ -1820,7 +1822,6 @@ static int zswap_setup(void)
 		pr_info("loaded using pool %s\n", pool->tfm_name);
 		list_add_rcu(&pool->list, &zswap_pools);
 		zswap_has_pool = true;
-		static_branch_enable(&zswap_ever_enabled);
 	} else {
 		pr_err("pool creation failed\n");
 		zswap_enabled = false;

From e5a02a186b4618d703ccda1151f9864e4e906036 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Tue, 15 Sep 2026 05:55:15 +0000
Subject: [PATCH 1435/1982] clk: imx: Fix clock reference leak in
 imx_get_clk_hw_by_name()

[ Upstream commit 8e177ca735761a1f03e1dedffd7ab00d6d0540ae ]

imx_get_clk_hw_by_name() obtains a consumer clock with
of_clk_get_by_name(), extracts the hardware pointer with __clk_get_hw()
and returns it without ever calling clk_put(), leaking the consumer
reference on both return paths.

Extract the hardware pointer first and drop the clock reference with
clk_put() before returning.

Fixes: 3b315214e091 ("clk: imx: implement new clk_hw based APIs")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055515.1730145-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index df83bd939492eb..542b58ccf120bf 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -119,12 +119,16 @@ struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,
 struct clk_hw *imx_get_clk_hw_by_name(struct device_node *np, const char *name)
 {
 	struct clk *clk;
+	struct clk_hw *hw;
 
 	clk = of_clk_get_by_name(np, name);
 	if (IS_ERR(clk))
 		return ERR_PTR(-ENOENT);
 
-	return __clk_get_hw(clk);
+	hw = __clk_get_hw(clk);
+	clk_put(clk);
+
+	return hw;
 }
 EXPORT_SYMBOL_GPL(imx_get_clk_hw_by_name);
 

From 2b637d3f1d2238f426b571424f352774556ef63f Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Tue, 15 Sep 2026 05:56:31 +0000
Subject: [PATCH 1436/1982] clk: imx: Fix clock reference leak in
 imx_obtain_fixed_clock_hw()

[ Upstream commit 52d4d1b26a5bc64de95099d0a3dd8b90dba1f3a3 ]

imx_obtain_fixed_clock_hw() obtains the clock through
imx_obtain_fixed_clock_from_dt(), which creates a consumer reference
via of_clk_get_from_provider(). The reference is discarded right after
__clk_get_hw() returns the hardware pointer, leaking it.

Keep the imx_clk_fixed() fallback unchanged and drop the DT-obtained
consumer reference with clk_put() once the hardware pointer has been
extracted.

Fixes: a4a4069f4523 ("clk: imx: Add imx_obtain_fixed_clock clk_hw based variant")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260915055631.1730231-1-vulab@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index 542b58ccf120bf..153e7405eae4da 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -95,11 +95,16 @@ struct clk_hw *imx_obtain_fixed_clock_hw(
 			const char *name, unsigned long rate)
 {
 	struct clk *clk;
+	struct clk_hw *hw;
 
 	clk = imx_obtain_fixed_clock_from_dt(name);
 	if (IS_ERR(clk))
-		clk = imx_clk_fixed(name, rate);
-	return __clk_get_hw(clk);
+		return __clk_get_hw(imx_clk_fixed(name, rate));
+
+	hw = __clk_get_hw(clk);
+	clk_put(clk);
+
+	return hw;
 }
 
 struct clk_hw *imx_obtain_fixed_of_clock(struct device_node *np,

From a0e83ac1d99e923a01a00fbe6cd000ee9646e62d Mon Sep 17 00:00:00 2001
From: Abdifatah Suruur <suruurism@gmail.com>
Date: Wed, 19 Aug 2026 11:42:17 +0300
Subject: [PATCH 1437/1982] xen/gntdev: prevent private mappings from becoming
 writable

[ Upstream commit 2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a ]

gntdev_mmap() rejects writable private (non-shared) mappings of foreign
grant pages, because a private writable mapping takes the COW path on
pages that have no proper struct-page backing.  However, VM_MAYWRITE is
left set, so userspace can map the grant read-only and then upgrade the
mapping to writable with mprotect(), hitting the same COW path the
check was written to prevent.

Clear VM_MAYWRITE for private mappings, as i915 does for its read-only
objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor
(CVE-2024-53071) and ptp: vmclock (commit
a5edadbae57e2298a56cf7a4e774a027905a331f).

Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>

Message-ID: <20260819084217.1577-1-suruurism@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/gntdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1e21b75114e5e9..02ebbdba861018 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1072,6 +1072,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 	if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED))
 		return -EINVAL;
 
+	/*
+	 * Private mappings of foreign grant pages must never become
+	 * writable: they would take the COW path on granted pages.
+	 */
+	if (!(vma->vm_flags & VM_SHARED))
+		vm_flags_clear(vma, VM_MAYWRITE);
+
 	pr_debug("map %d+%d at %lx (pgoff %lx)\n",
 		 index, count, vma->vm_start, vma->vm_pgoff);
 

From 7bc4323b464d134ded51822fb5b9930c8f682e46 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 15:27:19 +0000
Subject: [PATCH 1438/1982] soc: fsl: cpm1: tsa: Fix clock leak in
 tsa_of_parse_tdms()

[ Upstream commit 46201d760c48e771fa2febfcb0787f22c3b71387 ]

The error cleanup loop puts l1rsync_clk and l1rclk_clk a second time
and never puts l1tsync_clk or l1tclk_clk, because the branches that
guard the transmit clocks use the receive clock field names.

Use the matching field in each branch so every clock acquired by
tsa_of_parse_tdms() is released exactly once.

Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://lore.kernel.org/r/20260917152719.2160395-1-vulab@iscas.ac.cn
[chleroy: Fixed the same in tsa_remove()]
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/qe/tsa.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/soc/fsl/qe/tsa.c b/drivers/soc/fsl/qe/tsa.c
index 4a88e54d25b949..502e2ffe868984 100644
--- a/drivers/soc/fsl/qe/tsa.c
+++ b/drivers/soc/fsl/qe/tsa.c
@@ -865,12 +865,12 @@ static int tsa_of_parse_tdms(struct tsa *tsa, struct device_node *np)
 			clk_put(tsa->tdm[i].l1rclk_clk);
 		}
 		if (tsa->tdm[i].l1tsync_clk) {
-			clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
-			clk_put(tsa->tdm[i].l1rsync_clk);
+			clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+			clk_put(tsa->tdm[i].l1tsync_clk);
 		}
 		if (tsa->tdm[i].l1tclk_clk) {
-			clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
-			clk_put(tsa->tdm[i].l1rclk_clk);
+			clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+			clk_put(tsa->tdm[i].l1tclk_clk);
 		}
 	}
 	return ret;
@@ -1039,12 +1039,12 @@ static void tsa_remove(struct platform_device *pdev)
 			clk_put(tsa->tdm[i].l1rclk_clk);
 		}
 		if (tsa->tdm[i].l1tsync_clk) {
-			clk_disable_unprepare(tsa->tdm[i].l1rsync_clk);
-			clk_put(tsa->tdm[i].l1rsync_clk);
+			clk_disable_unprepare(tsa->tdm[i].l1tsync_clk);
+			clk_put(tsa->tdm[i].l1tsync_clk);
 		}
 		if (tsa->tdm[i].l1tclk_clk) {
-			clk_disable_unprepare(tsa->tdm[i].l1rclk_clk);
-			clk_put(tsa->tdm[i].l1rclk_clk);
+			clk_disable_unprepare(tsa->tdm[i].l1tclk_clk);
+			clk_put(tsa->tdm[i].l1tclk_clk);
 		}
 	}
 }

From e3b89306967275b927d7812cd9ab5bd6bc0e189e Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 2 Oct 2026 15:48:01 -0400
Subject: [PATCH 1439/1982] soc: fsl: dpio: Fix cleanup on IRQ registration
 failure

[ Upstream commit 45ecea8c55521d424513178fb612cefffb09a9f5 ]

IRQ registration happens after dpaa2_io_create(), but its failure path
only releases the IRQ resources and the MC portal. The I/O object stays
allocated and published in the service list and per-CPU lookup table,
while devres unmaps its portal registers after probe fails.

Call dpaa2_io_down() on IRQ registration failure to remove the object
from those lookup structures and free it. Reorder the error labels so
that a failed dpaa2_io_create() still skips this cleanup.

Remove unregister_dpio_irq_handlers() from the probe error path, since
no IRQ handler or affinity hint has been installed when registration
fails.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: fe8fe7723a3a ("soc: fsl: dpio: register dpio irq handlers after dpio create")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-2-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/dpio/dpio-driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index 9e3fddd8f5a912..7dc65f38d2fdbd 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -248,9 +248,9 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
 
 	return 0;
 
-err_dpaa2_io_create:
-	unregister_dpio_irq_handlers(dpio_dev);
 err_register_dpio_irq:
+	dpaa2_io_down(priv->io);
+err_dpaa2_io_create:
 	fsl_mc_free_irqs(dpio_dev);
 err_allocate_irqs:
 	dpio_disable(dpio_dev->mc_io, 0, dpio_dev->mc_handle);

From c3575058ef57d31dc12c544cee9653289b851036 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Fri, 2 Oct 2026 15:48:02 -0400
Subject: [PATCH 1440/1982] soc: fsl: dpio: Free the IRQ before releasing the
 I/O object

[ Upstream commit a7831c657c90e8f9165f6bbe0cc56262fee075e8 ]

The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
releases that object before tearing down the interrupts. The IRQ was
requested with devm_request_irq(), and unregister_dpio_irq_handlers()
only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
to the MC resource pool without freeing the handler. An interrupt can
therefore access the freed I/O object before devres releases the IRQ.

Explicitly free the managed IRQ in unregister_dpio_irq_handlers() before
returning its resource to the pool, and perform IRQ teardown before
releasing the I/O object. This also waits for an in-flight handler while
the object is still valid.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20261002194802.375497-3-mhun512@gmail.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/dpio/dpio-driver.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index 7dc65f38d2fdbd..2962e66e2e413e 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -88,6 +88,7 @@ static void unregister_dpio_irq_handlers(struct fsl_mc_device *dpio_dev)
 
 	/* clear the affinity hint */
 	irq_set_affinity_hint(irq->virq, NULL);
+	devm_free_irq(&dpio_dev->dev, irq->virq, &dpio_dev->dev);
 }
 
 static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
@@ -280,10 +281,10 @@ static void dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev)
 	priv = dev_get_drvdata(dev);
 	cpu = dpaa2_io_get_cpu(priv->io);
 
-	dpaa2_io_down(priv->io);
-
 	dpio_teardown_irqs(dpio_dev);
 
+	dpaa2_io_down(priv->io);
+
 	cpumask_set_cpu(cpu, cpus_unused_mask);
 
 	err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,

From b766cd114640acf06d7589232a23ba456478c073 Mon Sep 17 00:00:00 2001
From: Koichiro Den <den@valinux.co.jp>
Date: Fri, 21 Aug 2026 17:41:12 +0900
Subject: [PATCH 1441/1982] xen/privcmd: Only claim ioreqs matching an
 ioeventfd

[ Upstream commit 908019e5999161ca89da310c05ddbf7fc89c129e ]

The ioeventfd handler shares its event channel with the userspace device
model. It must only claim requests that match a registered ioeventfd.
Other requests are left for userspace.

ioeventfd_interrupt() currently marks every MMIO write INPROCESS before
looking for a match. For an unmatched request it drops the lock and
restores READY. Userspace may see INPROCESS and skip it. Restoring READY
does not send another notification. If userspace handles the request at
the same time, the READY store may overwrite its state.

Find a matching ioeventfd before changing the request state.

The lock now protects only the ioeventfd list. Use explicit virt_*mb()
barriers for the ioreq shared with Xen.

Fixes: f0d7db7b3324 ("xen: privcmd: Add support for ioeventfd")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260821084112.2374949-1-den@valinux.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/privcmd.c | 47 +++++++++++++++++--------------------------
 1 file changed, 18 insertions(+), 29 deletions(-)

diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index f37d8d212c066c..fc21473672d4b6 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -1168,51 +1168,40 @@ static irqreturn_t ioeventfd_interrupt(int irq, void *dev_id)
 	struct privcmd_kernel_ioreq *kioreq = port->kioreq;
 	struct ioreq *ioreq = &kioreq->ioreq[port->vcpu];
 	struct privcmd_kernel_ioeventfd *kioeventfd;
-	unsigned int state = STATE_IOREQ_READY;
+	bool matched = false;
 
-	if (ioreq->state != STATE_IOREQ_READY ||
-	    ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+	if (ioreq->state != STATE_IOREQ_READY)
 		return IRQ_NONE;
 
-	/*
-	 * We need a barrier, smp_mb(), here to ensure reads are finished before
-	 * `state` is updated. Since the lock implementation ensures that
-	 * appropriate barrier will be added anyway, we can avoid adding
-	 * explicit barrier here.
-	 *
-	 * Ideally we don't need to update `state` within the locks, but we do
-	 * that here to avoid adding explicit barrier.
-	 */
+	/* Xen publishes the request before changing its state to READY. */
+	virt_rmb();
 
-	spin_lock(&kioreq->lock);
-	ioreq->state = STATE_IOREQ_INPROCESS;
+	if (ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE)
+		return IRQ_NONE;
 
+	spin_lock(&kioreq->lock);
 	list_for_each_entry(kioeventfd, &kioreq->ioeventfds, list) {
 		if (ioreq->addr == kioeventfd->addr + VIRTIO_MMIO_QUEUE_NOTIFY &&
 		    ioreq->size == kioeventfd->addr_len &&
 		    (ioreq->data & QUEUE_NOTIFY_VQ_MASK) == kioeventfd->vq) {
+			/* Finish reading the request before claiming it. */
+			virt_mb();
+			ioreq->state = STATE_IOREQ_INPROCESS;
 			eventfd_signal(kioeventfd->eventfd);
-			state = STATE_IORESP_READY;
+			matched = true;
 			break;
 		}
 	}
 	spin_unlock(&kioreq->lock);
 
-	/*
-	 * We need a barrier, smp_mb(), here to ensure writes are finished
-	 * before `state` is updated. Since the lock implementation ensures that
-	 * appropriate barrier will be added anyway, we can avoid adding
-	 * explicit barrier here.
-	 */
-
-	ioreq->state = state;
-
-	if (state == STATE_IORESP_READY) {
-		notify_remote_via_evtchn(port->port);
-		return IRQ_HANDLED;
-	}
+	if (!matched)
+		return IRQ_NONE;
 
-	return IRQ_NONE;
+	/* Publish the response only after signaling the eventfd. */
+	virt_wmb();
+	ioreq->state = STATE_IORESP_READY;
+	notify_remote_via_evtchn(port->port);
+	return IRQ_HANDLED;
 }
 
 static void ioreq_free(struct privcmd_kernel_ioreq *kioreq)

From 01ed474a52876987c60689af1501a5824e87836d Mon Sep 17 00:00:00 2001
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Date: Tue, 6 Oct 2026 11:34:43 +0900
Subject: [PATCH 1442/1982] xen/pcifront: check that an AER callback exists
 before calling it

[ Upstream commit 3b4854b69ee70fffb2fa7acac09e715a7efcbae1 ]

pcifront_common_process() handles an AER request from the backend by
dispatching on aer_op.cmd to the bound driver's PCI error handler.  It
only checks that err_handler and err_handler->error_detected are present,
then for the mmio_enabled, slot_reset and resume commands it calls the
corresponding callback unconditionally.  Those three callbacks are
optional -- the PCI core NULL-checks each of them individually before
use -- and many drivers (for example igb, igc, ice and ixgbevf) install
error_detected without all of them.

aer_op.cmd comes from the shared ring, so a malicious or buggy backend
can send XEN_PCI_OP_aer_mmio (or _slotreset/_resume) for a device whose
driver leaves that callback NULL and make the frontend call through a
NULL pointer, crashing the guest.

Check each callback before calling it.  When mmio_enabled or slot_reset is
absent, return PCI_ERS_RESULT_RECOVERED so recovery proceeds, as the PCI
core does for a missing callback; returning PCI_ERS_RESULT_NONE would
instead make xen-pciback tear the guest domain down.

Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006023443.338194-1-yhlee@isslab.korea.ac.kr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/xen-pcifront.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index 11636634ae512f..451476ce10ae93 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -599,11 +599,16 @@ static pci_ers_result_t pcifront_common_process(int cmd,
 		case XEN_PCI_OP_aer_detected:
 			return pdrv->err_handler->error_detected(pcidev, state);
 		case XEN_PCI_OP_aer_mmio:
-			return pdrv->err_handler->mmio_enabled(pcidev);
+			if (pdrv->err_handler->mmio_enabled)
+				return pdrv->err_handler->mmio_enabled(pcidev);
+			return PCI_ERS_RESULT_RECOVERED;
 		case XEN_PCI_OP_aer_slotreset:
-			return pdrv->err_handler->slot_reset(pcidev);
+			if (pdrv->err_handler->slot_reset)
+				return pdrv->err_handler->slot_reset(pcidev);
+			return PCI_ERS_RESULT_RECOVERED;
 		case XEN_PCI_OP_aer_resume:
-			pdrv->err_handler->resume(pcidev);
+			if (pdrv->err_handler->resume)
+				pdrv->err_handler->resume(pcidev);
 			return PCI_ERS_RESULT_NONE;
 		default:
 			dev_err(&pdev->xdev->dev,

From 8ddf9f17929def10bb465ec7c56c50383c570d2b Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 17:11:41 +0000
Subject: [PATCH 1443/1982] xen-pciback: Fix pcistub_device ref leak in
 pcistub_get_gsi_from_sbdf()

[ Upstream commit cfaf31becde901f7a2376d36db628f8be0bc7283 ]

pcistub_get_gsi_from_sbdf() obtains the stub device with
pcistub_device_find(), which returns it with its kref incremented, and
returns psdev->gsi without dropping that reference again.  The caller
cannot release it either, so every lookup leaks one reference to the
stub device.

Release the reference after reading gsi.

Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jiqian Chen <Jiqian.Chen@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260916171141.2086627-1-vulab@iscas.ac.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 7de2fa67743c61..b128ceeee21bc4 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
 	int bus = PCI_BUS_NUM(sbdf);
 	int slot = PCI_SLOT(sbdf);
 	int func = PCI_FUNC(sbdf);
+	int gsi;
 
 	psdev = pcistub_device_find(domain, bus, slot, func);
-
 	if (!psdev)
 		return -ENODEV;
 
-	return psdev->gsi;
+	gsi = psdev->gsi;
+	pcistub_device_put(psdev);
+
+	return gsi;
 }
 #endif
 

From 0ec1d83baa7b319374e3071f48946240149efb74 Mon Sep 17 00:00:00 2001
From: Krzysztof Karas <krzysztof.karas@intel.com>
Date: Fri, 2 Oct 2026 05:33:20 +0000
Subject: [PATCH 1444/1982] iommu/dma: Catch scatterlist length overflows

[ Upstream commit 1c8f6308e557f32412e9d4678b3f029f47f6d9aa ]

It is possible, when a very large mapping uses only one
scatterlist, that padding overflows scatterlist's length field.
This results in:
 1) silently wrapping the value
 2) smaller than desired mappings produced by iommu_map_sg
 3) leaving mapped bytes in memory (no iommu_unmap)

Address this issue by adding overflow detection for scatterlist
length field.

Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 9da773ba550baa..aa9ebf2bc96ed9 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1453,6 +1453,11 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 		sg_dma_len(s) = s_length;
 		s->offset -= s_iova_off;
 		s_length = iova_align(iovad, s_length + s_iova_off);
+		if (overflows_type(s_length, s->length)) {
+			ret = -EOVERFLOW;
+
+			goto out_restore_sg;
+		}
 		s->length = s_length;
 
 		/*
@@ -1469,7 +1474,20 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 		 *   time through here (i.e. before it has a meaningful value).
 		 */
 		if (pad_len && pad_len < s_length - 1) {
-			prev->length += pad_len;
+			unsigned int new_prev_len;
+
+			/*
+			 * For large mappings spanning multiple GBs we
+			 * may not be able to fit all needed padding into
+			 * sg->length.
+			 */
+			if (check_add_overflow(prev->length, pad_len, &new_prev_len)) {
+				ret = -EOVERFLOW;
+
+				goto out_restore_sg;
+			}
+
+			prev->length = new_prev_len;
 			iova_len += pad_len;
 		}
 

From 428eeed252ba1dfc84ad10354ac27118a6bf84f2 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Fri, 9 Oct 2026 18:33:39 +0800
Subject: [PATCH 1445/1982] drm/ttm: return an error when kmapping a BO without
 pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fd485d47437ba1700dd47205a63b9f389a00aa36 ]

ttm_tt objects for imported sg tables (ttm_bo_type_sg, set up by
ttm_sg_tt_init() with TTM_TT_FLAG_EXTERNAL) only have DMA addresses and
no pages array. ttm_bo_kmap() and ttm_bo_vmap() still dereference
ttm->pages for them, so a driver that tries to CPU map such a BO oopses
instead of getting an error:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:ttm_bo_kmap+0x26c/0x300 [ttm]
  Call Trace:
   amdgpu_bo_kmap+0x89/0xb0 [amdgpu]
   amdgpu_userq_fence_read_wptr+0x116/0x170 [amdgpu]
   amdgpu_userq_signal_ioctl+0x3fe/0xbb0 [amdgpu]

Return -EINVAL in that case, like ttm_bo_kmap_try_from_panic() already
checks for a missing pages array.

Fixes: 75a57669cbc8 ("drm/ttm: add ttm_sg_tt_init")
Cc: stable@vger.kernel.org
Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20261009103419.4122940-1-Jesse.Zhang@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7aa35899e33ce9..7c1edf8c5c2dfb 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -359,6 +359,10 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 	if (ret)
 		return ret;
 
+	/* Imported sg tables only come with DMA addresses, no pages to map. */
+	if (!ttm->pages)
+		return -EINVAL;
+
 	if (num_pages == 1 && ttm->caching == ttm_cached &&
 	    !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) {
 		/*
@@ -422,7 +426,7 @@ EXPORT_SYMBOL(ttm_bo_kmap_try_from_panic);
  *
  * Returns
  * -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
  */
 int ttm_bo_kmap(struct ttm_buffer_object *bo,
 		unsigned long start_page, unsigned long num_pages,
@@ -496,7 +500,7 @@ EXPORT_SYMBOL(ttm_bo_kunmap);
  *
  * Returns
  * -ENOMEM: Out of memory.
- * -EINVAL: Invalid range.
+ * -EINVAL: Invalid range or the BO has no pages to map.
  */
 int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
 {
@@ -543,6 +547,9 @@ int ttm_bo_vmap(struct ttm_buffer_object *bo, struct iosys_map *map)
 		if (ret)
 			return ret;
 
+		if (!ttm->pages)
+			return -EINVAL;
+
 		/*
 		 * We need to use vmap to get the desired page protection
 		 * or to make the buffer object look contiguous.

From c2cbf1f5c5350b99bebb8062baa613f9900c0712 Mon Sep 17 00:00:00 2001
From: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Date: Fri, 9 Oct 2026 01:08:44 +0200
Subject: [PATCH 1446/1982] ALSA: usb-audio: Add mic resolution quirk for
 Logitech Webcam C200

[ Upstream commit 874323b68c93c6808e034dc0113681e822e6fb42 ]

The C200 (046d:0802) reports a mic capture volume range of
1536..7680 with a resolution of 1 (6144 steps), triggering
"Warning! Unlikely big volume step count (=6144), linear volume or
wrong cval->res?" at probe and exposing a uselessly fine-grained
mixer control.  This is the same firmware behavior as the other
UVC-era Logitech webcams already carrying QUIRK_FLAG_MIC_RES_384
(C500, C600, C210, C270, C310, C510, C525, ...), so apply the same
quirk: CTL_MSG_DELAY_1M (which the Logitech VENDOR_FLG would provide
if the device-specific entry did not short-circuit the lookup) plus
MIC_RES_384.

Verified on real hardware: with the quirk the warning disappears and
the driver logs "set resolution quirk: cval->res = 384".

Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261008230844.11246-1-olivier.kaloudoff@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index be80d9d14e0ad9..01a5564eda7af7 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2161,6 +2161,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 		   QUIRK_FLAG_DISABLE_AUTOSUSPEND),
 	DEVICE_FLG(0x045e, 0x070f, /* MS LifeChat LX-3000 Headset */
 		   QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
+	DEVICE_FLG(0x046d, 0x0802, /* Logitech Webcam C200 */
+		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
 	DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */
 		   QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
 	DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */

From ada2a9bcb9c49bce7091a30a6bb4e4551fbdd0d9 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Sat, 3 Oct 2026 18:19:43 +0800
Subject: [PATCH 1447/1982] wifi: ath12k: validate MAC/PHY capability count
 before saving

[ Upstream commit 86f2537877d6029487811bc3e0cd9e086a196000 ]

Firmware supplies the hardware mode count and the PHY bitmap for each
mode in the service-ready-ext event. ath12k_wmi_save_all_mac_phy_info()
uses those bitmaps to populate svc_ext_info->mac_phy_info, but the
destination is a fixed array of ATH12K_MAX_MAC_PHY_CAP elements.

If the total number of advertised PHY entries exceeds that limit, the
loop writes beyond mac_phy_info and corrupts adjacent memory.

ath12k_wmi_mac_phy_caps_parse() allocates the source array for
tot_phy_id entries and rejects excess capability TLVs. However, if the
event contains fewer capability TLVs than advertised, the remaining
allocated entries stay zeroed and are saved as invalid PHY information.

After parsing the MAC/PHY capability TLVs, validate the destination
capacity and reject an incomplete capability list before saving any
entries.

Fixes: 062ade23991e ("wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20261003101944.596546-1-yaojiale02@163.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath12k/wmi.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 91f293ab701378..67c9174a30aab2 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4814,6 +4814,7 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
 					u16 tag, u16 len,
 					const void *ptr, void *data)
 {
+	struct ath12k_svc_ext_info *svc_ext_info = &ab->wmi_ab.svc_ext_info;
 	struct ath12k_wmi_pdev *wmi_handle = &ab->wmi_ab.wmi[0];
 	struct ath12k_wmi_svc_rdy_ext_parse *svc_rdy_ext = data;
 	int ret;
@@ -4858,6 +4859,22 @@ static int ath12k_wmi_svc_rdy_ext_parse(struct ath12k_base *ab,
 				return ret;
 			}
 
+			if (svc_rdy_ext->tot_phy_id >
+			    ARRAY_SIZE(svc_ext_info->mac_phy_info)) {
+				ath12k_warn(ab, "too many PHY entries %u (max %zu)\n",
+					    svc_rdy_ext->tot_phy_id,
+					    ARRAY_SIZE(svc_ext_info->mac_phy_info));
+				return -EINVAL;
+			}
+
+			if (svc_rdy_ext->n_mac_phy_caps < svc_rdy_ext->tot_phy_id) {
+				ath12k_warn(ab,
+					    "not enough MAC/PHY caps %u, expected %u\n",
+					    svc_rdy_ext->n_mac_phy_caps,
+					    svc_rdy_ext->tot_phy_id);
+				return -EINVAL;
+			}
+
 			ath12k_wmi_save_all_mac_phy_info(ab, svc_rdy_ext);
 
 			svc_rdy_ext->mac_phy_done = true;

From 6a206ea1cfce608a0373de5e35badf0fa8ac9373 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 9 Oct 2026 14:29:34 +0200
Subject: [PATCH 1448/1982] USB: cdc-acm: fix urb leak on disconnect

[ Upstream commit 648b08aa37c1b24a61662ad78964f2bca659ca26 ]

Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.

Fixes: 140cb81ac8c6 ("USB: cdc-acm: fix broken runtime suspend")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260917161217.2161883-1-vulab@iscas.ac.cn/
Cc: stable@vger.kernel.org	# 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20261009122934.464142-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-acm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index b980cb08d675b7..884dc80868ca90 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -782,6 +782,7 @@ static void acm_port_shutdown(struct tty_port *port)
 		urb = usb_get_from_anchor(&acm->delayed);
 		if (!urb)
 			break;
+		usb_put_urb(urb);
 		wb = urb->context;
 		wb->use = false;
 		usb_autopm_put_interface_async(acm->control);
@@ -1710,7 +1711,7 @@ static int acm_resume(struct usb_interface *intf)
 			urb = usb_get_from_anchor(&acm->delayed);
 			if (!urb)
 				break;
-
+			usb_put_urb(urb);
 			acm_start_wb(acm, urb->context);
 		}
 

From f8b51537bad341024a406fd2ebe5ff5d8564792d Mon Sep 17 00:00:00 2001
From: Reinhard Speyerer <rspmn@arcor.de>
Date: Fri, 25 Sep 2026 14:56:52 +0200
Subject: [PATCH 1449/1982] USB: serial: option: add Rolling Wireless RN947R

[ Upstream commit 931aad81f3f2d26276fff6b7bda6793267a65725 ]

Add Rolling Wireless RN947R 0x9300 compositions:

Standard mode: DIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL

T:  Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#=  6 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=33f8 ProdID=9300 Rev= 0.00
S:  Manufacturer=Rolling Wireless
S:  Product=RN947R
S:  SerialNumber=xxxxxxxxxxx
C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=21 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#=22 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

QDL mode:

T:  Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 12 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=33f8 ProdID=9300 Rev= 0.00
S:  Manufacturer=Rolling Wireless
S:  Product=RN947R
S:  SerialNumber=xxxxxxxxxxx
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=  2mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/option.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 0f9a7a4c1f66e7..416ec012b0ace1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2511,6 +2511,10 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff),			/* Rolling RW135R-GL (laptop MBIM) */
 	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x30) },	/* Rolling RN947R */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x33f8, 0x9300, 0xff, 0xff, 0x10),
+	  .driver_info = ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) },			/* TDTECH MT5710-CN */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) },	/* NetPrisma LCUK54-WWD for Global */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },

From 1a95eef28e3a053ca3369807d26ecd9250998784 Mon Sep 17 00:00:00 2001
From: Michael Wyraz <michael@wyraz.de>
Date: Sun, 4 Oct 2026 11:43:21 +0200
Subject: [PATCH 1450/1982] USB: serial: option: add support for ASR 1286:4e3c
 modem

[ Upstream commit 87c56085bcdfec305f5c350fe1c58a62a7f65843 ]

The ASR modem used in the Tuoshi LT22M exposes an RNDIS function on
interfaces 0 and 1, a diagnostic port on interface 2, and AT ports on
interfaces 3 and 4. Match only the vendor-specific serial interfaces
so option does not bind to the RNDIS function.

Link: https://lore.kernel.org/all/d12635f9-9706-4dbd-8adb-d673c6a77202@wyraz.de/
Signed-off-by: Michael Wyraz <michael@wyraz.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 416ec012b0ace1..2f83e7b866f60a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2444,6 +2444,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x30) },	/* Compal EXM-G1x */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x04b7, 0x8217, 0xff, 0xff, 0x60) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1286, 0x4e3c, 0xff) },			/* ASR modem */
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */

From 778aa24d400eaebcad7bebbc69c496e126e99348 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 9 Oct 2026 14:32:42 +0200
Subject: [PATCH 1451/1982] USB: serial: usb_wwan: fix urb leak on disconnect

[ Upstream commit c78dd373b5c56a5a02da591b583c6b48d0d62954 ]

Make sure to drop the reference taken by usb_anchor_urb() when removing
URBs from the delayed URB anchor to prevent them from leaking when the
device is later disconnected.

Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the option driver")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165608.2085613-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org	# 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/usb_wwan.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 0017f6e969e122..67e1820bbbafe2 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -402,6 +402,7 @@ void usb_wwan_close(struct usb_serial_port *port)
 		urb = usb_get_from_anchor(&portdata->delayed);
 		if (!urb)
 			break;
+		usb_put_urb(urb);
 		unbusy_queued_urb(urb, portdata);
 		usb_autopm_put_interface_async(serial->interface);
 	}
@@ -579,6 +580,8 @@ static int usb_wwan_submit_delayed_urbs(struct usb_serial_port *port)
 		if (!urb)
 			break;
 
+		usb_put_urb(urb);
+
 		err = usb_submit_urb(urb, GFP_ATOMIC);
 		if (err) {
 			dev_err(&port->dev, "%s: submit urb failed: %d\n",

From f307ab1738e77d7e7c8b23406ceecce584de5d49 Mon Sep 17 00:00:00 2001
From: Zongmin Zhou <zhouzongmin@kylinos.cn>
Date: Fri, 2 Oct 2026 11:14:48 +0100
Subject: [PATCH 1452/1982] slimbus: messaging: fix leaked PM vote on tid
 allocation failure

[ Upstream commit c26cc979e28f5193310e4379e14aa6417375c565 ]

In slim_do_transfer(), when a transaction needs a tid and
slim_alloc_txn_tid() fails, the function returns directly instead of
jumping to slim_xfer_err. The runtime PM vote taken earlier with
pm_runtime_get_sync() is then never released, leaving the controller
permanently powered up.

As txn->tid is still 0 at that point, jumping to slim_xfer_err drops
the vote exactly like it is done for other failed transactions.

Fixes: d3062a2109309 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
Cc: stable@vger.kernel.org
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20261002101448.1084691-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/slimbus/messaging.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index e2dbe4a66b703a..ee127ef42046bf 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
 	if (need_tid) {
 		ret = slim_alloc_txn_tid(ctrl, txn);
 		if (ret)
-			return ret;
+			goto slim_xfer_err;
 
 		if (!txn->msg->comp)
 			txn->comp = &done;

From 24f7f97d3051299bc58f5366182662a7e31a5a24 Mon Sep 17 00:00:00 2001
From: Ross Lagerwall <ross.lagerwall@citrix.com>
Date: Tue, 6 Oct 2026 17:34:07 +0100
Subject: [PATCH 1453/1982] xen-blkfront: Fix IO race during unplug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 61b6d1df1d6234c38a6ea7e4f58e7da035ef6ab4 ]

During unplug, blkfront stops the hw queues and marks the disk as dead,
then later during removal calls del_gendisk(). However, IO issued after
the hw queues are stopped but before the call to del_gendisk() will be
queued but never handled. This causes del_gendisk() to hang forever
waiting for the queue refcount to drop to zero.

This can be reproduced by issuing IO during an artificial delay after
stopping the hw queues.

Fix this by simply not stopping the hw queues directly. Marking the disk
as dead already freezes the queue which prevents new requests being
added and it synchronously runs the hw queues to clear anything pending.
If the hw queues are stopped when calling blk_mark_disk_dead(), running
the hw queues is a no-op and can leave queued requests unprocessed.

Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20261006163411.2583538-1-ross.lagerwall@citrix.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/xen-blkfront.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index f37290fd3c5dba..79fe0b107887cf 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2133,10 +2133,8 @@ static void blkfront_closing(struct blkfront_info *info)
 		return;
 
 	/* No more blkif_request(). */
-	if (info->rq && info->gd) {
-		blk_mq_stop_hw_queues(info->rq);
+	if (info->gd)
 		blk_mark_disk_dead(info->gd);
-	}
 
 	for_each_rinfo(info, rinfo, i) {
 		/* No more gnttab callback work. */

From bb8ff1e7c85a7712bfff442a53458a1ad6c98cbb Mon Sep 17 00:00:00 2001
From: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Date: Thu, 17 Sep 2026 20:20:12 +0800
Subject: [PATCH 1454/1982] RISC-V: KVM: Fix IPI delivery for out-of-order
 vcpu_id

[ Upstream commit c367d3bf721f2bc391d6cfb47f6884e99d563df0 ]

The SBI IPI handler walks vCPUs with kvm_for_each_vcpu(), which
iterates by vcpu_idx (creation order) rather than vcpu_id order.
Since vcpu_id can be assigned out of order by userspace, a vCPU whose
hart_bit falls outside the XLEN-bit hart_mask range may be reached
before vCPUs the mask actually targets. In that case the handler jumps
to "done" and stops sending IPIs, leaving valid target vCPUs without
an interrupt.

Replace the early "goto done" with "continue" so vCPUs outside the
hart_mask range are skipped without aborting the loop.

Reproduced with a minimal userspace VMM driving KVM inside a QEMU
(RISC-V virt) guest: three vCPUs are created with ids 100, 0, 1 (in
creation order) and sbi_send_ipi(hart_mask=bit0, hbase=0) is called
from vcpu_id 1. Before this change the IPI is dropped and the ecall
returns SBI_ERR_INVALID_PARAM; with this change the IPI is delivered
and the ecall returns SBI_SUCCESS.

Fixes: 0611f78f83c9 ("riscv: KVM: Fix SBI IPI error generation")
Cc: stable@vger.kernel.org
Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260917122012.2577-1-yuanxiaofeng@eswincomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kvm/vcpu_sbi_replace.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/vcpu_sbi_replace.c b/arch/riscv/kvm/vcpu_sbi_replace.c
index b490ed1428a682..df3818fec0bfa8 100644
--- a/arch/riscv/kvm/vcpu_sbi_replace.c
+++ b/arch/riscv/kvm/vcpu_sbi_replace.c
@@ -64,8 +64,17 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
 			if (tmp->vcpu_id < hbase)
 				continue;
 			hart_bit = tmp->vcpu_id - hbase;
+			/*
+			 * kvm_for_each_vcpu() walks kvm->vcpus[] by
+			 * vcpu_idx, i.e. the creation order, which has
+			 * nothing to do with the vcpu_id (hart id) space
+			 * that the SBI IPI operates on. vcpu_ids need not
+			 * increase along the iteration, so harts outside
+			 * the hart_mask window must be skipped instead of
+			 * aborting the loop.
+			 */
 			if (hart_bit >= __riscv_xlen)
-				goto done;
+				continue;
 			if (!(hmask & (1UL << hart_bit)))
 				continue;
 		}
@@ -76,7 +85,6 @@ static int kvm_sbi_ext_ipi_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
 		kvm_riscv_vcpu_pmu_incr_fw(tmp, SBI_PMU_FW_IPI_RCVD);
 	}
 
-done:
 	if (hbase != -1UL && (hmask ^ sentmask))
 		retdata->err_val = SBI_ERR_INVALID_PARAM;
 

From 03c8debe85948e3950cda38b737777f9d7acdee1 Mon Sep 17 00:00:00 2001
From: Seongjun Hong <hsj0512@snu.ac.kr>
Date: Mon, 5 Oct 2026 16:16:29 +0000
Subject: [PATCH 1455/1982] vfio/mlx5: Fix boundary check in
 set_report_output()

[ Upstream commit 37b2ee6747b7857920ebc71eabc25208a39164a4 ]

Use > instead of >= on boundary check of recv_buf to avoid the bug which
the full message in the last slot of recv_buf is ignored even though the
received data size does not overflow the recv_buf.

Fixes: 9c7c5430bca3 ("vfio/mlx5: Align the page tracking max message size with the device capability")
Cc: stable@vger.kernel.org
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Seongjun Hong <hsj0512@snu.ac.kr>
Link: https://lore.kernel.org/r/20261005-vfio-mlx5-fix-boundary-check-v2-1-75599d2f4497@snu.ac.kr
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/mlx5/cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
index a92b095b90f6a9..a870ea1c0e9d30 100644
--- a/drivers/vfio/pci/mlx5/cmd.c
+++ b/drivers/vfio/pci/mlx5/cmd.c
@@ -1627,7 +1627,7 @@ set_report_output(u32 size, int index, struct mlx5_vhca_qp *qp,
 	int i;
 
 	buf_offset = index * qp->max_msg_size;
-	if (WARN_ON(buf_offset + size >= qp->recv_buf.npages * PAGE_SIZE ||
+	if (WARN_ON(buf_offset + size > qp->recv_buf.npages * PAGE_SIZE ||
 		    (nent > qp->max_msg_size / entry_size)))
 		return;
 

From 93658e949bcaaf277d57b0ff82f16c257f9d9e21 Mon Sep 17 00:00:00 2001
From: Guixin Liu <kanie@linux.alibaba.com>
Date: Thu, 8 Oct 2026 11:46:13 +0800
Subject: [PATCH 1456/1982] cxl/pci: Program the Port GPF timeouts before
 caching the DVSEC

[ Upstream commit ec2e30a682945616d194d7999cf96606b7ee5a88 ]

cxl_gpf_port_setup() caches the Port GPF DVSEC offset in the dport
before programming the phase timeouts, and ignores the return value
of both update_gpf_port_dvsec() calls: the function always reports
success.

A failing config write is therefore not only silent, it is also
permanent: the timeouts stay at the hardware defaults instead of the
maximum flush window the kernel is asking for, and the cached offset
keeps any later endpoint attach from retrying the update.

Propagate the errors and cache the offset only after both phases are
programmed, so the next endpoint attach retries the setup.

Fixes: 6af941db6a60 ("cxl/pci: Update Port GPF timeout only when the first EP attaching")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20261008034619.28059-3-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cxl/core/pci.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 68859eba30db3b..3e88c2e3304a34 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -860,7 +860,7 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
 
 	rc = pci_read_config_word(pdev, dvsec + offset, &ctrl);
 	if (rc)
-		return rc;
+		return pcibios_err_to_errno(rc);
 
 	if (FIELD_GET(base, ctrl) == GPF_TIMEOUT_BASE_MAX &&
 	    FIELD_GET(scale, ctrl) == GPF_TIMEOUT_SCALE_MAX)
@@ -870,11 +870,17 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
 	ctrl |= FIELD_PREP(scale, GPF_TIMEOUT_SCALE_MAX);
 
 	rc = pci_write_config_word(pdev, dvsec + offset, ctrl);
-	if (!rc)
-		pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
-			phase, GPF_TIMEOUT_BASE_MAX);
+	if (rc) {
+		rc = pcibios_err_to_errno(rc);
+		pci_warn(pdev, "Port GPF phase %d timeout write failed: %d\n",
+			 phase, rc);
+		return rc;
+	}
+
+	pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
+		phase, GPF_TIMEOUT_BASE_MAX);
 
-	return rc;
+	return 0;
 }
 
 int cxl_gpf_port_setup(struct cxl_dport *dport)
@@ -884,16 +890,22 @@ int cxl_gpf_port_setup(struct cxl_dport *dport)
 
 	if (!dport->gpf_dvsec) {
 		struct pci_dev *pdev;
-		int dvsec;
+		int dvsec, rc;
 
 		dvsec = cxl_gpf_get_dvsec(dport->dport_dev);
 		if (!dvsec)
 			return -EINVAL;
 
-		dport->gpf_dvsec = dvsec;
 		pdev = to_pci_dev(dport->dport_dev);
-		update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 1);
-		update_gpf_port_dvsec(pdev, dport->gpf_dvsec, 2);
+		rc = update_gpf_port_dvsec(pdev, dvsec, 1);
+		if (rc)
+			return rc;
+
+		rc = update_gpf_port_dvsec(pdev, dvsec, 2);
+		if (rc)
+			return rc;
+
+		dport->gpf_dvsec = dvsec;
 	}
 
 	return 0;

From f4b79f221d62326ccec4d68cfd4400dcbf20ab5f Mon Sep 17 00:00:00 2001
From: Koichiro Den <den@valinux.co.jp>
Date: Fri, 9 Oct 2026 13:54:50 +0900
Subject: [PATCH 1457/1982] cxl/port: Convert PCIe link latency to nanoseconds

[ Upstream commit 16440d6e4bf1175cda83438d9f9a8ae84bfcf0ee ]

Commit 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
converted CDAT latencies to nanoseconds and removed the conversion in
cxl_region_perf_data_calculate(), but left PCIe link latencies in
picoseconds.

This inflates the FlitLatency contribution to region and node latencies
by a factor of 1000, exposing incorrect values in sysfs. The resulting
abstract distances can incorrectly reverse the memory tier ordering of
nodes.

Convert the FlitLatency contribution to nanoseconds before adding it to
the access coordinates, rounding up as cdat_normalize() does.

Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-2-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cxl/core/port.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 8d2dc4b741781f..599aa9d9eddca1 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -2286,6 +2286,9 @@ EXPORT_SYMBOL_NS_GPL(schedule_cxl_memdev_detach, "CXL");
 
 static void add_latency(struct access_coordinate *c, long latency)
 {
+	/* Convert link latency from picoseconds to nanoseconds. */
+	latency = DIV_ROUND_UP(latency, 1000);
+
 	for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
 		c[i].write_latency += latency;
 		c[i].read_latency += latency;

From e5ab68567bcf62011dbb318957c220a55f84fe47 Mon Sep 17 00:00:00 2001
From: Koichiro Den <den@valinux.co.jp>
Date: Fri, 9 Oct 2026 13:54:51 +0900
Subject: [PATCH 1458/1982] cxl: Account for link width in latency calculation

[ Upstream commit db4503d4575cdd2fad7e8a13a8a8ffcbc86d152d ]

cxl_pci_get_latency() derives bandwidth from the per-lane speed returned
by pcie_link_speed_mbps(), ignoring the negotiated link width. This
overestimates the FlitLatency contribution for multi-lane links.
Sections 2.11.3 and 2.11.4 of the Intel CXL Memory Device Software Guide
describe the link bandwidth as the product of the negotiated speed and
width.

Replace pcie_link_speed_mbps() with pcie_link_bandwidth_mbps() and
migrate both CXL callers (the only users of the API). The new helper
obtains speed and width from a single Link Status read. The CXL
bandwidth calculation no longer needs a separate width read and
multiplication.

While at it, make error handling more robust by converting PCI config
read errors to negative errno values and checking for zero bandwidth
before calculating latency.

Fixes: 4d07a05397c8 ("cxl: Calculate and store PCI link latency for the downstream ports")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>	# pci/pci.c
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-3-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cxl/core/pci.c | 22 ++++++++--------------
 drivers/pci/pci.c      | 23 ++++++++++++++++++-----
 include/linux/pci.h    |  2 +-
 3 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 3e88c2e3304a34..48c1f3854b799d 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -738,8 +738,8 @@ long cxl_pci_get_latency(struct pci_dev *pdev)
 {
 	long bw;
 
-	bw = pcie_link_speed_mbps(pdev);
-	if (bw < 0)
+	bw = pcie_link_bandwidth_mbps(pdev);
+	if (bw <= 0)
 		return 0;
 	bw /= BITS_PER_BYTE;
 
@@ -777,18 +777,12 @@ EXPORT_SYMBOL_NS_GPL(cxl_endpoint_decoder_reset_detected, "CXL");
 
 int cxl_pci_get_bandwidth(struct pci_dev *pdev, struct access_coordinate *c)
 {
-	int speed, bw;
-	u16 lnksta;
-	u32 width;
-
-	speed = pcie_link_speed_mbps(pdev);
-	if (speed < 0)
-		return speed;
-	speed /= BITS_PER_BYTE;
-
-	pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
-	width = FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
-	bw = speed * width;
+	int bw;
+
+	bw = pcie_link_bandwidth_mbps(pdev);
+	if (bw < 0)
+		return bw;
+	bw /= BITS_PER_BYTE;
 
 	for (int i = 0; i < ACCESS_COORDINATE_MAX; i++) {
 		c[i].read_bandwidth = bw;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index bab3213bafbda5..8cfcd711630315 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5892,18 +5892,31 @@ static enum pci_bus_speed to_pcie_link_speed(u16 lnksta)
 	return pcie_link_speed[FIELD_GET(PCI_EXP_LNKSTA_CLS, lnksta)];
 }
 
-int pcie_link_speed_mbps(struct pci_dev *pdev)
+/**
+ * pcie_link_bandwidth_mbps - get the current bandwidth of a single PCIe link
+ * @pdev: PCI device to query
+ *
+ * The bandwidth includes all negotiated lanes and does not account for
+ * encoding overhead. A negotiated width of zero gives zero bandwidth.
+ *
+ * Return: Bandwidth in Mb/s, or a negative errno on failure.
+ */
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev)
 {
 	u16 lnksta;
-	int err;
+	int speed, err;
 
 	err = pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnksta);
 	if (err)
-		return err;
+		return pcibios_err_to_errno(err);
+
+	speed = pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+	if (speed < 0)
+		return speed;
 
-	return pcie_dev_speed_mbps(to_pcie_link_speed(lnksta));
+	return speed * FIELD_GET(PCI_EXP_LNKSTA_NLW, lnksta);
 }
-EXPORT_SYMBOL(pcie_link_speed_mbps);
+EXPORT_SYMBOL(pcie_link_bandwidth_mbps);
 
 /**
  * pcie_bandwidth_available - determine minimum link settings of a PCIe
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 95c77e2a1d1f56..72d1ca12aaa8c8 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1413,7 +1413,7 @@ int pcie_set_mps(struct pci_dev *dev, int mps);
 u32 pcie_bandwidth_available(struct pci_dev *dev, struct pci_dev **limiting_dev,
 			     enum pci_bus_speed *speed,
 			     enum pcie_link_width *width);
-int pcie_link_speed_mbps(struct pci_dev *pdev);
+int pcie_link_bandwidth_mbps(struct pci_dev *pdev);
 void pcie_print_link_status(struct pci_dev *dev);
 int pcie_reset_flr(struct pci_dev *dev, bool probe);
 int pcie_flr(struct pci_dev *dev);

From 97c37dff8da731e662cf6a3016084ddffca68982 Mon Sep 17 00:00:00 2001
From: Koichiro Den <den@valinux.co.jp>
Date: Fri, 9 Oct 2026 13:54:52 +0900
Subject: [PATCH 1459/1982] cxl/acpi: Convert QTG _DSM latencies to picoseconds

[ Upstream commit 2658c66a5efb5f30f5ced708a5de831845b43f6d ]

The QTG _DSM expects read and write latencies in picoseconds, as
specified in CXL 3.0, Table 9-30.

The code base originally kept the latencies passed to the QTG _DSM in
picoseconds in effect. Commit 51293c565cf4 ("cxl: Fix incorrect region
perf data calculation") normalized CDAT and host bridge latencies to
nanoseconds, but did not add a conversion back to picoseconds when
constructing the _DSM input. Firmware can therefore select QTG IDs using
understated latencies.

Convert the latencies to picoseconds when constructing the _DSM input
package. Multiply in 64 bits and reject latencies that cannot fit in the
DWORD inputs defined by the specification.

Fixes: 51293c565cf4 ("cxl: Fix incorrect region perf data calculation")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261009045452.1107921-4-den@valinux.co.jp
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cxl/acpi.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 5e9bb0df46dd88..eeb6921950fc2e 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -205,9 +205,10 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
 			  int entries, int *qos_class)
 {
 	union acpi_object *out_obj, *out_buf, *obj;
+	/* QTG _DSM expects latencies in picoseconds. */
 	union acpi_object in_array[4] = {
-		[0].integer = { ACPI_TYPE_INTEGER, coord->read_latency },
-		[1].integer = { ACPI_TYPE_INTEGER, coord->write_latency },
+		[0].integer = { ACPI_TYPE_INTEGER, coord->read_latency * 1000ULL },
+		[1].integer = { ACPI_TYPE_INTEGER, coord->write_latency * 1000ULL },
 		[2].integer = { ACPI_TYPE_INTEGER, coord->read_bandwidth },
 		[3].integer = { ACPI_TYPE_INTEGER, coord->write_bandwidth },
 	};
@@ -225,6 +226,11 @@ cxl_acpi_evaluate_qtg_dsm(acpi_handle handle, struct access_coordinate *coord,
 	if (!entries)
 		return -EINVAL;
 
+	/* Latency inputs must fit in the DWORD fields defined by the spec. */
+	if (coord->read_latency > U32_MAX / 1000 ||
+	    coord->write_latency > U32_MAX / 1000)
+		return -ERANGE;
+
 	out_obj = acpi_evaluate_dsm(handle, &acpi_cxl_qtg_id_guid, 1, 1, &in_obj);
 	if (!out_obj)
 		return -ENXIO;

From 6c3de683d73d721568f82ea7a839c6ddcf2210a3 Mon Sep 17 00:00:00 2001
From: Adam Harshbarger <handyhandyman.adam@gmail.com>
Date: Thu, 3 Sep 2026 17:24:56 -0500
Subject: [PATCH 1460/1982] lib/plist: fix plist_requeue() corrupting order in
 the last bucket

[ Upstream commit 43c91b1522435429a63d175f5a953e6f727a4f88 ]

plist_requeue() is meant to move a node to the end of its own priority
run.  When the node heads the *last* priority bucket it is instead placed
at the head of the whole list, leaving the plist unsorted:

  built:      A(prio 0) B(prio 1) C(prio 1)
  requeue(B): B(prio 1) A(prio 0) C(prio 1)
  expected:   A(prio 0) C(prio 1) B(prio 1)

prio_list is a *headless* circular ring of the nodes that lead each
priority bucket.  The shortcut added by commit 95d4b3450ebe ("lib/plist.c:
add shortcut for plist_requeue()") takes

	iter = list_entry(iter->prio_list.next, struct plist_node,
			  prio_list);
	node_next = &iter->node_list;

which from the last bucket wraps round to the *first* bucket, so node_next
ends up pointing at the head of the list rather than at its end.  The
plist_for_each_continue() loop immediately below it computes the correct
answer (&head->node_list) for that case.

With any bucket after it the shortcut is correct, which is why this went
unnoticed: the benchmark in that commit measured elapsed time and never
checked the resulting order.

Keep the shortcut -- it is a real win -- but exclude the case where iter's
bucket is the last one, which is exactly when its ring successor is the
first bucket again.

Reachable from mm/swapfile.c, which rotates swap_avail_heads[] with
plist_requeue().  It takes three or more swap devices: at least two
distinct priorities, so that a later bucket exists for the ring to wrap
round from, and two or more devices sharing the lowest priority, so that
plist_requeue() does not return early.  One device per priority returns
early at the node->prio != iter->prio test.  A single priority is also
safe, but for a different reason worth stating: with one bucket no node is
ever linked onto prio_list at all -- plist_add() skips it for the first
node and for every node whose predecessor shares its priority -- so
list_empty(&iter->prio_list) holds and the shortcut is never entered.

Tested by driving three implementations -- the pre-95d4b3450ebe code,
current mainline, and this patch -- through 1,084,492 identical random
add/del/requeue operations over 24 nodes and 1..5 distinct priorities,
comparing the resulting node_list node for node after every operation:

  variant             differs from pre-95d4b3450ebe  left list unsorted
  pre-95d4b3450ebe    -- (reference)                                  0
  mainline                                  289,297             276,660
  this patch                                      0                   0

Link: https://lore.kernel.org/20260903222456.1881786-1-handyhandyman.adam@gmail.com
Fixes: 95d4b3450ebe ("lib/plist.c: add shortcut for plist_requeue()")
Signed-off-by: Adam Harshbarger <handyhandyman.adam@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Assisted-by: Claude:claude-opus-5
Cc: I Hsin Cheng <richard120310@gmail.com>
Cc: <stable@vger.kernel.org> # v6.15+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/plist.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/plist.c b/lib/plist.c
index 330febb4bd7d7b..1e9cb0e35af7fe 100644
--- a/lib/plist.c
+++ b/lib/plist.c
@@ -174,8 +174,15 @@ void plist_requeue(struct plist_node *node, struct plist_head *head)
 	/*
 	 * After plist_del(), iter is the replacement of the node.  If the node
 	 * was on prio_list, take shortcut to find node_next instead of looping.
+	 *
+	 * prio_list is a headless ring, so from the LAST bucket ->next wraps
+	 * round to the first one; in that case node_next is the list head.
 	 */
 	if (!list_empty(&iter->prio_list)) {
+		struct plist_node *first = plist_first(head);
+
+		if (iter->prio_list.next == &first->prio_list)
+			goto queue;
 		iter = list_entry(iter->prio_list.next, struct plist_node,
 				  prio_list);
 		node_next = &iter->node_list;

From d585cf76296c9cb0a1ba7b2a1983f9a21927cac1 Mon Sep 17 00:00:00 2001
From: Drobyshev Vladimir <enigma_137@icloud.com>
Date: Tue, 29 Sep 2026 20:38:33 +0300
Subject: [PATCH 1461/1982] USB: cdc-acm: add VeriFone VX820 device ID

[ Upstream commit ddbddee6592ecf6cf6c24d888780f9ad45a3e30b ]

Add USB ID 11ca:0219 for the VeriFone VX820 to the cdc-acm device
table and apply the SINGLE_RX_URB quirk.

Signed-off-by: Drobyshev Vladimir <enigma_137@icloud.com>
Link: https://patch.msgid.link/20260929173833.105208-1-enigma_137@icloud.com
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-acm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 884dc80868ca90..990482982a28ec 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1819,6 +1819,9 @@ static const struct usb_device_id acm_ids[] = {
 	{ USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
 	.driver_info = SINGLE_RX_URB,
 	},
+	{ USB_DEVICE(0x11ca, 0x0219), /* VeriFone Vx820 Gadget Serial */
+	.driver_info = SINGLE_RX_URB,
+	},
 	{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
 	.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
 	},

From a0234e0c052c32c22b7d5ecd6376c968d80cca9f Mon Sep 17 00:00:00 2001
From: Ali Resool Tuama <aliresool567@gmail.com>
Date: Fri, 2 Oct 2026 20:42:12 +0300
Subject: [PATCH 1462/1982] USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE
 for GameSir G7 SE

[ Upstream commit 40224df29729618ecd88c5c0077e71b1e82c7a3a ]

The GameSir G7 SE wired controller first enumerates as 3537:10a0 and
then re-enumerates in a mode it picks from how the host enumerated it.

When the configuration descriptor is fetched the Linux way, 9 bytes
followed by the full 80, the controller disconnects about 1 ms after
its string descriptors have been read, before SET_CONFIGURATION, and
comes back as 3537:1082, a generic HID gamepad without force feedback.

When the configuration descriptor is fetched in one 255-byte request,
as Windows does, it comes back as 3537:1010 in Xbox One (GIP) mode,
which xpad already supports, including rumble.

Skipping the device qualifier requests (USB_QUIRK_DEVICE_QUALIFIER)
makes no difference; the configuration descriptor request size alone
decides the mode. Add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for the 10a0
identity, as is already done for the ShanWan Wireless Gamepad.

Cc: stable <stable@kernel.org>
Assisted-by: claude-opus-5-5
Signed-off-by: Ali Resool Tuama <aliresool567@gmail.com>
Link: https://patch.msgid.link/20261002-master-v2-1-24b05d8792b5@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0f804a52ab763e..a8e5016fee982e 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -613,6 +613,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */
 	{ USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS },
 
+	/* GameSir G7 SE */
+	{ USB_DEVICE(0x3537, 0x10a0), .driver_info = USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE },
+
 	/* DELL USB GEN2 */
 	{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
 

From 5d254d1e59da5b4bb05025924220faabb255b48f Mon Sep 17 00:00:00 2001
From: Seungjin Bae <eeodqql09@gmail.com>
Date: Sat, 3 Oct 2026 17:55:20 -0400
Subject: [PATCH 1463/1982] usb: typec: ucsi: ccg: Validate altmode index in
 GET_CURRENT_CAM response

[ Upstream commit 02ee864e8d2142c5648998944c3306ea6a763c26 ]

When the PPM reports more than one DisplayPort alternate mode for a
connector, ucsi_ccg_update_altmodes() merges them into a single entry
in uc->updated[] and sets uc->has_multiple_dp. In that case,
ucsi_ccg_update_get_current_cam_cmd() rewrites the response of the
GET_CURRENT_CAM command. The response is a single byte holding the
index of the currently active alternate mode, and it is provided by
the PPM firmware.

The function uses this byte directly as an index into uc->orig[], and
then uses the linked_idx read from that entry as the translated index
into uc->updated[]. Both arrays have UCSI_MAX_ALTMODES entries, but
neither index is checked against that size.

If a malicious or buggy PPM reports a value of UCSI_MAX_ALTMODES or
larger, e.g. 0xFF, uc->orig[cam].linked_idx reads over the end of
uc->orig[]. The byte read from there is then used as the index for
writing cam into uc->updated[new_cam].active_idx, so the out-of-bounds
read is followed by an out-of-bounds write. This happens without any
userspace action, since the UCSI core issues GET_CURRENT_CAM on its own
when handling connector changes.

Fix this by rejecting responses whose index is out of range, printing an
error and returning -EPROTO, so that the caller cannot accept this.
Also check linked_idx before using it as an index, so that the write into
uc->updated[] is always within bounds.

The response is now only processed when the command completed without
an error. ucsi_sync_control_common() only reads the response when the
CCI reports command completion, so otherwise the buffer is not filled
and must not be mistaken for an invalid index.

This bug was found with a Python script that traces where firmware input
is used.

Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Cc: stable <stable@kernel.org>
Reported-by: Nathan Rebello <nathan.c.rebello.27@dartmouth.edu>
Assisted-by: LLM
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20261003215520.611083-2-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/ucsi/ucsi_ccg.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 6c1f62c78ac254..18236d5c30922e 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -383,14 +383,28 @@ static int ucsi_ccg_init(struct ucsi_ccg *uc)
 	return -ETIMEDOUT;
 }
 
-static void ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
+static int ucsi_ccg_update_get_current_cam_cmd(struct ucsi_ccg *uc, u8 *data)
 {
 	u8 cam, new_cam;
 
 	cam = data[0];
+	if (cam >= UCSI_MAX_ALTMODES) {
+		dev_err(uc->dev, "PPM returned invalid alternate mode index %u\n",
+			cam);
+		return -EPROTO;
+	}
+
 	new_cam = uc->orig[cam].linked_idx;
+	if (new_cam >= UCSI_MAX_ALTMODES) {
+		dev_err(uc->dev, "invalid linked alternate mode index %u for %u\n",
+			new_cam, cam);
+		return -EPROTO;
+	}
+
 	uc->updated[new_cam].active_idx = cam;
 	data[0] = new_cam;
+
+	return 0;
 }
 
 static bool ucsi_ccg_update_altmodes(struct ucsi *ucsi,
@@ -633,8 +647,10 @@ static int ucsi_ccg_sync_control(struct ucsi *ucsi, u64 command, u32 *cci,
 
 	switch (UCSI_COMMAND(command)) {
 	case UCSI_GET_CURRENT_CAM:
-		if (uc->has_multiple_dp)
-			ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
+		if (!ret && uc->has_multiple_dp &&
+		    (*cci & UCSI_CCI_COMMAND_COMPLETE) &&
+		    !(*cci & UCSI_CCI_ERROR))
+			ret = ucsi_ccg_update_get_current_cam_cmd(uc, (u8 *)data);
 		break;
 	case UCSI_GET_ALTERNATE_MODES:
 		if (UCSI_ALTMODE_RECIPIENT(command) == UCSI_RECIPIENT_SOP) {

From d0d15d7a11f2a45e5d29ab4780a094992d7a26a2 Mon Sep 17 00:00:00 2001
From: Michal Pecio <michal.pecio@gmail.com>
Date: Fri, 9 Oct 2026 18:16:23 +0300
Subject: [PATCH 1464/1982] usb: xhci: Fix bounce buffer overflow

[ Upstream commit 68c5cb7574c567e83ba95258cb146db95e069a87 ]

High-speed devices with out of spec 1024 byte bulk endpoints exist and
are allowed by USB core, but xhci-hcd always sets packet size to 512.
The exact nature of these devices isn't documented, commit fb5ee84ea72c
("USB: Accept bulk endpoints with 1024-byte maxpacket") only states
that they "don't work with xHCI host controllers", whatever it means.

But somebody (or a malicious device) can try, and then the driver will
allocate a 512 byte bounce buffer for this endpoint and may write up to
1024 bytes into it if particular scatter-gather URBs are used, because
xhci_align_td() obtains packet size from the descriptor. Fix this.

As a side effect, TRBs will be aligned to the packet size chosen by the
driver on all endpoints of all speeds. Alignment serves the xHC, not
device, so this is fine. Only out of spec devices are affected anyway.

Reported-by: co+fd80bc5967eb22c3@bugs.sh
Link: https://lore.kernel.org/linux-usb/D4tcSGerkYkIV1DmaUo1t8TaR5qQElDLkidn@bugs.sh/
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-ring.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index dc18da8385a216..071a0310d61001 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3600,15 +3600,13 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
 
 
 static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
-			 u32 *trb_buff_len, struct xhci_segment *seg)
+			 u32 *trb_buff_len, struct xhci_segment *seg, u32 max_pkt)
 {
 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
 	unsigned int unalign;
-	unsigned int max_pkt;
 	u32 new_buff_len;
 	size_t len;
 
-	max_pkt = xhci_usb_endpoint_maxp(urb->dev, urb->ep);
 	unalign = (enqd_len + *trb_buff_len) % max_pkt;
 
 	/* we got lucky, last normal TRB data on segment is packet aligned */
@@ -3753,9 +3751,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 		if (enqd_len + trb_buff_len < full_len) {
 			field |= TRB_CHAIN;
 			if (trb_is_link(ring->enqueue + 1)) {
-				if (xhci_align_td(xhci, urb, enqd_len,
-						  &trb_buff_len,
-						  ring->enq_seg)) {
+				if (xhci_align_td(xhci, urb, enqd_len, &trb_buff_len,
+						ring->enq_seg, ring->bounce_buf_len)) {
 					send_addr = ring->enq_seg->bounce_dma;
 					/* TD bounced at least, and last on this seg */
 					td->bounce_seg = ring->enq_seg;

From 857ba63871a010cd62a3a90ff3d6d401dc769ea4 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 9 Oct 2026 18:16:24 +0300
Subject: [PATCH 1465/1982] xhci: Prevent invalid vdev dereference during
 sideband unregister

[ Upstream commit fd616dc74e8f58f351f2b295620027116cd6e92e ]

Offloaded USB audio devices using the xhci-sideband API store a pointer to
the xhci virtual device (vdev) in the sideband structure when registering.

This pointer typically remains valid throughout the lifetime of the USB
device. If a configured offloaded device requires a reset, the USB core
usually unbinds or notifies the audio driver beforehand, ensuring that the
sideband is unregistered before the vdev is freed.

An exception occurs when the USB core resets a device to recover from a
failed resume, but a subsequent 'address device' request also fails. To
recover in this specific scenario, the xHCI driver disables and re-enables
the slot, which frees and re-allocates the vdev.

xhci_sideband_unregister() later dereferences the stale, previously freed
vdev pointer during disconnect, triggering a kernel oops:

 Unable to handle kernel paging request at virtual address dead000000000122
 Call trace:
  xhci_get_ep_ctx+0x0/0x38
  xhci_sideband_unregister+0x68/0xf0
  uaudio_disconnect+0x70/0x144
  usb_audio_disconnect+0x7c/0x268
  usb_unbind_interface+0x13c/0x340
  device_release_driver_internal+0x1c4/0x2bc
  usb_disable_device+0x84/0x190
  usb_disconnect+0xe8/0x338
  hub_event+0xbd8/0x19ac

Fix this by preventing the reallocation of the vdev in this specific error
path if the device is registered for sideband use.

Just propagate the error directly to the USB core. It should either retry
enumeration or detect the disconnected device, and handle it accordingly.

Debugging this issue to the dangling vdev pointer, reporting it, testing,
and initial patch with different solution by Lianqin Hu

Reported-by: Lianqin Hu <hulianqin@vivo.com>
Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217000B59003EDF233D7246D2B22@TYUPR06MB6217.apcprd06.prod.outlook.com/
Tested-by: Lianqin Hu <hulianqin@vivo.com>
Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20261009151624.618967-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a4fab82da76b68..b894ba988a3d91 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4435,10 +4435,13 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
 		dev_warn(&udev->dev, "Device not responding to setup %s.\n", act);
 
 		mutex_unlock(&xhci->mutex);
-		ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
-		if (!ret) {
-			if (xhci_alloc_dev(hcd, udev) == 1)
-				xhci_setup_addressable_virt_dev(xhci, udev);
+
+		if (!virt_dev->sideband) {
+			ret = xhci_disable_and_free_slot(xhci, udev->slot_id);
+			if (!ret) {
+				if (xhci_alloc_dev(hcd, udev) == 1)
+					xhci_setup_addressable_virt_dev(xhci, udev);
+			}
 		}
 		kfree(command->completion);
 		kfree(command);

From dfe2627f25b1f0785a5e0eb11a28ea75842cb8c1 Mon Sep 17 00:00:00 2001
From: Wayne Chang <waynec@nvidia.com>
Date: Wed, 16 Sep 2026 14:18:58 +0800
Subject: [PATCH 1466/1982] usb: typec: ucsi_ccg: Add retry mechanism in
 ccg_read

[ Upstream commit bbf6b99a57b2479bf51c3c8ad0946f4b8c33ed69 ]

CCG4 firmware occasionally fails to respond to I2C read requests,
especially when reading cci and intr_reg from the ISR path. In these
cases, i2c_transfer() returns -EREMOTEIO.

The CCG4 is EOL, and Infineon no longer supports firmware updates, so
a software workaround is necessary.

Attempt the read up to CCG_READ_MAX_RETRIES (4) times in total when
-EREMOTEIO is returned, sleeping ~1 ms via fsleep() between attempts.
This allows recovery from transient I2C failures without affecting
other error paths.

The sleep is safe because ccg_read() is called both from process
context and from ccg_irq_handler(), which runs in threaded IRQ
context (registered via request_threaded_irq() with a NULL hard-IRQ
handler), so sleeping is allowed in both cases.

Fixes: 247c554a14aa ("usb: typec: ucsi: add support for Cypress CCGx")
Cc: stable <stable@kernel.org>
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260916061858.1471606-1-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/ucsi/ucsi_ccg.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 18236d5c30922e..55dbe7508ea7fd 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -134,6 +134,8 @@ struct version_format {
 #define NVIDIA_FTB_DP_OFFSET	(2)
 #define NVIDIA_FTB_DBG_OFFSET	(3)
 
+#define CCG_READ_MAX_RETRIES	4
+
 struct version_info {
 	struct version_format base;
 	struct version_format app;
@@ -254,6 +256,7 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 	};
 	u32 rlen, rem_len = len, max_read_len = len;
 	int status;
+	int retry_count;
 
 	/* check any max_read_len limitation on i2c adapter */
 	if (quirks && quirks->max_read_len)
@@ -265,7 +268,17 @@ static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 		rlen = min_t(u16, rem_len, max_read_len);
 		msgs[1].len = rlen;
 		put_unaligned_le16(rab, buf);
-		status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+		for (retry_count = 0; retry_count < CCG_READ_MAX_RETRIES; retry_count++) {
+			status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+
+			/* Only retry on -EREMOTEIO, and not after the last attempt */
+			if (status != -EREMOTEIO || retry_count == CCG_READ_MAX_RETRIES - 1)
+				break;
+
+			fsleep(1000);
+		}
+
 		if (status < 0) {
 			dev_err(uc->dev, "i2c_transfer failed %d\n", status);
 			pm_runtime_put_sync(uc->dev);

From e763f0231776056e5c11973ab3923fca0441564d Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Fri, 4 Sep 2026 14:19:39 +0800
Subject: [PATCH 1467/1982] mailbox: altera: shut down RX polling timer on
 channel teardown

[ Upstream commit 0cf10e65639cba32d05994f85e6a8f08dd0ffe08 ]

The RX polling callback unconditionally rearms the timer after it
processes mailbox data.  altera_mbox_shutdown() uses
timer_delete_sync(), which waits for a running callback but does not
prevent that callback from rearming the timer after the deletion.

Use timer_shutdown_sync() for the final polling teardown so the timer
cannot be queued again while the mailbox channel is being released.
The timer is reinitialized with timer_setup() on a later channel startup,
so polling mode remains reusable.

Fixes: f62092f6d77d ("mailbox: Add Altera mailbox driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mailbox-altera.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/mailbox-altera.c b/drivers/mailbox/mailbox-altera.c
index 17278c2571d341..7cb91413ef7fc5 100644
--- a/drivers/mailbox/mailbox-altera.c
+++ b/drivers/mailbox/mailbox-altera.c
@@ -270,7 +270,7 @@ static void altera_mbox_shutdown(struct mbox_chan *chan)
 		writel_relaxed(~0, mbox->mbox_base + MAILBOX_INTMASK_REG);
 		free_irq(mbox->irq, chan);
 	} else if (!mbox->is_sender) {
-		timer_delete_sync(&mbox->rxpoll_timer);
+		timer_shutdown_sync(&mbox->rxpoll_timer);
 	}
 }
 

From 9db206e80d084988ff5c58ebd74a26b98335fc85 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <florian.fainelli@broadcom.com>
Date: Tue, 25 Aug 2026 12:16:19 -0700
Subject: [PATCH 1468/1982] mailbox: bcm74110: Cap rx_svc_init_list growth to
 prevent PMC-induced OOM

[ Upstream commit eb2ee504757674450a5e03e36e6b9340f064e599 ]

bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every
BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it
to rx_svc_init_list with no cap on list length.  The only consumers of
this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are
called only during probe and at shutdown respectively; after probe
completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words,
exhausting GFP_ATOMIC reserves and causing a whole-device denial of
service.

Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth.
bcm74110_rx_push_init_msg() now checks the count under the existing
rx_svc_list_lock before allocating; if the cap is reached the message is
dropped and a rate-limited warning is emitted.  The new rx_svc_init_count
field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue
and reset to zero by bcm74110_rx_flush_msg() on shutdown.

Fixes: 52436007b862 ("mailbox: Add support for bcm74110")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Assisted-by: Anthropic:claude-sonnet-4.6 cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Acked-by: Justin Chen <justin.chen@broadcom.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/bcm74110-mailbox.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/mailbox/bcm74110-mailbox.c b/drivers/mailbox/bcm74110-mailbox.c
index 2e7e86f3e6a4aa..0ae6c56b878690 100644
--- a/drivers/mailbox/bcm74110-mailbox.c
+++ b/drivers/mailbox/bcm74110-mailbox.c
@@ -97,6 +97,8 @@ struct bcm74110_mbox_chan {
 	int				type;
 };
 
+#define BCM74110_INIT_MSG_MAX		16
+
 struct bcm74110_mbox {
 	struct platform_device		*pdev;
 	void __iomem			*base;
@@ -105,6 +107,7 @@ struct bcm74110_mbox {
 	int				rx_chan;
 	int				rx_irq;
 	struct list_head		rx_svc_init_list;
+	unsigned int			rx_svc_init_count;
 	spinlock_t			rx_svc_list_lock;
 
 	struct mbox_controller		controller;
@@ -148,7 +151,15 @@ static void bcm74110_rx_push_init_msg(struct bcm74110_mbox *mbox, u32 val)
 	msg->msg = val;
 
 	spin_lock(&mbox->rx_svc_list_lock);
+	if (mbox->rx_svc_init_count >= BCM74110_INIT_MSG_MAX) {
+		spin_unlock(&mbox->rx_svc_list_lock);
+		kfree(msg);
+		dev_warn_ratelimited(&mbox->pdev->dev,
+				     "PMC INIT msg list full, dropping message\n");
+		return;
+	}
 	list_add_tail(&msg->list_entry, &mbox->rx_svc_init_list);
+	mbox->rx_svc_init_count++;
 	spin_unlock(&mbox->rx_svc_list_lock);
 }
 
@@ -225,6 +236,7 @@ static int bcm74110_rx_pop_init_msg(struct bcm74110_mbox *mbox, u32 func_type,
 				 list_entry) {
 		if (BCM_MSG_GET_FIELD(msg->msg, FUNC) == func_type) {
 			list_del(&msg->list_entry);
+			mbox->rx_svc_init_count--;
 			found = true;
 			break;
 		}
@@ -248,6 +260,7 @@ static void bcm74110_rx_flush_msg(struct bcm74110_mbox *mbox)
 
 	spin_lock_irqsave(&mbox->rx_svc_list_lock, flags);
 	list_splice_init(&mbox->rx_svc_init_list, &list_temp);
+	mbox->rx_svc_init_count = 0;
 	spin_unlock_irqrestore(&mbox->rx_svc_list_lock, flags);
 
 	list_for_each_entry_safe(msg, msg_tmp, &list_temp, list_entry) {

From 35ee206bdab6cb32e69798da9a29a68bceb1d593 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 09:39:23 +0000
Subject: [PATCH 1469/1982] mailbox: mtk-cmdq: Fix runtime PM leak in
 cmdq_mbox_flush()

[ Upstream commit 18e3e979826795b62e8916743bec4de660e7cb22 ]

pm_runtime_get_sync() leaves the runtime PM usage counter incremented
even when it fails, but cmdq_mbox_flush() returns the error without
dropping it.  The same happens when the GCE thread does not drain in
time and the function bails out with -EFAULT.

Undo the reference on both error paths.

Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mtk-cmdq-mailbox.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
index a1360b70b83fbf..6e915ec5deaae3 100644
--- a/drivers/mailbox/mtk-cmdq-mailbox.c
+++ b/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -506,8 +506,10 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
 	int ret;
 
 	ret = pm_runtime_get_sync(cmdq->mbox.dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(cmdq->mbox.dev);
 		return ret;
+	}
 
 	spin_lock_irqsave(&thread->chan->lock, flags);
 	if (list_empty(&thread->task_busy_list))
@@ -544,6 +546,9 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
 		dev_err(cmdq->mbox.dev, "Fail to wait GCE thread 0x%x done\n",
 			(u32)(thread->base - cmdq->base));
 
+		pm_runtime_mark_last_busy(cmdq->mbox.dev);
+		pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
 		return -EFAULT;
 	}
 	pm_runtime_mark_last_busy(cmdq->mbox.dev);

From f1f969a1903573128ef2cad84cbcaa8e1fed5c96 Mon Sep 17 00:00:00 2001
From: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Date: Wed, 16 Sep 2026 15:26:53 +0530
Subject: [PATCH 1470/1982] mailbox: qcom-ipcc: Guard against NULL con_priv in
 send_data()

[ Upstream commit 7b3cc361b5942ac600f38e5dff7aed009be34964 ]

qcom_ipcc_mbox_shutdown() clears chan->con_priv with no locking.
qcom_ipcc_mbox_send_data() dereferences the same field without
checking for NULL first, so a send racing a concurrent shutdown can
crash:

  mchan = chan->con_priv;
  ...
  hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);

Add the same NULL guard mbox_send_message() already uses for
chan->cl, and bail out before dereferencing a cleared con_priv.

To close the remaining race where send_data() reads con_priv a moment
before a concurrent shutdown clears it, acquire the spinlock in
qcom_ipcc_mbox_shutdown() using the modern guard(spinlock_irqsave)
primitive before setting con_priv to NULL.

Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/qcom-ipcc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
index dead907aa7a282..b0b4e40d9202a7 100644
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -10,6 +10,7 @@
 #include <linux/mailbox_controller.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/spinlock.h>
 
 #include <dt-bindings/mailbox/qcom-ipcc.h>
 
@@ -151,6 +152,9 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
 	struct qcom_ipcc_chan_info *mchan = chan->con_priv;
 	u32 hwirq;
 
+	if (!mchan)
+		return -EINVAL;
+
 	hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
 	writel(hwirq, ipcc->base + IPCC_REG_SEND_ID);
 
@@ -159,6 +163,8 @@ static int qcom_ipcc_mbox_send_data(struct mbox_chan *chan, void *data)
 
 static void qcom_ipcc_mbox_shutdown(struct mbox_chan *chan)
 {
+	guard(spinlock_irqsave)(&chan->lock);
+
 	chan->con_priv = NULL;
 }
 

From f5a35fc0dcac6d30aa84fce73b343369e3d7753f Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 9 Oct 2026 14:33:59 +0200
Subject: [PATCH 1471/1982] USB: serial: sierra: fix urb leak on write
 completion

[ Upstream commit e7daa54802c566ed3f22e81513f84c8c9197c5d1 ]

Make sure to drop the reference taken by usb_anchor_urb() also on
successful submission of delayed write URBs during runtime resume to
prevent them from leaking on completion.

Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while online")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/20260916165352.2085480-1-vulab@iscas.ac.cn
Cc: stable@vger.kernel.org	# 2.6.32
Cc: Oliver Neukum <oliver@neukum.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/sierra.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 741e68e4613960..bac926cfee2826 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -972,12 +972,13 @@ static int sierra_submit_delayed_urbs(struct usb_serial_port *port)
 			intfdata->in_flight--;
 			usb_unanchor_urb(urb);
 			kfree(urb->transfer_buffer);
-			usb_free_urb(urb);
 
 			spin_lock(&portdata->lock);
 			portdata->outstanding_urbs--;
 			spin_unlock(&portdata->lock);
 		}
+
+		usb_put_urb(urb);
 	}
 
 	if (ec)

From 6b84be6acf4a1e0bc33bbe13faa36ac768e7e1e2 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Fri, 9 Oct 2026 18:14:45 +0200
Subject: [PATCH 1472/1982] dm-snapshot: fix crash if dm_io_client_create fails

[ Upstream commit 829c4d21148a205eca864429e06530319e1f92d5 ]

If dm_io_client_create() fails, it stores error into the ps->io_client
variable. The code would try to free it later with
dm_io_client_destroy(ps->io_client), causing an invalid pointer
dereference. Fix this by setting ps->io_client = NULL.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-snap-persistent.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 0dc429eb269245..989f958c229bcf 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -325,8 +325,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
 	}
 
 	ps->io_client = dm_io_client_create();
-	if (IS_ERR(ps->io_client))
-		return PTR_ERR(ps->io_client);
+	if (IS_ERR(ps->io_client)) {
+		r = PTR_ERR(ps->io_client);
+		ps->io_client = NULL;
+		return r;
+	}
 
 	r = alloc_area(ps);
 	if (r)

From 36e0970b8217d9b1aba6e773070624e337f595af Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Fri, 9 Oct 2026 17:16:01 +0200
Subject: [PATCH 1473/1982] arm64/efi: Clear PTE_WRITE when applying
 EFI_MEMORY_RO

[ Upstream commit 215d7b6622733603751f546b9faf9b84b0c281d4 ]

set_permissions() sets PTE_RDONLY for regions that the Memory Attributes
Table describes as read-only, but leaves PTE_WRITE set.  PTE_WRITE is
the DBM bit, so when hardware dirty state management is enabled
(TCR_EL1.HD), such a descriptor is writable-clean rather than read-only,
and a write by the firmware will be permitted by the hardware (which
marks the entry dirty) instead of faulting.

Clear PTE_WRITE as well, as pte_wrprotect() does.

Cc: stable@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/efi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 6c371b158b99f7..a3c0d5c2e9f74a 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -116,8 +116,14 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)
 	const efi_memory_desc_t *md = spd->md;
 	pte_t pte = __ptep_get(ptep);
 
+	/*
+	 * Clear PTE_WRITE as well: it doubles as the DBM bit, and leaving it
+	 * set would permit the hardware to make the mapping writable again
+	 * when TCR_EL1.HD is set.
+	 */
 	if (md->attribute & EFI_MEMORY_RO)
-		pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+		pte = set_pte_bit(clear_pte_bit(pte, __pgprot(PTE_WRITE)),
+				  __pgprot(PTE_RDONLY));
 	if (md->attribute & EFI_MEMORY_XP)
 		pte = set_pte_bit(pte, __pgprot(PTE_PXN));
 	else if (system_supports_bti_kernel() && spd->has_bti)

From 3c61ac2bec9c92c9114a03c9e76412ed0e750655 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 17:17:16 +0000
Subject: [PATCH 1474/1982] btrfs: zoned: fix block group reference leak in
 btrfs_repair_one_zone()

[ Upstream commit 886f1aa6e6b30a02901aa7f140149d466e10a873 ]

btrfs_repair_one_zone() hands the block group reference taken by
btrfs_lookup_block_group() over to relocating_repair_kthread(), which
drops it.  However the return value of kthread_run() is not checked, so
when the kernel thread fails to spawn, nothing executes the put and the
block group reference is leaked.

Check kthread_run() and drop the reference if the thread failed to
start.

Fixes: f7ef5287a63d ("btrfs: zoned: relocate block group to repair IO failure in zoned filesystems")
CC: stable@vger.kernel.org
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 200b4e4a07994a..a07b5a4d6e4df1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -8302,6 +8302,7 @@ static int relocating_repair_kthread(void *data)
 bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
 {
 	struct btrfs_block_group *cache;
+	struct task_struct *task;
 
 	if (!btrfs_is_zoned(fs_info))
 		return false;
@@ -8319,8 +8320,9 @@ bool btrfs_repair_one_zone(struct btrfs_fs_info *fs_info, u64 logical)
 		return true;
 	}
 
-	kthread_run(relocating_repair_kthread, cache,
-		    "btrfs-relocating-repair");
+	task = kthread_run(relocating_repair_kthread, cache, "btrfs-relocating-repair");
+	if (IS_ERR(task))
+		btrfs_put_block_group(cache);
 
 	return true;
 }

From acc0ad90eefb7056198748b0be3b292a1d8da4b6 Mon Sep 17 00:00:00 2001
From: Hengyu Liang <hengyul@cs.unc.edu>
Date: Fri, 9 Oct 2026 13:33:59 -0400
Subject: [PATCH 1475/1982] btrfs: return -ENOTTY for unknown ioctls on the
 control device

[ Upstream commit 9985f1643ac3f8595862e2f82108f0ccae4cf959 ]

Commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name") made btrfs_control_ioctl() store the result
of btrfs_check_ioctl_vol_args_path() in ret before it looks at the
command.

However, ret is initialized to -ENOTTY and the switch has no default
case, so this initial value was what an unknown command returned. As of
now, every unknown ioctl on /dev/btrfs-control returns 0. A tool that
tries a control ioctl which the running kernel does not have is told
that the ioctl succeeded.

The issue can be reproduced with a simple C program, run as root:

    #include <fcntl.h>
    #include <stdio.h>
    #include <sys/ioctl.h>

    int main(void)
    {
            static char buf[4096];
            int fd = open("/dev/btrfs-control", O_RDWR);

            if (ioctl(fd, TCGETS, buf) < 0)
                    perror("ioctl");
            else
                    printf("ioctl succeeded\n");
            return 0;
    }

Before commit 5ab2b180884c ("btrfs: factor out validation of
btrfs_ioctl_vol_args::name"), the result is:

    ioctl: Inappropriate ioctl for device

After that commit, the result is:

    ioctl succeeded

This patch will add a default case that returns -ENOTTY.

Fixes: 5ab2b180884c ("btrfs: factor out validation of btrfs_ioctl_vol_args::name")
CC: stable@vger.kernel.org
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/super.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 6cc4fe2ccd8a70..61a0575fd162ae 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2284,6 +2284,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
 	case BTRFS_IOC_GET_SUPPORTED_FEATURES:
 		ret = btrfs_ioctl_get_supported_features((void __user*)arg);
 		break;
+	default:
+		ret = -ENOTTY;
+		break;
 	}
 
 out:

From caacd77e93d925e2f72d676dc0c563cb822a20b5 Mon Sep 17 00:00:00 2001
From: Gabor Juhos <j4g8y7@gmail.com>
Date: Mon, 28 Sep 2026 09:01:53 +0200
Subject: [PATCH 1476/1982] mtd: rawnand: qcom: fix read location register
 usage in config_nand_cw_read()

[ Upstream commit 94623942a66e031826756f9c92dbde9a12e2b4d2 ]

On QPIC v2 controllers, when the last codeword is being read, the read
location values must be programmed into the READ_LOCATION_LAST_CW_*
registers. Prior to commit 8c52932da5e6 ("mtd: rawnand: qcom: cleanup
qcom_nandc driver"), the config_nand_cw_read() function did it right,
but since then it always writes the read location values to the
READ_LOCATION_* registers even if the actual codeword is the last one.

Change the function to always configure the registers corresponding to
the actual codeword to restore the correct behaviour.

Cc: stable@vger.kernel.org
Fixes: 8c52932da5e6 ("mtd: rawnand: qcom: cleanup qcom_nandc driver")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/qcom_nandc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index 4dd6f1a4e79785..b469c01aacf973 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -328,14 +328,16 @@ config_nand_cw_read(struct nand_chip *chip, bool use_ecc, int cw)
 {
 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 	struct nand_ecc_ctrl *ecc = &chip->ecc;
-
 	__le32 *reg = &nandc->regs->read_location0;
+	int reg_base = NAND_READ_LOCATION_0;
 
-	if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw))
+	if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) {
 		reg = &nandc->regs->read_location_last0;
+		reg_base = NAND_READ_LOCATION_LAST_CW_0;
+	}
 
 	if (nandc->props->supports_bam)
-		qcom_write_reg_dma(nandc, reg, NAND_READ_LOCATION_0, 4, NAND_BAM_NEXT_SGL);
+		qcom_write_reg_dma(nandc, reg, reg_base, 4, NAND_BAM_NEXT_SGL);
 
 	qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
 	qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);

From d05766991f871d94dd15ec912fd703d09015b9a0 Mon Sep 17 00:00:00 2001
From: Weigang He <geoffreyhe2@gmail.com>
Date: Sat, 26 Sep 2026 14:28:53 +1000
Subject: [PATCH 1477/1982] mtd: parsers: qcom: fix offset/size overflow on
 large partitions

[ Upstream commit 2f7fa8d90694d21dce68ceabd8383252b111cfea ]

In parse_qcomsmem_part() the partition offset and size are computed as

	parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
	parts[j].size   = le32_to_cpu(pentry->length) * mtd->erasesize;

Both le32_to_cpu() and mtd->erasesize are 32-bit (u32). The multiply is
therefore evaluated in 32-bit arithmetic and the product is truncated to
32 bits before being widened and stored into the 64-bit (u64)
parts[j].offset / parts[j].size fields, so the 64-bit destinations are
never used at their full width.

The SMEM partition table is firmware-provided and the per-entry offset
and length are not bounds-checked against the device geometry (only
numparts is capped). On a sufficiently large flash, a partition whose
(offset|length) * erasesize is >= 2^32 gets a silently truncated
offset/size and is mapped to the wrong region of the master MTD, which
can overlap or extend into an unintended area.

Cast one operand to u64 so the multiplication is performed in 64-bit and
the result fits the 64-bit fields without truncation.

Found by static analysis tool CodeQL.

Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/parsers/qcomsmempart.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c
index 4311b89d8df005..b12d87c3b02326 100644
--- a/drivers/mtd/parsers/qcomsmempart.c
+++ b/drivers/mtd/parsers/qcomsmempart.c
@@ -143,9 +143,9 @@ static int parse_qcomsmem_part(struct mtd_info *mtd,
 			*c = tolower(*c);
 
 		parts[j].name = name;
-		parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
+		parts[j].offset = (u64)le32_to_cpu(pentry->offset) * mtd->erasesize;
 		parts[j].mask_flags = pentry->attr;
-		parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
+		parts[j].size = (u64)le32_to_cpu(pentry->length) * mtd->erasesize;
 		pr_debug("%d: %s offs=0x%08x size=0x%08x attr:0x%08x\n",
 			 i, pentry->name, le32_to_cpu(pentry->offset),
 			 le32_to_cpu(pentry->length), pentry->attr);

From aa7065b8c699d6607abd35115687750f30321647 Mon Sep 17 00:00:00 2001
From: Tim Menninger <tmenninger@everpuredata.com>
Date: Thu, 24 Sep 2026 20:34:40 +0000
Subject: [PATCH 1478/1982] xprtrdma: prevent disconnect feedback during
 endpoint teardown

[ Upstream commit 0b5bb4e586f7b0a449f4d90a524f76a3be5db355 ]

xprt_autoclose() clears XPRT_CLOSE_WAIT before invoking the transport's
->close() operation. For RPC/RDMA, ->close() calls
rpcrdma_xprt_disconnect(), which disconnects the RDMA CM endpoint and
drains its QP.

Since commit 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on
connect"), RDMA_CM_EVENT_DISCONNECTED requests a SUNRPC transport
disconnect. Today that path, along with failed completion handling,
reaches xprt_force_disconnect() through rpcrdma_force_disconnect().

Commit c487eb7d8e41 ("xprtrdma: Clean up disconnect") later added
re_force_disconnect to ensure that multiple failure indications request
only one SUNRPC disconnect. However, the gate remains open when SUNRPC
itself begins endpoint teardown.

If re_force_disconnect is still clear, either a CM disconnect event or a
completion error can set XPRT_CLOSE_WAIT again while the current close
is in progress. When the transport send lock is subsequently released,
xprt_clear_locked() observes XPRT_CLOSE_WAIT and queues another
autoclose.

Requesting a disconnect this way is necessary when a connection is lost
unexpectedly, but not when the event was generated by
rpcrdma_xprt_disconnect() itself. In that case SUNRPC is already
committed to closing the transport.

Mark re_force_disconnect before initiating local endpoint teardown so
that CM events and completion errors caused by that teardown cannot
request another close. An unexpected error that wins the race before
local endpoint teardown begins can still request a disconnect normally.

Use a fully ordered exchange so that the gate is globally closed before
rdma_disconnect() can transition the QP to error and generate the
callbacks that the gate suppresses.

In 30-second traces of a sustained recovery loop, without this change
there were 7,693 xprt_force_disconnect() calls, 6,267 SUNRPC autocloses,
and 172,892 receive-side IB_WC_WR_FLUSH_ERR completions. With this
change, the same tracepoints recorded 3,512 xprt_force_disconnect()
calls, 3,212 autocloses, and 131,287 receive-side flush completions.
Thus QP teardown continues to produce flushed completions, but closing
the disconnect gate before teardown substantially reduces their
feedback into the SUNRPC close path.

Fixes: 31e62d25b5b8 ("xprtrdma: Simplify RPC wake-ups on connect")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtrdma/verbs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 8449107b2a0951..111c415f1aedac 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -114,9 +114,9 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
 	rpcrdma_ep_put(ep);
 }
 
-/* Ensure xprt_force_disconnect() is invoked exactly once when a
- * connection is closed or lost. (The important thing is it needs
- * to be invoked "at least" once).
+/* Ensure xprt_force_disconnect() is invoked at most once for an
+ * unexpected endpoint failure. Local endpoint teardown closes this
+ * gate before it can generate CM events and flushed completions.
  */
 void rpcrdma_force_disconnect(struct rpcrdma_ep *ep)
 {
@@ -587,6 +587,9 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt)
 	if (!ep)
 		return;
 
+	/* Prevent teardown-generated events from requesting another close. */
+	atomic_xchg(&ep->re_force_disconnect, 1);
+
 	id = ep->re_id;
 	rc = rdma_disconnect(id);
 	trace_xprtrdma_disconnect(r_xprt, rc);

From 85eaf47588492bc75206b27b0c679610e49d2a81 Mon Sep 17 00:00:00 2001
From: Yongjian Mu <ymu@everpuredata.com>
Date: Mon, 12 Oct 2026 17:06:19 +0000
Subject: [PATCH 1479/1982] xprtrdma: trim head iovec when the payload arrives
 via a Write chunk

[ Upstream commit 9ee534a75912361308b1f956bc3e7895a082a422 ]

The upper layer sets rq_rcv_buf.head[0].iov_len from its estimate of the
reply header size. For RPCSEC_GSS that estimate includes
auth->au_ralign, which gss_create_new() initializes to GSS_VERF_SLACK >>
2 (25 XDR words, or 100 bytes) and which is corrected to the real
verifier size only after the first reply on that rpc_auth has been
unwrapped. In this case, the krb5 MIC verifier is 36 bytes, so every
request encoded before the first reply completes has a head that is 64
bytes too long.

On TCP this is harmless: xdr_realign_pages() moves the excess head
bytes, which are genuine reply data, into the page list. With
RPC-over-RDMA and a Write chunk (sec=krb5, i.e. RPC_GSS_SVC_NONE, where
DDP is allowed), the payload has already been placed directly into the
page list, and the receive buffer holds only the inline part of the
reply. rpcrdma_inline_fixup() clamps its local copy of the head length
to the inline length but leaves head.iov_len untouched, so
xdr_realign_pages() still sees iov_len > cur and shifts whatever lies
past the inline reply in the receive buffer into the front of the
directly-placed payload:

  rpc_xdr_recvfrom:  head=[...,196] page=524288 tail=[...,64]
  rpc_xdr_alignment: nfsv4 READ offset=132 copied=64

The first 64 bytes returned by each such READ are incorrect (zeroed, or
shifted right by 64 bytes depending on the kernel's xdr_shrink_bufhead()
implementation). This is readily hit with pNFS flexfiles over RDMA and
sec=krb5: the per-DS rpc_clnt gets a fresh rpc_auth whose first RPC is a
large READ. Reads following the first completed reply return the
expected data.

Commit cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in
rpcrdma_inline_fixup()") removed the head-length correction while fixing
the handling of pure-inline krb5p replies.

When a Write chunk conveyed the payload, trim head.iov_len (in both
rq_rcv_buf and rq_private_buf, which call_decode() expects to match) to
the inline length actually received so that the XDR layer does not
realign the page list. These READ replies have no trailing inline
fields, and the payload is already in the page list, so the upper
layer's head estimate can be safely reduced. Reduce buflen by the same
amount to avoid treating unused head capacity as additional tail
capacity. Pure inline replies and Reply chunk replies are unchanged.

Tested on Linux 6.8.0 and 7.3-rc4 with NFSv4.1 pNFS flexfiles over
RPC/RDMA and sec=krb5.

Fixes: cb0ae1fbb2f5 ("xprtrdma: Do not update {head, tail}.iov_len in rpcrdma_inline_fixup()")
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Mu <ymu@everpuredata.com>
Reviewed-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Tim Menninger <tmenninger@everpuredata.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtrdma/rpc_rdma.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e2694fb03ba1b3..091b8cb415ec76 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1033,12 +1033,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
  * @rqst: controlling RPC request
  * @srcp: points to RPC message payload in receive buffer
  * @copy_len: remaining length of receive buffer content
- * @pad: Write chunk pad bytes needed (zero for pure inline)
+ * @writelist: bytes conveyed by the Write chunk (zero for pure inline)
  *
  * The upper layer has set the maximum number of bytes it can
  * receive in each component of rq_rcv_buf. These values are set in
  * the head.iov_len, page_len, tail.iov_len, and buflen fields.
  *
+ * For READ replies with a Write chunk, the payload is already in
+ * the page list. An overestimated head length and buflen can be
+ * reduced without moving reply data.
+ *
  * Unlike the TCP equivalent (xdr_partial_copy_from_skb), in
  * many cases this function simply updates iov_base pointers in
  * rq_rcv_buf to point directly to the received reply data, to
@@ -1047,13 +1051,16 @@ void rpcrdma_reset_cwnd(struct rpcrdma_xprt *r_xprt)
  * Returns the count of bytes which had to be memcopied.
  */
 static unsigned long
-rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
+rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len,
+		     u32 writelist)
 {
 	unsigned long fixup_copy_count;
 	int i, npages, curlen;
 	char *destp;
 	struct page **ppages;
 	int page_base;
+	int pad = writelist & 3;
+	unsigned int delta;
 
 	/* The head iovec is redirected to the RPC reply message
 	 * in the receive buffer, to avoid a memcopy.
@@ -1065,8 +1072,20 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
 	 * head.iov_len bytes are copied into the page list.
 	 */
 	curlen = rqst->rq_rcv_buf.head[0].iov_len;
-	if (curlen > copy_len)
+	if (curlen > copy_len) {
+		/* These READ replies have no inline fields after the payload.
+		 * Trim the head without moving the directly-placed data.
+		 */
+		if (writelist) {
+			delta = curlen - copy_len;
+
+			rqst->rq_rcv_buf.head[0].iov_len = copy_len;
+			rqst->rq_private_buf.head[0].iov_len = copy_len;
+			rqst->rq_rcv_buf.buflen -= delta;
+			rqst->rq_private_buf.buflen -= delta;
+		}
 		curlen = copy_len;
+	}
 	srcp += curlen;
 	copy_len -= curlen;
 
@@ -1294,7 +1313,7 @@ rpcrdma_decode_msg(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep,
 	base = (char *)xdr_inline_decode(xdr, 0);
 	rpclen = xdr_stream_remaining(xdr);
 	r_xprt->rx_stats.fixup_copy_count +=
-		rpcrdma_inline_fixup(rqst, base, rpclen, writelist & 3);
+		rpcrdma_inline_fixup(rqst, base, rpclen, writelist);
 
 	r_xprt->rx_stats.total_rdma_reply += writelist;
 	return rpclen + xdr_align_size(writelist);

From a1aaab4ae87a7584f9b66f2fae5bc294e13062c8 Mon Sep 17 00:00:00 2001
From: Imre Kaloz <kaloz@kernel.org>
Date: Sun, 27 Sep 2026 12:56:09 +0200
Subject: [PATCH 1480/1982] PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream
 ports

[ Upstream commit 8e923e51892c7da91687dd5b8081ddb1f0fb395a ]

Runtime PM suspends an idle downstream port of a PLX/Broadcom PEX
8532/8533/8548 switch to D3hot, but that takes the whole switch down
with it: any device behind another port of the same switch then
faults with a fatal bus error on its next access, e.g. mptsas probe
on a Sun Ultra 45.

This surfaced on sparc64 once commit a5fb3ff63287 ("PCI: Allow PCI
bridges to go to D3Hot on all non-x86") let bridges enter D3hot. Keep
these downstream ports out of D3 by setting PCI_DEV_FLAGS_NO_D3.

Fixes: a5fb3ff63287 ("PCI: Allow PCI bridges to go to D3Hot on all non-x86")
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260927105609.8813-1-kaloz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index d29ff1da29b179..812b01d24fc475 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2386,6 +2386,24 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9050,
 DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2000, quirk_plx_pci9050);
 DECLARE_PCI_FIXUP_HEADER(0x1402, 0x2600, quirk_plx_pci9050);
 
+/*
+ * An idle downstream port of a PLX/Broadcom PEX 8532/8533/8548 switch
+ * autosuspends into D3hot, and that takes the whole switch down with
+ * it -- any device behind another port of the same switch then sees a
+ * fatal, non-recoverable bus fault on its next access. Keep these
+ * ports out of D3 entirely.
+ */
+static void quirk_plx_pex_no_d3(struct pci_dev *dev)
+{
+	if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM) {
+		dev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
+		pci_info(dev, "avoiding D3 on this downstream port\n");
+	}
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8532, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8533, quirk_plx_pex_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PLX, 0x8548, quirk_plx_pex_no_d3);
+
 static void quirk_netmos(struct pci_dev *dev)
 {
 	unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;

From ebc5521bed8878628998c2ca89d0a5d145bd9512 Mon Sep 17 00:00:00 2001
From: SJ Park <sj@kernel.org>
Date: Mon, 14 Sep 2026 07:23:18 -0700
Subject: [PATCH 1481/1982] mm/damon/sysfs-schemes: read
 sysfs_filter->addr_range only once

[ Upstream commit 60e58be27d5e16d35e0728298f994dcae9f208a5 ]

Patch series "mm/damon: move damos filter range arguments validation to
core".

DAMOS filter range arguments are being validated in the DAMON sysfs
interface.  Some of those have minor time-of-check to time-of-use (TOCTOU)
bugs.  In future, other callers might have duplicated validations with
similar bugs.

Fix the bugs and further refactor the code to move the validation to the
core layer.  Also add kunit test cases for the validations.

Patches 1 and 2 fix the existing TOCTOU bugs.  Patches 3 and 4 adds the
validation in the core layer.  Patch 5 drops the replicated validation in
DAMON sysfs interface.  Patch 6 further cleanup the code.  Patches 7 and 8
extends kunit tests to test the validation.

This patch (of 8):

DAMON sysfs interface reads the user-provided address range arguments for
addr type DAMOS filter twice.  Once for validation, and once again for
assignments to the variable that will be passed to the core layer.  If the
user updates the argument in parallel, an invalid address range could be
passed to the core layer.  Avoid it by doing the assignments first, and
then validating the assigned variables before passing those to the core
layer.

User impact of the bug should be trivial.  From the core layer's
perspective, the invalid address range is not really invalid.  It just
works as having a weird address range.  No critical issues such as a crash
or a leak could happen.  And sane users ain't do such parallel arguments
update anyway.  If they do, such racy behavior is arguably somewhat
expected and deserved.  That said, there is no reason to keep such races.

Link: https://lore.kernel.org/20260914142327.92510-1-sj@kernel.org
Link: https://lore.kernel.org/20260914142327.92510-2-sj@kernel.org
Fixes: 2f1abcfccd86 ("mm/damon/sysfs-schemes: support address range type DAMOS filter")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <davidgow@davidgow.net>
Cc: Usama Arif <usamaarif642@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/sysfs-schemes.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
index 37e0a8bef4b1f9..e95cddca0a10d6 100644
--- a/mm/damon/sysfs-schemes.c
+++ b/mm/damon/sysfs-schemes.c
@@ -2484,12 +2484,12 @@ static int damon_sysfs_add_scheme_filters(struct damos *scheme,
 				return err;
 			}
 		} else if (filter->type == DAMOS_FILTER_TYPE_ADDR) {
-			if (sysfs_filter->addr_range.end <
-					sysfs_filter->addr_range.start) {
+			filter->addr_range = sysfs_filter->addr_range;
+			if (filter->addr_range.end <
+					filter->addr_range.start) {
 				damos_destroy_filter(filter);
 				return -EINVAL;
 			}
-			filter->addr_range = sysfs_filter->addr_range;
 		} else if (filter->type == DAMOS_FILTER_TYPE_TARGET) {
 			filter->target_idx = sysfs_filter->target_idx;
 		} else if (filter->type == DAMOS_FILTER_TYPE_HUGEPAGE_SIZE) {

From 06eebc180008290a042403e66fff2e80542c99a0 Mon Sep 17 00:00:00 2001
From: Gregory Price <gourry@gourry.net>
Date: Sat, 12 Sep 2026 07:08:32 -0400
Subject: [PATCH 1482/1982] mm/madvise: reclaim isolated folios if PTE restart
 fails

[ Upstream commit 5445a6359d717354dd76d509b8e693f13403ec61 ]

MADV_PAGEOUT collects isolated folios on a local list before reclaiming
them after the PTE walk.  The reschedule path drops the PTE lock and then
restarts the mapping with pte_offset_map_lock().

A concurrent operation can remove or replace the PTE table while the lock
is dropped, causing pte_offset_map_lock() to return NULL.  Returning
directly in that case bypasses reclaim_pages(), leaving the collected
folios off the LRU with elevated references.

This results in a permanent memory leak.  nr_isolated_anon increases
reliably and does not decrease when the process dies.

Route the failure through the existing cleanup path so any isolated folios
are reclaimed or put back.

Simplest userland pseudo-code reproducer:

p = mmap(PMD_SIZE, ANONYMOUS);
touch_every_page(p, PMD_SIZE);
parallel {
   while (1) madvise(p, PMD_SIZE, MADV_PAGEOUT);
   while (1) {
       madvise(p, PMD_SIZE, MADV_DONTNEED);
       touch_every_page(p, PMD_SIZE);
   }
}

Reproduced in qemu trivially with some explicit widening of the race window.

Link: https://lore.kernel.org/20260912110832.3203902-1-gourry@gourry.net
Fixes: b2f557a21bc8 ("mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range()")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260821150912.183976-1-gourry@gourry.net
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Assisted-by: LLM
Cc: David Hildenbrand <david@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jiexun Wang <wangjiexun@tinylab.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/madvise.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index b8c25fea4fab9b..6b62e01f31911e 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -460,7 +460,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 restart:
 	start_pte = pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
 	if (!start_pte)
-		return 0;
+		goto out;
 	flush_tlb_batched_pending(mm);
 	arch_enter_lazy_mmu_mode();
 	for (; addr < end; pte += nr, addr += nr * PAGE_SIZE) {
@@ -564,6 +564,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 			folio_deactivate(folio);
 	}
 
+out:
 	if (start_pte) {
 		arch_leave_lazy_mmu_mode();
 		pte_unmap_unlock(start_pte, ptl);

From 45555f91acf8a09b630229396aade62cdd1c4537 Mon Sep 17 00:00:00 2001
From: Gregory Price <gourry@gourry.net>
Date: Sat, 12 Sep 2026 07:05:40 -0400
Subject: [PATCH 1483/1982] mm/madvise: use folio_trylock() in the cold/pageout
 PMD split

[ Upstream commit 5a6c9cf117fca3c38a98fb2a2d5549795c8b0b73 ]

MADV_COLD or MADV_PAGEOUT over part of a PMD splits the THP in
madvise_cold_or_pageout_pte_range().  Two threads doing that to the same
THP create spurious failures.

  CPU0                          CPU1
  ----                          ----
  folio_get()
  spin_unlock(ptl)
  folio_lock()
                                folio_get()
                                spin_unlock(ptl)
                                folio_lock()  <- blocks, keeps its ref
  split_folio()
    folio_expected_ref_count(folio) != folio_ref_count(folio) - 1
    -EAGAIN

CPU1 cannot drop its reference until it gets the lock CPU0 holds, so
CPU0's split always fails.  folio_trylock() makes CPU1 leave without ever
taking a reference.  The PTE branch of this same function already does
this, as do madvise_free_pte_range() and madvise_free_huge_pmd().

Reproducer: 400 rounds of eight threads calling MADV_COLD on half of each
of eight THPs, re-formed with MADV_COLLAPSE between rounds.  From
/proc/vmstat:

                     thp_split_page   thp_split_page_failed
    before                     3186                     860
    after                      3200                       0

The short before count is rounds where every thread failed and the advice
was dropped for that THP entirely.

On failure the walker returns 0 and nothing retries.  The PMD path becomes
best effort when the folio lock is held elsewhere - same as the PTE path.

Link: https://lore.kernel.org/20260912110540.3203010-1-gourry@gourry.net
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260817220810.1175596-1-gourry%40gourry.net
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/madvise.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index 6b62e01f31911e..505a580cd9c4ca 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -415,9 +415,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 		if (next - addr != HPAGE_PMD_SIZE) {
 			int err;
 
+			if (!folio_trylock(folio))
+				goto huge_unlock;
 			folio_get(folio);
 			spin_unlock(ptl);
-			folio_lock(folio);
 			err = split_folio(folio);
 			folio_unlock(folio);
 			folio_put(folio);

From a4bd35798a34248b6d14508f0a00d7e4d990908e Mon Sep 17 00:00:00 2001
From: Yuanhe Shu <xiangzao@linux.alibaba.com>
Date: Wed, 16 Sep 2026 19:25:45 +0800
Subject: [PATCH 1484/1982] mm/page_alloc: do not boost watermarks in kdump
 capture kernels

[ Upstream commit 331f94007d79b3c02d3098eea469a92aea3efc2c ]

A watermark boost is not confined to one watermark: wmark_pages() adds it
to min, low and high alike, so every watermark check sees it, including
should_reclaim_retry() and the last ditch ALLOC_WMARK_HIGH attempt in
__alloc_pages_may_oom().  Once the boost exceeds the memory still free the
allocator gives up and invokes the OOM killer, and a capture kernel that
is still booting has nothing to kill: the boot panics and the vmcore is
lost.

Seen on an arm64 machine with 64K pages, CONFIG_PAGE_BLOCK_MAX_ORDER=10
(pageblock = 64M) and crashkernel=512M, running a distribution kernel
based on 7.0.14.  A high order UNMOVABLE allocation fell back to a MOVABLE
pageblock while the capture kernel was still in do_initcalls():

  Node 0 DMA free:68096kB boost:65536kB min:68160kB
  low:68800kB high:69440kB managed:479168kB
  Out of memory and no killable processes...
  Kernel panic - not syncing: System is deadlocked on memory

The zone was not short of memory.  Subtracting the boost gives min:2624kB
low:3264kB high:3904kB, so the 68096kB still free sat 17 times above the
high watermark and the allocator would not even have entered its slow
path.  The boost supplied 65536kB of the 68160kB min and by itself put the
zone 64kB under water.  It is that large because boost_watermark() clamps
it with max(pageblock_nr_pages, max_boost); watermark_boost_factor alone
would have allowed 5824kB.

Commit 14f69140ff9c ("mm: limit boost_watermark on small zones") already
tried to protect capture kernels, but it infers them from the zone size
and skips the boost only below four pageblocks.  arm64 64K pageblocks were
512M then, so the guard reached zones up to 2G;
CONFIG_PAGE_BLOCK_MAX_ORDER can cap them at 64M, which shrinks the guard
to zones under 256M and lets this 468M zone through.

kdump is a property of the kernel, not of the zone, so test for it
directly.  A capture kernel exits within seconds and never uses the
fragmentation avoidance the boost buys.  Normal kernels are unaffected:
the size based check still covers their genuinely tiny zones.

Passing sysctl.vm.watermark_boost_factor=0 to the capture kernel does not
cover this window: sysctl.* parameters are written through procfs by
do_sysctl_args(), which runs after do_initcalls() where the panic above
happened, and watermark_boost_factor has no early_param of its own.

Link: https://lore.kernel.org/20260916112545.3707893-1-xiangzao@linux.alibaba.com
Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org> # v5.0
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ff863a87f2b853..b866357339c56f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -38,6 +38,7 @@
 #include <linux/vmstat.h>
 #include <linux/fault-inject.h>
 #include <linux/compaction.h>
+#include <linux/crash_dump.h>
 #include <trace/events/kmem.h>
 #include <trace/events/oom.h>
 #include <linux/prefetch.h>
@@ -2206,10 +2207,17 @@ static inline bool boost_watermark(struct zone *zone)
 
 	if (!watermark_boost_factor)
 		return false;
+
+	/*
+	 * A kdump capture kernel exits before a boost can pay off, while
+	 * the raised watermark can exceed the memory left for the dump.
+	 */
+	if (is_kdump_kernel())
+		return false;
+
 	/*
 	 * Don't bother in zones that are unlikely to produce results.
-	 * On small machines, including kdump capture kernels running
-	 * in a small area, boosting the watermark can cause an out of
+	 * On small machines, boosting the watermark can cause an out of
 	 * memory situation immediately.
 	 */
 	if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))

From 42dd1e6f1b0902154dda0829c7d388570c46af23 Mon Sep 17 00:00:00 2001
From: Hongfu Li <lihongfu@kylinos.cn>
Date: Fri, 18 Sep 2026 10:56:10 +0800
Subject: [PATCH 1485/1982] mm/hugetlb_cgroup: move per-node usage on cross
 node migration

[ Upstream commit fe0ba1909c59660f078560f5130e7af7c6004f12 ]

Patch series "mm/hugetlb_cgroup: move the per-node usage along with the
folio", v2.

The per-node usage reported by hugetlb.<size>.numa_stat is accounted
against folio_nid() in __hugetlb_cgroup_commit_charge() and
__hugetlb_cgroup_uncharge_folio(), so it is only correct while a folio
stays charged on the same node and in the same hugetlb_cgroup.

Two paths move a folio which stays charged, and neither moves the usage
with it.  hugetlb_cgroup_migrate() only moves the hugetlb_cgroup pointers
of a folio migrated to another node, and hugetlb_cgroup_move_parent() only
moves the page_counter charges and the hugetlb_cgroup pointer of the
folios of a dying cgroup.  In both cases the node (or cgroup) which was
charged keeps a usage which never goes away, while the node (or cgroup)
which ends up uncharging the folio underflows as soon as the folio is
freed.

Patch 1/2 moves the usage along with the folio on cross node migration,
patch 2/2 does the same for the folios a dying cgroup reparents.

This patch (of 2):

hugetlb.<size>.numa_stat uses folio_nid() to account usage in
__hugetlb_cgroup_commit_charge() and __hugetlb_cgroup_uncharge_folio().
hugetlb_cgroup_migrate() only moves hugetlb_cgroup pointers, leaving
per-node usage behind on the source node during cross-node migration.

When the migrated folio gets uncharged, we subtract usage from the
destination node counter.  This creates stale usage on the source node and
unsigned long counter underflow on the destination node.  The
hugetlb.<size>.numa_stat interface exposes these incorrect per-node usage
values to userspace.

Add a hugetlb_cgroup_move_usage() helper which moves the usage from the
old node to the new node, and call it from hugetlb_cgroup_migrate().

Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-0-2b6d8c2bdc36@kylinos.cn
Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-1-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb_cgroup.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index b6537a3e4f62c6..00b20c4ff222fa 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -187,6 +187,34 @@ static void hugetlb_cgroup_css_free(struct cgroup_subsys_state *css)
 	hugetlb_cgroup_free(hugetlb_cgroup_from_css(css));
 }
 
+static void hugetlb_cgroup_move_usage(struct hugetlb_cgroup *from,
+				      struct hugetlb_cgroup *to,
+				      struct folio *from_folio,
+				      struct folio *to_folio)
+{
+	int idx = hstate_index(folio_hstate(from_folio));
+	unsigned long nr_pages = folio_nr_pages(from_folio);
+	int from_nid = folio_nid(from_folio);
+	int to_nid = folio_nid(to_folio);
+	unsigned long usage;
+
+	lockdep_assert_held(&hugetlb_lock);
+
+	if (!from || !to)
+		return;
+
+	if (from == to && from_nid == to_nid)
+		return;
+
+	usage = from->nodeinfo[from_nid]->usage[idx];
+	if (WARN_ON_ONCE(usage < nr_pages))
+		return;
+	WRITE_ONCE(from->nodeinfo[from_nid]->usage[idx], usage - nr_pages);
+
+	usage = to->nodeinfo[to_nid]->usage[idx];
+	WRITE_ONCE(to->nodeinfo[to_nid]->usage[idx], usage + nr_pages);
+}
+
 /*
  * Should be called with hugetlb_lock held.
  * Since we are holding hugetlb_lock, pages cannot get moved from
@@ -914,6 +942,9 @@ void hugetlb_cgroup_migrate(struct folio *old_folio, struct folio *new_folio)
 	/* move the h_cg details to new cgroup */
 	set_hugetlb_cgroup(new_folio, h_cg);
 	set_hugetlb_cgroup_rsvd(new_folio, h_cg_rsvd);
+
+	hugetlb_cgroup_move_usage(h_cg, h_cg, old_folio, new_folio);
+
 	list_move(&new_folio->lru, &h->hugepage_activelist);
 	spin_unlock_irq(&hugetlb_lock);
 }

From 08ff60709252d894d6ccb406d839cfdf09998062 Mon Sep 17 00:00:00 2001
From: Hongfu Li <lihongfu@kylinos.cn>
Date: Fri, 18 Sep 2026 10:56:11 +0800
Subject: [PATCH 1486/1982] mm/hugetlb_cgroup: move per-node usage on cgroup
 reparenting

[ Upstream commit 23fac055c21176f66ed453394b533bdfc00f7fba ]

hugetlb_cgroup_css_offline() hands the folios of a dying cgroup over to
its parent with hugetlb_cgroup_move_parent(), which moves the page_counter
charges and the hugetlb_cgroup pointer of the folio but not its per-node
usage.  The parent's hugetlb.<size>.numa_stat is short by that usage while
they are charged, and underflows once they are freed, exposing incorrect
per-node usage values to userspace.

Move the per-node usage to the parent as well.  The folios keep their node
here, so only the cgroup which holds the usage changes.

Link: https://lore.kernel.org/20260918-for-hugetlb-charge-v2-2-2b6d8c2bdc36@kylinos.cn
Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb_cgroup.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 00b20c4ff222fa..7c59c20d685740 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -249,6 +249,8 @@ static void hugetlb_cgroup_move_parent(int idx, struct hugetlb_cgroup *h_cg,
 	/* Take the pages off the local counter */
 	page_counter_cancel(counter, nr_pages);
 
+	hugetlb_cgroup_move_usage(h_cg, parent, folio, folio);
+
 	set_hugetlb_cgroup(folio, parent);
 out:
 	return;

From b5b95b5176045583130799e05cdd6d00735536e9 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
Date: Fri, 18 Sep 2026 04:24:37 -0700
Subject: [PATCH 1487/1982] mm/shmem: report RCU-tasks quiescent states while
 undoing a range

[ Upstream commit ebd1a08c192109c83a87ddf42793ed6283180faf ]

This shows up in the Meta fleet on ftruncate() of large tmpfs files:

  INFO: rcu_tasks detected stalls on tasks:
  00000000752fd185: .. nvcsw: 59455/59455 holdout: 1 idle_cpu: -1/0
  task:rocksdb:bottom  state:R  running task
    __folio_split
    find_get_entry
    find_get_entries
    truncate_inode_partial_folio
    shmem_undo_range
    shmem_setattr
    notify_change
    do_ftruncate
    __x64_sys_ftruncate
    do_syscall_64

shmem_undo_range() walks the whole of the requested range in folio_batch
sized steps, twice, and its two cond_resched() calls are the only
reschedule points in that walk.

cond_resched() is not an RCU-tasks quiescent state.  Use
cond_resched_tasks_rcu_qs() at both points so the walk reports an
RCU-tasks quiescent state as it proceeds.

Link: https://lore.kernel.org/20260918-shmem-tasks-rcu-v1-1-79acf91a2569@debian.org
Fixes: 8315f42295d2 ("rcu: Add call_rcu_tasks()")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Paul E . McKenney" <paulmck@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/shmem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/shmem.c b/mm/shmem.c
index 0100110f77b8e1..f2b5a11e88a557 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1129,7 +1129,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
 		}
 		folio_batch_remove_exceptionals(&fbatch);
 		folio_batch_release(&fbatch);
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 	}
 
 	/*
@@ -1170,7 +1170,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
 
 	index = start;
 	while (index < end) {
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 
 		if (!find_get_entries(mapping, &index, end - 1, &fbatch,
 				indices)) {

From 528d332bb864a38fa3547a54c66a4c65fe13c054 Mon Sep 17 00:00:00 2001
From: Hao Ge <hao.ge@linux.dev>
Date: Wed, 16 Sep 2026 15:55:57 +0800
Subject: [PATCH 1488/1982] mm/alloc_tag: account for reserved tag ids in the
 kernel tag check

[ Upstream commit c6e5c0b9a493891634d0a413c3485930a28a8903 ]

The tag ids stored in the page flags include two reserved markers.
Id 0 means the page has no tag and id 1 means the tag was cleared,
so real tags start at CODETAG_ID_FIRST. The kernel-side check in
alloc_tag_sec_init() compared kernel_tags.count alone against the
addressable limit, so with the count at or just under the limit
the last tag ids wrapped into those markers. Pages allocated
through them then look the same as untagged pages on free, nothing
is ever subtracted from the real tag and /proc/allocinfo shows
that memory as still allocated.

Add the missing CODETAG_ID_FIRST, same as tags_addressable().

Link: https://lore.kernel.org/20260916075557.121316-1-hao.ge@linux.dev
Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Signed-off-by: Hao Ge <hao.ge@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/alloc_tag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c
index 7c6d3a086fdc4f..fbe9e6c9952103 100644
--- a/lib/alloc_tag.c
+++ b/lib/alloc_tag.c
@@ -276,7 +276,7 @@ void __init alloc_tag_sec_init(void)
 	kernel_tags.count = last_codetag - kernel_tags.first_tag;
 
 	/* Check if kernel tags fit into page flags */
-	if (kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
+	if (CODETAG_ID_FIRST + kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
 		shutdown_mem_profiling(false); /* allocinfo file does not exist yet */
 		pr_err("%lu allocation tags cannot be references using %d available page flag bits. Memory allocation profiling is disabled!\n",
 			kernel_tags.count, NR_UNUSED_PAGEFLAG_BITS);

From 42d4192fa904579a94a8172522938c441832e72c Mon Sep 17 00:00:00 2001
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Date: Mon, 21 Sep 2026 08:24:41 -0700
Subject: [PATCH 1489/1982] mm/damon/core: charge only the part of a region the
 filter left

[ Upstream commit 4ff3b4a54a32142497fb44b79d0920aa6ba3393d ]

Patch series "mm/damon/core: fix the size charged for a filter-trimmed
region", v2.

An address range DAMOS filter that partially overlaps a monitoring region
splits it, so the scheme action reaches only one side of the boundary.
damos_apply_scheme() reads the region size before that split and never
re-reads it, so the quota charge and schemes/<S>/stats/sz_tried account
for the whole original region.

Patch 1 re-reads the size after the core filters have run.  Patch 2 adds
KUnit coverage for what the function charges and reports, for the trimmed
cases and for the cases that must not change.

This patch (of 2):

An address range DAMOS filter that partially overlaps a monitoring region
splits the region at the filter boundary, so the scheme action is applied
to only one side of it.  damos_apply_scheme() reads the region size once
on entry, before damos_core_filter_out() performs that split.

The quota charge and the statistics update therefore account for the
region as it was before the trim.  schemes/<S>/stats/sz_tried counts
memory the filter excluded, which Documentation/mm/damon/design.rst says
is not counted as tried, and with quotas/bytes set the excluded part is
charged against the budget, throttling the scheme to a fraction of what
was configured.

User impact is that DAMOS could unexpectedly slowly run, due to
over-charged quota.  DAMOS stat could also be confusing.  No critical
events such as crashes or leask happen.

Re-read the region size after the core filters have run.

Link: https://lore.kernel.org/20260921152443.80132-1-sj@kernel.org
Link: https://lore.kernel.org/20260921152443.80132-2-sj@kernel.org
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Brendan Higgins <brendan.higgins@linux.dev>
Cc: David Gow <david@davidgow.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/damon/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/damon/core.c b/mm/damon/core.c
index 0bed1cd9e3a237..56f2343ffefacd 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2004,6 +2004,7 @@ static void damos_apply_scheme(struct damon_ctx *c, struct damon_target *t,
 		}
 		if (damos_filter_out(c, t, r, s))
 			return;
+		sz = damon_sz_region(r);
 		ktime_get_coarse_ts64(&begin);
 		trace_damos_before_apply(cidx, sidx, tidx, r,
 				damon_nr_regions(t), do_trace);

From 0beb6ba8c6b5b50be88a037392eb4693dd6e44ba Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Thu, 3 Sep 2026 13:29:26 -0500
Subject: [PATCH 1490/1982] platform/x86/amd/pmf: Validate the APTS state index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 192dddd5aa45166450820cef16521bdf23976a73 ]

The static slider APTS state index is supplied by the BIOS as an 8-bit
value, but apts_config_store contains only APTS_MAX_STATES entries. An
invalid firmware value can therefore cause amd_pmf_update_slider_v2() to
read beyond the end of the array.

Validate the selected index before applying the slider values and return
an error when it is out of range.

Fixes: 8362e862fb87 ("platform/x86/amd/pmf: Update sps power thermals according to the platform-profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260903182927.3556274-1-mario.limonciello@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/pmf/sps.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
index c28f3c5744c259..bf101e527b115e 100644
--- a/drivers/platform/x86/amd/pmf/sps.c
+++ b/drivers/platform/x86/amd/pmf/sps.c
@@ -248,20 +248,24 @@ static int amd_pmf_update_sps_power_limits_v2(struct amd_pmf_dev *pdev, int pwr_
 	switch (pwr_mode) {
 	case POWER_MODE_PERFORMANCE:
 		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_PERFORMANCE];
-		amd_pmf_update_slider_v2(pdev, index);
 		break;
 	case POWER_MODE_BALANCED_POWER:
 		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BALANCED];
-		amd_pmf_update_slider_v2(pdev, index);
 		break;
 	case POWER_MODE_POWER_SAVER:
 		index = config_store_v2.sps_idx.power_states[src][POWER_MODE_BEST_POWER_EFFICIENCY];
-		amd_pmf_update_slider_v2(pdev, index);
 		break;
 	default:
 		return -EINVAL;
 	}
 
+	if (index >= APTS_MAX_STATES) {
+		dev_err(pdev->dev, "Invalid APTS index: %d\n", index);
+		return -EINVAL;
+	}
+
+	amd_pmf_update_slider_v2(pdev, index);
+
 	return 0;
 }
 

From d43e5fc381a9ced73692f754376329df20831412 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Mon, 14 Sep 2026 09:17:32 -0500
Subject: [PATCH 1491/1982] platform/x86/amd: Stop counting intermediate cycles
 with metrics table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0c2c928ea7d33c8131b0785bda4e26a32dce5caa ]

The metrics table doesn't increment for all cases that can cause an
intermediate wakeup if the cycle is very fast.  This can make the intent
from commit 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5
seconds between HW sleep cycles") not work properly.

That commit originally was measured to work properly, but it was
accidental due to a logic error.  The logic error was fixed in
commit 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at
start of cycle") but this now masked the table doesn't always update.

Since that code was introduced, Daniel Gibson added a number of changes
to the logic which includes a state variable introduced in
commit 037f0b03c663a ("platform/x86/amd/pmc: Don't log during
intermediate wakeups").

Utilize that state variable to instead decide if a single sequence has
started.

Cc: Daniel Gibson <daniel@gibson.sh>
Cc: stable@vger.kernel.org # 7.1.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Cc: stable@vger.kernel.org # 6.18.y: 037f0b03c663a platform/x86/amd/pmc: Don't log during intermediate wakeups
Fixes: 4dbd11796f3a8 ("platform/x86/amd: pmc: Clear metrics table at start of cycle")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Link: https://patch.msgid.link/20260914141734.2703545-1-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/pmc/pmc.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index 000f876e27ebb0..fea41c8c1899a3 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -604,19 +604,6 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
 	return rc;
 }
 
-static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)
-{
-	/*
-	 * Starting a new HW sleep cycle right after waking from one
-	 * can cause electrical problems triggering the over voltage protection.
-	 * That is avoided by delaying the next suspend a bit, see also
-	 * https://lore.kernel.org/all/20250414162446.3853194-1-superm1@kernel.org/
-	 */
-	struct smu_metrics table;
-
-	return get_metrics_table(pdev, &table) == 0 && table.s0i3_last_entry_status;
-}
-
 static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
 {
 	/*
@@ -709,7 +696,7 @@ static void amd_pmc_s2idle_check(void)
 	struct amd_pmc_dev *pdev = &pmc;
 	int rc;
 
-	if (amd_pmc_intermediate_wakeup_need_delay(pdev) ||
+	if (!pdev->is_first_check_after_suspend ||
 	    amd_pmc_want_suspend_delay(pdev))
 		msleep(2500);
 

From 4b003a2ab67752f69bf23184dd3e4b92599fe51e Mon Sep 17 00:00:00 2001
From: Denis Benato <denis.benato@linux.dev>
Date: Wed, 16 Sep 2026 14:38:25 +0000
Subject: [PATCH 1492/1982] platform/x86: asus-wmi: fix unclear usage of
 bd->props.power
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fd83d81ddf058d487e6d6489b18094f068e66a59 ]

The bd->props.power is checked in parts of the driver correctly
comparing with BACKLIGHT_POWER_ON, while in others with a raw usage
of bd->props.power and !bd->props.power, moreover in certain checks
the logic has been inverted due to BACKLIGHT_POWER_ON being defined
as 0: fix both the wrong usage and the inconsistencies by using
proper comparisons.

Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Closes: https://lore.kernel.org/all/178362762638.911488.8564892548331679884@eldamar.lan/
Closes: https://lore.kernel.org/all/ea9c63d1-4776-49d5-9dc4-6c09498f99c9@linux.dev/
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Ponali <ponali2k@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-2-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-wmi.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 9f0f79030b5b8e..adff9f49b5677e 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4156,7 +4156,8 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
 	u32 ctrl_param = bd->props.brightness;
 	int err = 0;
 
-	if (bd->props.power) {
+	switch (bd->props.power) {
+	case BACKLIGHT_POWER_ON:
 		err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 1, NULL);
 		if (err < 0)
 			return err;
@@ -4164,12 +4165,17 @@ static int update_screenpad_bl_status(struct backlight_device *bd)
 		err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_LIGHT, ctrl_param, NULL);
 		if (err < 0)
 			return err;
-	}
+		break;
 
-	if (!bd->props.power) {
+	case BACKLIGHT_POWER_OFF:
 		err = asus_wmi_set_devstate(ASUS_WMI_DEVID_SCREENPAD_POWER, 0, NULL);
 		if (err < 0)
 			return err;
+		break;
+
+	default:
+		pr_warn("Invalid screenpad backlight power state: %d\n", bd->props.power);
+		return -EINVAL;
 	}
 
 	return err;

From 16114eb40778eb308238d23a2edc215d110d84b1 Mon Sep 17 00:00:00 2001
From: Denis Benato <denis.benato@linux.dev>
Date: Wed, 16 Sep 2026 14:38:26 +0000
Subject: [PATCH 1493/1982] platform/x86: asus-wmi: fix screenpad power state
 detection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f9a1cd14b392a82fdc73474894bf8b198757dfb2 ]

On some models, e.g. the UX5400EA, the screenpad power state cannot be
read back: DSTS(ASUS_WMI_DEVID_SCREENPAD_POWER) never sets
ASUS_WMI_DSTS_STATUS_BIT, so asus_wmi_get_devstate_simple() reports the
panel as powered off regardless of its real state.

The DSDT shows DSTS 0x00050031 (POWER) and DSTS 0x00050032 (LIGHT)
both read the same two-byte EC register, each returning a different
byte: byte 0 is a raw EC status byte, which is 0xa0 when the panel is
powered and 0x00 when it is off, and byte 1 is the brightness. Read
the power state from the low byte instead of
ASUS_WMI_DSTS_STATUS_BIT: firmware reporting the power through the
status bit is covered too, since ASUS_WMI_DSTS_STATUS_BIT lies inside
ASUS_WMI_DSTS_BRIGHTNESS_MASK.

Reuse read_screenpad_backlight_power() in asus_screenpad_init() in
place of the raw devstate read. This makes the brightness read
reachable on models like the UX5400EA, so mask the SCREENPAD_LIGHT
value with ASUS_WMI_DSTS_BRIGHTNESS_MASK before storing it: the
unmasked devstate (0x0001ffa0 when the panel is on) would otherwise be
exposed to userspace as an out-of-range brightness (max_brightness is
255) which systemd-backlight then persists.

While at it, pass asus_wmi_get_devstate() the u32 it expects.

Fixes: 130d29c5627c ("platform/x86: asus-wmi: adjust screenpad power/brightness handling")
Reported-by: Hugo Baigue <hugobaigue2004@gmail.com>
Closes: https://lore.kernel.org/all/CAO84+x+P2_xyHP89+nGVSMV6bL+dy0P9=vyEEfZGnFhv0hBNWw@mail.gmail.com/
Suggested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Tested-by: Hugo Baigue <hugobaigue2004@gmail.com>
Cc: stable@vger.kernel.org
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260916143838.170950-3-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-wmi.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index adff9f49b5677e..486c12b232d146 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -4122,13 +4122,20 @@ static int is_display_toggle(int code)
 
 static int read_screenpad_backlight_power(struct asus_wmi *asus)
 {
-	int ret;
+	int ret, retval;
 
-	ret = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+	ret = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_POWER, &retval);
 	if (ret < 0)
 		return ret;
-	/* 1 == powered */
-	return ret ? BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
+
+	/*
+	 * The firmware reports the panel power in the low byte of the
+	 * devstate as a raw EC status byte that is non-zero when the
+	 * panel is powered; other models report it through
+	 * ASUS_WMI_DSTS_STATUS_BIT, which lies inside the same mask.
+	 */
+	return (retval & ASUS_WMI_DSTS_BRIGHTNESS_MASK) ?
+		BACKLIGHT_POWER_ON : BACKLIGHT_POWER_OFF;
 }
 
 static int read_screenpad_brightness(struct backlight_device *bd)
@@ -4192,16 +4199,17 @@ static int asus_screenpad_init(struct asus_wmi *asus)
 	struct backlight_device *bd;
 	struct backlight_properties props;
 	int err, power;
-	int brightness = 0;
+	u32 brightness = 0;
 
-	power = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_SCREENPAD_POWER);
+	power = read_screenpad_backlight_power(asus);
 	if (power < 0)
 		return power;
 
-	if (power) {
+	if (power == BACKLIGHT_POWER_ON) {
 		err = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_SCREENPAD_LIGHT, &brightness);
 		if (err < 0)
 			return err;
+		brightness &= ASUS_WMI_DSTS_BRIGHTNESS_MASK;
 	}
 
 	memset(&props, 0, sizeof(struct backlight_properties));

From b34024fae1d6f6dfaf9812adbe8967082c793c51 Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Sat, 19 Sep 2026 11:00:37 +0500
Subject: [PATCH 1494/1982] platform/x86: hp-bioscfg: fix 16-byte heap overflow
 for empty auth token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 540b8ae192afb5566c1b13b6884aee87107a26b9 ]

hp_calculate_security_buffer() special-cases an empty authentication
string and returns a fixed 4 bytes (sizeof(u16) * 2). But
hp_populate_security_buffer() does not special-case that same input:
for any authentication string that does not start with BEAM_PREFIX,
including the empty string, it always builds "UTF_PREFIX +
authentication" and converts the result to UTF-16, writing a 2-byte
length header plus 2 bytes per character of "<utf-16/>" (9 characters),
20 bytes total, regardless of how long "authentication" itself is.

The caller, hp_set_attribute(), sizes its kmalloc() buffer using
hp_calculate_security_buffer()'s return value, so for an empty
authentication token it allocates 4 bytes for the security area but
hp_populate_security_buffer() then writes 20 bytes into it, causing a
16-byte heap buffer overflow.

The authentication token used here is the current admin/setup
password, which is an empty string by default until one is
configured. Any write to a writable BIOS attribute while no admin
password has been set reaches this path.

Fix by removing the special-case early return for an empty string in
hp_calculate_security_buffer(). The generic calculation that follows
already accounts for the UTF_PREFIX correctly, which naturally yields
the same 20 bytes that hp_populate_security_buffer() writes for an empty
string, avoiding duplicate logic for special cases.

Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Reported-by: Josh Snyder <josh@code406.com>
Closes: https://lore.kernel.org/platform-driver-x86/20260402-hp-bioscfg-overflow-v1-1-6985f8c9e67c@code406.com/
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260919060037.84602-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index 4d94e48c1a4c80..abf8ce20fe15c6 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -47,9 +47,6 @@ size_t hp_calculate_security_buffer(const char *authentication)
 		return sizeof(u16) * 2;
 
 	authlen = strlen(authentication);
-	if (!authlen)
-		return sizeof(u16) * 2;
-
 	size = sizeof(u16) + authlen * sizeof(u16);
 	if (!strstarts(authentication, BEAM_PREFIX))
 		size += strlen(UTF_PREFIX) * sizeof(u16);

From d904db0a4d32bd49cff2476bf11cf0715c444804 Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 26 Aug 2026 15:30:12 +0500
Subject: [PATCH 1495/1982] platform/x86: hp-wmi: fix heap OOB read and memory
 corruption in hp_wmi_perform_query()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6dea092b261f04d632411c2be52d13190f5f67b1 ]

hp_wmi_perform_query() evaluates an ACPI WMI method and expects a
struct bios_return header in the returned buffer. However, it only
checks that the ACPI object type is ACPI_TYPE_BUFFER without verifying
that obj->buffer.length is at least sizeof(*bios_return) (8 bytes).

If the firmware or ACPI method returns a buffer shorter than 8 bytes:

1. bios_return->return_code at offset 4 reads out of bounds from the
   allocated ACPI buffer slab.

2. If return_code evaluates to 0 and outsize is non-zero,
   (int)(obj->buffer.length - sizeof(*bios_return)) evaluates to a
   negative integer (e.g. -8 for a 0-length buffer). actual_outsize is
   set to this negative value and passed to memcpy(buffer, ...,
   actual_outsize), where the signed negative value is cast to
   size_t (e.g. 0xfffffffffffffff8), attempting to copy ~18 Exabytes
   and triggering an immediate kernel crash. Additionally,
   memset(buffer + actual_outsize, ...) performs an out-of-bounds
   write before buffer.

Fix this by ensuring obj->buffer.length is at least sizeof(*bios_return)
before accessing the return code, and compute actual_outsize safely
using min_t(u32, ...), which is sound specifically because the guard
above already rules out obj->buffer.length being smaller than
sizeof(*bios_return) by the time that subtraction runs.

Fixes: c3021ea1beee ("hp-wmi: allow setting input and output buffer sizes separately")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260826103012.240453-1-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-wmi.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
index 5eb2aade44ccaf..f92bb3dca2e30e 100644
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -491,8 +491,9 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 		goto out_free;
 	}
 
-	if (obj->type != ACPI_TYPE_BUFFER) {
-		pr_warn("query 0x%x returned an invalid object 0x%x\n", query, ret);
+	if (obj->type != ACPI_TYPE_BUFFER ||
+	    obj->buffer.length < sizeof(*bios_return)) {
+		pr_warn("query 0x%x returned wrong type or too small buffer\n", query);
 		ret = -EINVAL;
 		goto out_free;
 	}
@@ -511,7 +512,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
 	if (!outsize)
 		goto out_free;
 
-	actual_outsize = min(outsize, (int)(obj->buffer.length - sizeof(*bios_return)));
+	actual_outsize = min_t(u32, outsize, obj->buffer.length - sizeof(*bios_return));
 	memcpy(buffer, obj->buffer.pointer + sizeof(*bios_return), actual_outsize);
 	memset(buffer + actual_outsize, 0, outsize - actual_outsize);
 

From 3857d41c7d4db8ad2a6891e3a88ba6e8ef56e075 Mon Sep 17 00:00:00 2001
From: Jack Boykin <jtboykin.jb@gmail.com>
Date: Wed, 2 Sep 2026 16:02:12 -0500
Subject: [PATCH 1496/1982] platform/x86/amd/pmf: Fix power_supply refcount
 leak in amd_pmf_get_battery_prop()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9f3eebbbd1033de0abcc2694ba4b455d30fe33f9 ]

power_supply_get_by_name() takes a reference that is only dropped on
the error path. On success it leaks, five times per policy evaluation.
Unregistering the battery later trips the use_cnt WARN_ON in
power_supply_unregister() and never frees it.

While here, return -ENODEV instead of an uninitialised 'value' when
no battery matches, and stop at the first supply found rather than
letting the last one in the table win.

Found by reading the code. Fix and changelog drafted with Claude Code
(Fable 5.1) and reviewed by hand. Compile-tested only (allmodconfig,
W=1, sparse); not run on Smart PC hardware.

Fixes: f4627dfd0e19 ("platform/x86/amd/pmf: Add support to get inputs from other subsystems")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Jack Boykin <jtboykin.jb@gmail.com>
Link: https://patch.msgid.link/20260902210217.69483-1-jtboykin.jb@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/pmf/spc.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/amd/pmf/spc.c b/drivers/platform/x86/amd/pmf/spc.c
index 85192c7536b800..cbe4eef5b8bb42 100644
--- a/drivers/platform/x86/amd/pmf/spc.c
+++ b/drivers/platform/x86/amd/pmf/spc.c
@@ -244,13 +244,11 @@ static int amd_pmf_get_battery_prop(enum power_supply_property prop)
 			continue;
 
 		ret = power_supply_get_property(psy, prop, &value);
-		if (ret) {
-			power_supply_put(psy);
-			return ret;
-		}
+		power_supply_put(psy);
+		return ret ? ret : value.intval;
 	}
 
-	return value.intval;
+	return -ENODEV;
 }
 
 static int amd_pmf_get_battery_info(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)

From 5d82777974b152a30d6df63d980cdef90bd6f006 Mon Sep 17 00:00:00 2001
From: Antheas Kapenekakis <lkml@antheas.dev>
Date: Sun, 20 Sep 2026 21:04:37 +0200
Subject: [PATCH 1497/1982] platform/x86: oxpec: Fix Apex charge limit control
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0ccdf9a1381c7fb6d9e84abeb8e5d6c85dd07059 ]

The OneXPlayer Apex uses E5/E6 for battery bypass / charge limit, making
it the first device to deviate. This was verified by a user on Windows
with BIOS version 2.17 and later by running this kernel patch.

Drop X1_ from the MASK variables as they are common in all devices,
introduce a board enum for Apex, and make it use the new E5/E6 registers
for charge limit / bypass. Apply the same quirks as oxp_fly, since APEX
uses the same registers otherwise.

Fixes: 3385ea97c14d ("platform/x86: oxpec: Add support for OneXPlayer APEX")
Cc: stable@vger.kernel.org
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Link: https://patch.msgid.link/20260920190438.3444923-1-lkml@antheas.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/oxpec.c | 68 ++++++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 15 deletions(-)

diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c
index a30845ba379697..4fc93102963424 100644
--- a/drivers/platform/x86/oxpec.c
+++ b/drivers/platform/x86/oxpec.c
@@ -60,6 +60,7 @@ enum oxp_board {
 	oxp_x1,
 	oxp_g1_i,
 	oxp_g1_a,
+	oxp_apex,
 };
 
 static enum oxp_board board;
@@ -103,11 +104,14 @@ static struct device *oxp_dev;
 #define OXP_X1_CHARGE_LIMIT_REG		0xA3 /* X1 charge limit (%) */
 #define OXP_X1_CHARGE_INHIBIT_REG	0xA4 /* X1 bypass charging */
 
-#define OXP_X1_CHARGE_INHIBIT_MASK_AWAKE	0x01
+#define OXP_APEX_CHARGE_LIMIT_REG	0xE5 /* Apex charge limit (%) */
+#define OXP_APEX_CHARGE_INHIBIT_REG	0xE6 /* Apex bypass charging */
+
+#define OXP_CHARGE_INHIBIT_MASK_AWAKE	0x01
 /* X1 Mask is 0x0A, F1Pro is 0x02 but the extra bit on the X1 does nothing. */
-#define OXP_X1_CHARGE_INHIBIT_MASK_OFF		0x02
-#define OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS	(OXP_X1_CHARGE_INHIBIT_MASK_AWAKE | \
-						 OXP_X1_CHARGE_INHIBIT_MASK_OFF)
+#define OXP_CHARGE_INHIBIT_MASK_OFF		0x02
+#define OXP_CHARGE_INHIBIT_MASK_ALWAYS	(OXP_CHARGE_INHIBIT_MASK_AWAKE | \
+					 OXP_CHARGE_INHIBIT_MASK_OFF)
 
 static const struct dmi_system_id dmi_table[] = {
 	{
@@ -220,7 +224,7 @@ static const struct dmi_system_id dmi_table[] = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
 			DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER APEX"),
 		},
-		.driver_data = (void *)oxp_fly,
+		.driver_data = (void *)oxp_apex,
 	},
 	{
 		.matches = {
@@ -404,6 +408,7 @@ static umode_t tt_toggle_is_visible(struct kobject *kobj,
 	case oxp_x1:
 	case oxp_g1_i:
 	case oxp_g1_a:
+	case oxp_apex:
 		return attr->mode;
 	default:
 		break;
@@ -433,6 +438,7 @@ static ssize_t tt_toggle_store(struct device *dev,
 	case oxp_fly:
 	case oxp_mini_amd_pro:
 	case oxp_g1_a:
+	case oxp_apex:
 		reg = OXP_TURBO_SWITCH_REG;
 		mask = OXP_TURBO_TAKE_VAL;
 		break;
@@ -479,6 +485,7 @@ static ssize_t tt_toggle_show(struct device *dev,
 	case oxp_fly:
 	case oxp_mini_amd_pro:
 	case oxp_g1_a:
+	case oxp_apex:
 		reg = OXP_TURBO_SWITCH_REG;
 		mask = OXP_TURBO_TAKE_VAL;
 		break;
@@ -576,6 +583,7 @@ static bool oxp_psy_ext_supported(void)
 	case oxp_g1_i:
 	case oxp_g1_a:
 	case oxp_fly:
+	case oxp_apex:
 		return true;
 	default:
 		break;
@@ -589,12 +597,24 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
 				enum power_supply_property psp,
 				union power_supply_propval *val)
 {
+	u8 limit_reg, inhibit_reg;
 	long raw_val;
 	int ret;
 
+	switch (board) {
+	case oxp_apex:
+		limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+		inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+		break;
+	default:
+		limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+		inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+		break;
+	}
+
 	switch (psp) {
 	case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
-		ret = read_from_ec(OXP_X1_CHARGE_LIMIT_REG, 1, &raw_val);
+		ret = read_from_ec(limit_reg, 1, &raw_val);
 		if (ret)
 			return ret;
 		if (raw_val < 0 || raw_val > 100)
@@ -602,14 +622,14 @@ static int oxp_psy_ext_get_prop(struct power_supply *psy,
 		val->intval = raw_val;
 		return 0;
 	case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
-		ret = read_from_ec(OXP_X1_CHARGE_INHIBIT_REG, 1, &raw_val);
+		ret = read_from_ec(inhibit_reg, 1, &raw_val);
 		if (ret)
 			return ret;
-		if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS) ==
-		    OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS)
+		if ((raw_val & OXP_CHARGE_INHIBIT_MASK_ALWAYS) ==
+		    OXP_CHARGE_INHIBIT_MASK_ALWAYS)
 			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE;
-		else if ((raw_val & OXP_X1_CHARGE_INHIBIT_MASK_AWAKE) ==
-			 OXP_X1_CHARGE_INHIBIT_MASK_AWAKE)
+		else if ((raw_val & OXP_CHARGE_INHIBIT_MASK_AWAKE) ==
+			 OXP_CHARGE_INHIBIT_MASK_AWAKE)
 			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE;
 		else
 			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO;
@@ -625,29 +645,41 @@ static int oxp_psy_ext_set_prop(struct power_supply *psy,
 				enum power_supply_property psp,
 				const union power_supply_propval *val)
 {
+	u8 limit_reg, inhibit_reg;
 	long raw_val;
 
+	switch (board) {
+	case oxp_apex:
+		limit_reg = OXP_APEX_CHARGE_LIMIT_REG;
+		inhibit_reg = OXP_APEX_CHARGE_INHIBIT_REG;
+		break;
+	default:
+		limit_reg = OXP_X1_CHARGE_LIMIT_REG;
+		inhibit_reg = OXP_X1_CHARGE_INHIBIT_REG;
+		break;
+	}
+
 	switch (psp) {
 	case POWER_SUPPLY_PROP_CHARGE_CONTROL_END_THRESHOLD:
 		if (val->intval < 0 || val->intval > 100)
 			return -EINVAL;
-		return write_to_ec(OXP_X1_CHARGE_LIMIT_REG, val->intval);
+		return write_to_ec(limit_reg, val->intval);
 	case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
 		switch (val->intval) {
 		case POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO:
 			raw_val = 0;
 			break;
 		case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE_AWAKE:
-			raw_val = OXP_X1_CHARGE_INHIBIT_MASK_AWAKE;
+			raw_val = OXP_CHARGE_INHIBIT_MASK_AWAKE;
 			break;
 		case POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE:
-			raw_val = OXP_X1_CHARGE_INHIBIT_MASK_ALWAYS;
+			raw_val = OXP_CHARGE_INHIBIT_MASK_ALWAYS;
 			break;
 		default:
 			return -EINVAL;
 		}
 
-		return write_to_ec(OXP_X1_CHARGE_INHIBIT_REG, raw_val);
+		return write_to_ec(inhibit_reg, raw_val);
 	default:
 		return -EINVAL;
 	}
@@ -715,6 +747,7 @@ static int oxp_pwm_enable(void)
 	case oxp_x1:
 	case oxp_g1_i:
 	case oxp_g1_a:
+	case oxp_apex:
 		return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_MANUAL);
 	default:
 		return -EINVAL;
@@ -743,6 +776,7 @@ static int oxp_pwm_disable(void)
 	case oxp_x1:
 	case oxp_g1_i:
 	case oxp_g1_a:
+	case oxp_apex:
 		return write_to_ec(OXP_SENSOR_PWM_ENABLE_REG, PWM_MODE_AUTO);
 	default:
 		return -EINVAL;
@@ -771,6 +805,7 @@ static int oxp_pwm_read(long *val)
 	case oxp_x1:
 	case oxp_g1_i:
 	case oxp_g1_a:
+	case oxp_apex:
 		return read_from_ec(OXP_SENSOR_PWM_ENABLE_REG, 1, val);
 	default:
 		return -EOPNOTSUPP;
@@ -815,6 +850,7 @@ static int oxp_pwm_fan_speed(long *val)
 	case oxp_mini_amd_a07:
 	case oxp_mini_amd_pro:
 	case oxp_g1_a:
+	case oxp_apex:
 		return read_from_ec(OXP_SENSOR_FAN_REG, 2, val);
 	default:
 		return -EOPNOTSUPP;
@@ -855,6 +891,7 @@ static int oxp_pwm_input_write(long val)
 	case oxp_fly:
 	case oxp_mini_amd_pro:
 	case oxp_g1_a:
+	case oxp_apex:
 		return write_to_ec(OXP_SENSOR_PWM_REG, val);
 	default:
 		return -EOPNOTSUPP;
@@ -902,6 +939,7 @@ static int oxp_pwm_input_read(long *val)
 	case oxp_fly:
 	case oxp_mini_amd_pro:
 	case oxp_g1_a:
+	case oxp_apex:
 	default:
 		ret = read_from_ec(OXP_SENSOR_PWM_REG, 1, val);
 		if (ret)

From 4a5b0194b8d8c462e89d286728368f67f4b89ed5 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Thu, 24 Sep 2026 19:56:17 +0800
Subject: [PATCH 1498/1982] platform/x86: simatic-ipc: fix platform device leak
 on registration failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9523698252fd583d6987582b9c34ec6500d10986 ]

register_platform_devices() registers the battery, LED, and watchdog
platform devices in sequence. If LED registration fails, the battery
device remains registered. If watchdog registration fails, the LED and
battery devices remain registered.

These failure paths leave successful platform_device_register_data()
calls without the matching platform_device_unregister() calls.

Add an unwind ladder to unregister previously registered platform
devices in reverse order before returning the registration error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: dd123e62bded ("platform/x86: simatic-ipc: add main driver for Siemens devices")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260924115617.1578309-1-lgs201920130244@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/siemens/simatic-ipc.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/siemens/simatic-ipc.c b/drivers/platform/x86/siemens/simatic-ipc.c
index 7039874d8f1122..4a4509fc9263e9 100644
--- a/drivers/platform/x86/siemens/simatic-ipc.c
+++ b/drivers/platform/x86/siemens/simatic-ipc.c
@@ -92,6 +92,7 @@ static int register_platform_devices(u32 station_id)
 	u8 wdtmode = SIMATIC_IPC_DEVICE_NONE;
 	u8 battmode = SIMATIC_IPC_DEVICE_NONE;
 	char *pdevname;
+	int ret;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(device_modes); i++) {
@@ -139,8 +140,10 @@ static int register_platform_devices(u32 station_id)
 				pdevname, PLATFORM_DEVID_NONE,
 				&platform_data,
 				sizeof(struct simatic_ipc_platform));
-		if (IS_ERR(ipc_led_platform_device))
-			return PTR_ERR(ipc_led_platform_device);
+		if (IS_ERR(ipc_led_platform_device)) {
+			ret = PTR_ERR(ipc_led_platform_device);
+			goto err_unregister_batt;
+		}
 
 		pr_debug("device=%s created\n",
 			 ipc_led_platform_device->name);
@@ -153,8 +156,10 @@ static int register_platform_devices(u32 station_id)
 				KBUILD_MODNAME "_wdt", PLATFORM_DEVID_NONE,
 				&platform_data,
 				sizeof(struct simatic_ipc_platform));
-		if (IS_ERR(ipc_wdt_platform_device))
-			return PTR_ERR(ipc_wdt_platform_device);
+		if (IS_ERR(ipc_wdt_platform_device)) {
+			ret = PTR_ERR(ipc_wdt_platform_device);
+			goto err_unregister_led;
+		}
 
 		pr_debug("device=%s created\n",
 			 ipc_wdt_platform_device->name);
@@ -169,6 +174,14 @@ static int register_platform_devices(u32 station_id)
 	}
 
 	return 0;
+
+err_unregister_led:
+	if (ledmode != SIMATIC_IPC_DEVICE_NONE)
+		platform_device_unregister(ipc_led_platform_device);
+err_unregister_batt:
+	if (battmode != SIMATIC_IPC_DEVICE_NONE)
+		platform_device_unregister(ipc_batt_platform_device);
+	return ret;
 }
 
 static void request_additional_modules(u32 station_id)

From 70ef07bf84276694597697c17d439c945084fe61 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Mon, 21 Sep 2026 12:04:10 -0500
Subject: [PATCH 1499/1982] platform/x86/amd: hfi: Fix out-of-bounds reads when
 parsing ranking data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b7b273844b94af9cc64907dccd9e7997c2b60f1a ]

amd_hfi_fill_metadata() parses CPU core ranking data out of the
firmware-provided PCC shared memory but trusts two values it should not:

 - n_bitmaps is used to bound the outer loop that reads the APIC ID
   bitmaps from table_data[], but it is never validated against the size
   of the shared memory region (pcct_ext->length).  A firmware-supplied
   count larger than the region reads past the end of table_data.

 - When resolving the base of the ranking data for a processor, the
   pointer is shifted by an extra "i * nr_class" term, where i is the
   current bitmap index.  The per-processor offset is already applied
   through apic_index, which uses the running count of active processors
   (apic_start).  The extra shift compounds for every logical processor
   beyond the first bitmap (APIC ID >= 32), reading out of bounds.

Both result in out-of-bounds reads that can corrupt the ranking metrics,
oops, or otherwise destabilise the system.

Reject an n_bitmaps value that would not fit within the shared memory
region, and drop the bogus "i * nr_class" term so the ranking data is
addressed only through its correct per-processor offset.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: d4e95ea7a78e ("platform/x86: hfi: Parse CPU core ranking data from shared memory")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260921170411.1149960-3-mario.limonciello@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/hfi/hfi.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/amd/hfi/hfi.c b/drivers/platform/x86/amd/hfi/hfi.c
index ac6ef0b5b95b2d..1d12a3b8f32f14 100644
--- a/drivers/platform/x86/amd/hfi/hfi.c
+++ b/drivers/platform/x86/amd/hfi/hfi.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/mailbox_client.h>
 #include <linux/mutex.h>
+#include <linux/overflow.h>
 #include <linux/percpu-defs.h>
 #include <linux/platform_device.h>
 #include <linux/smp.h>
@@ -169,6 +170,21 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
 		return -EINVAL;
 	}
 
+	/*
+	 * The bitmaps enumerating the APIC IDs occupy the first n_bitmaps
+	 * words of table_data.  Reject a firmware-provided count that would
+	 * push those reads past the end of the shared memory region.
+	 */
+	if (struct_size(amd_hfi_data->shmem, table_data, amd_hfi_data->shmem->n_bitmaps) >
+	    pcct_ext->length) {
+		dev_err(amd_hfi_data->dev, "invalid number of bitmaps: %u\n",
+			amd_hfi_data->shmem->n_bitmaps);
+		return -EINVAL;
+	}
+
+	/* The ranking data for each processor follows the bitmaps */
+	u32 *table = amd_hfi_data->shmem->table_data + amd_hfi_data->shmem->n_bitmaps;
+
 	for (unsigned int i = 0; i < amd_hfi_data->shmem->n_bitmaps; i++) {
 		u32 bitmap = amd_hfi_data->shmem->table_data[i];
 
@@ -193,10 +209,6 @@ static int amd_hfi_fill_metadata(struct amd_hfi_data *amd_hfi_data)
 			info = per_cpu_ptr(&amd_hfi_cpuinfo, cpu_index);
 			apic_index = apic_start * info->nr_class * 2;
 			for (unsigned int k = 0; k < info->nr_class; k++) {
-				u32 *table = amd_hfi_data->shmem->table_data +
-					     amd_hfi_data->shmem->n_bitmaps +
-					     i * info->nr_class;
-
 				info->amd_hfi_classes[k].eff = table[apic_index + 2 * k];
 				info->amd_hfi_classes[k].perf = table[apic_index + 2 * k + 1];
 			}

From 74eee7cc1aea34e31316f133da4daff05cdd82ae Mon Sep 17 00:00:00 2001
From: Guixiong Wei <weiguixiong@bytedance.com>
Date: Wed, 30 Sep 2026 00:31:34 +0800
Subject: [PATCH 1500/1982] platform/x86/intel-uncore-freq: Continue restoring
 limits on resume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 38998529f45c02edcf96b0a3ddd3c83de6d11bbe ]

The PM notifier iterates over every uncore frequency instance to restore
user-configured MSR_UNCORE_RATIO_LIMIT values after resume. Entries that
have never been configured legitimately have stored_uncore_data set to
zero.

The refactoring that split common and enumeration code changed the
iteration from active control CPUs to all allocated instances. It also
changed the skip for an invalid or unconfigured entry from continue to
return, causing that entry to terminate the entire restore operation.

On a multi-package or multi-die system, configuring only a later instance
therefore leaves its limit unrestored after suspend, hibernation, or
restore if an earlier entry is invalid or unconfigured.

Use continue to skip only the current entry and restore all remaining
configured instances.

Fixes: dbce412a7733 ("platform/x86/intel-uncore-freq: Split common and enumeration part")
Cc: stable@vger.kernel.org
Tested-by: Yijia Wang <wangyijia.yeah@bytedance.com>
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20260929163133.14326-2-weiguixiong@bytedance.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
index 0dfc552b280246..3836d76943f5ad 100644
--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
+++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
@@ -211,7 +211,7 @@ static int uncore_pm_notify(struct notifier_block *nb, unsigned long mode,
 			struct uncore_data *data = &uncore_instances[i];
 
 			if (!data || !data->valid || !data->stored_uncore_data)
-				return 0;
+				continue;
 
 			wrmsrq_on_cpu(data->control_cpu, MSR_UNCORE_RATIO_LIMIT,
 				      data->stored_uncore_data);

From 2e4f453c3c191a376c1e026224f4f402ff0d4af5 Mon Sep 17 00:00:00 2001
From: "David E. Box" <david.e.box@linux.intel.com>
Date: Thu, 1 Oct 2026 15:03:47 -0700
Subject: [PATCH 1501/1982] platform/x86/intel/vsec: Fix inverted walk_header()
 test in get_features()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3678e39c6aaeb9aa380c7357b24f7d55955543f8 ]

intel_vsec_walk_header() used to return a bool that was true when devices
were found. It was converted to return 0 on success and a negative errno
on failure, but the boolean test in intel_vsec_get_features() was left
unchanged, so its meaning is now inverted.

A successful walk returns 0 and leaves found set to false, while a failed
walk returns an error that evaluates to true. When no other capabilities
are present, intel_vsec_pci_init() then returns -ENODEV even though the
auxiliary devices were created, and the driver core tears them back down.

This affects platforms that have no DVSEC or VSEC capabilities and
describe their features through device_data instead, which today means
DG1. Test the return value for success explicitly.

Fixes: a6ce8bf3c993 ("platform/x86/intel/vsec: Return real error codes from registration path")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Link: https://patch.msgid.link/20261001220351.1592138-3-david.e.box@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/vsec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
index 1e292eaeb209d6..814e418bea82b7 100644
--- a/drivers/platform/x86/intel/vsec.c
+++ b/drivers/platform/x86/intel/vsec.c
@@ -617,7 +617,7 @@ static bool intel_vsec_get_features(struct pci_dev *pdev,
 		found = true;
 
 	if (info && (info->quirks & VSEC_QUIRK_NO_DVSEC) &&
-	    intel_vsec_walk_header(&pdev->dev, info))
+	    !intel_vsec_walk_header(&pdev->dev, info))
 		found = true;
 
 	return found;

From 51d8437aff718696241a8ba7aaa67a2d0bab2a38 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:16:59 +0100
Subject: [PATCH 1502/1982] fbdev: ssd1307fb: check for fb_deferred_io_init()
 error

[ Upstream commit 81ae1f9a6c850efab3e5dec6b7c9aa5c587f92b7 ]

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently ssd1307fb_probe() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.

When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).

Fix this by checking for the error.

Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/ssd1307fb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 0df3ac694f4e0d..e4559312a92652 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -763,7 +763,11 @@ static int ssd1307fb_probe(struct i2c_client *client)
 	info->fix.smem_start = __pa(vmem);
 	info->fix.smem_len = vmem_size;
 
-	fb_deferred_io_init(info);
+	ret = fb_deferred_io_init(info);
+	if (ret) {
+		dev_err(dev, "failed to init fb deferred io: %d\n", ret);
+		goto fb_defio_error;
+	}
 
 	i2c_set_clientdata(client, info);
 

From 99059dc7ee7bd0f4d9a695a7404e80efac5fdde3 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:17:00 +0100
Subject: [PATCH 1503/1982] fbdev: xen-fbfront: check for fb_deferred_io_init()
 error

[ Upstream commit 5b234b0dd29d79207c059c7b40851dd1e934fa3a ]

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently xenfb_probe() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.

When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).

Fix this by checking for the error.

Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/xen-fbfront.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index d8f3bfb2dd6c94..22aaafd2c11f53 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -443,7 +443,11 @@ static int xenfb_probe(struct xenbus_device *dev,
 	}
 
 	fb_info->fbdefio = &xenfb_defio;
-	fb_deferred_io_init(fb_info);
+	ret = fb_deferred_io_init(fb_info);
+	if (ret < 0) {
+		xenbus_dev_fatal(dev, ret, "fb_deferred_io_init");
+		goto error_cmap;
+	}
 
 	xenfb_init_shared_page(info, fb_info);
 
@@ -465,6 +469,7 @@ static int xenfb_probe(struct xenbus_device *dev,
 
 error_fb:
 	fb_deferred_io_cleanup(fb_info);
+error_cmap:
 	fb_dealloc_cmap(&fb_info->cmap);
 	framebuffer_release(fb_info);
 error_nomem:

From b4165e730e7807b90fd1b0e847f7fb826c674027 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:17:02 +0100
Subject: [PATCH 1504/1982] fbdev: udlfb: check for fb_deferred_io_init() error

[ Upstream commit eae055f33e41e1d3e1a7e905bdcb1e9f196ed31d ]

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently dlfb_ops_open() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.

fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as dlfb_ops_open() returns.

Additionally, if the allocation of info->fbdefio itself fails,
dlfb_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).

Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.

The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.

The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").

However, the BUG_ON() issue originates from the earlier
commit 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio
implementation for multiple framebuffers"), so target that for the fix.

Fixes: 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio implementation for multiple framebuffers")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/udlfb.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index f6da680c29eace..abaac2ed22a987 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -947,10 +947,13 @@ static int dlfb_ops_open(struct fb_info *info, int user)
 			fbdefio->delay = DL_DEFIO_WRITE_DELAY;
 			fbdefio->sort_pagereflist = true;
 			fbdefio->deferred_io = dlfb_dpy_deferred_io;
-		}
 
-		info->fbdefio = fbdefio;
-		fb_deferred_io_init(info);
+			info->fbdefio = fbdefio;
+			if (fb_deferred_io_init(info)) {
+				kfree(fbdefio);
+				info->fbdefio = NULL;
+			}
+		}
 	}
 
 	dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",

From db62efc3ecbd4447d90714a8c613955206179b33 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:17:03 +0100
Subject: [PATCH 1505/1982] fbdev: smscufx: check for fb_deferred_io_init()
 error

[ Upstream commit 8ea6c6e77ccf887f3e68c64f4c261071a345da1e ]

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently ufx_ops_open() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due to
an allocation failure) info->fbdefio_state is left NULL.

fb_open() will then dereference a NULL pointer (calling
fb_deferred_io_open()) as soon as ufx_ops_open() returns.

Additionally, if the allocation of info->fbdefio itself fails,
ufx_ops_open() sets info->fbdefio to NULL and invokes
fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio).

Fix this by only invoking fb_deferred_io_init() if the allocation
succeeded, and checking for the error.

The driver already supports operating without deferred I/O, so in either
case fall back to that by setting info->fbdefio to NULL.

The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev:
Track deferred-I/O pages in pageref struct").

However, the BUG_ON() issue originates from the earlier
commit 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display
adapters"), so target that for the fix.

Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/smscufx.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index 891ce7b76d637e..30a94d85fc8c18 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1041,10 +1041,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
 		if (fbdefio) {
 			fbdefio->delay = UFX_DEFIO_WRITE_DELAY;
 			fbdefio->deferred_io = ufx_dpy_deferred_io;
-		}
 
-		info->fbdefio = fbdefio;
-		fb_deferred_io_init(info);
+			info->fbdefio = fbdefio;
+			if (fb_deferred_io_init(info)) {
+				kfree(fbdefio);
+				info->fbdefio = NULL;
+			}
+		}
 	}
 
 	pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",

From 8e21bbb7c2ce772ea3d672c1de662c5da1e9fbeb Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Sat, 26 Sep 2026 14:17:04 +0100
Subject: [PATCH 1506/1982] fbdev: sh_mobile_lcdc: check for
 fb_deferred_io_init() error

[ Upstream commit 5192201aaac2a923ff98306e3ccda58718ee395f ]

fb_deferred_io_init() allocates deferred I/O state, populating
info->fbdefio_state, or leaving it NULL if an error occurs.

Currently sh_mobile_lcdc_start() ignores its return value.

Therefore if an error arises in fb_deferred_io_init() (for instance, due
to an allocation failure) info->fbdefio_state is left NULL.

When the file is subsequently opened, fb_open() will dereference a NULL
pointer (calling fb_deferred_io_open()).

Fix this by checking for the error.

Also clear info->fbdefio in that case, so that sh_mobile_lcdc_stop() does
not attempt to clean up deferred I/O state that was never initialised.

Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index 6038f217ab4272..c6da5a62f8c5fb 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -1042,7 +1042,11 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
 			ch->defio.deferred_io = sh_mobile_lcdc_deferred_io;
 			ch->defio.delay = msecs_to_jiffies(tmp);
 			ch->info->fbdefio = &ch->defio;
-			fb_deferred_io_init(ch->info);
+			ret = fb_deferred_io_init(ch->info);
+			if (ret) {
+				ch->info->fbdefio = NULL;
+				return ret;
+			}
 		}
 
 		sh_mobile_lcdc_display_on(ch);

From df083198ddca2fd4f4214c0cc1bd51ed08fe6f52 Mon Sep 17 00:00:00 2001
From: Myeonghun Pak <mhun512@gmail.com>
Date: Mon, 14 Sep 2026 20:52:43 -0400
Subject: [PATCH 1507/1982] fbdev: kyro: Release WC setup on registration
 failure

[ Upstream commit d3bc005a62945aec57059201092b12b7c955e5a7 ]

If register_framebuffer() fails, kyrofb_probe() frees the framebuffer
without releasing its write-combining range. Release the range before
freeing the framebuffer. Earlier failures still skip this cleanup.

The missing cleanup already exists in the initial Git import, before
the conversion from mtrr_add() to arch_phys_wc_add().

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/kyro/fbdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index c44d6809859e5a..fc350edb41a823 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -766,7 +766,7 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	fb_memset_io(info->screen_base, 0, size);
 
 	if (register_framebuffer(info) < 0)
-		goto out_free_fb;
+		goto out_free_wc;
 
 	fb_info(info, "%s frame buffer device, at %dx%d@%d using %ldk/%ldk of VRAM\n",
 		info->fix.id,
@@ -777,6 +777,8 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	return 0;
 
+out_free_wc:
+	arch_phys_wc_del(currentpar->wc_cookie);
 out_free_fb:
 	framebuffer_release(info);
 

From 55265c0f41ebe877b00b09a3d0cda796e6737e03 Mon Sep 17 00:00:00 2001
From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Date: Tue, 13 Oct 2026 08:48:48 +0200
Subject: [PATCH 1508/1982] serial: 8250_exar: store the GPIO platform device
 in struct exar8250

[ Upstream commit 33d337816e00994daaf670243186d9e537ee090d ]

The GPIO platform device is registered via platform->register_gpio()
when port 0 is being set up. It is stored to port->port.private_data of
the on-stack uart template (and from there it is copied into every
registered port). pci_xr17v35x_exit() then fetches it back by
serial8250_get_port(priv->line[0]).

But port 0 does not have to exist at that point. If
serial8250_register_8250_port() fails for port 0, priv->line[0] holds a
negative error code. The probe still succeeds (it only breaks the loop),
so on unbind, priv->line[0] (a negative value) is passed to
serial8250_get_port(). The GPIO device is never unregistered and a
bogus port is accessed.

The same problem would also occur after the planned conversion of
serial8250_register_8250_port() to return a uart port instead of a
line. As Sashiko pointed out in that case:
  If board->setup() fails for the first port (i=0) in exar_pci_probe(),
  priv->uport[0] remains NULL. If serial8250_register_8250_port() fails,
  it returns an ERR_PTR. In either case, the loop breaks and probe
  returns success. When the device is later unbound,
  pci_xr17v35x_exit() unconditionally passes priv->uport[0] to
  platform->unregister_gpio(), which will dereference it without
  checking for validity.

The GPIO device belongs to the PCI device, not to any particular port.
So store it in a new struct exar8250::gpio member. Pass priv to both
->register_gpio() and ->unregister_gpio(), so that pci_xr17v35x_exit()
does not need to look up any port at all.

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci")
Link: https://lore.kernel.org/all/sashiko-outbox-166269@kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/03a8b5c71614fc672fef1e55c083bda6c73b5bf3.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_exar.c | 36 ++++++++++++++---------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index b9cc0b786ca62d..f9f9c10246e12d 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -231,8 +231,9 @@ struct exar8250_platform {
 	int (*rs485_config)(struct uart_port *port, struct ktermios *termios,
 			    struct serial_rs485 *rs485);
 	const struct serial_rs485 *rs485_supported;
-	int (*register_gpio)(struct pci_dev *pcidev, struct uart_8250_port *port);
-	void (*unregister_gpio)(struct uart_8250_port *port);
+	int (*register_gpio)(struct exar8250 *priv, struct pci_dev *pcidev,
+			     struct uart_8250_port *port);
+	void (*unregister_gpio)(struct exar8250 *priv);
 };
 
 /**
@@ -256,6 +257,7 @@ struct exar8250 {
 	struct exar8250_board	*board;
 	struct eeprom_93cx6	eeprom;
 	void __iomem		*virt;
+	struct platform_device	*gpio;
 	int			line[];
 };
 
@@ -1174,22 +1176,21 @@ static const struct software_node exar_gpio_node = {
 	.properties = exar_gpio_properties,
 };
 
-static int xr17v35x_register_gpio(struct pci_dev *pcidev, struct uart_8250_port *port)
+static int xr17v35x_register_gpio(struct exar8250 *priv, struct pci_dev *pcidev,
+				  struct uart_8250_port *port)
 {
 	if (pcidev->vendor == PCI_VENDOR_ID_EXAR)
-		port->port.private_data =
-			__xr17v35x_register_gpio(pcidev, &exar_gpio_node);
+		priv->gpio = __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
 
 	return 0;
 }
 
-static void xr17v35x_unregister_gpio(struct uart_8250_port *port)
+static void xr17v35x_unregister_gpio(struct exar8250 *priv)
 {
-	if (!port->port.private_data)
-		return;
-
-	__xr17v35x_unregister_gpio(port->port.private_data);
-	port->port.private_data = NULL;
+	if (priv->gpio) {
+		__xr17v35x_unregister_gpio(priv->gpio);
+		priv->gpio = NULL;
+	}
 }
 
 static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termios,
@@ -1286,8 +1287,9 @@ static const struct software_node iot2040_gpio_node = {
 	.properties = iot2040_gpio_properties,
 };
 
-static int iot2040_register_gpio(struct pci_dev *pcidev,
-			      struct uart_8250_port *port)
+static int iot2040_register_gpio(struct exar8250 *priv,
+				 struct pci_dev *pcidev,
+				 struct uart_8250_port *port)
 {
 	u8 __iomem *p = port->port.membase;
 
@@ -1296,8 +1298,7 @@ static int iot2040_register_gpio(struct pci_dev *pcidev,
 	writeb(IOT2040_UARTS_ENABLE, p + UART_EXAR_MPIOLVL_15_8);
 	writeb(IOT2040_UARTS_GPIO_HI_MODE, p + UART_EXAR_MPIOSEL_15_8);
 
-	port->port.private_data =
-		__xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
+	priv->gpio = __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
 
 	return 0;
 }
@@ -1374,7 +1375,7 @@ pci_xr17v35x_setup(struct exar8250 *priv, struct pci_dev *pcidev,
 		/* Setup Multipurpose Input/Output pins. */
 		setup_gpio(pcidev, p);
 
-		ret = platform->register_gpio(pcidev, port);
+		ret = platform->register_gpio(priv, pcidev, port);
 	}
 
 	return ret;
@@ -1384,9 +1385,8 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev)
 {
 	const struct exar8250_platform *platform = exar_get_platform();
 	struct exar8250 *priv = pci_get_drvdata(pcidev);
-	struct uart_8250_port *port = serial8250_get_port(priv->line[0]);
 
-	platform->unregister_gpio(port);
+	platform->unregister_gpio(priv);
 }
 
 static inline void exar_misc_clear(struct exar8250 *priv)

From 0f39d51bd5f3d4d9cabd95578a998841ba6ca013 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Mon, 12 Oct 2026 16:07:58 +0200
Subject: [PATCH 1509/1982] dm-bufio: fix non-working memory limit

[ Upstream commit 1190dbeaeaa026a4879e675b8556a150c36a7ced ]

The function evict_old is supposed to loop and evict buffers while the
allocated size is above the threshold. However if it hits one bufio
client that is empty, it stops and doesn't attempt to scan other
clients.

This commit fixes it, so that it skips empty clients and retries up to
dm_bufio_client_count times.

Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-bufio.c | 41 +++++++++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 59e5d8aa42b717..6d76511953a25d 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2521,6 +2521,13 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
 	init_waitqueue_head(&c->free_buffer_wait);
 	c->async_write_error = 0;
 
+	/*
+	 * A client with no buffers yet is not holding the oldest buffer in
+	 * the system; leaving this zeroed would claim exactly that and keep
+	 * the client pinned at the front of dm_bufio_all_clients.
+	 */
+	c->oldest_buffer = jiffies;
+
 	c->dm_io = dm_io_client_create();
 	if (IS_ERR(c->dm_io)) {
 		r = PTR_ERR(c->dm_io);
@@ -2755,9 +2762,23 @@ static unsigned long __evict_a_few(unsigned long nr_buffers)
 
 	dm_bufio_unlock(c);
 
-	if (count)
+	if (count) {
 		c->oldest_buffer = oldest_buffer;
-	__insert_client(c);
+		__insert_client(c);
+	} else {
+		/*
+		 * We evicted nothing, so 'oldest_buffer' tells us nothing new
+		 * and the client keeps its old, possibly very stale, value.
+		 * Requeue it at the back rather than by that value, otherwise
+		 * __insert_client() would put it straight back at the front
+		 * and every subsequent call would pop this same client again,
+		 * never reaching any of the others.
+		 *
+		 * This leaves the list slightly out of order, which is fine -
+		 * it is only ever an approximation.
+		 */
+		list_add_tail(&c->client_list, &dm_bufio_all_clients);
+	}
 
 	return count;
 }
@@ -2782,11 +2803,23 @@ static void evict_old(void)
 {
 	unsigned long threshold = dm_bufio_cache_size -
 		dm_bufio_cache_size / DM_BUFIO_LOW_WATERMARK_RATIO;
+	int unproductive = 0;
 
 	mutex_lock(&dm_bufio_clients_lock);
 	while (dm_bufio_current_allocated > threshold) {
-		if (!__evict_a_few(64))
-			break;
+		if (__evict_a_few(64)) {
+			unproductive = 0;
+		} else {
+			/*
+			 * This client had nothing to give.  Try the others
+			 * before giving up: one idle client, or one whose
+			 * buffers are all held, must not stop us evicting
+			 * from everybody else.  Stop once a whole sweep of
+			 * the client list has freed nothing.
+			 */
+			if (++unproductive >= dm_bufio_client_count)
+				break;
+		}
 		cond_resched();
 	}
 	mutex_unlock(&dm_bufio_clients_lock);

From ac188323d33332db8e4aedd123a0383dda9c25b7 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Mon, 12 Oct 2026 16:09:52 +0200
Subject: [PATCH 1510/1982] dm-bufio: fix a race leading to an unsigned integer
 underflow

[ Upstream commit 005d2ec5723cd4ac740de678274623f1fadd6a6e ]

The function __scan tests "count - freed <= retain_target" and then sets
"atomic_long_set(&c->need_shrink, 0);" It exits with the condition "if
(!atomic_long_read(&c->need_shrink)) break;" It may be possible that
between these two statements, another thread sets &c->need_shrink to a
non-zero value. In this case, the function __scan continues and it may
possibly the "freed" variable is larger than the "count" variable. The
expression "count - freed" underflows and the function __scan will
continue to free all the buffers, even those that are below
retain_target.

Fix this bug by immediatelly exiting if we set
"atomic_long_set(&c->need_shrink, 0)"; and don't attempt to re-read
c->need_shrink afterwards.

Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-bufio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6d76511953a25d..07e2f0fccefe5f 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -2402,8 +2402,10 @@ static void __scan(struct dm_bufio_client *c)
 
 	for (l = 0; l < LIST_SIZE; l++) {
 		while (true) {
-			if (count - freed <= retain_target)
+			if (count - freed <= retain_target) {
 				atomic_long_set(&c->need_shrink, 0);
+				break;
+			}
 			if (!atomic_long_read(&c->need_shrink))
 				break;
 

From 4180ff5884387adc5a68d582b7808ea4ebf92af8 Mon Sep 17 00:00:00 2001
From: Wentao Guan <guanwentao@uniontech.com>
Date: Tue, 6 Oct 2026 10:38:00 +0300
Subject: [PATCH 1511/1982] mei: vsc: Fix packet CRC computed over pointer size

[ Upstream commit 1d2a50533aac7046488da78b0d25f69673cbb028 ]

vsc_tp_xfer() computes the packet CRC over sizeof(pkt) + olen bytes,
but pkt is a pointer, so sizeof(pkt) evaluates to the pointer size
instead of the size of struct vsc_tp_packet_hdr. The value correctly
match the 8-byte header on 64-bit builds.

Use sizeof(pkt->hdr), consistent with the header size used everywhere
else in the driver, e.g. in VSC_TP_PACKET_SIZE().

Cc: stable@kernel.org
Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20261006-vcs_fix_crc-v1-1-b7b149f13c1d@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mei/vsc-tp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c
index 5ecf99883996bb..e70c07aa0d604f 100644
--- a/drivers/misc/mei/vsc-tp.c
+++ b/drivers/misc/mei/vsc-tp.c
@@ -293,7 +293,7 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmd, const void *obuf, size_t olen,
 	pkt->hdr.seq = cpu_to_le32(++tp->seq);
 	memcpy(pkt->buf, obuf, olen);
 
-	crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt) + olen);
+	crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt->hdr) + olen);
 	memcpy(pkt->buf + olen, &crc, sizeof(crc));
 
 	ret = vsc_tp_wakeup_request(tp);

From 1a40cbb9d83ad8c669125554fcd73e626a00dc65 Mon Sep 17 00:00:00 2001
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date: Sat, 29 Aug 2026 18:49:45 +0200
Subject: [PATCH 1512/1982] speakup: Fix NULL pointer dereference on VT switch
 + selection

[ Upstream commit e1301ab8a8411fccc7effe0711fc09939a94953c ]

When selecting/pasting very quickly after VT switch, the tty is not set
yet, leading to a NULL dereference. We can just abort the operation.

Reported-by: co+e5693071d903b832@bugs.sh
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: stable@kernel.org
Tested-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260829164945.2691317-3-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/accessibility/speakup/selection.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
index 7df7afad5ab424..463a7ef19315e8 100644
--- a/drivers/accessibility/speakup/selection.c
+++ b/drivers/accessibility/speakup/selection.c
@@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = {
 
 int speakup_set_selection(struct tty_struct *tty)
 {
+	if (!tty)
+		return -ENODEV;
+
 	/* we get kref here first in order to avoid a subtle race when
 	 * cancelling selection work. getting kref first establishes the
 	 * invariant that if speakup_sel_work.tty is not NULL when
@@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = {
 
 int speakup_paste_selection(struct tty_struct *tty)
 {
+	if (!tty)
+		return -ENODEV;
+
 	tty_kref_get(tty);
 	if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
 		tty_kref_put(tty);

From 29d810702de082a48d7afebd86c87d9a15b41ff1 Mon Sep 17 00:00:00 2001
From: Aamir Ahmed <elb12345@hotmail.co.uk>
Date: Sat, 12 Sep 2026 14:09:06 +0100
Subject: [PATCH 1513/1982] clk: qcom: ipq-cmn-pll: Assign .num before
 accessing .hws

[ Upstream commit 231bbd135772390522be3656b34b49ea3039eccf ]

hw_data->hws[] is annotated with __counted_by(num), so hw_data->num
must hold the element count before the array is accessed.
ipq_cmn_pll_register_clks() assigns it only after storing the fixed
rate output clocks and the CMN PLL, and the unwind loop under
unregister_fixed_clk reads .hws[] with .num still zero. Both are
out-of-bounds accesses under CONFIG_UBSAN_BOUNDS.

Move the assignment to right after the allocation.

Fixes: f81715a4c87c ("clk: qcom: Add CMN PLL clock controller driver for IPQ SoC")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Luo Jie <jie.luo@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/AS8P251MB000187BDFAD98A21F4C356E9C8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/ipq-cmn-pll.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/qcom/ipq-cmn-pll.c b/drivers/clk/qcom/ipq-cmn-pll.c
index 369798d1ce4279..e01c8ccf173111 100644
--- a/drivers/clk/qcom/ipq-cmn-pll.c
+++ b/drivers/clk/qcom/ipq-cmn-pll.c
@@ -351,6 +351,8 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
 	if (!hw_data)
 		return -ENOMEM;
 
+	hw_data->num = num_clks + 1;
+
 	/*
 	 * Register the CMN PLL clock, which is the parent clock of
 	 * the fixed rate output clocks.
@@ -377,7 +379,6 @@ static int ipq_cmn_pll_register_clks(struct platform_device *pdev)
 	 * is configured to 12 GHZ by DT property assigned-clock-rates-u64.
 	 */
 	hw_data->hws[CMN_PLL_CLK] = cmn_pll_hw;
-	hw_data->num = num_clks + 1;
 
 	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, hw_data);
 	if (ret)

From deea3afb1aca21300a1701aa8950f3bee8eb7412 Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Date: Mon, 21 Sep 2026 11:49:34 +0530
Subject: [PATCH 1514/1982] clk: qcom: ipq5018: add 24MHz rate for USB UTMI
 clock

[ Upstream commit 75e893169fc5c9ec28d5f9dffde40ce29b59a5de ]

The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.

Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.

Cc: stable@vger.kernel.org
Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-1-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-ipq5018.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
index e2d01cdc39c961..78ccd70199fc9c 100644
--- a/drivers/clk/qcom/gcc-ipq5018.c
+++ b/drivers/clk/qcom/gcc-ipq5018.c
@@ -1270,6 +1270,7 @@ static struct clk_rcg2 usb0_master_clk_src = {
 };
 
 static const struct freq_tbl ftbl_usb0_mock_utmi_clk_src[] = {
+	F(24000000, P_XO, 1, 0, 0),
 	F(60000000, P_GPLL4, 10, 1, 2),
 	{ }
 };

From d8e8a00721a21b2022dedc63afb68beddca71bee Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Date: Mon, 21 Sep 2026 11:49:35 +0530
Subject: [PATCH 1515/1982] clk: qcom: ipq5332: add 24MHz rate for USB UTMI
 clock

[ Upstream commit 19b62f31e15ef70dc927aab91b1576ea6c37f992 ]

The USB UTMI reference clock must operate at 24 MHz, as recommended
by the hardware team, for reliable USB operation.

Validation showed that USB 3.2 hub enumeration with USB 2.0 devices
fails when the UTMI reference clock is not configured to the required
24 MHz rate. Configuring the UTMI reference clock to 24 MHz to resolve
the enumeration failure and ensure successful device detection.

Cc: stable@vger.kernel.org
Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-ipq_clk_changes-v1-2-d242e3d49648@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-ipq5332.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c
index 9246e97d785a1f..1d02c35c672258 100644
--- a/drivers/clk/qcom/gcc-ipq5332.c
+++ b/drivers/clk/qcom/gcc-ipq5332.c
@@ -1039,6 +1039,7 @@ static struct clk_rcg2 gcc_usb0_master_clk_src = {
 };
 
 static const struct freq_tbl ftbl_gcc_usb0_mock_utmi_clk_src[] = {
+	F(24000000, P_XO, 1, 0, 0),
 	F(60000000, P_GPLL4_OUT_AUX, 10, 1, 2),
 	{ }
 };

From d6c4a5d2cc6ad695bdc89ce6ac028eac17484b9a Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Mon, 28 Sep 2026 10:48:08 +0200
Subject: [PATCH 1516/1982] iomap: don't lose a fiemap iteration error when
 emitting the last extent

[ Upstream commit 0d0104adc2c8316433b660cdf6d182a09881864f ]

iomap_fiemap() emits extents one behind: iomap_fiemap_iter() flushes the
previous extent and remembers the current one, and the remembered extent
is written with FIEMAP_EXTENT_LAST after the iteration loop.

That final flush overwrites ret, so when ->iomap_begin() fails partway
through the iteration the error is replaced by the result of
iomap_to_fiemap() (zero on success) and iomap_fiemap() returns success
with a truncated extent list whose last entry is wrongly marked as the
last extent in the file.  The pre-iomap_iter code returned the error
from inside the loop, before flushing the pending extent.

Check for the iteration error before flushing the pending extent, so
that real errors are propagated and only a successful iteration emits
the final FIEMAP_EXTENT_LAST extent.  -ENOENT (no mapping) is still not
an error, and the pending extent is still emitted in that case.

Fixes: 7892386d3571 ("iomap: switch iomap_fiemap to use iomap_iter")
Cc: stable@vger.kernel.org # v5.15
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/250226e33b3b23c6b1714a45dc3c465c2a45cdc0.1790342457.git.parri.andrea@gmail.com
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/iomap/fiemap.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/iomap/fiemap.c b/fs/iomap/fiemap.c
index d11dadff828653..54b824b7edb5c6 100644
--- a/fs/iomap/fiemap.c
+++ b/fs/iomap/fiemap.c
@@ -76,15 +76,15 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
 	while ((ret = iomap_iter(&iter, ops)) > 0)
 		iter.status = iomap_fiemap_iter(&iter, fi, &prev);
 
+	/* inode with no (attribute) mapping will give ENOENT */
+	if (ret < 0 && ret != -ENOENT)
+		return ret;
+
 	if (prev.type != IOMAP_HOLE) {
 		ret = iomap_to_fiemap(fi, &prev, FIEMAP_EXTENT_LAST);
 		if (ret < 0)
 			return ret;
 	}
-
-	/* inode with no (attribute) mapping will give ENOENT */
-	if (ret < 0 && ret != -ENOENT)
-		return ret;
 	return 0;
 }
 EXPORT_SYMBOL_GPL(iomap_fiemap);

From 5564d7a654a7be040d7dd55fd9dd20dd4e0beab2 Mon Sep 17 00:00:00 2001
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Date: Tue, 29 Sep 2026 00:38:11 +0900
Subject: [PATCH 1517/1982] nvme-rdma: don't complete a request after a bogus
 remote invalidation

[ Upstream commit 909307cea08aff4e486cdb7491de5c76a2c31341 ]

When a remote invalidation names an rkey that is not the one we handed out
for this request, nvme_rdma_process_nvme_rsp() logs and schedules error
recovery, then falls through to nvme_rdma_end_request().  The request is
completed with req->mr never invalidated, and nvme_rdma_unmap_data() hands
it back with ib_mr_pool_put(), which only puts it on a list.  The rkey
stays valid and still maps the pages the completed read filled, so a
controller that sent the bogus invalidation can write into those pages
after pread() has returned.

Return instead, the way the local invalidation path below already does,
and leave the request for error recovery to cancel.

Fixes: 3ef0279bb0031 ("nvme-rdma: Check remotely invalidated rkey matches our expected rkey")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/rdma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 19a9dd7caed8df..dbaf503b7de9c1 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1713,6 +1713,7 @@ static void nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
 				"Bogus remote invalidation for rkey %#x\n",
 				req->mr ? req->mr->rkey : 0);
 			nvme_rdma_error_recovery(queue->ctrl);
+			return;
 		}
 	} else if (req->mr) {
 		int ret;

From 7a4ee76f0e8f47f5eee3f63d8a3ed20f5c672e6a Mon Sep 17 00:00:00 2001
From: Daejun Park <daejun7.park@samsung.com>
Date: Fri, 2 Oct 2026 16:03:41 +0900
Subject: [PATCH 1518/1982] nvmet: fix preempt of another registrant by the
 reservation holder

[ Upstream commit d9e84d4e19994818b80846bd2abb7b396e4116a9 ]

Unless the reservation is of an All Registrants type, nvmet_pr_preempt()
treats every Reservation Acquire command with the Preempt or Preempt and
Abort action that is sent by the reservation holder as the holder
preempting itself.  It updates the reservation type to RTYPE and
completes the command successfully without looking at PRKEY.

NVMe Base Specification 2.1, section 8.1.22.7 makes the action depend
on PRKEY for these reservation types, no matter which registrant sends
the command:

 - PRKEY matches the key of the reservation holder: the reservation is
   preempted.  This is how a holder preempts itself.
 - PRKEY does not match the key of the holder and is not 0h: the
   registrants whose key matches PRKEY are unregistered.
 - PRKEY does not match the key of the holder and is 0h: the command is
   aborted with Invalid Field in Command.

With the current code, a holder that preempts with the key of another
registrant leaves that registrant registered, changes the reservation
type to RTYPE and still gets a successful completion.  With hosts A, B
and C registered with the keys 0xa, 0xb and 0xc, and A holding an
Exclusive Access - Registrants Only reservation, A sends:

  # nvme resv-acquire /dev/nvme1 -n 1 --crkey=0xa --prkey=0xb \
        --rtype=4 --racqa=1
  NVME Reservation Acquire success
  # nvme resv-report /dev/nvme1 -n 1 --eds | grep '^regctl '
  regctl    : 3

and B can still write to the namespace.  Preempt and Abort (--racqa=2)
gives the same result.  When C sends the preempt instead (--crkey=0xc),
B is unregistered and its writes fail with Reservation Conflict.

This defeats fencing in the pNFS SCSI layout server.  nfsd holds the
reservation and fences a client that does not return its layout by
calling pr_preempt() with the key of that client and the abort flag,
which is the command RFC 9561 section 2.2.3 asks for.  On an nvmet
namespace the preempt succeeds, nfsd logs the client as fenced, and the
client keeps writing to the device.  In a test with an nfsd server and
two clients on an nvmet-tcp namespace, the namespace still had three
registrants after the fence and the fenced client went on writing to
it.  With this patch two registrants are left and the writes of the
fenced client fail with a reservation conflict.

Take the self preempt path only when PRKEY is the key of the holder.
Any other PRKEY sent by the holder is then handled by the code that
already serves a non-holder registrant, for Preempt and for Preempt and
Abort.  For a host that holds the reservation this changes the
following:

 - A preempt with the key of another registrant unregisters the
   registrants with that key, sends them the registration preempted
   notification and leaves the reservation type alone.
 - A preempt with PRKEY 0h fails with Invalid Field in Command.  A
   holder that changed its reservation type this way has to pass its
   own key in PRKEY, which works with and without this patch.
 - A preempt with a PRKEY that matches no registrant fails with
   Reservation Conflict.  The specification defines that status only
   for the All Registrants types.  It is what nvmet already returns to
   a non-holder registrant in this case and what the SCSI target
   returns for an unregistered key.  nfsd treats it as a successful
   fence.

Not changed: when the holder preempts itself, registrants that share
its key stay registered.

Fixes: 5a47c2080a73 ("nvmet: support reservation feature")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/pr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/pr.c b/drivers/nvme/target/pr.c
index 9ab50f821ad692..0f696840b168b8 100644
--- a/drivers/nvme/target/pr.c
+++ b/drivers/nvme/target/pr.c
@@ -589,7 +589,7 @@ static u16 nvmet_pr_preempt(struct nvmet_req *req,
 				&ctrl->hostid, abort);
 	}
 
-	if (holder == reg) {
+	if (holder == reg && prkey == holder->rkey) {
 		status = nvmet_pr_update_reg_attr(pr, holder,
 				nvmet_pr_update_holder_rtype, &rtype);
 		if (!status && original_rtype != rtype)

From 81b9f59167067b5fbb4f2ae65498194085bbffe3 Mon Sep 17 00:00:00 2001
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Date: Tue, 6 Oct 2026 22:48:05 +0900
Subject: [PATCH 1519/1982] nvme-auth: fail when the controller does not
 authenticate itself

[ Upstream commit f9e43d924bc74feeb56197de82b2845de2a4b85a ]

nvme_auth_process_dhchap_success1() returns success as soon as the
controller clears the rvalid flag in its DH-HMAC-CHAP success1 message,
without looking at whether the host had asked the controller to
authenticate.  A host configured with a controller secret sends a
challenge in its reply, computes the expected controller response, and
sets chap->bi_directional; if the controller then answers with
rvalid = 0 the response is never compared, the host still sends
success2, and the queue is marked as authenticated.

A malicious or man-in-the-middle controller therefore only has to clear
one flag to turn the configured bidirectional authentication into a
one-way one, without holding any secret of its own.  The target side
already treats the mirror image of this as fatal: when the host supplied
a challenge but no controller key is configured, nvmet_auth_success1()
fails the authentication rather than answering with rvalid = 0.

Refuse the connection if the controller returns no response although
bidirectional authentication was requested.  chap->bi_directional is the
right condition rather than ctrl->ctrl_key, because secure concatenation
sends a challenge only to derive the PSK and deliberately clears
bi_directional; a one-way setup without a controller secret keeps
returning success as before.

Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/auth.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 9d73713d6f8283..38506314248f67 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -378,8 +378,21 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl,
 			 nvme_auth_hmac_name(chap->hash_id),
 			 nvme_auth_dhgroup_name(chap->dhgroup_id));
 
-	if (!data->rvalid)
+	if (!data->rvalid) {
+		/*
+		 * The controller did not return a response.  If we asked it to
+		 * authenticate itself the session must not be used, otherwise
+		 * mutual authentication would silently degrade to one-way.
+		 */
+		if (chap->bi_directional) {
+			dev_warn(ctrl->device,
+				 "qid %d: controller did not authenticate\n",
+				 chap->qid);
+			chap->status = NVME_AUTH_DHCHAP_FAILURE_FAILED;
+			return -ECONNREFUSED;
+		}
 		return 0;
+	}
 
 	/* Validate controller response */
 	if (crypto_memneq(chap->response, data->rval, data->hl)) {

From ef062530729f0ddc738ac60a7966567836573e67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Wed, 7 Oct 2026 19:27:46 +0000
Subject: [PATCH 1520/1982] nvmet: free the bvec on file namespace range errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9d820d55b3cb4859c7cf42a74dc78f6154f97398 ]

nvmet_file_execute_rw() allocates the bvec before
nvmet_file_execute_io() checks whether the request fits in the backing
file. If the request extends beyond the file, nvmet_file_execute_io()
calls nvmet_req_complete() to return an error. This skips
nvmet_file_io_done(), so the allocated memory is never freed. Repeated
requests can exhaust memory.

Use nvmet_file_io_done() to free the bvec before returning the range
error to the client.

Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/io-cmd-file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 2d068439b129c5..6e147001647245 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -133,8 +133,8 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
 
 	pos = le64_to_cpu(req->cmd->rw.slba) << req->ns->blksize_shift;
 	if (unlikely(pos + req->transfer_len > req->ns->size)) {
-		nvmet_req_complete(req, errno_to_nvme_status(req, -ENOSPC));
-		return true;
+		ret = -ENOSPC;
+		goto complete;
 	}
 
 	memset(&req->f.iocb, 0, sizeof(struct kiocb));

From b0c652a11e536da6eb133d365bb936b081b6b70f Mon Sep 17 00:00:00 2001
From: Sung Byeongchan <tjdqudcks0424@naver.com>
Date: Wed, 7 Oct 2026 15:30:41 +0900
Subject: [PATCH 1521/1982] nvmet: require authentication before property set

[ Upstream commit 44512543ff0413031516a02cde67323a55e0f769 ]

I/O queues do not perform independent DH-HMAC-CHAP authentication.  They
instead rely on authentication of the controller's admin queue.  Fabrics
property commands, however, are dispatched before the general admin command
authentication check.

An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
and access a namespace after admin CONNECT reported that authentication was
required.  Reject PROPERTY_SET until the admin queue has authenticated.
Targets without a configured authentication key are unchanged.

This was found by source review with AI assistance.  A localhost NVMe/TCP
wire reproducer retrieved a known 4 KiB namespace block in two independent
boots without completing AUTH_SEND or AUTH_RECEIVE.  With this change,
PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
returned; the no-authentication control continued to work.

Fixes: c91a20129185 ("nvmet-auth: authenticate on admin queue only")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fabrics-cmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index bc837fbfada15d..9aedab2603bdd6 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -14,6 +14,10 @@ static void nvmet_execute_prop_set(struct nvmet_req *req)
 
 	if (!nvmet_check_transfer_len(req, 0))
 		return;
+	if (!nvmet_check_auth_status(req)) {
+		status = NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
+		goto out;
+	}
 
 	if (req->cmd->prop_set.attrib & 1) {
 		req->error_loc =

From 88d7fce496e65b6904daa7286c42a735fc7765d8 Mon Sep 17 00:00:00 2001
From: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Date: Tue, 13 Oct 2026 19:28:12 +0900
Subject: [PATCH 1522/1982] nvme: bound FDP config log reads to the received
 buffer

[ Upstream commit 3cf6de080d97d0d9641fbdb613d546c0734905dd ]

nvme_query_fdp_granularity() parses the FDP Configurations log using
sizes the controller returns, without checking that they fit the buffer
it was given.  The log size is only bounded from above before
kvmalloc(), so a size below the log header makes
le16_to_cpu(h->numfdpc) read past the allocation, and a size of zero
yields ZERO_SIZE_PTR and faults.  Each configuration descriptor is then
dereferenced (dsze while walking, and nrg and runs on the selected one)
without checking that the whole descriptor lies within the buffer, so a
descriptor at or past the end is read out of bounds.  The out-of-bounds
runs value is then exposed to userspace through
/sys/block/nvmeXnY/queue/write_stream_granularity.

A device-supplied dsze that is not a multiple of eight also leaves the
following descriptors unaligned, and the structure is not packed, so
reading nrg and runs from one can fault on architectures without
efficient unaligned access.

A malicious or buggy controller triggers this during namespace scan with a
short FDP Configurations log:

[    1.104828] BUG: KASAN: slab-out-of-bounds in nvme_alloc_ns+0x39a6/0x4480
[    1.104848] Read of size 8 at addr ffff888009fd8fe0 by task kworker/u8:3/52
[    1.104852]
[    1.104857] CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 7.3.0-rc6-00063-g0c2669a9f4a1 #1 PREEMPT(lazy)
[    1.104862] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[    1.104866] Workqueue: async async_run_entry_fn
[    1.104873] Call Trace:
[    1.104876]  <TASK>
[    1.104878]  dump_stack_lvl+0x66/0xa0
[    1.104886]  print_report+0xd0/0x630
[    1.104893]  ? nvme_alloc_ns+0x39a6/0x4480
[    1.104897]  ? __virt_addr_valid+0x209/0x3f0
[    1.104903]  ? nvme_alloc_ns+0x39a6/0x4480
[    1.104907]  kasan_report+0xe4/0x120
[    1.104913]  ? nvme_alloc_ns+0x39a6/0x4480
[    1.104919]  nvme_alloc_ns+0x39a6/0x4480
[    1.104926]  ? __pfx_nvme_alloc_ns+0x10/0x10
[    1.104931]  ? check_prev_add+0xfd/0xe80
[    1.104942]  ? lock_acquire+0x18d/0x300
[    1.104948]  ? nvme_find_get_ns+0xbb/0x2e0
[    1.104952]  ? find_held_lock+0x2b/0x80
[    1.104956]  ? nvme_find_get_ns+0x221/0x2e0
[    1.104962]  ? nvme_find_get_ns+0x231/0x2e0
[    1.104967]  ? nvme_scan_ns+0x2e1/0x8d0
[    1.104971]  ? kfree+0x2e5/0x510
[    1.104976]  ? __lock_acquire+0x570/0x1b00
[    1.104982]  nvme_scan_ns+0x56a/0x8d0
[    1.104987]  ? __pfx_nvme_scan_ns+0x10/0x10
[    1.104994]  ? lockdep_hardirqs_on_prepare+0xdc/0x190
[    1.104999]  ? trace_hardirqs_on+0x18/0x160
[    1.105005]  ? kvm_clock_get_cycles+0x19/0x40
[    1.105011]  ? __pfx_nvme_scan_ns_async+0x10/0x10
[    1.105015]  async_run_entry_fn+0x8d/0x290
[    1.105020]  process_one_work+0x8ac/0x1b00
[    1.105029]  ? __pfx_process_one_work+0x10/0x10
[    1.105034]  ? lock_acquire+0x18d/0x300
[    1.105040]  ? lock_is_held_type+0x8f/0x100
[    1.105046]  ? __pfx_async_run_entry_fn+0x10/0x10
[    1.105050]  worker_thread+0x4ee/0xe70
[    1.105056]  ? lockdep_hardirqs_on_prepare+0xdc/0x190
[    1.105061]  ? trace_hardirqs_on+0x18/0x160
[    1.105066]  ? __pfx_worker_thread+0x10/0x10
[    1.105071]  ? __pfx_worker_thread+0x10/0x10
[    1.105076]  kthread+0x2ce/0x3b0
[    1.105080]  ? __pfx_kthread+0x10/0x10
[    1.105085]  ret_from_fork+0x52e/0x780
[    1.105090]  ? __pfx_ret_from_fork+0x10/0x10
[    1.105094]  ? __switch_to+0x572/0xde0
[    1.105101]  ? __pfx_kthread+0x10/0x10
[    1.105105]  ret_from_fork_asm+0x1a/0x30
[    1.105114]  </TASK>
[    1.105116]
[    1.105117] Allocated by task 52:
[    1.105119]  kasan_save_stack+0x33/0x60
[    1.105123]  kasan_save_track+0x14/0x30
[    1.105126]  __kasan_kmalloc+0x8f/0xa0
[    1.105129]  __kvmalloc_node_noprof+0x2e1/0x820
[    1.105134]  nvme_alloc_ns+0x1097/0x4480
[    1.105138]  nvme_scan_ns+0x56a/0x8d0
[    1.105142]  async_run_entry_fn+0x8d/0x290
[    1.105145]  process_one_work+0x8ac/0x1b00
[    1.105148]  worker_thread+0x4ee/0xe70
[    1.105152]  kthread+0x2ce/0x3b0
[    1.105155]  ret_from_fork+0x52e/0x780
[    1.105159]  ret_from_fork_asm+0x1a/0x30
[    1.105163]
[    1.105164] The buggy address belongs to the object at ffff888009fd8fc0
[    1.105164]  which belongs to the cache kmalloc-32 of size 32
[    1.105167] The buggy address is located 8 bytes to the right of
[    1.105167]  allocated 24-byte region [ffff888009fd8fc0, ffff888009fd8fd8)
[    1.105171]
[    1.105172] The buggy address belongs to the physical page:
[    1.105175] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9fd8
[    1.105179] flags: 0x100000000000000(node=0|zone=1)
[    1.105183] page_type: f5(slab)
[    1.105188] raw: 0100000000000000 ffff888008c41780 dead000000000100 dead000000000122
[    1.105192] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[    1.105194] page dumped because: kasan: bad access detected
[    1.105195]
[    1.105196] Memory state around the buggy address:
[    1.105198]  ffff888009fd8e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    1.105201]  ffff888009fd8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    1.105203] >ffff888009fd8f80: fc fc fc fc fc fc fc fc 00 00 00 fc fc fc fc fc
[    1.105205]                                                        ^
[    1.105207]  ffff888009fd9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[    1.105210]  ffff888009fd9080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[    1.105212] ==================================================================

Reject a log smaller than its header plus one configuration descriptor,
zero the buffer so a short transfer leaves no uninitialized tail to parse,
require each descriptor's declared size to be at least a descriptor and to
leave room for the next one before walking it, and read the descriptor
fields with the unaligned accessors.

Fixes: 30b5f20bb2dda ("nvme: register fdp parameters with the block layer")
Cc: stable@vger.kernel.org
Suggested-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index ad725e346c94e4..99a8e2953b02a4 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2210,13 +2210,18 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
 	}
 
 	size = le32_to_cpu(hdr.sze);
+	if (size < sizeof(*h) + sizeof(*desc)) {
+		dev_warn(ctrl->device, "FDP config size too small:%zu\n",
+			 size);
+		return 0;
+	}
 	if (size > PAGE_SIZE * MAX_ORDER_NR_PAGES) {
 		dev_warn(ctrl->device, "FDP config size too large:%zu\n",
 			 size);
 		return 0;
 	}
 
-	h = kvmalloc(size, GFP_KERNEL);
+	h = kvzalloc(size, GFP_KERNEL);
 	if (!h)
 		return -ENOMEM;
 
@@ -2242,9 +2247,9 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
 	desc = log;
 	end = log + size - sizeof(*h);
 	for (i = 0; i < fdp_idx; i++) {
-		u16 dsze = le16_to_cpu(desc->dsze);
+		u16 dsze = get_unaligned_le16(&desc->dsze);
 
-		if (!dsze || log + dsze > end) {
+		if (dsze < sizeof(*desc) || log + dsze + sizeof(*desc) > end) {
 			dev_warn(ctrl->device,
 				 "FDP invalid config descriptor at index %d\n", i);
 			ret = 0;
@@ -2254,13 +2259,13 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
 		desc = log;
 	}
 
-	if (le32_to_cpu(desc->nrg) > 1) {
+	if (get_unaligned_le32(&desc->nrg) > 1) {
 		dev_warn(ctrl->device, "FDP NRG > 1 not supported\n");
 		ret = 0;
 		goto out;
 	}
 
-	info->runs = le64_to_cpu(desc->runs);
+	info->runs = get_unaligned_le64(&desc->runs);
 out:
 	kvfree(h);
 	return ret;

From 124db30f332f644e900cc9d92a9fb4293d63d4f7 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Mon, 12 Oct 2026 16:12:29 +0200
Subject: [PATCH 1523/1982] nvmet: zns: don't leak stale memory in zone
 management receive

[ Upstream commit 31b8a6af19b73e6167c4b655cd5e86681bac1c41 ]

A Zone Management Receive report returns the full buffer the host asked
for, but nvmet_bdev_zone_zmgmt_recv_work() writes only the 8-byte
Number of Zones field and one 64-byte descriptor for each matching zone
that fits. The 56 reserved header bytes and every descriptor slot past
the last match keep whatever the buffer held before. A 4096-byte report
covering a single zone leaves 4024 bytes unwritten.

The tcp, rdma and fc transports allocate that buffer with sgl_alloc()
and pci-epf with kmalloc(), none with __GFP_ZERO, and on success each
sends the whole buffer to the host (nvmet_setup_c2h_data_pdu() for
tcp), so the host receives old kernel memory from the target.

nvmet_bdev_execute_zone_mgmt_recv() also never checks the transport
data length against NUMD, so on transports where the host sets that
length, the buffer sent back can be much larger than the report NUMD
describes. pci-epf derives its data length from NUMD, so the length
check below does not apply there, but the zeroing still covers the
report.

Reject a data length that does not match NUMD with
nvmet_check_transfer_len(), as nvmet_bdev_execute_zone_append() does,
and zero the report with nvmet_zero_sgl() before filling it. Zeroing
NUMD bytes is only enough because of the length check, so the two go
together.

Allocating with __GFP_ZERO in the transports would also close the leak,
but it adds a memset to every read command to fix one handler, so the
transports are left alone.

Tested over the loop, tcp, rdma and fc transports with a zoned
null_blk namespace: before this patch, zone reports carried stale bytes
and a data length larger than NUMD was accepted; with it, reports are
fully initialized and such a length fails with Data SGL Length Invalid.

Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/zns.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index 95af4b67108c73..00f694ac3986c3 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -286,6 +286,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
 	if (status)
 		goto out;
 
+	/* Only the zone count and matching descriptors are written below. */
+	status = nvmet_zero_sgl(req, 0, out_bufsize);
+	if (status)
+		goto out;
+
 	if (!req_slba_nr_zones) {
 		status = NVME_SC_SUCCESS;
 		goto out;
@@ -314,6 +319,11 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
 
 void nvmet_bdev_execute_zone_mgmt_recv(struct nvmet_req *req)
 {
+	u32 out_bufsize = (le32_to_cpu(req->cmd->zmr.numd) + 1) << 2;
+
+	if (!nvmet_check_transfer_len(req, out_bufsize))
+		return;
+
 	INIT_WORK(&req->z.zmgmt_work, nvmet_bdev_zone_zmgmt_recv_work);
 	queue_work(zbd_wq, &req->z.zmgmt_work);
 }

From 1f49d6a95e9599430c69efeaaae55f746f1b89d3 Mon Sep 17 00:00:00 2001
From: Daeho Jeong <daehojeong@google.com>
Date: Sun, 4 Oct 2026 17:04:56 +0000
Subject: [PATCH 1524/1982] f2fs: convert inline quota files when turning quota
 on

[ Upstream commit a85e09bd6cc80059b9e0ef5cd1467719aa3129a8 ]

With a block size larger than 4KB, the inline data area is large enough
to hold a freshly created quota file (quotacheck writes 6KB), so
aquota.user/aquota.group stay inline after quotaon. f2fs does not
expect quota files to be inline, and this causes two problems:

1. Quota file corruption. f2fs_write_single_data_page() sends quota
   inodes straight to f2fs_do_write_data_page(), which sees NULL_ADDR
   for index 0, treats the folio as truncated and drops it. Updates to
   the quota file are lost once the folio is reclaimed, so the quota
   tree reads stale data: chown/chgrp fail with EIO and quota entries
   of users disappear. For example, the kernel log shows:

     find_free_dqentry: Data block full but it shouldn't
     qtree_write_dquot: Error -5 occurred while creating quota

2. Deadlock. Writing a quota file past MAX_INLINE_DATA converts it from
   f2fs_write_begin() under f2fs_lock_op(). dquot_transfer() is called
   from f2fs_setattr() with f2fs_lock_op() already held, so chown/chgrp
   take cp_rwsem for read twice and hang, together with the checkpoint
   and every other writer, once a checkpoint waits for cp_rwsem in
   between (seen with generic/232).

Quota files only grow and there are at most MAXQUOTAS of them, so there
is no point in keeping them inline. Convert them in f2fs_quota_on() and
after dquot_quota_on_mount(), which keeps every block size on the same
path as 4KB blocks, where quota files never fit inline. Quota sysfiles
are created by mkfs with real blocks and are not affected.

Cc: stable@kernel.org
Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 74b12c1ef82110..146bd977bb591c 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3171,15 +3171,42 @@ static qsize_t *f2fs_get_reserved_space(struct inode *inode)
 	return &F2FS_I(inode)->i_reserved_quota;
 }
 
+/*
+ * Quota files only grow and there are at most MAXQUOTAS of them, so there is
+ * no point in keeping them inline. Writeback of quota files does not handle
+ * inline data and would drop what was written to them.
+ */
+static int f2fs_quota_convert_inline(struct inode *inode)
+{
+	int err;
+
+	if (!f2fs_has_inline_data(inode))
+		return 0;
+
+	inode_lock(inode);
+	err = f2fs_convert_inline_inode(inode);
+	inode_unlock(inode);
+	return err;
+}
+
 static int f2fs_quota_on_mount(struct f2fs_sb_info *sbi, int type)
 {
+	int err;
+
 	if (is_set_ckpt_flags(sbi, CP_QUOTA_NEED_FSCK_FLAG)) {
 		f2fs_err(sbi, "quota sysfile may be corrupted, skip loading it");
 		return 0;
 	}
 
-	return dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
+	err = dquot_quota_on_mount(sbi->sb, F2FS_OPTION(sbi).s_qf_names[type],
 					F2FS_OPTION(sbi).s_jquota_fmt, type);
+	if (err)
+		return err;
+
+	err = f2fs_quota_convert_inline(sb_dqopt(sbi->sb)->files[type]);
+	if (err)
+		dquot_quota_off(sbi->sb, type);
+	return err;
 }
 
 int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly)
@@ -3391,6 +3418,10 @@ static int f2fs_quota_on(struct super_block *sb, int type, int format_id,
 
 	inode = d_inode(path->dentry);
 
+	err = f2fs_quota_convert_inline(inode);
+	if (err)
+		goto out;
+
 	err = filemap_fdatawrite(inode->i_mapping);
 	if (err)
 		goto out;

From 611201814601677f2743f94dc143e1777c256305 Mon Sep 17 00:00:00 2001
From: Geraldo Nascimento <geraldogabriel@gmail.com>
Date: Tue, 16 Jun 2026 12:25:28 -0300
Subject: [PATCH 1525/1982] PCI: rockchip-ep: Do not attempt 5.0 GT/s
 retraining

[ Upstream commit 7f173bfa6d42742de4ab647e001232c1165ab28e ]

Drop the 5.0 GT/s Link Speed retraining code block from Rockchip PCIe EP
driver. The reason is that Shawn Lin from Rockchip has reiterated that
there may be danger of "catastrophic failure" in using their PCIe with 5.0
GT/s speeds.

While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.

This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.

[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf

Fixes: bd6e61df4b2e ("PCI: rockchip-ep: Improve link training")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/d994f8fb3481bbb8f3972f117334a6e8aea383fb.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-rockchip-ep.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index 799461335762e3..9ebc227a1ef842 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -553,19 +553,6 @@ static void rockchip_pcie_ep_link_training(struct work_struct *work)
 	if (ret)
 		goto again;
 
-	/*
-	 * Check the current speed: if gen2 speed was requested and we are not
-	 * at gen2 speed yet, retrain again for gen2.
-	 */
-	val = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
-	if (!PCIE_LINK_IS_GEN2(val) && rockchip->link_gen == 2) {
-		/* Enable retrain for gen2 */
-		rockchip_pcie_ep_retrain_link(rockchip);
-		readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
-				   val, PCIE_LINK_IS_GEN2(val), 50,
-				   LINK_TRAIN_TIMEOUT);
-	}
-
 	/* Check again that the link is up */
 	if (!rockchip_pcie_ep_link_up(rockchip))
 		goto again;

From 2e7f6ad5e0c241c0bd0783074c75d3d722f30e90 Mon Sep 17 00:00:00 2001
From: Geraldo Nascimento <geraldogabriel@gmail.com>
Date: Tue, 16 Jun 2026 12:25:45 -0300
Subject: [PATCH 1526/1982] PCI: rockchip-host: Do not attempt 5.0 GT/s
 retraining

[ Upstream commit 2a1e6c382fb7567679c07bd6a7060fefc7a5edc9 ]

Drop the 5.0 GT/s Link Speed retraining from Rockchip PCIe Root Complex
Mode Operation, so-called host driver.

The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0GT/s speeds.

While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.

This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.

[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf

Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/68f6353e3a2ea4914de36c42b6906e41282adad3.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-rockchip-host.c | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
index d203c4876d3041..0b52f2e370f413 100644
--- a/drivers/pci/controller/pcie-rockchip-host.c
+++ b/drivers/pci/controller/pcie-rockchip-host.c
@@ -328,26 +328,6 @@ static int rockchip_pcie_host_init_port(struct rockchip_pcie *rockchip)
 		goto err_power_off_phy;
 	}
 
-	if (rockchip->link_gen == 2) {
-		/*
-		 * Enable retrain for gen2. This should be configured only after
-		 * gen1 finished.
-		 */
-		status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
-		status &= ~PCI_EXP_LNKCTL2_TLS;
-		status |= PCI_EXP_LNKCTL2_TLS_5_0GT;
-		rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2);
-		status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
-		status |= PCI_EXP_LNKCTL_RL;
-		rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL);
-
-		err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL,
-					 status, PCIE_LINK_IS_GEN2(status), 20,
-					 500 * USEC_PER_MSEC);
-		if (err)
-			dev_dbg(dev, "PCIe link training gen2 timeout, fall back to gen1!\n");
-	}
-
 	/* Check the final link width from negotiated lane counter from MGMT */
 	status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
 	status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>

From 6a590ce873e056d34cb658b6fb5739408937b104 Mon Sep 17 00:00:00 2001
From: Geraldo Nascimento <geraldogabriel@gmail.com>
Date: Tue, 16 Jun 2026 12:26:10 -0300
Subject: [PATCH 1527/1982] PCI: rockchip: Drive at 2.5 GT/s, error other
 speeds

[ Upstream commit 84d08ff902f1ec01177fef1a21a38934927f5aee ]

Configure the core to be driven at 2.5 GT/s Link Speed and ignore any other
speed with a warning. Also drop the 5.0 GT/s Link Speed defines from
Rockchip PCIe header.

The reason is that Shawn Lin from Rockchip has reiterated that there may be
danger of "catastrophic failure" in using their PCIe with 5.0 GT/s speeds.

While Rockchip has done so informally without issuing a proper errata, and
the particulars are thus unknown, this may cause data loss or worse.

This change is corroborated by RK3399 official datasheet [1], which states
maximum link speed for this platform is 2.5 GT/s.

[1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf

Fixes: 956cd99b35a8 ("PCI: rockchip: Separate common code from RC driver")
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/7421df7a7b7778ee99363cccfdfabbfa8aa6ab5e.1781622998.git.geraldogabriel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-rockchip.c | 14 ++++++--------
 drivers/pci/controller/pcie-rockchip.h |  3 ---
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
index 0f88da3788054e..456dcfd676ed77 100644
--- a/drivers/pci/controller/pcie-rockchip.c
+++ b/drivers/pci/controller/pcie-rockchip.c
@@ -66,8 +66,10 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
 	}
 
 	rockchip->link_gen = of_pci_get_max_link_speed(node);
-	if (rockchip->link_gen < 0 || rockchip->link_gen > 2)
-		rockchip->link_gen = 2;
+	if (rockchip->link_gen < 0 || rockchip->link_gen >= 2) {
+		rockchip->link_gen = 1;
+		dev_warn(dev, "invalid max-link-speed, limited to 2.5 GT/s\n");
+	}
 
 	for (i = 0; i < ROCKCHIP_NUM_PM_RSTS; i++)
 		rockchip->pm_rsts[i].id = rockchip_pci_pm_rsts[i];
@@ -147,12 +149,8 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
 		goto err_exit_phy;
 	}
 
-	if (rockchip->link_gen == 2)
-		rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_2,
-				    PCIE_CLIENT_CONFIG);
-	else
-		rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
-				    PCIE_CLIENT_CONFIG);
+	rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_1,
+			    PCIE_CLIENT_CONFIG);
 
 	regs = PCIE_CLIENT_ARI_ENABLE |
 	       PCIE_CLIENT_CONF_LANE_NUM(rockchip->lanes);
diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h
index 3e82a69b9c006e..b5da15601b5854 100644
--- a/drivers/pci/controller/pcie-rockchip.h
+++ b/drivers/pci/controller/pcie-rockchip.h
@@ -42,7 +42,6 @@
 #define   PCIE_CLIENT_MODE_RC			HWORD_SET_BIT(0x0040)
 #define   PCIE_CLIENT_MODE_EP			HWORD_CLR_BIT(0x0040)
 #define   PCIE_CLIENT_GEN_SEL_1			HWORD_CLR_BIT(0x0080)
-#define   PCIE_CLIENT_GEN_SEL_2			HWORD_SET_BIT(0x0080)
 #define PCIE_CLIENT_LEGACY_INT_CTRL	(PCIE_CLIENT_BASE + 0x0c)
 #define   PCIE_CLIENT_INT_IN_ASSERT		HWORD_SET_BIT(0x0002)
 #define   PCIE_CLIENT_INT_IN_DEASSERT		HWORD_CLR_BIT(0x0002)
@@ -197,8 +196,6 @@
 	(((x) & PCIE_CORE_PL_CONF_LS_MASK) == PCIE_CORE_PL_CONF_LS_READY)
 #define PCIE_LINK_UP(x) \
 	(((x) & PCIE_CLIENT_LINK_STATUS_MASK) == PCIE_CLIENT_LINK_STATUS_UP)
-#define PCIE_LINK_IS_GEN2(x) \
-	(((x) & PCIE_CORE_PL_CONF_SPEED_MASK) == PCIE_CORE_PL_CONF_SPEED_5G)
 
 #define RC_REGION_0_ADDR_TRANS_H		0x00000000
 #define RC_REGION_0_ADDR_TRANS_L		0x00000000

From 35acdbaaddd2e69882edea445122e484b59a2c1e Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sun, 27 Sep 2026 21:13:59 +0200
Subject: [PATCH 1528/1982] sh: intc: Sort the prio and sense lists after
 filling them

[ Upstream commit 94a219eda3b5fb1d1753a5ecf28b171c8f308a27 ]

register_intc_controller() sorts d->prio and d->sense right after
allocating them, with hw->nr_prio_regs and hw->nr_sense_regs as the
element count. The lists hold hw->nr_vectors entries and are only
filled later, by intc_register_irq().

On SH7785, sh7785-irq0123 and sh7785-irq4567 have four vectors but the
SoC's eleven priority registers, so sort() swaps 88 bytes in a 32 byte
kmalloc object at boot. slub_debug=FZPU reports "Right Redzone
overwritten" in kmalloc-32, and v6.5 and v6.6 panic in
__kmem_cache_alloc_node() while registering sh7785-irq0123.

Found with a custom QEMU model of the SH7785LCR. On it, v6.4
sh7785lcr_defconfig boots with SLAB, the defconfig default before v6.5,
and hangs before the console is up when built with SLUB.

Sort the lists once all vectors are registered, with the number of
entries that were added.

Fixes: b59f9f9775e6 ("sh: intc: optimize intc IRQ lookup")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/sh/intc/core.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 3dde703b776684..137a7a94d9cb80 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -277,9 +277,6 @@ int __init register_intc_controller(struct intc_desc *desc)
 			k += save_reg(d, k, hw->prio_regs[i].set_reg, smp);
 			k += save_reg(d, k, hw->prio_regs[i].clr_reg, smp);
 		}
-
-		sort(d->prio, hw->nr_prio_regs, sizeof(*d->prio),
-		     intc_handle_int_cmp, NULL);
 	}
 
 	if (hw->sense_regs) {
@@ -290,9 +287,6 @@ int __init register_intc_controller(struct intc_desc *desc)
 
 		for (i = 0; i < hw->nr_sense_regs; i++)
 			k += save_reg(d, k, hw->sense_regs[i].reg, 0);
-
-		sort(d->sense, hw->nr_sense_regs, sizeof(*d->sense),
-		     intc_handle_int_cmp, NULL);
 	}
 
 	if (hw->subgroups)
@@ -360,6 +354,11 @@ int __init register_intc_controller(struct intc_desc *desc)
 		}
 	}
 
+	sort(d->prio, d->nr_prio, sizeof(*d->prio),
+	     intc_handle_int_cmp, NULL);
+	sort(d->sense, d->nr_sense, sizeof(*d->sense),
+	     intc_handle_int_cmp, NULL);
+
 	intc_subgroup_init(desc, d);
 
 	/* enable bits matching force_enable after registering irqs */

From d16d2bb0141cd141321ef559024812b5e665b2b8 Mon Sep 17 00:00:00 2001
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Date: Mon, 12 Oct 2026 11:03:15 +0800
Subject: [PATCH 1529/1982] f2fs: remove mappedtodisk flag usage in mmap write
 path

[ Upstream commit b3c9843589257631bac18f30655e82d88970688a ]

PG_mappedtodisk was inherited from the nobh/buffer-head era.  However,
f2fs has no buffer heads and the flag is no longer meaningful.  The only
user of the flag is the "no holes" shortcut in f2fs_vm_page_mkwrite(),
which makes mmap write faults skip marking the folio dirty.  Moreover,
it causes the following race condition with filesystem freezing:

 CPU0 (write fault)     CPU1 (freeze_super)
 ----                   ----
 f2fs_vm_page_mkwrite()
 sb_start_pagefault()
 /* shortcut: no dirty */
 sb_end_pagefault()

                        sb_wait_write(SB_FREEZE_PAGEFAULT)
                        /* no waiter, passes */
                        sync_filesystem()
                        /* folio not dirty, skipped */

 finish_fault()
 /* PTE writable */
 fault_dirty_shared_page()
 folio_mark_dirty()
 /* dirty folio on a frozen fs */

It will also skip APP_MAPPED_IO iostat/REQ_TIME updates and post-EOF
folio zeroing.

Remove this shortcut in f2fs_vm_page_mkwrite() and stop setting it in
f2fs_read_single_page().

Reported-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/linux-f2fs-devel/496b913c-eb81-4fa8-be72-c6a06a10aba2@kernel.org/
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 1 -
 fs/f2fs/file.c | 6 ------
 2 files changed, 7 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index aa6a844ed34dd7..52bdfb2785f065 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2186,7 +2186,6 @@ static int f2fs_read_single_page(struct inode *inode, struct folio *folio,
 got_it:
 	if ((map->m_flags & F2FS_MAP_MAPPED)) {
 		block_nr = map->m_pblk + block_in_file - map->m_lblk;
-		folio_set_mappedtodisk(folio);
 
 		if (!f2fs_is_valid_blkaddr(F2FS_I_SB(inode), block_nr,
 						DATA_GENERIC_ENHANCE_READ)) {
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 49febaa6608150..e5de7c35572608 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -207,12 +207,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	/* wait for GCed page writeback via META_MAPPING */
 	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
 
-	/*
-	 * check to see if the page is mapped already (no holes)
-	 */
-	if (folio_test_mappedtodisk(folio))
-		goto out_sem;
-
 	/* page is wholly or partially inside EOF */
 	if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
 						i_size_read(inode)) {

From eb9b8c03d260aa76aa868bf9a46ebdc0f6f1efc4 Mon Sep 17 00:00:00 2001
From: Joanne Chang <joannechien@google.com>
Date: Fri, 9 Oct 2026 09:53:31 +0000
Subject: [PATCH 1530/1982] f2fs: allow pinning empty compressed files

[ Upstream commit 2eebc31ae5f53e1066bb6238c8087c23b688ad17 ]

Commit a64a3fec11e7 ("f2fs: force out-place update for all writes on
compressed file") updated f2fs_should_update_outplace() to always
return true for compressed files. However, this function is also
called during f2fs_ioc_set_pin_file() validation, so pinning an
empty file with compression enabled now fails with -EINVAL before the
compression flag can be stripped.

Fix this by guarding the f2fs_compressed_file(inode) check with fio in
f2fs_should_update_outplace(). This preserves forced OPU for actual
compressed writes (fio != NULL), while allowing f2fs_ioc_set_pin_file()
(fio == NULL) to proceed to f2fs_disable_compressed_file(inode).

Cc: stable@kernel.org
Fixes: a64a3fec11e7 ("f2fs: force out-place update for all writes on compressed file")
Assisted-by: LLM
Signed-off-by: Joanne Chang <joannechien@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 52bdfb2785f065..eba1e025b9d6ee 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2679,7 +2679,7 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
 	 * If IO comes from compressed write path and fallback to raw write,
 	 * force out‑place to prevent metadata‑data inconsistency.
 	 */
-	if (f2fs_compressed_file(inode))
+	if (fio && f2fs_compressed_file(inode))
 		return true;
 
 	/* swap file is migrating in aligned write mode */

From eb87db3cdf260f1fd7a420d2cf428ca3d2fde610 Mon Sep 17 00:00:00 2001
From: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Date: Tue, 13 Oct 2026 18:56:28 +0800
Subject: [PATCH 1531/1982] f2fs: read i_size once in f2fs_vm_page_mkwrite

[ Upstream commit c04f209773ecb31e592cababce0d6658ee0b8d58 ]

f2fs_vm_page_mkwrite() reads i_size twice: once to check whether the
folio is partially beyond EOF, and once to calculate the offset for
folio_zero_segment(). But a concurrent buffered write can extend isize
and cause the following race condition to corrupt data:

buffered write writes [0,3500)

CPU0 (write fault)                        CPU1 (buffered write)
 ----                                     ----
 f2fs_vm_page_mkwrite()
 folio_lock(folio)
 if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
 i_size_read(inode))
 /* i_size_read() = 3500 */
                                           write(fd, buf, 200, 4096)
                                           /* writes into page1, does not
                                              wait for folio lock */
                                           i_size_write(inode, 4296)
 offset = i_size_read(inode) & ~PAGE_MASK
 /* i_size_read() = 4296, offset = 200 */
 folio_zero_segment(folio, offset, folio_size(folio))
 /* valid data [200, 3500) is zeroed */

Fix this by reading i_size once and using the same value for both the
EOF check and the zeroing offset.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261012030315.978375-1-zhaonanzhe%40xiaomi.com
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Nanzhe Zhao <zhaonanzhe@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index e5de7c35572608..df625a48d725eb 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -123,6 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 	struct dnode_of_data dn;
 	bool need_alloc = !f2fs_is_pinned_file(inode);
+	loff_t isize;
 	int err = 0;
 	vm_fault_t ret;
 
@@ -177,8 +178,14 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	filemap_invalidate_lock_shared(inode->i_mapping);
 
 	folio_lock(folio);
+	/*
+	 * A concurrent buffered write can extend isize, so we store isize in a
+	 * local variable to let the zeroing offset match the EOF check below.
+	 */
+	isize = i_size_read(inode);
+
 	if (unlikely(folio->mapping != inode->i_mapping ||
-			folio_pos(folio) > i_size_read(inode) ||
+			folio_pos(folio) > isize ||
 			!folio_test_uptodate(folio))) {
 		folio_unlock(folio);
 		err = -EFAULT;
@@ -208,11 +215,10 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
 
 	/* page is wholly or partially inside EOF */
-	if (((loff_t)(folio->index + 1) << PAGE_SHIFT) >
-						i_size_read(inode)) {
+	if (((loff_t)(folio->index + 1) << PAGE_SHIFT) > isize) {
 		loff_t offset;
 
-		offset = i_size_read(inode) & ~PAGE_MASK;
+		offset = isize & ~PAGE_MASK;
 		folio_zero_segment(folio, offset, folio_size(folio));
 	}
 	folio_mark_dirty(folio);

From 7f050459206298020b028243ce3caef3ed9949b6 Mon Sep 17 00:00:00 2001
From: Kaixuan Li <kaixuanli0131@gmail.com>
Date: Sat, 19 Sep 2026 00:55:07 +0800
Subject: [PATCH 1532/1982] f2fs: check every cur_*_segno[] entry on readonly
 images

[ Upstream commit 9c4ee79190c8c23a9fb5c07d3bc87eaac514b2bb ]

sanity_check_ckpt() bounds-checks cur_node_segno[] and cur_data_segno[]
against main_segs, but on an image with the RO feature the goto that skips
the duplicate-segno cross-checks also leaves the enclosing loop, so only
index 0 of each array is ever checked.

An unchecked index reaches __set_sit_entry_type() through build_curseg() ->
reset_curseg(), which writes se->type through &sit_i->sentries[segno]. With
segment_count_main 120 and cur_data_segno[1] set to 200, KASAN reports
three out-of-bounds writes during mount and the mount then succeeds.

Use continue so every index is bounds-checked, and skip the node-vs-data
cross-check explicitly, which is the other thing the old goto skipped.

Cc: stable@kernel.org
Fixes: a7d9fe3c3388 ("f2fs: support RO feature")
Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 146bd977bb591c..11d218b415b0d3 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4180,7 +4180,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
 			return 1;
 
 		if (f2fs_sb_has_readonly(sbi))
-			goto check_data;
+			continue;
 
 		for (j = i + 1; j < NR_CURSEG_NODE_TYPE; j++) {
 			if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
@@ -4192,14 +4192,14 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
 			}
 		}
 	}
-check_data:
+
 	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
 		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
 			le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
 			return 1;
 
 		if (f2fs_sb_has_readonly(sbi))
-			goto skip_cross;
+			continue;
 
 		for (j = i + 1; j < NR_CURSEG_DATA_TYPE; j++) {
 			if (le32_to_cpu(ckpt->cur_data_segno[i]) ==
@@ -4211,6 +4211,9 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
 			}
 		}
 	}
+	if (f2fs_sb_has_readonly(sbi))
+		goto skip_cross;
+
 	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
 		for (j = 0; j < NR_CURSEG_DATA_TYPE; j++) {
 			if (le32_to_cpu(ckpt->cur_node_segno[i]) ==

From 16cb21f3f99296c2c93da11158d2c6a3577ba370 Mon Sep 17 00:00:00 2001
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
Date: Mon, 5 Oct 2026 23:49:54 +0800
Subject: [PATCH 1533/1982] f2fs: fix defragment writeback range truncation on
 32-bit

[ Upstream commit 92154fe28c3701bebf75176dc5522bec62519a8f ]

f2fs_defragment_range() flushes the range it is about to defragment:

	filemap_write_and_wait_range(inode->i_mapping,
				pg_start << PAGE_SHIFT,
				(pg_end << PAGE_SHIFT) - 1);

pg_start and pg_end are pgoff_t, 32 bits on 32-bit kernels, so both
shifts are evaluated in 32 bits and truncated before they are widened to
the loff_t parameters.  pg_end is only capped by the file's page count,
so for a file larger than 4 GiB the shift wraps.

For a 5 GiB file pg_end is 1310720 and the range collapses from
[0, 5 GiB) to [0, 1 GiB), leaving the rest of the dirty pages unwritten
before the blocks are moved.  For 8 GiB the shift yields 0, the minus one
makes it (loff_t)-1, and the range becomes [0, LLONG_MAX].

The matching call in f2fs_collapse_range() already casts:

	filemap_write_and_wait_range(inode->i_mapping,
				(loff_t)index << PAGE_SHIFT,
				((loff_t)pg_end << PAGE_SHIFT) - 1);

Do the same here.  On i386 the shift changes from "shl $0xc,%ecx" to
"shld", i.e. from a 32-bit shift to a double-precision one.

Cc: stable@kernel.org
Fixes: d323d005ac4a ("f2fs: support file defragment")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index df625a48d725eb..86f1f734caaac4 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2988,8 +2988,8 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
 
 	/* writeback all dirty pages in the range */
 	err = filemap_write_and_wait_range(inode->i_mapping,
-						pg_start << PAGE_SHIFT,
-						(pg_end << PAGE_SHIFT) - 1);
+						(loff_t)pg_start << PAGE_SHIFT,
+						((loff_t)pg_end << PAGE_SHIFT) - 1);
 	if (err)
 		goto out;
 

From 5e93214d8ccbf8fd0e955faf4f4070df1f4175e8 Mon Sep 17 00:00:00 2001
From: Daeho Jeong <daehojeong@google.com>
Date: Sat, 10 Oct 2026 02:41:33 +0000
Subject: [PATCH 1534/1982] f2fs: disallow mmap write and data-modifying
 fallocate on atomic files

[ Upstream commit 06dfe4a7eb696d868b196c2a49873142f19bd862 ]

Stores through a shared writable mapping and fallocate with
FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
the COW inode and modify the original inode directly. Reject them while
the file is in atomic write mode, as fallocate already does for pinned
and compressed files. A write fault gets SIGBUS and fallocate gets
-EOPNOTSUPP.

fallocate without these flags only preallocates blocks and stays
allowed.

f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
invalidate_lock, and hold invalidate_lock in
f2fs_ioc_start_atomic_write() from the flush until the flag is set.
Otherwise a fault could check the flag, then start_atomic_write could
flush and set the flag, and the fault would dirty the folio afterwards.

Cc: stable@kernel.org
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 86f1f734caaac4..8211ee75fb8f7b 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -177,6 +177,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	file_update_time(vmf->vma->vm_file);
 	filemap_invalidate_lock_shared(inode->i_mapping);
 
+	/*
+	 * mmap stores bypass the COW inode and would break atomicity. Check
+	 * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
+	 * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
+	 * our dirty folio and writes it back, or we see the flag.
+	 */
+	if (unlikely(f2fs_is_atomic_file(inode))) {
+		err = -EOPNOTSUPP;
+		goto out_sem;
+	}
+
 	folio_lock(folio);
 	/*
 	 * A concurrent buffered write can extend isize, so we store isize in a
@@ -2081,9 +2092,11 @@ static long f2fs_fallocate(struct file *file, int mode,
 
 	/*
 	 * Pinned file should not support partial truncation since the block
-	 * can be used by applications.
+	 * can be used by applications. Atomic files should not either, since
+	 * these modify the original inode directly and break atomicity.
 	 */
-	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
+	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
+	     f2fs_is_atomic_file(inode)) &&
 		(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
 			FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
 		ret = -EOPNOTSUPP;
@@ -2368,6 +2381,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 
 	f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
 	f2fs_down_write(&fi->i_gc_rwsem[READ]);
+	/* serialize with f2fs_vm_page_mkwrite(), see the comment there */
+	filemap_invalidate_lock(inode->i_mapping);
 
 	/*
 	 * Should wait end_io to count F2FS_WB_CP_DATA correctly by
@@ -2423,6 +2438,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 	f2fs_i_size_write(fi->cow_inode, isize);
 
 out_unlock:
+	filemap_invalidate_unlock(inode->i_mapping);
 	f2fs_up_write(&fi->i_gc_rwsem[READ]);
 	f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
 	if (ret)

From 3c50eeaf05d5065b0970c1db0c1862a987a6445a Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Tue, 13 Oct 2026 11:17:17 +0800
Subject: [PATCH 1535/1982] spi: ljca: validate the response length before
 copying the data

[ Upstream commit 0fe4573c822c4c9152e2fd5269ab85410c9e458f ]

ljca_spi_read_write() only checks that the response from the adapter
carries the packet header and a non-zero payload length before copying
r_packet->len bytes from the response into the transfer buffer.

The payload length is taken from the packet the device sent back and is
neither bounded by the number of bytes actually received nor by the
size of the requested transfer: a misbehaving adapter can announce a
payload larger than what it actually sent, and the memcpy then reads
past the end of the 60-byte input buffer and writes past the end of the
caller's transfer buffer.

Check that the response carries the full header before reading
r_packet->len, then reject responses whose payload is not contained in
the data received or is longer than the requested transfer.

Fixes: caee8e38da67 ("spi: Add support for Intel LJCA USB SPI driver")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013031717.3933277-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ljca.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-ljca.c b/drivers/spi/spi-ljca.c
index 3f412cf8f1cd97..1b745a55d8c8a6 100644
--- a/drivers/spi/spi-ljca.c
+++ b/drivers/spi/spi-ljca.c
@@ -105,7 +105,12 @@ static int ljca_spi_read_write(struct ljca_spi_dev *ljca_spi, const u8 *w_data,
 			    (u8 *)r_packet, LJCA_SPI_BUF_SIZE);
 	if (ret < 0)
 		return ret;
-	else if (ret < sizeof(*r_packet) || r_packet->len <= 0)
+
+	if (ret < sizeof(*r_packet))
+		return -EIO;
+
+	if (!r_packet->len || ret < sizeof(*r_packet) + r_packet->len ||
+	    r_packet->len > len)
 		return -EIO;
 
 	if (r_data)

From 91ff04f52138627b9bf0b8d402e810003ce4221b Mon Sep 17 00:00:00 2001
From: Arpith Alexander <arpith99@gmail.com>
Date: Tue, 3 Nov 2026 18:44:35 +0530
Subject: [PATCH 1536/1982] spi: ljca: Don't require data in write replies

[ Upstream commit 5072a9fae45a043cad80f74f4f19fc98803630ab ]

Commit 0fe4573c822c ("spi: ljca: validate the response length before
copying the data") made ljca_spi_read_write() reject any response whose
payload, as announced by r_packet->len, is not contained in the data
received.

That is right for reads, but the adapter acknowledges a write with only
the packet header: r_packet->len holds the number of bytes written and
no payload follows. The reply is 2 bytes long, so
"ret < sizeof(*r_packet) + r_packet->len" is true and every write fails
with -EIO.

Where the Intel Visual Sensing Controller (IVSC) is connected through
the LJCA, as on the Dell XPS 13 9340, its initialisation fails and the
camera behind it is lost:

  spi_ljca usb_ljca.ljca-spi.0: transfer failed len: 256
  vsc-tp spi-INTC10D0:00: SPI transfer failed: -5
  intel_vsc intel_vsc: error -ENODEV: init hw failed

Only require the payload to be present when there is a receive buffer
to copy it into. Write acks are still checked for a non-zero length that
does not exceed the request.

Fixes: 0fe4573c822c ("spi: ljca: validate the response length before copying the data")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Arpith Alexander <arpith99@gmail.com>
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Link: https://patch.msgid.link/20261103131435.21838-1-arpith99@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ljca.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-ljca.c b/drivers/spi/spi-ljca.c
index 1b745a55d8c8a6..0bc85899331127 100644
--- a/drivers/spi/spi-ljca.c
+++ b/drivers/spi/spi-ljca.c
@@ -109,8 +109,9 @@ static int ljca_spi_read_write(struct ljca_spi_dev *ljca_spi, const u8 *w_data,
 	if (ret < sizeof(*r_packet))
 		return -EIO;
 
-	if (!r_packet->len || ret < sizeof(*r_packet) + r_packet->len ||
-	    r_packet->len > len)
+	/* write acks carry no payload */
+	if (!r_packet->len || r_packet->len > len ||
+	    (r_data && ret < sizeof(*r_packet) + r_packet->len))
 		return -EIO;
 
 	if (r_data)

From 58e931c3b18e73fb98d8a53187cb7fb907d46d59 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Sun, 11 Oct 2026 14:17:22 +0800
Subject: [PATCH 1537/1982] pinctrl: stm32: Fix fwnode reference leak in
 stm32_gpiolib_register_bank()

[ Upstream commit 54c66b5e47a9b10cbf4a1efe9b01301b7ffee205 ]

stm32_gpiolib_register_bank() walks the "gpio-ranges" property with
fwnode_property_get_reference_args().  As documented in
drivers/base/property.c:

 * The caller is responsible for calling fwnode_handle_put() on the
 * returned @args->fwnode pointer.

The returned reference is never put.  The function calls the helper
twice, once directly and then repeatedly in a while loop, and each
call overwrites args, so only the last reference is even reachable
and all the earlier ones are leaked for good.

Put the reference as soon as args.args[] has been consumed, both for
the initial call and for every iteration of the loop.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: bb949ed9b16b ("pinctrl: stm32: Switch to use for_each_gpiochip_node() helper")
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index e73feb8ac90d16..f64dbb29a99dc4 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1452,8 +1452,12 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
 
 		/* get the last defined gpio line (offset + nb of pins) */
 		npins = args.args[0] + args.args[2];
-		while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args))
+		fwnode_handle_put(args.fwnode);
+
+		while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) {
 			npins = max(npins, (int)(args.args[0] + args.args[2]));
+			fwnode_handle_put(args.fwnode);
+		}
 	} else {
 		bank_nr = pctl->nbanks;
 		bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;

From da262f1e8a4dce4edebc00ca72523d8dea2ed630 Mon Sep 17 00:00:00 2001
From: Matt Turner <mattst88@gmail.com>
Date: Sat, 12 Sep 2026 14:17:35 -0400
Subject: [PATCH 1538/1982] lib/decompress_bunzip2: fix off-by-one in
 run-length bounds check

[ Upstream commit 69919be2b93ef3922f646729ff42b4bd9a30846b ]

The run-length path rejects a block when dbufCount+t equals dbufSize, but
the loop that follows writes exactly t bytes starting at dbufCount, so a
block that fills the buffer exactly is legal.  bzip2 allows it too: its
decompressor bounds a block at 100000 * blockSize100k and checks that
limit per byte appended.  Use > instead of >=.

bzip2's encoder stops filling a block 19 bytes early, so nothing it
produces ever reaches the limit and the bug stays hidden.  Compressors
that use the full block size do reach it: an lbzip2 -9 image whose block
ends on a run fails to decode, and a self-extracting kernel built that way
does not boot.

This code came from busybox, which fixed the same line in 2013 in commit
932e233a491b ("bunzip2: fix off-by-one check").

I ran into this because my system uses lbzip2 as /bin/bzip2 -- a common
thing on Gentoo I believe.  As far as I can tell, anyone using lbzip2
as their system bzip2 would run into this and it's only because it's
very uncommon these days to compress a kernel with bzip2 that no one
has noticed.  I only noticed because I was adding support for various
compression formats on alpha.

Link: https://lore.kernel.org/20260912-b4-bunzip2-blocksize-fix-v1-1-c7384bbfc954@gmail.com
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/decompress_bunzip2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index ca736166f10009..4f98cdea7e0b30 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -439,7 +439,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
 		   array.) */
 		if (runPos) {
 			runPos = 0;
-			if (dbufCount+t >= dbufSize)
+			if (dbufCount+t > dbufSize)
 				return RETVAL_DATA_ERROR;
 
 			uc = symToByte[mtfSymbol[0]];

From 0c30c5acdfd98ae3741c1d5daf26abb6ea504f13 Mon Sep 17 00:00:00 2001
From: Bradley Morgan <brads@mainlining.org>
Date: Wed, 16 Sep 2026 18:29:53 +0000
Subject: [PATCH 1539/1982] panic: flatten nmi_panic control flow

[ Upstream commit 75eb687ff2bcec9fba31bbe266e5f91e5c283efe ]

panic() is __noreturn, so the else after panic_try_start() is dead.  Drop
it so the force_cpu path can be added cleanly on top.

Link: https://lore.kernel.org/20260916182957.7788-3-brads@mainlining.org
Signed-off-by: Bradley Morgan <brads@mainlining.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Guenetr Roeck <linux@roeck-us.net>
Cc: Sashiko <sashiko-bot@kernel.org>
Cc: Wang Jinchao <wangjinchao600@gmail.com>
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/panic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/panic.c b/kernel/panic.c
index b13f040680ac1c..7f8725f2154b86 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -364,7 +364,8 @@ void nmi_panic(struct pt_regs *regs, const char *msg)
 {
 	if (panic_try_start())
 		panic("%s", msg);
-	else if (panic_on_other_cpu())
+
+	if (panic_on_other_cpu())
 		nmi_panic_self_stop(regs);
 }
 EXPORT_SYMBOL(nmi_panic);

From 664ef42230020ddb24cf6e4e791de9e70119ca17 Mon Sep 17 00:00:00 2001
From: Aamir Ahmed <elb12345@hotmail.co.uk>
Date: Wed, 16 Sep 2026 09:53:51 +0100
Subject: [PATCH 1540/1982] lib: decompress_bunzip2: fix integer overflow in
 run-length decoding

[ Upstream commit b822ad8d702df0be9fe3f24f71caeb0522d72319 ]

The RUNA/RUNB decoder in get_next_block() accumulates a run length into
the signed int t with no bound.  runPos doubles per symbol, so t grows as
at least 2^n-1 and reaches INT_MAX after 31 RUNA symbols.  The guard that
follows, dbufCount+t >= dbufSize, is itself a signed addition, and as the
kernel builds with -fno-strict-overflow it wraps negative once dbufCount
is nonzero, so the guard is skipped.  while (t--) dbuf[dbufCount++] = uc
then writes INT_MAX entries into a buffer holding at most 900000.  One
literal symbol ahead of the run is enough to make dbufCount nonzero.

Bound t to the block size as it is accumulated.  t only grows within a
run, so the value tested never exceeds the final run length; any stream
that decodes today satisfies dbufCount+t < dbufSize at the flush, hence t
< dbufSize throughout, and no such stream is rejected.  Because t grows as
at least 2^n-1 the bound trips by the 20th symbol, leaving runPos at most
2^19, so the following runPos <<= 1 cannot overflow either.

Link: https://lore.kernel.org/AS8P251MB00010FE5E38D253CF98A652AC8B92@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Alain Knaff <alain@knaff.lu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/decompress_bunzip2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 4f98cdea7e0b30..b8fb40ed06d22f 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -428,6 +428,10 @@ static int INIT get_next_block(struct bunzip_data *bd)
 			t += (runPos << nextSym);
 			/* +runPos if RUNA; +2*runPos if RUNB */
 
+			/* Bound the run so t and runPos cannot overflow. */
+			if (t >= dbufSize)
+				return RETVAL_DATA_ERROR;
+
 			runPos <<= 1;
 			continue;
 		}

From 075a08d5160c13571160c56aebaffb0a8ece7f36 Mon Sep 17 00:00:00 2001
From: Kazuki Hanai <hnkz.64@gmail.com>
Date: Fri, 2 Oct 2026 17:13:03 +0900
Subject: [PATCH 1541/1982] tmpfs: fix unicode_map leaks in casefold option
 handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f439d79e8cd19f89e04cbb3b532347edacd72c79 ]

shmem_parse_opt_casefold() stores the unicode_map returned by utf8_load()
in ctx->encoding.  A filesystem context can receive the casefold parameter
more than once, and a second successful parse overwrites the stored map
without releasing it.

The map is also leaked when an unmounted filesystem context is freed.
This includes the temporary context used for remount, because
shmem_reconfigure() does not take ownership of ctx->encoding.

Reject a second casefold setting, clear ctx->encoding after transferring
ownership to the superblock, and release any remaining map from
shmem_free_fc().

An unprivileged user can repeatedly create tmpfs filesystem contexts, set
the casefold parameter, and close them from a user namespace.  This causes
unbounded kernel memory consumption and can result in a local denial of
service.

Link: https://lore.kernel.org/20261002081306.637148-1-hnkz.64@gmail.com
Fixes: 58e55efd6c72 ("tmpfs: Add casefold lookup support")
Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Gabriel Krisman Bertazi <gabriel@krisman.be>
Cc: Hugh Dickins <hughd@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: André Almeida <andrealmeid@igalia.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/shmem.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mm/shmem.c b/mm/shmem.c
index f2b5a11e88a557..68a3a0734e3df3 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4595,6 +4595,9 @@ static int shmem_parse_opt_casefold(struct fs_context *fc, struct fs_parameter *
 	struct unicode_map *encoding;
 	char *version_str = param->string + 5;
 
+	if (ctx->encoding)
+		return invalfc(fc, "casefold parameter cannot be specified twice\n");
+
 	if (!latest_version) {
 		if (strncmp(param->string, "utf8-", 5))
 			return invalfc(fc, "Only UTF-8 encodings are supported "
@@ -5081,6 +5084,7 @@ static int shmem_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	if (ctx->encoding) {
 		sb->s_encoding = ctx->encoding;
+		ctx->encoding = NULL;
 		set_default_d_op(sb, &shmem_ci_dentry_ops);
 		if (ctx->strict_encoding)
 			sb->s_encoding_flags = SB_ENC_STRICT_MODE_FL;
@@ -5177,6 +5181,9 @@ static void shmem_free_fc(struct fs_context *fc)
 	struct shmem_options *ctx = fc->fs_private;
 
 	if (ctx) {
+#if IS_ENABLED(CONFIG_UNICODE)
+		utf8_unload(ctx->encoding);
+#endif
 		mpol_put(ctx->mpol);
 		kfree(ctx);
 	}

From 3648e9257696c8af3b4421c3d3496f5f63053e0e Mon Sep 17 00:00:00 2001
From: Gergo Koteles <soyer@irl.hu>
Date: Tue, 13 Oct 2026 15:02:21 +0200
Subject: [PATCH 1542/1982] ALSA: hda/tas2781: Skip invalid TAS2563 UEFI
 calibration data

[ Upstream commit a0f0325e92e505db6a6879d79da5aa88e94a36ab ]

Some Lenovo 14ARB7 laptops do not have proper calibration data.

Skip these zero calibration values and fall back to the calibration data
provided by the DSP firmware.

Tested-by: Georg Wenzel <g.wenzel@gmail.com>
Fixes: c3ca4458cc2f ("ALSA: hda/tas2781: add TAS2563 support for 14ARB7")
Cc: stable@vger.kernel.org # 6.18
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Tested-by: Philipp Oster <philippdev5396@outlook.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/12a1ab265a1dc0e3a062a54287c8ef48682c4efc.1791895478.git.soyer@irl.hu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
index ebfc08b5fb283c..6eb9e4b8ba2e8d 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
@@ -375,6 +375,11 @@ static int tas2563_save_calibration(struct tas2781_hda *h)
 					i, j, status);
 				return -EINVAL;
 			}
+			if (*(uint32_t *)&data[offset] == 0) {
+				dev_warn(p->dev,
+					 "Dev %d: Caldat[%d] is zero\n", i, j);
+				return -EINVAL;
+			}
 			bedata = cpu_to_be32(*(uint32_t *)&data[offset]);
 			memcpy(&data[offset], &bedata, sizeof(bedata));
 			offset += TAS2563_CAL_DATA_SIZE;

From 149024365092678754e10d447494894aaa5c4d2d Mon Sep 17 00:00:00 2001
From: Aaron Erhardt <aer@tuxedocomputers.com>
Date: Wed, 7 Oct 2026 10:01:50 +0200
Subject: [PATCH 1543/1982] platform/x86/tuxedo: Fix keyboard LED map ordering
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 5c9c54dfa28c9a47c9d81322d16585f9a64d4c69 ]

The LED mappings in sirius_16_[iso|ansii]_kbl_map did contain a
flipped line that caused LEDs to turn on in the wrong order when
counting up the Lamp ID.

Fixes: cfd84b3f419b ("platform/x86/tuxedo: Add virtual LampArray for TUXEDO NB04 devices")
Cc: stable@vger.kernel.org
Reviewed-by: Werner Sembach <wse@tuxedocomputers.com>
Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
Link: https://patch.msgid.link/20261007080202.81694-5-aer@tuxedocomputers.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/tuxedo/nb04/wmi_ab.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
index 32d7756022c266..38a719381fdc5b 100644
--- a/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
+++ b/drivers/platform/x86/tuxedo/nb04/wmi_ab.c
@@ -232,8 +232,8 @@ static const struct tux_kbl_map_entry_t sirius_16_ansii_kbl_map[] = {
 	{ 0x2e, { 246000,  67500, 5250 } },
 	{ 0x2a, { 269500,  67500, 5250 } },
 	{ 0x53, { 294500,  67500, 5250 } },
-	{ 0x55, { 311200,  67500, 5250 } },
-	{ 0x54, { 327900,  67500, 5250 } },
+	{ 0x54, { 311200,  67500, 5250 } },
+	{ 0x55, { 327900,  67500, 5250 } },
 	{ 0x56, { 344600,  67500, 5250 } },
 	{ 0x2b, {  31000,  85500, 5500 } },
 	{ 0x14, {  51500,  85500, 5500 } },
@@ -337,8 +337,8 @@ static const struct tux_kbl_map_entry_t sirius_16_iso_kbl_map[] = {
 	{ 0x2e, { 246000,  67500, 5250 } },
 	{ 0x2a, { 269500,  67500, 5250 } },
 	{ 0x53, { 294500,  67500, 5250 } },
-	{ 0x55, { 311200,  67500, 5250 } },
-	{ 0x54, { 327900,  67500, 5250 } },
+	{ 0x54, { 311200,  67500, 5250 } },
+	{ 0x55, { 327900,  67500, 5250 } },
 	{ 0x56, { 344600,  67500, 5250 } },
 	{ 0x2b, {  31000,  85500, 5500 } },
 	{ 0x14, {  51500,  85500, 5500 } },

From 15e36dc9be7b6050045de4b44ab518f3eec8ad3d Mon Sep 17 00:00:00 2001
From: Denis Arefev <arefev@swemel.ru>
Date: Wed, 14 Oct 2026 13:26:18 +0300
Subject: [PATCH 1544/1982] ALSA: cs46xx: fix unit mismatch in DSP code area
 bounds check

[ Upstream commit fd65108f5001ffb416dc9bd37ec1893f55cff24a ]

ins->code.offset and code->size are measured in 32-bit words, while
DSP_CODE_BYTE_SIZE is the size of the DSP code area in bytes. The
check ins->code.offset + code->size > DSP_CODE_BYTE_SIZE in
cs46xx_dsp_load_module() therefore allowed up to four times more code
than the code area can hold.

The shadow buffer ins->code.data is allocated with
kmalloc(DSP_CODE_BYTE_SIZE), i.e. it holds DSP_CODE_BYTE_SIZE/4
words. A firmware file with a code segment larger than
DSP_CODE_BYTE_SIZE/4 words (28 KiB) passed the check and caused an
out-of-bounds write in shadow_and_reallocate_code() and an
out-of-bounds read in snd_cs46xx_download().

Compare the sum in words against DSP_CODE_BYTE_SIZE/4 and cast it to
u64 so that the sum cannot wrap for large code->size values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Link: https://patch.msgid.link/20261014102619.16415-1-arefev@swemel.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/cs46xx/dsp_spos.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
index 3d34575a0e8f6c..ba290f3a50e43e 100644
--- a/sound/pci/cs46xx/dsp_spos.c
+++ b/sound/pci/cs46xx/dsp_spos.c
@@ -395,7 +395,7 @@ int cs46xx_dsp_load_module (struct snd_cs46xx * chip, struct dsp_module_desc * m
 		dev_dbg(chip->card->dev,
 			"dsp_spos: module got no code segment\n");
 	} else {
-		if (ins->code.offset + code->size > DSP_CODE_BYTE_SIZE) {
+		if ((u64)ins->code.offset + code->size > DSP_CODE_BYTE_SIZE / 4) {
 			dev_err(chip->card->dev,
 				"dsp_spos: no space available in DSP\n");
 			return -ENOMEM;

From e7e97446125b7990055a60fe3584996f7579d75c Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 7 Oct 2026 18:47:03 +0500
Subject: [PATCH 1545/1982] platform/x86: hp-bioscfg: fix OOB reads in
 hp_get_string_from_buffer()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 176b38b84ae5e075850b3ebb25f906d66f95a46d ]

The escape prescan loop uses 'size' as both its bound and its
accumulator, so each escape character found extends the loop and
reads past the end of src[].

Use the original u16 count as the loop bound. Also include the 2-byte
length prefix in the bounds check, pass the u16 count instead of the
byte count to utf16s_to_utf8s(), and advance the buffer by the bytes
actually consumed instead of the escape-inflated count.

Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).

Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-2-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 26 +++++++++++---------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index f665af1c118508..288f7ac01dacc2 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -54,8 +54,8 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
 int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
 {
 	u16 *src = (u16 *)*buffer;
+	u16 orig_size;
 	u16 src_size;
-
 	u16 size;
 	int i;
 	int conv_dst_size;
@@ -63,17 +63,21 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
 	if (*buffer_size < sizeof(u16))
 		return -EINVAL;
 
-	src_size = *(src++);
-	/* size value in u16 chars */
-	size = src_size / sizeof(u16);
+	src_size = *src;
 
-	/* Ensure there is enough space remaining to read and convert
-	 * the string
+	/*
+	 * Ensure there is enough space remaining for the length prefix
+	 * just read plus the string data it describes.
 	 */
-	if (*buffer_size < src_size)
+	if (*buffer_size < sizeof(u16) + src_size)
 		return -EINVAL;
 
-	for (i = 0; i < size; i++)
+	src++;
+	/* size value in u16 chars */
+	orig_size = src_size / sizeof(u16);
+	size = orig_size;
+
+	for (i = 0; i < orig_size; i++)
 		if (src[i] == '\\' ||
 		    src[i] == '\r' ||
 		    src[i] == '\n' ||
@@ -91,7 +95,7 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
 	/*
 	 * convert from UTF-16 unicode to ASCII
 	 */
-	utf16s_to_utf8s(src, src_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
+	utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
 	dst[conv_dst_size] = 0;
 
 	for (i = 0; i < conv_dst_size; i++) {
@@ -117,8 +121,8 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
 		src++;
 	}
 
-	*buffer = (u8 *)src;
-	*buffer_size -= size * sizeof(u16);
+	*buffer += sizeof(u16) + src_size;
+	*buffer_size -= sizeof(u16) + src_size;
 
 	return size;
 }

From 341ec94586d093c44bb8fe1974ca8c259d6d651a Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 7 Oct 2026 18:47:04 +0500
Subject: [PATCH 1546/1982] platform/x86: hp-bioscfg: fix non-ASCII truncation
 in hp_get_string_from_buffer()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6b8d2374b32c35efa2a431b3cd2fe346f8917dcc ]

utf16s_to_utf8s() writes into dst, but the loop that follows
overwrites dst from the raw UTF-16 code units with truncating casts,
so any character above U+007F is mangled. For example, U+00E9 is
stored as 0xe9 instead of 0xc3 0xa9.

Convert into a scratch buffer first, then escape '\\', '\r', '\n' and
'\t' into dst with string_escape_mem(). Quotes are not escaped, so the
existing strreplace() still handles them.

Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7).

Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-3-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 62 +++++---------------
 1 file changed, 14 insertions(+), 48 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index 288f7ac01dacc2..0dac3a853dfe2e 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -11,7 +11,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/printk.h>
-#include <linux/string.h>
+#include <linux/string_helpers.h>
 #include <linux/wmi.h>
 #include "bioscfg.h"
 #include "../../firmware_attributes_class.h"
@@ -53,12 +53,12 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer)
 
 int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size)
 {
+	char utf8_buf[MAX_BUFF_SIZE];
 	u16 *src = (u16 *)*buffer;
+	int escaped_len;
 	u16 orig_size;
 	u16 src_size;
-	u16 size;
-	int i;
-	int conv_dst_size;
+	int utf8_len;
 
 	if (*buffer_size < sizeof(u16))
 		return -EINVAL;
@@ -75,56 +75,22 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_
 	src++;
 	/* size value in u16 chars */
 	orig_size = src_size / sizeof(u16);
-	size = orig_size;
-
-	for (i = 0; i < orig_size; i++)
-		if (src[i] == '\\' ||
-		    src[i] == '\r' ||
-		    src[i] == '\n' ||
-		    src[i] == '\t')
-			size++;
 
-	/*
-	 * Conversion is limited to destination string max number of
-	 * bytes.
-	 */
-	conv_dst_size = size;
-	if (size >= dst_size)
-		conv_dst_size = dst_size - 1;
+	utf8_len = utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN,
+				   utf8_buf, sizeof(utf8_buf));
 
-	/*
-	 * convert from UTF-16 unicode to ASCII
-	 */
-	utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size);
-	dst[conv_dst_size] = 0;
-
-	for (i = 0; i < conv_dst_size; i++) {
-		if (*src == '\\' ||
-		    *src == '\r' ||
-		    *src == '\n' ||
-		    *src == '\t') {
-			dst[i++] = '\\';
-			if (i == conv_dst_size)
-				break;
-		}
-
-		if (*src == '\r')
-			dst[i] = 'r';
-		else if (*src == '\n')
-			dst[i] = 'n';
-		else if (*src == '\t')
-			dst[i] = 't';
-		else if (*src == '"')
-			dst[i] = '\'';
-		else
-			dst[i] = *src;
-		src++;
-	}
+	escaped_len = string_escape_mem(utf8_buf, utf8_len, dst, dst_size - 1,
+					ESCAPE_SPACE | ESCAPE_SPECIAL,
+					"\\\r\n\t");
+	if (escaped_len > dst_size - 1)
+		escaped_len = dst_size - 1;
+	dst[escaped_len] = '\0';
+	strreplace(dst, '"', '\'');
 
 	*buffer += sizeof(u16) + src_size;
 	*buffer_size -= sizeof(u16) + src_size;
 
-	return size;
+	return escaped_len;
 }
 
 int hp_get_common_data_from_buffer(u8 **buffer_ptr, u32 *buffer_size,

From 3da998f09826f59a21f75b1ab83ae72df4796074 Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 7 Oct 2026 18:47:05 +0500
Subject: [PATCH 1547/1982] platform/x86: hp-bioscfg: return -E2BIG from
 validate_password_input()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a4f19c589b21e18567d3c0ac7b9294f81e29b1de ]

validate_password_input() returns the positive INVALID_BIOS_AUTH on
rejection. store_password_instance() skips the store on nonzero ret,
but its final "return ret < 0 ? ret : count" treats the positive value
as success, so userspace sees count instead of an error.

Return -E2BIG for an invalid password length.

Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7): writing 999
bytes to current_password returned 999 before this change.

Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-4-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 6b94f90bea07a7..43a2fd0c07db10 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -70,12 +70,13 @@ static int validate_password_input(int instance_id, const char *buf)
 		length--;
 
 	if (length > MAX_PASSWD_SIZE)
-		return INVALID_BIOS_AUTH;
+		return -E2BIG;
 
 	if (password_data->min_password_length > length ||
 	    password_data->max_password_length < length)
-		return INVALID_BIOS_AUTH;
-	return SUCCESS;
+		return -E2BIG;
+
+	return 0;
 }
 
 ATTRIBUTE_N_PROPERTY_SHOW(is_enabled, password);

From b4b1bd4e0c1e73f8bb1185a871002b09107e771c Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 7 Oct 2026 18:47:06 +0500
Subject: [PATCH 1548/1982] platform/x86: hp-bioscfg: allow clearing
 current_password
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit acada379d5c4dd3a86d48fc69802e769eff29f7e ]

The ABI documents echo "" > current_password as the way to end a
session, but validate_password_input() rejects an empty string when
min_password_length is nonzero, so the password stays cached.

Skip the length check for an empty current_password so the write
clears it.

Compile tested only.

Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
Link: https://patch.msgid.link/20261007134711.473857-5-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/x86/hp/hp-bioscfg/passwdobj-attributes.c    | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
index 43a2fd0c07db10..97990191b71f3d 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
@@ -60,7 +60,8 @@ int hp_get_password_instance_for_type(const char *name)
 	return -EINVAL;
 }
 
-static int validate_password_input(int instance_id, const char *buf)
+static int validate_password_input(int instance_id, const char *buf,
+				   bool is_current)
 {
 	int length;
 	struct password_data *password_data = &bioscfg_drv.password_data[instance_id];
@@ -69,6 +70,10 @@ static int validate_password_input(int instance_id, const char *buf)
 	if (length > 0 && buf[length - 1] == '\n')
 		length--;
 
+	/* An empty current_password clears the session password */
+	if (is_current && !length)
+		return 0;
+
 	if (length > MAX_PASSWD_SIZE)
 		return -E2BIG;
 
@@ -97,7 +102,7 @@ static int store_password_instance(struct kobject *kobj, const char *buf,
 		id = get_password_instance_id(kobj);
 
 		if (id >= 0)
-			ret = validate_password_input(id, buf_cp);
+			ret = validate_password_input(id, buf_cp, is_current);
 	}
 
 	if (!ret) {

From c04cd1d0818221f7ee35893fe5524865509b1103 Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <meatuni001@gmail.com>
Date: Wed, 7 Oct 2026 18:47:10 +0500
Subject: [PATCH 1549/1982] platform/x86: hp-bioscfg: NUL-terminate the SPM
 auth token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f2769668959f6411ac69e83080a240f8a8785e05 ]

auth_token_store() copies the token with kmemdup(), which does not NUL
terminate it, but hp_calculate_security_buffer() and
hp_populate_security_buffer() use it as a C string and read past the
allocation.

A lone newline (echo > auth_token) is worse: kmemdup() of 0 bytes
returns ZERO_SIZE_PTR, which passes the NULL checks, so a later
attribute write passes it to strlen().

A userspace replica of the two helpers under ASan reports a heap
buffer overflow in hp_calculate_security_buffer() for the unterminated
token and a fault at address 0x10 for the lone newline, and is clean
with this change.

The token is a string, so copy it with kstrndup(), which always NUL
terminates and allocates at least one byte.

Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20261007134711.473857-9-meatuni001@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
index abf8ce20fe15c6..040964ed50cedb 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
@@ -307,7 +307,7 @@ static ssize_t auth_token_store(struct kobject *kobj,
 		length--;
 
 	/* allocate space and copy current auth token */
-	bioscfg_drv.spm_data.auth_token = kmemdup(buf, length, GFP_KERNEL);
+	bioscfg_drv.spm_data.auth_token = kstrndup(buf, length, GFP_KERNEL);
 	if (!bioscfg_drv.spm_data.auth_token) {
 		ret = -ENOMEM;
 		goto exit_token;

From fb0e78bacda6bd680db554b084b58970a69bfd2b Mon Sep 17 00:00:00 2001
From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Date: Tue, 13 Oct 2026 08:48:49 +0200
Subject: [PATCH 1550/1982] serial: 8250_lpss: do not touch uninitialized line
 in ehl_serial_exit()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3e3ae95a3d84a6028f37a07ab7ad78bb14689f2e ]

lpss8250_probe() calls lpss->board->exit() on its error path. For the
EHL board, that is ehl_serial_exit() and it does:
serial8250_get_port(lpss->data.line)->dma = NULL;

But when lpss8250_dma_setup() or serial8250_register_8250_port() fails,
lpss->data.line was never assigned. As lpss is kzalloc()ed, line is 0
and ehl_serial_exit() clears the dma pointer of an unrelated port --
serial8250_ports[0], i.e. ttyS0, which is often the console.

Initialize lpss->data.line to -1 in probe and skip the clearing in
ehl_serial_exit() if no port was registered.

Fixes: 5318f70da7e8 ("serial: 8250_lpss: Balance reference count for PCI DMA device")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
Cc: stable@kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: linux-serial@vger.kernel.org
Link: https://patch.msgid.link/f389df34aaa538270313ebd4cea75c2baaf46b95.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_lpss.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
index 776ec1ef29d62b..325e587ae2c42f 100644
--- a/drivers/tty/serial/8250/8250_lpss.c
+++ b/drivers/tty/serial/8250/8250_lpss.c
@@ -183,9 +183,8 @@ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
 
 static void ehl_serial_exit(struct lpss8250 *lpss)
 {
-	struct uart_8250_port *up = serial8250_get_port(lpss->data.line);
-
-	up->dma = NULL;
+	if (lpss->data.line >= 0)
+		serial8250_get_port(lpss->data.line)->dma = NULL;
 }
 
 #ifdef CONFIG_SERIAL_8250_DMA
@@ -329,6 +328,8 @@ static int lpss8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		return ret;
 
 	lpss->board = (struct lpss8250_board *)id->driver_data;
+	/* for tests in lpss->board->exit() */
+	lpss->data.line = -1;
 
 	memset(&uart, 0, sizeof(struct uart_8250_port));
 

From 0517d5fa233b15ff6c355ce5f47ec01b70906ec8 Mon Sep 17 00:00:00 2001
From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Date: Tue, 13 Oct 2026 08:48:50 +0200
Subject: [PATCH 1551/1982] serial: 8250_omap: set priv->line before enabling
 the IRQ

[ Upstream commit 8276a44f0a0b68c07b2331cc0058036ac4c4190d ]

omap8250_irq() is requested in omap8250_probe() with IRQ_NOAUTOEN and
enabled only in omap_8250_startup(). The handler obtains the port by
serial8250_get_port(priv->line), but probe stores priv->line only after
serial8250_register_8250_port() returns.

The port becomes visible to userspace already inside
serial8250_register_8250_port() (uart_add_one_port()). So it can be
opened -- and the IRQ enabled -- before probe stores the line. An
interrupt in that window makes the handler call
serial8250_get_port(-ENODEV) and dereference a pointer outside of
serial8250_ports[].

Store the line in omap_8250_startup() before enable_irq(), so the
handler never runs with an unset line. Keep the assignment in probe
too, as remove and the system PM callbacks rely on it even when the
port was never opened.

Fixes: fef4f600319e ("serial: 8250: omap: Fix life cycle issues for interrupt handlers")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/3b3a642f7df2285f49a7bbbe5d1c23fa442c7d94.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_omap.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index c0ffee2516142a..8c48e0a26b3cba 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -727,6 +727,9 @@ static int omap_8250_startup(struct uart_port *port)
 	struct uart_8250_dma *dma = &priv->omap8250_dma;
 	int ret;
 
+	/* ISR and runtime PM need the line; probe sets it only after registration */
+	priv->line = port->line;
+
 #ifdef CONFIG_PM
 	up->capabilities |= UART_CAP_RPM;
 #endif

From 57c22a5b141d9617e0fcd01a08c254df53ee35df Mon Sep 17 00:00:00 2001
From: Nicolai Buchwitz <nb@tipi-net.de>
Date: Sun, 11 Oct 2026 22:23:44 +0200
Subject: [PATCH 1552/1982] serial: amba-pl011: honour delay_rts_before_send
 for every write

[ Upstream commit 8a9750209596be35d109de5aa89623b049855c67 ]

While the driver waits out delay_rts_before_send, another write calls
pl011_start_tx() again. pl011_rs485_tx_start() then switches straight
to SEND, and the data goes out before the delay has passed.

Leave the start to the trigger_start_tx timer while it is pending.

Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261011-fix-pl011-rs485-rts-delay-v1-1-5078e61bc408@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/amba-pl011.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 4b213d0c61336f..3e777e4d13f20c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1355,10 +1355,6 @@ static void pl011_rs485_tx_start(struct uart_amba_port *uap)
 	struct uart_port *port = &uap->port;
 	u32 cr;
 
-	if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
-		uap->rs485_tx_state = SEND;
-		return;
-	}
 	if (uap->rs485_tx_state == WAIT_AFTER_SEND ||
 	    uap->rs485_tx_state == WAIT_AFTER_SEND_DELAY) {
 		hrtimer_try_to_cancel(&uap->trigger_stop_tx);
@@ -1397,6 +1393,10 @@ static void pl011_start_tx(struct uart_port *port)
 
 	if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
 	    uap->rs485_tx_state != SEND) {
+		/* trigger_start_tx starts TX once delay_rts_before_send passed */
+		if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+			return;
+
 		pl011_rs485_tx_start(uap);
 		if (uap->rs485_tx_state == WAIT_AFTER_RTS)
 			return;
@@ -1413,8 +1413,10 @@ static enum hrtimer_restart pl011_trigger_start_tx(struct hrtimer *t)
 	unsigned long flags;
 
 	uart_port_lock_irqsave(&uap->port, &flags);
-	if (uap->rs485_tx_state == WAIT_AFTER_RTS)
+	if (uap->rs485_tx_state == WAIT_AFTER_RTS) {
+		uap->rs485_tx_state = SEND;
 		pl011_start_tx(&uap->port);
+	}
 	uart_port_unlock_irqrestore(&uap->port, flags);
 
 	return HRTIMER_NORESTART;

From b0c1eed0e69dde2cdc5558c49cf58ac521ec6380 Mon Sep 17 00:00:00 2001
From: Nicolai Buchwitz <nb@tipi-net.de>
Date: Mon, 12 Oct 2026 16:23:50 +0200
Subject: [PATCH 1553/1982] serial: amba-pl011: keep transmitter enabled when
 disabling RS485

[ Upstream commit 97f85204275ae4d7fb530e451f3acc65c1ec1155 ]

Disabling RS485 on an open port calls pl011_rs485_tx_stop(), which
turns off the transmitter. Only the RS485 TX path turns it back on, so
any later output stays queued and tcdrain() hangs until the port is
closed.

pl011_rs485_tx_stop() also checks only the hardware FIFO. If a DMA
transfer has started but has not filled the FIFO yet, the transmitter
is turned off under the transfer and the DMA channel never recovers.

When leaving RS485 mode, cancel pending deferred starts and stops, leave
the transmitter enabled and start any TX that was still waiting for
delay_rts_before_send.

Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
Cc: stable@kernel.org
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20261012-fix-pl011-rs485-txe-v2-1-e9bf7d218389@tipi-net.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/amba-pl011.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 3e777e4d13f20c..20d2a8612cbcbc 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2308,8 +2308,31 @@ static int pl011_rs485_config(struct uart_port *port, struct ktermios *termios,
 	struct uart_amba_port *uap =
 		container_of(port, struct uart_amba_port, port);
 
-	if (port->rs485.flags & SER_RS485_ENABLED)
+	if ((port->rs485.flags & SER_RS485_ENABLED) &&
+	    !(rs485->flags & SER_RS485_ENABLED)) {
+		bool tx_pending = uap->rs485_tx_state == WAIT_AFTER_RTS;
+		u32 cr = pl011_read(uap, REG_CR);
+
+		/*
+		 * Leaving RS485 mode, which only enables the transmitter while
+		 * sending. Don't stop it, as that stalls a DMA transfer still
+		 * in flight. Drop pending deferred starts and stops and keep
+		 * it enabled.
+		 */
+		hrtimer_try_to_cancel(&uap->trigger_start_tx);
+		hrtimer_try_to_cancel(&uap->trigger_stop_tx);
+		uap->rs485_tx_state = OFF;
+
+		cr |= UART011_CR_TXE | UART011_CR_RXE;
+		pl011_write(cr, uap, REG_CR);
+
+		/* Start TX that was still waiting for delay_rts_before_send */
+		if (tx_pending && !uart_tx_stopped(port) &&
+		    !pl011_dma_tx_start(uap))
+			pl011_start_tx_pio(uap);
+	} else if (port->rs485.flags & SER_RS485_ENABLED) {
 		pl011_rs485_tx_stop(uap);
+	}
 
 	/* Make sure auto RTS is disabled */
 	if (rs485->flags & SER_RS485_ENABLED) {

From f69cfb5188bf3a5e618ed83ba093452ace82e5f7 Mon Sep 17 00:00:00 2001
From: Tim Douglas <me@timdoug.com>
Date: Mon, 12 Oct 2026 21:35:40 -0400
Subject: [PATCH 1554/1982] serial: pmac_zilog: push received data to the port
 that received it

[ Upstream commit f3dc727da3af64abc12b625bbf1eb68d55d882cc ]

pmz_interrupt() drains both channels but, since commit 2e124b4a390c
("TTY: switch tty_flip_buffer_push"), pushes the flip buffer of the
port whose handler is running rather than the port that was drained.
With both ports open, data received on the other port can be left in
its flip buffer until something else pushes it, so its reader may not
see it.

Fixes: 2e124b4a390c ("TTY: switch tty_flip_buffer_push")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013013541.4535-2-me@timdoug.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/pmac_zilog.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index e3a91932869545..f49d6052d11be7 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -444,7 +444,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
  skip_a:
 	uart_port_unlock(&uap_a->port);
 	if (push)
-		tty_flip_buffer_push(&uap->port.state->port);
+		tty_flip_buffer_push(&uap_a->port.state->port);
 
 	if (!uap_b)
 		goto out;
@@ -469,7 +469,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
  skip_b:
 	uart_port_unlock(&uap_b->port);
 	if (push)
-		tty_flip_buffer_push(&uap->port.state->port);
+		tty_flip_buffer_push(&uap_b->port.state->port);
 
  out:
 	return rc;

From c043a0aa81253235141509e19c29d2fcfa270a6d Mon Sep 17 00:00:00 2001
From: Matt Fleming <mfleming@cloudflare.com>
Date: Tue, 13 Oct 2026 13:19:43 +0100
Subject: [PATCH 1555/1982] iommu/amd: Program device table when kdump reuse
 fails

[ Upstream commit 05d62be400f3ae0f6856f6910a1281e67cbaabcf ]

Commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump") made
iommu_set_device_table() return early in every kdump kernel. That is
needed when the previous kernel's device table is reused: the base
register already points at it, and on SNP-enabled systems the register
is locked.

But if reuse isn't possible, early_enable_iommus() falls back to the
freshly allocated table and calls early_enable_iommu(). Because of the
early return, that table is never written to the base register. The
IOMMU keeps using whatever table the register pointed at before, while
the driver writes entries into the new one.

Only skip the write when the previous kernel's table was reused.

Fixes: 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
Cc: stable@vger.kernel.org
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd/init.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index c07c3a01b978bd..0572e1a674f0b7 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -409,7 +409,13 @@ static void iommu_set_device_table(struct amd_iommu *iommu)
 
 	BUG_ON(iommu->mmio_base == NULL);
 
-	if (is_kdump_kernel())
+	/*
+	 * A kdump kernel that reuses the previous kernel's device table must
+	 * leave the base register alone. It already points at that table, and
+	 * with SNP enabled the register is locked. If reuse failed, program
+	 * the freshly allocated table like a normal boot.
+	 */
+	if (iommu->pci_seg->old_dev_tbl_cpy)
 		return;
 
 	entry = iommu_virt_to_phys(dev_table);

From 5819b86e062406c6c43041875cff6681a3a373fd Mon Sep 17 00:00:00 2001
From: Matt Fleming <mfleming@cloudflare.com>
Date: Tue, 13 Oct 2026 13:19:44 +0100
Subject: [PATCH 1556/1982] iommu/amd: Don't allocate kdump device table from
 DMA32

[ Upstream commit bae0d3760661ac77148944e88aafef698cf7b2bf ]

Booting a kdump kernel with crashkernel=X,high crashkernel=0,low on an
AMD system fails the per-segment device table allocation because there
is no memory below 4G:

  swapper/0: page allocation failure: order:9, mode:0x40104(GFP_DMA32|__GFP_ZERO|__GFP_COMP)
  iommu_alloc_pages_node_sz+0x7f/0x150
  alloc_pci_segment+0x4bd/0x650
  iommu_go_to_state+0x213d/0x34e0
  amd_iommu_prepare+0x39/0xa0
  irq_remapping_prepare+0x83/0xd0
  enable_IR_x2apic+0x61/0x370

On our E810 systems, the kdump kernel booted but ice MSI-X interrupts
never fired and the TX queues timed out.

Commit b336781b82cc ("iommu/amd: Allocate memory below 4G for dev table
if translation pre-enabled") allocated device tables below 4G. At the
time, the kdump kernel programmed a copy of the old table into the base
register with the IOMMU still enabled. The 64-bit register is updated
as two 32-bit halves, so the running IOMMU could see a half-written,
invalid table pointer. Keeping both tables below 4G leaves the upper
half zero throughout the update, so the pointer stays valid.

Since commit 38e5f33ee359 ("iommu/amd: Reuse device table for kdump")
the kdump kernel reuses the previous kernel's table without writing the
base register, so its newly allocated table is discarded when reuse
succeeds. If reuse fails, the previous patch programs the new table only
after disabling the IOMMU. Either way, the kdump kernel's table doesn't
need to be below 4G.

The previous kernel still allocates its table from DMA32, so the kdump
kernel's check that the old table is below 4G still works. Drop
GFP_DMA32 for kdump kernels only.

Cc: stable@vger.kernel.org # 6.18.x
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Reviewed-by: Ashish Kalra <ashish.kalra@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd/init.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 0572e1a674f0b7..16c26d75f46f4a 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -648,8 +648,19 @@ static int __init find_last_devid_acpi(struct acpi_table_header *table, u16 pci_
 /* Allocate per PCI segment device table */
 static inline int __init alloc_dev_table(struct amd_iommu_pci_seg *pci_seg)
 {
-	pci_seg->dev_table = iommu_alloc_pages_sz(GFP_KERNEL | GFP_DMA32,
-						  pci_seg->dev_table_size);
+	gfp_t gfp = GFP_KERNEL;
+
+	/*
+	 * Keep normal kernel device tables below 4G because a later kdump
+	 * kernel only trusts and reuses old tables below that limit. A kdump
+	 * kernel's new table is either discarded when reuse succeeds or
+	 * programmed after the IOMMU is disabled, so the table does not
+	 * need DMA32 memory (which the crashkernel may not have).
+	 */
+	if (!is_kdump_kernel())
+		gfp |= GFP_DMA32;
+
+	pci_seg->dev_table = iommu_alloc_pages_sz(gfp, pci_seg->dev_table_size);
 	if (!pci_seg->dev_table)
 		return -ENOMEM;
 

From 1927f66f8ca6fbf1ff06e7af1dd5098e2ae69e43 Mon Sep 17 00:00:00 2001
From: Martin Belanger <martin.nvme.dev@gmail.com>
Date: Wed, 14 Oct 2026 08:02:57 -0400
Subject: [PATCH 1557/1982] nvme: make the DH-HMAC-CHAP secret attributes
 readable by root only

[ Upstream commit bbca7c312ab25efd0024eb87545c51a76ab2ea39 ]

The dhchap_secret and dhchap_ctrl_secret sysfs attributes have mode
0644. Their show functions return the secret, so any local user can
read the DH-HMAC-CHAP secrets of a connected controller.

Define them with DEVICE_ATTR_ADMIN_RW(), which sets mode 0600. The
macro takes the show and store functions from the attribute name, so
rename them. Writing the attributes was already limited to root and is
not changed.

Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Assisted-by: LLM
Signed-off-by: Martin Belanger <martin.nvme.dev@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/sysfs.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 12478e0297356b..2b6085359a9502 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -626,7 +626,7 @@ static ssize_t quirks_show(struct device *dev, struct device_attribute *attr,
 static DEVICE_ATTR_RO(quirks);
 
 #ifdef CONFIG_NVME_HOST_AUTH
-static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
+static ssize_t dhchap_secret_show(struct device *dev,
 		struct device_attribute *attr, char *buf)
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -637,7 +637,7 @@ static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
 	return sysfs_emit(buf, "%s\n", opts->dhchap_secret);
 }
 
-static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
+static ssize_t dhchap_secret_store(struct device *dev,
 		struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -681,10 +681,9 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
 	return count;
 }
 
-static DEVICE_ATTR(dhchap_secret, S_IRUGO | S_IWUSR,
-	nvme_ctrl_dhchap_secret_show, nvme_ctrl_dhchap_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_secret);
 
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
+static ssize_t dhchap_ctrl_secret_show(struct device *dev,
 		struct device_attribute *attr, char *buf)
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -695,7 +694,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
 	return sysfs_emit(buf, "%s\n", opts->dhchap_ctrl_secret);
 }
 
-static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
+static ssize_t dhchap_ctrl_secret_store(struct device *dev,
 		struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
@@ -739,8 +738,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
 	return count;
 }
 
-static DEVICE_ATTR(dhchap_ctrl_secret, S_IRUGO | S_IWUSR,
-	nvme_ctrl_dhchap_ctrl_secret_show, nvme_ctrl_dhchap_ctrl_secret_store);
+static DEVICE_ATTR_ADMIN_RW(dhchap_ctrl_secret);
 #endif
 
 static struct attribute *nvme_dev_attrs[] = {

From 874ed54f09c608e0e1bb3704ab05cd60949c13d2 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Tue, 29 Sep 2026 16:11:45 +0800
Subject: [PATCH 1558/1982] spi: cadence-xspi: fix stack buffer overflow in the
 Marvell b0 path

[ Upstream commit ef9690269999ddf9b204731baca1bd6b7aea1aa7 ]

transfer_one_message_b0() falls back to a 10-byte stack buffer for
transfers which carry no TX data and points both in_buffer and
out_buffer into it.

With a transfer longer than 10 bytes the SDMA branch of the loop moves
up to MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT (256) bytes
through those pointers and then advances them by the same amount, so
both directions overflow the scratch buffer: a read transaction copies
SDMA data past the end of the buffer, a write transaction sends stack
contents from beyond it to the SPI bus.

Size the scratch buffer for the largest chunk the loop can request,
keep the buffer pointers pinned to it when the message does not carry
the corresponding TX or RX data, and only advance the pointers which
reference real transfer buffers. Also zero-initialize the scratch
buffer so that padding bytes sent for TX-less transfers no longer leak
uninitialized stack contents.

Fixes: 5cb7651f78e1 ("Marvell HW overlay support for Cadence xSPI")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20260929081146.41041-3-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-cadence-xspi.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c
index 6dcba0e0ddaa3e..c3676b21e81675 100644
--- a/drivers/spi/spi-cadence-xspi.c
+++ b/drivers/spi/spi-cadence-xspi.c
@@ -268,6 +268,7 @@
 #define MRVL_XFER_FUNC_START		 BIT(0)
 #define MRVL_XFER_QWORD_COUNT		 32
 #define MRVL_XFER_QWORD_BYTECOUNT	 8
+#define MRVL_XFER_MAX_LEN (MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT)
 
 #define MRVL_XSPI_POLL_TIMEOUT_US	1000
 #define MRVL_XSPI_POLL_DELAY_US		10
@@ -1047,7 +1048,7 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
 	struct spi_device *spi = m->spi;
 	struct spi_transfer *t = NULL;
 
-	const unsigned int max_len = MRVL_XFER_QWORD_BYTECOUNT * MRVL_XFER_QWORD_COUNT;
+	const unsigned int max_len = MRVL_XFER_MAX_LEN;
 	int current_transfer_len;
 	int cs = spi_get_chipselect(spi, 0);
 	int cs_change = 0;
@@ -1070,13 +1071,16 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
 	list_for_each_entry(t, &m->transfers, transfer_list) {
 		u8 *txd = (u8 *) t->tx_buf;
 		u8 *rxd = (u8 *) t->rx_buf;
-		u8 data[10];
+		u8 data[MRVL_XFER_MAX_LEN] = {0};
 		u32 cmd_regs[6];
 
 		if (!txd)
 			txd = data;
 
-		cdns_xspi->in_buffer = txd + 1;
+		if (rxd)
+			cdns_xspi->in_buffer = rxd;
+		else
+			cdns_xspi->in_buffer = data;
 		cdns_xspi->out_buffer = txd + 1;
 
 		while (t->len) {
@@ -1101,8 +1105,10 @@ static int cdns_xspi_transfer_one_message_b0(struct spi_controller *controller,
 				if (!cdns_xspi_is_stig_ready(cdns_xspi, true))
 					return -EIO;
 
-				cdns_xspi->in_buffer += current_transfer_len;
-				cdns_xspi->out_buffer += current_transfer_len;
+				if (rxd)
+					cdns_xspi->in_buffer += current_transfer_len;
+				if (t->tx_buf)
+					cdns_xspi->out_buffer += current_transfer_len;
 			}
 
 			if (rxd) {

From 014e83749f5e3e5f3419d666c5e0a4803376adb7 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 8 Aug 2026 22:08:26 +0100
Subject: [PATCH 1559/1982] ARM: 9488/1: smp: set current pointer in assembly
 before jumping into C

[ Upstream commit f6e551e7d515579b952422c93415470fb672d848 ]

With CONFIG_KCOV_INSTRUMENT_ALL=y, secondary CPUs fail to come online
on ARMv6K/ARMv7 SMP:

  CPU1: failed to boot: -38

The compiler inserts a call to __sanitizer_cov_trace_pc() at the entry
of secondary_start_kernel(), before set_current(task). The KCOV hook
dereferences current while TPIDRURO is still uninitialized, causing a
data abort before cpu_init() has installed the exception stacks. The
secondary CPU consequently never completes startup.

Initialize current in the secondary assembly handoff, as
__mmap_switched already does for the boot CPU.

With current set in assembly, the set_current() call in
secondary_start_kernel() is redundant. Drop it together with the
function and the task argument. The hotplug resuscitate path in
arch_cpu_idle_dead() needs no hand-off either, as smp_ops.cpu_die()
can only return if the CPU kept its register state, TPIDRURO included.

Assisted-by: Claude:claude-fable-5

Fixes: 50596b7559bf ("ARM: smp: Store current pointer in TPIDRURO register if available")
Cc: stable@vger.kernel.org
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/include/asm/smp.h   |  2 +-
 arch/arm/kernel/head-nommu.S |  1 +
 arch/arm/kernel/head.S       |  1 +
 arch/arm/kernel/smp.c        | 15 ++-------------
 4 files changed, 5 insertions(+), 14 deletions(-)

diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
index 8c05a7f374d8b3..84aa6a663e8164 100644
--- a/arch/arm/include/asm/smp.h
+++ b/arch/arm/include/asm/smp.h
@@ -43,7 +43,7 @@ extern void set_smp_ipi_range(int ipi_base, int nr_ipi);
  * Called from platform specific assembly code, this is the
  * secondary CPU entry point.
  */
-asmlinkage void secondary_start_kernel(struct task_struct *task);
+asmlinkage void secondary_start_kernel(void);
 
 
 /*
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b9d6818f1ee164..f80bbfbd3a6f83 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -116,6 +116,7 @@ ENTRY(secondary_startup)
 	ldr	r7, __secondary_data		@ reload r7
 	ldr	sp, [r7, #12]			@ set up the stack pointer
 	ldr	r0, [r7, #16]			@ set up task pointer
+	set_current r0, r1
 	mov	fp, #0
 	b	secondary_start_kernel
 ENDPROC(secondary_startup)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f22c50d4bd4173..a22403a629efac 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -442,6 +442,7 @@ ENTRY(__secondary_switched)
 	adr_l	r7, secondary_data + 12		@ get secondary_data.stack
 	ldr	sp, [r7]
 	ldr	r0, [r7, #4]			@ get secondary_data.task
+	set_current r0, r1
 	mov	fp, #0
 	b	secondary_start_kernel
 ENDPROC(__secondary_switched)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 50999886a8b5cb..e302063658779a 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -371,12 +371,9 @@ void __noreturn arch_cpu_idle_dead(void)
 	 */
 	__asm__("mov	sp, %0\n"
 	"	mov	fp, #0\n"
-	"	mov	r0, %1\n"
 	"	b	secondary_start_kernel"
 		:
-		: "r" (task_stack_page(current) + THREAD_SIZE - 8),
-		  "r" (current)
-		: "r0");
+		: "r" (task_stack_page(current) + THREAD_SIZE - 8));
 
 	unreachable();
 }
@@ -397,23 +394,15 @@ static void smp_store_cpu_info(unsigned int cpuid)
 	check_cpu_icache_size(cpuid);
 }
 
-static void set_current(struct task_struct *cur)
-{
-	/* Set TPIDRURO */
-	asm("mcr p15, 0, %0, c13, c0, 3" :: "r"(cur) : "memory");
-}
-
 /*
  * This is the secondary CPU boot entry.  We're using this CPUs
  * idle thread stack, but a set of temporary page tables.
  */
-asmlinkage void secondary_start_kernel(struct task_struct *task)
+asmlinkage void secondary_start_kernel(void)
 {
 	struct mm_struct *mm = &init_mm;
 	unsigned int cpu;
 
-	set_current(task);
-
 	secondary_biglittle_init();
 
 	/*

From 06d167658ab538cfc9653fda92405b651e1c095c Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Thu, 13 Aug 2026 04:02:36 +0100
Subject: [PATCH 1560/1982] ARM: 9491/1: alignment: restore uaccess state on
 emulation fault

[ Upstream commit 80dafbcb705cead6d25cb821cf29c47da8860c8c ]

The alignment handlers enable access to user memory while emulating
unaligned instructions. If a checked access faults, its exception table
fixup jumps to the handler's fault label and bypasses uaccess_restore().
This leaves DOMAIN_USER as DOMAIN_CLIENT with SW domain PAN, or leaves
TTBR0 page table walks enabled with TTBR0 PAN, while the fault is handled.

An ARM926 QEMU test using LDMIA across an unmapped page boundary reports
DOMAIN_USER=1 at TYPE_FAULT before this change and DOMAIN_USER=0 after it.
SW domain PAN is the default on ARMv5, ARMv6, and non-LPAE ARMv7 builds.

Keep the saved uaccess state at function scope and track whether it was
saved. Restore it at the fault label only when needed. Paths that did not
enable user access continue to skip the restore.

Assisted-by: Codex:gpt-5.6-sol

Fixes: 274e91b81ed2 ("ARM: alignment: fix alignment handling for uaccess changes")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mm/alignment.c | 51 ++++++++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 14 deletions(-)

diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 812380f30ae36a..2b470a419dda30 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -341,6 +341,8 @@ static int
 do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
 	unsigned int rd = RD_BITS(instr);
+	unsigned int ua_flags;
+	bool ua_saved = false;
 
 	ai_half += 1;
 
@@ -364,10 +366,11 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
  user:
 	if (LDST_L_BIT(instr)) {
 		unsigned long val;
-		unsigned int __ua_flags = uaccess_save_and_enable();
 
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		get16t_unaligned_check(val, addr);
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 
 		/* signed half-word? */
 		if (instr & 0x40)
@@ -375,14 +378,17 @@ do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
 
 		regs->uregs[rd] = val;
 	} else {
-		unsigned int __ua_flags = uaccess_save_and_enable();
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		put16t_unaligned_check(regs->uregs[rd], addr);
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 	}
 
 	return TYPE_LDST;
 
  fault:
+	if (ua_saved)
+		uaccess_restore(ua_flags);
 	return TYPE_FAULT;
 }
 
@@ -391,6 +397,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
 	unsigned int rd = RD_BITS(instr);
 	unsigned int rd2;
+	unsigned int ua_flags;
+	bool ua_saved = false;
 	int load;
 
 	if ((instr & 0xfe000000) == 0xe8000000) {
@@ -425,26 +433,30 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
  user:
 	if (load) {
 		unsigned long val, val2;
-		unsigned int __ua_flags = uaccess_save_and_enable();
 
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		get32t_unaligned_check(val, addr);
 		get32t_unaligned_check(val2, addr + 4);
 
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 
 		regs->uregs[rd] = val;
 		regs->uregs[rd2] = val2;
 	} else {
-		unsigned int __ua_flags = uaccess_save_and_enable();
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		put32t_unaligned_check(regs->uregs[rd], addr);
 		put32t_unaligned_check(regs->uregs[rd2], addr + 4);
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 	}
 
 	return TYPE_LDST;
  bad:
 	return TYPE_ERROR;
  fault:
+	if (ua_saved)
+		uaccess_restore(ua_flags);
 	return TYPE_FAULT;
 }
 
@@ -452,6 +464,8 @@ static int
 do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
 	unsigned int rd = RD_BITS(instr);
+	unsigned int ua_flags;
+	bool ua_saved = false;
 
 	ai_word += 1;
 
@@ -469,18 +483,22 @@ do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
  trans:
 	if (LDST_L_BIT(instr)) {
 		unsigned int val;
-		unsigned int __ua_flags = uaccess_save_and_enable();
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		get32t_unaligned_check(val, addr);
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 		regs->uregs[rd] = val;
 	} else {
-		unsigned int __ua_flags = uaccess_save_and_enable();
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		put32t_unaligned_check(regs->uregs[rd], addr);
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 	}
 	return TYPE_LDST;
 
  fault:
+	if (ua_saved)
+		uaccess_restore(ua_flags);
 	return TYPE_FAULT;
 }
 
@@ -502,6 +520,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
 	unsigned int rd, rn, correction, nr_regs, regbits;
 	unsigned long eaddr, newaddr;
+	unsigned int ua_flags;
+	bool ua_saved = false;
 
 	if (LDM_S_BIT(instr))
 		goto bad;
@@ -547,7 +567,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 #endif
 
 	if (user_mode(regs)) {
-		unsigned int __ua_flags = uaccess_save_and_enable();
+		ua_flags = uaccess_save_and_enable();
+		ua_saved = true;
 		for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
 		     regbits >>= 1, rd += 1)
 			if (regbits & 1) {
@@ -559,7 +580,7 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 					put32t_unaligned_check(regs->uregs[rd], eaddr);
 				eaddr += 4;
 			}
-		uaccess_restore(__ua_flags);
+		uaccess_restore(ua_flags);
 	} else {
 		for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
 		     regbits >>= 1, rd += 1)
@@ -581,6 +602,8 @@ do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 	return TYPE_DONE;
 
 fault:
+	if (ua_saved)
+		uaccess_restore(ua_flags);
 	regs->ARM_pc -= correction;
 	return TYPE_FAULT;
 

From e9eb621dc62b51f33539cb70c23ffd495e0eec8b Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 21 Sep 2026 21:36:28 +0100
Subject: [PATCH 1561/1982] ARM: 9520/1: cacheinfo: avoid out-of-bounds write
 in populate_cache_leaves()

[ Upstream commit 41a3f4bc3e4ae4722fd24743bf3f286cea14e3dc ]

populate_cache_leaves() advances its bounds-checking index once per
cache level, but split instruction/data caches consume two entries.
CLIDR-based allocation supplies enough entries. Early allocation from
the device tree can supply fewer and expose an out-of-bounds write.

Count each written leaf and stop before a split level that does not
fit. This prepares ARM for DT-based early allocation and matches
commit 875d742cf532 ("arm64: cacheinfo: Avoid out-of-bounds write to
cacheinfo array").

Assisted-by: LLM

Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-2-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/cacheinfo.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index e1469b6417804d..860eeb03cfe5d6 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -151,7 +151,7 @@ int populate_cache_leaves(unsigned int cpu)
 	unsigned int level, idx;
 	enum cache_type type;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-	struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+	struct cacheinfo *infos = this_cpu_ci->info_list;
 	unsigned int arch = cpu_architecture();
 
 	/* CLIDR is not present before ARMv7/v7m */
@@ -159,13 +159,15 @@ int populate_cache_leaves(unsigned int cpu)
 		return -EOPNOTSUPP;
 
 	for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
-	     idx < this_cpu_ci->num_leaves; idx++, level++) {
+	     idx < this_cpu_ci->num_leaves; level++) {
 		type = get_cache_type(level);
 		if (type == CACHE_TYPE_SEPARATE) {
-			ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
-			ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+			if (idx + 1 >= this_cpu_ci->num_leaves)
+				break;
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
 		} else {
-			ci_leaf_init(this_leaf++, type, level);
+			ci_leaf_init(&infos[idx++], type, level);
 		}
 	}
 

From d75ac6be6915c38673bdb31f7e07913d742388a4 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 21 Sep 2026 21:44:33 +0100
Subject: [PATCH 1562/1982] ARM: 9521/1: cacheinfo: count external caches in
 early_cache_level()

[ Upstream commit 4fd69e8a9ebc42e292637ec2ebfb6bcf2d2f6c0e ]

early_cache_level() counts only caches described by CLIDR. An external
PL310 is absent from CLIDR, and its arm,pl310-cache compatible is not
accepted by init_of_cache_level(), so early allocation falls back to
an incomplete count. init_cache_level() later adds the DT-described
L2, forcing reallocation on the secondary CPU with interrupts disabled.
This defeats early allocation on PREEMPT_RT.

Use init_cache_level() for early sizing too, so the initial allocation
includes external caches described by the device tree.

Assisted-by: LLM

Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-3-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/cacheinfo.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 860eeb03cfe5d6..31591c94725488 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -111,13 +111,6 @@ static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
 	return 0;
 }
 
-int early_cache_level(unsigned int cpu)
-{
-	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-
-	return detect_cache_level(&this_cpu_ci->num_levels, &this_cpu_ci->num_leaves);
-}
-
 int init_cache_level(unsigned int cpu)
 {
 	unsigned int level, leaves;
@@ -146,6 +139,11 @@ int init_cache_level(unsigned int cpu)
 	return 0;
 }
 
+int early_cache_level(unsigned int cpu)
+{
+	return init_cache_level(cpu);
+}
+
 int populate_cache_leaves(unsigned int cpu)
 {
 	unsigned int level, idx;

From 9c6cd241d67f942dc4cc50be6bb0fcedc8d7b90a Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 21 Sep 2026 21:45:20 +0100
Subject: [PATCH 1563/1982] ARM: 9522/1: cacheinfo: guard the CLIDR read in
 populate_cache_leaves()

[ Upstream commit 2315f2c46e0813d010e7b3ea40f2769621453e27 ]

ARM1176 and ARM11 MPCore can be reported as ARMv7 by
cpu_architecture() even though they lack CLIDR. populate_cache_leaves()
therefore needs the CTR-format check used by detect_cache_level().

DT-based early allocation bypasses init_cache_level(), so its check
no longer protects populate_cache_leaves(). A combined ARMv6/ARMv7
SMP kernel can reach this path on BCM2835, whose DT describes its
caches.

Share the CLIDR capability check between detection and population.
Return -ENOENT from population when CLIDR is unavailable, preserving
the existing absence of cacheinfo and avoiding a new topology warning.

Assisted-by: LLM

Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-4-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/cacheinfo.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/arch/arm/kernel/cacheinfo.c b/arch/arm/kernel/cacheinfo.c
index 31591c94725488..993c8a13478603 100644
--- a/arch/arm/kernel/cacheinfo.c
+++ b/arch/arm/kernel/cacheinfo.c
@@ -80,19 +80,21 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
 	this_leaf->type = type;
 }
 
-static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+static bool clidr_present(void)
 {
-	unsigned int ctype, level, leaves;
-	u32 ctr, format;
-
 	/* CLIDR is not present before ARMv7/v7m */
 	if (cpu_architecture() < CPU_ARCH_ARMv7)
-		return -EOPNOTSUPP;
+		return false;
 
 	/* Don't try reading CLIDR if CTR declares old format */
-	ctr = read_cpuid_cachetype();
-	format = FIELD_GET(CTR_FORMAT_MASK, ctr);
-	if (format != CTR_FORMAT_ARMV7)
+	return FIELD_GET(CTR_FORMAT_MASK, read_cpuid_cachetype()) == CTR_FORMAT_ARMV7;
+}
+
+static int detect_cache_level(unsigned int *level_p, unsigned int *leaves_p)
+{
+	unsigned int ctype, level, leaves;
+
+	if (!clidr_present())
 		return -EOPNOTSUPP;
 
 	for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
@@ -150,11 +152,10 @@ int populate_cache_leaves(unsigned int cpu)
 	enum cache_type type;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
 	struct cacheinfo *infos = this_cpu_ci->info_list;
-	unsigned int arch = cpu_architecture();
 
-	/* CLIDR is not present before ARMv7/v7m */
-	if (arch < CPU_ARCH_ARMv7)
-		return -EOPNOTSUPP;
+	/* The device tree can describe caches CLIDR cannot fill in. */
+	if (!clidr_present())
+		return -ENOENT;
 
 	for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
 	     idx < this_cpu_ci->num_leaves; level++) {

From 9d71a347dcee1652e15b8ff66e4652ae26a9a53e Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Mon, 21 Sep 2026 21:46:11 +0100
Subject: [PATCH 1564/1982] ARM: 9523/1: topology: allocate the cacheinfo early
 on the boot CPU

[ Upstream commit 2d4234f99900403842b2c031fefb4c5816ac4df8 ]

ARM secondary CPUs allocate cacheinfo in detect_cache_attributes(),
called from secondary_start_kernel() with interrupts disabled. With
PREEMPT_RT, the allocation takes a sleeping lock and triggers
"BUG: sleeping function called from invalid context".

Call fetch_cache_info() for each possible CPU from init_cpu_topology()
on the boot CPU, following commit 5944ce092b97 ("arch_topology: Build
cacheinfo from primary CPU"). This supplies the arrays before secondary
CPUs populate them. Suppress -ENOENT and -EOPNOTSUPP, which leave cache
detection to the existing late path.

The CLIDR fallback uses the boot CPU's cache geometry. A secondary CPU
with more cache leaves can still require late reallocation and trigger
the warning.

Assisted-by: LLM

Fixes: a9ff94477836 ("ARM: 9433/2: implement cacheinfo support")
Cc: stable@vger.kernel.org
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20260912195552.76673-5-kmehltretter@gmail.com/
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/topology.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 2336ee2aa44a20..e6b50cd43ce53a 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/arch_topology.h>
+#include <linux/cacheinfo.h>
 #include <linux/cpu.h>
 #include <linux/cpufreq.h>
 #include <linux/cpumask.h>
@@ -238,8 +239,20 @@ void store_cpu_topology(unsigned int cpuid)
  */
 void __init init_cpu_topology(void)
 {
+	int cpu, ret;
+
 	reset_cpu_topology();
 	smp_wmb();
 
 	parse_dt_topology();
+
+	for_each_possible_cpu(cpu) {
+		ret = fetch_cache_info(cpu);
+		if (!ret)
+			continue;
+		/* CPUs without a usable CLIDR return -EOPNOTSUPP. */
+		if (ret != -ENOENT && ret != -EOPNOTSUPP)
+			pr_err("Early cacheinfo failed, ret = %d\n", ret);
+		return;
+	}
 }

From 8073652f5c220dca8bc07c94268a5e15cce921a4 Mon Sep 17 00:00:00 2001
From: Stian Halseth <stian@itx.no>
Date: Wed, 7 Oct 2026 15:13:04 +0200
Subject: [PATCH 1565/1982] PCI: Set supported_speeds in set_pcie_port_type()

[ Upstream commit 926767a9be8866d26cc27ca46c46c03d921e2193 ]

sparc64 and powerpc create PCI devices from the device tree in
of_create_pci_dev(), which calls set_pcie_port_type() but not
pci_setup_device(). Since d2bd39c0456b, supported_speeds is only set in
pci_setup_device(), so it stays 0 for these devices.

pcie_get_speed_cap() then returns PCI_SPEED_UNKNOWN, the sysfs
'max_link_speed' attribute reads "Unknown", and the failed link retraining
quirk passes PCI_SPEED_UNKNOWN to pcie_set_target_speed(), which warns on a
SPARC T7-1:

  WARNING: drivers/pci/pcie/bwctrl.c:125 at pcie_set_target_speed+0x284/0x2e0

Set supported_speeds in set_pcie_port_type(), which all three paths call.

Fixes: d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds")
Closes: https://github.com/sparclinux/issues/issues/109
Signed-off-by: Stian Halseth <stian@itx.no>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Tony Rodriguez <unixpro1970@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261007131304.309511-1-stian@itx.no
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/probe.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 4e4e38e6269128..082c51ce889368 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1661,6 +1661,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
 		pdev->aspm_l1_support = 1;
 #endif
 
+	pdev->supported_speeds = pcie_get_supported_speeds(pdev);
+
 	parent = pci_upstream_bridge(pdev);
 	if (!parent)
 		return;
@@ -2046,9 +2048,6 @@ int pci_setup_device(struct pci_dev *dev)
 
 	set_pcie_untrusted(dev);
 
-	if (pci_is_pcie(dev))
-		dev->supported_speeds = pcie_get_supported_speeds(dev);
-
 	/* "Unknown power state" */
 	dev->current_state = PCI_UNKNOWN;
 

From b60a589783eb939dbd03e7bcd138893f91cc845e Mon Sep 17 00:00:00 2001
From: Francesco Orlando <francesco.orlando99@libero.it>
Date: Sun, 11 Oct 2026 18:58:21 +0200
Subject: [PATCH 1566/1982] Input: xpad - add GameSir Nova Lite support

[ Upstream commit 2e6f2e5799f328ca0879dad14d7f3709c7f7496b ]

Add vendor and product ID for GameSir Nova Lite (0x3537:0x1040) in
XInput mode to enable force feedback rumble support.

Signed-off-by: Francesco Orlando <francesco.orlando99@libero.it>
Link: https://patch.msgid.link/20261011165821.72698-1-francesco.orlando99@libero.it
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/joystick/xpad.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 126f99cd0b29ea..716ab1c608f0b8 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -442,6 +442,7 @@ static const struct xpad_device {
 	{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
 	{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
 	{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
+	{ 0x3537, 0x1040, "GameSir Nova Lite", 0, XTYPE_XBOX360 },
 	{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
 	{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
 	{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },

From c63c5e1d19ad030df3dce9460cb935765eeb7a09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikolaj=20Klitlund=20B=C3=B8rty?= <nbn@sj.dk>
Date: Sat, 5 Sep 2026 14:05:12 +0200
Subject: [PATCH 1567/1982] Bluetooth: btusb: Add device ID for Realtek
 RTL8761BUE (StarTech AV53C1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1430308fc9d47a801a305700cd444b1a0051d14a ]

Add the USB ID 0x14b0:0x047a for the StarTech AV53C1-USB-BLUETOOTH
adapter, a Realtek RTL8761BUE based Bluetooth 5.3 dongle.

Without this entry btusb treats the device as a generic Bluetooth
adapter and never loads the Realtek firmware, leaving the controller on
its ROM firmware. In that state it advertises and scans actively, but
never reports advertisements during passive scanning. LE connections
initiated by the kernel wait for a passive-scan report before issuing
LE Create Connection, so connecting and pairing from BlueZ time out
without any error from the controller.

The same product is also sold with the ID 0x2c0a:0x8761, which is
already supported.

lsusb -v output for the device:

Bus 001 Device 010: ID 14b0:047a StarTech.com Ltd. Bluetooth Radio
Device Descriptor:
  bcdUSB               1.10
  bDeviceClass          224 Wireless
  bDeviceSubClass         1 Radio Frequency
  bDeviceProtocol         1 Bluetooth
  idVendor           0x14b0 StarTech.com Ltd.
  idProduct          0x047a
  bcdDevice            2.00
  iManufacturer           1 Realtek
  iProduct                2 Bluetooth Radio
  iSerial                 3 00E04C239987
  bNumInterfaces          2
    Interface Descriptor:
      bInterfaceClass       224 Wireless
      bInterfaceSubClass      1 Radio Frequency
      bInterfaceProtocol      1 Bluetooth

Cc: stable@vger.kernel.org
Signed-off-by: Nikolaj Klitlund Børty <nbn@sj.dk>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 0b8c2ecf0a64cd..5b8b71efffac94 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -843,6 +843,8 @@ static const struct usb_device_id quirks_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x37ad, 0x0600), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x14b0, 0x047a), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Additional Realtek 8821AE Bluetooth devices */
 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },

From 658da2402f4bb71e321b046d4ec95d90f786add7 Mon Sep 17 00:00:00 2001
From: Bui Viet Dung <dungvn2345@gmail.com>
Date: Thu, 8 Oct 2026 12:11:29 +0700
Subject: [PATCH 1568/1982] Bluetooth: 6lowpan: Pin module for 6lowpan_control
 debugfs file

[ Upstream commit 8368f0c2cde48c09ed70644059f24172b0c59f52 ]

An open debugfs file retains lowpan_control_fops in the debugfs proxy
state. However, lowpan_control_fops has no .owner set to THIS_MODULE.
As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth_6lowpan module.

With CONFIG_BT_6LOWPAN=m, a userspace process can keep the debugfs file
descriptor for 6lowpan_control open across module unload
(delete_module / rmmod bluetooth_6lowpan). When the process subsequently
closes the file descriptor, full_proxy_release() accesses the already
freed and unmapped lowpan_control_fops table, causing a kernel page fault
or oops.

The issue was discovered via manual code audit of
net/bluetooth/6lowpan.c.

Set .owner = THIS_MODULE on lowpan_control_fops so that debugfs pins
the module until all open file descriptors have finished.

Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/6lowpan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 3733f408d2e40d..0660d306cf4f73 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1207,6 +1207,7 @@ static int lowpan_control_open(struct inode *inode, struct file *file)
 }
 
 static const struct file_operations lowpan_control_fops = {
+	.owner		= THIS_MODULE,
 	.open		= lowpan_control_open,
 	.read		= seq_read,
 	.write		= lowpan_control_write,

From 967b028e2d39dc207a447603a3fa640b661a066d Mon Sep 17 00:00:00 2001
From: Bui Viet Dung <dungvn2345@gmail.com>
Date: Thu, 8 Oct 2026 12:01:40 +0700
Subject: [PATCH 1569/1982] Bluetooth: hci_debugfs: Pin module for debugfs file
 operations

[ Upstream commit 2a3e2287877b1ee40ffb80b7d769b633866533f3 ]

An open debugfs file retains its file_operations pointer in the
debugfs proxy state. However, the file_operations defined in
hci_debugfs.c (use_debug_keys_fops, sc_only_mode_fops,
ssp_debug_mode_fops, force_bredr_smp_fops, force_static_address_fops,
force_no_mitm_fops, dut_mode_fops, vendor_diag_fops, and the
DEFINE_QUIRK_ATTRIBUTE macro) have no .owner set to THIS_MODULE.

As a result, full_proxy_open_regular() calls fops_get() which succeeds
without taking a reference to the bluetooth module. When a userspace
process opens any of these debugfs files, a subsequent controller removal
and module unload (rmmod bluetooth) can succeed while the file descriptor
remains open.

When the userspace process subsequently closes the descriptor,
full_proxy_release() accesses the already unmapped file_operations
structure, triggering a kernel oops in full_proxy_release():

  BUG: unable to handle page fault for address: fffffbfff8056f03
  #PF: supervisor read access in kernel mode
  Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:full_proxy_release+0x8e/0x140
  Call Trace:
   <TASK>
   __fput+0x39f/0xa60
   fput_close_sync+0xff/0x200
   __x64_sys_close+0x8c/0xf0
   do_syscall_64+0x115/0x6a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

The issue was discovered via manual code audit of
net/bluetooth/hci_debugfs.c and verified on a Linux 7.3-rc6 test VM
with CONFIG_BT=m.

Set .owner = THIS_MODULE on all debugfs file_operations tables in
hci_debugfs.c so that debugfs keeps the module loaded until close has
finished.

Fixes: 0886aea6acd2 ("Bluetooth: Expose debug keys usage setting via debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_debugfs.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 9ae6d9224c3b79..807c9e0e212c9f 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -68,6 +68,7 @@ static ssize_t __name ## _write(struct file *file,			      \
 }									      \
 									      \
 static const struct file_operations __name ## _fops = {			      \
+	.owner		= THIS_MODULE,					      \
 	.open		= simple_open,					      \
 	.read		= __name ## _read,				      \
 	.write		= __name ## _write,				      \
@@ -286,6 +287,7 @@ static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf,
 }
 
 static const struct file_operations use_debug_keys_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= use_debug_keys_read,
 	.llseek		= default_llseek,
@@ -304,6 +306,7 @@ static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
 }
 
 static const struct file_operations sc_only_mode_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= sc_only_mode_read,
 	.llseek		= default_llseek,
@@ -440,6 +443,7 @@ static ssize_t ssp_debug_mode_read(struct file *file, char __user *user_buf,
 }
 
 static const struct file_operations ssp_debug_mode_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= ssp_debug_mode_read,
 	.llseek		= default_llseek,
@@ -532,6 +536,7 @@ static ssize_t force_bredr_smp_write(struct file *file,
 }
 
 static const struct file_operations force_bredr_smp_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_bredr_smp_read,
 	.write		= force_bredr_smp_write,
@@ -781,6 +786,7 @@ static ssize_t force_static_address_write(struct file *file,
 }
 
 static const struct file_operations force_static_address_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_static_address_read,
 	.write		= force_static_address_write,
@@ -1184,6 +1190,7 @@ static ssize_t force_no_mitm_write(struct file *file,
 }
 
 static const struct file_operations force_no_mitm_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= force_no_mitm_read,
 	.write		= force_no_mitm_write,
@@ -1322,6 +1329,7 @@ static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
 }
 
 static const struct file_operations dut_mode_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= dut_mode_read,
 	.write		= dut_mode_write,
@@ -1378,6 +1386,7 @@ static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
 }
 
 static const struct file_operations vendor_diag_fops = {
+	.owner		= THIS_MODULE,
 	.open		= simple_open,
 	.read		= vendor_diag_read,
 	.write		= vendor_diag_write,

From ef5743bd6ede07529f0b88f26443a06b8d1c020a Mon Sep 17 00:00:00 2001
From: Siwei Zhang <oss@fourdim.xyz>
Date: Tue, 13 Oct 2026 11:36:33 -0400
Subject: [PATCH 1570/1982] Bluetooth: L2CAP: Reject mode changes on connected
 channels

[ Upstream commit c1398cf11b31a94c27ed810ba69515e0df5ce379 ]

A peer can send a configuration response with an RFC
option for another mode to a connected channel, for
example to switch it from Streaming to ERTM mode.
l2cap_parse_conf_rsp() then changes chan->mode, but
l2cap_ertm_init() is not called again, so the ERTM
sequence lists are never allocated. The next
out-of-sequence I-frame makes l2cap_seq_list_clear()
write through the NULL srej_list.list.

Refuse the channel when a response tries to change
the mode of a connected channel.

Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/patchset/20261007144717.3832330-1-oss%40fourdim.xyz
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 462667a6e6ac24..4e1c21f05e54ed 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3801,7 +3801,11 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
 		}
 	}
 
-	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+	/* A connected channel cannot change its mode, as the new mode would
+	 * not be initialized.
+	 */
+	if (chan->mode != rfc.mode &&
+	    (chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED))
 		return -ECONNREFUSED;
 
 	chan->mode = rfc.mode;

From c00719deed5b6245dedeeb8d6d19cb852fe2ac4d Mon Sep 17 00:00:00 2001
From: Siwei Zhang <oss@fourdim.xyz>
Date: Tue, 13 Oct 2026 11:36:35 -0400
Subject: [PATCH 1571/1982] Bluetooth: L2CAP: Reject invalid TxWindow in
 configuration requests

[ Upstream commit c5ebb0245fe927cf5fa33510a9cb2799c4a2dd01 ]

A peer can send an ERTM RFC option with a TxWindow
of zero, which is out of spec. It is stored in
remote_tx_win unchanged and later passed to
l2cap_seq_list_init(), where roundup_pow_of_two(0)
is undefined. On some architectures this results in
a ZERO_SIZE_PTR list and a remote kernel oops.

A TxWindow above 63 is out of spec as well. With
6-bit sequence numbers we would then send more
unacknowledged frames than the sequence space can
tell apart.

Reply with L2CAP_CONF_UNACCEPT and propose the
default TxWindow instead of accepting the value, so
remote_tx_win always stays within 1 to 63. Keep the
parameters of an earlier request then, and do not
treat the request as done because an earlier one was.

Also refuse a zero size in l2cap_seq_list_init(), so
any other path that reaches it with a zero TxWindow
fails the channel instead of the kernel.

Fixes: f2fcfcd67025 ("Bluetooth: Add configuration support for ERTM and Streaming mode")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4e1c21f05e54ed..0ba7b1ea435cc1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -323,6 +323,10 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
 {
 	size_t alloc_size, i;
 
+	/* roundup_pow_of_two(0) is undefined */
+	if (!size)
+		return -EINVAL;
+
 	/* Allocated size is a power of 2 to map sequence numbers
 	 * (which may be up to 14 bits) in to a smaller array that is
 	 * sized for the negotiated ERTM transmit windows.
@@ -3648,18 +3652,33 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
 			break;
 
 		case L2CAP_MODE_ERTM:
-			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
-				chan->remote_tx_win = rfc.txwin_size;
-			else
-				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
-
-			chan->remote_max_tx = rfc.max_transmit;
-
 			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
 				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
 			rfc.max_pdu_size = cpu_to_le16(size);
-			chan->remote_mps = size;
+
+			/* The TxWindow must be within 1 to 63, otherwise
+			 * propose the default one and keep the parameters of
+			 * an earlier request. This overrides a PENDING result
+			 * from the EFS check above, so the request is no
+			 * longer pending, nor done if an earlier one was.
+			 */
+			if (!rfc.txwin_size ||
+			    rfc.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
+				result = L2CAP_CONF_UNACCEPT;
+				clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
+				clear_bit(CONF_OUTPUT_DONE, &chan->conf_state);
+				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+				remote_efs = 0;
+			} else {
+				if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
+					chan->remote_tx_win = rfc.txwin_size;
+				else
+					rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
+				chan->remote_max_tx = rfc.max_transmit;
+				chan->remote_mps = size;
+			}
 
 			__l2cap_set_ertm_timeouts(chan, &rfc);
 

From eb86688484688e7626f71f0a98583f9cdf760f13 Mon Sep 17 00:00:00 2001
From: Siwei Zhang <oss@fourdim.xyz>
Date: Tue, 13 Oct 2026 11:36:36 -0400
Subject: [PATCH 1572/1982] Bluetooth: L2CAP: Use default TxWindow for zero
 socket option

[ Upstream commit 226fa3b676cbf2236f803bccd347462433ffc2c8 ]

L2CAP_OPTIONS accepts a txwin_size of zero and
stores it in tx_win. The zero is then sent to the
peer in our configuration request, and if the
channel ends up in ERTM mode it is passed to
l2cap_seq_list_init().

Use the default TxWindow instead, as the mode can
still be changed to ERTM during configuration.

Fixes: 14b5aa71ec50 ("Bluetooth: Add sockopt configuration for txWindow on L2CAP")
Cc: stable@vger.kernel.org
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_sock.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index bb383ee188bbc8..b85c6a11334ee2 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -805,6 +805,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 			break;
 		}
 
+		/* A zero TxWindow is invalid, use the default instead */
+		if (!opts.txwin_size)
+			opts.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
+
 		if (!l2cap_valid_mtu(chan, opts.imtu)) {
 			err = -EINVAL;
 			break;

From c48802c7cc667fe5fd4ff8d1e84fa24d9e10abe8 Mon Sep 17 00:00:00 2001
From: Hui Su <sh_def@163.com>
Date: Tue, 13 Oct 2026 12:42:35 +0900
Subject: [PATCH 1573/1982] cpufreq: schedutil: Serialize sugov_start() against
 rate limit updates

[ Upstream commit ce390caf5541c493c9061e7a2d98a463e66b736a ]

The current value of sg_policy->tunables->rate_limit_us is used in
sugov_start() without locking to update sg_policy->freq_update_delay_ns,
so if rate_limit_us_store() runs in parallel with it, the rate limit
update may go unnoticed and the new freq_update_delay_ns value may be
stale until the rate limit is updated again.

To avoid that, acquire the update_lock mutex of the rate limit sysfs
attribute, that is held by rate_limit_us_store() during rate limit
updates, around the freq_update_delay_ns in sugov_start().

Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Hui Su <sh_def@163.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject adjustment, new changelog, edits of the new comment ]
[ rjw: Add empty code line after guard()() ]
Link: https://patch.msgid.link/20261013034235.2678177-1-sh_def@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/cpufreq_schedutil.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 22a1fbccb929f8..9b5db92744aeef 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -72,6 +72,18 @@ static void sugov_update_rate_limit_us(struct sugov_policy *sg_policy)
 		(s64)sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
 }
 
+static void sugov_update_rate_limit_us_sync(struct sugov_policy *sg_policy)
+{
+	/*
+	 * Serialize with rate_limit_us_store() to prevent this path from using
+	 * a stale rate limit tunable value to set the limit for the given
+	 * policy.
+	 */
+	guard(mutex)(&sg_policy->tunables->attr_set.update_lock);
+
+	sugov_update_rate_limit_us(sg_policy);
+}
+
 static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
 {
 	s64 delta_ns;
@@ -859,7 +871,7 @@ static int sugov_start(struct cpufreq_policy *policy)
 	void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
 	unsigned int cpu;
 
-	sugov_update_rate_limit_us(sg_policy);
+	sugov_update_rate_limit_us_sync(sg_policy);
 	sg_policy->last_freq_update_time	= 0;
 	sg_policy->next_freq			= 0;
 	sg_policy->work_in_progress		= false;

From 9e9554d3906cea522a437f745fe4b7765b3f27b5 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 13:24:59 +0000
Subject: [PATCH 1574/1982] PCI: xilinx-xdma: Fix device node reference leak in
 xilinx_pl_dma_pcie_init_irq_domain()

[ Upstream commit 73d3d81832708137ba6332fc011663feaf97deee ]

xilinx_pl_dma_pcie_init_irq_domain() takes a reference to the PCIe
interrupt-controller child node with of_get_child_by_name(), but the
error paths after the two irq_domain_create_linear() calls and after
xilinx_pl_dma_pcie_init_msi_irq_domain() return directly without
dropping it.  irq_domain_create_linear() gets its own reference on the
fwnode, so the domains do not consume the caller's one.

Add an err_put_node label that drops the reference before returning.

Fixes: 8d786149d78c ("PCI: xilinx-xdma: Add Xilinx XDMA Root Port driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260917132459.2153240-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-xilinx-dma-pl.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pcie-xilinx-dma-pl.c b/drivers/pci/controller/pcie-xilinx-dma-pl.c
index b037c8f315e465..e18eeecdc8a9ac 100644
--- a/drivers/pci/controller/pcie-xilinx-dma-pl.c
+++ b/drivers/pci/controller/pcie-xilinx-dma-pl.c
@@ -581,7 +581,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
 	port->pldma_domain = irq_domain_create_linear(of_fwnode_handle(pcie_intc_node), 32,
 						      &event_domain_ops, port);
 	if (!port->pldma_domain)
-		return -ENOMEM;
+		goto err_put_node;
 
 	irq_domain_update_bus_token(port->pldma_domain, DOMAIN_BUS_NEXUS);
 
@@ -589,7 +589,7 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
 						     &intx_domain_ops, port);
 	if (!port->intx_domain) {
 		dev_err(dev, "Failed to get a INTx IRQ domain\n");
-		return -ENOMEM;
+		goto err_put_node;
 	}
 
 	irq_domain_update_bus_token(port->intx_domain, DOMAIN_BUS_WIRED);
@@ -597,13 +597,17 @@ static int xilinx_pl_dma_pcie_init_irq_domain(struct pl_dma_pcie *port)
 	ret = xilinx_pl_dma_pcie_init_msi_irq_domain(port);
 	if (ret != 0) {
 		irq_domain_remove(port->intx_domain);
-		return -ENOMEM;
+		goto err_put_node;
 	}
 
 	of_node_put(pcie_intc_node);
 	raw_spin_lock_init(&port->lock);
 
 	return 0;
+
+err_put_node:
+	of_node_put(pcie_intc_node);
+	return -ENOMEM;
 }
 
 static int xilinx_pl_dma_pcie_setup_irq(struct pl_dma_pcie *port)

From 72e298e41885b1c2d029a8075ca82f10dd26c75b Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Wed, 14 Oct 2026 16:40:41 -0700
Subject: [PATCH 1575/1982] kbuild: AutoFDO: Update split machine function
 argument for upstream rename

[ Upstream commit 2b358510d5cc56164f83110ca1499c95a5a352cd ]

A recent LLVM commit [1] renamed the internal LLVM plugin option
'-split-machine-functions' to '-function-splitting=all', breaking the
AutoFDO + ThinLTO build with:

  ld.lld: error: -plugin-opt=-: ld.lld: Unknown command line argument '-split-machine-functions'.  Try: 'ld.lld --help'

The plugin option is needed for in-process ThinLTO, so handle the rename
accordingly using ld-option.

Cc: stable@vger.kernel.org
Closes: https://github.com/ClangBuiltLinux/linux/issues/2186
Fixes: 2fd65f7afd5a ("AutoFDO: Enable machine function split optimization for AutoFDO")
Link: https://github.com/llvm/llvm-project/commit/3e6acc87c58843e551d6e8e4bf06c26712b04622 [1]
Link: https://patch.msgid.link/20261014-update-autofdo-split-machine-function-option-v1-1-5c71b3005e89@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Makefile.autofdo | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Makefile.autofdo b/scripts/Makefile.autofdo
index 1caf2457e585c0..0b14a05726adac 100644
--- a/scripts/Makefile.autofdo
+++ b/scripts/Makefile.autofdo
@@ -18,7 +18,7 @@ ifdef CONFIG_LTO_CLANG_THIN
     KBUILD_LDFLAGS += --lto-sample-profile=$(CLANG_AUTOFDO_PROFILE)
   endif
   KBUILD_LDFLAGS += --mllvm=-enable-fs-discriminator=true --mllvm=-improved-fs-discriminator=true -plugin-opt=thinlto
-  KBUILD_LDFLAGS += -plugin-opt=-split-machine-functions
+  KBUILD_LDFLAGS += $(call ld-option,-plugin-opt=-function-splitting=all,-plugin-opt=-split-machine-functions)
 endif
 
 export CFLAGS_AUTOFDO_CLANG

From db482904054850558358d920b78ff057b1821575 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Fri, 25 Sep 2026 18:11:39 +0200
Subject: [PATCH 1576/1982] iommufd: Reject a zero-length dirty bitmap request

[ Upstream commit f6b3fd8f573e801066c21b2aec3d2e949e61e48e ]

iommufd_check_iova_range() subtracts one from bitmap->length before it
checks the length, so a zero-length request wraps to SIZE_MAX.  With
iova = 0 the wrapped value passes the overflow and alignment checks, and
the request reaches iova_bitmap_alloc() with length 0.

iova_bitmap_alloc() then sizes the bitmap from a length - 1 of SIZE_MAX,
so mapped_total_index is effectively unbounded.  The scan uses
last_iova = ULONG_MAX, which spans the whole IOAS when an area is mapped
at IOVA 0.  Reject a zero length before the subtraction.

Fixes: b9a60d6f850e ("iommufd: Add IOMMU_HWPT_GET_DIRTY_BITMAP")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/20260925161142.189813-4-parri.andrea@gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommufd/io_pagetable.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/iommufd/io_pagetable.c b/drivers/iommu/iommufd/io_pagetable.c
index a4d7a9d4356032..77891d4d65fb11 100644
--- a/drivers/iommu/iommufd/io_pagetable.c
+++ b/drivers/iommu/iommufd/io_pagetable.c
@@ -568,6 +568,9 @@ int iommufd_check_iova_range(struct io_pagetable *iopt,
 	size_t iommu_pgsize = iopt->iova_alignment;
 	u64 last_iova;
 
+	if (!bitmap->length)
+		return -EINVAL;
+
 	if (check_add_overflow(bitmap->iova, bitmap->length - 1, &last_iova))
 		return -EOVERFLOW;
 

From 741ac7c9673e65e5b2c02249ca9cf9c133ff21d6 Mon Sep 17 00:00:00 2001
From: Ahsan Atta <ahsan.atta@intel.com>
Date: Tue, 6 Oct 2026 16:06:47 +0100
Subject: [PATCH 1577/1982] crypto: qat - initialise state_lock on every path
 in adf_devmgr_add_dev()

[ Upstream commit 4ad7c1bd5f3dcd3fd6efbb068d6ee2a68dddfece ]

state_lock is initialised at the end of adf_devmgr_add_dev(), but the VF
on host path whose id mapping already exists returns earlier via
'goto unlock'. That mapping outlives the VF, so this path is taken every
time a VF is recreated on a BDF that already hosted one, e.g.:

	echo 0 > sriov_numvfs
	echo 32 > sriov_numvfs

accel_dev is freshly allocated on each probe, so state_lock is left zeroed
and adf_dev_up() takes an uninitialised mutex. With CONFIG_DEBUG_MUTEXES
this is reported on a dh895xcc with 32 host-bound VFs:

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
  Call Trace:
   adf_dev_up+0x27/0xe0 [intel_qat]
   adf_probe+0x700/0xa80 [qat_dh895xccvf]
   local_pci_probe+0xd5/0x190

The same happens on teardown when adf_dev_down() locks it again.

Initialise the lock next to the other per-device state, before the tables
are updated, so it is done on every path.

Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 81dd22d2083ff6..680e6557fc946f 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -137,6 +137,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
 
 	mutex_lock(&table_lock);
 	atomic_set(&accel_dev->ref_count, 0);
+	mutex_init(&accel_dev->state_lock);
 
 	/* PF on host or VF on guest - optimized to remove redundant is_vf */
 	if (!accel_dev->is_vf || !pf) {
@@ -210,7 +211,6 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
 		map->attached = true;
 		list_add_tail(&map->list, &vfs_table);
 	}
-	mutex_init(&accel_dev->state_lock);
 unlock:
 	mutex_unlock(&table_lock);
 	return ret;

From 335a0eaaa0d72197c52ba7230c869ef587904109 Mon Sep 17 00:00:00 2001
From: Ahsan Atta <ahsan.atta@intel.com>
Date: Tue, 6 Oct 2026 16:06:48 +0100
Subject: [PATCH 1578/1982] crypto: qat - fix use of destroyed vf2pf_lock on VF
 restart

[ Upstream commit 4921634ac0a9a65aaa5e41308aabda3d3f562ee3 ]

adf_dev_stop_async() sends the RESTARTING_COMPLETE message after
adf_dev_down() has returned, but adf_dev_down() already destroyed the
lock that message takes.

Both run in sequence in the same worker, so every PF restart locks a
destroyed mutex. With CONFIG_DEBUG_MUTEXES on a dh895xcc with 32 host-bound
VFs this trips on the first PF reset:

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
  Workqueue: adf_vf_stop_wq adf_dev_stop_async [intel_qat]
  Call Trace:
   adf_gen2_pfvf_send+0x210/0x530 [intel_qat]
   adf_vf2pf_notify_restart_complete+0x55/0x80 [intel_qat]
   adf_dev_stop_async+0xdb/0x140 [intel_qat]

The notification cannot move before adf_dev_down(): the PF waits for it
before its own reset and the VF must tear down its rings first.

vf2pf_lock protects the VF2PF CSR and is unrelated to the PF2VF bottom half
it is initialised alongside. Tie its lifetime to the accel device, next to
state_lock in adf_devmgr_add_dev()/adf_devmgr_rm_dev(), so it stays valid
for messages sent outside the device up/down cycle. It is only touched for
VFs, which set is_vf before adf_devmgr_add_dev() and keep it set until
adf_devmgr_rm_dev().

Fixes: 6f1b5236348f ("crypto: qat - fix recovery flow for VFs")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 8 ++++++++
 drivers/crypto/intel/qat/qat_common/adf_vf_isr.c  | 2 --
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
index 680e6557fc946f..833d3c8e4650c5 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
@@ -138,6 +138,12 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev,
 	mutex_lock(&table_lock);
 	atomic_set(&accel_dev->ref_count, 0);
 	mutex_init(&accel_dev->state_lock);
+	/*
+	 * The VF2PF lock is used to send messages to the PF outside of the
+	 * device up/down cycle, so it must live as long as the accel device.
+	 */
+	if (accel_dev->is_vf)
+		mutex_init(&accel_dev->vf.vf2pf_lock);
 
 	/* PF on host or VF on guest - optimized to remove redundant is_vf */
 	if (!accel_dev->is_vf || !pf) {
@@ -257,6 +263,8 @@ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
 		}
 	}
 unlock:
+	if (accel_dev->is_vf)
+		mutex_destroy(&accel_dev->vf.vf2pf_lock);
 	mutex_destroy(&accel_dev->state_lock);
 	list_del(&accel_dev->list);
 	mutex_unlock(&table_lock);
diff --git a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
index a4636ec9f9cac0..9ff6f664830169 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_vf_isr.c
@@ -118,7 +118,6 @@ static int adf_setup_pf2vf_bh(struct adf_accel_dev *accel_dev)
 	tasklet_init(&accel_dev->vf.pf2vf_bh_tasklet,
 		     (void *)adf_pf2vf_bh_handler, (unsigned long)accel_dev);
 
-	mutex_init(&accel_dev->vf.vf2pf_lock);
 	return 0;
 }
 
@@ -126,7 +125,6 @@ static void adf_cleanup_pf2vf_bh(struct adf_accel_dev *accel_dev)
 {
 	tasklet_disable(&accel_dev->vf.pf2vf_bh_tasklet);
 	tasklet_kill(&accel_dev->vf.pf2vf_bh_tasklet);
-	mutex_destroy(&accel_dev->vf.vf2pf_lock);
 }
 
 static irqreturn_t adf_isr(int irq, void *privdata)

From d7c633ef352783af346cfe55bbe5410ab7dd737d Mon Sep 17 00:00:00 2001
From: Fuad Tabba <fuad.tabba@linux.dev>
Date: Tue, 8 Sep 2026 15:26:31 +0100
Subject: [PATCH 1579/1982] irqchip/gic-v3-its: Don't clamp nvecs to zero when
 id_bits is 32

[ Upstream commit 5a9d62555e7164ec79a5fe70153d79cf1fdfd614 ]

GITS_TYPER_IDBITS is five bits, so id_bits reaches 32 and
min_t(unsigned int, ...) truncates BIT(32) to 0. nvecs becomes 0,
its_lpi_alloc() rejects that, and its_msi_prepare() returns -ENOMEM.
On 32-bit ARM the shift is undefined instead.

The clamp is correct for every value below the maximum, so only that
one value is affected.

Fixes: ce9e40a9a5e5c ("irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260908142632.2795308-3-fuad.tabba@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 8607ed0d98841c..4443bf46e390d7 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3488,7 +3488,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 	 * Also honor the ITS's own EID limit.
 	 */
 	id_bits = FIELD_GET(GITS_TYPER_IDBITS, its->typer) + 1;
-	nvecs = min_t(unsigned int, nvecs, BIT(id_bits));
+	nvecs = min_t(u64, nvecs, BIT_ULL(id_bits));
 	nr_ites = max(2, nvecs);
 	sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
 	sz = max(sz, ITS_ITT_ALIGN);

From aa309d71afdfba9824f1eab87f482a06bf0a3f18 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Mon, 14 Sep 2026 21:42:11 +0800
Subject: [PATCH 1580/1982] irqchip/imx-intmux: Fix runtime PM teardown on
 remove

[ Upstream commit b167c1a30e9e020e4c5e102c7a555943742c024b ]

imx_intmux_probe() enables the IPG clock and then drops its runtime PM
reference with pm_runtime_put(). With CONFIG_PM enabled, the runtime
suspend callback disables the IPG clock. With CONFIG_PM disabled, the
clock remains enabled after probe.

imx_intmux_remove() accesses the CHANIER registers without first making
sure that the device is runtime active. The device may therefore be
runtime suspended with the IPG clock disabled when these registers are
accessed. In addition, the remove path only calls pm_runtime_disable()
and does not balance the clock enable when CONFIG_PM is disabled.

Resume the device and acquire a runtime PM reference before accessing
the registers. If resume fails, skip the register accesses but still
tear down the chained handlers and IRQ domains. Disable runtime PM
afterwards, drop the acquired reference without triggering another
runtime suspend, and explicitly disable the IPG clock.

This keeps the clock enabled while the hardware registers are accessed
and balances the clk_prepare_enable() performed during probe for both
CONFIG_PM configurations.

This issue was found by manual code inspection.

Fixes: bb403111e017 ("irqchip/imx-intmux: Implement intmux runtime power management")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260914134211.1734163-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-imx-intmux.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-imx-intmux.c b/drivers/irqchip/irq-imx-intmux.c
index 5f9b204d350b2b..18e214e5b1b59d 100644
--- a/drivers/irqchip/irq-imx-intmux.c
+++ b/drivers/irqchip/irq-imx-intmux.c
@@ -289,12 +289,16 @@ static int imx_intmux_probe(struct platform_device *pdev)
 static void imx_intmux_remove(struct platform_device *pdev)
 {
 	struct intmux_data *data = platform_get_drvdata(pdev);
-	int i;
+	int i, ret;
+
+	ret = pm_runtime_resume_and_get(&pdev->dev);
+	if (ret < 0)
+		dev_warn(&pdev->dev, "failed to resume device: %d\n", ret);
 
 	for (i = 0; i < data->channum; i++) {
 		/* disable all interrupt sources of this channel */
-		writel_relaxed(0, data->regs + CHANIER(i));
-
+		if (ret >= 0)
+			writel_relaxed(0, data->regs + CHANIER(i));
 		irq_set_chained_handler_and_data(data->irqchip_data[i].irq,
 						 NULL, NULL);
 
@@ -302,6 +306,11 @@ static void imx_intmux_remove(struct platform_device *pdev)
 	}
 
 	pm_runtime_disable(&pdev->dev);
+	if (ret >= 0) {
+		pm_runtime_put_noidle(&pdev->dev);
+		clk_disable_unprepare(data->ipg_clk);
+		pm_runtime_set_suspended(&pdev->dev);
+	}
 }
 
 #ifdef CONFIG_PM

From 537b8eabc1c391b3f85509ac41cb2be2cd862a8e Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Wed, 16 Sep 2026 19:03:49 +0000
Subject: [PATCH 1581/1982] irqchip/mchp-eic: Fix clock reference leak in
 mchp_eic_probe()

[ Upstream commit af9c707eb065a7d48eb92dc15acdb4346acf5db0 ]

of_clk_get_by_name() returns the clock with an elevated reference count
that mchp_eic_probe() keeps for the lifetime of the driver, but none of
the probe error paths drops it, so the reference is leaked whenever
probe fails after the clock has been obtained.

Put the reference in the error cleanup.  The clk_prepare_enable()
failure path must jump there directly as it cannot call
clk_disable_unprepare() on a clock that was never enabled.

Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916190349.2094401-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-mchp-eic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index 31093a8ab67c3a..82cb0513bbb8d9 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -233,7 +233,7 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
 
 	ret = clk_prepare_enable(eic->clk);
 	if (ret)
-		goto unmap;
+		goto clk_put;
 
 	for (i = 0; i < MCHP_EIC_NIRQ; i++) {
 		struct of_phandle_args irq;
@@ -270,6 +270,8 @@ static int mchp_eic_probe(struct platform_device *pdev, struct device_node *pare
 
 clk_unprepare:
 	clk_disable_unprepare(eic->clk);
+clk_put:
+	clk_put(eic->clk);
 unmap:
 	iounmap(eic->base);
 free:

From ce6abad3ea47d8a463f7f3f0de098b7c92f6c4a8 Mon Sep 17 00:00:00 2001
From: Karl Mehltretter <kmehltretter@gmail.com>
Date: Sat, 26 Sep 2026 02:41:24 +0200
Subject: [PATCH 1582/1982] irqchip/atmel-aic[5]: Disable interrupts in the
 irq_pm_shutdown() callbacks

[ Upstream commit 0ca21fe111457c843624a835641bb490e704bb2f ]

irq_gc_shutdown() calls the irq_pm_shutdown() callbacks from
syscore_shutdown() with interrupts enabled. aic_pm_shutdown() and
aic5_pm_shutdown() take the generic chip lock with raw_spin_lock(), and
irq_gc_eoi() takes the same lock from the interrupt handler. An
interrupt from the chip while the lock is held spins in irq_gc_eoi()
and hangs the reboot.

Lockdep reports this on every reboot of a SAM9X75 Curiosity board:

  WARNING: inconsistent lock state
  inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
  busybox/101 [HC0[0]:SC0[0]:HE1:SE1] takes:
  c1c2b434 (&gc->lock){?.-.}-{2:2}, at: aic5_pm_shutdown+0x34/0xd8
  {IN-HARDIRQ-W} state was registered at:
    ...
    irq_gc_eoi+0x28/0x60
    handle_fasteoi_irq+0x120/0x214
  ...
   aic5_pm_shutdown from irq_gc_shutdown+0x4c/0x58
   irq_gc_shutdown from syscore_shutdown+0x5c/0x9c
   syscore_shutdown from kernel_restart+0x34/0x78
   kernel_restart from sys_reboot+0x180/0x25c

Use the irqsave guard, as
commit 33517881ede7 ("irqchip/brcmstb-l2: Use _irqsave locking variants in non-interrupt code")
did for brcmstb-l2.

Fixes: b1479ebb7720 ("irqchip: atmel-aic: Add atmel AIC/AIC5 drivers")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Reviewed-by: Radu Rendec <radu@rendec.net>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260926004124.88221-1-kmehltretter@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-atmel-aic.c  | 2 +-
 drivers/irqchip/irq-atmel-aic5.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 1dcc52760ecaee..4a7935e75e4dd9 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -123,7 +123,7 @@ static void aic_pm_shutdown(struct irq_data *d)
 {
 	struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
 
-	guard(raw_spinlock)(&gc->lock);
+	guard(raw_spinlock_irqsave)(&gc->lock);
 	irq_reg_writel(gc, 0xffffffff, AT91_AIC_IDCR);
 	irq_reg_writel(gc, 0xffffffff, AT91_AIC_ICCR);
 }
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 1f14b401f71d0d..07a317ed06ef43 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -217,7 +217,7 @@ static void aic5_pm_shutdown(struct irq_data *d)
 	struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
 	int i;
 
-	guard(raw_spinlock)(&bgc->lock);
+	guard(raw_spinlock_irqsave)(&bgc->lock);
 	for (i = 0; i < dgc->irqs_per_chip; i++) {
 		irq_reg_writel(bgc, i + gc->irq_base, AT91_AIC5_SSR);
 		irq_reg_writel(bgc, 1, AT91_AIC5_IDCR);

From 443730e39b1b79a68ef9220124fb0bbb0bf1bc6d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 15 Oct 2026 09:54:38 +0200
Subject: [PATCH 1583/1982] ALSA: ump: Correct return size of fill_rpn()

[ Upstream commit 85e8c5f933ee3dbc9d061e121237797e9fa05315 ]

The RPN/NRPN conversion in fill_rpn() is supposed to return the number
of bytes of the resultant UMP packet, but it returns boolean values.
This would result in the incorrect ump_bytes in the converter, which
will confuse stream processing.  Correct to the right value 8 as a MIDI
2.0 UMP packet.

Fixes: e6ce8a28c768 ("ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception")
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261015075439.50088-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/ump_convert.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/ump_convert.c b/sound/core/ump_convert.c
index 85cc67de633062..0a7972d91ec52c 100644
--- a/sound/core/ump_convert.c
+++ b/sound/core/ump_convert.c
@@ -323,7 +323,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc,
 					      cc->cc_data_lsb);
 
 	reset_rpn(cc);
-	return 1;
+	return 8;
 }
 
 /* convert to a MIDI 1.0 Channel Voice message */

From a59760cefb24e186b017e48caa5b71b31b696130 Mon Sep 17 00:00:00 2001
From: Tal Zussman <tz2294@columbia.edu>
Date: Wed, 14 Oct 2026 20:36:43 -0400
Subject: [PATCH 1584/1982] gfs2: fix the escaped block copy in
 gfs2_before_commit()

[ Upstream commit 1a4aeb6d6a08af1a2e2c52c84170561625819377 ]

Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where
appropriate") made the escaped buffer copy read from the mempool page
it had just allocated instead of from the buffer, so the block written
to the log is whatever the pool page last held. If the journal is
replayed after a crash, the block is restored from that and the file's
data is corrupted. Only escaped buffers are affected: jdata blocks
whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio
instead.

Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/lops.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 0ed81a685fcd09..59e3d295a2a173 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -690,7 +690,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit,
 
 				page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
 				p = page_address(page);
-				memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size);
+				memcpy_from_folio(p, bd2->bd_bh->b_folio,
+						  bh_offset(bd2->bd_bh),
+						  bd2->bd_bh->b_size);
 				*(__be32 *)p = 0;
 				clear_buffer_escaped(bd2->bd_bh);
 				unlock_buffer(bd2->bd_bh);

From 9c9bbb6a878056447dac471bbe73b4aa93085b01 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Wed, 14 Oct 2026 22:18:50 +0800
Subject: [PATCH 1585/1982] spi: jcore: fix divide-by-zero when speed_hz is
 zero

[ Upstream commit 7db773075501248893c22b11bedc6745d6d0be45 ]

jcore_spi_baudrate() computes hw->clock_freq / 2 / speed without
validating speed. The SPI core fills transfer.speed_hz from
spi->max_speed_hz when it is zero, and jcore_spi_probe() never sets
host->max_speed_hz, so the clamp in __spi_setup() is skipped. A
spi_device created via the sysfs new_device interface (or a DT node
without spi-max-frequency) therefore has max_speed_hz == 0, and any
SPI_IOC_MESSAGE transfer reaches jcore_spi_baudrate() with speed == 0,
causing a division by zero and a kernel panic.

Clamp speed to a minimum of 1 Hz before the division so the divisor is
never zero. The computed divider then truncates to the register field
width and the transfer simply runs at the slowest supported rate.

Verified by inspection of the __spi_setup() clamp and
__spi_validate()'s speed_hz handling; the division-by-zero path
requires the J-Core controller, which was not available.

Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 2cb1b3b3ac0a ("spi: add driver for J-Core SPI controller")
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-jcore-divzero-v1-1-a8205d30f2d1@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-jcore.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-jcore.c b/drivers/spi/spi-jcore.c
index e37ca22e04ba6d..2bde899eb2b499 100644
--- a/drivers/spi/spi-jcore.c
+++ b/drivers/spi/spi-jcore.c
@@ -84,6 +84,8 @@ static void jcore_spi_baudrate(struct jcore_spi *hw, int speed)
 {
 	if (speed == hw->speed_hz)
 		return;
+	if (speed <= 0)
+		speed = 1;
 	hw->speed_hz = speed;
 	if (speed >= hw->clock_freq / 2)
 		hw->speed_reg = 0;

From e9c140e506617e2d71d522ed900f0c9be27faac9 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Thu, 15 Oct 2026 13:38:58 +0200
Subject: [PATCH 1586/1982] efi/libstub: arm64: Don't use the platform register
 x18

[ Upstream commit 4c86b5f3fa78347fa9cbc9e8ec06615b2f80e397 ]

The UEFI specification designates x18, the platform register, as "do not
use" on AArch64, so that UEFI code is compatible both with an OS that
assigns a fixed role to x18, and with one that uses it as a temporary
register.

The arm64 EFI stub and the EFI zboot decompressor only avoid x18 if the
kernel is built with shadow call stacks, as that is the only case where
-ffixed-x18 is added to KBUILD_CFLAGS, which the stub inherits.
Otherwise, the compiler is free to use x18 as a temporary register, and
it does so.

So pass -ffixed-x18 unconditionally when building the stub for arm64,
so that the image can be run by loaders that rely on x18 being left
alone, such as a kernel that uses it for its shadow call stack.

Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/libstub/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 94b05e4451dd3f..c532ba55035229 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -22,7 +22,7 @@ cflags-$(CONFIG_X86)		+= -m$(BITS) -D__KERNEL__ -std=gnu11 \
 
 # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
 # disable the stackleak plugin
-cflags-$(CONFIG_ARM64)		+= -fpie $(DISABLE_KSTACK_ERASE) \
+cflags-$(CONFIG_ARM64)		+= -fpie $(DISABLE_KSTACK_ERASE) -ffixed-x18 \
 				   -fno-unwind-tables -fno-asynchronous-unwind-tables
 cflags-$(CONFIG_ARM)		+= -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \
 				   -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \

From d93e70dca09ab7ae0d5aab6b4f5e5374a32913a5 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Mon, 12 Oct 2026 14:06:12 +0200
Subject: [PATCH 1587/1982] efi/libstub: Don't replace an existing
 LINUX_EFI_MEMRESERVE table

[ Upstream commit aaf3ed0f46298e18ec8bc477cf0a37478e41f2ea ]

The LINUX_EFI_MEMRESERVE table is the root of a linked list of memory
reservations that need to persist across kexec, such as the GICv3 LPI
pending and property tables, which cannot be moved once the
redistributors have been enabled. Each kernel adds its own reservations
to the list that it finds via the EFI configuration table, and honours
the ones made by its predecessors.

The EFI stub installs a new, empty table unconditionally, replacing any
existing one. This is fine on a cold boot, but not if the stub is being
executed by a loader that passes on the configuration tables of an
earlier kernel, e.g., a kexec loader that runs the incoming kernel's EFI
stub, as the reservations made by earlier kernels would be lost.

So leave an existing table in place, and only install a new one if none
exists yet.

Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/libstub/efi-stub.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
index 874f63b4a3830c..adc5d121a33c5e 100644
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -73,6 +73,14 @@ static void install_memreserve_table(void)
 	efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
 	efi_status_t status;
 
+	/*
+	 * If an earlier boot stage installed a memreserve table already, e.g.,
+	 * a kexec loader passing on the persistent reservations made by the
+	 * previous kernel, use it as is: installing a new one would replace it.
+	 */
+	if (get_efi_config_table(memreserve_table_guid))
+		return;
+
 	status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
 			     (void **)&rsv);
 	if (status != EFI_SUCCESS) {

From 4c5b129a54498f18d9171e58dbc15e4800387274 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Thu, 15 Oct 2026 11:05:34 +0100
Subject: [PATCH 1588/1982] KVM: arm64: Move OUTSIDE_GUEST_MODE publication
 past context being saved

[ Upstream commit 1d4ce2901f1e25b06d447c0b02d105d6dd3550d8 ]

OUTSIDE_GUEST_MODE indicates to the rest of KVM that the vcpu has
exited. So far, this is set as soon as we return from the notional
hypervisor (which with VHE is just a function call away).

However, code that uses OUTSIDE_GUEST_MODE as a synchronisation point
relies on the vcpu state to have been written back to the in-memory
structures. Clearly, this is not what is happening.

Move the publication of OUTSIDE_GUEST_MODE to the point where the state
is actually written, and give this write release semantics to ensure the
correct ordering.

Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-3-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/arm.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index b52c162cb380e5..ab01b6c961132a 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1242,13 +1242,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
 
 		if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
-			vcpu->mode = OUTSIDE_GUEST_MODE;
 			isb(); /* Ensure work in x_flush_hwstate is committed */
 			if (kvm_vcpu_has_pmu(vcpu))
 				kvm_pmu_sync_hwstate(vcpu);
 			if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 				kvm_timer_sync_user(vcpu);
 			kvm_vgic_sync_hwstate(vcpu);
+			smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
 			local_irq_enable();
 			preempt_enable();
 			continue;
@@ -1264,7 +1264,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 
 		ret = kvm_arm_vcpu_enter_exit(vcpu);
 
-		vcpu->mode = OUTSIDE_GUEST_MODE;
 		vcpu->stat.exits++;
 		/*
 		 * Back from guest
@@ -1298,6 +1297,13 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 
 		kvm_arch_vcpu_ctxsync_fp(vcpu);
 
+		/*
+		 * The state that was pushed into the CPU on entering
+		 * the guest has been synchronised back, let's
+		 * advertise we're outside of the guest.
+		 */
+		smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
+
 		/*
 		 * We must ensure that any pending interrupts are taken before
 		 * we exit guest timing so that timer ticks are accounted as

From cbf52d6ce1d9861b15adc8a5aca90791361c6415 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Thu, 15 Oct 2026 11:05:35 +0100
Subject: [PATCH 1589/1982] KVM: arm64: Move IN_GUEST_MODE ahead of state being
 loaded

[ Upstream commit 22b6557ad05bf05c73246f62c19af3e04017270e ]

IN_GUEST_MODE is advertised too late, when state has already been moved
onto CPU registers and cannot be observed by another CPU anymore.

Move the IN_GUEST_MODE publication ahead of the state being loaded, and
immediately check for pending request. This ensures that there is no
window of opportunity for another CPU to observe OUTSIDE_GUEST_MODE and
yet for state to be loaded.

This also simplifies the "state rollback", which solely amounts to
synchronising the timer when no irqchip is present.

Cc: stable@vger.kernel.org
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261015100539.1011760-4-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/arm.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index ab01b6c961132a..c8a8d9ce4b14e4 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1229,31 +1229,33 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
 
 		local_irq_disable();
 
-		kvm_vgic_flush_hwstate(vcpu);
-
-		kvm_pmu_update_vcpu_events(vcpu);
-
 		/*
 		 * Ensure we set mode to IN_GUEST_MODE after we disable
 		 * interrupts and before the final VCPU requests check.
 		 * See the comment in kvm_vcpu_exiting_guest_mode() and
 		 * Documentation/virt/kvm/vcpu-requests.rst
+		 *
+		 * Requests to self must be posted before this point, or
+		 * won't be taken into account until the next exit. No state
+		 * loading other than what happens at vcpu_load() time can
+		 * be done before we have checked for pending requests.
 		 */
 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
 
 		if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
-			isb(); /* Ensure work in x_flush_hwstate is committed */
-			if (kvm_vcpu_has_pmu(vcpu))
-				kvm_pmu_sync_hwstate(vcpu);
 			if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
 				kvm_timer_sync_user(vcpu);
-			kvm_vgic_sync_hwstate(vcpu);
 			smp_store_release(&vcpu->mode, OUTSIDE_GUEST_MODE);
 			local_irq_enable();
 			preempt_enable();
 			continue;
 		}
 
+		/* From here onwards, we are commited to entering the guest */
+		kvm_vgic_flush_hwstate(vcpu);
+
+		kvm_pmu_update_vcpu_events(vcpu);
+
 		kvm_arch_vcpu_ctxflush_fp(vcpu);
 
 		/**************************************************************

From a2045078fe85918054462348c3e3ee9d628a125b Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Thu, 15 Oct 2026 11:05:36 +0100
Subject: [PATCH 1590/1982] KVM: arm64: Turn vcpu->arch.pause into a counter

[ Upstream commit e64309198eda29415a95113def92aa40196cd422 ]

We have situations where we can call kvm_arm_halt_guest() without
holding config_lock, which means that halt and resume can overlap in
funny ways when called from separate contexts, and result in situations
where a vcpu is resumed while other parts of KVM assume it is halted.
Consequences are left to the imagination of the reader.

Fix this sorry situation by turning kvm_vcpu_arch::pause into an
atomic counter, which makes the races described above harmless.

Fixes: 3b92830ad41b2 ("KVM: arm/arm64: implement kvm_arm_[halt,resume]_guest")
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015100539.1011760-5-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/kvm_host.h |  7 +++----
 arch/arm64/kvm/arm.c              | 21 ++++++++++++---------
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 419e37112a6f02..b7334f98deaac8 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -833,11 +833,10 @@ struct kvm_vcpu_arch {
 	/*
 	 * Don't run the guest (internal implementation need).
 	 *
-	 * Contrary to the flags above, this is set/cleared outside of
-	 * a vcpu context, and thus cannot be mixed with the flags
-	 * themselves (or the flag accesses need to be made atomic).
+	 * Contrary to the flags above, this is updated outside of
+	 * a vcpu context, and thus cannot be mixed with the flags.
 	 */
-	bool pause;
+	atomic_t pause;
 
 	/*
 	 * We maintain more than a single set of debug registers to support
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index c8a8d9ce4b14e4..4e0db01a528a8a 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -500,6 +500,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
 	kvm_arm_pvtime_vcpu_init(&vcpu->arch);
 
 	vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
+	atomic_set(&vcpu->arch.pause, 0);
 
 	/*
 	 * This vCPU may have been created after mpidr_data was initialized.
@@ -765,6 +766,11 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
 	return ret;
 }
 
+static bool vcpu_can_run(struct kvm_vcpu *vcpu)
+{
+	return !kvm_arm_vcpu_stopped(vcpu) && !atomic_read(&vcpu->arch.pause);
+}
+
 /**
  * kvm_arch_vcpu_runnable - determine if the vcpu can be scheduled
  * @v:		The VCPU pointer
@@ -780,8 +786,7 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
 		      (kvm_timer_should_notify_user(v) ||
 		       kvm_pmu_should_notify_user(v)));
 
-	return ((irq_lines || kvm_vgic_vcpu_pending_irq(v))
-		&& !kvm_arm_vcpu_stopped(v) && !v->arch.pause);
+	return ((irq_lines || kvm_vgic_vcpu_pending_irq(v)) && vcpu_can_run(v));
 }
 
 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
@@ -937,7 +942,7 @@ void kvm_arm_halt_guest(struct kvm *kvm)
 	struct kvm_vcpu *vcpu;
 
 	kvm_for_each_vcpu(i, vcpu, kvm)
-		vcpu->arch.pause = true;
+		atomic_inc(&vcpu->arch.pause);
 	kvm_make_all_cpus_request(kvm, KVM_REQ_SLEEP);
 }
 
@@ -947,8 +952,8 @@ void kvm_arm_resume_guest(struct kvm *kvm)
 	struct kvm_vcpu *vcpu;
 
 	kvm_for_each_vcpu(i, vcpu, kvm) {
-		vcpu->arch.pause = false;
-		__kvm_vcpu_wake_up(vcpu);
+		if (atomic_dec_and_test(&vcpu->arch.pause))
+			__kvm_vcpu_wake_up(vcpu);
 	}
 }
 
@@ -956,11 +961,9 @@ static void kvm_vcpu_sleep(struct kvm_vcpu *vcpu)
 {
 	struct rcuwait *wait = kvm_arch_vcpu_get_wait(vcpu);
 
-	rcuwait_wait_event(wait,
-			   (!kvm_arm_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
-			   TASK_INTERRUPTIBLE);
+	rcuwait_wait_event(wait, vcpu_can_run(vcpu), TASK_INTERRUPTIBLE);
 
-	if (kvm_arm_vcpu_stopped(vcpu) || vcpu->arch.pause) {
+	if (!vcpu_can_run(vcpu)) {
 		/* Awaken to handle a signal, request we sleep again later. */
 		kvm_make_request(KVM_REQ_SLEEP, vcpu);
 	}

From 4a8f333446c10d361782aa4dcb7833d30cf5c154 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Thu, 15 Oct 2026 10:10:12 +0800
Subject: [PATCH 1591/1982] spi: npcm-fiu: limit UMA data_size to the 16-byte
 staging buffer

[ Upstream commit f0be928a41384ea93c876364f360779f70359249 ]

npcm_fiu_uma_read() and npcm_fiu_uma_write() use a 16-byte on-stack
staging buffer (u32 data_reg[4]) and move data_size bytes to or from
it. data_size comes straight from op->data.nbytes, which is supplied
by the SPI MEM operation and is not bounded by the driver:
npcm_fiu_exec_op() only validates op->addr.nbytes, and no
adjust_op_size callback truncates the transfer to the controller FIFO
size.

A SPI MEM operation with addr.nbytes == 0 and data.nbytes > 16
therefore overflows data_reg[] on the kernel stack (write path) or
reads past it (read path), corrupting the stack.

Reject data_size larger than the staging buffer in both UMA helpers
by returning -EOPNOTSUPP, so spi_mem falls back to the generic SPI
message path. The chunked path in npcm_fiu_manualwrite() always passes
at most CHUNK_SIZE bytes, so it is unaffected.

Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Cc: stable@vger.kernel.org # 5.4+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-npcm-fiu-uma-datasize-v1-1-7dee91cadee6@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-npcm-fiu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
index cccd17f247754d..79328ae89fbb70 100644
--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -343,6 +343,10 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
 	u32 val;
 	u32 i;
 
+	/* data_reg holds at most 16 bytes */
+	if (data_size > sizeof(data_reg))
+		return -EOPNOTSUPP;
+
 	regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
 			   NPCM_FIU_UMA_CTS_DEV_NUM,
 			   (spi_get_chipselect(mem->spi, 0) <<
@@ -398,6 +402,10 @@ static int npcm_fiu_uma_write(struct spi_mem *mem,
 	u32 val;
 	u32 i;
 
+	/* data_reg holds at most 16 bytes */
+	if (data_size > sizeof(data_reg))
+		return -EOPNOTSUPP;
+
 	regmap_update_bits(fiu->regmap, NPCM_FIU_UMA_CTS,
 			   NPCM_FIU_UMA_CTS_DEV_NUM,
 			   (spi_get_chipselect(mem->spi, 0) <<

From c4ac68d07c812bf59a62d399a79e8fa4ca3fdf58 Mon Sep 17 00:00:00 2001
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Date: Fri, 2 Oct 2026 11:36:52 +0000
Subject: [PATCH 1592/1982] mfd: tps65217: Fix NULL pointer dereference on IRQ
 init failure

[ Upstream commit 0473a5b0663663b75573bf284beb77459e07c461 ]

tps65217_probe() ignores the return value of tps65217_irq_init(), so
when the irq domain creation fails the probe still completes and the
driver ends up bound with a NULL tps->irq_domain. Unloading the
module then makes tps65217_remove() call irq_domain_remove() on the
NULL pointer and oops the kernel. On top of that, irq_find_mapping()
may fall back to the default irq domain and dispose of mappings that
belong to other interrupt controllers.

Check the return value and abort the probe on failure so the error
is reported and no inconsistent state is left for removal.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20261002113624.178588-2-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/tps65217.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede76d..2d04d9e0ae29cd 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -333,7 +333,9 @@ static int tps65217_probe(struct i2c_client *client)
 	}
 
 	if (client->irq) {
-		tps65217_irq_init(tps, client->irq);
+		ret = tps65217_irq_init(tps, client->irq);
+		if (ret)
+			return ret;
 	} else {
 		int i;
 

From 081e702e1a4aaa9f03a43d576724091b345fc429 Mon Sep 17 00:00:00 2001
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Date: Fri, 2 Oct 2026 11:36:53 +0000
Subject: [PATCH 1593/1982] mfd: tps65217: Check return value when masking
 interrupt sources

[ Upstream commit 66ed12c1e5a986bee1dc63f9bd9c7f068138a69a ]

tps65217_irq_init() ignores the error returned by
tps65217_set_bits() when masking all interrupt sources. A failed
register write leaves the driver's software mask out of sync with the
hardware and may result in spurious interrupts.

Check the return value and propagate the error to the caller.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-3-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/tps65217.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index 2d04d9e0ae29cd..ee640e3fcf7b42 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -155,8 +155,12 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
 
 	/* Mask all interrupt sources */
 	tps->irq_mask = TPS65217_INT_MASK;
-	tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
-			  TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+	ret = tps65217_set_bits(tps, TPS65217_REG_INT, TPS65217_INT_MASK,
+				TPS65217_INT_MASK, TPS65217_PROTECT_NONE);
+	if (ret) {
+		dev_err(tps->dev, "Failed to mask interrupt sources: %d\n", ret);
+		return ret;
+	}
 
 	tps->irq_domain = irq_domain_create_linear(dev_fwnode(tps->dev), TPS65217_NUM_IRQ,
 						   &tps65217_irq_domain_ops, tps);

From 42e39e25b62e2d0b63e8cf0426b720b486353ecc Mon Sep 17 00:00:00 2001
From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Date: Fri, 2 Oct 2026 11:36:54 +0000
Subject: [PATCH 1594/1982] mfd: tps65217: Use devres for IRQ domain and wake
 teardown

[ Upstream commit cffd44d2d89524e2dda6adc7b0dd59363be1c8e6 ]

Removing the parent device used to tear the IRQ domain down in
tps65217_remove() before the MFD children are unbound: the i2c core
only releases the parent's devres after the remove callback returns,
whereas devm_mfd_add_devices() registered its own devres action which
unbinds the children. Children that requested interrupts from the
domain (e.g. tps65217-charger) therefore call free_irq() on virtual
IRQs whose descriptors have already been disposed. With
CONFIG_SPARSE_IRQ free_irq() then returns early without stopping the
threaded handler, leaking the irqaction, the IRQ kthread and a module
reference.

Register the domain teardown as a devres action right after the domain
is created instead. Devres actions are released in reverse order of
registration, so the MFD children release their IRQs first, then the
parent interrupt is freed and its thread stopped, and only then is the
domain torn down. The same ordering covers probe failure, which no
longer needs manual cleanup, and the remove callback can be dropped
entirely.

Balance the enable_irq_wake() in tps65217_irq_init() by registering
disable_irq_wake() as a devres action as well. Only do so when
enabling actually succeeded, since the parent chip may not support
setting wake-up.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
Link: https://patch.msgid.link/20261002113624.178588-4-r.zhambakiev@prosoftsystems.ru
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/tps65217.c | 57 +++++++++++++++++++++++++++++-------------
 1 file changed, 39 insertions(+), 18 deletions(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index ee640e3fcf7b42..569c28c8b20f5a 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -146,6 +146,31 @@ static const struct irq_domain_ops tps65217_irq_domain_ops = {
 	.map = tps65217_irq_map,
 };
 
+static void tps65217_irq_cleanup(void *data)
+{
+	struct tps65217 *tps = data;
+	unsigned int virq;
+
+	if (!tps->irq_domain)
+		return;
+
+	for (int i = 0; i < TPS65217_NUM_IRQ; i++) {
+		virq = irq_find_mapping(tps->irq_domain, i);
+		if (virq)
+			irq_dispose_mapping(virq);
+	}
+
+	irq_domain_remove(tps->irq_domain);
+	tps->irq_domain = NULL;
+}
+
+static void tps65217_irq_wake_disable(void *data)
+{
+	unsigned long irq = (unsigned long)data;
+
+	disable_irq_wake(irq);
+}
+
 static int tps65217_irq_init(struct tps65217 *tps, int irq)
 {
 	int ret;
@@ -169,6 +194,10 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
 		return -ENOMEM;
 	}
 
+	ret = devm_add_action_or_reset(tps->dev, tps65217_irq_cleanup, tps);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(tps->dev, irq, NULL,
 					tps65217_irq_thread, IRQF_ONESHOT,
 					"tps65217-irq", tps);
@@ -178,7 +207,16 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
 		return ret;
 	}
 
-	enable_irq_wake(irq);
+	ret = enable_irq_wake(irq);
+	if (ret) {
+		dev_warn(tps->dev, "failed to enable IRQ wake: %d\n", ret);
+		return 0;
+	}
+
+	ret = devm_add_action_or_reset(tps->dev, tps65217_irq_wake_disable,
+				       (void *)(unsigned long)irq);
+	if (ret)
+		return ret;
 
 	return 0;
 }
@@ -379,22 +417,6 @@ static int tps65217_probe(struct i2c_client *client)
 	return 0;
 }
 
-static void tps65217_remove(struct i2c_client *client)
-{
-	struct tps65217 *tps = i2c_get_clientdata(client);
-	unsigned int virq;
-	int i;
-
-	for (i = 0; i < TPS65217_NUM_IRQ; i++) {
-		virq = irq_find_mapping(tps->irq_domain, i);
-		if (virq)
-			irq_dispose_mapping(virq);
-	}
-
-	irq_domain_remove(tps->irq_domain);
-	tps->irq_domain = NULL;
-}
-
 static const struct i2c_device_id tps65217_id_table[] = {
 	{"tps65217", TPS65217},
 	{ /* sentinel */ }
@@ -408,7 +430,6 @@ static struct i2c_driver tps65217_driver = {
 	},
 	.id_table	= tps65217_id_table,
 	.probe		= tps65217_probe,
-	.remove		= tps65217_remove,
 };
 
 static int __init tps65217_init(void)

From 258d92898ea3095c7363f646aad82ff7c06c5d0b Mon Sep 17 00:00:00 2001
From: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Date: Wed, 14 Oct 2026 19:27:01 +0300
Subject: [PATCH 1595/1982] ASoC: qcom: q6apm: reset the hw pointer with the
 fragment queue

[ Upstream commit 0337b8129cf676b8eb767b2a1f312955760a5460 ]

On every prepare in queue mode, q6apm_dai_prepare() frees and allocates
the fragments again, and q6apm_alloc_fragments() resets dsp_buf, so the
first buffer queued after it is the first one of the ring. The hw
pointer that q6apm_dai_pointer() reports is left as it was.

q6apm-dai used to keep its own position and cleared it in prepare.
Since commit a93dad6f4e6a ("ASoC: q6apm-dai: make use of
q6apm_get_hw_pointer") the position comes from the hw pointer, so a
stream that is prepared again, e.g. to recover from an xrun, reports
the position of the previous run until the DSP returns its first
buffer, while ALSA has reset its own pointer to 0.

Reset the hw pointer together with dsp_buf.

Fixes: a93dad6f4e6a ("ASoC: q6apm-dai: make use of q6apm_get_hw_pointer")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Vladyslav Tymoshchuk <tvlad744@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261014162703.10172-3-tvlad744@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/qdsp6/q6apm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 9122876e00a2a9..50d5d2143daaff 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -223,6 +223,7 @@ int q6apm_map_memory_regions(struct q6apm_graph *graph, unsigned int dir, phys_a
 	mutex_lock(&graph->lock);
 
 	data->dsp_buf = 0;
+	atomic_set(&data->hw_ptr, 0);
 
 	if (data->buf) {
 		mutex_unlock(&graph->lock);

From 67221e6133a92aeabebb1ec4497234643a7b7745 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Thu, 15 Oct 2026 10:16:12 +0800
Subject: [PATCH 1596/1982] spi: bcm-qspi: reject oversized dummy bytes in mspi
 exec_mem_op

[ Upstream commit 9e44f0df3fff215d9033089e85980048c3ac132a ]

bcm_qspi_mspi_exec_mem_op() builds a local command buffer cmd[6]
holding one opcode byte, up to four address bytes and one spare
byte, and sets t[0].len = op->addr.nbytes + op->dummy.nbytes + 1.
bcm_qspi_exec_mem_op() only validates op->addr.nbytes <= 4 and never
bounds op->dummy.nbytes, which spi_mem_check_op() also leaves
unrestricted. With addr.nbytes = 4 and dummy.nbytes >= 2 the length
becomes 7 or more, so write_to_hw() reads past cmd[] on the kernel
stack and pushes the leaked bytes into the hardware TXRAM.

Reject operations whose dummy phase does not fit the remaining byte
of cmd[] by requiring op->dummy.nbytes <= 1, so such transfers fall
back to the generic SPI path instead of overrunning the buffer.

Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Fixes: 5f195ee7d830c ("spi: bcm-qspi: Implement the spi_mem interface")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261015-bcm-qspi-dummy-bytes-v1-1-c319da3c2497@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm-qspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index ae5545be0a45ca..de333a4a3200d4 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1197,8 +1197,9 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
 	u32 addr = 0, len;
 	u_char *buf;
 
+	/* cmd[] holds 1 opcode + 4 address + 1 dummy byte at most */
 	if (!op->data.nbytes || !op->addr.nbytes || op->addr.nbytes > 4 ||
-	    op->data.dir != SPI_MEM_DATA_IN)
+	    op->dummy.nbytes > 1 || op->data.dir != SPI_MEM_DATA_IN)
 		return -EOPNOTSUPP;
 
 	buf = op->data.buf.in;

From 95b03c926dcce21ba9271ddb4799e372512261b3 Mon Sep 17 00:00:00 2001
From: Keng-Yu Lin <keng-yu.lin@hpe.com>
Date: Thu, 15 Oct 2026 10:08:11 +0800
Subject: [PATCH 1597/1982] PCI/PM: Restore BARs after powering up during
 enumeration

[ Upstream commit f043083843cac1105206437d8c58e725b6412fad ]

Commit 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when
initializing") added pci_pm_power_up_and_verify_state() to pci_pm_init().
The helper ignores pci_power_up()'s return value indicating that BARs need
restoring. Its resume callers restore saved configuration afterwards;
pci_pm_init() does not.

D3hot-to-D0 may reset a device and lose its BARs (PCI PM 1.2, sec 5.4.1).
After enumeration powers it up, pci_enable_device() reads D0 and skips the
full power-up path. Previously, a device still in D3hot at enable time took
that path, including BAR restoration.

On AMD Venice SP7, two AMD xHCI controllers [1022:17d2] are in runtime
D3hot with No_Soft_Reset clear before kdump. Diagnostic reads on
v7.3-rc6-37 show the following for 0000:01:00.4 in the crash kernel:

                                   PMCSR      BAR0
  before the platform power call   0003       f4100004
  after the platform power call    0003       f4100004
  after native D0 power-up         0000       00000004

The upper BAR DWORD stays zero. pci_power_up() returns 1, but the BAR
address remains zero while dev->resource[0] still contains 0xf4100000.
Without BAR restoration, the crash kernel hangs during boot. The last
console output includes:

  pci 0000:01:00.4: enabling device (0000 -> 0002)

Restoring both controllers' BARs gives matching readbacks and allows kdump
to save a vmcore and reboot. An AMD Turin xHCI [1022:1557] shows the same
BAR loss; restoring its BAR also allows kdump to complete.

Read the initial power state first. Otherwise, pci_power_up() may request a
BAR restore based on a cached PCI_UNKNOWN state, even when the device is
already in D0.

For devices already in D0, only synchronize the platform state so
that ACPI calls such as _REG still run. For other states, use
pci_set_full_power_state() to power up the device and restore BARs
when needed.

Fixes: 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing")
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/CAJZ5v0ie2AvCbdv8-zkpYzHLcTwUPUj+=WWOQjDAPmSepSAQPg@mail.gmail.com/
Signed-off-by: Keng-Yu Lin <keng-yu.lin@hpe.com>
[bhelgaas: shorten comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Reviewed-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015020811.1132314-1-keng-yu.lin@hpe.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 8cfcd711630315..25720f28518ad9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3242,7 +3242,15 @@ void pci_pm_init(struct pci_dev *dev)
 	}
 
 poweron:
-	pci_pm_power_up_and_verify_state(dev);
+	pci_update_current_state(dev, PCI_UNKNOWN);
+	if (dev->current_state == PCI_D0) {
+		/* No need for full power-up, just sync-up platform state */
+		platform_pci_set_power_state(dev, PCI_D0);
+	} else {
+		/* Power up the device and restore BARs if necessary */
+		pci_set_full_power_state(dev, false);
+	}
+	pci_update_current_state(dev, PCI_D0);
 	pm_runtime_forbid(&dev->dev);
 
 	/*

From bf56e0e3cd67806a15dfaf637cd941449ca54a49 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Wed, 14 Oct 2026 20:39:13 +0800
Subject: [PATCH 1598/1982] spi: amd: fix len==0 underflow and FIFO overflow

[ Upstream commit e2f4edfc061e493fddde16c4bbe1c4f230f41e4a ]

amd_spi_fifo_xfer() unconditionally decrements xfer->len when a tx_buf
is present. The SPI core does not reject zero-length transfers, so a
transfer submitted through the SPI_IOC_MESSAGE ioctl with len == 0 and
a tx_buf makes the u32 len wrap to 0xFFFFFFFF, and the following
per-byte loop writes far past the FIFO window.

The driver also never checks the cumulative FIFO offset against
AMD_SPI_FIFO_SIZE. The core splits each transfer down to the
controller's max transfer size but does not bound the total message
length, so a message of several transfers whose total exceeds the FIFO
overflows it with out-of-bounds MMIO writes (tx) and reads (rx).

Skip zero-length transfers and reject any transfer that would run past
the end of the FIFO window.

Tested with a user-space replica of the fifo_xfer length arithmetic
(ASAN build): a zero-length transfer with tx_buf makes len-- wrap to
0xffffffff, and skipping zero-length transfers avoids the wrap. No AMD
SPI hardware was available, so the FIFO bound check was verified by
inspection against AMD_SPI_FIFO_SIZE.

Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support")
Cc: stable@vger.kernel.org # 5.8+
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261014-spi-amd-fifo-fix-v1-1-9fec9ab753e8@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-amd.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
index 71a6e5c475b037..ddf89e5353c55c 100644
--- a/drivers/spi/spi-amd.c
+++ b/drivers/spi/spi-amd.c
@@ -322,11 +322,22 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 
 	list_for_each_entry(xfer, &message->transfers,
 			    transfer_list) {
+		/* Skip zero-length transfers to avoid len underflow below */
+		if (!xfer->len)
+			continue;
+
 		if (xfer->speed_hz)
 			amd_set_spi_freq(amd_spi, xfer->speed_hz);
 		else
 			amd_set_spi_freq(amd_spi, spi->max_speed_hz);
 
+		/* Reject transfers that would overflow the FIFO window */
+		if (fifo_pos + xfer->len >
+		    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+			message->status = -EMSGSIZE;
+			goto fin_msg;
+		}
+
 		if (xfer->tx_buf) {
 			buf = (u8 *)xfer->tx_buf;
 			if (!tx_len) {
@@ -369,6 +380,12 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 
 		list_for_each_entry(xfer, &message->transfers, transfer_list)
 			if (xfer->rx_buf) {
+				/* Reject transfers that would overflow the FIFO window */
+				if (fifo_pos + xfer->len >
+				    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
+					message->status = -EMSGSIZE;
+					goto fin_msg;
+				}
 				buf = (u8 *)xfer->rx_buf;
 				/* Read data from FIFO to receive buffer */
 				for (i = 0; i < xfer->len; i++)

From 01c73963d83b3b85ccce6f273e46da32fb43e70f Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Tue, 27 Oct 2026 10:13:40 +0800
Subject: [PATCH 1599/1982] spi: amd: validate FIFO usage before executing
 message

[ Upstream commit aed0c7475d6af333fb9b37848ed5e4f92a808ffa ]

The RX FIFO bound is checked in the drain loop, after
amd_spi_execute_opcode(). A message whose cumulative RX length exceeds
AMD_SPI_FIFO_SIZE can therefore issue an SPI transaction before being
rejected.

Check tx_len + rx_len while walking the message and drop the drain-loop
check. This validates the complete message before executing the command.

Tested with a user-space replica covering TX, RX and mixed messages at
the 70/71-byte boundary. Oversized split-RX messages are now rejected
without executing the command. No AMD SPI hardware was available.

Assisted-by: LLM
Suggested-by: Krishnamoorthi M <krishnamoorthi.m@amd.com>
Fixes: e2f4edfc061e ("spi: amd: fix len==0 underflow and FIFO overflow")
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261027021340.914399-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-amd.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
index ddf89e5353c55c..d3953de255be6e 100644
--- a/drivers/spi/spi-amd.c
+++ b/drivers/spi/spi-amd.c
@@ -331,13 +331,6 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 		else
 			amd_set_spi_freq(amd_spi, spi->max_speed_hz);
 
-		/* Reject transfers that would overflow the FIFO window */
-		if (fifo_pos + xfer->len >
-		    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
-			message->status = -EMSGSIZE;
-			goto fin_msg;
-		}
-
 		if (xfer->tx_buf) {
 			buf = (u8 *)xfer->tx_buf;
 			if (!tx_len) {
@@ -346,6 +339,10 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 				xfer->len--;
 			}
 			tx_len += xfer->len;
+			if (tx_len + rx_len > AMD_SPI_FIFO_SIZE) {
+				message->status = -EMSGSIZE;
+				goto fin_msg;
+			}
 
 			/* Write data into the FIFO. */
 			for (i = 0; i < xfer->len; i++)
@@ -355,8 +352,13 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 		}
 
 		/* Store no. of bytes to be received from FIFO */
-		if (xfer->rx_buf)
+		if (xfer->rx_buf) {
 			rx_len += xfer->len;
+			if (tx_len + rx_len > AMD_SPI_FIFO_SIZE) {
+				message->status = -EMSGSIZE;
+				goto fin_msg;
+			}
+		}
 	}
 
 	if (!buf) {
@@ -380,12 +382,6 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 
 		list_for_each_entry(xfer, &message->transfers, transfer_list)
 			if (xfer->rx_buf) {
-				/* Reject transfers that would overflow the FIFO window */
-				if (fifo_pos + xfer->len >
-				    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
-					message->status = -EMSGSIZE;
-					goto fin_msg;
-				}
 				buf = (u8 *)xfer->rx_buf;
 				/* Read data from FIFO to receive buffer */
 				for (i = 0; i < xfer->len; i++)

From 7fe49d46b305cdd38d2a94b7ed643c3c2f9e99f2 Mon Sep 17 00:00:00 2001
From: Gyokhan Kochmarla <gyokhan@amazon.de>
Date: Tue, 13 Oct 2026 11:48:52 +0000
Subject: [PATCH 1600/1982] erofs: use on-disk blkszbits for lz4 max pcluster
 bound

[ Upstream commit 90b7e4a7a16443d9f6807b5c1dde52074d9f74c0 ]

z_erofs_load_lz4_config() rejects a valid LZ4 image when the kernel's
page size differs from the image's block size. It bounds the on-disk
max_pclusterblks with erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE), which
expands to Z_EROFS_PCLUSTER_MAX_SIZE >> sb->s_blocksize_bits.

At the point this runs, sb->s_blocksize_bits still holds PAGE_SHIFT:
erofs_fc_fill_super() seeds s_blocksize_bits to PAGE_SHIFT before
reading the superblock, and only corrects it down to the on-disk
blkszbits after erofs_read_superblock() returns. The LZ4 config is
parsed inside erofs_read_superblock(), before that correction, so the
bound is computed with the wrong shift.

On a 64K-page kernel mounting a 4K-block image (e.g. one built with
mkfs.erofs -C 262144 on a 4K-page host), the bound evaluates to
1 MiB >> 16 = 16 blocks instead of the correct 1 MiB >> 12 = 256
blocks. The image's legitimate max_pclusterblks of 64 then fails the
check, mount returns -EINVAL, and booting from such an image as the
root filesystem panics:

  erofs (device dm-0): too large lz4 pclusterblks 64
  Kernel panic - not syncing: VFS: Unable to mount root fs

sbi->blkszbits already holds the on-disk block size at this point, so
compute the bound from it directly. This makes the check independent of
the host page size and of superblock-parse ordering.

commit 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block
support") already handled the same ordering hazard for the superblock
checksum path by using sbi->blkszbits in erofs_superblock_csum_verify();
the lz4 config path was missed.

Fixes: 3acea5fc3354 ("erofs: avoid hardcoded blocksize for subpage block support")
Cc: stable@vger.kernel.org
Assisted-by: Kirocrew:gpt-5.6-sol
Signed-off-by: Gyokhan Kochmarla <gyokhan@amazon.de>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/erofs/decompressor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 48a0c84cec755a..858fe65ba84d03 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -23,7 +23,7 @@ static int z_erofs_load_lz4_config(struct super_block *sb,
 		if (!sbi->lz4.max_pclusterblks) {
 			sbi->lz4.max_pclusterblks = 1;	/* reserved case */
 		} else if (sbi->lz4.max_pclusterblks >
-			   erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE)) {
+			   Z_EROFS_PCLUSTER_MAX_SIZE >> sbi->blkszbits) {
 			erofs_err(sb, "too large lz4 pclusterblks %u",
 				  sbi->lz4.max_pclusterblks);
 			return -EINVAL;

From 2c5a807800b5f3349e16af591c9081a65fb4d23d Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Wed, 16 Sep 2026 20:26:28 +0100
Subject: [PATCH 1601/1982] ring-buffer: Take cpus_read_lock() when changing
 the subbuf order

[ Upstream commit 453d0f47b174cac387af48d303c503b84f82212e ]

A CPU coming online for the first time gets its per CPU buffer allocated
by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that
happens while ring_buffer_subbuf_order_set() is running, the CPU shows up
after the allocation loop and the install loop walks it with an empty
new_pages list, corrupting the buffer.

Take cpus_read_lock() as ring_buffer_resize() does.

Cc: stable@vger.kernel.org
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ring_buffer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index f74acc78866d84..dcb762664ce735 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7004,6 +7004,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
 	if (psize > RB_WRITE_MASK + 1)
 		return -EINVAL;
 
+	guard(cpus_read_lock)();
+
 	/* prevent another thread from changing buffer sizes */
 	guard(mutex)(&buffer->mutex);
 

From faef48ba428669db18c400e816f66f3446187175 Mon Sep 17 00:00:00 2001
From: Jianyun Gao <jianyungao89@gmail.com>
Date: Mon, 12 Oct 2026 23:18:57 +0800
Subject: [PATCH 1602/1982] dax: Return errors from dax_core_init()

[ Upstream commit 4da700e2cadf84a6e858391d5be51d64dcba080f ]

dax_core_init() returns success when either the character device
number allocation or DAX bus registration fails, even though the
error paths have already released the initialized resources.

For modular DAX, this allows the module to remain loaded despite
failed initialization, leaving subsequent users and module removal
to access resources that have already been released.

Return the error code from the failed operation so that module
loading fails rather than reporting successful initialization
after the resources have been released.

Fixes: 9567da0b408a ("device-dax: Introduce bus + driver model")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20261012151857.22534-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dax/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index efa5f61860190e..9b46166fd21488 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -601,7 +601,7 @@ static int __init dax_core_init(void)
 	unregister_chrdev_region(dax_devt, MINORMASK+1);
 err_chrdev:
 	dax_fs_exit();
-	return 0;
+	return rc;
 }
 
 static void __exit dax_core_exit(void)

From 50e8c09605b428fbd2305e0eaab05dc1a18c60e6 Mon Sep 17 00:00:00 2001
From: Jianyun Gao <jianyungao89@gmail.com>
Date: Sun, 11 Oct 2026 14:48:39 +0800
Subject: [PATCH 1603/1982] dax: fix dax_range_compare_iter() to use correct
 size and address offset

[ Upstream commit a4bfbfb4e98a62b589ac7ca9e73e9612bfe8cab7 ]

dax_range_compare_iter() has two bugs in how it calls
dax_iomap_direct_access() and uses the returned addresses:

1. The size argument passed to dax_iomap_direct_access() is
   ALIGN(pos + len, PAGE_SIZE), which is an absolute file offset
   rather than a length. This causes the underlying dax_direct_access()
   to request a massively inflated nr_pages via PHYS_PFN(size).

2. The addresses returned by dax_iomap_direct_access() are page-aligned
   starting addresses, but memcmp() compares from saddr/daddr directly
   without adding the page-in-page offset of pos1/pos2. When pos1/pos2
   are not page-aligned, this compares the wrong data.

Fix the size by computing ALIGN(len + offset_in_page(pos), PAGE_SIZE),
matching the pattern used in dax_iomap_copy_around(). Fix the address
by adding offset_in_page(pos1)/offset_in_page(pos2) to saddr/daddr in
the memcmp() call.

Fixes: 6f7db3894ae2 ("fsdax: dedup file range to use a compare function")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261011064840.1296-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dax.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/dax.c b/fs/dax.c
index 69ac2562cec31d..155f8024b30df4 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2168,6 +2168,7 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
 	loff_t pos1 = it_src->pos, pos2 = it_dest->pos;
 	u64 dest_len;
 	void *saddr, *daddr;
+	size_t size1, size2;
 	int id, ret;
 
 	len = min(len, min(smap->length, dmap->length));
@@ -2183,17 +2184,18 @@ static int dax_range_compare_iter(struct iomap_iter *it_src,
 	}
 
 	id = dax_read_lock();
-	ret = dax_iomap_direct_access(smap, pos1, ALIGN(pos1 + len, PAGE_SIZE),
-				      &saddr, NULL);
+	size1 = ALIGN(len + offset_in_page(pos1), PAGE_SIZE);
+	ret = dax_iomap_direct_access(smap, pos1, size1, &saddr, NULL);
 	if (ret < 0)
 		goto out_unlock;
 
-	ret = dax_iomap_direct_access(dmap, pos2, ALIGN(pos2 + len, PAGE_SIZE),
-				      &daddr, NULL);
+	size2 = ALIGN(len + offset_in_page(pos2), PAGE_SIZE);
+	ret = dax_iomap_direct_access(dmap, pos2, size2, &daddr, NULL);
 	if (ret < 0)
 		goto out_unlock;
 
-	*same = !memcmp(saddr, daddr, len);
+	*same = !memcmp(saddr + offset_in_page(pos1),
+			daddr + offset_in_page(pos2), len);
 	if (!*same)
 		len = 0;
 	dax_read_unlock(id);

From 44322a7293f15c9a1c1c74380eeb2ede878a6c55 Mon Sep 17 00:00:00 2001
From: Ming Lei <tom.leiming@gmail.com>
Date: Sun, 11 Oct 2026 01:35:47 -0500
Subject: [PATCH 1604/1982] ublk: reset the FETCH round in release also without
 a disk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f06ca594eafcdf58a399a0f92480631192e06032 ]

The release of /dev/ublkcN resets the queues only when the device has a
disk. Without one it skips ublk_reset_ch_dev():

  server fetches, never starts;         old server exits
  or STOP_DEV removed the disk           release: no disk → skip reset
                                         ios stay ACTIVE / CANCELED,
                                         nr_io_ready stays full
  new server opens /dev/ublkcN           FETCH: -EBUSY (still ready), or
                                         -EINVAL after a partial round
                                         → the device can only be deleted

All uring_cmds are done when the release work runs, with or without a
disk, so the reset is safe either way. Do it in both cases. Then a new
server can fetch and start the device again, as the STOP_DEV entry in
Documentation/block/ublk.rst says ("ublk device is ready for the new
process").

Fixes: 82a8a30c581b ("ublk: improve detection and handling of ublk server exit")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-5-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/ublk_drv.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index f44512ed12176f..f85d66cee9c3a6 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1761,12 +1761,13 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 	}
 
 	/*
-	 * disk isn't attached yet, either device isn't live, or it has
-	 * been removed already, so we needn't to do anything
+	 * No disk: the device isn't live, or it has been removed already.
+	 * There are no requests to abort, but the round still has to be
+	 * reset, so that a new server can fetch and start the device.
 	 */
 	disk = ublk_get_disk(ub);
 	if (!disk)
-		goto out;
+		goto reset;
 
 	/*
 	 * All uring_cmd are done now, so abort any request outstanding to
@@ -1827,10 +1828,9 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 unlock:
 	mutex_unlock(&ub->mutex);
 	ublk_put_disk(disk);
-
+reset:
 	/* all uring_cmd has been done now, reset device & ubq */
 	ublk_reset_ch_dev(ub);
-out:
 	clear_bit(UB_STATE_OPEN, &ub->state);
 
 	/* put the reference grabbed in ublk_ch_release() */

From dfa1499fdca9aaad24c7154ee2279045dba04745 Mon Sep 17 00:00:00 2001
From: Ming Lei <tom.leiming@gmail.com>
Date: Sun, 11 Oct 2026 01:35:48 -0500
Subject: [PATCH 1605/1982] ublk: reset the FETCH round under ub->mutex

[ Upstream commit 84824afdb5a4dc127fbd7036142d7611c5e53651 ]

The release work resets the FETCH round without ub->mutex, while
START_DEV checks it under ub->mutex:

  START_DEV (ub->mutex)               release work
  all queues ready? yes
  ublksrv_tgid matches? yes
                                      ublk_reset_ch_dev():
                                        io->cmd = NULL, nr_queue_ready = 0
  go live: a request then reaches ublk_queue_cmd() with a NULL io->cmd

Do the reset under ub->mutex. Then START_DEV sees the round either ready
or reset. The work already takes ub->mutex when there is a disk, after
it has aborted the requests; nothing holding ub->mutex waits for it.

Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()")
Cc: stable@vger.kernel.org
Tested-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261011063555.1142277-6-tom.leiming@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/ublk_drv.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index f85d66cee9c3a6..c9109731d29ba0 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1766,8 +1766,10 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 	 * reset, so that a new server can fetch and start the device.
 	 */
 	disk = ublk_get_disk(ub);
-	if (!disk)
+	if (!disk) {
+		mutex_lock(&ub->mutex);
 		goto reset;
+	}
 
 	/*
 	 * All uring_cmd are done now, so abort any request outstanding to
@@ -1799,7 +1801,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 
 	/* double check after grabbing lock */
 	if (!ub->ub_disk)
-		goto unlock;
+		goto reset;
 
 	/*
 	 * Transition the device to the nosrv state. What exactly this
@@ -1825,12 +1827,14 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 				WRITE_ONCE(ublk_get_queue(ub, i)->fail_io, true);
 		}
 	}
-unlock:
-	mutex_unlock(&ub->mutex);
-	ublk_put_disk(disk);
 reset:
-	/* all uring_cmd has been done now, reset device & ubq */
+	/*
+	 * All uring_cmd has been done now, reset device & ubq. Under
+	 * ub->mutex, so START_DEV sees the round either ready or reset.
+	 */
 	ublk_reset_ch_dev(ub);
+	mutex_unlock(&ub->mutex);
+	ublk_put_disk(disk);
 	clear_bit(UB_STATE_OPEN, &ub->state);
 
 	/* put the reference grabbed in ublk_ch_release() */

From 818fb17d609baf8e9646425c3efea6beba14379b Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 7 Oct 2026 17:36:04 +0000
Subject: [PATCH 1606/1982] net: skbuff: don't BUG() on a bad csum_start in
 skb_copy_and_csum_dev()

[ Upstream commit 56453199d28f0072a8196fba14b2d702632e2219 ]

skb_copy_and_csum_dev() copies everything up to the checksum start out
of the linear area, and BUG()s if the checksum start is past the end of
the linear area.  It misses the other direction: a CHECKSUM_PARTIAL skb
that has been pulled past its csum_start gives a negative offset, which
gets past the check and becomes a ~4GB copy.  It also trusts
csum_offset when it stores the folded checksum.  So far
skb_copy_and_csum_bits() BUG()ing on a short skb has covered for that,
but once it returns instead, a bad csum_offset would write past the end
of the caller's buffer.

The function returns void and its callers are drivers copying a frame
into a bounce buffer just before handing it to the hardware.  There's
nothing for them to back out of, so check both ends of csum_start and
that the checksum field fits in the frame, and if not, copy the whole
frame with skb_copy_bits() without filling in the checksum, with a
DEBUG_NET_WARN_ON_ONCE() for debug kernels.  The frame
goes out with a bad checksum and is dropped by the receiver.  If even
that copy fails, zero the buffer so the driver doesn't send stale bytes.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Cc: stable? The trailers only have Assisted-by: and Signed-off-by:. No
Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-5-b9a5f732895b@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skbuff.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1808bed195af17..227c889fba5787 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3899,7 +3899,18 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
 	else
 		csstart = skb_headlen(skb);
 
-	BUG_ON(csstart > skb_headlen(skb));
+	if (unlikely(csstart < 0 || csstart > skb_headlen(skb) ||
+		     (skb->ip_summed == CHECKSUM_PARTIAL &&
+		      csstart + skb->csum_offset + sizeof(__sum16) >
+		      skb->len))) {
+		DEBUG_NET_WARN_ON_ONCE(1);
+		/* Send the frame without the checksum filled in, or send
+		 * zeroes if we can't even copy it.
+		 */
+		if (skb_copy_bits(skb, 0, to, skb->len))
+			memset(to, 0, skb->len);
+		return;
+	}
 
 	skb_copy_from_linear_data(skb, to, csstart);
 

From 6f511bbaa33b903b1ca360a8e97eb735e3dad25d Mon Sep 17 00:00:00 2001
From: Zixuan Chai <petalzu987@gmail.com>
Date: Fri, 9 Oct 2026 00:52:31 +0800
Subject: [PATCH 1607/1982] ipv6: defrag: orphan skb before queuing

[ Upstream commit 5dfa91a5ec53cfbf907a1fca095ac3ac7a4e94c9 ]

IPv4 and nf_conntrack fragment queues orphan skbs before returning
-EINPROGRESS, but ip6_frag_queue() leaves the socket association intact.

Commit 18685451fc4e ("inet: inet_defrag: prevent sk release while still in
use") moved skb_orphan() into ip_frag_queue() and nf_ct_frag6_queue(), but
missed ip6_frag_queue().

Without orphaning, inet_frag_reasm_finish() clears fp->sk on frag_list
skbs but leaves fp->destructor set to sock_pfree. Freeing the reassembled
skb then calls sock_pfree() with a NULL socket. A socket using
SOCK_RCU_FREE may also be released while its fragment is queued, leaving a
stale socket pointer; this is a second consequence of the same missing
orphan.

Orphan the skb before returning -EINPROGRESS so the queued fragment no
longer retains the socket association or destructor.

Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Link: https://patch.msgid.link/5c396b7011168cd98b9812df4d6bbd00a96048e7.1791008591.git.petalzu987@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/reassembly.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 25ec8001898df7..c10a8a9d607e86 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -227,6 +227,7 @@ static int ip6_frag_queue(struct net *net,
 	}
 
 	skb_dst_drop(skb);
+	skb_orphan(skb);
 	return -EINPROGRESS;
 
 insert_error:

From a3203fbd9bf6e9201cae0f846df3e8badbceb814 Mon Sep 17 00:00:00 2001
From: Seung Min Shin <guncraft2000@naver.com>
Date: Sun, 11 Oct 2026 16:27:50 +0000
Subject: [PATCH 1608/1982] sctp: hold transport reference across connect wait

[ Upstream commit 5bef8649bb9ac4b2a014bcc227202ebd2df824be ]

sctp_sendmsg_to_asoc() selects a transport before waiting for a new
interleaved association to become established. sctp_wait_for_connect()
drops the socket lock while sleeping.

While the lock is dropped, backlog processing can handle a COOKIE ACK and
an ASCONF DEL-IP that removes the selected transport. sctp_assoc_rm_peer()
then marks the transport dead and drops its association-owned reference.
The transport can be freed through RCU before the send path resumes.

After the wait, the stale pointer is assigned to newly created DATA or
I-DATA chunks and later dereferenced by sctp_outq_select_transport().

Hold a reference to the selected transport across
sctp_wait_for_connect(). After the socket lock is reacquired, abort the
send if the transport was marked dead. Callers without a selected
transport pass NULL and retain their existing behavior.

Cc: stable@vger.kernel.org
Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Seung Min Shin <guncraft2000@naver.com>
Link: https://patch.msgid.link/20261011162750.1529631-1-guncraft2000@naver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/socket.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 03588ac5c382c5..8c9970352952e6 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -75,7 +75,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc,
 				struct sctp_transport *transport,
 				long *timeo_p, size_t msg_len);
 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
-static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
+static int sctp_wait_for_connect(struct sctp_association *,
+				 struct sctp_transport *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
 static void sctp_wait_for_close(struct sock *sk, long timeo);
 static void sctp_destruct_sock(struct sock *sk);
@@ -1244,7 +1245,7 @@ static int __sctp_connect(struct sock *sk, struct sockaddr *kaddrs,
 		*assoc_id = asoc->assoc_id;
 
 	timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
-	return sctp_wait_for_connect(asoc, &timeo);
+	return sctp_wait_for_connect(asoc, NULL, &timeo);
 
 out_free:
 	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
@@ -1846,7 +1847,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
 
 		if (asoc->ep->intl_enable) {
 			timeo = sock_sndtimeo(sk, 0);
-			err = sctp_wait_for_connect(asoc, &timeo);
+			err = sctp_wait_for_connect(asoc, transport, &timeo);
 			if (err || sk->sk_shutdown & RCV_SHUTDOWN) {
 				err = -ESRCH;
 				goto err;
@@ -1889,7 +1890,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
 
 	if (unlikely(wait_connect)) {
 		timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
-		sctp_wait_for_connect(asoc, &timeo);
+		sctp_wait_for_connect(asoc, NULL, &timeo);
 	}
 
 	err = msg_len;
@@ -9337,7 +9338,9 @@ static bool sctp_writeable(const struct sock *sk)
 /* Wait for an association to go into ESTABLISHED state. If timeout is 0,
  * returns immediately with EINPROGRESS.
  */
-static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
+static int sctp_wait_for_connect(struct sctp_association *asoc,
+				 struct sctp_transport *transport,
+				 long *timeo_p)
 {
 	struct sock *sk = asoc->base.sk;
 	int err = 0;
@@ -9346,12 +9349,16 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
 
 	pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
 
-	/* Increment the association's refcnt.  */
+	/* Hold references while the socket lock is dropped. */
+	if (transport)
+		sctp_transport_hold(transport);
 	sctp_association_hold(asoc);
 
 	for (;;) {
 		prepare_to_wait_exclusive(&asoc->wait, &wait,
 					  TASK_INTERRUPTIBLE);
+		if (transport && transport->dead)
+			goto do_transport_dead;
 		if (!*timeo_p)
 			goto do_nonblock;
 		if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -9380,7 +9387,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
 out:
 	finish_wait(&asoc->wait, &wait);
 
-	/* Release the association's refcnt.  */
+	if (transport)
+		sctp_transport_put(transport);
 	sctp_association_put(asoc);
 
 	return err;
@@ -9399,6 +9407,10 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
 do_nonblock:
 	err = -EINPROGRESS;
 	goto out;
+
+do_transport_dead:
+	err = -EAGAIN;
+	goto out;
 }
 
 static int sctp_wait_for_accept(struct sock *sk, long timeo)

From 4980879032bbc2d63f976f5b7f222105cea20ecb Mon Sep 17 00:00:00 2001
From: Shubham Antil <shubham@octane.security>
Date: Tue, 13 Oct 2026 08:27:29 +0530
Subject: [PATCH 1609/1982] RDS/IB: validate receive fragment completions

[ Upstream commit 65cf6863606b0507a7c3bd1711317e4f5d6b8b7e ]

rds_ib_process_recv() accounts every receive fragment as contributing
min(i_recv_data_rem, RDS_FRAG_SIZE) bytes, regardless of the completion
length. When a completion is shorter than the header-declared amount,
receive accounting can advance beyond the payload supplied by the
completion.

Only an IB_WC_RECV completion has the buffer layout expected by this
receive path. Other successful completion opcodes must not be interpreted
as ordinary receive completions.

Reject successful completions with any other opcode before processing
their length. For ordinary receive completions, require enough payload
to cover the amount accounted to the fragment before linking its page
into the incoming message.

This is compatible with the current transmit paths. MSG_ZEROCOPY is
restricted to RDS/TCP, while RDS/IB copied and page-vector messages use
full-sized non-final scatterlist entries.

Found during an LLM-assisted source audit and validated under KMSAN with
a malformed short receive completion.

Reported-by: sungbyeongchan <tjdqudcks0424@naver.com>
Closes: https://lore.kernel.org/netdev/20261006205204.1322102-1-tjdqudcks0424@naver.com/
Reported-by: Giovanni Vignone <gio@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Robert van Eijk <robert@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Reported-by: Paolo Gentry <paolo@octane.security>
Link: https://lore.kernel.org/netdev/8a6ee1d5336ae65b8ffdc8c40a1135657207e204.camel@kernel.org/
Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
Cc: stable@vger.kernel.org
Signed-off-by: Shubham Antil <shubham@octane.security>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20261013025729.40815-1-shubham@octane.security
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib_recv.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 0b52e060988d5f..ad4ff441bc983e 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -949,6 +949,12 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 		}
 	}
 
+	if (data_len < min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)) {
+		rds_ib_conn_error(conn,
+				  "fragment shorter than header-declared length; forcing reconnect\n");
+		goto done;
+	}
+
 	list_add_tail(&recv->r_frag->f_item, &ibinc->ii_frags);
 	recv->r_frag = NULL;
 
@@ -1004,7 +1010,12 @@ void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
 	 * event is processed.
 	 */
 	if (wc->status == IB_WC_SUCCESS) {
-		rds_ib_process_recv(conn, recv, wc->byte_len, state);
+		if (wc->opcode != IB_WC_RECV)
+			rds_ib_conn_error(conn,
+					  "recv completion had unexpected opcode %u, disconnecting and reconnecting\n",
+					  wc->opcode);
+		else
+			rds_ib_process_recv(conn, recv, wc->byte_len, state);
 	} else {
 		/* We expect errors as the qp is drained during shutdown */
 		if (rds_conn_up(conn) || rds_conn_connecting(conn))

From 409efb4f12b95e50e2e1f5f04af75a85eef01904 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Fri, 28 Aug 2026 11:11:57 +0800
Subject: [PATCH 1610/1982] cpufreq: loongson3: Make this driver depend on
 MACH_LOONGSON64

[ Upstream commit 48a82a3f44576a1b227f964fdb150e1cae7455bf ]

32BIT Loongson machines don't have SMC and FreqCtrl registers, so make
this driver depend on MACH_LOONGSON64 (only for LoongArch based 64bit
machines currently).

Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 78702a08364f32..73c1b62c1b37bb 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -289,6 +289,7 @@ endif
 if LOONGARCH
 config LOONGSON3_CPUFREQ
 	tristate "Loongson3 CPUFreq Driver"
+	depends on MACH_LOONGSON64
 	help
 	  This option adds a CPUFreq driver for Loongson processors which
 	  support software configurable cpu frequency.

From e4d2571effd19d76387e408e1f3506e9be17a5f4 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Fri, 28 Aug 2026 11:11:58 +0800
Subject: [PATCH 1611/1982] cpufreq: loongson3: Adjust the width of id and val
 in smc_message

[ Upstream commit 290814d3c22b300eb36b74dc76ad36bd7fdc1220 ]

The id field of smc_message is usually stand for the CPU ID. In the past
this driver was only tested for desktop and laptop productions so 4-bits
are enough. But now we have servers that can have as many as 256 cores,
so we need 8-bits CPU ID.

On the other hand, the val field is usually stand for CPU frequency so
12-bits are enough to represent 4GHz, and for higher frequencies there
is an extra bit to extend (enough for 8GHz).

In theory, this is a incompatible change, but fortunately the old SMC
firmwares are not widely shipped and can be updated on the air, thus we
can safely adjust the widths.

Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson3_cpufreq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1e8715ea1b771d..630f679aa73957 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -21,9 +21,9 @@
 union smc_message {
 	u32 value;
 	struct {
-		u32 id		: 4;
+		u32 id		: 8;
 		u32 info	: 4;
-		u32 val		: 16;
+		u32 val		: 12;
 		u32 cmd		: 6;
 		u32 extra	: 1;
 		u32 complete	: 1;

From e22aba38a54f1c55090151d5cd7868a258b39cc9 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Fri, 28 Aug 2026 11:11:59 +0800
Subject: [PATCH 1612/1982] cpufreq: loongson3: Replace per-package mutex with
 per-node

[ Upstream commit 5d7802ada30b3101f408706b7399b0e170d2febd ]

Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. So replace the
per-package mutex with per-node one.

Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson3_cpufreq.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 630f679aa73957..e3cd78a5ab1874 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -169,7 +169,7 @@ struct loongson3_freq_data {
 	struct cpufreq_frequency_table table[];
 };
 
-static struct mutex cpufreq_mutex[MAX_PACKAGES];
+static struct mutex cpufreq_mutex[MAX_NUMNODES];
 static struct cpufreq_driver loongson3_cpufreq_driver;
 static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
 
@@ -177,14 +177,14 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
 {
 	int retries;
 	unsigned int cpu = raw_smp_processor_id();
-	unsigned int package = cpu_data[cpu].package;
+	unsigned int nid = cpu_to_node(cpu);
 	union smc_message msg, last;
 
-	mutex_lock(&cpufreq_mutex[package]);
+	mutex_lock(&cpufreq_mutex[nid]);
 
 	last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
 	if (!last.complete) {
-		mutex_unlock(&cpufreq_mutex[package]);
+		mutex_unlock(&cpufreq_mutex[nid]);
 		return -EPERM;
 	}
 
@@ -208,11 +208,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
 	}
 
 	if (!msg.complete || msg.cmd != CMD_OK) {
-		mutex_unlock(&cpufreq_mutex[package]);
+		mutex_unlock(&cpufreq_mutex[nid]);
 		return -EPERM;
 	}
 
-	mutex_unlock(&cpufreq_mutex[package]);
+	mutex_unlock(&cpufreq_mutex[nid]);
 
 	return msg.val;
 }
@@ -337,7 +337,7 @@ static int loongson3_cpufreq_probe(struct platform_device *pdev)
 {
 	int i, ret;
 
-	for (i = 0; i < MAX_PACKAGES; i++) {
+	for (i = 0; i < MAX_NUMNODES; i++) {
 		ret = devm_mutex_init(&pdev->dev, &cpufreq_mutex[i]);
 		if (ret)
 			return ret;

From 24288c516442f49f00a2b735419fc1f0629de823 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Fri, 28 Aug 2026 11:12:00 +0800
Subject: [PATCH 1613/1982] cpufreq: loongson3: Use global physical CPU ID in
 get/target callbacks

[ Upstream commit e38360d7c62c8fa530b58905f99a4557d4d6b352 ]

Our server productions (e.g. Loongson-3D6000/3E6000) can have discrete
global physical CPU IDs while the core ID inside the packages are always
continuous. In these cases we should use global physical CPU IDs to get
and set frequencies.

Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson3_cpufreq.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index e3cd78a5ab1874..1ae821e265fbf8 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -16,6 +16,7 @@
 #include <asm/idle.h>
 #include <asm/loongarch.h>
 #include <asm/loongson.h>
+#include <asm/smp.h>
 
 /* Message */
 union smc_message {
@@ -219,38 +220,40 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
 
 static unsigned int loongson3_cpufreq_get(unsigned int cpu)
 {
-	int ret;
+	int ret, core = cpu_logical_map(cpu);
 
-	ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
+	ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_INFO, 0, 0);
 
-	return ret * KILO;
+	return (ret < 0) ? 0 : ret * KILO;
 }
 
 static int loongson3_cpufreq_target(struct cpufreq_policy *policy, unsigned int index)
 {
-	int ret;
+	int ret, core = cpu_logical_map(policy->cpu);
 
-	ret = do_service_request(cpu_data[policy->cpu].core,
-				 FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO, index, 0);
+	ret = do_service_request(core, FREQ_INFO_TYPE_LEVEL, CMD_SET_FREQ_INFO,
+				 index, 0);
 
 	return (ret >= 0) ? 0 : ret;
 }
 
 static int configure_freq_table(int cpu)
 {
-	int i, ret, boost_level, max_level, freq_level;
+	int i, ret, core, boost_level, max_level, freq_level;
 	struct platform_device *pdev = cpufreq_get_driver_data();
 	struct loongson3_freq_data *data;
 
 	if (per_cpu(freq_data, cpu))
 		return 0;
 
-	ret = do_service_request(cpu, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
+	core = cpu_logical_map(cpu);
+
+	ret = do_service_request(core, 0, CMD_GET_FREQ_LEVEL_NUM, 0, 0);
 	if (ret < 0)
 		return ret;
 	max_level = ret;
 
-	ret = do_service_request(cpu, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
+	ret = do_service_request(core, 0, CMD_GET_FREQ_BOOST_LEVEL, 0, 0);
 	if (ret < 0)
 		return ret;
 	boost_level = ret;
@@ -263,7 +266,7 @@ static int configure_freq_table(int cpu)
 	data->def_freq_level = boost_level - 1;
 
 	for (i = 0; i < freq_level; i++) {
-		ret = do_service_request(cpu, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
+		ret = do_service_request(core, FREQ_INFO_TYPE_FREQ, CMD_GET_FREQ_LEVEL_INFO, i, 0);
 		if (ret < 0) {
 			devm_kfree(&pdev->dev, data);
 			return ret;

From c51d1779ff5ab43fadb8bbba37bd98aa536ab0bc Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Fri, 28 Aug 2026 11:12:01 +0800
Subject: [PATCH 1614/1982] cpufreq: loongson3: Replace IOCSR read/write with
 MMIO ones

[ Upstream commit 81792daacfb41ca07b04bd3956ea9e672080cc98 ]

Our server productions (e.g. Loongson-3D6000/3E6000) can have multiple
nodes in one package and SMC mailboxes are also per-node. However, IOCSR
read/write can only perform on the current node, while sometimes we want
to perform on other nodes (e.g. when switch governor, the get and target
callbacks are not run on target core). So replace IOCSR read/write with
MMIO ones.

Cc: stable@vger.kernel.org
Fixes: ccf51454145b ("cpufreq: Add Loongson-3 CPUFreq driver support")
Tested-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson3_cpufreq.c | 34 +++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/drivers/cpufreq/loongson3_cpufreq.c b/drivers/cpufreq/loongson3_cpufreq.c
index 1ae821e265fbf8..aea7c31e155a40 100644
--- a/drivers/cpufreq/loongson3_cpufreq.c
+++ b/drivers/cpufreq/loongson3_cpufreq.c
@@ -17,6 +17,7 @@
 #include <asm/loongarch.h>
 #include <asm/loongson.h>
 #include <asm/smp.h>
+#include <asm/numa.h>
 
 /* Message */
 union smc_message {
@@ -165,6 +166,12 @@ union smc_message {
 
 #define FREQ_MAX_LEVEL			16
 
+#define MMIO_SMCMBX(node) \
+	((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_SMCMBX))
+
+#define MMIO_MISC_FUNC(node) \
+	((void __iomem *)(nid_to_addrbase(node) | IO_BASE | LOONGSON_REG_BASE | LOONGARCH_IOCSR_MISC_FUNC))
+
 struct loongson3_freq_data {
 	unsigned int def_freq_level;
 	struct cpufreq_frequency_table table[];
@@ -177,13 +184,27 @@ static DEFINE_PER_CPU(struct loongson3_freq_data *, freq_data);
 static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 extra)
 {
 	int retries;
-	unsigned int cpu = raw_smp_processor_id();
-	unsigned int nid = cpu_to_node(cpu);
+	unsigned int cpu = 0, nid;
 	union smc_message msg, last;
 
+#ifdef CONFIG_SMP
+	switch (cmd) {
+	case CMD_GET_FREQ_INFO:
+	case CMD_SET_FREQ_INFO:
+	case CMD_GET_FREQ_LEVEL_NUM:
+	case CMD_GET_FREQ_LEVEL_INFO:
+	case CMD_GET_FREQ_BOOST_LEVEL:
+		cpu = cpu_number_map(id);
+		break;
+	default:
+		cpu = raw_smp_processor_id();
+	}
+#endif
+	nid = cpu_to_node(cpu);
+
 	mutex_lock(&cpufreq_mutex[nid]);
 
-	last.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+	last.value = readl(MMIO_SMCMBX(nid));
 	if (!last.complete) {
 		mutex_unlock(&cpufreq_mutex[nid]);
 		return -EPERM;
@@ -196,12 +217,11 @@ static inline int do_service_request(u32 id, u32 info, u32 cmd, u32 val, u32 ext
 	msg.extra	= extra;
 	msg.complete	= 0;
 
-	iocsr_write32(msg.value, LOONGARCH_IOCSR_SMCMBX);
-	iocsr_write32(iocsr_read32(LOONGARCH_IOCSR_MISC_FUNC) | IOCSR_MISC_FUNC_SOFT_INT,
-		      LOONGARCH_IOCSR_MISC_FUNC);
+	writel(msg.value, MMIO_SMCMBX(nid));
+	writel(readl(MMIO_MISC_FUNC(nid)) | IOCSR_MISC_FUNC_SOFT_INT, MMIO_MISC_FUNC(nid));
 
 	for (retries = 0; retries < 10000; retries++) {
-		msg.value = iocsr_read32(LOONGARCH_IOCSR_SMCMBX);
+		msg.value = readl(MMIO_SMCMBX(nid));
 		if (msg.complete)
 			break;
 

From d75a44d360b6410eb89d0029b3eb1eea0571e2f9 Mon Sep 17 00:00:00 2001
From: Joanne Koong <joannelkoong@gmail.com>
Date: Tue, 6 Oct 2026 03:51:36 -0700
Subject: [PATCH 1615/1982] fuse: don't launder folios of a bad inode

[ Upstream commit 01d0f3d294af126f517d92c11e100525537f8be4 ]

fuse_flush() and fuse_writepages() reject writing back dirty data for
any inode that has been marked bad, but fuse_launder_folio() doesn't.

This can cause the following warning in fuse_write_file_get() to
trigger, as reported by syzbot:

WARNING: fs/fuse/file.c:2043 at fuse_write_file_get fs/fuse/file.c:2043 [inline]
WARNING: fs/fuse/file.c:2043 at fuse_iomap_writeback_range+0x7c8/0x18f0 fs/fuse/file.c:2227
Call Trace:
    iomap_writeback_folio+0x1526/0x2490 fs/iomap/buffered-io.c:2022
    fuse_launder_folio+0x17b/0x240 fs/fuse/file.c:2331
    folio_unmap_invalidate+0x4cd/0x830 mm/truncate.c:634
    invalidate_inode_pages2_range+0x629/0xb30 mm/truncate.c:726
    fuse_open+0x5a6/0x770 fs/fuse/file.c:297

This can be hit on a writeback cache mount:
1) a writeable file is open and a buffered write dirties some pages
2) another thread opens the same file read-only. fuse_open() passes the
   bad inode check and sends OPEN to the server.
3) a SETATTR reply with the wrong file type marks the inode bad
4) the writeable file is closed. Flush and release skip writeback
   because the inode is bad. The pages stay dirty but the file gets
   removed from write_files.
5) server replies to the OPEN. The reply has no FOPEN_KEEP_CACHE, so
   fuse_open() calls invalidate_inode_pages2().
6) the invalidation finds the dirty pages and calls
   fuse_launder_folio(), which finds no wriable file and hits the
   WARN_ON in fuse_write_file_get().

Instead of trying to write back dirty data for the bad inode,
fuse_launder_folio() should return -EIO.

Fixes: 5d069dbe8aaf ("fuse: fix bad inode")
Reported-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e8200299b0556976e13c
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reviewed-by: Horst Birthelmer <hbirthelmer@ddn.com>
Tested-by: syzbot+e8200299b0556976e13c@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 18a3ef3a969539..22b3f37ec88b80 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2271,6 +2271,9 @@ static int fuse_launder_folio(struct folio *folio)
 		.wb_ctx	= &data,
 	};
 
+	if (fuse_is_bad(wpc.inode))
+		return -EIO;
+
 	if (folio_clear_dirty_for_io(folio)) {
 		err = iomap_writeback_folio(&wpc, folio);
 		err = fuse_iomap_writeback_submit(&wpc, err);

From 6bbdb8bf46ef3219732a9645fa53e28b37c4df77 Mon Sep 17 00:00:00 2001
From: Fan Wu <fanwu01@zju.edu.cn>
Date: Tue, 22 Sep 2026 08:13:18 +0000
Subject: [PATCH 1616/1982] virtio_fs: read the vring size under
 virtio_fs_mutex in ->get_tree

[ Upstream commit e7ccc777a040343b80f95f4cc5c12ce1df3187f4 ]

The vring size was read after virtio_fs_find_instance() had dropped
virtio_fs_mutex, so a concurrent virtio_fs_remove() could free the
virtqueue first. The reference from the lookup keeps the virtio_fs
alive, but not its virtqueues.

Hold the mutex across the lookup and the read.

This issue was found by an in-house static analysis tool.

Fixes: a7f0d7aab0b4 ("virtiofs: split requests that exceed virtqueue size")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/virtio_fs.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 2b3daa93e299ae..e475f7f9e83d4d 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -454,26 +454,23 @@ static int virtio_fs_add_instance(struct virtio_device *vdev,
 	return ret;
 }
 
-/* Return the virtio_fs with a given tag, or NULL */
+/* Return the virtio_fs with a given tag, or NULL.
+ * Callers hold virtio_fs_mutex, which also keeps the virtqueues alive.
+ */
 static struct virtio_fs *virtio_fs_find_instance(const char *tag)
 {
 	struct virtio_fs *fs;
 
-	mutex_lock(&virtio_fs_mutex);
+	lockdep_assert_held(&virtio_fs_mutex);
 
 	list_for_each_entry(fs, &virtio_fs_instances, list) {
 		if (strcmp(fs->tag, tag) == 0) {
 			kobject_get(&fs->kobj);
-			goto found;
+			return fs;
 		}
 	}
 
-	fs = NULL; /* not found */
-
-found:
-	mutex_unlock(&virtio_fs_mutex);
-
-	return fs;
+	return NULL; /* not found */
 }
 
 static void virtio_fs_free_devs(struct virtio_fs *fs)
@@ -1675,13 +1672,17 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
 	 * in fc->iq->priv. Once fuse_conn is going away, it calls ->put()
 	 * to drop the reference to this object.
 	 */
+	mutex_lock(&virtio_fs_mutex);
 	fs = virtio_fs_find_instance(fsc->source);
+	if (fs)
+		virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
+	mutex_unlock(&virtio_fs_mutex);
+
 	if (!fs) {
 		pr_info("virtio-fs: tag <%s> not found\n", fsc->source);
 		return -EINVAL;
 	}
 
-	virtqueue_size = virtqueue_get_vring_size(fs->vqs[VQ_REQUEST].vq);
 	if (WARN_ON(virtqueue_size <= FUSE_HEADER_OVERHEAD))
 		goto out_err;
 

From 0e49fbd593ed3c9876d72c0ba481a5e70b3e59b9 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <nicoyip.dev@gmail.com>
Date: Tue, 13 Oct 2026 17:04:47 +0800
Subject: [PATCH 1617/1982] fuse: fix copy_file_range reply handling race

[ Upstream commit bf4ccbaad8bdff8c90fd290ed6135b63f89ee8a7 ]

__fuse_copy_file_range() selects its request opcode and output buffer
using fc->no_copy_file_range_64, then reads the flag again to handle the
reply. Copies to different destination inodes can run concurrently on
the same connection, so the flag may change while a request is pending.

For example, task A submits FUSE_COPY_FILE_RANGE_64 and waits for its
reply. Task B submits the same opcode, receives -ENOSYS and sets
no_copy_file_range_64. When A receives a successful reply, it reads the
uninitialized outarg.size instead of outarg_64.bytes_copied. This can
produce an incorrect return value, page cache invalidation range and
inode size update, and disclose stack contents if automatic stack
initialization is disabled.

If A also receives -ENOSYS, it instead mistakes that reply for rejection
of the legacy opcode and sets no_copy_file_range, skipping the legacy
fallback and unnecessarily disabling copy offload for the connection.

KCSAN reported the conflicting accesses:

  BUG: KCSAN: data-race in __fuse_copy_file_range / __fuse_copy_file_range

  read to 0xffff8881014a4d4d of 1 bytes by task 123 on cpu 4:
   __fuse_copy_file_range+0x1a7/0x6e0
   fuse_copy_file_range+0x54/0xd0
   vfs_copy_file_range+0x290/0x9d0
   __do_sys_copy_file_range+0x10f/0x2f0

  write to 0xffff8881014a4d4d of 8 bytes by task 119 on cpu 0:
   __fuse_copy_file_range+0x633/0x6e0
   fuse_copy_file_range+0x54/0xd0
   vfs_copy_file_range+0x290/0x9d0
   __do_sys_copy_file_range+0x10f/0x2f0

The bug can lead to leak kernel base address for KASLR bypass, the
corresponding reproducer can be provided per request.

Use args.opcode for both -ENOSYS handling and output buffer selection.
It records the opcode actually sent and is updated on fallback, keeping
each reply tied to its request regardless of concurrent flag updates.

Fixes: 7a37f55af7af ("fuse: add COPY_FILE_RANGE_64 that allows large copies")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 22b3f37ec88b80..f72d74e3c5f03d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3078,7 +3078,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 	}
 	err = fuse_simple_request(fm, &args);
 	if (err == -ENOSYS) {
-		if (fc->no_copy_file_range_64) {
+		if (args.opcode == FUSE_COPY_FILE_RANGE) {
 			fc->no_copy_file_range = 1;
 			err = -EOPNOTSUPP;
 		} else {
@@ -3089,7 +3089,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 	if (err)
 		goto out;
 
-	bytes_copied = fc->no_copy_file_range_64 ?
+	bytes_copied = args.opcode == FUSE_COPY_FILE_RANGE ?
 		outarg.size : outarg_64.bytes_copied;
 
 	if (bytes_copied > len) {

From 448dba9b2af31f445933a1f3026669619280f20c Mon Sep 17 00:00:00 2001
From: sonotri <sono7ri@gmail.com>
Date: Thu, 15 Oct 2026 21:06:54 +0900
Subject: [PATCH 1618/1982] ublk: pin module while release work is pending

[ Upstream commit afc9cde716b29ce814798d649a95f9128ba42b43 ]

ublk_ch_release() takes a device reference and queues exit_work.  The VFS
module reference held through the file operations is dropped after
->release() returns.  A queued work item does not acquire its own module
reference for the callback.

Consequently, normal module removal can start while exit_work is pending or
executing.  In addition to the worker callback itself, the final device put
can invoke ublk_cdev_rel(), which is also module code.

Take a module reference while ->release() is still covered by the file
operations reference and drop it only after the worker has completed its
final device put.  A rearming worker retains the same reference.

Merely canceling exit_work during module exit is insufficient.  The worker
is the terminal path for the device reference taken by ublk_ch_release(),
so its cancellation would strand that reference and skip the associated
cleanup.

Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
Cc: stable@vger.kernel.org
Signed-off-by: sonotri <sono7ri@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261015120654.241354-1-sono7ri@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/ublk_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c9109731d29ba0..8c33a5f86c3d65 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1839,6 +1839,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 
 	/* put the reference grabbed in ublk_ch_release() */
 	ublk_put_device(ub);
+	module_put(THIS_MODULE);
 }
 
 static int ublk_ch_release(struct inode *inode, struct file *filp)
@@ -1851,6 +1852,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
 	 */
 	ublk_get_device(ub);
 
+	/* Keep the worker's callback and final device release code resident. */
+	__module_get(THIS_MODULE);
 	INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
 	schedule_delayed_work(&ub->exit_work, 0);
 	return 0;

From ab36779bedcf1d0fcd309976e16f6c203f43bd8f Mon Sep 17 00:00:00 2001
From: Kees Cook <kees@kernel.org>
Date: Tue, 13 Oct 2026 22:23:43 -0700
Subject: [PATCH 1619/1982] ipc, msg: Account msg_msg allocations with
 GFP_KERNEL_ACCOUNT again

[ Upstream commit c57fbbe42e907fa26c5ffada52d913d4ca5fa66e ]

Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for
alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is
accounted only through SLAB_ACCOUNT on its bucket caches. With
CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and
kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches,
which do not account it; the same happens when kmem_buckets_create()
fails. Either way, the allocation is not charged to the sender's memory
cgroup.

Allocate with GFP_KERNEL_ACCOUNT again, as before that commit, so the
allocation is charged whichever cache serves it.

Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with
CONFIG_SLAB_BUCKETS as y and n.

Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261014052344.384723-2-kees@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/msgutil.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index 7a03f6d03de3ad..2b93abb808e7b6 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -63,7 +63,8 @@ static struct msg_msg *alloc_msg(size_t len)
 	size_t alen;
 
 	alen = min(len, DATALEN_MSG);
-	msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL);
+	msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen,
+				 GFP_KERNEL_ACCOUNT);
 	if (msg == NULL)
 		return NULL;
 

From e07db95b63a17250230642acd5c3be84fc2d0e5f Mon Sep 17 00:00:00 2001
From: Quanye Yang <quanyeyang@proton.me>
Date: Tue, 13 Oct 2026 16:29:19 +0200
Subject: [PATCH 1620/1982] mptcp: reset msk state on early connect failure

[ Upstream commit 29afe67082b2d33ab2e90c56c337235d725f023f ]

mptcp_connect() can fall back before the subflow SYN is sent, for
example when the netns is in an MPTCP blackhole, token allocation fails,
or MD5SIG is in use. If the subsequent subflow connect() fails
immediately (EAFNOSUPPORT, ENETUNREACH, ...), __inet_stream_connect()
returns while the socket is still SS_UNCONNECTED and never calls
->disconnect(). This was reported by Clashiko [1].

The error path only dropped the token and moved the msk back to
TCP_CLOSE. MPTCP_FALLBACK_DONE, allow_subflows and
request_mptcp were left as after early fallback, so a later
connect() on the same fd stayed TCP-only.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/633 [1]
Fixes: 0235d075a592 ("mptcp: mark as fallback even early ones")
Cc: stable@vger.kernel.org
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-1-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mptcp/protocol.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index e14a49180eefe1..df09dcfd15ce31 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3921,9 +3921,16 @@ static int mptcp_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	 * subflow_finish_connect()
 	 */
 	if (unlikely(err)) {
-		/* avoid leaving a dangling token in an unconnected socket */
 		mptcp_token_destroy(msk);
 		mptcp_set_state(sk, TCP_CLOSE);
+
+		spin_lock_bh(&msk->fallback_lock);
+		msk->allow_subflows = true;
+		msk->allow_infinite_fallback = true;
+		clear_bit(MPTCP_FALLBACK_DONE, &msk->flags);
+		spin_unlock_bh(&msk->fallback_lock);
+
+		mptcp_subflow_ctx_reset(mptcp_subflow_ctx(ssk));
 		return err;
 	}
 

From 8975faca8c9d3fb855da5949eebf2030e4d778e2 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Tue, 13 Oct 2026 16:29:20 +0200
Subject: [PATCH 1621/1982] mptcp: fix subflow bitfield misuse

[ Upstream commit 7538fa33bb2f66b8b809ff39d58308be48e197a0 ]

The subflow status bitfield is protected by the subflow socket lock,
with one notable exception: the `close_event_done` bit is actually under
the msk socket lock protection.

As reported by Clashiko [1], flipping the latter bit may corrupt other
entries in the same bitfield.

Move the `close_event_done` outside the bitfield, in a 32bit hole.

Link: https://lore.kernel.org/178959153492.22033.1944011998010756543@kernel.org
Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-2-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mptcp/protocol.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index dc8920a6a90c39..184831b5b624a0 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -543,14 +543,16 @@ struct mptcp_subflow_context {
 		closing : 1,	    /* must not pass rx data to msk anymore */
 		valid_csum_seen : 1,        /* at least one csum validated */
 		is_mptfo : 1,	    /* subflow is doing TFO */
-		close_event_done : 1,       /* has done the post-closed part */
 		mpc_drop : 1,	    /* the MPC option has been dropped in a rtx */
 		resetting : 1,	    /* subflow is resetting */
-		__unused : 8;
+		__unused : 9;
 	bool	data_avail;
 	bool	scheduled;
 	bool	pm_listener;	    /* a listener managed by the kernel PM? */
 	bool	fully_established;  /* path validated */
+	bool	close_event_done;   /* has done the post-closed part,
+				     * protected by msk socket lock
+				     */
 	u32	lent_mem_frag;
 	u32	remote_nonce;
 	u64	thmac;

From 3c4c6b318e7f52fa44a9ae2bfab03b9e9c782be1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 16 Oct 2026 18:19:29 +0200
Subject: [PATCH 1622/1982] ALSA: seq: oss: Skip events until fully initialized

[ Upstream commit 68d4a6ea6cc6091a05836f783bc17d525d266d0b ]

When an OSS sequencer device is opened, it creates a sequencer port,
then further initializes the internal states like a timer instance,
etc.  Since the sequencer port is published, an event can be already
delivered, and this may hit unexpected event handling, which can
eventually cause a NULL dereference (like the timer start/stop event
triggered before the timer initialization).

For avoiding such a race, introduce a simple guard and skips the event
processing until the port is fully initialized.
At releasing the device, in turn, clear this guard, so that any input
events will be discarded during the teardown.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261016161930.482309-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/seq/oss/seq_oss_device.h | 1 +
 sound/core/seq/oss/seq_oss_event.c  | 3 +++
 sound/core/seq/oss/seq_oss_init.c   | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
index 935cf3df0b30f8..571186db4fa59a 100644
--- a/sound/core/seq/oss/seq_oss_device.h
+++ b/sound/core/seq/oss/seq_oss_device.h
@@ -72,6 +72,7 @@ struct seq_oss_devinfo {
 	int cseq;	/* sequencer client number */
 	int port;	/* sequencer port number */
 	int queue;	/* sequencer queue number */
+	bool initialized;
 
 	struct snd_seq_addr addr;	/* address of this device */
 
diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
index 122735862044dc..20f4c5ce763cc8 100644
--- a/sound/core/seq/oss/seq_oss_event.c
+++ b/sound/core/seq/oss/seq_oss_event.c
@@ -425,6 +425,9 @@ snd_seq_oss_event_input(struct snd_seq_event *ev, int direct, void *private_data
 	struct seq_oss_devinfo *dp = (struct seq_oss_devinfo *)private_data;
 	union evrec *rec;
 
+	if (!dp || !smp_load_acquire(&dp->initialized))
+		return 0; /* ignored */
+
 	if (ev->type != SNDRV_SEQ_EVENT_ECHO)
 		return snd_seq_oss_midi_input(ev, direct, private_data);
 
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 973f057eb731f4..102c9358ce4812 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -258,6 +258,7 @@ snd_seq_oss_open(struct file *file, int level)
 
 	client_table[dp->index] = dp;
 	num_clients++;
+	smp_store_release(&dp->initialized, true);
 
 	return 0;
 
@@ -403,6 +404,7 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp)
 
 	client_table[dp->index] = NULL;
 	num_clients--;
+	smp_store_release(&dp->initialized, false);
 
 	snd_seq_oss_reset(dp);
 

From 6c8413f5412d2e8c6b6ceaa930848a825ceeedb9 Mon Sep 17 00:00:00 2001
From: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
Date: Fri, 16 Oct 2026 18:50:39 -0600
Subject: [PATCH 1623/1982] ALSA: hda/realtek: Fix internal speakers on Acer
 Aspire AL16-31P

[ Upstream commit d933955c456e0573b40eae4f72a3af37ab1c15c3 ]

The Acer Aspire AL16-31P (Intel Alder Lake-N, Realtek ALC269VC,
PCI/codec SSID 2782:1718) has its internal speakers wired to pin 0x1b,
but the BIOS marks that pin as not connected (0x411111f0) and only
exposes pin 0x14 as the speaker. As a result the internal speakers are
silent while headphones, HDMI and Bluetooth work.

This is the same layout as the Infinix Y4 Max and MEDION E15433, which
share the 0x2782 subsystem vendor. Reuse their fixup, which configures
pin 0x1b as an internal speaker and limits the internal mic boost.

Tested by booting with snd-hda-intel model=2782:1705: the fixup is
picked, pin 0x1b is used as a speaker output, the internal speakers
work, and they are muted when headphones are plugged in.

Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Luis Gerardo Lopez Hernandez <gamaerry@gmail.com>
Link: https://patch.msgid.link/20261017005039.9139-1-gamaerry@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 03265550c0eef2..c81ecda4e7b6e4 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7723,6 +7723,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x2782, 0x1701, "Infinix Y4 Max", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),
+	SND_PCI_QUIRK(0x2782, 0x1718, "Acer Aspire AL16-31P", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x4900, "MEDION E15443", ALC233_FIXUP_MEDION_MTL_SPK),
 	SND_PCI_QUIRK(0x2782, 0xa128, "Positivo N15RPE-S", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x2782, 0xa212, "Lunnen Ground 14", ALC269VC_FIXUP_LUNNEN_GROUND_14),

From 69c4e9c13afa249611bbc2d468b3883de524deff Mon Sep 17 00:00:00 2001
From: Fabricio Akio <fabricioakio@gmail.com>
Date: Fri, 2 Oct 2026 22:29:32 -0300
Subject: [PATCH 1624/1982] power: supply: qcom_smbx: set the charge enable
 after software control

[ Upstream commit 1fba787142011145e1071cee9448b3677fb2323d ]

The init sequence sets CHARGING_ENABLE_CMD before CHGR_CFG2 selects
software control of the charge enable.

The Motorola Moto X4's bootloader leaves the charger watchdog armed to
disable charging when it bites, which it does after a few minutes in
fastboot. Charging then stays disabled in the next boot until the cable
is replugged. Setting the command after CHGR_CFG2 re-enables it.

Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver")
Cc: stable@vger.kernel.org
Signed-off-by: Fabricio Akio <fabricioakio@gmail.com>
Link: https://patch.msgid.link/20261002-qcom-smbx-enable-order-v1-1-7df92bd809db@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_smbx.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/power/supply/qcom_smbx.c b/drivers/power/supply/qcom_smbx.c
index 55fe31aa3df3db..ad2cf516e2ded5 100644
--- a/drivers/power/supply/qcom_smbx.c
+++ b/drivers/power/supply/qcom_smbx.c
@@ -812,11 +812,7 @@ static const struct smb_init_register smb_init_seq[] = {
 	  .mask = SOC_LT_CHG_RECHARGE_THRESH_SEL_BIT |
 		  VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT,
 	  .val = VBT_LT_CHG_RECHARGE_THRESH_SEL_BIT },
-	/* Enable charging */
 	{ .addr = USBIN_OPTIONS_1_CFG, .mask = HVDCP_EN_BIT, .val = 0 },
-	{ .addr = CHARGING_ENABLE_CMD,
-	  .mask = CHARGING_ENABLE_CMD_BIT,
-	  .val = CHARGING_ENABLE_CMD_BIT },
 	/*
 	 * Match downstream defaults
 	 * CHG_EN_SRC_BIT - charger enable is controlled by software
@@ -837,6 +833,13 @@ static const struct smb_init_register smb_init_seq[] = {
 		  AUTO_RECHG_BIT | EN_ANALOG_DROP_IN_VBATT_BIT |
 		  CHARGER_INHIBIT_BIT,
 	  .val = CHARGER_INHIBIT_BIT },
+	/*
+	 * Set the enable command only once CHGR_CFG2 has selected software
+	 * control, or a charger its watchdog has disabled stays disabled.
+	 */
+	{ .addr = CHARGING_ENABLE_CMD,
+	  .mask = CHARGING_ENABLE_CMD_BIT,
+	  .val = CHARGING_ENABLE_CMD_BIT },
 	/* STAT pin software override, match downstream. Parallel charging? */
 	{ .addr = STAT_CFG,
 	  .mask = STAT_SW_OVERRIDE_CFG_BIT,

From b66d83f86183997b58469d571351b89b919475d4 Mon Sep 17 00:00:00 2001
From: Andrew Pam <andrew@fastmailteam.com>
Date: Mon, 5 Oct 2026 15:34:18 +1100
Subject: [PATCH 1625/1982] power: supply: cros_charge-control: restore EC
 state on resume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1f2a40f954c848dff9d8bb6d81e404f9e47f0e81 ]

The EC resets its charge control configuration when the AP powers off,
so configured sustainer thresholds and charge behaviour are lost across
hibernation.

Nothing notices the reset. Commit 4fc88ba435da ("power: supply:
cros_charge-control: adopt EC charge state on probe"), in the
power-supply tree, made the driver adopt the EC's charge state, but only
at probe, and a resume is not a probe. Sysfs therefore keeps reporting
the configured values while the EC charges the battery to full. On a
Framework Laptop 16 (Ryzen AI 300, charge control command version 3)
with charge_control_end_threshold set to 80, a hibernate and resume
cycle leaves the attribute still reading 80 while the battery charges
past it to 100%.

Add a system sleep resume hook that reprograms the EC from the cached
state. The same EC behaviour and the same fix already exist for another
driver, see commit 2643187ccb86 ("platform/x86: ayaneo-ec: Add suspend
hook").

Reprogramming the EC is only strictly required after hibernation, but it
is cheap and idempotent, so hook every resume path rather than rely on
the EC preserving its state across each kind of sleep transition.

Note that re-reading the state from the EC on resume, by reusing
cros_chctl_init_state() or otherwise, would be wrong even on the command
versions that support GET: the EC has been reset to its defaults by the
time the hook runs, so adopting that state would silently discard the
configuration the user asked for. The driver's cached state is the only
remaining record of it, which is why it is pushed to the EC rather than
refreshed from it.

Fixes: c6ed48ef5259 ("power: supply: add ChromeOS EC based charge control driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Andrew Pam <andrew@fastmailteam.com>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Acked-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20261005043418.243937-1-andrew@fastmailteam.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/cros_charge-control.c | 29 +++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/cros_charge-control.c b/drivers/power/supply/cros_charge-control.c
index 53e6a77e03fcff..6a6022f377b7a7 100644
--- a/drivers/power/supply/cros_charge-control.c
+++ b/drivers/power/supply/cros_charge-control.c
@@ -14,6 +14,7 @@
 #include <linux/platform_data/cros_ec_commands.h>
 #include <linux/platform_data/cros_ec_proto.h>
 #include <linux/platform_device.h>
+#include <linux/pm.h>
 #include <linux/types.h>
 
 #define EC_CHARGE_CONTROL_BEHAVIOURS	(BIT(POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO)             | \
@@ -294,6 +295,7 @@ static int cros_chctl_probe(struct platform_device *pdev)
 
 	priv->dev = dev;
 	priv->cros_ec = cros_ec;
+	dev_set_drvdata(dev, priv);
 
 	if (priv->cmd_version == 1)
 		priv->psy_ext = &cros_chctl_psy_ext_v1;
@@ -319,13 +321,38 @@ static int cros_chctl_probe(struct platform_device *pdev)
 	return devm_battery_hook_register(dev, &priv->battery_hook);
 }
 
+static int cros_chctl_resume(struct device *dev)
+{
+	struct cros_chctl_priv *priv = dev_get_drvdata(dev);
+	int ret;
+
+	/*
+	 * The EC resets its charge control state when the AP powers off, so the
+	 * configuration is lost across hibernation, while the values exposed to
+	 * userspace still describe it. The cached state is the only remaining
+	 * record of that configuration: reprogram the EC from it rather than
+	 * re-reading the EC, which would adopt the reset defaults instead.
+	 */
+	guard(mutex)(&priv->lock);
+	ret = cros_chctl_configure_ec(priv);
+	if (ret)
+		dev_err(dev, "failed to restore charge control state: %d\n", ret);
+
+	return ret;
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(cros_chctl_pm_ops, NULL, cros_chctl_resume);
+
 static const struct platform_device_id cros_chctl_id[] = {
 	{ "cros-charge-control", 0 },
 	{}
 };
 
 static struct platform_driver cros_chctl_driver = {
-	.driver.name	= "cros-charge-control",
+	.driver = {
+		.name	= "cros-charge-control",
+		.pm	= pm_sleep_ptr(&cros_chctl_pm_ops),
+	},
 	.probe		= cros_chctl_probe,
 	.id_table	= cros_chctl_id,
 };

From 7ba7ddbf458cb1c6593da649ac844db6d4979d08 Mon Sep 17 00:00:00 2001
From: Tim Douglas <me@timdoug.com>
Date: Mon, 12 Oct 2026 22:21:53 -0400
Subject: [PATCH 1626/1982] power: supply: generic-adc-battery: fix status with
 no supplier

[ Upstream commit 8ae5a3f40045ff486826ed6b6a83e39a0f380073 ]

power_supply_am_i_supplied() returns -ENODEV when no registered power
supply supplies the battery. generic-adc-battery's gab_work() tests this
return value as a boolean, so -ENODEV takes the supplied branch and
reports CHARGING, or NOT_CHARGING if the charge-finished GPIO is asserted,
instead of DISCHARGING.

This was noticed while bringing up an out-of-tree Linux port to the
WikiReader: the driver reported CHARGING on a device powered by two AAA
batteries with no charging hardware.

Only a positive return value indicates an online supplier, so treat zero
and negative returns as discharging.

Fixes: 46cecd130d55 ("power: supply: Fix power_supply_am_i_supplied to return -ENODEV when apropriate")
Cc: stable@vger.kernel.org
Signed-off-by: Tim Douglas <me@timdoug.com>
Link: https://patch.msgid.link/20261013022153.6707-1-me@timdoug.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/generic-adc-battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
index c69c9b9fa0eba4..df5f91bc1d0f65 100644
--- a/drivers/power/supply/generic-adc-battery.c
+++ b/drivers/power/supply/generic-adc-battery.c
@@ -135,7 +135,7 @@ static void gab_work(struct work_struct *work)
 	adc_bat = container_of(delayed_work, struct gab, bat_work);
 	status = adc_bat->status;
 
-	if (!power_supply_am_i_supplied(adc_bat->psy))
+	if (power_supply_am_i_supplied(adc_bat->psy) <= 0)
 		adc_bat->status =  POWER_SUPPLY_STATUS_DISCHARGING;
 	else if (gab_charge_finished(adc_bat))
 		adc_bat->status = POWER_SUPPLY_STATUS_NOT_CHARGING;

From 935f03f988830acc83ac889795c15830510d219b Mon Sep 17 00:00:00 2001
From: Brandon Williams <turbine.bmw@gmail.com>
Date: Tue, 13 Oct 2026 13:34:51 -0400
Subject: [PATCH 1627/1982] power: supply: qcom_battmgr: Notify charger
 supplies of online changes

[ Upstream commit 87fd20da8ca8bacdaa9bff5860167f208077dc51 ]

On SC8280XP and X1E80100 the AC, USB and wireless supplies take their
online state from the charging source in the battery status response.
The firmware sends no notification for those supplies when the charging
source changes, and the driver only announces the battery, so userspace
never learns that the charger was plugged in or out. UPower keeps the
state it read at startup: a laptop booted on the charger never goes on
battery.

Call power_supply_changed() for a supply whose online state changes when
a status response is parsed. A supply that is not registered yet, when
the battery is read during probe, reports its state when it registers.

Tested on a Microsoft Surface Pro 11 (X1E80100): after restarting UPower
on the charger, unplugging now sets OnBattery, and plugging in clears it.

Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Brandon Williams <turbine.bmw@gmail.com>
Link: https://patch.msgid.link/20261013-upstream-battmgr-charger-online-v1-1-731973e133a0@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/qcom_battmgr.c | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
index 7454ec0e996330..03ffaad3b53dff 100644
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -1258,6 +1258,23 @@ static unsigned int qcom_battmgr_sc8280xp_convert_temp(unsigned int temperature)
 	return DIV_ROUND_CLOSEST(temperature, 10);
 }
 
+/*
+ * The charger supplies' online state comes from the battery status response,
+ * and the firmware sends no notification of its own when it changes, so
+ * announce the change here. A supply that is not registered yet announces its
+ * state when it is.
+ */
+static void qcom_battmgr_sc8280xp_set_online(struct power_supply *psy,
+					     bool *online, bool value)
+{
+	if (*online == value)
+		return;
+
+	*online = value;
+	if (psy)
+		power_supply_changed(psy);
+}
+
 static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
 					   const struct qcom_battmgr_message *resp,
 					   size_t len)
@@ -1327,9 +1344,12 @@ static void qcom_battmgr_sc8280xp_callback(struct qcom_battmgr *battmgr,
 		battmgr->status.temperature = qcom_battmgr_sc8280xp_convert_temp(le32_to_cpu(resp->status.temperature));
 
 		source = le32_to_cpu(resp->status.charging_source);
-		battmgr->ac.online = source == BATTMGR_CHARGING_SOURCE_AC;
-		battmgr->usb.online = source == BATTMGR_CHARGING_SOURCE_USB;
-		battmgr->wireless.online = source == BATTMGR_CHARGING_SOURCE_WIRELESS;
+		qcom_battmgr_sc8280xp_set_online(battmgr->ac_psy, &battmgr->ac.online,
+						 source == BATTMGR_CHARGING_SOURCE_AC);
+		qcom_battmgr_sc8280xp_set_online(battmgr->usb_psy, &battmgr->usb.online,
+						 source == BATTMGR_CHARGING_SOURCE_USB);
+		qcom_battmgr_sc8280xp_set_online(battmgr->wls_psy, &battmgr->wireless.online,
+						 source == BATTMGR_CHARGING_SOURCE_WIRELESS);
 		if (battmgr->info.last_full_capacity != 0) {
 			/*
 			 * 100 * battmgr->status.capacity can overflow a 32bit

From 11452dc2e6bb4f42f700eb052dbc700f11b6764f Mon Sep 17 00:00:00 2001
From: Matt Turner <mattst88@gmail.com>
Date: Wed, 7 Oct 2026 23:24:05 -0400
Subject: [PATCH 1628/1982] alpha: handle VM_FAULT_HWPOISON in do_page_fault()

[ Upstream commit 4bef20bbb9e02568a009efa4d404ce2621289be5 ]

do_page_fault() handles VM_FAULT_OOM, VM_FAULT_SIGSEGV and
VM_FAULT_SIGBUS and then falls into BUG() for anything else in
VM_FAULT_ERROR. VM_FAULT_HWPOISON and VM_FAULT_HWPOISON_LARGE are in
that set, so a fault on a poisoned page takes down the kernel instead of
delivering a signal.

Alpha does not select ARCH_SUPPORTS_MEMORY_FAILURE, so the machine check
paths cannot produce these. UFFDIO_POISON can: it installs a poison PTE
marker without any memory failure support, and a subsequent access
returns VM_FAULT_HWPOISON. Registering an anonymous range with
userfaultfd, poisoning it and reading it back reliably hits the BUG():

  Kernel bug at arch/alpha/mm/fault.c:188
  poison(50809): Kernel Bug 1
  pc is at do_page_fault+0x4e8/0x550
  ra is at do_page_fault+0xfc/0x550

The BUG() fires with mmap_read_lock() still held, so the faulting task
is left unkillable in D state holding the lock, and shutdown stalls
behind it. A UFFD_USER_MODE_ONLY userfaultfd is always allowed, so any
local user can do this.

Deliver SIGBUS with BUS_MCEERR_AR instead, reporting the size of the
poisoned area, as the other architectures do. That is the huge page size
for VM_FAULT_HWPOISON_LARGE, which becomes reachable once alpha
implements huge pages.

Tested on an UP1500 (EV68AL): the reproducer above now takes a SIGBUS
and the kernel logs

  poison[373]: hardware memory error at 0000020000030000 pc 00000200010007ec

with no oops, no wedged task and no taint.

A backport needs the show_signal_msg() call dropped, since alpha only
has it since commit 9ca6af1aac40 ("alpha: select
SYSCTL_EXCEPTION_TRACE").

Fixes: fc71884a5f59 ("mm: userfaultfd: add new UFFDIO_POISON ioctl")
Cc: stable@vger.kernel.org # 6.6+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Link: https://lore.kernel.org/r/20261007-alpha-hugepages-v2-2-8e108af2d961@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/mm/fault.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index a9816bbc9f34d3..f40ac0826a8547 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -8,6 +8,7 @@
 #include <linux/sched/signal.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/hugetlb.h>
 #include <asm/io.h>
 
 #define __EXTERN_INLINE inline
@@ -89,6 +90,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
 	struct mm_struct *mm = current->mm;
 	const struct exception_table_entry *fixup;
 	int si_code = SEGV_MAPERR;
+	unsigned int lsb;
 	vm_fault_t fault;
 	unsigned int flags = FAULT_FLAG_DEFAULT;
 
@@ -161,6 +163,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
 			goto bad_area;
 		else if (fault & VM_FAULT_SIGBUS)
 			goto do_sigbus;
+		else if (fault & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+			goto do_sigbus_mceerr;
 		BUG();
 	}
 
@@ -222,6 +226,21 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
 		goto no_context;
 	return;
 
+ do_sigbus_mceerr:
+	mmap_read_unlock(mm);
+	if (!user_mode(regs))
+		goto no_context;
+	/*
+	 * Report the size of the poisoned area, which for a hugetlb fault
+	 * is the size of the huge page that could not be mapped.
+	 */
+	lsb = PAGE_SHIFT;
+	if (fault & VM_FAULT_HWPOISON_LARGE)
+		lsb = hstate_index_to_shift(VM_FAULT_GET_HINDEX(fault));
+	show_signal_msg(regs, address, SIGBUS, "hardware memory error");
+	force_sig_mceerr(BUS_MCEERR_AR, (void __user *) address, lsb);
+	return;
+
  do_sigsegv:
 	force_sig_fault(SIGSEGV, si_code, (void __user *) address);
 	return;

From bc958129a57392adff6f2d374bbb0f32bbf9a5de Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:27 +0200
Subject: [PATCH 1629/1982] alpha: load the MMU context when switch_mm()
 switches the current task

[ Upstream commit 9b8be19d5dc9525a408942e2e8012873199e7455 ]

ev5_switch_mm() only prepares the incoming PCB. The context is installed
by PAL_swpctx, which alpha_switch_to() issues against that PCB on the way
out of the scheduler.

Direct callers reach switch_mm() without going through alpha_switch_to():
kthread_use_mm(), which borrows an mm for the current kernel thread,
sched_force_init_mm() on the CPU-hotplug teardown path, and
do_shoot_lazy_tlb(), which switches to init_mm from an IPI. None explicitly
loads the context, so the task can carry on running under whatever was
loaded before. For kthread_use_mm(), current->mm then names the borrowed
mm even though its context has not been loaded. The other two callers
change active_mm while leaving current->mm NULL.

The stale page-table root need not be swapper_pg_dir; it may belong to a
user process that ran on the CPU earlier, and the kthread's user accesses
can then read and write that process's memory wherever the stale mappings
allow. Translations taken that way can also end up tagged with the
borrowed mm's ASN: ev5_switch_mm() writes that ASN into the PCB, which the
next PAL_swpctx installs against the stale ptbr. An address the stale
tables do not map faults instead, and since do_page_fault() resolves
faults against current->mm without reloading the context, the same access
can fault again on return.

sched_force_init_mm() needs CONFIG_HOTPLUG_CPU and do_shoot_lazy_tlb()
needs CONFIG_MMU_LAZY_TLB_SHOOTDOWN. Alpha selects neither, so only
kthread_use_mm() is reachable in practice. Test the caller's identity
rather than special-casing individual callers.

The scheduler passes the incoming task, which is not current until
alpha_switch_to() runs; all three direct callers pass current. Test for
that and load the context the way activate_mm() does. All three run with
interrupts disabled across the switch, so this completes before any
shootdown can be taken and needs no asn_lock handshake.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Tested-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/mmu_context.h | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index eee8fe836a59e6..d366f89fee585a 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -130,6 +130,8 @@ __get_new_mm_context(struct mm_struct *mm, long cpu)
 	return next;
 }
 
+extern void __load_new_mm_context(struct mm_struct *);
+
 __EXTERN_INLINE void
 ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
 	      struct task_struct *next)
@@ -139,6 +141,16 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
 	unsigned long mmc;
 	long cpu = smp_processor_id();
 
+	/*
+	 * kthread_use_mm(), sched_force_init_mm() and do_shoot_lazy_tlb()
+	 * switch current's mm without alpha_switch_to(), which loads the
+	 * context. The latter two require options Alpha does not select.
+	 */
+	if (next == current) {
+		__load_new_mm_context(next_mm);
+		return;
+	}
+
 #ifdef CONFIG_SMP
 	cpu_data[cpu].asn_lock = 1;
 	barrier();
@@ -160,7 +172,6 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
 	task_thread_info(next)->pcb.asn = mmc & HARDWARE_ASN_MASK;
 }
 
-extern void __load_new_mm_context(struct mm_struct *);
 asmlinkage void do_page_fault(unsigned long address, unsigned long mmcsr,
 			      long cause, struct pt_regs *regs);
 

From 07b4cbae2060778e53e4b102f28b042abf1331c5 Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:28 +0200
Subject: [PATCH 1630/1982] alpha: run check_mmu_context() from
 finish_arch_post_lock_switch()

[ Upstream commit 020d2e70b7538b66eee3c3480d2b8921fb182f0c ]

check_mmu_context() clears asn_lock and acts on need_new_asn, but it
runs only as the tail of switch_to(), after alpha_switch_to() returns.

A newly forked user task never gets there: its first context switch
resumes at ret_from_fork and reaches schedule_tail() without returning
to the code following alpha_switch_to().

asn_lock is left set on that CPU, so the new user task can run with
interrupts enabled while shootdown IPIs keep taking the deferred path.
The handshake meant to complete those invalidations never runs.

New kernel threads also reach schedule_tail(), but context_switch()
does not call switch_mm() for a task without an mm. They therefore do
not set asn_lock in the first place and are not affected by this bug.

Move check_mmu_context() to finish_arch_post_lock_switch(), which is
called by finish_task_switch() for both existing and newly created tasks.
Drop the now redundant call from switch_to().

The hook runs after finish_lock_switch() releases the rq lock and enables
interrupts. An IPI arriving before asn_lock is cleared retires the slot
through flush_tlb_other(); an IPI arriving afterwards can flush directly,
since PAL_swpctx has already installed the incoming context.

Set need_new_asn whether ev5_switch_mm() reuses or allocates an ASN. An
IPI in that interval can zero either slot. Without this, the allocated
case can return to user space with a live ASN but a zero context slot,
which a later context-based shootdown shortcut could mistake for an
inactive CPU. check_mmu_context() reloads only when the slot is zero.

Call the hook unconditionally. Alpha selects ARCH_NO_PREEMPT, and neither
kthread_use_mm() nor sched_force_init_mm() sleeps between the direct
switch and this hook. RCU_STRICT_GRACE_PERIOD can enable PREEMPT_COUNT,
but cannot make those callers migrate there. Testing preemptible() would
only leave asn_lock set in that configuration.

This requires the preceding direct-switch fix, "alpha: load the MMU
context when switch_mm() switches the current task". It installs the
borrowed context before kthread_use_mm() reaches this hook, so clearing
asn_lock cannot expose a targeted invalidate against the wrong context.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/mmu_context.h | 15 +++++++++++++--
 arch/alpha/include/asm/switch_to.h   |  1 -
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index d366f89fee585a..f41d7c73fdd641 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -162,8 +162,8 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
 		next_mm->context[cpu] = mmc;
 	}
 #ifdef CONFIG_SMP
-	else
-		cpu_data[cpu].need_new_asn = 1;
+	/* A deferred shootdown can also invalidate a newly allocated ASN. */
+	cpu_data[cpu].need_new_asn = 1;
 #endif
 
 	/* Always update the PCB ASN.  Another thread may have allocated
@@ -192,6 +192,17 @@ do {								\
 #define check_mmu_context()  do { } while(0)
 #endif
 
+/*
+ * Also called from kthread_use_mm() with preemption enabled. Alpha has
+ * no kernel preemption, so the task is still on the CPU that ran
+ * switch_mm().
+ */
+#define finish_arch_post_lock_switch finish_arch_post_lock_switch
+static inline void finish_arch_post_lock_switch(void)
+{
+	check_mmu_context();
+}
+
 __EXTERN_INLINE void
 ev5_activate_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm)
 {
diff --git a/arch/alpha/include/asm/switch_to.h b/arch/alpha/include/asm/switch_to.h
index 762b7f975310c0..35c4b2c9d9923d 100644
--- a/arch/alpha/include/asm/switch_to.h
+++ b/arch/alpha/include/asm/switch_to.h
@@ -9,7 +9,6 @@ extern struct task_struct *alpha_switch_to(unsigned long, struct task_struct *);
 #define switch_to(P,N,L)						 \
   do {									 \
     (L) = alpha_switch_to(virt_to_phys(&task_thread_info(N)->pcb), (P)); \
-    check_mmu_context();						 \
   } while (0)
 
 #endif /* __ALPHA_SWITCH_TO_H */

From a26392e2fde8ca95ae4fee99abaa1516c32cab3b Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:29 +0200
Subject: [PATCH 1631/1982] alpha: only use a targeted tbi() when the target mm
 is really current

[ Upstream commit 0d92845ac5dbc79e4ac4810b33c673f4c1c227e3 ]

ipi_flush_tlb_page() gates a targeted tbi() on current->active_mm.
tbi() acts on the address space context currently loaded on the CPU, so
it is only guaranteed to reach an mm's translations when a thread of
that mm is running there. current->active_mm is not sufficient: under
lazy TLB an idle or kernel task keeps an mm as its active_mm while a
different ASN is loaded, so the invalidate is issued against the wrong
context and the stale entry can survive. Nothing retires the old ASN
afterwards either, mm->context[cpu] still being valid, so the resuming
thread can reuse it.

Test current->mm instead and otherwise fall back to flush_tlb_other(),
which clears mm->context[cpu] and forces a fresh ASN at the next switch
whatever is loaded now.

For an mm borrowed through kthread_use_mm(), patch 1 of this series
installs the context before the task can take a shootdown IPI. The
current->mm test therefore covers that case as well.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-4-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index ed06367ece5749..1ad448105201f9 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -669,7 +669,8 @@ ipi_flush_tlb_page(void *x)
 	struct flush_tlb_page_struct *data = x;
 	struct mm_struct * mm = data->mm;
 
-	if (mm == current->active_mm && !asn_locked())
+	/* A targeted tbi() needs a thread of MM to be current.  */
+	if (mm == current->mm && !asn_locked())
 		flush_tlb_current_page(mm, data->vma, data->addr);
 	else
 		flush_tlb_other(mm);

From 5aa85f90a825b7eb9d4b6d0dd956d652715fa108 Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:30 +0200
Subject: [PATCH 1632/1982] alpha: invalidate the local context in
 flush_tlb_page()

[ Upstream commit c0db730bf05eb3c10c1fae64b19f6913dce129fc ]

When the target mm is not the calling CPU's active_mm, flush_tlb_page()
does nothing locally, and smp_call_function() reaches only the other CPUs.
This CPU may still hold translations for the mm and can later reuse the
old ASN together with them.

Add the missing else branch. flush_tlb_other() clears mm->context[cpu] so
a fresh ASN is taken at the next switch. Add this before changing the
current->active_mm test to current->mm: that change will also send lazy
callers here, so their local invalidate must already be in place.

The uniprocessor implementations of flush_tlb_mm() and
flush_icache_user_page() in asm/tlbflush.h and asm/cacheflush.h already
contain exactly this branch.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-5-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 1ad448105201f9..e4ba0aab8a6698 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -697,6 +697,9 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 			preempt_enable();
 			return;
 		}
+	} else {
+		/* smp_call_function() does not call back into this CPU.  */
+		flush_tlb_other(mm);
 	}
 
 	data.vma = vma;

From be818ec671dba143030e5924cb44a768114042ca Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:31 +0200
Subject: [PATCH 1633/1982] alpha: fix the local TLB invalidate in
 flush_tlb_page()

[ Upstream commit 32f4dd420d626f96128fcfeea2ab24760b4f21a6 ]

flush_tlb_page() invalidates the calling CPU itself before asking the
others, and gates that on current->active_mm. For a non-executable vma
that means a targeted tbi(2, addr), which acts on the context currently
loaded and is only guaranteed to invalidate the intended translations
when the target mm's context is the loaded one. A lazy active_mm does
not establish that, so as in ipi_flush_tlb_page() the target mm's stale
translations can survive, and nothing forces the old ASN to be retired
afterwards.

Test current->mm instead. A lazy caller then takes the flush_tlb_other()
branch added by the previous patch, retiring its local context. Adding
that branch first preserves the local invalidate at every step, including
on EV7 where a targeted tbi() against a foreign ASN appeared to work.

Which callers reach here with a foreign mm depends on the configuration.
folio_mkclean(), from the writeback flusher kworker that has no mm of its
own, accounted for about half the calls during writeback of a shared
mapping and none at all on anonymous memory. Those counts were measured
with CONFIG_COMPACTION=n: with COMPACTION=y, asm/pgtable.h overrides
ptep_clear_flush() to call migrate_flush_tlb_page(), which rendezvouses
with every CPU and handles the context itself, so folio_mkclean() does
not reach this function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-6-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e4ba0aab8a6698..a5a42ae4a7d80b 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -684,7 +684,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 
 	preempt_disable();
 
-	if (mm == current->active_mm) {
+	/* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current.  */
+	if (mm == current->mm) {
 		flush_tlb_current_page(mm, vma, addr);
 		if (atomic_read(&mm->mm_users) <= 1) {
 			int cpu, this_cpu = smp_processor_id();

From 8002dacea4708c7092ae4b00927b3861de608873 Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:32 +0200
Subject: [PATCH 1634/1982] alpha: fix the local TLB invalidate in the UP
 flush_tlb_page()

[ Upstream commit c825bf802a7a43fd302c879ef25c975e067a2e94 ]

The uniprocessor flush_tlb_page() in asm/tlbflush.h has the same wrong
test as the SMP one: a targeted tbi() is only guaranteed to invalidate
the intended translations when the target mm's context is loaded, but
the gate is current->active_mm, which a lazily borrowed mm also
satisfies.

Test current->mm instead. The else branch it falls to already exists
here, so unlike the SMP side this is the whole fix.
arch/alpha/kernel/smp.c is not built with CONFIG_SMP=n, so this is how
the same defect reaches a uniprocessor, where the flusher kworker
necessarily shares the only CPU with the writer.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-7-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/tlbflush.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
index 0c8529997f54e7..9ae1902faf8ecd 100644
--- a/arch/alpha/include/asm/tlbflush.h
+++ b/arch/alpha/include/asm/tlbflush.h
@@ -87,7 +87,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 {
 	struct mm_struct *mm = vma->vm_mm;
 
-	if (mm == current->active_mm)
+	/* A targeted tbi() needs a thread of MM to be current.  */
+	if (mm == current->mm)
 		flush_tlb_current_page(mm, vma, addr);
 	else
 		flush_tlb_other(mm);

From 4f2aa02c8865810c9dbeec767e78da9e2bd8ef43 Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:33 +0200
Subject: [PATCH 1635/1982] alpha: invalidate the local context in
 flush_tlb_mm()

[ Upstream commit 721bb7a129771f0ff9cef1dd5abfc106ef65feba ]

flush_tlb_mm() has the same caller-CPU omission that was fixed in
flush_tlb_page(): when the target mm is not the calling CPU's active_mm
nothing happens locally, and smp_call_function() handles only the other
CPUs, so this CPU may later reuse the old ASN together with the
translations it still holds.

The active_mm test itself is left alone here. That path calls
flush_tlb_current(), which loads a fresh context through
__load_new_mm_context() rather than issuing a targeted tbi() against
whatever ASN happens to be loaded, so it does not depend on which context
is current.

The uniprocessor implementation in asm/tlbflush.h already has the missing
branch. Counted over a fork-heavy run, flush_tlb_mm() was entered with the
mm not this CPU's active_mm 2934 times, and 632 times while otherwise idle.

The proposed Alpha hugetlb support routes hugetlb invalidations through
flush_tlb_range(), which calls this function. Unmapping or migrating a
hugetlb folio from another context will also need this local invalidate.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-8-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index a5a42ae4a7d80b..988e397b0b8a7e 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -649,6 +649,9 @@ flush_tlb_mm(struct mm_struct *mm)
 			preempt_enable();
 			return;
 		}
+	} else {
+		/* smp_call_function() does not call back into this CPU.  */
+		flush_tlb_other(mm);
 	}
 
 	smp_call_function(ipi_flush_tlb_mm, mm, 1);

From 42c4ea22552148c6f2ef93aa80b7657609555434 Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:24:34 +0200
Subject: [PATCH 1636/1982] alpha: invalidate the local context in
 flush_icache_user_page()

[ Upstream commit 4244c555ac440a445cc168f860b2677099d761f9 ]

flush_icache_user_page() has the same caller-CPU omission that the
previous patch fixed in flush_tlb_mm(): when the target mm is not the
calling CPU's active_mm nothing happens locally, and smp_call_function()
handles only the other CPUs, so this CPU may later reuse the old ASN
together with the translations it still holds.

This matters here in particular because the function exists for
operating on another process's mappings: the comment above it describes
setting breakpoints through ptrace, and access_remote_vm() reaches it
through copy_to_user_page(). The calling CPU is therefore often running
something other than the target mm.

As in flush_tlb_mm(), the uniprocessor implementation in
asm/cacheflush.h already has the missing case.

No imb() is needed, here or in ipi_flush_icache_page(). Alpha's
user-space I-cache flush works by allocating a new ASN rather than by
invalidating the I-cache: the entries stay, but they are tagged with the
old ASN and can no longer match. An imb() is only required when the ASN
space wraps and numbers are reused, and __get_new_mm_context() already
does one in that case.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010142533.974797-9-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 988e397b0b8a7e..e21bc3920bece9 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -758,6 +758,9 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
 			preempt_enable();
 			return;
 		}
+	} else {
+		/* smp_call_function() does not call back into this CPU.  */
+		flush_tlb_other(mm);
 	}
 
 	smp_call_function(ipi_flush_icache_page, mm, 1);

From 7e2ff6da9ecf1e041005fd60caba04bcbea2035d Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:33:10 +0200
Subject: [PATCH 1637/1982] alpha: do not clear remote MMU contexts in
 migrate_flush_tlb_page()

[ Upstream commit 16266d50c51eb5eb98f1c345c5aa9ff359a305aa ]

After the on_each_cpu() rendezvous, migrate_flush_tlb_page() walks the
other CPUs and zeroes their mm->context[cpu] when mm_users is at most one,
described as mimicking flush_tlb_mm()'s mm_users<=1 optimization.

It is not one. flush_tlb_mm() tests mm_users before deciding whether to
send the IPIs; here every CPU has already been visited and waited for, so
nothing is saved. The callback has also just set each CPU's own slot
correctly, so the loop only overwrites it, and does so while that CPU may
still be running in the address space.

Remove it. The shootdown shortcuts in flush_tlb_mm(), flush_tlb_page()
and flush_icache_user_page() clear remote slots too; once the next patch
removes those as well, every runtime update of mm->context[cpu] is made by
CPU cpu itself. That patch relies on the invariant when it reads those
slots to decide whether a shootdown can be skipped, so this one is tagged
for stable as its prerequisite.

Fixes: dd5712f3379c ("alpha: fix user-space corruption during memory compaction")
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/mm/tlbflush.c | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index ccbc317b9a3483..239c72b8a74124 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -90,22 +90,6 @@ void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 	 */
 	preempt_disable();
 	on_each_cpu(ipi_flush_mm_and_page, &d, 1);
-
-	/*
-	 * mimic flush_tlb_mm()'s mm_users<=1 optimization.
-	 */
-	if (atomic_read(&mm->mm_users) <= 1) {
-
-		int cpu, this_cpu;
-		this_cpu = smp_processor_id();
-
-		for (cpu = 0; cpu < NR_CPUS; cpu++) {
-			if (!cpu_online(cpu) || cpu == this_cpu)
-				continue;
-			if (READ_ONCE(mm->context[cpu]))
-				WRITE_ONCE(mm->context[cpu], 0);
-		}
-	}
 	preempt_enable();
 }
 

From 1ded6b545bade7167471e2b3f2d4fe0c6489cd6e Mon Sep 17 00:00:00 2001
From: Magnus Lindholm <linmag7@gmail.com>
Date: Sat, 10 Oct 2026 16:33:11 +0200
Subject: [PATCH 1638/1982] alpha: do not skip TLB shootdown IPIs for
 kthread-borrowed mms

[ Upstream commit fe221b7b2d3ecd042dd391f74ff6a6fdeb7c2038 ]

flush_tlb_mm(), flush_tlb_page() and flush_icache_user_page() skip the
shootdown IPI when mm_users <= 1, on the assumption that no other CPU can
be running the mm. A task that borrows an mm through kthread_use_mm()
takes mmgrab() rather than mmget(), so it never appears in mm_users, and
kthread_use_mm() may be handed an mm that is already the caller's
active_mm and loaded on that CPU. Such a CPU was not only left without
an IPI, its mm->context[cpu] was cleared from under it.

mm->context[cpu] is already the record of which CPUs hold an ASN for the
mm. Test it rather than clearing it: take the shortcut only when no
other CPU has one, and otherwise fall through to the IPI, which
invalidates those CPUs properly. A CPU that merely ran the mm in the
past also holds a context and now costs an IPI, which errs in the safe
direction.

Change ipi_flush_tlb_mm(), ipi_flush_icache_page() and the migration
callback ipi_flush_mm_and_page() to test current->mm, like
ipi_flush_tlb_page(). A CPU that only retains the mm lazily then clears
its own slot through flush_tlb_other(), rather than publishing a new ASN
on every IPI or migration rendezvous. The migration callback still does
its per-VA tbi() afterwards. Returning to the mm allocates a fresh ASN
through ev5_switch_mm(), or through the direct-load path when
kthread_use_mm() switches current's mm.

Once these historical slots are gone, the shortcut is available again
if mm_users remains at most one and no other CPU has taken or kept a
context. An explicit kthread_use_mm() borrower has current->mm set and
still receives the invalidate it needs.

The caller-side tests in flush_tlb_mm() and flush_icache_user_page()
remain current->active_mm. A kernel thread that flushes its lazily held
mm can therefore publish its own context slot. Those branches also
perform the shortcut check, which excludes the calling CPU's slot, so
leave them unchanged. This is distinct from a remote lazy CPU keeping
its slot populated through repeated callbacks.

Together with the preceding patch, dropping these clearing loops leaves
every runtime write to mm->context[] targeting the writing CPU's own slot,
so the array becomes a lockless publication of which CPUs may be using the
mm, with a single writer per slot. Mark the two stores that are now
observed from other CPUs; flush_tlb_other() already uses WRITE_ONCE().
The uniprocessor flush_icache_user_page() is left alone, as nothing reads
another CPU's slot there, and init_new_context() runs before the mm is
shared.

Order the slot reads after the page-table changes with smp_mb(). On the
publishing CPU, the store in ev5_switch_mm() precedes the mb() in Alpha's
arch_spin_unlock(), when finish_lock_switch() drops the rq lock. This
relies on Alpha's unlock implementation, not a generic scheduler promise
of a full barrier on unlock; document that reliance at the store. Also
issue smp_mb() after publishing in __load_new_mm_context(), before loading
and using the mm.

This covers every caller, including check_mmu_context(), which can
publish a replacement after finish_lock_switch() has already run.

This requires the preceding removal of remote slot clearing from
migrate_flush_tlb_page(). It also requires the stale-TLB series to set
need_new_asn on both the reused and newly allocated ASN paths. Otherwise
an IPI between finish_lock_switch() and check_mmu_context() can zero a
new slot while asn_lock is set, and the task can return to user space
with a live ASN that the shortcut cannot see.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org> # 53ab52cfe5ce: alpha: load the MMU context when switch_mm() switches the current task
Cc: <stable@vger.kernel.org> # 01df8f401888: alpha: run check_mmu_context() from finish_arch_post_lock_switch()
Cc: <stable@vger.kernel.org> # ef43cfc28c42: alpha: only use a targeted tbi() when the target mm is really current
Cc: <stable@vger.kernel.org> # 738cf8f7a78f: alpha: invalidate the local context in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 62c92086f30e: alpha: fix the local TLB invalidate in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 3faee097b939: alpha: fix the local TLB invalidate in the UP flush_tlb_page()
Cc: <stable@vger.kernel.org> # b2c3b654bb64: alpha: invalidate the local context in flush_tlb_mm()
Cc: <stable@vger.kernel.org> # f19ae6f51a38: alpha: invalidate the local context in flush_icache_user_page()
Cc: <stable@vger.kernel.org> # 471e7f9c890b: alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/mmu_context.h |  7 +++-
 arch/alpha/kernel/smp.c              | 52 ++++++++++++++--------------
 arch/alpha/mm/fault.c                |  4 ++-
 arch/alpha/mm/tlbflush.c             |  2 +-
 4 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index f41d7c73fdd641..09f356934b90a9 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -159,7 +159,12 @@ ev5_switch_mm(struct mm_struct *prev_mm, struct mm_struct *next_mm,
 	mmc = next_mm->context[cpu];
 	if ((mmc ^ asn) & ~HARDWARE_ASN_MASK) {
 		mmc = __get_new_mm_context(next_mm, cpu);
-		next_mm->context[cpu] = mmc;
+		/*
+		 * Ordered before any user access through the mm by the
+		 * mb() in arch_spin_unlock(), when finish_lock_switch()
+		 * drops the rq lock.
+		 */
+		WRITE_ONCE(next_mm->context[cpu], mmc);
 	}
 #ifdef CONFIG_SMP
 	/* A deferred shootdown can also invalidate a newly allocated ASN. */
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index e21bc3920bece9..11768aa292a487 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -625,12 +625,30 @@ static void
 ipi_flush_tlb_mm(void *x)
 {
 	struct mm_struct *mm = x;
-	if (mm == current->active_mm && !asn_locked())
+	if (mm == current->mm && !asn_locked())
 		flush_tlb_current(mm);
 	else
 		flush_tlb_other(mm);
 }
 
+/* True if a CPU other than this one holds an ASN for MM.  */
+static bool
+mm_context_elsewhere(struct mm_struct *mm)
+{
+	int cpu, this_cpu = smp_processor_id();
+
+	/* Pairs with the barrier the publishing CPU issues before using MM.  */
+	smp_mb();
+
+	for_each_online_cpu(cpu) {
+		if (cpu == this_cpu)
+			continue;
+		if (READ_ONCE(mm->context[cpu]))
+			return true;
+	}
+	return false;
+}
+
 void
 flush_tlb_mm(struct mm_struct *mm)
 {
@@ -638,14 +656,8 @@ flush_tlb_mm(struct mm_struct *mm)
 
 	if (mm == current->active_mm) {
 		flush_tlb_current(mm);
-		if (atomic_read(&mm->mm_users) <= 1) {
-			int cpu, this_cpu = smp_processor_id();
-			for (cpu = 0; cpu < NR_CPUS; cpu++) {
-				if (!cpu_online(cpu) || cpu == this_cpu)
-					continue;
-				if (mm->context[cpu])
-					mm->context[cpu] = 0;
-			}
+		if (atomic_read(&mm->mm_users) <= 1 &&
+		    !mm_context_elsewhere(mm)) {
 			preempt_enable();
 			return;
 		}
@@ -690,14 +702,8 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 	/* As in ipi_flush_tlb_page(): a targeted tbi() needs MM current.  */
 	if (mm == current->mm) {
 		flush_tlb_current_page(mm, vma, addr);
-		if (atomic_read(&mm->mm_users) <= 1) {
-			int cpu, this_cpu = smp_processor_id();
-			for (cpu = 0; cpu < NR_CPUS; cpu++) {
-				if (!cpu_online(cpu) || cpu == this_cpu)
-					continue;
-				if (mm->context[cpu])
-					mm->context[cpu] = 0;
-			}
+		if (atomic_read(&mm->mm_users) <= 1 &&
+		    !mm_context_elsewhere(mm)) {
 			preempt_enable();
 			return;
 		}
@@ -728,7 +734,7 @@ static void
 ipi_flush_icache_page(void *x)
 {
 	struct mm_struct *mm = (struct mm_struct *) x;
-	if (mm == current->active_mm && !asn_locked())
+	if (mm == current->mm && !asn_locked())
 		__load_new_mm_context(mm);
 	else
 		flush_tlb_other(mm);
@@ -747,14 +753,8 @@ flush_icache_user_page(struct vm_area_struct *vma, struct page *page,
 
 	if (mm == current->active_mm) {
 		__load_new_mm_context(mm);
-		if (atomic_read(&mm->mm_users) <= 1) {
-			int cpu, this_cpu = smp_processor_id();
-			for (cpu = 0; cpu < NR_CPUS; cpu++) {
-				if (!cpu_online(cpu) || cpu == this_cpu)
-					continue;
-				if (mm->context[cpu])
-					mm->context[cpu] = 0;
-			}
+		if (atomic_read(&mm->mm_users) <= 1 &&
+		    !mm_context_elsewhere(mm)) {
 			preempt_enable();
 			return;
 		}
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index f40ac0826a8547..53e170e965915b 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -46,7 +46,9 @@ __load_new_mm_context(struct mm_struct *next_mm)
 	struct pcb_struct *pcb;
 
 	mmc = __get_new_mm_context(next_mm, smp_processor_id());
-	next_mm->context[smp_processor_id()] = mmc;
+	WRITE_ONCE(next_mm->context[smp_processor_id()], mmc);
+	/* Publish the context before this CPU can access the mm. */
+	smp_mb();
 
 	pcb = &current_thread_info()->pcb;
 	pcb->asn = mmc & HARDWARE_ASN_MASK;
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
index 239c72b8a74124..a2aef90e6234b9 100644
--- a/arch/alpha/mm/tlbflush.c
+++ b/arch/alpha/mm/tlbflush.c
@@ -66,7 +66,7 @@ static void ipi_flush_mm_and_page(void *x)
 	struct tlb_mm_and_addr *d = x;
 
 	/* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
-	if (d->mm == current->active_mm && !asn_locked())
+	if (d->mm == current->mm && !asn_locked())
 		__load_new_mm_context(d->mm);
 	else
 		flush_tlb_other(d->mm);

From ccda4439445c0dcec7665af812ef5806b211b2d6 Mon Sep 17 00:00:00 2001
From: Vasiliy Kovalev <kovalev@altlinux.org>
Date: Sat, 17 Oct 2026 13:12:57 +0300
Subject: [PATCH 1639/1982] ALSA: hda/via: Apply runtime PM workaround for ASUS
 X55A

[ Upstream commit f6e8d5ebde5ceb7d3c0eef6e9e4d82862b503ade ]

ASUS X55A requires the same workaround like other machines with
VT1802, otherwise it loses the codec power on a few nodes and the
sound stays silent.

Link: https://bugzilla.altlinux.org/45606
Cc: <stable@vger.kernel.org>
Tested-by: Nikita Maksimov <nickstogramm@yandex.ru>
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://patch.msgid.link/20261017101257.215166-1-kovalev@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/via.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/hda/codecs/via.c b/sound/hda/codecs/via.c
index 6becea9bb810cf..b35eb727cf2ad9 100644
--- a/sound/hda/codecs/via.c
+++ b/sound/hda/codecs/via.c
@@ -933,6 +933,7 @@ static const struct hda_fixup via_fixups[] = {
 static const struct hda_quirk vt2002p_fixups[] = {
 	SND_PCI_QUIRK(0x1043, 0x13f7, "Asus B23E", VIA_FIXUP_POWER_SAVE),
 	SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+	SND_PCI_QUIRK(0x1043, 0x1c33, "Asus X55A", VIA_FIXUP_POWER_SAVE),
 	SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
 	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
 	{}

From 90cc16ecf4a70aad6f8b3ea5af8ec38064b03428 Mon Sep 17 00:00:00 2001
From: Weibin Liu <liuwb@xiaopeng.com>
Date: Tue, 13 Oct 2026 13:43:39 +0800
Subject: [PATCH 1640/1982] spi: ch341: handle transfers without a TX or RX
 buffer

[ Upstream commit 84182c48999f856c3865e4a537c244f9569c9f6c ]

ch341_transfer_one() unconditionally copies from trans->tx_buf into the
TX packet and hands trans->rx_buf to usb_bulk_msg() for the readback.

The SPI core allows half-duplex transfers where either of the buffers
is NULL, so a transfer without TX data crashes the kernel on the memcpy
and a transfer without RX data makes usb_bulk_msg() store the received
data at address 0.

The CH341A clocks data in both directions on every transfer; there is
no mode to disable a direction. Set SPI_CONTROLLER_MUST_TX and
SPI_CONTROLLER_MUST_RX so the SPI core fills in dummy buffers for
half-duplex transfers.

Fixes: 8846739f52af ("spi: add ch341a usb2spi driver")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
Link: https://patch.msgid.link/20261013054339.77477-1-liuwb@xiaopeng.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ch341.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c
index 3eaa8f176f63aa..170240a0dde898 100644
--- a/drivers/spi/spi-ch341.c
+++ b/drivers/spi/spi-ch341.c
@@ -189,6 +189,12 @@ static int ch341_probe(struct usb_interface *intf,
 	ctrl->transfer_one = ch341_transfer_one;
 	ctrl->set_cs = ch341_set_cs;
 	ctrl->auto_runtime_pm = false;
+	/*
+	 * The CH341A SPI_STREAM command clocks data in both directions on
+	 * every transfer, so the driver always needs a TX and an RX buffer;
+	 * let the SPI core supply dummy buffers for half-duplex transfers.
+	 */
+	ctrl->flags = SPI_CONTROLLER_MUST_TX | SPI_CONTROLLER_MUST_RX;
 
 	usb_set_intfdata(intf, ch341);
 

From 580203eaebaa611f43c07793c77c9c97df9d4a72 Mon Sep 17 00:00:00 2001
From: Tom Verdonck <tom.verdonck@inspiral.be>
Date: Fri, 25 Sep 2026 20:23:24 +0200
Subject: [PATCH 1641/1982] hwmon: (sht4x) Fix jiffies wraparound in
 heater-ready check

[ Upstream commit ce3ff350c4a3b9466bd67bfe2adb2e3bea732b9e ]

sht4x stores in ->heating_complete the jiffies deadline at which the
current heater pulse finishes. It is set once at probe (to jiffies) and
only updated when the heater is explicitly enabled via sysfs, so in the
common case where the heater is never used it stays frozen at its probe
value.

->heating_complete is an unsigned long compared with time_before(),
whose signed difference is only meaningful while the two values are
within LONG_MAX jiffies of each other. Because the deadline is frozen,
jiffies keeps advancing away from it, and after 2^31 jiffies the
difference flips sign. On a 32-bit HZ=100 kernel that happens ~248.5
days after boot. time_before() in sht4x_read_values() then wrongly
reports that heating is still in progress and the read path executes

	msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));

with a bogus, huge delta, blocking the temperature read for a very long
time instead of returning data. The heater_enable sysfs attributes are
affected the same way (spurious -EBUSY and "1" readback).

Store the deadline as a 64-bit jiffies value and compare it with
get_jiffies_64()/time_before64(), which does not wrap in any practical
uptime.

Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Tom Verdonck <tom.verdonck@inspiral.be>
Link: https://patch.msgid.link/7b2087ccb963e097cf3f6333efaec0c46549003b.1790358356.git.tom.verdonck@inspiral.be
[groeck: Squashed 'Fix torn read' patch into this one]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/sht4x.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index 5a76361bb1350f..f757265a82a6d1 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -67,7 +67,7 @@ DECLARE_CRC8_TABLE(sht4x_crc8_table);
  */
 struct sht4x_data {
 	struct i2c_client	*client;
-	unsigned long		heating_complete;	/* in jiffies */
+	u64			heating_complete;	/* in jiffies */
 	bool			data_pending;
 	u32			heater_power;	/* in milli-watts */
 	u32			heater_time;	/* in milli-seconds */
@@ -92,14 +92,14 @@ static int sht4x_read_values(struct sht4x_data *data)
 	u8 crc;
 	u8 cmd[SHT4X_CMD_LEN] = {SHT4X_CMD_MEASURE_HPM};
 	u8 raw_data[SHT4X_RESPONSE_LENGTH];
-	unsigned long curr_jiffies;
+	u64 curr_jiffies;
 
-	curr_jiffies = jiffies;
-	if (time_before(curr_jiffies, data->heating_complete))
+	curr_jiffies = get_jiffies_64();
+	if (time_before64(curr_jiffies, data->heating_complete))
 		msleep(jiffies_to_msecs(data->heating_complete - curr_jiffies));
 
 	if (data->data_pending &&
-	    time_before(jiffies, data->heating_complete + data->update_interval)) {
+	    time_before64(get_jiffies_64(), data->heating_complete + data->update_interval)) {
 		data->data_pending = false;
 	} else {
 		next_update = data->last_updated +
@@ -237,7 +237,9 @@ static ssize_t heater_enable_show(struct device *dev,
 {
 	struct sht4x_data *data = dev_get_drvdata(dev);
 
-	return sysfs_emit(buf, "%u\n", time_before(jiffies, data->heating_complete));
+	guard(hwmon_lock)(dev);
+
+	return sysfs_emit(buf, "%u\n", time_before64(get_jiffies_64(), data->heating_complete));
 }
 
 static ssize_t heater_enable_store(struct device *dev,
@@ -279,14 +281,14 @@ static ssize_t heater_enable_store(struct device *dev,
 
 	guard(hwmon_lock)(dev);
 
-	if (time_before(jiffies, data->heating_complete))
+	if (time_before64(get_jiffies_64(), data->heating_complete))
 		return -EBUSY;
 
 	ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
 	if (ret < 0)
 		return ret;
 
-	data->heating_complete = jiffies + msecs_to_jiffies(heating_time_bound);
+	data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
 	data->data_pending = true;
 	return count;
 }
@@ -410,7 +412,7 @@ static int sht4x_probe(struct i2c_client *client)
 	data->client = client;
 	data->heater_power = 200;
 	data->heater_time = 1000;
-	data->heating_complete = jiffies;
+	data->heating_complete = get_jiffies_64();
 
 	crc8_populate_msb(sht4x_crc8_table, SHT4X_CRC8_POLYNOMIAL);
 

From 6ad77a47904e8e9d8cfecc53a47146fa69b462a9 Mon Sep 17 00:00:00 2001
From: "Baek Kyu, Kim" <pocj8ur4in@gmail.com>
Date: Sun, 18 Oct 2026 05:52:34 +0900
Subject: [PATCH 1642/1982] hwmon: (sht4x) Reject incomplete heater command
 transfers

[ Upstream commit 0e1d292233c83d41530df6ffa4ec5a382f118b12 ]

heater_enable_store() treats a zero return from i2c_master_send() as
success. It updates the heater state and returns count, so another
attempt to enable the heater fails with -EBUSY.

i2c-virtio can return zero when the first message fails. Require
SHT4X_CMD_LEN before updating the heater state, as sht4x_probe()
already does for the reset command.

Fixes: 0eed6fc3d2b9 ("hwmon: (sht4x): add heater support")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261017205234.1084949-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/sht4x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwmon/sht4x.c b/drivers/hwmon/sht4x.c
index f757265a82a6d1..83dc3ca67046b4 100644
--- a/drivers/hwmon/sht4x.c
+++ b/drivers/hwmon/sht4x.c
@@ -287,6 +287,8 @@ static ssize_t heater_enable_store(struct device *dev,
 	ret = i2c_master_send(data->client, &cmd, SHT4X_CMD_LEN);
 	if (ret < 0)
 		return ret;
+	if (ret != SHT4X_CMD_LEN)
+		return -EIO;
 
 	data->heating_complete = get_jiffies_64() + msecs_to_jiffies(heating_time_bound);
 	data->data_pending = true;

From 2affbfaa1db576a7612ae11d5ca8b97f8fd30bdd Mon Sep 17 00:00:00 2001
From: Sanan Hasanov <sanan.hasanov@ucf.edu>
Date: Thu, 8 Oct 2026 16:52:45 -0400
Subject: [PATCH 1643/1982] hwmon: (corsair-cpro) Make wait_input_report_lock
 IRQ safe

[ Upstream commit e4fdc82f55cf0e3d5df5c88278da5baa76a109d1 ]

ccp_raw_event() is the HID ->raw_event() callback and takes
wait_input_report_lock with a plain spin_lock(). This callback can run
in very different contexts depending on the transport: from process
context (e.g. uhid, via a write() to /dev/uhid) with softirqs and
interrupts enabled, and from URB completion, which is softirq context
for HCDs using HCD_BH and hard interrupt context for HCDs that do not
(e.g. OHCI, UHCI).

Taking the lock from process context with softirqs enabled while the
same lock is also taken from softirq context can deadlock if the
softirq interrupts the lock holder on the same CPU. Lockdep reports:

  WARNING: inconsistent lock state
  inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
  ...
   spin_lock include/linux/spinlock.h:347 [inline]
   ccp_raw_event+0x51/0x110 drivers/hwmon/corsair-cpro.c:161
   __hid_input_report+0x41c/0x580 drivers/hid/hid-core.c:2175
   hid_irq_in+0x492/0x710 drivers/hid/usbhid/hid-core.c:287
   __usb_hcd_giveback_urb+0x378/0x540 drivers/usb/core/hcd.c:1657
   dummy_timer+0xa91/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:2023

For the same reason, the spin_lock_bh() in send_usb_cmd() is not
sufficient when ccp_raw_event() is called from hard interrupt context.

Use spin_lock_irqsave() in ccp_raw_event(), since it may be called with
interrupts already disabled, and spin_lock_irq() in send_usb_cmd(),
which always runs in process context.

Fixes: d02abd57e794 ("hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock")
Reported-by: syzbot+0f98b0c0bdeaab2dc2fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0f98b0c0bdeaab2dc2fd
Cc: stable@vger.kernel.org
Signed-off-by: Sanan Hasanov <sanan.hasanov@ucf.edu>
Link: https://patch.msgid.link/20261008205310.30832-1-sanan.hasanou@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/corsair-cpro.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c
index bf7775a731fbe3..17bb080eb9bb60 100644
--- a/drivers/hwmon/corsair-cpro.c
+++ b/drivers/hwmon/corsair-cpro.c
@@ -135,9 +135,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
 	 * the raw event parsing and marked the ccp->wait_input_report
 	 * completion as done.
 	 */
-	spin_lock_bh(&ccp->wait_input_report_lock);
+	spin_lock_irq(&ccp->wait_input_report_lock);
 	reinit_completion(&ccp->wait_input_report);
-	spin_unlock_bh(&ccp->wait_input_report_lock);
+	spin_unlock_irq(&ccp->wait_input_report_lock);
 
 	ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);
 	if (ret < 0)
@@ -156,15 +156,16 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,
 static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size)
 {
 	struct ccp_device *ccp = hid_get_drvdata(hdev);
+	unsigned long flags;
 
 	/* only copy buffer when requested */
-	spin_lock(&ccp->wait_input_report_lock);
+	spin_lock_irqsave(&ccp->wait_input_report_lock, flags);
 	if (!completion_done(&ccp->wait_input_report)) {
 		memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size));
 		ccp->buffer_recv_size = size;
 		complete_all(&ccp->wait_input_report);
 	}
-	spin_unlock(&ccp->wait_input_report_lock);
+	spin_unlock_irqrestore(&ccp->wait_input_report_lock, flags);
 
 	return 0;
 }

From 78b8738d6656acec8a0d812bf826a9a412f16971 Mon Sep 17 00:00:00 2001
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date: Sat, 17 Oct 2026 20:07:57 -0400
Subject: [PATCH 1644/1982] lib/buildid: reject file offsets that do not fit in
 pgoff_t

[ Upstream commit 0007654a7bf13ef2a19afd398bbc6507087f19fd ]

On a 32-bit kernel, parsing the build ID of a crafted ELF file can copy
far more than the intended bytes into a 64-byte on-stack buffer in
__build_id_parse(), corrupting the stack of whatever context fetches the
build ID.  This might be reachable without privilege: perf records a build ID
for PERF_RECORD_MMAP2 on the no-fault path when a process mmaps its own file
(build_id_parse_nofault() from perf_event_mmap()), and BPF build-id stack
maps do the same.

freader_get_folio() turns a 64-bit file offset into a page cache index
with file_off >> PAGE_SHIFT and passes it to filemap_get_folio().
pgoff_t is unsigned long, 32-bit on a 32-bit kernel, so an ELF64 e_phoff
of 2^44 + k * PAGE_SIZE truncates to index k.  filemap_get_folio()
returns the cached folio at index k, whose folio_pos() is far below the
requested file_off.  In freader_fetch() the folio does not contain
file_off, so the "crossing folio boundaries" path computes
part_sz = folio_off + folio_sz - file_off as a large u64 (file_off is
much larger), and the following memcpy() truncates it to size_t and
copies a page into the 64-byte buffer.  On a 64-bit kernel the index is
not truncated, the folio is not cached and the fetch returns -EFAULT, so
only 32-bit kernels are affected.

Reject a file offset that cannot be represented as a page cache index
before the lookup, so such a file fails the build ID parse cleanly as it
already does on 64-bit.

Reproduced on i386 under QEMU with CONFIG_STACKPROTECTOR_STRONG: mmapping
a crafted ELF (ELFCLASS64, e_phoff = 2^44) while a perf event with
attr.build_id is open panics with "stack-protector: Kernel stack is
corrupted in: __build_id_parse"; with this patch the parse returns
-EFAULT and the mmap completes cleanly.  Built for i386 with W=1, no new
warnings.

Fixes: de3ec364c3c3 ("lib/buildid: add single folio-based file reader abstraction")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/buildid.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/buildid.c b/lib/buildid.c
index ef112a7084ef17..015a1f9d2b48be 100644
--- a/lib/buildid.c
+++ b/lib/buildid.c
@@ -66,6 +66,10 @@ static int freader_get_folio(struct freader *r, loff_t file_off)
 
 	freader_put_folio(r);
 
+	/* the page index must fit in pgoff_t */
+	if (file_off < 0 || file_off > MAX_LFS_FILESIZE)
+		return -EFAULT;
+
 	/* only use page cache lookup - fail if not already cached */
 	r->folio = filemap_get_folio(r->file->f_mapping, file_off >> PAGE_SHIFT);
 

From 16777276954753bb06b7e9e338ed08a7a3742557 Mon Sep 17 00:00:00 2001
From: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Date: Fri, 16 Oct 2026 12:22:58 +0300
Subject: [PATCH 1645/1982] gpiolib: cdev: don't set GPIOD_FLAG_IS_OUT

[ Upstream commit 974d2712cb15014019595799b3ed68fef5fe9695 ]

When a line is requested or reconfigured through the v2 uAPI,
gpio_v2_line_config_flags_to_desc_flags() copies the requested
configuration into the descriptor flags, GPIOD_FLAG_IS_OUT included,
before gpiod_direction_input_nonotify() or
gpiod_direction_output_nonotify() asks the driver for the direction.
If the driver refuses, for instance with -EOPNOTSUPP from
.direction_input() for a line that can only be an output, the ioctl
fails but the flag keeps the refused direction. gpiod_free_commit()
does not touch GPIOD_FLAG_IS_OUT, so this outlives the failed request,
and GPIO_V2_GET_LINEINFO_IOCTL reports the line as an input while the
hardware still drives it, until a request without direction flags
makes gpiod_request_commit() read the direction back from the driver:

  GPIO_V2_GET_LINE_IOCTL, line 0, input:         -EOPNOTSUPP
  GPIO_V2_GET_LINEINFO_IOCTL, line 0:            input
  GPIO_V2_GET_LINE_IOCTL, line 0, no direction:  ok
  GPIO_V2_GET_LINEINFO_IOCTL, line 0:            output

GPIO_V2_LINE_SET_CONFIG_IOCTL updates the flags in the same order.
There the line stays requested, and since commit 92ac7de3175e
("gpiolib: don't allow setting values on input lines")
GPIO_V2_LINE_SET_VALUES_IOCTL on it then fails with -EPERM, though the
line is still an output. A line whose driver refuses to make it an
output is likewise reported as one.

gpiod_direction_input_nonotify() and gpiod_direction_output_nonotify()
set or clear GPIOD_FLAG_IS_OUT themselves once the driver has accepted
the direction, emulated open drain and open source included, and
nothing between the copy and those calls reads the flag. Leave it to
them, as the v1 uAPI already does.

The other flags that the helper copies stay as they are. Active low,
drive and bias are what gpiod_direction_*() applies, drive and bias
possibly before the driver refuses the direction; edges and event
clock are the character device's own. None of them is read back from
the driver, so there is no earlier state that is more accurate to go
back to. A failed request releases the line, which clears them, and a
failed reconfiguration leaves the line, like the lines before it, with
what was applied up to the failure.

Reproduced under QEMU with a test GPIO chip whose line 0 refuses input
and line 1 refuses output: both refused requests and both refused
reconfigurations leave the line info with the refused direction, and
setting the value of the reconfigured output fails with -EPERM. With
this change the line info shows the direction of the hardware in all
four cases and setting the value works. First seen on real hardware
with v6.12.

Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Reviewed-by: Kent Gibson <warthog618@gmail.com>
Link: https://patch.msgid.link/20261016-gpiolib-cdev-direction-v2-1-aambrozewicz@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib-cdev.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index d67d361cc45625..1afda8ea5769b0 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -1253,11 +1253,6 @@ static void gpio_v2_line_config_flags_to_desc_flags(u64 lflags,
 	assign_bit(GPIOD_FLAG_ACTIVE_LOW, &flags,
 		   lflags & GPIO_V2_LINE_FLAG_ACTIVE_LOW);
 
-	if (lflags & GPIO_V2_LINE_FLAG_OUTPUT)
-		set_bit(GPIOD_FLAG_IS_OUT, &flags);
-	else if (lflags & GPIO_V2_LINE_FLAG_INPUT)
-		clear_bit(GPIOD_FLAG_IS_OUT, &flags);
-
 	assign_bit(GPIOD_FLAG_EDGE_RISING, &flags,
 		   lflags & GPIO_V2_LINE_FLAG_EDGE_RISING);
 	assign_bit(GPIOD_FLAG_EDGE_FALLING, &flags,

From c2b9c053512eab7f32e41eea9cadf372fea06aa2 Mon Sep 17 00:00:00 2001
From: George Christidis <gxristidis@gmail.com>
Date: Sun, 18 Oct 2026 18:56:31 +0200
Subject: [PATCH 1646/1982] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook
 14 UX3402VA

[ Upstream commit 40409fa23d32c8ed51e832031daa6decd9d6fd11 ]

The UX3402VA (1043:16a3) BIOS leaves pin 0x19 unconfigured, so the
headset mic does not work. Use ALC294_FIXUP_ASUS_SPI_HEADSET_MIC like
the UX3405MA, it sets up the mic and keeps the CS35L41 speaker fixup.

Tested on a UX3402VA: headset mic, internal mic and speakers work.

Fixes: 07058dceb038 ("ALSA: hda/realtek: Splitting the UX3402 into two separate models")
Cc: stable@vger.kernel.org
Signed-off-by: George Christidis <gxristidis@gmail.com>
Link: https://patch.msgid.link/20261018-for-linus-v1-1-4d8e9ff27d89@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/codecs/realtek/alc269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index c81ecda4e7b6e4..404a93f552cb48 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -7222,7 +7222,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1664, "ASUS ExpertBook PM3406CHA", ALC256_FIXUP_ASUS_PM3406CHA),
 	SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
-	SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
+	SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x16d3, "ASUS UX5304VA", ALC245_FIXUP_CS35L41_SPI_2),
 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),

From 306a7db6aaa192e6ff1bd235bae4613d855af87f Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Wed, 7 Oct 2026 23:01:00 +0200
Subject: [PATCH 1647/1982] netfilter: nf_reject: initialize IPCB at inet
 ingress

[ Upstream commit 73a73d442f9986353fe284bd1b504d0313d0f153 ]

The inet ingress hook runs before ip_rcv_core() and ip6_rcv_core(), so
neither IPCB nor IP6CB has been initialized when nft_reject_inet passes
a packet to nf_send_unreach() or nf_send_unreach6(). skb->cb can
therefore retain metadata from an earlier protocol layer.

For IPv4, icmp_send() treats IPCB(skb)->opt as parsed IPv4 options.
Stale option offsets can make __ip_options_echo() copy an
attacker-controlled length into its 40-byte reply option buffer and
overflow the stack. On an unpatched v7.2-rc5 kernel, the IPv4
reproducer produced:

  BUG: KASAN: stack-out-of-bounds in __ip_options_echo()
  Write of size 255

For IPv6, icmpv6_send() consumes IP6CB(skb) as parsed IPv6 metadata. It
always uses iif for source selection and, when MIP6 is enabled, uses
dsthao as an extension-header offset. These fields must not be stale.

For NF_INET_INGRESS, clear the address-family-specific control block and
restore its input interface before constructing the ICMP error.  This
matches similar initialization normally performed by ip_rcv_core() and
ip6_rcv_core().

Fixes: 117ca1f8920c ("netfilter: nft_reject_inet: allow to use reject from inet ingress")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/netfilter/nf_reject_ipv4.c | 5 +++++
 net/ipv6/netfilter/nf_reject_ipv6.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 59ec465a9df982..7cb33af671e260 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -357,6 +357,11 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
 	if (!skb_valid_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
 		return;
 
+	if (hook == NF_INET_INGRESS) {
+		memset(IPCB(skb_in), 0, sizeof(*IPCB(skb_in)));
+		IPCB(skb_in)->iif = skb_in->skb_iif;
+	}
+
 	if (skb_csum_unnecessary(skb_in) ||
 	    !nf_reject_verify_csum(skb_in, dataoff, proto)) {
 		icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 07cdaa10da0d05..5e08d8529cc889 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -444,6 +444,11 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
 	if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
 		skb_in->dev = net->loopback_dev;
 
+	if (hooknum == NF_INET_INGRESS) {
+		memset(IP6CB(skb_in), 0, sizeof(*IP6CB(skb_in)));
+		IP6CB(skb_in)->iif = skb_in->skb_iif;
+	}
+
 	if (!skb_valid_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
 		return;
 

From 9e4af1fa6eb134ab230c0e3788c02f138f3febb7 Mon Sep 17 00:00:00 2001
From: Ximing Zhang <xzhangjr@gmail.com>
Date: Fri, 16 Oct 2026 12:36:37 +0400
Subject: [PATCH 1648/1982] hwmon: (coretemp) Fix handling of isolated SMT
 siblings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 37c1974a0ec4ec4624a270291a179c53f8f4fbca ]

Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to
isolated CPUs") prevents create_core_data() from creating temperature
data for an isolated CPU. coretemp_cpu_online(), however, still adds
that CPU to pdata->cpumask.

When an isolated SMT thread is processed before a housekeeping sibling,
the mask makes coretemp_cpu_online() believe that the core is already
represented. The housekeeping sibling then gets no temperature
attributes. Package attributes are similarly not retried when the first
CPU processed in a die is isolated.

The mask is also used to select a replacement CPU when a sensor target
goes offline. Including isolated CPUs permits the driver to retarget a
sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an
isolated CPU.

Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check
to coretemp_cpu_online(). Sensor creation is then deferred to an eligible
CPU, and hotplug replacement targets remain on housekeeping CPUs.

Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with
nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock
driver omitted Core 1 after module load and retained its readable sensor
after CPU 5 was offlined. The patched driver exposed Core 1, removed it
when CPU 5 went offline, and restored it when CPU 5 returned.

Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs")
Cc: stable@vger.kernel.org
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Ximing Zhang <xzhangjr@gmail.com>
Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/coretemp.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index e8697d6b9998af..c9b7e435eda814 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -559,9 +559,6 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
 	u32 eax, edx;
 	int err;
 
-	if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
-		return 0;
-
 	tdata = init_temp_data(pdata, cpu, pkg_flag);
 	if (!tdata)
 		return -ENOMEM;
@@ -681,6 +678,14 @@ static int coretemp_cpu_online(unsigned int cpu)
 	if (!cpu_has(c, X86_FEATURE_DTHERM))
 		return -ENODEV;
 
+	/*
+	 * Keep isolated CPUs out of pdata->cpumask. Besides tracking the CPUs
+	 * available to this driver, the mask is used to select the CPU on which
+	 * to read the temperature MSRs.
+	 */
+	if (!housekeeping_cpu(cpu, HK_TYPE_MISC))
+		return 0;
+
 	pdata = platform_get_drvdata(pdev);
 	if (!pdata->hwmon_dev) {
 		struct device *hwmon;
@@ -710,8 +715,8 @@ static int coretemp_cpu_online(unsigned int cpu)
 	}
 
 	/*
-	 * Check whether a thread sibling is already online. If not add the
-	 * interface for this CPU core.
+	 * Check whether a housekeeping thread sibling is already online. If
+	 * not, add the interface for this CPU core.
 	 */
 	if (!cpumask_intersects(&pdata->cpumask, topology_sibling_cpumask(cpu)))
 		coretemp_add_core(pdev, cpu, 0);
@@ -741,9 +746,9 @@ static int coretemp_cpu_offline(unsigned int cpu)
 	cpumask_clear_cpu(cpu, &pd->cpumask);
 
 	/*
-	 * If this is the last thread sibling, remove the CPU core
-	 * interface, If there is still a sibling online, transfer the
-	 * target cpu of that core interface to it.
+	 * If this is the last housekeeping thread sibling, remove the CPU core
+	 * interface. If there is still a housekeeping sibling online, transfer
+	 * the target CPU of that core interface to it.
 	 */
 	target = cpumask_any_and(&pd->cpumask, topology_sibling_cpumask(cpu));
 	if (target >= nr_cpu_ids) {
@@ -755,7 +760,8 @@ static int coretemp_cpu_offline(unsigned int cpu)
 	}
 
 	/*
-	 * If all cores in this pkg are offline, remove the interface.
+	 * If all housekeeping cores in this pkg are offline, remove the
+	 * interface.
 	 */
 	tdata = get_temp_data(pd, -1);
 	if (cpumask_empty(&pd->cpumask)) {
@@ -768,7 +774,7 @@ static int coretemp_cpu_offline(unsigned int cpu)
 
 	/*
 	 * Check whether this core is the target for the package
-	 * interface. We need to assign it to some other cpu.
+	 * interface. We need to assign it to some other housekeeping CPU.
 	 */
 	if (tdata && tdata->cpu == cpu) {
 		target = cpumask_first(&pd->cpumask);

From e1db6d1f020ea94f16c3f6149a7c9d4ebcb9fb02 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Sun, 27 Sep 2026 16:49:59 +0800
Subject: [PATCH 1649/1982] hwmon: (gigabyte_waterforce) reject short input
 reports

[ Upstream commit 400be69515c327ced60082b27ede902a8d93cbdb ]

The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.

Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.

Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/gigabyte_waterforce.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwmon/gigabyte_waterforce.c b/drivers/hwmon/gigabyte_waterforce.c
index 4eea05f8b569c2..f4d0376dd68e0a 100644
--- a/drivers/hwmon/gigabyte_waterforce.c
+++ b/drivers/hwmon/gigabyte_waterforce.c
@@ -257,6 +257,9 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 {
 	struct waterforce_data *priv = hid_get_drvdata(hdev);
 
+	if (size <= FIRMWARE_VER_START_OFFSET_2)
+		return 0;
+
 	if (data[0] == get_firmware_ver_cmd[0] && data[1] == get_firmware_ver_cmd[1]) {
 		/* Received a firmware version report */
 		priv->firmware_version =
@@ -269,6 +272,8 @@ static int waterforce_raw_event(struct hid_device *hdev, struct hid_report *repo
 
 	if (data[0] != get_status_cmd[0] || data[1] != get_status_cmd[1])
 		return 0;
+	if (size <= WATERFORCE_TEMP_SENSOR)
+		return 0;
 
 	priv->temp_input[0] = data[WATERFORCE_TEMP_SENSOR] * 1000;
 	priv->speed_input[0] = get_unaligned_le16(data + WATERFORCE_FAN_SPEED);

From 9738228aeaf27ed26b9815b79dde9574e124148d Mon Sep 17 00:00:00 2001
From: Wenjie Qi <qwjhust@gmail.com>
Date: Fri, 16 Oct 2026 13:44:05 +0800
Subject: [PATCH 1650/1982] f2fs: flush SIT journal during filesystem resize

[ Upstream commit a6ede405455106bf42164ec96fd84008c5aabdd9 ]

During a filesystem resize, SBI_IS_RESIZEFS prevents new SIT entries
from being added to the journal and forces existing entries to the SIT
area. However, f2fs_flush_sit_entries() returns early when there are no
new dirty sentries, leaving existing journal entries behind.

After the main area shrinks, a later checkpoint can access a journal
entry whose segment number is outside the new geometry and trigger
f2fs_bug_on().

Only take the zero-dirty fast path when entries may be written back to
the journal. This lets resize drain existing entries through
remove_sits_in_journal() even when there are no new dirty sentries.

Cc: stable@kernel.org
Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/segment.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 510d073f8ec541..23f9b76ee0145a 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4687,7 +4687,7 @@ void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc)
 
 	down_write(&sit_i->sentry_lock);
 
-	if (!sit_i->dirty_sentries)
+	if (!sit_i->dirty_sentries && to_journal)
 		goto out;
 
 	/*

From f78eff4218be3dcb34fabc9822164423ce601d05 Mon Sep 17 00:00:00 2001
From: Seongjae Jeong <jsjlee1020@gmail.com>
Date: Wed, 14 Oct 2026 11:26:29 +0000
Subject: [PATCH 1651/1982] f2fs: fix submit accounting for IPU writeback

[ Upstream commit 6d1f622b9c069378cdb83088be2b15a9b480b8a3 ]

f2fs_write_cache_pages() uses the submitted count, which is set to
fio.submitted in f2fs_write_single_data_page(), to update nwritten
and decrement wbc->nr_to_write.

In the OPU path, f2fs_submit_page_write() sets fio->submitted to 1.
However, in the IPU path, fio->submitted is never set and remains zero.
As a result, successful IPU writes are not accounted for.
This can cause asynchronous writeback to continue beyond its budget.

Set fio->submitted in f2fs_inplace_write_data() after a page is
successfully merged into a bio or submitted, so that successful
IPU writes are included in the writeback accounting.

Cc: stable@kernel.org
Fixes: d68f735b3bc9 ("f2fs: check io submission more precisely")
Signed-off-by: Seongjae Jeong <jsjlee1020@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/segment.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 23f9b76ee0145a..46f14f891843cd 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -4087,6 +4087,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
 	else
 		err = f2fs_submit_page_bio(fio);
 	if (!err) {
+		fio->submitted = 1;
 		f2fs_update_device_state(fio->sbi, fio->ino,
 						fio->new_blkaddr, 1);
 		f2fs_update_iostat(fio->sbi, fio_inode(fio),

From 4b6177c53f05c5dca180d67cb26ec4594ae234b5 Mon Sep 17 00:00:00 2001
From: Jianyun Gao <jianyungao89@gmail.com>
Date: Thu, 15 Oct 2026 22:34:25 +0800
Subject: [PATCH 1652/1982] dax: fix wrong error code returned from
 dax_dedupe_file_range_compare()

[ Upstream commit 9b036546a02c6c9a5133f9c1e93503896595c6ba ]

When dax_range_compare_iter() returns a negative error code (e.g. -EIO),
dax_dedupe_file_range_compare() incorrectly returns 'ret' which holds the
positive return value from iomap_iter() indicating more iterations remain.
This positive value leaks to the caller, where vfs_dedupe_file_range()
interprets it as success (bytes_deduped = len), causing userspace to
incorrectly believe deduplication completed.

Return 'status' instead to propagate the actual error code.

Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time")
Cc: stable@vger.kernel.org
Signed-off-by: Jianyun Gao <jianyungao89@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Link: https://patch.msgid.link/20261015143426.17620-1-jianyungao89@gmail.com
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dax.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dax.c b/fs/dax.c
index 155f8024b30df4..30d0c7e4b30cbd 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -2235,7 +2235,7 @@ int dax_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
 		status = dax_range_compare_iter(&src_iter, &dst_iter,
 				min(src_iter.len, dst_iter.len), same);
 		if (status < 0)
-			return ret;
+			return status;
 		src_iter.status = dst_iter.status = status;
 	}
 	return ret;

From 5e2b198a238421a44712a014c898e8963593fe9b Mon Sep 17 00:00:00 2001
From: Gregory Price <gourry@gourry.net>
Date: Thu, 15 Oct 2026 13:30:28 -0400
Subject: [PATCH 1653/1982] rtc: cmos: Disable ACPI RTC event before handling
 it

[ Upstream commit 3f67038df8b5cba07254d1cff60d73e988b49ab7 ]

Users of RTC_UIE_ON can stop receiving update interrupts when rtc-cmos
handles alarms through ACPI. In one 50-run test, 40 runs passed and 10
timed out after receiving between one and four of five expected events.

The ACPI ff_rt_clk counter stopped at 218, exactly matching the number
of events delivered to userspace, and reported:

    218     STS disabled     unmasked

rtc_handler() runs in the threaded ACPI SCI handler and calls
cmos_interrupt(), which schedules rtc->irqwork. The work can run before
rtc_handler() returns:

    ACPI SCI thread          rtc->irqwork

    cmos_interrupt()
      schedule_work()
                             __rtc_set_alarm()
                               rtc_wake_on()
    acpi_clear_event()
    acpi_disable_event()

The SCI thread then disables the event that the worker enabled for the
next alarm. That alarm sets its status while delivery remains disabled,
so no update interrupt reaches userspace.

Clear and disable the current ACPI RTC event before cmos_interrupt()
schedules the work. The worker can then enable the next event without
the handler undoing it. With this ordering, 150 runs delivered all 750
events without a stall.

Fixes: 311ee9c151ad ("rtc: cmos: allow using ACPI for RTC alarm instead of HPET")
Cc: stable@vger.kernel.org
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Link: https://patch.msgid.link/20261015173029.3091872-2-gourry@gourry.net
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-cmos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b537f40654b723..9dfa1f4ef7ff6c 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -753,7 +753,9 @@ static u32 rtc_handler(void *context)
 	unsigned char rtc_intr;
 	unsigned long flags;
 
-
+	/* Quiesce this event before rtc->irqwork can arm the next one. */
+	acpi_clear_event(ACPI_EVENT_RTC);
+	acpi_disable_event(ACPI_EVENT_RTC, 0);
 	/*
 	 * Always update rtc irq when ACPI is used as RTC Alarm.
 	 * Or else, ACPI SCI is enabled during suspend/resume only,
@@ -776,8 +778,6 @@ static u32 rtc_handler(void *context)
 	}
 
 	pm_wakeup_hard_event(dev);
-	acpi_clear_event(ACPI_EVENT_RTC);
-	acpi_disable_event(ACPI_EVENT_RTC, 0);
 	return ACPI_INTERRUPT_HANDLED;
 }
 

From 45e57ee17b8a588a752f45b2b499756d9ee3d75c Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Sun, 11 Oct 2026 20:17:58 +0800
Subject: [PATCH 1654/1982] platform/x86/amd/pmc: Fix RTC reference leak in
 amd_pmc_verify_czn_rtc()

[ Upstream commit 22b9306f1fcf86f80b55f05f08d10a9951ba970a ]

amd_pmc_verify_czn_rtc() opens the RTC with rtc_class_open(), which
takes both a device reference and a module reference on the RTC
driver. The matching release is rtc_class_close(), and it is never
called. Every return path after the device has been opened, the ones
that return 0 as well as the ones that report an error, leaves both
references behind, so each S0i3 suspend leaks them.

Release the reference with a __free() cleanup on the declaration,
which covers every return path without adding labels.

rtc_class_close() does not accept a NULL argument, so the cleanup
helper has to guard against one: rtc_class_open() may fail and the
declaration still has to be cleaned up.

Found by code review.

Fixes: 59348401ebed ("platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup")
Cc: stable@vger.kernel.org
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261011121759.3267678-1-make_ruc2021@163.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/amd/pmc/pmc.c | 5 +++--
 include/linux/rtc.h                | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
index fea41c8c1899a3..8abb80e1803f91 100644
--- a/drivers/platform/x86/amd/pmc/pmc.c
+++ b/drivers/platform/x86/amd/pmc/pmc.c
@@ -14,6 +14,7 @@
 #include <linux/array_size.h>
 #include <linux/bitfield.h>
 #include <linux/bits.h>
+#include <linux/cleanup.h>
 #include <linux/debugfs.h>
 #include <linux/delay.h>
 #include <linux/dmi.h>
@@ -554,7 +555,6 @@ static int amd_pmc_wa_irq1(struct amd_pmc_dev *pdev)
 
 static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
 {
-	struct rtc_device *rtc_device;
 	time64_t then, now, duration;
 	struct rtc_wkalrm alarm;
 	struct rtc_time tm;
@@ -570,7 +570,8 @@ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
 	if (pdev->major < 64 || (pdev->major == 64 && pdev->minor < 53))
 		return 0;
 
-	rtc_device = rtc_class_open("rtc0");
+	struct rtc_device *rtc_device __free(rtc_class_close) =
+		rtc_class_open("rtc0");
 	if (!rtc_device)
 		return 0;
 	rc = rtc_read_alarm(rtc_device, &alarm);
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 95da051fb155da..116ac3cd5d54ed 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -13,6 +13,7 @@
 #define _LINUX_RTC_H_
 
 
+#include <linux/cleanup.h>
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/nvmem-provider.h>
@@ -199,6 +200,7 @@ extern void rtc_update_irq(struct rtc_device *rtc,
 
 extern struct rtc_device *rtc_class_open(const char *name);
 extern void rtc_class_close(struct rtc_device *rtc);
+DEFINE_FREE(rtc_class_close, struct rtc_device *, if (_T) rtc_class_close(_T));
 
 extern int rtc_irq_set_state(struct rtc_device *rtc, int enabled);
 extern int rtc_irq_set_freq(struct rtc_device *rtc, int freq);

From 5cc7fddfce17f86c9267eda1109efba234a156e5 Mon Sep 17 00:00:00 2001
From: Igor Velkov <iav@iav.lv>
Date: Sun, 4 Oct 2026 23:56:53 +0000
Subject: [PATCH 1655/1982] rtc: pcf8563: pass the driver data to the alarm
 interrupt handler

[ Upstream commit 5831f5fef10030c175e585d51b0e793dc6fef6ab ]

pcf8563_irq() takes its dev_id as struct pcf8563, but probe still
registers the interrupt with the i2c client. The handler then takes the
regmap pointer from the wrong structure: the first alarm oopses, the
level-low INT is never acknowledged, and the interrupt gets disabled as
spurious.

Only an RTC that has an interrupt (client->irq > 0) reaches this path.

Fixes: 00f1bb9b8486 ("rtc: pcf8563: Switch to regmap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Igor Velkov <iav@iav.lv>
Reviewed-by: Nobuhiro Iwamtasu <iwamatsu@nigauri.org>
Link: https://patch.msgid.link/20261004-pcf8563-irq-data-v1-1-f176763ddf2f@iav.lv
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf8563.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 7083d927820f90..c23f04bdd95ffc 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -531,7 +531,7 @@ static int pcf8563_probe(struct i2c_client *client)
 		err = devm_request_threaded_irq(&client->dev, client->irq,
 				NULL, pcf8563_irq,
 				IRQF_SHARED | IRQF_ONESHOT | irqflags,
-				pcf8563_driver.driver.name, client);
+				pcf8563_driver.driver.name, pcf8563);
 		if (err) {
 			dev_err(&client->dev, "unable to request IRQ %d\n",
 								client->irq);

From 6ffb37e91e6bb8a6e97f75e900d3456d71854c71 Mon Sep 17 00:00:00 2001
From: "Baek Kyu, Kim" <pocj8ur4in@gmail.com>
Date: Tue, 20 Oct 2026 00:47:18 +0900
Subject: [PATCH 1656/1982] hwmon: (sht3x) Return the consumed count for heater
 writes

[ Upstream commit 817ac527100c8e20684211eb919ffd6d875adc7a ]

heater_enable_store() returns the result of i2c_master_send(), which is
the two-byte command length on success rather than the sysfs input
count. This can report more bytes than were supplied, or a partial write
for a fully processed input. For example, writing "on\n" returns two
instead of three, so a caller retrying the remaining newline gets
-EINVAL even though the heater command succeeded. Retrying the remainder
of "off\n" can also send the heater-off command twice.

Return count after a complete command transfer. Preserve negative I2C
errors and return -EIO for nonnegative incomplete transfers, so a
zero-message transfer is not reported as a successful zero-byte write.
Keep the existing boolean parsing, command selection and locking.

Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/sht3x.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/sht3x.c b/drivers/hwmon/sht3x.c
index 5d04013efb5221..c3e68bde709df6 100644
--- a/drivers/hwmon/sht3x.c
+++ b/drivers/hwmon/sht3x.c
@@ -543,7 +543,10 @@ static ssize_t heater_enable_store(struct device *dev,
 
 	mutex_unlock(&data->i2c_lock);
 
-	return ret;
+	if (ret != SHT3X_CMD_LENGTH)
+		return ret < 0 ? ret : -EIO;
+
+	return count;
 }
 
 static int update_interval_read(struct device *dev)

From fdb8628449f31b54b6b5269dd47242d94ac1c3a4 Mon Sep 17 00:00:00 2001
From: Armin Wolf <W_Armin@gmx.de>
Date: Wed, 7 Oct 2026 01:45:34 +0200
Subject: [PATCH 1657/1982] hwmon: (acpi_power_meter) Fix 18.45 TW bug

[ Upstream commit 0b6eda22f9ab67ddb2a872b0c3fc578ad9f4e27e ]

The ACPI specification says:

"If an error occurs while obtaining the meter reading or if the value
is not available then an Integer with all bits set is returned"

This integer can also be 64-bit wide on ACPI 2.0 and later systems,
so we have to check for that too.

Compile-tested only.

Reported-by: Grant Slater <github@firefishy.com>
Closes: https://github.com/lm-sensors/lm-sensors/issues/460
Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug")
Cc: stable@vger.kernel.org
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/acpi_power_meter.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index de408df0c4d786..667dffde330155 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -10,6 +10,7 @@
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
 #include <linux/jiffies.h>
+#include <linux/limits.h>
 #include <linux/mutex.h>
 #include <linux/dmi.h>
 #include <linux/slab.h>
@@ -31,7 +32,12 @@
 #define POWER_METER_CAN_NOTIFY	(1 << 3)
 #define POWER_METER_IS_BATTERY	(1 << 8)
 #define UNKNOWN_HYSTERESIS	0xFFFFFFFF
-#define UNKNOWN_POWER		0xFFFFFFFF
+/*
+ * ACPI integers can either be 32-bit or 64-bit wide, so
+ * we have to check for both values.
+ */
+#define UNKNOWN_POWER_32	U32_MAX
+#define UNKNOWN_POWER_64	U64_MAX
 
 #define METER_NOTIFY_CONFIG	0x80
 #define METER_NOTIFY_TRIP	0x81
@@ -454,7 +460,7 @@ static int power_meter_read(struct device *dev, enum hwmon_sensor_types type,
 		ret = update_meter(res);
 		if (ret)
 			return ret;
-		if (res->power == UNKNOWN_POWER)
+		if (res->power == UNKNOWN_POWER_32 || res->power == UNKNOWN_POWER_64)
 			return -ENODATA;
 		*val = res->power * 1000;
 		break;

From 8803593347710323494c1bbeefe2f0781cee7950 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Sun, 11 Oct 2026 23:12:40 -0700
Subject: [PATCH 1658/1982] Input: always accept EV_SYN in input_event()

[ Upstream commit c1d13bfdb9c75c2885d10332174a887349eb0b51 ]

Commit 0cd587735205 ("Input: preallocate memory to hold event values")
moved allocation of dev->vals into input_allocate_device(), which caused
input core to accumulate events reported while seeding initial device
state before input_register_device().

However, because EV_SYN is only set in dev->evbit during
input_register_device() (and some drivers also overwrite dev->evbit
directly before registration), any EV_SYN/SYN_REPORT events sent before
registration were dropped by is_event_supported(), leaving those seeded
events stuck in dev->vals until the next SYN_REPORT after registration.

Always accept EV_SYN in input_event() and input_inject_event() without
checking dev->evbit so input_sync() flushes dev->vals as intended.

Reported-by: Karlos Abel <kabel@voidship.net>,
Fixes: 0cd587735205 ("Input: preallocate memory to hold event values")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://patch.msgid.link/asx50uz6iafsyAd5@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/input.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/input.c b/drivers/input/input.c
index a500e1e276c211..9907dd9ec880a1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -391,7 +391,7 @@ void input_handle_event(struct input_dev *dev,
 void input_event(struct input_dev *dev,
 		 unsigned int type, unsigned int code, int value)
 {
-	if (is_event_supported(type, dev->evbit, EV_MAX)) {
+	if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
 		guard(spinlock_irqsave)(&dev->event_lock);
 		input_handle_event(dev, type, code, value);
 	}
@@ -415,7 +415,7 @@ void input_inject_event(struct input_handle *handle,
 	struct input_dev *dev = handle->dev;
 	struct input_handle *grab;
 
-	if (is_event_supported(type, dev->evbit, EV_MAX)) {
+	if (type == EV_SYN || is_event_supported(type, dev->evbit, EV_MAX)) {
 		guard(spinlock_irqsave)(&dev->event_lock);
 		guard(rcu)();
 

From 8126595cc9ab1b2613867c8dbab79005cbe1ff87 Mon Sep 17 00:00:00 2001
From: Alexander Kochetkov <al.kochet@gmail.com>
Date: Fri, 2 Oct 2026 13:09:35 +0300
Subject: [PATCH 1659/1982] Revert "Input: matrix_keypad - force switch rows to
 input mode"

[ Upstream commit 1527451f87dfe368b8ddeeb501c24ac9bde6b589 ]

This reverts commit 01c84b03d80aab9f04c4e3e1f9085f4202ff7c29.

The commit makes every scan call gpiod_direction_input() on the row
GPIOs. On pin controllers where GPIO input and interrupt are separate
pinmux functions this switches the row pins out of interrupt mode, and
enable_row_irqs() does not switch them back: it only unmasks the
interrupts. Row interrupts then never arrive and the keypad stops
working. Seen with a matrix keypad on an Allwinner A64 board (PINE
A64-LTS); it works again with the commit reverted.

The workaround is not needed on Ingenic either: the author of the
reverted commit re-tested all available JZ47xx SoCs and they all report
the live pin state in interrupt mode, see the thread in Link.

Fixes: 01c84b03d80a ("Input: matrix_keypad - force switch rows to input mode")
Link: https://lore.kernel.org/all/4130C026-2A83-408B-836A-ECA044491C47@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Acked-by: Siarhei Volkau <lis8215@gmail.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Link: https://patch.msgid.link/20261002100935.449473-1-al.kochet@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/matrix_keypad.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index e50a6fea9a602f..4247772892caa9 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -135,9 +135,6 @@ static void matrix_keypad_scan(struct work_struct *work)
 
 	memset(new_state, 0, sizeof(new_state));
 
-	for (row = 0; row < keypad->num_row_gpios; row++)
-		gpiod_direction_input(keypad->row_gpios[row]);
-
 	/* assert each column and read the row status out */
 	for (col = 0; col < keypad->num_col_gpios; col++) {
 

From dba86614860210064742fa38ae2db0c9030dba27 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Sun, 18 Oct 2026 15:04:39 -0700
Subject: [PATCH 1660/1982] cgroup: fix cgroup.kill for exited thread group
 leader

[ Upstream commit da13e0e72a7329c95642c44b2d03d194ab071e04 ]

cgroup.kill does not work in case a process' thread group leader is gone
but other threads are still running. This is because __cgroup_kill()
only walks the thread group leaders and sends SIGKILL to each of them
with send_sig(), which uses PIDTYPE_PID:

1. The exited leader is still listed by CSS_TASK_ITER_PROCS as long as
   the process has live threads, but a signal directed at a single
   exiting task never takes effect: complete_signal() does not look for
   another thread to deliver it to, and __send_signal_locked() now drops
   it altogether.  The process keeps running.

2. The live threads of such a process can be migrated to another cgroup
   by writing any of their IDs to cgroup.procs, while the exited leader
   stays behind.  The destination cgroup has no thread group leader to
   iterate, so writing to its cgroup.kill does nothing at all.

In both cases the cgroup stays populated after cgroup.kill, and a
process inside a container can use this to survive the container being
killed.  This also works with a private PID namespace when the init of
the container is the process, as the PID namespace is not torn down
while init has live threads.

Case 1 can be fixed by using do_send_sig_info(..., PIDTYPE_TGID) instead
of send_sig(), so that the signal is taken by a live thread even if the
task found by the iterator is exiting. Note it was pointed out by Eric
in [1] while reviewing v2 of cgroup.kill patchset, and v3 was meant to
switch to it, but the change was only made in cgroup_post_fork(),
leaving __cgroup_kill() with send_sig().

Case 2 can only be fixed by iterating over all threads, so this is what
the fix also does. Once a thread group is being killed, its other
threads are skipped since they already have a fatal signal pending.

I ran some performance checks and the added cost is ~60 ns per every
thread on my laptop (and less than a millisecond for 10K threads),
which seems low. The time to "populated 0" seems unchanged.

The issue was found in crun by Anthropic's OSS Scanner, and crun is
getting a workaround for it [2] (which does what we needed to do
before cgroup.kill was added).

[1] https://lore.kernel.org/all/m1v97x6niq.fsf@fess.ebiederm.org/
[2] https://github.com/containers/crun/pull/2351

Fixes: 661ee6280931 ("cgroup: introduce cgroup.kill")
Cc: stable@vger.kernel.org # v5.14+
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cgroup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 07e1e29228197b..28db81da10b81e 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4219,7 +4219,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
 	cgrp->kill_seq++;
 	spin_unlock_irq(&css_set_lock);
 
-	css_task_iter_start(&cgrp->self, CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED, &it);
+	css_task_iter_start(&cgrp->self, CSS_TASK_ITER_THREADED, &it);
 	while ((task = css_task_iter_next(&it))) {
 		/* Ignore kernel threads here. */
 		if (task->flags & PF_KTHREAD)
@@ -4229,7 +4229,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
 		if (__fatal_signal_pending(task))
 			continue;
 
-		send_sig(SIGKILL, task, 0);
+		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID);
 	}
 	css_task_iter_end(&it);
 }

From c59b5fcbc7b777bcf89a976af57f52a95ba42b6f Mon Sep 17 00:00:00 2001
From: Jamal Hadi Salim <jhs@mojatatu.com>
Date: Sat, 10 Oct 2026 17:02:48 -0400
Subject: [PATCH 1661/1982] netdevsim: reject cls_bpf programs bound to another
 device

[ Upstream commit 5820ca58b409402505b9e904d1ded4908e0b6b81 ]

The issue:
nsim_bpf_setup_tc_block_cb() installs any device-bound SCHED_CLS program
without checking that its offload device matches the target netdev.  The
core cls_bpf attach path rejects a mismatching program, but a netdev that
joins a shared block later is replayed the stored filter by
cls_bpf_reoffload() before it is inserted into block->ports, so the
attach-time check cannot see it.  The driver callback is the
authoritative per-device acceptance boundary and must enforce the match
itself, as nfp already does in nfp_net_bpf_offload().

Without the check, replaying a device-bound program onto a different
bpf_offload_dev installs it into that device's netdevsim state, which
trips the WARN in nsim_bpf_uninit() (ns->bpf_offloaded set on a foreign
device) and can dereference a NULL prog->aux->offload in
nsim_prog_set_loaded().

The Fix:
Reject a device-bound program whose offload device does not match the
target netdev, with -EINVAL and an extack so the rejected replay is not
silent.  The check is intentionally narrower than nfp's: it fires only
for a dev-bound program, so nsim's bpf_tc_non_bound_accept mode (which
admits an unbound program onto the device) is unaffected.  Teardown is
never blocked: the guard is on the program being installed and an unbind
passes cls_bpf.prog = NULL.

Conditions to recreate the bug:
  - CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
  - load and pin a dev-bound SCHED_CLS program for netdevsim device B
  - install the program on a shared block owned by B
  - add an independently backed netdevsim device C to that block; the
    bind replays the filter to C's callback, and C's
    ports/0/bpf_offloaded_id takes the B-bound program id.

The reported Sashiko review is at
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809094418.901607-1-jhs@mojatatu.com

Fixes: 31d3ad832948 ("netdevsim: add bpf offload support")
Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
Cc: stable@vger.kernel.org
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-2@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/netdevsim/bpf.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 5f17f68f3c0838..319f75e42f7c3d 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -150,6 +150,17 @@ int nsim_bpf_setup_tc_block_cb(enum tc_setup_type type,
 		return -EOPNOTSUPP;
 	}
 
+	/* A dev-bound program can be replayed here when a netdev joins
+	 * a shared block, after the core attach-time check has run;
+	 * enforce the device match as nfp does.
+	 */
+	if (prog && bpf_prog_is_dev_bound(prog->aux) &&
+	    !bpf_offload_dev_match(prog, ns->netdev)) {
+		NSIM_EA(cls_bpf->common.extack,
+			"program bound to a different device");
+		return -EINVAL;
+	}
+
 	if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
 		return -EOPNOTSUPP;
 

From d43792f4263a309705d495bec65496b802cb40e7 Mon Sep 17 00:00:00 2001
From: Sorah Fukumori <her@sorah.jp>
Date: Tue, 13 Oct 2026 22:02:48 +0900
Subject: [PATCH 1662/1982] net: gro: don't chain linear parts larger than
 gso_size into frag_list

[ Upstream commit 679f6929a66db9f5a6611dad37545fbd705962d5 ]

skb_gro_receive() chains an skb into the frag_list of the held packet
when its payload cannot be attached as page frags: when its head is
not a page fragment and still holds payload, or when its head and
frags would overflow the frags[] array of the last packet. Since commit
5eddb24901ee ("gro: add support of (hw)gro packets to gro stack"), that
skb may itself be a GSO packet whose linear part holds several
gso_size segments. skb_segment() cannot split the linear part of a
frag_list member across segments, so segmenting the aggregate in
software, e.g. when forwarding it to a device without NETIF_F_FRAGLIST,
hits

  BUG_ON(skb_headlen(list_skb) > len);

Fully linear GSO packets come from generic XDP. When the program does
not support frags, netif_skb_check_for_xdp() linearizes any nonlinear
skb with pskb_expand_head() and skb_linearize() and keeps its GSO
metadata. GRO on the device runs before generic XDP, so each aggregate
passed by the program carries all of its payload in a kmalloc'ed head.
A tunnel that decapsulates these packets and runs GRO again through
gro_cells then builds the bad frag_list. This was first seen on a
router that forwards TCP received over VXLAN, with a non-frags XDP
program attached in SKB mode to the underlying bond because one slave
lacks native XDP:

  kernel BUG at net/core/skbuff.c:4917!
  RIP: 0010:skb_segment+0xbb6/0xf40
  Call Trace:
   tcp_gso_segment
   ipv6_gso_segment
   skb_mac_gso_segment
   __skb_gso_segment
   validate_xmit_skb
   __dev_queue_xmit
   ip6_output
   ip6_sublist_rcv_finish
   ipv6_list_rcv
   netif_receive_skb_list_internal
   gro_complete
   dev_gro_receive
   gro_receive_skb
   gro_cell_poll
   __napi_poll
   net_rx_action

It reproduces with three network namespaces: TCP sent over VXLAN on an
IPv6 veth link to a router namespace that has an XDP_PASS program
without frags support attached to the underlay veth in generic mode
and GRO enabled on its VXLAN device, and forwards to a veth with
tx-scatter-gather-fraglist disabled.

A program with frags support in generic mode gives similar packets.
skb_pp_cow_data() rebuilds the skb with up to about a page of linear
data in a page_pool head_frag and keeps the GSO metadata, so once
frags[] is full the next such packet is chained through frag_list
with more than gso_size bytes in its head as well.

Refuse the merge when the linear part to be chained exceeds the held
packet's gso_size. tcp_gro_receive() then flushes the held packet and
the skb starts a new GRO packet as its head, whose linear length
skb_segment() handles.

Fixes: 5eddb24901ee ("gro: add support of (hw)gro packets to gro stack")
Cc: stable@vger.kernel.org
Assisted-by: claude-opus-5-5
Signed-off-by: Sorah Fukumori <her@sorah.jp>
Tested-by: Chase Hiltz <me@chasehil.tz>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://patch.msgid.link/20261013130250.3643916-1-her@sorah.jp
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/gro.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/gro.c b/net/core/gro.c
index 252d7851d1aee5..f96e5024758e21 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -192,6 +192,10 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 	}
 
 merge:
+	/* skb_segment() cannot split the linear part of a frag_list member. */
+	if (unlikely(headlen > offset + skb_shinfo(p)->gso_size))
+		return -E2BIG;
+
 	/* sk ownership - if any - completely transferred to the aggregated packet */
 	skb->destructor = NULL;
 	skb->sk = NULL;

From f82eafe282ea30abb82ca697069a33018de831d9 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Mon, 19 Oct 2026 17:45:30 +0300
Subject: [PATCH 1663/1982] ALSA: compress: fix buffer leak on failed
 SET_PARAMS

[ Upstream commit fbc74ca9fbf7e0b8f6872ccac62f9f4a1f3b5e53 ]

When the driver has neither ops->copy nor a preallocated dma_buffer_p,
snd_compr_allocate_buffer() kmallocs runtime->buffer. If
ops->set_params() then rejects the parameters, SET_PARAMS fails, the
stream stays in the OPEN state and keeps the buffer. The next
SET_PARAMS allocates a new buffer and overwrites the pointer, so
repeated SET_PARAMS calls with parameters that the driver rejects leak
one buffer per call.

Release the framework-owned buffer when ops->set_params() fails on an
OPEN stream, so that a failed SET_PARAMS leaves no buffer behind and
the buffer is allocated only once per successful setup. Use the same
ownership check as snd_compr_free().

Fixes: b21c60a4edd2 ("ALSA: core: add support for compress_offload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 065cdfaef1eaa3..c4114186b0d113 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -661,8 +661,15 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 			return -ENOMEM;
 
 		retval = stream->ops->set_params(stream, params);
-		if (retval)
+		if (retval) {
+			/* the stream stays OPEN: drop the buffer of the rejected setup */
+			if (stream->runtime->state == SNDRV_PCM_STATE_OPEN &&
+			    !stream->runtime->dma_buffer_p) {
+				kfree(stream->runtime->buffer);
+				stream->runtime->buffer = NULL;
+			}
 			return retval;
+		}
 
 		if (stream->next_track)
 			return retval;

From bda1fb7c15d9c7a293cc974d0325125ec577992a Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Mon, 19 Oct 2026 17:45:31 +0300
Subject: [PATCH 1664/1982] ALSA: compress: reject buffer geometry change on
 gapless next_track

[ Upstream commit 82da1acad6fd60b6072dd5f3383e6a55efdd2ac7 ]

snd_compr_set_params() is invoked from the gapless next_track
re-entry path, which calls snd_compr_allocate_buffer() again and lets
buffer_size change while total_bytes_available and
total_bytes_transferred still hold values computed for the previous
buffer. snd_compr_calc_avail() then derives an avail/count value from
those stale counters against the new buffer_size, and
snd_compr_write_data() copy_from_user()s that many bytes into the
new, potentially smaller buffer, overflowing it with user-controlled
length and content.

The buffer is set up once, with the initial SET_PARAMS, and neither the
core nor the DSP expects it to change for a gapless track transition.
Do not call snd_compr_allocate_buffer() on the next_track path and
reject a request that changes the buffer geometry, so that the codec
parameters that the driver receives match the buffer in use.

Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261019144533.30665-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index c4114186b0d113..b707bdbb970694 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -656,9 +656,19 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 		if (retval)
 			return retval;
 
-		retval = snd_compr_allocate_buffer(stream, params);
-		if (retval)
-			return -ENOMEM;
+		if (stream->next_track) {
+			/*
+			 * total_bytes_available/transferred still refer to the
+			 * current buffer; its geometry must not change.
+			 */
+			if (params->buffer.fragment_size != stream->runtime->fragment_size ||
+			    params->buffer.fragments != stream->runtime->fragments)
+				return -EINVAL;
+		} else {
+			retval = snd_compr_allocate_buffer(stream, params);
+			if (retval)
+				return retval;
+		}
 
 		retval = stream->ops->set_params(stream, params);
 		if (retval) {

From 50eb0b68ff6446928588052d2d92274a5c4cb77a Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Mon, 19 Oct 2026 17:45:32 +0300
Subject: [PATCH 1665/1982] ALSA: compress: add missing OPEN-state gate to
 SET_METADATA

[ Upstream commit 931f5714b7921290cd1a4742e185aeeae7270ee6 ]

snd_compr_set_metadata() calls stream->ops->set_metadata() straight
after copy_from_user(), without ever checking runtime->state, even
though the function's own comment says a parameter change should only
be allowed once the stream has left the OPEN state. Every other
metadata/param entry point in this file (SET_PARAMS, WRITE, ...)
enforces that gate.

A codec driver's set_metadata callback can assume SET_PARAMS has
already run and initialised its private state; calling it while the
stream is still OPEN can operate on that uninitialised state.

Add the OPEN-state check the existing comment already documents.

Fixes: 9727b490e543 ("ALSA: compress: add support for gapless playback")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index b707bdbb970694..1bf943b189cd0f 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -748,6 +748,9 @@ snd_compr_set_metadata(struct snd_compr_stream *stream, unsigned long arg)
 	* we should allow parameter change only when stream has been
 	* opened not in other cases
 	*/
+	if (stream->runtime->state == SNDRV_PCM_STATE_OPEN)
+		return -EBADFD;
+
 	if (copy_from_user(&metadata, (void __user *)arg, sizeof(metadata)))
 		return -EFAULT;
 

From 6d379def894e29a93019b5c04412c807f116255d Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Mon, 19 Oct 2026 17:45:33 +0300
Subject: [PATCH 1666/1982] ALSA: compress: reject restarting an ACTIVE task
 via origin_seqno

[ Upstream commit 0ade01edd33181b65393cf3864cb2ac7c5eb1487 ]

snd_compr_task_start_prepare() only rejects tasks with
state >= SND_COMPRESS_TASK_STATE_FINISHED. Since the enum is
IDLE(0) < ACTIVE(1) < FINISHED(2), this accepts ACTIVE tasks and
rejects FINISHED ones, the opposite of what the origin_seqno
mechanism needs: origin_seqno is meant to let a caller reuse a
FINISHED task's buffers for a new job, not to restart a task that is
still queued with the driver.

The seqno lookup path in snd_compr_task_start() has its own explicit
"task->state != IDLE" guard, but the origin_seqno lookup path relies
solely on this function, so it can restart an ACTIVE task, causing
ops->task_start() to be called twice for the same task and
runtime->active_tasks to be incremented twice without a matching
finish/stop.

Accept IDLE and FINISHED, reject ACTIVE, on both entry paths.

Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patch.msgid.link/20261019144533.30665-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 1bf943b189cd0f..e1b2da84f77824 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -1142,7 +1142,9 @@ static int snd_compr_task_start_prepare(struct snd_compr_task_runtime *task,
 {
 	if (task == NULL)
 		return -EINVAL;
-	if (task->state >= SND_COMPRESS_TASK_STATE_FINISHED)
+	/* only an unqueued or already finished task may be (re)started */
+	if (task->state != SND_COMPRESS_TASK_STATE_IDLE &&
+	    task->state != SND_COMPRESS_TASK_STATE_FINISHED)
 		return -EBUSY;
 	if (utask->input_size > task->input->size)
 		return -EINVAL;

From 7986ac275e14fa80dc400ac2776b485467a0b2a2 Mon Sep 17 00:00:00 2001
From: Wang Yan <wangyan01@kylinos.cn>
Date: Tue, 20 Oct 2026 17:09:59 +0800
Subject: [PATCH 1667/1982] ALSA: mtpav: restore negation dropped in guard()
 conversion

[ Upstream commit 47c3d5b885a4fcf65238c0cc525dd3c1cc65aa89 ]

commit 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
claims to be "Merely code refactoring, and no behavior change", but
it accidentally dropped the "!" from

        if (! (portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED))

in snd_mtpav_output_trigger().

Restore the negation.

Fixes: 316e0074ecdc ("ALSA: mtpav: Use guard() for spin locks")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020090959.570101-1-wangyan01@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/drivers/mtpav.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index 1ed6d4f0cb625d..288a873a27e615 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -443,7 +443,7 @@ static void snd_mtpav_output_trigger(struct snd_rawmidi_substream *substream, in
 
 	scoped_guard(spinlock_irqsave, &mtp_card->spinlock) {
 		if (up) {
-			if ((portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
+			if (!(portp->mode & MTPAV_MODE_OUTPUT_TRIGGERED)) {
 				if (mtp_card->istimer++ == 0)
 					snd_mtpav_add_output_timer(mtp_card);
 				portp->mode |= MTPAV_MODE_OUTPUT_TRIGGERED;

From 7dff4e2578fee54e8244df7c93bf627ce160632d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 20 Oct 2026 12:16:21 +0200
Subject: [PATCH 1668/1982] ALSA: emux: Stop voices before freeing zones in all
 cases

[ Upstream commit 8a5d87c2ba30e8de31cfbe888fd4d95f43c63db9 ]

The emux voice caches the soundfont zone pointer in vp->zone, which
is referred to later, e.g. in snd_emux_send_effect().  For avoiding
dangling pointers, the soundfont code calls the sample_reset callback
to stop all voices before freeing zones.  However, in a few cases
(e.g. emu10k1's missing sample_reset or the call path via
remove_info()), the sample reset isn't called properly, leaving the
playing voices.

Fix it by always registering the sample_reset callback, falling back
to snd_emux_terminate_all() when the driver has no own ops, and by
calling sample_reset in remove_info() before freeing the zones.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/synth/emux/emux.c      | 10 +++++++---
 sound/synth/emux/soundfont.c |  9 +++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index 01444fc960d086..863d35aff19601 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -71,7 +71,12 @@ static int sf_sample_free(void *private_data, struct snd_sf_sample *sp,
 static void sf_sample_reset(void *private_data)
 {
 	struct snd_emux *emu = private_data;
-	emu->ops.sample_reset(emu);
+
+	/* stop all voices that might refer to zones and samples to be freed */
+	if (emu->ops.sample_reset)
+		emu->ops.sample_reset(emu);
+	else
+		snd_emux_terminate_all(emu);
 }
 
 int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, char *name)
@@ -96,8 +101,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch
 	sf_cb.private_data = emu;
 	sf_cb.sample_new = sf_sample_new;
 	sf_cb.sample_free = sf_sample_free;
-	if (emu->ops.sample_reset)
-		sf_cb.sample_reset = sf_sample_reset;
+	sf_cb.sample_reset = sf_sample_reset;
 	emu->sflist = snd_sf_new(&sf_cb, emu->memhdr);
 	if (emu->sflist == NULL)
 		return -ENOMEM;
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 30793a131746ee..2f8ba39d4a6f6d 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -443,6 +443,15 @@ remove_info(struct snd_sf_list *sflist, struct snd_soundfont *sf,
 	struct snd_sf_zone *prev, *next, *p;
 	int removed = 0;
 
+	/* stop voices before freeing the zones they might refer to */
+	for (p = sf->zones; p; p = p->next) {
+		if (!p->mapped && p->bank == bank && p->instr == instr) {
+			if (sflist->callback.sample_reset)
+				sflist->callback.sample_reset(sflist->callback.private_data);
+			break;
+		}
+	}
+
 	prev = NULL;
 	for (p = sf->zones; p; p = next) {
 		next = p->next;

From 0fad7fba30c8ba80968a9867a765987b3ffa6cb2 Mon Sep 17 00:00:00 2001
From: "Baek Kyu, Kim" <pocj8ur4in@gmail.com>
Date: Sun, 18 Oct 2026 13:44:56 +0900
Subject: [PATCH 1669/1982] gpiolib: Free chip resources when allocating the
 label fails

[ Upstream commit 8381e1f15e27087fcb6f07046a526ac8b9b9b2b9 ]

If desc_set_label() fails after the chip's request callback succeeds,
gpiod_request_commit() clears GPIOD_FLAG_REQUESTED without calling the
free callback. The caller receives an error and has no GPIO to release,
leaving resources acquired by the request callback held.

Call the chip's free callback, if present, before clearing the requested
bit on label allocation failure. Leave request callback errors on the
existing path to avoid freeing a failed request.

Cc: stable@vger.kernel.org
Fixes: 1f2bcb8c8ccd ("gpio: protect the descriptor label with SRCU")
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261018044456.1259250-1-pocj8ur4in@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index d0efcb96d27696..635b77c0eab53c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2464,10 +2464,13 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 
 	ret = desc_set_label(desc, label ? : "?");
 	if (ret)
-		goto out_clear_bit;
+		goto out_free_gpio;
 
 	return 0;
 
+out_free_gpio:
+	if (guard.gc->free)
+		guard.gc->free(guard.gc, offset);
 out_clear_bit:
 	clear_bit(GPIOD_FLAG_REQUESTED, &desc->flags);
 	return ret;

From 0f3f389215cb80d97540f87cef3d07a72776ac38 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 20 Oct 2026 13:31:17 +0200
Subject: [PATCH 1670/1982] ALSA: line6: Handle period elapsed calls outside
 the locks

[ Upstream commit 443ed4edc2678cc51c5a01e7dffc4c890be40051 ]

LINE6 driver may call snd_pcm_period_elapsed() for both playback and
capture substreams at processing the playback substream, and this may
lead to a ABBA deadlock.

Move the actual calls of snd_pcm_period_elapsed() outside the locks
for avoiding it.  The capture period notification at submitting the
initial playback URBs (only with the impulse mode) is simply skipped,
as it's done in the lock context; it'll be caught up at the next
period.

Fixes: f56742cc4189 ("ALSA: line6: Add LINE6_CAP_IN_NEEDS_OUT, a void playback stream during capture")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5a9de389-e6ea-410d-8322-e74e14152603
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20261020113118.234689-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/line6/capture.c  | 25 ++++++++++++++++---------
 sound/usb/line6/capture.h  |  2 +-
 sound/usb/line6/playback.c | 31 +++++++++++++++++++++----------
 3 files changed, 38 insertions(+), 20 deletions(-)

diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index 9ef4faa006a038..46acd2f44c440b 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -125,24 +125,21 @@ void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf, int fsize)
 		line6pcm->in.pos_done -= runtime->buffer_size;
 }
 
-void line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
+/* update the capture position and check whether we need period_elapsed call */
+bool line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
 {
-	struct snd_pcm_substream *substream =
-	    get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE);
-
 	line6pcm->in.bytes += length;
 	if (line6pcm->in.bytes >= line6pcm->in.period) {
 		line6pcm->in.bytes %= line6pcm->in.period;
-		spin_unlock(&line6pcm->in.lock);
-		snd_pcm_period_elapsed(substream);
-		spin_lock(&line6pcm->in.lock);
+		return true;
 	}
+	return false;
 }
 
 /*
  * Callback for completed capture URB.
  */
-static void audio_in_callback(struct urb *urb)
+static bool handle_audio_in(struct urb *urb)
 {
 	int i, index, length = 0, shutdown = 0;
 	struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
@@ -207,8 +204,18 @@ static void audio_in_callback(struct urb *urb)
 
 		if (!test_bit(LINE6_STREAM_IMPULSE, &line6pcm->in.running) &&
 		    test_bit(LINE6_STREAM_PCM, &line6pcm->in.running))
-			line6_capture_check_period(line6pcm, length);
+			return line6_capture_check_period(line6pcm, length);
 	}
+
+	return false;
+}
+
+static void audio_in_callback(struct urb *urb)
+{
+	struct snd_line6_pcm *line6pcm = (struct snd_line6_pcm *)urb->context;
+
+	if (handle_audio_in(urb))
+		snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
 }
 
 /* open capture callback */
diff --git a/sound/usb/line6/capture.h b/sound/usb/line6/capture.h
index 90572dae134eee..628315389efcf1 100644
--- a/sound/usb/line6/capture.h
+++ b/sound/usb/line6/capture.h
@@ -17,7 +17,7 @@ extern const struct snd_pcm_ops snd_line6_capture_ops;
 
 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
 			       int fsize);
-extern void line6_capture_check_period(struct snd_line6_pcm *line6pcm,
+extern bool line6_capture_check_period(struct snd_line6_pcm *line6pcm,
 				       int length);
 extern int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm);
 extern int line6_submit_audio_in_all_urbs(struct snd_line6_pcm *line6pcm);
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 2e70ca5456c5a4..495a983a0c51f1 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -136,6 +136,8 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,
 /*
 	Find a free URB, prepare audio data, and submit URB.
 	must be called in line6pcm->out.lock context
+	Returns 1 if snd_pcm_period_elapsed() needs to be called for the
+	capture stream after releasing the lock, 0 if not, or a negative error
 */
 static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
 {
@@ -151,6 +153,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
 		line6pcm->properties->rates.rats[0].den *
 		(line6pcm->line6->intervals_per_second / LINE6_ISO_INTERVAL);
 	struct urb *urb_out;
+	bool capture_period_elapsed = false;
 
 	index = find_first_zero_bit(&line6pcm->out.active_urbs,
 				    line6pcm->line6->iso_buffers);
@@ -260,8 +263,9 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
 						   urb_out->transfer_buffer,
 						   urb_out->
 						   transfer_buffer_length);
-				line6_capture_check_period(line6pcm,
-					urb_out->transfer_buffer_length);
+				capture_period_elapsed =
+					line6_capture_check_period(line6pcm,
+								   urb_out->transfer_buffer_length);
 			}
 		} else {
 			if (!(line6pcm->line6->properties->capabilities & LINE6_CAP_HWMON)
@@ -283,24 +287,26 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
 		dev_err(line6pcm->line6->ifcdev,
 			"URB out #%d submission failed (%d)\n", index, ret);
 
-	return 0;
+	return capture_period_elapsed;
 }
 
 /*
 	Submit all currently available playback URBs.
 	must be called in line6pcm->out.lock context
+	The capture period notification is skipped here since we can't call
+	snd_pcm_period_elapsed() in the lock; it'll be caught up at the next one.
  */
 int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm)
 {
-	int ret = 0, i;
+	int ret, i;
 
 	for (i = 0; i < line6pcm->line6->iso_buffers; ++i) {
 		ret = submit_audio_out_urb(line6pcm);
 		if (ret < 0)
-			break;
+			return ret;
 	}
 
-	return ret;
+	return 0;
 }
 
 /*
@@ -316,6 +322,8 @@ static void audio_out_callback(struct urb *urb)
 	const int bytes_per_frame =
 		line6pcm->properties->bytes_per_channel *
 		line6pcm->properties->playback_hw.channels_max;
+	bool capture_period_elapsed = false;
+	bool playback_period_elapsed = false;
 
 #if USE_CLEAR_BUFFER_WORKAROUND
 	memset(urb->transfer_buffer, 0, urb->transfer_buffer_length);
@@ -358,19 +366,22 @@ static void audio_out_callback(struct urb *urb)
 		shutdown = 1;
 
 	if (!shutdown) {
-		submit_audio_out_urb(line6pcm);
+		capture_period_elapsed = submit_audio_out_urb(line6pcm) > 0;
 
 		if (test_bit(LINE6_STREAM_PCM, &line6pcm->out.running)) {
 			line6pcm->out.bytes += length;
 			if (line6pcm->out.bytes >= line6pcm->out.period) {
 				line6pcm->out.bytes %= line6pcm->out.period;
-				spin_unlock(&line6pcm->out.lock);
-				snd_pcm_period_elapsed(substream);
-				spin_lock(&line6pcm->out.lock);
+				playback_period_elapsed = true;
 			}
 		}
 	}
 	spin_unlock_irqrestore(&line6pcm->out.lock, flags);
+
+	if (capture_period_elapsed)
+		snd_pcm_period_elapsed(get_substream(line6pcm, SNDRV_PCM_STREAM_CAPTURE));
+	if (playback_period_elapsed)
+		snd_pcm_period_elapsed(substream);
 }
 
 /* open playback callback */

From e27d2775f9dbfe3301ddafc78bb9861399762084 Mon Sep 17 00:00:00 2001
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Date: Sun, 18 Oct 2026 22:36:22 +0530
Subject: [PATCH 1671/1982] gpio: davinci: Clear interrupt status in every bank
 on suspend

[ Upstream commit 800d7627f552bbf602a1736b638aee0ada3fbf87 ]

davinci_gpio_save_context() saves the registers of each 32-GPIO
register bank, but clears interrupt status only after the loop. At that
point g refers to the last bank, so pending status in all preceding
banks is left uncleared.

Move the interrupt-status write into the per-bank loop so that the
existing suspend-time clearing covers every register bank. Single-bank
controllers retain the same behavior.

Fixes: 0651a730924b ("gpio: davinci: Add support for system suspend/resume PM")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018170622.3406158-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-davinci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 5de42f1143dab6..80b3b36cf703a0 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -593,10 +593,10 @@ static void davinci_gpio_save_context(struct davinci_gpio_controller *chips,
 		context->set_data = readl_relaxed(&g->set_data);
 		context->set_rising = readl_relaxed(&g->set_rising);
 		context->set_falling = readl_relaxed(&g->set_falling);
-	}
 
-	/* Clear all interrupt status registers */
-	writel_relaxed(GENMASK(31, 0), &g->intstat);
+		/* Clear stale interrupt status for this bank. */
+		writel_relaxed(GENMASK(31, 0), &g->intstat);
+	}
 }
 
 static void davinci_gpio_restore_context(struct davinci_gpio_controller *chips,

From 2d12e5db3317566e400144e1f99d334f7fabf3dd Mon Sep 17 00:00:00 2001
From: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Date: Sun, 18 Oct 2026 22:20:03 +0530
Subject: [PATCH 1672/1982] gpio: pca953x: Handle direction register read
 errors in IRQ paths

[ Upstream commit a0fe269293509acdd93b9cfb3f46636f7b91b33a ]

Three IRQ paths ignore the result of reading the direction registers
and then use the destination bitmap. pca953x_read_regs() does not populate
that bitmap when regmap_bulk_read() fails, leaving the callers to use
uninitialized stack data.

This can select incorrect GPIOs for direction changes during IRQ bus
synchronization, corrupt the saved input state during IRQ setup, or
produce incorrect pending interrupt decisions.

Check the read result at all three sites. Release irq_lock without
changing GPIO directions on failure, leave the IRQ history untouched
when pending detection fails, and propagate the error from IRQ setup.
The read helper already logs the error.

Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
Link: https://patch.msgid.link/20261018165003.3372368-1-sahaj123.sc@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-pca953x.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 4eeac12ad0ed36..7ebc4f9662c918 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -863,6 +863,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	DECLARE_BITMAP(irq_mask, MAX_LINE);
 	DECLARE_BITMAP(reg_direction, MAX_LINE);
 	int level;
+	int ret;
 
 	guard(mutex)(&chip->i2c_lock);
 
@@ -877,7 +878,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	}
 
 	/* Switch direction to input if needed */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		goto out;
 
 	bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
 	bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
@@ -889,6 +892,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	for_each_set_bit(level, irq_mask, gc->ngpio)
 		pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
 
+out:
 	mutex_unlock(&chip->irq_lock);
 }
 
@@ -983,7 +987,9 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
 	}
 
 	/* Remove output pins from the equation */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		return false;
 
 	bitmap_copy(old_stat, chip->irq_stat, gc->ngpio);
 
@@ -1084,7 +1090,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
 	 * interrupt.  We have to rely on the previous read for
 	 * this purpose.
 	 */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		return ret;
 	bitmap_and(chip->irq_stat, irq_stat, reg_direction, gc->ngpio);
 	mutex_init(&chip->irq_lock);
 

From 1c2c129c4e7fc2b70c81554415a1d8826563a247 Mon Sep 17 00:00:00 2001
From: Nirmoy Das <nirmoyd@nvidia.com>
Date: Tue, 20 Oct 2026 05:51:29 -0700
Subject: [PATCH 1673/1982] blk-mq: clear stale inactive flag on hctx reuse

[ Upstream commit afc1de47a7ab607ae6403c4bfda36b0bf3cd342f ]

When the last CPU mapped to an hctx goes offline,
blk_mq_hctx_notify_offline() sets BLK_MQ_S_INACTIVE. Updating the
number of hardware queues exits every hctx and parks it on
q->unused_hctx_list. A later update can reuse a parked hctx through
blk_mq_alloc_and_init_hctx(), at any queue index, and nothing clears
the flag.

If the reused hctx is mapped to an online CPU, blk_mq_get_tag() keeps
returning BLK_MQ_NO_TAG for it. __blk_mq_alloc_requests() sleeps and
retries, expecting CPU hotplug to move the task to another CPU, so a
task that stays on that CPU never gets a tag. Onlining the original CPU
doesn't recover it either, because blk_mq_hctx_notify_online() only
clears the flag on the hctx that CPU now maps to.

Clear BLK_MQ_S_INACTIVE in blk_mq_init_hctx() so a reused hctx starts
like a freshly allocated one. A reused hctx has no cpuhp instances at
that point, so the offline callback can't set the flag again before
blk_mq_add_hw_queues_cpuhp() registers it. Clearing the flag in
blk_mq_exit_hctx() is not enough, because a parked hctx keeps its cpuhp
instances until blk_mq_remove_hw_queues_cpuhp(). Preserve the other
hctx state flags.

Reproduced with null_blk on v7.3 in a four-vCPU arm64 QEMU/KVM guest:

  modprobe null_blk nr_devices=0
  mkdir /sys/kernel/config/nullb/nullb0
  cd /sys/kernel/config/nullb/nullb0
  echo 4 > submit_queues; echo 1 > memory_backed; echo 16 > size
  echo 1 > power
  echo 0 > /sys/devices/system/cpu/cpu3/online
  echo 2 > submit_queues
  echo 4 > submit_queues

Offlining CPU3 marks hctx3 inactive. After the two updates it comes back
as hctx1 and is mapped to CPU0:

  # cat /sys/block/nullb0/mq/1/cpu_list
  0
  # cat /sys/kernel/debug/block/nullb0/hctx1/state
  INACTIVE

A 4K O_DIRECT read pinned to CPU0 hangs in D state, while the same read
on CPU1 and CPU2 completes. Onlining CPU3 again leaves hctx1 inactive
and the CPU0 read still hangs. With this change hctx1 state is empty and
the reads on CPU0, CPU1 and CPU2 complete, before and after onlining
CPU3.

Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Link: https://patch.msgid.link/20261020125129.430600-1-nirmoyd@nvidia.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 73ee5a9ea51d65..cced68a0e3c539 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4016,6 +4016,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
 		goto fail;
 
 	hctx->queue_num = hctx_idx;
+	clear_bit(BLK_MQ_S_INACTIVE, &hctx->state);
 
 	hctx->tags = set->tags[hctx_idx];
 

From d72ea8b655133aed1c4b316cbc9c07a43e9fdf43 Mon Sep 17 00:00:00 2001
From: Luigi Lauro <luigi.lauro@gmail.com>
Date: Wed, 14 Oct 2026 15:33:56 +0200
Subject: [PATCH 1674/1982] drm/amdgpu: require _PR3 for BOCO

[ Upstream commit 28f3d169f162ca7e803c5a1f7e1bb55bdc915d1c ]

amdgpu_device_supports_boco() returns true for an AMD_IS_PX device on a
system with a hybrid ATPX method even when the device has no ACPI power
resource (_PR3). On an APU mini PC with a discrete GPU attached over
OCuLink, the iGPU's ATPX method reports hybrid graphics, the dGPU is
flagged AMD_IS_PX, and runtime PM in auto mode picks BOCO:

  amdgpu: ATPX Hybrid Graphics
  amdgpu 0000:c6:00.0: Using BOCO for runtime pm

In BOCO mode the driver leaves powering the device off to the PCI core,
which can only do it through _PR3 on the upstream bridge. No device on
this dGPU's path has _PR3, so when it runtime suspends the card stays
powered, with its fans at about 700 rpm.

Require has_pr3 for BOCO, as the function's description ("dGPU with ACPI
power resources") says. The same card then picks BACO, which powers it
down:

  amdgpu 0000:c6:00.0: Using BACO for runtime pm

This only changes systems with a hybrid ATPX method and no _PR3 on the
dGPU's upstream bridge, where BOCO cannot cut the power today. Tested on
one such system only, an RX 9070 XT (Navi 48) over OCuLink with a Ryzen
AI 9 HX 470, with the change backported to 7.2.9: the stock module logs
"Using BOCO", the patched one "Using BACO"; BACO runtime suspend powers
the card off and it resumes cleanly. Not tested on a hybrid laptop or a
Thunderbolt eGPU.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5980
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1a039805354a44aab7abb2a6e685212d48b17a5e)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 88dda7dd2cd1c7..4a1b8795d117b3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -442,10 +442,8 @@ bool amdgpu_device_supports_boco(struct amdgpu_device *adev)
 	if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
 		return false;
 
-	if (adev->has_pr3 ||
-	    ((adev->flags & AMD_IS_PX) && amdgpu_is_atpx_hybrid()))
-		return true;
-	return false;
+	/* BOCO needs a platform power resource (_PR3) to cut the power */
+	return adev->has_pr3;
 }
 
 /**

From 94b703ea1438cff1de0f3036a0800bbb90f66256 Mon Sep 17 00:00:00 2001
From: Maciej Kucharek <qchcio@gmail.com>
Date: Thu, 15 Oct 2026 11:57:11 +0200
Subject: [PATCH 1675/1982] drm/amdgpu: reset SI ASIC on MacBookPros with VRAM
 at 0

[ Upstream commit 5b56ede880317bd912f914d5cd38ba1d357677fa ]

On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled.  The EFI stub enables the iGPU on
these machines through apple_set_os().  On a MacBookPro11,5 (Radeon R9
M370X, 1002:6821, subsystem 106b:0149), the driver adopts this layout
at init:

  MC_VM_FB_LOCATION=0x007f0000, HDP_NONSURFACE_BASE=0
  VRAM at 0x0-0x7fffffff, GART table at 0x1400000

The driver posts the ASIC again on S3 resume and after a GPU reset.
The VBIOS asic_init table then moves VRAM back to the VBIOS default:

  MC_VM_FB_LOCATION=0xf47ff400, HDP_NONSURFACE_BASE=0xf4000000

gmc_v6_0 does not reprogram these registers.  The GART table is then
no longer in VRAM, and the gfx ring test times out:

  amdgpu: ring gfx test failed (-110)
  amdgpu: resume of IP block <gfx_v6_0> failed -110

Reset and post the ASIC at driver load on Apple boards with VRAM at 0.
The driver then uses the VBIOS layout (VRAM at 0xf400000000) from the
start, and later posts keep it.  After the reset, FB_BASE is not 0, so
a module reload does not reset the ASIC again.

The test is the same one that commit c54e4d105077 ("drm/amdgpu: make
Mac FB workaround generic") uses: an Apple subsystem vendor and VRAM at
0.  The VI quirk for the MacBookPro14,3 resets at load for the same
reason:

  commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")

Other Apple SI boards get the same reset if FB_BASE reads 0 at load.

Tested on a MacBookPro11,5 with 7.2.5 and this patch: the panel comes
up at boot, and 4 of 4 deep S3 cycles resume.  Without the patch, S3
resume fails every time.  The GPU reset path is not tested.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5978
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 60dd16ae10f286cb9cce5b6027b2d5ee869637af)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/si.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index e0f139de79915a..0c96a40fe4b4ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -1524,6 +1524,16 @@ static bool si_need_full_reset(struct amdgpu_device *adev)
 
 static bool si_need_reset_on_init(struct amdgpu_device *adev)
 {
+	/*
+	 * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+	 * is enabled.  Any later post (S3 resume, GPU reset) moves it back to
+	 * the vbios default, so reset and post on load to start with the
+	 * vbios layout.
+	 */
+	if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+	    !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+		return true;
+
 	return false;
 }
 

From 6130c38c3e735215694b579927e6406bc00ad784 Mon Sep 17 00:00:00 2001
From: Maciej Kucharek <qchcio@gmail.com>
Date: Thu, 15 Oct 2026 11:57:12 +0200
Subject: [PATCH 1676/1982] drm/amdgpu: reset CIK ASIC on Apple boards with
 VRAM at 0

[ Upstream commit 095f634ea0aa5b9da19495520b5fc1a155b2c137 ]

On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled.  A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default.  The SI fix resets and
posts the ASIC at load, so the driver uses the VBIOS layout from the
start:

  "drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0"

No MacBookPro has a CIK GPU, and no affected CIK board is known.  Add
the same test to cik_need_reset_on_init(), so that SI, CIK and VI
handle this firmware layout in the same way.  gmc_v7_0 reads
MC_VM_FB_LOCATION once at init and does not reprogram it.  A CIK board
with VRAM at 0 therefore has the same problem as the SI boards.

After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.

Only compile-tested.

Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6bb4b79d6a6c461b40750fd67cb4e2a070e20b67)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/cik.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 9cd63b4177bf29..4bc35b5f7c47c2 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1932,6 +1932,16 @@ static bool cik_need_reset_on_init(struct amdgpu_device *adev)
 {
 	u32 clock_cntl, pc;
 
+	/*
+	 * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+	 * is enabled.  Any later post (S3 resume, GPU reset) moves it back to
+	 * the vbios default, so reset and post on load to start with the
+	 * vbios layout.
+	 */
+	if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+	    !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+		return true;
+
 	if (adev->flags & AMD_IS_APU)
 		return false;
 

From 7c43b9c2e9f803f078e22b25fb4f0250988fa17d Mon Sep 17 00:00:00 2001
From: Maciej Kucharek <qchcio@gmail.com>
Date: Thu, 15 Oct 2026 11:57:13 +0200
Subject: [PATCH 1677/1982] drm/amdgpu: reset VI ASIC on Apple boards with VRAM
 at 0

[ Upstream commit 92a5184787b81e67f7b831ad860ca9b053505cf8 ]

On MacBookPros with switchable graphics, the firmware puts VRAM at MC
address 0 when the iGPU is enabled.  A later post (S3 resume, GPU
reset) moves VRAM back to the VBIOS default.  gmc_v8_0 reads
MC_VM_FB_LOCATION once at init and reprograms it only on SR-IOV.  On
bare metal, the driver then keeps using the old layout.

vi_reset_quirks[] handles this for the MacBookPro14,3 by PCI ID:

  commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3")

Add the test that SI and CIK use: an Apple subsystem vendor and VRAM at
0.  Other Polaris MacBookPros then get the same reset at load, for
example the MacBookPro13,3 if its firmware leaves VRAM at 0.  These
boards are not tested.

Keep vi_reset_quirks[].  Its MacBookPro15,1 entries fix a different
failure, a module reload after S3:

  commit a5be7ad8f5f0 ("drm/amdgpu: reset VI ASIC on MacBookPro15,1")

VRAM is not at 0 at that point, so the new test may not cover it.

After the reset, FB_BASE is not 0, so the new test does not fire again
on a module reload.

Only compile-tested.

Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Maciej Kucharek <qchcio@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c2335b685b1e1e387f2fea1c67f56b5b8a8b6dc6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/vi.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index ce54e29381079f..bb81251319084f 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1425,6 +1425,16 @@ static bool vi_need_reset_on_init(struct amdgpu_device *adev)
 	unsigned int i;
 	u32 clock_cntl, pc;
 
+	/*
+	 * MacBookPros with switchable graphics put VRAM at 0 when the iGPU
+	 * is enabled.  Any later post (S3 resume, GPU reset) moves it back to
+	 * the vbios default, so reset and post on load to start with the
+	 * vbios layout.
+	 */
+	if (adev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+	    !(RREG32(mmMC_VM_FB_LOCATION) & MC_VM_FB_LOCATION__FB_BASE_MASK))
+		return true;
+
 	for (i = 0; i < ARRAY_SIZE(vi_reset_quirks); i++)
 		if (adev->pdev->device == vi_reset_quirks[i].device &&
 		    adev->pdev->subsystem_vendor == vi_reset_quirks[i].subsystem_vendor &&

From 2081dc291247066cf174f9ad4b20eaffc5663dc0 Mon Sep 17 00:00:00 2001
From: Henry Martin <bsdhenrymartin@gmail.com>
Date: Sat, 10 Oct 2026 11:02:30 +0800
Subject: [PATCH 1678/1982] drm/amdkfd: fix doorbell allocation race creating
 duplicate allocations

[ Upstream commit bebad45050945a3d668d6701fb77ae2571c5d44b ]

The check-and-allocate sequence on pdd->qpd.proc_doorbells is
lockless at every call site of kfd_alloc_process_doorbells():
kfd_get_process_doorbells() (mmap of /dev/kfd),
kfd_ioctl_create_queue() and the CRIU restore path each test the
pointer under different locking (or none), so two racing threads can
both observe NULL and each allocate a doorbell BO and bitmap,
orphaning one allocation and handing the two mappings different
backing pages.

Move the serialization into kfd_alloc_process_doorbells() itself,
using a new per-process-device mutex so all three call sites are
covered regardless of their own locking.  The device-global
kfd->doorbell_mutex is not suitable here: it is acquired under
dqm->lock on the kernel-doorbell path (start_cpsch() -> pm_init() ->
kq_initialize() -> kfd_get_kernel_doorbell()), so holding it across
the sleeping allocations above would create a lock-ordering
inversion with dqm->lock via TTM eviction, and it would also
serialize doorbell setup of unrelated processes behind a
device-wide lock for per-process state.

This issue was discovered by Tencent CodeBuddy Security.

v3 (Felix Kuehling):
- Removed unlocked check in kfd_get_process_doorbell flagged as
  problematic by Sashiko Bot. Fall back to the locked check inside
  kfd_alloc_process_doorbells
- Added missing mutex_destroy
v4 (Felix Kuehling):
- Removed unlocked checks around other kfd_alloc_process_doorbells calls

Fixes: 16f0013157bf ("drm/amdkfd: Allocate doorbells only when needed")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4e27ba5ad5f76932d4f6cbacd25c81c2dd40ec4a)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c  | 18 +++++++-----------
 drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c | 23 +++++++++++++++++------
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h     |  3 +++
 drivers/gpu/drm/amd/amdkfd/kfd_process.c  |  2 ++
 4 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 04c2d412fa7daa..c224d78a770a1a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -352,12 +352,10 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
 		}
 	}
 
-	if (!pdd->qpd.proc_doorbells) {
-		err = kfd_alloc_process_doorbells(dev->kfd, pdd);
-		if (err) {
-			pr_debug("failed to allocate process doorbells\n");
-			goto err_bind_process;
-		}
+	err = kfd_alloc_process_doorbells(dev->kfd, pdd);
+	if (err) {
+		pr_debug("failed to allocate process doorbells\n");
+		goto err_bind_process;
 	}
 
 	err = kfd_queue_acquire_buffers(pdd, &q_properties);
@@ -2282,11 +2280,9 @@ static int criu_restore_devices(struct kfd_process *p,
 			goto exit;
 		}
 
-		if (!pdd->qpd.proc_doorbells) {
-			ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
-			if (ret)
-				goto exit;
-		}
+		ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
+		if (ret)
+			goto exit;
 	}
 
 	/*
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index fdcf7f2d1b5b41..6af268a031f226 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -239,11 +239,9 @@ phys_addr_t kfd_get_process_doorbells(struct kfd_process_device *pdd)
 	struct amdgpu_device *adev = pdd->dev->adev;
 	uint32_t first_db_index;
 
-	if (!pdd->qpd.proc_doorbells) {
-		if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
-			/* phys_addr_t 0 is error */
-			return 0;
-	}
+	if (kfd_alloc_process_doorbells(pdd->dev->kfd, pdd))
+		/* phys_addr_t 0 is error */
+		return 0;
 
 	first_db_index = amdgpu_doorbell_index_on_bar(adev,
 						      pdd->qpd.proc_doorbells,
@@ -257,12 +255,21 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
 	int r;
 	struct qcm_process_device *qpd = &pdd->qpd;
 
+	mutex_lock(&pdd->doorbell_mutex);
+
+	/* Another thread may have won the check-and-allocate race */
+	if (qpd->proc_doorbells) {
+		mutex_unlock(&pdd->doorbell_mutex);
+		return 0;
+	}
+
 	/* Allocate bitmap for dynamic doorbell allocation */
 	qpd->doorbell_bitmap = bitmap_zalloc(KFD_MAX_NUM_OF_QUEUES_PER_PROCESS,
 					     GFP_KERNEL);
 	if (!qpd->doorbell_bitmap) {
 		DRM_ERROR("Failed to allocate process doorbell bitmap\n");
-		return -ENOMEM;
+		r = -ENOMEM;
+		goto unlock;
 	}
 
 	r = init_doorbell_bitmap(&pdd->qpd, kfd);
@@ -284,11 +291,15 @@ int kfd_alloc_process_doorbells(struct kfd_dev *kfd, struct kfd_process_device *
 		DRM_ERROR("Failed to allocate process doorbells\n");
 		goto err;
 	}
+
+	mutex_unlock(&pdd->doorbell_mutex);
 	return 0;
 
 err:
 	bitmap_free(qpd->doorbell_bitmap);
 	qpd->doorbell_bitmap = NULL;
+unlock:
+	mutex_unlock(&pdd->doorbell_mutex);
 	return r;
 }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index f2cda82cbed4c7..ef1afeaa8d85d4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -769,6 +769,9 @@ struct kfd_process_device {
 	/* per-process-per device QCM data structure */
 	struct qcm_process_device qpd;
 
+	/* Serializes process doorbell allocation for this device */
+	struct mutex doorbell_mutex;
+
 	/*Apertures*/
 	uint64_t lds_base;
 	uint64_t lds_limit;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 8ed513a77d38f0..0b760aab11c6f9 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1089,6 +1089,7 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)
 		}
 
 		atomic_dec(&pdd->dev->kfd->kfd_processes_count);
+		mutex_destroy(&pdd->doorbell_mutex);
 
 		kfree(pdd);
 		p->pdds[i] = NULL;
@@ -1628,6 +1629,7 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev,
 	pdd->dev = dev;
 	INIT_LIST_HEAD(&pdd->qpd.queues_list);
 	INIT_LIST_HEAD(&pdd->qpd.priv_queue_list);
+	mutex_init(&pdd->doorbell_mutex);
 	pdd->qpd.dqm = dev->dqm;
 	pdd->qpd.pqm = &p->pqm;
 	pdd->qpd.evicted = 0;

From 87a531b56f2b8992e6082c2e57ec034548bd11d4 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Sat, 26 Sep 2026 17:32:21 -0500
Subject: [PATCH 1679/1982] drm/amd/display: don't WARN when removing an
 unallocated MST payload

[ Upstream commit b18a7c6d75bcc883b39497863cc88c9ef4c6c85f ]

[Why]
On an MST teardown that runs through the reset path
(dcn31_reset_hw_ctx_wrap -> link_set_dpms_off -> deallocate_mst_payload),
fill_dc_mst_payload_table_from_drm() is asked to remove a payload whose
vcpi is not present in link->mst_stream_alloc_table and trips:

  WARNING: .../amdgpu_dm_helpers.c:275 fill_dc_mst_payload_table_from_drm

This is a legitimate case, not an error: deallocate_mst_payload() can be
called for a stream whose MST payload was never programmed into DC's
HW-maintained table (a new stream created for a modeset whose enable
never completed, as already documented in deallocate_mst_payload()).
There is simply nothing to remove.

[How]
Drop the ASSERT and fall through to the fill loop, which rebuilds the
allocation table from the remaining entries. The table ends up unchanged,
which is correct: the payload being removed was never in it.

Note the loop must not early-return here - the caller passes a zeroed
proposed_table, so returning early would zero the whole link's table and
drop the other MST streams sharing the link.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5875
Reviewed-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 88a27f624dc0ebc14a7ab274a84d977ce8513cb6)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index 7633af24291982..e8f4e7b7af5702 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -225,7 +225,7 @@ fill_dc_mst_payload_table_from_drm(struct dc_link *link,
 				break;
 			}
 		}
-		ASSERT(i != copy_of_link_table.stream_count);
+		/* Payload absent from HW table when never allocated: nothing to remove. */
 	}
 
 	/* Fill payload info*/

From b900cb2316ff78943f6b19360d931e312b751011 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Tue, 13 Oct 2026 21:37:07 +0800
Subject: [PATCH 1680/1982] drm/amdgpu: reject ANONONLY userptrs that span
 multiple VMAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d577b68a854d0f590f480777249b041507d0708c ]

For AMDGPU_GEM_USERPTR_ANONONLY, amdgpu_ttm_tt_get_user_pages() only
checks the VMA at the start of the range for a backing file, and
amdgpu_hmm_range_get_pages() then faults in the whole range, across any
other VMAs. The check used to reject ranges ending beyond the first VMA
(vma->vm_end < end), which got lost when the code moved to HMM.

An ANONONLY userptr over one page of file-backed memory is rejected
with -EPERM, but one over an anonymous page followed by the same
file-backed page is accepted.

Restore the check and reject ANONONLY userptrs that cross more than one
VMA. The second userptr is now rejected too.

v2: reject ranges spanning multiple VMAs instead of walking every VMA
    (Christian)
v3: cast num_pages to u64 to avoid an overflow (Christian)

Fixes: 6826cb3b92a3 ("drm/amdgpu: support userptr cross VMAs case with HMM")
Cc: Christian König <christian.koenig@amd.com>
Cc: Philip Yang <Philip.Yang@amd.com>
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 75d753ed4704d5efc72164d9e546b2a282e42ae2)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 08c31d78b3faee..918f38965cf21b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -766,7 +766,8 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo,
 		goto out_unlock;
 	}
 	if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) &&
-		vma->vm_file)) {
+		     (vma->vm_file ||
+		      vma->vm_end < start + (u64)ttm->num_pages * PAGE_SIZE))) {
 		r = -EPERM;
 		goto out_unlock;
 	}

From 01d08b4de4b1fbac7f980643ed9b4d7460ff1412 Mon Sep 17 00:00:00 2001
From: Kevin Wang <kevin.wang@amd.com>
Date: Thu, 15 Oct 2026 15:38:26 +0800
Subject: [PATCH 1681/1982] drm/amd/pm: reapply umd profile state after
 recovery

[ Upstream commit ad6eb088a508d927641c8a76d1ca7911dfb7c80b ]

Resume and full GPU reset retain the selected UMD profile level in
driver state.
The GFX and PMFW state behind it is reinitialized.

Add a generic DPM reapply path after CG and PG restoration.
It restores the UMD GFX state and asks the PM backend to replay the
retained level.

v2:
- Reapply only GFX CG to preserve the profile-owned GFX PG reference.
- Fall back to AUTO when reapply fails without failing device recovery.
- Propagate PowerPlay DPM errors before accepting AUTO fallback.
- Limit workload-profile error reporting to the swSMU reapply path.

This covers:
- PCI runtime resume
- Full GPU reset recovery
- System resume, including S3 and s2idle

Signed-off-by: Kevin Wang <kevin.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fd0699fc9f4266fc07d6ce6dbb484fac04601106)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c    |  6 ++
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c       | 14 ---
 .../gpu/drm/amd/include/kgd_pp_interface.h    |  2 +
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c           | 85 ++++++++++++++++++
 drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h       |  1 +
 .../gpu/drm/amd/pm/powerplay/amd_powerplay.c  | 33 +++++--
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c     | 87 +++++++++++++++++--
 7 files changed, 201 insertions(+), 27 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 4a1b8795d117b3..2e0998de67ed16 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3589,6 +3589,12 @@ static int amdgpu_device_ip_late_init(struct amdgpu_device *adev)
 	amdgpu_device_set_cg_state(adev, AMD_CG_STATE_GATE);
 	amdgpu_device_set_pg_state(adev, AMD_PG_STATE_GATE);
 
+	r = amdgpu_dpm_reapply_umd_profile(adev);
+	if (r) {
+		dev_err(adev->dev, "Failed to restore UMD profile state: %d\n", r);
+		return r;
+	}
+
 	amdgpu_device_fill_reset_magic(adev);
 
 	r = amdgpu_device_enable_mgpu_fan_boost();
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 845ebe041563f5..fc2823771cc40c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -2904,19 +2904,6 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
 	return 0;
 }
 
-static void amdgpu_restore_umd_profile_pstate_after_runpm(struct amdgpu_device *adev)
-{
-	enum amd_dpm_forced_level level;
-	uint32_t profile_mode_mask = AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD |
-		AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK |
-		AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK |
-		AMD_DPM_FORCED_LEVEL_PROFILE_PEAK;
-
-	level = amdgpu_dpm_get_performance_level(adev);
-	if (level & profile_mode_mask)
-		amdgpu_asic_update_umd_stable_pstate(adev, true);
-}
-
 static int amdgpu_pmops_runtime_resume(struct device *dev)
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
@@ -2962,7 +2949,6 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
 	if (adev->pm.rpm_mode == AMDGPU_RUNPM_PX)
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_ON;
 
-	amdgpu_restore_umd_profile_pstate_after_runpm(adev);
 	adev->in_runpm = false;
 	return 0;
 }
diff --git a/drivers/gpu/drm/amd/include/kgd_pp_interface.h b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
index 2b0cdb2a2775df..834ce6d1a40ef0 100644
--- a/drivers/gpu/drm/amd/include/kgd_pp_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_pp_interface.h
@@ -426,6 +426,8 @@ struct amd_pm_funcs {
 	int (*print_clock_levels)(void *handle, enum pp_clock_type type, char *buf);
 	int (*emit_clock_levels)(void *handle, enum pp_clock_type type, char *buf, int *offset);
 	int (*force_performance_level)(void *handle, enum amd_dpm_forced_level level);
+	int (*reapply_performance_level)(void *handle,
+					 enum amd_dpm_forced_level level);
 	int (*get_sclk_od)(void *handle);
 	int (*set_sclk_od)(void *handle, uint32_t value);
 	int (*get_mclk_od)(void *handle);
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
index d1c4d7f4accc37..402354846c5695 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c
@@ -1085,6 +1085,91 @@ static void amdgpu_dpm_exit_umd_state(struct amdgpu_device *adev)
 					       AMD_PG_STATE_GATE);
 }
 
+/**
+ * amdgpu_dpm_reapply_umd_profile - Restore the active UMD profile
+ * @adev: amdgpu device
+ *
+ * Resume and reset retain the selected DPM level in software, but the
+ * underlying GFX and PMFW state is lost. Reapply a retained UMD profile
+ * after the common resume path has restored its default CG and PG state.
+ */
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev)
+{
+	const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
+	enum amd_dpm_forced_level level;
+	int ret, fallback_ret;
+
+	if (!pp_funcs || !pp_funcs->reapply_performance_level ||
+	    !pp_funcs->force_performance_level)
+		return 0;
+
+	/* Serialize the retained level with the GFX and PMFW reprogramming. */
+	mutex_lock(&adev->pm.mutex);
+	if (adev->pm.dpm.thermal_active) {
+		dev_warn(adev->dev,
+			 "Cannot restore UMD profile while thermal control is active\n");
+		ret = 0;
+		goto unlock;
+	}
+
+	if (pp_funcs->get_performance_level)
+		level = pp_funcs->get_performance_level(adev->powerplay.pp_handle);
+	else
+		level = adev->pm.dpm.forced_level;
+
+	switch (level) {
+	case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+		break;
+	default:
+		ret = 0;
+		goto unlock;
+	}
+
+	/* The active profile already owns the GFX PG reference. */
+	ret = amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+					      AMD_CG_STATE_UNGATE);
+	if (ret)
+		goto fallback_auto;
+
+	ret = amdgpu_asic_update_umd_stable_pstate(adev, true);
+	if (ret)
+		goto fallback_auto;
+
+	ret = pp_funcs->reapply_performance_level(adev->powerplay.pp_handle,
+						     level);
+	if (ret)
+		goto fallback_auto;
+
+unlock:
+	mutex_unlock(&adev->pm.mutex);
+
+	return ret;
+
+fallback_auto:
+	dev_warn(adev->dev, "Failed to restore UMD profile state: %d\n", ret);
+
+	/* Restore normal CG before releasing the profile's PG reference. */
+	amdgpu_asic_update_umd_stable_pstate(adev, false);
+	amdgpu_device_ip_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_GFX,
+					       AMD_CG_STATE_GATE);
+	mutex_unlock(&adev->pm.mutex);
+
+	mutex_lock(&adev->pm.stable_pstate_ctx_lock);
+	fallback_ret = amdgpu_dpm_force_performance_level(adev,
+						   AMD_DPM_FORCED_LEVEL_AUTO);
+	if (fallback_ret)
+		dev_warn(adev->dev, "Failed to fall back to AUTO performance level: %d\n",
+			 fallback_ret);
+	else
+		adev->pm.stable_pstate_ctx = NULL;
+	mutex_unlock(&adev->pm.stable_pstate_ctx_lock);
+
+	return 0;
+}
+
 int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
 				       enum amd_dpm_forced_level level)
 {
diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
index 13a834575ed771..db78f44da0508b 100644
--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
+++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h
@@ -482,6 +482,7 @@ void amdgpu_dpm_set_power_state(struct amdgpu_device *adev,
 enum amd_dpm_forced_level amdgpu_dpm_get_performance_level(struct amdgpu_device *adev);
 int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev,
 				       enum amd_dpm_forced_level level);
+int amdgpu_dpm_reapply_umd_profile(struct amdgpu_device *adev);
 int amdgpu_dpm_get_pp_num_states(struct amdgpu_device *adev,
 				 struct pp_states_info *states);
 int amdgpu_dpm_dispatch_task(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
index 05c5e7d19ca1ce..4edca695e73ad6 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c
@@ -367,24 +367,46 @@ static void pp_dpm_en_umd_pstate(struct pp_hwmgr  *hwmgr,
 	}
 }
 
-static int pp_dpm_force_performance_level(void *handle,
-					enum amd_dpm_forced_level level)
+static int pp_dpm_apply_performance_level(struct pp_hwmgr *hwmgr,
+					  enum amd_dpm_forced_level level,
+					  bool reapply)
 {
-	struct pp_hwmgr *hwmgr = handle;
+	int ret;
 
 	if (!hwmgr || !hwmgr->pm_en)
 		return -EINVAL;
 
-	if (level == hwmgr->dpm_level)
+	if (!reapply && level == hwmgr->dpm_level)
 		return 0;
 
 	pp_dpm_en_umd_pstate(hwmgr, &level);
 	hwmgr->request_dpm_level = level;
-	hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+	ret = hwmgr_handle_task(hwmgr, AMD_PP_TASK_READJUST_POWER_STATE, NULL);
+	if (ret)
+		return ret;
+
+	ret = phm_force_dpm_levels(hwmgr, level);
+	if (ret)
+		return ret;
+
+	hwmgr->dpm_level = level;
 
 	return 0;
 }
 
+static int pp_dpm_force_performance_level(void *handle,
+					enum amd_dpm_forced_level level)
+{
+	return pp_dpm_apply_performance_level(handle, level, false);
+}
+
+static int
+pp_dpm_reapply_performance_level(void *handle,
+					 enum amd_dpm_forced_level level)
+{
+	return pp_dpm_apply_performance_level(handle, level, true);
+}
+
 static enum amd_dpm_forced_level pp_dpm_get_performance_level(
 								void *handle)
 {
@@ -1569,6 +1591,7 @@ static const struct amd_pm_funcs pp_dpm_funcs = {
 	.load_firmware = pp_dpm_load_fw,
 	.wait_for_fw_loading_complete = pp_dpm_fw_loading_complete,
 	.force_performance_level = pp_dpm_force_performance_level,
+	.reapply_performance_level = pp_dpm_reapply_performance_level,
 	.get_performance_level = pp_dpm_get_performance_level,
 	.get_current_power_state = pp_dpm_get_current_power_state,
 	.dispatch_tasks = pp_dpm_dispatch_tasks,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index e0e208a0d9f94c..0df4b36ec3a8f3 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -2314,6 +2314,13 @@ static int smu_set_powergating_state(struct amdgpu_ip_block *ip_block,
 	return 0;
 }
 
+static void smu_enter_umd_pstate(struct smu_context *smu)
+{
+	smu_gpo_control(smu, false);
+	smu_gfx_ulv_control(smu, false);
+	smu_deep_sleep_control(smu, false);
+}
+
 static int smu_enable_umd_pstate(void *handle,
 		      enum amd_dpm_forced_level *level)
 {
@@ -2332,9 +2339,7 @@ static int smu_enable_umd_pstate(void *handle,
 		/* enter umd pstate, save current level, disable gfx cg*/
 		if (*level & profile_mode_mask) {
 			smu_dpm_ctx->saved_dpm_level = smu_dpm_ctx->dpm_level;
-			smu_gpo_control(smu, false);
-			smu_gfx_ulv_control(smu, false);
-			smu_deep_sleep_control(smu, false);
+			smu_enter_umd_pstate(smu);
 			amdgpu_asic_update_umd_stable_pstate(smu->adev, true);
 		}
 	} else {
@@ -2393,7 +2398,8 @@ static void smu_power_profile_mode_put(struct smu_context *smu,
 
 static int smu_adjust_power_state_dynamic(struct smu_context *smu,
 					  enum amd_dpm_forced_level level,
-					  bool skip_display_settings)
+					  bool skip_display_settings,
+					  bool force_performance_level)
 {
 	int ret = 0;
 	struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
@@ -2420,7 +2426,7 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
 		}
 	}
 
-	if (smu_dpm_ctx->dpm_level != level) {
+	if (force_performance_level || smu_dpm_ctx->dpm_level != level) {
 		ret = smu_asic_set_performance_level(smu, level);
 		if (ret) {
 			if (ret == -EOPNOTSUPP)
@@ -2443,6 +2449,39 @@ static int smu_adjust_power_state_dynamic(struct smu_context *smu,
 	return ret;
 }
 
+static int
+smu_reapply_power_state_dynamic(struct smu_context *smu,
+				enum amd_dpm_forced_level level)
+{
+	struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+	int ret;
+
+	ret = smu_apply_clocks_adjust_rules(smu);
+	if (ret) {
+		dev_err(smu->adev->dev, "Failed to apply clocks adjust rules!");
+		return ret;
+	}
+
+	ret = smu_asic_set_performance_level(smu, level);
+	if (ret) {
+		if (ret == -EOPNOTSUPP)
+			dev_info(smu->adev->dev, "set performance level %d not supported",
+				 level);
+		else
+			dev_err(smu->adev->dev, "Failed to set performance level %d",
+				level);
+		return ret;
+	}
+
+	smu_dpm_ctx->dpm_level = level;
+
+	if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL ||
+	    smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM)
+		return 0;
+
+	return smu_bump_power_profile_mode(smu, NULL, 0);
+}
+
 static int smu_handle_task(struct smu_context *smu,
 			   enum amd_dpm_forced_level level,
 			   enum amd_pp_task task_id)
@@ -2457,13 +2496,13 @@ static int smu_handle_task(struct smu_context *smu,
 		ret = smu_pre_display_config_changed(smu);
 		if (ret)
 			return ret;
-		ret = smu_adjust_power_state_dynamic(smu, level, false);
+		ret = smu_adjust_power_state_dynamic(smu, level, false, false);
 		break;
 	case AMD_PP_TASK_COMPLETE_INIT:
-		ret = smu_adjust_power_state_dynamic(smu, level, true);
+		ret = smu_adjust_power_state_dynamic(smu, level, true, false);
 		break;
 	case AMD_PP_TASK_READJUST_POWER_STATE:
-		ret = smu_adjust_power_state_dynamic(smu, level, true);
+		ret = smu_adjust_power_state_dynamic(smu, level, true, false);
 		break;
 	default:
 		break;
@@ -2592,6 +2631,37 @@ static int smu_force_performance_level(void *handle,
 	return ret;
 }
 
+static int
+smu_reapply_performance_level(void *handle,
+			      enum amd_dpm_forced_level level)
+{
+	struct smu_context *smu = handle;
+	struct smu_dpm_context *smu_dpm_ctx = &smu->smu_dpm;
+
+	if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
+		return -EOPNOTSUPP;
+
+	if (!smu->is_apu && !smu_dpm_ctx->dpm_context)
+		return -EINVAL;
+
+	switch (level) {
+	case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_SCLK:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK:
+	case AMD_DPM_FORCED_LEVEL_PROFILE_PEAK:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (smu_dpm_ctx->dpm_level != level)
+		return -EINVAL;
+
+	smu_enter_umd_pstate(smu);
+
+	return smu_reapply_power_state_dynamic(smu, level);
+}
+
 static int smu_set_display_count(void *handle, uint32_t count)
 {
 	struct smu_context *smu = handle;
@@ -3932,6 +4002,7 @@ static const struct amd_pm_funcs swsmu_pm_funcs = {
 	.print_clock_levels      = smu_print_ppclk_levels,
 	.emit_clock_levels       = smu_emit_ppclk_levels,
 	.force_performance_level = smu_force_performance_level,
+	.reapply_performance_level = smu_reapply_performance_level,
 	.read_sensor             = smu_read_sensor,
 	.get_apu_thermal_limit       = smu_get_apu_thermal_limit,
 	.set_apu_thermal_limit       = smu_set_apu_thermal_limit,

From 1436e441ad19a475ce3fdaacee7efe670405cae9 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Sun, 11 Oct 2026 20:15:34 +0800
Subject: [PATCH 1682/1982] drm/amdkfd: don't drop an SVM CWSR reference that
 was never taken

[ Upstream commit 030d47cc6720e0f07b502876cdbd266e309f9461 ]

When kfd_queue_acquire_buffers() fails, its error path calls
kfd_queue_release_buffers(), which also drops a queue_refcount on the
SVM range at ctx_save_restore_area_address. The SVM range is the last
buffer acquired, and kfd_queue_buffer_svm_get() takes no reference when
it fails, so on every error path this reference was never taken. If
another queue of the process uses that CWSR range, its reference is
dropped instead, and unmapping the range no longer evicts that queue
while its CWSR area is unmapped from the GPU.

On navi31, with queue A using an SVM CWSR range: munmap() of the range
logs

  Freeing queue vital buffer 0x..., queue evicted

but after a CREATE_QUEUE that reuses A's CWSR address with an unmapped
write pointer (-EINVAL), the same munmap() leaves A running without the
message.

Only put the BOs on the acquire error path. The warning and the eviction
are back after the failed CREATE_QUEUE.

Fixes: b049504e211e ("drm/amdkfd: Validate user queue svm memory residency")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9a08122e6361ef73f4b512d5db9596d561305519)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 6f06516da32a84..eaa284e5518296 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -231,6 +231,15 @@ void kfd_queue_buffer_put(struct amdgpu_bo **bo)
 	amdgpu_bo_unref(bo);
 }
 
+static void kfd_queue_put_bos(struct queue_properties *properties)
+{
+	kfd_queue_buffer_put(&properties->wptr_bo);
+	kfd_queue_buffer_put(&properties->rptr_bo);
+	kfd_queue_buffer_put(&properties->ring_bo);
+	kfd_queue_buffer_put(&properties->eop_buf_bo);
+	kfd_queue_buffer_put(&properties->cwsr_bo);
+}
+
 int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
 {
 	struct kfd_topology_device *topo_dev;
@@ -341,7 +350,13 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
 	 * dropping the VM reservation.
 	 */
 	kfd_queue_unref_bo_vas(pdd, properties);
-	kfd_queue_release_buffers(pdd, properties);
+	/*
+	 * The SVM CWSR range is the last thing acquired and a failed
+	 * kfd_queue_buffer_svm_get() takes nothing, so only the BOs are held
+	 * here. Dropping the SVM reference would drop the one of another queue
+	 * using the same CWSR address.
+	 */
+	kfd_queue_put_bos(properties);
 	return err;
 }
 
@@ -350,11 +365,7 @@ int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_prope
 	struct kfd_topology_device *topo_dev;
 	u64 total_cwsr_size;
 
-	kfd_queue_buffer_put(&properties->wptr_bo);
-	kfd_queue_buffer_put(&properties->rptr_bo);
-	kfd_queue_buffer_put(&properties->ring_bo);
-	kfd_queue_buffer_put(&properties->eop_buf_bo);
-	kfd_queue_buffer_put(&properties->cwsr_bo);
+	kfd_queue_put_bos(properties);
 
 	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
 	if (!topo_dev)

From b260effe83a6566fd1d4038fa5ca9bc8a43c7208 Mon Sep 17 00:00:00 2001
From: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
Date: Wed, 14 Oct 2026 14:29:35 -0400
Subject: [PATCH 1683/1982] drm/amdgpu/gmc9: add extra type-2 TLB flush for
 gfx942/gfx950

[ Upstream commit 232213c9bd7f703836164f23160b76657094a7db ]

Add extra type-2 TLB flush for GC 9.5.0, similar race condition was
observed as Vega20+XGMI. Add to GC 9.4.3 and 9.4.4 too, as they share
the same multi-XCD TLB topology.

Reported-by: Shahzeb Ahmed <shahzeb.ahmed@amd.com>
Reported-by: Manjunath Gaonkar <Manjunath.Gaonkar@amd.com>
Signed-off-by: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com>
Reviewed-by: Apurv Mishra <apurv.mishra@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 138cfb165ae6aa98c0767b431e718d1a8199db28)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 0f0d6cd52d9166..230a346db3b1b9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -2186,10 +2186,22 @@ static int gmc_v9_0_hw_init(struct amdgpu_ip_block *ip_block)
 	 * (type 2), which flushes both. Due to a race condition with
 	 * concurrent memory accesses using the same TLB cache line, we still
 	 * need a second TLB flush after this.
+	 *
+	 * GC 9.4.3, 9.4.4 and 9.5.0 hit a similar race.
 	 */
-	adev->gmc.flush_tlb_needs_extra_type_2 =
-		amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 0) &&
-		adev->gmc.xgmi.num_physical_nodes;
+	switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
+	case IP_VERSION(9, 4, 0):
+		adev->gmc.flush_tlb_needs_extra_type_2 =
+			adev->gmc.xgmi.num_physical_nodes;
+		break;
+	case IP_VERSION(9, 4, 3):
+	case IP_VERSION(9, 4, 4):
+	case IP_VERSION(9, 5, 0):
+		adev->gmc.flush_tlb_needs_extra_type_2 = true;
+		break;
+	default:
+		break;
+	}
 
 	/* The sequence of these two function calls matters.*/
 	gmc_v9_0_init_golden_registers(adev);

From 38bb73854a4a0d38162c1776fa1a469de897bc96 Mon Sep 17 00:00:00 2001
From: Keita Morisaki <kmta1236@gmail.com>
Date: Wed, 23 Sep 2026 11:24:51 +0900
Subject: [PATCH 1684/1982] drm/amd/display: Fix swap in median3() for DSC rate
 control

[ Upstream commit 7b23bf82ccbdb4cf0752f2b8686e7319a7ce497f ]

median3() is meant to return the median of three values, but its last
compare-and-swap step swaps b and c instead of a and b. When c is
smaller than both a and b, it returns max(a, b) instead of min(a, b).
For example, median3(2, 3, 1) returns 3 instead of 2.

_do_calc_rc_params() always passes 0 as the first argument, and the
second argument is never below 12. So whenever the third argument is
negative, first_line_bpg_offset (and second_line_bpg_offset for 4:2:0)
is set to the second argument instead of 0.

Fix this by swapping a and b in the last step, as intended.

Note that this change does not affect valid DSC configurations. The
third argument is negative only when bits per pixel exceeds the
uncompressed rate of the colour format:

 - 3 * bpc for 4:4:4, 3 * bpc + 2 for RGB

 - 2 * bpc for 4:2:2

 - 1.5 * bpc for 4:2:0

Fixes: 97bda0322b8a ("drm/amd/display: Add DSC support for Navi (v2)")
Signed-off-by: Keita Morisaki <kmta1236@gmail.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1ddc4bc97a62fc89d9d3681413d9f977e1fa1a83)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
index ef75eb7d5adc3e..940de620e33086 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dsc/rc_calc_fpu.c
@@ -46,7 +46,7 @@ static int median3(int a, int b, int c)
 	if (b > c)
 		swap(b, c);
 	if (a > b)
-		swap(b, c);
+		swap(a, b);
 
 	return b;
 }

From 2cbdce3fdf929ec5c13007611a37672720bcfb8e Mon Sep 17 00:00:00 2001
From: William Palacek <William.Palacek@amd.com>
Date: Fri, 16 Oct 2026 10:44:50 -0400
Subject: [PATCH 1685/1982] drm/amdkfd: wait for a GPU reset before freeing a
 BO

[ Upstream commit 47d799a718439764432d8ef3a0952af45f025f76 ]

When a GPU reset takes the reset domain, KFD eviction cannot unmap
user queues: execute_queues_cpsch() fails its trylock with -EIO, so
the queues keep running until the ASIC is reset. The TLB flush is also
skipped while the reset is in progress. If the process unmaps and frees
a BO in that window, its pages are released while a queue can still
access them through stale translations.

On MI300X, munmap() then crashes in free_swap_cache() on a small bogus
page pointer in its mmu_gather batch page:

  BUG: unable to handle page fault for address: 0000000000002900
  RIP: 0010:free_swap_cache+0x5/0xb0
  Call Trace:
   free_pages_and_swap_cache+0x3a/0x60
   tlb_batch_pages_flush+0x43/0x80
   tlb_flush_mmu+0x3d/0x110
   zap_pte_range+0x80d/0xcd0
   ...
   do_vmi_align_munmap+0x3e8/0x5b0
   do_vmi_munmap+0xdf/0x190
   __vm_munmap+0xad/0x180
   __x64_sys_munmap+0x1b/0x30

In a traced crash the bogus pointer was the read pointer value of an SDMA
queue the process had just destroyed, at the read pointer's page offset:
the queue's writeback landed in its freed rptr page after the page was
reused as the batch page.

commit f0b4440cdc18 ("drm/amdkfd: Fix mode1 reset crash issue") fixed
this race on process exit by waiting for the reset to complete before
freeing the process's BOs. Free through the ioctl has the same race.
Wait for the reset there too, using the same helper.

Fixes: 9c33e5fd4fb6 ("drm/amdgpu: fix locking scope when flushing tlb")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: William Palacek <William.Palacek@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 06ff8ce77726b15a98fcc285dd6005cb3f48558b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +++
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h    | 1 +
 drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index c224d78a770a1a..1ec77554da5034 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1222,6 +1222,9 @@ static int kfd_ioctl_free_memory_of_gpu(struct file *filep,
 		goto err_unlock;
 	}
 
+	/* Queues a reset could not stop may still access the buffer */
+	kfd_process_wait_gpu_reset_complete(p);
+
 	ret = amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev,
 				(struct kgd_mem *)mem, pdd->drm_priv, &size);
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index ef1afeaa8d85d4..1f5f528188980a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1084,6 +1084,7 @@ void kfd_unref_process(struct kfd_process *p);
 int kfd_process_evict_queues(struct kfd_process *p, uint32_t trigger);
 int kfd_process_restore_queues(struct kfd_process *p);
 void kfd_suspend_all_processes(void);
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p);
 int kfd_resume_all_processes(void);
 
 struct kfd_process_device *kfd_process_device_data_by_id(struct kfd_process *process,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 0b760aab11c6f9..1c591953cc80d6 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -1144,7 +1144,7 @@ static void kfd_process_remove_sysfs(struct kfd_process *p)
 /*
  * If any GPU is ongoing reset, wait for reset complete.
  */
-static void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
+void kfd_process_wait_gpu_reset_complete(struct kfd_process *p)
 {
 	int i;
 

From 2368f9aed09cbabb5a8980c2fbc78bde98e170e9 Mon Sep 17 00:00:00 2001
From: John Fisher <jfisher84@gmail.com>
Date: Fri, 9 Oct 2026 09:45:17 +1300
Subject: [PATCH 1686/1982] drm/amdgpu: wait for pending page table updates
 before switching a VM to CPU updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 53d9ef2f518add783bb48a69d77bbc8aea99e911 ]

amdgpu_vm_make_compute() switches a VM from SDMA to CPU page table
updates when a KFD process acquires it. It syncs "with the last SDMA
update/clear" through amdgpu_bo_sync_wait() on the root PD, but that
walks the reservation with DMA_RESV_USAGE_READ, and the clears of the
VM's page tables (the root PD from amdgpu_vm_init(), and the PDs/PTs
the seq64 mapping allocates at the render node's open) are added there
by amdgpu_vm_sdma_commit() with DMA_RESV_USAGE_BOOKKEEP only:
amdgpu_vm_pt_clear() commits them with a NULL fence, so they do not
reach vm->last_update. The CPU path's own waits (amdgpu_vm_cpu_update(),
amdgpu_bo_kmap()) use DMA_RESV_USAGE_KERNEL. None of them waits for a
clear that is still queued.

When one is, the CPU writes the first entries of the new compute VM (the
KFD trap handler's TBA/TMA page at AMDGPU_VA_RESERVED_TRAP_START, mapped
during ACQUIRE_VM) into a page directory the SDMA then clears. The
entries are gone, the handler's page is unmapped, and the first wave
save of any queue of the process faults in the SQC instruction fetch at
the handler's address (GCVM_L2_PROTECTION_FAULT_STATUS 0x008012B1,
PERMISSION_FAULTS 0xb). The MES then fails REMOVE_QUEUE and SUSPEND, and
the device takes a MODE1 reset with VRAM lost on 7.2.9; on 7.3-rc6 the
queue is reset instead.

The window is the time between the render node's open and ACQUIRE_VM.
ROCr spends milliseconds there and is practically never hit; a minimal
KFD client that opens the render node and acquires the VM at once is hit
most of the time. On a Radeon AI PRO R9700 (gfx1201, Resizable BAR, so
vm_update_mode defaults to CPU updates for compute VMs), a wave reading
the trap handler's page right after queue creation found it unmapped in
8 of 12 runs; a 5 ms sleep between the open and ACQUIRE_VM made that 0
of 9, and the same sleep after queue creation instead 3 of 3.

The wait covered these jobs until commit 926c79ad6ecd ("drm/amdgpu:
promote the implicit sync to the dependent read fences") narrowed
amdgpu_sync_resv() from DMA_RESV_USAGE_BOOKKEEP to DMA_RESV_USAGE_READ;
the VM's page table jobs have been added with BOOKKEEP since commit
4247084057cf ("drm/amdgpu: use DMA_RESV_USAGE_BOOKKEEP v2"), so from
v6.16 on the sync in amdgpu_vm_make_compute() waits for nothing of
them.

Record the clears in vm->last_update, as amdgpu_vm_update_pdes() does
with its updates, and wait for it, uninterruptibly, before switching the
update functions. The clears all go through vm->delayed, so the last one
covers the earlier ones; immediate clears are not recorded, as before.

With this, on 7.3-rc6 and on 7.2.9, the same client reads the handler
10 of 10 times, 8 busy queues on the 4 compute slots complete in 5 of 5
runs on 7.3-rc6 and 3 of 3 on 7.2.9 (1 of 6 before), 16 and 32 queues
complete on 7.3-rc6, and two processes with 8 queues each complete
together on both, with no fault.

Fixes: 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences")
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John Fisher <jfisher84@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9ec91b35baba45209c3fcd00f086224a158dd512)
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c    | 5 +----
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +-
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index f78ac6777ee5c4..c9614a99b40d10 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2720,10 +2720,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
 
 	if (vm->use_cpu_for_update) {
 		/* Sync with last SDMA update/clear before switching to CPU */
-		r = amdgpu_bo_sync_wait(vm->root.bo,
-					AMDGPU_FENCE_OWNER_UNDEFINED, true);
-		if (r)
-			goto unreserve_bo;
+		dma_fence_wait(vm->last_update, false);
 
 		vm->update_funcs = &amdgpu_vm_cpu_funcs;
 		r = amdgpu_vm_pt_map_tables(adev, vm);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
index f794fb1cc06e66..a05f34259d5784 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -421,7 +421,7 @@ int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,
 	if (r)
 		goto exit;
 
-	r = vm->update_funcs->commit(&params, NULL);
+	r = vm->update_funcs->commit(&params, &vm->last_update);
 exit:
 	drm_dev_exit(idx);
 	return r;

From c2a3bef88fe10cdb286ad8414b44c7a2935017ff Mon Sep 17 00:00:00 2001
From: Daniel Phillips <daniel.phillips@amd.com>
Date: Sun, 5 Mar 2023 22:54:35 -0800
Subject: [PATCH 1687/1982] amdkfd: Fix memory availability double accounting
 of kfd pinned objects

[ Upstream commit 16df12d7158fb55f20d6e985abd1996cbabab9f8 ]

Pinned objects that are not kfd objects reduce the total vram available
to kfd, so we subtract the total size of pinned objects from kdf vram
availability. However this double counts objects pinned by kfd itself,
because they are counted both as used and pinned. So track the total
size of objects pinned by kfd and add it back to kfd availability to
remove the double accounting.

Signed-off-by: Daniel Phillips <daniel.phillips@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b8257bdb26ca5d9a75f4b81f629422f17afa221b)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h       |  1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index c59b5d9cd36b64..b15798489af0cc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -104,6 +104,7 @@ struct amdgpu_kfd_dev {
 	struct kfd_dev *dev;
 	int64_t vram_used[MAX_XCP];
 	uint64_t vram_used_aligned[MAX_XCP];
+	atomic64_t vram_pinned;
 	bool init_complete;
 	struct work_struct reset_work;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index d56728b257f49a..bf4cea36d3ad49 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1518,6 +1518,11 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
 		pr_err("Error in Pinning BO to domain: %d\n", domain);
 
 	amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
+
+	if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
+		atomic64_add(amdgpu_bo_size(bo),
+			&amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
 out:
 	amdgpu_bo_unreserve(bo);
 	return ret;
@@ -1540,6 +1545,11 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
 		return;
 
 	amdgpu_bo_unpin(bo);
+
+	if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
+		atomic64_sub(amdgpu_bo_size(bo),
+			&amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
+
 	amdgpu_bo_unreserve(bo);
 }
 
@@ -1661,6 +1671,7 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
 		vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
 			- adev->kfd.vram_used_aligned[xcp_id]
 			- atomic64_read(&adev->vram_pin_size)
+			+ atomic64_read(&adev->kfd.vram_pinned)
 			- reserved_for_pt
 			- reserved_for_ras;
 

From 58d07ddaa5f33052a29cb26ca226da281e5f3475 Mon Sep 17 00:00:00 2001
From: Zhen Han <Zhen.Han@amd.com>
Date: Sun, 20 Sep 2026 02:31:31 +0000
Subject: [PATCH 1688/1982] drm/amdkfd: correct vram_available calculation

[ Upstream commit 9131cc85d0dedd8ba4cae60dbe5985d081551f30 ]

reserve_mem_limit() computes available VRAM as
	vram_size - reserved - vram_pin_size - kfd.vram_used
However, kfd.vram_used already includes BOs that are later pinned.
Pinning does not consume extra VRAM. Subtracting
vram_pin_size counts those bytes twice and causes fake-OOM
while VRAM is still free.

Reuse get_available_memory() in reserve_mem_limit(). Move
ALIGN_DOWN to the ioctl so the userspace ABI is unchanged. The
VRAM counter is a parameter: the ioctl passes vram_used_aligned[],
the gate passes vram_used[] so a 4K BO is not charged 2MB.

kfd.vram_pinned is only updated in gpuvm_pin_bo(). dma-buf pin
calls amdgpu_bo_pin() only, so the counter stays zero. Update it
from amdgpu_bo_pin() through a KFD helper, on first pin and last
unpin, matching vram_pin_size.

Track per-XCP pins in vram_pin_size_xcp[] and kfd.vram_pinned[].
Pins that are not owned by a single partition go to
vram_pin_size_common, which every partition subtracts.

A KFD VRAM BO always carries a partition, so the KFD credit is only
correct for xcp >= 0. Call the helper for both branches and let it
warn once and skip if that ever stops holding: without the credit the
BO would be subtracted through vram_pin_size_common and never added
back, which is the double counting this patch removes, and
kfd.vram_pinned[] would be indexed out of bounds.

Suggested-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Zhen Han <Zhen.Han@amd.com>
Reviewed-by: Mukul Joshi <mukul.joshi@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 894cbb31c50e3cf49657130396bbf6c0475304e4)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu.h           | 11 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h    | 20 +++-
 .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c  | 94 +++++++++++--------
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c    | 33 +++++++
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c      | 12 ++-
 5 files changed, 127 insertions(+), 43 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 803b6fc360a07b..034f2d03e367e1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1195,8 +1195,17 @@ struct amdgpu_device {
 	struct mutex	mn_lock;
 	DECLARE_HASHTABLE(mn_hash, 7);
 
-	/* tracking pinned memory */
+	/* tracking pinned memory
+	 *
+	 *	vram_pin_size = sum(vram_pin_size_xcp[]) + vram_pin_size_common
+	 *
+	 * vram_pin_size         total pin size in device
+	 * vram_pin_size_xcp[i]  pins owned by partition i (bo->xcp_id = i, i >= 0)
+	 * vram_pin_size_common  pins not owned by any partition, bo->xcp_id = -1
+	 */
 	atomic64_t vram_pin_size;
+	atomic64_t vram_pin_size_xcp[MAX_XCP];
+	atomic64_t vram_pin_size_common;
 	atomic64_t visible_pin_size;
 	atomic64_t gart_pin_size;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
index b15798489af0cc..21dbc8675f4e7d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h
@@ -40,6 +40,12 @@
 
 extern uint64_t amdgpu_amdkfd_total_mem_size;
 
+/*
+ * Align VRAM availability to 2MB to avoid fragmentation caused by 4K
+ * allocations in the tail 2MB BO chunk.
+ */
+#define VRAM_AVAILABLITY_ALIGN (1 << 21)
+
 enum TLB_FLUSH_TYPE {
 	TLB_FLUSH_LEGACY = 0,
 	TLB_FLUSH_LIGHTWEIGHT,
@@ -104,7 +110,7 @@ struct amdgpu_kfd_dev {
 	struct kfd_dev *dev;
 	int64_t vram_used[MAX_XCP];
 	uint64_t vram_used_aligned[MAX_XCP];
-	atomic64_t vram_pinned;
+	atomic64_t vram_pinned[MAX_XCP];
 	bool init_complete;
 	struct work_struct reset_work;
 
@@ -375,6 +381,8 @@ void amdgpu_amdkfd_gpuvm_destroy_cb(struct amdgpu_device *adev,
  * Allows KFD to release its resources associated with the GEM object.
  */
 void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo);
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id);
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id);
 void amdgpu_amdkfd_reserve_system_mem(uint64_t size);
 #else
 static inline
@@ -392,6 +400,16 @@ static inline
 void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
 {
 }
+
+static inline
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
+
+static inline
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+}
 #endif
 
 #if IS_ENABLED(CONFIG_HSA_AMD_SVM)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index bf4cea36d3ad49..35dffb14a20aaf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -46,12 +46,6 @@
 #define AMDGPU_USERPTR_RESTORE_DELAY_MS 1
 #define AMDGPU_RESERVE_MEM_LIMIT			(3UL << 29)
 
-/*
- * Align VRAM availability to 2MB to avoid fragmentation caused by 4K allocations in the tail 2MB
- * BO chunk
- */
-#define VRAM_AVAILABLITY_ALIGN (1 << 21)
-
 /* Impose limit on how much memory KFD can use */
 static struct {
 	uint64_t max_system_mem_limit;
@@ -73,6 +67,8 @@ static const char * const domain_bit_to_string[] = {
 #define domain_string(domain) domain_bit_to_string[ffs(domain)-1]
 
 static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work);
+static size_t __get_available_memory(struct amdgpu_device *adev,
+				     uint8_t xcp_id, int64_t vram_used);
 
 static bool kfd_mem_is_attached(struct amdgpu_vm *avm,
 		struct kgd_mem *mem)
@@ -169,13 +165,8 @@ void amdgpu_amdkfd_reserve_system_mem(uint64_t size)
 int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
 		uint64_t size, u32 alloc_flag, int8_t xcp_id)
 {
-	uint64_t reserved_for_pt =
-		ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
-	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
-	uint64_t reserved_for_ras = (con ? con->reserved_pages_in_bytes : 0);
 	size_t system_mem_needed, ttm_mem_needed, vram_needed;
 	int ret = 0;
-	uint64_t vram_size = 0;
 
 	system_mem_needed = 0;
 	ttm_mem_needed = 0;
@@ -196,7 +187,6 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
 		if (WARN_ONCE(xcp_id < 0, "invalid XCP ID %d", xcp_id))
 			return -EINVAL;
 
-		vram_size = KFD_XCP_MEMORY_SIZE(adev, xcp_id);
 		if (adev->apu_prefer_gtt) {
 			system_mem_needed = size;
 			ttm_mem_needed = size;
@@ -232,14 +222,11 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
 	 * VRAM check since ttm_mem_limit check already cover this allocation
 	 */
 
-	if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {
-		uint64_t vram_available =
-			vram_size - reserved_for_pt - reserved_for_ras -
-			atomic64_read(&adev->vram_pin_size);
-		if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {
-			ret = -ENOMEM;
-			goto release;
-		}
+	if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu) &&
+	    vram_needed > __get_available_memory(adev, xcp_id,
+						 adev->kfd.vram_used[xcp_id])) {
+		ret = -ENOMEM;
+		goto release;
 	}
 
 	/* Update memory accounting by decreasing available system
@@ -318,6 +305,30 @@ void amdgpu_amdkfd_release_notify(struct amdgpu_bo *bo)
 	kfree(bo->kfd_bo);
 }
 
+void amdgpu_amdkfd_account_vram_pin(struct amdgpu_bo *bo, int xcp_id)
+{
+	if (!bo->kfd_bo)
+		return;
+
+	if (WARN_ONCE(xcp_id < 0, "KFD BO pinned in VRAM with no partition"))
+		return;
+
+	atomic64_add(amdgpu_bo_size(bo),
+		     &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
+void amdgpu_amdkfd_account_vram_unpin(struct amdgpu_bo *bo, int xcp_id)
+{
+	if (!bo->kfd_bo)
+		return;
+
+	if (WARN_ONCE(xcp_id < 0, "KFD BO unpinned in VRAM with no partition"))
+		return;
+
+	atomic64_sub(amdgpu_bo_size(bo),
+		     &amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned[xcp_id]);
+}
+
 /**
  * create_dmamap_sg_bo() - Creates a amdgpu_bo object to reflect information
  * about USERPTR or DOOREBELL or MMIO BO.
@@ -1519,10 +1530,6 @@ static int amdgpu_amdkfd_gpuvm_pin_bo(struct amdgpu_bo *bo, u32 domain)
 
 	amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false);
 
-	if (!ret && bo->tbo.resource->mem_type == TTM_PL_VRAM)
-		atomic64_add(amdgpu_bo_size(bo),
-			&amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
 out:
 	amdgpu_bo_unreserve(bo);
 	return ret;
@@ -1546,10 +1553,6 @@ static void amdgpu_amdkfd_gpuvm_unpin_bo(struct amdgpu_bo *bo)
 
 	amdgpu_bo_unpin(bo);
 
-	if (bo->tbo.resource->mem_type == TTM_PL_VRAM)
-		atomic64_sub(amdgpu_bo_size(bo),
-			&amdgpu_ttm_adev(bo->tbo.bdev)->kfd.vram_pinned);
-
 	amdgpu_bo_unreserve(bo);
 }
 
@@ -1653,8 +1656,9 @@ int amdgpu_amdkfd_criu_resume(void *p)
 	return ret;
 }
 
-size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
-					  uint8_t xcp_id)
+/* Caller must hold kfd_mem_limit.mem_limit_lock. */
+static size_t __get_available_memory(struct amdgpu_device *adev,
+				     uint8_t xcp_id, int64_t vram_used)
 {
 	uint64_t reserved_for_pt =
 		ESTIMATE_PT_SIZE(amdgpu_amdkfd_total_mem_size);
@@ -1663,15 +1667,17 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
 	ssize_t available;
 	uint64_t vram_available, system_mem_available, ttm_mem_available;
 
-	spin_lock(&kfd_mem_limit.mem_limit_lock);
+	lockdep_assert_held(&kfd_mem_limit.mem_limit_lock);
+
 	if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)
 		vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
-			- adev->kfd.vram_used_aligned[xcp_id];
+			- vram_used;
 	else
 		vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
-			- adev->kfd.vram_used_aligned[xcp_id]
-			- atomic64_read(&adev->vram_pin_size)
-			+ atomic64_read(&adev->kfd.vram_pinned)
+			- vram_used
+			- atomic64_read(&adev->vram_pin_size_xcp[xcp_id])
+			- atomic64_read(&adev->vram_pin_size_common)
+			+ atomic64_read(&adev->kfd.vram_pinned[xcp_id])
 			- reserved_for_pt
 			- reserved_for_ras;
 
@@ -1686,19 +1692,29 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
 
 		available = min3(system_mem_available, ttm_mem_available,
 				 vram_available);
-		available = ALIGN_DOWN(available, PAGE_SIZE);
 	} else {
-		available = ALIGN_DOWN(vram_available, VRAM_AVAILABLITY_ALIGN);
+		available = vram_available;
 	}
 
-	spin_unlock(&kfd_mem_limit.mem_limit_lock);
-
 	if (available < 0)
 		available = 0;
 
 	return available;
 }
 
+size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
+					  uint8_t xcp_id)
+{
+	size_t available;
+
+	spin_lock(&kfd_mem_limit.mem_limit_lock);
+	available = __get_available_memory(adev, xcp_id,
+					   adev->kfd.vram_used_aligned[xcp_id]);
+	spin_unlock(&kfd_mem_limit.mem_limit_lock);
+
+	return available;
+}
+
 int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
 		struct amdgpu_device *adev, uint64_t va, uint64_t size,
 		void *drm_priv, struct kgd_mem **mem,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index cdab2c098cfab7..c2f13584a5a32b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -917,6 +917,19 @@ void amdgpu_bo_unref(struct amdgpu_bo **bo)
 	*bo = NULL;
 }
 
+/* Map a BO onto vram_pin_size_xcp[]. bo->xcp_id < 0 means "any partition":
+ * such pins are not owned by a single partition and go to
+ * vram_pin_size_common, which every partition subtracts.
+ */
+static int amdgpu_bo_get_xcp(struct amdgpu_bo *bo)
+{
+	s8 xcp = bo->xcp_id;
+
+	if (xcp >= 0 && xcp < MAX_XCP)
+		return xcp;
+	return -1;
+}
+
 /**
  * amdgpu_bo_pin - pin an &amdgpu_bo buffer object
  * @bo: &amdgpu_bo buffer object to be pinned
@@ -997,7 +1010,17 @@ int amdgpu_bo_pin(struct amdgpu_bo *bo, u32 domain)
 	ttm_bo_pin(&bo->tbo);
 
 	if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+		int xcp = amdgpu_bo_get_xcp(bo);
+
 		atomic64_add(amdgpu_bo_size(bo), &adev->vram_pin_size);
+		if (xcp >= 0) {
+			atomic64_add(amdgpu_bo_size(bo),
+				     &adev->vram_pin_size_xcp[xcp]);
+		} else {
+			atomic64_add(amdgpu_bo_size(bo),
+				     &adev->vram_pin_size_common);
+		}
+		amdgpu_amdkfd_account_vram_pin(bo, xcp);
 		atomic64_add(amdgpu_vram_mgr_bo_visible_size(bo),
 			     &adev->visible_pin_size);
 	} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
@@ -1030,7 +1053,17 @@ void amdgpu_bo_unpin(struct amdgpu_bo *bo)
 		dma_buf_unpin(bo->tbo.base.import_attach);
 
 	if (bo->tbo.resource->mem_type == TTM_PL_VRAM) {
+		int xcp = amdgpu_bo_get_xcp(bo);
+
 		atomic64_sub(amdgpu_bo_size(bo), &adev->vram_pin_size);
+		if (xcp >= 0) {
+			atomic64_sub(amdgpu_bo_size(bo),
+				     &adev->vram_pin_size_xcp[xcp]);
+		} else {
+			atomic64_sub(amdgpu_bo_size(bo),
+				     &adev->vram_pin_size_common);
+		}
+		amdgpu_amdkfd_account_vram_unpin(bo, xcp);
 		atomic64_sub(amdgpu_vram_mgr_bo_visible_size(bo),
 			     &adev->visible_pin_size);
 	} else if (bo->tbo.resource->mem_type == TTM_PL_TT) {
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 1ec77554da5034..b90bfbd121f887 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1035,11 +1035,19 @@ static int kfd_ioctl_get_available_memory(struct file *filep,
 {
 	struct kfd_ioctl_get_available_memory_args *args = data;
 	struct kfd_process_device *pdd = kfd_lock_pdd_by_id(p, args->gpu_id);
+	struct amdgpu_device *adev;
+	size_t available;
 
 	if (!pdd)
 		return -EINVAL;
-	args->available = amdgpu_amdkfd_get_available_memory(pdd->dev->adev,
-							pdd->dev->node_id);
+
+	adev = pdd->dev->adev;
+	available = amdgpu_amdkfd_get_available_memory(adev, pdd->dev->node_id);
+	if (adev->apu_prefer_gtt)
+		args->available = ALIGN_DOWN(available, PAGE_SIZE);
+	else
+		args->available = ALIGN_DOWN(available, VRAM_AVAILABLITY_ALIGN);
+
 	kfd_unlock_pdd(pdd);
 	return 0;
 }

From ac01bab1bff8f08d57fdaedb624e36fb65d147c6 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Thu, 15 Oct 2026 14:06:48 +0900
Subject: [PATCH 1689/1982] ipv6: remove ifaddr from hash during ifdown list
 cleanup

[ Upstream commit 6ace56ed7b13a9c6d4cb7ef0d82d3a3d53324a63 ]

addrconf_ifdown() clears the address hash before snapshotting the
per-device address list. A concurrent ipv6_add_addr() can publish an
address after the hash scan and before the list snapshot.

The ifdown path then removes the address from the device list and drops
the list-owned reference while it is still linked in the hash. Once the
remaining references are released, inet6_ifa_finish_destroy() warns, but
a DEAD address continues to kfree_rcu(). The hash therefore points to
freed memory that later RCU walkers can dereference.

This follow-on was found by source review and was not separately
triggered at runtime.

Remove each non-kept address from the hash immediately before removing
it from the per-device list. Keeping it hashed through the delete
notification blocks same-address publication until NETDEV_DOWN has been
delivered. hlist_del_init_rcu() is safe when the earlier hash scan
already removed the address.

This handles a late publisher captured by the list snapshot. The next
change serializes publication with teardown so an add cannot miss both
observations. Both changes are required when backporting the complete fix.

Fixes: 73a8bd74e261 ("ipv6: Revert 'administrative down' address handling changes.")
Cc: stable@vger.kernel.org
Reported-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20261004135117.GA206930@shredder
Link: https://lore.kernel.org/r/179161099539.434549.2238120015372268173@kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-2-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/addrconf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 81f5bda2a89fc8..067d325291b9fc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4006,6 +4006,10 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
 		}
 
 		if (!keep) {
+			spin_lock_bh(&net->ipv6.addrconf_hash_lock);
+			hlist_del_init_rcu(&ifa->addr_lst);
+			spin_unlock_bh(&net->ipv6.addrconf_hash_lock);
+
 			write_lock_bh(&idev->lock);
 			list_del_rcu(&ifa->if_list);
 			write_unlock_bh(&idev->lock);

From ff386540eef6fabdb330bee9ef927c9fafe71496 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Thu, 15 Oct 2026 14:06:49 +0900
Subject: [PATCH 1690/1982] ipv6: serialize address publication with device
 teardown

[ Upstream commit 06227034e2d93942119b922cf05f2de9da0ad848 ]

ipv6_add_addr() checks idev state before allocating an ifaddr, but
publishes the object later. addrconf_ifdown() can mark and detach the
idev between the check and publication.

This happens when a non-loopback device MTU falls below IPV6_MIN_MTU. A
forced interleaving published an address on a dead idev, and
ipv6_get_ifaddr() still returned it after teardown. Later device deletion
remained blocked with:

  unregister_netdevice: waiting for ac0 to become free. Usage count = 3

Protect the dead indication with idev->lock and keep that lock across
both hash and device-list publication. Recheck dead before publishing;
if teardown wins the lock, reject the unpublished object.

Non-unregister teardown does not set dead. The preceding change covers an
add that misses the initial hash scan but reaches the per-device list
snapshot. Both changes are required when backporting this fix.

Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20261012145306.GB779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-3-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/addrconf.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 067d325291b9fc..caf8f3bd2372f5 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1168,14 +1168,18 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
 
 	rcu_read_lock();
 
-	err = ipv6_add_addr_hash(idev->dev, ifa);
+	write_lock_bh(&idev->lock);
+
+	if (idev->dead)
+		err = -ENODEV;
+	else
+		err = ipv6_add_addr_hash(idev->dev, ifa);
 	if (err < 0) {
+		write_unlock_bh(&idev->lock);
 		rcu_read_unlock();
 		goto out;
 	}
 
-	write_lock_bh(&idev->lock);
-
 	/* Add to inet6_dev unicast addr list. */
 	ipv6_link_dev_addr(idev, ifa);
 
@@ -3884,7 +3888,9 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
 	 *	   Do not dev_put!
 	 */
 	if (unregister) {
+		write_lock_bh(&idev->lock);
 		WRITE_ONCE(idev->dead, 1);
+		write_unlock_bh(&idev->lock);
 
 		/* protected by rtnl_lock */
 		RCU_INIT_POINTER(dev->ip6_ptr, NULL);

From 1ca1ed1e5752c2fcb61a25ec31e612b1d88e2b4e Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Thu, 15 Oct 2026 14:06:50 +0900
Subject: [PATCH 1691/1982] ipv6: initialize temporary ifaddr before
 publication

[ Upstream commit ed7f278812e540db507f683e5bf9b6d0a1f5bc1e ]

ipv6_create_tempaddr() holds a reference to the public ifaddr, publishes
the new temporary address through ipv6_add_addr(), and only then stores
the reference and final timestamps.

addrconf_ifdown() can remove the temporary address before ifpub is
stored, leaking the public ifaddr reference. Publishing ifpub alone is
insufficient: manage_tempaddrs() can then find the object before cstamp
and tstamp are final, update its lifetimes, and have the constructor
overwrite its timestamp with an older value.

This follow-on was found by source review and was not separately
triggered at runtime.

Pass the public ifaddr and both timestamps in ifa6_config. Initialize all
three fields before adding the temporary address to either the hash or
per-device lists. On success the existing public-ifaddr reference
transfers to the temporary object. On error it remains owned and released
by ipv6_create_tempaddr().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179122559913.434549.12720841717630168470@kernel.org
Link: https://lore.kernel.org/r/179161099665.434549.5858601179492551889@kernel.org
Link: https://lore.kernel.org/r/20261007164548.GA1153540@shredder
Link: https://lore.kernel.org/r/20261012145240.GA779501@shredder
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-4-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/addrconf.h |  3 +++
 net/ipv6/addrconf.c    | 20 +++++++++++++-------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index b353dea9aedc8f..03d6543a51890c 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -80,6 +80,9 @@ struct ifa6_config {
 	u8			ifa_proto;
 
 	const struct in6_addr	*peer_pfx;
+	struct inet6_ifaddr	*ifpub;
+	unsigned long		cstamp;
+	unsigned long		tstamp;
 
 	u32			rt_priority;
 	u32			ifa_flags;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index caf8f3bd2372f5..e277b78313686d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1155,10 +1155,19 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
 		ifa->flags |= IFA_F_TENTATIVE;
 	ifa->valid_lft = cfg->valid_lft;
 	ifa->prefered_lft = cfg->preferred_lft;
-	ifa->cstamp = ifa->tstamp = jiffies;
 	ifa->tokenized = false;
 
 	ifa->rt = f6i;
+	ifa->ifpub = cfg->ifpub;
+	if (cfg->ifpub) {
+		ifa->cstamp = cfg->cstamp;
+		ifa->tstamp = cfg->tstamp;
+	} else {
+		unsigned long now = jiffies;
+
+		ifa->cstamp = now;
+		ifa->tstamp = now;
+	}
 
 	ifa->idev = idev;
 	in6_dev_hold(idev);
@@ -1491,6 +1500,9 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
 
 	cfg.pfx = &addr;
 	cfg.scope = ipv6_addr_scope(cfg.pfx);
+	cfg.ifpub = ifp;
+	cfg.cstamp = now;
+	cfg.tstamp = tmp_tstamp;
 
 	ift = ipv6_add_addr(idev, &cfg, block, NULL);
 	if (IS_ERR(ift)) {
@@ -1501,12 +1513,6 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
 		goto retry;
 	}
 
-	spin_lock_bh(&ift->lock);
-	ift->ifpub = ifp;
-	ift->cstamp = now;
-	ift->tstamp = tmp_tstamp;
-	spin_unlock_bh(&ift->lock);
-
 	addrconf_dad_start(ift);
 	in6_ifa_put(ift);
 	in6_dev_put(idev);

From 9e93f41a3483974fc7df24def7f7999909cfd5ec Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Thu, 15 Oct 2026 14:06:51 +0900
Subject: [PATCH 1692/1982] ipv6: do not restart DAD for a dead ifaddr

[ Upstream commit ffb668669ce4144347973d8b2fad449e9be0563d ]

addrconf_dad_failure() can create a stable-privacy replacement without
RTNL. After ipv6_add_addr() publishes it, addrconf_ifdown() can mark the
new ifaddr DEAD, clear its route, and unlink it before the recovery path
takes ifp2->lock.

The recovery path then unconditionally changes the state back to PREDAD
and queues delayed DAD work. The MTU teardown path can leave IF_READY
set. For an optimistic address, addrconf_dad_begin() can consequently
pass the cleared NULL route to ip6_ins_rt().

This follow-on was found by source review and was not separately
triggered at runtime.

The new ifaddr is already initialized in PREDAD. Under ifp2->lock, record
the retry and queue DAD only if teardown has not changed the state to
DEAD. If teardown wins after this check, the work observes DEAD and exits
without reviving the address.

This complements the existing lock_errdad check that preserves the original
ifaddr's DEAD state after the same function reacquires its lock.

Fixes: 5f40ef77adb2 ("ipv6: do retries on stable privacy addresses")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@kernel.org
Link: https://lore.kernel.org/r/20260513025509.3776405-1-lilinmao@kylinos.cn
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261015050651.1841557-5-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/addrconf.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e277b78313686d..527ae9fc1c41c1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2198,6 +2198,7 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
 			     ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
 
 	if (ifp->flags & IFA_F_STABLE_PRIVACY) {
+		bool start_dad = false;
 		struct in6_addr new_addr;
 		struct inet6_ifaddr *ifp2;
 		int retries = ifp->stable_privacy_retry + 1;
@@ -2236,11 +2237,14 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
 			goto lock_errdad;
 
 		spin_lock_bh(&ifp2->lock);
-		ifp2->stable_privacy_retry = retries;
-		ifp2->state = INET6_IFADDR_STATE_PREDAD;
+		if (ifp2->state != INET6_IFADDR_STATE_DEAD) {
+			ifp2->stable_privacy_retry = retries;
+			start_dad = true;
+		}
 		spin_unlock_bh(&ifp2->lock);
 
-		addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
+		if (start_dad)
+			addrconf_mod_dad_work(ifp2, net->ipv6.sysctl.idgen_delay);
 		in6_ifa_put(ifp2);
 lock_errdad:
 		spin_lock_bh(&ifp->lock);

From 83babb400486507c98e151ec08a3663ffe1563a7 Mon Sep 17 00:00:00 2001
From: Tingjie Zhong <catme0w@live.cn>
Date: Tue, 20 Oct 2026 10:46:57 -0600
Subject: [PATCH 1693/1982] fbdev: bitblit: Fix glyph clipping when fbcon pans

[ Upstream commit 06fccf840640d8f6b0e08a1756f8d2f0435b4cbe ]

Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.

Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.

Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Tingjie Zhong <catme0w@live.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/core/bitblit.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 8f6a2d1736d396..86ae7a7252d211 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -18,6 +18,7 @@
 #include <linux/console.h>
 #include <asm/types.h>
 #include "fbcon.h"
+#include "fbcon_rotate.h"
 
 /*
  * Accelerated handlers.
@@ -151,7 +152,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
 		      const unsigned short *s, int count, int yy, int xx,
 		      int fg, int bg)
 {
+	struct fbcon_par *par = info->fbcon_par;
 	struct fb_image image;
+	u32 vyres = GETVYRES(par->p, info);
 	u32 width = DIV_ROUND_UP(vc->vc_font.width, 8);
 	u32 cellsize = width * vc->vc_font.height;
 	u32 maxcnt = info->pixmap.size/cellsize;
@@ -168,10 +171,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
 	image.height = vc->vc_font.height;
 	image.depth = 1;
 
-	if (image.dy >= info->var.yres)
+	if (image.dy >= vyres)
 		return;
 
-	image.height = min(image.height, info->var.yres - image.dy);
+	image.height = min(image.height, vyres - image.dy);
 
 	if (attribute) {
 		buf = kmalloc(cellsize, GFP_ATOMIC);

From fbeb004b09658d9ae54af6951f0220a2ecf5dd7c Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Wed, 16 Sep 2026 17:01:26 +0800
Subject: [PATCH 1694/1982] PCI: qcom-ep: Deinitialize endpoint on remove

[ Upstream commit ed1d71e41c7b2e755e0ef8e9af9cab9b6b185c4b ]

qcom_pcie_ep_probe() initializes the DesignWare PCIe endpoint with
dw_pcie_ep_init(). The probe failure paths call dw_pcie_ep_deinit() to
release the corresponding endpoint resources, but the remove path does
not perform the matching teardown after a successful probe.

As a result, resources initialized by the DesignWare endpoint core can
remain allocated when the endpoint controller is removed.

Notify endpoint functions about EPC deinitialization and call
dw_pcie_ep_deinit() before disabling the controller resources. Keep the
existing early return when the link is already disabled since Qualcomm
endpoint controllers depend on the host refclk for hardware cleanup.

This issue was found by manual code inspection.

Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916090126.2963064-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-qcom-ep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
index f1bc0ac81a928b..72bb2a2dd238ed 100644
--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
+++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
@@ -920,6 +920,8 @@ static void qcom_pcie_ep_remove(struct platform_device *pdev)
 
 	if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED)
 		return;
+	pci_epc_deinit_notify(pcie_ep->pci.ep.epc);
+	dw_pcie_ep_deinit(&pcie_ep->pci.ep);
 
 	qcom_pcie_disable_resources(pcie_ep);
 }

From 80ee045485b98533c5732f417df19229e3794928 Mon Sep 17 00:00:00 2001
From: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Date: Fri, 16 Oct 2026 23:15:25 +0700
Subject: [PATCH 1695/1982] net/rds: ib: don't enable IRQs in
 rds_ib_conn_free()

[ Upstream commit f6fa1d60ec3ceb7e6c26aa91eadfef34f94014e1 ]

__rds_conn_create() calls trans->conn_free() with rds_conn_lock held
and IRQs disabled when it loses the race to insert a connection.
rds_ib_conn_free() takes the device list lock with spin_lock_irq() and
releases it with spin_unlock_irq(), so IRQs are turned on while
rds_conn_lock is still held:

  raw_local_irq_restore() called with IRQs enabled
  WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20
   _raw_spin_unlock_irqrestore+0x67/0x80
   __rds_conn_create+0x1de5/0x2290
   rds_conn_create_outgoing+0x43/0x60
   rds_sendmsg+0xfca/0x20e0
   __sys_sendto+0x408/0x5a0

It needs an RDS socket bound to an address on an RDMA device (e.g. rxe)
and two concurrent sendto() calls to the same new destination.

The TCP and loopback ->conn_free() callbacks already use irqsave, so
do the same here.

Fixes: 745cbccac3fe ("RDS: Rewrite connection cleanup, fixing oops on rmmod")
Reported-by: syzbot+c3741bb338b5c6d6a4aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c3741bb338b5c6d6a4aa
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib_cm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 1c6e3b3f39d00e..c8771aa7df53a6 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -1271,6 +1271,7 @@ void rds_ib_conn_free(void *arg)
 {
 	struct rds_ib_connection *ic = arg;
 	spinlock_t	*lock_ptr;
+	unsigned long flags;
 
 	rdsdebug("ic %p\n", ic);
 
@@ -1281,9 +1282,10 @@ void rds_ib_conn_free(void *arg)
 	 */
 	lock_ptr = ic->rds_ibdev ? &ic->rds_ibdev->spinlock : &ib_nodev_conns_lock;
 
-	spin_lock_irq(lock_ptr);
+	/* May be called with IRQs already disabled (see __rds_conn_create()) */
+	spin_lock_irqsave(lock_ptr, flags);
 	list_del(&ic->ib_node);
-	spin_unlock_irq(lock_ptr);
+	spin_unlock_irqrestore(lock_ptr, flags);
 
 	rds_ib_recv_free_caches(ic);
 

From bea16873a071bc62162efb6213e9141ac7732a67 Mon Sep 17 00:00:00 2001
From: Yingjie Wang <1075151112@qq.com>
Date: Fri, 16 Oct 2026 11:02:58 +0800
Subject: [PATCH 1696/1982] net: unix: reject negative max_dgram_qlen values

[ Upstream commit 1a4e7bc6e3457ad95515a9d2c042452c3161bb2c ]

net.unix.max_dgram_qlen is parsed as a signed int and copied to the u32
sock::sk_max_ack_backlog when an AF_UNIX socket is created.  Consequently,
a negative value such as -1 is accepted and converted to UINT_MAX.  Since
the receive queue length is also u32, its fullness check cannot become true
for that limit.

max_dgram_qlen has no documented negative sentinel.  Its existing signed
interface represents nonnegative values only through INT_MAX; negative bit
patterns are not a supported encoding for the upper half of the u32
consumer range.

Switch to proc_dointvec_minmax and make the established 0..INT_MAX input
range explicit.  This rejects negative values without adding new accepted
values or changing the default and zero-value behavior.  Very large valid
values can still make the queue limit impractical to reach; this change
corrects the input domain rather than imposing a new resource ceiling.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/tencent_A643419B56079E9A448D97922763FF069F08@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/networking/ip-sysctl.rst | 3 ++-
 net/unix/sysctl_net_unix.c             | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 27a861053b2f53..c2ca933f7bdbc6 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -3729,5 +3729,6 @@ l3mdev_accept - BOOLEAN
 max_dgram_qlen - INTEGER
 	The maximum length of dgram socket receive queue
 
-	Default: 10
+	Possible values: 0 - INT_MAX
 
+	Default: 10
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index e02ed6e3955c06..bb93cf3aa6feee 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -19,7 +19,9 @@ static struct ctl_table unix_table[] = {
 		.data		= &init_net.unx.sysctl_max_dgram_qlen,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ZERO,
+		.extra2		= SYSCTL_INT_MAX,
 	},
 };
 

From ea1c50e9f1362caf17be32831cd9bf36289cd48e Mon Sep 17 00:00:00 2001
From: Bryam Vargas <hexlabsecurity@proton.me>
Date: Tue, 13 Oct 2026 15:45:01 -0500
Subject: [PATCH 1697/1982] net/smc: queue the copied chunk when
 smc_tx_sendmsg() faults

[ Upstream commit c0703534b223a5c6993e0f000fd1c3abe621fb65 ]

When a send wraps the end of the send buffer, smc_tx_sendmsg() copies
the data in two chunks. If memcpy_from_msg() faults on the second one,
smc_tx_sendmsg() returns send_done, which already counts the first
chunk, but leaves tx_curs_prep and sndbuf_space as they were. send()
reports bytes the peer never receives, and the next send() overwrites
them. Any caller can hit this on its own stream with a buffer whose
tail is unreadable.

On a fault in the second chunk, queue the first one. The next pass
retries the rest and returns send_done if it faults again, so send()
reports only what it queued, as TCP does.

Fixes: e6727f39004b ("smc: send data (through RDMA)")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20261013-b4-disp-872a3689-v1-1-2a4c63b04761@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_tx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 3144b4b1fe2901..495fb1354728c0 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -249,6 +249,13 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
 			rc = memcpy_from_msg(sndbuf_base + chunk_off,
 					     msg, chunk_len);
 			if (rc) {
+				if (chunk) {
+					/* send_done counts the first chunk:
+					 * queue it and retry the rest
+					 */
+					copylen -= chunk_len;
+					break;
+				}
 				smc_sndbuf_sync_sg_for_device(conn);
 				if (send_done)
 					return send_done;

From 6d1ca6232ed36257a6ee9124d98cbfe667e5a266 Mon Sep 17 00:00:00 2001
From: Matt Turner <mattst88@gmail.com>
Date: Mon, 3 Aug 2026 15:42:26 -0400
Subject: [PATCH 1698/1982] alpha: determine tininess after rounding in the FP
 emulation

[ Upstream commit b74843b38da8f1186fd7d447646c835b47096a15 ]

IEEE 754 lets an architecture determine tininess of a floating-point
result either before or after rounding, but requires the same choice for
every operation.  Alpha determines it after rounding, and stdlib's
tst-tininess confirms the hardware does so for the results it produces
itself.

The soft-fp emulation has no notion of the distinction and always
determines tininess before rounding, so a result that the hardware would
not consider tiny is reported as underflowing whenever the instruction
happens to trap for software completion.  The two paths then disagree on
the same machine.  A multiply of the largest subnormal double by
1 + 2^-52 rounds up to the smallest normal and raises no underflow when
the operands are normal, but raises it when an operand is subnormal and
the instruction traps:

  glibc math testsuite, test-float32x-float64-mul:
    Failure: mul_double (0x3.ffffffffffffcp-1024, 0x1.0000000000001p+0):
    Exception "Underflow" set

Add _FP_TININESS_AFTER_ROUNDING, as glibc's copy of soft-fp has, and set
it for alpha.  It determines tininess by rounding a copy of the result as
if the exponent range were unbounded, which is what the definition asks
for.  A plain check of whether the rounded result came out normal is not
equivalent: it differs for values that are still tiny once rounded with
an unbounded exponent range but reach the smallest normal on the coarser
subnormal grid.  That plain check is what the hardware itself does (it
decides tininess from the delivered result), and it is why a divide such
as -0x4p-128 / 0x1.000002p+0 in FE_DOWNWARD delivers -0x1p-126 and raises
nothing although the result is tiny after rounding.  Such cases do not
trap, so the emulation never sees them; where it does get control, it
follows the definition rather than reproducing that deviation, which is
what glibc's soft-fp does as well.

The macro defaults to zero, so powerpc, sh and sparc keep determining
tininess before rounding as they do now.

Cc: stable@vger.kernel.org # 5.15+
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-3-c99d75608e60@gmail.com
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/sfp-machine.h |  4 ++++
 include/math-emu/op-common.h         | 23 +++++++++++++++++++++--
 include/math-emu/soft-fp.h           |  8 ++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/arch/alpha/include/asm/sfp-machine.h b/arch/alpha/include/asm/sfp-machine.h
index 5fe63afbd474fd..bff1ad963c689b 100644
--- a/arch/alpha/include/asm/sfp-machine.h
+++ b/arch/alpha/include/asm/sfp-machine.h
@@ -59,6 +59,10 @@
     R##_c = FP_CLS_NAN;						\
   } while (0)
 
+/* Alpha determines tininess after rounding, so the emulation must do the
+   same as the hardware does for the results it produces itself.  */
+#define _FP_TININESS_AFTER_ROUNDING	1
+
 /* Obtain the current rounding mode. */
 #define FP_ROUNDMODE	mode
 #define FP_RND_NEAREST	(FPCR_DYN_NORMAL >> FPCR_DYN_SHIFT)
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index 8ce066c035cfa7..1d1ce5c08efcfc 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -135,6 +135,24 @@ do {								\
     else							\
       {								\
 	/* we've got a denormalized number */			\
+	int _FP_PACK_CANONICAL_is_tiny = 1;			\
+	if (_FP_TININESS_AFTER_ROUNDING && X##_e == 0)		\
+	  {							\
+	    /* Architectures that detect tininess after rounding	\
+	       only signal underflow if the result is still		\
+	       subnormal once rounded as if the exponent range	\
+	       were unbounded.  Round a copy to find out.  */	\
+	    FP_DECL_##fs(_FP_PACK_CANONICAL_T);			\
+	    /* The class field is not used by the rounding below,	\
+	       and is unused entirely where this block is dead.  */	\
+	    (void)_FP_PACK_CANONICAL_T##_c;			\
+	    _FP_FRAC_COPY_##wc(_FP_PACK_CANONICAL_T, X);	\
+	    _FP_PACK_CANONICAL_T##_s = X##_s;			\
+	    _FP_PACK_CANONICAL_T##_e = X##_e;			\
+	    _FP_ROUND(wc, _FP_PACK_CANONICAL_T);		\
+	    if (_FP_FRAC_OVERP_##wc(fs, _FP_PACK_CANONICAL_T))	\
+	      _FP_PACK_CANONICAL_is_tiny = 0;			\
+	  }							\
 	X##_e = -X##_e + 1;					\
 	if (X##_e <= _FP_WFRACBITS_##fs)			\
 	  {							\
@@ -161,8 +179,9 @@ do {								\
 		    _FP_FRAC_SRL_##wc(X, _FP_WORKBITS);		\
 		  }						\
 	      }							\
-	    if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) ||		\
-		(FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW))	\
+	    if (_FP_PACK_CANONICAL_is_tiny			\
+		&& ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) ||	\
+		    (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)))	\
 		FP_SET_EXCEPTION(FP_EX_UNDERFLOW);		\
 	  }							\
 	else							\
diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
index 5650c162838305..02ada0a9fca167 100644
--- a/include/math-emu/soft-fp.h
+++ b/include/math-emu/soft-fp.h
@@ -31,6 +31,14 @@
 #include <endian.h>
 #endif
 
+/* Whether the architecture determines tininess of a floating-point
+   result after rounding rather than before it.  IEEE 754 permits either
+   but requires the same choice for every operation, so this has to agree
+   with what the hardware does for the results it produces itself.  */
+#ifndef _FP_TININESS_AFTER_ROUNDING
+#define _FP_TININESS_AFTER_ROUNDING	0
+#endif
+
 #define _FP_WORKBITS		3
 #define _FP_WORK_LSB		((_FP_W_TYPE)1 << 3)
 #define _FP_WORK_ROUND		((_FP_W_TYPE)1 << 2)

From 16452d2c14525e6da15960afb8feea69a9060f19 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Sat, 10 Oct 2026 19:34:52 +0800
Subject: [PATCH 1699/1982] ocfs2: reserve metadata for a new xattr block and
 its value tree

[ Upstream commit 8ad5fa0c11246d260d7b12c9672e604b1f431b2e ]

Patch series "ocfs2: fix metadata reservation for xattr value trees".

ocfs2_calc_xattr_set_need() reserves too little metadata for a new xattr
value's extent tree on three paths.  The reservation cannot be topped up
once the transaction has started, so ocfs2_add_clusters_in_btree() gives
up with RESTART_META when the value root fills and nothing is left.
ocfs2_xattr_extend_allocation() turns that into -ENOSPC, after
ocfs2_xa_cleanup_value_truncate() has dropped the entry and leaked the
clusters already handed out; before commit 0cdc7dde00ec ("ocfs2: fix
missing metadata reservation for large xattrs") it was a BUG_ON() instead.
It takes a fragmented cluster allocator to get there, since the first
extent always fits in the root.

Patch 1 fixes the create side of meta_guess: commit 3ed2be719eb9 ("ocfs2:
allow for more than one data extent when creating xattr") replaced the
block reserved for the new xattr block with the two the value tree needs
instead of adding them together.

Patch 2 fixes the arm that moves an xattr back into the inode, which
charges credits for a value tree but no metadata for one.

Patch 3 drops a second copy of the same reservation on the path that falls
through to meta_guess.  That one is cleanup rather than a fix and is not
for stable, and it must not be backported without patch 1: the duplicate
it removes is what currently covers the shortfall patch 1 fixes.

This patch (of 3):

The create side of meta_guess in ocfs2_calc_xattr_set_need() reserves
metadata for the new value's extent tree and nothing for the xattr block
that will hold it:

        } else {
                credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
                if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
                        struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
                        meta_add += ocfs2_extend_meta_needed(el);
                        ...

Commit 3ed2be719eb9 ("ocfs2: allow for more than one data extent when
creating xattr") meant to add that tree on top of the meta_add += 1 the
branch already had, but it moved the 1 into the else arm instead, so the
external-value case lost it.  The 1 is not optional: it is what
ocfs2_create_xattr_block() takes from meta_ac through
ocfs2_claim_metadata(), and it is spent before the value tree exists.

ocfs2_extend_meta_needed() on the empty def_xv list returns 2, so the
branch reserves 2 where 3 are needed.  The xattr block consumes one, and
when the cluster allocator is fragmented enough that the value needs more
than one extent, ocfs2_add_clusters_in_btree() comes back around with a
full value root and ocfs2_alloc_context_bits_left() of 1 against a
threshold of 2.  It answers RESTART_META, which
ocfs2_xattr_extend_allocation() turns into a BUG_ON().  Commit
0cdc7dde00ec ("ocfs2: fix missing metadata reservation for large xattrs")
downgraded that to -ENOSPC, at the cost of leaking the clusters already
handed out: ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters
arm, drops the entry and leaves the clusters for fsck.ocfs2 to reclaim.

Reserve for the block and the tree separately.

Link: https://lore.kernel.org/20261010113454.1420939-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261010113454.1420939-2-joseph.qi@linux.alibaba.com
Fixes: 3ed2be719eb9 ("ocfs2: allow for more than one data extent when creating xattr")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index b5029c4e3784ef..a47a038b3311b9 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3243,7 +3243,13 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
 		credits += OCFS2_XATTR_BLOCK_CREATE_CREDITS;
 		if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
 			struct ocfs2_extent_list *el = &def_xv.xv.xr_list;
-			meta_add += ocfs2_extend_meta_needed(el);
+			/*
+			 * One block for the xattr block we may have to
+			 * allocate, the rest for growing the value tree it
+			 * would hold.  If ocfs2_xattr_ibody_set() succeeds
+			 * instead, that first block goes unused.
+			 */
+			meta_add += 1 + ocfs2_extend_meta_needed(el);
 			credits += ocfs2_calc_extend_credits(inode->i_sb,
 							     el);
 		} else {

From aea3d821519b58c0ea4074734cb5cd1000a8cf65 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Sat, 10 Oct 2026 19:34:53 +0800
Subject: [PATCH 1700/1982] ocfs2: reserve value tree metadata when moving an
 xattr into the inode

[ Upstream commit f5aee8ae5f85f8dfa78160e5c4963494319cdd64 ]

ocfs2_calc_xattr_set_need() charges no metadata for the case where an
xattr living in an xattr block or bucket moves back into the inode:

        if (old_in_xb) {
                if (ocfs2_xattr_can_be_in_inode(inode, xi, xis)) {
                        clusters_add += new_clusters;
                        credits += ...;
                        if (!ocfs2_xattr_is_local(xe))
                                credits += ocfs2_calc_extend_credits(...);
                        goto out;
                }
        }

The credits for extending a value tree are there but the matching blocks
are not, so meta_add stays 0, ocfs2_init_xattr_set_ctxt() skips
ocfs2_reserve_new_metadata_blocks() and ctxt->meta_ac is left NULL.

This is the shape commit 0cdc7dde00ec ("ocfs2: fix missing metadata
reservation for large xattrs") fixed for the xattr block case, and it is
reached the same way: namevalue_size() charges a value larger than
OCFS2_XATTR_INLINE_SIZE as only OCFS2_XATTR_ROOT_SIZE, so
ocfs2_xattr_can_be_in_inode() accepts a new value that will be stored
outside.  ocfs2_xa_prepare_entry() installs a value root from def_xv and
grows it, and once the cluster allocator is fragmented enough to need a
second extent ocfs2_add_clusters_in_btree() finds the root full with no
meta_ac at all and answers RESTART_META.  ocfs2_xattr_extend_allocation()
turns that into -ENOSPC, or into a BUG_ON() without that commit, and
ocfs2_xa_cleanup_value_truncate() takes its !orig_clusters arm, dropping
the entry and leaking the clusters already handed out until fsck.ocfs2
reclaims them.

Reserve for the value tree here too.  The entry moves back into the inode
rather than into a new xattr block, so unlike the create side of
meta_guess this needs no block of its own.

Link: https://lore.kernel.org/20261010113454.1420939-3-joseph.qi@linux.alibaba.com
Fixes: 78f30c314a74 ("ocfs2/xattr: Reserve meta/data at the beginning of ocfs2_xattr_set.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index a47a038b3311b9..ab117ed2623e74 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3143,6 +3143,14 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
 				credits += ocfs2_calc_extend_credits(
 							inode->i_sb,
 							&def_xv.xv.xr_list);
+			/*
+			 * A value too big to stay inline is only charged as
+			 * OCFS2_XATTR_ROOT_SIZE above, so it can still need a
+			 * value tree of its own.  No xattr block is allocated
+			 * on this path, so the tree is all we reserve for.
+			 */
+			if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
+				meta_add += ocfs2_extend_meta_needed(&def_xv.xv.xr_list);
 			goto out;
 		}
 	}

From be9f947632398a96e68fe21fa17890e255f31fdb Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Fri, 9 Oct 2026 16:30:00 +0800
Subject: [PATCH 1701/1982] ocfs2: deal with legacy signed dir index name hash
 values

[ Upstream commit d1b49d5ea1bf43cce2b0e249a7f7a30dde133907 ]

Patch series "ocfs2: deal with legacy signed name hash values", v2.

Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") turned on
-funsigned-char globally, which changed the result of two naked 'char'
loads in ocfs2 hashing code:

	str2hashbuf()            val = msg[i] + (val << 8);
	ocfs2_xattr_name_hash()  hash = (hash << 5) ^ (hash >> 27) ^ *name++;

A name byte >= 0x80 used to sign-extend and now zero-extends.  Both
results are written to disk, the first into the dx leaf when a directory
entry is indexed and the second into xe_name_hash when an xattr is
stored, so anything written by a pre-6.2 kernel is looked up under a
different hash and is no longer found.  readdir and listxattr still list
those names because neither of them hashes, which makes this look like
the filesystem losing entries rather than like a lookup bug.  Anderson
Ferneda reported it that way for directories with non-ASCII names [1].

Patches 1 and 3 do what ext4 did in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values"): look up with the current
unsigned hash, retry with the legacy signed one on a miss, and always
store new entries under the unsigned hash.  The retry is skipped when the
two hashes come out equal, so an ASCII name does not walk the index
twice.  Both hash functions now spell out the signedness instead of
leaving it to -funsigned-char, as commit 854f0912f813 ("ext4: make xattr
char unsignedness in hash explicit") did, so a backport to a kernel
without the flag still computes both variants correctly.

Patch 2 is a separate fix, placed before patch 3 so that every commit in
the series is correct on its own.  ocfs2_check_xattr_bucket_collision()
recomputes the hash of the name to decide whether splitting a full bucket
can make room for the entry being set.  That is right for a new entry and
wrong for one that already exists, since an update leaves xe_name_hash
alone.  Against a bucket holding legacy hashes the comparison does not
match, so the split goes ahead and cannot help: a bucket whose entries
all share one hash has no divide position.  How that ends depends on
where the unsigned hash sorts.  Below the legacy ones, the set fails with
-ENOSPC after growing the tree for nothing.  Above them, it lands in the
empty bucket the split just appended and stores a second copy of the
entry there while the original stays behind, so listxattr reports the
name twice.  Using the stored hash closes both.

Nothing retires a legacy hash at runtime.  Deleting or updating an entry
does not rewrite it, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion, so the
retry stays for as long as the legacy entries do.  Rebuilding the index
offline is what removes it for good.

This patch (of 3):

Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") set
-funsigned-char globally, which changed the result of the naked 'char'
load in str2hashbuf():

	val = msg[i] + (val << 8);

A name byte >= 0x80 used to sign-extend and now zero-extends, so
ocfs2_dx_dir_name_hash() computes a different hash pair for every name
containing one.  The pair is written into the dx leaf when the entry is
created, so an index built by an older kernel no longer matches and
ocfs2_dx_dir_search() returns -ENOENT for a name that readdir still
lists.

Search with the current unsigned hash and, on a miss, retry with the
legacy signed one, as ext4 does in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values").  New entries are always
indexed under the unsigned hash.  Skip the retry when the two hashes
are equal, so that a miss on an ASCII name does not walk the index
twice.

The retry costs a second walk of the dx tree, so a negative lookup of a
name containing a byte >= 0x80 does twice the work.  That is bounded and
worth it, and directories whose dx root is still inline pay nothing
extra, since there the retry only rescans the root block that is already
loaded.  Nothing retires it at runtime: a legacy entry keeps its legacy
hash, because neither deleting nor updating an entry rewrites the dx
hash, and the only code that rehashes existing dirents is
ocfs2_expand_inline_dir() on the inline to extent conversion.
Rebuilding the index offline is what removes the cost for good.

Also spell out the signedness in str2hashbuf() instead of leaving the
current hash to -funsigned-char, as commit 854f0912f813 ("ext4: make
xattr char unsignedness in hash explicit") did, so that both variants
stay correct if this is backported to a kernel without the flag.

Link: https://lore.kernel.org/20261009083002.2621201-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261009083002.2621201-2-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Anderson Ferneda <anderson.ferneda@braza.com.br>
Closes: https://lore.kernel.org/ocfs2-devel/CP5P284MB2780AC2C3C2AB2CF2B6CB7AFBE942@CP5P284MB2780.BRAP284.PROD.OUTLOOK.COM/
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 65 insertions(+), 11 deletions(-)

diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index fbfce8cd131aab..1dee6b8eaf2d02 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -221,7 +221,8 @@ static void TEA_transform(__u32 buf[4], __u32 const in[])
 	buf[1] += b1;
 }
 
-static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
+static void str2hashbuf(const char *msg, int len, __u32 *buf, int num,
+			bool legacy_signed)
 {
 	__u32	pad, val;
 	int	i;
@@ -235,7 +236,10 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
 	for (i = 0; i < len; i++) {
 		if ((i % 4) == 0)
 			val = pad;
-		val = msg[i] + (val << 8);
+		if (legacy_signed)
+			val = (signed char)msg[i] + (val << 8);
+		else
+			val = (unsigned char)msg[i] + (val << 8);
 		if ((i % 4) == 3) {
 			*buf++ = val;
 			val = pad;
@@ -248,8 +252,9 @@ static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
 		*buf++ = pad;
 }
 
-static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
-				   struct ocfs2_dx_hinfo *hinfo)
+static void __ocfs2_dx_dir_name_hash(struct inode *dir, const char *name,
+				     int len, struct ocfs2_dx_hinfo *hinfo,
+				     bool legacy_signed)
 {
 	struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
 	const char	*p;
@@ -279,7 +284,7 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
 
 	p = name;
 	while (len > 0) {
-		str2hashbuf(p, len, in, 4);
+		str2hashbuf(p, len, in, 4, legacy_signed);
 		TEA_transform(buf, in);
 		len -= 16;
 		p += 16;
@@ -290,6 +295,19 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
 	hinfo->minor_hash = buf[1];
 }
 
+static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len,
+				   struct ocfs2_dx_hinfo *hinfo)
+{
+	__ocfs2_dx_dir_name_hash(dir, name, len, hinfo, false);
+}
+
+static void ocfs2_dx_dir_name_hash_signed(struct inode *dir, const char *name,
+					  int len,
+					  struct ocfs2_dx_hinfo *hinfo)
+{
+	__ocfs2_dx_dir_name_hash(dir, name, len, hinfo, true);
+}
+
 /*
  * bh passed here can be an inode block or a dir data block, depending
  * on the inode inline data flag.
@@ -961,10 +979,10 @@ static int ocfs2_dx_dir_lookup(struct inode *inode,
 	return ret;
 }
 
-static int ocfs2_dx_dir_search(const char *name, int namelen,
-			       struct inode *dir,
-			       struct ocfs2_dx_root_block *dx_root,
-			       struct ocfs2_dir_lookup_result *res)
+static int __ocfs2_dx_dir_search(const char *name, int namelen,
+				 struct inode *dir,
+				 struct ocfs2_dx_root_block *dx_root,
+				 struct ocfs2_dir_lookup_result *res)
 {
 	int ret, i, found;
 	u64 phys;
@@ -977,8 +995,6 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
 	struct ocfs2_extent_list *dr_el;
 	struct ocfs2_dx_entry_list *entry_list;
 
-	ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
-
 	if (ocfs2_dx_root_inline(dx_root)) {
 		entry_list = &dx_root->dr_entries;
 		goto search;
@@ -1075,6 +1091,44 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
 	return ret;
 }
 
+static int ocfs2_dx_dir_search(const char *name, int namelen,
+			       struct inode *dir,
+			       struct ocfs2_dx_root_block *dx_root,
+			       struct ocfs2_dir_lookup_result *res)
+{
+	struct ocfs2_dx_hinfo legacy;
+	int ret;
+
+	ocfs2_dx_dir_name_hash(dir, name, namelen, &res->dl_hinfo);
+
+	ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+	if (ret != -ENOENT)
+		return ret;
+
+	/*
+	 * Nothing under the current hash.  The entry may have been indexed by
+	 * an older kernel, which sign-extended the name bytes when hashing.
+	 * New entries are always indexed under the unsigned hash, so only fall
+	 * back to the legacy signed one when it can actually differ: an ASCII
+	 * name hashes the same either way, and a genuine miss on one should
+	 * not have to walk the index twice.
+	 */
+	ocfs2_dx_dir_name_hash_signed(dir, name, namelen, &legacy);
+	if (legacy.major_hash == res->dl_hinfo.major_hash &&
+	    legacy.minor_hash == res->dl_hinfo.minor_hash)
+		return ret;
+
+	res->dl_hinfo = legacy;
+
+	ret = __ocfs2_dx_dir_search(name, namelen, dir, dx_root, res);
+	if (ret)
+		return ret;
+
+	pr_warn_once("ocfs2: directory index with signed name hash\n");
+
+	return 0;
+}
+
 static int ocfs2_find_entry_dx(const char *name, int namelen,
 			       struct inode *dir,
 			       struct ocfs2_dir_lookup_result *lookup)

From bd188a034bb18892ac97bff077f5e156f6096240 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Fri, 9 Oct 2026 16:30:01 +0800
Subject: [PATCH 1702/1982] ocfs2: use the stored hash when checking xattr
 bucket collision

[ Upstream commit e39baff18b85cf8956aee138d7944b6581e8ba36 ]

ocfs2_check_xattr_bucket_collision() decides whether splitting a full
bucket can make room for the entry being set by recomputing the hash of
the name:

	u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));

	if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
		return 0;

For a new entry that is the hash it will be stored under, so comparing it
is correct.  An existing entry keeps the hash it already has: an update
never rewrites xe_name_hash, since ocfs2_xa_add_entry() is the only
writer of that field for a real entry and ocfs2_xa_prepare_entry() calls
it only when loc->xl_entry is NULL.

An entry stored by a kernel that sign-extended the name bytes when
hashing can still be updated, because ocfs2_xattr_find_entry() searches
a non-indexed xattr block by memcmp on the name and never looks at
xe_name_hash.  Growing it past the space left in the block converts the
block into a tree, ocfs2_cp_xattr_block_to_bucket() fills the bucket in
stored hash order, and the update runs out of room in the bucket too.
The collision check then compares the unsigned hash against the legacy
hashes in the bucket and reports no collision.

ocfs2_xattr_set_entry_index_block() goes on to allocate a bucket that
ocfs2_divide_xattr_bucket() cannot fill: a bucket whose entries all share
one hash has no divide position, so all it does is append an empty bucket
with a sentinel hash one above the last entry's.

The re-search that follows depends on where the unsigned hash sorts.
Below the legacy ones, it comes back to the full bucket and the set fails
with -ENOSPC, having grown the tree for nothing.  Above them, it lands on
the new empty bucket, which ocfs2_xattr_bucket_find() handles explicitly
and ocfs2_find_xe_in_bucket() scans zero times, so the set stores a second
copy of the entry under the unsigned hash and returns success.  The
original stays in the full bucket, listxattr reports the name twice and
getxattr returns the new copy.

Pass the hash the entry is stored under instead: the stored one for an
existing entry, the unsigned one for a new entry.  A tree whose entries
are all stored under the unsigned hash sees no change, since there the
two are the same value.

Link: https://lore.kernel.org/20261009083002.2621201-3-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Anderson Ferneda <anderson.ferneda@braza.com.br>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index ab117ed2623e74..523d5ac597f414 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -5531,16 +5531,14 @@ static int ocfs2_rm_xattr_cluster(struct inode *inode,
 
 /*
  * check whether the xattr bucket is filled up with the same hash value.
- * If we want to insert the xattr with the same hash, return -ENOSPC.
- * If we want to insert a xattr with different hash value, go ahead
- * and ocfs2_divide_xattr_bucket will handle this.
+ * If the entry being set carries that same hash, return -ENOSPC, since
+ * ocfs2_divide_xattr_bucket() has no divide position to work with.
+ * Otherwise go ahead and ocfs2_divide_xattr_bucket() will handle this.
  */
-static int ocfs2_check_xattr_bucket_collision(struct inode *inode,
-					      struct ocfs2_xattr_bucket *bucket,
-					      const char *name)
+static int ocfs2_check_xattr_bucket_collision(struct ocfs2_xattr_bucket *bucket,
+					      u32 name_hash)
 {
 	struct ocfs2_xattr_header *xh = bucket_xh(bucket);
-	u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
 
 	if (name_hash != le32_to_cpu(xh->xh_entries[0].xe_name_hash))
 		return 0;
@@ -5609,6 +5607,7 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
 					     struct ocfs2_xattr_search *xs,
 					     struct ocfs2_xattr_set_ctxt *ctxt)
 {
+	u32 name_hash;
 	int ret;
 
 	trace_ocfs2_xattr_set_entry_index_block(xi->xi_name);
@@ -5628,10 +5627,18 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
 	 * the maximum number of collisions we will allow for then is
 	 * one bucket's worth, so check it here whether we need to
 	 * add a new bucket for the insert.
+	 *
+	 * An existing entry keeps the hash it was stored under, and that is
+	 * the hash a split has to work with.  A new entry is stored under the
+	 * unsigned one, which is what ocfs2_xa_add_entry() will write.
 	 */
-	ret = ocfs2_check_xattr_bucket_collision(inode,
-						 xs->bucket,
-						 xi->xi_name);
+	if (xs->not_found)
+		name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
+						  xi->xi_name_len);
+	else
+		name_hash = le32_to_cpu(xs->here->xe_name_hash);
+
+	ret = ocfs2_check_xattr_bucket_collision(xs->bucket, name_hash);
 	if (ret) {
 		mlog_errno(ret);
 		goto out;

From 9d74fa5c7b7db7f9594eb9842976c2656986d1e6 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Fri, 9 Oct 2026 16:30:02 +0800
Subject: [PATCH 1703/1982] ocfs2: deal with legacy signed xattr name hash
 values

[ Upstream commit 824d26d11448b4d4f19677bce27c7fe5e962f4c6 ]

Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") set
-funsigned-char globally, which changed the result of the naked 'char'
load in ocfs2_xattr_name_hash():

	hash = (hash << OCFS2_HASH_SHIFT) ^
	       (hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT)) ^
	       *name++;

A name byte >= 0x80 used to sign-extend and now zero-extends, so the
hash no longer matches the xe_name_hash an older kernel stored.  An
indexed xattr tree is searched by that hash alone, and both the bucket
binary search and the entry scan within it stop as soon as the wanted
hash falls below an entry's, so the entry is never reached: getxattr,
setxattr and removexattr return -ENODATA for a name that listxattr
still lists.

Search with the current unsigned hash and, on a miss, retry with the
legacy signed one, as ext4 does in commit f3bbac32475b2 ("ext4: deal
with legacy signed xattr name hash values").  New entries are always
stored under the unsigned hash.  Skip the retry when the two hashes are
equal, so that a miss on an ASCII name does not walk the tree twice.

A miss is not empty handed: ocfs2_xattr_bucket_find() leaves xs->bucket
holding the bucket a new entry would go into.  So after a double miss
drop it and search once more with the unsigned hash, otherwise a new
entry would be placed by its legacy hash and stored under its unsigned
one, breaking the ordering the search relies on.

Only indexed trees are affected; inline xattrs and non-indexed xattr
blocks compare names with memcmp and never look at the hash.

Also spell out the signedness instead of leaving the current hash to
-funsigned-char, as commit 854f0912f813 ("ext4: make xattr char
unsignedness in hash explicit") did, so that both variants stay correct
if this is backported to a kernel without the flag.

Link: https://lore.kernel.org/20261009083002.2621201-4-joseph.qi@linux.alibaba.com
Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Anderson Ferneda <anderson.ferneda@braza.com.br>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org> # 6.2+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 93 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 82 insertions(+), 11 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 523d5ac597f414..8013451927a83d 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -533,9 +533,10 @@ static inline const char *ocfs2_xattr_prefix(int name_index)
 	return handler ? xattr_prefix(handler) : NULL;
 }
 
-static u32 ocfs2_xattr_name_hash(struct inode *inode,
-				 const char *name,
-				 int name_len)
+static u32 __ocfs2_xattr_name_hash(struct inode *inode,
+				   const char *name,
+				   int name_len,
+				   bool legacy_signed)
 {
 	/* Get hash value of uuid from super block */
 	u32 hash = OCFS2_SB(inode->i_sb)->uuid_hash;
@@ -544,13 +545,30 @@ static u32 ocfs2_xattr_name_hash(struct inode *inode,
 	/* hash extended attribute name */
 	for (i = 0; i < name_len; i++) {
 		hash = (hash << OCFS2_HASH_SHIFT) ^
-		       (hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT)) ^
-		       *name++;
+		       (hash >> (8*sizeof(hash) - OCFS2_HASH_SHIFT));
+		if (legacy_signed)
+			hash ^= (signed char)name[i];
+		else
+			hash ^= (unsigned char)name[i];
 	}
 
 	return hash;
 }
 
+static u32 ocfs2_xattr_name_hash(struct inode *inode,
+				 const char *name,
+				 int name_len)
+{
+	return __ocfs2_xattr_name_hash(inode, name, name_len, false);
+}
+
+static u32 ocfs2_xattr_name_hash_signed(struct inode *inode,
+					const char *name,
+					int name_len)
+{
+	return __ocfs2_xattr_name_hash(inode, name, name_len, true);
+}
+
 static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
 {
 	return namevalue_size(name_len, value_len) +
@@ -3949,11 +3967,12 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
 	return ret;
 }
 
-static int ocfs2_xattr_index_block_find(struct inode *inode,
-					struct buffer_head *root_bh,
-					int name_index,
-					const char *name,
-					struct ocfs2_xattr_search *xs)
+static int __ocfs2_xattr_index_block_find(struct inode *inode,
+					  struct buffer_head *root_bh,
+					  int name_index,
+					  const char *name,
+					  u32 name_hash,
+					  struct ocfs2_xattr_search *xs)
 {
 	int ret;
 	struct ocfs2_xattr_block *xb =
@@ -3962,7 +3981,6 @@ static int ocfs2_xattr_index_block_find(struct inode *inode,
 	struct ocfs2_extent_list *el = &xb_root->xt_list;
 	u64 p_blkno = 0;
 	u32 first_hash, num_clusters = 0;
-	u32 name_hash = ocfs2_xattr_name_hash(inode, name, strlen(name));
 
 	if (le16_to_cpu(el->l_next_free_rec) == 0)
 		return -ENODATA;
@@ -3993,6 +4011,59 @@ static int ocfs2_xattr_index_block_find(struct inode *inode,
 	return ret;
 }
 
+static int ocfs2_xattr_index_block_find(struct inode *inode,
+					struct buffer_head *root_bh,
+					int name_index,
+					const char *name,
+					struct ocfs2_xattr_search *xs)
+{
+	u32 name_hash, legacy_hash;
+	int name_len = strlen(name);
+	int ret;
+
+	name_hash = ocfs2_xattr_name_hash(inode, name, name_len);
+
+	ret = __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+					     name_hash, xs);
+	if (ret != -ENODATA)
+		return ret;
+
+	/*
+	 * Nothing under the current hash.  The entry may have been stored by
+	 * an older kernel, which sign-extended the name bytes when hashing.
+	 * Skip the retry when the two hashes are equal, so that a name made
+	 * only of ASCII does not have to walk the tree twice.
+	 */
+	legacy_hash = ocfs2_xattr_name_hash_signed(inode, name, name_len);
+	if (legacy_hash == name_hash)
+		return ret;
+
+	/*
+	 * A miss still leaves xs->bucket holding the bucket a new entry would
+	 * be inserted into, so drop it before searching again.
+	 */
+	ocfs2_xattr_bucket_relse(xs->bucket);
+
+	ret = __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+					     legacy_hash, xs);
+	if (!ret) {
+		pr_warn_once("ocfs2: xattr tree with signed name hash\n");
+		return ret;
+	}
+	if (ret != -ENODATA)
+		return ret;
+
+	/*
+	 * Not under either hash.  Restore the unsigned placement, since that
+	 * is where a new entry is stored: leaving the bucket where the legacy
+	 * hash put it would break the ordering the search relies on.
+	 */
+	ocfs2_xattr_bucket_relse(xs->bucket);
+
+	return __ocfs2_xattr_index_block_find(inode, root_bh, name_index, name,
+					      name_hash, xs);
+}
+
 static int ocfs2_iterate_xattr_buckets(struct inode *inode,
 				       u64 blkno,
 				       u32 clusters,

From ff7cf939ebe93be3c42873f62dcbd34255d992de Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Fri, 16 Oct 2026 00:58:38 +0800
Subject: [PATCH 1704/1982] ocfs2/cluster: initialize heartbeat regions before
 publishing them

[ Upstream commit c5b7a30a5172317e1e3cba61d8c9f9c588c497bb ]

A region on o2hb_all_regions must have an initialized config item and
name. o2hb_heartbeat_group_make_item() currently links the zeroed region
under o2hb_live_lock, drops the lock, and only then initializes hr_item.
The lock therefore protects the list without protecting initialization
from readers of the published item.

With global heartbeat enabled, a DLM_QUERY_REGION from the current
joining node can pass the existing-domain and protocol checks while a
configfs mkdir creates another region. The DLM locks are not taken by
the constructor, and the network worker does not take the configfs
subsystem mutex. The following ordering is possible:

  Configfs mkdir                     O2net receive worker
  --------------                     --------------------
  Allocate reg
  Lock o2hb_live_lock
  Link into o2hb_all_regions
  Unlock o2hb_live_lock
                                     dlm_query_region_handler()
                                       dlm_match_regions()
                                         o2hb_get_all_regions()
                                           Lock o2hb_live_lock
                                           Copy 32 bytes from NULL name
                                           Unlock o2hb_live_lock
  config_item_init_type_name()

The query thus dereferences NULL. Initialize hr_item before linking the
region so the existing list lock also orders name initialization before
any reader. Reject a failed name allocation, since the initialization
helper does not propagate that error.

Use config_item_put() on initialized constructor failures to release the
name and respect references retained by o2hb_region_pin(). Initialize
the list heads, mutex and delayed works needed by o2hb_region_release()
before any such put, and leave the list node self-linked after rollback.
Keep the existing handler drain before removing a failed published item.

KASAN report as below:

    ==================================================================
    BUG: KASAN: null-ptr-deref in o2hb_get_all_regions+0xbb/0x1f0
    Read of size 32 at addr 0000000000000000 by task kworker/u16:1/14

    CPU: 2 UID: 0 PID: 14 Comm: kworker/u16:1 Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Workqueue: o2net o2net_rx_until_empty
    Call Trace:
     <TASK>
     dump_stack_lvl+0x93/0xd0
     kasan_report+0xe0/0x110
     ? o2hb_get_all_regions+0xbb/0x1f0
     kasan_check_range+0x105/0x1b0
     __asan_memcpy+0x23/0x60
     o2hb_get_all_regions+0xbb/0x1f0
     dlm_query_region_handler+0x4c2/0xc20
     ? __pfx_dlm_query_region_handler+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? trace_hardirqs_on+0x18/0x160
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? kvm_clock_get_cycles+0x31/0x60
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_dlm_query_region_handler+0x10/0x10
     o2net_rx_until_empty+0x1a50/0x3200
     ? reacquire_held_locks+0xdd/0x200
     ? __pfx_o2net_rx_until_empty+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? process_one_work+0x935/0x1b40
     ? process_one_work+0x834/0x1b40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? lock_release+0xc8/0x290
     ? srso_alias_return_thunk+0x5/0xfbef5
     process_one_work+0x9a8/0x1b40
     ? __pfx_process_one_work+0x10/0x10
     ? lock_acquire+0x190/0x300
     ? lock_is_held_type+0x8f/0x100
     ? srso_alias_return_thunk+0x5/0xfbef5
     worker_thread+0x65c/0xe40
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __kthread_parkme+0x177/0x220
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_worker_thread+0x10/0x10
     kthread+0x351/0x460
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x659/0x940
     ? __pfx_ret_from_fork+0x10/0x10
     ? srso_alias_return_thunk+0x5/0xfbef5
     ? __switch_to+0x74f/0xf70
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    ==================================================================

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0079-v5-f931a29339cadc0a2a70@gmail.com
Fixes: 536f0741f324 ("ocfs2/cluster: Track number of global heartbeat regions")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Yufan Chen <ericterminal@gmail.com>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Kees Cook <kees@kernel.org>
Cc: Karl Mehltretter <kmehltretter@gmail.com>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/cluster/heartbeat.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 61e5eb0090d392..0888c44f677c19 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -2124,6 +2124,18 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
 	}
 	reg->hr_node_num = O2NM_MAX_NODES;
 
+	INIT_LIST_HEAD(&reg->hr_all_item);
+	mutex_init(&reg->hr_arming_mutex);
+	reg->hr_stopping = true;
+	INIT_DELAYED_WORK(&reg->hr_write_timeout_work, o2hb_write_timeout);
+	INIT_DELAYED_WORK(&reg->hr_nego_timeout_work, o2hb_nego_timeout);
+	INIT_LIST_HEAD(&reg->hr_handler_list);
+	config_item_init_type_name(&reg->hr_item, name, &o2hb_region_type);
+	if (!config_item_name(&reg->hr_item)) {
+		ret = -ENOMEM;
+		goto put_item;
+	}
+
 	spin_lock(&o2hb_live_lock);
 	reg->hr_region_num = 0;
 	if (o2hb_global_heartbeat_active()) {
@@ -2132,26 +2144,19 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
 		if (reg->hr_region_num >= O2NM_MAX_REGIONS) {
 			spin_unlock(&o2hb_live_lock);
 			ret = -EFBIG;
-			goto free;
+			goto put_item;
 		}
 		set_bit(reg->hr_region_num, o2hb_region_bitmap);
 	}
 	list_add_tail(&reg->hr_all_item, &o2hb_all_regions);
 	spin_unlock(&o2hb_live_lock);
 
-	config_item_init_type_name(&reg->hr_item, name, &o2hb_region_type);
-
 	/* this is the same way to generate msg key as dlm, for local heartbeat,
 	 * name is also the same, so make initial crc value different to avoid
 	 * message key conflict.
 	 */
 	reg->hr_key = crc32_le(reg->hr_region_num + O2NM_MAX_REGIONS,
 		name, strlen(name));
-	mutex_init(&reg->hr_arming_mutex);
-	reg->hr_stopping = true;
-	INIT_DELAYED_WORK(&reg->hr_write_timeout_work, o2hb_write_timeout);
-	INIT_DELAYED_WORK(&reg->hr_nego_timeout_work, o2hb_nego_timeout);
-	INIT_LIST_HEAD(&reg->hr_handler_list);
 	ret = o2net_register_handler(O2HB_NEGO_TIMEOUT_MSG, reg->hr_key,
 			sizeof(struct o2hb_nego_msg),
 			o2hb_nego_timeout_handler,
@@ -2174,10 +2179,13 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
 	o2net_unregister_and_flush_handler_list(&reg->hr_handler_list);
 remove_item:
 	spin_lock(&o2hb_live_lock);
-	list_del(&reg->hr_all_item);
+	list_del_init(&reg->hr_all_item);
 	if (o2hb_global_heartbeat_active())
 		clear_bit(reg->hr_region_num, o2hb_region_bitmap);
 	spin_unlock(&o2hb_live_lock);
+put_item:
+	config_item_put(&reg->hr_item);
+	return ERR_PTR(ret);
 free:
 	kfree(reg);
 	return ERR_PTR(ret);

From ade5975527b7fd33b6bc4da6c84b378b3d8bfbd9 Mon Sep 17 00:00:00 2001
From: Michael Kelley <mhkelley58@gmail.com>
Date: Mon, 12 Oct 2026 18:43:54 -0700
Subject: [PATCH 1705/1982] Documentation: hyperv: Update documentation for
 sending VMBus packets

[ Upstream commit 6a3d77a0a8cf69cf3d234305e6711729eb5d10c4 ]

The functions for sending VMBus packets have changed.
vmbus_sendpacket_mpb_desc() can target multiple ranges, and
vmbus_sendpacket_pagebuffer() has been removed. vmbus_sendpacket_getid()
has been added. Update the documentation accordingly.

Fixes: 45a442fe369e ("Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/virt/hyperv/vmbus.rst | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/Documentation/virt/hyperv/vmbus.rst b/Documentation/virt/hyperv/vmbus.rst
index 654bb484997249..c546e821ce6b2b 100644
--- a/Documentation/virt/hyperv/vmbus.rst
+++ b/Documentation/virt/hyperv/vmbus.rst
@@ -141,14 +141,15 @@ Three functions exist to send VMBus channel messages:
 
 1. vmbus_sendpacket():  Control-only messages and messages with
    embedded data -- no GPAs
-2. vmbus_sendpacket_pagebuffer(): Message with list of GPAs
-   identifying data to transfer.  An offset and length is
-   associated with each GPA so that multiple discontinuous areas
-   of guest memory can be targeted.
-3. vmbus_sendpacket_mpb_desc(): Message with list of GPAs
-   identifying data to transfer.  A single offset and length is
-   associated with a list of GPAs.  The GPAs must describe a
-   single logical area of guest memory to be targeted.
+2. vmbus_sendpacket_getid(): Similar to vmbus_sendpacket() but returns
+   a transaction ID that is matched against a reply from the Hyper-V
+   host. Useful when the struct completion (or other rendezvous data)
+   must reside on the caller's stack. By invalidating the transaction
+   ID before exiting the function due to a timeout or other error, a
+   late arriving interrupt is assured to not trash the stack.
+3. vmbus_sendpacket_mpb_desc(): Message with one or more data ranges
+   to target. Each range consists of a single offset and length plus
+   a list of GPAs that describe a logical area of guest memory.
 
 Historically, Linux guests have trusted Hyper-V to send well-formed
 and valid messages, and Linux drivers for synthetic devices did not

From d84a3fde13fb8ea01cae89a6c5292e74a34ecbef Mon Sep 17 00:00:00 2001
From: Bartu Alev <bartualev@gmail.com>
Date: Sat, 10 Oct 2026 13:15:58 +0300
Subject: [PATCH 1706/1982] platform/x86: asus-wmi: fix TUF keyboard power
 state shutdown naming
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3d9a175707eeb15a2d577af1e669b98e0236719b ]

The fourth state flag of kbd_rgb_state_index is named "keyboard" and has
long been treated as having no effect.  In hardware the flag, BIT(7) of
the payload sent to the TUF RGB state device, gates whether the keyboard
backlight stays lit while the machine powers off: with the bit set the
keyboard lights up white during the ACPI S5 sequence, with the bit clear
the machine powers off dark.  Verified by A/B testing both values on a
TUF Gaming A15 (FA507NV).

Rename the fourth field and its index entry from "keyboard" to
"shutdown".  The write format is unchanged, the value is still
positional, and the diff is two variable names and one string, so it
backports cleanly.

Fixes: 61f64515299e ("platform/x86: asus-wmi: Implement TUF laptop keyboard power states")
Cc: stable@vger.kernel.org
Signed-off-by: Bartu Alev <bartualev@gmail.com>
Link: https://patch.msgid.link/20261010101601.888709-3-bartualev@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-wmi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 486c12b232d146..c8cc47df9294e8 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -998,10 +998,10 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
 				 struct device_attribute *attr,
 				 const char *buf, size_t count)
 {
-	u32 flags, cmd, boot, awake, sleep, keyboard;
+	u32 flags, cmd, boot, awake, sleep, shutdown;
 	int err;
 
-	if (sscanf(buf, "%d %d %d %d %d", &cmd, &boot, &awake, &sleep, &keyboard) != 5)
+	if (sscanf(buf, "%d %d %d %d %d", &cmd, &boot, &awake, &sleep, &shutdown) != 5)
 		return -EINVAL;
 
 	if (cmd)
@@ -1014,7 +1014,7 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
 		flags |= BIT(3);
 	if (sleep)
 		flags |= BIT(5);
-	if (keyboard)
+	if (shutdown)
 		flags |= BIT(7);
 
 	/* 0xbd is the required default arg0 for the method. Nothing happens otherwise */
@@ -1028,7 +1028,7 @@ static ssize_t kbd_rgb_state_store(struct device *dev,
 static DEVICE_ATTR_WO(kbd_rgb_state);
 
 static DEVICE_STRING_ATTR_RO(kbd_rgb_state_index, 0444,
-			     "cmd boot awake sleep keyboard");
+			     "cmd boot awake sleep shutdown");
 
 static struct attribute *kbd_rgb_state_attrs[] = {
 	&dev_attr_kbd_rgb_state.attr,

From 7ad9304dbef135174734028a1637c776fcabe1a9 Mon Sep 17 00:00:00 2001
From: Julian Sun <sunjunchao@bytedance.com>
Date: Fri, 16 Oct 2026 19:52:29 +0800
Subject: [PATCH 1707/1982] writeback: reset dirtied_when when switching wbs

[ Upstream commit 13b9a606dd0a6cf9bac12894c97b9546d22a7425 ]

When switching a dirty inode to another wb, inode_do_switch_wbs() puts
it at the newest end of the target b_dirty list instead of searching
for its sorted position. This requires updating dirtied_when, which
move_expired_inodes() uses to decide where to stop scanning.

However, the switch updates dirtied_time_when instead. This leaves
b_dirty out of order and can make the scan stop before reaching older
inodes. It also resets the lazytime expiration timestamp, potentially
delaying timestamp writeback.

Update dirtied_when instead, preserving both the constant-time insertion
and the lazytime expiration timestamp. Correct the field name in the
comment and document the distinction between the two inode timestamps.

Fixes: 9a6ebbdbd412 ("writeback: Avoid excessively long inode switching times")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Link: https://patch.msgid.link/20261016115230.3640770-2-sunjunchao@bytedance.com
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c  | 6 +++---
 include/linux/fs.h | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 094d2872881d3b..b74a7387bea747 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -454,12 +454,12 @@ static bool inode_do_switch_wbs(struct inode *inode,
 		if (inode->i_state & I_DIRTY_ALL) {
 			/*
 			 * We need to keep b_dirty list sorted by
-			 * dirtied_time_when. However properly sorting the
+			 * dirtied_when. However properly sorting the
 			 * inode in the list gets too expensive when switching
 			 * many inodes. So just attach inode at the end of the
-			 * dirty list and clobber the dirtied_time_when.
+			 * dirty list and clobber the dirtied_when.
 			 */
-			inode->dirtied_time_when = jiffies;
+			inode->dirtied_when = jiffies;
 			inode_io_list_move_locked(inode, new_wb,
 						  &new_wb->b_dirty);
 		} else {
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 55ecd9d26b4fbb..349b7fc57db36d 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -847,7 +847,9 @@ struct inode {
 	/* 32-bit hole */
 	struct rw_semaphore	i_rwsem;
 
-	unsigned long		dirtied_when;	/* jiffies of first dirtying */
+	/* Timestamp for writeback list ordering and age checks (jiffies). */
+	unsigned long		dirtied_when;
+	/* Start time for deciding when lazytime updates need writeback (jiffies). */
 	unsigned long		dirtied_time_when;
 
 	struct hlist_node	i_hash;

From 0a4c515925cc1130821e14de528b8c2792ada94f Mon Sep 17 00:00:00 2001
From: Julian Sun <sunjunchao@bytedance.com>
Date: Fri, 16 Oct 2026 19:52:30 +0800
Subject: [PATCH 1708/1982] writeback: clear old wb dirty state after inode
 switches

[ Upstream commit a396fe9f74ea367ae3fab2dcb70b24e83db9f0cb ]

Switching an inode to another wb updates the target wb's dirty-I/O state,
but no longer checks whether the source wb's dirty-I/O lists became empty.
The check was lost when inode_io_list_del_locked(inode, old_wb) was
removed to support tracking clean attached inodes.

If the last dirty inode is moved, WB_has_dirty_io remains set on the old
wb and its bandwidth contribution remains in bdi->tot_write_bandwidth.
This can keep an empty wb scheduled for periodic writeback and overstate
the total bandwidth used to distribute writeback work.

Call wb_io_lists_depopulated() on the old wb after the batch of inode
switches, while its list_lock is still held. This clears the flag and
removes the bandwidth contribution if its dirty-I/O lists are empty.

Fixes: f3b6a6df38aa ("writeback, cgroup: keep list of inodes attached to bdi_writeback")
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
Link: https://patch.msgid.link/20261016115230.3640770-3-sunjunchao@bytedance.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b74a7387bea747..3025fc7ddfe84e 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -534,6 +534,7 @@ static void process_inode_switch_wbs(struct bdi_writeback *new_wb,
 		}
 	}
 
+	wb_io_lists_depopulated(old_wb);
 	spin_unlock(&new_wb->list_lock);
 	spin_unlock(&old_wb->list_lock);
 

From 5ec6159e99f1d06b511aff863d830e0d917926ab Mon Sep 17 00:00:00 2001
From: Henrik Enquist <henrik.enquist@gmail.com>
Date: Wed, 21 Oct 2026 09:46:45 +0200
Subject: [PATCH 1709/1982] ALSA: aloop: Update the PCM Slave controls for a
 matching playback

[ Upstream commit c3bde2beacbcb40790f0e3c3f909f9e16bbced9c ]

The "PCM Slave" format, rate, channels and access controls report the
parameters of the playback side of a cable. loopback_check_format()
updates them when a playback starts, but returns early when a capture
is open and its parameters match. The controls then keep the module
defaults, or the parameters of an earlier stream.

A playback that joins an open capture with the same parameters is the
normal case without notify, where it is constrained to the capture's
parameters, and also with notify whenever the player happens to use
them. An application that reads the controls to find the playback's
parameters, for example to reopen the capture side at the right rate
after a restart, then gets the wrong values.

Only skip the capture stop when the parameters match, and update the
controls in every case. A value event is still sent only for a control
whose value changes.

Reproducer:
  arecord -D hw:Loopback,1,0 -r 44100 -f S16_LE -c 2 /dev/null &
  aplay -D hw:Loopback,0,0 -t raw -r 44100 -f S16_LE -c 2 /dev/zero &
  amixer -c Loopback cget "iface=PCM,name='PCM Slave Rate',device=1"
Before: the control reports 48000, the module default.
After: it reports 44100.

Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: stable@vger.kernel.org
Signed-off-by: Henrik Enquist <henrik.enquist@gmail.com>
Link: https://patch.msgid.link/20261021-aloop-slave-controls-v1-1-62297727177f@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/drivers/aloop.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index eefc41f6284627..fd8d6b474e4654 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -365,11 +365,14 @@ static int loopback_check_format(struct loopback_cable *cable, int stream)
 			runtime->channels != cruntime->channels ||
 			is_access_interleaved(runtime->access) !=
 			is_access_interleaved(cruntime->access);
-			if (!check)
-				return 0;
-			if (stream == SNDRV_PCM_STREAM_CAPTURE)
+			/*
+			 * Matching params also go on to the update below, so that
+			 * the setup controls follow a playback that joins an open
+			 * capture.
+			 */
+			if (check && stream == SNDRV_PCM_STREAM_CAPTURE)
 				return -EIO;
-			else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) {
+			else if (check && cruntime->state == SNDRV_PCM_STATE_RUNNING) {
 				/* close must not free the peer runtime below */
 				atomic_inc(&cable->stop_count);
 				stop_capture = true;

From e204d8b84f97b732f6cf0b3b78ccfff8016d78b0 Mon Sep 17 00:00:00 2001
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
Date: Fri, 9 Oct 2026 12:02:48 +0800
Subject: [PATCH 1710/1982] sh: maple: Use the matching IRQ cookie when
 invoking free_irq()

[ Upstream commit e3ef44e77b40e3cecfb34757ff3c15ecceea0309 ]

The Maple DMA and VBLANK handlers are registered with
&maple_unsupported_device as their dev_id. Passing NULL to free_irq()
cannot find either action, so the handlers remain registered and the
IRQ core warns.

Use the same cookie when freeing both handlers on the error paths.

Fixes: b3c69e248176 ("maple: more robust device detection.")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-By: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/sh/maple/maple.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 6dc0549f790053..3d3302c900caf1 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -863,10 +863,10 @@ static int __init maple_bus_init(void)
 	kmem_cache_destroy(maple_queue_cache);
 
 cleanup_bothirqs:
-	free_irq(HW_EVENT_VSYNC, 0);
+	free_irq(HW_EVENT_VSYNC, &maple_unsupported_device);
 
 cleanup_irq:
-	free_irq(HW_EVENT_MAPLE_DMA, 0);
+	free_irq(HW_EVENT_MAPLE_DMA, &maple_unsupported_device);
 
 cleanup_dma:
 	free_pages((unsigned long) maple_sendbuf, MAPLE_DMA_PAGES);

From 62518ed062b5a93e091b43cdfa05b9d9796ac184 Mon Sep 17 00:00:00 2001
From: Yu Zhang <yuz08559@gmail.com>
Date: Tue, 20 Oct 2026 12:50:47 +1000
Subject: [PATCH 1711/1982] nvmet: take subsys->lock while force-reconnecting
 in nvmet_subsys_attr_qid_max_store()

[ Upstream commit 9f426f14051181e251590783e68ce589a63e2b1c ]

nvmet_subsys_attr_qid_max_store() sets subsys->max_qid and then walks
subsys->ctrls to force every controller to reconnect, but it holds only
nvmet_config_sem (for write).  subsys->ctrls is protected by subsys->lock:
nvmet_alloc_ctrl() adds an entry under subsys->lock, and nvmet_ctrl_free()
removes it under subsys->lock with list_del() + kfree() (not kfree_rcu).
The free path takes no nvmet_config_sem, so the two locks are independent.

A controller teardown (host disconnect, keep-alive timeout or fatal error
-> nvmet_sq_destroy() -> nvmet_ctrl_put() -> nvmet_ctrl_free()) can
therefore list_del() an entry while qid_max_store() is iterating the list,
corrupting the walk.

KASAN, concurrent "echo 128 > .../subsystems/<nqn>/attr_qid_max" racing
nvme-loop controllers connecting and disconnecting, panics in seconds:

  BUG: KASAN: null-ptr-deref in nvmet_subsys_attr_qid_max_store+0x10d/0x1b0
  Read of size 8 at addr 0000000000000090
  Call Trace:
   nvmet_subsys_attr_qid_max_store+0x10d/0x1b0
   configfs_write_iter+0x1a7/0x250
   vfs_write+0x5df/0x940
   ksys_write+0xfd/0x1e0

(also seen as a general-protection fault dereferencing a LIST_POISON
pointer at the same instruction.)

Take subsys->lock around the list_for_each_entry() loop, matching every
other subsys->ctrls accessor.  ->delete_ctrl() only queues asynchronous
controller teardown, so it does not re-enter subsys->lock under the loop.

Fixes: 3e980f5995e0 ("nvmet: expose max queues to configfs")
Cc: stable@vger.kernel.org
Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Yu Zhang <yuz08559@gmail.com>
Tested-by: Yu Zhang <yuz08559@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/configfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index f6ac42eaac0e0a..e2032b58191c5d 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1662,8 +1662,10 @@ static ssize_t nvmet_subsys_attr_qid_max_store(struct config_item *item,
 	subsys->max_qid = qid_max;
 
 	/* Force reconnect */
+	mutex_lock(&subsys->lock);
 	list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
 		ctrl->ops->delete_ctrl(ctrl);
+	mutex_unlock(&subsys->lock);
 	up_write(&nvmet_config_sem);
 
 	return cnt;

From 7511c1c4baa944dd73f724566bf78abf15944502 Mon Sep 17 00:00:00 2001
From: Liu Chao <liuc63@xiaopeng.com>
Date: Tue, 20 Oct 2026 17:42:49 +0800
Subject: [PATCH 1712/1982] net: wwan: iosm: validate msg_head before indexing
 msg_ring

[ Upstream commit 46cbf85155e5451b6682ea0c17bc62ec564aec36 ]

ipc_protocol_free_msg_get() reads msg_head from shared memory and
uses it directly as an index into msg_ring[]. If the head is out
of range, the subsequent memset() writes beyond the message ring.

Validate head against IPC_MEM_MSG_ENTRIES before using it as an
index. The ring is a circular buffer, so a value outside the valid
range indicates a corrupted head pointer; report the error and fail
the allocation instead of writing out of bounds.

Fixes: 64516f633bfd ("net: iosm: protocol operations")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
index 4627847c6daab2..455b3b6f09917e 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
@@ -14,6 +14,11 @@ ipc_protocol_free_msg_get(struct iosm_protocol *ipc_protocol, int *index)
 	u32 new_head = (head + 1) % IPC_MEM_MSG_ENTRIES;
 	union ipc_mem_msg_entry *msg;
 
+	if (head >= IPC_MEM_MSG_ENTRIES) {
+		dev_err(ipc_protocol->dev, "invalid message head %u", head);
+		return NULL;
+	}
+
 	if (new_head == le32_to_cpu(ipc_protocol->p_ap_shm->msg_tail)) {
 		dev_err(ipc_protocol->dev, "message ring is full");
 		return NULL;

From 3402ea1ee81cb2cfa61184d6eaffd1e9743c754c Mon Sep 17 00:00:00 2001
From: Henry Martin <bsdhenrymartin@gmail.com>
Date: Mon, 19 Oct 2026 19:58:59 +0800
Subject: [PATCH 1713/1982] tipc: fix broadcast sender hang on last acker
 departure

[ Upstream commit f4377bf85887f57b59abb5479f7660a81ffe4449 ]

TIPC group broadcast senders are blocked while a replicast still has
outstanding member acks: tipc_group_bc_cong() returns true as long as
grp->bc_ackers is non-zero, and clears *grp->open, which is what
tipc_poll() uses to report EPOLLOUT (via tsk->group_is_open).

When the last outstanding acker departs before acking,
tipc_group_delete_member() decrements grp->bc_ackers to zero but
never restores *grp->open.  As a result poll(EPOLLOUT) never fires
again.  A writer blocked in sendmsg() is only released if some other
wakeup happens after the deletion: with TIPC_GROUP_MEMBER_EVTS the
leave event delivery calls sk_data_ready() and wakes it, but without
member events nothing does and it sleeps indefinitely, since the
default send timeout is MAX_SCHEDULE_TIMEOUT.

Commit 99cc2a62e07a ("tipc: reject invalid and unexpected
GRP_ACK_MSG to prevent bc_ackers underflow") already calls this out
in its changelog as a pre-existing issue.

Restore the open state exactly on the 1->0 transition in the delete
path, mirroring the GRP_ACK_MSG completion path, and invoke
sk->sk_write_space() from tipc_sk_filter_rcv() when the group just
became writable again.

Also make the ack accounting precise.  The delete path used to test
less(m->bc_acked, grp->bc_snd_nxt - 1), which also matches members
that were never counted for the current replicast (JOINING/LEAVING
members keep a stale bc_acked), and the GRP_ACK_MSG handler accepted
an ack from any member whose bc_acked differed from the expected
value.  Either could zero bc_ackers on behalf of a member that owes
nothing and silently void an ack still owed by a real acker.  Track
whether a member owes an ack for the current replicast in a new
per-member bc_pending flag, set when the member is counted and
cleared when its ack arrives, and use it both to accept an ack and
to decide on deletion.  bc_acked has no remaining user and is
removed.  Suggested by Tung Quang Nguyen.

This issue was discovered by Tencent CodeBuddy Security.

Cc: stable@vger.kernel.org
Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20261019115859.3471295-1-bsdhenrymartin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/group.c  | 19 ++++++++++---------
 net/tipc/socket.c | 12 +++++++++++-
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/net/tipc/group.c b/net/tipc/group.c
index 0da7b271339499..a9ce1c7018b6c9 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -74,7 +74,7 @@ struct tipc_member {
 	u16 window;
 	u16 bc_rcv_nxt;
 	u16 bc_syncpt;
-	u16 bc_acked;
+	bool bc_pending;
 };
 
 struct tipc_group {
@@ -316,7 +316,6 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
 	m->node = node;
 	m->port = port;
 	m->instance = instance;
-	m->bc_acked = grp->bc_snd_nxt - 1;
 	ret = tipc_group_add_to_tree(grp, m);
 	if (ret < 0) {
 		kfree(m);
@@ -340,9 +339,12 @@ static void tipc_group_delete_member(struct tipc_group *grp,
 	rb_erase(&m->tree_node, &grp->members);
 	grp->member_cnt--;
 
-	/* Check if we were waiting for replicast ack from this member */
-	if (grp->bc_ackers && less(m->bc_acked, grp->bc_snd_nxt - 1))
-		grp->bc_ackers--;
+	/* If this member owed an ack for the current replicast and it
+	 * was the last one, restore the open state so blocked broadcast
+	 * senders can proceed.
+	 */
+	if (grp->bc_ackers && m->bc_pending && !--grp->bc_ackers)
+		*grp->open = true;
 
 	list_del_init(&m->list);
 	list_del_init(&m->small_win);
@@ -394,7 +396,6 @@ void tipc_group_update_member(struct tipc_member *m, int len)
 
 void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
 {
-	u16 prev = grp->bc_snd_nxt - 1;
 	struct tipc_member *m;
 	struct rb_node *n;
 	u16 ackers = 0;
@@ -403,8 +404,8 @@ void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
 		m = container_of(n, struct tipc_member, tree_node);
 		if (tipc_group_is_receiver(m)) {
 			tipc_group_update_member(m, len);
-			m->bc_acked = prev;
 			ackers++;
+			m->bc_pending = ack;
 		}
 	}
 
@@ -800,9 +801,9 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
 		if (!m || !grp->bc_ackers)
 			return;
 		acked = msg_grp_bc_acked(hdr);
-		if (acked != grp->bc_snd_nxt || m->bc_acked == acked)
+		if (acked != grp->bc_snd_nxt || !m->bc_pending)
 			return;
-		m->bc_acked = acked;
+		m->bc_pending = false;
 		if (--grp->bc_ackers)
 			return;
 		list_del_init(&m->small_win);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index af14b50933f5c8..4780264a8a491f 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2355,8 +2355,18 @@ static void tipc_sk_filter_rcv(struct sock *sk, struct sk_buff *skb,
 	if (unlikely(!msg_isdata(hdr)))
 		tipc_sk_proto_rcv(sk, &inputq, xmitq);
 
-	if (unlikely(grp))
+	if (unlikely(grp)) {
+		bool was_open = tsk->group_is_open;
+
 		tipc_group_filter_msg(grp, &inputq, xmitq);
+		/* A departing member may have held the last outstanding
+		 * replicast ack, which can restore the open state inside
+		 * tipc_group_filter_msg(); wake up senders blocked in
+		 * poll()/write() if the group just became writable.
+		 */
+		if (!was_open && tsk->group_is_open)
+			sk->sk_write_space(sk);
+	}
 
 	if (unlikely(!grp) && mtyp == TIPC_MCAST_MSG)
 		tipc_mcast_filter_msg(net, &tsk->mc_method.deferredq, &inputq);

From d14b8b4bad5c44b90fbcb78d21ceb9d18b528eef Mon Sep 17 00:00:00 2001
From: Chuck Lever <cel@kernel.org>
Date: Thu, 8 Oct 2026 10:09:03 -0400
Subject: [PATCH 1714/1982] exportfs: Release the get_name() directory file
 synchronously

[ Upstream commit 49184daab01674ca400cbef58ee101dba6dbbb9d ]

get_name() opens the parent directory with dentry_open() and
releases it with fput(). From a kernel thread, fput() defers the
final __fput() to the delayed_fput work item. NFSD threads are
kernel threads, and NFSD reaches get_name() through
exportfs_decode_fh() whenever a file handle's dentry is not
connected to the root.

On a filesystem with more directories than the dcache retains,
nearly every READDIRPLUS needs a reconnect. The deferred releases
arrive faster than the work item retires them, and each pending
file pins the directory's readdir state. On ext4 that state is the
htree fname cache for the last leaf block read. A 64-thread NFSv3
server under a parallel tree walk showed unreclaimable slab growing
by about 90 MB per second, and the same workload on a 5.15 kernel
ended in a global OOM.

Commit 5ff318f645eb ("nfsd: use __fput_sync() to avoid delayed
closing of files.") stopped NFSD's own closes from feeding the
delayed_fput queue but did not cover the exportfs reconnect path.

Release the file with __fput_sync(). get_name() opened the file
itself, read-only, on a directory, so __fput() involves nothing
that could wait on the caller.

Note for LTS backports: Kernels before v6.6 need the __fput_sync()
call guarded by current->flags & PF_KTHREAD, with a plain fput()
otherwise.

Fixes: 4a9d4b024a31 ("switch fput to task_work_add")
Cc: stable@vger.kernel.org # see above, needs adjustments for < v6.2
Reported-by: Danny Pidutti <danny_pidutti@hotmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/DS4PR04MB9846BA3C16BC5ACED8B589228D952@DS4PR04MB9846.namprd04.prod.outlook.com/
Tested-by: Danny Pidutti <danny@lightningiq.io>
Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Chuck Lever <cel@kernel.org>
Link: https://patch.msgid.link/20261008140903.2784-1-cel@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exportfs/expfs.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index d3e55de4a2a2af..ab470783e798d5 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -336,7 +336,11 @@ static int get_name(const struct path *path, char *name, struct dentry *child)
 	}
 
 out_close:
-	fput(file);
+	/*
+	 * @file is the read-only directory opened above, so __fput()
+	 * cannot block on anything the caller holds.
+	 */
+	__fput_sync(file);
 out:
 	return error;
 }

From 0be8ba845e49ae45cdaf60e3f38be8514efe5f00 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 21 Oct 2026 13:46:54 +0200
Subject: [PATCH 1715/1982] statmount: don't copy the reserved empty string
 past the buffer

[ Upstream commit 11eef75006819f4e71d04ca2b9a1fb1580854a55 ]

statmount_string() reserves an empty string at the start of the seq
buffer before it calls the handler for the requested string. That's
what the offsets of unset strings point to since commit e52e97f09fb6
("statmount: let unset strings be empty").

If the handler emits nothing the early return from commit 75ead69a7173
("fs: don't let statmount return empty strings") skips the size check
against the caller's buffer. Back then an empty emission meant an empty
seq buffer and there was nothing to copy. Now the reserved NUL byte is
there and copy_statmount_to_user() copies it to buf + sizeof(struct
statmount) no matter how small bufsize is.

So request a string that may turn out empty with a buffer that's
smaller than struct statmount and the kernel writes one zero byte past
the caller's buffer and reports a size that's larger than the buffer.
STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP on a mount that isn't
idmapped will do, so will STATMOUNT_FS_SUBTYPE on anything but fuse or
STATMOUNT_OPT_ARRAY on a filesystem without ->show_options(). None of
this needs privileges. The byte only lands in the caller's own address
space but that's still not ok.

prepare_kstatmount() already refuses a buffer of exactly sizeof(struct
statmount) for string requests. A smaller buffer can't hold a string
either and it can't even hold the reserved empty string. So refuse any
buffer that isn't larger than the fixed part. That's also what the uapi
header says: string requests need space after the fixed part of the
structure.

Reproducer, unprivileged, on any mount that isn't idmapped:

    #define _GNU_SOURCE
    #include <errno.h>
    #include <fcntl.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <string.h>
    #include <sys/mman.h>
    #include <sys/syscall.h>
    #include <unistd.h>
    #define STATMOUNT_FS_SUBTYPE	0x00000100U
    #define STATMOUNT_MNT_UIDMAP	0x00002000U
    #define STATX_MNT_ID_UNIQUE	0x00004000U
    #define SM_SIZE			512 /* sizeof(struct statmount) */
    struct mnt_id_req {
    	uint32_t size, mnt_ns_fd;
    	uint64_t mnt_id, param, mnt_ns_id;
    };
    static uint64_t root_mnt_id(void)
    {
    	unsigned char stx[256]; /* struct statx, stx_mnt_id at offset 144 */
    	uint64_t id;
    	if (syscall(__NR_statx, AT_FDCWD, "/", 0, STATX_MNT_ID_UNIQUE, stx))
    		_exit(1);
    	memcpy(&id, stx + 144, sizeof(id));
    	return id;
    }
    static void probe(uint64_t mnt_id, uint64_t mask, int guard)
    {
    	struct mnt_id_req req = {
    		.size = sizeof(req), .mnt_id = mnt_id, .param = mask,
    	};
    	long page = sysconf(_SC_PAGESIZE);
    	unsigned char *map, *buf;
    	uint32_t size;
    	long ret;
    	map = mmap(NULL, 2 * page, PROT_READ | PROT_WRITE,
    		   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    	memset(map, 0xaa, 2 * page);
    	/* 100 byte buffer ending right at the page boundary */
    	buf = map + page - 100;
    	if (guard)
    		mprotect(map + page, page, PROT_NONE);
    	errno = 0;
    	ret = syscall(__NR_statmount, &req, buf, 100, 0);
    	printf("mask 0x%04llx%s: ret %ld errno %d", (unsigned long long)mask,
    	       guard ? " guard page" : "", ret, errno);
    	if (!guard) {
    		memcpy(&size, buf, sizeof(size));
    		printf(", size 0x%x, byte[%d] 0x%02x", size, SM_SIZE,
    		       buf[SM_SIZE]);
    	}
    	printf("\n");
    	munmap(map, 2 * page);
    }
    int main(void)
    {
    	uint64_t id = root_mnt_id();
    	probe(id, STATMOUNT_MNT_UIDMAP, 0);
    	probe(id, STATMOUNT_FS_SUBTYPE, 0);
    	probe(id, STATMOUNT_MNT_UIDMAP, 1);
    	return 0;
    }

Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM, the
same on a distro 7.1.13:

    mask 0x2000: ret 0 errno 0, size 0x65, byte[512] 0x00
    mask 0x0100: ret 0 errno 0, size 0x65, byte[512] 0x00
    mask 0x2000 guard page: ret -1 errno 14

After:

    mask 0x2000: ret -1 errno 75, size 0xaaaaaaaa, byte[512] 0xaa
    mask 0x0100: ret -1 errno 75, size 0xaaaaaaaa, byte[512] 0xaa
    mask 0x2000 guard page: ret -1 errno 75

Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020110747.959829-1-shawnq1@163.com
Fixes: e52e97f09fb6 ("statmount: let unset strings be empty")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-1-8917a4c1bd14@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index ab050a939cb539..fd7949d88a6c5c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5817,7 +5817,8 @@ static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
 	ks->bufsize = bufsize;
 
 	if (ks->mask & STATMOUNT_STRING_REQ) {
-		if (bufsize == sizeof(ks->sm))
+		/* Even the reserved empty string needs room past the fixed part. */
+		if (bufsize <= sizeof(ks->sm))
 			return -EOVERFLOW;
 
 		ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);

From 848ca02a4a39f2b15ad52d59ecef9df36c942215 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Wed, 21 Oct 2026 13:46:56 +0200
Subject: [PATCH 1716/1982] listmount: don't wrap around with a U64_MAX cursor

[ Upstream commit 95a5412022e437691f4eb1924ff249d9044f5ed1 ]

do_listmount() takes the last mount id the caller saw and looks up the
first mount after it by searching for last_mnt_id + 1. With U64_MAX
that wraps around to zero and the search finds the first mount in the
namespace. So a cursor at the largest possible id restarts the listing
from the beginning instead of ending it. A cursor of U64_MAX - 1
correctly returns nothing.

No mount will ever have that id. Mount ids come from a counter that
starts at MNT_UNIQUE_ID_OFFSET + 1 and a caller that only feeds back
ids it got from us can't hit this. It's still wrong. Nothing can come
after the largest possible id so return no entries for it, just like
for any other cursor past the last mount.

The reverse direction isn't affected. A cursor of zero is special-cased
and anything else is larger than MNT_UNIQUE_ID_OFFSET so last_mnt_id - 1
can't underflow.

Reproducer, unprivileged:

    #define _GNU_SOURCE
    #include <errno.h>
    #include <stdint.h>
    #include <stdio.h>
    #include <sys/syscall.h>
    #include <unistd.h>
    #define LSMT_ROOT 0xffffffffffffffffULL
    struct mnt_id_req {
    	uint32_t size, mnt_ns_fd;
    	uint64_t mnt_id, param, mnt_ns_id;
    };
    static void list(uint64_t cursor)
    {
    	struct mnt_id_req req = {
    		.size = sizeof(req), .mnt_id = LSMT_ROOT, .param = cursor,
    	};
    	uint64_t ids[8];
    	long ret;
    	errno = 0;
    	ret = syscall(__NR_listmount, &req, ids, 8, 0);
    	printf("cursor %llu: ret %ld errno %d", (unsigned long long)cursor,
    	       ret, errno);
    	for (long i = 0; i < ret && i < 1; i++)
    		printf("%s%llu", i ? "," : " ids ", (unsigned long long)ids[i]);
    	printf("%s\n", ret > 1 ? ",..." : "");
    }
    int main(void)
    {
    	list(0);
    	list(UINT64_MAX - 1);
    	list(UINT64_MAX);
    	return 0;
    }

Before, on 7.3.0-rc7-00252-g4e3259b08c54 (vfs.fixes) in a VM:

    cursor 0: ret 5 errno 0 ids 2147483651,...
    cursor 18446744073709551614: ret 0 errno 0
    cursor 18446744073709551615: ret 5 errno 0 ids 2147483651,...

After:

    cursor 0: ret 5 errno 0 ids 2147483651,...
    cursor 18446744073709551614: ret 0 errno 0
    cursor 18446744073709551615: ret 0 errno 0

Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020110732.959552-1-shawnq1@163.com
Fixes: b4c2bea8ceaa ("add listmount(2) syscall")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-3-8917a4c1bd14@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/namespace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index fd7949d88a6c5c..bb73b317f9e72a 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5998,6 +5998,8 @@ static ssize_t do_listmount(struct klistmount *kls, bool reverse)
 	} else {
 		if (reverse)
 			first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
+		else if (last_mnt_id == U64_MAX)
+			first = NULL; /* nothing comes after the largest id */
 		else
 			first = mnt_find_id_at(ns, last_mnt_id + 1);
 	}

From 4429d405124e6199092f029afd5630c84019d6f9 Mon Sep 17 00:00:00 2001
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date: Mon, 19 Oct 2026 14:59:13 -0400
Subject: [PATCH 1717/1982] ucount: take the rlimit reference before checking
 the limit

[ Upstream commit b14fcabd34e02c40f72d3cd1e9bd4fd18df40ff1 ]

inc_rlimit_get_ucounts() takes the reference that pins a ucounts level
while its rlimit count is non-zero only in the walk whose increment is
the 0 -> 1 transition, and only after that walk passed the limit check.
A walk that raises the count from zero and then fails the limit backs
out without the reference, while a concurrent walk that raised it past
one keeps its increment and never takes one either:

  CPU0 (obeys the limit)              CPU1 (overrides it)
  new = add_return(1) -> 1
                                      new = add_return(1) -> 2
                                      new != 1, no get_ucounts()
  new > max -> dec_unwind
  sub_return(1) -> 1   (no put)

The count is 1 with no reference held. When CPU1 drops its charge,
dec_rlimit_put_ucounts() takes the count to 0 and puts a reference
nobody took, which frees the live struct ucounts, and the user_namespace
it pins, with kfree_rcu(). The mirror interleaving leaks the reference
instead.

An unprivileged user reaches this on a kernel with CONFIG_USER_NS=y: in
a user namespace with RLIMIT_SIGPENDING 0, one process taking
synchronous SIGSEGVs (forced, so override_rlimit is set) races a second
process in the same namespace and uid that queues real-time signals,
which obey the limit. The two hold different sighand->siglock but charge
the same per-namespace SIGPENDING ucounts. Unpatched, with rcuref
debugging:

  rcuref - imbalanced put()
  WARNING: lib/rcuref.c:266 at rcuref_put_slowpath+0xf4/0x120
   put_ucounts+0x5a/0x180
   do_dec_rlimit_put_ucounts+0x70/0x90
   __sigqueue_free+0x33/0xc0
   get_signal+0x56f/0xd20
   arch_do_signal_or_restart+0x87/0x380
   irqentry_exit+0x243/0x650
   asm_exc_page_fault+0x26/0x30

Take the reference on the 0 -> 1 transition before the limit is checked,
so the walk that raises the count from zero owns that level's reference
even when its request is rejected, and unwind a rejected level through
do_dec_rlimit_put_ucounts(), which releases the reference when the count
returns to 0. The get_ucounts() failure path is unchanged. With the
patch the same interleaving, forced some 80000 times in a KASAN build,
produces no warning and no KASAN report.

Fixes: 15bc01effefe ("ucounts: Fix signal ucount refcounting")
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Link: https://patch.msgid.link/20261019185913.805378-1-nickolai@csail.mit.edu
Acked-by: Alexey Gladkov <legion@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/ucount.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/kernel/ucount.c b/kernel/ucount.c
index fc4a8f2d309651..5cbf1553658ea1 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -302,23 +302,26 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
 
 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
 		long new = atomic_long_add_return(1, &iter->rlimit[type]);
-		if (new < 0 || new > max)
+		/*
+		 * Take the extra reference on the 0 -> 1 transition before the
+		 * limit check: a rejected walk must not leave a concurrent one
+		 * holding the surviving increment with no reference.
+		 */
+		if (new == 1 && !get_ucounts(iter))
 			goto dec_unwind;
+		if (new < 0 || new > max) {
+			/* undo iter too, releasing the reference taken above */
+			do_dec_rlimit_put_ucounts(ucounts, iter->ns->ucounts, type);
+			return 0;
+		}
 		if (iter == ucounts)
 			ret = new;
 		if (!override_rlimit)
 			max = get_userns_rlimit_max(iter->ns, type);
-		/*
-		 * Grab an extra ucount reference for the caller when
-		 * the rlimit count was previously 0.
-		 */
-		if (new != 1)
-			continue;
-		if (!get_ucounts(iter))
-			goto dec_unwind;
 	}
 	return ret;
 dec_unwind:
+	/* get_ucounts() failed for iter: undo iter without a put */
 	dec = atomic_long_sub_return(1, &iter->rlimit[type]);
 	WARN_ON_ONCE(dec < 0);
 	do_dec_rlimit_put_ucounts(ucounts, iter, type);

From 55441fd25257971833e914ccd7337b2f2118534f Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Mon, 19 Oct 2026 22:26:35 +0000
Subject: [PATCH 1718/1982] cpufreq: intel_pstate: cancel HWP notify work in
 driver cleanup

[ Upstream commit 0ffc7534a210105ba973167a5b86d5ab39d4031f ]

intel_pstate_driver_cleanup() frees per-CPU data without cancelling the
pending HWP notify delayed work. If hwp_notify_work is still scheduled
or running when the struct is freed, the work function accesses freed
memory via container_of().

Call intel_pstate_disable_hwp_interrupt() before kfree() to disable
the interrupt source and cancel the pending work, matching the pattern
used in intel_pstate_suspend() and intel_pstate_hwp_offline().

Fixes: d845cd901b28 ("cpufreq: intel_pstate: Support highest performance change interrupt")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
[ rjw: Fixed the Fixes: tag ]
Link: https://patch.msgid.link/20261019222635.1741146-1-tristmd@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/intel_pstate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 1de12358c0b988..a498d66883b52a 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -3458,6 +3458,8 @@ static void intel_pstate_driver_cleanup(void)
 			if (intel_pstate_driver == &intel_pstate)
 				intel_pstate_clear_update_util_hook(cpu);
 
+			intel_pstate_disable_hwp_interrupt(all_cpu_data[cpu]);
+
 			kfree(all_cpu_data[cpu]);
 			WRITE_ONCE(all_cpu_data[cpu], NULL);
 		}

From 2fec4e4547ee28e5ebe54c34d67b4afcaf3fc0a7 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Mon, 12 Oct 2026 09:34:21 +0800
Subject: [PATCH 1719/1982] i2c: acpi: Fix adapter reference leak in
 i2c_acpi_new_device_by_fwnode()

[ Upstream commit a65917d0a22f9b10694853b725f9cd399fc3ef4d ]

i2c_acpi_new_device_by_fwnode() obtains an i2c_adapter through
i2c_acpi_find_adapter_by_handle(). That helper uses bus_find_device()
internally, so it returns the adapter with a reference held:

        adapter = i2c_verify_adapter(dev);
        if (!adapter)
                put_device(dev);

        return adapter;

The reference is only put on the failure path inside that helper. The
caller owns it otherwise. i2c_acpi_new_device_by_fwnode() never drops
it, neither on the -EPROBE_DEFER path nor after
i2c_new_client_device(), so every call leaks one reference on the
adapter and the adapter can never be released.

i2c_new_client_device() does not consume that reference. It registers
the new client with the adapter as its parent, and device_add() takes
its own reference on the parent, which device_del() releases when the
client goes away.  The reference obtained by the lookup is a separate
one and has to be dropped here.

i2c_acpi_notify() in the same file already does exactly this. It takes
the adapter from the same helper, registers the client through
i2c_acpi_register_device(), which calls i2c_new_client_device(), and
then puts the reference.

i2c_new_client_device() gives the client its own reference on the
adapter, so ours can be dropped unconditionally.

Found by code review.

Fixes: 605f8fc22442 ("i2c: core: Add new i2c_acpi_new_device helper function")
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261012013421.3597430-1-make_ruc2021@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/i2c-core-acpi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 98ebbc973f2122..8805fc454a4ef5 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -545,6 +545,7 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 {
 	struct i2c_acpi_lookup lookup;
 	struct i2c_adapter *adapter;
+	struct i2c_client *client;
 	struct acpi_device *adev;
 	LIST_HEAD(resource_list);
 	int ret;
@@ -572,7 +573,10 @@ struct i2c_client *i2c_acpi_new_device_by_fwnode(struct fwnode_handle *fwnode,
 	if (!adapter)
 		return ERR_PTR(-EPROBE_DEFER);
 
-	return i2c_new_client_device(adapter, info);
+	client = i2c_new_client_device(adapter, info);
+	put_device(&adapter->dev);
+
+	return client;
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_new_device_by_fwnode);
 

From 25a82a59738578a2ad4175b604e59a63ba8e6d32 Mon Sep 17 00:00:00 2001
From: Navon John Lukose <navonjohnlukose@gmail.com>
Date: Mon, 21 Sep 2026 04:30:17 +0530
Subject: [PATCH 1720/1982] i2c: designware: queue only one read command for
 block reads

[ Upstream commit 73dae605cad7921800677d982bfaeb81cc930dec ]

i2c_dw_xfer_msg() pre-queues up to rx_fifo_depth read commands based
on the initial msg.len. For I2C_M_RECV_LEN transfers the real length
is unknown until the first byte arrives and i2c_dw_recv_len() runs.
When a large initial length is passed, the surplus pre-queued reads
leave rx_outstanding non-zero after i2c_dw_recv_len() adjusts
msg.len, so the completion condition is never met and the transfer
times out. In a loop, this repeatedly times out the controller and
disrupts unrelated driver-bound devices on the same adapter.

Queue only one read command while I2C_M_RECV_LEN is pending.
i2c_dw_recv_len() re-enables TX_EMPTY, and the rest are queued once
the device-reported length is known.

Fixes: c3ae106050b9 ("i2c: designware: Implement support for SMBus block read and write")
Signed-off-by: Navon John Lukose <navonjohnlukose@gmail.com>
Cc: <stable@vger.kernel.org> # v4.10+
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-designware-master.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index c4bab532eed1ef..593ddec3c40ee6 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -515,6 +515,14 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
 				if (dev->rx_outstanding >= dev->rx_fifo_depth)
 					break;
 
+				/*
+				 * For block reads, queue only the length
+				 * byte until i2c_dw_recv_len() runs.
+				 */
+				if ((flags & I2C_M_RECV_LEN) &&
+				    buf_len < msgs[dev->msg_write_idx].len)
+					break;
+
 				regmap_write(dev->map, DW_IC_DATA_CMD,
 					     cmd | 0x100);
 				rx_limit--;

From 5ce06b8a03a7d8400408b953d7312dbc5219bb51 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Sat, 3 Oct 2026 16:27:52 +0800
Subject: [PATCH 1721/1982] tpm: tpm_nsc: fix NULL pointer dereference on init
 failure

[ Upstream commit 1900449684cf71427a51e0bb1d7914c0c8b39152 ]

tpm_nsc_remove() is used as the release callback of the hand-created
platform device and dereferences the chip drvdata unconditionally.
If init fails before tpmm_chip_alloc() (e.g. request_region() cannot
claim the ports), the error path drops the last device reference and
the release callback runs with chip == NULL, crashing module init.

Return early when the chip has not been created yet.

Cc: stable@vger.kernel.org
Fixes: afb5abc262e9 ("tpm: two-phase chip management functions")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/d5f0b38d6d6c17c01519c879d26448dbae388b0e.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_nsc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 879ac88f5783c9..46a52dc99b1481 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -259,7 +259,12 @@ static struct platform_device *pdev = NULL;
 static void tpm_nsc_remove(struct device *dev)
 {
 	struct tpm_chip *chip = dev_get_drvdata(dev);
-	struct tpm_nsc_priv *priv = dev_get_drvdata(&chip->dev);
+	struct tpm_nsc_priv *priv;
+
+	if (!chip)
+		return;
+
+	priv = dev_get_drvdata(&chip->dev);
 
 	tpm_chip_unregister(chip);
 	release_region(priv->base, 2);

From 160acc23dea8d3b5acae35e1effb32788a9aebd1 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Sat, 3 Oct 2026 16:27:53 +0800
Subject: [PATCH 1722/1982] tpm: tpm_nsc: stop using the cleanup callback as
 dev.release

[ Upstream commit df0ef271087623439a1e900f323ed2a57204706d ]

tpm_nsc_remove() is called explicitly from cleanup_nsc() and also
runs as the platform device release callback on the final
platform_device_put(), so the cleanup executes twice on module
exit; the second invocation operates on a chip that has already
been freed by the devm cleanup, and the I/O region is released
twice.

Overwriting the release callback installed by
platform_device_alloc() also keeps platform_device_release() from
running, leaking the platform object allocation.

Leave the default release callback in place; the explicit call in
cleanup_nsc() remains the single cleanup point.

Cc: stable@vger.kernel.org
Fixes: 570302a31149 ("[PATCH] tpm: move nsc driver off pci_dev")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/a6155310e6772f708b47291cc959e02c05b90eb7.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_nsc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 46a52dc99b1481..bcfa2a1a208a92 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -327,7 +327,6 @@ static int __init init_nsc(void)
 
 	pdev->num_resources = 0;
 	pdev->dev.driver = &nsc_drv.driver;
-	pdev->dev.release = tpm_nsc_remove;
 
 	if ((rc = platform_device_add(pdev)) < 0)
 		goto err_put_dev;

From 532570df1ea04da4b2463477abf92b739a072ad0 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Sat, 3 Oct 2026 16:27:54 +0800
Subject: [PATCH 1723/1982] tpm: fix zero-length read discarding the pending
 response

[ Upstream commit 6fc1b05077b8ac7c3193616f0bc419f6185988c6 ]

POSIX requires that a read() with a count of zero returns zero and
has no other effects.  tpm_common_read() treats such a call as a
consumed response: it marks the pending response as read and drops
it, so the response can never be retrieved; subsequent reads return
zero and the next write() is allowed to overwrite the response
buffer, silently breaking the command/response pairing of the TPM
character devices.

Return early when the caller passes a zero count, leaving any
pending response untouched for the next read.  A zero-length read
will not report a deferred asynchronous error; POSIX permits read()
to skip error detection for a zero count.

Cc: stable@vger.kernel.org
Fixes: 9488585b21be ("tpm: add support for partial reads")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/3f15140ab3c26e98b49d6aceaaa826585d56960b.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm-dev-common.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index f2a5e09257dddd..a856b4ddbdc2cd 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -134,6 +134,9 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
 	ssize_t ret_size = 0;
 	int rc;
 
+	if (!size)
+		return 0;
+
 	mutex_lock(&priv->buffer_mutex);
 
 	if (priv->response_length) {

From 930132f707c7ea67bc9cb8099ef784195cb6ca8c Mon Sep 17 00:00:00 2001
From: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Date: Thu, 22 Oct 2026 11:33:44 +0300
Subject: [PATCH 1724/1982] gpiolib: don't report -ENOMEM for a requested line
 without a label

[ Upstream commit dae739137441667d67fbfcc4d303a0ecc6618662 ]

gpiod_request_commit() sets GPIOD_FLAG_REQUESTED, calls ->request() and
only then sets the label. A line in between has no label, so
gpiochip_dup_line_label() passes NULL to kstrdup() and returns
ERR_PTR(-ENOMEM), which for_each_hwgpio() then passes to kfree():

  BUG: unable to handle page fault for address: ffcc73074355ffc8
  Call Trace:
   gpio_sim_dbg_show
   gpiolib_seq_show
   seq_read_iter

Return NULL for such a line, as for an unrequested one.

Reproduced with gpio-sim: reading /sys/kernel/debug/gpio in a loop while
lines are requested and released oopses within seconds; with this
change, 100000 cycles pass.

Fixes: 35b545332b80 ("gpio: remove gpio_lock")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20261020-gpiolib-chip-removal-v3-0-aambrozewicz@nvidia.com?part=2
Assisted-by: LLM
Signed-off-by: Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Link: https://patch.msgid.link/20261022083343.3905973-3-aambrozewicz@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 635b77c0eab53c..c23ba5e94cd6f0 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2556,6 +2556,7 @@ void gpiod_free(struct gpio_desc *desc)
 char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset)
 {
 	struct gpio_desc *desc;
+	const char *name;
 	char *label;
 
 	desc = gpiochip_get_desc(gc, offset);
@@ -2567,7 +2568,11 @@ char *gpiochip_dup_line_label(struct gpio_chip *gc, unsigned int offset)
 
 	guard(srcu)(&desc->gdev->desc_srcu);
 
-	label = kstrdup(gpiod_get_label(desc), GFP_KERNEL);
+	name = gpiod_get_label(desc);
+	if (!name)
+		return NULL;
+
+	label = kstrdup(name, GFP_KERNEL);
 	if (!label)
 		return ERR_PTR(-ENOMEM);
 

From d9c558a9a047c6d768b7c915bdc978631c836f84 Mon Sep 17 00:00:00 2001
From: Jean Delu <jeandelu@tutamail.com>
Date: Sat, 8 Aug 2026 16:00:00 +0200
Subject: [PATCH 1725/1982] parisc: eisa_enumerator: Fix out-of-bounds reads of
 the EEPROM buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c0a3e153804f0c14f4159ddbd2b73483c9cb3577 ]

eisa_enumerator() trusts the contents of the EISA EEPROM.  The number
of slots is read from the EEPROM header and used to access the slot
records at HPEE_SLOT_INFO(i) = 20 + 48*i within the fixed-size
eeprom_buf (HPEE_MAX_LENGTH, 8192 bytes) without any bound check.  As
struct eeprom_eisa_slot_info is 48 bytes, only 170 records fit into the
buffer, but num_slots is a u8 and may be up to 255, so a corrupted
EEPROM makes the code read up to about 4 kB past the end of the buffer
(e.g. record 254 is accessed at offset 20 + 48*254 = 12212).

parse_slot_config() has the same kind of problem: it clamps
config_data_length against HPEE_MAX_LENGTH but does not take
config_data_offset into account, so the parser can walk past the end of
the buffer even when the offset itself is valid.

Clamp the number of slots so that all slot records fit into the buffer,
and hand the number of bytes actually available to parse_slot_config()
and bound the parse by it.

Signed-off-by: Jean Delu <jeandelu@tutamail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/parisc/eisa_enumerator.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/parisc/eisa_enumerator.c b/drivers/parisc/eisa_enumerator.c
index f0cb31198a8f03..aa41d3abc6c222 100644
--- a/drivers/parisc/eisa_enumerator.c
+++ b/drivers/parisc/eisa_enumerator.c
@@ -311,6 +311,7 @@ static int configure_function(const unsigned char *buf, int *more)
 
 static int parse_slot_config(int slot,
 			     const unsigned char *buf,
+			     unsigned int buflen,
 			     struct eeprom_eisa_slot_info *es, 
 			     struct resource *io_parent,
 			     struct resource *mem_parent)
@@ -333,8 +334,8 @@ static int parse_slot_config(int slot,
 	printk(KERN_INFO "EISA slot %d: %s %s ", 
 	       slot, board, es->flags&HPEE_FLAG_BOARD_IS_ISA ? "ISA" : "EISA");
 	
-	maxlen = es->config_data_length < HPEE_MAX_LENGTH ?
-			 es->config_data_length : HPEE_MAX_LENGTH;
+	/* never parse beyond the data that is actually in the buffer */
+	maxlen = min_t(unsigned int, es->config_data_length, buflen);
 	while ((pos < maxlen) && (num_func <= es->num_functions)) {
 		pos+=configure_function(buf+pos, &function_len); 
 		
@@ -491,6 +492,13 @@ int eisa_enumerator(unsigned long eeprom_addr,
 	printk(KERN_INFO "Enumerating EISA bus\n");
 		    	
 	eh = (struct eeprom_header*)(eeprom_buf);
+	/*
+	 * The EEPROM contents are not to be trusted: clamp the number of
+	 * slots so that all slot records fit into eeprom_buf.
+	 */
+	eh->num_slots = min_t(u8, eh->num_slots,
+				(HPEE_MAX_LENGTH - sizeof(*eh)) /
+				sizeof(struct eeprom_eisa_slot_info));
 	for (i=0;i<eh->num_slots;i++) {
 		struct eeprom_eisa_slot_info *es;
 		
@@ -503,7 +511,8 @@ int eisa_enumerator(unsigned long eeprom_addr,
 		
 		if (es->config_data_offset < HPEE_MAX_LENGTH) {
 			if (parse_slot_config(i+1, &eeprom_buf[es->config_data_offset],
-					      es, io_parent, mem_parent)) {
+						HPEE_MAX_LENGTH - es->config_data_offset,
+						es, io_parent, mem_parent)) {
 				return -1;
 			}
 		} else {

From 0a71f66c8f3ee1f1592268d75766489e96c37525 Mon Sep 17 00:00:00 2001
From: Alex Kazinsky <a.kazinsky@ideco.ru>
Date: Fri, 23 Oct 2026 17:08:52 +0400
Subject: [PATCH 1726/1982] ASoC: tlv320aic32x4: Prevent division by zero in
 divider callbacks

[ Upstream commit 8cf9607d2d855629260fc78e6b54ea7a98525708 ]

A zero rate requested through clk_set_rate() or clk_round_rate() reaches
clk_aic32x4_div_determine_rate() when the minimum rate is zero. Clamping
the requested rate to the allowed range leaves it unchanged, causing
division by zero when calculating the divisor.

A zero parent rate can also cause division by zero in determine_rate().
For example, if reading a parent divider's register fails,
clk_aic32x4_div_recalc_rate() returns zero, which the clock framework
caches as the parent's rate. A subsequent rate request for a child
divider receives this value in best_parent_rate. With a nonzero requested
rate, the calculated divisor is zero. It passes the existing upper-bound
check and causes division by zero in the resulting rate calculation.

The set_rate callback can receive a zero rate when an ancestor's rate
changes. clk_calc_subtree() calculates descendant rates through
recalc_rate() without calling their determine_rate callbacks. If reading
a descendant divider's register fails, clk_aic32x4_div_recalc_rate()
returns zero. This becomes the descendant's new_rate, which
clk_change_rate() passes to clk_aic32x4_div_set_rate(), causing division
by zero.

Reject zero rates in both callbacks and reject a zero divisor in
clk_aic32x4_div_determine_rate().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a51b50062091 ("ASoC: tlv320aic32x4: Model DAC/ADC dividers in CCF")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>
Link: https://patch.msgid.link/20261023130854.93639-1-a.kazinsky@ideco.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-clk.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
index 5c0a76a4a106b2..1a815de9090976 100644
--- a/sound/soc/codecs/tlv320aic32x4-clk.c
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -320,6 +320,9 @@ static int clk_aic32x4_div_set_rate(struct clk_hw *hw, unsigned long rate,
 	struct clk_aic32x4 *div = to_clk_aic32x4(hw);
 	u8 divisor;
 
+	if (!rate)
+		return -EINVAL;
+
 	divisor = DIV_ROUND_UP(parent_rate, rate);
 	if (divisor > AIC32X4_DIV_MAX)
 		return -EINVAL;
@@ -333,8 +336,11 @@ static int clk_aic32x4_div_determine_rate(struct clk_hw *hw,
 {
 	unsigned long divisor;
 
+	if (!req->rate)
+		return -EINVAL;
+
 	divisor = DIV_ROUND_UP(req->best_parent_rate, req->rate);
-	if (divisor > AIC32X4_DIV_MAX)
+	if (!divisor || divisor > AIC32X4_DIV_MAX)
 		return -EINVAL;
 
 	req->rate = DIV_ROUND_UP(req->best_parent_rate, divisor);

From 20661adcee8783ba73fa6405842042dd161915c0 Mon Sep 17 00:00:00 2001
From: Christian Marangi <ansuelsmth@gmail.com>
Date: Thu, 22 Oct 2026 21:38:51 +0200
Subject: [PATCH 1727/1982] i2c: mt7621: fix copying uninitialized kernel stack
 with reduced page_len

[ Upstream commit b7fd977fec0d3f2bdd4f13bb59949c817a365652 ]

When a page_len is less than 5 bytes in mtk_i2c_xfer, uninitialized kernel
stack data is copied and written to REG_SM0D1_REG. Equally on the read
part, an unnecessary read is done.

Guard these extra copy/write and read for the page_len to fix leaking
uninitialized stack memory.

Fixes: d04913ec5f89 ("i2c: mt7621: Add MediaTek MT7621/7628/7688 I2C driver")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20261022193853.670625-1-ansuelsmth@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mt7621.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mt7621.c b/drivers/i2c/busses/i2c-mt7621.c
index 0a288c998419b3..9ea5e3f9a7632c 100644
--- a/drivers/i2c/busses/i2c-mt7621.c
+++ b/drivers/i2c/busses/i2c-mt7621.c
@@ -144,7 +144,6 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 	u16 addr;
 	int i, j, ret, len, page_len;
 	u32 cmd;
-	u32 data[2];
 
 	i2c = i2c_get_adapdata(adap);
 
@@ -186,6 +185,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 
 		/* transfer data */
 		for (len = pmsg->len, j = 0; len > 0; len -= 8, j += 8) {
+			u32 data[2] = { };
+
 			page_len = (len >= 8) ? 8 : len;
 
 			if (pmsg->flags & I2C_M_RD) {
@@ -194,7 +195,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 			} else {
 				memcpy(data, &pmsg->buf[j], page_len);
 				iowrite32(data[0], i2c->base + REG_SM0D0_REG);
-				iowrite32(data[1], i2c->base + REG_SM0D1_REG);
+				if (page_len > 4)
+					iowrite32(data[1], i2c->base + REG_SM0D1_REG);
 				cmd = SM0CTL1_WRITE;
 			}
 
@@ -204,7 +206,8 @@ static int mtk_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 
 			if (pmsg->flags & I2C_M_RD) {
 				data[0] = ioread32(i2c->base + REG_SM0D0_REG);
-				data[1] = ioread32(i2c->base + REG_SM0D1_REG);
+				if (page_len > 4)
+					data[1] = ioread32(i2c->base + REG_SM0D1_REG);
 				memcpy(&pmsg->buf[j], data, page_len);
 			} else {
 				if (!(pmsg->flags & I2C_M_IGNORE_NAK)) {

From 2e98c0261fc6b500db9d7f09b32b023b0f03c4cb Mon Sep 17 00:00:00 2001
From: Pufan Jin <cyan2254650260@gmail.com>
Date: Fri, 16 Oct 2026 21:08:12 +0800
Subject: [PATCH 1728/1982] spi: zynq-qspi: fix address buffer corruption and
 support 4-byte address

[ Upstream commit dc5ca34f5e8dc10c566ef39aa3b1a201a17ca734 ]

In zynq_qspi_exec_mem_op(), when transmitting address bytes, the driver
iterates over op->addr.nbytes and populates xqspi->txbuf[i]. However,
xqspi->txbuf is never re-assigned before populating the address, meaning
it still points to (u8 *)&op->cmd.opcode from the command phase.

This causes two severe issues:
1. Memory corruption: Writing into xqspi->txbuf writes past the opcode
   buffer on the stack (which was passed as const struct spi_mem_op *).
   If opcode is zero, xqspi->txbuf is uninitialized.
2. In zynq_qspi_supports_op(), operations with op->addr.nbytes > 3 are
   rejected. When paired with SPI NOR flashes larger than 16MB (such as
   Winbond W25Q256), spi_nor_spimem_check_read_pp_op() tests 4-byte address
   support, which fails and causes spi_nor_select_read() to drop all read
   capabilities, failing probe with -EINVAL (-22).

The Zynq-7000 QSPI controller hardware in manual I/O mode natively supports
transmitting 1 to 4 address bytes via its TXD FIFO registers
(ZYNQ_QSPI_TXD_00_00_OFFSET).

Fix this by introducing a local opaddr[4] buffer in zynq_qspi_exec_mem_op()
and explicitly setting xqspi->txbuf = opaddr before populating address
bytes. Also allow up to 4 address bytes in zynq_qspi_supports_op().

Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
Cc: stable@vger.kernel.org
Signed-off-by: Pufan Jin <cyan2254650260@gmail.com>
Link: https://patch.msgid.link/20261016130812.282624-1-cyan2254650260@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-zynq-qspi.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
index 406fd9d5337eec..c9588fd1d12375 100644
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -229,11 +229,10 @@ static bool zynq_qspi_supports_op(struct spi_mem *mem,
 		return false;
 
 	/*
-	 * The number of address bytes should be equal to or less than 3 bytes.
+	 * The number of address bytes should be equal to or less than 4 bytes.
 	 */
-	if (op->addr.nbytes > 3)
+	if (op->addr.nbytes > 4)
 		return false;
-
 	return true;
 }
 
@@ -526,6 +525,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 				 const struct spi_mem_op *op)
 {
 	struct zynq_qspi *xqspi = spi_controller_get_devdata(mem->spi->controller);
+	u8 opaddr[4] __aligned(4);
 	int err = 0, i;
 	u8 *tmpbuf;
 
@@ -547,12 +547,13 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 	}
 
 	if (op->addr.nbytes) {
-		for (i = 0; i < op->addr.nbytes; i++) {
-			xqspi->txbuf[i] = op->addr.val >>
+		for (i = 0; i < op->addr.nbytes; i++)
+			opaddr[i] = op->addr.val >>
 					(8 * (op->addr.nbytes - i - 1));
-		}
 
 		reinit_completion(&xqspi->data_completion);
+		xqspi->txbuf = opaddr;
+
 		xqspi->rxbuf = NULL;
 		xqspi->tx_bytes = op->addr.nbytes;
 		xqspi->rx_bytes = op->addr.nbytes;

From a1028ed2d71d28395c58af1ab73abd0e42cc9909 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <cenzhang@linux.microsoft.com>
Date: Mon, 12 Oct 2026 19:51:49 -0400
Subject: [PATCH 1729/1982] posix-cpu-timers: Fix pid refcount leak in
 do_cpu_nanosleep() signal path

[ Upstream commit 8ccd731b63a0183ca2b0e18f3ca15864b3f37eda ]

do_cpu_nanosleep() sleeps on a temporary k_itimer whose reference on the
target's struct pid is taken by posix_cpu_timer_create() and dropped by
posix_cpu_timer_del(). When a signal ends the sleep, the timer is
disarmed with posix_cpu_timer_set(), but posix_cpu_timer_del() is only
called for a result of 0 or TIMER_RETRY. If the target thread or process
has exited in the meantime, timer_lock_sighand() finds no task,
posix_cpu_timer_set() returns -ESRCH and the pid reference is leaked.

An unprivileged user can trigger this: sleep on the CPU clock of a
thread, let that thread exit, then signal the sleeper. Each round leaks
one struct pid. Repeating it exhausts unreclaimable slab memory
within minutes:

  Out of memory: Killed process 150 (poc) total-vm:789292kB, anon-rss:484kB
  Kernel panic - not syncing: System is deadlocked on memory

Fix this by also calling posix_cpu_timer_del() on -ESRCH. With the
target gone, the deletion is safe. It finds no task either and only
drops the pid reference.

Fixes: e26d70d271ee ("posix-timers: Cleanup reaped target handling")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261012235149.66531-1-cenzhang@linux.microsoft.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/posix-cpu-timers.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index b3d4bae9ee3e00..fcb98cbb1219be 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1597,8 +1597,8 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
 		 */
 		expires = cpu_timer_getexpires(&timer.it.cpu);
 		error = posix_cpu_timer_set(&timer, 0, &zero_it, &it);
-		if (!error) {
-			/* Timer is now unarmed, deletion can not fail. */
+		if (error != TIMER_RETRY) {
+			/* Unarmed or target gone (-ESRCH), deletion can not fail. */
 			posix_cpu_timer_del(&timer);
 		} else {
 			while (error == TIMER_RETRY) {

From 5ba40b5a2d6220666f9263e92ef38e43029ac6b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh=20=28Schneider=20Electric=29?=
 <thomas.weissschuh@linutronix.de>
Date: Fri, 23 Oct 2026 13:49:17 +0200
Subject: [PATCH 1730/1982] timekeeping: Update offsets on sequence counter
 retry in ktime_get_update_offsets_now()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6541fbc942f3b63bb8bd44e34eee6223e0abe719 ]

The sequence counter of the cwsseq target is modified during the
sequence counter loop. If the loop retries, cwsseq will now match
but the offsets contain the values from the previous loop iteration.
These are not guaranteed to be consistent in themselves or with the
current loops "now.

Save the target's original sequence counter value so that the update
also happens on loop retries.

Fixes: 868a3e915f7f ("hrtimer: Make offset update smarter")
Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261023-timekeeping-clock_was_set_seq-v1-1-61c4c53d031c@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/timekeeping.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 377e29ca5a521a..32f59de2ba4ce6 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -2569,6 +2569,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
 				     ktime_t *offs_boot, ktime_t *offs_tai)
 {
 	struct timekeeper *tk = &tk_core.timekeeper;
+	u32 cwsseq_orig = *cwsseq;
 	unsigned int seq;
 	ktime_t base;
 	u64 nsecs;
@@ -2580,7 +2581,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
 		nsecs = timekeeping_get_ns(&tk->tkr_mono);
 		base = ktime_add_ns(base, nsecs);
 
-		if (*cwsseq != tk->clock_was_set_seq) {
+		if (cwsseq_orig != tk->clock_was_set_seq) {
 			*cwsseq = tk->clock_was_set_seq;
 			*offs_real = tk->offs_real;
 			*offs_boot = tk->offs_boot;

From 5244ac2547e5d1310d233f490e193024803422ef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 23 Oct 2026 15:46:23 -0400
Subject: [PATCH 1731/1982] cgroup: don't kill migrated processes through their
 exiting threads

[ Upstream commit 5f4a3f743acc96987ae5c2e966947942c34ba56c ]

Since commit da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread
group leader"), __cgroup_kill() visits every thread in the cgroup and
sends SIGKILL with PIDTYPE_TGID, so each visited thread takes down its
whole thread group.

A thread that has started exiting can stay in a cgroup after its process
has been moved out of it. cgroup_migrate_add_task() skips PF_EXITING
tasks, and the thread is only unlinked by cgroup_task_dead() after its
final context switch. mm_release() clears the thread's clear_child_tid
word and wakes the joiner well before that, so pthread_join() can return
while the thread is still in the old cgroup.

If cgroup.kill is written in that window, __cgroup_kill() finds the
exiting thread and complete_signal() passes the group-wide SIGKILL on to
a live thread, killing a process that already left the cgroup. The cgroup
selftest test_stress.sh runs into this: test_cgcore_proc_migration()
joins its threads, moves itself back to the root cgroup, and cg_destroy()
falls back to cgroup.kill on the old cgroup when rmdir() fails with
EBUSY, so test_core kills itself. KernelCI has been reporting
"with_stress.sh: line 94: ... Killed" on several arm64 boards since the
commit reached linux-next.

Keep visiting every thread, but go back to sending SIGKILL to the thread
that was found. A SIGKILL sent to a live thread still kills its whole
thread group, so both cases fixed by that commit stay fixed, and
task_can_queue_signal() drops one sent to a thread that is already
exiting.

Fixes: da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread group leader")
Cc: stable@vger.kernel.org # v5.14+
Link: https://lore.kernel.org/all/179272264722.329188.4773475583351189022@6e52bff8000c/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 28db81da10b81e..aa629b7d76e530 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4229,7 +4229,7 @@ static void __cgroup_kill(struct cgroup *cgrp)
 		if (__fatal_signal_pending(task))
 			continue;
 
-		do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID);
+		send_sig(SIGKILL, task, 0);
 	}
 	css_task_iter_end(&it);
 }

From ca59f6aa7c29c5248ea996d4a5e2fa7964ae74e8 Mon Sep 17 00:00:00 2001
From: Aamir Ahmed <elb12345@hotmail.co.uk>
Date: Tue, 20 Oct 2026 23:33:46 +0100
Subject: [PATCH 1732/1982] gve: fix out-of-bounds read in
 gve_get_flow_rule_entry()

[ Upstream commit 45e0a63f9c86a558afc70d79b6df38f8ec7f502a ]

gve_get_flow_rule_entry() checks the requested location against the
first and last cached rules, but rules_cache_num can be 0 while
rules_cache_synced is true: GVE_FLOW_RULE_QUERY_RULES returns the rules
from the requested location onwards, so a request past the last
installed rule - or any request when no rules are installed - returns
zero rules, which the driver accepts and marks as synced.

The next query evaluates rules_cache[*cache_num - 1] with
*cache_num == 0. The zero-initialised cache does not trip the earlier
comparison, *cache_num - 1 wraps to 0xFFFFFFFF in u32, and the read
faults about 352 GiB past the cache. ETHTOOL_GRXCLSRULE needs no
capability, so an unprivileged user can trigger it:

    BUG: unable to handle page fault for address: ff240996c4c64fa8
    #PF: supervisor read access in kernel mode
    RIP: gve_get_flow_rule_entry+0xd4/0x110 [gve]

Treat an empty cache as a cache miss and re-query.

Fixes: 6f3bc487565d ("gve: Add flow steering ethtool support")
Cc: stable@vger.kernel.org
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Eugene Lee <eugenehlee@google.com>
Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
Link: https://patch.msgid.link/AS8P251MB0001135AF3233180DC42DCD1C8672@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_flow_rule.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/google/gve/gve_flow_rule.c b/drivers/net/ethernet/google/gve/gve_flow_rule.c
index 0bb8cd1876a3fd..426a264af8b26b 100644
--- a/drivers/net/ethernet/google/gve/gve_flow_rule.c
+++ b/drivers/net/ethernet/google/gve/gve_flow_rule.c
@@ -206,6 +206,7 @@ int gve_get_flow_rule_entry(struct gve_priv *priv, struct ethtool_rxnfc *cmd)
 		return -EOPNOTSUPP;
 
 	if (!priv->flow_rules_cache.rules_cache_synced ||
+	    !*cache_num ||
 	    fsp->location < be32_to_cpu(rules_cache[0].location) ||
 	    fsp->location > be32_to_cpu(rules_cache[*cache_num - 1].location)) {
 		err = gve_adminq_query_flow_rules(priv, GVE_FLOW_RULE_QUERY_RULES, fsp->location);

From 57492dac0edfdc29d0c6a5b931456f2a5545e964 Mon Sep 17 00:00:00 2001
From: Igor Velkov <iav@iav.lv>
Date: Thu, 15 Oct 2026 21:51:50 +0300
Subject: [PATCH 1733/1982] genirq/kexec: Do not take the bus lock of an
 interrupt chip on the crash path

[ Upstream commit 717862eac6eff0eea8ac30a0c0de0bed84922aab ]

machine_kexec_mask_interrupts() calls irq_set_irqchip_state() for every
started interrupt. That function takes the bus lock of the chip and
desc->lock, and syncs the chip when it drops them. On the crash path
interrupts are off and the other CPUs are stopped, so a chip whose bus
transfer is completed by an interrupt never returns from the sync.

On RK3399 boards with an RK808 PMIC the RTC alarm interrupt belongs to
the regmap-irq chip of the RK808, which sits on I2C. rk808_irq_chip sets
init_ack_masked, so regmap_irq_sync_unlock() writes the ack register on
every unlock, and the I2C controller needs its own interrupt to finish
the transfer. A panic with a crash kernel loaded prints

  SMP: stopping secondary CPUs

and then nothing until the watchdog resets the board.

machine_kexec_mask_interrupts() takes neither lock for the other
operations on the descriptor. Move the search for the chip that
implements irq_set_irqchip_state() into __irq_set_irqchip_state(), which
takes no locks, and call it from machine_kexec_mask_interrupts().

Fixes: 78fd584cdec0 ("arm64: kdump: implement machine_crash_shutdown()")
Suggested-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Igor Velkov <iav@iav.lv>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015-kexec-irq-bus-lock-v2-1-2af15f0757b6@iav.lv
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/internals.h |  1 +
 kernel/irq/kexec.c     |  2 +-
 kernel/irq/manage.c    | 43 +++++++++++++++++++++++-------------------
 3 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index d197854a93c8ff..97e50ade3bb981 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -78,6 +78,7 @@ enum {
 #include "settings.h"
 
 extern int __irq_set_trigger(struct irq_desc *desc, unsigned long flags);
+extern int __irq_set_irqchip_state(struct irq_desc *desc, enum irqchip_irq_state which, bool val);
 extern void __disable_irq(struct irq_desc *desc);
 extern void __enable_irq(struct irq_desc *desc);
 
diff --git a/kernel/irq/kexec.c b/kernel/irq/kexec.c
index 1a3deffe6b5b65..f245b987642250 100644
--- a/kernel/irq/kexec.c
+++ b/kernel/irq/kexec.c
@@ -25,7 +25,7 @@ void machine_kexec_mask_interrupts(void)
 			 * First try to remove the active state from an interrupt which is forwarded
 			 * to a VM. If the interrupt is not forwarded, try to EOI the interrupt.
 			 */
-			check_eoi = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false);
+			check_eoi = __irq_set_irqchip_state(desc, IRQCHIP_STATE_ACTIVE, false);
 		}
 
 		if (check_eoi && chip->irq_eoi && irqd_irq_inprogress(&desc->irq_data))
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index a0b79bcc0e08b7..19eda7aa9febde 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -2702,6 +2702,28 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which, bool *
 }
 EXPORT_SYMBOL_GPL(irq_get_irqchip_state);
 
+int __irq_set_irqchip_state(struct irq_desc *desc, enum irqchip_irq_state which, bool val)
+{
+	struct irq_data *data = irq_desc_get_irq_data(desc);
+	struct irq_chip *chip;
+
+	do {
+		chip = irq_data_get_irq_chip(data);
+
+		if (WARN_ON_ONCE(!chip))
+			return -ENODEV;
+
+		if (chip->irq_set_irqchip_state)
+			break;
+
+		data = irqd_get_parent_data(data);
+	} while (data);
+
+	if (data)
+		return chip->irq_set_irqchip_state(data, which, val);
+	return -EINVAL;
+}
+
 /**
  * irq_set_irqchip_state - set the state of a forwarded interrupt.
  * @irq:	Interrupt line that is forwarded to a VM
@@ -2716,25 +2738,8 @@ EXPORT_SYMBOL_GPL(irq_get_irqchip_state);
  */
 int irq_set_irqchip_state(unsigned int irq, enum irqchip_irq_state which, bool val)
 {
-	scoped_irqdesc_get_and_buslock(irq, 0) {
-		struct irq_data *data = irq_desc_get_irq_data(scoped_irqdesc);
-		struct irq_chip *chip;
-
-		do {
-			chip = irq_data_get_irq_chip(data);
-
-			if (WARN_ON_ONCE(!chip))
-				return -ENODEV;
-
-			if (chip->irq_set_irqchip_state)
-				break;
-
-			data = irqd_get_parent_data(data);
-		} while (data);
-
-		if (data)
-			return chip->irq_set_irqchip_state(data, which, val);
-	}
+	scoped_irqdesc_get_and_buslock(irq, 0)
+		return __irq_set_irqchip_state(scoped_irqdesc, which, val);
 	return -EINVAL;
 }
 EXPORT_SYMBOL_GPL(irq_set_irqchip_state);

From 9a62816f8891b0804c5e36538377b1a618a0bcab Mon Sep 17 00:00:00 2001
From: yanxia <yanxia@cmss.chinamobile.com>
Date: Tue, 20 Oct 2026 10:01:47 +0800
Subject: [PATCH 1734/1982] veth: fix stale peer max_mtu on XDP program
 replacement

[ Upstream commit c955325db639e9503941227e14e1f1ccc99442a1 ]

veth_xdp_set() calculates the peer MTU limit from the incoming program's
XDP fragment capability, but only stores it when no program was attached.
Replacing a program with one having a different fragment capability
therefore leaves the peer's max_mtu stale.

Replacing a regular program with an xdp.frags program keeps rejecting
otherwise valid jumbo MTUs. The opposite replacement leaves a larger
limit in place and permits MTUs which a fresh attachment of the regular
program would reject.

Update peer->max_mtu after every successful attachment or replacement.
Keep the GSO feature update conditional on the first attachment.

Found during review of the XDP replacement path and confirmed with
native XDP on an isolated veth pair. Before the fix, direct replacement
rejects MTU 9000 after switching to xdp.frags, and accepts it after
switching back to a regular program. Detaching and attaching instead
produces the expected results in both directions.

UML tests on net reproduce the problem before this change and match the
detach/attach controls afterwards, with both devices up or down and
with either endpoint receiving XDP. Failed replacements preserve the
previous state; same-type replacements and detach also behave as
expected. Small-frame traffic passes in the devices-up cases.

Fixes: 7cda76d858a4 ("veth: Allow jumbo frames in xdp mode")
Cc: stable@vger.kernel.org
Signed-off-by: yanxia <yanxia@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261020020147.790274-1-yanxia@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/veth.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 148114ab85ac37..25cdbba5dfa9b0 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1621,10 +1621,9 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog,
 			}
 		}
 
-		if (!old_prog) {
+		if (!old_prog)
 			peer->hw_features &= ~NETIF_F_GSO_SOFTWARE;
-			peer->max_mtu = max_mtu;
-		}
+		peer->max_mtu = max_mtu;
 
 		xdp_features_set_redirect_target(peer, true);
 	}

From 6252388f4ee900826173c2a71d9071b7a2b699f9 Mon Sep 17 00:00:00 2001
From: Stanley Jhu <stanleyjhu@google.com>
Date: Thu, 15 Oct 2026 08:18:51 +0800
Subject: [PATCH 1735/1982] scsi: ufs: bsg: Complete the job on error

[ Upstream commit cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8 ]

When ufs_bsg_request() fails, it returns a non-zero status without calling
bsg_job_done(). bsg_queue_rq() then ends the request with BLK_STS_IOERR
without running bsg_complete(), leaking the job's device reference and
mapped scatterlists.

Always complete the job via bsg_job_done() and return 0, matching other BSG
transports. Requests failing with a negative errno now return it from SG_IO
with the 4-byte result in the reply, while positive status codes still
return 0 from SG_IO with the reply header.

Fixes: b13a3539eb2a ("scsi: ufs-bsg: complete ufs-bsg job only if no error")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-2-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ufs/core/ufs_bsg.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index bb6ff8ca5c7a8c..237ade1f0cd839 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -194,14 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job)
 	ufshcd_rpm_put_sync(hba);
 	kfree(buff);
 	bsg_reply->result = ret;
-	/* complete the job here only if no error */
-	if (ret == 0) {
+	if (ret == 0)
 		job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) :
 					sizeof(struct ufs_bsg_reply);
-		bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
-	}
+	bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
 
-	return ret;
+	return 0;
 }
 
 /**

From a3e6b9d63f4545f2e2c6522eb7b180a607420ef7 Mon Sep 17 00:00:00 2001
From: Stanley Jhu <stanleyjhu@google.com>
Date: Thu, 15 Oct 2026 08:18:52 +0800
Subject: [PATCH 1736/1982] scsi: ufs: bsg: Clear the reply buffer before use

[ Upstream commit 2e63ac76cc08ea376ba61fef52f7b7849e35024d ]

The reply buffer is allocated once per tag and reused. Requests that
complete with a positive status do not fill all of it, so user space
receives bytes from an earlier request on the same tag.

Clear the whole reply buffer on entry to ufs_bsg_request().

Fixes: 95e34bf930ea ("scsi: ufs-bsg: Add support for raw upiu in ufs_bsg_request()")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-3-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ufs/core/ufs_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 237ade1f0cd839..0e0b08a3821c4e 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -142,7 +142,7 @@ static int ufs_bsg_request(struct bsg_job *job)
 	int ret;
 	bool rpmb = false;
 
-	bsg_reply->reply_payload_rcv_len = 0;
+	memset(job->reply, 0, job->reply_len);
 
 	ufshcd_rpm_get_sync(hba);
 

From 657a3f18227d375fe34c565f511a268c63f20784 Mon Sep 17 00:00:00 2001
From: Stanley Jhu <stanleyjhu@google.com>
Date: Thu, 15 Oct 2026 08:18:55 +0800
Subject: [PATCH 1737/1982] scsi: ufs: core: Clear stale UIC result byte before
 peer DME retries

[ Upstream commit e4a9b7640914b248eb7537d4507aa42db080586a ]

Peer DME get and set retry a failed attempt with the same struct
uic_command. UIC completion ORs the ConfigResultCode into argument2[7:0],
and nothing clears it before the next attempt. Once an attempt fails, every
retry keeps reporting that error code, even when the device returns
success, so a transient failure becomes a hard failure after three
retries. Each such retry also triggers the WARN_ON_ONCE() in
ufshcd_dispatch_uic_cmd(). In ufshcd_dme_set_attr(), ufshcd_uic_cmd_compl()
also overwrites argument3 with the register readback before the next
attempt.

Clear the result byte and restore argument3 in ufshcd_dme_set_attr() when
an attempt fails.

Fixes: 64238fbd15ea ("scsi: ufs: add retries to dme_peer get and set attribute")
Cc: stable@vger.kernel.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-6-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ufs/core/ufshcd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 52df1df6333aae..d225ad90cc3923 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -4219,9 +4219,12 @@ int ufshcd_dme_set_attr(struct ufs_hba *hba, u32 attr_sel,
 	do {
 		/* for peer attributes we retry upon failure */
 		ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
-		if (ret)
+		if (ret) {
 			dev_dbg(hba->dev, "%s: attr-id 0x%x val 0x%x error code %d\n",
 				set, UIC_GET_ATTR_ID(attr_sel), mib_val, ret);
+			uic_cmd.argument2 &= ~MASK_UIC_COMMAND_RESULT;
+			uic_cmd.argument3 = mib_val;
+		}
 	} while (ret && peer && --retries);
 
 	if (ret)
@@ -4285,9 +4288,11 @@ int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel,
 	do {
 		/* for peer attributes we retry upon failure */
 		ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
-		if (ret)
+		if (ret) {
 			dev_dbg(hba->dev, "%s: attr-id 0x%x error code %d\n",
 				get, UIC_GET_ATTR_ID(attr_sel), ret);
+			uic_cmd.argument2 &= ~MASK_UIC_COMMAND_RESULT;
+		}
 	} while (ret && peer && --retries);
 
 	if (ret)

From e89d8e7c00ec52c207950a4f80c77e82565de9fe Mon Sep 17 00:00:00 2001
From: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Date: Mon, 19 Oct 2026 21:30:33 +0000
Subject: [PATCH 1738/1982] scsi: libiscsi_tcp: Prevent R2T range check
 overflow

[ Upstream commit eb7aa7fd673fdc1582223cd133bcc5f54e7af19f ]

An iSCSI target controls the R2T data offset and length as 32-bit
values. Adding them before comparing the result with the SCSI data buffer
length can wrap. An R2T with offset 1 and length U32_MAX then passes the
check for a 4096-byte write.

The transmit path treats the wrapped range as valid, exhausts the command
scatterlist, and dereferences the NULL next entry in
iscsi_tcp_segment_done().

Check the offset first, then compare the length with the remaining bytes in
the data buffer.

Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Acked-by: Chris Leech <cleech@redhat.com>
Link: https://patch.msgid.link/DB5PR08MB100629CD3750FBF71475B5224FD982@DB5PR08MB10062.eurprd08.prod.outlook.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libiscsi_tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index d35f93451ee9bb..3c9e736d45e7ee 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -601,7 +601,8 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 			      data_length, session->max_burst);
 
 	data_offset = be32_to_cpu(rhdr->data_offset);
-	if (data_offset + data_length > task->sc->sdb.length) {
+	if (data_offset > task->sc->sdb.length ||
+	    data_length > task->sc->sdb.length - data_offset) {
 		iscsi_conn_printk(KERN_ERR, conn,
 				  "invalid R2T with data len %u at offset %u "
 				  "and total length %d\n", data_length,

From 3c9620afa60869f5e637ec047a04ba71f1557512 Mon Sep 17 00:00:00 2001
From: Stanley Jhu <stanleyjhu@google.com>
Date: Thu, 22 Oct 2026 11:44:38 +0800
Subject: [PATCH 1739/1982] scsi: ufs: core: Remove an always-false WARN_ONCE()

[ Upstream commit cd37a69c367b6a5f685db0ac7d01f08545081a30 ]

The WARN_ONCE() in ufshcd_poll() can never fire. completed_reqs is set to
~tr_doorbell & hba->outstanding_reqs on the line above, and
hba->outstanding_reqs cannot change in between because ufshcd_poll() holds
hba->outstanding_lock. So completed_reqs & ~hba->outstanding_reqs is always
zero. Remove it. No functional change.

Cc: stable@vger.kernel.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Link: https://patch.msgid.link/20261022034443.3034432-2-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ufs/core/ufshcd.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index d225ad90cc3923..b3dbfd3552dc44 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -5714,9 +5714,6 @@ static int ufshcd_poll(struct Scsi_Host *shost, unsigned int queue_num)
 	spin_lock_irqsave(&hba->outstanding_lock, flags);
 	tr_doorbell = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
 	completed_reqs = ~tr_doorbell & hba->outstanding_reqs;
-	WARN_ONCE(completed_reqs & ~hba->outstanding_reqs,
-		  "completed: %#lx; outstanding: %#lx\n", completed_reqs,
-		  hba->outstanding_reqs);
 	if (queue_num == UFSHCD_POLL_FROM_INTERRUPT_CONTEXT) {
 		/* Do not complete polled requests from interrupt context. */
 		ufshcd_clear_polled(hba, &completed_reqs);

From 5e208e3883fd79e841bd98d99ae9f3cfef5ad191 Mon Sep 17 00:00:00 2001
From: Stanley Jhu <stanleyjhu@google.com>
Date: Thu, 22 Oct 2026 11:44:42 +0800
Subject: [PATCH 1740/1982] scsi: ufs: core: Remove completed-without-interrupt
 path in ufshcd_abort()

[ Upstream commit 7cfdfdd6557906fd09cf0a9a564a07012e7fb0c1 ]

In SDB mode, a command that times out right as the controller finishes it
can be completed twice:

 1. The command times out and scsi_timeout() schedules ufshcd_abort().

 2. The controller finishes the command and clears its doorbell bit in
    REG_UTP_TRANSFER_REQ_DOOR_BELL, while the completion handler has not
    yet cleared BIT(tag) in hba->outstanding_reqs.

 3. ufshcd_abort() sees the doorbell bit clear and calls
    __ufshcd_transfer_req_compl() without clearing BIT(tag) in
    hba->outstanding_reqs.

 4. The normal completion handler or the logical unit reset that follows
    sees BIT(tag) still set in hba->outstanding_reqs and completes the same
    command a second time.

This branch only exists for a rare corner case, a completion interrupt that
is lost or arrives late. Remove it to simplify the abort path and leave
such a command to the SCSI error handler, like any other command that
cannot be aborted. The cost is a slower recovery in this corner case, which
is acceptable since it only happens after a timeout.

Fixes: 169f5eb28869 ("scsi: ufs: Optimize SCSI command processing")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/fdb5c391-01ef-4a23-94c2-4f3853909348@acm.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261022034443.3034432-6-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ufs/core/ufshcd.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index b3dbfd3552dc44..97f86b6905b56c 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -7777,15 +7777,6 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
 	}
 	hba->req_abort_count++;
 
-	if (!hba->mcq_enabled && !(reg & (1 << tag))) {
-		/* only execute this code in single doorbell mode */
-		dev_err(hba->dev,
-		"%s: cmd was completed, but without a notifying intr, tag = %d",
-		__func__, tag);
-		__ufshcd_transfer_req_compl(hba, 1UL << tag);
-		goto release;
-	}
-
 	/*
 	 * Task abort to the device W-LUN is illegal. When this command
 	 * will fail, due to spec violation, scsi err handling next step

From e93fbad317c8c8501697c7bbbebc285999f340e1 Mon Sep 17 00:00:00 2001
From: Hungyu Lin <dennylin0707@gmail.com>
Date: Tue, 20 Oct 2026 21:01:57 +0000
Subject: [PATCH 1741/1982] compat: avoid double rounding in times()

[ Upstream commit 6b30c39a5e333cfb1475acf0f73de6ef954eea8a ]

do_sys_times() already converts CPU time to USER_HZ ticks.  The compat
path converts each value back to jiffies before converting it to
COMPAT_USER_HZ.  This round trip can lose precision even when the two
userspace rates match.

With HZ=250 and USER_HZ=COMPAT_USER_HZ=100, one user tick becomes two
jiffies and then zero compat ticks.  Every odd tick count loses one tick,
so any of the four tms fields can underreport CPU time by an additional 10
ms.

Return the value directly when the native and compat units match.  Keep
the existing conversion for differing rates.

Link: https://lore.kernel.org/20261020210157.52057-1-dennylin0707@gmail.com
Fixes: f06febc96ba8 ("timers: fix itimer/many thread hang")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sys.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/sys.c b/kernel/sys.c
index c8376d7a0741b2..bc89bd13311190 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1077,6 +1077,9 @@ SYSCALL_DEFINE1(times, struct tms __user *, tbuf)
 #ifdef CONFIG_COMPAT
 static compat_clock_t clock_t_to_compat_clock_t(clock_t x)
 {
+	if (USER_HZ == COMPAT_USER_HZ)
+		return x;
+
 	return compat_jiffies_to_clock_t(clock_t_to_jiffies(x));
 }
 

From 4dd4043fcfa06d27c2ed22cc51c8a1b2e0e632bc Mon Sep 17 00:00:00 2001
From: Caleb Kan <ckan@cloudflare.com>
Date: Thu, 22 Oct 2026 09:33:30 +0100
Subject: [PATCH 1742/1982] stackdepot: stop preallocating after the final pool

[ Upstream commit 8f56ea8e0706d92774603260779c7032f03ef3ac ]

depot_init_pool() decides whether another pool is needed before it
increments pools_num. When it registers the last allowed pool, pools_num
is still one below stack_max_pools, so the existing comparison clears
new_pool.

With new_pool cleared, stack_depot_save_flags() can allocate another
order-2 pool after a lookup miss. depot_keep_new_pool() retains its pointer
in the global new_pool, so the allocation is not lost. However, pools_num
has already reached stack_max_pools, and depot_init_pool() rejects every
attempt to register the pool. It remains allocated and unusable until
reboot. The non-NULL pointer prevents later saves from allocating more
spare pools.

Account for the pool being registered in the limit check so registering
the final pool installs STACK_DEPOT_POISON and prevents the extra
allocation.

Link: https://lore.kernel.org/20261022083330.3159793-1-matt@readmodwrite.com
Fixes: 31639fd6cebd ("stackdepot: use variable size records for non-evictable entries")
Signed-off-by: Caleb Kan <ckan@cloudflare.com>
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc: Caleb Kan <calebkan1106@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/stackdepot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index de0b0025af2b94..b20f4db5c83f63 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -322,7 +322,7 @@ static bool depot_init_pool(void **prealloc)
 	 * NULL; do not reset to NULL if we have reached the maximum number of
 	 * pools.
 	 */
-	if (pools_num < stack_max_pools)
+	if (pools_num + 1 < stack_max_pools)
 		WRITE_ONCE(new_pool, NULL);
 	else
 		WRITE_ONCE(new_pool, STACK_DEPOT_POISON);

From 03ea1f756ecf84d05f923940583ea20691c825f5 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Thu, 22 Oct 2026 17:08:42 +0800
Subject: [PATCH 1743/1982] ocfs2: snapshot the dentry name while tracing file
 release

[ Upstream commit 5898987d4a92b70ae73fd8355cc3a388b4dfa4e6 ]

ocfs2_file_release() passes the live dentry name and length to a trace
event while holding oi->ip_lock. This lock protects the open count and
delays RCU reclamation of external names, but it does not serialize name
changes during rename. The dentry can switch between inline and external
names, and a separately loaded length can describe a different name.

The ocfs2__file_ops event sizes and copies its __string separately.
A concurrently rewritten inline name need not remain consistent between
those operations. External names can also be selected at this call site;
the existing spinlock critical section protects their allocation lifetime,
while a snapshot additionally pairs a stable name with its length.

Take a name snapshot before acquiring oi->ip_lock and release it after
dropping the lock. Keep the trace call and open-count argument inside
the original critical section. Cache the event-enabled check so the
snapshot stays paired even if tracing is toggled meanwhile.

Link: https://lore.kernel.org/pm-ocfs2-objects-candidate-0088-v7-6324344256f0c3b1c3d8-2@gmail.com
Fixes: 468eedde23d6 ("ocfs2: Remove mlog(0) from fs/ocfs2/file.c")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/file.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index a0df92a23498aa..f4c36ce1678d06 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -140,18 +140,26 @@ static int ocfs2_file_open(struct inode *inode, struct file *file)
 static int ocfs2_file_release(struct inode *inode, struct file *file)
 {
 	struct ocfs2_inode_info *oi = OCFS2_I(inode);
+	struct dentry *dentry = file->f_path.dentry;
+	struct name_snapshot name;
+	bool trace_enabled = trace_ocfs2_file_release_enabled();
+
+	if (trace_enabled)
+		take_dentry_name_snapshot(&name, dentry);
 
 	spin_lock(&oi->ip_lock);
 	if (!--oi->ip_open_count)
 		oi->ip_flags &= ~OCFS2_INODE_OPEN_DIRECT;
 
-	trace_ocfs2_file_release(inode, file, file->f_path.dentry,
-				 oi->ip_blkno,
-				 file->f_path.dentry->d_name.len,
-				 file->f_path.dentry->d_name.name,
-				 oi->ip_open_count);
+	if (trace_enabled)
+		trace_ocfs2_file_release(inode, file, dentry,
+					 oi->ip_blkno, name.name.len,
+					 name.name.name, oi->ip_open_count);
 	spin_unlock(&oi->ip_lock);
 
+	if (trace_enabled)
+		release_dentry_name_snapshot(&name);
+
 	ocfs2_free_file_private(inode, file);
 
 	return 0;

From fa5ee143d0e6fa86c7173d4e6389f2b4bbd075a5 Mon Sep 17 00:00:00 2001
From: Cen Zhang <zzzccc427@gmail.com>
Date: Tue, 20 Oct 2026 21:12:50 +0800
Subject: [PATCH 1744/1982] ocfs2/cluster: remove zero-address nodes from IP
 tree on teardown

[ Upstream commit 5dd57e77eff4ba3e85b3df126a55417c88245708 ]

o2nm_node_ipv4_address_store() accepts 0.0.0.0. It sets
O2NM_NODE_ATTR_ADDRESS and links nd_ip_node into cl_node_ip_tree under
cl_nodes_lock, but o2nm_node_group_drop_item() uses nd_ipv4_address as a
membership test. A zero address therefore leaves the rbtree node linked
when config_item_put() releases and frees struct o2nm_node. A later
address store or IP lookup can then walk the stale node and dereference
freed memory.

During teardown, drop_item takes cl_nodes_lock, skips rb_erase()
for the zero key, and then calls config_item_put(). A later
o2nm_node_ipv4_address_store() duplicate check or o2nm_get_node_by_ip()
lookup takes the same lock and walks the stale cl_node_ip_tree entry. Use
O2NM_NODE_ATTR_ADDRESS for teardown so every published nd_ip_node is
erased before configfs can release the node, without rejecting 0.0.0.0
or changing lookup semantics.

Link: https://lore.kernel.org/pm-ocfs2-node-ip-rbtree-zero-address-uaf-v5-e7f64be16b7c3b0988d1@gmail.com
Fixes: 0c83ed8eeb28 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Assisted-by: LLM
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <jjzuming@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/cluster/nodemanager.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index 87aeb1a7a90aef..bfc7c0fb2be059 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -626,8 +626,11 @@ static void o2nm_node_group_drop_item(struct config_group *group,
 
 	write_lock(&cluster->cl_nodes_lock);
 
-	/* XXX sloppy */
-	if (node->nd_ipv4_address)
+	/*
+	 * 0.0.0.0 is a valid configured address, so nd_ipv4_address does
+	 * not tell us whether nd_ip_node was published in the IP tree.
+	 */
+	if (test_bit(O2NM_NODE_ATTR_ADDRESS, &node->nd_set_attributes))
 		rb_erase(&node->nd_ip_node, &cluster->cl_node_ip_tree);
 
 	/* nd_num might be 0 if the node number hasn't been set.. */

From 1b6f6cf3a78dffe7588155884edd9f3ea06ac8ea Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Thu, 15 Oct 2026 18:07:11 +0200
Subject: [PATCH 1745/1982] mm/hugetlb: don't clear the resv_map of a VMA whose
 lock is held

[ Upstream commit d42032c0fe3ca007986c1229128775af0340fbec ]

Since commit bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private
VMAs") the lock of a private hugetlb VMA that owns a reservation is the
rw_sema of its resv_map.  The hugetlb_vma_*lock*() helpers find it through
vma->vm_private_data, anew for every lock and every unlock.

At the end of mremap() the old VMA has to let go of the resv_map, which
now belongs to the new VMA: clear_vma_resv_huge_pages() stores NULL into
vm_private_data.  mremap() holds mmap_lock for writing and has write
locked the VMA, which keeps away everybody who comes through the mm.  It
does not keep away those who find the VMA through the file.  For hole
punch and truncation hugetlb_vmdelete_list() does

	hugetlb_vma_trylock_write(vma);		locks resv_map->rw_sema
	unmap_hugepage_range(vma, ...);
						vm_private_data = NULL
	hugetlb_vma_unlock_write(vma);		no resv_map: does nothing

and the rw_sema stays write locked for ever:

  WARNING: lock held when returning to user space!
  mremap_punch/116 is leaving the kernel with locks still held!
  locks held by mremap_punch/116: 1, last CPU#1:
   #0: (&resv_map->rw_sema){+.+.}-{4:4}, at:
                                       hugetlb_vmdelete_list+0x46/0x160

The next fault in the new VMA sleeps in hugetlb_vma_lock_read(),
uninterruptibly, and it holds its entry of hugetlb_fault_mutex_table[].
That table is global, so a fault of any other process on a page that
hashes to the same entry sleeps uninterruptibly as well.

All those who take the lock of a private VMA without taking the mmap/vma
lock are affected: rmap walks. So hold i_mmap_rwsem around the clearing
of the resv_map.

No change of behaviour, other than that mremap() of a hugetlb VMA takes
i_mmap_rwsem once more.

Original fix generated by an LLM and sent in private by Josef.

[david: avoid local variable, move and refine comment, description cleanups+simplifications]
Link: https://lore.kernel.org/20261015-urgent_fixes-v1-5-42796911043b@kernel.org
Fixes: bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chris Mason <mason@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 8832923dfbcd8f..ed4fb48cb35b80 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -8054,6 +8054,15 @@ void hugetlb_unshare_all_pmds(struct vm_area_struct *vma)
  */
 void fixup_hugetlb_reservations(struct vm_area_struct *vma)
 {
-	if (is_vm_hugetlb_page(vma))
-		clear_vma_resv_huge_pages(vma);
+	if (!is_vm_hugetlb_page(vma))
+		return;
+
+	/*
+	 * Rmap walks might still find this VMA and take the lock
+	 * inside the reservation map for __vma_private_lock(). Don't clear
+	 * the reservation map while that is possible.
+	 */
+	i_mmap_lock_write(vma->vm_file->f_mapping);
+	clear_vma_resv_huge_pages(vma);
+	i_mmap_unlock_write(vma->vm_file->f_mapping);
 }

From fb307eadea56944075197c1d34905b458cf561f1 Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <david@kernel.org>
Date: Thu, 15 Oct 2026 18:07:16 +0200
Subject: [PATCH 1746/1982] mm/mremap: fix calling fixup_hugetlb_reservations()
 on the wrong VMA

[ Upstream commit cc078ca0b5b79b4a9e514b7f1b489f2afc83b195 ]

In case we fail to move the page tables, for example, because we fail
to allocate a page table, we actually keep the old VMA.

Calling fixup_hugetlb_reservations() on the old VMA is wrong. Fix it
by just calling it on the VMA that will be removed.

The user-visible impact is that the VMA loses its reservations, meaning
that the existing reservations get stranded (leaked) and new hugetlb folios
that are getting allocated in the VMA cannot make use of the
reservations, failing these allocations.

Link: https://lore.kernel.org/20261015-urgent_fixes-v1-10-42796911043b@kernel.org
Fixes: b714ccb02a76 ("mm/mremap: complete refactor of move_vma()")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Adam Litke <agl@us.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@surriel.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mremap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index f0e63d3b3c1480..f023b05dfb3d94 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1245,7 +1245,7 @@ static int copy_vma_and_data(struct vma_remap_struct *vrm,
 		mremap_userfaultfd_prep(new_vma, vrm->uf);
 	}
 
-	fixup_hugetlb_reservations(vma);
+	fixup_hugetlb_reservations(vrm->vma);
 
 	*new_vma_ptr = new_vma;
 	return err;

From 7ea08a7ca9e1612b6615487c1e536a98b01f6f56 Mon Sep 17 00:00:00 2001
From: Hongfu Li <lihongfu@kylinos.cn>
Date: Wed, 23 Sep 2026 10:05:15 +0800
Subject: [PATCH 1747/1982] mm/hugetlb: account migration target folio in
 per-node NR_HUGETLB vmstat

[ Upstream commit 92635a3ffe8bb48304f50625dd591a27d7505698 ]

Patch series "mm: fix hugetlb NR_HUGETLB accounting on folio migration", v2.

The hugeTLB counters added by 05d4532b60e3 ("memcg/hugetlb: add hugeTLB
counters to memcg") are maintained in two per-node places:
  - the per-node vmstat counter NR_HUGETLB, exposed as nr_hugetlb in
    /proc/vmstat;
  - the per-node memcg lruvec stat, exposed via memory.numa_stat.

Both are accounted against the folio's node, and both drift when a hugetlb
folio is migrated, though in different ways.

A migration target folio is allocated by alloc_hugetlb_folio_nodemask()
and inherits the old folio's state without ever being accounted, while the
old folio is freed right after and its free is accounted.  That alone
loses vmstat accounting: the target node has no matching increment for the
decrement on the old node, so /proc/vmstat's nr_hugetlb shrinks by
nr_pages per migration.  Patch 1 accounts the folio where it is obtained,
so the increment pairs with the free in free_huge_folio() on the
successful as well as the failed migration path.  The memfd page cache
preallocation helper has the same asymmetry and is fixed in the same
patch.

The per-node lruvec stat breaks differently.  mem_cgroup_migrate() moves
the charge to the new folio and drops the old folio's memcg data, so the
old folio's free right after migration skips the memcg per-node decrement;
the count stays attributed to the old node for the rest of the charge's
life, and the target folio never gets an increment on its new node.  Patch
2 moves that per-node accounting along with the charge, in
move_hugetlb_state().

This patch (of 2):

The NR_HUGETLB vmstat counter is maintained per folio's node: incremented
when a huge page is handed to a user via hugetlb_alloc_folio() and
decremented when it is returned to the pool via free_huge_folio().

A folio obtained by alloc_hugetlb_folio_nodemask() never goes through
hugetlb_alloc_folio(), so it is never accounted, while its free always is.
For a migration target this means the target node gets no matching
increment for the decrement on the old node, so the global nr_hugetlb in
/proc/vmstat drops by nr_pages for each migration.  The same asymmetry
affects the failed migration path, which frees the target again right
away, and the temporary folio hugetlb_mfill_atomic_pte() takes from the
same helper.

alloc_hugetlb_folio_reserve(), used to preallocate the memfd page cache
folios, has the same asymmetry: the folio is handed to a user without
being accounted, while its free is accounted through free_huge_folio().

Account the folio where it is obtained, in alloc_hugetlb_folio_nodemask()
and alloc_hugetlb_folio_reserve(), so that the increment pairs with the
decrement in free_huge_folio(): a successful migration hands the folio to
a user, a failed one frees it again.

Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-0-e8a36245bfab@kylinos.cn
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-1-e8a36245bfab@kylinos.cn
Fixes: 05d4532b60e3 ("memcg/hugetlb: add hugeTLB counters to memcg")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb.c | 35 +++++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ed4fb48cb35b80..42aace6e3ca171 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2353,6 +2353,11 @@ struct folio *alloc_hugetlb_folio_reserve(struct hstate *h, int preferred_nid,
 		h->resv_huge_pages--;
 
 	spin_unlock_irq(&hugetlb_lock);
+
+	if (folio)
+		lruvec_stat_mod_folio(folio, NR_HUGETLB,
+				      folio_nr_pages(folio));
+
 	return folio;
 }
 
@@ -2360,24 +2365,30 @@ struct folio *alloc_hugetlb_folio_reserve(struct hstate *h, int preferred_nid,
 struct folio *alloc_hugetlb_folio_nodemask(struct hstate *h, int preferred_nid,
 		nodemask_t *nmask, gfp_t gfp_mask, bool allow_alloc_fallback)
 {
-	spin_lock_irq(&hugetlb_lock);
-	if (available_huge_pages(h)) {
-		struct folio *folio;
+	struct folio *folio = NULL;
 
+	spin_lock_irq(&hugetlb_lock);
+	if (available_huge_pages(h))
 		folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask,
 						preferred_nid, nmask);
-		if (folio) {
-			spin_unlock_irq(&hugetlb_lock);
-			return folio;
-		}
-	}
 	spin_unlock_irq(&hugetlb_lock);
 
-	/* We cannot fallback to other nodes, as we could break the per-node pool. */
-	if (!allow_alloc_fallback)
-		gfp_mask |= __GFP_THISNODE;
+	if (!folio) {
+		/*
+		 * We cannot fallback to other nodes, as we could break the
+		 * per-node pool.
+		 */
+		if (!allow_alloc_fallback)
+			gfp_mask |= __GFP_THISNODE;
 
-	return alloc_migrate_hugetlb_folio(h, gfp_mask, preferred_nid, nmask);
+		folio = alloc_migrate_hugetlb_folio(h, gfp_mask, preferred_nid,
+						    nmask);
+	}
+
+	if (folio)
+		lruvec_stat_mod_folio(folio, NR_HUGETLB, folio_nr_pages(folio));
+
+	return folio;
 }
 
 static nodemask_t *policy_mbind_nodemask(gfp_t gfp)

From e9d4d0f7d9ca54980fa989280ea75cbed3190c99 Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Arm)" <david@kernel.org>
Date: Tue, 13 Oct 2026 13:41:24 +0200
Subject: [PATCH 1748/1982] mm: disallow ioremap'ing ordinary RAM in
 generic_access_phys()

[ Upstream commit 4590752e20aa393cc0d4fe538c0747d14a98c97a ]

generic_access_phys() can end up getting called on CoW PFNMAP mappings,
resulting in it trying to ioremap anonymous folios, which especially
the x86 code doesn't enjoy, and which is in general just odd/wrong.

E.g., with a CoW mapping of a PCI BAR:

ioremap on RAM at 0x0000000045623000 - 0x0000000045623fff
  WARNING: arch/x86/mm/ioremap.c:216 at __ioremap_caller.isra.0+0x4c2/0x5f0
  Call Trace:
   generic_access_phys+0x130/0x4d0 mm/memory.c:7178
   kernfs_vma_access+0x1ce/0x280 fs/kernfs/file.c:437
   __access_remote_vm+0x58f/0x890 mm/memory.c:7256
   mem_rw+0x2a1/0x670 fs/proc/base.c:912

But more generically, we should disallow access to anything that looks
like ordinary RAM in the system: including allocating memory (e.g.,
alloc_pages) and mapping them in a VM_PFNMAP.

For pages with an online memmap, allow only pages marked as reserved
(PageReserved). This also includes memblock allocations, however,
distinguishing them from other MMIO is tricky, and nobody should really
be mapping them in a PFNMAP (except someone abusing /dev/mem, which we
do not care about).

So only allow access if there is no online memmap, or if the pages are
marked reserved. Reject other pages with -EINVAL.

Note that, just like other pfn_to_online_page() users, we won't care about
concurrent memory offlining; mapping memory that can concurrently get
offlined is highly dubious.

Link: https://lore.kernel.org/20261013-generic_access_phys-v1-1-b3963ef76e37@kernel.org
Fixes: 28b2ee20c7cb ("access_process_vm device memory infrastructure")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <syzbot+49b1021becba70c1f3f6@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=49b1021becba70c1f3f6
Reported-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Closes: https://lore.kernel.org/r/20261001152524.171115-1-ngocthang2710.1999@gmail.com/
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Rik van Riel <riel@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memory.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index d755b5c1f12876..01d14ca0e74d23 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -6808,6 +6808,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
 	resource_size_t phys_addr;
 	pgprot_t prot = __pgprot(0);
 	void __iomem *maddr;
+	struct page *page;
 	int offset = offset_in_page(addr);
 	int ret = -EINVAL;
 	bool writable;
@@ -6822,6 +6823,19 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
 retry:
 	if (follow_pfnmap_start(&args))
 		return -EINVAL;
+
+	/*
+	 * Reject anything that looks like ordinary RAM, including anonymous
+	 * folios in CoW mappings or allocated kernel memory. Note that we
+	 * cannot distinguish memblock allocations from non-RAM reliably, so
+	 * we cannot easily reject them here.
+	 */
+	page = pfn_to_online_page(args.pfn);
+	if (page && !PageReserved(page)) {
+		follow_pfnmap_end(&args);
+		return -EINVAL;
+	}
+
 	prot = args.pgprot;
 	phys_addr = (resource_size_t)args.pfn << PAGE_SHIFT;
 	writable = args.writable;

From 6dddcb5b8bf84da259ab32cc372d0465537097d0 Mon Sep 17 00:00:00 2001
From: Wei Yang <albinwyang@tencent.com>
Date: Sat, 10 Oct 2026 10:40:42 +0800
Subject: [PATCH 1749/1982] mm/madvise: add cond_resched() in THP branch of
 madvise_cold_or_pageout_pte_range()

[ Upstream commit f5cfc8e3b20ad71949a1e5623ff45882c063a71b ]

During stress testing with stress-ng on a 256-CPU system, a softlockup was
observed when madvise(MADV_COLD) was called on a 31GB memory region backed
by transparent hugepages.  The region contains 15935 THP PMD entries, and
the softlockup was triggered after 14485 of them had been processed.

The THP branch of madvise_cold_or_pageout_pte_range() has no scheduling
point.  walk_pmd_range() invokes it once per 2MB PMD entry with no
cond_resched() anywhere in the loop.  Each iteration calls
pmdp_invalidate() which issues a synchronous TLB shootdown (dsb ish)
waiting for all CPUs to acknowledge.  This operation can be time-consuming
under heavy system load, causing the accumulated time across all PMD
entries to exceed the softlockup threshold (20s) and panic when
softlockup_panic=1.  On a CONFIG_PREEMPT_NONE=y kernel, there is no other
opportunity to reschedule during this entire traversal.

The regular PTE path already has an unconditional cond_resched() at the
function tail (introduced by commit 9c276cc65a58 ("mm: introduce
MADV_COLD") and commit 1a4e58cce84e ("mm: introduce MADV_PAGEOUT") when
MADV_COLD and MADV_PAGEOUT were first introduced) and a conditional one
inside the loop (commit b2f557a21bc8 ("mm/madvise: add cond_resched() in
madvise_cold_or_pageout_pte_range()")).  The THP branch never received
equivalent treatment.

Fix by adding cond_resched() at the huge_unlock exit path after
spin_unlock(ptl) and reclaim_pages(), which is the single exit point for
all goto paths in the THP branch.

Crash log:
  watchdog: BUG: soft lockup - CPU#63 stuck for 23s! [stress-ng-vm:1665914]
  ...
  Call trace:
  pmdp_invalidate+0x48/0x68
  madvise_cold_or_pageout_pte_range+0x84c/0xb00
  walk_pmd_range.isra.0+0x1ac/0x3b0
  walk_pud_range+0x120/0x190
  walk_pgd_range+0x170/0x1b8
  __walk_page_range+0x184/0x198
  walk_page_range_vma+0x94/0x128
  madvise_cold+0xd8/0x198
  madvise_vma_behavior+0x234/0x638
  madvise_walk_vmas.constprop.0+0xdc/0x210
  madvise_do_behavior+0xa8/0x328
  do_madvise+0xd8/0x140
  __arm64_sys_madvise+0x2c/0xe0

Link: https://lore.kernel.org/20261010024042.4070048-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/madvise.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/madvise.c b/mm/madvise.c
index 505a580cd9c4ca..bb02220e1959b0 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -452,6 +452,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 		spin_unlock(ptl);
 		if (pageout)
 			reclaim_pages(&folio_list);
+		cond_resched();
 		return 0;
 	}
 

From fe6e1017449126be6ae477483945c31ea1b0a03e Mon Sep 17 00:00:00 2001
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date: Wed, 14 Oct 2026 09:13:58 -0400
Subject: [PATCH 1750/1982] mm/mlock: use a long for the page count in
 mlock_fixup()

[ Upstream commit 3ae91e3079b1504ef162b2884454d5f1421f4eb9 ]

mlock_fixup() adjusts mm->locked_vm, an unsigned long, by the number of
pages whose VM_LOCKED state it changes, but computes that number in an
int:

	int nr_pages;
	...
	nr_pages = (end - start) >> PAGE_SHIFT;
	...
	mm->locked_vm += nr_pages;

When a single VMA range of 2^31 pages (8 TiB with 4 KiB pages) or more
is locked or unlocked, the count is truncated to 32 bits and then
sign-extended, so locked_vm is changed by the wrong amount, while
munmap(), mremap() and the other paths that maintain locked_vm use the
full unsigned long page count.

Such a range is reachable on 64-bit architectures with a 47-bit or
larger user address space (x86_64, arm64 with 48-bit VA, riscv64 Sv48)
by a task with CAP_IPC_LOCK or a raised RLIMIT_MEMLOCK, which do_mlock()
checks against the full untruncated length.  It costs nothing with
MAP_NORESERVE and MLOCK_ONFAULT/MCL_ONFAULT, since then no page is
populated.  On x86_64, after

	p = mmap(NULL, 8UL << 40, PROT_READ | PROT_WRITE,
		 MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
	mlock2(p, 8UL << 40, MLOCK_ONFAULT);

VmLck in /proc/self/status reads 18446744065119617024 kB instead of
8589934592 kB; munmap() of the region then subtracts the true size and
leaves VmLck at 18446744056529682432 kB instead of 0.  With 16 TiB,
locked_vm is not changed at all, VmLck stays 0 kB, and after the task
drops CAP_IPC_LOCK or lowers RLIMIT_MEMLOCK, mlock(), mmap(MAP_LOCKED)
and the other mlock_future_ok() and account_locked_vm() users enforce
RLIMIT_MEMLOCK against that count, so they let the task lock memory
beyond its limit (or, in the 8 TiB case, refuse every further lock).
The error persists for the life of the mm; unlocking the range in pieces
skews it further.  The wrong count is per-mm accounting only: it does
not change which pages are locked.

The int has been there since before git history (the variable was named
"pages" until it was renamed in 2.6.28); every other updater of
locked_vm uses an unsigned long or long count.  Make nr_pages a long,
which holds the page count of any user range and its negation, so the
existing sign handling is unchanged.

Found by formal verification of mm/mlock.c against the kernel binary.

Link: https://lore.kernel.org/20261014131358.780240-1-nickolai@csail.mit.edu
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Assisted-by: LLM
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mlock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mlock.c b/mm/mlock.c
index 31045f17766a7d..20061dd2815020 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -468,7 +468,7 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
 	       unsigned long end, vm_flags_t newflags)
 {
 	struct mm_struct *mm = vma->vm_mm;
-	int nr_pages;
+	long nr_pages;
 	int ret = 0;
 	vm_flags_t oldflags = vma->vm_flags;
 

From 87f6bb4b82ac4334ff4b5ff0becff9690fe39911 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <cenzhang@linux.microsoft.com>
Date: Mon, 12 Oct 2026 16:15:14 -0400
Subject: [PATCH 1751/1982] userfaultfd: fix UFFDIO_MOVE livelock on large
 folio with extra references

[ Upstream commit 454143aeb4c6c85ca7d50df36d1a66a64d88283e ]

To move one page out of a large folio, move_pages_ptes() first has to
split the folio.  __folio_split() refuses if the folio has any reference
beyond its page table mappings and the caller's own, and it reports the
refusal as -EAGAIN.  move_pages() treats returned -EAGAIN as a transient
race and keeps retrying the same address, holding the VMA read locks the
whole time.  This is incorrect since in some cases userspace can hold such
a reference indefinitely, such as by registering the page as an io_uring
buffer.

An unprivileged user can trigger this with three threads: first holds such
a reference on a page of a THP, second calls UFFDIO_MOVE on another page
of the same THP and spins in the kernel forever holding the VMA read
locks, and third calls fork() or mprotect(), which takes mmap_lock for
writing and then waits forever for those read locks.  From then on every
mmap_lock user of that mm hangs, including other processes inspecting it
through /proc/<pid>/, until the process is SIGKILLed.  The hung task
detector reports the blocked tasks (third one), and with
kernel.hung_task_panic=1 the machine panics:

  INFO: task wedge:95 blocked for more than 122 seconds.
  task:wedge  state:D stack:12528 pid:95 tgid:95 ppid:94
  Call Trace:
   __schedule+0x596/0x1110
   schedule+0x36/0xf0
   __vma_start_exclude_readers+0x100/0x170
   __vma_start_write+0x51/0xd0
   __split_vma+0x208/0x3d0
   vma_modify+0x6a8/0x840
   vma_modify_flags+0xce/0x110
   mprotect_fixup+0xbe/0x480
   do_mprotect_pkey+0x2d9/0x580
   __x64_sys_mprotect+0x1a/0x30

Fix by returning -EBUSY instead of -EAGAIN in move_pages_ptes(), the
caller of split_folio(), when the split fails.  Thus, move_pages() does
not retry -EBUSY and the ioctl drops its locks and returns to userspace
instead of spinning.

Link: https://lore.kernel.org/20261012201514.97015-1-cenzhang@linux.microsoft.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <AutonomousCodeSecurity@microsoft.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <tgopinath@linux.microsoft.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/userfaultfd.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 34798ce783e6c7..579445bddf5614 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1414,8 +1414,12 @@ static long move_pages_ptes(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd
 			pte_unmap(dst_pte);
 			src_pte = dst_pte = NULL;
 			ret = split_folio(src_folio);
-			if (ret)
+			if (ret) {
+				/* do not retry, extra refs may be held forever */
+				if (ret == -EAGAIN)
+					ret = -EBUSY;
 				goto out;
+			}
 			/* have to reacquire the folio after it got split */
 			folio_unlock(src_folio);
 			folio_put(src_folio);

From 695d0c95c13f678acddc6912f6b711a29cbcbf3b Mon Sep 17 00:00:00 2001
From: "Harry Yoo (Meta)" <harry@kernel.org>
Date: Tue, 13 Oct 2026 20:34:39 +0100
Subject: [PATCH 1752/1982] mm/percpu: account full object size for percpu
 memory allocations

[ Upstream commit c7a467fbcbbc31e57a5077bfc9456d9f29cb1571 ]

When memory allocation profiling is enabled, the pages backing percpu
memory chunks are attributed to func:pcpu_alloc_pages.  However, the
accounting of individual percpu memory allocations via alloc_percpu()
and friends record only the size of a single object rather than its
full size across all CPUs.

As a result, it is often not straightforward to identify which kernel code
is actually responsible for percpu memory, because the size is
under-accounted by a factor of num_possible_cpus().

Account full object size with pcpu_obj_full_size(size) instead, which
multiplies the object size by num_possible_cpus() and adds the objcg
pointer overhead.  This is consistent with what memcg already does for
charging percpu allocations.

Verified with 64-CPU VM by spawning 400 processes in a memory cgroup and
measuring mm_init()'s rss_stat counters.

Delta of kernel/fork.c:1142 func:mm_init in /proc/allocinfo:

                  bytes   calls   per allocation
    unpatched      6320     395         16
    patched      418176     396       1056

'percpu' field in memory.stat: 422400 (1056 bytes per process)

Memory allocation profiling now accounts the same amount of memory as
what memcg charges.

Link: https://lore.kernel.org/20261013-fix-alloc-percpu-accounting-v1-1-03e788a1e41f@kernel.org
Fixes: 60fa4a9e2323 ("mm: percpu: add codetag reference into pcpuobj_ext")
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Assisted-by: LLM # Verification
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Hao Ge <hao.ge@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/percpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/percpu.c b/mm/percpu.c
index 81462ce5866e16..32519523845b3b 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1692,14 +1692,15 @@ static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
 {
 	if (mem_alloc_profiling_enabled() && likely(chunk->obj_exts)) {
 		alloc_tag_add(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag,
-			      current->alloc_tag, size);
+			      current->alloc_tag, pcpu_obj_full_size(size));
 	}
 }
 
 static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
 {
 	if (mem_alloc_profiling_enabled() && likely(chunk->obj_exts))
-		alloc_tag_sub(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag, size);
+		alloc_tag_sub(&chunk->obj_exts[off >> PCPU_MIN_ALLOC_SHIFT].tag,
+			      pcpu_obj_full_size(size));
 }
 #else
 static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,

From be6be6707c2953dc4ee979e7e4605fe436d87429 Mon Sep 17 00:00:00 2001
From: Pedro Falcato <pfalcato@suse.de>
Date: Tue, 13 Oct 2026 20:17:19 +0100
Subject: [PATCH 1753/1982] mm/madvise: atomically clear the young bit on THP
 MADV_COLD

[ Upstream commit 246c8cc33438a71c28f9b86baa492d9a0a130316 ]

As-is, madvise_cold_or_pageout_pte_range() discards the hardware young bit
by invalidating the PMD, doing pmd_mkold() and subsequently writing to the
pmd again.  However, it does so in a racy manner, looking at a
possibly-stale snapshot.  It's entirely possible that a write elsewhere
set the hardware D bit, which this logic now loses.

Fix it by using pmdp_test_and_clear_young().  This is an atomic
modification of the PMD entry, and thus safe against any possible racing
writes.  As a (nice) side-effect, this elides one non-required TLB flush
in pmdp_invalidate().

This bug can interact with the swapping system in complicated ways,
leading to data loss.  For instance, if a folio is marked lazyfree, but
was later read from, and then MADV_COLD'd while racing a write to that
same THP, dropping the dirty bit may lead to data loss as
reclaim/MADV_PAGEOUT drops the "clean" anon folio:

T0                                T1
================================================================
MADV_FREE(thp)			|
  folio marked lazyfree		|
read(thp)			|
  PMD marked young by hardware	|
				| MADV_COLD(thp)
write(thp)			|   if (pmd_young(pmd)) {
  PMD marked dirty by hardware	|     set(pmdp, pmd_mkold(pmd));
MADV_PAGEOUT/reclaim		|
  dirty bit may or may not be   |
  set				|
    reclaim/pageout may drop    |
    the folio			|

Link: https://lore.kernel.org/20261013191719.95502-1-pfalcato@suse.de
Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Samarth Narang <samarth.colleges@gmail.com>
Closes: https://lore.kernel.org/linux-mm/20261011132227.413217-1-samarth.colleges@gmail.com/
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/madvise.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index bb02220e1959b0..729d8f2f07fd83 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -428,10 +428,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 		}
 
 		if (!pageout && pmd_young(orig_pmd)) {
-			pmdp_invalidate(vma, addr, pmd);
-			orig_pmd = pmd_mkold(orig_pmd);
-
-			set_pmd_at(mm, addr, pmd, orig_pmd);
+			pmdp_test_and_clear_young(vma, addr, pmd);
 			tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
 		}
 

From 1900cb4401985376b3bf98dd54b97fa42688cf58 Mon Sep 17 00:00:00 2001
From: Weilin Tong <tongweilin@linux.alibaba.com>
Date: Wed, 14 Oct 2026 16:22:18 +0800
Subject: [PATCH 1754/1982] ipc/shm: fix RSS accounting for hugetlb shared
 memory

[ Upstream commit e387ebe5cd31720b1e0281fd045be4eef36fadb3 ]

Commit a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in
filemap.c") changed mapping->nrpages to count base pages for hugetlb
folios.  However, shm_add_rss_swap() still multiplies it by
pages_per_huge_page(), overcounting RSS in both SHM_INFO and
/proc/sysvipc/shm.

Use mapping->nrpages for RSS accounting across all backing types, and
account swap only for non-hugetlb shmem.  Use READ_ONCE() for both
counters instead of info->lock, which does not protect nrpages and cannot
provide a consistent snapshot.

Link: https://lore.kernel.org/20261014082218.2236088-1-tongweilin@linux.alibaba.com
Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
Signed-off-by: Weilin Tong <tongweilin@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/shm.c | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/ipc/shm.c b/ipc/shm.c
index c77a6c8683ce92..2f5cee0c78c7db 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -936,26 +936,11 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
 static void shm_add_rss_swap(struct shmid_kernel *shp,
 	unsigned long *rss_add, unsigned long *swp_add)
 {
-	struct inode *inode;
+	struct inode *inode = file_inode(shp->shm_file);
 
-	inode = file_inode(shp->shm_file);
-
-	if (is_file_hugepages(shp->shm_file)) {
-		struct address_space *mapping = inode->i_mapping;
-		struct hstate *h = hstate_file(shp->shm_file);
-		*rss_add += pages_per_huge_page(h) * mapping->nrpages;
-	} else {
-#ifdef CONFIG_SHMEM
-		struct shmem_inode_info *info = SHMEM_I(inode);
-
-		spin_lock_irq(&info->lock);
-		*rss_add += inode->i_mapping->nrpages;
-		*swp_add += info->swapped;
-		spin_unlock_irq(&info->lock);
-#else
-		*rss_add += inode->i_mapping->nrpages;
-#endif
-	}
+	*rss_add += READ_ONCE(inode->i_mapping->nrpages);
+	if (IS_ENABLED(CONFIG_SHMEM) && !is_file_hugepages(shp->shm_file))
+		*swp_add += READ_ONCE(SHMEM_I(inode)->swapped);
 }
 
 /*

From f48ad207e5b617d990382053cfabe8414eb79f77 Mon Sep 17 00:00:00 2001
From: Vernon Yang <yanglincheng@kylinos.cn>
Date: Mon, 12 Oct 2026 10:29:17 +0800
Subject: [PATCH 1755/1982] mm: vmscan: don't count per-node proactive reclaim
 as memory pressure

[ Upstream commit 2ca8b38962f239b17f7881a4710c11328ce38ac9 ]

When the cgroup has no memory pressure at all, writing to
/sys/devices/system/nodeX/reclaim triggers proactive reclaim on
NUMA node, causing increase in the writer cgroup's memory PSI.

Due to this reclaim is performed in the context of the write(),
accounted as memory pressure on the writer, like
commit e22c6ed90aa9 ("mm: memcontrol: don't count limit-setting reclaim
as memory pressure"). This is unexpected, the similar scenarios (e.g.
senpai) will continue to occur, only this time it is for the
/sys/devices/system/nodeX/reclaim knob.

The Documentation/ABI/stable/sysfs-devices-node documentation also
notes that "This interface is equivalent to the memcg variant."

This patch unifies the semantics of the memcg and node interfaces:
per-node proactive reclaim is no longer counted as memory pressure,
and the per-node proactive reclaim interface no longer produces
phantom pressure.

I ran demo[1] that performs per-node proactive reclaim 10000 times
in qemu, writer cgroup memory.pressure as follows:

without patch:

some avg10=31.53 avg60=13.42 avg300=3.31 total=10602985
full avg10=31.53 avg60=13.42 avg300=3.31 total=10602985

with patch:

some avg10=9.59 avg60=3.41 avg300=0.81 total=2686221
full avg10=9.59 avg60=3.41 avg300=0.81 total=2686221

Link: https://lore.kernel.org/20261012022917.1102467-1-vernon2gm@gmail.com
Link: https://github.com/vernon2gh/app_and_module/tree/main/reclaim_node_psi [1]
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmscan.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index c983815bde5bfc..6d53f83e9dbcfc 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -7642,7 +7642,8 @@ static unsigned long __node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask,
 					   sc->gfp_mask);
 
 	cond_resched();
-	psi_memstall_enter(&pflags);
+	if (!sc->proactive)
+		psi_memstall_enter(&pflags);
 	delayacct_freepages_start();
 	fs_reclaim_acquire(sc->gfp_mask);
 	/*
@@ -7666,7 +7667,8 @@ static unsigned long __node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask,
 	memalloc_noreclaim_restore(noreclaim_flag);
 	fs_reclaim_release(sc->gfp_mask);
 	delayacct_freepages_end();
-	psi_memstall_leave(&pflags);
+	if (!sc->proactive)
+		psi_memstall_leave(&pflags);
 
 	trace_mm_vmscan_node_reclaim_end(sc->nr_reclaimed);
 

From 98e52d6946a95a28cc59605d97de364bdcd7691f Mon Sep 17 00:00:00 2001
From: Jiayuan Chen <jiayuan.chen@shopee.com>
Date: Thu, 15 Oct 2026 14:05:27 +0800
Subject: [PATCH 1756/1982] mm/swap: fix swap_cache_get_folio() returning a
 folio that left the swap cache

[ Upstream commit 60f34fedf3a4c91ed631ed2f80713ab993cde5ee ]

swap_cache_get_folio() reads the folio from the swap table and takes a
reference with folio_try_get(), without any lock.  If the folio is removed
from the swap cache and freed in between, and its memory gets reused,
folio_try_get() still succeeds and we return a page that has nothing to do
with the swap entry:

  CPU 0                                  CPU 1
  do_swap_page()
    swap_cache_get_folio()
      swp_tb = swap_table_get()
      folio = swp_tb_to_folio(swp_tb)
                                         madvise(MADV_DONTNEED)
                                           zap_nonpresent_ptes()
                                             swap_put_entries_direct()
                                               swap_put_entries_cluster()
                                                 __try_to_reclaim_swap()
                                                   swap_cache_del_folio()
                                                   folio_put()   <- freed
                                         page reused, e.g. as an anon
                                         folio of another task
      folio_try_get(folio)               <- succeeds
      return folio
    swap_update_readahead()              <- may clear PG_readahead on it
    folio_lock_or_retry()                <- locks it
    folio_matches_swap_entry() fails, unlock and put

filemap_get_entry() does the same lockless lookup for the page cache, and
after folio_try_get() it rechecks the xarray, because the folio may have
been freed and reused in between.  swap_cache_get_folio() lost that
recheck when the swap cache moved to the swap table.

So CPU 0 writes to a folio it doesn't own: it may clear PG_readahead and
takes the folio lock of someone else's page, before
folio_matches_swap_entry() finds out the folio is not ours.

When the race occurs, a swap fault can acquire a reference to a
physical page that has been freed and reused for an unrelated purpose,
potentially by another process.  The fault handler may then clear that
page's PG_readahead/PG_reclaim flag, wait on or acquire its folio lock,
and potentially attempt to remove it from an unrelated swap cache.

These operations can interfere with unrelated workloads and may cause
unexpected stalls and impaired reclaim.  The subsequent swap-entry
validation normally prevents the wrong folio from being mapped into the
faulting process.

It's documented that caller always double checks the folio so this part
is harmless from the aspect of data corruption or crash.

Recheck the slot after folio_try_get() and retry if it no longer holds
this folio.

[akpm@linux-foundation.org: add LLM-generated description of userspace impact]
Link: https://lore.kernel.org/20261015060528.302634-1-jiayuan.chen@linux.dev
Fixes: 8578e0c00dcf ("mm, swap: use the swap table for the swap cache and switch API")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Kairui Song <kasong@tencent.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/swap_state.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/mm/swap_state.c b/mm/swap_state.c
index b8d7744b4436a0..57cae6f6eac1ee 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -86,17 +86,27 @@ void show_swap_cache_info(void)
  */
 struct folio *swap_cache_get_folio(swp_entry_t entry)
 {
+	struct swap_cluster_info *ci = __swap_entry_to_cluster(entry);
+	unsigned int ci_off = swp_cluster_offset(entry);
 	unsigned long swp_tb;
 	struct folio *folio;
 
 	for (;;) {
-		swp_tb = swap_table_get(__swap_entry_to_cluster(entry),
-					swp_cluster_offset(entry));
+		swp_tb = swap_table_get(ci, ci_off);
 		if (!swp_tb_is_folio(swp_tb))
 			return NULL;
 		folio = swp_tb_to_folio(swp_tb);
-		if (likely(folio_try_get(folio)))
+		if (!folio_try_get(folio))
+			continue;
+		/*
+		 * The folio may have been freed and its memory reused before
+		 * we got the reference. Make sure it is still in the slot.
+		 */
+		swp_tb = swap_table_get(ci, ci_off);
+		if (likely(swp_tb_is_folio(swp_tb) &&
+			   swp_tb_to_folio(swp_tb) == folio))
 			return folio;
+		folio_put(folio);
 	}
 
 	return NULL;

From abdf941e56626dc9a04f3fde86fe8c79ce8c3776 Mon Sep 17 00:00:00 2001
From: Rik van Riel <riel@surriel.com>
Date: Fri, 16 Oct 2026 12:23:04 -0400
Subject: [PATCH 1757/1982] mm/page_alloc: count guard pages as free again when
 their buddy merges

[ Upstream commit 1503710b3b0cec02b531978129c6c1eb70a7c490 ]

With debug_guardpage_minorder set, expand() turns the unused halves of a
split into guard pages, which page_del_and_expand() leaves out of the free
counts.  Freeing the allocated half credits only that half, and
__free_one_page() then merges the guard buddy with clear_page_guard(),
which no longer touches the counters.

The merged block goes on a free list with the guard pages never counted,
so NR_FREE_PAGES falls behind the free lists by every guard that merges.
Before commit e0932b6c1f94 ("mm: page_alloc: consolidate free page
accounting"), __set_page_guard() and __clear_page_guard() adjusted the
counts themselves; that commit dropped both adjustments but kept the
subtraction implicit in expand().

Count the guard pages under the merged block's migratetype when the buddy
is cleared.  account_freepages() skips an isolated block as it does for
every other free page, and moving the block off the isolated list counts
it then.

Booting a 16GB VM with debug_pagealloc=on debug_guardpage_minorder=1,
check the difference in free pages reported between /proc/vmstat and
/proc/buddyinfo.

At three points (idle, after a read and file-creation load, after a second
load), check the difference between nr_free_pages and the buddyinfo
numbers in the normal zone, as a number of pages:

                idle   after load   after second load
    unpatched   -130        79205               99121
    patched      -16           45                   0

The small remaining difference seems to be due to the numbers not being
read at exactly the same time, and is also seen without guard pages.

Link: https://lore.kernel.org/20261016122304.5b1eba8e@fangorn
Fixes: e0932b6c1f94 ("mm: page_alloc: consolidate free page accounting")
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Assisted-by: LLM
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Frank van der Linden <fvdl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index b866357339c56f..8bdc35efad26ba 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1027,10 +1027,12 @@ static inline void __free_one_page(struct page *page,
 		 * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page,
 		 * merge with it and move up one order.
 		 */
-		if (page_is_guard(buddy))
+		if (page_is_guard(buddy)) {
 			clear_page_guard(zone, buddy, order);
-		else
+			account_freepages(zone, 1 << order, migratetype);
+		} else {
 			__del_page_from_free_list(buddy, zone, order, buddy_mt);
+		}
 
 		if (unlikely(buddy_mt != migratetype)) {
 			/*

From 5b040ba4b592f9ccbc7d072767e1be8c545c9f24 Mon Sep 17 00:00:00 2001
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date: Fri, 16 Oct 2026 18:27:21 -0400
Subject: [PATCH 1758/1982] mm/truncate: fix the zeroing end of
 pagecache_isize_extended()

[ Upstream commit 8f9039840588dd618c72a726c192126bb7b98228 ]

A process that extends a file by 4 GiB or more past a dirty folio, on a
file system whose block size is smaller than the page size (ext4 with 1k
blocks), reads back the bytes it wrote through a shared mapping beyond the
old end of file instead of zeroes, and a later write into that block
carries them to the disk.  With the example of commit 52aecaee1c26 ("mm:
zero range of eof folio exposed by inode size extension") and the truncate
taken 4 GiB further (pwrite 2k at 0, mmap the first page and write 'X'
over [2k, 4k), truncate(2) to 4 GiB + 2k), the read of [2k, 4k) returns
the 2048 'X' bytes, and a pwrite of 16 bytes at 3k followed by fsync() and
a remount leaves 1008 'X' bytes on the disk in [3k+16, 4k).  No privilege
is needed, and every size extension of 4 GiB or more reaches it:
truncate(2)/ftruncate(2) through truncate_setsize(), writes beyond the end
of file through generic_write_end(), ext4, iomap, btrfs, exfat, ntfs, afs
and orangefs.  Affected since v6.13.

pagecache_isize_extended() zeroes the part of the dirty folio straddling
the old end of file that the size extension exposes, from the old size to
the new size or the end of the folio, whichever comes first:

	end = min_t(unsigned int, to - folio_pos(folio), folio_size(folio));

min_t() converts both operands to unsigned int before comparing, so the
loff_t difference to - folio_pos(folio) is reduced modulo 2^32 first.
When the file grows by 4 GiB or more past the folio, end is that residue
instead of folio_size(folio): below offset nothing is zeroed, above it
only [offset, end) is.  The bytes beyond the old end of file stay in the
dirty folio and, now inside i_size, are file data.

Compare in loff_t; the result is at most folio_size(folio) and fits end.

Found while formally verifying pagecache_isize_extended() against the
kernel binary.

Link: https://lore.kernel.org/20261016222721.791785-1-nickolai@csail.mit.edu
Fixes: 52aecaee1c26 ("mm: zero range of eof folio exposed by inode size extension")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Assisted-by: LLM
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Brian Foster <bfoster@redhat.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/truncate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/mm/truncate.c b/mm/truncate.c
index 9b1baa688a1046..3534bc320a9c58 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -880,8 +880,7 @@ void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to)
 		unsigned int offset, end;
 
 		offset = from - folio_pos(folio);
-		end = min_t(unsigned int, to - folio_pos(folio),
-			    folio_size(folio));
+		end = min_t(loff_t, to - folio_pos(folio), folio_size(folio));
 		folio_zero_segment(folio, offset, end);
 	}
 

From 38efa986446b83eaefde90558bc0ee7dbe903782 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Mon, 19 Oct 2026 15:28:27 +0100
Subject: [PATCH 1759/1982] mm/mremap: populate calculated fields in vrm state
 correctly

[ Upstream commit 34e753f8d927069785f6b675f5769da5da4ef78e ]

Commit d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
introduced the vma_remap_struct helper to pass state sanely through
mremap() logic.

Part of this state is vrm->delta - equal to the absolute difference between
vrm->old_len and vrm->new_len (the old and new lengths of the VMA,
respectively).

This value is used to correctly charge accounted VMAs.

When shrinking a VMA, mremap_to() sets vrm->old_len equal to vrm->new_len
having performed the shrink of the VMA first, prior to any potential move
(e.g.  MREMAP_FIXED | MREMAP_MAYMOVE specified).

However it does not recalculate vrm->delta, which results in incorrectly
overcharging the VMA when both moving and shrinking a VMA.

The charge leaks to Committed_AS globally, meaning a mischievous user can
cause allocations to fail across the system in strict overcommit mode.

Resolve the issue by abstracting the update of vrm->delta to
vrm_populate_calculated() and invoking this from mremap_to() when
vrm->old_len is changed.

Additionally, update vrm->remap_type whose value depends on vrm->delta.
The field is not read again after the shrink, but it is the logically
correct thing to do and protects against future changes which break this.

Link: https://lore.kernel.org/20261019-mremap-fix-shrink-charge-v1-1-a3ce209e5360@kernel.org
Fixes: d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Closes: https://lore.kernel.org/all/20261017233527.797191-1-nickolai@csail.mit.edu/
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mremap.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index f023b05dfb3d94..593e6f94eba3df 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -874,12 +874,6 @@ unsigned long move_page_tables(struct pagetable_move_control *pmc)
 	return pmc_progress(pmc);
 }
 
-/* Set vrm->delta to the difference in VMA size specified by user. */
-static void vrm_set_delta(struct vma_remap_struct *vrm)
-{
-	vrm->delta = abs_diff(vrm->old_len, vrm->new_len);
-}
-
 /* Determine what kind of remap this is - shrink, expand or no resize at all. */
 static enum mremap_type vrm_remap_type(struct vma_remap_struct *vrm)
 {
@@ -892,6 +886,13 @@ static enum mremap_type vrm_remap_type(struct vma_remap_struct *vrm)
 	return MREMAP_EXPAND;
 }
 
+/* Populate calculated fields. */
+static void vrm_populate_calculated(struct vma_remap_struct *vrm)
+{
+	vrm->delta = abs_diff(vrm->old_len, vrm->new_len);
+	vrm->remap_type = vrm_remap_type(vrm);
+}
+
 /*
  * When moving a VMA to vrm->new_adr, does this result in the new and old VMAs
  * overlapping?
@@ -1422,6 +1423,7 @@ static unsigned long mremap_to(struct vma_remap_struct *vrm)
 
 		/* Set up for the move now shrink has been executed. */
 		vrm->old_len = vrm->new_len;
+		vrm_populate_calculated(vrm);
 	}
 
 	/* MREMAP_DONTUNMAP expands by old_len since old_len == new_len */
@@ -1694,8 +1696,7 @@ static int check_prep_vma(struct vma_remap_struct *vrm)
 	if (is_vm_hugetlb_page(vma) && !align_hugetlb(vrm))
 		return -EINVAL;
 
-	vrm_set_delta(vrm);
-	vrm->remap_type = vrm_remap_type(vrm);
+	vrm_populate_calculated(vrm);
 	/* For convenience, we set new_addr even if VMA won't move. */
 	if (!vrm_implies_new_addr(vrm))
 		vrm->new_addr = addr;

From e251079d676c481cc905d1ac226851b1ef49a4b8 Mon Sep 17 00:00:00 2001
From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Date: Mon, 19 Oct 2026 16:57:48 +0100
Subject: [PATCH 1760/1982] mm/mremap: correctly uncharge accountable VMAs in
 error path

[ Upstream commit 65e722a74df992719676ead85a9e93fb2b5a0983 ]

The mremap error path is a fragile and unwieldy beast - it reverses the
page table move then updates vma_remap_struct state to swap VMA, length and
address between old and new VMAs in copy_vma_and_data().

If the mremap() operation didn't specify MREMAP_DONTUNMAP then its caller,
move_vma(), invokes unmap_source_vma(), which unmaps the new VMA rather
than the old one.

For accountable VMAs when MREMAP_DONTUNMAP is not specified,
unmap_source_vma() unsets VMA_ACCOUNT_BIT during this unmap in order that
only the delta of a VMA expansion is charged (performed by
vrm_calc_charge() earlier).

Therefore nothing uncharges the expanded VMA size, and there is a permanent
leak in global Committed_AS.

Resolve the issue by uncharging when MREMAP_DONTUNMAP is not specified.

Link: https://lore.kernel.org/20261019-other-mremap-charge-leak-v1-1-d94477fe6545@kernel.org
Fixes: fdbef6149135 ("mm/mremap: don't account pages in vma_to_resize()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mremap.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/mm/mremap.c b/mm/mremap.c
index 593e6f94eba3df..8ed7c50e499b8b 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1239,6 +1239,20 @@ static int copy_vma_and_data(struct vma_remap_struct *vrm,
 		pmc_revert.need_rmap_locks = true;
 		move_page_tables(&pmc_revert);
 
+		/*
+		 * When copy_vma_and_data() returns, the new VMA will be
+		 * unmapped rather than the old one.
+		 *
+		 * When an accountable move is being performed, this unmapping
+		 * will not uncharge any expansion, so do that now.
+		 *
+		 * A move is accountable if the VMA is accountable and
+		 * MREMAP_DONTUNMAP is not specified, so only do so if the
+		 * latter is true.
+		 */
+		if (!(vrm->flags & MREMAP_DONTUNMAP))
+			vrm_uncharge(vrm);
+
 		vrm->vma = new_vma;
 		vrm->old_len = vrm->new_len;
 		vrm->addr = vrm->new_addr;

From a402a7a7dea719dd48bd9da81463195835255e3a Mon Sep 17 00:00:00 2001
From: "Gregory Price (Meta)" <gourry@gourry.net>
Date: Mon, 19 Oct 2026 14:50:02 -0400
Subject: [PATCH 1761/1982] mm/vmscan: reclaim every zone in per-node proactive
 reclaim

[ Upstream commit d0a12d80d2f7e9f4ed2030b6f04c8a897956bf84 ]

user_proactive_reclaim() limits per-node reclaim to
gfp_zone(GFP_KERNEL), which is ZONE_NORMAL. Proactive reclaim serves no
allocation, but that limit makes shrink_node() skip every ZONE_MOVABLE
folio, so writing to /sys/devices/system/node/nodeN/reclaim never
reclaims a node's movable memory. A movable-only node, such as dax/kmem
or hotplugged memory onlined movable, reclaims nothing and fails with
-EAGAIN.

To reproduce, fill a movable-only node with clean page cache and write
200M to its nodeN/reclaim: the write fails with -EAGAIN and the page
cache stays. The same write to a ZONE_NORMAL node frees 200MB.

Scan every zone, as memory.reclaim does.

Link: https://lore.kernel.org/20261019185002.3428594-1-gourry@gourry.net
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 6d53f83e9dbcfc..8fb0d79a00b9e0 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -7825,7 +7825,7 @@ int user_proactive_reclaim(char *buf,
 		} else {
 			struct scan_control sc = {
 				.gfp_mask = current_gfp_context(gfp_mask),
-				.reclaim_idx = gfp_zone(gfp_mask),
+				.reclaim_idx = MAX_NR_ZONES - 1,
 				.proactive_swappiness = swappiness == -1 ? NULL : &swappiness,
 				.priority = DEF_PRIORITY,
 				.may_writepage = !laptop_mode,

From 41a885c81a18d41613b78888d9aa1e95393473f7 Mon Sep 17 00:00:00 2001
From: "Gregory Price (Meta)" <gourry@gourry.net>
Date: Sat, 17 Oct 2026 22:33:49 -0400
Subject: [PATCH 1762/1982] mm/mempolicy: apply bind policies against the
 scoped allocation zone

[ Upstream commit d4ea410ce4b8aa46a316476ea2624a357bf31fa9 ]

QEMU fails to start a guest with a VFIO device when guest RAM comes
from a memory backend bound to a movable-only node:

  vfio_container_dma_map(0x55b1b1317800, 0x0, 0x10000000,
                         0x7f39a2200000)
    = -12 (Cannot allocate memory)

VFIO pins guest RAM when the device is realized, and the pin faults
the pages in. io_uring fixed buffers fail the same way. Faulting the
range in before pinning lets the same pin succeed, since resident
pages are migrated off the node instead.

A long-term pin faults under memalloc_pin_save(). PF_MEMALLOC_PIN makes
current_gfp_context() clear __GFP_MOVABLE, but policy_nodemask() tests
apply_policy_zone() against the caller's gfp.

The bind keeps its movable-only nodemask, and the allocation finds no
usable zone:

  page allocation failure:
      order:0,
      mode:0x140dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_COMP),
      nodemask=1,cpuset=/,mems_allowed=0-1

  Call Trace:
   warn_alloc+0x136/0x150
   __alloc_frozen_pages_noprof+0xed8/0x1720
   alloc_pages_mpol+0xaa/0x170
   vma_alloc_folio_noprof+0x65/0xd0
   __handle_mm_fault+0x137b/0x1ac0
   handle_mm_fault+0xa0/0x270
   __get_user_pages+0x250/0xfd0
   __gup_longterm_locked+0x116/0x870
   gup_fast_fallback+0xcfc/0xdf0
   pin_user_pages_fast+0x47/0x60
   io_pin_pages+0x9a/0x110

Base page faults fail with -ENOMEM.
hugetlb faults fail with -EFAULT.

Check the policy zone against current_gfp_context(gfp), so a pin-scoped
fault falls back off the movable-only nodemask, like any other
non-movable allocation under the same bind.

Tested in qemu with a dax/kmem movable-only node 1. io_uring and VFIO
pins of unfaulted base pages and 2MB hugetlb pages now succeed and land
on node 0 (correct). QEMU now starts with the same backend binding.

Link: https://lore.kernel.org/20261018023349.1697434-1-gourry@gourry.net
Fixes: 8e3560d963d2 ("mm: honor PF_MEMALLOC_PIN for all movable pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mempolicy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 197a5ea0d76d9a..919a505cabaee4 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2206,7 +2206,7 @@ static nodemask_t *policy_nodemask(gfp_t gfp, struct mempolicy *pol,
 		break;
 	case MPOL_BIND:
 		/* Restrict to nodemask (but not on lower zones) */
-		if (apply_policy_zone(pol, gfp_zone(gfp)) &&
+		if (apply_policy_zone(pol, gfp_zone(current_gfp_context(gfp))) &&
 		    cpuset_nodemask_valid_mems_allowed(&pol->nodes))
 			nodemask = &pol->nodes;
 		if (pol->home_node != NUMA_NO_NODE)

From cb24274f7d304d992e940be51234a3d9cfc179b5 Mon Sep 17 00:00:00 2001
From: Yunhui Cui <cuiyunhui@bytedance.com>
Date: Sat, 23 May 2026 12:20:52 +0800
Subject: [PATCH 1763/1982] riscv: mm: exclude invalid THP PMDs from page table
 check

[ Upstream commit bdda2887cbf3937c2d0f56589c2124c4167324e1 ]

RISC-V THP splitting uses a temporary invalid PMD state where
pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
in-progress entry.

That temporary state no longer describes a user-accessible mapping, but
page_table_check currently treats it as one because the RISC-V PMD
user-accessibility test only checks whether the PMD is a leaf and has user
permissions.

As a result, when a PMD-sized anonymous THP is split during a COW fault,
page_table_check can account the invalid intermediate PMD as a live PMD
mapping, and then account the replacement PTE mappings again when the
split installs the PTE table.  This leaves stale PMD accounting behind and
later triggers page_table_check failures such as a non-zero anon_map_count
when the folio is freed.

Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
accounting only considers leaf PMDs that still carry either _PAGE_PRESENT
or _PAGE_PROT_NONE.  This preserves the THP split semantics required by
the MM code while preventing page_table_check from treating invalid split
PMDs as live user mappings.

With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
tools/testing/selftests/mm/cow completes successfully on RISC-V after this
change.

Link: https://lore.kernel.org/20260523042052.35476-1-cuiyunhui@bytedance.com
Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: tongtiangen <tongtiangen@huawei.com>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Vivian Wang <wangruikang@iscas.ac.cn>
Cc: Yaxing Guo <guoyaxing@bosc.ac.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/include/asm/pgtable.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 9b2e967c9fe080..420d402336d0bf 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -833,7 +833,14 @@ static inline bool pte_user_accessible_page(pte_t pte)
 
 static inline bool pmd_user_accessible_page(pmd_t pmd)
 {
-	return pmd_leaf(pmd) && pmd_user(pmd);
+	/*
+	 * page_table_check() must ignore THP split invalidation entries created by
+	 * pmd_mkinvalid(). These retain _PAGE_LEAF so pmd_present()/pmd_leaf() stay
+	 * true during the split, but they no longer describe a user-accessible
+	 * mapping once both _PAGE_PRESENT and _PAGE_PROT_NONE are cleared.
+	 */
+	return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)) &&
+		(pmd_val(pmd) & _PAGE_LEAF) && pmd_user(pmd);
 }
 
 static inline bool pud_user_accessible_page(pud_t pud)

From 482a6e8ab6ae8f719a204966688daecdbcd6ff70 Mon Sep 17 00:00:00 2001
From: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Date: Sat, 17 Oct 2026 05:09:27 +0000
Subject: [PATCH 1764/1982] mm: multi-gen LRU: fix NULL lruvec->pgdat deref
 with memcg disabled on cmdline

[ Upstream commit 183895979c441e52dbd651b388553b09eaa35cfa ]

When CONFIG_MEMCG=y, lruvec_pgdat() returns lruvec->pgdat, which for the
per-node pgdat->__lruvec is left NULL by lruvec_init() and only filled in
lazily by mem_cgroup_lruvec(). Normally that happens early, e.g. on the
first folio_add_lru().

With cgroup_disable=memory, lru_gen_shrink_node() passes &pgdat->__lruvec
directly to shrink_one(). If direct reclaim runs before anything has
called mem_cgroup_lruvec() for the node, which can happen during early
boot under memory pressure (e.g. a kdump kernel), get_swappiness() ends
up dereferencing a NULL pgdat:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
  pc : get_swappiness+0x68/0xb0
  lr : try_to_shrink_lruvec+0x54/0x2c0
  Call trace:
   get_swappiness+0x68/0xb0 (P)
   try_to_shrink_lruvec+0x54/0x2c0
   shrink_one+0x8c/0x240
   shrink_node+0xc6c/0xe08
   do_try_to_free_pages+0xdc/0x570
   try_to_free_pages+0x124/0x278
   __alloc_frozen_pages_noprof+0x6e8/0xf78
   alloc_pages_mpol+0xc4/0x1c0
   alloc_frozen_pages_noprof+0x54/0xe8
   alloc_pages_noprof+0x1c/0x40
   atomic_pool_expand+0x98/0x300
   __dma_atomic_pool_init+0x58/0xd8
   dma_atomic_pool_init+0x154/0x170
   do_one_initcall+0x64/0x350
   kernel_init_freeable+0x214/0x430
   kernel_init+0x2c/0x208
   ret_from_fork+0x10/0x20

The classic LRU path and MGLRU before per-node lru_gen_folio lists
obtained the lruvec through mem_cgroup_lruvec(), which sets
lruvec->pgdat.

The above was hit on an arm64 kdump kernel (6.18-based) booted with
cgroup_disable=memory nr_cpus=4. It also reproduces on mainline on an
arm64 VM with CONFIG_ARM64_64K_PAGES=y, CONFIG_MEMCG=y,
CONFIG_LRU_GEN_ENABLED=y and:

  mem=160M nr_cpus=4 coherent_pool=512M cgroup_disable=memory

These options only serve to force direct reclaim early in boot; with
160M the boot eventually ends in OOM regardless. On mainline the first
LRU reclaim happens while unpacking the initramfs, and faults the same
way:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
  pc : get_swappiness+0xd4/0x150
  Call trace:
   get_swappiness+0xd4/0x150 (P)
   try_to_shrink_lruvec+0x44/0x2b8
   shrink_one+0x80/0x1a0
   shrink_node+0xd98/0xea8
   do_try_to_free_pages+0xf4/0x4b0
   try_to_free_pages+0x110/0x360
   __alloc_frozen_pages_noprof+0x8b0/0x1718
   ...
   __filemap_get_folio_mpol+0x2ac/0x548
   simple_write_begin+0x44/0xf8
   page_symlink+0x178/0x198
   ...
   do_populate_rootfs+0x13c/0x200

Link: https://lore.kernel.org/20261017050928.128582-1-sidchintamaneni@gmail.com
Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <apais@microsoft.com>
Cc: <rlmenge@gmail.com>
Cc: <stable@vger.kernel.org> # 6.3+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/vmscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8fb0d79a00b9e0..e72d50bab730ad 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -5082,7 +5082,7 @@ static void lru_gen_shrink_node(struct pglist_data *pgdat, struct scan_control *
 		sc->nr_reclaimed = 0;
 
 	if (mem_cgroup_disabled())
-		shrink_one(&pgdat->__lruvec, sc);
+		shrink_one(mem_cgroup_lruvec(NULL, pgdat), sc);
 	else
 		shrink_many(pgdat, sc);
 

From e87cd6f7507f682f0f32ef83917b6729738bce7c Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun@linux.alibaba.com>
Date: Sat, 24 Oct 2026 18:43:50 +0800
Subject: [PATCH 1765/1982] fscrypt: Fix missing barrier in
 fscrypt_find_mode_key()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cf66375465b9ca531f5c294f468db1df293c178c ]

fscrypt_find_mode_key() walks an RCU list and hands out a per-mode
key without an acquire:

  setup task
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  setup_per_mode_enc_key()
   ├─ fscrypt_prepare_key()
   │  └─ fscrypt_prepare_inline_crypt_key()
   │     └─ blk_crypto_start_using_key()
   │        └─ blk_crypto_fallback_start_using_mode()
   │           ├─ init profile, keyslots, tfms[]
   │           └─ smp_store_release(tfms_inited[mode])  # init order
   └─ list_add_tail_rcu(&new_node->link, ...)  # release -> finder

  finding task (later submits the I/O itself)
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  fscrypt_find_mode_key()
   ├─ list_for_each_entry_rcu(node, ...)
   └─ return &node->key                 # no acquire, chain breaks
  ...
  blk_crypto_fallback_bio_prep()        # WRITE path
   ├─ tfms_inited[mode]                 # addr-dep, reads true
   ├─ blk_crypto_fallback_profile       # no dependency
   ├─ blk_crypto_keyslots               # no dependency
   └─ slotp->tfms[mode]                 # no dependency

RCU publishes the node and the key reachable from it, so
tfms_inited[mode] reads true through the address dependency.  The
independent fallback globals are not covered by it and can be read as
uninitialized.

On a weakly ordered machine, a WRITE bio can crash in
blk_crypto_get_keyslot() or crypto_sync_skcipher_setkey().

Other tasks reach the key through fscrypt_inode_info's
cmpxchg_release()/smp_load_acquire(), which is already ordered after
the list walk; only the finding task's own later I/O was not.

Fix this by upgrading the control dependency to an acquire with
smp_acquire__after_ctrl_dep() once a matching entry has been found.

Fixes: dd015b566d50 ("fscrypt: Fix key setup in edge case with multiple data unit sizes")
Cc: stable@vger.kernel.org
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Link: https://lore.kernel.org/r/20261014161153.GC322435@quark
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20261024104350.2257313-1-libaokun@linux.alibaba.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/crypto/keysetup.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
index f27997ef9a08c5..707552228ed624 100644
--- a/fs/crypto/keysetup.c
+++ b/fs/crypto/keysetup.c
@@ -207,8 +207,14 @@ fscrypt_find_mode_key(struct fscrypt_master_key *mk, u8 hkdf_context,
 		if (node->hkdf_context == hkdf_context &&
 		    node->mode_num == mode_num &&
 		    node->data_unit_bits == ci->ci_data_unit_bits &&
-		    fscrypt_is_key_prepared(&node->key, ci))
+		    fscrypt_is_key_prepared(&node->key, ci)) {
+			/*
+			 * Upgrade the RCU dereference to a full ACQUIRE, so
+			 * that blk-crypto global state is seen as initialized.
+			 */
+			smp_acquire__after_ctrl_dep();
 			return &node->key;
+		}
 	}
 	return NULL;
 }

From fa12106f992805d7bb4938ad88669bd18a7709ca Mon Sep 17 00:00:00 2001
From: Wang Haoran <haoranwangsec@gmail.com>
Date: Fri, 23 Oct 2026 15:56:11 +0800
Subject: [PATCH 1766/1982] fbdev: atmel_lcdfb: fix list_first_entry() on
 possibly empty modelist in probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 01d1204582f16e8b7bfce29648e5cf77a585d962 ]

list_first_entry() does not return NULL on an empty list; it returns a
bogus pointer computed by container_of() from the list head.
atmel_lcdfb_probe() initializes info->modelist with INIT_LIST_HEAD()
and later takes its first entry with list_first_entry(), assuming
atmel_lcdfb_of_init() populated it. However, atmel_lcdfb_of_init()
drops the return value of fb_add_videomode() — unlike every other
fallible call in the same function — so if fb_add_videomode() fails
(its internal kmalloc can return -ENOMEM under memory pressure or
fault injection), the list stays empty while of_init() reports
success. The probe path then dereferences the bogus pointer in
fb_videomode_to_var(&info->var, &modelist->mode). Because the bogus
pointer lands inside the contiguous fb_info allocation, this may not
fault immediately; instead it silently reads adjacent memory as a
struct fb_videomode and programs garbage timing parameters into the
LCD controller. This was found by code audit; we do not have Atmel
hardware to reproduce it.

Fix this on two levels: check the return value of fb_add_videomode()
in atmel_lcdfb_of_init() so the failure is propagated (root cause),
and use list_first_entry_or_null() in atmel_lcdfb_probe() with a NULL
check that fails probe gracefully with -EINVAL (defense in depth),
consistent with the surrounding error handling which bails out to
stop_clk.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/atmel_lcdfb.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 35862e83f7afa0..2b602ad004dd92 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1009,7 +1009,9 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
 	if (ret < 0)
 		goto put_display_node;
 
-	fb_add_videomode(&fb_vm, &info->modelist);
+	ret = fb_add_videomode(&fb_vm, &info->modelist);
+	if (ret < 0)
+		goto put_display_node;
 
 put_display_node:
 	of_node_put(display_np);
@@ -1077,8 +1079,13 @@ static int atmel_lcdfb_probe(struct platform_device *pdev)
 	}
 	atmel_lcdfb_start_clock(sinfo);
 
-	modelist = list_first_entry(&info->modelist,
-			struct fb_modelist, list);
+	modelist = list_first_entry_or_null(&info->modelist,
+					    struct fb_modelist, list);
+	if (!modelist) {
+		dev_err(dev, "no video mode available\n");
+		ret = -EINVAL;
+		goto stop_clk;
+	}
 	fb_videomode_to_var(&info->var, &modelist->mode);
 
 	atmel_lcdfb_check_var(&info->var, info);

From 035b7372117f174b5b3a10378b77a5380fcd54e1 Mon Sep 17 00:00:00 2001
From: Hungyu Lin <dennylin0707@gmail.com>
Date: Tue, 20 Oct 2026 22:39:57 +0000
Subject: [PATCH 1767/1982] timers/itimer: Keep a nonzero value at CPU timer
 expiry

[ Upstream commit ef60f61208a30eb5b941b707debdf04517271b4f ]

get_cpu_itimer() returns a zero remaining time when the sampled CPU time
is exactly equal to the nonzero expiry. This makes an armed ITIMER_VIRTUAL
or ITIMER_PROF timer appear disarmed.

The cputime cleanup replaced cputime_le(), which implements <=, with <.
Restore the inclusive comparison so the equality case returns TICK_NSEC,
like the overdue case and set_process_cpu_timer().

Fixes: 648616343cdb ("[S390] cputime: add sparse checking and cleanup")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020223957.87842-1-dennylin0707@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/itimer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/time/itimer.c b/kernel/time/itimer.c
index 03a32dffc56cc3..f7de39769095f1 100644
--- a/kernel/time/itimer.c
+++ b/kernel/time/itimer.c
@@ -60,7 +60,7 @@ static void get_cpu_itimer(struct task_struct *tsk, unsigned int clock_id,
 		thread_group_sample_cputime(tsk, samples);
 		t = samples[clock_id];
 
-		if (val < t)
+		if (val <= t)
 			/* about to fire */
 			val = TICK_NSEC;
 		else

From 4c4c4a69cc2dc9237acd25caacee5552206ce0ab Mon Sep 17 00:00:00 2001
From: Hungyu Lin <dennylin0707@gmail.com>
Date: Tue, 20 Oct 2026 23:34:33 +0000
Subject: [PATCH 1768/1982] time/namespace: Fix overflow when converting
 absolute deadlines

[ Upstream commit d69cfd33b5a8d176124c564513b9ceb933595d93 ]

do_timens_ktime_to_host() subtracts the namespace offset from an absolute
deadline and clamps the result to [0, KTIME_MAX]. A negative offset can
make a large deadline overflow to a negative value. Since ktime_t is
signed and KTIME_MAX is its maximum value, the subsequent comparison
against KTIME_MAX can never detect this overflow.

For example, with a -1 second boottime offset, an absolute CLOCK_BOOTTIME
timerfd deadline of KTIME_MAX can expire immediately. An absolute
clock_nanosleep() using the same clock and deadline can also return
immediately instead of waiting.

The earlier tim < offset check already handles the lower bound. A
negative subtraction result in the remaining branch therefore indicates
overflow. Detect that result and clamp it to KTIME_MAX.

Fixes: 89dd8eecfe961 ("time: Add do_timens_ktime_to_host() helper")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020233433.20997-1-dennylin0707@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c
index 99dcdb3315db72..632f3315728474 100644
--- a/kernel/time/namespace.c
+++ b/kernel/time/namespace.c
@@ -51,7 +51,7 @@ ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
 		tim = 0;
 	} else {
 		tim = ktime_sub(tim, offset);
-		if (unlikely(tim > KTIME_MAX))
+		if (unlikely(tim < 0))
 			tim = KTIME_MAX;
 	}
 

From 2da8a5e6c0abb3388f8f1a959d4a986b039b6c45 Mon Sep 17 00:00:00 2001
From: Fuad Tabba <fuad.tabba@linux.dev>
Date: Fri, 16 Oct 2026 09:15:58 +0100
Subject: [PATCH 1769/1982] KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for
 guests

[ Upstream commit 00e73757518020273ccf6308a51f214e58c21ad5 ]

KVM sets HCR_EL2.BSU to Inner Shareable for guests, so that a guest's
barriers cover the TLB and I-cache invalidations that HCR_EL2.FB
broadcasts. However, since HCR_BSU_IS became an alias of the generated
HCR_EL2_BSU_IS, it is the unshifted field value 0b01, which sets bit
0 (VM, already set) and leaves BSU at 0b00. A guest's DSB NSH is then
not required to wait for a broadcast TLBI to complete on other CPUs.

Build the field with SYS_FIELD_PREP_ENUM().

Fixes: d0f39259eff4 ("arm64: sysreg: Add layout for HCR_EL2")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261016081558.805411-1-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/kvm_arm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 1da290aeedce76..641276868a6535 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -98,7 +98,7 @@
  * TID1:	Trap REVIDR_EL1, AIDR_EL1, and SMIDR_EL1
  */
 #define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \
-			 HCR_BSU_IS | HCR_FB | HCR_TACR | \
+			 SYS_FIELD_PREP_ENUM(HCR_EL2, BSU, IS) | HCR_EL2_FB | HCR_EL2_TACR | \
 			 HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \
 			 HCR_FMO | HCR_IMO | HCR_PTW | HCR_TID3 | HCR_TID1)
 #define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK | HCR_ATA)

From 5c4d3a1f50545607a841be707e144f49ede855a1 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Fri, 4 Sep 2026 12:33:51 +0200
Subject: [PATCH 1770/1982] ceph: avoid pending truncate during nonblocking cap
 acquire

[ Upstream commit 979b7ed4457a04c5a41c36f86052ecc6b76c67d9 ]

Readahead acquires caps while the folios are locked.  This can
deadlock when processing a pending truncate; truncate_pagecache() can
then attempt to a folio that is already locked.

Return -EAGAIN instead when `NON_BLOCKING` is set, causing the
readahead to be abandoned.

Cc: stable@vger.kernel.org
Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 91cb305815cbdd..7ce1af5b61c884 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2878,6 +2878,10 @@ static int try_get_cap_refs(struct inode *inode, int need, int want,
 	}
 
 	/* finish pending truncate */
+	if (ci->i_truncate_pending && (flags & NON_BLOCKING)) {
+		ret = -EAGAIN;
+		goto out_unlock;
+	}
 	while (ci->i_truncate_pending) {
 		spin_unlock(&ci->i_ceph_lock);
 		if (snap_rwsem_locked) {

From acaec29310a634f15007cb25c4ee5c87552c6204 Mon Sep 17 00:00:00 2001
From: Guanglei Zhu <zhugl3@xiaopeng.com>
Date: Thu, 10 Sep 2026 11:00:36 +0800
Subject: [PATCH 1771/1982] ceph: fix out-of-bounds read in
 ceph_netfs_issue_op_inline()

[ Upstream commit cdbb60f00f87297a9db2652847dfc0eaaf3c45aa ]

The read offset is validated against i_size but never against
inline_len, and the two fields come from the MDS independently.  When
a read starts past the end of the inline data, the subtraction

	len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len);

underflows and min_t() ends up with subreq->len, so copy_to_iter()
reads past the end of the inline buffer straight into the user
buffer.  A malicious or buggy MDS reporting a short inline payload
together with an inflated i_size can thus leak kernel heap memory to
userspace.

Bail out with -ENODATA when the offset is not within the inline
data.

Cc: stable@vger.kernel.org
Fixes: 5b19f1eba459 ("ceph: make ceph_netfs_issue_op() handle inlined data")
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/addr.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index cfbd88412f047f..f58eba5456e361 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -314,6 +314,12 @@ static bool ceph_netfs_issue_op_inline(struct netfs_io_subrequest *subreq)
 		return false;
 	}
 
+	if (subreq->start >= iinfo->inline_len) {
+		ceph_mdsc_put_request(req);
+		err = -ENODATA;
+		goto out;
+	}
+
 	len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len);
 	err = copy_to_iter(iinfo->inline_data + subreq->start, len, &subreq->io_iter);
 	if (err == 0) {

From e9d72cf5d1bf5b4ddfe86707ada614973d75bf64 Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Mon, 14 Sep 2026 22:19:24 -0700
Subject: [PATCH 1772/1982] ceph: reject mdsmaps that claim more than
 CEPH_MAX_MDS ranks

[ Upstream commit c1742590d2b2fc5fb217e1a9b520108f1fe282e5 ]

check_new_map() sizes its export-target bitmap from CEPH_MAX_MDS but walks
it with newmap->possible_max_rank, which comes straight off the wire:
ceph_mdsmap_decode() sets it to max(m_num_active_mds, m_max_mds), then
overwrites it with the size of the "in" set.  Neither is bounded by
CEPH_MAX_MDS, only by m_info allocating, so a monitor announcing more ranks
than the bitmap holds makes test_bit() read past the end of targets[].  The
clear_bit() loop above indexes the same bitmap, though it is additionally
bounded by mdsc->max_sessions.  The map arrives on the monitor connection,
which is unauthenticated in legacy msgr mode.

CEPH_MAX_MDS is a protocol constant from src/mds/mdstypes.h, and the
reserved inode ranges in super.h are laid out one rank apart over that
span, so a map claiming more ranks is corrupt.  Reject it where the rank
space is established rather than letting the count reach check_new_map().

  BUG: KASAN: stack-out-of-bounds in check_new_map (fs/ceph/mds_client.c:5968)
  Read of size 8 at addr ffffc90000ac7798 by task kworker/1:2/127
  Workqueue: ceph-msgr ceph_con_workfn
  Call Trace:
   <TASK>
   dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
   print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
   kasan_report (mm/kasan/report.c:595)
   kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
   check_new_map (fs/ceph/mds_client.c:5968)
   ceph_mdsc_handle_mdsmap (fs/ceph/mds_client.c:7060)
   extra_mon_dispatch (fs/ceph/super.c:802)
   mon_dispatch (net/ceph/mon_client.c:1483)
   ceph_con_process_message (net/ceph/messenger.c:1424)
   ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
   ceph_con_workfn (net/ceph/messenger.c:1576)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   </TASK>
  The buggy address belongs to stack of task kworker/1:2/127
   and is located at offset 288 in frame:
   check_new_map (fs/ceph/mds_client.c:5846)
  This frame has 1 object:
   [32, 288) 'targets'

Cc: stable@vger.kernel.org
Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps")
Reported-by: co+f8e3e01d8dda8689@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mdsmap.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index c91c0e2e118ba5..0fd578f0b2cd26 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -170,6 +170,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
 	 * and the mds rank >= m_num_active_mds.
 	 */
 	m->possible_max_rank = max(m->m_num_active_mds, m->m_max_mds);
+	if (m->possible_max_rank > CEPH_MAX_MDS) {
+		err = -EIO;
+		goto corrupt;
+	}
 
 	m->m_info = kcalloc(m->possible_max_rank, sizeof(*m->m_info), GFP_NOFS);
 	if (!m->m_info)
@@ -316,6 +320,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
 	{
 		int num_laggy = 0;
 		ceph_decode_32_safe(p, end, n, bad_ext);
+		if (n > CEPH_MAX_MDS) {
+			err = -EIO;
+			goto corrupt;
+		}
 		ceph_decode_need(p, end, sizeof(u32) * n, bad_ext);
 
 		for (i = 0; i < n; i++) {

From 5ab17ed54e8b7ca64a8d167a09d6a2c865ed51cc Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Mon, 14 Sep 2026 19:17:10 -0700
Subject: [PATCH 1773/1982] ceph: require the dentry lease record to cover
 struct ceph_mds_reply_lease

[ Upstream commit 7286b2ffe04d4b39b4e9884f714792589d94f316 ]

parse_reply_info_lease() reads a 32-bit struct_len off the wire and only
checks that many bytes are present, without requiring struct_len to cover
sizeof(struct ceph_mds_reply_lease) (10 bytes).  A malicious MDS can
declare a shorter record and still get the pointer published: the
following *p += sizeof(**lease) overshoot is undone by *p = lend, so
nothing downstream rejects the reply.  ceph_fill_trace() ->
update_dentry_lease() then reads 10 bytes through that pointer on any
lookup on a mounted CephFS, running past the end of the message front.

Require the record to cover the structure, matching the sibling
parse_reply_info_dir().  A conforming MDS always encodes the full 10
bytes.

  BUG: KASAN: slab-out-of-bounds in __update_dentry_lease.constprop.0 (fs/ceph/inode.c:1459)
  Read of size 4 at addr ffff888026c63d65 by task kworker/0:3/2366
  Workqueue: ceph-msgr ceph_con_workfn
  Call Trace:
   __update_dentry_lease.constprop.0 (fs/ceph/inode.c:1459)
   ceph_fill_trace (fs/ceph/inode.c:1474 fs/ceph/inode.c:1823)
   mds_dispatch (fs/ceph/mds_client.c:4229 fs/ceph/mds_client.c:7225)
   ceph_con_process_message (net/ceph/messenger.c:1424)
   ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
   ceph_con_workfn (net/ceph/messenger.c:1576)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

  The buggy address is located 357 bytes inside of
   allocated 360-byte region [ffff888026c63c00, ffff888026c63d68)

Cc: stable@vger.kernel.org
Fixes: 4ac4c23eaa38 ("ceph: decode alternate_name in lease info")
Reported-by: co+f92fbe44e3c6df69@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 342d8778b69cfa..a5bc9f75e0f9c5 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -338,6 +338,8 @@ static int parse_reply_info_lease(void **p, void *end,
 
 	lend = *p + struct_len;
 	ceph_decode_need(p, end, struct_len, bad);
+	if (struct_len < sizeof(**lease))
+		goto bad;
 	*lease = *p;
 	*p += sizeof(**lease);
 

From 046d542cd77b36395f6f9fd63e8de0e69612a34d Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubo.li@clyso.com>
Date: Thu, 3 Sep 2026 18:48:36 -0700
Subject: [PATCH 1774/1982] libceph: only set read_from_replica on read
 requests

[ Upstream commit d6c7a5fcd08873c45a2dcd645a0690fd1443af50 ]

ceph_osdc_alloc_request() ORs the mount option's read_from_replica
flag into r_flags for every request, writes included.  The flag is
meant for reads: calc_target() skips the replica choice for any
request that has CEPH_OSD_FLAG_WRITE, and the OSDs only know
BALANCE_READS on read ops.  Sending it on writes is at best ignored;
with read_from_replica=balance a buffered write that fell back to
ceph_sync_write() after losing BUFFER to a revoke failed with -EIO,
while the same run without the option works fine.

Gate the flag on CEPH_OSD_FLAG_READ.

Cc: stable@vger.kernel.org
Fixes: 22d2cfdffa5b ("libceph: move away from global osd_req_flags")
Assisted-by: Cursor
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/osd_client.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 46b2c2ae777842..92d76df2701eff 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1108,7 +1108,9 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
 	req->r_base_oloc.pool = layout->pool_id;
 	req->r_base_oloc.pool_ns = ceph_try_get_string(layout->pool_ns);
 	ceph_oid_printf(&req->r_base_oid, "%llx.%08llx", vino.ino, objnum);
-	req->r_flags = flags | osdc->client->options->read_from_replica;
+	req->r_flags = flags;
+	if (flags & CEPH_OSD_FLAG_READ)
+		req->r_flags |= osdc->client->options->read_from_replica;
 
 	req->r_snapid = vino.snap;
 	if (flags & CEPH_OSD_FLAG_WRITE)

From 7f4f3e6fe58c25ac5b6977b089634bd5c48a66a4 Mon Sep 17 00:00:00 2001
From: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Date: Wed, 9 Sep 2026 16:59:13 +0200
Subject: [PATCH 1775/1982] libceph: Fix unsafe decode in
 ceph_redirect_decode()

[ Upstream commit 0405670e50f213594366ab7eddc07002bd7f84c0 ]

ceph_redirect_decode handles unchecked data received over the network
from an OSD. Currently, there is only a bounds check covering the first
three decode operations. After decoding the first len field from the
message, the only remaining check ensures there is enough buffer space
to hold len bytes. However, there is no guarantee that this value is
large enough to hold the subsequently decoded fields. The decoding of
the second len field is missing an explicit bounds check. Consequently,
a corrupted message can trigger an out-of-bounds read.

This patch fixes the issue by switching the decoding from
ceph_decode_32() to the bounds-checked version ceph_decode_32_safe().

Cc: stable@vger.kernel.org
Fixes: 205ee1187a67 ("libceph: follow redirect replies from osds")
Assisted-by: Cursor
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/osd_client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 92d76df2701eff..47879d73029aa0 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -3642,7 +3642,7 @@ static int ceph_redirect_decode(void **p, void *end,
 	if (ret)
 		goto out;
 
-	len = ceph_decode_32(p);
+	ceph_decode_32_safe(p, end, len, e_inval);
 	if (len > 0) {
 		pr_warn("ceph_request_redirect::object_name is set\n");
 		goto e_inval;

From ab62a3677aadb0bd46f37330cbf44202cff3a59b Mon Sep 17 00:00:00 2001
From: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Date: Wed, 9 Sep 2026 17:03:53 +0200
Subject: [PATCH 1776/1982] libceph: Fix multiple unsafe decodes in
 ceph_oloc_decode()

[ Upstream commit 10655007b9b679e46a9e383202c7bb791e5d1d13 ]

ceph_oloc_decode handles unchecked data received over the network from
an OSD. Currently, there are multiple decode operations that aren't
covered by any bounds check. Decoding these fields can therefore result
in out-of-bounds reads if a corrupted message is received.

This patch fixes the issue by adding bounds checks covering all
previously uncovered decode operations.

[ idryomov: use ceph_decode_64_safe() for hash ]

Cc: stable@vger.kernel.org
Fixes: 205ee1187a67 ("libceph: follow redirect replies from osds")
Assisted-by: Cursor
Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/osd_client.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 47879d73029aa0..0b37fb3c626441 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -3570,6 +3570,7 @@ static int ceph_oloc_decode(void **p, void *end,
 	ceph_decode_need(p, end, len, e_inval);
 	struct_end = *p + len;
 
+	ceph_decode_need(p, end, 8 + 4 + 4, e_inval);
 	oloc->pool = ceph_decode_64(p);
 	*p += 4; /* skip preferred */
 
@@ -3582,7 +3583,7 @@ static int ceph_oloc_decode(void **p, void *end,
 	if (struct_v >= 5) {
 		bool changed = false;
 
-		len = ceph_decode_32(p);
+		ceph_decode_32_safe(p, end, len, e_inval);
 		if (len > 0) {
 			ceph_decode_need(p, end, len, e_inval);
 			if (!oloc->pool_ns ||
@@ -3601,7 +3602,9 @@ static int ceph_oloc_decode(void **p, void *end,
 	}
 
 	if (struct_v >= 6) {
-		s64 hash = ceph_decode_64(p);
+		s64 hash;
+
+		ceph_decode_64_safe(p, end, hash, e_inval);
 		if (hash != -1) {
 			pr_warn("ceph_object_locator::hash is set\n");
 			goto e_inval;

From 23e0bbd385b17c30ad5aa03f6b7663c6341f019d Mon Sep 17 00:00:00 2001
From: Felix Hoffmann <f3lix.dev@gmx.de>
Date: Thu, 10 Sep 2026 13:39:36 +0200
Subject: [PATCH 1777/1982] libceph: reject mismatched CRUSH weight-set sizes

[ Upstream commit d8fc89b5bfe4cb3aebe4c8a818247d11291b841c ]

A CEPH_MSG_OSD_MAP message can contain CRUSH choose args with replacement
weight vectors for straw2 buckets.  decode_choose_args() validates the
optional IDs vector against the referenced bucket, but does not validate
the size of any replacement-weight vector.

The CRUSH mapper assumes that each replacement vector has exactly as many
entries as the bucket.  A zero-length vector for a nonempty bucket makes
bucket_straw2_choose() dereference NULL, while a shorter nonzero vector
causes an out-of-bounds read.  An authenticated monitor or OSD can deliver
such a map and crash a kernel client when it performs placement for an
ordinary request.

Reject a nonempty collection of weight sets for an absent bucket and
require every replacement-weight vector to match its bucket size.

Cc: stable@vger.kernel.org
Fixes: 5cf9c4a9959b ("libceph, crush: per-pool crush_choose_arg_map for crush_do_rule()")
Assisted-by: Codex:gpt-5
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/osdmap.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 68bd45852fc374..e812b30778d573 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -378,7 +378,9 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
 		ceph_decode_32_safe(p, end, num_buckets, e_inval);
 		while (num_buckets--) {
 			struct crush_choose_arg *arg;
+			struct crush_bucket *bucket;
 			u32 bucket_index;
+			u32 i;
 
 			ceph_decode_32_safe(p, end, bucket_index, e_inval);
 			if (bucket_index >= arg_map->size)
@@ -389,10 +391,18 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
 			if (ret)
 				goto fail;
 
+			bucket = c->buckets[bucket_index];
 			if (arg->ids_size &&
-			    (!c->buckets[bucket_index] ||
-			     arg->ids_size != c->buckets[bucket_index]->size))
+			    (!bucket || arg->ids_size != bucket->size))
 				goto e_inval;
+
+			if (arg->weight_set_size && !bucket)
+				goto e_inval;
+
+			for (i = 0; i < arg->weight_set_size; i++) {
+				if (arg->weight_set[i].size != bucket->size)
+					goto e_inval;
+			}
 		}
 
 		if (!__insert_choose_arg_map(&c->choose_args, arg_map)) {

From de314d21f7adb39bd2de38c2f7145375201ca180 Mon Sep 17 00:00:00 2001
From: Yogesh Gaur <yogeshgaur.83@gmail.com>
Date: Fri, 11 Sep 2026 19:01:09 +0530
Subject: [PATCH 1778/1982] libceph: reject an initial monmap with no monitors

[ Upstream commit 94dbce2ae4fdb57bdb53ffa3456da777a5cfb981 ]

build_initial_monmap() takes the monitor count straight from
ceph_options::num_mon and builds a monmap with that many entries without
checking that there is at least one. ceph_parse_ips() writes *count only
after it has parsed an address successfully, so a ceph_options that went
through a failed parse still has num_mon == 0 and the resulting monmap
has no monitors in it at all.

The first thing the client does with that monmap is open a session, and
pick_new_mon() asserts the invariant that it is non-empty:

  kernel BUG at net/ceph/mon_client.c:211!
  RIP: 0010:pick_new_mon net/ceph/mon_client.c:211 [inline]
  RIP: 0010:__open_session+0x60f/0x740 net/ceph/mon_client.c:245
  Call Trace:
   ceph_monc_open_session+0x46/0x60 net/ceph/mon_client.c:534
   __ceph_open_session+0x135/0x590 net/ceph/ceph_common.c:798
   ceph_real_mount fs/ceph/super.c:1173 [inline]
   ceph_get_tree+0xd98/0x1fd0 fs/ceph/super.c:1362
   vfs_get_tree+0x92/0x320 fs/super.c:1947
   vfs_cmd_create+0xd7/0x2a0 fs/fsopen.c:231
   __do_sys_fsconfig+0x55a/0xcb0 fs/fsopen.c:463

The reproducer gets there through the new device syntax: an fsconfig()
mon_addr= that does not resolve ("libceph: resolve '127.0.0.' (ret=-3):
failed") leaves fsopt->mon_addr set but num_mon at 0, so the "No monitor
address" check in ceph_get_tree() passes and the mount proceeds with an
empty monmap. The next patch stops that string from being kept, but the
assertion should not be reachable from a mount option in the first place.

Commit 40480eee361e ("libceph: Reject monmaps advertising zero monitors")
made the same BUG_ON() unreachable from the wire by rejecting
num_mon == 0 in ceph_monmap_decode(). Apply the same rule to the initial
monmap, which is the only other way one gets built, and fail the mount
with -EINVAL rather than assert afterwards.

Cc: stable@vger.kernel.org
Fixes: 7b19b4db5add ("ceph: new device mount syntax")
Reported-by: syzbot+1dbed5969931c19d3eb5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1dbed5969931c19d3eb5
Assisted-by: Cursor
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/mon_client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 614d2bba9fd60c..a406fff75ba0db 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -1141,6 +1141,9 @@ static int build_initial_monmap(struct ceph_mon_client *monc)
 	int num_mon = opt->num_mon;
 	int i;
 
+	if (num_mon < 1 || num_mon > CEPH_MAX_MON)
+		return -EINVAL;
+
 	/* build initial monmap */
 	monc->monmap = kzalloc(struct_size(monc->monmap, mon_inst, num_mon),
 			       GFP_KERNEL);

From f0dbd6b9b05e919ebab668f3479aebbcd2431fce Mon Sep 17 00:00:00 2001
From: Xiang Mei <xmei5@asu.edu>
Date: Tue, 15 Sep 2026 14:40:27 -0700
Subject: [PATCH 1779/1982] ceph: fix integer overflow in the snap trace bounds
 check

[ Upstream commit b3bf89767e3ca9506f1c7167cac97c41ec254d42 ]

ceph_update_snap_trace() bounds the two encoded snapid arrays that follow a
struct ceph_mds_snap_realm with sizeof(u64) * (num_snaps +
num_prior_parent_snaps).  Both counts come straight off the wire as __le32,
so the addition is evaluated in unsigned int and wraps before sizeof(u64)
promotes it to size_t: an MDS sending num_snaps = 1 and
num_prior_parent_snaps = 0xffffffff makes the sum zero and the check
degenerates to ceph_decode_need(&p, e, 0, bad), which always passes.
dup_array() then reads num_snaps * 8 bytes past the end of the message
front, which ceph_msg_new2() allocates at exactly front_len bytes.  An
unsolicited CEPH_MSG_CLIENT_SNAP reaches this from a malicious or
compromised MDS with no client-side action, as do the snaptraces carried in
an MDS reply and in a cap import.

Compute the length with size_add()/size_mul() so it saturates at SIZE_MAX
instead of wrapping, in the style fs/ceph/mdsmap.c already uses for
num_export_targets.

  BUG: KASAN: slab-out-of-bounds in dup_array (include/linux/unaligned.h:28 fs/ceph/snap.c:500)
  Read of size 8 at addr ffff8880102a16c8 by task kworker/1:2/129
  Workqueue: ceph-msgr ceph_con_workfn
  Call Trace:
   dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
   print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
   kasan_report (mm/kasan/report.c:595)
   dup_array (include/linux/unaligned.h:28 fs/ceph/snap.c:500)
   ceph_update_snap_trace (fs/ceph/snap.c:836)
   ceph_handle_snap (fs/ceph/snap.c:1155)
   mds_dispatch (fs/ceph/mds_client.c:7234)
   ceph_con_process_message (net/ceph/messenger.c:1424)
   ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
   ceph_con_workfn (net/ceph/messenger.c:1576)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  ...
  The buggy address is located 0 bytes to the right of
   allocated 72-byte region [ffff8880102a1680, ffff8880102a16c8)

Cc: stable@vger.kernel.org
Fixes: 963b61eb041e ("ceph: snapshot management")
Reported-by: co+ecaada42f806f629@bugs.sh
Assisted-by: LLM
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/snap.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index c65f2b202b2b3e..00cfcef5fbb258 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -788,6 +788,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
 	struct ceph_snap_realm *first_realm = NULL;
 	struct ceph_snap_realm *realm_to_rebuild = NULL;
 	struct ceph_client *client = mdsc->fsc->client;
+	size_t snaps_len;
 	int rebuild_snapcs;
 	int err = -ENOMEM;
 	int ret;
@@ -802,8 +803,10 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
 	ceph_decode_need(&p, e, sizeof(*ri), bad);
 	ri = p;
 	p += sizeof(*ri);
-	ceph_decode_need(&p, e, sizeof(u64)*(le32_to_cpu(ri->num_snaps) +
-			    le32_to_cpu(ri->num_prior_parent_snaps)), bad);
+	snaps_len = size_mul(size_add(le32_to_cpu(ri->num_snaps),
+				      le32_to_cpu(ri->num_prior_parent_snaps)),
+			     sizeof(u64));
+	ceph_decode_need(&p, e, snaps_len, bad);
 	snaps = p;
 	p += sizeof(u64) * le32_to_cpu(ri->num_snaps);
 	prior_parent_snaps = p;

From 112f3dba7af4da07c95151e6236213ba7c6b00c9 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:27:04 +0000
Subject: [PATCH 1780/1982] ceph: Fix xattr buffer leak in __send_cap()

[ Upstream commit e51cf76e7275d1bb5ad2d529bb00feade632dadc ]

__prep_cap() takes a reference on the xattr blob via ceph_buffer_get()
and also grabs a reference to the old xattr blob returned by
__ceph_build_xattrs_blob(). These references are normally dropped in
__send_cap() after the cap message has been sent, but when ceph_msg_new()
fails, __send_cap() requeues the cap and returns early without dropping
them, leaking both buffers on every allocation failure.

Release arg->old_xattr_buf and arg->xattr_buf on the ceph_msg_new()
failure path before returning.

Cc: stable@vger.kernel.org
Fixes: 16d68903f56a ("ceph: break up send_cap_msg")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 7ce1af5b61c884..3dfd230412cc29 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1561,6 +1561,8 @@ static void __send_cap(struct cap_msg_args *arg, struct ceph_inode_info *ci)
 		spin_lock(&ci->i_ceph_lock);
 		__cap_delay_requeue(arg->session->s_mdsc, ci);
 		spin_unlock(&ci->i_ceph_lock);
+		ceph_buffer_put(arg->old_xattr_buf);
+		ceph_buffer_put(arg->xattr_buf);
 		return;
 	}
 

From 410855d5e5b63e6a9b5225f0680b68336de90ab2 Mon Sep 17 00:00:00 2001
From: Wentao Liang <vulab@iscas.ac.cn>
Date: Thu, 17 Sep 2026 16:28:07 +0000
Subject: [PATCH 1781/1982] ceph: Fix mds session leak in
 __open_export_target_session()

[ Upstream commit 6c80207392fdb86107d7acbdbf4c86cac38da1af ]

__open_export_target_session() holds a reference on the target session,
either from __ceph_lookup_mds_session() or from register_session(),
which the caller is expected to drop. When __open_session() fails, the
helper returns ERR_PTR(ret) without dropping that reference, leaking
one session reference on every open failure.

Drop the session reference before returning the error.

Cc: stable@vger.kernel.org
Fixes: b682c6d41bc2 ("ceph: switch to WARN_ON_ONCE in encode_supported_features()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index a5bc9f75e0f9c5..56d8df7f7ebddd 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1758,8 +1758,10 @@ __open_export_target_session(struct ceph_mds_client *mdsc, int target)
 	if (session->s_state == CEPH_MDS_SESSION_NEW ||
 	    session->s_state == CEPH_MDS_SESSION_CLOSING) {
 		ret = __open_session(mdsc, session);
-		if (ret)
+		if (ret) {
+			ceph_put_mds_session(session);
 			return ERR_PTR(ret);
+		}
 	}
 
 	return session;

From 813221c8bbc9ce0c22b8a190478f6718d9c69a31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Wed, 23 Sep 2026 20:25:34 +0000
Subject: [PATCH 1782/1982] ceph: fix 32-bit overflow in readdir reply count
 check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 52913831ba56efceaafd80b501d68fa00f79bde6 ]

parse_reply_info_readdir() checks how many entries are in a readdir
reply by computing the end pointer of the decoded array. That pointer
addition can wrap on 32-bit kernels and let an oversized count pass the
check. For example, a count of 0x40000000 with 156-byte entries wraps
to a zero offset, so the decoder can write past the preallocated buffer.

Check the count against the number of entries that fit in the allocation
before publishing dir_nr. Reject oversized replies through the existing
error path.

Cc: stable@vger.kernel.org
Fixes: 54008399dc0c ("ceph: preallocate buffer for readdir reply")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 56d8df7f7ebddd..9e1b4bc3eab7c5 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -436,10 +436,8 @@ static int parse_reply_info_readdir(void **p, void *end,
 		goto done;
 
 	BUG_ON(!info->dir_entries);
-	if ((unsigned long)(info->dir_entries + num) >
-	    (unsigned long)info->dir_entries + info->dir_buf_size) {
+	if (num > info->dir_buf_size / sizeof(*info->dir_entries)) {
 		pr_err_client(cl, "dir contents are larger than expected\n");
-		WARN_ON(1);
 		goto bad;
 	}
 

From e1cf4b41bfbe86f06f272e4c9e87e383d62014fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <Jeremy.Jean@oss.cyber.gouv.fr>
Date: Wed, 23 Sep 2026 08:07:21 +0000
Subject: [PATCH 1783/1982] libceph: fix out-of-bounds reads from repeated
 CRUSH bucket entries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 569a9bb1e5615c2b88b8d76f03a4ab82e65a673e ]

decode_choose_arg() assumes that its destination is zero-initialized.
Although decode_choose_args() zeroes the argument array, it does not reject
a repeated bucket_index and can decode into an already populated entry.

Repeating a bucket with weight_set_size=0 preserves its existing weight_set
pointer but clears the count. Placement then reads weight_set[-1].weights
and dereferences the resulting pointer.

A malformed monitor OSDMap triggers this during RBD placement:

  BUG: KASAN: slab-out-of-bounds in crush_bucket_choose+0xdd1/0xf90
  Read of size 8 at addr ffff88800290df70 by task init/75

Reject populated arguments before decoding another entry, so the error
path can free their original allocations.

Cc: stable@vger.kernel.org
Fixes: c7ed1a4bf4b4 ("crush: assume weight_set != null imples weight_set_size > 0")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ceph/osdmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e812b30778d573..803514a1bc7ced 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -387,6 +387,8 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c)
 				goto e_inval;
 
 			arg = &arg_map->args[bucket_index];
+			if (arg->ids || arg->weight_set)
+				goto e_inval;
 			ret = decode_choose_arg(p, end, arg);
 			if (ret)
 				goto fail;

From 5f4eda68e31881d82d017a1bd51d774fd342f23b Mon Sep 17 00:00:00 2001
From: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Date: Sat, 26 Sep 2026 19:56:51 +0800
Subject: [PATCH 1784/1982] ceph: clamp MDS reply result code to the errno
 range

[ Upstream commit ec8d583469ed64b4973192a21b5a41c33219721f ]

ceph_mdsc_wait_request() returns the reply head result code of the MDS
request to its callers as a plain int errno.  The value is a
server-controlled u32 and nothing checks that it actually is an errno;
several callers pass it straight to ERR_PTR(), e.g.
ceph_finish_lookup() on the atomic open path:

	err = ceph_mdsc_wait_request(...)	/* e.g. +0x50fc00 */
	...
	if (err)
		dentry = ERR_PTR(err);

IS_ERR() only recognizes the [-MAX_ERRNO, -1] window, so an
out-of-range value is not caught anywhere and survives as a "struct
dentry *".  On the open path the positive error travels
ceph_finish_lookup() -> ceph_atomic_open() -> ERR_PTR() in
fs/namei.c's atomic_open() wrapper -> step_into(), which dereferences
it as a dentry and oopses (mainline 7.3-rc3-135-g4982d3552a3b, the
value in R12 is the server-supplied result):

BUG: KASAN: probably user-memory-access in range
[0x000000000050fc00-0x000000000050fc07]
RIP: 0010:step_into_slowpath+0x3e3/0xe60
R12: 000000000050fc00
Call Trace:
 <TASK>
 ? __pfx_ceph_atomic_open+0x10/0x10
 path_openat+0xf41/0x2440
 do_file_open+0x228/0x480
 do_sys_openat2+0x103/0x1d0
 __x64_sys_openat+0x141/0x200
 do_syscall_64+0xe8/0x4f0
 entry_SYSCALL_64_after_hwframe+0x77/0x79
 </TASK>

(0xdffffc00000a1f80 in the full report is the KASAN shadow of 0x50fc00;
without KASAN the raw value is read.)  Values with the top bit set fare
no better: 0xd8000000 sign-extends through the int conversion into the
kernel address range and takes a page fault instead.

Clamp the result at the single read and return -EIO for anything
outside the errno range, which is what a malformed reply means there.
net/9p does the same to server errno values with safe_errno().  This
is the path the reported crash takes; the other readers of
head->result, including the ceph_async_create_cb() and
ceph_async_unlink_cb() callbacks, are not covered by this patch.

Each of the six crashing opens was run on a build of
7.3-rc3-135-g4982d3552a3bf with only this change applied: it crashes
the unpatched kernel on the first openat() (verified on the same
tree without the patch), and with the patch the open fails cleanly
without an oops.  A few hundred normal file operations on the
patched kernel also completed without a crash; valid errno values
pass through unchanged.

Cc: stable@vger.kernel.org
Fixes: 2f2dc053404febedc9c273452d9d518fb31fde72 ("ceph: MDS client")
Signed-off-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 9e1b4bc3eab7c5..e1a0f77acc1ad4 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3814,6 +3814,14 @@ int ceph_mdsc_wait_request(struct ceph_mds_client *mdsc,
 	/* only abort if we didn't race with a real reply */
 	if (test_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags)) {
 		err = le32_to_cpu(req->r_reply_info.head->result);
+		if (err > 0 || err < -MAX_ERRNO) {
+			/*
+			 * The result is server-controlled.  Values outside
+			 * the errno range are turned into bogus pointers by
+			 * the ERR_PTR() users among the callers.
+			 */
+			err = -EIO;
+		}
 	} else if (err < 0) {
 		doutc(cl, "aborted request %lld with %d\n", req->r_tid, err);
 

From 32da9f494080b609a1979d6ae21e0bd1bdd30591 Mon Sep 17 00:00:00 2001
From: Venky Shankar <vshankar@redhat.com>
Date: Wed, 7 Oct 2026 14:25:59 +0530
Subject: [PATCH 1785/1982] ceph: don't fail write_begin with -EAGAIN after
 flushing old snapc

[ Upstream commit 6ff7920ca78f6edcabc26c63d20f681d938027c7 ]

When ceph_netfs_check_write_begin() finds the folio dirty in an older
snap context, it drops the folio, waits for that snap context to be
flushed and then returns -EAGAIN so that the write is retried.

However, since commit fac47b43c760 ("netfs: do not unlock and put the
folio twice"), netfs_write_begin() retries only when ->check_write_begin()
returns 0 with *foliop cleared -- every error, -EAGAIN included, is
returned as is. The -EAGAIN thus propagates up to write(2), which fails
with "Resource temporarily unavailable" once the dirty data has been
flushed, rather than being retried.

This is easily hit by buffered writers rewriting dirty pages while
snapshots are being taken, e.g. a kernel build linking vmlinux into a
directory under a snapshot schedule:

  ld: final link failed: Resource temporarily unavailable

Return the wait_event_killable() result as is so that netfs re-gets the
folio and retries on success.

Cc: stable@vger.kernel.org
Fixes: fac47b43c760 ("netfs: do not unlock and put the folio twice")
Link: https://tracker.ceph.com/issues/57656
Signed-off-by: Venky Shankar <vshankar@redhat.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/addr.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index f58eba5456e361..fe8b7b4f6e8bff 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1889,7 +1889,12 @@ static int ceph_netfs_check_write_begin(struct file *file, loff_t pos, unsigned
 		r = wait_event_killable(ci->i_cap_wq,
 					context_is_writeable_or_written(inode, snapc));
 		ceph_put_snap_context(snapc);
-		return r == 0 ? -EAGAIN : r;
+		/*
+		 * *foliop is cleared, so a return of 0 makes
+		 * netfs_write_begin() grab the folio again and call us again
+		 * to recheck it. Any error (fatal signal) fails the write.
+		 */
+		return r;
 	}
 	return 0;
 }

From 512b5cf725d576aba222d976f9cb9a197d3316ab Mon Sep 17 00:00:00 2001
From: sung byeongchan <tjdqudcks0424@naver.com>
Date: Thu, 8 Oct 2026 15:06:46 +0900
Subject: [PATCH 1786/1982] ceph: validate fscrypt auth blob length

[ Upstream commit bc418e234e5be14b97dec90e84a680e615b4134e ]

ceph_crypt_get_context() trusts cfa_blob_len after checking only that the
inode-owned fscrypt_auth allocation contains the fixed header and one byte.
An MDS can therefore place a larger inner length in a shorter outer object,
causing memcpy() to read beyond the allocation when a caller requests the
encryption nonce.

Require the complete blob to fit in the inode-owned allocation before using
the inner length.

On the tested baseline, the malformed reply produced the same KASAN
slab-out-of-bounds read twice. An ordinary UID obtained sixteen wire-absent
SLUB redzone bytes in two non-KASAN production-path runs. The input was
rejected twice after this change, while a complete context still worked.

Cc: stable@vger.kernel.org
Fixes: 2d332d5bc424 ("ceph: fscrypt_auth handling for ceph")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/crypto.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
index a236035f3a7a4d..f23ba5c1487807 100644
--- a/fs/ceph/crypto.c
+++ b/fs/ceph/crypto.c
@@ -83,6 +83,9 @@ static int ceph_crypt_get_context(struct inode *inode, void *ctx, size_t len)
 		return -ENOBUFS;
 
 	ctxlen = le32_to_cpu(cfa->cfa_blob_len);
+	if (ctxlen > ci->fscrypt_auth_len -
+		     offsetof(struct ceph_fscrypt_auth, cfa_blob))
+		return -ENOBUFS;
 	if (len < ctxlen)
 		return -ERANGE;
 

From ff6e8ae28b522586507f7de81230b471a4d9c633 Mon Sep 17 00:00:00 2001
From: sung byeongchan <tjdqudcks0424@naver.com>
Date: Thu, 8 Oct 2026 15:07:14 +0900
Subject: [PATCH 1787/1982] ceph: bound name skips in ceph_mdsmap_decode() by
 the message end

[ Upstream commit 7f702e1703c9648fcb02a217d66c880d00417150 ]

ceph_mdsmap_decode() reads two remote u32 name lengths and advances its
parser cursor without checking that either string remains in the message.
On a 32-bit client, a sufficiently large length can wrap the cursor below
`end`.  The following numerical bounds check then succeeds and dereferences
the wrapped address.

Use ceph_decode_skip_n() for both names so the remaining bytes are checked
before the cursor advances.

The issue produced a page fault in ceph_mdsmap_decode twice on the tested
i386 baseline.  The same frame was rejected without a fault twice after
this change, while a normal MDSMap continued to be accepted.

Cc: stable@vger.kernel.org
Fixes: 2f2dc053404f ("ceph: MDS client")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mdsmap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
index 0fd578f0b2cd26..d377d13f854d59 100644
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -209,7 +209,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
 		ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
 		*p += sizeof(u64);
 		namelen = ceph_decode_32(p);  /* skip mds name */
-		*p += namelen;
+		ceph_decode_skip_n(p, end, namelen, bad);
 
 		ceph_decode_32_safe(p, end, mds, bad);
 		ceph_decode_32_safe(p, end, inc, bad);
@@ -227,7 +227,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p,
 		laggy = laggy_since.tv_sec != 0 || laggy_since.tv_nsec != 0;
 		*p += sizeof(u32);
 		ceph_decode_32_safe(p, end, namelen, bad);
-		*p += namelen;
+		ceph_decode_skip_n(p, end, namelen, bad);
 		if (info_v >= 2) {
 			ceph_decode_32_safe(p, end, num_export_targets, bad);
 			export_targets_len = size_mul(num_export_targets,

From fa6e5325278c620391ee6b75abc731532d66e57f Mon Sep 17 00:00:00 2001
From: sung byeongchan <tjdqudcks0424@naver.com>
Date: Thu, 8 Oct 2026 15:07:25 +0900
Subject: [PATCH 1788/1982] ceph: validate MDS reply fragtree split array
 length

[ Upstream commit 8cab7e7461f81ea1e0fd45082b50bb3c04c0bb10 ]

parse_reply_info_in() advances over the fragtree split array using an
unchecked count multiplication.  On a 32-bit client, nsplits=0x20000000
wraps the byte length to zero, so the reply is accepted and
ceph_fill_fragtree() sorts far beyond the message front.

Compute the split length with size_mul() and require the complete array to
remain in the inode record before advancing the cursor.

The malformed reply faulted in frag_tree_split_cmp() twice on the tested
i386 baseline.  It was rejected without a fault twice after this change,
while a normal reply and a one-split control remained functional.

Cc: stable@vger.kernel.org
Fixes: 2f2dc053404f ("ceph: MDS client")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index e1a0f77acc1ad4..0220daac0fba72 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -14,6 +14,7 @@
 #include <linux/ktime.h>
 #include <linux/bitmap.h>
 #include <linux/mnt_idmapping.h>
+#include <linux/overflow.h>
 
 #include "super.h"
 #include "mds_client.h"
@@ -104,6 +105,7 @@ static int parse_reply_info_in(void **p, void *end,
 			       u64 features)
 {
 	int err = 0;
+	size_t splits_len;
 	u8 struct_v = 0;
 
 	if (features == (u64)-1) {
@@ -122,9 +124,11 @@ static int parse_reply_info_in(void **p, void *end,
 
 	ceph_decode_need(p, end, sizeof(struct ceph_mds_reply_inode), bad);
 	info->in = *p;
-	*p += sizeof(struct ceph_mds_reply_inode) +
-		sizeof(*info->in->fragtree.splits) *
-		le32_to_cpu(info->in->fragtree.nsplits);
+	splits_len = size_mul(sizeof(*info->in->fragtree.splits),
+			      le32_to_cpu(info->in->fragtree.nsplits));
+	*p += sizeof(struct ceph_mds_reply_inode);
+	ceph_decode_need(p, end, splits_len, bad);
+	*p += splits_len;
 
 	ceph_decode_32_safe(p, end, info->symlink_len, bad);
 	ceph_decode_need(p, end, info->symlink_len, bad);

From 6f8082c1fb88f478826d355ec3cefc6ff09da6e1 Mon Sep 17 00:00:00 2001
From: sung byeongchan <tjdqudcks0424@naver.com>
Date: Thu, 8 Oct 2026 15:07:38 +0900
Subject: [PATCH 1789/1982] ceph: validate encoded xattr name lengths

[ Upstream commit 166375898d29fea050a9abec855da6075050d5c9 ]

__build_xattrs() advances over an MDS-provided name length before checking
that the name remains in the encoded xattr blob.  On 32-bit clients,
UINT_MAX wraps the cursor and is stored as a negative internal name
length.  A later ordinary listxattr() converts it back to a UINT_MAX memcpy
size and corrupts kernel memory.

Check the name range before advancing and reject name, value, or aggregate
sizes that overflow the signed internal accounting.

The malformed blob corrupted kernel state in two baseline boots.  It was
rejected cleanly twice with this change, while normal and length-only
controls remained safe.

Cc: stable@vger.kernel.org
Fixes: 355da1eb7a1f ("ceph: inode operations")
Assisted-by: LLM
Signed-off-by: sung byeongchan <tjdqudcks0424@naver.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/xattr.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index cc73b0874ce40a..90a9e7de8fea0d 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -11,6 +11,7 @@
 #include <linux/security.h>
 #include <linux/posix_acl_xattr.h>
 #include <linux/slab.h>
+#include <linux/overflow.h>
 
 #define XATTR_CEPH_PREFIX "ceph."
 #define XATTR_CEPH_PREFIX_LEN (sizeof (XATTR_CEPH_PREFIX) - 1)
@@ -845,14 +846,23 @@ static int __build_xattrs(struct inode *inode)
 		}
 		err = -EIO;
 		while (numattr--) {
+			int names_size, vals_size;
+
 			ceph_decode_32_safe(&p, end, len, bad);
 			namelen = len;
 			name = p;
+			ceph_decode_need(&p, end, namelen, bad);
 			p += len;
 			ceph_decode_32_safe(&p, end, len, bad);
 			ceph_decode_need(&p, end, len, bad);
 			val = p;
 			p += len;
+			if (namelen > INT_MAX || len > INT_MAX ||
+			    check_add_overflow(ci->i_xattrs.names_size,
+					       (int)namelen, &names_size) ||
+			    check_add_overflow(ci->i_xattrs.vals_size,
+					       (int)len, &vals_size))
+				goto bad;
 
 			err = __set_xattr(ci, name, namelen, val, len,
 					  0, 0, &xattrs[numattr]);

From c94e08ae4ad38ef847e273d9d989b106a083dd2e Mon Sep 17 00:00:00 2001
From: Alex Markuze <amarkuze@redhat.com>
Date: Tue, 20 Oct 2026 08:47:30 +0000
Subject: [PATCH 1790/1982] ceph: fix uninitialized err in
 ceph_netfs_issue_read()

[ Upstream commit 823d21c78453fcdf58dbd8ecefbb41f4f3eb6540 ]

ceph_netfs_issue_read() declares err without an initializer. On the
unencrypted, non-sparse success path nothing assigns it, then the
out: label does if (err) netfs_read_subreq_terminated(subreq).

With CONFIG_INIT_STACK_ALL_PATTERN, err is 0xaaaaaaaa (nonzero), so
the subrequest is terminated while the OSD READ is still in flight.
netfs then frees the rolling buffer that the OSD iterator still
points at, causing a KASAN UAF / oops, and finish_netfs_read()
terminates the same subrequest a second time. CONFIG_INIT_STACK_ALL_ZERO
hides it because err happens to be 0.

Restore the err = 0 initializer so a successful submit leaves
completion to finish_netfs_read() only.

Cc: stable@vger.kernel.org
Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading")
Reported-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Alex Markuze <amarkuze@redhat.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/addr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index fe8b7b4f6e8bff..51aeae341f56da 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -362,7 +362,7 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq)
 	struct ceph_client *cl = fsc->client;
 	struct ceph_osd_request *req = NULL;
 	struct ceph_vino vino = ceph_vino(inode);
-	int err;
+	int err = 0;
 	u64 len;
 	bool sparse = IS_ENCRYPTED(inode) || ceph_test_mount_opt(fsc, SPARSEREAD);
 	u64 off = subreq->start;

From 2431c46f95a353ecea7a3db2da54164f2e654505 Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Mon, 26 Oct 2026 08:23:50 +0800
Subject: [PATCH 1791/1982] f2fs: fix to update superblock crc in
 sanity_check_area_boundary()

[ Upstream commit f8f956c7ec8c0285d7a80bed497d2f7adcbded15 ]

This patch fixes the bug reported by Sashiko:

We should update superblock crc along w/ raw_super->segment_count in
sanity_check_area_boundary() if sb_checksum feature is enabled.

Cc: stable@kernel.org
Fixes: d440c52d3151 ("f2fs: support superblock checksum")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 11d218b415b0d3..69d36e1a301bfd 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3920,6 +3920,12 @@ static inline bool sanity_check_area_boundary(struct f2fs_sb_info *sbi,
 		/* fix in-memory information all the time */
 		raw_super->segment_count = cpu_to_le32((main_end_blkaddr -
 				segment0_blkaddr) >> log_blocks_per_seg);
+		if (__F2FS_HAS_FEATURE(raw_super, F2FS_FEATURE_SB_CHKSUM)) {
+			__u32 crc = f2fs_crc32(raw_super,
+					offsetof(struct f2fs_super_block, crc));
+
+			raw_super->crc = cpu_to_le32(crc);
+		}
 
 		if (f2fs_readonly(sb) || f2fs_hw_is_readonly(sbi)) {
 			set_sbi_flag(sbi, SBI_NEED_SB_WRITE);

From a55460a33402c09a8733d5ddbcb6db9865de50be Mon Sep 17 00:00:00 2001
From: Val Packett <val@packett.cool>
Date: Fri, 16 Oct 2026 03:29:17 -0300
Subject: [PATCH 1792/1982] ASoC: qcom: qdsp6: q6afe: fix clk vote response
 type mismatch

[ Upstream commit f3c7bee984aa0ba2b48a44e16a6f3ec2c27f851e ]

The response sent by the firmware when requesting a clock vote (opcode
AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST) does not actually have
the same opcode + status payload as APR_BASIC_RSP_RESULT. Rather, it
returns one single u32 which is the client_handle that must be used in
future unvote requests for the same clock.

As a result of this type confusion, the status returned by the callback
to q6afe_vote_lpass_core_hw was actually an out-of-bounds read. It was
only interpreted as success (0) most of the time due to luck, but there
are some reports of random errors such as:

[   20.961100] qcom-q6afe aprsvc:service:4:4: AFE failed to vote (3)
[   20.961131] Failed to prepare clk 'core': -110

Fix by correctly interpreting the response as a single u32, and actually
store it as the client_handle to ensure unvote would work correctly.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/5976946.DvuYhMxLoT@antlia/
Fixes: 55e07531d922 ("ASoC: q6dsp: q6afe: add lpass hw voting support")
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Val Packett <val@packett.cool>
Link: https://patch.msgid.link/20261016063536.598610-1-val@packett.cool
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/qdsp6/q6afe.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
index 7b59d514b432a2..d2cb0ccd345620 100644
--- a/sound/soc/qcom/qdsp6/q6afe.c
+++ b/sound/soc/qcom/qdsp6/q6afe.c
@@ -377,6 +377,7 @@ struct q6afe {
 	struct q6core_svc_api_info ainfo;
 	struct mutex lock;
 	struct aprv2_ibasic_rsp_result_t result;
+	uint32_t vote_result;
 	wait_queue_head_t wait;
 	struct list_head port_list;
 	spinlock_t port_list_lock;
@@ -966,13 +967,14 @@ static int q6afe_callback(struct apr_device *adev, struct apr_resp_pkt *data)
 	struct aprv2_ibasic_rsp_result_t *res;
 	struct apr_hdr *hdr = &data->hdr;
 	struct q6afe_port *port;
+	uint32_t *vote_res;
 
 	if (!data->payload_size)
 		return 0;
 
-	res = data->payload;
 	switch (hdr->opcode) {
 	case APR_BASIC_RSP_RESULT: {
+		res = data->payload;
 		if (res->status) {
 			dev_err(afe->dev, "cmd = 0x%x returned error = 0x%x\n",
 				res->opcode, res->status);
@@ -999,8 +1001,10 @@ static int q6afe_callback(struct apr_device *adev, struct apr_resp_pkt *data)
 	}
 		break;
 	case AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST:
+		vote_res = data->payload;
 		afe->result.opcode = hdr->opcode;
-		afe->result.status = res->status;
+		afe->result.status = 0;
+		afe->vote_result = *vote_res;
 		wake_up(&afe->wait);
 		break;
 	default:
@@ -1910,6 +1914,8 @@ int q6afe_vote_lpass_core_hw(struct device *dev, uint32_t hw_block_id,
 			       AFE_CMD_RSP_REMOTE_LPASS_CORE_HW_VOTE_REQUEST);
 	if (ret)
 		dev_err(afe->dev, "AFE failed to vote (%d)\n", hw_block_id);
+	else
+		*client_handle = afe->vote_result;
 
 
 	kfree(pkt);

From e4ab85f273f41aa7dbfc2a876f2c42275c9ba783 Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date: Fri, 23 Oct 2026 18:13:11 +0100
Subject: [PATCH 1793/1982] ASoC: codecs: wsa884x: Accept temperatures across
 the full trim range

[ Upstream commit 00535515e3c14fbee20de4a1aa61cfb3390f0f50 ]

wsa884x_get_temp() rejects any reading outside 5..45 degC with -EAGAIN.
A speaker that has been playing, or sits in a warm laptop, easily runs
above 45 degC, so its temperature becomes unreadable when it matters.

The check only needs to drop bogus conversions, such as the all-zero
reading before the PA is first enabled. Bound it by the -10..150 degC
two-point trim range instead.

Fixes: 6b99dc62d940 ("ASoC: codecs: wsa884x: Implement temperature reading and hwmon")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261023171316.819857-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wsa884x.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sound/soc/codecs/wsa884x.c b/sound/soc/codecs/wsa884x.c
index 5ecd7962d77ae1..d941e9826ba00c 100644
--- a/sound/soc/codecs/wsa884x.c
+++ b/sound/soc/codecs/wsa884x.c
@@ -720,10 +720,11 @@
 
 /*
  * Device will report senseless data in many cases, so discard any measurements
- * outside of valid range.
+ * outside of the two-point trim range. Do not narrow this to ambient: a
+ * speaker that has been playing easily runs well above 45 degC.
  */
-#define WSA884X_LOW_TEMP_THRESHOLD	5
-#define WSA884X_HIGH_TEMP_THRESHOLD	45
+#define WSA884X_LOW_TEMP_THRESHOLD	WSA884X_T1_TEMP
+#define WSA884X_HIGH_TEMP_THRESHOLD	WSA884X_T2_TEMP
 
 struct wsa884x_priv {
 	struct regmap *regmap;
@@ -1931,8 +1932,8 @@ static int wsa884x_get_temp(struct wsa884x_priv *wsa884x, long *temp)
 	dev_dbg(wsa884x->dev, "Measured temp %ld (dmeas=%d, d1=%d, d2=%d)\n",
 		val, dmeas, d1, d2);
 
-	if ((val > WSA884X_LOW_TEMP_THRESHOLD) &&
-	    (val < WSA884X_HIGH_TEMP_THRESHOLD)) {
+	if (val >= WSA884X_LOW_TEMP_THRESHOLD &&
+	    val <= WSA884X_HIGH_TEMP_THRESHOLD) {
 		wsa884x->temperature = val;
 		*temp = val * 1000;
 		ret = 0;

From 9189524229c35f8aca0584c7cb758d4406e0e1de Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date: Fri, 23 Oct 2026 18:13:12 +0100
Subject: [PATCH 1794/1982] ASoC: codecs: wsa883x: Accept temperatures across
 the full trim range

[ Upstream commit 6a55cf0d9dd2e2493a5030a4f7b0413d31165e45 ]

wsa883x_get_temp() rejects any reading outside 5..45 degC with -EAGAIN,
so a speaker that has been playing, or sits in a warm chassis, becomes
unreadable above 45 degC.

Bound the check by the -10..150 degC two-point trim range instead, and
use inclusive comparisons, as in_range() excludes the upper bound.

Fixes: a02c42d41af7 ("ASoC: codecs: wsa883x: Implement temperature reading and hwmon")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20261023171316.819857-4-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wsa883x.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c
index 5f2ced650dcc81..6fb50b6e5e1886 100644
--- a/sound/soc/codecs/wsa883x.c
+++ b/sound/soc/codecs/wsa883x.c
@@ -455,10 +455,11 @@
 
 /*
  * Device will report senseless data in many cases, so discard any measurements
- * outside of valid range.
+ * outside of the two-point trim range. Do not narrow this to ambient: a
+ * speaker that has been playing easily runs well above 45 degC.
  */
-#define WSA883X_LOW_TEMP_THRESHOLD	5
-#define WSA883X_HIGH_TEMP_THRESHOLD	45
+#define WSA883X_LOW_TEMP_THRESHOLD	WSA883X_T1_TEMP
+#define WSA883X_HIGH_TEMP_THRESHOLD	WSA883X_T2_TEMP
 
 struct wsa883x_priv {
 	struct regmap *regmap;
@@ -1430,7 +1431,7 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
 	unsigned int dmeas_msb = 0, dmeas_lsb = 0;
 	int d1, d2, dmeas;
 	unsigned int mask;
-	int ret, range;
+	int ret;
 	long val;
 
 	guard(mutex)(&wsa883x->sp_lock);
@@ -1493,8 +1494,8 @@ static int wsa883x_get_temp(struct wsa883x_priv *wsa883x, long *temp)
 	}
 
 	val = WSA883X_T1_TEMP + (((dmeas - d1) * (WSA883X_T2_TEMP - WSA883X_T1_TEMP)) / (d2 - d1));
-	range = WSA883X_HIGH_TEMP_THRESHOLD - WSA883X_LOW_TEMP_THRESHOLD;
-	if (in_range(val, WSA883X_LOW_TEMP_THRESHOLD, range)) {
+	if (val >= WSA883X_LOW_TEMP_THRESHOLD &&
+	    val <= WSA883X_HIGH_TEMP_THRESHOLD) {
 		wsa883x->temperature = val;
 		*temp = val * 1000;
 		ret = 0;

From 1179a864db9dff2258d72deee2348d967cfd6f29 Mon Sep 17 00:00:00 2001
From: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Date: Wed, 21 Oct 2026 10:03:10 +0800
Subject: [PATCH 1795/1982] net: usb: pegasus: check rx pkt_len against the
 received length

[ Upstream commit efee699f6de06611234ef9b0abd52db1340e5452 ]

read_bulk_callback() takes the frame length from the device, from the
receive header on the 0x8513 and from the trailing status bytes on the
other chips, and only checks it against PEGASUS_MTU before passing that
many bytes up the stack. In two cases the stack then uses bytes that the
device did not send:

- A device that sends a short transfer but claims a long frame gets the
  stale or uninitialized remainder of the receive skb delivered as
  packet data.

- A device that claims a frame shorter than an Ethernet header gets
  past the check as well. eth_type_trans() takes pkt_type from h_dest
  and the protocol from h_proto without checking skb->len. If the
  transfer is also short, those come from bytes left in the skb by an
  earlier transfer, or from uninitialized memory.

Drop frames shorter than ETH_HLEN, and frames whose claimed length, plus
the 0x8513 header, does not fit in the bytes actually received, and
count them as length errors. urb->actual_length never exceeds the
PEGASUS_MTU sized transfer buffer, so this also covers the existing
PEGASUS_MTU check. Valid Ethernet frames are at least 60 bytes long
without the FCS, so they are not affected.

Found by code review with LLM assistance. With an emulated USB device,
a 101-byte transfer claiming a 1500-byte frame was passed up as a
1500-byte packet before this change and is dropped after it, and
frames claiming 0, 4 and 13 bytes were passed up and are now dropped
and counted in rx_length_errors. The extra bytes happened to be zero
in the first test, so disclosure of actual kernel data was not
demonstrated.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <law.wei.jie@gt.tech.gov.sg>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261021020310.34045-3-law.wei.jie@gt.tech.gov.sg
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/pegasus.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index f5a26a0bc679a1..69445a94ee6ffe 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -523,11 +523,17 @@ static void read_bulk_callback(struct urb *urb)
 	}
 
 	/*
-	 * If the packet is unreasonably long, quietly drop it rather than
-	 * kernel panicing by calling skb_put.
+	 * Drop frames shorter than an Ethernet header, because
+	 * eth_type_trans() reads the header whatever the length, and frames
+	 * longer than what was actually received. Passing either up would
+	 * expose stale buffer contents, and skb_put() could panic on the
+	 * latter. count is at most PEGASUS_MTU.
 	 */
-	if (pkt_len > PEGASUS_MTU - rx_offset)
+	if (pkt_len < ETH_HLEN || pkt_len + rx_offset > count) {
+		net->stats.rx_errors++;
+		net->stats.rx_length_errors++;
 		goto goon;
+	}
 
 	/*
 	 * at this point we are sure pegasus->rx_skb != NULL

From b124b5a2d82f894cda2b327f4b9fec28b7a590a3 Mon Sep 17 00:00:00 2001
From: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: Fri, 23 Oct 2026 18:45:27 +0800
Subject: [PATCH 1796/1982] bonding: fix out-of-bounds read of arp_ip_target

[ Upstream commit a81513bf5bdf29cf00c0a11f56be515c1ec260f4 ]

arp_ip_target is a module parameter array with BOND_MAX_ARP_TARGETS
entries. In the loop parsing it in bond_check_params(), arp_ip_count is
the number of accepted targets, while i is the index into
arp_ip_target. Invalid and duplicate entries are skipped without
bumping arp_ip_count, so bounding the loop with arp_ip_count lets i run
past the end of arp_ip_target, e.g. 16 targets with one duplicate:

  BUG: KASAN: global-out-of-bounds in bond_check_params.constprop.0+0x1148/0x1440
  Read of size 8 at addr ffffffff96e9ee00 by task swapper/0/1
  Call Trace:
   <TASK>
   dump_stack_lvl+0x91/0xf0
   print_report+0xd1/0x630
   kasan_report+0xf3/0x130
   __asan_report_load8_noabort+0x14/0x30
   bond_check_params.constprop.0+0x1148/0x1440
   bonding_init+0x13/0xe0
   do_one_initcall+0xe7/0x5b0
   kernel_init_freeable+0xa91/0x1120
   kernel_init+0x24/0x220
   ret_from_fork+0x5b3/0x820
   ret_from_fork_asm+0x1a/0x30
   </TASK>

  The buggy address belongs to the variable:
   arp_ip_target+0x80/0xa0

Bound the loop with i instead. arp_ip_count never exceeds i, so it
stays within BOND_MAX_ARP_TARGETS too.

Fixes: 5a5c5fd48e3b ("bonding: arp_ip_count and arp_targets can be wrong")
Cc: stable@vger.kernel.org
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20261023104528.232427-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index baafc13603d3d9..2e9e1b4d74da9b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -6270,7 +6270,7 @@ static int __init bond_check_params(struct bond_params *params)
 	}
 
 	for (arp_ip_count = 0, i = 0;
-	     (arp_ip_count < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
+	     (i < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
 		__be32 ip;
 
 		/* not a complete check, but good enough to catch mistakes */

From 0cc5459983d1e158dce54e539f7d5c94777c0ac9 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Sun, 25 Oct 2026 09:17:28 +0200
Subject: [PATCH 1797/1982] ipmr: fully initialize the synthetic IP header in
 ipmr_get_route()

[ Upstream commit 134351edc28e083c61012b6c69e8e54dd7fa5bcc ]

For an unresolved multicast route query, ipmr_get_route() builds a
synthetic IP header in the headroom obtained from
skb_realloc_headroom(), which does not zero the memory it allocates.
Only a few fields are initialized, leaving others as stale heap
contents.

ipmr_cache_report() copies this header into the IGMPMSG_NOCACHE report
that is queued to the mroute socket, so a recvmsg() on that socket leaks
the uninitialized bytes to user space: the 'tos' field [1] and the 'id'
and 'frag_off' fields [2].

Fix by zeroing the IP header before filling in the few fields that are
used, so that the entire header is initialized, as in ip6mr_get_route().

[1]
BUG: KMSAN: kernel-infoleak in _copy_to_iter
 raw_recvmsg

Uninit was stored to memory at:
 ipmr_cache_report
 ipmr_cache_unresolved
 ipmr_get_route

Uninit was created at:
 pskb_expand_head
 skb_realloc_headroom
 ipmr_get_route

Byte 1 of 28 is uninitialized

[2]
BUG: KMSAN: kernel-infoleak in _copy_to_iter
 raw_recvmsg

Uninit was stored to memory at:
 ipmr_cache_report
 ipmr_cache_unresolved
 ipmr_get_route

Uninit was created at:
 pskb_expand_head
 skb_realloc_headroom
 ipmr_get_route

Bytes 4-7 of 28 are uninitialized

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/0545f0c83f5ee2f6696210f87268e811ef655715.1792476357.git.zhilinz%40nebusec.ai
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261025071729.34967-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ipmr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b1282c01a77e01..66a7f25f236b86 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2474,6 +2474,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
 		skb_push(skb2, sizeof(struct iphdr));
 		skb_reset_network_header(skb2);
 		iph = ip_hdr(skb2);
+		memset(iph, 0, sizeof(*iph));
 		iph->ihl = sizeof(struct iphdr) >> 2;
 		iph->saddr = saddr;
 		iph->daddr = daddr;

From 01c9e3038a39a1eb683f0b7e2a9d59398b5d759d Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 30 Sep 2026 19:24:48 +0200
Subject: [PATCH 1798/1982] dt-bindings: clock: ma35d1: Document the missing
 crystal inputs

[ Upstream commit ea1f41802312e77b58113146a060fb0546b2234d ]

The MA35D1 clock controller takes two crystal oscillator inputs from
the board:
- HXT, a high-speed 24 MHz crystal for most of the system
- LXT, a low-speed 32.768 kHz crytal for the RTC and low power modes

So far the binding was expecting a single crystal. The example named it
HXT, but no real definition for it was given. LXT was not even
described. In order to remain backward compatible, we will continue to
allow either one (HXT) or two (HXT then LXT) input clocks. I propose to
give those phandles a name to clarify what these entries expect, but I'm
not listing the clock-names property in the required block, for backward
compatibility. The rates are fixed by the TRM, so even if the second
oscillator is not described, the OS can make an educated guess.

Fixes: 2f8b5eb589cb ("dt-bindings: clock: nuvoton: add binding for ma35d1 clock controller")
Cc: stable@vger.kernel.org
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260930-perso-ma35d1-upstream-clk-v6-2-48937ee6c9bb@bootlin.com
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../bindings/clock/nuvoton,ma35d1-clk.yaml       | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml b/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
index 8f0c43683729b3..9649feda8d7a52 100644
--- a/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
+++ b/Documentation/devicetree/bindings/clock/nuvoton,ma35d1-clk.yaml
@@ -29,7 +29,18 @@ properties:
     const: 1
 
   clocks:
-    maxItems: 1
+    minItems: 1
+    maxItems: 2
+    description:
+      The controller takes 2 crystal oscillator inputs from the board.
+      HXT is a 24 MHz crystal feeding the internal PLLs. LXT is a 32.768
+      kHz crystal, for RTC and low power operations.
+
+  clock-names:
+    minItems: 1
+    items:
+      - const: hxt
+      - const: lxt
 
   nuvoton,pll-mode:
     description:
@@ -58,6 +69,7 @@ examples:
         compatible = "nuvoton,ma35d1-clk";
         reg = <0x40460200 0x100>;
         #clock-cells = <1>;
-        clocks = <&clk_hxt>;
+        clocks = <&clk_hxt>, <&clk_lxt>;
+        clock-names = "hxt", "lxt";
     };
 ...

From a3d1e34ce1284fb9ea2e01e479123d3f285b4612 Mon Sep 17 00:00:00 2001
From: Yingjie Wang <1075151112@qq.com>
Date: Fri, 23 Oct 2026 22:40:36 +0800
Subject: [PATCH 1799/1982] tcp: limit tcp_tso_rtt_log to a valid shift count

[ Upstream commit 850a7225bc61cdfaf0c4b02ff341ae7cb54902f5 ]

tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
an upper bound, so it accepts values through 255. Values above 31 make
the shift undefined.

A process with CAP_NET_ADMIN in the target network namespace can set the
per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
TCP data over loopback triggers:

  UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
  shift exponent 32 is too large for 32-bit type 'unsigned int'
  Call Trace:
   __ubsan_handle_shift_out_of_bounds
   tcp_tso_segs
   tcp_write_xmit
   __tcp_push_pending_frames
   tcp_push
   tcp_sendmsg_locked

Limit the sysctl to 31, the largest valid shift count for a u32, and
document the accepted range. Writes of larger values now fail with
-EINVAL.

On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
valid boundary values produced no sanitizer diagnostics.

Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/tencent_31D2FFCCE76C50A695A1270151F825E90906@qq.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/networking/ip-sysctl.rst | 2 ++
 net/ipv4/sysctl_net_ipv4.c             | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index c2ca933f7bdbc6..9b8a1980bb546e 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1088,6 +1088,8 @@ tcp_tso_rtt_log - INTEGER
 
 	If you want to use the old autosizing, set this sysctl to 0.
 
+	Possible values are [0, 31], inclusive.
+
 	Default: 9  (2^9 = 512 usec)
 
 tcp_pacing_ss_ratio - INTEGER
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 34a8a932402d84..bc3e5d6b8662cf 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,7 @@ static int ip_local_port_range_max[] = { 65535, 65535 };
 static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int tcp_app_win_max = 31;
+static int tcp_tso_rtt_log_max = 31;
 static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
 static int tcp_min_snd_mss_max = 65535;
 static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
@@ -1379,6 +1380,7 @@ static struct ctl_table ipv4_net_table[] = {
 		.maxlen		= sizeof(u8),
 		.mode		= 0644,
 		.proc_handler	= proc_dou8vec_minmax,
+		.extra2		= &tcp_tso_rtt_log_max,
 	},
 	{
 		.procname	= "tcp_min_rtt_wlen",

From a6814a094d3bf29bb35b1212a718fd9639469d0a Mon Sep 17 00:00:00 2001
From: Paul Moses <p@1g4.org>
Date: Wed, 21 Oct 2026 22:47:33 +0000
Subject: [PATCH 1800/1982] xsk: restore UMEM flags after failed pool
 assignment

[ Upstream commit b88b826ec54a06f48a42580c609ba81293ebec8e ]

xp_assign_dev() sets XDP_UMEM_SG_FLAG before checking whether the
device supports multibuffer zero-copy. If assignment fails, xsk_bind()
destroys the pool but retains the registered UMEM. A subsequent bind
without XDP_USE_SG inherits the stale flag.

The flag also changes RX buffer sizing after DMA mapping. On igc, a
failed SG bind followed by a non-SG retry with 4096-byte chunks and
1792 bytes of headroom passes admission with 2048 bytes, but programs
a 1024-byte RX buffer. On I225-V hardware, an ordinary 1514-byte frame
is truncated to 1024 bytes or 1008 with RX timestamps enabled.
Restoring the original flags eliminates the truncation in both cases.

Save the UMEM flags before assignment and restore them on failure.

Discovered during development of AF_XDP changes for igc.

Fixes: d609f3d228a8 ("xsk: add multi-buffer support for sockets sharing umem")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20261021224705.2078753-1-p@1g4.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk_buff_pool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index 5ee0edaf075c08..9dc1ff31867a13 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c
@@ -175,6 +175,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
 {
 	u32 needed = netdev->mtu + ETH_PAD_LEN;
 	u32 segs = netdev->xdp_zc_max_segs;
+	u8 umem_flags = pool->umem->flags;
 	bool mbuf = flags & XDP_USE_SG;
 	bool force_zc, force_copy;
 	struct netdev_bpf bpf;
@@ -270,6 +271,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
 	if (!force_zc)
 		err = 0; /* fallback to copy mode */
 	if (err) {
+		pool->umem->flags = umem_flags;
 		xsk_clear_pool_at_qid(netdev, queue_id);
 		dev_put(netdev);
 	}

From 9e48dbf6841e67c311a4099b768b4e331eae15c4 Mon Sep 17 00:00:00 2001
From: Dominik Maier <dmnk@google.com>
Date: Sun, 25 Oct 2026 21:07:40 +0100
Subject: [PATCH 1801/1982] loop: check for read-write open mode on
 LOOP_SET_STATUS in lo_compat_ioctl()

[ Upstream commit 87409eedc543d288cdd49c2174f7d61eca7b8db5 ]

lo_ioctl() checks for (mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN)
before allowing LOOP_SET_STATUS or LOOP_SET_STATUS64, but not
lo_compat_ioctl(), the handler used by 32-bit user space on 64-bit
kernels.

As a result, on 64-bit kernels with CONFIG_COMPAT=y, a 32-bit
unprivileged user-space process holding a read-only (O_RDONLY) file
descriptor to an active /dev/loopN device can issue a compat
LOOP_SET_STATUS ioctl to modify lo_offset, clear lo_sizelimit to 0
(exposing backing-file data past the configured limit), or alter
lo_flags.

Enforce the same (mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN) check
on LOOP_SET_STATUS in lo_compat_ioctl().

Cc: stable@vger.kernel.org
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Reviewed-by: Bart Van Assche bvanassche@acm.org
Link: https://patch.msgid.link/20261025200740.2064379-1-dmnk@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/loop.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 13ce229d450cd3..57d3babbd63bf5 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1686,8 +1686,10 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
 
 	switch(cmd) {
 	case LOOP_SET_STATUS:
-		err = loop_set_status_compat(lo,
-			     (const struct compat_loop_info __user *)arg);
+		err = -EPERM;
+		if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
+			err = loop_set_status_compat(lo,
+				(const struct compat_loop_info __user *)arg);
 		break;
 	case LOOP_GET_STATUS:
 		err = loop_get_status_compat(lo,

From 834ca8b916c768411693b62aaeb33f7ce39fe10e Mon Sep 17 00:00:00 2001
From: Sinan Turunc <enscrpt@pm.me>
Date: Mon, 26 Oct 2026 22:36:39 +0000
Subject: [PATCH 1802/1982] ALSA: usb-audio: Bound packet copies by the PCM
 buffer size

[ Upstream commit 06be918062adc1a5a76dc346803b136b20bdb5ae ]

retire_capture_urb() and prepare_playback_urb() assume that one USB
packet never carries more data than the whole ALSA ring buffer. Nothing
enforces that: the packet size comes from the device (wMaxPacketSize,
and curpacksize == maxpacksize when the class-specific endpoint
descriptor sets MaxPacketsOnly), while the PCM hardware constraints only
require 64-byte periods, two periods and a period time of one data
interval. An 8 kHz mono U8 stream on a 128-byte buffer is legal, and a
full-speed device can send 1023-byte packets into it.

On the first oversized packet hwptr_done is wrapped once and stays
beyond buffer_bytes (895 for 1023 bytes into 128). On the next packet
the wrap arithmetic in the copy path computes

    bytes1 = subs->buffer_bytes - oldptr

with oldptr > buffer_bytes, so bytes1 wraps to about 4 GB and memcpy()
runs off the end of the URB buffer and of the vmalloc'd DMA buffer:

  BUG: KASAN: slab-out-of-bounds in retire_capture_urb+0x251/0x870
  Read of size 4294966529 at addr ffff88800c1e2800 by task vhci_rx/82

and for playback, where copy_to_urb() has the same shape:

  BUG: KASAN: vmalloc-out-of-bounds in copy_to_urb.isra.0+0x188/0x430
  Read of size 4294966529 at addr ffffc9000004537f by task vhci_rx/79
   prepare_playback_urb+0x98a/0x1fc0

Truncate an oversized capture packet to the buffer size, and stop
filling a playback URB once it holds a whole buffer. With bytes <=
buffer_bytes the single wrap of hwptr_done and the two-part memcpy()
in both copy paths stay inside the buffer. A device whose packets do
not fit the buffer at all was never going to play correctly anyway.

Reproduced on 7.3-rc7 with a USB/IP device (dummy_hcd cannot carry
isochronous data) advertising a UAC1 endpoint with MaxPacketsOnly and
wMaxPacketSize 1023, and a PCM client using period_size 64, periods 2.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Sinan Turunc <enscrpt@pm.me>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261026223543.620-2-enscrpt@pm.me
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/pcm.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 682b6c1fe76bac..c2f7b08607ac86 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1343,6 +1343,18 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
 			bytes -= adj;
 			subs->stream_offset_adj -= adj;
 		}
+		/*
+		 * A packet can be as large as the endpoint's maxpacksize, which
+		 * the device chooses, while the ring buffer can be as small as
+		 * two 64-byte periods. The hwptr_done wrap below handles one
+		 * wrap only, so never take more than one buffer from a packet.
+		 */
+		if (unlikely(bytes > subs->buffer_bytes)) {
+			dev_warn_ratelimited(&subs->dev->dev,
+					     "%u-byte packet exceeds %u-byte buffer, truncating\n",
+					     bytes, subs->buffer_bytes);
+			bytes = subs->buffer_bytes;
+		}
 		frames = bytes / stride;
 		if (!subs->txfr_quirk)
 			bytes = frames * stride;
@@ -1553,8 +1565,14 @@ static int prepare_playback_urb(struct snd_usb_substream *subs,
 
 		for (i = 0; i < ctx->packets; i++) {
 			counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail);
+			/*
+			 * Bound by the ring buffer as well as by the URB:
+			 * copy_to_urb() wraps hwptr_done once, so one URB must
+			 * never carry more than the whole buffer.
+			 */
 			if (counts < 0 ||
-			    (frames + counts) * stride > ctx->buffer_size)
+			    (frames + counts) * stride > ctx->buffer_size ||
+			    (frames + counts) * stride > subs->buffer_bytes)
 				break;
 			/* set up descriptor */
 			urb->iso_frame_desc[i].offset = frames * stride;

From db13dbefa22eef5d20173766d7e1e71a1f9dc7dc Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Tue, 27 Oct 2026 09:28:35 +0200
Subject: [PATCH 1803/1982] ALSA: hda: Reject codec reset on ASoC (ext_ops)
 buses

[ Upstream commit a4311e9447bbb219044db38897f95be112f46a8a ]

Writing to the reconfig or clear sysfs nodes of a codec handled by ASoC
(SOF via hdac_hda, AVS via codecs/hda) hangs the writer.

snd_hda_codec_reset() sets card->shutdown and calls
device_release_driver(). With ext_ops the driver unbind unregisters the
ASoC component, which unbinds and frees the whole ASoC card:
- snd_card_disconnect() returns early as card->shutdown is already set,
  so the card's child devices are not removed and snd_card_free() waits
  for the card release forever.
- Even without that, freeing the card removes the codec's hwdep device,
  which owns the sysfs node the reset was issued from, deadlocking in
  kernfs while waiting for the active write to finish.

The legacy HDA driver keeps the card across a driver rebind, ASoC does
not, so the reset cannot be supported there. Return -EOPNOTSUPP and skip
the misleading "codec is being used" messages in the callers.

Fixes: 6bae5ea94989 ("ASoC: hdac_hda: add asoc extension for legacy HDA codec drivers")
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222182
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20261027072835.4796-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/common/codec.c | 6 ++++++
 sound/hda/common/sysfs.c | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index 7869f673894fe5..e6548e03a32cef 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -1806,6 +1806,12 @@ int snd_hda_codec_reset(struct hda_codec *codec)
 {
 	struct hda_bus *bus = codec->bus;
 
+	/* ASoC: driver unbind frees the card, incl. the hwdep issuing the reset */
+	if (bus->core.ext_ops) {
+		codec_err(codec, "Codec reset is not supported with ASoC\n");
+		return -EOPNOTSUPP;
+	}
+
 	if (snd_hda_lock_devices(bus) < 0)
 		return -EBUSY;
 
diff --git a/sound/hda/common/sysfs.c b/sound/hda/common/sysfs.c
index f8c8483fd5e5f3..121a54ea3150ab 100644
--- a/sound/hda/common/sysfs.c
+++ b/sound/hda/common/sysfs.c
@@ -117,6 +117,8 @@ static int clear_codec(struct hda_codec *codec)
 	int err;
 
 	err = snd_hda_codec_reset(codec);
+	if (err == -EOPNOTSUPP)
+		return err;
 	if (err < 0) {
 		codec_err(codec, "The codec is being used, can't free.\n");
 		return err;
@@ -132,6 +134,8 @@ static int reconfig_codec(struct hda_codec *codec)
 	CLASS(snd_hda_power, pm)(codec);
 	codec_info(codec, "hda-codec: reconfiguring\n");
 	err = snd_hda_codec_reset(codec);
+	if (err == -EOPNOTSUPP)
+		return err;
 	if (err < 0) {
 		codec_err(codec,
 			   "The codec is being used, can't reconfigure.\n");

From 4d816922640628e1df36d740b38478d03d09d81a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@kernel.org>
Date: Mon, 26 Oct 2026 09:20:35 +0100
Subject: [PATCH 1804/1982] ixgbe: reserve TX timestamp after skb preparation

[ Upstream commit f75062536e2d45ee182828f0e47e0124be2fdc8d ]

ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
for the pending TX timestamp before preparing the skb for transmit.
Several of the following steps may need to reallocate the skb head:

- ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
  when the header is cloned (e.g. a packet tap holds a clone).
- ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
  checksum offsets, which can call pskb_expand_head() through
  skb_ensure_writable().
- With DCB and a software VLAN tag, skb_cow_head() is called to
  rewrite the VLAN priority.

pskb_expand_head() used to BUG() on shared skbs. Since commit
c7d8bc3dd511 ("net: skbuff: don't BUG() on bad arguments to
pskb_expand_head()") it returns -EINVAL instead, so these packets
are dropped (TSO, DCB) or sent with an unfinished checksum
(skb_checksum_help() errors are ignored by ixgbe_tx_csum()).

Reserve the TX timestamp right before ixgbe_tx_map(), after all skb
preparation, as i40e and ice already do. The timestamp request
remains covered on the FCoE path, and the cleanup on ixgbe_tx_map()
failure is unchanged.

Fixes: 891dc0821d20 ("ixgbe: Add ptp work item to poll for the Tx timestamp")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20261026082035.335770-1-edumazet@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +++++++++++--------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index f950570909ab2b..75ba78a84c865c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9426,23 +9426,6 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 	}
 	protocol = vlan_get_protocol(skb);
 
-	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
-	    adapter->ptp_clock) {
-		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
-		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
-					   &adapter->state)) {
-			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
-			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
-
-			/* schedule check for Tx timestamp */
-			adapter->ptp_tx_skb = skb_get(skb);
-			adapter->ptp_tx_start = jiffies;
-			schedule_work(&adapter->ptp_tx_work);
-		} else {
-			adapter->tx_hwtstamp_skipped++;
-		}
-	}
-
 #ifdef CONFIG_PCI_IOV
 	/*
 	 * Use the l2switch_enable flag - would be false if the DMA
@@ -9507,6 +9490,29 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 #ifdef IXGBE_FCOE
 xmit_fcoe:
 #endif /* IXGBE_FCOE */
+	/* Reserve the Tx timestamp only after all skb preparation:
+	 * skb_get() makes the skb shared, and pskb_expand_head()
+	 * (reached from skb_cow_head() or skb_checksum_help())
+	 * refuses shared skbs.
+	 */
+	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+	    adapter->ptp_clock) {
+		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
+		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
+					   &adapter->state)) {
+			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+			first->tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+
+			/* schedule check for Tx timestamp */
+			adapter->ptp_tx_skb = skb_get(skb);
+			adapter->ptp_tx_start = jiffies;
+			schedule_work(&adapter->ptp_tx_work);
+		} else {
+			adapter->tx_hwtstamp_skipped++;
+		}
+	}
+
 	if (ixgbe_tx_map(tx_ring, first, hdr_len))
 		goto cleanup_tx_timestamp;
 

From 66995f75c5926a0d6cef69b668f3170541b327d9 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Tue, 27 Oct 2026 10:38:40 +0200
Subject: [PATCH 1805/1982] ASoC: hdac_hda: Balance the runtime PM disable in
 codec remove

[ Upstream commit f26c0d5f91d918bb66cbbc8916f41836adb38346 ]

hdac_hda_codec_remove() disables runtime PM of the codec device before
releasing the HDA link and calling the codec driver's remove callback,
so that no runtime resume can race with the teardown and access the
link or the already freed codec driver data.
snd_hda_codec_cleanup_for_unbind() then disables runtime PM again.

On the next probe snd_hda_codec_register() enables runtime PM only once,
leaving it disabled after the ASoC card or the codec driver has been
unbound and bound again: the codec stays powered and runtime_status
reads 'unsupported'.

Re-enable runtime PM at the end of hdac_hda_codec_remove() to balance
its own disable. The codec remains disabled until it is registered again.

Fixes: c3ec8ac82105 ("ASoC: hdac_hda: fix memleak on module unload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261027083840.28813-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/hdac_hda.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index b4d93b9404bb7b..1a89f570fd1f47 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -557,6 +557,7 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
 		return;
 	}
 
+	/* prevent runtime PM callbacks while the link and the codec are torn down */
 	pm_runtime_disable(&hdev->dev);
 	snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 
@@ -564,6 +565,9 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
 		driver->ops->remove(codec);
 
 	snd_hda_codec_cleanup_for_unbind(codec);
+
+	/* Balances the disable above, cleanup_for_unbind keeps runtime PM disabled */
+	pm_runtime_enable(&hdev->dev);
 }
 
 static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {

From a6a76018c2d666949a7ab357986037349b3433dc Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:23 +0800
Subject: [PATCH 1806/1982] LoongArch: Call cpu_final_simd() with
 pure_initcall()

[ Upstream commit 9b56c3659a7e5d930ab3c07ea74cc46af65b6d20 ]

After commit 35ebc4de105989034f12 ("xor: remove macro abuse for XOR
implementation registrations"), using "simd=128" to limit SIMD on a
platform with 256bit SIMD instructions causes a boot failure.

Because cpu_final_simd() is called with arch_initcall() now, which is
after xor_init(), LASX flavors are selected but not workable.

Call cpu_final_simd() with pure_initcall() which is before xor_init().

Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kernel/cpu-probe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/loongarch/kernel/cpu-probe.c b/arch/loongarch/kernel/cpu-probe.c
index 4ac9c95991670b..9f0f9fdac011bf 100644
--- a/arch/loongarch/kernel/cpu-probe.c
+++ b/arch/loongarch/kernel/cpu-probe.c
@@ -93,7 +93,7 @@ static int __init cpu_final_simd(void)
 	return 0;
 }
 
-arch_initcall(cpu_final_simd);
+pure_initcall(cpu_final_simd);
 
 static inline void set_elf_platform(int cpu, const char *plat)
 {

From 45d58b3dcb3d2d4c24046815ccef0a5526723f0a Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:23 +0800
Subject: [PATCH 1807/1982] LoongArch: Use pa_to_nid()/nid_to_addrbase() rather
 than hard-code

[ Upstream commit 244eb26bbd152896f976db6415550993cd60b46d ]

NODE_ADDRSPACE_SHIFT is 44 now but may be changed in future, so use
pa_to_nid()/nid_to_addrbase() rather than hard-code.

Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/numa.h | 2 +-
 arch/loongarch/kernel/irq.c       | 3 ++-
 arch/loongarch/pci/pci.c          | 3 ++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/loongarch/include/asm/numa.h b/arch/loongarch/include/asm/numa.h
index bbf9f70bd25f45..c9654ff900a3a8 100644
--- a/arch/loongarch/include/asm/numa.h
+++ b/arch/loongarch/include/asm/numa.h
@@ -14,7 +14,7 @@
 #define NODE_ADDRSPACE_SHIFT 44
 
 #define pa_to_nid(addr)		(((addr) & 0xf00000000000) >> NODE_ADDRSPACE_SHIFT)
-#define nid_to_addrbase(nid)	(_ULCAST_(nid) << NODE_ADDRSPACE_SHIFT)
+#define nid_to_addrbase(nid)	(_U64CAST_(nid) << NODE_ADDRSPACE_SHIFT)
 
 #ifdef CONFIG_NUMA
 
diff --git a/arch/loongarch/kernel/irq.c b/arch/loongarch/kernel/irq.c
index 80946cafaec1b2..130954ab9ee20b 100644
--- a/arch/loongarch/kernel/irq.c
+++ b/arch/loongarch/kernel/irq.c
@@ -19,6 +19,7 @@
 
 #include <asm/irq.h>
 #include <asm/loongson.h>
+#include <asm/numa.h>
 #include <asm/setup.h>
 
 DEFINE_PER_CPU(unsigned long, irq_stack);
@@ -68,7 +69,7 @@ static int __init early_pci_mcfg_parse(struct acpi_table_header *header)
 
 	for (i = 0; i < n; i++, mptr++) {
 		msi_group[i].pci_segment = mptr->pci_segment;
-		pch_group[i].node = msi_group[i].node = (mptr->address >> 44) & 0xf;
+		pch_group[i].node = msi_group[i].node = pa_to_nid(mptr->address);
 	}
 
 	return 0;
diff --git a/arch/loongarch/pci/pci.c b/arch/loongarch/pci/pci.c
index f33c7ea1443d94..0b99b32110a5d5 100644
--- a/arch/loongarch/pci/pci.c
+++ b/arch/loongarch/pci/pci.c
@@ -12,6 +12,7 @@
 #include <linux/io-64-nonatomic-lo-hi.h>
 #include <asm/cacheflush.h>
 #include <asm/loongson.h>
+#include <asm/numa.h>
 
 #define PCI_DEVICE_ID_LOONGSON_HOST     0x7a00
 #define PCI_DEVICE_ID_LOONGSON_DC1      0x7a06
@@ -43,7 +44,7 @@ int raw_pci_write(unsigned int domain, unsigned int bus, unsigned int devfn,
 
 phys_addr_t mcfg_addr_init(int node)
 {
-	return (((u64)node << 44) | MCFG_EXT_PCICFG_BASE);
+	return (nid_to_addrbase(node) | MCFG_EXT_PCICFG_BASE);
 }
 
 static int __init pcibios_init(void)

From a307ab34e323be8e18cfca948d6fee6a00457ca4 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:23 +0800
Subject: [PATCH 1808/1982] LoongArch: Remove arch-specific
 __smp_mb__{before,after}_atomic()

[ Upstream commit 85cebdfee765e92e748e71b9b91889eef5988282 ]

When running BPF selftest "test_progs -t timer_lockup" on a LoongArch
machine, the kernel intermittently experiences soft lockups and panics
in hrtimer_cancel().

The root cause is that the bpf_timer_cancel() implementation relies on
smp_mb__after_atomic() to provide a full data barrier after a relaxed
atomic_inc() to ensure the proper store-load ordering before performing
lockless dependency checks on weakly-ordered architectures, such as on
LoongArch, but the current definition of smp_mb__after_atomic() is just
a plain compiler barrier.

This allows a subsequent read to bypass the prior write due to store-
load reordering, enabling concurrent CPUs to simultaneously bypass the
software deadlock detection, enter hrtimer_cancel(), and then trigger a
severe ABBA deadlock in the hrtimer core.

Moreover, there are hundreds of smp_mb__after_atomic() call sites across
the core kernel (kernel/, drivers/, mm/, net/, fs/) that currently lack
necessary full data barriers on LoongArch, which have potential risks.

To comply with the LKMM specification, fix this by removing the arch-
specific definition of __smp_mb__after_atomic(), so that this macro can
automatically fall back to the generic definition in asm-generic that
maps to __smp_mb() and emits the required hardware DBAR instruction.

While at it, do the same thing for __smp_mb__before_atomic().

With this patch the BPF timer_lockup selftest was stressed for millions
consecutive loops on a physical LoongArch machine, without encountering
any further lockups.

Cc: stable@vger.kernel.org # 6.7+
Fixes: affef66b65889a0e ("LoongArch: Relax memory ordering for atomic operations")
Closes: https://lore.kernel.org/loongarch/CAK3+h2xOSEZUHhou7N2cRL-aGrZCNSm45g+P7thObMe+fpgYCA@mail.gmail.com/
Reported-by: Vincent Li <vincent.mc.li@gmail.com>
Reviewed-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/barrier.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/loongarch/include/asm/barrier.h b/arch/loongarch/include/asm/barrier.h
index 4b663f19770611..84c6d739119d18 100644
--- a/arch/loongarch/include/asm/barrier.h
+++ b/arch/loongarch/include/asm/barrier.h
@@ -57,9 +57,6 @@
 #define __WEAK_LLSC_MB		"			\n"
 #endif
 
-#define __smp_mb__before_atomic()	barrier()
-#define __smp_mb__after_atomic()	barrier()
-
 /**
  * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
  * @index: array element index

From 53e0ad94f3da17bbcefafb967ee17d928b040d0d Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:24 +0800
Subject: [PATCH 1809/1982] LoongArch: Remove redundant call in
 update_bp_registers()

[ Upstream commit 23534c6efeb718e8a4d9107fa7d6707b5b1f5859 ]

In update_bp_registers(), there is a duplicate call to write_wb_reg()
when enabling an execute breakpoint:

    write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
    write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);

The two lines are completely identical. Remove the redundant call to
clean up the code and eliminate unnecessary register writes.

Cc: stable@vger.kernel.org
Fixes: edffa33c7bb5 ("LoongArch: Add hardware breakpoints/watchpoints support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kernel/hw_breakpoint.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index c35f9bf3803349..deeb2f9795705a 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -453,7 +453,6 @@ static void update_bp_registers(struct pt_regs *regs, int enable, int type)
 		if (enable) {
 			if ((info->ctrl.type == LOONGARCH_BREAKPOINT_EXECUTE) && (type == 0)) {
 				write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
-				write_wb_reg(CSR_CFG_CTRL, i, 0, CTRL_PLV_ENABLE);
 			} else {
 				ctrl = read_wb_reg(CSR_CFG_CTRL, i, 1);
 				if (info->ctrl.type == LOONGARCH_BREAKPOINT_LOAD)

From 18de2985eb99f1de3b54b9edd4374b5dd428ec9f Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:34 +0800
Subject: [PATCH 1810/1982] LoongArch: Fix bitmask corruption in
 update_bp_registers()

[ Upstream commit 30c52672bf456decf675c11f3c65acd73a6bcca8 ]

In update_bp_registers(), when disabling a LOAD or STORE watchpoint,
the code attempts to clear the bit of LoadEn or StoreEn by using the
standard bit-clearing pattern.

However, due to the omission of parentheses, the bitwise NOT operator
'~' takes higher precedence than the left shift operator '<<'. Then:
(1) ~0x1 << MWPnCFG3_LoadEn evaluates to "(~0x1) << 8 = 0xFFFFFE00",
(2) ~0x1 << MWPnCFG3_StoreEn evaluates to "(~0x1) << 9 = 0xFFFFFC00",
that incorrectly clears all configuration fields in the lower 8 bits.

These fields in the lower 8 bits contain critical configurations such
as DSOnly (bit 0), PLV0-PLV3 privilege levels (bits 1-4), and LCL (bit
7). Writing back these corrupted values severely breaks configuration
isolation and ruins the hardware watchpoint states.

Add parentheses to ensure the correct evaluation order, so that only
the targeted LoadEn/StoreEn bit is cleared while preserving the other
crucial configuration bits in the lower 8 bits.

Cc: stable@vger.kernel.org
Fixes: edffa33c7bb5 ("LoongArch: Add hardware breakpoints/watchpoints support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kernel/hw_breakpoint.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index deeb2f9795705a..bd891b3808a6b3 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -468,9 +468,9 @@ static void update_bp_registers(struct pt_regs *regs, int enable, int type)
 			} else {
 				ctrl = read_wb_reg(CSR_CFG_CTRL, i, 1);
 				if (info->ctrl.type == LOONGARCH_BREAKPOINT_LOAD)
-					ctrl &= ~0x1 << MWPnCFG3_LoadEn;
+					ctrl &= ~(0x1 << MWPnCFG3_LoadEn);
 				if (info->ctrl.type == LOONGARCH_BREAKPOINT_STORE)
-					ctrl &= ~0x1 << MWPnCFG3_StoreEn;
+					ctrl &= ~(0x1 << MWPnCFG3_StoreEn);
 				write_wb_reg(CSR_CFG_CTRL, i, 1, ctrl);
 			}
 			regs->csr_prmd &= ~CSR_PRMD_PWE;

From eef4bbc5174dc79a95b99984c28a0b3fb2a06535 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:35 +0800
Subject: [PATCH 1811/1982] LoongArch: Fix architectural naming typo for
 CSR_FWPS_SKIP

[ Upstream commit f322ebfdfda2bce91fb1d3fb0072c735051fed85 ]

According to the LoongArch Reference Manual, the single-step 'Skip' bit
resides in the instruction breakpoint status register (CSR.FWPS), rather
than the configuration register (CSR.FWPC).

Furthermore, the kernel code comments also explicitly document it as
"CSR.FWPS.Skip", yet the macro was erroneously defined as CSR_FWPC_SKIP
and used as such in traps.c and hw_breakpoint.c. This mismatch creates
architectural naming confusion.

Fix this by renaming the macro from CSR_FWPC_SKIP to CSR_FWPS_SKIP to
precisely match the manual and comments. Also, update all call sites to
align with the rectified definition.

Cc: stable@vger.kernel.org
Fixes: 424421a7f34c ("LoongArch: ptrace: Add hardware single step support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/loongarch.h | 4 ++--
 arch/loongarch/kernel/hw_breakpoint.c  | 2 +-
 arch/loongarch/kernel/traps.c          | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h
index 58a4a3b6b035d4..642dc9adddcebc 100644
--- a/arch/loongarch/include/asm/loongarch.h
+++ b/arch/loongarch/include/asm/loongarch.h
@@ -1090,8 +1090,8 @@
 #define LOONGARCH_CSR_DERA		0x501	/* debug era */
 #define LOONGARCH_CSR_DESAVE		0x502	/* debug save */
 
-#define CSR_FWPC_SKIP_SHIFT		16
-#define CSR_FWPC_SKIP			(_ULCAST_(1) << CSR_FWPC_SKIP_SHIFT)
+#define CSR_FWPS_SKIP_SHIFT		16
+#define CSR_FWPS_SKIP			(_ULCAST_(1) << CSR_FWPS_SKIP_SHIFT)
 
 /*
  * CSR_ECFG IM
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index bd891b3808a6b3..7f69cf361a5e20 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -550,7 +550,7 @@ void hw_breakpoint_thread_switch(struct task_struct *next)
 		addr = read_wb_reg(CSR_CFG_ADDR, 0, 0);
 		mask = read_wb_reg(CSR_CFG_MASK, 0, 0);
 		if (!((regs->csr_era ^ addr) & ~mask))
-			csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+			csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
 		regs->csr_prmd |= CSR_PRMD_PWE;
 	} else {
 		/* Update breakpoints */
diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c
index 8e51ce004572ca..4c2e5a13f07e4f 100644
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -821,7 +821,7 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
 			 * instruction. So don't clear llbit and reset CSR.FWPS.Skip until
 			 * the llsc execution is completed.
 			 */
-			csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+			csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
 			csr_write32(CSR_LLBCTL_KLO, LOONGARCH_CSR_LLBCTL);
 			goto out;
 		}
@@ -838,7 +838,7 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
 				 * current pc, If yes, then we should not set the CSR.FWPS.SKIP
 				 * bit to break the original instruction stream.
 				 */
-				csr_write32(CSR_FWPC_SKIP, LOONGARCH_CSR_FWPS);
+				csr_write32(CSR_FWPS_SKIP, LOONGARCH_CSR_FWPS);
 				goto out;
 			}
 		}

From 815c31e67f3feb82926b823469c953af8d3b84f7 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:35 +0800
Subject: [PATCH 1812/1982] LoongArch: Only send SIGTRAP signal if necessary in
 do_watch()

[ Upstream commit f087903018e35d38b8932e18b010ee2e8699d1a1 ]

In do_watch(), the kernel unconditionally forces a SIGTRAP signal at the
end of the handler via force_sig(SIGTRAP). This is essential for ptrace
operations, but it severely disrupts standard perf_event usage.

Under normal perf usage, it is not necessary to force a SIGTRAP signal
on every hit. Forcing it unnecessarily aborts the target process if no
user-space signal handler is registered, which violates performance
monitoring behaviors and injects context switch overheads.

However, a conditional check using only 'current->ptrace' would block
legitimate user-requested signals when a perf_event is configured with
'attr.sigtrap = 1' for asynchronous user-space tracking.

Fix this by refactoring breakpoint_handler() and watchpoint_handler()
to return a boolean status indicating whether any triggered breakpoint
explicitly requires a signal notification. Update do_watch() to enforce
the SIGTRAP signal only when the process is actively being debugged via
ptrace, or when the underlying perf_event infrastructure specifically
demands it via 'attr.sigtrap'.

Cc: stable@vger.kernel.org
Fixes: 424421a7f34c ("LoongArch: ptrace: Add hardware single step support")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/include/asm/hw_breakpoint.h |  4 ++--
 arch/loongarch/kernel/hw_breakpoint.c      | 18 ++++++++++++++++--
 arch/loongarch/kernel/traps.c              |  9 ++++++---
 3 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/arch/loongarch/include/asm/hw_breakpoint.h b/arch/loongarch/include/asm/hw_breakpoint.h
index 5faa97a87a9e2d..d202052df8a16c 100644
--- a/arch/loongarch/include/asm/hw_breakpoint.h
+++ b/arch/loongarch/include/asm/hw_breakpoint.h
@@ -116,8 +116,8 @@ extern void arch_uninstall_hw_breakpoint(struct perf_event *bp);
 extern int hw_breakpoint_slots(int type);
 extern void hw_breakpoint_pmu_read(struct perf_event *bp);
 
-void breakpoint_handler(struct pt_regs *regs);
-void watchpoint_handler(struct pt_regs *regs);
+bool breakpoint_handler(struct pt_regs *regs);
+bool watchpoint_handler(struct pt_regs *regs);
 
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
 extern void ptrace_hw_copy_thread(struct task_struct *task);
diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index 7f69cf361a5e20..d009ed780cf028 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -482,9 +482,10 @@ NOKPROBE_SYMBOL(update_bp_registers);
 /*
  * Debug exception handlers.
  */
-void breakpoint_handler(struct pt_regs *regs)
+bool breakpoint_handler(struct pt_regs *regs)
 {
 	int i;
+	bool need_sigtrap = false;
 	struct perf_event *bp, **slots;
 
 	slots = this_cpu_ptr(bp_on_reg);
@@ -494,17 +495,24 @@ void breakpoint_handler(struct pt_regs *regs)
 			bp = slots[i];
 			if (bp == NULL)
 				continue;
+
 			perf_bp_event(bp, regs);
+			if (bp->attr.sigtrap)
+				need_sigtrap = true;
+
 			csr_write32(0x1 << i, LOONGARCH_CSR_FWPS);
 			update_bp_registers(regs, 0, 0);
 		}
 	}
+
+	return need_sigtrap;
 }
 NOKPROBE_SYMBOL(breakpoint_handler);
 
-void watchpoint_handler(struct pt_regs *regs)
+bool watchpoint_handler(struct pt_regs *regs)
 {
 	int i;
+	bool need_sigtrap = false;
 	struct perf_event *wp, **slots;
 
 	slots = this_cpu_ptr(wp_on_reg);
@@ -514,11 +522,17 @@ void watchpoint_handler(struct pt_regs *regs)
 			wp = slots[i];
 			if (wp == NULL)
 				continue;
+
 			perf_bp_event(wp, regs);
+			if (wp->attr.sigtrap)
+				need_sigtrap = true;
+
 			csr_write32(0x1 << i, LOONGARCH_CSR_MWPS);
 			update_bp_registers(regs, 0, 1);
 		}
 	}
+
+	return need_sigtrap;
 }
 NOKPROBE_SYMBOL(watchpoint_handler);
 
diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c
index 4c2e5a13f07e4f..9ce12327d64ea8 100644
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -807,6 +807,8 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
 #ifndef CONFIG_HAVE_HW_BREAKPOINT
 	pr_warn("Hardware watch point handler not implemented!\n");
 #else
+	bool need_sigtrap = !!current->ptrace;
+
 	if (kgdb_breakpoint_handler(regs))
 		goto out;
 
@@ -843,11 +845,12 @@ asmlinkage void noinstr do_watch(struct pt_regs *regs)
 			}
 		}
 	} else {
-		breakpoint_handler(regs);
-		watchpoint_handler(regs);
+		need_sigtrap |= breakpoint_handler(regs);
+		need_sigtrap |= watchpoint_handler(regs);
 	}
 
-	force_sig(SIGTRAP);
+	if (need_sigtrap)
+		force_sig(SIGTRAP);
 out:
 #endif
 	irqentry_exit(regs, state);

From 4e4c9733886db991f7aedaa0ff9bd5f26851ae18 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 27 Oct 2026 22:51:35 +0800
Subject: [PATCH 1813/1982] LoongArch: Fix perf hardware breakpoint failure via
 installation

[ Upstream commit f5c0f8427469e703465c719c4304ce91282a32eb ]

In hw_breakpoint_control(), the logic to enable CSR_PRMD_PWE (global
watchpoint enable) incorrectly relies on TIF_LOAD_WATCH. This thread
flag is only set during ptrace operations, meaning that the standard
hardware breakpoints created via perf_event_open() will never have
this flag set.

As a result, the CSR_PRMD_PWE switch is skipped, leaving the hardware
breakpoint completely inactive in perf usage.

Fix this by decoupling the CSR_PRMD_PWE from the ptrace specific flag
TIF_LOAD_WATCH, which ensures that CSR_PRMD_PWE is enabled whenever a
hardware breakpoint is installed.

Here is a user-space reproducer to demonstrate the issue:

(1) Test program (test_perf_install.c):

  #include <stdio.h>
  #include <unistd.h>
  #include <sys/syscall.h>
  #include <sys/ioctl.h>
  #include <linux/perf_event.h>
  #include <linux/hw_breakpoint.h>

  static int var = 0;

  int main(void)
  {
  	size_t count = 0;
  	struct perf_event_attr attr = {
  		.type = PERF_TYPE_BREAKPOINT,
  		.size = sizeof(attr),
  		.bp_type = HW_BREAKPOINT_W,
  		.bp_addr = (unsigned long)&var,
  		.bp_len = HW_BREAKPOINT_LEN_1,
  		.exclude_kernel = 1,
  	};

  	int fd = syscall(__NR_perf_event_open, &attr, 0, -1, -1, 0);
  	ioctl(fd, PERF_EVENT_IOC_ENABLE, 0);

  	asm volatile("st.b %1, %0" : "=m"(var) : "r"(11) : "memory");

  	ioctl(fd, PERF_EVENT_IOC_DISABLE, 0);
  	read(fd, &count, sizeof(size_t));

  	printf("Watchpoint counts: expected = 1, actual = %zu\n", count);

  	close(fd);
  	return 0;
  }

(2) Test steps:

  $ gcc test_perf_install.c -o test_perf_install
  $ ./test_perf_install

(3) Test results:

Without this patch:

  Watchpoint counts: expected = 1, actual = 0

With this patch:

  Watchpoint counts: expected = 1, actual = 1

Cc: stable@vger.kernel.org
Fixes: 3892b11eac5a ("LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/loongarch/kernel/hw_breakpoint.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c
index d009ed780cf028..1a05350159f7b0 100644
--- a/arch/loongarch/kernel/hw_breakpoint.c
+++ b/arch/loongarch/kernel/hw_breakpoint.c
@@ -233,7 +233,7 @@ static int hw_breakpoint_control(struct perf_event *bp,
 		}
 		enable = csr_read64(LOONGARCH_CSR_CRMD);
 		csr_write64(CSR_CRMD_WE | enable, LOONGARCH_CSR_CRMD);
-		if (bp->hw.target && test_tsk_thread_flag(bp->hw.target, TIF_LOAD_WATCH))
+		if (bp->hw.target)
 			regs->csr_prmd |= CSR_PRMD_PWE;
 		break;
 	case HW_BREAKPOINT_UNINSTALL:

From f5841241474fa4465d24f88860ace7683fdc6fc7 Mon Sep 17 00:00:00 2001
From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Date: Tue, 27 Oct 2026 21:33:31 +0800
Subject: [PATCH 1814/1982] cpufreq: stats: Fix potential out-of-bounds access
 in deferred reset

[ Upstream commit 8a702989677216489e471a6f27599da53f753567 ]

cpufreq_stats_create_table() sets stats->last_index to -1 if policy->cur
is not in the frequency table. It then stays at -1, because
cpufreq_stats_record_transition() returns early on old_index == -1 before
it gets to update last_index.

Commit 46a310b80bc2 ("[CPUFREQ] Don't set stat->last_index to -1 if
the pol->cur has incorrect value.") added that check. However, since
commit 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to
cpufreq_stats_record_transition()"), the stats reset is deferred to the
beginning of cpufreq_stats_record_transition(), before that check, and
cpufreq_stats_reset_table() ends with an unconditional
cpufreq_stats_update(). So if the "reset" attribute is written while
last_index is -1, the next frequency transition accesses
time_in_state[-1].

Fix it by also returning early on last_index == -1 in
cpufreq_stats_reset_table().

Fixes: 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to cpufreq_stats_record_transition()")
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/20261027133332.377546-1-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/cpufreq_stats.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 40a9ff18da068c..d457848b3eabd2 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -52,6 +52,10 @@ static void cpufreq_stats_reset_table(struct cpufreq_stats *stats)
 	 * reset_pending accesses in cpufreq_stats_record_transition().
 	 */
 	smp_rmb();
+
+	if (stats->last_index == -1)
+		return;
+
 	cpufreq_stats_update(stats, READ_ONCE(stats->reset_time));
 }
 

From 1e70a9c88381bb29fc64acc427afc1e09d0a8b9d Mon Sep 17 00:00:00 2001
From: Zhao Gongyi <zhaogongyi@bytedance.com>
Date: Fri, 23 Oct 2026 20:12:33 +0800
Subject: [PATCH 1815/1982] arm64/mm: restrict transparent contpte mappings to
 valid PTEs

[ Upstream commit 486d396b19e93f6e56e0a0ba96c14a9ccc1a5977 ]

The transparent contpte layer treats PTE_CONT as software grouping state.
When a valid PTE has PTE_CONT set, the contpte helpers may align an
operation to a CONT_PTE_SIZE block and operate on the whole block. The
current single-PTE helpers use pte_valid_cont() to identify such groups;
this is a helper contract, not an architectural restriction on using
PTE_CONT with present-invalid descriptors. Explicit users such as hugetlb
manage their contiguous encodings separately.

contpte_set_ptes() currently sets PTE_CONT from alignment alone. Batched
set_ptes() users can therefore install present-invalid PTEs with
PTE_CONT set, for example mprotect(PROT_NONE), NUMA hinting through
modify_prot_commit_ptes(), fork() copying a PROT_NONE large folio, or a
PMD split installing PAGE_NONE PTEs.

This is not a hardware programming problem: invalid descriptors are not
translated, so the hardware ignores descriptor bits such as PTE_CONT. It
is a software-state problem. Some arm64 fast paths, such as
test_and_clear_young_ptes(), test pte_cont() directly instead of
pte_valid_cont().

In the observed failure, mprotect(PROT_NONE) installed a full
CONT_PTE_SIZE range of present-invalid PTEs with PTE_CONT set.
MADV_GUARD_INSTALL then zapped one PTE. The nr == 1 clear_full_ptes()
path only unfolds pte_valid_cont() entries, so the neighbouring
present-invalid entries kept PTE_CONT while the target entry became a
guard marker.

clear_refs_pte_range() then reached the marker through:

  ptep_test_and_clear_young()
  test_and_clear_young_ptes()
  contpte_test_and_clear_young_ptes()
  contpte_align_addr_ptep()
  __ptep_test_and_clear_young()

The marker changed from old_pte=0x00000000000047c0 to
new_pte=0x00000000000043c0 by clearing PTE_AF. For swap PTEs, bit 10 is
part of the swap type field, bits 6-10: 0x47c0 is SWP_PTE_MARKER with
offset 4, while 0x43c0 has type 15 and is decoded as an ordinary swap
entry. Zap later warned in swap_put_entries_direct() with a bad swap
entry.

Present-invalid PTEs could retain PTE_CONT as software grouping state,
but their single-PTE modification paths would then need to recognize
and unfold those groups consistently. Since current helpers mostly use
pte_valid_cont() for membership, avoid creating present-invalid
transparent contpte groups in contpte_set_ptes(). They bring no hardware
benefit while invalid, and eligible valid ranges can be grouped again
when they are installed.

The public set_ptes() wrapper already clears PTE_CONT before calling
contpte_set_ptes(). Return invalid PTEs through __set_ptes() directly,
and warn if a future direct caller unexpectedly passes an invalid PTE
with PTE_CONT set.

This is triggerable by a user process against its own address space. On
systems running with panic_on_warn, the warning becomes a denial of
service.

Fixes: 4602e5757bcc ("arm64/mm: wire up PTE_CONT for user mappings")
Cc: stable@vger.kernel.org
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/pgtable.h | 3 +++
 arch/arm64/mm/contpte.c          | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 1765e484fb9f05..2ce69d64e60ca8 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -1675,6 +1675,9 @@ extern void modify_prot_commit_ptes(struct vm_area_struct *vma, unsigned long ad
  * The contpte APIs are used to transparently manage the contiguous bit in ptes
  * where it is possible and makes sense to do so. The PTE_CONT bit is considered
  * a private implementation detail of the public ptep API (see below).
+ * Single-PTE transparent contpte helpers use pte_valid_cont() to identify
+ * grouped PTEs; explicit contiguous-encoding users such as hugetlb manage
+ * their entries separately.
  */
 extern void __contpte_try_fold(struct mm_struct *mm, unsigned long addr,
 				pte_t *ptep, pte_t pte);
diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c
index 29024e20e876da..c39a290c6b5a23 100644
--- a/arch/arm64/mm/contpte.c
+++ b/arch/arm64/mm/contpte.c
@@ -444,8 +444,10 @@ void contpte_set_ptes(struct mm_struct *mm, unsigned long addr,
 	 */
 	VM_WARN_ON(nr == 1);
 
-	if (!mm_is_user(mm))
+	if (!mm_is_user(mm) || !pte_valid(pte)) {
+		VM_WARN_ON_ONCE(!pte_valid(pte) && pte_cont(pte));
 		return __set_ptes(mm, addr, ptep, pte, nr);
+	}
 
 	end = addr + (nr << PAGE_SHIFT);
 	pfn = pte_pfn(pte);

From 1916c2f2d1bdb979b4610b5514c0af37fc7ed2bd Mon Sep 17 00:00:00 2001
From: lvyating <lv.yating@zte.com.cn>
Date: Tue, 27 Oct 2026 19:47:32 +0800
Subject: [PATCH 1816/1982] perf machine: Fix NULL deref in
 thread__resolve_callchain_sample()

[ Upstream commit 4626d370ae89b8af4d46a45372b269f926ec662d ]

When recording with -j stack, resolve_lbr_callchain_sample() can
dereference a NULL 'chain' pointer while resolving the branch
stack.

$ perf record -j stack -e branches:u uname
perf: Segmentation fault

Fix it by checking 'chain' for NULL before dereferencing it.

Fixes: 29be60c93d2d9300 ("perf build-id: Mark DSO in sample callchains")
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Shengming Hu <hu.shengming@zte.com.cn>
Signed-off-by: lvyating <lv.yating@zte.com.cn>
Tested-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Dai Hualiang <dai.hualiang@zte.com.cn>
Cc: he.yilin@zte.com.cn
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qingtao Liu <liu.qingtao2@zte.com.cn>
Cc: Shen Lin <shen.lin1@zte.com.cn>
Cc: stable@vger.kernel.org
Cc: ye.zhihao1@zte.com.cn
Cc: zhang.cheng35@zte.com.cn
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index cb138d1bdd7b94..8452d776d994ac 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2743,7 +2743,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
 	if (chain)
 		chain_nr = chain->nr;
 
-	if (evsel__has_branch_callstack(evsel)) {
+	if (chain && evsel__has_branch_callstack(evsel)) {
 		struct perf_env *env = evsel__env(evsel);
 
 		err = resolve_lbr_callchain_sample(thread, cursor, sample, parent,

From 03bb7b94d6e408bb52c5c25d4fd7bca2c794be3c Mon Sep 17 00:00:00 2001
From: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Date: Tue, 13 Oct 2026 20:53:12 +0200
Subject: [PATCH 1817/1982] drm/amdkfd: stop restore retries on device unplug

[ Upstream commit 3254ed0b15f2fe656c9cb36ccb59b92422440bf8 ]

amdgpu_amdkfd_restore_userptr_worker() and svm_range_restore_work()
reschedule themselves when validation fails with evicted objects
pending. After a surprise removal the restore paths fail with -ENODEV
permanently, so rescheduling just spins the worker uselessly until
cancel_delayed_work_sync() in fini finally stops it - which can take
a while, since process teardown itself is delayed by the dead device.

Treat -ENODEV as terminal in both workers.

Cc: Xiaogang Chen <xiaogang.chen@amd.com>
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 266fab83139600e58db7e900e930c722e619b78c)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c   | 18 +++++++++++++-----
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c           |  8 +++++---
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 35dffb14a20aaf..6de7dfa30ce50d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -2824,6 +2824,7 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
 	struct task_struct *usertask;
 	struct mm_struct *mm;
 	uint32_t evicted_bos;
+	int ret;
 
 	mutex_lock(&process_info->notifier_lock);
 	evicted_bos = process_info->evicted_bos;
@@ -2843,14 +2844,16 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
 
 	mutex_lock(&process_info->lock);
 
-	if (update_invalid_user_pages(process_info, mm))
+	ret = update_invalid_user_pages(process_info, mm);
+	if (ret)
 		goto unlock_out;
 	/* userptr_inval_list can be empty if all evicted userptr BOs
 	 * have been freed. In that case there is nothing to validate
 	 * and we can just restart the queues.
 	 */
 	if (!list_empty(&process_info->userptr_inval_list)) {
-		if (validate_invalid_user_pages(process_info))
+		ret = validate_invalid_user_pages(process_info);
+		if (ret)
 			goto unlock_out;
 	}
 	/* Final check for concurrent evicton and atomic update. If
@@ -2859,11 +2862,14 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
 	 * reference counting inside KFD will handle this case.
 	 */
 	mutex_lock(&process_info->notifier_lock);
-	if (process_info->evicted_bos != evicted_bos)
+	if (process_info->evicted_bos != evicted_bos) {
+		ret = -EAGAIN;
 		goto unlock_notifier_out;
+	}
 
 	if (confirm_valid_user_pages_locked(process_info)) {
 		WARN(1, "User pages unexpectedly invalid");
+		ret = -EINVAL;
 		goto unlock_notifier_out;
 	}
 
@@ -2881,8 +2887,10 @@ static void amdgpu_amdkfd_restore_userptr_worker(struct work_struct *work)
 unlock_out:
 	mutex_unlock(&process_info->lock);
 
-	/* If validation failed, reschedule another attempt */
-	if (evicted_bos) {
+	/* If validation failed, reschedule another attempt, unless the
+	 * device is gone for good
+	 */
+	if (evicted_bos && ret != -ENODEV) {
 		queue_delayed_work(system_freezable_wq,
 			&process_info->restore_userptr_work,
 			msecs_to_jiffies(AMDGPU_USERPTR_RESTORE_DELAY_MS));
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 1b29dee7948d83..366b31191ac1e6 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -1853,7 +1853,7 @@ static void svm_range_restore_work(struct work_struct *work)
 	struct mm_struct *mm;
 	int evicted_ranges;
 	int invalid;
-	int r;
+	int r = 0;
 
 	svms = container_of(dwork, struct svm_range_list, restore_work);
 	evicted_ranges = atomic_read(&svms->evicted_ranges);
@@ -1927,8 +1927,10 @@ static void svm_range_restore_work(struct work_struct *work)
 	mmap_write_unlock(mm);
 	mutex_unlock(&process_info->lock);
 
-	/* If validation failed, reschedule another attempt */
-	if (evicted_ranges) {
+	/* If validation failed, reschedule another attempt, unless the
+	 * device is gone for good
+	 */
+	if (evicted_ranges && r != -ENODEV) {
 		pr_debug("reschedule to restore svm range\n");
 		queue_delayed_work(system_freezable_wq, &svms->restore_work,
 			msecs_to_jiffies(AMDGPU_SVM_RANGE_RESTORE_DELAY_MS));

From ec01397e6c4082f78e1a40e0baff7c8979653dda Mon Sep 17 00:00:00 2001
From: Luigi Lauro <luigi.lauro@gmail.com>
Date: Fri, 16 Oct 2026 05:16:36 +0200
Subject: [PATCH 1818/1982] drm/amd/display: take a runtime PM reference only
 when a CRTC turns on

[ Upstream commit b456f591f925fbd6b33770d0eec1b51c2f9d41c1 ]

amdgpu_dm_commit_streams() takes a runtime PM reference for every
active CRTC that needs a modeset and has a new stream, but
amdgpu_dm_atomic_commit_tail() drops one only for each CRTC that goes
from active to inactive. A modeset of a CRTC that is already active (a
mode change, or anything else that needs a full modeset) therefore
leaks one reference. Once that has happened, the usage count no longer
returns to zero with every CRTC off, and the device cannot runtime
suspend again until reboot. The two also disagree the other way when a
CRTC turns on without a stream ("Failed to create new stream"): no
reference is taken, but one is dropped when it turns off.

Take the reference in the loop that counts the disabled CRTCs, on the
mirror condition: when the CRTC goes from inactive to active, which is
what the commit that added it intended ("every time we enable a
previously disabled CRTC"). Each active CRTC then holds exactly one
reference.

Tested on an RX 9070 XT (Navi 48) over OCuLink, with the change
backported to 7.2.9: an unplugged connector forced on, then mode A on a
CRTC, mode B on the same active CRTC, and the CRTC off, three rounds in
a row. The usage count rose by 3 with the stock module, by 0 with this
patch, and by 3 again after reloading the stock module.

Fixes: 97028037a38a ("drm/amdgpu: Grab/put runtime PM references in atomic_commit_tail()")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5951
Assisted-by: Claude:claude-opus-5-5
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 59ef9a435499777b8e1c4e0eff52f813c64fb920)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index bb1fae39cd3955..a77b55ff9321fa 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -10550,8 +10550,6 @@ static void amdgpu_dm_commit_streams(struct drm_atomic_state *state,
 			if (dm_old_crtc_state->stream)
 				remove_stream(adev, acrtc, dm_old_crtc_state->stream);
 
-			pm_runtime_get_noresume(dev->dev);
-
 			acrtc->enabled = true;
 			acrtc->hw_mode = new_crtc_state->mode;
 			crtc->hwmode = new_crtc_state->mode;
@@ -11024,8 +11022,13 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
 #ifdef CONFIG_DEBUG_FS
 		enum amdgpu_dm_pipe_crc_source cur_crc_src;
 #endif
-		/* Count number of newly disabled CRTCs for dropping PM refs later. */
-		if (old_crtc_state->active && !new_crtc_state->active)
+		/*
+		 * One runtime PM reference per active CRTC: take it when the
+		 * CRTC turns on, count it when it turns off for dropping later.
+		 */
+		if (!old_crtc_state->active && new_crtc_state->active)
+			pm_runtime_get_noresume(dev->dev);
+		else if (old_crtc_state->active && !new_crtc_state->active)
 			crtc_disable_count++;
 
 		dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);

From cfa7fd53ed06c8cce47390a86781316bbb9d1e78 Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Sun, 18 Oct 2026 19:17:57 +0800
Subject: [PATCH 1819/1982] drm/amdgpu: reject CS chunks too large for
 kvmalloc()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ba4c3c202919405f461a393e823e4b72c8518494 ]

The CS ioctl copies every chunk with vmemdup_array_user() before it
looks at it, for whatever length_dw userspace gives. kvmalloc() warns
about allocations above INT_MAX when called without __GFP_NOWARN, so any
process with the render node can trigger a warning. On navi31, a CS with
a chunk of length_dw 0x20000000 returns -ENOMEM after:

  WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x5a5/0x7d0

Reject such chunks with -EINVAL before trying to copy them.

Fixes: 2098105ec65c ("drm: drop drm_[cm]alloc* helpers")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit dab5f5280406088591645f499f048dcfefab8d7d)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index f8a2c9e41ca31d..efcd2322afa611 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -235,6 +235,12 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
 
 		size = p->chunks[i].length_dw;
 
+		if (size > INT_MAX / sizeof(uint32_t)) {
+			ret = -EINVAL;
+			i--;
+			goto free_partial_kdata;
+		}
+
 		p->chunks[i].kdata = vmemdup_array_user(u64_to_user_ptr(user_chunk.chunk_data),
 							size,
 							sizeof(uint32_t));

From 08a3f27f91a91fe105012ce8d910540d6a54b37d Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Tue, 13 Oct 2026 13:17:53 +0800
Subject: [PATCH 1820/1982] drm/amdkfd: split vram_pages of SVM ranges
 prefetched without a GPU mapping

[ Upstream commit 52957e813f2f025c86e4aa6e86cb4963ef94fd00 ]

When an SVM range is split, svm_range_split_pages() gives the new range
the number of VRAM pages counted in its part of the dma_addr arrays and
subtracts it from the old range. Pages migrated to VRAM by a prefetch
have no dma_addr entries until the range is mapped on a GPU, e.g. with
no ACCESS attribute, or with XNACK off before the delayed restore worker
mapped it, so the new range gets 0 and the old one keeps the count for
both.

Migrating the parts back to system memory then gets the accounting
wrong: the old part keeps a VRAM page count after all its pages are
gone, so its svm_bo is never freed, and the new part underflows. On
navi31, as an unprivileged process: prefetch 4 MiB to the GPU, prefetch
the upper 2 MiB and then the lower 2 MiB back to system memory:

  Recorded vram pages(0x0) should not be less than migration pages(0x200).
  WARNING: ../amdkfd/kfd_migrate.c:922 at svm_migrate_vram_to_ram+0xbdc/0xcd0 [amdgpu]

and /sys/class/kfd/kfd/proc/<pid>/vram_<gpu_id> stays at 4194304 until
the process exits.

Without dma_addr arrays, the split is still exact when the old range is
completely in VRAM, which is what a prefetch of the whole range leaves.
Give the new range all its pages in that case. The warning is gone and
the VRAM usage drops back to 0.

This doesn't cover a range that is only partly in VRAM without dma_addr
arrays, e.g. after a partial migration, since svm_migrate_ram_to_vram()
only counts the pages it actually migrated. That would need VRAM
residency to be tracked per page independently of dma_addr.

v2:
- Rename counted to has_dma_addr and compare against old->npages (Philip)
- Mention the XNACK off case and the partial migration limitation (Philip)

Fixes: 006ad514a50c ("drm/amdkfd: Use partial hmm page walk during buffer validation in SVM")
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7ca6f3359b557a267c7b07a2fd748b1473395e10)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 366b31191ac1e6..cd2cfb9a3bae27 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -987,9 +987,12 @@ svm_range_split_pages(struct svm_range *new, struct svm_range *old,
 		      uint64_t start, uint64_t last)
 {
 	uint64_t npages = last - start + 1;
+	bool has_dma_addr = false;
 	int i, r;
 
 	for (i = 0; i < MAX_GPU_INSTANCE; i++) {
+		if (old->dma_addr[i])
+			has_dma_addr = true;
 		r = svm_range_split_array(&new->dma_addr[i], &old->dma_addr[i],
 					  sizeof(*old->dma_addr[i]), old->start,
 					  npages, new->start, new->npages,
@@ -997,8 +1000,16 @@ svm_range_split_pages(struct svm_range *new, struct svm_range *old,
 		if (r)
 			return r;
 	}
-	if (old->actual_loc)
+	if (old->actual_loc) {
+		/*
+		 * Pages migrated by prefetch have no dma_addr until they are
+		 * mapped on a GPU. A fully resident range still splits exactly,
+		 * old->npages isn't adjusted yet here.
+		 */
+		if (!has_dma_addr && old->vram_pages == old->npages)
+			new->vram_pages = new->npages;
 		old->vram_pages -= new->vram_pages;
+	}
 
 	return 0;
 }

From 48f413a3999ac9421f97c2330242dc72f72ae24f Mon Sep 17 00:00:00 2001
From: Avi Weiss <thnkslprpt@gmail.com>
Date: Sun, 11 Oct 2026 10:45:10 +0300
Subject: [PATCH 1821/1982] drm/amd/display: Initialize missing TD-LUT
 programming inputs

[ Upstream commit 167df3b94680b8670c4cacc08af232e3bfcab5ff ]

dml_core_mode_programming() memsets (clears) its scratch structure
before calculating TD-LUT settings, but does not initialize
tdlut_mpc_width_flag or is_gfx11.

Both inputs therefore remain false regardless of the plane
configuration which can result in incorrect calculations.

Initialize both fields using the same sources as the mode
support path (now both paths are aligned).

Fixes: 70839da63605 ("drm/amd/display: Add new DCN401 sources")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ad8d216e7d9fc050cdf39278e5fae17f61c36931)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
index d2a237fcf5b08f..ccc7ce0db2e1a9 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
@@ -10921,6 +10921,8 @@ static bool dml_core_mode_programming(struct dml2_core_calcs_mode_programming_ex
 		calculate_tdlut_setting_params->cursor_buffer_size = mode_lib->ip.cursor_buffer_size;
 		calculate_tdlut_setting_params->gpuvm_enable = display_cfg->gpuvm_enable;
 		calculate_tdlut_setting_params->gpuvm_page_size_kbytes = display_cfg->plane_descriptors[k].overrides.gpuvm_min_page_size_kbytes;
+		calculate_tdlut_setting_params->tdlut_mpc_width_flag = display_cfg->plane_descriptors[k].tdlut.tdlut_mpc_width_flag;
+		calculate_tdlut_setting_params->is_gfx11 = dml_get_gfx_version(display_cfg->plane_descriptors[k].surface.tiling);
 
 		// output
 		calculate_tdlut_setting_params->tdlut_pte_bytes_per_frame = &s->tdlut_pte_bytes_per_frame[k];

From 7f1ed723c19846fd176243acb68ecdccb22bfa72 Mon Sep 17 00:00:00 2001
From: Jiale Yao <yaojiale02@163.com>
Date: Fri, 16 Oct 2026 22:15:04 +0800
Subject: [PATCH 1822/1982] drm/amdkfd: validate SRAT subtables before parsing

[ Upstream commit 9866cb13ba4d39aa8fed34b765d4aecabe04f02e ]

The KFD SRAT walker reads the first subtable length without checking
that a header is present and trusts subsequent lengths when accessing
CPU and generic affinity records. Invalid firmware lengths can therefore
cause out-of-bounds reads.

Validate the table header, every generic subtable range, and each
supported typed record before reading its fields.

Fixes: ddec8d3be0f8 ("drm/amdkfd: add ACPI SRAT parsing for topology")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d76b655c98e8cc9e791b31502ad274f47dee2aae)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 35 ++++++++++++++++++---------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index b0e87bdc291141..ee6c17e88976ad 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -2051,27 +2051,33 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
 		return;
 	}
 
+	if (table_header->length < sizeof(struct acpi_table_srat))
+		goto invalid_srat;
+
 	table_end = (unsigned long)table_header + table_header->length;
 
 	/* Parse all entries looking for a match. */
 	sub_header = (struct acpi_subtable_header *)
 			((unsigned long)table_header +
 			sizeof(struct acpi_table_srat));
-	subtable_len = sub_header->length;
 
-	while (((unsigned long)sub_header) + subtable_len  < table_end) {
-		/*
-		 * If length is 0, break from this loop to avoid
-		 * infinite loop.
-		 */
-		if (subtable_len == 0) {
-			pr_err("SRAT invalid zero length\n");
-			break;
-		}
+	while ((unsigned long)sub_header < table_end) {
+		unsigned long start = (unsigned long)sub_header;
+
+		if (table_end - start < sizeof(*sub_header))
+			goto invalid_srat;
+
+		subtable_len = sub_header->length;
+		if (subtable_len < sizeof(*sub_header) ||
+		    subtable_len > table_end - start)
+			goto invalid_srat;
 
 		switch (sub_header->type) {
 		case ACPI_SRAT_TYPE_CPU_AFFINITY:
 			cpu = (struct acpi_srat_cpu_affinity *)sub_header;
+			if (subtable_len < sizeof(*cpu))
+				goto invalid_srat;
+
 			pxm = *((u32 *)cpu->proximity_domain_hi) << 8 |
 					cpu->proximity_domain_lo;
 			if (pxm > max_pxm)
@@ -2079,6 +2085,9 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
 			break;
 		case ACPI_SRAT_TYPE_GENERIC_AFFINITY:
 			gpu = (struct acpi_srat_generic_affinity *)sub_header;
+			if (subtable_len < sizeof(*gpu))
+				goto invalid_srat;
+
 			bdf = *((u16 *)(&gpu->device_handle[0])) << 16 |
 					*((u16 *)(&gpu->device_handle[2]));
 			if (bdf == pci_id) {
@@ -2095,9 +2104,13 @@ static void kfd_find_numa_node_in_srat(struct kfd_node *kdev)
 
 		sub_header = (struct acpi_subtable_header *)
 				((unsigned long)sub_header + subtable_len);
-		subtable_len = sub_header->length;
 	}
 
+	goto out;
+
+invalid_srat:
+	pr_err("SRAT contains an invalid subtable\n");
+out:
 	acpi_put_table(table_header);
 
 	/* Workaround bad cpu-gpu binding case */

From 7f695fb47b4073d6bbd5bb9d5c4f969327641eab Mon Sep 17 00:00:00 2001
From: Jesse Zhang <Jesse.Zhang@amd.com>
Date: Mon, 12 Oct 2026 12:19:15 +0800
Subject: [PATCH 1823/1982] drm/amdkfd: evict the queues only once for CRIU
 PROCESS_INFO

[ Upstream commit 8f3ecda0ab42fb5ba7310fe848013d3eff31b416 ]

criu_process_info() evicts the queues of the process on every call, and
each kfd_process_evict_queues() increments qpd->evicted, but CRIU UNPAUSE
restores them only once. After PROCESS_INFO twice and UNPAUSE the queues
stay evicted for good. On navi31, a barrier-AND packet on an HSA queue
completes after PROCESS_INFO + UNPAUSE, but times out after
PROCESS_INFO, PROCESS_INFO, UNPAUSE.

The error path has a related problem: when kfd_process_evict_queues()
itself fails, it has already rolled back its partial eviction, and the
kfd_process_restore_queues() in the error path restores once more.

Evict only when the queues are not paused yet, and on errors only undo
an eviction done by this call. The barrier now completes after any
number of PROCESS_INFO calls followed by UNPAUSE.

Fixes: cd9f79103003 ("drm/amdkfd: CRIU Implement KFD unpause operation")
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4d79c9e3c32c677fcadf5ca10ab81ee0a4b81f99)
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index b90bfbd121f887..e4a6100d036ae8 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -2703,6 +2703,7 @@ static int criu_process_info(struct file *filep,
 				struct kfd_process *p,
 				struct kfd_ioctl_criu_args *args)
 {
+	bool paused_here = false;
 	int ret = 0;
 
 	mutex_lock(&p->mutex);
@@ -2713,11 +2714,15 @@ static int criu_process_info(struct file *filep,
 		goto err_unlock;
 	}
 
-	ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_CHECKPOINT);
-	if (ret)
-		goto err_unlock;
+	/* UNPAUSE restores the queues once, so evict them only once */
+	if (!p->queues_paused) {
+		ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_CHECKPOINT);
+		if (ret)
+			goto err_unlock;
 
-	p->queues_paused = true;
+		p->queues_paused = true;
+		paused_here = true;
+	}
 
 	args->pid = task_pid_nr_ns(p->lead_thread,
 					task_active_pid_ns(p->lead_thread));
@@ -2732,7 +2737,7 @@ static int criu_process_info(struct file *filep,
 				args->priv_data_size);
 
 err_unlock:
-	if (ret) {
+	if (ret && paused_here) {
 		kfd_process_restore_queues(p);
 		p->queues_paused = false;
 	}

From 3646b7c04717004d0abfc71dd35d25a646c34f45 Mon Sep 17 00:00:00 2001
From: Kamil Sawicki <user148783812897@gmail.com>
Date: Fri, 23 Oct 2026 20:48:35 -0400
Subject: [PATCH 1824/1982] net: limit priority VLAN untag depth

[ Upstream commit d3ff07f5acc573e5f72bf1c581bae5d05191ba61 ]

The priority VLAN receive path can repeatedly remove VID 0 tags and retry
packet processing. Unlike the read-only VLAN protocol parser, this path has
no limit on the number of nested tags it consumes.

Each skb_vlan_untag() advances skb->data and resets header offsets. The
offsets are stored in 16-bit fields. With enough nested tags, the network
or transport offset can wrap. A later protocol handler can then derive a
large pull length from the wrapped offsets and access memory outside the
skb allocation.

Apply the existing VLAN_MAX_DEPTH limit to the exceptional VID 0 retry.
Count the tag already stored in skb VLAN metadata as the first level, then
stop before untagging a ninth level. Keep the accounting inside this
uncommon branch so the regular VLAN receive path is unaffected.

A single VID 0 priority tag before a real VLAN tag is valid. No normal
deployment was found that intentionally emits multiple consecutive VID 0
tags; permitting eight levels is therefore conservative.

The issue was found while researching the Linux network receive path for
Google kvmCTF, with OpenAI Codex (gpt-5.6-sol) assisting the analysis. The
affected path, reproducer and fix were manually reviewed and tested.

Fixes: 36b2f61a42c2 ("net: handle 802.1P vlan 0 packets properly")
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Kamil Sawicki <user148783812897@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Link: https://patch.msgid.link/20261024004835.17862-1-user148783812897@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 0bfd5e9940df05..673223065b955f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6074,6 +6074,8 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
 	}
 
 	if (unlikely(skb_vlan_tag_present(skb)) && !netdev_uses_dsa(skb->dev)) {
+		unsigned int priority_tag_depth = 1;
+
 check_vlan_id:
 		if (skb_vlan_tag_get_id(skb)) {
 			/* Vlan id is non 0 and vlan_do_receive() above couldn't
@@ -6085,6 +6087,12 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
 			 * 802.1Q or 802.1AD and vlan_do_receive() above could
 			 * not find vlan dev for vlan id 0.
 			 */
+			if (unlikely(priority_tag_depth >= VLAN_MAX_DEPTH)) {
+				drop_reason = SKB_DROP_REASON_RECURSION_LIMIT;
+				goto drop;
+			}
+
+			priority_tag_depth++;
 			__vlan_hwaccel_clear_tag(skb);
 			skb = skb_vlan_untag(skb);
 			if (unlikely(!skb))

From 33e747a4822b77117a17805e0c7df9e0bb03413b Mon Sep 17 00:00:00 2001
From: Xia Yan <yanxia@cmss.chinamobile.com>
Date: Thu, 22 Oct 2026 17:08:09 +0800
Subject: [PATCH 1825/1982] macvlan: fix passthru promiscuity accounting while
 down

[ Upstream commit b6743653d134c9ef8436e2db1be1ad4c1e0d0091 ]

macvlan_changelink() adjusts the lower device's promiscuity count when
NOPROMISC changes, even if the passthru macvlan is down. The reference
is acquired in macvlan_open() and released in macvlan_stop(), so a down
interface has no reference to change.

Clearing NOPROMISC while down leaves an extra reference after the next
open/stop cycle. Setting it while down can remove a reference held by
another user of the lower device.

Guard the count adjustment with netif_running(dev). Keep storing the
requested flags while down so the next open uses the new setting.

Comparing changelink with open/stop exposed the unmatched count changes;
the same issue was also described in earlier macvlan reviews. A netlink
test on UML reproduced both DOWN cases before the fix and verified the
expected counts afterwards. Repeated flag updates, two open/stop cycles,
deletion and bidirectional small-frame delivery were also checked.

Full x86_64 builds completed with WERROR disabled for allmodconfig, and
WERROR and KASAN disabled for allyesconfig, including the resulting
dependency changes. Neither comparison showed new diagnostics.

Fixes: df8ef8f3aaa6 ("macvlan: add FDB bridge ops and macvlan flags")
Link: https://lore.kernel.org/netdev/179170088566.434549.4699134797461783473@kernel.org/
Link: https://lore.kernel.org/netdev/20261016003009.2692872-1-kuba@kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261022090809.12019-1-yanxia@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/macvlan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 7151ae883136b0..c38989009c76f5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1630,7 +1630,8 @@ static int macvlan_changelink(struct net_device *dev,
 	if (data && data[IFLA_MACVLAN_FLAGS]) {
 		__u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
 		bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
-		if (macvlan_passthru(vlan->port) && promisc) {
+		if (macvlan_passthru(vlan->port) && promisc &&
+		    netif_running(dev)) {
 			int err;
 
 			if (flags & MACVLAN_FLAG_NOPROMISC)

From 5e3cdfc8554dfc43b90ca13231e694bd145390d5 Mon Sep 17 00:00:00 2001
From: David Yang <mmyangfl@gmail.com>
Date: Mon, 26 Oct 2026 02:20:18 +0800
Subject: [PATCH 1826/1982] net: hisilicon: hisi_femac: Stop the receiver
 before releasing the RX ring

[ Upstream commit d54b21d824302af52d06574870817fbe14774dab ]

hisi_femac_net_close() frees the receive ring while the RX address queue
still holds every address that was pushed to IQ_ADDR.

A port that keeps receiving then DMAs arrived frames into buffers that
other slab caches have already taken back; on an EC6108V9C (hi3798mv100)
the queue still held all 52 armed addresses right after the interface
was closed, and had dropped to 43 after 15 s of broadcast traffic.

Reset the port before the buffers are released, so that the receiver no
longer holds any of their addresses.

Fixes: 542ae60af24f ("net: hisilicon: Add Fast Ethernet MAC driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20261025182022.2959333-1-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hisi_femac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c
index d244a40df43091..fba68035c96916 100644
--- a/drivers/net/ethernet/hisilicon/hisi_femac.c
+++ b/drivers/net/ethernet/hisilicon/hisi_femac.c
@@ -491,6 +491,7 @@ static int hisi_femac_net_close(struct net_device *dev)
 	netif_stop_queue(dev);
 	napi_disable(&priv->napi);
 
+	hisi_femac_port_reset(priv);
 	hisi_femac_free_skb_rings(priv);
 
 	return 0;

From 2ebe4f0736129014d6fc475215fc5bf0a0549737 Mon Sep 17 00:00:00 2001
From: Hyeontae Lee <wonju345@naver.com>
Date: Fri, 31 Jul 2026 23:14:40 +0900
Subject: [PATCH 1827/1982] fs/ntfs3: bound CreateAttribute asize against
 record_size in do_action

[ Upstream commit fb0f0ef7b5a6bc761b372ce00764d4b6e0b91a47 ]

In do_action()'s CreateAttribute case (fslog.c:3286), attr2 points into
the on-disk log record and asize = le32_to_cpu(attr2->size) is therefore
attacker-controlled on mount.  The guard bounds asize only against the
log record itself,

	Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)

where rec_len is the client data length, and separately bounds dlen
against the MFT record.  Nothing bounds asize against record_size, but
all three writes that follow are into rec, a kmalloc(sbi->record_size)
buffer allocated by mi_init() (record.c:105):

	memmove(Add2Ptr(attr, asize), attr, used - roff);
	memcpy(attr, attr2, asize);
	rec->used = cpu_to_le32(used + asize);

With record_size 0x400, roff 0x38, used 0x160 and asize 0x800 the memcpy
writes 2048 bytes at rec + 0x38, 0x438 bytes past the allocation, and
rec->used is left at 0x960.  dlen is 0x18 here, so the existing
dlen check passes: dlen bounds nothing about the size of the copy.

The equivalent non-replay path already refuses this.  mi_insert_attr()
performs the same insert and starts with (record.c:488):

	if (used + asize > sbi->record_size)
		return NULL;

Apply the same bound, spelled as a subtraction to match the neighbouring
clause.  used <= record_size holds here because check_file_record()
validates it (fslog.c:2826) and is called on this record at fslog.c:3172;
roff <= used - 4 follows from check_if_attr() together with the ATTR_END
check at fslog.c:2844, so bounding used + asize bounds both copies.

The sibling WriteEndOfFileRecordSegment case does the equivalent check
against record_size at fslog.c:3277.

Reproduced by mounting a crafted image on v7.2-rc5 under KASAN:

  BUG: KASAN: slab-out-of-bounds in do_action.isra.0+0x41f6/0x83a0
  Write of size 2048 at addr ffff888005c74838 by task mount/69

  CPU: 0 UID: 0 PID: 69 Comm: mount Not tainted 7.2.0-rc5-00300-g8ba098e6b6ff #2
  Call Trace:
   kasan_report+0xce/0x100
   kasan_check_range+0x105/0x1b0
   __asan_memcpy+0x3c/0x60
   do_action.isra.0+0x41f6/0x83a0
   log_replay+0x920a/0xd300
   ntfs_loadlog_and_replay+0x3ef/0x510
   ntfs_fill_super+0x1d23/0x4550
   get_tree_bdev_flags+0x2ef/0x550
   vfs_get_tree+0x82/0x2f0
   fc_mount+0x10/0x1b0
   path_mount+0x517/0x1df0
   __x64_sys_mount+0x20b/0x270
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

  Allocated by task 69:
   __kasan_kmalloc+0x8f/0xa0
   __kmalloc_noprof+0x1b4/0x460
   mi_init+0x81/0x110
   mi_get+0x6a/0x220
   do_action.isra.0+0x1db4/0x83a0
   log_replay+0x920a/0xd300
   ntfs_loadlog_and_replay+0x3ef/0x510
   ntfs_fill_super+0x1d23/0x4550

  The buggy address belongs to the object at ffff888005c74800
   which belongs to the cache kmalloc-1k of size 1024
  The buggy address is located 56 bytes inside of
   allocated 1024-byte region [ffff888005c74800, ffff888005c74c00)

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hyeontae Lee <wonju345@naver.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/fslog.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ca3533a10d0646..f9b6275643f2c6 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3302,10 +3302,15 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 		asize = le32_to_cpu(attr2->size);
 		used = le32_to_cpu(rec->used);
 
+		/*
+		 * attr2->size is taken from the log record and is bounded only
+		 * by the log record length, not by the MFT record.  Refuse an
+		 * attribute that does not fit, as mi_insert_attr() does.
+		 */
 		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
 		    !IS_ALIGNED(asize, 8) ||
 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
-		    dlen > record_size - used) {
+		    dlen > record_size - used || asize > record_size - used) {
 			goto dirty_vol;
 		}
 

From 61329755f28185322ab4f7640112b1e5c2f505ee Mon Sep 17 00:00:00 2001
From: Hyeontae Lee <wonju345@naver.com>
Date: Mon, 3 Aug 2026 14:21:45 +0900
Subject: [PATCH 1828/1982] fs/ntfs3: bound DeleteAttribute asize against
 rec->used in do_action

[ Upstream commit 408216b66afd9ddadaba2dce56fd4af6793e95a2 ]

In do_action()'s DeleteAttribute case (fslog.c:3316), attr is
Add2Ptr(rec, roff) with roff taken from the on-disk lrh->record_off, and
asize = le32_to_cpu(attr->size) is read straight out of the MFT record:

	asize = le32_to_cpu(attr->size);
	used  = le32_to_cpu(rec->used);

	if (!check_if_attr(rec, lrh))
		goto dirty_vol;
	...
	memmove(attr, Add2Ptr(attr, asize), used - asize - roff);

check_if_attr() (fslog.c:2869) walks the attribute chain from
rec->attr_off and returns o == ro.  Its loop breaks on ATTR_END, so ro may
legitimately equal the offset of the ATTR_END marker; that is exactly how
CreateAttribute appends to a record.  But check_file_record()'s walk
(fslog.c:2831) also stops at ATTR_END, so check_attr() never inspects the
bytes there.  When roff is the ATTR_END offset, those never-validated bytes
are what gets read as attr->size, and used - asize - roff underflows.

The read itself is also unbounded: roff is a u16 and attr->size is
dereferenced at fslog.c:3317, before check_if_attr() has constrained roff
at all, so it can be up to ~64K past a record_size-sized object.

Commit 0ca0485e4b2e ("fs/ntfs3: validate rec->used in journal-replay file
record check") added at fslog.c:2844

	if (used < PtrOffset(rec, attr) + sizeof(attr->type))
		return false;

and its changelog names this very memmove.  It bounds rec->used against the
ATTR_END offset; it does not bound asize.  With record_size 0x400,
attr_off 0x38, a valid three-attribute chain ending in ATTR_END at 0x158
and used 0x160, a record whose four bytes at 0x15c read 0x100 gives

	used - asize - roff = 0x160 - 0x100 - 0x158 = 0xffffff08

i.e. a ~4 GiB memmove whose source and destination both run off the end of
rec, a kmalloc(sbi->record_size) object (record.c:105).

The equivalent non-replay path already refuses this.  mi_remove_attr()
performs the same removal and starts with (record.c:548):

	if (aoff + asize > used)
		return false;

Apply the same bound, spelled as a subtraction to match the neighbouring
cases, and move the attr->size read after check_if_attr() so that the
header is known to lie inside the record before it is dereferenced.
Requiring roff + SIZEOF_RESIDENT <= used rejects the ATTR_END offset
without rejecting any real attribute: for an attribute the walk validated,
roff + asize <= off(ATTR_END) <= used - 4, and any attribute a
DeleteAttribute record can legitimately name carries a full resident
header, so roff + SIZEOF_RESIDENT <= roff + asize <= used - 4.
check_attr() itself imposes no lower bound on asize, so a crafted
sub-header asize can still pass the first test; the second test then
bounds it and the memmove stays inside the record.

Reproduced by mounting a crafted image on v7.2-rc5, which already contains
0ca0485e4b2e, under KASAN.  The image is an ordinary mkfs.ntfs volume with
four bytes of one MFT record changed and a crafted $LogFile:

  BUG: KASAN: slab-out-of-bounds in do_action.isra.0+0x3211/0x83c0
  Read of size 4294967048 at addr ffff888002423258 by task mount/66

  CPU: 1 UID: 0 PID: 66 Comm: mount Not tainted 7.2.0-rc5 #3
  Call Trace:
   kasan_report+0xce/0x100
   kasan_check_range+0x105/0x1b0
   __asan_memmove+0x23/0x60
   do_action.isra.0+0x3211/0x83c0
   log_replay+0x920a/0xd300
   ntfs_loadlog_and_replay+0x3ef/0x510
   ntfs_fill_super+0x1d23/0x4550
   get_tree_bdev_flags+0x2ef/0x550
   vfs_get_tree+0x82/0x2f0
   fc_mount+0x10/0x1b0
   path_mount+0x517/0x1df0
   __x64_sys_mount+0x20b/0x270
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

  Allocated by task 66:
   __kasan_kmalloc+0x8f/0xa0
   __kmalloc_noprof+0x1b4/0x460
   mi_init+0x81/0x110
   mi_get+0x6a/0x220
   do_action.isra.0+0x1dbf/0x83c0
   log_replay+0x920a/0xd300
   ntfs_loadlog_and_replay+0x3ef/0x510
   ntfs_fill_super+0x1d23/0x4550

  The buggy address belongs to the object at ffff888002423000
   which belongs to the cache kmalloc-1k of size 1024
  The buggy address is located 600 bytes inside of
   allocated 1024-byte region [ffff888002423000, ffff888002423400)

KASAN reports the source side because __asan_memmove()
(mm/kasan/shadow.c:94) validates src before dest and returns without
copying.  Both ends are out of bounds, and on a kernel built without
KASAN the copy is performed.

rec->used is also left at used - asize by fslog.c:3323 before the memmove,
so the record stays inconsistent even when the copy is suppressed; the same
mount goes on to report "ino=1a, mi_enum_attr" and marks the volume dirty.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hyeontae Lee <wonju345@naver.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/fslog.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index f9b6275643f2c6..e2668c57066b4d 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3340,10 +3340,21 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 		break;
 
 	case DeleteAttribute:
-		asize = le32_to_cpu(attr->size);
 		used = le32_to_cpu(rec->used);
 
-		if (!check_if_attr(rec, lrh))
+		/*
+		 * check_if_attr() accepts a record_off that points at the
+		 * ATTR_END marker, which is how CreateAttribute appends.  The
+		 * bytes there are not an attribute and check_attr() never
+		 * validated them, so refuse an offset that cannot hold a
+		 * resident header before reading attr->size, and then bound it
+		 * as mi_remove_attr() does.
+		 */
+		if (!check_if_attr(rec, lrh) || roff + SIZEOF_RESIDENT > used)
+			goto dirty_vol;
+
+		asize = le32_to_cpu(attr->size);
+		if (asize > used - roff)
 			goto dirty_vol;
 
 		rec->used = cpu_to_le32(used - asize);

From 241fed9fa149e538546116e22d88420bac606291 Mon Sep 17 00:00:00 2001
From: Hongling Zeng <zenghongling@kylinos.cn>
Date: Wed, 5 Aug 2026 14:45:59 +0800
Subject: [PATCH 1829/1982] ntfs3: fix mapping pairs bounds check for alignment

[ Upstream commit f517cae6333121783043d9ba5142b50f5d1cf75b ]

In the UpdateMappingPairs action, the expansion check compares the
unaligned new attribute size with the available record space. The new
size is aligned to an 8-byte boundary before the mapping pairs are
updated, so the check can underestimate the required space by up to
seven bytes.

Use the aligned size in the expansion check to ensure that the
subsequent update cannot exceed the available record space.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/fslog.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index e2668c57066b4d..4753fcab4d81c0 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3436,7 +3436,8 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 
 		if (!check_if_attr(rec, lrh) || !attr->non_res ||
 		    aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
-		    (nsize > asize && nsize - asize > record_size - used)) {
+		    (nsize > asize &&
+		     ALIGN(nsize, 8) - asize > record_size - used)) {
 			goto dirty_vol;
 		}
 

From 9a048334a7dce061f6c75d3b334b4a4f28db60fc Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date: Tue, 27 Oct 2026 16:46:55 +0200
Subject: [PATCH 1830/1982] ASoC: hdac_hda: Keep runtime PM state in sync
 across codec remove/probe

[ Upstream commit 99203e8d8968def973e82bb712ea959c6a46c16e ]

After the codec has been removed, its runtime PM status is
RPM_SUSPENDED while hdac_hda_codec_probe() powers the codec up via
snd_hda_codec_device_new(). The pm_runtime_put()/snd_hda_power_down()
calls on probe and registration then see an already suspended device,
the codec suspend callback is not called and the codec, its HDA link and
the codec_powered bit stay set, preventing the controller from runtime
suspending.

The remove has a similar problem with the codec link accounting:
hdac_hda_codec_remove() drops the link reference taken in probe without
looking at the runtime PM state of the codec. If the codec was already
runtime suspended, the link reference has been dropped by the codec
suspend callback and the remove drops it a second time.

Resume the codec in hdac_hda_codec_remove() before disabling runtime PM
so that the link reference and the codec_powered bit are always in the
same state as after the probe, and mark the device active on probe once
the codec has been powered up.

Finally mark the codec device suspended at the end of the remove. Its
runtime PM is disabled at this point and if only the ASoC card is
unbound (e.g. by unbinding the machine driver), a following system
suspend would otherwise call the runtime suspend callback on the already
cleaned up codec via pm_runtime_force_suspend().

This is a followup patch to address Sashiko reports.

Link: https://lore.kernel.org/linux-sound/20261027083840.28813-4-peter.ujfalusi@linux.intel.com/
Fixes: c3ec8ac82105 ("ASoC: hdac_hda: fix memleak on module unload")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20261027144655.31988-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/hdac_hda.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index 1a89f570fd1f47..ac28b3cadb69f8 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -517,6 +517,9 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
 		snd_hdac_display_power(hdev->bus,
 				       HDA_CODEC_IDX_CONTROLLER, false);
 
+	/* The codec is in D0, the status is RPM_SUSPENDED after a previous unbind */
+	pm_runtime_set_active(&hdev->dev);
+
 	/* match for forbid call in snd_hda_codec_device_new() */
 	pm_runtime_allow(&hdev->dev);
 
@@ -557,6 +560,12 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
 		return;
 	}
 
+	/*
+	 * Resume the codec to have its link reference (dropped below) and
+	 * codec_powered bit in the same state as after the probe.
+	 */
+	pm_runtime_get_sync(&hdev->dev);
+
 	/* prevent runtime PM callbacks while the link and the codec are torn down */
 	pm_runtime_disable(&hdev->dev);
 	snd_hdac_ext_bus_link_put(hdev->bus, hlink);
@@ -568,6 +577,9 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
 
 	/* Balances the disable above, cleanup_for_unbind keeps runtime PM disabled */
 	pm_runtime_enable(&hdev->dev);
+	pm_runtime_put_noidle(&hdev->dev);
+	/* The codec is cleaned up, system suspend must skip it from now on */
+	pm_runtime_set_suspended(&hdev->dev);
 }
 
 static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {

From 63c2733ed1fc1d40a6c42577a3e82e0e1323e945 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 23 Oct 2026 19:53:09 +0000
Subject: [PATCH 1831/1982] ppp: fix stale pointer access after pskb_may_pull
 in ppp_ccp_peek

[ Upstream commit 1e860f42f41c6fbf3304f6a52be38245b9394982 ]

ppp_ccp_peek() caches a pointer to skb->data in dp after the first
pskb_may_pull(), then uses dp after a second pskb_may_pull(skb, len + 2)
in the CCP_CONFACK handler. If the second pull triggers
pskb_expand_head() due to a cloned skb or frag linearization,
skb->head is freed and reallocated, leaving dp stale.

The stale dp is subsequently used in CCP_OPT_LENGTH() and passed to
decomp_init()/comp_init() which read from the freed memory.

Re-derive dp from skb->data after the second pskb_may_pull.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ppp/ppp_generic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 14fa87a8e08345..61c240d846ee2c 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -3204,6 +3204,7 @@ ppp_ccp_peek(struct ppp *ppp, struct sk_buff *skb, int inbound)
 		len = CCP_LENGTH(dp);
 		if (!pskb_may_pull(skb, len + 2))
 			return;		/* too short */
+		dp = skb->data + 2;
 		dp += CCP_HDRLEN;
 		len -= CCP_HDRLEN;
 		if (len < CCP_OPT_MINLEN || len < CCP_OPT_LENGTH(dp))

From 36c3af0e94b6c385c4934c028cbca27e138ae1ee Mon Sep 17 00:00:00 2001
From: Weiming Shi <bestswngs@gmail.com>
Date: Fri, 16 Oct 2026 10:23:38 -0700
Subject: [PATCH 1832/1982] nvmet-rdma: reject short connection requests

[ Upstream commit 635e760169a87abf03874cd4636cd91b580cb427 ]

nvmet_rdma_parse_cm_connect_req() treats RDMA-CM private data as a
struct nvme_rdma_cm_req but accepts any nonzero private_data_len.  The
iWARP path allocates exactly the peer-provided length, so a six-byte MPA
request reaches the parser and the hsqsize load reads two bytes past the
allocation.

Require the complete request structure before reading any of its fields.
The decoded KASAN report is:

  BUG: KASAN: slab-out-of-bounds in nvmet_rdma_cm_handler
    (drivers/nvme/target/rdma.c:1427 drivers/nvme/target/rdma.c:1475
     drivers/nvme/target/rdma.c:1614 drivers/nvme/target/rdma.c:1814)
  Read of size 2 at addr ff1100010459d366 by task kworker/u16:1/41
  Workqueue: iw_cm_wq cm_work_handler
  Call Trace:
   <TASK>
   dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
   print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
   kasan_report (mm/kasan/report.c:595)
   nvmet_rdma_cm_handler
    (drivers/nvme/target/rdma.c:1427 drivers/nvme/target/rdma.c:1475
     drivers/nvme/target/rdma.c:1614 drivers/nvme/target/rdma.c:1814)
   cma_cm_event_handler (drivers/infiniband/core/cma.c:2181)
   iw_conn_req_handler (drivers/infiniband/core/cma.c:2640)
   cm_work_handler
    (drivers/infiniband/core/cm.c:2502
     drivers/infiniband/core/cm.c:3858)
   process_one_work (kernel/workqueue.c:3396)
   worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   </TASK>

  Allocated by task 12:
   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
   __kmalloc_node_track_caller_noprof
    (mm/slub.c:5414 mm/slub.c:5545)
   kmemdup_noprof (mm/util.c:138)
   cm_event_handler
    (drivers/infiniband/core/iwcm.c:194
     drivers/infiniband/core/iwcm.c:1076)
   siw_cm_upcall (drivers/infiniband/sw/siw/siw_cm.c:408)
   siw_proc_mpareq (drivers/infiniband/sw/siw/siw_cm.c:750)
   siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1086)

  The buggy address is located 0 bytes to the right of
  allocated 6-byte region [ff1100010459d360, ff1100010459d366)

Cc: stable@vger.kernel.org
Fixes: 8f000cac6e7a ("nvmet-rdma: add a NVMe over Fabrics RDMA target driver")
Reported-by: <co+e015e82956da641b@bugs.sh>
Assisted-by: LLM
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/rdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 2b03bce27a88cd..a0ba6641c7ffb7 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -1410,7 +1410,7 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
 	struct nvme_rdma_cm_req *req;
 
 	req = (struct nvme_rdma_cm_req *)conn->private_data;
-	if (!req || conn->private_data_len == 0)
+	if (!req || conn->private_data_len < sizeof(*req))
 		return NVME_RDMA_CM_INVALID_LEN;
 
 	if (le16_to_cpu(req->recfmt) != NVME_RDMA_CM_FMT_1_0)

From 224aa110632eaccdafa62e106fbeb81420c0d84e Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Thu, 22 Oct 2026 15:29:30 +0200
Subject: [PATCH 1833/1982] nvmet-fc: only send read data for successful
 commands

[ Upstream commit 94f93c61b1a5dd08d011be58172ce4392b849008 ]

When a read command completes with an error,
__nvmet_fc_fcp_nvme_cmd_done() still pushes the whole data buffer to
the host before the response. nvmet_fc_alloc_tgt_pgs() allocates that
buffer with sgl_alloc() and no __GFP_ZERO, and a command rejected by
nvmet_check_transfer_len() leaves it untouched, so the host receives
stale target memory.

The buffer is as large as the data length in the command IU, so the
amount of stale memory returned is up to the host.

The tcp and rdma targets send data only when cqe->status is zero (see
nvmet_tcp_need_data_out() and nvmet_rdma_need_data_out()), so no nvmet
command can rely on returning data with an error status. Do the same
for fc. The ERSP then reports a transferred length of fod->offset,
which is 0, matching what nvme_fc_fcpio_done() checks on the host.

Tested over nvme-fcloop: a failed read command no longer transfers
data and still completes with its error status, and successful reads
are unaffected.

Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1880fc78043261..ec08992668b99e 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -2493,11 +2493,11 @@ __nvmet_fc_fcp_nvme_cmd_done(struct nvmet_fc_tgtport *tgtport,
 	} else {
 
 		/*
-		 * try to push the data even if the SQE status is non-zero.
-		 * There may be a status where data still was intended to
-		 * be moved
+		 * A failed command may not have filled its read buffer, so
+		 * only push data for success, as the tcp and rdma targets do.
 		 */
-		if ((fod->io_dir == NVMET_FCP_READ) && (fod->data_sg_cnt)) {
+		if (fod->io_dir == NVMET_FCP_READ && fod->data_sg_cnt &&
+		    !cqe->status) {
 			/* push the data over before sending rsp */
 			nvmet_fc_transfer_fcp_data(tgtport, fod,
 						NVMET_FCOP_READDATA);

From 5dc1fa00e67e8ab728a1284b8c889675e6eb8605 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Thu, 22 Oct 2026 15:29:32 +0200
Subject: [PATCH 1834/1982] nvmet: pci-epf: report transport errors in command
 completions

[ Upstream commit 46ed7310a60029826eedb01081a4556643ed5f3b ]

When the PCI endpoint target fails a command itself, the host receives a
successful completion. This happens for a data length above MDTS,
malformed PRPs or SGLs, a buffer allocation failure, an SQ that is not
live, and a failed DMA of the command data. A write whose data cannot be
fetched from the host is thus reported as written, though nothing was
executed.

Each of these paths sets iod->status and calls
nvmet_pci_epf_complete_iod(), which then reloads iod->status from
iod->cqe.status. The nvmet core only fills that field when it completes
the request, which these paths never do, so it is still zero and
nvmet_pci_epf_cq_work() posts a success status to the host.

Drop the reload. Every path already sets iod->status before completion:
nvmet_pci_epf_queue_response() copies it from the request's CQE, and
the transport error paths set it themselves.

Found by code inspection.

Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
Cc: stable@vger.kernel.org
Tested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/pci-epf.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c
index e3815be98ee6e2..a85f21a5937061 100644
--- a/drivers/nvme/target/pci-epf.c
+++ b/drivers/nvme/target/pci-epf.c
@@ -1174,7 +1174,6 @@ static void nvmet_pci_epf_complete_iod(struct nvmet_pci_epf_iod *iod)
 	unsigned long flags;
 
 	/* Print an error message for failed commands, except AENs. */
-	iod->status = le16_to_cpu(iod->cqe.status) >> 1;
 	if (iod->status && iod->cmd.common.opcode != nvme_admin_async_event)
 		dev_err(iod->ctrl->dev,
 			"CQ[%d]: Command %s (0x%x) status 0x%0x\n",

From 868a29f30f15e6a75371ccbc64a9d0bdc2be4795 Mon Sep 17 00:00:00 2001
From: Andrea Parri <parri.andrea@gmail.com>
Date: Thu, 22 Oct 2026 15:29:33 +0200
Subject: [PATCH 1835/1982] nvmet: pci-epf: require SGLs to match the command
 data length

[ Upstream commit 9fb4adbc39751697b9fcf71e45bd5d5119c3f07c ]

The PCI endpoint target sends the host every byte a read command's SGL
describes, even when the SGL describes more than the command transfers.
The excess is kmalloc() memory the command never wrote, so the host
receives stale target memory. Any successful read can do this,
including Identify.

nvmet_pci_epf_alloc_iod_data_buf() allocates each segment at the length
of its SGL data descriptor, but sets req->transfer_len from
iod->data_len, the length the command implies. Once the command
completes, nvmet_pci_epf_transfer_iod_data() sends every segment in
full. Nothing compares the descriptor lengths with iod->data_len, and
the MDTS check only bounds iod->data_len.

Fail the command with Data SGL Length Invalid when the data descriptors
do not add up to iod->data_len, before any segment is allocated. The
tcp and rdma transports take the data length from the SGL itself, so
there most commands already reject a mismatch in
nvmet_check_transfer_len(). PRP lists are built from iod->data_len and
are unaffected.

Found by code inspection.

Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
Cc: stable@vger.kernel.org
Tested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/pci-epf.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/pci-epf.c b/drivers/nvme/target/pci-epf.c
index a85f21a5937061..dcc6cae6f3c5e7 100644
--- a/drivers/nvme/target/pci-epf.c
+++ b/drivers/nvme/target/pci-epf.c
@@ -1095,10 +1095,22 @@ static int nvmet_pci_epf_iod_parse_sgl_segments(struct nvmet_pci_epf_ctrl *ctrl,
 	return 0;
 }
 
+static u64 nvmet_pci_epf_iod_data_segs_len(struct nvmet_pci_epf_iod *iod)
+{
+	u64 len = 0;
+	int i;
+
+	for (i = 0; i < iod->nr_data_segs; i++)
+		len += iod->data_segs[i].length;
+
+	return len;
+}
+
 static int nvmet_pci_epf_iod_parse_sgls(struct nvmet_pci_epf_iod *iod)
 {
 	struct nvmet_pci_epf_ctrl *ctrl = iod->ctrl;
 	struct nvme_sgl_desc *sgl = &iod->cmd.common.dptr.sgl;
+	int ret;
 
 	if (sgl->type == (NVME_SGL_FMT_DATA_DESC << 4)) {
 		/* Single data descriptor case. */
@@ -1106,10 +1118,23 @@ static int nvmet_pci_epf_iod_parse_sgls(struct nvmet_pci_epf_iod *iod)
 		iod->data_segs = &iod->data_seg;
 		iod->data_seg.pci_addr = le64_to_cpu(sgl->addr);
 		iod->data_seg.length = le32_to_cpu(sgl->length);
-		return 0;
+	} else {
+		ret = nvmet_pci_epf_iod_parse_sgl_segments(ctrl, iod);
+		if (ret)
+			return ret;
 	}
 
-	return nvmet_pci_epf_iod_parse_sgl_segments(ctrl, iod);
+	/*
+	 * The command executes on data_len bytes, but each segment is
+	 * allocated and transferred in full, so they must describe exactly
+	 * data_len bytes.
+	 */
+	if (nvmet_pci_epf_iod_data_segs_len(iod) != iod->data_len) {
+		iod->status = NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
+		return -EINVAL;
+	}
+
+	return 0;
 }
 
 static int nvmet_pci_epf_alloc_iod_data_buf(struct nvmet_pci_epf_iod *iod)

From d6792894711a19e093681ee874095bf7f4543c6b Mon Sep 17 00:00:00 2001
From: Shao Mingyin <shao.mingyin@zte.com.cn>
Date: Mon, 26 Oct 2026 16:45:26 +0800
Subject: [PATCH 1836/1982] nvmet-auth: fix error handling on CHALLENGE failure

[ Upstream commit 96da408bb4a24bf87b366b13f41c2687d3c05671 ]

In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for
example when the initiator-supplied allocation length is shorter than the
DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails),
the error path sets status = NVME_SC_INTERNAL and breaks out of the
switch. The unconditional

    status = nvmet_copy_to_sgl(req, 0, d, al);

after the switch then overwrites the error status (nvmet_copy_to_sgl()
returns 0 on success), so the AUTH_RECEIVE command incorrectly completes
with SUCCESS and the initiator proceeds with a truncated/empty challenge.

Fix this by freeing the buffer and jumping to the common done: label on
CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the
NVME_SC_INTERNAL status.

Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fabrics-cmd-auth.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 20a2dfcbbc57f2..fc50fde2947d4c 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -601,10 +601,11 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
 	switch (req->sq->dhchap_step) {
 	case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE:
 		if (nvmet_auth_challenge(req, d, al) < 0) {
-			pr_warn("ctrl %d qid %d: challenge error (%d)\n",
-				ctrl->cntlid, req->sq->qid, status);
+			pr_warn("ctrl %d qid %d: challenge error\n",
+				ctrl->cntlid, req->sq->qid);
 			status = NVME_SC_INTERNAL;
-			break;
+			kfree(d);
+			goto done;
 		}
 		req->sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_REPLY;
 		break;

From 5e4325c515dc5719d2dab3520327d1f04c661596 Mon Sep 17 00:00:00 2001
From: Guixin Liu <kanie@linux.alibaba.com>
Date: Mon, 26 Oct 2026 18:44:56 +0800
Subject: [PATCH 1837/1982] nvmet-fc: Tear down the association when the admin
 queue allocation fails

[ Upstream commit 11db8ab55e1a7533e9cfe57687ab142ba67d3c84 ]

When the initial admin queue allocation fails after a new association
was created, nvmet_fc_ls_create_association() only drops the
association reference, which frees the association.  By then the
association is already on the target port's assoc_list, though, and
removal from that list only happens in nvmet_fc_delete_target_assoc(),
which this error path never calls.  The freed association stays on the
list, where later lookups and the port teardown can access it, and the
target port reference taken at allocation time leaks.

A remote host can trigger this reliably with a Create Association LS
requesting a queue too large to allocate.

Schedule the regular association teardown instead of dropping the
reference directly.  The teardown removes the association from the
list and releases the target port reference before the final reference
drop frees it.

Fixes: 0cab4404874f ("nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association")
Cc: stable@vger.kernel.org
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index ec08992668b99e..89edffeb10626f 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1710,7 +1710,7 @@ nvmet_fc_ls_create_association(struct nvmet_fc_tgtport *tgtport,
 					be16_to_cpu(rqst->assoc_cmd.sqsize));
 			if (!queue) {
 				ret = VERR_QUEUE_ALLOC_FAIL;
-				nvmet_fc_tgt_a_put(iod->assoc);
+				nvmet_fc_schedule_delete_assoc(iod->assoc);
 			}
 		}
 	}

From 80b1428dbf81f4bb14d66606f61d1e1cb556ce0f Mon Sep 17 00:00:00 2001
From: Martin Belanger <martin.belanger@dell.com>
Date: Tue, 27 Oct 2026 06:38:52 -0400
Subject: [PATCH 1838/1982] nvme-tcp: start error recovery when read_sock fails

[ Upstream commit 288cfa187208cc9d0809eb8e1508658151a444dd ]

nvme_tcp_recv_skb() disables the queue and starts error recovery for
errors it detects itself. An error returned by the transport reaches
nvme_tcp_try_recv() without either action.

nvme_tcp_io_work() returns on a negative result and does not requeue
itself, so the queue stops receiving and remains stalled until a command
times out.

Report the error and start error recovery when the queue is still
enabled, which indicates that the error was not handled by the actor.
Do this under the socket lock, as nvme_tcp_recv_skb() does.

Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin Belanger <martin.belanger@dell.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index b7e4624f1dcd82..5d7581a1dc41de 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1425,6 +1425,19 @@ static int nvme_tcp_try_recv(struct nvme_tcp_queue *queue)
 	lock_sock(sk);
 	queue->nr_cqe = 0;
 	consumed = sock->ops->read_sock(sk, &rd_desc, nvme_tcp_recv_skb);
+	/*
+	 * nvme_tcp_recv_skb() handles its own errors, so a queue that is
+	 * still enabled failed inside read_sock(). Handle it before
+	 * release_sock() processes the backlog.
+	 */
+	if (unlikely(consumed < 0 && consumed != -EAGAIN &&
+		     queue->rd_enabled)) {
+		dev_err(queue->ctrl->ctrl.device,
+			"queue %d: receive failed: %d\n",
+			nvme_tcp_queue_id(queue), consumed);
+		queue->rd_enabled = false;
+		nvme_tcp_error_recovery(&queue->ctrl->ctrl);
+	}
 	release_sock(sk);
 	return consumed == -EAGAIN ? 0 : consumed;
 }

From 32bfe3eddb18691b482893c730fd71b0996e4aca Mon Sep 17 00:00:00 2001
From: Seiji Nishikawa <snishika@redhat.com>
Date: Wed, 14 Oct 2026 15:45:24 +0900
Subject: [PATCH 1839/1982] nvme-tcp: fix io_work priority inversion when
 send_mutex is held

[ Upstream commit 5db358f3a7f9c33717622c1597d15c4c91997b19 ]

Commit f42d4796ee10 ("nvme-tcp: fix I/O stalls on congested sockets")
added a check in nvme_tcp_io_work() that sets pending to true when the
queue has pending requests and the socket is writeable. The check is
placed after the mutex_trylock() block, so it also runs when
mutex_trylock(&queue->send_mutex) failed and io_work did not send
anything.

When .queue_rq sends a request directly from its own context, it holds
send_mutex and can give up the CPU in lock_sock_nested() when another
task needs the CPU, for example the io_work kworker of the same queue,
which runs on the same CPU. Then io_work cannot take send_mutex, but
the requests are still on req_list and the socket is writeable, so
pending is set to true. io_work loops until the deadline and queues
itself again on io_cpu, without sleeping.

This is a priority inversion. io_work runs on the high priority
nvme_tcp_wq and cannot make progress until send_mutex is released, but
it keeps running. The task holding send_mutex runs at normal priority
and needs the CPU to release it. The scheduler keeps giving the CPU to
io_work, so the task holding send_mutex may not run again, and the
requests on the queue are not sent and time out.

This is the same problem that commit 70f437fb4395 ("nvme-tcp: fix
io_work priority inversion") fixed. That commit removed
"pending = !llist_empty(&queue->req_list)" from the path where
mutex_trylock() fails, and let the task holding send_mutex queue
io_work again in nvme_tcp_queue_request() after it releases the mutex.
The new check brings back the same behavior in a different form.

Two things make this easier to hit. nvme_tcp_queue_request() sends
directly only when it runs on io_cpu, so the task that takes send_mutex
is on the same CPU as the io_work kworker of that queue when it takes
the mutex. Also, when the tasks are in a cgroup with the cpu controller
enabled, the whole group competes with the nice -20 kworker as one
entity, so each task in the group gets even less CPU time.

We hit this on a 6 CPU VM running a database on nvme-tcp storage. In
the vmcore, 2 tasks held send_mutex of 2 queues and were runnable in
lock_sock_nested() for 103 seconds, while the kworkers for those queues
kept running io_work on their CPUs. All database tasks were in one
cgroup, which got only about 0.3% of the CPU against the nice -20
kworker. Requests timed out, and blk_mq_timeout_work() waited in
synchronize_srcu() for the tasks still in .queue_rq.

Only do the pending check if io_work could take send_mutex. If it could
not, the task holding send_mutex sends what it can in
nvme_tcp_send_all(), and queues io_work again after it releases the
mutex if requests are still pending, so no request is left behind.

Fixes: f42d4796ee10 ("nvme-tcp: fix I/O stalls on congested sockets")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 5d7581a1dc41de..94495b02287140 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1450,9 +1450,11 @@ static void nvme_tcp_io_work(struct work_struct *w)
 
 	do {
 		bool pending = false;
+		bool got_send_mutex = false;
 		int result;
 
 		if (mutex_trylock(&queue->send_mutex)) {
+			got_send_mutex = true;
 			result = nvme_tcp_try_send(queue);
 			mutex_unlock(&queue->send_mutex);
 			if (result > 0)
@@ -1467,8 +1469,13 @@ static void nvme_tcp_io_work(struct work_struct *w)
 		else if (unlikely(result < 0))
 			return;
 
-		/* did we get some space after spending time in recv? */
-		if (nvme_tcp_queue_has_pending(queue) &&
+		/*
+		 * did we get some space after spending time in recv?
+		 * Only check this if we could take send_mutex. Otherwise
+		 * the task holding it sends the requests and queues io_work
+		 * again after it releases the mutex.
+		 */
+		if (got_send_mutex && nvme_tcp_queue_has_pending(queue) &&
 		    sk_stream_is_writeable(queue->sock->sk))
 			pending = true;
 

From 13ebf8ef96ac6988f56167a2e50ae290d59fc6f6 Mon Sep 17 00:00:00 2001
From: Guixin Liu <kanie@linux.alibaba.com>
Date: Wed, 28 Oct 2026 14:44:36 +0800
Subject: [PATCH 1840/1982] nvmet: Finish the blk plug when integrity
 allocation fails

[ Upstream commit 18fc5f6f1ca945630dae5404265de55d65194e22 ]

nvmet_bdev_execute_rw() starts a plug before building the bios, but
the two error exits taken when nvmet_bdev_alloc_bip() fails return
without calling blk_finish_plug().  current->plug is left pointing
at the stack frame of the returned function, so the next
blk_flush_plug() walks a stale list.

Route both failures through a common exit that finishes the plug.

Fixes: c6e3f13398123 ("nvmet: add metadata support for block devices")
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/io-cmd-bdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
index 0103815542d49f..160364cc8c9802 100644
--- a/drivers/nvme/target/io-cmd-bdev.c
+++ b/drivers/nvme/target/io-cmd-bdev.c
@@ -305,7 +305,7 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req)
 							  &prot_miter);
 				if (unlikely(rc)) {
 					bio_io_error(bio);
-					return;
+					goto out_plug;
 				}
 			}
 
@@ -325,11 +325,12 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req)
 		rc = nvmet_bdev_alloc_bip(req, bio, &prot_miter);
 		if (unlikely(rc)) {
 			bio_io_error(bio);
-			return;
+			goto out_plug;
 		}
 	}
 
 	submit_bio(bio);
+out_plug:
 	blk_finish_plug(&plug);
 }
 

From 1890437496271781a9d4ab1ba2ba9bbe4cc7c073 Mon Sep 17 00:00:00 2001
From: Guixin Liu <kanie@linux.alibaba.com>
Date: Wed, 28 Oct 2026 16:55:51 +0800
Subject: [PATCH 1841/1982] nvmet: Free the old negotiation state when
 restarting authentication

[ Upstream commit 5c279fcabb0ea7ba61881c13027b15d8054b8abd ]

Restarting a DH-HMAC-CHAP negotiation with SEND(NEGOTIATE) resets
sq->dhchap_step but does not release the previous c1/c2/skey, which
are only freed in nvmet_auth_sq_free() at teardown.  The next
CHALLENGE/REPLY exchange then overwrites those pointers with fresh
allocations.

An unauthenticated host can repeat the negotiate message endlessly,
leaking a few dozen bytes per round and slowly exhausting target
memory.

Clear the old negotiation state with nvmet_auth_sq_free() before
setting up the new one.  Also reset dhchap_skey_len to zero: if a DH
session key was already established, a following round with dhvlen=0
would otherwise pass a NULL skey with a stale non-zero length to the
HMAC code and dereference it.

Fixes: db1312dd95488 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/auth.c             | 1 +
 drivers/nvme/target/fabrics-cmd-auth.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 4c68225411be31..eb2b6c7a808384 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -249,6 +249,7 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq)
 	sq->dhchap_c2 = NULL;
 	kfree(sq->dhchap_skey);
 	sq->dhchap_skey = NULL;
+	sq->dhchap_skey_len = 0;
 }
 
 void nvmet_auth_sq_destroy(struct nvmet_sq *sq)
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index fc50fde2947d4c..61a36fb54e877d 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -326,6 +326,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 			/* Restart negotiation */
 			pr_debug("%s: ctrl %d qid %d reset negotiation\n",
 				 __func__, ctrl->cntlid, req->sq->qid);
+			nvmet_auth_sq_free(req->sq);
 			if (!req->sq->qid) {
 				dhchap_status = nvmet_setup_auth(ctrl, req->sq,
 								 true);

From 129119bb1c3dba3c47bc620a831355dbd1451c7b Mon Sep 17 00:00:00 2001
From: Fang Xieyan <fangxy@xiaopeng.com>
Date: Tue, 15 Sep 2026 02:03:44 +0800
Subject: [PATCH 1842/1982] kgdb: Fix buffer overflow in the 'm' packet handler

[ Upstream commit ac0159129e2cb99a70c4b80cfbf58d03e092dc7b ]

gdb_cmd_memread() passes the length of the 'm' packet straight to
kgdb_mem2hex(), which hex-encodes the reply into
remcom_out_buffer[BUFMAX] without checking that the reply fits. A
client on the KGDB I/O console can ask for a read of any size, and
the hex encoding runs off the end of the buffer. kgdb_mem2hex() takes
that length as an int count, so 2^31 truncates to a negative value
and copy_from_kernel_nofault() is handed buf + count as its
destination.

On x86 BUFMAX is 1024, so a read of 512 bytes overruns by the single
byte that terminates the hex string:

  BUG: KASAN: global-out-of-bounds in kgdb_mem2hex+0x1dd/0x230
  Write of size 1 at addr ffffffff87651780 by task sh/1
  ...
  The buggy address belongs to the variable:
   remcom_out_buffer+0x400/0x420

Bounds check the length before the hex encoding:

		if (length > (BUFMAX - 1) / 2) {
			error_packet(remcom_out_buffer, -EINVAL);
			return;
		}

gdbstub_msg_write() already bounds the count it hex-encodes
against BUFMAX. Reads over the limit never returned valid data,
so an error reply loses nothing.

Fixes: dc7d55270521 ("kgdb: core")
Cc: stable@vger.kernel.org
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20260914180344.15485-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/gdbstub.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index 22fe969c5d2e59..75b9cf07ebbe09 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -562,6 +562,14 @@ static void gdb_cmd_memread(struct kgdb_state *ks)
 
 	if (kgdb_hex2long(&ptr, &addr) > 0 && *ptr++ == ',' &&
 					kgdb_hex2long(&ptr, &length) > 0) {
+		/*
+		 * The hex-encoded reply needs 2 * length + 1 bytes
+		 * in remcom_out_buffer[BUFMAX].
+		 */
+		if (length > (BUFMAX - 1) / 2) {
+			error_packet(remcom_out_buffer, -EINVAL);
+			return;
+		}
 		err = kgdb_mem2hex((char *)addr, remcom_out_buffer, length);
 		if (!err)
 			error_packet(remcom_out_buffer, -EINVAL);

From 009c3d488595eb52245be30cb7b9de83f7d89f22 Mon Sep 17 00:00:00 2001
From: Fang Xieyan <fangxy@xiaopeng.com>
Date: Tue, 22 Sep 2026 23:49:07 +0800
Subject: [PATCH 1843/1982] kgdb: Fix buffer overflow in the 'M' and 'X' packet
 handlers

[ Upstream commit 13962ef7021ef2531a4f6650eca87c363e6c9c32 ]

write_mem_msg() passes the length claimed by an 'M' or 'X' packet directly
to kgdb_hex2mem() or kgdb_ebin2mem(). A malformed packet can claim more
data than was actually received, causing the decoders to read past
remcom_in_buffer.

Record the received payload length in get_packet() and use it to bound
the decoders. 'M' carries two hex characters per byte, while 'X' carries
one byte per output byte except that a 0x7d escape consumes an additional
input byte. Pass the packet end to kgdb_ebin2mem() so both reads are
checked against the received data.

Keep zero-length 'X' packets valid, as GDB uses them to probe binary
download support.

Fixes: dc7d55270521 ("kgdb: core")
Cc: stable@vger.kernel.org
Assisted-by: Hawkeye:GLM-5.3-flash
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Link: https://lore.kernel.org/r/20260922154907.90535-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/gdbstub.c | 45 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 38 insertions(+), 7 deletions(-)

diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index 75b9cf07ebbe09..dbe48bd53e533a 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -42,6 +42,8 @@
 /* Our I/O buffers. */
 static char			remcom_in_buffer[BUFMAX];
 static char			remcom_out_buffer[BUFMAX];
+/* Payload bytes get_packet() stored in remcom_in_buffer, excluding the NUL. */
+static int			remcom_in_len;
 static int			gdbstub_use_prev_in_buf;
 static int			gdbstub_prev_in_buf_pos;
 
@@ -86,7 +88,7 @@ static int gdbstub_read_wait(void)
 }
 #endif
 /* scan for the sequence $<data>#<checksum> */
-static void get_packet(char *buffer)
+static int get_packet(char *buffer)
 {
 	unsigned char checksum;
 	unsigned char xmitcsum;
@@ -134,6 +136,8 @@ static void get_packet(char *buffer)
 		}
 		buffer[count] = 0;
 	} while (checksum != xmitcsum);
+
+	return count;
 }
 
 /*
@@ -320,16 +324,26 @@ int kgdb_hex2long(char **ptr, unsigned long *long_val)
  * Copy the binary array pointed to by buf into mem.  Fix $, #, and
  * 0x7d escaped with 0x7d. Return -EFAULT on failure or 0 on success.
  * The input buf is overwritten with the result to write to mem.
+ *
+ * buf_end points one past the last byte received for this packet. Each
+ * 0x7d escape consumes a second input byte, so decoding count bytes can
+ * read up to 2 * count input bytes; stop at buf_end rather than running
+ * off the end of remcom_in_buffer.
  */
-static int kgdb_ebin2mem(char *buf, char *mem, int count)
+static int kgdb_ebin2mem(char *buf, char *mem, int count, char *buf_end)
 {
 	int size = 0;
 	char *c = buf;
 
 	while (count-- > 0) {
+		if (buf >= buf_end)
+			return -EINVAL;
 		c[size] = *buf++;
-		if (c[size] == 0x7d)
+		if (c[size] == 0x7d) {
+			if (buf >= buf_end)
+				return -EINVAL;
 			c[size] = *buf++ ^ 0x20;
+		}
 		size++;
 	}
 
@@ -366,16 +380,33 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 static int write_mem_msg(int binary)
 {
 	char *ptr = &remcom_in_buffer[1];
+	char *buf_end = &remcom_in_buffer[remcom_in_len];
 	unsigned long addr;
 	unsigned long length;
 	int err;
 
 	if (kgdb_hex2long(&ptr, &addr) > 0 && *(ptr++) == ',' &&
 	    kgdb_hex2long(&ptr, &length) > 0 && *(ptr++) == ':') {
-		if (binary)
-			err = kgdb_ebin2mem(ptr, (char *)addr, length);
-		else
+		/*
+		 * Trust only the bytes actually received, not length: the
+		 * client can claim more payload than it sent. 'M' decodes two
+		 * hex chars per byte in place, so it needs 2 * length bytes at
+		 * ptr; 'X' decodes one byte per byte, and kgdb_ebin2mem() bounds
+		 * its extra 0x7d-escape reads against buf_end itself.
+		 */
+		if (ptr >= buf_end)
+			return -EINVAL;
+
+		if (binary) {
+			if (length > (unsigned long)(buf_end - ptr))
+				return -EINVAL;
+			err = kgdb_ebin2mem(ptr, (char *)addr, length, buf_end);
+		} else {
+			if (length > (unsigned long)(buf_end - ptr) / 2)
+				return -EINVAL;
 			err = kgdb_hex2mem(ptr, (char *)addr, length);
+		}
+
 		if (err)
 			return err;
 		if (CACHE_FLUSH_IS_SAFE)
@@ -992,7 +1023,7 @@ int gdb_serial_stub(struct kgdb_state *ks)
 		/* Clear the out buffer. */
 		memset(remcom_out_buffer, 0, sizeof(remcom_out_buffer));
 
-		get_packet(remcom_in_buffer);
+		remcom_in_len = get_packet(remcom_in_buffer);
 
 		switch (remcom_in_buffer[0]) {
 		case '?': /* gdbserial status */

From 61e7228c532950643d9ccaa2274d30c61a00d376 Mon Sep 17 00:00:00 2001
From: Fang Xieyan <fangxy@xiaopeng.com>
Date: Wed, 16 Sep 2026 23:17:53 +0800
Subject: [PATCH 1844/1982] kgdb: Fix buffer overflow in the qRcmd packet
 handler

[ Upstream commit 9ca9e8c857b55a081d5a1f8039b27cbb4d646b49 ]

gdb_cmd_query() decodes the hex payload of a qRcmd packet (the GDB
"monitor" command passthrough to kdb) into remcom_out_buffer and hands
it to kdb_parse(). It sizes the decode with strlen() of the payload:

	int len = strlen(remcom_in_buffer + 6);
	...
	kgdb_hex2mem(remcom_in_buffer + 6,
		     remcom_out_buffer, len);
	len = len / 2;

kgdb_hex2mem() takes count as the number of bytes to produce and
decodes them in place at buf, reading and writing 2 * count bytes
there. len here is the hex character count, twice the decoded size,
so the decode runs over 2 * len bytes at remcom_in_buffer + 6, off
the end of the buffer. On x86 BUFMAX is 1024, so a 256-byte monitor
command (512 hex characters) overruns remcom_in_buffer during the
in-place decode:

  BUG: KASAN: global-out-of-bounds in kgdb_hex2mem+0x131/0x160
  Read of size 1 at addr ffffffff8765ef05 by task sh/1
  ...
  kgdb_hex2mem+0x131/0x160
  gdb_serial_stub+0x16d4/0x3170
  kgdb_cpu_enter+0xb68/0x1520
  ...
  The buggy address belongs to the variable:
   remcom_in_buffer+0x405/0x420

Halve len before the call so kgdb_hex2mem() gets the decoded byte count.
It then reads the len hex characters already in remcom_in_buffer and
writes len / 2 bytes, all inside the buffer, and remcom_out_buffer holds
the same command as before.

Fixes: a0de055cf613 ("kgdb: gdb "monitor" -> kdb passthrough")
Cc: stable@vger.kernel.org
Suggested-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/all/CAD=FV=V1-gNZ8yTsC+D8inePWv=A+9H09hWJojQf5NRpcNvK+Q@mail.gmail.com/
Assisted-by: Qoder:Qwen3.8-Max
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20260916151753.6722-1-fangxy@xiaopeng.com
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index dbe48bd53e533a..1a917c5bdd1ebf 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -816,9 +816,9 @@ static void gdb_cmd_query(struct kgdb_state *ks)
 				strscpy(remcom_out_buffer, "E01");
 				break;
 			}
+			len = len / 2;
 			kgdb_hex2mem(remcom_in_buffer + 6,
 				     remcom_out_buffer, len);
-			len = len / 2;
 			remcom_out_buffer[len++] = 0;
 
 			kdb_common_init_state(ks);

From b80b417d864b3f99dbcdfb64c5ba49ccfbfdd139 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@kernel.org>
Date: Sun, 25 Oct 2026 13:38:31 -0700
Subject: [PATCH 1845/1982] fsverity: Be more careful with return value of
 ->get_verity_descriptor()

[ Upstream commit 8f8faec82aa902b1997ae578c46bcc84afbad811 ]

If fsverity_operations::get_verity_descriptor() returns that the verity
descriptor has 0 size, then a zero-size buffer is allocated to hold it,
and it's called again with bufsize=0.

But bufsize=0 is a special case that says to return the actual size.  If
in the meantime the filesystem has decided that the size is some
actually valid size, it will return that size, and then
validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash.

Of course, for the filesystem to misbehave in that strange way, it
generally would require direct writes to the block device.

Regardless, fsverity_get_descriptor() might as well guard against it.
Make it do so.  Specifically, validate that the first call to
->get_verity_descriptor() returns at least the minimum descriptor size,
and validate that the second call returns the same size as the first.

Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261025203831.120095-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/verity/open.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/fs/verity/open.c b/fs/verity/open.c
index 2aa5eae5a54039..02e2c14ab3ffb9 100644
--- a/fs/verity/open.c
+++ b/fs/verity/open.c
@@ -273,12 +273,6 @@ static bool validate_fsverity_descriptor(struct inode *inode,
 					 const struct fsverity_descriptor *desc,
 					 size_t desc_size)
 {
-	if (desc_size < sizeof(*desc)) {
-		fsverity_err(inode, "Unrecognized descriptor size: %zu bytes",
-			     desc_size);
-		return false;
-	}
-
 	if (desc->version != 1) {
 		fsverity_err(inode, "Unrecognized descriptor version: %u",
 			     desc->version);
@@ -317,31 +311,37 @@ static bool validate_fsverity_descriptor(struct inode *inode,
 int fsverity_get_descriptor(struct inode *inode,
 			    struct fsverity_descriptor **desc_ret)
 {
-	int res;
+	int size, res;
 	struct fsverity_descriptor *desc;
 
-	res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
-	if (res < 0) {
-		fsverity_err(inode,
-			     "Error %d getting verity descriptor size", res);
-		return res;
+	size = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
+	if (size < 0) {
+		fsverity_err(inode, "Error %d getting verity descriptor size",
+			     size);
+		return size;
 	}
-	if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
-		fsverity_err(inode, "Verity descriptor is too large (%d bytes)",
-			     res);
+	if (size < sizeof(*desc) || size > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
+		fsverity_err(inode,
+			     "Verity descriptor has invalid size (%d bytes)",
+			     size);
 		return -EMSGSIZE;
 	}
-	desc = kmalloc(res, GFP_KERNEL);
+	desc = kmalloc(size, GFP_KERNEL);
 	if (!desc)
 		return -ENOMEM;
-	res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res);
+	res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, size);
 	if (res < 0) {
 		fsverity_err(inode, "Error %d reading verity descriptor", res);
 		kfree(desc);
 		return res;
 	}
-
-	if (!validate_fsverity_descriptor(inode, desc, res)) {
+	if (res != size) {
+		fsverity_err(inode, "Verity descriptor size changed (%d => %d)",
+			     size, res);
+		kfree(desc);
+		return -EINVAL;
+	}
+	if (!validate_fsverity_descriptor(inode, desc, size)) {
 		kfree(desc);
 		return -EINVAL;
 	}

From 74cc51e2f1bf6f2b8b8da4c36c70ca781f9192ee Mon Sep 17 00:00:00 2001
From: Avi Weiss <thnkslprpt@gmail.com>
Date: Mon, 26 Oct 2026 14:26:42 +0200
Subject: [PATCH 1846/1982] irqchip/riscv-imsic: Report successful hardware
 retrigger
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a2f482407d33ebe7f12e30d6cf383ffb1c7d709d ]

imsic_irq_retrigger() writes to the IMSIC MSI register to retrigger
an interrupt, but returns 0. The IRQ core treats zero as failure and
may schedule a software resend despite the hardware retrigger.

Return 1 after the MSI write to report successful hardware
retriggering and prevent the unnecessary software resend.

Fixes: 027e125acdba ("irqchip/riscv-imsic: Add device MSI domain support for platform devices")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261026122641.3292904-2-thnkslprpt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-riscv-imsic-platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-riscv-imsic-platform.c b/drivers/irqchip/irq-riscv-imsic-platform.c
index 643c8e45961173..52673ff9edf4a8 100644
--- a/drivers/irqchip/irq-riscv-imsic-platform.c
+++ b/drivers/irqchip/irq-riscv-imsic-platform.c
@@ -61,7 +61,7 @@ static int imsic_irq_retrigger(struct irq_data *d)
 
 	local = per_cpu_ptr(imsic->global.local, vec->cpu);
 	writel_relaxed(vec->local_id, local->msi_va);
-	return 0;
+	return 1;
 }
 
 static void imsic_irq_ack(struct irq_data *d)

From 4d4bd7bcc14e80ab38d5ea2cf6018afd00660f20 Mon Sep 17 00:00:00 2001
From: Avi Weiss <thnkslprpt@gmail.com>
Date: Sun, 25 Oct 2026 14:20:58 +0200
Subject: [PATCH 1847/1982] irqchip/irq-msi-lib: Free wired MSI descriptors

[ Upstream commit 1c16bc2b1122f78f9d51c5785f7a78b36d44972b ]

msi_device_domain_alloc_wired() allocates a descriptor for each
interrupt, but wired MSI domains do not set MSI_FLAG_FREE_MSI_DESCS.
msi_device_domain_free_wired() releases the IRQ without freeing its
descriptor, eventually exhausting the domain. Failed allocations also
leave descriptors behind.

Set MSI_FLAG_FREE_MSI_DESCS for wired MSI domains so both paths
release the descriptors.

Fixes: 64a855324311 ("irqchip/irq-msi-lib: Prepare for DOMAIN_BUS_WIRED_TO_MSI")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261025122058.2180685-1-thnkslprpt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-msi-lib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-msi-lib.c b/drivers/irqchip/irq-msi-lib.c
index d5eefc3d72155c..8b8a64f63a717b 100644
--- a/drivers/irqchip/irq-msi-lib.c
+++ b/drivers/irqchip/irq-msi-lib.c
@@ -72,6 +72,7 @@ bool msi_lib_init_dev_msi_info(struct device *dev, struct irq_domain *domain,
 		info->flags = MSI_FLAG_ALLOC_SIMPLE_MSI_DESCS | MSI_FLAG_FREE_MSI_DESCS;
 		fallthrough;
 	case DOMAIN_BUS_WIRED_TO_MSI:
+		info->flags |= MSI_FLAG_FREE_MSI_DESCS;
 		/* Remove PCI specific flags */
 		required_flags &= ~MSI_FLAG_PCI_MSI_MASK_PARENT;
 		break;

From 6ad9711f4fec328a970821ad5cd3a49b1dad9380 Mon Sep 17 00:00:00 2001
From: Yongjian Wang <echoowall@gmail.com>
Date: Mon, 26 Oct 2026 15:23:09 +0800
Subject: [PATCH 1848/1982] Revert "net: advertise TCP MSS from the configured
 MTU, not the learned PMTU"

[ Upstream commit 564313447e545eea13038f74ada9272ab129b3cb ]

This reverts commit 2640e6419594 ("net: advertise TCP MSS from the
configured MTU, not the learned PMTU").

That commit stopped the learned PMTU from lowering the MSS we advertise
in SYN and SYN-ACK. For symmetric paths it argued that "the peer runs
its own PMTU discovery and usually already knows the real path MTU".
That only holds if ICMP "fragmentation needed" can reach the peer. When
the peer sits behind a firewall that drops inbound ICMP, its PMTU
discovery is a black hole (RFC 2923, section 2.1), and the smaller MSS
we advertised was the only thing keeping its full-size segments off the
narrow hop.

Inbound ICMP filtering is very common in enterprise and carrier
networks, and it is pervasive in mainland China. We hit this in
production after the commit was backported to 6.12.111: TCP connections
that reach a server through a relay with a smaller-MTU hop complete the
handshake, then stall as soon as the client sends full-size segments.
Clients on networks that let ICMP through, and connections that bypass
the relay, are unaffected, which made it hard to trace back to the
kernel.

Reproducer, network namespaces on a single host:

  cli --(1500)-- r1 --(1456)-- r2 --(1500)-- srv

r1 drops ICMP frag-needed towards cli. srv has already learned PMTU
1456 towards cli, then cli uploads 1 MB to srv:

  kernel                     SYN-ACK MSS   1 MB upload
  6.12.107                   1416          OK
  6.12.111                   1460          stalls, times out
  7.3-rc7                    1460          stalls, times out
  7.3-rc7 + this revert      1416          OK

The asymmetric case the commit was written for does not need a new
default: the advertised MSS can already be set per route with the
advmss metric, which takes precedence over default_advmss(). With this
revert applied, on an asymmetric path where srv learned PMTU 1456
towards cli while cli->srv is 1500 end to end:

  srv route to cli           SYN-ACK MSS   largest cli->srv segment
  default                    1416          1404
  advmss 1460                1460          1448

So DSR-style setups can opt in with "ip route ... advmss <mss>", while
hosts whose peers cannot complete PMTU discovery keep working by
default.

Fixes: 2640e6419594 ("net: advertise TCP MSS from the configured MTU, not the learned PMTU")
Closes: https://lore.kernel.org/regressions/4F0FAEB6-A13B-47F3-BFF1-C706686C6F64@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Yongjian Wang <echoowall@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20261026-advmss-revert-v1-2-272fa4b7ecb6@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/ip.h        | 25 -------------------------
 include/net/ip6_route.h | 37 -------------------------------------
 net/ipv4/route.c        |  4 ++--
 net/ipv6/route.c        |  2 +-
 4 files changed, 3 insertions(+), 65 deletions(-)

diff --git a/include/net/ip.h b/include/net/ip.h
index 5041202ccce2ae..86e555fb6897bb 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -513,31 +513,6 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 	return res;
 }
 
-/* Configured/administrative MTU of a route, for advertising the TCP MSS.
- *
- * Unlike ip_dst_mtu_maybe_forward(), this deliberately ignores the
- * ICMP-learned path MTU (rt->rt_pmtu).  The advertised MSS bounds what the
- * peer may send to us and must reflect our receive capability (the device or
- * route-configured MTU), not a path MTU learned on the reverse (send)
- * direction, which may not apply to the peer->us path and outlives the fnhe
- * for the whole connection.  See RFC 2923 section 2.3 and the comment above
- * tcp_advertise_mss().
- */
-static inline unsigned int ip_dst_mtu_configured(const struct dst_entry *dst)
-{
-	unsigned int mtu, res;
-
-	rcu_read_lock();
-	mtu = dst_metric_raw(dst, RTAX_MTU);
-	if (!mtu)
-		mtu = READ_ONCE(dst_dev_rcu(dst)->mtu);
-	mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
-	res = mtu - lwtunnel_headroom(dst->lwtstate, mtu);
-	rcu_read_unlock();
-
-	return res;
-}
-
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
 					  const struct sk_buff *skb)
 {
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 4137bdf05baaee..956ebbebd53cf8 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -354,43 +354,6 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst
 	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
 
-/* Configured/administrative MTU of a route, for advertising the TCP MSS.
- *
- * Unlike ip6_dst_mtu_maybe_forward(), this ignores any ICMPv6-learned path
- * MTU (which is kept on the RTF_CACHE exception route) and returns the MTU of
- * the underlying route (fib6_pmtu) or the egress device.  The advertised MSS
- * bounds what the peer may send to us and must reflect our receive
- * capability, not a path MTU learned on the reverse (send) direction.  See
- * RFC 2923 section 2.3 and the comment above tcp_advertise_mss().
- */
-static inline unsigned int ip6_dst_mtu_configured(const struct dst_entry *dst)
-{
-	const struct rt6_info *rt = dst_rt6_info(dst);
-	const struct fib6_info *from;
-	struct inet6_dev *idev;
-	unsigned int mtu = 0;
-
-	rcu_read_lock();
-	/* IPv6 keeps the learned PMTU and the configured MTU in the same
-	 * RTAX_MTU slot: the learned value sits on this (possibly RTF_CACHE)
-	 * dst, the configured one on the underlying route.  Reach the latter
-	 * via ->from (fib6_pmtu), populated by ip6_route_info_create().
-	 */
-	from = rcu_dereference(rt->from);
-	if (from)
-		mtu = from->fib6_pmtu;
-	if (!mtu) {
-		mtu = IPV6_MIN_MTU;
-		idev = __in6_dev_get(dst_dev_rcu(dst));
-		if (idev)
-			mtu = max_t(unsigned int, mtu, READ_ONCE(idev->cnf.mtu6));
-	}
-	rcu_read_unlock();
-
-	mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
-	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
-}
-
 u32 ip6_mtu_from_fib6(const struct fib6_result *res,
 		      const struct in6_addr *daddr,
 		      const struct in6_addr *saddr);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6e51d8f5365dcc..e6276896f3ad42 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1362,8 +1362,8 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 
 	rcu_read_lock();
 	net = dst_dev_net_rcu(dst);
-	advmss = max_t(unsigned int, ip_dst_mtu_configured(dst) - header_size,
-		       net->ipv4.ip_rt_min_advmss);
+	advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+				   net->ipv4.ip_rt_min_advmss);
 	rcu_read_unlock();
 
 	return min(advmss, IPV4_MAX_PMTU - header_size);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ce60fe53b822b2..c3a837bdd0cb69 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3264,7 +3264,7 @@ EXPORT_SYMBOL_GPL(ip6_sk_redirect);
 
 static unsigned int ip6_default_advmss(const struct dst_entry *dst)
 {
-	unsigned int mtu = ip6_dst_mtu_configured(dst);
+	unsigned int mtu = dst6_mtu(dst);
 	struct net *net;
 
 	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);

From 084a9234681ed6e2f8828341984d8770fb10ab66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maxime=20B=C3=A9lair?= <maxime.belair@canonical.com>
Date: Mon, 24 Aug 2026 17:58:02 +0200
Subject: [PATCH 1849/1982] apparmor: fix NULL ctx->peer derefs in unix socket
 ctx updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4de32fd05ce9e63b492899215ea929e7d306cdab ]

aa_unix_file_perm lazily refreshes the AppArmor context cached on a unix
socket. Two of the helpers it uses assume ctx->peer has already been set:

	update_peer_ctx ->  l = aa_label_merge(old, label, GFP_ATOMIC);
	update_sk_ctx   ->  } else if (aa_label_is_subset(plabel, old)) {

where @old is ctx->peer. Neither aa_label_merge nor aa_label_is_subset
allows NULL. So both fault on the aa_label->size load.

  BUG: kernel NULL pointer dereference, address: 000000000000004c
  RIP: 0010:__aa_label_next_not_in_set+0xb/0xd0
  Call Trace:
   aa_label_is_subset+0x3f/0x70
   aa_unix_file_perm+0x5e8/0x9d0
   aa_file_perm+0x45a/0x550
   apparmor_file_permission+0x44/0xb0
   security_file_permission+0x40/0x100
   rw_verify_area+0x56/0x180
   vfs_write+0x7c/0x480
   ksys_write+0xbf/0xf0

ctx->peer is only recorded for stream connections and socket pairs.
unix_dgram_connect sets unix_peer(sk) without going through that path,
so a connected AF_UNIX datagram socket has unix_peer(sk) set while
ctx->peer is still NULL, and the first write that needs revalidation
reaches the helpers above.

Both derefs date back to the Fixes: commit, but the update_sk_ctx() one
was dormant until commit 4483efe4f215 ("apparmor: fix shadowing of plabel
that prevents cache from being updated") stopped @plabel being shadowed,
which is why bisecting the oops lands there.

A NULL @old just means no peer label has been recorded yet, so install
the label directly instead of merging or comparing against it.

Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
Cc: stable@vger.kernel.org
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Closes: https://bugs.debian.org/1145111
Tested-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/af_unix.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index 834a3b1c2f0af4..aa2b31d5598cdf 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -676,7 +676,7 @@ static void update_sk_ctx(struct sock *sk, struct aa_label *label,
 		if (old == plabel) {
 			rcu_assign_pointer(ctx->peer_lastupdate,
 					   aa_get_label(plabel));
-		} else if (aa_label_is_subset(plabel, old)) {
+		} else if (!old || aa_label_is_subset(plabel, old)) {
 			rcu_assign_pointer(ctx->peer_lastupdate,
 					   aa_get_label(plabel));
 			rcu_assign_pointer(ctx->peer, aa_get_label(plabel));
@@ -694,13 +694,17 @@ static void update_peer_ctx(struct sock *sk, struct aa_sk_ctx *ctx,
 	spin_lock(&unix_sk(sk)->lock);
 	old = rcu_dereference_protected(ctx->peer,
 					lockdep_is_held(&unix_sk(sk)->lock));
-	l = aa_label_merge(old, label, GFP_ATOMIC);
-	if (l) {
-		if (l != old) {
-			rcu_assign_pointer(ctx->peer, l);
-			aa_put_label(old);
-		} else
-			aa_put_label(l);
+	if (!old) {
+		rcu_assign_pointer(ctx->peer, aa_get_label(label));
+	} else {
+		l = aa_label_merge(old, label, GFP_ATOMIC);
+		if (l) {
+			if (l != old) {
+				rcu_assign_pointer(ctx->peer, l);
+				aa_put_label(old);
+			} else
+				aa_put_label(l);
+		}
 	}
 	spin_unlock(&unix_sk(sk)->lock);
 }

From a20f98ffe158ea5eeb9932a3badbce267cd04917 Mon Sep 17 00:00:00 2001
From: Georgia Garcia <georgia.garcia@canonical.com>
Date: Fri, 16 Oct 2026 19:08:51 -0300
Subject: [PATCH 1850/1982] apparmor: don't revalidate inherited files under
 files->file_lock

[ Upstream commit a913281f600157aa036b7c02afbb18a0ac115187 ]

aa_inherit_files() revalidates inherited files on exec using
iterate_fd(), which calls the callback with files->file_lock held,
so the revalidation is done with IN_ATOMIC. However the unix socket
mediation path can sleep: aa_unix_file_perm() drops a ref on the
peer's path with path_put(), and unix_fs_perm() -> aa_path_perm()
allocates a buffer with aa_get_buffer(false), resulting in

  BUG: sleeping function called from invalid context at fs/dcache.c:1039
  ...
   dput.part.0+0x24/0x180
   path_put+0x2c/0x60
   aa_unix_file_perm+0x42a/0x17b0
   aa_file_perm+0xcd3/0x1060
   match_file+0x10b/0x190
   iterate_fd+0xe6/0x280
   aa_inherit_files+0x250/0x4f0

Only grab a ref on each file under iterate_fd(), and revalidate it
after the lock is dropped, so revalidation is done with no locks held
and does not need to be atomic. Denied fds are still replaced with
/dev/null, or closed if it can not be opened.

Fixes: b1aea2c19607 ("apparmor: fix race in unix socket mediation when peer_path is used")
Cc: stable@vger.kernel.org
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/file.c | 61 ++++++++++++++++++++--------------------
 1 file changed, 31 insertions(+), 30 deletions(-)

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 534a93520c5698..3176e5623d3d4b 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -691,49 +691,50 @@ static void revalidate_tty(const struct cred *subj_cred, struct aa_label *label)
 		no_tty();
 }
 
-struct cred_label {
-	const struct cred *cred;
-	struct aa_label *label;
-};
-
-static int match_file(const void *p, struct file *file, unsigned int fd)
+/*
+ * iterate_fd() callback, called with files->file_lock held: grab a ref
+ * on the next file so it can be revalidated without the lock held.
+ */
+static int get_next_file(const void *p, struct file *file, unsigned int fd)
 {
-	struct cred_label *cl = (struct cred_label *)p;
+	*(struct file **)p = get_file(file);
 
-	if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,
-			 aa_map_file_to_perms(file), IN_ATOMIC))
-		return fd + 1;
-	return 0;
+	return fd + 1;
 }
 
-
 /* based on selinux's flush_unauthorized_files */
 void aa_inherit_files(const struct cred *cred, struct files_struct *files)
 {
 	struct aa_label *label = aa_get_newest_cred_label(cred);
-	struct cred_label cl = {
-		.cred = cred,
-		.label = label,
-	};
-	struct file *devnull = NULL;
-	unsigned int n;
+	struct file *devnull = NULL, *file;
+	bool devnull_tried = false;
+	unsigned int n = 0;
 
 	revalidate_tty(cred, label);
 
-	/* Revalidate access to inherited open files. */
-	n = iterate_fd(files, 0, match_file, &cl);
-	if (!n) /* none found? */
-		goto out;
-
-	devnull = dentry_open(&aa_null, O_RDWR, cred);
-	if (IS_ERR(devnull))
-		devnull = NULL;
-	/* replace all the matching ones with this */
-	do {
+	/*
+	 * Revalidate access to inherited open files. Each file is
+	 * revalidated holding only a reference to it, with no locks
+	 * held, as revalidation may sleep (e.g. unix socket mediation
+	 * dropping path refs, or allocating path buffers).
+	 */
+	while ((n = iterate_fd(files, n, get_next_file, &file)) != 0) {
+		int error = aa_file_perm(OP_INHERIT, cred, label, file,
+					 aa_map_file_to_perms(file), false);
+
+		fput(file);
+		if (!error)
+			continue;
+		if (!devnull_tried) {
+			devnull_tried = true;
+			devnull = dentry_open(&aa_null, O_RDWR, cred);
+			if (IS_ERR(devnull))
+				devnull = NULL;
+		}
+		/* replace the denied fd (n - 1) with devnull, or close it */
 		replace_fd(n - 1, devnull, 0);
-	} while ((n = iterate_fd(files, n, match_file, &cl)) != 0);
+	}
 	if (devnull)
 		fput(devnull);
-out:
 	aa_put_label(label);
 }

From f8cd83f7b7ea7b72ccf6fc0b30ea8272207f0702 Mon Sep 17 00:00:00 2001
From: Linmao Li <lilinmao@kylinos.cn>
Date: Mon, 26 Oct 2026 09:23:45 +0800
Subject: [PATCH 1851/1982] r8152: Use BMSR to detect the link state

[ Upstream commit 85b4bc79dde77aadda0929a22f3532b208a3e1f8 ]

r8152 detects carrier from PLA_PHYSTATUS without reading BMSR, so
BMSR_LSTATUS can remain latched low after link up. Since
commit f6f2e946aa4d ("net: mii: Fix the Speed display when the network
cable is not connected"), the first speed query can then report
SPEED_UNKNOWN, which applications such as NetworkManager may cache
until the next carrier change.

Use BMSR_LSTATUS in set_carrier() so a latched link down can turn
carrier off after the link has recovered. If BMSR reports down but
PLA_PHYSTATUS reports up, reschedule the link work to read the current
state without waiting for another notification.

Tested on an RTL8153B: NetworkManager reported 1000 Mb/s after 3 of 3
rebinds, instead of an unknown speed.

Fixes: f6f2e946aa4d ("net: mii: Fix the Speed display when the network cable is not connected")
Cc: stable@vger.kernel.org
Suggested-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Hayes Wang <hayeswang@realtek.com>
Link: https://patch.msgid.link/20261026012345.1902285-1-lilinmao@kylinos.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 8cf4e81f8f882b..7b9923b6480e6e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -6785,11 +6785,8 @@ static void set_carrier(struct r8152 *tp)
 {
 	struct net_device *netdev = tp->netdev;
 	struct napi_struct *napi = &tp->napi;
-	u16 speed;
-
-	speed = rtl8152_get_speed(tp);
 
-	if (speed & LINK_STATUS) {
+	if (r8152_mdio_read(tp, MII_BMSR) & BMSR_LSTATUS) {
 		if (!netif_carrier_ok(netdev)) {
 			tp->rtl_ops.enable(tp);
 			netif_stop_queue(netdev);
@@ -6815,6 +6812,11 @@ static void set_carrier(struct r8152 *tp)
 			tasklet_enable(&tp->tx_tl);
 			netif_info(tp, link, netdev, "carrier off\n");
 		}
+
+		if (rtl8152_get_speed(tp) & LINK_STATUS) {
+			set_bit(RTL8152_LINK_CHG, &tp->flags);
+			schedule_delayed_work(&tp->schedule, 0);
+		}
 	}
 }
 

From 0aba8e759cfcdc6242348dc82b97c96405f90762 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Thu, 8 Oct 2026 09:33:33 +0000
Subject: [PATCH 1852/1982] mount: refuse setns() with a shared fs_struct again

[ Upstream commit 948e604aca8af30490accf7d46d44814ffa26f80 ]

mntns_install() refuses to switch the mount namespace of a task that
shares its fs_struct, since root and cwd of the others would move to a
namespace they are not in.  It looks at nsset->fs for that.  If more
than the mount namespace is asked for, that is a private copy made by
prepare_nsset(), which has one user by definition; commit_nsset() then
writes root and cwd of the copy to the fs_struct of the task.

A thread of a process with two threads, pidfd of a task in another
mount namespace:

	setns(pidfd, CLONE_NEWNS)			-EINVAL
	setns(pidfd, CLONE_NEWNS | CLONE_NEWUTS)	0

and after the second call the other thread, still in the old mount
namespace, has lost its cwd (/tmp became /) and sees the mounts of the
other namespace under /.

Look at the fs_struct that is going to be changed.  The second call then
fails with -EINVAL like the first one.

Fixes: 303cc571d107 ("nsproxy: attach to namespaces via pidfds")
Cc: stable@vger.kernel.org # v5.8+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index bb73b317f9e72a..34e0d14c454baf 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -6376,7 +6376,7 @@ static int mntns_install(struct nsset *nsset, struct ns_common *ns)
 	if (is_anon_ns(mnt_ns))
 		return -EINVAL;
 
-	if (fs->users != 1)
+	if (current->fs->users != 1)
 		return -EINVAL;
 
 	get_mnt_ns(mnt_ns);

From 24705093eeb28c70f56ea509d9110e802435b1b8 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Mon, 26 Oct 2026 21:53:29 +0100
Subject: [PATCH 1853/1982] userns: don't drop the exec securebits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bf5ba73c9bdd5e872eb35e801e429a3b526f8f04 ]

SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE tell script
interpreters to only run what AT_EXECVE_CHECK allows and to refuse
interactive input. A service manager sets them together with their lock
bits so that nothing below it can turn them off again.

But set_cred_user_ns() resets all securebits to SECUREBITS_DEFAULT. So
any task that can create a user namespace sheds the locked exec bits
with a single unshare(CLONE_NEWUSER) and joining one with setns() does
the same. The lock is pointless if anyone who may create a user
namespace can drop it, and that is pretty much everyone.

Resetting the other bits is fine. They are about how capabilities are
computed and a new user namespace starts out with a full set of
capabilities anyway. The exec bits grant nothing though. They are
restrictions a task placed on itself, just like no_new_privs which a
user namespace doesn't touch either. So keep them and their locks.

Reproducer:

  // SPDX-License-Identifier: GPL-2.0
  /* Lock the exec securebits, then create a user namespace and look at them again. */
  #define _GNU_SOURCE
  #include <sched.h>
  #include <stdio.h>
  #include <sys/prctl.h>

  #define SECBIT_EXEC_RESTRICT_FILE		(1 << 8)
  #define SECBIT_EXEC_RESTRICT_FILE_LOCKED	(1 << 9)
  #define SECBIT_EXEC_DENY_INTERACTIVE		(1 << 10)
  #define SECBIT_EXEC_DENY_INTERACTIVE_LOCKED	(1 << 11)

  int main(void)
  {
  	int bits = SECBIT_EXEC_RESTRICT_FILE | SECBIT_EXEC_RESTRICT_FILE_LOCKED |
  		   SECBIT_EXEC_DENY_INTERACTIVE | SECBIT_EXEC_DENY_INTERACTIVE_LOCKED;

  	if (prctl(PR_SET_SECUREBITS, bits, 0, 0, 0)) {
  		perror("PR_SET_SECUREBITS");
  		return 1;
  	}
  	printf("before: 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
  	printf("clear locked bits: %s\n", prctl(PR_SET_SECUREBITS, 0, 0, 0, 0) ? "refused" : "ALLOWED");

  	if (unshare(CLONE_NEWUSER)) {
  		perror("unshare(CLONE_NEWUSER)");
  		return 1;
  	}
  	printf("after unshare(CLONE_NEWUSER): 0x%x\n", prctl(PR_GET_SECUREBITS, 0, 0, 0, 0));
  	return 0;
  }

On v7.1 this prints "before: 0xf00", "clear locked bits: refused" and
"after unshare(CLONE_NEWUSER): 0x0". With this patch the last line
reads 0xf00 as well.

Fixes: a0623b2a1d59 ("security: Add EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits")
Cc: stable@vger.kernel.org # v6.14+
Link: https://patch.msgid.link/20261026-work-securebits-userns-v1-1-b35473fa1a34@kernel.org
Reviewed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/userspace-api/check_exec.rst | 4 ++++
 kernel/user_namespace.c                    | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/Documentation/userspace-api/check_exec.rst b/Documentation/userspace-api/check_exec.rst
index 05dfe3b56f711f..0904810e1d8d9c 100644
--- a/Documentation/userspace-api/check_exec.rst
+++ b/Documentation/userspace-api/check_exec.rst
@@ -99,6 +99,10 @@ This secure bit may be set by user session managers, service managers,
 container runtimes, sandboxer tools...  Except for test environments, the
 related ``SECBIT_EXEC_DENY_INTERACTIVE_LOCKED`` bit should also be set.
 
+Both secure bits and their locks are inherited across :manpage:`fork(2)` and
+:manpage:`execve(2)`, and they are kept when a task creates or joins a user
+namespace.
+
 Here is the expected behavior for a script interpreter according to combination
 of any exec securebits:
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 03cb63883d041a..702f934e69a979 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -45,8 +45,11 @@ static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
 {
 	/* Start with the same capabilities as init but useless for doing
 	 * anything as the capabilities are bound to the new user namespace.
+	 * The exec securebits grant nothing, they are restrictions the task
+	 * placed on itself. Keep them and their locks.
 	 */
-	cred->securebits = SECUREBITS_DEFAULT;
+	cred->securebits = SECUREBITS_DEFAULT |
+		(cred->securebits & (SECURE_ALL_UNPRIVILEGED | SECURE_ALL_UNPRIVILEGED << 1));
 	cred->cap_inheritable = CAP_EMPTY_SET;
 	cred->cap_permitted = CAP_FULL_SET;
 	cred->cap_effective = CAP_FULL_SET;

From bf04f8bdd6f0065afe6997a4a2affeece2090d57 Mon Sep 17 00:00:00 2001
From: Kunhai Dai <daikunhai@didiglobal.com>
Date: Mon, 19 Oct 2026 08:54:11 -0400
Subject: [PATCH 1854/1982] blk-iocost: abort weight transfer on invalid
 donation weights

[ Upstream commit c810ee88cdab27f443c32270dc7c0eaad2cca3f8 ]

transfer_surpluses() warns and then keeps going when the donation
calculation produced invalid weights.  The following propagation can then
divide by a zero hweight_inuse, so the warning is immediately followed by a
divide error.

When the check trips, abandon this period's donation transfer and release
the walk lists.  This trades one period without donation for not crashing;
the invalid state is not expected on the normal path.

Developed with assistance from Claude Code (Anthropic): the assistant
analysed the failure path, drafted the change and ran the checks listed
below.  The author reviewed the result and remains responsible for it.

Fixes: e08d02aa5fc9 ("blk-iocost: implement Andy's method for donation weight updates")
Cc: stable@vger.kernel.org
Signed-off-by: Kunhai Dai <daikunhai@didiglobal.com>
Tested-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20261019125412.3123895-2-daikunhai@didiglobal.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-iocost.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index d0b13580c6b622..5c7cdb493768cb 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -1965,6 +1965,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now)
 			pr_cont(": active=%u donating=%u after=%u\n",
 				iocg->hweight_active, iocg->hweight_donating,
 				iocg->hweight_after_donation);
+			goto out;
 		}
 	}
 
@@ -2063,6 +2064,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now)
 		__propagate_weights(iocg, iocg->active, inuse, true, now);
 	}
 
+out:
 	/* walk list should be dissolved after use */
 	list_for_each_entry_safe(iocg, tiocg, &inner_walk, walk_list)
 		list_del_init(&iocg->walk_list);

From 594a389f90686159f4a2198f370b43fcec01fdec Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Sat, 24 Oct 2026 12:38:27 +0200
Subject: [PATCH 1855/1982] proc: don't let an entry below /proc/<pid>/net be a
 mountpoint

[ Upstream commit eeecea75ece2ba894bee4d3c53ed2e40abda8f0e ]

proc_net_d_revalidate() always returns 0 so that a dentry below
/proc/<pid>/net is never reused after setns(). So lookup_fast() will end
up calling d_invalidate(), which unhashes the dentry and detaches every
mount on it, in every mount namespace; including locked mounts.

Then lookup_slow() creates a new dentry for the same entry. So a mount
on /proc/<pid>/net/dev succeeds and goes away with the first lookup of
the name by anybody with search permission on the directory. Given it's
0555 that's everyone's grandma. A mask on such a name hides nothing as
the repro below shows.

Treat those entries like I did fd/, fdinfo/ and map_files/ and refuse to
mount on them in the first place. It's nonsensical theater otherwise:

  procnet net/dev stat

  // SPDX-License-Identifier: GPL-2.0
  /*
   * procnet: cover an entry of /proc/<pid>/ with a bind mount, lock the mount,
   * then look the name up.
   *
   * The first task stays alive, <pid> is its pid. The "container" task has its
   * own mount namespace. There it binds a mask on /proc/<pid>/<name>. It drops to
   * uid 1000 and enters a new user namespace with a new mount namespace, so that
   * the mask is locked. Then one task looks the name up:
   *
   *   stat    the container calls stat() on the name
   *   umount  the container calls umount2(MNT_DETACH) on the name
   *   nobody  a task with uid 65534 in the first namespaces calls stat()
   *
   * The container lists its mounts before and after (that does not look the
   * name up) and then reads the name. MASK is fine. Anything else means that
   * the lookup uncovered the entry.
   *
   * usage: procnet <name> stat|umount|nobody
   *   name "status" is the control, "net/dev" is a file below net, "net/stat" is
   *   a directory below net
   */
  #define _GNU_SOURCE
  #include <dirent.h>
  #include <errno.h>
  #include <fcntl.h>
  #include <sched.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <time.h>
  #include <unistd.h>
  #include <sys/mount.h>
  #include <sys/prctl.h>
  #include <sys/stat.h>
  #include <sys/wait.h>

  #define WORK "/run/pn"

  static char target[128];

  static void die(const char *what)
  {
  	fprintf(stderr, "FATAL %s: %s\n", what, strerror(errno));
  	exit(2);
  }

  static void write_str(const char *path, const char *s, int flags)
  {
  	int fd = open(path, O_WRONLY | flags, 0644);

  	if (fd < 0 || write(fd, s, strlen(s)) < 0)
  		die(path);
  	close(fd);
  }

  /* list the mounts below /proc without a lookup of the target */
  static void mounts(const char *when)
  {
  	char line[512];
  	FILE *f = fopen("/proc/self/mountinfo", "r");
  	int n = 0;

  	if (!f)
  		die("mountinfo");
  	while (fgets(line, sizeof(line), f)) {
  		if (!strstr(line, " /proc/"))
  			continue;
  		printf("container: %s: mount: %s", when, line);
  		n++;
  	}
  	fclose(f);
  	if (!n)
  		printf("container: %s: nothing is mounted below /proc\n", when);
  }

  static void show(const char *when, int isdir)
  {
  	char buf[48] = "";
  	int fd;

  	if (isdir) {
  		struct dirent *de;
  		DIR *d = opendir(target);
  		int hit = 0;

  		if (!d) {
  			printf("container: %s: opendir(%s) = %s\n", when, target, strerror(errno));
  			return;
  		}
  		printf("container: %s: readdir(%s) =", when, target);
  		while ((de = readdir(d))) {
  			if (de->d_name[0] == '.')
  				continue;
  			printf(" %s", de->d_name);
  			hit |= strcmp(de->d_name, "MASK");
  		}
  		closedir(d);
  		printf("%s\n", hit ? "   <-- HIT" : "");
  		return;
  	}
  	fd = open(target, O_RDONLY);
  	if (fd < 0) {
  		printf("container: %s: open(%s) = %s\n", when, target, strerror(errno));
  		return;
  	}
  	if (read(fd, buf, sizeof(buf) - 1) < 0)
  		die("read");
  	close(fd);
  	if (strchr(buf, '\n'))
  		*strchr(buf, '\n') = 0;
  	printf("container: %s: read(%s) = \"%s\"%s\n", when, target, buf,
  	       strncmp(buf, "MASK", 4) ? "   <-- HIT" : "");
  }

  int main(int argc, char **argv)
  {
  	const char *name = argc > 1 ? argv[1] : "net/dev";
  	const char *op = argc > 2 ? argv[2] : "stat";
  	int isdir = !strcmp(name, "net/stat");
  	int to_host[2], to_cont[2];
  	struct stat st;
  	pid_t pid;
  	char c;

  	setvbuf(stdout, NULL, _IOLBF, 0);
  	snprintf(target, sizeof(target), "/proc/%d/%s", getpid(), name);
  	if (unshare(CLONE_NEWNS) || mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL))
  		die("unshare");
  	mkdir(WORK, 0755);
  	if (mount("W", WORK, "tmpfs", 0, NULL))
  		die("mount W");
  	write_str(WORK "/mask", "MASK", O_CREAT);
  	mkdir(WORK "/maskdir", 0755);
  	write_str(WORK "/maskdir/MASK", "MASK", O_CREAT);
  	if (pipe(to_host) || pipe(to_cont))
  		die("pipe");

  	pid = fork();
  	if (pid < 0)
  		die("fork");
  	if (!pid) {
  		if (unshare(CLONE_NEWNS))
  			die("container unshare");
  		if (mount(isdir ? WORK "/maskdir" : WORK "/mask", target, NULL, MS_BIND, NULL)) {
  			printf("container: bind the mask on %s: %s\n", target, strerror(errno));
  			exit(0);
  		}
  		printf("container: bind the mask on %s: ok\n", target);
  		if (setgid(1000) || setuid(1000) || prctl(PR_SET_DUMPABLE, 1))
  			die("setuid");
  		/* lock the mount: a new user namespace with a copy of the tree */
  		if (unshare(CLONE_NEWUSER | CLONE_NEWNS))
  			die("container userns");
  		write_str("/proc/self/setgroups", "deny", 0);
  		write_str("/proc/self/uid_map", "0 1000 1", 0);
  		write_str("/proc/self/gid_map", "0 1000 1", 0);
  		mounts("before");
  		errno = 0;
  		if (!strcmp(op, "stat")) {
  			stat(target, &st);
  			printf("container: stat(%s): %s\n", target, strerror(errno));
  		} else if (!strcmp(op, "umount")) {
  			umount2(target, MNT_DETACH);
  			printf("container: umount2(%s, MNT_DETACH): %s\n", target, strerror(errno));
  		} else if (write(to_host[1], "g", 1) != 1 || read(to_cont[0], &c, 1) != 1) {
  			die("sync");
  		}
  		mounts("after");
  		show("after", isdir);
  		exit(0);
  	}
  	close(to_host[1]);
  	if (read(to_host[0], &c, 1) == 1) {
  		pid_t p2 = fork();

  		if (!p2) {
  			if (setgid(65534) || setuid(65534))
  				die("setuid");
  			errno = 0;
  			stat(target, &st);
  			printf("nobody: uid %u: stat(%s): %s\n", getuid(), target, strerror(errno));
  			exit(0);
  		}
  		waitpid(p2, NULL, 0);
  		if (write(to_cont[1], "g", 1) != 1)
  			die("sync");
  	}
  	waitpid(pid, NULL, 0);
  	return 0;
  }

Fixes: 1fde6f21d90f ("proc: fix /proc/net/* after setns(2)")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261024-work-procfs-fixes-v1-1-46b03c3a8fac@kernel.org
Acked-by: Jan Kara <jack@suse.cz>
Reviewed-by: Aleksa Sarai <aleksa@amutable.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/generic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 12b817f4ffcfd7..b63f612d5ebf23 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -256,9 +256,10 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
 		inode = proc_get_inode(dir->i_sb, de);
 		if (!inode)
 			return ERR_PTR(-ENOMEM);
+		/* never reused and so never a mountpoint for long */
 		if (de->flags & PROC_ENTRY_FORCE_LOOKUP)
-			return d_splice_alias_ops(inode, dentry,
-						  &proc_net_dentry_ops);
+			return proc_splice_unmountable(inode, dentry,
+						       &proc_net_dentry_ops);
 		return d_splice_alias_ops(inode, dentry,
 					  &proc_misc_dentry_ops);
 	}

From f021ba9c6f5e60560a040a54d22df166106941fb Mon Sep 17 00:00:00 2001
From: Zhiling Zou <zhilinz@nebusec.ai>
Date: Tue, 27 Oct 2026 12:46:49 +0800
Subject: [PATCH 1856/1982] tcp: check congestion control restriction first

[ Upstream commit dda51b73721684637ab8e9bd97c78228b99c4bd2 ]

tcp_set_default_congestion_control() takes a reference to an algorithm
before checking whether a non-init network namespace may select it. A
rejected request returns -EPERM without dropping the reference.

This affects module-backed algorithms too; BPF is not required. For
example, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a
non-init network namespace can repeatedly request it as the default
although it is not in tcp_allowed_congestion_control. Each rejected
write leaks a module reference. Since module->refcnt is an atomic_t,
2^31 such writes can make it negative; later module_put() calls warn,
and rmmod can hit the BUG_ON() in try_release_module_ref().

Check the namespace restriction before acquiring the reference, as
tcp_set_congestion_control() already does.

Fixes: 8d432592f30f ("net: Only allow init netns to set default tcp cong to a restricted algo")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Suggested-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/71c142b2d45af6a2fe7fc6cd4a5ca52c53afbe23.1793075984.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_cong.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 8e83ef81fc187d..e3f462f161dd6c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -288,12 +288,12 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
 	ca = tcp_ca_find_autoload(name);
 	if (!ca) {
 		ret = -ENOENT;
-	} else if (!bpf_try_module_get(ca, ca->owner)) {
-		ret = -EBUSY;
 	} else if (!net_eq(net, &init_net) &&
 			!(ca->flags & TCP_CONG_NON_RESTRICTED)) {
 		/* Only init netns can set default to a restricted algorithm */
 		ret = -EPERM;
+	} else if (!bpf_try_module_get(ca, ca->owner)) {
+		ret = -EBUSY;
 	} else {
 		prev = xchg(&net->ipv4.tcp_congestion_control, ca);
 		if (prev)

From 8c054c71d47d19472d2aa2efbae89d2c85e0b7cf Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Tue, 20 Oct 2026 16:00:30 -0700
Subject: [PATCH 1857/1982] apparmor: fix refcount leak in
 aa_get_newest_profile()

[ Upstream commit 33ed50716251d5b2875706c40d0c8082d46be0b1 ]

The labels_profile() macro is evaluating its argument twice

  #define labels_profile(X) ((X)->vec[(X)->size - 1])

unfortunately aa_get_newest_profile() passes
   aa_get_newest_label(&p->label)
so every call to aa_get_newest_profile results in 2 refcounts
being taken with one being leaked.

There is no need for labels_profile() to be a macro. Convert it to
an inline fn, which ensures all uses are passing the correct struct
and removes the double evaluation.

Fixes: 637f688dc3dc ("apparmor: switch from profiles to using labels on contexts")
Cc: stable@vger.kernel.org
Reported-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/include/label.h | 6 +++++-
 security/apparmor/label.c         | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 574be681f83e98..75c49e713a7497 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -162,7 +162,11 @@ do {							\
 #define labels_ns(X) (vec_ns(&((X)->vec[0]), (X)->size))
 #define labels_set(X) (&labels_ns(X)->labels)
 #define labels_view(X) labels_ns(X)
-#define labels_profile(X) ((X)->vec[(X)->size - 1])
+
+static inline struct aa_profile *labels_profile(const struct aa_label *label)
+{
+	return label->vec[label->size - 1];
+}
 
 
 int aa_label_next_confined(struct aa_label *l, int i);
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 5c42cd01ea473e..667f20363ebf14 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -386,7 +386,6 @@ void aa_label_kref(struct kref *kref)
 		label_free_switch(label);
 		return;
 	}
-	/* TODO: update labels_profile macro so it works here */
 	AA_BUG(label_isprofile(label) &&
 	       on_list_rcu(&label->vec[0]->base.profiles));
 	AA_BUG(label_isprofile(label) &&

From 4971c6f821ff06a01c0779d0b1f9d0fd6452e3fe Mon Sep 17 00:00:00 2001
From: Li RongQing <lirongqing@baidu.com>
Date: Thu, 8 Oct 2026 11:15:33 +0800
Subject: [PATCH 1858/1982] apparmor: avoid potential double free when
 remapping DFA tables

[ Upstream commit 7ccd884a5e5386f4c7d98625113f4924f70286b4 ]

When unpacking a DFA, aa_dfa_unpack() stores a table in dfa->tables
before attempting to remap a 16-bit table to 32-bit.

However, remap_data16_to_data32() frees the original table when
allocation of the new table fails. This leaves the corresponding
dfa->tables entry pointing to freed memory. If the unpacking then
fails, dfa_free() attempts to free the same table again.

Only publish the table to dfa->tables after any required remapping
has completed successfully, so that dfa->tables never contains a
pointer to a table that has already been freed.

Fixes: 9208c05f9fdf ("apparmor: add support for 2^24 states to the dfa state machine.")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/match.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index b2a4bee4e3939c..e4ef1057e2c06f 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -397,7 +397,6 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
 		/* check for duplicate table entry */
 		if (dfa->tables[table->td_id])
 			goto fail;
-		dfa->tables[table->td_id] = table;
 		data += table_size(table->td_lolen, table->td_flags);
 		size -= table_size(table->td_lolen, table->td_flags);
 
@@ -414,9 +413,9 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
 				if (!table)
 					goto fail;
 			}
-			dfa->tables[table->td_id] = table;
 			break;
 		}
+		dfa->tables[table->td_id] = table;
 		table = NULL;
 	}
 	error = verify_table_headers(dfa->tables, flags);

From e5b1fefc2dcd8951874be43f409c8a61f574f6d9 Mon Sep 17 00:00:00 2001
From: Guanglei Zhu <zhugl3@xiaopeng.com>
Date: Wed, 16 Sep 2026 19:53:07 +0800
Subject: [PATCH 1859/1982] apparmor: check accept index + 1 is in bounds

[ Upstream commit afe5d5a747393cb3d00795db31d7fce5108a766a ]

aa_lookup_condperms() returns perms[index + 1] when an accept entry has
ACCEPT_FLAG_OWNER set and the subject uid does not match the file uid,
so such an entry consumes two slots in the perms table.  But
verify_dfa_accept_index() only checks that index is within the perms
table, so a policy that sets the owner flag on the last entry is
accepted, and the runtime lookup then reads perms[index + 1] one entry
past the end of the table.

The perms table is allocated by unpack_perms_table() with a u16 size
read from the policy blob, so a crafted policy can place the owner flag
at index size - 1 to reach the out-of-bounds read.

Check that index + 1 is also in bounds when the owner flag is set.

Fixes: 6f442d42c0d89 ("apparmor: fix profile verification and enable it")
Cc: stable@vger.kernel.org
Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/policy_unpack.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 1e1792d3ff5a46..391665c27ede1b 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1244,6 +1244,15 @@ static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
 	for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
 		if (ACCEPT_TABLE(dfa)[i] >= table_size)
 			return false;
+		/*
+		 * Accept indexes for owner-conditional permissions come in
+		 * pairs, so the non-owner entry at index + 1 must also be
+		 * in bounds.
+		 */
+		if (dfa->tables[YYTD_ID_ACCEPT2] &&
+		    (ACCEPT_TABLE2(dfa)[i] & ACCEPT_FLAG_OWNER) &&
+		    ACCEPT_TABLE(dfa)[i] + 1 >= table_size)
+			return false;
 	}
 	return true;
 }

From 7d6eccadf776e56f13873b1b8de4e7583b51fc02 Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Wed, 28 Oct 2026 19:14:50 +0100
Subject: [PATCH 1860/1982] net/packet: check TX_RING fragments before memory
 accounting

[ Upstream commit dc4dd12f80e499dc034710cd8195489abcf0b059 ]

tpacket_fill_skb() adds the full non-linear payload length to
skb->truesize and sk_wmem_alloc before checking MAX_SKB_FRAGS. With
PACKET_VNET_HDR, userspace can submit a ring-sized frame even when it
greatly exceeds the device MTU.

A near-INT_MAX frame can saturate sk_wmem_alloc before the fragment
loop rejects it. A subsequent refcount_add(0x40000001) can temporarily
turn REFCOUNT_SATURATED into 1. A concurrent TX completion can then
drop that apparent last reference and free the still-live packet
socket before refcount_warn_saturate() restores the counter.

Check that the remaining payload fits in MAX_SKB_FRAGS pages before
accounting it. Include the initial page offset in the calculation,
and move the existing -EFAULT handling out of the fragment loop.
This preserves the accepted packet sizes and error code while
preventing an invalid frame from injecting an oversized byte charge.

Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
Cc: stable@vger.kernel.org
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
[edumazet: use net_warn_ratelimited() instead of pr_err(), add a Fixes: tag]
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261028181450.2221013-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4516e54525223a..7b8ba1690d543e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2646,6 +2646,12 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	}
 
 	offset = offset_in_page(data);
+	if (unlikely(to_write > MAX_SKB_FRAGS * PAGE_SIZE - offset)) {
+		net_warn_ratelimited("Packet exceed the number of skb frags(%u)\n",
+				     (unsigned int)MAX_SKB_FRAGS);
+		return -EFAULT;
+	}
+
 	len_max = PAGE_SIZE - offset;
 	len = ((to_write > len_max) ? len_max : to_write);
 
@@ -2657,12 +2663,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	while (likely(to_write)) {
 		nr_frags = skb_shinfo(skb)->nr_frags;
 
-		if (unlikely(nr_frags >= MAX_SKB_FRAGS)) {
-			pr_err("Packet exceed the number of skb frags(%u)\n",
-			       (unsigned int)MAX_SKB_FRAGS);
-			return -EFAULT;
-		}
-
 		page = pgv_to_page(data);
 		data += len;
 		flush_dcache_page(page);

From 464df36ba29d68bfab38d19c18127fdcebeb5a3f Mon Sep 17 00:00:00 2001
From: Kyle Zeng <kylebot@openai.com>
Date: Wed, 28 Oct 2026 17:02:26 +0100
Subject: [PATCH 1861/1982] tcp: fix reordering addition overflow in MTU
 probing

[ Upstream commit c1df9c0c0536393de43310f84ca4f8b217271a00 ]

Commit efb8763d7bbb ("net: ipv4: bound TCP reordering sysctl writes and
MTU probe sizes") widened size_needed and the MSS multiplication, but
tp->reordering + 1 is still evaluated as u32. RTAX_REORDERING accepts
an unrestricted u32, and tcp_init_metrics() can install U32_MAX.

In that case the extra-data requirement becomes zero. A write queue
with probe_size - 1 data bytes and a FIN satisfies the sequence-space
check. The coalescing walk can pass the queue head to
tcp_skb_can_collapse(), and tcp_clone_payload() can produce an skb
whose advertised payload exceeds the data in its fragments. Local
delivery followed by TCP_ZEROCOPY_RECEIVE can then walk beyond the
fragment array. KASAN reports a slab-out-of-bounds read in
can_map_frag().

Cast reordering before incrementing it so the arithmetic handles the
entire u32 metric range. For U32_MAX, the required size exceeds the
32-bit queue and window limits, so the existing checks skip the probe.
The calculation is unchanged for all other reordering values.

Fixes: efb8763d7bbb ("net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes")
Cc: stable@vger.kernel.org
Cc: Wyatt Feng <bronzed_45_vested@icloud.com>
Cc: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20261028160226.2170244-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f6210d4a3408ff..b39ab081e3a66e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2631,7 +2631,7 @@ static int tcp_mtu_probe(struct sock *sk)
 	mss_now = tcp_current_mss(sk);
 	probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
 				    icsk->icsk_mtup.search_low) >> 1);
-	size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache;
+	size_needed = probe_size + ((u64)tp->reordering + 1) * tp->mss_cache;
 	interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
 	/* When misfortune happens, we are reprobing actively,
 	 * and then reprobe timer has expired. We stick with current

From a08cef6d1aead92a85dea5a8b7a826b4355d0303 Mon Sep 17 00:00:00 2001
From: Georgia Garcia <georgia.garcia@canonical.com>
Date: Wed, 14 Oct 2026 19:08:20 -0300
Subject: [PATCH 1862/1982] apparmor: remove fs entries created by a failed
 policy load

[ Upstream commit 6ec46f8f1977d218bf2494ce276152b2d01424af ]

aa_replace_profiles() creates the raw_data/<rev> directory for the
loaddata and the profile directories for new profiles before the last
checks that can fail. When one of those checks fails, the fail path
releases the ns lock without removing what this load created.

The raw_data directory is named after the current ns revision, and the
revision is only bumped by a successful load. The stale directory is
only removed once the loaddata's last profile reference is dropped, from
a workqueue. Until then, every load fails to create raw_data/<rev> with
-EEXIST. If the new profiles are never freed, which is the case when
their dents are left behind pinning the proxy, that never happens and no
policy can be loaded until reboot.

While still holding the ns lock in the fail path, remove the profile
directories of the new profiles and, if this load created it, the
raw_data directory.

Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Cc: stable@vger.kernel.org
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/policy.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 70d6315a059afe..14c91fc94b22e1 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1163,6 +1163,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 	struct aa_loaddata *rawdata_ent;
 	const char *op;
 	ssize_t count, error;
+	bool rawdata_created = false;
 	LIST_HEAD(lh);
 
 	op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
@@ -1302,6 +1303,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 			ent = NULL;
 			goto fail_lock;
 		}
+		rawdata_created = true;
 	}
 	list_for_each_entry(ent, &lh, list) {
 		if (!ent->old) {
@@ -1397,6 +1399,18 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 	return udata_sz;
 
 fail_lock:
+	/*
+	 * Remove fs entries created by this load. Nothing else references
+	 * them yet, and leaving them behind would leak the new profiles
+	 * (their dents pin the proxy) and make the next load at the same,
+	 * unbumped ns revision fail with -EEXIST on its raw_data dir.
+	 */
+	list_for_each_entry(tmp, &lh, list) {
+		if (!tmp->old)
+			__aafs_profile_rmdir(tmp->new);
+	}
+	if (rawdata_created)
+		__aa_fs_remove_rawdata(udata);
 	mutex_unlock(&ns->lock);
 
 	/* audit cause of failure */

From 7d0e4a0f1aedaa81250538b9c115a4ba53d69f1f Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Thu, 29 Oct 2026 15:00:20 +0100
Subject: [PATCH 1863/1982] aio: fix NULL deref when a fault races ring
 truncation

[ Upstream commit d53b5aa5cfae27e4d236fc0ab9581085d27f7d33 ]

The aio ring lives in a file on the aio pseudo filesystem and the ring
VMA uses filemap_fault(). aio_ctx_aops doesn't have a ->read_folio
because aio_setup_ring() puts all folios of the ring into the page
cache. So a fault on the ring only works as long as it finds its folio
in the page cache. If it doesn't, filemap_fault() calls ->read_folio
without checking and we jump to NULL.

We already fixed this twice this year. A forked child could inherit the
ring mapping, fixed by commit c03ce4173c7b ("fs: aio: set
VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error"). And a
partial mremap() could leave part of the ring mapped, fixed by
commit 3adf7ae18bf4 ("fs: aio: reject partial mremap to avoid
Null-pointer-dereference error"). Both times a VMA outlived the ring and
the ring file was truncated under it.

There's a third way to get there. kill_ioctx() and the error path of
ioctx_alloc() unmap the ring with vm_munmap() and ignore the return
value. If vm_munmap() has to wait for mmap_lock and a fatal signal is
pending it returns -EINTR and the VMA stays. free_ioctx() then calls
put_aio_ring_file() which truncates the ring file to zero. A fault that
passed the i_size check in filemap_fault() before that doesn't find its
folio anymore, allocates a new one and calls ->read_folio:

    fault on the ring                 io_destroy() with SIGKILL pending
    =================                 =================================
                                      vm_munmap() returns -EINTR
    filemap_fault()
      i_size check passes
                                      free_ioctx()
                                        put_aio_ring_file()
                                          truncate_setsize(inode, 0)
      no folio, allocate a new one
      filemap_read_folio()
        ->read_folio == NULL

All that's needed is a second process that shares the mm. If a CLONE_VM
child calls io_destroy() and gets SIGKILLed while it waits for mmap_lock
the ring stays mapped for the threads of the parent. Any user can do
that.

Instead of plugging the routes one by one give the ring a ->read_folio
that unlocks the folio and returns -EIO. All folios of a live ring are
in the page cache so a fault can only end up there if the ring was
truncated. The fault now gets SIGBUS. Nothing else reads the ring file
and the aio filesystem uses noop_backing_dev_info so there's no
readahead either.

Making vm_munmap() unkillable in those two places would only close this
one route and bring back what commit ae7987835643 ("mm: make vm_munmap
killable") fixed.

Fixes: 36bc08cc0170 ("fs/aio: Add support to aio ring pages migration")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-1-88f22792f6f7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/aio.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/aio.c b/fs/aio.c
index bd92bd3e13408e..e06fa57b05ca9d 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -474,7 +474,18 @@ static int aio_migrate_folio(struct address_space *mapping, struct folio *dst,
 #define aio_migrate_folio NULL
 #endif
 
+/*
+ * filemap_fault() reads a folio that it did not find in the page cache. All
+ * folios of a live ring are there, so the ring was truncated under the fault.
+ */
+static int aio_read_folio(struct file *file, struct folio *folio)
+{
+	folio_unlock(folio);
+	return -EIO;
+}
+
 static const struct address_space_operations aio_ctx_aops = {
+	.read_folio	= aio_read_folio,
 	.dirty_folio	= noop_dirty_folio,
 	.migrate_folio	= aio_migrate_folio,
 };

From 4a70894450cb4d0d5308a9b831e30a8fe0a5a156 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Thu, 29 Oct 2026 15:00:21 +0100
Subject: [PATCH 1864/1982] backing-file: enforce append-only and immutable
 backing inodes

[ Upstream commit 19b18e01d0361ce495be153ecce80b581086ab3f ]

FUSE passthrough opens the backing file anew whenever the FUSE file is
opened. fuse_passthrough_open() passes the flags of that open to
backing_file_open() which opens the backing file with vfs_open() and the
credentials of the server. But vfs_open() doesn't go through may_open().
So the backing inode is never checked for S_APPEND and S_IMMUTABLE. The
checks that did run were done on the FUSE inode and that one never has
either flag.

So anyone who may open the FUSE file for writing can overwrite an
append-only backing file anywhere or write to an immutable one. The
server only has to register the file and a read-only or even an O_PATH
file descriptor is enough for that. Registering requires CAP_SYS_ADMIN
but the writer can be any user that the server lets open the file.

The FUSE inode is checked instead of the backing inode in a few more
places:

- do_mmap() refuses a shared mapping of an append-only file that was
  opened for writing. A FUSE file opened with O_RDWR | O_APPEND passes
  the open check and can then be mapped shared and written to at any
  offset.

- fcntl(F_SETFL) and RWF_NOAPPEND refuse to take append mode away from a
  file on an append-only inode. On the FUSE file both succeed. A
  synchronous write still appends because the backing file was opened
  with O_APPEND. But an asynchronous write is submitted with the flags
  of the user's kiocb and lands at the given offset.

Do the checks on the backing inode. backing_file_open() refuses to open
an immutable inode for writing and an append-only inode for writing
without O_APPEND, just like may_open(). backing_file_mmap() refuses a
shared mapping of an append-only inode, just like do_mmap(). And writes
and splices to a backing file in append mode fail if append mode was
taken away from the user file.

A FUSE file that was opened before the backing file became append-only
can still write anywhere. That's what happens on the native filesystem
as well and the backing file of such a file isn't in append mode. Two
differences remain. F_SETFL succeeds and the next write fails. And FUSE
reports EIO for a refused open because it turns every error from opening
the backing file into EIO.

overlayfs uses the same helpers but it mirrors S_APPEND and S_IMMUTABLE
in its own inode and a chattr through the overlay never sets them on the
upper inode. So for overlayfs this only changes something if the upper
inode is changed behind the overlay's back.

Fixes: 4a90451bbc7f ("fuse: implement open in passthrough mode")
Reported-by: Chris Mason <mason@kernel.org>
Cc: stable@vger.kernel.org # v6.9+
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-2-88f22792f6f7@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/backing-file.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/fs/backing-file.c b/fs/backing-file.c
index 6f16e23f704613..5cca636207d1aa 100644
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -35,9 +35,21 @@ struct file *backing_file_open(const struct file *user_file, int flags,
 			       const struct cred *cred)
 {
 	const struct path *user_path = file_user_path(user_file);
+	struct inode *real_inode = d_inode(real_path->dentry);
 	struct file *f;
 	int error;
 
+	/*
+	 * may_open() checked the inode of the user file, which need not carry
+	 * S_APPEND and S_IMMUTABLE of the backing inode.
+	 */
+	if ((flags & O_ACCMODE) != O_RDONLY) {
+		if (IS_IMMUTABLE(real_inode))
+			return ERR_PTR(-EPERM);
+		if (IS_APPEND(real_inode) && !(flags & O_APPEND))
+			return ERR_PTR(-EPERM);
+	}
+
 	f = alloc_empty_backing_file(flags, cred, user_file);
 	if (IS_ERR(f))
 		return f;
@@ -222,6 +234,14 @@ ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter,
 	if (!iov_iter_count(iter))
 		return 0;
 
+	/*
+	 * F_SETFL and RWF_NOAPPEND can take append mode away from the user
+	 * file. They checked its inode, not the backing one.
+	 */
+	if ((file->f_flags & O_APPEND) && !(flags & IOCB_APPEND) &&
+	    IS_APPEND(file_inode(file)))
+		return -EPERM;
+
 	ret = file_remove_privs(iocb->ki_filp);
 	if (ret)
 		return ret;
@@ -309,6 +329,10 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe,
 	if (!out->f_op->splice_write)
 		return -EINVAL;
 
+	/* splice refuses a user file in append mode, so F_SETFL cleared it */
+	if ((out->f_flags & O_APPEND) && IS_APPEND(file_inode(out)))
+		return -EPERM;
+
 	ret = file_remove_privs(iocb->ki_filp);
 	if (ret)
 		return ret;
@@ -339,6 +363,10 @@ int backing_file_mmap(struct file *file, struct vm_area_struct *vma,
 	if (!can_mmap_file(file))
 		return -ENODEV;
 
+	/* do_mmap() checked the inode of the user file */
+	if ((vma->vm_flags & VM_SHARED) && IS_APPEND(file_inode(file)))
+		return -EACCES;
+
 	vma_set_file(vma, file);
 
 	old_cred = override_creds(ctx->cred);

From 325b62c95822975a65fe5d0c70e106a68f1ee700 Mon Sep 17 00:00:00 2001
From: Chris Mason <mason@kernel.org>
Date: Thu, 29 Oct 2026 15:00:22 +0100
Subject: [PATCH 1865/1982] iov_iter: fix NULL deref in iov_iter_alignment()

[ Upstream commit a290a9e5cf5fbba05d6c59b94b36d00f4fc15ef2 ]

Since commit 111a12b422a8 ("io_uring/rsrc: reject zero-length fixed
buffer import") io_import_fixed() hands out an empty ITER_BVEC for a
zero-length request. Its count is 0 and its bvec array is NULL.

iov_iter_alignment() only checks the count for ITER_UBUF. For ITER_BVEC
it calls iov_iter_alignment_bvec() and the do-while loop in there reads
bvec->bv_len before it looks at the count. So it dereferences NULL.

btrfs checks the alignment of a direct read with iov_iter_alignment()
before it looks at the count and f2fs does the same. So any user that
can open a file on btrfs can oops the kernel with a single zero-length
IORING_OP_READ_FIXED on an O_DIRECT file descriptor. With IOSQE_ASYNC
the oops happens in an io-wq worker. The dead worker stays on the worker
list and when the task that submitted the request exits io-wq writes to
the freed task_struct of the worker. That's just fallout from the oops
though.

Empty iterators with a NULL array aren't unusual. afs, tls and tipc
create them as well. So leave io_uring alone and make
iov_iter_alignment() return 0 for an empty iterator of any type.

Fixes: 111a12b422a8 ("io_uring/rsrc: reject zero-length fixed buffer import")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
Link: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-3-88f22792f6f7@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/iov_iter.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 4bc7c19337558f..b2eb629497a922 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -836,6 +836,10 @@ unsigned long iov_iter_alignment(const struct iov_iter *i)
 		return 0;
 	}
 
+	/* An empty iterator may have no segment array at all. */
+	if (!i->count)
+		return 0;
+
 	/* iovec and kvec have identical layouts */
 	if (likely(iter_is_iovec(i) || iov_iter_is_kvec(i)))
 		return iov_iter_alignment_iovec(i);

From 8bceb60345446206ddaa648020e5bbff65409af8 Mon Sep 17 00:00:00 2001
From: Daehyeon Ko <4ncienth@gmail.com>
Date: Sun, 18 Oct 2026 14:17:08 +0900
Subject: [PATCH 1866/1982] splice: avoid stale f_pos writeback on error

[ Upstream commit 79b496ebe382866e3a05090b7dc9ae95e85e65b2 ]

do_splice() snapshots an implicit file position before calling the splice
helper. Since splice does not take f_pos_lock, another operation on the
same open file description can update f_pos while the helper is blocked.
If the helper then fails, the unconditional writeback restores the stale
snapshot.

For a directory without ->splice_read, a file-to-pipe splice fails with
-EINVAL. A concurrent directory mutation and getdents() call can advance
f_pos and refresh the filesystem's revalidation cookie before that failure
restores only the old position. The next ext2 readdir can then trust an
offset inside a directory entry and copy data from the adjacent page to
userspace.

Only update an implicit file position when splice returns a non-negative
result, matching read and write. Keep explicit offset updates unchanged.

Fixes: 7995bd287134 ("splice: don't pass the address of ->f_pos to methods")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20261018051708.2422394-1-4ncienth@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/splice.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/splice.c b/fs/splice.c
index f5094b6d00a09f..8ac45441e2193e 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1351,10 +1351,10 @@ ssize_t do_splice(struct file *in, loff_t *off_in, struct file *out,
 		ret = do_splice_from(ipipe, out, &offset, len, flags);
 		file_end_write(out);
 
-		if (!off_out)
-			out->f_pos = offset;
-		else
+		if (off_out)
 			*off_out = offset;
+		else if (ret >= 0)
+			out->f_pos = offset;
 	} else if (opipe) {
 		if (off_out)
 			return -ESPIPE;
@@ -1375,10 +1375,10 @@ ssize_t do_splice(struct file *in, loff_t *off_in, struct file *out,
 
 		ret = splice_file_to_pipe(in, opipe, &offset, len, flags);
 
-		if (!off_in)
-			in->f_pos = offset;
-		else
+		if (off_in)
 			*off_in = offset;
+		else if (ret >= 0)
+			in->f_pos = offset;
 	} else {
 		ret = -EINVAL;
 	}

From 0da582bda88a6b0621aa9c6305354a14244bd922 Mon Sep 17 00:00:00 2001
From: Edvard Conrad <edvard@tuta.io>
Date: Thu, 29 Oct 2026 22:18:40 +0100
Subject: [PATCH 1867/1982] fs: let backing files inherit FMODE_NONOTIFY from
 the user file

[ Upstream commit c3d355f427cea70fbe31b49e21f1915dbf37f2e6 ]

When fanotify reports a permission event, copy_event_to_user() creates
the event fd with dentry_open_nonotify(), so that the listener's use of
that fd does not generate further events. If the event's path is on a
stacked filesystem, the stacked filesystem's ->open() opens the real
file with backing_file_open(). Since commit ebe559609d78 ("fs: get rid
of __FMODE_NONOTIFY kludge"), FMODE_NONOTIFY lives in f_mode only and
the backing file does not inherit it: it is allocated with the default
fsnotify mode, and fsnotify_open_perm_and_set_mode() raises FS_OPEN_PERM
on the real path if the backing filesystem has permission event
watchers.

Before that commit __FMODE_NONOTIFY travelled in f_flags, and overlayfs
copies the user file's f_flags into the backing open
(ovl_open_realfile()), so the backing file was exempt implicitly. Commit
bc2473c90fca ("ovl: enable fsnotify events on underlying real files")
relied on that when it dropped FMODE_NONOTIFY from OVL_OPEN_FLAGS.

The nested event is queued to the same group, from inside the
listener's read(2), and can only be answered by another reader thread
of that group. A listener holding filesystem marks on both the stacked
and the backing filesystem therefore deadlocks as soon as all of its
reader threads are inside such a read(2) at the same time, and every
other task that touches a marked filesystem queues up behind it.

Observed with a commercial anti-malware agent (16 reader threads) on an
ostree/composefs host: / is an overlayfs whose data layer is the ostree
object store on the same btrfs that holds /etc and /home, and a
systemd-sysext overlay sits on /usr. Every on-demand scan of /usr wedged
the whole machine until the group was killed. Stack of a blocked reader
thread on 7.2.7:

  fanotify_get_response
  fanotify_handle_event
  send_to_group
  fsnotify
  __fsnotify_parent
  do_dentry_open
  vfs_open
  backing_file_open
  ovl_open_realfile [overlay]
  ovl_open [overlay]
  do_dentry_open
  vfs_open
  backing_file_open
  ovl_open_realfile [overlay]
  ovl_open [overlay]
  do_dentry_open
  vfs_open
  dentry_open_nonotify
  copy_event_to_user
  fanotify_read
  vfs_read
  ksys_read

Userspace cannot avoid this: the backing open happens while the kernel
builds the fd, before the event is reported, and fid reporting is not
available for permission event classes.

Make a backing file inherit FMODE_NONOTIFY when the user file it is
opened for must not generate events. This restores the pre-6.14
behaviour for the fds that fanotify creates (and for any other
FMODE_NONOTIFY file), while ordinary opens through a stacked filesystem
keep generating events on the real path, as intended by bc2473c90fca.

Verified with a self-contained reproducer (private tmpfs lower layers, an
overlayfs over them, FAN_OPEN_PERM filesystem marks on the overlay and on
one lower layer, a child opening a file through the overlay) in a qemu
VM on this tree built with defconfig plus OVERLAY_FS, FANOTIFY and
FANOTIFY_ACCESS_PERMISSIONS: without this patch the listener's read(2)
never returns and the child's open is released only by the listener's
death; with it read(2) returns, the event is answered and the open
completes.

backing_tmpfile_open() is left alone: its only caller is
ovl_create_tmpfile(), whose user file is a regular overlayfs file.

Fixes: ebe559609d78 ("fs: get rid of __FMODE_NONOTIFY kludge")
Cc: stable@vger.kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Edvard Conrad <edvard@tuta.io>
Link: https://patch.msgid.link/P58Wrer--F-9@tuta.io
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/backing-file.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/backing-file.c b/fs/backing-file.c
index 5cca636207d1aa..bf526fa2e29dfb 100644
--- a/fs/backing-file.c
+++ b/fs/backing-file.c
@@ -54,6 +54,17 @@ struct file *backing_file_open(const struct file *user_file, int flags,
 	if (IS_ERR(f))
 		return f;
 
+	/*
+	 * A user file that must not generate fsnotify events (e.g. the fd
+	 * that fanotify creates for a permission event with
+	 * dentry_open_nonotify()) must not generate them through its backing
+	 * file either. Otherwise a listener watching the backing filesystem
+	 * gets a nested permission event from its own read(2), which only
+	 * another reader of the same group can answer.
+	 */
+	if (FMODE_FSNOTIFY_NONE(user_file->f_mode))
+		file_set_fsnotify_mode(f, FMODE_NONOTIFY);
+
 	path_get(user_path);
 	backing_file_set_user_path(f, user_path);
 	error = vfs_open(real_path, f);

From f4acf474e4dc4f235a6fd343a8bc808ff6de62a8 Mon Sep 17 00:00:00 2001
From: Hungyu Lin <dennylin0707@gmail.com>
Date: Mon, 26 Oct 2026 01:57:38 +0000
Subject: [PATCH 1868/1982] fs: skip copy_file_range write limits when there is
 no data

[ Upstream commit 81dfa035891f0502674332ee97db348a16486de0 ]

generic_copy_file_checks() reduces count to zero for a source offset at
or beyond EOF, but still checks the destination write limits. If pos_out
is at RLIMIT_FSIZE, this sends SIGXFSZ and returns -EFBIG even though
there is no data to write.

For example, GNU cat copying a 1024-byte regular file to another regular
file with RLIMIT_FSIZE=1024 copies all bytes and is then killed by its
next copy_file_range() call at EOF. A zero-length request can fail in
the same way.

Check write limits only when count is nonzero, as the ordinary write
checks already do. Keep the other copy validation in place.

Fixes: 96e6e8f4a68d ("vfs: add missing checks to copy_file_range")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20261026015738.46230-1-dennylin0707@gmail.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/read_write.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/read_write.c b/fs/read_write.c
index 833bae068770a4..011fe55c94cdb4 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1530,9 +1530,11 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
 	else
 		count = min(count, size_in - (uint64_t)pos_in);
 
-	ret = generic_write_check_limits(file_out, pos_out, &count);
-	if (ret)
-		return ret;
+	if (count) {
+		ret = generic_write_check_limits(file_out, pos_out, &count);
+		if (ret)
+			return ret;
+	}
 
 	/* Don't allow overlapped copying within the same file. */
 	if (inode_in == inode_out &&

From 662ac91c9ffd4e71da45d6998c381658c209824b Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Fri, 30 Oct 2026 16:55:52 +0100
Subject: [PATCH 1869/1982] fs: don't fail __d_obtain_alias() for unlinked
 inodes

[ Upstream commit a522dd871024a0f065bfa7638afdb929607f58fc ]

Commit 669bb5af15d4 ("fs: make sure to call fsnotify_inoderemove() only
once when inode is dead") did two things. It made dentry_unlink_inode()
call fsnotify_inoderemove() only once the inode has neither links nor
aliases left. And it made __d_obtain_alias() fail with -ESTALE for an
inode in that state so that open_by_handle_at() can't create a new alias
after FS_DELETE_SELF has been reported and the inode marks are gone.

The second part is wrong for network filesystems. __d_obtain_alias()
backs d_obtain_alias() and d_obtain_root(). Those are what the
->fh_to_dentry() and ->get_parent() methods use to turn the inode they
looked up into a dentry for exportfs_decode_fh_raw(), i.e., for
open_by_handle_at() and for nfsd file handle decoding.

For a local filesystem an in-core inode without links and aliases is an
orphan that goes away on the final iput(). For a network filesystem
that's not true. i_nlink is just the link count the server last
reported and whether the object is still reachable through its file
handle is up to the server. If a file is unlinked while it is still
open elsewhere, e.g., by another NFSv4 client or by a process on the
server, the server keeps the object alive and its file handle stays
valid. nfs_fh_to_dentry() fetches the attributes for such a handle,
nfs_fhget() sets i_nlink to 0 from them, the new inode has no aliases
yet and so __d_obtain_alias() now fails with -ESTALE. The same applies
to fuse_get_dentry() which takes i_nlink from the fuse server.
Filesystems that care about unlinked inodes already make that decision
themselves in ->fh_to_dentry(), e.g., ceph's __fh_to_dentry() fetches
the link count with CEPH_CAP_LINK_SHARED and only refuses an unlinked
inode if it isn't open.

Note that on a network filesystem i_nlink drops to zero through
attribute updates when another client unlinks the file. So the inode
might never have gone through dentry_unlink_inode() with i_nlink == 0,
i.e., fsnotify_inoderemove() might never have been called for it and
there's nothing for the -ESTALE to protect.

So drop the two checks from __d_obtain_alias() again and go back to the
unconditional alias lookup. While at it, update the comment above
inode_notify_dead() since it no longer blocks new aliases.

Amir sent this as v3 to replace 669bb5af15d4 but that commit was already
in mainline by then. So do it as a fix on top. The resulting code is
identical to v3.

This means open_by_handle_at() can again create a new alias for an
unlinked inode after FS_DELETE_SELF has been reported. Closing that file
reports a second FS_DELETE_SELF and the file has none of the inode marks
that were torn down. That's what Daehyeon's open_by_handle_at() LTP test
checks so it is expected to fail again. This needs to be handled
separately. A mark that is added through such a file while
fsnotify_destroy_marks() is still running is rejected with -ENOENT since
36ebddca56b9 ("fsnotify: prevent mark additions during connector
teardown") so it can't end up on a detached connector.

Christian Brauner <brauner@kernel.org> says:

Amir's v3 replaced 669bb5af15d4 as a whole. I turned it into an
incremental fix on top of mainline and wrote a new commit message.
Jan's Reviewed-by was given on v3 and the resulting code is identical.

Fixes: 669bb5af15d4 ("fs: make sure to call fsnotify_inoderemove() only once when inode is dead")
Cc: stable@vger.kernel.org
Reported-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/CAOQ4uxg7Qt436SiKhKEJKOjtCjeB_XyTjazYF7HMyQAGGcgx2A@mail.gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20261030-work-dcache-obtain_alias-v1-1-a1f7e44536d2@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dcache.c | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 04adb623e584e9..3ad74a3abf9ad9 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -443,10 +443,9 @@ static void dentry_free(struct dentry *dentry)
 }
 
 /*
- * If inode is unlinked and doesn't have any aliases (i.e., all fds pointing to
- * it are closed), it is pretty much dead. Except that file handle lookup could
- * still revive it which causes issues to fsnotify. So once inode reaches this
- * state we make sure to block creating any new aliases.
+ * When inode is unlinked and doesn't have any aliases (i.e., all fds pointing
+ * to it are closed) we report FS_DELETE_SELF to fsnotify and cleanup all inode
+ * marks.
  */
 static bool inode_notify_dead(struct inode *inode)
 {
@@ -2035,12 +2034,7 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
 
 	sb = inode->i_sb;
 
-	spin_lock(&inode->i_lock);
-	if (!inode_notify_dead(inode))
-		res = __d_find_any_alias(inode);	/* existing alias? */
-	else
-		res = ERR_PTR(-ESTALE);
-	spin_unlock(&inode->i_lock);
+	res = d_find_any_alias(inode); /* existing alias? */
 	if (res)
 		goto out;
 
@@ -2052,10 +2046,7 @@ static struct dentry *__d_obtain_alias(struct inode *inode, bool disconnected)
 
 	security_d_instantiate(new, inode);
 	spin_lock(&inode->i_lock);
-	if (!inode_notify_dead(inode))
-		res = __d_find_any_alias(inode);	/* recheck under lock */
-	else
-		res = ERR_PTR(-ESTALE);
+	res = __d_find_any_alias(inode); /* recheck under lock */
 	if (likely(!res)) { /* still no alias, attach a disconnected dentry */
 		unsigned add_flags = d_flags_for_inode(inode);
 

From 337783277c0b0ee57bde6d9be4c9ea3d93c5d31d Mon Sep 17 00:00:00 2001
From: Avi Weiss <thnkslprpt@gmail.com>
Date: Tue, 27 Oct 2026 09:37:20 +0200
Subject: [PATCH 1870/1982] init/bootconfig: pass init arguments in documented
 order

[ Upstream commit 278b2abf660a3e0991eb9f16f11bd9e9514a286d ]

start_kernel() appends command-line init arguments before
bootconfig init arguments, while setup_command_line()
places them in the opposite order. As a result, the
arguments passed to init do not match the saved command
line, reversing the intended precedence of options.

Parse extra_init_args before after_dashes so command-line
init arguments are passed last.

Link: https://lore.kernel.org/all/20261027073719.4010659-2-thnkslprpt@gmail.com/

Fixes: b66fbbe8d482 ("init/bootconfig: Reorder init parameter from bootconfig and cmdline")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 init/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/init/main.c b/init/main.c
index 269b30038b9fac..2097f4bbc0d87e 100644
--- a/init/main.c
+++ b/init/main.c
@@ -910,12 +910,12 @@ void start_kernel(void)
 				  __stop___param - __start___param,
 				  -1, -1, NULL, &unknown_bootoption);
 	print_unknown_bootoptions();
-	if (!IS_ERR_OR_NULL(after_dashes))
-		parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
-			   NULL, set_init_arg);
 	if (extra_init_args)
 		parse_args("Setting extra init args", extra_init_args,
 			   NULL, 0, -1, -1, NULL, set_init_arg);
+	if (!IS_ERR_OR_NULL(after_dashes))
+		parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
+			   NULL, set_init_arg);
 
 	/* Architectural and non-timekeeping rng init, before allocator init */
 	random_init_early(command_line);

From 99c09b6a5ebeddf2643c4266f4381efc4754e5c7 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Sat, 24 Oct 2026 23:10:07 +0800
Subject: [PATCH 1871/1982] ocfs2: read the xattr entry hash before
 defragmenting the bucket

[ Upstream commit f48151da595e74efdc23d83d8d6d142207b8c731 ]

Patch series "ocfs2: fix stale xattr entry pointers and empty header
reads", v1.

Five defects in the ocfs2 extended attribute code, plus one robustness
measure that belongs with them, all on the paths that move entries
between a block, a bucket and an index tree.  They fall into two groups.

Stale entry pointers (patches 1 to 3)

ocfs2_xa_set() writes through a pointer into xh_entries[] that two of
its callers invalidate first.  Defragmenting a bucket ends in a sort()
on xe_name_hash, and lib/sort.c is an unstable heapsort, so entries that
share a hash can trade slots.  Copying a block into a bucket changes the
order outright, since a block holds its entries in insertion order while
a bucket holds them by hash, yet ocfs2_xattr_update_xattr_search()
relocates the search by the index the entry had in the block.  Neither
path compares the entry's name with the one being set, so setxattr() can
replace a neighbouring attribute's value and still report success, or
trip ocfs2_xa_reuse_entry()'s BUG_ON.  Patch 1 takes the hash before the
sort; patches 2 and 3 look the entry up again afterwards.

Reads of an empty entry array (patches 4 to 6)

A block and a bucket may both hold no entries: ocfs2_xa_remove_entry()
keeps the last slot when it removes the only one, so an empty bucket
still carries the hash it is keyed by.  Three sites index xh_entries[]
without checking xh_count and so read xh_entries[-1], which lands on the
header and comes back as xh_count | xh_free_start << 16.  Nothing
faults, but the value is acted on: the collision check reports no
collision for an empty bucket, the divide commits a sentinel hash that
hides part of the key space from ocfs2_xattr_bucket_find(), and the
block to bucket copy claims storage the bucket does not hold.  Patches 4
to 6 guard each site and keep the one read of xh_entries[0] that
ocfs2_xa_remove_entry() documents as intentional.

This patch (of 6):

ocfs2_xattr_set_entry_index_block() takes the hash a bucket split has to
work with out of xs->here, but only after ocfs2_xattr_set_entry_bucket()
has tried and failed to fit the entry.  That call defragments the bucket
when it runs out of room, and ocfs2_defrag_xattr_bucket() finishes by
sorting the entry array by name hash.  lib/sort.c is not stable, so two
entries sharing a hash may trade slots and xs->here is left naming an
entry other than the one the search found.

The hash value itself survives the permutation -- the array is already
sorted, so a slot can only exchange with an equal-hash neighbour -- but
there is no reason to depend on that.  Pick the hash up before the set,
where xs->here is unambiguously the entry the search landed on.

No functional change intended.

Link: https://lore.kernel.org/20261024151012.1059683-1-joseph.qi@linux.alibaba.com
Link: https://lore.kernel.org/20261024151012.1059683-2-joseph.qi@linux.alibaba.com
Fixes: e39baff18b85 ("ocfs2: use the stored hash when checking xattr bucket collision")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 8013451927a83d..734801de8e89ee 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -5683,6 +5683,22 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
 
 	trace_ocfs2_xattr_set_entry_index_block(xi->xi_name);
 
+	/*
+	 * An existing entry keeps the hash it was stored under, and that is
+	 * the hash a split has to work with.  A new entry is stored under the
+	 * unsigned one, which is what ocfs2_xa_add_entry() will write.
+	 *
+	 * Read it before the set below.  Filling the bucket may defragment it,
+	 * and ocfs2_defrag_xattr_bucket() re-sorts the entry array, so
+	 * afterwards xs->here only denotes whichever entry the sort left in
+	 * that slot.
+	 */
+	if (xs->not_found)
+		name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
+						  xi->xi_name_len);
+	else
+		name_hash = le32_to_cpu(xs->here->xe_name_hash);
+
 	ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
 	if (!ret)
 		goto out;
@@ -5698,17 +5714,7 @@ static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
 	 * the maximum number of collisions we will allow for then is
 	 * one bucket's worth, so check it here whether we need to
 	 * add a new bucket for the insert.
-	 *
-	 * An existing entry keeps the hash it was stored under, and that is
-	 * the hash a split has to work with.  A new entry is stored under the
-	 * unsigned one, which is what ocfs2_xa_add_entry() will write.
 	 */
-	if (xs->not_found)
-		name_hash = ocfs2_xattr_name_hash(inode, xi->xi_name,
-						  xi->xi_name_len);
-	else
-		name_hash = le32_to_cpu(xs->here->xe_name_hash);
-
 	ret = ocfs2_check_xattr_bucket_collision(xs->bucket, name_hash);
 	if (ret) {
 		mlog_errno(ret);

From 26d2534b6f1e78f3515f68b62786c38fcb210f92 Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Thu, 29 Oct 2026 16:53:12 -0700
Subject: [PATCH 1872/1982] apparmor: fix uninitialized variable warning in
 aa_inherit_files

[ Upstream commit ed35bbe7d06e6505401eff3f3c7a36bd1f167a17 ]

Fix the following warning

All warnings (new ones prefixed by >>):

>> security/apparmor/file.c:737:53: warning: variable 'file' is uninitialized when used here [-Wuninitialized]
     737 |                 int error = aa_file_perm(OP_INHERIT, cred, label, file,
         |                                                                   ^~~~
   security/apparmor/file.c:724:36: note: initialize the variable 'file' to silence this warning
     724 |         struct file *devnull = NULL, *file;
         |                                           ^
         |                                            = NULL
   1 warning generated.

vim +/file +737 security/apparmor/file.c

   719
   720	/* based on selinux's flush_unauthorized_files */
   721	void aa_inherit_files(const struct cred *cred, struct files_struct *files)
   722	{
   723		struct aa_label *label = aa_get_newest_cred_label(cred);
   724		struct file *devnull = NULL, *file;
   725		bool devnull_tried = false;
   726		unsigned int n = 0;
   727
   728		revalidate_tty(cred, label);
   729
   730		/*
   731		 * Revalidate access to inherited open files. Each file is
   732		 * revalidated holding only a reference to it, with no locks
   733		 * held, as revalidation may sleep (e.g. unix socket mediation
   734		 * dropping path refs, or allocating path buffers).
   735		 */
   736		while ((n = iterate_fd(files, n, get_next_file, &file)) != 0) {
 > 737			int error = aa_file_perm(OP_INHERIT, cred, label, file,

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610292346.ehqNujiE-lkp@intel.com/
Fixes: a913281f60015 ("apparmor: don't revalidate inherited files under files->file_lock")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 3176e5623d3d4b..f8f9320e266a46 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -706,7 +706,7 @@ static int get_next_file(const void *p, struct file *file, unsigned int fd)
 void aa_inherit_files(const struct cred *cred, struct files_struct *files)
 {
 	struct aa_label *label = aa_get_newest_cred_label(cred);
-	struct file *devnull = NULL, *file;
+	struct file *devnull = NULL, *file = NULL;
 	bool devnull_tried = false;
 	unsigned int n = 0;
 

From 5d68f3fd958b90b65faa879108ef2a47fa3c25c0 Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Thu, 29 Oct 2026 08:13:55 -0700
Subject: [PATCH 1873/1982] apparmor: on failed load ensure profile files are
 removed before parent

[ Upstream commit 97ba44a2aa4c7ab011a93ce94cb595200fe4ea4f ]

The load interface does not guarantee the order profiles are loaded.
When a parent is loaded after its child, and the load fails, the
current code will issue a warning, and leak a dentry.

For the loaded set of profiles, ensure that on failure list is ordered
is traversed in reverse so any children processed after their parent
is freed first. We do not need to deal with the cases where the
children are processed before their parent, because either a parent
outside the list already exists or a dummy parent outside of the list
is created, and the list walk will not put those parents before their
children.

Fixes: 6ec46f8f1977d ("apparmor: remove fs entries created by a failed policy load")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/policy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 14c91fc94b22e1..230d8428b4d318 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1404,8 +1404,10 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 	 * them yet, and leaving them behind would leak the new profiles
 	 * (their dents pin the proxy) and make the next load at the same,
 	 * unbumped ns revision fail with -EEXIST on its raw_data dir.
+	 * ensure children (which are at the end of the list are removed
+	 * before their parent
 	 */
-	list_for_each_entry(tmp, &lh, list) {
+	list_for_each_entry_reverse(tmp, &lh, list) {
 		if (!tmp->old)
 			__aafs_profile_rmdir(tmp->new);
 	}

From a97aa838903d15f865d80809f5198ff459c6634a Mon Sep 17 00:00:00 2001
From: Tu Dinh <ngoc-tu.dinh@vates.tech>
Date: Mon, 9 Nov 2026 17:03:55 +0100
Subject: [PATCH 1874/1982] xen-netback: Fix XenBus connection failure cleanup

commit dc6d814562b65813556933dbda1015cef61dabf8 upstream.

xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues
under rcu_read_lock. We need to unpublish vif->num_queues before
synchronize_net to ensure that readers that come afterwards will not
read a non-zero vif->num_queues and attempt to access invalid queues.

This is the same cleanup algorithm as used in backend_disconnect and
added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus
disconnect").

This is XSA-531

Fixes: 5fb756f1bbec ("xen-netback: Fix UAF when reading statistics data")
Signed-off-by: Tu Dinh <ngoc-tu.dinh@vates.tech>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/xenbus.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index aca25db2503b61..e4405a6c6e70ee 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -731,6 +731,7 @@ static void connect(struct backend_info *be)
 	unsigned int queue_index;
 	unsigned int requested_num_queues;
 	struct xenvif_queue *queue;
+	unsigned int num_queues;
 
 	/* Check whether the frontend requested multiple queues
 	 * and read the number requested.
@@ -837,14 +838,15 @@ static void connect(struct backend_info *be)
 	return;
 
 err:
-	if (be->vif->num_queues > 0)
+	num_queues = be->vif->num_queues;
+	if (num_queues > 0)
 		xenvif_disconnect_data(be->vif); /* Clean up existing queues */
+	be->vif->num_queues = 0;
 	synchronize_net();
-	for (queue_index = 0; queue_index < be->vif->num_queues; ++queue_index)
+	for (queue_index = 0; queue_index < num_queues; ++queue_index)
 		xenvif_deinit_queue(&be->vif->queues[queue_index]);
 	vfree(be->vif->queues);
 	be->vif->queues = NULL;
-	be->vif->num_queues = 0;
 	xenvif_disconnect_ctrl(be->vif);
 	return;
 }

From c5f54af611ff6fe1d53fa05d8e87b469dc56122b Mon Sep 17 00:00:00 2001
From: Tu Dinh <ngoc-tu.dinh@vates.tech>
Date: Sat, 7 Nov 2026 12:35:51 +0100
Subject: [PATCH 1875/1982] xen-netback: Zero out sring pointers on unmap

commit f96f16592a32430a0582309d73a873b6d3ee2bdb upstream.

If xenvif_map_frontend_data_rings() fails when a ring is already mapped,
it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the
ring pointers unchanged. xenvif_connect_data()'s cleanup path calls
xenvif_disconnect_queue() which in turn calls
xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the
pointers a second time.

Zero out the ring pointers after they are unmapped to avoid this issue.

This is XSA-532

Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code")
Signed-off-by: Tu Dinh <ngoc-tu.dinh@vates.tech>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/netback.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index c759ebc5645702..e3f126897cfccf 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1530,12 +1530,17 @@ static inline bool tx_dealloc_work_todo(struct xenvif_queue *queue)
 
 void xenvif_unmap_frontend_data_rings(struct xenvif_queue *queue)
 {
-	if (queue->tx.sring)
+	if (queue->tx.sring) {
 		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
 					queue->tx.sring);
-	if (queue->rx.sring)
+		queue->tx.sring = NULL;
+	}
+
+	if (queue->rx.sring) {
 		xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif),
 					queue->rx.sring);
+		queue->rx.sring = NULL;
+	}
 }
 
 int xenvif_map_frontend_data_rings(struct xenvif_queue *queue,

From 1cdda838e8475edf89b73ff0cc952005dd0b1fa7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 10 Nov 2026 13:07:06 -0500
Subject: [PATCH 1876/1982] Linux 6.18.63

Link: https://lore.kernel.org/r/20261107134852.069646174@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Barry K. Nathan <barryn@pobox.com>
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ae234882e7e55f..124ecd981272b1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 18
-SUBLEVEL = 62
+SUBLEVEL = 63
 EXTRAVERSION =
 NAME = Baby Opossum Posse
 

From ba320aa9a50f8148342468d377498756d704ee4e Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 23 Jul 2026 15:42:06 -0700
Subject: [PATCH 1877/1982] x86/hyperv: enable a Xen PV dom0 to use the L0
 Hyper-V host

When Xen is itself a Hyper-V guest and hands its PV dom0 the host's
VMBus, dom0 must speak Hyper-V to the L0 host through Xen.  Detect this
"nested on Xen" case (xen_pv_domain() + "Microsoft Hv" CPUID) and bring
up a minimal Hyper-V guest: GUEST_OS_ID, a hypercall page and the
per-cpu input pages, skipping the APIC/timer/isolation setup a PV dom0
does not use.

Add hv_nested_hostpfn()/hv_nested_hostpa() helpers translating dom0's
pseudo-physical frames to the machine (L1-physical) frames the L0 host
requires, and have hv_do_hypercall() emit machine addresses in this
mode.  Reserve VIRQ_HYPERV_VMBUS and add hyperv_setup_xen_vmbus_irq()
to bind the VMBus interrupt to it.

The helpers compile to no-ops without CONFIG_XEN_PV.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/hyperv/hv_init.c       |  94 ++++++++++++++++++++-
 arch/x86/include/asm/mshyperv.h |  30 ++++++-
 arch/x86/xen/Makefile           |   2 +
 arch/x86/xen/hyperv.c           | 144 ++++++++++++++++++++++++++++++++
 include/asm-generic/mshyperv.h  |  22 +++++
 include/xen/interface/xen.h     |   7 ++
 6 files changed, 295 insertions(+), 4 deletions(-)
 create mode 100644 arch/x86/xen/hyperv.c

diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 498d48b575e510..4c2b5e84e4e4fc 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -433,6 +433,18 @@ static void __init hv_stimer_setup_percpu_clockev(void)
 		old_setup_percpu_clockev();
 }
 
+/*
+ * True when running as a Xen PV dom0 that is itself nested under Hyper-V (L0).
+ * Set by the Xen guest code (arch/x86/xen/) after it detects the underlying
+ * Hyper-V.  In this mode Linux stays a Xen guest (x86_hyper_type == XEN_PV) but
+ * additionally brings up the VMBus stack to drive the L0 host's synthetic
+ * devices, with Xen proxying the Hyper-V enlightenments.
+ */
+#ifdef CONFIG_XEN_PV
+bool hyperv_nested_on_xen __ro_after_init;
+EXPORT_SYMBOL_GPL(hyperv_nested_on_xen);
+#endif
+
 /*
  * This function is to be invoked early in the boot sequence after the
  * hypervisor has been detected.
@@ -611,6 +623,83 @@ void __init hyperv_init(void)
 	hv_common_free();
 }
 
+/*
+ * Minimal Hyper-V bring-up for a Xen PV dom0 nested under Hyper-V.
+ *
+ * Unlike hyperv_init(), this deliberately does NOT touch the APIC, timers, TSC
+ * reference page, PCI, syscore or isolation machinery -- Xen owns all of those
+ * for a PV guest.  We set up only what the VMBus stack needs: the per-cpu input
+ * pages (hv_common_init + hv_cpu_init via cpuhp), the guest OS id, and the
+ * hypercall page.  Xen intercepts the GUEST_OS_ID / HYPERCALL MSR writes and
+ * fills the hypercall page with its own trap stub, and proxies the SynIC MSRs
+ * that vmbus_bus_init() subsequently programs.
+ *
+ * Must run after cpuhp is up and before hv_acpi_init() (subsys_initcall).
+ */
+#ifdef CONFIG_XEN_PV
+void __init hyperv_init_nested_on_xen(void)
+{
+	union hv_x64_msr_hypercall_contents hypercall_msr;
+	u64 guest_id;
+
+	if (!hyperv_nested_on_xen)
+		return;
+
+	/* Extract the L0 host's features and hints (subset of ms_hyperv_init). */
+	ms_hyperv.features = cpuid_eax(HYPERV_CPUID_FEATURES);
+	ms_hyperv.priv_high = cpuid_ebx(HYPERV_CPUID_FEATURES);
+	ms_hyperv.ext_features = cpuid_ecx(HYPERV_CPUID_FEATURES);
+	ms_hyperv.misc_features = cpuid_edx(HYPERV_CPUID_FEATURES);
+	ms_hyperv.hints = cpuid_eax(HYPERV_CPUID_ENLIGHTMENT_INFO);
+	ms_hyperv.max_vp_index = cpuid_eax(HYPERV_CPUID_IMPLEMENT_LIMITS);
+	ms_hyperv.max_lp_index = cpuid_ebx(HYPERV_CPUID_IMPLEMENT_LIMITS);
+
+	if (hv_common_init())
+		return;
+
+	guest_id = hv_generate_guest_id(LINUX_VERSION_CODE);
+	wrmsrq(HV_X64_MSR_GUEST_OS_ID, guest_id);
+
+	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, MODULES_VADDR,
+			MODULES_END, GFP_KERNEL, PAGE_KERNEL_ROX,
+			VM_FLUSH_RESET_PERMS, NUMA_NO_NODE,
+			__builtin_return_address(0));
+	if (!hv_hypercall_pg)
+		goto clean_guest_os_id;
+
+	rdmsrq(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+	hypercall_msr.enable = 1;
+	/*
+	 * Hand Xen the machine frame so it fills the correct page: for a PV
+	 * guest the pseudo-physical PFN differs from the machine (L1-physical)
+	 * frame the hypervisor uses.
+	 */
+	hypercall_msr.guest_physical_address =
+		hv_nested_hostpfn(vmalloc_to_pfn(hv_hypercall_pg));
+	wrmsrq(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+	hv_set_hypercall_pg(hv_hypercall_pg);
+
+	/*
+	 * Bring up the per-cpu input pages (VP assist is left NULL: it is a
+	 * lazy-EOI optimisation the PV dom0 does not need).
+	 */
+	if (cpuhp_setup_state(CPUHP_AP_HYPERV_ONLINE, "x86/hyperv_init:online",
+			      hv_cpu_init, hv_cpu_die) < 0)
+		goto clean_hypercall_pg;
+
+	return;
+
+clean_hypercall_pg:
+	hv_set_hypercall_pg(NULL);
+	vfree(hv_hypercall_pg);
+	hv_hypercall_pg = NULL;
+clean_guest_os_id:
+	wrmsrq(HV_X64_MSR_GUEST_OS_ID, 0);
+	hyperv_nested_on_xen = false;
+	hv_common_free();
+}
+#endif /* CONFIG_XEN_PV */
+
 /*
  * This routine is called before kexec/kdump, it does the required cleanup.
  */
@@ -679,9 +768,10 @@ bool hv_is_hyperv_initialized(void)
 
 	/*
 	 * Ensure that we're really on Hyper-V, and not a KVM or Xen
-	 * emulation of Hyper-V
+	 * emulation of Hyper-V.  The exception is a Xen PV dom0 nested under
+	 * Hyper-V, which drives VMBus with Xen proxying the enlightenments.
 	 */
-	if (x86_hyper_type != X86_HYPER_MS_HYPERV)
+	if (x86_hyper_type != X86_HYPER_MS_HYPERV && !hyperv_nested_on_xen)
 		return false;
 
 	/* A TDX VM with no paravisor uses TDX GHCI call rather than hv_hypercall_pg */
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 605abd02158dd6..79a303acef218d 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -63,14 +63,40 @@ DECLARE_STATIC_CALL(hv_hypercall, hv_std_hypercall);
 #define HV_AP_INIT_GPAT_DEFAULT		0x0007040600070406ULL
 #define HV_AP_SEGMENT_LIMIT		0xffffffff
 
+/*
+ * Nested Hyper-V-on-Xen host-address translation.  Shared include-guard with
+ * asm-generic/mshyperv.h so this is defined exactly once regardless of include
+ * order/arch.  A Xen PV dom0 nested under Hyper-V must hand the host machine
+ * (L1-physical) frames, not its own pseudo-physical frames.
+ */
+#ifndef __HV_NESTED_ON_XEN_DEFINED
+#define __HV_NESTED_ON_XEN_DEFINED
+#ifdef CONFIG_XEN_PV
+extern bool hyperv_nested_on_xen;
+unsigned long hv_nested_hostpfn(unsigned long pfn);
+u64 hv_nested_hostpa(void *va);
+void __init hyperv_init_nested_on_xen(void);
+int hyperv_setup_xen_vmbus_irq(void (*isr)(void));
+#else
+#define hyperv_nested_on_xen false
+/* Never called (the caller's hyperv_nested_on_xen test is a build-time false). */
+static inline unsigned long hv_nested_hostpfn(unsigned long pfn) { return pfn; }
+static inline u64 hv_nested_hostpa(void *va) { return 0; }
+static inline void hyperv_init_nested_on_xen(void) {}
+static inline int hyperv_setup_xen_vmbus_irq(void (*isr)(void)) { return -ENODEV; }
+#endif
+#endif /* __HV_NESTED_ON_XEN_DEFINED */
+
 /*
  * If the hypercall involves no input or output parameters, the hypervisor
  * ignores the corresponding GPA pointer.
  */
 static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
 {
-	u64 input_address = input ? virt_to_phys(input) : 0;
-	u64 output_address = output ? virt_to_phys(output) : 0;
+	u64 input_address = input ?
+		(hyperv_nested_on_xen ? hv_nested_hostpa(input) : virt_to_phys(input)) : 0;
+	u64 output_address = output ?
+		(hyperv_nested_on_xen ? hv_nested_hostpa(output) : virt_to_phys(output)) : 0;
 
 #ifdef CONFIG_X86_64
 	return static_call_mod(hv_hypercall)(control, input_address, output_address);
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index a9ec8c9f5c5dd0..58484ae6a5835e 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -35,6 +35,8 @@ obj-$(CONFIG_XEN_PV)		+= xen-asm.o
 
 obj-$(CONFIG_XEN_PVH)		+= enlighten_pvh.o
 
+obj-$(CONFIG_XEN_PV)		+= hyperv.o
+
 obj-$(CONFIG_EVENT_TRACING)	+= trace.o
 
 obj-$(CONFIG_SMP)		+= smp.o
diff --git a/arch/x86/xen/hyperv.c b/arch/x86/xen/hyperv.c
new file mode 100644
index 00000000000000..be66bb2201709b
--- /dev/null
+++ b/arch/x86/xen/hyperv.c
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Xen PV dom0 nested under Hyper-V.
+ *
+ * When Xen itself runs as a guest of Hyper-V (e.g. a nested VM on Azure), its
+ * PV dom0 must drive the L0 host's synthetic (VMBus) devices for storage and
+ * networking.  Xen exposes the Hyper-V enlightenments to dom0 and proxies the
+ * hypercalls / synthetic interrupts, so here we detect that situation, bring up
+ * the (otherwise Hyper-V-only) VMBus stack while remaining a Xen guest, and
+ * route the relayed VMBus interrupt (delivered by Xen as VIRQ_HYPERV_VMBUS)
+ * into the VMBus ISR.
+ */
+#include <linux/init.h>
+
+#if IS_ENABLED(CONFIG_HYPERV)
+
+#include <linux/cpuhotplug.h>
+#include <linux/interrupt.h>
+#include <linux/mm.h>
+#include <linux/printk.h>
+
+#include <asm/cpuid/api.h>
+#include <asm/mshyperv.h>
+#include <asm/xen/page.h>
+
+#include <xen/xen.h>
+#include <xen/events.h>
+#include <xen/interface/xen.h>
+
+/*
+ * Translate a guest pseudo-physical frame / address to the machine
+ * (L1-physical) frame the underlying Hyper-V host must use.  For a Xen PV dom0
+ * the two differ, so every host-facing VMBus / SynIC / hypercall address must
+ * be run through these.
+ */
+unsigned long hv_nested_hostpfn(unsigned long pfn)
+{
+	return hyperv_nested_on_xen ? pfn_to_mfn(pfn) : pfn;
+}
+EXPORT_SYMBOL_GPL(hv_nested_hostpfn);
+
+u64 hv_nested_hostpa(void *va)
+{
+	unsigned long pfn = virt_to_pfn(va);
+
+	if (hyperv_nested_on_xen)
+		pfn = pfn_to_mfn(pfn);
+
+	return ((u64)pfn << PAGE_SHIFT) | offset_in_page(va);
+}
+EXPORT_SYMBOL_GPL(hv_nested_hostpa);
+
+static bool __init xen_detect_hyperv_l0(void)
+{
+	u32 eax, ebx, ecx, edx;
+
+	if (!xen_pv_domain())
+		return false;
+
+	/*
+	 * Xen presents the underlying host's "Microsoft Hv" leaves at
+	 * 0x40000000 (its own XenVMMXenVMM leaves are relocated to 0x40000100).
+	 */
+	cpuid(HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS, &eax, &ebx, &ecx, &edx);
+
+	return ebx == 0x7263694d &&	/* "Micr" */
+	       ecx == 0x666f736f &&	/* "osof" */
+	       edx == 0x76482074;	/* "t Hv" */
+}
+
+static int __init xen_hyperv_init(void)
+{
+	if (!xen_detect_hyperv_l0())
+		return 0;
+
+	pr_info("Xen: nested under Hyper-V, enabling VMBus passthrough\n");
+	hyperv_nested_on_xen = true;
+	hyperv_init_nested_on_xen();
+
+	return 0;
+}
+arch_initcall(xen_hyperv_init);
+
+/*
+ * VMBus interrupt bridge.  A PV dom0 receives interrupts as Xen event channels,
+ * not as the native SINT vector VMBus programs, so Xen relays each VMBus
+ * message via the per-vcpu VIRQ_HYPERV_VMBUS.  Bind it on every cpu and drive
+ * the VMBus ISR from its handler.
+ */
+static void (*xen_vmbus_handler)(void);
+static DEFINE_PER_CPU(int, xen_vmbus_irq);
+
+static irqreturn_t xen_hyperv_vmbus_isr(int irq, void *dev_id)
+{
+	if (xen_vmbus_handler)
+		xen_vmbus_handler();
+
+	return IRQ_HANDLED;
+}
+
+static int xen_hyperv_vmbus_cpu_up(unsigned int cpu)
+{
+	int irq;
+
+	irq = bind_virq_to_irqhandler(VIRQ_HYPERV_VMBUS, cpu,
+				      xen_hyperv_vmbus_isr,
+				      IRQF_PERCPU | IRQF_NOBALANCING,
+				      "hyperv-vmbus", NULL);
+	if (irq < 0)
+		return irq;
+
+	per_cpu(xen_vmbus_irq, cpu) = irq;
+
+	return 0;
+}
+
+static int xen_hyperv_vmbus_cpu_down(unsigned int cpu)
+{
+	int irq = per_cpu(xen_vmbus_irq, cpu);
+
+	if (irq > 0) {
+		unbind_from_irqhandler(irq, NULL);
+		per_cpu(xen_vmbus_irq, cpu) = 0;
+	}
+
+	return 0;
+}
+
+int hyperv_setup_xen_vmbus_irq(void (*isr)(void))
+{
+	int ret;
+
+	if (!hyperv_nested_on_xen)
+		return -ENODEV;
+
+	xen_vmbus_handler = isr;
+
+	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "xen/hyperv-vmbus:online",
+				xen_hyperv_vmbus_cpu_up, xen_hyperv_vmbus_cpu_down);
+
+	return ret < 0 ? ret : 0;
+}
+
+#endif /* CONFIG_HYPERV */
diff --git a/include/asm-generic/mshyperv.h b/include/asm-generic/mshyperv.h
index 8862f77241e6c9..9e1469c6a79031 100644
--- a/include/asm-generic/mshyperv.h
+++ b/include/asm-generic/mshyperv.h
@@ -365,6 +365,28 @@ static inline enum hv_isolation_type hv_get_isolation_type(void)
 }
 #endif /* CONFIG_HYPERV */
 
+/*
+ * Nested Hyper-V-on-Xen host-address translation.  Shared include-guard with
+ * arch/x86/include/asm/mshyperv.h (which defines this first on x86, ahead of
+ * hv_do_hypercall()); this copy serves other arches.
+ */
+#ifndef __HV_NESTED_ON_XEN_DEFINED
+#define __HV_NESTED_ON_XEN_DEFINED
+#ifdef CONFIG_XEN_PV
+extern bool hyperv_nested_on_xen;
+unsigned long hv_nested_hostpfn(unsigned long pfn);
+u64 hv_nested_hostpa(void *va);
+void __init hyperv_init_nested_on_xen(void);
+int hyperv_setup_xen_vmbus_irq(void (*isr)(void));
+#else
+#define hyperv_nested_on_xen false
+static inline unsigned long hv_nested_hostpfn(unsigned long pfn) { return pfn; }
+static inline u64 hv_nested_hostpa(void *va) { return 0; }
+static inline void hyperv_init_nested_on_xen(void) {}
+static inline int hyperv_setup_xen_vmbus_irq(void (*isr)(void)) { return -ENODEV; }
+#endif
+#endif /* __HV_NESTED_ON_XEN_DEFINED */
+
 #if IS_ENABLED(CONFIG_MSHV_ROOT)
 static inline bool hv_root_partition(void)
 {
diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
index 0ca23eca2a9ccc..a7687ad868cae4 100644
--- a/include/xen/interface/xen.h
+++ b/include/xen/interface/xen.h
@@ -102,6 +102,13 @@
 /* Architecture-specific VIRQ definitions. */
 #define VIRQ_ARCH_0    16
 #define VIRQ_ARCH_1    17
+/*
+ * Relayed Hyper-V VMBus synthetic interrupt, for a Xen dom0 running nested
+ * under Hyper-V: Xen owns the L0 SynIC and forwards VMBus messages to dom0 via
+ * this per-vcpu VIRQ.  Must match the Xen definition.  NB: VIRQ_ARCH_0 is
+ * VIRQ_MCA (used by xen_mcelog), so VMBus uses VIRQ_ARCH_1.
+ */
+#define VIRQ_HYPERV_VMBUS VIRQ_ARCH_1
 #define VIRQ_ARCH_2    18
 #define VIRQ_ARCH_3    19
 #define VIRQ_ARCH_4    20

From 4110fe86974fb7ab14b4d2b6d97911494c86f057 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 23 Jul 2026 15:42:06 -0700
Subject: [PATCH 1878/1982] Drivers: hv: use host frames for GPADLs and SynIC
 pages when nested on Xen

The VMBus GPADL page lists and the SynIC SIMP/SIEFP pages must hold the
machine (L1-physical) frames the L0 Hyper-V host can access, not dom0's
pseudo-physical frames.  Route them through hv_nested_hostpfn()/
hv_nested_hostpa() when running nested on Xen; the translation is a
no-op otherwise.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 drivers/hv/channel.c    |  7 ++++++-
 drivers/hv/connection.c | 15 +++++++++++----
 drivers/hv/hv.c         |  8 ++++----
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 162d6aeece7b3b..c2af4fa5aac2e1 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -114,7 +114,12 @@ static inline u64 hv_gpadl_hvpfn(enum hv_gpadl_type type, void *kbuffer,
 		break;
 	}
 
-	return virt_to_hvpfn(kbuffer + delta + (HV_HYP_PAGE_SIZE * i));
+	/*
+	 * The host consumes these as machine (L1-physical) frames; on a Xen PV
+	 * dom0 that differs from the guest pseudo-physical frame.
+	 */
+	return hv_nested_hostpfn(virt_to_hvpfn(kbuffer + delta +
+					       (HV_HYP_PAGE_SIZE * i)));
 }
 
 /*
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 4a3bb9ae9250cb..92eadbed90ffd6 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -102,17 +102,24 @@ static int vmbus_try_connection_id(struct vmbus_channel_msginfo *msginfo,
 		msg->msg_vtl = ms_hyperv.vtl;
 		vmbus_connection.msg_conn_id = connection_id;
 	} else {
-		msg->interrupt_page = virt_to_phys(vmbus_connection.int_page);
+		msg->interrupt_page = hyperv_nested_on_xen ?
+			hv_nested_hostpa(vmbus_connection.int_page) :
+			virt_to_phys(vmbus_connection.int_page);
 		vmbus_connection.msg_conn_id = VMBUS_MESSAGE_CONNECTION_ID;
 	}
 
 	/*
 	 * shared_gpa_boundary is zero in non-SNP VMs, so it's safe to always
-	 * bitwise OR it
+	 * bitwise OR it.  On a Xen PV dom0 the host needs machine (L1-physical)
+	 * addresses for the monitor pages.
 	 */
-	msg->monitor_page1 = virt_to_phys(vmbus_connection.monitor_pages[0]) |
+	msg->monitor_page1 = (hyperv_nested_on_xen ?
+			hv_nested_hostpa(vmbus_connection.monitor_pages[0]) :
+			virt_to_phys(vmbus_connection.monitor_pages[0])) |
 				ms_hyperv.shared_gpa_boundary;
-	msg->monitor_page2 = virt_to_phys(vmbus_connection.monitor_pages[1]) |
+	msg->monitor_page2 = (hyperv_nested_on_xen ?
+			hv_nested_hostpa(vmbus_connection.monitor_pages[1]) :
+			virt_to_phys(vmbus_connection.monitor_pages[1])) |
 				ms_hyperv.shared_gpa_boundary;
 
 	msg->target_vcpu = hv_cpu_number_to_vp_number(VMBUS_CONNECT_CPU);
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 90db1e17582d80..3e862ab710c176 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -287,8 +287,8 @@ void hv_synic_enable_regs(unsigned int cpu)
 		if (!hv_cpu->hyp_synic_message_page)
 			pr_err("Fail to map synic message page.\n");
 	} else {
-		simp.base_simp_gpa = virt_to_phys(hv_cpu->hyp_synic_message_page)
-			>> HV_HYP_PAGE_SHIFT;
+		simp.base_simp_gpa = hv_nested_hostpfn(
+			virt_to_phys(hv_cpu->hyp_synic_message_page) >> HV_HYP_PAGE_SHIFT);
 	}
 
 	hv_set_msr(HV_MSR_SIMP, simp.as_uint64);
@@ -306,8 +306,8 @@ void hv_synic_enable_regs(unsigned int cpu)
 		if (!hv_cpu->hyp_synic_event_page)
 			pr_err("Fail to map synic event page.\n");
 	} else {
-		siefp.base_siefp_gpa = virt_to_phys(hv_cpu->hyp_synic_event_page)
-			>> HV_HYP_PAGE_SHIFT;
+		siefp.base_siefp_gpa = hv_nested_hostpfn(
+			virt_to_phys(hv_cpu->hyp_synic_event_page) >> HV_HYP_PAGE_SHIFT);
 	}
 
 	hv_set_msr(HV_MSR_SIEFP, siefp.as_uint64);

From 2c45cfea1356e12575e5eea6e0724143f661819a Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 23 Jul 2026 15:42:07 -0700
Subject: [PATCH 1879/1982] drivers: hv: deliver the VMBus interrupt via a Xen
 VIRQ when nested on Xen

When nested on Xen the host's synthetic interrupt is taken by Xen and
relayed to dom0 as VIRQ_HYPERV_VMBUS.  Bind the VMBus ISR to that VIRQ
instead of the Hyper-V synthetic vector in that case.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 drivers/hv/vmbus_drv.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 1dc371eb534001..f52940885d7458 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1440,7 +1440,19 @@ static int vmbus_bus_init(void)
 		vmbus_irq_initialized = true;
 	}
 
-	if (vmbus_irq == -1) {
+	if (hyperv_nested_on_xen) {
+		/*
+		 * A Xen PV dom0 nested under Hyper-V receives the relayed VMBus
+		 * interrupt as a Xen event channel (VIRQ_HYPERV_VMBUS), not as
+		 * the native SINT vector, so use the Xen-side bridge.
+		 */
+		ret = hyperv_setup_xen_vmbus_irq(vmbus_isr);
+		if (ret) {
+			pr_err("Can't set up Xen VMbus interrupt bridge, Err %d\n",
+					ret);
+			goto err_setup;
+		}
+	} else if (vmbus_irq == -1) {
 		hv_setup_vmbus_handler(vmbus_isr);
 	} else {
 		vmbus_evt = alloc_percpu(long);

From 58f3e1ecfda24052a245d2c2e78d3ac439bbd744 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 23 Jul 2026 15:42:07 -0700
Subject: [PATCH 1880/1982] hv_netvsc: DMA-map transmit pages when nested on
 Xen

Like an isolation VM, a Xen PV dom0 nested under Hyper-V must hand the
host machine (bus) addresses for transmit page buffers.  Extend the
DMA-map/unmap path (which routes through swiotlb-xen) to also run in the
nested-on-Xen case, so RNDIS control and data sends reference machine
frames the host can read.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 drivers/net/hyperv/netvsc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 073f2b7bd3c0e1..fab91c7ab44353 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -993,7 +993,7 @@ void netvsc_dma_unmap(struct hv_device *hv_dev,
 {
 	int i;
 
-	if (!hv_is_isolation_supported())
+	if (!hv_is_isolation_supported() && !hyperv_nested_on_xen)
 		return;
 
 	if (!packet->dma_range)
@@ -1033,7 +1033,12 @@ static int netvsc_dma_map(struct hv_device *hv_dev,
 	dma_addr_t dma;
 	int i;
 
-	if (!hv_is_isolation_supported())
+	/*
+	 * A Xen PV dom0 nested under Hyper-V must also DMA-map packet pages so
+	 * the host receives machine (bus) addresses (via swiotlb-xen), not the
+	 * guest's pseudo-physical PFNs.
+	 */
+	if (!hv_is_isolation_supported() && !hyperv_nested_on_xen)
 		return 0;
 
 	packet->dma_range = kcalloc(page_count,

From 346c688951497ae8d3277312db1226520b04e117 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Mon, 27 Jul 2026 20:30:58 -0700
Subject: [PATCH 1881/1982] x86/hyperv: take vPCI device interrupts through Xen
 when nested on Xen

A Xen PV dom0 nested under Hyper-V cannot back vPCI MSIs with
x86_vector_domain.  The host composes them against a vector on a virtual
processor belonging to Xen, so Xen owns the vector and tells us which
one; and PV never onlines the local APIC, so cpu0 is the only CPU in the
vector matrix and acking through apic_ack_edge() reaches xen_apic_eoi(),
which warns.

Query that vector and supply a minimal parent irq domain for these
interrupts, one in which masking and affinity belong to the host: Xen
has already acked the vector by the time it relays the interrupt as
VIRQ_HYPERV_VPCI, and affinity takes effect through the retarget
hypercall the vPCI irq_chip above issues on unmask.  As one vector
serves every vPCI device, run each registered handler on every relayed
interrupt, and mark the interrupts polled so that the spurious detector
does not eventually disable a busy device whose handler usually has
nothing to do.

Multi-message MSI cannot work in this configuration - a contiguous block
of vectors cannot come from the single relay vector - so drop it; MSI-X,
which NVMe and MANA use, is unaffected.  Config space likewise takes the
trapped MMIO path in preference to HVCALL_MMIO_READ/WRITE, whose output
page Xen would otherwise have to marshal, as arm64 already does.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/include/asm/mshyperv.h     |  10 +
 arch/x86/xen/hyperv.c               | 275 ++++++++++++++++++++++++++++
 drivers/pci/controller/pci-hyperv.c |  35 +++-
 include/asm-generic/mshyperv.h      |   5 +
 include/xen/interface/physdev.h     |  14 ++
 include/xen/interface/xen.h         |   8 +
 6 files changed, 345 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 79a303acef218d..f0f402f349b348 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -71,12 +71,20 @@ DECLARE_STATIC_CALL(hv_hypercall, hv_std_hypercall);
  */
 #ifndef __HV_NESTED_ON_XEN_DEFINED
 #define __HV_NESTED_ON_XEN_DEFINED
+struct irq_domain;
 #ifdef CONFIG_XEN_PV
 extern bool hyperv_nested_on_xen;
 unsigned long hv_nested_hostpfn(unsigned long pfn);
 u64 hv_nested_hostpa(void *va);
 void __init hyperv_init_nested_on_xen(void);
 int hyperv_setup_xen_vmbus_irq(void (*isr)(void));
+/*
+ * The vector vPCI device MSIs must be composed with, and the parent irq domain
+ * for them: the host delivers such an MSI to a vector Xen owns and relays it to
+ * us, so x86_vector_domain's vectors (meaningless to a PV guest) cannot be used.
+ */
+unsigned int hyperv_xen_vpci_vector(void);
+struct irq_domain *hyperv_xen_vpci_root_domain(void);
 #else
 #define hyperv_nested_on_xen false
 /* Never called (the caller's hyperv_nested_on_xen test is a build-time false). */
@@ -84,6 +92,8 @@ static inline unsigned long hv_nested_hostpfn(unsigned long pfn) { return pfn; }
 static inline u64 hv_nested_hostpa(void *va) { return 0; }
 static inline void hyperv_init_nested_on_xen(void) {}
 static inline int hyperv_setup_xen_vmbus_irq(void (*isr)(void)) { return -ENODEV; }
+static inline unsigned int hyperv_xen_vpci_vector(void) { return 0; }
+static inline struct irq_domain *hyperv_xen_vpci_root_domain(void) { return NULL; }
 #endif
 #endif /* __HV_NESTED_ON_XEN_DEFINED */
 
diff --git a/arch/x86/xen/hyperv.c b/arch/x86/xen/hyperv.c
index be66bb2201709b..dc6c8b4b57e797 100644
--- a/arch/x86/xen/hyperv.c
+++ b/arch/x86/xen/hyperv.c
@@ -16,15 +16,22 @@
 
 #include <linux/cpuhotplug.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
 #include <linux/mm.h>
+#include <linux/mutex.h>
 #include <linux/printk.h>
+#include <linux/rculist.h>
+#include <linux/slab.h>
 
 #include <asm/cpuid/api.h>
 #include <asm/mshyperv.h>
+#include <asm/xen/hypercall.h>
 #include <asm/xen/page.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
+#include <xen/interface/physdev.h>
 #include <xen/interface/xen.h>
 
 /*
@@ -141,4 +148,272 @@ int hyperv_setup_xen_vmbus_irq(void (*isr)(void))
 	return ret < 0 ? ret : 0;
 }
 
+/*
+ * vPCI (VMBus-assigned PCI device, e.g. NVMe or a MANA VF) interrupt bridge.
+ *
+ * The host composes these MSIs itself and delivers them to the VP, which under
+ * Xen belongs to Xen and not to us: the vPCI protocol messages that request them
+ * travel in a VMBus ring buffer Xen does not inspect, so it cannot rewrite the
+ * vector we ask for.  Xen therefore owns one vector for all of them, tells us
+ * which (PHYSDEVOP_hyperv_vpci_vector), and relays each delivery to the vcpu
+ * that received it as VIRQ_HYPERV_VPCI.  We compose every vPCI MSI with that
+ * vector and demultiplex here, since Xen cannot tell the devices apart.
+ *
+ * That also means x86_vector_domain cannot be the parent of the vPCI MSI domain:
+ * its vectors are meaningless to a PV guest (and acking one reaches
+ * xen_apic_eoi(), which warns).  We supply a minimal parent domain instead - the
+ * host owns masking and affinity, and Xen has already EOId the vector by the
+ * time we run.
+ */
+static u32 xen_hv_vpci_vector;
+static struct irq_domain *xen_hv_vpci_domain;
+static DEFINE_PER_CPU(int, xen_vpci_irq);
+
+/* The vPCI interrupts to consider on each relayed VIRQ. */
+struct xen_hv_vpci_irq {
+	struct list_head node;
+	struct rcu_head rcu;
+	unsigned int irq;
+};
+
+static LIST_HEAD(xen_hv_vpci_irqs);
+static DEFINE_SPINLOCK(xen_hv_vpci_irqs_lock);
+
+static int xen_hv_vpci_irq_add(unsigned int irq)
+{
+	struct xen_hv_vpci_irq *entry;
+
+	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+	if (!entry)
+		return -ENOMEM;
+
+	entry->irq = irq;
+
+	spin_lock(&xen_hv_vpci_irqs_lock);
+	list_add_rcu(&entry->node, &xen_hv_vpci_irqs);
+	spin_unlock(&xen_hv_vpci_irqs_lock);
+
+	return 0;
+}
+
+static void xen_hv_vpci_irq_del(unsigned int irq)
+{
+	struct xen_hv_vpci_irq *entry;
+
+	spin_lock(&xen_hv_vpci_irqs_lock);
+	list_for_each_entry(entry, &xen_hv_vpci_irqs, node) {
+		if (entry->irq == irq) {
+			list_del_rcu(&entry->node);
+			kfree_rcu(entry, rcu);
+			break;
+		}
+	}
+	spin_unlock(&xen_hv_vpci_irqs_lock);
+}
+
+static irqreturn_t xen_hyperv_vpci_isr(int irq, void *dev_id)
+{
+	struct xen_hv_vpci_irq *entry;
+
+	/*
+	 * One or more of these devices interrupted; which one is not
+	 * recoverable from the relay, so run them all.  Device handlers are
+	 * required to tolerate a spurious call.
+	 */
+	rcu_read_lock();
+	list_for_each_entry_rcu(entry, &xen_hv_vpci_irqs, node)
+		generic_handle_irq(entry->irq);
+	rcu_read_unlock();
+
+	return IRQ_HANDLED;
+}
+
+static int xen_hyperv_vpci_cpu_up(unsigned int cpu)
+{
+	int irq;
+
+	irq = bind_virq_to_irqhandler(VIRQ_HYPERV_VPCI, cpu,
+				      xen_hyperv_vpci_isr,
+				      IRQF_PERCPU | IRQF_NOBALANCING,
+				      "hyperv-vpci", NULL);
+	if (irq < 0)
+		return irq;
+
+	per_cpu(xen_vpci_irq, cpu) = irq;
+
+	return 0;
+}
+
+static int xen_hyperv_vpci_cpu_down(unsigned int cpu)
+{
+	int irq = per_cpu(xen_vpci_irq, cpu);
+
+	if (irq > 0) {
+		unbind_from_irqhandler(irq, NULL);
+		per_cpu(xen_vpci_irq, cpu) = 0;
+	}
+
+	return 0;
+}
+
+/*
+ * Xen acknowledged the host's vector before relaying, so there is nothing to ack
+ * here beyond completing a pending affinity change - the same thing
+ * apic_ack_edge() does for a native MSI.
+ */
+static void xen_hv_vpci_irq_ack(struct irq_data *data)
+{
+	irq_move_irq(data);
+}
+
+static void xen_hv_vpci_irq_noop(struct irq_data *data)
+{
+}
+
+/*
+ * Record where the interrupt should land; the vPCI irq_chip above us turns this
+ * into a HVCALL_RETARGET_INTERRUPT (proxied by Xen) when it unmasks, which is
+ * what actually moves it.
+ */
+static int xen_hv_vpci_set_affinity(struct irq_data *data,
+				    const struct cpumask *mask, bool force)
+{
+	unsigned int cpu = cpumask_first_and(mask, cpu_online_mask);
+
+	if (cpu >= nr_cpu_ids)
+		return -EINVAL;
+
+	irq_data_update_effective_affinity(data, cpumask_of(cpu));
+
+	return IRQ_SET_MASK_OK;
+}
+
+static struct irq_chip xen_hv_vpci_irq_chip = {
+	.name			= "XEN-HV-vPCI",
+	.irq_ack		= xen_hv_vpci_irq_ack,
+	.irq_eoi		= xen_hv_vpci_irq_noop,
+	.irq_mask		= xen_hv_vpci_irq_noop,
+	.irq_unmask		= xen_hv_vpci_irq_noop,
+	.irq_set_affinity	= xen_hv_vpci_set_affinity,
+};
+
+static int xen_hv_vpci_domain_alloc(struct irq_domain *domain, unsigned int virq,
+				    unsigned int nr_irqs, void *arg)
+{
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < nr_irqs; i++) {
+		ret = xen_hv_vpci_irq_add(virq + i);
+		if (ret)
+			goto err;
+
+		irq_domain_set_info(domain, virq + i, virq + i,
+				    &xen_hv_vpci_irq_chip, NULL,
+				    handle_edge_irq, NULL, NULL);
+
+		/*
+		 * Every handler runs on every relayed interrupt, so most calls
+		 * return IRQ_NONE by design.  Tell the spurious-interrupt
+		 * detector this line is polled, or it would eventually decide a
+		 * busy device's interrupt is stuck and disable it.
+		 */
+		irq_set_status_flags(virq + i, IRQ_IS_POLLED);
+
+		/*
+		 * The host has to be given a VP to deliver to, and
+		 * hv_compose_msi_msg() takes it from the effective affinity, so
+		 * that must never be empty.
+		 */
+		irq_data_update_effective_affinity(irq_domain_get_irq_data(domain,
+									  virq + i),
+						   cpumask_of(0));
+	}
+
+	return 0;
+
+err:
+	while (i--)
+		xen_hv_vpci_irq_del(virq + i);
+
+	return ret;
+}
+
+static void xen_hv_vpci_domain_free(struct irq_domain *domain, unsigned int virq,
+				    unsigned int nr_irqs)
+{
+	unsigned int i;
+
+	for (i = 0; i < nr_irqs; i++) {
+		xen_hv_vpci_irq_del(virq + i);
+		irq_domain_reset_irq_data(irq_domain_get_irq_data(domain, virq + i));
+	}
+}
+
+static const struct irq_domain_ops xen_hv_vpci_domain_ops = {
+	.alloc	= xen_hv_vpci_domain_alloc,
+	.free	= xen_hv_vpci_domain_free,
+};
+
+/* The vector every vPCI MSI must be composed with. */
+unsigned int hyperv_xen_vpci_vector(void)
+{
+	return xen_hv_vpci_vector;
+}
+EXPORT_SYMBOL_GPL(hyperv_xen_vpci_vector);
+
+/*
+ * Parent irq domain for vPCI MSIs, brought up on first use.  Returns NULL if Xen
+ * is not relaying vPCI interrupts, which leaves the vPCI bus unusable - the
+ * devices on it cannot deliver an interrupt any other way.
+ */
+struct irq_domain *hyperv_xen_vpci_root_domain(void)
+{
+	static DEFINE_MUTEX(setup_lock);
+	struct physdev_hyperv_vpci_vector out = {};
+	struct fwnode_handle *fn;
+	int ret;
+
+	if (!hyperv_nested_on_xen)
+		return NULL;
+
+	guard(mutex)(&setup_lock);
+
+	if (xen_hv_vpci_domain)
+		return xen_hv_vpci_domain;
+
+	ret = HYPERVISOR_physdev_op(PHYSDEVOP_hyperv_vpci_vector, &out);
+	if (ret) {
+		pr_err("Xen: no Hyper-V vPCI interrupt vector: %d\n", ret);
+		return NULL;
+	}
+	xen_hv_vpci_vector = out.vector;
+
+	fn = irq_domain_alloc_named_fwnode("XEN-HV-vPCI");
+	if (!fn)
+		return NULL;
+
+	xen_hv_vpci_domain = irq_domain_create_tree(fn, &xen_hv_vpci_domain_ops,
+						    NULL);
+	if (!xen_hv_vpci_domain) {
+		irq_domain_free_fwnode(fn);
+		return NULL;
+	}
+
+	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "xen/hyperv-vpci:online",
+				xen_hyperv_vpci_cpu_up, xen_hyperv_vpci_cpu_down);
+	if (ret < 0) {
+		pr_err("Xen: can't bind the Hyper-V vPCI VIRQ: %d\n", ret);
+		irq_domain_remove(xen_hv_vpci_domain);
+		xen_hv_vpci_domain = NULL;
+		return NULL;
+	}
+
+	pr_info("Xen: Hyper-V vPCI interrupts relayed on vector 0x%x\n",
+		xen_hv_vpci_vector);
+
+	return xen_hv_vpci_domain;
+}
+EXPORT_SYMBOL_GPL(hyperv_xen_vpci_root_domain);
+
 #endif /* CONFIG_HYPERV */
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index fff5df771d5bd1..9cb5f7ec4e48ac 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -586,12 +586,26 @@ static int hv_pci_irqchip_init(void)
 
 static struct irq_domain *hv_pci_get_root_domain(void)
 {
+	/*
+	 * Nested under Hyper-V in a Xen PV dom0 the host delivers these MSIs to
+	 * a vector Xen owns, on a VP that is Xen's, so x86_vector_domain has
+	 * nothing to allocate here - Xen provides the vector and the parent
+	 * domain.  See hyperv_xen_vpci_root_domain().
+	 */
+	if (hyperv_nested_on_xen)
+		return hyperv_xen_vpci_root_domain();
+
 	return x86_vector_domain;
 }
 
 static unsigned int hv_msi_get_int_vector(struct irq_data *data)
 {
-	struct irq_cfg *cfg = irqd_cfg(data);
+	struct irq_cfg *cfg;
+
+	if (hyperv_nested_on_xen)
+		return hyperv_xen_vpci_vector();
+
+	cfg = irqd_cfg(data);
 
 	return cfg->vector;
 }
@@ -2125,6 +2139,15 @@ static bool hv_pcie_init_dev_msi_info(struct device *dev, struct irq_domain *dom
 	if (IS_ENABLED(CONFIG_X86))
 		chip->flags |= IRQCHIP_MOVE_DEFERRED;
 
+	/*
+	 * Nested under Hyper-V in a Xen PV dom0 all vPCI MSIs share the single
+	 * vector Xen relays on, so there is no contiguous block of vectors to
+	 * back a multi-message MSI allocation.  MSI-X (what NVMe and MANA use)
+	 * is unaffected.
+	 */
+	if (hyperv_nested_on_xen)
+		info->flags &= ~MSI_FLAG_MULTI_PCI_MSI;
+
 	return true;
 }
 
@@ -3807,7 +3830,15 @@ static int hv_pci_probe(struct hv_device *hdev,
 	hbus->bridge->domain_nr = dom;
 #ifdef CONFIG_X86
 	hbus->sysdata.domain = dom;
-	hbus->use_calls = !!(ms_hyperv.hints & HV_X64_USE_MMIO_HYPERCALLS);
+	/*
+	 * The MMIO hypercalls return data through an output page, which Xen
+	 * would have to marshal on our behalf when nested in a PV dom0.  Take
+	 * the trapped-MMIO path instead (as arm64 does unconditionally): the
+	 * config window's machine address is mapped directly, so the host
+	 * intercepts the access with no hypervisor involvement.
+	 */
+	hbus->use_calls = !hyperv_nested_on_xen &&
+			  !!(ms_hyperv.hints & HV_X64_USE_MMIO_HYPERCALLS);
 #elif defined(CONFIG_ARM64)
 	/*
 	 * Set the PCI bus parent to be the corresponding VMbus
diff --git a/include/asm-generic/mshyperv.h b/include/asm-generic/mshyperv.h
index 9e1469c6a79031..b0e3879ff91ed5 100644
--- a/include/asm-generic/mshyperv.h
+++ b/include/asm-generic/mshyperv.h
@@ -372,18 +372,23 @@ static inline enum hv_isolation_type hv_get_isolation_type(void)
  */
 #ifndef __HV_NESTED_ON_XEN_DEFINED
 #define __HV_NESTED_ON_XEN_DEFINED
+struct irq_domain;
 #ifdef CONFIG_XEN_PV
 extern bool hyperv_nested_on_xen;
 unsigned long hv_nested_hostpfn(unsigned long pfn);
 u64 hv_nested_hostpa(void *va);
 void __init hyperv_init_nested_on_xen(void);
 int hyperv_setup_xen_vmbus_irq(void (*isr)(void));
+unsigned int hyperv_xen_vpci_vector(void);
+struct irq_domain *hyperv_xen_vpci_root_domain(void);
 #else
 #define hyperv_nested_on_xen false
 static inline unsigned long hv_nested_hostpfn(unsigned long pfn) { return pfn; }
 static inline u64 hv_nested_hostpa(void *va) { return 0; }
 static inline void hyperv_init_nested_on_xen(void) {}
 static inline int hyperv_setup_xen_vmbus_irq(void (*isr)(void)) { return -ENODEV; }
+static inline unsigned int hyperv_xen_vpci_vector(void) { return 0; }
+static inline struct irq_domain *hyperv_xen_vpci_root_domain(void) { return NULL; }
 #endif
 #endif /* __HV_NESTED_ON_XEN_DEFINED */
 
diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
index df74e65a884b6f..213919747dcce5 100644
--- a/include/xen/interface/physdev.h
+++ b/include/xen/interface/physdev.h
@@ -296,6 +296,20 @@ struct physdev_dbgp_op {
     } u;
 };
 
+/*
+ * Query the interrupt vector Xen receives Hyper-V vPCI (VMBus-assigned PCI
+ * device) MSIs on, for a hardware domain running nested under Hyper-V.  Such a
+ * device's MSI is composed by the host and delivered to the VP - which is Xen's,
+ * not ours - so we must compose every vPCI MSI with this vector and take the
+ * resulting interrupts as VIRQ_HYPERV_VPCI.  Fails with -ENODEV if Xen is not
+ * relaying Hyper-V enlightenments to this domain.
+ */
+#define PHYSDEVOP_hyperv_vpci_vector    33
+struct physdev_hyperv_vpci_vector {
+    /* OUT */
+    uint32_t vector;
+};
+
 /*
  * Notify that some PIRQ-bound event channels have been unmasked.
  * ** This command is obsolete since interface version 0x00030202 and is **
diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
index a7687ad868cae4..81236530244502 100644
--- a/include/xen/interface/xen.h
+++ b/include/xen/interface/xen.h
@@ -110,6 +110,14 @@
  */
 #define VIRQ_HYPERV_VMBUS VIRQ_ARCH_1
 #define VIRQ_ARCH_2    18
+/*
+ * Relayed Hyper-V vPCI device interrupt, for the same nested dom0: the host
+ * delivers MSIs of VMBus-assigned PCI devices to a vector Xen owns (see
+ * PHYSDEVOP_hyperv_vpci_vector), and Xen notifies us via this per-vcpu VIRQ,
+ * leaving us to demultiplex among our own vPCI devices.  Must match the Xen
+ * definition.
+ */
+#define VIRQ_HYPERV_VPCI  VIRQ_ARCH_2
 #define VIRQ_ARCH_3    19
 #define VIRQ_ARCH_4    20
 #define VIRQ_ARCH_5    21

From 5e820d9a75f8aee4a6b8d598439b9d22e1f50f77 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 16 Sep 2026 18:22:32 -0700
Subject: [PATCH 1882/1982] drivers: hv: tear down the Xen VMBus interrupt
 bridge on unwind

hyperv_setup_xen_vmbus_irq() had no counterpart, so the VIRQ_HYPERV_VMBUS
bindings it installs were never removed.  Two paths leaked them:

  - vmbus_bus_init() failing after the bridge was set up fell into the
    err_alloc unwind, which tested vmbus_irq == -1 and so called
    hv_remove_vmbus_handler() -- tearing down a native SINT handler that
    was never installed, while the per-cpu VIRQs stayed bound.

  - vmbus_exit() did the same on module unload.

Add hyperv_remove_xen_vmbus_irq(), which drops the cpuhp state and thereby
runs xen_hyperv_vmbus_cpu_down() on every cpu, and dispatch to it from both
sites before the vmbus_irq tests.  Record the cpuhp state returned by
cpuhp_setup_state() so it can be removed, and clear the stored handler when
setup fails.

Signed-off-by: Ariadne Conill <ariadne@edera.dev>
---
 arch/x86/include/asm/mshyperv.h |  2 ++
 arch/x86/xen/hyperv.c           | 20 +++++++++++++++++++-
 drivers/hv/vmbus_drv.c          |  8 ++++++--
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index f0f402f349b348..c794ddd9ac4cb7 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -78,6 +78,7 @@ unsigned long hv_nested_hostpfn(unsigned long pfn);
 u64 hv_nested_hostpa(void *va);
 void __init hyperv_init_nested_on_xen(void);
 int hyperv_setup_xen_vmbus_irq(void (*isr)(void));
+void hyperv_remove_xen_vmbus_irq(void);
 /*
  * The vector vPCI device MSIs must be composed with, and the parent irq domain
  * for them: the host delivers such an MSI to a vector Xen owns and relays it to
@@ -92,6 +93,7 @@ static inline unsigned long hv_nested_hostpfn(unsigned long pfn) { return pfn; }
 static inline u64 hv_nested_hostpa(void *va) { return 0; }
 static inline void hyperv_init_nested_on_xen(void) {}
 static inline int hyperv_setup_xen_vmbus_irq(void (*isr)(void)) { return -ENODEV; }
+static inline void hyperv_remove_xen_vmbus_irq(void) {}
 static inline unsigned int hyperv_xen_vpci_vector(void) { return 0; }
 static inline struct irq_domain *hyperv_xen_vpci_root_domain(void) { return NULL; }
 #endif
diff --git a/arch/x86/xen/hyperv.c b/arch/x86/xen/hyperv.c
index dc6c8b4b57e797..a0d9f82ebdcd25 100644
--- a/arch/x86/xen/hyperv.c
+++ b/arch/x86/xen/hyperv.c
@@ -96,6 +96,7 @@ arch_initcall(xen_hyperv_init);
  */
 static void (*xen_vmbus_handler)(void);
 static DEFINE_PER_CPU(int, xen_vmbus_irq);
+static int xen_vmbus_cpuhp_state;
 
 static irqreturn_t xen_hyperv_vmbus_isr(int irq, void *dev_id)
 {
@@ -144,8 +145,25 @@ int hyperv_setup_xen_vmbus_irq(void (*isr)(void))
 
 	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "xen/hyperv-vmbus:online",
 				xen_hyperv_vmbus_cpu_up, xen_hyperv_vmbus_cpu_down);
+	if (ret < 0) {
+		xen_vmbus_handler = NULL;
+		return ret;
+	}
+
+	xen_vmbus_cpuhp_state = ret;
+
+	return 0;
+}
+
+void hyperv_remove_xen_vmbus_irq(void)
+{
+	if (!xen_vmbus_cpuhp_state)
+		return;
 
-	return ret < 0 ? ret : 0;
+	/* Runs xen_hyperv_vmbus_cpu_down() on each cpu, unbinding the VIRQ. */
+	cpuhp_remove_state(xen_vmbus_cpuhp_state);
+	xen_vmbus_cpuhp_state = 0;
+	xen_vmbus_handler = NULL;
 }
 
 /*
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index f52940885d7458..df089830ac949e 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1519,7 +1519,9 @@ static int vmbus_bus_init(void)
 	cpuhp_remove_state(hyperv_cpuhp_online);
 err_alloc:
 	hv_synic_free();
-	if (vmbus_irq == -1) {
+	if (hyperv_nested_on_xen) {
+		hyperv_remove_xen_vmbus_irq();
+	} else if (vmbus_irq == -1) {
 		hv_remove_vmbus_handler();
 	} else {
 		free_percpu_irq(vmbus_irq, vmbus_evt);
@@ -3032,7 +3034,9 @@ static void __exit vmbus_exit(void)
 	hv_remove_crash_handler();
 	hv_stimer_global_cleanup();
 	vmbus_disconnect();
-	if (vmbus_irq == -1) {
+	if (hyperv_nested_on_xen) {
+		hyperv_remove_xen_vmbus_irq();
+	} else if (vmbus_irq == -1) {
 		hv_remove_vmbus_handler();
 	} else {
 		free_percpu_irq(vmbus_irq, vmbus_evt);

From c335fa570f82336e5d20243f9a0da501d69114e8 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 00:38:42 -0700
Subject: [PATCH 1883/1982] iommu/xen: Add Xen PV-IOMMU driver

Port of Teddy Astie's RFC v3 driver for the Xen PV-IOMMU interface. Under
Xen the IOMMU belongs to the hypervisor, so a guest cannot use anything
that needs one -- VFIO, or DMA protection of its own. The PV-IOMMU
hypercall lets it manage IOMMU contexts through Xen instead, and this
driver presents that as a normal iommu_ops.

    https://patchwork.kernel.org/project/xen-devel/list/?series=906092

Changes needed against 6.18:

  - pgsize_bitmap moved from struct iommu_ops to struct iommu_domain, so
    the mask the hypervisor reports is now stashed and applied to each
    domain as it is allocated, including the identity domain.
  - iommu_alloc_page()/iommu_free_page() are gone; the page table code uses
    iommu_alloc_pages_sz()/iommu_free_pages().

CONFIG_XEN_IOMMU still depends on XEN_DOM0, matching the interface as
posted: the hypercall names devices by machine BDF, which a guest does not
see.
---
 arch/x86/include/asm/xen/hypercall.h |   6 +
 drivers/iommu/Kconfig                |  10 +
 drivers/iommu/Makefile               |   2 +
 drivers/iommu/io-pgtable-xen.c       | 370 ++++++++++++++++++++++
 drivers/iommu/io-pgtable.c           |   3 +
 drivers/iommu/xen-iommu.c            | 446 +++++++++++++++++++++++++++
 include/linux/io-pgtable.h           |   2 +
 include/xen/interface/memory.h       |  33 ++
 include/xen/interface/pv-iommu.h     | 341 ++++++++++++++++++++
 include/xen/interface/xen.h          |   1 +
 10 files changed, 1214 insertions(+)
 create mode 100644 drivers/iommu/io-pgtable-xen.c
 create mode 100644 drivers/iommu/xen-iommu.c
 create mode 100644 include/xen/interface/pv-iommu.h

diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index a16d4631547ce1..fa7db4d3ba5c1f 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -497,6 +497,12 @@ HYPERVISOR_xenpmu_op(unsigned int op, void *arg)
 	return _hypercall2(int, xenpmu_op, op, arg);
 }
 
+static inline long
+HYPERVISOR_iommu_op(unsigned int subop, void *arg)
+{
+	return _hypercall2(int, iommu_op, subop, arg);
+}
+
 static inline int
 HYPERVISOR_dm_op(
 	domid_t dom, unsigned int nr_bufs, struct xen_dm_op_buf *bufs)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 70d29b14d85196..8ab6cd68bdcc19 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -371,6 +371,16 @@ config VIRTIO_IOMMU
 
 	  Say Y here if you intend to run this kernel as a guest.
 
+config XEN_IOMMU
+	bool "Xen IOMMU driver"
+	depends on XEN_DOM0
+	select IOMMU_API
+	select IOMMU_IO_PGTABLE
+	help
+		Xen PV-IOMMU driver for Dom0.
+
+		Say Y here if you intend to run this guest as Xen Dom0.
+
 config SPRD_IOMMU
 	tristate "Unisoc IOMMU Support"
 	depends on ARCH_SPRD || COMPILE_TEST
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 355294fa9033f3..55954056cbb0ab 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_IOMMU_IO_PGTABLE) += io-pgtable.o
 obj-$(CONFIG_IOMMU_IO_PGTABLE_ARMV7S) += io-pgtable-arm-v7s.o
 obj-$(CONFIG_IOMMU_IO_PGTABLE_LPAE) += io-pgtable-arm.o
 obj-$(CONFIG_IOMMU_IO_PGTABLE_DART) += io-pgtable-dart.o
+obj-$(CONFIG_XEN_IOMMU) += io-pgtable-xen.o
 obj-$(CONFIG_IOMMU_IOVA) += iova.o
 obj-$(CONFIG_OF_IOMMU)	+= of_iommu.o
 obj-$(CONFIG_MSM_IOMMU) += msm_iommu.o
@@ -34,3 +35,4 @@ obj-$(CONFIG_IOMMU_SVA) += iommu-sva.o
 obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
 obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
 obj-$(CONFIG_APPLE_DART) += apple-dart.o
+obj-$(CONFIG_XEN_IOMMU) += xen-iommu.o
diff --git a/drivers/iommu/io-pgtable-xen.c b/drivers/iommu/io-pgtable-xen.c
new file mode 100644
index 00000000000000..37a8668a677192
--- /dev/null
+++ b/drivers/iommu/io-pgtable-xen.c
@@ -0,0 +1,370 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Generic page table allocator for tracking purposes.
+ * Based on AMD IO pagetable allocator v2.
+ *
+ * Copyright (C) 2024 Vates SAS
+ * Author: Teddy Astie <teddy.astie@vates.tech>
+ */
+
+#define pr_fmt(fmt)	"xen-iommu pg-table: " fmt
+#define dev_fmt(fmt)	pr_fmt(fmt)
+
+#include <linux/bitops.h>
+#include <linux/io-pgtable.h>
+#include <linux/kernel.h>
+
+#include <asm/barrier.h>
+
+#include <linux/sizes.h>
+
+#include "iommu-pages.h"
+
+#include "xen/page.h"
+
+#define IOMMU_PAGE_PRESENT	BIT_ULL(0)	/* Is present */
+#define IOMMU_PAGE_HUGE		BIT_ULL(1)	/* Is hugepage */
+#define MAX_PTRS_PER_PAGE	512
+
+#define IOMMU_PAGE_SIZE_2M	BIT_ULL(21)
+#define IOMMU_PAGE_SIZE_1G	BIT_ULL(30)
+
+#define PM_ADDR_MASK		0x000ffffffffff000ULL
+#define XEN_IOMMU_PGSIZES	(XEN_PAGE_SIZE | (1ULL << 21) | (1ULL << 30))
+
+#define PAGE_MODE_NONE    0x00
+#define PAGE_MODE_1_LEVEL 0x01
+#define PAGE_MODE_2_LEVEL 0x02
+#define PAGE_MODE_3_LEVEL 0x03
+#define PAGE_MODE_4_LEVEL 0x04
+#define PAGE_MODE_5_LEVEL 0x05
+
+#define IOMMU_PTE_PR BIT(0)
+#define IOMMU_PTE_PRESENT(pte) ((pte) & IOMMU_PTE_PR)
+
+#define PM_LEVEL_SHIFT(x)	(12 + ((x) * 9))
+#define PM_LEVEL_INDEX(x, a)	(((a) >> PM_LEVEL_SHIFT((x))) & 0x1ffULL)
+
+#define IOMMU_IN_ADDR_BIT_SIZE  52
+#define IOMMU_OUT_ADDR_BIT_SIZE 52
+
+#define PAGE_SIZE_ALIGN(address, pagesize) \
+		((address) & ~((pagesize) - 1))
+
+#define io_pgtable_to_data(x) \
+	container_of((x), struct xen_io_pgtable, iop)
+
+#define io_pgtable_ops_to_data(x) \
+	io_pgtable_to_data(io_pgtable_ops_to_pgtable(x))
+
+
+struct xen_io_pgtable {
+	struct io_pgtable_cfg	pgtbl_cfg;
+	struct io_pgtable	iop;
+	u64			*pgd;	/* pgtable pgd pointer */
+};
+
+static inline bool is_large_pte(u64 pte)
+{
+	return (pte & IOMMU_PAGE_HUGE);
+}
+
+static inline u64 set_pgtable_attr(u64 *page)
+{
+	return (virt_to_phys(page) | IOMMU_PAGE_PRESENT);
+}
+
+static inline void *get_pgtable_pte(u64 pte)
+{
+	return phys_to_virt(pte & PM_ADDR_MASK);
+}
+
+static u64 set_pte_attr(u64 paddr, u64 pg_size)
+{
+	u64 pte;
+
+	pte = paddr & PM_ADDR_MASK;
+	pte |= IOMMU_PAGE_PRESENT;
+
+	/* Large page */
+	if (pg_size == IOMMU_PAGE_SIZE_1G || pg_size == IOMMU_PAGE_SIZE_2M)
+		pte |= IOMMU_PAGE_HUGE;
+
+	return pte;
+}
+
+static inline u64 get_alloc_page_size(u64 size)
+{
+	if (size >= IOMMU_PAGE_SIZE_1G)
+		return IOMMU_PAGE_SIZE_1G;
+
+	if (size >= IOMMU_PAGE_SIZE_2M)
+		return IOMMU_PAGE_SIZE_2M;
+
+	return XEN_PAGE_SIZE;
+}
+
+static inline int page_size_to_level(u64 pg_size)
+{
+	if (pg_size == IOMMU_PAGE_SIZE_1G)
+		return PAGE_MODE_3_LEVEL;
+	if (pg_size == IOMMU_PAGE_SIZE_2M)
+		return PAGE_MODE_2_LEVEL;
+
+	return PAGE_MODE_1_LEVEL;
+}
+
+static void free_pgtable(u64 *pt, int level)
+{
+	u64 *p;
+	int i;
+
+	for (i = 0; i < MAX_PTRS_PER_PAGE; i++) {
+		/* PTE present? */
+		if (!IOMMU_PTE_PRESENT(pt[i]))
+			continue;
+
+		if (is_large_pte(pt[i]))
+			continue;
+
+		/*
+		 * Free the next level. No need to look at l1 tables here since
+		 * they can only contain leaf PTEs; just free them directly.
+		 */
+		p = get_pgtable_pte(pt[i]);
+		if (level > 2)
+			free_pgtable(p, level - 1);
+		else
+			iommu_free_pages(p);
+	}
+
+	iommu_free_pages(pt);
+}
+
+/* Allocate page table */
+static u64 *xen_alloc_pte(u64 *pgd, unsigned long iova, gfp_t gfp,
+			  unsigned long pg_size, bool *updated)
+{
+	u64 *pte, *page;
+	int level, end_level;
+
+	level = PAGE_MODE_5_LEVEL - 1;
+	end_level = page_size_to_level(pg_size);
+	pte = &pgd[PM_LEVEL_INDEX(level, iova)];
+	iova = PAGE_SIZE_ALIGN(iova, XEN_PAGE_SIZE);
+
+	while (level >= end_level) {
+		u64 __pte, __npte;
+
+		__pte = *pte;
+
+		if (IOMMU_PTE_PRESENT(__pte) && is_large_pte(__pte)) {
+			/* Unmap large pte */
+			cmpxchg64(pte, *pte, 0ULL);
+			*updated = true;
+			continue;
+		}
+
+		if (!IOMMU_PTE_PRESENT(__pte)) {
+			page = iommu_alloc_pages_sz(gfp, SZ_4K);
+			if (!page)
+				return NULL;
+
+			__npte = set_pgtable_attr(page);
+			/* pte could have been changed somewhere. */
+			if (cmpxchg64(pte, __pte, __npte) != __pte)
+				iommu_free_pages(page);
+			else if (IOMMU_PTE_PRESENT(__pte))
+				*updated = true;
+
+			continue;
+		}
+
+		level -= 1;
+		pte = get_pgtable_pte(__pte);
+		pte = &pte[PM_LEVEL_INDEX(level, iova)];
+	}
+
+	/* Tear down existing pte entries */
+	if (IOMMU_PTE_PRESENT(*pte)) {
+		u64 *__pte;
+
+		*updated = true;
+		__pte = get_pgtable_pte(*pte);
+		cmpxchg64(pte, *pte, 0ULL);
+		if (pg_size == IOMMU_PAGE_SIZE_1G)
+			free_pgtable(__pte, end_level - 1);
+		else if (pg_size == IOMMU_PAGE_SIZE_2M)
+			iommu_free_pages(__pte);
+	}
+
+	return pte;
+}
+
+/*
+ * This function checks if there is a PTE for a given dma address.
+ * If there is one, it returns the pointer to it.
+ */
+static u64 *fetch_pte(struct xen_io_pgtable *pgtable, unsigned long iova,
+		      unsigned long *page_size)
+{
+	u64 *pte;
+	int level;
+
+	level = PAGE_MODE_5_LEVEL - 1;
+	pte = &pgtable->pgd[PM_LEVEL_INDEX(level, iova)];
+	/* Default page size is 4K */
+	*page_size = XEN_PAGE_SIZE;
+
+	while (level) {
+		/* Not present */
+		if (!IOMMU_PTE_PRESENT(*pte))
+			return NULL;
+
+		/* Walk to the next level */
+		pte = get_pgtable_pte(*pte);
+		pte = &pte[PM_LEVEL_INDEX(level - 1, iova)];
+
+		/* Large page */
+		if (is_large_pte(*pte)) {
+			if (level == PAGE_MODE_3_LEVEL)
+				*page_size = IOMMU_PAGE_SIZE_1G;
+			else if (level == PAGE_MODE_2_LEVEL)
+				*page_size = IOMMU_PAGE_SIZE_2M;
+			else
+				return NULL;	/* Wrongly set PSE bit in PTE */
+
+			break;
+		}
+
+		level -= 1;
+	}
+
+	return pte;
+}
+
+static int iommu_xen_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
+			       phys_addr_t paddr, size_t pgsize, size_t pgcount,
+			       int prot, gfp_t gfp, size_t *mapped)
+{
+	struct xen_io_pgtable *pgtable = io_pgtable_ops_to_data(ops);	
+	struct io_pgtable_cfg *cfg = &pgtable->pgtbl_cfg;
+	u64 *pte;
+	unsigned long map_size;
+	unsigned long mapped_size = 0;
+	size_t size = pgcount << __ffs(pgsize);
+	int ret = 0;
+	bool updated = false;
+
+	if (WARN_ON(!pgsize || (pgsize & cfg->pgsize_bitmap) != pgsize) || !pgcount)
+		return -EINVAL;
+
+	while (mapped_size < size) {
+		map_size = get_alloc_page_size(pgsize);
+		pte = xen_alloc_pte(pgtable->pgd, iova, gfp, map_size, &updated);
+		if (!pte) {
+			ret = -ENOMEM;
+			goto out;
+		}
+
+		*pte = set_pte_attr(paddr, map_size);
+
+		iova += map_size;
+		paddr += map_size;
+		mapped_size += map_size;
+	}
+
+out:
+	if (mapped)
+		*mapped += mapped_size;
+
+	return ret;
+}
+
+static unsigned long iommu_xen_unmap_pages(struct io_pgtable_ops *ops,
+					   unsigned long iova,
+					   size_t pgsize, size_t pgcount,
+					   struct iommu_iotlb_gather *gather)
+{
+	struct xen_io_pgtable *pgtable = io_pgtable_ops_to_data(ops);
+	struct io_pgtable_cfg *cfg = &pgtable->iop.cfg;
+	unsigned long unmap_size;
+	unsigned long unmapped = 0;
+	size_t size = pgcount << __ffs(pgsize);
+	u64 *pte;
+
+	if (WARN_ON(!pgsize || (pgsize & cfg->pgsize_bitmap) != pgsize || !pgcount))
+		return 0;
+
+	while (unmapped < size) {
+		pte = fetch_pte(pgtable, iova, &unmap_size);
+		if (!pte)
+			return unmapped;
+
+		*pte = 0ULL;
+
+		iova = (iova & ~(unmap_size - 1)) + unmap_size;
+		unmapped += unmap_size;
+	}
+
+	return unmapped;
+}
+
+static phys_addr_t iommu_xen_iova_to_phys(struct io_pgtable_ops *ops, unsigned long iova)
+{
+	struct xen_io_pgtable *pgtable = io_pgtable_ops_to_data(ops);
+	unsigned long offset_mask, pte_pgsize;
+	u64 *pte, __pte;
+
+	pte = fetch_pte(pgtable, iova, &pte_pgsize);
+	if (!pte || !IOMMU_PTE_PRESENT(*pte))
+		return 0;
+
+	offset_mask = pte_pgsize - 1;
+	__pte = *pte & PM_ADDR_MASK;
+
+	return (__pte & ~offset_mask) | (iova & offset_mask);
+}
+
+static void xen_free_pgtable(struct io_pgtable *iop)
+{
+	struct xen_io_pgtable *pgtable = container_of(iop, struct xen_io_pgtable, iop);
+
+	if (!pgtable || !pgtable->pgd)
+		return;
+
+	/* Free page table */
+	free_pgtable(pgtable->pgd, PAGE_MODE_5_LEVEL);
+	kfree(pgtable);
+}
+
+static struct io_pgtable *xen_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie)
+{
+	struct xen_io_pgtable *pgtable = kmalloc(sizeof(struct xen_io_pgtable),
+						 GFP_KERNEL);
+	if (!pgtable)
+		return NULL;
+
+	pgtable->pgd = iommu_alloc_pages_sz(GFP_KERNEL, SZ_4K);
+	if (!pgtable->pgd) {
+		kfree(pgtable);
+		return NULL;
+	}
+
+	pgtable->iop.ops.map_pages    = iommu_xen_map_pages;
+	pgtable->iop.ops.unmap_pages  = iommu_xen_unmap_pages;
+	pgtable->iop.ops.iova_to_phys = iommu_xen_iova_to_phys;
+
+	cfg->pgsize_bitmap = XEN_IOMMU_PGSIZES;
+	cfg->ias           = IOMMU_IN_ADDR_BIT_SIZE;
+	cfg->oas           = IOMMU_OUT_ADDR_BIT_SIZE;
+
+	pgtable->pgtbl_cfg = *cfg;
+
+	return &pgtable->iop;
+}
+
+struct io_pgtable_init_fns io_pgtable_xen_init_fns = {
+	.alloc	= xen_alloc_pgtable,
+	.free	= xen_free_pgtable,
+};
diff --git a/drivers/iommu/io-pgtable.c b/drivers/iommu/io-pgtable.c
index 8841c1487f0048..763f6c34db73dc 100644
--- a/drivers/iommu/io-pgtable.c
+++ b/drivers/iommu/io-pgtable.c
@@ -32,6 +32,9 @@ io_pgtable_init_table[IO_PGTABLE_NUM_FMTS] = {
 	[AMD_IOMMU_V1] = &io_pgtable_amd_iommu_v1_init_fns,
 	[AMD_IOMMU_V2] = &io_pgtable_amd_iommu_v2_init_fns,
 #endif
+#ifdef CONFIG_XEN_IOMMU
+	[XEN_IOMMU_GENERIC] = &io_pgtable_xen_init_fns,
+#endif
 };
 
 static int check_custom_allocator(enum io_pgtable_fmt fmt,
diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
new file mode 100644
index 00000000000000..1ea66aeda09633
--- /dev/null
+++ b/drivers/iommu/xen-iommu.c
@@ -0,0 +1,446 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Xen PV-IOMMU driver.
+ *
+ * Copyright (C) 2024 Vates SAS
+ *
+ * Author: Teddy Astie <teddy.astie@vates.tech>
+ *
+ */
+
+#define pr_fmt(fmt)	"xen-iommu: " fmt
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/iommu.h>
+#include <linux/pci.h>
+#include <linux/printk.h>
+#include <linux/stddef.h>
+#include <linux/minmax.h>
+#include <linux/io-pgtable.h>
+
+#include <xen/xen.h>
+#include <xen/page.h>
+#include <xen/interface/memory.h>
+#include <xen/interface/pv-iommu.h>
+#include <asm/xen/hypercall.h>
+#include <asm/xen/page.h>
+
+MODULE_DESCRIPTION("Xen IOMMU driver");
+MODULE_AUTHOR("Teddy Astie <teddy.astie@vates.tech>");
+MODULE_LICENSE("GPL");
+
+#define MSI_RANGE_START		(0xfee00000)
+#define MSI_RANGE_END		(0xfeefffff)
+
+struct xen_iommu_domain {
+	struct iommu_domain domain;
+
+	u16 ctx_no;			/* Xen PV-IOMMU context number */
+	struct io_pgtable_ops *pgtable;	/* Parralel page table for iova_to_phys */
+};
+
+static struct iommu_device xen_iommu_device;
+static struct pv_iommu_capabilities caps;
+
+static struct xen_iommu_domain xen_iommu_identity_domain;
+static unsigned long xen_iommu_pgsize_bitmap = XEN_PAGE_SIZE;
+static bool map_single_pages = false;
+
+static inline struct xen_iommu_domain *to_xen_iommu_domain(struct iommu_domain *dom)
+{
+	return container_of(dom, struct xen_iommu_domain, domain);
+}
+
+static inline u64 addr_to_pfn(u64 addr)
+{
+	return addr >> 12;
+}
+
+static inline u64 pfn_to_addr(u64 pfn)
+{
+	return pfn << 12;
+}
+
+static bool xen_iommu_capable(struct device *dev, enum iommu_cap cap)
+{
+	switch (cap) {
+	case IOMMU_CAP_CACHE_COHERENCY:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
+static struct iommu_domain *xen_iommu_domain_alloc_paging(struct device *dev)
+{
+	struct xen_iommu_domain *domain;
+	struct io_pgtable_cfg cfg = { .alloc = NULL, .free = NULL };
+	struct io_pgtable_ops *pgtable;
+	int ret;
+
+	struct pv_iommu_alloc alloc = { .alloc_flags = 0 };
+
+	domain = kzalloc(sizeof(*domain), GFP_KERNEL);
+	if (!domain)
+		return ERR_PTR(-ENOMEM);
+
+	pgtable = alloc_io_pgtable_ops(XEN_IOMMU_GENERIC, &cfg, NULL);
+	if (!pgtable) {
+		kfree(domain);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ret = HYPERVISOR_iommu_op(IOMMU_alloc_context, &alloc);
+
+	if (ret) {
+		pr_err("Unable to create Xen IOMMU context (%d)", ret);
+		kfree(domain);
+		free_io_pgtable_ops(pgtable);
+		return ERR_PTR(ret);
+	}
+
+	domain->ctx_no = alloc.ctx_no;
+	domain->pgtable = pgtable;
+
+	domain->domain.pgsize_bitmap = xen_iommu_pgsize_bitmap;
+	domain->domain.geometry = (struct iommu_domain_geometry){
+		.aperture_start = 0,
+		.aperture_end = caps.max_iova_addr,
+		.force_aperture = true,
+	};
+
+	return &domain->domain;
+}
+
+static struct iommu_device *xen_iommu_probe_device(struct device *dev)
+{
+	if (!dev_is_pci(dev))
+		return ERR_PTR(-ENODEV);
+
+	return &xen_iommu_device;
+}
+
+static int xen_iommu_map_pages(struct iommu_domain *domain, unsigned long iova,
+			       phys_addr_t paddr, size_t pgsize, size_t pgcount,
+			       int prot, gfp_t gfp, size_t *mapped)
+{
+	int ret = 0;
+	size_t _mapped; /* for pgtable callback */
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+	struct pv_iommu_map_pages map = {
+		.ctx_no = dom->ctx_no,
+		.pgsize = pgsize,
+		.map_flags = 0,
+		.mapped = 0,
+	};
+
+	/* NOTE: paddr is actually bound to pfn, not gfn */
+	uint64_t pfn0 = addr_to_pfn(paddr);
+	uint64_t dfn0 = addr_to_pfn(iova);
+
+	if (prot & IOMMU_READ)
+		map.map_flags |= IOMMU_MAP_readable;
+
+	if (prot & IOMMU_WRITE)
+		map.map_flags |= IOMMU_MAP_writeable;
+
+	if (prot & IOMMU_CACHE)
+		map.map_flags |= IOMMU_MAP_cache;
+
+	if (map_single_pages) {
+		size_t i = 0;
+		map.nr_pages = 1;
+
+		for (; i < pgcount; i++) {
+			map.gfn = pfn_to_gfn(pfn0 + i);
+			map.dfn = dfn0 + i;
+			map.nr_pages = 1;
+
+			ret = HYPERVISOR_iommu_op(IOMMU_map_pages, &map);
+
+			if (ret)
+				break;
+		}
+	} else {
+		map.nr_pages = pgcount;
+		map.gfn = pfn_to_gfn(pfn0);
+		map.dfn = dfn0;
+
+		ret = HYPERVISOR_iommu_op(IOMMU_map_pages, &map);
+	}
+
+	if (mapped)
+		*mapped = pgsize * map.mapped;
+
+	dom->pgtable->map_pages(dom->pgtable, iova, paddr, pgsize, pgcount,
+				prot, gfp, &_mapped);
+
+	return ret;
+}
+
+static size_t xen_iommu_unmap_pages(struct iommu_domain *domain, unsigned long iova,
+				    size_t pgsize, size_t pgcount,
+				    struct iommu_iotlb_gather *iotlb_gather)
+{
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+	struct pv_iommu_unmap_pages unmap = {
+		.ctx_no = dom->ctx_no,
+		.pgsize = pgsize,
+		.unmapped = 0,
+		.nr_pages = pgcount,
+		.dfn = addr_to_pfn(iova),
+	};
+
+	WARN_ON(HYPERVISOR_iommu_op(IOMMU_unmap_pages, &unmap));
+	dom->pgtable->unmap_pages(dom->pgtable, iova, pgsize, pgcount,
+				  iotlb_gather);
+
+	return unmap.unmapped * pgsize;
+}
+
+static int xen_iommu_attach_dev(struct iommu_domain *domain, struct device *dev)
+{
+	struct pci_dev *pdev;
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+	struct pv_iommu_reattach_device reattach = {
+		.ctx_no = dom->ctx_no,
+		.pasid = 0,
+	};
+
+	pdev = to_pci_dev(dev);
+
+	reattach.dev.seg = pci_domain_nr(pdev->bus);
+	reattach.dev.bus = pdev->bus->number;
+	reattach.dev.devfn = pdev->devfn;
+
+	return HYPERVISOR_iommu_op(IOMMU_reattach_device, &reattach);
+}
+
+static void xen_iommu_free(struct iommu_domain *domain)
+{
+	int ret;
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+	struct pv_iommu_free op = {
+		.ctx_no = dom->ctx_no,
+		.free_flags = 0,
+	};
+
+	ret = HYPERVISOR_iommu_op(IOMMU_free_context, &op);
+
+	if (ret)
+		pr_err("Context %hu destruction failure\n", dom->ctx_no);
+
+	free_io_pgtable_ops(dom->pgtable);
+
+	kfree(domain);
+}
+
+static phys_addr_t xen_iommu_iova_to_phys(struct iommu_domain *domain, dma_addr_t iova)
+{
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+
+	if (!dom->ctx_no)
+		/* If default domain is identity, phys_addr is iova. */
+		return (caps.cap_flags & IOMMUCAP_default_identity) ? iova : 0;
+	
+	return dom->pgtable->iova_to_phys(dom->pgtable, iova);
+}
+
+static void xen_iommu_get_resv_regions(struct device *dev, struct list_head *head)
+{
+	struct iommu_resv_region *reg;
+	struct xen_reserved_device_memory *entries;
+	struct xen_reserved_device_memory_map map;
+	struct pci_dev *pdev;
+	int ret, i;
+
+	pdev = to_pci_dev(dev);
+
+	reg = iommu_alloc_resv_region(MSI_RANGE_START,
+				      MSI_RANGE_END - MSI_RANGE_START + 1,
+				      0, IOMMU_RESV_MSI, GFP_KERNEL);
+
+	if (!reg)
+		return;
+
+	list_add_tail(&reg->list, head);
+
+	/* Map xen-specific entries */
+
+	/* First, get number of entries to map */
+	map.buffer = NULL;
+	map.nr_entries = 0;
+	map.flags = 0;
+
+	map.dev.pci.seg = pci_domain_nr(pdev->bus);
+	map.dev.pci.bus = pdev->bus->number;
+	map.dev.pci.devfn = pdev->devfn;
+
+	ret = HYPERVISOR_memory_op(XENMEM_reserved_device_memory_map, &map);
+
+	if (ret == 0)
+		/* No reserved region, nothing to do */
+		return;
+
+	if (ret != -ENOBUFS) {
+		pr_err("Unable to get reserved region count (%d)\n", ret);
+		return;
+	}
+
+	/* Assume a reasonable number of entries, otherwise, something is probably wrong */
+	if (WARN_ON(map.nr_entries > 256))
+		pr_warn("Xen reporting many reserved regions (%u)\n", map.nr_entries);
+
+	/* And finally get actual mappings */
+	entries = kcalloc(map.nr_entries, sizeof(struct xen_reserved_device_memory),
+					  GFP_KERNEL);
+
+	if (!entries) {
+		pr_err("No memory for map entries\n");
+		return;
+	}
+
+	map.buffer = entries;
+
+	ret = HYPERVISOR_memory_op(XENMEM_reserved_device_memory_map, &map);
+
+	if (ret != 0) {
+		pr_err("Unable to get reserved regions (%d)\n", ret);
+		kfree(entries);
+		return;
+	}
+
+	for (i = 0; i < map.nr_entries; i++) {
+		struct xen_reserved_device_memory entry = entries[i];
+
+		reg = iommu_alloc_resv_region(pfn_to_addr(entry.start_pfn),
+					      pfn_to_addr(entry.nr_pages),
+					      0, IOMMU_RESV_RESERVED, GFP_KERNEL);
+
+		if (!reg)
+			break;
+
+		list_add_tail(&reg->list, head);
+	}
+
+	kfree(entries);
+}
+
+static struct iommu_ops xen_iommu_ops = {
+	.identity_domain = &xen_iommu_identity_domain.domain,
+	.release_domain = &xen_iommu_identity_domain.domain,
+	.capable = xen_iommu_capable,
+	.domain_alloc_paging = xen_iommu_domain_alloc_paging,
+	.probe_device = xen_iommu_probe_device,
+	.device_group = pci_device_group,
+	.get_resv_regions = xen_iommu_get_resv_regions,
+	.default_domain_ops = &(const struct iommu_domain_ops) {
+		.map_pages = xen_iommu_map_pages,
+		.unmap_pages = xen_iommu_unmap_pages,
+		.attach_dev = xen_iommu_attach_dev,
+		.iova_to_phys = xen_iommu_iova_to_phys,
+		.free = xen_iommu_free,
+	},
+};
+
+static int __init xen_iommu_init(void)
+{
+	long ret;
+
+	if (!xen_domain())
+		return -ENODEV;
+
+	/* Check if iommu_op is supported */
+	if ((ret = HYPERVISOR_iommu_op(IOMMU_query_capabilities, &caps)))
+	{
+		pr_err("Unable to query capabilities (%ld)", ret);
+		return -ENODEV; /* No Xen IOMMU hardware */
+	}
+
+	/* If ctx_no is zero, it may be due to PV-IOMMU not being initialized. */
+	if (!caps.max_ctx_no)
+	{
+		/* Try to initialize PV-IOMMU */
+		struct pv_iommu_init init;
+
+		pr_info("Got no usable context, try initializing PV-IOMMU\n");
+
+		/* FIXME: Don't hardcode this */
+		init.max_ctx_no = 128;
+		init.arena_order = 12;
+
+		pr_info("init.max_ctx_no=%hu\n", init.max_ctx_no);
+		pr_info("init.arena_order=%hu\n", init.arena_order);
+
+		/* Try to initialize PV-IOMMU */
+		ret = HYPERVISOR_iommu_op(IOMMU_init, &init);
+
+		if (ret == -EACCES) {
+			/* PV-IOMMU being already initialized often means not allowed. */
+			pr_warn("PV-IOMMU is already initialized, guest may not be allowed to use PV-IOMMU\n");
+			return -EACCES;
+		} else if (ret) {
+			pr_err("PV-IOMMU initialization failure (%ld)", ret);
+			return ret;
+		}
+
+		WARN_ON(HYPERVISOR_iommu_op(IOMMU_query_capabilities, &caps));
+	}
+
+	pr_info("Initialising Xen IOMMU driver\n");
+	pr_info("max_ctx_no=%hu\n", caps.max_ctx_no);
+	pr_info("max_iova_addr=%llx\n", caps.max_iova_addr);
+	pr_info("pgsize_mask=%d\n", caps.pgsize_mask);
+	pr_info("default_identity=%c\n", (caps.cap_flags & IOMMUCAP_default_identity) ? 'y' : 'n');
+	pr_info("cache=%c\n", (caps.cap_flags & IOMMUCAP_cache) ? 'y' : 'n');
+
+	if (caps.max_ctx_no == 0) {
+		pr_err("Unable to use IOMMU PV driver (no context available ?)\n");
+		return -ENOTSUPP; /* Unable to use IOMMU PV ? */
+	}
+
+	xen_iommu_pgsize_bitmap = caps.pgsize_mask;
+
+	if (xen_domain_type == XEN_PV_DOMAIN)
+		/* TODO: In PV domain, due to the existing pfn-gfn mapping we need to
+		 * consider that under certains circonstances, we have :
+		 *   pfn_to_gfn(x + 1) != pfn_to_gfn(x) + 1
+		 *
+		 * In these cases, we would want to separate the subop into several calls.
+		 * (only doing the grouped operation when the mapping is actually contigous)
+		 * Only map operation would be affected, as unmap actually uses dfn which
+		 * doesn't have this kind of mapping.
+		 *
+		 * Force single-page operations to work arround this issue for now.
+		 */
+		map_single_pages = true;
+
+	/* Initialize identity domain */
+	xen_iommu_identity_domain.ctx_no = 0;
+
+	xen_iommu_identity_domain.domain.pgsize_bitmap = xen_iommu_pgsize_bitmap;
+	xen_iommu_identity_domain.domain.geometry = (struct iommu_domain_geometry){
+		.aperture_start = 0,
+		.aperture_end = caps.max_iova_addr,
+		.force_aperture = true,
+	};
+
+	ret = iommu_device_sysfs_add(&xen_iommu_device, NULL, NULL, "xen-iommu");
+	if (ret) {
+		pr_err("Unable to add Xen IOMMU sysfs\n");
+		return ret;
+	}
+
+	ret = iommu_device_register(&xen_iommu_device, &xen_iommu_ops, NULL);
+	if (ret) {
+		pr_err("Unable to register Xen IOMMU device %ld\n", ret);
+		iommu_device_sysfs_remove(&xen_iommu_device);
+		return ret;
+	}
+
+	return 0;
+}
+
+module_init(xen_iommu_init);
diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h
index 8a823c6f2b4a88..7814114f053738 100644
--- a/include/linux/io-pgtable.h
+++ b/include/linux/io-pgtable.h
@@ -19,6 +19,7 @@ enum io_pgtable_fmt {
 	AMD_IOMMU_V2,
 	APPLE_DART,
 	APPLE_DART2,
+	XEN_IOMMU_GENERIC,
 	IO_PGTABLE_NUM_FMTS,
 };
 
@@ -325,5 +326,6 @@ extern struct io_pgtable_init_fns io_pgtable_arm_mali_lpae_init_fns;
 extern struct io_pgtable_init_fns io_pgtable_amd_iommu_v1_init_fns;
 extern struct io_pgtable_init_fns io_pgtable_amd_iommu_v2_init_fns;
 extern struct io_pgtable_init_fns io_pgtable_apple_dart_init_fns;
+extern struct io_pgtable_init_fns io_pgtable_xen_init_fns;
 
 #endif /* __IO_PGTABLE_H */
diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
index 1a371a825c5596..c860acaf4b0ee3 100644
--- a/include/xen/interface/memory.h
+++ b/include/xen/interface/memory.h
@@ -10,6 +10,7 @@
 #ifndef __XEN_PUBLIC_MEMORY_H__
 #define __XEN_PUBLIC_MEMORY_H__
 
+#include <xen/interface/physdev.h>
 #include <linux/spinlock.h>
 
 /*
@@ -214,6 +215,38 @@ struct xen_add_to_physmap_range {
 };
 DEFINE_GUEST_HANDLE_STRUCT(xen_add_to_physmap_range);
 
+/*
+ * With some legacy devices, certain guest-physical addresses cannot safely
+ * be used for other purposes, e.g. to map guest RAM.  This hypercall
+ * enumerates those regions so the toolstack can avoid using them.
+ */
+#define XENMEM_reserved_device_memory_map   27
+struct xen_reserved_device_memory {
+    xen_pfn_t start_pfn;
+    xen_ulong_t nr_pages;
+};
+DEFINE_GUEST_HANDLE_STRUCT(xen_reserved_device_memory);
+
+struct xen_reserved_device_memory_map {
+#define XENMEM_RDM_ALL 1 /* Request all regions (ignore dev union). */
+    /* IN */
+    uint32_t flags;
+    /*
+     * IN/OUT
+     *
+     * Gets set to the required number of entries when too low,
+     * signaled by error code -ERANGE.
+     */
+    unsigned int nr_entries;
+    /* OUT */
+    GUEST_HANDLE(xen_reserved_device_memory) buffer;
+    /* IN */
+    union {
+        struct physdev_pci_device pci;
+    } dev;
+};
+DEFINE_GUEST_HANDLE_STRUCT(xen_reserved_device_memory_map);
+
 /*
  * Returns the pseudo-physical memory map as it was when the domain
  * was started (specified by XENMEM_set_memory_map).
diff --git a/include/xen/interface/pv-iommu.h b/include/xen/interface/pv-iommu.h
new file mode 100644
index 00000000000000..a4a470319486a4
--- /dev/null
+++ b/include/xen/interface/pv-iommu.h
@@ -0,0 +1,341 @@
+/* SPDX-License-Identifier: MIT */
+/**
+ * pv-iommu.h
+ *
+ * Paravirtualized IOMMU driver interface.
+ *
+ * Copyright (c) 2024 Teddy Astie <teddy.astie@vates.tech>
+ */
+
+#ifndef __XEN_PUBLIC_PV_IOMMU_H__
+#define __XEN_PUBLIC_PV_IOMMU_H__
+
+#include "xen.h"
+#include "physdev.h"
+
+#ifndef uint64_aligned_t
+#define uint64_aligned_t uint64_t
+#endif
+
+#define IOMMU_DEFAULT_CONTEXT (0)
+
+enum {
+    /* Basic cmd */
+    IOMMU_noop = 0,
+    IOMMU_query_capabilities,
+    IOMMU_init,
+    IOMMU_alloc_context,
+    IOMMU_free_context,
+    IOMMU_reattach_device,
+    IOMMU_map_pages,
+    IOMMU_unmap_pages,
+    IOMMU_remote_cmd,
+
+    /* Extended cmd */
+    IOMMU_alloc_nested,     /* if IOMMUCAP_nested */
+    IOMMU_flush_nested,     /* if IOMMUCAP_nested */
+    IOMMU_attach_pasid,     /* if IOMMUCAP_pasid */
+    IOMMU_detach_pasid,     /* if IOMMUCAP_pasid */
+};
+
+/**
+ * Indicate if the default context is a identity mapping to domain memory.
+ * If not defined, default context blocks all DMA to domain memory.
+ */
+#define IOMMUCAP_default_identity  (1 << 0)
+
+/**
+ * IOMMU_MAP_cache support.
+ */
+#define IOMMUCAP_cache     (1 << 1)
+
+/**
+ * Support for IOMMU_alloc_nested.
+ */
+#define IOMMUCAP_nested    (1 << 2)
+
+/**
+ * Support for IOMMU_attach_pasid and IOMMU_detach_pasid and pasid parameter in
+ * reattach_context.
+ */
+#define IOMMUCAP_pasid     (1 << 3)
+
+/**
+ * Support for IOMMU_ALLOC_identity
+ */
+#define IOMMUCAP_identity (1 << 4)
+
+/**
+ * IOMMU_query_capabilities
+ * Query PV-IOMMU capabilities for this domain.
+ */
+struct pv_iommu_capabilities {
+    /*
+     * OUT: Maximum device address (iova) that the guest can use for mappings.
+     */
+    uint64_aligned_t max_iova_addr;
+
+    /* OUT: IOMMU capabilities flags */
+    uint32_t cap_flags;
+
+    /* OUT: Mask of all supported page sizes. */
+    uint32_t pgsize_mask;
+
+    /* OUT: Maximum pasid (if IOMMUCAP_pasid) */
+    uint32_t max_pasid;
+
+    /* OUT: Maximum number of IOMMU context this domain can use. */
+    uint16_t max_ctx_no;
+};
+typedef struct pv_iommu_capabilities pv_iommu_capabilities_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_capabilities_t);
+
+/**
+ * IOMMU_init
+ * Initialize PV-IOMMU for this domain.
+ *
+ * Fails with -EACCESS if PV-IOMMU is already initialized.
+ */
+struct pv_iommu_init {
+    /* IN: Maximum number of IOMMU context this domain can use. */
+    uint32_t max_ctx_no;
+
+    /* IN: Arena size in pages (in power of two) */
+    uint32_t arena_order;
+};
+typedef struct pv_iommu_init pv_iommu_init_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_init_t);
+
+/**
+ * Create a 1:1 identity mapped context to domain memory
+ * (needs IOMMUCAP_identity).
+ */
+#define IOMMU_ALLOC_identity (1 << 0)
+
+/**
+ * IOMMU_alloc_context
+ * Allocate an IOMMU context.
+ * Fails with -ENOSPC if no context number is available.
+ */
+struct pv_iommu_alloc {
+    /* OUT: allocated IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: allocation flags */
+    uint32_t alloc_flags;
+};
+typedef struct pv_iommu_alloc pv_iommu_alloc_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_alloc_t);
+
+/**
+ * Move all devices to default context before freeing the context.
+ */
+#define IOMMU_FREE_reattach_default (1 << 0)
+
+/**
+ * IOMMU_free_context
+ * Destroy a IOMMU context.
+ *
+ * If IOMMU_FREE_reattach_default is specified, move all context devices to
+ * default context before destroying this context.
+ *
+ * If there are devices in the context and IOMMU_FREE_reattach_default is not
+ * specified, fail with -EBUSY.
+ *
+ * The default context can't be destroyed.
+ */
+struct pv_iommu_free {
+    /* IN: IOMMU context number to free */
+    uint16_t ctx_no;
+
+    /* IN: Free operation specific flags */
+    uint32_t free_flags;
+};
+typedef struct pv_iommu_free pv_iommu_free_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_free_t);
+
+/* Device has read access */
+#define IOMMU_MAP_readable (1 << 0)
+
+/* Device has write access */
+#define IOMMU_MAP_writeable (1 << 1)
+
+/* Enforce DMA coherency */
+#define IOMMU_MAP_cache (1 << 2)
+
+/**
+ * IOMMU_map_pages
+ * Map pages on a IOMMU context.
+ *
+ * pgsize must be supported by pgsize_mask.
+ * Fails with -EINVAL if mapping on top of another mapping.
+ * Report actually mapped page count in mapped field (regardless of failure).
+ */
+struct pv_iommu_map_pages {
+    /* IN: IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: Guest frame number */
+    uint64_aligned_t gfn;
+
+    /* IN: Device frame number */
+    uint64_aligned_t dfn;
+
+    /* IN: Map flags */
+    uint32_t map_flags;
+
+    /* IN: Size of pages to map */
+    uint32_t pgsize;
+
+    /* IN: Number of pages to map */
+    uint32_t nr_pages;
+
+    /* OUT: Number of pages actually mapped */
+    uint32_t mapped;
+};
+typedef struct pv_iommu_map_pages pv_iommu_map_pages_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_map_pages_t);
+
+/**
+ * IOMMU_unmap_pages
+ * Unmap pages on a IOMMU context.
+ *
+ * pgsize must be supported by pgsize_mask.
+ * Report actually unmapped page count in mapped field (regardless of failure).
+ * Fails with -ENOENT when attempting to unmap a page without any mapping
+ */
+struct pv_iommu_unmap_pages {
+    /* IN: IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: Device frame number */
+    uint64_aligned_t dfn;
+
+    /* IN: Size of pages to unmap */
+    uint32_t pgsize;
+
+    /* IN: Number of pages to unmap */
+    uint32_t nr_pages;
+
+    /* OUT: Number of pages actually unmapped */
+    uint32_t unmapped;
+};
+typedef struct pv_iommu_unmap_pages pv_iommu_unmap_pages_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_unmap_pages_t);
+
+/**
+ * IOMMU_reattach_device
+ * Reattach a device to another IOMMU context.
+ * Fails with -ENODEV if no such device exist.
+ */
+struct pv_iommu_reattach_device {
+    /* IN: Target IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: Physical device to move */
+    struct physdev_pci_device dev;
+
+    /* IN: PASID of the device (if IOMMUCAP_pasid) */
+    uint32_t pasid;
+};
+typedef struct pv_iommu_reattach_device pv_iommu_reattach_device_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_reattach_device_t);
+
+
+/**
+ * IOMMU_remote_cmd
+ * Do a PV-IOMMU operation on another domain.
+ * Current domain needs to be allowed to act on the target domain, otherwise
+ * fails with -EPERM.
+ */
+struct pv_iommu_remote_cmd {
+    /* IN: Target domain to do the subop on */
+    uint16_t domid;
+
+    /* IN: Command to do on target domain. */
+    uint16_t subop;
+
+    /* INOUT: Command argument from current domain memory */
+    GUEST_HANDLE(void) arg;
+};
+typedef struct pv_iommu_remote_cmd pv_iommu_remote_cmd_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_remote_cmd_t);
+
+/**
+ * IOMMU_alloc_nested
+ * Create a nested IOMMU context (needs IOMMUCAP_nested).
+ *
+ * This context uses a platform-specific page table from domain address space
+ * specified in pgtable_gfn and use it for nested translations.
+ *
+ * Explicit flushes needs to be submited with IOMMU_flush_nested on
+ * modification of the nested pagetable to ensure coherency between IOTLB and
+ * nested page table.
+ *
+ * This context can be destroyed using IOMMU_free_context.
+ * This context cannot be modified using map_pages, unmap_pages.
+ */
+struct pv_iommu_alloc_nested {
+    /* OUT: allocated IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: guest frame number of the nested page table */
+    uint64_aligned_t pgtable_gfn;
+
+    /* IN: nested mode flags */
+    uint64_aligned_t nested_flags;
+};
+typedef struct pv_iommu_alloc_nested pv_iommu_alloc_nested_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_alloc_nested_t);
+
+/**
+ * IOMMU_flush_nested (needs IOMMUCAP_nested)
+ * Flush the IOTLB for nested translation.
+ */
+struct pv_iommu_flush_nested {
+    /* TODO */
+};
+typedef struct pv_iommu_flush_nested pv_iommu_flush_nested_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_flush_nested_t);
+
+/**
+ * IOMMU_attach_pasid (needs IOMMUCAP_pasid)
+ * Attach a new device-with-pasid to a IOMMU context.
+ * If a matching device-with-pasid already exists (globally),
+ * fail with -EEXIST.
+ * If pasid is 0, fails with -EINVAL.
+ * If physical device doesn't exist in domain, fail with -ENOENT.
+ */
+struct pv_iommu_attach_pasid {
+    /* IN: IOMMU context to add the device-with-pasid in */
+    uint16_t ctx_no;
+
+    /* IN: Physical device */
+    struct physdev_pci_device dev;
+
+    /* IN: pasid of the device to attach */
+    uint32_t pasid;
+};
+typedef struct pv_iommu_attach_pasid pv_iommu_attach_pasid_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_attach_pasid_t);
+
+/**
+ * IOMMU_detach_pasid (needs IOMMUCAP_pasid)
+ * detach a device-with-pasid.
+ * If the device-with-pasid doesn't exist or belong to the domain,
+ * fail with -ENOENT.
+ * If pasid is 0, fails with -EINVAL.
+ */
+struct pv_iommu_detach_pasid {
+    /* IN: Physical device */
+    struct physdev_pci_device dev;
+
+    /* pasid of the device to detach */
+    uint32_t pasid;
+};
+typedef struct pv_iommu_detach_pasid pv_iommu_detach_pasid_t;
+DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_detach_pasid_t);
+
+/* long do_iommu_op(int subop, XEN_GUEST_HANDLE_PARAM(void) arg) */
+
+#endif
\ No newline at end of file
diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
index 81236530244502..2da308f3ca5d64 100644
--- a/include/xen/interface/xen.h
+++ b/include/xen/interface/xen.h
@@ -65,6 +65,7 @@
 #define __HYPERVISOR_xc_reserved_op       39 /* reserved for XenClient */
 #define __HYPERVISOR_xenpmu_op            40
 #define __HYPERVISOR_dm_op                41
+#define __HYPERVISOR_iommu_op 					  43
 
 /* Architecture-specific hypercall definitions. */
 #define __HYPERVISOR_arch_0               48

From c4d356015a2b608d14b82212b1f94499bd54c17a Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 00:44:53 -0700
Subject: [PATCH 1884/1982] iommu/xen: Allow the PV-IOMMU driver in a guest

The driver itself was never Dom0-specific -- it only checks xen_domain()
and sends the SBDF it sees, which is what the hypervisor now translates.
The restriction lived entirely in Kconfig, so drop it to depends on XEN.

Guests do need one adjustment. Dom0 sees the real topology, bridges
included, and Xen tracks all of it. A guest only gets the endpoints vPCI
assigned to it, sitting under an emulated bridge that has no device on the
Xen side, so don't claim bridges there; attaching a context to one can only
fail.

A guest also has to call IOMMU_init before it has any contexts to allocate,
which the driver already does unconditionally.
---
 drivers/iommu/Kconfig     |  8 +++++---
 drivers/iommu/xen-iommu.c | 10 ++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 8ab6cd68bdcc19..2e1e4a72670e21 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -373,13 +373,15 @@ config VIRTIO_IOMMU
 
 config XEN_IOMMU
 	bool "Xen IOMMU driver"
-	depends on XEN_DOM0
+	depends on XEN
 	select IOMMU_API
 	select IOMMU_IO_PGTABLE
 	help
-		Xen PV-IOMMU driver for Dom0.
+		Xen PV-IOMMU driver.
 
-		Say Y here if you intend to run this guest as Xen Dom0.
+		Say Y here if you intend to run this kernel under Xen, either as
+		Dom0 or as a guest whose passed-through devices come through
+		vPCI.
 
 config SPRD_IOMMU
 	tristate "Unisoc IOMMU Support"
diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 1ea66aeda09633..35cbc7d7026b8b 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -119,6 +119,16 @@ static struct iommu_device *xen_iommu_probe_device(struct device *dev)
 	if (!dev_is_pci(dev))
 		return ERR_PTR(-ENODEV);
 
+	/*
+	 * Dom0 sees the real topology, bridges included, and Xen tracks all of
+	 * it. A guest only gets the endpoints vPCI assigned to it; the bridge
+	 * above them is emulated and has no device for Xen to attach a context
+	 * to, so leave it alone rather than fail the attach later.
+	 */
+	if (!xen_initial_domain() &&
+	    to_pci_dev(dev)->hdr_type != PCI_HEADER_TYPE_NORMAL)
+		return ERR_PTR(-ENODEV);
+
 	return &xen_iommu_device;
 }
 

From e8d5aa2799dcee7cd2eabd9971a98ed5b113abb2 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 10:08:58 -0700
Subject: [PATCH 1885/1982] iommu/xen: Give the identity domain a type and ops

xen_iommu_identity_domain is statically allocated, and the core only fills
in type and ops for domains it allocated itself. Left at zero the type is
IOMMU_DOMAIN_BLOCKED, not identity, and the ops pointer is NULL, so
anything the core routes to this domain either does the wrong thing or
dereferences NULL.

Name both explicitly. attach_dev is the same as for a paging domain -- the
identity domain is just context 0.
---
 drivers/iommu/xen-iommu.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 35cbc7d7026b8b..d43fd5a869a3e2 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -43,7 +43,24 @@ struct xen_iommu_domain {
 static struct iommu_device xen_iommu_device;
 static struct pv_iommu_capabilities caps;
 
-static struct xen_iommu_domain xen_iommu_identity_domain;
+static int xen_iommu_attach_dev(struct iommu_domain *domain,
+				struct device *dev);
+
+static const struct iommu_domain_ops xen_iommu_identity_ops = {
+	.attach_dev = xen_iommu_attach_dev,
+};
+
+/*
+ * A statically allocated domain has to name its own type and ops; the core
+ * only fills those in for domains it allocated itself. Leaving type at 0 makes
+ * this an IOMMU_DOMAIN_BLOCKED domain with no ops at all.
+ */
+static struct xen_iommu_domain xen_iommu_identity_domain = {
+	.domain = {
+		.type = IOMMU_DOMAIN_IDENTITY,
+		.ops = &xen_iommu_identity_ops,
+	},
+};
 static unsigned long xen_iommu_pgsize_bitmap = XEN_PAGE_SIZE;
 static bool map_single_pages = false;
 

From dbde5076cc43071e54306078ecbe43a6c94fa307 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 10:51:23 -0700
Subject: [PATCH 1886/1982] iommu/dma: Don't reserve PCI windows under a
 paravirtual IOMMU

A PCI host bridge's memory windows are reserved in IOVA space so that an
IOVA cannot collide with an address the bridge would route to MMIO rather
than to memory. Under a paravirtual IOMMU that reasoning does not apply:
the IOVA space belongs to the hypervisor, is programmed by hypercall, and
is not the bridge's address space at all.

Worse, the windows a Xen guest sees are invented. pcifront hands out
iomem_resource itself as the root bus window, and a PVH guest has no host
bridge _CRS so Linux falls back to its catch-all default, clipped only by
the guest's physical address width:

  pci_bus 0000:00: root bus resource [mem 0x00000000-0x3fffffffffff]

Reserving that swallows the whole aperture the hypervisor reported, and
every IOVA allocation fails -- even for a single page:

  nvidia 0000:00:01.0: IOVA alloc failed: len=1 limit=7fffffffff shift=12
                       granule=4096 start_pfn=1 aperture=0-7fffffffff
  NVRM: GPU0 osIovaMap: failed to map allocation (status = 0x59)

The device then never gets a DMA mapping and the driver cannot attach. This
is inert without an IOMMU, since there is no IOVA space to reserve, so it
only appears once a guest drives one.

Let the driver owning the IOVA space opt out. Kept to a private header
rather than a flag in struct iommu_ops: adding a field there changes the
CRC of every exported symbol whose type graph reaches it, which breaks
every already-built out-of-tree module.
---
 drivers/iommu/dma-iommu.c  | 14 +++++++++++++-
 drivers/iommu/iommu-priv.h |  9 +++++++++
 drivers/iommu/xen-iommu.c  |  7 +++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index aa9ebf2bc96ed9..a6359167ce0814 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -28,6 +28,8 @@
 #include <linux/of_iommu.h>
 #include <linux/pci.h>
 #include <linux/pci-p2pdma.h>
+
+#include "iommu-priv.h"
 #include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/swiotlb.h>
@@ -558,7 +560,17 @@ static int iova_reserve_iommu_regions(struct device *dev,
 	LIST_HEAD(resv_regions);
 	int ret = 0;
 
-	if (dev_is_pci(dev)) {
+	/*
+	 * A PCI host bridge's windows are reserved so that an IOVA cannot
+	 * collide with an address the bridge would route to MMIO. Under a
+	 * paravirtual IOMMU the IOVA space belongs to the hypervisor and is not
+	 * the bridge's address space at all, and the windows a Xen guest sees
+	 * are invented -- pcifront hands out iomem_resource itself, and a PVH
+	 * guest with no host bridge _CRS gets Linux's catch-all default. There
+	 * is nothing meaningful to reserve, and reserving it leaves no usable
+	 * IOVA space whatsoever.
+	 */
+	if (dev_is_pci(dev) && !xen_iommu_manages_iova(dev)) {
 		ret = iova_reserve_pci_windows(to_pci_dev(dev), iovad);
 		if (ret)
 			return ret;
diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h
index c95394cd03a770..292a73b1dd1d05 100644
--- a/drivers/iommu/iommu-priv.h
+++ b/drivers/iommu/iommu-priv.h
@@ -7,6 +7,15 @@
 #include <linux/iommu.h>
 #include <linux/msi.h>
 
+#ifdef CONFIG_XEN_IOMMU
+bool xen_iommu_manages_iova(struct device *dev);
+#else
+static inline bool xen_iommu_manages_iova(struct device *dev)
+{
+	return false;
+}
+#endif
+
 static inline const struct iommu_ops *dev_iommu_ops(struct device *dev)
 {
 	/*
diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index d43fd5a869a3e2..56b36160b378ec 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -13,6 +13,8 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/iommu.h>
+
+#include "iommu-priv.h"
 #include <linux/pci.h>
 #include <linux/printk.h>
 #include <linux/stddef.h>
@@ -372,6 +374,11 @@ static struct iommu_ops xen_iommu_ops = {
 	},
 };
 
+bool xen_iommu_manages_iova(struct device *dev)
+{
+	return dev->iommu && dev_iommu_ops(dev) == &xen_iommu_ops;
+}
+
 static int __init xen_iommu_init(void)
 {
 	long ret;

From 2b95b2bd9c88afab2d9d8aeb96787a924a052a38 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 11:26:57 -0700
Subject: [PATCH 1887/1982] xen/pcifront: Let callers ask for a device's
 machine BDF

The BDF a PV guest sees for a passed-through device is invented by pciback
in the hardware domain and never reaches the hypervisor, so it cannot be
used to name the device in a hypercall. PV-IOMMU needs to.

pciback already publishes both halves of the mapping in its xenstore
directory -- dev-N is the machine BDF, vdev-N the one this domain sees --
and pcifront already reads vdev-N when detaching, so the mapping is right
there. Walk it and hand the machine BDF back.

Use it in the PV-IOMMU driver for both reattach and the reserved-region
query. With vPCI the SBDF a guest sees is one Xen assigned and can
translate, so this only changes what a PV guest sends. Both end up naming a
device the hypervisor can find.
---
 drivers/iommu/xen-iommu.c  | 33 +++++++++++++++++----
 drivers/pci/xen-pcifront.c | 59 ++++++++++++++++++++++++++++++++++++++
 include/xen/pci.h          | 14 +++++++++
 3 files changed, 100 insertions(+), 6 deletions(-)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 56b36160b378ec..7195bc76baa1fc 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -14,6 +14,8 @@
 #include <linux/module.h>
 #include <linux/iommu.h>
 
+#include <xen/pci.h>
+
 #include "iommu-priv.h"
 #include <linux/pci.h>
 #include <linux/printk.h>
@@ -133,6 +135,29 @@ static struct iommu_domain *xen_iommu_domain_alloc_paging(struct device *dev)
 	return &domain->domain;
 }
 
+/*
+ * Name a device the way the hypervisor knows it. With vPCI the SBDF this domain
+ * sees is one Xen assigned and can translate. A PV guest's comes from pciback
+ * instead and means nothing to Xen, so use the machine BDF pciback published
+ * alongside it.
+ */
+static void xen_iommu_set_dev(struct physdev_pci_device *out,
+			      struct pci_dev *pdev)
+{
+	u32 sbdf;
+
+	if (!pcifront_machine_sbdf(pdev, &sbdf)) {
+		out->seg = sbdf >> 16;
+		out->bus = (sbdf >> 8) & 0xff;
+		out->devfn = sbdf & 0xff;
+		return;
+	}
+
+	out->seg = pci_domain_nr(pdev->bus);
+	out->bus = pdev->bus->number;
+	out->devfn = pdev->devfn;
+}
+
 static struct iommu_device *xen_iommu_probe_device(struct device *dev)
 {
 	if (!dev_is_pci(dev))
@@ -240,9 +265,7 @@ static int xen_iommu_attach_dev(struct iommu_domain *domain, struct device *dev)
 
 	pdev = to_pci_dev(dev);
 
-	reattach.dev.seg = pci_domain_nr(pdev->bus);
-	reattach.dev.bus = pdev->bus->number;
-	reattach.dev.devfn = pdev->devfn;
+	xen_iommu_set_dev(&reattach.dev, pdev);
 
 	return HYPERVISOR_iommu_op(IOMMU_reattach_device, &reattach);
 }
@@ -303,9 +326,7 @@ static void xen_iommu_get_resv_regions(struct device *dev, struct list_head *hea
 	map.nr_entries = 0;
 	map.flags = 0;
 
-	map.dev.pci.seg = pci_domain_nr(pdev->bus);
-	map.dev.pci.bus = pdev->bus->number;
-	map.dev.pci.devfn = pdev->devfn;
+	xen_iommu_set_dev(&map.dev.pci, pdev);
 
 	ret = HYPERVISOR_memory_op(XENMEM_reserved_device_memory_map, &map);
 
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index 451476ce10ae93..4ee6ab154891de 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -8,6 +8,7 @@
 #include <linux/init.h>
 #include <linux/mm.h>
 #include <xen/xenbus.h>
+#include <xen/pci.h>
 #include <xen/events.h>
 #include <xen/grant_table.h>
 #include <xen/page.h>
@@ -404,6 +405,64 @@ static int pcifront_claim_resource(struct pci_dev *dev, void *data)
 	return 0;
 }
 
+/*
+ * pciback names every assigned device twice in its xenstore directory: dev-N is
+ * the machine BDF and vdev-N is the BDF this domain sees. Only the former means
+ * anything to the hypervisor, so hand it back to callers that have to name a
+ * device to Xen -- the PV-IOMMU driver -- since the BDF a PV guest sees was
+ * invented in the backend and never reached Xen at all.
+ *
+ * Returns the machine SBDF packed as Xen expects it: seg << 16 | bus << 8 |
+ * devfn.
+ */
+int pcifront_machine_sbdf(const struct pci_dev *dev, u32 *sbdf)
+{
+	unsigned int domain, bus, slot, func;
+	struct pcifront_device *pdev;
+	int i, num_devs;
+	char str[64];
+
+	if (dev->bus->ops != &pcifront_bus_ops)
+		return -ENODEV;
+
+	pdev = pcifront_get_pdev(dev->bus->sysdata);
+	if (!pdev)
+		return -ENODEV;
+
+	if (xenbus_scanf(XBT_NIL, pdev->xdev->otherend, "num_devs", "%d",
+			 &num_devs) != 1)
+		return -ENODEV;
+
+	for (i = 0; i < num_devs; i++) {
+		if (snprintf(str, sizeof(str), "vdev-%d", i) >= sizeof(str) - 1)
+			return -ENODEV;
+
+		if (xenbus_scanf(XBT_NIL, pdev->xdev->otherend, str,
+				 "%x:%x:%x.%x", &domain, &bus, &slot,
+				 &func) != 4)
+			continue;
+
+		if (domain != pci_domain_nr(dev->bus) ||
+		    bus != dev->bus->number ||
+		    PCI_DEVFN(slot, func) != dev->devfn)
+			continue;
+
+		if (snprintf(str, sizeof(str), "dev-%d", i) >= sizeof(str) - 1)
+			return -ENODEV;
+
+		if (xenbus_scanf(XBT_NIL, pdev->xdev->otherend, str,
+				 "%x:%x:%x.%x", &domain, &bus, &slot,
+				 &func) != 4)
+			return -ENODEV;
+
+		*sbdf = (domain << 16) | (bus << 8) | PCI_DEVFN(slot, func);
+		return 0;
+	}
+
+	return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(pcifront_machine_sbdf);
+
 static int pcifront_scan_bus(struct pcifront_device *pdev,
 				unsigned int domain, unsigned int bus,
 				struct pci_bus *b)
diff --git a/include/xen/pci.h b/include/xen/pci.h
index 424b8ea89ca81c..b5efff694a03fe 100644
--- a/include/xen/pci.h
+++ b/include/xen/pci.h
@@ -3,6 +3,20 @@
 #ifndef __XEN_PCI_H__
 #define __XEN_PCI_H__
 
+#include <linux/errno.h>
+#include <linux/types.h>
+
+struct pci_dev;
+
+#if defined(CONFIG_XEN_PCIDEV_FRONTEND)
+int pcifront_machine_sbdf(const struct pci_dev *dev, u32 *sbdf);
+#else
+static inline int pcifront_machine_sbdf(const struct pci_dev *dev, u32 *sbdf)
+{
+	return -ENODEV;
+}
+#endif
+
 #if defined(CONFIG_XEN_DOM0)
 int xen_reset_device(const struct pci_dev *dev);
 int xen_find_device_domain_owner(struct pci_dev *dev);

From 8e68484afb2c2cd9d55d6b291548fe9e508048c7 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 12:02:36 -0700
Subject: [PATCH 1888/1982] iommu/xen: Default a PV guest to the identity
 context

A PV guest reaches its devices through xen-swiotlb, which hands them
machine addresses. Attaching one to a translated IOMMU context as well
leaves two translations disagreeing about every address, and the DMA layer
rejects the combination outright:

  WARNING: CPU: 0 PID: 11 at kernel/dma/mapping.c:881 dma_supported+0x5e/0x80
   dma_set_mask+0x24/0xe0
   nv_set_dma_address_size+0x52/0x70 [nvidia]
   nv_pci_probe+0x28f/0x1090 [nvidia]

dma_supported() warns and returns false when a device both uses iommu-dma
and has dma_map_ops, which in a PV guest it always does. The driver's
dma_set_mask() then fails and every mapping after it is wrong; the GPU here
got as far as GspStatusQueueInit before returning NV_ERR_RESET_REQUIRED.

Report IOMMU_DOMAIN_IDENTITY as the default domain type there, which is
context 0 and what the hypervisor already advertises as identity. Normal
DMA stays on xen-swiotlb and translated contexts can still be asked for
explicitly, which is what a guest wanting one for VFIO would do.

Guests whose devices come through vPCI are unaffected; they have no
dma_map_ops of their own and use iommu-dma as before.
---
 drivers/iommu/xen-iommu.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 7195bc76baa1fc..f06dc957e8b0f7 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -158,6 +158,22 @@ static void xen_iommu_set_dev(struct physdev_pci_device *out,
 	out->devfn = pdev->devfn;
 }
 
+/*
+ * A PV guest reaches its devices through xen-swiotlb, which hands them machine
+ * addresses. Putting a device in a translated context as well leaves two
+ * translations disagreeing about every address, and the DMA layer refuses the
+ * combination outright -- dma_supported() warns and fails once a device both
+ * uses iommu-dma and has dma_map_ops, which every PV guest does. Default to
+ * the identity context there and let translated ones be asked for explicitly.
+ */
+static int xen_iommu_def_domain_type(struct device *dev)
+{
+	if (xen_pv_domain())
+		return IOMMU_DOMAIN_IDENTITY;
+
+	return 0;
+}
+
 static struct iommu_device *xen_iommu_probe_device(struct device *dev)
 {
 	if (!dev_is_pci(dev))
@@ -386,6 +402,7 @@ static struct iommu_ops xen_iommu_ops = {
 	.probe_device = xen_iommu_probe_device,
 	.device_group = pci_device_group,
 	.get_resv_regions = xen_iommu_get_resv_regions,
+	.def_domain_type = xen_iommu_def_domain_type,
 	.default_domain_ops = &(const struct iommu_domain_ops) {
 		.map_pages = xen_iommu_map_pages,
 		.unmap_pages = xen_iommu_unmap_pages,

From e4b2ce87f28c248fc5c0c9ef219955c12c2954f5 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Wed, 2 Sep 2026 20:52:03 -0700
Subject: [PATCH 1889/1982] PCI/MSI: don't write the MSI-X table in a Xen PV
 guest

A PV guest does not own the MSI-X table of a passed-through device. Xen
programs it when mapping the pirq and maps the table read-only, so the
mask, message and unmask writes in pci_write_msg_msix() fault.

vfio-pci refreshes the cached message unconditionally before enabling a
vector, to undo a backdoor reset, which crashes a PV guest:

  BUG: unable to handle page fault for address: ffffc9004001d000
  #PF: supervisor write access in kernel mode
  RIP: __pci_write_msi_msg+0x74/0x1f0
   vfio_msi_set_vector_signal+0x2c9/0x320

Return early as the is_virtual case already does; nothing in a PV guest
programs the table itself, the Xen MSI domain routes allocation through
PHYSDEVOP_map_pirq and Xen does the write.
---
 drivers/pci/msi/msi.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index 7e233286930658..c01f44195817b3 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -12,6 +12,8 @@
 #include <linux/irq.h>
 #include <linux/irqdomain.h>
 
+#include <xen/xen.h>
+
 #include "../pci.h"
 #include "msi.h"
 
@@ -214,6 +216,15 @@ static inline void pci_write_msg_msix(struct msi_desc *desc, struct msi_msg *msg
 
 	if (desc->pci.msi_attrib.is_virtual)
 		return;
+
+	/*
+	 * A PV guest never owns the MSI-X table.  Xen programs it when mapping
+	 * the pirq and maps it read-only, so the masking and message writes
+	 * below would fault; vfio-pci refreshes the message unconditionally.
+	 */
+	if (xen_pv_domain())
+		return;
+
 	/*
 	 * The specification mandates that the entry is masked
 	 * when the message is modified:

From f31bc8b35162a2a325d533561c6a241185e8a75e Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Thu, 3 Sep 2026 01:00:50 -0700
Subject: [PATCH 1890/1982] iommu/xen: batch map subops over contiguous runs

A PV domain took the single-page path unconditionally, one hypercall per
4K page, because pfn_to_gfn(x + 1) != pfn_to_gfn(x) + 1 there in general
and the batched path assumed the whole request was contiguous. Every
subop also carries an IOTLB flush on the hypervisor side, so a large
mapping costs a flush per page: a 4G premapping is a million hypercalls
and a million flushes, which no caller waits out.

Walk the request and issue one subop per maximal run contiguous in both
dfn and gfn, as the TODO describing this asked for. Behaviour is
unchanged where pfn_to_gfn is the identity, the run then covering the
whole request. map_single_pages remains as a module parameter.
---
 drivers/iommu/xen-iommu.c | 48 +++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 19 deletions(-)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index f06dc957e8b0f7..3a9bf55ecadb98 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -67,6 +67,9 @@ static struct xen_iommu_domain xen_iommu_identity_domain = {
 };
 static unsigned long xen_iommu_pgsize_bitmap = XEN_PAGE_SIZE;
 static bool map_single_pages = false;
+module_param(map_single_pages, bool, 0444);
+MODULE_PARM_DESC(map_single_pages,
+		 "Issue one hypercall per page instead of per contiguous run");
 
 static inline struct xen_iommu_domain *to_xen_iommu_domain(struct iommu_domain *dom)
 {
@@ -221,7 +224,6 @@ static int xen_iommu_map_pages(struct iommu_domain *domain, unsigned long iova,
 
 	if (map_single_pages) {
 		size_t i = 0;
-		map.nr_pages = 1;
 
 		for (; i < pgcount; i++) {
 			map.gfn = pfn_to_gfn(pfn0 + i);
@@ -234,11 +236,33 @@ static int xen_iommu_map_pages(struct iommu_domain *domain, unsigned long iova,
 				break;
 		}
 	} else {
-		map.nr_pages = pgcount;
-		map.gfn = pfn_to_gfn(pfn0);
-		map.dfn = dfn0;
+		size_t done = 0;
 
-		ret = HYPERVISOR_iommu_op(IOMMU_map_pages, &map);
+		/*
+		 * A subop covers a run of pages contiguous in both dfn and gfn.
+		 * In a PV domain pfn_to_gfn(x + 1) != pfn_to_gfn(x) + 1 in
+		 * general, so walk the request and issue one subop per maximal
+		 * run rather than assuming the whole of it is contiguous.
+		 */
+		while (done < pgcount) {
+			uint64_t gfn0 = pfn_to_gfn(pfn0 + done);
+			size_t run = 1;
+
+			while (done + run < pgcount &&
+			       pfn_to_gfn(pfn0 + done + run) == gfn0 + run)
+				run++;
+
+			map.gfn = gfn0;
+			map.dfn = dfn0 + done;
+			map.nr_pages = run;
+
+			ret = HYPERVISOR_iommu_op(IOMMU_map_pages, &map);
+
+			if (ret)
+				break;
+
+			done += run;
+		}
 	}
 
 	if (mapped)
@@ -475,20 +499,6 @@ static int __init xen_iommu_init(void)
 
 	xen_iommu_pgsize_bitmap = caps.pgsize_mask;
 
-	if (xen_domain_type == XEN_PV_DOMAIN)
-		/* TODO: In PV domain, due to the existing pfn-gfn mapping we need to
-		 * consider that under certains circonstances, we have :
-		 *   pfn_to_gfn(x + 1) != pfn_to_gfn(x) + 1
-		 *
-		 * In these cases, we would want to separate the subop into several calls.
-		 * (only doing the grouped operation when the mapping is actually contigous)
-		 * Only map operation would be affected, as unmap actually uses dfn which
-		 * doesn't have this kind of mapping.
-		 *
-		 * Force single-page operations to work arround this issue for now.
-		 */
-		map_single_pages = true;
-
 	/* Initialize identity domain */
 	xen_iommu_identity_domain.ctx_no = 0;
 

From b53034fdbe0b9aeab065de7ca10095931f18c430 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Thu, 3 Sep 2026 09:15:38 -0700
Subject: [PATCH 1891/1982] iommu/xen: do not claim the IOMMU itself

An IOMMU does not sit behind itself, so the hypervisor has no device for
it and reattach fails with -ENODEV. The IOMMU core does not allow a
driver to fail the first domain attach, so claiming it takes down
registration of the whole driver:

  WARNING at drivers/iommu/iommu.c:3037 iommu_setup_default_domain
   iommu_device_register
   xen_iommu_init
  xen-iommu: Unable to register Xen IOMMU device -19

Only reachable in the initial domain, which sees the real topology; a
guest is never given the IOMMU. Skip PCI class 0806.
---
 drivers/iommu/xen-iommu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 3a9bf55ecadb98..78ced18c4c9053 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -65,6 +65,9 @@ static struct xen_iommu_domain xen_iommu_identity_domain = {
 		.ops = &xen_iommu_identity_ops,
 	},
 };
+/* PCI base class 08h, sub-class 06h: IOMMU. */
+#define XEN_IOMMU_PCI_CLASS 0x0806
+
 static unsigned long xen_iommu_pgsize_bitmap = XEN_PAGE_SIZE;
 static bool map_single_pages = false;
 module_param(map_single_pages, bool, 0444);
@@ -192,6 +195,14 @@ static struct iommu_device *xen_iommu_probe_device(struct device *dev)
 	    to_pci_dev(dev)->hdr_type != PCI_HEADER_TYPE_NORMAL)
 		return ERR_PTR(-ENODEV);
 
+	/*
+	 * An IOMMU does not sit behind itself, so Xen has no device for it and
+	 * a context can never be attached. Claiming it fails the first attach,
+	 * which the IOMMU core treats as fatal to registering the driver.
+	 */
+	if ((to_pci_dev(dev)->class >> 8) == XEN_IOMMU_PCI_CLASS)
+		return ERR_PTR(-ENODEV);
+
 	return &xen_iommu_device;
 }
 

From 44ad2a0a11cc7c10233b5f246c7e1d29bf8dd1e2 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Thu, 3 Sep 2026 10:53:59 -0700
Subject: [PATCH 1892/1982] x86/xen: disable the right interrupt type when
 tearing down MSI

pci_disable_msix() clears msix_enabled in pci_msix_shutdown() before
pci_free_msi_irqs() reaches the domain teardown, so by the time
xen_pv_teardown_msi_irqs() runs the flag can no longer say which of the
two the device was using. It always took the MSI branch.

The backend therefore never saw XEN_PCI_OP_disable_msix and left MSI-X
enabled on the real device, and a later guest asking to enable it got
-EALREADY from xen_pcibk_enable_msix(). Seen as a device usable exactly
once per assignment.

Take the type from a descriptor instead. The descriptor lock is already
held by the caller.
---
 arch/x86/pci/xen.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index b8755cde241993..de9a1c946a3fa5 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -400,7 +400,24 @@ static void xen_teardown_msi_irqs(struct pci_dev *dev)
 
 static void xen_pv_teardown_msi_irqs(struct pci_dev *dev)
 {
-	if (dev->msix_enabled)
+	struct msi_desc *desc;
+	bool msix = false;
+
+	/*
+	 * pci_disable_msix() clears msix_enabled in pci_msix_shutdown() before
+	 * freeing the irqs brings us here, so it cannot say which of the two
+	 * the device was using. Ask a descriptor instead: getting this wrong
+	 * leaves the backend with MSI-X still enabled on the real device, and
+	 * the next attempt to enable it fails with -EALREADY.
+	 *
+	 * The descriptor lock is already held by pci_disable_msix().
+	 */
+	msi_for_each_desc(desc, &dev->dev, MSI_DESC_ALL) {
+		msix = desc->pci.msi_attrib.is_msix;
+		break;
+	}
+
+	if (msix)
 		xen_pci_frontend_disable_msix(dev);
 	else
 		xen_pci_frontend_disable_msi(dev);

From a1b6fc52d92871dc14e3374bf92b6426683f8503 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Thu, 3 Sep 2026 12:21:19 -0700
Subject: [PATCH 1893/1982] iommu/xen: flush the IOTLB once per mapping, not
 once per subop

A map subop covers a run of frames contiguous in both dfn and gfn, and
in a PV domain gfns are machine frames, so a scattered buffer breaks
into runs of a few pages. Each subop then flushed, and against an
emulated IOMMU a flush is a command and a completion wait that costs far
more than the mapping does. Mapping several gigabytes took long enough
for callers to give up.

The core already has somewhere to put this: ask the hypervisor to skip
the per-subop flush and issue one over the whole range from
iotlb_sync_map(). Gated on IOMMUCAP_deferred_flush so an older
hypervisor keeps flushing per subop rather than never flushing at all.
---
 drivers/iommu/xen-iommu.c        | 31 +++++++++++++++++++++++++++++++
 include/xen/interface/pv-iommu.h | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 78ced18c4c9053..36ad0dbee42c01 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -69,6 +69,8 @@ static struct xen_iommu_domain xen_iommu_identity_domain = {
 #define XEN_IOMMU_PCI_CLASS 0x0806
 
 static unsigned long xen_iommu_pgsize_bitmap = XEN_PAGE_SIZE;
+static bool deferred_flush;
+
 static bool map_single_pages = false;
 module_param(map_single_pages, bool, 0444);
 MODULE_PARM_DESC(map_single_pages,
@@ -233,6 +235,14 @@ static int xen_iommu_map_pages(struct iommu_domain *domain, unsigned long iova,
 	if (prot & IOMMU_CACHE)
 		map.map_flags |= IOMMU_MAP_cache;
 
+	/*
+	 * A scattered buffer costs one subop per run of contiguous frames, and
+	 * each one flushes. Leave the flush to iotlb_sync_map(), which pays it
+	 * once for the whole mapping.
+	 */
+	if (deferred_flush)
+		map.map_flags |= IOMMU_MAP_no_flush;
+
 	if (map_single_pages) {
 		size_t i = 0;
 
@@ -285,6 +295,23 @@ static int xen_iommu_map_pages(struct iommu_domain *domain, unsigned long iova,
 	return ret;
 }
 
+static int xen_iommu_sync_map(struct iommu_domain *domain, unsigned long iova,
+			      size_t size)
+{
+	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);
+	struct pv_iommu_flush_pages flush = {
+		.ctx_no = dom->ctx_no,
+		.dfn = addr_to_pfn(iova),
+		.pgsize = PAGE_SIZE,
+		.nr_pages = size >> PAGE_SHIFT,
+	};
+
+	if (!deferred_flush)
+		return 0;
+
+	return HYPERVISOR_iommu_op(IOMMU_flush_pages, &flush);
+}
+
 static size_t xen_iommu_unmap_pages(struct iommu_domain *domain, unsigned long iova,
 				    size_t pgsize, size_t pgcount,
 				    struct iommu_iotlb_gather *iotlb_gather)
@@ -440,6 +467,7 @@ static struct iommu_ops xen_iommu_ops = {
 	.def_domain_type = xen_iommu_def_domain_type,
 	.default_domain_ops = &(const struct iommu_domain_ops) {
 		.map_pages = xen_iommu_map_pages,
+		.iotlb_sync_map = xen_iommu_sync_map,
 		.unmap_pages = xen_iommu_unmap_pages,
 		.attach_dev = xen_iommu_attach_dev,
 		.iova_to_phys = xen_iommu_iova_to_phys,
@@ -503,6 +531,9 @@ static int __init xen_iommu_init(void)
 	pr_info("default_identity=%c\n", (caps.cap_flags & IOMMUCAP_default_identity) ? 'y' : 'n');
 	pr_info("cache=%c\n", (caps.cap_flags & IOMMUCAP_cache) ? 'y' : 'n');
 
+	deferred_flush = caps.cap_flags & IOMMUCAP_deferred_flush;
+	pr_info("deferred_flush=%c\n", deferred_flush ? 'y' : 'n');
+
 	if (caps.max_ctx_no == 0) {
 		pr_err("Unable to use IOMMU PV driver (no context available ?)\n");
 		return -ENOTSUPP; /* Unable to use IOMMU PV ? */
diff --git a/include/xen/interface/pv-iommu.h b/include/xen/interface/pv-iommu.h
index a4a470319486a4..d4e58edd6e0d7c 100644
--- a/include/xen/interface/pv-iommu.h
+++ b/include/xen/interface/pv-iommu.h
@@ -36,6 +36,7 @@ enum {
     IOMMU_flush_nested,     /* if IOMMUCAP_nested */
     IOMMU_attach_pasid,     /* if IOMMUCAP_pasid */
     IOMMU_detach_pasid,     /* if IOMMUCAP_pasid */
+    IOMMU_flush_pages,      /* if IOMMUCAP_deferred_flush */
 };
 
 /**
@@ -65,6 +66,11 @@ enum {
  */
 #define IOMMUCAP_identity (1 << 4)
 
+/**
+ * Support for IOMMU_MAP_no_flush and IOMMU_flush_pages.
+ */
+#define IOMMUCAP_deferred_flush (1 << 5)
+
 /**
  * IOMMU_query_capabilities
  * Query PV-IOMMU capabilities for this domain.
@@ -163,6 +169,12 @@ DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_free_t);
 /* Enforce DMA coherency */
 #define IOMMU_MAP_cache (1 << 2)
 
+/*
+ * Don't flush the IOTLB for this call. The caller must issue IOMMU_flush_pages
+ * over the range before a device uses it.
+ */
+#define IOMMU_MAP_no_flush (1 << 3)
+
 /**
  * IOMMU_map_pages
  * Map pages on a IOMMU context.
@@ -193,6 +205,26 @@ struct pv_iommu_map_pages {
     /* OUT: Number of pages actually mapped */
     uint32_t mapped;
 };
+
+/**
+ * IOMMU_flush_pages
+ * Flush the IOTLB over a device frame range on a IOMMU context.
+ *
+ * Pairs with IOMMU_MAP_no_flush.
+ */
+struct pv_iommu_flush_pages {
+    /* IN: IOMMU context number */
+    uint16_t ctx_no;
+
+    /* IN: Device frame number */
+    uint64_aligned_t dfn;
+
+    /* IN: Size of pages to flush */
+    uint32_t pgsize;
+
+    /* IN: Number of pages to flush */
+    uint32_t nr_pages;
+};
 typedef struct pv_iommu_map_pages pv_iommu_map_pages_t;
 DEFINE_GUEST_HANDLE_STRUCT(pv_iommu_map_pages_t);
 

From 951b8b04311e078f2d3613c9b0cc2f6518b7cbb8 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 16 Sep 2026 18:53:04 -0700
Subject: [PATCH 1894/1982] iommu/xen: restrict the PV-IOMMU driver to x86

"iommu/xen: Allow the PV-IOMMU driver in a guest" relaxed the dependency
from XEN_DOM0 to XEN so a domU could use the driver, but XEN_DOM0 is
x86-only and dropping it also dropped the architecture constraint. The
driver does not build anywhere else:

  - HYPERVISOR_iommu_op() is defined only in
    arch/x86/include/asm/xen/hypercall.h.
  - arm64 lays out guest handles differently, so assigning a pointer to
    the xen_reserved_device_memory handle is a type error there.

An arm64 defconfig with XEN=y and XEN_IOMMU=y therefore fails to build.
Depend on X86 as well, which is what the hypercall interface requires
anyway.

Signed-off-by: Ariadne Conill <ariadne@edera.dev>
---
 drivers/iommu/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 2e1e4a72670e21..6053415b4df1f0 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -373,7 +373,7 @@ config VIRTIO_IOMMU
 
 config XEN_IOMMU
 	bool "Xen IOMMU driver"
-	depends on XEN
+	depends on X86 && XEN
 	select IOMMU_API
 	select IOMMU_IO_PGTABLE
 	help

From 9586cf56a1eb4da6823b0266894f1ba5d8a8ea86 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Thu, 10 Apr 2025 12:32:14 -0400
Subject: [PATCH 1895/1982] x86/topology: Tolerate lack of APIC when booting as
 Xen domU

Xen domU instances do not boot on x86 with ACPI enabled, so the entire
ACPI subsystem is ultimately disabled.  This causes acpi_mps_check()
to trigger a warning that the ACPI MPS table is not present, which then
disables APIC support on domU, breaking the CPU topology detection for
all vCPUs other than the boot vCPU.

Fixes: 7c0edad3643f ("x86/cpu/topology: Rework possible CPU management")
---
 arch/x86/kernel/cpu/topology.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c
index 425404e7b7b428..e966f2a16eb1df 100644
--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -428,7 +428,7 @@ void __init topology_apply_cmdline_limits_early(void)
 	unsigned int possible = nr_cpu_ids;
 
 	/* 'maxcpus=0' 'nosmp' 'nolapic' */
-	if (!setup_max_cpus || apic_is_disabled)
+	if (!setup_max_cpus || (apic_is_disabled && !xen_pv_domain()))
 		possible = 1;
 
 	/* 'possible_cpus=N' */

From e6bf2f3f2ef1396622fe83797ac658fb548f3617 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 4 Sep 2025 12:32:45 -0700
Subject: [PATCH 1896/1982] x86/CPU/AMD: avoid printing reset reasons on Xen
 domU

Xen domU cannot access the given MMIO address for security reasons,
resulting in a failed hypercall in ioremap() due to permissions.

Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset")
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
Cc: stable@vger.kernel.org
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/kernel/cpu/amd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index bd274c2b4c6a30..cb2f5c0487dacc 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -29,6 +29,8 @@
 # include <asm/mmconfig.h>
 #endif
 
+#include <xen/xen.h>
+
 #include "cpu.h"
 
 u16 invlpgb_count_max __ro_after_init = 1;
@@ -1372,6 +1374,10 @@ static __init int print_s5_reset_status_mmio(void)
 	if (!cpu_feature_enabled(X86_FEATURE_ZEN))
 		return 0;
 
+	/* Xen PV domU cannot access hardware directly, so bail for domU case */
+	if (cpu_feature_enabled(X86_FEATURE_XENPV) && !xen_initial_domain())
+		return 0;
+
 	addr = ioremap(FCH_PM_BASE + FCH_PM_S5_RESET_STATUS, sizeof(value));
 	if (!addr)
 		return 0;

From c46dc9c8c612b3a5e5506a4b73e3da7b729de6c0 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Tue, 14 Jul 2026 23:27:39 -0700
Subject: [PATCH 1897/1982] 9p/xen: share one frontend across mounts and
 advertise it (6.18)

Backport of the multi-attach change to the pre-fs_context 9p mount API
used by 6.18.x. Let the 9p core share one refcounted p9_client across all
mounts of an endpoint (opt-in via p9_trans_module.share_client, set for
xen), so several mounts share a frontend, each attaching with its own
aname to get an independent tree and superblock.

The endpoint is selected by a tag= mount option (parsed from the options
string in the old API) so the mount source can differ per mount (distinct
/proc/mounts device names), and the capability is advertised to userspace
as edera_multi_attach_v1 in /sys/fs/9p/features.

Signed-off-by: Alex Zenla <alex@edera.dev>
---
 fs/9p/v9fs.c               |  20 ++++++
 include/net/9p/client.h    |  10 +++
 include/net/9p/transport.h |   8 +++
 net/9p/client.c            | 125 +++++++++++++++++++++++++++++++++++++
 net/9p/trans_xen.c         |  40 +++++++++++-
 5 files changed, 200 insertions(+), 3 deletions(-)

diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index bde3ffb0e319a5..daaca8117f5368 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -578,10 +578,30 @@ static ssize_t caches_show(struct kobject *kobj,
 static struct kobj_attribute v9fs_attr_cache = __ATTR_RO(caches);
 #endif /* CONFIG_9P_FSCACHE */
 
+/*
+ * Capability tokens for userspace to probe, one per line.
+ *
+ * "edera_multi_attach_v1": a transport that sets p9_trans_module.share_client
+ * (e.g. Xen 9pfs) can back several mounts of a single endpoint, each attaching
+ * with its own aname. Userspace can test for this token before mounting subtrees
+ * of one frontend as independent superblocks (distinct st_dev) instead of
+ * bind-mounting from a single mount. The token is vendor-namespaced and
+ * versioned so it never aliases an unrelated upstream feature name, and a future
+ * behavior change can advertise "_v2" instead.
+ */
+static ssize_t features_show(struct kobject *kobj,
+			     struct kobj_attribute *attr, char *buf)
+{
+	return sysfs_emit(buf, "edera_multi_attach_v1\n");
+}
+
+static struct kobj_attribute v9fs_attr_features = __ATTR_RO(features);
+
 static struct attribute *v9fs_attrs[] = {
 #ifdef CONFIG_9P_FSCACHE
 	&v9fs_attr_cache.attr,
 #endif
+	&v9fs_attr_features.attr,
 	NULL,
 };
 
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 4f785098c67a14..763cad1359a0ad 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -123,6 +123,16 @@ struct p9_client {
 	struct idr fids;
 	struct idr reqs;
 
+	/* Client sharing, for transports with p9_trans_module.share_client set:
+	 * all mounts of one endpoint reference a single client. @refcount counts
+	 * those mounts; @shared_list links the client into the shared-client
+	 * registry, keyed by @shared_key (a copy of the endpoint tag/source).
+	 * @shared_key is NULL for ordinary, unshared clients.
+	 */
+	refcount_t refcount;
+	struct list_head shared_list;
+	char *shared_key;
+
 	char name[__NEW_UTS_LEN + 1];
 };
 
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 766ec07c95999d..0bc000853b5827 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -24,6 +24,13 @@
  *                   we're less flexible when choosing the response message
  *                   size in this case
  * @def: set if this transport should be considered the default
+ * @share_client: set if one transport endpoint (e.g. a Xen 9pfs frontend,
+ *                keyed by its tag) can back more than one mount. Such an
+ *                endpoint cannot multiplex several p9_clients, so when this is
+ *                set the 9p core hands every mount of the same endpoint a
+ *                single, refcounted p9_client instead of one per mount. Each
+ *                mount still issues its own Tattach (with its own aname), so it
+ *                gets an independent tree and superblock over the shared client.
  * @create: member function to create a new connection on this transport
  * @close: member function to discard a connection on this transport
  * @request: member function to issue a request to the transport
@@ -44,6 +51,7 @@ struct p9_trans_module {
 	int maxsize;		/* max message size of transport */
 	bool pooled_rbuffers;
 	int def;		/* this transport should be default */
+	bool share_client;	/* one endpoint may back many mounts */
 	struct module *owner;
 	int (*create)(struct p9_client *client,
 		      const char *devname, char *args);
diff --git a/net/9p/client.c b/net/9p/client.c
index 75aac636b20e73..16a0577e6cd6f9 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -132,6 +132,59 @@ static int get_protocol_version(char *s)
  * Return 0 upon success, -ERRNO upon failure
  */
 
+/*
+ * Shared-client registry.
+ *
+ * Some transports (currently only Xen 9pfs) expose a single endpoint that
+ * cannot multiplex more than one p9_client: a second mount of the same
+ * endpoint would clobber the first's client pointer. For such transports
+ * (p9_trans_module.share_client) all mounts of one endpoint share a single
+ * refcounted p9_client and tell themselves apart by attaching (Tattach) with
+ * their own aname, which gives each an independent tree and superblock.
+ *
+ * Clients are keyed by endpoint id: the explicit "tag=" mount option when the
+ * mount supplied one, otherwise the mount device name.
+ */
+static LIST_HEAD(p9_shared_clients);
+static DEFINE_MUTEX(p9_shared_clients_lock);
+
+/* Value of the "tag=" mount option in @options, copied into @buf, or NULL when
+ * absent. Matched only at an option boundary.
+ */
+static const char *p9_options_tag(const char *options, char *buf, size_t buflen)
+{
+	const char *p = options;
+
+	while (p && *p) {
+		if (!strncmp(p, "tag=", 4)) {
+			size_t n = strcspn(p + 4, ",");
+
+			if (n == 0 || n >= buflen)
+				return NULL;
+			memcpy(buf, p + 4, n);
+			buf[n] = '\0';
+			return buf;
+		}
+		p = strchr(p, ',');
+		if (p)
+			p++;
+	}
+	return NULL;
+}
+
+/* Caller must hold p9_shared_clients_lock. */
+static struct p9_client *p9_client_find_shared(struct p9_trans_module *trans,
+					       const char *key)
+{
+	struct p9_client *clnt;
+
+	list_for_each_entry(clnt, &p9_shared_clients, shared_list) {
+		if (clnt->trans_mod == trans && !strcmp(clnt->shared_key, key))
+			return clnt;
+	}
+	return NULL;
+}
+
 static int parse_opts(char *opts, struct p9_client *clnt)
 {
 	char *options, *tmp_options;
@@ -983,6 +1036,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 	struct p9_client *clnt;
 	char *client_id;
 	char *cache_name;
+	bool shared_locked = false;
 
 	clnt = kmalloc(sizeof(*clnt), GFP_KERNEL);
 	if (!clnt)
@@ -998,6 +1052,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 	spin_lock_init(&clnt->lock);
 	idr_init(&clnt->fids);
 	idr_init(&clnt->reqs);
+	refcount_set(&clnt->refcount, 1);
+	INIT_LIST_HEAD(&clnt->shared_list);
+	clnt->shared_key = NULL;
 
 	err = parse_opts(options, clnt);
 	if (err < 0)
@@ -1016,6 +1073,47 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 	p9_debug(P9_DEBUG_MUX, "clnt %p trans %p msize %d protocol %d\n",
 		 clnt, clnt->trans_mod, clnt->msize, clnt->proto_version);
 
+	if (clnt->trans_mod->share_client) {
+		char tagbuf[64];
+		const char *key = p9_options_tag(options, tagbuf, sizeof(tagbuf));
+		struct p9_client *shared;
+
+		if (!key)
+			key = dev_name;
+		if (!key) {
+			err = -EINVAL;
+			goto put_trans;
+		}
+		mutex_lock(&p9_shared_clients_lock);
+		shared = p9_client_find_shared(clnt->trans_mod, key);
+		if (shared) {
+			/* Endpoint already has a client; reuse it. Discard the
+			 * client we speculatively allocated above.
+			 */
+			refcount_inc(&shared->refcount);
+			mutex_unlock(&p9_shared_clients_lock);
+			v9fs_put_trans(clnt->trans_mod);
+			idr_destroy(&clnt->reqs);
+			idr_destroy(&clnt->fids);
+			kfree(clnt);
+			return shared;
+		}
+		/* First mount of this endpoint. Hold the registry lock across
+		 * setup (trans->create + version negotiation) so a concurrent
+		 * mount of the same endpoint waits and then finds a fully
+		 * initialised client, rather than racing trans->create which
+		 * binds the endpoint to a single client. share_client
+		 * transports have a local backend, so the stall is bounded.
+		 */
+		clnt->shared_key = kstrdup(key, GFP_KERNEL);
+		if (!clnt->shared_key) {
+			mutex_unlock(&p9_shared_clients_lock);
+			err = -ENOMEM;
+			goto put_trans;
+		}
+		shared_locked = true;
+	}
+
 	err = clnt->trans_mod->create(clnt, dev_name, options);
 	if (err)
 		goto put_trans;
@@ -1056,6 +1154,10 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 					   NULL);
 
 	kfree(cache_name);
+	if (shared_locked) {
+		list_add(&clnt->shared_list, &p9_shared_clients);
+		mutex_unlock(&p9_shared_clients_lock);
+	}
 	return clnt;
 
 close_trans:
@@ -1063,6 +1165,10 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 put_trans:
 	v9fs_put_trans(clnt->trans_mod);
 free_client:
+	if (shared_locked) {
+		kfree(clnt->shared_key);
+		mutex_unlock(&p9_shared_clients_lock);
+	}
 	kfree(clnt);
 	return ERR_PTR(err);
 }
@@ -1075,6 +1181,18 @@ void p9_client_destroy(struct p9_client *clnt)
 
 	p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt);
 
+	/* Shared client: only the last mount tears it down. */
+	if (clnt->shared_key) {
+		mutex_lock(&p9_shared_clients_lock);
+		if (!refcount_dec_and_test(&clnt->refcount)) {
+			mutex_unlock(&p9_shared_clients_lock);
+			return;
+		}
+		list_del(&clnt->shared_list);
+		mutex_unlock(&p9_shared_clients_lock);
+		kfree(clnt->shared_key);
+	}
+
 	if (clnt->trans_mod)
 		clnt->trans_mod->close(clnt);
 
@@ -1095,6 +1213,11 @@ EXPORT_SYMBOL(p9_client_destroy);
 void p9_client_disconnect(struct p9_client *clnt)
 {
 	p9_debug(P9_DEBUG_9P, "clnt %p\n", clnt);
+	/* On a shared client, only the last mount may tear the link down;
+	 * disconnecting while a sibling mount is still live would break it.
+	 */
+	if (clnt->shared_key && refcount_read(&clnt->refcount) > 1)
+		return;
 	clnt->status = Disconnected;
 }
 EXPORT_SYMBOL(p9_client_disconnect);
@@ -1102,6 +1225,8 @@ EXPORT_SYMBOL(p9_client_disconnect);
 void p9_client_begin_disconnect(struct p9_client *clnt)
 {
 	p9_debug(P9_DEBUG_9P, "clnt %p\n", clnt);
+	if (clnt->shared_key && refcount_read(&clnt->refcount) > 1)
+		return;
 	clnt->status = BeginDisconnect;
 }
 EXPORT_SYMBOL(p9_client_begin_disconnect);
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 068d57515dd585..9960a7e8246eed 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -66,16 +66,49 @@ static int p9_xen_cancel(struct p9_client *client, struct p9_req_t *req)
 	return 1;
 }
 
+/* Value of the "tag=" mount option in @args, copied into @buf, or NULL when
+ * absent. Matched only at an option boundary. The device is selected by tag,
+ * so several mounts of one frontend can carry distinct source strings.
+ */
+static const char *p9_xen_opt_tag(const char *args, char *buf, size_t buflen)
+{
+	const char *p = args;
+
+	while (p && *p) {
+		if (!strncmp(p, "tag=", 4)) {
+			size_t n = strcspn(p + 4, ",");
+
+			if (n == 0 || n >= buflen)
+				return NULL;
+			memcpy(buf, p + 4, n);
+			buf[n] = '\0';
+			return buf;
+		}
+		p = strchr(p, ',');
+		if (p)
+			p++;
+	}
+	return NULL;
+}
+
 static int p9_xen_create(struct p9_client *client, const char *addr, char *args)
 {
 	struct xen_9pfs_front_priv *priv;
-
-	if (addr == NULL)
+	char tagbuf[64];
+	const char *tag;
+
+	/* Prefer an explicit tag= option so the mount source can differ per
+	 * mount (distinct /proc/mounts device names); fall back to the source.
+	 */
+	tag = p9_xen_opt_tag(args, tagbuf, sizeof(tagbuf));
+	if (!tag)
+		tag = addr;
+	if (tag == NULL)
 		return -EINVAL;
 
 	read_lock(&xen_9pfs_lock);
 	list_for_each_entry(priv, &xen_9pfs_devs, list) {
-		if (!strcmp(priv->tag, addr)) {
+		if (!strcmp(priv->tag, tag)) {
 			priv->client = client;
 			read_unlock(&xen_9pfs_lock);
 			return 0;
@@ -258,6 +291,7 @@ static struct p9_trans_module p9_xen_trans = {
 	.maxsize = 1 << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT - 2),
 	.pooled_rbuffers = false,
 	.def = 1,
+	.share_client = true,
 	.create = p9_xen_create,
 	.close = p9_xen_close,
 	.request = p9_xen_request,

From 6025fca68a315f3b89ad04ef5e469b3bd62056b8 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@uplinklabs.net>
Date: Fri, 14 Nov 2025 10:34:21 -0800
Subject: [PATCH 1898/1982] x86/amd_node: fix integer divide by zero during
 init

On a Xen dom0 boot, this feature does not behave, and we end up
calculating:

    num_roots = 1
    num_nodes = 2
    roots_per_node = 0

This causes a divide-by-zero in the modulus inside the loop.

This change adds a couple of guards for invalid states where we might
get a divide-by-zero.

Signed-off-by: Steven Noonan <steven@uplinklabs.net>
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
CC: Yazen Ghannam <yazen.ghannam@amd.com>
CC: x86@vger.kernel.org
CC: stable@vger.kernel.org
---
 arch/x86/kernel/amd_node.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
index 306f64536969a7..31474ac855282e 100644
--- a/arch/x86/kernel/amd_node.c
+++ b/arch/x86/kernel/amd_node.c
@@ -285,6 +285,17 @@ static int __init amd_smn_init(void)
 		return -ENODEV;
 
 	num_nodes = amd_num_nodes();
+
+	if (!num_nodes)
+		return -ENODEV;
+
+	/* Possibly a virtualized environment (e.g. Xen) where we will get
+	 * roots_per_node=0 if the number of roots is fewer than number of
+	 * nodes
+	 */
+	if (num_roots < num_nodes)
+		return -ENODEV;
+
 	amd_roots = kcalloc(num_nodes, sizeof(*amd_roots), GFP_KERNEL);
 	if (!amd_roots)
 		return -ENOMEM;

From 294a6dccdad27faaea0ac4accaf420b2a03b14b9 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:49:47 -0700
Subject: [PATCH 1899/1982] xen/evtchn: diagnose ring_overflow with
 post-barrier cons re-read

We've been seeing /dev/xen/evtchn fds enter the ring_overflow=1
state under sustained event load (specifically: many ports bound
to a single fd, all firing concurrently during a daemon-side
metrics-collection storm).  Once the flag latches, every read
returns -EFBIG and the fd is dead for event delivery until reset.

The per-port masking invariant (each bound port can occupy at
most one ring slot, because lateeoi_ack_dynirq masks the channel
at Xen level before evtchn_interrupt runs and userspace can't
unmask until it reads + writes the port back) combined with the
ring being sized to nr_evtchns means overflow should not be
reachable.  No "Interrupt for port N, but apparently not enabled"
WARNs precede the EFBIG state on hosts where this happens, so
the masking invariant is holding.

One plausible candidate: the producer's READ_ONCE(ring_cons) in
evtchn_interrupt has no acquire pairing with the consumer's
WRITE_ONCE in evtchn_read -- they take ring_prod_lock and
ring_cons_mutex respectively, neither of which synchronizes
ring_cons between them.  The smp_wmb/smp_rmb pair already
present covers ring entry visibility against ring_prod, not
ring_cons.  A producer that fires right after the consumer
drains can observe a stale ring_cons and compute
(prod - stale_cons) >= ring_size when the ring actually has
room.  On x86-TSO the staleness window is bounded to
store-buffer drain time but is non-zero; on weakly-ordered
hardware it's wider.

Add an observe-only diagnostic at the overflow point: before
setting ring_overflow, issue an smp_mb() and re-read ring_cons.
Emit a rate-limited pr_warn with prod, both cons values, both
depths, ring_size, nr_evtchns, and the triggering port's
enabled/unbinding flags, tagging the log with " SPURIOUS" when
the post-barrier depth is below ring_size (i.e., the original
overflow detection was based on a stale view).

This does not change runtime behavior other than emitting a log
line at the overflow boundary (which already required entering
a path that wedges the fd, so the printk cost is irrelevant).
If the diagnostic confirms the stale-cons hypothesis, the real
fix is to switch ring_cons access to smp_load_acquire /
smp_store_release pairing.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/evtchn.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 7e4a13e632dcee..85619b041ee851 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -189,8 +189,37 @@ static irqreturn_t evtchn_interrupt(int irq, void *data)
 			kill_fasync(&u->evtchn_async_queue,
 				    SIGIO, POLL_IN);
 		}
-	} else
+	} else {
+		unsigned int cons_now;
+
+		/*
+		 * Diagnostic: the READ_ONCE of ring_cons above has no
+		 * acquire pairing with the WRITE_ONCE in evtchn_read --
+		 * the producer holds ring_prod_lock and the consumer
+		 * holds ring_cons_mutex, so they don't synchronize on
+		 * ring_cons.  On weakly-ordered hardware (and within
+		 * the x86 store-buffer drain window) the producer can
+		 * observe a stale ring_cons and conclude the ring is
+		 * full when it actually has room.  Re-read with a full
+		 * barrier before declaring overflow and tag the log as
+		 * SPURIOUS when the post-barrier read shows the ring
+		 * had room -- that pins the cause on the cons
+		 * visibility race rather than a real fill-to-capacity
+		 * or a broken per-port masking invariant.
+		 */
+		smp_mb();
+		cons_now = READ_ONCE(u->ring_cons);
+
+		pr_warn_ratelimited(
+			"xen-evtchn overflow on %s: port=%u prod=%u cons=%u cons_after_mb=%u depth=%u depth_after_mb=%u ring_size=%u nr_evtchns=%u enabled=%d unbinding=%d%s\n",
+			u->name, evtchn->port, prod, cons, cons_now,
+			prod - cons, prod - cons_now,
+			u->ring_size, u->nr_evtchns,
+			(int)evtchn->enabled, (int)evtchn->unbinding,
+			(prod - cons_now) < u->ring_size ? " SPURIOUS" : "");
+
 		u->ring_overflow = 1;
+	}
 
 	spin_unlock(&u->ring_prod_lock);
 

From 5df498b5d558edb7e641e022f59e640ad2b97ace Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:51:31 -0700
Subject: [PATCH 1900/1982] xen: add xen_mfn_to_node to resolve a foreign
 frame's host NUMA node

Dom0 code that grant-maps foreign pages -- xenbus ring mappings,
gntdev -- has no way to learn which host NUMA node backs a foreign
frame, so nothing downstream (kthread and IRQ placement, placeholder
page homing) can be made node-local to the guest being served.  Every
backend kthread for every queue piles onto whatever node it happens
to land on, regardless of the guest's vNUMA layout.

Add xen_mfn_to_node(), resolving one host MFN to a Linux node id via
the new XENMEM_get_mfn_pxms hypercall, along with the hypercall's
interface definition.  It lives in grant-table.c because its callers
are the grant-mapping paths that need to home placeholder pages.

Three NUMA identifier namespaces are involved.  Xen returns host PXM
(firmware-supplied), matching what dom0's own SRAT already uses;
pxm_to_node() converts to a Linux dom0 node id, which is what callers
feed to Linux helpers like cpumask_of_node() and
kthread_create_on_node().  Keeping the Xen-side ABI in PXM-space lets
callers translate with one standard lookup instead of maintaining
their own Xen-nid -> Linux-node table.

The query is meaningful only in the hardware domain: Xen restricts
XENMEM_get_mfn_pxms to it, and a guest has no view of host topology
to localize against in any case.  xen_mfn_to_node returns
NUMA_NO_NODE immediately when !xen_initial_domain(), without issuing
the hypercall.

Older or non-Edera hypervisors lack the hypercall.  The first call
returns -ENOSYS, which latches a global "unsupported" flag; every
subsequent call returns NUMA_NO_NODE without entering the
hypervisor.  -EPERM (XSM policy, a late hardware domain) latches the
same way, so no boot pays more than one refused attempt.  Callers
seeing NUMA_NO_NODE fall back to NUMA-oblivious behaviour, making the
kernel-side change safe to ship without a lockstep hypervisor update.

Gated by CONFIG_XEN_BACKEND_NUMA_AFFINITY, which depends on
XEN_BACKEND, NUMA, ACPI_NUMA, and XEN_UNPOPULATED_ALLOC and defaults
to y.  XEN_UNPOPULATED_ALLOC is a hard dependency rather than a soft
one because the placement work the rest of this series performs is
only meaningful when grant-map placeholders come from a per-node
pool: with the generic balloon allocator, page_to_nid() reflects only
where dom0's free RAM happened to be, and per-ring NUMA placement
would commit to wrong nodes confidently rather than silently no-op.
Disabling the option compiles the query out; the header supplies a
NUMA_NO_NODE stub so callers need no ifdefs.

Sampling policy is left to callers.  The hypercall accepts a batch of
MFNs, though the consumers in this series query only a ring's first
frame.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/Kconfig            | 25 ++++++++++
 drivers/xen/grant-table.c      | 86 ++++++++++++++++++++++++++++++++++
 include/xen/interface/memory.h | 26 ++++++++++
 include/xen/xen.h              | 16 +++++++
 4 files changed, 153 insertions(+)

diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index f9a35ed266ecfc..147e6acb231b7e 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -96,6 +96,31 @@ config XEN_BACKEND
 	  Support for backend device drivers that provide I/O services
 	  to other virtual machines.
 
+config XEN_BACKEND_NUMA_AFFINITY
+	bool "NUMA affinity for Xen backend drivers"
+	depends on XEN_BACKEND && NUMA && ACPI_NUMA && XEN_UNPOPULATED_ALLOC
+	default y
+	help
+	  Allow Xen backend drivers (netback, blkback, gntdev consumers)
+	  to discover the host NUMA node that hosts a grant-mapped ring
+	  page, and to place their service threads and IRQs on that node.
+
+	  XEN_UNPOPULATED_ALLOC provides the per-node placeholder-page pool
+	  the relocation logic in xenbus_map_ring_valloc() draws from.
+	  Without it, placeholders come from the generic balloon allocator,
+	  whose page_to_nid() reflects only where dom0's free RAM happened
+	  to be -- not the host node of the foreign frame the placeholder
+	  will end up backing.  In that configuration the per-ring
+	  placement decisions would be confidently wrong rather than just
+	  absent, so the Kconfig hard-depends on XEN_UNPOPULATED_ALLOC
+	  rather than silently degrading.
+
+	  Requires hypervisor support for the XENMEM_get_mfn_pxms
+	  hypercall.  Without that support the feature is silently a
+	  no-op, equivalent to NUMA-oblivious behaviour.
+
+	  If unsure, say Y.
+
 config XENFS
 	tristate "Xen filesystem"
 	select XEN_PRIVCMD
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 478d2ad725ac6b..f8b86a8679de11 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -67,6 +67,10 @@
 
 #include <asm/sync_bitops.h>
 
+#ifdef CONFIG_XEN_BACKEND_NUMA_AFFINITY
+#include <acpi/acpi_numa.h>
+#endif
+
 #define GNTTAB_LIST_END 0xffffffff
 
 static grant_ref_t **gnttab_list;
@@ -881,6 +885,88 @@ int gnttab_pages_set_private(int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL_GPL(gnttab_pages_set_private);
 
+#ifdef CONFIG_XEN_BACKEND_NUMA_AFFINITY
+/*
+ * Tri-state cache for XENMEM_get_mfn_pxms availability.  -ENOSYS
+ * (hypervisor without the hypercall) or -EPERM (Xen restricts the
+ * query to the hardware domain) from the first attempt latches
+ * "unsupported", short-circuiting future calls.  Any positive ACK
+ * (including the legitimate XEN_INVALID_NUMA_ID answer for an MFN Xen
+ * does not know about) latches "supported".
+ *
+ * Lock-free: at most one transition each direction, and "unsupported"
+ * is a stable terminal state once entered.  A racing reader might
+ * issue one redundant hypercall before observing the cached state,
+ * which is harmless.
+ */
+#define XEN_MFN_PXM_UNKNOWN     0
+#define XEN_MFN_PXM_SUPPORTED   1
+#define XEN_MFN_PXM_UNSUPPORTED 2
+
+static int xen_mfn_pxm_state = XEN_MFN_PXM_UNKNOWN;
+
+/*
+ * Resolve one foreign MFN to a Linux node id.  Returns NUMA_NO_NODE
+ * for any failure mode: hypercall unsupported, MFN unknown to Xen,
+ * PXM not registered with the dom0 ACPI namespace.
+ *
+ * Three NUMA identifier namespaces are involved here.  Xen returns
+ * host PXM (firmware-supplied).  pxm_to_node() translates to a Linux
+ * dom0 node id.  Callers then use the result against Linux helpers
+ * like cpumask_of_node() and kthread_create_on_node().
+ */
+int xen_mfn_to_node(unsigned long mfn)
+{
+	struct xen_get_mfn_pxms req;
+	xen_pfn_t mfn_arg = mfn;
+	uint32_t pxm = XEN_INVALID_NUMA_ID;
+	int rc;
+
+	/*
+	 * Xen answers this query only for the hardware domain.  A domU
+	 * mapping a foreign ring (a driver domain, say) would just earn
+	 * an -EPERM per connect; skip the doomed hypercall and stay
+	 * node-oblivious, which is the only honest answer for a guest
+	 * with no view of host topology anyway.
+	 */
+	if (!xen_initial_domain())
+		return NUMA_NO_NODE;
+
+	if (READ_ONCE(xen_mfn_pxm_state) == XEN_MFN_PXM_UNSUPPORTED)
+		return NUMA_NO_NODE;
+
+	memset(&req, 0, sizeof(req));
+	set_xen_guest_handle(req.mfns, &mfn_arg);
+	set_xen_guest_handle(req.pxms, &pxm);
+	req.nr_mfns = 1;
+
+	rc = HYPERVISOR_memory_op(XENMEM_get_mfn_pxms, &req);
+	if (rc < 0) {
+		/*
+		 * Both errnos are stable properties of this boot: -ENOSYS
+		 * means the hypervisor lacks the hypercall (no CONFIG_NUMA
+		 * or too old), -EPERM that it refuses us despite the
+		 * initial-domain check above (XSM policy, or a late
+		 * hardware domain).  Latch either so we never retry.
+		 */
+		if (rc == -ENOSYS || rc == -EPERM) {
+			WRITE_ONCE(xen_mfn_pxm_state, XEN_MFN_PXM_UNSUPPORTED);
+			pr_info("XENMEM_get_mfn_pxms unavailable (%d), NUMA affinity for grant mappings disabled\n",
+				rc);
+		}
+		return NUMA_NO_NODE;
+	}
+
+	WRITE_ONCE(xen_mfn_pxm_state, XEN_MFN_PXM_SUPPORTED);
+
+	if (pxm == XEN_INVALID_NUMA_ID)
+		return NUMA_NO_NODE;
+
+	return pxm_to_node(pxm);
+}
+EXPORT_SYMBOL_GPL(xen_mfn_to_node);
+#endif /* CONFIG_XEN_BACKEND_NUMA_AFFINITY */
+
 /**
  * gnttab_alloc_pages - alloc pages suitable for grant mapping into
  * @nr_pages: number of pages to alloc
diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
index c860acaf4b0ee3..7ab099188c3fe9 100644
--- a/include/xen/interface/memory.h
+++ b/include/xen/interface/memory.h
@@ -358,4 +358,30 @@ struct xen_mem_acquire_resource {
 };
 DEFINE_GUEST_HANDLE_STRUCT(xen_mem_acquire_resource);
 
+/*
+ * XENMEM_get_mfn_pxms: resolve a batch of host MFNs to their firmware
+ * proximity-domain identifiers (host PXM on x86 ACPI).
+ *
+ * Returned values are in the host PXM namespace (the same value space
+ * dom0's own SRAT uses), not Xen's internal node id.  Callers convert
+ * to a Linux node id with pxm_to_node().  Slots Xen has no node info
+ * for receive XEN_INVALID_NUMA_ID rather than failing the whole batch.
+ *
+ * Restricted to the hardware domain.  On hypervisors that do not
+ * provide this op (older or non-Edera Xen, or builds without
+ * CONFIG_NUMA), the hypercall returns -ENOSYS; callers treat that as
+ * "feature unavailable" and fall back to NUMA-oblivious behaviour.
+ */
+#define XENMEM_get_mfn_pxms 40
+
+#define XEN_INVALID_NUMA_ID (~(uint32_t)0)
+
+struct xen_get_mfn_pxms {
+	GUEST_HANDLE(xen_pfn_t) mfns;
+	GUEST_HANDLE(uint32_t) pxms;
+	uint32_t nr_mfns;
+	uint32_t flags;
+};
+DEFINE_GUEST_HANDLE_STRUCT(xen_get_mfn_pxms);
+
 #endif /* __XEN_PUBLIC_MEMORY_H__ */
diff --git a/include/xen/xen.h b/include/xen/xen.h
index f280c5dcf92369..f7f3dd7a3abe0a 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -89,6 +89,22 @@ static inline void xen_free_unpopulated_pages(unsigned int nr_pages,
 }
 #endif
 
+/*
+ * Resolve a foreign frame's host MFN to the Linux node id of the memory
+ * backing it, via XENMEM_get_mfn_pxms.  NUMA_NO_NODE for any failure
+ * mode (hypercall unsupported or refused, MFN unknown to Xen, PXM not
+ * in the ACPI namespace) -- callers degrade to node-oblivious behaviour.
+ */
+#include <linux/numa.h>
+#ifdef CONFIG_XEN_BACKEND_NUMA_AFFINITY
+int xen_mfn_to_node(unsigned long mfn);
+#else
+static inline int xen_mfn_to_node(unsigned long mfn)
+{
+	return NUMA_NO_NODE;
+}
+#endif
+
 #if defined(CONFIG_XEN_DOM0) && defined(CONFIG_ACPI) && defined(CONFIG_X86)
 bool __init xen_processor_present(uint32_t acpi_id);
 #else

From d66d00b5e31ad50545734e1de4612f9db988cb5b Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:51:49 -0700
Subject: [PATCH 1901/1982] xen: make xen_alloc_unpopulated_pages NUMA-aware

xen_alloc_unpopulated_pages today hands out ZONE_DEVICE placeholder
pages from a single global free list, with the underlying section
registered via memremap_pages(pgmap, NUMA_NO_NODE).  page_to_nid()
of any such page reports NUMA_NO_NODE, so every consumer of
foreign-mapped grant pages -- xenbus rings, gntdev mmaps, xlate_mmu,
privcmd, xen-drm -- has no useful node information for kernel code
that consults page_to_nid (slab placement decisions, autonuma,
numastat, various softirq routing heuristics).

Partition the free list by Linux node id and register each
section-aligned IOMEM allocation against a specific node.  Pages
drawn from page_list[N] then report page_to_nid() == N by
construction.  Callers that know the host node of the foreign frame
they intend to grant-map can request from the matching pool; the
foreign frame's node and the placeholder page's nid then agree.

Two exported entry points:

  xen_alloc_unpopulated_pages_node(nr, pages, node) -- new, takes an
    explicit node preference.  NUMA_NO_NODE and out-of-range values
    are clamped to numa_node_id() at the boundary; internal code only
    ever indexes into a valid slot.

  xen_alloc_unpopulated_pages(nr, pages) -- existing API, now a
    wrapper that passes numa_node_id().  Strictly an improvement over
    NUMA_NO_NODE for callers with no node hint of their own: the
    caller's local node is at least as good a guess as none.

xen_free_unpopulated_pages routes each page back to the pool of the
node it came from via page_to_nid().  No new arguments; existing
callers do not change.

A single mutex still covers all per-node lists.  Allocation and free
are connect-time events on I/O backends and on map_grant_ref ioctls,
not contention-sensitive paths.

MAX_NUMNODES sizes the two arrays; on CONFIG_NUMA=n that is 1 and the
behaviour is byte-for-byte equivalent to the previous single-list
implementation.  The consumers that pair this allocator with
xen_mfn_to_node to home placeholders on the foreign frame's node come
in the patches that follow.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/unpopulated-alloc.c | 103 +++++++++++++++++++++++++-------
 include/xen/xen.h               |   7 +++
 2 files changed, 89 insertions(+), 21 deletions(-)

diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index 1dc0b495c8e597..ea9c768954596d 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -4,6 +4,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/memremap.h>
+#include <linux/numa.h>
 #include <linux/slab.h>
 
 #include <asm/page.h>
@@ -12,12 +13,31 @@
 #include <xen/page.h>
 #include <xen/xen.h>
 
+/*
+ * Free pages are kept on per-node lists indexed by Linux node id.  Each
+ * fill_list() call grabs a fresh section-aligned IOMEM region and
+ * registers it with memremap_pages() against a specific node, so all
+ * struct pages in that section report that node via page_to_nid().
+ * Backends that learn the host node of a foreign frame (via
+ * xenbus_ring_host_node) can request placeholder pages from the
+ * matching pool so page_to_nid agrees with the actual host placement.
+ *
+ * A single mutex covers all per-node lists.  Alloc/free are
+ * connect-time events on the I/O backends and not contention-sensitive.
+ */
 static DEFINE_MUTEX(list_lock);
-static struct page *page_list;
-static unsigned int list_count;
+static struct page *page_list[MAX_NUMNODES];
+static unsigned int list_count[MAX_NUMNODES];
 
 static struct resource *target_resource;
 
+static int xen_unpopulated_clamp_node(int node)
+{
+	if (node == NUMA_NO_NODE || node < 0 || node >= MAX_NUMNODES)
+		return numa_node_id();
+	return node;
+}
+
 /* Pages to subtract from the memory count when setting balloon target. */
 unsigned long xen_unpopulated_pages __initdata;
 
@@ -34,7 +54,7 @@ int __weak __init arch_xen_unpopulated_init(struct resource **res)
 	return 0;
 }
 
-static int fill_list(unsigned int nr_pages)
+static int fill_list(unsigned int nr_pages, int node)
 {
 	struct dev_pagemap *pgmap;
 	struct resource *res, *tmp_res = NULL;
@@ -121,7 +141,15 @@ static int fill_list(unsigned int nr_pages)
 	}
 #endif
 
-	vaddr = memremap_pages(pgmap, NUMA_NO_NODE);
+	/*
+	 * Register the section against @node so page_to_nid() of any
+	 * page in this section reports that value.  Grant-map operations
+	 * later install foreign MFNs into these slots; as long as the
+	 * caller picks the section matching the foreign MFN's host node
+	 * (which is the contract callers of xen_alloc_unpopulated_pages_node
+	 * are expected to honour), page_to_nid is correct by construction.
+	 */
+	vaddr = memremap_pages(pgmap, node);
 	if (IS_ERR(vaddr)) {
 		pr_err("Cannot remap memory range\n");
 		ret = PTR_ERR(vaddr);
@@ -131,9 +159,9 @@ static int fill_list(unsigned int nr_pages)
 	for (i = 0; i < alloc_pages; i++) {
 		struct page *pg = virt_to_page(vaddr + PAGE_SIZE * i);
 
-		pg->zone_device_data = page_list;
-		page_list = pg;
-		list_count++;
+		pg->zone_device_data = page_list[node];
+		page_list[node] = pg;
+		list_count[node]++;
 	}
 
 	return 0;
@@ -153,12 +181,21 @@ static int fill_list(unsigned int nr_pages)
 }
 
 /**
- * xen_alloc_unpopulated_pages - alloc unpopulated pages
+ * xen_alloc_unpopulated_pages_node - alloc unpopulated pages on a node
  * @nr_pages: Number of pages
  * @pages: pages returned
- * @return 0 on success, error otherwise
+ * @node: Preferred Linux node id, or NUMA_NO_NODE for current CPU's node
+ *
+ * The returned pages are drawn from a per-node pool registered with
+ * memremap_pages() against @node, so page_to_nid() reports @node for
+ * every returned page.  Callers that know the host node of a foreign
+ * frame should pass it here to keep page_to_nid in agreement with the
+ * actual host placement after a subsequent grant-map.
+ *
+ * Returns 0 on success, error otherwise.
  */
-int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
+int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
+				     int node)
 {
 	unsigned int i;
 	int ret = 0;
@@ -171,19 +208,21 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 	if (!target_resource)
 		return xen_alloc_ballooned_pages(nr_pages, pages);
 
+	node = xen_unpopulated_clamp_node(node);
+
 	mutex_lock(&list_lock);
-	if (list_count < nr_pages) {
-		ret = fill_list(nr_pages - list_count);
+	if (list_count[node] < nr_pages) {
+		ret = fill_list(nr_pages - list_count[node], node);
 		if (ret)
 			goto out;
 	}
 
 	for (i = 0; i < nr_pages; i++) {
-		struct page *pg = page_list;
+		struct page *pg = page_list[node];
 
 		BUG_ON(!pg);
-		page_list = pg->zone_device_data;
-		list_count--;
+		page_list[node] = pg->zone_device_data;
+		list_count[node]--;
 		pages[i] = pg;
 
 #ifdef CONFIG_XEN_HAVE_PVMMU
@@ -193,9 +232,9 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 				unsigned int j;
 
 				for (j = 0; j <= i; j++) {
-					pages[j]->zone_device_data = page_list;
-					page_list = pages[j];
-					list_count++;
+					pages[j]->zone_device_data = page_list[node];
+					page_list[node] = pages[j];
+					list_count[node]++;
 				}
 				goto out;
 			}
@@ -207,12 +246,32 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 	mutex_unlock(&list_lock);
 	return ret;
 }
+EXPORT_SYMBOL(xen_alloc_unpopulated_pages_node);
+
+/**
+ * xen_alloc_unpopulated_pages - alloc unpopulated pages
+ * @nr_pages: Number of pages
+ * @pages: pages returned
+ * @return 0 on success, error otherwise
+ *
+ * Equivalent to xen_alloc_unpopulated_pages_node() with the current
+ * CPU's node as the preference.
+ */
+int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
+{
+	return xen_alloc_unpopulated_pages_node(nr_pages, pages, numa_node_id());
+}
 EXPORT_SYMBOL(xen_alloc_unpopulated_pages);
 
 /**
  * xen_free_unpopulated_pages - return unpopulated pages
  * @nr_pages: Number of pages
  * @pages: pages to return
+ *
+ * Each page returns to the pool of the node it was originally allocated
+ * from, identified via page_to_nid().  Sections registered to a
+ * specific node yield pages whose nid reflects that node, so freed
+ * pages naturally land back in the matching list.
  */
 void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 {
@@ -225,9 +284,11 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 
 	mutex_lock(&list_lock);
 	for (i = 0; i < nr_pages; i++) {
-		pages[i]->zone_device_data = page_list;
-		page_list = pages[i];
-		list_count++;
+		int node = xen_unpopulated_clamp_node(page_to_nid(pages[i]));
+
+		pages[i]->zone_device_data = page_list[node];
+		page_list[node] = pages[i];
+		list_count[node]++;
 	}
 	mutex_unlock(&list_lock);
 }
diff --git a/include/xen/xen.h b/include/xen/xen.h
index f7f3dd7a3abe0a..ccf9bfa338131c 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -70,6 +70,8 @@ extern u64 xen_saved_max_mem_size;
 
 #ifdef CONFIG_XEN_UNPOPULATED_ALLOC
 extern unsigned long xen_unpopulated_pages;
+int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
+				     int node);
 int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 #include <linux/ioport.h>
@@ -77,6 +79,11 @@ int arch_xen_unpopulated_init(struct resource **res);
 #else
 #define xen_unpopulated_pages 0UL
 #include <xen/balloon.h>
+static inline int xen_alloc_unpopulated_pages_node(unsigned int nr_pages,
+		struct page **pages, int node)
+{
+	return xen_alloc_ballooned_pages(nr_pages, pages);
+}
 static inline int xen_alloc_unpopulated_pages(unsigned int nr_pages,
 		struct page **pages)
 {

From 11acd3fba5fbabf009cf80ad1b36060d535cf69a Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:51:51 -0700
Subject: [PATCH 1902/1982] xen/grant-table: add gnttab_alloc_pages_node

gnttab_alloc_pages draws grant-mapping placeholder pages via
xen_alloc_unpopulated_pages, which prefers the calling CPU's NUMA
node.  That is the right default for a caller with no better
information, but a consumer that already knows the host node of the
foreign frames it is about to map -- because it queried the node via
xen_mfn_to_node after a first map -- has no way to ask for
placeholders from the matching pool.

Add gnttab_alloc_pages_node, taking an explicit node preference and
passing it through to xen_alloc_unpopulated_pages_node, and reduce
gnttab_alloc_pages to a wrapper passing NUMA_NO_NODE (which the
unpopulated allocator clamps to the local node, preserving today's
behaviour exactly).  Frees are unchanged: gnttab_free_pages already
routes each page back to its home pool via page_to_nid.

No functional change for existing callers.  The first user is gntdev,
which will relocate a fresh grant mapping's placeholders onto the
foreign frames' node the same way the xenbus ring path gains later in
this series.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/grant-table.c | 25 ++++++++++++++++++++++---
 include/xen/grant_table.h |  1 +
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index f8b86a8679de11..879e08104805a4 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -968,15 +968,23 @@ EXPORT_SYMBOL_GPL(xen_mfn_to_node);
 #endif /* CONFIG_XEN_BACKEND_NUMA_AFFINITY */
 
 /**
- * gnttab_alloc_pages - alloc pages suitable for grant mapping into
+ * gnttab_alloc_pages_node - alloc pages suitable for grant mapping into,
+ * drawn from a specific NUMA node's placeholder pool
  * @nr_pages: number of pages to alloc
  * @pages: returns the pages
+ * @node: node to draw the pages from, or NUMA_NO_NODE for the caller's
+ * local node
+ *
+ * A caller that knows the host node of the foreign frames it is about
+ * to map can request placeholders whose page_to_nid() matches; the
+ * generic gnttab_alloc_pages() below has no such knowledge and settles
+ * for the local node.
  */
-int gnttab_alloc_pages(int nr_pages, struct page **pages)
+int gnttab_alloc_pages_node(int nr_pages, struct page **pages, int node)
 {
 	int ret;
 
-	ret = xen_alloc_unpopulated_pages(nr_pages, pages);
+	ret = xen_alloc_unpopulated_pages_node(nr_pages, pages, node);
 	if (ret < 0)
 		return ret;
 
@@ -986,6 +994,17 @@ int gnttab_alloc_pages(int nr_pages, struct page **pages)
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(gnttab_alloc_pages_node);
+
+/**
+ * gnttab_alloc_pages - alloc pages suitable for grant mapping into
+ * @nr_pages: number of pages to alloc
+ * @pages: returns the pages
+ */
+int gnttab_alloc_pages(int nr_pages, struct page **pages)
+{
+	return gnttab_alloc_pages_node(nr_pages, pages, NUMA_NO_NODE);
+}
 EXPORT_SYMBOL_GPL(gnttab_alloc_pages);
 
 #ifdef CONFIG_XEN_UNPOPULATED_ALLOC
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index 69ac6d80a006b7..d13566a00ce736 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -211,6 +211,7 @@ void gnttab_free_auto_xlat_frames(void);
 
 #define gnttab_map_vaddr(map) ((void *)(map.host_virt_addr))
 
+int gnttab_alloc_pages_node(int nr_pages, struct page **pages, int node);
 int gnttab_alloc_pages(int nr_pages, struct page **pages);
 void gnttab_free_pages(int nr_pages, struct page **pages);
 

From 8cc8c8735effc52d86b96acde0587ed43d018490 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:51:53 -0700
Subject: [PATCH 1903/1982] xen/events: add _on_node variants of the lateeoi
 bind helpers

xen_allocate_irq_dynamic() unconditionally calls
irq_alloc_desc_from(0, -1), so every Xen evtchn IRQ descriptor is
allocated with NUMA_NO_NODE.  This means /proc/irq/N/node always
reads -1 even when the caller (netback, blkback, netfront, blkfront)
already knows the right node for the IRQ.

irqbalance treats node=-1 as "no NUMA preference" and distributes
the IRQ across all CPUs for load balance, ignoring affinity_hint.
With irqbalance running, the per-queue NUMA placement we install via
irq_set_affinity_and_hint() gets overwritten almost immediately.

Add _on_node variants of the four bind helpers Xen front/back ends
use:

  bind_evtchn_to_irq_lateeoi_on_node(evtchn, node)
  bind_evtchn_to_irqhandler_lateeoi_on_node(..., node)
  bind_interdomain_evtchn_to_irq_lateeoi_on_node(..., node)
  bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(..., node)

Each passes the caller's node through to the internal chip helpers
and on to a new xen_allocate_irq_dynamic_node(node).  The existing
public functions become thin wrappers passing NUMA_NO_NODE, so every
caller that hasn't been updated keeps today's behaviour.

After this change, /proc/irq/N/node reflects the node the caller
asked for, and irqbalance respects affinity_hint as a NUMA-local
subset rather than treating the IRQ as floating.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/events/events_base.c | 86 ++++++++++++++++++++++++++------
 include/xen/events.h             | 15 ++++++
 2 files changed, 85 insertions(+), 16 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 9478fae014e50f..6368ff561472a7 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -28,6 +28,7 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/moduleparam.h>
+#include <linux/numa.h>
 #include <linux/string.h>
 #include <linux/memblock.h>
 #include <linux/slab.h>
@@ -729,9 +730,9 @@ static struct irq_info *xen_irq_init(unsigned int irq)
 	return info;
 }
 
-static struct irq_info *xen_allocate_irq_dynamic(void)
+static struct irq_info *xen_allocate_irq_dynamic_node(int node)
 {
-	int irq = irq_alloc_desc_from(0, -1);
+	int irq = irq_alloc_desc_from(0, node);
 	struct irq_info *info = NULL;
 
 	if (irq >= 0) {
@@ -743,6 +744,11 @@ static struct irq_info *xen_allocate_irq_dynamic(void)
 	return info;
 }
 
+static struct irq_info *xen_allocate_irq_dynamic(void)
+{
+	return xen_allocate_irq_dynamic_node(NUMA_NO_NODE);
+}
+
 static struct irq_info *xen_allocate_irq_gsi(unsigned int gsi)
 {
 	int irq;
@@ -1184,7 +1190,8 @@ int xen_pirq_from_irq(unsigned irq)
 EXPORT_SYMBOL_GPL(xen_pirq_from_irq);
 
 static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip,
-				   struct xenbus_device *dev, bool shared)
+				   struct xenbus_device *dev, bool shared,
+				   int node)
 {
 	int ret = -ENOMEM;
 	struct irq_info *info;
@@ -1197,7 +1204,7 @@ static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip,
 	info = evtchn_to_info(evtchn);
 
 	if (!info) {
-		info = xen_allocate_irq_dynamic();
+		info = xen_allocate_irq_dynamic_node(node);
 		if (!info)
 			goto out;
 
@@ -1232,16 +1239,25 @@ static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip,
 
 int bind_evtchn_to_irq(evtchn_port_t evtchn)
 {
-	return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL, false);
+	return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip, NULL, false,
+				       NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
 
 int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn)
 {
-	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL, false);
+	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL, false,
+				       NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi);
 
+int bind_evtchn_to_irq_lateeoi_on_node(evtchn_port_t evtchn, int node)
+{
+	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL, false,
+				       node);
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi_on_node);
+
 static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
 {
 	struct evtchn_bind_ipi bind_ipi;
@@ -1291,7 +1307,7 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
 static int bind_interdomain_evtchn_to_irq_chip(struct xenbus_device *dev,
 					       evtchn_port_t remote_port,
 					       struct irq_chip *chip,
-					       bool shared)
+					       bool shared, int node)
 {
 	struct evtchn_bind_interdomain bind_interdomain;
 	int err;
@@ -1303,17 +1319,28 @@ static int bind_interdomain_evtchn_to_irq_chip(struct xenbus_device *dev,
 					  &bind_interdomain);
 
 	return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port,
-					       chip, dev, shared);
+					       chip, dev, shared, node);
 }
 
 int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev,
 					   evtchn_port_t remote_port)
 {
 	return bind_interdomain_evtchn_to_irq_chip(dev, remote_port,
-						   &xen_lateeoi_chip, false);
+						   &xen_lateeoi_chip, false,
+						   NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
 
+int bind_interdomain_evtchn_to_irq_lateeoi_on_node(struct xenbus_device *dev,
+						   evtchn_port_t remote_port,
+						   int node)
+{
+	return bind_interdomain_evtchn_to_irq_chip(dev, remote_port,
+						   &xen_lateeoi_chip, false,
+						   node);
+}
+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi_on_node);
+
 static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn,
 		     bool percpu)
 {
@@ -1432,12 +1459,12 @@ static int bind_evtchn_to_irqhandler_chip(evtchn_port_t evtchn,
 					  irq_handler_t handler,
 					  unsigned long irqflags,
 					  const char *devname, void *dev_id,
-					  struct irq_chip *chip)
+					  struct irq_chip *chip, int node)
 {
 	int irq, retval;
 
 	irq = bind_evtchn_to_irq_chip(evtchn, chip, NULL,
-				      irqflags & IRQF_SHARED);
+				      irqflags & IRQF_SHARED, node);
 	if (irq < 0)
 		return irq;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
@@ -1456,7 +1483,8 @@ int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
 {
 	return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
 					      devname, dev_id,
-					      &xen_dynamic_chip);
+					      &xen_dynamic_chip,
+					      NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler);
 
@@ -1467,19 +1495,34 @@ int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
 {
 	return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
 					      devname, dev_id,
-					      &xen_lateeoi_chip);
+					      &xen_lateeoi_chip,
+					      NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler_lateeoi);
 
+int bind_evtchn_to_irqhandler_lateeoi_on_node(evtchn_port_t evtchn,
+					      irq_handler_t handler,
+					      unsigned long irqflags,
+					      const char *devname,
+					      void *dev_id, int node)
+{
+	return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
+					      devname, dev_id,
+					      &xen_lateeoi_chip, node);
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler_lateeoi_on_node);
+
 static int bind_interdomain_evtchn_to_irqhandler_chip(
 		struct xenbus_device *dev, evtchn_port_t remote_port,
 		irq_handler_t handler, unsigned long irqflags,
-		const char *devname, void *dev_id, struct irq_chip *chip)
+		const char *devname, void *dev_id, struct irq_chip *chip,
+		int node)
 {
 	int irq, retval;
 
 	irq = bind_interdomain_evtchn_to_irq_chip(dev, remote_port, chip,
-						  irqflags & IRQF_SHARED);
+						  irqflags & IRQF_SHARED,
+						  node);
 	if (irq < 0)
 		return irq;
 
@@ -1501,10 +1544,21 @@ int bind_interdomain_evtchn_to_irqhandler_lateeoi(struct xenbus_device *dev,
 {
 	return bind_interdomain_evtchn_to_irqhandler_chip(dev,
 				remote_port, handler, irqflags, devname,
-				dev_id, &xen_lateeoi_chip);
+				dev_id, &xen_lateeoi_chip, NUMA_NO_NODE);
 }
 EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler_lateeoi);
 
+int bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
+		struct xenbus_device *dev, evtchn_port_t remote_port,
+		irq_handler_t handler, unsigned long irqflags,
+		const char *devname, void *dev_id, int node)
+{
+	return bind_interdomain_evtchn_to_irqhandler_chip(dev,
+				remote_port, handler, irqflags, devname,
+				dev_id, &xen_lateeoi_chip, node);
+}
+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node);
+
 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
 			    irq_handler_t handler,
 			    unsigned long irqflags, const char *devname, void *dev_id)
diff --git a/include/xen/events.h b/include/xen/events.h
index de5da58a0205b0..1abc068557b4ff 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -18,6 +18,7 @@ unsigned xen_evtchn_nr_channels(void);
 
 int bind_evtchn_to_irq(evtchn_port_t evtchn);
 int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn);
+int bind_evtchn_to_irq_lateeoi_on_node(evtchn_port_t evtchn, int node);
 int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
 			      irq_handler_t handler,
 			      unsigned long irqflags, const char *devname,
@@ -26,6 +27,10 @@ int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
 			      irq_handler_t handler,
 			      unsigned long irqflags, const char *devname,
 			      void *dev_id);
+int bind_evtchn_to_irqhandler_lateeoi_on_node(evtchn_port_t evtchn,
+			      irq_handler_t handler,
+			      unsigned long irqflags, const char *devname,
+			      void *dev_id, int node);
 int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
 			    irq_handler_t handler,
@@ -39,12 +44,22 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
 			   void *dev_id);
 int bind_interdomain_evtchn_to_irq_lateeoi(struct xenbus_device *dev,
 					   evtchn_port_t remote_port);
+int bind_interdomain_evtchn_to_irq_lateeoi_on_node(struct xenbus_device *dev,
+						   evtchn_port_t remote_port,
+						   int node);
 int bind_interdomain_evtchn_to_irqhandler_lateeoi(struct xenbus_device *dev,
 						  evtchn_port_t remote_port,
 						  irq_handler_t handler,
 						  unsigned long irqflags,
 						  const char *devname,
 						  void *dev_id);
+int bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
+					struct xenbus_device *dev,
+					evtchn_port_t remote_port,
+					irq_handler_t handler,
+					unsigned long irqflags,
+					const char *devname,
+					void *dev_id, int node);
 
 /*
  * Common unbind function for all event sources. Takes IRQ to unbind from.

From bb1651e5aa0b45fffcfe1c6457d1da81dff37677 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:31 -0700
Subject: [PATCH 1904/1982] xen/xenbus: home ring mappings on the foreign
 frame's host node

Xenbus backends in PVH dom0 today have no visibility into which host
NUMA node the foreign frame backing a grant-mapped ring lives on, so
nothing can drive kthread or IRQ placement off of it, and every
backend kthread for every queue piles onto one host node regardless
of the guest's vNUMA layout.

Make xenbus_map_ring_hvm place its placeholder pages on the foreign
frame's node.  Placeholders are first drawn from numa_node_id()'s
pool, because the foreign MFN is not known before the grant_map.
After grant_map succeeds, the first page's host node is resolved via
xen_mfn_to_node and the placeholders are relocated: unmap, free,
re-allocate on the target node, re-map.  When the initial allocation
already landed on the right node, the relocate is skipped.  After
this, page_to_nid() of every mapped ring page equals the host node of
its foreign MFN by construction.

Expose the result as xenbus_ring_host_node(dev, vaddr), returning the
Linux node id of the node hosting a mapped ring, or NUMA_NO_NODE when
the information is unavailable.  Thanks to the relocation, it is a
thin wrapper around vmalloc_to_page() + page_to_nid(): no hypercall,
no lock, no per-map caching.  Backends feed the value to
cpumask_of_node() and kthread_create_on_node().

The foreign MFN is sourced from dev_bus_addr in the gnttab map
result.  Xen sets that field unconditionally for host_map operations
(see grant_table.c in the hypervisor), so it is reliable in PVH dom0.
Sampling only the first ring page's MFN is sufficient for the common
case where a ring is contiguous on one host node; multi-node
huge-page grants are a future concern.

The relocate costs one extra grant unmap + map pair per backend
connect (a rare event), paid only when the placeholder pool's node
disagrees with the foreign frame's.  A failed unmap during the
relocate marks the pages leaked and fails the whole map, since at
least one grant may still be live against a placeholder that can no
longer be reached safely.

PV dom0 is not a NUMA-affinity target: PV mappings install foreign
MFNs directly in the PTEs and have no struct page in dom0's mem_map
for the foreign frame, so xenbus_ring_host_node returns NUMA_NO_NODE
there.  On hypervisors without XENMEM_get_mfn_pxms the node resolves
to NUMA_NO_NODE at map time and the relocate is skipped entirely.
Backends seeing NUMA_NO_NODE fall back to today's NUMA-oblivious
behaviour.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/xenbus/xenbus_client.c | 96 ++++++++++++++++++++++++++++++
 include/xen/xenbus.h               | 13 ++++
 2 files changed, 109 insertions(+)

diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 2dc874fb550665..34ac3f197b92e8 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -31,15 +31,18 @@
  */
 
 #include <linux/mm.h>
+#include <linux/numa.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/vmalloc.h>
 #include <linux/export.h>
+#include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
 #include <xen/page.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/event_channel.h>
+#include <xen/interface/memory.h>
 #include <xen/balloon.h>
 #include <xen/events.h>
 #include <xen/grant_table.h>
@@ -674,6 +677,7 @@ static int xenbus_map_ring_hvm(struct xenbus_device *dev,
 {
 	struct xenbus_map_node *node = info->node;
 	int err;
+	int host_node = NUMA_NO_NODE;
 	void *addr;
 	bool leaked = false;
 	unsigned int nr_pages = XENBUS_PAGES(nr_grefs);
@@ -693,6 +697,75 @@ static int xenbus_map_ring_hvm(struct xenbus_device *dev,
 	if (err)
 		goto out_free_ballooned_pages;
 
+	/*
+	 * Xen fills dev_bus_addr with the foreign frame's machine
+	 * address on a successful host_map (see grant_table.c in the
+	 * hypervisor).  Resolve the host node now so we know whether the
+	 * placeholders need to be relocated below.
+	 */
+	if (nr_grefs > 0)
+		host_node = xen_mfn_to_node(
+			PFN_DOWN(info->map[0].dev_bus_addr));
+
+	/*
+	 * Placeholder pages came from numa_node_id()'s pool, which only
+	 * matches the foreign frame's node by coincidence.  If they
+	 * disagree, drop the mapping, return the placeholders, and redo
+	 * the map with placeholders drawn from the correct pool.  After
+	 * this, page_to_nid() of every ring page equals the host node of
+	 * its foreign MFN by construction, which keeps grant-mapped pages
+	 * truthful to every NUMA-aware code path that consults page_to_nid.
+	 *
+	 * The cost is one extra grant unmap + map pair per backend
+	 * connect (a rare event) and is paid only when the placeholder
+	 * pool's node disagrees with the foreign frame.  PV mappings and
+	 * cases where Xen cannot supply node info skip the dance entirely.
+	 */
+	if (host_node != NUMA_NO_NODE &&
+	    page_to_nid(node->hvm.pages[0]) != host_node) {
+		int relocate_err;
+
+		relocate_err = xenbus_unmap_ring(dev, node->handles, nr_grefs,
+						 info->addrs);
+		if (relocate_err != GNTST_okay) {
+			/*
+			 * Partial unmap: at least one grant may still be
+			 * live against a placeholder we can no longer
+			 * reach safely.  Mark the pages leaked and fail
+			 * the whole map.
+			 */
+			leaked = true;
+			err = -EIO;
+			goto out_free_ballooned_pages;
+		}
+
+		xen_free_unpopulated_pages(nr_pages, node->hvm.pages);
+
+		err = xen_alloc_unpopulated_pages_node(nr_pages,
+						       node->hvm.pages,
+						       host_node);
+		if (err) {
+			/*
+			 * Pages already gone; clear the array so the
+			 * cleanup path does not try to free them again.
+			 */
+			memset(node->hvm.pages, 0,
+			       nr_pages * sizeof(*node->hvm.pages));
+			node->nr_handles = 0;
+			goto out_err;
+		}
+
+		info->idx = 0;
+		gnttab_foreach_grant(node->hvm.pages, nr_grefs,
+				     xenbus_map_ring_setup_grant_hvm,
+				     info);
+
+		err = __xenbus_map_ring(dev, gnt_ref, nr_grefs, node->handles,
+					info, GNTMAP_host_map, &leaked);
+		if (err)
+			goto out_free_ballooned_pages;
+	}
+
 	addr = vmap(node->hvm.pages, nr_pages, VM_MAP | VM_IOREMAP,
 		    PAGE_KERNEL);
 	if (!addr) {
@@ -743,6 +816,29 @@ int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
 }
 EXPORT_SYMBOL_GPL(xenbus_unmap_ring_vfree);
 
+int xenbus_ring_host_node(struct xenbus_device *dev, void *vaddr)
+{
+	struct page *page;
+
+	/*
+	 * PV mappings install foreign MFNs directly in the PTEs and have
+	 * no struct page in dom0's mem_map for the foreign frame.  PVH
+	 * dom0 keeps a placeholder struct page (allocated from the
+	 * matching per-node pool of xen_alloc_unpopulated_pages_node)
+	 * whose page_to_nid() reports the host node of the foreign frame
+	 * by construction.
+	 */
+	if (xen_pv_domain())
+		return NUMA_NO_NODE;
+
+	page = vmalloc_to_page(vaddr);
+	if (!page)
+		return NUMA_NO_NODE;
+
+	return page_to_nid(page);
+}
+EXPORT_SYMBOL_GPL(xenbus_ring_host_node);
+
 #ifdef CONFIG_XEN_PV
 static int map_ring_apply(pte_t *pte, unsigned long addr, void *data)
 {
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index 7dab04cf4a36c5..18b902bf79efd7 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -225,6 +225,19 @@ int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
 
 int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr);
 
+/*
+ * Return the host NUMA node (Linux node id) of the foreign frame
+ * backing the first page of a mapping previously established by
+ * xenbus_map_ring_valloc().  Returns NUMA_NO_NODE if the hypervisor
+ * cannot provide the information, the mapping is not found, or the
+ * kernel was built without CONFIG_XEN_BACKEND_NUMA_AFFINITY.
+ *
+ * Intended for backends placing their service threads and IRQs on
+ * the node hosting the ring.  The value is resolved at map time and
+ * cached on the mapping, so this call is a cheap lookup.
+ */
+int xenbus_ring_host_node(struct xenbus_device *dev, void *vaddr);
+
 int xenbus_alloc_evtchn(struct xenbus_device *dev, evtchn_port_t *port);
 int xenbus_free_evtchn(struct xenbus_device *dev, evtchn_port_t port);
 

From 8fe11c2b672495208919e1c9c3ad33edc2782dcf Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:33 -0700
Subject: [PATCH 1905/1982] xen/xenbus: add xenbus_setup_ring_node for per-node
 ring allocation

Frontend drivers today route every ring allocation through
xenbus_setup_ring, which calls alloc_pages_exact with no node
preference.  The result is that every PV ring -- across all queues
of all multi-queue devices on a guest -- ends up on whichever node
the xenbus watch handler happens to run on, typically a single fixed
value at boot.  Multi-queue devices on multi-vnode guests therefore
defeat the dom0 backend's per-queue NUMA affinity work: all of dom0's
backend kthreads cluster on one host node because all of the guest's
rings live on one guest node, which maps to one host node.

Add a node-aware variant.  xenbus_setup_ring_node(dev, gfp, node, ...)
takes a Linux node id and draws the ring pages from that node's buddy
list.  xenbus_setup_ring() is now a thin wrapper that passes
NUMA_NO_NODE, preserving existing behaviour for every caller until
they opt in.

The same-ring locality property is preserved by construction.  A
single buddy allocation comes from a single node's free list, so all
pages of one ring remain on one node regardless of which node was
requested.  The new variant only changes which node that is.

alloc_pages_exact_nid is __meminit-restricted and not exported, so
the body cannot just delegate to it.  Use alloc_pages_node() (which
is exported and runtime-safe) to get an order-N block on the target
node, then split_page() it so every subpage carries an independent
refcount, and free any tail pages beyond ring_size back to the
allocator.

Also add xenbus_node_for_queue(index), a helper that rotates over the
set of nodes with online CPUs.  Frontend callers feed it a per-queue
or per-ring index to pick the node they pass to
xenbus_setup_ring_node.  The natural shape is
cpumask_local_spread(i, NUMA_NO_NODE), but with a NUMA_NO_NODE node
argument that falls back to a linear walk of cpu_online_mask (see
sched_numa_find_nth_cpu) and collapses every queue onto the first
node's CPUs.  Going through num_node_state(N_CPU) and
for_each_node_state(node, N_CPU) actually rotates.  Living in
xenbus_client.c rather than open-coded in each driver lets future
scsiback / pvcalls-back style frontends pick it up for free.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/xenbus/xenbus_client.c | 105 ++++++++++++++++++++++++++---
 include/xen/xenbus.h               |   4 ++
 2 files changed, 99 insertions(+), 10 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 34ac3f197b92e8..d3108f9fab324c 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/mm.h>
+#include <linux/nodemask.h>
 #include <linux/numa.h>
 #include <linux/slab.h>
 #include <linux/types.h>
@@ -378,33 +379,103 @@ static void xenbus_switch_fatal(struct xenbus_device *dev, int depth, int err,
 }
 
 /*
- * xenbus_setup_ring
+ * xenbus_setup_ring_node
  * @dev: xenbus device
+ * @gfp: GFP flags for the allocation
+ * @node: preferred Linux node id for the ring pages, or NUMA_NO_NODE
  * @vaddr: pointer to starting virtual address of the ring
  * @nr_pages: number of pages to be granted
  * @grefs: grant reference array to be filled in
  *
- * Allocate physically contiguous pages for a shared ring buffer and grant it
- * to the peer of the given device. The ring buffer is initially filled with
- * zeroes. The virtual address of the ring is stored at @vaddr and the
- * grant references are stored in the @grefs array. In case of error @vaddr
- * will be set to NULL and @grefs will be filled with INVALID_GRANT_REF.
+ * Same contract as xenbus_setup_ring(), but the ring pages are drawn
+ * from @node's buddy free list when possible (subject to fallback when
+ * @node has no available memory).  All pages of a single ring come
+ * from one buddy allocation so they remain on a single node by
+ * construction, which is the property frontends rely on to keep
+ * per-queue rings on per-queue nodes.
+ *
+ * The ring buffer is initially filled with zeroes.  The virtual address
+ * of the ring is stored at @vaddr and the grant references are stored
+ * in the @grefs array.  In case of error @vaddr will be set to NULL and
+ * @grefs will be filled with INVALID_GRANT_REF.
  */
-int xenbus_setup_ring(struct xenbus_device *dev, gfp_t gfp, void **vaddr,
-		      unsigned int nr_pages, grant_ref_t *grefs)
+/*
+ * Pick a Linux node id from the set of nodes with online CPUs, cycling
+ * by @index.  Frontends use this to distribute per-queue rings across
+ * guest NUMA nodes so the dom0 backend's per-ring placement lands them
+ * on distinct host nodes.
+ *
+ * cpumask_local_spread(i, NUMA_NO_NODE) is the natural shape this code
+ * wants, but with a NUMA_NO_NODE node argument it falls back to a
+ * straight linear walk of cpu_online_mask (see sched_numa_find_nth_cpu)
+ * which collapses every queue onto the first node's CPUs.  This helper
+ * actually rotates over nodes.
+ */
+int xenbus_node_for_queue(unsigned int index)
+{
+	unsigned int idx = 0;
+	unsigned int n;
+	int node;
+
+	n = num_node_state(N_CPU);
+	if (n == 0)
+		return NUMA_NO_NODE;
+
+	index %= n;
+	for_each_node_state(node, N_CPU) {
+		if (idx == index)
+			return node;
+		idx++;
+	}
+	return NUMA_NO_NODE;
+}
+EXPORT_SYMBOL_GPL(xenbus_node_for_queue);
+
+int xenbus_setup_ring_node(struct xenbus_device *dev, gfp_t gfp, int node,
+			   void **vaddr, unsigned int nr_pages,
+			   grant_ref_t *grefs)
 {
 	unsigned long ring_size = nr_pages * XEN_PAGE_SIZE;
+	unsigned int order;
+	unsigned long nr_alloc;
+	struct page *page;
 	grant_ref_t gref_head;
 	unsigned int i;
 	void *addr;
 	int ret;
 
-	addr = *vaddr = alloc_pages_exact(ring_size, gfp | __GFP_ZERO);
-	if (!*vaddr) {
+	*vaddr = NULL;
+
+	/*
+	 * Mirror the GFP filtering that alloc_pages_exact() does
+	 * internally: split_page() below requires a non-compound page
+	 * and HIGHMEM is incompatible with the direct virt mapping used
+	 * by the grant code.
+	 */
+	gfp &= ~(__GFP_COMP | __GFP_HIGHMEM);
+
+	order = get_order(ring_size);
+	page = alloc_pages_node(node, gfp | __GFP_ZERO, order);
+	if (!page) {
 		ret = -ENOMEM;
 		goto err;
 	}
 
+	/*
+	 * alloc_pages_node returns a single order-N block where only
+	 * the head is refcounted.  split_page makes every subpage
+	 * individually refcounted so free_pages_exact() can release the
+	 * ring page-by-page.  Return any tail pages beyond ring_size to
+	 * the allocator immediately.
+	 */
+	split_page(page, order);
+	nr_alloc = 1UL << order;
+	for (i = DIV_ROUND_UP(ring_size, PAGE_SIZE); i < nr_alloc; i++)
+		__free_page(page + i);
+
+	addr = page_address(page);
+	*vaddr = addr;
+
 	ret = gnttab_alloc_grant_references(nr_pages, &gref_head);
 	if (ret) {
 		xenbus_dev_fatal(dev, ret, "granting access to %u ring pages",
@@ -438,6 +509,20 @@ int xenbus_setup_ring(struct xenbus_device *dev, gfp_t gfp, void **vaddr,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(xenbus_setup_ring_node);
+
+/*
+ * xenbus_setup_ring
+ *
+ * Equivalent to xenbus_setup_ring_node() with no node preference; the
+ * pages come from the current CPU's local node by default GFP policy.
+ */
+int xenbus_setup_ring(struct xenbus_device *dev, gfp_t gfp, void **vaddr,
+		      unsigned int nr_pages, grant_ref_t *grefs)
+{
+	return xenbus_setup_ring_node(dev, gfp, NUMA_NO_NODE, vaddr, nr_pages,
+				      grefs);
+}
 EXPORT_SYMBOL_GPL(xenbus_setup_ring);
 
 /*
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index 18b902bf79efd7..8ce096797b867d 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -216,6 +216,10 @@ int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
 			 const char *pathfmt, ...);
 
 int xenbus_switch_state(struct xenbus_device *dev, enum xenbus_state new_state);
+int xenbus_node_for_queue(unsigned int index);
+int xenbus_setup_ring_node(struct xenbus_device *dev, gfp_t gfp, int node,
+			   void **vaddr, unsigned int nr_pages,
+			   grant_ref_t *grefs);
 int xenbus_setup_ring(struct xenbus_device *dev, gfp_t gfp, void **vaddr,
 		      unsigned int nr_pages, grant_ref_t *grefs);
 void xenbus_teardown_ring(void **vaddr, unsigned int nr_pages,

From d7239b097ec0233b8b3324d35b6c1d667f9e03e7 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:53 -0700
Subject: [PATCH 1906/1982] xen-netback: place per-queue kthreads and IRQs near
 the ring

Today both xenvif kthreads (guest-rx and dealloc) and the per-queue
event-channel IRQs run wherever the scheduler happened to place them,
which in PVH dom0 is typically all on one CPU regardless of the
guest's vNUMA layout.  When a guest's per-queue ring lives on a
different host node from the kthread, every packet pays cross-node
interconnect cost to walk the ring and to grant-copy payload pages.

Use xenbus_ring_host_node() to find the host node hosting the
queue's tx ring, then:

 - Create the guest-rx and dealloc kthreads with
   kthread_create_on_node() so the task_struct (and kernel stack) is
   allocated on the target node from the start.  A bare
   set_cpus_allowed_ptr() after kthread_run leaves the stack on the
   caller's node and continues to pay cross-node cost on every
   context switch.
 - Pin each kthread to the node's cpumask with
   set_cpus_allowed_ptr().  This is a hard pin; an operator can
   still override with taskset.  No-op when no node info is
   available.
 - Bind each evtchn IRQ on the ring's node using
   bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node() (and the
   non-handler variant for the ctrl ring), so the underlying desc is
   allocated with the right node attribute and irqbalance treats the
   IRQ as NUMA-local rather than floating.  For the ctrl ring this
   means resolving host_node before the bind instead of after.
 - Steer the tx, rx, and ctrl IRQs with irq_set_affinity_and_hint().
   This writes both the actual affinity and the affinity_hint, so a
   fresh boot without irqbalance routes IRQs correctly and irqbalance
   agrees if it is running.  Operator writes to
   /proc/irq/N/smp_affinity still win.
 - Clear the hint with irq_update_affinity_hint(irq, NULL) right
   before each unbind_from_irqhandler() in xenvif_disconnect_queue
   and xenvif_disconnect_ctrl.  free_irq() warns if the hint is still
   set at teardown (kernel/irq/manage.c:1865); destroying a domU
   would otherwise WARN in xenwatch context.

When xenbus_ring_host_node() returns NUMA_NO_NODE (older Xen without
the underlying hypercall, kernel built without
CONFIG_XEN_BACKEND_NUMA_AFFINITY, or a PV mapping), every NUMA-aware
step is skipped and the behaviour is byte-for-byte identical to the
previous code path.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/net/xen-netback/interface.c | 102 ++++++++++++++++++++++------
 1 file changed, 82 insertions(+), 20 deletions(-)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b233834ec6cc75..e5515c49dd496d 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -31,6 +31,7 @@
 #include "common.h"
 
 #include <linux/kthread.h>
+#include <linux/numa.h>
 #include <linux/sched/task.h>
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
@@ -638,19 +639,41 @@ int xenvif_connect_ctrl(struct xenvif *vif, grant_ref_t ring_ref,
 	if (req_prod - rsp_prod > RING_SIZE(&vif->ctrl))
 		goto err_unmap;
 
-	err = bind_interdomain_evtchn_to_irq_lateeoi(xendev, evtchn);
-	if (err < 0)
-		goto err_unmap;
+	{
+		/*
+		 * Resolve the host node before binding the IRQ so the
+		 * desc itself is allocated on the right node (which is
+		 * what irqbalance reads from /proc/irq/N/node when
+		 * deciding affinity).  Steer the threaded IRQ handler
+		 * toward the same node with irq_set_affinity_and_hint so
+		 * a fresh boot without irqbalance also routes correctly.
+		 * Operator writes to /proc/irq/N/smp_affinity still win.
+		 */
+		int node = xenbus_ring_host_node(xendev, vif->ctrl.sring);
 
-	vif->ctrl_irq = err;
+		err = bind_interdomain_evtchn_to_irq_lateeoi_on_node(xendev,
+								     evtchn,
+								     node);
+		if (err < 0)
+			goto err_unmap;
 
-	xenvif_init_hash(vif);
+		vif->ctrl_irq = err;
 
-	err = request_threaded_irq(vif->ctrl_irq, NULL, xenvif_ctrl_irq_fn,
-				   IRQF_ONESHOT, "xen-netback-ctrl", vif);
-	if (err) {
-		pr_warn("Could not setup irq handler for %s\n", dev->name);
-		goto err_deinit;
+		xenvif_init_hash(vif);
+
+		err = request_threaded_irq(vif->ctrl_irq, NULL,
+					   xenvif_ctrl_irq_fn,
+					   IRQF_ONESHOT,
+					   "xen-netback-ctrl", vif);
+		if (err) {
+			pr_warn("Could not setup irq handler for %s\n",
+				dev->name);
+			goto err_deinit;
+		}
+
+		if (node != NUMA_NO_NODE)
+			irq_set_affinity_and_hint(vif->ctrl_irq,
+						  cpumask_of_node(node));
 	}
 
 	return 0;
@@ -686,6 +709,11 @@ static void xenvif_disconnect_queue(struct xenvif_queue *queue)
 	}
 
 	if (queue->tx_irq) {
+		/*
+		 * free_irq() warns if affinity_hint is still set.  Drop the
+		 * hint installed at connect time before tearing the IRQ down.
+		 */
+		irq_update_affinity_hint(queue->tx_irq, NULL);
 		unbind_from_irqhandler(queue->tx_irq, queue);
 		if (queue->tx_irq == queue->rx_irq)
 			queue->rx_irq = 0;
@@ -693,6 +721,7 @@ static void xenvif_disconnect_queue(struct xenvif_queue *queue)
 	}
 
 	if (queue->rx_irq) {
+		irq_update_affinity_hint(queue->rx_irq, NULL);
 		unbind_from_irqhandler(queue->rx_irq, queue);
 		queue->rx_irq = 0;
 	}
@@ -708,6 +737,7 @@ int xenvif_connect_data(struct xenvif_queue *queue,
 {
 	struct xenbus_device *dev = xenvif_to_xenbus_device(queue->vif);
 	struct task_struct *task;
+	int ring_node;
 	int err;
 
 	BUG_ON(queue->tx_irq);
@@ -719,6 +749,16 @@ int xenvif_connect_data(struct xenvif_queue *queue,
 	if (err < 0)
 		goto err;
 
+	/*
+	 * Place the per-queue kthreads and IRQs on the host node hosting
+	 * the ring page.  Most of the per-packet work touches the ring;
+	 * keeping the worker local cuts cross-node interconnect traffic.
+	 * Returns NUMA_NO_NODE on hypervisors without XENMEM_get_mfn_pxms
+	 * or on a kernel built without CONFIG_XEN_BACKEND_NUMA_AFFINITY,
+	 * in which case the code below falls back to today's behaviour.
+	 */
+	ring_node = xenbus_ring_host_node(dev, queue->tx.sring);
+
 	init_waitqueue_head(&queue->wq);
 	init_waitqueue_head(&queue->dealloc_wq);
 	atomic_set(&queue->inflight_packets, 0);
@@ -727,8 +767,14 @@ int xenvif_connect_data(struct xenvif_queue *queue,
 
 	queue->stalled = true;
 
-	task = kthread_run(xenvif_kthread_guest_rx, queue,
-			   "%s-guest-rx", queue->name);
+	/*
+	 * Split kthread create + wake so the task_struct (and its kernel
+	 * stack) is allocated on the target node from the start.  A bare
+	 * set_cpus_allowed_ptr after kthread_run leaves the stack on the
+	 * caller's node.
+	 */
+	task = kthread_create_on_node(xenvif_kthread_guest_rx, queue,
+				      ring_node, "%s-guest-rx", queue->name);
 	if (IS_ERR(task))
 		goto kthread_err;
 	queue->task = task;
@@ -737,43 +783,58 @@ int xenvif_connect_data(struct xenvif_queue *queue,
 	 * if the thread function returns before kthread_stop is called.
 	 */
 	get_task_struct(task);
+	if (ring_node != NUMA_NO_NODE)
+		set_cpus_allowed_ptr(task, cpumask_of_node(ring_node));
+	wake_up_process(task);
 
-	task = kthread_run(xenvif_dealloc_kthread, queue,
-			   "%s-dealloc", queue->name);
+	task = kthread_create_on_node(xenvif_dealloc_kthread, queue,
+				      ring_node, "%s-dealloc", queue->name);
 	if (IS_ERR(task))
 		goto kthread_err;
 	queue->dealloc_task = task;
+	if (ring_node != NUMA_NO_NODE)
+		set_cpus_allowed_ptr(task, cpumask_of_node(ring_node));
+	wake_up_process(task);
 
 	if (tx_evtchn == rx_evtchn) {
 		/* feature-split-event-channels == 0 */
-		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
 			dev, tx_evtchn, xenvif_interrupt, 0,
-			queue->name, queue);
+			queue->name, queue, ring_node);
 		if (err < 0)
 			goto err;
 		queue->tx_irq = queue->rx_irq = err;
 		disable_irq(queue->tx_irq);
+		if (ring_node != NUMA_NO_NODE)
+			irq_set_affinity_and_hint(queue->tx_irq,
+						  cpumask_of_node(ring_node));
 	} else {
 		/* feature-split-event-channels == 1 */
 		snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
 			 "%s-tx", queue->name);
-		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
 			dev, tx_evtchn, xenvif_tx_interrupt, 0,
-			queue->tx_irq_name, queue);
+			queue->tx_irq_name, queue, ring_node);
 		if (err < 0)
 			goto err;
 		queue->tx_irq = err;
 		disable_irq(queue->tx_irq);
+		if (ring_node != NUMA_NO_NODE)
+			irq_set_affinity_and_hint(queue->tx_irq,
+						  cpumask_of_node(ring_node));
 
 		snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
 			 "%s-rx", queue->name);
-		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
 			dev, rx_evtchn, xenvif_rx_interrupt, 0,
-			queue->rx_irq_name, queue);
+			queue->rx_irq_name, queue, ring_node);
 		if (err < 0)
 			goto err;
 		queue->rx_irq = err;
 		disable_irq(queue->rx_irq);
+		if (ring_node != NUMA_NO_NODE)
+			irq_set_affinity_and_hint(queue->rx_irq,
+						  cpumask_of_node(ring_node));
 	}
 
 	return 0;
@@ -818,6 +879,7 @@ void xenvif_disconnect_ctrl(struct xenvif *vif)
 {
 	if (vif->ctrl_irq) {
 		xenvif_deinit_hash(vif);
+		irq_update_affinity_hint(vif->ctrl_irq, NULL);
 		unbind_from_irqhandler(vif->ctrl_irq, vif);
 		vif->ctrl_irq = 0;
 	}

From c44ae03fe29a2d3ae70be4f2dcec29474fe5e0fa Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:54 -0700
Subject: [PATCH 1907/1982] xen-blkback: place per-ring kthread and IRQ near
 the ring

The xenblkd kthread and per-ring event-channel IRQ today run wherever
the scheduler happens to place them, which in PVH dom0 is typically
all on one CPU regardless of the guest's vNUMA layout.  When the
guest's per-ring buffer lives on a different host node from the
worker, every request pays cross-node interconnect cost to walk the
ring and to grant-copy payload pages.

The blkback flow is split across two call sites: xen_blkif_map() maps
the ring and binds the event channel, while xen_update_blkif_status()
spawns the xenblkd kthread later.  Stash the ring's host node on the
xen_blkif_ring at map time so the kthread creation site can pick it
up without re-querying.

At map time:
 - Call xenbus_ring_host_node() right after xenbus_map_ring_valloc()
   succeeds.  Store the result in ring->host_node.
 - Bind the IRQ on the ring's node using
   bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node() so the
   underlying desc is allocated with the right node attribute and
   irqbalance treats the IRQ as NUMA-local.
 - Steer the bound IRQ with irq_set_affinity_and_hint() so a fresh
   boot without irqbalance routes correctly and irqbalance agrees if
   it is running.  Operator writes still win.

At kthread creation time:
 - Use kthread_create_on_node() with ring->host_node so the
   task_struct (and kernel stack) is allocated on the target node
   from the start.  A bare set_cpus_allowed_ptr() after kthread_run
   would leave the stack on the caller's node and pay cross-node
   cost on every context switch.
 - Hard-pin the kthread to the node's cpumask with
   set_cpus_allowed_ptr().  An operator can still override with
   taskset.

At disconnect time:
 - Clear the hint with irq_update_affinity_hint(ring->irq, NULL)
   right before each unbind_from_irqhandler().  free_irq() warns if
   the hint is still set at teardown (kernel/irq/manage.c:1865);
   destroying a domU would otherwise WARN in xenwatch context.

ring->host_node is initialised to NUMA_NO_NODE in xen_blkif_alloc_rings
so any path that misses the map step (or runs on a hypervisor without
XENMEM_get_mfn_pxms, or a kernel without CONFIG_XEN_BACKEND_NUMA_AFFINITY)
falls back to today's NUMA-oblivious behaviour without further checks.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/block/xen-blkback/common.h |  7 +++++
 drivers/block/xen-blkback/xenbus.c | 48 ++++++++++++++++++++++++++++--
 2 files changed, 52 insertions(+), 3 deletions(-)

diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index f5890b3f1df9c0..4f0df833682449 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -297,6 +297,13 @@ struct xen_blkif_ring {
 	/* Thread shutdown wait queue. */
 	wait_queue_head_t	shutdown_wq;
 	struct xen_blkif	*blkif;
+
+	/*
+	 * Linux node id of the host NUMA node hosting blk_ring, or
+	 * NUMA_NO_NODE if unknown.  Resolved at xen_blkif_map() time,
+	 * consumed when starting the per-ring xenblkd kthread.
+	 */
+	int			host_node;
 };
 
 struct xen_blkif {
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 628611ff4b8e1c..b4353d8033fc4c 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -10,6 +10,7 @@
 
 #include <linux/module.h>
 #include <linux/kthread.h>
+#include <linux/numa.h>
 #include <linux/pagemap.h>
 #include <xen/events.h>
 #include <xen/grant_table.h>
@@ -108,7 +109,17 @@ static void xen_update_blkif_status(struct xen_blkif *blkif)
 
 	for (i = 0; i < blkif->nr_rings; i++) {
 		ring = &blkif->rings[i];
-		ring->xenblkd = kthread_run(xen_blkif_schedule, ring, "%s-%d", name, i);
+		/*
+		 * Allocate the task_struct (including its kernel stack) on
+		 * the node hosting the ring so that subsequent kernel-mode
+		 * accesses on this thread stay local.  set_cpus_allowed_ptr
+		 * after kthread_create_on_node hard-pins to that node's CPUs;
+		 * an operator may still override with taskset.  NUMA_NO_NODE
+		 * leaves placement to the default scheduler.
+		 */
+		ring->xenblkd = kthread_create_on_node(xen_blkif_schedule, ring,
+						       ring->host_node,
+						       "%s-%d", name, i);
 		if (IS_ERR(ring->xenblkd)) {
 			err = PTR_ERR(ring->xenblkd);
 			ring->xenblkd = NULL;
@@ -116,6 +127,10 @@ static void xen_update_blkif_status(struct xen_blkif *blkif)
 					"start %s-%d xenblkd", name, i);
 			goto out;
 		}
+		if (ring->host_node != NUMA_NO_NODE)
+			set_cpus_allowed_ptr(ring->xenblkd,
+					     cpumask_of_node(ring->host_node));
+		wake_up_process(ring->xenblkd);
 	}
 	return;
 
@@ -158,6 +173,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif,
 		init_waitqueue_head(&ring->pending_free_wq);
 		init_waitqueue_head(&ring->shutdown_wq);
 		ring->blkif = blkif;
+		ring->host_node = NUMA_NO_NODE;
 		ring->st_print = jiffies;
 		ring->active = true;
 	}
@@ -216,6 +232,15 @@ static int xen_blkif_map(struct xen_blkif_ring *ring, grant_ref_t *gref,
 	if (err < 0)
 		return err;
 
+	/*
+	 * Stash the host node now while the mapping is fresh.  The
+	 * xenblkd kthread is created later from xen_update_blkif_status()
+	 * and consumes this value to place the worker on the node that
+	 * owns the ring.  NUMA_NO_NODE leaves placement to the default
+	 * scheduler.
+	 */
+	ring->host_node = xenbus_ring_host_node(blkif->be->dev, ring->blk_ring);
+
 	sring_common = (struct blkif_common_sring *)ring->blk_ring;
 	rsp_prod = READ_ONCE(sring_common->rsp_prod);
 	req_prod = READ_ONCE(sring_common->req_prod);
@@ -259,12 +284,23 @@ static int xen_blkif_map(struct xen_blkif_ring *ring, grant_ref_t *gref,
 	if (req_prod - rsp_prod > size)
 		goto fail;
 
-	err = bind_interdomain_evtchn_to_irqhandler_lateeoi(blkif->be->dev,
-			evtchn, xen_blkif_be_int, 0, "blkif-backend", ring);
+	err = bind_interdomain_evtchn_to_irqhandler_lateeoi_on_node(
+			blkif->be->dev, evtchn, xen_blkif_be_int, 0,
+			"blkif-backend", ring, ring->host_node);
 	if (err < 0)
 		goto fail;
 	ring->irq = err;
 
+	/*
+	 * Route the event channel toward the ring's host node.  Writes
+	 * both the actual affinity (relied on at boot when irqbalance is
+	 * absent) and the hint (so irqbalance agrees if it is running).
+	 * Operator writes to /proc/irq/N/smp_affinity still win.
+	 */
+	if (ring->host_node != NUMA_NO_NODE)
+		irq_set_affinity_and_hint(ring->irq,
+					  cpumask_of_node(ring->host_node));
+
 	return 0;
 
 fail:
@@ -303,6 +339,12 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 		}
 
 		if (ring->irq) {
+			/*
+			 * free_irq() warns if affinity_hint is still set.
+			 * Drop the hint installed at map time before tearing
+			 * the IRQ down.
+			 */
+			irq_update_affinity_hint(ring->irq, NULL);
 			unbind_from_irqhandler(ring->irq, ring);
 			ring->irq = 0;
 		}

From db8ed0c5324b702a0beb5e14600ef265c3e8baea Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:57 -0700
Subject: [PATCH 1908/1982] xen-netfront: place per-queue rings on per-queue
 nodes, with XPS

Today every netfront queue allocates its tx and rx rings from
xenbus_setup_ring(), which has no node preference and pulls from the
buddy free list of whichever node the xenbus watch handler is on.
On a multi-queue device, every queue's rings end up on the same
guest node.  Combined with vNUMA->host-node mapping that puts each
guest node on its own host node, this funnels all of dom0's
per-queue backend kthreads onto a single host node and defeats the
multi-queue parallelism the dom0 backend is otherwise prepared to
deliver.

Pick a per-queue node with xenbus_node_for_queue(queue->id) and pass
it to xenbus_setup_ring_node() for both tx and rx rings.  Same-ring
locality is preserved by construction (one buddy allocation comes
from one node); different rings of different queues now land on
different nodes on multi-vnode guests.  Single-vnode guests
degenerate to node 0 for every queue, identical to the previous
behaviour.

Thread the same node through setup_netfront_split() and
setup_netfront_single() so the per-queue evtchn IRQs are bound with
bind_evtchn_to_irqhandler_lateeoi_on_node().  The underlying desc is
then allocated with the right node attribute and irqbalance treats
each IRQ as NUMA-local rather than floating.

Apply irq_set_affinity_and_hint() to each queue's tx/rx IRQ at
connect time using the same per-queue node.  NAPI runs in softirq on
the CPU that took the IRQ; landing IRQ + NAPI + ring on one node
keeps the receive path NUMA-local.  Sets both actual affinity and
hint so behaviour is correct on guests without irqbalance; operator
writes to /proc/irq/N/smp_affinity still win.

Install an XPS map for each queue mapping the node's cpumask to that
queue's index.  Without this, __netdev_pick_tx falls back to
hash-based queue selection and a sender on any CPU can land on any
queue regardless of where its data wants to live; the ring-placement
work above is then wasted because the actual sender-to-queue
pairing is random.  With XPS in place, a sender on a CPU in node N
selects queue N, whose rings are on node N, whose dom0 backend
kthread is on the host node hosting those rings: an end-to-end
NUMA-local TX path with no cross-node payload movement up to the
hypervisor boundary.

In xennet_disconnect_backend(), clear the hint with
irq_update_affinity_hint(irq, NULL) before each unbind_from_irqhandler
in both the shared- and split-evtchn paths.  free_irq() warns if the
hint is still set at teardown (kernel/irq/manage.c:1865); reconnects
would otherwise WARN.

Operator writes to /proc/sys/net/.../xps_cpus continue to win on
subsequent writes -- this only provides a sensible default.  XPS is
also conditional: CONFIG_XPS off makes netif_set_xps_queue a stub,
and an empty cpumask (memory-only NUMA node, possible if unusual on
guests) skips the install to avoid programming an effectively-unusable
map.  On reconnect, the new setup_netfront calls overwrite the XPS
map with fresh values; the netdev-scoped map is freed when the
netdev unregisters.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/net/xen-netfront.c | 107 ++++++++++++++++++++++++++++++-------
 1 file changed, 88 insertions(+), 19 deletions(-)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5be8d977d07512..065a6ea09081a6 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -31,10 +31,12 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/cpumask.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/numa.h>
 #include <linux/skbuff.h>
 #include <linux/ethtool.h>
 #include <linux/if_ether.h>
@@ -1834,9 +1836,17 @@ static void xennet_disconnect_backend(struct netfront_info *info)
 
 		timer_delete_sync(&queue->rx_refill_timer);
 
-		if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
+		/*
+		 * free_irq() warns if affinity_hint is still set.  Drop the
+		 * hint installed at connect time before tearing the IRQ down.
+		 */
+		if (queue->tx_irq && (queue->tx_irq == queue->rx_irq)) {
+			irq_update_affinity_hint(queue->tx_irq, NULL);
 			unbind_from_irqhandler(queue->tx_irq, queue);
+		}
 		if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
+			irq_update_affinity_hint(queue->tx_irq, NULL);
+			irq_update_affinity_hint(queue->rx_irq, NULL);
 			unbind_from_irqhandler(queue->tx_irq, queue);
 			unbind_from_irqhandler(queue->rx_irq, queue);
 		}
@@ -1912,7 +1922,7 @@ static int xen_net_read_mac(struct xenbus_device *dev, u8 mac[])
 	return 0;
 }
 
-static int setup_netfront_single(struct netfront_queue *queue)
+static int setup_netfront_single(struct netfront_queue *queue, int node)
 {
 	int err;
 
@@ -1920,10 +1930,10 @@ static int setup_netfront_single(struct netfront_queue *queue)
 	if (err < 0)
 		goto fail;
 
-	err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
-						xennet_interrupt, 0,
-						queue->info->netdev->name,
-						queue);
+	err = bind_evtchn_to_irqhandler_lateeoi_on_node(queue->tx_evtchn,
+							xennet_interrupt, 0,
+							queue->info->netdev->name,
+							queue, node);
 	if (err < 0)
 		goto bind_fail;
 	queue->rx_evtchn = queue->tx_evtchn;
@@ -1938,7 +1948,7 @@ static int setup_netfront_single(struct netfront_queue *queue)
 	return err;
 }
 
-static int setup_netfront_split(struct netfront_queue *queue)
+static int setup_netfront_split(struct netfront_queue *queue, int node)
 {
 	int err;
 
@@ -1951,18 +1961,20 @@ static int setup_netfront_split(struct netfront_queue *queue)
 
 	snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
 		 "%s-tx", queue->name);
-	err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
-						xennet_tx_interrupt, 0,
-						queue->tx_irq_name, queue);
+	err = bind_evtchn_to_irqhandler_lateeoi_on_node(queue->tx_evtchn,
+							xennet_tx_interrupt, 0,
+							queue->tx_irq_name,
+							queue, node);
 	if (err < 0)
 		goto bind_tx_fail;
 	queue->tx_irq = err;
 
 	snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
 		 "%s-rx", queue->name);
-	err = bind_evtchn_to_irqhandler_lateeoi(queue->rx_evtchn,
-						xennet_rx_interrupt, 0,
-						queue->rx_irq_name, queue);
+	err = bind_evtchn_to_irqhandler_lateeoi_on_node(queue->rx_evtchn,
+							xennet_rx_interrupt, 0,
+							queue->rx_irq_name,
+							queue, node);
 	if (err < 0)
 		goto bind_rx_fail;
 	queue->rx_irq = err;
@@ -1987,6 +1999,7 @@ static int setup_netfront(struct xenbus_device *dev,
 {
 	struct xen_netif_tx_sring *txs;
 	struct xen_netif_rx_sring *rxs;
+	int node;
 	int err;
 
 	queue->tx_ring_ref = INVALID_GRANT_REF;
@@ -1994,32 +2007,88 @@ static int setup_netfront(struct xenbus_device *dev,
 	queue->rx.sring = NULL;
 	queue->tx.sring = NULL;
 
-	err = xenbus_setup_ring(dev, GFP_NOIO | __GFP_HIGH, (void **)&txs,
-				1, &queue->tx_ring_ref);
+	/*
+	 * Distribute queues across guest NUMA nodes by rotating over
+	 * nodes-with-CPUs.  On a single-vnode guest every queue lands
+	 * on node 0 and behaviour matches the legacy default.  On a
+	 * multi-vnode guest, queues spread across nodes and pair up
+	 * naturally with the dom0 backend's per-queue node-affinity
+	 * placement.
+	 */
+	node = xenbus_node_for_queue(queue->id);
+
+	err = xenbus_setup_ring_node(dev, GFP_NOIO | __GFP_HIGH, node,
+				     (void **)&txs, 1, &queue->tx_ring_ref);
 	if (err)
 		goto fail;
 
 	XEN_FRONT_RING_INIT(&queue->tx, txs, XEN_PAGE_SIZE);
 
-	err = xenbus_setup_ring(dev, GFP_NOIO | __GFP_HIGH, (void **)&rxs,
-				1, &queue->rx_ring_ref);
+	err = xenbus_setup_ring_node(dev, GFP_NOIO | __GFP_HIGH, node,
+				     (void **)&rxs, 1, &queue->rx_ring_ref);
 	if (err)
 		goto fail;
 
 	XEN_FRONT_RING_INIT(&queue->rx, rxs, XEN_PAGE_SIZE);
 
 	if (feature_split_evtchn)
-		err = setup_netfront_split(queue);
+		err = setup_netfront_split(queue, node);
 	/* setup single event channel if
 	 *  a) feature-split-event-channels == 0
 	 *  b) feature-split-event-channels == 1 but failed to setup
 	 */
 	if (!feature_split_evtchn || err)
-		err = setup_netfront_single(queue);
+		err = setup_netfront_single(queue, node);
 
 	if (err)
 		goto fail;
 
+	/*
+	 * Route each per-queue evtchn IRQ toward the same node the ring
+	 * lives on.  NAPI runs in softirq on the CPU that took the IRQ;
+	 * landing IRQ + NAPI + ring on one node keeps the receive path
+	 * NUMA-local.  Sets both actual affinity and hint so behaviour
+	 * is correct on guests without irqbalance.  Operator writes to
+	 * /proc/irq/N/smp_affinity continue to win.
+	 */
+	if (node != NUMA_NO_NODE) {
+		const struct cpumask *mask = cpumask_of_node(node);
+
+		if (!cpumask_empty(mask)) {
+			irq_set_affinity_and_hint(queue->tx_irq, mask);
+			if (queue->rx_irq != queue->tx_irq)
+				irq_set_affinity_and_hint(queue->rx_irq, mask);
+		}
+	}
+
+	/*
+	 * Steer senders toward this queue based on the same node the
+	 * rings live on.  __netdev_pick_tx consults the XPS map first;
+	 * a sender on a CPU in `node` will pick `queue->id`, whose
+	 * rings are on `node`, and dom0's matching backend kthread is
+	 * pinned to the host node that hosts those rings.  Without
+	 * this, the kernel's default hash-based queue selection lets a
+	 * sender on any node land on any queue, defeating the per-queue
+	 * NUMA-locality story.  An operator write to xps_cpus
+	 * overrides on subsequent writes.
+	 *
+	 * netif_set_xps_queue silently returns 0 if CONFIG_XPS is off;
+	 * an empty cpumask (e.g. memory-only NUMA node) is skipped to
+	 * avoid programming an effectively-unusable map.
+	 */
+	if (node != NUMA_NO_NODE) {
+		const struct cpumask *mask = cpumask_of_node(node);
+
+		if (!cpumask_empty(mask)) {
+			int xps_err = netif_set_xps_queue(queue->info->netdev,
+							  mask, queue->id);
+			if (xps_err)
+				netdev_warn(queue->info->netdev,
+					    "XPS setup failed for queue %u: %d\n",
+					    queue->id, xps_err);
+		}
+	}
+
 	return 0;
 
  fail:

From 16af4223c8608d3c864e0094d00ceaf7a3cec96d Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:52:59 -0700
Subject: [PATCH 1909/1982] xen-blkfront: place per-ring buffers on per-hctx
 nodes

Today every blkfront ring (one per hctx in multi-queue mode) is
allocated from xenbus_setup_ring() with no node preference, so all
of a multi-queue blkfront's rings end up on whichever node the
xenbus watch handler runs on.  Combined with vNUMA->host-node
mapping, this funnels every dom0 backend xenblkd kthread onto a
single host node and defeats multi-queue parallelism.

Pick a per-ring node with xenbus_node_for_queue(ring_idx) and pass it
to xenbus_setup_ring_node().  Different rings now land on different
guest nodes on multi-vnode guests; same-ring locality is preserved
by the underlying buddy allocation.

The ring's index is recovered from its byte offset within
info->rinfo because struct blkfront_ring_info has a flex array
trailer and sizeof() is not the stride; the same arithmetic appears
in get_rinfo() and for_each_rinfo().

Bind the ring's evtchn IRQ on the ring's node using
bind_evtchn_to_irqhandler_lateeoi_on_node().  The desc is then
allocated with the right node attribute and irqbalance treats the
IRQ as NUMA-local.

Apply irq_set_affinity_and_hint() to the per-ring IRQ using the same
node.  The IRQ fires on a CPU in the ring's node; blk-mq routes the
completion onward to the original submitter via the request_irq
machinery, so the wake-up edge stays on the right node before that
handoff.  Sets both actual affinity and hint; operator writes to
/proc/irq/N/smp_affinity continue to win.

No XPS-equivalent steering is needed on the block side.  blk-mq's
existing hctx-to-CPU map already routes submissions: a process
running on CPU C submits via the hctx blk-mq mapped to C, and our
ring node for that hctx is derived from the same node-rotation
helper.  The submitter is on the same node as the ring by
construction.

In blkif_free_ring(), clear the hint with
irq_update_affinity_hint(rinfo->irq, NULL) before
unbind_from_irqhandler().  free_irq() warns if the hint is still set
at teardown (kernel/irq/manage.c:1865); reconnects would otherwise
WARN.

Single-vnode guests are unaffected: every ring's node resolves to
node 0 and behaviour matches the previous default.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/block/xen-blkfront.c | 53 ++++++++++++++++++++++++++++++++----
 1 file changed, 48 insertions(+), 5 deletions(-)

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 79fe0b107887cf..14e48a31212551 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -35,12 +35,14 @@
  * IN THE SOFTWARE.
  */
 
+#include <linux/cpumask.h>
 #include <linux/interrupt.h>
 #include <linux/blkdev.h>
 #include <linux/blk-mq.h>
 #include <linux/hdreg.h>
 #include <linux/cdrom.h>
 #include <linux/module.h>
+#include <linux/numa.h>
 #include <linux/slab.h>
 #include <linux/major.h>
 #include <linux/mutex.h>
@@ -1214,8 +1216,14 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
 	 * Interrupt teardown must be done ahead of freeing queue-related
 	 * data, otherwise the interrupt handler can race with the cleanup.
 	 */
-	if (rinfo->irq)
+	if (rinfo->irq) {
+		/*
+		 * free_irq() warns if affinity_hint is still set.  Drop the
+		 * hint installed at setup time before tearing the IRQ down.
+		 */
+		irq_update_affinity_hint(rinfo->irq, NULL);
 		unbind_from_irqhandler(rinfo->irq, rinfo);
+	}
 	rinfo->evtchn = rinfo->irq = 0;
 
 	/*
@@ -1688,9 +1696,29 @@ static int setup_blkring(struct xenbus_device *dev,
 	int err;
 	struct blkfront_info *info = rinfo->dev_info;
 	unsigned long ring_size = info->nr_ring_pages * XEN_PAGE_SIZE;
+	unsigned int ring_idx;
+	int node;
+
+	/*
+	 * Recover the ring index from its slot in info->rinfo.  The same
+	 * arithmetic is used by get_rinfo() and for_each_rinfo() (the
+	 * struct has a flex array so sizeof() is not the stride).
+	 */
+	ring_idx = ((unsigned long)rinfo - (unsigned long)info->rinfo) /
+		   info->rinfo_size;
+
+	/*
+	 * Distribute rings across guest NUMA nodes by rotating over
+	 * nodes-with-CPUs.  blk-mq's default hctx-to-CPU map is also
+	 * NUMA-balanced (blk_mq_map_queues uses NUMA-aware distribution
+	 * when topology is present), so a submitter on a node-N CPU
+	 * lands on the hctx whose ring is on node N.  No XPS-equivalent
+	 * steering needed on the block side -- blk-mq already does it.
+	 */
+	node = xenbus_node_for_queue(ring_idx);
 
-	err = xenbus_setup_ring(dev, GFP_NOIO, (void **)&sring,
-				info->nr_ring_pages, rinfo->ring_ref);
+	err = xenbus_setup_ring_node(dev, GFP_NOIO, node, (void **)&sring,
+				     info->nr_ring_pages, rinfo->ring_ref);
 	if (err)
 		goto fail;
 
@@ -1700,8 +1728,9 @@ static int setup_blkring(struct xenbus_device *dev,
 	if (err)
 		goto fail;
 
-	err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt,
-						0, "blkif", rinfo);
+	err = bind_evtchn_to_irqhandler_lateeoi_on_node(rinfo->evtchn,
+							blkif_interrupt, 0,
+							"blkif", rinfo, node);
 	if (err <= 0) {
 		xenbus_dev_fatal(dev, err,
 				 "bind_evtchn_to_irqhandler failed");
@@ -1709,6 +1738,20 @@ static int setup_blkring(struct xenbus_device *dev,
 	}
 	rinfo->irq = err;
 
+	/*
+	 * Route the ring's evtchn IRQ toward the same node the ring
+	 * lives on.  blk-mq completes requests on the submitting CPU
+	 * via the request_irq path; firing the IRQ on the ring's node
+	 * keeps the wake-up on the right node before blk-mq routes the
+	 * completion onward.  Sets both actual affinity and hint.
+	 */
+	if (node != NUMA_NO_NODE) {
+		const struct cpumask *mask = cpumask_of_node(node);
+
+		if (!cpumask_empty(mask))
+			irq_set_affinity_and_hint(rinfo->irq, mask);
+	}
+
 	return 0;
 fail:
 	blkif_free(info, 0);

From 7d764db24f2b14a0511b151611508c5e30bcd452 Mon Sep 17 00:00:00 2001
From: Steven Noonan <steven@edera.dev>
Date: Mon, 20 Jul 2026 13:53:00 -0700
Subject: [PATCH 1910/1982] xen/gntdev: home grant-map placeholder pages on the
 foreign frame's node

On an auto-translated dom0, gntdev backs each userspace grant mapping
with placeholder pages drawn from the unpopulated-page pool of the
mapping CPU's local node.  page_to_nid() of such a page therefore
reflects where the mapper happened to run, not where the foreign frame
actually lives, and userspace has no way at all to learn the frame's
home: gntdev never surfaces dev_bus_addr, and /proc/self/pagemap only
yields the placeholder's dom0 pseudo-physical frame.

Do for gntdev what xenbus_map_ring_hvm already does for kernel ring
mappings.  After the first successful gnttab_map_refs -- and before
the pages become visible outside the map: gntdev_mmap() only inserts
them into the VMA afterwards, and map->in_use limits a map to a single
mmap -- resolve the first frame's host node via xen_mfn_to_node.  If
the placeholders live elsewhere, allocate replacements from the
matching pool, unmap, and remap onto them.  The frames of one map
overwhelmingly share a node (they are rings or buffers the granting
guest allocated together), so following the first frame mirrors the
xenbus precedent.  DMA-allocated backing (CONFIG_XEN_GRANT_DMA_ALLOC)
is skipped: its physical placement is part of its contract.

The ordering makes failure handling one-directional.  Replacement
pages are allocated before anything moves, so allocation failure --
like an unresolvable node, a hint-free hypervisor, or a domU caller
(xen_mfn_to_node answers only in the hardware domain) -- leaves the
original mapping untouched.  Once the old mapping has been torn down,
a failure poisons the map's statuses and handles so the caller's
accounting loop reports the map as wholly failed and teardown does not
unmap a second time; should the unmap itself fail, the old pages may
still carry live foreign mappings, so they are deliberately leaked
rather than returned to the allocator, exactly as the xenbus relocate
leaks placeholders it can no longer reach safely.

The payoff is that the node information becomes visible to userspace
through an existing interface: get_mempolicy(MPOL_F_ADDR | MPOL_F_NODE)
on a gntdev-mapped address returns page_to_nid of the placeholder
(gntdev VMAs are VM_MIXEDMAP with normal PTEs, which the GUP slow path
resolves), which now equals the foreign frame's node.  A userspace
paravirtual backend can map a guest's ring, ask the kernel which node
that ring lives on, and bind its memory and I/O threads to match --
the userspace analogue of the netback/blkback per-queue placement.
move_pages(2) and /proc/self/numa_maps still ignore these mappings;
both explicitly skip ZONE_DEVICE pages.

Signed-off-by: Steven Noonan <steven@edera.dev>
---
 drivers/xen/gntdev.c | 123 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 02ebbdba861018..9a55008deb7d74 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -327,6 +327,119 @@ static int find_grant_ptes(pte_t *pte, unsigned long addr, void *data)
 	return 0;
 }
 
+/*
+ * Relocate a freshly mapped map's placeholder pages onto the NUMA node
+ * hosting the foreign frames, so that page_to_nid() of a grant-mapped
+ * page reports the frame's true home -- the same dance
+ * xenbus_map_ring_hvm() performs for kernel ring mappings.  Userspace
+ * can then recover the node of a mapping it created with
+ * get_mempolicy(MPOL_F_ADDR | MPOL_F_NODE) and place its I/O threads
+ * and buffers accordingly.
+ *
+ * Runs after the first successful gnttab_map_refs() and before the
+ * pages are visible outside the map (gntdev_mmap() inserts them into
+ * the VMA only after gntdev_map_grant_pages() returns, and map->in_use
+ * limits a map to a single mmap), so the unmap/remap below cannot race
+ * a user access.
+ *
+ * Best-effort while nothing has moved: any failure to learn or improve
+ * the placement leaves the original mapping untouched and returns 0.  A
+ * failure while moving the mapping poisons the map and returns an
+ * error, since a half-relocated map must not be exposed.
+ */
+static int gntdev_relocate_map(struct gntdev_grant_map *map)
+{
+	struct page **pages;
+	int node, i, err;
+
+#ifdef CONFIG_XEN_GRANT_DMA_ALLOC
+	/* DMA-allocated backing must keep its physical placement. */
+	if (map->dma_vaddr)
+		return 0;
+#endif
+
+	/* Only relocate a fully successful map. */
+	for (i = 0; i < map->count; i++)
+		if (map->map_ops[i].status != GNTST_okay)
+			return 0;
+
+	/*
+	 * Xen filled dev_bus_addr with the foreign frame's machine
+	 * address on the successful host_map.  The frames of one map
+	 * overwhelmingly share a node (they are rings or buffers the
+	 * granting guest allocated together), so follow the first frame,
+	 * as the xenbus ring path does.
+	 */
+	node = xen_mfn_to_node(PFN_DOWN(map->map_ops[0].dev_bus_addr));
+	if (node == NUMA_NO_NODE || node == page_to_nid(map->pages[0]))
+		return 0;
+
+	pages = kvcalloc(map->count, sizeof(pages[0]), GFP_KERNEL);
+	if (!pages)
+		return 0;
+	if (gnttab_alloc_pages_node(map->count, pages, node)) {
+		kvfree(pages);
+		return 0;
+	}
+
+	for (i = 0; i < map->count; i++) {
+		map->unmap_ops[i].handle = map->map_ops[i].handle;
+		if (map->flags & GNTMAP_device_map)
+			map->unmap_ops[i].dev_bus_addr =
+				map->map_ops[i].dev_bus_addr;
+	}
+	err = gnttab_unmap_refs(map->unmap_ops, map->kunmap_ops, map->pages,
+				map->count);
+	if (err) {
+		/*
+		 * The old placeholders may still carry live foreign
+		 * mappings; freeing them would hand foreign-mapped frames
+		 * back to the allocator.  Swap in the clean replacements
+		 * so teardown frees those instead, deliberately leak the
+		 * old pages, and fail the map.
+		 */
+		pr_err("relocate unmap failed (%d); leaking %d pages\n",
+		       err, map->count);
+		memcpy(map->pages, pages, map->count * sizeof(pages[0]));
+		kvfree(pages);
+		goto poison;
+	}
+
+	gnttab_free_pages(map->count, map->pages);
+	memcpy(map->pages, pages, map->count * sizeof(pages[0]));
+	kvfree(pages);
+
+	for (i = 0; i < map->count; i++) {
+		unsigned long addr = (unsigned long)
+			pfn_to_kaddr(page_to_pfn(map->pages[i]));
+		gnttab_set_map_op(&map->map_ops[i], addr, map->flags,
+				  map->grants[i].ref, map->grants[i].domid);
+		gnttab_set_unmap_op(&map->unmap_ops[i], addr, map->flags,
+				    INVALID_GRANT_HANDLE);
+	}
+	err = gnttab_map_refs(map->map_ops, map->kmap_ops, map->pages,
+			      map->count);
+	if (err) {
+		pr_err("relocate remap on node %d failed (%d)\n", node, err);
+		goto poison;
+	}
+
+	return 0;
+
+poison:
+	/*
+	 * Present the map as wholly failed: no handle survives for the
+	 * caller's status loop to account, or for teardown to unmap a
+	 * second time.
+	 */
+	for (i = 0; i < map->count; i++) {
+		map->map_ops[i].status = GNTST_general_error;
+		map->map_ops[i].handle = INVALID_GRANT_HANDLE;
+		map->unmap_ops[i].handle = INVALID_GRANT_HANDLE;
+	}
+	return err;
+}
+
 int gntdev_map_grant_pages(struct gntdev_grant_map *map)
 {
 	size_t alloced = 0;
@@ -377,6 +490,16 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
 	err = gnttab_map_refs(map->map_ops, map->kmap_ops, map->pages,
 			map->count);
 
+	/*
+	 * Auto-translated placeholders came from the local node's pool,
+	 * which matches the foreign frames' node only by coincidence;
+	 * move them to the frames' real home while nothing can observe
+	 * the map.  PV installs foreign MFNs directly in the PTEs and has
+	 * no dom0 struct page to relocate.
+	 */
+	if (!err && !xen_pv_domain())
+		err = gntdev_relocate_map(map);
+
 	for (i = 0; i < map->count; i++) {
 		if (map->map_ops[i].status == GNTST_okay) {
 			map->unmap_ops[i].handle = map->map_ops[i].handle;

From f1ac2bbbe01a9d6059cd9dbd7114b5fe03b3acb3 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Wed, 27 May 2026 13:21:23 -0500
Subject: [PATCH 1911/1982] xen: xlate_mmu: relocate remap_pfn utils

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
---
 drivers/xen/xlate_mmu.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index f17c4c03db30c8..6a15396b08aa1f 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -61,6 +61,25 @@ static void xen_for_each_gfn(struct page **pages, unsigned nr_gfn,
 	}
 }
 
+struct remap_pfn {
+	struct mm_struct *mm;
+	struct page **pages;
+	pgprot_t prot;
+	unsigned long i;
+};
+
+static int remap_pfn_fn(pte_t *ptep, unsigned long addr, void *data)
+{
+	struct remap_pfn *r = data;
+	struct page *page = r->pages[r->i];
+	pte_t pte = pte_mkspecial(pfn_pte(page_to_pfn(page), r->prot));
+
+	set_pte_at(r->mm, addr, ptep, pte);
+	r->i++;
+
+	return 0;
+}
+
 struct remap_data {
 	xen_pfn_t *fgfn; /* foreign domain's gfn */
 	int nr_fgfn; /* Number of foreign gfn left to map */
@@ -262,25 +281,6 @@ int __init xen_xlate_map_ballooned_pages(xen_pfn_t **gfns, void **virt,
 	return 0;
 }
 
-struct remap_pfn {
-	struct mm_struct *mm;
-	struct page **pages;
-	pgprot_t prot;
-	unsigned long i;
-};
-
-static int remap_pfn_fn(pte_t *ptep, unsigned long addr, void *data)
-{
-	struct remap_pfn *r = data;
-	struct page *page = r->pages[r->i];
-	pte_t pte = pte_mkspecial(pfn_pte(page_to_pfn(page), r->prot));
-
-	set_pte_at(r->mm, addr, ptep, pte);
-	r->i++;
-
-	return 0;
-}
-
 /* Used by the privcmd module, but has to be built-in on ARM */
 int xen_remap_vma_range(struct vm_area_struct *vma, unsigned long addr, unsigned long len)
 {

From 1593534786d5f8f6f4b1008b67e3a2eff8b655f6 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Wed, 27 May 2026 13:47:13 -0500
Subject: [PATCH 1912/1982] xen: xlate_mmu: batch gfn mappings

PVH dom0 wanting to map in guest memory would iterate over each page
individually invoking hypercall add_to_physmap_range, leading to high
mapping latencies.

Refactor xen_xlate_remap_gfn_array to separately batch GFN mappings to
the hypervisor to amortize hypercall overhead.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
---
 drivers/xen/xlate_mmu.c | 133 +++++++++++++++++++++++-----------------
 1 file changed, 76 insertions(+), 57 deletions(-)

diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
index 6a15396b08aa1f..f8dd332b7f46c2 100644
--- a/drivers/xen/xlate_mmu.c
+++ b/drivers/xen/xlate_mmu.c
@@ -42,6 +42,9 @@
 #include <xen/interface/memory.h>
 #include <xen/balloon.h>
 
+/* Issue up to this many GFN mapping requests in a batch at a time. */
+#define XLATE_BATCH_SIZE 16
+
 typedef void (*xen_gfn_fn_t)(unsigned long gfn, void *data);
 
 /* Break down the pages in 4KB chunk and call fn for each gfn */
@@ -92,12 +95,19 @@ struct remap_data {
 	int *err_ptr;
 	int mapped;
 
-	/* Hypercall parameters */
-	int h_errs[XEN_PFN_PER_PAGE];
-	xen_ulong_t h_idxs[XEN_PFN_PER_PAGE];
-	xen_pfn_t h_gpfns[XEN_PFN_PER_PAGE];
+	/* Hypercall parameters.
+	 *
+	 * idxs: source GFNs in foreign domain P2M (combined with XENMAPSPACE_gmfn_foreign)
+	 * gpfns: destination GFNs in dom0's P2M. Extracted from pages[]
+	 *
+	 * h_idxs and h_gpfns exist as pairs: we map into dom0's GFN
+	 * the same MFN for the GFN in the foreign domain.
+	 */
+	int h_errs[XLATE_BATCH_SIZE];
+	xen_ulong_t h_idxs[XLATE_BATCH_SIZE];
+	xen_pfn_t h_gpfns[XLATE_BATCH_SIZE];
 
-	int h_iter;	/* Iterator */
+	int h_iter;
 };
 
 static void setup_hparams(unsigned long gfn, void *data)
@@ -112,53 +122,6 @@ static void setup_hparams(unsigned long gfn, void *data)
 	info->fgfn++;
 }
 
-static int remap_pte_fn(pte_t *ptep, unsigned long addr, void *data)
-{
-	struct remap_data *info = data;
-	struct page *page = info->pages[info->index++];
-	pte_t pte = pte_mkspecial(pfn_pte(page_to_pfn(page), info->prot));
-	int rc, nr_gfn;
-	uint32_t i;
-	struct xen_add_to_physmap_range xatp = {
-		.domid = DOMID_SELF,
-		.foreign_domid = info->domid,
-		.space = XENMAPSPACE_gmfn_foreign,
-	};
-
-	nr_gfn = min_t(typeof(info->nr_fgfn), XEN_PFN_PER_PAGE, info->nr_fgfn);
-	info->nr_fgfn -= nr_gfn;
-
-	info->h_iter = 0;
-	xen_for_each_gfn(&page, nr_gfn, setup_hparams, info);
-	BUG_ON(info->h_iter != nr_gfn);
-
-	set_xen_guest_handle(xatp.idxs, info->h_idxs);
-	set_xen_guest_handle(xatp.gpfns, info->h_gpfns);
-	set_xen_guest_handle(xatp.errs, info->h_errs);
-	xatp.size = nr_gfn;
-
-	rc = HYPERVISOR_memory_op(XENMEM_add_to_physmap_range, &xatp);
-
-	/* info->err_ptr expect to have one error status per Xen PFN */
-	for (i = 0; i < nr_gfn; i++) {
-		int err = (rc < 0) ? rc : info->h_errs[i];
-
-		*(info->err_ptr++) = err;
-		if (!err)
-			info->mapped++;
-	}
-
-	/*
-	 * Note: The hypercall will return 0 in most of the case if even if
-	 * all the fgmfn are not mapped. We still have to update the pte
-	 * as the userspace may decide to continue.
-	 */
-	if (!rc)
-		set_pte_at(info->vma->vm_mm, addr, ptep, pte);
-
-	return 0;
-}
-
 int xen_xlate_remap_gfn_array(struct vm_area_struct *vma,
 			      unsigned long addr,
 			      xen_pfn_t *gfn, int nr,
@@ -166,9 +129,10 @@ int xen_xlate_remap_gfn_array(struct vm_area_struct *vma,
 			      unsigned domid,
 			      struct page **pages)
 {
-	int err;
 	struct remap_data data;
-	unsigned long range = DIV_ROUND_UP(nr, XEN_PFN_PER_PAGE) << PAGE_SHIFT;
+	int page_off = 0;
+
+	BUILD_BUG_ON(XLATE_BATCH_SIZE % XEN_PFN_PER_PAGE != 0);
 
 	/* Kept here for the purpose of making sure code doesn't break
 	   x86 PVOPS */
@@ -184,9 +148,64 @@ int xen_xlate_remap_gfn_array(struct vm_area_struct *vma,
 	data.err_ptr = err_ptr;
 	data.mapped = 0;
 
-	err = apply_to_page_range(vma->vm_mm, addr, range,
-				  remap_pte_fn, &data);
-	return err < 0 ? err : data.mapped;
+	while (data.nr_fgfn > 0) {
+		int batch = min_t(int, XLATE_BATCH_SIZE, data.nr_fgfn); /* xen GFN units */
+		/* NOTE: on ARM, page size may be larger than in Xen */
+		int batch_pages = DIV_ROUND_UP(batch, XEN_PFN_PER_PAGE);
+		unsigned long batch_range = (unsigned long)batch_pages << PAGE_SHIFT;
+
+		struct xen_add_to_physmap_range xatp = {
+			.domid = DOMID_SELF,
+			.foreign_domid = domid,
+			.space = XENMAPSPACE_gmfn_foreign,
+			.size = batch,
+		};
+
+		int rc, i;
+
+		data.h_iter = 0;
+		xen_for_each_gfn(&pages[page_off], batch, setup_hparams, &data);
+		data.nr_fgfn -= batch;
+
+		set_xen_guest_handle(xatp.idxs,  data.h_idxs);
+		set_xen_guest_handle(xatp.gpfns, data.h_gpfns);
+		set_xen_guest_handle(xatp.errs,  data.h_errs);
+
+		rc = HYPERVISOR_memory_op(XENMEM_add_to_physmap_range, &xatp);
+
+		/*
+		 * Note: The hypercall will return 0 in most of the case if even if
+		 * all the fgmfn are not mapped. We still have to update the pte
+		 * as the userspace may decide to continue.
+		 */
+		if (rc == 0) {
+			struct remap_pfn r = {
+				.mm    = vma->vm_mm,
+				.pages = &pages[page_off],
+				.prot  = prot,
+				.i     = 0,
+			};
+			int walk_err = apply_to_page_range(vma->vm_mm, addr,
+				      batch_range,
+				      remap_pfn_fn, &r);
+			if (walk_err < 0)
+				return walk_err;
+		}
+
+		/* err_ptr expected to have one error status per Xen PFN */
+		for (i = 0; i < batch; i++) {
+			int err = (rc < 0) ? rc : data.h_errs[i];
+			*(data.err_ptr++) = err;
+			if (!err)
+				data.mapped++;
+		}
+
+		addr += batch_range;
+		page_off += batch_pages;
+		cond_resched();
+	}
+
+      return data.mapped;
 }
 EXPORT_SYMBOL_GPL(xen_xlate_remap_gfn_array);
 

From c33fc44e5935dd0c48201e1e3520416d6516de03 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Wed, 5 Aug 2026 23:32:27 -0500
Subject: [PATCH 1913/1982] feat(xen): deflate balloon via oom notifier

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
---
 drivers/xen/balloon.c | 58 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d4c99165b3a9c6..40c55082867ecd 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -55,6 +55,7 @@
 #include <linux/notifier.h>
 #include <linux/memory.h>
 #include <linux/memory_hotplug.h>
+#include <linux/oom.h>
 #include <linux/percpu-defs.h>
 #include <linux/slab.h>
 #include <linux/sysctl.h>
@@ -679,6 +680,61 @@ void xen_free_ballooned_pages(unsigned int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL(xen_free_ballooned_pages);
 
+#define BALLOON_OOM_DEFLATE_BATCH 512UL /* pages per OOM event (~2 MiB) */
+
+static int balloon_oom_notify(struct notifier_block *nb, unsigned long dummy,
+			      void *parm)
+{
+	unsigned long *freed = parm;
+	unsigned long before, nr;
+
+	/*
+	 * The balloon worker (or an inflate) may hold balloon_mutex and could
+	 * itself be the allocation that triggered OOM; never block on it here.
+	 * The mutex also guards the shared frame_list used by the populate path.
+	 */
+	if (!mutex_trylock(&balloon_mutex))
+		return NOTIFY_OK;
+
+	/* nr: number of pages parked on the balloon list that we can reclaim */
+	nr = balloon_stats.balloon_low + balloon_stats.balloon_high;
+
+	/* clamp, so we don't release all of them at once */
+	nr = min_t(unsigned long, nr, BALLOON_OOM_DEFLATE_BATCH);
+
+	/* if nr = 0, no pages remain to reclaim, OOM killer proceeds */
+
+	/* capture current before deflating, to calculate actual release */
+	before = balloon_stats.current_pages;
+
+	/* runs XENMEM_populate_physmap, updates current_pages */
+	if (nr > 0)
+		increase_reservation(nr);
+
+	/*
+	 * increase_reservation() bumped current_pages by however many Xen
+	 * actually populated (possibly fewer than asked, or zero if the host is
+	 * out or we are already at max_pages). Report that to the OOM killer so
+	 * it retries instead of killing when we made progress.
+	 */
+	*freed += balloon_stats.current_pages - before;
+
+	/*
+	 * Keep target_pages >= current_pages so
+	 * balloon_process() will not immediately inflate the reclaimed pages back
+	 * out and re-create the pressure. dom0 reconciles the higher figure.
+	 */
+	if (balloon_stats.target_pages < balloon_stats.current_pages)
+		balloon_stats.target_pages = balloon_stats.current_pages;
+
+	mutex_unlock(&balloon_mutex);
+	return NOTIFY_OK;
+}
+
+static struct notifier_block balloon_oom_nb = {
+	.notifier_call = balloon_oom_notify,
+};
+
 static int __init balloon_add_regions(bool append)
 {
 	unsigned long start_pfn, pages;
@@ -789,6 +845,8 @@ static int __init balloon_init(void)
 	/* Init the xen-balloon driver. */
 	xen_balloon_init();
 
+	register_oom_notifier(&balloon_oom_nb);
+
 	return 0;
 
  underflow:

From b51489a07157850863a7a80d247f1a6136096c38 Mon Sep 17 00:00:00 2001
From: Ben Leggett <benjamin@edera.io>
Date: Tue, 11 Aug 2026 13:55:35 -0400
Subject: [PATCH 1914/1982] firmware: qemu_fw_cfg: do not use the DMA interface
 on Xen PV

fw_cfg_dma_transfer() describes its descriptor and the caller's buffer to
the device with virt_to_phys(), on the stated assumption that the device
needs no IOMMU protection and therefore no address translation:

	*d = (struct fw_cfg_dma_access) {
		.address = cpu_to_be64(address ? virt_to_phys(address) : 0),
		...
	};
	dma = virt_to_phys(d);

In a Xen PV domain that does not hold. A pseudo-physical address bears no
relation to the machine address the device model needs to reach the page.
The device never sees the descriptor and never clears its control word, so
fw_cfg_wait_for_control() spins on it with no timeout.  Because the loop
never returns to userspace it also never dequeues a signal, so the task
cannot be killed and burns a CPU until the domain is reset.

Blob reads go through the data register with ioread8_rep() and are
unaffected, so refuse only the DMA interface.  fw_cfg_dma_enabled() has a
single caller, which already warns and continues when the vmcoreinfo write
fails.  The cost on Xen PV is that the host cannot locate the guest's
vmcoreinfo note, which it could not do correctly there in any case.

Fixes: 2d6d60a3d3ec ("fw_cfg: write vmcoreinfo details")
Signed-off-by: Ben Leggett <benjamin@edera.io>
---
 drivers/firmware/qemu_fw_cfg.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 0eebd572f9a54d..e13f043f5f9a28 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -38,6 +38,7 @@
 #include <linux/delay.h>
 #include <linux/crash_dump.h>
 #include <linux/vmcore_info.h>
+#include <xen/xen.h>
 
 MODULE_AUTHOR("Gabriel L. Somlo <somlo@cmu.edu>");
 MODULE_DESCRIPTION("QEMU fw_cfg sysfs support");
@@ -70,6 +71,17 @@ static void fw_cfg_sel_endianness(u16 key)
 #ifdef CONFIG_VMCORE_INFO
 static inline bool fw_cfg_dma_enabled(void)
 {
+	/*
+	 * The DMA interface hands the device a virt_to_phys() address.
+	 * In a Xen PV domain that is a pseudo-physical address, so the
+	 * device writes the completion somewhere else entirely and
+	 * fw_cfg_wait_for_control() spins forever.
+	 * Reads go through the data register and are unaffected, so only
+	 * the DMA interface is refused.
+	 */
+	if (xen_pv_domain())
+		return false;
+
 	return (fw_cfg_rev & FW_CFG_VERSION_DMA) && fw_cfg_reg_dma;
 }
 

From f3c5f13ab6efe69f5d7341ec850284138397abb9 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 7 Jul 2024 14:22:33 -0700
Subject: [PATCH 1915/1982] security: Add openpax configuration menus

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 security/Kconfig         |  1 +
 security/Kconfig.openpax | 46 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 security/Kconfig.openpax

diff --git a/security/Kconfig b/security/Kconfig
index 285f284dfcac44..6f988431a088ca 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -285,6 +285,7 @@ config LSM
 	  If unsure, leave this as the default.
 
 source "security/Kconfig.hardening"
+source "security/Kconfig.openpax"
 
 endmenu
 
diff --git a/security/Kconfig.openpax b/security/Kconfig.openpax
new file mode 100644
index 00000000000000..9ebbf584121552
--- /dev/null
+++ b/security/Kconfig.openpax
@@ -0,0 +1,46 @@
+#
+# OpenPaX configuration
+#
+
+menu "OpenPaX options"
+
+config OPENPAX
+	bool "Enable OpenPaX features"
+	default y
+	help
+	  This configuration setting enables OpenPaX features.
+	  OpenPaX adds memory safety-related defenses to the kernel which
+	  reduce the risks posed by exploitable memory safety bugs.
+
+config OPENPAX_XATTR_PAX_FLAGS
+	bool "Use filesystem extended attributes to modify OpenPaX features"
+	depends on OPENPAX
+	default y
+	help
+	  Enabling this option will allow you to control whether
+	  OpenPaX features are enabled on a per-executable basis via
+	  xattr attributes.
+	
+	  For compatibility with the original PaX patch, the feature
+	  flags are read from the user.pax.flags extended attribute.
+	
+	  If you disable this feature, then all applications will run
+	  with OpenPaX enabled by default.
+
+config OPENPAX_MPROTECT
+	bool "Enforce W^X for memory mappings"
+	depends on OPENPAX
+	default y
+	help
+	  Enabling this option prevents programs from making pages
+	  executable when they are also writable.  In addition, it
+	  also denies transition of writable mappings to executable
+	  mappings.
+	
+	  This feature is known to break programs which depend on
+	  just-in-time (JIT) compilation.  It is advisable to enable
+	  this feature system-wide, but mark programs which have
+	  JIT compilation appropriately so the W^X enforcement is
+	  disabled for them.
+
+endmenu

From c8f4cd0f22284e74e105ba4ea2b018070a387847 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 7 Jul 2024 14:28:03 -0700
Subject: [PATCH 1916/1982] xattr: add support for retrieving PaX flags stored
 in xattrs

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/xattr.c                 | 16 ++++++++++++++++
 include/linux/xattr.h      |  4 ++++
 include/uapi/linux/xattr.h |  5 +++++
 3 files changed, 25 insertions(+)

diff --git a/fs/xattr.c b/fs/xattr.c
index 8851a5ef34f5ab..70bdd5606b6a07 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -424,6 +424,22 @@ __vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name,
 }
 EXPORT_SYMBOL(__vfs_getxattr);
 
+#ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
+ssize_t
+pax_getxattr(struct file *file, void *value, size_t size)
+{
+	struct inode *inode = file->f_path.dentry->d_inode;
+	ssize_t error;
+
+	error = inode_permission(file_mnt_idmap(file), inode, MAY_EXEC);
+	if (error)
+		return error;
+
+	return __vfs_getxattr(file->f_path.dentry, inode, XATTR_NAME_USER_PAX_FLAGS, value, size);
+}
+EXPORT_SYMBOL(pax_getxattr);
+#endif
+
 ssize_t
 vfs_getxattr(struct mnt_idmap *idmap, struct dentry *dentry,
 	     const char *name, void *value, size_t size)
diff --git a/include/linux/xattr.h b/include/linux/xattr.h
index 86b0d47984a16d..c4ad3af7e1a21a 100644
--- a/include/linux/xattr.h
+++ b/include/linux/xattr.h
@@ -25,6 +25,7 @@
 
 struct inode;
 struct dentry;
+struct file;
 
 static inline bool is_posix_acl_xattr(const char *name)
 {
@@ -75,6 +76,9 @@ struct xattr {
 	size_t value_len;
 };
 
+#ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
+ssize_t pax_getxattr(struct file *, void *, size_t);
+#endif
 ssize_t __vfs_getxattr(struct dentry *, struct inode *, const char *, void *, size_t);
 ssize_t vfs_getxattr(struct mnt_idmap *, struct dentry *, const char *,
 		     void *, size_t);
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index c7c85bb504bab9..f6a25302a65aac 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -92,5 +92,10 @@ struct xattr_args {
 #define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
 #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
 
+/* User namespace */
+#define XATTR_PAX_PREFIX "pax."
+#define XATTR_PAX_FLAGS_SUFFIX "flags"
+#define XATTR_NAME_USER_PAX_FLAGS XATTR_USER_PREFIX XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
 
 #endif /* _UAPI_LINUX_XATTR_H */

From 3a273448f7c337f4330df5702757d238e0d238ef Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 7 Jul 2024 14:41:26 -0700
Subject: [PATCH 1917/1982] mm: add openpax flags, settable via atomics

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 include/linux/mm_types.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 08495d38572f3e..a4ccff06c84191 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -1132,6 +1132,9 @@ struct mm_struct {
 		mm_context_t context;
 
 		mm_flags_t flags; /* Must use mm_flags_* hlpers to access */
+#ifdef CONFIG_OPENPAX
+		unsigned long pax_flags;
+#endif
 
 #ifdef CONFIG_AIO
 		spinlock_t			ioctx_lock;
@@ -1856,4 +1859,12 @@ static inline unsigned long mmf_init_legacy_flags(unsigned long flags)
 	return flags & MMF_INIT_LEGACY_MASK;
 }
 
+#ifdef CONFIG_OPENPAX
+#define PAXF_PAGEEXEC		1
+#define PAXF_EMUTRAMP		2
+#define PAXF_MPROTECT		3
+#define PAXF_RANDMMAP		4
+#define PAXF_SEGMEXEC		5
+#endif
+
 #endif /* _LINUX_MM_TYPES_H */

From dc3f7d6850109395198d8f4b21abc7a5089a63ed Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 7 Jul 2024 14:52:54 -0700
Subject: [PATCH 1918/1982] mman: enforce MPROTECT when enabled for a task

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 include/linux/mman.h | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/linux/mman.h b/include/linux/mman.h
index 0ba8a7e8b90aed..1867db7075800c 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -197,12 +197,21 @@ static inline bool arch_memory_deny_write_exec_supported(void)
  * we propose to set.
  *
  * Return: false if proposed change is OK, true if not ok and should be denied.
+ *
+ * Note: If OpenPaX is enabled, it will be assumed that we want to deny
+ * PROT_WRITE | PROT_EXEC by default, unless the MPROTECT feature bit is
+ * disabled on a binary.
  */
 static inline bool map_deny_write_exec(unsigned long old, unsigned long new)
 {
 	/* If MDWE is disabled, we have nothing to deny. */
-	if (!mm_flags_test(MMF_HAS_MDWE, current->mm))
+	if (
+#ifdef CONFIG_OPENPAX_MPROTECT
+	    !test_bit(PAXF_MPROTECT, &current->mm->pax_flags) &&
+#endif
+	    !mm_flags_test(MMF_HAS_MDWE, current->mm)) {
 		return false;
+	}
 
 	/* If the new VMA is not executable, we have nothing to deny. */
 	if (!(new & VM_EXEC))

From 2fd59b221294d22b4b4c2333cfaf74c64a344bd6 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 7 Jul 2024 15:14:25 -0700
Subject: [PATCH 1919/1982] elf: wire up setup for PaX flags

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 71 insertions(+), 2 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e4653bb99946b1..d684c44f79fa95 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -47,6 +47,7 @@
 #include <linux/dax.h>
 #include <linux/uaccess.h>
 #include <linux/rseq.h>
+#include <linux/xattr.h>
 #include <asm/param.h>
 #include <asm/page.h>
 
@@ -829,6 +830,63 @@ static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr,
 	return ret == -ENOENT ? 0 : ret;
 }
 
+#ifdef CONFIG_OPENPAX
+#ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
+static int openpax_parse_xattr_flags(struct file * const file)
+{
+	ssize_t xattr_size, i;
+	unsigned char xattr_value[sizeof("pemrs") - 1];
+
+	xattr_size = pax_getxattr(file, xattr_value, sizeof xattr_value);
+	if (xattr_size < 0 || xattr_size > sizeof xattr_value)
+		return -ENOENT;
+
+	for (i = 0; i < xattr_size; i++)
+		switch (xattr_value[i]) {
+		default:
+			return -EINVAL;
+
+#define parse_flag(option_disable, option_enable, flag)				\
+		case option_disable:						\
+			clear_bit(flag, &current->mm->pax_flags);		\
+			break;							\
+		case option_enable:						\
+			set_bit(flag, &current->mm->pax_flags);			\
+			break;
+
+		parse_flag('p', 'P', PAXF_PAGEEXEC);
+		parse_flag('e', 'E', PAXF_EMUTRAMP);
+		parse_flag('m', 'M', PAXF_MPROTECT);
+		parse_flag('r', 'R', PAXF_RANDMMAP);
+		parse_flag('s', 'S', PAXF_SEGMEXEC);
+#undef parse_flag
+		}
+
+	return 0;
+}
+#endif
+
+static int openpax_set_flags(struct file * const file)
+{
+#ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
+	int error;
+#endif
+	current->mm->pax_flags = 0;
+
+	set_bit(PAXF_PAGEEXEC, &current->mm->pax_flags);
+	set_bit(PAXF_MPROTECT, &current->mm->pax_flags);
+	set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
+
+#ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
+	error = openpax_parse_xattr_flags(file);
+	if (error != -ENOENT)
+		return error;
+#endif
+
+	return 0;
+}
+#endif
+
 static int load_elf_binary(struct linux_binprm *bprm)
 {
 	struct file *interpreter = NULL; /* to shut gcc up */
@@ -1014,8 +1072,19 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
 	   may depend on the personality.  */
 	SET_PERSONALITY2(*elf_ex, &arch_state);
-	if (elf_read_implies_exec(*elf_ex, executable_stack))
-		current->personality |= READ_IMPLIES_EXEC;
+
+#ifdef CONFIG_OPENPAX
+	retval = openpax_set_flags(bprm->file);
+	if (retval)
+		goto out_free_dentry;
+#endif
+
+	if (elf_read_implies_exec(*elf_ex, executable_stack)) {
+#ifdef CONFIG_OPENPAX
+		if (!test_bit(PAXF_MPROTECT, &current->mm->pax_flags))
+#endif
+			current->personality |= READ_IMPLIES_EXEC;
+	}
 
 	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
 	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space)

From 86e355faff38399dbe802f56488c47bf6fa06f8e Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 14:23:18 -0700
Subject: [PATCH 1920/1982] security: openpax: add OPENPAX_SOFTMODE
 configuration knob

This configuration knob enables OpenPaX soft mode, wherein OpenPaX features will
be disabled by default, with OpenPaX features only enforcing on binaries where
OpenPaX has been explicitly configured.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 security/Kconfig.openpax | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/security/Kconfig.openpax b/security/Kconfig.openpax
index 9ebbf584121552..7a07386e116a7d 100644
--- a/security/Kconfig.openpax
+++ b/security/Kconfig.openpax
@@ -12,6 +12,18 @@ config OPENPAX
 	  OpenPaX adds memory safety-related defenses to the kernel which
 	  reduce the risks posed by exploitable memory safety bugs.
 
+config OPENPAX_SOFTMODE
+	bool "Support PaX soft mode"
+	default y
+	help
+	  Enabling this option will allow you to configure OpenPaX
+	  features to run in soft mode.  In this mode, OpenPaX features
+	  will be disabled by default, only running on applications
+	  which explicitly enable them.
+	
+	  Soft mode can be enabled via the kernel.pax.softmode sysctl,
+	  or the pax_softmode=1 kernel command-line option.
+
 config OPENPAX_XATTR_PAX_FLAGS
 	bool "Use filesystem extended attributes to modify OpenPaX features"
 	depends on OPENPAX

From a61d9c4d23fd478f70c270d66935a2e7617dc1f8 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 14:29:45 -0700
Subject: [PATCH 1921/1982] documentation: add pax_softmode= to kernel
 parameters doc

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 Documentation/admin-guide/kernel-parameters.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 362ff322522094..545f8e229e9120 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4793,6 +4793,9 @@
 			the specified number of seconds.  This is to be used if
 			your oopses keep scrolling off the screen.
 
+	pax_softmode=<int>
+			Enables OpenPaX soft mode if set to a non-zero value.
+
 	pcbit=		[HW,ISDN]
 
 	pci=option[,option...]	[PCI,EARLY] various PCI subsystem options.

From ee86070b73556ac687793d0f811cd4792997fd97 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 14:34:34 -0700
Subject: [PATCH 1922/1982] init: add pax_softmode= kernel command-line option

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 include/linux/init.h |  3 +++
 init/main.c          | 11 +++++++++++
 2 files changed, 14 insertions(+)

diff --git a/include/linux/init.h b/include/linux/init.h
index 17c1bc712e234a..2a575c75fd98ab 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -138,6 +138,9 @@ extern char __initdata boot_command_line[];
 extern char *saved_command_line;
 extern unsigned int saved_command_line_len;
 extern unsigned int reset_devices;
+#ifdef CONFIG_OPENPAX_SOFTMODE
+extern int pax_softmode;
+#endif
 
 /* used by init/main.c */
 void setup_arch(char **);
diff --git a/init/main.c b/init/main.c
index 2097f4bbc0d87e..6a2ebb40324998 100644
--- a/init/main.c
+++ b/init/main.c
@@ -191,6 +191,17 @@ static int __init set_reset_devices(char *str)
 
 __setup("reset_devices", set_reset_devices);
 
+#ifdef CONFIG_OPENPAX_SOFTMODE
+int pax_softmode;
+
+static int __init setup_pax_softmode(char *str)
+{
+	get_option(&str, &pax_softmode);
+	return 1;
+}
+__setup("pax_softmode=", setup_pax_softmode);
+#endif
+
 static const char *argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
 const char *envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
 static const char *panic_later, *panic_param;

From 1bdf4d4685aae43469efdafc244f8eb7ca97c21a Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 14:51:47 -0700
Subject: [PATCH 1923/1982] sysctl: wire up PaX softmode setting

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 kernel/sysctl.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 970525e6c76c71..5a12345f4ca0ff 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1454,6 +1454,18 @@ int proc_do_static_key(const struct ctl_table *table, int write,
 	return ret;
 }
 
+#ifdef CONFIG_OPENPAX_SOFTMODE
+static const struct ctl_table pax_table[] = {
+	{
+		.procname       = "softmode",
+		.data           = &pax_softmode,
+		.maxlen         = sizeof(int),
+		.mode           = 0600,
+		.proc_handler   = proc_dointvec,
+	},
+};
+#endif
+
 static const struct ctl_table sysctl_subsys_table[] = {
 #ifdef CONFIG_PROC_SYSCTL
 	{
@@ -1503,6 +1515,9 @@ static const struct ctl_table sysctl_subsys_table[] = {
 int __init sysctl_init_bases(void)
 {
 	register_sysctl_init("kernel", sysctl_subsys_table);
+#ifdef CONFIG_OPENPAX_SOFTMODE
+	register_sysctl_init("kernel/pax", pax_table);
+#endif
 
 	return 0;
 }

From 15a71a9dace7dffab8886b7fb1787f3d7a880678 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 14:53:05 -0700
Subject: [PATCH 1924/1982] elf: only enable PaX features by default if
 softmode is disabled

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index d684c44f79fa95..c64414a7f63666 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -873,9 +873,11 @@ static int openpax_set_flags(struct file * const file)
 #endif
 	current->mm->pax_flags = 0;
 
-	set_bit(PAXF_PAGEEXEC, &current->mm->pax_flags);
-	set_bit(PAXF_MPROTECT, &current->mm->pax_flags);
-	set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
+	if (!pax_softmode) {
+		set_bit(PAXF_PAGEEXEC, &current->mm->pax_flags);
+		set_bit(PAXF_MPROTECT, &current->mm->pax_flags);
+		set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
+	}
 
 #ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
 	error = openpax_parse_xattr_flags(file);

From ab5db43074a7382c92e121251ae177ca16365224 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 17:39:00 -0700
Subject: [PATCH 1925/1982] elf: enable PAXF_RANDMMAP if randomize_va_space > 0

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index c64414a7f63666..853bc6f53af8b3 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -873,10 +873,13 @@ static int openpax_set_flags(struct file * const file)
 #endif
 	current->mm->pax_flags = 0;
 
+	if (randomize_va_space) {
+		set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
+	}
+
 	if (!pax_softmode) {
 		set_bit(PAXF_PAGEEXEC, &current->mm->pax_flags);
 		set_bit(PAXF_MPROTECT, &current->mm->pax_flags);
-		set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
 	}
 
 #ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS

From 8861329f19ce12db79a9ad586941f9261a36e157 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 17:40:01 -0700
Subject: [PATCH 1926/1982] elf: use PAXF_RANDMMAP to control whether ASLR is
 enabled on a process

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 853bc6f53af8b3..07db14e2203453 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1092,7 +1092,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	}
 
 	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space)
+	if (!(current->personality & ADDR_NO_RANDOMIZE) && test_bit(PAXF_RANDMMAP, &current->mm->pax_flags))
 		current->flags |= PF_RANDOMIZE;
 
 	setup_new_exec(bprm);

From 0a5930373bf27b4d1e763ee0f55965d1eac36b59 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 17:40:54 -0700
Subject: [PATCH 1927/1982] elf: allow executable stacks if PAXF_EMUTRAMP is
 enabled

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 07db14e2203453..25d79005691703 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1082,6 +1082,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	retval = openpax_set_flags(bprm->file);
 	if (retval)
 		goto out_free_dentry;
+
+	if (!test_bit(PAXF_EMUTRAMP, &current->mm->pax_flags))
+		executable_stack = EXSTACK_DISABLE_X;
 #endif
 
 	if (elf_read_implies_exec(*elf_ex, executable_stack)) {

From 96fb7d582bafa2924fbb4eb3d03b42ae7aef10a1 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 10 Jul 2024 18:37:03 -0700
Subject: [PATCH 1928/1982] proc: display PaX status in procfs status entries

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/proc/array.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/proc/array.c b/fs/proc/array.c
index 38f96af7b521be..2003e880b2600e 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -434,6 +434,18 @@ __weak void arch_proc_pid_thread_features(struct seq_file *m,
 {
 }
 
+#ifdef CONFIG_OPENPAX
+static inline void task_pax(struct seq_file *m, struct mm_struct *mm)
+{
+	seq_printf(m, "PaX:\t%c%c%c%c%c\n",
+		   test_bit(PAXF_PAGEEXEC, &mm->pax_flags) ? 'P' : 'p',
+		   test_bit(PAXF_EMUTRAMP, &mm->pax_flags) ? 'E' : 'e',
+		   test_bit(PAXF_MPROTECT, &mm->pax_flags) ? 'M' : 'm',
+		   test_bit(PAXF_RANDMMAP, &mm->pax_flags) ? 'R' : 'r',
+		   test_bit(PAXF_SEGMEXEC, &mm->pax_flags) ? 'S' : 's');
+}
+#endif
+
 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
 			struct pid *pid, struct task_struct *task)
 {
@@ -450,6 +462,9 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
 		task_core_dumping(m, task);
 		task_thp_status(m, mm);
 		task_untag_mask(m, mm);
+#ifdef CONFIG_OPENPAX
+		task_pax(m, mm);
+#endif
 		mmput(mm);
 	}
 	task_sig(m, task);

From 9a913345082c582a37e904061d1074e672d65980 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Mon, 15 Jul 2024 19:57:22 -0700
Subject: [PATCH 1929/1982] elf: only test for PAXF_RANDMMAP if OPENPAX is
 enabled

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 25d79005691703..0dcbb70f94e58a 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1095,7 +1095,11 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	}
 
 	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && test_bit(PAXF_RANDMMAP, &current->mm->pax_flags))
+	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space
+#ifdef CONFIG_OPENPAX
+	    && test_bit(PAXF_RANDMMAP, &current->mm->pax_flags)
+#endif
+	    )
 		current->flags |= PF_RANDOMIZE;
 
 	setup_new_exec(bprm);

From f44b3870637d9eba99c5fb7db458a4c5f903bb6a Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 15:46:41 -0700
Subject: [PATCH 1930/1982] security: add openpax EMUTRAMP config option

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 security/Kconfig.openpax | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/security/Kconfig.openpax b/security/Kconfig.openpax
index 7a07386e116a7d..d8ee4bc570b615 100644
--- a/security/Kconfig.openpax
+++ b/security/Kconfig.openpax
@@ -55,4 +55,21 @@ config OPENPAX_MPROTECT
 	  JIT compilation appropriately so the W^X enforcement is
 	  disabled for them.
 
+config OPENPAX_EMUTRAMP
+	bool "Emulate stack and heap trampolines"
+	depends on OPENPAX
+	default y
+	help
+	  Enabling this option allows programs to depend on common
+	  types of stack and heap trampolines (such as the ones
+	  generated by GCC and libffi) to continue working despite
+	  the stack and heap being non-executable memory.
+	
+	  This option works by intercepting the page faults caused
+	  by executing code in non-executable memory and emulating
+	  the side effects that would have happened from executing
+	  the trampoline.
+	
+	  Most likely, you should say 'y' here.
+
 endmenu

From d98f79469ccd33dd5360ba570d4b260b0f453b96 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 15:53:32 -0700
Subject: [PATCH 1931/1982] elf: simplify executable stack logic

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 0dcbb70f94e58a..70c021969a0922 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1083,16 +1083,14 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	if (retval)
 		goto out_free_dentry;
 
-	if (!test_bit(PAXF_EMUTRAMP, &current->mm->pax_flags))
+	if (test_bit(PAXF_PAGEEXEC, &current->mm->pax_flags) || test_bit(PAXF_SEGMEXEC, &current->mm->pax_flags)) {
 		executable_stack = EXSTACK_DISABLE_X;
+		current->personality &= ~READ_IMPLIES_EXEC;
+	} else
 #endif
 
-	if (elf_read_implies_exec(*elf_ex, executable_stack)) {
-#ifdef CONFIG_OPENPAX
-		if (!test_bit(PAXF_MPROTECT, &current->mm->pax_flags))
-#endif
-			current->personality |= READ_IMPLIES_EXEC;
-	}
+	if (elf_read_implies_exec(*elf_ex, executable_stack))
+		current->personality |= READ_IMPLIES_EXEC;
 
 	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
 	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space

From 51de976cd39c2c966458c398e1d3dd03f91f335e Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 17:04:55 -0700
Subject: [PATCH 1932/1982] x86: fault: add openpax_fault_is_trampoline to
 detect if a page-fault might be a trampoline

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/mm/fault.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index b33a52a3c515de..da44dc7c0f1fa9 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1195,6 +1195,39 @@ do_kern_addr_fault(struct pt_regs *regs, unsigned long hw_error_code,
 }
 NOKPROBE_SYMBOL(do_kern_addr_fault);
 
+#ifdef CONFIG_OPENPAX_EMUTRAMP
+/*
+ * Determine if a fault is possibly caused by an emulatable stack or
+ * heap trampoline.  We return false if trampoline emulation is not
+ * enabled.
+ */
+static inline
+bool openpax_fault_is_trampoline(unsigned long error_code,
+				 struct pt_regs *regs,
+				 unsigned long address)
+{
+	struct mm_struct *mm = current->mm;
+	unsigned long ip = regs->ip;
+
+	if (!test_bit(PAXF_EMUTRAMP, &mm->pax_flags))
+		return false;
+
+	if (v8086_mode(regs))
+		ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
+
+	if (test_bit(PAXF_PAGEEXEC, &mm->pax_flags)) {
+		if ((__supported_pte_mask & _PAGE_NX) && (error_code & X86_PF_INSTR))
+			return true;
+		if (!(error_code & (X86_PF_PROT | X86_PF_WRITE)) && ip == address)
+			return true;
+		return false;
+	}
+
+	return false;
+}
+NOKPROBE_SYMBOL(openpax_fault_is_trampoline);
+#endif
+
 /*
  * Handle faults in the user portion of the address space.  Nothing in here
  * should check X86_PF_USER without a specific justification: for almost

From 64d5dd122ebc5263f9d5e7e74974079fb56948da Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 17:37:29 -0700
Subject: [PATCH 1933/1982] x86: fault: add stack trampoline emulator

Stack trampoline definitions were derived from the original PaX.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/mm/fault.c | 178 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 178 insertions(+)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index da44dc7c0f1fa9..1f9b3b078b06b5 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1226,6 +1226,184 @@ bool openpax_fault_is_trampoline(unsigned long error_code,
 	return false;
 }
 NOKPROBE_SYMBOL(openpax_fault_is_trampoline);
+
+static inline
+bool openpax_emulate_trampoline_32(struct pt_regs *regs)
+{
+	int err;
+
+	/* libffi trampoline type 1, gcc trampoline type 2 */
+	do {
+		unsigned char mov, jmp;
+		unsigned int addr1, addr2;
+
+#ifdef CONFIG_X86_64
+		if ((regs->ip + 9) >> 32)
+			break;
+#endif
+
+		err = get_user(mov, (unsigned char __user *) regs->ip);
+		err |= get_user(addr1, (unsigned int __user *) (regs->ip + 1));
+		err |= get_user(jmp, (unsigned char __user *) (regs->ip + 5));
+		err |= get_user(addr2, (unsigned int __user *) (regs->ip + 6));
+
+		if (err)
+			break;
+
+		if ((mov == 0xB8 || mov == 0xB9) && jmp == 0xE9) {
+			if (mov == 0xB8)
+				regs->ax = addr1;
+			else
+				regs->cx = addr1;
+
+			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
+			return true;
+		}
+	} while (0);
+
+	/* older gcc trampoline type... */
+	do {
+		unsigned char mov1, mov2;
+		unsigned short jmp;
+		unsigned int addr1, addr2;
+
+#ifdef CONFIG_X86_64
+		if ((regs->ip + 11) >> 32)
+			break;
+#endif
+
+		err = get_user(mov1, (unsigned char __user *) regs->ip);
+		err |= get_user(addr1, (unsigned int __user *) (regs->ip + 1));
+		err |= get_user(mov2, (unsigned char __user *) (regs->ip + 5));
+		err |= get_user(addr2, (unsigned int __user *) (regs->ip + 6));
+		err |= get_user(jmp, (unsigned short __user *) (regs->ip + 10));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
+			regs->cx = addr1;
+			regs->ax = addr2;
+			regs->ip = addr2;
+			return true;
+		}
+	} while (0);
+
+	return false;
+}
+NOKPROBE_SYMBOL(openpax_emulate_trampoline_32);
+
+#ifdef CONFIG_X86_64
+static inline
+bool openpax_emulate_trampoline_64(struct pt_regs *regs)
+{
+	int err;
+
+	/* libffi trampoline type 1 */
+	do {
+		unsigned short mov1, mov2, jmp1;
+		unsigned char stcclc, jmp2;
+		unsigned long addr1, addr2;
+
+		err = get_user(mov1, (unsigned short __user *) regs->ip);
+		err |= get_user(addr1, (unsigned long __user *) (regs->ip + 2));
+		err |= get_user(mov2, (unsigned short __user *) (regs->ip + 10));
+		err |= get_user(addr2, (unsigned long __user *) (regs->ip + 12));
+		err |= get_user(stcclc, (unsigned char __user *) (regs->ip + 20));
+		err |= get_user(jmp1, (unsigned short __user *) (regs->ip + 21));
+		err |= get_user(jmp2, (unsigned char __user *) (regs->ip + 23));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
+			regs->r11 = addr1;
+			regs->r10 = addr2;
+
+			if (stcclc == 0xF8)
+				regs->flags &= ~X86_EFLAGS_CF;
+			else
+				regs->flags |= X86_EFLAGS_CF;
+
+			regs->ip = addr1;
+			return true;
+		}
+	} while (0);
+
+	/* gcc trampoline type 1 */
+	do {
+		unsigned short mov1, mov2, jmp1;
+		unsigned char jmp2;
+		unsigned int addr1;
+		unsigned long addr2;
+
+		err = get_user(mov1, (unsigned short __user *) regs->ip);
+		err |= get_user(addr1, (unsigned int __user *) (regs->ip + 2));
+		err |= get_user(mov2, (unsigned short __user *) (regs->ip + 6));
+		err |= get_user(addr2, (unsigned long __user *) (regs->ip + 8));
+		err |= get_user(jmp1, (unsigned short __user *) (regs->ip + 16));
+		err |= get_user(jmp2, (unsigned char __user *) (regs->ip + 18));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
+			regs->r11 = addr1;
+			regs->r10 = addr2;
+			regs->ip = addr1;
+			return true;
+		}
+	} while (0);
+
+	/* gcc trampoline type 2 */
+	do {
+		unsigned short mov1, mov2, jmp1;
+		unsigned char jmp2;
+		unsigned long addr1, addr2;
+
+		err = get_user(mov1, (unsigned short __user *) regs->ip);
+		err |= get_user(addr1, (unsigned long __user *) (regs->ip + 2));
+		err |= get_user(mov2, (unsigned short __user *) (regs->ip + 10));
+		err |= get_user(addr2, (unsigned long __user *) (regs->ip + 12));
+		err |= get_user(jmp1, (unsigned short __user *) (regs->ip + 20));
+		err |= get_user(jmp2, (unsigned char __user *) (regs->ip + 22));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
+			regs->r11 = addr1;
+			regs->r10 = addr2;
+			regs->ip = addr1;
+			return true;
+		}
+	} while (0);
+
+	return false;
+}
+NOKPROBE_SYMBOL(openpax_emulate_trampoline_64);
+#endif
+
+/*
+ * Emulate a trampoline.  Returns false if emulation failed, meaning
+ * that the task should be killed.
+ */
+static inline
+bool openpax_emulate_trampoline(struct pt_regs *regs)
+{
+	if (v8086_mode(regs))
+		return false;
+
+	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
+		return openpax_emulate_trampoline_32(regs);
+#ifdef CONFIG_X86_64
+	else
+		return openpax_emulate_trampoline_64(regs);
+#endif
+
+	return false;
+}
+NOKPROBE_SYMBOL(openpax_emulate_trampoline);
 #endif
 
 /*

From 1668fe6648b0db770cd39659e0a9f31e74879082 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 17:38:29 -0700
Subject: [PATCH 1934/1982] x86: fault: hook up stack trampoline emulator

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/mm/fault.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 1f9b3b078b06b5..3d0d75c24a5470 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1530,6 +1530,13 @@ void do_user_addr_fault(struct pt_regs *regs,
 	}
 #endif
 
+#ifdef CONFIG_OPENPAX_EMUTRAMP
+	if (openpax_fault_is_trampoline(error_code, regs, address)) {
+		if (openpax_emulate_trampoline(regs))
+			return;
+	}
+#endif
+
 	if (!(flags & FAULT_FLAG_USER))
 		goto lock_mmap;
 

From f76f00dc23741fe593b489c8fbfd46d2cc445aeb Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 18:40:14 -0700
Subject: [PATCH 1935/1982] security: openpax: add OPENPAX_EMUTRAMP_DEFAULT
 config option

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 security/Kconfig.openpax | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/Kconfig.openpax b/security/Kconfig.openpax
index d8ee4bc570b615..76ee145094d93b 100644
--- a/security/Kconfig.openpax
+++ b/security/Kconfig.openpax
@@ -72,4 +72,18 @@ config OPENPAX_EMUTRAMP
 	
 	  Most likely, you should say 'y' here.
 
+config OPENPAX_EMUTRAMP_DEFAULT
+	bool "Enable trampoline emulation by default"
+	depends on OPENPAX_EMUTRAMP
+	default y
+	help
+	  Enabling this option allows programs which require
+	  trampolines to be emulated to continue working by default.
+
+	  Otherwise, the emulation flag must be enabled in a binary's
+	  PaX marking, e.g. with paxmark -E <binary>.
+
+	  If you do not say 'y' here, you will have to manually mark
+	  all programs which require trampoline emulation.
+
 endmenu

From 635ab59ae3af61e78fd14f8cacb6b87dbbf69777 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Sun, 21 Jul 2024 18:42:57 -0700
Subject: [PATCH 1936/1982] elf: enable EMUTRAMP by default if
 CONFIG_OPENPAX_EMUTRAMP_DEFAULT is enabled

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 70c021969a0922..fe4410269d6ba7 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -882,6 +882,10 @@ static int openpax_set_flags(struct file * const file)
 		set_bit(PAXF_MPROTECT, &current->mm->pax_flags);
 	}
 
+#ifdef CONFIG_OPENPAX_EMUTRAMP_DEFAULT
+	set_bit(PAXF_EMUTRAMP, &current->mm->pax_flags);
+#endif
+
 #ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
 	error = openpax_parse_xattr_flags(file);
 	if (error != -ENOENT)

From 34cd7a2eb211a1afde8f5dcee7ed1fd1b9b29bae Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Mon, 22 May 2017 05:06:20 -0400
Subject: [PATCH 1937/1982] arm64: determine stack entropy based on mmap
 entropy

Stack mapping entropy is currently hard-wired to 11 bits of entropy on
32-bit and 18 bits of entropy on 64-bit. The stack itself gains an extra
8 bits of entropy from lower bit randomization within 16 byte alignment
constraints. The argument block could have all lower bits randomized but
it currently only gets the mapping randomization.

Rather than hard-wiring values this switches to using the mmap entropy
configuration like the mmap base and executable base, resulting in a
range of 8 to 16 bits on 32-bit and 18 to 24 bits on 64-bit (with 4k
pages and 3 level page tables) depending on kernel configuration and
overridable via the sysctl entries.

It's worth noting that since these kernel configuration options default
to the minimum supported entropy value, the entropy on 32-bit will drop
from 11 to 8 bits for builds using the defaults. However, following the
configuration seems like the right thing to do regardless. At the very
least, changing the defaults for COMPAT (32-bit processes on 64-bit)
should be considered due to the larger address space compared to real
32-bit.

Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/arm64/include/asm/elf.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 3f93f4eef9530a..575a608be2606e 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -189,10 +189,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 /* 1GB of VA */
 #ifdef CONFIG_COMPAT
 #define STACK_RND_MASK			(test_thread_flag(TIF_32BIT) ? \
-						0x7ff >> (PAGE_SHIFT - 12) : \
-						0x3ffff >> (PAGE_SHIFT - 12))
+						((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \
+						((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
 #else
-#define STACK_RND_MASK			(0x3ffff >> (PAGE_SHIFT - 12))
+#define STACK_RND_MASK			(((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
 #endif
 
 #ifdef __AARCH64EB__

From 6fa6267474cc9f8e2b594d2d3d314bd9c5169d84 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Sun, 21 May 2017 20:30:44 -0400
Subject: [PATCH 1938/1982] x86: determine stack entropy based on mmap entropy

Stack mapping entropy is currently hard-wired to 11 bits of entropy on
32-bit and 22 bits of entropy on 64-bit. The stack itself gains an extra
8 bits of entropy from lower bit randomization within 16 byte alignment
constraints. The argument block could have all lower bits randomized but
it currently only gets the mapping randomization.

Rather than hard-wiring values this switches to using the mmap entropy
configuration like the mmap base and executable base, resulting in a
range of 8 to 16 bits on 32-bit and 28 to 32 bits on 64-bit depending on
kernel configuration and overridable via the sysctl entries.

It's worth noting that since these kernel configuration options default
to the minimum supported entropy value, the entropy on 32-bit will drop
from 11 to 8 bits for builds using the defaults. However, following the
configuration seems like the right thing to do regardless. At the very
least, changing the defaults for COMPAT (32-bit processes on 64-bit)
should be considered due to the larger address space compared to real
32-bit.

Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/include/asm/elf.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 6c8fdc96be7e8b..25e26df366a679 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -315,8 +315,8 @@ extern unsigned long get_sigframe_size(void);
 
 #ifdef CONFIG_X86_32
 
-#define __STACK_RND_MASK(is32bit) (0x7ff)
-#define STACK_RND_MASK (0x7ff)
+#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
+#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1)
 
 #define ARCH_DLINFO		ARCH_DLINFO_IA32
 
@@ -325,7 +325,11 @@ extern unsigned long get_sigframe_size(void);
 #else /* CONFIG_X86_32 */
 
 /* 1GB for 64bit, 8MB for 32bit */
-#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff)
+#ifdef CONFIG_COMPAT
+#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1)
+#else
+#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
+#endif
 #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32())
 
 #define ARCH_DLINFO							\

From 1f3936998116b22b86b1d30d03aba172d8a8a222 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Tue, 23 Jul 2024 12:31:58 -0700
Subject: [PATCH 1939/1982] mmap: further improve randomization of brk(2)
 addresses

This code mostly inspired by linux-hardened patch set.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/x86/kernel/process.c | 4 ++--
 mm/mmap.c                 | 7 +++++++
 mm/util.c                 | 4 ++--
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index d5cd2177f18a54..5a6d9c821755a5 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -1027,9 +1027,9 @@ unsigned long arch_align_stack(unsigned long sp)
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
 	if (mmap_is_ia32())
-		return randomize_page(mm->brk, SZ_32M);
+		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
 
-	return randomize_page(mm->brk, SZ_1G);
+	return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
 }
 
 /*
diff --git a/mm/mmap.c b/mm/mmap.c
index b29b31a29ef662..c49a6c353dbd32 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -152,6 +152,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 
 	newbrk = PAGE_ALIGN(brk);
 	oldbrk = PAGE_ALIGN(mm->brk);
+	/* properly handle unaligned min_brk as an empty heap */
+	if (min_brk & ~PAGE_MASK) {
+		if (brk == min_brk)
+			newbrk -= PAGE_SIZE;
+		if (mm->brk == min_brk)
+			oldbrk -= PAGE_SIZE;
+	}
 	if (oldbrk == newbrk) {
 		mm->brk = brk;
 		goto success;
diff --git a/mm/util.c b/mm/util.c
index 31a59c038ba0ad..d198ffe17b8937 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -391,9 +391,9 @@ unsigned long __weak arch_randomize_brk(struct mm_struct *mm)
 {
 	/* Is the current task 32bit ? */
 	if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())
-		return randomize_page(mm->brk, SZ_32M);
+		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
 
-	return randomize_page(mm->brk, SZ_1G);
+	return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
 }
 
 unsigned long arch_mmap_rnd(void)

From 15f84e3ae395c8515fc54a95e517bca79746c13e Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Tue, 23 Jul 2024 12:34:17 -0700
Subject: [PATCH 1940/1982] exec: randomize argument block location

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 mm/vma_exec.c                    | 4 ++++
 mm/vma_internal.h                | 1 +
 tools/testing/vma/vma.c          | 1 +
 tools/testing/vma/vma_internal.h | 8 ++++++++
 4 files changed, 14 insertions(+)

diff --git a/mm/vma_exec.c b/mm/vma_exec.c
index 922ee51747a683..9a9787fce5ce25 100644
--- a/mm/vma_exec.c
+++ b/mm/vma_exec.c
@@ -148,6 +148,10 @@ int create_init_stack_vma(struct mm_struct *mm, struct vm_area_struct **vmap,
 	mmap_write_unlock(mm);
 	*vmap = vma;
 	*top_mem_p = vma->vm_end - sizeof(void *);
+
+	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+		*top_mem_p ^= get_random_u32() & ~PAGE_MASK;
+
 	return 0;
 
 err:
diff --git a/mm/vma_internal.h b/mm/vma_internal.h
index 2f05735ff190c4..1483a6c69eacac 100644
--- a/mm/vma_internal.h
+++ b/mm/vma_internal.h
@@ -37,6 +37,7 @@
 #include <linux/perf_event.h>
 #include <linux/personality.h>
 #include <linux/pfn.h>
+#include <linux/random.h>
 #include <linux/rcupdate.h>
 #include <linux/rmap.h>
 #include <linux/rwsem.h>
diff --git a/tools/testing/vma/vma.c b/tools/testing/vma/vma.c
index db580c5d21515b..9abb7408830a9a 100644
--- a/tools/testing/vma/vma.c
+++ b/tools/testing/vma/vma.c
@@ -23,6 +23,7 @@ static bool fail_prealloc;
 unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
 unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
 unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
+int randomize_va_space = 2;
 
 /*
  * Directly import the VMA implementation here. Our vma_internal.h wrapper
diff --git a/tools/testing/vma/vma_internal.h b/tools/testing/vma/vma_internal.h
index f64064ee485879..4d07f428ea0517 100644
--- a/tools/testing/vma/vma_internal.h
+++ b/tools/testing/vma/vma_internal.h
@@ -170,6 +170,11 @@ extern unsigned long dac_mmap_min_addr;
 
 #define vma_policy(vma) NULL
 
+static inline u32 get_random_u32(void)
+{
+	return 0;
+}
+
 #define down_write_nest_lock(sem, nest_lock)
 
 #define pgprot_val(x)		((x).pgprot)
@@ -239,8 +244,11 @@ enum {
  */
 enum {
 	READ_IMPLIES_EXEC =	0x0400000,
+	ADDR_NO_RANDOMIZE =	0x0040000,
 };
 
+extern int randomize_va_space;
+
 struct task_struct {
 	char comm[TASK_COMM_LEN];
 	pid_t pid;

From 4fce508f363c4bc7eb0ff6ad20dd038a09af8100 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Sun, 7 May 2017 16:16:39 -0400
Subject: [PATCH 1941/1982] use maximum supported mmap rnd entropy by default

Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 arch/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index ee9fd0150f487c..c23faaee621bd7 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -1209,7 +1209,7 @@ config ARCH_MMAP_RND_BITS
 	int "Number of bits to use for ASLR of mmap base address" if EXPERT
 	range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
 	default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT
-	default ARCH_MMAP_RND_BITS_MIN
+	default ARCH_MMAP_RND_BITS_MAX
 	depends on HAVE_ARCH_MMAP_RND_BITS
 	help
 	  This value can be used to select the number of bits to use to
@@ -1243,7 +1243,7 @@ config ARCH_MMAP_RND_COMPAT_BITS
 	int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT
 	range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX
 	default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
-	default ARCH_MMAP_RND_COMPAT_BITS_MIN
+	default ARCH_MMAP_RND_COMPAT_BITS_MAX
 	depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
 	help
 	  This value can be used to select the number of bits to use to

From 03f30a2143b89ada4f23d9e2dc2b6e02be226a8c Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 13 Sep 2024 11:22:21 -0700
Subject: [PATCH 1942/1982] elf: avoid double read of randomize_va_space in
 OpenPaX flag setup

Previously we would read randomize_va_space in openpax_setup_flags,
and then again later after calling openpax_setup_flags.

As randomize_va_space is a sysctl, its value can change at any time.
Accordingly, snapshot randomize_va_space before calling
openpax_set_flags and pass the snapshot value to openpax_set_flags.

This resolves a minor race condition where one may be able to slightly
weaken process ASLR by turning ASLR on or off during an exec call.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 fs/binfmt_elf.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index fe4410269d6ba7..c3db2840bf25be 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -866,14 +866,14 @@ static int openpax_parse_xattr_flags(struct file * const file)
 }
 #endif
 
-static int openpax_set_flags(struct file * const file)
+static int openpax_set_flags(struct file * const file, const int snapshot_randomize_va_space)
 {
 #ifdef CONFIG_OPENPAX_XATTR_PAX_FLAGS
 	int error;
 #endif
 	current->mm->pax_flags = 0;
 
-	if (randomize_va_space) {
+	if (snapshot_randomize_va_space) {
 		set_bit(PAXF_RANDMMAP, &current->mm->pax_flags);
 	}
 
@@ -1082,8 +1082,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	   may depend on the personality.  */
 	SET_PERSONALITY2(*elf_ex, &arch_state);
 
+	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
+
 #ifdef CONFIG_OPENPAX
-	retval = openpax_set_flags(bprm->file);
+	retval = openpax_set_flags(bprm->file, snapshot_randomize_va_space);
 	if (retval)
 		goto out_free_dentry;
 
@@ -1096,7 +1098,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	if (elf_read_implies_exec(*elf_ex, executable_stack))
 		current->personality |= READ_IMPLIES_EXEC;
 
-	const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
 	if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space
 #ifdef CONFIG_OPENPAX
 	    && test_bit(PAXF_RANDMMAP, &current->mm->pax_flags)

From df0a2e31028669df232e8c0669f641213ce7795c Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Wed, 30 Oct 2024 22:05:13 -0700
Subject: [PATCH 1943/1982] init: provide pax_softmode symbol unconditionally

Otherwise we have to add a bunch of #ifdefs when we otherwise
would not need to.

Fixes: a78588f6fc2f2 ("init: add pax_softmode= kernel command-line option")
Fixes: https://github.com/edera-dev/linux-openpax/issues/1
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
---
 include/linux/init.h | 2 --
 init/main.c          | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/linux/init.h b/include/linux/init.h
index 2a575c75fd98ab..00322a0992acea 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -138,9 +138,7 @@ extern char __initdata boot_command_line[];
 extern char *saved_command_line;
 extern unsigned int saved_command_line_len;
 extern unsigned int reset_devices;
-#ifdef CONFIG_OPENPAX_SOFTMODE
 extern int pax_softmode;
-#endif
 
 /* used by init/main.c */
 void setup_arch(char **);
diff --git a/init/main.c b/init/main.c
index 6a2ebb40324998..300046f2cfd0d6 100644
--- a/init/main.c
+++ b/init/main.c
@@ -191,9 +191,9 @@ static int __init set_reset_devices(char *str)
 
 __setup("reset_devices", set_reset_devices);
 
-#ifdef CONFIG_OPENPAX_SOFTMODE
 int pax_softmode;
 
+#ifdef CONFIG_OPENPAX_SOFTMODE
 static int __init setup_pax_softmode(char *str)
 {
 	get_option(&str, &pax_softmode);

From 626441c6ebdb953ffed8e0fec25733217462c5ba Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 13:09:58 -0700
Subject: [PATCH 1944/1982] security: openpax: disable OpenPaX by default

OPENPAX currently defaults to y, which means OpenPaX gets enabled
for any configuration that picks up the new symbol, including ones
that never asked for it. Default it to n so it has to be selected
explicitly.

While at it, make OPENPAX_SOFTMODE depend on OPENPAX. Soft mode does
nothing without OpenPaX enabled, so there is no reason for it to be
selectable (and default y) on its own.

Signed-off-by: Alex Zenla <alex@edera.dev>
---
 security/Kconfig.openpax | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/Kconfig.openpax b/security/Kconfig.openpax
index 76ee145094d93b..df65b38ed396e4 100644
--- a/security/Kconfig.openpax
+++ b/security/Kconfig.openpax
@@ -6,7 +6,7 @@ menu "OpenPaX options"
 
 config OPENPAX
 	bool "Enable OpenPaX features"
-	default y
+	default n
 	help
 	  This configuration setting enables OpenPaX features.
 	  OpenPaX adds memory safety-related defenses to the kernel which
@@ -14,6 +14,7 @@ config OPENPAX
 
 config OPENPAX_SOFTMODE
 	bool "Support PaX soft mode"
+	depends on OPENPAX
 	default y
 	help
 	  Enabling this option will allow you to configure OpenPaX

From d44fde870c1b6071c3176b1da77b68a522844781 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 09:58:03 -0500
Subject: [PATCH 1945/1982] xen/mem-reservation: add ordered populate

XENMEM_populate_physmap takes an extent order, but the only wrapper
exposed here pins it to EXTENT_ORDER, the order that covers one native
page and nothing more. Add a variant that takes an additional order, so
a caller can ask Xen to back a run of pages with a single
machine-contiguous allocation rather than one frame per page.

For a PV domain Xen reports back only the base machine frame of each
ordered extent, the rest of the extent following it. For a PVH domain it
reports nothing, as the guest never handles machine frames.

No functional change: xenmem_reservation_increase() becomes a wrapper at
order 0 and the new variant has no callers yet.

Backends: PV, PVH
Direction: deflate (frames move from Xen to the guest)
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 9fe9c09f2a78466ee6a38b580537b7cc3cf45bb7)
---
 drivers/xen/mem-reservation.c | 19 ++++++++++++++++---
 include/xen/mem-reservation.h |  3 +++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/mem-reservation.c b/drivers/xen/mem-reservation.c
index 24648836e0d445..ec18f5e050f1e6 100644
--- a/drivers/xen/mem-reservation.c
+++ b/drivers/xen/mem-reservation.c
@@ -82,12 +82,18 @@ void __xenmem_reservation_va_mapping_reset(unsigned long count,
 EXPORT_SYMBOL_GPL(__xenmem_reservation_va_mapping_reset);
 #endif /* CONFIG_XEN_HAVE_PVMMU */
 
-/* @frames is an array of PFNs */
-int xenmem_reservation_increase(int count, xen_pfn_t *frames)
+/*
+ * @frames is an array of PFNs, one per extent.  Each extent covers
+ * 1 << @order native pages.  For a PV domain Xen reports back only the base
+ * machine frame of each extent; the rest of the extent follows it
+ * contiguously.
+ */
+int xenmem_reservation_increase_order(int count, xen_pfn_t *frames,
+				      unsigned int order)
 {
 	struct xen_memory_reservation reservation = {
 		.address_bits = 0,
-		.extent_order = EXTENT_ORDER,
+		.extent_order = EXTENT_ORDER + order,
 		.domid        = DOMID_SELF
 	};
 
@@ -96,6 +102,13 @@ int xenmem_reservation_increase(int count, xen_pfn_t *frames)
 	reservation.nr_extents = count;
 	return HYPERVISOR_memory_op(XENMEM_populate_physmap, &reservation);
 }
+EXPORT_SYMBOL_GPL(xenmem_reservation_increase_order);
+
+/* @frames is an array of PFNs */
+int xenmem_reservation_increase(int count, xen_pfn_t *frames)
+{
+	return xenmem_reservation_increase_order(count, frames, 0);
+}
 EXPORT_SYMBOL_GPL(xenmem_reservation_increase);
 
 /* @frames is an array of GFNs */
diff --git a/include/xen/mem-reservation.h b/include/xen/mem-reservation.h
index 3cbe3df0dfd4e9..914176d959a056 100644
--- a/include/xen/mem-reservation.h
+++ b/include/xen/mem-reservation.h
@@ -55,6 +55,9 @@ static inline void xenmem_reservation_va_mapping_reset(unsigned long count,
 
 int xenmem_reservation_increase(int count, xen_pfn_t *frames);
 
+int xenmem_reservation_increase_order(int count, xen_pfn_t *frames,
+				      unsigned int order);
+
 int xenmem_reservation_decrease(int count, xen_pfn_t *frames);
 
 #endif

From 1062af871ccdd9ca69f29e46490629c3145ee92a Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 12:01:35 -0500
Subject: [PATCH 1946/1982] x86/xen: add batched helpers for remapping a
 contiguous pfn run

A PV domain's page tables hold machine frames, so moving a page between
the guest and Xen means rewriting its direct map PTE through Xen. The
per-page helpers in drivers/xen/mem-reservation.c make one
HYPERVISOR_update_va_mapping call per page.

Add exported helpers that do the same for a contiguous run in batches,
through HYPERVISOR_mmu_update as xen_remap_pfn() does:

  - xen_zap_contig_pfns() unmaps a run and invalidates its p2m entries,
    for pages about to be handed to Xen.

  - xen_remap_contig_pfns() maps a run onto frames Xen has just
    populated. It writes the p2m with __set_phys_to_machine(), which
    never allocates, so the caller runs xen_prealloc_p2m_range() over
    the run first, before the populate hypercall, while a failure can
    still be backed out of.

Both return the first failure, whether a PTE they could not find or Xen
refused to update, or a p2m entry that could not be written, and leave
what to do about it to the caller. mmu_update reports a failure back to its caller, where a
multicall batch would only log it.

Neither flushes the TLB: the intended caller only maps over PTEs that
were already cleared, and flushes after unmapping itself.

PVH domains never reach these: their page tables hold guest frames,
which do not change when Xen moves the machine frames behind them.

No callers yet.

[ 6.18 backport: context conflict only. The helpers go in front of
  xen_exchange_memory(), whose comment still describes the 6.18
  signature taking pfns_in; the added lines are unchanged. ]

Backends: PV only
Direction: inflate and deflate
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit e8f2d6dcfc6042881d74c1bd6d1daa8327221bf8)
---
 arch/x86/include/asm/xen/page.h |   5 ++
 arch/x86/xen/mmu_pv.c           | 108 ++++++++++++++++++++++++++++++++
 2 files changed, 113 insertions(+)

diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 59f642a94b9d90..80b3eda2fa01b6 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -55,6 +55,11 @@ extern unsigned long  xen_max_p2m_pfn;
 
 extern int xen_alloc_p2m_entry(unsigned long pfn);
 
+extern int xen_prealloc_p2m_range(unsigned long pfn, unsigned long count);
+extern int xen_remap_contig_pfns(unsigned long pfn, unsigned long mfn,
+				 unsigned long count);
+extern int xen_zap_contig_pfns(unsigned long pfn, unsigned long count);
+
 extern unsigned long get_phys_to_machine(unsigned long pfn);
 extern bool set_phys_to_machine(unsigned long pfn, unsigned long mfn);
 extern bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn);
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 2a4a8deaf612f5..d61aa464f46df2 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -2313,6 +2313,114 @@ static void xen_remap_exchanged_ptes(unsigned long vaddr, int order,
 	xen_mc_issue(0);
 }
 
+/*
+ * A p2m leaf covers this many pfns, so a run touches one leaf per stride plus
+ * whichever leaf its last pfn falls in.
+ */
+#define P2M_PFNS_PER_LEAF (PAGE_SIZE / sizeof(unsigned long))
+
+/*
+ * Make every p2m leaf that a run of @count pfns from @pfn writes through
+ * present, so that xen_remap_contig_pfns() over the run cannot fail for want
+ * of one. Callers run this before asking Xen to populate the run, while a
+ * failure is still easy to back out of.
+ */
+int xen_prealloc_p2m_range(unsigned long pfn, unsigned long count)
+{
+	unsigned long i;
+	int ret;
+
+	for (i = 0; i < count; i += P2M_PFNS_PER_LEAF) {
+		ret = xen_alloc_p2m_entry(pfn + i);
+		if (ret < 0)
+			return ret;
+	}
+
+	return xen_alloc_p2m_entry(pfn + count - 1);
+}
+EXPORT_SYMBOL_GPL(xen_prealloc_p2m_range);
+
+/* PTE updates per mmu_update hypercall, few enough to batch on the stack. */
+#define CONTIG_PTE_BATCH	32UL
+
+/*
+ * Point the direct map PTEs of @count contiguous pfns from @pfn at the frames
+ * counting up from @mfn when @map, or clear them when not, and set their p2m
+ * entries to match. Returns 0, or the error for the first PTE or p2m entry
+ * that could not be written.
+ */
+static int xen_set_contig_ptes(unsigned long pfn, unsigned long mfn,
+			       unsigned long count, bool map)
+{
+	struct mmu_update u[CONTIG_PTE_BATCH];
+
+	while (count) {
+		unsigned long vaddr = (unsigned long)__va(pfn << PAGE_SHIFT);
+		unsigned long batch = min(count, CONTIG_PTE_BATCH);
+		unsigned long i;
+		unsigned int level;
+		pte_t *ptep;
+		int ret;
+
+		/* Stay within one PTE page, so that its entries are consecutive. */
+		batch = min(batch, (PMD_SIZE - (vaddr & ~PMD_MASK)) >> PAGE_SHIFT);
+
+		ptep = lookup_address(vaddr, &level);
+		if (!ptep || level != PG_LEVEL_4K)
+			return -EINVAL;
+
+		for (i = 0; i < batch; i++) {
+			unsigned long frame = map ? mfn + i : INVALID_P2M_ENTRY;
+			pte_t pte = map ? mfn_pte(frame, PAGE_KERNEL) : VOID_PTE;
+
+			if (!__set_phys_to_machine(pfn + i, frame))
+				return -ENOMEM;
+
+			u[i].ptr = virt_to_machine(ptep + i).maddr |
+				   MMU_NORMAL_PT_UPDATE;
+			u[i].val = pte_val_ma(pte);
+		}
+
+		ret = HYPERVISOR_mmu_update(u, batch, NULL, DOMID_SELF);
+		if (ret < 0)
+			return ret;
+
+		pfn += batch;
+		mfn += batch;
+		count -= batch;
+	}
+
+	return 0;
+}
+
+/*
+ * Point a run of @count contiguous pfns from @pfn at the equally contiguous
+ * machine frames from @mfn. The caller must have run xen_prealloc_p2m_range()
+ * over the same run.
+ *
+ * No TLB flush is done: a run is only ever mapped over PTEs that
+ * xen_zap_contig_pfns() already cleared, so there is no stale entry to shoot
+ * down.
+ */
+int xen_remap_contig_pfns(unsigned long pfn, unsigned long mfn,
+			  unsigned long count)
+{
+	return xen_set_contig_ptes(pfn, mfn, count, true);
+}
+EXPORT_SYMBOL_GPL(xen_remap_contig_pfns);
+
+/*
+ * Unmap a run of @count contiguous pfns from @pfn and invalidate their p2m
+ * entries. Writing an invalid entry never needs a new leaf, so unlike the
+ * remap above this needs no preallocation. The caller flushes the TLB before
+ * the frames are handed back to Xen.
+ */
+int xen_zap_contig_pfns(unsigned long pfn, unsigned long count)
+{
+	return xen_set_contig_ptes(pfn, INVALID_P2M_ENTRY, count, false);
+}
+EXPORT_SYMBOL_GPL(xen_zap_contig_pfns);
+
 /*
  * Perform the hypercall to exchange a region of our pfns to point to
  * memory with the required contiguous alignment.  Takes the pfns as

From d73dea8ca20af139bede0e9ab27b2b7ad98e0713 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 12:02:18 -0500
Subject: [PATCH 1947/1982] xen/mem-reservation: add contiguous mapping helpers

A PV domain's page tables hold machine frames, so moving a page between
the guest and Xen means updating its direct map PTE and p2m entry. The
existing helpers for that take parallel arrays of pages and frames, one
entry per page. That fits order-0 extents, where Xen reports a frame per
page, but not an ordered extent, where it reports only the base frame.

Add variants that take a base page, and for mapping a base frame, and
derive the rest of a contiguous run from them, on top of the batched arch
helpers:

  - xenmem_reservation_va_mapping_reset_contig() unmaps a run before its
    frames are handed to Xen.

  - xenmem_reservation_p2m_prealloc() and
    xenmem_reservation_va_mapping_update_contig() map a run in once Xen
    has populated it. The mapping step cannot allocate, so the
    preallocation is a separate call, made before asking Xen to
    populate: it is the only step expected to fail, and failing after
    the populate would strand the frames Xen handed over.

The two directions treat a failed update differently:

  - A failed map is fatal, as in the per-page helper. Callers treat the
    run as mapped once the call returns, and a page with no mapping
    would fault wherever it was next used, far from the cause.

  - A failed unmap only warns, unlike the per-page helper. The frame
    stays mapped, and Xen will not hand it to another domain while it
    is, so the frame leaks but nothing is corrupted.

All three are no-ops outside a PV domain, like the helpers they sit
beside.

No functional change: the new helpers have no callers yet.

Backends: PV only
Direction: inflate and deflate
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit cab7ddd3e7ee67c9850bb9ce8aa9d33d6a98ead3)
---
 drivers/xen/mem-reservation.c | 37 +++++++++++++++++++++++++
 include/xen/mem-reservation.h | 51 +++++++++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/drivers/xen/mem-reservation.c b/drivers/xen/mem-reservation.c
index ec18f5e050f1e6..621606935c132b 100644
--- a/drivers/xen/mem-reservation.c
+++ b/drivers/xen/mem-reservation.c
@@ -80,6 +80,43 @@ void __xenmem_reservation_va_mapping_reset(unsigned long count,
 	}
 }
 EXPORT_SYMBOL_GPL(__xenmem_reservation_va_mapping_reset);
+
+void __xenmem_reservation_va_mapping_update_contig(unsigned long count,
+						   struct page *page,
+						   xen_pfn_t frame)
+{
+	BUILD_BUG_ON(XEN_PAGE_SIZE != PAGE_SIZE);
+
+	/*
+	 * Fatal, as in the per-page helper: callers treat the run as mapped
+	 * once this returns, and a page without a mapping faults wherever it
+	 * is next used, far from here.
+	 */
+	BUG_ON(xen_remap_contig_pfns(page_to_pfn(page), frame, count));
+}
+EXPORT_SYMBOL_GPL(__xenmem_reservation_va_mapping_update_contig);
+
+void __xenmem_reservation_va_mapping_reset_contig(unsigned long count,
+						  struct page *page)
+{
+	BUILD_BUG_ON(XEN_PAGE_SIZE != PAGE_SIZE);
+
+	/*
+	 * Unlike the per-page helper, only a warning: a frame left mapped is a
+	 * leak, but Xen will not hand it to another domain while any mapping
+	 * of it remains.
+	 */
+	WARN_ON_ONCE(xen_zap_contig_pfns(page_to_pfn(page), count));
+}
+EXPORT_SYMBOL_GPL(__xenmem_reservation_va_mapping_reset_contig);
+
+int __xenmem_reservation_p2m_prealloc(unsigned long count, struct page *page)
+{
+	BUILD_BUG_ON(XEN_PAGE_SIZE != PAGE_SIZE);
+
+	return xen_prealloc_p2m_range(page_to_pfn(page), count);
+}
+EXPORT_SYMBOL_GPL(__xenmem_reservation_p2m_prealloc);
 #endif /* CONFIG_XEN_HAVE_PVMMU */
 
 /*
diff --git a/include/xen/mem-reservation.h b/include/xen/mem-reservation.h
index 914176d959a056..5f481259ae1501 100644
--- a/include/xen/mem-reservation.h
+++ b/include/xen/mem-reservation.h
@@ -32,6 +32,15 @@ void __xenmem_reservation_va_mapping_update(unsigned long count,
 
 void __xenmem_reservation_va_mapping_reset(unsigned long count,
 					   struct page **pages);
+
+void __xenmem_reservation_va_mapping_update_contig(unsigned long count,
+						   struct page *page,
+						   xen_pfn_t frame);
+
+void __xenmem_reservation_va_mapping_reset_contig(unsigned long count,
+						  struct page *page);
+
+int __xenmem_reservation_p2m_prealloc(unsigned long count, struct page *page);
 #endif
 
 static inline void xenmem_reservation_va_mapping_update(unsigned long count,
@@ -53,6 +62,48 @@ static inline void xenmem_reservation_va_mapping_reset(unsigned long count,
 #endif
 }
 
+/*
+ * Prepare a run of @count physically contiguous pages starting at @page to be
+ * mapped by xenmem_reservation_va_mapping_update_contig(), which cannot
+ * allocate. Call this before asking Xen to populate the run: it is the only
+ * step that can fail, and failing it after the populate would strand the
+ * frames Xen handed over.
+ */
+static inline int xenmem_reservation_p2m_prealloc(unsigned long count,
+						  struct page *page)
+{
+#ifdef CONFIG_XEN_HAVE_PVMMU
+	if (xen_pv_domain())
+		return __xenmem_reservation_p2m_prealloc(count, page);
+#endif
+	return 0;
+}
+
+/*
+ * Variants for a run of @count physically contiguous pages starting at @page,
+ * backed by the equally contiguous machine frames starting at @frame.  Xen
+ * reports only the base frame of a multi-page extent, so the ordered populate
+ * path has no frame array to pass.
+ */
+static inline void xenmem_reservation_va_mapping_update_contig(unsigned long count,
+							       struct page *page,
+							       xen_pfn_t frame)
+{
+#ifdef CONFIG_XEN_HAVE_PVMMU
+	if (xen_pv_domain())
+		__xenmem_reservation_va_mapping_update_contig(count, page, frame);
+#endif
+}
+
+static inline void xenmem_reservation_va_mapping_reset_contig(unsigned long count,
+							      struct page *page)
+{
+#ifdef CONFIG_XEN_HAVE_PVMMU
+	if (xen_pv_domain())
+		__xenmem_reservation_va_mapping_reset_contig(count, page);
+#endif
+}
+
 int xenmem_reservation_increase(int count, xen_pfn_t *frames);
 
 int xenmem_reservation_increase_order(int count, xen_pfn_t *frames,

From 896d5cbeded116631994bfc79bcc05395336ec22 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 12:02:48 -0500
Subject: [PATCH 1948/1982] xen/balloon: inflate in 2 MiB blocks

The balloon inflates a page at a time: it takes whatever pages the guest
buddy allocator hands out and returns their frames to Xen one order-0
extent each. Those frames need not form an aligned run, so Xen's
free_heap_pages() cannot merge them back into a 2 MiB buddy.

Add a second unit of trade, a block of 1 << 9 Xen pages: 2 MiB, the
largest extent Xen grants a domain asking on its own behalf. Inflate now
takes a whole free block with one alloc_pages() and parks it on a block
list, so its frames go back to Xen as an aligned run. On PV the block is
unmapped with the batched contiguous-run helper; on PVH there is nothing
to unmap.

The extents submitted stay order-0. XENMEM_decrease_reservation
releases each frame individually whatever the extent order, so an
ordered extent would change nothing there while asking Xen to trust that
the block is machine-contiguous, a claim it cannot check for a PV
domain, where the frame number it is handed is already the machine
frame.

A block is only an option, never a requirement, in either direction:

  - balloon_inflate() takes a block only when the guest has a whole free
    2 MiB run, without reclaiming or compacting to make one, and
    otherwise inflates a page at a time. A guest with plenty of free
    memory can still have no such run, and that must not stop it
    shrinking.

  - Deflate still populates a page at a time and walks only the page
    list, which cannot see blocks. When that list is empty it now breaks
    a parked block onto it, so the guest can always grow back into
    memory it gave up as a block.

The OOM notifier sized its deflate from the page list counters alone,
so a balloon holding only blocks would look empty to it and the OOM
killer would run while the balloon still held memory. It now counts
block pages too, and its deflate reaches them through the block-breaking
path above.

Set xen.balloon_superpages=0 to inflate a page at a time as before.

Backends: PV, PVH
Direction: inflate (frames move from the guest to Xen); deflate only
 changes to consume blocks
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 534e37ae697f1b41bcf4087dfe75e5fb1b9fe022)
---
 drivers/xen/balloon.c     | 202 ++++++++++++++++++++++++++++++++++++--
 drivers/xen/xen-balloon.c |   2 +
 include/xen/balloon.h     |   2 +
 3 files changed, 200 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 40c55082867ecd..349648b4eb3230 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -107,6 +107,17 @@ static const struct ctl_table balloon_table[] = {
  */
 #define EXTENT_ORDER (fls(XEN_PFN_PER_PAGE) - 1)
 
+/*
+ * A balloon block is 2 MiB of Xen pages, the largest extent Xen lets a domU
+ * request for itself: CONFIG_DOMU_MAX_ORDER is PAGETABLE_ORDER on x86.
+ */
+#define BALLOON_BLOCK_XEN_ORDER	9
+#define BALLOON_BLOCK_ORDER	(BALLOON_BLOCK_XEN_ORDER - EXTENT_ORDER)
+#define BALLOON_BLOCK_NR_PAGES	(1UL << BALLOON_BLOCK_ORDER)
+
+static bool __read_mostly balloon_superpages = true;
+module_param(balloon_superpages, bool, 0444);
+
 /*
  * balloon_thread() state:
  *
@@ -139,11 +150,21 @@ static xen_pfn_t frame_list[PAGE_SIZE / sizeof(xen_pfn_t)];
 static LIST_HEAD(ballooned_pages);
 static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
 
+/* List of ballooned blocks, threaded through each block's head page. */
+static LIST_HEAD(ballooned_blocks);
+
 /* When ballooning out (allocating memory to return to Xen) we don't really
    want the kernel to try too hard since that can trigger the oom killer. */
 #define GFP_BALLOON \
 	(GFP_HIGHUSER | __GFP_NOWARN | __GFP_NORETRY | __GFP_NOMEMALLOC)
 
+/*
+ * A block is only taken when the guest has a whole free 2 MiB run to spare:
+ * the balloon never reclaims or compacts to make one, and inflates a page at
+ * a time instead.
+ */
+#define GFP_BALLOON_BLOCK	(GFP_BALLOON & ~__GFP_RECLAIM)
+
 /* balloon_append: add the given page to the balloon. */
 static void balloon_append(struct page *page)
 {
@@ -163,12 +184,78 @@ static void balloon_append(struct page *page)
 	wake_up(&balloon_wq);
 }
 
+/*
+ * A block is accounted as one unit, which the low/high split of the page list
+ * cannot express. That only matters with highmem, which the 64-bit
+ * configurations Xen guests run on do not have.
+ */
+static bool balloon_blocks_usable(void)
+{
+	return balloon_superpages && !IS_ENABLED(CONFIG_HIGHMEM);
+}
+
+/* balloon_append_block: park a whole block on the balloon. */
+static void balloon_append_block(struct page *head)
+{
+	unsigned long i;
+
+	for (i = 0; i < BALLOON_BLOCK_NR_PAGES; i++)
+		__SetPageOffline(head + i);
+
+	list_add(&head->lru, &ballooned_blocks);
+	balloon_stats.balloon_blocks++;
+	mod_node_page_state(page_pgdat(head), NR_BALLOON_PAGES,
+			    BALLOON_BLOCK_NR_PAGES);
+
+	wake_up(&balloon_wq);
+}
+
+/* balloon_retrieve_block: rescue a whole block from the balloon. */
+static struct page *balloon_retrieve_block(void)
+{
+	struct page *head;
+	unsigned long i;
+
+	head = list_first_entry_or_null(&ballooned_blocks, struct page, lru);
+	if (!head)
+		return NULL;
+
+	list_del(&head->lru);
+	balloon_stats.balloon_blocks--;
+	mod_node_page_state(page_pgdat(head), NR_BALLOON_PAGES,
+			    -(long)BALLOON_BLOCK_NR_PAGES);
+
+	for (i = 0; i < BALLOON_BLOCK_NR_PAGES; i++)
+		__ClearPageOffline(head + i);
+
+	return head;
+}
+
+/*
+ * Spill one block onto the page list so the order-0 paths can consume it.
+ * This is one way: the pages go back to being ballooned individually, and
+ * only form a block again if a later inflate allocates the same run whole.
+ */
+static bool balloon_break_block(void)
+{
+	struct page *head = balloon_retrieve_block();
+	unsigned long i;
+
+	if (!head)
+		return false;
+
+	for (i = 0; i < BALLOON_BLOCK_NR_PAGES; i++)
+		balloon_append(head + i);
+
+	return true;
+}
+
 /* balloon_retrieve: rescue a page from the balloon, if it is not empty. */
 static struct page *balloon_retrieve(bool require_lowmem)
 {
 	struct page *page;
 
-	if (list_empty(&ballooned_pages))
+	if (list_empty(&ballooned_pages) && !balloon_break_block())
 		return NULL;
 
 	page = list_entry(ballooned_pages.next, struct page, lru);
@@ -385,7 +472,8 @@ static long current_credit(void)
 
 static bool balloon_is_inflated(void)
 {
-	return balloon_stats.balloon_low || balloon_stats.balloon_high;
+	return balloon_stats.balloon_low || balloon_stats.balloon_high ||
+	       balloon_stats.balloon_blocks;
 }
 
 static enum bp_state increase_reservation(unsigned long nr_pages)
@@ -397,6 +485,14 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
 	if (nr_pages > ARRAY_SIZE(frame_list))
 		nr_pages = ARRAY_SIZE(frame_list);
 
+	/*
+	 * Memory parked as whole blocks is invisible to the page list walk
+	 * below. Break a block onto the list rather than find nothing to
+	 * populate while the balloon still holds memory.
+	 */
+	if (list_empty(&ballooned_pages))
+		balloon_break_block();
+
 	page = list_first_entry_or_null(&ballooned_pages, struct page, lru);
 	for (i = 0; i < nr_pages; i++) {
 		if (!page) {
@@ -488,6 +584,94 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 	return state;
 }
 
+static enum bp_state decrease_reservation_blocks(unsigned long nr_blocks)
+{
+	enum bp_state state = BP_DONE;
+	unsigned long i, j, nr_pages;
+	struct page *head, *tmp;
+	LIST_HEAD(blocks);
+	int ret;
+
+	/*
+	 * One extent per native page even though the frames form whole blocks.
+	 * XENMEM_decrease_reservation releases each frame individually
+	 * whatever the extent order, so an ordered extent would change nothing
+	 * here while asking Xen to trust that the block is machine-contiguous,
+	 * a claim it cannot check for a PV domain, where the frame number it
+	 * is handed is already the machine frame. What lets Xen merge the
+	 * frames back into a 2 MiB buddy is that they are a whole aligned run,
+	 * which they are whenever the block is backed by one machine-contiguous
+	 * allocation.
+	 */
+	if (nr_blocks > ARRAY_SIZE(frame_list) / BALLOON_BLOCK_NR_PAGES)
+		nr_blocks = ARRAY_SIZE(frame_list) / BALLOON_BLOCK_NR_PAGES;
+
+	for (i = 0; i < nr_blocks; i++) {
+		head = alloc_pages(GFP_BALLOON_BLOCK, BALLOON_BLOCK_ORDER);
+		if (head == NULL) {
+			nr_blocks = i;
+			state = BP_EAGAIN;
+			break;
+		}
+
+		split_page(head, BALLOON_BLOCK_ORDER);
+		adjust_managed_page_count(head, -(long)BALLOON_BLOCK_NR_PAGES);
+
+		for (j = 0; j < BALLOON_BLOCK_NR_PAGES; j++)
+			xenmem_reservation_scrub_page(head + j);
+
+		list_add(&head->lru, &blocks);
+	}
+
+	if (!nr_blocks)
+		return state;
+
+	kmap_flush_unused();
+
+	i = 0;
+	list_for_each_entry_safe(head, tmp, &blocks, lru) {
+		for (j = 0; j < BALLOON_BLOCK_NR_PAGES; j++)
+			frame_list[i++] = xen_page_to_gfn(head + j);
+
+		xenmem_reservation_va_mapping_reset_contig(
+				BALLOON_BLOCK_NR_PAGES, head);
+
+		list_del(&head->lru);
+
+		balloon_append_block(head);
+	}
+
+	flush_tlb_all();
+
+	nr_pages = nr_blocks * BALLOON_BLOCK_NR_PAGES;
+	ret = xenmem_reservation_decrease(nr_pages, frame_list);
+	BUG_ON(ret != nr_pages);
+
+	balloon_stats.current_pages -= nr_pages;
+
+	return state;
+}
+
+/*
+ * Inflate by whole blocks while the guest has one to spare, a page at a time
+ * otherwise. A guest with plenty of free memory can still have no whole free
+ * 2 MiB run left, and that must not stop it shrinking.
+ */
+static enum bp_state balloon_inflate(unsigned long nr_pages)
+{
+	if (balloon_blocks_usable() && nr_pages >= BALLOON_BLOCK_NR_PAGES) {
+		unsigned long before = balloon_stats.current_pages;
+		enum bp_state state;
+
+		state = decrease_reservation_blocks(nr_pages >>
+						    BALLOON_BLOCK_ORDER);
+		if (balloon_stats.current_pages != before)
+			return state;
+	}
+
+	return decrease_reservation(nr_pages, GFP_BALLOON);
+}
+
 /*
  * Stop waiting if either state is BP_DONE and ballooning action is
  * needed, or if the credit has changed while state is not BP_DONE.
@@ -549,8 +733,7 @@ static int balloon_thread(void *unused)
 			long n_pages;
 
 			n_pages = min(-credit, si_mem_available());
-			balloon_state = decrease_reservation(n_pages,
-							     GFP_BALLOON);
+			balloon_state = balloon_inflate(n_pages);
 			if (balloon_state == BP_DONE && n_pages != -credit &&
 			    n_pages < totalreserve_pages)
 				balloon_state = BP_EAGAIN;
@@ -696,8 +879,9 @@ static int balloon_oom_notify(struct notifier_block *nb, unsigned long dummy,
 	if (!mutex_trylock(&balloon_mutex))
 		return NOTIFY_OK;
 
-	/* nr: number of pages parked on the balloon list that we can reclaim */
-	nr = balloon_stats.balloon_low + balloon_stats.balloon_high;
+	/* nr: number of pages parked on the balloon that we can reclaim */
+	nr = balloon_stats.balloon_low + balloon_stats.balloon_high +
+	     balloon_stats.balloon_blocks * BALLOON_BLOCK_NR_PAGES;
 
 	/* clamp, so we don't release all of them at once */
 	nr = min_t(unsigned long, nr, BALLOON_OOM_DEFLATE_BATCH);
@@ -795,6 +979,12 @@ static int __init balloon_init(void)
 	if (!xen_domain())
 		return -ENODEV;
 
+	/* A block must span at least a native page, and be allocatable. */
+	BUILD_BUG_ON(BALLOON_BLOCK_XEN_ORDER < EXTENT_ORDER);
+	BUILD_BUG_ON(BALLOON_BLOCK_ORDER > MAX_PAGE_ORDER);
+	/* Inflating a block takes one frame_list entry per page. */
+	BUILD_BUG_ON(BALLOON_BLOCK_NR_PAGES > ARRAY_SIZE(frame_list));
+
 	pr_info("Initialising balloon driver\n");
 
 	if (xen_initial_domain())
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index b293d7652f1559..bf538f12781261 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -145,6 +145,7 @@ EXPORT_SYMBOL_GPL(xen_balloon_init);
 BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages));
 BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low));
 BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high));
+BALLOON_SHOW(blocks, "%lu\n", balloon_stats.balloon_blocks);
 
 static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay);
 static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);
@@ -223,6 +224,7 @@ static struct attribute *balloon_info_attrs[] = {
 	&dev_attr_current_kb.attr,
 	&dev_attr_low_kb.attr,
 	&dev_attr_high_kb.attr,
+	&dev_attr_blocks.attr,
 	NULL
 };
 
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index f78a6cc94f1aea..4702026337e554 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -15,6 +15,8 @@ struct balloon_stats {
 	/* Number of pages in high- and low-memory balloons. */
 	unsigned long balloon_low;
 	unsigned long balloon_high;
+	/* Number of whole superpage blocks parked on the balloon. */
+	unsigned long balloon_blocks;
 	unsigned long total_pages;
 	unsigned long schedule_delay;
 	unsigned long max_schedule_delay;

From d10952c0fe9c9abc7127a4521dcff852608b55cd Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 10:00:15 -0500
Subject: [PATCH 1949/1982] xen/balloon: deflate in 2 MiB blocks

Deflate still breaks a parked block into pages and asks Xen to populate
each with its own order-0 extent, which lets Xen back the block with any
512 frames it has.

Populate a parked block as a single order-9 extent instead, so that Xen
allocates one machine-contiguous 2 MiB run for it:

  - On PVH Xen maps that run with a single 2 MiB EPT entry rather than
    512 4 KiB ones.

  - On PV there is no EPT, and the guest cannot use 2 MiB mappings. The
    guest maps the run in itself, with the batched contiguous-run
    helper, from the base machine frame Xen reports.

The p2m leaves of each block are preallocated while walking the block
list, before the populate hypercall: mapping the block afterwards cannot
allocate, and once Xen has populated an extent there is no way to hand
it back. Failing there only shortens the batch.

A block is only an option here too. balloon_deflate() falls back to the
page at a time path when a block makes no progress: Xen refuses an
order-9 extent when the host has no free 2 MiB run, or when the domain
is less than 2 MiB below its max_pages ceiling, and neither should stop
the guest growing by what it can still get. Credits smaller than a block
take the page at a time path as well.

Blocks are populated at most BALLOON_BLOCK_BATCH at a time, which bounds
the work done under balloon_mutex; the OOM notifier can only trylock it.

Backends: PV, PVH
Direction: deflate (frames move from Xen to the guest)
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 0fe138949be10b99c4bcbbe26672267725d1254a)
---
 drivers/xen/balloon.c | 109 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 108 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 349648b4eb3230..2b8d15dddf22db 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -115,6 +115,14 @@ static const struct ctl_table balloon_table[] = {
 #define BALLOON_BLOCK_ORDER	(BALLOON_BLOCK_XEN_ORDER - EXTENT_ORDER)
 #define BALLOON_BLOCK_NR_PAGES	(1UL << BALLOON_BLOCK_ORDER)
 
+/*
+ * Most blocks populated by one deflate. On PV each block also costs a page
+ * table update per page, batched but done under balloon_mutex. Capping the
+ * batch keeps a large target change from holding the mutex against a later
+ * target update, or against the OOM notifier, which can only trylock it.
+ */
+#define BALLOON_BLOCK_BATCH	32
+
 static bool __read_mostly balloon_superpages = true;
 module_param(balloon_superpages, bool, 0444);
 
@@ -231,6 +239,15 @@ static struct page *balloon_retrieve_block(void)
 	return head;
 }
 
+static struct page *balloon_next_block(struct page *head)
+{
+	struct list_head *next = head->lru.next;
+
+	if (next == &ballooned_blocks)
+		return NULL;
+	return list_entry(next, struct page, lru);
+}
+
 /*
  * Spill one block onto the page list so the order-0 paths can consume it.
  * This is one way: the pages go back to being ballooned individually, and
@@ -527,6 +544,94 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
 	return BP_DONE;
 }
 
+/*
+ * Populate whole parked blocks, one order-9 extent each, so that Xen backs
+ * each block with a single machine-contiguous 2 MiB run. On PVH Xen maps that
+ * run with one 2 MiB EPT entry rather than 512 4 KiB ones.
+ */
+static enum bp_state increase_reservation_blocks(unsigned long nr_blocks)
+{
+	struct page *head;
+	unsigned long i, j;
+	int rc;
+
+	if (nr_blocks > BALLOON_BLOCK_BATCH)
+		nr_blocks = BALLOON_BLOCK_BATCH;
+
+	head = list_first_entry_or_null(&ballooned_blocks, struct page, lru);
+	for (i = 0; i < nr_blocks; i++) {
+		if (!head) {
+			nr_blocks = i;
+			break;
+		}
+
+		/*
+		 * Has to happen before the hypercall: mapping the block in
+		 * below cannot allocate, and once Xen has populated an extent
+		 * there is no way to hand it back. A short batch is fine; what
+		 * is left is deflated on a later pass.
+		 */
+		if (xenmem_reservation_p2m_prealloc(BALLOON_BLOCK_NR_PAGES,
+						    head)) {
+			nr_blocks = i;
+			break;
+		}
+
+		frame_list[i] = page_to_xen_pfn(head);
+		head = balloon_next_block(head);
+	}
+
+	if (!nr_blocks)
+		return BP_EAGAIN;
+
+	rc = xenmem_reservation_increase_order(nr_blocks, frame_list,
+					       BALLOON_BLOCK_ORDER);
+	if (rc <= 0)
+		return BP_EAGAIN;
+
+	for (i = 0; i < rc; i++) {
+		head = balloon_retrieve_block();
+		BUG_ON(head == NULL);
+
+		/*
+		 * A PV domain gets back only the base machine frame of each
+		 * extent, the rest of the block following it; on PVH there is
+		 * nothing to map.
+		 */
+		xenmem_reservation_va_mapping_update_contig(
+				BALLOON_BLOCK_NR_PAGES, head, frame_list[i]);
+
+		for (j = 0; j < BALLOON_BLOCK_NR_PAGES; j++)
+			free_reserved_page(head + j);
+	}
+
+	balloon_stats.current_pages += rc * BALLOON_BLOCK_NR_PAGES;
+
+	return BP_DONE;
+}
+
+/*
+ * Deflate by whole blocks while Xen can supply a 2 MiB extent, a page at a
+ * time otherwise. Xen refuses a block when the host has no free 2 MiB run,
+ * or when the domain is less than 2 MiB below its max_pages ceiling, and
+ * neither must stop the guest growing by what it can still get.
+ */
+static enum bp_state balloon_deflate(unsigned long nr_pages)
+{
+	if (balloon_blocks_usable() && balloon_stats.balloon_blocks &&
+	    nr_pages >= BALLOON_BLOCK_NR_PAGES) {
+		unsigned long before = balloon_stats.current_pages;
+		enum bp_state state;
+
+		state = increase_reservation_blocks(nr_pages >>
+						    BALLOON_BLOCK_ORDER);
+		if (balloon_stats.current_pages != before)
+			return state;
+	}
+
+	return increase_reservation(nr_pages);
+}
+
 static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 {
 	enum bp_state state = BP_DONE;
@@ -724,7 +829,7 @@ static int balloon_thread(void *unused)
 
 		if (credit > 0) {
 			if (balloon_is_inflated())
-				balloon_state = increase_reservation(credit);
+				balloon_state = balloon_deflate(credit);
 			else
 				balloon_state = reserve_additional_memory();
 		}
@@ -984,6 +1089,8 @@ static int __init balloon_init(void)
 	BUILD_BUG_ON(BALLOON_BLOCK_ORDER > MAX_PAGE_ORDER);
 	/* Inflating a block takes one frame_list entry per page. */
 	BUILD_BUG_ON(BALLOON_BLOCK_NR_PAGES > ARRAY_SIZE(frame_list));
+	/* Deflating takes one frame_list entry per block. */
+	BUILD_BUG_ON(BALLOON_BLOCK_BATCH > ARRAY_SIZE(frame_list));
 
 	pr_info("Initialising balloon driver\n");
 

From a5d9d9ff9cadf9065b1e8282a0d91abf17241847 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 24 Sep 2026 12:03:03 -0500
Subject: [PATCH 1950/1982] xen/balloon: deflate 2 MiB blocks in the OOM path

The OOM notifier deflates through increase_reservation(), which works a
page at a time and reaches parked blocks only by breaking them up.

Deflate through balloon_deflate() instead, so that an OOM deflate
populates a whole block as a single order-9 extent where Xen can supply
one, and still falls back to single pages where it cannot, including the
last 2 MiB below the domain's max_pages ceiling.

Backends: PV, PVH
Direction: deflate (frames move from Xen to the guest)
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit ee71370a693c12056b7c44cdd4f7b2709d227e35)
---
 drivers/xen/balloon.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 2b8d15dddf22db..692dca2eccbc58 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -998,10 +998,10 @@ static int balloon_oom_notify(struct notifier_block *nb, unsigned long dummy,
 
 	/* runs XENMEM_populate_physmap, updates current_pages */
 	if (nr > 0)
-		increase_reservation(nr);
+		balloon_deflate(nr);
 
 	/*
-	 * increase_reservation() bumped current_pages by however many Xen
+	 * balloon_deflate() bumped current_pages by however many Xen
 	 * actually populated (possibly fewer than asked, or zero if the host is
 	 * out or we are already at max_pages). Report that to the OOM killer so
 	 * it retries instead of killing when we made progress.

From 86b2c349440112fd882a5dbb16ddc5fc44c2e4e1 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 9 Oct 2026 12:17:18 -0700
Subject: [PATCH 1951/1982] automation: rebase edera/6.18-lts onto stable
 linux-6.18.y nightly

Give edera/6.18-lts its own copy of the rebase automation that
edera/mainline carries, set up for this tree: kernel-nightly.yml rebases
edera/6.18-lts onto stable.git linux-6.18.y, rebase-land.yml lands
approved rebase/edera-6.18-lts/... pull requests, and the skill audits
the stable delta, where every commit is a fix.

Scheduled workflows run only from the default branch, so this copy has
no schedule. A trigger on edera/mainline dispatches it nightly by path.
Its concurrency group is per tree so it runs alongside the mainline
rebase.
---
 .automation/skills/upstream-rebase/SKILL.md   | 246 +++++++
 .github/scripts/kernel-build.sh               |  93 +++
 .github/scripts/report-needs-decision.sh      |  51 ++
 .../tests/report-needs-decision.test.sh       | 111 +++
 .../tests/verify-upstream-rebase.test.sh      | 136 ++++
 .github/scripts/verify-upstream-rebase.sh     | 207 ++++++
 .github/workflows/automation-selftest.yml     |  60 ++
 .github/workflows/kernel-nightly.yml          |  60 ++
 .github/workflows/rebase-land.yml             | 130 ++++
 .github/workflows/upstream-rebase.yml         | 665 ++++++++++++++++++
 10 files changed, 1759 insertions(+)
 create mode 100644 .automation/skills/upstream-rebase/SKILL.md
 create mode 100755 .github/scripts/kernel-build.sh
 create mode 100755 .github/scripts/report-needs-decision.sh
 create mode 100755 .github/scripts/tests/report-needs-decision.test.sh
 create mode 100755 .github/scripts/tests/verify-upstream-rebase.test.sh
 create mode 100755 .github/scripts/verify-upstream-rebase.sh
 create mode 100644 .github/workflows/automation-selftest.yml
 create mode 100644 .github/workflows/kernel-nightly.yml
 create mode 100644 .github/workflows/rebase-land.yml
 create mode 100644 .github/workflows/upstream-rebase.yml

diff --git a/.automation/skills/upstream-rebase/SKILL.md b/.automation/skills/upstream-rebase/SKILL.md
new file mode 100644
index 00000000000000..5f22a00da6d391
--- /dev/null
+++ b/.automation/skills/upstream-rebase/SKILL.md
@@ -0,0 +1,246 @@
+---
+name: upstream-rebase
+description: Nightly rebase of edera/6.18-lts onto stable linux-6.18.y, run unattended in CI by .github/workflows/upstream-rebase.yml. Covers the replay, conflict resolution, build checks, the audit of upstream fixes that meet the series, and the report the workflow publishes.
+---
+
+# Nightly upstream rebase
+
+You are rebasing the Edera downstream kernel series (around 80 commits:
+Hyper-V-nested-on-Xen, the Xen PV-IOMMU, NUMA-aware Xen backends, 2 MiB
+ballooning, OpenPaX, and assorted fixes) on `edera/6.18-lts` onto the stable
+`linux-6.18.y` branch. The goal is a replay that changes **nothing downstream**: every
+difference in the final tree must come from the upstream delta alone. Where
+that is impossible, because upstream and downstream touched the same code, you
+resolve the conflict the way a careful kernel maintainer would and you say
+exactly what you did.
+
+This runs unattended. Nobody is watching while you work, and nobody can answer
+a question. Everything a reviewer needs has to end up in the report.
+
+## What happens to your result
+
+You cannot push, and nothing you write can cause the branch to be pushed.
+Your report can only stop it. When you finish, the workflow independently:
+
+1. runs `verify-upstream-rebase.sh` against your branch, which checks from git
+   alone that the series sits on the upstream tip, is linear, lost or gained
+   no commit, and changed the tree by exactly the upstream delta;
+2. builds x86_64 and arm64 `vmlinux` with `kernel-build.sh`, which turns on
+   every downstream feature as a built-in.
+
+If all of that passes **and your report's "Needs a decision" section is
+`None.` with nothing marked UNSURE anywhere** (checked by
+`report-needs-decision.sh`), the downstream branch is force-pushed to your
+branch. Otherwise your branch goes up as a pull request with your report as
+the body, and a maintainer reads it.
+
+So a question you raise is never lost to an automatic push. Raise one whenever
+a maintainer should see something before the branch moves, even when the
+rebase itself is clean, for example an upstream change that reaches a
+downstream feature without touching the same lines. Do not use the word UNSURE
+for anything else.
+
+So: a conflict you resolve **will** show up as drift and **will** go to a
+human. That is the intended outcome, not a failure. Do not try to make a
+resolution look clean, and never drop, squash, reorder or reword a downstream
+commit to get past the checks. A rebase that reaches review with an honest
+report is a success; one that hides a judgement call is not.
+
+## Inputs
+
+The workflow gives you, in the prompt:
+
+- `DOWNSTREAM`: the branch being rebased, `edera/6.18-lts`.
+- `OLD_TIP`: its current commit (already checked out).
+- `UPSTREAM`: the upstream commit to rebase onto, fetched as the local branch
+  `upstream-target`.
+- `RESULT`: the local branch name your result must end up on.
+- `REPORT`: the path your report must be written to.
+
+The automation's own scripts are in `.rebase-tools/scripts/`, copied from the
+default branch. Use those, never a copy inside the tree you are rebasing: the
+tree is what is under test.
+
+### How to run commands here
+
+Your shell commands are checked against an allowlist that matches the
+command's first word. Shell variables, `$(...)`, `<(...)` and `VAR=x cmd`
+prefixes will be refused, so in every snippet below `OLD_TIP`, `UPSTREAM`,
+`RESULT`, `MB` and `<...>` are placeholders: substitute the literal SHA or
+path, or a path you choose. Put scratch files, worktrees and build output
+under `.rebase-scratch/` in the repository root (`mkdir -p .rebase-scratch`);
+the kernel's `.gitignore` ignores it and nothing reads it after you.
+
+This is a blobless clone: file contents are fetched from GitHub the first time
+a command needs them, so the first `git log -p` or checkout over a range is
+slower than you expect. That is not a hang.
+
+## 1. Survey
+
+```sh
+git merge-base OLD_TIP UPSTREAM               # call the result MB
+git rev-list --count --no-merges MB..OLD_TIP  # downstream commits
+git log --oneline --no-merges MB..UPSTREAM    # what is new upstream
+```
+
+The upstream range is large (one or more stable releases, often hundreds of
+commits each), so do not read it all. Find where it meets the
+series:
+
+```sh
+git diff --name-only --output=.rebase-scratch/down.files MB..OLD_TIP
+git diff --name-only --output=.rebase-scratch/up.files MB..UPSTREAM
+comm -12 .rebase-scratch/down.files .rebase-scratch/up.files   # both sorted already
+git log --oneline --no-merges MB..UPSTREAM -- <each shared path>
+```
+
+Read the messages and diffs of those upstream commits. They are where a
+textually clean replay can still be semantically wrong: a helper downstream
+calls that changed its locking or return convention, a struct field that
+moved, a Kconfig symbol that was renamed. Note them; you come back to them in
+step 4.
+
+The series may contain a merge commit from an old pull request. Rebasing
+flattens it into its commits, which is expected and the checker accepts it;
+do not use `--rebase-merges`.
+
+## 2. Rebase
+
+```sh
+git switch -c RESULT OLD_TIP
+git rebase --onto UPSTREAM MB RESULT
+```
+
+When a commit conflicts:
+
+- Read the upstream change that caused it **and** the downstream commit's
+  intent (its message, and the rest of its diff). Resolve so the downstream
+  commit does what it did before, on top of what upstream now does.
+- Upstream wins on fixes. If a stable backport changed the code a downstream
+  commit edits, keep every check, lock, ordering constraint
+  and error path the fix introduced, and fit the downstream change around it.
+- If upstream now contains the downstream change itself (it was upstreamed and
+  backported to stable), let the downstream commit go empty and let git drop
+  it. Record that, with the upstream commit.
+- If you cannot tell what the right resolution is, do not guess silently. Make
+  the most conservative resolution you can defend, mark it **UNSURE** in the
+  report, and explain both readings.
+- Never use `-X ours`, `-X theirs`, `--skip`, or `git checkout --ours/--theirs`
+  on a whole file to make a conflict go away.
+
+For each conflict, record: the downstream commit (subject), the files, the
+upstream commit it collided with, and in a sentence or two what you kept and
+why.
+
+## 3. Build
+
+The workflow re-runs these builds itself, but run them here so you can fix
+what your resolutions broke. Each takes a while; run them once the rebase is
+complete, not after every commit.
+
+```sh
+bash .rebase-tools/scripts/kernel-build.sh x86_64 .rebase-scratch/obj-x86 4
+bash .rebase-tools/scripts/kernel-build.sh arm64 .rebase-scratch/obj-arm64 4
+```
+
+Exit status 3 means a downstream option no longer survives `olddefconfig`:
+upstream renamed or re-depended a Kconfig symbol the series relies on (or that
+the build script names). Find out which, and say so in the report; if the
+build script's list is what is stale, that is a **Needs a decision** item,
+not something to work around.
+
+If a build fails because of the rebase (a resolution, or an upstream change a
+downstream commit has not caught up with), fix it **in the downstream commit
+that is wrong**. Interactive editors do not work here, so drive the todo list
+with sed: `git -c sequence.editor="sed -i 's/^pick <sha>/edit <sha>/'" rebase
+-i UPSTREAM`, amend, then `git rebase --continue`. Do not add a fix-up commit
+on top unless there is no single commit it belongs to; if you must, its
+subject starts with `rebase: ` and the report says why.
+
+If a build fails on the pristine upstream tree too, it is not yours: build
+UPSTREAM the same way in a `.rebase-scratch/` worktree to confirm, and report
+it as pre-existing.
+
+## 4. Audit what upstream brought in
+
+For every upstream commit flagged in step 1, check that its change **survived
+the replay**. Ancestry is not enough: a downstream commit replayed on top can
+edit the very lines a fix added.
+
+Every stable commit is a fix; those with a `CVE-` reference matter most. For
+each one that touched a file the series also touches:
+
+```sh
+git log --oneline UPSTREAM..RESULT -- <files the fix touched>
+```
+
+If that returns anything, read the **final tree**, not the commit graph:
+confirm the fix's checks and ordering are intact and that downstream code
+added after it is covered by them. Grep tree-wide for any function or flag
+the fix deliberately removed, in case a downstream commit brought it back.
+
+Also look for semantic collisions that did not conflict: an upstream change
+to a function's contract (locking, refcounting, return values, a new required
+call) where a downstream commit calls that function. Each one you cannot rule
+out is an UNSURE item.
+
+## 5. Check yourself
+
+Run the same checker the workflow will run, so the report can explain its
+result rather than be surprised by it:
+
+```sh
+bash .rebase-tools/scripts/verify-upstream-rebase.sh OLD_TIP RESULT UPSTREAM
+```
+
+Every drift line and every changed commit it lists must be accounted for in
+your report by a conflict resolution, a dropped-empty commit or a build fix.
+If one is not, you made a change you did not mean to: find it and undo it.
+
+## 6. Report
+
+Write the report to the `REPORT` path, in Markdown. It becomes a pull request
+body when a human has to look, so lead with what they must decide. No
+preamble, no sign-off.
+
+```markdown
+## Summary
+One paragraph: the tree, upstream range (N commits, short SHAs and the
+`git describe` of each end), downstream commits replayed, conflicts resolved,
+commits dropped, and whether you expect the checker to pass.
+
+## Needs a decision
+One bullet per question, each starting **UNSURE:**, with both readings and
+what you committed. "None." if there is nothing; anything else here stops the
+automatic push.
+
+## Conflicts resolved
+Per conflict: downstream commit, files, colliding upstream commit, what you
+kept and why. "None." if none.
+
+## Dropped downstream commits
+Subject and the upstream commit that made it empty. "None." if none.
+
+## Build fixes
+What broke, which commit you fixed it in, why. "None." if none.
+
+## Upstream commits that meet the series
+`short-sha subject` for each upstream commit that touched a file the series
+touches, and for each fix among them your reading of the final tree. "None."
+if none.
+
+## Builds
+x86_64, arm64: pass, fail (with the first error), or pre-existing failure
+(confirmed on pristine upstream).
+```
+
+Then stop. Leave RESULT checked out or not; the workflow reads the branch,
+not the working tree.
+
+## If you cannot finish
+
+If the rebase cannot be completed (a conflict you cannot resolve at all, a
+toolchain that will not run), run `git rebase --abort`, do not create the
+RESULT branch, and write the report explaining where you stopped and why. The
+workflow treats a missing RESULT branch as a failed night and opens an issue
+with your report.
diff --git a/.github/scripts/kernel-build.sh b/.github/scripts/kernel-build.sh
new file mode 100755
index 00000000000000..2a4c38dd68cb80
--- /dev/null
+++ b/.github/scripts/kernel-build.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Builds the kernel the way the nightly automation judges a branch.
+#
+# defconfig alone compiles almost none of the Edera series: Hyper-V nesting,
+# Xen dom0 and backends, the PV-IOMMU, OpenPaX and the NUMA-aware Xen paths
+# are all off in it. This turns them on as built-ins and builds vmlinux, so a
+# replay that breaks any of them, or links against a symbol upstream removed,
+# fails here. Building only a subdirectory would miss those link errors.
+#
+# The rebase skill runs this same script before they finish, so
+# what Claude checks and what the workflow checks cannot drift apart.
+#
+# Usage:
+#   kernel-build.sh <x86_64|arm64> <objdir> [jobs]
+#
+# Run from the top of a kernel tree. <objdir> is created if missing and may be
+# reused between runs. For arm64 it uses CROSS_COMPILE (default
+# aarch64-linux-gnu-) unless LLVM is set, in which case it builds with clang.
+#
+# Exit status: make's on a build failure; 3 if an option it asked for did not
+# survive olddefconfig (a Kconfig dependency the series no longer satisfies).
+
+set -euo pipefail
+
+if [ $# -lt 2 ] || [ $# -gt 3 ]; then
+	echo "usage: $0 <x86_64|arm64> <objdir> [jobs]" >&2
+	exit 2
+fi
+arch=$1
+objdir=$2
+jobs=${3:-$(nproc)}
+
+common=(
+	XEN XEN_BACKEND XEN_DOM0 XEN_BALLOON XEN_GNTDEV XEN_GRANT_DEV_ALLOC
+	NUMA ACPI_NUMA MEMORY_HOTPLUG MEMORY_HOTREMOVE ZONE_DEVICE
+	XEN_UNPOPULATED_ALLOC XEN_BACKEND_NUMA_AFFINITY
+	XEN_NETDEV_FRONTEND XEN_NETDEV_BACKEND XEN_BLKDEV_FRONTEND XEN_BLKDEV_BACKEND
+	NET_9P NET_9P_XEN 9P_FS
+	DRM DRM_VIRTIO_GPU FW_CFG_SYSFS
+	SECURITY OPENPAX OPENPAX_SOFTMODE OPENPAX_XATTR_PAX_FLAGS OPENPAX_MPROTECT
+	OPENPAX_EMUTRAMP
+)
+case $arch in
+x86_64)
+	karch=x86
+	# make reads LLVM from the environment; x86 is always the gcc build.
+	unset LLVM
+	cross=()
+	opts=(
+		"${common[@]}"
+		HYPERVISOR_GUEST PARAVIRT XEN_PV XEN_PVHVM_GUEST PCI_XEN
+		XEN_PCIDEV_FRONTEND XEN_PCIDEV_BACKEND XEN_IOMMU
+		HYPERV HYPERV_VMBUS HYPERV_NET PCI_HYPERV PCI_HYPERV_INTERFACE
+	)
+	;;
+arm64)
+	karch=arm64
+	if [ -n "${LLVM:-}" ]; then
+		cross=(LLVM=1)
+	else
+		cross=(CROSS_COMPILE="${CROSS_COMPILE:-aarch64-linux-gnu-}")
+	fi
+	opts=("${common[@]}")
+	;;
+*)
+	echo "unknown arch: $arch" >&2
+	exit 2
+	;;
+esac
+
+mkdir -p "$objdir"
+mk() { make -s ARCH="$karch" "${cross[@]}" O="$objdir" "$@"; }
+
+mk defconfig
+enable=()
+for o in "${opts[@]}"; do enable+=(--enable "$o"); done
+scripts/config --file "$objdir/.config" "${enable[@]}"
+mk olddefconfig
+
+# scripts/config writes whatever it is told; olddefconfig then quietly drops
+# anything whose dependencies are not met. Catch that, or a Kconfig change
+# could switch a downstream feature off without failing the build.
+lost=()
+for o in "${opts[@]}"; do
+	grep -qx "CONFIG_$o=y" "$objdir/.config" || lost+=("$o")
+done
+if [ "${#lost[@]}" -ne 0 ]; then
+	echo "kernel-build: not enabled after olddefconfig ($arch): ${lost[*]}" >&2
+	exit 3
+fi
+
+mk -j"$jobs" vmlinux
+echo "kernel-build: $arch vmlinux built in $objdir"
diff --git a/.github/scripts/report-needs-decision.sh b/.github/scripts/report-needs-decision.sh
new file mode 100755
index 00000000000000..e15b51979fd3b7
--- /dev/null
+++ b/.github/scripts/report-needs-decision.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Decides whether the nightly rebase report asks a human for a decision.
+#
+# The upstream-rebase skill tells Claude to list anything it was unsure about
+# under a "## Needs a decision" section, each item marked UNSURE. A rebase can
+# be clean by every mechanical measure (no drift, builds pass) and still raise
+# such a question: an upstream change that interacts with a downstream feature
+# without touching the same lines. The workflow does not push those
+# automatically; it opens a pull request so a maintainer sees the question
+# before the branch moves.
+#
+# The report counts as asking for a decision when either:
+#   - its "Needs a decision" section has any content other than "None.", or
+#   - any line marks something UNSURE.
+# Both err towards a pull request: a stray "UNSURE" costs one review, a missed
+# question costs an unreviewed kernel change.
+#
+# Usage:
+#   report-needs-decision.sh <report.md>
+#
+# Prints the section's content when it asks for a decision. Exit status:
+#   0  a decision is needed
+#   1  no decision is needed
+#   2  the report cannot be read
+
+set -euo pipefail
+
+if [ $# -ne 1 ] || [ ! -r "$1" ]; then
+	echo "usage: $0 <report.md>" >&2
+	exit 2
+fi
+
+awk '
+	BEGIN { insec = 0; body = ""; unsure = 0 }
+	/UNSURE/ { unsure = 1 }
+	/^##?[ \t]/ {
+		if (tolower($0) ~ /^##?[ \t]+needs a decision[ \t]*$/) { insec = 1; next }
+		insec = 0
+	}
+	insec {
+		line = $0
+		gsub(/^[ \t]+|[ \t]+$/, "", line)
+		if (line == "") next
+		if (tolower(line) ~ /^(_?none\.?_?|n\/a\.?)$/) next
+		body = body $0 "\n"
+	}
+	END {
+		if (body != "" || unsure) { printf "%s", body; exit 0 }
+		exit 1
+	}
+' "$1"
diff --git a/.github/scripts/tests/report-needs-decision.test.sh b/.github/scripts/tests/report-needs-decision.test.sh
new file mode 100755
index 00000000000000..b2ab3547a2f1b6
--- /dev/null
+++ b/.github/scripts/tests/report-needs-decision.test.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Tests for .github/scripts/report-needs-decision.sh.
+#
+# A clean nightly rebase is force-pushed to its downstream branch unless this script says
+# Claude's report asks for a decision, so a report that does ask must never
+# read as one that does not.
+#
+# Run from anywhere: bash .github/scripts/tests/report-needs-decision.test.sh
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SCRIPT="$HERE/../report-needs-decision.sh"
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+failures=0
+expect() {
+	# expect <description> <exit-status>   (report on stdin)
+	local desc=$1 want=$2 got
+	cat >"$WORK/report.md"
+	bash "$SCRIPT" "$WORK/report.md" >/dev/null 2>&1
+	got=$?
+	if [ "$got" -eq "$want" ]; then
+		echo "ok   $desc"
+	else
+		echo "FAIL $desc: exit $got, want $want" >&2
+		failures=$((failures + 1))
+	fi
+}
+
+expect "no section, nothing unsure" 1 <<'EOF'
+## Summary
+All 221 commits replayed cleanly.
+
+## Conflicts resolved
+None.
+EOF
+
+expect "section says None." 1 <<'EOF'
+## Summary
+Clean.
+
+## Needs a decision
+None.
+
+## Conflicts resolved
+None.
+EOF
+
+expect "section empty before the next heading" 1 <<'EOF'
+## Needs a decision
+
+## Conflicts resolved
+None.
+EOF
+
+expect "section with an item" 0 <<'EOF'
+## Summary
+Clean replay.
+
+## Needs a decision
+- Upstream 0822a2e890 now reaches Arm dom0 vPCI; see below.
+
+## Conflicts resolved
+None.
+EOF
+
+expect "UNSURE outside the section" 0 <<'EOF'
+## Summary
+Clean replay.
+
+## Conflicts resolved
+- foo.c: kept downstream's lock order. **UNSURE** whether upstream intended otherwise.
+EOF
+
+expect "heading case and trailing space" 0 <<'EOF'
+## NEEDS A DECISION
+- something
+EOF
+
+expect "a level-3 heading stays inside the section" 0 <<'EOF'
+## Needs a decision
+### Arm vPCI
+- something
+## Builds
+pass
+EOF
+
+expect "a report with one UNSURE item asks for a decision" 0 <<'EOF'
+## Summary
+Rebased cleanly.
+
+## Needs a decision
+- **UNSURE: upstream `0123456789ab` ("xen/events: rework lateeoi handling") now reaches the downstream _on_node bind helpers.**
+
+## Conflicts resolved
+None.
+EOF
+
+bash "$SCRIPT" "$WORK/missing.md" >/dev/null 2>&1
+if [ $? -eq 2 ]; then echo "ok   unreadable report is an error"; else
+	echo "FAIL unreadable report is an error" >&2
+	failures=$((failures + 1))
+fi
+
+if [ "$failures" -ne 0 ]; then
+	echo "$failures failure(s)" >&2
+	exit 1
+fi
+echo "all passed"
diff --git a/.github/scripts/tests/verify-upstream-rebase.test.sh b/.github/scripts/tests/verify-upstream-rebase.test.sh
new file mode 100755
index 00000000000000..fdbdf7b5f86583
--- /dev/null
+++ b/.github/scripts/tests/verify-upstream-rebase.test.sh
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# Tests for .github/scripts/verify-upstream-rebase.sh.
+#
+# Builds a small throwaway repository with an upstream line and a downstream
+# series on it, rebases the series onto a newer upstream, and then damages
+# copies of that result in each way the checker exists to catch. The nightly
+# rebase force-pushes edera/6.18-lts on this script's say-so, so every
+# damaged copy must be refused, and every honest replay must pass.
+#
+# Run from anywhere: bash .github/scripts/tests/verify-upstream-rebase.test.sh
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SCRIPT="$HERE/../verify-upstream-rebase.sh"
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+cd "$WORK" || exit 1
+
+failures=0
+expect() {
+	# expect <description> <exit-status> <old> <new> <upstream> [<grep pattern>]
+	local desc=$1 want=$2 got out
+	out=$(bash "$SCRIPT" "$3" "$4" "$5")
+	got=$?
+	if [ "$got" -ne "$want" ]; then
+		echo "FAIL $desc: exit $got, want $want" >&2
+		printf '     %s\n' "${out//$'\n'/$'\n'     }" >&2
+		failures=$((failures + 1))
+	elif [ $# -ge 6 ] && ! grep -qF -- "$6" <<<"$out"; then
+		echo "FAIL $desc: output lacks '$6'" >&2
+		printf '     %s\n' "${out//$'\n'/$'\n'     }" >&2
+		failures=$((failures + 1))
+	else
+		echo "ok   $desc"
+	fi
+}
+
+git init -q -b upstream .
+git config user.name test
+git config user.email test@example.invalid
+commit() { git add -A && git commit -qm "$1"; }
+
+# Upstream: two files with room for both sides to edit.
+seq 1 40 >a.c
+seq 1 40 >b.c
+commit "upstream: base"
+base=$(git rev-parse HEAD)
+
+# Downstream series. Two commits share a subject, as real series do.
+git switch -q -c downstream
+sed -i 's/^10$/10 downstream/' a.c
+commit "downstream: edit a"
+sed -i 's/^30$/30 downstream/' b.c
+commit "apply dep patch"
+echo "new" >c.c
+commit "downstream: add c"
+sed -i 's/^35$/35 downstream/' b.c
+commit "apply dep patch"
+old=$(git rev-parse HEAD)
+
+# Upstream moves on in two steps. The first edits only lines far from
+# anything downstream touches; the second edits line 12, which sits inside the
+# hunk context of "downstream: edit a" (line 10) without conflicting with it.
+git switch -q upstream
+sed -i 's/^1$/1 upstream/' b.c
+commit "upstream: edit b far away"
+far=$(git rev-parse HEAD)
+sed -i 's/^12$/12 upstream/' a.c
+commit "upstream: edit a near downstream"
+up=$(git rev-parse HEAD)
+
+replay() { # replay <branch> <onto>
+	git switch -q -c "$1" "$old" && git rebase -q --onto "$2" "$base" "$1"
+}
+
+replay far "$far"
+expect "replay with untouched context passes" 0 "$old" "$(git rev-parse HEAD)" "$far" "identical patch-ids"
+expect "a no-op rebase passes" 0 "$old" "$old" "$base" "identical patch-ids"
+
+# Context moved but the commit's own lines did not: still clean.
+replay rebased "$up"
+good=$(git rev-parse HEAD)
+expect "replay with moved context passes" 0 "$old" "$good" "$up" "1 changed only in hunk context"
+
+# Damage 1: one of the two same-subject commits edited.
+git switch -q -c tamper "$good"
+# shellcheck disable=SC2016 # expanded by the shell git rebase starts
+git rebase -q --exec 'if [ "$(git log -1 --format=%s)" = "apply dep patch" ] && grep -q "35 downstream" b.c; then echo extra >>b.c; git commit -qa --amend --no-edit; fi' "$up"
+expect "edited commit with a repeated subject fails" 1 "$old" "$(git rev-parse HEAD)" "$up" "1 commit(s) lost, added, or with different +/- lines"
+
+# Damage 2: a commit dropped.
+git switch -q -c dropped "$good"
+drop=$(git log --format='%H %s' "$up..HEAD" | awk '/downstream: add c/ { print $1 }')
+git rebase -q --onto "$drop^" "$drop" dropped
+expect "dropped commit fails" 1 "$old" "$(git rev-parse HEAD)" "$up" "downstream: add c"
+
+# Damage 3: a commit added.
+git switch -q -c added "$good"
+echo "sneaky" >d.c
+commit "innocent looking"
+expect "added commit fails" 1 "$old" "$(git rev-parse HEAD)" "$up" "innocent looking"
+
+# Damage 4: not on the upstream tip.
+expect "stale base is refused" 2 "$old" "$old" "$up" "not based on the upstream tip"
+
+# Damage 5: a merge commit in the series.
+git switch -q -c merged "$good"
+git switch -q -c side "$up"
+echo side >e.c
+commit "side"
+git switch -q merged
+git merge -q --no-edit side
+expect "merge in the series is refused" 2 "$old" "$(git rev-parse HEAD)" "$up" "merge commit"
+
+# A series that merged a feature branch, as both kernel trees once did: the
+# first rebase flattens it, and that must still pass, since no commit is
+# lost and the tree moves by exactly the upstream delta.
+git switch -q -c withmerge "$old"
+git switch -q -c feature "$old~1"
+sed -i 's/^20$/20 feature/' a.c
+commit "feature: edit a"
+git switch -q withmerge
+git merge -q --no-ff --no-edit feature >/dev/null
+sed -i 's/^25$/25 after merge/' b.c
+commit "downstream: after the merge"
+mold=$(git rev-parse HEAD)
+git switch -q -c flattened "$mold"
+git rebase -q --onto "$up" "$base" flattened
+expect "flattening a merged series passes" 0 "$mold" "$(git rev-parse HEAD)" "$up" "All 6 downstream commits replayed"
+
+if [ "$failures" -ne 0 ]; then
+	echo "$failures failure(s)" >&2
+	exit 1
+fi
+echo "all passed"
diff --git a/.github/scripts/verify-upstream-rebase.sh b/.github/scripts/verify-upstream-rebase.sh
new file mode 100755
index 00000000000000..7a493aad81c0c8
--- /dev/null
+++ b/.github/scripts/verify-upstream-rebase.sh
@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# Checks a rebased downstream branch against the branch it replaces, without
+# trusting whoever did the rebase.
+#
+# The nightly upstream-rebase workflow lets a model drive the rebase, but
+# nothing it says about its own result is taken on faith. This script is the
+# gate. It proves, from git alone, that:
+#
+#   1. the new branch sits directly on the upstream tip it claims to;
+#   2. the downstream series is linear (no merge commits slipped in);
+#   3. no downstream commit was lost, added, or changed: patch-ids match, or,
+#      where they do not, the commit's own +/- lines are identical and only a
+#      hunk's context anchor moved;
+#   4. the tree changed by exactly the upstream delta and nothing else (only
+#      the +/- lines are compared, so moved hunks and blob hashes do not raise
+#      false alarms).
+#
+# A rebase that needed conflict resolution will normally fail check 4: the
+# resolution is, by definition, a change to downstream lines. That is the
+# point. Such a result is not wrong, but it is not "clean", and a human has to
+# read it before it replaces the branch.
+#
+# Usage:
+#   verify-upstream-rebase.sh <old-tip> <new-tip> <upstream-tip>
+#
+# Writes a Markdown report to stdout. Exit status:
+#   0  clean: all four checks pass
+#   1  drift: the branch is well-formed (1-2) but 3 or 4 found differences
+#   2  broken: 1 or 2 failed, or the inputs are unusable
+
+set -euo pipefail
+
+if [ $# -ne 3 ]; then
+	echo "usage: $0 <old-tip> <new-tip> <upstream-tip>" >&2
+	exit 2
+fi
+
+old=$(git rev-parse --verify "$1^{commit}")
+new=$(git rev-parse --verify "$2^{commit}")
+up=$(git rev-parse --verify "$3^{commit}")
+old_base=$(git merge-base "$old" "$up")
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+status=0
+fail() { [ "$status" -ge "$1" ] || status=$1; }
+short() { git rev-parse --short=12 "$1"; }
+changed_lines() { grep -E '^[+-]' | grep -vE '^(\+\+\+|---)' || true; }
+changed_files() { grep -E '^(\+\+\+|---) ' || true; }
+
+echo "| | |"
+echo "| --- | --- |"
+echo "| Old tip | \`$(short "$old")\` |"
+echo "| New tip | \`$(short "$new")\` |"
+echo "| Old upstream base | \`$(short "$old_base")\` |"
+echo "| New upstream base | \`$(short "$up")\` |"
+echo
+
+# 1. Base.
+if [ "$(git merge-base "$new" "$up")" = "$up" ]; then
+	echo "- [x] New branch is based on the upstream tip."
+else
+	echo "- [ ] **New branch is not based on the upstream tip** \`$(short "$up")\`."
+	fail 2
+fi
+
+# 2. Linearity.
+merges=$(git rev-list --merges "$up..$new" | wc -l)
+if [ "$merges" -eq 0 ]; then
+	echo "- [x] Downstream series is linear."
+else
+	echo "- [ ] **Downstream series contains $merges merge commit(s).**"
+	fail 2
+fi
+
+if [ "$status" -ge 2 ]; then
+	echo
+	echo "Stopped: the remaining checks assume a linear series on the upstream tip."
+	exit "$status"
+fi
+
+# 3. Commit set.
+#
+# Each commit is keyed by its subject and how many earlier commits in the
+# series share that subject, so the k-th "apply dep patch" before pairs with
+# the k-th after. A rebase keeps the series order, so this pairs every commit
+# with its own replay even when subjects repeat.
+#
+# A changed patch-id is fine when the commit's own +/- lines are unchanged and
+# only a hunk's context anchor moved, which is what happens wherever upstream
+# edited the same region. Anything else is a real difference.
+series() {
+	git log --no-merges --reverse --format='commit %H' --patch "$1" |
+		git patch-id --stable | awk '{ print $2 "\t" $1 }' >"$work/pid.map"
+	git log --no-merges --reverse --format='%H%x09%s' "$1" |
+		awk -F'\t' 'NR == FNR { pid[$1] = $2; next }
+			{ k = $2 "#" ++seen[$2]; print k "\t" $1 "\t" ($1 in pid ? pid[$1] : "-") }' \
+			"$work/pid.map" -
+}
+series "$old_base..$old" >"$work/old.series"
+series "$up..$new" >"$work/new.series"
+n_old=$(wc -l <"$work/old.series")
+n_new=$(wc -l <"$work/new.series")
+
+# key -> "old-commit new-commit verdict"; verdict is same, check, lost, added.
+awk -F'\t' 'NR == FNR { oc[$1] = $2; op[$1] = $3; order[++n] = $1; next }
+	{
+		if ($1 in oc) { print oc[$1], $2, (op[$1] == $3 ? "same" : "check"); delete oc[$1] }
+		else print "-", $2, "added"
+	}
+	END { for (i = 1; i <= n; i++) if (order[i] in oc) print oc[order[i]], "-", "lost" }' \
+	"$work/old.series" "$work/new.series" >"$work/pairs"
+
+own_change() {
+	local patch
+	patch=$(git show --format= "$1")
+	changed_files <<<"$patch"
+	changed_lines <<<"$patch"
+}
+: >"$work/moved"
+: >"$work/changed"
+while read -r c d verdict; do
+	case $verdict in
+	same) ;;
+	check)
+		if [ "$(own_change "$c")" = "$(own_change "$d")" ]; then
+			echo "$c $d" >>"$work/moved"
+		else
+			echo "$c $d" >>"$work/changed"
+		fi ;;
+	*) echo "$c $d" >>"$work/changed" ;;
+	esac
+done <"$work/pairs"
+
+if [ "$n_old" -eq "$n_new" ] && [ ! -s "$work/changed" ]; then
+	if [ -s "$work/moved" ]; then
+		echo "- [x] All $n_new downstream commits replayed;" \
+			"$(wc -l <"$work/moved") changed only in hunk context (listed below)."
+	else
+		echo "- [x] All $n_new downstream commits replayed with identical patch-ids."
+	fi
+else
+	echo "- [ ] **Downstream commit set changed:** $n_old before, $n_new after;" \
+		"$(wc -l <"$work/changed") commit(s) lost, added, or with different +/- lines."
+	fail 1
+fi
+
+# 4. Drift.
+git diff "$old..$new" >"$work/rebase.diff"
+git diff "$old_base..$up" >"$work/upstream.diff"
+changed_files <"$work/rebase.diff" >"$work/rebase.files"
+changed_files <"$work/upstream.diff" >"$work/upstream.files"
+changed_lines <"$work/rebase.diff" >"$work/rebase.lines"
+changed_lines <"$work/upstream.diff" >"$work/upstream.lines"
+
+if cmp -s "$work/rebase.files" "$work/upstream.files" &&
+	cmp -s "$work/rebase.lines" "$work/upstream.lines"; then
+	echo "- [x] Zero downstream drift: the tree changed by exactly the upstream delta."
+else
+	echo "- [ ] **Downstream drift:** the tree changed by more than the upstream delta."
+	fail 1
+fi
+
+# Details for anything that did not match.
+oneline() { if [ "$1" = - ]; then echo "(none)"; else git log -1 --format='%h %s' "$1"; fi; }
+if [ -s "$work/moved" ]; then
+	echo
+	echo "<details><summary>Commits whose hunk context moved (own +/- lines identical)</summary>"
+	echo
+	while read -r c d; do
+		echo "- \`$(oneline "$c")\` → \`$(git rev-parse --short "$d")\`"
+	done <"$work/moved"
+	echo
+	echo "</details>"
+fi
+if [ -s "$work/changed" ]; then
+	echo
+	echo "<details><summary>Commits lost, added, or whose own +/- lines changed</summary>"
+	echo
+	echo "| Before | After |"
+	echo "| --- | --- |"
+	while read -r c d; do
+		echo "| \`$(oneline "$c")\` | \`$(oneline "$d")\` |"
+	done <"$work/changed"
+	echo
+	echo "</details>"
+fi
+
+if ! cmp -s "$work/rebase.lines" "$work/upstream.lines" ||
+	! cmp -s "$work/rebase.files" "$work/upstream.files"; then
+	echo
+	echo "<details><summary>Drift (changed lines: upstream delta vs. actual change)</summary>"
+	echo
+	echo '```diff'
+	{
+		diff -u --label upstream-files --label actual-files \
+			"$work/upstream.files" "$work/rebase.files" || true
+		diff -u --label upstream-lines --label actual-lines \
+			"$work/upstream.lines" "$work/rebase.lines" || true
+	} | head -n 400
+	echo '```'
+	echo
+	echo "</details>"
+fi
+
+exit "$status"
diff --git a/.github/workflows/automation-selftest.yml b/.github/workflows/automation-selftest.yml
new file mode 100644
index 00000000000000..b3cf554a636931
--- /dev/null
+++ b/.github/workflows/automation-selftest.yml
@@ -0,0 +1,60 @@
+name: Automation self-test
+
+# Tests the scripts the nightly rebase relies on to decide whether to
+# force-push edera/6.18-lts, so a change that weakens either must not land
+# quietly:
+#
+#   - verify-upstream-rebase.sh: honest replays pass, including one that
+#     flattens a merged series; edited, dropped, added and merged commits and
+#     a stale base are all refused;
+#   - report-needs-decision.sh: any question in Claude's report, or anything
+#     marked UNSURE, stops the automatic push.
+#
+# It runs only when the automation itself changes.
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review]
+    branches: ['edera/**']
+    paths:
+      - '.github/scripts/**'
+      - '.github/workflows/upstream-rebase.yml'
+      - '.github/workflows/kernel-nightly.yml'
+      - '.github/workflows/rebase-land.yml'
+      - '.github/workflows/automation-selftest.yml'
+      - '.automation/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: automation-selftest-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  selftest:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      # Only the automation is needed, not the kernel.
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github
+            .automation
+
+      - name: Rebase checker tests
+        run: bash .github/scripts/tests/verify-upstream-rebase.test.sh
+
+      - name: Decision detector tests
+        run: bash .github/scripts/tests/report-needs-decision.test.sh
+
+      - name: Shellcheck
+        run: shellcheck .github/scripts/*.sh .github/scripts/tests/*.sh
diff --git a/.github/workflows/kernel-nightly.yml b/.github/workflows/kernel-nightly.yml
new file mode 100644
index 00000000000000..f06f0c17c61c17
--- /dev/null
+++ b/.github/workflows/kernel-nightly.yml
@@ -0,0 +1,60 @@
+name: Nightly kernel maintenance
+
+# Rebases edera/6.18-lts onto stable linux-6.18.y every night
+# (upstream-rebase.yml).
+#
+# Claude does the rebase. Independent checks decide whether the result is
+# pushed or proposed as a pull request; see upstream-rebase.yml.
+#
+# GitHub runs scheduled workflows only from the default branch, edera/mainline,
+# so this copy has no schedule of its own. lts-rebase-trigger.yml on
+# edera/mainline dispatches it nightly; this file and the one on
+# edera/mainline share a path, which is how that dispatch finds this copy.
+#
+# Repository configuration this needs:
+#   vars.REBASE_APP_CLIENT_ID, secrets.REBASE_APP_PRIVATE_KEY
+#       A GitHub App installed on this repository with contents, pull requests
+#       and workflows write, allowed to bypass the protection rules on
+#       edera/6.18-lts. GITHUB_TOKEN cannot do this job: it cannot push
+#       commits that touch .github/workflows/ (every rebase rewrites the ones
+#       that add them), and pull requests it opens do not trigger other
+#       workflows.
+#   vars.REBASE_FEDERATION_RULE_ID
+#       The workload identity federation rule for the rebase. It must accept
+#       this workflow's OIDC subject (a dispatched run on edera/6.18-lts).
+#   vars.ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID,
+#   ANTHROPIC_WORKSPACE_ID
+#       The rest of the Claude API federation identity.
+
+on:
+  workflow_dispatch:
+    inputs:
+      force:
+        description: Rebase even if an open rebase pull request already covers this upstream tip
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  # Per tree: groups are repository-wide, and edera/mainline's copy of this
+  # workflow uses plain kernel-nightly.
+  group: kernel-nightly-edera/6.18-lts
+  cancel-in-progress: false
+
+jobs:
+  lts:
+    uses: ./.github/workflows/upstream-rebase.yml
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: write
+      id-token: write
+    with:
+      downstream: edera/6.18-lts
+      key: 6.18-lts
+      upstream_url: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+      upstream_branch: linux-6.18.y
+      force: ${{ inputs.force == true }}
+    secrets: inherit
diff --git a/.github/workflows/rebase-land.yml b/.github/workflows/rebase-land.yml
new file mode 100644
index 00000000000000..87eeda680ae715
--- /dev/null
+++ b/.github/workflows/rebase-land.yml
@@ -0,0 +1,130 @@
+name: Land upstream rebase
+
+# Lands a nightly rebase that needed review (see upstream-rebase.yml) once a
+# maintainer approves its pull request.
+#
+# A rebase replaces the tree rather than merging into it, so the merge button
+# is the wrong tool: it would graft a second copy of the whole series onto the
+# old one. Approving instead force-pushes the tree to the exact commit that
+# was approved, and GitHub then marks the pull request merged.
+#
+# A review runs this workflow from the pull request's merge ref, which is why
+# it lives on edera/6.18-lts. edera/mainline carries its own copy for its
+# own rebases.
+#
+# What has to hold before anything is pushed:
+#   - the pull request is a rebase/edera-6.18-lts/... branch from this
+#     repository, targeting edera/6.18-lts;
+#   - the review approved the current head, not an earlier one;
+#   - the approver has write access;
+#   - the tree is still the tip the branch was made from. The branch name
+#     records that tip, and branch names cannot be edited on an open pull
+#     request, so this is not something the pull request body can change. If
+#     the tree moved, nothing is pushed; the next nightly run starts from the
+#     new tip.
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+
+concurrency:
+  # Shared with the nightly's publish jobs, so nothing else moves the tree
+  # while this runs.
+  group: push-${{ github.event.pull_request.base.ref }}
+  cancel-in-progress: false
+
+jobs:
+  land:
+    if: >-
+      github.event.review.state == 'approved'
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && github.event.pull_request.base.ref == 'edera/6.18-lts'
+      && startsWith(github.event.pull_request.head.ref, 'rebase/edera-6.18-lts/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: App token
+        id: app
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.REBASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REBASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
+
+      - name: Land
+        env:
+          APP_TOKEN: ${{ steps.app.outputs.token }}
+          JOB_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          BASE: ${{ github.event.pull_request.base.ref }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REVIEWED_SHA: ${{ github.event.review.commit_id }}
+          APPROVER: ${{ github.event.review.user.login }}
+        run: |
+          set -euo pipefail
+          say() {
+            GH_TOKEN=$JOB_TOKEN gh pr comment "$PR" --repo "$GITHUB_REPOSITORY" --body "$1"
+          }
+
+          if [ "$REVIEWED_SHA" != "$HEAD_SHA" ]; then
+            say "Not landed: the approval was for \`${REVIEWED_SHA:0:12}\`, but the head is now \`${HEAD_SHA:0:12}\`. Approve the current head to land it."
+            exit 1
+          fi
+
+          perm=$(GH_TOKEN=$JOB_TOKEN gh api "repos/$GITHUB_REPOSITORY/collaborators/$APPROVER/permission" -q .permission)
+          case $perm in
+            admin|maintain|write) ;;
+            *)
+              say "Not landed: @$APPROVER does not have write access, so their approval cannot land a rebase."
+              exit 1 ;;
+          esac
+
+          # Name: rebase/<tree>/<date>-<old tree tip 12>-<upstream tip 12>.
+          rest=${HEAD_REF#"rebase/${BASE//\//-}/"}
+          IFS=- read -r _date old12 up12 extra <<<"$rest"
+          if [ -n "${extra:-}" ] || ! [[ $old12 =~ ^[0-9a-f]{12}$ && $up12 =~ ^[0-9a-f]{12}$ ]]; then
+            say "Not landed: \`$HEAD_REF\` is not a branch the nightly automation made."
+            exit 1
+          fi
+
+          origin="https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          cur=$(git ls-remote "$origin" "refs/heads/$BASE" | cut -f1)
+          if [ "${cur:0:12}" != "$old12" ]; then
+            say "Not landed: \`$BASE\` has moved to \`${cur:0:12}\` since this branch was made from \`$old12\`. Tonight's run starts from the new tip; this pull request will be closed as superseded."
+            exit 1
+          fi
+
+          # Both commits are already on GitHub, so this needs neither the
+          # kernel's history nor its files, only the two commit objects to
+          # name in the push.
+          git init -q work && cd work
+          git fetch -q --no-tags --depth=1 --filter=tree:0 "$origin" "$HEAD_SHA" "$cur"
+
+          # Created through the API, and before the tree moves: a push from
+          # this shallow clone is refused once the old tip is unreferenced.
+          backup="backup/${BASE//\//-}-pre-rebase-$(date -u +%Y%m%d)-$old12"
+          GH_TOKEN=$APP_TOKEN gh api -X POST "repos/$GITHUB_REPOSITORY/git/refs" \
+            -f ref="refs/heads/$backup" -f sha="$cur" >/dev/null
+
+          git push --force-with-lease="refs/heads/$BASE:$cur" "$origin" "$HEAD_SHA:refs/heads/$BASE"
+          now=$(git ls-remote "$origin" "refs/heads/$BASE" | cut -f1)
+          if [ "$now" != "$HEAD_SHA" ]; then
+            say "Push reported success but \`$BASE\` is \`${now:0:12}\`, not \`${HEAD_SHA:0:12}\`. Check the run log."
+            exit 1
+          fi
+          say "Landed by @$APPROVER's approval: \`$BASE\` is now \`${HEAD_SHA:0:12}\` (was \`${cur:0:12}\`, kept as \`$backup\`)."
+          git push "$origin" --delete "$HEAD_REF" || true
diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml
new file mode 100644
index 00000000000000..7b8620fb30878c
--- /dev/null
+++ b/.github/workflows/upstream-rebase.yml
@@ -0,0 +1,665 @@
+name: Upstream rebase
+
+# Rebases an Edera kernel integration tree onto its upstream. Called nightly
+# by kernel-nightly.yml for edera/6.18-lts, onto stable linux-6.18.y.
+#
+# Claude does the rebase, following .automation/skills/upstream-rebase/
+# SKILL.md: it replays the series, resolves conflicts, fixes what the replay
+# broke, builds, audits upstream fixes that meet the series, and writes a
+# report.
+#
+# Nothing Claude says about its own result decides what happens to it. The
+# model runs in a job that holds a read-only token and cannot push. Its branch
+# leaves that job as a git bundle, and two things then judge it
+# independently, with scripts taken from the commit this run started from
+# (the default branch), never from the tree under test:
+#
+#   - verify-upstream-rebase.sh proves the series sits on the upstream tip, is
+#     linear, lost or gained no commit, and changed the tree by exactly the
+#     upstream delta;
+#   - kernel-build.sh builds x86_64 and arm64 vmlinux with every downstream
+#     feature built in.
+#
+# If both pass and Claude's report asks for no decision
+# (report-needs-decision.sh), the tree is force-pushed to the result, pinned
+# by lease to the tip the rebase started from, with the old tip kept as a
+# backup branch. Otherwise, or if that push is refused, the result goes up as
+# a rebase/<tree>/... branch with a pull request carrying Claude's report;
+# approving that pull request lands it (rebase-land.yml). A night where
+# Claude could not produce a branch at all opens an issue instead.
+#
+# Nights with nothing new upstream stop in the first job and never start the
+# model.
+#
+# Every job clones with --filter=blob:none: the kernel's full history with
+# blobs is several gigabytes, and the jobs need the commit graph but only the
+# contents of the files the series and the upstream delta touch.
+
+on:
+  workflow_call:
+    inputs:
+      downstream:
+        description: The tree to rebase, e.g. edera/6.18-lts
+        type: string
+        required: true
+      key:
+        description: A short name for the tree, unique per run, for artifact names
+        type: string
+        required: true
+      upstream_url:
+        type: string
+        required: true
+      upstream_branch:
+        type: string
+        required: true
+      force:
+        description: Rebase even if an open rebase pull request already covers this upstream tip
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+env:
+  DOWNSTREAM: ${{ inputs.downstream }}
+  UPSTREAM_URL: ${{ inputs.upstream_url }}
+  UPSTREAM_BRANCH: ${{ inputs.upstream_branch }}
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      run: ${{ steps.plan.outputs.run }}
+      old: ${{ steps.plan.outputs.old }}
+      up: ${{ steps.plan.outputs.up }}
+      prefix: ${{ steps.plan.outputs.prefix }}
+      candidate: ${{ steps.plan.outputs.candidate }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.DOWNSTREAM }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Decide whether tonight has work
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          FORCE: ${{ inputs.force }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          old=$(git rev-parse HEAD)
+          up=$(git rev-parse FETCH_HEAD)
+          prefix="rebase/${DOWNSTREAM//\//-}/"
+          candidate="${prefix}$(date -u +%Y%m%d)-${old:0:12}-${up:0:12}"
+          {
+            echo "old=$old"
+            echo "up=$up"
+            echo "prefix=$prefix"
+            echo "candidate=$candidate"
+          } >> "$GITHUB_OUTPUT"
+
+          skip() {
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "### Upstream rebase of \`$DOWNSTREAM\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "$1" >> "$GITHUB_STEP_SUMMARY"
+          }
+
+          if git merge-base --is-ancestor "$up" "$old"; then
+            skip "Nothing to do: \`$DOWNSTREAM\` (\`${old:0:12}\`) already contains \`$UPSTREAM_BRANCH\` (\`${up:0:12}\`)."
+            exit 0
+          fi
+
+          # The candidate name records both tips, so an open pull request for
+          # the same pair means last night's result is still awaiting review.
+          if [ "$FORCE" != "true" ]; then
+            pending=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --base "$DOWNSTREAM" \
+              --json headRefName,url \
+              -q ".[] | select(.headRefName | startswith(\"$prefix\") and endswith(\"-${old:0:12}-${up:0:12}\")) | .url")
+            if [ -n "$pending" ]; then
+              skip "A rebase of these exact tips is already awaiting review: $pending"
+              exit 0
+            fi
+          fi
+          echo "run=true" >> "$GITHUB_OUTPUT"
+
+  rebase:
+    needs: prepare
+    if: needs.prepare.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 330
+    # Read-only on purpose: the model runs here. It reaches the Claude API
+    # through OIDC federation, and that is the only thing id-token is for.
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      produced: ${{ steps.collect.outputs.produced }}
+      result: ${{ steps.collect.outputs.result }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      # The skill and scripts come from the commit this run started from,
+      # never from the tree under test. The kernel's .gitignore ignores
+      # dot-directories, so .rebase-tools/ cannot end up in a commit.
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir .rebase-tools
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C .rebase-tools --strip-components=1
+
+      - name: Fetch upstream
+        env:
+          UP: ${{ needs.prepare.outputs.up }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          git merge-base --is-ancestor "$UP" FETCH_HEAD
+          git branch upstream-target "$UP"
+          # The rebase commits; this identity is what the committer field shows.
+          git config --global user.name "edera-upstream-rebase"
+          git config --global user.email "noreply@edera.dev"
+
+      - name: Install toolchains
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential bc bison flex libelf-dev libssl-dev python3 \
+            gcc-aarch64-linux-gnu
+
+      - name: Normalize identifiers
+        id: ids
+        env:
+          RULE: ${{ vars.REBASE_FEDERATION_RULE_ID }}
+          ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+        run: |
+          set -euo pipefail
+          strip() { printf '%s' "$1" | tr -d '[:space:]'; }
+          {
+            echo "rule=$(strip "$RULE")"
+            echo "org=$(strip "$ORG")"
+            echo "svc=$(strip "$SVC")"
+            echo "ws=$(strip "$WS")"
+          } >> "$GITHUB_OUTPUT"
+          # An unset variable otherwise surfaces as an opaque API failure a
+          # second into the model step, with nothing in the log to say why.
+          missing=0
+          for n in REBASE_FEDERATION_RULE_ID:RULE ANTHROPIC_ORGANIZATION_ID:ORG ANTHROPIC_SERVICE_ACCOUNT_ID:SVC ANTHROPIC_WORKSPACE_ID:WS; do
+            eval "v=\$${n#*:}"
+            if [ -z "$(strip "$v")" ]; then
+              echo "::error::vars.${n%%:*} is empty or not visible to this repository."
+              missing=1
+            fi
+          done
+          exit "$missing"
+
+      - name: Rebase
+        id: claude
+        continue-on-error: true
+        uses: anthropics/claude-code-action@6fed3ca145920b639991cb756090506e1bcaf515 # v1.0.245
+        with:
+          # The job token, which is read-only here. Without it the action
+          # would exchange OIDC for its own app token, which can write.
+          github_token: ${{ github.token }}
+          anthropic_federation_rule_id: '${{ steps.ids.outputs.rule }}'
+          anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
+          anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
+          anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          prompt: |
+            Rebase the downstream kernel series onto upstream by following
+            .rebase-tools/skills/upstream-rebase/SKILL.md exactly. Read it in
+            full before you start.
+
+            DOWNSTREAM=${{ env.DOWNSTREAM }}
+            OLD_TIP=${{ needs.prepare.outputs.old }}   (${{ env.DOWNSTREAM }}, checked out)
+            UPSTREAM=${{ needs.prepare.outputs.up }}   (${{ env.UPSTREAM_BRANCH }}, local branch upstream-target)
+            RESULT=rebase-result
+            REPORT=${{ runner.temp }}/rebase-report.md
+
+            You cannot push and must not try. The workflow verifies and
+            builds your branch independently afterwards and decides what
+            happens to it.
+          claude_args: |
+            --model claude-opus-5-5
+            --max-turns 400
+            --allowedTools "Read,Grep,Glob,Edit,Write,Bash(git:*),Bash(make:*),Bash(bash .rebase-tools/scripts/verify-upstream-rebase.sh:*),Bash(bash .rebase-tools/scripts/kernel-build.sh:*),Bash(scripts/config:*),Bash(mkdir -p .rebase-scratch:*),Bash(diff:*),Bash(comm:*),Bash(sort:*),Bash(grep:*),Bash(sed:*),Bash(awk:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*),Bash(ls:*),Bash(cut:*),Bash(tee:*)"
+
+      # Take only what Claude left in git and the report file. A branch that
+      # does not exist or does not sit on the upstream tip is a failed night.
+      - name: Collect the result
+        id: collect
+        if: always()
+        env:
+          REPORT: ${{ runner.temp }}/rebase-report.md
+          UP: ${{ needs.prepare.outputs.up }}
+          OUTCOME: ${{ steps.claude.outcome }}
+          EXECUTION_FILE: ${{ steps.claude.outputs.execution_file }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          if [ -s "$REPORT" ]; then
+            cp "$REPORT" "$out/report.md"
+          else
+            # The action hides the session to keep tool output out of a
+            # public log, which also hides why a run ended early. Take only
+            # the API error messages and the final result text from it:
+            # neither carries tool output.
+            why=
+            f=${EXECUTION_FILE:-$RUNNER_TEMP/claude-execution-output.json}
+            if [ -s "$f" ]; then
+              why=$(jq -r '
+                (if type == "array" then .[] else . end)
+                | if .type == "assistant" and (.error != null) then
+                    "API error (\(.error)): " + ([.message.content[]? | .text? // empty] | join(" "))
+                  elif .type == "result" then
+                    ([.result // empty] + (.errors // [] | map(tostring))) | join("\n")
+                  else empty end' "$f" 2>/dev/null | head -c 2000 || true)
+            fi
+            {
+              printf 'Claude left no report (rebase step: %s).\n' "$OUTCOME"
+              if [ -n "$why" ]; then
+                # shellcheck disable=SC2016 # a literal Markdown fence
+                printf '\n```\n%s\n```\n' "$why"
+              else
+                printf 'The run log has the cause.\n'
+              fi
+            } >"$out/report.md"
+            [ -z "$why" ] || echo "::error::Claude ended without a result: ${why//$'\n'/ }"
+          fi
+          if git rev-parse --verify -q refs/heads/rebase-result >/dev/null \
+             && git merge-base --is-ancestor "$UP" rebase-result \
+             && [ "$(git rev-parse rebase-result)" != "$UP" ]; then
+            git bundle create "$out/rebase.bundle" refs/heads/rebase-result "^$UP"
+            echo "produced=true" >> "$GITHUB_OUTPUT"
+            echo "result=$(git rev-parse rebase-result)" >> "$GITHUB_OUTPUT"
+          else
+            echo "produced=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: rebase-${{ inputs.key }}
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  verify:
+    needs: [prepare, rebase]
+    if: needs.rebase.outputs.produced == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    outputs:
+      status: ${{ steps.check.outputs.status }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      # The checker comes from the commit this run started from, never from
+      # the branch under test.
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rebase-${{ inputs.key }}
+          path: ${{ runner.temp }}/in
+
+      - name: Check
+        id: check
+        env:
+          OLD: ${{ needs.prepare.outputs.old }}
+          UP: ${{ needs.prepare.outputs.up }}
+          RESULT: ${{ needs.rebase.outputs.result }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          git merge-base --is-ancestor "$UP" FETCH_HEAD
+          git fetch "$RUNNER_TEMP/in/rebase.bundle" rebase-result:rebase-result
+          [ "$(git rev-parse rebase-result)" = "$RESULT" ] || { echo "bundle does not hold $RESULT"; exit 1; }
+          # Actions runs this step under bash -e, so a bare call would end the
+          # step on the checker's first non-zero exit, before its verdict is
+          # recorded: drift would then reach the pull request as "the checker
+          # did not run". Capture the status instead.
+          rc=0
+          bash "$RUNNER_TEMP/tools/scripts/verify-upstream-rebase.sh" "$OLD" "$RESULT" "$UP" >"$RUNNER_TEMP/verify.md" || rc=$?
+          case $rc in
+            0) status=clean ;;
+            1) status=drift ;;
+            *) status=broken ;;
+          esac
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          cat "$RUNNER_TEMP/verify.md" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: verify-${{ inputs.key }}
+          path: ${{ runner.temp }}/verify.md
+          retention-days: 30
+
+  build:
+    needs: [prepare, rebase]
+    if: needs.rebase.outputs.produced == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x86_64, arm64]
+    name: build (${{ matrix.arch }})
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rebase-${{ inputs.key }}
+          path: ${{ runner.temp }}/in
+
+      - name: Check out the result
+        env:
+          UP: ${{ needs.prepare.outputs.up }}
+          RESULT: ${{ needs.rebase.outputs.result }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          git merge-base --is-ancestor "$UP" FETCH_HEAD
+          git fetch "$RUNNER_TEMP/in/rebase.bundle" rebase-result:rebase-result
+          git checkout --detach "$RESULT"
+
+      - name: Install toolchains
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential bc bison flex libelf-dev libssl-dev python3 \
+            gcc-aarch64-linux-gnu
+
+      - name: Build
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: bash "$RUNNER_TEMP/tools/scripts/kernel-build.sh" "$ARCH" "$RUNNER_TEMP/obj"
+
+  publish:
+    needs: [prepare, rebase, verify, build]
+    if: always() && needs.prepare.outputs.run == 'true' && needs.rebase.result != 'cancelled'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    concurrency:
+      group: push-${{ inputs.downstream }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download the rebase
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rebase-${{ inputs.key }}
+          path: ${{ runner.temp }}/in/rebase
+
+      # Absent when Claude produced no branch and the checker never ran.
+      - name: Download the checker report
+        if: needs.verify.result == 'success'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: verify-${{ inputs.key }}
+          path: ${{ runner.temp }}/in/verify
+
+      - name: App token
+        id: app
+        if: needs.rebase.outputs.produced == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.REBASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REBASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
+
+      - name: Push or propose
+        env:
+          APP_TOKEN: ${{ steps.app.outputs.token }}
+          JOB_TOKEN: ${{ github.token }}
+          PRODUCED: ${{ needs.rebase.outputs.produced }}
+          VERIFY: ${{ needs.verify.outputs.status }}
+          BUILD: ${{ needs.build.result }}
+          OLD: ${{ needs.prepare.outputs.old }}
+          UP: ${{ needs.prepare.outputs.up }}
+          RESULT: ${{ needs.rebase.outputs.result }}
+          PREFIX: ${{ needs.prepare.outputs.prefix }}
+          CANDIDATE: ${{ needs.prepare.outputs.candidate }}
+          KEY: ${{ inputs.key }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          in=$RUNNER_TEMP/in
+          report=$in/rebase/report.md
+          verify=$in/verify/verify.md
+          summary() { cat >> "$GITHUB_STEP_SUMMARY"; }
+          title="Nightly upstream rebase of $DOWNSTREAM failed"
+
+          # One issue per tree that stays open until someone deals with it,
+          # rather than one per night.
+          report_issue() {
+            existing=$(GH_TOKEN=$JOB_TOKEN gh issue list --repo "$GITHUB_REPOSITORY" --state open \
+              --search "in:title \"$title\"" --json number -q '.[0].number // empty')
+            if [ -n "$existing" ]; then
+              GH_TOKEN=$JOB_TOKEN gh issue comment "$existing" --repo "$GITHUB_REPOSITORY" --body-file "$1"
+            else
+              GH_TOKEN=$JOB_TOKEN gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$1"
+            fi
+          }
+
+          if [ "$PRODUCED" != "true" ]; then
+            body=$RUNNER_TEMP/issue.md
+            {
+              echo "Claude could not produce a rebase of \`$DOWNSTREAM\` (\`${OLD:0:12}\`) onto \`$UPSTREAM_BRANCH\` (\`${UP:0:12}\`). [Run log]($RUN_URL)."
+              echo
+              cat "$report"
+            } | head -c 60000 >"$body"
+            report_issue "$body"
+            echo "No branch produced; reported in an issue." | summary
+            exit 1
+          fi
+
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          git merge-base --is-ancestor "$UP" FETCH_HEAD
+          git fetch "$in/rebase/rebase.bundle" rebase-result:rebase-result
+          [ "$(git rev-parse rebase-result)" = "$RESULT" ]
+
+          # Workflows triggered by a pull request, including the land workflow,
+          # run that branch's own copy of .github/ with this repository's
+          # secrets. So the automation paths must change by exactly what
+          # upstream changed there, or the branch never leaves this job: not
+          # as the tree and not as a pull request.
+          mb=$(git merge-base "$OLD" "$UP")
+          guarded=(.github .automation)
+          lines() { git diff "$@" -- "${guarded[@]}" | grep -E '^([+-]|diff )' || true; }
+          if [ "$(lines "$OLD" "$RESULT")" != "$(lines "$mb" "$UP")" ]; then
+            body=$RUNNER_TEMP/issue.md
+            {
+              echo "**Refused to publish** the rebase of \`$DOWNSTREAM\` (\`${OLD:0:12}\`) onto \`$UPSTREAM_BRANCH\` (\`${UP:0:12}\`): it changes \`${guarded[*]}\` beyond what upstream changed there. Those paths run with repository secrets, so the branch was not pushed anywhere. It is in the run's \`rebase-${KEY}\` artifact. [Run log]($RUN_URL)."
+              echo
+              echo '```diff'
+              git diff --stat "$OLD" "$RESULT" -- "${guarded[@]}"
+              echo '```'
+            } >"$body"
+            report_issue "$body"
+            echo "::error::Rebase changes automation paths beyond the upstream delta; not published."
+            exit 1
+          fi
+
+          origin="https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          export GH_TOKEN=$APP_TOKEN
+
+          close_superseded() {
+            gh pr list --repo "$GITHUB_REPOSITORY" --state open --base "$DOWNSTREAM" \
+              --json number,headRefName \
+              -q ".[] | select(.headRefName | startswith(\"$PREFIX\")) | select(.headRefName != \"$CANDIDATE\") | .number" |
+            while read -r n; do
+              gh pr close "$n" --repo "$GITHUB_REPOSITORY" --delete-branch \
+                --comment "Superseded by $1."
+            done
+          }
+
+          # Reasons a human has to look before the tree moves. The checker
+          # and the builds judge the branch; the report can still raise a
+          # question they cannot see, such as an upstream change that meets a
+          # downstream feature without touching the same lines.
+          why=()
+          [ "$VERIFY" = "clean" ] || why+=("the checker found ${VERIFY:-no result (it did not run)}")
+          [ "$BUILD" = "success" ] || why+=("a build ${BUILD}")
+          drc=0
+          bash "$RUNNER_TEMP/tools/scripts/report-needs-decision.sh" "$report" >/dev/null || drc=$?
+          case $drc in
+            0) why+=("Claude's report asks for a decision") ;;
+            1) ;;
+            *) why+=("Claude's report could not be read") ;;
+          esac
+
+          if [ "${#why[@]}" -eq 0 ]; then
+            backup="backup/${DOWNSTREAM//\//-}-pre-rebase-$(date -u +%Y%m%d)-${OLD:0:12}"
+            git push "$origin" "$OLD:refs/heads/$backup"
+            # The lease pins the tip this rebase started from: if anything
+            # landed on the tree since, the push fails and nothing is lost.
+            if git push --force-with-lease="refs/heads/$DOWNSTREAM:$OLD" "$origin" \
+                 "$RESULT:refs/heads/$DOWNSTREAM" 2>"$RUNNER_TEMP/push.err"; then
+              cat "$RUNNER_TEMP/push.err" >&2
+              now=$(git ls-remote "$origin" "refs/heads/$DOWNSTREAM" | cut -f1)
+              [ "$now" = "$RESULT" ] || { echo "::error::$DOWNSTREAM is $now after the push, expected $RESULT"; exit 1; }
+              close_superseded "the clean rebase pushed to \`$DOWNSTREAM\` as \`${RESULT:0:12}\`"
+              {
+                echo "### Pushed \`$DOWNSTREAM\` → \`${RESULT:0:12}\`"
+                echo "Was \`${OLD:0:12}\`, kept as \`$backup\`."
+                echo
+                cat "$verify"
+                echo
+                cat "$report"
+              } | summary
+              exit 0
+            fi
+            # Refused: a branch rule, or the tree moved under the lease. A
+            # clean result is still worth a reviewer's approval, so propose
+            # it rather than drop it; the land workflow re-checks the tip.
+            cat "$RUNNER_TEMP/push.err" >&2
+            reason=$(grep -m1 -E 'GH0[0-9]+|\[(remote )?rejected\]|error:' "$RUNNER_TEMP/push.err" |
+              sed -E 's/^remote: *//; s/^[[:space:]]+//; s/[[:space:]]+$//' || true)
+            why+=("the push to \`$DOWNSTREAM\` was refused${reason:+ (\`$reason\`)}")
+            git push "$origin" --delete "$backup" || true
+          fi
+
+          # Not pushed: propose it.
+          git push "$origin" "$RESULT:refs/heads/$CANDIDATE"
+          because=$(IFS=';'; echo "${why[*]}")
+          because=${because//;/ and }
+          body=$RUNNER_TEMP/pr.md
+          {
+            echo "Nightly rebase of \`$DOWNSTREAM\` (\`${OLD:0:12}\`) onto \`$UPSTREAM_BRANCH\` (\`${UP:0:12}\`), driven by Claude. **Not pushed automatically because ${because}.** [Run log]($RUN_URL)."
+            echo
+            echo "> [!IMPORTANT]"
+            echo "> Do not use the merge button: this branch replaces \`$DOWNSTREAM\` rather than merging into it. **Approve** the pull request to land it; the land workflow force-pushes \`$DOWNSTREAM\` to the approved head, pinned to \`${OLD:0:12}\`, and keeps a backup."
+            echo
+            echo "## Independent checks"
+            echo
+            echo "Builds: **${BUILD}** (x86_64 and arm64 vmlinux with the Edera features built in; per-build results in the run)."
+            echo
+            if [ -s "$verify" ]; then cat "$verify"; else echo "The checker did not run."; fi
+            echo
+            echo "# Claude's report"
+            echo
+            cat "$report"
+          } >"$body"
+          if [ "$(wc -c <"$body")" -gt 60000 ]; then
+            head -c 59000 "$body" >"$body.cut"
+            printf '\n\n_Truncated; the full report is in the run artifacts._\n' >>"$body.cut"
+            mv "$body.cut" "$body"
+          fi
+          url=$(gh pr create --repo "$GITHUB_REPOSITORY" --base "$DOWNSTREAM" --head "$CANDIDATE" \
+            --title "Rebase $DOWNSTREAM onto $UPSTREAM_BRANCH @ ${UP:0:12}" --body-file "$body")
+          close_superseded "$url"
+          echo "### Proposed: $url" | summary

From ef0766360ffe105d2b6f84b9f785db3e88ba6a73 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 9 Oct 2026 13:45:48 -0700
Subject: [PATCH 1952/1982] automation: propose a 6.18-lts backport for each
 merged mainline PR

Every pull request merged into edera/mainline flows down to
edera/6.18-lts as its own backport pull request, unless it is labelled
no-backport. lts-backport-trigger.yml on edera/mainline dispatches
kernel-nightly.yml here with backport_pr=<N>, which runs
lts-backport.yml:

- prepare works out which of the pull request's commits the LTS tree
  still lacks (pending-backports.sh, backport-blockers.sh), and holds it
  back with a backport-waiting label while an earlier pending Edera
  commit touches the same files, so interdependent patches land in
  mainline order;
- Claude cherry-picks the commits with -x, adapting them to 6.18 where
  needed, following .automation/skills/mainline-backport/SKILL.md, and
  can also declare a dependency a file match cannot see;
- verify-backport.sh and x86_64/arm64 builds judge the result;
- publish always opens (or refreshes) backport/edera-6.18-lts/pr-<N>,
  never pushes edera/6.18-lts, and keeps one status comment on the
  mainline pull request.

Waiting backports are retried when a backport merges here
(lts-backport-merged.yml) and after each nightly rebase, which also
re-prepares open backport pull requests the rebase made unmergeable
(retry-backports.sh). A backport whose base was rebased away while it
ran dispatches itself again.
---
 .automation/backport-skip                     |  11 +
 .automation/skills/mainline-backport/SKILL.md | 206 +++++
 .github/scripts/backport-blockers.sh          |  92 +++
 .github/scripts/pending-backports.sh          |  80 ++
 .github/scripts/retry-backports.sh            |  35 +
 .github/scripts/tests/backport.test.sh        | 225 ++++++
 .github/scripts/verify-backport.sh            | 177 +++++
 .github/workflows/automation-selftest.yml     |  14 +-
 .github/workflows/kernel-nightly.yml          |  66 +-
 .github/workflows/lts-backport-merged.yml     |  45 ++
 .github/workflows/lts-backport.yml            | 722 ++++++++++++++++++
 11 files changed, 1664 insertions(+), 9 deletions(-)
 create mode 100644 .automation/backport-skip
 create mode 100644 .automation/skills/mainline-backport/SKILL.md
 create mode 100755 .github/scripts/backport-blockers.sh
 create mode 100755 .github/scripts/pending-backports.sh
 create mode 100755 .github/scripts/retry-backports.sh
 create mode 100755 .github/scripts/tests/backport.test.sh
 create mode 100755 .github/scripts/verify-backport.sh
 create mode 100644 .github/workflows/lts-backport-merged.yml
 create mode 100644 .github/workflows/lts-backport.yml

diff --git a/.automation/backport-skip b/.automation/backport-skip
new file mode 100644
index 00000000000000..45f4777c562617
--- /dev/null
+++ b/.automation/backport-skip
@@ -0,0 +1,11 @@
+# Edera commits on edera/mainline that must never be backported to
+# edera/6.18-lts, one subject per line, exactly as the commit has it.
+#
+# Each pull request merged into edera/mainline is backported on its own
+# (.github/workflows/lts-backport.yml); label it no-backport to opt out. This
+# file is for commits that did not arrive through such a pull request, or
+# were ported to 6.18 in a form the subject match cannot see. A commit that
+# is listed here, or belongs to a no-backport pull request, does not hold up
+# later backports that touch the same files.
+#
+# Blank lines and lines starting with # are ignored.
diff --git a/.automation/skills/mainline-backport/SKILL.md b/.automation/skills/mainline-backport/SKILL.md
new file mode 100644
index 00000000000000..fe1d9506994b16
--- /dev/null
+++ b/.automation/skills/mainline-backport/SKILL.md
@@ -0,0 +1,206 @@
+---
+name: mainline-backport
+description: Backport of one merged edera/mainline pull request to edera/6.18-lts, run unattended in CI by .github/workflows/lts-backport.yml. Covers the cherry-picks, adapting a commit to the older kernel, spotting a dependency on another backport, build checks, and the report that becomes the backport pull request.
+---
+
+# Mainline pull request backport
+
+Edera kernel work lands on `edera/mainline` first, one pull request at a time,
+and every merged pull request is proposed for `edera/6.18-lts` as its own
+backport pull request. You are preparing one of those. The workflow has
+already worked out which of the pull request's commits the LTS tree still
+lacks and hands you that list.
+
+The goal is that each backport changes **exactly what its mainline commit
+changes**. Where 6.18 differs from mainline enough that the same change does
+not apply, you adapt it the way a careful stable maintainer would and you say
+exactly what you did.
+
+This runs unattended. Nobody is watching while you work, and nobody can answer
+a question. Everything a reviewer needs has to end up in the report.
+
+## What happens to your result
+
+You cannot push, and nothing you write lands on `edera/6.18-lts`: a maintainer
+merges the backport pull request, or does not. When you finish, the workflow
+independently:
+
+1. runs `verify-backport.sh`, which checks from git alone that your branch
+   fast-forwards the LTS tip, is linear, and holds one commit per requested
+   commit, in order, each naming its source with a `(cherry picked from
+   commit <sha>)` trailer, keeping its source's subject, and changing the
+   same files by the same +/- lines;
+2. builds x86_64 and arm64 `vmlinux` with `kernel-build.sh`.
+
+Both results go into the pull request next to your report. A commit you had
+to adapt **will** show up as adapted there. That is expected, not a failure;
+your report explains it. Never reword a subject, merge two commits into one,
+or split one into two: backports are recognised later by subject, and a
+renamed one would be offered again.
+
+## Inputs
+
+The workflow gives you, in the prompt:
+
+- `MAINLINE_PR`: the number and title of the merged pull request.
+- `OLD_TIP`: the `edera/6.18-lts` commit to build on (already checked out).
+- `REQUEST`: a file listing the pull request's commits to backport, one per
+  line as `<sha> TAB <subject>`, oldest first. Their objects are already
+  fetched. Commits the LTS tree already has, and automation-only commits, are
+  not in it.
+- `PENDING`: a file listing every Edera commit on `edera/mainline` that the
+  LTS tree lacks, in the same format, oldest first. The request's own commits
+  are among them. The workflow has already checked that nothing earlier in
+  this list touches the request's files; you look for the dependencies a file
+  match cannot see.
+- `RESULT`: the local branch name your result must end up on.
+- `REPORT`: the path your report must be written to.
+
+The automation's own scripts are in `.rebase-tools/scripts/`, copied from the
+commit this run started from. Use those, never the copy inside the tree.
+
+### How to run commands here
+
+Your shell commands are checked against an allowlist that matches the
+command's first word. Shell variables, `$(...)`, `<(...)` and `VAR=x cmd`
+prefixes will be refused, so `OLD_TIP`, `RESULT`, `<sha>` and `<...>` below
+are placeholders: substitute the literal value. Put scratch files, worktrees
+and build output under `.rebase-scratch/` in the repository root; the
+kernel's `.gitignore` ignores it.
+
+This is a blobless clone: file contents are fetched from GitHub the first time
+a command needs them, so the first checkout or `git show` can be slow. That is
+not a hang.
+
+## 1. Read the request
+
+```sh
+cat REQUEST
+cat PENDING
+git show --stat <sha>        # for each requested commit
+```
+
+For each commit, read its message and diff, and check what it depends on:
+does it call a helper, use a struct field or a Kconfig symbol that 6.18
+lacks? If so, where does that come from?
+
+- From an earlier commit in the request: fine, it is backported first.
+- From a commit in `PENDING` that is not in the request: this backport has to
+  **wait** for that one. Stop here; see "If it has to wait".
+- From upstream (Linus' tree) only: see the next section.
+
+## 2. Cherry-pick, in order
+
+```sh
+git switch -c RESULT OLD_TIP
+git cherry-pick -x <sha>     # one at a time, oldest first
+```
+
+`-x` is required: the trailer it adds is how the checker pairs your commit
+with its source. If you have to amend, keep the trailer and the subject.
+
+When a pick conflicts, or applies but would not build or behave the same on
+6.18:
+
+- Read what differs between the two kernels around the change, and adapt the
+  change so it does on 6.18 what it does on mainline. Prefer the smallest
+  adaptation; do not backport an unrelated upstream refactor to make the
+  patch apply.
+- If the conflict is with Edera code that only a pending commit brings,
+  that is a dependency: **wait**, as above.
+- If the commit depends on an upstream change 6.18 lacks and cannot be
+  adapted without it, do not pull that upstream change in. Leave the commit
+  out (`git cherry-pick --abort` for that one, then continue with the next)
+  and make it a **Needs a decision** item saying what it needs.
+- If the commit does not apply to 6.18 at all (it fixes code only mainline
+  has), leave it out the same way and say so.
+- If you cannot tell what the right adaptation is, make the most conservative
+  one you can defend, mark it **UNSURE** in the report, and explain both
+  readings.
+- Never use `-X ours`, `-X theirs`, or `git checkout --ours/--theirs` on a
+  whole file to make a conflict go away.
+- Never commit anything that is not a backport of a requested commit. If a
+  backport needs a 6.18-only fix to build, fold it into that backport and
+  report it as an adaptation.
+
+## 3. Build
+
+```sh
+bash .rebase-tools/scripts/kernel-build.sh x86_64 .rebase-scratch/obj-x86 4
+bash .rebase-tools/scripts/kernel-build.sh arm64 .rebase-scratch/obj-arm64 4
+```
+
+If a build fails because of a backport, fix it **in that backport**: drive the
+todo list with sed, `git -c sequence.editor="sed -i 's/^pick <sha>/edit
+<sha>/'" rebase -i OLD_TIP`, amend (keeping subject and trailer), then `git
+rebase --continue`. Never rebase below OLD_TIP.
+
+If a build fails on OLD_TIP too, it is not yours: build OLD_TIP the same way
+in a `.rebase-scratch/` worktree to confirm, and report it as pre-existing.
+
+## 4. Check yourself
+
+```sh
+bash .rebase-tools/scripts/verify-backport.sh OLD_TIP RESULT REQUEST
+```
+
+Every commit it lists as adapted or left out must be accounted for in your
+report. If one is not, you changed something you did not mean to: find it and
+undo it.
+
+## 5. Report
+
+Write the report to the `REPORT` path, in Markdown. Its **first line** is the
+status, exactly one of:
+
+- `Status: proposed` when the RESULT branch holds a backport for review;
+- `Status: waiting` when it has to wait for another backport (no RESULT
+  branch);
+- `Status: not-applicable` when none of the request applies to 6.18 (no
+  RESULT branch).
+
+The rest becomes the pull request body (or the comment on the mainline pull
+request when there is no branch), so lead with what a reviewer must decide.
+No preamble, no sign-off.
+
+```markdown
+Status: proposed
+
+## Summary
+One paragraph: commits requested, backported unchanged, adapted, left out,
+and whether you expect the checker to pass.
+
+## Needs a decision
+One bullet per question, each starting **UNSURE:**, with both readings and
+what you committed. Every left-out commit is one. "None." if there is
+nothing.
+
+## Adapted commits
+Per commit: subject, what differs on 6.18, what you changed and why. "None."
+if none.
+
+## Left out
+Per commit: subject and why. "None." if none.
+
+## Builds
+x86_64, arm64: pass, fail (with the first error), or pre-existing failure
+(confirmed on OLD_TIP).
+```
+
+Then stop. The workflow reads the branch, not the working tree.
+
+## If it has to wait
+
+Do not create the RESULT branch. Write the report with `Status: waiting`,
+and under `## Waiting on` list each pending commit it needs, as `` `<sha>`
+<subject> ``, with one line on what it needs from it. The workflow labels the
+mainline pull request `backport-waiting` and tries again once other backports
+land.
+
+## If nothing applies, or you cannot finish
+
+If none of the request applies to 6.18, do not create the RESULT branch and
+write the report with `Status: not-applicable`, explaining why. If you could
+not produce a backport for any other reason, do not create the branch either
+and explain what went wrong; the first line is then whatever fits best, and
+a missing branch is treated as needing a human either way.
diff --git a/.github/scripts/backport-blockers.sh b/.github/scripts/backport-blockers.sh
new file mode 100755
index 00000000000000..6588478a0fcf96
--- /dev/null
+++ b/.github/scripts/backport-blockers.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Works out what a merged edera/mainline pull request still needs on
+# edera/6.18-lts, and what it has to wait for first.
+#
+# Backports to edera/6.18-lts land in the order their commits landed on
+# edera/mainline. A pull request is backported only once every Edera commit
+# that came before it on mainline, is still missing from the LTS tree, and
+# touches a file it touches has been backported (or skipped). Otherwise its
+# commits could be applied on top of code they were never written against.
+#
+# Usage:
+#   backport-blockers.sh <pending-file> <request-file> <lts-tip> <lts-upstream> <todo-out>
+#
+# <pending-file> is what pending-backports.sh prints for the whole of
+# edera/mainline: the mainline commits the LTS tree lacks, oldest first.
+# <request-file> lists the pull request's own commits the same way ("<sha>
+# TAB <subject>", oldest first). A request commit still needs backporting when
+# it matches a pending commit, and those are written to <todo-out>:
+#
+#   - by patch-id first, which is how a rebase-merged commit normally matches
+#     its copy on mainline;
+#   - otherwise, if the LTS series does not already have its patch-id, by
+#     subject, ignoring a trailing version tag. The patch-id check keeps a
+#     commit that is already on the LTS tree from claiming a different
+#     pending commit that happens to share its subject.
+#
+# Prints the pending commits the pull request has to wait for, oldest first,
+# and nothing when it can go ahead.
+
+set -euo pipefail
+
+if [ $# -ne 5 ] || [ ! -r "$1" ] || [ ! -r "$2" ]; then
+	echo "usage: $0 <pending-file> <request-file> <lts-tip> <lts-upstream> <todo-out>" >&2
+	exit 2
+fi
+pending=$1
+request=$2
+l_tip=$(git rev-parse --verify "$3^{commit}")
+l_base=$(git merge-base "$l_tip" "$(git rev-parse --verify "$4^{commit}")")
+todo=$5
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+norm() { sed -E 's/[[:space:]]*\((v?[0-9]+\.[0-9]+(\.[0-9y]+)?(-lts)?)\)$//'; }
+pid() { git show "$1" | git patch-id --stable | cut -d' ' -f1; }
+files() { git show --format= --name-only "$1"; }
+
+git log --no-merges --format='commit %H' --patch "$l_base..$l_tip" |
+	git patch-id --stable | cut -d' ' -f1 | sort -u >"$work/lts-pids"
+
+# Pending commits, numbered, with patch-ids.
+n=0
+while IFS=$'\t' read -r sha subject; do
+	n=$((n + 1))
+	printf '%s\t%s\t%s\t%s\n' "$n" "$sha" "$subject" "$(pid "$sha")"
+done <"$pending" >"$work/pending"
+
+# Each request commit claims the first pending commit it matches that nothing
+# else has claimed.
+: >"$todo"
+: >"$work/claimed"
+while IFS=$'\t' read -r sha subject; do
+	s=$(printf '%s' "$subject" | norm)
+	p=$(pid "$sha")
+	by=subject
+	grep -qxF -- "$p" "$work/lts-pids" && by=none
+	hit=$(awk -F'\t' -v s="$s" -v p="$p" -v by="$by" '
+		FILENAME == ARGV[1] { claimed[$0] = 1; next }
+		($1 in claimed) { next }
+		$4 == p { print $1; found = 1; exit }
+		by == "subject" && $3 == s && !first { first = $1 }
+		END { if (!found && first) print first }
+	' "$work/claimed" "$work/pending")
+	if [ -n "$hit" ]; then
+		echo "$hit" >>"$work/claimed"
+		printf '%s\t%s\n' "$sha" "$s" >>"$todo"
+		files "$sha" >>"$work/files"
+	fi
+done <"$request"
+[ -s "$todo" ] || exit 0
+sort -u -o "$work/files" "$work/files"
+first=$(sort -n "$work/claimed" | head -n1)
+
+awk -F'\t' -v first="$first" '
+	FILENAME == ARGV[1] { claimed[$0] = 1; next }
+	$1 < first && !($1 in claimed) { print $2 "\t" $3 }
+' "$work/claimed" "$work/pending" | while IFS=$'\t' read -r sha subject; do
+	if files "$sha" | grep -qxFf "$work/files"; then
+		printf '%s\t%s\n' "$sha" "$subject"
+	fi
+done
diff --git a/.github/scripts/pending-backports.sh b/.github/scripts/pending-backports.sh
new file mode 100755
index 00000000000000..c6ae95a0669378
--- /dev/null
+++ b/.github/scripts/pending-backports.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Lists the Edera commits on edera/mainline that edera/6.18-lts does not have.
+#
+# Edera kernel work lands on edera/mainline first and flows down to
+# edera/6.18-lts. Both trees are rebased onto their upstream nightly, so commit
+# hashes are no use for telling which commits already made it across. A commit
+# counts as present on the LTS tree when its series there has:
+#
+#   - a commit with the same subject, ignoring a trailing version tag such as
+#     " (6.18)" that a port may add (the k-th mainline commit with a subject
+#     pairs with the k-th LTS one, so repeated subjects are counted, not
+#     merged); or
+#   - a commit with the same patch-id, which catches a port whose subject was
+#     reworded but whose change was not.
+#
+# A commit that must never reach the LTS tree (it fixes code only mainline
+# has, say) is listed by subject in the skip file, one per line (the
+# backport workflow adds the commits of mainline pull requests labelled
+# no-backport); blank lines
+# and lines starting with # are ignored. Commits that change only .github/ or
+# .automation/ are never offered: both trees carry the automation, it is
+# landed on each by hand, and the backport is not allowed to touch it.
+#
+# Usage:
+#   pending-backports.sh <mainline-tip> <mainline-upstream> <lts-tip> <lts-upstream> [<skip-file>]
+#
+# Prints "<sha> TAB <subject>" for each pending commit, oldest first, and
+# nothing when the trees agree. Merge commits are ignored on both sides: their
+# content is in the commits they merged.
+
+set -euo pipefail
+
+if [ $# -lt 4 ] || [ $# -gt 5 ]; then
+	echo "usage: $0 <mainline-tip> <mainline-upstream> <lts-tip> <lts-upstream> [<skip-file>]" >&2
+	exit 2
+fi
+
+m_tip=$(git rev-parse --verify "$1^{commit}")
+m_base=$(git merge-base "$m_tip" "$(git rev-parse --verify "$2^{commit}")")
+l_tip=$(git rev-parse --verify "$3^{commit}")
+l_base=$(git merge-base "$l_tip" "$(git rev-parse --verify "$4^{commit}")")
+skip=${5:-/dev/null}
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+# <sha> TAB <normalized subject> TAB <patch-id>, oldest first.
+series() {
+	git log --no-merges --reverse --format='commit %H' --patch "$1" |
+		git patch-id --stable | awk '{ print $2 "\t" $1 }' >"$work/pid.map"
+	git log --no-merges --reverse --format='%H%x09%s' "$1" |
+		awk -F'\t' 'NR == FNR { pid[$1] = $2; next }
+			{
+				s = $2
+				sub(/[ \t]*\((v?[0-9]+\.[0-9]+(\.[0-9y]+)?(-lts)?)\)$/, "", s)
+				print $1 "\t" s "\t" ($1 in pid ? pid[$1] : "-")
+			}' "$work/pid.map" -
+}
+series "$m_base..$m_tip" >"$work/mainline"
+series "$l_base..$l_tip" >"$work/lts"
+# Mainline commits whose every changed path is automation.
+git log --no-merges --format='commit %H' --name-only "$m_base..$m_tip" |
+	awk '/^commit / { if (c != "" && only) print c; c = $2; only = 0; seen = 0; next }
+		NF { if (!seen) only = 1; seen = 1; if ($0 !~ /^\.(github|automation)\//) only = 0 }
+		END { if (c != "" && only) print c }' >"$work/automation"
+grep -vE '^[[:space:]]*(#|$)' "$skip" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g' >"$work/skip" || true
+
+awk -F'\t' '
+	FILENAME == ARGV[1] { auto[$0] = 1; next }
+	FILENAME == ARGV[2] { skip[$0] = 1; next }
+	FILENAME == ARGV[3] { have[$2]++; if ($3 != "-") bypid[$3] = $2; next }
+	{
+		if (($1 in auto) || ($2 in skip)) next
+		# A patch-id match uses up the LTS commit it matched, under the
+		# subject that commit has there, so it cannot also pair with another.
+		if ($3 in bypid) { have[bypid[$3]]--; delete bypid[$3]; next }
+		if (have[$2] > 0) { have[$2]--; next }
+		print $1 "\t" $2
+	}
+' "$work/automation" "$work/skip" "$work/lts" "$work/mainline"
diff --git a/.github/scripts/retry-backports.sh b/.github/scripts/retry-backports.sh
new file mode 100755
index 00000000000000..723955972a35a8
--- /dev/null
+++ b/.github/scripts/retry-backports.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Dispatches backports of merged edera/mainline pull requests again.
+#
+#   - Every mainline pull request labelled backport-waiting: something it was
+#     waiting for may have landed on edera/6.18-lts since.
+#   - With --stale, also every open backport pull request GitHub can no
+#     longer merge: a rebase of edera/6.18-lts rewrote the history it was
+#     built on, so it is prepared again from the new tip.
+#
+# Each one is a run of kernel-nightly.yml on edera/6.18-lts with backport_pr
+# set (lts-backport.yml). Needs GH_TOKEN with actions write and pull requests
+# read, and GITHUB_REPOSITORY.
+#
+# Usage: retry-backports.sh [--stale]
+
+set -euo pipefail
+
+SOURCE=edera/mainline
+TARGET=edera/6.18-lts
+PREFIX=backport/edera-6.18-lts/pr-
+R=$GITHUB_REPOSITORY
+
+{
+	gh pr list --repo "$R" --base "$SOURCE" --state merged --label backport-waiting \
+		--limit 200 --json number -q '.[].number'
+	if [ "${1:-}" = --stale ]; then
+		gh pr list --repo "$R" --base "$TARGET" --state open --limit 200 \
+			--json headRefName,mergeable \
+			-q ".[] | select(.headRefName | startswith(\"$PREFIX\")) | select(.mergeable == \"CONFLICTING\") | .headRefName" |
+			sed "s|^$PREFIX||"
+	fi
+} | grep -xE '[0-9]+' | sort -un | while read -r n; do
+	echo "Dispatching the backport of #$n"
+	gh workflow run kernel-nightly.yml --repo "$R" --ref "$TARGET" -f backport_pr="$n"
+done
diff --git a/.github/scripts/tests/backport.test.sh b/.github/scripts/tests/backport.test.sh
new file mode 100755
index 00000000000000..9c650aba454d5b
--- /dev/null
+++ b/.github/scripts/tests/backport.test.sh
@@ -0,0 +1,225 @@
+#!/usr/bin/env bash
+# Tests for .github/scripts/pending-backports.sh, backport-blockers.sh and
+# verify-backport.sh.
+#
+# Builds a small throwaway repository with two upstreams (an "lts" line and a
+# "mainline" line that has moved on), an Edera series on each, and checks
+# that pending-backports.sh finds exactly the mainline commits the LTS series
+# lacks, and that backport-blockers.sh holds a pull request back only for
+# earlier pending commits that touch its files. It then backports them
+# honestly and in each way the checker exists to catch. A backport is only
+# proposed on verify-backport.sh's say-so, so every damaged backport must be
+# flagged or refused and the honest one must pass.
+#
+# Run from anywhere: bash .github/scripts/tests/backport.test.sh
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+PENDING="$HERE/../pending-backports.sh"
+VERIFY="$HERE/../verify-backport.sh"
+BLOCKERS="$HERE/../backport-blockers.sh"
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+mkdir "$WORK/repo" && cd "$WORK/repo" || exit 1
+
+failures=0
+ok() { echo "ok   $1"; }
+bad() {
+	echo "FAIL $1" >&2
+	[ -z "${2:-}" ] || printf '     %s\n' "${2//$'\n'/$'\n'     }" >&2
+	failures=$((failures + 1))
+}
+
+git init -q -b lts-up .
+git config user.name test
+git config user.email test@example.invalid
+commit() { git add -A && git commit -qm "$1"; }
+
+# Upstreams: mainline is the LTS base plus an unrelated change.
+seq 1 60 >a.c
+seq 1 60 >b.c
+commit "upstream: base"
+git switch -q -c mainline-up
+echo "upstream main" >u.c
+commit "upstream: mainline moves on"
+
+# Edera on LTS: one commit both trees share, one ported with a version tag,
+# one reworded but identical in content, one LTS-only, and a repeated subject
+# once.
+git switch -q -c lts lts-up
+sed -i 's/^5$/5 shared/' a.c
+commit "xen: shared fix"
+sed -i 's/^15$/15 ported/' a.c
+commit "9p/xen: share one frontend (6.18)"
+sed -i 's/^25$/25 reworded/' a.c
+commit "xen: lts wording of a fix"
+echo lts-only >l.c
+commit "drm: lts only"
+sed -i 's/^30$/30 dep one/' b.c
+commit "apply dep patch"
+lts_tip=$(git rev-parse HEAD)
+
+# Edera on mainline: the same, plus three new commits (one with the repeated
+# subject, one to be skipped), a merge, and an automation-only commit, which
+# is never offered.
+git switch -q -c main mainline-up
+sed -i 's/^5$/5 shared/' a.c
+commit "xen: shared fix"
+sed -i 's/^15$/15 ported/' a.c
+commit "9p/xen: share one frontend"
+sed -i 's/^25$/25 reworded/' a.c
+commit "xen: mainline wording of a fix"
+sed -i 's/^30$/30 dep one/' b.c
+commit "apply dep patch"
+git switch -q -c side
+sed -i 's/^40$/40 new one/' b.c
+commit "xen: new on mainline"
+git switch -q main
+git merge -q --no-ff --no-edit side >/dev/null
+sed -i 's/^50$/50 dep two/' b.c
+commit "apply dep patch"
+echo mainline-only >m.c
+commit "xen: mainline only"
+mkdir -p .github/workflows
+echo "on: push" >.github/workflows/x.yml
+commit "automation: a workflow"
+main_tip=$(git rev-parse HEAD)
+
+printf '# never backport\n\n  xen: mainline only  \n' >"$WORK/skip"
+want=$(printf '%s\n' "xen: new on mainline" "apply dep patch")
+got=$(bash "$PENDING" "$main_tip" mainline-up "$lts_tip" lts-up "$WORK/skip" | cut -f2)
+if [ "$got" = "$want" ]; then ok "pending lists only what LTS lacks, oldest first"; else
+	bad "pending lists only what LTS lacks, oldest first" "got: $got"; fi
+
+got=$(bash "$PENDING" "$main_tip" mainline-up "$lts_tip" lts-up | cut -f2 | tail -n1)
+if [ "$got" = "xen: mainline only" ]; then ok "without a skip file, skipped commits are pending"; else
+	bad "without a skip file, skipped commits are pending" "got: $got"; fi
+
+got=$(bash "$PENDING" "$lts_tip" lts-up "$lts_tip" lts-up)
+if [ -z "$got" ]; then ok "a tree against itself has nothing pending"; else
+	bad "a tree against itself has nothing pending" "got: $got"; fi
+
+# Blockers. A "pull request" here is one mainline commit, as the request
+# file lists it.
+bash "$PENDING" "$main_tip" mainline-up "$lts_tip" lts-up >"$WORK/pending-all"
+nth() { git log --reverse --format=%H --grep="^$1\$" "$main_tip" | sed -n "${2:-1}p"; }
+pr() { for c in "$@"; do printf '%s\t%s\n' "$c" "$(git log -1 --format=%s "$c")"; done >"$WORK/pr"; }
+blockers() { bash "$BLOCKERS" "$WORK/pending-all" "$WORK/pr" "$lts_tip" lts-up "$WORK/todo" | cut -f2; }
+check() { # check <description> <want blockers> <want todo count>
+	local got
+	got=$(blockers)
+	if [ "$got" != "$2" ]; then
+		bad "$1" "blockers: $got"
+	elif [ "$(grep -c . "$WORK/todo")" -ne "$3" ]; then
+		bad "$1" "todo: $(cat "$WORK/todo")"
+	else
+		ok "$1"
+	fi
+}
+
+pr "$(nth 'apply dep patch' 2)"
+check "an earlier pending commit on the same file blocks" "xen: new on mainline" 1
+
+pr "$(nth 'apply dep patch' 1)"
+check "a commit already on LTS has nothing to do, even with a repeated subject" "" 0
+
+pr "$(nth 'xen: new on mainline')"
+check "the oldest pending commit is not blocked" "" 1
+
+pr "$(nth 'xen: new on mainline')" "$(nth 'apply dep patch' 2)"
+check "a pull request does not wait for its own commits" "" 2
+
+pr "$(nth 'xen: mainline only')"
+check "earlier pending commits on other files do not block" "" 1
+
+pr "$(nth 'automation: a workflow')"
+check "an automation-only pull request has nothing to do" "" 0
+
+printf 'xen: new on mainline\n' >"$WORK/skip2"
+bash "$PENDING" "$main_tip" mainline-up "$lts_tip" lts-up "$WORK/skip2" >"$WORK/pending-all"
+pr "$(nth 'apply dep patch' 2)"
+check "a skipped commit does not block" "" 1
+
+bash "$PENDING" "$main_tip" mainline-up "$lts_tip" lts-up "$WORK/skip" >"$WORK/request"
+
+expect() {
+	# expect <description> <exit-status> <new-tip> [<grep pattern>]
+	local desc=$1 want=$2 got out
+	out=$(bash "$VERIFY" "$lts_tip" "$3" "$WORK/request")
+	got=$?
+	if [ "$got" -ne "$want" ]; then
+		bad "$desc: exit $got, want $want" "$out"
+	elif [ $# -ge 4 ] && ! grep -qF -- "$4" <<<"$out"; then
+		bad "$desc: output lacks '$4'" "$out"
+	else
+		ok "$desc"
+	fi
+}
+
+pick_all() { # pick_all <branch>
+	git switch -q -c "$1" "$lts_tip"
+	cut -f1 "$WORK/request" | while read -r c; do git cherry-pick -x "$c" >/dev/null; done
+}
+
+pick_all good
+good=$(git rev-parse HEAD)
+expect "honest backport passes" 0 "$good" "All 2 requested commits backported"
+
+got=$(bash "$PENDING" "$main_tip" mainline-up "$good" lts-up "$WORK/skip")
+if [ -z "$got" ]; then ok "after the backport nothing is pending"; else
+	bad "after the backport nothing is pending" "got: $got"; fi
+
+# Adapted: the backport changes different lines from its source.
+git switch -q -c adapted "$good"
+echo extra >>b.c
+git commit -qa --amend --no-edit
+expect "adapted commit needs review" 1 "$(git rev-parse HEAD)" "| adapted |"
+
+# Retitled: same change, new subject, which pending would not recognise.
+git switch -q -c retitled "$good"
+git commit -q --amend -m "apply a dependency patch
+
+(cherry picked from commit $(sed -n 2p "$WORK/request" | cut -f1))"
+expect "retitled commit needs review" 1 "$(git rev-parse HEAD)" "| retitled |"
+
+# Left out: only the first requested commit.
+git switch -q -c leftout "$good~1"
+expect "left-out commit needs review" 1 "$(git rev-parse HEAD)" "| left-out |"
+
+# Added: an extra commit with no trailer.
+git switch -q -c added "$good"
+echo sneaky >s.c
+commit "innocent looking"
+expect "added commit needs review" 1 "$(git rev-parse HEAD)" "| added |"
+
+# Out of order.
+git switch -q -c reordered "$lts_tip"
+git cherry-pick -x "$(sed -n 2p "$WORK/request" | cut -f1)" >/dev/null
+git cherry-pick -x "$(sed -n 1p "$WORK/request" | cut -f1)" >/dev/null
+expect "out-of-order backport is refused" 2 "$(git rev-parse HEAD)" "| stray |"
+
+# A trailer naming a commit nobody asked for.
+git switch -q -c stray "$good"
+echo x >x.c
+git add x.c
+git commit -qm "xen: mainline only
+
+(cherry picked from commit $main_tip)"
+expect "unrequested source is refused" 2 "$(git rev-parse HEAD)" "| stray |"
+
+# Not a fast-forward of the LTS tip.
+git switch -q -c rewritten "$lts_tip~1"
+cut -f1 "$WORK/request" | while read -r c; do git cherry-pick -x "$c" >/dev/null; done
+expect "rewritten LTS history is refused" 2 "$(git rev-parse HEAD)" "does not contain the LTS tip"
+
+# A merge on top.
+git switch -q -c merged "$good"
+git merge -q --no-ff --no-edit side >/dev/null
+expect "merge on top is refused" 2 "$(git rev-parse HEAD)" "merge commit"
+
+if [ "$failures" -ne 0 ]; then
+	echo "$failures failure(s)" >&2
+	exit 1
+fi
+echo "all passed"
diff --git a/.github/scripts/verify-backport.sh b/.github/scripts/verify-backport.sh
new file mode 100755
index 00000000000000..e5cc7964777ea0
--- /dev/null
+++ b/.github/scripts/verify-backport.sh
@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# Checks a backport of edera/mainline commits onto edera/6.18-lts, without
+# trusting whoever did it.
+#
+# The backport of a merged edera/mainline pull request lets a model
+# cherry-pick its commits, but nothing it says about its own result is taken
+# on faith. This script is the gate. It proves, from git alone, that:
+#
+#   1. the new branch fast-forwards the LTS tip the backport started from;
+#   2. the commits on top are linear (no merge commits);
+#   3. every one of them is a backport of a requested commit, in the requested
+#      order, each named by its "(cherry picked from commit <sha>)" trailer,
+#      with nothing extra in between and nothing requested left out;
+#   4. each keeps its source's subject, so pending-backports.sh recognises it
+#      next time instead of offering it again;
+#   5. each changes the same files by the same +/- lines as its source. Hunk
+#      offsets and context may differ; the change itself may not.
+#
+# A commit that had to be adapted to the older kernel fails check 5. That is
+# the point: such a commit is not wrong, but the pull request has to say so,
+# so its reviewer knows to read it closely.
+#
+# Usage:
+#   verify-backport.sh <old-lts-tip> <new-tip> <requested-file>
+#
+# <requested-file> holds the commits asked for, as pending-backports.sh prints
+# them: "<sha> TAB <subject>", oldest first.
+#
+# Writes a Markdown report to stdout. Exit status:
+#   0  clean: every requested commit backported unchanged
+#   1  differences: well-formed (1-3 hold for what is there) but a commit was
+#      adapted, retitled, left out, or added; flagged in the pull request
+#   2  broken: 1 or 2 failed, a trailer names something not requested or out
+#      of order, or the inputs are unusable; not proposed at all
+
+set -euo pipefail
+
+if [ $# -ne 3 ] || [ ! -r "$3" ]; then
+	echo "usage: $0 <old-lts-tip> <new-tip> <requested-file>" >&2
+	exit 2
+fi
+
+old=$(git rev-parse --verify "$1^{commit}")
+new=$(git rev-parse --verify "$2^{commit}")
+requested=$3
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+status=0
+fail() { [ "$status" -ge "$1" ] || status=$1; }
+short() { git rev-parse --short=12 "$1"; }
+oneline() { git log -1 --format='%h %s' "$1"; }
+# The subject without a trailing version tag such as " (6.18)", as
+# pending-backports.sh compares them.
+subject() { git log -1 --format=%s "$1" | sed -E 's/[[:space:]]*\((v?[0-9]+\.[0-9]+(\.[0-9y]+)?(-lts)?)\)$//'; }
+own_change() {
+	git show --format= "$1" | grep -E '^([+-]|diff )' | grep -vE '^(\+\+\+|---) ' || true
+}
+
+echo "| | |"
+echo "| --- | --- |"
+echo "| LTS tip before | \`$(short "$old")\` |"
+echo "| LTS tip after | \`$(short "$new")\` |"
+echo "| Commits requested | $(grep -c . "$requested" || true) |"
+echo
+
+# 1. Fast-forward.
+if git merge-base --is-ancestor "$old" "$new"; then
+	echo "- [x] New branch fast-forwards the LTS tip."
+else
+	echo "- [ ] **New branch does not contain the LTS tip** \`$(short "$old")\`."
+	fail 2
+fi
+
+# 2. Linearity.
+if [ "$status" -lt 2 ]; then
+	merges=$(git rev-list --merges "$old..$new" | wc -l)
+	if [ "$merges" -eq 0 ]; then
+		echo "- [x] Backported commits are linear."
+	else
+		echo "- [ ] **$merges merge commit(s) on top of the LTS tip.**"
+		fail 2
+	fi
+fi
+
+if [ "$status" -ge 2 ]; then
+	echo
+	echo "Stopped: the remaining checks assume a linear series on the LTS tip."
+	exit "$status"
+fi
+
+# 3-5. Walk the new commits and the request list together. A commit names its
+# source by trailer; it must be the next requested commit, or a later one (the
+# ones skipped over were left out).
+cut -f1 "$requested" | while read -r sha; do git rev-parse --verify "$sha^{commit}"; done >"$work/want"
+git rev-list --reverse "$old..$new" >"$work/got"
+
+: >"$work/rows"
+next=1
+n_want=$(wc -l <"$work/want")
+while read -r c; do
+	src=$(git log -1 --format=%B "$c" |
+		sed -nE 's/^\(cherry picked from commit ([0-9a-f]{40})\)$/\1/p' | tail -n1)
+	if [ -z "$src" ]; then
+		echo "added	$c	-" >>"$work/rows"
+		fail 1
+		continue
+	fi
+	pos=$(grep -nxF "$src" "$work/want" | cut -d: -f1 | head -n1 || true)
+	if [ -z "$pos" ] || [ "$pos" -lt "$next" ]; then
+		echo "stray	$c	$src" >>"$work/rows"
+		fail 2
+		continue
+	fi
+	while [ "$next" -lt "$pos" ]; do
+		echo "left-out	-	$(sed -n "${next}p" "$work/want")" >>"$work/rows"
+		fail 1
+		next=$((next + 1))
+	done
+	next=$((pos + 1))
+	if [ "$(subject "$c")" != "$(subject "$src")" ]; then
+		echo "retitled	$c	$src" >>"$work/rows"
+		fail 1
+	elif [ "$(own_change "$c")" != "$(own_change "$src")" ]; then
+		echo "adapted	$c	$src" >>"$work/rows"
+		fail 1
+	else
+		echo "same	$c	$src" >>"$work/rows"
+	fi
+done <"$work/got"
+while [ "$next" -le "$n_want" ]; do
+	echo "left-out	-	$(sed -n "${next}p" "$work/want")" >>"$work/rows"
+	fail 1
+	next=$((next + 1))
+done
+
+count() { awk -F'\t' -v k="$1" '$1 == k' "$work/rows" | wc -l; }
+n_same=$(count same)
+if [ "$n_same" -eq "$n_want" ] && [ "$(wc -l <"$work/got")" -eq "$n_want" ]; then
+	echo "- [x] All $n_want requested commits backported in order, each with its source's subject and identical +/- lines."
+else
+	echo "- [ ] **Backport differs from the request:** $n_same of $n_want unchanged;" \
+		"$(count adapted) adapted, $(count retitled) retitled, $(count left-out) left out," \
+		"$(count added) added, $(count stray) not requested or out of order."
+fi
+
+if [ "$n_same" -ne "$(wc -l <"$work/rows")" ]; then
+	echo
+	echo "| | Backport | Mainline source |"
+	echo "| --- | --- | --- |"
+	while IFS=$'\t' read -r verdict c src; do
+		[ "$verdict" = same ] && continue
+		a='(none)'; b='(none)'
+		[ "$c" = - ] || a=$(oneline "$c")
+		[ "$src" = - ] || b=$(oneline "$src")
+		echo "| $verdict | \`$a\` | \`$b\` |"
+	done <"$work/rows"
+fi
+
+if grep -q '^adapted' "$work/rows"; then
+	echo
+	echo "<details><summary>Adapted commits (source +/- lines vs. backport)</summary>"
+	echo
+	echo '```diff'
+	awk -F'\t' '$1 == "adapted" { print $2 "\t" $3 }' "$work/rows" |
+		while IFS=$'\t' read -r c src; do
+			echo "### $(oneline "$c")"
+			diff -u --label mainline --label backport \
+				<(own_change "$src") <(own_change "$c") || true
+		done | head -n 400
+	echo '```'
+	echo
+	echo "</details>"
+fi
+
+exit "$status"
diff --git a/.github/workflows/automation-selftest.yml b/.github/workflows/automation-selftest.yml
index b3cf554a636931..fff5f1f7ac104d 100644
--- a/.github/workflows/automation-selftest.yml
+++ b/.github/workflows/automation-selftest.yml
@@ -1,14 +1,17 @@
 name: Automation self-test
 
 # Tests the scripts the nightly rebase relies on to decide whether to
-# force-push edera/6.18-lts, so a change that weakens either must not land
-# quietly:
+# force-push edera/6.18-lts, and the ones the backports rely on to decide what
+# to propose, so a change that weakens any of them must not land quietly:
 #
 #   - verify-upstream-rebase.sh: honest replays pass, including one that
 #     flattens a merged series; edited, dropped, added and merged commits and
 #     a stale base are all refused;
 #   - report-needs-decision.sh: any question in Claude's report, or anything
-#     marked UNSURE, stops the automatic push.
+#     marked UNSURE, stops the automatic push;
+#   - pending-backports.sh, backport-blockers.sh and verify-backport.sh: only
+#     what the LTS tree lacks is offered, in mainline order, and a damaged
+#     backport is flagged or refused.
 #
 # It runs only when the automation itself changes.
 
@@ -21,6 +24,8 @@ on:
       - '.github/workflows/upstream-rebase.yml'
       - '.github/workflows/kernel-nightly.yml'
       - '.github/workflows/rebase-land.yml'
+      - '.github/workflows/lts-backport.yml'
+      - '.github/workflows/lts-backport-merged.yml'
       - '.github/workflows/automation-selftest.yml'
       - '.automation/**'
 
@@ -56,5 +61,8 @@ jobs:
       - name: Decision detector tests
         run: bash .github/scripts/tests/report-needs-decision.test.sh
 
+      - name: Backport tests
+        run: bash .github/scripts/tests/backport.test.sh
+
       - name: Shellcheck
         run: shellcheck .github/scripts/*.sh .github/scripts/tests/*.sh
diff --git a/.github/workflows/kernel-nightly.yml b/.github/workflows/kernel-nightly.yml
index f06f0c17c61c17..9c5135045f42c9 100644
--- a/.github/workflows/kernel-nightly.yml
+++ b/.github/workflows/kernel-nightly.yml
@@ -1,10 +1,17 @@
 name: Nightly kernel maintenance
 
-# Rebases edera/6.18-lts onto stable linux-6.18.y every night
-# (upstream-rebase.yml).
+# Keeps edera/6.18-lts current:
 #
-# Claude does the rebase. Independent checks decide whether the result is
-# pushed or proposed as a pull request; see upstream-rebase.yml.
+#   - nightly, rebases it onto stable linux-6.18.y (upstream-rebase.yml), then
+#     retries waiting backports and refreshes the backport pull requests the
+#     rebase left behind (retry-backports.sh);
+#   - with backport_pr set, proposes the backport of that merged
+#     edera/mainline pull request instead (lts-backport.yml).
+#     lts-backport-trigger.yml on edera/mainline dispatches this for every
+#     pull request that merges there.
+#
+# Claude does the rebase and the backports. Independent checks decide what
+# happens to each result; see those workflows.
 #
 # GitHub runs scheduled workflows only from the default branch, edera/mainline,
 # so this copy has no schedule of its own. lts-rebase-trigger.yml on
@@ -33,18 +40,25 @@ on:
         description: Rebase even if an open rebase pull request already covers this upstream tip
         type: boolean
         default: false
+      backport_pr:
+        description: Instead of the rebase, backport this merged edera/mainline pull request (its number)
+        type: string
+        default: ''
 
 permissions:
   contents: read
 
 concurrency:
   # Per tree: groups are repository-wide, and edera/mainline's copy of this
-  # workflow uses plain kernel-nightly.
-  group: kernel-nightly-edera/6.18-lts
+  # workflow uses plain kernel-nightly. Each backport has its own group, so
+  # they run alongside the rebase and each other; a newer dispatch for the
+  # same pull request replaces one still queued.
+  group: kernel-nightly-edera/6.18-lts${{ inputs.backport_pr != '' && format('-backport-{0}', inputs.backport_pr) || '' }}
   cancel-in-progress: false
 
 jobs:
   lts:
+    if: inputs.backport_pr == ''
     uses: ./.github/workflows/upstream-rebase.yml
     permissions:
       contents: read
@@ -58,3 +72,43 @@ jobs:
       upstream_branch: linux-6.18.y
       force: ${{ inputs.force == true }}
     secrets: inherit
+
+  # After the rebase, whatever it did.
+  retry:
+    needs: lts
+    if: always() && inputs.backport_pr == ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          sparse-checkout: .github
+
+      - name: Retry and refresh backports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash .github/scripts/retry-backports.sh --stale
+
+  backport:
+    if: inputs.backport_pr != ''
+    uses: ./.github/workflows/lts-backport.yml
+    permissions:
+      contents: read
+      actions: write
+      issues: write
+      pull-requests: write
+      id-token: write
+    with:
+      pr: ${{ inputs.backport_pr }}
+    secrets: inherit
diff --git a/.github/workflows/lts-backport-merged.yml b/.github/workflows/lts-backport-merged.yml
new file mode 100644
index 00000000000000..d77121a6a984ec
--- /dev/null
+++ b/.github/workflows/lts-backport-merged.yml
@@ -0,0 +1,45 @@
+name: Retry waiting backports
+
+# When a backport pull request merges into edera/6.18-lts, a mainline pull
+# request waiting for it (labelled backport-waiting) may now be able to go
+# ahead, so every waiting one is dispatched again (retry-backports.sh). The
+# nightly retries them too; this just saves the wait.
+#
+# pull_request_target runs this file as it is on edera/6.18-lts, never the
+# pull request's copy, and nothing here checks out the pull request.
+
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [edera/6.18-lts]
+
+permissions: {}
+
+jobs:
+  retry:
+    if: >-
+      github.event.pull_request.merged
+      && startsWith(github.event.pull_request.head.ref, 'backport/edera-6.18-lts/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          persist-credentials: false
+          sparse-checkout: .github
+
+      - name: Retry waiting backports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash .github/scripts/retry-backports.sh
diff --git a/.github/workflows/lts-backport.yml b/.github/workflows/lts-backport.yml
new file mode 100644
index 00000000000000..4a0e15d997e3ce
--- /dev/null
+++ b/.github/workflows/lts-backport.yml
@@ -0,0 +1,722 @@
+name: LTS backport
+
+# Proposes the backport of one merged edera/mainline pull request to
+# edera/6.18-lts, as a pull request. Called by kernel-nightly.yml when it is
+# dispatched with backport_pr: by lts-backport-trigger.yml on edera/mainline
+# when a pull request merges there, and by retry-backports.sh to retry or
+# refresh one.
+#
+# Edera kernel work lands on edera/mainline first and every merged pull
+# request flows down, unless it is labelled no-backport. The order is kept:
+# backport-blockers.sh holds a pull request back while an earlier Edera commit
+# that touches its files is still missing from edera/6.18-lts, and Claude
+# holds it back for a dependency a file match cannot see. Either way the
+# mainline pull request is labelled backport-waiting and retried later.
+#
+# Claude cherry-picks the commits, following
+# .automation/skills/mainline-backport/SKILL.md. Nothing it says about its own
+# result decides what happens to it. The model runs read-only; its branch
+# leaves as a git bundle and is judged by scripts from the commit this run
+# started from:
+#
+#   - verify-backport.sh proves the branch fast-forwards the LTS tip and holds
+#     exactly the requested commits, in order, each with its source's subject
+#     and its source's +/- lines;
+#   - kernel-build.sh builds x86_64 and arm64 vmlinux.
+#
+# The result always goes up as a backport/edera-6.18-lts/pr-<N> pull request
+# with both results and Claude's report; nothing here pushes edera/6.18-lts.
+# The mainline pull request gets one status comment, kept up to date, and is
+# labelled backport-needs-attention when there is nothing to propose and a
+# human has to decide.
+
+on:
+  workflow_call:
+    inputs:
+      pr:
+        description: Number of the merged edera/mainline pull request
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  SOURCE: edera/mainline
+  SOURCE_UPSTREAM_URL: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
+  SOURCE_UPSTREAM_BRANCH: master
+  TARGET: edera/6.18-lts
+  TARGET_UPSTREAM_URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+  TARGET_UPSTREAM_BRANCH: linux-6.18.y
+  PR: ${{ inputs.pr }}
+  BRANCH: backport/edera-6.18-lts/pr-${{ inputs.pr }}
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      state: ${{ steps.plan.outputs.state }}
+      old: ${{ steps.plan.outputs.old }}
+      head: ${{ steps.plan.outputs.head }}
+      source: ${{ steps.plan.outputs.source }}
+      title: ${{ steps.plan.outputs.title }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.TARGET }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Plan
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          tools=$RUNNER_TEMP/tools
+          finish() { # finish <state> <message>
+            echo "state=$1" >> "$GITHUB_OUTPUT"
+            printf '%s\n' "$2" >"$out/message.md"
+            printf '### Backport of #%s\n\n%s\n' "$PR" "$2" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          }
+          if ! [[ $PR =~ ^[0-9]+$ ]]; then
+            echo "::error::backport_pr must be a pull request number, not '$PR'."
+            exit 1
+          fi
+          old=$(git rev-parse HEAD)
+          echo "old=$old" >> "$GITHUB_OUTPUT"
+
+          pr=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR")
+          title=$(jq -r .title <<<"$pr" | tr -d '\r\n')
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+          if [ "$(jq -r .merged <<<"$pr")" != true ] || [ "$(jq -r .base.ref <<<"$pr")" != "$SOURCE" ]; then
+            finish ignored "#$PR is not a merged pull request into \`$SOURCE\`."
+          fi
+          case $(jq -r .head.ref <<<"$pr") in
+            rebase/*) finish ignored "#$PR is a nightly rebase, not Edera work." ;;
+          esac
+          if jq -e '.labels | map(.name) | index("no-backport")' <<<"$pr" >/dev/null; then
+            finish skipped "#$PR is labelled \`no-backport\`, so it is not backported to \`$TARGET\`."
+          fi
+
+          # The pull request's own commits, as they were reviewed. Their hashes
+          # stay valid when the nightly rebase rewrites edera/mainline.
+          git fetch --no-tags --filter=blob:none origin "refs/pull/$PR/head"
+          head=$(git rev-parse FETCH_HEAD)
+          echo "head=$head" >> "$GITHUB_OUTPUT"
+          gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR/commits" -q '.[].sha' >"$out/pr-commits"
+          while read -r c; do
+            git merge-base --is-ancestor "$c" "$head"
+            printf '%s\t%s\n' "$c" "$(git log -1 --format=%s "$c")"
+          done <"$out/pr-commits" >"$out/request"
+
+          git fetch --no-tags --filter=blob:none origin "$SOURCE"
+          src=$(git rev-parse FETCH_HEAD)
+          echo "source=$src" >> "$GITHUB_OUTPUT"
+          git fetch --no-tags --filter=blob:none "$SOURCE_UPSTREAM_URL" "$SOURCE_UPSTREAM_BRANCH"
+          src_up=$(git rev-parse FETCH_HEAD)
+          git fetch --no-tags --filter=blob:none "$TARGET_UPSTREAM_URL" "$TARGET_UPSTREAM_BRANCH"
+          tgt_up=$(git rev-parse FETCH_HEAD)
+
+          # Never backported: the skip file, and the commits of every mainline
+          # pull request labelled no-backport.
+          cp "$tools/backport-skip" "$out/skip"
+          gh pr list --repo "$GITHUB_REPOSITORY" --base "$SOURCE" --state merged \
+            --label no-backport --limit 500 --json number -q '.[].number' |
+          while read -r n; do
+            gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$n/commits" -q '.[].commit.message | split("\n")[0]'
+          done >>"$out/skip"
+
+          bash "$tools/scripts/pending-backports.sh" "$src" "$src_up" "$old" "$tgt_up" "$out/skip" >"$out/pending"
+          bash "$tools/scripts/backport-blockers.sh" "$out/pending" "$out/request" "$old" "$tgt_up" "$out/todo" >"$out/blockers"
+
+          if [ ! -s "$out/todo" ]; then
+            finish skipped "Nothing to backport: every commit of #$PR is already on \`$TARGET\` (\`${old:0:12}\`), changes only automation, or is no longer an Edera commit on \`$SOURCE\`."
+          fi
+          if [ -s "$out/blockers" ]; then
+            {
+              echo "Waiting: earlier Edera commits on \`$SOURCE\` that touch the same files are not on \`$TARGET\` yet, and have to be backported first:"
+              echo
+              while IFS=$'\t' read -r sha subject; do echo "- \`${sha:0:12}\` $subject"; done <"$out/blockers"
+              echo
+              echo "This is retried when a backport lands on \`$TARGET\`, and nightly. If one of them should never be backported, label its pull request \`no-backport\`, or list its subject in \`.automation/backport-skip\` on \`$TARGET\`."
+            } >"$out/blocked.md"
+            finish waiting "$(cat "$out/blocked.md")"
+          fi
+          {
+            echo "### Backport of #$PR to \`$TARGET\` (\`${old:0:12}\`)"
+            echo
+            while IFS=$'\t' read -r sha subject; do echo "- \`${sha:0:12}\` $subject"; done <"$out/todo"
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "state=run" >> "$GITHUB_OUTPUT"
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: backport-plan
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  backport:
+    needs: prepare
+    if: needs.prepare.outputs.state == 'run'
+    runs-on: ubuntu-latest
+    timeout-minutes: 240
+    # Read-only on purpose: the model runs here. It reaches the Claude API
+    # through OIDC federation, and that is the only thing id-token is for.
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      produced: ${{ steps.collect.outputs.produced }}
+      result: ${{ steps.collect.outputs.result }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      # The skill and scripts come from the commit this run started from.
+      # The kernel's .gitignore ignores dot-directories, so .rebase-tools/
+      # cannot end up in a commit.
+      - name: Trusted tools
+        env:
+          HEAD_SHA: ${{ needs.prepare.outputs.head }}
+          SRC: ${{ needs.prepare.outputs.source }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA" "$SRC" "refs/pull/$PR/head"
+          git cat-file -e "$HEAD_SHA^{commit}"
+          mkdir .rebase-tools
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C .rebase-tools --strip-components=1
+          git config --global user.name "edera-lts-backport"
+          git config --global user.email "noreply@edera.dev"
+
+      - name: Download the plan
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport-plan
+          path: ${{ runner.temp }}/in
+
+      - name: Install toolchains
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential bc bison flex libelf-dev libssl-dev python3 \
+            gcc-aarch64-linux-gnu
+
+      - name: Normalize identifiers
+        id: ids
+        env:
+          RULE: ${{ vars.REBASE_FEDERATION_RULE_ID }}
+          ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+        run: |
+          set -euo pipefail
+          strip() { printf '%s' "$1" | tr -d '[:space:]'; }
+          {
+            echo "rule=$(strip "$RULE")"
+            echo "org=$(strip "$ORG")"
+            echo "svc=$(strip "$SVC")"
+            echo "ws=$(strip "$WS")"
+          } >> "$GITHUB_OUTPUT"
+          # An unset variable otherwise surfaces as an opaque API failure a
+          # second into the model step, with nothing in the log to say why.
+          missing=0
+          for n in REBASE_FEDERATION_RULE_ID:RULE ANTHROPIC_ORGANIZATION_ID:ORG ANTHROPIC_SERVICE_ACCOUNT_ID:SVC ANTHROPIC_WORKSPACE_ID:WS; do
+            eval "v=\$${n#*:}"
+            if [ -z "$(strip "$v")" ]; then
+              echo "::error::vars.${n%%:*} is empty or not visible to this repository."
+              missing=1
+            fi
+          done
+          exit "$missing"
+
+      - name: Backport
+        id: claude
+        continue-on-error: true
+        uses: anthropics/claude-code-action@6fed3ca145920b639991cb756090506e1bcaf515 # v1.0.245
+        with:
+          # The job token, which is read-only here. Without it the action
+          # would exchange OIDC for its own app token, which can write.
+          github_token: ${{ github.token }}
+          anthropic_federation_rule_id: '${{ steps.ids.outputs.rule }}'
+          anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
+          anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
+          anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          prompt: |
+            Backport a merged edera/mainline pull request to edera/6.18-lts by
+            following .rebase-tools/skills/mainline-backport/SKILL.md exactly.
+            Read it in full before you start.
+
+            MAINLINE_PR=#${{ inputs.pr }}: ${{ needs.prepare.outputs.title }}
+            OLD_TIP=${{ needs.prepare.outputs.old }}   (${{ env.TARGET }}, checked out)
+            REQUEST=${{ runner.temp }}/in/todo
+            PENDING=${{ runner.temp }}/in/pending
+            RESULT=backport-result
+            REPORT=${{ runner.temp }}/backport-report.md
+
+            You cannot push and must not try. The workflow verifies and
+            builds your branch independently afterwards and proposes it as a
+            pull request.
+          claude_args: |
+            --model claude-opus-5-5
+            --max-turns 300
+            --allowedTools "Read,Grep,Glob,Edit,Write,Bash(git:*),Bash(make:*),Bash(bash .rebase-tools/scripts/verify-backport.sh:*),Bash(bash .rebase-tools/scripts/kernel-build.sh:*),Bash(scripts/config:*),Bash(mkdir -p .rebase-scratch:*),Bash(diff:*),Bash(comm:*),Bash(sort:*),Bash(grep:*),Bash(sed:*),Bash(awk:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*),Bash(ls:*),Bash(cut:*),Bash(tee:*)"
+
+      - name: Collect the result
+        id: collect
+        if: always()
+        env:
+          REPORT: ${{ runner.temp }}/backport-report.md
+          OLD: ${{ needs.prepare.outputs.old }}
+          OUTCOME: ${{ steps.claude.outcome }}
+          EXECUTION_FILE: ${{ steps.claude.outputs.execution_file }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          if [ -s "$REPORT" ]; then
+            cp "$REPORT" "$out/report.md"
+          else
+            # Only the API error messages and the final result text: neither
+            # carries tool output into a public log.
+            why=
+            f=${EXECUTION_FILE:-$RUNNER_TEMP/claude-execution-output.json}
+            if [ -s "$f" ]; then
+              why=$(jq -r '
+                (if type == "array" then .[] else . end)
+                | if .type == "assistant" and (.error != null) then
+                    "API error (\(.error)): " + ([.message.content[]? | .text? // empty] | join(" "))
+                  elif .type == "result" then
+                    ([.result // empty] + (.errors // [] | map(tostring))) | join("\n")
+                  else empty end' "$f" 2>/dev/null | head -c 2000 || true)
+            fi
+            {
+              printf 'Status: failed\n\nClaude left no report (backport step: %s).\n' "$OUTCOME"
+              if [ -n "$why" ]; then
+                # shellcheck disable=SC2016 # a literal Markdown fence
+                printf '\n```\n%s\n```\n' "$why"
+              else
+                printf 'The run log has the cause.\n'
+              fi
+            } >"$out/report.md"
+            [ -z "$why" ] || echo "::error::Claude ended without a result: ${why//$'\n'/ }"
+          fi
+          if git rev-parse --verify -q refs/heads/backport-result >/dev/null \
+             && git merge-base --is-ancestor "$OLD" backport-result \
+             && [ "$(git rev-parse backport-result)" != "$OLD" ]; then
+            git bundle create "$out/backport.bundle" refs/heads/backport-result "^$OLD"
+            echo "produced=true" >> "$GITHUB_OUTPUT"
+            echo "result=$(git rev-parse backport-result)" >> "$GITHUB_OUTPUT"
+          else
+            echo "produced=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: backport
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  verify:
+    needs: [prepare, backport]
+    if: needs.backport.outputs.produced == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      status: ${{ steps.check.outputs.status }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA" "refs/pull/$PR/head"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download the plan
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport-plan
+          path: ${{ runner.temp }}/in/plan
+
+      - name: Download the backport
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport
+          path: ${{ runner.temp }}/in/backport
+
+      - name: Check
+        id: check
+        env:
+          OLD: ${{ needs.prepare.outputs.old }}
+          RESULT: ${{ needs.backport.outputs.result }}
+        run: |
+          set -euo pipefail
+          git fetch "$RUNNER_TEMP/in/backport/backport.bundle" backport-result:backport-result
+          [ "$(git rev-parse backport-result)" = "$RESULT" ] || { echo "bundle does not hold $RESULT"; exit 1; }
+          # Capture the status: under bash -e a bare call would end the step
+          # before the verdict is recorded.
+          rc=0
+          bash "$RUNNER_TEMP/tools/scripts/verify-backport.sh" "$OLD" "$RESULT" "$RUNNER_TEMP/in/plan/todo" >"$RUNNER_TEMP/verify.md" || rc=$?
+          case $rc in
+            0) status=clean ;;
+            1) status=differences ;;
+            *) status=broken ;;
+          esac
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          cat "$RUNNER_TEMP/verify.md" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: backport-verify
+          path: ${{ runner.temp }}/verify.md
+          retention-days: 30
+
+  build:
+    needs: [prepare, backport]
+    if: needs.backport.outputs.produced == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x86_64, arm64]
+    name: build (${{ matrix.arch }})
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport
+          path: ${{ runner.temp }}/in
+
+      - name: Check out the result
+        env:
+          RESULT: ${{ needs.backport.outputs.result }}
+        run: |
+          set -euo pipefail
+          git fetch "$RUNNER_TEMP/in/backport.bundle" backport-result:backport-result
+          git checkout --detach "$RESULT"
+
+      - name: Install toolchains
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential bc bison flex libelf-dev libssl-dev python3 \
+            gcc-aarch64-linux-gnu
+
+      - name: Build
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: bash "$RUNNER_TEMP/tools/scripts/kernel-build.sh" "$ARCH" "$RUNNER_TEMP/obj"
+
+  publish:
+    needs: [prepare, backport, verify, build]
+    if: >-
+      always()
+      && needs.prepare.result == 'success'
+      && needs.prepare.outputs.state != 'ignored'
+      && needs.backport.result != 'cancelled'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: write
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download the plan
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport-plan
+          path: ${{ runner.temp }}/in/plan
+
+      - name: Download the backport
+        if: needs.prepare.outputs.state == 'run'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport
+          path: ${{ runner.temp }}/in/backport
+
+      - name: Download the checker report
+        if: needs.verify.result == 'success'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: backport-verify
+          path: ${{ runner.temp }}/in/verify
+
+      # Pushes and closes backport branches. Pull requests it opens trigger
+      # the usual checks, which ones opened with GITHUB_TOKEN would not.
+      - name: App token
+        id: app
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.REBASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REBASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Propose
+        env:
+          APP_TOKEN: ${{ steps.app.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
+          STATE: ${{ needs.prepare.outputs.state }}
+          TITLE: ${{ needs.prepare.outputs.title }}
+          PRODUCED: ${{ needs.backport.outputs.produced }}
+          VERIFY: ${{ needs.verify.outputs.status }}
+          BUILD: ${{ needs.build.result }}
+          OLD: ${{ needs.prepare.outputs.old }}
+          RESULT: ${{ needs.backport.outputs.result }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          R=$GITHUB_REPOSITORY
+          in=$RUNNER_TEMP/in
+          summary() { cat >> "$GITHUB_STEP_SUMMARY"; }
+
+          # One status comment on the mainline pull request, kept up to date.
+          marker='<!-- lts-backport-status -->'
+          status_comment() { # status_comment <markdown-file>
+            local id
+            { echo "$marker"; echo "**Backport to \`$TARGET\`:** $(head -n1 "$1")"; tail -n +2 "$1"; echo; echo "[Run log]($RUN_URL)"; } >"$1.full"
+            id=$(gh api --paginate "repos/$R/issues/$PR/comments" \
+              -q ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n1)
+            if [ -n "$id" ]; then
+              gh api -X PATCH "repos/$R/issues/comments/$id" -F body=@"$1.full" >/dev/null
+            else
+              gh api -X POST "repos/$R/issues/$PR/comments" -F body=@"$1.full" >/dev/null
+            fi
+          }
+          # At most one of backport-waiting and backport-needs-attention.
+          set_label() { # set_label <label or none>
+            local l
+            for l in backport-waiting backport-needs-attention; do
+              if [ "$l" = "$1" ]; then
+                gh label create "$l" --repo "$R" --color ededed --force >/dev/null
+                gh api -X POST "repos/$R/issues/$PR/labels" -f "labels[]=$l" >/dev/null
+              else
+                gh api -X DELETE "repos/$R/issues/$PR/labels/$l" >/dev/null 2>&1 || true
+              fi
+            done
+          }
+          open_backport() {
+            gh pr list --repo "$R" --state open --base "$TARGET" --head "$BRANCH" --json number -q '.[0].number // empty'
+          }
+          close_backport() { # close_backport <reason>
+            local n
+            n=$(open_backport)
+            [ -z "$n" ] || GH_TOKEN=$APP_TOKEN gh pr close "$n" --repo "$R" --delete-branch --comment "$1"
+          }
+
+          case $STATE in
+            skipped)
+              set_label none
+              close_backport "Closed: $(cat "$in/plan/message.md")"
+              { echo "not needed"; echo; cat "$in/plan/message.md"; } >"$RUNNER_TEMP/c.md"
+              status_comment "$RUNNER_TEMP/c.md"
+              exit 0 ;;
+            waiting)
+              set_label backport-waiting
+              close_backport "Closed while #$PR waits for earlier backports; it is proposed again once they land."
+              { echo "waiting"; echo; cat "$in/plan/message.md"; } >"$RUNNER_TEMP/c.md"
+              status_comment "$RUNNER_TEMP/c.md"
+              exit 0 ;;
+          esac
+
+          # A rebase moved edera/6.18-lts under this backport: start again
+          # from the new tip rather than propose something built on the old
+          # one. A backport that landed on top is fine; the tree still
+          # contains OLD.
+          git fetch --no-tags --filter=blob:none origin "$TARGET"
+          if ! git merge-base --is-ancestor "$OLD" FETCH_HEAD; then
+            gh workflow run kernel-nightly.yml --repo "$R" --ref "$TARGET" -f backport_pr="$PR"
+            echo "\`$TARGET\` was rebased while this ran; dispatched again from the new tip." | summary
+            exit 0
+          fi
+
+          report=$in/backport/report.md
+          claude_status=$(head -n1 "$report" | sed -nE 's/^Status:[[:space:]]*([a-z-]+).*/\1/p')
+          tail -n +2 "$report" | sed '1{/^$/d}' >"$RUNNER_TEMP/report-body.md"
+
+          if [ "$claude_status" = waiting ]; then
+            set_label backport-waiting
+            close_backport "Closed while #$PR waits for earlier backports; it is proposed again once they land."
+            { echo "waiting (Claude found a dependency)"; echo; cat "$RUNNER_TEMP/report-body.md"; } >"$RUNNER_TEMP/c.md"
+            status_comment "$RUNNER_TEMP/c.md"
+            exit 0
+          fi
+
+          why=
+          if [ "$PRODUCED" != true ]; then
+            why="Claude produced no backport (\`${claude_status:-no status}\`)"
+          elif [ "$VERIFY" = broken ]; then
+            why="the checker refused the backport branch"
+          else
+            git fetch "$in/backport/backport.bundle" backport-result:backport-result
+            [ "$(git rev-parse backport-result)" = "$RESULT" ]
+            # Workflows triggered by a pull request run that branch's own copy
+            # of .github/ with this repository's secrets. A backport never
+            # touches it: automation commits are never requested.
+            if ! git diff --quiet "$OLD" "$RESULT" -- .github .automation; then
+              why="the backport changes \`.github\` or \`.automation\`"
+            fi
+          fi
+          if [ -n "$why" ]; then
+            set_label backport-needs-attention
+            {
+              echo "needs attention: $why"
+              echo
+              [ ! -s "$in/verify/verify.md" ] || { cat "$in/verify/verify.md"; echo; }
+              cat "$RUNNER_TEMP/report-body.md"
+              echo
+              echo "Label this pull request \`no-backport\` if it should not come to \`$TARGET\`; otherwise fix the cause and run **Nightly kernel maintenance** on \`$TARGET\` with \`backport_pr\` = $PR."
+            } | head -c 60000 >"$RUNNER_TEMP/c.md"
+            status_comment "$RUNNER_TEMP/c.md"
+            echo "::error::Backport of #$PR not proposed: $why."
+            exit 1
+          fi
+
+          flags=()
+          [ "$VERIFY" = clean ] || flags+=("the checker found differences from the mainline commits (see below)")
+          [ "$BUILD" = success ] || flags+=("a build ${BUILD}")
+          drc=0
+          bash "$RUNNER_TEMP/tools/scripts/report-needs-decision.sh" "$RUNNER_TEMP/report-body.md" >/dev/null || drc=$?
+          [ "$drc" -ne 0 ] || flags+=("Claude's report asks for a decision")
+
+          body=$RUNNER_TEMP/pr.md
+          {
+            echo "Backport of #$PR from \`$SOURCE\` to \`$TARGET\` (\`${OLD:0:12}\`), prepared by Claude. [Run log]($RUN_URL)."
+            echo
+            if [ "${#flags[@]}" -gt 0 ]; then
+              echo "> [!WARNING]"
+              for f in "${flags[@]}"; do echo "> - $f"; done
+              echo
+            fi
+            echo "Merge with **Rebase and merge**, so \`$TARGET\` stays linear."
+            echo
+            echo "## Independent checks"
+            echo
+            echo "Builds: **${BUILD}** (x86_64 and arm64 vmlinux with the Edera features built in)."
+            echo
+            if [ -s "$in/verify/verify.md" ]; then cat "$in/verify/verify.md"; else echo "The checker did not run."; fi
+            echo
+            echo "# Claude's report"
+            echo
+            cat "$RUNNER_TEMP/report-body.md"
+          } >"$body"
+          if [ "$(wc -c <"$body")" -gt 60000 ]; then
+            head -c 59000 "$body" >"$body.cut"
+            printf '\n\n_Truncated; the full report is in the run artifacts._\n' >>"$body.cut"
+            mv "$body.cut" "$body"
+          fi
+
+          # The branch belongs to this automation; a retry replaces it.
+          git push --force "https://x-access-token:${APP_TOKEN}@github.com/${R}.git" "$RESULT:refs/heads/$BRANCH"
+          n=$(open_backport)
+          if [ -n "$n" ]; then
+            GH_TOKEN=$APP_TOKEN gh pr edit "$n" --repo "$R" --body-file "$body"
+            url=$(gh pr view "$n" --repo "$R" --json url -q .url)
+          else
+            url=$(GH_TOKEN=$APP_TOKEN gh pr create --repo "$R" --base "$TARGET" --head "$BRANCH" \
+              --title "Backport #$PR to 6.18-lts: $TITLE" --body-file "$body")
+          fi
+          set_label none
+          {
+            echo "proposed in $url"
+            echo
+            if [ "${#flags[@]}" -gt 0 ]; then for f in "${flags[@]}"; do echo "- $f"; done; else echo "Checks and builds passed."; fi
+          } >"$RUNNER_TEMP/c.md"
+          status_comment "$RUNNER_TEMP/c.md"
+          echo "### Proposed: $url" | summary

From 6ea43b42c68e7c8da7d5431ac9428586a04c95ed Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Mon, 12 Oct 2026 10:15:16 -0700
Subject: [PATCH 1953/1982] automation: allow github-actions to initiate
 workflows

---
 .github/workflows/lts-backport.yml    | 1 +
 .github/workflows/upstream-rebase.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/lts-backport.yml b/.github/workflows/lts-backport.yml
index 4a0e15d997e3ce..e60c42b6a3a4c5 100644
--- a/.github/workflows/lts-backport.yml
+++ b/.github/workflows/lts-backport.yml
@@ -277,6 +277,7 @@ jobs:
           anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
           anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
           anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          allowed_bots:                 'github-actions'
           prompt: |
             Backport a merged edera/mainline pull request to edera/6.18-lts by
             following .rebase-tools/skills/mainline-backport/SKILL.md exactly.
diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml
index 7b8620fb30878c..250dc71808d17d 100644
--- a/.github/workflows/upstream-rebase.yml
+++ b/.github/workflows/upstream-rebase.yml
@@ -232,6 +232,7 @@ jobs:
           anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
           anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
           anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          allowed_bots:                 'github-actions'
           prompt: |
             Rebase the downstream kernel series onto upstream by following
             .rebase-tools/skills/upstream-rebase/SKILL.md exactly. Read it in

From ed753b0e66fb35a06c7da7cef76f77151c529587 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 10 Oct 2026 16:52:18 +0000
Subject: [PATCH 1954/1982] iommu/xen: register before xen-pciback binds its
 devices

xen-pciback seizes a hidden device in an fs_initcall, but the Xen IOMMU
registered from a device_initcall. Registering probes every PCI device
that already exists, so a hidden device was found with a driver bound and
the IOMMU core warned about a late probe at driver bind.

Register from subsys_initcall_sync instead, so the IOMMU is in place
before pciback binds anything.

Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit cfb58095c90877819a53565082fac4f283527a1a)
---
 drivers/iommu/xen-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index 36ad0dbee42c01..b4c2ea39ddae6c 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -567,4 +567,5 @@ static int __init xen_iommu_init(void)
 	return 0;
 }
 
-module_init(xen_iommu_init);
+/* Must precede xen-pciback's fs_initcall bind, or the IOMMU core sees a bound device. */
+subsys_initcall_sync(xen_iommu_init);

From 2b3662837c0c9c0f29f3db4accd252c8b98c9b0a Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Mon, 12 Oct 2026 13:00:51 -0700
Subject: [PATCH 1955/1982] automation: do not fail backport retries when
 nothing needs retrying

retry-backports.sh filters the pull request numbers it collects through
grep under pipefail. When no mainline pull request is waiting and no
backport is stale, grep matches nothing and exits 1, so the script fails.
That is the usual case: the retry job has failed on every nightly run of
edera/6.18-lts since it was added, and lts-backport-merged.yml fails the
same way whenever a backport merges with nothing waiting.

Let an empty list through, and add tests for the script against a fake
gh, including the empty case.
---
 .github/scripts/retry-backports.sh            |  4 +-
 .github/scripts/tests/retry-backports.test.sh | 66 +++++++++++++++++++
 .github/workflows/automation-selftest.yml     |  3 +
 3 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100755 .github/scripts/tests/retry-backports.test.sh

diff --git a/.github/scripts/retry-backports.sh b/.github/scripts/retry-backports.sh
index 723955972a35a8..5eaca535f0b508 100755
--- a/.github/scripts/retry-backports.sh
+++ b/.github/scripts/retry-backports.sh
@@ -12,6 +12,8 @@
 # read, and GITHUB_REPOSITORY.
 #
 # Usage: retry-backports.sh [--stale]
+#
+# Nothing to retry is the usual case and exits 0.
 
 set -euo pipefail
 
@@ -29,7 +31,7 @@ R=$GITHUB_REPOSITORY
 			-q ".[] | select(.headRefName | startswith(\"$PREFIX\")) | select(.mergeable == \"CONFLICTING\") | .headRefName" |
 			sed "s|^$PREFIX||"
 	fi
-} | grep -xE '[0-9]+' | sort -un | while read -r n; do
+} | { grep -xE '[0-9]+' || true; } | sort -un | while read -r n; do
 	echo "Dispatching the backport of #$n"
 	gh workflow run kernel-nightly.yml --repo "$R" --ref "$TARGET" -f backport_pr="$n"
 done
diff --git a/.github/scripts/tests/retry-backports.test.sh b/.github/scripts/tests/retry-backports.test.sh
new file mode 100755
index 00000000000000..5f900c5c1672b6
--- /dev/null
+++ b/.github/scripts/tests/retry-backports.test.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Tests for .github/scripts/retry-backports.sh against a fake gh.
+#
+# The fake answers the two pull request listings from WAITING and STALE and
+# records every dispatch, so each case checks exactly which backports the
+# script started, and that having nothing to retry is a success.
+#
+# Run from anywhere: bash .github/scripts/tests/retry-backports.test.sh
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+RETRY="$HERE/../retry-backports.sh"
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+mkdir "$WORK/bin"
+cat >"$WORK/bin/gh" <<'GH'
+#!/usr/bin/env bash
+case "$1 $2" in
+"pr list")
+	case " $* " in
+	*" --label backport-waiting "*) [ -z "$WAITING" ] || printf '%s\n' $WAITING ;;
+	*) [ -z "$STALE" ] || printf '%s\n' $STALE ;;
+	esac ;;
+"workflow run") echo "$*" >>"$DISPATCHED" ;;
+*) echo "unexpected: gh $*" >&2; exit 2 ;;
+esac
+GH
+chmod +x "$WORK/bin/gh"
+export PATH="$WORK/bin:$PATH" GITHUB_REPOSITORY=edera-dev/linux DISPATCHED="$WORK/dispatched"
+
+failures=0
+ok() { echo "ok   $1"; }
+bad() {
+	echo "FAIL $1" >&2
+	[ -z "${2:-}" ] || printf '     %s\n' "${2//$'\n'/$'\n'     }" >&2
+	failures=$((failures + 1))
+}
+
+# check <name> <args> <waiting> <stale> <expected pr numbers, space separated>
+check() {
+	local name=$1 args=$2 out got
+	: >"$DISPATCHED"
+	# shellcheck disable=SC2086 # $args is zero or one word
+	if ! out=$(WAITING=$3 STALE=$4 bash "$RETRY" $args 2>&1); then
+		bad "$name" "exited non-zero: $out"
+		return
+	fi
+	got=$(sed -E 's/.*backport_pr=([0-9]+).*/\1/' "$DISPATCHED" | xargs)
+	if [ "$got" = "$5" ]; then ok "$name"; else bad "$name" "dispatched '$got', expected '$5'"; fi
+}
+
+check "nothing waiting, no --stale" "" "" "" ""
+check "nothing waiting, nothing stale" --stale "" "" ""
+check "waiting pull requests are dispatched" "" "7 12" "" "7 12"
+check "stale backports are dispatched by number" --stale "" \
+	"backport/edera-6.18-lts/pr-23 backport/edera-6.18-lts/pr-9" "9 23"
+check "stale backports are ignored without --stale" "" "" "backport/edera-6.18-lts/pr-23" ""
+check "a pull request both waiting and stale goes once" --stale "23" \
+	"backport/edera-6.18-lts/pr-23" "23"
+
+if [ "$failures" -ne 0 ]; then
+	echo "$failures failure(s)" >&2
+	exit 1
+fi
+echo "all passed"
diff --git a/.github/workflows/automation-selftest.yml b/.github/workflows/automation-selftest.yml
index fff5f1f7ac104d..0f5b41444b775e 100644
--- a/.github/workflows/automation-selftest.yml
+++ b/.github/workflows/automation-selftest.yml
@@ -64,5 +64,8 @@ jobs:
       - name: Backport tests
         run: bash .github/scripts/tests/backport.test.sh
 
+      - name: Backport retry tests
+        run: bash .github/scripts/tests/retry-backports.test.sh
+
       - name: Shellcheck
         run: shellcheck .github/scripts/*.sh .github/scripts/tests/*.sh

From 8f960b16c2c7a1393d7f2d89192ad7eb9786238c Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 22 Aug 2026 14:07:55 -0700
Subject: [PATCH 1956/1982] x86/xen: take the early CPU frequency from the
 hypervisor

xen_init_time_common() points x86_platform.calibrate_tsc at
xen_tsc_khz() but leaves calibrate_cpu native, so tsc_early_init() ->
determine_cpu_tsc_frequencies() still calls
native_calibrate_cpu_early() for cpu_khz. That tries CPUID 0x16, then
MSR_PLATFORM_INFO, and then falls through to quick_pit_calibrate() --
which on a PVH guest waits out its full 50ms timeout on a PIT that is
not there, prints "Fast TSC calibration failed", and arrives at a
value the hypervisor had already been asked for a moment later.

It is 48ms of every boot, and it is the largest single item in one: a
512 MiB PVH guest reached "Run /init as init process" at 0.330s, and
0.118s once this and the xenbus boot wait were out of the way.

There is nothing for the calibration to find out here. Xen reports the
TSC frequency, tsc_khz already comes from it, and cpu_khz differing
from tsc_khz under a hypervisor is not information --
determine_cpu_tsc_frequencies() would overwrite cpu_khz with tsc_khz
anyway once they disagree by more than 10%. Note that tsc_early_khz=
does not help: it only short-circuits calibrate_tsc, and the 50ms is
spent in calibrate_cpu.

Set in xen_init_time_common() so PV and PVH/HVM guests both get it,
which is where calibrate_tsc is already set for the same reason.

Signed-off-by: Alex Zenla <alex@edera.dev>
---
 arch/x86/xen/time.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 96521b1874acfc..493c46190d7c20 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -567,6 +567,7 @@ static void __init xen_init_time_common(void)
 	paravirt_set_sched_clock(xen_sched_clock);
 
 	x86_platform.calibrate_tsc = xen_tsc_khz;
+	x86_platform.calibrate_cpu = xen_tsc_khz;
 	x86_platform.get_wallclock = xen_get_wallclock;
 }
 

From 9909c32d7506aecd600fdd3cf960b609d3370db1 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 22 Aug 2026 14:08:06 -0700
Subject: [PATCH 1957/1982] xen/xenbus: wake the boot device wait when a
 backend changes state

boot_wait_for_devices() sleeps HZ/10 between checks, so on a
CONFIG_HZ=100 kernel it waits a tenth of a second to notice something
that has already happened. What it is waiting for is not slow: a
toolstack has every backend sitting in XenbusStateInitWait before it
unpauses the guest, so the wait covers the frontend half of the
handshake, which finishes a few milliseconds after the late_initcall
starts looking. Measured on a PVH guest, the last frontend connected
at 0.232s and init started at 0.311s -- 79ms of sleeping past the
event.

Frontends move to XenbusStateConnected (and blkfront sets is_ready)
from their otherend_changed callback, which runs from the frontend
bus's backend_changed() watch. Bump a sequence count and wake a wait
queue there, and have wait_for_devices() sleep on it instead of for a
fixed interval. The sequence is sampled before each check, so a change
that lands between the check and the sleep still wakes the waiter.

The HZ/10 interruptible sleep stays as the timeout, so state changes
that do not come through the watch are noticed no later than before,
and the 30/270-second budgets and their reporting are unchanged.

Signed-off-by: Alex Zenla <alex@edera.dev>
---
 drivers/xen/xenbus/xenbus_probe_frontend.c | 30 +++++++++++++++++-----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 199917b6f77ca9..9d14e3808d949c 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -85,10 +85,17 @@ static int xenbus_uevent_frontend(const struct device *_dev,
 }
 
 
+/* Condition for wait_for_devices(): bumped on every backend state change. */
+static atomic_t frontend_wait_seq = ATOMIC_INIT(0);
+static DECLARE_WAIT_QUEUE_HEAD(frontend_wait_wq);
+
 static void backend_changed(struct xenbus_watch *watch,
 			    const char *path, const char *token)
 {
 	xenbus_otherend_changed(watch, path, token, 1);
+
+	atomic_inc(&frontend_wait_seq);
+	wake_up(&frontend_wait_wq);
 }
 
 static void xenbus_frontend_delayed_resume(struct work_struct *w)
@@ -265,7 +272,7 @@ static int print_device_status(struct device *dev, void *data)
 static int ready_to_wait_for_devices;
 
 static bool wait_loop(unsigned long start, unsigned int max_delay,
-		     unsigned int *seconds_waited)
+		     unsigned int *seconds_waited, unsigned int seq)
 {
 	if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
 		if (!*seconds_waited)
@@ -278,7 +285,8 @@ static bool wait_loop(unsigned long start, unsigned int max_delay,
 		}
 	}
 
-	schedule_timeout_interruptible(HZ/10);
+	wait_event_interruptible_timeout(frontend_wait_wq,
+			atomic_read(&frontend_wait_seq) != seq, HZ/10);
 
 	return false;
 }
@@ -301,18 +309,28 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
 	unsigned long start = jiffies;
 	struct device_driver *drv = xendrv ? &xendrv->driver : NULL;
 	unsigned int seconds_waited = 0;
+	unsigned int seq;
 
 	if (!ready_to_wait_for_devices || !xen_domain())
 		return;
 
-	while (exists_non_essential_connecting_device(drv))
-		if (wait_loop(start, 30, &seconds_waited))
+	/* Sample the sequence before checking, so a change in between wakes us. */
+	for (;;) {
+		seq = atomic_read(&frontend_wait_seq);
+		if (!exists_non_essential_connecting_device(drv))
+			break;
+		if (wait_loop(start, 30, &seconds_waited, seq))
 			break;
+	}
 
 	/* Skips PVKB and PVFB check.*/
-	while (exists_essential_connecting_device(drv))
-		if (wait_loop(start, 270, &seconds_waited))
+	for (;;) {
+		seq = atomic_read(&frontend_wait_seq);
+		if (!exists_essential_connecting_device(drv))
+			break;
+		if (wait_loop(start, 270, &seconds_waited, seq))
 			break;
+	}
 
 	if (seconds_waited)
 		printk("\n");

From 7351d79993954947adff017524a5dfe709b506c4 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 15 Oct 2026 19:25:36 -0500
Subject: [PATCH 1958/1982] fix(xen/balloon): register the OOM deflate notifier
 only in domUs

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 2cae6397bbf9bdb110f8542a3c953c0b89666510)
---
 drivers/xen/balloon.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 692dca2eccbc58..d5444e699acce2 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -1142,7 +1142,8 @@ static int __init balloon_init(void)
 	/* Init the xen-balloon driver. */
 	xen_balloon_init();
 
-	register_oom_notifier(&balloon_oom_nb);
+	if (!xen_initial_domain())
+		register_oom_notifier(&balloon_oom_nb);
 
 	return 0;
 

From 12ed636326d52fd3047b7cd3e8ff5ff3133ac203 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 15 Oct 2026 22:45:10 -0500
Subject: [PATCH 1959/1982] xen/balloon: add boot-time extra memory as 2 MiB
 blocks

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 2bf98044438994101e998014b68743d2622791ef)
---
 drivers/xen/balloon.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d5444e699acce2..f4ec5e7c2786bb 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -1024,10 +1024,26 @@ static struct notifier_block balloon_oom_nb = {
 	.notifier_call = balloon_oom_notify,
 };
 
+static void __init balloon_append_range(unsigned long pfn,
+					unsigned long end_pfn)
+{
+	while (pfn < end_pfn) {
+		if (balloon_blocks_usable() &&
+		    IS_ALIGNED(pfn, BALLOON_BLOCK_NR_PAGES) &&
+		    end_pfn - pfn >= BALLOON_BLOCK_NR_PAGES) {
+			balloon_append_block(pfn_to_page(pfn));
+			pfn += BALLOON_BLOCK_NR_PAGES;
+		} else {
+			balloon_append(pfn_to_page(pfn));
+			pfn++;
+		}
+	}
+}
+
 static int __init balloon_add_regions(bool append)
 {
 	unsigned long start_pfn, pages;
-	unsigned long pfn, extra_pfn_end;
+	unsigned long extra_pfn_end;
 	unsigned int i;
 
 	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
@@ -1044,8 +1060,7 @@ static int __init balloon_add_regions(bool append)
 		 */
 		extra_pfn_end = min(max_pfn, start_pfn + pages);
 
-		for (pfn = start_pfn; pfn < extra_pfn_end; pfn++)
-			balloon_append(pfn_to_page(pfn));
+		balloon_append_range(start_pfn, extra_pfn_end);
 
 		/*
 		 * There are two different use-cases depending on how the

From 6f194b7e0bb5a331e9d2703ec5e4c3945000a05e Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Thu, 15 Oct 2026 22:46:10 -0500
Subject: [PATCH 1960/1982] x86/xen: keep dom0's growth room on the balloon

All of the extra memory Linux reserves at boot goes to the mapping
pool, so dom0's balloon starts empty. Growing dom0 at runtime then
means memory hotplug, which places the new range at the first free
physical address: on PVH that is the host's own map, where nothing
guarantees the range is not a device's MMIO window.

Keep the part of the extra memory dom0 may grow into on the balloon
instead. Xen's ceiling for dom0 (dom0_mem=...,max:) sizes that part,
so a host booted without a max: keeps today's behaviour. Every
region gives up the same fraction, which spreads the growth over the
NUMA nodes on PVH and leaves each node's mapping pool its share, and
the last memory section stays with the pool so that early grant
mappings never fall back to holes in the physical map.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit a26875e62c613e663047e71113ef291effd40e29)
---
 arch/x86/xen/enlighten.c | 54 ++++++++++++++++++++++++++++++++++------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 23b91bf9b66303..852610dfe704bd 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,6 +10,7 @@
 
 #include <xen/xen.h>
 #include <xen/features.h>
+#include <xen/interface/memory.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/version.h>
 #include <xen/page.h>
@@ -440,8 +441,34 @@ void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns)
 }
 
 #ifdef CONFIG_XEN_UNPOPULATED_ALLOC
+/*
+ * How much of the extra memory dom0 keeps on the balloon, to grow into up
+ * to the ceiling Xen set for it (dom0_mem=...,max:). Without a max: Xen
+ * reports UINT_MAX and dom0 keeps nothing, so growing stays opt-in. The
+ * last memory section always stays with the mapping pool, so that the
+ * grant table and other early users never fall back to holes in the
+ * physical map before PCI devices have claimed their MMIO windows.
+ */
+static unsigned long __init xen_dom0_growth_pages(unsigned long extra_pages)
+{
+	domid_t domid = DOMID_SELF;
+	long max_pages, cur_pages;
+
+	if (!xen_initial_domain() || extra_pages <= PAGES_PER_SECTION)
+		return 0;
+
+	max_pages = HYPERVISOR_memory_op(XENMEM_maximum_reservation, &domid);
+	cur_pages = HYPERVISOR_memory_op(XENMEM_current_reservation, &domid);
+	if (cur_pages <= 0 || max_pages <= cur_pages || max_pages >= UINT_MAX)
+		return 0;
+
+	return min_t(unsigned long, max_pages - cur_pages,
+		     extra_pages - PAGES_PER_SECTION);
+}
+
 int __init arch_xen_unpopulated_init(struct resource **res)
 {
+	unsigned long extra_pages = 0, growth_pages;
 	unsigned int i;
 
 	if (!xen_domain())
@@ -450,16 +477,27 @@ int __init arch_xen_unpopulated_init(struct resource **res)
 	/* Must be set strictly before calling xen_free_unpopulated_pages(). */
 	*res = &iomem_resource;
 
+	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++)
+		extra_pages += xen_extra_mem[i].n_pfns;
+	growth_pages = xen_dom0_growth_pages(extra_pages);
+
 	/*
 	 * Initialize with pages from the extra memory regions (see
-	 * arch/x86/xen/setup.c).
+	 * arch/x86/xen/setup.c), less what dom0 keeps to grow into. Every
+	 * region gives up the same fraction: on PVH that spreads dom0's
+	 * growth over the NUMA nodes the regions belong to, and leaves each
+	 * node's pool its share of the rest.
 	 */
 	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
-		unsigned int j;
+		struct xen_memory_region *region = &xen_extra_mem[i];
+		unsigned long keep = 0, j;
+
+		if (growth_pages)
+			keep = mult_frac(region->n_pfns, growth_pages,
+					 extra_pages);
 
-		for (j = 0; j < xen_extra_mem[i].n_pfns; j++) {
-			struct page *pg =
-				pfn_to_page(xen_extra_mem[i].start_pfn + j);
+		for (j = keep; j < region->n_pfns; j++) {
+			struct page *pg = pfn_to_page(region->start_pfn + j);
 
 			xen_free_unpopulated_pages(1, &pg);
 		}
@@ -470,9 +508,9 @@ int __init arch_xen_unpopulated_init(struct resource **res)
 		 * driver to know how much of the physmap is unpopulated and
 		 * set an accurate initial memory target.
 		 */
-		xen_unpopulated_pages += xen_extra_mem[i].n_pfns;
-		/* Zero so region is not also added to the balloon driver. */
-		xen_extra_mem[i].n_pfns = 0;
+		xen_unpopulated_pages += region->n_pfns - keep;
+		/* Only the part dom0 keeps is added to the balloon driver. */
+		region->n_pfns = keep;
 	}
 
 	return 0;

From d11e3314fbbf47cd7c94930a19f8eb9a95ca32e7 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 17 Oct 2026 17:14:01 -0700
Subject: [PATCH 1961/1982] 9p/xen: wake ring-space waiters with wake_up()

A request that does not fit in its ring sleeps in
io_wait_event_killable() until the backend frees space, but the event
handler wakes the ring with wake_up_interruptible(), which only wakes
TASK_INTERRUPTIBLE sleepers. A TASK_KILLABLE waiter therefore sleeps
until it is killed, which hangs a guest that has enough large requests
in flight to fill a ring.

Wake the ring with wake_up() so killable waiters see the freed space.

Fixes: 9523feac272c ("net/9p: Switch to wait_event_killable()")
Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit 902d2211245f292b54d0becb1ff0cd64a9be4cb3)
---
 net/9p/trans_xen.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 9960a7e8246eed..7970241fc8d9c5 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -280,7 +280,7 @@ static irqreturn_t xen_9pfs_front_event_handler(int irq, void *r)
 		return IRQ_HANDLED;
 	}
 
-	wake_up_interruptible(&ring->wq);
+	wake_up(&ring->wq);
 	schedule_work(&ring->work);
 
 	return IRQ_HANDLED;

From c9bbf732feb1aebb8704aaf7d34d7066a678b34c Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 17 Oct 2026 17:17:01 -0700
Subject: [PATCH 1962/1982] 9p/xen: reconnect to the backend on resume

The frontend's resume handler only warned that suspend and resume are
unsupported. After a restore its rings, grant references and event
channels are gone, yet the mounted client kept writing requests into
them, so every request on the mount hung. The next InitWait from the
backend then allocated a second frontend instance for the same device,
which no client used.

On resume, collect any replies the backend left in the rings, free the
rings, fail the requests that are still unanswered with -EIO, and
publish Initialising so that a backend which still serves the old rings
starts over. When the backend reaches InitWait, allocate and publish new
rings for the existing frontend, keeping its clients. Requests that
arrive while the frontend is not connected wait until it is, and a
rw_semaphore keeps them off the rings while a resume replaces them.

Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit 9a1668bd2e37b45d15c663395cd9a675e243ec43)
---
 net/9p/trans_xen.c | 326 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 257 insertions(+), 69 deletions(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 7970241fc8d9c5..e98a07c4c7610a 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -55,10 +55,18 @@ struct xen_9pfs_front_priv {
 	struct p9_client *client;
 
 	struct xen_9pfs_dataring *rings;
+	unsigned int ring_order;
+	/* Requests hold it for read while they use the rings; a restore
+	 * holds it for write to replace them.
+	 */
+	struct rw_semaphore rings_sem;
+	bool connected;
 };
 
 static LIST_HEAD(xen_9pfs_devs);
 static DEFINE_RWLOCK(xen_9pfs_lock);
+/* Requests that find their frontend disconnected wait here for it. */
+static DECLARE_WAIT_QUEUE_HEAD(xen_9pfs_connect_wq);
 
 /* We don't currently allow canceling of requests */
 static int p9_xen_cancel(struct p9_client *client, struct p9_req_t *req)
@@ -145,6 +153,23 @@ static bool p9_xen_write_todo(struct xen_9pfs_dataring *ring, RING_IDX size)
 		xen_9pfs_queued(prod, cons, XEN_9PFS_RING_SIZE(ring)) >= size;
 }
 
+/* True once @client's frontend is connected, or gone. */
+static bool p9_xen_ready(struct p9_client *client)
+{
+	struct xen_9pfs_front_priv *priv;
+	bool ready = true;
+
+	read_lock(&xen_9pfs_lock);
+	list_for_each_entry(priv, &xen_9pfs_devs, list) {
+		if (priv->client == client) {
+			ready = READ_ONCE(priv->connected);
+			break;
+		}
+	}
+	read_unlock(&xen_9pfs_lock);
+	return ready;
+}
+
 static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 {
 	struct xen_9pfs_front_priv *priv;
@@ -154,6 +179,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 	struct xen_9pfs_dataring *ring;
 	int num;
 
+lookup:
 	read_lock(&xen_9pfs_lock);
 	list_for_each_entry(priv, &xen_9pfs_devs, list) {
 		if (priv->client == client)
@@ -163,13 +189,27 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 	if (list_entry_is_head(priv, &xen_9pfs_devs, list))
 		return -EINVAL;
 
+	down_read(&priv->rings_sem);
+	if (!READ_ONCE(priv->connected)) {
+		up_read(&priv->rings_sem);
+		if (wait_event_killable(xen_9pfs_connect_wq,
+					p9_xen_ready(client)))
+			return -ERESTARTSYS;
+		goto lookup;
+	}
+
 	num = p9_req->tc.tag % XEN_9PFS_NUM_RINGS;
 	ring = &priv->rings[num];
 
 again:
 	while (wait_event_killable(ring->wq,
+				   !READ_ONCE(priv->connected) ||
 				   p9_xen_write_todo(ring, size)) != 0)
 		;
+	if (!READ_ONCE(priv->connected)) {
+		up_read(&priv->rings_sem);
+		goto lookup;
+	}
 
 	spin_lock_irqsave(&ring->lock, flags);
 	cons = ring->intf->out_cons;
@@ -195,6 +235,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 	ring->intf->out_prod = prod;
 	spin_unlock_irqrestore(&ring->lock, flags);
 	notify_remote_via_irq(ring->irq);
+	up_read(&priv->rings_sem);
 	p9_req_put(client, p9_req);
 
 	return 0;
@@ -304,36 +345,42 @@ static const struct xenbus_device_id xen_9pfs_front_ids[] = {
 	{ "" }
 };
 
-static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+static void xen_9pfs_front_free_rings(struct xen_9pfs_front_priv *priv)
 {
 	int i, j;
 
-	if (priv->rings) {
-		for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
-			struct xen_9pfs_dataring *ring = &priv->rings[i];
+	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+		struct xen_9pfs_dataring *ring = &priv->rings[i];
 
-			cancel_work_sync(&ring->work);
+		cancel_work_sync(&ring->work);
 
-			if (!priv->rings[i].intf)
-				break;
-			if (priv->rings[i].irq > 0)
-				unbind_from_irqhandler(priv->rings[i].irq, ring);
-			if (priv->rings[i].data.in) {
-				for (j = 0;
-				     j < (1 << priv->rings[i].intf->ring_order);
-				     j++) {
-					grant_ref_t ref;
-
-					ref = priv->rings[i].intf->ref[j];
-					gnttab_end_foreign_access(ref, NULL);
-				}
-				free_pages_exact(priv->rings[i].data.in,
-				   1UL << (priv->rings[i].intf->ring_order +
-					   XEN_PAGE_SHIFT));
+		if (!priv->rings[i].intf)
+			break;
+		if (priv->rings[i].irq > 0)
+			unbind_from_irqhandler(priv->rings[i].irq, ring);
+		if (priv->rings[i].data.in) {
+			for (j = 0;
+			     j < (1 << priv->rings[i].intf->ring_order);
+			     j++) {
+				grant_ref_t ref;
+
+				ref = priv->rings[i].intf->ref[j];
+				gnttab_end_foreign_access(ref, NULL);
 			}
-			gnttab_end_foreign_access(priv->rings[i].ref, NULL);
-			free_page((unsigned long)priv->rings[i].intf);
+			free_pages_exact(priv->rings[i].data.in,
+			   1UL << (priv->rings[i].intf->ring_order +
+				   XEN_PAGE_SHIFT));
 		}
+		gnttab_end_foreign_access(priv->rings[i].ref, NULL);
+		free_page((unsigned long)priv->rings[i].intf);
+		priv->rings[i].intf = NULL;
+	}
+}
+
+static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+{
+	if (priv->rings) {
+		xen_9pfs_front_free_rings(priv);
 		kfree(priv->rings);
 	}
 	kfree(priv->tag);
@@ -353,10 +400,65 @@ static void xen_9pfs_front_remove(struct xenbus_device *dev)
 	dev_set_drvdata(&dev->dev, NULL);
 	list_del(&priv->list);
 	write_unlock(&xen_9pfs_lock);
+	wake_up_all(&xen_9pfs_connect_wq);
 
 	xen_9pfs_front_free(priv);
 }
 
+/* Fail the requests the backend held when the rings went away; nothing
+ * will answer them now, and whether they took effect is unknown.
+ */
+static void xen_9pfs_front_fail_sent(struct p9_client *client)
+{
+	struct p9_req_t *req, *next;
+	unsigned long flags;
+	LIST_HEAD(sent);
+	int id;
+
+	spin_lock_irqsave(&client->lock, flags);
+	idr_for_each_entry(&client->reqs, req, id) {
+		if (READ_ONCE(req->status) == REQ_STATUS_SENT &&
+		    p9_req_try_get(req))
+			list_add_tail(&req->req_list, &sent);
+	}
+	spin_unlock_irqrestore(&client->lock, flags);
+
+	list_for_each_entry_safe(req, next, &sent, req_list) {
+		list_del(&req->req_list);
+		req->t_err = -EIO;
+		p9_client_cb(client, req, REQ_STATUS_ERROR);
+	}
+}
+
+static void xen_9pfs_front_disconnect(struct xen_9pfs_front_priv *priv)
+{
+	int i;
+
+	WRITE_ONCE(priv->connected, false);
+	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+		if (priv->rings[i].intf)
+			wake_up(&priv->rings[i].wq);
+	}
+
+	down_write(&priv->rings_sem);
+	if (priv->client) {
+		/* Collect the replies the backend wrote before it went away. */
+		for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+			struct xen_9pfs_dataring *ring = &priv->rings[i];
+
+			if (!ring->intf)
+				break;
+			schedule_work(&ring->work);
+			flush_work(&ring->work);
+		}
+	}
+	xen_9pfs_front_free_rings(priv);
+	up_write(&priv->rings_sem);
+
+	if (priv->client)
+		xen_9pfs_front_fail_sent(priv->client);
+}
+
 static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
 					 struct xen_9pfs_dataring *ring,
 					 unsigned int order)
@@ -416,10 +518,68 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
 	return ret;
 }
 
-static int xen_9pfs_front_init(struct xenbus_device *dev)
+static int xen_9pfs_front_publish(struct xenbus_device *dev,
+				  struct xen_9pfs_front_priv *priv)
 {
 	int ret, i;
 	struct xenbus_transaction xbt;
+
+ again:
+	ret = xenbus_transaction_start(&xbt);
+	if (ret) {
+		xenbus_dev_fatal(dev, ret, "starting transaction");
+		return ret;
+	}
+	ret = xenbus_printf(xbt, dev->nodename, "version", "%u", 1);
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_printf(xbt, dev->nodename, "num-rings", "%u",
+			    XEN_9PFS_NUM_RINGS);
+	if (ret)
+		goto error_xenbus;
+
+	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+		char str[16];
+
+		BUILD_BUG_ON(XEN_9PFS_NUM_RINGS > 9);
+		sprintf(str, "ring-ref%d", i);
+		ret = xenbus_printf(xbt, dev->nodename, str, "%d",
+				    priv->rings[i].ref);
+		if (ret)
+			goto error_xenbus;
+
+		sprintf(str, "event-channel-%d", i);
+		ret = xenbus_printf(xbt, dev->nodename, str, "%u",
+				    priv->rings[i].evtchn);
+		if (ret)
+			goto error_xenbus;
+	}
+	if (!priv->tag) {
+		priv->tag = xenbus_read(xbt, dev->nodename, "tag", NULL);
+		if (IS_ERR(priv->tag)) {
+			ret = PTR_ERR(priv->tag);
+			priv->tag = NULL;
+			goto error_xenbus;
+		}
+	}
+	ret = xenbus_transaction_end(xbt, 0);
+	if (ret) {
+		if (ret == -EAGAIN)
+			goto again;
+		xenbus_dev_fatal(dev, ret, "completing transaction");
+		return ret;
+	}
+	return 0;
+
+ error_xenbus:
+	xenbus_transaction_end(xbt, 1);
+	xenbus_dev_fatal(dev, ret, "writing xenstore");
+	return ret;
+}
+
+static int xen_9pfs_front_init(struct xenbus_device *dev)
+{
+	int ret, i;
 	struct xen_9pfs_front_priv *priv;
 	char *versions, *v;
 	unsigned int max_rings, max_ring_order, len = 0;
@@ -452,6 +612,8 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
 	if (!priv)
 		return -ENOMEM;
 	priv->dev = dev;
+	priv->ring_order = max_ring_order;
+	init_rwsem(&priv->rings_sem);
 	priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
 			      GFP_KERNEL);
 	if (!priv->rings) {
@@ -467,48 +629,9 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
 			goto error;
 	}
 
- again:
-	ret = xenbus_transaction_start(&xbt);
-	if (ret) {
-		xenbus_dev_fatal(dev, ret, "starting transaction");
-		goto error;
-	}
-	ret = xenbus_printf(xbt, dev->nodename, "version", "%u", 1);
-	if (ret)
-		goto error_xenbus;
-	ret = xenbus_printf(xbt, dev->nodename, "num-rings", "%u",
-			    XEN_9PFS_NUM_RINGS);
+	ret = xen_9pfs_front_publish(dev, priv);
 	if (ret)
-		goto error_xenbus;
-
-	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
-		char str[16];
-
-		BUILD_BUG_ON(XEN_9PFS_NUM_RINGS > 9);
-		sprintf(str, "ring-ref%d", i);
-		ret = xenbus_printf(xbt, dev->nodename, str, "%d",
-				    priv->rings[i].ref);
-		if (ret)
-			goto error_xenbus;
-
-		sprintf(str, "event-channel-%d", i);
-		ret = xenbus_printf(xbt, dev->nodename, str, "%u",
-				    priv->rings[i].evtchn);
-		if (ret)
-			goto error_xenbus;
-	}
-	priv->tag = xenbus_read(xbt, dev->nodename, "tag", NULL);
-	if (IS_ERR(priv->tag)) {
-		ret = PTR_ERR(priv->tag);
-		goto error_xenbus;
-	}
-	ret = xenbus_transaction_end(xbt, 0);
-	if (ret) {
-		if (ret == -EAGAIN)
-			goto again;
-		xenbus_dev_fatal(dev, ret, "completing transaction");
 		goto error;
-	}
 
 	write_lock(&xen_9pfs_lock);
 	dev_set_drvdata(&dev->dev, priv);
@@ -518,14 +641,47 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
 	xenbus_switch_state(dev, XenbusStateInitialised);
 	return 0;
 
- error_xenbus:
-	xenbus_transaction_end(xbt, 1);
-	xenbus_dev_fatal(dev, ret, "writing xenstore");
  error:
 	xen_9pfs_front_free(priv);
 	return ret;
 }
 
+/* Give a restored frontend new rings, keeping its clients and their fids. */
+static int xen_9pfs_front_reconnect(struct xenbus_device *dev,
+				    struct xen_9pfs_front_priv *priv)
+{
+	int ret, i;
+
+	if (xenbus_read_unsigned(dev->otherend, "max-rings", 0) <
+	    XEN_9PFS_NUM_RINGS ||
+	    xenbus_read_unsigned(dev->otherend, "max-ring-page-order", 0) <
+	    priv->ring_order) {
+		xenbus_dev_fatal(dev, -EINVAL,
+				 "backend cannot serve the rings in use");
+		return -EINVAL;
+	}
+
+	down_write(&priv->rings_sem);
+	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+		ret = xen_9pfs_front_alloc_dataring(dev, &priv->rings[i],
+						    priv->ring_order);
+		if (ret < 0)
+			goto error;
+	}
+	ret = xen_9pfs_front_publish(dev, priv);
+	if (ret)
+		goto error;
+	up_write(&priv->rings_sem);
+
+	xenbus_switch_state(dev, XenbusStateInitialised);
+	return 0;
+
+ error:
+	xen_9pfs_front_free_rings(priv);
+	up_write(&priv->rings_sem);
+	return ret;
+}
+
 static int xen_9pfs_front_probe(struct xenbus_device *dev,
 				const struct xenbus_device_id *id)
 {
@@ -534,13 +690,30 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
 
 static int xen_9pfs_front_resume(struct xenbus_device *dev)
 {
-	dev_warn(&dev->dev, "suspend/resume unsupported\n");
+	struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
+	int ret;
+
+	if (!priv)
+		return 0;
+
+	xen_9pfs_front_disconnect(priv);
+	/* xenbus set dev->state back to Initialising without publishing it,
+	 * and a backend that still serves the old rings only goes back to
+	 * InitWait once it sees that.
+	 */
+	ret = xenbus_printf(XBT_NIL, dev->nodename, "state", "%d",
+			    XenbusStateInitialising);
+	if (ret)
+		dev_warn(&dev->dev, "publishing Initialising failed: %d\n",
+			 ret);
 	return 0;
 }
 
 static void xen_9pfs_front_changed(struct xenbus_device *dev,
 				   enum xenbus_state backend_state)
 {
+	struct xen_9pfs_front_priv *priv;
+
 	switch (backend_state) {
 	case XenbusStateReconfiguring:
 	case XenbusStateReconfigured:
@@ -553,10 +726,25 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev,
 		if (dev->state != XenbusStateInitialising)
 			break;
 
-		xen_9pfs_front_init(dev);
+		priv = dev_get_drvdata(&dev->dev);
+		if (priv)
+			xen_9pfs_front_reconnect(dev, priv);
+		else
+			xen_9pfs_front_init(dev);
 		break;
 
 	case XenbusStateConnected:
+		/* Until we publish rings, a Connected backend is one still
+		 * serving the rings a resume dropped.
+		 */
+		if (dev->state != XenbusStateInitialised)
+			break;
+
+		priv = dev_get_drvdata(&dev->dev);
+		if (priv) {
+			WRITE_ONCE(priv->connected, true);
+			wake_up_all(&xen_9pfs_connect_wq);
+		}
 		xenbus_switch_state(dev, XenbusStateConnected);
 		break;
 

From d472ad56c17dc71112357bb22f509b43632238ba Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 17 Oct 2026 17:20:22 -0700
Subject: [PATCH 1963/1982] 9p/xen: carry the 9P session across a restore

A forked, restored or imported domain resumes against a new backend
whose fid table is empty, while the guest's 9P clients still hold the
fids of the session they were suspended with. With the transport
reconnected every request on those fids still fails, so even an idle
mount comes back unusable.

When the backend advertises feature-session-transfer, wait at suspend
for the requests in flight to be answered, then ask the backend for its
fid table with Tsession_save and keep the pages in guest memory, where
they survive into whatever domain the guest resumes in. Once a restored
frontend's new backend connects, replay the pages with Tsession_restore
before any request can use the rings. The pages are opaque to the
frontend; the backend validates every entry as it would a walk or open.

Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit e271536038f687af944fe6c0448ea89648862ae9)
---
 net/9p/trans_xen.c | 279 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 276 insertions(+), 3 deletions(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index e98a07c4c7610a..8b473572ae77c8 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -15,6 +15,8 @@
 
 #include <linux/module.h>
 #include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/unaligned.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
@@ -23,6 +25,28 @@
 #define XEN_9PFS_RING_ORDER 9
 #define XEN_9PFS_RING_SIZE(ring)  XEN_FLEX_RING_SIZE(ring->intf->ring_order)
 
+/* Edera backend extension that hands the fid table to the guest at suspend
+ * and takes it back after a restore, advertised as feature-session-transfer.
+ * The ids sit outside the 9P2000.L range. Tsession_save offset[4] answers
+ * Rsession_save total[4] next[4] count[4] entry[count]; Tsession_restore
+ * msize[4] flags[4] count[4] entry[count] answers Rsession_restore
+ * restored[4]. The frontend stores the count[4] entry[count] tails without
+ * looking inside them.
+ */
+#define P9_XEN_TSESSION_SAVE		200
+#define P9_XEN_RSESSION_SAVE		201
+#define P9_XEN_TSESSION_RESTORE		202
+#define P9_XEN_RSESSION_RESTORE		203
+#define P9_XEN_SESSION_RESET		1
+#define XEN_9PFS_CTL_TIMEOUT		(5 * HZ)
+#define XEN_9PFS_DRAIN_TIMEOUT		(2 * HZ)
+
+struct xen_9pfs_session_chunk {
+	struct list_head list;
+	u32 len;
+	u8 data[];
+};
+
 struct xen_9pfs_header {
 	uint32_t size;
 	uint8_t id;
@@ -61,6 +85,17 @@ struct xen_9pfs_front_priv {
 	 */
 	struct rw_semaphore rings_sem;
 	bool connected;
+
+	/* Session chunks saved at the last suspend, in guest memory so that
+	 * they survive into a restored or forked domain.
+	 */
+	struct list_head session;
+	/* A control request on ring 0, answered with tag P9_NOTAG. */
+	bool ctl_pending;
+	struct completion ctl_done;
+	u8 *ctl_reply;
+	u32 ctl_reply_cap;
+	u32 ctl_reply_len;
 };
 
 static LIST_HEAD(xen_9pfs_devs);
@@ -272,6 +307,29 @@ static void p9_xen_response(struct work_struct *work)
 				     masked_prod, &masked_cons,
 				     XEN_9PFS_RING_SIZE(ring));
 
+		/* A client's own P9_NOTAG request, Tversion, never maps to
+		 * ring 0; see xen_9pfs_front_ctl().
+		 */
+		if (ring == priv->rings && h.tag == P9_NOTAG &&
+		    READ_ONCE(priv->ctl_pending)) {
+			if (h.size <= priv->ctl_reply_cap) {
+				u32 size = XEN_9PFS_RING_SIZE(ring);
+
+				masked_cons = xen_9pfs_mask(cons, size);
+				xen_9pfs_read_packet(priv->ctl_reply,
+						     ring->data.in, h.size,
+						     masked_prod, &masked_cons,
+						     size);
+				priv->ctl_reply_len = h.size;
+			}
+			virt_mb();		/* read ring before freeing it */
+			cons += h.size;
+			ring->intf->in_cons = cons;
+			WRITE_ONCE(priv->ctl_pending, false);
+			complete(&priv->ctl_done);
+			continue;
+		}
+
 		req = p9_tag_lookup(priv->client, h.tag);
 		if (!req || req->status != REQ_STATUS_SENT) {
 			dev_warn(&priv->dev->dev, "Wrong req tag=%x\n", h.tag);
@@ -377,12 +435,23 @@ static void xen_9pfs_front_free_rings(struct xen_9pfs_front_priv *priv)
 	}
 }
 
+static void xen_9pfs_front_session_free(struct xen_9pfs_front_priv *priv)
+{
+	struct xen_9pfs_session_chunk *chunk, *next;
+
+	list_for_each_entry_safe(chunk, next, &priv->session, list) {
+		list_del(&chunk->list);
+		kvfree(chunk);
+	}
+}
+
 static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
 {
 	if (priv->rings) {
 		xen_9pfs_front_free_rings(priv);
 		kfree(priv->rings);
 	}
+	xen_9pfs_front_session_free(priv);
 	kfree(priv->tag);
 	kfree(priv);
 }
@@ -459,6 +528,159 @@ static void xen_9pfs_front_disconnect(struct xen_9pfs_front_priv *priv)
 		xen_9pfs_front_fail_sent(priv->client);
 }
 
+/* Send control request @req on ring 0 and wait for the backend's answer in
+ * @reply, which must carry @id and at least @body bytes after the header.
+ * Returns the reply length or a negative errno. Callers hold rings_sem.
+ */
+static int xen_9pfs_front_ctl(struct xen_9pfs_front_priv *priv,
+			      const u8 *req, u32 len, u8 *reply, u32 cap,
+			      u8 id, u32 body)
+{
+	struct xen_9pfs_dataring *ring = &priv->rings[0];
+	RING_IDX cons, prod, masked_cons, masked_prod;
+	unsigned long flags;
+	u32 reply_len;
+
+	BUILD_BUG_ON(P9_NOTAG % XEN_9PFS_NUM_RINGS == 0);
+	if (len > XEN_9PFS_RING_SIZE(ring))
+		return -E2BIG;
+	if (!wait_event_timeout(ring->wq, p9_xen_write_todo(ring, len),
+				XEN_9PFS_CTL_TIMEOUT))
+		return -ETIMEDOUT;
+
+	reinit_completion(&priv->ctl_done);
+	priv->ctl_reply = reply;
+	priv->ctl_reply_cap = cap;
+	priv->ctl_reply_len = 0;
+	WRITE_ONCE(priv->ctl_pending, true);
+
+	spin_lock_irqsave(&ring->lock, flags);
+	cons = ring->intf->out_cons;
+	prod = ring->intf->out_prod;
+	virt_mb();			/* read indexes before the ring */
+	if (XEN_9PFS_RING_SIZE(ring) -
+	    xen_9pfs_queued(prod, cons, XEN_9PFS_RING_SIZE(ring)) < len) {
+		spin_unlock_irqrestore(&ring->lock, flags);
+		WRITE_ONCE(priv->ctl_pending, false);
+		return -EBUSY;
+	}
+	masked_prod = xen_9pfs_mask(prod, XEN_9PFS_RING_SIZE(ring));
+	masked_cons = xen_9pfs_mask(cons, XEN_9PFS_RING_SIZE(ring));
+	xen_9pfs_write_packet(ring->data.out, req, len, &masked_prod,
+			      masked_cons, XEN_9PFS_RING_SIZE(ring));
+	virt_wmb();			/* write ring before updating pointer */
+	prod += len;
+	ring->intf->out_prod = prod;
+	spin_unlock_irqrestore(&ring->lock, flags);
+	notify_remote_via_irq(ring->irq);
+
+	if (!wait_for_completion_timeout(&priv->ctl_done,
+					 XEN_9PFS_CTL_TIMEOUT)) {
+		WRITE_ONCE(priv->ctl_pending, false);
+		/* A response worker may already be copying into @reply. */
+		flush_work(&ring->work);
+		return -ETIMEDOUT;
+	}
+
+	reply_len = priv->ctl_reply_len;
+	if (reply_len < P9_HDRSZ || get_unaligned_le32(reply) != reply_len)
+		return -EPROTO;
+	if (reply[4] == P9_RLERROR && reply_len >= P9_HDRSZ + 4)
+		return -(int)get_unaligned_le32(reply + P9_HDRSZ);
+	if (reply[4] != id || reply_len < P9_HDRSZ + body)
+		return -EPROTO;
+	return reply_len;
+}
+
+static int xen_9pfs_front_suspend(struct xenbus_device *dev)
+{
+	struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
+	struct xen_9pfs_session_chunk *chunk;
+	u32 offset = 0, total, next, len;
+	struct p9_client *client;
+	u8 req[P9_HDRSZ + 4];
+	unsigned long deadline;
+	struct p9_req_t *p9_req;
+	unsigned long flags;
+	bool idle;
+	u8 *reply;
+	int ret, id;
+
+	if (!priv)
+		return 0;
+	xen_9pfs_front_session_free(priv);
+	if (!xenbus_read_unsigned(dev->otherend, "feature-session-transfer", 0))
+		return 0;
+
+	down_read(&priv->rings_sem);
+	client = priv->client;
+	if (!READ_ONCE(priv->connected) || !client)
+		goto out;
+
+	/* Let what is in flight finish first, so that the saved fids match
+	 * what the guest has seen answered.
+	 */
+	deadline = jiffies + XEN_9PFS_DRAIN_TIMEOUT;
+	do {
+		idle = true;
+		spin_lock_irqsave(&client->lock, flags);
+		idr_for_each_entry(&client->reqs, p9_req, id) {
+			if (READ_ONCE(p9_req->status) == REQ_STATUS_SENT) {
+				idle = false;
+				break;
+			}
+		}
+		spin_unlock_irqrestore(&client->lock, flags);
+		if (idle)
+			break;
+		usleep_range(1000, 2000);
+	} while (time_before(jiffies, deadline));
+
+	reply = kvmalloc(XEN_9PFS_RING_SIZE(priv->rings), GFP_KERNEL);
+	if (!reply) {
+		ret = -ENOMEM;
+		goto failed;
+	}
+	do {
+		put_unaligned_le32(sizeof(req), req);
+		req[4] = P9_XEN_TSESSION_SAVE;
+		put_unaligned_le16(P9_NOTAG, req + 5);
+		put_unaligned_le32(offset, req + P9_HDRSZ);
+		ret = xen_9pfs_front_ctl(priv, req, sizeof(req), reply,
+					 XEN_9PFS_RING_SIZE(priv->rings),
+					 P9_XEN_RSESSION_SAVE, 12);
+		if (ret < 0)
+			break;
+		total = get_unaligned_le32(reply + P9_HDRSZ);
+		next = get_unaligned_le32(reply + P9_HDRSZ + 4);
+		len = ret - (P9_HDRSZ + 8);
+		ret = 0;
+		if (next <= offset && next < total) {
+			ret = -EPROTO;
+			break;
+		}
+		chunk = kvmalloc(struct_size(chunk, data, len), GFP_KERNEL);
+		if (!chunk) {
+			ret = -ENOMEM;
+			break;
+		}
+		chunk->len = len;
+		memcpy(chunk->data, reply + P9_HDRSZ + 8, len);
+		list_add_tail(&chunk->list, &priv->session);
+		offset = next;
+	} while (offset < total);
+	kvfree(reply);
+
+ failed:
+	if (ret) {
+		dev_warn(&dev->dev, "saving the 9P session failed: %d\n", ret);
+		xen_9pfs_front_session_free(priv);
+	}
+ out:
+	up_read(&priv->rings_sem);
+	return 0;
+}
+
 static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
 					 struct xen_9pfs_dataring *ring,
 					 unsigned int order)
@@ -614,6 +836,8 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
 	priv->dev = dev;
 	priv->ring_order = max_ring_order;
 	init_rwsem(&priv->rings_sem);
+	INIT_LIST_HEAD(&priv->session);
+	init_completion(&priv->ctl_done);
 	priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
 			      GFP_KERNEL);
 	if (!priv->rings) {
@@ -712,7 +936,12 @@ static int xen_9pfs_front_resume(struct xenbus_device *dev)
 static void xen_9pfs_front_changed(struct xenbus_device *dev,
 				   enum xenbus_state backend_state)
 {
+	struct xen_9pfs_session_chunk *chunk;
 	struct xen_9pfs_front_priv *priv;
+	u8 reply[P9_HDRSZ + 4];
+	u32 len, flags;
+	int ret;
+	u8 *req;
 
 	switch (backend_state) {
 	case XenbusStateReconfiguring:
@@ -741,10 +970,53 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev,
 			break;
 
 		priv = dev_get_drvdata(&dev->dev);
-		if (priv) {
-			WRITE_ONCE(priv->connected, true);
-			wake_up_all(&xen_9pfs_connect_wq);
+		if (!priv) {
+			xenbus_switch_state(dev, XenbusStateConnected);
+			break;
+		}
+
+		/* Replay the fids saved at suspend before any request can use
+		 * them.
+		 */
+		down_read(&priv->rings_sem);
+		ret = 0;
+		flags = P9_XEN_SESSION_RESET;
+		if (!list_empty(&priv->session) && priv->client &&
+		    xenbus_read_unsigned(dev->otherend,
+					 "feature-session-transfer", 0)) {
+			list_for_each_entry(chunk, &priv->session, list) {
+				len = P9_HDRSZ + 8 + chunk->len;
+				req = kvmalloc(len, GFP_KERNEL);
+				if (!req) {
+					ret = -ENOMEM;
+					break;
+				}
+				put_unaligned_le32(len, req);
+				req[4] = P9_XEN_TSESSION_RESTORE;
+				put_unaligned_le16(P9_NOTAG, req + 5);
+				put_unaligned_le32(priv->client->msize,
+						   req + P9_HDRSZ);
+				put_unaligned_le32(flags, req + P9_HDRSZ + 4);
+				memcpy(req + P9_HDRSZ + 8, chunk->data,
+				       chunk->len);
+				ret = xen_9pfs_front_ctl(priv, req, len, reply,
+							 sizeof(reply),
+							 P9_XEN_RSESSION_RESTORE,
+							 4);
+				kvfree(req);
+				if (ret < 0)
+					break;
+				flags = 0;
+			}
 		}
+		up_read(&priv->rings_sem);
+		if (ret < 0)
+			dev_warn(&dev->dev, "restoring the 9P session failed: %d\n",
+				 ret);
+		xen_9pfs_front_session_free(priv);
+
+		WRITE_ONCE(priv->connected, true);
+		wake_up_all(&xen_9pfs_connect_wq);
 		xenbus_switch_state(dev, XenbusStateConnected);
 		break;
 
@@ -762,6 +1034,7 @@ static struct xenbus_driver xen_9pfs_front_driver = {
 	.ids = xen_9pfs_front_ids,
 	.probe = xen_9pfs_front_probe,
 	.remove = xen_9pfs_front_remove,
+	.suspend = xen_9pfs_front_suspend,
 	.resume = xen_9pfs_front_resume,
 	.otherend_changed = xen_9pfs_front_changed,
 };

From ea70a931dc5a9abcc60716e5d91c6b41c4157a4e Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sun, 18 Oct 2026 10:06:22 -0700
Subject: [PATCH 1964/1982] 9p/xen: advertise session transfer to the toolstack

The toolstack has to know whether a guest can carry its 9P session into a
new backend before it exports the domain, because a guest that cannot
comes back with every open file on its mounts unusable. Until now only the
backend advertised the feature, and the frontend's support was invisible
from dom0.

Publish feature-session-transfer = 1 in the frontend's own xenstore
directory, next to version and num-rings.

Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit 97d826b4ad059488167365ec3c52183778139546)
---
 net/9p/trans_xen.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 8b473572ae77c8..a6ef4d07a0cd4b 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -759,6 +759,13 @@ static int xen_9pfs_front_publish(struct xenbus_device *dev,
 			    XEN_9PFS_NUM_RINGS);
 	if (ret)
 		goto error_xenbus;
+	/* Lets the toolstack tell, before it exports a domain, whether its
+	 * open files can follow it into a new backend.
+	 */
+	ret = xenbus_printf(xbt, dev->nodename, "feature-session-transfer",
+			    "%u", 1);
+	if (ret)
+		goto error_xenbus;
 
 	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
 		char str[16];

From 063a98f905938d99e7a6cc0e0010474c27a59b0c Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sun, 18 Oct 2026 17:50:23 -0700
Subject: [PATCH 1965/1982] x86/xen: include the Xen types before
 interface/memory.h

arch/x86/xen/enlighten.c includes xen/interface/memory.h for
XENMEM_maximum_reservation, but memory.h uses xen_ulong_t, domid_t and
GUEST_HANDLE without including where they are defined,
xen/interface/xen.h. Other configurations reach those through an earlier
include. The zone-tiny configuration does not, and fails to build with
CONFIG_WERROR=y:

  include/xen/interface/physdev.h:41:5: error: unknown type name 'xen_ulong_t'

Include xen/interface/xen.h first, as arch/arm/xen/enlighten.c does.

Signed-off-by: Alex Zenla <alex@edera.dev>
(cherry picked from commit c20012baca75a65885c61d75de60f4aa3410f14c)
---
 arch/x86/xen/enlighten.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 852610dfe704bd..651768313b421e 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,6 +10,7 @@
 
 #include <xen/xen.h>
 #include <xen/features.h>
+#include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/version.h>

From b119d2ea8f84c15063d0aeb8a99ed913b4ca8d61 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Mon, 19 Oct 2026 11:13:52 -0700
Subject: [PATCH 1966/1982] xen/unpopulated-alloc: borrow from other nodes
 before carving a region

A node whose pool is short called fill_list() even when other nodes
still held free pages. fill_list() takes new address space from
iomem_resource, which on a PVH dom0 can overlap MMIO that Xen has
identity mapped. A later grant map onto such a gfn makes Xen refuse the
p2m change and crash dom0.

Carve a new region only when every node's pool is short, and otherwise
take pages from the preferred node first, then the others. Return pages
to the pool of their own node when the PV p2m allocation fails.

(cherry picked from commit a071d8580f210ea627780a94b7e2af14c20fa17f)
---
 drivers/xen/unpopulated-alloc.c | 38 +++++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index ea9c768954596d..9f020c069c78dd 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -190,14 +190,15 @@ static int fill_list(unsigned int nr_pages, int node)
  * memremap_pages() against @node, so page_to_nid() reports @node for
  * every returned page.  Callers that know the host node of a foreign
  * frame should pass it here to keep page_to_nid in agreement with the
- * actual host placement after a subsequent grant-map.
+ * actual host placement after a subsequent grant-map.  When the pool of
+ * @node is short, pages come from the other nodes' pools instead.
  *
  * Returns 0 on success, error otherwise.
  */
 int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 				     int node)
 {
-	unsigned int i;
+	unsigned int i, total = 0;
 	int ret = 0;
 
 	/*
@@ -211,18 +212,30 @@ int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 	node = xen_unpopulated_clamp_node(node);
 
 	mutex_lock(&list_lock);
-	if (list_count[node] < nr_pages) {
-		ret = fill_list(nr_pages - list_count[node], node);
+
+	/*
+	 * A new region comes from free address space, which can overlap MMIO
+	 * the hypervisor has mapped into the guest. Only carve one when every
+	 * node's pool is short, and borrow from other nodes before that.
+	 */
+	for (i = 0; i < MAX_NUMNODES; i++)
+		total += list_count[i];
+	if (total < nr_pages) {
+		ret = fill_list(nr_pages - total, node);
 		if (ret)
 			goto out;
 	}
 
 	for (i = 0; i < nr_pages; i++) {
-		struct page *pg = page_list[node];
+		int src = node;
+		struct page *pg;
+
+		while (!page_list[src])
+			src = (src + 1) % MAX_NUMNODES;
 
-		BUG_ON(!pg);
-		page_list[node] = pg->zone_device_data;
-		list_count[node]--;
+		pg = page_list[src];
+		page_list[src] = pg->zone_device_data;
+		list_count[src]--;
 		pages[i] = pg;
 
 #ifdef CONFIG_XEN_HAVE_PVMMU
@@ -232,9 +245,12 @@ int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 				unsigned int j;
 
 				for (j = 0; j <= i; j++) {
-					pages[j]->zone_device_data = page_list[node];
-					page_list[node] = pages[j];
-					list_count[node]++;
+					int dst = xen_unpopulated_clamp_node(
+							page_to_nid(pages[j]));
+
+					pages[j]->zone_device_data = page_list[dst];
+					page_list[dst] = pages[j];
+					list_count[dst]++;
 				}
 				goto out;
 			}

From c3e5abddef6fd7adf89abe95f693e013fc00a8de Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Mon, 19 Oct 2026 11:29:23 -0700
Subject: [PATCH 1967/1982] xen/unpopulated-alloc: never hand out another
 node's pages from the node variant

Borrowing across nodes made xen_alloc_unpopulated_pages_node() best
effort, so a caller that asked for a node could get pages of another.

The node variant now takes pages only from the requested node's pool and
fails with -ENOMEM when it is short. It no longer carves a region.
xen_alloc_unpopulated_pages() has no node requirement: it prefers the
local pool, borrows from other nodes, and carves a region only when
every pool is short. xenbus falls back to it when the node's pool is
short, and gnttab_alloc_pages_node() uses it for NUMA_NO_NODE.

(cherry picked from commit fc166a63bcddb1730f676ba394fb09b515f647bf)
---
 drivers/xen/grant-table.c          |   5 +-
 drivers/xen/unpopulated-alloc.c    | 115 ++++++++++++++++++-----------
 drivers/xen/xenbus/xenbus_client.c |   4 +
 3 files changed, 78 insertions(+), 46 deletions(-)

diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 879e08104805a4..cb79be036cc2ab 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -984,7 +984,10 @@ int gnttab_alloc_pages_node(int nr_pages, struct page **pages, int node)
 {
 	int ret;
 
-	ret = xen_alloc_unpopulated_pages_node(nr_pages, pages, node);
+	if (node == NUMA_NO_NODE)
+		ret = xen_alloc_unpopulated_pages(nr_pages, pages);
+	else
+		ret = xen_alloc_unpopulated_pages_node(nr_pages, pages, node);
 	if (ret < 0)
 		return ret;
 
diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index 9f020c069c78dd..73ea5adf786615 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -180,51 +180,19 @@ static int fill_list(unsigned int nr_pages, int node)
 	return ret;
 }
 
-/**
- * xen_alloc_unpopulated_pages_node - alloc unpopulated pages on a node
- * @nr_pages: Number of pages
- * @pages: pages returned
- * @node: Preferred Linux node id, or NUMA_NO_NODE for current CPU's node
- *
- * The returned pages are drawn from a per-node pool registered with
- * memremap_pages() against @node, so page_to_nid() reports @node for
- * every returned page.  Callers that know the host node of a foreign
- * frame should pass it here to keep page_to_nid in agreement with the
- * actual host placement after a subsequent grant-map.  When the pool of
- * @node is short, pages come from the other nodes' pools instead.
- *
- * Returns 0 on success, error otherwise.
+/*
+ * Take @nr_pages from the pool of @node, or from any node's pool when @any is
+ * set.  Called with list_lock held.  Never carves a new region.
  */
-int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
-				     int node)
+static int pop_pages(unsigned int nr_pages, struct page **pages, int node,
+		     bool any)
 {
 	unsigned int i, total = 0;
-	int ret = 0;
-
-	/*
-	 * Fallback to default behavior if we do not have any suitable resource
-	 * to allocate required region from and as the result we won't be able to
-	 * construct pages.
-	 */
-	if (!target_resource)
-		return xen_alloc_ballooned_pages(nr_pages, pages);
-
-	node = xen_unpopulated_clamp_node(node);
-
-	mutex_lock(&list_lock);
 
-	/*
-	 * A new region comes from free address space, which can overlap MMIO
-	 * the hypervisor has mapped into the guest. Only carve one when every
-	 * node's pool is short, and borrow from other nodes before that.
-	 */
 	for (i = 0; i < MAX_NUMNODES; i++)
 		total += list_count[i];
-	if (total < nr_pages) {
-		ret = fill_list(nr_pages - total, node);
-		if (ret)
-			goto out;
-	}
+	if ((any ? total : list_count[node]) < nr_pages)
+		return -ENOMEM;
 
 	for (i = 0; i < nr_pages; i++) {
 		int src = node;
@@ -240,7 +208,8 @@ int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 
 #ifdef CONFIG_XEN_HAVE_PVMMU
 		if (xen_pv_domain()) {
-			ret = xen_alloc_p2m_entry(page_to_pfn(pg));
+			int ret = xen_alloc_p2m_entry(page_to_pfn(pg));
+
 			if (ret < 0) {
 				unsigned int j;
 
@@ -252,14 +221,53 @@ int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 					page_list[dst] = pages[j];
 					list_count[dst]++;
 				}
-				goto out;
+				return ret;
 			}
 		}
 #endif
 	}
 
-out:
+	return 0;
+}
+
+/**
+ * xen_alloc_unpopulated_pages_node - alloc unpopulated pages on a node
+ * @nr_pages: Number of pages
+ * @pages: pages returned
+ * @node: Linux node id, or NUMA_NO_NODE for current CPU's node
+ *
+ * The returned pages are drawn from the per-node pool registered with
+ * memremap_pages() against @node, so page_to_nid() reports @node for
+ * every returned page.  Callers that know the host node of a foreign
+ * frame should pass it here to keep page_to_nid in agreement with the
+ * actual host placement after a subsequent grant-map.
+ *
+ * Fails with -ENOMEM when the pool of @node is short rather than returning
+ * pages of another node.  A new region is not carved here: it comes from free
+ * address space, which can overlap MMIO the hypervisor has mapped into the
+ * guest, so only xen_alloc_unpopulated_pages() does it.
+ *
+ * Returns 0 on success, error otherwise.
+ */
+int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
+				     int node)
+{
+	int ret;
+
+	/*
+	 * Fallback to default behavior if we do not have any suitable resource
+	 * to allocate required region from and as the result we won't be able to
+	 * construct pages.
+	 */
+	if (!target_resource)
+		return xen_alloc_ballooned_pages(nr_pages, pages);
+
+	node = xen_unpopulated_clamp_node(node);
+
+	mutex_lock(&list_lock);
+	ret = pop_pages(nr_pages, pages, node, false);
 	mutex_unlock(&list_lock);
+
 	return ret;
 }
 EXPORT_SYMBOL(xen_alloc_unpopulated_pages_node);
@@ -270,12 +278,29 @@ EXPORT_SYMBOL(xen_alloc_unpopulated_pages_node);
  * @pages: pages returned
  * @return 0 on success, error otherwise
  *
- * Equivalent to xen_alloc_unpopulated_pages_node() with the current
- * CPU's node as the preference.
+ * Prefers the pool of the current CPU's node, then takes from the other
+ * nodes' pools.  A new region is carved only when every pool is short.
  */
 int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 {
-	return xen_alloc_unpopulated_pages_node(nr_pages, pages, numa_node_id());
+	unsigned int i, total = 0;
+	int node = numa_node_id();
+	int ret;
+
+	if (!target_resource)
+		return xen_alloc_ballooned_pages(nr_pages, pages);
+
+	mutex_lock(&list_lock);
+	for (i = 0; i < MAX_NUMNODES; i++)
+		total += list_count[i];
+	ret = 0;
+	if (total < nr_pages)
+		ret = fill_list(nr_pages - total, node);
+	if (!ret)
+		ret = pop_pages(nr_pages, pages, node, true);
+	mutex_unlock(&list_lock);
+
+	return ret;
 }
 EXPORT_SYMBOL(xen_alloc_unpopulated_pages);
 
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index d3108f9fab324c..d2bd45e8d3ee47 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -829,6 +829,10 @@ static int xenbus_map_ring_hvm(struct xenbus_device *dev,
 		err = xen_alloc_unpopulated_pages_node(nr_pages,
 						       node->hvm.pages,
 						       host_node);
+		/* The node's pool is short; the ring still works from any node. */
+		if (err)
+			err = xen_alloc_unpopulated_pages(nr_pages,
+							  node->hvm.pages);
 		if (err) {
 			/*
 			 * Pages already gone; clear the array so the

From b80e43d54594f2af8996361d25fd2440dbdfa215 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 23 Oct 2026 09:26:42 -0700
Subject: [PATCH 1968/1982] automation: request reviews of LTS backports from
 the patch authors

Each proposed backport now asks the GitHub accounts of the mainline
commits' authors to review it, falling back to the mainline pull
request's author when no commit author maps to an account. Bots are left
out. Reviewers are requested one at a time, so one author who cannot
review here does not stop the rest; that is a warning, not a failure.
---
 .github/workflows/lts-backport.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lts-backport.yml b/.github/workflows/lts-backport.yml
index e60c42b6a3a4c5..c3f12d4be33791 100644
--- a/.github/workflows/lts-backport.yml
+++ b/.github/workflows/lts-backport.yml
@@ -125,7 +125,13 @@ jobs:
           git fetch --no-tags --filter=blob:none origin "refs/pull/$PR/head"
           head=$(git rev-parse FETCH_HEAD)
           echo "head=$head" >> "$GITHUB_OUTPUT"
-          gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR/commits" -q '.[].sha' >"$out/pr-commits"
+          gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR/commits" >"$out/pr-commits.json"
+          jq -r '.[].sha' "$out/pr-commits.json" >"$out/pr-commits"
+          # Reviewers for the backport: the GitHub accounts of the commits'
+          # authors, or the pull request's author when none of them has one.
+          # Bots are left out.
+          jq -r '.[].author | select(.type? == "User") | .login' "$out/pr-commits.json" | sort -u >"$out/reviewers"
+          [ -s "$out/reviewers" ] || jq -r 'select(.user.type == "User") | .user.login' <<<"$pr" >"$out/reviewers"
           while read -r c; do
             git merge-base --is-ancestor "$c" "$head"
             printf '%s\t%s\n' "$c" "$(git log -1 --format=%s "$c")"
@@ -713,6 +719,14 @@ jobs:
             url=$(GH_TOKEN=$APP_TOKEN gh pr create --repo "$R" --base "$TARGET" --head "$BRANCH" \
               --title "Backport #$PR to 6.18-lts: $TITLE" --body-file "$body")
           fi
+          # One at a time: GitHub refuses the whole request if any one of
+          # them cannot review here, such as an author without access to the
+          # repository. A refresh asks them again, since the branch changed.
+          n=${url##*/}
+          while read -r who; do
+            GH_TOKEN=$APP_TOKEN gh api -X POST "repos/$R/pulls/$n/requested_reviewers" -f "reviewers[]=$who" >/dev/null ||
+              echo "::warning::Could not request a review of #$n from @$who."
+          done <"$in/plan/reviewers"
           set_label none
           {
             echo "proposed in $url"

From b04990f7d0185d1055fb0b0b7093ee04df522cef Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 23 Oct 2026 10:00:19 -0700
Subject: [PATCH 1969/1982] automation: allow landing an approved rebase by
 hand

GitHub starts no workflow for a review of a pull request it cannot
compute a merge ref for, and a rebase often conflicts with the tree it
replaces: approving edera/mainline's #48 started nothing, and it had to
be landed by hand.

The land workflow can now also be run with a pull request number. It
then reads the head, branch and base from the pull request, requires
the same rebase/edera-6.18-lts/... branch into edera/6.18-lts, and
lands on the most recent approval of the current head from a reviewer
whose latest review is still an approval. Everything after that, the
write-access check, the tip check, the backup and the leased push, is
unchanged.
---
 .github/workflows/rebase-land.yml | 56 +++++++++++++++++++++++++++----
 1 file changed, 49 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/rebase-land.yml b/.github/workflows/rebase-land.yml
index 87eeda680ae715..a1d0718539dd49 100644
--- a/.github/workflows/rebase-land.yml
+++ b/.github/workflows/rebase-land.yml
@@ -10,7 +10,11 @@ name: Land upstream rebase
 #
 # A review runs this workflow from the pull request's merge ref, which is why
 # it lives on edera/6.18-lts. edera/mainline carries its own copy for its
-# own rebases.
+# own rebases. GitHub starts nothing for a pull request it cannot compute a
+# merge ref for, and a rebase often conflicts with the tree it replaces, so
+# an approval can also be landed by running this workflow with the pull
+# request's number. It then lands on the most recent approval of the current
+# head, from a reviewer whose latest review is still an approval.
 #
 # What has to hold before anything is pushed:
 #   - the pull request is a rebase/edera-6.18-lts/... branch from this
@@ -26,6 +30,12 @@ name: Land upstream rebase
 on:
   pull_request_review:
     types: [submitted]
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: Number of the approved rebase pull request to land
+        type: string
+        required: true
 
 permissions:
   contents: read
@@ -33,16 +43,17 @@ permissions:
 concurrency:
   # Shared with the nightly's publish jobs, so nothing else moves the tree
   # while this runs.
-  group: push-${{ github.event.pull_request.base.ref }}
+  group: push-edera/6.18-lts
   cancel-in-progress: false
 
 jobs:
   land:
     if: >-
-      github.event.review.state == 'approved'
-      && github.event.pull_request.head.repo.full_name == github.repository
-      && github.event.pull_request.base.ref == 'edera/6.18-lts'
-      && startsWith(github.event.pull_request.head.ref, 'rebase/edera-6.18-lts/')
+      github.event_name == 'workflow_dispatch'
+      || (github.event.review.state == 'approved'
+          && github.event.pull_request.head.repo.full_name == github.repository
+          && github.event.pull_request.base.ref == 'edera/6.18-lts'
+          && startsWith(github.event.pull_request.head.ref, 'rebase/edera-6.18-lts/'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -68,7 +79,7 @@ jobs:
         env:
           APP_TOKEN: ${{ steps.app.outputs.token }}
           JOB_TOKEN: ${{ github.token }}
-          PR: ${{ github.event.pull_request.number }}
+          PR: ${{ github.event.pull_request.number || inputs.pr }}
           BASE: ${{ github.event.pull_request.base.ref }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -80,6 +91,37 @@ jobs:
             GH_TOKEN=$JOB_TOKEN gh pr comment "$PR" --repo "$GITHUB_REPOSITORY" --body "$1"
           }
 
+          # Run by hand: take from the pull request itself what a review
+          # event would have carried.
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
+            if ! [[ $PR =~ ^[0-9]+$ ]]; then
+              echo "::error::pr must be a pull request number, not '$PR'."
+              exit 1
+            fi
+            pr=$(GH_TOKEN=$JOB_TOKEN gh api "repos/$GITHUB_REPOSITORY/pulls/$PR")
+            BASE=$(jq -r .base.ref <<<"$pr")
+            HEAD_REF=$(jq -r .head.ref <<<"$pr")
+            HEAD_SHA=$(jq -r .head.sha <<<"$pr")
+            if [ "$(jq -r .state <<<"$pr")" != open ] \
+              || [ "$(jq -r .head.repo.full_name <<<"$pr")" != "$GITHUB_REPOSITORY" ] \
+              || [ "$BASE" != edera/6.18-lts ] \
+              || [[ $HEAD_REF != rebase/edera-6.18-lts/* ]]; then
+              echo "::error::#$PR is not an open rebase/edera-6.18-lts/... pull request from this repository into edera/6.18-lts."
+              exit 1
+            fi
+            APPROVER=$(GH_TOKEN=$JOB_TOKEN gh api --paginate "repos/$GITHUB_REPOSITORY/pulls/$PR/reviews" |
+              jq -rs --arg sha "$HEAD_SHA" '
+                add | map(select(.state != "COMMENTED" and .state != "PENDING"))
+                | group_by(.user.login) | map(last)
+                | map(select(.state == "APPROVED" and .commit_id == $sha))
+                | sort_by(.submitted_at) | last | .user.login // empty')
+            if [ -z "$APPROVER" ]; then
+              say "Not landed: nobody's current review approves the head, \`${HEAD_SHA:0:12}\`. Approve it, then run this again."
+              exit 1
+            fi
+            REVIEWED_SHA=$HEAD_SHA
+          fi
+
           if [ "$REVIEWED_SHA" != "$HEAD_SHA" ]; then
             say "Not landed: the approval was for \`${REVIEWED_SHA:0:12}\`, but the head is now \`${HEAD_SHA:0:12}\`. Approve the current head to land it."
             exit 1

From e69b4253688d3a1a811a36c70de5b7f5030a1f67 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Fri, 23 Oct 2026 10:37:17 -0700
Subject: [PATCH 1970/1982] automation: audit edera/6.18-lts weekly for missing
 mainline commits

The swap-over to the automated rebase dropped two boot performance
commits from edera/6.18-lts that edera/mainline still had (the early
CPU frequency from the hypervisor, and waking the boot device wait when
a backend changes state), and nothing noticed until they were ported by
hand. The per-pull-request backport cannot catch that: it only looks at
the pull request that just merged.

Add an audit mode to kernel-nightly.yml (audit=true runs lts-audit.yml)
that lists every Edera commit on edera/mainline the LTS tree lacks,
with pending-backports.sh and the backports' own skip list, and keeps
one issue open about them. Open backport pull requests and waiting or
stuck backports are matched to each commit by subject. Claude then
triages the rest read-only, following .automation/skills/lts-audit/,
saying which are really missing and which were ported in another form,
are upstream already or do not apply to 6.18. Its notes only annotate
the issue: the list itself comes from git.

The issue is edited in place each run, gets a comment when the set of
missing commits changes, and is closed once nothing is missing.
---
 .automation/skills/lts-audit/SKILL.md | 125 ++++++++
 .github/workflows/kernel-nightly.yml  |  36 ++-
 .github/workflows/lts-audit.yml       | 396 ++++++++++++++++++++++++++
 3 files changed, 549 insertions(+), 8 deletions(-)
 create mode 100644 .automation/skills/lts-audit/SKILL.md
 create mode 100644 .github/workflows/lts-audit.yml

diff --git a/.automation/skills/lts-audit/SKILL.md b/.automation/skills/lts-audit/SKILL.md
new file mode 100644
index 00000000000000..f772251e277860
--- /dev/null
+++ b/.automation/skills/lts-audit/SKILL.md
@@ -0,0 +1,125 @@
+---
+name: lts-audit
+description: Weekly audit of edera/6.18-lts for Edera commits from edera/mainline that it lacks, run unattended in CI by .github/workflows/lts-audit.yml. Covers telling a commit that is really missing from one that was ported in another form or does not apply to 6.18, and the triage notes that go into the audit issue.
+---
+
+# LTS audit triage
+
+Edera kernel work lands on `edera/mainline` first and flows down to
+`edera/6.18-lts`, one backport pull request per mainline pull request. Some
+commits still fall through. The workflow has already listed, from git alone,
+every Edera commit on mainline that the LTS tree does not seem to have, and
+it files that list as an issue whatever you say. Your job is to tell the
+maintainers which of those are **really** missing, and what to do about the
+rest.
+
+The list comes from `pending-backports.sh`, which counts a mainline commit as
+present on the LTS tree only when the LTS series has a commit with the same
+subject (ignoring a trailing version tag such as ` (6.18)`) or the same
+patch-id. So a commit can be listed although it is there: ported under a
+reworded subject and with a changed diff, folded into another commit, or
+already in `linux-6.18.y` upstream. And a commit can be listed because it
+does not belong on 6.18 at all.
+
+This runs unattended. Nobody can answer a question. Everything a maintainer
+needs has to end up in the report.
+
+## Inputs
+
+The workflow gives you, in the prompt:
+
+- `LTS_TIP`: the `edera/6.18-lts` commit audited (checked out). Local branch
+  `lts-upstream` is its upstream, `linux-6.18.y`; the Edera series is
+  `<lts-base>..LTS_TIP`, where `<lts-base>` is their merge-base.
+- `MAINLINE_TIP`: the `edera/mainline` commit audited (fetched). Local branch
+  `mainline-upstream` is its upstream, Linus' `master`, and `<mainline-base>`
+  their merge-base.
+- `PENDING`: the commits listed as missing, one per line as `<sha> TAB
+  <subject>`, oldest first. The shas are mainline commits.
+- `STATUS`: what is already happening to them, one per line as `<where> TAB
+  <subject>`. `<where>` is `#N` for an open pull request into
+  `edera/6.18-lts` that carries a commit with that subject, or `#N
+  backport-waiting` / `#N backport-needs-attention` for a merged mainline
+  pull request whose backport is in that state. It may be empty.
+- `REPORT`: the path your report must be written to.
+
+You change nothing: no commits, no branches, no checkouts, no pushes. Read
+with `git log`, `git show`, `git diff`, `git range-diff`, `git grep` and the
+like.
+
+### How to run commands here
+
+Your shell commands are checked against an allowlist that matches the
+command's first words. Shell variables, `$(...)`, `<(...)`, pipes into
+commands that are not on the list, and `VAR=x cmd` prefixes will be refused,
+so `LTS_TIP`, `<sha>` and `<...>` below are placeholders: substitute the
+literal value. Work out the merge-bases once with `git merge-base` and reuse
+the hashes.
+
+This is a blobless clone: file contents are fetched from GitHub the first time
+a command needs them, so the first `git show` of a commit can be slow. That is
+not a hang.
+
+## 1. Read the list
+
+```sh
+cat PENDING
+cat STATUS
+git merge-base LTS_TIP lts-upstream
+git merge-base MAINLINE_TIP mainline-upstream
+```
+
+A commit with an open backport pull request in `STATUS` is in flight: note
+the pull request and move on, unless something in it looks wrong.
+
+## 2. Judge each commit
+
+For every other commit, `git show <sha>` and decide which one of these it is.
+Look, in this order:
+
+1. **Ported in another form.** Search the LTS series for the change: the
+   files it touches (`git log --format='%h %s' <lts-base>..LTS_TIP --
+   <path>`), distinctive identifiers it adds (`git grep -n <identifier>
+   LTS_TIP -- <path>`), and its subject with different wording. If an LTS
+   commit carries the same change, adapted or not, name it, and say how it
+   differs. Several mainline commits squashed into one LTS commit count.
+2. **Already upstream in 6.18.** Edera fixes are sometimes sent upstream and
+   land in a stable release: look for the change in `lts-upstream` (`git log
+   --format='%h %s' lts-upstream -- <path>`, then `git show`).
+3. **Not applicable to 6.18.** The commit fixes or extends code that only
+   mainline has, upstream or Edera, and the LTS tree has nothing for it to
+   apply to. Say what is absent.
+4. **Missing.** None of the above: the LTS tree lacks the change. Say what
+   it does in one line, which later Edera commits in `PENDING` depend on it,
+   and whether it looks likely to apply to 6.18 as is, or needs adapting (and
+   why).
+
+When you cannot tell, say **UNSURE**, give both readings and what would
+settle it. Never call a commit present on a guess: a maintainer will act on
+"ported" by adding it to the skip file, and a commit skipped by mistake is
+lost from the LTS tree for good.
+
+## 3. Write the report
+
+Write `REPORT` as Markdown. It is pasted under a table of the commits, so do
+not repeat the table. Start with one short paragraph saying how many are
+really missing, how many are in flight, and how many need a maintainer to
+skip them. Then one entry per commit, in `PENDING` order:
+
+```markdown
+### `<sha12>` <subject>
+
+**Missing** | **In flight (#N)** | **Ported as `<lts-sha12>`** | **Upstream in 6.18 as `<sha12>`** | **Not applicable** | **UNSURE**
+
+<two to five sentences: the evidence, and what to do>
+```
+
+What to do, by verdict:
+
+- Missing: backport it. If its mainline pull request is in `STATUS` as
+  waiting or needing attention, point at that pull request.
+- Ported, upstream, or not applicable: add its subject, exactly as `PENDING`
+  has it, to `.automation/backport-skip` on `edera/6.18-lts`, or label its
+  mainline pull request `no-backport`.
+
+Keep it factual and short. Do not quote large diffs.
diff --git a/.github/workflows/kernel-nightly.yml b/.github/workflows/kernel-nightly.yml
index 9c5135045f42c9..6d6b29be5285be 100644
--- a/.github/workflows/kernel-nightly.yml
+++ b/.github/workflows/kernel-nightly.yml
@@ -8,10 +8,15 @@ name: Nightly kernel maintenance
 #   - with backport_pr set, proposes the backport of that merged
 #     edera/mainline pull request instead (lts-backport.yml).
 #     lts-backport-trigger.yml on edera/mainline dispatches this for every
-#     pull request that merges there.
+#     pull request that merges there;
+#   - with audit set, checks that it has every Edera commit edera/mainline
+#     has, and keeps an issue open about the ones it lacks, instead
+#     (lts-audit.yml). lts-audit-trigger.yml on edera/mainline dispatches
+#     this weekly.
 #
-# Claude does the rebase and the backports. Independent checks decide what
-# happens to each result; see those workflows.
+# Claude does the rebase and the backports, and triages the audit.
+# Independent checks decide what happens to each result; see those
+# workflows.
 #
 # GitHub runs scheduled workflows only from the default branch, edera/mainline,
 # so this copy has no schedule of its own. lts-rebase-trigger.yml on
@@ -44,6 +49,10 @@ on:
         description: Instead of the rebase, backport this merged edera/mainline pull request (its number)
         type: string
         default: ''
+      audit:
+        description: Instead of the rebase, audit this tree for Edera commits from edera/mainline that it lacks
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -52,13 +61,14 @@ concurrency:
   # Per tree: groups are repository-wide, and edera/mainline's copy of this
   # workflow uses plain kernel-nightly. Each backport has its own group, so
   # they run alongside the rebase and each other; a newer dispatch for the
-  # same pull request replaces one still queued.
-  group: kernel-nightly-edera/6.18-lts${{ inputs.backport_pr != '' && format('-backport-{0}', inputs.backport_pr) || '' }}
+  # same pull request replaces one still queued. The audit only reads, and
+  # has its own group too.
+  group: kernel-nightly-edera/6.18-lts${{ inputs.audit && '-audit' || inputs.backport_pr != '' && format('-backport-{0}', inputs.backport_pr) || '' }}
   cancel-in-progress: false
 
 jobs:
   lts:
-    if: inputs.backport_pr == ''
+    if: inputs.backport_pr == '' && !inputs.audit
     uses: ./.github/workflows/upstream-rebase.yml
     permissions:
       contents: read
@@ -76,7 +86,7 @@ jobs:
   # After the rebase, whatever it did.
   retry:
     needs: lts
-    if: always() && inputs.backport_pr == ''
+    if: always() && inputs.backport_pr == '' && !inputs.audit
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -101,7 +111,7 @@ jobs:
         run: bash .github/scripts/retry-backports.sh --stale
 
   backport:
-    if: inputs.backport_pr != ''
+    if: inputs.backport_pr != '' && !inputs.audit
     uses: ./.github/workflows/lts-backport.yml
     permissions:
       contents: read
@@ -112,3 +122,13 @@ jobs:
     with:
       pr: ${{ inputs.backport_pr }}
     secrets: inherit
+
+  audit:
+    if: inputs.audit
+    uses: ./.github/workflows/lts-audit.yml
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: write
+      id-token: write
+    secrets: inherit
diff --git a/.github/workflows/lts-audit.yml b/.github/workflows/lts-audit.yml
new file mode 100644
index 00000000000000..182204add9e0a3
--- /dev/null
+++ b/.github/workflows/lts-audit.yml
@@ -0,0 +1,396 @@
+name: LTS audit
+
+# Checks that edera/6.18-lts has every Edera commit edera/mainline has, and
+# keeps one issue open about the ones it lacks. Called by kernel-nightly.yml
+# when it is dispatched with audit: lts-audit-trigger.yml on edera/mainline
+# does that weekly.
+#
+# Every merged edera/mainline pull request is backported on its own
+# (lts-backport.yml), but commits can still fall through: one pushed without
+# a pull request, a backport that waits or needs attention and is forgotten,
+# a rebase or a hand-landed series that drops one. This is the backstop.
+#
+# What is missing is decided from git alone, by pending-backports.sh, exactly
+# as the backports decide it, with the same skip list. Open backport pull
+# requests that carry a missing commit, and mainline pull requests whose
+# backport is labelled waiting or needs-attention, are matched to it by
+# subject. Claude then reads each commit that is not already in flight and
+# says whether it really is missing, following
+# .automation/skills/lts-audit/SKILL.md. It runs read-only, and its notes
+# only annotate the issue: every commit pending-backports.sh lists stays in
+# it until the LTS tree has it or the commit is skipped
+# (.automation/backport-skip, or a no-backport label on its pull request).
+#
+# The issue is edited in place each week, and gets a comment only when the
+# set of missing commits changes. A week with nothing missing closes it.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  SOURCE: edera/mainline
+  SOURCE_UPSTREAM_URL: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
+  SOURCE_UPSTREAM_BRANCH: master
+  TARGET: edera/6.18-lts
+  TARGET_UPSTREAM_URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+  TARGET_UPSTREAM_BRANCH: linux-6.18.y
+  ISSUE_TITLE: edera/6.18-lts is missing commits from edera/mainline
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      state: ${{ steps.plan.outputs.state }}
+      old: ${{ steps.plan.outputs.old }}
+      source: ${{ steps.plan.outputs.source }}
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.TARGET }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Plan
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          tools=$RUNNER_TEMP/tools
+          R=$GITHUB_REPOSITORY
+          norm() { sed -E 's/[[:space:]]*\((v?[0-9]+\.[0-9]+(\.[0-9y]+)?(-lts)?)\)$//'; }
+          subjects() { gh api --paginate "repos/$R/pulls/$1/commits" -q '.[].commit.message | split("\n")[0]' | norm; }
+
+          old=$(git rev-parse HEAD)
+          echo "old=$old" >> "$GITHUB_OUTPUT"
+          git fetch --no-tags --filter=blob:none origin "$SOURCE"
+          src=$(git rev-parse FETCH_HEAD)
+          echo "source=$src" >> "$GITHUB_OUTPUT"
+          git fetch --no-tags --filter=blob:none "$SOURCE_UPSTREAM_URL" "$SOURCE_UPSTREAM_BRANCH"
+          src_up=$(git rev-parse FETCH_HEAD)
+          git fetch --no-tags --filter=blob:none "$TARGET_UPSTREAM_URL" "$TARGET_UPSTREAM_BRANCH"
+          tgt_up=$(git rev-parse FETCH_HEAD)
+          printf '%s\n' "$old" >"$out/lts-tip"
+          printf '%s\n' "$src" >"$out/mainline-tip"
+
+          # The same skip list the backports use (lts-backport.yml).
+          cp "$tools/backport-skip" "$out/skip"
+          gh pr list --repo "$R" --base "$SOURCE" --state merged \
+            --label no-backport --limit 500 --json number -q '.[].number' |
+          while read -r n; do
+            gh api --paginate "repos/$R/pulls/$n/commits" -q '.[].commit.message | split("\n")[0]'
+          done >>"$out/skip"
+
+          bash "$tools/scripts/pending-backports.sh" "$src" "$src_up" "$old" "$tgt_up" "$out/skip" >"$out/pending"
+
+          # Where each missing commit already stands, by subject:
+          # "<where> TAB <subject>", where is "#N" for an open pull request
+          # into the LTS tree, or "#N label" for a merged mainline one whose
+          # backport carries that label.
+          : >"$out/status"
+          if [ -s "$out/pending" ]; then
+            gh pr list --repo "$R" --base "$TARGET" --state open --limit 200 --json number -q '.[].number' |
+            while read -r n; do
+              subjects "$n" | sed "s/^/#$n\t/"
+            done >>"$out/status"
+            for label in backport-waiting backport-needs-attention; do
+              gh pr list --repo "$R" --base "$SOURCE" --state merged --label "$label" --limit 200 --json number -q '.[].number' |
+              while read -r n; do
+                subjects "$n" | sed "s/^/#$n $label\t/"
+              done >>"$out/status"
+            done
+          fi
+
+          {
+            echo "### LTS audit of \`$TARGET\` (\`${old:0:12}\`) against \`$SOURCE\` (\`${src:0:12}\`)"
+            echo
+            if [ -s "$out/pending" ]; then
+              echo "$(wc -l <"$out/pending") Edera commit(s) missing:"
+              echo
+              while IFS=$'\t' read -r sha subject; do echo "- \`${sha:0:12}\` $subject"; done <"$out/pending"
+            else
+              echo "In sync: no Edera commit on \`$SOURCE\` is missing."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+          if [ -s "$out/pending" ]; then
+            echo "state=missing" >> "$GITHUB_OUTPUT"
+          else
+            echo "state=clean" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: audit-plan
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  triage:
+    needs: prepare
+    if: needs.prepare.outputs.state == 'missing'
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    # Read-only on purpose: the model runs here. It reaches the Claude API
+    # through OIDC federation, and that is the only thing id-token is for.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ needs.prepare.outputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      # The skill comes from the commit this run started from. The kernel's
+      # .gitignore ignores dot-directories, so .rebase-tools/ cannot end up in
+      # a commit.
+      - name: Trusted tools
+        env:
+          SRC: ${{ needs.prepare.outputs.source }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA" "$SRC"
+          mkdir .rebase-tools
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C .rebase-tools --strip-components=1
+          git fetch --no-tags --filter=blob:none "$SOURCE_UPSTREAM_URL" "$SOURCE_UPSTREAM_BRANCH"
+          git branch mainline-upstream FETCH_HEAD
+          git fetch --no-tags --filter=blob:none "$TARGET_UPSTREAM_URL" "$TARGET_UPSTREAM_BRANCH"
+          git branch lts-upstream FETCH_HEAD
+
+      - name: Download the plan
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: audit-plan
+          path: ${{ runner.temp }}/in
+
+      - name: Normalize identifiers
+        id: ids
+        env:
+          RULE: ${{ vars.REBASE_FEDERATION_RULE_ID }}
+          ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+        run: |
+          set -euo pipefail
+          strip() { printf '%s' "$1" | tr -d '[:space:]'; }
+          {
+            echo "rule=$(strip "$RULE")"
+            echo "org=$(strip "$ORG")"
+            echo "svc=$(strip "$SVC")"
+            echo "ws=$(strip "$WS")"
+          } >> "$GITHUB_OUTPUT"
+          # An unset variable otherwise surfaces as an opaque API failure a
+          # second into the model step, with nothing in the log to say why.
+          missing=0
+          for n in REBASE_FEDERATION_RULE_ID:RULE ANTHROPIC_ORGANIZATION_ID:ORG ANTHROPIC_SERVICE_ACCOUNT_ID:SVC ANTHROPIC_WORKSPACE_ID:WS; do
+            eval "v=\$${n#*:}"
+            if [ -z "$(strip "$v")" ]; then
+              echo "::error::vars.${n%%:*} is empty or not visible to this repository."
+              missing=1
+            fi
+          done
+          exit "$missing"
+
+      - name: Triage
+        id: claude
+        continue-on-error: true
+        uses: anthropics/claude-code-action@6fed3ca145920b639991cb756090506e1bcaf515 # v1.0.245
+        with:
+          # The job token, which is read-only here. Without it the action
+          # would exchange OIDC for its own app token, which can write.
+          github_token: ${{ github.token }}
+          anthropic_federation_rule_id: '${{ steps.ids.outputs.rule }}'
+          anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
+          anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
+          anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          allowed_bots:                 'github-actions'
+          prompt: |
+            Audit edera/6.18-lts for Edera commits from edera/mainline that it
+            lacks, by following .rebase-tools/skills/lts-audit/SKILL.md
+            exactly. Read it in full before you start.
+
+            LTS_TIP=${{ needs.prepare.outputs.old }}   (${{ env.TARGET }}, checked out; its upstream is local branch lts-upstream)
+            MAINLINE_TIP=${{ needs.prepare.outputs.source }}   (${{ env.SOURCE }}; its upstream is local branch mainline-upstream)
+            PENDING=${{ runner.temp }}/in/pending
+            STATUS=${{ runner.temp }}/in/status
+            REPORT=${{ runner.temp }}/audit-report.md
+
+            You change nothing: no commits, no branches, no pushes. The
+            workflow files the issue from git's own list; your report
+            annotates it.
+          claude_args: |
+            --model claude-opus-5-5
+            --max-turns 150
+            --allowedTools "Read,Grep,Glob,Write,Bash(git log:*),Bash(git show:*),Bash(git diff:*),Bash(git range-diff:*),Bash(git merge-base:*),Bash(git rev-parse:*),Bash(git patch-id:*),Bash(git grep:*),Bash(git cat-file:*),Bash(diff:*),Bash(comm:*),Bash(sort:*),Bash(grep:*),Bash(sed:*),Bash(awk:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*),Bash(ls:*),Bash(cut:*)"
+
+      - name: Collect the report
+        if: always()
+        env:
+          REPORT: ${{ runner.temp }}/audit-report.md
+          OUTCOME: ${{ steps.claude.outcome }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          if [ -s "$REPORT" ]; then
+            cp "$REPORT" "$out/report.md"
+          else
+            printf 'Claude left no triage notes (triage step: %s); the run log has the cause.\n' "$OUTCOME" >"$out/report.md"
+          fi
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: audit-triage
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    needs: [prepare, triage]
+    # Whatever triage did: the issue rests on prepare's list, not on Claude.
+    if: always() && needs.prepare.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: lts-audit-issue
+      cancel-in-progress: false
+    permissions:
+      issues: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Download the plan
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: audit-plan
+          path: ${{ runner.temp }}/in/plan
+
+      - name: Download the triage
+        if: needs.triage.result != 'skipped'
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: audit-triage
+          path: ${{ runner.temp }}/in/triage
+
+      - name: Open, update or close the issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          in=$RUNNER_TEMP/in
+          plan=$in/plan
+          R=$GITHUB_REPOSITORY
+          old=$(cat "$plan/lts-tip")
+          src=$(cat "$plan/mainline-tip")
+          summary() { cat >> "$GITHUB_STEP_SUMMARY"; }
+
+          existing=$(gh issue list --repo "$R" --state open \
+            --search "in:title \"$ISSUE_TITLE\"" --json number,title \
+            -q ".[] | select(.title == \"$ISSUE_TITLE\") | .number" | head -n1)
+
+          if [ ! -s "$plan/pending" ]; then
+            if [ -n "$existing" ]; then
+              gh issue close "$existing" --repo "$R" --comment \
+                "Back in sync: \`$TARGET\` (\`${old:0:12}\`) has every Edera commit on \`$SOURCE\` (\`${src:0:12}\`). [Audit run]($RUN_URL)."
+              echo "In sync; closed #$existing." | summary
+            else
+              echo "In sync; no issue to close." | summary
+            fi
+            exit 0
+          fi
+
+          # Commit hashes change with every nightly rebase, so the set of
+          # missing commits is recorded by subject, in the issue itself, to
+          # tell next week whether it changed.
+          cut -f2 "$plan/pending" | sort >"$RUNNER_TEMP/now"
+          now=$(base64 -w0 <"$RUNNER_TEMP/now")
+          : >"$RUNNER_TEMP/before"
+          if [ -n "$existing" ]; then
+            gh issue view "$existing" --repo "$R" --json body -q .body |
+              sed -n 's/.*<!-- lts-audit-subjects:\([A-Za-z0-9+\/=]*\) -->.*/\1/p' | head -n1 |
+              base64 -d >"$RUNNER_TEMP/before" 2>/dev/null || : >"$RUNNER_TEMP/before"
+          fi
+
+          body=$RUNNER_TEMP/issue.md
+          {
+            echo "<!-- lts-audit-subjects:$now -->"
+            echo "The weekly audit found **$(wc -l <"$plan/pending") Edera commit(s)** on \`$SOURCE\` (\`${src:0:12}\`) that \`$TARGET\` (\`${old:0:12}\`) does not have. [Audit run]($RUN_URL)."
+            echo
+            echo "| Mainline commit | Subject | Backport status |"
+            echo "| --- | --- | --- |"
+            while IFS=$'\t' read -r sha subject; do
+              where=$(awk -F'\t' -v s="$subject" '$2 == s { print $1 }' "$plan/status" | sort -u | paste -sd, - | sed 's/,/, /g')
+              printf '| `%s` | %s | %s |\n' "${sha:0:12}" "${subject//|/\\|}" "${where:-none}"
+            done <"$plan/pending"
+            echo
+            echo "Each one is resolved by landing its backport on \`$TARGET\`, or, if it must never go there, by labelling its mainline pull request \`no-backport\` or listing its subject in \`.automation/backport-skip\` on \`$TARGET\`. A commit that was ported under another subject or in another form also goes in the skip file. This issue is updated weekly and closes itself once nothing is missing."
+            echo
+            echo "## Claude's triage"
+            echo
+            if [ -s "$in/triage/report.md" ]; then cat "$in/triage/report.md"; else echo "Triage did not run; the run log has the cause."; fi
+          } >"$body"
+          if [ "$(wc -c <"$body")" -gt 60000 ]; then
+            head -c 59000 "$body" >"$body.cut"
+            printf '\n\n_Truncated; the full triage is in the run artifacts._\n' >>"$body.cut"
+            mv "$body.cut" "$body"
+          fi
+
+          if [ -z "$existing" ]; then
+            url=$(gh issue create --repo "$R" --title "$ISSUE_TITLE" --body-file "$body")
+            echo "Opened $url." | summary
+            exit 0
+          fi
+          gh issue edit "$existing" --repo "$R" --body-file "$body"
+          if cmp -s "$RUNNER_TEMP/before" "$RUNNER_TEMP/now"; then
+            echo "Unchanged since the last audit; refreshed #$existing." | summary
+            exit 0
+          fi
+          note=$RUNNER_TEMP/comment.md
+          {
+            echo "The set of missing commits changed; the description is updated. [Audit run]($RUN_URL)."
+            echo
+            comm -13 "$RUNNER_TEMP/before" "$RUNNER_TEMP/now" | sed 's/^/- newly missing: /'
+            comm -23 "$RUNNER_TEMP/before" "$RUNNER_TEMP/now" | sed 's/^/- no longer missing: /'
+          } >"$note"
+          gh issue comment "$existing" --repo "$R" --body-file "$note"
+          echo "Updated #$existing." | summary

From 6b99c1a47dd29eaecefb223ca97fa2fb602ae588 Mon Sep 17 00:00:00 2001
From: Grayson Guarino <96265652+graysonguarino@users.noreply.github.com>
Date: Mon, 26 Oct 2026 16:07:43 -0400
Subject: [PATCH 1971/1982] iommu/xen: take the old domain in attach_dev (#58)

Linux 6.18.58 passes the device's old domain to the attach_dev callback as a
third argument. xen-iommu still had the two-argument form, so x86_64 builds
with CONFIG_XEN_IOMMU fail with -Werror=incompatible-pointer-types since the
rebase onto 6.18.58.

The driver does not need the old domain. This matches xen-iommu.c on
edera/mainline, whose upstream base already had the three-argument form.

Signed-off-by: Grayson Guarino <graysonguarino@gmail.com>
---
 drivers/iommu/xen-iommu.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/xen-iommu.c b/drivers/iommu/xen-iommu.c
index b4c2ea39ddae6c..986cf874319eb8 100644
--- a/drivers/iommu/xen-iommu.c
+++ b/drivers/iommu/xen-iommu.c
@@ -48,7 +48,8 @@ static struct iommu_device xen_iommu_device;
 static struct pv_iommu_capabilities caps;
 
 static int xen_iommu_attach_dev(struct iommu_domain *domain,
-				struct device *dev);
+				struct device *dev,
+				struct iommu_domain *old);
 
 static const struct iommu_domain_ops xen_iommu_identity_ops = {
 	.attach_dev = xen_iommu_attach_dev,
@@ -332,7 +333,8 @@ static size_t xen_iommu_unmap_pages(struct iommu_domain *domain, unsigned long i
 	return unmap.unmapped * pgsize;
 }
 
-static int xen_iommu_attach_dev(struct iommu_domain *domain, struct device *dev)
+static int xen_iommu_attach_dev(struct iommu_domain *domain, struct device *dev,
+				struct iommu_domain *old)
 {
 	struct pci_dev *pdev;
 	struct xen_iommu_domain *dom = to_xen_iommu_domain(domain);

From 68e2be74b064cf04da34ea4a7b7df4e7a74193ec Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Mon, 26 Oct 2026 14:22:46 -0700
Subject: [PATCH 1972/1982] automation: build x86_64 on the Edera host config

The acceptance build judged x86_64 against defconfig with the Edera
options forced on, which is not the kernel we ship. Merge the latest
configs/x86_64/host.config from edera-dev/linux-kernel-oci over
defconfig first, the way linux-kernel-oci itself applies it (the file
is a fragment against x86_64_defconfig and omits SMP, NET and the rest
of what matches it), and log the commit it came from.

The Edera options are still forced on as built-ins afterwards: the host
config builds OpenPaX out and 9P/Xen, virtio-gpu and the Hyper-V
network drivers as modules, which a vmlinux build would never compile.
AGP joins that list on x86_64 because host.config has it as a module,
which caps DRM at m.

arm64 is unchanged.
---
 .automation/skills/upstream-rebase/SKILL.md |  3 ++-
 .github/scripts/kernel-build.sh             | 24 ++++++++++++++++++++-
 .github/workflows/upstream-rebase.yml       |  5 +++--
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/.automation/skills/upstream-rebase/SKILL.md b/.automation/skills/upstream-rebase/SKILL.md
index 5f22a00da6d391..063e485c1a35dd 100644
--- a/.automation/skills/upstream-rebase/SKILL.md
+++ b/.automation/skills/upstream-rebase/SKILL.md
@@ -26,7 +26,8 @@ Your report can only stop it. When you finish, the workflow independently:
    alone that the series sits on the upstream tip, is linear, lost or gained
    no commit, and changed the tree by exactly the upstream delta;
 2. builds x86_64 and arm64 `vmlinux` with `kernel-build.sh`, which turns on
-   every downstream feature as a built-in.
+   every downstream feature as a built-in. x86_64 starts from the latest
+   Edera host config in edera-dev/linux-kernel-oci; arm64 from defconfig.
 
 If all of that passes **and your report's "Needs a decision" section is
 `None.` with nothing marked UNSURE anywhere** (checked by
diff --git a/.github/scripts/kernel-build.sh b/.github/scripts/kernel-build.sh
index 2a4c38dd68cb80..5920e581871522 100755
--- a/.github/scripts/kernel-build.sh
+++ b/.github/scripts/kernel-build.sh
@@ -7,6 +7,12 @@
 # replay that breaks any of them, or links against a symbol upstream removed,
 # fails here. Building only a subdirectory would miss those link errors.
 #
+# x86_64 adds Edera's shipping host config, fetched from the tip of
+# edera-dev/linux-kernel-oci each run, over defconfig, so the branch is
+# judged against the kernel we actually ship. That config builds
+# OpenPaX out and several Edera drivers as modules, so the options below are
+# still forced on as built-ins over it. arm64 starts from defconfig.
+#
 # The rebase skill runs this same script before they finish, so
 # what Claude checks and what the workflow checks cannot drift apart.
 #
@@ -18,7 +24,8 @@
 # aarch64-linux-gnu-) unless LLVM is set, in which case it builds with clang.
 #
 # Exit status: make's on a build failure; 3 if an option it asked for did not
-# survive olddefconfig (a Kconfig dependency the series no longer satisfies).
+# survive olddefconfig (a Kconfig dependency the series no longer satisfies);
+# git's if the host config cannot be fetched.
 
 set -euo pipefail
 
@@ -51,6 +58,8 @@ x86_64)
 		HYPERVISOR_GUEST PARAVIRT XEN_PV XEN_PVHVM_GUEST PCI_XEN
 		XEN_PCIDEV_FRONTEND XEN_PCIDEV_BACKEND XEN_IOMMU
 		HYPERV HYPERV_VMBUS HYPERV_NET PCI_HYPERV PCI_HYPERV_INTERFACE
+		# host.config builds AGP as a module, which caps DRM at m.
+		AGP
 	)
 	;;
 arm64)
@@ -72,6 +81,19 @@ mkdir -p "$objdir"
 mk() { make -s ARCH="$karch" "${cross[@]}" O="$objdir" "$@"; }
 
 mk defconfig
+if [ "$arch" = x86_64 ]; then
+	# host.config is a fragment against x86_64_defconfig: it leaves out
+	# whatever matches defconfig (SMP and NET among them), so it only means
+	# something merged over defconfig, the way linux-kernel-oci applies it.
+	oci=https://github.com/edera-dev/linux-kernel-oci
+	cfgrepo=$(mktemp -d)
+	trap 'rm -rf "$cfgrepo"' EXIT
+	git init -q --bare "$cfgrepo"
+	git -C "$cfgrepo" fetch -q --depth 1 "$oci" main
+	git -C "$cfgrepo" show FETCH_HEAD:configs/x86_64/host.config >"$cfgrepo/host.config"
+	echo "kernel-build: merging host.config from $oci@$(git -C "$cfgrepo" rev-parse FETCH_HEAD)"
+	scripts/kconfig/merge_config.sh -m -O "$objdir" "$objdir/.config" "$cfgrepo/host.config" >/dev/null
+fi
 enable=()
 for o in "${opts[@]}"; do enable+=(--enable "$o"); done
 scripts/config --file "$objdir/.config" "${enable[@]}"
diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml
index 250dc71808d17d..8d487d32945efa 100644
--- a/.github/workflows/upstream-rebase.yml
+++ b/.github/workflows/upstream-rebase.yml
@@ -18,7 +18,8 @@ name: Upstream rebase
 #     linear, lost or gained no commit, and changed the tree by exactly the
 #     upstream delta;
 #   - kernel-build.sh builds x86_64 and arm64 vmlinux with every downstream
-#     feature built in.
+#     feature built in, x86_64 on top of the latest Edera host config from
+#     edera-dev/linux-kernel-oci.
 #
 # If both pass and Claude's report asks for no decision
 # (report-needs-decision.sh), the tree is force-pushed to the result, pinned
@@ -647,7 +648,7 @@ jobs:
             echo
             echo "## Independent checks"
             echo
-            echo "Builds: **${BUILD}** (x86_64 and arm64 vmlinux with the Edera features built in; per-build results in the run)."
+            echo "Builds: **${BUILD}** (x86_64 vmlinux on the Edera host config and arm64 vmlinux, both with the Edera features built in; per-build results in the run)."
             echo
             if [ -s "$verify" ]; then cat "$verify"; else echo "The checker did not run."; fi
             echo

From 71a2c9de79c3d92512d4ed3211f9e0122a799c17 Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Mon, 26 Oct 2026 14:33:48 -0700
Subject: [PATCH 1973/1982] automation: repair a rebase whose build fails
 instead of proposing it

A rebase whose independent build failed went straight to a pull request,
and in practice that was a run Claude never finished: the Bash tool's
two-minute default timeout cannot hold a kernel build, so the build went
to the background and the session ended "waiting for the x86 build"
(#47, and #35 before it). Nobody saw the error until a reviewer did.

Give the rebase step a 90-minute Bash timeout, and tell the skill to run
builds in the foreground and to keep fixing and rebuilding until both
pass rather than treat a failing build as an outcome to report.

If the independent build still fails, a new read-only fix job hands
Claude its branch and the build logs for one repair round, following a
new "Repairing a failed build" section of the skill. A repaired branch
is verified and built again from scratch before publish judges it; the
checker now runs on whichever branch is final. Publish takes the
repaired branch and report when there is one, says so in the pull
request, and keeps the repair round's report when it repaired nothing.

The build job moves to a reusable rebase-build.yml so the first build
and the rebuild are the same job, and it now keeps each build's log as
an artifact for the repair round to read.

A repair changes downstream commits, so a repaired branch still shows
drift and still goes to review rather than being pushed: what changes is
that the reviewer gets a branch that builds.
---
 .automation/skills/upstream-rebase/SKILL.md |  47 ++++-
 .github/workflows/automation-selftest.yml   |   1 +
 .github/workflows/rebase-build.yml          | 117 +++++++++++
 .github/workflows/upstream-rebase.yml       | 218 +++++++++++++++++---
 4 files changed, 353 insertions(+), 30 deletions(-)
 create mode 100644 .github/workflows/rebase-build.yml

diff --git a/.automation/skills/upstream-rebase/SKILL.md b/.automation/skills/upstream-rebase/SKILL.md
index 063e485c1a35dd..a898484d25539c 100644
--- a/.automation/skills/upstream-rebase/SKILL.md
+++ b/.automation/skills/upstream-rebase/SKILL.md
@@ -29,6 +29,10 @@ Your report can only stop it. When you finish, the workflow independently:
    every downstream feature as a built-in. x86_64 starts from the latest
    Edera host config in edera-dev/linux-kernel-oci; arm64 from defconfig.
 
+If the build fails, you get your branch back with the build logs and one
+chance to repair it (see "Repairing a failed build"), and the repaired branch
+is checked and built again from scratch.
+
 If all of that passes **and your report's "Needs a decision" section is
 `None.` with nothing marked UNSURE anywhere** (checked by
 `report-needs-decision.sh`), the downstream branch is force-pushed to your
@@ -139,6 +143,12 @@ The workflow re-runs these builds itself, but run them here so you can fix
 what your resolutions broke. Each takes a while; run them once the rebase is
 complete, not after every commit.
 
+Run each build in the foreground and wait for it: the shell allows a command
+up to 90 minutes, which is enough for a full build. Never start a build in
+the background, and never end your session while one is running. A run
+that stops to wait for a build ends there, and nobody fixes what it would
+have shown.
+
 ```sh
 bash .rebase-tools/scripts/kernel-build.sh x86_64 .rebase-scratch/obj-x86 4
 bash .rebase-tools/scripts/kernel-build.sh arm64 .rebase-scratch/obj-arm64 4
@@ -150,9 +160,10 @@ the build script names). Find out which, and say so in the report; if the
 build script's list is what is stale, that is a **Needs a decision** item,
 not something to work around.
 
-If a build fails because of the rebase (a resolution, or an upstream change a
-downstream commit has not caught up with), fix it **in the downstream commit
-that is wrong**. Interactive editors do not work here, so drive the todo list
+A failing build is not a finished rebase. If a build fails because of the
+rebase (a resolution, or an upstream change a downstream commit has not
+caught up with), fix it, build again, and keep going until both builds pass.
+Fix it **in the downstream commit that is wrong**. Interactive editors do not work here, so drive the todo list
 with sed: `git -c sequence.editor="sed -i 's/^pick <sha>/edit <sha>/'" rebase
 -i UPSTREAM`, amend, then `git rebase --continue`. Do not add a fix-up commit
 on top unless there is no single commit it belongs to; if you must, its
@@ -238,6 +249,36 @@ x86_64, arm64: pass, fail (with the first error), or pre-existing failure
 Then stop. Leave RESULT checked out or not; the workflow reads the branch,
 not the working tree.
 
+## Repairing a failed build
+
+The workflow sends you here, in a fresh session, when the branch you produced
+failed its independent build. The prompt gives you `BUILD_LOGS`, a directory
+holding the log of each arch the workflow built, and your branch is checked
+out as `RESULT`. `REPORT` already holds the report you wrote for the rebase.
+
+1. Read the logs. Find the first error in each failing one; later errors
+   usually follow from it. A log that ends with `kernel-build: ... built`
+   passed.
+2. Reproduce the failure with `kernel-build.sh` exactly as in step 3, then
+   fix it the same way: in the downstream commit that is wrong, with the
+   same rules on fix-up commits. If it fails on pristine `UPSTREAM` too, it
+   is not yours: say so and leave the branch alone.
+3. Build both arches again, not only the one that failed, and keep fixing
+   and rebuilding until both pass. Do not stop at the first fix.
+4. Run `verify-upstream-rebase.sh` as in step 5. Every new drift line must be
+   one of your build fixes.
+5. Update `REPORT` in place. Add each fix to **Build fixes** (what broke, the
+   first error, which commit you changed, why), and rewrite **Builds** with
+   the results you now have. Leave the rest as it is, except to add an
+   **UNSURE** item if a fix needed a judgement call. A reviewer will read
+   this report, not your session.
+
+Exit status 3 is still not something to work around here: a Kconfig symbol
+the build script names no longer surviving `olddefconfig` goes to **Needs a
+decision**, as in step 3. If you cannot make the build pass, leave `RESULT`
+at the best branch you have and say in **Builds** exactly what still fails
+and why.
+
 ## If you cannot finish
 
 If the rebase cannot be completed (a conflict you cannot resolve at all, a
diff --git a/.github/workflows/automation-selftest.yml b/.github/workflows/automation-selftest.yml
index 0f5b41444b775e..765589325583e3 100644
--- a/.github/workflows/automation-selftest.yml
+++ b/.github/workflows/automation-selftest.yml
@@ -22,6 +22,7 @@ on:
     paths:
       - '.github/scripts/**'
       - '.github/workflows/upstream-rebase.yml'
+      - '.github/workflows/rebase-build.yml'
       - '.github/workflows/kernel-nightly.yml'
       - '.github/workflows/rebase-land.yml'
       - '.github/workflows/lts-backport.yml'
diff --git a/.github/workflows/rebase-build.yml b/.github/workflows/rebase-build.yml
new file mode 100644
index 00000000000000..2b07628fb92109
--- /dev/null
+++ b/.github/workflows/rebase-build.yml
@@ -0,0 +1,117 @@
+name: Rebase build
+
+# The independent build of a rebase result, called by upstream-rebase.yml:
+# once for Claude's rebase and, if that fails and Claude repairs the branch,
+# once more for the repaired branch.
+#
+# It builds x86_64 and arm64 vmlinux with kernel-build.sh, taken from the
+# commit the calling run started from, never from the tree under test. Each
+# build's log is kept as an artifact, so a repair round can read what broke.
+
+on:
+  workflow_call:
+    inputs:
+      old:
+        description: The downstream tip the rebase started from
+        type: string
+        required: true
+      up:
+        description: The upstream commit the result sits on
+        type: string
+        required: true
+      result:
+        description: The commit to build
+        type: string
+        required: true
+      bundle:
+        description: The artifact holding rebase.bundle with the result
+        type: string
+        required: true
+      logs:
+        description: Prefix for the build log artifacts; the arch is appended
+        type: string
+        required: true
+      upstream_url:
+        type: string
+        required: true
+      upstream_branch:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x86_64, arm64]
+    name: build (${{ matrix.arch }})
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ inputs.old }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Trusted tools
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
+          mkdir "$RUNNER_TEMP/tools"
+          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+
+      - name: Download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs.bundle }}
+          path: ${{ runner.temp }}/in
+
+      - name: Check out the result
+        env:
+          UPSTREAM_URL: ${{ inputs.upstream_url }}
+          UPSTREAM_BRANCH: ${{ inputs.upstream_branch }}
+          UP: ${{ inputs.up }}
+          RESULT: ${{ inputs.result }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
+          git merge-base --is-ancestor "$UP" FETCH_HEAD
+          git fetch "$RUNNER_TEMP/in/rebase.bundle" rebase-result:rebase-result
+          [ "$(git rev-parse rebase-result)" = "$RESULT" ] || { echo "bundle does not hold $RESULT"; exit 1; }
+          git checkout --detach "$RESULT"
+
+      - name: Install toolchains
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential bc bison flex libelf-dev libssl-dev python3 \
+            gcc-aarch64-linux-gnu
+
+      - name: Build
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: |
+          set -euo pipefail
+          bash "$RUNNER_TEMP/tools/scripts/kernel-build.sh" "$ARCH" "$RUNNER_TEMP/obj" 2>&1 |
+            tee "$RUNNER_TEMP/build-$ARCH.log"
+
+      - name: Upload the log
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ inputs.logs }}-${{ matrix.arch }}
+          path: ${{ runner.temp }}/build-${{ matrix.arch }}.log
+          if-no-files-found: ignore
+          retention-days: 30
diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml
index 8d487d32945efa..e9195b01ff1bb5 100644
--- a/.github/workflows/upstream-rebase.yml
+++ b/.github/workflows/upstream-rebase.yml
@@ -10,9 +10,13 @@ name: Upstream rebase
 #
 # Nothing Claude says about its own result decides what happens to it. The
 # model runs in a job that holds a read-only token and cannot push. Its branch
-# leaves that job as a git bundle, and two things then judge it
-# independently, with scripts taken from the commit this run started from
-# (the default branch), never from the tree under test:
+# leaves that job as a git bundle and is built independently
+# (rebase-build.yml). If that build fails, Claude gets one repair round: a
+# second read-only job hands it the build logs, it fixes the branch in the
+# downstream commit that broke, and the repaired branch is built again from
+# scratch. The final branch is then judged, with scripts taken from the
+# commit this run started from (the default branch), never from the tree
+# under test:
 #
 #   - verify-upstream-rebase.sh proves the series sits on the upstream tip, is
 #     linear, lost or gained no commit, and changed the tree by exactly the
@@ -234,6 +238,10 @@ jobs:
           anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
           anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
           allowed_bots:                 'github-actions'
+          # A kernel build takes far longer than the Bash tool's default
+          # timeout of two minutes. Without this, a build has to go to the
+          # background, and the run ends while Claude waits for it.
+          settings: '{"env": {"BASH_DEFAULT_TIMEOUT_MS": "5400000", "BASH_MAX_TIMEOUT_MS": "5400000"}}'
           prompt: |
             Rebase the downstream kernel series onto upstream by following
             .rebase-tools/skills/upstream-rebase/SKILL.md exactly. Read it in
@@ -316,8 +324,8 @@ jobs:
           retention-days: 30
 
   verify:
-    needs: [prepare, rebase]
-    if: needs.rebase.outputs.produced == 'true'
+    needs: [prepare, rebase, build, fix]
+    if: always() && needs.rebase.outputs.produced == 'true' && needs.build.result != 'cancelled' && needs.fix.result != 'cancelled'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     outputs:
@@ -345,10 +353,11 @@ jobs:
           mkdir "$RUNNER_TEMP/tools"
           git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
 
+      # The repaired branch when there is one, otherwise Claude's rebase.
       - name: Download
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: rebase-${{ inputs.key }}
+          name: ${{ needs.fix.outputs.produced == 'true' && format('fix-{0}', inputs.key) || format('rebase-{0}', inputs.key) }}
           path: ${{ runner.temp }}/in
 
       - name: Check
@@ -356,7 +365,7 @@ jobs:
         env:
           OLD: ${{ needs.prepare.outputs.old }}
           UP: ${{ needs.prepare.outputs.up }}
-          RESULT: ${{ needs.rebase.outputs.result }}
+          RESULT: ${{ needs.fix.outputs.produced == 'true' && needs.fix.outputs.result || needs.rebase.outputs.result }}
         run: |
           set -euo pipefail
           git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
@@ -388,13 +397,31 @@ jobs:
   build:
     needs: [prepare, rebase]
     if: needs.rebase.outputs.produced == 'true'
+    uses: ./.github/workflows/rebase-build.yml
+    with:
+      old: ${{ needs.prepare.outputs.old }}
+      up: ${{ needs.prepare.outputs.up }}
+      result: ${{ needs.rebase.outputs.result }}
+      bundle: rebase-${{ inputs.key }}
+      logs: build-${{ inputs.key }}
+      upstream_url: ${{ inputs.upstream_url }}
+      upstream_branch: ${{ inputs.upstream_branch }}
+
+  # The repair round. The same read-only footing as the rebase job: Claude
+  # gets the failed build logs and its own branch back, and nothing it says
+  # decides anything. A branch that comes out of here is verified and built
+  # again from scratch before publish looks at it.
+  fix:
+    needs: [prepare, rebase, build]
+    if: always() && needs.rebase.outputs.produced == 'true' && needs.build.result == 'failure'
     runs-on: ubuntu-latest
-    timeout-minutes: 120
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [x86_64, arm64]
-    name: build (${{ matrix.arch }})
+    timeout-minutes: 330
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      produced: ${{ steps.collect.outputs.produced }}
+      result: ${{ steps.collect.outputs.result }}
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
@@ -413,16 +440,28 @@ jobs:
         run: |
           set -euo pipefail
           git fetch --no-tags --filter=blob:none origin "$GITHUB_SHA"
-          mkdir "$RUNNER_TEMP/tools"
-          git archive "$GITHUB_SHA" .github/scripts | tar -x -C "$RUNNER_TEMP/tools" --strip-components=1
+          mkdir .rebase-tools
+          git archive "$GITHUB_SHA" .github/scripts .automation | tar -x -C .rebase-tools --strip-components=1
 
-      - name: Download
+      - name: Download Claude's rebase
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: rebase-${{ inputs.key }}
-          path: ${{ runner.temp }}/in
+          path: ${{ runner.temp }}/in/rebase
+
+      # A build that died before it started leaves no log; Claude can still
+      # build the branch itself.
+      - name: Download the build logs
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: build-${{ inputs.key }}-*
+          path: ${{ runner.temp }}/in/build
+          merge-multiple: true
 
-      - name: Check out the result
+      # The logs go where Claude can read them; .rebase-scratch/ is ignored
+      # by the kernel's .gitignore, so they cannot end up in a commit.
+      - name: Restore the branch
         env:
           UP: ${{ needs.prepare.outputs.up }}
           RESULT: ${{ needs.rebase.outputs.result }}
@@ -430,8 +469,17 @@ jobs:
           set -euo pipefail
           git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
           git merge-base --is-ancestor "$UP" FETCH_HEAD
-          git fetch "$RUNNER_TEMP/in/rebase.bundle" rebase-result:rebase-result
-          git checkout --detach "$RESULT"
+          git branch upstream-target "$UP"
+          git fetch "$RUNNER_TEMP/in/rebase/rebase.bundle" rebase-result:rebase-result
+          [ "$(git rev-parse rebase-result)" = "$RESULT" ] || { echo "bundle does not hold $RESULT"; exit 1; }
+          git checkout -q rebase-result
+          mkdir -p .rebase-scratch/build-logs
+          for f in "$RUNNER_TEMP"/in/build/*.log; do
+            [ ! -e "$f" ] || cp "$f" .rebase-scratch/build-logs/
+          done
+          cp "$RUNNER_TEMP/in/rebase/report.md" "$RUNNER_TEMP/rebase-report.md"
+          git config --global user.name "edera-upstream-rebase"
+          git config --global user.email "noreply@edera.dev"
 
       - name: Install toolchains
         run: |
@@ -441,13 +489,107 @@ jobs:
             build-essential bc bison flex libelf-dev libssl-dev python3 \
             gcc-aarch64-linux-gnu
 
-      - name: Build
+      # The rebase job has already checked that these are set.
+      - name: Normalize identifiers
+        id: ids
         env:
-          ARCH: ${{ matrix.arch }}
-        run: bash "$RUNNER_TEMP/tools/scripts/kernel-build.sh" "$ARCH" "$RUNNER_TEMP/obj"
+          RULE: ${{ vars.REBASE_FEDERATION_RULE_ID }}
+          ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+        run: |
+          set -euo pipefail
+          strip() { printf '%s' "$1" | tr -d '[:space:]'; }
+          {
+            echo "rule=$(strip "$RULE")"
+            echo "org=$(strip "$ORG")"
+            echo "svc=$(strip "$SVC")"
+            echo "ws=$(strip "$WS")"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Repair
+        id: claude
+        continue-on-error: true
+        uses: anthropics/claude-code-action@6fed3ca145920b639991cb756090506e1bcaf515 # v1.0.245
+        with:
+          github_token: ${{ github.token }}
+          anthropic_federation_rule_id: '${{ steps.ids.outputs.rule }}'
+          anthropic_organization_id:    '${{ steps.ids.outputs.org }}'
+          anthropic_service_account_id: '${{ steps.ids.outputs.svc }}'
+          anthropic_workspace_id:       '${{ steps.ids.outputs.ws }}'
+          allowed_bots:                 'github-actions'
+          settings: '{"env": {"BASH_DEFAULT_TIMEOUT_MS": "5400000", "BASH_MAX_TIMEOUT_MS": "5400000"}}'
+          prompt: |
+            Your rebase of the downstream kernel series failed the workflow's
+            independent build. Repair it by following the "Repairing a failed
+            build" section of .rebase-tools/skills/upstream-rebase/SKILL.md
+            exactly. Read the whole skill first; the rest of it still applies.
+
+            DOWNSTREAM=${{ env.DOWNSTREAM }}
+            OLD_TIP=${{ needs.prepare.outputs.old }}
+            UPSTREAM=${{ needs.prepare.outputs.up }}   (local branch upstream-target)
+            RESULT=rebase-result   (your rebase, checked out, at ${{ needs.rebase.outputs.result }})
+            BUILD_LOGS=.rebase-scratch/build-logs   (one log per arch the workflow built)
+            REPORT=${{ runner.temp }}/rebase-report.md   (your report from the rebase)
+
+            You cannot push and must not try. The workflow verifies and
+            builds your branch independently again afterwards.
+          claude_args: |
+            --model claude-opus-5-5
+            --max-turns 400
+            --allowedTools "Read,Grep,Glob,Edit,Write,Bash(git:*),Bash(make:*),Bash(bash .rebase-tools/scripts/verify-upstream-rebase.sh:*),Bash(bash .rebase-tools/scripts/kernel-build.sh:*),Bash(scripts/config:*),Bash(mkdir -p .rebase-scratch:*),Bash(diff:*),Bash(comm:*),Bash(sort:*),Bash(grep:*),Bash(sed:*),Bash(awk:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*),Bash(ls:*),Bash(cut:*),Bash(tee:*)"
+
+      # Only a branch that still sits on the upstream tip and differs from
+      # the one that failed is worth building again. The report is always
+      # kept: when nothing was repaired, it says why.
+      - name: Collect the result
+        id: collect
+        if: always()
+        env:
+          UP: ${{ needs.prepare.outputs.up }}
+          BEFORE: ${{ needs.rebase.outputs.result }}
+          OUTCOME: ${{ steps.claude.outcome }}
+        run: |
+          set -euo pipefail
+          out=$RUNNER_TEMP/out
+          mkdir -p "$out"
+          cp "$RUNNER_TEMP/rebase-report.md" "$out/report.md"
+          if git rev-parse --verify -q refs/heads/rebase-result >/dev/null \
+             && git merge-base --is-ancestor "$UP" rebase-result \
+             && [ "$(git rev-parse rebase-result)" != "$UP" ] \
+             && [ "$(git rev-parse rebase-result)" != "$BEFORE" ]; then
+            git bundle create "$out/rebase.bundle" refs/heads/rebase-result "^$UP"
+            echo "produced=true" >> "$GITHUB_OUTPUT"
+            echo "result=$(git rev-parse rebase-result)" >> "$GITHUB_OUTPUT"
+          else
+            echo "produced=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::The repair round left no new branch (repair step: $OUTCOME)."
+          fi
+
+      - name: Upload
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fix-${{ inputs.key }}
+          path: ${{ runner.temp }}/out/
+          if-no-files-found: error
+          retention-days: 30
+
+  rebuild:
+    needs: [prepare, fix]
+    if: always() && needs.fix.outputs.produced == 'true'
+    uses: ./.github/workflows/rebase-build.yml
+    with:
+      old: ${{ needs.prepare.outputs.old }}
+      up: ${{ needs.prepare.outputs.up }}
+      result: ${{ needs.fix.outputs.result }}
+      bundle: fix-${{ inputs.key }}
+      logs: rebuild-${{ inputs.key }}
+      upstream_url: ${{ inputs.upstream_url }}
+      upstream_branch: ${{ inputs.upstream_branch }}
 
   publish:
-    needs: [prepare, rebase, verify, build]
+    needs: [prepare, rebase, build, fix, verify, rebuild]
     if: always() && needs.prepare.outputs.run == 'true' && needs.rebase.result != 'cancelled'
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -484,6 +626,16 @@ jobs:
           name: rebase-${{ inputs.key }}
           path: ${{ runner.temp }}/in/rebase
 
+      # The repaired branch if there is one, and the repair round's report
+      # whether or not it repaired anything.
+      - name: Download the repair
+        if: needs.fix.result != 'skipped'
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: fix-${{ inputs.key }}
+          path: ${{ runner.temp }}/in/fix
+
       # Absent when Claude produced no branch and the checker never ran.
       - name: Download the checker report
         if: needs.verify.result == 'success'
@@ -509,10 +661,12 @@ jobs:
           JOB_TOKEN: ${{ github.token }}
           PRODUCED: ${{ needs.rebase.outputs.produced }}
           VERIFY: ${{ needs.verify.outputs.status }}
-          BUILD: ${{ needs.build.result }}
+          BUILD: ${{ needs.fix.outputs.produced == 'true' && needs.rebuild.result || needs.build.result }}
+          REPAIR: ${{ needs.fix.result }}
+          REPAIRED: ${{ needs.fix.outputs.produced }}
           OLD: ${{ needs.prepare.outputs.old }}
           UP: ${{ needs.prepare.outputs.up }}
-          RESULT: ${{ needs.rebase.outputs.result }}
+          RESULT: ${{ needs.fix.outputs.produced == 'true' && needs.fix.outputs.result || needs.rebase.outputs.result }}
           PREFIX: ${{ needs.prepare.outputs.prefix }}
           CANDIDATE: ${{ needs.prepare.outputs.candidate }}
           KEY: ${{ inputs.key }}
@@ -521,6 +675,9 @@ jobs:
           set -euo pipefail
           in=$RUNNER_TEMP/in
           report=$in/rebase/report.md
+          bundle=$in/rebase/rebase.bundle
+          [ ! -s "$in/fix/report.md" ] || report=$in/fix/report.md
+          [ "$REPAIRED" != "true" ] || bundle=$in/fix/rebase.bundle
           verify=$in/verify/verify.md
           summary() { cat >> "$GITHUB_STEP_SUMMARY"; }
           title="Nightly upstream rebase of $DOWNSTREAM failed"
@@ -551,7 +708,7 @@ jobs:
 
           git fetch --no-tags "$UPSTREAM_URL" "$UPSTREAM_BRANCH"
           git merge-base --is-ancestor "$UP" FETCH_HEAD
-          git fetch "$in/rebase/rebase.bundle" rebase-result:rebase-result
+          git fetch "$bundle" rebase-result:rebase-result
           [ "$(git rev-parse rebase-result)" = "$RESULT" ]
 
           # Workflows triggered by a pull request, including the land workflow,
@@ -649,6 +806,13 @@ jobs:
             echo "## Independent checks"
             echo
             echo "Builds: **${BUILD}** (x86_64 vmlinux on the Edera host config and arm64 vmlinux, both with the Edera features built in; per-build results in the run)."
+            if [ "$REPAIRED" = "true" ]; then
+              echo
+              echo "The first build of Claude's rebase failed. Claude repaired the branch from the build logs, and the builds and checker above are of the repaired branch; its report's **Build fixes** section says what changed."
+            elif [ "$REPAIR" != "skipped" ]; then
+              echo
+              echo "The build failed and Claude's repair round (${REPAIR}) left no new branch; this is the unrepaired rebase."
+            fi
             echo
             if [ -s "$verify" ]; then cat "$verify"; else echo "The checker did not run."; fi
             echo

From 6df2e2e4d711a34c197f893d5359e766a0a760c1 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Fri, 23 Oct 2026 16:12:27 -0500
Subject: [PATCH 1974/1982] Revert "x86/xen: include the Xen types before
 interface/memory.h"

This reverts commit 0a2ac176ade71.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit b0f69be0852ee4e8203f3bd302510ade401d1ee1)
---
 arch/x86/xen/enlighten.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 651768313b421e..852610dfe704bd 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,7 +10,6 @@
 
 #include <xen/xen.h>
 #include <xen/features.h>
-#include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/version.h>

From 375f71d0f2c50ff7656e9f728b6e3dc95468f948 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Fri, 23 Oct 2026 16:12:27 -0500
Subject: [PATCH 1975/1982] Revert "x86/xen: keep dom0's growth room on the
 balloon"

This reverts commit 878826950b173.

We no longer want to split the unpopulated boot-time space between
the dom0 balloon and grant and foreign mappings.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit bf4463b4e8740950196a534417537c4f03b20525)
---
 arch/x86/xen/enlighten.c | 54 ++++++----------------------------------
 1 file changed, 8 insertions(+), 46 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 852610dfe704bd..23b91bf9b66303 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -10,7 +10,6 @@
 
 #include <xen/xen.h>
 #include <xen/features.h>
-#include <xen/interface/memory.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/version.h>
 #include <xen/page.h>
@@ -441,34 +440,8 @@ void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns)
 }
 
 #ifdef CONFIG_XEN_UNPOPULATED_ALLOC
-/*
- * How much of the extra memory dom0 keeps on the balloon, to grow into up
- * to the ceiling Xen set for it (dom0_mem=...,max:). Without a max: Xen
- * reports UINT_MAX and dom0 keeps nothing, so growing stays opt-in. The
- * last memory section always stays with the mapping pool, so that the
- * grant table and other early users never fall back to holes in the
- * physical map before PCI devices have claimed their MMIO windows.
- */
-static unsigned long __init xen_dom0_growth_pages(unsigned long extra_pages)
-{
-	domid_t domid = DOMID_SELF;
-	long max_pages, cur_pages;
-
-	if (!xen_initial_domain() || extra_pages <= PAGES_PER_SECTION)
-		return 0;
-
-	max_pages = HYPERVISOR_memory_op(XENMEM_maximum_reservation, &domid);
-	cur_pages = HYPERVISOR_memory_op(XENMEM_current_reservation, &domid);
-	if (cur_pages <= 0 || max_pages <= cur_pages || max_pages >= UINT_MAX)
-		return 0;
-
-	return min_t(unsigned long, max_pages - cur_pages,
-		     extra_pages - PAGES_PER_SECTION);
-}
-
 int __init arch_xen_unpopulated_init(struct resource **res)
 {
-	unsigned long extra_pages = 0, growth_pages;
 	unsigned int i;
 
 	if (!xen_domain())
@@ -477,27 +450,16 @@ int __init arch_xen_unpopulated_init(struct resource **res)
 	/* Must be set strictly before calling xen_free_unpopulated_pages(). */
 	*res = &iomem_resource;
 
-	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++)
-		extra_pages += xen_extra_mem[i].n_pfns;
-	growth_pages = xen_dom0_growth_pages(extra_pages);
-
 	/*
 	 * Initialize with pages from the extra memory regions (see
-	 * arch/x86/xen/setup.c), less what dom0 keeps to grow into. Every
-	 * region gives up the same fraction: on PVH that spreads dom0's
-	 * growth over the NUMA nodes the regions belong to, and leaves each
-	 * node's pool its share of the rest.
+	 * arch/x86/xen/setup.c).
 	 */
 	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
-		struct xen_memory_region *region = &xen_extra_mem[i];
-		unsigned long keep = 0, j;
-
-		if (growth_pages)
-			keep = mult_frac(region->n_pfns, growth_pages,
-					 extra_pages);
+		unsigned int j;
 
-		for (j = keep; j < region->n_pfns; j++) {
-			struct page *pg = pfn_to_page(region->start_pfn + j);
+		for (j = 0; j < xen_extra_mem[i].n_pfns; j++) {
+			struct page *pg =
+				pfn_to_page(xen_extra_mem[i].start_pfn + j);
 
 			xen_free_unpopulated_pages(1, &pg);
 		}
@@ -508,9 +470,9 @@ int __init arch_xen_unpopulated_init(struct resource **res)
 		 * driver to know how much of the physmap is unpopulated and
 		 * set an accurate initial memory target.
 		 */
-		xen_unpopulated_pages += region->n_pfns - keep;
-		/* Only the part dom0 keeps is added to the balloon driver. */
-		region->n_pfns = keep;
+		xen_unpopulated_pages += xen_extra_mem[i].n_pfns;
+		/* Zero so region is not also added to the balloon driver. */
+		xen_extra_mem[i].n_pfns = 0;
 	}
 
 	return 0;

From d451e629a783a178d6807dcac94f8321075dfb4d Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Fri, 23 Oct 2026 16:12:27 -0500
Subject: [PATCH 1976/1982] Revert "xen/balloon: add boot-time extra memory as
 2 MiB blocks"

This reverts commit 749897863227e.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit 857e516edbde5f3f8bf9c0c379912c941b5d04b4)
---
 drivers/xen/balloon.c | 21 +++------------------
 1 file changed, 3 insertions(+), 18 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index f4ec5e7c2786bb..d5444e699acce2 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -1024,26 +1024,10 @@ static struct notifier_block balloon_oom_nb = {
 	.notifier_call = balloon_oom_notify,
 };
 
-static void __init balloon_append_range(unsigned long pfn,
-					unsigned long end_pfn)
-{
-	while (pfn < end_pfn) {
-		if (balloon_blocks_usable() &&
-		    IS_ALIGNED(pfn, BALLOON_BLOCK_NR_PAGES) &&
-		    end_pfn - pfn >= BALLOON_BLOCK_NR_PAGES) {
-			balloon_append_block(pfn_to_page(pfn));
-			pfn += BALLOON_BLOCK_NR_PAGES;
-		} else {
-			balloon_append(pfn_to_page(pfn));
-			pfn++;
-		}
-	}
-}
-
 static int __init balloon_add_regions(bool append)
 {
 	unsigned long start_pfn, pages;
-	unsigned long extra_pfn_end;
+	unsigned long pfn, extra_pfn_end;
 	unsigned int i;
 
 	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
@@ -1060,7 +1044,8 @@ static int __init balloon_add_regions(bool append)
 		 */
 		extra_pfn_end = min(max_pfn, start_pfn + pages);
 
-		balloon_append_range(start_pfn, extra_pfn_end);
+		for (pfn = start_pfn; pfn < extra_pfn_end; pfn++)
+			balloon_append(pfn_to_page(pfn));
 
 		/*
 		 * There are two different use-cases depending on how the

From 390607f25a75321a01adabd2ac2120feec747a6a Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Tue, 20 Oct 2026 21:49:57 -0500
Subject: [PATCH 1977/1982] xen/unpopulated-alloc: add push_page()

Consolidate existing duplicated code. No functional change.

Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
(cherry picked from commit bfc026e5efb8f57ab7248a9bc3673c9ebe0712f1)
---
 drivers/xen/unpopulated-alloc.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index 73ea5adf786615..d5e99435721f14 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -180,6 +180,16 @@ static int fill_list(unsigned int nr_pages, int node)
 	return ret;
 }
 
+/* Put @pg on the pool of its own node.  Called with list_lock held. */
+static void push_page(struct page *pg)
+{
+	int node = xen_unpopulated_clamp_node(page_to_nid(pg));
+
+	pg->zone_device_data = page_list[node];
+	page_list[node] = pg;
+	list_count[node]++;
+}
+
 /*
  * Take @nr_pages from the pool of @node, or from any node's pool when @any is
  * set.  Called with list_lock held.  Never carves a new region.
@@ -213,14 +223,8 @@ static int pop_pages(unsigned int nr_pages, struct page **pages, int node,
 			if (ret < 0) {
 				unsigned int j;
 
-				for (j = 0; j <= i; j++) {
-					int dst = xen_unpopulated_clamp_node(
-							page_to_nid(pages[j]));
-
-					pages[j]->zone_device_data = page_list[dst];
-					page_list[dst] = pages[j];
-					list_count[dst]++;
-				}
+				for (j = 0; j <= i; j++)
+					push_page(pages[j]);
 				return ret;
 			}
 		}
@@ -324,13 +328,8 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 	}
 
 	mutex_lock(&list_lock);
-	for (i = 0; i < nr_pages; i++) {
-		int node = xen_unpopulated_clamp_node(page_to_nid(pages[i]));
-
-		pages[i]->zone_device_data = page_list[node];
-		page_list[node] = pages[i];
-		list_count[node]++;
-	}
+	for (i = 0; i < nr_pages; i++)
+		push_page(pages[i]);
 	mutex_unlock(&list_lock);
 }
 EXPORT_SYMBOL(xen_free_unpopulated_pages);

From 072495a22b24e7693c6c745be889302f21e6bb8b Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Tue, 27 Oct 2026 09:35:45 -0500
Subject: [PATCH 1978/1982] xen/unpopulated-alloc: keep boot-time address space
 as 2 MiB blocks

The boot-time unbacked address space reaches the unpopulated allocator
(page_list) one 4 KiB page at a time, with a lock round trip and a list
push for each page. On a large dom0 that is millions of round trips at
boot. page_list also is unaware of page contiguity, limiting dom0
balloon growth to 4 KiB updates.

Hand each extra memory region over whole, and keep its aligned 2 MiB
blocks on a list per node, linked through the first page of each
block as page_list links pages. The pages around the blocks, and a
block that a node boundary cuts, go on page_list.

Grants and foreign mappings still take pages from page_list only.
When page_list of a node is empty, one block moves onto it, so taking
a page stays a list pop. Pages given back go on page_list and do not
form a block again.

(cherry picked from commit 23041338f9a2b6c2f1dcedf97bc1cd4fd009ef11)
---
 arch/x86/xen/enlighten.c        |  13 +---
 drivers/xen/unpopulated-alloc.c | 126 +++++++++++++++++++++++++++++---
 include/xen/xen.h               |   4 +
 3 files changed, 123 insertions(+), 20 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 23b91bf9b66303..9a42a11c7319cd 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -447,22 +447,15 @@ int __init arch_xen_unpopulated_init(struct resource **res)
 	if (!xen_domain())
 		return -ENODEV;
 
-	/* Must be set strictly before calling xen_free_unpopulated_pages(). */
 	*res = &iomem_resource;
 
 	/*
-	 * Initialize with pages from the extra memory regions (see
+	 * Initialize with the extra memory regions (see
 	 * arch/x86/xen/setup.c).
 	 */
 	for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
-		unsigned int j;
-
-		for (j = 0; j < xen_extra_mem[i].n_pfns; j++) {
-			struct page *pg =
-				pfn_to_page(xen_extra_mem[i].start_pfn + j);
-
-			xen_free_unpopulated_pages(1, &pg);
-		}
+		xen_unpopulated_add_range(xen_extra_mem[i].start_pfn,
+					  xen_extra_mem[i].n_pfns);
 
 		/*
 		 * Account for the region being in the physmap but unpopulated.
diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index d5e99435721f14..aca0f6718219bc 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -24,10 +24,21 @@
  *
  * A single mutex covers all per-node lists.  Alloc/free are
  * connect-time events on the I/O backends and not contention-sensitive.
+ *
+ * The boot-time unbacked address space, which arch_xen_unpopulated_init()
+ * hands over with xen_unpopulated_add_range(), is not ZONE_DEVICE but RAM
+ * pfns with nothing behind them.  Its aligned 2 MiB blocks go on block_list[]
+ * of their node, linked through their first page as page_list[] links pages,
+ * and the pages around them go on page_list[].
+ *
+ * Mappings take pages from page_list[] only, and give them back to it.  When
+ * page_list[] runs empty, a block moves onto it from block_list[].
  */
 static DEFINE_MUTEX(list_lock);
 static struct page *page_list[MAX_NUMNODES];
 static unsigned int list_count[MAX_NUMNODES];
+static struct page *block_list[MAX_NUMNODES];
+static unsigned long block_count[MAX_NUMNODES];
 
 static struct resource *target_resource;
 
@@ -180,7 +191,7 @@ static int fill_list(unsigned int nr_pages, int node)
 	return ret;
 }
 
-/* Put @pg on the pool of its own node.  Called with list_lock held. */
+/* Put @pg on page_list[] of its own node.  Called with list_lock held. */
 static void push_page(struct page *pg)
 {
 	int node = xen_unpopulated_clamp_node(page_to_nid(pg));
@@ -190,6 +201,64 @@ static void push_page(struct page *pg)
 	list_count[node]++;
 }
 
+/*
+ * Put the 2 MiB block that starts at @head on block_list[] of its node.
+ * Called with list_lock held.
+ */
+static void push_block(struct page *head)
+{
+	int node = page_to_nid(head);
+
+	head->zone_device_data = block_list[node];
+	block_list[node] = head;
+	block_count[node]++;
+}
+
+/*
+ * Take a 2 MiB block off block_list[@node].  Returns its first page, or NULL
+ * when none is left.  Called with list_lock held.
+ */
+static struct page *pop_block(int node)
+{
+	struct page *head = block_list[node];
+
+	if (head) {
+		block_list[node] = head->zone_device_data;
+		block_count[node]--;
+	}
+	return head;
+}
+
+/*
+ * Take a page off page_list[@node], which a block refills when it is empty.
+ * Returns NULL when the pool is empty.
+ */
+static struct page *take_page(int node)
+{
+	struct page *pg;
+	unsigned long pfn, i;
+
+	if (!page_list[node] && block_list[node]) {
+		pfn = page_to_pfn(pop_block(node));
+		for (i = 0; i < XEN_UNPOPULATED_BLOCK_PAGES; i++)
+			push_page(pfn_to_page(pfn + i));
+	}
+
+	pg = page_list[node];
+	if (pg) {
+		page_list[node] = pg->zone_device_data;
+		list_count[node]--;
+	}
+	return pg;
+}
+
+/* Free pages of @node, those in the blocks on block_list[] included. */
+static unsigned long pool_pages(int node)
+{
+	return list_count[node] +
+	       block_count[node] * XEN_UNPOPULATED_BLOCK_PAGES;
+}
+
 /*
  * Take @nr_pages from the pool of @node, or from any node's pool when @any is
  * set.  Called with list_lock held.  Never carves a new region.
@@ -197,23 +266,21 @@ static void push_page(struct page *pg)
 static int pop_pages(unsigned int nr_pages, struct page **pages, int node,
 		     bool any)
 {
-	unsigned int i, total = 0;
+	unsigned long total = 0;
+	unsigned int i;
 
 	for (i = 0; i < MAX_NUMNODES; i++)
-		total += list_count[i];
-	if ((any ? total : list_count[node]) < nr_pages)
+		total += pool_pages(i);
+	if ((any ? total : pool_pages(node)) < nr_pages)
 		return -ENOMEM;
 
 	for (i = 0; i < nr_pages; i++) {
 		int src = node;
 		struct page *pg;
 
-		while (!page_list[src])
+		while (!(pg = take_page(src)))
 			src = (src + 1) % MAX_NUMNODES;
 
-		pg = page_list[src];
-		page_list[src] = pg->zone_device_data;
-		list_count[src]--;
 		pages[i] = pg;
 
 #ifdef CONFIG_XEN_HAVE_PVMMU
@@ -287,8 +354,9 @@ EXPORT_SYMBOL(xen_alloc_unpopulated_pages_node);
  */
 int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 {
-	unsigned int i, total = 0;
+	unsigned long total = 0;
 	int node = numa_node_id();
+	unsigned int i;
 	int ret;
 
 	if (!target_resource)
@@ -296,7 +364,7 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 
 	mutex_lock(&list_lock);
 	for (i = 0; i < MAX_NUMNODES; i++)
-		total += list_count[i];
+		total += pool_pages(i);
 	ret = 0;
 	if (total < nr_pages)
 		ret = fill_list(nr_pages - total, node);
@@ -334,6 +402,44 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL(xen_free_unpopulated_pages);
 
+/**
+ * xen_unpopulated_add_range - hand over boot-time unbacked address space
+ * @start_pfn: first pfn of the range
+ * @nr_pages: number of pages in the range
+ *
+ * The pages must have a struct page and nothing behind them, as the extra
+ * memory regions of a Xen guest do.  Each aligned 2 MiB block goes on
+ * block_list[] of its node, and the other pages on page_list[].
+ */
+void __init xen_unpopulated_add_range(unsigned long start_pfn,
+				      unsigned long nr_pages)
+{
+	unsigned long pfn = start_pfn, end_pfn = start_pfn + nr_pages, last;
+	struct page *pg;
+
+	mutex_lock(&list_lock);
+	while (pfn < end_pfn) {
+		pg = pfn_to_page(pfn);
+		last = pfn + XEN_UNPOPULATED_BLOCK_PAGES - 1;
+
+		/*
+		 * As with __pageblock_pfn_to_page we assume no A B A
+		 * alternations of numa node assignments within a block, thus
+		 * check only the first and last entries.
+		 */
+		if (IS_ALIGNED(pfn, XEN_UNPOPULATED_BLOCK_PAGES) &&
+		    last < end_pfn &&
+		    page_to_nid(pg) == page_to_nid(pfn_to_page(last))) {
+			push_block(pg);
+			pfn += XEN_UNPOPULATED_BLOCK_PAGES;
+		} else {
+			push_page(pg);
+			pfn++;
+		}
+	}
+	mutex_unlock(&list_lock);
+}
+
 static int __init unpopulated_init(void)
 {
 	int ret;
diff --git a/include/xen/xen.h b/include/xen/xen.h
index ccf9bfa338131c..f2ccd2bf86b327 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -68,12 +68,16 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
 extern u64 xen_saved_max_mem_size;
 #endif
 
+/* Pages in a 2 MiB block of unbacked address space, one order-9 Xen extent. */
+#define XEN_UNPOPULATED_BLOCK_PAGES	(1UL << (21 - PAGE_SHIFT))
+
 #ifdef CONFIG_XEN_UNPOPULATED_ALLOC
 extern unsigned long xen_unpopulated_pages;
 int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 				     int node);
 int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages);
+void xen_unpopulated_add_range(unsigned long start_pfn, unsigned long nr_pages);
 #include <linux/ioport.h>
 int arch_xen_unpopulated_init(struct resource **res);
 #else

From 958435cb4fa3c717dec5b3e21e9fbac7f409f8c3 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Tue, 27 Oct 2026 09:36:01 -0500
Subject: [PATCH 1979/1982] xen/balloon: grow dom0 into 2 MiB blocks from the
 unpopulated allocator

With no pages parked on the balloon, dom0 grows by hotplugging a
memory section at the first free physical address. That address space
can belong to a PCI device that has not claimed it yet, and Xen does
not stop dom0 from growing when dom0_mem sets no max:.

dom0's balloon needs room to grow into, and grows faster when Xen
populates a whole 2 MiB extent at a time. The unpopulated allocator
keeps that room, the boot-time unbacked address space. Grant and foreign
mappings and the balloon have to share it.

Feed the dom0 balloon from the allocator's 2 MiB blocks when it is
instructed to grow.

(cherry picked from commit 4870058d413897596ec4b3bd2cae9f9a64e281d6)
---
 drivers/xen/balloon.c           | 44 +++++++++++++++++++++++++++
 drivers/xen/unpopulated-alloc.c | 53 +++++++++++++++++++++++++++++++++
 include/xen/xen.h               |  7 +++++
 3 files changed, 104 insertions(+)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d5444e699acce2..cd34b0ea5bb73a 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -632,6 +632,48 @@ static enum bp_state balloon_deflate(unsigned long nr_pages)
 	return increase_reservation(nr_pages);
 }
 
+/*
+ * Grow dom0 into 2 MiB blocks of the unpopulated allocator's address space,
+ * rather than hotplugging memory at the first free physical address, which
+ * can belong to a PCI device that has not claimed it yet. The blocks are
+ * parked on the balloon only for this call and deflated like any others, and
+ * whatever Xen did not populate goes straight back, so the balloon never
+ * holds address space grant mappings could use.
+ */
+static enum bp_state balloon_grow_dom0(unsigned long nr_pages)
+{
+	unsigned long before = balloon_stats.current_pages;
+	struct page *heads[BALLOON_BLOCK_BATCH], *page;
+	unsigned int nr = 1, i;
+	enum bp_state state;
+
+	BUILD_BUG_ON(XEN_UNPOPULATED_BLOCK_PAGES != BALLOON_BLOCK_NR_PAGES);
+
+	/*
+	 * Take as many blocks as balloon_deflate() populates whole, or one for
+	 * it to populate a page at a time.
+	 */
+	if (balloon_blocks_usable())
+		nr = clamp(nr_pages / BALLOON_BLOCK_NR_PAGES, 1UL,
+			   ARRAY_SIZE(heads));
+	nr = xen_alloc_unpopulated_blocks(heads, nr);
+	if (!nr) {
+		pr_warn_once("no room left for dom0 to grow into\n");
+		return BP_ECANCELED;
+	}
+
+	for (i = 0; i < nr; i++)
+		balloon_append_block(heads[i]);
+
+	state = balloon_deflate(nr_pages);
+	balloon_stats.total_pages += balloon_stats.current_pages - before;
+
+	while ((page = balloon_retrieve(false)))
+		xen_free_unpopulated_pages(1, &page);
+
+	return state;
+}
+
 static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 {
 	enum bp_state state = BP_DONE;
@@ -830,6 +872,8 @@ static int balloon_thread(void *unused)
 		if (credit > 0) {
 			if (balloon_is_inflated())
 				balloon_state = balloon_deflate(credit);
+			else if (xen_initial_domain())
+				balloon_state = balloon_grow_dom0(credit);
 			else
 				balloon_state = reserve_additional_memory();
 		}
diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index aca0f6718219bc..197a8fa5e593a9 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -31,6 +31,9 @@
  * of their node, linked through their first page as page_list[] links pages,
  * and the pages around them go on page_list[].
  *
+ * dom0's balloon takes blocks off block_list[], which Xen can populate as one
+ * extent each, and leaves each node at least MAPPING_FLOOR_PAGES free pages.
+ *
  * Mappings take pages from page_list[] only, and give them back to it.  When
  * page_list[] runs empty, a block moves onto it from block_list[].
  */
@@ -40,6 +43,13 @@ static unsigned int list_count[MAX_NUMNODES];
 static struct page *block_list[MAX_NUMNODES];
 static unsigned long block_count[MAX_NUMNODES];
 
+/*
+ * Free pages of each node that dom0's balloon leaves to mappings, so that
+ * they rarely need fill_list() to carve a region out of address space that
+ * may belong to a device.
+ */
+#define MAPPING_FLOOR_PAGES	PAGES_PER_SECTION
+
 static struct resource *target_resource;
 
 static int xen_unpopulated_clamp_node(int node)
@@ -440,6 +450,49 @@ void __init xen_unpopulated_add_range(unsigned long start_pfn,
 	mutex_unlock(&list_lock);
 }
 
+/*
+ * Blocks dom0's balloon may take from @node.  Pages on page_list[] count
+ * toward MAPPING_FLOOR_PAGES, and @node keeps enough blocks to make up the
+ * rest.
+ */
+static unsigned long spare_blocks(int node)
+{
+	unsigned long keep = 0;
+
+	if (list_count[node] < MAPPING_FLOOR_PAGES)
+		keep = DIV_ROUND_UP(MAPPING_FLOOR_PAGES - list_count[node],
+				    XEN_UNPOPULATED_BLOCK_PAGES);
+
+	return block_count[node] > keep ? block_count[node] - keep : 0;
+}
+
+/**
+ * xen_alloc_unpopulated_blocks - take 2 MiB blocks for dom0's balloon
+ * @heads: first page of each block taken
+ * @nr_blocks: number of blocks wanted
+ *
+ * Blocks come from the boot-time address space of the lowest node that can
+ * spare one and still keep MAPPING_FLOOR_PAGES free pages.  Give back the
+ * pages Xen did not populate with xen_free_unpopulated_pages(), after which
+ * they serve mappings and do not form a block again.
+ *
+ * Returns the number of blocks taken, which may be less than @nr_blocks.
+ */
+unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
+					  unsigned int nr_blocks)
+{
+	unsigned int nr = 0;
+	int node;
+
+	mutex_lock(&list_lock);
+	for (node = 0; node < MAX_NUMNODES; node++)
+		while (nr < nr_blocks && spare_blocks(node))
+			heads[nr++] = pop_block(node);
+	mutex_unlock(&list_lock);
+
+	return nr;
+}
+
 static int __init unpopulated_init(void)
 {
 	int ret;
diff --git a/include/xen/xen.h b/include/xen/xen.h
index f2ccd2bf86b327..0cf3fe3537c9d1 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -78,6 +78,8 @@ int xen_alloc_unpopulated_pages_node(unsigned int nr_pages, struct page **pages,
 int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 void xen_unpopulated_add_range(unsigned long start_pfn, unsigned long nr_pages);
+unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
+					  unsigned int nr_blocks);
 #include <linux/ioport.h>
 int arch_xen_unpopulated_init(struct resource **res);
 #else
@@ -98,6 +100,11 @@ static inline void xen_free_unpopulated_pages(unsigned int nr_pages,
 {
 	xen_free_ballooned_pages(nr_pages, pages);
 }
+static inline unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
+		unsigned int nr_blocks)
+{
+	return 0;
+}
 #endif
 
 /*

From e11b39ec49f4b2fe59fffd9fc0ee343a7c7ee2f1 Mon Sep 17 00:00:00 2001
From: "Alexander M. Merritt" <alexander@edera.dev>
Date: Tue, 27 Oct 2026 09:36:19 -0500
Subject: [PATCH 1980/1982] xen/balloon: report how far dom0 can still grow

Add `info/room_kb` to the sysfs of the xen balloon driver, so user tools
can discover the amount of memory dom0 can grow by. Reported are only
complete 2MiB blocks in the unpopulated allocator.

(cherry picked from commit f3450aa8354ae1bf0d1eeb05b9c53bdc05f9052f)
---
 drivers/xen/balloon.c           | 25 +++++++++++++++++++++++++
 drivers/xen/unpopulated-alloc.c | 19 +++++++++++++++++++
 drivers/xen/xen-balloon.c       |  2 ++
 include/xen/balloon.h           |  1 +
 include/xen/xen.h               |  5 +++++
 5 files changed, 52 insertions(+)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index cd34b0ea5bb73a..538d2000e73197 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -1012,6 +1012,31 @@ void xen_free_ballooned_pages(unsigned int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL(xen_free_ballooned_pages);
 
+/*
+ * How many pages dom0 can still grow by: the 2 MiB blocks the unpopulated
+ * allocator has to spare, within Xen's ceiling for dom0 (dom0_mem=...,max:)
+ * when one is set. Without a max: Xen reports UINT_MAX.
+ */
+unsigned long balloon_room_pages(void)
+{
+	domid_t domid = DOMID_SELF;
+	long max_pages, cur_pages;
+	unsigned long room;
+
+	if (!xen_initial_domain())
+		return 0;
+
+	room = xen_unpopulated_spare_blocks() * XEN_UNPOPULATED_BLOCK_PAGES;
+
+	max_pages = HYPERVISOR_memory_op(XENMEM_maximum_reservation, &domid);
+	cur_pages = HYPERVISOR_memory_op(XENMEM_current_reservation, &domid);
+	if (max_pages > 0 && max_pages < UINT_MAX && cur_pages > 0)
+		room = min_t(unsigned long, room,
+			     max(max_pages - cur_pages, 0L));
+
+	return room;
+}
+
 #define BALLOON_OOM_DEFLATE_BATCH 512UL /* pages per OOM event (~2 MiB) */
 
 static int balloon_oom_notify(struct notifier_block *nb, unsigned long dummy,
diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index 197a8fa5e593a9..7dacc13447b609 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -493,6 +493,25 @@ unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
 	return nr;
 }
 
+/**
+ * xen_unpopulated_spare_blocks - 2 MiB blocks dom0's balloon could still take
+ *
+ * Each node spares the blocks on its block_list[] beyond those it keeps to make
+ * up MAPPING_FLOOR_PAGES free pages.
+ */
+unsigned long xen_unpopulated_spare_blocks(void)
+{
+	unsigned long nr = 0;
+	int node;
+
+	mutex_lock(&list_lock);
+	for (node = 0; node < MAX_NUMNODES; node++)
+		nr += spare_blocks(node);
+	mutex_unlock(&list_lock);
+
+	return nr;
+}
+
 static int __init unpopulated_init(void)
 {
 	int ret;
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index bf538f12781261..07e58db1fe26f1 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -146,6 +146,7 @@ BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages));
 BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low));
 BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high));
 BALLOON_SHOW(blocks, "%lu\n", balloon_stats.balloon_blocks);
+BALLOON_SHOW(room_kb, "%lu\n", PAGES2KB(balloon_room_pages()));
 
 static DEVICE_ULONG_ATTR(schedule_delay, 0444, balloon_stats.schedule_delay);
 static DEVICE_ULONG_ATTR(max_schedule_delay, 0644, balloon_stats.max_schedule_delay);
@@ -225,6 +226,7 @@ static struct attribute *balloon_info_attrs[] = {
 	&dev_attr_low_kb.attr,
 	&dev_attr_high_kb.attr,
 	&dev_attr_blocks.attr,
+	&dev_attr_room_kb.attr,
 	NULL
 };
 
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index 4702026337e554..00a44b9d75162d 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -27,6 +27,7 @@ struct balloon_stats {
 extern struct balloon_stats balloon_stats;
 
 void balloon_set_new_target(unsigned long target);
+unsigned long balloon_room_pages(void);
 
 int xen_alloc_ballooned_pages(unsigned int nr_pages, struct page **pages);
 void xen_free_ballooned_pages(unsigned int nr_pages, struct page **pages);
diff --git a/include/xen/xen.h b/include/xen/xen.h
index 0cf3fe3537c9d1..c1eec9f7329558 100644
--- a/include/xen/xen.h
+++ b/include/xen/xen.h
@@ -80,6 +80,7 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages);
 void xen_unpopulated_add_range(unsigned long start_pfn, unsigned long nr_pages);
 unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
 					  unsigned int nr_blocks);
+unsigned long xen_unpopulated_spare_blocks(void);
 #include <linux/ioport.h>
 int arch_xen_unpopulated_init(struct resource **res);
 #else
@@ -105,6 +106,10 @@ static inline unsigned int xen_alloc_unpopulated_blocks(struct page **heads,
 {
 	return 0;
 }
+static inline unsigned long xen_unpopulated_spare_blocks(void)
+{
+	return 0;
+}
 #endif
 
 /*

From 6070b0788109544386cafaaf4843da9e7eff36a4 Mon Sep 17 00:00:00 2001
From: Kavi <15661106+kdaula@users.noreply.github.com>
Date: Tue, 3 Nov 2026 13:59:56 -0500
Subject: [PATCH 1981/1982] ci: file a Linear issue for pull requests opened
 without one

---
 .github/workflows/linear-autotrack.yml | 36 ++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/linear-autotrack.yml

diff --git a/.github/workflows/linear-autotrack.yml b/.github/workflows/linear-autotrack.yml
new file mode 100644
index 00000000000000..9dcddcd9be6fe8
--- /dev/null
+++ b/.github/workflows/linear-autotrack.yml
@@ -0,0 +1,36 @@
+name: Linear autotrack
+
+# Files a Linear issue in Core Eng (COR) for a pull request opened without one, and
+# moves it to Done when the pull request merges. Putting any Linear issue key
+# in the branch name, title or description skips it.
+#
+# Needs the LINEAR_API_KEY secret. Without it the job warns and does nothing.
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review, closed]
+
+permissions: {}
+
+concurrency:
+  group: linear-autotrack-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  autotrack:
+    # A fork's pull request gets no secrets. Bot pull requests (rebases,
+    # backports, dependency bumps) are not tracked.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository
+      && github.event.pull_request.user.type != 'Bot'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: read
+    steps:
+      - uses: edera-dev/actions/linear-autotrack@4284f52d8169e8ece1e3709f8bd488549b8a2d6c
+        with:
+          team: COR
+          linear-api-key: ${{ secrets.LINEAR_API_KEY }}

From 33f41a7eff4734aa98127e3946dcb0f2b1327ee9 Mon Sep 17 00:00:00 2001
From: Kavi <15661106+kdaula@users.noreply.github.com>
Date: Mon, 2 Nov 2026 19:46:24 -0500
Subject: [PATCH 1982/1982] 9p/xen: grant each ring page by its own frame

The data pages of a ring are granted as the first page's frame plus the
page index. That holds for auto-translated guests, whose grant frames are
pseudo-physical. A PV guest grants machine frames, and alloc_pages_exact()
only promises pseudo-physical contiguity. When the pages are not
machine-contiguous the backend maps the frames that follow the first one.
Some of those are other pages of the guest, so requests read as garbage,
and some cannot be granted at all, so the mapping fails.

A freshly built PV guest is usually machine-contiguous within a 2 MiB
block, which hid this. A PV guest restored from a snapshot gets its frames
one page at a time, so its first request on ring 0 after the restore
arrives as a malformed frame and the mount hangs.

Look up the frame of each page instead.

Signed-off-by: Kavi Daula <kavi@edera.dev>
(cherry picked from commit 8115eea00edab2921e233ea851c3b77191937ebd)
---
 net/9p/trans_xen.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index a6ef4d07a0cd4b..81ced50975d590 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -708,8 +708,8 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
 		goto out;
 	}
 	for (; i < (1 << order); i++) {
-		ret = gnttab_grant_foreign_access(
-				dev->otherend_id, virt_to_gfn(bytes) + i, 0);
+		ret = gnttab_grant_foreign_access(dev->otherend_id,
+				virt_to_gfn(bytes + i * XEN_PAGE_SIZE), 0);
 		if (ret < 0)
 			goto out;
 		ring->intf->ref[i] = ret;